Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'mscorsvw' = '<SYSTEM32>\mscorsvw.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'mscorsvw' = '<SYSTEM32>\mscorsvw.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'rscorsvw' = '<SYSTEM32>\rscorsvw.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'rscorsvw' = '<SYSTEM32>\rscorsvw.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'lssm' = '<SYSTEM32>\lssm.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'lssm' = '<SYSTEM32>\lssm.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'smls' = '<SYSTEM32>\smls.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'smls' = '<SYSTEM32>\smls.exe'
Создает или изменяет следующие файлы:
- %HOMEPATH%\Start Menu\Programs\Startup\mscorsvw.exe
- %HOMEPATH%\Start Menu\Programs\Startup\rscorsvw.exe
- %HOMEPATH%\Start Menu\Programs\Startup\lssm.exe
- %HOMEPATH%\Start Menu\Programs\Startup\smls.exe
Вредоносные функции:
Создает и запускает на исполнение:
- '<SYSTEM32>\lssm.exe'
- '<SYSTEM32>\smls.exe'
- '%HOMEPATH%\Start Menu\Programs\Startup\lssm.exe'
- '%HOMEPATH%\Start Menu\Programs\Startup\smls.exe'
Запускает на исполнение:
- '<SYSTEM32>\ntvdm.exe' -f -i3c
- '<SYSTEM32>\ntvdm.exe' -f -i3d
- '<SYSTEM32>\ntvdm.exe' -f -i3b
- '<SYSTEM32>\ntvdm.exe' -f -i39
- '<SYSTEM32>\ntvdm.exe' -f -i3a
- '<SYSTEM32>\ntvdm.exe' -f -i3e
- '<SYSTEM32>\ntvdm.exe' -f -i42
- '<SYSTEM32>\ntvdm.exe' -f -i43
- '<SYSTEM32>\ntvdm.exe' -f -i41
- '<SYSTEM32>\ntvdm.exe' -f -i3f
- '<SYSTEM32>\ntvdm.exe' -f -i40
- '<SYSTEM32>\ntvdm.exe' -f -i31
- '<SYSTEM32>\ntvdm.exe' -f -i32
- '<SYSTEM32>\ntvdm.exe' -f -i30
- '<SYSTEM32>\ntvdm.exe' -f -i2d
- '<SYSTEM32>\ntvdm.exe' -f -i2f
- '<SYSTEM32>\ntvdm.exe' -f -i33
- '<SYSTEM32>\ntvdm.exe' -f -i36
- '<SYSTEM32>\ntvdm.exe' -f -i38
- '<SYSTEM32>\ntvdm.exe' -f -i37
- '<SYSTEM32>\ntvdm.exe' -f -i35
- '<SYSTEM32>\ntvdm.exe' -f -i34
- '<SYSTEM32>\ntvdm.exe' -f -i52
- '<SYSTEM32>\ntvdm.exe' -f -i53
- '<SYSTEM32>\ntvdm.exe' -f -i51
- '<SYSTEM32>\ntvdm.exe' -f -i4f
- '<SYSTEM32>\ntvdm.exe' -f -i50
- '<SYSTEM32>\ntvdm.exe' -f -i54
- '<SYSTEM32>\ntvdm.exe' /pid=3284
- '<SYSTEM32>\ntvdm.exe' -f -i58
- '<SYSTEM32>\ntvdm.exe' -f -i56
- '<SYSTEM32>\ntvdm.exe' -f -i55
- '<SYSTEM32>\ntvdm.exe' -f -i57
- '<SYSTEM32>\ntvdm.exe' -f -i47
- '<SYSTEM32>\ntvdm.exe' -f -i48
- '<SYSTEM32>\ntvdm.exe' -f -i46
- '<SYSTEM32>\ntvdm.exe' -f -i45
- '<SYSTEM32>\ntvdm.exe' -f -i44
- '<SYSTEM32>\ntvdm.exe' -f -i49
- '<SYSTEM32>\ntvdm.exe' -f -i4d
- '<SYSTEM32>\ntvdm.exe' -f -i4e
- '<SYSTEM32>\ntvdm.exe' -f -i4c
- '<SYSTEM32>\ntvdm.exe' -f -i4a
- '<SYSTEM32>\ntvdm.exe' -f -i4b
- '<SYSTEM32>\ntvdm.exe' -f -i2e
- '<SYSTEM32>\ntvdm.exe' -f -if
- '<SYSTEM32>\ntvdm.exe' -f -i10
- '<SYSTEM32>\ntvdm.exe' -f -ie
- '<SYSTEM32>\ntvdm.exe' -f -ic
- '<SYSTEM32>\ntvdm.exe' -f -id
- '<SYSTEM32>\ntvdm.exe' -f -i11
- '<SYSTEM32>\ntvdm.exe' -f -i15
- '<SYSTEM32>\ntvdm.exe' -f -i16
- '<SYSTEM32>\ntvdm.exe' -f -i14
- '<SYSTEM32>\ntvdm.exe' -f -i12
- '<SYSTEM32>\ntvdm.exe' -f -i13
- '<SYSTEM32>\ntvdm.exe' -f -i4
- '<SYSTEM32>\ntvdm.exe' -f -i5
- '<SYSTEM32>\ntvdm.exe' -f -i3
- '<SYSTEM32>\ntvdm.exe' -f -i1
- '<SYSTEM32>\ntvdm.exe' -f -i2
- '<SYSTEM32>\ntvdm.exe' -f -i6
- '<SYSTEM32>\ntvdm.exe' -f -ia
- '<SYSTEM32>\ntvdm.exe' -f -ib
- '<SYSTEM32>\ntvdm.exe' -f -i9
- '<SYSTEM32>\ntvdm.exe' -f -i7
- '<SYSTEM32>\ntvdm.exe' -f -i8
- '<SYSTEM32>\ntvdm.exe' -f -i25
- '<SYSTEM32>\ntvdm.exe' -f -i26
- '<SYSTEM32>\ntvdm.exe' -f -i23
- '<SYSTEM32>\ntvdm.exe' -f -i22
- '<SYSTEM32>\ntvdm.exe' -f -i24
- '<SYSTEM32>\ntvdm.exe' -f -i27
- '<SYSTEM32>\ntvdm.exe' -f -i2b
- '<SYSTEM32>\ntvdm.exe' -f -i2c
- '<SYSTEM32>\ntvdm.exe' -f -i2a
- '<SYSTEM32>\ntvdm.exe' -f -i28
- '<SYSTEM32>\ntvdm.exe' -f -i29
- '<SYSTEM32>\ntvdm.exe' -f -i1a
- '<SYSTEM32>\ntvdm.exe' -f -i1c
- '<SYSTEM32>\ntvdm.exe' -f -i19
- '<SYSTEM32>\ntvdm.exe' -f -i17
- '<SYSTEM32>\ntvdm.exe' -f -i18
- '<SYSTEM32>\ntvdm.exe' -f -i1b
- '<SYSTEM32>\ntvdm.exe' -f -i20
- '<SYSTEM32>\ntvdm.exe' -f -i21
- '<SYSTEM32>\ntvdm.exe' -f -i1f
- '<SYSTEM32>\ntvdm.exe' -f -i1e
- '<SYSTEM32>\ntvdm.exe' -f -i1d
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\ntvdm.exe
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\Temp\scs62.tmp
- %WINDIR%\Temp\scs61.tmp
- %WINDIR%\Temp\scs65.tmp
- %WINDIR%\Temp\scs63.tmp
- %WINDIR%\Temp\scs60.tmp
- %WINDIR%\Temp\scs5C.tmp
- %WINDIR%\Temp\scs5D.tmp
- %WINDIR%\Temp\scs5F.tmp
- %WINDIR%\Temp\scs5E.tmp
- %WINDIR%\Temp\scs6B.tmp
- %WINDIR%\Temp\scs6A.tmp
- %WINDIR%\Temp\scs6D.tmp
- %WINDIR%\Temp\scs6C.tmp
- %WINDIR%\Temp\scs69.tmp
- %WINDIR%\Temp\scs64.tmp
- %WINDIR%\Temp\scs66.tmp
- %WINDIR%\Temp\scs68.tmp
- %WINDIR%\Temp\scs67.tmp
- %WINDIR%\Temp\scs5B.tmp
- %WINDIR%\Temp\scs4E.tmp
- %WINDIR%\Temp\scs4F.tmp
- %WINDIR%\Temp\scs51.tmp
- %WINDIR%\Temp\scs50.tmp
- %WINDIR%\Temp\scs4C.tmp
- %WINDIR%\Temp\scs4B.tmp
- %WINDIR%\Temp\scs49.tmp
- %WINDIR%\Temp\scs4D.tmp
- %WINDIR%\Temp\scs48.tmp
- %WINDIR%\Temp\scs58.tmp
- %WINDIR%\Temp\scs57.tmp
- %WINDIR%\Temp\scs5A.tmp
- %WINDIR%\Temp\scs59.tmp
- %WINDIR%\Temp\scs56.tmp
- %WINDIR%\Temp\scs53.tmp
- %WINDIR%\Temp\scs52.tmp
- %WINDIR%\Temp\scs54.tmp
- %WINDIR%\Temp\scs55.tmp
- %WINDIR%\Temp\scs6E.tmp
- %WINDIR%\Temp\scs8A.tmp
- %WINDIR%\Temp\scs87.tmp
- %WINDIR%\Temp\scs89.tmp
- %WINDIR%\Temp\scs88.tmp
- %WINDIR%\Temp\scs86.tmp
- %WINDIR%\Temp\scs83.tmp
- %WINDIR%\Temp\scs82.tmp
- %WINDIR%\Temp\scs85.tmp
- %WINDIR%\Temp\scs84.tmp
- %WINDIR%\Temp\scs8E.tmp
- %WINDIR%\Temp\scs91.tmp
- %WINDIR%\Temp\scs93.tmp
- %WINDIR%\Temp\scs92.tmp
- %WINDIR%\Temp\scs90.tmp
- %WINDIR%\Temp\scs8C.tmp
- %WINDIR%\Temp\scs8B.tmp
- %WINDIR%\Temp\scs8F.tmp
- %WINDIR%\Temp\scs8D.tmp
- %WINDIR%\Temp\scs80.tmp
- %WINDIR%\Temp\scs75.tmp
- %WINDIR%\Temp\scs74.tmp
- %WINDIR%\Temp\scs77.tmp
- %WINDIR%\Temp\scs76.tmp
- %WINDIR%\Temp\scs73.tmp
- %WINDIR%\Temp\scs6F.tmp
- %WINDIR%\Temp\scs71.tmp
- %WINDIR%\Temp\scs72.tmp
- %WINDIR%\Temp\scs70.tmp
- %WINDIR%\Temp\scs7E.tmp
- %WINDIR%\Temp\scs7D.tmp
- %WINDIR%\Temp\scs81.tmp
- %WINDIR%\Temp\scs7F.tmp
- %WINDIR%\Temp\scs7C.tmp
- %WINDIR%\Temp\scs79.tmp
- %WINDIR%\Temp\scs78.tmp
- %WINDIR%\Temp\scs7B.tmp
- %WINDIR%\Temp\scs7A.tmp
- %WINDIR%\Temp\scs4A.tmp
- %WINDIR%\Temp\scs16.tmp
- %WINDIR%\Temp\scs15.tmp
- %WINDIR%\Temp\scs19.tmp
- %WINDIR%\Temp\scs17.tmp
- %WINDIR%\Temp\scs14.tmp
- %WINDIR%\Temp\scs11.tmp
- %WINDIR%\Temp\scs10.tmp
- %WINDIR%\Temp\scs13.tmp
- %WINDIR%\Temp\scs12.tmp
- %WINDIR%\Temp\scs1F.tmp
- %WINDIR%\Temp\scs1E.tmp
- %WINDIR%\Temp\scs21.tmp
- %WINDIR%\Temp\scs20.tmp
- %WINDIR%\Temp\scs1D.tmp
- %WINDIR%\Temp\scs1A.tmp
- %WINDIR%\Temp\scs18.tmp
- %WINDIR%\Temp\scs1C.tmp
- %WINDIR%\Temp\scs1B.tmp
- %WINDIR%\Temp\scsF.tmp
- %WINDIR%\Temp\scs3.tmp
- %WINDIR%\Temp\scs2.tmp
- %WINDIR%\Temp\scs5.tmp
- %WINDIR%\Temp\scs4.tmp
- %WINDIR%\Temp\scs1.tmp
- <SYSTEM32>\smls.exe
- <SYSTEM32>\lssm.exe
- <SYSTEM32>\rscorsvw.exe
- <SYSTEM32>\mscorsvw.exe
- %WINDIR%\Temp\scsC.tmp
- %WINDIR%\Temp\scsB.tmp
- %WINDIR%\Temp\scsE.tmp
- %WINDIR%\Temp\scsD.tmp
- %WINDIR%\Temp\scsA.tmp
- %WINDIR%\Temp\scs7.tmp
- %WINDIR%\Temp\scs6.tmp
- %WINDIR%\Temp\scs9.tmp
- %WINDIR%\Temp\scs8.tmp
- %WINDIR%\Temp\scs22.tmp
- %WINDIR%\Temp\scs3A.tmp
- %WINDIR%\Temp\scs3B.tmp
- %WINDIR%\Temp\scs3E.tmp
- %WINDIR%\Temp\scs3D.tmp
- %WINDIR%\Temp\scs3C.tmp
- %WINDIR%\Temp\scs37.tmp
- %WINDIR%\Temp\scs36.tmp
- %WINDIR%\Temp\scs39.tmp
- %WINDIR%\Temp\scs38.tmp
- %WINDIR%\Temp\scs45.tmp
- %WINDIR%\Temp\scs44.tmp
- %WINDIR%\Temp\scs47.tmp
- %WINDIR%\Temp\scs46.tmp
- %WINDIR%\Temp\scs42.tmp
- %WINDIR%\Temp\scs41.tmp
- %WINDIR%\Temp\scs3F.tmp
- %WINDIR%\Temp\scs43.tmp
- %WINDIR%\Temp\scs40.tmp
- %WINDIR%\Temp\scs35.tmp
- %WINDIR%\Temp\scs29.tmp
- %WINDIR%\Temp\scs28.tmp
- %WINDIR%\Temp\scs2B.tmp
- %WINDIR%\Temp\scs2A.tmp
- %WINDIR%\Temp\scs27.tmp
- %WINDIR%\Temp\scs24.tmp
- %WINDIR%\Temp\scs23.tmp
- %WINDIR%\Temp\scs26.tmp
- %WINDIR%\Temp\scs25.tmp
- %WINDIR%\Temp\scs31.tmp
- %WINDIR%\Temp\scs32.tmp
- %WINDIR%\Temp\scs34.tmp
- %WINDIR%\Temp\scs33.tmp
- %WINDIR%\Temp\scs30.tmp
- %WINDIR%\Temp\scs2C.tmp
- %WINDIR%\Temp\scs2D.tmp
- %WINDIR%\Temp\scs2E.tmp
- %WINDIR%\Temp\scs2F.tmp
Удаляет следующие файлы:
- %WINDIR%\Temp\scs34.tmp
- %WINDIR%\Temp\scs1D.tmp
- %WINDIR%\Temp\scs33.tmp
- %WINDIR%\Temp\scs23.tmp
- %WINDIR%\Temp\scs3E.tmp
- %WINDIR%\Temp\scs3B.tmp
- %WINDIR%\Temp\scs26.tmp
- %WINDIR%\Temp\scs1C.tmp
- %WINDIR%\Temp\scs31.tmp
- %WINDIR%\Temp\scs1E.tmp
- %WINDIR%\Temp\scs28.tmp
- %WINDIR%\Temp\scs19.tmp
- %WINDIR%\Temp\scs35.tmp
- %WINDIR%\Temp\scs21.tmp
- %WINDIR%\Temp\scs2D.tmp
- %WINDIR%\Temp\scs22.tmp
- %WINDIR%\Temp\scs4F.tmp
- %WINDIR%\Temp\scs32.tmp
- %WINDIR%\Temp\scs47.tmp
- %WINDIR%\Temp\scs2E.tmp
- %WINDIR%\Temp\scs49.tmp
- %WINDIR%\Temp\scs2F.tmp
- %WINDIR%\Temp\scs4C.tmp
- %WINDIR%\Temp\scs45.tmp
- %WINDIR%\Temp\scs43.tmp
- %WINDIR%\Temp\scs27.tmp
- %WINDIR%\Temp\scs37.tmp
- %WINDIR%\Temp\scs2A.tmp
- %WINDIR%\Temp\scs2B.tmp
- %WINDIR%\Temp\scs29.tmp
- %WINDIR%\Temp\scs46.tmp
- %WINDIR%\Temp\scsB.tmp
- %WINDIR%\Temp\scs10.tmp
- %WINDIR%\Temp\scs9.tmp
- %WINDIR%\Temp\scs15.tmp
- %WINDIR%\Temp\scs8.tmp
- %WINDIR%\Temp\scs17.tmp
- %WINDIR%\Temp\scsC.tmp
- %WINDIR%\Temp\scsA.tmp
- %WINDIR%\Temp\scs2.tmp
- %WINDIR%\Temp\scs4.tmp
- %WINDIR%\Temp\scs1.tmp
- %WINDIR%\Temp\scs6.tmp
- %WINDIR%\Temp\scs5.tmp
- %WINDIR%\Temp\scs7.tmp
- %WINDIR%\Temp\scs3.tmp
- %WINDIR%\Temp\scs12.tmp
- %WINDIR%\Temp\scs13.tmp
- %WINDIR%\Temp\scs24.tmp
- %WINDIR%\Temp\scs14.tmp
- %WINDIR%\Temp\scs25.tmp
- %WINDIR%\Temp\scs16.tmp
- %WINDIR%\Temp\scs2C.tmp
- %WINDIR%\Temp\scs1B.tmp
- %WINDIR%\Temp\scs1F.tmp
- %WINDIR%\Temp\scsE.tmp
- %WINDIR%\Temp\scs18.tmp
- %WINDIR%\Temp\scsD.tmp
- %WINDIR%\Temp\scs1A.tmp
- %WINDIR%\Temp\scsF.tmp
- %WINDIR%\Temp\scs20.tmp
- %WINDIR%\Temp\scs11.tmp
Другое:
Ищет следующие окна:
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-970.560.710030'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-984.998.720031'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-13c.9a0.70002f'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-14c.148.6e002d'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-144.138.6f002e'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-69c.cc.750012'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-d4.854.770017'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-9e8.790.760014'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-9f8.a10.730011'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-a14.b4.740007'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-70.140.6d0010'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-f48.f60.670029'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-f50.f64.660028'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-f44.f58.63000b'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-f4c.f5c.64000d'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-f54.f68.65000f'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-fcc.fd8.6b002b'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-fc4.fd4.6c002c'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-fbc.fd0.6a002a'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-fb4.fc0.680001'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-fb8.fc8.690002'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-1f4.a4c.780015'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-bb8.d74.87003b'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-ae0.d98.88001e'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-d08.d48.860008'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-ba4.cac.840039'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-ba0.bd8.85003a'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-e94.e84.8c000a'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-c4c.c44.8e003e'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-e4c.c20.8b001b'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-dbc.c14.89003c'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-e0c.c5c.8a001a'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b84.c38.820037'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-a90.a98.7b0033'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-abc.ac4.7e0019'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-9e4.a94.7c0034'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-a5c.a1c.790013'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-a68.a7c.7a0032'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b98.bc8.810036'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-bfc.b74.830038'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b34.b88.7f0016'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-ac0.acc.7d0018'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b20.b50.800035'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-ef0.efc.620027'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-c90.c9c.450011'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-cb0.cb8.460002'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-c7c.c8c.440010'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-c68.c6c.420001'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-c70.c74.43000f'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-ce4.cf4.480013'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-d1c.d2c.4b0007'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-cf0.d00.4a0015'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-cd4.cd8.470012'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-ce8.cf8.490014'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-c2c.c30.40000d'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-bb8.bbc.3a0007'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-be0.be4.3b0008'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-ba0.ba4.390002'
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b74.b7c.380001'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-c20.c24.3f000c'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-c3c.c44.41000e'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-c18.c1c.3e000b'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-bf0.bf8.3c0009'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-c00.c04.3d000a'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-d38.d40.4c0016'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-e68.e7c.5a000e'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-e6c.e78.5b0021'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-e80.e90.5c0022'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-e3c.e44.580020'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-e5c.e60.59000c'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-edc.ee8.600025'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-ee0.eec.610026'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-ec8.ed0.5e0023'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-e88.e9c.5d0009'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-ed8.ee4.5f0024'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-e2c.e38.57000a'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-d6c.d78.4f0008'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-da4.db4.51001a'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-d84.d94.500019'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-d44.d54.4d0017'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-d68.d70.4e0018'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-ddc.dec.54001d'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-df4.dfc.56001f'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-dc0.dd0.53001c'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-de0.df0.55001e'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-dc4.dcc.52001b'
