MD5: a325fa35893889690e8a6864b7254932
SHA1: 17d541c1294636a3abb5d325a42f0523c16482d6
SHA256: 5464cb9bbf491d757213c5bcf64d608e66f90a3d68c56c3d3570cbc7c5aaf87a
SSDeep: 196608:5Q5Z6PVVKHvvMcaSfPNJdLt9IfWgf5Tw86Ev:5Q5kNVKH82PNJdIOOuX2
Size: 7856392 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Client Connect LTD
Created at: 2011-07-06 17:31:20
Analyzed on: WindowsXP SP3 32-bit

Summary:

Malware. Malware, short for malicious software, is any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems.

Payload

No specific payload has been found.

Process activity

The Application creates the following process(es):

%original file name%.exe:748
sdbinst.exe:228
CltMngSvc.exe:1320
CltMngSvc.exe:1476
cltmng.exe:1240
cltmngui.exe:1980
nsu6.exe:1060
nsnE.exe:2412

The Application injects its code into the following process(es):
No processes have been created.

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:748 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files%\SearchProtect\UI\dialogs\Images\Icon.ico (3312 bytes)
%Program Files%\SearchProtect\UI\dialogs\protectionDS\protectionDS.js (7 bytes)
%Program Files%\SearchProtect\UI\dialogs\libs\json2.min.js (2 bytes)
%Program Files%\SearchProtect\UI\dialogs\libs\main.js (10 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\hez.png (256 bytes)
%Program Files%\SearchProtect\SearchProtect\bin\VC32.dll (267547 bytes)
%Program Files%\SearchProtect\UI\bin\cltmngui.exe (106875 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp (866 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\bgSettingsDS.png (9 bytes)
%Program Files%\SearchProtect\UI\dialogs\Consent\consent.js (2 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\bg-uninstall.png (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc3.tmp\inetc.dll (784 bytes)
%Program Files%\SearchProtect\UI\dialogs\Consent\consent.html (1 bytes)
%Program Files%\SearchProtect\SearchProtect\bin\SPtool64.exe (52609 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\menu-rollover.png (1 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\icon-win.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc3.tmp\nsExec.dll (6 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\hez-selected.png (1 bytes)
%Program Files%\SearchProtect\UI\dialogs\protectionDS\defaults.js (1 bytes)
%Program Files%\SearchProtect\UI\dialogs\libs\DialogAPI.js (3 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\bg-dia.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp (866 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\v.png (1 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\radio-button2.png (886 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\btnSilver.png (1 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\bgNotif.png (9 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\btnClose.png (933 bytes)
%Program Files%\SearchProtect\UI\dialogs\Consent\consent.css (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\D.tmp (1 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\gray-bg.png (2 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\close-win-over-click.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4967CDAB\desktop.ini (67 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\radio-button-def.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsnE.exe (5520 bytes)
%Program Files%\SearchProtect\UI\dialogs\settings\settings.html (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp9.tmp (2 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\bg-with-logo.png (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0X234163\CARRIER_ID[1] (866 bytes)
%Program Files%\SearchProtect\UI\dialogs\uninstall\uninstall.js (5 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\hez-def-grey.png (1 bytes)
%Program Files%\SearchProtect\UI\dialogs\protection\protection.css (4 bytes)
%Program Files%\SearchProtect\SearchProtect\bin\RN32.dll (8184 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\SearchProtect\SearchProtect\rep\UserRepository.dat (12 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\checkbox.png (378 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc3.tmp\SPTool.dll (93946 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\x.png (1 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\close-win-def.png (1 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\checkbox_checked.png (360 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\bgUninstall.png (784 bytes)
%Program Files%\SearchProtect\UI\dialogs\protectionDS\protectionDS.html (2 bytes)
%Program Files%\SearchProtect\UI\dialogs\protection\protection.html (2 bytes)
%Program Files%\SearchProtect\UI\dialogs\settings\defaults.js (1 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\Apply-onclick.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc3.tmp\System.dll (11 bytes)
%Program Files%\SearchProtect\UI\dialogs\libs\defaults.js (983 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\radio-button.png (859 bytes)
%Program Files%\SearchProtect\SearchProtect\bin\VC64Loader.dll (8560 bytes)
%Program Files%\SearchProtect\Main\bin\CltMngSvc.exe (102654 bytes)
%Program Files%\SearchProtect\SearchProtect\bin\VC32Loader.dll (8184 bytes)
%Program Files%\SearchProtect\SearchProtect\bin\cltmng.exe (197222 bytes)
%Program Files%\SearchProtect\UI\dialogs\uninstall\uninstall.css (5 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\Settings-icon.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SXMZ0DAF\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nslA.tmp (181 bytes)
%Program Files%\SearchProtect\UI\dialogs\protection\protection.js (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0X234163\desktop.ini (67 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\text-field.png (1 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\checkbox_def.png (274 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\btnBlue.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SXMZ0DAF\ip[1] (181 bytes)
%Program Files%\SearchProtect\UI\dialogs\libs\jquery.1.7.1.min.js (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh2.tmp (705688 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\menu-selected.png (3 bytes)
%Program Files%\SearchProtect\UI\dialogs\protection\defaults.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4967CDAB\CT3331172[1] (866 bytes)
%Program Files%\SearchProtect\EULA.txt (784 bytes)
%Program Files%\SearchProtect\Main\bin\uninstall.exe (34561 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc3.tmp\nsC.tmp (6 bytes)
%Program Files%\SearchProtect\UI\dialogs\protectionDS\protectionDS.css (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu6.exe (5520 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SD6JW5EN\settings[1] (4 bytes)
%Program Files%\SearchProtect\UI\dialogs\settings\settings.js (11 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\bg.png (784 bytes)
%Program Files%\SearchProtect\UI\dialogs\uninstall\defaults.js (1 bytes)
%Program Files%\SearchProtect\UI\dialogs\settings\settings.css (8 bytes)
%Program Files%\SearchProtect\UI\dialogs\style.css (7 bytes)
%WinDir%\AppPatch\nbin\VC32Loader.dll (8184 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\info-icon.png (424 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\browsers32.sdb (1 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\button-bg.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SD6JW5EN\desktop.ini (67 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\bgSettings.png (12 bytes)
%Program Files%\SearchProtect\UI\dialogs\settings.html (8 bytes)
%Program Files%\SearchProtect\Main\bin\SPtool.dll (93946 bytes)
%Program Files%\SearchProtect\UI\dialogs\uninstall\uninstall.html (5 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\hez-def.png (1 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\radio-button-selected.png (1 bytes)
%Program Files%\SearchProtect\Main\rep\SystemRepository.dat (1298 bytes)
%Program Files%\SearchProtect\UI\dialogs\libs\dialogUtils.js (1 bytes)
%Program Files%\SearchProtect\SearchProtect\bin\VC64.dll (164944 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nswB.tmp (4 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\Apply-default.png (2 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\SP_DialogBG.png (10 bytes)
%Program Files%\SearchProtect\UI\dialogs\Consent\defaults.js (591 bytes)
%Program Files%\SearchProtect\UI\dialogs\Images\Apply-Rollover.png (2 bytes)

The Application deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nswB.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp9.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc3.tmp\SPTool.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nslA.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc3.tmp\nsExec.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc3.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc3.tmp\nsC.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\browsers32.sdb (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc3.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm1.tmp (0 bytes)

The process sdbinst.exe:228 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%WinDir%\AppPatch\Custom\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb (1 bytes)

The process CltMngSvc.exe:1476 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files%\SearchProtect\Main\rep\cfi.bin (708 bytes)
%Program Files%\SearchProtect\Main\rep\pni.bin (708 bytes)
%Program Files%\SearchProtect\Main\rep\edk.bin (708 bytes)
%Program Files%\SearchProtect\Main\rep\SystemRepository.dat (135 bytes)
%Program Files%\SearchProtect\Main\rep\trn.bin (708 bytes)

The process cltmng.exe:1240 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\SearchProtect\SearchProtect\rep\UserSettings.dat (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\SearchProtect\SearchProtect\rep\UserRepository.dat (642 bytes)

The Application deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\SearchProtect\SearchProtect\STG\Init_D.tmp (0 bytes)

The process cltmngui.exe:1980 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\SearchProtect\UI\rep\UIRepository.dat (1057 bytes)

The process nsu6.exe:1060 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsu8.tmp\inetc.dll (30 bytes)

The Application deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsu8.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu8.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsk7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu8.tmp\a.txt (0 bytes)

The process nsnE.exe:2412 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsi10.tmp\inetc.dll (30 bytes)

The Application deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nstF.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsnE.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi10.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi10.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi10.tmp\a.txt (0 bytes)

Registry activity

The process %original file name%.exe:748 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu8.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu6.exe, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu8.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsc3.tmp\SPTool.dll,"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs" = "C:\PROGRA~1\SearchProtect\SearchProtect\bin\VC32Loader.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect]
"Publisher" = "Client Connect LTD"

[HKLM\SOFTWARE\SearchProtect]
"Environment" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect]
"UninstallString" = "C:\PROGRA~1\SearchProtect\Main\bin\uninstall.exe /S"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect]
"DisplayVersion" = "2.19.31.1"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\SearchProtect]
"InstallDir" = "C:\PROGRA~1\SearchProtect"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect]
"DisplayIcon" = "C:\PROGRA~1\SearchProtect\SearchProtect\bin\cltmng.exe"
"DisplayName" = "Search Protect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "80 3E 61 54 67 35 5D 6C 57 DB FF EC 27 B1 9A E2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Application modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Application modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb]

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The Application disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"SpUninstallCleanUp"

The process sdbinst.exe:228 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "25 6A 8A 0A 0D FF 40 EA F7 B0 0C 9F 73 55 9B 37"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\chrome.exe]
"{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb" = "Type: REG_QWORD, Length: 8"

[HKLM\System\CurrentControlSet\Control\Session Manager\AppCompatibility]
"AppCompatCache" = "EF BE AD DE 60 00 00 00 00 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\firefox.exe]
"{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb" = "Type: REG_QWORD, Length: 8"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\explorer.xxx]
"{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb" = "Type: REG_QWORD, Length: 8"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\iexplore.exe]
"{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb" = "Type: REG_QWORD, Length: 8"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}]
"DatabaseType" = "65536"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\software_removal_tool.exe]
"{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb" = "Type: REG_QWORD, Length: 8"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb]
"UninstallString" = "%System%\sdbinst.exe -u %WinDir%\AppPatch\Custom\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\software_reporter_tool.exe]
"{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb" = "Type: REG_QWORD, Length: 8"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb]
"DisplayName" = "Apps32"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}]
"DataBasePath" = "%WinDir%\AppPatch\Custom\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb"
"DatabaseDescription" = "Apps32"
"DatabaseInstallTimeStamp" = "Type: REG_QWORD, Length: 8"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\Layers\VC32Ldr]
"{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb" = "Type: REG_QWORD, Length: 8"

The process CltMngSvc.exe:1320 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "60 49 42 30 25 11 A3 CD E3 FA B9 C9 A1 60 02 11"

The process CltMngSvc.exe:1476 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\SearchProtect]
"InstallDate" = "20150124"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\LocalService\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "09 2B F5 5E 50 13 63 5A 2B B5 79 DF 45 24 4F AD"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu8.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu6.exe, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu8.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsc3.tmp\SPTool.dll,"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\LocalService\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\SPPDCOM]
"TS" = "0"

The Application modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Application modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Application deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

The process cltmng.exe:1240 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "69 5A 6D F2 73 F2 8A CE C6 AD 37 C6 F2 30 B1 C0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Application modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Application modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process cltmngui.exe:1980 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3B 97 B5 79 96 6C EF A3 F8 C3 6D 62 88 6B 46 DD"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Application modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Application modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process nsu6.exe:1060 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu8.tmp\,"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6A 5E DE D2 38 DD 74 A1 A4 52 37 00 DC 2B BE 7C"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Application modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Application modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process nsnE.exe:2412 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu8.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu6.exe, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu8.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsc3.tmp\SPTool.dll, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsc3.tmp\System.dll, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsc3.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsi10.tmp\,"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C5 D3 BD 69 2D B0 86 02 35 A5 9E E3 ED 38 F1 8D"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Application modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Application modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: Client Connect LTD
Product Name: Search Protect
Product Version: 2.19.31.1
Legal Copyright:
Legal Trademarks:
Original Filename: Search Protect Search (R)
Internal Name: Unknown
File Version: 2.19.31.1
File Description: Search Protect
Comments:
Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 47
f1f93e75b6d8a2c07f17ddb13ebdb2fe
d3544ed5e2df316a68a92e71c67aca9a
9bb4c5d31bb29cd6412b43d4614300f4
4b34b9f7a281713445214417361b9a58
5955652fc4378e86b17d900c8dd9df90
a60b92ef915761fa1a025e3b2fe79491
87273f0390fd14a668e5a593bb448d27
ae29cde2e87b0412d1ca23f0caec987f
76aef0f56182e0b38ef9c0141c85b527
319e1f26cf3281984792af00dfdd6c12
6c4346b6ef4cebcd6b9bbf87c4d0b1b5
3e43b6b0b99a709207d0baaaea076741
b5150638f8493dad0f5cc1ccf2bdc45e
3145591466302c1e91c14ed9cd17b2f3
7753ed850ca35db8660f1b4939d9c3c2
8ee1fe9338cda40354cc84fee625d8f4
fb7eafcd655387b24a3c406ba446aa34
49d842fee76f6622915200a94c6f1e9b
ca88c736bd8b5e5aaa1f51b0ea518fda
f0557e1a4d5c92d4ed6deb883682d15e
5cb2d96ae1d17e875bbe62cb354c699e
038f41ef9cbe92a09d57c071338ae1a3
26ef3b597356e2da3f027e62be5d6940
d0a7d6d0412549e4d68f7ea83f61eb9c
0800275e079ca64be48e5ba47d669192

URLs

URL	IP
hxxp://e3937.g.akamaiedge.net/spinstallersettings/2.19.31.1/test/ABTEST_SETTINGS_ID/carrierId/CARRIER_ID
hxxp://e3937.g.akamaiedge.net/spinstallersettings/2.19.31.1/test/ABTEST_SETTINGS_ID/carrierId/CT3331172
hxxp://Jazz-1846647836.us-east-1.elb.amazonaws.com/
hxxp://sp-ip2location.ams.spccint.com/ip/?client=sp
hxxp://a1015.g1.akamai.net/UP/settings/?ctid=CT3331172&UM=&c=UA&DUM=2
hxxp://a1015.g1.akamai.net/UP/settings/?ctid=CT3331172&gd=&UM=&c=UA&DUM=2&D=012415
hxxp://sp-settings.spccint.com/spinstallersettings/2.19.31.1/test/ABTEST_SETTINGS_ID/carrierId/CARRIER_ID	23.37.55.61
hxxp://c.api.seccint.com/UP/settings/?ctid=CT3331172&gd=&UM=&c=UA&DUM=2&D=012415	88.221.133.73
hxxp://sp-ip2location.spccint.com/ip/?client=sp	195.78.120.183
hxxp://sp-alive-msg.databssint.com/	23.23.106.133
hxxp://sp-usage.databssint.com/	23.23.106.133
hxxp://c.api.seccint.com/UP/settings/?ctid=CT3331172&UM=&c=UA&DUM=2	88.221.133.73
hxxp://sp-installer.databssint.com/	54.243.91.139
hxxp://sp-settings.spccint.com/spinstallersettings/2.19.31.1/test/ABTEST_SETTINGS_ID/carrierId/CT3331172	23.37.55.61
servicemap.spccint.com	23.37.55.61
sp-autoupdate.spccint.com	23.37.55.61

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers

Traffic

GET /spinstallersettings/2.19.31.1/test/ABTEST_SETTINGS_ID/carrierId/CARRIER_ID HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: sp-settings.spccint.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: application/json; charset=text/plain

Last-Modified: Wed, 14 Jan 2015 14:07:24 GMT

ETag: "2a57ba7559f4c156393df725faadf6a0"

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

P3P: CP="IDC DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Content-Length: 866

Cache-Control: private, max-age=900

Expires: Sat, 24 Jan 2015 01:34:44 GMT

Date: Sat, 24 Jan 2015 01:19:44 GMT

Connection: keep-alive
{"InstallerSettings":{"CHExtension_Id":null,"CHExtension_LandingPage":
null,"CHExtension_Name":null,"DEFAULT_CMD":"-carrier_type=CTID -carrie
r_id=CT3331172 -Platform=all -startpage=true -defaultsearch=true -inst
all_time_revert=true","DUM":"2","InstallSPPDriver":null,"IsAUAllowedno
TB":"true","LOST_USERS":"false","ObeyGoogleGuildlinesProviders":"[]","
PING":"false","SERVICE_LOST_USERS":null,"SERVICE_NAMES":"[\"Cltmngsvc\
",\"NSCltmngsvc\"]","TbExternalAssetsEnable":"true","UNINSTALL_PING":n
ull},"AbTestSettings":{"Experiment":"","Variant":"","TestParameter":""
},"CarrierSettings":{"CHExtensionMode":"false","RBuilder":"false","v_e
nv":"true","v_env_10":"true","v_env_12":"false"},"signature":"VtOjrod9
xkURbcTqhbp 2GnmQ492uujcRtheFHUtt6ZNve4YA5 /mJ2I3AEiED9RHWLh9OFZx2HjQS
I5mFfXTeLfzwKxfFNRysDV9gWeuoKmbBicmpbU8rr7xd1Jw4MmIeja3yasiPy6Q9dDQj8J
ByMyjM4ke3gaNLSl1o XJXk="}HTTP/1.1 200 OK..Content-Type: application/j
son; charset=text/plain..Last-Modified: Wed, 14 Jan 2015 14:07:24 GMT.
.ETag: "2a57ba7559f4c156393df725faadf6a0"..Server: Microsoft-IIS/7.5..
X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..P3P: CP="IDC DSP C
OR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"..Content-Length: 8
66..Cache-Control: private, max-age=900..Expires: Sat, 24 Jan 2015 01:
34:44 GMT..Date: Sat, 24 Jan 2015 01:19:44 GMT..Connection: keep-alive
..{"InstallerSettings":{"CHExtension_Id":null,"CHExtension_LandingPage
":null,"CHExtension_Name":null,"DEFAULT_CMD":"-carrier_type=CTID -carr
ier_id=CT3331172 -Platform=all -startpage=true -defaultsearch=true
<<< skipped >>>

GET /spinstallersettings/2.19.31.1/test/ABTEST_SETTINGS_ID/carrierId/CT3331172 HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: sp-settings.spccint.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: application/json; charset=text/plain

Last-Modified: Sat, 24 Jan 2015 01:19:45 GMT

ETag: "2a57ba7559f4c156393df725faadf6a0"

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

P3P: CP="IDC DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Content-Length: 866

Cache-Control: private, max-age=900

Expires: Sat, 24 Jan 2015 01:34:45 GMT

Date: Sat, 24 Jan 2015 01:19:45 GMT

Connection: keep-alive
{"InstallerSettings":{"CHExtension_Id":null,"CHExtension_LandingPage":
null,"CHExtension_Name":null,"DEFAULT_CMD":"-carrier_type=CTID -carrie
r_id=CT3331172 -Platform=all -startpage=true -defaultsearch=true -inst
all_time_revert=true","DUM":"2","InstallSPPDriver":null,"IsAUAllowedno
TB":"true","LOST_USERS":"false","ObeyGoogleGuildlinesProviders":"[]","
PING":"false","SERVICE_LOST_USERS":null,"SERVICE_NAMES":"[\"Cltmngsvc\
",\"NSCltmngsvc\"]","TbExternalAssetsEnable":"true","UNINSTALL_PING":n
ull},"AbTestSettings":{"Experiment":"","Variant":"","TestParameter":""
},"CarrierSettings":{"CHExtensionMode":"false","RBuilder":"false","v_e
nv":"true","v_env_10":"true","v_env_12":"false"},"signature":"VtOjrod9
xkURbcTqhbp 2GnmQ492uujcRtheFHUtt6ZNve4YA5 /mJ2I3AEiED9RHWLh9OFZx2HjQS
I5mFfXTeLfzwKxfFNRysDV9gWeuoKmbBicmpbU8rr7xd1Jw4MmIeja3yasiPy6Q9dDQj8J
ByMyjM4ke3gaNLSl1o XJXk="}HTTP/1.1 200 OK..Content-Type: application/j
son; charset=text/plain..Last-Modified: Sat, 24 Jan 2015 01:19:45 GMT.
.ETag: "2a57ba7559f4c156393df725faadf6a0"..Server: Microsoft-IIS/7.5..
X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..P3P: CP="IDC DSP C
OR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"..Content-Length: 8
66..Cache-Control: private, max-age=900..Expires: Sat, 24 Jan 2015 01:
34:45 GMT..Date: Sat, 24 Jan 2015 01:19:45 GMT..Connection: keep-alive
..{"InstallerSettings":{"CHExtension_Id":null,"CHExtension_LandingPage
":null,"CHExtension_Name":null,"DEFAULT_CMD":"-carrier_type=CTID -carr
ier_id=CT3331172 -Platform=all -startpage=true -defaultsearch=true
<<< skipped >>>

POST / HTTP/1.0

Content-Type: application/json

Accept: */*

Host: sp-usage.databssint.com

Content-Length: 420

Connection: Keep-Alive

Pragma: no-cache

{"SP_ID":"SP6E332FFD-6BB3-4ACB-AA28-C84599BC50AC","Experiment":"","Variant":"","oslocale":"en-US","environment":"","OS_version":"5.1","OS_name":"Microsoft Windows XP","machine_ID":"X6DXB5LA8TCXW1SVVBM5RK8SRPSWASASMB3FBWLZVGDSK5SY8EJGP WASHJODV4YYUFBGJQOD3NWH/WF QMGXW","sequence_timestamp":"1422062405653","SP_version":"2.19.31.1","brand":"SP","action_type":"driver_first_enabled","result":"success","failure_reason":""}
HTTP/1.1 202 Accepted

Access-Control-Allow-Methods: GET,POST,HEAD,OPTIONS,PUT

Access-Control-Allow-Origin: *

Date: Sat, 24 Jan 2015 01:19:55 GMT

P3P: CP="NOI ADM DEV COM NAV OUR STP"

Server: Apache-Coyote/1.1

Content-Length: 0

Connection: keep-alive
HTTP/1.1 202 Accepted..Access-Control-Allow-Methods: GET,POST,HEAD,OPT
IONS,PUT..Access-Control-Allow-Origin: *..Date: Sat, 24 Jan 2015 01:19
:55 GMT..P3P: CP="NOI ADM DEV COM NAV OUR STP"..Server: Apache-Coyote/
1.1..Content-Length: 0..Connection: keep-alive..

GET /ip/?client=sp HTTP/1.1

User-Agent: SearchProtect;2.19.31.1;Microsoft Windows XP;SP6E332FFD-6BB3-4ACB-AA28-C84599BC50AC

Accept: */*

Host: sp-ip2location.spccint.com

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 181

Content-Type: application/json; charset=text/plain

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

P3P: CP="IDC DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Date: Sat, 24 Jan 2015 01:19:58 GMT
{"Location":{"City":"KHARKIV","Country":"UKRAINE","CountryCode":"UA","
IP":"193.138.244.231","Latitude":49.98081,"Longitude":36.25272,"Region
":"KHARKIVS'KA OBLAST'"},"Language":"uk"}HTTP/1.1 200 OK..Cache-Contro
l: private..Content-Length: 181..Content-Type: application/json; chars
et=text/plain..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319.
.X-Powered-By: ASP.NET..P3P: CP="IDC DSP COR CURa ADMa DEVa TAIa OUR B
US IND UNI COM NAV INT"..Date: Sat, 24 Jan 2015 01:19:58 GMT..{"Locati
on":{"City":"KHARKIV","Country":"UKRAINE","CountryCode":"UA","IP":"193
.138.244.231","Latitude":49.98081,"Longitude":36.25272,"Region":"KHARK
IVS'KA OBLAST'"},"Language":"uk"}..

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: sp-installer.databssint.com

Content-Length: 1239

Connection: Keep-Alive

Cache-Control: no-cache

{"event_type":"install_completed","SP_ID":"SP6E332FFD-6BB3-4ACB-AA28-C84599BC50AC","SP_version":"2.19.31.1","OS_name":"Microsoft Windows XP Professional Service Pack 3 (build 2600)","OS_version":"5.1","browser":"InternetExplorer","browser_version":"6.0.2900.5512","carrier_type":"CTID","carrier_ID":"CT3331172","carrier_version":"","carrier_userid":"","carrier_UM":"","machine_ID":"X6DXB5LA8TCXW1SVVBM5RK8SRPSWASASMB3FBWLZVGDSK5SY8EJGP+WASHJODV4YYUFBGJQOD3NWH/WF+QMGXW","hp_takeover":"true","other_takeover":"true","environment":"","sequence_timestamp":"1422062413138","profile_number":"1","user_number":"1", "installation_session_id":"I55C9995C-1A38-44AC-A4F4-9EC3862AE0CC", "download_length": -1, "install_type": "install", "result": "success", "reason": "0","v_env_tests":{"10_ProcessesExists":"0","10_ModuleInjected":"0","10_FakeSPServiceParent":"0","12_ProcessesExists":"0","12_StatusKeyExists":"0"},"v_env_codes":{"10":"0","12":"0"},"channel_id": "", "brand": "SP" , "previous_brand":"", "brand_install_type":"cleanmachine","extra_info":"","seed":"16245","source_version":"", "OS_bit": "", "OS_edition" : "Microsoft Windows XP Professional", "browser_bit" : "32", "dom_vir" : "vir","ProviderId": "2","Experiment":"","Variant":""}
HTTP/1.1 202 Accepted

Date: Sat, 24 Jan 2015 01:20:03 GM

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: sp-installer.databssint.com

Content-Length: 911

Connection: Keep-Alive

Cache-Control: no-cache

{"event_type":"install_start","SP_ID":"SP6E332FFD-6BB3-4ACB-AA28-C84599BC50AC","SP_version":"2.19.31.1","OS_name":"Microsoft Windows XP Professional Service Pack 3 (build 2600)","OS_version":"5.1","browser":"InternetExplorer","browser_version":"6.0.2900.5512","carrier_type":"CTID","carrier_ID":"CT3331172","carrier_version":"","carrier_userid":"","carrier_UM":"","machine_ID":"X6DXB5LA8TCXW1SVVBM5RK8SRPSWASASMB3FBWLZVGDSK5SY8EJGP+WASHJODV4YYUFBGJQOD3NWH/WF+QMGXW","hp_takeover":"true","other_takeover":"true","environment":"","sequence_timestamp":"1422062400966","profile_number":"1","user_number":"1", "installation_session_id":"I55C9995C-1A38-44AC-A4F4-9EC3862AE0CC", "download_length": -1, "install_type": "install", "channel_id": "", "brand": "SP", "extra_info":"", "OS_bit": "", "OS_edition" : "Microsoft Windows XP Professional", "browser_bit" : "32", "dom_vir" : "vir","Experiment":"","Variant":""}
HTTP/1.1 202 Accepted

Date: Sat, 24 Jan 2015 01:19:51 GMT

P3P: CP="NOI ADM DEV COM NAV OUR STP"

Server: Apache-Coyote/1.1

Content-Length: 0

Connection: keep-alive

GET /ip/?client=sp HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: sp-ip2location.spccint.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 181

Content-Type: application/json; charset=text/plain

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

P3P: CP="IDC DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Date: Sat, 24 Jan 2015 01:19:51 GMT
{"Location":{"City":"KHARKIV","Country":"UKRAINE","CountryCode":"UA","
IP":"193.138.244.231","Latitude":49.98081,"Longitude":36.25272,"Region
":"KHARKIVS'KA OBLAST'"},"Language":"uk"}HTTP/1.1 200 OK..Cache-Contro
l: private..Content-Length: 181..Content-Type: application/json; chars
et=text/plain..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319.
.X-Powered-By: ASP.NET..P3P: CP="IDC DSP COR CURa ADMa DEVa TAIa OUR B
US IND UNI COM NAV INT"..Date: Sat, 24 Jan 2015 01:19:51 GMT..{"Locati
on":{"City":"KHARKIV","Country":"UKRAINE","CountryCode":"UA","IP":"193
.138.244.231","Latitude":49.98081,"Longitude":36.25272,"Region":"KHARK
IVS'KA OBLAST'"},"Language":"uk"}..

POST / HTTP/1.1

Content-Type: application/json

Accept: */*

User-Agent: SearchProtect;2.19.31.1;Microsoft Windows XP;SP6E332FFD-6BB3-4ACB-AA28-C84599BC50AC

Host: sp-alive-msg.databssint.com

Content-Length: 622

Connection: Keep-Alive

Cache-Control: no-cache

{"SP_ID":"SP6E332FFD-6BB3-4ACB-AA28-C84599BC50AC","SP_version":"2.19.31.1","OS_name":"Microsoft Windows XP","OS_version":"5.1","install_date":"20150124","environment":"","machine_ID":"X6DXB5LA8TCXW1SVVBM5RK8SRPSWASASMB3FBWLZVGDSK5SY8EJGP WASHJODV4YYUFBGJQOD3NWH/WF QMGXW","Experiment":"","Variant":"","driver_enabled":"false","OS_edition":"Microsoft Windows XP Professional","OS_bit":"","action_type":"alive","type":"","brand":"SP","carrier_type":"CTID","dom_vir":"vir","carrier_ID":"CT3331172","browser":"InternetExplorer","browser_version":"6.0.2900.5512","browser_bit":"32","browser_uptime":0,"browser_vc_loaded":false}
HTTP/1.1 202 Accepted

Date: Sat, 24 Jan 2015 01:19:58 GMT

P3P: CP="NOI ADM DEV COM NAV OUR STP"

Server: Apache-Coyote/1.1

Content-Length: 0

Connection: keep-alive
HTTP/1.1 202 Accepted..Date: Sat, 24 Jan 2015 01:19:58 GMT..P3P: CP="N
OI ADM DEV COM NAV OUR STP"..Server: Apache-Coyote/1.1..Content-Length
: 0..Connection: keep-alive..

GET /UP/settings/?ctid=CT3331172&UM=&c=UA&DUM=2 HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: c.api.seccint.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: application/json; charset=utf-8

Server: Microsoft-IIS/7.5

X-AspNetMvc-Version: 3.0

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Content-Length: 4229

Cache-Control: private, max-age=3600

Expires: Sat, 24 Jan 2015 02:19:52 GMT

Date: Sat, 24 Jan 2015 01:19:52 GMT

Connection: keep-alive
{"GeneralId":null,"Ctid":"CT3331172","ProviderId":2,"ProviderName":"Bi
ng","UserIP":"193.138.244.231","UserLanguage":"ru","ToolbarLanguage":"
en","EntityLanguage":"en","CountryShortCode":"UA","IsUserRTL":false,"I
sToolbarRTL":false,"IsEntityRTL":false,"ShowClientDialog":true,"HomePa
geUrl":"hXXp://VVV.trovi.com/?gd=&ctid=CT3331172&octid=EB_ORIGINAL_CTI
D&ISID=ISID_ID&SearchSource=55&CUI=SB_CUI&UM=8&UP=UP_ID","IsCustomized
Homepage":false,"HomePageButtonUrl":"hXXp://VVV.trovi.com/?gd=&ctid=CT
3331172&octid=EB_ORIGINAL_CTID&ISID=ISID_ID&SearchSource=55&CUI=SB_CUI
&UM=8&UP=UP_ID&SAT=HPB","UM":"","SearchDomain":"VVV.trovi.com","Toolba
rSearchBox":{"History":{"IsEnabled":true,"Position":1,"MaxAmount":5,"L
abel":{"Text":"History"}},"Verticals":[{"Name":"SearchImages","SearchU
rl":"hXXp://VVV.trovi.com/?gd=&ctid=CT3331172&octid=EB_ORIGINAL_CTID&I
SID=ISID_ID&SearchSource=67&SearchType=SearchImages&CUI=SB_CUI&UM=8&UP
=UP_ID&q=UCM_SEARCH_TERM","EmptySearchUrl":"hXXp://VVV.trovi.com/?gd=&
ctid=CT3331172&octid=EB_ORIGINAL_CTID&ISID=ISID_ID&SearchSource=67&Sea
rchType=SearchImages&CUI=SB_CUI&UM=8&UP=UP_ID"}],"EmptySearchUrl":"htt
p://VVV.trovi.com/?gd=&ctid=CT3331172&octid=EB_ORIGINAL_CTID&ISID=ISID
_ID&SearchSource=67&CUI=SB_CUI&UM=8&UP=UP_ID","SearchUrl":"hXXp://VVV.
trovi.com/Results.aspx?gd=&ctid=CT3331172&octid=EB_ORIGINAL_CTID&ISID=
ISID_ID&SearchSource=67&CUI=SB_CUI&UM=8&UP=UP_ID&q=UCM_SEARCH_TERM","S
uggest":{"SearchResultsUrl":"hXXp://VVV.trovi.com/Results.aspx?gd=&cti
d=CT3331172&octid=EB_ORIGINAL_CTID&ISID=ISID_ID&SearchSource=67&Su
<<< skipped >>>

GET /UP/settings/?ctid=CT3331172&gd=&UM=&c=UA&DUM=2&D=012415 HTTP/1.1

User-Agent: SearchProtect;2.19.31.1;Microsoft Windows XP;SP6E332FFD-6BB3-4ACB-AA28-C84599BC50AC

Accept: */*

Host: c.api.seccint.com

HTTP/1.1 200 OK

Content-Type: application/json; charset=utf-8

Server: Microsoft-IIS/7.5

X-AspNetMvc-Version: 3.0

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Content-Length: 4229

Cache-Control: private, max-age=3600

Expires: Sat, 24 Jan 2015 02:19:58 GMT

Date: Sat, 24 Jan 2015 01:19:58 GMT

Connection: keep-alive
{"GeneralId":null,"Ctid":"CT3331172","ProviderId":2,"ProviderName":"Bi
ng","UserIP":"193.138.244.231","UserLanguage":"ru","ToolbarLanguage":"
en","EntityLanguage":"en","CountryShortCode":"UA","IsUserRTL":false,"I
sToolbarRTL":false,"IsEntityRTL":false,"ShowClientDialog":true,"HomePa
geUrl":"hXXp://VVV.trovi.com/?gd=&ctid=CT3331172&octid=EB_ORIGINAL_CTI
D&ISID=ISID_ID&SearchSource=55&CUI=SB_CUI&UM=8&UP=UP_ID","IsCustomized
Homepage":false,"HomePageButtonUrl":"hXXp://VVV.trovi.com/?gd=&ctid=CT
3331172&octid=EB_ORIGINAL_CTID&ISID=ISID_ID&SearchSource=55&CUI=SB_CUI
&UM=8&UP=UP_ID&SAT=HPB","UM":"","SearchDomain":"VVV.trovi.com","Toolba
rSearchBox":{"History":{"IsEnabled":true,"Position":1,"MaxAmount":5,"L
abel":{"Text":"History"}},"Verticals":[{"Name":"SearchImages","SearchU
rl":"hXXp://VVV.trovi.com/?gd=&ctid=CT3331172&octid=EB_ORIGINAL_CTID&I
SID=ISID_ID&SearchSource=67&SearchType=SearchImages&CUI=SB_CUI&UM=8&UP
=UP_ID&q=UCM_SEARCH_TERM","EmptySearchUrl":"hXXp://VVV.trovi.com/?gd=&
ctid=CT3331172&octid=EB_ORIGINAL_CTID&ISID=ISID_ID&SearchSource=67&Sea
rchType=SearchImages&CUI=SB_CUI&UM=8&UP=UP_ID"}],"EmptySearchUrl":"htt
p://VVV.trovi.com/?gd=&ctid=CT3331172&octid=EB_ORIGINAL_CTID&ISID=ISID
_ID&SearchSource=67&CUI=SB_CUI&UM=8&UP=UP_ID","SearchUrl":"hXXp://VVV.
trovi.com/Results.aspx?gd=&ctid=CT3331172&octid=EB_ORIGINAL_CTID&ISID=
ISID_ID&SearchSource=67&CUI=SB_CUI&UM=8&UP=UP_ID&q=UCM_SEARCH_TERM","S
uggest":{"SearchResultsUrl":"hXXp://VVV.trovi.com/Results.aspx?gd=&cti
d=CT3331172&octid=EB_ORIGINAL_CTID&ISID=ISID_ID&SearchSource=67&Su
<<< skipped >>>

The Application connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.rsrc

@.reloc

SHA256 block transform for x86, CRYPTOGAMS by <[email protected]>

SHA1 block transform for x86, CRYPTOGAMS by <[email protected]>

.EKSWU

DlSHA512 block transform for x86, CRYPTOGAMS by <[email protected]>

\$$;\$0|

Montgomery Multiplication for x86, CRYPTOGAMS by <[email protected]>

6-9'6-9'

$6.:$6.:

*?#1*?#1

>8$4,8$4,

AES for x86, CRYPTOGAMS by <[email protected]>

FtPS

GF(2^m) Multiplication for x86, CRYPTOGAMS by <[email protected]>

Camellia for x86 by <[email protected]>

AES for Intel AES-NI, CRYPTOGAMS by <[email protected]>

RC4 for x86, CRYPTOGAMS by <[email protected]>

GHASH for x86, CRYPTOGAMS by <[email protected]>

[email protected]

t.JuG

PSSSSSSh

t.VVW

<1%u5

FTPj

tCPQ

,4,56,789

j.Yf;

_tcPVj@

.PjRW

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

0123456789-

%b %d %H : %M : %S %Y

%m / %d / %y

%I : %M : %S %p

%d / %m / %y

boost thread: trying joining itself

Local\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flag

Visual C   CRT: Not enough memory to complete call to strerror.

Operation not permitted

Inappropriate I/O control operation

Broken pipe

operator

GetProcessWindowStation

kernel32.dll

The repeat operator "*" cannot start a regular expression.

The repeat operator "?" cannot start a regular expression.

The repeat operator " " cannot start a regular expression.

Found a closing repetition operator } with no corresponding {.

Can't terminate a sub-expression with an alternation operator |.

The \c and \C escape sequences are not supported by POSIX basic regular expressions: try the Perl syntax instead.

A regular expression can start with the alternation operator |.

Invalid alternation operators within (?...) block.

More than one alternation operator | was encountered inside a conditional expression.

Alternation operators are not allowed inside a DEFINE block.

A repetition operator cannot be applied to a zero-width assertion.

left-curly-bracket

right-curly-bracket

0123456789

Unmatched quantified repeat operator { or \{.

Invalid preceding regular expression prior to repetition operator.

len>=0 && len<=(int)sizeof(ctx->key)

j <= (int)sizeof(ctx->key)

SHA-256 part of OpenSSL 1.0.1e 11 Feb 2013

SHA1 part of OpenSSL 1.0.1e 11 Feb 2013

ssl_sess_cert

ssl_cert

evp_pkey

x509_pkey

%s(%d): OpenSSL internal error, assertion failed: %s

SHA-512 part of OpenSSL 1.0.1e 11 Feb 2013

passed a null parameter

DSO support routines

x509 certificate routines

Stack part of OpenSSL 1.0.1e 11 Feb 2013

Any Extended Key Usage

anyExtendedKeyUsage

supportedAlgorithms

crossCertificatePair

certificateRevocationList

cACertificate

userCertificate

userPassword

supportedApplicationContext

Microsoft Local Key set

LocalKeySet

id-Gost28147-89-None-KeyMeshing

id-Gost28147-89-CryptoPro-KeyMeshing

password based MAC

id-PasswordBasedMAC

X509v3 Certificate Issuer

certificateIssuer

certicom-arc

Proxy Certificate Information

proxyCertInfo

Microsoft Smartcardlogin

msSmartcardLogin

joint-iso-itu-t

JOINT-ISO-ITU-T

set-rootKeyThumb

setAttr-Cert

setCext-cCertRequired

setCext-certType

setct-CertResTBE

setct-CertReqTBEX

setct-CertReqTBE

setct-AcqCardCodeMsgTBE

setct-CertInqReqTBS

setct-CertResData

setct-CertReqTBS

setct-CertReqData

setct-PCertResTBS

setct-PCertReqData

setct-AcqCardCodeMsg

certificate extensions

set-certExt

set-msgExt

id-ecPublicKey

id-cmc-confirmCertAcceptance

id-cmc-getCert

id-regInfo-certReq

id-regCtrl-protocolEncrKey

id-regCtrl-oldCertID

id-it-revPassphrase

id-it-keyPairParamRep

id-it-keyPairParamReq

id-it-unsupportedOIDs

id-it-caKeyUpdateInfo

id-it-encKeyPairTypes

id-it-signKeyPairTypes

id-it-caProtEncCert

id-mod-attribute-cert

id-mod-qualified-cert-93

id-mod-qualified-cert-88

id-smime-aa-ets-certCRLTimestamp

id-smime-aa-ets-certValues

id-smime-aa-ets-CertificateRefs

id-smime-aa-ets-otherSigCert

id-smime-aa-smimeEncryptCerts

id-smime-aa-signingCertificate

id-smime-aa-encrypKeyPref

id-smime-aa-msgSigDigest

id-smime-ct-publishCert

id-smime-mod-msg-v3

sdsiCertificate

x509Certificate

localKeyID

certBag

pkcs8ShroudedKeyBag

keyBag

pbeWithSHA1And2-KeyTripleDES-CBC

pbeWithSHA1And3-KeyTripleDES-CBC

TLS Web Client Authentication

TLS Web Server Authentication

X509v3 Extended Key Usage

extendedKeyUsage

X509v3 Authority Key Identifier

authorityKeyIdentifier

X509v3 Certificate Policies

certificatePolicies

X509v3 Private Key Usage Period

privateKeyUsagePeriod

X509v3 Key Usage

keyUsage

X509v3 Subject Key Identifier

subjectKeyIdentifier

Netscape Certificate Sequence

nsCertSequence

Netscape CA Policy Url

nsCaPolicyUrl

Netscape Renewal Url

nsRenewalUrl

Netscape CA Revocation Url

nsCaRevocationUrl

Netscape Revocation Url

nsRevocationUrl

Netscape Base Url

nsBaseUrl

Netscape Cert Type

nsCertType

Netscape Certificate Extension

nsCertExt

extendedCertificateAttributes

challengePassword

dhKeyAgreement

hexkey

rsa_keygen_pubexp

rsa_keygen_bits

lhash part of OpenSSL 1.0.1e 11 Feb 2013

ASN.1 part of OpenSSL 1.0.1e 11 Feb 2013

Big Number part of OpenSSL 1.0.1e 11 Feb 2013

%d.%d.%d.%d

EC part of OpenSSL 1.0.1e 11 Feb 2013

ECDSA part of OpenSSL 1.0.1e 11 Feb 2013

.\crypto\ec\ec_key.c

priv_key

pub_key

DSA part of OpenSSL 1.0.1e 11 Feb 2013

Diffie-Hellman part of OpenSSL 1.0.1e 11 Feb 2013

.\crypto\dh\dh_key.c

RSA part of OpenSSL 1.0.1e 11 Feb 2013

value.single

value.set

RAND part of OpenSSL 1.0.1e 11 Feb 2013

You need to read the OpenSSL FAQ, hXXp://VVV.openssl.org/support/faq.html

keylen <= sizeof key

EVP_CIPHER_key_length(cipher) <= (int)sizeof(md_tmp)

EVP part of OpenSSL 1.0.1e 11 Feb 2013

d.registeredID

d.iPAddress

d.uniformResourceIdentifier

d.ediPartyName

d.directoryName

d.dNSName

d.rfc822Name

d.otherName

ECDH part of OpenSSL 1.0.1e 11 Feb 2013

%'%1$=%C%K%O%s%

.%.-.3.7.9.?.W.[.o.y.

C%C'C3C7C9COCWCiC

d.receiptList

d.allOrFirstTier

d.compressedData

d.authenticatedData

d.encryptedData

d.digestedData

d.envelopedData

d.signedData

d.data

d.ori

d.pwri

d.kekri

d.kari

d.ktri

CMS_PasswordRecipientInfo

keyDerivationAlgorithm

keyIdentifier

CMS_KeyAgreeRecipientInfo

recipientEncryptedKeys

CMS_OriginatorIdentifierOrKey

d.originatorKey

CMS_OriginatorPublicKey

publicKey

CMS_RecipientEncryptedKey

CMS_KeyAgreeRecipientIdentifier

d.rKeyId

CMS_RecipientKeyIdentifier

CMS_OtherKeyAttribute

keyAttr

keyAttrId

CMS_KeyTransRecipientInfo

encryptedKey

keyEncryptionAlgorithm

certificates

d.crl

d.subjectKeyIdentifier

d.issuerAndSerialNumber

CMS_CertificateChoices

d.other

d.v2AttrCert

d.v1AttrCert

d.extendedCertificate

d.certificate

CMS_OtherCertificateFormat

otherCert

otherCertFormat

AES part of OpenSSL 1.0.1e 11 Feb 2013

%s: (%d bit)

Public-Key

Private-Key

recommended-private-length: %d bits

public-key:

private-key:

PKCS#3 DH Public-Key

PKCS#3 DH Private-Key

Public-Key: (%d bit)

Private-Key: (%d bit)

USER32.DLL

NETAPI32.DLL

KERNEL32.DLL

ADVAPI32.DLL

keylength

keyfunc

.\crypto\pkcs12\p12_key.c

<unsupported>

IP Address:%d.%d.%d.%d

URI:%s

DNS:%s

email:%s

EdiPartyName:<unsupported>

X400Name:<unsupported>

othername:<unsupported>

CONF part of OpenSSL 1.0.1e 11 Feb 2013

X509_PUBKEY

public_key

.\crypto\asn1\x_pubkey.c

name.relativename

name.fullname

certificateHold

Certificate Hold

cessationOfOperation

Cessation Of Operation

keyCompromise

Key Compromise

%*s%s:

%*sOnly Attribute Certificates

%*sOnly CA Certificates

%*sOnly User Certificates

%d.%d.%d.%d/%d.%d.%d.%d

%*sPolicy Text: %s

%*scrlUrl:

EXTENDED_KEY_USAGE

%*sZone: %s, User:

keyid

.\crypto\x509v3\v3_akey.c

d.usernotice

d.cpsuri

CERTIFICATEPOLICIES

%*sExplicit Text: %s

%*sNumber%s:

%*sOrganization: %s

%*sCPS: %s

PKEY_USAGE_PERIOD

keyCertSign

Certificate Sign

keyAgreement

Key Agreement

keyEncipherment

Key Encipherment

.\crypto\x509v3\v3_skey.c

pubkey

cert_info

X.509 part of OpenSSL 1.0.1e 11 Feb 2013

PROXY_CERT_INFO_EXTENSION

EC_PRIVATEKEY

privateKey

value.implicitlyCA

value.parameters

value.named_curve

p.char_two

p.prime

p.ppBasis

p.tpBasis

p.onBasis

p.other

PKCS8_PRIV_KEY_INFO

pkey

pkeyalg

x%s

Basis Type: %s

Field Type: %s

ASN1 OID: %s

%s %s%lu (%s0x%lx)

%s - d:d:d%.*s %d%s

\X

'() ,-./:=?

CONF_def part of OpenSSL 1.0.1e 11 Feb 2013

[[%s]]

[%s] %s=%s

MD5 part of OpenSSL 1.0.1e 11 Feb 2013

crlUrl

certStatus

certId

OCSP_CERTSTATUS

value.unknown

value.revoked

value.good

value.byKey

value.byName

reqCert

OCSP_CERTID

issuerKeyHash

certs

AUTHORITY_KEYID

enc_key

key_enc_algor

cert

d.encrypted

d.digest

d.signed_and_enveloped

d.enveloped

d.sign

X509_CERT_PAIR

X509_CERT_AUX

PEM part of OpenSSL 1.0.1e 11 Feb 2013

ddddddZ

ddddddZ

value.bag

value.safes

value.shkeybag

value.keybag

value.sdsicert

value.x509cert

value.other

%s.dll

?456789:;<=

!"#$%&'()* ,-./0123

Verifying - %s

NETSCAPE_CERT_SEQUENCE

RIPE-MD160 part of OpenSSL 1.0.1e 11 Feb 2013

SHA part of OpenSSL 1.0.1e 11 Feb 2013

MD4 part of OpenSSL 1.0.1e 11 Feb 2013

CAST part of OpenSSL 1.0.1e 11 Feb 2013

Blowfish part of OpenSSL 1.0.1e 11 Feb 2013

:RC2 part of OpenSSL 1.0.1e 11 Feb 2013

.pp@0

aEÐ

 (#EÚ

ÚE<<0

IDEA part of OpenSSL 1.0.1e 11 Feb 2013

libdes part of OpenSSL 1.0.1e 11 Feb 2013

DES part of OpenSSL 1.0.1e 11 Feb 2013

L-L.LbL(L)L:L8L>L#L:L%LbL/L#L!L

 F'F>FfF2F/F F#FfF4F#F'F%F.F#F"F

=\>\3\.\(\

@%]%Q%@%K%V%L%J%K%z%I%J%F%D%Q%L%J%K%z%R%W%L%Q%Q%@%K%

${/{){:{"{${({>{){-{2{8{>{6{:{ {${.{){7{${*{:{${

d:\Build\78\Search Protector\SP-2.19.31-Production\Sources\3rdParty\Boost\boost_1_55_0\boost/exception/detail/exception_ptr.hpp

{{{$1253}}}

{{{$1258}}}

{{{$1259}}}

{{{$730}}}

{{{$1260}}}

\5\(\9\|\

{{{$1269}}}

{{{$1271}}}

{{{$1273}}}

{{{$1272}}}

{{{$1275}}}

{{{$1274}}}

{{{$1277}}}

{{{$1276}}}

{{{$1279}}}

{{{$1278}}}

{{{$1281}}}

{{{$1280}}}

{{{$1283}}}

{{{$1282}}}

{{{$1285}}}

{{{$1284}}}

{{{$1287}}}

{{{$1286}}}

-@!@#@(@)@.@%@)@$@

{{{$1315}}}

{{{$1316}}}

{{{$1317}}}

{{{$1319}}}

{{{$1318}}}

{{{$1321}}}

{{{$1320}}}

{{{$1323}}}

{{{$1322}}}

{{{$1324}}}

{{{$1326}}}

{{{$1325}}}

{{{$1331}}}

{{{$1327}}}

{{{$1329}}}

{{{$1330}}}

{{{$1328}}}

{{{$1336}}}

{{{$1338}}}

{{{$1337}}}

{{{$1339}}}

{{{$1344}}}

{{{$1347}}}

{{{$1346}}}

{{{$1349}}}

{{{$1348}}}

{{{$1351}}}

{{{$1350}}}

{{{$145}}}

{{{$146}}}

{{{$149}}}

{{{$147}}}

{{{$148}}}

{{{$154}}}

{{{$150}}}

{{{$153}}}

{{{$156}}}

{{{$155}}}

{{{$128}}}

{{{$131}}}

{{{$126}}}

{{{$127}}}

{{{$134}}}

{{{$135}}}

{{{$132}}}

{{{$133}}}

{{{$138}}}

{{{$136}}}

{{{$137}}}

{{{$141}}}

S6S!S%S:S0S6SsS

S6S!S%S:S0S6SqSsS5S2S:S?S6S7S

D*D7D0D%D(D(DdDiDdD'D,D%D*D#D!D DdD0D DdDdDÑD0D D)DÐD-D'DdD D!D(D%D=D!D D

{{{$562}}}

{{{$564}}}

{{{$558}}}

{{{$551}}}

{{{$560}}}

-^;^0^:^

^-^?^9^;^

A18HT0FXT8IDECMDWSR4HJMU1SWH9O

@/@/@4@3@4@2@!@0@%@2@`@

@%@'@)@3@4@%@2@

@2@/@7@3@%@2@

@)@&@%@4@)@-@%@

@6@%@.@4@`@%@8@)@4@

[2[8[)[4[([4[=[/[

[2[5[?[4[,[([{[

[.[)[)[>[5[/[

[>[)[([2[4[5[

[2[5[?[4[,[([

{{{$586}}}

{{{$587}}}

{{{$588}}}

{{{$590}}}

{{{$589}}}

{{{$592}}}

{{{$591}}}

{{{$600}}}

{{{$599}}}

{{{$598}}}

{{{$597}}}

{{{$602}}}

{{{$604}}}

{{{$603}}}

{{{$608}}}

{{{$607}}}

{{{$606}}}

{{{$605}}}

{{{$611}}}

{{{$610}}}

{{{$609}}}

{{{$612}}}

{{{$613}}}

^,^1^?^:^=^?^-^*^

{{{$614}}}

{{{$617}}}

{{{$616}}}

{{{$615}}}

{{{$618}}}

{{{$619}}}

{{{$621}}}

{{{$620}}}

{{{$623}}}

{{{$622}}}

{{{$624}}}

{{{$625}}}

{{{$626}}}

{{{$627}}}

{{{$713}}}

{{{$717}}}

{{{$716}}}

{{{$715}}}

{{{$714}}}

{{{$718}}}

[)[4[,[([>[)[

{{{$465}}}

{{{$464}}}

?[2[)[>[8[/[4[)[2[>[([

{{{$466}}}

{{{$469}}}

{{{$472}}}

.@!@-@%@

{{{$475}}}

{{{$488}}}

{{{$489}}}

Z7Z;Z=Z?ZzZ-Z3Z>Z.Z2ZgZxZkZlZxZzZ2Z?Z3Z=Z2Z.ZgZxZkZlZxZdZ

Z(Z6ZzZ.Z#Z*Z?ZgZxZ.Z?Z"Z.ZuZ2Z.Z7Z6ZxZzZ7Z?Z.Z2Z5Z>ZgZxZ

F#FóF4F#FfF

F4F#F F#F4F#F(F%F#F5F

>;/*?.KK

dd)!0}

{{{$367}}}

{{{$366}}}

{{{$368}}}

wrfcvg"ogvc"qgv"tcnwg?%'f%"ujgpg"ig{?%Fgdcwnv"Qgcpaj"Rpmtkfgp"KF%9

{{{$388}}}

.818>)}49};/20}68$*2/9.}*58/8}(/1`zx.zf

{{{$417}}}

{{{$419}}}

{{{$418}}}

{{{$420}}}

,J J#J&J/J.JjJ&J J?J$J)J"J#J$J-JjJ

f%P%W%W%@%K%Q%s%@%W%V%L%J%K%

{{{$736}}}

{{{$733}}}

{{{$734}}}

{{{$735}}}

d:\Build\78\Search Protector\SP-2.19.31-Production\Sources\3rdParty\google\gtest\gtest-1.6.0\include\gtest/internal/gtest-port.h

Module %d

Image Base: 0xx Image Size: 0xx

Checksum: 0xx Time Stamp: 0xx

\StringFileInfo\xx\%s

(more frames truncated from call stack report)

%d/%d/%d d:d:d

FileDesc: %s

FileVer: %d.%d.%d.%d

ProdVer: %d.%d.%d.%d

File Size: %-10d File Time: %s

Company: %s

Product: %s

Windows 7

Windows Server 2008

Windows 8

Windows Server 2008 R2

Windows Vista

Windows 9

Web Edition

Windows XP

Windows Server 2012

(build %d)

Windows Server 9

Windows 2000

Operating system: %s

Operating system: Could not Determine

This sample does not support this version of Windows.

Error occurred at %s.

%d MBytes paging file.

%d MBytes paging file free.

%d MBytes user address space.

%d MBytes user address space free.

%d processor(s), type %d.

%d%% memory in use.

Web Server Edition

%d MBytes physical memory free.

Windows Server 2003 R2

a Float Invalid Operation

Windows Storage Server 2003

Windows Home Server

Windows XP Professional x64 Edition

a Float Denormal Operand

Windows Server 2003

%d MBytes physical memory.

0xx:

EDI: 0xx ESI: 0xx EAX: 0xx

EBX: 0xx ECX: 0xx EDX: 0xx

EIP: 0xx EBP: 0xx SegCs: 0xx

EFlags: 0xx ESP: 0xx SegSs: 0xx

%s location x caused an access violation.

%s\CRASH_REPORT_%s.txt

%s caused %s (0xx)

in module %s at x:x.

%s\CRASH_DUMP_%s.dmp

Exception code is 0xX

Crash dump file: %s

Crash report file :%s

Error creating dump file, err=%d

===== [end of %s] =====

P%d_T%d_Dld_ld_ld_Tld_ld_ld

code: %x, addr: %x, module: %s

code: %x

F)F%F'F*FfF

00:00:00.

NtQueryKey

{{{$723}}}

{{{$724}}}

{{{$725}}}

{{{$719}}}

{{{$720}}}

{{{$721}}}

{{{$722}}}

{{{$726}}}

{{{$727}}}

{{{$818}}}

{{{$819}}}

{{{$820}}}

{{{$821}}}

{{{$815}}}

{{{$816}}}

%s 0x%I64x %s [file:%s(%u)]

hXXp://

hXXps://

PTF://

wininet.dll

[%u, 0xx] %s

https

HTTP/1.0

Content-Type: application/x-www-form-urlencoded

request HttpSendRequestA failed...

Content-Length: %u

response failed...last error %d

1.1.3

gen_codes: max_code %d

code %d bits %d->%d

opt %lu(%lu) stat %lu(%lu) stored %lu lit %u dist %u

bl code -

last_lit %u, last_dist %u, in %ld, out ~%ld(%ld%%)

{{{$860}}}

{{{$859}}}

{{{$861}}}

{{{$862}}}

{{{$863}}}

{{{$866}}}

{{{$864}}}

{{{$865}}}

{{{$867}}}

{{{$868}}}

{{{$869}}}

{{{$870}}}

{{{$871}}}

{{{$872}}}

{{{$873}}}

{{{$874}}}

{{{$876}}}

{{{$877}}}

{{{$875}}}

{{{$884}}}

{{{$885}}}

{{{$886}}}

{{{$889}}}

{{{$888}}}

{{{$778}}}

{{{$786}}}

{{{$785}}}

{{{$787}}}

{{{$782}}}

{{{$779}}}

{{{$784}}}

{{{$783}}}

SQLite format 3

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY_\

CREATE TABLE sqlite_master(

sql text

3.7.16

CREATE TEMP TABLE sqlite_temp_master(

{{{$108}}}

{{{$107}}}

{{{$103}}}

{{{$105}}}

{{{$104}}}

{{{$114}}}

{{{$113}}}

{{{$115}}}

{{{$110}}}

{{{$109}}}

{{{$112}}}

{{{$111}}}

{{{$117}}}

{{{$118}}}

{{{$116}}}

{{{$121}}}

{{{$122}}}

{{{$119}}}

{{{$120}}}

{{{$125}}}

{{{$123}}}

{{{$124}}}

{{{$102}}}

{{{$809}}}

{{{$808}}}

{{{$811}}}

{{{$810}}}

{{{$805}}}

{{{$807}}}

{{{$806}}}

{{{$812}}}

boost::too_few_args: format-string referred to more arguments than were passed

boost::too_many_args: format-string referred to less arguments than were passed

{{{$144}}}

Content-Disposition: form-data; name="%s"; filename="%s"

Content-Disposition: form-data; name="%s"

SQLITE_

d-d-d d:d:d

d:d:d

d-d-d

failed to allocate %u bytes of memory

failed memory resize %u to %u bytes

922337203685477580

API call with %s database connection pointer

RowKey

GetProcessHeap

os_win.c:%d: (%d) %s(%s) - %s

delayed %dms for lock/sharing conflict

OsError 0x%x (%u)

%s-shm

%s\etilqs_

%s\%s

cannot limit WAL size: %s

Recovered %d frames from WAL file %s

invalid page number %d

2nd reference to page %d

%d of %d pages missing from overflow list starting at %d

failed to get page %d

Failed to read ptrmap key=%d

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

unable to get the page. error code=%d

btreeInitPage() returns error code %d

freelist leaf count too big on page %d

Page %d:

On page %d at right child:

On tree page %d cell %d:

Fragmentation of %d bytes reported as %d on page %d

Corruption detected in cell %d on page %d

Multiple uses for byte %d of page %d

Pointer map page %d is referenced

Outstanding page count goes from %d to %d during this analysis

Page %d is never used

unknown database %s

keyinfo(%d

%s(%d)

MJ collide: %s

-mjX9X

%s-mjXXXXXX9XXz

MJ delete: %s

foreign key constraint failed

unable to use function %s in the requested context

bind on a busy prepared statement: [%s]

zeroblob(%d)

cannot open savepoint - SQL statements in progress

no such savepoint: %s

abort at %d in [%s]: %s

constraint failed at %d in [%s]

cannot release savepoint - SQL statements in progress

cannot commit transaction - SQL statements in progress

sqlite_temp_master

sqlite_master

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid

statement aborts at %d: [%s] %s

cannot change %s wal mode from within a transaction

database table is locked: %s

cannot open value of type %s

no such column: "%s"

foreign key

cannot open virtual table: %s

cannot open view: %s

indexed

cannot open %s column for writing

%s: %s.%s.%s

misuse of aliased aggregate %s

not authorized to use function: %s

%s: %s.%s

%s: %s

%r %s BY term out of range - should be between 1 and %d

too many terms in %s BY clause

too many SQL variables

too many columns in %s

Expression tree is too large (maximum depth %d)

variable number must be between ?1 and ?%d

EXECUTE %s%s SUBQUERY %d

misuse of aggregate: %s()

%.*s"%w"%s

%s%.*s"%w"

sqlite_rename_parent

sqlite_rename_table

sqlite_rename_trigger

sqlite_

%s OR name=%Q

type='trigger' AND (%s)

view %s may not be altered

UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;

table %s may not be altered

there is already another table or index with this name: %s

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

sqlite_sequence

Cannot add a PRIMARY KEY column

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

CREATE TABLE %Q.%s(%s)

sqlite_altertab_%s

sqlite_stat1

DELETE FROM %Q.%s WHERE %s=%Q

SELECT tbl,idx,stat FROM %Q.sqlite_stat1

invalid name: "%s"

database %s is already in use

too many attached databases - max %d

no such database: %s

cannot detach database %s

unable to open database: %s

sqlite_detach

sqlite_attach

database %s is locked

access to %s.%s.%s is prohibited

access to %s.%s is prohibited

%s %T cannot reference objects in database %s

object name reserved for internal use: %s

duplicate column name: %s

default value of column [%s] is not constant

there is already an index named %s

too many columns on %s

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

table "%s" has more than one primary key

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

CREATE TABLE %Q.sqlite_sequence(name,seq)

CREATE %s %.*s

view %s is circularly defined

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

sqlite_stat

sqlite_stat%d

DELETE FROM %Q.sqlite_sequence WHERE name=%Q

use DROP VIEW to delete view %s

foreign key on %s should reference only one column of table %T

table %s may not be dropped

use DROP TABLE to delete table %s

indexed columns are not unique

number of columns in foreign key does not match the number of columns in the referenced table

unknown column "%s" in foreign key definition

views may not be indexed

virtual tables may not be indexed

table %s may not be indexed

sqlite_autoindex_%s_%d

table %s has no column named %s

there is already a table named %s

index %s already exists

CREATE%s INDEX %.*s

no such index: %S

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

a JOIN clause is required before %s

DELETE FROM %Q.%s WHERE name=%Q AND type='index'

no such collation sequence: %s

table %s may not be modified

unable to identify the object to be reindexed

cannot modify %s because it is a view

sqlite_source_id

sqlite_log

sqlite_version

sqlite_compileoption_used

sqlite_compileoption_get

foreign key mismatch - "%w" referencing "%w"

table %S has no column named %s

table %S has %d columns but %d values were supplied

%d values for %d columns

PRIMARY KEY must be unique

%s.%s may not be NULL

constraint %s failed

no entry point [%s] in shared library [%s]

error during initialization: %s

sqlite3_extension_init

unable to open shared library [%s]

automatic extension loading failed: %s

foreign_keys

foreign_key_list

foreign_key_check

*** in database %s ***

unsupported encoding: %s

malformed database schema (%s)

%s - %s

SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid

database schema is locked: %s

unsupported file format

a NATURAL join may not have an ON or USING clause

cannot have both ON and USING clauses in the same join

unknown or unsupported join type: %T %T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

cannot join using column %s - column not present in both tables

USE TEMP B-TREE FOR %s

%s:%d

ORDER BY clause should come after %s not before

COMPOUND SUBQUERIES %d AND %d %s(%s)

%s.%s

SELECTs to the left and right of %s do not have the same number of result columns

no such index: %s

LIMIT clause should come after %s not before

%s.%s.%s

no such table: %s

sqlite_subquery_%p_

too many references to "%s": max 65535

SCAN TABLE %s %s%s(~%d rows)

sqlite3_get_table() called with two or more incompatible queries

cannot create INSTEAD OF trigger on table: %S

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

cannot create %s trigger on view: %S

-- TRIGGER %s

no such column: %s

no such trigger: %S

cannot VACUUM - SQL statements in progress

PRAGMA vacuum_db.synchronous=OFF

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

vtable constructor failed: %s

vtable constructor did not declare schema: %s

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

no such module: %s

table %s: xBestIndex returned an invalid plan

%s AS %s

%s SUBQUERY %d

%s TABLE %s

%s USING INTEGER PRIMARY KEY

%s (rowid=?)

%s USING %s%sINDEX%s%s%s

%s (rowid<?)

%s VIRTUAL TABLE INDEX %d:%s

%s (rowid>? AND rowid<?)

%s (rowid>?)

cannot use index: %s

%s (~%lld rows)

at most %d tables in a join

the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

SQL logic error or missing database

unknown operation

large file support is disabled

unknown database: %s

no such %s mode: %s

%s mode not allowed: %s

database corruption at line %d of [%.10s]

no such vfs: %s

misuse at line %d of [%.10s]

cannot open file at line %d of [%.10s]

{{{$835}}}

{{{$836}}}

{{{$837}}}

d:\Build\78\Search Protector\SP-2.19.31-Production\Sources\SearchProtector\Dev\2.19.31\Output\Release_32\CltMngSvc.pdb

WTSAPI32.dll

USERENV.dll

KERNEL32.dll

USER32.dll

ReportEventW

ADVAPI32.dll

SHELL32.dll

ole32.dll

OLEAUT32.dll

I_RpcBindingInqTransportType

RPCRT4.dll

PSAPI.DLL

VERSION.dll

HttpOpenRequestA

HttpAddRequestHeadersA

HttpSendRequestW

HttpSendRequestA

HttpSendRequestExW

HttpEndRequestW

HttpQueryInfoA

WININET.dll

CryptMsgClose

CertGetNameStringW

CertFreeCertificateContext

CertFindCertificateInStore

CertCloseStore

CryptMsgGetParam

CRYPT32.dll

dbghelp.dll

GetCPInfo

RegCloseKey

RegOpenKeyExW

RegDeleteKeyW

RegEnumKeyExW

RegCreateKeyExW

RegNotifyChangeKeyValue

RegSaveKeyExW

RegRestoreKeyW

ReportEventA

zcÁ

C:\PROGRA~1\SearchProtect\

;74/, (%#

~{xrpfa\ZSM@;3-%U

function k(a) { return a < 10 ? "0"   a : a } function o(a) { p.lastIndex = 0; return p.test(a) ? '"'   a.replace(p, function (a) { var c = r[a]; return typeof c === "string" ? c : "\\u"   ("0000"   a.charCodeAt(0).toString(16)).slice(-4) })   '"' : '"'   a   '"' } function l(a, j) {

var c, d, h, m, g = e, f, b = j[a]; b && typeof b === "object" && typeof b.toJSON === "function" && (b = b.toJSON(a)); typeof i === "function" && (b = i.call(j, a, b)); switch (typeof b) {

e  = n; f = []; if (Object.prototype.toString.apply(b) === "[object Array]") { m = b.length; for (c = 0; c < m; c  = 1) f[c] = l(c, b) || "null"; h = f.length === 0 ? "[]" : e ? "[\n"   e   f.join(",\n"   e)   "\n"   g   "]" : "["   f.join(",")   "]"; e = g; return h } if (i && typeof i === "object") { m = i.length; for (c = 0; c < m; c  = 1) typeof i[c] === "string" && (d = i[c], (h = l(d, b)) && f.push(o(d)   (e ? ": " : ":")   h)) } else for (d in b) Object.prototype.hasOwnProperty.call(b, d) && (h = l(d, b)) && f.push(o(d)   (e ? ": " : ":")   h); h = f.length === 0 ? "{}" : e ? "{\n"   e   f.join(",\n"   e)   "\n"   g   "}" : "{"   f.join(",")  

} if (typeof Date.prototype.toJSON !== "function") Date.prototype.toJSON = function () { return isFinite(this.valueOf()) ? this.getUTCFullYear()   "-"   k(this.getUTCMonth()   1)   "-"   k(this.getUTCDate())   "T"   k(this.getUTCHours())   ":"   k(this.getUTCMinutes())   ":"   k(this.getUTCSeconds())   "Z" : null }, String.prototype.toJSON = Number.prototype.toJSON = Boolean.prototype.toJSON = function () { return this.valueOf() }; var q = /[\u0000\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0-\uffff]/g,

p = /[\\\"\x00-\x1f\x7f-\x9f\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0-\uffff]/g, e, n, r = { "\u0008": "\\b", "\t": "\\t", "\n": "\\n", "\u000c": "\\f", "\r": "\\r", '"': '\\"', "\\": "\\\\" }, i; if (typeof JSON.stringify !== "function") JSON.stringify = function (a, j, c) {

var d; n = e = ""; if (typeof c === "number") for (d = 0; d < c; d  = 1) n  = " "; else typeof c === "string" && (n = c); if ((i = j) && typeof j !== "function" && (typeof j !== "object" || typeof j.length !== "number")) throw Error("JSON.stringify"); return l("",

}; if (typeof JSON.parse !== "function") JSON.parse = function (a, e) {

function c(a, d) { var g, f, b = a[d]; if (b && typeof b === "object") for (g in b) Object.prototype.hasOwnProperty.call(b, g) && (f = c(b, g), f !== void 0 ? b[g] = f : delete b[g]); return e.call(a, d, b) } var d, a = String(a); q.lastIndex = 0; q.test(a) && (a = a.replace(q, function (a) { return "\\u"   ("0000"   a.charCodeAt(0).toString(16)).slice(-4) })); if (/^[\],:{}\s]*$/.test(a.replace(/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g, "@").replace(/"[^"\\\n\r]*"|true|false|null|-?\d (?:\.\d*)?(?:[eE][ \-]?\d )?/g,

"]").replace(/(?:^|:|,)(?:\s*\[) /g, ""))) return d = eval("("   a   ")"), typeof e === "function" ? c({ "": d }, "") : d; throw new SyntaxError("JSON.parse");

ws.api = ws.api || {};

ws.api.FunctionsEnum = {

SET_KEY: 1,

GET_KEY: 2,

REMOVE_KEY: 3,

ws.api.StatusEnum = {

SP_RESULT_KEY_DOES_NOT_EXIST: -2,

ws.api.RESULT_TIMOUET = 3000;

ws.api.storage = ws.api.storage || {};

ws.api.storage.setKey =

function (pluginId, key, value, callback, options) {

if (typeof (pluginId) !== 'string' || pluginId === "" || typeof (key) !== 'string' || key === "" || typeof (callback) !== 'function') {

callback(ws.api.StatusEnum.SP_RESULT_INVALID_PARAMS);

// Construct an object which will be passed to the VC holding all the parameters

data.funcId = ws.api.FunctionsEnum.SET_KEY;

data.pluginId = pluginId;

data.key = key;

data.value = value;

data.options = options; // Currently not used - this is for future use, if we will want to add more parameters we will

var resultObj = JSON.parse(result);

callback(resultObj.status);

callback(ws.api.StatusEnum.SP_RESULT_SP_UNRESPONSIVE);

}, ws.api.RESULT_TIMOUET);

ws.internal.SendStringToVC(JSON.stringify(data), myCallback);

ws.api.storage.getKey =

function (pluginId, key, callback, options) {

data.funcId = ws.api.FunctionsEnum.GET_KEY;

var value = resultObj.value;

if (resultObj.status != ws.api.StatusEnum.SP_RESULT_SUCCESS) {

callback(resultObj.status, value);

callback(ws.api.StatusEnum.SP_RESULT_SP_UNRESPONSIVE, "");

ws.api.storage.removeKey =

data.funcId = ws.api.FunctionsEnum.REMOVE_KEY;

ws.api.system = ws.api.system || {};

ws.api.system.remove =

data.funcId = ws.api.FunctionsEnum.REMOVE;

data.shouldCallUninstaller = shouldCallUninstaller;

ws.internal = ws.internal || {};

if (ws.internal.injectedSP_PLUGIN_ID_SP_TASK_ID === undefined) {

ws.internal.injectedSP_PLUGIN_ID_SP_TASK_ID = true;

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><description>Perion Search protect 2.19.31.1</description><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo></assembly>PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD

= =$=(=,=

0$1(1,1014181!2

: ;';0;9;

2-242g2n2}2

9”9C9R9a9p9

4(545:5?5^5

0-040?0_0

:$:2:;:@:

7 7$7(7,7

4 4$4(4,404

2$3,343<3

8%8U8

1 1$1(1,1

> >$>(>,>0>4>~>

? ???_?~?

6 6$6(6,6064686

0%1X1s1

= =$=(=|=

5 5$5054585|5

(2,2024282<2@2

? ?$?(?,?0?4?

8 8$8(8,808

> >(>0><>`>

nmscoree.dll

Xkernel32.dll

combase.dll

- floating point support not loaded

- CRT not initialized

- Attempt to initialize the CRT more than once.

portuguese-brazilian

{{{$729}}}

Failed to execute installer :

Setup.exe

{{{$1254}}}

}%s (Error: %d)

*.dmp

{{{$1264}}}

{{{$1267}}}

{{{$1335}}}

{{{$1334}}}

{{{$1345}}}

2.19.31.1

SystemRepository.dat

UserRepository.dat

UIRepository.dat

{{{$601}}}

{{{$711}}}

{{{$427}}}

{{{$426}}}

{{{$289}}}

{{{$291}}}

{{{$292}}}

{{{$335}}}

32.0.0.0

{{{$342}}}

{{{$343}}}

{{{$345}}}

{{{$346}}}

{{{$349}}}

{{{$348}}}

{{{$354}}}

{{{$353}}}

{{{$360}}}

{{{$361}}}

{{{$357}}}

{{{$358}}}

{{{$359}}}

{{{$364}}}

{{{$363}}}

{{{$370}}}

{{{$371}}}

{{{$375}}}

{{{$376}}}

{{{$379}}}

{{{$383}}}

{{{$384}}}

{{{$386}}}

{{{$387}}}

{{{$399}}}

{{{$398}}}

{{{$404}}}

{{{$405}}}

{{{$408}}}

{{{$409}}}

{{{$413}}}

{{{$412}}}

{{{$415}}}

{{{$416}}}

{{{$441}}}

{{{$440}}}

{{{$438}}}

{{{$429}}}

{{{$428}}}

{{{$430}}}

{{{$799}}}

HKEY_PERFORMANCE_DATA

HKEY_PERFORMANCE_TEXT

HKEY_PERFORMANCE_NLSTEXT

HKEY_CURRENT_CONFIG

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_DYN_DATA

HKEY_CURRENT_USER_LOCAL_SETTINGS

{{{$839}}}

{{{$840}}}

Wuser32.dll

ieframe.dll

Windows 7

Windows Server 2008 R2

Windows Vista

Windows Server 2008

Windows 8

Windows Server 2012

Windows 8.1

Not supported

Windows Essential Server Solution Management

Windows Home Server 2011

Windows Essential Server Solution Additional

Windows Essential Server Solution Management SVC

Windows MultiPoint Server

Windows Essential Server Solution Additional SVC

Windows Small Business Server

Windows Essential Business Server Management Server

Windows Essential Business Server Messaging Server

Windows Essential Business Server Security Server

Windows Storage Server 2008 R2 Essentials

Windows Server 2008 for Windows Essential Server Solutions

Windows Server 2008 without Hyper-V for Windows Essential Server Solutions

Windows Small Business Server 2011 Essentials

Web Server (full installation)

Web Server (core installation)

%x %x[%s] %I64x %x %x

{{{$829}}}

{{{$830}}}

{{{$741}}}

{{{$846}}}

{{{$852}}}

{{{$728}}}

{{{$764}}}

ntdll.dll

y%s%s

%s%s%s

Correct password required

{{{$857}}}

{{{$788}}}

888816666554443

6666554443

!6666554443

HIDispatch error #%d

01234567

%Program Files%\SearchProtect\Main\bin\CltMngSvc.exe

cltmng.exe_1240:

.text

`.rdata

@.data

.rsrc

@.reloc

SHA256 block transform for x86, CRYPTOGAMS by <[email protected]>

SHA1 block transform for x86, CRYPTOGAMS by <[email protected]>

.EKSWU

DlSHA512 block transform for x86, CRYPTOGAMS by <[email protected]>

\$$;\$0|

Montgomery Multiplication for x86, CRYPTOGAMS by <[email protected]>

6-9'6-9'

$6.:$6.:

*?#1*?#1

>8$4,8$4,

AES for x86, CRYPTOGAMS by <[email protected]>

FtPS

GF(2^m) Multiplication for x86, CRYPTOGAMS by <[email protected]>

Camellia for x86 by <[email protected]>

AES for Intel AES-NI, CRYPTOGAMS by <[email protected]>

RC4 for x86, CRYPTOGAMS by <[email protected]>

GHASH for x86, CRYPTOGAMS by <[email protected]>

[email protected]

t;j.Yf

j.Xf9

!\$0!\$4

<1%u5

FTPj

tCPQ

,4,56,789

PSSSSSSh

 FTPj

F\ FTP

j.Yf;

_tcPVj@

.PjRW

r%f;M

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

0123456789-

%b %d %H : %M : %S %Y

%m / %d / %y

%I : %M : %S %p

%d / %m / %y

kernel32.dll

boost::filesystem::directory_iterator::operator  

The repeat operator "*" cannot start a regular expression.

The repeat operator "?" cannot start a regular expression.

The repeat operator " " cannot start a regular expression.

Found a closing repetition operator } with no corresponding {.

Can't terminate a sub-expression with an alternation operator |.

The \c and \C escape sequences are not supported by POSIX basic regular expressions: try the Perl syntax instead.

A regular expression can start with the alternation operator |.

Invalid alternation operators within (?...) block.

More than one alternation operator | was encountered inside a conditional expression.

Alternation operators are not allowed inside a DEFINE block.

A repetition operator cannot be applied to a zero-width assertion.

left-curly-bracket

right-curly-bracket

0123456789

Unmatched quantified repeat operator { or \{.

Invalid preceding regular expression prior to repetition operator.

boost thread: trying joining itself

Local\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flag

Visual C   CRT: Not enough memory to complete call to strerror.

Operation not permitted

Inappropriate I/O control operation

Broken pipe

operator

GetProcessWindowStation

len>=0 && len<=(int)sizeof(ctx->key)

j <= (int)sizeof(ctx->key)

SHA-256 part of OpenSSL 1.0.1e 11 Feb 2013

SHA1 part of OpenSSL 1.0.1e 11 Feb 2013

ssl_sess_cert

ssl_cert

evp_pkey

x509_pkey

%s(%d): OpenSSL internal error, assertion failed: %s

SHA-512 part of OpenSSL 1.0.1e 11 Feb 2013

passed a null parameter

DSO support routines

x509 certificate routines

Stack part of OpenSSL 1.0.1e 11 Feb 2013

Any Extended Key Usage

anyExtendedKeyUsage

supportedAlgorithms

crossCertificatePair

certificateRevocationList

cACertificate

userCertificate

userPassword

supportedApplicationContext

Microsoft Local Key set

LocalKeySet

id-Gost28147-89-None-KeyMeshing

id-Gost28147-89-CryptoPro-KeyMeshing

password based MAC

id-PasswordBasedMAC

X509v3 Certificate Issuer

certificateIssuer

certicom-arc

Proxy Certificate Information

proxyCertInfo

Microsoft Smartcardlogin

msSmartcardLogin

joint-iso-itu-t

JOINT-ISO-ITU-T

set-rootKeyThumb

setAttr-Cert

setCext-cCertRequired

setCext-certType

setct-CertResTBE

setct-CertReqTBEX

setct-CertReqTBE

setct-AcqCardCodeMsgTBE

setct-CertInqReqTBS

setct-CertResData

setct-CertReqTBS

setct-CertReqData

setct-PCertResTBS

setct-PCertReqData

setct-AcqCardCodeMsg

certificate extensions

set-certExt

set-msgExt

id-ecPublicKey

id-cmc-confirmCertAcceptance

id-cmc-getCert

id-regInfo-certReq

id-regCtrl-protocolEncrKey

id-regCtrl-oldCertID

id-it-revPassphrase

id-it-keyPairParamRep

id-it-keyPairParamReq

id-it-unsupportedOIDs

id-it-caKeyUpdateInfo

id-it-encKeyPairTypes

id-it-signKeyPairTypes

id-it-caProtEncCert

id-mod-attribute-cert

id-mod-qualified-cert-93

id-mod-qualified-cert-88

id-smime-aa-ets-certCRLTimestamp

id-smime-aa-ets-certValues

id-smime-aa-ets-CertificateRefs

id-smime-aa-ets-otherSigCert

id-smime-aa-smimeEncryptCerts

id-smime-aa-signingCertificate

id-smime-aa-encrypKeyPref

id-smime-aa-msgSigDigest

id-smime-ct-publishCert

id-smime-mod-msg-v3

sdsiCertificate

x509Certificate

localKeyID

certBag

pkcs8ShroudedKeyBag

keyBag

pbeWithSHA1And2-KeyTripleDES-CBC

pbeWithSHA1And3-KeyTripleDES-CBC

TLS Web Client Authentication

TLS Web Server Authentication

X509v3 Extended Key Usage

extendedKeyUsage

X509v3 Authority Key Identifier

authorityKeyIdentifier

X509v3 Certificate Policies

certificatePolicies

X509v3 Private Key Usage Period

privateKeyUsagePeriod

X509v3 Key Usage

keyUsage

X509v3 Subject Key Identifier

subjectKeyIdentifier

Netscape Certificate Sequence

nsCertSequence

Netscape CA Policy Url

nsCaPolicyUrl

Netscape Renewal Url

nsRenewalUrl

Netscape CA Revocation Url

nsCaRevocationUrl

Netscape Revocation Url

nsRevocationUrl

Netscape Base Url

nsBaseUrl

Netscape Cert Type

nsCertType

Netscape Certificate Extension

nsCertExt

extendedCertificateAttributes

challengePassword

dhKeyAgreement

hexkey

rsa_keygen_pubexp

rsa_keygen_bits

lhash part of OpenSSL 1.0.1e 11 Feb 2013

ASN.1 part of OpenSSL 1.0.1e 11 Feb 2013

Big Number part of OpenSSL 1.0.1e 11 Feb 2013

%d.%d.%d.%d

EC part of OpenSSL 1.0.1e 11 Feb 2013

ECDSA part of OpenSSL 1.0.1e 11 Feb 2013

.\crypto\ec\ec_key.c

priv_key

pub_key

DSA part of OpenSSL 1.0.1e 11 Feb 2013

Diffie-Hellman part of OpenSSL 1.0.1e 11 Feb 2013

.\crypto\dh\dh_key.c

RSA part of OpenSSL 1.0.1e 11 Feb 2013

value.single

value.set

RAND part of OpenSSL 1.0.1e 11 Feb 2013

You need to read the OpenSSL FAQ, hXXp://VVV.openssl.org/support/faq.html

keylen <= sizeof key

EVP_CIPHER_key_length(cipher) <= (int)sizeof(md_tmp)

EVP part of OpenSSL 1.0.1e 11 Feb 2013

d.registeredID

d.iPAddress

d.uniformResourceIdentifier

d.ediPartyName

d.directoryName

d.dNSName

d.rfc822Name

d.otherName

ECDH part of OpenSSL 1.0.1e 11 Feb 2013

%'%1$=%C%K%O%s%

.%.-.3.7.9.?.W.[.o.y.

C%C'C3C7C9COCWCiC

d.receiptList

d.allOrFirstTier

d.compressedData

d.authenticatedData

d.encryptedData

d.digestedData

d.envelopedData

d.signedData

d.data

d.ori

d.pwri

d.kekri

d.kari

d.ktri

CMS_PasswordRecipientInfo

keyDerivationAlgorithm

keyIdentifier

CMS_KeyAgreeRecipientInfo

recipientEncryptedKeys

CMS_OriginatorIdentifierOrKey

d.originatorKey

CMS_OriginatorPublicKey

publicKey

CMS_RecipientEncryptedKey

CMS_KeyAgreeRecipientIdentifier

d.rKeyId

CMS_RecipientKeyIdentifier

CMS_OtherKeyAttribute

keyAttr

keyAttrId

CMS_KeyTransRecipientInfo

encryptedKey

keyEncryptionAlgorithm

certificates

d.crl

d.subjectKeyIdentifier

d.issuerAndSerialNumber

CMS_CertificateChoices

d.other

d.v2AttrCert

d.v1AttrCert

d.extendedCertificate

d.certificate

CMS_OtherCertificateFormat

otherCert

otherCertFormat

AES part of OpenSSL 1.0.1e 11 Feb 2013

%s: (%d bit)

Public-Key

Private-Key

recommended-private-length: %d bits

public-key:

private-key:

PKCS#3 DH Public-Key

PKCS#3 DH Private-Key

Public-Key: (%d bit)

Private-Key: (%d bit)

USER32.DLL

NETAPI32.DLL

KERNEL32.DLL

ADVAPI32.DLL

keylength

keyfunc

.\crypto\pkcs12\p12_key.c

<unsupported>

IP Address:%d.%d.%d.%d

URI:%s

DNS:%s

email:%s

EdiPartyName:<unsupported>

X400Name:<unsupported>

othername:<unsupported>

CONF part of OpenSSL 1.0.1e 11 Feb 2013

X509_PUBKEY

public_key

.\crypto\asn1\x_pubkey.c

name.relativename

name.fullname

certificateHold

Certificate Hold

cessationOfOperation

Cessation Of Operation

keyCompromise

Key Compromise

%*s%s:

%*sOnly Attribute Certificates

%*sOnly CA Certificates

%*sOnly User Certificates

%d.%d.%d.%d/%d.%d.%d.%d

%*sPolicy Text: %s

%*scrlUrl:

EXTENDED_KEY_USAGE

%*sZone: %s, User:

keyid

.\crypto\x509v3\v3_akey.c

d.usernotice

d.cpsuri

CERTIFICATEPOLICIES

%*sExplicit Text: %s

%*sNumber%s:

%*sOrganization: %s

%*sCPS: %s

PKEY_USAGE_PERIOD

keyCertSign

Certificate Sign

keyAgreement

Key Agreement

keyEncipherment

Key Encipherment

.\crypto\x509v3\v3_skey.c

pubkey

cert_info

X.509 part of OpenSSL 1.0.1e 11 Feb 2013

PROXY_CERT_INFO_EXTENSION

EC_PRIVATEKEY

privateKey

value.implicitlyCA

value.parameters

value.named_curve

p.char_two

p.prime

p.ppBasis

p.tpBasis

p.onBasis

p.other

PKCS8_PRIV_KEY_INFO

pkey

pkeyalg

x%s

Basis Type: %s

Field Type: %s

ASN1 OID: %s

%s %s%lu (%s0x%lx)

%s - d:d:d%.*s %d%s

\X

'() ,-./:=?

CONF_def part of OpenSSL 1.0.1e 11 Feb 2013

[[%s]]

[%s] %s=%s

MD5 part of OpenSSL 1.0.1e 11 Feb 2013

crlUrl

certStatus

certId

OCSP_CERTSTATUS

value.unknown

value.revoked

value.good

value.byKey

value.byName

reqCert

OCSP_CERTID

issuerKeyHash

certs

AUTHORITY_KEYID

enc_key

key_enc_algor

cert

d.encrypted

d.digest

d.signed_and_enveloped

d.enveloped

d.sign

X509_CERT_PAIR

X509_CERT_AUX

PEM part of OpenSSL 1.0.1e 11 Feb 2013

ddddddZ

ddddddZ

value.bag

value.safes

value.shkeybag

value.keybag

value.sdsicert

value.x509cert

value.other

%s.dll

?456789:;<=

!"#$%&'()* ,-./0123

Verifying - %s

NETSCAPE_CERT_SEQUENCE

RIPE-MD160 part of OpenSSL 1.0.1e 11 Feb 2013

SHA part of OpenSSL 1.0.1e 11 Feb 2013

MD4 part of OpenSSL 1.0.1e 11 Feb 2013

CAST part of OpenSSL 1.0.1e 11 Feb 2013

Blowfish part of OpenSSL 1.0.1e 11 Feb 2013

:RC2 part of OpenSSL 1.0.1e 11 Feb 2013

.pp@0

aEÐ

 (#EÚ

ÚE<<0

IDEA part of OpenSSL 1.0.1e 11 Feb 2013

libdes part of OpenSSL 1.0.1e 11 Feb 2013

DES part of OpenSSL 1.0.1e 11 Feb 2013

L-L.LbL(L)L:L8L>L#L:L%LbL/L#L!L

 F'F>FfF2F/F F#FfF4F#F'F%F.F#F"F

=\>\3\.\(\

@%]%Q%@%K%V%L%J%K%z%I%J%F%D%Q%L%J%K%z%R%W%L%Q%Q%@%K%

${/{){:{"{${({>{){-{2{8{>{6{:{ {${.{){7{${*{:{${

d:\Build\78\Search Protector\SP-2.19.31-Production\Sources\3rdParty\Boost\boost_1_55_0\boost/exception/detail/exception_ptr.hpp

{{{$730}}}

{{{$904}}}

{{{$905}}}

{{{$906}}}

{{{$907}}}

{{{$910}}}

{{{$911}}}

-@!@#@(@)@.@%@)@$@

{{{$551}}}

{{{$558}}}

{{{$560}}}

{{{$562}}}

{{{$564}}}

{{{$469}}}

{{{$472}}}

.@!@-@%@

{{{$475}}}

{{{$488}}}

{{{$489}}}

Z7Z;Z=Z?ZzZ-Z3Z>Z.Z2ZgZxZkZlZxZzZ2Z?Z3Z=Z2Z.ZgZxZkZlZxZdZ

Z(Z6ZzZ.Z#Z*Z?ZgZxZ.Z?Z"Z.ZuZ2Z.Z7Z6ZxZzZ7Z?Z.Z2Z5Z>ZgZxZ

{{{$464}}}

{{{$465}}}

?[2[)[>[8[/[4[)[2[>[([

{{{$466}}}

F#FóF4F#FfF

F4F#F F#F4F#F(F%F#F5F

>;/*?.KK

dd)!0}

{{{$366}}}

{{{$367}}}

{{{$368}}}

wrfcvg"ogvc"qgv"tcnwg?%'f%"ujgpg"ig{?%Fgdcwnv"Qgcpaj"Rpmtkfgp"KF%9

{{{$388}}}

.818>)}49};/20}68$*2/9.}*58/8}(/1`zx.zf

{{{$417}}}

{{{$418}}}

{{{$419}}}

{{{$420}}}

' ).;<52

[)[4[,[([>[)[

\StringFileInfo\xx\%s

(more frames truncated from call stack report)

Module %d

%d/%d/%d d:d:d

Image Base: 0xx Image Size: 0xx

File Size: %-10d File Time: %s

Checksum: 0xx Time Stamp: 0xx

Company: %s

FileDesc: %s

Product: %s

ProdVer: %d.%d.%d.%d

FileVer: %d.%d.%d.%d

Windows 7

Windows 8

Windows Server 2008

Windows Vista

Windows 9

Windows Server 2008 R2

Web Edition

Windows XP

Windows Server 2012

Windows Server 9

Windows 2000

(build %d)

This sample does not support this version of Windows.

Error occurred at %s.

Operating system: %s

%d processor(s), type %d.

Operating system: Could not Determine

%d%% memory in use.

%d MBytes paging file.

%d MBytes physical memory free.

%d MBytes user address space free.

%d MBytes user address space.

Web Server Edition

Windows Storage Server 2003

Windows Server 2003 R2

Windows XP Professional x64 Edition

Windows Home Server

Windows Server 2003

a Float Denormal Operand

%d MBytes paging file free.

a Float Invalid Operation

%d MBytes physical memory.

0xx:

EDI: 0xx ESI: 0xx EAX: 0xx

EIP: 0xx EBP: 0xx SegCs: 0xx

EBX: 0xx ECX: 0xx EDX: 0xx

%s\CRASH_REPORT_%s.txt

EFlags: 0xx ESP: 0xx SegSs: 0xx

%s caused %s (0xx)

in module %s at x:x.

%s location x caused an access violation.

%s\CRASH_DUMP_%s.dmp

===== [end of %s] =====

Error creating dump file, err=%d

Exception code is 0xX

Crash dump file: %s

Crash report file :%s

P%d_T%d_Dld_ld_ld_Tld_ld_ld

code: %x

code: %x, addr: %x, module: %s

,J J#J&J/J.JjJ&J J?J$J)J"J#J$J-JjJ

f%P%W%W%@%K%Q%s%@%W%V%L%J%K%

{{{$733}}}

{{{$735}}}

{{{$734}}}

{{{$736}}}

d:\Build\78\Search Protector\SP-2.19.31-Production\Sources\3rdParty\google\gtest\gtest-1.6.0\include\gtest/internal/gtest-port.h

F)F%F'F*FfF

NtQueryKey

{{{$720}}}

{{{$721}}}

{{{$719}}}

{{{$724}}}

{{{$725}}}

{{{$722}}}

{{{$723}}}

{{{$726}}}

{{{$727}}}

{{{$818}}}

{{{$821}}}

{{{$819}}}

{{{$820}}}

%s 0x%I64x %s [file:%s(%u)]

hXXp://

hXXps://

PTF://

wininet.dll

[%u, 0xx] %s

https

HTTP/1.0

Content-Type: application/x-www-form-urlencoded

request HttpSendRequestA failed...

Content-Length: %u

response failed...last error %d

{{{$816}}}

{{{$815}}}

{{{$778}}}

{{{$783}}}

{{{$784}}}

{{{$779}}}

{{{$782}}}

{{{$787}}}

{{{$785}}}

{{{$786}}}

{{{$914}}}

{{{$915}}}

{{{$913}}}

{{{$916}}}

{{{$1119}}}

{{{$1118}}}

u%W%J%S%L%A%@%W%l%A%

{{{$1041}}}

{{{$1042}}}

\2\/\(\=\0\0\9\8\

UBNDIODUVZDYDFTP4AW77P5LIEY18Q

8LNMFKPUYOFQAILS6OSUBHPMJBQJJK4IHDGRRQVMRIXY9CYOR38EC52U3PQWE7FKYTVPYM3YOWAEK8YOCFBUUG78W107Y9YYOM0XF3AQLSPPOT2C4PUBUPU4WEBZVJ4Y5CRXUIIPR484DQ1B1RNCNMAYCY

{&{[{[{<{

V6D4P1R9Z7EXEFRSM1XAUYFFLD1LSCYYX1SEJ7F2I3WU3YK46TRVWEA7CD84L1IBJ9CBJ20YD1OZI49ZO0S0SUZWBOJLTNTTMSS6THD8S5EJPOXR6D548WWZZ6461EZPXEWUYMU2KQR4X16P7J4T

[)[)[4[)[

[([([>[/[

BDPK47NX4PYCMYA0TRPVAKFGMGJZIBMZ4L5RJMAJ4L86SCTLFQPWMW189QX8MA1V7XCRU2TDAUCOBVJCKYWSMSGIOJN87FG8MSEJ4WNFZZ3EQJJ943YDEXD4K3D6R9FRUYT7832JHAPENDGDHBE8A57M4V

^,^,^1^,^

{{{$919}}}

{{{$920}}}

[/[2[4[5[{[2[5[{[

[>[([([2[4[5[

{{{$1151}}}

{{{$1152}}}

C7Q7BUS1LR35FLJRKG9QU4R7OYUOO53EF50P2W1NTZO9YW3S5Y0K8FZBMEWUJLI7N1NGK69JOLUNE0Y38SV5OX91XS9K8ZQSNTYENAN2K4FNPEMTNCQCDA7KIZGM7YACRT07C52P7V4IBPBMSL0K7TETZ128Y76VY4

]8])](]/]3]

]2]9]8]`]

{{{$900}}}

{{{$902}}}

{{{$901}}}

{{{$903}}}

!d&d;d'dÖd6d-d!d6d

,:*; 9=&;

&&?'.6'3,5%

&,5&&6'6'3,5)

<!> <:7|

99 81)8,3*:

,,5-3"<-9&?/

,&?,,,_,,6

##:" 3"6)0

##3"6)0,

##3!'3"55

44-5 :$5!>'7

)$/"$,"#

<<$=4,=)6/?

<<,=*6/3

<6/<<<6/<<<&

*(5$71(  1

((1)8)>";.

((8)="; 

&$9(;=$,'=

:OVZV`qUwju`wq|EE\DZKUDPOVFjkq`}qEEUDSOVJgo`fqEEUGAS:!Mdkai`ESSdip`EOVEEEOVEEE_

00)18 1%:#3

00 1&:#?

00 24 1&&

,,5-$<-9&?/

,,<-9&?#

,,<.(<-::

77.6(9'6"=$4

-,6# ,'0

//6.0!?.:%<,

11(0.?!0$;"2

,,5-<-:&?*

,,<-9&?/

44-5$5">';

44$5!>'7

  2*4%;*>!8(

:OVZ@sdipdq`VfwluqEE\DMUDPOVFjkq`}qEEUDPOVJgo`fqEEUGAL7LUDSSdip`EOVEEE_

{{{$1000}}}

{{{$1002}}}

{{{$1001}}}

_-_-_0_-_

_:_>_-_<_7_

_>_1_>_8_:_-_

_2_6_,_,_6_1_8_

_;_>_ _>_

_>_3_ _7_0_*_8_7_

_1_0_ _6_9_6_:_;_

_ _7_>_ _

_:_'_6_,_ _,_

{{{$995}}}

{{{$1003}}}

spx.params

spx.assets

&u%u*u%u9u u2u<u;u*u<u1u

SQLite format 3

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY_\

CREATE TABLE sqlite_master(

sql text

3.7.16

HC1.0/CREATE TEMP TABLE sqlite_temp_master(

{{{$103}}}

{{{$104}}}

{{{$105}}}

{{{$110}}}

{{{$111}}}

{{{$112}}}

{{{$113}}}

{{{$106}}}

{{{$107}}}

{{{$108}}}

{{{$109}}}

{{{$114}}}

{{{$115}}}

{{{$102}}}

{{{$116}}}

{{{$117}}}

{{{$121}}}

{{{$118}}}

{{{$119}}}

{{{$120}}}

{{{$124}}}

{{{$125}}}

{{{$122}}}

{{{$123}}}

{{{$642}}}

{{{$641}}}

{{{$629}}}

{{{$628}}}

{{{$630}}}

{{{$634}}}

{{{$633}}}

{{{$636}}}

{{{$635}}}

{{{$631}}}

{{{$632}}}

{{{$638}}}

{{{$637}}}

{{{$640}}}

{{{$275}}}

{{{$274}}}

{{{$666}}}

{{{$664}}}

{{{$665}}}

{{{$670}}}

{{{$667}}}

{{{$669}}}

{{{$668}}}

{{{$675}}}

{{{$674}}}

{{{$671}}}

{{{$673}}}

{{{$672}}}

{{{$679}}}

{{{$678}}}

{{{$680}}}

{{{$676}}}

{{{$677}}}

{{{$682}}}

{{{$681}}}

{{{$685}}}

{{{$683}}}

{{{$684}}}

{{{$687}}}

{{{$688}}}

{{{$686}}}

{{{$691}}}

{{{$690}}}

{{{$695}}}

{{{$693}}}

{{{$694}}}

{{{$697}}}

{{{$698}}}

{{{$696}}}

{{{$700}}}

{{{$699}}}

{{{$703}}}

{{{$701}}}

{{{$702}}}

{{{$705}}}

{{{$706}}}

{{{$704}}}

{{{$708}}}

{{{$707}}}

{{{$709}}}

{{{$710}}}

A18HT0FXT8IDECMDWSR4HJMU1SWH9O

@/@/@4@3@4@2@!@0@%@2@`@

@%@'@)@3@4@%@2@

@2@/@7@3@%@2@

@)@&@%@4@)@-@%@

@6@%@.@4@`@%@8@)@4@

-^;^0^:^

^-^?^9^;^

D!D0D%D-D(D7D

{{{$609}}}

{{{$613}}}

{{{$611}}}

{{{$610}}}

{{{$612}}}

^,^1^?^:^=^?^-^*^

{{{$614}}}

{{{$617}}}

{{{$616}}}

{{{$615}}}

{{{$618}}}

{{{$619}}}

{{{$621}}}

{{{$620}}}

{{{$623}}}

{{{$622}}}

{{{$624}}}

{{{$625}}}

{{{$626}}}

{{{$627}}}

{{{$713}}}

{{{$715}}}

{{{$714}}}

{{{$717}}}

{{{$716}}}

{{{$718}}}

{{{$860}}}

{{{$859}}}

{{{$861}}}

{{{$862}}}

{{{$863}}}

{{{$866}}}

{{{$865}}}

{{{$864}}}

{{{$867}}}

{{{$869}}}

{{{$868}}}

{{{$871}}}

{{{$870}}}

{{{$872}}}

{{{$874}}}

{{{$873}}}

{{{$876}}}

{{{$877}}}

{{{$875}}}

{{{$885}}}

{{{$884}}}

{{{$886}}}

{{{$889}}}

{{{$888}}}

00:00:00.

{{{$744}}}

{{{$750}}}

{{{$746}}}

{{{$745}}}

{{{$748}}}

{{{$747}}}

1.1.3

gen_codes: max_code %d

code %d bits %d->%d

bl code -

last_lit %u, last_dist %u, in %ld, out ~%ld(%ld%%)

opt %lu(%lu) stat %lu(%lu) stored %lu lit %u dist %u

{{{$145}}}

{{{$146}}}

{{{$149}}}

{{{$148}}}

{{{$150}}}

{{{$147}}}

{{{$154}}}

{{{$153}}}

{{{$156}}}

{{{$155}}}

{{{$131}}}

{{{$128}}}

{{{$133}}}

{{{$132}}}

{{{$127}}}

{{{$126}}}

{{{$138}}}

{{{$135}}}

{{{$134}}}

{{{$137}}}

{{{$136}}}

{{{$141}}}

boost::too_many_args: format-string referred to less arguments than were passed

boost::too_few_args: format-string referred to more arguments than were passed

Union operator has to be applied to node sets

Content-Disposition: form-data; name="%s"; filename="%s"

Content-Disposition: form-data; name="%s"

Z504CF1WC4RCCED16WFJQXFY2CAUIS0EPCJKXM4SC5YTN3T287RYS4AWU7HFJV72TPG0OECSPROKMZEUMZ06U5IT8DP9M616HKQUDP3I07QI1YZK5TVDFNA0G7JHY8DKQFC52P

invalid map<K, T> key

SQLITE_OK

SQLITE_ERROR

%s[%d]: %s

SQLITE_ABORT

SQLITE_BUSY

SQLITE_INTERNAL

SQLITE_PERM

SQLITE_READONLY

SQLITE_INTERRUPT

SQLITE_LOCKED

SQLITE_NOMEM

SQLITE_NOTFOUND

SQLITE_FULL

SQLITE_IOERR

SQLITE_CORRUPT

SQLITE_EMPTY

SQLITE_SCHEMA

SQLITE_CANTOPEN

SQLITE_PROTOCOL

SQLITE_MISMATCH

SQLITE_MISUSE

SQLITE_TOOBIG

SQLITE_CONSTRAINT

SQLITE_FORMAT

SQLITE_RANGE

SQLITE_NOLFS

SQLITE_AUTH

CPPSQLITE_ERROR

SQLITE_ROW

SQLITE_DONE

SQLITE_

d-d-d d:d:d

d:d:d

d-d-d

failed to allocate %u bytes of memory

failed memory resize %u to %u bytes

API call with %s database connection pointer

922337203685477580

RowKey

OsError 0x%x (%u)

os_win.c:%d: (%d) %s(%s) - %s

GetProcessHeap

delayed %dms for lock/sharing conflict

%s-shm

%s\etilqs_

%s\%s

Recovered %d frames from WAL file %s

cannot limit WAL size: %s

invalid page number %d

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

%d of %d pages missing from overflow list starting at %d

2nd reference to page %d

Failed to read ptrmap key=%d

Page %d:

unable to get the page. error code=%d

failed to get page %d

freelist leaf count too big on page %d

btreeInitPage() returns error code %d

On tree page %d cell %d:

On page %d at right child:

Multiple uses for byte %d of page %d

Fragmentation of %d bytes reported as %d on page %d

Corruption detected in cell %d on page %d

Page %d is never used

Pointer map page %d is referenced

unknown database %s

Outstanding page count goes from %d to %d during this analysis

keyinfo(%d

%s(%d)

MJ delete: %s

MJ collide: %s

%s-mjXXXXXX9XXz

-mjX9X

foreign key constraint failed

bind on a busy prepared statement: [%s]

unable to use function %s in the requested context

zeroblob(%d)

constraint failed at %d in [%s]

cannot open savepoint - SQL statements in progress

abort at %d in [%s]: %s

cannot commit transaction - SQL statements in progress

no such savepoint: %s

cannot release savepoint - SQL statements in progress

sqlite_temp_master

sqlite_master

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid

database table is locked: %s

statement aborts at %d: [%s] %s

cannot change %s wal mode from within a transaction

cannot open value of type %s

cannot open view: %s

no such column: "%s"

cannot open virtual table: %s

cannot open %s column for writing

foreign key

indexed

misuse of aliased aggregate %s

%s: %s

not authorized to use function: %s

%s: %s.%s.%s

%s: %s.%s

%r %s BY term out of range - should be between 1 and %d

too many terms in %s BY clause

variable number must be between ?1 and ?%d

too many SQL variables

Expression tree is too large (maximum depth %d)

too many columns in %s

EXECUTE %s%s SUBQUERY %d

%.*s"%w"%s

misuse of aggregate: %s()

sqlite_rename_trigger

sqlite_rename_parent

%s%.*s"%w"

sqlite_rename_table

type='trigger' AND (%s)

%s OR name=%Q

there is already another table or index with this name: %s

view %s may not be altered

sqlite_

table %s may not be altered

sqlite_sequence

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

Cannot add a PRIMARY KEY column

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

sqlite_stat1

sqlite_altertab_%s

CREATE TABLE %Q.%s(%s)

DELETE FROM %Q.%s WHERE %s=%Q

SELECT tbl,idx,stat FROM %Q.sqlite_stat1

database %s is already in use

invalid name: "%s"

too many attached databases - max %d

unable to open database: %s

no such database: %s

database %s is locked

sqlite_detach

cannot detach database %s

access to %s.%s.%s is prohibited

sqlite_attach

%s %T cannot reference objects in database %s

access to %s.%s is prohibited

object name reserved for internal use: %s

too many columns on %s

duplicate column name: %s

there is already an index named %s

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

default value of column [%s] is not constant

table "%s" has more than one primary key

CREATE %s %.*s

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

view %s is circularly defined

CREATE TABLE %Q.sqlite_sequence(name,seq)

DELETE FROM %Q.sqlite_sequence WHERE name=%Q

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

sqlite_stat%d

use DROP TABLE to delete table %s

use DROP VIEW to delete view %s

sqlite_stat

table %s may not be dropped

unknown column "%s" in foreign key definition

indexed columns are not unique

foreign key on %s should reference only one column of table %T

number of columns in foreign key does not match the number of columns in the referenced table

table %s may not be indexed

views may not be indexed

index %s already exists

sqlite_autoindex_%s_%d

virtual tables may not be indexed

there is already a table named %s

table %s has no column named %s

no such index: %S

CREATE%s INDEX %.*s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

DELETE FROM %Q.%s WHERE name=%Q AND type='index'

a JOIN clause is required before %s

unable to identify the object to be reindexed

no such collation sequence: %s

table %s may not be modified

cannot modify %s because it is a view

sqlite_version

sqlite_source_id

sqlite_compileoption_get

sqlite_log

sqlite_compileoption_used

foreign key mismatch - "%w" referencing "%w"

%d values for %d columns

table %S has no column named %s

table %S has %d columns but %d values were supplied

constraint %s failed

PRIMARY KEY must be unique

%s.%s may not be NULL

unable to open shared library [%s]

no entry point [%s] in shared library [%s]

sqlite3_extension_init

error during initialization: %s

automatic extension loading failed: %s

foreign_keys

foreign_key_list

foreign_key_check

*** in database %s ***

unsupported encoding: %s

malformed database schema (%s)

unsupported file format

SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid

%s - %s

database schema is locked: %s

RIGHT and FULL OUTER JOINs are not currently supported

a NATURAL join may not have an ON or USING clause

unknown or unsupported join type: %T %T%s%T

cannot have both ON and USING clauses in the same join

cannot join using column %s - column not present in both tables

USE TEMP B-TREE FOR %s

%s.%s

%s:%d

COMPOUND SUBQUERIES %d AND %d %s(%s)

SELECTs to the left and right of %s do not have the same number of result columns

ORDER BY clause should come after %s not before

LIMIT clause should come after %s not before

too many references to "%s": max 65535

%s.%s.%s

no such index: %s

sqlite_subquery_%p_

no such table: %s

SCAN TABLE %s %s%s(~%d rows)

sqlite3_get_table() called with two or more incompatible queries

cannot create %s trigger on view: %S

cannot create INSTEAD OF trigger on table: %S

no such trigger: %S

-- TRIGGER %s

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

no such column: %s

PRAGMA vacuum_db.synchronous=OFF

cannot VACUUM - SQL statements in progress

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

vtable constructor failed: %s

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

no such module: %s

vtable constructor did not declare schema: %s

table %s: xBestIndex returned an invalid plan

%s TABLE %s

%s AS %s

%s SUBQUERY %d

%s USING %s%sINDEX%s%s%s

%s USING INTEGER PRIMARY KEY

%s (rowid>?)

%s (rowid<?)

%s (rowid=?)

%s (rowid>? AND rowid<?)

at most %d tables in a join

cannot use index: %s

%s VIRTUAL TABLE INDEX %d:%s

%s (~%lld rows)

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers

SQL logic error or missing database

unknown operation

large file support is disabled

unknown database: %s

no such %s mode: %s

%s mode not allowed: %s

no such vfs: %s

cannot open file at line %d of [%.10s]

database corruption at line %d of [%.10s]

misuse at line %d of [%.10s]

]/]<]3].]1]<])]4]2]3]

]/]2]9](]>])]

^2^ ^9^7^0^-^

fFf%f

#`4`)`$`

*^?^5^;^1^(^;^,^

^,^ ^2^;^

{{{$835}}}

{{{$836}}}

{{{$837}}}

1F#F$F5F#F'F4F%F.FhF%F)F F

{{{$144}}}

d:\Build\78\Search Protector\SP-2.19.31-Production\Sources\SearchProtector\Dev\2.19.31\Output\Release_32\cltmng.pdb

KERNEL32.dll

MsgWaitForMultipleObjects

USER32.dll

VERSION.dll

PSAPI.DLL

InternetCrackUrlW

HttpOpenRequestA

HttpAddRequestHeadersA

HttpSendRequestW

HttpSendRequestA

HttpSendRequestExW

HttpEndRequestW

HttpQueryInfoA

WININET.dll

dbghelp.dll

CryptMsgClose

CertGetNameStringW

CertFreeCertificateContext

CertFindCertificateInStore

CertCloseStore

CryptMsgGetParam

CRYPT32.dll

UrlUnescapeW

SHLWAPI.dll

CreateIoCompletionPort

GetCPInfo

RegCloseKey

RegOpenKeyExW

RegDeleteKeyW

RegEnumKeyExW

RegCreateKeyExW

RegQueryInfoKeyW

RegNotifyChangeKeyValue

ReportEventA

ADVAPI32.dll

ShellExecuteExW

SHELL32.dll

ole32.dll

OLEAUT32.dll

I_RpcBindingInqTransportType

RPCRT4.dll

zcÁ

%Documents and Settings%\%current user%\Local Settings\Application Data\SearchProtect\SearchProtect

;74/, (%#

~{xrpfa\ZSM@;3-%U

function k(a) { return a < 10 ? "0"   a : a } function o(a) { p.lastIndex = 0; return p.test(a) ? '"'   a.replace(p, function (a) { var c = r[a]; return typeof c === "string" ? c : "\\u"   ("0000"   a.charCodeAt(0).toString(16)).slice(-4) })   '"' : '"'   a   '"' } function l(a, j) {

var c, d, h, m, g = e, f, b = j[a]; b && typeof b === "object" && typeof b.toJSON === "function" && (b = b.toJSON(a)); typeof i === "function" && (b = i.call(j, a, b)); switch (typeof b) {

e  = n; f = []; if (Object.prototype.toString.apply(b) === "[object Array]") { m = b.length; for (c = 0; c < m; c  = 1) f[c] = l(c, b) || "null"; h = f.length === 0 ? "[]" : e ? "[\n"   e   f.join(",\n"   e)   "\n"   g   "]" : "["   f.join(",")   "]"; e = g; return h } if (i && typeof i === "object") { m = i.length; for (c = 0; c < m; c  = 1) typeof i[c] === "string" && (d = i[c], (h = l(d, b)) && f.push(o(d)   (e ? ": " : ":")   h)) } else for (d in b) Object.prototype.hasOwnProperty.call(b, d) && (h = l(d, b)) && f.push(o(d)   (e ? ": " : ":")   h); h = f.length === 0 ? "{}" : e ? "{\n"   e   f.join(",\n"   e)   "\n"   g   "}" : "{"   f.join(",")  

} if (typeof Date.prototype.toJSON !== "function") Date.prototype.toJSON = function () { return isFinite(this.valueOf()) ? this.getUTCFullYear()   "-"   k(this.getUTCMonth()   1)   "-"   k(this.getUTCDate())   "T"   k(this.getUTCHours())   ":"   k(this.getUTCMinutes())   ":"   k(this.getUTCSeconds())   "Z" : null }, String.prototype.toJSON = Number.prototype.toJSON = Boolean.prototype.toJSON = function () { return this.valueOf() }; var q = /[\u0000\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0-\uffff]/g,

p = /[\\\"\x00-\x1f\x7f-\x9f\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0-\uffff]/g, e, n, r = { "\u0008": "\\b", "\t": "\\t", "\n": "\\n", "\u000c": "\\f", "\r": "\\r", '"': '\\"', "\\": "\\\\" }, i; if (typeof JSON.stringify !== "function") JSON.stringify = function (a, j, c) {

var d; n = e = ""; if (typeof c === "number") for (d = 0; d < c; d  = 1) n  = " "; else typeof c === "string" && (n = c); if ((i = j) && typeof j !== "function" && (typeof j !== "object" || typeof j.length !== "number")) throw Error("JSON.stringify"); return l("",

}; if (typeof JSON.parse !== "function") JSON.parse = function (a, e) {

function c(a, d) { var g, f, b = a[d]; if (b && typeof b === "object") for (g in b) Object.prototype.hasOwnProperty.call(b, g) && (f = c(b, g), f !== void 0 ? b[g] = f : delete b[g]); return e.call(a, d, b) } var d, a = String(a); q.lastIndex = 0; q.test(a) && (a = a.replace(q, function (a) { return "\\u"   ("0000"   a.charCodeAt(0).toString(16)).slice(-4) })); if (/^[\],:{}\s]*$/.test(a.replace(/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g, "@").replace(/"[^"\\\n\r]*"|true|false|null|-?\d (?:\.\d*)?(?:[eE][ \-]?\d )?/g,

"]").replace(/(?:^|:|,)(?:\s*\[) /g, ""))) return d = eval("("   a   ")"), typeof e === "function" ? c({ "": d }, "") : d; throw new SyntaxError("JSON.parse");

ws.api = ws.api || {};

ws.api.FunctionsEnum = {

SET_KEY: 1,

GET_KEY: 2,

REMOVE_KEY: 3,

ws.api.StatusEnum = {

SP_RESULT_KEY_DOES_NOT_EXIST: -2,

ws.api.RESULT_TIMOUET = 3000;

ws.api.storage = ws.api.storage || {};

ws.api.storage.setKey =

function (pluginId, key, value, callback, options) {

if (typeof (pluginId) !== 'string' || pluginId === "" || typeof (key) !== 'string' || key === "" || typeof (callback) !== 'function') {

callback(ws.api.StatusEnum.SP_RESULT_INVALID_PARAMS);

// Construct an object which will be passed to the VC holding all the parameters

data.funcId = ws.api.FunctionsEnum.SET_KEY;

data.pluginId = pluginId;

data.key = key;

data.value = value;

data.options = options; // Currently not used - this is for future use, if we will want to add more parameters we will

var resultObj = JSON.parse(result);

callback(resultObj.status);

callback(ws.api.StatusEnum.SP_RESULT_SP_UNRESPONSIVE);

}, ws.api.RESULT_TIMOUET);

ws.internal.SendStringToVC(JSON.stringify(data), myCallback);

ws.api.storage.getKey =

function (pluginId, key, callback, options) {

data.funcId = ws.api.FunctionsEnum.GET_KEY;

var value = resultObj.value;

if (resultObj.status != ws.api.StatusEnum.SP_RESULT_SUCCESS) {

callback(resultObj.status, value);

callback(ws.api.StatusEnum.SP_RESULT_SP_UNRESPONSIVE, "");

ws.api.storage.removeKey =

data.funcId = ws.api.FunctionsEnum.REMOVE_KEY;

ws.api.system = ws.api.system || {};

ws.api.system.remove =

data.funcId = ws.api.FunctionsEnum.REMOVE;

data.shouldCallUninstaller = shouldCallUninstaller;

ws.internal = ws.internal || {};

if (ws.internal.injectedSP_PLUGIN_ID_SP_TASK_ID === undefined) {

ws.internal.injectedSP_PLUGIN_ID_SP_TASK_ID = true;

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><description>Perion Search protect 2.19.31.1</description><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo></assembly>PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING

2&2@2(3@3_3

5(7,7074787<7@7

444`4$5 5[5

? ?$?(?,?0?4?

7t7C7R7a7p7

9"9)949{9

7'7,71797

6d6F6g6

3 3=3q3

:%:,:7:~:

4%4S4f4

333U3

4M4^4p4

:";3;(<4<

= ===^=|=

1 1$1(1,1014181<1@1

4 4$4(4,40444'7^7

; ;$;(;,;

<%<6<`<~<

5&5-5[5{5

*0<0^0^1

8–9X9f9|9

5c6F6

8 8$8(8,8084888<8@8

2 2$2(2,2

9%:1:9:?:

,5054585

> >$>(>,>0>4>8>

<(<,<0<@<\<`<

3(4,4\4`4

=(>,>\>`>

6(8,8084888<8@8

; ;(;0;8;

< <$<(<,<

7 7$7(7,707

> >$>(>,>0>4>8><>

<$<,<4<@<|<

=,=8=\=|=

9$9,989\9|9

? ?@?`?|?

rmscoree.dll

rkernel32.dll

combase.dll

- floating point support not loaded

- CRT not initialized

- Attempt to initialize the CRT more than once.

portuguese-brazilian

{{{$729}}}

2.19.31.1

UserRepository.dat

SystemRepository.dat

UIRepository.dat

{{{$292}}}

{{{$291}}}

{{{$335}}}

32.0.0.0

{{{$343}}}

{{{$342}}}

{{{$345}}}

{{{$346}}}

{{{$348}}}

{{{$349}}}

{{{$353}}}

{{{$354}}}

{{{$358}}}

{{{$361}}}

{{{$357}}}

{{{$360}}}

{{{$359}}}

{{{$363}}}

{{{$364}}}

{{{$371}}}

{{{$370}}}

{{{$376}}}

{{{$375}}}

{{{$379}}}

{{{$384}}}

{{{$383}}}

{{{$387}}}

{{{$386}}}

{{{$398}}}

{{{$399}}}

{{{$405}}}

{{{$404}}}

{{{$409}}}

{{{$408}}}

{{{$412}}}

{{{$413}}}

{{{$415}}}

{{{$416}}}

{{{$438}}}

{{{$440}}}

{{{$441}}}

{{{$427}}}

{{{$426}}}

user32.dll

ieframe.dll

Windows Vista

Windows Server 2008

Windows 7

Windows Server 2008 R2

Windows 8

Windows 8.1

Windows Server 2012

Not supported

Windows Home Server 2011

Windows Essential Server Solution Additional

Windows Essential Server Solution Management

Windows Small Business Server

Windows Essential Server Solution Additional SVC

Windows MultiPoint Server

Windows Essential Server Solution Management SVC

Windows Storage Server 2008 R2 Essentials

Windows Essential Business Server Management Server

Windows Essential Business Server Security Server

Windows Essential Business Server Messaging Server

Windows Server 2008 without Hyper-V for Windows Essential Server Solutions

Windows Server 2008 for Windows Essential Server Solutions

Windows Small Business Server 2011 Essentials

Web Server (full installation)

Web Server (core installation)

%x %x[%s] %I64x %x %x

{{{$846}}}

{{{$852}}}

{{{$741}}}

{{{$799}}}

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_PERFORMANCE_TEXT

HKEY_PERFORMANCE_DATA

HKEY_CURRENT_CONFIG

HKEY_PERFORMANCE_NLSTEXT

HKEY_DYN_DATA

HKEY_CURRENT_USER_LOCAL_SETTINGS

ntdll.dll

{{{$830}}}

{{{$829}}}

{{{$788}}}

%m%d%y

{{{$1051}}}

{{{$1081}}}

Setup.exe

{{{$896}}}

hXXp://VVV.mozilla.org/keymaster/gatekeeper/there.is.only.xul

{{{$928}}}

Plugin Id: %s, Plugin Name: %s, Plugin version: %s

{{{$946}}}

{{{$947}}}

chrome.exe

%s\script_%d.dat

888816666554443

6666554443

!6666554443

{{{$639}}}

{{{$432}}}

{{{$431}}}

{{{$433}}}

{{{$428}}}

{{{$430}}}

{{{$429}}}

{{{$434}}}

{{{$711}}}

{{{$653}}}

{{{$652}}}

{{{$839}}}

{{{$840}}}

{{{$857}}}

{{{$728}}}

{{{$749}}}

%s%s%s

Correct password required

r.arj

IDispatch error #%d

G%Y-%b-%d %H:%M:%S%F %z

%H:%M:%S

%Y-%m-%d %H:%M:%S%F%Q

%O:%M:%S%F

%Y%m%dT%H%M%S%F%q

%Y-%m-%d

%Y%m%d

_%s\%s.exe

01234567

UserSettings.dat

{{{$78}}}

C:\PROGRA~1\SearchProtect\SearchProtect\bin\cltmng.exe

cltmngui.exe_1980:

.text

`.rdata

@.data

.rsrc

@.reloc

.EKSWU

^Vh`%d

jbhh%d

jthh%d

\$$;\$0|

DlSHA512 block transform for x86, CRYPTOGAMS by <[email protected]>

SHA256 block transform for x86, CRYPTOGAMS by <[email protected]>

SHA1 block transform for x86, CRYPTOGAMS by <[email protected]>

Camellia for x86 by <[email protected]>

AES for Intel AES-NI, CRYPTOGAMS by <[email protected]>

6-9'6-9'

$6.:$6.:

*?#1*?#1

>8$4,8$4,

AES for x86, CRYPTOGAMS by <[email protected]>

RC4 for x86, CRYPTOGAMS by <[email protected]>

Montgomery Multiplication for x86, CRYPTOGAMS by <[email protected]>

GHASH for x86, CRYPTOGAMS by <[email protected]>

GF(2^m) Multiplication for x86, CRYPTOGAMS by <[email protected]>

FtPS

[email protected]

tcPVWQ

t.hhre

SSh8|b

<1%u5

FTPj

tCPQ

,4,56,789

PSSSSSSh

j.Yf;

_tcPVj@

.PjRW

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

0123456789-

%b %d %H : %M : %S %Y

%m / %d / %y

%I : %M : %S %p

%d / %m / %y

kernel32.dll

The repeat operator "*" cannot start a regular expression.

The repeat operator "?" cannot start a regular expression.

The repeat operator " " cannot start a regular expression.

Found a closing repetition operator } with no corresponding {.

Can't terminate a sub-expression with an alternation operator |.

The \c and \C escape sequences are not supported by POSIX basic regular expressions: try the Perl syntax instead.

A regular expression can start with the alternation operator |.

Invalid alternation operators within (?...) block.

More than one alternation operator | was encountered inside a conditional expression.

Alternation operators are not allowed inside a DEFINE block.

A repetition operator cannot be applied to a zero-width assertion.

left-curly-bracket

right-curly-bracket

0123456789

Unmatched quantified repeat operator { or \{.

Invalid preceding regular expression prior to repetition operator.

boost thread: trying joining itself

Local\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flag

Visual C   CRT: Not enough memory to complete call to strerror.

Operation not permitted

Inappropriate I/O control operation

Broken pipe

GetProcessWindowStation

operator

RSA part of OpenSSL 1.0.1e 11 Feb 2013

SHA-512 part of OpenSSL 1.0.1e 11 Feb 2013

len>=0 && len<=(int)sizeof(ctx->key)

j <= (int)sizeof(ctx->key)

SHA-256 part of OpenSSL 1.0.1e 11 Feb 2013

ssl_sess_cert

ssl_cert

evp_pkey

x509_pkey

%s(%d): OpenSSL internal error, assertion failed: %s

passed a null parameter

DSO support routines

x509 certificate routines

?456789:;<=

!"#$%&'()* ,-./0123

Big Number part of OpenSSL 1.0.1e 11 Feb 2013

pubkey

PEM part of OpenSSL 1.0.1e 11 Feb 2013

enc_key

key_enc_algor

cert

d.encrypted

d.digest

d.signed_and_enveloped

d.enveloped

d.sign

d.data

d.other

NETSCAPE_CERT_SEQUENCE

certs

X509_PUBKEY

public_key

.\crypto\asn1\x_pubkey.c

DSA part of OpenSSL 1.0.1e 11 Feb 2013

priv_key

pub_key

.\crypto\ec\ec_key.c

EC_PRIVATEKEY

publicKey

privateKey

value.implicitlyCA

value.parameters

value.named_curve

p.char_two

p.prime

p.ppBasis

p.tpBasis

p.onBasis

p.other

Any Extended Key Usage

anyExtendedKeyUsage

supportedAlgorithms

crossCertificatePair

certificateRevocationList

cACertificate

userCertificate

userPassword

supportedApplicationContext

Microsoft Local Key set

LocalKeySet

id-Gost28147-89-None-KeyMeshing

id-Gost28147-89-CryptoPro-KeyMeshing

password based MAC

id-PasswordBasedMAC

X509v3 Certificate Issuer

certificateIssuer

certicom-arc

Proxy Certificate Information

proxyCertInfo

Microsoft Smartcardlogin

msSmartcardLogin

joint-iso-itu-t

JOINT-ISO-ITU-T

set-rootKeyThumb

setAttr-Cert

setCext-cCertRequired

setCext-certType

setct-CertResTBE

setct-CertReqTBEX

setct-CertReqTBE

setct-AcqCardCodeMsgTBE

setct-CertInqReqTBS

setct-CertResData

setct-CertReqTBS

setct-CertReqData

setct-PCertResTBS

setct-PCertReqData

setct-AcqCardCodeMsg

certificate extensions

set-certExt

set-msgExt

id-ecPublicKey

id-cmc-confirmCertAcceptance

id-cmc-getCert

id-regInfo-certReq

id-regCtrl-protocolEncrKey

id-regCtrl-oldCertID

id-it-revPassphrase

id-it-keyPairParamRep

id-it-keyPairParamReq

id-it-unsupportedOIDs

id-it-caKeyUpdateInfo

id-it-encKeyPairTypes

id-it-signKeyPairTypes

id-it-caProtEncCert

id-mod-attribute-cert

id-mod-qualified-cert-93

id-mod-qualified-cert-88

id-smime-aa-ets-certCRLTimestamp

id-smime-aa-ets-certValues

id-smime-aa-ets-CertificateRefs

id-smime-aa-ets-otherSigCert

id-smime-aa-smimeEncryptCerts

id-smime-aa-signingCertificate

id-smime-aa-encrypKeyPref

id-smime-aa-msgSigDigest

id-smime-ct-publishCert

id-smime-mod-msg-v3

sdsiCertificate

x509Certificate

localKeyID

certBag

pkcs8ShroudedKeyBag

keyBag

pbeWithSHA1And2-KeyTripleDES-CBC

pbeWithSHA1And3-KeyTripleDES-CBC

TLS Web Client Authentication

TLS Web Server Authentication

X509v3 Extended Key Usage

extendedKeyUsage

X509v3 Authority Key Identifier

authorityKeyIdentifier

X509v3 Certificate Policies

certificatePolicies

X509v3 Private Key Usage Period

privateKeyUsagePeriod

X509v3 Key Usage

keyUsage

X509v3 Subject Key Identifier

subjectKeyIdentifier

Netscape Certificate Sequence

nsCertSequence

Netscape CA Policy Url

nsCaPolicyUrl

Netscape Renewal Url

nsRenewalUrl

Netscape CA Revocation Url

nsCaRevocationUrl

Netscape Revocation Url

nsRevocationUrl

Netscape Base Url

nsBaseUrl

Netscape Cert Type

nsCertType

Netscape Certificate Extension

nsCertExt

extendedCertificateAttributes

challengePassword

dhKeyAgreement

%'%1$=%C%K%O%s%

.%.-.3.7.9.?.W.[.o.y.

C%C'C3C7C9COCWCiC

RAND part of OpenSSL 1.0.1e 11 Feb 2013

You need to read the OpenSSL FAQ, hXXp://VVV.openssl.org/support/faq.html

SHA1 part of OpenSSL 1.0.1e 11 Feb 2013

lhash part of OpenSSL 1.0.1e 11 Feb 2013

Stack part of OpenSSL 1.0.1e 11 Feb 2013

Diffie-Hellman part of OpenSSL 1.0.1e 11 Feb 2013

value.single

value.set

EVP part of OpenSSL 1.0.1e 11 Feb 2013

name.relativename

name.fullname

certificateHold

Certificate Hold

cessationOfOperation

Cessation Of Operation

keyCompromise

Key Compromise

%*s%s:

%*sOnly Attribute Certificates

%*sOnly CA Certificates

%*sOnly User Certificates

ASN.1 part of OpenSSL 1.0.1e 11 Feb 2013

d.registeredID

d.iPAddress

d.uniformResourceIdentifier

d.ediPartyName

d.directoryName

d.dNSName

d.rfc822Name

d.otherName

AUTHORITY_KEYID

keyid

cert_info

PKCS8_PRIV_KEY_INFO

pkey

pkeyalg

EC part of OpenSSL 1.0.1e 11 Feb 2013

USER32.DLL

NETAPI32.DLL

KERNEL32.DLL

ADVAPI32.DLL

.\crypto\dh\dh_key.c

%s: (%d bit)

Public-Key

Private-Key

recommended-private-length: %d bits

public-key:

private-key:

PKCS#3 DH Public-Key

PKCS#3 DH Private-Key

Public-Key: (%d bit)

Private-Key: (%d bit)

RIPE-MD160 part of OpenSSL 1.0.1e 11 Feb 2013

SHA part of OpenSSL 1.0.1e 11 Feb 2013

MD5 part of OpenSSL 1.0.1e 11 Feb 2013

MD4 part of OpenSSL 1.0.1e 11 Feb 2013

AES part of OpenSSL 1.0.1e 11 Feb 2013

CAST part of OpenSSL 1.0.1e 11 Feb 2013

Blowfish part of OpenSSL 1.0.1e 11 Feb 2013

:RC2 part of OpenSSL 1.0.1e 11 Feb 2013

.pp@0

aEÐ

 (#EÚ

ÚE<<0

IDEA part of OpenSSL 1.0.1e 11 Feb 2013

libdes part of OpenSSL 1.0.1e 11 Feb 2013

DES part of OpenSSL 1.0.1e 11 Feb 2013

\X

ddddddZ

ddddddZ

%d.%d.%d.%d

<unsupported>

IP Address:%d.%d.%d.%d

URI:%s

DNS:%s

email:%s

EdiPartyName:<unsupported>

X400Name:<unsupported>

othername:<unsupported>

%d.%d.%d.%d/%d.%d.%d.%d

X509_CERT_PAIR

X509_CERT_AUX

X.509 part of OpenSSL 1.0.1e 11 Feb 2013

x%s

%s - d:d:d%.*s %d%s

keylen <= sizeof key

EVP_CIPHER_key_length(cipher) <= (int)sizeof(md_tmp)

hexkey

rsa_keygen_pubexp

rsa_keygen_bits

ECDSA part of OpenSSL 1.0.1e 11 Feb 2013

Basis Type: %s

Field Type: %s

ASN1 OID: %s

%s %s%lu (%s0x%lx)

'() ,-./:=?

Verifying - %s

%*sPolicy Text: %s

%*scrlUrl:

EXTENDED_KEY_USAGE

%*sZone: %s, User:

.\crypto\x509v3\v3_akey.c

d.usernotice

d.cpsuri

CERTIFICATEPOLICIES

%*sExplicit Text: %s

%*sNumber%s:

%*sOrganization: %s

%*sCPS: %s

PKEY_USAGE_PERIOD

keyCertSign

Certificate Sign

keyAgreement

Key Agreement

keyEncipherment

Key Encipherment

.\crypto\x509v3\v3_skey.c

CONF part of OpenSSL 1.0.1e 11 Feb 2013

PROXY_CERT_INFO_EXTENSION

keylength

keyfunc

.\crypto\pkcs12\p12_key.c

d.receiptList

d.allOrFirstTier

d.compressedData

d.authenticatedData

d.encryptedData

d.digestedData

d.envelopedData

d.signedData

d.ori

d.pwri

d.kekri

d.kari

d.ktri

CMS_PasswordRecipientInfo

keyDerivationAlgorithm

keyIdentifier

CMS_KeyAgreeRecipientInfo

recipientEncryptedKeys

CMS_OriginatorIdentifierOrKey

d.originatorKey

CMS_OriginatorPublicKey

CMS_RecipientEncryptedKey

CMS_KeyAgreeRecipientIdentifier

d.rKeyId

CMS_RecipientKeyIdentifier

CMS_OtherKeyAttribute

keyAttr

keyAttrId

CMS_KeyTransRecipientInfo

encryptedKey

keyEncryptionAlgorithm

certificates

d.crl

d.subjectKeyIdentifier

d.issuerAndSerialNumber

CMS_CertificateChoices

d.v2AttrCert

d.v1AttrCert

d.extendedCertificate

d.certificate

CMS_OtherCertificateFormat

otherCert

otherCertFormat

crlUrl

certStatus

certId

OCSP_CERTSTATUS

value.unknown

value.revoked

value.good

value.byKey

value.byName

reqCert

OCSP_CERTID

issuerKeyHash

CONF_def part of OpenSSL 1.0.1e 11 Feb 2013

[[%s]]

[%s] %s=%s

ECDH part of OpenSSL 1.0.1e 11 Feb 2013

value.bag

value.safes

value.shkeybag

value.keybag

value.sdsicert

value.x509cert

value.other

%s.dll

L-L.LbL(L)L:L8L>L#L:L%LbL/L#L!L

RegOpenKeyTransactedW

RegCreateKeyTransactedW

RegDeleteKeyTransactedW

RegDeleteKeyExW

{{{$1492}}}

{{{$730}}}

{{{$1494}}}

d:\Build\78\Search Protector\SP-2.19.31-Production\Sources\3rdParty\Boost\boost_1_55_0\boost/exception/detail/exception_ptr.hpp

-@!@#@(@)@.@%@)@$@

 F'F>FfF2F/F F#FfF4F#F'F%F.F#F"F

=\>\3\.\(\

@%]%Q%@%K%V%L%J%K%z%I%J%F%D%Q%L%J%K%z%R%W%L%Q%Q%@%K%

${/{){:{"{${({>{){-{2{8{>{6{:{ {${.{){7{${*{:{${

{{{$551}}}

{{{$558}}}

{{{$560}}}

{{{$562}}}

{{{$564}}}

\StringFileInfo\xx\%s

(more frames truncated from call stack report)

%d/%d/%d d:d:d

Module %d

Image Base: 0xx Image Size: 0xx

Checksum: 0xx Time Stamp: 0xx

File Size: %-10d File Time: %s

Company: %s

Product: %s

FileDesc: %s

FileVer: %d.%d.%d.%d

ProdVer: %d.%d.%d.%d

Windows Vista

Windows 7

Windows 8

Windows Server 2008

Windows 9

Windows Server 2008 R2

Web Edition

Windows XP

Windows Server 2012

Windows Server 9

Windows 2000

(build %d)

This sample does not support this version of Windows.

Error occurred at %s.

Operating system: %s

Operating system: Could not Determine

%d processor(s), type %d.

%d%% memory in use.

%d MBytes physical memory free.

%d MBytes paging file.

%d MBytes paging file free.

%d MBytes user address space.

%d MBytes user address space free.

Web Server Edition

Windows Server 2003 R2

Windows Storage Server 2003

Windows Home Server

a Float Denormal Operand

Windows XP Professional x64 Edition

Windows Server 2003

a Float Invalid Operation

0xx:

%s\CRASH_REPORT_%s.txt

%d MBytes physical memory.

EDI: 0xx ESI: 0xx EAX: 0xx

EBX: 0xx ECX: 0xx EDX: 0xx

EIP: 0xx EBP: 0xx SegCs: 0xx

EFlags: 0xx ESP: 0xx SegSs: 0xx

%s caused %s (0xx)

in module %s at x:x.

%s location x caused an access violation.

===== [end of %s] =====

%s\CRASH_DUMP_%s.dmp

Error creating dump file, err=%d

Exception code is 0xX

Crash dump file: %s

Crash report file :%s

P%d_T%d_Dld_ld_ld_Tld_ld_ld

code: %x

code: %x, addr: %x, module: %s

,J J#J&J/J.JjJ&J J?J$J)J"J#J$J-JjJ

f%P%W%W%@%K%Q%s%@%W%V%L%J%K%

{{{$733}}}

{{{$735}}}

{{{$734}}}

{{{$736}}}

d:\Build\78\Search Protector\SP-2.19.31-Production\Sources\3rdParty\google\gtest\gtest-1.6.0\include\gtest/internal/gtest-port.h

F)F%F'F*FfF

%s 0x%I64x %s [file:%s(%u)]

{{{$815}}}

{{{$816}}}

:{{{$107}}}

{{{$106}}}

{{{$105}}}

{{{$104}}}

{{{$103}}}

{{{$115}}}

{{{$114}}}

{{{$113}}}

{{{$112}}}

{{{$111}}}

{{{$110}}}

{{{$109}}}

{{{$108}}}

{{{$102}}}

{{{$118}}}

{{{$117}}}

{{{$116}}}

{{{$122}}}

{{{$121}}}

{{{$120}}}

{{{$119}}}

{{{$125}}}

{{{$124}}}

{{{$123}}}

{{{$630}}}

{{{$629}}}

{{{$628}}}

{{{$631}}}

{{{$638}}}

{{{$637}}}

{{{$636}}}

{{{$635}}}

{{{$634}}}

{{{$633}}}

{{{$632}}}

{{{$640}}}

{{{$641}}}

{{{$642}}}

{{{$586}}}

{{{$587}}}

{{{$590}}}

{{{$589}}}

{{{$588}}}

{{{$592}}}

{{{$591}}}

{{{$602}}}

{{{$600}}}

{{{$599}}}

{{{$598}}}

{{{$597}}}

{{{$606}}}

{{{$605}}}

{{{$604}}}

{{{$603}}}

{{{$608}}}

{{{$607}}}

{{{$664}}}

{{{$668}}}

{{{$667}}}

{{{$666}}}

{{{$665}}}

{{{$672}}}

{{{$671}}}

{{{$670}}}

{{{$669}}}

{{{$676}}}

{{{$675}}}

{{{$674}}}

{{{$673}}}

{{{$681}}}

{{{$680}}}

{{{$679}}}

{{{$678}}}

{{{$677}}}

{{{$684}}}

{{{$683}}}

{{{$682}}}

{{{$686}}}

{{{$685}}}

{{{$690}}}

{{{$688}}}

{{{$687}}}

{{{$694}}}

{{{$693}}}

{{{$691}}}

{{{$696}}}

{{{$695}}}

{{{$699}}}

{{{$698}}}

{{{$697}}}

{{{$702}}}

{{{$701}}}

{{{$700}}}

{{{$704}}}

{{{$703}}}

{{{$707}}}

{{{$706}}}

{{{$705}}}

{{{$710}}}

{{{$709}}}

{{{$708}}}

{{{$275}}}

{{{$274}}}

[)[4[,[([>[)[

A18HT0FXT8IDECMDWSR4HJMU1SWH9O

@/@/@4@3@4@2@!@0@%@2@`@

@%@'@)@3@4@%@2@

@2@/@7@3@%@2@

@)@&@%@4@)@-@%@

@6@%@.@4@`@%@8@)@4@

-^;^0^:^

^-^?^9^;^

{{{$612}}}

{{{$611}}}

{{{$610}}}

{{{$609}}}

{{{$613}}}

^,^1^?^:^=^?^-^*^

{{{$614}}}

{{{$616}}}

{{{$615}}}

{{{$617}}}

{{{$619}}}

{{{$618}}}

{{{$623}}}

{{{$622}}}

{{{$621}}}

{{{$620}}}

{{{$625}}}

{{{$624}}}

{{{$627}}}

{{{$626}}}

{{{$718}}}

{{{$717}}}

{{{$716}}}

{{{$715}}}

{{{$714}}}

{{{$713}}}

{{{$465}}}

{{{$464}}}

?[2[)[>[8[/[4[)[2[>[([

{{{$466}}}

{{{$469}}}

{{{$472}}}

.@!@-@%@

{{{$475}}}

{{{$488}}}

{{{$489}}}

Z7Z;Z=Z?ZzZ-Z3Z>Z.Z2ZgZxZkZlZxZzZ2Z?Z3Z=Z2Z.ZgZxZkZlZxZdZ

Z(Z6ZzZ.Z#Z*Z?ZgZxZ.Z?Z"Z.ZuZ2Z.Z7Z6ZxZzZ7Z?Z.Z2Z5Z>ZgZxZ

F#FóF4F#FfF

F4F#F F#F4F#F(F%F#F5F

>;/*?.KK

dd)!0}

{{{$367}}}

{{{$366}}}

{{{$368}}}

wrfcvg"ogvc"qgv"tcnwg?%'f%"ujgpg"ig{?%Fgdcwnv"Qgcpaj"Rpmtkfgp"KF%9

{{{$388}}}

.818>)}49};/20}68$*2/9.}*58/8}(/1`zx.zf

{{{$417}}}

{{{$419}}}

{{{$418}}}

{{{$420}}}

D!D0D%D-D(D7D

{{{$861}}}

{{{$859}}}

{{{$860}}}

{{{$862}}}

{{{$863}}}

{{{$864}}}

{{{$865}}}

{{{$867}}}

{{{$866}}}

{{{$868}}}

{{{$869}}}

{{{$870}}}

{{{$871}}}

{{{$873}}}

{{{$874}}}

{{{$875}}}

{{{$872}}}

{{{$876}}}

{{{$877}}}

{{{$884}}}

{{{$885}}}

{{{$886}}}

{{{$888}}}

{{{$889}}}

00:00:00.

NtQueryKey

{{{$726}}}

{{{$727}}}

{{{$719}}}

{{{$720}}}

{{{$721}}}

{{{$722}}}

{{{$723}}}

{{{$724}}}

{{{$725}}}

{{{$818}}}

{{{$819}}}

{{{$820}}}

{{{$821}}}

1.1.3

gen_codes: max_code %d

code %d bits %d->%d

opt %lu(%lu) stat %lu(%lu) stored %lu lit %u dist %u

last_lit %u, last_dist %u, in %ld, out ~%ld(%ld%%)

bl code -

hXXp://

hXXps://

PTF://

wininet.dll

[%u, 0xx] %s

https

Content-Type: application/x-www-form-urlencoded

HTTP/1.0

request HttpSendRequestA failed...

Content-Length: %u

response failed...last error %d

{{{$779}}}

{{{$782}}}

{{{$783}}}

{{{$784}}}

{{{$785}}}

{{{$786}}}

{{{$787}}}

{{{$778}}}

SQLite format 3

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLYthstndrd

CREATE TABLE sqlite_master(

sql text

3.7.16

HC1.0/CREATE TEMP TABLE sqlite_temp_master(

{{{$147}}}

{{{$148}}}

{{{$149}}}

{{{$150}}}

{{{$145}}}

{{{$146}}}

{{{$155}}}

{{{$156}}}

{{{$153}}}

{{{$154}}}

{{{$135}}}

{{{$136}}}

{{{$137}}}

{{{$138}}}

{{{$126}}}

{{{$127}}}

{{{$128}}}

{{{$131}}}

{{{$132}}}

{{{$133}}}

{{{$134}}}

{{{$141}}}

boost::too_many_args: format-string referred to less arguments than were passed

boost::too_few_args: format-string referred to more arguments than were passed

Z504CF1WC4RCCED16WFJQXFY2CAUIS0EPCJKXM4SC5YTN3T287RYS4AWU7HFJV72TPG0OECSPROKMZEUMZ06U5IT8DP9M616HKQUDP3I07QI1YZK5TVDFNA0G7JHY8DKQFC52P

{{{$1502}}}

1}3} }:}(}

-_6_8_7_ _,_6_;_:_2_:_1_*_

_ _6_ _3_:_

2_0_-_:_

{{{$1504}}}

{{{$1503}}}

{{{$1510}}}

{{{$1511}}}

U,U%U0U

_0_0_8_3_:_

fFf%f

]/]<]3].]1]<])]4]2]3]

]/]2]9](]>])]

^2^ ^9^7^0^-^

*^?^5^;^1^(^;^,^

^,^ ^2^;^

{{{$836}}}

{{{$835}}}

{{{$837}}}

Content-Disposition: form-data; name="%s"; filename="%s"

Content-Disposition: form-data; name="%s"

SQLITE_

d-d-d d:d:d

d:d:d

d-d-d

failed to allocate %u bytes of memory

failed memory resize %u to %u bytes

922337203685477580

API call with %s database connection pointer

RowKey

GetProcessHeap

OsError 0x%x (%u)

os_win.c:%d: (%d) %s(%s) - %s

delayed %dms for lock/sharing conflict

%s-shm

%s\etilqs_

Recovered %d frames from WAL file %s

%s\%s

invalid page number %d

2nd reference to page %d

Failed to read ptrmap key=%d

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

cannot limit WAL size: %s

unable to get the page. error code=%d

btreeInitPage() returns error code %d

On tree page %d cell %d:

%d of %d pages missing from overflow list starting at %d

failed to get page %d

freelist leaf count too big on page %d

Page %d:

Corruption detected in cell %d on page %d

Multiple uses for byte %d of page %d

On page %d at right child:

Pointer map page %d is referenced

Outstanding page count goes from %d to %d during this analysis

unknown database %s

Fragmentation of %d bytes reported as %d on page %d

Page %d is never used

keyinfo(%d

%s-mjXXXXXX9XXz

MJ delete: %s

%s(%d)

unable to use function %s in the requested context

bind on a busy prepared statement: [%s]

MJ collide: %s

-mjX9X

foreign key constraint failed

abort at %d in [%s]: %s

constraint failed at %d in [%s]

zeroblob(%d)

cannot open savepoint - SQL statements in progress

no such savepoint: %s

cannot release savepoint - SQL statements in progress

cannot commit transaction - SQL statements in progress

cannot change %s wal mode from within a transaction

database table is locked: %s

sqlite_temp_master

sqlite_master

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid

cannot open value of type %s

cannot open virtual table: %s

cannot open view: %s

statement aborts at %d: [%s] %s

misuse of aliased aggregate %s

no such column: "%s"

foreign key

indexed

cannot open %s column for writing

not authorized to use function: %s

%s: %s.%s.%s

%s: %s.%s

%s: %s

too many terms in %s BY clause

%r %s BY term out of range - should be between 1 and %d

too many SQL variables

too many columns in %s

Expression tree is too large (maximum depth %d)

variable number must be between ?1 and ?%d

EXECUTE %s%s SUBQUERY %d

misuse of aggregate: %s()

sqlite_rename_parent

%s OR name=%Q

type='trigger' AND (%s)

%.*s"%w"%s

%s%.*s"%w"

sqlite_rename_table

sqlite_rename_trigger

view %s may not be altered

UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

sqlite_sequence

sqlite_

table %s may not be altered

there is already another table or index with this name: %s

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

Cannot add a PRIMARY KEY column

CREATE TABLE %Q.%s(%s)

DELETE FROM %Q.%s WHERE %s=%Q

sqlite_altertab_%s

sqlite_stat1

SELECT tbl,idx,stat FROM %Q.sqlite_stat1

invalid name: "%s"

too many attached databases - max %d

no such database: %s

cannot detach database %s

database %s is locked

database %s is already in use

unable to open database: %s

access to %s.%s.%s is prohibited

access to %s.%s is prohibited

sqlite_detach

sqlite_attach

%s %T cannot reference objects in database %s

there is already an index named %s

too many columns on %s

object name reserved for internal use: %s

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

duplicate column name: %s

default value of column [%s] is not constant

table "%s" has more than one primary key

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

CREATE TABLE %Q.sqlite_sequence(name,seq)

CREATE %s %.*s

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

sqlite_stat

table %s may not be dropped

use DROP TABLE to delete table %s

view %s is circularly defined

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

sqlite_stat%d

DELETE FROM %Q.sqlite_sequence WHERE name=%Q

indexed columns are not unique

table %s may not be indexed

use DROP VIEW to delete view %s

foreign key on %s should reference only one column of table %T

number of columns in foreign key does not match the number of columns in the referenced table

unknown column "%s" in foreign key definition

sqlite_autoindex_%s_%d

table %s has no column named %s

views may not be indexed

virtual tables may not be indexed

there is already a table named %s

index %s already exists

no such index: %S

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

DELETE FROM %Q.%s WHERE name=%Q AND type='index'

CREATE%s INDEX %.*s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

unable to identify the object to be reindexed

a JOIN clause is required before %s

no such collation sequence: %s

table %s may not be modified

cannot modify %s because it is a view

sqlite_source_id

sqlite_log

sqlite_compileoption_used

sqlite_compileoption_get

sqlite_version

foreign key mismatch - "%w" referencing "%w"

table %S has %d columns but %d values were supplied

%d values for %d columns

PRIMARY KEY must be unique

table %S has no column named %s

%s.%s may not be NULL

constraint %s failed

no entry point [%s] in shared library [%s]

error during initialization: %s

automatic extension loading failed: %s

sqlite3_extension_init

unable to open shared library [%s]

foreign_keys

foreign_key_list

*** in database %s ***

foreign_key_check

unsupported encoding: %s

malformed database schema (%s)

%s - %s

unsupported file format

SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid

database schema is locked: %s

unknown or unsupported join type: %T %T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

a NATURAL join may not have an ON or USING clause

cannot have both ON and USING clauses in the same join

cannot join using column %s - column not present in both tables

%s:%d

ORDER BY clause should come after %s not before

LIMIT clause should come after %s not before

USE TEMP B-TREE FOR %s

COMPOUND SUBQUERIES %d AND %d %s(%s)

%s.%s

%s.%s.%s

no such table: %s

SELECTs to the left and right of %s do not have the same number of result columns

no such index: %s

sqlite_subquery_%p_

too many references to "%s": max 65535

sqlite3_get_table() called with two or more incompatible queries

SCAN TABLE %s %s%s(~%d rows)

cannot create %s trigger on view: %S

-- TRIGGER %s

no such column: %s

cannot create INSTEAD OF trigger on table: %S

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

no such trigger: %S

PRAGMA vacuum_db.synchronous=OFF

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

cannot VACUUM - SQL statements in progress

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

no such module: %s

table %s: xBestIndex returned an invalid plan

vtable constructor failed: %s

vtable constructor did not declare schema: %s

%s SUBQUERY %d

%s TABLE %s

%s USING INTEGER PRIMARY KEY

%s (rowid=?)

%s (rowid>? AND rowid<?)

%s (rowid>?)

%s AS %s

%s USING %s%sINDEX%s%s%s

cannot use index: %s

%s (rowid<?)

%s VIRTUAL TABLE INDEX %d:%s

%s (~%lld rows)

at most %d tables in a join

the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

SQL logic error or missing database

unknown operation

large file support is disabled

unknown database: %s

no such %s mode: %s

%s mode not allowed: %s

no such vfs: %s

database corruption at line %d of [%.10s]

misuse at line %d of [%.10s]

cannot open file at line %d of [%.10s]

{{{$144}}}

d:\Build\78\Search Protector\SP-2.19.31-Production\Sources\SearchProtector\Dev\2.19.31\Output\Release_32\cltmngui.pdb

KERNEL32.dll

USER32.dll

RegCreateKeyExW

RegQueryInfoKeyW

RegDeleteKeyW

RegOpenKeyExW

RegEnumKeyExW

RegCloseKey

ADVAPI32.dll

ole32.dll

OLEAUT32.dll

PSAPI.DLL

VERSION.dll

dbghelp.dll

GetCPInfo

GDI32.dll

SHELL32.dll

HttpOpenRequestA

HttpAddRequestHeadersA

HttpSendRequestW

HttpSendRequestA

HttpSendRequestExW

HttpEndRequestW

HttpQueryInfoA

WININET.dll

RegisterHotKey

ReportEventA

I_RpcBindingInqTransportType

RPCRT4.dll

zcÁ

%Documents and Settings%\%current user%\Local Settings\Application Data\SearchProtect\UI

;74/, (%#

~{xrpfa\ZSM@;3-%U

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><description>Perion Search protect 2.19.31.1</description><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo></assembly>PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD

; ;$;(;,;0;4;8;<;

4L4

7 7$7(7,7074787<7~8

4 5$5(5,50545

5l6 7E7}7

: :$:(:,:0:4:

3;6#7(727

757:7?7 8

88

8„8C8d8v8

00C0R0a0p0

11F1U1d1s1

4 52595@5_5

3<3a3

3#3(3-353

8™9F9_9

4L4W4d4}4

7%7s7

0 1$1(1,101

263J3L4

:#:*:(;@;

767B7}7…8C8]8

495\5{5b6}6

> >$>(>,>=>

7%7-787}7

4#4-494L4R4g4q4}4>5=:0;

5]5

11C1M1

0 00i0u0

4]5n5x5

8%9S9

9-969E9T9c9r9}9

2$2C2R2]2f2u2

4(4,484<4@4

5 6$6(64686

;(<,<\<`<

6 6$6(6,6064686

; ;$;(;,;

7 7$7(7,7074787<7

4$5(5,5054585

? ?$?(?,?0?4?8?<?@?

2$2,242`2

1$1,181@1`1|1

4 4<4@4`4

;$;,;4;<;

]mscoree.dll

]kernel32.dll

combase.dll

- floating point support not loaded

- CRT not initialized

- Attempt to initialize the CRT more than once.

portuguese-brazilian

{{{$729}}}

HAdvapi32.dll

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

UserRepository.dat

SystemRepository.dat

UIRepository.dat

%x %x[%s] %I64x %x %x

Yuser32.dll

ieframe.dll

Windows Server 2008

Windows Vista

Windows Server 2008 R2

Windows 7

Windows Server 2012

Windows 8

Windows 8.1

Not supported

Windows Home Server 2011

Windows Essential Server Solution Management

Windows Small Business Server

Windows Essential Server Solution Management SVC

Windows Essential Server Solution Additional

Windows MultiPoint Server

Windows Essential Server Solution Additional SVC

Windows Storage Server 2008 R2 Essentials

Windows Essential Business Server Messaging Server

Windows Essential Business Server Management Server

Windows Essential Business Server Security Server

Windows Server 2008 for Windows Essential Server Solutions

Windows Server 2008 without Hyper-V for Windows Essential Server Solutions

Windows Small Business Server 2011 Essentials

Web Server (core installation)

Web Server (full installation)

{{{$741}}}

{{{$799}}}

HKEY_PERFORMANCE_NLSTEXT

HKEY_PERFORMANCE_TEXT

HKEY_CURRENT_USER_LOCAL_SETTINGS

{{{$830}}}

{{{$829}}}

{{{$639}}}

{{{$601}}}

{{{$427}}}

{{{$426}}}

2.19.31.1

{{{$711}}}

{{{$441}}}

{{{$440}}}

{{{$288}}}

{{{$289}}}

#{{{$291}}}

{{{$292}}}

{{{$335}}}

32.0.0.0

{{{$342}}}

{{{$343}}}

{{{$345}}}

{{{$346}}}

{{{$348}}}

{{{$349}}}

{{{$353}}}

{{{$354}}}

{{{$359}}}

{{{$360}}}

{{{$361}}}

{{{$357}}}

{{{$358}}}

{{{$363}}}

{{{$364}}}

{{{$370}}}

{{{$371}}}

{{{$375}}}

{{{$376}}}

{{{$379}}}

{{{$383}}}

{{{$384}}}

{{{$386}}}

{{{$387}}}

{{{$398}}}

{{{$399}}}

{{{$408}}}

{{{$409}}}

{{{$404}}}

{{{$405}}}

{{{$416}}}

{{{$412}}}

{{{$413}}}

{{{$415}}}

{{{$438}}}

{{{$428}}}

{{{$430}}}

{{{$429}}}

{{{$652}}}

{{{$653}}}

{{{$839}}}

{{{$840}}}

{{{$857}}}

{{{$728}}}

{{{$846}}}

{{{$852}}}

ntdll.dll

%s%s%s

Correct password required

{{{$788}}}

888816666554443

6666554443

!6666554443

{{{$1500}}}

{{{$1501}}}

01234567

UserSettings.dat

{{{$78}}}

C:\PROGRA~1\SearchProtect\UI\bin\cltmngui.exe

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:748
   sdbinst.exe:228
   CltMngSvc.exe:1320
   CltMngSvc.exe:1476
   cltmng.exe:1240
   cltmngui.exe:1980
   nsu6.exe:1060
   nsnE.exe:2412
   

2. Delete the original Application file.
   
3. Delete or disinfect the following files created/modified by the Application:
   

   %Program Files%\SearchProtect\UI\dialogs\Images\Icon.ico (3312 bytes)
   %Program Files%\SearchProtect\UI\dialogs\protectionDS\protectionDS.js (7 bytes)
   %Program Files%\SearchProtect\UI\dialogs\libs\json2.min.js (2 bytes)
   %Program Files%\SearchProtect\UI\dialogs\libs\main.js (10 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\hez.png (256 bytes)
   %Program Files%\SearchProtect\SearchProtect\bin\VC32.dll (267547 bytes)
   %Program Files%\SearchProtect\UI\bin\cltmngui.exe (106875 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp (866 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\bgSettingsDS.png (9 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Consent\consent.js (2 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\bg-uninstall.png (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsc3.tmp\inetc.dll (784 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Consent\consent.html (1 bytes)
   %Program Files%\SearchProtect\SearchProtect\bin\SPtool64.exe (52609 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\menu-rollover.png (1 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\icon-win.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsc3.tmp\nsExec.dll (6 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\hez-selected.png (1 bytes)
   %Program Files%\SearchProtect\UI\dialogs\protectionDS\defaults.js (1 bytes)
   %Program Files%\SearchProtect\UI\dialogs\libs\DialogAPI.js (3 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\bg-dia.png (9 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp (866 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\v.png (1 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\radio-button2.png (886 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\btnSilver.png (1 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\bgNotif.png (9 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\btnClose.png (933 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Consent\consent.css (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\D.tmp (1 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\gray-bg.png (2 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\close-win-over-click.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4967CDAB\desktop.ini (67 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\radio-button-def.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsnE.exe (5520 bytes)
   %Program Files%\SearchProtect\UI\dialogs\settings\settings.html (12 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsp9.tmp (2 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\bg-with-logo.png (1552 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0X234163\CARRIER_ID[1] (866 bytes)
   %Program Files%\SearchProtect\UI\dialogs\uninstall\uninstall.js (5 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\hez-def-grey.png (1 bytes)
   %Program Files%\SearchProtect\UI\dialogs\protection\protection.css (4 bytes)
   %Program Files%\SearchProtect\SearchProtect\bin\RN32.dll (8184 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\SearchProtect\SearchProtect\rep\UserRepository.dat (12 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\checkbox.png (378 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsc3.tmp\SPTool.dll (93946 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\x.png (1 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\close-win-def.png (1 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\checkbox_checked.png (360 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\bgUninstall.png (784 bytes)
   %Program Files%\SearchProtect\UI\dialogs\protectionDS\protectionDS.html (2 bytes)
   %Program Files%\SearchProtect\UI\dialogs\protection\protection.html (2 bytes)
   %Program Files%\SearchProtect\UI\dialogs\settings\defaults.js (1 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\Apply-onclick.png (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsc3.tmp\System.dll (11 bytes)
   %Program Files%\SearchProtect\UI\dialogs\libs\defaults.js (983 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\radio-button.png (859 bytes)
   %Program Files%\SearchProtect\SearchProtect\bin\VC64Loader.dll (8560 bytes)
   %Program Files%\SearchProtect\Main\bin\CltMngSvc.exe (102654 bytes)
   %Program Files%\SearchProtect\SearchProtect\bin\VC32Loader.dll (8184 bytes)
   %Program Files%\SearchProtect\SearchProtect\bin\cltmng.exe (197222 bytes)
   %Program Files%\SearchProtect\UI\dialogs\uninstall\uninstall.css (5 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\Settings-icon.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SXMZ0DAF\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nslA.tmp (181 bytes)
   %Program Files%\SearchProtect\UI\dialogs\protection\protection.js (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0X234163\desktop.ini (67 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\text-field.png (1 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\checkbox_def.png (274 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\btnBlue.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SXMZ0DAF\ip[1] (181 bytes)
   %Program Files%\SearchProtect\UI\dialogs\libs\jquery.1.7.1.min.js (3312 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsh2.tmp (705688 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\menu-selected.png (3 bytes)
   %Program Files%\SearchProtect\UI\dialogs\protection\defaults.js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4967CDAB\CT3331172[1] (866 bytes)
   %Program Files%\SearchProtect\EULA.txt (784 bytes)
   %Program Files%\SearchProtect\Main\bin\uninstall.exe (34561 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsc3.tmp\nsC.tmp (6 bytes)
   %Program Files%\SearchProtect\UI\dialogs\protectionDS\protectionDS.css (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsu6.exe (5520 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SD6JW5EN\settings[1] (4 bytes)
   %Program Files%\SearchProtect\UI\dialogs\settings\settings.js (11 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\bg.png (784 bytes)
   %Program Files%\SearchProtect\UI\dialogs\uninstall\defaults.js (1 bytes)
   %Program Files%\SearchProtect\UI\dialogs\settings\settings.css (8 bytes)
   %Program Files%\SearchProtect\UI\dialogs\style.css (7 bytes)
   %WinDir%\AppPatch\nbin\VC32Loader.dll (8184 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\info-icon.png (424 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\browsers32.sdb (1 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\button-bg.png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SD6JW5EN\desktop.ini (67 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\bgSettings.png (12 bytes)
   %Program Files%\SearchProtect\UI\dialogs\settings.html (8 bytes)
   %Program Files%\SearchProtect\Main\bin\SPtool.dll (93946 bytes)
   %Program Files%\SearchProtect\UI\dialogs\uninstall\uninstall.html (5 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\hez-def.png (1 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\radio-button-selected.png (1 bytes)
   %Program Files%\SearchProtect\Main\rep\SystemRepository.dat (1298 bytes)
   %Program Files%\SearchProtect\UI\dialogs\libs\dialogUtils.js (1 bytes)
   %Program Files%\SearchProtect\SearchProtect\bin\VC64.dll (164944 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nswB.tmp (4 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\Apply-default.png (2 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\SP_DialogBG.png (10 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Consent\defaults.js (591 bytes)
   %Program Files%\SearchProtect\UI\dialogs\Images\Apply-Rollover.png (2 bytes)
   %WinDir%\AppPatch\Custom\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb (1 bytes)
   %Program Files%\SearchProtect\Main\rep\cfi.bin (708 bytes)
   %Program Files%\SearchProtect\Main\rep\pni.bin (708 bytes)
   %Program Files%\SearchProtect\Main\rep\edk.bin (708 bytes)
   %Program Files%\SearchProtect\Main\rep\trn.bin (708 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\SearchProtect\SearchProtect\rep\UserSettings.dat (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\SearchProtect\UI\rep\UIRepository.dat (1057 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsu8.tmp\inetc.dll (30 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsi10.tmp\inetc.dll (30 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.