PUPYahooCompanion.YR, SearchProtectToolbar.YR, PUPAirInstaller.YR (Lavasoft MAS)Behaviour: Installer, PUP
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 32ad762111b95f3fcb816f7184caba86
SHA1: 068d381a0969ac21e74c69d462263cc02c6e06bf
SHA256: 9ef87a8c36874074ddc3e2e5d93dd53bd322a5afc05ac8c764bdb4f77bfdb63b
SSDeep: 49152:PvlwvmA2vDTXj5lppfNH5DlhsZCTu6JLPa:PvQmAy5lDnsZmPa
Size: 2152448 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: SafeInstall, LLC
Created at: 2015-02-09 19:29:11
Analyzed on: WindowsXP SP3 32-bit
Summary: PUP. Potentially Unwanted Program. An application that does not display malicious behavior yet is installed without having first sought affirmative user consent for installation. Users may not realize, due to the nature of the installation procedure, that an application they have not explicitly agreed to has been installed. This category can also be used to classify other applications which in a certain context can be wanted e.g. remote administration tools or IRC clients.
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The PUP creates the following process(es):No processes have been created.The PUP injects its code into the following process(es):
%original file name%.exe:880
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:880 makes changes in the file system.
The PUP creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\5C22ACAC-4D3A-4D89-9980-81FBB493E7B8.zip (888 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\AFB3988D-640F-43BB-8422-D40ED6AA32BE.zip (820 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\404D0823-2D00-44F7-AC98-92F79F87E4F2.zip (778 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\F80287B7-718C-4676-AC71-3F1AB04A60E1.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\80A3CCD4-64BC-4AF8-853B-ABA075AE5218.zip (866 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\441493C8-0E32-4504-B8CC-7851FFF110EC.zip (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\4FFA1EE1-2AD7-40C8-9643-B801D9DED1A0.zip (804 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\ECBFC9AB-A637-4487-9A66-817881951C55.zip (904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\32ad762111b95f3fcb816f7184caba86.log (172863 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\00EB7EC2-4B2C-4603-9043-79A1C36414EE.zip (422 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\226383C9-5E0D-4ABD-8308-30F31DD040A6.zip (666 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\7E447291-0A05-4EB1-98E9-49ECF3C139D1.zip (834 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8XO3O5CA\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\099AEF6E-E690-4A5C-85F8-481343649504.zip (809 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\theanswerfinder.vi.zip (838 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\1D677809-65E4-4CBA-B3B2-1705755F5F07.zip (434 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\4594AF2F-4D07-4B39-B15B-443A87882878.zip (732 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\225E5BB2-B83F-478E-B774-62F53C2BCAD7.zip (858 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\7BAB633E-6C2D-45CC-BFE3-A79142FDABBF.zip (507 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\F3823C96-34C1-478F-BA9E-3F84F3D6094F.zip (787 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\7D03F38F-AF42-4EAB-837C-E8B4B2D9B644.zip (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\B7109C6A-73CA-4979-B038-5AE45CBE649F.zip (811 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\F3DA0320-7EB0-4648-BE62-3B08958C9B3E.zip (920 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\0393A455-8396-4E79-8339-7DAEDC83567B.zip (801 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\66DFABC3-9023-45A3-A5DE-FA8CAAEF0AAC.zip (856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\AD04DC3C-8B12-4879-83E3-523DF600D9DE.zip (968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\2704D408-C40A-4848-BC30-B5478423E8C9.zip (821 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IALSJMJ9\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\stub.xml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\8C58D003-E863-4399-A7CF-A32275393FD1.zip (412 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\B2B00637-BC0D-48D8-B686-9F13DA5E04A1.zip (822 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\mediaplayer_12478.txt (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\C4B20519-3B35-4A1C-BB5C-695D80D9C28D.zip (926 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SymCCIS.dll (11704 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\session.response.json (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\E92D7B47-33AD-4469-81D4-CB551DE8DDA8.zip (889 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\55997C50-1F00-4D74-BAEF-46A658272B17.zip (971 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\9332870F-9082-4684-AFF2-8C852FCEE8D7.zip (747 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\3927F92B-2CF0-4555-8A62-C42865E873C2.zip (936 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\AF33782B-57D0-466B-831D-0CE47455F809.zip (892 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\1E00B2CE-84B4-4764-A567-81130045EEE4.zip (739 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\13D66679-5DC0-48AA-BB42-E7BD34CEBAE2.zip (889 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\9N5BLK62\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\73EB1E3A-0BE4-4F19-8F38-6B2B93DB1927.zip (939 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\D21384DD-7E7F-4D84-9C43-6D82036FA24F.zip (9352 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\F5C1E3BE-C571-4295-82AB-9C78A7DFD0BA.zip (823 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SymCCIS2.zip (162 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\224505F1-4910-4879-A9AD-B70D1AE1A120.zip (904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\42FDD0AA-EAD7-45DD-8421-47492FCFF9DB.zip (941 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\B88FF7FD-BE0E-44BC-97BC-D6943F9F8A86.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\config.xml (17904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\E9E56BE3-7EC7-450B-9C2E-BA9B0BCD6B05.zip (817 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\BF68CAAA-24EB-4A90-94B1-A68D8718116D.zip (731 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\DF86C614-36F8-4BE3-A1A0-78E774802EE7.zip (928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\2E076E93-E171-4F73-A0D5-5BFDDE0E4783.zip (792 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\NPU513SG\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\8BF6320F-C08A-446A-80A8-FBCCDBA35CB7.zip (804 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\B7F6A91D-8542-4B59-A285-EF08E6922F28.zip (883 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\BB13E620-1EBA-47D8-A623-39986DE12F1F.zip (790 bytes)
Registry activity
The process %original file name%.exe:880 makes changes in the system registry.
The PUP creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\InstallIQ]
"test" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "75 12 05 77 82 36 D6 3C 4A D0 5B 95 86 81 5A 27"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The PUP modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The PUP modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The PUP modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The PUP deletes the following registry key(s):
[HKLM\SOFTWARE\InstallIQ]
The PUP deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
[HKLM\SOFTWARE\InstallIQ]
"test"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
Dropped PE files
MD5 | File path |
---|---|
6bec059e9f70b59873807c4f2a72a8b5 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\SymCCIS.dll |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original PUP file.
- Delete or disinfect the following files created/modified by the PUP:
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\5C22ACAC-4D3A-4D89-9980-81FBB493E7B8.zip (888 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\AFB3988D-640F-43BB-8422-D40ED6AA32BE.zip (820 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\404D0823-2D00-44F7-AC98-92F79F87E4F2.zip (778 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\F80287B7-718C-4676-AC71-3F1AB04A60E1.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\80A3CCD4-64BC-4AF8-853B-ABA075AE5218.zip (866 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\441493C8-0E32-4504-B8CC-7851FFF110EC.zip (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\4FFA1EE1-2AD7-40C8-9643-B801D9DED1A0.zip (804 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\ECBFC9AB-A637-4487-9A66-817881951C55.zip (904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\32ad762111b95f3fcb816f7184caba86.log (172863 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\00EB7EC2-4B2C-4603-9043-79A1C36414EE.zip (422 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\226383C9-5E0D-4ABD-8308-30F31DD040A6.zip (666 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\7E447291-0A05-4EB1-98E9-49ECF3C139D1.zip (834 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8XO3O5CA\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\099AEF6E-E690-4A5C-85F8-481343649504.zip (809 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\theanswerfinder.vi.zip (838 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\1D677809-65E4-4CBA-B3B2-1705755F5F07.zip (434 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\4594AF2F-4D07-4B39-B15B-443A87882878.zip (732 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\225E5BB2-B83F-478E-B774-62F53C2BCAD7.zip (858 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\7BAB633E-6C2D-45CC-BFE3-A79142FDABBF.zip (507 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\F3823C96-34C1-478F-BA9E-3F84F3D6094F.zip (787 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\7D03F38F-AF42-4EAB-837C-E8B4B2D9B644.zip (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\B7109C6A-73CA-4979-B038-5AE45CBE649F.zip (811 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\F3DA0320-7EB0-4648-BE62-3B08958C9B3E.zip (920 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\0393A455-8396-4E79-8339-7DAEDC83567B.zip (801 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\66DFABC3-9023-45A3-A5DE-FA8CAAEF0AAC.zip (856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\AD04DC3C-8B12-4879-83E3-523DF600D9DE.zip (968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\2704D408-C40A-4848-BC30-B5478423E8C9.zip (821 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IALSJMJ9\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\stub.xml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\8C58D003-E863-4399-A7CF-A32275393FD1.zip (412 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\B2B00637-BC0D-48D8-B686-9F13DA5E04A1.zip (822 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\mediaplayer_12478.txt (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\C4B20519-3B35-4A1C-BB5C-695D80D9C28D.zip (926 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SymCCIS.dll (11704 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\session.response.json (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\E92D7B47-33AD-4469-81D4-CB551DE8DDA8.zip (889 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\55997C50-1F00-4D74-BAEF-46A658272B17.zip (971 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\9332870F-9082-4684-AFF2-8C852FCEE8D7.zip (747 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\3927F92B-2CF0-4555-8A62-C42865E873C2.zip (936 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\AF33782B-57D0-466B-831D-0CE47455F809.zip (892 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\1E00B2CE-84B4-4764-A567-81130045EEE4.zip (739 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\13D66679-5DC0-48AA-BB42-E7BD34CEBAE2.zip (889 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\9N5BLK62\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\73EB1E3A-0BE4-4F19-8F38-6B2B93DB1927.zip (939 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\D21384DD-7E7F-4D84-9C43-6D82036FA24F.zip (9352 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\F5C1E3BE-C571-4295-82AB-9C78A7DFD0BA.zip (823 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SymCCIS2.zip (162 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\224505F1-4910-4879-A9AD-B70D1AE1A120.zip (904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\42FDD0AA-EAD7-45DD-8421-47492FCFF9DB.zip (941 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\B88FF7FD-BE0E-44BC-97BC-D6943F9F8A86.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\config.xml (17904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\E9E56BE3-7EC7-450B-9C2E-BA9B0BCD6B05.zip (817 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\BF68CAAA-24EB-4A90-94B1-A68D8718116D.zip (731 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\DF86C614-36F8-4BE3-A1A0-78E774802EE7.zip (928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\2E076E93-E171-4F73-A0D5-5BFDDE0E4783.zip (792 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\NPU513SG\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\8BF6320F-C08A-446A-80A8-FBCCDBA35CB7.zip (804 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\B7F6A91D-8542-4B59-A285-EF08E6922F28.zip (883 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_17269ab0\BB13E620-1EBA-47D8-A623-39986DE12F1F.zip (790 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name: SafeInstall, LLC
Product Name: SafeInstaller
Product Version: 1.0.72.0
Legal Copyright: Copyright (C) 2014
Legal Trademarks:
Original Filename: safeinstall.exe
Internal Name: SafeInstaller
File Version: 1.0.72.0
File Description: Safe Installer
Comments:
Language: English (United States)
Company Name: SafeInstall, LLCProduct Name: SafeInstallerProduct Version: 1.0.72.0Legal Copyright: Copyright (C) 2014Legal Trademarks: Original Filename: safeinstall.exeInternal Name: SafeInstallerFile Version: 1.0.72.0File Description: Safe InstallerComments: Language: English (United States)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 494937 | 495104 | 4.49559 | 79f82a13a49c4af97e56105203db816e |
.text-qu | 499712 | 3923 | 4096 | 4.19142 | c228b851da5948298b88d0f68be44c9c |
.text-co | 503808 | 88205 | 88576 | 4.48498 | 2f42aaee8fba0023ededca09590de4fb |
.text-co | 593920 | 75433 | 75776 | 4.46199 | bec45236b00d2c6df3523d3abeae3c59 |
.text-co | 671744 | 48588 | 48640 | 4.49726 | bbc1d90a9748a63315478d95a33581ab |
.text-co | 720896 | 14904 | 15360 | 4.40895 | 549da5eaa45276aef072ae9d0d48fac2 |
.text-co | 737280 | 27320 | 27648 | 4.61595 | cb725a9e61efca91b39ed98e633883c3 |
.text-co | 765952 | 10272 | 10752 | 4.36435 | 35783d34da5aea49ae9ae220f91dc23e |
.text-co | 778240 | 263610 | 263680 | 4.59722 | 6130032b23e5b050f7ef6e091de45279 |
.text-ti | 1044480 | 43367 | 43520 | 4.58486 | 8592313570f96ea9a1561a479718e67a |
.text-co | 1089536 | 16103 | 16384 | 4.37497 | f049073835c36de1a89968d36253ad67 |
.text-co | 1105920 | 59 | 512 | 0.606205 | fd9b2190e38582cf67313d0dd565b92b |
.text-co | 1110016 | 12737 | 12800 | 4.42102 | fff94e8753aacfac54a8e2f4400a0b1e |
.rdata | 1126400 | 266756 | 267264 | 3.8846 | 08eafd22a21d685373e8bbfdd4a5c06f |
.data | 1396736 | 27492 | 17408 | 3.39538 | 47aaca79819f8c4e6b08107eac1eb3f9 |
.data-qu | 1425408 | 41 | 512 | 0 | bf619eac0cdf3f68d496ea9344137e8b |
.data-co | 1429504 | 188 | 512 | 0 | bf619eac0cdf3f68d496ea9344137e8b |
.data-co | 1433600 | 56 | 512 | 0.042395 | 1e293257cf493bcacc1f9d4b65c50fe8 |
.data-co | 1437696 | 40 | 512 | 0 | bf619eac0cdf3f68d496ea9344137e8b |
.data-co | 1441792 | 44 | 512 | 0.014135 | 2d5fe836dd5a60fa37b7c590cfc70410 |
.data-co | 1445888 | 41 | 512 | 0 | bf619eac0cdf3f68d496ea9344137e8b |
.data-co | 1449984 | 40 | 512 | 0 | bf619eac0cdf3f68d496ea9344137e8b |
.data-co | 1454080 | 2932 | 3072 | 1.35606 | dcd991a144b39f17d95b47640f8edfb7 |
.data-ti | 1458176 | 1176 | 1536 | 1.01305 | 3b2768e897e8ea9ee1bf5c4827ee3ac6 |
.data-co | 1462272 | 40 | 512 | 0 | bf619eac0cdf3f68d496ea9344137e8b |
.data-co | 1466368 | 4 | 512 | 0.014135 | d340f23a7d18057bb02252a3cb40b877 |
.data-co | 1470464 | 40 | 512 | 0 | bf619eac0cdf3f68d496ea9344137e8b |
.rsrc | 1474560 | 748856 | 749056 | 5.36258 | f00e15df3beae2308a8048d2fed5b505 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://volumedl.com/d11776f7-4f4f-42e3-84c1-1d4e8fbd07f2/b24047c8-d6f6-4f46-bac7-944d68214054 | 66.77.96.162 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
POST /d11776f7-4f4f-42e3-84c1-1d4e8fbd07f2/b24047c8-d6f6-4f46-bac7-944d68214054 HTTP/1.1
Content-Type: application/json; charset=utf-8
Accept: application/json;
installerversion: 1
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
Host: volumedl.com
Content-Length: 602
Cache-Control: no-cache
{"Content":"FrsQsDi7LOYAjhttwW2VRdfK0jpCMx3l6iYIV8EoK8i0kUoGpMvGcZkgQ9Ig6ErVm8q9vwcP5 NP ejJBPWcg7SgVCIOovjGgpqJn9EgqJJIUGzpE4syxwleaPmYZzck34wLUtT4IG8O3zq/J/I7pYkrum IqGMpKaxlvr8GaJBY4X8deuIataUdn ODlTVO9la0ZhanY5RtQKhLkfnB2SF/AhPjgCyxge4PXYPR1xc5RYl9e9ceEdBfOpe2e7M5rQJIvOdtjz9FtObPH3NIkOrt9Zoh8QGOAQDU4o RvUNYzB/VM0brhDaBqLbQauoAlS5Dxy1TB4fTvFlMmW4fWF1PmL0hvHRyBRu14esOfAOR5ZdJKGOGikv53EaBYnxvMWOtpjxEMmK9fhiV snVFqW6G95QftF1uvABKGFGJdCji4IvurCt0tWJZSXjTzv6hwK3MjhkeQ lMq4A3AO8KDrSnRfVJNbkYQoj4LXz18EQ5T6nxQj1cASbt6M4yY06eV ENQCpTwK/Z0myfob75FW0yCCczwC4be0LbM68BUKA6MiznGb1z 1JBCIBO3fYnJwd4okWwCwC"}
HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: application/json; charset=utf-8
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
P3P: CP="PSA OUR DEM"
X-Robots-Tag: noindex, nofollow
Set-Cookie: dtCookie=3$EB593FE8F7E7AD6D0F858E2FD733DD76|volumedl.com|1; Path=/; Domain=.volumedl.com
Date: Sun, 08 Mar 2015 23:38:19 GMT
Content-Length: 22762
{"Content":"FrsBtCa7IuEUhXc21yrUEJuOl39kKRPj9wcHGJ5xM4e2mloH54GZPMIyVJVn6CCWxILqpRY94KM8r/rCHOiS1ZSxUCgPrv7gkcvW3Mcu64IvF0OuW9oS7UU7Lo3DJnNt3/9HF4LkYCEbxAK9IPM 6N0r6DnN9mkoMegk4uhHL7tnhnhQLe0Op94ZkafcwiId2x hbRO4bOxtTKsvzeOfjjx1VAaixD/o1qMKHZKbkVQ1TIFxfcEJBIYNYI 3d7Q rVka7OdtgzIX4P XTC9Ljbbk54Uw4AvNFlCBs8bI7U0ImUrOIkD232net7fbduNHy3dUlXASH96Q4FQewWkIC0wE1Lh6tCs4WEyi7fcAeFOW8J9JIHyXmkr4hBvRNjs6O2b4/moBcibiKUTB9ceeQbu1UYtGaZVj6rQDc3YRdNazh9I paD5kYvEdTXlQnWpywGqImpkexH/f5IUwwO2MFvXlB dVYK4JQYbhaHg89ZS9Czwjlbjc23TuIpk0cwtb3T1cx27egLnIx ma4i3jkH3vCfNg0y3fJxUN4z8Uh3AtNaj jK91eFaeQYTc2K7mNJEpcNDhSV..
Map
The PUP connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_880:
.text
.text
`.text-quS
`.text-quS
`.text-co
`.text-co
`.text-co8:
`.text-co8:
`.text-co (
`.text-co (
`.text-tig
`.text-tig
`.text-co;
`.text-co;
`.rdata
`.rdata
@.data
@.data
.data-qu)
.data-qu)
.data-co
.data-co
.data-co8
.data-co8
.data-co(
.data-co(
.data-co,
.data-co,
.data-co)
.data-co)
.data-cot
.data-cot
.data-ti
.data-ti
.rsrc
.rsrc
CSShZ
CSShZ
t.ShPvR
t.ShPvR
CSSh4
CSSh4
CSSh9
CSSh9
CSSh>
CSSh>
CSShl
CSShl
CSSh[
CSSh[
CSSh`
CSSh`
<:>
<:>
t8Ht.HHt#
t8Ht.HHt#
.FGy1
.FGy1
Af;FP}%S3
Af;FP}%S3
|$|.tD
|$|.tD
#t.Ht
#t.Ht
2 34 567
2 34 567
u.SSV
u.SSV
1t.Ht
1t.Ht
9sxv%UW
9sxv%UW
function not supported
function not supported
operation canceled
operation canceled
address_family_not_supported
address_family_not_supported
operation_in_progress
operation_in_progress
operation_not_supported
operation_not_supported
protocol_not_supported
protocol_not_supported
operation_would_block
operation_would_block
address family not supported
address family not supported
broken pipe
broken pipe
inappropriate io control operation
inappropriate io control operation
not supported
not supported
operation in progress
operation in progress
operation not permitted
operation not permitted
operation not supported
operation not supported
operation would block
operation would block
protocol not supported
protocol not supported
operator
operator
GetProcessWindowStation
GetProcessWindowStation
Operation not permitted
Operation not permitted
Inappropriate I/O control operation
Inappropriate I/O control operation
Broken pipe
Broken pipe
0xX
0xX
Invalid CRT parameter
Invalid CRT parameter
QuickStartApp.cpp
QuickStartApp.cpp
vi.engine.xml
vi.engine.xml
chk_firefox
chk_firefox
chk_chrome
chk_chrome
OfferManager.cpp
OfferManager.cpp
position=%d, active=%d
position=%d, active=%d
%s[%d]
%s[%d]
%d,%d,%d
%d,%d,%d
** Debug mode: simulating stopping Firefox
** Debug mode: simulating stopping Firefox
** Debug mode: simulating stopping Chrome
** Debug mode: simulating stopping Chrome
%s must be closed before continuing. Press OK to close %s now. You may need to close %s manually.
%s must be closed before continuing. Press OK to close %s now. You may need to close %s manually.
Firefox
Firefox
Google Chrome
Google Chrome
%d err: %s
%d err: %s
Chrome
Chrome
firefox
firefox
chrome
chrome
opera
opera
sxexaxrxcxhxpxrxoxtxexcxtxoxrx.xexxxex
sxexaxrxcxhxpxrxoxtxexcxtxoxrx.xexxxex
view=%d,sel=%d,inst=%d,conf=%d,can=%d,err=%d,eid=%d,pos=%d,%s
view=%d,sel=%d,inst=%d,conf=%d,can=%d,err=%d,eid=%d,pos=%d,%s
control.txt
control.txt
00000000-0000-0000-0000-000000000000
00000000-0000-0000-0000-000000000000
QuickStartProcess.cpp
QuickStartProcess.cpp
%programfiles%\Free Offers from Freeze.com
%programfiles%\Free Offers from Freeze.com
disabling offer because system doesn't have Firefox
disabling offer because system doesn't have Firefox
disabling offer because system doesn't have Chrome
disabling offer because system doesn't have Chrome
%s[%s]: view=%s accept=%s
%s[%s]: view=%s accept=%s
%s,%s
%s,%s
WindowsErrorCode
WindowsErrorCode
targetbrowser/key
targetbrowser/key
%s:v=%s,id=%s,rc=%d,f=%d,e=%d,i=%s,p=%s,pb=%s,ex=%s,tr=%s,px=%d
%s:v=%s,id=%s,rc=%d,f=%d,e=%d,i=%s,p=%s,pb=%s,ex=%s,tr=%s,px=%d
%s:v=%s,rc=%d,os=%s,%s,%s|ie=%s
%s:v=%s,rc=%d,os=%s,%s,%s|ie=%s
%d,%d,%s,%s,%s,%s
%d,%d,%s,%s,%s,%s
%d,%d,%d,%d,%d
%d,%d,%d,%d,%d
%d,%d,%s,%s,%s,%s,%s
%d,%d,%s,%s,%s,%s,%s
%d,%s,%s,%s,%s,%d,%d,%d,%d,%d,%d,%d,%d,%s,%s,%d,%s
%d,%s,%s,%s,%s,%d,%d,%d,%d,%d,%d,%d,%d,%s,%s,%d,%s
offers
offers
%s,%s,%s,%s,%s,%s,%s,%s
%s,%s,%s,%s,%s,%s,%s,%s
%s,%d,%s,%s
%s,%d,%s,%s
%s,%s,%u,%u,%d,%s
%s,%s,%u,%u,%d,%s
Unable to open thankyou page; url is empty or invalid!
Unable to open thankyou page; url is empty or invalid!
statsd.response.txt
statsd.response.txt
Web.Installer.VDI.CommError
Web.Installer.VDI.CommError
Web.Installer.VDI.InstallError
Web.Installer.VDI.InstallError
Web.Installer.VDI.OfferDownloadError
Web.Installer.VDI.OfferDownloadError
Web.Installer.VDI.OfferInstallError
Web.Installer.VDI.OfferInstallError
Web.Installer.VDI.OfferInstallFailed
Web.Installer.VDI.OfferInstallFailed
hxtxtxpx:x/x/xdxlx2x.xvx4x7xixnxsxtxaxlxlxexrx.xcxoxmx/xlxmx/xbxuxnxdxlxexsx/xkxexexpxmxyxsxextxtxixnxgxsxxx/xkxexexpxmxyxsxextxtxixnxgxsxxx.xzxixpx
hxtxtxpx:x/x/xdxlx2x.xvx4x7xixnxsxtxaxlxlxexrx.xcxoxmx/xlxmx/xbxuxnxdxlxexsx/xkxexexpxmxyxsxextxtxixnxgxsxxx/xkxexexpxmxyxsxextxtxixnxgxsxxx.xzxixpx
hxtxtxpx:x/x/xsxdxsxpxaxpxix.xcxoxmx/xaxpxix/xvxaxlxuxexsx
hxtxtxpx:x/x/xsxdxsxpxaxpxix.xcxoxmx/xaxpxix/xvxaxlxuxexsx
hXXps://search.yahoo.com/yhs/web?hspart=w3i&hsimp=yhs-syctransfer&type=W3i_DS,221,0_0,Search,20140522,19669,0,FF29,7635
hXXps://search.yahoo.com/yhs/web?hspart=w3i&hsimp=yhs-syctransfer&type=W3i_DS,221,0_0,Search,20140522,19669,0,FF29,7635
hxtxtxpx:x/x/xdxlx2x.xvx4x7xixnxsxtxaxlxlxexrx.xcxoxmx/xlxmx/xbxuxnxdxlxexsx/xkxexexpxmxyxsxextxtxixnxgxsxxx/xsxpxvx1x.xzxixpx
hxtxtxpx:x/x/xdxlx2x.xvx4x7xixnxsxtxaxlxlxexrx.xcxoxmx/xlxmx/xbxuxnxdxlxexsx/xkxexexpxmxyxsxextxtxixnxgxsxxx/xsxpxvx1x.xzxixpx
spv1.zip
spv1.zip
hxtxtxpx:x/x/xvxixnxsxtxaxlxlxexrx.xcxoxmx/xaxpxix/xtxrxaxcxkxoxfxfxexrxixnxsxtxaxlxlxdxextxaxixlxsx
hxtxtxpx:x/x/xvxixnxsxtxaxlxlxexrx.xcxoxmx/xaxpxix/xtxrxaxcxkxoxfxfxexrxixnxsxtxaxlxlxdxextxaxixlxsx
hxtxtxpx:x/x/xvxixnxsxtxaxlxlxexrx.xcxoxmx/xaxpxix/xixnxsxtxaxlxlxexrxrxoxrx
hxtxtxpx:x/x/xvxixnxsxtxaxlxlxexrx.xcxoxmx/xaxpxix/xixnxsxtxaxlxlxexrxrxoxrx
session.response.json
session.response.json
postback.response.json
postback.response.json
vmtest.txt
vmtest.txt
vmtest.txt is present, enbaling offers for vmtest
vmtest.txt is present, enbaling offers for vmtest
config.xml
config.xml
pingurl
pingurl
postbackurl
postbackurl
errorurl
errorurl
statsdurl
statsdurl
uninstalloptionurl
uninstalloptionurl
encryptionkey
encryptionkey
PingUrl
PingUrl
PostbackUrl
PostbackUrl
Config.cpp
Config.cpp
stub.xml
stub.xml
.json
.json
MainWnd.cpp
MainWnd.cpp
.html
.html
OfferThread.cpp
OfferThread.cpp
Setting offer checkbox value: key=
Setting offer checkbox value: key=
COfferExe::GetXpiFilename
COfferExe::GetXpiFilename
g:\winapps\windows\main\installer.quickstart.application\installer.quickstart.lib\OfferExe.h
g:\winapps\windows\main\installer.quickstart.application\installer.quickstart.lib\OfferExe.h
configuration/downloadurl
configuration/downloadurl
configuration/downloadurl.64bit
configuration/downloadurl.64bit
configuration/msie.downloadurl
configuration/msie.downloadurl
configuration/msie.commandline
configuration/msie.commandline
configuration/firefox.downloadurl
configuration/firefox.downloadurl
configuration/firefox.commandline
configuration/firefox.commandline
configuration/chrome.downloadurl
configuration/chrome.downloadurl
configuration/chrome.commandline
configuration/chrome.commandline
configuration/allbrowser.downloadurl
configuration/allbrowser.downloadurl
configuration/allbrowser.commandline
configuration/allbrowser.commandline
configuration/regkeyadd
configuration/regkeyadd
regkeyadd
regkeyadd
configuration/ieregkey
configuration/ieregkey
ieregkey
ieregkey
configuration/firefox.pref
configuration/firefox.pref
firefox.pref
firefox.pref
configuration/firefox.xpimethod
configuration/firefox.xpimethod
configuration/firefox.xpilocation
configuration/firefox.xpilocation
configuration/firefox.xpidelete
configuration/firefox.xpidelete
LUA account detected, and flag lua_runasdesktopuser detected, forcing executeAsDesktopUser
LUA account detected, and flag lua_runasdesktopuser detected, forcing executeAsDesktopUser
configuration/iconurl
configuration/iconurl
adding %s entry, ourVal='%s', theirVal='%s'
adding %s entry, ourVal='%s', theirVal='%s'
COfferExe::Download
COfferExe::Download
Download url is empty!
Download url is empty!
_firefox is NULL!
_firefox is NULL!
COfferExe::OnInstall
COfferExe::OnInstall
Install is a dropfile; no exe to run...
Install is a dropfile; no exe to run...
Icon offer (in exe config) detected, running icon install
Icon offer (in exe config) detected, running icon install
COfferExe::Run
COfferExe::Run
COfferExe::HandleFirefoxOptions
COfferExe::HandleFirefoxOptions
firefoxoffer
firefoxoffer
HandleFirefoxOptions called with incorrect preferences set in config!
HandleFirefoxOptions called with incorrect preferences set in config!
COfferExe::BuildCommandLine
COfferExe::BuildCommandLine
msiexec.exe /i "%s" /qn ALLUSERS=2 REBOOT=ReallySuppress
msiexec.exe /i "%s" /qn ALLUSERS=2 REBOOT=ReallySuppress
msiexec.exe /i "%s" %s
msiexec.exe /i "%s" %s
Could not find firefox exe to install
Could not find firefox exe to install
Offer is installing XPI for Firefox 8 or higher, enabling GUI.
Offer is installing XPI for Firefox 8 or higher, enabling GUI.
"%s" "%s"
"%s" "%s"
"%s" %s
"%s" %s
COfferExe::RunSearchProtectInstall
COfferExe::RunSearchProtectInstall
COfferExe::WaitForInstallProcess
COfferExe::WaitForInstallProcess
OfferExe.cpp
OfferExe.cpp
COfferExe::WaitForProcessStarted
COfferExe::WaitForProcessStarted
waiting for registry key:
waiting for registry key:
COfferExe::WaitForRegistryValue
COfferExe::WaitForRegistryValue
Registry key found.
Registry key found.
Registry key found (64-bit).
Registry key found (64-bit).
COfferExe::WaitForFile
COfferExe::WaitForFile
COfferExe::InstallXpi
COfferExe::InstallXpi
Bad RegKeyAdd config; not correct format: (missing hive \ )
Bad RegKeyAdd config; not correct format: (missing hive \ )
Bad RegKeyAdd config; not correct format: (missing , )
Bad RegKeyAdd config; not correct format: (missing , )
Bad RegKeyAdd config; not correct format: (missing = )
Bad RegKeyAdd config; not correct format: (missing = )
unable to set regkey from following RegKeyAdd:
unable to set regkey from following RegKeyAdd:
RegKeyAdd:
RegKeyAdd:
unrecognized values in RegKeyAdd:
unrecognized values in RegKeyAdd:
unable to set regkey from following IERegKey:
unable to set regkey from following IERegKey:
IERegKeyAdd:
IERegKeyAdd:
unrecognized values in IERegKey:
unrecognized values in IERegKey:
COfferExe::FinishXpiInstall
COfferExe::FinishXpiInstall
COfferExe::CancelXpiInstall
COfferExe::CancelXpiInstall
COfferExe::RunIconInstall
COfferExe::RunIconInstall
%s_%s.url
%s_%s.url
configuration/url
configuration/url
configuration/msie.url
configuration/msie.url
configuration/firefox.url
configuration/firefox.url
configuration/firefox.newtaburl
configuration/firefox.newtaburl
configuration/chrome.extensionid
configuration/chrome.extensionid
configuration/chrome.extensionparam
configuration/chrome.extensionparam
All urls are empty!
All urls are empty!
COfferStartPage::InstallFirefox
COfferStartPage::InstallFirefox
_firefox is NULL!
_firefox is NULL!
** Debug mode: simulated setting Firefox startpage:
** Debug mode: simulated setting Firefox startpage:
Error writing Firefox pref for startpage!
Error writing Firefox pref for startpage!
Error setting Firefox new tab!
Error setting Firefox new tab!
Set new tab in Firefox.
Set new tab in Firefox.
Firefox startpage set successful.
Firefox startpage set successful.
chromeoffer
chromeoffer
COfferStartPage::InstallChrome
COfferStartPage::InstallChrome
_chrome is NULL!
_chrome is NULL!
** Debug mode: simulated setting Chrome startpage:
** Debug mode: simulated setting Chrome startpage:
Error setting Chrome startpage: browser is still running!
Error setting Chrome startpage: browser is still running!
Error writing Chrome pref for startpage!
Error writing Chrome pref for startpage!
Can't set new tab Chrome, function is implemented with Default Search.
Can't set new tab Chrome, function is implemented with Default Search.
Chrome startpage set successful.
Chrome startpage set successful.
OfferStartPage.cpp
OfferStartPage.cpp
startpageurl
startpageurl
oldstartpageurl
oldstartpageurl
hXXp://ff.search.yahoo.com/gossip?output=fxjson&command={searchTerms}
hXXp://ff.search.yahoo.com/gossip?output=fxjson&command={searchTerms}
configuration/msie.searchname
configuration/msie.searchname
configuration/firefox.searchname
configuration/firefox.searchname
configuration/firefox.suggesturl
configuration/firefox.suggesturl
configuration/firefox.selectedengine
configuration/firefox.selectedengine
Error setting IE search: url is empty!
Error setting IE search: url is empty!
Internet Explorer version 6 or older does not support default search!
Internet Explorer version 6 or older does not support default search!
COfferDefaultSearch::InstallFirefox
COfferDefaultSearch::InstallFirefox
** Debug mode: simulated setting Firefox default search:
** Debug mode: simulated setting Firefox default search:
Failed to write Yahoo xml for Firefox!
Failed to write Yahoo xml for Firefox!
Firefox default search set successful.
Firefox default search set successful.
COfferDefaultSearch::InstallChrome
COfferDefaultSearch::InstallChrome
** Debug mode: simulated setting Chrome default search by extension:
** Debug mode: simulated setting Chrome default search by extension:
Failed to install default search extension for chrome!
Failed to install default search extension for chrome!
Chrome default search set successful.
Chrome default search set successful.
OfferDefaultSearch.cpp
OfferDefaultSearch.cpp
searchurl
searchurl
hxtxtxpx:x/x/xdxlx5x.xvx1xixnxsxtxaxlxlxexrx.xcxoxmx/x
hxtxtxpx:x/x/xdxlx5x.xvx1xixnxsxtxaxlxlxexrx.xcxoxmx/x
PingResponse.cpp
PingResponse.cpp
targetbrowser/Key
targetbrowser/Key
PingThread.cpp
PingThread.cpp
offer %s[%s]: isInstalled=%d canShow=%d
offer %s[%s]: isInstalled=%d canShow=%d
rule %s[%s]: isInstalled=%d
rule %s[%s]: isInstalled=%d
QuickStartDetectThread.cpp
QuickStartDetectThread.cpp
ResourceThread.cpp
ResourceThread.cpp
Response/url
Response/url
passed
passed
CRequirementManager::RunExecute
CRequirementManager::RunExecute
CRequirementManager::ParseExecuteResult
CRequirementManager::ParseExecuteResult
invalid flag in execute result:
invalid flag in execute result:
Software\Microsoft\Windows\CurrentVersion\RunOnce
Software\Microsoft\Windows\CurrentVersion\RunOnce
Running requirement.OnInstall:
Running requirement.OnInstall:
Running requirement.OnCancel:
Running requirement.OnCancel:
requirement.OnCancel is empty, skipping.
requirement.OnCancel is empty, skipping.
Running requirement.OnExit:
Running requirement.OnExit:
requirement.OnExit is empty, skipping.
requirement.OnExit is empty, skipping.
%programdata%\W3i\UninstallHelper\iqu.ini
%programdata%\W3i\UninstallHelper\iqu.ini
2.0.1.0
2.0.1.0
%xpxrxoxgxrxaxmxdxaxtxax%x\xWx3xix\xUxnxixnxsxtxaxlxlxHxexlxpxexrx\xixmxpxoxrxtx
%xpxrxoxgxrxaxmxdxaxtxax%x\xWx3xix\xUxnxixnxsxtxaxlxlxHxexlxpxexrx\xixmxpxoxrxtx
quickstart.xml
quickstart.xml
quickstart%d.xml
quickstart%d.xml
Failed to save IQU data, too many import files in directory!
Failed to save IQU data, too many import files in directory!
%xpxrxoxgxrxaxmxfxixlxexsx%x\xWx3xix\xUxnxixnxsxtxaxlxlxHxexlxpxexrx\xUxnxixnxsxtxaxlxlxHxexlxpxexrx.xexxxex
%xpxrxoxgxrxaxmxfxixlxexsx%x\xWx3xix\xUxnxixnxsxtxaxlxlxHxexlxpxexrx\xUxnxixnxsxtxaxlxlxHxexlxpxexrx.xexxxex
quickstart_si.xml
quickstart_si.xml
quickstart_si%d.xml
quickstart_si%d.xml
Failed to save SoftwareInfo data, too many import files in directory!
Failed to save SoftwareInfo data, too many import files in directory!
hxtxtxpx:x/x/xdxlx.xixnxsxtxaxlxlxixqx.xcxoxmx/xAxPxIx/xIxQxUx/xSxoxfxtxwxaxrxexIxnxfxox.xaxsxpxxx
hxtxtxpx:x/x/xdxlx.xixnxsxtxaxlxlxixqx.xcxoxmx/xAxPxIx/xIxQxUx/xSxoxfxtxwxaxrxexIxnxfxox.xaxsxpxxx
UH executable not found!
UH executable not found!
"%s" /silent /noswinfo
"%s" /silent /noswinfo
%s:%d
%s:%d
handling firefox cookies...
handling firefox cookies...
FF.GetCookiesError
FF.GetCookiesError
FF.NoCookies
FF.NoCookies
firefox: no cookies found
firefox: no cookies found
FF.SetCookieError
FF.SetCookieError
FF.SetCookies
FF.SetCookies
firefox: set cookies
firefox: set cookies
getting firefox cookies for
getting firefox cookies for
CCookieManager::GetFirefoxCookies
CCookieManager::GetFirefoxCookies
Error enumerating firefox cookies!
Error enumerating firefox cookies!
firefoxenum
firefoxenum
hXXp://
hXXp://
cookie.dat
cookie.dat
Vista.NoResult
Vista.NoResult
Vista.SavedLow
Vista.SavedLow
Vista.NoCookies
Vista.NoCookies
Vista.CopiedLow
Vista.CopiedLow
%a, %d-%b-%Y %H:%M:%S GMT
%a, %d-%b-%Y %H:%M:%S GMT
cookieman.exe
cookieman.exe
Vista.ExtractError
Vista.ExtractError
Vista.CreateLowError
Vista.CreateLowError
handling chrome cookies
handling chrome cookies
Chrome.GetCookiesError
Chrome.GetCookiesError
Chrome.NoCookies
Chrome.NoCookies
Chrome: no cookies found
Chrome: no cookies found
Chrome.SetCookieError
Chrome.SetCookieError
Chrome.SetCookies
Chrome.SetCookies
Chrome: set cookies succeeded
Chrome: set cookies succeeded
getting Chrome cookies for
getting Chrome cookies for
CCookieManager::GetChromeCookies
CCookieManager::GetChromeCookies
Error enumerating chrome cookies!
Error enumerating chrome cookies!
chromeenum
chromeenum
Safari.GetCookiesError
Safari.GetCookiesError
Safari.NoCookies
Safari.NoCookies
Safari.SetCookieError
Safari.SetCookieError
Safari.SetCookies
Safari.SetCookies
Sending session request, url=
Sending session request, url=
Request url is empty!
Request url is empty!
Request url is invalid!
Request url is invalid!
ErrorLogger.cpp
ErrorLogger.cpp
explorer.exe
explorer.exe
CDialogWindowJson::OnBeforeNavigate2, url=
CDialogWindowJson::OnBeforeNavigate2, url=
DialogWindowJson.cpp
DialogWindowJson.cpp
%s: view=%s accept=%s
%s: view=%s accept=%s
chk_%s=
chk_%s=
checkbox found; %s=%s
checkbox found; %s=%s
adding disclosure(%s): %s
adding disclosure(%s): %s
installedbrowsers/firefox
installedbrowsers/firefox
installedbrowsers/chrome
installedbrowsers/chrome
installedbrowsers/opera
installedbrowsers/opera
view.buildconfig.json
view.buildconfig.json
view.productconfig.json
view.productconfig.json
ProgressDialog.cpp
ProgressDialog.cpp
Installing %d of %d
Installing %d of %d
uninstalloption.exe
uninstalloption.exe
InstallIQFirefoxLock
InstallIQFirefoxLock
configuration/postinstallexecute
configuration/postinstallexecute
configuration/postinstallexecuteintegrity
configuration/postinstallexecuteintegrity
stopfirefox
stopfirefox
stopchrome
stopchrome
disablechromeextensions
disablechromeextensions
/msie.autoconfirm
/msie.autoconfirm
/firefox.autoconfirm
/firefox.autoconfirm
/chrome.autoconfirm
/chrome.autoconfirm
COffer::WaitForFirefoxLock
COffer::WaitForFirefoxLock
Offer.cpp
Offer.cpp
_firefoxLock is already created!
_firefoxLock is already created!
Waiting for Firefox lock...
Waiting for Firefox lock...
Firefox lock status:
Firefox lock status:
Releasing Firefox lock
Releasing Firefox lock
PostInstallExecute:
PostInstallExecute:
iexplore.exe
iexplore.exe
** Debug mode: simulating PostInstallExecute:
** Debug mode: simulating PostInstallExecute:
Cannot run post-install execute, file does not exist:
Cannot run post-install execute, file does not exist:
COffer::PostInstallExecute
COffer::PostInstallExecute
PostInstallExecute command failed!
PostInstallExecute command failed!
http:
http:
Adding UH data: %s|%s,%s
Adding UH data: %s|%s,%s
Failed to extract uninstall option exe!
Failed to extract uninstall option exe!
Error; uninstalloption.exe doesn't exist (after download and extract!)
Error; uninstalloption.exe doesn't exist (after download and extract!)
Error copying uninstalloption.exe to program files!
Error copying uninstalloption.exe to program files!
error downloading uninstall option url!
error downloading uninstall option url!
%programfiles%\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe
%programfiles%\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe
hXXp://airdownload.adobe.com/air/win/download/latest/AdobeAIRInstaller.exe
hXXp://airdownload.adobe.com/air/win/download/latest/AdobeAIRInstaller.exe
"%s" %s "%s"
"%s" %s "%s"
AdobeAirInstaller.exe
AdobeAirInstaller.exe
JsonResponse.cpp
JsonResponse.cpp
%firefoxprofiles%
%firefoxprofiles%
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
Unknown uninstall key type encountered, skipping lookup
Unknown uninstall key type encountered, skipping lookup
HRESULT:0x%X
HRESULT:0x%X
crterr:%d
crterr:%d
Win32Err:%d
Win32Err:%d
@ line %d in function .
@ line %d in function .
wininet.dll
wininet.dll
Unknown error: %d
Unknown error: %d
IDispatch error #%d
IDispatch error #%d
LoadLibrary failed in loading current exe:
LoadLibrary failed in loading current exe:
CoreResource.cpp
CoreResource.cpp
CStringW.GetBuffer failed!
CStringW.GetBuffer failed!
0xx
0xx
%s. {%s} @ line %d in function in module %s.
%s. {%s} @ line %d in function in module %s.
Win32Err:%d
Win32Err:%d
HRESULT:0x%X
HRESULT:0x%X
Error:%d
Error:%d
HttpStatus:%d
HttpStatus:%d
L%d:d.d.d_d:d:d.d
L%d:d.d.d_d:d:d.d
-- %s line %d --
-- %s line %d --
[X]
[X]
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /%d
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /%d
%s_%x%x%x%x%x
%s_%x%x%x%x%x
CoreFile.cpp
CoreFile.cpp
Exception %X in module %s at: 0x%p.
Exception %X in module %s at: 0x%p.
dbghelp.dll
dbghelp.dll
0x%p %s
0x%p %s
CoreProcess.cpp
CoreProcess.cpp
CCoreProcess::ShellExecuteCommand
CCoreProcess::ShellExecuteCommand
ShellExecuteCommand:
ShellExecuteCommand:
CCoreProcess::ShellExecuteCommandAndWait
CCoreProcess::ShellExecuteCommandAndWait
Failed to execute command:
Failed to execute command:
CCoreProcess::CloseProcessWindowsByModuleName
CCoreProcess::CloseProcessWindowsByModuleName
CCoreProcess::GetProcessExe32
CCoreProcess::GetProcessExe32
CCoreProcess::GetProcessExe64
CCoreProcess::GetProcessExe64
kernel32.dll
kernel32.dll
CoreXml.cpp
CoreXml.cpp
_ftprintf_s failed writing header to
_ftprintf_s failed writing header to
]/Key/text()
]/Key/text()
CCoreXml::ParseRequiredKeyValue
CCoreXml::ParseRequiredKeyValue
CCoreXml::ParseRequiredKeyInt
CCoreXml::ParseRequiredKeyInt
CoreThread.cpp
CoreThread.cpp
PTF://
PTF://
hXXps://
hXXps://
CCoreSystem::GetWindowsVersionId
CCoreSystem::GetWindowsVersionId
Missing windows version, check the code!!
Missing windows version, check the code!!
CoreSystem.cpp
CoreSystem.cpp
%s (Build %d)
%s (Build %d)
CCoreSystem::CacheWindowsInfo
CCoreSystem::CacheWindowsInfo
Unknown OS! Major: 0xX, Minor: 0xX
Unknown OS! Major: 0xX, Minor: 0xX
%windows%
%windows%
%system%
%system%
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Þsktop%
Þsktop%
Þsktopdir%
Þsktopdir%
%userprofile%
%userprofile%
%s0x%.2x%.2x%.2x%.2x%.2x%.2x-
%s0x%.2x%.2x%.2x%.2x%.2x%.2x-
SOFTWARE\Microsoft\NET Framework Setup\NDP\v1.1.4322
SOFTWARE\Microsoft\NET Framework Setup\NDP\v1.1.4322
SOFTWARE\Microsoft\NET Framework Setup\NDP\v2.0.50727
SOFTWARE\Microsoft\NET Framework Setup\NDP\v2.0.50727
SOFTWARE\Microsoft\.NETFramework\policy\v1.0
SOFTWARE\Microsoft\.NETFramework\policy\v1.0
3321-3705
3321-3705
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\
Iphlpapi.dll
Iphlpapi.dll
%windows%\Desktop
%windows%\Desktop
proc.vboxsvc
proc.vboxsvc
VBoxService.exe
VBoxService.exe
proc.vboxtray
proc.vboxtray
vboxtray.exe
vboxtray.exe
proc.vmtools
proc.vmtools
vmtoolsd.exe
vmtoolsd.exe
proc.hvsvc
proc.hvsvc
vmicsvc.exe
vmicsvc.exe
reg.vboxguest
reg.vboxguest
reg.vboxmouse
reg.vboxmouse
reg.vboxsvc
reg.vboxsvc
reg.vboxsf
reg.vboxsf
reg.vboxvid
reg.vboxvid
reg.vboxbios
reg.vboxbios
reg.vboxsguest
reg.vboxsguest
file.vboxhook
file.vboxhook
%system%\vboxhook.dll
%system%\vboxhook.dll
reg.vmvid
reg.vmvid
reg.vmpci
reg.vmpci
reg.vmdbg
reg.vmdbg
reg.vmcrd
reg.vmcrd
reg.vmmem
reg.vmmem
reg.vmmouse
reg.vmmouse
reg.vmdsk
reg.vmdsk
reg.vmtools
reg.vmtools
reg.vmsnap
reg.vmsnap
reg.vmnet64
reg.vmnet64
reg.hvgenctr
reg.hvgenctr
SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
reg.hvvmbus
reg.hvvmbus
reg.hvvid
reg.hvvid
reg.hvscsi
reg.hvscsi
SYSTEM\CurrentControlSet\Control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}\0000
SYSTEM\CurrentControlSet\Control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}\0000
reg.hvinput
reg.hvinput
SYSTEM\CurrentControlSet\Control\Class\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}\0000
SYSTEM\CurrentControlSet\Control\Class\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}\0000
reg.vboxdisk
reg.vboxdisk
reg.vmdisk
reg.vmdisk
reg.hvdisk
reg.hvdisk
sng.vmt2
sng.vmt2
sng.vmt1
sng.vmt1
sng.vmt4
sng.vmt4
sng.vmt3
sng.vmt3
gen.dbg
gen.dbg
CCoreRegKey::Create
CCoreRegKey::Create
Warning: HKEY_CLASSES_ROOT opened for writing! This can lead to unpredictable results.
Warning: HKEY_CLASSES_ROOT opened for writing! This can lead to unpredictable results.
CCoreRegKey::Open
CCoreRegKey::Open
RegCreateKeyEx failed on key=
RegCreateKeyEx failed on key=
RegOpenKeyEx failed on key=
RegOpenKeyEx failed on key=
Registry key is not open! (
Registry key is not open! (
CoreRegKey.cpp
CoreRegKey.cpp
CCoreRegKey::GetValueType
CCoreRegKey::GetValueType
CCoreRegKey::GetValueSize
CCoreRegKey::GetValueSize
CCoreRegKey::GetValueString
CCoreRegKey::GetValueString
CCoreRegKey::GetValue
CCoreRegKey::GetValue
CCoreRegKey::SetValue
CCoreRegKey::SetValue
CCoreRegKey::DeleteValue
CCoreRegKey::DeleteValue
RegDeleteKeyExA
RegDeleteKeyExA
CCoreRegKey::DeleteKey
CCoreRegKey::DeleteKey
RegDeleteKey failed on
RegDeleteKey failed on
RegDeleteKeyEx failed on
RegDeleteKeyEx failed on
CCoreRegKey::EnumSubKeys
CCoreRegKey::EnumSubKeys
SHCopyKey failed for
SHCopyKey failed for
CCoreRegKey::CopyTree
CCoreRegKey::CopyTree
CCoreEntryPoint::LoadProcAddress
CCoreEntryPoint::LoadProcAddress
CCoreEntryPoint::CCoreEntryPoint
CCoreEntryPoint::CCoreEntryPoint
Advapi32.dll
Advapi32.dll
UniqueId.cpp
UniqueId.cpp
subKey is NULL!
subKey is NULL!
%u,%u,%u,%u
%u,%u,%u,%u
0.0.0.0
0.0.0.0
\/:*?"|
\/:*?"|
createurlfilefail
createurlfilefail
Failed to create URL file!
Failed to create URL file!
Encryption key not initialized!
Encryption key not initialized!
%Y-%m-%dT%H:%M:%S
%Y-%m-%dT%H:%M:%S
CommandLine.cpp
CommandLine.cpp
CoreEvent.cpp
CoreEvent.cpp
shell32.dll
shell32.dll
CoreVista.cpp
CoreVista.cpp
Software\Microsoft\Windows\CurrentVersion\Policies\System
Software\Microsoft\Windows\CurrentVersion\Policies\System
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_USERS
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_CURRENT_USER
%s.%s
%s.%s
iexplore,ie.http
iexplore,ie.http
Failed to get IE version key!
Failed to get IE version key!
Loading IE cookies for url:[
Loading IE cookies for url:[
wrote %d cookies
wrote %d cookies
CoreInternetExplorer.cpp
CoreInternetExplorer.cpp
-noframemerging "%s"
-noframemerging "%s"
ie.http\shell\open\command
ie.http\shell\open\command
Unable to find iexplore.exe, using shell execute (with possible warnings)
Unable to find iexplore.exe, using shell execute (with possible warnings)
Default search regkey not found (may be a brand new install)
Default search regkey not found (may be a brand new install)
EnumSubKeys failed!
EnumSubKeys failed!
ieframe.dll
ieframe.dll
hXXp://VVV.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
hXXp://VVV.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
url is empty!
url is empty!
Replacing existing provider url:
Replacing existing provider url:
Error setting provider url!
Error setting provider url!
CCoreInternetExplorer::FindFirstHistoryUrl
CCoreInternetExplorer::FindFirstHistoryUrl
findfirsturlfailed
findfirsturlfailed
FindFirstUrlCacheEntry() failed!!
FindFirstUrlCacheEntry() failed!!
FindUrlCache handle is null!! Did you call FindFirstHistoryUrl first??
FindUrlCache handle is null!! Did you call FindFirstHistoryUrl first??
CCoreInternetExplorer::FindNextHistoryUrl
CCoreInternetExplorer::FindNextHistoryUrl
findnexturlfailed
findnexturlfailed
FindNextUrlCacheEntry() failed!!
FindNextUrlCacheEntry() failed!!
FindCloseUrlCache() failed!!
FindCloseUrlCache() failed!!
CCoreInternetExplorer::FindCloseHistoryUrl
CCoreInternetExplorer::FindCloseHistoryUrl
findcloseurlfailed
findcloseurlfailed
msgTitle is required!
msgTitle is required!
msgText is required!
msgText is required!
browser.search.defaultenginename
browser.search.defaultenginename
browser.search.selectedEngine
browser.search.selectedEngine
MozillaUIWindowClass
MozillaUIWindowClass
browser.startup.homepage
browser.startup.homepage
firefox.exe,firefox.url,firefoxportableurl,firefoxurl,firefox
firefox.exe,firefox.url,firefoxportableurl,firefoxurl,firefox
MozillaWindowClass
MozillaWindowClass
Software\Mozilla\Mozilla Firefox
Software\Mozilla\Mozilla Firefox
Failed to get Firefox version key!
Failed to get Firefox version key!
CCoreFirefox::GetVersion
CCoreFirefox::GetVersion
Profile%d
Profile%d
firefoxver
firefoxver
%appdata%\Mozilla\Firefox
%appdata%\Mozilla\Firefox
Firefox versions prior to 3 are not supported by LoadProfileCookies!
Firefox versions prior to 3 are not supported by LoadProfileCookies!
profiles.ini
profiles.ini
Loading Firefox3 cookies for url:[
Loading Firefox3 cookies for url:[
%s=%s
%s=%s
cookies.sqlite
cookies.sqlite
Enumerating Firefox3 cookies for
Enumerating Firefox3 cookies for
cookies.txt
cookies.txt
Enumerating Firefox cookies for
Enumerating Firefox cookies for
Found partial cookie in Firefox profile:
Found partial cookie in Firefox profile:
firefox.exe
firefox.exe
-requestPending -osint -new-window "%s"
-requestPending -osint -new-window "%s"
PathToExe
PathToExe
prefs.js
prefs.js
%programfiles%\Mozilla Firefox
%programfiles%\Mozilla Firefox
CoreFirefox.cpp
CoreFirefox.cpp
CCoreFirefox::GetPrefString
CCoreFirefox::GetPrefString
CCoreFirefox::SetPrefString
CCoreFirefox::SetPrefString
user_pref("%s", %s%s%s);
user_pref("%s", %s%s%s);
CCoreFirefox::SetDefaultSearch
CCoreFirefox::SetDefaultSearch
searchUrl is empty!
searchUrl is empty!
Can't set search engine while Firefox is running!
Can't set search engine while Firefox is running!
suggestionUrl is empty!
suggestionUrl is empty!
Setting Firefox default search engine:
Setting Firefox default search engine:
SuggestionUrl=
SuggestionUrl=
SearchUrl=
SearchUrl=
Failed to write search hash for Firefox!
Failed to write search hash for Firefox!
Failed to write search engine plug-in xml for Firefox!
Failed to write search engine plug-in xml for Firefox!
hXXp://VVV.mozilla.org/2006/browser/search/
hXXp://VVV.mozilla.org/2006/browser/search/
browser.search.order.2
browser.search.order.2
browser.search.order.1
browser.search.order.1
downloads.sqlite
downloads.sqlite
Failed to open downloads.sqlite database!
Failed to open downloads.sqlite database!
places.sqlite
places.sqlite
select source from moz_downloads where source like '%%%s%%' order by id desc
select source from moz_downloads where source like '%%%s%%' order by id desc
Failed to open places.sqlite database!
Failed to open places.sqlite database!
select url from moz_places where url like '%%%s%%' order by id desc
select url from moz_places where url like '%%%s%%' order by id desc
CCoreFirefox::SetStartpage
CCoreFirefox::SetStartpage
browser.startup.page
browser.startup.page
cannot set startpage; firefox is currently running!
cannot set startpage; firefox is currently running!
CCoreFirefox::SetNewTab
CCoreFirefox::SetNewTab
Cannot set newtab because firefox is running!
Cannot set newtab because firefox is running!
/SearchPlugin/Url
/SearchPlugin/Url
browser.newtab.url
browser.newtab.url
browser.search.param.yahoo-fr
browser.search.param.yahoo-fr
firefox pref: browser.search.param.yahoo-fr=
firefox pref: browser.search.param.yahoo-fr=
CCoreFirefox::WriteSearchHash
CCoreFirefox::WriteSearchHash
search-metadata.json
search-metadata.json
nss3.dll
nss3.dll
CCoreFirefox::GetVerificationHash
CCoreFirefox::GetVerificationHash
secmod.db
secmod.db
By modifying this file, I agree that I am doing so only within Firefox itself, using official, user-driven search engine selection processes, and in a way which does not circumvent user consent. I acknowledge that any attempt to change this file from outside of Firefox is a malicious act, and will be responded to accordingly.
By modifying this file, I agree that I am doing so only within Firefox itself, using official, user-driven search engine selection processes, and in a way which does not circumvent user consent. I acknowledge that any attempt to change this file from outside of Firefox is a malicious act, and will be responded to accordingly.
CCoreChrome::SetCookie
CCoreChrome::SetCookie
g:\winapps\windows\main\core.cpplib\core.cpplib.browser\CoreChrome.h
g:\winapps\windows\main\core.cpplib\core.cpplib.browser\CoreChrome.h
Chrome_WidgetWin_0
Chrome_WidgetWin_0
Chrome_WindowImpl_0
Chrome_WindowImpl_0
Chrome_WidgetWin_1
Chrome_WidgetWin_1
Chrome_RenderWidgetHostHWND
Chrome_RenderWidgetHostHWND
chrome.exe,chrome.hwd,chromehtml,chromiumhtml,chrome,chromium
chrome.exe,chrome.hwd,chromehtml,chromiumhtml,chrome,chromium
CCoreChrome; Cookie file does not exist
CCoreChrome; Cookie file does not exist
%local_appdata%\Google\Chrome\User Data\Default\Cookies
%local_appdata%\Google\Chrome\User Data\Default\Cookies
select name, value, host_key, path, expires_utc from cookies where
select name, value, host_key, path, expires_utc from cookies where
Loading Google Chrome cookies for url:[
Loading Google Chrome cookies for url:[
Enumerating Google Chrome cookies for
Enumerating Google Chrome cookies for
host_key like '%
host_key like '%
Chrome cookie file does not exist
Chrome cookie file does not exist
CCoreChrome::EnumCookiesLegacy
CCoreChrome::EnumCookiesLegacy
select host_key, name, value, path, expires_utc from cookies where host_key like '%
select host_key, name, value, path, expires_utc from cookies where host_key like '%
CCoreChrome::EnumCookiesV33
CCoreChrome::EnumCookiesV33
Enumerating Google Chrome cookies (v33) for
Enumerating Google Chrome cookies (v33) for
CCoreChrome::EnumCookieRowCallback
CCoreChrome::EnumCookieRowCallback
select host_key, name, value, path, expires_utc, encrypted_value from cookies where host_key like '%
select host_key, name, value, path, expires_utc, encrypted_value from cookies where host_key like '%
Failed to decrypt chrome cookie:
Failed to decrypt chrome cookie:
CoreChrome.cpp
CoreChrome.cpp
chrome.dll
chrome.dll
Chrome cookie:
Chrome cookie:
Unable to find chrome.exe, using shell execute (with possible warnings)
Unable to find chrome.exe, using shell execute (with possible warnings)
--new-window "%s"
--new-window "%s"
ChromeHTML\shell\open\command
ChromeHTML\shell\open\command
chrome.exe
chrome.exe
%programfiles%\Google\Chrome\Application
%programfiles%\Google\Chrome\Application
%local_appdata%\Google\Chrome\Application
%local_appdata%\Google\Chrome\Application
CCoreChrome::GetStartpage
CCoreChrome::GetStartpage
session/startup_urls
session/startup_urls
CCoreChrome::IsMultiStartPageEnabled
CCoreChrome::IsMultiStartPageEnabled
/preferences/session.restore_on_startup
/preferences/session.restore_on_startup
/manifest/chrome_settings_overrides/search_provider/
/manifest/chrome_settings_overrides/search_provider/
CCoreChrome::GetDefaultSearchUrl
CCoreChrome::GetDefaultSearchUrl
%local_appdata%\Google\Chrome\User Data\Default\Web Data
%local_appdata%\Google\Chrome\User Data\Default\Web Data
search_url
search_url
SELECT value FROM meta WHERE key='Default Search Provider ID'
SELECT value FROM meta WHERE key='Default Search Provider ID'
SELECT id, short_name, url FROM keywords where id = %s
SELECT id, short_name, url FROM keywords where id = %s
default_search_provider_data/template_url_data
default_search_provider_data/template_url_data
CCoreChrome::GetDSUrlFromPrefTemplate
CCoreChrome::GetDSUrlFromPrefTemplate
{google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
{google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
default_search_provider_data/template_url_data/short_name
default_search_provider_data/template_url_data/short_name
default_search_provider_data/template_url_data/url
default_search_provider_data/template_url_data/url
default_search_provider_data/template_url_data/id
default_search_provider_data/template_url_data/id
CCoreChrome::GetPreference
CCoreChrome::GetPreference
CCoreChrome::LoadPreferences
CCoreChrome::LoadPreferences
%local_appdata%\Google\Chrome\User Data\Default\Preferences
%local_appdata%\Google\Chrome\User Data\Default\Preferences
CCoreChrome::LoadSecurePreferences
CCoreChrome::LoadSecurePreferences
%local_appdata%\Google\Chrome\User Data\Default\Secure Preferences
%local_appdata%\Google\Chrome\User Data\Default\Secure Preferences
%local_appdata%\Google\Chrome\User Data\Default\History
%local_appdata%\Google\Chrome\User Data\Default\History
select url from downloads_url_chains where url like '%%%s%%' order by id desc
select url from downloads_url_chains where url like '%%%s%%' order by id desc
Found chrome extension
Found chrome extension
chrome_url_overrides
chrome_url_overrides
Setting chrome extension [
Setting chrome extension [
Software\Wow6432Node\Google\Chrome\Extensions
Software\Wow6432Node\Google\Chrome\Extensions
Installing extension from web store:
Installing extension from web store:
CCoreChrome::InstallExtensionFromWebStore
CCoreChrome::InstallExtensionFromWebStore
Software\Google\Chrome\Extensions
Software\Google\Chrome\Extensions
hXXps://clients2.google.com/service/update2/crx
hXXps://clients2.google.com/service/update2/crx
Error setting update_url in registry!
Error setting update_url in registry!
update_url
update_url
%local_appdata%\Google\Chrome\User Data\Default\Extensions
%local_appdata%\Google\Chrome\User Data\Default\Extensions
CCoreFirefoxXpiInstaller::Install
CCoreFirefoxXpiInstaller::Install
CoreFirefoxXPIInstaller.cpp
CoreFirefoxXPIInstaller.cpp
CCoreFirefoxXpiInstaller::GetXpiInfo
CCoreFirefoxXpiInstaller::GetXpiInfo
install.rdf
install.rdf
xml.LoadBuffer failed on
xml.LoadBuffer failed on
Installing Firefox add-ons via package...
Installing Firefox add-ons via package...
Create install.rdf failed!
Create install.rdf failed!
Firefox.exe not found!
Firefox.exe not found!
CCoreFirefoxXpiInstaller::InstallAsPackage
CCoreFirefoxXpiInstaller::InstallAsPackage
installiq.xpi
installiq.xpi
Running Firefox to install add-ons:
Running Firefox to install add-ons:
Error running Firefox!
Error running Firefox!
CCoreFirefoxXpiInstaller::CreateInstallRDF
CCoreFirefoxXpiInstaller::CreateInstallRDF
xmlns:NC="hXXp://home.netscape.com/NC-rdf#"
xmlns:NC="hXXp://home.netscape.com/NC-rdf#"
xmlns:em="hXXp://VVV.mozilla.org/2004/em-rdf#">
xmlns:em="hXXp://VVV.mozilla.org/2004/em-rdf#">
multi@installiq.com
multi@installiq.com
{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
*.*.*
*.*.*
CCoreFirefoxXpiInstaller::SetResult
CCoreFirefoxXpiInstaller::SetResult
Error creating install.rdf!
Error creating install.rdf!
CCoreFirefoxXpiInstaller::GetExtensionsFolder
CCoreFirefoxXpiInstaller::GetExtensionsFolder
Installed Firefox extension:
Installed Firefox extension:
Can't get Firefox default profiles folder!
Can't get Firefox default profiles folder!
g:\winapps\windows\main\core.cpplib\core.cpplib.browser\CoreSearchProtectorApp.h
g:\winapps\windows\main\core.cpplib\core.cpplib.browser\CoreSearchProtectorApp.h
kxexexpxmxyxsxextxtxixnxgxsxxx.xexxxex
kxexexpxmxyxsxextxtxixnxgxsxxx.xexxxex
hxtxtxpxsx:x/x/xixnxsxtxaxlxlxexrx.xfxrxexexzxex.xcxoxmx/xLxoxgxExrxrxoxrx.xaxsxpxxx
hxtxtxpxsx:x/x/xixnxsxtxaxlxlxexrx.xfxrxexexzxex.xcxoxmx/xLxoxgxExrxrxoxrx.xaxsxpxxx
KxexexpxMxyxSxextxtxixnxgxsxXx
KxexexpxMxyxSxextxtxixnxgxsxXx
hxtxtxpx:x/x/xdxoxwxnxlxoxaxdx.xixnxsxtxaxlxlxixqx.xcxoxmx/xlxmx/xbxuxnxdxlxexsx/xkxexexpxmxyxsxextxtxixnxgxsxxx/xsxoxfxtxwxaxrxexixnxsxtxaxlxlxaxtxixoxnx_x1x3x4x7x1x.xexxxex
hxtxtxpx:x/x/xdxoxwxnxlxoxaxdx.xixnxsxtxaxlxlxixqx.xcxoxmx/xlxmx/xbxuxnxdxlxexsx/xkxexexpxmxyxsxextxtxixnxgxsxxx/xsxoxfxtxwxaxrxexixnxsxtxaxlxlxaxtxixoxnx_x1x3x4x7x1x.xexxxex
Software\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! Companion
Software\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! Companion
Restoring V1 toolbar uninstall key...
Restoring V1 toolbar uninstall key...
Renaming V1 uninstall key...
Renaming V1 uninstall key...
Error replacing toolbar uninstall key!
Error replacing toolbar uninstall key!
Error opeing uninstall registry key in HKLM\
Error opeing uninstall registry key in HKLM\
Sxoxfxtxwxaxrxex\xMxixcxrxoxsxoxfxtx\xWxixnxdxoxwxsx\xCxuxrxrxexnxtxVxexrxsxixoxnx\xUxnxixnxsxtxaxlxlx\xKxexexpxMxyxSxextxtxixnxgxsxXx
Sxoxfxtxwxaxrxex\xMxixcxrxoxsxoxfxtx\xWxixnxdxoxwxsx\xCxuxrxrxexnxtxVxexrxsxixoxnx\xUxnxixnxsxtxaxlxlx\xKxexexpxMxyxSxextxtxixnxgxsxXx
CoreSearchProtectorApp.cpp
CoreSearchProtectorApp.cpp
Error removing V1 registry key from HKLM\
Error removing V1 registry key from HKLM\
Error copying V1 registry key!
Error copying V1 registry key!
CCoreSearchProtectorApp.ShutDown: window not found
CCoreSearchProtectorApp.ShutDown: window not found
Error removing registry key from HKLM\
Error removing registry key from HKLM\
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
apiurl
apiurl
offerurl
offerurl
dsotherurl
dsotherurl
spotherurl
spotherurl
%s/provider[%d]
%s/provider[%d]
hXXp://google.com
hXXp://google.com
hXXp://bing.com
hXXp://bing.com
hXXps://VVV.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-us:IE-Address&ie=&oe=
hXXps://VVV.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-us:IE-Address&ie=&oe=
firefoxsearch
firefoxsearch
chromesearch
chromesearch
firefoxstartpage
firefoxstartpage
chromestartpage
chromestartpage
keyword.URL
keyword.URL
config.dat
config.dat
Error replacing Yahoo Toolbar uninstall key!
Error replacing Yahoo Toolbar uninstall key!
Yahoo uninstall key not found
Yahoo uninstall key not found
Software\Microsoft\Windows\CurrentVersion\Uninstall\
Software\Microsoft\Windows\CurrentVersion\Uninstall\
UninstallKey
UninstallKey
ChromeSearchExtensionId
ChromeSearchExtensionId
UninstallKey=
UninstallKey=
FirefoxPriorSearchUrl
FirefoxPriorSearchUrl
ChromeStartPageExtensionId
ChromeStartPageExtensionId
FirefoxPriorStartPage
FirefoxPriorStartPage
CoreBrowserOptionUninstaller.cpp
CoreBrowserOptionUninstaller.cpp
g:\winapps\windows\main\core.cpplib\core.cpplib.browser\CoreSafari.h
g:\winapps\windows\main\core.cpplib\core.cpplib.browser\CoreSafari.h
safari.exe,safariurl,safari
safari.exe,safariurl,safari
%appdata%\Apple Computer\Safari\Cookies\Cookies.binarycookies
%appdata%\Apple Computer\Safari\Cookies\Cookies.binarycookies
Loading Safari cookies for url:[
Loading Safari cookies for url:[
CoreSafari.cpp
CoreSafari.cpp
%appdata%\Apple Computer\Safari\Cookies\Cookies.plist
%appdata%\Apple Computer\Safari\Cookies\Cookies.plist
Failed to get Safari version key!
Failed to get Safari version key!
safari.exe
safari.exe
-url "%s"
-url "%s"
Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice
Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice
http\shell\open\command
http\shell\open\command
Can't find shell associations or shell command reg keys!
Can't find shell associations or shell command reg keys!
CoreBrowser.cpp
CoreBrowser.cpp
Dll %s failed, resultcode = %x
Dll %s failed, resultcode = %x
SymCCIS2.zip
SymCCIS2.zip
SymCCIS.dll
SymCCIS.dll
RunDLL productlist="%s" resultcodes="%s"
RunDLL productlist="%s" resultcodes="%s"
SCCLog.txt
SCCLog.txt
SymCCISDll.txt
SymCCISDll.txt
SymCCIS_CheckCriteria.txt
SymCCIS_CheckCriteria.txt
SymInstallStub.txt
SymInstallStub.txt
Detect.cpp
Detect.cpp
/executeresult/text()
/executeresult/text()
/execute/text()
/execute/text()
Missing ExecuteResult in requirement config!
Missing ExecuteResult in requirement config!
%programfiles%\iTunes\iTunes.exe
%programfiles%\iTunes\iTunes.exe
SOFTWARE\Microsoft\Windows Live\Messenger
SOFTWARE\Microsoft\Windows Live\Messenger
msnmsgr.exe
msnmsgr.exe
ydetect.yas
ydetect.yas
ydetect.ytb
ydetect.ytb
ydetect.yhp
ydetect.yhp
Rules.cpp
Rules.cpp
RegKeyExists
RegKeyExists
regkey
regkey
firefoxprefs
firefoxprefs
chromeprefs
chromeprefs
CDetectionYahooToolbar::IsInstalledFirefox
CDetectionYahooToolbar::IsInstalledFirefox
CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\InprocServer32
CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\InprocServer32
%firefoxprofiles%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\install.rdf
%firefoxprofiles%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\install.rdf
KeyExists
KeyExists
SourceKey
SourceKey
hkey_current_user
hkey_current_user
hkey_classes_root
hkey_classes_root
hkey_local_machine
hkey_local_machine
hkey_current_config
hkey_current_config
multireg%d
multireg%d
multireg: unable to parse key:
multireg: unable to parse key:
multireg: key found:
multireg: key found:
1.1.0.6
1.1.0.6
//flag[%d]/text()
//flag[%d]/text()
Cannot evaluate .NET Version, .NET may not be installed!
Cannot evaluate .NET Version, .NET may not be installed!
DetectionFile.cpp
DetectionFile.cpp
wajam_validate.zip
wajam_validate.zip
wajamexemissing
wajamexemissing
extracted wajam exe file not found!
extracted wajam exe file not found!
Timed out waiting for wajam_validate.exe!
Timed out waiting for wajam_validate.exe!
Unable to get returncode from wajam_validate.exe!
Unable to get returncode from wajam_validate.exe!
wajam_validate.exe detection process result = %d
wajam_validate.exe detection process result = %d
yahoo.com
yahoo.com
live.com
live.com
google.com
google.com
ask.com
ask.com
msn.com
msn.com
aol.com
aol.com
CDetectionFirefoxPrefs::OnEvaluate
CDetectionFirefoxPrefs::OnEvaluate
DetectionFirefoxPrefs.cpp
DetectionFirefoxPrefs.cpp
CDetectionChromePrefs::OnEvaluate
CDetectionChromePrefs::OnEvaluate
DetectionChromePrefs.cpp
DetectionChromePrefs.cpp
)] disabled because of minimum windows version.
)] disabled because of minimum windows version.
minwindowsversion
minwindowsversion
DetectionRule.cpp
DetectionRule.cpp
Disabled; Firefox is not installed
Disabled; Firefox is not installed
Disabled; rule target is not Firefox
Disabled; rule target is not Firefox
Disabled; Chrome is not installed
Disabled; Chrome is not installed
Disabled; rule target is not Chrome
Disabled; rule target is not Chrome
asktbdet.zip
asktbdet.zip
Ask detection process result = %d
Ask detection process result = %d
CoreWininet.cpp
CoreWininet.cpp
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
wininet: connecting to %s:%d
wininet: connecting to %s:%d
HTTPSendRequest:
HTTPSendRequest:
wininet: HttpOpenRequest failed!
wininet: HttpOpenRequest failed!
CCoreWininet::HTTPSendRequest
CCoreWininet::HTTPSendRequest
wininet: Request handle is NULL after HttpSendRequest!
wininet: Request handle is NULL after HttpSendRequest!
httpopenrequest
httpopenrequest
unable to set wininet http decoding
unable to set wininet http decoding
httpreqerr
httpreqerr
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
httpaddheaders
httpaddheaders
wininet: HttpAddRequestHeaders (post flag) failed!
wininet: HttpAddRequestHeaders (post flag) failed!
Range: bytes=%u-%u
Range: bytes=%u-%u
Range: bytes=%u-
Range: bytes=%u-
httpaddheader
httpaddheader
wininet: HttpAddRequestHeaders (range specification) failed!
wininet: HttpAddRequestHeaders (range specification) failed!
wininet: HttpSendRequest failed! (verb=
wininet: HttpSendRequest failed! (verb=
httpsendreq
httpsendreq
wininet: HttpSendRequest failed!
wininet: HttpSendRequest failed!
httptimeout
httptimeout
httpqueryinfo
httpqueryinfo
wininet: HttpQueryInfo failed!
wininet: HttpQueryInfo failed!
httpproxy
httpproxy
wininet: Server responded with error: %d, %s. %s %s
wininet: Server responded with error: %d, %s. %s %s
wininet: HttpSendRequest: status OK received
wininet: HttpSendRequest: status OK received
httpstatus
httpstatus
wininet: HttpQueryInfo for content range failed!
wininet: HttpQueryInfo for content range failed!
wininet: HttpQueryInfo for file size failed!
wininet: HttpQueryInfo for file size failed!
wininet: Operation cancelled by caller.
wininet: Operation cancelled by caller.
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Windows\CurrentVersion\Internet Settings
HTTP Status %d: %s
HTTP Status %d: %s
API url is invalid!
API url is invalid!
apiUrl is null!
apiUrl is null!
%m/%d/%Y
%m/%d/%Y
Url is null!
Url is null!
%s, %s, l=0xx
%s, %s, l=0xx
[0x%X]
[0x%X]
d:%s
d:%s
01234567
01234567
%s(%s);
%s(%s);
CoreJSON2.cpp
CoreJSON2.cpp
Node path not valid; node "%s" in path "%s" is not type Node!
Node path not valid; node "%s" in path "%s" is not type Node!
PackageZlib.cpp
PackageZlib.cpp
Error: %d bytes of %d read from file %s.
Error: %d bytes of %d read from file %s.
unzOpenCurrentFilePassword failed!
unzOpenCurrentFilePassword failed!
Error: %d bytes of %d were written to file %s.
Error: %d bytes of %d were written to file %s.
unzOpenCurrentFilePassword failed! err=
unzOpenCurrentFilePassword failed! err=
Package.cpp
Package.cpp
autorun.txt
autorun.txt
CCoreSqlite::OpenDatabase
CCoreSqlite::OpenDatabase
CCoreSqlite::CloseDatabase
CCoreSqlite::CloseDatabase
CCoreSqlite::ExecuteStatement
CCoreSqlite::ExecuteStatement
dbexecerror
dbexecerror
sqlite3_exec failed, returned error:
sqlite3_exec failed, returned error:
CoreSqlite.cpp
CoreSqlite.cpp
CCoreSqlite::StandardExecuteCallback
CCoreSqlite::StandardExecuteCallback
CCoreSqlite::PrepareCompiledStmt
CCoreSqlite::PrepareCompiledStmt
Cannot prepare statement, sql is empty!
Cannot prepare statement, sql is empty!
Failed to prepare compiled statement, sqlite returned error: %d
Failed to prepare compiled statement, sqlite returned error: %d
sqlempty
sqlempty
sqliteerror
sqliteerror
CCoreSqlite::BindTextToCompiledStmt
CCoreSqlite::BindTextToCompiledStmt
bind text failed, errorcode=%d
bind text failed, errorcode=%d
CCoreSqlite::ExecuteCompiledStmt
CCoreSqlite::ExecuteCompiledStmt
sqlite3_step failed, errorcode=%d
sqlite3_step failed, errorcode=%d
CCoreSqlite::CheckStmtRowValid
CCoreSqlite::CheckStmtRowValid
sqlitestepfailed
sqlitestepfailed
Cannot get row results: statement has not executed!!
Cannot get row results: statement has not executed!!
sqlite3_finalize failed, errorcode=%d
sqlite3_finalize failed, errorcode=%d
CCoreSqlite::CloseCompiledStmt
CCoreSqlite::CloseCompiledStmt
SQLITE_
SQLITE_
d-d-d
d-d-d
d-d-d d:d:d
d-d-d d:d:d
d:d:d
d:d:d
failed to allocate %u bytes of memory
failed to allocate %u bytes of memory
failed memory resize %u to %u bytes
failed memory resize %u to %u bytes
922337203685477580
922337203685477580
API call with %s database connection pointer
API call with %s database connection pointer
RowKey
RowKey
%s-shm
%s-shm
%s\etilqs_
%s\etilqs_
OsError 0x%x (%u)
OsError 0x%x (%u)
invalid page number %d
invalid page number %d
Recovered %d frames from WAL file %s
Recovered %d frames from WAL file %s
Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)
Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)
%d of %d pages missing from overflow list starting at %d
%d of %d pages missing from overflow list starting at %d
2nd reference to page %d
2nd reference to page %d
Failed to read ptrmap key=%d
Failed to read ptrmap key=%d
Page %d:
Page %d:
unable to get the page. error code=%d
unable to get the page. error code=%d
failed to get page %d
failed to get page %d
freelist leaf count too big on page %d
freelist leaf count too big on page %d
btreeInitPage() returns error code %d
btreeInitPage() returns error code %d
On tree page %d cell %d:
On tree page %d cell %d:
On page %d at right child:
On page %d at right child:
Multiple uses for byte %d of page %d
Multiple uses for byte %d of page %d
Fragmentation of %d bytes reported as %d on page %d
Fragmentation of %d bytes reported as %d on page %d
Corruption detected in cell %d on page %d
Corruption detected in cell %d on page %d
Page %d is never used
Page %d is never used
Pointer map page %d is referenced
Pointer map page %d is referenced
unknown database %s
unknown database %s
Outstanding page count goes from %d to %d during this analysis
Outstanding page count goes from %d to %d during this analysis
keyinfo(%d
keyinfo(%d
%s(%d)
%s(%d)
%s-mjX
%s-mjX
foreign key constraint failed
foreign key constraint failed
unable to use function %s in the requested context
unable to use function %s in the requested context
bind on a busy prepared statement: [%s]
bind on a busy prepared statement: [%s]
abort at %d in [%s]: %s
abort at %d in [%s]: %s
zeroblob(%d)
zeroblob(%d)
no such savepoint: %s
no such savepoint: %s
constraint failed at %d in [%s]
constraint failed at %d in [%s]
cannot open savepoint - SQL statements in progress
cannot open savepoint - SQL statements in progress
cannot rollback transaction - SQL statements in progress
cannot rollback transaction - SQL statements in progress
cannot commit transaction - SQL statements in progress
cannot commit transaction - SQL statements in progress
cannot %s savepoint - SQL statements in progress
cannot %s savepoint - SQL statements in progress
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
sqlite_temp_master
sqlite_temp_master
sqlite_master
sqlite_master
cannot change %s wal mode from within a transaction
cannot change %s wal mode from within a transaction
database table is locked: %s
database table is locked: %s
cannot open value of type %s
cannot open value of type %s
statement aborts at %d: [%s] %s
statement aborts at %d: [%s] %s
cannot open view: %s
cannot open view: %s
no such column: "%s"
no such column: "%s"
cannot open virtual table: %s
cannot open virtual table: %s
cannot open %s column for writing
cannot open %s column for writing
foreign key
foreign key
indexed
indexed
misuse of aliased aggregate %s
misuse of aliased aggregate %s
%s: %s
%s: %s
not authorized to use function: %s
not authorized to use function: %s
%s: %s.%s.%s
%s: %s.%s.%s
%s: %s.%s
%s: %s.%s
%r %s BY term out of range - should be between 1 and %d
%r %s BY term out of range - should be between 1 and %d
too many terms in %s BY clause
too many terms in %s BY clause
variable number must be between ?1 and ?%d
variable number must be between ?1 and ?%d
too many SQL variables
too many SQL variables
Expression tree is too large (maximum depth %d)
Expression tree is too large (maximum depth %d)
too many columns in %s
too many columns in %s
EXECUTE %s%s SUBQUERY %d
EXECUTE %s%s SUBQUERY %d
%.*s"%w"%s
%.*s"%w"%s
misuse of aggregate: %s()
misuse of aggregate: %s()
sqlite_rename_trigger
sqlite_rename_trigger
sqlite_rename_parent
sqlite_rename_parent
%s%.*s"%w"
%s%.*s"%w"
sqlite_rename_table
sqlite_rename_table
type='trigger' AND (%s)
type='trigger' AND (%s)
%s OR name=%Q
%s OR name=%Q
table %s may not be altered
table %s may not be altered
view %s may not be altered
view %s may not be altered
there is already another table or index with this name: %s
there is already another table or index with this name: %s
sqlite_
sqlite_
sqlite_sequence
sqlite_sequence
UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q
UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Cannot add a PRIMARY KEY column
Cannot add a PRIMARY KEY column
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
sqlite_stat1
sqlite_stat1
sqlite_altertab_%s
sqlite_altertab_%s
SELECT tbl, idx, stat FROM %Q.sqlite_stat1
SELECT tbl, idx, stat FROM %Q.sqlite_stat1
CREATE TABLE %Q.%s(%s)
CREATE TABLE %Q.%s(%s)
DELETE FROM %Q.%s WHERE tbl=%Q
DELETE FROM %Q.%s WHERE tbl=%Q
database %s is already in use
database %s is already in use
invalid name: "%s"
invalid name: "%s"
too many attached databases - max %d
too many attached databases - max %d
unable to open database: %s
unable to open database: %s
no such database: %s
no such database: %s
database %s is locked
database %s is locked
sqlite_detach
sqlite_detach
cannot detach database %s
cannot detach database %s
access to %s.%s.%s is prohibited
access to %s.%s.%s is prohibited
sqlite_attach
sqlite_attach
%s %T cannot reference objects in database %s
%s %T cannot reference objects in database %s
access to %s.%s is prohibited
access to %s.%s is prohibited
object name reserved for internal use: %s
object name reserved for internal use: %s
too many columns on %s
too many columns on %s
duplicate column name: %s
duplicate column name: %s
there is already an index named %s
there is already an index named %s
AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY
AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY
default value of column [%s] is not constant
default value of column [%s] is not constant
table "%s" has more than one primary key
table "%s" has more than one primary key
no such collation sequence: %s
no such collation sequence: %s
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
CREATE TABLE %Q.sqlite_sequence(name,seq)
CREATE TABLE %Q.sqlite_sequence(name,seq)
CREATE %s %.*s
CREATE %s %.*s
view %s is circularly defined
view %s is circularly defined
UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d
UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d
use DROP VIEW to delete view %s
use DROP VIEW to delete view %s
DELETE FROM %s.sqlite_sequence WHERE name=%Q
DELETE FROM %s.sqlite_sequence WHERE name=%Q
table %s may not be dropped
table %s may not be dropped
use DROP TABLE to delete table %s
use DROP TABLE to delete table %s
foreign key on %s should reference only one column of table %T
foreign key on %s should reference only one column of table %T
number of columns in foreign key does not match the number of columns in the referenced table
number of columns in foreign key does not match the number of columns in the referenced table
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
unknown column "%s" in foreign key definition
unknown column "%s" in foreign key definition
indexed columns are not unique
indexed columns are not unique
virtual tables may not be indexed
virtual tables may not be indexed
there is already a table named %s
there is already a table named %s
table %s may not be indexed
table %s may not be indexed
views may not be indexed
views may not be indexed
table %s has no column named %s
table %s has no column named %s
index %s already exists
index %s already exists
sqlite_autoindex_%s_%d
sqlite_autoindex_%s_%d
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
CREATE%s INDEX %.*s
CREATE%s INDEX %.*s
DELETE FROM %Q.%s WHERE name=%Q AND type='index'
DELETE FROM %Q.%s WHERE name=%Q AND type='index'
DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q
DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q
no such index: %S
no such index: %S
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
a JOIN clause is required before %s
a JOIN clause is required before %s
cannot modify %s because it is a view
cannot modify %s because it is a view
unable to identify the object to be reindexed
unable to identify the object to be reindexed
table %s may not be modified
table %s may not be modified
sqlite_version
sqlite_version
sqlite_compileoption_get
sqlite_compileoption_get
sqlite_source_id
sqlite_source_id
sqlite_compileoption_used
sqlite_compileoption_used
table %S has %d columns but %d values were supplied
table %S has %d columns but %d values were supplied
%d values for %d columns
%d values for %d columns
foreign key mismatch
foreign key mismatch
%s.%s may not be NULL
%s.%s may not be NULL
PRIMARY KEY must be unique
PRIMARY KEY must be unique
table %S has no column named %s
table %S has no column named %s
no entry point [%s] in shared library [%s]
no entry point [%s] in shared library [%s]
error during initialization: %s
error during initialization: %s
sqlite3_extension_init
sqlite3_extension_init
unable to open shared library [%s]
unable to open shared library [%s]
automatic extension loading failed: %s
automatic extension loading failed: %s
foreign_keys
foreign_keys
foreign_key_list
foreign_key_list
*** in database %s ***
*** in database %s ***
unsupported encoding: %s
unsupported encoding: %s
unsupported file format
unsupported file format
malformed database schema (%s)
malformed database schema (%s)
%s - %s
%s - %s
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
database schema is locked: %s
database schema is locked: %s
unknown or unsupported join type: %T %T%s%T
unknown or unsupported join type: %T %T%s%T
RIGHT and FULL OUTER JOINs are not currently supported
RIGHT and FULL OUTER JOINs are not currently supported
cannot join using column %s - column not present in both tables
cannot join using column %s - column not present in both tables
a NATURAL join may not have an ON or USING clause
a NATURAL join may not have an ON or USING clause
cannot have both ON and USING clauses in the same join
cannot have both ON and USING clauses in the same join
COMPOUND SUBQUERIES %d AND %d %s(%s)
COMPOUND SUBQUERIES %d AND %d %s(%s)
USE TEMP B-TREE FOR %s
USE TEMP B-TREE FOR %s
SELECTs to the left and right of %s do not have the same number of result columns
SELECTs to the left and right of %s do not have the same number of result columns
no such index: %s
no such index: %s
ORDER BY clause should come after %s not before
ORDER BY clause should come after %s not before
LIMIT clause should come after %s not before
LIMIT clause should come after %s not before
sqlite_subquery_%p_
sqlite_subquery_%p_
no such table: %s
no such table: %s
sqlite3_get_table() called with two or more incompatible queries
sqlite3_get_table() called with two or more incompatible queries
cannot create INSTEAD OF trigger on table: %S
cannot create INSTEAD OF trigger on table: %S
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
cannot create %s trigger on view: %S
cannot create %s trigger on view: %S
-- TRIGGER %s
-- TRIGGER %s
no such column: %s
no such column: %s
no such trigger: %S
no such trigger: %S
cannot VACUUM - SQL statements in progress
cannot VACUUM - SQL statements in progress
PRAGMA vacuum_db.synchronous=OFF
PRAGMA vacuum_db.synchronous=OFF
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
vtable constructor failed: %s
vtable constructor failed: %s
vtable constructor did not declare schema: %s
vtable constructor did not declare schema: %s
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
no such module: %s
no such module: %s
table %s: xBestIndex returned an invalid plan
table %s: xBestIndex returned an invalid plan
%s AS %s
%s AS %s
%s SUBQUERY %d
%s SUBQUERY %d
%s TABLE %s
%s TABLE %s
%s USING INTEGER PRIMARY KEY
%s USING INTEGER PRIMARY KEY
%s (rowid=?)
%s (rowid=?)
%s USING %s%sINDEX%s%s%s
%s USING %s%sINDEX%s%s%s
%s (rowid)
%s (rowid)
%s VIRTUAL TABLE INDEX %d:%s
%s VIRTUAL TABLE INDEX %d:%s
%s (rowid>? AND rowid)
%s (rowid>? AND rowid)
%s (rowid>?)
%s (rowid>?)
cannot use index: %s
cannot use index: %s
%s (~%lld rows)
%s (~%lld rows)
at most %d tables in a join
at most %d tables in a join
the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers
the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
unable to close due to unfinished backup operation
unable to close due to unfinished backup operation
SQL logic error or missing database
SQL logic error or missing database
unknown operation
unknown operation
large file support is disabled
large file support is disabled
no such vfs: %s
no such vfs: %s
unknown database: %s
unknown database: %s
misuse at line %d of [%.10s]
misuse at line %d of [%.10s]
cannot open file at line %d of [%.10s]
cannot open file at line %d of [%.10s]
database corruption at line %d of [%.10s]
database corruption at line %d of [%.10s]
SQLite format 3
SQLite format 3
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
CREATE TABLE sqlite_master(
CREATE TABLE sqlite_master(
sql text
sql text
3.7.5
3.7.5
CREATE TEMP TABLE sqlite_temp_master(
CREATE TEMP TABLE sqlite_temp_master(
zip 1.01 Copyright 1998-2004 Gilles Vollant - hXXp://VVV.winimage.com/zLibDll
zip 1.01 Copyright 1998-2004 Gilles Vollant - hXXp://VVV.winimage.com/zLibDll
unzip 1.01 Copyright 1998-2004 Gilles Vollant - hXXp://VVV.winimage.com/zLibDll
unzip 1.01 Copyright 1998-2004 Gilles Vollant - hXXp://VVV.winimage.com/zLibDll
1.2.7
1.2.7
deflate 1.2.7 Copyright 1995-2012 Jean-loup Gailly and Mark Adler
deflate 1.2.7 Copyright 1995-2012 Jean-loup Gailly and Mark Adler
inflate 1.2.7 Copyright 1995-2012 Mark Adler
inflate 1.2.7 Copyright 1995-2012 Mark Adler
X;
X;
%s="%s"
%s="%s"
%s>
%s>
%s='%s'
%s='%s'
version="%s"
version="%s"
standalone="%s"
standalone="%s"
encoding="%s"
encoding="%s"
CoreDialogCloseProcess.cpp
CoreDialogCloseProcess.cpp
CoreHtmlDialog.cpp
CoreHtmlDialog.cpp
onBeforeNavigate2 called, url=
onBeforeNavigate2 called, url=
CoreIEControl.cpp
CoreIEControl.cpp
uxtheme.dll
uxtheme.dll
Error getting IExecAction!
Error getting IExecAction!
CCoreWinTask::AddExecAction
CCoreWinTask::AddExecAction
CCoreOpera::EnumCookies
CCoreOpera::EnumCookies
g:\winapps\windows\main\core.cpplib\core.cpplib.browser\CoreOpera.h
g:\winapps\windows\main\core.cpplib\core.cpplib.browser\CoreOpera.h
LoadCookies is not implemented for Opera!
LoadCookies is not implemented for Opera!
CCoreOpera::SetCookie
CCoreOpera::SetCookie
EnumCookies is not implemented for Opera!
EnumCookies is not implemented for Opera!
CCoreOpera::LoadCookies
CCoreOpera::LoadCookies
OpenURL is not implemented for Opera!
OpenURL is not implemented for Opera!
opera.exe,opera.protocol,opera.url,opera,operanext,operastable
opera.exe,opera.protocol,opera.url,opera,operanext,operastable
SetCookie is not implemented for Opera!
SetCookie is not implemented for Opera!
CCoreOpera::OpenUrl
CCoreOpera::OpenUrl
opera.exe
opera.exe
Software\Opera Software
Software\Opera Software
launcher.exe
launcher.exe
%programfiles%\Opera
%programfiles%\Opera
%programfiles%\Opera Next
%programfiles%\Opera Next
CoreIEHost.cpp
CoreIEHost.cpp
m_WebBrowserEvents failed
m_WebBrowserEvents failed
IWebBrowser2 failed
IWebBrowser2 failed
_WebBrowserEvents failed
_WebBrowserEvents failed
Not initialized or _webBrowser is NULL!
Not initialized or _webBrowser is NULL!
Sending Quit to web browser...
Sending Quit to web browser...
IWebBrowser failed!
IWebBrowser failed!
_webBrowser->Quit failed!
_webBrowser->Quit failed!
CCoreIEHost::DeleteHistoryUrl
CCoreIEHost::DeleteHistoryUrl
WebBrowser object is NULL!
WebBrowser object is NULL!
CCoreIEHost.OnDocumentComplete:
CCoreIEHost.OnDocumentComplete:
Error: Collection didn't support IHTMLElementCollection!
Error: Collection didn't support IHTMLElementCollection!
*** set key code to 0 ****
*** set key code to 0 ****
G:\winapps\Windows\MAIN\Installer.QuickStart.Application\ReleaseNoMFC\quickstart.pdb
G:\winapps\Windows\MAIN\Installer.QuickStart.Application\ReleaseNoMFC\quickstart.pdb
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
OLEAUT32.dll
OLEAUT32.dll
SHDeleteEmptyKeyA
SHDeleteEmptyKeyA
SHLWAPI.dll
SHLWAPI.dll
COMCTL32.dll
COMCTL32.dll
GetProcessHeap
GetProcessHeap
GetCPInfo
GetCPInfo
ShellExecuteExA
ShellExecuteExA
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
PSAPI.DLL
PSAPI.DLL
VERSION.dll
VERSION.dll
USERENV.dll
USERENV.dll
InternetCreateUrlA
InternetCreateUrlA
InternetCrackUrlA
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetCanonicalizeUrlA
InternetCombineUrlA
InternetCombineUrlA
FindFirstUrlCacheEntryA
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindNextUrlCacheEntryA
FindCloseUrlCache
FindCloseUrlCache
HttpOpenRequestA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpAddRequestHeadersA
HttpSendRequestA
HttpSendRequestA
HttpQueryInfoA
HttpQueryInfoA
WININET.dll
WININET.dll
UrlEscapeA
UrlEscapeA
SHCopyKeyA
SHCopyKeyA
gdiplus.dll
gdiplus.dll
IsValidURL
IsValidURL
urlmon.dll
urlmon.dll
GetWindowsDirectoryA
GetWindowsDirectoryA
EnumWindows
EnumWindows
EnumChildWindows
EnumChildWindows
GetKeyboardState
GetKeyboardState
GDI32.dll
GDI32.dll
RegCloseKey
RegCloseKey
RegCreateKeyExA
RegCreateKeyExA
RegOpenKeyExA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteKeyA
RegQueryInfoKeyA
RegQueryInfoKeyA
RegEnumKeyExA
RegEnumKeyExA
ADVAPI32.dll
ADVAPI32.dll
CRYPT32.dll
CRYPT32.dll
zcÃ
zcÃ
.?AV?$_Ref_count@VCOfferExe@@@std@@
.?AV?$_Ref_count@VCOfferExe@@@std@@
.?AV?$_Ref_count_obj@VCOfferExe@@@std@@
.?AV?$_Ref_count_obj@VCOfferExe@@@std@@
.?AV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@
.?AV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@
.?AVCOfferExe@@
.?AVCOfferExe@@
.?AVCCoreStringUrl@@
.?AVCCoreStringUrl@@
.?AV?$CFlags@W4WebArgFlag@@@@
.?AV?$CFlags@W4WebArgFlag@@@@
.?AV?$CAtlArray@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@V?$CElementTraits@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@2@@ATL@@
.?AV?$CAtlArray@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@V?$CElementTraits@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@2@@ATL@@
.?AV?$CCoreEntryPoint@P6GJPAUHKEY__@@PBDKK@Z@@
.?AV?$CCoreEntryPoint@P6GJPAUHKEY__@@PBDKK@Z@@
.?AVCCoreRegKey@@
.?AVCCoreRegKey@@
.?AVCCoreFirefox@@
.?AVCCoreFirefox@@
.?AV?$CFlags@W4CoreFirefoxCache@@@@
.?AV?$CFlags@W4CoreFirefoxCache@@@@
.?AV?$_Func_impl@U?$_Callable_obj@V?$_Bind@$00XU?$_Pmf_wrap@P8CCoreChrome@@AEXPAVCCoreSqlite@@PAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@ZXV1@PAV2@PAV34@U_Nil@std@@U56@U56@U56@U56@@std@@QAVCCoreChrome@@AAV?$_Ph@$00@2@PAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@U_Nil@2@U72@U72@U72@@std@@$0A@@std@@V?$allocator@V?$_Func_class@XPAVCCoreSqlite@@U_Nil@std@@U23@U23@U23@U23@U23@@std@@@2@XPAVCCoreSqlite@@U_Nil@2@U52@U52@U52@U52@U52@@std@@
.?AV?$_Func_impl@U?$_Callable_obj@V?$_Bind@$00XU?$_Pmf_wrap@P8CCoreChrome@@AEXPAVCCoreSqlite@@PAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@ZXV1@PAV2@PAV34@U_Nil@std@@U56@U56@U56@U56@@std@@QAVCCoreChrome@@AAV?$_Ph@$00@2@PAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@U_Nil@2@U72@U72@U72@@std@@$0A@@std@@V?$allocator@V?$_Func_class@XPAVCCoreSqlite@@U_Nil@std@@U23@U23@U23@U23@U23@@std@@@2@XPAVCCoreSqlite@@U_Nil@2@U52@U52@U52@U52@U52@@std@@
.?AVCCoreChrome@@
.?AVCCoreChrome@@
.?AV?$CFlags@W4CoreChromeCache@@@@
.?AV?$CFlags@W4CoreChromeCache@@@@
.?AV?$_Func_base@XPAVCCoreSqlite@@U_Nil@std@@U23@U23@U23@U23@U23@@std@@
.?AV?$_Func_base@XPAVCCoreSqlite@@U_Nil@std@@U23@U23@U23@U23@U23@@std@@
.?AV?$_Bind@$00XU?$_Pmf_wrap@P8CCoreChrome@@AEXPAVCCoreSqlite@@PAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@ZXV1@PAV2@PAV34@U_Nil@std@@U56@U56@U56@U56@@std@@QAVCCoreChrome@@AAV?$_Ph@$00@2@PAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@U_Nil@2@U72@U72@U72@@std@@
.?AV?$_Bind@$00XU?$_Pmf_wrap@P8CCoreChrome@@AEXPAVCCoreSqlite@@PAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@ZXV1@PAV2@PAV34@U_Nil@std@@U56@U56@U56@U56@@std@@QAVCCoreChrome@@AAV?$_Ph@$00@2@PAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@U_Nil@2@U72@U72@U72@@std@@
.?AVCCoreFirefoxXpiInstaller@@
.?AVCCoreFirefoxXpiInstaller@@
.?AV?$_Ref_count_obj@VCCoreOpera@@@std@@
.?AV?$_Ref_count_obj@VCCoreOpera@@@std@@
.?AV?$_Ref_count_obj@VCCoreChrome@@@std@@
.?AV?$_Ref_count_obj@VCCoreChrome@@@std@@
.?AV?$_Ref_count_obj@VCCoreFirefox@@@std@@
.?AV?$_Ref_count_obj@VCCoreFirefox@@@std@@
.?AV?$_Ref_count_obj@VCDetectionChromePrefs@@@std@@
.?AV?$_Ref_count_obj@VCDetectionChromePrefs@@@std@@
.?AV?$_Ref_count_obj@VCDetectionFirefoxPrefs@@@std@@
.?AV?$_Ref_count_obj@VCDetectionFirefoxPrefs@@@std@@
.?AVCDetectionFirefoxPrefs@@
.?AVCDetectionFirefoxPrefs@@
.?AVCDetectionChromePrefs@@
.?AVCDetectionChromePrefs@@
.?AV?$CAtlArray@UWebArg@@V?$CElementTraits@UWebArg@@@ATL@@@ATL@@
.?AV?$CAtlArray@UWebArg@@V?$CElementTraits@UWebArg@@@ATL@@@ATL@@
.?AVCCoreWebArgs@@
.?AVCCoreWebArgs@@
.?AVCCoreSqlite@@
.?AVCCoreSqlite@@
.?AV?$CAtlArray@PAV?$CAtlMap@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@V12@V?$CElementTraits@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@2@V32@@ATL@@V?$CElementTraits@PAV?$CAtlMap@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@V12@V?$CElementTraits@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@2@V32@@ATL@@@2@@ATL@@
.?AV?$CAtlArray@PAV?$CAtlMap@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@V12@V?$CElementTraits@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@2@V32@@ATL@@V?$CElementTraits@PAV?$CAtlMap@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@V12@V?$CElementTraits@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@2@V32@@ATL@@@2@@ATL@@
.?AVCCoreSqliteResult@@
.?AVCCoreSqliteResult@@
.?AVexecution_error@TinyXPath@@
.?AVexecution_error@TinyXPath@@
.?AVCCoreOpera@@
.?AVCCoreOpera@@
.?AV?$CFlags@W4CoreOperaCache@@@@
.?AV?$CFlags@W4CoreOperaCache@@@@
.?AVCCoreWebBrowserEvents@@
.?AVCCoreWebBrowserEvents@@
.?AUDWebBrowserEvents2@@
.?AUDWebBrowserEvents2@@
c:\%original file name%.exe
c:\%original file name%.exe
@.reloc
@.reloc
Vista.BadArgs
Vista.BadArgs
\cookie.ini
\cookie.ini
\cookie.dat
\cookie.dat
Vista.BadArgs2
Vista.BadArgs2
Domain%d
Domain%d
Name%d
Name%d
\cookie%d.dat
\cookie%d.dat
\cookie%d.ini
\cookie%d.ini
Vista.NoAppLow
Vista.NoAppLow
Vista.WideFail
Vista.WideFail
Vista.GetCookieFail
Vista.GetCookieFail
Vista.AllocFail
Vista.AllocFail
Vista.CreateFileError
Vista.CreateFileError
Vista.WriteFileError
Vista.WriteFileError
Vista.SetCookie
Vista.SetCookie
SetCookie%d
SetCookie%d
Vista.SetCookieError
Vista.SetCookieError
Error: %d. %s
Error: %d. %s
g:\winapps\Windows\MAIN\Installer.QuickStart.Application\ReleaseNoMFC\Installer.CookieMan.pdb
g:\winapps\Windows\MAIN\Installer.QuickStart.Application\ReleaseNoMFC\Installer.CookieMan.pdb
3 3%3,323
3 3%3,323
.ao &
.ao &
$.OA[W
$.OA[W
C_.jN
C_.jN
fs.MJ
fs.MJ
\%S6j
\%S6j
<.vmx>
<.vmx>
;.Ur?
;.Ur?
7:.Vmeu
7:.Vmeu
-N.sZ
-N.sZ
v.GEJh
v.GEJh
}N5%d
}N5%d
.nX9k
.nX9k
U;9%u
U;9%u
g 8%U
g 8%U
'/O.Axy
'/O.Axy
f7%X[
f7%X[
@: .pI^
@: .pI^
wajam_validate.exe
wajam_validate.exe
R2dmjg
R2dmjg
UfgjoTakI kOh2sBpiiXQ5aHkH54PEyalEhJGoQ2f4 uk1sGoYXOJtF2ApVp TeXkJr88UdpoOMr/PKSS mFkJb1VntNr7vs1o PgYtx58cRG16ybPJ7iEc3MKjKJXR8k6QIRJ70KWcCzBy2NPg3uNsm8yXW9Cdpf/MusJAgav8riCdcIbpG9pgfnP2OmSQVgx31PUv7ILFrQKFjmL7F5RtsER/hzD 9hvQZR4TdwFphHtMsLckLUtBaN9ftO povm0jrfFgmzdSs6XKFTgU2bHk95EmrEvIB1yEv9/U x8nqUiGdhS6kyODsrHYbedGkTZLyjAJQJTTpllBmWtVMCMd2f5q6Wp8AhjiqbYHJkbVrZVUNjnLlVv31kyJL3dhMjrw 3JQczrkLkeX797MQb3 RI8VaYss57IDdTkSKIDkidd 7bKrhcuEZXKjHmOkilHzMiw4YhO9dspXgwSzP0KZwkaTCYSvcQFMjazlqZwP yOlwgm7dFLqtch9kJNwNGW1dU3ochahfhL4MMT2g1a5 iqW2xixfcNXYNaiWgiS/Yeg4jq02 9YYFEWcmGjycgL44YUwWlKQXBmK0LRmYV3J9oskmZQM8GkfF8WDEkox6xxhqFoapE7QjYdWgV9lBhgNRB9q9jTbW fn4XtTDfkG8hd//GgxSWsNcgYJ0dCxKmk0t8eaRdqn7NojFxEEBMRW5q2pv4wvZesLl2TVj4/hzMKEAjiaFVlISUxIjuPu4Fn3BetZJc64qT8XDi3Q5 TaIBCnTHst0I7Avo4nxQw9QS7fOEsz5ka2ek5OXuBBQ7BoZMA0xKvWTnjcKyHRNCD CQxHtiHGkWagJ6XRiOcTE6ezSfsgae1wGia1r4aRhtilXNC5BvW2NY4oVMFoisgL9 Qh4qcJVkkSHUDT3PoUa1fP3ckeBvfnDQMgCX0SJvkGgmRbDEWlGSRQDL9hUo0CvWfBjenTtWfQihtKFkGR3kWPCDHwtRtRro7U4oyYIWTg8euUadrwvHxqpRhFLMAHYCQZxUVPgdK44GIE4A3CchPPLFAIh9cFmj5Zd/SF270pOMYzIPZFeGGcgURsyBKzpnI2qaGXoue PKI0FktfMAgpoEFjlNW7F0OQacO3jnCa9OnMMYWIbn914SVPsIHNJw6MpIHkV7GjT5dYTONzercQkMV hm3Qo3OCkUKopXUIZwUMCrNiLDgn3jdgVaXX6fV 7A0 TkS8dRl6NEBKhk3QOZiEjQthnGi4OWV039dYM7popTylHEg4L2RkFBWTg9g3DkX9k8X x2kIiQHyiyqKfDWoPm/mT5Hs8bjt0xAJKsmDNEtjZEFg/Cuwxkq50RrrPU5aMkbiLQNLZ4RVWK2pVlWfW1Y1TxZbRyLMMULzLX/SSGSI5EOOkr taibEUxNtROt1E1qjFwudyzME1EIu0iTjmfDpAG5BSxcgc7RP0j EalTHn1RMP4jzfDfrONA KKgEG6 prajvSNFVImDaiH0LI efpI33vMNbO5IDxi/Ji798DbbM26aZvopQ1bgBQ8oHQF53scYZ4sHzTFY00B3YBHIDol2gDi0FzThuReEjBTllRzblforCmMTord1GQiV39VftC1pMcw3cDWADRfWEdhoPy34OqWRLkRmv3JX6wi7sgcSt/PVzljwbzHLjJbwVirQyTxgW2g6S6tErsKew8VdiL D1cIYcY5zmPvmihAaElMhp sHXQ3bEdzEmsWsm2 /vlSxOogJKzcbSh2/07s6B79TnqoqL105VdE5G ilhd1e37Yi93U8Qq4ylc868PoBH5R2YihxCYg8yNJOtyGxCab74ilm18xLecbarB67ggLW9zApzMEImwGxnEz 1uuTMvfLHRrosuYawCPDwj O6I9h9dG/0BNalnb2v0NfvvawfaoOy RxkfaF9tRkaolmCKiTS9t2YLkYWocdrkSXMoqlSEvmkwTAJLRB8IqGgSk2IdPdXA1mL4FYz6XRAL/9K4DzfeCUmhC1s0gW76BIURrOvWBQVBl /0X4uxnHodJVq5Gkx5my9p01ZrMDUPeJH69YlgsjQBm0wjyLhZrbKpaX1TJEiI5sKmOMWB60wKR3kDmAO13Y4uZ978HADe92JInlSiDteWo91twi6V1OsxReN7PLykOyNtyAYgPAtLRqv4IHM/PL6B7aVgG/i tRYmsFlsYlpScOZGbxyuClyh b4 qAqyVgST/ErkG2l6NBlBLc9IhSQjydc2jItaM MPlYbOc51MITxt7YqMCp/95dcGdaxNd386QOixEF56lNVsFydLPpuH VSFR2uNHxAc5j6m9cVSKBOMNIxAZeRtKID0fJzl8MU58/F5V3omK5mOtOju1C8MKNTkTuqMofB9TfjHxqr YvTVFJWvBe8e5ATEEQn0rbf2Zo/cUY2n1oCjEaJ2FFlH627ndeGS4ev58AiU6rkoKeEBsxuH3P7Z5O18t/BkAGzokN67MrVaU9PK
UfgjoTakI kOh2sBpiiXQ5aHkH54PEyalEhJGoQ2f4 uk1sGoYXOJtF2ApVp TeXkJr88UdpoOMr/PKSS mFkJb1VntNr7vs1o PgYtx58cRG16ybPJ7iEc3MKjKJXR8k6QIRJ70KWcCzBy2NPg3uNsm8yXW9Cdpf/MusJAgav8riCdcIbpG9pgfnP2OmSQVgx31PUv7ILFrQKFjmL7F5RtsER/hzD 9hvQZR4TdwFphHtMsLckLUtBaN9ftO povm0jrfFgmzdSs6XKFTgU2bHk95EmrEvIB1yEv9/U x8nqUiGdhS6kyODsrHYbedGkTZLyjAJQJTTpllBmWtVMCMd2f5q6Wp8AhjiqbYHJkbVrZVUNjnLlVv31kyJL3dhMjrw 3JQczrkLkeX797MQb3 RI8VaYss57IDdTkSKIDkidd 7bKrhcuEZXKjHmOkilHzMiw4YhO9dspXgwSzP0KZwkaTCYSvcQFMjazlqZwP yOlwgm7dFLqtch9kJNwNGW1dU3ochahfhL4MMT2g1a5 iqW2xixfcNXYNaiWgiS/Yeg4jq02 9YYFEWcmGjycgL44YUwWlKQXBmK0LRmYV3J9oskmZQM8GkfF8WDEkox6xxhqFoapE7QjYdWgV9lBhgNRB9q9jTbW fn4XtTDfkG8hd//GgxSWsNcgYJ0dCxKmk0t8eaRdqn7NojFxEEBMRW5q2pv4wvZesLl2TVj4/hzMKEAjiaFVlISUxIjuPu4Fn3BetZJc64qT8XDi3Q5 TaIBCnTHst0I7Avo4nxQw9QS7fOEsz5ka2ek5OXuBBQ7BoZMA0xKvWTnjcKyHRNCD CQxHtiHGkWagJ6XRiOcTE6ezSfsgae1wGia1r4aRhtilXNC5BvW2NY4oVMFoisgL9 Qh4qcJVkkSHUDT3PoUa1fP3ckeBvfnDQMgCX0SJvkGgmRbDEWlGSRQDL9hUo0CvWfBjenTtWfQihtKFkGR3kWPCDHwtRtRro7U4oyYIWTg8euUadrwvHxqpRhFLMAHYCQZxUVPgdK44GIE4A3CchPPLFAIh9cFmj5Zd/SF270pOMYzIPZFeGGcgURsyBKzpnI2qaGXoue PKI0FktfMAgpoEFjlNW7F0OQacO3jnCa9OnMMYWIbn914SVPsIHNJw6MpIHkV7GjT5dYTONzercQkMV hm3Qo3OCkUKopXUIZwUMCrNiLDgn3jdgVaXX6fV 7A0 TkS8dRl6NEBKhk3QOZiEjQthnGi4OWV039dYM7popTylHEg4L2RkFBWTg9g3DkX9k8X x2kIiQHyiyqKfDWoPm/mT5Hs8bjt0xAJKsmDNEtjZEFg/Cuwxkq50RrrPU5aMkbiLQNLZ4RVWK2pVlWfW1Y1TxZbRyLMMULzLX/SSGSI5EOOkr taibEUxNtROt1E1qjFwudyzME1EIu0iTjmfDpAG5BSxcgc7RP0j EalTHn1RMP4jzfDfrONA KKgEG6 prajvSNFVImDaiH0LI efpI33vMNbO5IDxi/Ji798DbbM26aZvopQ1bgBQ8oHQF53scYZ4sHzTFY00B3YBHIDol2gDi0FzThuReEjBTllRzblforCmMTord1GQiV39VftC1pMcw3cDWADRfWEdhoPy34OqWRLkRmv3JX6wi7sgcSt/PVzljwbzHLjJbwVirQyTxgW2g6S6tErsKew8VdiL D1cIYcY5zmPvmihAaElMhp sHXQ3bEdzEmsWsm2 /vlSxOogJKzcbSh2/07s6B79TnqoqL105VdE5G ilhd1e37Yi93U8Qq4ylc868PoBH5R2YihxCYg8yNJOtyGxCab74ilm18xLecbarB67ggLW9zApzMEImwGxnEz 1uuTMvfLHRrosuYawCPDwj O6I9h9dG/0BNalnb2v0NfvvawfaoOy RxkfaF9tRkaolmCKiTS9t2YLkYWocdrkSXMoqlSEvmkwTAJLRB8IqGgSk2IdPdXA1mL4FYz6XRAL/9K4DzfeCUmhC1s0gW76BIURrOvWBQVBl /0X4uxnHodJVq5Gkx5my9p01ZrMDUPeJH69YlgsjQBm0wjyLhZrbKpaX1TJEiI5sKmOMWB60wKR3kDmAO13Y4uZ978HADe92JInlSiDteWo91twi6V1OsxReN7PLykOyNtyAYgPAtLRqv4IHM/PL6B7aVgG/i tRYmsFlsYlpScOZGbxyuClyh b4 qAqyVgST/ErkG2l6NBlBLc9IhSQjydc2jItaM MPlYbOc51MITxt7YqMCp/95dcGdaxNd386QOixEF56lNVsFydLPpuH VSFR2uNHxAc5j6m9cVSKBOMNIxAZeRtKID0fJzl8MU58/F5V3omK5mOtOju1C8MKNTkTuqMofB9TfjHxqr YvTVFJWvBe8e5ATEEQn0rbf2Zo/cUY2n1oCjEaJ2FFlH627ndeGS4ev58AiU6rkoKeEBsxuH3P7Z5O18t/BkAGzokN67MrVaU9PK
op.YI
op.YI
i8bB .jH
i8bB .jH
76_5-{<.>
76_5-{<.>
.cc,vNT
.cc,vNT
%uD7b
%uD7b
&k%f"
&k%f"
m7%Fm
m7%Fm
fW.oxBQ
fW.oxBQ
#C.jK
#C.jK
m.akV
m.akV
.ko &
.ko &
csqL
csqL
`R7%f
`R7%f
@bÃŽT
@bÃŽT
`>2A.er
`>2A.er
&.eEu
&.eEu
55997C50-1F00-4D74-BAEF-46A658272B17.zip
55997C50-1F00-4D74-BAEF-46A658272B17.zip
E9E56BE3-7EC7-450B-9C2E-BA9B0BCD6B05.zip
E9E56BE3-7EC7-450B-9C2E-BA9B0BCD6B05.zip
4594AF2F-4D07-4B39-B15B-443A87882878.zipi4
4594AF2F-4D07-4B39-B15B-443A87882878.zipi4
AFB3988D-640F-43BB-8422-D40ED6AA32BE.zip
AFB3988D-640F-43BB-8422-D40ED6AA32BE.zip
F80287B7-718C-4676-AC71-3F1AB04A60E1.zipv
F80287B7-718C-4676-AC71-3F1AB04A60E1.zipv
B7109C6A-73CA-4979-B038-5AE45CBE649F.zip
B7109C6A-73CA-4979-B038-5AE45CBE649F.zip
AD04DC3C-8B12-4879-83E3-523DF600D9DE.zip
AD04DC3C-8B12-4879-83E3-523DF600D9DE.zip
theanswerfinder.vi.zip
theanswerfinder.vi.zip
099AEF6E-E690-4A5C-85F8-481343649504.zip
099AEF6E-E690-4A5C-85F8-481343649504.zip
E92D7B47-33AD-4469-81D4-CB551DE8DDA8.zip
E92D7B47-33AD-4469-81D4-CB551DE8DDA8.zip
7E447291-0A05-4EB1-98E9-49ECF3C139D1.zip
7E447291-0A05-4EB1-98E9-49ECF3C139D1.zip
BB13E620-1EBA-47D8-A623-39986DE12F1F.zipT/|
BB13E620-1EBA-47D8-A623-39986DE12F1F.zipT/|
B2B00637-BC0D-48D8-B686-9F13DA5E04A1.zip
B2B00637-BC0D-48D8-B686-9F13DA5E04A1.zip
42FDD0AA-EAD7-45DD-8421-47492FCFF9DB.zip
42FDD0AA-EAD7-45DD-8421-47492FCFF9DB.zip
7BAB633E-6C2D-45CC-BFE3-A79142FDABBF.zip
7BAB633E-6C2D-45CC-BFE3-A79142FDABBF.zip
73EB1E3A-0BE4-4F19-8F38-6B2B93DB1927.zipj
73EB1E3A-0BE4-4F19-8F38-6B2B93DB1927.zipj
5C22ACAC-4D3A-4D89-9980-81FBB493E7B8.zip
5C22ACAC-4D3A-4D89-9980-81FBB493E7B8.zip
C4B20519-3B35-4A1C-BB5C-695D80D9C28D.zipmP
C4B20519-3B35-4A1C-BB5C-695D80D9C28D.zipmP
ECBFC9AB-A637-4487-9A66-817881951C55.zipU!*-2E
ECBFC9AB-A637-4487-9A66-817881951C55.zipU!*-2E
8BF6320F-C08A-446A-80A8-FBCCDBA35CB7.zip
8BF6320F-C08A-446A-80A8-FBCCDBA35CB7.zip
B88FF7FD-BE0E-44BC-97BC-D6943F9F8A86.zipH
B88FF7FD-BE0E-44BC-97BC-D6943F9F8A86.zipH
80A3CCD4-64BC-4AF8-853B-ABA075AE5218.zip
80A3CCD4-64BC-4AF8-853B-ABA075AE5218.zip
0393A455-8396-4E79-8339-7DAEDC83567B.zip
0393A455-8396-4E79-8339-7DAEDC83567B.zip
441493C8-0E32-4504-B8CC-7851FFF110EC.zip
441493C8-0E32-4504-B8CC-7851FFF110EC.zip
13D66679-5DC0-48AA-BB42-E7BD34CEBAE2.zip
13D66679-5DC0-48AA-BB42-E7BD34CEBAE2.zip
`&.YH
`&.YH
404D0823-2D00-44F7-AC98-92F79F87E4F2.zipK
404D0823-2D00-44F7-AC98-92F79F87E4F2.zipK
AF33782B-57D0-466B-831D-0CE47455F809.zip
AF33782B-57D0-466B-831D-0CE47455F809.zip
9332870F-9082-4684-AFF2-8C852FCEE8D7.zip
9332870F-9082-4684-AFF2-8C852FCEE8D7.zip
F3DA0320-7EB0-4648-BE62-3B08958C9B3E.zip(
F3DA0320-7EB0-4648-BE62-3B08958C9B3E.zip(
4FFA1EE1-2AD7-40C8-9643-B801D9DED1A0.zip
4FFA1EE1-2AD7-40C8-9643-B801D9DED1A0.zip
224505F1-4910-4879-A9AD-B70D1AE1A120.zipn*
224505F1-4910-4879-A9AD-B70D1AE1A120.zipn*
66DFABC3-9023-45A3-A5DE-FA8CAAEF0AAC.zipK&
66DFABC3-9023-45A3-A5DE-FA8CAAEF0AAC.zipK&
2E076E93-E171-4F73-A0D5-5BFDDE0E4783.zipZ
2E076E93-E171-4F73-A0D5-5BFDDE0E4783.zipZ
DF86C614-36F8-4BE3-A1A0-78E774802EE7.zipM
DF86C614-36F8-4BE3-A1A0-78E774802EE7.zipM
2704D408-C40A-4848-BC30-B5478423E8C9.zipM
2704D408-C40A-4848-BC30-B5478423E8C9.zipM
BF68CAAA-24EB-4A90-94B1-A68D8718116D.zip
BF68CAAA-24EB-4A90-94B1-A68D8718116D.zip
1E00B2CE-84B4-4764-A567-81130045EEE4.zipl!
1E00B2CE-84B4-4764-A567-81130045EEE4.zipl!
226383C9-5E0D-4ABD-8308-30F31DD040A6.zipp
226383C9-5E0D-4ABD-8308-30F31DD040A6.zipp
B7F6A91D-8542-4B59-A285-EF08E6922F28.zip
B7F6A91D-8542-4B59-A285-EF08E6922F28.zip
F5C1E3BE-C571-4295-82AB-9C78A7DFD0BA.zip
F5C1E3BE-C571-4295-82AB-9C78A7DFD0BA.zip
8C58D003-E863-4399-A7CF-A32275393FD1.zip
8C58D003-E863-4399-A7CF-A32275393FD1.zip
F3823C96-34C1-478F-BA9E-3F84F3D6094F.zipE
F3823C96-34C1-478F-BA9E-3F84F3D6094F.zipE
225E5BB2-B83F-478E-B774-62F53C2BCAD7.zip
225E5BB2-B83F-478E-B774-62F53C2BCAD7.zip
$%f.r
$%f.r
3927F92B-2CF0-4555-8A62-C42865E873C2.zipdb
3927F92B-2CF0-4555-8A62-C42865E873C2.zipdb
1D677809-65E4-4CBA-B3B2-1705755F5F07.ziplz
1D677809-65E4-4CBA-B3B2-1705755F5F07.ziplz
00EB7EC2-4B2C-4603-9043-79A1C36414EE.zip
00EB7EC2-4B2C-4603-9043-79A1C36414EE.zip
7D03F38F-AF42-4EAB-837C-E8B4B2D9B644.zip
7D03F38F-AF42-4EAB-837C-E8B4B2D9B644.zip
{ol`%X
{ol`%X
D21384DD-7E7F-4D84-9C43-6D82036FA24F.zip
D21384DD-7E7F-4D84-9C43-6D82036FA24F.zip
~o$(%x
~o$(%x
.ybyZ
.ybyZ
.uu"`%
.uu"`%
?k{H<.dv>
?k{H<.dv>
.PIE'|
.PIE'|
P;{7%S~V
P;{7%S~V
.XEw U
.XEw U
.hGlp
.hGlp
mediaplayer_12478.txt%
mediaplayer_12478.txt%
config.xmlPK
config.xmlPK
55997C50-1F00-4D74-BAEF-46A658272B17.zipPK
55997C50-1F00-4D74-BAEF-46A658272B17.zipPK
E9E56BE3-7EC7-450B-9C2E-BA9B0BCD6B05.zipPK
E9E56BE3-7EC7-450B-9C2E-BA9B0BCD6B05.zipPK
4594AF2F-4D07-4B39-B15B-443A87882878.zipPK
4594AF2F-4D07-4B39-B15B-443A87882878.zipPK
AFB3988D-640F-43BB-8422-D40ED6AA32BE.zipPK
AFB3988D-640F-43BB-8422-D40ED6AA32BE.zipPK
F80287B7-718C-4676-AC71-3F1AB04A60E1.zipPK
F80287B7-718C-4676-AC71-3F1AB04A60E1.zipPK
B7109C6A-73CA-4979-B038-5AE45CBE649F.zipPK
B7109C6A-73CA-4979-B038-5AE45CBE649F.zipPK
AD04DC3C-8B12-4879-83E3-523DF600D9DE.zipPK
AD04DC3C-8B12-4879-83E3-523DF600D9DE.zipPK
theanswerfinder.vi.zipPK
theanswerfinder.vi.zipPK
099AEF6E-E690-4A5C-85F8-481343649504.zipPK
099AEF6E-E690-4A5C-85F8-481343649504.zipPK
E92D7B47-33AD-4469-81D4-CB551DE8DDA8.zipPK
E92D7B47-33AD-4469-81D4-CB551DE8DDA8.zipPK
7E447291-0A05-4EB1-98E9-49ECF3C139D1.zipPK
7E447291-0A05-4EB1-98E9-49ECF3C139D1.zipPK
BB13E620-1EBA-47D8-A623-39986DE12F1F.zipPK
BB13E620-1EBA-47D8-A623-39986DE12F1F.zipPK
B2B00637-BC0D-48D8-B686-9F13DA5E04A1.zipPK
B2B00637-BC0D-48D8-B686-9F13DA5E04A1.zipPK
42FDD0AA-EAD7-45DD-8421-47492FCFF9DB.zipPK
42FDD0AA-EAD7-45DD-8421-47492FCFF9DB.zipPK
7BAB633E-6C2D-45CC-BFE3-A79142FDABBF.zipPK
7BAB633E-6C2D-45CC-BFE3-A79142FDABBF.zipPK
73EB1E3A-0BE4-4F19-8F38-6B2B93DB1927.zipPK
73EB1E3A-0BE4-4F19-8F38-6B2B93DB1927.zipPK
5C22ACAC-4D3A-4D89-9980-81FBB493E7B8.zipPK
5C22ACAC-4D3A-4D89-9980-81FBB493E7B8.zipPK
C4B20519-3B35-4A1C-BB5C-695D80D9C28D.zipPK
C4B20519-3B35-4A1C-BB5C-695D80D9C28D.zipPK
ECBFC9AB-A637-4487-9A66-817881951C55.zipPK
ECBFC9AB-A637-4487-9A66-817881951C55.zipPK
8BF6320F-C08A-446A-80A8-FBCCDBA35CB7.zipPK
8BF6320F-C08A-446A-80A8-FBCCDBA35CB7.zipPK
B88FF7FD-BE0E-44BC-97BC-D6943F9F8A86.zipPK
B88FF7FD-BE0E-44BC-97BC-D6943F9F8A86.zipPK
80A3CCD4-64BC-4AF8-853B-ABA075AE5218.zipPK
80A3CCD4-64BC-4AF8-853B-ABA075AE5218.zipPK
0393A455-8396-4E79-8339-7DAEDC83567B.zipPK
0393A455-8396-4E79-8339-7DAEDC83567B.zipPK
441493C8-0E32-4504-B8CC-7851FFF110EC.zipPK
441493C8-0E32-4504-B8CC-7851FFF110EC.zipPK
13D66679-5DC0-48AA-BB42-E7BD34CEBAE2.zipPK
13D66679-5DC0-48AA-BB42-E7BD34CEBAE2.zipPK
404D0823-2D00-44F7-AC98-92F79F87E4F2.zipPK
404D0823-2D00-44F7-AC98-92F79F87E4F2.zipPK
AF33782B-57D0-466B-831D-0CE47455F809.zipPK
AF33782B-57D0-466B-831D-0CE47455F809.zipPK
9332870F-9082-4684-AFF2-8C852FCEE8D7.zipPK
9332870F-9082-4684-AFF2-8C852FCEE8D7.zipPK
F3DA0320-7EB0-4648-BE62-3B08958C9B3E.zipPK
F3DA0320-7EB0-4648-BE62-3B08958C9B3E.zipPK
4FFA1EE1-2AD7-40C8-9643-B801D9DED1A0.zipPK
4FFA1EE1-2AD7-40C8-9643-B801D9DED1A0.zipPK
224505F1-4910-4879-A9AD-B70D1AE1A120.zipPK
224505F1-4910-4879-A9AD-B70D1AE1A120.zipPK
66DFABC3-9023-45A3-A5DE-FA8CAAEF0AAC.zipPK
66DFABC3-9023-45A3-A5DE-FA8CAAEF0AAC.zipPK
2E076E93-E171-4F73-A0D5-5BFDDE0E4783.zipPK
2E076E93-E171-4F73-A0D5-5BFDDE0E4783.zipPK
DF86C614-36F8-4BE3-A1A0-78E774802EE7.zipPK
DF86C614-36F8-4BE3-A1A0-78E774802EE7.zipPK
2704D408-C40A-4848-BC30-B5478423E8C9.zipPK
2704D408-C40A-4848-BC30-B5478423E8C9.zipPK
BF68CAAA-24EB-4A90-94B1-A68D8718116D.zipPK
BF68CAAA-24EB-4A90-94B1-A68D8718116D.zipPK
1E00B2CE-84B4-4764-A567-81130045EEE4.zipPK
1E00B2CE-84B4-4764-A567-81130045EEE4.zipPK
226383C9-5E0D-4ABD-8308-30F31DD040A6.zipPK
226383C9-5E0D-4ABD-8308-30F31DD040A6.zipPK
B7F6A91D-8542-4B59-A285-EF08E6922F28.zipPK
B7F6A91D-8542-4B59-A285-EF08E6922F28.zipPK
F5C1E3BE-C571-4295-82AB-9C78A7DFD0BA.zipPK
F5C1E3BE-C571-4295-82AB-9C78A7DFD0BA.zipPK
8C58D003-E863-4399-A7CF-A32275393FD1.zipPK
8C58D003-E863-4399-A7CF-A32275393FD1.zipPK
F3823C96-34C1-478F-BA9E-3F84F3D6094F.zipPK
F3823C96-34C1-478F-BA9E-3F84F3D6094F.zipPK
225E5BB2-B83F-478E-B774-62F53C2BCAD7.zipPK
225E5BB2-B83F-478E-B774-62F53C2BCAD7.zipPK
3927F92B-2CF0-4555-8A62-C42865E873C2.zipPK
3927F92B-2CF0-4555-8A62-C42865E873C2.zipPK
1D677809-65E4-4CBA-B3B2-1705755F5F07.zipPK
1D677809-65E4-4CBA-B3B2-1705755F5F07.zipPK
00EB7EC2-4B2C-4603-9043-79A1C36414EE.zipPK
00EB7EC2-4B2C-4603-9043-79A1C36414EE.zipPK
7D03F38F-AF42-4EAB-837C-E8B4B2D9B644.zipPK
7D03F38F-AF42-4EAB-837C-E8B4B2D9B644.zipPK
D21384DD-7E7F-4D84-9C43-6D82036FA24F.zipPK
D21384DD-7E7F-4D84-9C43-6D82036FA24F.zipPK
mediaplayer_12478.txtPK
mediaplayer_12478.txtPK
PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX
PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX
Emscoree.dll
Emscoree.dll
- CRT not initialized
- CRT not initialized
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- floating point support not loaded
- floating point support not loaded
USER32.DLL
USER32.DLL
combase.dll
combase.dll
777705555443332
777705555443332
5555443332
5555443332
5555443332
5555443332
mscoree.dll
mscoree.dll
_T{hfiws| sijn^sftqawlbl^edro jnye{esdasf zahnj pimn{tpeer|nce|tx _cfojndnte^c^trioo]ns ]aqvoatitl|a`bol_ee ^ifnf ko_rhdoehrf `tfof bcloanstwiqneuxea lwciftvhl gtrhle^ sicn|sitgailel|adtpisoenq.u a dP]lye|a^sfet jdvizslalbyl{ee `axnhy{ jf|i{rneswuaml]lrss `awnkdy ^mmaukoe^ lsauwrhej wyboyu_ cadrhev pceoincnseycrtwelds ]troh utnhxek kiunhtleyrunieatq,f ea]njdy {rwemt{roym rt{heeh kinnnsat_aslbleaztsioounb.k
_T{hfiws| sijn^sftqawlbl^edro jnye{esdasf zahnj pimn{tpeer|nce|tx _cfojndnte^c^trioo]ns ]aqvoatitl|a`bol_ee ^ifnf ko_rhdoehrf `tfof bcloanstwiqneuxea lwciftvhl gtrhle^ sicn|sitgailel|adtpisoenq.u a dP]lye|a^sfet jdvizslalbyl{ee `axnhy{ jf|i{rneswuaml]lrss `awnkdy ^mmaukoe^ lsauwrhej wyboyu_ cadrhev pceoincnseycrtwelds ]troh utnhxek kiunhtleyrunieatq,f ea]njdy {rwemt{roym rt{heeh kinnnsat_aslbleaztsioounb.k
_Y{ofuw |msujs^tf qbweb ^ldoogjgye{ds aifnz hajsp ma{np ea|dcm|ixn_ifsjtdrta^t^orro ]tso] qcootmtp|l`eot_ee ^tfhfek _ihnoshtfa`lflfabtliaosnw qoenx atlhcifsv lcgormlp^ustce|ri.g iPel|edapssee qluoagd ]iyn| ^ufstijnvgz lyloyu{re `axdhm{ijn|i{sntsruamt]orrs `awckcyo^umnuto ^alnadw hrjewtbryy_ ctdhhev pienisctsaylrlwaltsi]ornh.u
_Y{ofuw |msujs^tf qbweb ^ldoogjgye{ds aifnz hajsp ma{np ea|dcm|ixn_ifsjtdrta^t^orro ]tso] qcootmtp|l`eot_ee ^tfhfek _ihnoshtfa`lflfabtliaosnw qoenx atlhcifsv lcgormlp^ustce|ri.g iPel|edapssee qluoagd ]iyn| ^ufstijnvgz lyloyu{re `axdhm{ijn|i{sntsruamt]orrs `awckcyo^umnuto ^alnadw hrjewtbryy_ ctdhhev pienisctsaylrlwaltsi]ornh.u
_T{hfiws| sijn^sftqawlbl^edro jrye{qsuaifrzehsj pImn{tpeer|nce|tx _Efxjpdlto^r^erro ]vse]rqsoitotn| `6o _oer^ fhfikg_hheorh.f `Pflfebalsaes wuqpedxaatlec fyvolugrr lc^osmcp|uitgeire |adnpds erqeutardy] yt|h^ef tijnvsztlallyl{aet`ixohn{.jTSfoprkr_ye!b
_T{hfiws| sijn^sftqawlbl^edro jrye{qsuaifrzehsj pImn{tpeer|nce|tx _Efxjpdlto^r^erro ]vse]rqsoitotn| `6o _oer^ fhfikg_hheorh.f `Pflfebalsaes wuqpedxaatlec fyvolugrr lc^osmcp|uitgeire |adnpds erqeutardy] yt|h^ef tijnvsztlallyl{aet`ixohn{.jTSfoprkr_ye!b
cPflvelagsrel ^dsics|aibgliee |adnpys efqiuraedw]ayl|l^sf tajnvdz lmlayk{ee `sxuhr{ej |y{onus uamr]er sc`ownknye^cmtueod^ ltaow htjhweb yi_nctdehrvnpeeti,c saynrdw lrse]trrhyu ntxhkek uihnlsytuailalqaftei]ojny.{
cPflvelagsrel ^dsics|aibgliee |adnpys efqiuraedw]ayl|l^sf tajnvdz lmlayk{ee `sxuhr{ej |y{onus uamr]er sc`ownknye^cmtueod^ ltaow htjhweb yi_nctdehrvnpeeti,c saynrdw lrse]trrhyu ntxhkek uihnlsytuailalqaftei]ojny.{
Ifnpskt_aelblqe_r{ fiws| sujn^afbqlweb ^tdoo jsyt{asratf.z hPjlpema{spee |ccl|oxs_ef jadltl^ ^ortoh]esr] qaoptptl|i`coa_tei^ofnfsk _ahnodh ft`rfyf balgaasiwnq.e
Ifnpskt_aelblqe_r{ fiws| sujn^afbqlweb ^tdoo jsyt{asratf.z hPjlpema{spee |ccl|oxs_ef jadltl^ ^ortoh]esr] qaoptptl|i`coa_tei^ofnfsk _ahnodh ft`rfyf balgaasiwnq.e
1.0.72.0
1.0.72.0
safeinstall.exe
safeinstall.exe
%original file name%.exe_880_rwx_00ED0000_00002000:
The procedure %s could not be located in the DLL %s.
The procedure %s could not be located in the DLL %s.
The ordinal %d could not be located in the DLL %s.
The ordinal %d could not be located in the DLL %s.
%original file name%.exe_880_rwx_10001000_00082000:
SSSSh
SSSSh
tcPW
tcPW
QSSSSSSh
QSSSSSSh
t%SWh
t%SWh
1.3.6.1.4.1.311.10.3.5
1.3.6.1.4.1.311.10.3.5
1.3.6.1.4.1.311.10.3.6
1.3.6.1.4.1.311.10.3.6
1.3.6.1.5.5.7.3.3
1.3.6.1.5.5.7.3.3
2.5.4.6
2.5.4.6
2.5.4.8
2.5.4.8
2.5.4.7
2.5.4.7
2.5.4.10
2.5.4.10
2.5.4.11
2.5.4.11
2.5.4.3
2.5.4.3
WINTRUST.dll
WINTRUST.dll
CRYPT32.dll
CRYPT32.dll
{X-X-X-XX-XXXXXX}
{X-X-X-XX-XXXXXX}
operator
operator
GetProcessWindowStation
GetProcessWindowStation
SCC_CheckCriteria_Web
SCC_CheckCriteria_Web
RegOpenKeyTransactedW
RegOpenKeyTransactedW
RegCreateKeyTransactedW
RegCreateKeyTransactedW
RegDeleteKeyTransactedW
RegDeleteKeyTransactedW
RegDeleteKeyExW
RegDeleteKeyExW
2.1.0.20
2.1.0.20
CryptCATCatalogInfoFromContext
CryptCATCatalogInfoFromContext
CryptMsgClose
CryptMsgClose
CertCloseStore
CertCloseStore
CertFreeCertificateContext
CertFreeCertificateContext
CertFindCertificateInStore
CertFindCertificateInStore
CryptMsgGetParam
CryptMsgGetParam
CertGetEnhancedKeyUsage
CertGetEnhancedKeyUsage
CertNameToStrW
CertNameToStrW
CertGetNameStringW
CertGetNameStringW
URLOpenStreamW
URLOpenStreamW
urlmon.dll
urlmon.dll
DeleteUrlCacheEntryW
DeleteUrlCacheEntryW
HttpOpenRequestW
HttpOpenRequestW
HttpAddRequestHeadersW
HttpAddRequestHeadersW
HttpSendRequestW
HttpSendRequestW
WININET.dll
WININET.dll
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
RegCloseKey
RegCloseKey
RegOpenKeyExW
RegOpenKeyExW
RegDeleteKeyW
RegDeleteKeyW
RegCreateKeyExW
RegCreateKeyExW
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteExW
ShellExecuteExW
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
SHLWAPI.dll
SHLWAPI.dll
USERENV.dll
USERENV.dll
GetProcessHeap
GetProcessHeap
GetWindowsDirectoryW
GetWindowsDirectoryW
GetCPInfo
GetCPInfo
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjectsEx
RegEnumKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegQueryInfoKeyW
OLEAUT32.dll
OLEAUT32.dll
SHDeleteKeyW
SHDeleteKeyW
SHDeleteEmptyKeyW
SHDeleteEmptyKeyW
SYMCCIS.dll
SYMCCIS.dll
zcÃ
zcÃ
c:\%original file name%.exe
c:\%original file name%.exe
0xX
0xX
..\Source\ccVerifyTrustStatic.cpp
..\Source\ccVerifyTrustStatic.cpp
%SymEFA%
%SymEFA%
EFACli.dll
EFACli.dll
CLSID\%s\LocalServer32
CLSID\%s\LocalServer32
CLSID\%s\InprocServer32
CLSID\%s\InprocServer32
NTDLL.DLL
NTDLL.DLL
..\Source\ccVerifyTrustImpl.cpp
..\Source\ccVerifyTrustImpl.cpp
..\Source\FileCache.cpp
..\Source\FileCache.cpp
g..\Source\VerifyFile.cpp
g..\Source\VerifyFile.cpp
..\Source\ccVerifyTrustPolicy.cpp
..\Source\ccVerifyTrustPolicy.cpp
..\Source\CatalogIterator.cpp
..\Source\CatalogIterator.cpp
..\Source\CatalogFileHash.cpp
..\Source\CatalogFileHash.cpp
WinTrust.dll
WinTrust.dll
..\Source\CatalogContext.cpp
..\Source\CatalogContext.cpp
..\Source\ccSymModuleLifetimeMgrImpl.cpp
..\Source\ccSymModuleLifetimeMgrImpl.cpp
%s, %s, %s, %s(%ld)
%s, %s, %s, %s(%ld)
..\Source\ccModule.cpp
..\Source\ccModule.cpp
..\Source\ccSystemInfo.cpp
..\Source\ccSystemInfo.cpp
..\Source\ccRegistry.cpp
..\Source\ccRegistry.cpp
..\Source\ccStringConvert.cpp
..\Source\ccStringConvert.cpp
CSIDL_WINDOWS
CSIDL_WINDOWS
SOFTWARE\Microsoft\Windows\CurrentVersion
SOFTWARE\Microsoft\Windows\CurrentVersion
..\Source\ccPathExpansion.cpp
..\Source\ccPathExpansion.cpp
\\?\UNC
\\?\UNC
..\Source\ccSplitPath.cpp
..\Source\ccSplitPath.cpp
..\Source\ccOSInfo.cpp
..\Source\ccOSInfo.cpp
\wpeutil.dll
\wpeutil.dll
\FACTORY.exe
\FACTORY.exe
\wpeinit.exe
\wpeinit.exe
..\Source\ccMemory.cpp
..\Source\ccMemory.cpp
..\Source\ccFile.cpp
..\Source\ccFile.cpp
..\Source\ccWow64FsRedirection.cpp
..\Source\ccWow64FsRedirection.cpp
%s\%s
%s\%s
CIsolation::GetRegistryHive(): RegOpenKeyEx() returned ERROR_FILE_NOT_FOUND
CIsolation::GetRegistryHive(): RegOpenKeyEx() returned ERROR_FILE_NOT_FOUND
CIsolation::GetRegistryHive(): RegOpenKeyEx() returned ERROR_ACCESS_DENIED
CIsolation::GetRegistryHive(): RegOpenKeyEx() returned ERROR_ACCESS_DENIED
isolate.ini
isolate.ini
%COMMON_SILO_DATA%
%COMMON_SILO_DATA%
..\Source\ccEncryptedString.cpp
..\Source\ccEncryptedString.cpp
..\Source\ccSynchronize.cpp
..\Source\ccSynchronize.cpp
..\Source\ccSymDllLifetimeMgr.cpp
..\Source\ccSymDllLifetimeMgr.cpp
kernel32.dll
kernel32.dll
KERNEL32.DLL
KERNEL32.DLL
PSAPI.DLL
PSAPI.DLL
..\Source\ccPEBReader.cpp
..\Source\ccPEBReader.cpp
..\Source\ccPrivilege.cpp
..\Source\ccPrivilege.cpp
..\Source\ccSymIndexValueCollectionImpl.cpp
..\Source\ccSymIndexValueCollectionImpl.cpp
AWTSAPI32.DLL
AWTSAPI32.DLL
..\Source\ccSymDllLifetimeMgrLocal.cpp
..\Source\ccSymDllLifetimeMgrLocal.cpp
..\Source\ccSymIndexValueCollection.cpp
..\Source\ccSymIndexValueCollection.cpp
..\Source\ccSymValueCollection.cpp
..\Source\ccSymValueCollection.cpp
ÃŒROOT%
ÃŒROOT%
rcPFRes.dll
rcPFRes.dll
rcPxyEvt.dll
rcPxyEvt.dll
rcProxy.dll
rcProxy.dll
rcSvcHst.dll
rcSvcHst.dll
rcEmlPxy.dll
rcEmlPxy.dll
rcLgView.dll
rcLgView.dll
rcErrDsp.dll
rcErrDsp.dll
rcAlert.dll
rcAlert.dll
rcApp.dll
rcApp.dll
ccEmlPxy.dll
ccEmlPxy.dll
ccGLog.dll
ccGLog.dll
ccJobMgr.dll
ccJobMgr.dll
ccGEvt.dll
ccGEvt.dll
ccIPC.dll
ccIPC.dll
ccRkSn.dll
ccRkSn.dll
PFPriv.dll
PFPriv.dll
ccPxyIns.dll
ccPxyIns.dll
ccPxyEvt.dll
ccPxyEvt.dll
ccInst64.dll
ccInst64.dll
ccEvtCli.dll
ccEvtCli.dll
ccTrstPc.dll
ccTrstPc.dll
ccSvc.dll
ccSvc.dll
ccEraser.dll
ccEraser.dll
OEHeur.dll
OEHeur.dll
ccCharCv.dll
ccCharCv.dll
ccInst.dll
ccInst.dll
DefUtDCD.dll
DefUtDCD.dll
ccScanw.dll
ccScanw.dll
ccScan.dll
ccScan.dll
dec_abi.dll
dec_abi.dll
ccDec.dll
ccDec.dll
ccALEng.dll
ccALEng.dll
ccErrDsp.dll
ccErrDsp.dll
ccProSub.dll
ccProSub.dll
ccVrTrst.dll
ccVrTrst.dll
ccSetEvt.dll
ccSetEvt.dll
ccSet.dll
ccSet.dll
ccAlert.dll
ccAlert.dll
..\Source\ccArchive.cpp
..\Source\ccArchive.cpp
..\Source\ccDummyArchive.cpp
..\Source\ccDummyArchive.cpp
..\Source\ccInstanceFactory.cpp
..\Source\ccInstanceFactory.cpp
..\Source\ccSymValueCollectionConvert.cpp
..\Source\ccSymValueCollectionConvert.cpp
..\Source\ccSymStreamArchive.cpp
..\Source\ccSymStreamArchive.cpp
Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders
Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
ÃŒROOT%\
ÃŒROOT%\
ÃŒDATA%\
ÃŒDATA%\
..\Source\ccSymInstalledApps.cpp
..\Source\ccSymInstalledApps.cpp
..\Source\ccSymDigest.cpp
..\Source\ccSymDigest.cpp
..\Source\ccSymKeyValueCollectionImpl.cpp
..\Source\ccSymKeyValueCollectionImpl.cpp
..\Source\ccSymMemoryImpl.cpp
..\Source\ccSymMemoryImpl.cpp
Archive.Write(CMemoryImpl::CSerializeImpl::Version) == FALSE
Archive.Write(CMemoryImpl::CSerializeImpl::Version) == FALSE
Archive.Read(nVersion) == FALSE
Archive.Read(nVersion) == FALSE
..\Source\ccSymStringImpl.cpp
..\Source\ccSymStringImpl.cpp
Archive.Write(CStringImpl::Version) == FALSE
Archive.Write(CStringImpl::Version) == FALSE
..\Source\ccSymInstanceFactoryImpl.cpp
..\Source\ccSymInstanceFactoryImpl.cpp
t..\Source\ccMessageLock.cpp
t..\Source\ccMessageLock.cpp
..\Source\ccSymKeyValueCollection.cpp
..\Source\ccSymKeyValueCollection.cpp
..\Source\ccSymPersist.cpp
..\Source\ccSymPersist.cpp
ÃŒROOT%\ccSet.dll
ÃŒROOT%\ccSet.dll
..\Source\ccSymObjectRepository.cpp
..\Source\ccSymObjectRepository.cpp
CommonClient\OBJID\%s
CommonClient\OBJID\%s
..\Source\ccMemoryArchive.cpp
..\Source\ccMemoryArchive.cpp
..\Source\ccSymMemoryStreamImpl.cpp
..\Source\ccSymMemoryStreamImpl.cpp
mscoree.dll
mscoree.dll
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
WUSER32.DLL
WUSER32.DLL
FileDownloader::callURLOpenStream
FileDownloader::callURLOpenStream
CHttpRequest::CHttpRequest
CHttpRequest::CHttpRequest
CHttpRequest::~CHttpRequest
CHttpRequest::~CHttpRequest
CHttpRequest::RequestPage
CHttpRequest::RequestPage
CHttpRequest::ParseURLW
CHttpRequest::ParseURLW
https
https
[s d, d - d:d:d:d]
[s d, d - d:d:d:d]
%s %ld
%s %ld
%s %s
%s %s
%s 0x%x
%s 0x%x
hXXp://cps.qalabs.symantec.com/teams/isp/symccis
hXXp://cps.qalabs.symantec.com/teams/isp/symccis
hXXp://liveupdate.symantecliveupdate.com/upgrade/NSS/SymCCIS/Staging
hXXp://liveupdate.symantecliveupdate.com/upgrade/NSS/SymCCIS/Staging
hXXp://liveupdate.symantecliveupdate.com/upgrade/NSS/SymCCIS/Production
hXXp://liveupdate.symantecliveupdate.com/upgrade/NSS/SymCCIS/Production
SymCCIS.dll
SymCCIS.dll
SCC.dll
SCC.dll
OfferUI.dll
OfferUI.dll
SymInstallStub.exe
SymInstallStub.exe
SymCCISDll.txt
SymCCISDll.txt
Total CheckCriteria execution time in seconds =
Total CheckCriteria execution time in seconds =
NortonOfferEngineImpl::CheckCriteria_Web
NortonOfferEngineImpl::CheckCriteria_Web
downloadStubInstallerExe() failed, HR =
downloadStubInstallerExe() failed, HR =
Failed to delete downloaded SCC.dll, GetLastError =
Failed to delete downloaded SCC.dll, GetLastError =
Failed to delete existing SCC.dll, GetLastError =
Failed to delete existing SCC.dll, GetLastError =
NortonOfferEngineImpl::downloadStubInstallerExe
NortonOfferEngineImpl::downloadStubInstallerExe
Failed to delete existing SymInstallStub.exe, GetLastError =
Failed to delete existing SymInstallStub.exe, GetLastError =
NortonOfferEngineImpl::buildComponentDownloadURL
NortonOfferEngineImpl::buildComponentDownloadURL
NortonOfferEngineImpl::getTestEnvironmentRootURL
NortonOfferEngineImpl::getTestEnvironmentRootURL
NortonOfferEngineImpl::getISExeDestPath
NortonOfferEngineImpl::getISExeDestPath
getISExeDestPath() returned =
getISExeDestPath() returned =
NortonOfferEngineImpl::sendPingForCheckCriteriaWeb
NortonOfferEngineImpl::sendPingForCheckCriteriaWeb
NortonOfferEngineImpl::getCheckCriteriaPingDataWeb
NortonOfferEngineImpl::getCheckCriteriaPingDataWeb
NortonOfferEngineImpl::getStubInstallerCmdLine
NortonOfferEngineImpl::getStubInstallerCmdLine
getStubInstallerCmdLine() returned =
getStubInstallerCmdLine() returned =
NortonOfferEngineImpl::deleteDeclineCountRegKeyForThisProduct
NortonOfferEngineImpl::deleteDeclineCountRegKeyForThisProduct
NortonOfferEngineImpl::deleteDeclineCountParentKeyIfNoMoreProductsExist
NortonOfferEngineImpl::deleteDeclineCountParentKeyIfNoMoreProductsExist
Deleting DeclineCount subkey for partner =
Deleting DeclineCount subkey for partner =
Failed to create/open DECLINE_COUNT_REG_KEY
Failed to create/open DECLINE_COUNT_REG_KEY
Advapi32.dll
Advapi32.dll
hXXp://stats.norton.com/n/p?
hXXp://stats.norton.com/n/p?
PingData::SendCheckCriteriaWebPing
PingData::SendCheckCriteriaWebPing
PingData::createBaseURL
PingData::createBaseURL
PingData::getCheckCriteriaPingURL
PingData::getCheckCriteriaPingURL
PingData::getCheckCriteriaWebPingURL
PingData::getCheckCriteriaWebPingURL
PingData::getInstallProductsPingURL
PingData::getInstallProductsPingURL
PingData::getOfferAcceptancePingURL
PingData::getOfferAcceptancePingURL
pingURL =
pingURL =
X.X
X.X
%u.%u.%u.%u.%u
%u.%u.%u.%u.%u
Utility::LaunchProcessWithShellExecute
Utility::LaunchProcessWithShellExecute
ShellExecuteEx failed, GetLastError =
ShellExecuteEx failed, GetLastError =
---8#-8-@
---8#-8-@
%original file name%.exe_880_rwx_10084000_00002000:
NRTN_OfferEngine_CheckCriteria_Web
NRTN_OfferEngine_CheckCriteria_Web
kernel32.dll
kernel32.dll
urlmon.dll
urlmon.dll
URLOpenStreamW
URLOpenStreamW
WININET.dll
WININET.dll
USER32.dll
USER32.dll
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjectsEx
ADVAPI32.dll
ADVAPI32.dll
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
SHLWAPI.dll
SHLWAPI.dll
USERENV.dll
USERENV.dll
OLEAUT32.dll
OLEAUT32.dll
2.1.0.20
2.1.0.20