Trojan.GenericKD.3506392_8907e74959

by malwarelabrobot on September 10th, 2016 in Malware Descriptions.

Susp_Dropper (Kaspersky), Trojan.GenericKD.3506392 (B) (Emsisoft), Trojan.GenericKD.3506392 (AdAware), Backdoor.Win32.Farfli.FD, Trojan-Banker.Win32.Brasil.FD, Trojan.Win32.Delphi.FD, Trojan.Win32.Sasfis.FD, VirTool.Win32.DelfInject.FD, GenericInjector.YR (Lavasoft MAS)
Behaviour: Banker, Trojan, Backdoor, VirTool


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 8907e7495997feb1cd7d5b0450ad40e3
SHA1: 49368cf3d9814fab3a3cf59085be3009e1314f68
SHA256: 3c2b81aab281e89a7aa550b105555e986c8e9d09c7e25938308e6fb40963c3e1
SSDeep: 24576:jVqFccZF4mwUQue4TvvzYIQBJgriuaxKrZvCUc2/ dc8/z0Pj:j074pzMTnVAJgriuOK9lc2/Z8/zK
Size: 1131008 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPXv0896v102v105v122Delphistub, UPolyXv05_v6
Company: no certificate found
Created at: 1992-06-20 01:22:17
Analyzed on: WindowsXP SP3 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

mspaint.exe:1760
%original file name%.exe:1488

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:1488 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\user64.dll (3760 bytes)

Registry activity

The process mspaint.exe:1760 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "44 DB 99 14 9C 43 FD 78 17 8B D4 98 05 BB CB 48"

The process %original file name%.exe:1488 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "40 AF 78 1E 12 29 19 91 F3 27 6A D4 56 C8 1C D1"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"user64" = "C:\setup2.exe"

Dropped PE files

MD5 File path
9e9109939265645154bb81c93fee2e68 c:\user64.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
UPX0 4096 630784 0 0 d41d8cd98f00b204e9800998ecf8427e
UPX1 634880 1052672 1051136 5.4341 37043dd4fed4e356542e0823217fb5f4
.rsrc 1687552 81920 78848 3.59091 9a8d77b3b21218eebde2795f933cb751

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Trojan connects to the servers at the folowing location(s):

%original file name%.exe_1488:

`.rsrc
kernel32.dll
Windows
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
EVariantBadIndexError
ssShift
htKeyword
EInvalidOperation
u%CNu
%s[%d]
%s_%d
.Owner
EInvalidGraphicOperation
comctl32.dll
USER32.DLL
windows
uxtheme.dll
Uh|
%s%s%s%s%s%s%s%s%s%s
Proportional
MAPI32.DLL
PasswordChar
OnKeyDown
OnKeyPressH
OnKeyUpl
ssHorizontal
OnKeyUp
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
JumpID("","%s")
TKeyEvent
TKeyPressEvent
HelpKeywordd
crSQLWait
%s (%s)
imm32.dll
AutoHotkeys
AutoHotkeysd
ssHotTrack
Size0%F
TWindowState
poProportional
TWMKey
KeyPreview
WindowStateH
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
User32.dll
EInvalidGridOperation
TSQLTimeStampVariantType
TSQLTimeStampData
TSQLTimeStampData`
SqlTimSt
%s %s
(%s%s)
-%s%s
%s-%s
%s%s-
-%s %s
%s %s-
%s -%s
(%s- %s)
(%s %s)
ole32.dll
ftParadoxOle
TLoginEvent
Password
pfInKey
ImportedConstraint
LookupKeyFields
KeyFields
TSQLTimeStampField
SQLTimeStamp
%s: %s
Uh.tH
%s.%s
Password
TLoginDialog
TLoginDialogpMI
TPasswordDialog
KeyField
NullValueKey
dgAlwaysShowEditor
dgAlwaysShowSelection
mtxex.dll
ctKeyset
TExecuteOption
eoAsyncExecute
eoExecuteNoRecords
TExecuteOptions
cmdUnknown
cmdText
cmdTable
cmdStoredProc
cmdFile
cmdTableDirect
TExecuteCompleteEvent
TWillExecuteEvent
LoginPrompt
OnExecuteComplete
OnWillExecute@
OnLogin
(%s%s%s%s%2:s)
RDSServer.DataFactory
COLUMN%d
%s[%s],
%s%s,
%s;%s
PRIMARY_KEY
\Software\Microsoft\Windows\CurrentVersion\Policies\System
SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
C:\setup2.exe
mspaint.exe
notepad.exe
C:\user64.dll
333333333333333333
33333833
3333339
3333333333333338
:*"*"$3338
3333333
33333333
33333333333
3333333333338
33338?383
333333333333
:*3:"$3338
333333333333333
33333333333333
337373?3
333373?33
33333337
3733333
3337333
3333373
3737333
373333?3
3333333333
333333333
333?33?333
333373?3
Nexec
KWindows
UrlMon
rSqlTimSt
LoginDialog
Database Login
&Password:
PasswordDialog
Enter password
Font.Charset
Font.Color
Font.Height
Font.Name
Font.Style
TitleFont.Charset
TitleFont.Color
TitleFont.Height
TitleFont.Name
TitleFont.Style
Lines.Strings
.rsrc
l32.dll_GetLongPathNameAb
%%''''%%%%''''%%%%''''%%%%''''%%%%''''%%%%''''%%%%:'''%%%(
ORT_(_.SCK_LI
P.TPlrr
Keyw2
.RGRO
%U0R2
%s[Úb
g%s_%dM
MsgC
A.Crs
;o%se
iQg.gx
t.Hpa
.Gr!o
%S78e
L0E#$%S
7IE(AL("%s",4
.Cren
keysK<n
.CJ%'
.Px|Q
||2%uQ!
OI.qH
e.YW'
.Susp
ExE.ct'?
R%Cx3
%-xb%D
-e}XP
%XeElt
@DMSGbOa
.lb@%~=
,u"%X
%S67W
| :.Xw@f,=
tcpG'
.Lb4'S
%FY}kU
C:\us
y%dRt/>
.diY.Y
_.hxQ'
$.ZC!f
0####48<@
-vKO}
14&%f
.tQvU<
%4up% 
edt2crt,9
!_MsgO
8Ý$'
i.ia]cT
.Qhq\1
keyGsd
mx%q}%u
-1H}R
577244/33/43054
!&%"'&#('
27649838
_` 0/(-,$)(
\[.Xr@
,24.3)03
&)!(  '*
"),#*-%,/
.1(/2$,,'//)|22.66
 26*05).3(.2/2
_2:[email protected] ##
h[aa.NTT!
9<=,-.^__
.lv.A
w.rCJIM"
wk"Q.QWV
Ÿ@A
}I.je
.AU6%
.JJyUT
..yme
pf.XF
.aUTO
:&&'))*/
.)$#(#"*%$,'&0 *.)(-('
.3.-1, :/*)
,18  3$(6*-3.>*$
)''/( 4 .
.'*7.19,
""v%d
:1.bYV
AP

:[email protected]
Dcs,fu at%Xk
Uk%XU
js"jv$py)"%fo
p\k.Sh
Yi&ap.ny
<<.ED@ROQ
44.KIIc`bzv{
422, ''(
.1"/3'37,9<3
/1  /$')
'{~|%S
_MsgOS
5772, 2014/
/13-19:44:00
.com/x
=<;:98765
D%xzJ
Passw8@
Keydv
keybd
LMsg
"$ %),'(
VrF!.jv
M*.*  0
.P.reE
KERNEL32.DLL
advapi32.dll
comdlg32.dll
gdi32.dll
shell32.dll
user32.dll
version.dll
winmm.dll
winspool.drv
wsock32.dll
RegCloseKey
ShellExecuteA
ChiCorier.dll
GetCPInfo
RegOpenKeyExA
RegFlushKey
RegCreateKeyExA
SetViewportOrgEx
SetViewportExtEx
UnhookWindowsHookEx
SetWindowsHookExA
SetKeyboardState
MapVirtualKeyA
LoadKeyboardLayoutA
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextA
EnumWindows
EnumThreadWindows
ActivateKeyboardLayout
GetKeyboardType
.idata
.rdata
P.reloc
P.rsrc
.se\S
.P.re
B.RGG3T
<assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Criol64" type="win32"/>
<requestedExecutionLevel level="requireAdministrator" uiAccess="false"/>
MSDASQL.1
MSDASQL
TLOGINDIALOG
TPASSWORDDIALOG
'Unsupported field type (%s) in field %s;A connection component is required for async ExecuteOptions5Cannot perform a requery after connection has changed
FilterOptions are not supported
Delete all selected records?%Operation not allowed in a DBCtrlGrid(Property already defined by lookup field/Grid requested to display more than 256 columns
Remote Login
Invalid Enum Value&Missing Connection or ConnectionString0Filter property cannot be used for detail tablesUDataset does not support bookmarks, which are required for multi-record data controls
Missing %s property(CommandText does not return a result set{Error creating object. Please verify that the Microsoft Data Access Components 2.1 (or later) have been properly installed=Events are not supported with server side TableDirect cursors
%s is not a valid BCD value
Invalid format type for BCD$Could not parse SQL TimeStamp string
Invalid SQL date/time values
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
"Dataset not in edit or insert mode1Cannot perform this operation on a closed dataset1Cannot perform this operation on an empty dataset!Cannot modify a read-only dataset#Nested dataset must inherit from %s
Parameter '%s' not found
Unable to load bind parameters$Field '%s' is of an unsupported type
SQL not supported: %s
Execute not supported: %s1Operation not allowed on a unidirectional dataset
0'%s' is not a valid boolean value for field '%s'7'%s' is not a valid floating point value for field '%s'6Type mismatch for field '%s', expecting: %s actual: %s6Size mismatch for field '%s', expecting: %d actual: %d Invalid variant type or size for field '%s'#Value of field '%s' is out of range
Field '%s' must have a value
Field '%s' has no dataset1Field '%s' cannot be a calculated or lookup field
Field '%s' cannot be modified
No index for fields '%s'
Index '%s' not found"Circular datalinks are not allowed/Lookup information for field '%s' is incomplete
DataSource cannot be changed0Cannot perform this operation on an open dataset
No help keyword specified.
Invalid FieldKind Field '%s' is of an unknown type
Duplicate field name '%s'
Field '%s' not found#Cannot access field '%s' as type %s
Invalid value for field '%s'E%g is not a valid value for field '%s'. The allowed range is %g to %gE%s is not a valid value for field '%s'. The allowed range is %s to %s0'%s' is not a valid integer value for field '%s'
8Listbox (%s) style must be virtual in order to set Count"Unable to find a Table of Contents
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Value must be between %d and %d
Invalid clipboard format Clipboard does not support Icons
Text exceeds memo capacity Operation not supported on selected printer.There is no default printer currently selected/Menu '%s' is already being used by another form
Error setting %s.Count
7Invalid input value. Use escape key to abandon changes
!Control '%s' has no parent window
%s property out of range
%s on %s@GroupIndex cannot be less than a previous menu item's GroupIndex5Cannot create form. No MDI forms are currently active*A control cannot have itself as its parent
Unsupported clipboard format
Invalid property value List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Failed to set data for '%s'
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list Too many rows or columns deleted$%s not in a class registration group
Property %s does not exist
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s1Fixed column count must be less than column count Fixed row count must be less than row count
Cannot open file "%s". %s
Grid too large for operation
Invalid stream format$''%s'' is not a valid component name
Invalid property element: %s
Invalid property type: %s
Ancestor for '%s' not found
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
/Custom variant type (%s%.4x) already used by %s*Custom variant type (%s%.4x) is not usable2Too many custom variant types have been registered5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
External exception %x
Interface not supported
%s (%s, line %d)
(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
Invalid variant operation
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
%s,Custom variant type (%s%.4x) is out of range
Integer overflow Invalid floating point operation
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Operation aborted
!'%s' is not a valid integer value('%s' is not a valid floating point value
'%s' is not a valid date
'%s' is not a valid time!'%s' is not a valid date and time '%d.%d' is not a valid timestamp
I/O error %d

%original file name%.exe_1488_rwx_00401000_0018E000:

kernel32.dll
Windows
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
EVariantBadIndexError
ssShift
htKeyword
EInvalidOperation
u%CNu
%s[%d]
%s_%d
.Owner
EInvalidGraphicOperation
comctl32.dll
USER32.DLL
windows
uxtheme.dll
Uh|
%s%s%s%s%s%s%s%s%s%s
Proportional
MAPI32.DLL
PasswordChar
OnKeyDown
OnKeyPressH
OnKeyUpl
ssHorizontal
OnKeyUp
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
JumpID("","%s")
TKeyEvent
TKeyPressEvent
HelpKeywordd
crSQLWait
%s (%s)
imm32.dll
AutoHotkeys
AutoHotkeysd
ssHotTrack
Size0%F
TWindowState
poProportional
TWMKey
KeyPreview
WindowStateH
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
User32.dll
EInvalidGridOperation
TSQLTimeStampVariantType
TSQLTimeStampData
TSQLTimeStampData`
SqlTimSt
%s %s
(%s%s)
-%s%s
%s-%s
%s%s-
-%s %s
%s %s-
%s -%s
(%s- %s)
(%s %s)
ole32.dll
ftParadoxOle
TLoginEvent
Password
pfInKey
ImportedConstraint
LookupKeyFields
KeyFields
TSQLTimeStampField
SQLTimeStamp
%s: %s
Uh.tH
%s.%s
Password
TLoginDialog
TLoginDialogpMI
TPasswordDialog
KeyField
NullValueKey
dgAlwaysShowEditor
dgAlwaysShowSelection
mtxex.dll
ctKeyset
TExecuteOption
eoAsyncExecute
eoExecuteNoRecords
TExecuteOptions
cmdUnknown
cmdText
cmdTable
cmdStoredProc
cmdFile
cmdTableDirect
TExecuteCompleteEvent
TWillExecuteEvent
LoginPrompt
OnExecuteComplete
OnWillExecute@
OnLogin
(%s%s%s%s%2:s)
RDSServer.DataFactory
COLUMN%d
%s[%s],
%s%s,
%s;%s
PRIMARY_KEY
\Software\Microsoft\Windows\CurrentVersion\Policies\System
SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
C:\setup2.exe
mspaint.exe
notepad.exe
C:\user64.dll
333333333333333333
33333833
3333339
3333333333333338
:*"*"$3338
3333333
33333333
33333333333
3333333333338
33338?383
333333333333
:*3:"$3338
333333333333333
33333333333333
337373?3
333373?33
33333337
3733333
3337333
3333373
3737333
373333?3
3333333333
333333333
333?33?333
333373?3
Nexec
KWindows
UrlMon
rSqlTimSt
LoginDialog
Database Login
&Password:
PasswordDialog
Enter password
Font.Charset
Font.Color
Font.Height
Font.Name
Font.Style
TitleFont.Charset
TitleFont.Color
TitleFont.Height
TitleFont.Name
TitleFont.Style
Lines.Strings
.rsrc
l32.dll_GetLongPathNameAb
%%''''%%%%''''%%%%''''%%%%''''%%%%''''%%%%''''%%%%:'''%%%(
ORT_(_.SCK_LI
P.TPlrr
Keyw2
.RGRO
%U0R2
%s[Úb
g%s_%dM
MsgC
A.Crs
;o%se
iQg.gx
t.Hpa
.Gr!o
%S78e
L0E#$%S
7IE(AL("%s",4
.Cren
keysK<n
.CJ%'
.Px|Q
||2%uQ!
OI.qH
e.YW'
.Susp
ExE.ct'?
R%Cx3
%-xb%D
-e}XP
%XeElt
@DMSGbOa
.lb@%~=
,u"%X
%S67W
| :.Xw@f,=
tcpG'
.Lb4'S
%FY}kU
C:\us
y%dRt/>
.diY.Y
_.hxQ'
$.ZC!f
0####48<@
-vKO}
14&%f
.tQvU<
%4up% 
edt2crt,9
!_MsgO
8Ý$'
i.ia]cT
.Qhq\1
keyGsd
mx%q}%u
-1H}R
577244/33/43054
!&%"'&#('
27649838
_` 0/(-,$)(
\[.Xr@
,24.3)03
&)!(  '*
"),#*-%,/
.1(/2$,,'//)|22.66
 26*05).3(.2/2
_2:[email protected] ##
h[aa.NTT!
9<=,-.^__
.lv.A
w.rCJIM"
wk"Q.QWV
Ÿ@A
}I.je
.AU6%
.JJyUT
..yme
pf.XF
.aUTO
:&&'))*/
.)$#(#"*%$,'&0 *.)(-('
.3.-1, :/*)
,18  3$(6*-3.>*$
)''/( 4 .
.'*7.19,
""v%d
:1.bYV
AP

:[email protected]
Dcs,fu at%Xk
Uk%XU
js"jv$py)"%fo
p\k.Sh
Yi&ap.ny
<<.ED@ROQ
44.KIIc`bzv{
422, ''(
.1"/3'37,9<3
/1  /$')
'{~|%S
_MsgOS
5772, 2014/
/13-19:44:00
.com/x
=<;:98765
D%xzJ
Passw8@
Keydv
keybd
LMsg
"$ %),'(
VrF!.jv
M*.*  0
.P.reE
KERNEL32.DLL
advapi32.dll
comdlg32.dll
gdi32.dll
shell32.dll
user32.dll
version.dll
winmm.dll
winspool.drv
wsock32.dll
RegCloseKey
ShellExecuteA
ChiCorier.dll
GetCPInfo
RegOpenKeyExA
RegFlushKey
RegCreateKeyExA
SetViewportOrgEx
SetViewportExtEx
UnhookWindowsHookEx
SetWindowsHookExA
SetKeyboardState
MapVirtualKeyA
LoadKeyboardLayoutA
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextA
EnumWindows
EnumThreadWindows
ActivateKeyboardLayout
GetKeyboardType
.idata
.rdata
P.reloc
P.rsrc
MSDASQL.1
MSDASQL
TLOGINDIALOG
TPASSWORDDIALOG
'Unsupported field type (%s) in field %s;A connection component is required for async ExecuteOptions5Cannot perform a requery after connection has changed
FilterOptions are not supported
Delete all selected records?%Operation not allowed in a DBCtrlGrid(Property already defined by lookup field/Grid requested to display more than 256 columns
Remote Login
Invalid Enum Value&Missing Connection or ConnectionString0Filter property cannot be used for detail tablesUDataset does not support bookmarks, which are required for multi-record data controls
Missing %s property(CommandText does not return a result set{Error creating object. Please verify that the Microsoft Data Access Components 2.1 (or later) have been properly installed=Events are not supported with server side TableDirect cursors
%s is not a valid BCD value
Invalid format type for BCD$Could not parse SQL TimeStamp string
Invalid SQL date/time values
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
"Dataset not in edit or insert mode1Cannot perform this operation on a closed dataset1Cannot perform this operation on an empty dataset!Cannot modify a read-only dataset#Nested dataset must inherit from %s
Parameter '%s' not found
Unable to load bind parameters$Field '%s' is of an unsupported type
SQL not supported: %s
Execute not supported: %s1Operation not allowed on a unidirectional dataset
0'%s' is not a valid boolean value for field '%s'7'%s' is not a valid floating point value for field '%s'6Type mismatch for field '%s', expecting: %s actual: %s6Size mismatch for field '%s', expecting: %d actual: %d Invalid variant type or size for field '%s'#Value of field '%s' is out of range
Field '%s' must have a value
Field '%s' has no dataset1Field '%s' cannot be a calculated or lookup field
Field '%s' cannot be modified
No index for fields '%s'
Index '%s' not found"Circular datalinks are not allowed/Lookup information for field '%s' is incomplete
DataSource cannot be changed0Cannot perform this operation on an open dataset
No help keyword specified.
Invalid FieldKind Field '%s' is of an unknown type
Duplicate field name '%s'
Field '%s' not found#Cannot access field '%s' as type %s
Invalid value for field '%s'E%g is not a valid value for field '%s'. The allowed range is %g to %gE%s is not a valid value for field '%s'. The allowed range is %s to %s0'%s' is not a valid integer value for field '%s'
8Listbox (%s) style must be virtual in order to set Count"Unable to find a Table of Contents
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Value must be between %d and %d
Invalid clipboard format Clipboard does not support Icons
Text exceeds memo capacity Operation not supported on selected printer.There is no default printer currently selected/Menu '%s' is already being used by another form
Error setting %s.Count
7Invalid input value. Use escape key to abandon changes
!Control '%s' has no parent window
%s property out of range
%s on %s@GroupIndex cannot be less than a previous menu item's GroupIndex5Cannot create form. No MDI forms are currently active*A control cannot have itself as its parent
Unsupported clipboard format
Invalid property value List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Failed to set data for '%s'
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list Too many rows or columns deleted$%s not in a class registration group
Property %s does not exist
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s1Fixed column count must be less than column count Fixed row count must be less than row count
Cannot open file "%s". %s
Grid too large for operation
Invalid stream format$''%s'' is not a valid component name
Invalid property element: %s
Invalid property type: %s
Ancestor for '%s' not found
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
/Custom variant type (%s%.4x) already used by %s*Custom variant type (%s%.4x) is not usable2Too many custom variant types have been registered5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
External exception %x
Interface not supported
%s (%s, line %d)
(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
Invalid variant operation
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
%s,Custom variant type (%s%.4x) is out of range
Integer overflow Invalid floating point operation
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Operation aborted
!'%s' is not a valid integer value('%s' is not a valid floating point value
'%s' is not a valid date
'%s' is not a valid time!'%s' is not a valid date and time '%d.%d' is not a valid timestamp
I/O error %d

mspaint.exe_1760:

.text
`.data
.rsrc
MFC42u.DLL
msvcrt.dll
ADVAPI32.dll
KERNEL32.dll
NTDLL.DLL
GDI32.dll
USER32.dll
comdlg32.dll
ole32.dll
OLEAUT32.dll
SHELL32.dll
IMM32.dll
mspaint.chm
COMDLG32.DLL
Fhhctrl.ocx
CLSID\{ADB880A6-D8FF-11CF-9377-00AA003B7A11}\InprocServer32
gdiplus.dll
UxTheme.dll
mspaint.pdb
SSSShH
[email protected]
GdiplusShutdown
_wcmdln
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegOpenKeyW
RegEnumKeyW
SetViewportExtEx
GetKeyState
GetKeyboardLayout
MsgWaitForMultipleObjects
RegOpenKeyExA
.?AVCCmdTarget@@
.PAVCMemoryException@@
.PAVCFileException@@
.PAVCException@@
.PAVCResourceException@@
.PAVCNotSupportedException@@
name="Microsoft.Windows.Shell.mspaint"
version="5.1.0.0"
<description>Windows Shell</description>
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
R.bbbbbbbbbbbbbbbbbbbbbbbbbbOR@lVSV\
.bbbbbbbbbbbbbbbbbbb
K6*z^H=.fMM
6 .BT[r!G
8-/|:[email protected]
%d~%d
%u%su
mspaint.hlp
gdi32.dll
shell32.dll
;*.jpeg
Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop
imm32.dll
SOFTWARE\Microsoft\Shared Tools\Graphics Filters\Import
SOFTWARE\Microsoft\Shared Tools\Graphics Filters\Export
5.1.2600.5512 (xpsp.080413-2105)
MSPAINT.EXE
Windows
Operating System
5.1.2600.5512
24-bit Bitmap (*.bmp;*.dib)
Palette|*.pal|
untitled.pal
.rlecOLE 2.0 was unable to start.
Bitmap Files (*.bmp)
Paint.Picture
Monochrome Bitmap (*.bmp;*.dib)
16 Color Bitmap (*.bmp;*.dib)
256 Color Bitmap (*.bmp;*.dib)
,Displays instructions about how to use Help.%Displays Help for areas you click on..Displays Help for the current task or command.
.Centers this bitmap as the desktop background.
!Pastes a file into the selection.%Selects the scanner or camera device.2Downloads a new document from a scanner or camera.
%Sends a picture by using mail or fax.
Reduces the window to an icon.!Enlarges the window to full size.%Switches to the next document window.)Switches to the previous document window.>Closes the active window and asks if you want to save changes.
gThere is not enough memory or resources to complete operation.
Close some programs, and then try again.DLow on memory or resources.
JThis is not a valid bitmap file, or its format is not currently supported.
This is not a valid .PCS file.
6The grid spacing must be an integer between %d and %d.
%s bytes
%d x %d dots per inch
PencilUErases a portion of the picture, using the selected eraser shape.
,Flips or rotates the picture or a selection..Stretches or skews the picture or a selection.1Inverts the colors of the picture or a selection.&Changes the attributes of the picture. Clears the picture or selection.&The font size must be a numeric value.8Contains commands for working with the selected item(s).7Contains commands for selecting and transferring items..Contains commands for customizing this window.CContains commands for manipulating pictures and setting attributes.>Contains commands for using custom colors and drawing options.FContains commands for displaying Help for and information about Paint.
Creates a new color.*Uses a previously saved palette of colors..Saves the current palette of colors to a file.
Shows Paint Help.(Microsoft\Windows\CurrentVersion\Applets
Downloading picture,Reading data from the device (%d%% complete)
Processing data (%d%% complete)!Transferring data (%d%% complete)

mspaint.exe_1760_rwx_000A0000_00001000:

C:\user64.dll

svchost.exe_616:

.text
`.data
.rsrc
ADVAPI32.dll
KERNEL32.dll
NTDLL.DLL
RPCRT4.dll
NETAPI32.dll
ole32.dll
ntdll.dll
RegCloseKey
RegOpenKeyExW
GetProcessHeap
NtOpenKey
svchost.pdb
\PIPE\
Software\Microsoft\Windows NT\CurrentVersion\Svchost
\Registry\Machine\System\CurrentControlSet\Control\SecurePipeServers\
5.1.2600.5512 (xpsp.080413-2111)
svchost.exe
Windows
Operating System
5.1.2600.5512

mspaint.exe_1760_rwx_01061000_00A6D000:

kernel32.dll
Windows
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
EVariantBadIndexError
ssShift
htKeyword
EInvalidOperation
u%CNu
%s[%d]
%s_%d
.Owner
EInvalidGraphicOperation
%s%s (*.%s)|*.%2:s
%s*.%s
%s (%s)|%1:s|%s
USER32.DLL
windows
comctl32.dll
uxtheme.dll
%s%s%s%s%s%s%s%s%s%s
Proportional
MAPI32.DLL
PasswordChar
OnKeyDown
OnKeyPress
OnKeyUp
ssHorizontal
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
JumpID("","%s")
TKeyEvent
TKeyPressEvent
HelpKeywordL
crSQLWait
%s (%s)
imm32.dll
AutoHotkeys
ssHotTrack
TWindowState
poProportional
TWMKey
KeyPreview
WindowState
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
User32.dll
TSQLTimeStampVariantType
TSQLTimeStampData
TSQLTimeStampDatap
SqlTimSt
%s %s
(%s%s)
-%s%s
%s-%s
%s%s-
-%s %s
%s %s-
%s -%s
(%s- %s)
(%s %s)
ole32.dll
ftParadoxOle
pfInKey
ImportedConstraint
LookupKeyFields
KeyFields
TSQLTimeStampField
TSQLTimeStampField<
SQLTimeStamp
%s: %s
%s.%s
Password
TLoginDialog
TPasswordDialog
KeyField
NullValueKey
EInvalidGridOperation
dgAlwaysShowEditor
dgAlwaysShowSelection
Port
1.1.4
Invalid Key Name
Invalid KeyName
C:\user64.dll
ESendKeyError
TMonochromeLookup
user32.dll
edt_Amcrt,
Panel_MsgOSL
edt_amCKeyPress
edt_azAssKeyPress
edt_AmcrtKeyPress
edt_descoTkKeyPress
edt_itDiaKeyPress
edt_itDiaKeyUp
edt_itMesKeyUp
edt_itAnoKeyUp
edt_vermelhoSassKeyPress
edt_sico4KeyPress
edt_sicreAsKeyPress
edt_codCitiKeyPress
Error, bitmap format not supported.
Chrome_RenderWidgetHostHWND
Chrome_WidgetWin_0
deflate 1.1.4 Copyright 1995-2002 Jean-loup Gailly
333333333333333333
33333833
3333339
3333333333333338
:*"*"$3338
3333333
33333333
33333333333
3333333333338
33338?383
333333333333
:*3:"$3338
333333333333333
33333333333333
337373?3
333373?33
33333337
3733333
3337333
3333373
3737333
373333?3
3333333333
333333333
333?33?333
333373?3
KWindows
UrlMon
.ScktComp
Usndkey32
qKeydefs2
Keydefs
EKeyPOS2
rSqlTimSt
Font.Charset
Font.Color
Font.Height
Font.Name
Font.Style
TitleFont.Charset
TitleFont.Color
TitleFont.Height
TitleFont.Name
TitleFont.Style
Picture.Data
mx%q}%u
edt_Amcrt
000000000
&)!( !(  '*
UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%oY.UD%UD%UD%UD%UD%UD%|d3UD%UD%UD%UD%oY.oY.UD%UD%UD%|d3oY.UD%UD%UD%
n7UD%UD%UD%|d3|d3UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%bO*
n7bO*UD%UD%oY.|d3UD%UD%UD%
n7bO*UD%UD%UD%
n7UD%UD%UD%UD%UD%oY.UD%UD%UD%UD%UD%oY.bO*UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%oY.UD%UD%UD%UD%UD%UD%|d3UD%UD%UD%UD%oY.oY.UD%UD%UD%|d3oY.UD%UD%UD%
n7UD%UD%UD%UD%UD%oY.UD%UD%UD%UD%UD%oY.bO*UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%YG&YG&YG&YG&UD%YG&YG&]K(UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%YG&YG&]K(UD%YG&]K(UD%]K(UD%UD%UD%UD%UD%UD%UD%UD%oY.UD%UD%UD%UD%UD%UD%oY.UD%UD%UD%UD%oY.bO*UD%UD%UD%|d3bO*UD%UD%bO*|d3UD%UD%UD%
n7|d3UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%oY.
n7bO*UD%UD%|d3oY.UD%UD%UD%
n7UD%UD%UD%UD%|d3UD%UD%UD%UD%bO*bO*UD%UD%UD%UD%UD%oY.UD%UD%UD%UD%UD%UD%UD%UD%eQ UD%UD%UD%UD%eQ UD%UD%UD%eQ UD%UD%lW-UD%UD%eQ ]J(UD%lW-eQ UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%t]0]J(UD%lW-UD%UD%eQ ]J(UD%UD%eQ UD%UD%UD%eQ UD%UD%UD%]J(]J(UD%UD%UD%UD%UD%UD%UD%mW-UD%UD%UD%UD%UD%UD%mW-UD%UD%UD%UD%aN)mW-UD%UD%UD%mW-xa1UD%UD%UD%xa1aN)UD%UD%mW-
j5UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%xa1xa1UD%UD%UD%
j5UD%UD%UD%mW-xa1UD%UD%UD%mW-mW-UD%UD%UD%UD%mW-UD%UD%UD%UD%UD%UD%mW-UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%oY.UD%UD%UD%UD%UD%UD%|d3UD%UD%UD%UD%oY.oY.UD%UD%UD%|d3oY.UD%UD%UD%
n7UD%UD%UD%|d3
k6UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%bO*
n7UD%UD%UD%r\/
n7\I'UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%oY.
n7_L(UD%UD%oY.|d3UD%UD%UD%
j5[I'UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%
h4xa1UD%UD%UD%
j5UD%UD%UD%mW-xa1UD%UD%UD%mW-mW-UD%UD%UD%UD%mW-UD%UD%UD%UD%UD%UD%mW-UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%ZH'gS oY.oY.jU,jU,jU,jU,jU,jU,jU,jU,jU,jU,jU,UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%oY.UD%UD%UD%UD%UD%UD%|d3UD%UD%UD%UD%oY.oY.UD%UD%UD%|d3oY.UD%UD%UD%
n7UD%UD%UD%eQ 
n7oY.UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%
k6UD%UD%UD%oY.|d3UD%UD%ZH'
n7_L(_L(_L(_L(_L(t]0_L(_L(_L(_L(_L(t]0iT,_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%oY.UD%UD%UD%UD%UD%UD%|d3UD%UD%UD%UD%oY.oY.UD%UD%UD%|d3oY.UD%UD%UD%
n7_L(_L(_L(_L(_L(t]0_L(_L(_L(_L(_L(t]0iT,_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(WF&UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%YG&YG&YG&YG&UD%YG&YG&]K(UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%YG&YG&]K(UD%YG&]K(UD%]K(UD%UD%UD%UD%UD%UD%UD%UD%oY.UD%UD%UD%UD%UD%UD%oY.UD%UD%UD%UD%oY.bO*UD%UD%UD%|d3bO*UD%UD%bO*|d3UD%UD%UD%
n7UD%UD%UD%UD%|d3UD%UD%UD%UD%bO*bO*UD%UD%UD%UD%UD%oY.UD%UD%UD%UD%UD%UD%UD%UD%eQ UD%UD%UD%UD%eQ UD%UD%UD%eQ UD%UD%lW-UD%UD%eQ ]J(UD%lW-eQ UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%t]0]J(UD%lW-UD%UD%eQ ]J(UD%UD%eQ UD%UD%UD%eQ UD%UD%UD%]J(]J(UD%UD%UD%UD%UD%UD%UD%mW-UD%UD%UD%UD%UD%UD%mW-UD%UD%UD%UD%aN)mW-UD%UD%UD%mW-xa1UD%UD%UD%xa1aN)UD%UD%dP*
j5gR UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%[I'
j5oY.UD%UD%UD%
j5UD%UD%UD%mW-xa1UD%UD%UD%mW-mW-UD%UD%UD%UD%mW-UD%UD%UD%UD%UD%UD%mW-UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%eQ*r[/mW-`M)UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%oY.UD%UD%UD%UD%UD%UD%|d3UD%UD%UD%UD%oY.oY.UD%UD%UD%|d3oY.UD%UD%UD%
n7XG&UD%UD%UD%
k6\I'UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%lV-
n7oY.UD%UD%UD%oY.
n7_L(_L(_L(_L(_L(t]0_L(_L(_L(_L(_L(t]0iT,_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(_L(iT,kU,mW-aN)UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%YG&YG&YG&YG&UD%YG&YG&]K(UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%WF&YG&YG&]K(UD%YG&]K(UD%]K(UD%UD%UD%UD%UD%UD%UD%UD%oY.UD%UD%UD%UD%UD%UD%oY.UD%UD%UD%UD%oY.bO*UD%UD%UD%|d3bO*UD%UD%bO*|d3UD%UD%UD%
n7UD%UD%UD%UD%|d3UD%UD%UD%UD%bO*bO*UD%UD%UD%UD%UD%oY.UD%UD%UD%UD%UD%UD%UD%UD%eQ UD%UD%UD%UD%eQ UD%UD%UD%eQ UD%UD%lW-UD%UD%eQ ]J(UD%hT,jU-UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%[I't]0YG&UD%lW-UD%UD%eQ ]J(UD%UD%eQ UD%UD%UD%eQ UD%UD%UD%]J(]J(UD%UD%UD%UD%UD%UD%UD%mW-UD%UD%UD%UD%UD%UD%mW-UD%UD%UD%UD%aN)mW-UD%UD%UD%mW-xa1UD%UD%UD%xa1aN)UD%UD%XF&
j5xa1UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%UD%mW-
j5dP*UD%UD%UD%
j5UD%UD%UD%mW-xa1UD%UD%UD%mW-mW-UD%UD%UD%UD%mW-UD%UD%UD%WF&\J'ZH'oY.YG&YG&YG&YG&YG&YG&YG&YG&YG&YG&YG&fR u^0gS YG&YG&YG&YG&[I'\J'VE%UD%UD%UD%UD%UD%UD%UD%UD%UD%
{{|{{|{{|{{|{{|{{|{{|{{|
{{|{{|{{|{{|{{|{{|{{|{{|{{|
[[[:::666>>>
]]]===999>??
^^^???;;;@@@
...ffffffffffffffffffffffffeeeffffffffffffffffffffffff```NNN
&!"&!"&!"&!"% !"
% !&!"% !#
)$#(#"*%$,'&0 *.)(-('-('-('.)(-(','&3.-1, 0 */*)/*)-('*%$'"!"
'#")%$ '&(&%
'"! &%.)(0 *1, 3.-2-,2-,2-,3.-4/.6107213/.1-,,('($#$
'%$%#"%#"
(#")$#1-,1-,0, -)(*&%'#"%! $
,(')%$*&%)%$
%! '#"($# '&-)(2.-'#"
95440/2.-,(' '&510
'"!(#")$#(#"(#")$#*%$)$#)$#(#"'"!&! %
 &%/*)3.-610'"!610
%! )%$*&%'#"%! $
(#"2-,721=87721555
., *(',*)(&%
0.-721.)(
6430.-421., 
310865:87865&$#
-)((&% )(*('@<;:87310
&!!'""(##)$% &'-(0, 
)'&0.-75431053296252.E@=JEBSLII@=:1.bYV
'%$'%$- *.1/697342'(&
532 )(&$#"'2&)'&$#($##
&! )$#)$#'"!$
($#(&%)'&/-,)*(231* )(&%)%$$
*((31020/310:87532643;98 )( &%)$#%!
- */-,4216431/.532532:542-,,('510
% !&!"'"#(#$(#$$
- *., 0.-,*))'&., 0.-)'&@<;
%#"(&% )(1/.- *
5=,/27)!(0$
#(&228)#:#
999333333999
Dcs,fu at%Xk
js"jv$py)ju%fo
;v}4y}5mu(sz)s}*ls"nx%r{%dn
p\k.Sh
Yi&ap.ny
<<.ED@ROQ
44.KIIc`bzv{
'{~|%S
Panel_MsgOS
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:ab43d7fc-b733-45ef-a63c-14c134b5dfd1" xmpMM:DocumentID="xmp.did:27B6D114253411E4ADEAF9DA489C9B99" xmpMM:InstanceID="xmp.iid:27B6D113253411E4ADEAF9DA489C9B99" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:783ec1ed-afb6-4ab6-b029-0960fbf86810" stRef:documentID="xmp.did:ab43d7fc-b733-45ef-a63c-14c134b5dfd1"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
D%xzJ
LoginDialog
Password
Database Login
&Password:
PasswordDialog
Enter password
GetCPInfo
RegOpenKeyExA
RegCloseKey
RegFlushKey
RegCreateKeyExA
SetViewportOrgEx
SetViewportExtEx
ShellExecuteA
keybd_event
VkKeyScanA
UnhookWindowsHookEx
SetWindowsHookExA
SetKeyboardState
RegisterHotKey
MsgWaitForMultipleObjects
MapVirtualKeyA
LoadKeyboardLayoutA
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextA
GetAsyncKeyState
EnumWindows
EnumThreadWindows
EnumDesktopWindows
ActivateKeyboardLayout
GetKeyboardType
"$ %),'(
)%%%$$&&$%&)
)%%%$$&&$''&&
)%%%$$"!$%"&&$&)
)%%%$$"!$%"&&$&)
)%%$$"!$%"&&$&&
38000=344
'*'/)0',)-'0'M*.*  0*  0,0*x@
)%%%$$"!$%"&&$&&
)%%%$$"!$%"&&$&'
.idata
.edata
P.reloc
P.rsrc
.P.reE
TLOGINDIALOG
TPASSWORDDIALOG
Invalid Image trailerAInternal error: Extension Instance does not match Extension Label,Unsupported Application Extension block size
Unknown GIF block type'Object type not supported for operation
Unsupported PixelFormat
Invalid stream operation
Remote Login&Cannot change the size of a JPEG image
JPEG error #%d
Unsupported GIF version
Invalid extension introducerúiled to allocate memory for GIF DIB
7Dispatch methods do not support more than 64 parameters
Delete all selected records?%Operation not allowed in a DBCtrlGrid(Property already defined by lookup field/Grid requested to display more than 256 columns
#Nested dataset must inherit from %s
SQL not supported: %s
Execute not supported: %s1Operation not allowed on a unidirectional dataset
%s is not a valid BCD value
Invalid format type for BCD$Could not parse SQL TimeStamp string
Invalid SQL date/time values
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object
0'%s' is not a valid boolean value for field '%s'7'%s' is not a valid floating point value for field '%s'6Type mismatch for field '%s', expecting: %s actual: %s6Size mismatch for field '%s', expecting: %d actual: %d Invalid variant type or size for field '%s'#Value of field '%s' is out of range
Field '%s' must have a value
Field '%s' has no dataset"Circular datalinks are not allowed/Lookup information for field '%s' is incomplete
DataSource cannot be changed0Cannot perform this operation on an open dataset"Dataset not in edit or insert mode1Cannot perform this operation on a closed dataset1Cannot perform this operation on an empty dataset!Cannot modify a read-only dataset
No help keyword specified.
Invalid FieldKind Field '%s' is of an unknown type
Duplicate field name '%s'
Field '%s' not found#Cannot access field '%s' as type %s
Invalid value for field '%s'E%g is not a valid value for field '%s'. The allowed range is %g to %gE%s is not a valid value for field '%s'. The allowed range is %s to %s0'%s' is not a valid integer value for field '%s'
8Listbox (%s) style must be virtual in order to set Count"Unable to find a Table of Contents
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Invalid clipboard format Clipboard does not support Icons
Text exceeds memo capacity Operation not supported on selected printer.There is no default printer currently selected/Menu '%s' is already being used by another form
(%dx%d)
Error setting %s.Count
Invalid input value7Invalid input value. Use escape key to abandon changes
%s on %s@GroupIndex cannot be less than a previous menu item's GroupIndex5Cannot create form. No MDI forms are currently active*A control cannot have itself as its parent
$Unknown picture file extension (.%s)
Unsupported clipboard format
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
Thread creation error: %s
Thread Error: %s (%d)*Windows socket error: %s (%d), on API '%s'
Asynchronous socket error %d
Invalid data type for '%s' List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Failed to get data for '%s'
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list Too many rows or columns deleted$%s not in a class registration group
Property %s does not exist
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s1Fixed column count must be less than column count Fixed row count must be less than row count
Cannot open file "%s". %s
Grid too large for operation
Invalid stream format$''%s'' is not a valid component name
Invalid property element: %s
Invalid property type: %s
Ancestor for '%s' not found
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
/Custom variant type (%s%.4x) already used by %s*Custom variant type (%s%.4x) is not usable2Too many custom variant types have been registered5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
External exception %x
Interface not supported
%s (%s, line %d)
(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
Invalid variant operation
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
%s,Custom variant type (%s%.4x) is out of range
Integer overflow Invalid floating point operation
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Operation aborted
!'%s' is not a valid integer value('%s' is not a valid floating point value
'%s' is not a valid date
'%s' is not a valid time!'%s' is not a valid date and time '%d.%d' is not a valid timestamp
I/O error %d


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    C:\user64.dll (3760 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "user64" = "C:\setup2.exe"

  5. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2026 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now