Dropped.Application.Adware.POV_c8a237f42e – Adaware

Dropped:Application.Adware.POV (AdAware), mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Adware

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: c8a237f42e8ab619dfef75bbc3ce6745

SHA1: bcfe2e7476fb65efe97c2fc7641780c3d3b7c36f

SHA256: b86e08e2f261e1bfdc5aa4dbc5eaa2bc4a3b2a9b2860b8c526431aeb5ef6bece

SSDeep: 6144:nFJ0DmdS0pnutlR9GcEbh6MIpi1fdN2xGSIxsOaFBRV7vNplABn30XGmpkxNw9a:emsPtlRsrNCAdNyEsOaFHVBplANpmmxp

Size: 391552 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: http://buttonguide.co.kr

Created at: 2009-06-07 00:43:17

Analyzed on: WindowsXP SP3 32-bit

Summary: Adware. Delivers advertising content in a manner or context that may be unexpected and unwanted by users. Many adware applications also perform tracking functions. Users may want to remove adware if they object to such tracking, do not wish to see the advertising caused by the program or are frustrated by its effects on system performance.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Dropped creates the following process(es):

ButtonGuideAgent.exe:776
ButtonGuideC.exe:368
dwwin.exe:584
schtasks.exe:1596
%original file name%.exe:256
841031.exe:1900

The Dropped injects its code into the following process(es):

ButtonGuide.exe:604

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process ButtonGuideAgent.exe:776 makes changes in the file system.

The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\update[1].xml (187 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\a981_appcompat.txt (4512 bytes)

The process ButtonGuideC.exe:368 makes changes in the file system.

The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\841031.exe (141855 bytes)
%Program Files%\buttonguide\Update.dat (800 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\buttonguide_silent[1].exe (411565 bytes)

The process dwwin.exe:584 makes changes in the file system.

The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DABC1.dmp (125277 bytes)

The process %original file name%.exe:256 makes changes in the file system.

The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsw2.tmp\version.dll (6 bytes)
%Program Files%\buttonguide\Uninstall.exe (2162 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\license1.txt (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw2.tmp\KillProcDLL.dll (327 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw2.tmp\System.dll (11 bytes)
%Program Files%\buttonguide\ButtonGuideC.exe (18394 bytes)

The Dropped deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsw2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw2.tmp\KillProcDLL.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw2.tmp\version.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw2.tmp\System.dll (0 bytes)

The process 841031.exe:1900 makes changes in the file system.

The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nss4.tmp\SelfDelete.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss4.tmp\nsExec.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss4.tmp\DLLWebCount.dll (28 bytes)
%Program Files%\buttonguide\ButtonGuideAgent.exe (77653 bytes)
%Program Files%\buttonguide\button.dll (25601 bytes)
%Program Files%\buttonguide\uninst.exe (2396 bytes)
%Program Files%\buttonguide\ButtonGuide.exe (79332 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss4.tmp\DLLWaitForKillProgram.dll (28 bytes)
C:\DelUS.bat (140 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss4.tmp\ns5.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss4.tmp\GetVersion.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss4.tmp\KillProcDLL.dll (2390 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss4.tmp (4 bytes)

The Dropped deletes the following file(s):

%Program Files%\buttonguide\Update.dat (0 bytes)
%Program Files%\buttonguide\Uninstall.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss4.tmp\nsExec.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss4.tmp\DLLWebCount.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss4.tmp\SelfDelete.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss4.tmp\DLLWaitForKillProgram.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss4.tmp\ns5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc3.tmp (0 bytes)
%Program Files%\buttonguide\ButtonGuideC.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss4.tmp\GetVersion.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss4.tmp\KillProcDLL.dll (0 bytes)

Registry activity

The process ButtonGuide.exe:604 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "80 4D 23 1B 85 80 C8 3A 37 85 5C 5C 3C 05 9D AA"

[HKCU\Software\ButtonGuide\advert]
"today" = "20150311"

[HKCU\Software\Microsoft\Internet Explorer\MINIE]
"ShowTabsBelowAddressBar" = "0"

[HKCU\Software\ButtonGuide\advert]
"Count" = "0"

The process ButtonGuideAgent.exe:776 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\ButtonGuide]
"ButtonGuide.exe" = "Advert Application Tools"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1F 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4F 3E 06 B9 21 47 A6 2F A1 0C 15 E0 82 73 6F 1E"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Dropped deletes the following registry key(s):

[HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW]

The Dropped deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

[HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW]
"DWFileTreeRoot"

The process ButtonGuideC.exe:368 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"841031.exe" = "841031"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "82 41 77 41 91 D5 67 9C B7 F0 ED 01 58 20 60 10"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Dropped deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process dwwin.exe:584 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F4 EF 0B D5 79 CF FC 4C 47 6C 95 A2 A1 4A 3F 39"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 20 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Dropped deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process schtasks.exe:1596 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C6 00 2E 57 27 AF A1 05 07 2B 41 DE D0 34 E3 8D"

The process %original file name%.exe:256 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "21 C1 A6 8B C6 8C DD 8E FB FF F0 CA 27 13 2E 69"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Ãƒâ€šÃ‚Â¹ÃƒÆ’Ã‚Â¶ÃƒÆ’Ã¢â‚¬Â Ãƒâ€šÃ‚Â°Ãƒâ€šÃ‚Â°Ãƒâ€šÃ‚Â¡ÃƒÆ’Ã¢â€šÂ¬ÃƒÆ’Ã…â€™Ãƒâ€šÃ‚ÂµÃƒÆ’Ã‚Â¥(ButtonGuide)]
"InstallLocation" = "%Program Files%\buttonguide"
"DisplayVersion" = "1.0.0.1"
"Publisher" = "TGSM"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Ãƒâ€šÃ‚Â¹ÃƒÆ’Ã‚Â¶ÃƒÆ’Ã¢â‚¬Â Ãƒâ€šÃ‚Â°Ãƒâ€šÃ‚Â°Ãƒâ€šÃ‚Â¡ÃƒÆ’Ã¢â€šÂ¬ÃƒÆ’Ã…â€™Ãƒâ€šÃ‚ÂµÃƒÆ’Ã‚Â¥(ButtonGuide)]
"URLInfoAbout" = "http://buttonguide.co.kr"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Ãƒâ€šÃ‚Â¹ÃƒÆ’Ã‚Â¶ÃƒÆ’Ã¢â‚¬Â Ãƒâ€šÃ‚Â°Ãƒâ€šÃ‚Â°Ãƒâ€šÃ‚Â¡ÃƒÆ’Ã¢â€šÂ¬ÃƒÆ’Ã…â€™Ãƒâ€šÃ‚ÂµÃƒÆ’Ã‚Â¥(ButtonGuide)]
"DisplayIcon" = "%Program Files%\buttonguide\ButtonGuideC.exe"
"DisplayName" = "Ãƒâ€šÃ‚Â¹ÃƒÆ’Ã‚Â¶ÃƒÆ’Ã¢â‚¬Â Ãƒâ€šÃ‚Â°Ãƒâ€šÃ‚Â°Ãƒâ€šÃ‚Â¡ÃƒÆ’Ã¢â€šÂ¬ÃƒÆ’Ã…â€™Ãƒâ€šÃ‚ÂµÃƒÆ’Ã‚Â¥(ButtonGuide)"
"UninstallString" = "%Program Files%\buttonguide\Uninstall.exe"

To automatically run itself each time Windows is booted, the Dropped adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"ButtonGuide" = "%Program Files%\buttonguide\ButtonGuideC.exe /RUN"

The process 841031.exe:1900 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKCU\Software\ButtonGuide]
"dir" = "%Program Files%\ButtonGuide"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ButtonGuide]
"UninstallString" = "%Program Files%\ButtonGuide\uninst.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ButtonGuide]
"DisplayVersion" = "8"
"URLUpdateInfo" = "http://www.buttonguide.co.kr"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\ButtonGuide\update]
"ver" = "8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ButtonGuide]
"DisplayIcon" = "%Program Files%\ButtonGuide\uninst.exe"
"Comments" = "ButtonGuide"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ButtonGuide]
"Publisher" = "Maroin"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "89 50 D0 E8 01 23 8D 56 FC AB 5C 64 50 20 A7 3E"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ButtonGuide]
"HelpLink" = "http://www.buttonguide.co.kr"
"URLInfoAbout" = "http://www.buttonguide.co.kr"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ButtonGuide]
"DisplayName" = "Windows ButtonGuide"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Dropped adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"ButtonGuide" = "%Program Files%\ButtonGuide\ButtonGuideAgent.exe"

The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Dropped deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Ãƒâ€šÃ‚Â¹ÃƒÆ’Ã‚Â¶ÃƒÆ’Ã¢â‚¬Â Ãƒâ€šÃ‚Â°Ãƒâ€šÃ‚Â°Ãƒâ€šÃ‚Â¡ÃƒÆ’Ã¢â€šÂ¬ÃƒÆ’Ã…â€™Ãƒâ€šÃ‚ÂµÃƒÆ’Ã‚Â¥(ButtonGuide)]

The Dropped deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The Dropped disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"buttonguide"

Dropped PE files

MD5	File path
0975a6ecc83d15d4b644568e7043728e	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\buttonguide_silent[1].exe
ba7dfec7bc0ea80f2b8aef9024e21e4d	c:\Program Files\buttonguide\ButtonGuide.exe
9ff65774f17f0b95f64fc4aadf56afc7	c:\Program Files\buttonguide\ButtonGuideAgent.exe
3f3fdbc2f991f18a3ca271e3a01603cc	c:\Program Files\buttonguide\button.dll
007b976f23e19f8b45282911d718c02e	c:\Program Files\buttonguide\uninst.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
ButtonGuideAgent.exe:776
ButtonGuideC.exe:368
dwwin.exe:584
schtasks.exe:1596
%original file name%.exe:256
841031.exe:1900
Delete the original Dropped file.
Delete or disinfect the following files created/modified by the Dropped:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\update[1].xml (187 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\a981_appcompat.txt (4512 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\841031.exe (141855 bytes)
%Program Files%\buttonguide\Update.dat (800 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\buttonguide_silent[1].exe (411565 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DABC1.dmp (125277 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw2.tmp\version.dll (6 bytes)
%Program Files%\buttonguide\Uninstall.exe (2162 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\license1.txt (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw2.tmp\KillProcDLL.dll (327 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw2.tmp\System.dll (11 bytes)
%Program Files%\buttonguide\ButtonGuideC.exe (18394 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss4.tmp\SelfDelete.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss4.tmp\nsExec.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss4.tmp\DLLWebCount.dll (28 bytes)
%Program Files%\buttonguide\ButtonGuideAgent.exe (77653 bytes)
%Program Files%\buttonguide\button.dll (25601 bytes)
%Program Files%\buttonguide\uninst.exe (2396 bytes)
%Program Files%\buttonguide\ButtonGuide.exe (79332 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss4.tmp\DLLWaitForKillProgram.dll (28 bytes)
C:\DelUS.bat (140 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss4.tmp\ns5.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss4.tmp\GetVersion.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss4.tmp\KillProcDLL.dll (2390 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"ButtonGuide" = "%Program Files%\buttonguide\ButtonGuideC.exe /RUN"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"ButtonGuide" = "%Program Files%\ButtonGuide\ButtonGuideAgent.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: http://buttonguide.co.kr
Product Name: ?????(ButtonGuide)
Product Version: 1.0.0.1
Legal Copyright: ?????(ButtonGuide)
Legal Trademarks: ?????(ButtonGuide)
Original Filename:
Internal Name:
File Version: 1.0.0.1
File Description: ?????(ButtonGuide)
Comments: ?????(ButtonGuide)
Language: Language Neutral

Company Name: http://buttonguide.co.krProduct Name: ?????(ButtonGuide)Product Version: 1.0.0.1Legal Copyright: ?????(ButtonGuide)Legal Trademarks: ?????(ButtonGuide)Original Filename: Internal Name: File Version: 1.0.0.1File Description: ?????(ButtonGuide)Comments: ?????(ButtonGuide)Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	23628	24064	4.46304	c52a72deb0170941d392ec38c6aeafd0
.rdata	28672	4764	5120	3.4982	dc77f8a1e6985a4361c55642680ddb4f
.data	36864	298072	1024	3.32453	723ad80df002dc5421798f4307abe5cf
.ndata	335872	311296	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	647168	17336	17408	4.14031	adb122250ccee687c2f1cdb278bd1dd4

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://buttonguide.co.kr/opapp/btguide/Update.dat
hxxp://buttonguide.co.kr/opapp/btguide/app/download/buttonguide_silent.exe
hxxp://buttonguide.co.kr/mmsv/Access3.php
hxxp://buttonguide.co.kr/mmsv/Access3.php?MyMode=i&MyPartner=btguide&MyValue=00-0C-29-FD-55-AD
hxxp://buttonguide.co.kr/opapp/btguide/app/update/update.xml
hxxp://ad.syndiapi.com/v4/TagCnt_xe2.asp	183.110.214.114
hxxp://openkeyword.co.kr/mmsv/Access3.php	115.71.1.209
hxxp://openkeyword.co.kr/mmsv/Access3.php?MyMode=i&MyPartner=btguide&MyValue=00-0C-29-FD-55-AD	115.71.1.209
hxxp://sub.buttonguide.co.kr/opapp/btguide/Update.dat	115.71.1.211
hxxp://sub.buttonguide.co.kr/opapp/btguide/app/download/buttonguide_silent.exe	115.71.1.211
hxxp://sub.buttonguide.co.kr/opapp/btguide/app/update/update.xml	115.71.1.211

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST /opapp/btguide/Update.dat HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)

Host: sub.buttonguide.co.kr

Content-Length: 12

Connection: Keep-Alive

Cache-Control: no-cache

precondition

HTTP/1.1 200 OK

Date: Wed, 11 Mar 2015 20:43:24 GMT

Server: Apache/2.2.3 (CentOS)

Last-Modified: Tue, 14 May 2013 10:04:29 GMT

ETag: "174086d-618-4dcaac249a540"

Accept-Ranges: bytes

Content-Length: 1560

Connection: close

Content-Type: text/plain; charset=EUC-KR

....:...2.'d.u...:. .&|..@..K...k.'e}.;;..$e>..S...G#qa.6....W.^..3/F:...^=......_j9O?T.&...\n.Up..!E.[.......H..w.)..1..t,l.;..W*>!m...cexp7jS ...L.v..(.zz.... p.3.....j2.L...]......e.bA...D3...........A..V........d4K..}.....P..(...N..........h..P.B.i...y.(.[..$.FA.Q.N..c...........e...c..........b.t0..}-.-..X,.P.M.L..51IQ..u.._.8Z2...."pJ....j;.M.N....r}x..Yr..Q_(....G.F.aa...U...Su9... ..x...}* ....y.z..x...}*N....%.m....?N...D.....b.5..X...uR.}w.6.._.F....Ly./... ..%...,}2x..J....N.......w.....bV-.k.._.c..........'.t.P#))5.....\..'.sC.......F.B..p..p......c...=..D......]5"....'.t.P.y}................_....-.s d9?v...B...8-.s d9?v...\....d.. .d..yg..*#P.........yg..*#P.g'....& ...6...u..d..E_....6...u....D;.%"e...TA..;......"e...TA..r.I.i..!...{......|..m..9^.... ...|..m..u.1.... =.(..o.....>......C..t6I*.....8f.....i.1........0)/.Z...R.........#w].....:#~..... .d..c.p.....?.......b..]. ....#.Q...*r.;A..P.nl}...\.7...M.."twl...q\;._Z..1...q.}r".........|e..=_.......{...,E..'.A...J...c........K*z.Tn.#))5.......K.>...<^&.&.;...K.>..":..G...e...&9?.sx.PaQ..b....v..........x..............o.C..B.....t.4...iS..T.......z....N.... 3....H....N.... 3..F.`..D.5..X...*..f....B.IY.......34.O%....1..N.U."...."twl...q....nSY.....].....,E..'......\...<^&.&.;^..v....l..)..,Z@~e....,./;$.c....1....s.z.hxOFF...N.p...........r...jr...J#....iV5.;L........`.)t<>,J....1.....`.c=TN.#H]".X$.<....b..7.4.%..........|3.4.%......t.....-.s d9?v........-.s d9?v..G.X.A.d.. .d....#9.5............#9.5..g'....& ..

<<< skipped >>>

GET /v4/TagCnt_xe2.asp HTTP/1.1

Cache-control: no-cache

Host: ad.syndiapi.com

Accept: text/html, */*

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 3362

Content-Type: text/html

Server: Microsoft-IIS/7.5

Date: Wed, 11 Mar 2015 20:44:23 GMT

Connection: close

[ConnectInfo]..ConnectTimeoutDefault=3000..ReadTimeoutDefault=3000..SaveKeyword_Length=100..SaverQuery_Length=35..MaxPriCnt=6..ShowTabsOp=0..RecycleDay=7..RecoveryType=0..ReturnRCValue=RCB..[TimeRetargeting]..TH_ONOFF=False..TH_SaveKeyword_Length=240..TH_TIME=3 ..TH_RetagetTime=3....[BlockDomain]..BlockDomain=cl.ncclick.co.kr,tab.windowboanpatch.com,search.dreamwiz.com,cl.smart-manager.co.kr,esero.go.kr,endic.naver.com,clk.cuberab.com,keyword.daumdn.com,gall.dcinside.com,www3.adnclick.com,gom.gomtv.com,media.daum.net,taxsave.go.kr,shopping.daum.net,script.theprimead.co.kr,VVV.amazon.cn,VVV.inven.co.kr,xiyou.cntv.cn,start.bricksbox.com,cpa.gaia.com,VVV.zfile.co.kr,tab.file-down.co.kr,VVV.lustful.tv,lustful.tv,tab.howcodec.co.kr,rd.koreankeyword.com,item2.gmarket.co.kr,VVV.topclick.kr,so.v.ifeng.com,VVV.law.go.kr,cpa.gaiacpa.com,www.gdlibrary.or.kr,docs.google.com,VVV.ybmallinall.com,VVV.alba.co.kr,ecfs.scourt.go.kr,t.openpotservice.com,kiup.ibk.co.kr,VVV.minwon.go.kr,mail.daum.net,market.cetizen.com,VVV.gonzoape.com,nimage.samsungfire.com,tab.syndiapi.com,tab.gcodec.co.kr,tab.everytoolbar.co.kr,VVV.band.us,VVV.momwank.com,VVV.vulgarmoms.com,VVV.asiatoday.co.kr,start.shopingstarter.com,labellefrance.tv,VVV.bondisk.com,shop.shoppingzum.com,video.fc2.com,download.off.co.kr,mybank.ibk.co.kr,VVV.qdown.com,cl.opclick.com,VVV.nedisk.com,vube.com,tab.vcodec.co.kr,tab.ktqooksearch.co.kr,VVV.jejutourbank.co.kr,VVV.diyhard.co.kr,open.howcodec.co.kr,open.gcodec.co.kr,open.vcodec.co.kr,ad.syndiapi.com,ad.windowboanpatch.com,

<<< skipped >>>

GET /opapp/btguide/app/update/update.xml HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: sub.buttonguide.co.kr

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 11 Mar 2015 20:44:19 GMT

Server: Apache/2.2.3 (CentOS)

Last-Modified: Wed, 17 Dec 2014 06:56:34 GMT

ETag: "be88bb-bb-50a63f9e30c80"

Accept-Ranges: bytes

Content-Length: 187

Connection: close

Content-Type: text/xml

<?xml version="1.0" encoding="UTF-8"?>..<update>..<item>..<ver>8</ver>..<url>hXXp://sub.buttonguide.co.kr/opapp/btguide/app/download/buttonguide_update.exe</url>..</item>..</update>..

GET /mmsv/Access3.php?MyMode=i&MyPartner=btguide&MyValue=00-0C-29-FD-55-AD HTTP/1.1

Host: openkeyword.co.kr

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Wed, 11 Mar 2015 20:44:10 GMT

Server: Apache/2.2.3 (CentOS)

X-Powered-By: PHP/5.1.6

Content-Length: 0

Connection: close

Content-Type: text/html; charset=EUC-KR

POST /mmsv/Access3.php HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)

Host: openkeyword.co.kr

Content-Length: 52

Connection: Keep-Alive

Cache-Control: no-cache

MyMode=i&MyPartner=btguide&MyValue=00-0C-29-FD-55-AD

HTTP/1.1 200 OK

Date: Wed, 11 Mar 2015 20:44:09 GMT

Server: Apache/2.2.3 (CentOS)

X-Powered-By: PHP/5.1.6

Content-Length: 0

Connection: close

Content-Type: text/html; charset=EUC-KR

POST /mmsv/Access3.php HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: ButtonGuideAgent

Host: openkeyword.co.kr

Content-Length: 52

Cache-Control: no-cache

MyMode=b&MyPartner=btguide&MyValue=00-0C-29-FD-55-AD

HTTP/1.1 200 OK

Date: Wed, 11 Mar 2015 20:44:17 GMT

Server: Apache/2.2.3 (CentOS)

X-Powered-By: PHP/5.1.6

Content-Length: 0

Connection: close

Content-Type: text/html; charset=EUC-KR

GET /opapp/btguide/app/download/buttonguide_silent.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: sub.buttonguide.co.kr

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 11 Mar 2015 20:43:25 GMT

Server: Apache/2.2.3 (CentOS)

Last-Modified: Wed, 17 Dec 2014 06:56:22 GMT

ETag: "1740a13-346888-50a63f92bf180"

Accept-Ranges: bytes

Content-Length: 3434632

Connection: close

Content-Type: application/octet-stream

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................Z...........0.......p....@.................................x.4......................................s......................`R4.(............................................................p...............................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data...x............p..............@....ndata.......@...........................rsrc................t..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....>B..H.P.u..u..u...Hr@..B...SV.5.>B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h.6B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[...U.

<<< skipped >>>

Map

The Dropped connects to the servers at the folowing location(s):

Strings from Dumps

ButtonGuideAgent.exe_776:

.text

`.rdata

@.data

.rsrc

@.reloc

t.SSj

PSShL?W

SSSShP

SSSSh

Ht.Ht

.Wh`eU

u.Ph`eU

tAHt.HHt

u SSh

SSQSSSSh

u$SShe

t.hAp

t6Ht.Ht&

CNotSupportedException

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Software\Microsoft\Windows\CurrentVersion\Policies\Network

Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32

%s%s.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp

lX-X-x-XX-XXXXXX

Unicows.dll

Kernel32.dll

Comctl32.dll

CMFCVisualManagerWindows

Advapi32.dll

RegOpenKeyTransactedA

RegCreateKeyTransactedA

CCmdTarget

RegDeleteKeyTransactedA

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl

commctrl_DragListMsg

Afx:%p:%x

Afx:%p:%x:%p:%p:%p

CHttpFile

CHttpConnection

hXXp://

HTTP/1.0

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp

RegDeleteKeyExA

lXXxXXXXXXXX

%s:%x:%x:%x:%x

TOOLBAR_RESETKEYBAORD

%sMFCToolBar-%d

%sMFCToolBar-%d%x

%sMFCToolBarParameters

MSG_CHECKEMPTYMINIFRAME

%sDockingManager-%d

&%d %s

%sPane-%d

%sPane-%d%x

CMDIFrameWndEx

Hex={X,X,X}

kernel32.dll

Comdlg32.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp

ole32.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp

KEYTIP

IDB_OFFICE2007_RIBBON_KEYTIP_BACK

CMDITabProxyWnd

CMDIChildWndEx

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp

%sBasePane-%d

%sBasePane-%d%x

windows

%sMFCOutlookBar-%d

%sMFCOutlookBar-%d%x

%sDockablePaneAdapter-%d

%sDockablePaneAdapter-%d%x

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledrop2.cpp

CMDIClientAreaWnd

%sMDIClientArea-%d

%c%d%c%s

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp

CMDIFrameWnd

CMDIChildWnd

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\viewcore.cpp

RGB(%d, %d, %d)

1&0 %s

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleipfrm.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olestrm.cpp

CMFCToolBarsKeyboardPropertyPage

ENABLE_KEYS

KEYS

KEYS_MENU

%sMFCTasksPane-%d

%sMFCTasksPane-%d%x

MFCLink_Url

MFCLink_UrlPrefix

operator

GetProcessWindowStation

%s (%s:%d)

%Program Files% (x86)\Microsoft Visual Studio 11.0\VC\atlmfc\include\afxwin1.inl

Content-Type: application/x-www-form-urlencoded

Microsoft.XMLHTTP

Microsoft.XMLDOM

ButtonGuide.exe

/app/config/connection.html

hXXp://sub.buttonguide.co.kr/opapp/

hXXp://openkeyword.co.kr/mmsv/Access3.php

/app/update/update.xml

F:\corporation\software\

\btgagent\Release\ButtonGuideAgent.pdb

GetCPInfo

GetWindowsDirectoryA

GetProcessHeap

KERNEL32.dll

CreateDialogIndirectParamA

SetWindowsHookExA

UnhookWindowsHookEx

GetKeyState

GetAsyncKeyState

GetKeyboardLayout

GetKeyboardState

MapVirtualKeyA

GetKeyNameTextA

MapVirtualKeyExA

USER32.dll

GetViewportExtEx

SetViewportExtEx

SetViewportOrgEx

OffsetViewportOrgEx

ScaleViewportExtEx

GetViewportOrgEx

GDI32.dll

MSIMG32.dll

WINSPOOL.DRV

RegCreateKeyExA

RegCloseKey

RegEnumKeyA

RegDeleteKeyA

RegOpenKeyExA

RegEnumKeyExA

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

COMCTL32.dll

UrlUnescapeA

SHLWAPI.dll

UxTheme.dll

OLEAUT32.dll

URLDownloadToFileA

urlmon.dll

GdiplusShutdown

gdiplus.dll

DeleteUrlCacheEntry

InternetCrackUrlA

InternetCanonicalizeUrlA

HttpOpenRequestA

HttpSendRequestA

WININET.dll

IPHLPAPI.DLL

OLEACC.dll

IMM32.dll

WINMM.dll

.PAVCOleException@@

.PAVCObject@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCSimpleException@@

.PAVCNotSupportedException@@

.PAVCInvalidArgException@@

.?AVCMFCVisualManagerWindows@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.?AVCHttpFile@@

.?AVCHttpConnection@@

.PAVCArchiveException@@

.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDV12@PBD@@

.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDPAVCDocument@@PAV3@@@

.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD_N_N@@

.?AV?$CMap@PAVCDocument@@PAV1@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@@

.?AVCMFCToolBarCmdUI@@

.?AVCMDIFrameWndEx@@

.?AVCMDIFrameWnd@@

.?AV?$CMap@KKV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@@

.?AVCMFCColorBarCmdUI@@

.PAVCFileException@@

.?AVCMDIChildWndEx@@

.?AVCMDIChildWnd@@

.?AVCMDITabProxyWnd@@

.?AVCMFCCmdUsageCount@@

.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDPAVCObList@@PAV3@@@

.?AVCMFCRibbonCmdUI@@

.?AV?$CArray@PAVCMFCRibbonKeyTip@@PAV1@@@

.?AVCMFCRibbonKeyTip@@

.?AVCMDIClientAreaWnd@@

.?AV?$CList@PAVCMDIChildWndEx@@PAV1@@@

.?AVCMFCAcceleratorKey@@

.?AVCMFCToolBarsKeyboardPropertyPage@@

.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDHH@@

.?AVCMFCTasksPaneToolBarCmdUI@@

.?AVCMFCAcceleratorKeyAssignCtrl@@

zcÃ

.?AVCCmdTarget@@

.PAVCException@@

.PAVCInternetException@@

%Program Files%\ButtonGuide\ButtonGuideAgent.exe

1JTCP

d\'.tA

.IDAT

p.qN3

s',%f

~:v.zgu}7

.IDATH

AYO.xXO

3%Cn,

HOJ.oa

u.vjB

}j.jX

cdl6.ptQf

&I.Ibr

=9=%{.mnWw/

X${.mn:

s?.jP

p.qNs2cC

.MaeI

.HtCE

~%Uu ,

.YRar

B%f#X

..nax

.mQ$(Xt

O\.gA

\.Wnp`p(

.QzY(

".igLO

%FPf!

*"%Dv

#c$D%f

,D.Zl

.yK]EW

kJ%UN

23[.Iq&

v`.Ko

q.Ko#

6wv.TD

PFTI%f

R%FO8

Q`.vc

V.mE&Qs;

WINDOWS7_

Windows7

.hF[*A

wÃ‰&QM

yVu%X

CU~.CC

true

3 4&4,424

? ?1?7?_?{?

0X0

5Â8

7/8

7 8&9-94999

=!='=-=3=9=

:):5:_:~:

0-0}0

5$7/787}7

7 7$7(7,7074787

9$9(9,909

3$3(30343`3|3

TKernel32.dll

accKeyboardShortcut

user32.dll

hhctrl.ocx

WININET.DLL

BD2D1.dll

DWrite.dll

shell32.dll

uxtheme.dll

dwmapi.dll

comctl32.dll

UComdlg32.dll

MRICHED20.DLL

mscoree.dll

- CRT not initialized

- Attempt to initialize the CRT more than once.

- floating point support not loaded

USER32.DLL

AQUA_IDB_OFFICE2007_MENUBAR_BTN$AQUA_IDB_OFFICE2007_POPUPMENU_BORDER'AQUA_IDB_OFFICE2007_POPUPMENU_RESIZEBAR/AQUA_IDB_OFFICE2007_POPUPMENU_RESIZEBAR_ICON_HV0AQUA_IDB_OFFICE2007_POPUPMENU_RESIZEBAR_ICON_HVT.AQUA_IDB_OFFICE2007_POPUPMENU_RESIZEBAR_ICON_V&AQUA_IDB_OFFICE2007_MENU_ITEM_MARKER_R

AQUA_IDB_OFFICE2007_TAB_FLAT(AQUA_IDB_OFFICE2007_RIBBON_CATEGORY_BACK'AQUA_IDB_OFFICE2007_RIBBON_CATEGORY_TAB'AQUA_IDB_OFFICE2007_RIBBON_PANEL_BACK_T'AQUA_IDB_OFFICE2007_RIBBON_PANEL_BACK_B&AQUA_IDB_OFFICE2007_RIBBON_BTN_GROUP_F&AQUA_IDB_OFFICE2007_RIBBON_BTN_GROUP_M&AQUA_IDB_OFFICE2007_RIBBON_BTN_GROUP_L&AQUA_IDB_OFFICE2007_RIBBON_BTN_GROUP_S'AQUA_IDB_OFFICE2007_RIBBON_BTN_NORMAL_S'AQUA_IDB_OFFICE2007_RIBBON_BTN_NORMAL_B*AQUA_IDB_OFFICE2007_RIBBON_BTN_LAUNCH_ICON#AQUA_IDB_OFFICE2007_RIBBON_BTN_MAIN&AQUA_IDB_OFFICE2007_RIBBON_BTN_DEFAULT,AQUA_IDB_OFFICE2007_RIBBON_BTN_DEFAULT_IMAGE%AQUA_IDB_OFFICE2007_RIBBON_CAPTION_QA AQUA_IDB_OFFICE2007_RIBBON_CAPTION_QA_GLASS'AQUA_IDB_OFFICE2007_RIBBON_BTN_MENU_H_C'AQUA_IDB_OFFICE2007_RIBBON_BTN_MENU_H_M'AQUA_IDB_OFFICE2007_RIBBON_BTN_MENU_V_C'AQUA_IDB_OFFICE2007_RIBBON_BTN_MENU_V_M,AQUA_IDB_OFFICE2007_RIBBON_BTN_GROUPMENU_F_C,AQUA_IDB_OFFICE2007_RIBBON_BTN_GROUPMENU_F_M,AQUA_IDB_OFFICE2007_RIBBON_BTN_GROUPMENU_M_C,AQUA_IDB_OFFICE2007_RIBBON_BTN_GROUPMENU_M_M,AQUA_IDB_OFFICE2007_RIBBON_BTN_GROUPMENU_L_C,AQUA_IDB_OFFICE2007_RIBBON_BTN_GROUPMENU_L_M$AQUA_IDB_OFFICE2007_RIBBON_BTN_CHECK*AQUA_IDB_OFFICE2007_RIBBON_PANEL_SEPARATOR)AQUA_IDB_OFFICE2007_RIBBON_BTN_PANEL_MAIN/AQUA_IDB_OFFICE2007_RIBBON_BTN_DEFAULT_QAT_ICON(AQUA_IDB_OFFICE2007_RIBBON_BTN_PALETTE_T(AQUA_IDB_OFFICE2007_RIBBON_BTN_PALETTE_M(AQUA_IDB_OFFICE2007_RIBBON_BTN_PALETTE_B*AQUA_IDB_OFFICE2007_RIBBON_BTN_STATUS_PANE'AQUA_IDB_OFFICE2007_RIBBON_SLIDER_THUMB*AQUA_IDB_OFFICE2007_RIBBON_SLIDER_BTN_PLUS AQUA_IDB_OFFICE2007_RIBBON_SLIDER_BTN_MINUS(AQUA_IDB_OFFICE2007_RIBBON_PROGRESS_BACK*AQUA_IDB_OFFICE2007_RIBBON_PROGRESS_NORMAL.AQUA_IDB_OFFICE2007_RIBBON_PROGRESS_NORMAL_EXT,AQUA_IDB_OFFICE2007_RIBBON_PROGRESS_INFINITY*AQUA_IDB_OFFICE2007_RIBBON_BTN_DEFAULT_QAT(AQUA_IDB_OFFICE2007_RIBBON_BORDER_FLOATY&AQUA_IDB_OFFICE2007_RIBBON_KEYTIP_BACK%AQUA_IDB_OFFICE2007_RIBBON_BTN_PAGE_L%AQUA_IDB_OFFICE2007_RIBBON_BTN_PAGE_R/AQUA_IDB_OFFICE2007_RIBBON_CONTEXT_PANEL_BACK_B/AQUA_IDB_OFFICE2007_RIBBON_CONTEXT_PANEL_BACK_T,AQUA_IDB_OFFICE2007_RIBBON_CONTEXT_SEPARATOR0AQUA_IDB_OFFICE2007_RIBBON_CONTEXT_R_BTN_DEFAULT1AQUA_IDB_OFFICE2007_RIBBON_CONTEXT_R_CATEGORY_TAB5AQUA_IDB_OFFICE2007_RIBBON_CONTEXT_R_CATEGORY_CAPTION2AQUA_IDB_OFFICE2007_RIBBON_CONTEXT_R_CATEGORY_BACK0AQUA_IDB_OFFICE2007_RIBBON_CONTEXT_O_BTN_DEFAULT1AQUA_IDB_OFFICE2007_RIBBON_CONTEXT_O_CATEGORY_TAB5AQUA_IDB_OFFICE2007_RIBBON_CONTEXT_O_CATEGORY_CAPTION2AQUA_IDB_OFFICE2007_RIBBON_CONTEXT_O_CATEGORY_BACK0AQUA_IDB_OFFICE2007_RIBBON_CONTEXT_Y_BTN_DEFAULT1AQUA_IDB_OFFICE2007_RIBBON_CONTEXT_Y_CATEGORY_TAB5AQUA_IDB_OFFICE2007_RIBBON_CONTEXT_Y_CATEGORY_CAPTION2AQUA_IDB_OFFICE2007_RIBBON_CONTEXT_Y_CATEGORY_BACK0AQUA_IDB_OFFICE2007_RIBBON_CONTEXT_G_BTN_DEFAULT1AQUA_IDB_OFFICE2007_RIBBON_CONTEXT_G_CATEGORY_TAB5AQUA_IDB_OFFICE2007_RIBBON_CONTEXT_G_CATEGORY_CAPTION2AQUA_IDB_OFFICE2007_RIBBON_CONTEXT_G_CATEGORY_BACK0AQUA_IDB_OFFICE2007_RIBBON_CONTEXT_B_BTN_DEFAULT1AQUA_IDB_OFFICE2007_RIBBON_CONTEXT_B_CATEGORY_TAB5AQUA_IDB_OFFICE2007_RIBBON_CONTEXT_B_CATEGORY_CAPTION2AQUA_IDB_OFFICE2007_RIBBON_CONTEXT_B_CATEGORY_BACK0AQUA_IDB_OFFICE2007_RIBBON_CONTEXT_I_BTN_DEFAULT1AQUA_IDB_OFFICE2007_RIBBON_CONTEXT_I_CATEGORY_TAB5AQUA_IDB_OFFICE2007_RIBBON_CONTEXT_I_CATEGORY_CAPTION2AQUA_IDB_OFFICE2007_RIBBON_CONTEXT_I_CATEGORY_BACK0AQUA_IDB_OFFICE2007_RIBBON_CONTEXT_V_BTN_DEFAULT1AQUA_IDB_OFFICE2007_RIBBON_CONTEXT_V_CATEGORY_TAB5AQUA_IDB_OFFICE2007_RIBBON_CONTEXT_V_CATEGORY_CAPTION2AQUA_IDB_OFFICE2007_RIBBON_CONTEXT_V_CATEGORY_BACK

BLACK_IDB_OFFICE2007_TAB_FLAT%BLACK_IDB_OFFICE2007_OUTLOOK_BTN_PAGE%BLACK_IDB_OFFICE2007_OUTLOOK_BAR_BACK)BLACK_IDB_OFFICE2007_RIBBON_CATEGORY_BACK(BLACK_IDB_OFFICE2007_RIBBON_CATEGORY_TAB,BLACK_IDB_OFFICE2007_RIBBON_CATEGORY_TAB_SEP(BLACK_IDB_OFFICE2007_RIBBON_PANEL_BACK_T(BLACK_IDB_OFFICE2007_RIBBON_PANEL_BACK_B'BLACK_IDB_OFFICE2007_RIBBON_BTN_GROUP_F'BLACK_IDB_OFFICE2007_RIBBON_BTN_GROUP_M'BLACK_IDB_OFFICE2007_RIBBON_BTN_GROUP_L'BLACK_IDB_OFFICE2007_RIBBON_BTN_GROUP_S(BLACK_IDB_OFFICE2007_RIBBON_BTN_NORMAL_S(BLACK_IDB_OFFICE2007_RIBBON_BTN_NORMAL_B&BLACK_IDB_OFFICE2007_RIBBON_BTN_LAUNCH BLACK_IDB_OFFICE2007_RIBBON_BTN_LAUNCH_ICON$BLACK_IDB_OFFICE2007_RIBBON_BTN_MAIN'BLACK_IDB_OFFICE2007_RIBBON_BTN_DEFAULT,BLACK_IDB_OFFICE2007_RIBBON_BTN_DEFAULT_ICON-BLACK_IDB_OFFICE2007_RIBBON_BTN_DEFAULT_IMAGE&BLACK_IDB_OFFICE2007_RIBBON_CAPTION_QA,BLACK_IDB_OFFICE2007_RIBBON_CAPTION_QA_GLASS(BLACK_IDB_OFFICE2007_RIBBON_BTN_MENU_H_C(BLACK_IDB_OFFICE2007_RIBBON_BTN_MENU_H_M(BLACK_IDB_OFFICE2007_RIBBON_BTN_MENU_V_C(BLACK_IDB_OFFICE2007_RIBBON_BTN_MENU_V_M-BLACK_IDB_OFFICE2007_RIBBON_BTN_GROUPMENU_F_C-BLACK_IDB_OFFICE2007_RIBBON_BTN_GROUPMENU_F_M-BLACK_IDB_OFFICE2007_RIBBON_BTN_GROUPMENU_M_C-BLACK_IDB_OFFICE2007_RIBBON_BTN_GROUPMENU_M_M-BLACK_IDB_OFFICE2007_RIBBON_BTN_GROUPMENU_L_C-BLACK_IDB_OFFICE2007_RIBBON_BTN_GROUPMENU_L_M%BLACK_IDB_OFFICE2007_RIBBON_BTN_CHECK BLACK_IDB_OFFICE2007_RIBBON_PANEL_SEPARATOR&BLACK_IDB_OFFICE2007_RIBBON_PANEL_MAIN-BLACK_IDB_OFFICE2007_RIBBON_PANEL_MAIN_BORDER*BLACK_IDB_OFFICE2007_RIBBON_BTN_PANEL_MAIN0BLACK_IDB_OFFICE2007_RIBBON_BTN_DEFAULT_QAT_ICON%BLACK_IDB_OFFICE2007_RIBBON_PANEL_QAT)BLACK_IDB_OFFICE2007_RIBBON_BTN_PALETTE_T)BLACK_IDB_OFFICE2007_RIBBON_BTN_PALETTE_M)BLACK_IDB_OFFICE2007_RIBBON_BTN_PALETTE_B BLACK_IDB_OFFICE2007_RIBBON_BTN_STATUS_PANE(BLACK_IDB_OFFICE2007_RIBBON_SLIDER_THUMB BLACK_IDB_OFFICE2007_RIBBON_SLIDER_BTN_PLUS,BLACK_IDB_OFFICE2007_RIBBON_SLIDER_BTN_MINUS)BLACK_IDB_OFFICE2007_RIBBON_PROGRESS_BACK BLACK_IDB_OFFICE2007_RIBBON_PROGRESS_NORMAL/BLACK_IDB_OFFICE2007_RIBBON_PROGRESS_NORMAL_EXT-BLACK_IDB_OFFICE2007_RIBBON_PROGRESS_INFINITY BLACK_IDB_OFFICE2007_RIBBON_BTN_DEFAULT_QAT&BLACK_IDB_OFFICE2007_RIBBON_BORDER_QAT)BLACK_IDB_OFFICE2007_RIBBON_BORDER_FLOATY'BLACK_IDB_OFFICE2007_RIBBON_KEYTIP_BACK&BLACK_IDB_OFFICE2007_RIBBON_BTN_PAGE_L&BLACK_IDB_OFFICE2007_RIBBON_BTN_PAGE_R0BLACK_IDB_OFFICE2007_RIBBON_CONTEXT_PANEL_BACK_B0BLACK_IDB_OFFICE2007_RIBBON_CONTEXT_PANEL_BACK_T-BLACK_IDB_OFFICE2007_RIBBON_CONTEXT_SEPARATOR1BLACK_IDB_OFFICE2007_RIBBON_CONTEXT_R_BTN_DEFAULT2BLACK_IDB_OFFICE2007_RIBBON_CONTEXT_R_CATEGORY_TAB6BLACK_IDB_OFFICE2007_RIBBON_CONTEXT_R_CATEGORY_CAPTION3BLACK_IDB_OFFICE2007_RIBBON_CONTEXT_R_CATEGORY_BACK1BLACK_IDB_OFFICE2007_RIBBON_CONTEXT_O_BTN_DEFAULT2BLACK_IDB_OFFICE2007_RIBBON_CONTEXT_O_CATEGORY_TAB6BLACK_IDB_OFFICE2007_RIBBON_CONTEXT_O_CATEGORY_CAPTION3BLACK_IDB_OFFICE2007_RIBBON_CONTEXT_O_CATEGORY_BACK1BLACK_IDB_OFFICE2007_RIBBON_CONTEXT_Y_BTN_DEFAULT2BLACK_IDB_OFFICE2007_RIBBON_CONTEXT_Y_CATEGORY_TAB6BLACK_IDB_OFFICE2007_RIBBON_CONTEXT_Y_CATEGORY_CAPTION3BLACK_IDB_OFFICE2007_RIBBON_CONTEXT_Y_CATEGORY_BACK1BLACK_IDB_OFFICE2007_RIBBON_CONTEXT_G_BTN_DEFAULT2BLACK_IDB_OFFICE2007_RIBBON_CONTEXT_G_CATEGORY_TAB6BLACK_IDB_OFFICE2007_RIBBON_CONTEXT_G_CATEGORY_CAPTION3BLACK_IDB_OFFICE2007_RIBBON_CONTEXT_G_CATEGORY_BACK1BLACK_IDB_OFFICE2007_RIBBON_CONTEXT_B_BTN_DEFAULT2BLACK_IDB_OFFICE2007_RIBBON_CONTEXT_B_CATEGORY_TAB6BLACK_IDB_OFFICE2007_RIBBON_CONTEXT_B_CATEGORY_CAPTION3BLACK_IDB_OFFICE2007_RIBBON_CONTEXT_B_CATEGORY_BACK1BLACK_IDB_OFFICE2007_RIBBON_CONTEXT_I_BTN_DEFAULT2BLACK_IDB_OFFICE2007_RIBBON_CONTEXT_I_CATEGORY_TAB6BLACK_IDB_OFFICE2007_RIBBON_CONTEXT_I_CATEGORY_CAPTION3BLACK_IDB_OFFICE2007_RIBBON_CONTEXT_I_CATEGORY_BACK1BLACK_IDB_OFFICE2007_RIBBON_CONTEXT_V_BTN_DEFAULT2BLACK_IDB_OFFICE2007_RIBBON_CONTEXT_V_CATEGORY_TAB6BLACK_IDB_OFFICE2007_RIBBON_CONTEXT_V_CATEGORY_CAPTION3BLACK_IDB_OFFICE2007_RIBBON_CONTEXT_V_CATEGORY_BACK

BLUE_IDB_OFFICE2007_MENUBAR_BTN$BLUE_IDB_OFFICE2007_POPUPMENU_BORDER'BLUE_IDB_OFFICE2007_POPUPMENU_RESIZEBAR/BLUE_IDB_OFFICE2007_POPUPMENU_RESIZEBAR_ICON_HV0BLUE_IDB_OFFICE2007_POPUPMENU_RESIZEBAR_ICON_HVT.BLUE_IDB_OFFICE2007_POPUPMENU_RESIZEBAR_ICON_V&BLUE_IDB_OFFICE2007_MENU_ITEM_MARKER_R

BLUE_IDB_OFFICE2007_TAB_FLAT$BLUE_IDB_OFFICE2007_OUTLOOK_BTN_PAGE$BLUE_IDB_OFFICE2007_OUTLOOK_BAR_BACK(BLUE_IDB_OFFICE2007_RIBBON_CATEGORY_BACK'BLUE_IDB_OFFICE2007_RIBBON_CATEGORY_TAB BLUE_IDB_OFFICE2007_RIBBON_CATEGORY_TAB_SEP'BLUE_IDB_OFFICE2007_RIBBON_PANEL_BACK_T'BLUE_IDB_OFFICE2007_RIBBON_PANEL_BACK_B&BLUE_IDB_OFFICE2007_RIBBON_BTN_GROUP_F&BLUE_IDB_OFFICE2007_RIBBON_BTN_GROUP_M&BLUE_IDB_OFFICE2007_RIBBON_BTN_GROUP_L&BLUE_IDB_OFFICE2007_RIBBON_BTN_GROUP_S'BLUE_IDB_OFFICE2007_RIBBON_BTN_NORMAL_S'BLUE_IDB_OFFICE2007_RIBBON_BTN_NORMAL_B%BLUE_IDB_OFFICE2007_RIBBON_BTN_LAUNCH*BLUE_IDB_OFFICE2007_RIBBON_BTN_LAUNCH_ICON#BLUE_IDB_OFFICE2007_RIBBON_BTN_MAIN&BLUE_IDB_OFFICE2007_RIBBON_BTN_DEFAULT BLUE_IDB_OFFICE2007_RIBBON_BTN_DEFAULT_ICON,BLUE_IDB_OFFICE2007_RIBBON_BTN_DEFAULT_IMAGE%BLUE_IDB_OFFICE2007_RIBBON_CAPTION_QA BLUE_IDB_OFFICE2007_RIBBON_CAPTION_QA_GLASS'BLUE_IDB_OFFICE2007_RIBBON_BTN_MENU_H_C'BLUE_IDB_OFFICE2007_RIBBON_BTN_MENU_H_M'BLUE_IDB_OFFICE2007_RIBBON_BTN_MENU_V_C'BLUE_IDB_OFFICE2007_RIBBON_BTN_MENU_V_M,BLUE_IDB_OFFICE2007_RIBBON_BTN_GROUPMENU_F_C,BLUE_IDB_OFFICE2007_RIBBON_BTN_GROUPMENU_F_M,BLUE_IDB_OFFICE2007_RIBBON_BTN_GROUPMENU_M_C,BLUE_IDB_OFFICE2007_RIBBON_BTN_GROUPMENU_M_M,BLUE_IDB_OFFICE2007_RIBBON_BTN_GROUPMENU_L_C,BLUE_IDB_OFFICE2007_RIBBON_BTN_GROUPMENU_L_M$BLUE_IDB_OFFICE2007_RIBBON_BTN_CHECK*BLUE_IDB_OFFICE2007_RIBBON_PANEL_SEPARATOR%BLUE_IDB_OFFICE2007_RIBBON_PANEL_MAIN,BLUE_IDB_OFFICE2007_RIBBON_PANEL_MAIN_BORDER)BLUE_IDB_OFFICE2007_RIBBON_BTN_PANEL_MAIN/BLUE_IDB_OFFICE2007_RIBBON_BTN_DEFAULT_QAT_ICON$BLUE_IDB_OFFICE2007_RIBBON_PANEL_QAT(BLUE_IDB_OFFICE2007_RIBBON_BTN_PALETTE_T(BLUE_IDB_OFFICE2007_RIBBON_BTN_PALETTE_M(BLUE_IDB_OFFICE2007_RIBBON_BTN_PALETTE_B*BLUE_IDB_OFFICE2007_RIBBON_BTN_STATUS_PANE'BLUE_IDB_OFFICE2007_RIBBON_SLIDER_THUMB*BLUE_IDB_OFFICE2007_RIBBON_SLIDER_BTN_PLUS BLUE_IDB_OFFICE2007_RIBBON_SLIDER_BTN_MINUS(BLUE_IDB_OFFICE2007_RIBBON_PROGRESS_BACK*BLUE_IDB_OFFICE2007_RIBBON_PROGRESS_NORMAL.BLUE_IDB_OFFICE2007_RIBBON_PROGRESS_NORMAL_EXT,BLUE_IDB_OFFICE2007_RIBBON_PROGRESS_INFINITY*BLUE_IDB_OFFICE2007_RIBBON_BTN_DEFAULT_QAT%BLUE_IDB_OFFICE2007_RIBBON_BORDER_QAT(BLUE_IDB_OFFICE2007_RIBBON_BORDER_FLOATY&BLUE_IDB_OFFICE2007_RIBBON_KEYTIP_BACK%BLUE_IDB_OFFICE2007_RIBBON_BTN_PAGE_L%BLUE_IDB_OFFICE2007_RIBBON_BTN_PAGE_R/BLUE_IDB_OFFICE2007_RIBBON_CONTEXT_PANEL_BACK_B/BLUE_IDB_OFFICE2007_RIBBON_CONTEXT_PANEL_BACK_T,BLUE_IDB_OFFICE2007_RIBBON_CONTEXT_SEPARATOR0BLUE_IDB_OFFICE2007_RIBBON_CONTEXT_R_BTN_DEFAULT1BLUE_IDB_OFFICE2007_RIBBON_CONTEXT_R_CATEGORY_TAB5BLUE_IDB_OFFICE2007_RIBBON_CONTEXT_R_CATEGORY_CAPTION2BLUE_IDB_OFFICE2007_RIBBON_CONTEXT_R_CATEGORY_BACK0BLUE_IDB_OFFICE2007_RIBBON_CONTEXT_O_BTN_DEFAULT1BLUE_IDB_OFFICE2007_RIBBON_CONTEXT_O_CATEGORY_TAB5BLUE_IDB_OFFICE2007_RIBBON_CONTEXT_O_CATEGORY_CAPTION2BLUE_IDB_OFFICE2007_RIBBON_CONTEXT_O_CATEGORY_BACK0BLUE_IDB_OFFICE2007_RIBBON_CONTEXT_Y_BTN_DEFAULT1BLUE_IDB_OFFICE2007_RIBBON_CONTEXT_Y_CATEGORY_TAB5BLUE_IDB_OFFICE2007_RIBBON_CONTEXT_Y_CATEGORY_CAPTION2BLUE_IDB_OFFICE2007_RIBBON_CONTEXT_Y_CATEGORY_BACK0BLUE_IDB_OFFICE2007_RIBBON_CONTEXT_G_BTN_DEFAULT1BLUE_IDB_OFFICE2007_RIBBON_CONTEXT_G_CATEGORY_TAB5BLUE_IDB_OFFICE2007_RIBBON_CONTEXT_G_CATEGORY_CAPTION2BLUE_IDB_OFFICE2007_RIBBON_CONTEXT_G_CATEGORY_BACK0BLUE_IDB_OFFICE2007_RIBBON_CONTEXT_B_BTN_DEFAULT1BLUE_IDB_OFFICE2007_RIBBON_CONTEXT_B_CATEGORY_TAB5BLUE_IDB_OFFICE2007_RIBBON_CONTEXT_B_CATEGORY_CAPTION2BLUE_IDB_OFFICE2007_RIBBON_CONTEXT_B_CATEGORY_BACK0BLUE_IDB_OFFICE2007_RIBBON_CONTEXT_I_BTN_DEFAULT1BLUE_IDB_OFFICE2007_RIBBON_CONTEXT_I_CATEGORY_TAB5BLUE_IDB_OFFICE2007_RIBBON_CONTEXT_I_CATEGORY_CAPTION2BLUE_IDB_OFFICE2007_RIBBON_CONTEXT_I_CATEGORY_BACK0BLUE_IDB_OFFICE2007_RIBBON_CONTEXT_V_BTN_DEFAULT1BLUE_IDB_OFFICE2007_RIBBON_CONTEXT_V_CATEGORY_TAB5BLUE_IDB_OFFICE2007_RIBBON_CONTEXT_V_CATEGORY_CAPTION2BLUE_IDB_OFFICE2007_RIBBON_CONTEXT_V_CATEGORY_BACK

SILVER_IDX_OFFICE2007_STYLE SILVER_IDB_OFFICE2007_MAINBORDER$SILVER_IDB_OFFICE2007_MDICHILDBORDER(SILVER_IDB_OFFICE2007_MAINBORDER_CAPTION$SILVER_IDB_OFFICE2007_STATUSBAR_BACK(SILVER_IDB_OFFICE2007_STATUSBAR_BACK_EXT'SILVER_IDB_OFFICE2007_STATUSBAR_SIZEBOX*SILVER_IDB_OFFICE2007_STATUSBAR_PANEBORDER"SILVER_IDB_OFFICE2007_SYS_BTN_BACK$SILVER_IDB_OFFICE2007_SYS_BTN_BACK_S#SILVER_IDB_OFFICE2007_SYS_BTN_CLOSE%SILVER_IDB_OFFICE2007_SYS_BTN_CLOSE_S&SILVER_IDB_OFFICE2007_SYS_BTN_MINIMIZE(SILVER_IDB_OFFICE2007_SYS_BTN_MINIMIZE_S&SILVER_IDB_OFFICE2007_SYS_BTN_MAXIMIZE(SILVER_IDB_OFFICE2007_SYS_BTN_MAXIMIZE_S%SILVER_IDB_OFFICE2007_SYS_BTN_RESTORE'SILVER_IDB_OFFICE2007_SYS_BTN_RESTORE_S(SILVER_IDB_OFFICE2007_MENU_ITEM_MARKER_C

SILVER_IDB_OFFICE2007_TAB_FLAT&SILVER_IDB_OFFICE2007_OUTLOOK_BTN_PAGE&SILVER_IDB_OFFICE2007_OUTLOOK_BAR_BACK*SILVER_IDB_OFFICE2007_RIBBON_CATEGORY_BACK)SILVER_IDB_OFFICE2007_RIBBON_CATEGORY_TAB-SILVER_IDB_OFFICE2007_RIBBON_CATEGORY_TAB_SEP)SILVER_IDB_OFFICE2007_RIBBON_PANEL_BACK_T)SILVER_IDB_OFFICE2007_RIBBON_PANEL_BACK_B(SILVER_IDB_OFFICE2007_RIBBON_BTN_GROUP_F(SILVER_IDB_OFFICE2007_RIBBON_BTN_GROUP_M(SILVER_IDB_OFFICE2007_RIBBON_BTN_GROUP_L(SILVER_IDB_OFFICE2007_RIBBON_BTN_GROUP_S)SILVER_IDB_OFFICE2007_RIBBON_BTN_NORMAL_S)SILVER_IDB_OFFICE2007_RIBBON_BTN_NORMAL_B'SILVER_IDB_OFFICE2007_RIBBON_BTN_LAUNCH,SILVER_IDB_OFFICE2007_RIBBON_BTN_LAUNCH_ICON%SILVER_IDB_OFFICE2007_RIBBON_BTN_MAIN(SILVER_IDB_OFFICE2007_RIBBON_BTN_DEFAULT-SILVER_IDB_OFFICE2007_RIBBON_BTN_DEFAULT_ICON.SILVER_IDB_OFFICE2007_RIBBON_BTN_DEFAULT_IMAGE'SILVER_IDB_OFFICE2007_RIBBON_CAPTION_QA-SILVER_IDB_OFFICE2007_RIBBON_CAPTION_QA_GLASS)SILVER_IDB_OFFICE2007_RIBBON_BTN_MENU_H_C)SILVER_IDB_OFFICE2007_RIBBON_BTN_MENU_H_M)SILVER_IDB_OFFICE2007_RIBBON_BTN_MENU_V_C)SILVER_IDB_OFFICE2007_RIBBON_BTN_MENU_V_M.SILVER_IDB_OFFICE2007_RIBBON_BTN_GROUPMENU_F_C.SILVER_IDB_OFFICE2007_RIBBON_BTN_GROUPMENU_F_M.SILVER_IDB_OFFICE2007_RIBBON_BTN_GROUPMENU_M_C.SILVER_IDB_OFFICE2007_RIBBON_BTN_GROUPMENU_M_M.SILVER_IDB_OFFICE2007_RIBBON_BTN_GROUPMENU_L_C.SILVER_IDB_OFFICE2007_RIBBON_BTN_GROUPMENU_L_M&SILVER_IDB_OFFICE2007_RIBBON_BTN_CHECK,SILVER_IDB_OFFICE2007_RIBBON_PANEL_SEPARATOR'SILVER_IDB_OFFICE2007_RIBBON_PANEL_MAIN.SILVER_IDB_OFFICE2007_RIBBON_PANEL_MAIN_BORDER SILVER_IDB_OFFICE2007_RIBBON_BTN_PANEL_MAIN1SILVER_IDB_OFFICE2007_RIBBON_BTN_DEFAULT_QAT_ICON&SILVER_IDB_OFFICE2007_RIBBON_PANEL_QAT*SILVER_IDB_OFFICE2007_RIBBON_BTN_PALETTE_T*SILVER_IDB_OFFICE2007_RIBBON_BTN_PALETTE_M*SILVER_IDB_OFFICE2007_RIBBON_BTN_PALETTE_B,SILVER_IDB_OFFICE2007_RIBBON_BTN_STATUS_PANE)SILVER_IDB_OFFICE2007_RIBBON_SLIDER_THUMB,SILVER_IDB_OFFICE2007_RIBBON_SLIDER_BTN_PLUS-SILVER_IDB_OFFICE2007_RIBBON_SLIDER_BTN_MINUS*SILVER_IDB_OFFICE2007_RIBBON_PROGRESS_BACK,SILVER_IDB_OFFICE2007_RIBBON_PROGRESS_NORMAL0SILVER_IDB_OFFICE2007_RIBBON_PROGRESS_NORMAL_EXT.SILVER_IDB_OFFICE2007_RIBBON_PROGRESS_INFINITY,SILVER_IDB_OFFICE2007_RIBBON_BTN_DEFAULT_QAT'SILVER_IDB_OFFICE2007_RIBBON_BORDER_QAT*SILVER_IDB_OFFICE2007_RIBBON_BORDER_FLOATY(SILVER_IDB_OFFICE2007_RIBBON_KEYTIP_BACK'SILVER_IDB_OFFICE2007_RIBBON_BTN_PAGE_L'SILVER_IDB_OFFICE2007_RIBBON_BTN_PAGE_R1SILVER_IDB_OFFICE2007_RIBBON_CONTEXT_PANEL_BACK_B1SILVER_IDB_OFFICE2007_RIBBON_CONTEXT_PANEL_BACK_T.SILVER_IDB_OFFICE2007_RIBBON_CONTEXT_SEPARATOR2SILVER_IDB_OFFICE2007_RIBBON_CONTEXT_R_BTN_DEFAULT3SILVER_IDB_OFFICE2007_RIBBON_CONTEXT_R_CATEGORY_TAB7SILVER_IDB_OFFICE2007_RIBBON_CONTEXT_R_CATEGORY_CAPTION4SILVER_IDB_OFFICE2007_RIBBON_CONTEXT_R_CATEGORY_BACK2SILVER_IDB_OFFICE2007_RIBBON_CONTEXT_O_BTN_DEFAULT3SILVER_IDB_OFFICE2007_RIBBON_CONTEXT_O_CATEGORY_TAB7SILVER_IDB_OFFICE2007_RIBBON_CONTEXT_O_CATEGORY_CAPTION4SILVER_IDB_OFFICE2007_RIBBON_CONTEXT_O_CATEGORY_BACK2SILVER_IDB_OFFICE2007_RIBBON_CONTEXT_Y_BTN_DEFAULT3SILVER_IDB_OFFICE2007_RIBBON_CONTEXT_Y_CATEGORY_TAB7SILVER_IDB_OFFICE2007_RIBBON_CONTEXT_Y_CATEGORY_CAPTION4SILVER_IDB_OFFICE2007_RIBBON_CONTEXT_Y_CATEGORY_BACK2SILVER_IDB_OFFICE2007_RIBBON_CONTEXT_G_BTN_DEFAULT3SILVER_IDB_OFFICE2007_RIBBON_CONTEXT_G_CATEGORY_TAB7SILVER_IDB_OFFICE2007_RIBBON_CONTEXT_G_CATEGORY_CAPTION4SILVER_IDB_OFFICE2007_RIBBON_CONTEXT_G_CATEGORY_BACK2SILVER_IDB_OFFICE2007_RIBBON_CONTEXT_B_BTN_DEFAULT3SILVER_IDB_OFFICE2007_RIBBON_CONTEXT_B_CATEGORY_TAB7SILVER_IDB_OFFICE2007_RIBBON_CONTEXT_B_CATEGORY_CAPTION4SILVER_IDB_OFFICE2007_RIBBON_CONTEXT_B_CATEGORY_BACK2SILVER_IDB_OFFICE2007_RIBBON_CONTEXT_I_BTN_DEFAULT3SILVER_IDB_OFFICE2007_RIBBON_CONTEXT_I_CATEGORY_TAB7SILVER_IDB_OFFICE2007_RIBBON_CONTEXT_I_CATEGORY_CAPTION4SILVER_IDB_OFFICE2007_RIBBON_CONTEXT_I_CATEGORY_BACK2SILVER_IDB_OFFICE2007_RIBBON_CONTEXT_V_BTN_DEFAULT3SILVER_IDB_OFFICE2007_RIBBON_CONTEXT_V_CATEGORY_TAB7SILVER_IDB_OFFICE2007_RIBBON_CONTEXT_V_CATEGORY_CAPTION4SILVER_IDB_OFFICE2007_RIBBON_CONTEXT_V_CATEGORY_BACK

WINDOWS7_IDX_STYLE

WINDOWS7_IDB_COMBOBOX_BTN!WINDOWS7_IDB_RIBBON_CATEGORY_BACK WINDOWS7_IDB_RIBBON_CATEGORY_TAB$WINDOWS7_IDB_RIBBON_CATEGORY_TAB_SEP

WINDOWS7_IDB_RIBBON_PANEL_BACK"WINDOWS7_IDB_RIBBON_PANEL_BACK_SEP

WINDOWS7_IDB_MENU_BTN

WINDOWS7_IDB_MENU_BTN_DISABLED

WINDOWS7_IDB_MENU_ITEM_BACK

WINDOWS7_IDB_MENU_ITEM_MARKER_C

WINDOWS7_IDB_MENU_ITEM_MARKER_R

WINDOWS7_IDB_RIBBON_BTN_GROUP_F

WINDOWS7_IDB_RIBBON_BTN_GROUP_M

WINDOWS7_IDB_RIBBON_BTN_GROUP_L

WINDOWS7_IDB_RIBBON_BTN_GROUP_S WINDOWS7_IDB_RIBBON_BTN_NORMAL_S WINDOWS7_IDB_RIBBON_BTN_NORMAL_B

WINDOWS7_IDB_RIBBON_BTN_LAUNCH#WINDOWS7_IDB_RIBBON_BTN_LAUNCH_ICON

WINDOWS7_IDB_RIBBON_PANEL_MAIN

WINDOWS7_IDB_RIBBON_BTN_MAIN

WINDOWS7_IDB_RIBBON_BTN_DEFAULT$WINDOWS7_IDB_RIBBON_BTN_DEFAULT_ICON%WINDOWS7_IDB_RIBBON_BTN_DEFAULT_IMAGE WINDOWS7_IDB_RIBBON_BTN_MENU_H_C WINDOWS7_IDB_RIBBON_BTN_MENU_H_M WINDOWS7_IDB_RIBBON_BTN_MENU_V_C WINDOWS7_IDB_RIBBON_BTN_MENU_V_M%WINDOWS7_IDB_RIBBON_BTN_GROUPMENU_F_C%WINDOWS7_IDB_RIBBON_BTN_GROUPMENU_F_M%WINDOWS7_IDB_RIBBON_BTN_GROUPMENU_M_C%WINDOWS7_IDB_RIBBON_BTN_GROUPMENU_M_M%WINDOWS7_IDB_RIBBON_BTN_GROUPMENU_L_C%WINDOWS7_IDB_RIBBON_BTN_GROUPMENU_L_M!WINDOWS7_IDB_RIBBON_BTN_PALETTE_T!WINDOWS7_IDB_RIBBON_BTN_PALETTE_M!WINDOWS7_IDB_RIBBON_BTN_PALETTE_B#WINDOWS7_IDB_RIBBON_BTN_STATUS_PANE#WINDOWS7_IDB_RIBBON_SLIDER_BTN_PLUS$WINDOWS7_IDB_RIBBON_SLIDER_BTN_MINUS#WINDOWS7_IDB_RIBBON_BTN_DEFAULT_QAT

WINDOWS7_IDB_RIBBON_BTN_PAGE_L

WINDOWS7_IDB_RIBBON_BTN_PAGE_R

WINDOWS7_IDB_RIBBON_BORDER_QAT WINDOWS7_IDB_RIBBON_BORDER_PANEL

WINDOWS7_IDB_RIBBON_CAPTION_QA%WINDOWS7_IDB_RIBBON_CONTEXT_SEPARATOR*WINDOWS7_IDB_RIBBON_CONTEXT_R_CATEGORY_TAB.WINDOWS7_IDB_RIBBON_CONTEXT_R_CATEGORY_CAPTION WINDOWS7_IDB_RIBBON_CONTEXT_R_CATEGORY_BACK*WINDOWS7_IDB_RIBBON_CONTEXT_O_CATEGORY_TAB.WINDOWS7_IDB_RIBBON_CONTEXT_O_CATEGORY_CAPTION WINDOWS7_IDB_RIBBON_CONTEXT_O_CATEGORY_BACK*WINDOWS7_IDB_RIBBON_CONTEXT_Y_CATEGORY_TAB.WINDOWS7_IDB_RIBBON_CONTEXT_Y_CATEGORY_CAPTION WINDOWS7_IDB_RIBBON_CONTEXT_Y_CATEGORY_BACK*WINDOWS7_IDB_RIBBON_CONTEXT_G_CATEGORY_TAB.WINDOWS7_IDB_RIBBON_CONTEXT_G_CATEGORY_CAPTION WINDOWS7_IDB_RIBBON_CONTEXT_G_CATEGORY_BACK*WINDOWS7_IDB_RIBBON_CONTEXT_B_CATEGORY_TAB.WINDOWS7_IDB_RIBBON_CONTEXT_B_CATEGORY_CAPTION WINDOWS7_IDB_RIBBON_CONTEXT_B_CATEGORY_BACK*WINDOWS7_IDB_RIBBON_CONTEXT_I_CATEGORY_TAB.WINDOWS7_IDB_RIBBON_CONTEXT_I_CATEGORY_CAPTION WINDOWS7_IDB_RIBBON_CONTEXT_I_CATEGORY_BACK*WINDOWS7_IDB_RIBBON_CONTEXT_V_CATEGORY_TAB.WINDOWS7_IDB_RIBBON_CONTEXT_V_CATEGORY_CAPTION WINDOWS7_IDB_RIBBON_CONTEXT_V_CATEGORY_BACK

2.0.0.22

ButtonGuideAgent.exe

(*.*)

(%d x %d)

(*.exe)|*.exe|

(*.com)|*.com|

(*.pdf)|*.pdf|

(*.bat)|*.bat|

(*.*)|*.*||

. '%s'

%d-%d(

ButtonGuide.exe_604:

.text

`.rdata

@.data

.rsrc

@.reloc

t.SSj

SSSSh(8Z

SSSSh

Ht.Ht

tAHt.HHt

u SSh

SSQSSSSh

u$SShe

t.hAp

t6Ht.Ht&

CNotSupportedException

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Software\Microsoft\Windows\CurrentVersion\Policies\Network

Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32

%s%s.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp

lX-X-x-XX-XXXXXX

Unicows.dll

Kernel32.dll

Comctl32.dll

CMFCVisualManagerWindows

Advapi32.dll

RegOpenKeyTransactedA

RegCreateKeyTransactedA

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp

CCmdTarget

RegDeleteKeyTransactedA

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl

commctrl_DragListMsg

Afx:%p:%x

Afx:%p:%x:%p:%p:%p

CHttpFile

CHttpConnection

hXXp://

HTTP/1.0

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp

RegDeleteKeyExA

lXXxXXXXXXXX

%s:%x:%x:%x:%x

TOOLBAR_RESETKEYBAORD

%sMFCToolBar-%d

%sMFCToolBar-%d%x

%sMFCToolBarParameters

MSG_CHECKEMPTYMINIFRAME

%sDockingManager-%d

&%d %s

%sPane-%d

%sPane-%d%x

CMDIFrameWndEx

Hex={X,X,X}

kernel32.dll

Comdlg32.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp

ole32.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp

KEYTIP

IDB_OFFICE2007_RIBBON_KEYTIP_BACK

CMDITabProxyWnd

CMDIChildWndEx

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp

%sBasePane-%d

%sBasePane-%d%x

windows

%sMFCOutlookBar-%d

%sMFCOutlookBar-%d%x

%sDockablePaneAdapter-%d

%sDockablePaneAdapter-%d%x

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledrop2.cpp

CMDIClientAreaWnd

%sMDIClientArea-%d

%c%d%c%s

CMDIFrameWnd

CMDIChildWnd

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\viewcore.cpp

RGB(%d, %d, %d)

1&0 %s

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleipfrm.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olestrm.cpp

CMFCToolBarsKeyboardPropertyPage

ENABLE_KEYS

KEYS

KEYS_MENU

%sMFCTasksPane-%d

%sMFCTasksPane-%d%x

MFCLink_Url

MFCLink_UrlPrefix

operator

GetProcessWindowStation

%s (%s:%d)

%Program Files% (x86)\Microsoft Visual Studio 11.0\VC\atlmfc\include\afxwin1.inl

hXXp://ad.buttonguide.co.kr/opendb/mmsv.php

hXXp://openkeyword.co.kr/hybrid/staSum2.php

Debug : Keyword /

Debug : URL /

button.dll

#keyword#

keyword

Debug : GetUrlLoad#1

Debug : GetUrlLoad#2

Debug : GetUrlLoad#3

Debug : GetUrlLoad#4

naver.com

daum.net

nate.com

yahoo.com

paran.com

google.co.kr

google.comr

dreamwiz.com

korea.com

chol.com

go.kr

or.kr

adgod.co.kr

openpot.kr

buttonguide.co.kr

ticketmonster.co.kr

coupang.com

wemakeprice.com

Debug : GetUrlAdvert Filter

#url#

ticketmonster.co.kr/search

coupang.com/np/search

wemakeprice.com/search

&keyword=

?search_keyword=

hXXps://

Debug : URL Reconnect

Debug : LIMIT_KEYWORD

hXXp://api.openpot.kr/full_search.php?app=331&url=

Debug : The same Parser URL

Content-Type: application/x-www-form-urlencoded

%%%2x

F:\corporation\software\

\btg\Release\ButtonGuide.pdb

GetCPInfo

GetWindowsDirectoryA

GetProcessHeap

KERNEL32.dll

CreateDialogIndirectParamA

SetWindowsHookExA

UnhookWindowsHookEx

GetKeyState

GetAsyncKeyState

GetKeyboardLayout

GetKeyboardState

MapVirtualKeyA

GetKeyNameTextA

MapVirtualKeyExA

USER32.dll

GetViewportExtEx

SetViewportExtEx

SetViewportOrgEx

OffsetViewportOrgEx

ScaleViewportExtEx

GetViewportOrgEx

GDI32.dll

MSIMG32.dll

WINSPOOL.DRV

RegDeleteKeyA

RegCreateKeyExA

RegCloseKey

RegEnumKeyA

RegOpenKeyExA

RegEnumKeyExA

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

COMCTL32.dll

UrlUnescapeA

SHLWAPI.dll

UxTheme.dll

OLEAUT32.dll

GdiplusShutdown

gdiplus.dll

IPHLPAPI.DLL

OLEACC.dll

InternetCrackUrlA

InternetCanonicalizeUrlA

InternetOpenUrlA

HttpOpenRequestA

HttpSendRequestA

WININET.dll

IMM32.dll

WINMM.dll

.PAVCOleException@@

.PAVCObject@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCSimpleException@@

.PAVCNotSupportedException@@

.PAVCInvalidArgException@@

.?AVCMFCVisualManagerWindows@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.?AVCHttpFile@@

.?AVCHttpConnection@@

.PAVCArchiveException@@

.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDV12@PBD@@

.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDPAVCDocument@@PAV3@@@

.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD_N_N@@

.?AV?$CMap@PAVCDocument@@PAV1@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@@

.?AVCMFCToolBarCmdUI@@

.?AVCMDIFrameWndEx@@

.?AVCMDIFrameWnd@@

.?AV?$CMap@KKV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@@

.?AVCMFCColorBarCmdUI@@

.PAVCFileException@@

.?AVCMDIChildWndEx@@

.?AVCMDIChildWnd@@

.?AVCMDITabProxyWnd@@

.?AVCMFCCmdUsageCount@@

.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDPAVCObList@@PAV3@@@

.?AVCMFCRibbonCmdUI@@

.?AV?$CArray@PAVCMFCRibbonKeyTip@@PAV1@@@

.?AVCMFCRibbonKeyTip@@

.?AVCMDIClientAreaWnd@@

.?AV?$CList@PAVCMDIChildWndEx@@PAV1@@@

.?AVCMFCAcceleratorKey@@

.?AVCMFCToolBarsKeyboardPropertyPage@@

.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDHH@@

.?AVCMFCTasksPaneToolBarCmdUI@@

.?AVCMFCAcceleratorKeyAssignCtrl@@

zcÃ

.?AVCCmdTarget@@

.PAVCException@@

.PAVCInternetException@@

%Program Files%\ButtonGuide\ButtonGuide.exe

1JTCP

d\'.tA

.IDAT

p.qN3

s',%f

~:v.zgu}7

.IDATH

AYO.xXO

3%Cn,

HOJ.oa

u.vjB

}j.jX

cdl6.ptQf

&I.Ibr

=9=%{.mnWw/

X${.mn:

s?.jP

p.qNs2cC

.MaeI

.HtCE

~%Uu ,

.YRar

B%f#X

..nax

.mQ$(Xt

O\.gA

\.Wnp`p(

.QzY(

".igLO

%FPf!

*"%Dv

#c$D%f

,D.Zl

.yK]EW

kJ%UN

23[.Iq&

v`.Ko

q.Ko#

6wv.TD

PFTI%f

R%FO8

Q`.vc

V.mE&Qs;

WINDOWS7_

Windows7

.hF[*A

wÃ‰&QM

yVu%X

CU~.CC

true

1 2S2

6:6{6=7[7

="=)=2=7=@=

5]5c5

393D3M3S3

;%;,;5;@;

4_5

8Å’8N8

4L67V7

5"6(6;6`6

243d3k3Q4[4/9

5C6k6y6Å’8\8c8k8p8t8x8

1$1)121}1

0%1S1

7%8X8

; ;$;(;,;0;4;8;

0 0$0(0,0004080

1(1,10141

1(1,101@1

? ?$?(?,?0?4?

*0.02060

6 6$64686

3 3$3(3,3034383

UKernel32.dll

accKeyboardShortcut

user32.dll

hhctrl.ocx

WININET.DLL

BD2D1.dll

DWrite.dll

shell32.dll

uxtheme.dll

dwmapi.dll

comctl32.dll

UComdlg32.dll

NRICHED20.DLL

mscoree.dll

- CRT not initialized

- Attempt to initialize the CRT more than once.

- floating point support not loaded

USER32.DLL

WINDOWS7_IDX_STYLE

WINDOWS7_IDB_COMBOBOX_BTN!WINDOWS7_IDB_RIBBON_CATEGORY_BACK WINDOWS7_IDB_RIBBON_CATEGORY_TAB$WINDOWS7_IDB_RIBBON_CATEGORY_TAB_SEP

WINDOWS7_IDB_RIBBON_PANEL_BACK"WINDOWS7_IDB_RIBBON_PANEL_BACK_SEP

WINDOWS7_IDB_MENU_BTN

WINDOWS7_IDB_MENU_BTN_DISABLED

WINDOWS7_IDB_MENU_ITEM_BACK

WINDOWS7_IDB_MENU_ITEM_MARKER_C

WINDOWS7_IDB_MENU_ITEM_MARKER_R

WINDOWS7_IDB_RIBBON_BTN_GROUP_F

WINDOWS7_IDB_RIBBON_BTN_GROUP_M

WINDOWS7_IDB_RIBBON_BTN_GROUP_L

WINDOWS7_IDB_RIBBON_BTN_GROUP_S WINDOWS7_IDB_RIBBON_BTN_NORMAL_S WINDOWS7_IDB_RIBBON_BTN_NORMAL_B

WINDOWS7_IDB_RIBBON_BTN_LAUNCH#WINDOWS7_IDB_RIBBON_BTN_LAUNCH_ICON

WINDOWS7_IDB_RIBBON_PANEL_MAIN

WINDOWS7_IDB_RIBBON_BTN_MAIN

WINDOWS7_IDB_RIBBON_BTN_PAGE_L

WINDOWS7_IDB_RIBBON_BTN_PAGE_R

WINDOWS7_IDB_RIBBON_BORDER_QAT WINDOWS7_IDB_RIBBON_BORDER_PANEL

4.0.0.270

ButtonGuide.exe

(*.*)

(%d x %d)

(*.exe)|*.exe|

(*.com)|*.com|

(*.pdf)|*.pdf|

(*.bat)|*.bat|

(*.*)|*.*||

. '%s'

%d-%d(

ButtonGuide.exe_604_rwx_00D21000_00241000:

System.Types

System.UITypes

TWindowState

poPortrait

biClrImportant

tagMSG

Winapi.Windows

HKEY

etNoMonitorSupportException

System.Internal.ExcUtils

TArray

System.SysUtils

ENotSupportedException

ENotSupportedException4

ENoMonitorSupportException

ENoMonitorSupportException$

TArray

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

System.SysUtilsL

System.SysUtils0

&TArray

TWMKey

MsgFiller

KeyData

KeyDataFiller

Winapi.ActiveX

grfLocksSupported

System.Variants

Operator

System.VariantsX"

EVariantBadIndexErrorD

EVariantBadIndexError

System.Variants\

System.TypInfo

TPropSetV

TPropSet|

TPropSetV

TPropSet

TPropSetK

TPropSett

TPropSetK

TPropSet

TPropSetK

TPropSetL

TPropSetK

TPropSet

TPropSetK

TPropSet$

TPropSetV

TPropSet

System.Classes

ssShift

htKeyword

EInvalidOperation

TList.TDirection

AOperator

System.Classes0

TThread.TSynchronizeRecord

TOperation

TObservers.TCanObserveEvent

TObservers.TObserverAddedEvent

Operation

FOnExecute

OnExecute

TArray

ELoginCredendialError

"TLoginCredentialService.TLoginFunc

#TLoginCredentialService.TLoginEvent

Password

-TLoginCredentialService.TLoginCredentialEvent

Callback#TLoginCredentialService.TLoginEvent

FLoginFunc

'TLoginCredentialService.TLoginFuncProxy:

ALoginFunc

'TLoginCredentialService.TLoginFuncProxy\\

TLoginCredentialServiceM

RegisterLoginHandler

UnregisterLoginHandler

GetLoginCredentialEvent

GetLoginCredentials

TLoginCredentialService

TList.Sort$267$0$Intf

TList.Sort$267$ActRec

TList.Sort$267$ActRecP

#TComponent.FindComponent$891$0$Intf

#TComponent.FindComponent$891$ActRec

#TComponent.FindComponent$891$ActRec b

"TComponent.GetObservers$902$0$Intf

"TComponent.GetObservers$902$1$Intf

"TComponent.GetObservers$902$ActRec

"TComponent.GetObservers$902$ActRec\g

7TLoginCredentialService.GetLoginCredentials$1172$0$Intf

LPassword

7TLoginCredentialService.GetLoginCredentials$1172$ActRec

7TLoginCredentialService.GetLoginCredentials$1172$ActRec4

Winapi.Wincodec

TTimeSpanParser.TParseError

System.TimeSpan

System.SyncObjs

TFunc

System.SyncObjsp

System.Generics.Collections

System.IniFiles

DeleteKey

System.Win.Registry

TRegKeyInfo

NumSubKeys

MaxSubKeyLen

FCurrentKey

FRootKey

FCloseRootKey

CloseKey

CreateKey

GetKeyInfo

GetKeyNames

HasSubKeys

KeyExists

LoadKey

MoveKey

OpenKey

OpenKeyReadOnly

ReplaceKey

RestoreKey

SaveKey

UnLoadKey

CurrentKey

LastErrorMsg4

RootKey

RootKeyName

Vcl.Graphics

EInvalidGraphicOperation

SupportsPartialTransparency

SupportsClipboardFormat

Monochrome0

System.Contnrs

Vcl.ActnList

IsShortCut

FHelpKeyword

HelpKeywordh

$:Crtc

System.HelpIntfs

HelpKeyword

UnderstandsKeyword

Vcl.StdCtrls

Vcl.StdCtrls,

FPasswordChar

Vcl.StdCtrlsB

PasswordChar,c

OnKeyDown

OnKeyPressp

OnKeyUpL

ssHorizontal

Vcl.StdCtrls@

TCustomButton.TButtonStyle

Vcl.StdCtrls:

Vcl.StdCtrls*

OnKeyUp

!TScrollBarStyleHook.TScrollWindow6

!TScrollBarStyleHook.TScrollWindow

%TCustomEdit.ObserverAdded$3288$0$Intf

%TCustomEdit.ObserverAdded$3288$ActRecLt

%TCustomEdit.ObserverAdded$3288$ActRec

System.Win.ComObj

Winapi.msxml

Winapi.msxml$

Winapi.msxml!

Winapi.ShlObj

Winapi.ShlObj,

Vcl.Printers

APort

Port

Vcl.StdActns

Vcl.ComCtrls

Vcl.Dialogs

OnExecutep

Vcl.Dialogs|

FURL

TDefaultLoginCredentials]

LoginEvent

LoginEventUsrPw

TDefaultLoginCredentials\

.TDefaultLoginCredentials.LoginEvent$833$0$Intf

.TDefaultLoginCredentials.LoginEvent$833$ActRec

3TDefaultLoginCredentials.LoginEventUsrPw$835$0$Intf

3TDefaultLoginCredentials.LoginEventUsrPw$835$ActRec8

3TDefaultLoginCredentials.LoginEventUsrPw$835$ActRec

FProportional

Vcl.ExtCtrls$

Proportional

Vcl.ExtCtrls

Vcl.Themes

tcpCategoryPanelGroupDontCare

tcpCategoryPanelGroupRoot

tcpBackground

tcpGradientHeader

tcpThemedHeader

tcpChevronOpenedNormal

tcpChevronOpenedHot

tcpChevronOpenedPressed

tcpChevronClosedNormal

tcpChevronClosedHot

tcpChevronClosedPressed

tcpChevronClosedLeftNormal

tcpChevronClosedLeftHot

tcpChevronClosedLeftPressed

tcpThemedChevronOpenedNormal

tcpThemedChevronOpenedHot

tcpThemedChevronOpenedPressed

tcpThemedChevronClosedNormal

tcpThemedChevronClosedHot

tcpThemedChevronClosedPressed

tcDropDownButtonLeftPressed

tePassword

thHeaderItemLeftPressed

tsArrowBtnLeftPressed

ttbThumbLeftPressed

AuthorURL

TCustomStyleServices.TStyleFlag

TCustomStyleServices.TStyleFlags

TCustomStyleEngine.TStyleEngineNotification

#TStyleManager.TStyleClassDescriptor

"TStyleManager.TStyleServicesHandle

TStyleManager.TSourceInfo

"TArray

'TEnumerator(

'TEnumerator

'TEnumerable-

'TEnumerable

B:{System.Generics.Collections}TList.:1

%IComparer

System.Generics.Defaults

2TCollectionNotifyEvent

'IEnumerable

-TList.TEnumerator5

-TList.TEnumeratorL

!TList&

!TList

RTPair>

AKey

eTArray>>

jTEnumerator>>(

jTEnumerator>>X

jTEnumerable>>-

jTEnumerable>>$

^TDictionary>.TItem

cTDictionary>.TItemArray

IEqualityComparer

%TCollectionNotifyEvent

UTCollectionNotifyEvent>

Item!TList

TArray

TEnumerator(

TEnumerator

TEnumerable-

TEnumerable

gTDictionary>.TKeyEnumerator;

gTDictionary>.TKeyEnumerator

gTDictionary>.TKeyCollection;

gTDictionary>.TKeyCollection(

4TArray>

9TEnumerator>(

9TEnumerator>

9TEnumerable>-

9TEnumerable>L

iTDictionary>.TValueEnumerator;

iTDictionary>.TValueEnumerator

iTDictionary>.TValueCollection;

iTDictionary>.TValueCollection

hTDictionary>.TPairEnumerator;

hTDictionary>.TPairEnumeratorp

FOnKeyNotify

FKeyCollection

XTDictionary>9

ContainsKey

XTDictionary>

KeysT

OnKeyNotify

9TPair

LTArray>

QTEnumerator>(

QTEnumerator>

QTEnumerable>-

QTEnumerable>P

ETDictionary.TItem

JTDictionary.TItemArray

IEqualityComparer

%TCollectionNotifyEvent

TEnumerator(

TEnumerator

TEnumerable-

TEnumerable(

NTDictionary.TKeyEnumerator;

NTDictionary.TKeyEnumeratorh

NTDictionary.TKeyCollection;

NTDictionary.TKeyCollectionp

,TArray

1TEnumerator(

1TEnumerator

1TEnumerable-

1TEnumerableL

PTDictionary.TValueEnumerator;

PTDictionary.TValueEnumerator

PTDictionary.TValueCollection;

PTDictionary.TValueCollection

OTDictionary.TPairEnumerator;

OTDictionary.TPairEnumerator

?TDictionary9

?TDictionary

Keys

6TArray

;TEnumerator(

;TEnumerator,

;TEnumerable-

;TEnumerable

V:{System.Generics.Collections}TList.:1

Vcl.Themes0s

9IComparer

FTCollectionNotifyEvent

Item#TStyleManager.TStyleClassDescriptor

;IEnumerable

ATList.TEnumerator5

ATList.TEnumerator`

5TList&

5TList@

*TArray

/TEnumerator(

/TEnumerator

/TEnumerable-

/TEnumerableL

J:{System.Generics.Collections}TList.:1

-IComparer

:TCollectionNotifyEvent

/IEnumerable

5TList.TEnumerator5

5TList.TEnumerator

)TList&

)TList

'TArray

,TEnumerator(

,TEnumerator

,TEnumerable-

,TEnumerableH

G:{System.Generics.Collections}TList.:1

*IComparer

7TCollectionNotifyEvent

,IEnumerable

2TList.TEnumerator5

2TList.TEnumerator

&TList&

&TListd

TArray

TEnumerator(

TEnumerator

TEnumerable-

TEnumerable

;:{System.Generics.Collections}TList.:1

IComparer

TCollectionNotifyEvent

IEnumerable

&TList.TEnumerator5

&TList.TEnumerator

TList&

TList

'TComparison

%TComparer2

%TComparer

B:{System.Generics.Collections}TList.:3

:{System.Generics.Collections}TList>>.:1

hIComparer>>

uTCollectionNotifyEvent>>

ItemRTPair>

jIEnumerable>>

pTList>>.TEnumerator5

pTList>>.TEnumerator

dTList>>&

dTList>>P

5:{System.Generics.Collections}TList.:1

IComparer

IEnumerable

TList.TEnumerator5

TList.TEnumerator

TList&

TList

T:{System.Generics.Collections}TList>.:1

7IComparer>

9IEnumerable>

?TList>.TEnumerator5

?TList>.TEnumerator

3TList>&

3TList>

l:{System.Generics.Collections}TList>.:1

Vcl.ThemesH

OIComparer>

\TCollectionNotifyEvent>

Item9TPair

QIEnumerable>

WTList>.TEnumerator5

WTList>.TEnumerator

KTList>&

KTList>

5:{System.Generics.Collections}TList.:1

IComparer

IEnumerable

TList.TEnumerator5

TList.TEnumeratorH

TList&

TList

L:{System.Generics.Collections}TList.:1

/IComparer

1IEnumerable

7TList.TEnumerator5

7TList.TEnumeratorH

TList&

TList

;TComparison

9TComparer2

9TComparer

V:{System.Generics.Collections}TList.:3

/TComparison

-TComparer2

-TComparerp

J:{System.Generics.Collections}TList.:3

,TComparison

*TComparer2

*TComparer|

G:{System.Generics.Collections}TList.:3

TComparison

TComparer2

TComparerp

;:{System.Generics.Collections}TList.:3

.TDelegatedComparer8

.TDelegatedComparer

jTComparison>>

hTComparer>>2

hTComparer>>4

:{System.Generics.Collections}TList>>.:3

TComparison

TComparer2

TComparer

5:{System.Generics.Collections}TList.:3

9TComparison>

7TComparer>2

7TComparer>

T:{System.Generics.Collections}TList>.:3

QTComparison>

OTComparer>2

OTComparer>

l:{System.Generics.Collections}TList>.:3

TComparison

TComparer2

TComparerT

5:{System.Generics.Collections}TList.:3

1TComparison

/TComparer2

/TComparer$

L:{System.Generics.Collections}TList.:3

BTDelegatedComparer8

BTDelegatedComparerh

6TDelegatedComparer8

6TDelegatedComparer

3TDelegatedComparer8

3TDelegatedComparer

'TDelegatedComparer8

'TDelegatedComparer

qTDelegatedComparer>>8

qTDelegatedComparer>>H

!TDelegatedComparer8

!TDelegatedComparer|

@TDelegatedComparer>8

@TDelegatedComparer>

XTDelegatedComparer>8

XTDelegatedComparer>

!TDelegatedComparer8

!TDelegatedComparer

8TDelegatedComparer8

8TDelegatedComparer|

Vcl.Forms

ssHotTrack

Vcl.Forms4$

poProportional

fsShowing

FWindowState

FKeyPreview

WantChildKey

KeyPreview4^

WindowState

Vcl.Formsa

KeyPreviewp

WindowStatedP

FBiDiKeyboard

FNonBiDiKeyboard

FEnumAllWindowsOnActivateHint

FOnActionExecute

Keyword

EnumAllWindowsOnActivateHint

BiDiKeyboard

NonBiDiKeyboard

OnActionExecute

!TScrollingStyleHook.TScrollWindow6

!TScrollingStyleHook.TScrollWindow

1TFormStyleHook.TMainMenuBarStyleHook.TMenuBarItem

(:TFormStyleHook.TMainMenuBarStyleHook.:1

Vcl.Forms`

FEnterWithKeyboard

$TFormStyleHook.TMainMenuBarStyleHook8

CheckHotKeyItem

$TFormStyleHook.TMainMenuBarStyleHook

EnterWithKeyboard

Vcl.ImgList

lrMonoChrome

Vcl.Menus

FAutoHotkeys

RethinkHotkeys

AutoHotkeys@C

AutoHotkeys

Vcl.Controls

igoParentPassthrough

FAlwaysShowDragImages

AlwaysShowDragImages

toFlickFallbackKeys

'TCustomGestureEngine.TGestureEngineFlag

(TCustomGestureEngine.TGestureEngineFlags

Supported

TKeyEvent

TKeyPressEvent

HelpKeywordH

FOnKeyDown

FOnKeyPress

FOnKeyUp

IsHintMsg

FNativeWheelSupport

FWheelSupportMessage

Vcl.ControlsL

Vcl.AxCtrls

Vcl.OleCtrls

LicenseKey

Vcl.OleServer

'TServerEventDispatch.Invoke$7169$0$Intf

'TServerEventDispatch.Invoke$7169$ActRec

'TServerEventDispatch.Invoke$7169$ActRec0Q

IWebBrowser

IWebBrowserApp

IWebBrowser2HU

IShellWindows

CoShellWindows1

CoShellWindowsHV

AMsg

EIdCanNotBindPortInRange

EIdInvalidPortRange

CheckIPVersionSupport

WSGetServByPort

APortNumber

AddServByPortToList

VPort

IdStackWindows

TIdSocketListWindows4

TIdSocketListWindows$M

TIdStackWindowsg

ReceiveMsg

WSTranslateSocketErrorMsg

SupportsIPv6

TIdStackWindows

EIdIPVersionUnsupported

EIdIPVersionUnsupported,

ReceiveMsg,

EIdPortRequired

EIdTCPConnectionError

EIdTCPConnectionErrort

EIdObjectTypeNotSupportedd

EIdObjectTypeNotSupported4

IPAsStringU

QuoteHTTP

IdHTTPHeaderInfo

FPassword

FPort

ProxyPassword

ProxyPort

FMetaHTTPEquiv

TIdMetaHTTPEquivE

ProcessMetaHTTPEquiv

TIdMetaHTTPEquiv

ftpTransfer

ftpReady

ftpAborted

VMsgEnd

FClientPortMin

FClientPortMax

FPeerPort

ClientPortMin

ClientPortMax

PeerPort

"EIdTransparentProxyUDPNotSupported

OpenUDP

CloseUDP

RecvFromUDP

SendToUDPm

FLastCmdResult

TIdTCPConnectionB

RaiseExceptionForLastCmdResult

SendCmd

SendCmdf

TIdTCPConnectionPe

IdTCPConnection

LastCmdResult

FBoundPort

FBoundPortMax

FBoundPortMin

TIdTCPClientCustom'

TIdTCPClientCustom

IdTCPClient

BoundPort

BoundPortMax

BoundPortMin

TIdTCPClient

%EIdSocksUDPNotSupportedBySOCKSVersion

%EIdSocksUDPNotSupportedBySOCKSVersionH

saUsernamePassword

FUDPSocksAssociation

SendToUDP9

FDefaultPort

DefaultPort

fPassThrough

PassThrough

MakeFTPSvrPort

MakeFTPSvrPasv

CompressFTPDeflate

CompressFTPToIO

DecompressFTPFromIO

DecompressFTPDeflate

CompressHTTPDeflate

DecompressHTTPDeflate

URLDecode

URLEncode

FHttpOnly

HttpOnly

AURL

EIdUnsupportedOperation

EIdUnsupportedTransfer

rsa_keygen

dsa_keygen

pub_key

priv_key

PEVP_PKEY

EVP_PKEY_union

EVP_PKEY

pkey

pkey_type

required_pkey_type

key_len

key_length

AUTHORITY_KEYID

keyid

PAUTHORITY_KEYID

X509_PUBKEY

public_key

PX509_PUBKEY

X509_CERT_AUX

PX509_CERT_AUX8

cert_info

ex_nscert

get_cert_methods

cert_crl

ppem_password_cb

key_arg_length

key_arg

master_key_length

master_key

sess_cert

Ptlsext_ticket_key_cb-

cert_store

default_passwd_callback

default_passwd_callback_userdata

client_cert_cb

extra_certs

max_cert_list

cert

msg_callback

msg_callback_arg

client_cert_engine

tlsext_tick_key_name

tlsext_tick_hmac_key

tlsext_tick_aes_key

tlsext_ticket_key_cb

init_msg

read_key

write_key

key_material_length

key_material

tmp_cert_type

tmp_cert_length

tmp_cert_verify_md

tmp_cert_req

tmp_key_block_length

tmp_key_block

tmp_cert_request

msg_len

w_msg_hdr

r_msg_hdr

sslvrfFailIfNoPeerCert

TCallbackExEvent

TPasswordEvent

TPasswordEventEx

VPassword

Certificate

fsRootCertFile

fsCertFile

fsKeyFile

RootCertFile

CertFile

KeyFileLh

LoadRootCert

LoadCert

KeyFile

fPeerCert

PeerCert

fOnGetPassword

fOnGetPasswordEx

OnGetPassword

OnGetPasswordEx0m

EIdOSSLLoadingRootCertError

EIdOSSLLoadingCertError

EIdOSSLLoadingKeyError

EIdOSSLLoadingKeyErrord

SEC_GET_KEY_FN

KeyVer

pGetKeyFn

pvGetKeyArgument

EXPORT_SECURITY_CONTEXT_FN

IMPORT_SECURITY_CONTEXT_FN_Wd

ExportSecurityContext

ImportSecurityContextW

aPassword

TIdHTTPConnectionType

IdHTTP

TIdHTTPOption

hoNoParseMetaHTTPEquiv

TIdHTTPOptions

TIdHTTPProtocolVersion

TIdHTTPOnRedirectEvent

TIdHTTPOnHeadersAvailable

FHTTP

TIdHTTPResponse5

AHTTP

TIdHTTPResponsePi

MetaHTTPEquiv

TIdHTTPRequest5

TIdHTTPRequestTl

TIdHTTPProtocol;

TIdHTTPProtocol

FHTTPProto

TIdCustomHTTP'

TIdCustomHTTP

HTTPOptions

TIdHTTP

EIdHTTPProtocolExceptionn

EIdHTTPProtocolException

Xml.Win.msxmldom

Xml.Xmldom

Xml.XMLIntf

Xml.XMLIntf*

Xml.XMLIntf/

TNodeListOperation

Xml.XMLDoc

BeforeOperation

hXXp://mmnneo.com

hXXp://ncclick.co.kr

hXXp://robinhoot.co.kr

ROBIN_TARGET_KWDS

HandlexE

FRegKey

DeleteKeyBeforeSave

RegKey

IndexOfURL

IndexOfURLBrowser

FRedirectURL

RedirectURL

IWebBrowser2

TIEWebBrowserTextChange

TIEWebBrowserStatusTextChange

TIEWebBrowserProgressChange

TIEWebBrowserCommandStateChange

TIEWebBrowserPropertyChange

TIEWebBrowserBeforeNavigate2

NewURL

TIEWebBrowserNewWindow2

TIEWebBrowserNavigateComplete2

TIEWebBrowserDocumentComplete

TIEWebBrowserOnVisible

TIEWebBrowserOnToolBar

TIEWebBrowserOnMenuBar

TIEWebBrowserOnStatusBar

TIEWebBrowserOnFullScreen

TIEWebBrowserOnTheaterMode

TIEWebBrowserOnAddressBar

TIEWebBrowserOnFileDownload

!TIEWebBrowserOnWindowStateChanged

dwWindowStateFlags

FSniffWithHTTPPrefixOnly

FURLs

FOnURLChange

FOnWindowStateChanged

SniffWithHTTPPrefixOnly$

URLsp

OnURLChange

OnWindowStateChanged

URLParams

NewWindowURL

TS_B_URL

IESniffer1WindowStateChanged

IESniffer1URLChange

ClickURL

NavigateURL

Search_Keyword

IE_ALL_URL_List

IsSaveKeyword

ActiveURLs

System.SysConst

System.RTLConsts

System.Character

Winapi.PsAPI

Winapi.SHFolder

Winapi.ImageHlp

System.VarUtils

Winapi.Messages

System.DateUtils

System.Math

System.Diagnostics

System.AnsiStrings

System.StrUtils

Winapi.CommCtrl

Winapi.Dwmapi

Winapi.UxTheme

Winapi.MultiMon

Vcl.Consts

System.UIConsts

System.IOUtils

System.Masks

Vcl.GraphUtil

System.ZLib

System.Win.Crtl

Winapi.TpcShrd

Winapi.Imm

Winapi.CommDlg

System.Win.ComConst

Winapi.StructuredQueryCondition

Winapi.PropSys

Winapi.ObjectArray

Winapi.UrlMon

Winapi.WinInet

Winapi.RegStr

Winapi.ShellAPI

Winapi.IpExport

Winapi.Winsock2

Winapi.Qos

Vcl.ComStrs

Winapi.WinSpool

Vcl.ListActns

Vcl.ToolWin

Winapi.RichEdit

Vcl.Clipbrd

Winapi.FlatSB

Winapi.Dlgs

System.WideStrUtils

System.Win.StdVCL

Vcl.OleConst

IdTCPServer

IdCustomTCPServer

Xml.XMLConst

Xml.XMLSchema

Xml.XMLSchemaTags

csshiftjis

windows-936

windows-1250

windows-1251

windows-1252

windows-1253

windows-1254

windows-1255

windows-1256

windows-1257

windows-1258

windows-874

#!V!W!"!&!r%!%#%%%'%)%c%e%g%C%

P%S%V%Y%\%

?456789:;

!"#$%&'()* ,-./0123

kernel32.dll

wtsapi32.dll

user32.dll

advapi32.dll

RegDeleteKeyExW

windowscodecs.dll

imm32.dll

uxtheme.dll

DWMAPI.DLL

shell32.dll

ISystem.Internal.ExcUtils

dSystem.SysConst

,System.Character

kWinapi.PsAPI

-Winapi.ImageHlp

yVcl.Consts

%System.Classes

'System.UIConsts

iSystem.IOUtils

&System.DateUtils

YSystem.AnsiStrings

System.StrUtils

RVcl.Dialogs

NSystem.Contnrs

CVcl.ExtCtrls

eVcl.Forms

(Vcl.Menus

Vcl.ComCtrls

hWinapi.UrlMon

4Winapi.RegStr

WVcl.ComStrs

bVcl.Printers

8Vcl.ToolWin

jVcl.Clipbrd

:Winapi.Imm

BVcl.OleServer

sVcl.AxCtrls

0IdHTTPHeaderInfo

IdTCPServer

:Xml.XMLSchemaTags

]Xml.Win.msxmldom

ZXml.XMLIntf

Font.Charset

Font.Color

Font.Height

Font.Name

Font.Style

SearchBar.URL

hXXp://VVV.google.com/ie

SearchRedirect.RedirectURL

hXXp://yoururl/%s

GetCPInfoExW

GetCPInfo

GetConsoleOutputCP

RegOpenKeyExW

RegCloseKey

RegUnLoadKeyW

RegSaveKeyW

RegRestoreKeyW

RegReplaceKeyW

RegQueryInfoKeyW

RegLoadKeyW

RegFlushKey

RegEnumKeyExW

RegDeleteKeyW

RegCreateKeyExW

SetViewportOrgEx

UnhookWindowsHookEx

SetWindowsHookExW

MsgWaitForMultipleObjectsEx

MsgWaitForMultipleObjects

MapVirtualKeyW

LoadKeyboardLayoutW

GetKeyboardState

GetKeyboardLayoutNameW

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextW

EnumWindows

EnumThreadWindows

EnumChildWindows

ActivateKeyboardLayout

Âd

"'/$*-,/4|

Y[.jaS

)%%%$$$*&&$''&)

)%%%$$"!$$%"*&''&$&)

)%%*$$"!$%"*&''&$&)

)#%%$$"!$%"''#&)

(!("$% $() &, *

*.*,%-&/"0

)%%%$$$*&''&$%&)

//*)%'&0.!!!$%'%$%%*

/%%"%("&&,

&%'('&()&

''*'&()#0

/1 0 .'7(2':

0$$((%0

9>#5#5#/

) && !&)/

R6R%.rq}hx|

/-1,/*-.)0/#&&&()*) ')&/

.text

`.itext

`.data

.idata

.didata

.edata

@.reloc

B.rsrc

8M(N%f

,/*-.)0/#&

)*) ')&/

O@.re

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

%s-%s

oleaut32.dll

%s[%d]

%s_%d

.Owner

ole32.dll

\\?\UNC\

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_CURRENT_CONFIG

HKEY_DYN_DATA

crSQLWait

claBurlywood

%s (*.%s)|*.%1:s

%s (%s)|%1:s|

SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes

comctl32.dll

TaskDialogIndirect

clWebSnow

clWebFloralWhite

clWebLavenderBlush

clWebOldLace

clWebIvory

clWebCornSilk

clWebBeige

clWebAntiqueWhite

clWebWheat

clWebAliceBlue

clWebGhostWhite

clWebLavender

clWebSeashell

clWebLightYellow

clWebPapayaWhip

clWebNavajoWhite

clWebMoccasin

clWebBurlywood

clWebAzure

clWebMintcream

clWebHoneydew

clWebLinen

clWebLemonChiffon

clWebBlanchedAlmond

clWebBisque

clWebPeachPuff

clWebTan

clWebYellow

clWebDarkOrange

clWebRed

clWebDarkRed

clWebMaroon

clWebIndianRed

clWebSalmon

clWebCoral

clWebGold

clWebTomato

clWebCrimson

clWebBrown

clWebChocolate

clWebSandyBrown

clWebLightSalmon

clWebLightCoral

clWebOrange

clWebOrangeRed

clWebFirebrick

clWebSaddleBrown

clWebSienna

clWebPeru

clWebDarkSalmon

clWebRosyBrown

clWebPaleGoldenrod

clWebLightGoldenrodYellow

clWebOlive

clWebForestGreen

clWebGreenYellow

clWebChartreuse

clWebLightGreen

clWebAquamarine

clWebSeaGreen

clWebGoldenRod

clWebKhaki

clWebOliveDrab

clWebGreen

clWebYellowGreen

clWebLawnGreen

clWebPaleGreen

clWebMediumAquamarine

clWebMediumSeaGreen

clWebDarkGoldenRod

clWebDarkKhaki

clWebDarkOliveGreen

clWebDarkgreen

clWebLimeGreen

clWebLime

clWebSpringGreen

clWebMediumSpringGreen

clWebDarkSeaGreen

clWebLightSeaGreen

clWebPaleTurquoise

clWebLightCyan

clWebLightBlue

clWebLightSkyBlue

clWebCornFlowerBlue

clWebDarkBlue

clWebIndigo

clWebMediumTurquoise

clWebTurquoise

clWebCyan

clWebPowderBlue

clWebSkyBlue

clWebRoyalBlue

clWebMediumBlue

clWebMidnightBlue

clWebDarkTurquoise

clWebCadetBlue

clWebDarkCyan

clWebTeal

clWebDeepskyBlue

clWebDodgerBlue

clWebBlue

clWebNavy

clWebDarkViolet

clWebDarkOrchid

clWebMagenta

clWebDarkMagenta

clWebMediumVioletRed

clWebPaleVioletRed

clWebBlueViolet

clWebMediumOrchid

clWebMediumPurple

clWebPurple

clWebDeepPink

clWebLightPink

clWebViolet

clWebOrchid

clWebPlum

clWebThistle

clWebHotPink

clWebPink

clWebLightSteelBlue

clWebMediumSlateBlue

clWebLightSlateGray

clWebWhite

clWebLightgrey

clWebGray

clWebSteelBlue

clWebSlateBlue

clWebSlateGray

clWebWhiteSmoke

clWebSilver

clWebDimGray

clWebMistyRose

clWebDarkSlateBlue

clWebDarkSlategray

clWebGainsboro

clWebDarkGray

clWebBlack

%s, ClassID: %s

%s, ProgID: "%s"

{43826D1E-E718-42EE-BC55-A1E261C37BFE}

%s%s%s%s%s%s%s%s%s%s

Windows

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\

%s (%s)

olepro32.dll

%d - %s

%s, %.2d %s %.4d %s %s

%s, %.2d%s%s%s%.4d %s %s

WS2_32.DLL

getservbyport

WSAAsyncGetServByPort

WSAJoinLeaf

MSWSOCK.DLL

WSARecvMsg

WSASendMsg

Wship6.dll

Fwpuclnt.dll

127.0.0.1

ISO_646.irv:1991

ISO_646.basic:1983

ISO_646.irv:1983

csISO16Portuguese

csISO84Portuguese2

csShiftJIS

ISO-8859-1-Windows-3.0-Latin-1

csWindows30Latin1

ISO-8859-1-Windows-3.1-Latin-1

csWindows31Latin1

ISO-8859-2-Windows-Latin-2

csWindows31Latin2

ISO-8859-9-Windows-Latin-5

csWindows31Latin5

csMicrosoftPublishing

Windows-31J

csWindows31J

PTCP154

csPTCP154

10.5.8.0

!"#$%&'()* ,-./;?@[\]^_`{|}~

.nml=animation/narrative

.aac=audio/mp4

.aif=audio/x-aiff

.aifc=audio/x-aiff

.aiff=audio/x-aiff

.au=audio/basic

.gsm=audio/x-gsm

.kar=audio/midi

.m3u=audio/mpegurl

.mid=audio/midi

.midi=audio/midi

.mpega=audio/x-mpg

.mp2=audio/x-mpg

.mp3=audio/x-mpg

.mpga=audio/x-mpg

.m3u=audio/x-mpegurl

.pls=audio/x-scpls

.qcp=audio/vnd.qcelp

.ra=audio/x-realaudio

.ram=audio/x-pn-realaudio

.rm=audio/x-pn-realaudio

.sd2=audio/x-sd2

.sid=audio/prs.sid

.snd=audio/basic

.wav=audio/x-wav

.wax=audio/x-ms-wax

.wma=audio/x-ms-wma

.mjf=audio/x-vnd.AudioExplosion.MjuiceMediaFile

.art=image/x-jg

.bmp=image/bmp

.cdr=image/x-coreldraw

.cdt=image/x-coreldrawtemplate

.cpt=image/x-corelphotopaint

.djv=image/vnd.djvu

.djvu=image/vnd.djvu

.gif=image/gif

.ief=image/ief

.ico=image/x-icon

.jng=image/x-jng

.jpg=image/jpeg

.jpeg=image/jpeg

.jpe=image/jpeg

.pat=image/x-coreldrawpattern

.pcx=image/pcx

.pbm=image/x-portable-bitmap

.pgm=image/x-portable-graymap

.pict=image/x-pict

.png=image/x-png

.pnm=image/x-portable-anymap

.pntg=image/x-macpaint

.ppm=image/x-portable-pixmap

.psd=image/x-psd

.qtif=image/x-quicktime

.ras=image/x-cmu-raster

.rf=image/vnd.rn-realflash

.rgb=image/x-rgb

.rp=image/vnd.rn-realpix

.sgi=image/x-sgi

.svg=image/svg-xml

.svgz=image/svg-xml

.targa=image/x-targa

.tif=image/x-tiff

.wbmp=image/vnd.wap.wbmp

.xbm=image/xbm

.xbm=image/x-xbitmap

.xpm=image/x-xpixmap

.xwd=image/x-xwindowdump

.xml=text/xml

.uls=text/iuls

.txt=text/plain

.rtx=text/richtext

.wsc=text/scriptlet

.rt=text/vnd.rn-realtext

.htt=text/webviewhtml

.htc=text/x-component

.vcf=text/x-vcard

.asf=video/x-ms-asf

.asx=video/x-ms-asf

.avi=video/x-msvideo

.dl=video/dl

.dv=video/dv

.flc=video/flc

.fli=video/fli

.gl=video/gl

.lsf=video/x-la-asf

.lsx=video/x-la-asf

.mng=video/x-mng

.mp2=video/mpeg

.mp3=video/mpeg

.mp4=video/mpeg

.mpeg=video/x-mpeg2a

.mpa=video/mpeg

.mpe=video/mpeg

.mpg=video/mpeg

.moov=video/quicktime

.mov=video/quicktime

.mxu=video/vnd.mpegurl

.qt=video/quicktime

.qtc=video/x-qtc

.rv=video/vnd.rn-realvideo

.ivf=video/x-ivf

.wm=video/x-ms-wm

.wmp=video/x-ms-wmp

.wmv=video/x-ms-wmv

.wmx=video/x-ms-wmx

.wvx=video/x-ms-wvx

.rms=video/vnd.rn-realvideo-secure

.asx=video/x-ms-asf-plugin

.movie=video/x-sgi-movie

.aab=application/x-authorware-bin

.aam=application/x-authorware-map

.aas=application/x-authorware-seg

.abw=application/x-abiword

.ace=application/x-ace-compressed

.ai=application/postscript

.alz=application/x-alz-compressed

.ani=application/x-navi-animation

.arj=application/x-arj

.asf=application/vnd.ms-asf

.bat=application/x-msdos-program

.bcpio=application/x-bcpio

.boz=application/x-bzip2

.bz=application/x-bzip

.bz2=application/x-bzip2

.cab=application/vnd.ms-cab-compressed

.cat=application/vnd.ms-pki.seccat

.ccn=application/x-cnc

.cco=application/x-cocoa

.cdf=application/x-cdf

.cer=application/x-x509-ca-cert

.chm=application/vnd.ms-htmlhelp

.chrt=application/vnd.kde.kchart

.cil=application/vnd.ms-artgalry

.class=application/java-vm

.com=application/x-msdos-program

.clp=application/x-msclip

.cpio=application/x-cpio

.cpt=application/mac-compactpro

.cqk=application/x-calquick

.crd=application/x-mscardfile

.crl=application/pkix-crl

.csh=application/x-csh

.dar=application/x-dar

.dbf=application/x-dbase

.dcr=application/x-director

.deb=application/x-debian-package

.dir=application/x-director

.dist=vnd.apple.installer xml

.distz=vnd.apple.installer xml

.dll=application/x-msdos-program

.dmg=application/x-apple-diskimage

.doc=application/msword

.dot=application/msword

.dvi=application/x-dvi

.dxr=application/x-director

.ebk=application/x-expandedbook

.eps=application/postscript

.evy=application/envoy

.exe=application/x-msdos-program

.fdf=application/vnd.fdf

.fif=application/fractals

.flm=application/vnd.kde.kivio

.fml=application/x-file-mirror-list

.gzip=application/x-gzip

.gnumeric=application/x-gnumeric

.gtar=application/x-gtar

.gz=application/x-gzip

.hdf=application/x-hdf

.hlp=application/winhlp

.hpf=application/x-icq-hpf

.hqx=application/mac-binhex40

.hta=application/hta

.ims=application/vnd.ms-ims

.ins=application/x-internet-signup

.iii=application/x-iphone

.iso=application/x-iso9660-image

.jar=application/java-archive

.karbon=application/vnd.kde.karbon

.kfo=application/vnd.kde.kformula

.kon=application/vnd.kde.kontour

.kpr=application/vnd.kde.kpresenter

.kpt=application/vnd.kde.kpresenter

.kwd=application/vnd.kde.kword

.kwt=application/vnd.kde.kword

.latex=application/x-latex

.lha=application/x-lzh

.lcc=application/fastman

.lrm=application/vnd.ms-lrm

.lz=application/x-lzip

.lzh=application/x-lzh

.lzma=application/x-lzma

.lzo=application/x-lzop

.lzx=application/x-lzx

.mpp=application/vnd.ms-project

.mvb=application/x-msmediaview

.man=application/x-troff-man

.mdb=application/x-msaccess

.me=application/x-troff-me

.ms=application/x-troff-ms

.msi=application/x-msi

.mpkg=vnd.apple.installer xml

.mny=application/x-msmoney

.nix=application/x-mix-transfer

.oda=application/oda

.odb=application/vnd.oasis.opendocument.database

.odc=application/vnd.oasis.opendocument.chart

.odf=application/vnd.oasis.opendocument.formula

.odg=application/vnd.oasis.opendocument.graphics

.odi=application/vnd.oasis.opendocument.image

.odm=application/vnd.oasis.opendocument.text-master

.odp=application/vnd.oasis.opendocument.presentation

.ods=application/vnd.oasis.opendocument.spreadsheet

.ogg=application/ogg

.odt=application/vnd.oasis.opendocument.text

.otg=application/vnd.oasis.opendocument.graphics-template

.oth=application/vnd.oasis.opendocument.text-web

.otp=application/vnd.oasis.opendocument.presentation-template

.ots=application/vnd.oasis.opendocument.spreadsheet-template

.ott=application/vnd.oasis.opendocument.text-template

.p7b=application/x-pkcs7-certificates

.p7r=application/x-pkcs7-certreqresp

.package=application/vnd.autopackage

.pfr=application/font-tdpfr

.pkg=vnd.apple.installer xml

.pdf=application/pdf

.pko=application/vnd.ms-pki.pko

.pl=application/x-perl

.pnq=application/x-icq-pnq

.pot=application/mspowerpoint

.pps=application/mspowerpoint

.ppt=application/mspowerpoint

.ppz=application/mspowerpoint

.ps=application/postscript

.pub=application/x-mspublisher

.qpw=application/x-quattropro

.qtl=application/x-quicktimeplayer

.rar=application/rar

.rdf=application/rdf xml

.rjs=application/vnd.rn-realsystem-rjs

.rm=application/vnd.rn-realmedia

.rmf=application/vnd.rmf

.rmp=application/vnd.rn-rn_music_package

.rmx=application/vnd.rn-realsystem-rmx

.rnx=application/vnd.rn-realplayer

.rpm=application/x-redhat-package-manager

.rsml=application/vnd.rn-rsml

.rtsp=application/x-rtsp

.rss=application/rss xml

.scm=application/x-icq-scm

.ser=application/java-serialized-object

.scd=application/x-msschedule

.sda=application/vnd.stardivision.draw

.sdc=application/vnd.stardivision.calc

.sdd=application/vnd.stardivision.impress

.sdp=application/x-sdp

.setpay=application/set-payment-initiation

.setreg=application/set-registration-initiation

.sh=application/x-sh

.shar=application/x-shar

.shw=application/presentations

.sit=application/x-stuffit

.sitx=application/x-stuffitx

.skd=application/x-koan

.skm=application/x-koan

.skp=application/x-koan

.skt=application/x-koan

.smf=application/vnd.stardivision.math

.smi=application/smil

.smil=application/smil

.spl=application/futuresplash

.ssm=application/streamingmedia

.sst=application/vnd.ms-pki.certstore

.stc=application/vnd.sun.xml.calc.template

.std=application/vnd.sun.xml.draw.template

.sti=application/vnd.sun.xml.impress.template

.stl=application/vnd.ms-pki.stl

.stw=application/vnd.sun.xml.writer.template

.svi=application/softvision

.sv4cpio=application/x-sv4cpio

.sv4crc=application/x-sv4crc

.swf=application/x-shockwave-flash

.swf1=application/x-shockwave-flash

.sxc=application/vnd.sun.xml.calc

.sxi=application/vnd.sun.xml.impress

.sxm=application/vnd.sun.xml.math

.sxw=application/vnd.sun.xml.writer

.sxg=application/vnd.sun.xml.writer.global

.tar=application/x-tar

.tcl=application/x-tcl

.tex=application/x-tex

.texi=application/x-texinfo

.texinfo=application/x-texinfo

.tbz=application/x-bzip-compressed-tar

.tbz2=application/x-bzip-compressed-tar

.tgz=application/x-compressed-tar

.tlz=application/x-lzma-compressed-tar

.tr=application/x-troff

.trm=application/x-msterminal

.troff=application/x-troff

.tsp=application/dsptype

.torrent=application/x-bittorrent

.ttz=application/t-time

.txz=application/x-xz-compressed-tar

.udeb=application/x-debian-package

.uin=application/x-icq

.urls=application/x-url-list

.ustar=application/x-ustar

.vcd=application/x-cdlink

.vor=application/vnd.stardivision.writer

.vsl=application/x-cnet-vsl

.wcm=application/vnd.ms-works

.wb1=application/x-quattropro

.wb2=application/x-quattropro

.wb3=application/x-quattropro

.wdb=application/vnd.ms-works

.wks=application/vnd.ms-works

.wmd=application/x-ms-wmd

.wms=application/x-ms-wms

.wmz=application/x-ms-wmz

.wp5=application/wordperfect5.1

.wpd=application/wordperfect

.wpl=application/vnd.ms-wpl

.wps=application/vnd.ms-works

.wri=application/x-mswrite

.xfdf=application/vnd.adobe.xfdf

.xls=application/x-msexcel

.xlb=application/x-msexcel

.xpi=application/x-xpinstall

.xps=application/vnd.ms-xpsdocument

.xsd=application/vnd.sun.xml.draw

.xul=application/vnd.mozilla.xul xml

.zoo=application/x-zoo

.zip=application/x-zip-compressed

.wml=text/vnd.wap.wml

.wmlc=application/vnd.wap.wmlc

.wmls=text/vnd.wap.wmlscript

.wmlsc=application/vnd.wap.wmlscriptc

.asm=text/x-asm

.pas=text/x-pascal

.cs=text/x-csharp

.cpp=text/x-c src

.cxx=text/x-c src

.cc=text/x-c src

.hpp=text/x-c hdr

.hxx=text/x-c hdr

.hh=text/x-c hdr

.java=text/x-java

.css=text/css

.js=text/javascript

.htm=text/html

.html=text/html

.ls=text/javascript

.mocha=text/javascript

.shtml=server-parsed-html

.sgm=text/sgml

.sgml=text/sgml

HTTP-EQUIV

()@,;:\"./

()@,;:\"/[]?=

()@,;:\"/[]?={}

X-HTTP-Method-Override

Mozilla/3.0 (compatible; Indy Library)

%d-%d

255.255.255.255

0.0.0.0

0.0.0.1

*#%"{}|\^[]`

HTTPS

https

HTTPONLY=

HTTPONLY

WINDOWS

()[]:;.,@\"

Content-Disposition: form-data; name="%s"

; filename="%s"

Content-Type: %s

; charset="%s"

Content-Transfer-Encoding: %s

libeay32.dll

ssleay32.dll

libssl32.dll

SSL_CTX_use_PrivateKey_file

SSL_CTX_use_PrivateKey

SSL_CTX_use_certificate

SSL_CTX_use_certificate_file

SSL_get_peer_certificate

SSL_CTX_set_default_passwd_cb

SSL_CTX_set_default_passwd_cb_userdata

SSL_CTX_check_private_key

X509_STORE_add_cert

X509_STORE_CTX_get_current_cert

i2d_DSAPrivateKey

d2i_DSAPrivateKey

d2i_PrivateKey

d2i_PrivateKey_bio

DES_set_key

_ossl_old_des_set_key

RSA_generate_key

RSA_check_key

RSA_generate_key_ex

i2d_PrivateKey_bio

i2d_RSAPrivateKey

d2i_RSAPrivateKey

i2d_RSAPublicKey

d2i_RSAPublicKey

i2d_PrivateKey

i2d_NETSCAPE_CERT_SEQUENCE

X509_get_default_cert_file

X509_get_default_cert_file_env

X509_set_pubkey

X509_REQ_set_pubkey

PEM_read_bio_RSAPrivateKey

PEM_read_bio_RSAPublicKey

PEM_read_bio_DSAPrivateKey

PEM_read_bio_PrivateKey

PEM_read_bio_NETSCAPE_CERT_SEQUENCE

PEM_write_bio_RSAPublicKey

PEM_write_bio_DSAPrivateKey

PEM_write_bio_PrivateKey

PEM_write_bio_NETSCAPE_CERT_SEQUENCE

PEM_write_bio_PKCS8PrivateKey

EVP_PKEY_type

EVP_PKEY_new

EVP_PKEY_free

EVP_PKEY_assign

secur32.dll

security.dll

application/x-www-form-urlencoded

HTTP/1.0 200 OK

HTTP/

supports

importNode

hXXp://VVV.w3.org/2001/XMLSchema

%s="%s"

hXXp://VVV.w3.org/2000/xmlns/

%s%s%s: %d%s%s

hXXp://VVV.w3.org/2001/XMLSchema-instance

iKeywordCnt

iKeyword0=

iKeyword

iKeywordCnt=

wininet.dll

ROBIN_TARGET_KWD=

ROBIN_TARGET_KWDS=

InternetExplorer.Application.1

hXXp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

hXXp://

hXXp://auto.search.msn.com/response.asp

hXXp://ieautosearch

hXXp://VVV.mywebsearch.com/jsp/cfg_redir2

google.co.kr/#

D:\svn\codec\TimeAdd_ver3.0_xe2_Syndi.dll\Unit1.pas

hXXp://ad.syndiapi.com/tab/opensearch2.asp?tagkwd=$$query$$&part=$$partcode$$

Content-Type: application/x-www-form-urlencoded

Referer: hXXp://cl.ncclick.co.kr/

hXXp://cl.ncclick.co.kr/KeywordClickLog_EC.asp

cl.ncclick.co.kr,tab.gcodec.co.kr

Date*.Txt

hXXp://ad.syndiapi.com/v4/TagCnt_xe2.asp

hXXp://tab.syndiapi.com/ck.asp

hXXp://ad.syndiapi.com/tab/opensearch2.asp

==> TB_A NavURL ==> "

D:\svn\codec\TimeAdd_ver3.0_xe2_Syndi.dll\ProgramInfo.pas

InternetExplorer.Application

hXXp://search.dreamwiz.co.kr/?part=$$partcode$$&sword=$$query$$&aword=$$adquery$$

hXXp://ad.syndiapi.com/v4/return_rc_r1.asp?tagkwd=$$query$$&part=$$partcode$$&SiteHost=$$SiteHost$$&adtypes=$$adTypes$$

==> HistoryKeywordSave URL ==> "

==> HistoryKeywordSave Result ==> "

hXXp://ad.syndiapi.com/v4/Xml_nt.asp?part=$$partcode$$&adType=$$adType$$&keywords=$$query$$

hXXp://ad.syndiapi.com/v4/Xml_nto.asp?part=$$partcode$$&adType=$$adType$$&keywords=$$query$$

hXXp://ad.syndiapi.com/v4/Xml_ntb.asp?part=$$partcode$$&adtype=$$adType$$&keywords=$$query$$

hXXp://ad.syndiapi.com/v4/Xml_ck.asp?keywords=$$query$$&part=$$partcode$$&adtype=$$adType$$

ClickUrl

T.txt

S.txt

N.txt

F.txt

C.txt

R.txt

Keyword=

keywords

keyword

search_keyWord

srchKeyword

s_keyword

qKeyword

option.keyword

keywordOrg

field-keywords

sKeyWord

keyval

SaveKeyword_Length

TH_SaveKeyword_Length

NTB_S_SaveKeyword_Length

KeyList_ETAdver.dat

RPCRT4.DLL

D:\svn\codec\TimeAdd_ver3.0_xe2_Syndi.dll\ADTypeThread.pas

hXXp://cl.ncclick.co.kr/KeywordClickLog.asp

Kernel32.dll

Open SSL Support DLL Delphi and C Builder interface

hXXp://VVV.indyproject.org/

1993 - 2009

0123456789

Mismatched paramaters to RegisterChildNodes0Element "%s" does not contain a single text node4DOM Implementation does not support IDOMParseOptions#ItemTag property is not initialized

Node is readonlyCRefresh is only supported if the FileName or XML properties are set

Unsupported transfer type. You can assign only an empty string or one of the following types: 7bit, 8bit, binary, quoted-printable, base64.

Unsupported operation./Could not encode header data using charset "%s")"%s" DOMImplementation already registered

No matching DOM Vendor: "%s"

Node "%s" not found

IDOMNode required.Attributes are not supported on this node type

SSL status: "%s"

%s Alert

%s Read Alert

%s Write Alert

Handshake DonepUnsupported object type. You can assign only one of the following types or their descendants: TStrings, TStream.

Unknown credentials use!Do AcquireCredentialsHandle first"CompleteAuthToken is not supported$Error accepting connection with SSL.

Error creating SSL context. Could not load root certificate.

Could not load certificate.#Could not load key, check password.

The domain controller certificate used for smartcard logon has expired. Please contact your system administrator with the contents of your system event log.

The domain controller certificate used for smartcard logon has been revoked. Please contact your system administrator with the contents of your system event log.IA signature operation must be performed before the user can authenticate.AOne or more of the parameters passed to the function was invalid.DClient policy does not allow credential delegation to target server.bClient policy does not allow credential delegation to target server with NLTM only authentication.1The recipient rejected the renegotiation request.-The required security context does not exist.`The PKU2U protocol encountered an error while attempting to utilize the associated certificates.:The identity of the server computer could not be verified.

Unknown error#SSPI %s returns error #%d(0x%x): %s0SSPI interface has failed to initialise properly

No credential handle acquiredBCan not change credentials after handle aquired. Use Release firstQAn unsupported preauthentication mechanism was presented to the Kerberos package.

The requested operation cannot be completed. The computer must be trusted for delegation and the current user account must be configured to allow delegation.7Client's supplied SSPI channel bindings were incorrect.9The received certificate was mapped to multiple accounts.

SEC_E_NO_KERB_KEY5The certificate is not valid for the requested usage.

The smartcard certificate used for authentication has been revoked. Please contact your system administrator. There may be additional information in the event log.

An untrusted certificate authority was detected While processing the smartcard certificate used for authentication. Please contact your system administrator.

The revocation status of the smartcard certificate used for authentication could not be determined. Please contact your system administrator.lThe smartcard certificate used for authentication was not trusted. Please contact your system administrator.hThe smartcard certificate used for authentication has expired. Please contact your system administrator.

The Kerberos subsystem encountered an error. A service for user protocol request was made against a domain controller which does not support service for user.

An attempt was made by this server to make a Kerberos constrained delegation request for a target outside of the server's realm. This is not supported, and indicates a misconfiguration on this server's allowed to delegate to list. Please contact your administrator.

The revocation status of the domain controller certificate used for smartcard authentication could not be determined. There is additional information in the system event log. Please contact your system administrator.

An untrusted certificate authority was detected while processing the domain controller certificate used for authentication. There is additional information in the system event log. Please contact your system administrator.dA security context was deleted before the context was completed. This is considered a logon failure.mThe client is trying to negotiate a context and the server requires user-to-user but didn't send a TGT reply.aUnable to accomplish the requested task because the local machine does not have any IP addresses.bThe supplied credential handle does not match the credential associated with the security context.]The crypto system or checksum function is invalid because a required function is unavailable.9The number of maximum ticket referrals has been exceeded.KThe local machine must be a Kerberos KDC (domain controller) and it is not.qThe other end of the security negotiation is requires strong crypto but it is not supported on the local machine.5The KDC reply contained more than one principal name.OExpected to find PA data for a hint of what etype to use, but it was not found.

The client certificate does not contain a valid UPN, or does not match the client name in the logon request. Please contact your administrator.-Smartcard logon is required and was not used.!A system shutdown is in progress.'An invalid request was sent to the KDC.DThe KDC was unable to generate a referral for the service requested.:The encryption type requested is not supported by the KDC.DThe supplied message is incomplete. The signature was not verified.lThe credentials supplied were not complete, and could not be verified. The context could not be initialized.1The buffers supplied to a function was too small.

The credentials supplied were not complete, and could not be verified. Additional information can be returned from the context.4The context data must be renegotiated with the peer.'The target principal name is incorrect.:There is no LSA mode context associated with this context.8The clocks on the client and server machines are skewed.;The certificate chain was issued by an untrusted authority.7The message received was unexpected or badly formatted.;An unknown error occurred while processing the certificate.%The received certificate has expired.*The specified data could not be encrypted.*The specified data could not be decrypted.YThe client and server cannot communicate, because they do not possess a common algorithm.

The security context could not be established due to a failure in the requested quality of service (e.g. mutual authentication or delegation).-The token supplied to the function is invalid^The security package is not able to marshall the logon buffer, so the logon attempt has failedNThe per-message Quality of Protection is not supported by the security package?The security context does not allow impersonation of the client

The logon attempt failed;The credentials supplied to the package were not recognized4No credentials are available in the security packageCThe message or signature supplied for verification has been altered8The message supplied for verification is out of sequence3No authority could be contacted for authentication.UThe function completed successfully, but must be called again to complete the contextEThe function completed successfully, but CompleteToken must be calledtThe function completed successfully, but both CompleteToken and this function must be called to complete the contextsThe logon was completed, but no network authority was available. The logon was made using locally known information-The requested security package does not exist2The context has expired and can no longer be used.

Unknown Protocol(Request method requires HTTP version 1.1KUnsupported hash algorithm. This implementation supports only MD5 encoding.

The handle specified is invalid'The function requested is not supported.The specified target is unknown or unreachable0The Local Security Authority cannot be contacted-The requested security package does not exist6The caller is not the owner of the desired credentialsBThe security package failed to initialize, and cannot be installed

Transparent proxy cannot bind. UDP Not supported by this proxy.$Buffer terminator must be specified.!Buffer start position is invalid.$Cannot change a connected IOHandler.%No IOHandler of type %s is installed.

Reply Code is not valid: %s

Reply Code already exists: %s

IOHandler value is not valid'Algorithm %s not permitted in FIPS mode

Command not supported.

Address type not supported."%d: Circular links are not allowed"Not enough data in buffer. (%d/%d)

File "%s" not found

Object type not supported.

End of stream: Class %s at %d)UDP is not support in this SOCKS version.

Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.

Stack already created.1Only one TIdAntiFreeze can exist per application.&Cannot change IPVersion when connected$Can not bind in port range (%d - %d)

Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.

Invalid Port Range (%d - %d)

%s is not a valid service.

%s is not a valid IPv6 address:The requested IPVersion / Address family is not supported.

Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.

Operation would block.

Operation now in progress.

Operation already in progress.

Socket operation on non-socket.

Protocol not supported.

Socket type not supported."Operation not supported on socket.

Protocol family not supported.0Address family not supported by protocol family.

%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s4Failed attempting to retrieve time zone information.-Error on call to Winsock2 library function %s&Error on loading Winsock2 library (%s)

Resolving hostname %s.

Connecting to %s.

Socket Error # %d

Style '%s' not found

Style class '%s' not found

Invalid style format)Class '%s' is already registered for '%s'%Class '%s' is not registered for '%s'

%s parameter cannot be nil#Feature not supported by this style

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

DCOM not installed"'%s' is not a valid property value

OLE control activation failed*Could not obtain OLE control window handleLError loading dock zone from the stream. Expecting version %d, but found %d.7Length of value array must be >= length of prompt array

&Password

LoginÃŠnnot remove shell notification icon"%s requires Windows Vista or later

Button%d

RadioButton%d

Unable to load style '%s'

Unable to load styles: %s

Style '%s' already registered#Style class '%s' already registered

Value must be between %d and %d

All Clipboard does not support Icons

Cannot open clipboard: %s

Text exceeds memo capacity Operation not supported on selected printer.There is no default printer currently selected/Menu '%s' is already being used by another form

%s on %s@GroupIndex cannot be less than a previous menu item's GroupIndex5Cannot create form. No MDI forms are currently active0Can only modify an image if it contains a bitmap*A control cannot have itself as its parent

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window$Parent given is not a parent of '%s'

%s property out of range

Scan line index out of range!Cannot change the size of an iconÃŠnnot change the size of a WIC Image Invalid operation on TOleGraphic$Unknown picture file extension (.%s)

Unsupported clipboard format

Canvas does not allow drawing#Text format flag '%s' not supported

Windows Vista

Windows Server 2008

Windows 7

Windows Server 2008 R2

Windows 2000

Windows XP

Windows Server 2003

Windows Server 2003 R2

Observer is not supportedLCannot have multiple single cast observers added to the observers collection4The object does not implement the observer interfaceGNo single cast observer with ID %s was added to the observer collectionFNo multi cast observer with ID %s was added to the observer collection

#''%s'' is not a valid integer value

''%s'' is not a valid time

No help found for context %d

No help found for %s

Duplicates not allowed,Specified Login Credential Service not found"%s (Version %d.%d, Build %d, %5:s):%s Service Pack %4:d (Version %1:d.%2:d, Build %3:d, %5:s)

The path format is not supported The specified file was not found$No help viewer that supports filters7String index out of range (%d). Must be >= 1 and

Invalid Timeout value: %s

Timespan too longbThe duration cannot be returned because the absolute value exceeds the value of TTimeSpan.MaxValue

''%s'' is not a valid date#''%s'' is not a valid date and time$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)-Cannot terminate an externally created thread,Cannot wait for an externally created thread2Cannot call Start on a running or suspended thread;Cannot call CheckTerminated on an externally created thread9Cannot call SetReturnValue on an externally create thread'Parameter %s cannot be a negative value*Input buffer exceeded for %s = %d, %s = %d

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream)%s has not been registered as a COM class

Error reading %s%s%s: %s

Failed to create key %s

Failed to get data for '%s'

Failed to set data for '%s'

Resource %s not found

%s.Seek not implemented

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s

Unable to write to %s

Invalid file name - %s

Invalid stream format$''%s'' is not a valid component name

Invalid destination array"Character index out of bounds (%d)

Start index out of bounds (%d)

Invalid count (%d)

Invalid destination index (%d)

Ancestor for '%s' not found

Operation not supported

External exception %x

Interface not supported

Object lock not owned(Monitor support function not initialized

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

%s"Variant method calls not supported

Invalid variant operation

Invalid NULL variant operation%Invalid variant operation (%s%.8x)

%s,Custom variant type (%s%.4x) is out of range/Custom variant type (%s%.4x) already used by %s*Custom variant type (%s%.4x) is not usable2Too many custom variant types have been registered5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

('%s' is not a valid floating point value '%d.%d' is not a valid timestamp

'%s' is not a valid GUID value!'%s' is not a valid boolean value

I/O error %d