PUPYahooCompanion.YR, SearchProtectToolbar.YR, PUPAirInstaller.YR (Lavasoft MAS)Behaviour: Installer, PUP
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: f7b1dc2d7f64c1c371baed7ea93ec0dd
SHA1: 0555865a6ee83b0eae05821b07c72e5bdff4a283
SHA256: b12077ca00b5d5b5b30fe6a41d5413524f3db3922ad05a9afdf7b5f17f2d94ee
SSDeep: 49152:rOEmLWOu/az54rNKQUoqu2ZSjTN788Ft Zp:rOEty5wUq2Zk8V
Size: 2140672 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: SafeInstall, LLC
Created at: 2015-02-25 16:49:21
Analyzed on: WindowsXP SP3 32-bit
Summary: PUP. Potentially Unwanted Program. An application that does not display malicious behavior yet is installed without having first sought affirmative user consent for installation. Users may not realize, due to the nature of the installation procedure, that an application they have not explicitly agreed to has been installed. This category can also be used to classify other applications which in a certain context can be wanted e.g. remote administration tools or IRC clients.
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The PUP creates the following process(es):No processes have been created.The PUP injects its code into the following process(es):
%original file name%.exe:376
Mutexes
The following mutexes were created/opened:
c:!documents and settings!adm!local settings!history!history.ie5!mshist012015040220150403!_!SHMSFTHISTORY!___DDrawCheckExclMode____DDrawExclMode__DDrawDriverObjectListMutexCTF.TMD.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Layouts.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Asm.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Compart.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.LBES.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003DDrawWindowListMutexVdiMsiLockInstallIQFirefoxLockRasPbFileInstallIQUninstallOptionLockWininetProxyRegistryMutexWininetConnectionMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!temporary internet files!content.ie5!_!MSFTHISTORY!_ShimCacheMutexQuickStartAppW3i_CoreBrowserShutdownW3iFFPrefslockDialogCloseProcessLockCPackageZlib::CPackageZlibW3iCoreLoggerZonesLockedCacheCounterMutexZonesCacheCounterMutexZonesCounterMutex
File activity
The process %original file name%.exe:376 makes changes in the file system.
The PUP creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\jquery.min.js (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\225E5BB2-B83F-478E-B774-62F53C2BCAD7.zip (858 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\screenmanager.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\2704D408-C40A-4848-BC30-B5478423E8C9.zip (821 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\config.xml (17616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\css\style.css (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\224505F1-4910-4879-A9AD-B70D1AE1A120.zip (904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\A93B8CBE-2E96-442C-A85F-49ED855FDB8B.zip (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\title-bar.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\btn.png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\yahoo.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\close.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\screen.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\226383C9-5E0D-4ABD-8308-30F31DD040A6.zip (666 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\filewhiz_tn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\checkbox.png (650 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\B88FF7FD-BE0E-44BC-97BC-D6943F9F8A86.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\2E076E93-E171-4F73-A0D5-5BFDDE0E4783.zip (792 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\.DS_Store (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\80A3CCD4-64BC-4AF8-853B-ABA075AE5218.zip (866 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\7BAB633E-6C2D-45CC-BFE3-A79142FDABBF.zip (507 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\0393A455-8396-4E79-8339-7DAEDC83567B.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\testsuitemanager.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\utils.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\bg_disc_wrap.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\F5C1E3BE-C571-4295-82AB-9C78A7DFD0BA.zip (823 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\session.response.json (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\5FDCCE24-C6DF-4C42-BE3B-202FAD5BF071.zip (928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\responsemanager.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\view.petite_oo_v5.vi.json (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\screenfactory.js (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\offerparser.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\btn-win.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\13D66679-5DC0-48AA-BB42-E7BD34CEBAE2.zip (889 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\7E447291-0A05-4EB1-98E9-49ECF3C139D1.zip (834 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\42FDD0AA-EAD7-45DD-8421-47492FCFF9DB.zip (941 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\step-contents-stepped.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\noyahoo.js (323 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\petite_oo_v5.vi.json (74 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\AD04DC3C-8B12-4879-83E3-523DF600D9DE.zip (968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\kmsxSuite.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\lodash.custom.min.js (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SymCCIS2.zip (162 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\FC7B0DC7-475B-489A-970D-27D5F49C54FA.zip (790 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\screenconfig.js (240 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\f7b1dc2d7f64c1c371baed7ea93ec0dd.log (430371 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\minmax.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\saferbrowser.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\custom-check.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\4FFA1EE1-2AD7-40C8-9643-B801D9DED1A0.zip (804 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\66DFABC3-9023-45A3-A5DE-FA8CAAEF0AAC.zip (856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\container-separator.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\petite_oo_v5.vi.html (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\E92D7B47-33AD-4469-81D4-CB551DE8DDA8.zip (889 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\BDAAF9E7-1317-4A08-A774-4E8B122DA876.zip (793 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\404D0823-2D00-44F7-AC98-92F79F87E4F2.zip (778 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\8388CA31-64D2-4B18-853D-6E8F73B33C4A.zip (726 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\F80287B7-718C-4676-AC71-3F1AB04A60E1.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\E9E56BE3-7EC7-450B-9C2E-BA9B0BCD6B05.zip (817 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\bg-installprogress.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\DF86C614-36F8-4BE3-A1A0-78E774802EE7.zip (928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\step-contents.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\java_14552.txt (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\B2B00637-BC0D-48D8-B686-9F13DA5E04A1.zip (822 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\installprogress.png (998 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\java\java_tn.png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\script.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\theanswerfinder.vi.zip (838 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\4594AF2F-4D07-4B39-B15B-443A87882878.zip (732 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\099AEF6E-E690-4A5C-85F8-481343649504.zip (809 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\java.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\common.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\knockout-2.2.1.js (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\product-icon.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\B7109C6A-73CA-4979-B038-5AE45CBE649F.zip (811 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\3927F92B-2CF0-4555-8A62-C42865E873C2.zip (936 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\json2.js (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\73EB1E3A-0BE4-4F19-8F38-6B2B93DB1927.zip (939 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\86DDC60B-D946-49DA-A0F7-AD1D99007CBB.zip (803 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\55997C50-1F00-4D74-BAEF-46A658272B17.zip (971 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\3AD49606-8E98-404B-8DB4-767574E46DBB.zip (690 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SymCCIS.dll (11704 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\C4B20519-3B35-4A1C-BB5C-695D80D9C28D.zip (926 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\clickmanager.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\988E6415-56A2-4711-9270-F71450CD0B9B.zip (9352 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\5C22ACAC-4D3A-4D89-9980-81FBB493E7B8.zip (888 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\AF33782B-57D0-466B-831D-0CE47455F809.zip (892 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\AFB3988D-640F-43BB-8422-D40ED6AA32BE.zip (820 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\config.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\stub.xml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\btn-win-cancel.png (776 bytes)
The PUP deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014040920140410 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014040920140410\index.dat (0 bytes)
Registry activity
The process %original file name%.exe:376 makes changes in the system registry.
The PUP creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015040220150403]
"CachePrefix" = ":2015040220150403:"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015040220150403]
"CacheOptions" = "11"
"CacheLimit" = "8192"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\InstallIQ]
"test" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1F 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1424875761"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015040220150403]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012015040220150403\"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "56 13 CE 88 FA 6B 63 8F C4 D1 0A 60 33 F0 ED B4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015040220150403]
"CacheRepair" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The PUP modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The PUP modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The PUP modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The PUP deletes the following registry key(s):
[HKLM\SOFTWARE\InstallIQ]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014040920140410]
The PUP deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
[HKLM\SOFTWARE\InstallIQ]
"test"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
Dropped PE files
MD5 | File path |
---|---|
6bec059e9f70b59873807c4f2a72a8b5 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\SymCCIS.dll |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original PUP file.
- Delete or disinfect the following files created/modified by the PUP:
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\jquery.min.js (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\225E5BB2-B83F-478E-B774-62F53C2BCAD7.zip (858 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\screenmanager.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\2704D408-C40A-4848-BC30-B5478423E8C9.zip (821 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\config.xml (17616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\css\style.css (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\224505F1-4910-4879-A9AD-B70D1AE1A120.zip (904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\A93B8CBE-2E96-442C-A85F-49ED855FDB8B.zip (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\title-bar.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\btn.png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\yahoo.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\close.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\screen.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\226383C9-5E0D-4ABD-8308-30F31DD040A6.zip (666 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\filewhiz_tn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\checkbox.png (650 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\B88FF7FD-BE0E-44BC-97BC-D6943F9F8A86.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\2E076E93-E171-4F73-A0D5-5BFDDE0E4783.zip (792 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\.DS_Store (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\80A3CCD4-64BC-4AF8-853B-ABA075AE5218.zip (866 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\7BAB633E-6C2D-45CC-BFE3-A79142FDABBF.zip (507 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\0393A455-8396-4E79-8339-7DAEDC83567B.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\testsuitemanager.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\utils.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\bg_disc_wrap.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\F5C1E3BE-C571-4295-82AB-9C78A7DFD0BA.zip (823 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\session.response.json (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\5FDCCE24-C6DF-4C42-BE3B-202FAD5BF071.zip (928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\responsemanager.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\view.petite_oo_v5.vi.json (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\screenfactory.js (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\offerparser.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\btn-win.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\13D66679-5DC0-48AA-BB42-E7BD34CEBAE2.zip (889 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\7E447291-0A05-4EB1-98E9-49ECF3C139D1.zip (834 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\42FDD0AA-EAD7-45DD-8421-47492FCFF9DB.zip (941 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\step-contents-stepped.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\noyahoo.js (323 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\petite_oo_v5.vi.json (74 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\AD04DC3C-8B12-4879-83E3-523DF600D9DE.zip (968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\kmsxSuite.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\lodash.custom.min.js (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SymCCIS2.zip (162 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\FC7B0DC7-475B-489A-970D-27D5F49C54FA.zip (790 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\screenconfig.js (240 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\f7b1dc2d7f64c1c371baed7ea93ec0dd.log (430371 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\minmax.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\saferbrowser.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\custom-check.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\4FFA1EE1-2AD7-40C8-9643-B801D9DED1A0.zip (804 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\66DFABC3-9023-45A3-A5DE-FA8CAAEF0AAC.zip (856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\container-separator.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\petite_oo_v5.vi.html (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\E92D7B47-33AD-4469-81D4-CB551DE8DDA8.zip (889 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\BDAAF9E7-1317-4A08-A774-4E8B122DA876.zip (793 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\404D0823-2D00-44F7-AC98-92F79F87E4F2.zip (778 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\8388CA31-64D2-4B18-853D-6E8F73B33C4A.zip (726 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\F80287B7-718C-4676-AC71-3F1AB04A60E1.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\E9E56BE3-7EC7-450B-9C2E-BA9B0BCD6B05.zip (817 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\bg-installprogress.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\DF86C614-36F8-4BE3-A1A0-78E774802EE7.zip (928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\step-contents.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\java_14552.txt (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\B2B00637-BC0D-48D8-B686-9F13DA5E04A1.zip (822 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\installprogress.png (998 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\java\java_tn.png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\script.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\theanswerfinder.vi.zip (838 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\4594AF2F-4D07-4B39-B15B-443A87882878.zip (732 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\099AEF6E-E690-4A5C-85F8-481343649504.zip (809 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\java.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\common.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\knockout-2.2.1.js (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\product-icon.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\B7109C6A-73CA-4979-B038-5AE45CBE649F.zip (811 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\3927F92B-2CF0-4555-8A62-C42865E873C2.zip (936 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\json2.js (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\73EB1E3A-0BE4-4F19-8F38-6B2B93DB1927.zip (939 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\86DDC60B-D946-49DA-A0F7-AD1D99007CBB.zip (803 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\55997C50-1F00-4D74-BAEF-46A658272B17.zip (971 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\3AD49606-8E98-404B-8DB4-767574E46DBB.zip (690 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SymCCIS.dll (11704 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\C4B20519-3B35-4A1C-BB5C-695D80D9C28D.zip (926 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\clickmanager.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\988E6415-56A2-4711-9270-F71450CD0B9B.zip (9352 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\5C22ACAC-4D3A-4D89-9980-81FBB493E7B8.zip (888 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\AF33782B-57D0-466B-831D-0CE47455F809.zip (892 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\AFB3988D-640F-43BB-8422-D40ED6AA32BE.zip (820 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\js\config.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\stub.xml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_1636f3240\dialogs\library\images\btn-win-cancel.png (776 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name: SafeInstall, LLC
Product Name: SafeInstaller
Product Version: 1.0.73.0
Legal Copyright: Copyright (C) 2014
Legal Trademarks:
Original Filename: safeinstall.exe
Internal Name: SafeInstaller
File Version: 1.0.73.0
File Description: Safe Installer
Comments:
Language: English (United States)
Company Name: SafeInstall, LLCProduct Name: SafeInstallerProduct Version: 1.0.73.0Legal Copyright: Copyright (C) 2014Legal Trademarks: Original Filename: safeinstall.exeInternal Name: SafeInstallerFile Version: 1.0.73.0File Description: Safe InstallerComments: Language: English (United States)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 495737 | 496128 | 4.50055 | eacbc95c9ed4581ae3c4f55cfabc6ec9 |
.text-qu | 503808 | 3923 | 4096 | 4.20452 | 97250a2453f354d02fd01e35f04b19f2 |
.text-co | 507904 | 88205 | 88576 | 4.49095 | 3125e03fc18ae36452de39b85c1ce00e |
.text-co | 598016 | 75433 | 75776 | 4.46088 | 866aaf5899bc16b6d78fa87831f13987 |
.text-co | 675840 | 48588 | 48640 | 4.49468 | 8c4a97b53f59efdb41abb8c63368a037 |
.text-co | 724992 | 14904 | 15360 | 4.40949 | 6d42f78ec4272a1f2344dddee4c3647d |
.text-co | 741376 | 27320 | 27648 | 4.61586 | ded2001ef9229973104294adb8de2eaf |
.text-co | 770048 | 10272 | 10752 | 4.36135 | fbdd36f604e15916f49b5763385dc762 |
.text-co | 782336 | 263610 | 263680 | 4.59423 | d7e12a1c3a7fe565fb233e3050fbbd79 |
.text-ti | 1048576 | 43367 | 43520 | 4.58001 | b3b92b28aaf4f6638c2d896e2fdb91af |
.text-co | 1093632 | 16103 | 16384 | 4.3716 | 312013803e5c472a2393e39874c72442 |
.text-co | 1110016 | 59 | 512 | 0.606205 | b93d46b36642bdf35f83073cd1db88ac |
.text-co | 1114112 | 12737 | 12800 | 4.42334 | f2cdaa8cf5120ab1006e7de4af21369a |
.rdata | 1130496 | 267004 | 267264 | 3.89234 | 9551880b413cba74371a6005c601d232 |
.data | 1400832 | 27492 | 17408 | 3.39326 | 3af4dcaef998567e95dbfe24bbce1759 |
.data-qu | 1429504 | 41 | 512 | 0 | bf619eac0cdf3f68d496ea9344137e8b |
.data-co | 1433600 | 188 | 512 | 0 | bf619eac0cdf3f68d496ea9344137e8b |
.data-co | 1437696 | 56 | 512 | 0.042395 | e7d0abf57dfaebcc790cb19fb02f668a |
.data-co | 1441792 | 40 | 512 | 0 | bf619eac0cdf3f68d496ea9344137e8b |
.data-co | 1445888 | 44 | 512 | 0.014135 | 2d5fe836dd5a60fa37b7c590cfc70410 |
.data-co | 1449984 | 41 | 512 | 0 | bf619eac0cdf3f68d496ea9344137e8b |
.data-co | 1454080 | 40 | 512 | 0 | bf619eac0cdf3f68d496ea9344137e8b |
.data-co | 1458176 | 2932 | 3072 | 1.34082 | 9ed02dcd88cf9a78a3b2fc9ce26f50a7 |
.data-ti | 1462272 | 1176 | 1536 | 1.01208 | ebb67f64a312161d58e41913f7a95bf3 |
.data-co | 1466368 | 40 | 512 | 0 | bf619eac0cdf3f68d496ea9344137e8b |
.data-co | 1470464 | 4 | 512 | 0.014135 | d340f23a7d18057bb02252a3cb40b877 |
.data-co | 1474560 | 40 | 512 | 0 | bf619eac0cdf3f68d496ea9344137e8b |
.rsrc | 1478656 | 735972 | 736256 | 5.35924 | a3850b2023490a6bbb2852a40a418355 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://2-vinstaller.com/7a29ae39-7c7b-40c2-b2df-bd957391d3ab/f635c5bc-aa13-400d-ac76-6c0e9f461cc7 | 66.77.96.162 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
POST /7a29ae39-7c7b-40c2-b2df-bd957391d3ab/f635c5bc-aa13-400d-ac76-6c0e9f461cc7 HTTP/1.1
Content-Type: application/json; charset=utf-8
Accept: application/json;
installerversion: 1
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
Host: 2-vinstaller.com
Content-Length: 718
Cache-Control: no-cache
{"Content":"FrsQsDi7LOYAjhttwW2VRdfK0jpCMx3l6iYIV8EoK8izlVgO55eIQJIqVYVvvknSlues/klxo60k3KmQRrHe1bynFXdK b2/0pSR IBm48kLHHPoQ8Jom1ImIPnrJHV8nKkJRNLPKXEYxAO0d7tw 8k5rnqKqGMlMrwE3dROaOU hDlrJbpG 5AMl9qL1nsbkxDaPUjsCLwuFP4yxujXynAgXVC2hjP83/0NRYPRiEYmR8Uua4dRVp8bKNDsK/Zv9BNM/qIp1GVNsumUWHMZiLi/988hvVGPVFTN5JiF/AxLlVnFewDjg3SVoOCEO71DmzlW1H0NSpHTqkRCkX8bVEdakLpo7y8sXU27 btKPV3CtM4PfDvWmE3x2kaCaHAsZTL482oGczrhLF3Tq5abSOf8CtNGYttksucQNH1NK93lk4sxuK6 kZzcdSnjSyHyhRy7P358bgq JchSmkrwPhDAmh7OA9m1eUta3/yl9N8W/Car01ntZ27Mt4o4xM5sMniqdEPlfwq0e0iyfp23lVv06TGbwhy6ct0MbcuqE0TQu9DlvmzinvVRORVWciii36AJ9c5Cgh4ZCnctVBfBj9tISsds4TtedoagbxsBBD820oUh0rdnfuBTAi8MNUkm2EUkOB83xMzHGDLF0YDuSwH0FdxF7/HuwVOEXo1BJUEF/57pjIg6ZEV3juUigA4W"}
HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: application/json; charset=utf-8
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
P3P: CP="PSA OUR DEM"
X-Robots-Tag: noindex, nofollow
Date: Wed, 01 Apr 2015 22:54:18 GMT
Content-Length: 4694
{"Content":"FrsBtCa7IuEUhXc21yrUEJuOl39kKRPj9wcHGJ5xM4e2mloH54GePMIyVJVn6CCWwILqpRY94KM8r/rCHOiS1ZSxUCgPrv7gkcvW3Mcu64IvF0OuW9oS7UU7Lo3DJnNt3/9HF4LkYCEbxAK9IPM 6N0r6DnN9mkoMaxm PREOatqxHdaMvlV JxXx6CKx3gZiQe7axPvcfU4Hvww2LmZjSlhUgjzlD/p0vlcHMSEiwdkG9dwKccSHodcaJCue E14U1L7rMhlm9B5fvLSHJFj7fqpos shTREUaCsc7W6lNGgVKEPkDylXze7uqadedM3G8bmnMaV8jDoFsAxjpYDR5byLxntn4jXFKj6ONaY1OT7JtWfC3FyUiuhEmAMnE cDStr2gGIDK1NBDI6JbVE776UZZFNIFl8udVdHEQKI20hdUk7KCwwZzZdS/lWyX/y1P8Pm4qJASmP8xM2A 8LwHVlx7CH5z0LF1XhP 3ptBNp37vhkyxKHLUpdtunc5hOnXsL06zLlS2dBijctOzlhzz6STJmUa1NJ1JO4jiVFOb5p7z7mW wOJcfAITJze3mcEM5IkA1DkQH2Z9J1Ha2ZVjLcRhxyUDL4Osb11KUBc5kaIozudzP8Z7D2dBFEYmwkFiLQtmu4OKMSfP2ZTsS2G8HMpa ebg2VrHe4xXahRB0L6508UecQs4jaZ0xRYWSl4NXJi3t/FqrZ2yZwzMF341mndDWlLiMA4oLSI LGzbsp9zmAPvJpB/tLbsGG3nQ9iYcZ4KjXj87BYqAqNyz1YlsV/gLLAjlIwXj/E aCjQAUeRpZZUyhGmTj 8Y/XEUo/bo08JWpmfCUHEgNLaDGeKVlLSjHWigaPvlSyW0roIWjpK0TYUrUTA3tk qlkCoj09I5PD3c/EJxJ/FzYZT37zS7BcLjpzJlmUhzgElnKWLNKgGBOeLGFE1yiGViPrmFI/TaGASyGqQdWLSC86fEcTBSlEY3qPk8BtXKkxRI0yLcjL25/2GfY2rpah690mRqkBXNXHNV5Ba0YOqsaFG4M0HMBEPqwfekZRXy/sZd3pVDim5rZRi47fDvyGYRAUpDx9/I3Y1qTZVZGH4uyekwdiSP1jvJlb2EtF6gwTW74BjXjAbcO8LsgDLLvym9 JedEQLoMqYutk1VzcnDcPPmnHhvnSQk0O9witGc6GTEUEoJrZcctGaWiMnrSx5QWYzRXYDrHS bYi CJCp55/6cBdMkVwRv9yGDEiiWrt5fiE3nJTZtfl 4 8zmd4o7qKm1JCS0MeonZRsApZ/BakJCQL1iStKPzTtvmjhTUP7t3j7A1NJ7QsGcohlYwEg6HT6wN tREy9bkxZc4Gn71DeJoXSWil/AlVJWlIySsXMjT5aYkS0KnvXS6KbtsBcUvx97jXQgB0oASgmg44i10ua3bYG0xRtgffjWjGsUL5SzNemsPLMknlGbVkJ2hAI/I90P7UqvFP8r7xRDDr5beioWkTBMqeeTD0OICPdcNjgKZOZ 5JV3zS
<<< skipped >>>
Map
The PUP connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_376:
.text
.text
`.text-quS
`.text-quS
`.text-co
`.text-co
`.text-co8:
`.text-co8:
`.text-co (
`.text-co (
`.text-tig
`.text-tig
`.text-co;
`.text-co;
`.rdata
`.rdata
@.data
@.data
.data-qu)
.data-qu)
.data-co
.data-co
.data-co8
.data-co8
.data-co(
.data-co(
.data-co,
.data-co,
.data-co)
.data-co)
.data-cot
.data-cot
.data-ti
.data-ti
.rsrc
.rsrc
CSShZ
CSShZ
CSSh4
CSSh4
CSSh9
CSSh9
CSSh>
CSSh>
CSShl
CSShl
CSSh[
CSSh[
CSSh`
CSSh`
<:>
<:>
t8Ht.HHt#
t8Ht.HHt#
.FGy1
.FGy1
Af;FP}%S3
Af;FP}%S3
|$|.tD
|$|.tD
#t.Ht
#t.Ht
2 34 567
2 34 567
u.SSV
u.SSV
1t.Ht
1t.Ht
9sxv%UW
9sxv%UW
function not supported
function not supported
operation canceled
operation canceled
address_family_not_supported
address_family_not_supported
operation_in_progress
operation_in_progress
operation_not_supported
operation_not_supported
protocol_not_supported
protocol_not_supported
operation_would_block
operation_would_block
address family not supported
address family not supported
broken pipe
broken pipe
inappropriate io control operation
inappropriate io control operation
not supported
not supported
operation in progress
operation in progress
operation not permitted
operation not permitted
operation not supported
operation not supported
operation would block
operation would block
protocol not supported
protocol not supported
operator
operator
GetProcessWindowStation
GetProcessWindowStation
Operation not permitted
Operation not permitted
Inappropriate I/O control operation
Inappropriate I/O control operation
Broken pipe
Broken pipe
0xX
0xX
Invalid CRT parameter
Invalid CRT parameter
QuickStartApp.cpp
QuickStartApp.cpp
vi.engine.xml
vi.engine.xml
chk_firefox
chk_firefox
chk_chrome
chk_chrome
OfferManager.cpp
OfferManager.cpp
position=%d, active=%d
position=%d, active=%d
%s[%d]
%s[%d]
%d,%d,%d
%d,%d,%d
** Debug mode: simulating stopping Firefox
** Debug mode: simulating stopping Firefox
** Debug mode: simulating stopping Chrome
** Debug mode: simulating stopping Chrome
%s must be closed before continuing. Press OK to close %s now. You may need to close %s manually.
%s must be closed before continuing. Press OK to close %s now. You may need to close %s manually.
Firefox
Firefox
Google Chrome
Google Chrome
%d err: %s
%d err: %s
Chrome
Chrome
firefox
firefox
chrome
chrome
opera
opera
sxexaxrxcxhxpxrxoxtxexcxtxoxrx.xexxxex
sxexaxrxcxhxpxrxoxtxexcxtxoxrx.xexxxex
view=%d,sel=%d,inst=%d,conf=%d,can=%d,err=%d,eid=%d,pos=%d,%s
view=%d,sel=%d,inst=%d,conf=%d,can=%d,err=%d,eid=%d,pos=%d,%s
control.txt
control.txt
00000000-0000-0000-0000-000000000000
00000000-0000-0000-0000-000000000000
QuickStartProcess.cpp
QuickStartProcess.cpp
%programfiles%\Free Offers from Freeze.com
%programfiles%\Free Offers from Freeze.com
disabling offer because system doesn't have Firefox
disabling offer because system doesn't have Firefox
disabling offer because system doesn't have Chrome
disabling offer because system doesn't have Chrome
%s[%s]: view=%s accept=%s
%s[%s]: view=%s accept=%s
%s,%s
%s,%s
WindowsErrorCode
WindowsErrorCode
targetbrowser/key
targetbrowser/key
%s:v=%s,id=%s,rc=%d,f=%d,e=%d,i=%s,p=%s,pb=%s,ex=%s,tr=%s,px=%d
%s:v=%s,id=%s,rc=%d,f=%d,e=%d,i=%s,p=%s,pb=%s,ex=%s,tr=%s,px=%d
%s:v=%s,rc=%d,os=%s,%s,%s|ie=%s
%s:v=%s,rc=%d,os=%s,%s,%s|ie=%s
%d,%d,%s,%s,%s,%s
%d,%d,%s,%s,%s,%s
%d,%d,%d,%d,%d
%d,%d,%d,%d,%d
%d,%d,%s,%s,%s,%s,%s
%d,%d,%s,%s,%s,%s,%s
%d,%s,%s,%s,%s,%d,%d,%d,%d,%d,%d,%d,%d,%s,%s,%d,%s
%d,%s,%s,%s,%s,%d,%d,%d,%d,%d,%d,%d,%d,%s,%s,%d,%s
offers
offers
%s,%s,%s,%s,%s,%s,%s,%s
%s,%s,%s,%s,%s,%s,%s,%s
%s,%d,%s,%s
%s,%d,%s,%s
%s,%s,%u,%u,%d,%s
%s,%s,%u,%u,%d,%s
Unable to open thankyou page; url is empty or invalid!
Unable to open thankyou page; url is empty or invalid!
statsd.response.txt
statsd.response.txt
Web.Installer.VDI.CommError
Web.Installer.VDI.CommError
Web.Installer.VDI.InstallError
Web.Installer.VDI.InstallError
Web.Installer.VDI.OfferDownloadError
Web.Installer.VDI.OfferDownloadError
Web.Installer.VDI.OfferInstallError
Web.Installer.VDI.OfferInstallError
Web.Installer.VDI.OfferInstallFailed
Web.Installer.VDI.OfferInstallFailed
hxtxtxpx:x/x/xdxlx2x.xvx4x7xixnxsxtxaxlxlxexrx.xcxoxmx/xlxmx/xbxuxnxdxlxexsx/xkxexexpxmxyxsxextxtxixnxgxsxxx/xkxexexpxmxyxsxextxtxixnxgxsxxx.xzxixpx
hxtxtxpx:x/x/xdxlx2x.xvx4x7xixnxsxtxaxlxlxexrx.xcxoxmx/xlxmx/xbxuxnxdxlxexsx/xkxexexpxmxyxsxextxtxixnxgxsxxx/xkxexexpxmxyxsxextxtxixnxgxsxxx.xzxixpx
hxtxtxpx:x/x/xsxdxsxpxaxpxix.xcxoxmx/xaxpxix/xvxaxlxuxexsx
hxtxtxpx:x/x/xsxdxsxpxaxpxix.xcxoxmx/xaxpxix/xvxaxlxuxexsx
hXXps://search.yahoo.com/yhs/web?hspart=w3i&hsimp=yhs-syctransfer&type=W3i_DS,221,0_0,Search,20140522,19669,0,FF29,7635
hXXps://search.yahoo.com/yhs/web?hspart=w3i&hsimp=yhs-syctransfer&type=W3i_DS,221,0_0,Search,20140522,19669,0,FF29,7635
hxtxtxpx:x/x/xdxlx2x.xvx4x7xixnxsxtxaxlxlxexrx.xcxoxmx/xlxmx/xbxuxnxdxlxexsx/xkxexexpxmxyxsxextxtxixnxgxsxxx/xsxpxvx1x.xzxixpx
hxtxtxpx:x/x/xdxlx2x.xvx4x7xixnxsxtxaxlxlxexrx.xcxoxmx/xlxmx/xbxuxnxdxlxexsx/xkxexexpxmxyxsxextxtxixnxgxsxxx/xsxpxvx1x.xzxixpx
spv1.zip
spv1.zip
hxtxtxpx:x/x/xvxixnxsxtxaxlxlxexrx.xcxoxmx/xaxpxix/xtxrxaxcxkxoxfxfxexrxixnxsxtxaxlxlxdxextxaxixlxsx
hxtxtxpx:x/x/xvxixnxsxtxaxlxlxexrx.xcxoxmx/xaxpxix/xtxrxaxcxkxoxfxfxexrxixnxsxtxaxlxlxdxextxaxixlxsx
hxtxtxpx:x/x/xvxixnxsxtxaxlxlxexrx.xcxoxmx/xaxpxix/xixnxsxtxaxlxlxexrxrxoxrx
hxtxtxpx:x/x/xvxixnxsxtxaxlxlxexrx.xcxoxmx/xaxpxix/xixnxsxtxaxlxlxexrxrxoxrx
session.response.json
session.response.json
postback.response.json
postback.response.json
vmtest.txt
vmtest.txt
vmtest.txt is present, enbaling offers for vmtest
vmtest.txt is present, enbaling offers for vmtest
config.xml
config.xml
pingurl
pingurl
postbackurl
postbackurl
errorurl
errorurl
statsdurl
statsdurl
uninstalloptionurl
uninstalloptionurl
encryptionkey
encryptionkey
PingUrl
PingUrl
PostbackUrl
PostbackUrl
Config.cpp
Config.cpp
stub.xml
stub.xml
.json
.json
MainWnd.cpp
MainWnd.cpp
.html
.html
OfferThread.cpp
OfferThread.cpp
Setting offer checkbox value: key=
Setting offer checkbox value: key=
COfferExe::GetXpiFilename
COfferExe::GetXpiFilename
g:\winapps\windows\main\installer.quickstart.application\installer.quickstart.lib\OfferExe.h
g:\winapps\windows\main\installer.quickstart.application\installer.quickstart.lib\OfferExe.h
configuration/downloadurl
configuration/downloadurl
configuration/downloadurl.64bit
configuration/downloadurl.64bit
configuration/msie.downloadurl
configuration/msie.downloadurl
configuration/msie.commandline
configuration/msie.commandline
configuration/firefox.downloadurl
configuration/firefox.downloadurl
configuration/firefox.commandline
configuration/firefox.commandline
configuration/chrome.downloadurl
configuration/chrome.downloadurl
configuration/chrome.commandline
configuration/chrome.commandline
configuration/allbrowser.downloadurl
configuration/allbrowser.downloadurl
configuration/allbrowser.commandline
configuration/allbrowser.commandline
configuration/regkeyadd
configuration/regkeyadd
regkeyadd
regkeyadd
configuration/ieregkey
configuration/ieregkey
ieregkey
ieregkey
configuration/firefox.pref
configuration/firefox.pref
firefox.pref
firefox.pref
configuration/firefox.xpimethod
configuration/firefox.xpimethod
configuration/firefox.xpilocation
configuration/firefox.xpilocation
configuration/firefox.xpidelete
configuration/firefox.xpidelete
LUA account detected, and flag lua_runasdesktopuser detected, forcing executeAsDesktopUser
LUA account detected, and flag lua_runasdesktopuser detected, forcing executeAsDesktopUser
configuration/iconurl
configuration/iconurl
adding %s entry, ourVal='%s', theirVal='%s'
adding %s entry, ourVal='%s', theirVal='%s'
COfferExe::Download
COfferExe::Download
Download url is empty!
Download url is empty!
_firefox is NULL!
_firefox is NULL!
COfferExe::OnInstall
COfferExe::OnInstall
Install is a dropfile; no exe to run...
Install is a dropfile; no exe to run...
Icon offer (in exe config) detected, running icon install
Icon offer (in exe config) detected, running icon install
COfferExe::Run
COfferExe::Run
COfferExe::HandleFirefoxOptions
COfferExe::HandleFirefoxOptions
firefoxoffer
firefoxoffer
HandleFirefoxOptions called with incorrect preferences set in config!
HandleFirefoxOptions called with incorrect preferences set in config!
COfferExe::BuildCommandLine
COfferExe::BuildCommandLine
msiexec.exe /i "%s" /qn ALLUSERS=2 REBOOT=ReallySuppress
msiexec.exe /i "%s" /qn ALLUSERS=2 REBOOT=ReallySuppress
msiexec.exe /i "%s" %s
msiexec.exe /i "%s" %s
Could not find firefox exe to install
Could not find firefox exe to install
Offer is installing XPI for Firefox 8 or higher, enabling GUI.
Offer is installing XPI for Firefox 8 or higher, enabling GUI.
"%s" "%s"
"%s" "%s"
"%s" %s
"%s" %s
COfferExe::RunSearchProtectInstall
COfferExe::RunSearchProtectInstall
COfferExe::WaitForInstallProcess
COfferExe::WaitForInstallProcess
OfferExe.cpp
OfferExe.cpp
COfferExe::WaitForProcessStarted
COfferExe::WaitForProcessStarted
waiting for registry key:
waiting for registry key:
COfferExe::WaitForRegistryValue
COfferExe::WaitForRegistryValue
Registry key found.
Registry key found.
Registry key found (64-bit).
Registry key found (64-bit).
COfferExe::WaitForFile
COfferExe::WaitForFile
COfferExe::InstallXpi
COfferExe::InstallXpi
Bad RegKeyAdd config; not correct format: (missing hive \ )
Bad RegKeyAdd config; not correct format: (missing hive \ )
Bad RegKeyAdd config; not correct format: (missing , )
Bad RegKeyAdd config; not correct format: (missing , )
Bad RegKeyAdd config; not correct format: (missing = )
Bad RegKeyAdd config; not correct format: (missing = )
unable to set regkey from following RegKeyAdd:
unable to set regkey from following RegKeyAdd:
RegKeyAdd:
RegKeyAdd:
unrecognized values in RegKeyAdd:
unrecognized values in RegKeyAdd:
unable to set regkey from following IERegKey:
unable to set regkey from following IERegKey:
IERegKeyAdd:
IERegKeyAdd:
unrecognized values in IERegKey:
unrecognized values in IERegKey:
COfferExe::FinishXpiInstall
COfferExe::FinishXpiInstall
COfferExe::CancelXpiInstall
COfferExe::CancelXpiInstall
COfferExe::RunIconInstall
COfferExe::RunIconInstall
%s_%s.url
%s_%s.url
configuration/url
configuration/url
configuration/msie.url
configuration/msie.url
configuration/firefox.url
configuration/firefox.url
configuration/firefox.newtaburl
configuration/firefox.newtaburl
configuration/chrome.extensionid
configuration/chrome.extensionid
configuration/chrome.extensionparam
configuration/chrome.extensionparam
All urls are empty!
All urls are empty!
COfferStartPage::InstallFirefox
COfferStartPage::InstallFirefox
_firefox is NULL!
_firefox is NULL!
** Debug mode: simulated setting Firefox startpage:
** Debug mode: simulated setting Firefox startpage:
Error writing Firefox pref for startpage!
Error writing Firefox pref for startpage!
Error setting Firefox new tab!
Error setting Firefox new tab!
Set new tab in Firefox.
Set new tab in Firefox.
Firefox startpage set successful.
Firefox startpage set successful.
chromeoffer
chromeoffer
COfferStartPage::InstallChrome
COfferStartPage::InstallChrome
_chrome is NULL!
_chrome is NULL!
** Debug mode: simulated setting Chrome startpage:
** Debug mode: simulated setting Chrome startpage:
Error setting Chrome startpage: browser is still running!
Error setting Chrome startpage: browser is still running!
Error writing Chrome pref for startpage!
Error writing Chrome pref for startpage!
Can't set new tab Chrome, function is implemented with Default Search.
Can't set new tab Chrome, function is implemented with Default Search.
Chrome startpage set successful.
Chrome startpage set successful.
OfferStartPage.cpp
OfferStartPage.cpp
startpageurl
startpageurl
oldstartpageurl
oldstartpageurl
hXXp://ff.search.yahoo.com/gossip?output=fxjson&command={searchTerms}
hXXp://ff.search.yahoo.com/gossip?output=fxjson&command={searchTerms}
configuration/msie.searchname
configuration/msie.searchname
configuration/firefox.searchname
configuration/firefox.searchname
configuration/firefox.suggesturl
configuration/firefox.suggesturl
configuration/firefox.selectedengine
configuration/firefox.selectedengine
Error setting IE search: url is empty!
Error setting IE search: url is empty!
Internet Explorer version 6 or older does not support default search!
Internet Explorer version 6 or older does not support default search!
COfferDefaultSearch::InstallFirefox
COfferDefaultSearch::InstallFirefox
** Debug mode: simulated setting Firefox default search:
** Debug mode: simulated setting Firefox default search:
Failed to write Yahoo xml for Firefox!
Failed to write Yahoo xml for Firefox!
Firefox default search set successful.
Firefox default search set successful.
COfferDefaultSearch::InstallChrome
COfferDefaultSearch::InstallChrome
** Debug mode: simulated setting Chrome default search by extension:
** Debug mode: simulated setting Chrome default search by extension:
Failed to install default search extension for chrome!
Failed to install default search extension for chrome!
Chrome default search set successful.
Chrome default search set successful.
OfferDefaultSearch.cpp
OfferDefaultSearch.cpp
searchurl
searchurl
hxtxtxpx:x/x/xdxlx5x.xvx1xixnxsxtxaxlxlxexrx.xcxoxmx/x
hxtxtxpx:x/x/xdxlx5x.xvx1xixnxsxtxaxlxlxexrx.xcxoxmx/x
PingResponse.cpp
PingResponse.cpp
targetbrowser/Key
targetbrowser/Key
PingThread.cpp
PingThread.cpp
offer %s[%s]: isInstalled=%d canShow=%d
offer %s[%s]: isInstalled=%d canShow=%d
rule %s[%s]: isInstalled=%d
rule %s[%s]: isInstalled=%d
QuickStartDetectThread.cpp
QuickStartDetectThread.cpp
ResourceThread.cpp
ResourceThread.cpp
Response/url
Response/url
passed
passed
CRequirementManager::RunExecute
CRequirementManager::RunExecute
CRequirementManager::ParseExecuteResult
CRequirementManager::ParseExecuteResult
invalid flag in execute result:
invalid flag in execute result:
Software\Microsoft\Windows\CurrentVersion\RunOnce
Software\Microsoft\Windows\CurrentVersion\RunOnce
Running requirement.OnInstall:
Running requirement.OnInstall:
Running requirement.OnCancel:
Running requirement.OnCancel:
requirement.OnCancel is empty, skipping.
requirement.OnCancel is empty, skipping.
Running requirement.OnExit:
Running requirement.OnExit:
requirement.OnExit is empty, skipping.
requirement.OnExit is empty, skipping.
%programdata%\W3i\UninstallHelper\iqu.ini
%programdata%\W3i\UninstallHelper\iqu.ini
2.0.1.0
2.0.1.0
%xpxrxoxgxrxaxmxdxaxtxax%x\xWx3xix\xUxnxixnxsxtxaxlxlxHxexlxpxexrx\xixmxpxoxrxtx
%xpxrxoxgxrxaxmxdxaxtxax%x\xWx3xix\xUxnxixnxsxtxaxlxlxHxexlxpxexrx\xixmxpxoxrxtx
quickstart.xml
quickstart.xml
quickstart%d.xml
quickstart%d.xml
Failed to save IQU data, too many import files in directory!
Failed to save IQU data, too many import files in directory!
%xpxrxoxgxrxaxmxfxixlxexsx%x\xWx3xix\xUxnxixnxsxtxaxlxlxHxexlxpxexrx\xUxnxixnxsxtxaxlxlxHxexlxpxexrx.xexxxex
%xpxrxoxgxrxaxmxfxixlxexsx%x\xWx3xix\xUxnxixnxsxtxaxlxlxHxexlxpxexrx\xUxnxixnxsxtxaxlxlxHxexlxpxexrx.xexxxex
quickstart_si.xml
quickstart_si.xml
quickstart_si%d.xml
quickstart_si%d.xml
Failed to save SoftwareInfo data, too many import files in directory!
Failed to save SoftwareInfo data, too many import files in directory!
hxtxtxpx:x/x/xdxlx.xixnxsxtxaxlxlxixqx.xcxoxmx/xAxPxIx/xIxQxUx/xSxoxfxtxwxaxrxexIxnxfxox.xaxsxpxxx
hxtxtxpx:x/x/xdxlx.xixnxsxtxaxlxlxixqx.xcxoxmx/xAxPxIx/xIxQxUx/xSxoxfxtxwxaxrxexIxnxfxox.xaxsxpxxx
UH executable not found!
UH executable not found!
"%s" /silent /noswinfo
"%s" /silent /noswinfo
%s:%d
%s:%d
handling firefox cookies...
handling firefox cookies...
FF.GetCookiesError
FF.GetCookiesError
FF.NoCookies
FF.NoCookies
firefox: no cookies found
firefox: no cookies found
FF.SetCookieError
FF.SetCookieError
FF.SetCookies
FF.SetCookies
firefox: set cookies
firefox: set cookies
getting firefox cookies for
getting firefox cookies for
CCookieManager::GetFirefoxCookies
CCookieManager::GetFirefoxCookies
Error enumerating firefox cookies!
Error enumerating firefox cookies!
firefoxenum
firefoxenum
hXXp://
hXXp://
cookie.dat
cookie.dat
Vista.NoResult
Vista.NoResult
Vista.SavedLow
Vista.SavedLow
Vista.NoCookies
Vista.NoCookies
Vista.CopiedLow
Vista.CopiedLow
%a, %d-%b-%Y %H:%M:%S GMT
%a, %d-%b-%Y %H:%M:%S GMT
cookieman.exe
cookieman.exe
Vista.ExtractError
Vista.ExtractError
Vista.CreateLowError
Vista.CreateLowError
handling chrome cookies
handling chrome cookies
Chrome.GetCookiesError
Chrome.GetCookiesError
Chrome.NoCookies
Chrome.NoCookies
Chrome: no cookies found
Chrome: no cookies found
Chrome.SetCookieError
Chrome.SetCookieError
Chrome.SetCookies
Chrome.SetCookies
Chrome: set cookies succeeded
Chrome: set cookies succeeded
getting Chrome cookies for
getting Chrome cookies for
CCookieManager::GetChromeCookies
CCookieManager::GetChromeCookies
Error enumerating chrome cookies!
Error enumerating chrome cookies!
chromeenum
chromeenum
Safari.GetCookiesError
Safari.GetCookiesError
Safari.NoCookies
Safari.NoCookies
Safari.SetCookieError
Safari.SetCookieError
Safari.SetCookies
Safari.SetCookies
Sending session request, url=
Sending session request, url=
Request url is empty!
Request url is empty!
Request url is invalid!
Request url is invalid!
ErrorLogger.cpp
ErrorLogger.cpp
explorer.exe
explorer.exe
CDialogWindowJson::OnBeforeNavigate2, url=
CDialogWindowJson::OnBeforeNavigate2, url=
DialogWindowJson.cpp
DialogWindowJson.cpp
%s: view=%s accept=%s
%s: view=%s accept=%s
chk_%s=
chk_%s=
checkbox found; %s=%s
checkbox found; %s=%s
adding disclosure(%s): %s
adding disclosure(%s): %s
installedbrowsers/firefox
installedbrowsers/firefox
installedbrowsers/chrome
installedbrowsers/chrome
installedbrowsers/opera
installedbrowsers/opera
view.buildconfig.json
view.buildconfig.json
view.productconfig.json
view.productconfig.json
ProgressDialog.cpp
ProgressDialog.cpp
Installing %d of %d
Installing %d of %d
uninstalloption.exe
uninstalloption.exe
InstallIQFirefoxLock
InstallIQFirefoxLock
configuration/postinstallexecute
configuration/postinstallexecute
configuration/postinstallexecuteintegrity
configuration/postinstallexecuteintegrity
stopfirefox
stopfirefox
stopchrome
stopchrome
disablechromeextensions
disablechromeextensions
/msie.autoconfirm
/msie.autoconfirm
/firefox.autoconfirm
/firefox.autoconfirm
/chrome.autoconfirm
/chrome.autoconfirm
COffer::WaitForFirefoxLock
COffer::WaitForFirefoxLock
Offer.cpp
Offer.cpp
_firefoxLock is already created!
_firefoxLock is already created!
Waiting for Firefox lock...
Waiting for Firefox lock...
Firefox lock status:
Firefox lock status:
Releasing Firefox lock
Releasing Firefox lock
PostInstallExecute:
PostInstallExecute:
iexplore.exe
iexplore.exe
** Debug mode: simulating PostInstallExecute:
** Debug mode: simulating PostInstallExecute:
Cannot run post-install execute, file does not exist:
Cannot run post-install execute, file does not exist:
COffer::PostInstallExecute
COffer::PostInstallExecute
PostInstallExecute command failed!
PostInstallExecute command failed!
http:
http:
Adding UH data: %s|%s,%s
Adding UH data: %s|%s,%s
Failed to extract uninstall option exe!
Failed to extract uninstall option exe!
Error; uninstalloption.exe doesn't exist (after download and extract!)
Error; uninstalloption.exe doesn't exist (after download and extract!)
Error copying uninstalloption.exe to program files!
Error copying uninstalloption.exe to program files!
error downloading uninstall option url!
error downloading uninstall option url!
hXXp://airdownload.adobe.com/air/win/download/latest/AdobeAIRInstaller.exe
hXXp://airdownload.adobe.com/air/win/download/latest/AdobeAIRInstaller.exe
%programfiles%\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe
%programfiles%\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe
"%s" %s "%s"
"%s" %s "%s"
AdobeAirInstaller.exe
AdobeAirInstaller.exe
JsonResponse.cpp
JsonResponse.cpp
Unknown uninstall key type encountered, skipping lookup
Unknown uninstall key type encountered, skipping lookup
%firefoxprofiles%
%firefoxprofiles%
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
crterr:%d
crterr:%d
Win32Err:%d
Win32Err:%d
HRESULT:0x%X
HRESULT:0x%X
@ line %d in function .
@ line %d in function .
Unknown error: %d
Unknown error: %d
wininet.dll
wininet.dll
IDispatch error #%d
IDispatch error #%d
LoadLibrary failed in loading current exe:
LoadLibrary failed in loading current exe:
CoreResource.cpp
CoreResource.cpp
CStringW.GetBuffer failed!
CStringW.GetBuffer failed!
0xx
0xx
%s. {%s} @ line %d in function in module %s.
%s. {%s} @ line %d in function in module %s.
HRESULT:0x%X
HRESULT:0x%X
HttpStatus:%d
HttpStatus:%d
Win32Err:%d
Win32Err:%d
Error:%d
Error:%d
-- %s line %d --
-- %s line %d --
[X]
[X]
L%d:d.d.d_d:d:d.d
L%d:d.d.d_d:d:d.d
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /%d
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /%d
%s_%x%x%x%x%x
%s_%x%x%x%x%x
CoreFile.cpp
CoreFile.cpp
Exception %X in module %s at: 0x%p.
Exception %X in module %s at: 0x%p.
dbghelp.dll
dbghelp.dll
0x%p %s
0x%p %s
CoreProcess.cpp
CoreProcess.cpp
ShellExecuteCommand:
ShellExecuteCommand:
Failed to execute command:
Failed to execute command:
CCoreProcess::ShellExecuteCommand
CCoreProcess::ShellExecuteCommand
CCoreProcess::CloseProcessWindowsByModuleName
CCoreProcess::CloseProcessWindowsByModuleName
CCoreProcess::ShellExecuteCommandAndWait
CCoreProcess::ShellExecuteCommandAndWait
CCoreProcess::GetProcessExe32
CCoreProcess::GetProcessExe32
CCoreProcess::GetProcessExe64
CCoreProcess::GetProcessExe64
kernel32.dll
kernel32.dll
CoreXml.cpp
CoreXml.cpp
_ftprintf_s failed writing header to
_ftprintf_s failed writing header to
CCoreXml::ParseRequiredKeyValue
CCoreXml::ParseRequiredKeyValue
]/Key/text()
]/Key/text()
CCoreXml::ParseRequiredKeyInt
CCoreXml::ParseRequiredKeyInt
CoreThread.cpp
CoreThread.cpp
hXXps://
hXXps://
PTF://
PTF://
CoreSystem.cpp
CoreSystem.cpp
CCoreSystem::GetWindowsVersionId
CCoreSystem::GetWindowsVersionId
Missing windows version, check the code!!
Missing windows version, check the code!!
%s (Build %d)
%s (Build %d)
Unknown OS! Major: 0xX, Minor: 0xX
Unknown OS! Major: 0xX, Minor: 0xX
CCoreSystem::CacheWindowsInfo
CCoreSystem::CacheWindowsInfo
%system%
%system%
%windows%
%windows%
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Þsktopdir%
Þsktopdir%
Þsktop%
Þsktop%
%userprofile%
%userprofile%
%s0x%.2x%.2x%.2x%.2x%.2x%.2x-
%s0x%.2x%.2x%.2x%.2x%.2x%.2x-
SOFTWARE\Microsoft\NET Framework Setup\NDP\v2.0.50727
SOFTWARE\Microsoft\NET Framework Setup\NDP\v2.0.50727
SOFTWARE\Microsoft\NET Framework Setup\NDP\v1.1.4322
SOFTWARE\Microsoft\NET Framework Setup\NDP\v1.1.4322
SOFTWARE\Microsoft\.NETFramework\policy\v1.0
SOFTWARE\Microsoft\.NETFramework\policy\v1.0
3321-3705
3321-3705
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\
Iphlpapi.dll
Iphlpapi.dll
%windows%\Desktop
%windows%\Desktop
VBoxService.exe
VBoxService.exe
vboxtray.exe
vboxtray.exe
proc.vboxsvc
proc.vboxsvc
vmtoolsd.exe
vmtoolsd.exe
proc.vboxtray
proc.vboxtray
vmicsvc.exe
vmicsvc.exe
proc.vmtools
proc.vmtools
proc.hvsvc
proc.hvsvc
reg.vboxguest
reg.vboxguest
reg.vboxmouse
reg.vboxmouse
reg.vboxsvc
reg.vboxsvc
reg.vboxsf
reg.vboxsf
reg.vboxvid
reg.vboxvid
reg.vboxbios
reg.vboxbios
%system%\vboxhook.dll
%system%\vboxhook.dll
reg.vboxsguest
reg.vboxsguest
file.vboxhook
file.vboxhook
reg.vmvid
reg.vmvid
reg.vmpci
reg.vmpci
reg.vmdbg
reg.vmdbg
reg.vmcrd
reg.vmcrd
reg.vmmem
reg.vmmem
reg.vmmouse
reg.vmmouse
reg.vmdsk
reg.vmdsk
reg.vmtools
reg.vmtools
reg.vmsnap
reg.vmsnap
reg.vmnet64
reg.vmnet64
reg.hvgenctr
reg.hvgenctr
reg.hvvmbus
reg.hvvmbus
SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
SYSTEM\CurrentControlSet\Control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}\0000
SYSTEM\CurrentControlSet\Control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}\0000
reg.hvvid
reg.hvvid
SYSTEM\CurrentControlSet\Control\Class\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}\0000
SYSTEM\CurrentControlSet\Control\Class\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}\0000
reg.hvscsi
reg.hvscsi
reg.hvinput
reg.hvinput
reg.vboxdisk
reg.vboxdisk
reg.vmdisk
reg.vmdisk
reg.hvdisk
reg.hvdisk
sng.vmt1
sng.vmt1
sng.vmt3
sng.vmt3
sng.vmt2
sng.vmt2
gen.dbg
gen.dbg
sng.vmt4
sng.vmt4
CCoreRegKey::Create
CCoreRegKey::Create
Warning: HKEY_CLASSES_ROOT opened for writing! This can lead to unpredictable results.
Warning: HKEY_CLASSES_ROOT opened for writing! This can lead to unpredictable results.
RegCreateKeyEx failed on key=
RegCreateKeyEx failed on key=
RegOpenKeyEx failed on key=
RegOpenKeyEx failed on key=
CCoreRegKey::Open
CCoreRegKey::Open
Registry key is not open! (
Registry key is not open! (
CCoreRegKey::GetValueType
CCoreRegKey::GetValueType
CoreRegKey.cpp
CoreRegKey.cpp
CCoreRegKey::GetValueSize
CCoreRegKey::GetValueSize
CCoreRegKey::GetValue
CCoreRegKey::GetValue
CCoreRegKey::GetValueString
CCoreRegKey::GetValueString
CCoreRegKey::SetValue
CCoreRegKey::SetValue
CCoreRegKey::DeleteValue
CCoreRegKey::DeleteValue
CCoreRegKey::DeleteKey
CCoreRegKey::DeleteKey
RegDeleteKeyEx failed on
RegDeleteKeyEx failed on
RegDeleteKeyExA
RegDeleteKeyExA
RegDeleteKey failed on
RegDeleteKey failed on
CCoreRegKey::EnumSubKeys
CCoreRegKey::EnumSubKeys
CCoreRegKey::CopyTree
CCoreRegKey::CopyTree
SHCopyKey failed for
SHCopyKey failed for
CCoreEntryPoint::CCoreEntryPoint
CCoreEntryPoint::CCoreEntryPoint
CCoreEntryPoint::LoadProcAddress
CCoreEntryPoint::LoadProcAddress
Advapi32.dll
Advapi32.dll
UniqueId.cpp
UniqueId.cpp
subKey is NULL!
subKey is NULL!
0.0.0.0
0.0.0.0
%u,%u,%u,%u
%u,%u,%u,%u
\/:*?"|
\/:*?"|
Failed to create URL file!
Failed to create URL file!
createurlfilefail
createurlfilefail
Encryption key not initialized!
Encryption key not initialized!
%Y-%m-%dT%H:%M:%S
%Y-%m-%dT%H:%M:%S
CommandLine.cpp
CommandLine.cpp
CoreEvent.cpp
CoreEvent.cpp
shell32.dll
shell32.dll
CoreVista.cpp
CoreVista.cpp
Software\Microsoft\Windows\CurrentVersion\Policies\System
Software\Microsoft\Windows\CurrentVersion\Policies\System
HKEY_USERS
HKEY_USERS
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
%s.%s
%s.%s
iexplore,ie.http
iexplore,ie.http
Failed to get IE version key!
Failed to get IE version key!
Loading IE cookies for url:[
Loading IE cookies for url:[
wrote %d cookies
wrote %d cookies
CoreInternetExplorer.cpp
CoreInternetExplorer.cpp
Unable to find iexplore.exe, using shell execute (with possible warnings)
Unable to find iexplore.exe, using shell execute (with possible warnings)
-noframemerging "%s"
-noframemerging "%s"
ie.http\shell\open\command
ie.http\shell\open\command
Default search regkey not found (may be a brand new install)
Default search regkey not found (may be a brand new install)
ieframe.dll
ieframe.dll
EnumSubKeys failed!
EnumSubKeys failed!
hXXp://VVV.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
hXXp://VVV.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
url is empty!
url is empty!
Replacing existing provider url:
Replacing existing provider url:
Error setting provider url!
Error setting provider url!
FindFirstUrlCacheEntry() failed!!
FindFirstUrlCacheEntry() failed!!
CCoreInternetExplorer::FindFirstHistoryUrl
CCoreInternetExplorer::FindFirstHistoryUrl
CCoreInternetExplorer::FindNextHistoryUrl
CCoreInternetExplorer::FindNextHistoryUrl
findfirsturlfailed
findfirsturlfailed
FindNextUrlCacheEntry() failed!!
FindNextUrlCacheEntry() failed!!
FindUrlCache handle is null!! Did you call FindFirstHistoryUrl first??
FindUrlCache handle is null!! Did you call FindFirstHistoryUrl first??
CCoreInternetExplorer::FindCloseHistoryUrl
CCoreInternetExplorer::FindCloseHistoryUrl
findnexturlfailed
findnexturlfailed
findcloseurlfailed
findcloseurlfailed
FindCloseUrlCache() failed!!
FindCloseUrlCache() failed!!
msgText is required!
msgText is required!
msgTitle is required!
msgTitle is required!
browser.search.selectedEngine
browser.search.selectedEngine
browser.search.defaultenginename
browser.search.defaultenginename
browser.startup.homepage
browser.startup.homepage
MozillaWindowClass
MozillaWindowClass
MozillaUIWindowClass
MozillaUIWindowClass
firefox.exe,firefox.url,firefoxportableurl,firefoxurl,firefox
firefox.exe,firefox.url,firefoxportableurl,firefoxurl,firefox
CCoreFirefox::GetVersion
CCoreFirefox::GetVersion
Software\Mozilla\Mozilla Firefox
Software\Mozilla\Mozilla Firefox
firefoxver
firefoxver
Failed to get Firefox version key!
Failed to get Firefox version key!
Profile%d
Profile%d
profiles.ini
profiles.ini
%appdata%\Mozilla\Firefox
%appdata%\Mozilla\Firefox
Loading Firefox3 cookies for url:[
Loading Firefox3 cookies for url:[
Firefox versions prior to 3 are not supported by LoadProfileCookies!
Firefox versions prior to 3 are not supported by LoadProfileCookies!
cookies.sqlite
cookies.sqlite
%s=%s
%s=%s
Enumerating Firefox3 cookies for
Enumerating Firefox3 cookies for
cookies.txt
cookies.txt
Found partial cookie in Firefox profile:
Found partial cookie in Firefox profile:
Enumerating Firefox cookies for
Enumerating Firefox cookies for
-requestPending -osint -new-window "%s"
-requestPending -osint -new-window "%s"
firefox.exe
firefox.exe
%programfiles%\Mozilla Firefox
%programfiles%\Mozilla Firefox
PathToExe
PathToExe
CCoreFirefox::GetPrefString
CCoreFirefox::GetPrefString
prefs.js
prefs.js
CoreFirefox.cpp
CoreFirefox.cpp
user_pref("%s", %s%s%s);
user_pref("%s", %s%s%s);
CCoreFirefox::SetPrefString
CCoreFirefox::SetPrefString
CCoreFirefox::SetDefaultSearch
CCoreFirefox::SetDefaultSearch
suggestionUrl is empty!
suggestionUrl is empty!
searchUrl is empty!
searchUrl is empty!
Setting Firefox default search engine:
Setting Firefox default search engine:
Can't set search engine while Firefox is running!
Can't set search engine while Firefox is running!
SearchUrl=
SearchUrl=
SuggestionUrl=
SuggestionUrl=
Failed to write search engine plug-in xml for Firefox!
Failed to write search engine plug-in xml for Firefox!
Failed to write search hash for Firefox!
Failed to write search hash for Firefox!
hXXp://VVV.mozilla.org/2006/browser/search/
hXXp://VVV.mozilla.org/2006/browser/search/
browser.search.order.1
browser.search.order.1
browser.search.order.2
browser.search.order.2
places.sqlite
places.sqlite
downloads.sqlite
downloads.sqlite
select source from moz_downloads where source like '%%%s%%' order by id desc
select source from moz_downloads where source like '%%%s%%' order by id desc
Failed to open downloads.sqlite database!
Failed to open downloads.sqlite database!
select url from moz_places where url like '%%%s%%' order by id desc
select url from moz_places where url like '%%%s%%' order by id desc
Failed to open places.sqlite database!
Failed to open places.sqlite database!
cannot set startpage; firefox is currently running!
cannot set startpage; firefox is currently running!
CCoreFirefox::SetStartpage
CCoreFirefox::SetStartpage
browser.startup.page
browser.startup.page
Cannot set newtab because firefox is running!
Cannot set newtab because firefox is running!
CCoreFirefox::SetNewTab
CCoreFirefox::SetNewTab
browser.newtab.url
browser.newtab.url
/SearchPlugin/Url
/SearchPlugin/Url
firefox pref: browser.search.param.yahoo-fr=
firefox pref: browser.search.param.yahoo-fr=
CCoreFirefox::WriteSearchHash
CCoreFirefox::WriteSearchHash
browser.search.param.yahoo-fr
browser.search.param.yahoo-fr
search-metadata.json
search-metadata.json
nss3.dll
nss3.dll
CCoreFirefox::GetVerificationHash
CCoreFirefox::GetVerificationHash
secmod.db
secmod.db
By modifying this file, I agree that I am doing so only within Firefox itself, using official, user-driven search engine selection processes, and in a way which does not circumvent user consent. I acknowledge that any attempt to change this file from outside of Firefox is a malicious act, and will be responded to accordingly.
By modifying this file, I agree that I am doing so only within Firefox itself, using official, user-driven search engine selection processes, and in a way which does not circumvent user consent. I acknowledge that any attempt to change this file from outside of Firefox is a malicious act, and will be responded to accordingly.
g:\winapps\windows\main\core.cpplib\core.cpplib.browser\CoreChrome.h
g:\winapps\windows\main\core.cpplib\core.cpplib.browser\CoreChrome.h
CCoreChrome::SetCookie
CCoreChrome::SetCookie
Chrome_WindowImpl_0
Chrome_WindowImpl_0
Chrome_RenderWidgetHostHWND
Chrome_RenderWidgetHostHWND
Chrome_WidgetWin_0
Chrome_WidgetWin_0
chrome.exe,chrome.hwd,chromehtml,chromiumhtml,chrome,chromium
chrome.exe,chrome.hwd,chromehtml,chromiumhtml,chrome,chromium
Chrome_WidgetWin_1
Chrome_WidgetWin_1
%local_appdata%\Google\Chrome\User Data\Default\Cookies
%local_appdata%\Google\Chrome\User Data\Default\Cookies
Loading Google Chrome cookies for url:[
Loading Google Chrome cookies for url:[
CCoreChrome; Cookie file does not exist
CCoreChrome; Cookie file does not exist
host_key like '%
host_key like '%
select name, value, host_key, path, expires_utc from cookies where
select name, value, host_key, path, expires_utc from cookies where
CCoreChrome::EnumCookiesLegacy
CCoreChrome::EnumCookiesLegacy
Enumerating Google Chrome cookies for
Enumerating Google Chrome cookies for
Chrome cookie file does not exist
Chrome cookie file does not exist
Enumerating Google Chrome cookies (v33) for
Enumerating Google Chrome cookies (v33) for
select host_key, name, value, path, expires_utc from cookies where host_key like '%
select host_key, name, value, path, expires_utc from cookies where host_key like '%
select host_key, name, value, path, expires_utc, encrypted_value from cookies where host_key like '%
select host_key, name, value, path, expires_utc, encrypted_value from cookies where host_key like '%
CCoreChrome::EnumCookiesV33
CCoreChrome::EnumCookiesV33
CoreChrome.cpp
CoreChrome.cpp
CCoreChrome::EnumCookieRowCallback
CCoreChrome::EnumCookieRowCallback
Chrome cookie:
Chrome cookie:
Failed to decrypt chrome cookie:
Failed to decrypt chrome cookie:
--new-window "%s"
--new-window "%s"
chrome.dll
chrome.dll
chrome.exe
chrome.exe
Unable to find chrome.exe, using shell execute (with possible warnings)
Unable to find chrome.exe, using shell execute (with possible warnings)
%local_appdata%\Google\Chrome\Application
%local_appdata%\Google\Chrome\Application
ChromeHTML\shell\open\command
ChromeHTML\shell\open\command
CCoreChrome::GetStartpage
CCoreChrome::GetStartpage
%programfiles%\Google\Chrome\Application
%programfiles%\Google\Chrome\Application
session/startup_urls
session/startup_urls
/preferences/session.restore_on_startup
/preferences/session.restore_on_startup
CCoreChrome::IsMultiStartPageEnabled
CCoreChrome::IsMultiStartPageEnabled
CCoreChrome::GetDefaultSearchUrl
CCoreChrome::GetDefaultSearchUrl
search_url
search_url
/manifest/chrome_settings_overrides/search_provider/
/manifest/chrome_settings_overrides/search_provider/
SELECT value FROM meta WHERE key='Default Search Provider ID'
SELECT value FROM meta WHERE key='Default Search Provider ID'
%local_appdata%\Google\Chrome\User Data\Default\Web Data
%local_appdata%\Google\Chrome\User Data\Default\Web Data
SELECT id, short_name, url FROM keywords where id = %s
SELECT id, short_name, url FROM keywords where id = %s
CCoreChrome::GetDSUrlFromPrefTemplate
CCoreChrome::GetDSUrlFromPrefTemplate
default_search_provider_data/template_url_data
default_search_provider_data/template_url_data
default_search_provider_data/template_url_data/url
default_search_provider_data/template_url_data/url
{google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
{google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
default_search_provider_data/template_url_data/id
default_search_provider_data/template_url_data/id
default_search_provider_data/template_url_data/short_name
default_search_provider_data/template_url_data/short_name
CCoreChrome::GetPreference
CCoreChrome::GetPreference
%local_appdata%\Google\Chrome\User Data\Default\Preferences
%local_appdata%\Google\Chrome\User Data\Default\Preferences
CCoreChrome::LoadPreferences
CCoreChrome::LoadPreferences
%local_appdata%\Google\Chrome\User Data\Default\Secure Preferences
%local_appdata%\Google\Chrome\User Data\Default\Secure Preferences
CCoreChrome::LoadSecurePreferences
CCoreChrome::LoadSecurePreferences
%local_appdata%\Google\Chrome\User Data\Default\History
%local_appdata%\Google\Chrome\User Data\Default\History
select url from downloads_url_chains where url like '%%%s%%' order by id desc
select url from downloads_url_chains where url like '%%%s%%' order by id desc
Found chrome extension
Found chrome extension
chrome_url_overrides
chrome_url_overrides
Setting chrome extension [
Setting chrome extension [
Installing extension from web store:
Installing extension from web store:
Software\Google\Chrome\Extensions
Software\Google\Chrome\Extensions
Software\Wow6432Node\Google\Chrome\Extensions
Software\Wow6432Node\Google\Chrome\Extensions
CCoreChrome::InstallExtensionFromWebStore
CCoreChrome::InstallExtensionFromWebStore
update_url
update_url
hXXps://clients2.google.com/service/update2/crx
hXXps://clients2.google.com/service/update2/crx
Error setting update_url in registry!
Error setting update_url in registry!
%local_appdata%\Google\Chrome\User Data\Default\Extensions
%local_appdata%\Google\Chrome\User Data\Default\Extensions
CoreFirefoxXPIInstaller.cpp
CoreFirefoxXPIInstaller.cpp
CCoreFirefoxXpiInstaller::Install
CCoreFirefoxXpiInstaller::Install
CCoreFirefoxXpiInstaller::GetXpiInfo
CCoreFirefoxXpiInstaller::GetXpiInfo
install.rdf
install.rdf
xml.LoadBuffer failed on
xml.LoadBuffer failed on
Firefox.exe not found!
Firefox.exe not found!
Installing Firefox add-ons via package...
Installing Firefox add-ons via package...
installiq.xpi
installiq.xpi
Create install.rdf failed!
Create install.rdf failed!
CCoreFirefoxXpiInstaller::InstallAsPackage
CCoreFirefoxXpiInstaller::InstallAsPackage
Running Firefox to install add-ons:
Running Firefox to install add-ons:
Error running Firefox!
Error running Firefox!
xmlns:NC="hXXp://home.netscape.com/NC-rdf#"
xmlns:NC="hXXp://home.netscape.com/NC-rdf#"
xmlns:em="hXXp://VVV.mozilla.org/2004/em-rdf#">
xmlns:em="hXXp://VVV.mozilla.org/2004/em-rdf#">
multi@installiq.com
multi@installiq.com
{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
*.*.*
*.*.*
Error creating install.rdf!
Error creating install.rdf!
CCoreFirefoxXpiInstaller::CreateInstallRDF
CCoreFirefoxXpiInstaller::CreateInstallRDF
Installed Firefox extension:
Installed Firefox extension:
CCoreFirefoxXpiInstaller::SetResult
CCoreFirefoxXpiInstaller::SetResult
Can't get Firefox default profiles folder!
Can't get Firefox default profiles folder!
CCoreFirefoxXpiInstaller::GetExtensionsFolder
CCoreFirefoxXpiInstaller::GetExtensionsFolder
g:\winapps\windows\main\core.cpplib\core.cpplib.browser\CoreSearchProtectorApp.h
g:\winapps\windows\main\core.cpplib\core.cpplib.browser\CoreSearchProtectorApp.h
kxexexpxmxyxsxextxtxixnxgxsxxx.xexxxex
kxexexpxmxyxsxextxtxixnxgxsxxx.xexxxex
KxexexpxMxyxSxextxtxixnxgxsxXx
KxexexpxMxyxSxextxtxixnxgxsxXx
hxtxtxpx:x/x/xdxoxwxnxlxoxaxdx.xixnxsxtxaxlxlxixqx.xcxoxmx/xlxmx/xbxuxnxdxlxexsx/xkxexexpxmxyxsxextxtxixnxgxsxxx/xsxoxfxtxwxaxrxexixnxsxtxaxlxlxaxtxixoxnx_x1x3x4x7x1x.xexxxex
hxtxtxpx:x/x/xdxoxwxnxlxoxaxdx.xixnxsxtxaxlxlxixqx.xcxoxmx/xlxmx/xbxuxnxdxlxexsx/xkxexexpxmxyxsxextxtxixnxgxsxxx/xsxoxfxtxwxaxrxexixnxsxtxaxlxlxaxtxixoxnx_x1x3x4x7x1x.xexxxex
hxtxtxpxsx:x/x/xixnxsxtxaxlxlxexrx.xfxrxexexzxex.xcxoxmx/xLxoxgxExrxrxoxrx.xaxsxpxxx
hxtxtxpxsx:x/x/xixnxsxtxaxlxlxexrx.xfxrxexexzxex.xcxoxmx/xLxoxgxExrxrxoxrx.xaxsxpxxx
Restoring V1 toolbar uninstall key...
Restoring V1 toolbar uninstall key...
Error replacing toolbar uninstall key!
Error replacing toolbar uninstall key!
Software\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! Companion
Software\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! Companion
Sxoxfxtxwxaxrxex\xMxixcxrxoxsxoxfxtx\xWxixnxdxoxwxsx\xCxuxrxrxexnxtxVxexrxsxixoxnx\xUxnxixnxsxtxaxlxlx\xKxexexpxMxyxSxextxtxixnxgxsxXx
Sxoxfxtxwxaxrxex\xMxixcxrxoxsxoxfxtx\xWxixnxdxoxwxsx\xCxuxrxrxexnxtxVxexrxsxixoxnx\xUxnxixnxsxtxaxlxlx\xKxexexpxMxyxSxextxtxixnxgxsxXx
Renaming V1 uninstall key...
Renaming V1 uninstall key...
Error opeing uninstall registry key in HKLM\
Error opeing uninstall registry key in HKLM\
Error copying V1 registry key!
Error copying V1 registry key!
CoreSearchProtectorApp.cpp
CoreSearchProtectorApp.cpp
Error removing V1 registry key from HKLM\
Error removing V1 registry key from HKLM\
CCoreSearchProtectorApp.ShutDown: window not found
CCoreSearchProtectorApp.ShutDown: window not found
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
Error removing registry key from HKLM\
Error removing registry key from HKLM\
apiurl
apiurl
offerurl
offerurl
dsotherurl
dsotherurl
spotherurl
spotherurl
%s/provider[%d]
%s/provider[%d]
hXXp://bing.com
hXXp://bing.com
hXXps://VVV.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-us:IE-Address&ie=&oe=
hXXps://VVV.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-us:IE-Address&ie=&oe=
hXXp://google.com
hXXp://google.com
firefoxstartpage
firefoxstartpage
firefoxsearch
firefoxsearch
chromestartpage
chromestartpage
chromesearch
chromesearch
keyword.URL
keyword.URL
config.dat
config.dat
Yahoo uninstall key not found
Yahoo uninstall key not found
Error replacing Yahoo Toolbar uninstall key!
Error replacing Yahoo Toolbar uninstall key!
UninstallKey
UninstallKey
Software\Microsoft\Windows\CurrentVersion\Uninstall\
Software\Microsoft\Windows\CurrentVersion\Uninstall\
UninstallKey=
UninstallKey=
ChromeStartPageExtensionId
ChromeStartPageExtensionId
ChromeSearchExtensionId
ChromeSearchExtensionId
FirefoxPriorStartPage
FirefoxPriorStartPage
FirefoxPriorSearchUrl
FirefoxPriorSearchUrl
CoreBrowserOptionUninstaller.cpp
CoreBrowserOptionUninstaller.cpp
g:\winapps\windows\main\core.cpplib\core.cpplib.browser\CoreSafari.h
g:\winapps\windows\main\core.cpplib\core.cpplib.browser\CoreSafari.h
%appdata%\Apple Computer\Safari\Cookies\Cookies.binarycookies
%appdata%\Apple Computer\Safari\Cookies\Cookies.binarycookies
safari.exe,safariurl,safari
safari.exe,safariurl,safari
Loading Safari cookies for url:[
Loading Safari cookies for url:[
CoreSafari.cpp
CoreSafari.cpp
%appdata%\Apple Computer\Safari\Cookies\Cookies.plist
%appdata%\Apple Computer\Safari\Cookies\Cookies.plist
Failed to get Safari version key!
Failed to get Safari version key!
-url "%s"
-url "%s"
safari.exe
safari.exe
Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice
Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice
http\shell\open\command
http\shell\open\command
CoreBrowser.cpp
CoreBrowser.cpp
Can't find shell associations or shell command reg keys!
Can't find shell associations or shell command reg keys!
Dll %s failed, resultcode = %x
Dll %s failed, resultcode = %x
SymCCIS.dll
SymCCIS.dll
SymCCIS2.zip
SymCCIS2.zip
RunDLL productlist="%s" resultcodes="%s"
RunDLL productlist="%s" resultcodes="%s"
SymCCIS_CheckCriteria.txt
SymCCIS_CheckCriteria.txt
SCCLog.txt
SCCLog.txt
SymInstallStub.txt
SymInstallStub.txt
SymCCISDll.txt
SymCCISDll.txt
Detect.cpp
Detect.cpp
/execute/text()
/execute/text()
Missing ExecuteResult in requirement config!
Missing ExecuteResult in requirement config!
/executeresult/text()
/executeresult/text()
%programfiles%\iTunes\iTunes.exe
%programfiles%\iTunes\iTunes.exe
SOFTWARE\Microsoft\Windows Live\Messenger
SOFTWARE\Microsoft\Windows Live\Messenger
ydetect.ytb
ydetect.ytb
msnmsgr.exe
msnmsgr.exe
ydetect.yhp
ydetect.yhp
ydetect.yas
ydetect.yas
Rules.cpp
Rules.cpp
RegKeyExists
RegKeyExists
regkey
regkey
chromeprefs
chromeprefs
firefoxprefs
firefoxprefs
CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\InprocServer32
CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\InprocServer32
%firefoxprofiles%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\install.rdf
%firefoxprofiles%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\install.rdf
CDetectionYahooToolbar::IsInstalledFirefox
CDetectionYahooToolbar::IsInstalledFirefox
KeyExists
KeyExists
SourceKey
SourceKey
hkey_local_machine
hkey_local_machine
hkey_current_user
hkey_current_user
hkey_current_config
hkey_current_config
hkey_classes_root
hkey_classes_root
multireg: key found:
multireg: key found:
multireg%d
multireg%d
multireg: unable to parse key:
multireg: unable to parse key:
1.1.0.6
1.1.0.6
//flag[%d]/text()
//flag[%d]/text()
DetectionFile.cpp
DetectionFile.cpp
Cannot evaluate .NET Version, .NET may not be installed!
Cannot evaluate .NET Version, .NET may not be installed!
wajam_validate.zip
wajam_validate.zip
extracted wajam exe file not found!
extracted wajam exe file not found!
wajamexemissing
wajamexemissing
Timed out waiting for wajam_validate.exe!
Timed out waiting for wajam_validate.exe!
Unable to get returncode from wajam_validate.exe!
Unable to get returncode from wajam_validate.exe!
wajam_validate.exe detection process result = %d
wajam_validate.exe detection process result = %d
yahoo.com
yahoo.com
google.com
google.com
msn.com
msn.com
live.com
live.com
aol.com
aol.com
ask.com
ask.com
DetectionFirefoxPrefs.cpp
DetectionFirefoxPrefs.cpp
CDetectionFirefoxPrefs::OnEvaluate
CDetectionFirefoxPrefs::OnEvaluate
DetectionChromePrefs.cpp
DetectionChromePrefs.cpp
CDetectionChromePrefs::OnEvaluate
CDetectionChromePrefs::OnEvaluate
minwindowsversion
minwindowsversion
)] disabled because of minimum windows version.
)] disabled because of minimum windows version.
DetectionRule.cpp
DetectionRule.cpp
Disabled; rule target is not Firefox
Disabled; rule target is not Firefox
Disabled; rule target is not Chrome
Disabled; rule target is not Chrome
Disabled; Firefox is not installed
Disabled; Firefox is not installed
Disabled; Chrome is not installed
Disabled; Chrome is not installed
asktbdet.zip
asktbdet.zip
Ask detection process result = %d
Ask detection process result = %d
CoreWininet.cpp
CoreWininet.cpp
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
wininet: connecting to %s:%d
wininet: connecting to %s:%d
CCoreWininet::HTTPSendRequest
CCoreWininet::HTTPSendRequest
HTTPSendRequest:
HTTPSendRequest:
httpopenrequest
httpopenrequest
wininet: HttpOpenRequest failed!
wininet: HttpOpenRequest failed!
httpreqerr
httpreqerr
wininet: Request handle is NULL after HttpSendRequest!
wininet: Request handle is NULL after HttpSendRequest!
unable to set wininet http decoding
unable to set wininet http decoding
wininet: HttpAddRequestHeaders (post flag) failed!
wininet: HttpAddRequestHeaders (post flag) failed!
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
Range: bytes=%u-
Range: bytes=%u-
httpaddheaders
httpaddheaders
wininet: HttpAddRequestHeaders (range specification) failed!
wininet: HttpAddRequestHeaders (range specification) failed!
Range: bytes=%u-%u
Range: bytes=%u-%u
httpaddheader
httpaddheader
httpsendreq
httpsendreq
wininet: HttpSendRequest failed! (verb=
wininet: HttpSendRequest failed! (verb=
httptimeout
httptimeout
wininet: HttpQueryInfo failed!
wininet: HttpQueryInfo failed!
wininet: HttpSendRequest failed!
wininet: HttpSendRequest failed!
httpqueryinfo
httpqueryinfo
httpproxy
httpproxy
httpstatus
httpstatus
wininet: Server responded with error: %d, %s. %s %s
wininet: Server responded with error: %d, %s. %s %s
wininet: HttpSendRequest: status OK received
wininet: HttpSendRequest: status OK received
wininet: HttpQueryInfo for file size failed!
wininet: HttpQueryInfo for file size failed!
wininet: HttpQueryInfo for content range failed!
wininet: HttpQueryInfo for content range failed!
wininet: Operation cancelled by caller.
wininet: Operation cancelled by caller.
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Windows\CurrentVersion\Internet Settings
HTTP Status %d: %s
HTTP Status %d: %s
apiUrl is null!
apiUrl is null!
API url is invalid!
API url is invalid!
%m/%d/%Y
%m/%d/%Y
Url is null!
Url is null!
%s, %s, l=0xx
%s, %s, l=0xx
[0x%X]
[0x%X]
d:%s
d:%s
01234567
01234567
%s(%s);
%s(%s);
CoreJSON2.cpp
CoreJSON2.cpp
Node path not valid; node "%s" in path "%s" is not type Node!
Node path not valid; node "%s" in path "%s" is not type Node!
PackageZlib.cpp
PackageZlib.cpp
Error: %d bytes of %d read from file %s.
Error: %d bytes of %d read from file %s.
unzOpenCurrentFilePassword failed!
unzOpenCurrentFilePassword failed!
Error: %d bytes of %d were written to file %s.
Error: %d bytes of %d were written to file %s.
unzOpenCurrentFilePassword failed! err=
unzOpenCurrentFilePassword failed! err=
Package.cpp
Package.cpp
autorun.txt
autorun.txt
CCoreSqlite::OpenDatabase
CCoreSqlite::OpenDatabase
CCoreSqlite::CloseDatabase
CCoreSqlite::CloseDatabase
CCoreSqlite::ExecuteStatement
CCoreSqlite::ExecuteStatement
sqlite3_exec failed, returned error:
sqlite3_exec failed, returned error:
CCoreSqlite::StandardExecuteCallback
CCoreSqlite::StandardExecuteCallback
dbexecerror
dbexecerror
CoreSqlite.cpp
CoreSqlite.cpp
CCoreSqlite::PrepareCompiledStmt
CCoreSqlite::PrepareCompiledStmt
sqlempty
sqlempty
Cannot prepare statement, sql is empty!
Cannot prepare statement, sql is empty!
sqliteerror
sqliteerror
Failed to prepare compiled statement, sqlite returned error: %d
Failed to prepare compiled statement, sqlite returned error: %d
CCoreSqlite::BindTextToCompiledStmt
CCoreSqlite::BindTextToCompiledStmt
bind text failed, errorcode=%d
bind text failed, errorcode=%d
CCoreSqlite::ExecuteCompiledStmt
CCoreSqlite::ExecuteCompiledStmt
sqlitestepfailed
sqlitestepfailed
sqlite3_step failed, errorcode=%d
sqlite3_step failed, errorcode=%d
CCoreSqlite::CheckStmtRowValid
CCoreSqlite::CheckStmtRowValid
Cannot get row results: statement has not executed!!
Cannot get row results: statement has not executed!!
CCoreSqlite::CloseCompiledStmt
CCoreSqlite::CloseCompiledStmt
sqlite3_finalize failed, errorcode=%d
sqlite3_finalize failed, errorcode=%d
SQLITE_
SQLITE_
d-d-d d:d:d
d-d-d d:d:d
d:d:d
d:d:d
d-d-d
d-d-d
failed to allocate %u bytes of memory
failed to allocate %u bytes of memory
failed memory resize %u to %u bytes
failed memory resize %u to %u bytes
922337203685477580
922337203685477580
API call with %s database connection pointer
API call with %s database connection pointer
RowKey
RowKey
%s\etilqs_
%s\etilqs_
%s-shm
%s-shm
Recovered %d frames from WAL file %s
Recovered %d frames from WAL file %s
OsError 0x%x (%u)
OsError 0x%x (%u)
invalid page number %d
invalid page number %d
2nd reference to page %d
2nd reference to page %d
%d of %d pages missing from overflow list starting at %d
%d of %d pages missing from overflow list starting at %d
failed to get page %d
failed to get page %d
Failed to read ptrmap key=%d
Failed to read ptrmap key=%d
Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)
Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)
unable to get the page. error code=%d
unable to get the page. error code=%d
btreeInitPage() returns error code %d
btreeInitPage() returns error code %d
freelist leaf count too big on page %d
freelist leaf count too big on page %d
Page %d:
Page %d:
On page %d at right child:
On page %d at right child:
On tree page %d cell %d:
On tree page %d cell %d:
Fragmentation of %d bytes reported as %d on page %d
Fragmentation of %d bytes reported as %d on page %d
Corruption detected in cell %d on page %d
Corruption detected in cell %d on page %d
Multiple uses for byte %d of page %d
Multiple uses for byte %d of page %d
Pointer map page %d is referenced
Pointer map page %d is referenced
Outstanding page count goes from %d to %d during this analysis
Outstanding page count goes from %d to %d during this analysis
Page %d is never used
Page %d is never used
unknown database %s
unknown database %s
keyinfo(%d
keyinfo(%d
%s(%d)
%s(%d)
%s-mjX
%s-mjX
foreign key constraint failed
foreign key constraint failed
unable to use function %s in the requested context
unable to use function %s in the requested context
zeroblob(%d)
zeroblob(%d)
bind on a busy prepared statement: [%s]
bind on a busy prepared statement: [%s]
abort at %d in [%s]: %s
abort at %d in [%s]: %s
constraint failed at %d in [%s]
constraint failed at %d in [%s]
cannot open savepoint - SQL statements in progress
cannot open savepoint - SQL statements in progress
no such savepoint: %s
no such savepoint: %s
cannot commit transaction - SQL statements in progress
cannot commit transaction - SQL statements in progress
cannot %s savepoint - SQL statements in progress
cannot %s savepoint - SQL statements in progress
cannot rollback transaction - SQL statements in progress
cannot rollback transaction - SQL statements in progress
sqlite_temp_master
sqlite_temp_master
sqlite_master
sqlite_master
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
database table is locked: %s
database table is locked: %s
statement aborts at %d: [%s] %s
statement aborts at %d: [%s] %s
cannot change %s wal mode from within a transaction
cannot change %s wal mode from within a transaction
cannot open value of type %s
cannot open value of type %s
no such column: "%s"
no such column: "%s"
foreign key
foreign key
cannot open virtual table: %s
cannot open virtual table: %s
cannot open view: %s
cannot open view: %s
indexed
indexed
cannot open %s column for writing
cannot open %s column for writing
%s: %s.%s.%s
%s: %s.%s.%s
misuse of aliased aggregate %s
misuse of aliased aggregate %s
not authorized to use function: %s
not authorized to use function: %s
%s: %s.%s
%s: %s.%s
%s: %s
%s: %s
%r %s BY term out of range - should be between 1 and %d
%r %s BY term out of range - should be between 1 and %d
too many terms in %s BY clause
too many terms in %s BY clause
too many SQL variables
too many SQL variables
too many columns in %s
too many columns in %s
Expression tree is too large (maximum depth %d)
Expression tree is too large (maximum depth %d)
variable number must be between ?1 and ?%d
variable number must be between ?1 and ?%d
EXECUTE %s%s SUBQUERY %d
EXECUTE %s%s SUBQUERY %d
misuse of aggregate: %s()
misuse of aggregate: %s()
%.*s"%w"%s
%.*s"%w"%s
%s%.*s"%w"
%s%.*s"%w"
sqlite_rename_parent
sqlite_rename_parent
sqlite_rename_table
sqlite_rename_table
sqlite_rename_trigger
sqlite_rename_trigger
there is already another table or index with this name: %s
there is already another table or index with this name: %s
%s OR name=%Q
%s OR name=%Q
type='trigger' AND (%s)
type='trigger' AND (%s)
view %s may not be altered
view %s may not be altered
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
sqlite_
sqlite_
table %s may not be altered
table %s may not be altered
UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q
UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
sqlite_sequence
sqlite_sequence
Cannot add a PRIMARY KEY column
Cannot add a PRIMARY KEY column
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
CREATE TABLE %Q.%s(%s)
CREATE TABLE %Q.%s(%s)
sqlite_altertab_%s
sqlite_altertab_%s
sqlite_stat1
sqlite_stat1
SELECT tbl, idx, stat FROM %Q.sqlite_stat1
SELECT tbl, idx, stat FROM %Q.sqlite_stat1
invalid name: "%s"
invalid name: "%s"
DELETE FROM %Q.%s WHERE tbl=%Q
DELETE FROM %Q.%s WHERE tbl=%Q
database %s is already in use
database %s is already in use
too many attached databases - max %d
too many attached databases - max %d
no such database: %s
no such database: %s
cannot detach database %s
cannot detach database %s
unable to open database: %s
unable to open database: %s
sqlite_detach
sqlite_detach
sqlite_attach
sqlite_attach
database %s is locked
database %s is locked
access to %s.%s.%s is prohibited
access to %s.%s.%s is prohibited
access to %s.%s is prohibited
access to %s.%s is prohibited
%s %T cannot reference objects in database %s
%s %T cannot reference objects in database %s
object name reserved for internal use: %s
object name reserved for internal use: %s
duplicate column name: %s
duplicate column name: %s
default value of column [%s] is not constant
default value of column [%s] is not constant
there is already an index named %s
there is already an index named %s
too many columns on %s
too many columns on %s
AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY
AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY
no such collation sequence: %s
no such collation sequence: %s
table "%s" has more than one primary key
table "%s" has more than one primary key
CREATE TABLE %Q.sqlite_sequence(name,seq)
CREATE TABLE %Q.sqlite_sequence(name,seq)
CREATE %s %.*s
CREATE %s %.*s
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d
UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d
table %s may not be dropped
table %s may not be dropped
view %s is circularly defined
view %s is circularly defined
DELETE FROM %s.sqlite_sequence WHERE name=%Q
DELETE FROM %s.sqlite_sequence WHERE name=%Q
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
use DROP TABLE to delete table %s
use DROP TABLE to delete table %s
use DROP VIEW to delete view %s
use DROP VIEW to delete view %s
number of columns in foreign key does not match the number of columns in the referenced table
number of columns in foreign key does not match the number of columns in the referenced table
unknown column "%s" in foreign key definition
unknown column "%s" in foreign key definition
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
foreign key on %s should reference only one column of table %T
foreign key on %s should reference only one column of table %T
table %s may not be indexed
table %s may not be indexed
indexed columns are not unique
indexed columns are not unique
there is already a table named %s
there is already a table named %s
index %s already exists
index %s already exists
views may not be indexed
views may not be indexed
virtual tables may not be indexed
virtual tables may not be indexed
sqlite_autoindex_%s_%d
sqlite_autoindex_%s_%d
table %s has no column named %s
table %s has no column named %s
no such index: %S
no such index: %S
CREATE%s INDEX %.*s
CREATE%s INDEX %.*s
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q
DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
DELETE FROM %Q.%s WHERE name=%Q AND type='index'
DELETE FROM %Q.%s WHERE name=%Q AND type='index'
a JOIN clause is required before %s
a JOIN clause is required before %s
unable to identify the object to be reindexed
unable to identify the object to be reindexed
table %s may not be modified
table %s may not be modified
cannot modify %s because it is a view
cannot modify %s because it is a view
sqlite_version
sqlite_version
sqlite_source_id
sqlite_source_id
sqlite_compileoption_used
sqlite_compileoption_used
sqlite_compileoption_get
sqlite_compileoption_get
foreign key mismatch
foreign key mismatch
%d values for %d columns
%d values for %d columns
table %S has no column named %s
table %S has no column named %s
table %S has %d columns but %d values were supplied
table %S has %d columns but %d values were supplied
PRIMARY KEY must be unique
PRIMARY KEY must be unique
%s.%s may not be NULL
%s.%s may not be NULL
sqlite3_extension_init
sqlite3_extension_init
error during initialization: %s
error during initialization: %s
automatic extension loading failed: %s
automatic extension loading failed: %s
unable to open shared library [%s]
unable to open shared library [%s]
no entry point [%s] in shared library [%s]
no entry point [%s] in shared library [%s]
foreign_keys
foreign_keys
foreign_key_list
foreign_key_list
*** in database %s ***
*** in database %s ***
unsupported encoding: %s
unsupported encoding: %s
malformed database schema (%s)
malformed database schema (%s)
unsupported file format
unsupported file format
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
%s - %s
%s - %s
database schema is locked: %s
database schema is locked: %s
RIGHT and FULL OUTER JOINs are not currently supported
RIGHT and FULL OUTER JOINs are not currently supported
a NATURAL join may not have an ON or USING clause
a NATURAL join may not have an ON or USING clause
unknown or unsupported join type: %T %T%s%T
unknown or unsupported join type: %T %T%s%T
cannot have both ON and USING clauses in the same join
cannot have both ON and USING clauses in the same join
cannot join using column %s - column not present in both tables
cannot join using column %s - column not present in both tables
USE TEMP B-TREE FOR %s
USE TEMP B-TREE FOR %s
ORDER BY clause should come after %s not before
ORDER BY clause should come after %s not before
COMPOUND SUBQUERIES %d AND %d %s(%s)
COMPOUND SUBQUERIES %d AND %d %s(%s)
no such index: %s
no such index: %s
sqlite_subquery_%p_
sqlite_subquery_%p_
LIMIT clause should come after %s not before
LIMIT clause should come after %s not before
SELECTs to the left and right of %s do not have the same number of result columns
SELECTs to the left and right of %s do not have the same number of result columns
no such table: %s
no such table: %s
sqlite3_get_table() called with two or more incompatible queries
sqlite3_get_table() called with two or more incompatible queries
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
cannot create %s trigger on view: %S
cannot create %s trigger on view: %S
cannot create INSTEAD OF trigger on table: %S
cannot create INSTEAD OF trigger on table: %S
no such column: %s
no such column: %s
no such trigger: %S
no such trigger: %S
-- TRIGGER %s
-- TRIGGER %s
cannot VACUUM - SQL statements in progress
cannot VACUUM - SQL statements in progress
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
PRAGMA vacuum_db.synchronous=OFF
PRAGMA vacuum_db.synchronous=OFF
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
vtable constructor did not declare schema: %s
vtable constructor did not declare schema: %s
vtable constructor failed: %s
vtable constructor failed: %s
table %s: xBestIndex returned an invalid plan
table %s: xBestIndex returned an invalid plan
no such module: %s
no such module: %s
%s SUBQUERY %d
%s SUBQUERY %d
%s TABLE %s
%s TABLE %s
%s AS %s
%s AS %s
%s (rowid=?)
%s (rowid=?)
%s (rowid>? AND rowid)
%s (rowid>? AND rowid)
%s USING %s%sINDEX%s%s%s
%s USING %s%sINDEX%s%s%s
%s USING INTEGER PRIMARY KEY
%s USING INTEGER PRIMARY KEY
%s VIRTUAL TABLE INDEX %d:%s
%s VIRTUAL TABLE INDEX %d:%s
%s (~%lld rows)
%s (~%lld rows)
%s (rowid>?)
%s (rowid>?)
%s (rowid)
%s (rowid)
at most %d tables in a join
at most %d tables in a join
cannot use index: %s
cannot use index: %s
the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers
the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
unable to close due to unfinished backup operation
unable to close due to unfinished backup operation
SQL logic error or missing database
SQL logic error or missing database
unknown operation
unknown operation
large file support is disabled
large file support is disabled
unknown database: %s
unknown database: %s
no such vfs: %s
no such vfs: %s
cannot open file at line %d of [%.10s]
cannot open file at line %d of [%.10s]
database corruption at line %d of [%.10s]
database corruption at line %d of [%.10s]
misuse at line %d of [%.10s]
misuse at line %d of [%.10s]
SQLite format 3
SQLite format 3
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
CREATE TABLE sqlite_master(
CREATE TABLE sqlite_master(
sql text
sql text
3.7.5
3.7.5
CREATE TEMP TABLE sqlite_temp_master(
CREATE TEMP TABLE sqlite_temp_master(
zip 1.01 Copyright 1998-2004 Gilles Vollant - hXXp://VVV.winimage.com/zLibDll
zip 1.01 Copyright 1998-2004 Gilles Vollant - hXXp://VVV.winimage.com/zLibDll
unzip 1.01 Copyright 1998-2004 Gilles Vollant - hXXp://VVV.winimage.com/zLibDll
unzip 1.01 Copyright 1998-2004 Gilles Vollant - hXXp://VVV.winimage.com/zLibDll
1.2.7
1.2.7
deflate 1.2.7 Copyright 1995-2012 Jean-loup Gailly and Mark Adler
deflate 1.2.7 Copyright 1995-2012 Jean-loup Gailly and Mark Adler
inflate 1.2.7 Copyright 1995-2012 Mark Adler
inflate 1.2.7 Copyright 1995-2012 Mark Adler
X;
X;
%s="%s"
%s="%s"
%s='%s'
%s='%s'
%s>
%s>
encoding="%s"
encoding="%s"
version="%s"
version="%s"
standalone="%s"
standalone="%s"
CoreDialogCloseProcess.cpp
CoreDialogCloseProcess.cpp
CoreHtmlDialog.cpp
CoreHtmlDialog.cpp
onBeforeNavigate2 called, url=
onBeforeNavigate2 called, url=
CoreIEControl.cpp
CoreIEControl.cpp
uxtheme.dll
uxtheme.dll
Error getting IExecAction!
Error getting IExecAction!
CCoreWinTask::AddExecAction
CCoreWinTask::AddExecAction
g:\winapps\windows\main\core.cpplib\core.cpplib.browser\CoreOpera.h
g:\winapps\windows\main\core.cpplib\core.cpplib.browser\CoreOpera.h
EnumCookies is not implemented for Opera!
EnumCookies is not implemented for Opera!
CCoreOpera::EnumCookies
CCoreOpera::EnumCookies
CCoreOpera::SetCookie
CCoreOpera::SetCookie
SetCookie is not implemented for Opera!
SetCookie is not implemented for Opera!
CCoreOpera::LoadCookies
CCoreOpera::LoadCookies
LoadCookies is not implemented for Opera!
LoadCookies is not implemented for Opera!
opera.exe,opera.protocol,opera.url,opera,operanext,operastable
opera.exe,opera.protocol,opera.url,opera,operanext,operastable
CCoreOpera::OpenUrl
CCoreOpera::OpenUrl
OpenURL is not implemented for Opera!
OpenURL is not implemented for Opera!
Software\Opera Software
Software\Opera Software
opera.exe
opera.exe
%programfiles%\Opera
%programfiles%\Opera
launcher.exe
launcher.exe
%programfiles%\Opera Next
%programfiles%\Opera Next
CoreIEHost.cpp
CoreIEHost.cpp
m_WebBrowserEvents failed
m_WebBrowserEvents failed
IWebBrowser2 failed
IWebBrowser2 failed
_WebBrowserEvents failed
_WebBrowserEvents failed
Sending Quit to web browser...
Sending Quit to web browser...
_webBrowser->Quit failed!
_webBrowser->Quit failed!
Not initialized or _webBrowser is NULL!
Not initialized or _webBrowser is NULL!
IWebBrowser failed!
IWebBrowser failed!
CCoreIEHost::DeleteHistoryUrl
CCoreIEHost::DeleteHistoryUrl
CCoreIEHost.OnDocumentComplete:
CCoreIEHost.OnDocumentComplete:
WebBrowser object is NULL!
WebBrowser object is NULL!
Error: Collection didn't support IHTMLElementCollection!
Error: Collection didn't support IHTMLElementCollection!
*** set key code to 0 ****
*** set key code to 0 ****
g:\winapps\Windows\MAIN\Installer.QuickStart.Application\ReleaseNoMFC\quickstart.pdb
g:\winapps\Windows\MAIN\Installer.QuickStart.Application\ReleaseNoMFC\quickstart.pdb
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
OLEAUT32.dll
OLEAUT32.dll
SHDeleteEmptyKeyA
SHDeleteEmptyKeyA
SHLWAPI.dll
SHLWAPI.dll
COMCTL32.dll
COMCTL32.dll
GetProcessHeap
GetProcessHeap
GetCPInfo
GetCPInfo
ShellExecuteExA
ShellExecuteExA
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
PSAPI.DLL
PSAPI.DLL
VERSION.dll
VERSION.dll
USERENV.dll
USERENV.dll
InternetCreateUrlA
InternetCreateUrlA
InternetCrackUrlA
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetCanonicalizeUrlA
InternetCombineUrlA
InternetCombineUrlA
FindFirstUrlCacheEntryA
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindNextUrlCacheEntryA
FindCloseUrlCache
FindCloseUrlCache
HttpOpenRequestA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpAddRequestHeadersA
HttpSendRequestA
HttpSendRequestA
HttpQueryInfoA
HttpQueryInfoA
WININET.dll
WININET.dll
UrlEscapeA
UrlEscapeA
SHCopyKeyA
SHCopyKeyA
gdiplus.dll
gdiplus.dll
IsValidURL
IsValidURL
urlmon.dll
urlmon.dll
GetWindowsDirectoryA
GetWindowsDirectoryA
EnumWindows
EnumWindows
EnumChildWindows
EnumChildWindows
GetKeyboardState
GetKeyboardState
GDI32.dll
GDI32.dll
RegCloseKey
RegCloseKey
RegCreateKeyExA
RegCreateKeyExA
RegOpenKeyExA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteKeyA
RegQueryInfoKeyA
RegQueryInfoKeyA
RegEnumKeyExA
RegEnumKeyExA
ADVAPI32.dll
ADVAPI32.dll
CRYPT32.dll
CRYPT32.dll
zcÃ
zcÃ
.?AV?$_Ref_count@VCOfferExe@@@std@@
.?AV?$_Ref_count@VCOfferExe@@@std@@
.?AV?$_Ref_count_obj@VCOfferExe@@@std@@
.?AV?$_Ref_count_obj@VCOfferExe@@@std@@
.?AV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@
.?AV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@
.?AVCOfferExe@@
.?AVCOfferExe@@
.?AVCCoreStringUrl@@
.?AVCCoreStringUrl@@
.?AV?$CFlags@W4WebArgFlag@@@@
.?AV?$CFlags@W4WebArgFlag@@@@
.?AV?$CAtlArray@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@V?$CElementTraits@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@2@@ATL@@
.?AV?$CAtlArray@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@V?$CElementTraits@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@2@@ATL@@
.?AV?$CCoreEntryPoint@P6GJPAUHKEY__@@PBDKK@Z@@
.?AV?$CCoreEntryPoint@P6GJPAUHKEY__@@PBDKK@Z@@
.?AVCCoreRegKey@@
.?AVCCoreRegKey@@
.?AVCCoreFirefox@@
.?AVCCoreFirefox@@
.?AV?$CFlags@W4CoreFirefoxCache@@@@
.?AV?$CFlags@W4CoreFirefoxCache@@@@
.?AV?$_Func_impl@U?$_Callable_obj@V?$_Bind@$00XU?$_Pmf_wrap@P8CCoreChrome@@AEXPAVCCoreSqlite@@PAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@ZXV1@PAV2@PAV34@U_Nil@std@@U56@U56@U56@U56@@std@@QAVCCoreChrome@@AAV?$_Ph@$00@2@PAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@U_Nil@2@U72@U72@U72@@std@@$0A@@std@@V?$allocator@V?$_Func_class@XPAVCCoreSqlite@@U_Nil@std@@U23@U23@U23@U23@U23@@std@@@2@XPAVCCoreSqlite@@U_Nil@2@U52@U52@U52@U52@U52@@std@@
.?AV?$_Func_impl@U?$_Callable_obj@V?$_Bind@$00XU?$_Pmf_wrap@P8CCoreChrome@@AEXPAVCCoreSqlite@@PAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@ZXV1@PAV2@PAV34@U_Nil@std@@U56@U56@U56@U56@@std@@QAVCCoreChrome@@AAV?$_Ph@$00@2@PAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@U_Nil@2@U72@U72@U72@@std@@$0A@@std@@V?$allocator@V?$_Func_class@XPAVCCoreSqlite@@U_Nil@std@@U23@U23@U23@U23@U23@@std@@@2@XPAVCCoreSqlite@@U_Nil@2@U52@U52@U52@U52@U52@@std@@
.?AVCCoreChrome@@
.?AVCCoreChrome@@
.?AV?$CFlags@W4CoreChromeCache@@@@
.?AV?$CFlags@W4CoreChromeCache@@@@
.?AV?$_Func_base@XPAVCCoreSqlite@@U_Nil@std@@U23@U23@U23@U23@U23@@std@@
.?AV?$_Func_base@XPAVCCoreSqlite@@U_Nil@std@@U23@U23@U23@U23@U23@@std@@
.?AV?$_Bind@$00XU?$_Pmf_wrap@P8CCoreChrome@@AEXPAVCCoreSqlite@@PAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@ZXV1@PAV2@PAV34@U_Nil@std@@U56@U56@U56@U56@@std@@QAVCCoreChrome@@AAV?$_Ph@$00@2@PAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@U_Nil@2@U72@U72@U72@@std@@
.?AV?$_Bind@$00XU?$_Pmf_wrap@P8CCoreChrome@@AEXPAVCCoreSqlite@@PAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@ZXV1@PAV2@PAV34@U_Nil@std@@U56@U56@U56@U56@@std@@QAVCCoreChrome@@AAV?$_Ph@$00@2@PAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@U_Nil@2@U72@U72@U72@@std@@
.?AVCCoreFirefoxXpiInstaller@@
.?AVCCoreFirefoxXpiInstaller@@
.?AV?$_Ref_count_obj@VCCoreOpera@@@std@@
.?AV?$_Ref_count_obj@VCCoreOpera@@@std@@
.?AV?$_Ref_count_obj@VCCoreChrome@@@std@@
.?AV?$_Ref_count_obj@VCCoreChrome@@@std@@
.?AV?$_Ref_count_obj@VCCoreFirefox@@@std@@
.?AV?$_Ref_count_obj@VCCoreFirefox@@@std@@
.?AV?$_Ref_count_obj@VCDetectionChromePrefs@@@std@@
.?AV?$_Ref_count_obj@VCDetectionChromePrefs@@@std@@
.?AV?$_Ref_count_obj@VCDetectionFirefoxPrefs@@@std@@
.?AV?$_Ref_count_obj@VCDetectionFirefoxPrefs@@@std@@
.?AVCDetectionFirefoxPrefs@@
.?AVCDetectionFirefoxPrefs@@
.?AVCDetectionChromePrefs@@
.?AVCDetectionChromePrefs@@
.?AV?$CAtlArray@UWebArg@@V?$CElementTraits@UWebArg@@@ATL@@@ATL@@
.?AV?$CAtlArray@UWebArg@@V?$CElementTraits@UWebArg@@@ATL@@@ATL@@
.?AVCCoreWebArgs@@
.?AVCCoreWebArgs@@
.?AVCCoreSqlite@@
.?AVCCoreSqlite@@
.?AV?$CAtlArray@PAV?$CAtlMap@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@V12@V?$CElementTraits@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@2@V32@@ATL@@V?$CElementTraits@PAV?$CAtlMap@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@V12@V?$CElementTraits@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@2@V32@@ATL@@@2@@ATL@@
.?AV?$CAtlArray@PAV?$CAtlMap@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@V12@V?$CElementTraits@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@2@V32@@ATL@@V?$CElementTraits@PAV?$CAtlMap@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@V12@V?$CElementTraits@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@2@V32@@ATL@@@2@@ATL@@
.?AVCCoreSqliteResult@@
.?AVCCoreSqliteResult@@
.?AVexecution_error@TinyXPath@@
.?AVexecution_error@TinyXPath@@
.?AV?$CFlags@W4CoreOperaCache@@@@
.?AV?$CFlags@W4CoreOperaCache@@@@
.?AVCCoreOpera@@
.?AVCCoreOpera@@
.?AUDWebBrowserEvents2@@
.?AUDWebBrowserEvents2@@
.?AVCCoreWebBrowserEvents@@
.?AVCCoreWebBrowserEvents@@
c:\%original file name%.exe
c:\%original file name%.exe
@.reloc
@.reloc
Vista.BadArgs
Vista.BadArgs
\cookie.ini
\cookie.ini
\cookie.dat
\cookie.dat
Vista.BadArgs2
Vista.BadArgs2
Domain%d
Domain%d
Name%d
Name%d
\cookie%d.dat
\cookie%d.dat
\cookie%d.ini
\cookie%d.ini
Vista.NoAppLow
Vista.NoAppLow
Vista.WideFail
Vista.WideFail
Vista.GetCookieFail
Vista.GetCookieFail
Vista.AllocFail
Vista.AllocFail
Vista.CreateFileError
Vista.CreateFileError
Vista.WriteFileError
Vista.WriteFileError
Vista.SetCookie
Vista.SetCookie
SetCookie%d
SetCookie%d
Vista.SetCookieError
Vista.SetCookieError
Error: %d. %s
Error: %d. %s
g:\winapps\Windows\MAIN\Installer.QuickStart.Application\ReleaseNoMFC\Installer.CookieMan.pdb
g:\winapps\Windows\MAIN\Installer.QuickStart.Application\ReleaseNoMFC\Installer.CookieMan.pdb
3 3%3,323
3 3%3,323
.ao &
.ao &
$.OA[W
$.OA[W
C_.jN
C_.jN
fs.MJ
fs.MJ
\%S6j
\%S6j
<.vmx>
<.vmx>
;.Ur?
;.Ur?
7:.Vmeu
7:.Vmeu
-N.sZ
-N.sZ
v.GEJh
v.GEJh
}N5%d
}N5%d
.nX9k
.nX9k
U;9%u
U;9%u
g 8%U
g 8%U
'/O.Axy
'/O.Axy
f7%X[
f7%X[
@: .pI^
@: .pI^
wajam_validate.exe
wajam_validate.exe
R2dmjg
R2dmjg
,i.BP
,i.BP
%%S~"
%%S~"
:.rHH
:.rHH
)[.Uo
)[.Uo
9I.tA
9I.tA
u%CO,X
u%CO,X
O5d%u
O5d%u
D.EQ,
D.EQ,
#i%.fE#
#i%.fE#
.ia;s
.ia;s
55997C50-1F00-4D74-BAEF-46A658272B17.zipu
55997C50-1F00-4D74-BAEF-46A658272B17.zipu
86DDC60B-D946-49DA-A0F7-AD1D99007CBB.zip
86DDC60B-D946-49DA-A0F7-AD1D99007CBB.zip
4594AF2F-4D07-4B39-B15B-443A87882878.zip
4594AF2F-4D07-4B39-B15B-443A87882878.zip
AFB3988D-640F-43BB-8422-D40ED6AA32BE.zipb
AFB3988D-640F-43BB-8422-D40ED6AA32BE.zipb
F80287B7-718C-4676-AC71-3F1AB04A60E1.zip
F80287B7-718C-4676-AC71-3F1AB04A60E1.zip
B7109C6A-73CA-4979-B038-5AE45CBE649F.zip*[
B7109C6A-73CA-4979-B038-5AE45CBE649F.zip*[
AD04DC3C-8B12-4879-83E3-523DF600D9DE.zip
AD04DC3C-8B12-4879-83E3-523DF600D9DE.zip
theanswerfinder.vi.zip-
theanswerfinder.vi.zip-
6P%CH
6P%CH
099AEF6E-E690-4A5C-85F8-481343649504.zip":
099AEF6E-E690-4A5C-85F8-481343649504.zip":
E92D7B47-33AD-4469-81D4-CB551DE8DDA8.zip
E92D7B47-33AD-4469-81D4-CB551DE8DDA8.zip
7E447291-0A05-4EB1-98E9-49ECF3C139D1.zip7
7E447291-0A05-4EB1-98E9-49ECF3C139D1.zip7
8388CA31-64D2-4B18-853D-6E8F73B33C4A.zipR
8388CA31-64D2-4B18-853D-6E8F73B33C4A.zipR
B2B00637-BC0D-48D8-B686-9F13DA5E04A1.zip
B2B00637-BC0D-48D8-B686-9F13DA5E04A1.zip
42FDD0AA-EAD7-45DD-8421-47492FCFF9DB.zip
42FDD0AA-EAD7-45DD-8421-47492FCFF9DB.zip
7BAB633E-6C2D-45CC-BFE3-A79142FDABBF.zipr
7BAB633E-6C2D-45CC-BFE3-A79142FDABBF.zipr
73EB1E3A-0BE4-4F19-8F38-6B2B93DB1927.zip2
73EB1E3A-0BE4-4F19-8F38-6B2B93DB1927.zip2
.adTF
.adTF
5C22ACAC-4D3A-4D89-9980-81FBB493E7B8.zip
5C22ACAC-4D3A-4D89-9980-81FBB493E7B8.zip
C4B20519-3B35-4A1C-BB5C-695D80D9C28D.zip
C4B20519-3B35-4A1C-BB5C-695D80D9C28D.zip
E9E56BE3-7EC7-450B-9C2E-BA9B0BCD6B05.zip
E9E56BE3-7EC7-450B-9C2E-BA9B0BCD6B05.zip
B88FF7FD-BE0E-44BC-97BC-D6943F9F8A86.zipfo
B88FF7FD-BE0E-44BC-97BC-D6943F9F8A86.zipfo
80A3CCD4-64BC-4AF8-853B-ABA075AE5218.zipUi
80A3CCD4-64BC-4AF8-853B-ABA075AE5218.zipUi
13D66679-5DC0-48AA-BB42-E7BD34CEBAE2.zip
13D66679-5DC0-48AA-BB42-E7BD34CEBAE2.zip
3AD49606-8E98-404B-8DB4-767574E46DBB.zip[
3AD49606-8E98-404B-8DB4-767574E46DBB.zip[
404D0823-2D00-44F7-AC98-92F79F87E4F2.zip
404D0823-2D00-44F7-AC98-92F79F87E4F2.zip
AF33782B-57D0-466B-831D-0CE47455F809.zip
AF33782B-57D0-466B-831D-0CE47455F809.zip
BDAAF9E7-1317-4A08-A774-4E8B122DA876.zip
BDAAF9E7-1317-4A08-A774-4E8B122DA876.zip
4FFA1EE1-2AD7-40C8-9643-B801D9DED1A0.zip]^L
4FFA1EE1-2AD7-40C8-9643-B801D9DED1A0.zip]^L
224505F1-4910-4879-A9AD-B70D1AE1A120.zip&
224505F1-4910-4879-A9AD-B70D1AE1A120.zip&
66DFABC3-9023-45A3-A5DE-FA8CAAEF0AAC.zip{0
66DFABC3-9023-45A3-A5DE-FA8CAAEF0AAC.zip{0
2E076E93-E171-4F73-A0D5-5BFDDE0E4783.zip
2E076E93-E171-4F73-A0D5-5BFDDE0E4783.zip
DF86C614-36F8-4BE3-A1A0-78E774802EE7.zipvh
DF86C614-36F8-4BE3-A1A0-78E774802EE7.zipvh
2704D408-C40A-4848-BC30-B5478423E8C9.zip
2704D408-C40A-4848-BC30-B5478423E8C9.zip
.Cfv &
.Cfv &
0393A455-8396-4E79-8339-7DAEDC83567B.zip
0393A455-8396-4E79-8339-7DAEDC83567B.zip
226383C9-5E0D-4ABD-8308-30F31DD040A6.zipm!>
226383C9-5E0D-4ABD-8308-30F31DD040A6.zipm!>
F5C1E3BE-C571-4295-82AB-9C78A7DFD0BA.zip
F5C1E3BE-C571-4295-82AB-9C78A7DFD0BA.zip
5FDCCE24-C6DF-4C42-BE3B-202FAD5BF071.zip
5FDCCE24-C6DF-4C42-BE3B-202FAD5BF071.zip
225E5BB2-B83F-478E-B774-62F53C2BCAD7.zip
225E5BB2-B83F-478E-B774-62F53C2BCAD7.zip
3927F92B-2CF0-4555-8A62-C42865E873C2.zipn
3927F92B-2CF0-4555-8A62-C42865E873C2.zipn
FC7B0DC7-475B-489A-970D-27D5F49C54FA.zipUm7
FC7B0DC7-475B-489A-970D-27D5F49C54FA.zipUm7
A93B8CBE-2E96-442C-A85F-49ED855FDB8B.zip
A93B8CBE-2E96-442C-A85F-49ED855FDB8B.zip
%f t7)_u
%f t7)_u
988E6415-56A2-4711-9270-F71450CD0B9B.zipD
988E6415-56A2-4711-9270-F71450CD0B9B.zipD
keyOm
keyOm
.dGAK
.dGAK
3u.rOY
3u.rOY
.Vt#'
.Vt#'
Tq.IuyX
Tq.IuyX
CxS%s
CxS%s
y,~ \6*%6s?
y,~ \6*%6s?
java_14552.txt
java_14552.txt
config.xmlPK
config.xmlPK
55997C50-1F00-4D74-BAEF-46A658272B17.zipPK
55997C50-1F00-4D74-BAEF-46A658272B17.zipPK
86DDC60B-D946-49DA-A0F7-AD1D99007CBB.zipPK
86DDC60B-D946-49DA-A0F7-AD1D99007CBB.zipPK
4594AF2F-4D07-4B39-B15B-443A87882878.zipPK
4594AF2F-4D07-4B39-B15B-443A87882878.zipPK
AFB3988D-640F-43BB-8422-D40ED6AA32BE.zipPK
AFB3988D-640F-43BB-8422-D40ED6AA32BE.zipPK
F80287B7-718C-4676-AC71-3F1AB04A60E1.zipPK
F80287B7-718C-4676-AC71-3F1AB04A60E1.zipPK
B7109C6A-73CA-4979-B038-5AE45CBE649F.zipPK
B7109C6A-73CA-4979-B038-5AE45CBE649F.zipPK
AD04DC3C-8B12-4879-83E3-523DF600D9DE.zipPK
AD04DC3C-8B12-4879-83E3-523DF600D9DE.zipPK
theanswerfinder.vi.zipPK
theanswerfinder.vi.zipPK
099AEF6E-E690-4A5C-85F8-481343649504.zipPK
099AEF6E-E690-4A5C-85F8-481343649504.zipPK
E92D7B47-33AD-4469-81D4-CB551DE8DDA8.zipPK
E92D7B47-33AD-4469-81D4-CB551DE8DDA8.zipPK
7E447291-0A05-4EB1-98E9-49ECF3C139D1.zipPK
7E447291-0A05-4EB1-98E9-49ECF3C139D1.zipPK
8388CA31-64D2-4B18-853D-6E8F73B33C4A.zipPK
8388CA31-64D2-4B18-853D-6E8F73B33C4A.zipPK
B2B00637-BC0D-48D8-B686-9F13DA5E04A1.zipPK
B2B00637-BC0D-48D8-B686-9F13DA5E04A1.zipPK
42FDD0AA-EAD7-45DD-8421-47492FCFF9DB.zipPK
42FDD0AA-EAD7-45DD-8421-47492FCFF9DB.zipPK
7BAB633E-6C2D-45CC-BFE3-A79142FDABBF.zipPK
7BAB633E-6C2D-45CC-BFE3-A79142FDABBF.zipPK
73EB1E3A-0BE4-4F19-8F38-6B2B93DB1927.zipPK
73EB1E3A-0BE4-4F19-8F38-6B2B93DB1927.zipPK
5C22ACAC-4D3A-4D89-9980-81FBB493E7B8.zipPK
5C22ACAC-4D3A-4D89-9980-81FBB493E7B8.zipPK
C4B20519-3B35-4A1C-BB5C-695D80D9C28D.zipPK
C4B20519-3B35-4A1C-BB5C-695D80D9C28D.zipPK
E9E56BE3-7EC7-450B-9C2E-BA9B0BCD6B05.zipPK
E9E56BE3-7EC7-450B-9C2E-BA9B0BCD6B05.zipPK
B88FF7FD-BE0E-44BC-97BC-D6943F9F8A86.zipPK
B88FF7FD-BE0E-44BC-97BC-D6943F9F8A86.zipPK
80A3CCD4-64BC-4AF8-853B-ABA075AE5218.zipPK
80A3CCD4-64BC-4AF8-853B-ABA075AE5218.zipPK
13D66679-5DC0-48AA-BB42-E7BD34CEBAE2.zipPK
13D66679-5DC0-48AA-BB42-E7BD34CEBAE2.zipPK
3AD49606-8E98-404B-8DB4-767574E46DBB.zipPK
3AD49606-8E98-404B-8DB4-767574E46DBB.zipPK
404D0823-2D00-44F7-AC98-92F79F87E4F2.zipPK
404D0823-2D00-44F7-AC98-92F79F87E4F2.zipPK
AF33782B-57D0-466B-831D-0CE47455F809.zipPK
AF33782B-57D0-466B-831D-0CE47455F809.zipPK
BDAAF9E7-1317-4A08-A774-4E8B122DA876.zipPK
BDAAF9E7-1317-4A08-A774-4E8B122DA876.zipPK
4FFA1EE1-2AD7-40C8-9643-B801D9DED1A0.zipPK
4FFA1EE1-2AD7-40C8-9643-B801D9DED1A0.zipPK
224505F1-4910-4879-A9AD-B70D1AE1A120.zipPK
224505F1-4910-4879-A9AD-B70D1AE1A120.zipPK
66DFABC3-9023-45A3-A5DE-FA8CAAEF0AAC.zipPK
66DFABC3-9023-45A3-A5DE-FA8CAAEF0AAC.zipPK
2E076E93-E171-4F73-A0D5-5BFDDE0E4783.zipPK
2E076E93-E171-4F73-A0D5-5BFDDE0E4783.zipPK
DF86C614-36F8-4BE3-A1A0-78E774802EE7.zipPK
DF86C614-36F8-4BE3-A1A0-78E774802EE7.zipPK
2704D408-C40A-4848-BC30-B5478423E8C9.zipPK
2704D408-C40A-4848-BC30-B5478423E8C9.zipPK
0393A455-8396-4E79-8339-7DAEDC83567B.zipPK
0393A455-8396-4E79-8339-7DAEDC83567B.zipPK
226383C9-5E0D-4ABD-8308-30F31DD040A6.zipPK
226383C9-5E0D-4ABD-8308-30F31DD040A6.zipPK
F5C1E3BE-C571-4295-82AB-9C78A7DFD0BA.zipPK
F5C1E3BE-C571-4295-82AB-9C78A7DFD0BA.zipPK
5FDCCE24-C6DF-4C42-BE3B-202FAD5BF071.zipPK
5FDCCE24-C6DF-4C42-BE3B-202FAD5BF071.zipPK
225E5BB2-B83F-478E-B774-62F53C2BCAD7.zipPK
225E5BB2-B83F-478E-B774-62F53C2BCAD7.zipPK
3927F92B-2CF0-4555-8A62-C42865E873C2.zipPK
3927F92B-2CF0-4555-8A62-C42865E873C2.zipPK
FC7B0DC7-475B-489A-970D-27D5F49C54FA.zipPK
FC7B0DC7-475B-489A-970D-27D5F49C54FA.zipPK
A93B8CBE-2E96-442C-A85F-49ED855FDB8B.zipPK
A93B8CBE-2E96-442C-A85F-49ED855FDB8B.zipPK
988E6415-56A2-4711-9270-F71450CD0B9B.zipPK
988E6415-56A2-4711-9270-F71450CD0B9B.zipPK
java_14552.txtPK
java_14552.txtPK
PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
Emscoree.dll
Emscoree.dll
- CRT not initialized
- CRT not initialized
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- floating point support not loaded
- floating point support not loaded
USER32.DLL
USER32.DLL
combase.dll
combase.dll
777705555443332
777705555443332
5555443332
5555443332
5555443332
5555443332
mscoree.dll
mscoree.dll
_T{hfiws| sijn^sftqawlbl^edro jnye{esdasf zahnj pimn{tpeer|nce|tx _cfojndnte^c^trioo]ns ]aqvoatitl|a`bol_ee ^ifnf ko_rhdoehrf `tfof bcloanstwiqneuxea lwciftvhl gtrhle^ sicn|sitgailel|adtpisoenq.u a dP]lye|a^sfet jdvizslalbyl{ee `axnhy{ jf|i{rneswuaml]lrss `awnkdy ^mmaukoe^ lsauwrhej wyboyu_ cadrhev pceoincnseycrtwelds ]troh utnhxek kiunhtleyrunieatq,f ea]njdy {rwemt{roym rt{heeh kinnnsat_aslbleaztsioounb.k
_T{hfiws| sijn^sftqawlbl^edro jnye{esdasf zahnj pimn{tpeer|nce|tx _cfojndnte^c^trioo]ns ]aqvoatitl|a`bol_ee ^ifnf ko_rhdoehrf `tfof bcloanstwiqneuxea lwciftvhl gtrhle^ sicn|sitgailel|adtpisoenq.u a dP]lye|a^sfet jdvizslalbyl{ee `axnhy{ jf|i{rneswuaml]lrss `awnkdy ^mmaukoe^ lsauwrhej wyboyu_ cadrhev pceoincnseycrtwelds ]troh utnhxek kiunhtleyrunieatq,f ea]njdy {rwemt{roym rt{heeh kinnnsat_aslbleaztsioounb.k
_Y{ofuw |msujs^tf qbweb ^ldoogjgye{ds aifnz hajsp ma{np ea|dcm|ixn_ifsjtdrta^t^orro ]tso] qcootmtp|l`eot_ee ^tfhfek _ihnoshtfa`lflfabtliaosnw qoenx atlhcifsv lcgormlp^ustce|ri.g iPel|edapssee qluoagd ]iyn| ^ufstijnvgz lyloyu{re `axdhm{ijn|i{sntsruamt]orrs `awckcyo^umnuto ^alnadw hrjewtbryy_ ctdhhev pienisctsaylrlwaltsi]ornh.u
_Y{ofuw |msujs^tf qbweb ^ldoogjgye{ds aifnz hajsp ma{np ea|dcm|ixn_ifsjtdrta^t^orro ]tso] qcootmtp|l`eot_ee ^tfhfek _ihnoshtfa`lflfabtliaosnw qoenx atlhcifsv lcgormlp^ustce|ri.g iPel|edapssee qluoagd ]iyn| ^ufstijnvgz lyloyu{re `axdhm{ijn|i{sntsruamt]orrs `awckcyo^umnuto ^alnadw hrjewtbryy_ ctdhhev pienisctsaylrlwaltsi]ornh.u
_T{hfiws| sijn^sftqawlbl^edro jrye{qsuaifrzehsj pImn{tpeer|nce|tx _Efxjpdlto^r^erro ]vse]rqsoitotn| `6o _oer^ fhfikg_hheorh.f `Pflfebalsaes wuqpedxaatlec fyvolugrr lc^osmcp|uitgeire |adnpds erqeutardy] yt|h^ef tijnvsztlallyl{aet`ixohn{.jTSfoprkr_ye!b
_T{hfiws| sijn^sftqawlbl^edro jrye{qsuaifrzehsj pImn{tpeer|nce|tx _Efxjpdlto^r^erro ]vse]rqsoitotn| `6o _oer^ fhfikg_hheorh.f `Pflfebalsaes wuqpedxaatlec fyvolugrr lc^osmcp|uitgeire |adnpds erqeutardy] yt|h^ef tijnvsztlallyl{aet`ixohn{.jTSfoprkr_ye!b
cPflvelagsrel ^dsics|aibgliee |adnpys efqiuraedw]ayl|l^sf tajnvdz lmlayk{ee `sxuhr{ej |y{onus uamr]er sc`ownknye^cmtueod^ ltaow htjhweb yi_nctdehrvnpeeti,c saynrdw lrse]trrhyu ntxhkek uihnlsytuailalqaftei]ojny.{
cPflvelagsrel ^dsics|aibgliee |adnpys efqiuraedw]ayl|l^sf tajnvdz lmlayk{ee `sxuhr{ej |y{onus uamr]er sc`ownknye^cmtueod^ ltaow htjhweb yi_nctdehrvnpeeti,c saynrdw lrse]trrhyu ntxhkek uihnlsytuailalqaftei]ojny.{
Ifnpskt_aelblqe_r{ fiws| sujn^afbqlweb ^tdoo jsyt{asratf.z hPjlpema{spee |ccl|oxs_ef jadltl^ ^ortoh]esr] qaoptptl|i`coa_tei^ofnfsk _ahnodh ft`rfyf balgaasiwnq.e
Ifnpskt_aelblqe_r{ fiws| sujn^afbqlweb ^tdoo jsyt{asratf.z hPjlpema{spee |ccl|oxs_ef jadltl^ ^ortoh]esr] qaoptptl|i`coa_tei^ofnfsk _ahnodh ft`rfyf balgaasiwnq.e
1.0.73.0
1.0.73.0
safeinstall.exe
safeinstall.exe
%original file name%.exe_376_rwx_00ED0000_00002000:
The procedure %s could not be located in the DLL %s.
The procedure %s could not be located in the DLL %s.
The ordinal %d could not be located in the DLL %s.
The ordinal %d could not be located in the DLL %s.
%original file name%.exe_376_rwx_10001000_00082000:
SSSSh
SSSSh
tcPW
tcPW
QSSSSSSh
QSSSSSSh
t%SWh
t%SWh
1.3.6.1.4.1.311.10.3.5
1.3.6.1.4.1.311.10.3.5
1.3.6.1.4.1.311.10.3.6
1.3.6.1.4.1.311.10.3.6
1.3.6.1.5.5.7.3.3
1.3.6.1.5.5.7.3.3
2.5.4.6
2.5.4.6
2.5.4.8
2.5.4.8
2.5.4.7
2.5.4.7
2.5.4.10
2.5.4.10
2.5.4.11
2.5.4.11
2.5.4.3
2.5.4.3
WINTRUST.dll
WINTRUST.dll
CRYPT32.dll
CRYPT32.dll
{X-X-X-XX-XXXXXX}
{X-X-X-XX-XXXXXX}
operator
operator
GetProcessWindowStation
GetProcessWindowStation
SCC_CheckCriteria_Web
SCC_CheckCriteria_Web
RegOpenKeyTransactedW
RegOpenKeyTransactedW
RegCreateKeyTransactedW
RegCreateKeyTransactedW
RegDeleteKeyTransactedW
RegDeleteKeyTransactedW
RegDeleteKeyExW
RegDeleteKeyExW
2.1.0.20
2.1.0.20
CryptCATCatalogInfoFromContext
CryptCATCatalogInfoFromContext
CryptMsgClose
CryptMsgClose
CertCloseStore
CertCloseStore
CertFreeCertificateContext
CertFreeCertificateContext
CertFindCertificateInStore
CertFindCertificateInStore
CryptMsgGetParam
CryptMsgGetParam
CertGetEnhancedKeyUsage
CertGetEnhancedKeyUsage
CertNameToStrW
CertNameToStrW
CertGetNameStringW
CertGetNameStringW
URLOpenStreamW
URLOpenStreamW
urlmon.dll
urlmon.dll
DeleteUrlCacheEntryW
DeleteUrlCacheEntryW
HttpOpenRequestW
HttpOpenRequestW
HttpAddRequestHeadersW
HttpAddRequestHeadersW
HttpSendRequestW
HttpSendRequestW
WININET.dll
WININET.dll
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
RegCloseKey
RegCloseKey
RegOpenKeyExW
RegOpenKeyExW
RegDeleteKeyW
RegDeleteKeyW
RegCreateKeyExW
RegCreateKeyExW
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteExW
ShellExecuteExW
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
SHLWAPI.dll
SHLWAPI.dll
USERENV.dll
USERENV.dll
GetProcessHeap
GetProcessHeap
GetWindowsDirectoryW
GetWindowsDirectoryW
GetCPInfo
GetCPInfo
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjectsEx
RegEnumKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegQueryInfoKeyW
OLEAUT32.dll
OLEAUT32.dll
SHDeleteKeyW
SHDeleteKeyW
SHDeleteEmptyKeyW
SHDeleteEmptyKeyW
SYMCCIS.dll
SYMCCIS.dll
zcÃ
zcÃ
c:\%original file name%.exe
c:\%original file name%.exe
0xX
0xX
..\Source\ccVerifyTrustStatic.cpp
..\Source\ccVerifyTrustStatic.cpp
%SymEFA%
%SymEFA%
EFACli.dll
EFACli.dll
CLSID\%s\LocalServer32
CLSID\%s\LocalServer32
CLSID\%s\InprocServer32
CLSID\%s\InprocServer32
NTDLL.DLL
NTDLL.DLL
..\Source\ccVerifyTrustImpl.cpp
..\Source\ccVerifyTrustImpl.cpp
..\Source\FileCache.cpp
..\Source\FileCache.cpp
g..\Source\VerifyFile.cpp
g..\Source\VerifyFile.cpp
..\Source\ccVerifyTrustPolicy.cpp
..\Source\ccVerifyTrustPolicy.cpp
..\Source\CatalogIterator.cpp
..\Source\CatalogIterator.cpp
..\Source\CatalogFileHash.cpp
..\Source\CatalogFileHash.cpp
WinTrust.dll
WinTrust.dll
..\Source\CatalogContext.cpp
..\Source\CatalogContext.cpp
..\Source\ccSymModuleLifetimeMgrImpl.cpp
..\Source\ccSymModuleLifetimeMgrImpl.cpp
%s, %s, %s, %s(%ld)
%s, %s, %s, %s(%ld)
..\Source\ccModule.cpp
..\Source\ccModule.cpp
..\Source\ccSystemInfo.cpp
..\Source\ccSystemInfo.cpp
..\Source\ccRegistry.cpp
..\Source\ccRegistry.cpp
..\Source\ccStringConvert.cpp
..\Source\ccStringConvert.cpp
CSIDL_WINDOWS
CSIDL_WINDOWS
SOFTWARE\Microsoft\Windows\CurrentVersion
SOFTWARE\Microsoft\Windows\CurrentVersion
..\Source\ccPathExpansion.cpp
..\Source\ccPathExpansion.cpp
\\?\UNC
\\?\UNC
..\Source\ccSplitPath.cpp
..\Source\ccSplitPath.cpp
..\Source\ccOSInfo.cpp
..\Source\ccOSInfo.cpp
\wpeutil.dll
\wpeutil.dll
\FACTORY.exe
\FACTORY.exe
\wpeinit.exe
\wpeinit.exe
..\Source\ccMemory.cpp
..\Source\ccMemory.cpp
..\Source\ccFile.cpp
..\Source\ccFile.cpp
..\Source\ccWow64FsRedirection.cpp
..\Source\ccWow64FsRedirection.cpp
%s\%s
%s\%s
CIsolation::GetRegistryHive(): RegOpenKeyEx() returned ERROR_FILE_NOT_FOUND
CIsolation::GetRegistryHive(): RegOpenKeyEx() returned ERROR_FILE_NOT_FOUND
CIsolation::GetRegistryHive(): RegOpenKeyEx() returned ERROR_ACCESS_DENIED
CIsolation::GetRegistryHive(): RegOpenKeyEx() returned ERROR_ACCESS_DENIED
isolate.ini
isolate.ini
%COMMON_SILO_DATA%
%COMMON_SILO_DATA%
..\Source\ccEncryptedString.cpp
..\Source\ccEncryptedString.cpp
..\Source\ccSynchronize.cpp
..\Source\ccSynchronize.cpp
..\Source\ccSymDllLifetimeMgr.cpp
..\Source\ccSymDllLifetimeMgr.cpp
kernel32.dll
kernel32.dll
KERNEL32.DLL
KERNEL32.DLL
PSAPI.DLL
PSAPI.DLL
..\Source\ccPEBReader.cpp
..\Source\ccPEBReader.cpp
..\Source\ccPrivilege.cpp
..\Source\ccPrivilege.cpp
..\Source\ccSymIndexValueCollectionImpl.cpp
..\Source\ccSymIndexValueCollectionImpl.cpp
AWTSAPI32.DLL
AWTSAPI32.DLL
..\Source\ccSymDllLifetimeMgrLocal.cpp
..\Source\ccSymDllLifetimeMgrLocal.cpp
..\Source\ccSymIndexValueCollection.cpp
..\Source\ccSymIndexValueCollection.cpp
..\Source\ccSymValueCollection.cpp
..\Source\ccSymValueCollection.cpp
ÃŒROOT%
ÃŒROOT%
rcPFRes.dll
rcPFRes.dll
rcPxyEvt.dll
rcPxyEvt.dll
rcProxy.dll
rcProxy.dll
rcSvcHst.dll
rcSvcHst.dll
rcEmlPxy.dll
rcEmlPxy.dll
rcLgView.dll
rcLgView.dll
rcErrDsp.dll
rcErrDsp.dll
rcAlert.dll
rcAlert.dll
rcApp.dll
rcApp.dll
ccEmlPxy.dll
ccEmlPxy.dll
ccGLog.dll
ccGLog.dll
ccJobMgr.dll
ccJobMgr.dll
ccGEvt.dll
ccGEvt.dll
ccIPC.dll
ccIPC.dll
ccRkSn.dll
ccRkSn.dll
PFPriv.dll
PFPriv.dll
ccPxyIns.dll
ccPxyIns.dll
ccPxyEvt.dll
ccPxyEvt.dll
ccInst64.dll
ccInst64.dll
ccEvtCli.dll
ccEvtCli.dll
ccTrstPc.dll
ccTrstPc.dll
ccSvc.dll
ccSvc.dll
ccEraser.dll
ccEraser.dll
OEHeur.dll
OEHeur.dll
ccCharCv.dll
ccCharCv.dll
ccInst.dll
ccInst.dll
DefUtDCD.dll
DefUtDCD.dll
ccScanw.dll
ccScanw.dll
ccScan.dll
ccScan.dll
dec_abi.dll
dec_abi.dll
ccDec.dll
ccDec.dll
ccALEng.dll
ccALEng.dll
ccErrDsp.dll
ccErrDsp.dll
ccProSub.dll
ccProSub.dll
ccVrTrst.dll
ccVrTrst.dll
ccSetEvt.dll
ccSetEvt.dll
ccSet.dll
ccSet.dll
ccAlert.dll
ccAlert.dll
..\Source\ccArchive.cpp
..\Source\ccArchive.cpp
..\Source\ccDummyArchive.cpp
..\Source\ccDummyArchive.cpp
..\Source\ccInstanceFactory.cpp
..\Source\ccInstanceFactory.cpp
..\Source\ccSymValueCollectionConvert.cpp
..\Source\ccSymValueCollectionConvert.cpp
..\Source\ccSymStreamArchive.cpp
..\Source\ccSymStreamArchive.cpp
Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders
Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
ÃŒROOT%\
ÃŒROOT%\
ÃŒDATA%\
ÃŒDATA%\
..\Source\ccSymInstalledApps.cpp
..\Source\ccSymInstalledApps.cpp
..\Source\ccSymDigest.cpp
..\Source\ccSymDigest.cpp
..\Source\ccSymKeyValueCollectionImpl.cpp
..\Source\ccSymKeyValueCollectionImpl.cpp
..\Source\ccSymMemoryImpl.cpp
..\Source\ccSymMemoryImpl.cpp
Archive.Write(CMemoryImpl::CSerializeImpl::Version) == FALSE
Archive.Write(CMemoryImpl::CSerializeImpl::Version) == FALSE
Archive.Read(nVersion) == FALSE
Archive.Read(nVersion) == FALSE
..\Source\ccSymStringImpl.cpp
..\Source\ccSymStringImpl.cpp
Archive.Write(CStringImpl::Version) == FALSE
Archive.Write(CStringImpl::Version) == FALSE
..\Source\ccSymInstanceFactoryImpl.cpp
..\Source\ccSymInstanceFactoryImpl.cpp
t..\Source\ccMessageLock.cpp
t..\Source\ccMessageLock.cpp
..\Source\ccSymKeyValueCollection.cpp
..\Source\ccSymKeyValueCollection.cpp
..\Source\ccSymPersist.cpp
..\Source\ccSymPersist.cpp
ÃŒROOT%\ccSet.dll
ÃŒROOT%\ccSet.dll
..\Source\ccSymObjectRepository.cpp
..\Source\ccSymObjectRepository.cpp
CommonClient\OBJID\%s
CommonClient\OBJID\%s
..\Source\ccMemoryArchive.cpp
..\Source\ccMemoryArchive.cpp
..\Source\ccSymMemoryStreamImpl.cpp
..\Source\ccSymMemoryStreamImpl.cpp
mscoree.dll
mscoree.dll
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
WUSER32.DLL
WUSER32.DLL
FileDownloader::callURLOpenStream
FileDownloader::callURLOpenStream
CHttpRequest::CHttpRequest
CHttpRequest::CHttpRequest
CHttpRequest::~CHttpRequest
CHttpRequest::~CHttpRequest
CHttpRequest::RequestPage
CHttpRequest::RequestPage
CHttpRequest::ParseURLW
CHttpRequest::ParseURLW
https
https
[s d, d - d:d:d:d]
[s d, d - d:d:d:d]
%s %ld
%s %ld
%s %s
%s %s
%s 0x%x
%s 0x%x
hXXp://cps.qalabs.symantec.com/teams/isp/symccis
hXXp://cps.qalabs.symantec.com/teams/isp/symccis
hXXp://liveupdate.symantecliveupdate.com/upgrade/NSS/SymCCIS/Staging
hXXp://liveupdate.symantecliveupdate.com/upgrade/NSS/SymCCIS/Staging
hXXp://liveupdate.symantecliveupdate.com/upgrade/NSS/SymCCIS/Production
hXXp://liveupdate.symantecliveupdate.com/upgrade/NSS/SymCCIS/Production
SymCCIS.dll
SymCCIS.dll
SCC.dll
SCC.dll
OfferUI.dll
OfferUI.dll
SymInstallStub.exe
SymInstallStub.exe
SymCCISDll.txt
SymCCISDll.txt
Total CheckCriteria execution time in seconds =
Total CheckCriteria execution time in seconds =
NortonOfferEngineImpl::CheckCriteria_Web
NortonOfferEngineImpl::CheckCriteria_Web
downloadStubInstallerExe() failed, HR =
downloadStubInstallerExe() failed, HR =
Failed to delete downloaded SCC.dll, GetLastError =
Failed to delete downloaded SCC.dll, GetLastError =
Failed to delete existing SCC.dll, GetLastError =
Failed to delete existing SCC.dll, GetLastError =
NortonOfferEngineImpl::downloadStubInstallerExe
NortonOfferEngineImpl::downloadStubInstallerExe
Failed to delete existing SymInstallStub.exe, GetLastError =
Failed to delete existing SymInstallStub.exe, GetLastError =
NortonOfferEngineImpl::buildComponentDownloadURL
NortonOfferEngineImpl::buildComponentDownloadURL
NortonOfferEngineImpl::getTestEnvironmentRootURL
NortonOfferEngineImpl::getTestEnvironmentRootURL
NortonOfferEngineImpl::getISExeDestPath
NortonOfferEngineImpl::getISExeDestPath
getISExeDestPath() returned =
getISExeDestPath() returned =
NortonOfferEngineImpl::sendPingForCheckCriteriaWeb
NortonOfferEngineImpl::sendPingForCheckCriteriaWeb
NortonOfferEngineImpl::getCheckCriteriaPingDataWeb
NortonOfferEngineImpl::getCheckCriteriaPingDataWeb
NortonOfferEngineImpl::getStubInstallerCmdLine
NortonOfferEngineImpl::getStubInstallerCmdLine
getStubInstallerCmdLine() returned =
getStubInstallerCmdLine() returned =
NortonOfferEngineImpl::deleteDeclineCountRegKeyForThisProduct
NortonOfferEngineImpl::deleteDeclineCountRegKeyForThisProduct
NortonOfferEngineImpl::deleteDeclineCountParentKeyIfNoMoreProductsExist
NortonOfferEngineImpl::deleteDeclineCountParentKeyIfNoMoreProductsExist
Deleting DeclineCount subkey for partner =
Deleting DeclineCount subkey for partner =
Failed to create/open DECLINE_COUNT_REG_KEY
Failed to create/open DECLINE_COUNT_REG_KEY
Advapi32.dll
Advapi32.dll
hXXp://stats.norton.com/n/p?
hXXp://stats.norton.com/n/p?
PingData::SendCheckCriteriaWebPing
PingData::SendCheckCriteriaWebPing
PingData::createBaseURL
PingData::createBaseURL
PingData::getCheckCriteriaPingURL
PingData::getCheckCriteriaPingURL
PingData::getCheckCriteriaWebPingURL
PingData::getCheckCriteriaWebPingURL
PingData::getInstallProductsPingURL
PingData::getInstallProductsPingURL
PingData::getOfferAcceptancePingURL
PingData::getOfferAcceptancePingURL
pingURL =
pingURL =
X.X
X.X
%u.%u.%u.%u.%u
%u.%u.%u.%u.%u
Utility::LaunchProcessWithShellExecute
Utility::LaunchProcessWithShellExecute
ShellExecuteEx failed, GetLastError =
ShellExecuteEx failed, GetLastError =
---8#-8-@
---8#-8-@
%original file name%.exe_376_rwx_10084000_00002000:
NRTN_OfferEngine_CheckCriteria_Web
NRTN_OfferEngine_CheckCriteria_Web
kernel32.dll
kernel32.dll
urlmon.dll
urlmon.dll
URLOpenStreamW
URLOpenStreamW
WININET.dll
WININET.dll
USER32.dll
USER32.dll
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjectsEx
ADVAPI32.dll
ADVAPI32.dll
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
SHLWAPI.dll
SHLWAPI.dll
USERENV.dll
USERENV.dll
OLEAUT32.dll
OLEAUT32.dll
2.1.0.20
2.1.0.20