"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
"abcdefghijklmnopqrstuvwxyz"
"ABCDEFGHIJKLMNOPQRSTUVWXYZ"
"zer0"
"http://%s"
"http://%s/index.php?id=%s&scn=%d&inf=%d&ver=19&cnt=%s"
"PC NETWORK PROGRAM 1.0"
"indows for Workgroups 3.1a"
"?????"
"AdjustTokenPrivileges"
"LookupPrivilegeValueA"
"OpenProcessToken"
"advapi32"
"uterm19"
"Shell_TrayWnd"
"CreateRemoteThread"
"VirtualAllocEx"
"kernel32"
"Content-Length: %u"
"HTTP/1.1 200 OK"
"GET"
"ftpupd.exe"
"user32"
"msvcrt"
"wininet"
"ws2_32"
"u19x"
"u19"
"u18"
"u17"
"u16"
"u15"
"u14"
"u13i"
"u13"
"u12"
"u11"
"u10"
"u9"
"u8"
"u18x"
"u17x"
"u16x"
"u15x"
"u14x"
"u13x"
"u12x"
"u11x"
"u10x"
"http://%s:%d/x.exe"
"SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
"Cryptographic Service"
"fgnsdrjyrsert"
"Software\Microsoft\Wireless"
"Client"
"ID"
"Windows Update"
"MS Config v13"
"avserve2.exeUpdate Service"
"avserve.exe"
"Windows Update Service"
"WinUpdate"
"SysTray"
"Bot Loader"
"System Restore Service"
"Disk Defragmenter"
"Windows Security Manager"
"VT_3"
"LookupPrivilegeValueA"
"\BaseNamedObjects\W32_Virtu"
"lstrlen"
"CreateFileA"
"CreateFileMappingA"
"CreateProcessA"
"CreateRemoteThread"
"CreateThread"
"CreateToolhelp32Snapshot"
"ExitThread"
"FileTimeToSystemTime"
"GetFileAttributesA"
"GetFileSize"
"GetFileTime"
"GetModuleHandleA"
"GetTempFileNameA"
"GetTempPathA"
"GetVersion"
"GetVersionExA"
"LoadLibraryA"
"MapViewOfFile"
"OpenFileMappingA"
"OpenProcess"
"Process32First"
"Process32Next"
"SetFileAttributesA"
"SetFileTime"
"Sleep"
"SystemTimeToFileTime"
"UnmapViewOfFile"
"VirtualAlloc"
"WriteFile"
"NtAdjustPrivilegesToken"
"NtCreateFile"
"NtCreateProcess"
"NtCreateProcessEx"
"NtCreateSection"
"NtMapViewOfSection"
"NtOpenFile"
"NtOpenProcessToken"
"NtProtectVirtualMemory"
"NtWriteVirtualMemory"
"RtlUnicodeStringToAnsiString"
"WSAStartup"
"closesocket"
"connect"
"gethostbyname"
"recv"
"send"
"socket"
"InternetCloseHandle"
"InternetGetConnectedState"
"InternetOpenA"
"InternetOpenUrlA"
"InternetReadFile"
"ADVAPI32.DLL"
"RegCloseKey"
"RegOpenKeyExA"
"RegQueryValueExA"
"RegSetValueExA"