Trojan.Win32.SwrortProxy_745a8c8b96 – Adaware

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):

drvupdsetup.exe:860
DUStartScan.exe:1856
drvupdsetup.tmp:228
DriverUpdater.exe:1308
%original file name%.exe:1616

The Trojan injects its code into the following process(es):

DUTray.exe:1336
DriverUpdater.exe:1492

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process drvupdsetup.exe:860 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-QO7P3.tmp\drvupdsetup.tmp (7386 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-QO7P3.tmp\drvupdsetup.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-QO7P3.tmp (0 bytes)

The process DUStartScan.exe:1856 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QTYJ0O64\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S9ANCLM3\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\B4RM162F\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KS0GYMR6\desktop.ini (67 bytes)

The process drvupdsetup.tmp:228 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\Driver Updater\is-8Q48D.tmp (13 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Driver Updater\Uninstall Driver Updater.lnk (1498 bytes)
%Program Files%\Driver Updater\is-PD5LD.tmp (7971 bytes)
%Program Files%\Driver Updater\is-9SOCM.tmp (35 bytes)
%Program Files%\Driver Updater\is-2HAG0.tmp (32641 bytes)
%Program Files%\Driver Updater\is-9AR17.tmp (34721 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-DE0LO.tmp\DrvUpdHelper.dll (7971 bytes)
%Program Files%\Driver Updater\is-N43MA.tmp (11 bytes)
%Program Files%\Driver Updater\is-IE2MR.tmp (10177 bytes)
%Program Files%\Driver Updater\is-CFQM1.tmp (6841 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-DE0LO.tmp\_isetup\_shfoldr.dll (23 bytes)
%Program Files%\Driver Updater\is-M9ISP.tmp (14022 bytes)
%Program Files%\Driver Updater\unins000.dat (12505 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-DE0LO.tmp\check.bmp (601 bytes)
%Program Files%\Driver Updater\is-2K8IK.tmp (3073 bytes)
%Program Files%\Driver Updater\is-J1S66.tmp (552 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Driver Updater\Help.lnk (761 bytes)
%Documents and Settings%\%current user%\Desktop\Driver Updater.lnk (749 bytes)
%Program Files%\Driver Updater\is-L6QB2.tmp (52 bytes)
%Documents and Settings%\%current user%\Application Data\Driver Updater\is-56HH4.tmp (4 bytes)
%Documents and Settings%\%current user%\Application Data\Driver Updater\is-S1CTG.tmp (601 bytes)
%Program Files%\Driver Updater\unins000.msg (646 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Driver Updater\Driver Updater.lnk (761 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Driver Updater\Driver Updater on the Web.lnk (736 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\All Users\Start Menu\Programs\Driver Updater\Uninstall Driver Updater.lnk (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-DE0LO.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-DE0LO.tmp\_isetup\_shfoldr.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-DE0LO.tmp\check.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-DE0LO.tmp\DrvUpdHelper.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-DE0LO.tmp\_isetup (0 bytes)

The process DriverUpdater.exe:1492 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Driver Updater\Devices.ini (228 bytes)
%Documents and Settings%\%current user%\Application Data\Driver Updater\DevicesPlus.ini (3 bytes)
%Documents and Settings%\%current user%\Application Data\Driver Updater\Scan.ini (231 bytes)
%Documents and Settings%\%current user%\Application Data\Driver Updater\Drivers32.db-journal (8274 bytes)
%Documents and Settings%\%current user%\Application Data\Driver Updater\Drivers32.db (14561977 bytes)
%Documents and Settings%\%current user%\Application Data\Driver Updater\Snapshot.ini (1 bytes)
%WinDir%\setupapi.log (4240 bytes)
%Documents and Settings%\%current user%\Application Data\Driver Updater\PCInfo.ini (151 bytes)
%Documents and Settings%\%current user%\Application Data\Driver Updater\program.log (680 bytes)
%Documents and Settings%\%current user%\Application Data\Driver Updater\Drivers.db (154783 bytes)
%Documents and Settings%\%current user%\Application Data\Driver Updater\current_5_32_cxw.7z (15021 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DriverUpdater.madExcept (0 bytes)
%Documents and Settings%\%current user%\Application Data\Driver Updater\Drivers32.db-journal (0 bytes)
%Documents and Settings%\%current user%\Application Data\Driver Updater\current_5_32_cxw.7z (0 bytes)

The process DriverUpdater.exe:1308 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Driver Updater\program.log (506 bytes)
%Program Files%\Driver Updater\HomePage.url (127 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DriverUpdater.madExcept (0 bytes)
%Program Files%\Driver Updater\HomePage.url (0 bytes)

The process %original file name%.exe:1616 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\drvupdsetup.exe (25429 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\drvupdsetup.exe (0 bytes)

Registry activity

The process drvupdsetup.exe:860 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E2 AD B9 8C D4 BD 08 0A 34 63 6E A2 B9 21 24 E7"

The process DUStartScan.exe:1856 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Driver Updater]
"SupportURL" = "http://pcrepairlabs.com/support"

"homepageurl" = "http://www.pcrepairlabs.com/"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Driver Updater]
"UninstallURL" = "https://safecart.com/pcrepairlabs/.du-special/purchase?sid=141002000-US-014"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Driver Updater]
"DelayedStart" = "0"
"AppStart" = "0"
"MachineGuid" = "8EE1E1A6-3E72-A927-7272-C6B5AD51792E"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Driver Updater]
"OS" = "102"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Driver Updater]
"DriverUpdater.exe" = "Driver Updater"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Driver Updater]
"InstallDate" = "54 17 A1 7E DC B9 E4 40"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BD 0C 6C 84 CF E2 53 FE 2D 91 89 F8 BA 5C 2D 93"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Driver Updater]
"UseAds" = "0"
"Querry" = "http://bi.getlivesupport24x7.com/t/du?sid=141002000-US-014&dt=%dt%&gid=%GID%&tz=%tz%&ln=%ln%&lc=%lc%&bis=%bis%&bief=%bief%&biefx=%biefx%&bif=%bif%&os=%os%&f=3293552760"
"QuerryDate" = "F2 42 B0 7E DC B9 E4 40"
"BuyNowURL" = "http://22a.pcrepairlabs.revenuewire.net/driverupdater/register?141002000-US-014_8EE1E1A6-3E72-A927-7272-C6B5AD51792E"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process drvupdsetup.tmp:228 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Driver Updater_is1]
"DisplayVersion" = "3.1"
"HelpLink" = "http://www.pcrepairlabs.com"
"Inno Setup: Selected Tasks" = "desktopicon"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Driver Updater_is1]
"Inno Setup: Setup Version" = "5.5.3 (u)"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Driver Updater_is1]
"MajorVersion" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Driver Updater_is1]
"Inno Setup: App Path" = "%Program Files%\Driver Updater"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Driver Updater_is1]
"QuietUninstallString" = "%Program Files%\Driver Updater\unins000.exe /SILENT"
"URLInfoAbout" = "http://www.pcrepairlabs.com"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Driver Updater_is1]
"Inno Setup: Icon Group" = "Driver Updater"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKCU\Software\Driver Updater]
"SessionID" = "1F0A1C8C-C950-4DA9-8CC97BA7DAD3C23F"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Driver Updater_is1]
"DisplayName" = "Driver Updater v3.1"
"Inno Setup: Language" = "en"

[HKCU\Software\Driver Updater]
"Ir" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Driver Updater_is1]
"NoModify" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Driver Updater_is1]
"Inno Setup: Deselected Tasks" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Driver Updater_is1]
"URLUpdateInfo" = "http://www.pcrepairlabs.com"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Driver Updater_is1]
"MinorVersion" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKCU\Software\Driver Updater]
"Language" = "1"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "28 27 DF 8C 9E A6 4E 22 B0 80 5C CA 9B D3 08 D7"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Driver Updater_is1]
"InstallLocation" = "%Program Files%\Driver Updater\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Driver Updater_is1]
"UninstallString" = "%Program Files%\Driver Updater\unins000.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Driver Updater_is1]
"Publisher" = "Get Live Support Limited"
"Inno Setup: User" = "%CurrentUserName%"
"InstallDate" = "20160317"

[HKCU\Software\Driver Updater]
"CBM" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Driver Updater_is1]
"NoRepair" = "1"

The process DUTray.exe:1336 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F2 01 A5 CB 97 7E 9D C7 B9 45 B9 AC D5 30 D0 DD"

[HKCU\Software\Driver Updater]
"s_SmartScan" = "1"
"StartWithWindows" = "0"
"TrayNotification" = "1"
"s_Exec" = "0"
"s_Mode" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Driver Updater]
"s_SmartMode" = "0"
"s_Enable" = "0"
"s_SmartDate" = "51 FE 8C 7E BC B9 E4 40"

The process DriverUpdater.exe:1492 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Driver Updater]
"nDownloads" = "3"
"s_SmartMode" = "0"
"ShowSRPMessage" = "1"
"ShowUpdateWindow" = "0"
"s_SmartDate" = "80 B5 CC 7E BC B9 E4 40"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Driver Updater]
"s_SmartScan" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Driver Updater]
"UseProxy" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Driver Updater]
"UpdateWindowShown" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Driver Updater]
"ShowAlertMessages" = "1"
"InstallStat" = "0"
"s_Mode" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Driver Updater]
"AppStart" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"

[HKCU\Software\Driver Updater]
"BackupPath" = "%Documents and Settings%\%current user%\My Documents\Driver Updater\Backup\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Driver Updater]
"ScanExecuted" = "1"
"s_SmartExec" = "0"
"s_Enable" = "0"

"s_Time" = "80 B5 CC 7E DC B9 E4 40"
"LastDatabaseCheck" = "80 B5 CC 7E DC B9 E4 40"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Driver Updater]
"QuerryDate" = "F0 8C 7B 81 DC B9 E4 40"
"ProxyPassword" = ""
"StartWithWindows" = "0"
"ProxyPort" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Driver Updater]
"InstallationDate" = "03-17-2016"
"ProxyAddress" = ""
"LastScan" = "E7 FD 6B 81 DC B9 E4 40"
"OutdatedDrivers" = "0"
"TotalDrivers" = "66"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Driver Updater]
"LastUpdate" = "80 B5 CC 7E DC B9 E4 40"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C1 EA FC 3E EB 55 25 3C DA D3 CC 83 C9 94 40 EC"

[HKCU\Software\Driver Updater]
"DatabaseDate" = "80 B5 CC 7E DC B9 E4 40"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Driver Updater]
"ProxyLogin" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Driver Updater]
"ShowRebootMessage" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"

[HKCU\Software\Driver Updater]
"TrayNotification" = "1"
"ForceUpdate" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Driver Updater]
"DownloadPath" = "%Documents and Settings%\%current user%\My Documents\Driver Updater\Drivers\"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Driver Updater" = "%Program Files%\Driver Updater\DUTray.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process DriverUpdater.exe:1308 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D3 9C 7E 61 F1 DA 34 10 E4 F7 82 97 48 E3 FA 94"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Templates" = "%Documents and Settings%\%current user%\Templates"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The process %original file name%.exe:1616 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F8 4D 09 01 43 0D 9A 50 5E 20 EF DA 4B 9F 49 F3"

[HKCU\Software\Driver Updater]
"setupname" = "c:\%original file name%.exe"

Dropped PE files

MD5	File path
04ad4b80880b32c94be8d0886482c774	c:\Program Files\Driver Updater\7z.dll
3b040050ed470793de2a728cc13a10f6	c:\Program Files\Driver Updater\DUStartScan.exe
d14a8e1cdbacfb11f5568d478f3e789d	c:\Program Files\Driver Updater\DUTray.exe
4894d45e386d78a86203f213db816294	c:\Program Files\Driver Updater\DriverUpdater.exe
b4373efde1810d3537f1c9ca007a3c5b	c:\Program Files\Driver Updater\DrvUpdHelper.dll
0f66e8e2340569fb17e774dac2010e31	c:\Program Files\Driver Updater\sqlite3.dll
2cb43bd3900229377ca74680702d7311	c:\Program Files\Driver Updater\unins000.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
drvupdsetup.exe:860
DUStartScan.exe:1856
drvupdsetup.tmp:228
DriverUpdater.exe:1308
%original file name%.exe:1616
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\is-QO7P3.tmp\drvupdsetup.tmp (7386 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QTYJ0O64\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\S9ANCLM3\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\B4RM162F\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KS0GYMR6\desktop.ini (67 bytes)
%Program Files%\Driver Updater\is-8Q48D.tmp (13 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Driver Updater\Uninstall Driver Updater.lnk (1498 bytes)
%Program Files%\Driver Updater\is-PD5LD.tmp (7971 bytes)
%Program Files%\Driver Updater\is-9SOCM.tmp (35 bytes)
%Program Files%\Driver Updater\is-2HAG0.tmp (32641 bytes)
%Program Files%\Driver Updater\is-9AR17.tmp (34721 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-DE0LO.tmp\DrvUpdHelper.dll (7971 bytes)
%Program Files%\Driver Updater\is-N43MA.tmp (11 bytes)
%Program Files%\Driver Updater\is-IE2MR.tmp (10177 bytes)
%Program Files%\Driver Updater\is-CFQM1.tmp (6841 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-DE0LO.tmp\_isetup\_shfoldr.dll (23 bytes)
%Program Files%\Driver Updater\is-M9ISP.tmp (14022 bytes)
%Program Files%\Driver Updater\unins000.dat (12505 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-DE0LO.tmp\check.bmp (601 bytes)
%Program Files%\Driver Updater\is-2K8IK.tmp (3073 bytes)
%Program Files%\Driver Updater\is-J1S66.tmp (552 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Driver Updater\Help.lnk (761 bytes)
%Documents and Settings%\%current user%\Desktop\Driver Updater.lnk (749 bytes)
%Program Files%\Driver Updater\is-L6QB2.tmp (52 bytes)
%Documents and Settings%\%current user%\Application Data\Driver Updater\is-56HH4.tmp (4 bytes)
%Documents and Settings%\%current user%\Application Data\Driver Updater\is-S1CTG.tmp (601 bytes)
%Program Files%\Driver Updater\unins000.msg (646 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Driver Updater\Driver Updater.lnk (761 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Driver Updater\Driver Updater on the Web.lnk (736 bytes)
%Documents and Settings%\%current user%\Application Data\Driver Updater\Devices.ini (228 bytes)
%Documents and Settings%\%current user%\Application Data\Driver Updater\DevicesPlus.ini (3 bytes)
%Documents and Settings%\%current user%\Application Data\Driver Updater\Scan.ini (231 bytes)
%Documents and Settings%\%current user%\Application Data\Driver Updater\Drivers32.db-journal (8274 bytes)
%Documents and Settings%\%current user%\Application Data\Driver Updater\Snapshot.ini (1 bytes)
%WinDir%\setupapi.log (4240 bytes)
%Documents and Settings%\%current user%\Application Data\Driver Updater\PCInfo.ini (151 bytes)
%Documents and Settings%\%current user%\Application Data\Driver Updater\program.log (680 bytes)
%Documents and Settings%\%current user%\Application Data\Driver Updater\Drivers.db (154783 bytes)
%Documents and Settings%\%current user%\Application Data\Driver Updater\current_5_32_cxw.7z (15021 bytes)
%Program Files%\Driver Updater\HomePage.url (127 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\drvupdsetup.exe (25429 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Driver Updater" = "%Program Files%\Driver Updater\DUTray.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Get Live Support Limited
Product Name: Driver Updater 3.1
Product Version: 3.1.0.0
Legal Copyright: Get Live Support Limited
Legal Trademarks:
Original Filename:
Internal Name: Driver Updater 3.1
File Version: 3.1.0.0
File Description: Keep your PC drivers up to date
Comments:
Language: English (United States)

Company Name: Get Live Support Limited Product Name: Driver Updater 3.1Product Version: 3.1.0.0Legal Copyright: Get Live Support Limited Legal Trademarks: Original Filename: Internal Name: Driver Updater 3.1File Version: 3.1.0.0File Description: Keep your PC drivers up to dateComments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	241560	241664	4.49456	43ae436662ce821181c7c53fd81dd162
.itext	245760	1892	2048	3.93725	5d465d74b8d89adb956acc3adc823d6e
.data	249856	4704	5120	2.23823	01b775d416c333198075e5185d289a47
.bss	258048	20376	0	0	d41d8cd98f00b204e9800998ecf8427e
.idata	278528	4006	4096	3.3668	2b09c35f93cef948b3e1fb959087d8c5
.tls	282624	16	0	0	d41d8cd98f00b204e9800998ecf8427e
.rdata	286720	24	512	0.143426	b3b093e090514dceab227b0b04d17b7f
.reloc	290816	22904	23040	4.6072	b28c0ededbd933b74c9e3b77588aba58
.rsrc	315392	3917312	3917312	5.49679	82f1f31b5cf6481a0a6310833dff1507

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://isysdrv.com/inst?hid=1316d97eba6bcefe3e2338d69a89874126605403&sid=1F0A1C8C-C950-4DA9-8CC97BA7DAD3C23F&tr=141002000-US-014&a=NA&adm=1&os=5.1&x64=0&sil=1&st=201512301&e=200	104.28.18.109
hxxp://isysdrv.com/inst?sid=1F0A1C8C-C950-4DA9-8CC97BA7DAD3C23F&st=0&e=210	104.28.18.109
hxxp://bi.getlivesupport24x7.com/t/du?sid=141002000-US-014&dt=1458249735&gid=8EE1E1A6-3E72-A927-7272-C6B5AD51792E&tz=2&ln=1&lc=0&bis=0&bief=0&biefx=0&bif=0&os=102&f=3293552760	198.20.86.27
hxxp://isysdrv.com/inst?sid=1F0A1C8C-C950-4DA9-8CC97BA7DAD3C23F&st=0&du=4015&e=400	104.28.18.109
hxxp://service.smartpcupdate.com/rpc/sendinstall?partner=PCRepairLabsDU&build=3.2	176.9.2.106
hxxp://service.smartpcupdate.com/rpc/getdatabasecxw?arch=32&os=5	176.9.2.106
hxxp://d2.smartpcupdate.com/dbs/current_5_32_cxw.7z	173.192.91.180
hxxp://d2.smartpcupdate.com/rpc/sendsnapshot	173.192.91.180

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

HEAD /dbs/current_5_32_cxw.7z HTTP/1.1

Content-Type: text/html; charset=ISO-8859-1

Host: d2.smartpcupdate.com

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Server: nginx/1.5.5

Date: Thu, 17 Mar 2016 19:25:40 GMT

Content-Type: application/x-7z-compressed

Content-Length: 2164030

Last-Modified: Tue, 19 Jan 2016 08:33:03 GMT

Connection: keep-alive

ETag: "569df4bf-21053e"

Accept-Ranges: bytes

....

GET /dbs/current_5_32_cxw.7z HTTP/1.1

Content-Type: text/html; charset=ISO-8859-1

Host: d2.smartpcupdate.com

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Server: nginx/1.5.5

Date: Thu, 17 Mar 2016 19:25:40 GMT

Content-Type: application/x-7z-compressed

Content-Length: 2164030

Last-Modified: Tue, 19 Jan 2016 08:33:03 GMT

Connection: keep-alive

ETag: "569df4bf-21053e"

Accept-Ranges: bytes

7z..'....t....!.....Z.........a..).E.`...&d..&.1...!..m....9......<..Q.6..;.E..:.._g...hS5..$..../*!.Q3..@..AE...f9.4.M{...J...U.xv."Z.Q0..t..} .7...C......Y.....}t.{/... 2d..$.].....c.....q<.%..0U{..z......S...0...A'.k7Zy.Z.kl.=.]w..E_v.u.X..g.w..M.{..E...L.t.8..r/..tsF2P....9..O.J.i...........J........%.....e.... T>...Z.~...E........g3......M.Y.f._E....g.sR...?...{}Kj....w..U..{..YH_......FG.N..C.&.?K.A x6...W.....p..T.3.kB.-X>...E_8Q&ES3.{.d......o.,...rm..V;.....?...g. .w....<u.[UZ......E.%v.8l(.>J....VV..w.mV.W.".RvGS.P.Ah"Q.z..kx.wpM.P.....u....6.@..E5...U..9^...p....b.....D..&...........]...........p"X..Y....^)*........Z7p5nk.t.T.7..)\L.#...kJ...H./.^=.....]......6..V..X..^...K)c.....3..;.i..P...S.t-;..d.....Oyy\..tjr......n.7.~..c...6...!..h...V...4.@.........7.3....I.........?........0.f.,!....D.........-.0......F......_.a....n..1...1.pd!|.w...{V\t..........7 ..D.W.%.........1..Z..Sd........Gp.8..-]e...,.~..L`....h&..bwE....&t~W..B".?!8^.j.....OX...E.....9.a..$..B...GF......9=.#0MO,Maq.z1~..........d...*A...Qj.Uv.k.,..x......./%....9..o;.9q....6C...>fG.=....u..ABQ...X....h~...9....-....QZi..Y.HU|...X..$'.a..Z/.k8....Y.H.. B..... .C...8..2.....l.h.....o\.....w...:.b...*..y..23..VX..6.>......j..a..8..6.....<nDD.<( '..v....K&.C..YkJD.........N.J......'...=.4.3.........toE/!..Axl~.....B..Eg*..u..z..j.}.!.....P..%,|..~Y..j....H.3`........\.(.:zd1.....t.....i..dY..........Z*8KHx.en....5..*....(..<..dm .z"%..,......"..A..M.....V.'..T....!..K.....9......a.i]>.7...$jtp^H...uG

<<< skipped >>>

GET /rpc/sendinstall?partner=PCRepairLabsDU&build=3.2 HTTP/1.1

Host: service.smartpcupdate.com

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Thu, 17 Mar 2016 19:25:39 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.5.26

12..{"ok":1,"error":0}..0..

GET /inst?hid=1316d97eba6bcefe3e2338d69a89874126605403&sid=1F0A1C8C-C950-4DA9-8CC97BA7DAD3C23F&tr=141002000-US-014&a=NA&adm=1&os=5.1&x64=0&sil=1&st=201512301&e=200 HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Host: isysdrv.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 17 Mar 2016 19:25:34 GMT

Content-Type: text/plain

Content-Length: 0

Connection: keep-alive

Set-Cookie: __cfduid=dcdd83411f9e73c403626ca0d29af43901458242734; expires=Fri, 17-Mar-17 19:25:34 GMT; path=/; domain=.isysdrv.com; HttpOnly

Server: cloudflare-nginx

CF-RAY: 2852d4e301d72c72-AMS

....

GET /inst?sid=1F0A1C8C-C950-4DA9-8CC97BA7DAD3C23F&st=0&e=210 HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Host: isysdrv.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 17 Mar 2016 19:25:34 GMT

Content-Type: text/plain

Content-Length: 0

Connection: keep-alive

Set-Cookie: __cfduid=dcdd83411f9e73c403626ca0d29af43901458242734; expires=Fri, 17-Mar-17 19:25:34 GMT; path=/; domain=.isysdrv.com; HttpOnly

Server: cloudflare-nginx

CF-RAY: 2852d4e4a20e2c72-AMS

HTTP/1.1 200 OK..Date: Thu, 17 Mar 2016 19:25:34 GMT..Content-Type: text/plain..Content-Length: 0..Connection: keep-alive..Set-Cookie: __cfduid=dcdd83411f9e73c403626ca0d29af43901458242734; expires=Fri, 17-Mar-17 19:25:34 GMT; path=/; domain=.isysdrv.com; HttpOnly..Server: cloudflare-nginx..CF-RAY: 2852d4e4a20e2c72-AMS......

GET /inst?sid=1F0A1C8C-C950-4DA9-8CC97BA7DAD3C23F&st=0&du=4015&e=400 HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Host: isysdrv.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 17 Mar 2016 19:25:38 GMT

Content-Type: text/plain

Content-Length: 0

Connection: keep-alive

Set-Cookie: __cfduid=d9ea4cb71f99dd8494f80b5b1d5f134d51458242738; expires=Fri, 17-Mar-17 19:25:38 GMT; path=/; domain=.isysdrv.com; HttpOnly

Server: cloudflare-nginx

CF-RAY: 2852d4f985102c72-AMS

HTTP/1.1 200 OK..Date: Thu, 17 Mar 2016 19:25:38 GMT..Content-Type: text/plain..Content-Length: 0..Connection: keep-alive..Set-Cookie: __cfduid=d9ea4cb71f99dd8494f80b5b1d5f134d51458242738; expires=Fri, 17-Mar-17 19:25:38 GMT; path=/; domain=.isysdrv.com; HttpOnly..Server: cloudflare-nginx..CF-RAY: 2852d4f985102c72-AMS..

GET /t/du?sid=141002000-US-014&dt=1458249735&gid=8EE1E1A6-3E72-A927-7272-C6B5AD51792E&tz=2&ln=1&lc=0&bis=0&bief=0&biefx=0&bif=0&os=102&f=3293552760 HTTP/1.1

Host: bi.getlivesupport24x7.com

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Server: nginx/1.6.0

Date: Thu, 17 Mar 2016 19:25:37 GMT

Content-Type: application/octet-stream

Content-Length: 0

Connection: keep-alive

content-type: text/html

GET /rpc/getdatabasecxw?arch=32&os=5 HTTP/1.1

Content-Type: text/html; charset=ISO-8859-1

Host: service.smartpcupdate.com

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Thu, 17 Mar 2016 19:25:39 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.5.26

81..{"ok":1,"error":0,"url":"http:\/\/d2.smartpcupdate.com\/dbs\/current_5_32_cxw.7z","file_hash":"ff612b999f2c17b46fcb948e01ad5c2d"}..0..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

DUTray.exe_1336:

.text

`.itext

`.data

.idata

.didata

.rdata

@.reloc

B.rsrc

biClrImportant

tagMSG

Windows

HKEY

TWMKey

KeyData

grfLocksSupported

etNoMonitorSupportException

TArray

ENotSupportedException

ENoMonitorSupportException

ENoMonitorSupportException,

TArray

csshiftjis

windows-936

windows-1250

windows-1251

windows-1252

windows-1253

windows-1254

windows-1255

windows-1256

windows-1257

windows-1258

windows-874

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

TArray

Operator

EVariantBadIndexError

EVariantBadIndexError(

ssShift

htKeyword

EInvalidOperation

TList.TDirection

AOperator

TThread.TSynchronizeRecord

TOperation

Operation

FOnExecute

OnExecute

TArray

TList.Sort$594$0$Intf@

TList.Sort$594$ActRec

$TComponent.FindComponent$1217$0$Intf@

$TComponent.FindComponent$1217$ActRec

DeleteKey

TRegKeyInfo

NumSubKeys

MaxSubKeyLen

FCurrentKey

FRootKey

FCloseRootKey

CloseKey

CreateKey

GetKeyInfo

GetKeyNames

HasSubKeys

KeyExists

LoadKey

MoveKey

OpenKey

OpenKeyReadOnly

ReplaceKey

RestoreKey

SaveKey

UnLoadKey

CurrentKey\

LastErrorMsg

RootKey\

RootKeyName

EInvalidGraphicOperation

EInvalidGraphicOperation@^E

SupportsPartialTransparency

SupportsClipboardFormat

Monochrome$

Uh.dF

IsShortCut

FHelpKeyword

HelpKeywordt'C

igoParentPassthrough

FAlwaysShowDragImages

AlwaysShowDragImages

toFlickFallbackKeys

'TCustomGestureEngine.TGestureEngineFlag

(TCustomGestureEngine.TGestureEngineFlags

Supported

TKeyEvent

TKeyPressEvent

HelpKeywordT'C

FOnKeyDown

FOnKeyPress

FOnKeyUp

IsHintMsg

FNativeWheelSupport

FWheelSupportMessage

thHeaderItemLeftPressed

tsArrowBtnLeftPressed

ttbThumbLeftPressed

lrMonoChrome

FAutoHotkeys

RethinkHotkeys

AutoHotkeysXII

AutoHotkeys

HelpKeyword

UnderstandsKeyword

poPortrait

APort

Port

OnKeyDown

OnKeyPresst

OnKeyUpP

FProportional

Proportional

ssHotTrack

TWindowState

poProportional

fsShowing

FWindowState

FKeyPreview

WantChildKey

KeyPreview

WindowState

KeyPreview$

FBiDiKeyboard

FNonBiDiKeyboard

FEnumAllWindowsOnActivateHint

FOnActionExecute

Keyword

EnumAllWindowsOnActivateHint\

BiDiKeyboard\

NonBiDiKeyboard

OnActionExecute4

fKeyword

AMsg

CheckIPVersionSupport

VPort

WSGetServByPort

APortNumber

AddServByPortToList

TIdSocketListWindows4

TIdSocketListWindows

IdStackWindows

TIdStackWindowsg

ReceiveMsg

WSTranslateSocketErrorMsg

SupportsIPv6

TIdStackWindows

EIdIPVersionUnsupported

FSourcePort

FDestPort

SourcePort

DestPort

Generics.Defaults

Generics.Collections

UrlMon

1.2.3

oleaut32.dll

advapi32.dll

RegOpenKeyExW

RegCloseKey

user32.dll

kernel32.dll

UnhookWindowsHookEx

SetWindowsHookExW

MsgWaitForMultipleObjectsEx

MsgWaitForMultipleObjects

MapVirtualKeyW

LoadKeyboardLayoutW

GetKeyboardState

GetKeyboardLayoutNameW

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextW

EnumWindows

EnumThreadWindows

EnumChildWindows

ActivateKeyboardLayout

msimg32.dll

gdi32.dll

SetViewportOrgEx

version.dll

GetCPInfoExW

GetCPInfo

RegUnLoadKeyW

RegSaveKeyW

RegRestoreKeyW

RegReplaceKeyW

RegQueryInfoKeyW

RegLoadKeyW

RegFlushKey

RegEnumKeyExW

RegDeleteKeyW

RegCreateKeyExW

ole32.dll

SHFolder.dll

comctl32.dll

winspool.drv

shell32.dll

ShellExecuteW

windowscodecs.dll

uxtheme.dll

DWMAPI.DLL

1$1$0,0004080

;%;

8*888[8}8

7}7u7

?#?'? ?/?3?7?;???

2(3=3{3[4

5#5'5 5/53575;5?5

5 5$5(5,5054585\5~5

7"7&7*7.72767

1!141>1{1

535@5^5{5

<_>

0!11k1s1

2,2S2

9â€“9D9]9l9

11D1]1l1

4 4$4(4,404

5P5D5O5]5

0 0$0(0,0

1 1$1(1,10141

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

3333333

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

%%%U)))'%%%

$&&{4666)

%"!^'%#=!!

Paint.NET v3.5.100

paint.net 4.0;

KWindows

CGenerics.Defaults

%sTray

Font.Charset

Font.Color

Font.Height

Font.Name

Font.Style

(%s found NN outdated drivers on your PC.

-%s detected a new device attached to your PC.

name="SmartDriverUpdater.exe"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

PSAPI.dll

NTDLL.DLL

%s-%s

%s[%d]

%s_%d

.Owner

\\?\UNC\

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_CURRENT_CONFIG

HKEY_DYN_DATA

%s (*.%s)|*.%1:s

%s (%s)|%1:s|

SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes

crSQLWait

%s (%s)

imm32.dll

\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\

clWebSnow

clWebFloralWhite

clWebLavenderBlush

clWebOldLace

clWebIvory

clWebCornSilk

clWebBeige

clWebAntiqueWhite

clWebWheat

clWebAliceBlue

clWebGhostWhite

clWebLavender

clWebSeashell

clWebLightYellow

clWebPapayaWhip

clWebNavajoWhite

clWebMoccasin

clWebBurlywood

clWebAzure

clWebMintcream

clWebHoneydew

clWebLinen

clWebLemonChiffon

clWebBlanchedAlmond

clWebBisque

clWebPeachPuff

clWebTan

clWebYellow

clWebDarkOrange

clWebRed

clWebDarkRed

clWebMaroon

clWebIndianRed

clWebSalmon

clWebCoral

clWebGold

clWebTomato

clWebCrimson

clWebBrown

clWebChocolate

clWebSandyBrown

clWebLightSalmon

clWebLightCoral

clWebOrange

clWebOrangeRed

clWebFirebrick

clWebSaddleBrown

clWebSienna

clWebPeru

clWebDarkSalmon

clWebRosyBrown

clWebPaleGoldenrod

clWebLightGoldenrodYellow

clWebOlive

clWebForestGreen

clWebGreenYellow

clWebChartreuse

clWebLightGreen

clWebAquamarine

clWebSeaGreen

clWebGoldenRod

clWebKhaki

clWebOliveDrab

clWebGreen

clWebYellowGreen

clWebLawnGreen

clWebPaleGreen

clWebMediumAquamarine

clWebMediumSeaGreen

clWebDarkGoldenRod

clWebDarkKhaki

clWebDarkOliveGreen

clWebDarkgreen

clWebLimeGreen

clWebLime

clWebSpringGreen

clWebMediumSpringGreen

clWebDarkSeaGreen

clWebLightSeaGreen

clWebPaleTurquoise

clWebLightCyan

clWebLightBlue

clWebLightSkyBlue

clWebCornFlowerBlue

clWebDarkBlue

clWebIndigo

clWebMediumTurquoise

clWebTurquoise

clWebCyan

clWebPowderBlue

clWebSkyBlue

clWebRoyalBlue

clWebMediumBlue

clWebMidnightBlue

clWebDarkTurquoise

clWebCadetBlue

clWebDarkCyan

clWebTeal

clWebDeepskyBlue

clWebDodgerBlue

clWebBlue

clWebNavy

clWebDarkViolet

clWebDarkOrchid

clWebMagenta

clWebDarkMagenta

clWebMediumVioletRed

clWebPaleVioletRed

clWebBlueViolet

clWebMediumOrchid

clWebMediumPurple

clWebPurple

clWebDeepPink

clWebLightPink

clWebViolet

clWebOrchid

clWebPlum

clWebThistle

clWebHotPink

clWebPink

clWebLightSteelBlue

clWebMediumSlateBlue

clWebLightSlateGray

clWebWhite

clWebLightgrey

clWebGray

clWebSteelBlue

clWebSlateBlue

clWebSlateGray

clWebWhiteSmoke

clWebSilver

clWebDimGray

clWebMistyRose

clWebDarkSlateBlue

clWebDarkSlategray

clWebGainsboro

clWebDarkGray

clWebBlack

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

hXXp://VVV.pcrepairlabs.com

pcspeedmaximizer.exe

PC Speed Maximizer\PCSpeedMaximizer.exe

PC Speed Maximizer Pro\PCSpeedMaximizerPro.exe

HomePageURL

AfterInstallURL

SupportURL

UninstallURL

BuyNowURL

AdsDownloadURL

AdsBuyNowURL

AdsDownloadURL2

AdsBuyNowURL2

*.status

%s detected a new device attached to your PC.

English.ini

French.ini

German.ini

Spanish.ini

Italian.ini

Portuguese.ini

Danish.ini

Dutch.ini

Swedish.ini

Polish.ini

Russian.ini

Brazilian.ini

Finnish.ini

Norwegian.ini

Japanese.ini

Chinese.ini

Czech.ini

Arabic.ini

StartWithWindows

s_Exec

D:\Projects\Components XE\Indy\Lib\System\IdGlobal.pas

ISO_646.irv:1991

ISO_646.basic:1983

ISO_646.irv:1983

csISO16Portuguese

csISO84Portuguese2

csShiftJIS

ISO-8859-1-Windows-3.0-Latin-1

csWindows30Latin1

ISO-8859-1-Windows-3.1-Latin-1

csWindows31Latin1

ISO-8859-2-Windows-Latin-2

csWindows31Latin2

ISO-8859-9-Windows-Latin-5

csWindows31Latin5

csMicrosoftPublishing

Windows-31J

csWindows31J

PTCP154

csPTCP154

WS2_32.DLL

getservbyport

WSAAsyncGetServByPort

WSAJoinLeaf

MSWSOCK.DLL

WSARecvMsg

WSASendMsg

Wship6.dll

Fwpuclnt.dll

IdnDL.dll

Normaliz.dll

iphlpapi.dll

0.0.0.0

127.0.0.1

D:\Projects\Components XE\Indy\Lib\System\IdStack.pas

HTTP-EQUIV

()@,;:\"./

()@,;:\"/[]?=

()@,;:\"/[]?={}

*#%"{}|\^[]`

Backup\*.*

Drivers\*.*

\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Portable Network Graphics

systemoptimizer.exe

System Optimizer\SystemOptimizer.exe

Kernel32.dll

%s is not a valid service.

%s is not a valid IPv6 address:The requested IPVersion / Address family is not supported.

Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.

Operation now in progress.

Operation already in progress.

Socket operation on non-socket.

Protocol not supported.

Socket type not supported."Operation not supported on socket.

Protocol family not supported.0Address family not supported by protocol family.

7The png image could not be loaded from the resource ID.oSome operation could not be performed because the system is out of resources. Close some windows and try again.

Setting bit transparency color is not allowed for png images containing alpha value for each pixel (COLOR_RGBALPHA and COLOR_GRAYSCALEALPHA)OThis operation is not valid because the current image contains no valid header.4The new size provided for image resizing is invalid.oThe "Portable Network Graphics" could not be created because invalid image type parameters have being provided.-Error on call to Winsock2 library function %s&Error on loading Winsock2 library (%s)

Socket Error # %d

Operation would block.yThe "Portable Network Graphics" image could not be loaded because one of its main piece of data (ihdr) might be corruptedUThis "Portable Network Graphics" image is invalid because it has missing image parts.[Could not decompress the image because it contains invalid compressed data.

Description: BThe "Portable Network Graphics" image contains an invalid palette.

The file being read is not a valid "Portable Network Graphics" image because it contains an invalid header. This file may be corrupted, try obtaining it againnThis "Portable Network Graphics" image is not supported or it might be invalid.

This "Portable Network Graphics" image is not supported because either its width or height exceeds the maximum size of 65535 pixels.

There is no such palette entry.dThis "Portable Network Graphics" image contains an unknown critical part which could not be decoded.pThis "Portable Network Graphics" image is encoded with an unknown compression scheme which could not be decoded.cThis "Portable Network Graphics" image uses an unknown interlace scheme which could not be decoded.-The chunks must be compatible to be assigned.jThis "Portable Network Graphics" image is invalid because the decoder found an unexpected end of the file.8This "Portable Network Graphics" image contains no data.]The program tried to add a existent critical chunk to the current image which is not allowed.IIt's not allowed to add a new chunk because the current image is invalid.

All Clipboard does not support Icons Operation not supported on selected printer.There is no default printer currently selected/Menu '%s' is already being used by another form

- Dock zone has no controlLError loading dock zone from the stream. Expecting version %d, but found %d.jThis "Portable Network Graphics" image is not valid because it contains invalid pieces of data (crc error)

Enhanced Metafiles Cannot focus a disabled or invisible window!Control '%s' has no parent window$Parent given is not a parent of '%s'

%s on %s@GroupIndex cannot be less than a previous menu item's GroupIndex

Invalid image!Cannot change the size of an iconÃŠnnot change the size of a WIC Image$Unknown picture file extension (.%s)

Unsupported clipboard format

Invalid Timeout value: %s

''%s'' is not a valid date#''%s'' is not a valid date and time#''%s'' is not a valid integer value

''%s'' is not a valid time

No help found for context %d

No help found for %s

Thread creation error: %s

Thread Error: %s (%d)-Cannot terminate an externally created thread,Cannot wait for an externally created thread2Cannot call Start on a running or suspended thread;Cannot call CheckTerminated on an externally created thread9Cannot call SetReturnValue on an externally create thread'Parameter %s cannot be a negative value*Input buffer exceeded for %s = %d, %s = %d

The specified path is too long The specified path was not found The path format is not supported The specified file was not found$No help viewer that supports filters2Length of Strings and Objects arrays must be equal

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream)%s has not been registered as a COM class

Error reading %s%s%s: %s

Failed to create key %s

Failed to get data for '%s'

Failed to set data for '%s'

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s

Unable to write to %s

Invalid file name - %s

Invalid stream format$''%s'' is not a valid component name

Invalid data type for '%s' List capacity out of bounds (%d)

Invalid destination array"Character index out of bounds (%d)

Start index out of bounds (%d)

Invalid count (%d)

Invalid destination index (%d)

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

External exception %x

Interface not supported

Object lock not owned(Monitor support function not initialized

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid variant operation

Invalid NULL variant operation%Invalid variant operation (%s%.8x)

%s,Custom variant type (%s%.4x) is out of range/Custom variant type (%s%.4x) already used by %s*Custom variant type (%s%.4x) is not usable2Too many custom variant types have been registered5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

Write$Error creating variant or safe array('%s' is not a valid floating point value '%d.%d' is not a valid timestamp

I/O error %d

Integer overflow Invalid floating point operation

3.1.0.5

DUTray.exe

DriverUpdater.exe_1492:

.text

`.itext

`.data

.idata

.didata

.edata

@.tls

.rdata

@.reloc

B.rsrc

biClrImportant

tagMSG

Windows

HKEY

TWMKey

KeyData

etNoMonitorSupportException

TArray

ENotSupportedException

ENoMonitorSupportException

TArray

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

TArray

grfLocksSupported

tdPortNameOffset

Operator

EVariantBadIndexError

EVariantBadIndexErrorxyB

ssShift

htKeyword

EInvalidOperation

EInvalidOperationX.C

TList.TDirection

AOperator

TThread.TSynchronizeRecord

TOperation

Operation

FOnExecute

OnExecute

TArray

TList.Sort$594$0$Intfh

TList.Sort$594$ActRec

TList.Sort$594$ActRec4

$TComponent.FindComponent$1217$0$Intfh

$TComponent.FindComponent$1217$ActRec

$TComponent.FindComponent$1217$ActRecP

Generics.Collections

TRegKeyInfo

NumSubKeys

MaxSubKeyLen

FCurrentKey

FRootKey

FCloseRootKey

CloseKey

CreateKey

DeleteKey

GetKeyInfo

GetKeyNames

HasSubKeys

KeyExists

LoadKey

MoveKey

OpenKey

OpenKeyReadOnly

ReplaceKey

RestoreKey

SaveKey

UnLoadKey

CurrentKey\

LastErrorMsg

RootKey\

RootKeyName

EInvalidGraphicOperation

SupportsPartialTransparency

SupportsClipboardFormat

MonochromeP

IsShortCut

FHelpKeyword

HelpKeywordX$C

igoParentPassthrough

FAlwaysShowDragImages

AlwaysShowDragImages

toFlickFallbackKeys

'TCustomGestureEngine.TGestureEngineFlag

(TCustomGestureEngine.TGestureEngineFlags

Supported

TKeyEvent

TKeyPressEvent

HelpKeyword8$C

FOnKeyDown

FOnKeyPress

FOnKeyUp

IsHintMsg

FNativeWheelSupport

FWheelSupportMessage

thHeaderItemLeftPressed

tsArrowBtnLeftPressed

ttbThumbLeftPressed

lrMonoChrome

FAutoHotkeys

RethinkHotkeys

AutoHotkeys

AutoHotkeys$

HelpKeyword

UnderstandsKeyword

FPasswordChar

PasswordChar

OnKeyDown

OnKeyPressx

OnKeyUpT

ssHorizontal

OnKeyUp

TCustomButton.TButtonStyle

FProportional

Proportional

FOldKeyDown

cdsShowKeyboardCues

vsReport

FURL

ssHotTrack

TWindowState

poProportional

fsShowing

FWindowState

FKeyPreview

WantChildKey

KeyPreview 3I

WindowState@xM

KeyPreview

WindowState

FBiDiKeyboard

FNonBiDiKeyboard

FEnumAllWindowsOnActivateHint

FOnActionExecute

Keyword

EnumAllWindowsOnActivateHint\

BiDiKeyboard\

NonBiDiKeyboard

OnActionExecute@zF

fKeyword

IFontAccessh

IPictureAccessh

TCommonShellExecuteThread,

TCommonShellExecuteThread

shell32.dll

shlwapi.dll

Mpr.dll

THKeyArray

TCommonKeyState

cksShift

TCommonKeyStates

Userenv.dll

NETAPI32.DLL

SVRAPI.DLL

elsReport

elsReportThumb

TAutoGroupGetKeyEvent

TColumnGetImageIndexEvent

TColumnSetImageIndexEvent

KeyState

KeyStates

TGroupGetImageIndexEvent

TGroupSetImageIndexEvent

HintWindowShown

TItemGetGroupKeyEvent

GroupKey

TItemGetImageIndexEvent

TItemSetGroupKeyEvent

TItemSetImageIndexEvent

MouseMsg

TEasyKeyActionEvent

EscapeKeyPressed

TEasyViewReportItem

TEasyViewReportThumbItem

TEasyViewReportThumbItemT}R

TEasyGridReportGroup

TEasyGridReportGroup`

TEasyGridReportThumbGroup

TEasyGridReportThumbGroupL

TEasyCellSizeReport4

TEasyCellSizeReport

TEasyCellSizeReportThumb

TEasyCellSizeReportThumb,

ReportThumb

Report

AlwaysShow

OnAutoGroupGetKey

OnItemGetGroupKey

OnItemSetGroupKey

OnKeyAction

Uh&%U

EIdCanNotBindPortInRange

EIdCanNotBindPortInRange8

EIdInvalidPortRange

TIdSocketListWindows

TIdSocketListWindowslEX

IdStackWindows

TIdStackWindows8GX

TIdStackWindowsDFX

EIdIPVersionUnsupportedDyX

EIdIPVersionUnsupported

LicenseKey

ESQLiteException

SQLiteTable3

TSQLiteDatabase

TSQLiteTable

TSQLiteTableP

ftpTransfer

ftpReady

ftpAborted

EIdPortRequired8

EIdPortRequired

EIdTCPConnectionError

EIdTCPConnectionErrorp

EIdObjectTypeNotSupported

EIdObjectTypeNotSupported(

Port

ClientPortMin

ClientPortMax\

Port4

"EIdTransparentProxyUDPNotSupported

TIdTCPClientCustom

IdTCPClient

TIdTCPClient

TIdTCPClient$|Z

BoundPort

%EIdSocksUDPNotSupportedBySOCKSVersion

saUsernamePassword

Password

DefaultPort

TIdTCPConnection

TIdTCPConnection$

IdTCPConnection

IdHTTPHeaderInfo

ProxyPassword

ProxyPort\

Password\

TIdMetaHTTPEquiv

EIdUnsupportedOperationd

EIdUnsupportedOperation

sslvrfFailIfNoPeerCert

AMsg

TCallbackExEvent

TPasswordEvent

TPasswordEventEx

VPassword

Certificate

RootCertFile\

CertFile\

KeyFile\

OnGetPasswordl~\

OnGetPasswordEx

EIdOSSLLoadingRootCertError

EIdOSSLLoadingRootCertErrort

EIdOSSLLoadingCertError\

EIdOSSLLoadingCertError4

EIdOSSLLoadingKeyError

TIdHTTPOption

hoNoParseMetaHTTPEquiv

IdHTTP

TIdHTTPOptions

TIdHTTPProtocolVersion

TIdHTTPOnRedirectEvent

TIdHTTPOnHeadersAvailable

TIdHTTPResponse

TIdHTTPResponsexO]

TIdHTTPRequest

TIdHTTPRequest@P]

TIdHTTPProtocol,Q]

TIdHTTPProtocol

TIdCustomHTTP

TIdHTTP

HTTPOptions

EIdHTTPProtocolException

TMonochromeLookup

SetupDiOpenClassRegKey

SetupDiOpenClassRegKeyExA

SetupDiOpenClassRegKeyExW

SetupDiCreateDeviceInterfaceRegKeyA

SetupDiCreateDeviceInterfaceRegKeyW

SetupDiOpenDeviceInterfaceRegKey

SetupDiDeleteDeviceInterfaceRegKey

SetupDiCreateDevRegKeyA

SetupDiCreateDevRegKeyW

SetupDiOpenDevRegKey

SetupDiDeleteDevRegKey

CM_Delete_Class_Key

CM_Delete_Class_Key_Ex

CM_Delete_DevNode_Key

CM_Delete_DevNode_Key_Ex

CM_Get_Class_Key_NameA

CM_Get_Class_Key_NameW

CM_Get_Class_Key_Name_ExA

CM_Get_Class_Key_Name_ExW

CM_Open_Class_KeyA

CM_Open_Class_KeyW

CM_Open_Class_Key_ExA

CM_Open_Class_Key_ExW

CM_Open_DevNode_Key

CM_Open_DevNode_Key_Ex

IProgressh

ICryptoGetTextPasswordh

ICryptoGetTextPassword2h

Common.LoggerWindow

Common.Logger

Driver.CoreSnapshot

Driver.CoreResult

Uh.ua

Common.RestorePoint\

Common.RestorePoint b

Driver.CoreInstall

'TPair

BTArray>

GTEnumerator>(

GTEnumerator>

GTEnumerable>-

GTEnumerable>

3TDictionary.TItem

8TDictionary.TItemArray

"IEqualityComparerh

Generics.Defaults

'TCollectionNotifyEvent

(TCollectionNotifyEvent

TArray

TEnumerator(

TEnumerator

TEnumerable-

TEnumerable$

.TKeyEnumerator;

.TKeyEnumerator\

.TKeyCollection;

.TKeyCollection4

TArray

TEnumerator(

TEnumeratort

TEnumerable-

TEnumerable

>TDictionary.TValueEnumerator;

>TDictionary.TValueEnumerator

>TDictionary.TValueCollection;

>TDictionary.TValueCollection

=TDictionary.TPairEnumerator;

=TDictionary.TPairEnumerator

FOnKeyNotify

FKeyCollection

-TDictionary9

ContainsKey

-TDictionary

Keys

OnKeyNotify

[:{Generics.Collections}TList>.:1

EIComparer>h

RTCollectionNotifyEvent>

Item'TPair

GIEnumerable>

MTList>.TEnumerator5

MTList>.TEnumerator$

ATList>&

ATList>

0:{Generics.Collections}TList.:1

IComparerh

IEnumerable

"TList.TEnumerator5

"TList.TEnumerator

TList&

TListp

1:{Generics.Collections}TList.:1

IComparerh

IEnumerable

#TList.TEnumerator5

#TList.TEnumerator

TList&

TListX

GTComparison>h

ETComparer>2

ETComparer>

[:{Generics.Collections}TList>.:3

TComparisonh

TComparer2

TComparer

0:{Generics.Collections}TList.:3

TComparisonh

TComparer2

TComparer`

1:{Generics.Collections}TList.:3

Driver.Core

EInvalidGridOperation

goAlwaysShowEditor

doKeyColFixed

TKeyOption

keyEdit

keyAdd

keyDelete

keyUnique

TKeyOptions

KeyName

KeyValue

FKeyOptions

FDupKeySave

KeyOptionspPd

KeyIsValid

FKeyDesc

KeyDesc\WC

;!199{199

;0!8&2{199

"

Windows 95

Windows 95 OSR-2

Windows 98

Windows 98 SE

Windows ME

Windows 9x New

Windows NT 3

Windows NT 4

Windows 2000

Windows XP

Windows 2003

Windows Vista

Windows 2008

Windows 7

Windows 2008 R2

Windows 8

Windows Server 8

Windows NT New

TMsgHandler

TMsgHandlerOO

user.exe

TMsgHandlers

madToolsMsgHandlerWindow

>0';0974&0{199

Export

MapFileNameVVV.madshi.net

dbghelp.dll

4.0.11

bSendBugReport

bSaveBugReport

bPrintBugReport

bShowBugReport

esSysUtilsShowException

esHttpExtension

esIntraweb

esTThreadExecute

epCompleteReport

TBugReportCallback

bugReport

TBugReportCallbackOO

eaSendBugReport

eaSaveBugReport

eaPrintBugReport

eaSendBugReport2

eaSaveBugReport2

eaPrintBugReport2

eaSendBugReport3

eaSaveBugReport3

eaPrintBugReport3

eaShowBugReport

TBugReportPluginA

TBugReportPluginW

TBugReportPluginExA

TBugReportPluginExW

advapi32.dll

The import table is invalid.

WindowsLogo

ReportLeaks

UploadViaHttp

HttpServer

HttpSsl

HttpPort

HttpAccount

HttpPassword

BugTrPassword

MailAsSmtpServer

MailAsSmtpClient

SmtpServer

SmtpSsl

SmtpTls

SmtpPort

SmtpAccount

SmtpPassword

bugreport.mbr

screenshot.png

ExceptMsg

FrozenMsg

BitFaultMsg

send bug report

save bug report

print bug report

show bug report

%appname%, %exceptMsg%

bug report

please find the bug report attached

Sending bug report...

PrepAttMsg

MxLookMsg

ConnMsg

SendMailMsg

FieldMsg

SendAttMsg

SendFinalMsg

SendFailMsg

Sorry, sending the bug report didn't work.

GetWindowsLogo

SetWindowsLogo

GetFilter1NoBugReport

GetFilter2NoBugReport

GetGeneralNoBugReport

SetFilter1NoBugReport

SetFilter2NoBugReport

SetGeneralNoBugReport

GetAutoShowBugReport

SetAutoShowBugReport

GetHttpServer

SetHttpServer

GetHttpSsl

SetHttpSsl

GetHttpPort

SetHttpPort

GetHttpAccount

SetHttpAccount

GetHttpPassword

SetHttpPassword

GetBugTrackerPassword

SetBugTrackerPassword

GetMailAsSmtpServer

SetMailAsSmtpServer

GetMailAsSmtpClient

SetMailAsSmtpClient

GetSmtpServer

SetSmtpServer

GetSmtpSsl

SetSmtpSsl

GetSmtpTls

SetSmtpTls

GetSmtpPort

SetSmtpPort

GetSmtpAccount

SetSmtpAccount

GetSmtpPassword

SetSmtpPassword

GetAttachBugReport

SetAttachBugReport

GetAttachBugReportFile

SetAttachBugReportFile

GetDeleteBugReportFile

SetDeleteBugReportFile

GetBugReportSendAs

SetBugReportSendAs

GetBugReportZip

SetBugReportZip

GetBugReportFile

SetBugReportFile

GetAppendBugReports

SetAppendBugReports

GetBugReportFileSize

SetBugReportFileSize

GetExceptMsg

SetExceptMsg

GetFrozenMsg

SetFrozenMsg

GetBitFaultMsg

SetBitFaultMsg

GetPrepareAttachMsg

SetPrepareAttachMsg

GetMxLookupMsg

SetMxLookupMsg

GetConnectMsg

SetConnectMsg

GetSendMailMsg

SetSendMailMsg

GetFieldsMsg

SetFieldsMsg

GetSendAttachMsg

SetSendAttachMsg

GetSendFinalizeMsg

SetSendFinalizeMsg

GetSendFailureMsg

SetSendFailureMsg

TDABugReportCallback

TDABugReportCallbackOO

FBugReportHeader

FBugReportSections

FBugReport

FBugReportCallbacks

FBugReportCallbacksOO

FCreateBugReport

FCorrectBugReportNo

GetBugReportHeader

GetBugReportSections

GetBugReport_

SetBugReport

GetBugReport

RegisterBugReportCallback

bugReportCallback

UnregisterBugReportCallback

GetCreateBugReport

SetCreateBugReport

ShowBugReport

SendBugReport

SaveBugReport

PrintBugReport

CompleteBugReport

CriticalBugReportCallbackExists

VVV.google.com

SMTP:

A.ROOT-SERVERS.NET

K.ROOT-SERVERS.NET

VVV.madshi.net_multipart_boundary

sbtPassResponse

cSupportedAlgs

palgSupportedAlgs

FTlsSupported

TSmtp

port

password

LOGIN

AUTH LOGIN

TWinHttpProxyInfo

lpszProxyBypass

FUrl

FPort

FBugTrackerPassword

FHttpAuthUser

FHttpAuthPassword

FProxyPassword

TWinHttp

httpAuthUser

httpAuthPassword

bugTrackerPassword

proxyBypass

proxyPassword

TWinHttp

/api.xml

?cmd=

/xmlrpc.cgi

Bugzilla.version

Product.get_enterable_products

Product.get

Bug.fields

Bugzilla_login

Bugzilla_password

Bug.create

Bug.add_attachment

/api/soap/mantisconnect.php

*.txt

TSendBugReportExRec

FDefaultMsgBox

defaultMsgBox

BugReportChanged

ServerSupportFunctionNext

kernel32.dll

user32.dll

coreide150.bpl

FaultRep.dll

internal error. please notify bug@madshi.net

IWebBrowser

IWebBrowserApp,

IWebBrowser2d

TWebBrowserStatusTextChange

TWebBrowserProgressChange

TWebBrowserCommandStateChange

TWebBrowserTitleChange

TWebBrowserPropertyChange

TWebBrowserBeforeNavigate2

TWebBrowserNewWindow2

TWebBrowserNavigateComplete2

TWebBrowserDocumentComplete

TWebBrowserOnVisible

TWebBrowserOnToolBar

TWebBrowserOnMenuBar

TWebBrowserOnStatusBar

TWebBrowserOnFullScreen

TWebBrowserOnTheaterMode

TWebBrowserWindowSetResizable

TWebBrowserWindowSetLeft

TWebBrowserWindowSetTop

TWebBrowserWindowSetWidth

TWebBrowserWindowSetHeight

TWebBrowserWindowClosing

TWebBrowserClientToHostWindow

TWebBrowserSetSecureLockIcon

TWebBrowserFileDownload

TWebBrowserNavigateError

%TWebBrowserPrintTemplateInstantiation

TWebBrowserPrintTemplateTeardown

TWebBrowserUpdatePageStatus

%TWebBrowserPrivacyImpactedStateChange

TWebBrowserNewWindow3

bstrUrlContext

bstrUrl

"TWebBrowserSetPhishingFilterStatus

TWebBrowserWindowStateChanged

dwWindowStateFlags

TWebBrowserNewProcess

TWebBrowserThirdPartyUrlBlocked

!TWebBrowserRedirectXDomainBlocked

StartURL

RedirectURL

TWebBrowserBeforeScriptExecute

TWebBrowserWebWorkerStarted

TWebBrowserWebWorkerFinsihed

TWebBrowser

OnWindowSetResizable

OnWindowSetLeft

OnWindowSetTop

OnWindowSetWidthd

OnWindowSetHeight

OnWindowStateChanged

OnThirdPartyUrlBlockedl

OnBeforeScriptExecute

OnWebWorkerStarted

OnWebWorkerFinsihed

FormKeyDown

IdHTTP1

HTTPWorkBegin

HTTPWork

HTTPWorkEnd

TIdTCPStream

TIdTCPStreamp$m

IdTCPStream

utNoTLSSupport

EIdSASLNotSupported,

EIdSASLNotSupported

TIdSMTPEnhancedCodeh n

TIdSMTPEnhancedCodeD n

IdReplySMTP

TIdReplySMTP

EIdSMTPReplyError

EIdSMTPReply

EIdSMTPReply`.n

EIdSMTPReplyInvalidReplyString

EIdSMTPReplyInvalidClass

TIdSMTPFailedRecipient

TIdSMTPBase

TIdSMTPBaseD=n

IdSMTPBase

PipeLine

TIdSMTPAuthenticationType

IdSMTP

TIdSMTP|Pn

TIdSMTP

ValidateAuthLoginCapabilitypjm

IdSMTP1

Driver.CoreDriverList

*TArray

/TEnumerator(

/TEnumerator

/TEnumerable-

/TEnumerable

C:{Generics.Collections}TList.:1

Driver.CoreDriverListD

-IComparerh

:TCollectionNotifyEvent

/IEnumerable

5TList.TEnumerator5

5TList.TEnumeratorp

)TList&

)TList0

/TObjectList

1TArray

6TEnumerator(

6TEnumerator8

6TEnumerable-

6TEnumerable

J:{Generics.Collections}TList.:1

Driver.CoreDriverList

4IComparerh

ATCollectionNotifyEvent

6IEnumerable

.TEnumerator5

.TEnumerator

0TList&

0TList

6TObjectList

6TObjectListt

6TComparisonh

4TComparer2

4TComparer

8TPair

dTPair>

TArray>>

TEnumerator>>(

TEnumerator>>4

TEnumerable>>-

TEnumerable>>,

oTDictionary>.TItem

tTDictionary>.TItemArray

!IEqualityComparerh

&TCollectionNotifyEvent

fTCollectionNotifyEvent>

Item8TPair

TArray

TEnumerator(

TEnumerator

TEnumerable-

TEnumerable

xTDictionary>.TKeyEnumerator;

xTDictionary>.TKeyEnumeratorT

xTDictionary>.TKeyCollection;

xTDictionary>.TKeyCollection

VTArray>

[TEnumerator>(

[TEnumerator>

[TEnumerable>-

[TEnumerable>

zTDictionary>.TValueEnumerator;

zTDictionary>.TValueEnumerator

zTDictionary>.TValueCollection;

zTDictionary>.TValueCollectionH

yTDictionary>.TPairEnumerator;

yTDictionary>.TPairEnumerator

iTDictionary>9

iTDictionary>

OnKeyNotifyH

/TComparisonh

-TComparer2

-TComparerdWo

C:{Generics.Collections}TList.:3

J:{Generics.Collections}TList.:3

=TDelegatedComparer8

=TDelegatedComparer

:{Generics.Collections}TList>>.:1

IComparer>>h

TCollectionNotifyEvent>>

ItemdTPair>

IEnumerable>>

TList>>.TEnumerator5

TList>>.TEnumerator

TList>>&

TList>>

/:{Generics.Collections}TList.:1

IComparerh

IEnumerable

!TList.TEnumerator5

!TList.TEnumerator8mo

TList&

TList

o:{Generics.Collections}TList>.:1

Driver.CoreDriverList(

YIComparer>h

[IEnumerable>

aTList>.TEnumerator5

aTList>.TEnumerator

UTList>&

UTList>

TComparison>>h

TComparer>>2

TComparer>>

:{Generics.Collections}TList>>.:3

TComparisonh

TComparer2

TComparer

/:{Generics.Collections}TList.:3

[TComparison>h

YTComparer>2

YTComparer>

o:{Generics.Collections}TList>.:3

Common.Internet

TfrmCheckURL

TfrmCheckURL4

URLChecker

IdHTTP0x

IdHTTP11|

btnCheckURL

HTTP0Work

HTTP0Work2

HTTP1Start

HTTP2Start

HTTP3Start

HTTP4Start

HTTP5Start

HTTP1Work

HTTP2Work

HTTP3Work

HTTP4Work

HTTP5Work

InstallExeDriver

actDebugExecute

btnCheckURLClick

TPackageName|%s

Common.Utils

Common.Params

Driver.Utils

Driver.CoreDevices

Driver.CoreDevicesHelpers

UrlMon

SQLite3

IdTCPServer

IdCustomTCPServer

Common.RestorePoint

JwaWS2tcpip

JwaIpExport

IdCmdTCPServer

1.2.3

#!V!W!"!&!r%!%#%%%'%)%c%e%g%C%

P%S%V%Y%\%

6666666666666666

?456789:;

!"#$%&'()* ,-./0123

0123456

!"#$%&'()* ,-./0123456789:;?

&'()* ,-./0123456789:;?

oleaut32.dll

RegOpenKeyExW

RegCloseKey

UnhookWindowsHookEx

SetWindowsHookExW

SetKeyboardState

MsgWaitForMultipleObjectsEx

MsgWaitForMultipleObjects

MapVirtualKeyW

LoadKeyboardLayoutW

GetKeyboardState

GetKeyboardLayoutNameW

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextW

GetAsyncKeyState

ExitWindowsEx

EnumWindows

EnumThreadWindows

EnumChildWindows

ActivateKeyboardLayout

msimg32.dll

gdi32.dll

SetViewportOrgEx

SetViewportExtEx

version.dll

GetWindowsDirectoryA

GetWindowsDirectoryW

GetCPInfoExW

GetCPInfo

CreatePipe

RegQueryInfoKeyW

RegOpenKeyExA

RegFlushKey

RegEnumKeyExW

RegCreateKeyExA

RegCreateKeyExW

SHFolder.dll

ole32.dll

comctl32.dll

SHFileOperationA

SHFileOperationW

ShellExecuteExA

ShellExecuteExW

ShellExecuteA

ShellExecuteW

wininet.dll

HttpSendRequestW

HttpQueryInfoW

HttpOpenRequestW

comdlg32.dll

oleacc.dll

sqlite3.dll

sqlite3_finalize

sqlite3_column_type

sqlite3_column_text

sqlite3_column_int

sqlite3_column_double

sqlite3_column_bytes

sqlite3_column_blob

sqlite3_step

sqlite3_column_decltype

sqlite3_column_name

sqlite3_column_count

sqlite3_prepare

sqlite3_free

sqlite3_errcode

sqlite3_errmsg

sqlite3_close

sqlite3_open

winmm.dll

ntdll.dll

wsock32.dll

windowscodecs.dll

uxtheme.dll

DWMAPI.DLL

MainProgram.exe

1$1$0,0004080

0#0'0 0/0

9Å¸9d9

333F3\3m3}3

6~6 7@7[7

=5>%?7?|?

> >$>(>,>0>4>

0(0-080*1

7!7:7>7_7

2#2C2V2d2l2z2

6-6F6W6o6}6

11l1|1

2%2C2[2c2q2

4 5_5

5 5$5(5;6

?3?7?[?_?

?#?'? ?/?

: ;);

3O4

7%8X8

6 6$6(6,6064686

11K1g1o1

9Å“9K9i9q9

51"3 3,4

7|75:k;

4-5}5

8Â9_9i9

0 0$0(0,0004080

6f6D6]6l6

9â€œ9C9

7#7(7-7:7`7

0-2S2

4%5x5

:?:[;(

070?0_0~0

5]5P5T5d5l5p5t5x5|5

1%1X1t1

4-5J5k5}5k6

6&6.636=6

0-0}0

6o6j6

> ?8?=?]?

2'212@2^2

>)>8>[>_>

9"9(92979

676

11D1h1y1

2/2N2d2l2

5 5$5(5,5054585|9

333C3U3f3n3|3

7s7D7S7b7u7

9$9)9.939

5 5&5,525]5

1"1)1.1

= =$=(=,=2=

? ?$?(?,?0?4?8?\?}?

; ;$;(;,;0;4;`;

4 4$4(4,4044484

90959:9\93:@:

9 9$9(9,9094989@9

; ;$;(;,;0;8;@;

5(6H6%7U7\7

3!3&3]3{3

1 11O1V1[1y1

7$7(7,70747

4$4-44494

6#6

252;2@2[2`2

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

3333333

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

%%%U)))'%%%

$&&{4666)

%"!^'%#=!!

paint.net 4.0;

!.WE/4

.IDAThC

.pIDI

Paint.NET v3.5.100

.DFFr

paint.net 4.0.3

Paint.NET v3.5.11G

.Az%F

}0(*.pw

pm%C\rlR

t%DMM

Pegg.UjF|jFbZzbj

%cPn:

7:5221>8=

gOÃe

%XzVSoMx

h.FG

t.ESZH'p

K.kf]Q

.Xpeg

r%SKI

H.uuu

.nl#]cS-

4IP%u

5;1% >)#6!-*6%

{:%9.;

Q.tHJJ\

nmr.M2.Mb6

7-'7-&5.$5,&

|^}

eeA%u

4/%7.&5,%

w.WMl

WG,.gr

@70".0*>2)#&9;6)'1

30,*6>52-)"'>4#

2)!%1&%)1.!!

$KU%uM5

2214652

x~~avv.tU

.vqI18

k...ii)

KWindows

CGenerics.Defaults

#IdSMTP

IdSMTPBase

IdTCPServer

fJwaIpExport

eCommon.LoggerWindow

}Common.Params

oDriver.Utils

CCommon.Utils

bDriver.CoreSnapshot

]Driver.CoreDevices

0IdHTTPHeaderInfo

?1)19%)%%

d;%%%C

cg.Br

Font.Charset

Font.Color

Font.Height

Font.Name

Font.Style

All windows

Check URL

%Select the drivers you wish to backup

EditManager.Font.Charset

EditManager.Font.Color

EditManager.Font.Height

EditManager.Font.Name

EditManager.Font.Style

GroupFont.Charset

GroupFont.Color

GroupFont.Height

GroupFont.Name

GroupFont.Style

Header.Columns.Items

Header.Font.Charset

Header.Font.Color

Header.Font.Height

Header.Font.Name

Header.Font.Style

Header.Height

ImageList1)PaintInfoGroup.MarginBottom.CaptionIndent

Selection.FullRowSelect

%Driver backup successfully completed!

Header.ShowInAllViews

Header.Visible

PaintInfoGroup.Expandable

)PaintInfoGroup.MarginBottom.CaptionIndent

Groups.Items

%Select name, location and backup type

Items.Strings

Welcome to %s

Picture.Data

%s found

Webcam drivers

Windows system drivers

Keyboard drivers

%Save downloded drivers to this folder

Login

$Product information and support link

Support

Support:

Register %s

Version: %s

IdHTTP11

ProxyParams.BasicAuthentication

ProxyParams.ProxyPort

Request.CharSet

Request.ContentLength

Request.ContentRangeEnd

Request.ContentRangeStart

"Request.ContentRangeInstanceLength

Request.ContentType

Request.Accept

Request.BasicAuthentication

Request.UserAgent

&Mozilla/3.0 (compatible; Indy Library)

Request.Ranges.Units

Request.Ranges

IdHTTP0

.NN outdated drivers have been found on your PC

"Would you like to register %s now?

FTo immediately download and fix these drivers you need to register %s.

Do you have a License Key?

License key

]If you already have a License Key, please enter it in the form below and click "Activate Now"

Do you need a License Key?

.To purchase %s and obtain a license key click

YCheck the email you received after you purchased the product for the correct license key.

&Your license key will look like this:

'The license key you entered is for %s.

>%s is a separate product and requires a different license key.

to purchase %s.

BWe NOT reccomend your use this driver for current Windows version.

Current Windows version:

Backuped driver Windows version:

"Report a problem with a new driver

Thank you for trying %s!

xYour feedback is very valuable and will help us create better products. Please let us know why you did not register %s:

,%s did not find the driver I was looking for

frmCheckURL

name="program.exe"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

PSAPI.dll

NTDLL.DLL

%s-%s

%s[%d]

%s_%d

.Owner

\\?\UNC\

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_CURRENT_CONFIG

HKEY_DYN_DATA

SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes

TaskDialogIndirect

crSQLWait

%s (%s)

imm32.dll

\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\

clWebSnow

clWebFloralWhite

clWebLavenderBlush

clWebOldLace

clWebIvory

clWebCornSilk

clWebBeige

clWebAntiqueWhite

clWebWheat

clWebAliceBlue

clWebGhostWhite

clWebLavender

clWebSeashell

clWebLightYellow

clWebPapayaWhip

clWebNavajoWhite

clWebMoccasin

clWebBurlywood

clWebAzure

clWebMintcream

clWebHoneydew

clWebLinen

clWebLemonChiffon

clWebBlanchedAlmond

clWebBisque

clWebPeachPuff

clWebTan

clWebYellow

clWebDarkOrange

clWebRed

clWebDarkRed

clWebMaroon

clWebIndianRed

clWebSalmon

clWebCoral

clWebGold

clWebTomato

clWebCrimson

clWebBrown

clWebChocolate

clWebSandyBrown

clWebLightSalmon

clWebLightCoral

clWebOrange

clWebOrangeRed

clWebFirebrick

clWebSaddleBrown

clWebSienna

clWebPeru

clWebDarkSalmon

clWebRosyBrown

clWebPaleGoldenrod

clWebLightGoldenrodYellow

clWebOlive

clWebForestGreen

clWebGreenYellow

clWebChartreuse

clWebLightGreen

clWebAquamarine

clWebSeaGreen

clWebGoldenRod

clWebKhaki

clWebOliveDrab

clWebGreen

clWebYellowGreen

clWebLawnGreen

clWebPaleGreen

clWebMediumAquamarine

clWebMediumSeaGreen

clWebDarkGoldenRod

clWebDarkKhaki

clWebDarkOliveGreen

clWebDarkgreen

clWebLimeGreen

clWebLime

clWebSpringGreen

clWebMediumSpringGreen

clWebDarkSeaGreen

clWebLightSeaGreen

clWebPaleTurquoise

clWebLightCyan

clWebLightBlue

clWebLightSkyBlue

clWebCornFlowerBlue

clWebDarkBlue

clWebIndigo

clWebMediumTurquoise

clWebTurquoise

clWebCyan

clWebPowderBlue

clWebSkyBlue

clWebRoyalBlue

clWebMediumBlue

clWebMidnightBlue

clWebDarkTurquoise

clWebCadetBlue

clWebDarkCyan

clWebTeal

clWebDeepskyBlue

clWebDodgerBlue

clWebBlue

clWebNavy

clWebDarkViolet

clWebDarkOrchid

clWebMagenta

clWebDarkMagenta

clWebMediumVioletRed

clWebPaleVioletRed

clWebBlueViolet

clWebMediumOrchid

clWebMediumPurple

clWebPurple

clWebDeepPink

clWebLightPink

clWebViolet

clWebOrchid

clWebPlum

clWebThistle

clWebHotPink

clWebPink

clWebLightSteelBlue

clWebMediumSlateBlue

clWebLightSlateGray

clWebWhite

clWebLightgrey

clWebGray

clWebSteelBlue

clWebSlateBlue

clWebSlateGray

clWebWhiteSmoke

clWebSilver

clWebDimGray

clWebMistyRose

clWebDarkSlateBlue

clWebDarkSlategray

clWebGainsboro

clWebDarkGray

clWebBlack

Items.ItemData

%s%s%s%s%s%s%s%s%s%s

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

%s, ClassID: %s

%s, ProgID: "%s"

WNNC_NET_FTP_NFS

PIDLs to operate on are not siblings of the Namespace doing the operation.

olepro32.dll

\\.\vwin32

Unable to find RegSvr32.exe executable.

RegSvr32.exe

RegOpenKeyW

%s, %.2d %s %.4d %s %s

%s, %.2d%s%s%s%.4d %s %s

%s, %d %s %d %s %s

ISO_646.irv:1991

ISO_646.basic:1983

ISO_646.irv:1983

csISO16Portuguese

csISO84Portuguese2

windows-936

csShiftJIS

windows-874

ISO-8859-1-Windows-3.0-Latin-1

csWindows30Latin1

ISO-8859-1-Windows-3.1-Latin-1

csWindows31Latin1

ISO-8859-2-Windows-Latin-2

csWindows31Latin2

ISO-8859-9-Windows-Latin-5

csWindows31Latin5

csMicrosoftPublishing

Windows-31J

csWindows31J

PTCP154

csPTCP154

windows-1250

windows-1251

windows-1252

windows-1253

windows-1254

windows-1255

windows-1256

windows-1257

windows-1258

WS2_32.DLL

getservbyport

WSAAsyncGetServByPort

WSAJoinLeaf

MSWSOCK.DLL

WSARecvMsg

WSASendMsg

Wship6.dll

Fwpuclnt.dll

IdnDL.dll

Normaliz.dll

iphlpapi.dll

0.0.0.0

127.0.0.1

0123456789

!"#$%&'()* ,-./;?@[\]^_`{|}~

.nml=animation/narrative

.aac=audio/mp4

.aif=audio/x-aiff

.aifc=audio/x-aiff

.aiff=audio/x-aiff

.au=audio/basic

.gsm=audio/x-gsm

.kar=audio/midi

.m3u=audio/mpegurl

.mid=audio/midi

.midi=audio/midi

.mpega=audio/x-mpg

.mp2=audio/x-mpg

.mp3=audio/x-mpg

.mpga=audio/x-mpg

.m3u=audio/x-mpegurl

.pls=audio/x-scpls

.qcp=audio/vnd.qcelp

.ra=audio/x-realaudio

.ram=audio/x-pn-realaudio

.rm=audio/x-pn-realaudio

.sd2=audio/x-sd2

.sid=audio/prs.sid

.snd=audio/basic

.wav=audio/x-wav

.wax=audio/x-ms-wax

.wma=audio/x-ms-wma

.mjf=audio/x-vnd.AudioExplosion.MjuiceMediaFile

.art=image/x-jg

.bmp=image/bmp

.cdr=image/x-coreldraw

.cdt=image/x-coreldrawtemplate

.cpt=image/x-corelphotopaint

.djv=image/vnd.djvu

.djvu=image/vnd.djvu

.gif=image/gif

.ief=image/ief

.ico=image/x-icon

.jng=image/x-jng

.jpg=image/jpeg

.jpeg=image/jpeg

.jpe=image/jpeg

.pat=image/x-coreldrawpattern

.pcx=image/pcx

.pbm=image/x-portable-bitmap

.pgm=image/x-portable-graymap

.pict=image/x-pict

.png=image/x-png

.pnm=image/x-portable-anymap

.pntg=image/x-macpaint

.ppm=image/x-portable-pixmap

.psd=image/x-psd

.qtif=image/x-quicktime

.ras=image/x-cmu-raster

.rf=image/vnd.rn-realflash

.rgb=image/x-rgb

.rp=image/vnd.rn-realpix

.sgi=image/x-sgi

.svg=image/svg-xml

.svgz=image/svg-xml

.targa=image/x-targa

.tif=image/x-tiff

.wbmp=image/vnd.wap.wbmp

.webp=image/webp

.xbm=image/xbm

.xbm=image/x-xbitmap

.xpm=image/x-xpixmap

.xwd=image/x-xwindowdump

.xml=text/xml

.uls=text/iuls

.txt=text/plain

.rtx=text/richtext

.wsc=text/scriptlet

.rt=text/vnd.rn-realtext

.htt=text/webviewhtml

.htc=text/x-component

.vcf=text/x-vcard

.asf=video/x-ms-asf

.asx=video/x-ms-asf

.avi=video/x-msvideo

.dl=video/dl

.dv=video/dv

.flc=video/flc

.fli=video/fli

.gl=video/gl

.lsf=video/x-la-asf

.lsx=video/x-la-asf

.mng=video/x-mng

.mp2=video/mpeg

.mp3=video/mpeg

.mp4=video/mpeg

.mpeg=video/x-mpeg2a

.mpa=video/mpeg

.mpe=video/mpeg

.mpg=video/mpeg

.ogv=video/ogg

.moov=video/quicktime

.mov=video/quicktime

.mxu=video/vnd.mpegurl

.qt=video/quicktime

.qtc=video/x-qtc

.rv=video/vnd.rn-realvideo

.ivf=video/x-ivf

.webm=video/webm

.wm=video/x-ms-wm

.wmp=video/x-ms-wmp

.wmv=video/x-ms-wmv

.wmx=video/x-ms-wmx

.wvx=video/x-ms-wvx

.rms=video/vnd.rn-realvideo-secure

.asx=video/x-ms-asf-plugin

.movie=video/x-sgi-movie

.aab=application/x-authorware-bin

.aam=application/x-authorware-map

.aas=application/x-authorware-seg

.abw=application/x-abiword

.ace=application/x-ace-compressed

.ai=application/postscript

.alz=application/x-alz-compressed

.ani=application/x-navi-animation

.arj=application/x-arj

.asf=application/vnd.ms-asf

.bat=application/x-msdos-program

.bcpio=application/x-bcpio

.boz=application/x-bzip2

.bz=application/x-bzip

.bz2=application/x-bzip2

.cab=application/vnd.ms-cab-compressed

.cat=application/vnd.ms-pki.seccat

.ccn=application/x-cnc

.cco=application/x-cocoa

.cdf=application/x-cdf

.cer=application/x-x509-ca-cert

.chm=application/vnd.ms-htmlhelp

.chrt=application/vnd.kde.kchart

.cil=application/vnd.ms-artgalry

.class=application/java-vm

.com=application/x-msdos-program

.clp=application/x-msclip

.cpio=application/x-cpio

.cpt=application/mac-compactpro

.cqk=application/x-calquick

.crd=application/x-mscardfile

.crl=application/pkix-crl

.csh=application/x-csh

.dar=application/x-dar

.dbf=application/x-dbase

.dcr=application/x-director

.deb=application/x-debian-package

.dir=application/x-director

.dist=vnd.apple.installer xml

.distz=vnd.apple.installer xml

.dll=application/x-msdos-program

.dmg=application/x-apple-diskimage

.doc=application/msword

.dot=application/msword

.dvi=application/x-dvi

.dxr=application/x-director

.ebk=application/x-expandedbook

.eps=application/postscript

.evy=application/envoy

.exe=application/x-msdos-program

.fdf=application/vnd.fdf

.fif=application/fractals

.flm=application/vnd.kde.kivio

.fml=application/x-file-mirror-list

.gzip=application/x-gzip

.gnumeric=application/x-gnumeric

.gtar=application/x-gtar

.gz=application/x-gzip

.hdf=application/x-hdf

.hlp=application/winhlp

.hpf=application/x-icq-hpf

.hqx=application/mac-binhex40

.hta=application/hta

.ims=application/vnd.ms-ims

.ins=application/x-internet-signup

.iii=application/x-iphone

.iso=application/x-iso9660-image

.jar=application/java-archive

.karbon=application/vnd.kde.karbon

.kfo=application/vnd.kde.kformula

.kon=application/vnd.kde.kontour

.kpr=application/vnd.kde.kpresenter

.kpt=application/vnd.kde.kpresenter

.kwd=application/vnd.kde.kword

.kwt=application/vnd.kde.kword

.latex=application/x-latex

.lha=application/x-lzh

.lcc=application/fastman

.lrm=application/vnd.ms-lrm

.lz=application/x-lzip

.lzh=application/x-lzh

.lzma=application/x-lzma

.lzo=application/x-lzop

.lzx=application/x-lzx

.mpp=application/vnd.ms-project

.mvb=application/x-msmediaview

.man=application/x-troff-man

.mdb=application/x-msaccess

.me=application/x-troff-me

.ms=application/x-troff-ms

.msi=application/x-msi

.mpkg=vnd.apple.installer xml

.mny=application/x-msmoney

.nix=application/x-mix-transfer

.oda=application/oda

.odb=application/vnd.oasis.opendocument.database

.odc=application/vnd.oasis.opendocument.chart

.odf=application/vnd.oasis.opendocument.formula

.odg=application/vnd.oasis.opendocument.graphics

.odi=application/vnd.oasis.opendocument.image

.odm=application/vnd.oasis.opendocument.text-master

.odp=application/vnd.oasis.opendocument.presentation

.ods=application/vnd.oasis.opendocument.spreadsheet

.ogg=application/ogg

.odt=application/vnd.oasis.opendocument.text

.otg=application/vnd.oasis.opendocument.graphics-template

.oth=application/vnd.oasis.opendocument.text-web

.otp=application/vnd.oasis.opendocument.presentation-template

.ots=application/vnd.oasis.opendocument.spreadsheet-template

.ott=application/vnd.oasis.opendocument.text-template

.p7b=application/x-pkcs7-certificates

.p7r=application/x-pkcs7-certreqresp

.package=application/vnd.autopackage

.pfr=application/font-tdpfr

.pkg=vnd.apple.installer xml

.pdf=application/pdf

.pko=application/vnd.ms-pki.pko

.pl=application/x-perl

.pnq=application/x-icq-pnq

.pot=application/mspowerpoint

.pps=application/mspowerpoint

.ppt=application/mspowerpoint

.ppz=application/mspowerpoint

.ps=application/postscript

.pub=application/x-mspublisher

.qpw=application/x-quattropro

.qtl=application/x-quicktimeplayer

.rar=application/rar

.rdf=application/rdf xml

.rjs=application/vnd.rn-realsystem-rjs

.rm=application/vnd.rn-realmedia

.rmf=application/vnd.rmf

.rmp=application/vnd.rn-rn_music_package

.rmx=application/vnd.rn-realsystem-rmx

.rnx=application/vnd.rn-realplayer

.rpm=application/x-redhat-package-manager

.rsml=application/vnd.rn-rsml

.rtsp=application/x-rtsp

.rss=application/rss xml

.scm=application/x-icq-scm

.ser=application/java-serialized-object

.scd=application/x-msschedule

.sda=application/vnd.stardivision.draw

.sdc=application/vnd.stardivision.calc

.sdd=application/vnd.stardivision.impress

.sdp=application/x-sdp

.setpay=application/set-payment-initiation

.setreg=application/set-registration-initiation

.sh=application/x-sh

.shar=application/x-shar

.shw=application/presentations

.sit=application/x-stuffit

.sitx=application/x-stuffitx

.skd=application/x-koan

.skm=application/x-koan

.skp=application/x-koan

.skt=application/x-koan

.smf=application/vnd.stardivision.math

.smi=application/smil

.smil=application/smil

.spl=application/futuresplash

.ssm=application/streamingmedia

.sst=application/vnd.ms-pki.certstore

.stc=application/vnd.sun.xml.calc.template

.std=application/vnd.sun.xml.draw.template

.sti=application/vnd.sun.xml.impress.template

.stl=application/vnd.ms-pki.stl

.stw=application/vnd.sun.xml.writer.template

.svi=application/softvision

.sv4cpio=application/x-sv4cpio

.sv4crc=application/x-sv4crc

.swf=application/x-shockwave-flash

.swf1=application/x-shockwave-flash

.sxc=application/vnd.sun.xml.calc

.sxi=application/vnd.sun.xml.impress

.sxm=application/vnd.sun.xml.math

.sxw=application/vnd.sun.xml.writer

.sxg=application/vnd.sun.xml.writer.global

.tar=application/x-tar

.tcl=application/x-tcl

.tex=application/x-tex

.texi=application/x-texinfo

.texinfo=application/x-texinfo

.tbz=application/x-bzip-compressed-tar

.tbz2=application/x-bzip-compressed-tar

.tgz=application/x-compressed-tar

.tlz=application/x-lzma-compressed-tar

.tr=application/x-troff

.trm=application/x-msterminal

.troff=application/x-troff

.tsp=application/dsptype

.torrent=application/x-bittorrent

.ttz=application/t-time

.txz=application/x-xz-compressed-tar

.udeb=application/x-debian-package

.uin=application/x-icq

.urls=application/x-url-list

.ustar=application/x-ustar

.vcd=application/x-cdlink

.vor=application/vnd.stardivision.writer

.vsl=application/x-cnet-vsl

.wcm=application/vnd.ms-works

.wb1=application/x-quattropro

.wb2=application/x-quattropro

.wb3=application/x-quattropro

.wdb=application/vnd.ms-works

.wks=application/vnd.ms-works

.wmd=application/x-ms-wmd

.wms=application/x-ms-wms

.wmz=application/x-ms-wmz

.wp5=application/wordperfect5.1

.wpd=application/wordperfect

.wpl=application/vnd.ms-wpl

.wps=application/vnd.ms-works

.wri=application/x-mswrite

.xfdf=application/vnd.adobe.xfdf

.xls=application/x-msexcel

.xlb=application/x-msexcel

.xpi=application/x-xpinstall

.xps=application/vnd.ms-xpsdocument

.xsd=application/vnd.sun.xml.draw

.xul=application/vnd.mozilla.xul xml

.zoo=application/x-zoo

.zip=application/x-zip-compressed

.wml=text/vnd.wap.wml

.wmlc=application/vnd.wap.wmlc

.wmls=text/vnd.wap.wmlscript

.wmlsc=application/vnd.wap.wmlscriptc

.asm=text/x-asm

.pas=text/x-pascal

.cs=text/x-csharp

.cpp=text/x-c src

.cxx=text/x-c src

.cc=text/x-c src

.hpp=text/x-c hdr

.hxx=text/x-c hdr

.hh=text/x-c hdr

.java=text/x-java

.css=text/css

.js=text/javascript

.htm=text/html

.html=text/html

.xhtml=application/xhtml xml

.xht=application/xhtml xml

.ls=text/javascript

.mocha=text/javascript

.shtml=server-parsed-html

.sgm=text/sgml

.sgml=text/sgml

.mht=message/rfc822

HTTP-EQUIV

()@,;:\"./

()@,;:\"/[]?=

()@,;:\"/[]?={}

*#%"{}|\^[]`

HTTPS

Failed to open database "%s" : %s

Failed to open database "%s" : unknown error

"%s" : %s

Error executing SQL

Could not prepare SQL statement

Error executing SQL statement

select [sql] from sqlite_master where [type] = 'table' and lower(name) = '

SQLite is Busy

invalid zipfile

Shell.Application

invalid source

invalid target folder

0.0.0.1

Mozilla/3.0 (compatible; Indy Library)

X-HTTP-Method-Override

%d-%d

https

HttpOnly

HTTPONLY=

HTTPONLY

WINDOWS

()[]:;.,@\"

%s

Content-Disposition: form-data; name="%s"

; filename="%s"

Content-Type: %s

; charset="%s"

Content-Transfer-Encoding: %s

libeay32.dll

ssleay32.dll

libssl32.dll

SSL_CTX_use_PrivateKey_file

SSL_CTX_use_PrivateKey

SSL_CTX_use_certificate

SSL_CTX_use_certificate_file

SSL_get_peer_certificate

SSL_CTX_set_default_passwd_cb

SSL_CTX_set_default_passwd_cb_userdata

SSL_CTX_check_private_key

X509_STORE_add_cert

X509_STORE_CTX_get_current_cert

i2d_DSAPrivateKey

d2i_DSAPrivateKey

d2i_PrivateKey

d2i_PrivateKey_bio

DES_set_key

_ossl_old_des_set_key

RSA_generate_key_ex

RSA_generate_key

RSA_check_key

i2d_PrivateKey_bio

i2d_RSAPrivateKey

d2i_RSAPrivateKey

i2d_RSAPublicKey

d2i_RSAPublicKey

i2d_PrivateKey

i2d_NETSCAPE_CERT_SEQUENCE

X509_get_default_cert_file

X509_get_default_cert_file_env

X509_set_pubkey

X509_REQ_set_pubkey

X509_PUBKEY_get

PEM_read_bio_RSAPrivateKey

PEM_read_bio_RSAPublicKey

PEM_read_bio_DSAPrivateKey

PEM_read_bio_PrivateKey

PEM_read_bio_NETSCAPE_CERT_SEQUENCE

PEM_write_bio_RSAPublicKey

PEM_write_bio_DSAPrivateKey

PEM_write_bio_PrivateKey

PEM_write_bio_NETSCAPE_CERT_SEQUENCE

PEM_write_bio_PKCS8PrivateKey

EVP_PKEY_type

EVP_PKEY_new

EVP_PKEY_free

EVP_PKEY_assign

secur32.dll

security.dll

HTTP/1.0 200 OK

HTTP/

SetupApi.dll

cfgmgr32.dll

7z.dll

Error loading library %s

%s is not a 7z library

%s is not a Format library

XWindow.GetWindowPlacementEvg

XSettings.GetDebugPrivilege

XProcess.IsWow64Process

XFile.LogicalDriveStringsInit

XFile.ExpandRawPath

Psapi.dll

XProcess.GetProcessStartTime

XFile.DeleteFolder

SHFileOperation fail:

XFile.AssignFileW

XFile.WriteLnW

_prev.log

DriverUpdater.dpr

c:\debug.log.pc

ERROR (%s): %s

MESS: %s

PARAMS: %s

LAST_ERR (%d -> %s): %s

LAST_ERR (%d, %s): %s

%s%s%s%s

%s: %s

%s: %s PARAMS: %s

program.log

program_error.log

Multiple errors: %s Count: %d

Multiple logs: %s Count: %d

%s %s

XLog.Execute

c:\debug.pc

CERTANCE

%d.%d.%d.%d

Setupapi.dll

CM_PROB_DRIVER_SERVICE_KEY_INVALID

CM_DEVCAP_LOCKSUPPORTED

CM_DEVCAP_EJECTSUPPORTED

FILE_CHARACTERISTIC_WEBDAV_DEVICE

DNF_INDEXED_DRIVER

SOFTWARE\Microsoft\Windows\CurrentVersion\DriverSettings\

DriverKey=

OpenKey fail

Snapshot.ini

hXXp://d2.smartpcupdate.com/rpc/sendsnapshot

*.status

Ini.UpdateFile fail

Ini.UpdateFile fail 2

Scan.ini

DevicesPlus.ini

.status

5.2.3790.

5.1.2600.

6.0.6000.

6.0.6001.

6.0.6002.

6.1.6002.

6.1.7100.

6.1.7600.

6.1.7601.

6.2.8400.

6.2.9200.

6.3.9600.

6.3.9431.

6.4.9842.

EnumKey=

SetupDiEnumDriverInfoW fail, EnumKey=

SELECT * FROM hardids JOIN drivers ON hardids.id = drivers.hardid_full_index JOIN files ON files.id = drivers.file_id JOIN vendors ON vendors.id = drivers.vendor_id JOIN versions ON versions.id = drivers.version_id LEFT JOIN installers ON installers.id = drivers.installer_id JOIN devices_descriptions ON devices_descriptions.id = drivers.device_id WHERE hardids.hardid = "%s"

SELECT * FROM hardids JOIN drivers ON hardids.id = drivers.hardid_index JOIN files ON files.id = drivers.file_id JOIN vendors ON vendors.id = drivers.vendor_id JOIN versions ON versions.id = drivers.version_id LEFT JOIN installers ON installers.id = drivers.installer_id JOIN devices_descriptions ON devices_descriptions.id = drivers.device_id WHERE hardids.hardid = "%s"

AND os=%s

Drivers64.db

Drivers32.db

Devices.ini

Cannot delete and rename DevicesPlus.ini file

Cannot delete and rename Scan.ini file

EnumKey

ClassKey

SOFTWARE\Microsoft\Windows\CurrentVersion

DevWebSite

OpenKeyReadOnly 3 fail

OpenKeyReadOnly 2 fail

{8ECC055D-047F-11D1-A537-0000F8753ED1}

TSWbemLocator.Create fail

EOleException %s %x

wmiLocator.ConnectServer fail

wmiLocator.ConnectServer 2 fail

%s%s%s%s%s%s

%s%s%s

%s%s%s%s%s%s%s%s

TSchedulerStartupRegularItem.ItemRead

SrClient.dll

hXXp://service.smartpcupdate.com/rpc/senddriverstats

TUploadThread.Execute

Ini.UpdateFile fail 1

Ini.UpdateFile fail 1.2

Ini.UpdateFile fail 2.2

Ini.UpdateFile fail 3

Ini.UpdateFile fail 3.2

*.dul

DriverKey empty

GetCurrentSnapshot.OnFail

EnumKey empty

GetCurrentSnapshot.FindDevice fail:

Temp.ini

GetCurrentSnapshot.GetDriverParameters fail:

Device.Scan empty

SaveInstallLogs.AddSetupAPIlogs

Windows=

Devices.Count = 0

setupapi.log

Inf\setupapi.app.log

Inf\setupapi.dev.log

C:\Intel\Logs\IntelChipset.log

explorer.exe

firefox.exe

chrome.exe

iexplore.exe

opera.exe

raptr.exe

msiexec.exe

drvinst.exe

rundll32.exe

setup.exe

IsThereVisibleWindows.EnumWindowsProc

IsThereVisibleWindows

No visible windows for 30 seconds

No visible windows

There are visible windows:

ShellExecuteAndWait: begin: Path=

ShellExecuteAndWait: GetProcessId fail:

ShellExecuteAndWait: lpExecInfo.hProcess = 0:

ShellExecuteAndWait: ShellExecuteEx fail:

readme.txt

installmanagerapp.exe

InstallExeOrMsiDriver: begin: FName=

InstallExeOrMsiDriver: File not found:

InstallExeOrMsiDriver: Install disabled:

autorun.exe

InstallExeOrMsiDriver: CreateProcessAndWait failed

InstallExeOrMsiDriver: ShellExecuteAndWait failed

stub64.exe

newdev.dll

advpack.dll

IncompatibleWindowsLogoError

NonSupportedMethod

advpack.dll,LaunchINFSectionEx "

InstallInfDriver: Direct install advpack.dll,LaunchINFSectionEx success, for

InstallInfDriver: Direct install advpack.dll,LaunchINFSectionEx success but nothing changed, for

InfDefaultInstall.exe

CoreInstall.UnzipCallback

setupapi.log fail

InstallDriverLL.PrepareSystemLogs

IntelChipset.log fail

isInstalling exe/msi from zip: Cancelled

isInstalling exe/msi: Cancelled

empty EnumKey field

.restart

Restart of Windows detected

*.pre

stub64.exe was not found

Driver.CoreInit

CreateBaseIndexes

PCInfo.ini

program_prev.log

program_error_prev.log

TGenerateThread.Execute

TInstallThread.Execute

hXXp://VVV.pcrepairlabs.com

pcspeedmaximizer.exe

PC Speed Maximizer\PCSpeedMaximizer.exe

PC Speed Maximizer Pro\PCSpeedMaximizerPro.exe

HomePageURL

AfterInstallURL

SupportURL

UninstallURL

BuyNowURL

AdsDownloadURL

AdsBuyNowURL

AdsDownloadURL2

AdsBuyNowURL2

%s=%s

msvcrt.dll

.jdbg

madExcept.HandleContactForm

madExcept.HandleScreenshotForm

.madExcept

%exceptMsg%

%bugReport%

Ãšte%

Ãštetime%

%computerName%

Ãžsktop%

%userappdata%

%commonappdata%

cc32110mt.dll

cc32110.dll

screenShot.bmp

madExceptIde_.bpl

mapi32.dll

Tcpip\Parameters

VxD\MSTCP

IpHlpApi.dll

.jpeg

winhttp.dll

WinHttpOpen

WinHttpConnect

WinHttpOpenRequest

WinHttpAddRequestHeaders

WinHttpSendRequest

WinHttpGetIEProxyConfigForCurrentUser

WinHttpGetProxyForUrl

WinHttpSetOption

WinHttpWriteData

WinHttpReceiveResponse

WinHttpQueryHeaders

WinHttpQueryAuthSchemes

WinHttpSetCredentials

WinHttpQueryDataAvailable

WinHttpReadData

WinHttpCloseHandle

hXXps://

hXXp://

%userappdata%\

BugReport

screenShot.png

operating system

Â

<textarea id='"bugReport"' readonly cols='"80"' rows='"20"' style='"width:100%;height:100%;</p'>wtsapi32.dll wtsapi32.dll Software\Microsoft\Windows Software\Microsoft\Windows idapi32.dll idapi32.dll GetThreadReport GetThreadReport GetCpuRegisters GetCpuRegisters kernelbase.dll kernelbase.dll madExcept32.dll madExcept32.dll c:\sources\madshi\madExcept32.dll c:\sources\madshi\madExcept32.dll \madExcept\Dlls\madExcept32.dll \madExcept\Dlls\madExcept32.dll ReportLeaksNow ReportLeaksNow GetLeakReport GetLeakReport ShowLeakReport ShowLeakReport madExcept32.dll has the wrong version. madExcept32.dll has the wrong version. ReportFault ReportFault @System@@StartExe$qqrp23System@PackageInfoTablep17System@TLibModule @System@@StartExe$qqrp23System@PackageInfoTablep17System@TLibModule %Program Files% (x86)\Mozilla Firefox\firefox.exe %Program Files% (x86)\Mozilla Firefox\firefox.exe %Program Files%\Mozilla Firefox\firefox.exe %Program Files%\Mozilla Firefox\firefox.exe SOFTWARE\Mozilla\Mozilla Firefox SOFTWARE\Mozilla\Mozilla Firefox SOFTWARE\Mozilla\Mozilla Firefox\ SOFTWARE\Mozilla\Mozilla Firefox\ PathToExe PathToExe %Program Files% (x86)\Google\Chrome\Application\chrome.exe %Program Files% (x86)\Google\Chrome\Application\chrome.exe %Program Files%\Google\Chrome\Application\chrome.exe %Program Files%\Google\Chrome\Application\chrome.exe C:\Users\ C:\Users\ \AppData\Local\Google\Chrome\Application\chrome.exe \AppData\Local\Google\Chrome\Application\chrome.exe Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome %Program Files% (x86)\Internet Explorer\iexplore.exe %Program Files% (x86)\Internet Explorer\iexplore.exe %Program Files%\Internet Explorer\iexplore.exe %Program Files%\Internet Explorer\iexplore.exe Software\Opera Software Software\Opera Software \opera.exe \opera.exe \launcher.exe \launcher.exe %Program Files% (x86)\Opera\Opera.exe %Program Files% (x86)\Opera\Opera.exe %Program Files%\Opera\Opera.exe %Program Files%\Opera\Opera.exe %Program Files% (x86)\Opera\launcher.exe %Program Files% (x86)\Opera\launcher.exe %Program Files%\Opera\launcher.exe %Program Files%\Opera\launcher.exe BrowserExe BrowserExe %Program Files% (x86)\Safari\Safari.exe %Program Files% (x86)\Safari\Safari.exe %Program Files%\Safari\Safari.exe %Program Files%\Safari\Safari.exe http\shell\open\command http\shell\open\command SOFTWARE\Microsoft\Windows\CurrentVersion\Settings\Driver Updater SOFTWARE\Microsoft\Windows\CurrentVersion\Settings\Driver Updater URLParams URLParams Tray.exe Tray.exe \SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ \SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation \oeminfo.ini \oeminfo.ini Check the email you received after you purchased the product for the correct license key. Check the email you received after you purchased the product for the correct license key. Your license key will look like this: Your license key will look like this: hXXp://service.smartpcupdate.com/rpc/sendspmpurchase hXXp://service.smartpcupdate.com/rpc/sendspmpurchase hXXp://service.smartpcupdate.com/rpc/sendpurchase hXXp://service.smartpcupdate.com/rpc/sendpurchase &key= &key= hXXp://service.smartpcupdate.com/rpc/sendspminstall hXXp://service.smartpcupdate.com/rpc/sendspminstall hXXp://service.smartpcupdate.com/rpc/sendspmuninstall hXXp://service.smartpcupdate.com/rpc/sendspmuninstall hXXp://service.smartpcupdate.com/rpc/sendinstall hXXp://service.smartpcupdate.com/rpc/sendinstall hXXp://service.smartpcupdate.com/rpc/senduninstall hXXp://service.smartpcupdate.com/rpc/senduninstall %s is a separate product and requires a different license key. %s is a separate product and requires a different license key. Enter License Key Enter License Key Please enter your %s license key below. You would have received the license key in your purchase confirmation email. Please note, your license key is formatted as %d sets of %d characters (i.e., %s). Please enter your %s license key below. You would have received the license key in your purchase confirmation email. Please note, your license key is formatted as %d sets of %d characters (i.e., %s). If you already have a License Key, please enter it in the form below and click "Activate Now". If you already have a License Key, please enter it in the form below and click "Activate Now". We recommend that you upgrade to the full version of %s We recommend that you upgrade to the full version of %s To purchase %s and obtain a license key click To purchase %s and obtain a license key click The license key you entered is for %s. The license key you entered is for %s. Licensing key has reached its usage limit! Licensing key has reached its usage limit! Thank you for registering %s! Thank you for registering %s! Register %s now to download and install new drivers. Register %s now to download and install new drivers. Would you like to register %s? Would you like to register %s? Current Windows version Current Windows version Backuped driver Windows version Backuped driver Windows version We NOT reccomend your use this driver for current Windows version. We NOT reccomend your use this driver for current Windows version. 5 (Windows XP) 5 (Windows XP) 6 (Windows Vista) 6 (Windows Vista) 7 (Windows 7) 7 (Windows 7) 8 (Windows 8) 8 (Windows 8) CreateBaseIndexesOld CreateBaseIndexesOld ProxyPort ProxyPort ProxyLogin ProxyLogin hXXp://service.smartpcupdate.com/rpc/getdatabasecxw?arch=%d&os=%d hXXp://service.smartpcupdate.com/rpc/getdatabasecxw?arch=%d&os=%d hXXp://service.smartpcupdate.com/rpc/getdatabasezxw?arch=%d&os=%d hXXp://service.smartpcupdate.com/rpc/getdatabasezxw?arch=%d&os=%d hXXp://service.smartpcupdate.com/rpc/getdatabasex%d_wd hXXp://service.smartpcupdate.com/rpc/getdatabasex%d_wd TForm4a.Button2Click TForm4a.Button2Click IdHTTP1.Get 1 fail IdHTTP1.Get 1 fail IdHTTP1.Head fail IdHTTP1.Head fail IdHTTP1.Get 2 fail IdHTTP1.Get 2 fail Drivers32prev.db Drivers32prev.db Drivers64prev.db Drivers64prev.db Drivers.db Drivers.db CreateBaseIndexes success CreateBaseIndexes success SetupFiles.txt SetupFiles.txt IdRead() method of TIdTCPStream class does not support seeking IdRead() method of TIdTCPStream class does not support seeking Block passed to TIdDecoderBinHex4.Decode is missing a starting colon : Block passed to TIdDecoderBinHex4.Decode is missing a starting colon : Block passed to TIdDecoderBinHex4.Decode is missing a terminating colon : Block passed to TIdDecoderBinHex4.Decode is missing a terminating colon : Data passed to TIdEncoderBinHex4.Encode is missing a filename Data passed to TIdEncoderBinHex4.Encode is missing a filename \/:*?"| \/:*?"| Importance Importance PIPELINING PIPELINING LOGIN LOGIN smtp smtp Report a problem with a new driver! Report a problem with a new driver! mail.smartpctools.com mail.smartpctools.com apps@smartpctools.com apps@smartpctools.com support@smartpctools.com support@smartpctools.com support@pcutilitiespro.com support@pcutilitiespro.com report.zip report.zip Your feedback is very valuable and will help us create better products. Please let us know why you did not register %s: Your feedback is very valuable and will help us create better products. Please let us know why you did not register %s: %s did not find the driver I was looking for %s did not find the driver I was looking for hXXp://service.smartpcupdate.com/rpc/feedback?reason= hXXp://service.smartpcupdate.com/rpc/feedback?reason= TDeviceEntry.GetIcon TDeviceEntry.GetIcon TDriversList.Scan TDriversList.Scan TDriversList.ScanPreFiles TDriversList.ScanPreFiles Keyboard Keyboard Ports Ports MultiPortSerial MultiPortSerial XInternet.LoadInternetData XInternet.LoadInternetData HttpOpenRequest timeout: HttpOpenRequest timeout: HttpOpenRequest fail HttpOpenRequest fail HttpSendRequest fail: HttpSendRequest fail: HttpSendRequest timeout: HttpSendRequest timeout: HttpQueryInfo HTTP_QUERY_STATUS_CODE fail: HttpQueryInfo HTTP_QUERY_STATUS_CODE fail: HttpQueryInfo HTTP_QUERY_CONTENT_LENGTH fail: HttpQueryInfo HTTP_QUERY_CONTENT_LENGTH fail: Mozilla/5.0 Mozilla/5.0 XInternet.CloseInternet XInternet.CloseInternet XInternet.ConnectToInternet XInternet.ConnectToInternet URL is empty URL is empty URL is not trimmed URL is not trimmed Cannot open the URL Cannot open the URL Windows 8.1 Windows 8.1 Windows 10 Windows 10 hXXp://service.smartpcupdate.com/rpc/candownloadfiles?partner= hXXp://service.smartpcupdate.com/rpc/candownloadfiles?partner= English.ini English.ini French.ini French.ini German.ini German.ini Spanish.ini Spanish.ini Italian.ini Italian.ini Portuguese.ini Portuguese.ini Danish.ini Danish.ini Dutch.ini Dutch.ini Swedish.ini Swedish.ini Polish.ini Polish.ini Russian.ini Russian.ini Brazilian.ini Brazilian.ini Finnish.ini Finnish.ini Norwegian.ini Norwegian.ini Japanese.ini Japanese.ini Chinese.ini Chinese.ini Czech.ini Czech.ini Arabic.ini Arabic.ini Product information and support link Product information and support link InstallLog.ini InstallLog.ini UpdateWindowShown UpdateWindowShown StartWithWindows StartWithWindows s_SmartExec s_SmartExec Software\Microsoft\Windows\CurrentVersion\Settings\ Software\Microsoft\Windows\CurrentVersion\Settings\ UserKey UserKey TForm1a.WMQueryEndSession TForm1a.WMQueryEndSession Vendors.txt Vendors.txt ScanExecuted ScanExecuted Scan.gif Scan.gif TForm1a.Callback: incorrect Status TForm1a.Callback: incorrect Status drivers.db drivers.db Exclusions.txt Exclusions.txt 1.0.0.0 1.0.0.0 %d new drivers in %d driver packages found for your computer %d new drivers in %d driver packages found for your computer hXXp://update1.smartpcupdate.com/rpc/getlastupdate hXXp://update1.smartpcupdate.com/rpc/getlastupdate hXXp://service.smartpcupdate.com/rpc/getstatus?exedate= hXXp://service.smartpcupdate.com/rpc/getstatus?exedate= hXXp://update1.smartpcupdate.com/rpc/sendinstall?partner= hXXp://update1.smartpcupdate.com/rpc/sendinstall?partner= hXXp://update1.smartpcupdate.com/rpc/sendreport?filename= hXXp://update1.smartpcupdate.com/rpc/sendreport?filename= hXXp://update1.smartpcupdate.com/rpc/sendstats?partner= hXXp://update1.smartpcupdate.com/rpc/sendstats?partner= This version is no longer supported! This version is no longer supported! UpdateList.txt UpdateList.txt SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore hXXp://VVV.google.com/search?hl=en&q= hXXp://VVV.google.com/search?hl=en&q= .SYS.DLL.INF.CAT.NFO.EXE.REG.AX.DRV.CPL .SYS.DLL.INF.CAT.NFO.EXE.REG.AX.DRV.CPL RUNDLL32.EXE RUNDLL32.EXE LAYOUT.INF LAYOUT.INF regedit.exe regedit.exe Backups.ini Backups.ini \Enum.reg" "HKEY_LOCAL_MACHINE\ \Enum.reg" "HKEY_LOCAL_MACHINE\ \Classes.reg" "HKEY_LOCAL_MACHINE\ \Classes.reg" "HKEY_LOCAL_MACHINE\ \*.inf \*.inf \Log.txt \Log.txt backups.ini backups.ini /s zipfldr.dll /s zipfldr.dll regsvr32.exe regsvr32.exe \.zip\CompressedFolder\ShellNew \.zip\CompressedFolder\ShellNew \Classes.reg \Classes.reg \Classes.reg" \Classes.reg" \Enum.reg \Enum.reg \Enum.reg" \Enum.reg" *.exe *.exe AUTORUN.EXE AUTORUN.EXE 32.EXE 32.EXE 64.EXE 64.EXE *.inf *.inf 01-01-2012 01-01-2012 TForm1a.InstallCallback TForm1a.InstallCallback RunExe RunExe TForm1a.HTTP1Start TForm1a.HTTP1Start hXXp://service.smartpcupdate.com/downloads/ hXXp://service.smartpcupdate.com/downloads/ Form1a.HTTP1Start Form1a.HTTP1Start TForm1a.HTTP2Start TForm1a.HTTP2Start Form1a.HTTP2Start Form1a.HTTP2Start TForm1a.HTTP3Start TForm1a.HTTP3Start Form1a.HTTP3Start Form1a.HTTP3Start TForm1a.HTTP4Start TForm1a.HTTP4Start Form1a.HTTP4Start Form1a.HTTP4Start TForm1a.HTTP5Start TForm1a.HTTP5Start Form1a.HTTP5Start Form1a.HTTP5Start TForm1a.HTTP1Work TForm1a.HTTP1Work TForm1a.HTTP2Work TForm1a.HTTP2Work TForm1a.HTTP3Work TForm1a.HTTP3Work TForm1a.HTTP4Work TForm1a.HTTP4Work TForm1a.HTTP5Work TForm1a.HTTP5Work s_Exec s_Exec hXXp://service.smartpcupdate.com/rpc/senduninstall?partner= hXXp://service.smartpcupdate.com/rpc/senduninstall?partner= Backup\*.* Backup\*.* Drivers\*.* Drivers\*.* \SOFTWARE\Microsoft\Windows\CurrentVersion\Run \SOFTWARE\Microsoft\Windows\CurrentVersion\Run HomePage.url HomePage.url Portable Network Graphics Portable Network Graphics ::{26EE0668-A00A-44D7-9371-BEB064C98683} ::{26EE0668-A00A-44D7-9371-BEB064C98683} EasyListview.Header EasyListview.Header Kernel32.dll Kernel32.dll Open SSL Support DLL Delphi and C Builder interface Open SSL Support DLL Delphi and C Builder interface hXXp://VVV.indyproject.org/ hXXp://VVV.indyproject.org/ 1993 - 2012 1993 - 2012 systemoptimizer.exe systemoptimizer.exe System Optimizer\SystemOptimizer.exe System Optimizer\SystemOptimizer.exe CreateBaseIndexes fail CreateBaseIndexes fail 66006666 66006666 TFRMCHECKURL TFRMCHECKURL 'Object type not supported for operation 'Object type not supported for operation Unsupported PixelFormat Unsupported PixelFormat Invalid stream operation Invalid stream operation Unsupported GIF version Unsupported GIF version Invalid extension introducerÃºiled to allocate memory for GIF DIB Invalid extension introducerÃºiled to allocate memory for GIF DIB Invalid Image trailerAInternal error: Extension Instance does not match Extension Label,Unsupported Application Extension block size Invalid Image trailerAInternal error: Extension Instance does not match Extension Label,Unsupported Application Extension block size Unknown GIF block typeAOne or more of the parameters passed to the function was invalid.DClient policy does not allow credential delegation to target server.bClient policy does not allow credential delegation to target server with NLTM only authentication.1The recipient rejected the renegotiation request.-The required security context does not exist.`The PKU2U protocol encountered an error while attempting to utilize the associated certificates.:The identity of the server computer could not be verified. Unknown GIF block typeAOne or more of the parameters passed to the function was invalid.DClient policy does not allow credential delegation to target server.bClient policy does not allow credential delegation to target server with NLTM only authentication.1The recipient rejected the renegotiation request.-The required security context does not exist.`The PKU2U protocol encountered an error while attempting to utilize the associated certificates.:The identity of the server computer could not be verified. Unknown error#SSPI %s returns error #%d(0x%x): %s0SSPI interface has failed to initialise properly Unknown error#SSPI %s returns error #%d(0x%x): %s0SSPI interface has failed to initialise properly Unknown credentials use!Do AcquireCredentialsHandle first"CompleteAuthToken is not supported9The received certificate was mapped to multiple accounts. Unknown credentials use!Do AcquireCredentialsHandle first"CompleteAuthToken is not supported9The received certificate was mapped to multiple accounts. SEC_E_NO_KERB_KEY5The certificate is not valid for the requested usage. SEC_E_NO_KERB_KEY5The certificate is not valid for the requested usage. The smartcard certificate used for authentication has been revoked. Please contact your system administrator. There may be additional information in the event log. The smartcard certificate used for authentication has been revoked. Please contact your system administrator. There may be additional information in the event log. An untrusted certificate authority was detected While processing the smartcard certificate used for authentication. Please contact your system administrator. An untrusted certificate authority was detected While processing the smartcard certificate used for authentication. Please contact your system administrator. The revocation status of the smartcard certificate used for authentication could not be determined. Please contact your system administrator.lThe smartcard certificate used for authentication was not trusted. Please contact your system administrator.hThe smartcard certificate used for authentication has expired. Please contact your system administrator. The revocation status of the smartcard certificate used for authentication could not be determined. Please contact your system administrator.lThe smartcard certificate used for authentication was not trusted. Please contact your system administrator.hThe smartcard certificate used for authentication has expired. Please contact your system administrator. The Kerberos subsystem encountered an error. A service for user protocol request was made against a domain controller which does not support service for user. The Kerberos subsystem encountered an error. A service for user protocol request was made against a domain controller which does not support service for user. An attempt was made by this server to make a Kerberos constrained delegation request for a target outside of the server's realm. This is not supported, and indicates a misconfiguration on this server's allowed to delegate to list. Please contact your administrator. An attempt was made by this server to make a Kerberos constrained delegation request for a target outside of the server's realm. This is not supported, and indicates a misconfiguration on this server's allowed to delegate to list. Please contact your administrator. The revocation status of the domain controller certificate used for smartcard authentication could not be determined. There is additional information in the system event log. Please contact your system administrator. The revocation status of the domain controller certificate used for smartcard authentication could not be determined. There is additional information in the system event log. Please contact your system administrator. An untrusted certificate authority was detected while processing the domain controller certificate used for authentication. There is additional information in the system event log. Please contact your system administrator. An untrusted certificate authority was detected while processing the domain controller certificate used for authentication. There is additional information in the system event log. Please contact your system administrator. The domain controller certificate used for smartcard logon has expired. Please contact your system administrator with the contents of your system event log. The domain controller certificate used for smartcard logon has expired. Please contact your system administrator with the contents of your system event log. The domain controller certificate used for smartcard logon has been revoked. Please contact your system administrator with the contents of your system event log.IA signature operation must be performed before the user can authenticate. The domain controller certificate used for smartcard logon has been revoked. Please contact your system administrator with the contents of your system event log.IA signature operation must be performed before the user can authenticate. bThe supplied credential handle does not match the credential associated with the security context.]The crypto system or checksum function is invalid because a required function is unavailable.9The number of maximum ticket referrals has been exceeded.KThe local machine must be a Kerberos KDC (domain controller) and it is not.qThe other end of the security negotiation is requires strong crypto but it is not supported on the local machine.5The KDC reply contained more than one principal name.OExpected to find PA data for a hint of what etype to use, but it was not found. bThe supplied credential handle does not match the credential associated with the security context.]The crypto system or checksum function is invalid because a required function is unavailable.9The number of maximum ticket referrals has been exceeded.KThe local machine must be a Kerberos KDC (domain controller) and it is not.qThe other end of the security negotiation is requires strong crypto but it is not supported on the local machine.5The KDC reply contained more than one principal name.OExpected to find PA data for a hint of what etype to use, but it was not found. The client certificate does not contain a valid UPN, or does not match the client name in the logon request. Please contact your administrator.-Smartcard logon is required and was not used.!A system shutdown is in progress.'An invalid request was sent to the KDC.DThe KDC was unable to generate a referral for the service requested.:The encryption type requested is not supported by the KDC.QAn unsupported preauthentication mechanism was presented to the Kerberos package. The client certificate does not contain a valid UPN, or does not match the client name in the logon request. Please contact your administrator.-Smartcard logon is required and was not used.!A system shutdown is in progress.'An invalid request was sent to the KDC.DThe KDC was unable to generate a referral for the service requested.:The encryption type requested is not supported by the KDC.QAn unsupported preauthentication mechanism was presented to the Kerberos package. The requested operation cannot be completed. The computer must be trusted for delegation and the current user account must be configured to allow delegation.7Client's supplied SSPI channel bindings were incorrect. The requested operation cannot be completed. The computer must be trusted for delegation and the current user account must be configured to allow delegation.7Client's supplied SSPI channel bindings were incorrect. The credentials supplied were not complete, and could not be verified. Additional information can be returned from the context.4The context data must be renegotiated with the peer.'The target principal name is incorrect.:There is no LSA mode context associated with this context.8The clocks on the client and server machines are skewed.;The certificate chain was issued by an untrusted authority.7The message received was unexpected or badly formatted.;An unknown error occurred while processing the certificate.%The received certificate has expired.*The specified data could not be encrypted.*The specified data could not be decrypted.YThe client and server cannot communicate, because they do not possess a common algorithm. The credentials supplied were not complete, and could not be verified. Additional information can be returned from the context.4The context data must be renegotiated with the peer.'The target principal name is incorrect.:There is no LSA mode context associated with this context.8The clocks on the client and server machines are skewed.;The certificate chain was issued by an untrusted authority.7The message received was unexpected or badly formatted.;An unknown error occurred while processing the certificate.%The received certificate has expired.*The specified data could not be encrypted.*The specified data could not be decrypted.YThe client and server cannot communicate, because they do not possess a common algorithm. The security context could not be established due to a failure in the requested quality of service (e.g. mutual authentication or delegation).dA security context was deleted before the context was completed. This is considered a logon failure.mThe client is trying to negotiate a context and the server requires user-to-user but didn't send a TGT reply.aUnable to accomplish the requested task because the local machine does not have any IP addresses. The security context could not be established due to a failure in the requested quality of service (e.g. mutual authentication or delegation).dA security context was deleted before the context was completed. This is considered a logon failure.mThe client is trying to negotiate a context and the server requires user-to-user but didn't send a TGT reply.aUnable to accomplish the requested task because the local machine does not have any IP addresses. The logon attempt failed;The credentials supplied to the package were not recognized4No credentials are available in the security packageCThe message or signature supplied for verification has been altered8The message supplied for verification is out of sequence3No authority could be contacted for authentication.UThe function completed successfully, but must be called again to complete the contextEThe function completed successfully, but CompleteToken must be calledtThe function completed successfully, but both CompleteToken and this function must be called to complete the contextsThe logon was completed, but no network authority was available. The logon was made using locally known information-The requested security package does not exist2The context has expired and can no longer be used.DThe supplied message is incomplete. The signature was not verified.lThe credentials supplied were not complete, and could not be verified. The context could not be initialized.1The buffers supplied to a function was too small. The logon attempt failed;The credentials supplied to the package were not recognized4No credentials are available in the security packageCThe message or signature supplied for verification has been altered8The message supplied for verification is out of sequence3No authority could be contacted for authentication.UThe function completed successfully, but must be called again to complete the contextEThe function completed successfully, but CompleteToken must be calledtThe function completed successfully, but both CompleteToken and this function must be called to complete the contextsThe logon was completed, but no network authority was available. The logon was made using locally known information-The requested security package does not exist2The context has expired and can no longer be used.DThe supplied message is incomplete. The signature was not verified.lThe credentials supplied were not complete, and could not be verified. The context could not be initialized.1The buffers supplied to a function was too small. The handle specified is invalid'The function requested is not supported.The specified target is unknown or unreachable0The Local Security Authority cannot be contacted-The requested security package does not exist6The caller is not the owner of the desired credentialsBThe security package failed to initialize, and cannot be installed-The token supplied to the function is invalid^The security package is not able to marshall the logon buffer, so the logon attempt has failedNThe per-message Quality of Protection is not supported by the security package%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s The handle specified is invalid'The function requested is not supported.The specified target is unknown or unreachable0The Local Security Authority cannot be contacted-The requested security package does not exist6The caller is not the owner of the desired credentialsBThe security package failed to initialize, and cannot be installed-The token supplied to the function is invalid^The security package is not able to marshall the logon buffer, so the logon attempt has failedNThe per-message Quality of Protection is not supported by the security package%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s Failed to load %s. Failed to load %s. SSL status: "%s" SSL status: "%s" %s Alert %s Alert %s Read Alert %s Read Alert %s Write Alert %s Write Alert Host field is empty*SSL IOHandler is required for this setting8This value can not be set while the client is connected.$SSL is not available on this server.%Start SSL negotiation command failed. Host field is empty*SSL IOHandler is required for this setting8This value can not be set while the client is connected.$SSL is not available on this server.%Start SSL negotiation command failed. Unsupported operation./Could not encode header data using charset "%s" Unsupported operation./Could not encode header data using charset "%s" OLE control activation failed*Could not obtain OLE control window handle(Request method requires HTTP version 1.1KUnsupported hash algorithm. This implementation supports only MD5 encoding.<tidmessagepart can not be created. use descendant classes.>OLE control activation failed*Could not obtain OLE control window handle(Request method requires HTTP version 1.1KUnsupported hash algorithm. This implementation supports only MD5 encoding.<tidmessagepart can not be created. use descendant classes.>Attachment %s is blocked.$Error accepting connection with SSL. Attachment %s is blocked.$Error accepting connection with SSL. Error creating SSL context. Could not load root certificate. Error creating SSL context. Could not load root certificate. Could not load certificate.#Could not load key, check password. Could not load certificate.#Could not load key, check password. Reply Code is not valid: %s Reply Code is not valid: %s Reply Code already exists: %s Reply Code already exists: %s IOHandler value is not valid'Algorithm %s not permitted in FIPS mode The specified SASL handlers are not ready!!5Doesn't support AUTH or the specified SASL handlers!!'Need SASL mechanisms to login with it!! IOHandler value is not valid'Algorithm %s not permitted in FIPS mode The specified SASL handlers are not ready!!5Doesn't support AUTH or the specified SASL handlers!!'Need SASL mechanisms to login with it!! Object type not supported. Object type not supported. Transparent proxy cannot bind. UDP Not supported by this proxy.$Buffer terminator must be specified.!Buffer start position is invalid. Transparent proxy cannot bind. UDP Not supported by this proxy.$Buffer terminator must be specified.!Buffer start position is invalid. Command not supported. Command not supported. Address type not supported."%d: Circular links are not allowed"Not enough data in buffer. (%d/%d) Address type not supported."%d: Circular links are not allowed"Not enough data in buffer. (%d/%d) File "%s" not found File "%s" not found &Cannot change IPVersion when connected$Can not bind in port range (%d - %d) &Cannot change IPVersion when connected$Can not bind in port range (%d - %d) Connection Closed Gracefully.;Could not bind socket. Address and port are already in use. Connection Closed Gracefully.;Could not bind socket. Address and port are already in use. Invalid Port Range (%d - %d) Invalid Port Range (%d - %d) %s is not a valid service. %s is not a valid service. %s is not a valid IPv6 address:The requested IPVersion / Address family is not supported. %s is not a valid IPv6 address:The requested IPVersion / Address family is not supported. End of stream: Class %s at %d)UDP is not support in this SOCKS version. End of stream: Class %s at %d)UDP is not support in this SOCKS version. Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids. Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids. Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice. Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice. Protocol not supported. Protocol not supported. Socket type not supported."Operation not supported on socket. Socket type not supported."Operation not supported on socket. Protocol family not supported.0Address family not supported by protocol family. Protocol family not supported.0Address family not supported by protocol family. Connecting to %s. Connecting to %s. Socket Error # %d Socket Error # %d Operation would block. Operation would block. Operation now in progress. Operation now in progress. Operation already in progress. Operation already in progress. Socket operation on non-socket.4The new size provided for image resizing is invalid. Socket operation on non-socket.4The new size provided for image resizing is invalid. OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters Invalid destination array"Character index out of bounds (%d) Invalid destination array"Character index out of bounds (%d) Invalid count (%d) Invalid count (%d) Invalid destination index (%d) Invalid destination index (%d) Invalid codepage (%d)4Failed attempting to retrieve time zone information.-Error on call to Winsock2 library function %s&Error on loading Winsock2 library (%s) Invalid codepage (%d)4Failed attempting to retrieve time zone information.-Error on call to Winsock2 library function %s&Error on loading Winsock2 library (%s) Resolving hostname %s. Resolving hostname %s. The file being read is not a valid "Portable Network Graphics" image because it contains an invalid header. This file may be corrupted, try obtaining it againnThis "Portable Network Graphics" image is not supported or it might be invalid. The file being read is not a valid "Portable Network Graphics" image because it contains an invalid header. This file may be corrupted, try obtaining it againnThis "Portable Network Graphics" image is not supported or it might be invalid. This "Portable Network Graphics" image is not supported because either its width or height exceeds the maximum size of 65535 pixels. This "Portable Network Graphics" image is not supported because either its width or height exceeds the maximum size of 65535 pixels. There is no such palette entry.dThis "Portable Network Graphics" image contains an unknown critical part which could not be decoded.pThis "Portable Network Graphics" image is encoded with an unknown compression scheme which could not be decoded.cThis "Portable Network Graphics" image uses an unknown interlace scheme which could not be decoded.-The chunks must be compatible to be assigned.jThis "Portable Network Graphics" image is invalid because the decoder found an unexpected end of the file.8This "Portable Network Graphics" image contains no data.]The program tried to add a existent critical chunk to the current image which is not allowed.IIt's not allowed to add a new chunk because the current image is invalid.7The png image could not be loaded from the resource ID.oSome operation could not be performed because the system is out of resources. Close some windows and try again. There is no such palette entry.dThis "Portable Network Graphics" image contains an unknown critical part which could not be decoded.pThis "Portable Network Graphics" image is encoded with an unknown compression scheme which could not be decoded.cThis "Portable Network Graphics" image uses an unknown interlace scheme which could not be decoded.-The chunks must be compatible to be assigned.jThis "Portable Network Graphics" image is invalid because the decoder found an unexpected end of the file.8This "Portable Network Graphics" image contains no data.]The program tried to add a existent critical chunk to the current image which is not allowed.IIt's not allowed to add a new chunk because the current image is invalid.7The png image could not be loaded from the resource ID.oSome operation could not be performed because the system is out of resources. Close some windows and try again. Setting bit transparency color is not allowed for png images containing alpha value for each pixel (COLOR_RGBALPHA and COLOR_GRAYSCALEALPHA)OThis operation is not valid because the current image contains no valid header. Setting bit transparency color is not allowed for png images containing alpha value for each pixel (COLOR_RGBALPHA and COLOR_GRAYSCALEALPHA)OThis operation is not valid because the current image contains no valid header. RadioButton%d RadioButton%d Invalid owner=This control requires version 4.70 or greater of COMCTL32.DLL Invalid owner=This control requires version 4.70 or greater of COMCTL32.DLL Date exceeds maximum of %s Date exceeds maximum of %s Date is less than minimum of %s4You must be in ShowCheckbox mode to set to this date#Failed to set calendar date or timeÃºiled to set maximum selection range$Failed to set calendar min/max rangeÃºiled to set calendar selected rangejThis "Portable Network Graphics" image is not valid because it contains invalid pieces of data (crc error)yThe "Portable Network Graphics" image could not be loaded because one of its main piece of data (ihdr) might be corruptedUThis "Portable Network Graphics" image is invalid because it has missing image parts.[Could not decompress the image because it contains invalid compressed data. Date is less than minimum of %s4You must be in ShowCheckbox mode to set to this date#Failed to set calendar date or timeÃºiled to set maximum selection range$Failed to set calendar min/max rangeÃºiled to set calendar selected rangejThis "Portable Network Graphics" image is not valid because it contains invalid pieces of data (crc error)yThe "Portable Network Graphics" image could not be loaded because one of its main piece of data (ihdr) might be corruptedUThis "Portable Network Graphics" image is invalid because it has missing image parts.[Could not decompress the image because it contains invalid compressed data. Description: BThe "Portable Network Graphics" image contains an invalid palette. Description: BThe "Portable Network Graphics" image contains an invalid palette. - Dock zone has no controlLError loading dock zone from the stream. Expecting version %d, but found %d. - Dock zone has no controlLError loading dock zone from the stream. Expecting version %d, but found %d. Value*A key with the name of "%s" already exists Value*A key with the name of "%s" already exists Key "%s" not found%goColMoving is not a supported option%Key may not contain equals sign ("=") Key "%s" not found%goColMoving is not a supported option%Key may not contain equals sign ("=") Error setting %s.Count8Listbox (%s) style must be virtual in order to set Count#No OnGetItem event handler assigned"%s requires Windows Vista or later %s requires themes to be enabled Error setting %s.Count8Listbox (%s) style must be virtual in order to set Count#No OnGetItem event handler assigned"%s requires Windows Vista or later %s requires themes to be enabled Button%d Button%d Value must be between %d and %d Value must be between %d and %d Invalid clipboard format Clipboard does not support Icons Invalid clipboard format Clipboard does not support Icons Cannot open clipboard: %s Cannot open clipboard: %s Text exceeds memo capacity/Menu '%s' is already being used by another form Text exceeds memo capacity/Menu '%s' is already being used by another form Invalid input value7Invalid input value. Use escape key to abandon changes Invalid input value7Invalid input value. Use escape key to abandon changes Grid too large for operation Cannot focus a disabled or invisible window!Control '%s' has no parent window$Parent given is not a parent of '%s' Grid too large for operation Cannot focus a disabled or invisible window!Control '%s' has no parent window$Parent given is not a parent of '%s' %s property out of range %s property out of range Scan line index out of range!Cannot change the size of an iconÃŠnnot change the size of a WIC Image Invalid operation on TOleGraphic Scan line index out of range!Cannot change the size of an iconÃŠnnot change the size of a WIC Image Invalid operation on TOleGraphic Unsupported clipboard format Unsupported clipboard format ''%s'' is not a valid time ''%s'' is not a valid time No help found for context %d No help found for context %d No help found for %s No help found for %s The specified path is too long The specified path was not found The path format is not supported The specified file was not found The specified path is too long The specified path was not found The path format is not supported The specified file was not found ?$No help viewer that supports filters7String index out of range (%d). Must be >= 1 and ?$No help viewer that supports filters7String index out of range (%d). Must be >= 1 and ''%s'' is not a valid date#''%s'' is not a valid date and time#''%s'' is not a valid integer value ''%s'' is not a valid date#''%s'' is not a valid date and time#''%s'' is not a valid integer value List index out of bounds (%d) Out of memory while expanding memory stream)%s has not been registered as a COM class List index out of bounds (%d) Out of memory while expanding memory stream)%s has not been registered as a COM class Error reading %s%s%s: %s Error reading %s%s%s: %s Failed to get data for '%s' Failed to get data for '%s' Failed to set data for '%s' Failed to set data for '%s' Resource %s not found Resource %s not found %s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group %s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group Property %s does not exist Property %s does not exist Thread creation error: %s Thread creation error: %s Thread Error: %s (%d) Thread Error: %s (%d) A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates Cannot create file "%s". %s Cannot create file "%s". %s Cannot open file "%s". %s Cannot open file "%s". %s Unable to write to %s Unable to write to %s Invalid file name - %s Invalid file name - %s Invalid stream format$''%s'' is not a valid component name Invalid stream format$''%s'' is not a valid component name Invalid data type for '%s' List capacity out of bounds (%d) Invalid data type for '%s' List capacity out of bounds (%d) List count out of bounds (%d) List count out of bounds (%d) Start index out of bounds (%d) Start index out of bounds (%d) Ancestor for '%s' not found Ancestor for '%s' not found Cannot assign a %s to a %s Cannot assign a %s to a %s Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread Class %s not found Class %s not found External exception %x External exception %x Interface not supported Interface not supported Object lock not owned(Monitor support function not initialized Object lock not owned(Monitor support function not initialized %s (%s, line %d) %s (%s, line %d) Abstract Error?Access violation at address %p in module '%s'. %s of address %p Abstract Error?Access violation at address %p in module '%s'. %s of address %p System Error. Code: %d. System Error. Code: %d. Invalid variant operation Invalid variant operation Invalid NULL variant operation%Invalid variant operation (%s%.8x) Invalid NULL variant operation%Invalid variant operation (%s%.8x) %s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s) %s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s) Operation not supported Operation not supported Invalid pointer operation Invalid pointer operation Invalid class typecast0Access violation at address %p. %s of address %p Invalid class typecast0Access violation at address %p. %s of address %p Operation aborted(Exception %s in module %s at %p. Operation aborted(Exception %s in module %s at %p. Application Error1Format '%s' invalid or incompatible with argument Application Error1Format '%s' invalid or incompatible with argument No argument for format '%s'"Variant method calls not supported('%s' is not a valid floating point value!'%s' is not a valid date and time '%d.%d' is not a valid timestamp No argument for format '%s'"Variant method calls not supported('%s' is not a valid floating point value!'%s' is not a valid date and time '%d.%d' is not a valid timestamp '%s' is not a valid GUID value '%s' is not a valid GUID value I/O error %d I/O error %d Integer overflow Invalid floating point operation Integer overflow Invalid floating point operation 3.1.0.5 3.1.0.5 </tidmessagepart></tidmessagepart>

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps