Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\ntvdm.exe' -f -i2e
- '<SYSTEM32>\ntvdm.exe' -f -i2f
- '<SYSTEM32>\ntvdm.exe' -f -i2c
- '%WINDIR%\regedit.exe' -f -i2d
- '<SYSTEM32>\ntvdm.exe' -f -i30
- '<SYSTEM32>\ntvdm.exe' -f -i33
- '<SYSTEM32>\ntvdm.exe' -f -i34
- '<SYSTEM32>\ntvdm.exe' -f -i31
- '<SYSTEM32>\ntvdm.exe' -f -i32
- '<SYSTEM32>\ntvdm.exe' -f -i25
- '<SYSTEM32>\ntvdm.exe' -f -i26
- '<SYSTEM32>\ntvdm.exe' -f -i23
- '<SYSTEM32>\ntvdm.exe' -f -i24
- '<SYSTEM32>\ntvdm.exe' -f -i27
- '<SYSTEM32>\ntvdm.exe' -f -i2a
- '<SYSTEM32>\ntvdm.exe' -f -i2b
- '<SYSTEM32>\ntvdm.exe' -f -i28
- '%WINDIR%\regedit.exe' -f -i29
- '<SYSTEM32>\ntvdm.exe' -f -i35
- '<SYSTEM32>\ntvdm.exe' -f -i41
- '<SYSTEM32>\ntvdm.exe' -f -i42
- '<SYSTEM32>\ntvdm.exe' -f -i3f
- '<SYSTEM32>\ntvdm.exe' -f -i40
- '<SYSTEM32>\ntvdm.exe' -f -i43
- '<SYSTEM32>\ntvdm.exe' -f -i46
- '<SYSTEM32>\ntvdm.exe' -f -i47
- '<SYSTEM32>\ntvdm.exe' -f -i44
- '<SYSTEM32>\ntvdm.exe' -f -i45
- '<SYSTEM32>\ntvdm.exe' -f -i38
- '<SYSTEM32>\ntvdm.exe' -f -i39
- '<SYSTEM32>\ntvdm.exe' -f -i36
- '<SYSTEM32>\ntvdm.exe' -f -i37
- '<SYSTEM32>\ntvdm.exe' -f -i3a
- '<SYSTEM32>\ntvdm.exe' -f -i3d
- '<SYSTEM32>\ntvdm.exe' -f -i3e
- '<SYSTEM32>\ntvdm.exe' -f -i3b
- '<SYSTEM32>\ntvdm.exe' -f -i3c
- '<SYSTEM32>\ntvdm.exe' -f -i9
- '<SYSTEM32>\ntvdm.exe' -f -ia
- '<SYSTEM32>\ntvdm.exe' -f -i7
- '<SYSTEM32>\ntvdm.exe' -f -i8
- '<SYSTEM32>\ntvdm.exe' -f -ib
- '<SYSTEM32>\ntvdm.exe' -f -ie
- '<SYSTEM32>\ntvdm.exe' -f -if
- '<SYSTEM32>\ntvdm.exe' -f -ic
- '<SYSTEM32>\ntvdm.exe' -f -id
- '<SYSTEM32>\notepad.exe'
- '<SYSTEM32>\ntvdm.exe' -f -i1
- '<SYSTEM32>\calc.exe'
- '%WINDIR%\regedit.exe'
- '<SYSTEM32>\ntvdm.exe' -f -i2
- '<SYSTEM32>\ntvdm.exe' -f -i5
- '<SYSTEM32>\ntvdm.exe' -f -i6
- '<SYSTEM32>\ntvdm.exe' -f -i3
- '<SYSTEM32>\ntvdm.exe' -f -i4
- '<SYSTEM32>\ntvdm.exe' -f -i10
- '<SYSTEM32>\ntvdm.exe' -f -i1c
- '<SYSTEM32>\ntvdm.exe' -f -i1d
- '<SYSTEM32>\ntvdm.exe' -f -i1a
- '<SYSTEM32>\ntvdm.exe' -f -i1b
- '<SYSTEM32>\ntvdm.exe' -f -i1e
- '<SYSTEM32>\ntvdm.exe' -f -i21
- '<SYSTEM32>\ntvdm.exe' -f -i22
- '<SYSTEM32>\ntvdm.exe' -f -i1f
- '<SYSTEM32>\ntvdm.exe' -f -i20
- '<SYSTEM32>\ntvdm.exe' -f -i13
- '<SYSTEM32>\ntvdm.exe' -f -i14
- '<SYSTEM32>\ntvdm.exe' -f -i11
- '<SYSTEM32>\ntvdm.exe' -f -i12
- '<SYSTEM32>\ntvdm.exe' -f -i15
- '<SYSTEM32>\ntvdm.exe' -f -i18
- '<SYSTEM32>\ntvdm.exe' -f -i19
- '<SYSTEM32>\ntvdm.exe' -f -i16
- '<SYSTEM32>\ntvdm.exe' -f -i17
Внедряет код в
следующие системные процессы:
- %WINDIR%\regedit.exe
Ищет ветки реестра, отвечающие за хранение паролей сторонними программами:
- [<HKLM>\SOFTWARE\Microsoft\MessengerService]
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\Temp\scs5F.tmp
- %WINDIR%\Temp\scs5E.tmp
- %WINDIR%\Temp\scs61.tmp
- %WINDIR%\Temp\scs60.tmp
- %WINDIR%\Temp\scs5B.tmp
- %WINDIR%\Temp\scs5A.tmp
- %WINDIR%\Temp\scs5D.tmp
- %WINDIR%\Temp\scs5C.tmp
- %WINDIR%\Temp\scs62.tmp
- %WINDIR%\Temp\scs68.tmp
- %WINDIR%\Temp\scs67.tmp
- %WINDIR%\Temp\scs6A.tmp
- %WINDIR%\Temp\scs69.tmp
- %WINDIR%\Temp\scs64.tmp
- %WINDIR%\Temp\scs63.tmp
- %WINDIR%\Temp\scs66.tmp
- %WINDIR%\Temp\scs65.tmp
- %WINDIR%\Temp\scs59.tmp
- %WINDIR%\Temp\scs4D.tmp
- %WINDIR%\Temp\scs4C.tmp
- %WINDIR%\Temp\scs4F.tmp
- %WINDIR%\Temp\scs4E.tmp
- %WINDIR%\Temp\scs49.tmp
- %WINDIR%\Temp\scs48.tmp
- %WINDIR%\Temp\scs4B.tmp
- %WINDIR%\Temp\scs4A.tmp
- %WINDIR%\Temp\scs50.tmp
- %WINDIR%\Temp\scs56.tmp
- %WINDIR%\Temp\scs55.tmp
- %WINDIR%\Temp\scs58.tmp
- %WINDIR%\Temp\scs57.tmp
- %WINDIR%\Temp\scs52.tmp
- %WINDIR%\Temp\scs51.tmp
- %WINDIR%\Temp\scs54.tmp
- %WINDIR%\Temp\scs53.tmp
- %WINDIR%\Temp\scs6B.tmp
- %WINDIR%\Temp\scs83.tmp
- %WINDIR%\Temp\scs82.tmp
- %WINDIR%\Temp\scs85.tmp
- %WINDIR%\Temp\scs84.tmp
- %WINDIR%\Temp\scs7F.tmp
- %WINDIR%\Temp\scs7E.tmp
- %WINDIR%\Temp\scs81.tmp
- %WINDIR%\Temp\scs80.tmp
- %WINDIR%\Temp\scs86.tmp
- %WINDIR%\Temp\scs8C.tmp
- %WINDIR%\Temp\scs8B.tmp
- %WINDIR%\Temp\scs8E.tmp
- %WINDIR%\Temp\scs8D.tmp
- %WINDIR%\Temp\scs88.tmp
- %WINDIR%\Temp\scs87.tmp
- %WINDIR%\Temp\scs8A.tmp
- %WINDIR%\Temp\scs89.tmp
- %WINDIR%\Temp\scs7D.tmp
- %WINDIR%\Temp\scs71.tmp
- %WINDIR%\Temp\scs70.tmp
- %WINDIR%\Temp\scs73.tmp
- %WINDIR%\Temp\scs72.tmp
- %WINDIR%\Temp\scs6D.tmp
- %WINDIR%\Temp\scs6C.tmp
- %WINDIR%\Temp\scs6F.tmp
- %WINDIR%\Temp\scs6E.tmp
- %WINDIR%\Temp\scs74.tmp
- %WINDIR%\Temp\scs7A.tmp
- %WINDIR%\Temp\scs79.tmp
- %WINDIR%\Temp\scs7C.tmp
- %WINDIR%\Temp\scs7B.tmp
- %WINDIR%\Temp\scs76.tmp
- %WINDIR%\Temp\scs75.tmp
- %WINDIR%\Temp\scs78.tmp
- %WINDIR%\Temp\scs77.tmp
- %WINDIR%\Temp\scs47.tmp
- %WINDIR%\Temp\scs17.tmp
- %WINDIR%\Temp\scs16.tmp
- %WINDIR%\Temp\scs19.tmp
- %WINDIR%\Temp\scs18.tmp
- %WINDIR%\Temp\scs13.tmp
- %WINDIR%\Temp\scs12.tmp
- %WINDIR%\Temp\scs15.tmp
- %WINDIR%\Temp\scs14.tmp
- %WINDIR%\Temp\scs1A.tmp
- %WINDIR%\Temp\scs20.tmp
- %WINDIR%\Temp\scs1F.tmp
- %WINDIR%\Temp\scs22.tmp
- %WINDIR%\Temp\scs21.tmp
- %WINDIR%\Temp\scs1C.tmp
- %WINDIR%\Temp\scs1B.tmp
- %WINDIR%\Temp\scs1E.tmp
- %WINDIR%\Temp\scs1D.tmp
- %WINDIR%\Temp\scs11.tmp
- %WINDIR%\Temp\scs5.tmp
- %WINDIR%\Temp\scs4.tmp
- %WINDIR%\Temp\scs7.tmp
- %WINDIR%\Temp\scs6.tmp
- %WINDIR%\Temp\scs1.tmp
- %WINDIR%\Temp\scs3.tmp
- %WINDIR%\Temp\scs2.tmp
- %WINDIR%\Temp\scs8.tmp
- %WINDIR%\Temp\scsE.tmp
- %WINDIR%\Temp\scsD.tmp
- %WINDIR%\Temp\scs10.tmp
- %WINDIR%\Temp\scsF.tmp
- %WINDIR%\Temp\scsA.tmp
- %WINDIR%\Temp\scs9.tmp
- %WINDIR%\Temp\scsC.tmp
- %WINDIR%\Temp\scsB.tmp
- %WINDIR%\Temp\scs23.tmp
- %WINDIR%\Temp\scs3B.tmp
- %WINDIR%\Temp\scs3A.tmp
- %WINDIR%\Temp\scs3D.tmp
- %WINDIR%\Temp\scs3C.tmp
- %WINDIR%\Temp\scs37.tmp
- %WINDIR%\Temp\scs36.tmp
- %WINDIR%\Temp\scs39.tmp
- %WINDIR%\Temp\scs38.tmp
- %WINDIR%\Temp\scs3E.tmp
- %WINDIR%\Temp\scs44.tmp
- %WINDIR%\Temp\scs43.tmp
- %WINDIR%\Temp\scs46.tmp
- %WINDIR%\Temp\scs45.tmp
- %WINDIR%\Temp\scs40.tmp
- %WINDIR%\Temp\scs3F.tmp
- %WINDIR%\Temp\scs42.tmp
- %WINDIR%\Temp\scs41.tmp
- %WINDIR%\Temp\scs35.tmp
- %WINDIR%\Temp\scs29.tmp
- %WINDIR%\Temp\scs28.tmp
- %WINDIR%\Temp\scs2B.tmp
- %WINDIR%\Temp\scs2A.tmp
- %WINDIR%\Temp\scs25.tmp
- %WINDIR%\Temp\scs24.tmp
- %WINDIR%\Temp\scs27.tmp
- %WINDIR%\Temp\scs26.tmp
- %WINDIR%\Temp\scs2C.tmp
- %WINDIR%\Temp\scs32.tmp
- %WINDIR%\Temp\scs31.tmp
- %WINDIR%\Temp\scs34.tmp
- %WINDIR%\Temp\scs33.tmp
- %WINDIR%\Temp\scs2E.tmp
- %WINDIR%\Temp\scs2D.tmp
- %WINDIR%\Temp\scs30.tmp
- %WINDIR%\Temp\scs2F.tmp
Удаляет следующие файлы:
- %WINDIR%\Temp\scs5F.tmp
- %WINDIR%\Temp\scs5E.tmp
- %WINDIR%\Temp\scs61.tmp
- %WINDIR%\Temp\scs60.tmp
- %WINDIR%\Temp\scs5B.tmp
- %WINDIR%\Temp\scs5A.tmp
- %WINDIR%\Temp\scs5D.tmp
- %WINDIR%\Temp\scs5C.tmp
- %WINDIR%\Temp\scs62.tmp
- %WINDIR%\Temp\scs68.tmp
- %WINDIR%\Temp\scs67.tmp
- %WINDIR%\Temp\scs6A.tmp
- %WINDIR%\Temp\scs69.tmp
- %WINDIR%\Temp\scs64.tmp
- %WINDIR%\Temp\scs63.tmp
- %WINDIR%\Temp\scs66.tmp
- %WINDIR%\Temp\scs65.tmp
- %WINDIR%\Temp\scs59.tmp
- %WINDIR%\Temp\scs4D.tmp
- %WINDIR%\Temp\scs4C.tmp
- %WINDIR%\Temp\scs4F.tmp
- %WINDIR%\Temp\scs4E.tmp
- %WINDIR%\Temp\scs49.tmp
- %WINDIR%\Temp\scs48.tmp
- %WINDIR%\Temp\scs4B.tmp
- %WINDIR%\Temp\scs4A.tmp
- %WINDIR%\Temp\scs50.tmp
- %WINDIR%\Temp\scs56.tmp
- %WINDIR%\Temp\scs55.tmp
- %WINDIR%\Temp\scs58.tmp
- %WINDIR%\Temp\scs57.tmp
- %WINDIR%\Temp\scs52.tmp
- %WINDIR%\Temp\scs51.tmp
- %WINDIR%\Temp\scs54.tmp
- %WINDIR%\Temp\scs53.tmp
- %WINDIR%\Temp\scs6B.tmp
- %WINDIR%\Temp\scs83.tmp
- %WINDIR%\Temp\scs82.tmp
- %WINDIR%\Temp\scs85.tmp
- %WINDIR%\Temp\scs84.tmp
- %WINDIR%\Temp\scs7F.tmp
- %WINDIR%\Temp\scs7E.tmp
- %WINDIR%\Temp\scs81.tmp
- %WINDIR%\Temp\scs80.tmp
- %WINDIR%\Temp\scs86.tmp
- %WINDIR%\Temp\scs8C.tmp
- %WINDIR%\Temp\scs8B.tmp
- %WINDIR%\Temp\scs8E.tmp
- %WINDIR%\Temp\scs8D.tmp
- %WINDIR%\Temp\scs88.tmp
- %WINDIR%\Temp\scs87.tmp
- %WINDIR%\Temp\scs8A.tmp
- %WINDIR%\Temp\scs89.tmp
- %WINDIR%\Temp\scs7D.tmp
- %WINDIR%\Temp\scs71.tmp
- %WINDIR%\Temp\scs70.tmp
- %WINDIR%\Temp\scs73.tmp
- %WINDIR%\Temp\scs72.tmp
- %WINDIR%\Temp\scs6D.tmp
- %WINDIR%\Temp\scs6C.tmp
- %WINDIR%\Temp\scs6F.tmp
- %WINDIR%\Temp\scs6E.tmp
- %WINDIR%\Temp\scs74.tmp
- %WINDIR%\Temp\scs7A.tmp
- %WINDIR%\Temp\scs79.tmp
- %WINDIR%\Temp\scs7C.tmp
- %WINDIR%\Temp\scs7B.tmp
- %WINDIR%\Temp\scs76.tmp
- %WINDIR%\Temp\scs75.tmp
- %WINDIR%\Temp\scs78.tmp
- %WINDIR%\Temp\scs77.tmp
- %WINDIR%\Temp\scs18.tmp
- %WINDIR%\Temp\scs17.tmp
- %WINDIR%\Temp\scs1A.tmp
- %WINDIR%\Temp\scs19.tmp
- %WINDIR%\Temp\scs14.tmp
- %WINDIR%\Temp\scs13.tmp
- %WINDIR%\Temp\scs16.tmp
- %WINDIR%\Temp\scs15.tmp
- %WINDIR%\Temp\scs1B.tmp
- %WINDIR%\Temp\scs21.tmp
- %WINDIR%\Temp\scs20.tmp
- %WINDIR%\Temp\scs23.tmp
- %WINDIR%\Temp\scs22.tmp
- %WINDIR%\Temp\scs1D.tmp
- %WINDIR%\Temp\scs1C.tmp
- %WINDIR%\Temp\scs1F.tmp
- %WINDIR%\Temp\scs1E.tmp
- %WINDIR%\Temp\scs12.tmp
- %WINDIR%\Temp\scs6.tmp
- %WINDIR%\Temp\scs5.tmp
- %WINDIR%\Temp\scs8.tmp
- %WINDIR%\Temp\scs7.tmp
- %WINDIR%\Temp\scs2.tmp
- %WINDIR%\Temp\scs1.tmp
- %WINDIR%\Temp\scs4.tmp
- %WINDIR%\Temp\scs3.tmp
- %WINDIR%\Temp\scs9.tmp
- %WINDIR%\Temp\scsF.tmp
- %WINDIR%\Temp\scsE.tmp
- %WINDIR%\Temp\scs11.tmp
- %WINDIR%\Temp\scs10.tmp
- %WINDIR%\Temp\scsB.tmp
- %WINDIR%\Temp\scsA.tmp
- %WINDIR%\Temp\scsD.tmp
- %WINDIR%\Temp\scsC.tmp
- %WINDIR%\Temp\scs24.tmp
- %WINDIR%\Temp\scs3C.tmp
- %WINDIR%\Temp\scs3B.tmp
- %WINDIR%\Temp\scs3E.tmp
- %WINDIR%\Temp\scs3D.tmp
- %WINDIR%\Temp\scs38.tmp
- %WINDIR%\Temp\scs37.tmp
- %WINDIR%\Temp\scs3A.tmp
- %WINDIR%\Temp\scs39.tmp
- %WINDIR%\Temp\scs3F.tmp
- %WINDIR%\Temp\scs45.tmp
- %WINDIR%\Temp\scs44.tmp
- %WINDIR%\Temp\scs47.tmp
- %WINDIR%\Temp\scs46.tmp
- %WINDIR%\Temp\scs41.tmp
- %WINDIR%\Temp\scs40.tmp
- %WINDIR%\Temp\scs43.tmp
- %WINDIR%\Temp\scs42.tmp
- %WINDIR%\Temp\scs36.tmp
- %WINDIR%\Temp\scs2A.tmp
- %WINDIR%\Temp\scs29.tmp
- %WINDIR%\Temp\scs2C.tmp
- %WINDIR%\Temp\scs2B.tmp
- %WINDIR%\Temp\scs26.tmp
- %WINDIR%\Temp\scs25.tmp
- %WINDIR%\Temp\scs28.tmp
- %WINDIR%\Temp\scs27.tmp
- %WINDIR%\Temp\scs2D.tmp
- %WINDIR%\Temp\scs33.tmp
- %WINDIR%\Temp\scs32.tmp
- %WINDIR%\Temp\scs35.tmp
- %WINDIR%\Temp\scs34.tmp
- %WINDIR%\Temp\scs2F.tmp
- %WINDIR%\Temp\scs2E.tmp
- %WINDIR%\Temp\scs31.tmp
- %WINDIR%\Temp\scs30.tmp
Другое:
Ищет следующие окна:
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-1048.104c.660033'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-1070.1074.670034'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-fc0.fec.640031'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-1020.1024.650032'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-1098.109c.680035'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-1110.1114.6b0038'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-1138.113c.6c0039'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-10c0.10c4.690036'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-10e8.10ec.6a0037'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-ae0.adc.5d002a'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b34.b30.5e002b'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-a24.a20.5b0028'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-a70.ab0.5c0029'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-478.c28.5f002c'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-e3c.e38.62002f'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-f24.f20.630030'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-cb4.ce8.60002d'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b40.d78.61002e'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-1318.131c.780045'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-1340.1344.790046'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-12c8.12cc.760043'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-12f0.12f4.770044'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-1368.136c.7a0047'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-13e0.13e4.7d004a'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-1408.140c.7e004b'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-1390.1394.7b0048'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-13b8.13bc.7c0049'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-11b0.11b4.6f003c'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-11d8.11dc.70003d'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-1160.1164.6d003a'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-1188.118c.6e003b'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-1200.1204.71003e'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-1278.127c.740041'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-12a0.12a4.750042'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-1228.122c.72003f'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-1250.1254.730040'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-1f4.a64.5a0027'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-ccc.cd0.41000e'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-cfc.d00.42000f'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-c6c.c70.3f000c'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-c9c.ca0.40000d'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-d2c.d30.430010'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-dc0.dc4.460013'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-df0.df4.470014'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-d5c.d60.440011'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-d90.d94.450012'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b18.b1c.380001'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b4c.b50.390002'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b7c.b80.3a0007'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-c0c.c10.3d000a'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-c3c.c40.3e000b'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-bac.bb0.3b0008'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-bdc.be0.3c0009'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-ff8.ffc.530020'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-12c.14c.540021'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-fa8.fac.51001e'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-fd0.fd4.52001f'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-954.56c.550022'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-bc.ac.580025'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-724.734.590026'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-94c.998.560023'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-9ec.9e0.570024'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-e80.e84.4a0017'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-eb0.eb4.4b0018'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-e20.e24.480015'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-e50.e54.490016'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-ee0.ee4.4c0019'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-f58.f5c.4f001c'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-f80.f84.50001d'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-f08.f0c.4d001a'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-f30.f34.4e001b'
