For a Limited Time: Get HUGE savings on Pro and Sticky Password Premium! Act now & save 60%! BUY NOW >
  • Stay aware

    Inquietari sueti praenturis et stationibus servabantur agrariis

  • How to get the best

    Inquietari sueti praenturis et stationibus servabantur agrariis

  • Help us

    Inquietari sueti praenturis et stationibus servabantur agrariis

  • Forum

    Inquietari sueti praenturis et stationibus servabantur agrariis

Mon, 04/03/2017 - 03:03

Trojan-PSW.Win32.MSNPassword_5c3ea63a39

Trojan.Win32.StartPage.dtaa (Kaspersky), Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.Ransom.FD (Lavasoft MAS) Behaviour: Trojan-PSW, Ransom, Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

Summary

MD5: 5c3ea63a39a616b421e2d9be56c5d9f2

SHA1: 1484d25d466275a4b9d13e1a267da785c27c712b

SHA256: 0dbc4e415db9a1fffc1fd6e45fa0c825fe1b43373b0be25142b7d439fc4e44dd

SSDeep: 49152:PmPoHJF jPR6RoQXMHwDjv/1GsxqRc3FKCDKC0QprMfzcYAJVk:egHJ4rsRoQ8HmbYmwcK0B/auJVk

Size: 2603149 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171

Company: no certificate found

Created at: 2007-11-06 21:06:44

Analyzed on: Windows7 SP1 32-bit

Summary: Trojan-PSW. Trojan program intended for stealing users passwords.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan-PSW creates the following process(es):

autorun.exe:3420
Homer.exe:160
%original file name%.exe:2712

The Trojan-PSW injects its code into the following process(es):

stst.exe:3724

Mutexes

The following mutexes were created/opened: No objects were found.

File activity

The process autorun.exe:3420 makes changes in the file system.


The Trojan-PSW creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017040220170403\index.dat (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Docs\Homer.exe (1 bytes)

The Trojan-PSW deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012016101320161014\index.dat (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012016101320161014 (0 bytes)

The process Homer.exe:160 makes changes in the file system.


The Trojan-PSW creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\prefs.js (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\operaprefs.ini (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\stst.exe (1847 bytes)

The Trojan-PSW deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\__tmp_rar_sfx_access_check_335932 (0 bytes)

The process stst.exe:3724 makes changes in the file system.


The Trojan-PSW creates and/or writes to the following file(s):

C:\Windows\System32\RICHTX32.OCX (407 bytes)
C:\prefs.js (18 bytes)
C:\starter.exe (2849 bytes)
C:\operaprefs.ini (2 bytes)

The process %original file name%.exe:2712 makes changes in the file system.


The Trojan-PSW creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Audio\High1.ogg (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Buttons\grey_pill.btn (27 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Docs\Homer.exe (9321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Audio\Click1.ogg (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\autorun.cdd (1137 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ir_ext_temp_0\autorun.exe (19740 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Docs\index.html (62 bytes)

Registry activity

The process autorun.exe:3420 makes changes in the system registry.


The Trojan-PSW creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012017040220170403]
"CacheOptions" = "11"

[HKLM\SOFTWARE\Microsoft\Tracing\autorun_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012017040220170403]
"CacheRepair" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\autorun_RASMANCS]
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\autorun_RASMANCS]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012017040220170403]
"CacheLimit" = "8192"
"CachePrefix" = ":2017040220170403:"

[HKLM\SOFTWARE\Microsoft\Tracing\autorun_RASAPI32]
"FileTracingMask" = "4294901760"
"MaxFileSize" = "1048576"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\autorun_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\autorun_RASMANCS]
"FileDirectory" = "%windir%\tracing"
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\autorun_RASAPI32]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\autorun_RASMANCS]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\autorun_RASAPI32]
"ConsoleTracingMask" = "4294901760"
"EnableFileTracing" = "0"

[HKLM\System\CurrentControlSet\Control\MediaResources\DirectSound\Speaker Configuration]
"Speaker Configuration" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012017040220170403]
"CachePath" = "%USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017040220170403"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan-PSW deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016101320161014]

The Trojan-PSW deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process Homer.exe:160 makes changes in the system registry.


The Trojan-PSW creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Trojan-PSW deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process stst.exe:3724 makes changes in the system registry.


The Trojan-PSW creates and/or sets the following values in system registry:

[HKCR\Interface\{859321D0-3FD1-11CF-8981-00AA00688B10}\TypeLib]
"(Default)" = "{3B7C8863-D78F-101B-B9B5-04021C009402}"

[HKCR\Scripting.FileSystemObject]
"(Default)" = "FileSystem Object"

[HKCR\Interface\{E9A5593C-CAB0-11D1-8C0B-0000F8754DA1}\TypeLib]
"(Default)" = "{3B7C8863-D78F-101B-B9B5-04021C009402}"

[HKCR\Interface\{ED117630-4090-11CF-8981-00AA00688B10}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\CLSID\{3B7C8860-D78F-101B-B9B5-04021C009402}]
"(Default)" = "Microsoft Rich Textbox Control, version 6.0"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.anwarelbayan.com/search/"

[HKCR\Interface\{ED117630-4090-11CF-8981-00AA00688B10}\TypeLib]
"Version" = "1.2"

[HKCR\ChromeHTML\ScriptHostEncode]
"(Default)" = "{0CF774D0-F077-11D1-B1BC-00C04F86C324}"

[HKCR\CLSID\{3B7C8860-D78F-101B-B9B5-04021C009402}\TypeLib]
"(Default)" = "{3B7C8863-D78F-101B-B9B5-04021C009402}"

[HKCR\TypeLib\{3B7C8863-D78F-101B-B9B5-04021C009402}\1.2\HELPDIR]
"(Default)" = ""

[HKCR\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\InProcServer32]
"ThreadingModel" = "Apartment"

[HKCR\Interface\{859321D0-3FD1-11CF-8981-00AA00688B10}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}]
"(Default)" = "VBPropertyBag"

[HKCR\aspfile\ScriptHostEncode]
"(Default)" = "{0CF774D1-F077-11D1-B1BC-00C04F86C324}"

[HKCR\CLSID\{3B7C8860-D78F-101B-B9B5-04021C009402}\VersionIndependentProgID]
"(Default)" = "RICHTEXT.RichtextCtrl"

[HKCR\Interface\{3B7C8862-D78F-101B-B9B5-04021C009402}\TypeLib]
"Version" = "1.2"

[HKCR\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Scripting.Encoder]
"(Default)" = "Script Encoder Object"

[HKCR\RICHTEXT.RichtextCtrl\CLSID]
"(Default)" = "{3B7C8860-D78F-101B-B9B5-04021C009402}"

[HKCR\RICHTEXT.RichtextCtrl\CurVer]
"(Default)" = "RICHTEXT.RichtextCtrl.1"

[HKCR\RICHTEXT.RichtextCtrl]
"(Default)" = "Microsoft Rich Textbox Control, version 6.0"

[HKCR\Interface\{3B7C8862-D78F-101B-B9B5-04021C009402}]
"(Default)" = "DRichTextEvents"

[HKCR\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}]
"(Default)" = "IVBDataObjectFiles"

[HKCR\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\TypeLib]
"(Default)" = "{3B7C8863-D78F-101B-B9B5-04021C009402}"

[HKCR\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Scripting.Dictionary]
"(Default)" = "Scripting.Dictionary"

[HKCR\CLSID\{3B7C8860-D78F-101B-B9B5-04021C009402}\MiscStatus\1]
"(Default)" = "131473"

[HKCR\RICHTEXT.RichtextCtrl.1]
"(Default)" = "Microsoft Rich Textbox Control, version 6.0"

[HKCR\CLSID\{78E5A540-1850-11CF-9D53-00AA003C9CB6}\InprocServer32]
"(Default)" = "C:\Windows\system32\RICHTX32.OCX"

[HKCR\TypeLib\{3B7C8863-D78F-101B-B9B5-04021C009402}\1.2\FLAGS]
"(Default)" = "2"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\VBRuntime]
"TypesSupported" = "4"

[HKCR\RICHTEXT.RichtextCtrl.1\CLSID]
"(Default)" = "{3B7C8860-D78F-101B-B9B5-04021C009402}"

[HKCR\TypeLib\{3B7C8863-D78F-101B-B9B5-04021C009402}\1.2]
"(Default)" = "Microsoft Rich Textbox Control 6.0"

[HKCR\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\InProcServer32]
"(Default)" = "C:\Windows\system32\MSVBVM60.DLL"

[HKCR\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}]
"(Default)" = "IVBDataObject"

[HKCR\CLSID\{AFC634B0-4B8B-11CF-8989-00AA00688B10}\InprocServer32]
"(Default)" = "C:\Windows\system32\RICHTX32.OCX"

[HKCR\JSFile\ScriptHostEncode]
"(Default)" = "{85131630-480C-11D2-B1F9-00C04F86C324}"

[HKCR\Interface\{859321D0-3FD1-11CF-8981-00AA00688B10}]
"(Default)" = "IOLEObjects"

[HKCR\CLSID\{3B7C8860-D78F-101B-B9B5-04021C009402}\Version]
"(Default)" = "1.2"

[HKCR\CLSID\{3B7C8860-D78F-101B-B9B5-04021C009402}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{E9A5593C-CAB0-11D1-8C0B-0000F8754DA1}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{3B7C8863-D78F-101B-B9B5-04021C009402}\1.2\0\win32]
"(Default)" = "C:\Windows\system32\RICHTX32.OCX"

[HKCR\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib]
"Version" = "1.2"

[HKCR\Interface\{E9A5593C-CAB0-11D1-8C0B-0000F8754DA1}]
"(Default)" = "IRichText"

[HKCR\CLSID\{3B7C8860-D78F-101B-B9B5-04021C009402}\InprocServer32]
"(Default)" = "C:\Windows\system32\RICHTX32.OCX"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\VBRuntime]
"EventMessageFile" = "C:\Windows\system32\MSVBVM60.DLL"

[HKCR\Interface\{E9A5593C-CAB0-11D1-8C0B-0000F8754DA1}\TypeLib]
"Version" = "1.2"

[HKCR\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\TypeLib]
"Version" = "1.2"

[HKCR\Interface\{859321D0-3FD1-11CF-8981-00AA00688B10}\TypeLib]
"Version" = "1.2"

[HKCR\Interface\{859321D0-3FD1-11CF-8981-00AA00688B10}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\CLSID\{3B7C8860-D78F-101B-B9B5-04021C009402}\MiscStatus]
"(Default)" = "0"

[HKCR\CLSID\{AFC634B0-4B8B-11CF-8989-00AA00688B10}]
"(Default)" = "RichText Apppearance Property Page Object"

[HKCR\Interface\{E9A5593C-CAB0-11D1-8C0B-0000F8754DA1}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{3B7C8862-D78F-101B-B9B5-04021C009402}\TypeLib]
"(Default)" = "{3B7C8863-D78F-101B-B9B5-04021C009402}"

[HKCR\Interface\{ED117630-4090-11CF-8981-00AA00688B10}]
"(Default)" = "IOLEObject"

[HKCR\Interface\{3B7C8862-D78F-101B-B9B5-04021C009402}\ProxyStubClsid]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\Interface\{ED117630-4090-11CF-8981-00AA00688B10}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\CLSID\{78E5A540-1850-11CF-9D53-00AA003C9CB6}]
"(Default)" = "RichText General Property Page Object"

[HKCR\Interface\{3B7C8862-D78F-101B-B9B5-04021C009402}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib]
"(Default)" = "{3B7C8863-D78F-101B-B9B5-04021C009402}"

[HKCR\VBSFile\ScriptHostEncode]
"(Default)" = "{85131631-480C-11D2-B1F9-00C04F86C324}"

[HKCR\Interface\{ED117630-4090-11CF-8981-00AA00688B10}\TypeLib]
"(Default)" = "{3B7C8863-D78F-101B-B9B5-04021C009402}"

[HKCR\CLSID\{3B7C8860-D78F-101B-B9B5-04021C009402}\ToolboxBitmap32]
"(Default)" = "C:\Windows\system32\RICHTX32.OCX, 1"

[HKCR\CLSID\{3B7C8860-D78F-101B-B9B5-04021C009402}\ProgID]
"(Default)" = "RICHTEXT.RichtextCtrl.1"

[HKCR\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

To automatically run itself each time Windows is booted, the Trojan-PSW adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Start" = "C:\starter.exe"

The Trojan-PSW deletes the following registry key(s):

[HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{3B7C8860-D78F-101B-B9B5-04021C009402}]
[HKCR\CLSID\{3B7C8860-D78F-101B-B9B5-04021C009402}]
[HKCR\JSFile\ScriptHostEncode]
[HKCR\aspfile]
[HKCR\ASP.HostEncode]
[HKCR\VBSFile.HostEncode]
[HKCR\Scripting.Encoder]
[HKCR\HTML.HostEncode]
[HKCR\Scripting.FileSystemObject]
[HKCR\CLSID\{78E5A540-1850-11CF-9D53-00AA003C9CB6}]
[HKCR\JSFile.HostEncode]
[HKCR\Scripting.Dictionary]
[HKCR\VBSFile\ScriptHostEncode]
[HKCR\aspfile\ScriptHostEncode]
[HKCR\CLSID\{AFC634B0-4B8B-11CF-8989-00AA00688B10}]

The Trojan-PSW deletes the following value(s) in system registry:

[HKCR\CLSID\{78E5A540-1850-11CF-9D53-00AA003C9CB6}\InprocServer32]
"ThreadingModel"

[HKCR\CLSID\{AFC634B0-4B8B-11CF-8989-00AA00688B10}\InprocServer32]
"ThreadingModel"

Dropped PE files

MD5 File path
c6c0dcc5229759508bda68c2e51014fcc:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\stst.exe
8bb67aa40cd4a6c39db02bf90069bb17c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Docs\Homer.exe
074d9dd244b7719857cfac01665062cac:\Users\"%CurrentUserName%"\AppData\Local\Temp\ir_ext_temp_0\autorun.exe
722435ba4d18f1704b43e823a12e489ac:\Windows\System32\RICHTX32.OCX
c6c0dcc5229759508bda68c2e51014fcc:\starter.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    autorun.exe:3420
    Homer.exe:160
    %original file name%.exe:2712

  2. Delete the original Trojan-PSW file.
  3. Delete or disinfect the following files created/modified by the Trojan-PSW:

    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017040220170403\index.dat (16 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Docs\Homer.exe (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\prefs.js (18 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\operaprefs.ini (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\stst.exe (1847 bytes)
    C:\Windows\System32\RICHTX32.OCX (407 bytes)
    C:\prefs.js (18 bytes)
    C:\starter.exe (2849 bytes)
    C:\operaprefs.ini (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Audio\High1.ogg (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Buttons\grey_pill.btn (27 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Audio\Click1.ogg (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\autorun.cdd (1137 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ir_ext_temp_0\autorun.exe (19740 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Docs\index.html (62 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Start" = "C:\starter.exe"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: AutoPlay Media Studio 7.0 Launcher
Product Version: 7.1.1000.0
Legal Copyright: Runtime Engine Copyright (c) 2007 Indigo Rose Corporation (www.indigorose.com)
Legal Trademarks: AutoPlay Media Studio is a Trademark of Indigo Rose Corporation
Original Filename: ams70_launch.exe
Internal Name: ams70_launch
File Version: 7.1.1000.0
File Description: AutoPlay Application
Comments: Created with AutoPlay Media Studio 7.0
Language: English (United States)

Company Name: Product Name: AutoPlay Media Studio 7.0 Launcher Product Version: 7.1.1000.0 Legal Copyright: Runtime Engine Copyright (c) 2007 Indigo Rose Corporation (www.indigorose.com) Legal Trademarks: AutoPlay Media Studio is a Trademark of Indigo Rose Corporation Original Filename: ams70_launch.exe Internal Name: ams70_launch File Version: 7.1.1000.0 File Description: AutoPlay Application Comments: Created with AutoPlay Media Studio 7.0 Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text40961905661925124.573291481e31f0c3cb2e7fc7a35534e99b725
.rdata19660833838368643.1737adba77fd2cf0149b00b8079d8ef79fdc
.data23347240200245761.85375b316c3ee9d4b846700357adeb10688ce
.rsrc27443239320409603.29422bf52af86d56fa868551c80c0d8dcf8fc

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:


Total found: 9
c01f051c40a484051c48d15f1942ac55
524d52b70368ca2a023a88e9b7ffcbc4
ff9332208e03e31b8a6d84d9b417068b
3b7ee95ee3a18a60d30115a4c7ac5afa
b228af974dd17974a8901f5c387f09a5
c7a257855ebf534eeabd1e1314c43cc4
5fd24b8ea559630b2553d55819a2fee4
63e5b34fd63ff947c9f9ef0a758e547e
a725f62f593eb11127c249e3e13664a8

Network Activity

URLs

URL IP
hxxp://olom.info/cgi-bin/olom.cgi?Large(array{n\r})198.23.48.35
hxxp://olom.info/cgi-bin/olom.cgi?Large(array{7\3})198.23.48.35
hxxp://olom.info/cgi-bin/olom.cgi?Large(array{15\4})198.23.48.35
hxxp://olom.info/cgi-bin/olom.cgi?Large(array{4\2})198.23.48.35
hxxp://olom.info/cgi-bin/olom.cgi?Large(array{n\n-r})198.23.48.35
hxxp://olom.info/cgi-bin/olom.cgi?Large(array{10\3})198.23.48.35
hxxp://olom.info/cgi-bin/olom.cgi?Large(array{10\7})198.23.48.35
hxxp://olom.info/cgi-bin/olom.cgi?Large(array{n\y})198.23.48.35
hxxp://olom.info/cgi-bin/olom.cgi?Large(array{7\2})198.23.48.35
hxxp://olom.info/cgi-bin/olom.cgi?Large(array{n\x})198.23.48.35

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /cgi-bin/olom.cgi?\Large\(\array{7\\3}\) HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: olom.info

Connection: Keep-Alive

57.... If you entered the URL manually please check your. spelling and try again... ..2......9..</p>.<p>...48..If you think this is a server error, please contact.the <a href="mailto:..2b..[no address given]">webmaster</a>....11...</p>..<h2>Error ..21..404</h2>.<address>. <a href="/">..1c..olom.info</a><br />. <span>..29..Apache</span>.</address>.</body>.</html>...1.....0....

GET /cgi-bin/olom.cgi?\Large\(\array{4\\2}\) HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: olom.info

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Sun, 02 Apr 2017 12:28:59 GMT

Server: Apache

Vary: accept-language,accept-charset,User-Agent

Accept-Ranges: bytes

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Transfer-Encoding: chunked

Content-Type: text/html; charset=utf-8

Content-Language: en

c8..<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN". "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">.<html xmlns="hXXp://VVV.w3.org/1999/xhtml" lang="..e..en" xml:lang="..13..en">.<head>.<title>..38..Object not found!</title>.<link rev="made" href="mailto:..113..[no address given]" />.<style type="text/css"><!--/*--><![CDATA[/*><!--*/ . body { color: #000000; background-color: #FFFFFF; }. a:link { color: #0000CC; }. p, address {margin-left: 3em;}. span {font-size: smaller;}./*]]>*/--></style>.</head>..<body>.<h1>..1b..Object not found!</h1>.<p>...39.... The requested URL was not found on this server... ..57.... If you entered the URL manually please check your. spelling and try again... ..2......9..</p>.<p>...48..If you think this is a server error, please contact.the <a href="mailto:..2b..[no address given]">webmaster</a>....11...</p>..<h2>Error ..21..404</h2>.<address>. <a href="/">..1c..olom.info</a><br />. <span>..29..Apache</span>.</address>.</body>.</html>...1.....0......

<<< skipped >>>

GET /cgi-bin/olom.cgi?\Large\(\array{10\\3}\) HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: olom.info

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Sun, 02 Apr 2017 12:28:59 GMT

Server: Apache

Vary: accept-language,accept-charset,User-Agent

Accept-Ranges: bytes

Keep-Alive: timeout=5, max=99

Connection: Keep-Alive

Transfer-Encoding: chunked

Content-Type: text/html; charset=utf-8

Content-Language: en

c8..<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN". "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">.<html xmlns="hXXp://VVV.w3.org/1999/xhtml" lang="..e..en" xml:lang="..13..en">.<head>.<title>..38..Object not found!</title>.<link rev="made" href="mailto:..113..[no address given]" />.<style type="text/css"><!--/*--><![CDATA[/*><!--*/ . body { color: #000000; background-color: #FFFFFF; }. a:link { color: #0000CC; }. p, address {margin-left: 3em;}. span {font-size: smaller;}./*]]>*/--></style>.</head>..<body>.<h1>..1b..Object not found!</h1>.<p>...39.... The requested URL was not found on this server... ..57.... If you entered the URL manually please check your. spelling and try again... ..2......9..</p>.<p>...48..If you think this is a server error, please contact.the <a href="mailto:..2b..[no address given]">webmaster</a>....11...</p>..<h2>Error ..21..404</h2>.<address>. <a href="/">..1c..olom.info</a><br />. <span>..29..Apache</span>.</address>.</body>.</html>...1.....0......

<<< skipped >>>

GET /cgi-bin/olom.cgi?\Large\(\array{n\\y}\) HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: olom.info

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Sun, 02 Apr 2017 12:29:00 GMT

Server: Apache

Vary: accept-language,accept-charset,User-Agent

Accept-Ranges: bytes

Keep-Alive: timeout=5, max=98

Connection: Keep-Alive

Transfer-Encoding: chunked

Content-Type: text/html; charset=utf-8

Content-Language: en

c8..<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN". "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">.<html xmlns="hXXp://VVV.w3.org/1999/xhtml" lang="..e..en" xml:lang="..13..en">.<head>.<title>..38..Object not found!</title>.<link rev="made" href="mailto:..113..[no address given]" />.<style type="text/css"><!--/*--><![CDATA[/*><!--*/ . body { color: #000000; background-color: #FFFFFF; }. a:link { color: #0000CC; }. p, address {margin-left: 3em;}. span {font-size: smaller;}./*]]>*/--></style>.</head>..<body>.<h1>..1b..Object not found!</h1>.<p>...39.... The requested URL was not found on this server... ..57.... If you entered the URL manually please check your. spelling and try again... ..2......9..</p>.<p>...48..If you think this is a server error, please contact.the <a href="mailto:..2b..[no address given]">webmaster</a>....11...</p>..<h2>Error ..21..404</h2>.<address>. <a href="/">..1c..olom.info</a><br />. <span>..29..Apache</span>.</address>.</body>.</html>...1.....0..

<<< skipped >>>

GET /cgi-bin/olom.cgi?\Large\(\array{n\\r}\) HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: olom.info

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Sun, 02 Apr 2017 12:28:59 GMT

Server: Apache

Vary: accept-language,accept-charset,User-Agent

Accept-Ranges: bytes

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Transfer-Encoding: chunked

Content-Type: text/html; charset=utf-8

Content-Language: en

c8..<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN". "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">.<html xmlns="hXXp://VVV.w3.org/1999/xhtml" lang="..e..en" xml:lang="..13..en">.<head>.<title>..38..Object not found!</title>.<link rev="made" href="mailto:..113..[no address given]" />.<style type="text/css"><!--/*--><![CDATA[/*><!--*/ . body { color: #000000; background-color: #FFFFFF; }. a:link { color: #0000CC; }. p, address {margin-left: 3em;}. span {font-size: smaller;}./*]]>*/--></style>.</head>..<body>.<h1>..1b..Object not found!</h1>.<p>...39.... The requested URL was not found on this server... ..57.... If you entered the URL manually please check your. spelling and try again... ..2......9..</p>.<p>...48..If you think this is a server error, please contact.the <a href="mailto:..2b..[no address given]">webmaster</a>....11...</p>..<h2>Error ..21..404</h2>.<address>. <a href="/">..1c..olom.info</a><br />. <span>..29..Apache</span>.</address>.</body>.</html>...1.....0......

<<< skipped >>>

GET /cgi-bin/olom.cgi?\Large\(\array{15\\4}\) HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: olom.info

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Sun, 02 Apr 2017 12:28:59 GMT

Server: Apache

Vary: accept-language,accept-charset,User-Agent

Accept-Ranges: bytes

Keep-Alive: timeout=5, max=99

Connection: Keep-Alive

Transfer-Encoding: chunked

Content-Type: text/html; charset=utf-8

Content-Language: en

c8..<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN". "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">.<html xmlns="hXXp://VVV.w3.org/1999/xhtml" lang="..e..en" xml:lang="..13..en">.<head>.<title>..38..Object not found!</title>.<link rev="made" href="mailto:..113..[no address given]" />.<style type="text/css"><!--/*--><![CDATA[/*><!--*/ . body { color: #000000; background-color: #FFFFFF; }. a:link { color: #0000CC; }. p, address {margin-left: 3em;}. span {font-size: smaller;}./*]]>*/--></style>.</head>..<body>.<h1>..1b..Object not found!</h1>.<p>...39.... The requested URL was not found on this server... ..57.... If you entered the URL manually please check your. spelling and try again... ..2......9..</p>.<p>...48..If you think this is a server error, please contact.the <a href="mailto:..2b..[no address given]">webmaster</a>....11...</p>..<h2>Error ..21..404</h2>.<address>. <a href="/">..1c..olom.info</a><br />. <span>..29..Apache</span>.</address>.</body>.</html>...1.....0......

<<< skipped >>>

GET /cgi-bin/olom.cgi?\Large\(\array{n\\n-r}\) HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: olom.info

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Sun, 02 Apr 2017 12:28:59 GMT

Server: Apache

Vary: accept-language,accept-charset,User-Agent

Accept-Ranges: bytes

Keep-Alive: timeout=5, max=98

Connection: Keep-Alive

Transfer-Encoding: chunked

Content-Type: text/html; charset=utf-8

Content-Language: en

c8..<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN". "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">.<html xmlns="hXXp://VVV.w3.org/1999/xhtml" lang="..e..en" xml:lang="..13..en">.<head>.<title>..38..Object not found!</title>.<link rev="made" href="mailto:..113..[no address given]" />.<style type="text/css"><!--/*--><![CDATA[/*><!--*/ . body { color: #000000; background-color: #FFFFFF; }. a:link { color: #0000CC; }. p, address {margin-left: 3em;}. span {font-size: smaller;}./*]]>*/--></style>.</head>..<body>.<h1>..1b..Object not found!</h1>.<p>...39.... The requested URL was not found on this server... ..57.... If you entered the URL manually please check your. spelling and try again... ..2......9..</p>.<p>...48..If you think this is a server error, please contact.the <a href="mailto:..2b..[no address given]">webmaster</a>........

GET /cgi-bin/olom.cgi?\Large\(\array{10\\7}\) HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: olom.info

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Sun, 02 Apr 2017 12:28:59 GMT

Server: Apache

Vary: accept-language,accept-charset,User-Agent

Accept-Ranges: bytes

Keep-Alive: timeout=5, max=97

Connection: Keep-Alive

Transfer-Encoding: chunked

Content-Type: text/html; charset=utf-8

Content-Language: en

c8..<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN". "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">.<html xmlns="hXXp://VVV.w3.org/1999/xhtml" lang="..e..en" xml:lang="..13..en">.<head>.<title>..38..Object not found!</title>.<link rev="made" href="mailto:..113..[no address given]" />.<style type="text/css"><!--/*--><![CDATA[/*><!--*/ . body { color: #000000; background-color: #FFFFFF; }. a:link { color: #0000CC; }. p, address {margin-left: 3em;}. span {font-size: smaller;}./*]]>*/--></style>.</head>..<body>.<h1>..1b..Object not found!</h1>.<p>...39.... The requested URL was not found on this server... ..57.... If you entered the URL manually please check your. spelling and try again... ..2......9..</p>.<p>...48..If you think this is a server error, please contact.the <a href="mailto:..2b..[no address given]">webmaster</a>....11...</p>..<h2>Error ..21..404</h2>.<address>. <a href="/">..1c..olom.info</a><br />. <span>..29..Apache</span>.</address>.</body>.</html>...1.....0......

<<< skipped >>>

GET /cgi-bin/olom.cgi?\Large\(\array{7\\2}\) HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: olom.info

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Sun, 02 Apr 2017 12:29:00 GMT

Server: Apache

Vary: accept-language,accept-charset,User-Agent

Accept-Ranges: bytes

Keep-Alive: timeout=5, max=96

Connection: Keep-Alive

Transfer-Encoding: chunked

Content-Type: text/html; charset=utf-8

Content-Language: en

c8..<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN". "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">.<html xmlns="hXXp://VVV.w3.org/1999/xhtml" lang="..e..en" xml:lang="..13..en">.<head>.<title>..38..Object not found!</title>.<link rev="made" href="mailto:..113..[no address given]" />.<style type="text/css"><!--/*--><![CDATA[/*><!--*/ . body { color: #000000; background-color: #FFFFFF; }. a:link { color: #0000CC; }. p, address {margin-left: 3em;}. span {font-size: smaller;}./*]]>*/--></style>.</head>..<body>.<h1>..1b..Object not found!</h1>.<p>...39.... The requested URL was not found on this server... ..57.... If you entered the URL manually please check your. spelling and try again... ..2......9..</p>.<p>...48..If you think this is a server error, please contact.the <a href="mailto:..2b..[no address given]">webmaster</a>....11...</p>..<h2>Error ..21..404</h2>.<address>. <a href="/">..1c..olom.info</a><br />. <span>..29..Apache</span>.</address>.</body>.</html>...1.....0......

<<< skipped >>>

Map

The Trojan-PSW connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_2712:

)!Krz!Krz!Krz!Krz3KrzCTaz.Krz!Ksz

)!Krz!Krz!Krz!Krz3KrzCTaz.Krz!Ksz

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

u.hD3C

u.hD3C

diu2.iu

diu2.iu

deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly

deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly

inflate 1.1.3 Copyright 1995-1998 Mark Adler

inflate 1.1.3 Copyright 1995-1998 Mark Adler

%*.*f

%*.*f

CCmdTarget

CCmdTarget

commctrl_DragListMsg

commctrl_DragListMsg

COMCTL32.DLL

COMCTL32.DLL

CNotSupportedException

CNotSupportedException

MSWHEEL_ROLLMSG

MSWHEEL_ROLLMSG

__MSVCRT_HEAP_SELECT

__MSVCRT_HEAP_SELECT

user32.dll

user32.dll

GetCPInfo

GetCPInfo

KERNEL32.dll

KERNEL32.dll

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

UnhookWindowsHookEx

UnhookWindowsHookEx

SetWindowsHookExA

SetWindowsHookExA

GetKeyState

GetKeyState

CreateDialogIndirectParamA

CreateDialogIndirectParamA

USER32.dll

USER32.dll

SetViewportOrgEx

SetViewportOrgEx

OffsetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

SetViewportExtEx

ScaleViewportExtEx

ScaleViewportExtEx

GDI32.dll

GDI32.dll

comdlg32.dll

comdlg32.dll

WINSPOOL.DRV

WINSPOOL.DRV

RegCloseKey

RegCloseKey

RegCreateKeyExA

RegCreateKeyExA

RegOpenKeyExA

RegOpenKeyExA

ADVAPI32.dll

ADVAPI32.dll

SHFileOperationA

SHFileOperationA

SHELL32.dll

SHELL32.dll

COMCTL32.dll

COMCTL32.dll

End tag not completed for element %s

End tag not completed for element %s

End tag does not correspond to %s

End tag does not correspond to %s

Expecting end tag of element %s

Expecting end tag of element %s

End tag of %s element not found

End tag of %s element not found

.PAVCException@@

.PAVCException@@

"SFXSOURCE:%s"

"SFXSOURCE:%s"

%s\ir_ext_temp_%d

%s\ir_ext_temp_%d

"%s" %s

"%s" %s

.PAVCObject@@

.PAVCObject@@

.PAVCZipException@@

.PAVCZipException@@

1.1.3

1.1.3

.PAVCFileException@@

.PAVCFileException@@

%s (%s)

%s (%s)

Incorrect password set for the file being decrypted

Incorrect password set for the file being decrypted

\\?\unc\

\\?\unc\

.PAVCArchiveException@@

.PAVCArchiveException@@

.?AVCCmdTarget@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.?AVCTestCmdUI@@

.PAVCUserException@@

.PAVCUserException@@

.PAVCSimpleException@@

.PAVCSimpleException@@

.PAVCResourceException@@

.PAVCResourceException@@

.PAVCMemoryException@@

.PAVCMemoryException@@

.PAVCNotSupportedException@@

.PAVCNotSupportedException@@

.?AVCNotSupportedException@@

.?AVCNotSupportedException@@

zcÁ

zcÁ

windows

windows

KERNEL32.DLL

KERNEL32.DLL

c:\%original file name%.exe

c:\%original file name%.exe

version="7.1.1000.0"

version="7.1.1000.0"

name="autorun.exe"/>

name="autorun.exe"/>

name="Microsoft.Windows.Common-Controls"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

publicKeyToken="6595b64144ccf1df"

7.1.1000.0

7.1.1000.0

2007 Indigo Rose Corporation (VVV.indigorose.com)

2007 Indigo Rose Corporation (VVV.indigorose.com)

ams70_launch.exe

ams70_launch.exe

All Files (*.*)

All Files (*.*)

No error message is available.'An unsupported operation was attempted.$A required resource was unavailable.

No error message is available.'An unsupported operation was attempted.$A required resource was unavailable.

Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.

Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.

Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else..An unexpected error occurred while reading %1..An unexpected error occurred while writing %1.

Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else..An unexpected error occurred while reading %1..An unexpected error occurred while writing %1.

Access to %1 was denied..An invalid file handle was associated with %1.

Access to %1 was denied..An invalid file handle was associated with %1.

Seek failed on A hardware I/O error was reported while accessing %1.0A sharing violation occurred while accessing %1.0A locking violation occurred while accessing %1.

Seek failed on A hardware I/O error was reported while accessing %1.0A sharing violation occurred while accessing %1.0A locking violation occurred while accessing %1.

Disk full while accessing %1..An attempt was made to access %1 past its end.

Disk full while accessing %1..An attempt was made to access %1 past its end.

No error occurred.-An unknown error occurred while accessing %1./An attempt was made to write to the reading %1..An attempt was made to access %1 past its end.0An attempt was made to read from the writing %1.

No error occurred.-An unknown error occurred while accessing %1./An attempt was made to write to the reading %1..An attempt was made to access %1 past its end.0An attempt was made to read from the writing %1.

#Unable to load mail system support.

#Unable to load mail system support.

autorun.exe_3420:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

t.Ht&

t.Ht&

<.uef>

<.uef>

<.uoca>

<.uoca>

u.WWWWSW

u.WWWWSW

u SSSSh?

u SSSSh?

u)SSSSh?

u)SSSSh?

uUSSh

uUSSh

.FG;}

.FG;}

Ht.Ht!

Ht.Ht!

t.It"

t.It"

INIt.It

INIt.It

u.Jt$Jt

u.Jt$Jt

t.Ht Ht

t.Ht Ht

QhX%d

QhX%d

F

F

t,SSh

t,SSh

t'SSSSSSSSh

t'SSSSSSSSh

uASSh

uASSh

It.It#Iuy

It.It#Iuy

%UUUU3

%UUUU3

n%dGj

n%dGj

Pj.VQ

Pj.VQ

Qj.WP

Qj.WP

.tTPV

.tTPV

FTPjK

FTPjK

FtPj;

FtPj;

F.PjRWj

F.PjRWj

u.hhea

u.hhea

u.WWj

u.WWj

u.VVj

u.VVj

u$SShe

u$SShe

diu2.iuz

diu2.iuz

1wX!/wK(.wS

1wX!/wK(.wS

On Key

On Key

>1.2.8

>1.2.8

LIBTIFF, Version 3.7.0

LIBTIFF, Version 3.7.0

deflate 1.2.3 Copyright 1995-2003 Jean-loup Gailly

deflate 1.2.3 Copyright 1995-2003 Jean-loup Gailly

1.2.3

1.2.3

inflate 1.2.3 Copyright 1995-2005 Mark Adler

inflate 1.2.3 Copyright 1995-2005 Mark Adler

%u BitsPerSample not allowed for JPEG

%u BitsPerSample not allowed for JPEG

PhotometricInterpretation %u not allowed for JPEG

PhotometricInterpretation %u not allowed for JPEG

$Lua: Lua 5.0.2 Copyright (C) 1994-2004 Tecgraf, PUC-Rio $

$Lua: Lua 5.0.2 Copyright (C) 1994-2004 Tecgraf, PUC-Rio $

$URL: VVV.lua.org $

$URL: VVV.lua.org $

#

#

GetASPI32SupportInfo

GetASPI32SupportInfo

commctrl_DragListMsg

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

Afx:%x:%x

COMCTL32.DLL

COMCTL32.DLL

CCmdTarget

CCmdTarget

CNotSupportedException

CNotSupportedException

{X-X-X-XX-XXXXXX}

{X-X-X-XX-XXXXXX}

%*.*f

%*.*f

CHttpConnection

CHttpConnection

CHttpFile

CHttpFile

hXXp://

hXXp://

MSWHEEL_ROLLMSG

MSWHEEL_ROLLMSG

ddeexec

ddeexec

%s\ShellNew

%s\ShellNew

%s\DefaultIcon

%s\DefaultIcon

%s\shell\printto\%s

%s\shell\printto\%s

%s\shell\print\%s

%s\shell\print\%s

%s\shell\open\%s

%s\shell\open\%s

ole32.dll

ole32.dll

cmd.exe

cmd.exe

command.com

command.com

__MSVCRT_HEAP_SELECT

__MSVCRT_HEAP_SELECT

Broken pipe

Broken pipe

Inappropriate I/O control operation

Inappropriate I/O control operation

Operation not permitted

Operation not permitted

portuguese-brazilian

portuguese-brazilian

user32.dll

user32.dll

FWININET.dll

FWININET.dll

InternetCrackUrlA

InternetCrackUrlA

InternetCanonicalizeUrlA

InternetCanonicalizeUrlA

InternetOpenUrlA

InternetOpenUrlA

FtpDeleteFileA

FtpDeleteFileA

FtpRenameFileA

FtpRenameFileA

FtpCreateDirectoryA

FtpCreateDirectoryA

FtpRemoveDirectoryA

FtpRemoveDirectoryA

FtpSetCurrentDirectoryA

FtpSetCurrentDirectoryA

FtpGetCurrentDirectoryA

FtpGetCurrentDirectoryA

FtpOpenFileA

FtpOpenFileA

FtpPutFileA

FtpPutFileA

FtpGetFileA

FtpGetFileA

HttpOpenRequestA

HttpOpenRequestA

HttpAddRequestHeadersA

HttpAddRequestHeadersA

HttpSendRequestA

HttpSendRequestA

HttpEndRequestA

HttpEndRequestA

HttpSendRequestExA

HttpSendRequestExA

HttpQueryInfoA

HttpQueryInfoA

FtpFindFirstFileA

FtpFindFirstFileA

WINMM.dll

WINMM.dll

WSOCK32.dll

WSOCK32.dll

VERSION.dll

VERSION.dll

MSACM32.dll

MSACM32.dll

GetWindowsDirectoryA

GetWindowsDirectoryA

GetProcessHeap

GetProcessHeap

GetCPInfo

GetCPInfo

KERNEL32.dll

KERNEL32.dll

GetKeyState

GetKeyState

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

EnumWindows

EnumWindows

GetAsyncKeyState

GetAsyncKeyState

ExitWindowsEx

ExitWindowsEx

EnumChildWindows

EnumChildWindows

UnhookWindowsHookEx

UnhookWindowsHookEx

SetWindowsHookExA

SetWindowsHookExA

CreateDialogIndirectParamA

CreateDialogIndirectParamA

USER32.dll

USER32.dll

GetViewportExtEx

GetViewportExtEx

SetViewportExtEx

SetViewportExtEx

SetViewportOrgEx

SetViewportOrgEx

OffsetViewportOrgEx

OffsetViewportOrgEx

ScaleViewportExtEx

ScaleViewportExtEx

GDI32.dll

GDI32.dll

comdlg32.dll

comdlg32.dll

WINSPOOL.DRV

WINSPOOL.DRV

RegCloseKey

RegCloseKey

RegOpenKeyExA

RegOpenKeyExA

RegOpenKeyA

RegOpenKeyA

RegCreateKeyExA

RegCreateKeyExA

RegDeleteKeyA

RegDeleteKeyA

RegQueryInfoKeyA

RegQueryInfoKeyA

RegEnumKeyExA

RegEnumKeyExA

RegEnumKeyA

RegEnumKeyA

RegCreateKeyA

RegCreateKeyA

ADVAPI32.dll

ADVAPI32.dll

ShellExecuteA

ShellExecuteA

SHELL32.dll

SHELL32.dll

COMCTL32.dll

COMCTL32.dll

oledlg.dll

oledlg.dll

OLEPRO32.DLL

OLEPRO32.DLL

OLEAUT32.dll

OLEAUT32.dll

URLDownloadToFileA

URLDownloadToFileA

urlmon.dll

urlmon.dll

NETAPI32.dll

NETAPI32.dll

CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32

CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32

.?AVCCmdTarget@@

.?AVCCmdTarget@@

Error evaluating stack - operand stack is empty.

Error evaluating stack - operand stack is empty.

%s.%d

%s.%d

A value was expected at position %d.

A value was expected at position %d.

Missing operator before open parenthesis.

Missing operator before open parenthesis.

There is an operator missing before the open parenthesis at position %d.

There is an operator missing before the open parenthesis at position %d.

The quotation mark at position %d is missing a match.

The quotation mark at position %d is missing a match.

Operator:

Operator:

The backslash (\) at position %d must be followed by another backslash (\) or a quote (") to form a valid escape sequence.

The backslash (\) at position %d must be followed by another backslash (\) or a quote (") to form a valid escape sequence.

The closed parenthesis at position %d does not have a matching open parenthesis.

The closed parenthesis at position %d does not have a matching open parenthesis.

The open parenthesis at position %d does not have a matching closed parenthesis.

The open parenthesis at position %d does not have a matching closed parenthesis.

The closed parenthesis at position %d needs something else to the left of it.

The closed parenthesis at position %d needs something else to the left of it.

The open parenthesis at position %d needs something else to the left of it.

The open parenthesis at position %d needs something else to the left of it.

The operator at position %d needs a value to the left of it.

The operator at position %d needs a value to the left of it.

Values must be separated by operators.

Values must be separated by operators.

The value at position %d needs something else to the left of it.

The value at position %d needs something else to the left of it.

The operator at position %d needs a value to the right of it.

The operator at position %d needs a value to the right of it.

Operators must be separated by values.

Operators must be separated by values.

There can't be two %s operators in a row.

There can't be two %s operators in a row.

"%s"%s

"%s"%s

%s"%s"

%s"%s"

"%s" %s "%s"

"%s" %s "%s"

Error in operate(): no value on the operand stack

Error in operate(): no value on the operand stack

Error in operate(): not enough values on the operand stack

Error in operate(): not enough values on the operand stack

%s: %s

%s: %s

Error loading .btn file.

Error loading .btn file.

Error loading URL

Error loading URL

Unable to display object: %s is not installed.

Unable to display object: %s is not installed.

Web Object

Web Object

Windows Media Player

Windows Media Player

Failed to load button file (#%d): %d

Failed to load button file (#%d): %d

_manifest.xml

_manifest.xml

The file "%s" does not exist.

The file "%s" does not exist.

Could not load Down > Disabled image: "%s".

Could not load Down > Disabled image: "%s".

Could not load Down > Highlight image: "%s".

Could not load Down > Highlight image: "%s".

Could not load Down > Normal image: "%s".

Could not load Down > Normal image: "%s".

Could not load Up > Disabled image: "%s".

Could not load Up > Disabled image: "%s".

Could not load Up > Highlight image: "%s".

Could not load Up > Highlight image: "%s".

Could not load Up > Normal image: "%s".

Could not load Up > Normal image: "%s".

Copying "%s"

Copying "%s"

.PAVCFileException@@

.PAVCFileException@@

kernel32.dll

kernel32.dll

"%s" %s

"%s" %s

%d.%d.%d.%d

%d.%d.%d.%d

\StringFileInfo\xx\ProductVersion

\StringFileInfo\xx\ProductVersion

\StringFileInfo\xx\PrivateBuild

\StringFileInfo\xx\PrivateBuild

.bak%d

.bak%d

SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs

SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

%%x

%%x

%s %s %s %s

%s %s %s %s

%s %s

%s %s

%s v%d.%d

%s v%d.%d

Windows ME

Windows ME

Windows 98

Windows 98

Windows 95

Windows 95

Windows Vista

Windows Vista

Windows XP

Windows XP

Windows Server,XP x64

Windows Server,XP x64

Windows 2000

Windows 2000

Windows NT 4

Windows NT 4

Windows NT 3

Windows NT 3

%s\shell\open\command

%s\shell\open\command

\WININIT.INI

\WININIT.INI

NUL=%s

NUL=%s

SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Software\Microsoft\Windows NT\CurrentVersion\Fonts

Software\Microsoft\Windows NT\CurrentVersion\Fonts

Software\Microsoft\Windows\CurrentVersion\Fonts

Software\Microsoft\Windows\CurrentVersion\Fonts

***!!!***@@

***!!!***@@

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

%s\%s.lnk

%s\%s.lnk

%s\%s.url

%s\%s.url

%s\%s.pif

%s\%s.pif

*.tns

*.tns

_fonts.dat

_fonts.dat

%s_%d

%s_%d

/\:*?"|

/\:*?"|

gdi32.dll

gdi32.dll

%s\_ir_tmpfnt_%d

%s\_ir_tmpfnt_%d

MSG_INITIALIZING

MSG_INITIALIZING

Incorrect HTTP status returned by server: %d

Incorrect HTTP status returned by server: %d

.PAVCInternetException@@

.PAVCInternetException@@

Could not create Internet session: %u

Could not create Internet session: %u

Could not create HTTP connection: %u

Could not create HTTP connection: %u

Could not open request: %u

Could not open request: %u

Send request failed: %u

Send request failed: %u

WinINet.dll

WinINet.dll

d:d

d:d

.PAVCMemoryException@@

.PAVCMemoryException@@

Error downloading file: %u

Error downloading file: %u

Error writing the destination file: %d-%u

Error writing the destination file: %d-%u

Could not create HTTP connection

Could not create HTTP connection

Could not HTTP file: %u

Could not HTTP file: %u

Could not open HTTP file: %s

Could not open HTTP file: %s

.PAVCException@@

.PAVCException@@

PTF://

PTF://

hXXps://

hXXps://

jsproxy.dll

jsproxy.dll

DetectAutoProxyUrl

DetectAutoProxyUrl

wininet.dll

wininet.dll

.tiff

.tiff

.jpeg

.jpeg

.wbmp

.wbmp

End tag not completed for element %s

End tag not completed for element %s

End tag does not correspond to %s

End tag does not correspond to %s

Expecting end tag of element %s

Expecting end tag of element %s

End tag of %s element not found

End tag of %s element not found

UxTheme.dll

UxTheme.dll

*.gif

*.gif

*.pcd

*.pcd

*.psd

*.psd

*.emf

*.emf

*.apm

*.apm

*.wmf

*.wmf

*.tif

*.tif

*.tga

*.tga

*.png

*.png

*.pcx

*.pcx

*.jpg

*.jpg

*.bmp

*.bmp

.PAVCObject@@

.PAVCObject@@

.PAVCThreadException@@

.PAVCThreadException@@

local this="%s";

local this="%s";

%s -> %s -> %s

%s -> %s -> %s

local this="%s";local e_Key=%d;local e_Modifiers = {};e_Modifiers.ctrl=%s;e_Modifiers.alt=%s;e_Modifiers.shift=%s

local this="%s";local e_Key=%d;local e_Modifiers = {};e_Modifiers.ctrl=%s;e_Modifiers.alt=%s;e_Modifiers.shift=%s

local e_NodeIndex="%s";local this="%s";

local e_NodeIndex="%s";local this="%s";

local e_Key=%d;local e_Modifiers = {};e_Modifiers.ctrl=%s;e_Modifiers.alt=%s;e_Modifiers.shift=%s;local this="%s";

local e_Key=%d;local e_Modifiers = {};e_Modifiers.ctrl=%s;e_Modifiers.alt=%s;e_Modifiers.shift=%s;local this="%s";

local e_NodeIndex="%s";local e_Expanded=%s;local this="%s";

local e_NodeIndex="%s";local e_Expanded=%s;local this="%s";

local e_NodeIndex="%s";local e_Checked=%s;local this="%s";

local e_NodeIndex="%s";local e_Checked=%s;local this="%s";

local e_NodeIndex="%s";local e_NewText="%s";local e_OldText ="%s";local this="%s";

local e_NodeIndex="%s";local e_NewText="%s";local e_OldText ="%s";local this="%s";

%s%s1

%s%s1

number e_Key, table e_Modifiers

number e_Key, table e_Modifiers

local this="%s";local e_Index = %d; local e_FilePath = "%s"

local this="%s";local e_Index = %d; local e_FilePath = "%s"

%s -> %s ->

%s -> %s ->

CAutoPlayWebObject

CAutoPlayWebObject

.?AVCAutoPlayWebObject@@

.?AVCAutoPlayWebObject@@

hXXp://VVV.indigorose.com

hXXp://VVV.indigorose.com

string e_URL

string e_URL

.?AVCWebBrowser2@@

.?AVCWebBrowser2@@

WebWindow

WebWindow

local e_Key=%d;local e_Modifiers = {};e_Modifiers.ctrl=%s;e_Modifiers.alt=%s;e_Modifiers.shift=%s;local this="%s"

local e_Key=%d;local e_Modifiers = {};e_Modifiers.ctrl=%s;e_Modifiers.alt=%s;e_Modifiers.shift=%s;local this="%s"

local e_Selection=%d;local this="%s"

local e_Selection=%d;local this="%s"

%s;local this="%s"

%s;local this="%s"

local e_Min=%d;local e_Max = %d;local e_Link = "%s";local this="%s"

local e_Min=%d;local e_Max = %d;local e_Link = "%s";local this="%s"

local e_Min=%d;local e_Max = %d;local this="%s"

local e_Min=%d;local e_Max = %d;local this="%s"

local e_Key=%d;local e_Modifiers = {};e_Modifiers.ctrl=%s;e_Modifiers.alt=%s;e_Modifiers.shift=%s

local e_Key=%d;local e_Modifiers = {};e_Modifiers.ctrl=%s;e_Modifiers.alt=%s;e_Modifiers.shift=%s

Proxy-Authorization: Basic %s

Proxy-Authorization: Basic %s

KERNEL32.DLL

KERNEL32.DLL

PSAPI.DLL

PSAPI.DLL

WS2_32.DLL

WS2_32.DLL

windows

windows

CWebBrowser2

CWebBrowser2

MakeKeywordIndex

MakeKeywordIndex

SearchKeywords

SearchKeywords

__NOREPORT__

__NOREPORT__

Keywords

Keywords

TRACE: LastError = %d ("%s")

TRACE: LastError = %d ("%s")

PasswordInput

PasswordInput

All Files (*.*)|*.*|

All Files (*.*)|*.*|

Page.Jump("

Page.Jump("

.PAVCResourceException@@

.PAVCResourceException@@

MSG_MOVING

MSG_MOVING

MSG_COPYING

MSG_COPYING

MSG_FROM_CAP

MSG_FROM_CAP

MSG_TO_CAP

MSG_TO_CAP

MSG_DELETING

MSG_DELETING

MSG_SEARCHING

MSG_SEARCHING

OpenURL

OpenURL

\StringFileInfo\xx\SpecialBuild

\StringFileInfo\xx\SpecialBuild

\StringFileInfo\xx\OriginalFilename

\StringFileInfo\xx\OriginalFilename

\StringFileInfo\xx\Comments

\StringFileInfo\xx\Comments

\StringFileInfo\xx\LegalTrademarks

\StringFileInfo\xx\LegalTrademarks

\StringFileInfo\xx\LegalCopyright

\StringFileInfo\xx\LegalCopyright

\StringFileInfo\xx\ProductName

\StringFileInfo\xx\ProductName

\StringFileInfo\xx\InternalName

\StringFileInfo\xx\InternalName

\StringFileInfo\xx\FileDescription

\StringFileInfo\xx\FileDescription

\StringFileInfo\xx\CompanyName

\StringFileInfo\xx\CompanyName

ErrorMsg

ErrorMsg

%Y-%m-%dT%H:%M:%S

%Y-%m-%dT%H:%M:%S

%A, %B %d, %Y

%A, %B %d, %Y

MSG_NOTICE

MSG_NOTICE

MSG_INSTALL_DO_YOU_WANT_OVERWRITE

MSG_INSTALL_DO_YOU_WANT_OVERWRITE

MSG_INSTALL_ALWAYS_ASK_OVERWRITE_MSG

MSG_INSTALL_ALWAYS_ASK_OVERWRITE_MSG

MSG_INSTALL_FILE_OLDER_MSG

MSG_INSTALL_FILE_OLDER_MSG

MSG_INSTALLING

MSG_INSTALLING

RunMsiexec

RunMsiexec

\msi.dll

\msi.dll

msi.dll

msi.dll

Software\Microsoft\Windows\CurrentVersion\Installer

Software\Microsoft\Windows\CurrentVersion\Installer

\msiexec.exe

\msiexec.exe

Page.Jump does not work during a Page Preview

Page.Jump does not work during a Page Preview

Page.Navigate does not work during a Page Preview

Page.Navigate does not work during a Page Preview

AutoDetectURL

AutoDetectURL

AlwaysShowSelection

AlwaysShowSelection

GetKeyNames

GetKeyNames

DoesKeyExist

DoesKeyExist

DeleteKey

DeleteKey

CreateKey

CreateKey

keycode

keycode

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

MSG_SIZE_GIGABYTES

MSG_SIZE_GIGABYTES

MSG_SIZE_MEGABYTES

MSG_SIZE_MEGABYTES

MSG_SIZE_KILOBYTES

MSG_SIZE_KILOBYTES

MSG_SIZE_BYTES

MSG_SIZE_BYTES

IsKeyDown

IsKeyDown

%s-%s-%s

%s-%s-%s

%s/%s/%s

%s/%s/%s

%d:%s:%s AM

%d:%s:%s AM

%d:%s:%s PM

%d:%s:%s PM

%s:%s:%s

%s:%s:%s

Windows Server 2003

Windows Server 2003

xxxxxx

xxxxxx

Software\Microsoft\Windows NT\CurrentVersion

Software\Microsoft\Windows NT\CurrentVersion

MSG_ERROR

MSG_ERROR

MSG_REBOOT_FAILED

MSG_REBOOT_FAILED

LoadURL

LoadURL

GetURL

GetURL

GetHTTPErrorInfo

GetHTTPErrorInfo

PPassword

PPassword

Password

Password

%s %s %s %s (%0.2f %s)

%s %s %s %s (%0.2f %s)

%0.1f %s/%0.1f %s

%0.1f %s/%0.1f %s

%u %s/%u %s

%u %s/%u %s

MSG_KB_PER_SEC

MSG_KB_PER_SEC

MSG_ESTIMATED_TIME_LEFT

MSG_ESTIMATED_TIME_LEFT

MSG_FROM

MSG_FROM

MSG_SAVING

MSG_SAVING

MSG_DOWNLOADING

MSG_DOWNLOADING

WININET.DLL

WININET.DLL

MSG_QUERYING_INTERNET

MSG_QUERYING_INTERNET

MSG_READING

MSG_READING

%s/%s

%s/%s

%s (0x%2x)

%s (0x%2x)

Cannot play back the video stream: format 'RPZA' is not supported.

Cannot play back the video stream: format 'RPZA' is not supported.

Some of the streams in this movie are in an unsupported format.

Some of the streams in this movie are in an unsupported format.

Use of this filter is restricted by a software key. The application must unlock the filter.

Use of this filter is restricted by a software key. The application must unlock the filter.

Frame stepping is not supported.

Frame stepping is not supported.

This operation is not permitted in the current domain.

This operation is not permitted in the current domain.

This user operation is inhibited by DVD content at this time.

This user operation is inhibited by DVD content at this time.

No video port hardware is available, or the hardware is not responding.

No video port hardware is available, or the hardware is not responding.

The video port connection negotiation process has failed.

The video port connection negotiation process has failed.

Pins cannot connect because they don't support the same transport.

Pins cannot connect because they don't support the same transport.

Cannot play back the file: the format is not supported.

Cannot play back the file: the format is not supported.

Cannot play back the video stream: the video format is not supported.

Cannot play back the video stream: the video format is not supported.

Cannot play back the audio stream: the audio format is not supported.

Cannot play back the audio stream: the audio format is not supported.

Cannot play back the audio stream: no audio hardware is available, or the hardware is not supported.

Cannot play back the audio stream: no audio hardware is available, or the hardware is not supported.

The operation could not be performed because the filter is in the wrong state

The operation could not be performed because the filter is in the wrong state

The operation could not be performed because the filter is not running.

The operation could not be performed because the filter is not running.

The operation could not be performed because the filter is not paused.

The operation could not be performed because the filter is not paused.

The operation could not be performed because the filter is not stopped.

The operation could not be performed because the filter is not stopped.

No matching color key is available.

No matching color key is available.

Setting a palette would conflict with the color key already set.

Setting a palette would conflict with the color key already set.

Setting a color key would conflict with the palette already set.

Setting a color key would conflict with the palette already set.

Current pin connection is not using the IMemInputPin transport.

Current pin connection is not using the IMemInputPin transport.

Current pin connection is not using the IOverlay transport.

Current pin connection is not using the IOverlay transport.

No color key has been set.

No color key has been set.

The operation cannot be performed because the pins are not connected.

The operation cannot be performed because the pins are not connected.

One of the specified pins supports no media types.

One of the specified pins supports no media types.

At least one of the pins involved in the operation is already connected.

At least one of the pins involved in the operation is already connected.

This operation cannot be performed because the filter is active.

This operation cannot be performed because the filter is active.

font%d.dat

font%d.dat

Advapi32.dll

Advapi32.dll

MSG_REDIRECTING

MSG_REDIRECTING

MSG_STATUS_REQUEST_COMPLETE

MSG_STATUS_REQUEST_COMPLETE

MSG_STATUS_HANDLE_CLOSING

MSG_STATUS_HANDLE_CLOSING

MSG_STATUS_HANDLE_CREATED

MSG_STATUS_HANDLE_CREATED

MSG_CONNECTION_CLOSED

MSG_CONNECTION_CLOSED

MSG_CLOSING_CONNECTION

MSG_CLOSING_CONNECTION

MSG_CONNECTED_TO_SERVER

MSG_CONNECTED_TO_SERVER

MSG_CONNECTING_TO_SERVER

MSG_CONNECTING_TO_SERVER

MSG_HOST_NAME_RESOLVED

MSG_HOST_NAME_RESOLVED

MSG_RESOLVING_HOST_NAME

MSG_RESOLVING_HOST_NAME

%s, Line %d: %s

%s, Line %d: %s

[%d]: %s

[%d]: %s

*** LOCATION: %s

*** LOCATION: %s

local e_WindowWidth = %d; local e_WindowHeight = %d; local e_PageWidth = %d; local e_PageHeight = %d; local e_Type = %d;local this="%s";

local e_WindowWidth = %d; local e_WindowHeight = %d; local e_PageWidth = %d; local e_PageHeight = %d; local e_Type = %d;local this="%s";

%s -> %s

%s -> %s

local e_WindowWidth = %d; local e_WindowHeight = %d; local e_PageWidth = %d; local e_PageHeight = %d; local e_Type = %d;

local e_WindowWidth = %d; local e_WindowHeight = %d; local e_PageWidth = %d; local e_PageHeight = %d; local e_Type = %d;

Project -> %s

Project -> %s

local e_ID = %d;%s;local this="%s"

local e_ID = %d;%s;local this="%s"

local e_ID = %d;%s

local e_ID = %d;%s

local e_ItemInfo = {}; e_ItemInfo.Text="%s";e_ItemInfo.ID=%d; e_ItemInfo.Checked=%s;e_ItemInfo.Enabled=%s

local e_ItemInfo = {}; e_ItemInfo.Text="%s";e_ItemInfo.ID=%d; e_ItemInfo.Checked=%s;e_ItemInfo.Enabled=%s

0.0.0.0

0.0.0.0

%s >= %s

%s >= %s

__IR_TEMP_DETECT_VER = %s();

__IR_TEMP_DETECT_VER = %s();

RICHED32.DLL

RICHED32.DLL

RICHED20.DLL

RICHED20.DLL

comctl32.dll

comctl32.dll

Failed to initialize sound system: %s

Failed to initialize sound system: %s

{19813504-68A4-EFEC-925D-B3CD087B8175}

{19813504-68A4-EFEC-925D-B3CD087B8175}

_proj.dat

_proj.dat

Recording not supported on this device

Recording not supported on this device

An invalid parameter was passed to this function

An invalid parameter was passed to this function

The version number of this file format is not supported

The version number of this file format is not supported

Error setting cooperative level for hardware.

Error setting cooperative level for hardware.

Soundcard does not support the features needed for this soundsystem (16bit stereo output)

Soundcard does not support the features needed for this soundsystem (16bit stereo output)

and can not be run with the commercial version's runtime executable.

and can not be run with the commercial version's runtime executable.

Detection script: %s

Detection script: %s

_detect.dat

_detect.dat

MissingAXHelpURL

MissingAXHelpURL

?;%s\AutoPlay\Scripts\?;%s\AutoPlay\Scripts\?.lua;%s\?.lua;%s\?;

?;%s\AutoPlay\Scripts\?;%s\AutoPlay\Scripts\?.lua;%s\?.lua;%s\?;

Failed to load plugin: %s (#%d)

Failed to load plugin: %s (#%d)

Debug.ShowWindow(true);

Debug.ShowWindow(true);

Debug.SetTraceMode(true);

Debug.SetTraceMode(true);

%s\menu1.dah

%s\menu1.dah

local e_X = %d; local e_Y = %d;local this="%s";

local e_X = %d; local e_Y = %d;local this="%s";

local e_Type = %d; local e_X = %d; local e_Y = %d;local this="%s";

local e_Type = %d; local e_X = %d; local e_Y = %d;local this="%s";

local e_Type = %d; local e_X = %d; local e_Y = %d; local this="%s";

local e_Type = %d; local e_X = %d; local e_Y = %d; local this="%s";

local this="%s";local e_FSCommand="%s";local e_FSArgs="%s";

local this="%s";local e_FSCommand="%s";local e_FSArgs="%s";

local this="%s";local e_URL="%s";

local this="%s";local e_URL="%s";

local this="%s";local e_Channel=%d;local e_State="%s"

local this="%s";local e_Channel=%d;local e_State="%s"

local e_Type = %d; local e_X = %d; local e_Y = %d;local this="%s"

local e_Type = %d; local e_X = %d; local e_Y = %d;local this="%s"

local e_Type = %d; local e_X = %d; local e_Y = %d

local e_Type = %d; local e_X = %d; local e_Y = %d

Created with AutoPlay Media Studio 7.0 Trial - hXXp://VVV.indigorose.com

Created with AutoPlay Media Studio 7.0 Trial - hXXp://VVV.indigorose.com

%Program Files%

%Program Files%

C:\Temp

C:\Temp

_WindowsFolder

_WindowsFolder

IS 3.0.58.3

IS 3.0.58.3

DIBToHBITMAP error: GetLastError = %d

DIBToHBITMAP error: GetLastError = %d

SetWinMetaFileBits failed GetLastError = %d

SetWinMetaFileBits failed GetLastError = %d

read %d. layersLen %d

read %d. layersLen %d

ISLib PNG Error : %s

ISLib PNG Error : %s

1.2.8

1.2.8

Reading PCD sub-image #%d (%d x %d)

Reading PCD sub-image #%d (%d x %d)

ISLib JPG Error : %s

ISLib JPG Error : %s

ISLib JPG marker # %d, len: %d

ISLib JPG marker # %d, len: %d

ISLib JPG comment : %s

ISLib JPG comment : %s

Found bad IPTC data resource (len exceeds block end). ID=%d

Found bad IPTC data resource (len exceeds block end). ID=%d

NULL row buffer for row %ld, pass %d

NULL row buffer for row %ld, pass %d

libpng error: %s

libpng error: %s

libpng error: %s, offset=%d

libpng error: %s, offset=%d

libpng error no. %s: %s

libpng error no. %s: %s

libpng warning: %s

libpng warning: %s

libpng warning no. %s: %s

libpng warning no. %s: %s

iTXt chunk not supported.

iTXt chunk not supported.

GeoKeyDirectory

GeoKeyDirectory

%s: Cannot modify tag "%s" while writing

%s: Cannot modify tag "%s" while writing

%s: Unknown %stag %u

%s: Unknown %stag %u

%s: Bad value %f for "%s"

%s: Bad value %f for "%s"

%s: Invalid %stag "%s" (not supported by codec)

%s: Invalid %stag "%s" (not supported by codec)

%s: Bad field type %d for "%s"

%s: Bad field type %d for "%s"

%s: Pass by value is not implemented.

%s: Pass by value is not implemented.

%s: Failed to allocate space for list of custom values

%s: Failed to allocate space for list of custom values

%s: Bad value %ld for "%s"

%s: Bad value %ld for "%s"

%s: Bad value %d for "%s"

%s: Bad value %d for "%s"

%s: Sorry, cannot nest SubIFDs

%s: Sorry, cannot nest SubIFDs

Nonstandard tile length %d, convert file

Nonstandard tile length %d, convert file

Nonstandard tile width %d, convert file

Nonstandard tile width %d, convert file

Bad value %ld for "%s" tag ignored

Bad value %ld for "%s" tag ignored

%s: Invalid InkNames value; expecting %d names, found %d

%s: Invalid InkNames value; expecting %d names, found %d

%s: Error fetching directory count

%s: Error fetching directory count

%s: Error fetching directory link

%s: Error fetching directory link

Sorry, can not handle images with %d-bit samples

Sorry, can not handle images with %d-bit samples

Sorry, LogL data must have %s=%d

Sorry, LogL data must have %s=%d

Sorry, can not handle LogLuv images with %s=%d

Sorry, can not handle LogLuv images with %s=%d

Sorry, LogLuv data must have %s=%d or %d

Sorry, LogLuv data must have %s=%d or %d

Sorry, can not handle image with %s=%d

Sorry, can not handle image with %s=%d

Sorry, can not handle YCbCr images with %s=%d

Sorry, can not handle YCbCr images with %s=%d

Sorry, can not handle contiguous data with %s=%d, and %s=%d

Sorry, can not handle contiguous data with %s=%d, and %s=%d

Sorry, can not handle contiguous data with %s=%d, and %s=%d and Bits/Sample=%d

Sorry, can not handle contiguous data with %s=%d, and %s=%d and Bits/Sample=%d

Sorry, can not handle RGB image with %s=%d

Sorry, can not handle RGB image with %s=%d

Sorry, can not handle separated image with %s=%d

Sorry, can not handle separated image with %s=%d

Missing needed %s tag

Missing needed %s tag

%s: Read error at scanline %lu, strip %lu; got %lu bytes, expected %lu

%s: Read error at scanline %lu, strip %lu; got %lu bytes, expected %lu

%s: Read error at scanline %lu; got %lu bytes, expected %lu

%s: Read error at scanline %lu; got %lu bytes, expected %lu

%s: Seek error at scanline %lu, strip %lu

%s: Seek error at scanline %lu, strip %lu

%s: Data buffer too small to hold strip %lu

%s: Data buffer too small to hold strip %lu

%s: Read error on strip %lu; got %lu bytes, expected %lu

%s: Read error on strip %lu; got %lu bytes, expected %lu

%s: Read error at row %ld, col %ld, tile %ld; got %lu bytes, expected %lu

%s: Read error at row %ld, col %ld, tile %ld; got %lu bytes, expected %lu

%s: Read error at row %ld, col %ld; got %lu bytes, expected %lu

%s: Read error at row %ld, col %ld; got %lu bytes, expected %lu

%s: Seek error at row %ld, col %ld, tile %ld

%s: Seek error at row %ld, col %ld, tile %ld

%s: Data buffer too small to hold tile %ld

%s: Data buffer too small to hold tile %ld

%s: No space for data buffer at scanline %ld

%s: No space for data buffer at scanline %ld

Integer overflow in %s

Integer overflow in %s

"%s": Bad mode

"%s": Bad mode

Not a TIFF file, bad version number %d (0x%x)

Not a TIFF file, bad version number %d (0x%x)

This is a BigTIFF file. This format not supported

This is a BigTIFF file. This format not supported

Not a TIFF file, bad magic number %d (0x%x)

Not a TIFF file, bad magic number %d (0x%x)

%s: Out of memory (TIFF structure)

%s: Out of memory (TIFF structure)

Corrupt JPEG data: found marker 0xx instead of RST%d

Corrupt JPEG data: found marker 0xx instead of RST%d

Warning: unknown JFIF revision number %d.d

Warning: unknown JFIF revision number %d.d

Corrupt JPEG data: %u extraneous bytes before marker 0xx

Corrupt JPEG data: %u extraneous bytes before marker 0xx

Inconsistent progression sequence for component %d coefficient %d

Inconsistent progression sequence for component %d coefficient %d

Unknown Adobe color transform code %d

Unknown Adobe color transform code %d

Obtained XMS handle %u

Obtained XMS handle %u

Freed XMS handle %u

Freed XMS handle %u

Unrecognized component IDs %d %d %d, assuming YCbCr

Unrecognized component IDs %d %d %d, assuming YCbCr

JFIF extension marker: RGB thumbnail image, length %u

JFIF extension marker: RGB thumbnail image, length %u

JFIF extension marker: palette thumbnail image, length %u

JFIF extension marker: palette thumbnail image, length %u

JFIF extension marker: JPEG-compressed thumbnail image, length %u

JFIF extension marker: JPEG-compressed thumbnail image, length %u

Opened temporary file %s

Opened temporary file %s

Closed temporary file %s

Closed temporary file %s

Ss=%d, Se=%d, Ah=%d, Al=%d

Ss=%d, Se=%d, Ah=%d, Al=%d

Component %d: dc=%d ac=%d

Component %d: dc=%d ac=%d

Start Of Scan: %d components

Start Of Scan: %d components

Component %d: %dhx%dv q=%d

Component %d: %dhx%dv q=%d

Start Of Frame 0xx: width=%u, height=%u, components=%d

Start Of Frame 0xx: width=%u, height=%u, components=%d

Smoothing not supported with nonstandard sampling ratios

Smoothing not supported with nonstandard sampling ratios

RST%d

RST%d

At marker 0xx, recovery action %d

At marker 0xx, recovery action %d

Selected %d colors for quantization

Selected %d colors for quantization

Quantizing to %d colors

Quantizing to %d colors

Quantizing to %d = %d*%d*%d colors

Quantizing to %d = %d*%d*%d colors

%4u %4u %4u %4u %4u %4u %4u %4u

%4u %4u %4u %4u %4u %4u %4u %4u

Unexpected marker 0xx

Unexpected marker 0xx

Miscellaneous marker 0xx, length %u

Miscellaneous marker 0xx, length %u

with %d x %d thumbnail image

with %d x %d thumbnail image

JFIF extension marker: type 0xx, length %u

JFIF extension marker: type 0xx, length %u

Warning: thumbnail image size does not match data length %u

Warning: thumbnail image size does not match data length %u

JFIF APP0 marker: version %d.d, density %dx%d %d

JFIF APP0 marker: version %d.d, density %dx%d %d

= = = = = = = =

= = = = = = = =

Obtained EMS handle %u

Obtained EMS handle %u

Freed EMS handle %u

Freed EMS handle %u

Define Restart Interval %u

Define Restart Interval %u

Define Quantization Table %d precision %d

Define Quantization Table %d precision %d

Define Huffman Table 0xx

Define Huffman Table 0xx

Define Arithmetic Table 0xx: 0xx

Define Arithmetic Table 0xx: 0xx

Unknown APP14 marker (not Adobe), length %u

Unknown APP14 marker (not Adobe), length %u

Unknown APP0 marker (not JFIF), length %u

Unknown APP0 marker (not JFIF), length %u

Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d

Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d

Unsupported marker type 0xx

Unsupported marker type 0xx

Failed to create temporary file %s

Failed to create temporary file %s

Unsupported JPEG process: SOF type 0xx

Unsupported JPEG process: SOF type 0xx

Cannot quantize to more than %d colors

Cannot quantize to more than %d colors

Cannot quantize to fewer than %d colors

Cannot quantize to fewer than %d colors

Cannot quantize more than %d color components

Cannot quantize more than %d color components

Insufficient memory (case %d)

Insufficient memory (case %d)

Not a JPEG file: starts with 0xx 0xx

Not a JPEG file: starts with 0xx 0xx

Quantization table 0xx was not defined

Quantization table 0xx was not defined

Huffman table 0xx was not defined

Huffman table 0xx was not defined

Backing store not supported

Backing store not supported

Cannot transcode due to multiple use of quantization table %d

Cannot transcode due to multiple use of quantization table %d

Maximum supported image dimension is %u pixels

Maximum supported image dimension is %u pixels

Empty JPEG image (DNL not supported)

Empty JPEG image (DNL not supported)

Bogus DQT index %d

Bogus DQT index %d

Bogus DHT index %d

Bogus DHT index %d

Bogus DAC value 0x%x

Bogus DAC value 0x%x

Bogus DAC index %d

Bogus DAC index %d

Unsupported color conversion request

Unsupported color conversion request

Too many color components: %d, max %d

Too many color components: %d, max %d

Buffer passed to JPEG library is too small

Buffer passed to JPEG library is too small

JPEG parameter struct mismatch: library thinks size is %u, caller expects %u

JPEG parameter struct mismatch: library thinks size is %u, caller expects %u

Improper call to JPEG library in state %d

Improper call to JPEG library in state %d

Invalid scan script at entry %d

Invalid scan script at entry %d

Invalid progressive parameters at scan script entry %d

Invalid progressive parameters at scan script entry %d

Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d

Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d

Unsupported JPEG data precision %d

Unsupported JPEG data precision %d

Invalid memory pool code %d

Invalid memory pool code %d

Wrong JPEG library version: library is %d, caller expects %d

Wrong JPEG library version: library is %d, caller expects %d

IDCT output block size %d not supported

IDCT output block size %d not supported

Invalid component ID %d in SOS

Invalid component ID %d in SOS

Bogus message code %d

Bogus message code %d

%s: Write error at scanline %lu

%s: Write error at scanline %lu

%s: Seek error at scanline %lu

%s: Seek error at scanline %lu

"%s": Information lost writing value (%g) as (unsigned) RATIONAL

"%s": Information lost writing value (%g) as (unsigned) RATIONAL

Error writing data for field "%s"

Error writing data for field "%s"

%s: Error writing SubIFD directory link

%s: Error writing SubIFD directory link

ExifInteroperabilityOffset

ExifInteroperabilityOffset

InteroperabilityIndex

InteroperabilityIndex

InteroperabilityVersion

InteroperabilityVersion

Unknown zTXt compression type %d

Unknown zTXt compression type %d

Incomplete compressed datastream in %s chunk

Incomplete compressed datastream in %s chunk

Data error in compressed datastream in %s chunk

Data error in compressed datastream in %s chunk

Buffer error in compressed datastream in %s chunk

Buffer error in compressed datastream in %s chunk

gamma = (%d/100000)

gamma = (%d/100000)

gx=%f, gy=%f, bx=%f, by=%f

gx=%f, gy=%f, bx=%f, by=%f

wx=%f, wy=%f, rx=%f, ry=%f

wx=%f, wy=%f, rx=%f, ry=%f

incorrect gamma=(%d/100000)

incorrect gamma=(%d/100000)

Internal error, unknown tag 0x%x

Internal error, unknown tag 0x%x

Tag %d

Tag %d

Compression scheme %u %s encoding is not implemented

Compression scheme %u %s encoding is not implemented

%s %s encoding is not implemented

%s %s encoding is not implemented

Compression scheme %u %s decoding is not implemented

Compression scheme %u %s decoding is not implemented

%s %s decoding is not implemented

%s %s decoding is not implemented

Compression algorithm does not support random access

Compression algorithm does not support random access

%s: cannot handle zero strip size

%s: cannot handle zero strip size

%s: cannot handle zero tile size

%s: cannot handle zero tile size

%s: cannot handle zero scanline size

%s: cannot handle zero scanline size

%s: Bogus "%s" field, ignoring and calculating from imagelength

%s: Bogus "%s" field, ignoring and calculating from imagelength

%s: TIFF directory is missing required "%s" field, calculating from imagelength

%s: TIFF directory is missing required "%s" field, calculating from imagelength

%s: cannot handle zero number of %s

%s: cannot handle zero number of %s

%s: wrong data type %d for "%s"; tag ignored

%s: wrong data type %d for "%s"; tag ignored

%s: unknown field with tag %d (0x%x) encountered

%s: unknown field with tag %d (0x%x) encountered

%s: invalid TIFF directory; tags are not sorted in ascending order

%s: invalid TIFF directory; tags are not sorted in ascending order

%s: Can not read TIFF directory

%s: Can not read TIFF directory

%s: Can not read TIFF directory count

%s: Can not read TIFF directory count

%s: Seek error accessing TIFF directory

%s: Seek error accessing TIFF directory

%s: Failed to allocate space for IFD list

%s: Failed to allocate space for IFD list

No space %s

No space %s

%s: Cannot determine size of unknown tag type %d

%s: Cannot determine size of unknown tag type %d

%s: TIFF directory is missing required "%s" field

%s: TIFF directory is missing required "%s" field

incorrect count for field "%s" (%lu, expecting %lu); tag trimmed

incorrect count for field "%s" (%lu, expecting %lu); tag trimmed

incorrect count for field "%s" (%lu, expecting %lu); tag ignored

incorrect count for field "%s" (%lu, expecting %lu); tag ignored

Error fetching data for field "%s"

Error fetching data for field "%s"

%s: Rational with zero denominator (num = %lu)

%s: Rational with zero denominator (num = %lu)

Cannot handle different per-sample values for field "%s"

Cannot handle different per-sample values for field "%s"

cannot read TIFF_ANY type %d for field "%s"

cannot read TIFF_ANY type %d for field "%s"

%ld%c

%ld%c

%s compression support is not configured

%s compression support is not configured

?%s: No space for LogLuv state block

?%s: No space for LogLuv state block

Inappropriate photometric interpretation %d for SGILog compression; %s

Inappropriate photometric interpretation %d for SGILog compression; %s

LogL16Decode: Not enough data at row %d (short %d pixels)

LogL16Decode: Not enough data at row %d (short %d pixels)

LogLuvDecode24: Not enough data at row %d (short %d pixels)

LogLuvDecode24: Not enough data at row %d (short %d pixels)

LogLuvDecode32: Not enough data at row %d (short %d pixels)

LogLuvDecode32: Not enough data at row %d (short %d pixels)

%s: No space for SGILog translation buffer

%s: No space for SGILog translation buffer

No support for converting user data format to LogL

No support for converting user data format to LogL

No support for converting user data format to LogLuv

No support for converting user data format to LogLuv

SGILog compression supported only for %s, or raw data

SGILog compression supported only for %s, or raw data

Unknown data format %d for LogLuv compression

Unknown data format %d for LogLuv compression

Unknown encoding %d for LogLuv compression

Unknown encoding %d for LogLuv compression

PixarLog compression can't handle bits depth/data format combination (depth: %d)

PixarLog compression can't handle bits depth/data format combination (depth: %d)

%d bit input not supported in PixarLog

%d bit input not supported in PixarLog

PixarLogDecode: unsupported bits/sample: %d

PixarLogDecode: unsupported bits/sample: %d

%s: zlib error: %s

%s: zlib error: %s

%s: Not enough data at scanline %d (short %d bytes)

%s: Not enough data at scanline %d (short %d bytes)

%s: Decoding error at scanline %d, %s

%s: Decoding error at scanline %d, %s

PixarLog compression can't handle %d bit linear encodings

PixarLog compression can't handle %d bit linear encodings

%s: Encoder error: %s

%s: Encoder error: %s

%s: No space for state block

%s: No space for state block

%s: Bad code word at scanline %d (x %lu)

%s: Bad code word at scanline %d (x %lu)

%s: %s at scanline %d (got %lu, expected %lu)

%s: %s at scanline %d (got %lu, expected %lu)

%s: Premature EOF at scanline %d (x %lu)

%s: Premature EOF at scanline %d (x %lu)

%s: No space for Group 3/4 reference line

%s: No space for Group 3/4 reference line

%s: Uncompressed data (not supported) at scanline %d (x %lu)

%s: Uncompressed data (not supported) at scanline %d (x %lu)

Fax SubAddress: %s

Fax SubAddress: %s

(%u = 0x%x)

(%u = 0x%x)

%suncompressed data

%suncompressed data

%sEOL padding

%sEOL padding

%s2-d encoding

%s2-d encoding

%s compression not supported

%s compression not supported

Tiled Wang image not supported in libtiff

Tiled Wang image not supported in libtiff

Does not support lossless Huffman coding

Does not support lossless Huffman coding

Decompressor will try reading with sampling %d,%d.

Decompressor will try reading with sampling %d,%d.

Improper JPEG sampling factors %d,%d

Improper JPEG sampling factors %d,%d

Apparently should be %d,%d.

Apparently should be %d,%d.

Improper JPEG strip/tile size, expected %dx%d, got %dx%d

Improper JPEG strip/tile size, expected %dx%d, got %dx%d

RowsPerStrip must be multiple of %d for JPEG

RowsPerStrip must be multiple of %d for JPEG

JPEG tile width must be multiple of %d

JPEG tile width must be multiple of %d

JPEG tile height must be multiple of %d

JPEG tile height must be multiple of %d

BitsPerSample %d not allowed for JPEG

BitsPerSample %d not allowed for JPEG

PhotometricInterpretation %d not allowed for JPEG

PhotometricInterpretation %d not allowed for JPEG

ThunderDecode: %s data at scanline %ld (%lu != %lu)

ThunderDecode: %s data at scanline %ld (%lu != %lu)

PackBitsDecode: discarding %d bytes to avoid buffer overrun

PackBitsDecode: discarding %d bytes to avoid buffer overrun

LZWDecode: Corrupted LZW table at scanline %d

LZWDecode: Corrupted LZW table at scanline %d

LZWDecode: Not enough data at scanline %d (short %d bytes)

LZWDecode: Not enough data at scanline %d (short %d bytes)

LZWDecode: Wrong length of decoded string: data probably corrupted at scanline %d

LZWDecode: Wrong length of decoded string: data probably corrupted at scanline %d

LZWDecode: Strip %d not terminated with EOI code

LZWDecode: Strip %d not terminated with EOI code

LZWDecode: Bogus encoding, loop in the code table; scanline %d

LZWDecode: Bogus encoding, loop in the code table; scanline %d

LZWDecodeCompat: Corrupted LZW table at scanline %d

LZWDecodeCompat: Corrupted LZW table at scanline %d

LZWDecodeCompat: Not enough data at scanline %d (short %d bytes)

LZWDecodeCompat: Not enough data at scanline %d (short %d bytes)

LZWDecodeCompat: Wrong length of decoded string: data probably corrupted at scanline %d

LZWDecodeCompat: Wrong length of decoded string: data probably corrupted at scanline %d

DumpModeDecode: Not enough data for scanline %d

DumpModeDecode: Not enough data for scanline %d

Horizontal differencing "Predictor" not supported with %d-bit samples

Horizontal differencing "Predictor" not supported with %d-bit samples

"Predictor" value %d not supported

"Predictor" value %d not supported

%u (0x%x)

%u (0x%x)

Lua 5.0.2

Lua 5.0.2

bad argument #%d to `%s' (%s)

bad argument #%d to `%s' (%s)

calling `%s' on bad self (%s)

calling `%s' on bad self (%s)

%s expected, got %s

%s expected, got %s

%s:%d:

%s:%d:

stack overflow (%s)

stack overflow (%s)

cannot read %s: %s

cannot read %s: %s

attempt to %s a %s value

attempt to %s a %s value

attempt to %s %s `%s' (a %s value)

attempt to %s %s `%s' (a %s value)

attempt to compare %s with %s

attempt to compare %s with %s

attempt to compare two %s values

attempt to compare two %s values

%s:%d: %s

%s:%d: %s

system error %d

system error %d

file (%s)

file (%s)

`popen' not supported

`popen' not supported

field `%s' missing in date table

field `%s' missing in date table

^$* ?.([%-

^$* ?.([%-

missing `[' after `%%f' in pattern

missing `[' after `%%f' in pattern

no function environment for tail call at level %d

no function environment for tail call at level %d

could not load package `%s' from path `%s'

could not load package `%s' from path `%s'

error loading package `%s' (%s)

error loading package `%s' (%s)

?;?.lua

?;?.lua

`__pow' (`^' operator) is not a function

`__pow' (`^' operator) is not a function

invalid key for `next'

invalid key for `next'

too many %s (limit=%d)

too many %s (limit=%d)

%s:%d: %s near `%s'

%s:%d: %s near `%s'

char(%d)

char(%d)

`%s' expected (to close `%s' at line %d)

`%s' expected (to close `%s' at line %d)

`%s' expected

`%s' expected

bad code in %s

bad code in %s

unexpected end of file in %s

unexpected end of file in %s

bad integer in %s

bad integer in %s

bad nupvalues in %s: read %d; expected %d

bad nupvalues in %s: read %d; expected %d

bad constant type (%d) in %s

bad constant type (%d) in %s

unknown number format in %s

unknown number format in %s

%s too old: read version %d.%d; expected at least %d.%d

%s too old: read version %d.%d; expected at least %d.%d

%s too new: read version %d.%d; expected at most %d.%d

%s too new: read version %d.%d; expected at most %d.%d

bad signature in %s

bad signature in %s

virtual machine mismatch in %s: size of %s is %d but read %d

virtual machine mismatch in %s: size of %s is %d but read %d

C:\Dev\fmodsrc375win\src\fsound_stream.c

C:\Dev\fmodsrc375win\src\fsound_stream.c

http:\\

http:\\

C:\Dev\fmodsrc375win\src\fsound.c

C:\Dev\fmodsrc375win\src\fsound.c

C:\Dev\fmodsrc375win\src\fsound_tag.c

C:\Dev\fmodsrc375win\src\fsound_tag.c

C:\Dev\fmodsrc375win\src\system_memory.c

C:\Dev\fmodsrc375win\src\system_memory.c

C:\Dev\fmodsrc375win\src\fsound_dsp.c

C:\Dev\fmodsrc375win\src\fsound_dsp.c

C:\Dev\fmodsrc375win\src\system_thread.c

C:\Dev\fmodsrc375win\src\system_thread.c

C:\Dev\fmodsrc375win\src\system_file.c

C:\Dev\fmodsrc375win\src\system_file.c

The DLLs/EXEs of ASPI don't version check

The DLLs/EXEs of ASPI don't version check

No resources available to execute cmd

No resources available to execute cmd

ASPI for windows failed init

ASPI for windows failed init

Unsupported Windows mode

Unsupported Windows mode

ASPI manager doesn't support Windows

ASPI manager doesn't support Windows

C:\Dev\fmodsrc375win\win\src\fsound_cdda.c

C:\Dev\fmodsrc375win\win\src\fsound_cdda.c

\\.\%c:

\\.\%c:

ERROR: %c: already open

ERROR: %c: already open

ERROR: Couldn't access CD/DVD device at %c:

ERROR: Couldn't access CD/DVD device at %c:

ERROR: %s

ERROR: %s

ERROR: Failed to initialise ASPI (%s)

ERROR: Failed to initialise ASPI (%s)

wmvcore.dll

wmvcore.dll

C:\Dev\fmodsrc375win\win\src\format_asf.cpp

C:\Dev\fmodsrc375win\win\src\format_asf.cpp

C:\Dev\fmodsrc375win\ogg_vorbis\vorbis\lib\vorbisfile.c

C:\Dev\fmodsrc375win\ogg_vorbis\vorbis\lib\vorbisfile.c

C:\Dev\fmodsrc375win\win\src\format_dshow.c

C:\Dev\fmodsrc375win\win\src\format_dshow.c

C:\Dev\fmodsrc375win\src\fsound_sample.c

C:\Dev\fmodsrc375win\src\fsound_sample.c

C:\Dev\fmodsrc375win\src\format_mpeg.c

C:\Dev\fmodsrc375win\src\format_mpeg.c

C:\Dev\fmodsrc375win\src\format_oggvorbis.c

C:\Dev\fmodsrc375win\src\format_oggvorbis.c

C:\Dev\fmodsrc375win\src\format_wav.c

C:\Dev\fmodsrc375win\src\format_wav.c

C:\Dev\fmodsrc375win\src\format_fsb.c

C:\Dev\fmodsrc375win\src\format_fsb.c

C:\Dev\fmodsrc375win\src\format_oggvorbis_net.c

C:\Dev\fmodsrc375win\src\format_oggvorbis_net.c

C:\Dev\fmodsrc375win\src\format_mpeg_net.c

C:\Dev\fmodsrc375win\src\format_mpeg_net.c

StreamUrl='

StreamUrl='

HTTP/1.1

HTTP/1.1

HTTP/1.0

HTTP/1.0

C:\Dev\fmodsrc375win\src\fsound_stream_net.c

C:\Dev\fmodsrc375win\src\fsound_stream_net.c

ice-url

ice-url

ice-url:

ice-url:

icy-url

icy-url

icy-url:

icy-url:

Authorization: Basic %s

Authorization: Basic %s

Host: %s

Host: %s

GET %s HTTP/1.1

GET %s HTTP/1.1

C:\Dev\fmodsrc375win\src\sound_software.c

C:\Dev\fmodsrc375win\src\sound_software.c

C:\Dev\fmodsrc375win\win\src\output_winmm.c

C:\Dev\fmodsrc375win\win\src\output_winmm.c

ddraw.dll

ddraw.dll

\d3d9.dll

\d3d9.dll

dsound3d.dll

dsound3d.dll

dsound.dll

dsound.dll

%s: Left = ASIO CH %d Right = ASIO CH %d

%s: Left = ASIO CH %d Right = ASIO CH %d

C:\Dev\fmodsrc375win\win\src\output_asio.cpp

C:\Dev\fmodsrc375win\win\src\output_asio.cpp

C:\Dev\fmodsrc375win\win\src\fsound_systemmixer_win32.c

C:\Dev\fmodsrc375win\win\src\fsound_systemmixer_win32.c

Software\Microsoft\Windows\CurrentVersion\Multimedia\MIDIMap

Software\Microsoft\Windows\CurrentVersion\Multimedia\MIDIMap

C:\Dev\fmodsrc375win\win\src\music_formatmidi.c

C:\Dev\fmodsrc375win\win\src\music_formatmidi.c

C:\Dev\fmodsrc375win\src\fsound_dsp_fft.c

C:\Dev\fmodsrc375win\src\fsound_dsp_fft.c

C:\Dev\fmodsrc375win\ogg_vorbis\ogg\src\framing.c

C:\Dev\fmodsrc375win\ogg_vorbis\ogg\src\framing.c

C:\Dev\fmodsrc375win\ogg_vorbis\vorbis\lib\info.c

C:\Dev\fmodsrc375win\ogg_vorbis\vorbis\lib\info.c

C:\Dev\fmodsrc375win\ogg_vorbis\vorbis\lib\block.c

C:\Dev\fmodsrc375win\ogg_vorbis\vorbis\lib\block.c

C:\Dev\fmodsrc375win\src\format_it.c

C:\Dev\fmodsrc375win\src\format_it.c

C:\Dev\fmodsrc375win\src\system_net.c

C:\Dev\fmodsrc375win\src\system_net.c

C:\Dev\fmodsrc375win\src\music_formatmod.c

C:\Dev\fmodsrc375win\src\music_formatmod.c

C:\Dev\fmodsrc375win\src\music_formatit.c

C:\Dev\fmodsrc375win\src\music_formatit.c

C:\Dev\fmodsrc375win\src\music_formatxm.c

C:\Dev\fmodsrc375win\src\music_formatxm.c

C:\Dev\fmodsrc375win\src\music_formats3m.c

C:\Dev\fmodsrc375win\src\music_formats3m.c

C:\Dev\fmodsrc375win\src\music_formatfsb.c

C:\Dev\fmodsrc375win\src\music_formatfsb.c

C:\Dev\fmodsrc375win\ogg_vorbis\vorbis\lib\psy.c

C:\Dev\fmodsrc375win\ogg_vorbis\vorbis\lib\psy.c

C:\Dev\fmodsrc375win\ogg_vorbis\vorbis\lib\sharedbook.c

C:\Dev\fmodsrc375win\ogg_vorbis\vorbis\lib\sharedbook.c

C:\Dev\fmodsrc375win\ogg_vorbis\vorbis\lib\codebook.c

C:\Dev\fmodsrc375win\ogg_vorbis\vorbis\lib\codebook.c

C:\Dev\fmodsrc375win\ogg_vorbis\vorbis\lib\mdct.c

C:\Dev\fmodsrc375win\ogg_vorbis\vorbis\lib\mdct.c

C:\Dev\fmodsrc375win\ogg_vorbis\vorbis\lib\envelope.c

C:\Dev\fmodsrc375win\ogg_vorbis\vorbis\lib\envelope.c

C:\Dev\fmodsrc375win\ogg_vorbis\vorbis\lib\mapping0.c

C:\Dev\fmodsrc375win\ogg_vorbis\vorbis\lib\mapping0.c

C:\Dev\fmodsrc375win\ogg_vorbis\vorbis\lib\res0.c

C:\Dev\fmodsrc375win\ogg_vorbis\vorbis\lib\res0.c

C:\Dev\fmodsrc375win\ogg_vorbis\vorbis\lib\floor1.c

C:\Dev\fmodsrc375win\ogg_vorbis\vorbis\lib\floor1.c

C:\Dev\fmodsrc375win\ogg_vorbis\vorbis\lib\floor0.c

C:\Dev\fmodsrc375win\ogg_vorbis\vorbis\lib\floor0.c

%s %s

%s %s

%s %s (%s)

%s %s (%s)

u/u/u u:u

u/u/u u:u

%s %lx

%s %lx

%s %d %s

%s %d %s

All Files|*.*||

All Files|*.*||

dzprog32 /%c /u /T=%s

dzprog32 /%c /u /T=%s

Version: 4.00.04 - %s %s

Version: 4.00.04 - %s %s

%s [Memory]

%s [Memory]

%s [Tested]

%s [Tested]

%s [Extracted]

%s [Extracted]

--- DynaZIP UnZIP Log - %s ---

--- DynaZIP UnZIP Log - %s ---

\DUNZLOG.TXT

\DUNZLOG.TXT

%s exists and is Read Only, do you want to overwrite it?

%s exists and is Read Only, do you want to overwrite it?

Decryption key not provided, or too long

Decryption key not provided, or too long

UNZIPCMDSTRUCT Size is incorrect.

UNZIPCMDSTRUCT Size is incorrect.

\DYNAZIP.LOG

\DYNAZIP.LOG

decryptFlag: %d

decryptFlag: %d

returnCount: %d

returnCount: %d

noDirectoryItemsFlag: %d

noDirectoryItemsFlag: %d

recurseFlag: %d

recurseFlag: %d

noDirectoryNamesFlag: %d

noDirectoryNamesFlag: %d

testFlag: %d

testFlag: %d

quietFlag: %d

quietFlag: %d

overWriteFlag: %d

overWriteFlag: %d

updateFlag: %d

updateFlag: %d

freshenFlag: %d

freshenFlag: %d

index: %d

index: %d

Function: %d

Function: %d

--- DynaZIP UnZIP Diagnostic Log - %s ---

--- DynaZIP UnZIP Diagnostic Log - %s ---

returnCount: %d

returnCount: %d

File to Memory: %s

File to Memory: %s

Testing: %s

Testing: %s

Extracting: %s

Extracting: %s

Item %d of %d

Item %d of %d

%s is encrypted, and you have not provided the correct code. Go to next item (if any)?

%s is encrypted, and you have not provided the correct code. Go to next item (if any)?

%s exists, do you want to overwrite it?

%s exists, do you want to overwrite it?

User skipped this operation

User skipped this operation

User cancelled this operation

User cancelled this operation

Bad or missing decryption key

Bad or missing decryption key

Application cancelled operation

Application cancelled operation

Multi-disk archive, not supported

Multi-disk archive, not supported

Target Media is NON-Removable and can not be used for a Multi-Volume operation.

Target Media is NON-Removable and can not be used for a Multi-Volume operation.

Please insert Disk Volume %d of %d.

Please insert Disk Volume %d of %d.

Please insert Disk Volume %d.

Please insert Disk Volume %d.

PKBACK# d

PKBACK# d

dzprog32.exe /%c /z /T=%s

dzprog32.exe /%c /z /T=%s

:;,= "[]|

:;,= "[]|

-.Z:.zip:.zoo:.arc:.lzh:.arj

-.Z:.zip:.zoo:.arc:.lzh:.arj

PKBACK# .d

PKBACK# .d

%s [Deleted]

%s [Deleted]

%s [Added]

%s [Added]

--- DynaZIP ZIP Log - %s ---

--- DynaZIP ZIP Log - %s ---

\DZIPLOG.TXT

\DZIPLOG.TXT

Wiping Drive %c:...

Wiping Drive %c:...

Formatting Cylinder %d

Formatting Cylinder %d

Formatting Drive %c:...

Formatting Drive %c:...

zip error: STORE not supported for pipes or devices

zip error: STORE not supported for pipes or devices

local extra (%d bytes) != central extra (%d bytes):

local extra (%d bytes) != central extra (%d bytes):

has %d bytes of extra data:

has %d bytes of extra data:

unknown internal attributes = 0xx:

unknown internal attributes = 0xx:

starts on disk %u:

starts on disk %u:

unknown compression method %u:

unknown compression method %u:

undefined bits used in flags = 0xx:

undefined bits used in flags = 0xx:

local flags = 0xx, central = 0xx:

local flags = 0xx, central = 0xx:

needs unzip %d.%d on system type %d:

needs unzip %d.%d on system type %d:

made by version %d.%d on system type %d:

made by version %d.%d on system type %d:

Could not complete operation

Could not complete operation

Operation interrupted by application

Operation interrupted by application

encryptFlag: %d

encryptFlag: %d

dontCompressTheseSuffixesFlag: %d

dontCompressTheseSuffixesFlag: %d

includeSysHiddenFlag: %d

includeSysHiddenFlag: %d

noDirectoryEntriesFlag: %d

noDirectoryEntriesFlag: %d

excludeFollowingFlag: %d

excludeFollowingFlag: %d

includeOnlyFollowingFlag: %d

includeOnlyFollowingFlag: %d

oldAsLatestFlag: %d

oldAsLatestFlag: %d

afterDateFlag: %d

afterDateFlag: %d

addCommentFlag: %d

addCommentFlag: %d

convertLFtoCRLFFlag: %d

convertLFtoCRLFFlag: %d

growExistingFlag: %d

growExistingFlag: %d

deleteOriginalFlag: %d

deleteOriginalFlag: %d

includeVolumeFlag: %d

includeVolumeFlag: %d

fixHarderFlag: %d

fixHarderFlag: %d

fixFlag: %d

fixFlag: %d

pathForTempFlag: %d

pathForTempFlag: %d

compFactor: %d

compFactor: %d

dosifyFlag: %d

dosifyFlag: %d

Function: %d

Function: %d

--- DynaZIP ZIP Diagnostic Log - %s ---

--- DynaZIP ZIP Diagnostic Log - %s ---

was getting encryption password

was getting encryption password

encryption not supported

encryption not supported

\\.\vwin32

\\.\vwin32

.?AVCCmdUI@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.?AVCTestCmdUI@@

.PAVCUserException@@

.PAVCUserException@@

.PAVCSimpleException@@

.PAVCSimpleException@@

.PAVCNotSupportedException@@

.PAVCNotSupportedException@@

.?AVCNotSupportedException@@

.?AVCNotSupportedException@@

.PAVCArchiveException@@

.PAVCArchiveException@@

.?AVCHttpConnection@@

.?AVCHttpConnection@@

.?AVCHttpFile@@

.?AVCHttpFile@@

.PAVCOleException@@

.PAVCOleException@@

.PAVCOleDispatchException@@

.PAVCOleDispatchException@@

zcÁ

zcÁ

q.CWN3C

q.CWN3C

2FO?

2FO?

wF%7xF

wF%7xF

$.Gn7.G

$.Gn7.G

SG?%SG

SG?%SG

MSG?bSG

MSG?bSG

RZG.gZG

RZG.gZG

%dGh:dG#OdG

%dGh:dG#OdG

hG\4hG.IhG

hG\4hG.IhG

iGR.iG*CiG

iGR.iG*CiG

.zG DzGbYzG

.zG DzGbYzG

2x?'9x?-@x?/Gx?,Nx?%Ux?

2x?'9x?-@x?/Gx?,Nx?%Ux?

vJ>.DK>

vJ>.DK>

Wp?.np?

Wp?.np?

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ir_ext_temp_0\autorun.exe

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ir_ext_temp_0\autorun.exe

333333334

333333334

.nM(aL8

.nM(aL8

(H7.www

(H7.www

version="7.1.1000.0"

version="7.1.1000.0"

name="autorun.exe"/>

name="autorun.exe"/>

name="Microsoft.Windows.Common-Controls"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

publicKeyToken="6595b64144ccf1df"

eDRMHeader.SubscriptionContentID

eDRMHeader.SubscriptionContentID

DRMHeader.ContentDistributor

DRMHeader.ContentDistributor

DRMHeader.SECURITYVERSION

DRMHeader.SECURITYVERSION

DRMHeader.CID

DRMHeader.CID

DRMHeader.LAINFO

DRMHeader.LAINFO

DRMHeader.KID

DRMHeader.KID

LicenseStateData.Transfer.NONSDMI

LicenseStateData.Transfer.NONSDMI

LicenseStateData.Transfer.SDMI

LicenseStateData.Transfer.SDMI

LicenseStateData.Print.redbook

LicenseStateData.Print.redbook

LicenseStateData.Play

LicenseStateData.Play

ActionAllowed.Backup

ActionAllowed.Backup

ActionAllowed.Transfer.NONSDMI

ActionAllowed.Transfer.NONSDMI

ActionAllowed.Transfer.SDMI

ActionAllowed.Transfer.SDMI

ActionAllowed.Print.redbook

ActionAllowed.Print.redbook

ActionAllowed.Play

ActionAllowed.Play

BaseLAURL

BaseLAURL

Transfer.NONSDMI

Transfer.NONSDMI

Transfer.SDMI

Transfer.SDMI

Print.redbook

Print.redbook

CopyrightURL

CopyrightURL

BannerImageURL

BannerImageURL

WM/AlbumCoverURL

WM/AlbumCoverURL

WM/PromotionURL

WM/PromotionURL

To see what data this error report contains,

To see what data this error report contains,

We have created an error report which will help us to improve this product. We will treat this report as confidential and anonymous. No personal data will be transmitted other than what you provide to us.

We have created an error report which will help us to improve this product. We will treat this report as confidential and anonymous. No personal data will be transmitted other than what you provide to us.

7.1.1000.0

7.1.1000.0

2007 Indigo Rose Corporation (VVV.indigorose.com)

2007 Indigo Rose Corporation (VVV.indigorose.com)

ams70_runtime.exe

ams70_runtime.exe

Page %u

Page %u

Pages %u-%u

Pages %u-%u

Output.prn1Printer Files (*.prn)|*.prn|All Files (*.*)|*.*||

Output.prn1Printer Files (*.prn)|*.prn|All Files (*.*)|*.*||

Replace%Select the entire document

Replace%Select the entire document

Jump target not found2The operating system is out of memory or resources!The specified file was not found.!The specified path was not found.AThe .exe file is invalid (non-Win32 .exe or error in .exe image).9The operating system denied access to the specified file.3The file name association is incomplete or invalid._The DDE transaction could not be completed because other DDE transactions were being processed.

Jump target not found2The operating system is out of memory or resources!The specified file was not found.!The specified path was not found.AThe .exe file is invalid (non-Win32 .exe or error in .exe image).9The operating system denied access to the specified file.3The file name association is incomplete or invalid._The DDE transaction could not be completed because other DDE transactions were being processed.

The DDE transaction failed.IThe DDE transaction could not be completed because the request timed out.1The specified dynamic-link library was not found.FThere is no application associated with the given file name extension.6There was not enough memory to complete the operation.

The DDE transaction failed.IThe DDE transaction could not be completed because the request timed out.1The specified dynamic-link library was not found.FThere is no application associated with the given file name extension.6There was not enough memory to complete the operation.

Unidentified execution error.=Could not find the startup page specified in Project|Settings

Unidentified execution error.=Could not find the startup page specified in Project|Settings

Page does not exist:#The specified object was not found.EThe action could not be performed because the content file is closed.:The Video Object's state was incompatible with the action.2The "SeekTime" value is to large for Video Object.6The "SeekTime" value cannot be less than negative one.

Page does not exist:#The specified object was not found.EThe action could not be performed because the content file is closed.:The Video Object's state was incompatible with the action.2The "SeekTime" value is to large for Video Object.6The "SeekTime" value cannot be less than negative one.

Confirm Abort2Are you sure that you want to abort the operation?

Confirm Abort2Are you sure that you want to abort the operation?

%d arguments required.

%d arguments required.

Argument %d must be of type %s.

Argument %d must be of type %s.

All Files (*.*)

All Files (*.*)

No error message is available.'An unsupported operation was attempted.$A required resource was unavailable.

No error message is available.'An unsupported operation was attempted.$A required resource was unavailable.

Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.

Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.

Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else..An unexpected error occurred while reading %1..An unexpected error occurred while writing %1.

Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else..An unexpected error occurred while reading %1..An unexpected error occurred while writing %1.

Access to %1 was denied..An invalid file handle was associated with %1.

Access to %1 was denied..An invalid file handle was associated with %1.

Seek failed on A hardware I/O error was reported while accessing %1.0A sharing violation occurred while accessing %1.0A locking violation occurred while accessing %1.

Seek failed on A hardware I/O error was reported while accessing %1.0A sharing violation occurred while accessing %1.0A locking violation occurred while accessing %1.

Disk full while accessing %1..An attempt was made to access %1 past its end.

Disk full while accessing %1..An attempt was made to access %1 past its end.

No error occurred.-An unknown error occurred while accessing %1./An attempt was made to write to the reading %1..An attempt was made to access %1 past its end.0An attempt was made to read from the writing %1.

No error occurred.-An unknown error occurred while accessing %1./An attempt was made to write to the reading %1..An attempt was made to access %1 past its end.0An attempt was made to read from the writing %1.

#Unable to load mail system support.

#Unable to load mail system support.

Homer.exe_160:

.text

.text

`.data

`.data

.idata

.idata

@.rsrc

@.rsrc

shlwapi.dll

shlwapi.dll

%s %s %s

%s %s %s

GETPASSWORD1

GETPASSWORD1

sfxcmd

sfxcmd

__tmp_rar_sfx_access_check_%u

__tmp_rar_sfx_access_check_%u

-el -s2 "-d%s" "-p%s" "-sp%s"

-el -s2 "-d%s" "-p%s" "-sp%s"

%s.%d.tmp

%s.%d.tmp

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

%s%s%d

%s%s%d

riched32.dll

riched32.dll

riched20.dll

riched20.dll

COMCTL32.DLL

COMCTL32.DLL

%.*s(%d)%s

%.*s(%d)%s

rtmp%d

rtmp%d

Extracting %s

Extracting %s

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Docs\Homer.exe

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Docs\Homer.exe

lu2.iu

lu2.iu

ADVAPI32.DLL

ADVAPI32.DLL

KERNEL32.DLL

KERNEL32.DLL

COMDLG32.DLL

COMDLG32.DLL

GDI32.DLL

GDI32.DLL

SHELL32.DLL

SHELL32.DLL

USER32.DLL

USER32.DLL

OLE32.DLL

OLE32.DLL

RegCloseKey

RegCloseKey

RegCreateKeyExA

RegCreateKeyExA

RegOpenKeyExA

RegOpenKeyExA

GetCPInfo

GetCPInfo

GetProcessHeap

GetProcessHeap

SHFileOperationA

SHFileOperationA

ShellExecuteExA

ShellExecuteExA

:(,4;;?@

:(,4;;?@

3,45657879

3,45657879

8888888888887

8888888888887

version="1.0.0.0"

version="1.0.0.0"

name="Microsoft.Windows.Common-Controls"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

publicKeyToken="6595b64144ccf1df"

Shell.Explorer

Shell.Explorer

Enter password

Enter password

&Enter password for the encrypted file:

&Enter password for the encrypted file:

Skipping %s

Skipping %s

The file "%s" header is corrupt%The archive comment header is corrupt

The file "%s" header is corrupt%The archive comment header is corrupt

Unknown method in %s

Unknown method in %s

Cannot open %s

Cannot open %s

Cannot create %s

Cannot create %s

Cannot create folder %s6CRC failed in the encrypted file %s (wrong password ?)

Cannot create folder %s6CRC failed in the encrypted file %s (wrong password ?)

CRC failed in %s

CRC failed in %s

Packed data CRC failed in %s

Packed data CRC failed in %s

Wrong password for %s5Write error in the file %s. Probably the disk is full

Wrong password for %s5Write error in the file %s. Probably the disk is full

Read error in the file %s

Read error in the file %s

Extracting from %s

Extracting from %s

ErroraErrors encountered while performing the operation

ErroraErrors encountered while performing the operation

Please close all applications, reboot Windows and restart this installation\Some installation files are corrupt.

Please close all applications, reboot Windows and restart this installation\Some installation files are corrupt.

stst.exe_3724:

.rsrc

.rsrc

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

VBA6.DLL

VBA6.DLL

MSVBVM60.DLL

MSVBVM60.DLL

KERNEL32.DLL

KERNEL32.DLL

C:\Windows\system32\wshom.ocx

C:\Windows\system32\wshom.ocx

scrrun.dll

scrrun.dll

RICHTX32.OCX

RICHTX32.OCX

wshom.ocx

wshom.ocx

bitarts_evaluation.ocx

bitarts_evaluation.ocx

bitarts_evaluation.dll

bitarts_evaluation.dll

.tex.dat.rsr

.tex.dat.rsr

Error encountered resolving imports:

Error encountered resolving imports:

.tex8

.tex8

%MkQgDTl%Ck

%MkQgDTl%Ck

.KnWC

.KnWC

cMdx

cMdx

7V.DU

7V.DU

%SkG.

%SkG.

"ÙK

"ÙK

"×K

"×K

"ÕH

"ÕH

$%&'()*

$%&'()*

,-./0123

,-./0123

456789:;

456789:;

m`>%sj

m`>%sj

xD

xD

urlm

urlm

_8%x't

_8%x't

URLM

URLM

u.Shi'

u.Shi'

`"#$%>&'

`"#$%>&'

.dZl.

.dZl.

tB.pBE

tB.pBE

.V!z.Xg.

.V!z.Xg.

$#W%9X

$#W%9X

,V%S1

,V%S1

W.uk,*

W.uk,*

%CQe%

%CQe%

P.NtO

P.NtO

?Vj%S

?Vj%S

u%%SR

u%%SR

SS_%XK

SS_%XK

ujTB.UM;

ujTB.UM;

~`%F }f

~`%F }f

w'sSH

w'sSH

ERSION.DqL

ERSION.DqL

^,%fH=

^,%fH=

%d Lm

%d Lm

8.hM3M?@6

8.hM3M?@6

%uE0L

%uE0L

%S3.0

%S3.0

&ms%d

&ms%d

s%uHh]

s%uHh]

rq.AY

rq.AY

rG%x

rG%x

O0%X(

O0%X(

Rg,U%]Sql

Rg,U%]Sql

b.ved'

b.ved'

.Pwfn

.Pwfn

yp.lm%O

yp.lm%O

Z.CbuM

Z.CbuM

O%ur-

O%ur-

%x4vZ%

%x4vZ%

.uR,%t

.uR,%t

.dNbV

.dNbV

V2%xOA

V2%xOA

d|.df

d|.df

%c*7@

%c*7@

wqT%D

wqT%D

4

4

88A%DK"

88A%DK"

UDPrL6BF#A

UDPrL6BF#A

V%X_]

V%X_]

]lH.KA

]lH.KA

A^;%U

A^;%U

32.dl

32.dl

d".DH8

d".DH8

|/.jT@

|/.jT@

m.djy

m.djy

pVg:R%S

pVg:R%S

3Ô,

3Ô,

".wz8

".wz8

ib.DYLp

ib.DYLp

Ä!(D

Ä!(D

~%u'uI

~%u'uI

%F|}Lsk

%F|}Lsk

%c>&[

%c>&[

vb6%s.dl

vb6%s.dl

89>(8:>)8;>*

89>(8:>)8;>*

>{> >|>!>}>"$~

>{> >|>!>}>"$~

zcÁ

zcÁ

(%CT,

(%CT,

]!VL5B%s

]!VL5B%s

]!dX?.Ix

]!dX?.Ix

8N.Te

8N.Te

hKey

hKey

I%ClB

I%ClB

00).WR'l

00).WR'l

aXB.VQX

aXB.VQX

ou%.s

ou%.s

#ßH

#ßH

0Msg}|[

0Msg}|[

.MVJhuX

.MVJhuX

D %x'Wd

D %x'Wd

6SFtP

6SFtP

^6.DqL

^6.DqL

_;(%f

_;(%f

@Kq.qT

@Kq.qT

2)9

2)9

i.Rk^P

i.Rk^P

xFY&P.UN

xFY&P.UN

60.dbg9

60.dbg9

.tesx

.tesx

.rs$cT

.rs$cT

C42.DL

C42.DL

Dt.yYpN

Dt.yYpN

% û8P*

% û8P*

%D?u!

%D?u!

.x%SZl

.x%SZl

.JbE;Z[

.JbE;Z[

.aV1uS

.aV1uS

I}D>Z.pB]

I}D>Z.pB]

MFC42.DL

MFC42.DL

? ?$?(?,?0(4

? ?$?(?,?0(4

.xJ:[*

.xJ:[*

~#~'~ ~/~3~7

~#~'~ ~/~3~7

`.dat

`.dat

.al |

.al |

8.CHMy$A

8.CHMy$A

2.DL2

2.DL2

%x&NR

%x&NR

,A s/%Fl(

,A s/%Fl(

.wk!j

.wk!j

E P%d

E P%d

%#8.JX

%#8.JX

^lJ%Sd

^lJ%Sd

R,HV%s

R,HV%s

#h9%sR

#h9%sR

.ModB

.ModB

ESc%s_

ESc%s_

}.RI#

}.RI#

[.TN:>V7_

[.TN:>V7_

%dll

%dll

.aFZ^nZ

.aFZ^nZ

~ ~$~(~,

~ ~$~(~,

:5;Na.ir

:5;Na.ir

,N:7.HTg

,N:7.HTg

2.vss/(c

2.vss/(c

'htCps:/

'htCps:/

.datX

.datX

Windows

Windows

p.pLpopgpEgv%n

p.pLpopgpEgv%n

h.logCHW2aH

h.logCHW2aH

32.dP

32.dP

{2X-

{2X-

5.WrkKjH

5.WrkKjH

0sA%u

0sA%u

.Nam)A

.Nam)A

NSPO L.DRV

NSPO L.DRV

X"uDpv

X"uDpv

|c&,%X

|c&,%X

D,

D,

PFDpaSs4R

PFDpaSs4R

~ ~$~(~,~0

~ ~$~(~,~0

@*\AD:\find files\Project1.vbp

@*\AD:\find files\Project1.vbp

prefs.js

prefs.js

\prefs.js

\prefs.js

operaprefs.ini

operaprefs.ini

\operaprefs.ini

\operaprefs.ini

C:\starter.exe

C:\starter.exe

C:\operaprefs.ini

C:\operaprefs.ini

C:\prefs.js

C:\prefs.js

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page

hXXp://VVV.anwarelbayan.com/search/

hXXp://VVV.anwarelbayan.com/search/

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Start

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Start

Project1.exe

Project1.exe

SUPPORT_38

SUPPORT_38

stst.exe_3724_rwx_00401000_00003000:

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

VBA6.DLL

VBA6.DLL

MSVBVM60.DLL

MSVBVM60.DLL

@*\AD:\find files\Project1.vbp

@*\AD:\find files\Project1.vbp

prefs.js

prefs.js

\prefs.js

\prefs.js

operaprefs.ini

operaprefs.ini

\operaprefs.ini

\operaprefs.ini

C:\starter.exe

C:\starter.exe

C:\operaprefs.ini

C:\operaprefs.ini

C:\prefs.js

C:\prefs.js

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page

hXXp://VVV.anwarelbayan.com/search/

hXXp://VVV.anwarelbayan.com/search/

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Start

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Start

stst.exe_3724_rwx_00405000_00005000:

KERNEL32.DLL

KERNEL32.DLL

C:\Windows\system32\wshom.ocx

C:\Windows\system32\wshom.ocx

MSVBVM60.DLL

MSVBVM60.DLL

scrrun.dll

scrrun.dll

RICHTX32.OCX

RICHTX32.OCX

wshom.ocx

wshom.ocx

bitarts_evaluation.ocx

bitarts_evaluation.ocx

bitarts_evaluation.dll

bitarts_evaluation.dll

.tex.dat.rsr

.tex.dat.rsr

Error encountered resolving imports:

Error encountered resolving imports:

Project1.exe

Project1.exe

SUPPORT_38

SUPPORT_38