Gen.Variant.Graftor.151493_4fd8e33a46 – Adaware

Gen:Variant.Graftor.151493 (AdAware), Backdoor.Win32.PcClient.FD, Installer.Win32.InnoSetup.FD, Installer.Win32.InnoSetup.2.FD, InstallerInnoSetup.YR (Lavasoft MAS)Behaviour: Backdoor, Installer

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 4fd8e33a46eeea19ab0c25455d956828

SHA1: b9410120809757a64b89192a3a5db868894abf79

SHA256: 7969af43ab18ba43a1304f97f0254f850cf70092971461489e491e1a064665a5

SSDeep: 393216:1LDJ0uHs0ci/xdRxdeero6Ts01hgR9zzRi/rI:1ZVHLcA/e0TN1yg/r

Size: 13650944 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6, MicrosoftWindowsShortcutfile

Company: no certificate found

Created at: 2014-07-19 16:35:37

Analyzed on: WindowsXPESX SP3 32-bit

Summary: Backdoor. Malware that enables a remote control of victim's machine.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Backdoor creates the following process(es):

mscorsvw.exe:172
CE61.exe:1112
%original file name%.exe:1252

The Backdoor injects its code into the following process(es):

RunDll32.exe:540
CE61.tmp:1532

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process CE61.exe:1112 makes changes in the file system.

The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-CQ0O9.tmp\CE61.tmp (3777 bytes)

The process RunDll32.exe:540 makes changes in the file system.

The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\P0ZNDN9K\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C8B6K94S\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0RXSXFHY\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1MJ98KT3\desktop.ini (67 bytes)
%System%\wbem\Logs\wbemprox.log (37376 bytes)

The process %original file name%.exe:1252 makes changes in the file system.

The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\0001C354\CE61.exe (67082 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0001C354\config.yaml (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00071F8B (587235 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CE61.exe (64096 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0014F5C8 (64096 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\config.yaml (70 bytes)

The Backdoor deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\config.yaml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0014F5C8 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00071F8B (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CE61.exe (0 bytes)

The process CE61.tmp:1532 makes changes in the file system.

The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-ULDSR.tmp\_isetup\_shfoldr.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-ULDSR.tmp\toolbarsnap.bmp (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-ULDSR.tmp\OCSetupHlp.dll (5441 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-ULDSR.tmp\_isetup\_RegDLL.tmp (4 bytes)

Registry activity

The process mscorsvw.exe:172 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\State]
"AccumulatedWaitIdleTime" = "1260000"

The process CE61.exe:1112 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "ED EE 74 2E 70 6D 74 E3 A8 94 CE 55 E5 27 A3 BC"

The process RunDll32.exe:540 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "96 F4 3B B5 05 E2 E8 87 99 8F D2 55 B4 53 4C 39"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 13 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Backdoor deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:1252 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "52 81 B0 60 76 F1 BE CA DF 55 BC 09 32 D0 07 1C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\0001C354]
"CE61.exe" = "Cheat Engine 6.1 Setup"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process CE61.tmp:1532 makes changes in the system registry.

The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E4 46 ED C5 88 BB E1 9B 12 D9 28 7B 58 6F E3 0B"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

Dropped PE files

MD5	File path
fc35b558f32375552fe5fb553c4eb324	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0001C354\CE61.exe
c080f73b1bdde0853cb0258d9a02b0ec	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\is-CQ0O9.tmp\CE61.tmp
100bfb001d36dd905f952b0f91161787	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\is-ULDSR.tmp\OCSetupHlp.dll
0ee914c6f0bb93996c75941e1ad629c6	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\is-ULDSR.tmp\_isetup\_RegDLL.tmp
92dc6ef532fbb4a5c3201469a5b5eb63	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\is-ULDSR.tmp\_isetup\_shfoldr.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
mscorsvw.exe:172
CE61.exe:1112
%original file name%.exe:1252
Delete the original Backdoor file.
Delete or disinfect the following files created/modified by the Backdoor:
%Documents and Settings%\%current user%\Local Settings\Temp\is-CQ0O9.tmp\CE61.tmp (3777 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\P0ZNDN9K\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C8B6K94S\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0RXSXFHY\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1MJ98KT3\desktop.ini (67 bytes)
%System%\wbem\Logs\wbemprox.log (37376 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0001C354\CE61.exe (67082 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0001C354\config.yaml (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00071F8B (587235 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CE61.exe (64096 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0014F5C8 (64096 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\config.yaml (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-ULDSR.tmp\_isetup\_shfoldr.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-ULDSR.tmp\toolbarsnap.bmp (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-ULDSR.tmp\OCSetupHlp.dll (5441 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-ULDSR.tmp\_isetup\_RegDLL.tmp (4 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Advertiso
Product Name: Installer
Product Version: 1.0.0.1
Legal Copyright:
Legal Trademarks:
Original Filename: Installer.exe
Internal Name: Installer.exe
File Version: 1.0.0.1
File Description: Installer
Comments:
Language: English (United States)

Company Name: AdvertisoProduct Name: InstallerProduct Version: 1.0.0.1Legal Copyright: Legal Trademarks: Original Filename: Installer.exeInternal Name: Installer.exeFile Version: 1.0.0.1File Description: InstallerComments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	1864003	1864192	4.58762	d7bd21dc36e5b671fb4934f9e66f51b2
.rdata	1871872	406796	407040	3.6403	4710974c55509778b926a3e069f25531
.data	2281472	70916	36864	2.9501	4f5a7dd316729539f866dd727ba7352b
.rsrc	2355200	10862592	10862080	5.515	2c080c28e20d2474b2b7f7da1057e7e8
.reloc	13217792	479318	479744	1.87262	d694f917e099790a39e8534c9c322bd1

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://a469.d.akamai.net/templates/7926/0/56364.png
hxxp://cdn3.opencandy.com/templates/7926/0/56364.png	184.84.243.64

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /templates/7926/0/56364.png HTTP/1.1

Host: cdn3.opencandy.com

Accept: */*

HTTP/1.1 200 OK

x-amz-id-2: 1hpM7hPiPcgDJfYAfjuXLa8Dzp7FgU9U07klzTs3opuJj8E L5Am0QEVBormHye7

x-amz-request-id: 7D203C869B0A6202

Last-Modified: Tue, 22 Jul 2014 01:46:19 GMT

ETag: "efd41a21e6b25031e1774ea0e4f90e1a"

Accept-Ranges: bytes

Content-Type: image/png

Content-Length: 30060

Server: AmazonS3

Cache-Control: max-age=275

Date: Fri, 24 Oct 2014 05:25:19 GMT

Connection: keep-alive

.PNG........IHDR.......;........8.. .IDATx...{XTW...." ..... ...B.......q:....J..jcLg.qx}3...m..5...}hG;......5....:AG.........!.........tU..s.NA!...<...}.^k....\.|=t:...@ ...n..........AC,...@ .........@.f..*........l.....~..f.{...x..G(&.....d....(M......n...bq.....xz...T...G.(...'xxCs.MM.P.=..8.>......@../.....47@s=4.Z.5.Ac-..m....n?.g.x.....:.......$....6./...Q..5?}.j1..C..?.]...}..-...P...P......{....i..ZXXHRR.;}y`..e.aaa.....)**.......T:..r..........$?........Z...._..xk..0..a2..x..k.....1.i..E.=4.p..n_S.}3...G...:.Rn{...7..C..#<KKK...i.1//.a...SG:....`0.|.r...8}.tg...hO~JJJ.5jT...^.m..A.......t...n.......}0.../...^<..a26`j.....I...U...p-.,7..B....y\..j...@37}....fg.(..H....j..?~O...>;.[.n.R.....g..%........$<...;..o...h..?..zP..a..{...kxx7...o..Z>.t....3..|.X.....j...VQ.m..P.M..].....C.t0....%...BF..Ejj**....$..[...]..=z4:..U.V...Ahh(.....F&N.H^^.....c)**.......Z.J.".../...U[.FCdd$AAADDD...e.Caa!#F.`....T*.j5:.....~..}...o_..]....S...?..6l --.....^*...B...Ozz:...b...\.p...@V.^M^^.))).......-[d...~.TVV....J.b..I.xm.j'.S....a..e......).p..G.....%}.1c..|...........vL..k...9O.u/.'...Y.|9aaaDEE...KNN...'L.@~.O.....Oaa.......mx4.._..n.v..........0........#U...h..CSM5FC....../.../.....H.....L..>......._...E.....A.=W.VKFF.W.^....}..Y~...OVV.....=z. W.PRR..K.(//g.....5..>..........1b.l.YYYDGGSVV..5k.y..e...H4..UUU.9r...L.......%K.p..u...X.n.....?~.S.Nq..I.....k.....8q..C..q......)..&11..........y..W)--e.....8..N..o..$..h..UUU,\..U.RH.....X...g.....9y.$%%ÃžE..m..)[./^..e.....<..N...|.0

<<< skipped >>>

Map

The Backdoor connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1252:

.text

`.rdata

@.data

.rsrc

@.reloc

D$0j.Xf

<:>

t8Ht.HHt#

F2t%f

#t.Ht

2 34 567

j.Zf9P,u

9>t.hX

t.SSj

SSSSh

SSSShH~c

SShB;R

tAHt.HHt

u SSh

SSQSSSSh

u$SShe

t.hAp

t6Ht.Ht&

j.Yf;

_tcPVj@

.PjRW

tag:yaml.org,2002:

,[]{}#&*!|>'"%@`

?,[]{}#&*!|>'"%@`

expected key token

unexpected key token

illegal map key

?:,]}%@`

#;/?:@&= $,_.!~*'()[]

#;/?:@&= $_.~*'

?456789:;

!"#$%&'()* ,-./0123

Unicows.dll

Kernel32.dll

Comctl32.dll

CMFCVisualManagerWindows

RegOpenKeyTransactedW

RegCreateKeyTransactedW

CCmdTarget

RegDeleteKeyTransactedW

CNotSupportedException

Comdlg32.dll

OTaskDialogIndirect

RegDeleteKeyExW

CMDIFrameWndEx

CMDITabProxyWnd

CMDIChildWndEx

CMDIClientAreaWnd

CMDIFrameWnd

CMDIChildWnd

CMFCToolBarsKeyboardPropertyPage

GetProcessWindowStation

operator

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

%s.ld

Installing Addon. Executing

Installing Firefox Addon. Installing

Installing Chrome Addon. Installing

cannot create Chrome directory. returning.

cannot create Chrome\extension directory. returning.

cannot copy unzip.exe. returning.

cannot copy chromeacitvate.exe. returning.

trying to start chromeactivate.

finished_install_url:

banner_url:

Firefox installed

Firefox not installed

Error opening SQLite3 database:

Opened sqlite extension.db.

Closing firefox extension db ...

key not found

%sX\

config.yaml

finished_install_url

Opening webpage after install complete

SQLite format 3

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY

CREATE TABLE sqlite_master(

sql text

3.7.4

CREATE TEMP TABLE sqlite_temp_master(

1.2.7

%sX

Copying ...\%s

SQLITE_

d-d-d d:d:d

d:d:d

d-d-d

failed to allocate %u bytes of memory

failed memory resize %u to %u bytes

922337203685477580

API call with %s database connection pointer

RowKey

%s-shm

%s\etilqs_

OsError 0x%x (%u)

Recovered %d frames from WAL file %s

invalid page number %d

2nd reference to page %d

Failed to read ptrmap key=%d

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

%d of %d pages missing from overflow list starting at %d

failed to get page %d

freelist leaf count too big on page %d

Page %d:

unable to get the page. error code=%d

btreeInitPage() returns error code %d

On tree page %d cell %d:

On page %d at right child:

Corruption detected in cell %d on page %d

Multiple uses for byte %d of page %d

Fragmentation of %d bytes reported as %d on page %d

Page %d is never used

Pointer map page %d is referenced

Outstanding page count goes from %d to %d during this analysis

unknown database %s

keyinfo(%d

%s(%d)

%s-mjX

foreign key constraint failed

unable to use function %s in the requested context

bind on a busy prepared statement: [%s]

zeroblob(%d)

abort at %d in [%s]: %s

constraint failed at %d in [%s]

cannot open savepoint - SQL statements in progress

no such savepoint: %s

cannot %s savepoint - SQL statements in progress

cannot rollback transaction - SQL statements in progress

cannot commit transaction - SQL statements in progress

sqlite_temp_master

sqlite_master

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid

cannot change %s wal mode from within a transaction

database table is locked: %s

statement aborts at %d: [%s] %s

cannot open value of type %s

cannot open virtual table: %s

cannot open view: %s

no such column: "%s"

foreign key

indexed

cannot open %s column for writing

misuse of aliased aggregate %s

%s: %s.%s.%s

%s: %s.%s

%s: %s

not authorized to use function: %s

%r %s BY term out of range - should be between 1 and %d

too many terms in %s BY clause

Expression tree is too large (maximum depth %d)

variable number must be between ?1 and ?%d

too many SQL variables

too many columns in %s

EXECUTE %s%s SUBQUERY %d

misuse of aggregate: %s()

%.*s"%w"%s

%s%.*s"%w"

sqlite_rename_table

sqlite_rename_trigger

sqlite_rename_parent

%s OR name=%Q

type='trigger' AND (%s)

there is already another table or index with this name: %s

sqlite_

table %s may not be altered

view %s may not be altered

UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

sqlite_sequence

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

Cannot add a PRIMARY KEY column

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

sqlite_altertab_%s

sqlite_stat1

CREATE TABLE %Q.%s(%s)

DELETE FROM %Q.%s WHERE tbl=%Q

SELECT tbl, idx, stat FROM %Q.sqlite_stat1

invalid name: "%s"

too many attached databases - max %d

database %s is already in use

unable to open database: %s

no such database: %s

cannot detach database %s

database %s is locked

sqlite_detach

sqlite_attach

%s %T cannot reference objects in database %s

access to %s.%s.%s is prohibited

access to %s.%s is prohibited

object name reserved for internal use: %s

there is already an index named %s

too many columns on %s

duplicate column name: %s

default value of column [%s] is not constant

table "%s" has more than one primary key

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

no such collation sequence: %s

CREATE %s %.*s

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

CREATE TABLE %Q.sqlite_sequence(name,seq)

view %s is circularly defined

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

table %s may not be dropped

use DROP TABLE to delete table %s

use DROP VIEW to delete view %s

DELETE FROM %s.sqlite_sequence WHERE name=%Q

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q

foreign key on %s should reference only one column of table %T

number of columns in foreign key does not match the number of columns in the referenced table

unknown column "%s" in foreign key definition

indexed columns are not unique

table %s may not be indexed

views may not be indexed

virtual tables may not be indexed

there is already a table named %s

index %s already exists

sqlite_autoindex_%s_%d

table %s has no column named %s

CREATE%s INDEX %.*s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

no such index: %S

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

DELETE FROM %Q.%s WHERE name=%Q AND type='index'

DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q

a JOIN clause is required before %s

unable to identify the object to be reindexed

table %s may not be modified

cannot modify %s because it is a view

sqlite_version

sqlite_source_id

sqlite_compileoption_used

sqlite_compileoption_get

foreign key mismatch

table %S has %d columns but %d values were supplied

%d values for %d columns

table %S has no column named %s

%s.%s may not be NULL

PRIMARY KEY must be unique

sqlite3_extension_init

unable to open shared library [%s]

no entry point [%s] in shared library [%s]

error during initialization: %s

automatic extension loading failed: %s

foreign_keys

foreign_key_list

*** in database %s ***

unsupported encoding: %s

malformed database schema (%s)

%s - %s

unsupported file format

SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid

database schema is locked: %s

unknown or unsupported join type: %T %T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

a NATURAL join may not have an ON or USING clause

cannot have both ON and USING clauses in the same join

cannot join using column %s - column not present in both tables

USE TEMP B-TREE FOR %s

COMPOUND SUBQUERIES %d AND %d %s(%s)

%s.%s

%s:%d

ORDER BY clause should come after %s not before

LIMIT clause should come after %s not before

SELECTs to the left and right of %s do not have the same number of result columns

no such index: %s

sqlite_subquery_%p_

no such table: %s

sqlite3_get_table() called with two or more incompatible queries

cannot create %s trigger on view: %S

cannot create INSTEAD OF trigger on table: %S

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

no such trigger: %S

-- TRIGGER %s

no such column: %s

cannot VACUUM - SQL statements in progress

PRAGMA vacuum_db.synchronous=OFF

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

vtable constructor failed: %s

vtable constructor did not declare schema: %s

no such module: %s

table %s: xBestIndex returned an invalid plan

%s SUBQUERY %d

%s TABLE %s

%s AS %s

%s USING %s%sINDEX%s%s%s

%s USING INTEGER PRIMARY KEY

%s (rowid=?)

%s (rowid>? AND rowid)

%s (rowid>?)

%s (rowid)

%s VIRTUAL TABLE INDEX %d:%s

%s (~%lld rows)

at most %d tables in a join

cannot use index: %s

the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

unable to close due to unfinished backup operation

SQL logic error or missing database

large file support is disabled

unknown database: %s

no such vfs: %s

database corruption at line %d of [%.10s]

misuse at line %d of [%.10s]

cannot open file at line %d of [%.10s]

C:\Users\Thomas\Dropbox\projects\mfcdemo\Installer\Release\Installer.pdb

COMCTL32.dll

GetWindowsDirectoryW

GetCPInfo

GetProcessHeap

KERNEL32.dll

GetAsyncKeyState

GetKeyState

SetWindowsHookExW

UnhookWindowsHookEx

GetKeyNameTextW

MapVirtualKeyW

CreateDialogIndirectParamW

GetKeyboardLayout

GetKeyboardState

MapVirtualKeyExW

USER32.dll

GetViewportExtEx

SetViewportExtEx

SetViewportOrgEx

OffsetViewportOrgEx

ScaleViewportExtEx

GetViewportOrgEx

GDI32.dll

MSIMG32.dll

WINSPOOL.DRV

RegOpenKeyExW

RegCloseKey

RegCreateKeyExW

RegDeleteKeyW

RegEnumKeyW

RegEnumKeyExW

ADVAPI32.dll

ShellExecuteW

ShellExecuteExW

SHELL32.dll

UrlCreateFromPathW

SHLWAPI.dll

UxTheme.dll

ole32.dll

OLEAUT32.dll

oledlg.dll

GdiplusShutdown

gdiplus.dll

OLEACC.dll

IMM32.dll

WINMM.dll

.?AVCMFCVisualManagerWindows@@

.?AVCCmdUI@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCSimpleException@@

.PAVCObject@@

.PAVCNotSupportedException@@

.PAVCInvalidArgException@@

.PAVCUserException@@

.?AVCTestCmdUI@@

.PAVCOleException@@

.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@

.?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@

.PAVCArchiveException@@

.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WV12@PB_W@@

.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WPAVCDocument@@PAV3@@@

.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W_N_N@@

.?AV?$CMap@PAVCDocument@@PAV1@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W@@

.?AVCMFCToolBarCmdUI@@

.?AVCMDIFrameWndEx@@

.?AVCMDIFrameWnd@@

.?AV?$CMap@KKV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W@@

.?AVCMFCColorBarCmdUI@@

.PAVCOleDispatchException@@

.PAVCFileException@@

.?AVCMDIChildWndEx@@

.?AVCMDIChildWnd@@

.?AVCMDITabProxyWnd@@

.?AVCMFCCmdUsageCount@@

.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WPAVCObList@@PAV3@@@

.?AVCMFCRibbonCmdUI@@

.?AV?$CArray@PAVCMFCRibbonKeyTip@@PAV1@@@

.?AVCMFCRibbonKeyTip@@

.?AVCMDIClientAreaWnd@@

.?AV?$CList@PAVCMDIChildWndEx@@PAV1@@@

.?AVCMFCAcceleratorKey@@

.?AVCMFCToolBarsKeyboardPropertyPage@@

.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WHH@@

.?AVCMFCTasksPaneToolBarCmdUI@@

.?AVCMFCAcceleratorKeyAssignCtrl@@

zcÃ

.?AVCCmdTarget@@

.PAVCException@@

.PAVCResourceException@@

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\0001C354\

1JTCP

p.qN3

.IDAT

~:v.zgu}7

.IDATH

AYO.xXO

s',%f

3%Cn,

&I.Ibr

HOJ.oa

u.vjB

}j.jX

cdl6.ptQf

d\'.tA

s?.jP

p.qNs2cC

.QzY(

O\.gA

.YRar

B%f#X

..nax

.mQ$(Xt

.MaeI

.HtCE

~%Uu ,

kJ%UN

".igLO

%FPf!

*"%Dv

#c$D%f

,D.Zl

.yK]EW

\.Wnp`p(

=9=%{.mnWw/

X${.mn:

23[.Iq&

v`.Ko

q.Ko#

PFTI%f

6wv.TD

V.mE&Qs;

Q`.vc

R%FO8

.hF[*A

wÃ‰&QM

yVu%X

CU~.CC

V.NQ=

a}=

.fkhgE

-M}{%3

o..Bg

%sW@vg

nx.BO

qs%cK>

k%DTB

.zVAM

HGExE

?%D^Z

Wk%S"

0:.fM

.gut*e

v%c h

N.MyK1

k..ck)

G.kF-

.}.XvX

2O-1n}Q

ilZS.Sz(

R .zO:

|Od)%x

j*P%dI

58.oN

vwR.eB

k%Fv=

GP%D:

.meB>

ub.mJ

R0Ãœ

ZHM.Mj

n|%x0

)(I.Wv

zfq%S

-H9q}

.YK(pS

{.oQ^

&.xj%

1.npz

U.hhBN^

I%XM)

NK.Aj

.Cr\.

dZw/a%S

3.JfT

.Zlh@

j3%U7~]

*%x^*wE

5 !v$.VI

SSh@b,

>.Cf5P

.rT'H

%SF}U

.Qujw

.GBeg

U2,D.Wz

ZFR.Wv

Nl.ZN^F

.FbF,]

XiZ,'Ã›>

.iZoe

I.FA'

wk.jv

.Go.=nn

Pu.sF

i#Ã¾#

6npo-):%c

aM%s:k

>Udph

d|I%u

*hk.WR1]j

ye.Og

[q5%x6gw

1,.WC

'4%u

^/%XB

Q.ohKi

%fJT{

i?P.MaKw

L.rI5

[-taD}}

.Ld?g

IMy.HXPCt9(

P.eqz

!.Jq|

K%DpSK

F.KE#

@%S

c.Spc

}.VIK

g.rlK

^.Xv)

.Vw~?

_:z%s

9,%U3

Xl.KFN!%

R$.kR

*.TSV

R/j.cR7

6.3.uy|6

A.Hp,

2.kdJn[

.cVZm

0WeQ_%%f

XR1.lq

zq.jLT

|%%UI|

-2.kFr

'.KM`

J.NVw

%fsdd(N

!TCp9

.GU~J

%x.`4

O.QRvP

&c.jr

=-%ux

`=.Fi'm

lO%x6O

Ãµa#p

-bw}\

o%dh|r

BE.Cz=

[%CYi

'.oiR

AÃ‹w

.Kd!

%X;%`

.IH-U

j$M.yI`Z

_.VA|

P8&.Xa

.VV

.JUV,X

>x%ui

v.flch

Cs%.X

j.pe4FG

.RKs:U

M;.cC

WeBy

2>.nB^^

3%fs`zQ

b.It:

QMÃ“

US%SJ

.gI)S\

QU.RDo

*?w.MH

!%x#P

:Fd-.Qc

.IZeJ

'.ZhW

N~.yT

7.iO

@&d.oQ

/.yBz

LGo(%u

)W.Xq4

ZcmD_$

}C%s^3

.pWN3

cNÃ“

.Di38F

~ {%U

&v4r%X|}q

&.vL_

%U=,Q

Gg.FD|A

]3%s;

q%7Sw^

E%s_

HZL|#%f

.wn0g

W-.oU

o%Sl;70

Qw3.ra

%x.1p@

%.sd!

%U,`!O

{[.dz

b .ILp

N0-z}\

f.eTYC

s6.dre

$.yCwz|K

}Fq.QQ

61%xG_~

qR.vj

Is.mD&

%uOGR=

jIW.ql;

.jL-`

g,urL

.bvc7

S.yr;

L.mAV

Qk.YY

7%FHd

$KU%x

M7.Xq

.hE8Y

qc.rO

PV.Sb#

\9.Rz

%s7u=

.ORTr

Og.vmh

A6.gD

%sa~s

pc=U%Cu_)

.bml_

.vf8Zk

#SqL8o

.Jok5

D&.yG

UB.(k{%c

A{.wK

3%xth

db.rn

%xb8/

sDj.pG

De.jG

O6,

.tXR-

.Yv x/

.OU r:

%9U~8

&%so%

:n.Uw

vP.lMe

.lD~M*

!.jH

Bw!Q%f

9A$.YWA

cRTo'

ReO%s*S

tcPL

n.SN"

lu'"-t}

.jHlE

.un}%

].OcM._

n]y-%d

8%%u/TuY

.Ooc!

(F].ErS

_J-NQ}

.EkoG

%S:JJ

*4 .Ps}

uX.Vx

%UB

aÃ[a

ND.xM

q#5.dG(w

W.rcPeq

s\}.Gx1

.ds{J

CMdU

=Ã‰/]

.kBbA

l x.Wx

.zT-Z

=5.Rq

D.vss

{"0{!!

.YYPC

g].kG]"_

=.up-

p%UFD=

.Xc;)q

^|.SL

Uw.Dxo

a.fycv

%XG#_

%F(bU

t2V %u9

.EEQ,

(7C".wk]

.Zlzpqio"T

/?i.Dm

9g"%U

(.ZPW

.ÃŸ|A

H#cmd:Oom

..BVV

A.pz[8

%FNLvr

Z.OK0

pH}%f

.dnpvw

W.aP

\8_.NcI-

r/ei.dm

rd.WH

.cS#ng0

QQ.mh

7:k(lk%s

LM.Oe

CN2G.Tw;

.nLU^

X#.uY

b.SER~

\o6

DOJ.oQ

p.LGc

s.JA4

%CJBj

MT.ZV

A.SSx

Z%X,p=

L.Aq!

Å“7m>

k%xD=

Ãœ\F

9BR.wc

.Eb.s

e2.SFG

t.Zy'

'%Soe6y

.tUqvx_r{

X%c:>

[%0x.?

3 %S?P

0WCN.KC

;.jO.

.HK|F?

.eM}X

g%x%4

%DrE/q

W;Ã²

%Ci?%S

.iOU8

Za:k3:%u

],S.ZR'

Q%uio

S6.AL

/#VQ.mPn

[%cY5

m.pls

"v%Xo

.eoc{M

)U.De-;j

%.DGb

Bg.xi

ZUO^%s

eKKCÃ”r

N.Fm

%xxP.

6.wEs

w%.YV

0%sUP

(0qI%d(

u|.Zj

`4s%d

,Ã’=

.jQU F

%%xT1

TpL%Cp*

.OhPIVi

[.ds~4G

j]%fk

1%8U/

3NCRT

%2s'Im[{

%hE.ia

J-w3}b

y.yh%

.Yq3z|*

1B%s?

.xoFUr

d.GH3

I.qrxW

Vt.IH

$.NEe

.AHAp

9G%dy

16urL9

%f@m]a

z|Z.FZ

Ba"%s

.kw3Z%[

I.hfS

=]wx.lM

? Å’

/$z%SY

.uDXQ

M/Ã

7}mv.wYS

%*q%F>Us

.tEb`

n.HEl

Im%XJ%

L0%f^y

.yiBz

`TÃŽ

{.CJW

_.kqQ

.og[0

X%dR3#I,

(;kK.jT

0=.vIT

h7%foO

sX5%U

.eOYo

.Xcs[$

!.rH-

\E.Dk

^y.FHO

QTCpB=

ch.Bd

;%cPA

l.gqo

A&.Gw^

^c.UZ

:lM%uM

.Wyl&

g.Uw!

.exz3

.m_].xn

E'.wJ

pU\D3

zdN%c

.JV]

e[d2X6-qN}7

=8.RG

d[.zY

*D%.C

5:-qu}de

`\\ %Sh

R1%s7

l.XDU7

2%UwCn7

ZF.PK

N_G

G.rV4

.Xvl&

7OHF).AA

!.GA;

.tD;ax

.iX,b

c%Uu:

K@x.Fw

fF.Xi

.ybr.

Xg!F.sX

.scSI

;.nBG%x

b%XeGz

4H.he^"

.HY/=

%U"(k

7Ã¿Vb

-%c!$;

d%xzu

MVK.se

A5.rM

.RD5R

5.%cG

a#_C%C

.kR9!

%F~iG

e).pY

f2.kx

y.IAx

.SNc;[

.wJ$=Db

z:\.y

l%SZU

z\7 .Il#

.FWD

BT.Sj

k%sd>

H^.LW

.jFX7f

o8M%D=

UH%f`

.bEk,y

.Bd,uT

^5%dxI

"T`%F

x%Di.[Qu

`>.FW

FjB.IQ

H.jm\|

Ma.cf

i&.Me5

.WIw!

%chc

.uUM

.RK7_G

%xW?Wc

0.ts,

?.gk_

9.TI=

{.ijGa

!t.PFt

.VN5B

^t.Rsy

.tg*)Y

x/.qJ

z.cT5

x.maWQ

B7^.Cm&

v.Cjc

&|.wTTUg|

%.pzn

n?{%u

-7}A=

Y"5T.Mq

{.WZy}

Q.nO5D

M.sK7

NA.Gs(

q@.LJ

Ds}.nRD

].Tl:

%SO3Y

sA.Db~

c.qfF

!.FSh

Mm\@%d

wB.vq

,.nR5

KKr.iv

Ã‹NE

vI.nr

d.UQ P

3\%2U

n.Qtf

esÃ±

%xM,e]

Ll.cSR:

d.QV{jM:

E.om*

m4.OI

Uo*c.nc

.nFvZ

EÃž1

|=_s.hn

luSsh

%cn6qh"

AD.qe{]'

%fx77C

%XDgi

.iK:V

GX%fI.

J %S,

p.hoT8JD@

".Ql^

jt.iJ

y=|%X

_"Ãši

Q6D.XKb

k%cHT$w

4.uW8

k.WS;

!@.oe8

.bk=O

.KR4P:

*h(].Ab

JF.Gr/$

|o.RKE|

@%W%9Srs/

MY.IU

{S%2x

~%x'o

!FBl.uP

.im~=;

*J%9x

%Sl-|

.DbE_

.Qx"B

-E} E

Y>^Ãƒ7

.RLiRW

.XcJ{

M.HX5)Q

%X[@xLI

7%fVN

>-.ZF

.ba*V

px,C_%C^

Z]E.ZN

VrÃŠ

4@6%S

Y.PN&

%x^*-

3F^%X

>.EwZmS

0p.RJm

.lQv0

B.gMP&

c%Dm"m

.lpJw

pkl%U

.lPaq

u.nA4M

.TFa@S

ao/%x{UQ

&"&Fk].AygY

Rs%Sh

.EU0h

.gcM/

TCpnt

O.qu$

.Xrvx

U.if3

.Anr}

.HlDe

Mm.Vq-

u;,%X

i[}%D\

.].bk

s%U,x

y6.YfM

a%c

_.OWy

80-8}

:S%XP

Eor?sx%x}*

.Of1\5

BW.iD

"z.ImC

.SJ}$

S'%c)

%f`(m

_!9%s3M

.Vm v

Qns.Kz3

Ab.qG

`eo.vB

!,%u\

%Fj`z

B%C%zJ

r\0.qS

O*%C

\`.EM

a.jg3

E$i%u

l=%f~/w

%X&})

14Bzj%CN

.PW2C5q\

,#.CNV

g~Y.fv0

eF%C..=

-.Qb~

.gD'6(

f.CmF

("%X4

6[T%d

H9Ã¾*"

A28%S

.ii-_l

_Ã“Z

%CM>c

.BBtK

!3.Sjk

%d\eB

.lnclMS

z.ab2

6.YQ*T

^ .oL'

Gx.dt

$*".Uv

_.GM9

b1.Dg

F.Of#

\h.eh)

:fbn.vf

o.ZV~

%fq^H

.vp#g

.pkO{

q%u>-/S

X%S]v2:

cn{

G.ZUfH9

6%szZ

.Dedc

#.kn9

.CH?

pY@.SG

gv:Q\.nC

.rl~2

.XM*qp

V$.QC4]

f]z/%D

7uk%c

^.fzxl

@M1%D

(c%C"

%UZ Y

S8.Em_8

BtA%S\

=[.ms

{.FOW

-qky}

}H%s3

aW.ZR

.su69%^

7.eI*7

XK*%Uo

(%SgT!lU

*D%CtU=a&

tM%Fg

uExe)

-A};YR

%Dw9-

'Ow.iqx

SBzc.PB@

.eVC[

!x.hM,

N3C%d(%

I.Oiq

fexecutable: CE61.exe

finished_install_url: hXXp://downloadpt.com/typ3

WINDOWS7_

Windows7

*& &$!$$#$%%&&'((())),,,222>>>]]]

___===111---))*''&&%".(

&$"''&))) ///;;;^^^

1* &&%**),,,///@@@```

^^^@@@... ,,*)(%$"4*

'%$ *),--///@@@^^^

\\\???...,,-*))&$"7

'%# **---///???\\\

\\\???///--- *)'$"9,

'%#, *-..///???[[[

(, *../000???[[[

"""&&&!!!

...JJJxwv

`^]

/..ONM

~~]]]444

_\[:98"!!

%%%./.FEDlig

!!!###%%