Trojan.Win32.Alureon_733288ab39
Trojan-Downloader.Win32.Genome.hvqg (Kaspersky), Trojan.Win32.Alureon.FD, GenericAutorunWorm.YR (Lavasoft MAS)
Behaviour: Trojan-Downloader, Trojan, Worm, WormAutorun
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
| Requires JavaScript enabled! |
|---|
MD5: 733288ab39e17af8119267a741b6b9ec
SHA1: 3fc80b48c356a64e15d52b52404036bf95bfc741
SHA256: 8ccf0a3a3367a1f861ac3ecc6732d5e868f15afc42e7a21b7607c897e183fbd2
SSDeep: 49152:hqybqC/t42ohzYTq FY0LBMBTjl1rRs/eStit/dHeC/dgAzqerYVSwnoV:qzYTdY0LWBTjlzAeSti1HZGAzhrASwo
Size: 2860456 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6
Company: PlusHD Q-9.4V04.01
Created at: 2009-12-06 00:50:52
Analyzed on: WindowsXPESX SP3 32-bit
Summary:
Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Payload
| Behaviour | Description |
|---|---|
| WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer. |
Process activity
The Trojan creates the following process(es):
sc.exe:1112
net1.exe:1616
net1.exe:316
net.exe:240
net.exe:668
mscorsvw.exe:1912
fenopy.exe:1856
dvprprld.exe:860
regsvr32.exe:332
lbha.exe:1248
%original file name%.exe:376
The Trojan injects its code into the following process(es):
irsetup.exe:764
Mutexes
The following mutexes were created/opened:
No objects were found.
File activity
The process fenopy.exe:1856 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\_ir_sf_temp_0\lua5.1.dll (325 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_ir_sf_temp_0\irsetup.exe (7386 bytes)
The process dvprprld.exe:860 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\All Users\Application Data\Intuit\TurboTax\MSI\TY12\Logs\20150107_TTINSTALLER.log (5741 bytes)
The process lbha.exe:1248 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\fenopy.exe (10719 bytes)
The process irsetup.exe:764 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\_ir_sf_temp_0\IRIMG1.JPG (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_ir_sf_temp_0\IRIMG2.JPG (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_ir_sf_temp_0\irsetup.dat (131 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\IRW80.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_ir_sf_temp_0\irsetup.dat (0 bytes)
The process %original file name%.exe:376 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsh7F.tmp\ExecDos.dll (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\glywv.7z (21345 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lbha.exe (15192 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dvprprld.exe (60053 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsh7F.tmp\ExecDos.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh7F.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh7E.tmp (0 bytes)
Registry activity
The process sc.exe:1112 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0E 8C B0 61 68 E2 3D 5C 60 96 79 E9 D3 0D B5 92"
The process net1.exe:1616 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D2 76 BD B9 66 C1 D5 CA E0 30 85 83 F0 B1 90 DA"
The process net1.exe:316 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C4 52 5E 95 A2 CF 6A C9 19 A9 0B 27 8D C4 41 70"
The process net.exe:240 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "62 05 1B 81 27 78 AB 0B 82 08 8E A2 EF E9 74 AA"
The process net.exe:668 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F9 B8 12 68 AE 94 9E 87 B1 FE 35 3B 72 50 88 21"
The process mscorsvw.exe:1912 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\State]
"AccumulatedWaitIdleTime" = "2340000"
The process fenopy.exe:1856 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2E 7E F2 5C B7 78 06 88 A0 20 EB FB BE D8 20 11"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\_ir_sf_temp_0]
"irsetup.exe" = "Setup Application"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The process dvprprld.exe:860 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "03 0B 59 BE B1 E4 13 C7 DE 59 56 E0 FF B8 B0 A0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The Trojan deletes the following value(s) in system registry:
The Trojan disables automatic startup of the application by deleting the following autorun value:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TurboTax 2012"
The process regsvr32.exe:332 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCR\CLSID\{F5078F39-C551-11D3-89B9-0000F81FE221}\InProcServer32]
"ThreadingModel" = "Apartment"
[HKCR\Interface\{2933BF89-7B36-11D2-B20E-00C04F983E60}]
"(Default)" = "IXMLDOMProcessingInstruction"
[HKCR\CLSID\{F5078F19-C551-11D3-89B9-0000F81FE221}\InProcServer32]
"ThreadingModel" = "Both"
[HKCR\Interface\{50EA08B1-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{2B8DE2FF-8D2D-11D1-B2FC-00C04FD915A9}]
"(Default)" = "IXMLElement2"
[HKCR\Interface\{24FB3297-302D-4620-BA39-3A732D850558}]
"(Default)" = "IVBSAXDTDHandler"
[HKCR\Interface\{310AFA62-0575-11D2-9CA9-0060B0EC3D39}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{F5078F37-C551-11D3-89B9-0000F81FE221}\InProcServer32]
"ThreadingModel" = "Apartment"
[HKCR\Msxml2.XMLSchemaCache\CurVer]
"(Default)" = "Msxml2.XMLSchemaCache.3.0"
[HKCR\Interface\{50EA08BD-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{2933BF86-7B36-11D2-B20E-00C04F983E60}]
"(Default)" = "IXMLDOMElement"
[HKCR\Interface\{0C05D096-F45B-4ACA-AD1A-AA0BC25518DC}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{2933BF85-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\xslfile\DefaultIcon]
"(Default)" = "%WinDir%\System32\msxml3.dll,1"
[HKCR\Interface\{50EA08BE-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{2E01311B-C322-4B0A-BD77-B90CFDC8DCE7}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{50EA08BC-DD1B-4664-9A50-C2F40F4BD79A}]
"(Default)" = "ISchemaAny"
[HKCR\CLSID\{AFB40FFD-B609-40A3-9828-F88BBE11E4E3}]
"(Default)" = "Server XML HTTP 3.0"
[HKCR\Interface\{50EA08B8-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{2933BF83-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{3EFAA425-272F-11D2-836F-0000F87A7782}]
"(Default)" = "IXTLRuntime"
[HKCR\Interface\{2ED7290A-4DD5-4B46-BB26-4E4155E77FAA}]
"(Default)" = "IVBSAXContentHandler"
[HKCR\Interface\{C90352F4-643C-4FBC-BB23-E996EB2D51FD}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{1299EB1B-5B88-433E-82DE-82CA75AD4E04}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Microsoft.XMLParser.1.0]
"(Default)" = "XML Parser"
[HKCR\Interface\{FA4BB38C-FAF9-4CCA-9302-D1DD0FE520DB}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{50EA08B7-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{2B8DE2FE-8D2D-11d1-B2FC-00C04FD915A9}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{4DD441AD-526D-4A77-9F1B-9841ED802FB0}\ProgID]
"(Default)" = "Msxml2.SAXAttributes"
[HKCR\CLSID\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}\ProgID]
"(Default)" = "Msxml2.DOMDocument"
[HKCR\Interface\{2933BF8B-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Msxml2.MXXMLWriter.3.0\CLSID]
"(Default)" = "{3D813DFE-6C91-4A4E-8F41-04346A841D9C}"
[HKCR\CLSID\{3E784A01-F3AE-4DC0-9354-9526B9370EBA}\InProcServer32]
"ThreadingModel" = "Apartment"
[HKCR\Interface\{50EA08B9-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{50EA08B8-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{FC220AD8-A72A-4EE8-926E-0B7AD152A020}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\Microsoft.XMLParser.1.0\CLSID]
"(Default)" = "{D2423620-51A0-11D2-9CAF-0060B0EC3D39}"
[HKCR\CLSID\{379E501F-B231-11D1-ADC1-00805FC752D8}\TypeLib]
"(Default)" = "{D63E0CE2-A0A2-11D0-9C02-00C04FC99C8E}"
[HKCR\CLSID\{F5078F39-C551-11D3-89B9-0000F81FE221}\VersionIndependentProgID]
"(Default)" = "Msxml2.DSOControl"
[HKCR\.xsl]
"(Default)" = "xslfile"
[HKCR\Interface\{FA4BB38C-FAF9-4CCA-9302-D1DD0FE520DB}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{D963D3FE-173C-4862-9095-B92F66995F52}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{8C033CAA-6CD6-4F73-B728-4531AF74945F}]
"(Default)" = "IVBSAXXMLReader"
[HKCR\Interface\{0C05D096-F45B-4ACA-AD1A-AA0BC25518DC}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{373984C8-B845-449B-91E7-45AC83036ADE}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Microsoft.XMLDOM\CLSID]
"(Default)" = "{2933BF90-7B36-11D2-B20E-00C04F983E60}"
[HKCR\Interface\{3EFAA427-272F-11D2-836F-0000F87A7782}]
"(Default)" = "XMLDOMDocumentEvents"
[HKCR\Interface\{65725580-9B5D-11D0-9BFE-00C04FC99C8E}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{2933BF93-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{50EA08B8-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{032AAC35-8C0E-4D9D-979F-E3B702935576}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{D2423620-51A0-11D2-9CAF-0060B0EC3D39}\VersionIndependentProgID]
"(Default)" = "Microsoft.XMLParser"
[HKCR\Interface\{0C05D096-F45B-4ACA-AD1A-AA0BC25518DC}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{1299EB1B-5B88-433E-82DE-82CA75AD4E04}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{F6D90F12-9C73-11D3-B32E-00C04F990BB4}]
"(Default)" = "Free Threaded XML DOM Document"
[HKCR\.xsl]
"Content Type" = "text/xml"
[HKCR\CLSID\{550DDA30-0541-11D2-9CA9-0060B0EC3D39}\Version]
"(Default)" = "1.0"
[HKCR\Interface\{50EA08B7-DD1B-4664-9A50-C2F40F4BD79A}]
"(Default)" = "ISchemaElement"
[HKCR\Interface\{3EFAA428-272F-11D2-836F-0000F87A7782}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{50EA08BB-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{AA634FC7-5888-44A7-A257-3A47150D3A0E}\TypeLib]
"Version" = "3.0"
[HKCR\CLSID\{373984C9-B845-449B-91E7-45AC83036ADE}\VersionIndependentProgID]
"(Default)" = "Msxml2.XMLSchemaCache"
[HKCR\CLSID\{F5078F19-C551-11D3-89B9-0000F81FE221}]
"(Default)" = "XML Parser"
[HKCR\Interface\{F10D27CC-3EC0-415C-8ED8-77AB1C5E7262}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Microsoft.XMLParser]
"(Default)" = "XML Parser"
[HKCR\Interface\{2933BF8A-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{F5078F34-C551-11D3-89B9-0000F81FE221}\InProcServer32]
"ThreadingModel" = "Both"
[HKCR\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\InProcServer32]
"ThreadingModel" = "Apartment"
[HKCR\Interface\{65725580-9B5D-11D0-9BFE-00C04FC99C8E}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{2933BF85-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{2933BF88-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{50EA08BE-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{2933BF80-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Msxml2.ServerXMLHTTP]
"(Default)" = "Server XML HTTP"
[HKCR\Interface\{C90352F5-643C-4FBC-BB23-E996EB2D51FD}]
"(Default)" = "IVBMXNamespaceManager"
[HKCR\CLSID\{2933BF90-7B36-11d2-B20E-00C04F983E60}\VersionList]
"3.0" = "%WinDir%\System32\msxml3.dll"
[HKCR\Interface\{3EFAA425-272F-11D2-836F-0000F87A7782}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{8C033CAA-6CD6-4F73-B728-4531AF74945F}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{3F7F31AC-E15F-11D0-9C25-00C04FC99C8E}]
"(Default)" = "IXMLElement"
[HKCR\CLSID\{F5078F33-C551-11D3-89B9-0000F81FE221}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\CLSID\{3D813DFE-6C91-4A4E-8F41-04346A841D9C}]
"(Default)" = "MXXMLWriter 3.0"
[HKCR\Interface\{F10D27CC-3EC0-415C-8ED8-77AB1C5E7262}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{50EA08B5-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{D2423620-51A0-11D2-9CAF-0060B0EC3D39}]
"(Default)" = "XML Parser"
[HKCR\CLSID\{989D1DC0-B162-11D1-B6EC-D27DDCF9A923}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\Interface\{1299EB1B-5B88-433E-82DE-82CA75AD4E04}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{2ED7290A-4DD5-4B46-BB26-4E4155E77FAA}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{2933BF8D-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{D4D4A0FC-3B73-11D1-B2B4-00C04FB92596}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{FA4BB38C-FAF9-4CCA-9302-D1DD0FE520DB}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{4DD441AD-526D-4A77-9F1B-9841ED802FB0}\InProcServer32]
"ThreadingModel" = "Apartment"
[HKCR\CLSID\{F6D90F14-9C73-11D3-B32E-00C04F990BB4}]
"(Default)" = "XML Data Source Object"
[HKCR\Interface\{50EA08B3-DD1B-4664-9A50-C2F40F4BD79A}]
"(Default)" = "ISchemaItem"
[HKCR\Interface\{AA634FC7-5888-44A7-A257-3A47150D3A0E}]
"(Default)" = "IXMLDOMSelection"
[HKCR\Interface\{50EA08B2-DD1B-4664-9A50-C2F40F4BD79A}]
"(Default)" = "ISchemaItemCollection"
[HKCR\CLSID\{3E784A01-F3AE-4DC0-9354-9526B9370EBA}\VersionIndependentProgID]
"(Default)" = "Msxml2.SAXAttributes"
[HKCR\CLSID\{FC220AD8-A72A-4EE8-926E-0B7AD152A020}]
"(Default)" = "MXXMLWriter"
[HKCR\Interface\{D4D4A0FC-3B73-11D1-B2B4-00C04FB92596}\TypeLib]
"Version" = "3.0"
[HKCR\Msxml2.XMLSchemaCache.3.0]
"(Default)" = "XML Schema Cache 3.0"
[HKCR\MSXML.DOMDocument]
"(Default)" = "XML DOM Document"
[HKCR\Interface\{2933BF8E-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{50EA08B2-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Msxml2.XMLSchemaCache\CLSID]
"(Default)" = "{373984C9-B845-449B-91E7-45AC83036ADE}"
[HKCR\CLSID\{F5078F34-C551-11D3-89B9-0000F81FE221}\ProgID]
"(Default)" = "Msxml2.XMLSchemaCache.3.0"
[HKCR\Interface\{FA4BB38C-FAF9-4CCA-9302-D1DD0FE520DB}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{2933BF8A-7B36-11D2-B20E-00C04F983E60}]
"(Default)" = "IXMLDOMCDATASection"
[HKCR\CLSID\{2933BF90-7B36-11d2-B20E-00C04F983E60}\SideBySide]
"RefCount" = "4"
[HKCR\CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}\VersionIndependentProgID]
"(Default)" = "Msxml2.DOMDocument"
[HKCR\CLSID\{989D1DC0-B162-11D1-B6EC-D27DDCF9A923}\Implemented Categories\{F0B7A1A2-9847-11CF-8F20-00805F2CD064}]
"(Default)" = ""
[HKCR\CLSID\{373984C9-B845-449B-91E7-45AC83036ADE}\ProgID]
"(Default)" = "Msxml2.XMLSchemaCache"
[HKCR\MSXML.DOMDocument\CurVer]
"(Default)" = "Microsoft.XMLDOM.1.0"
[HKCR\Interface\{ED8C108D-4349-11D2-91A4-00C04F7969E8}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{079AA557-4A18-424A-8EEE-E39F0A8D41B9}]
"(Default)" = "SAX XML Reader"
[HKCR\Interface\{ED8C108D-4349-11D2-91A4-00C04F7969E8}\TypeLib]
"Version" = "3.0"
[HKCR\CLSID\{3E784A01-F3AE-4DC0-9354-9526B9370EBA}]
"(Default)" = "SAXAttributes 3.0"
[HKCR\CLSID\{F5078F35-C551-11D3-89B9-0000F81FE221}\Version]
"(Default)" = "3.0"
[HKCR\Interface\{50EA08BA-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{50EA08BE-DD1B-4664-9A50-C2F40F4BD79A}]
"(Default)" = "ISchemaNotation"
[HKCR\CLSID\{48123BC4-99D9-11D1-A6B3-00C04FD91555}\Version]
"(Default)" = "1.0"
[HKCR\CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\CLSID\{FC220AD8-A72A-4EE8-926E-0B7AD152A020}\ProgID]
"(Default)" = "Msxml2.MXXMLWriter"
[HKCR\CLSID\{F5078F3F-C551-11D3-89B9-0000F81FE221}]
"(Default)" = "XML Moniker 3.0"
[HKCR\Interface\{2933BF80-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{550DDA30-0541-11D2-9CA9-0060B0EC3D39}\TypeLib]
"(Default)" = "{D63E0CE2-A0A2-11D0-9C02-00C04FC99C8E}"
[HKCR\Interface\{2933BF81-7B36-11D2-B20E-00C04F983E60}]
"(Default)" = "IXMLDOMDocument"
[HKCR\CLSID\{2933BF94-7B36-11D2-B20E-00C04F983E60}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\CLSID\{2933BF90-7B36-11d2-B20E-00C04F983E60}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\Interface\{808F4E35-8D5A-4FBE-8466-33A41279ED30}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{ED8C108E-4349-11D2-91A4-00C04F7969E8}]
"(Default)" = "XML HTTP Request"
[HKCR\Interface\{C90352F4-643C-4FBC-BB23-E996EB2D51FD}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Msxml2.MXXMLWriter\CLSID]
"(Default)" = "{FC220AD8-A72A-4EE8-926E-0B7AD152A020}"
[HKCR\Interface\{65725580-9B5D-11D0-9BFE-00C04FC99C8E}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{2B8DE2FE-8D2D-11d1-B2FC-00C04FD915A9}\TypeLib]
"Version" = "3.0"
[HKCR\Msxml2.SAXXMLReader\CurVer]
"(Default)" = "Msxml2.SAXXMLReader.3.0"
[HKCR\MIME\Database\Content Type\application/xml]
"Encoding" = "08 00 00 00"
[HKCR\Interface\{F52E2B61-18A1-11D1-B105-00805F49916B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{3E784A01-F3AE-4DC0-9354-9526B9370EBA}\ProgID]
"(Default)" = "Msxml2.SAXAttributes.3.0"
[HKCR\CLSID\{2933BF91-7B36-11D2-B20E-00C04F983E60}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\Interface\{796E7AC5-5AA2-4EFF-ACAD-3FAAF01A3288}\TypeLib]
"Version" = "3.0"
[HKCR\CLSID\{AFB40FFD-B609-40A3-9828-F88BBE11E4E3}\ProgID]
"(Default)" = "Msxml2.ServerXMLHTTP.3.0"
[HKCR\MSXML.FreeThreadedDOMDocument\CLSID]
"(Default)" = "{2933BF91-7B36-11D2-B20E-00C04F983E60}"
[HKCR\CLSID\{4DD441AD-526D-4A77-9F1B-9841ED802FB0}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\Msxml2.ServerXMLHTTP\CLSID]
"(Default)" = "{AFBA6B42-5692-48EA-8141-DC517DCF0EF1}"
[HKCR\Interface\{8C033CAA-6CD6-4F73-B728-4531AF74945F}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{2B8DE2FF-8D2D-11D1-B2FC-00C04FD915A9}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{50EA08BD-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\.xml]
"Content Type" = "text/xml"
[HKCR\Interface\{2933BF93-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"Version" = "3.0"
[HKCR\Msxml2.XMLHTTP]
"(Default)" = "XML HTTP"
[HKCR\Msxml2.XMLParser]
"(Default)" = "XML Parser"
[HKCR\Interface\{2933BF84-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{AA634FC7-5888-44A7-A257-3A47150D3A0E}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{F6D90F14-9C73-11D3-B32E-00C04F990BB4}\VersionIndependentProgID]
"(Default)" = "Msxml2.DSOControl"
[HKCR\Interface\{2933BF95-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{50EA08B0-DD1B-4664-9A50-C2F40F4BD79A}]
"(Default)" = "IXMLDOMSchemaCollection2"
[HKCR\Interface\{796E7AC5-5AA2-4EFF-ACAD-3FAAF01A3288}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Microsoft.XMLDSO.1.0\CLSID]
"(Default)" = "{550DDA30-0541-11D2-9CA9-0060B0EC3D39}"
[HKCR\CLSID\{F5078F36-C551-11D3-89B9-0000F81FE221}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\CLSID\{F5078F40-C551-11D3-89B9-0000F81FE221}\Version]
"(Default)" = "3.0"
[HKCR\Interface\{2933BF87-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{D2423620-51A0-11D2-9CAF-0060B0EC3D39}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\CLSID\{F5078F34-C551-11D3-89B9-0000F81FE221}\Version]
"(Default)" = "3.0"
[HKCR\Interface\{50EA08B6-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{3EFAA427-272F-11D2-836F-0000F87A7782}\ProxyStubClsid]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"
[HKCR\Msxml2.MXXMLWriter]
"(Default)" = "MXXMLWriter"
[HKCR\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\CLSID\{AFB40FFD-B609-40A3-9828-F88BBE11E4E3}\VersionIndependentProgID]
"(Default)" = "Msxml2.ServerXMLHTTP"
[HKCR\CLSID\{2933BF91-7B36-11D2-B20E-00C04F983E60}\Version]
"(Default)" = "1.0"
[HKCR\CLSID\{2933BF94-7B36-11D2-B20E-00C04F983E60}]
"(Default)" = "XSL Template"
[HKCR\MIME\Database\Content Type\text/xml]
"Extension" = ".xml"
[HKCR\Interface\{2933BF95-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{2B8DE2FF-8D2D-11D1-B2FC-00C04FD915A9}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{3EFAA413-272F-11D2-836F-0000F87A7782}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{2E9196BF-13BA-4DD4-91CA-6C571F281495}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\xmlfile]
"FriendlyTypeName" = "@%WinDir%\System32\msxml3r.dll,-1"
[HKCR\Interface\{2933BF88-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{808F4E35-8D5A-4FBE-8466-33A41279ED30}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\3.0]
"(Default)" = "Microsoft XML, v3.0"
[HKCR\Interface\{50EA08B4-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
"Version" = "3.0"
[HKCR\CLSID\{F5078F33-C551-11D3-89B9-0000F81FE221}\VersionIndependentProgID]
"(Default)" = "Msxml2.FreeThreadedDOMDocument"
[HKCR\CLSID\{F5078F27-C551-11D3-89B9-0000F81FE221}\Version]
"(Default)" = "3.0"
[HKCR\Interface\{50EA08B3-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{550DDA30-0541-11D2-9CA9-0060B0EC3D39}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\Interface\{0C05D096-F45B-4ACA-AD1A-AA0BC25518DC}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{3EFAA425-272F-11D2-836F-0000F87A7782}\TypeLib]
"Version" = "3.0"
[HKCR\CLSID\{F5078F40-C551-11D3-89B9-0000F81FE221}]
"(Default)" = "XML Document 3.0"
[HKCR\Microsoft.XMLDOM\CurVer]
"(Default)" = "Microsoft.XMLDOM.1.0"
[HKCR\Interface\{E8917260-7579-4BE1-B5DD-7AFBFA6F077B}]
"(Default)" = "IVBSAXDeclHandler"
[HKCR\CLSID\{AFBA6B42-5692-48EA-8141-DC517DCF0EF1}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{C90352F4-643C-4FBC-BB23-E996EB2D51FD}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Microsoft.FreeThreadedXMLDOM]
"(Default)" = "Free Threaded XML DOM Document"
[HKCR\Msxml2.SAXAttributes\CLSID]
"(Default)" = "{4DD441AD-526D-4A77-9F1B-9841ED802FB0}"
[HKCR\CLSID\{CFC399AF-D876-11D0-9C10-00C04FC99C8E}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\Msxml2.DSOControl\CLSID]
"(Default)" = "{F6D90F14-9C73-11D3-B32E-00C04F990BB4}"
[HKCR\Interface\{2933BF82-7B36-11D2-B20E-00C04F983E60}]
"(Default)" = "IXMLDOMNodeList"
[HKCR\Msxml2.FreeThreadedDOMDocument.3.0]
"(Default)" = "Free Threaded XML DOM Document 3.0"
[HKCR\Interface\{50EA08BD-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{3124C396-FB13-4836-A6AD-1317F1713688}\VersionIndependentProgID]
"(Default)" = "Msxml2.SAXXMLReader"
[HKCR\Interface\{3EFAA428-272F-11D2-836F-0000F87A7782}\TypeLib]
"Version" = "3.0"
[HKCR\xmlfile\CLSID]
"(Default)" = "{48123BC4-99D9-11D1-A6B3-00C04FD91555}"
[HKCR\Interface\{2933BF81-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\xslfile]
"EditFlags" = "00 00 01 00"
[HKCR\CLSID\{3E784A01-F3AE-4DC0-9354-9526B9370EBA}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\Interface\{2933BF8C-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{379E501F-B231-11D1-ADC1-00805FC752D8}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\Interface\{3EFAA427-272F-11D2-836F-0000F87A7782}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{796E7AC5-5AA2-4EFF-ACAD-3FAAF01A3288}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{2933BF8A-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{2933BF8F-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{E8917260-7579-4BE1-B5DD-7AFBFA6F077B}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\VersionIndependentProgID]
"(Default)" = "Msxml2.XMLHTTP"
[HKCR\Interface\{50EA08B6-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{2933BF87-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{50EA08B4-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\xslfile\shell\Open\ddeexec]
"(Default)" = "file:%1,,-1,,,,,"
[HKCR\xslfile\shell\Open\ddeexec\application]
"(Default)" = "IExplore"
[HKCR\CLSID\{4DD441AD-526D-4A77-9F1B-9841ED802FB0}]
"(Default)" = "SAXAttributes"
[HKCR\Interface\{50EA08B2-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{2933BF83-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{50EA08BE-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{FC220AD8-A72A-4EE8-926E-0B7AD152A020}\Version]
"(Default)" = "3.0"
[HKCR\CLSID\{079AA557-4A18-424A-8EEE-E39F0A8D41B9}\VersionIndependentProgID]
"(Default)" = "Msxml2.SAXXMLReader"
[HKCR\Interface\{50EA08B0-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{F5078F33-C551-11D3-89B9-0000F81FE221}\InProcServer32]
"ThreadingModel" = "Both"
[HKCR\Interface\{50EA08B0-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
"Version" = "3.0"
[HKCR\Msxml2.XMLSchemaCache]
"(Default)" = "XML Schema Cache"
[HKCR\Interface\{3EFAA413-272F-11D2-836F-0000F87A7782}]
"(Default)" = "IXMLDOMDocumentFragment"
[HKCR\Msxml2.XSLTemplate\CurVer]
"(Default)" = "Msxml2.XSLTemplate.3.0"
[HKCR\Microsoft.FreeThreadedXMLDOM.1.0\CLSID]
"(Default)" = "{2933BF91-7B36-11D2-B20E-00C04F983E60}"
[HKCR\CLSID\{F5078F35-C551-11D3-89B9-0000F81FE221}]
"(Default)" = "XML HTTP 3.0"
[HKCR\CLSID\{F5078F27-C551-11D3-89B9-0000F81FE221}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\Microsoft.XMLHTTP.1.0]
"(Default)" = "XML HTTP Request"
[HKCR\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\3.0\0\win32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\Interface\{2933BF82-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{2933BF8C-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{2933BF89-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{50EA08B5-DD1B-4664-9A50-C2F40F4BD79A}]
"(Default)" = "ISchemaParticle"
[HKCR\CLSID\{F5078F34-C551-11D3-89B9-0000F81FE221}]
"(Default)" = "XML Schema Cache 3.0"
[HKCR\Interface\{310AFA62-0575-11D2-9CA9-0060B0EC3D39}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{2933BF92-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{50EA08BA-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{2933BF83-7B36-11D2-B20E-00C04F983E60}]
"(Default)" = "IXMLDOMNamedNodeMap"
[HKCR\Interface\{8C033CAA-6CD6-4F73-B728-4531AF74945F}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\XML\CLSID]
"(Default)" = "{989D1DC0-B162-11D1-B6EC-D27DDCF9A923}"
[HKCR\CLSID\{AFBA6B42-5692-48EA-8141-DC517DCF0EF1}\InProcServer32]
"ThreadingModel" = "Apartment"
[HKCR\Interface\{032AAC35-8C0E-4D9D-979F-E3B702935576}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{2933BF81-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Msxml2.XSLTemplate\CLSID]
"(Default)" = "{2933BF94-7B36-11D2-B20E-00C04F983E60}"
[HKCR\CLSID\{AFBA6B42-5692-48EA-8141-DC517DCF0EF1}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\Interface\{4D7FF4BA-1565-4EA8-94E1-6E724A46F98D}]
"(Default)" = "IMXWriter"
[HKCR\CLSID\{2933BF90-7B36-11d2-B20E-00C04F983E60}\ProgID]
"(Default)" = "Microsoft.XMLDOM.1.0"
[HKCR\Interface\{50EA08B9-DD1B-4664-9A50-C2F40F4BD79A}]
"(Default)" = "ISchemaComplexType"
[HKCR\Interface\{FA4BB38C-FAF9-4CCA-9302-D1DD0FE520DB}]
"(Default)" = "IMXSchemaDeclHandler"
[HKCR\CLSID\{F6D90F14-9C73-11D3-B32E-00C04F990BB4}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\Msxml2.MXXMLWriter.3.0]
"(Default)" = "MXXMLWriter 3.0"
[HKCR\CLSID\{F5078F37-C551-11D3-89B9-0000F81FE221}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\CLSID\{F5078F40-C551-11D3-89B9-0000F81FE221}\InProcServer32]
"ThreadingModel" = "Apartment"
[HKCR\Interface\{C90352F5-643C-4FBC-BB23-E996EB2D51FD}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{3124C396-FB13-4836-A6AD-1317F1713688}\InProcServer32]
"ThreadingModel" = "Both"
[HKCR\Interface\{2933BF8D-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"Version" = "3.0"
[HKCR\CLSID\{079AA557-4A18-424A-8EEE-E39F0A8D41B9}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\CLSID\{FC220AD8-A72A-4EE8-926E-0B7AD152A020}\InProcServer32]
"ThreadingModel" = "Both"
[HKCR\CLSID\{3124C396-FB13-4836-A6AD-1317F1713688}\ProgID]
"(Default)" = "Msxml2.SAXXMLReader.3.0"
[HKCR\CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}\InProcServer32]
"ThreadingModel" = "Both"
[HKCR\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}]
"(Default)" = "XML HTTP"
[HKCR\CLSID\{F5078F39-C551-11D3-89B9-0000F81FE221}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\xmlfile]
"(Default)" = "XML Document"
[HKCR\Interface\{2933BF8C-7B36-11D2-B20E-00C04F983E60}]
"(Default)" = "IXMLDOMNotation"
[HKCR\CLSID\{48123BC4-99D9-11D1-A6B3-00C04FD91555}\BrowseInPlace]
"(Default)" = ""
[HKCR\xmlfile\shell\Open\ddeexec]
"(Default)" = "file:%1,,-1,,,,,"
[HKCR\Interface\{50EA08B5-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{50EA08B4-DD1B-4664-9A50-C2F40F4BD79A}]
"(Default)" = "ISchema"
[HKCR\Interface\{2933BF8F-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"Version" = "3.0"
[HKCR\Msxml2.SAXXMLReader\CLSID]
"(Default)" = "{079AA557-4A18-424A-8EEE-E39F0A8D41B9}"
[HKCR\Interface\{10DC0586-132B-4CAC-8BB3-DB00AC8B7EE0}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{3EFAA426-272F-11D2-836F-0000F87A7782}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{989D1DC0-B162-11D1-B6EC-D27DDCF9A923}\InProcServer32]
"ThreadingModel" = "Both"
[HKCR\CLSID\{379E501F-B231-11D1-ADC1-00805FC752D8}\InProcServer32]
"ThreadingModel" = "Apartment"
[HKCR\CLSID\{7E3FCEA1-31B4-11D2-AE1F-0080C7337EA1}]
"(Default)" = "XML Viewer Moniker"
[HKCR\Interface\{2933BF8E-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{F5078F36-C551-11D3-89B9-0000F81FE221}\InProcServer32]
"ThreadingModel" = "Both"
[HKCR\Interface\{F52E2B61-18A1-11D1-B105-00805F49916B}]
"(Default)" = "IXMLDocument"
[HKCR\Msxml]
"(Default)" = "Msxml"
[HKCR\Interface\{2933BF8A-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"Version" = "3.0"
[HKCR\CLSID\{F5078F3F-C551-11D3-89B9-0000F81FE221}\InProcServer32]
"ThreadingModel" = "Apartment"
[HKCR\Interface\{F10D27CC-3EC0-415C-8ED8-77AB1C5E7262}]
"(Default)" = "IMXAttributes"
[HKCR\Interface\{2933BF86-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"Version" = "3.0"
[HKCR\CLSID\{F6D90F12-9C73-11D3-B32E-00C04F990BB4}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\Microsoft.XMLDSO\CLSID]
"(Default)" = "{550DDA30-0541-11D2-9CA9-0060B0EC3D39}"
[HKCR\CLSID\{3D813DFE-6C91-4A4E-8F41-04346A841D9C}\InProcServer32]
"ThreadingModel" = "Both"
[HKCR\Interface\{2933BF85-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{F52E2B61-18A1-11D1-B105-00805F49916B}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{F5078F36-C551-11D3-89B9-0000F81FE221}\VersionIndependentProgID]
"(Default)" = "Msxml2.XSLTemplate"
[HKCR\Interface\{3F7F31AC-E15F-11D0-9C25-00C04FC99C8E}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{2933BF85-7B36-11D2-B20E-00C04F983E60}]
"(Default)" = "IXMLDOMAttribute"
[HKCR\Msxml2.SAXAttributes]
"(Default)" = "SAXAttributes"
[HKCR\Interface\{50EA08BA-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{2933BF82-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{808F4E35-8D5A-4FBE-8466-33A41279ED30}]
"(Default)" = "IMXReaderControl"
[HKCR\CLSID\{079AA557-4A18-424A-8EEE-E39F0A8D41B9}\ProgID]
"(Default)" = "Msxml2.SAXXMLReader"
[HKCR\Interface\{50EA08BC-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{2933BF95-7B36-11D2-B20E-00C04F983E60}]
"(Default)" = "IXMLDOMDocument2"
[HKCR\CLSID\{D2423620-51A0-11D2-9CAF-0060B0EC3D39}\Version]
"(Default)" = "1.0"
[HKCR\Interface\{2933BF8B-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"Version" = "3.0"
[HKCR\Msxml2.SAXAttributes.3.0]
"(Default)" = "SAXAttributes 3.0"
[HKCR\CLSID\{7E3FCEA1-31B4-11D2-AE1F-0080C7337EA1}\InProcServer32]
"ThreadingModel" = "Apartment"
[HKCR\Interface\{2933BF89-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"Version" = "3.0"
[HKCR\CLSID\{F5078F41-C551-11D3-89B9-0000F81FE221}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\Interface\{373984C8-B845-449B-91E7-45AC83036ADE}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{3124C396-FB13-4836-A6AD-1317F1713688}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\Interface\{24FB3297-302D-4620-BA39-3A732D850558}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{2933BF80-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Msxml2.DOMDocument\CLSID]
"(Default)" = "{F6D90F11-9C73-11D3-B32E-00C04F990BB4}"
[HKCR\CLSID\{F5078F35-C551-11D3-89B9-0000F81FE221}\VersionIndependentProgID]
"(Default)" = "Msxml2.XMLHTTP"
[HKCR\Interface\{2933BF80-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{2933BF82-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{50EA08BB-DD1B-4664-9A50-C2F40F4BD79A}]
"(Default)" = "ISchemaModelGroup"
[HKCR\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\3.0\FLAGS]
"(Default)" = "0"
[HKCR\Interface\{50EA08BC-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{4D7FF4BA-1565-4EA8-94E1-6E724A46F98D}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{2933BF91-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"(Default)" = "{D63E0CE2-A0A2-11D0-9C02-00C04FC99C8E}"
[HKCR\Interface\{50EA08B3-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
"Version" = "3.0"
[HKCR\CLSID\{48123BC4-99D9-11D1-A6B3-00C04FD91555}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\CLSID\{2933BF90-7B36-11d2-B20E-00C04F983E60}\TypeLib]
"(Default)" = "{D63E0CE2-A0A2-11D0-9C02-00C04FC99C8E}"
[HKCR\CLSID\{989D1DC0-B162-11D1-B6EC-D27DDCF9A923}]
"(Default)" = "XML Script Engine"
[HKCR\CLSID\{2933BF94-7B36-11D2-B20E-00C04F983E60}\ProgID]
"(Default)" = "Msxml2.XSLTemplate"
[HKCR\Interface\{2E01311B-C322-4B0A-BD77-B90CFDC8DCE7}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{2933BF92-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"Version" = "3.0"
[HKCR\CLSID\{48123BC4-99D9-11D1-A6B3-00C04FD91555}\DefaultIcon]
"(Default)" = "%WinDir%\System32\msxml3.dll,0"
[HKCR\Interface\{2ED7290A-4DD5-4B46-BB26-4E4155E77FAA}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{8C033CAA-6CD6-4F73-B728-4531AF74945F}\TypeLib]
"Version" = "3.0"
[HKCR\CLSID\{2933BF90-7B36-11d2-B20E-00C04F983E60}\Version]
"(Default)" = "1.0"
[HKCR\Interface\{3F7F31AC-E15F-11D0-9C25-00C04FC99C8E}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{F5078F3F-C551-11D3-89B9-0000F81FE221}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\CLSID\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{2933BF94-7B36-11D2-B20E-00C04F983E60}\InProcServer32]
"ThreadingModel" = "Both"
[HKCR\CLSID\{3D813DFE-6C91-4A4E-8F41-04346A841D9C}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\Interface\{3EFAA413-272F-11D2-836F-0000F87A7782}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{3EFAA428-272F-11D2-836F-0000F87A7782}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{ED8C108E-4349-11D2-91A4-00C04F7969E8}\TypeLib]
"(Default)" = "{D63E0CE2-A0A2-11D0-9C02-00C04FC99C8E}"
[HKCR\CLSID\{2933BF94-7B36-11D2-B20E-00C04F983E60}\VersionIndependentProgID]
"(Default)" = "Msxml2.XSLTemplate"
[HKCR\CLSID\{F6D90F14-9C73-11D3-B32E-00C04F990BB4}\Version]
"(Default)" = "3.0"
[HKCR\Microsoft.XMLDOM]
"(Default)" = "XML DOM Document"
[HKCR\xslfile]
"(Default)" = "XSL Stylesheet"
[HKCR\CLSID\{3124C396-FB13-4836-A6AD-1317F1713688}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{F5078F39-C551-11D3-89B9-0000F81FE221}\Version]
"(Default)" = "3.0"
[HKCR\CLSID\{AFBA6B42-5692-48EA-8141-DC517DCF0EF1}\VersionIndependentProgID]
"(Default)" = "Msxml2.ServerXMLHTTP"
[HKCR\CLSID\{3124C396-FB13-4836-A6AD-1317F1713688}]
"(Default)" = "SAX XML Reader 3.0"
[HKCR\Interface\{50EA08B4-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{2E9196BF-13BA-4DD4-91CA-6C571F281495}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Microsoft.XMLDSO]
"(Default)" = "XML Data Source Object"
[HKCR\CLSID\{CFC399AF-D876-11D0-9C10-00C04FC99C8E}\ProgID]
"(Default)" = "Msxml"
[HKCR\CLSID\{F5078F36-C551-11D3-89B9-0000F81FE221}]
"(Default)" = "XSL Template 3.0"
[HKCR\Interface\{AA634FC7-5888-44A7-A257-3A47150D3A0E}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\xslfile\CLSID]
"(Default)" = "{48123BC4-99D9-11D1-A6B3-00C04FD91555}"
[HKCR\CLSID\{F5078F27-C551-11D3-89B9-0000F81FE221}\InProcServer32]
"ThreadingModel" = "Apartment"
[HKCR\Interface\{2933BF8D-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{3D813DFE-6C91-4A4E-8F41-04346A841D9C}\ProgID]
"(Default)" = "Msxml2.MXXMLWriter.3.0"
[HKCR\CLSID\{2933BF91-7B36-11D2-B20E-00C04F983E60}\ProgID]
"(Default)" = "Microsoft.FreeThreadedXMLDOM.1.0"
[HKCR\Interface\{2933BF93-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{F5078F39-C551-11D3-89B9-0000F81FE221}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{373984C8-B845-449B-91E7-45AC83036ADE}]
"(Default)" = "IXMLDOMSchemaCollection"
[HKCR\Interface\{50EA08B1-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
"Version" = "3.0"
[HKCR\CLSID\{F5078F19-C551-11D3-89B9-0000F81FE221}\VersionIndependentProgID]
"(Default)" = "Msxml2.XMLParser"
[HKCR\Interface\{50EA08B6-DD1B-4664-9A50-C2F40F4BD79A}]
"(Default)" = "ISchemaAttribute"
[HKCR\CLSID\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}\InProcServer32]
"ThreadingModel" = "Both"
[HKCR\Interface\{2933BF86-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{24FB3297-302D-4620-BA39-3A732D850558}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}]
"(Default)" = "XML DOM Document 3.0"
[HKCR\Interface\{2933BF8C-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"Version" = "3.0"
[HKCR\Msxml2.SAXXMLReader.3.0\CLSID]
"(Default)" = "{3124C396-FB13-4836-A6AD-1317F1713688}"
[HKCR\CLSID\{ED8C108E-4349-11D2-91A4-00C04F7969E8}\InProcServer32]
"ThreadingModel" = "Apartment"
[HKCR\CLSID\{373984C9-B845-449B-91E7-45AC83036ADE}\InProcServer32]
"ThreadingModel" = "Both"
[HKCR\CLSID\{F6D90F12-9C73-11D3-B32E-00C04F990BB4}\VersionIndependentProgID]
"(Default)" = "Msxml2.FreeThreadedDOMDocument"
[HKCR\Interface\{D963D3FE-173C-4862-9095-B92F66995F52}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{3EFAA427-272F-11D2-836F-0000F87A7782}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"
[HKCR\Interface\{032AAC35-8C0E-4D9D-979F-E3B702935576}]
"(Default)" = "IVBSAXLexicalHandler"
[HKCR\Interface\{796E7AC5-5AA2-4EFF-ACAD-3FAAF01A3288}]
"(Default)" = "IVBSAXLocator"
[HKCR\CLSID\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}\Version]
"(Default)" = "3.0"
[HKCR\CLSID\{ED8C108E-4349-11D2-91A4-00C04F7969E8}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\CLSID\{F5078F33-C551-11D3-89B9-0000F81FE221}\ProgID]
"(Default)" = "Msxml2.FreeThreadedDOMDocument.3.0"
[HKCR\CLSID\{F5078F19-C551-11D3-89B9-0000F81FE221}\Version]
"(Default)" = "3.0"
[HKCR\Interface\{4D7FF4BA-1565-4EA8-94E1-6E724A46F98D}\TypeLib]
"Version" = "3.0"
[HKCR\CLSID\{3E784A01-F3AE-4DC0-9354-9526B9370EBA}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{3EFAA428-272F-11D2-836F-0000F87A7782}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{2933BF89-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{AFB40FFD-B609-40A3-9828-F88BBE11E4E3}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\Msxml2.FreeThreadedDOMDocument]
"(Default)" = "Free Threaded XML DOM Document"
[HKCR\CLSID\{AFBA6B42-5692-48EA-8141-DC517DCF0EF1}\ProgID]
"(Default)" = "Msxml2.ServerXMLHTTP"
[HKCR\Interface\{C90352F4-643C-4FBC-BB23-E996EB2D51FD}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{3124C396-FB13-4836-A6AD-1317F1713688}\Version]
"(Default)" = "3.0"
[HKCR\Interface\{2933BF8B-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{ED8C108E-4349-11D2-91A4-00C04F7969E8}\VersionIndependentProgID]
"(Default)" = "Microsoft.XMLHTTP"
[HKCR\Interface\{50EA08BD-DD1B-4664-9A50-C2F40F4BD79A}]
"(Default)" = "ISchemaIdentityConstraint"
[HKCR\CLSID\{550DDA30-0541-11D2-9CA9-0060B0EC3D39}\InProcServer32]
"ThreadingModel" = "Apartment"
[HKCR\Interface\{310AFA62-0575-11D2-9CA9-0060B0EC3D39}\TypeLib]
"Version" = "3.0"
[HKCR\CLSID\{F5078F35-C551-11D3-89B9-0000F81FE221}\InProcServer32]
"ThreadingModel" = "Apartment"
[HKCR\Interface\{50EA08B7-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{2933BF8A-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{2933BF87-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{2933BF83-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{C90352F7-643C-4FBC-BB23-E996EB2D51FD}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{2ED7290A-4DD5-4B46-BB26-4E4155E77FAA}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Msxml2.XMLHTTP.3.0\CLSID]
"(Default)" = "{F5078F35-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{F5078F37-C551-11D3-89B9-0000F81FE221}\Version]
"(Default)" = "3.0"
[HKCR\Interface\{50EA08BB-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{2E9196BF-13BA-4DD4-91CA-6C571F281495}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Microsoft.XMLHTTP]
"(Default)" = "XML HTTP Request"
[HKCR\Msxml2.FreeThreadedDOMDocument\CurVer]
"(Default)" = "Msxml2.FreeThreadedDOMDocument.3.0"
[HKCR\Interface\{2933BF86-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{48123BC4-99D9-11D1-A6B3-00C04FD91555}\MiscStatus]
"(Default)" = "2228625"
[HKCR\Interface\{4D7FF4BA-1565-4EA8-94E1-6E724A46F98D}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{2933BF96-7B36-11D2-B20E-00C04F983E60}]
"(Default)" = "IXMLDOMDocument3"
[HKCR\Interface\{3EFAA426-272F-11D2-836F-0000F87A7782}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{24FB3297-302D-4620-BA39-3A732D850558}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{2933BF8F-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{F5078F35-C551-11D3-89B9-0000F81FE221}\ProgID]
"(Default)" = "Msxml2.XMLHTTP.3.0"
[HKCR\Microsoft.XMLDSO.1.0]
"(Default)" = "XML Data Source Object"
[HKCR\Msxml2.XMLParser\CLSID]
"(Default)" = "{F5078F19-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{FC220AD8-A72A-4EE8-926E-0B7AD152A020}\VersionIndependentProgID]
"(Default)" = "Msxml2.MXXMLWriter"
[HKCR\Msxml2.XMLParser.3.0\CLSID]
"(Default)" = "{F5078F31-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{F6D90F14-9C73-11D3-B32E-00C04F990BB4}\InProcServer32]
"ThreadingModel" = "Apartment"
[HKCR\CLSID\{D2423620-51A0-11D2-9CAF-0060B0EC3D39}\ProgID]
"(Default)" = "Microsoft.XMLParser.1.0"
[HKCR\Interface\{C90352F5-643C-4FBC-BB23-E996EB2D51FD}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{50EA08B3-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{50EA08B0-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Microsoft.XMLHTTP\CurVer]
"(Default)" = "Microsoft.XMLHTTP.1.0"
[HKCR\CLSID\{F5078F40-C551-11D3-89B9-0000F81FE221}\DefaultIcon]
"(Default)" = "%WinDir%\System32\msxml3.dll,0"
[HKCR\CLSID\{373984C9-B845-449B-91E7-45AC83036ADE}]
"(Default)" = "XML Schema Cache"
[HKCR\CLSID\{373984C9-B845-449B-91E7-45AC83036ADE}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\Interface\{50EA08B1-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{2933BF92-7B36-11D2-B20E-00C04F983E60}]
"(Default)" = "IXSLProcessor"
[HKCR\Interface\{D963D3FE-173C-4862-9095-B92F66995F52}]
"(Default)" = "IVBSAXErrorHandler"
[HKCR\CLSID\{F5078F39-C551-11D3-89B9-0000F81FE221}\ProgID]
"(Default)" = "Msxml2.DSOControl.3.0"
[HKCR\CLSID\{989D1DC0-B162-11D1-B6EC-D27DDCF9A923}\OLEScript]
"(Default)" = ""
[HKCR\CLSID\{3D813DFE-6C91-4A4E-8F41-04346A841D9C}\VersionIndependentProgID]
"(Default)" = "Msxml2.MXXMLWriter"
[HKCR\xmlfile\shell\Open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"
[HKCR\Microsoft.XMLDOM.1.0]
"(Default)" = "XML DOM Document"
[HKCR\Msxml2.XMLSchemaCache.3.0\CLSID]
"(Default)" = "{F5078F34-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{2933BF84-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{50EA08B0-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{50EA08BE-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{989D1DC0-B162-11D1-B6EC-D27DDCF9A923}\Implemented Categories\{F0B7A1A1-9847-11CF-8F20-00805F2CD064}]
"(Default)" = ""
[HKCR\CLSID\{F6D90F14-9C73-11D3-B32E-00C04F990BB4}\ProgID]
"(Default)" = "Msxml2.DSOControl"
[HKCR\Interface\{2933BF92-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{079AA557-4A18-424A-8EEE-E39F0A8D41B9}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Msxml2.ServerXMLHTTP.3.0\CLSID]
"(Default)" = "{AFB40FFD-B609-40A3-9828-F88BBE11E4E3}"
[HKCR\Interface\{2933BF95-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{373984C9-B845-449B-91E7-45AC83036ADE}\Version]
"(Default)" = "3.0"
[HKCR\Interface\{2933BF85-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{2933BF84-7B36-11D2-B20E-00C04F983E60}]
"(Default)" = "IXMLDOMCharacterData"
[HKCR\CLSID\{F5078F31-C551-11D3-89B9-0000F81FE221}\ProgID]
"(Default)" = "Msxml2.XMLParser.3.0"
[HKCR\CLSID\{F5078F33-C551-11D3-89B9-0000F81FE221}]
"(Default)" = "Free Threaded XML DOM Document 3.0"
[HKCR\CLSID\{AFB40FFD-B609-40A3-9828-F88BBE11E4E3}\Version]
"(Default)" = "3.0"
[HKCR\Interface\{2933BF86-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{F5078F19-C551-11D3-89B9-0000F81FE221}\ProgID]
"(Default)" = "Msxml2.XMLParser"
[HKCR\CLSID\{379E501F-B231-11D1-ADC1-00805FC752D8}]
"(Default)" = "MsxmlIsland"
[HKCR\Interface\{3EFAA429-272F-11D2-836F-0000F87A7782}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{2933BF8B-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{AA634FC7-5888-44A7-A257-3A47150D3A0E}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\XML]
"(Default)" = "XML Script Engine"
[HKCR\Interface\{2B8DE2FF-8D2D-11D1-B2FC-00C04FD915A9}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{2933BF90-7B36-11d2-B20E-00C04F983E60}\InProcServer32]
"ThreadingModel" = "Both"
[HKCR\Msxml\CLSID]
"(Default)" = "{CFC399AF-D876-11D0-9C10-00C04FC99C8E}"
[HKCR\Msxml2.DSOControl\CurVer]
"(Default)" = "Msxml2.DSOControl.3.0"
[HKCR\CLSID\{373984C9-B845-449B-91E7-45AC83036ADE}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{2933BF82-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Msxml2.ServerXMLHTTP\CurVer]
"(Default)" = "Msxml2.ServerXMLHTTP.3.0"
[HKCR\Interface\{65725580-9B5D-11D0-9BFE-00C04FC99C8E}\TypeLib]
"Version" = "3.0"
[HKCR\Msxml2.XMLHTTP\CurVer]
"(Default)" = "Msxml2.XMLHTTP.3.0"
[HKCR\Interface\{50EA08B9-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{2933BF88-7B36-11D2-B20E-00C04F983E60}]
"(Default)" = "IXMLDOMComment"
[HKCR\CLSID\{079AA557-4A18-424A-8EEE-E39F0A8D41B9}\InProcServer32]
"ThreadingModel" = "Both"
[HKCR\CLSID\{AFB40FFD-B609-40A3-9828-F88BBE11E4E3}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{F52E2B61-18A1-11D1-B105-00805F49916B}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Msxml2.DSOControl.3.0]
"(Default)" = "XML Data Source Object 3.0"
[HKCR\CLSID\{D2423620-51A0-11D2-9CAF-0060B0EC3D39}\InProcServer32]
"ThreadingModel" = "Both"
[HKCR\CLSID\{3E784A01-F3AE-4DC0-9354-9526B9370EBA}\Version]
"(Default)" = "3.0"
[HKCR\.xml]
"(Default)" = "xmlfile"
[HKCR\CLSID\{F5078F41-C551-11D3-89B9-0000F81FE221}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{50EA08BC-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
"Version" = "3.0"
[HKCR\CLSID\{550DDA30-0541-11D2-9CA9-0060B0EC3D39}]
"(Default)" = "XML Data Source Object"
[HKCR\CLSID\{F5078F31-C551-11D3-89B9-0000F81FE221}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\CLSID\{CFC399AF-D876-11D0-9C10-00C04FC99C8E}]
"(Default)" = "Msxml"
[HKCR\CLSID\{2933BF94-7B36-11D2-B20E-00C04F983E60}\Version]
"(Default)" = "3.0"
[HKCR\CLSID\{CFC399AF-D876-11D0-9C10-00C04FC99C8E}\InProcServer32]
"ThreadingModel" = "Both"
[HKCR\Interface\{50EA08BA-DD1B-4664-9A50-C2F40F4BD79A}]
"(Default)" = "ISchemaAttributeGroup"
[HKCR\Interface\{2933BF84-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{ED8C108D-4349-11D2-91A4-00C04F7969E8}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{2E01311B-C322-4B0A-BD77-B90CFDC8DCE7}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{50EA08B1-DD1B-4664-9A50-C2F40F4BD79A}]
"(Default)" = "ISchemaStringCollection"
[HKCR\CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}\ProgID]
"(Default)" = "Msxml2.DOMDocument.3.0"
[HKCR\XML\OLEScript]
"(Default)" = ""
[HKCR\CLSID\{F5078F31-C551-11D3-89B9-0000F81FE221}\Version]
"(Default)" = "3.0"
[HKCR\CLSID\{ED8C108E-4349-11D2-91A4-00C04F7969E8}\ProgID]
"(Default)" = "Microsoft.XMLHTTP.1.0"
[HKCR\Interface\{2B8DE2FE-8D2D-11d1-B2FC-00C04FD915A9}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{F5078F36-C551-11D3-89B9-0000F81FE221}\Version]
"(Default)" = "3.0"
[HKCR\xslfile\BrowseInPlace]
"(Default)" = ""
[HKCR\Interface\{50EA08B6-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
"Version" = "3.0"
[HKCR\MIME\Database\Content Type\text/xml]
"CLSID" = "{48123BC4-99D9-11D1-A6B3-00C04FD91555}"
"Encoding" = "08 00 00 00"
[HKCR\Msxml2.SAXAttributes.3.0\CLSID]
"(Default)" = "{3E784A01-F3AE-4DC0-9354-9526B9370EBA}"
[HKCR\Interface\{50EA08B3-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\xmlfile\DefaultIcon]
"(Default)" = "%WinDir%\System32\msxml3.dll,0"
[HKCR\Interface\{2933BF8E-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"Version" = "3.0"
[HKCR\xmlfile\shell\Open\ddeexec\topic]
"(Default)" = "WWW_OpenURL"
[HKCR\Interface\{2B8DE2FE-8D2D-11d1-B2FC-00C04FD915A9}]
"(Default)" = "IXMLDocument2"
[HKCR\Interface\{50EA08BD-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{2933BF84-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{032AAC35-8C0E-4D9D-979F-E3B702935576}\TypeLib]
"Version" = "3.0"
[HKCR\CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}\Version]
"(Default)" = "3.0"
[HKCR\Interface\{3EFAA426-272F-11D2-836F-0000F87A7782}]
"(Default)" = "IXMLDOMParseError"
[HKCR\Interface\{3EFAA425-272F-11D2-836F-0000F87A7782}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Microsoft.FreeThreadedXMLDOM\CurVer]
"(Default)" = "Microsoft.FreeThreadedXMLDOM.1.0"
[HKCR\MSXML.DOMDocument\CLSID]
"(Default)" = "{2933BF90-7B36-11D2-B20E-00C04F983E60}"
[HKCR\Interface\{2E9196BF-13BA-4DD4-91CA-6C571F281495}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{50EA08B7-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Microsoft.XMLParser\CurVer]
"(Default)" = "Microsoft.XMLParser.1.0"
[HKCR\CLSID\{F5078F36-C551-11D3-89B9-0000F81FE221}\ProgID]
"(Default)" = "Msxml2.XSLTemplate.3.0"
[HKCR\xslfile\shell\Open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe -nohome"
[HKCR\Interface\{50EA08B2-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}\VersionIndependentProgID]
"(Default)" = "Msxml2.DOMDocument"
[HKCR\CLSID\{F5078F39-C551-11D3-89B9-0000F81FE221}]
"(Default)" = "XML Data Source Object 3.0"
[HKCR\CLSID\{48123BC4-99D9-11D1-A6B3-00C04FD91555}\ProgID]
"(Default)" = "xmlfile"
[HKCR\Interface\{2933BF96-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{2933BF8F-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{F10D27CC-3EC0-415C-8ED8-77AB1C5E7262}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{2933BF96-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{F6D90F12-9C73-11D3-B32E-00C04F990BB4}\Version]
"(Default)" = "3.0"
[HKCR\CLSID\{48123BC4-99D9-11D1-A6B3-00C04FD91555}\InProcServer32]
"ThreadingModel" = "Apartment"
[HKCR\Interface\{3EFAA429-272F-11D2-836F-0000F87A7782}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{2933BF91-7B36-11D2-B20E-00C04F983E60}\InProcServer32]
"ThreadingModel" = "Both"
[HKCR\CLSID\{550DDA30-0541-11D2-9CA9-0060B0EC3D39}\VersionIndependentProgID]
"(Default)" = "Microsoft.XMLDSO"
[HKCR\Interface\{2933BF87-7B36-11D2-B20E-00C04F983E60}]
"(Default)" = "IXMLDOMText"
[HKCR\Interface\{2E01311B-C322-4B0A-BD77-B90CFDC8DCE7}]
"(Default)" = "IServerXMLHTTPRequest2"
[HKCR\CLSID\{F5078F31-C551-11D3-89B9-0000F81FE221}]
"(Default)" = "XML Parser 3.0"
[HKCR\Interface\{2933BF8E-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{2933BF93-7B36-11D2-B20E-00C04F983E60}]
"(Default)" = "IXSLTemplate"
[HKCR\Microsoft.FreeThreadedXMLDOM.1.0]
"(Default)" = "Free Threaded XML DOM Document"
[HKCR\MSXML.FreeThreadedDOMDocument]
"(Default)" = "Free Threaded XML DOM Document"
[HKCR\Interface\{C90352F5-643C-4FBC-BB23-E996EB2D51FD}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{FC220AD8-A72A-4EE8-926E-0B7AD152A020}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{2E01311B-C322-4B0A-BD77-B90CFDC8DCE7}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{50EA08B8-DD1B-4664-9A50-C2F40F4BD79A}]
"(Default)" = "ISchemaType"
[HKCR\Interface\{2933BF89-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{373984C8-B845-449B-91E7-45AC83036ADE}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{50EA08B7-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{50EA08B5-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{F5078F31-C551-11D3-89B9-0000F81FE221}\VersionIndependentProgID]
"(Default)" = "Msxml2.XMLParser"
[HKCR\CLSID\{989D1DC0-B162-11D1-B6EC-D27DDCF9A923}\ProgID]
"(Default)" = "XML"
[HKCR\Interface\{2B8DE2FF-8D2D-11D1-B2FC-00C04FD915A9}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{3EFAA429-272F-11D2-836F-0000F87A7782}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{2933BF93-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{310AFA62-0575-11D2-9CA9-0060B0EC3D39}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Msxml2.FreeThreadedDOMDocument.3.0\CLSID]
"(Default)" = "{F5078F33-C551-11D3-89B9-0000F81FE221}"
[HKCR\Microsoft.XMLParser\CLSID]
"(Default)" = "{D2423620-51A0-11D2-9CAF-0060B0EC3D39}"
[HKCR\Interface\{D963D3FE-173C-4862-9095-B92F66995F52}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Msxml2.DSOControl]
"(Default)" = "XML Data Source Object"
[HKCR\Interface\{2933BF8B-7B36-11D2-B20E-00C04F983E60}]
"(Default)" = "IXMLDOMDocumentType"
[HKCR\Msxml2.XSLTemplate.3.0\CLSID]
"(Default)" = "{F5078F36-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{3D813DFE-6C91-4A4E-8F41-04346A841D9C}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Microsoft.XMLDOM.1.0\CLSID]
"(Default)" = "{2933BF90-7B36-11D2-B20E-00C04F983E60}"
[HKCR\Msxml2.SAXXMLReader.3.0]
"(Default)" = "SAX XML Reader 3.0"
[HKCR\Interface\{50EA08B6-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{50EA08B8-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{2933BF90-7B36-11d2-B20E-00C04F983E60}\SideBySide]
"RegVersion" = "3.0"
[HKCR\Interface\{808F4E35-8D5A-4FBE-8466-33A41279ED30}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{D4D4A0FC-3B73-11D1-B2B4-00C04FB92596}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\MIME\Database\Content Type\application/xml]
"Extension" = ".xml"
[HKCR\CLSID\{AFB40FFD-B609-40A3-9828-F88BBE11E4E3}\InProcServer32]
"ThreadingModel" = "Apartment"
[HKCR\CLSID\{AFBA6B42-5692-48EA-8141-DC517DCF0EF1}\Version]
"(Default)" = "3.0"
[HKCR\xmlfile\shell\Open\ddeexec\application]
"(Default)" = "IExplore"
[HKCR\CLSID\{079AA557-4A18-424A-8EEE-E39F0A8D41B9}\Version]
"(Default)" = "3.0"
[HKCR\Interface\{50EA08B1-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Msxml2.FreeThreadedDOMDocument\CLSID]
"(Default)" = "{F6D90F12-9C73-11D3-B32E-00C04F990BB4}"
[HKCR\Interface\{C90352F7-643C-4FBC-BB23-E996EB2D51FD}\TypeLib]
"Version" = "3.0"
[HKCR\Msxml2.DSOControl.3.0\CLSID]
"(Default)" = "{F5078F39-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{3EFAA427-272F-11D2-836F-0000F87A7782}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{F10D27CC-3EC0-415C-8ED8-77AB1C5E7262}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{2933BF8E-7B36-11D2-B20E-00C04F983E60}]
"(Default)" = "IXMLDOMEntityReference"
[HKCR\CLSID\{2933BF94-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{CFC399AF-D876-11D0-9C10-00C04FC99C8E}\TypeLib]
"(Default)" = "{D63E0CE2-A0A2-11D0-9C02-00C04FC99C8E}"
[HKCR\xslfile]
"FriendlyTypeName" = "@%WinDir%\System32\msxml3r.dll,-2"
[HKCR\xmlfile]
"EditFlags" = "00 00 01 00"
[HKCR\MSXML.FreeThreadedDOMDocument\CurVer]
"(Default)" = "Microsoft.FreeThreadedXMLDOM.1.0"
[HKCR\Interface\{3F7F31AC-E15F-11D0-9C25-00C04FC99C8E}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Msxml2.MXXMLWriter\CurVer]
"(Default)" = "Msxml2.MXXMLWriter.3.0"
[HKCR\Interface\{3EFAA425-272F-11D2-836F-0000F87A7782}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{7E3FCEA1-31B4-11D2-AE1F-0080C7337EA1}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\Interface\{C90352F5-643C-4FBC-BB23-E996EB2D51FD}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{10DC0586-132B-4CAC-8BB3-DB00AC8B7EE0}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{D4D4A0FC-3B73-11D1-B2B4-00C04FB92596}]
"(Default)" = "IXMLAttribute"
[HKCR\Interface\{2933BF87-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{50EA08BC-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{2933BF92-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{3EFAA426-272F-11D2-836F-0000F87A7782}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{2933BF8C-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Msxml2.ServerXMLHTTP.3.0]
"(Default)" = "Server XML HTTP 3.0"
[HKCR\CLSID\{AFBA6B42-5692-48EA-8141-DC517DCF0EF1}]
"(Default)" = "Server XML HTTP"
[HKCR\Interface\{65725580-9B5D-11D0-9BFE-00C04FC99C8E}]
"(Default)" = "IXMLElementCollection"
[HKCR\xmlfile\BrowseInPlace]
"(Default)" = ""
[HKCR\Interface\{2933BF80-7B36-11D2-B20E-00C04F983E60}]
"(Default)" = "IXMLDOMNode"
[HKCR\Msxml2.DOMDocument.3.0\CLSID]
"(Default)" = "{F5078F32-C551-11D3-89B9-0000F81FE221}"
[HKCR\Msxml2.XSLTemplate]
"(Default)" = "XSL Template"
[HKCR\CLSID\{F5078F34-C551-11D3-89B9-0000F81FE221}\VersionIndependentProgID]
"(Default)" = "Msxml2.XMLSchemaCache"
[HKCR\Interface\{ED8C108D-4349-11D2-91A4-00C04F7969E8}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{24FB3297-302D-4620-BA39-3A732D850558}\TypeLib]
"Version" = "3.0"
[HKCR\CLSID\{3D813DFE-6C91-4A4E-8F41-04346A841D9C}\Version]
"(Default)" = "3.0"
[HKCR\CLSID\{F5078F35-C551-11D3-89B9-0000F81FE221}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\Interface\{3EFAA413-272F-11D2-836F-0000F87A7782}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{F5078F34-C551-11D3-89B9-0000F81FE221}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{2933BF83-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Msxml2.XSLTemplate.3.0]
"(Default)" = "XSL Template 3.0"
[HKCR\Interface\{E8917260-7579-4BE1-B5DD-7AFBFA6F077B}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{373984C8-B845-449B-91E7-45AC83036ADE}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{2933BF91-7B36-11D2-B20E-00C04F983E60}\VersionIndependentProgID]
"(Default)" = "Microsoft.FreeThreadedXMLDOM"
[HKCR\CLSID\{4DD441AD-526D-4A77-9F1B-9841ED802FB0}\VersionIndependentProgID]
"(Default)" = "Msxml2.SAXAttributes"
[HKCR\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\ProgID]
"(Default)" = "Msxml2.XMLHTTP"
[HKCR\CLSID\{4DD441AD-526D-4A77-9F1B-9841ED802FB0}\Version]
"(Default)" = "3.0"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0D EE 0A 2F 0B 1D 40 BF CB 86 CE 44 4E CE 27 7B"
[HKCR\CLSID\{F6D90F12-9C73-11D3-B32E-00C04F990BB4}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{550DDA30-0541-11D2-9CA9-0060B0EC3D39}\ProgID]
"(Default)" = "Microsoft.XMLDSO.1.0"
[HKCR\CLSID\{2933BF90-7B36-11d2-B20E-00C04F983E60}]
"(Default)" = "XML DOM Document"
[HKCR\Interface\{2933BF95-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"Version" = "3.0"
[HKCR\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\Version]
"(Default)" = "3.0"
[HKCR\Interface\{0C05D096-F45B-4ACA-AD1A-AA0BC25518DC}]
"(Default)" = "IVBSAXEntityResolver"
[HKCR\Interface\{310AFA62-0575-11D2-9CA9-0060B0EC3D39}]
"(Default)" = "IDSOControl"
[HKCR\Msxml2.DOMDocument\CurVer]
"(Default)" = "Msxml2.DOMDocument.3.0"
[HKCR\Interface\{2933BF81-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{50EA08BB-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{2ED7290A-4DD5-4B46-BB26-4E4155E77FAA}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{3EFAA429-272F-11D2-836F-0000F87A7782}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{796E7AC5-5AA2-4EFF-ACAD-3FAAF01A3288}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{F52E2B61-18A1-11D1-B105-00805F49916B}\TypeLib]
"Version" = "3.0"
[HKCR\CLSID\{4DD441AD-526D-4A77-9F1B-9841ED802FB0}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{C90352F4-643C-4FBC-BB23-E996EB2D51FD}]
"(Default)" = "IMXNamespacePrefixes"
[HKCR\Interface\{1299EB1B-5B88-433E-82DE-82CA75AD4E04}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{F5078F33-C551-11D3-89B9-0000F81FE221}\Version]
"(Default)" = "3.0"
[HKCR\CLSID\{F5078F41-C551-11D3-89B9-0000F81FE221}\InProcServer32]
"ThreadingModel" = "Apartment"
[HKCR\Msxml2.XMLHTTP.3.0]
"(Default)" = "XML HTTP 3.0"
[HKCR\CLSID\{2933BF90-7B36-11d2-B20E-00C04F983E60}\SideBySide]
"Version30RefCount" = "2"
[HKCR\Interface\{2933BF88-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{2E9196BF-13BA-4DD4-91CA-6C571F281495}]
"(Default)" = "IServerXMLHTTPRequest"
[HKCR\CLSID\{F5078F40-C551-11D3-89B9-0000F81FE221}\MiscStatus]
"(Default)" = "2228625"
[HKCR\Microsoft.XMLDSO\CurVer]
"(Default)" = "Microsoft.XMLDSO.1.0"
[HKCR\Interface\{3EFAA428-272F-11D2-836F-0000F87A7782}]
"(Default)" = "IXMLDOMParseError2"
[HKCR\Interface\{10DC0586-132B-4CAC-8BB3-DB00AC8B7EE0}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Msxml2.XMLParser\CurVer]
"(Default)" = "Msxml2.XMLParser.3.0"
[HKCR\CLSID\{F6D90F12-9C73-11D3-B32E-00C04F990BB4}\ProgID]
"(Default)" = "Msxml2.FreeThreadedDOMDocument"
[HKCR\CLSID\{F5078F34-C551-11D3-89B9-0000F81FE221}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\Interface\{2933BF8D-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{808F4E35-8D5A-4FBE-8466-33A41279ED30}\TypeLib]
"Version" = "3.0"
[HKCR\Msxml2.DOMDocument.3.0]
"(Default)" = "XML DOM Document 3.0"
[HKCR\Interface\{2933BF8D-7B36-11D2-B20E-00C04F983E60}]
"(Default)" = "IXMLDOMEntity"
[HKCR\CLSID\{2933BF90-7B36-11d2-B20E-00C04F983E60}\VersionIndependentProgID]
"(Default)" = "Microsoft.XMLDOM"
[HKCR\Interface\{032AAC35-8C0E-4D9D-979F-E3B702935576}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{50EA08B4-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{3EFAA429-272F-11D2-836F-0000F87A7782}]
"(Default)" = "IXMLDOMParseErrorCollection"
[HKCR\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{3F7F31AC-E15F-11D0-9C25-00C04FC99C8E}\TypeLib]
"Version" = "3.0"
[HKCR\Microsoft.FreeThreadedXMLDOM\CLSID]
"(Default)" = "{2933BF91-7B36-11D2-B20E-00C04F983E60}"
[HKCR\CLSID\{F5078F33-C551-11D3-89B9-0000F81FE221}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{2933BF91-7B36-11D2-B20E-00C04F983E60}]
"(Default)" = "Free Threaded XML DOM Document"
[HKCR\Msxml2.DOMDocument]
"(Default)" = "XML DOM Document"
[HKCR\CLSID\{F5078F40-C551-11D3-89B9-0000F81FE221}\BrowseInPlace]
"(Default)" = ""
[HKCR\CLSID\{F5078F31-C551-11D3-89B9-0000F81FE221}\InProcServer32]
"ThreadingModel" = "Both"
[HKCR\Interface\{E8917260-7579-4BE1-B5DD-7AFBFA6F077B}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{4D7FF4BA-1565-4EA8-94E1-6E724A46F98D}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{50EA08B5-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{ED8C108D-4349-11D2-91A4-00C04F7969E8}]
"(Default)" = "IXMLHTTPRequest"
[HKCR\CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{F5078F36-C551-11D3-89B9-0000F81FE221}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{50EA08BB-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{2933BF96-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{3EFAA413-272F-11D2-836F-0000F87A7782}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{F6D90F12-9C73-11D3-B32E-00C04F990BB4}\InProcServer32]
"ThreadingModel" = "Both"
[HKCR\Interface\{50EA08B2-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
"Version" = "3.0"
[HKCR\CLSID\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}]
"(Default)" = "XML DOM Document"
[HKCR\Interface\{10DC0586-132B-4CAC-8BB3-DB00AC8B7EE0}]
"(Default)" = "IVBSAXAttributes"
[HKCR\Interface\{E8917260-7579-4BE1-B5DD-7AFBFA6F077B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{F5078F40-C551-11D3-89B9-0000F81FE221}\ProgID]
"(Default)" = "xmlfile"
[HKCR\Interface\{50EA08B9-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Msxml2.SAXXMLReader]
"(Default)" = "SAX XML Reader"
[HKCR\Msxml2.XMLParser.3.0]
"(Default)" = "XML Parser 3.0"
[HKCR\Interface\{C90352F7-643C-4FBC-BB23-E996EB2D51FD}]
"(Default)" = "IMXXMLFilter"
[HKCR\CLSID\{F5078F41-C551-11D3-89B9-0000F81FE221}]
"(Default)" = "XML Island 3.0"
[HKCR\Interface\{3EFAA426-272F-11D2-836F-0000F87A7782}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{F5078F40-C551-11D3-89B9-0000F81FE221}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\Microsoft.XMLHTTP\CLSID]
"(Default)" = "{ED8C108E-4349-11D2-91A4-00C04F7969E8}"
[HKCR\Interface\{D963D3FE-173C-4862-9095-B92F66995F52}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{D4D4A0FC-3B73-11D1-B2B4-00C04FB92596}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{2933BF81-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{2B8DE2FE-8D2D-11d1-B2FC-00C04FD915A9}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Msxml2.SAXAttributes\CurVer]
"(Default)" = "Msxml2.SAXAttributes.3.0"
[HKCR\Interface\{C90352F7-643C-4FBC-BB23-E996EB2D51FD}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Microsoft.XMLHTTP.1.0\CLSID]
"(Default)" = "{ED8C108E-4349-11D2-91A4-00C04F7969E8}"
[HKCR\MIME\Database\Content Type\application/xml]
"CLSID" = "{48123BC4-99D9-11D1-A6B3-00C04FD91555}"
[HKCR\CLSID\{989D1DC0-B162-11D1-B6EC-D27DDCF9A923}\Implemented Categories]
"(Default)" = ""
[HKCR\Interface\{50EA08BA-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{C90352F7-643C-4FBC-BB23-E996EB2D51FD}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\xslfile\shell\Open\ddeexec\topic]
"(Default)" = "WWW_OpenURL"
[HKCR\Interface\{1299EB1B-5B88-433E-82DE-82CA75AD4E04}]
"(Default)" = "IVBSAXXMLFilter"
[HKCR\Msxml2.XMLHTTP\CLSID]
"(Default)" = "{F6D90F16-9C73-11D3-B32E-00C04F990BB4}"
[HKCR\CLSID\{F5078F19-C551-11D3-89B9-0000F81FE221}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
[HKCR\Interface\{2933BF8F-7B36-11D2-B20E-00C04F983E60}]
"(Default)" = "IXMLDOMImplementation"
[HKCR\CLSID\{F6D90F14-9C73-11D3-B32E-00C04F990BB4}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{F5078F35-C551-11D3-89B9-0000F81FE221}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\Interface\{2933BF88-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{50EA08B9-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
"Version" = "3.0"
[HKCR\CLSID\{48123BC4-99D9-11D1-A6B3-00C04FD91555}]
"(Default)" = "XML Document"
[HKCR\Interface\{10DC0586-132B-4CAC-8BB3-DB00AC8B7EE0}\TypeLib]
"Version" = "3.0"
[HKCR\Interface\{2933BF96-7B36-11D2-B20E-00C04F983E60}\TypeLib]
"(Default)" = "{F5078F18-C551-11D3-89B9-0000F81FE221}"
[HKCR\CLSID\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}\InProcServer32]
"(Default)" = "%WinDir%\System32\msxml3.dll"
The Trojan deletes the following registry key(s):
[HKCR\CLSID\{F5078F41-C551-11D3-89B9-0000F81FE221}\TypeLib]
[HKCR\Interface\{796E7AC5-5AA2-4EFF-ACAD-3FAAF01A3288}\TypeLib]
[HKCR\Interface\{2B8DE2FF-8D2D-11D1-B2FC-00C04FD915A9}\ProxyStubClsid32]
[HKCR\Interface\{2ED7290A-4DD5-4B46-BB26-4E4155E77FAA}]
[HKCR\Interface\{2933BF8E-7B36-11D2-B20E-00C04F983E60}]
[HKCR\Interface\{D4D4A0FC-3B73-11D1-B2B4-00C04FB92596}\TypeLib]
[HKCR\Interface\{D4D4A0FC-3B73-11D1-B2B4-00C04FB92596}\ProxyStubClsid]
[HKCR\Interface\{032AAC35-8C0E-4D9D-979F-E3B702935576}]
[HKCR\CLSID\{F6D90F12-9C73-11D3-B32E-00C04F990BB4}\Version]
[HKCR\Interface\{50EA08BE-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid32]
[HKCR\Interface\{2ED7290A-4DD5-4B46-BB26-4E4155E77FAA}\ProxyStubClsid]
[HKCR\Msxml2.XMLParser.3.0]
[HKCR\CLSID\{2933BF90-7B36-11d2-B20E-00C04F983E60}\Version]
[HKCR\CLSID\{F5078F3F-C551-11D3-89B9-0000F81FE221}\InProcServer32]
[HKCR\Interface\{C90352F4-643C-4FBC-BB23-E996EB2D51FD}\TypeLib]
[HKCR\CLSID\{48123BC4-99D9-11D1-A6B3-00C04FD91555}\Version]
[HKCR\Interface\{2933BF88-7B36-11D2-B20E-00C04F983E60}]
[HKCR\CLSID\{2933BF94-7B36-11D2-B20E-00C04F983E60}\VersionIndependentProgID]
[HKCR\CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}\InProcServer32]
[HKCR\CLSID\{F5078F39-C551-11D3-89B9-0000F81FE221}\VersionIndependentProgID]
[HKCR\Interface\{3EFAA429-272F-11D2-836F-0000F87A7782}\ProxyStubClsid32]
[HKCR\CLSID\{AFB40FFD-B609-40A3-9828-F88BBE11E4E3}\TypeLib]
[HKCR\Interface\{AA634FC7-5888-44A7-A257-3A47150D3A0E}\ProxyStubClsid32]
[HKCR\Msxml2.FreeThreadedDOMDocument]
[HKCR\Interface\{2ED7290A-4DD5-4B46-BB26-4E4155E77FAA}\ProxyStubClsid32]
[HKCR\Interface\{2933BF92-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
[HKCR\CLSID\{3124C396-FB13-4836-A6AD-1317F1713688}\VersionIndependentProgID]
[HKCR\Msxml2.XMLSchemaCache\CLSID]
[HKCR\Interface\{F10D27CC-3EC0-415C-8ED8-77AB1C5E7262}]
[HKCR\Interface\{2933BF8D-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
[HKCR\Interface\{2933BF89-7B36-11D2-B20E-00C04F983E60}]
[HKCR\CLSID\{550DDA30-0541-11D2-9CA9-0060B0EC3D39}\ProgID]
[HKCR\Msxml2.XMLSchemaCache.3.0\CLSID]
[HKCR\xmlfile\shell\Open\command]
[HKCR\Interface\{2933BF8D-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
[HKCR\CLSID\{D2423620-51A0-11D2-9CAF-0060B0EC3D39}\Version]
[HKCR\CLSID\{F5078F40-C551-11D3-89B9-0000F81FE221}\MiscStatus]
[HKCR\CLSID\{2933BF91-7B36-11D2-B20E-00C04F983E60}]
[HKCR\xmlfile\shell\Open\ddeexec\topic]
[HKCR\Interface\{50EA08B8-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid]
[HKCR\CLSID\{FC220AD8-A72A-4EE8-926E-0B7AD152A020}\TypeLib]
[HKCR\Interface\{808F4E35-8D5A-4FBE-8466-33A41279ED30}\ProxyStubClsid32]
[HKCR\CLSID\{2933BF91-7B36-11D2-B20E-00C04F983E60}\VersionIndependentProgID]
[HKCR\Interface\{C90352F7-643C-4FBC-BB23-E996EB2D51FD}]
[HKCR\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}]
[HKCR\Interface\{2933BF81-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
[HKCR\Msxml2.XMLParser]
[HKCR\Interface\{50EA08BA-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid]
[HKCR\Interface\{8C033CAA-6CD6-4F73-B728-4531AF74945F}\TypeLib]
[HKCR\Microsoft.XMLHTTP]
[HKCR\Interface\{2933BF8F-7B36-11D2-B20E-00C04F983E60}\TypeLib]
[HKCR\Interface\{310AFA62-0575-11D2-9CA9-0060B0EC3D39}\TypeLib]
[HKCR\CLSID\{D2423620-51A0-11D2-9CAF-0060B0EC3D39}]
[HKCR\Interface\{8C033CAA-6CD6-4F73-B728-4531AF74945F}\ProxyStubClsid]
[HKCR\Interface\{50EA08B7-DD1B-4664-9A50-C2F40F4BD79A}]
[HKCR\Interface\{50EA08B8-DD1B-4664-9A50-C2F40F4BD79A}]
[HKCR\Interface\{C90352F4-643C-4FBC-BB23-E996EB2D51FD}\ProxyStubClsid]
[HKCR\Interface\{3F7F31AC-E15F-11D0-9C25-00C04FC99C8E}\ProxyStubClsid32]
[HKCR\Interface\{50EA08BD-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid]
[HKCR\Interface\{50EA08B2-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid32]
[HKCR\CLSID\{F5078F40-C551-11D3-89B9-0000F81FE221}\BrowseInPlace]
[HKCR\Microsoft.XMLDSO\CLSID]
[HKCR\CLSID\{989D1DC0-B162-11D1-B6EC-D27DDCF9A923}\ProgID]
[HKCR\Interface\{1299EB1B-5B88-433E-82DE-82CA75AD4E04}\ProxyStubClsid]
[HKCR\Interface\{50EA08BD-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
[HKCR\Interface\{2933BF93-7B36-11D2-B20E-00C04F983E60}\TypeLib]
[HKCR\CLSID\{F6D90F14-9C73-11D3-B32E-00C04F990BB4}\TypeLib]
[HKCR\Interface\{F10D27CC-3EC0-415C-8ED8-77AB1C5E7262}\ProxyStubClsid]
[HKCR\CLSID\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}]
[HKCR\CLSID\{F5078F34-C551-11D3-89B9-0000F81FE221}\ProgID]
[HKCR\CLSID\{AFB40FFD-B609-40A3-9828-F88BBE11E4E3}\ProgID]
[HKCR\Interface\{50EA08BA-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
[HKCR\CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}\Version]
[HKCR\Interface\{E8917260-7579-4BE1-B5DD-7AFBFA6F077B}\ProxyStubClsid]
[HKCR\Interface\{50EA08B7-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
[HKCR\Interface\{2933BF8B-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
[HKCR\Interface\{AA634FC7-5888-44A7-A257-3A47150D3A0E}]
[HKCR\Microsoft.XMLDOM.1.0]
[HKCR\Interface\{2B8DE2FF-8D2D-11D1-B2FC-00C04FD915A9}\ProxyStubClsid]
[HKCR\Msxml2.ServerXMLHTTP\CurVer]
[HKCR\xmlfile\BrowseInPlace]
[HKCR\Interface\{50EA08B1-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
[HKCR\Interface\{4D7FF4BA-1565-4EA8-94E1-6E724A46F98D}\ProxyStubClsid]
[HKCR\CLSID\{F5078F36-C551-11D3-89B9-0000F81FE221}\Version]
[HKCR\Interface\{ED8C108D-4349-11D2-91A4-00C04F7969E8}]
[HKCR\Msxml2.SAXAttributes]
[HKCR\Interface\{2933BF82-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
[HKCR\Interface\{50EA08BC-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
[HKCR\CLSID\{989D1DC0-B162-11D1-B6EC-D27DDCF9A923}\Implemented Categories\{F0B7A1A1-9847-11CF-8F20-00805F2CD064}]
[HKCR\Interface\{50EA08BB-DD1B-4664-9A50-C2F40F4BD79A}]
[HKCR\Msxml2.DOMDocument\CLSID]
[HKCR\Microsoft.XMLHTTP\CLSID]
[HKCR\CLSID\{079AA557-4A18-424A-8EEE-E39F0A8D41B9}]
[HKCR\Msxml2.DOMDocument]
[HKCR\Interface\{C90352F4-643C-4FBC-BB23-E996EB2D51FD}]
[HKCR\Interface\{3EFAA413-272F-11D2-836F-0000F87A7782}\ProxyStubClsid32]
[HKCR\Interface\{50EA08BA-DD1B-4664-9A50-C2F40F4BD79A}]
[HKCR\Msxml\CLSID]
[HKCR\Interface\{50EA08BB-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
[HKCR\xslfile\shell]
[HKCR\Interface\{2B8DE2FE-8D2D-11d1-B2FC-00C04FD915A9}]
[HKCR\Interface\{2E9196BF-13BA-4DD4-91CA-6C571F281495}\TypeLib]
[HKCR\Interface\{2E01311B-C322-4B0A-BD77-B90CFDC8DCE7}\ProxyStubClsid]
[HKCR\Interface\{F52E2B61-18A1-11D1-B105-00805F49916B}\ProxyStubClsid]
[HKCR\Interface\{50EA08B9-DD1B-4664-9A50-C2F40F4BD79A}]
[HKCR\Interface\{3F7F31AC-E15F-11D0-9C25-00C04FC99C8E}\TypeLib]
[HKCR\CLSID\{2933BF94-7B36-11D2-B20E-00C04F983E60}\Version]
[HKCR\Interface\{50EA08B3-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid]
[HKCR\MSXML.DOMDocument\CLSID]
[HKCR\Microsoft.FreeThreadedXMLDOM]
[HKCR\CLSID\{F5078F19-C551-11D3-89B9-0000F81FE221}\Version]
[HKCR\Interface\{50EA08BC-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid]
[HKCR\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\InProcServer32]
[HKCR\Interface\{2933BF85-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
[HKCR\CLSID\{3D813DFE-6C91-4A4E-8F41-04346A841D9C}\VersionIndependentProgID]
[HKCR\Msxml2.XSLTemplate\CLSID]
[HKCR\Interface\{2933BF89-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
[HKCR\CLSID\{3D813DFE-6C91-4A4E-8F41-04346A841D9C}\Version]
[HKCR\Interface\{2933BF96-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
[HKCR\Interface\{65725580-9B5D-11D0-9BFE-00C04FC99C8E}\TypeLib]
[HKCR\Interface\{2933BF8C-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
[HKCR\Msxml2.FreeThreadedDOMDocument\CLSID]
[HKCR\CLSID\{F5078F33-C551-11D3-89B9-0000F81FE221}\InProcServer32]
[HKCR\Msxml2.DOMDocument.3.0]
[HKCR\CLSID\{D2423620-51A0-11D2-9CAF-0060B0EC3D39}\VersionIndependentProgID]
[HKCR\Interface\{2933BF8E-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
[HKCR\CLSID\{CFC399AF-D876-11D0-9C10-00C04FC99C8E}]
[HKCR\Interface\{3EFAA427-272F-11D2-836F-0000F87A7782}\ProxyStubClsid32]
[HKCR\Interface\{3EFAA426-272F-11D2-836F-0000F87A7782}\ProxyStubClsid32]
[HKCR\Interface\{2933BF85-7B36-11D2-B20E-00C04F983E60}]
[HKCR\Interface\{C90352F5-643C-4FBC-BB23-E996EB2D51FD}\ProxyStubClsid32]
[HKCR\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\3.0\FLAGS]
[HKCR\Interface\{C90352F5-643C-4FBC-BB23-E996EB2D51FD}]
[HKCR\Interface\{2933BF81-7B36-11D2-B20E-00C04F983E60}]
[HKCR\Interface\{2933BF86-7B36-11D2-B20E-00C04F983E60}\TypeLib]
[HKCR\CLSID\{F5078F35-C551-11D3-89B9-0000F81FE221}\VersionIndependentProgID]
[HKCR\Interface\{24FB3297-302D-4620-BA39-3A732D850558}\ProxyStubClsid32]
[HKCR\Interface\{3EFAA428-272F-11D2-836F-0000F87A7782}\ProxyStubClsid32]
[HKCR\xslfile\BrowseInPlace]
[HKCR\Interface\{2933BF86-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
[HKCR\Msxml2.DSOControl\CLSID]
[HKCR\CLSID\{FC220AD8-A72A-4EE8-926E-0B7AD152A020}\ProgID]
[HKCR\Interface\{F52E2B61-18A1-11D1-B105-00805F49916B}]
[HKCR\Interface\{F10D27CC-3EC0-415C-8ED8-77AB1C5E7262}\TypeLib]
[HKCR\CLSID\{AFBA6B42-5692-48EA-8141-DC517DCF0EF1}]
[HKCR\CLSID\{2933BF90-7B36-11d2-B20E-00C04F983E60}\ProgID]
[HKCR\Msxml2.SAXXMLReader\CurVer]
[HKCR\Microsoft.XMLDOM\CLSID]
[HKCR\Interface\{50EA08B6-DD1B-4664-9A50-C2F40F4BD79A}]
[HKCR\Interface\{2933BF84-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
[HKCR\Msxml]
[HKCR\Interface\{8C033CAA-6CD6-4F73-B728-4531AF74945F}\ProxyStubClsid32]
[HKCR\CLSID\{F5078F40-C551-11D3-89B9-0000F81FE221}]
[HKCR\Microsoft.XMLDOM.1.0\CLSID]
[HKCR\CLSID\{F5078F40-C551-11D3-89B9-0000F81FE221}\InProcServer32]
[HKCR\Interface\{2B8DE2FE-8D2D-11d1-B2FC-00C04FD915A9}\ProxyStubClsid]
[HKCR\Interface\{373984C8-B845-449B-91E7-45AC83036ADE}\TypeLib]
[HKCR\Interface\{50EA08B2-DD1B-4664-9A50-C2F40F4BD79A}]
[HKCR\Microsoft.XMLHTTP.1.0]
[HKCR\Interface\{50EA08BE-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid]
[HKCR\CLSID\{F5078F39-C551-11D3-89B9-0000F81FE221}\ProgID]
[HKCR\CLSID\{48123BC4-99D9-11D1-A6B3-00C04FD91555}\ProgID]
[HKCR\Interface\{2933BF95-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
[HKCR\Interface\{F10D27CC-3EC0-415C-8ED8-77AB1C5E7262}\ProxyStubClsid32]
[HKCR\Interface\{24FB3297-302D-4620-BA39-3A732D850558}]
[HKCR\Interface\{50EA08B1-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid]
[HKCR\CLSID\{989D1DC0-B162-11D1-B6EC-D27DDCF9A923}]
[HKCR\Interface\{3EFAA427-272F-11D2-836F-0000F87A7782}]
[HKCR\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\ProgID]
[HKCR\CLSID\{AFBA6B42-5692-48EA-8141-DC517DCF0EF1}\VersionIndependentProgID]
[HKCR\Interface\{3EFAA429-272F-11D2-836F-0000F87A7782}\TypeLib]
[HKCR\Interface\{50EA08B4-DD1B-4664-9A50-C2F40F4BD79A}]
[HKCR\Interface\{2933BF8B-7B36-11D2-B20E-00C04F983E60}]
[HKCR\CLSID\{989D1DC0-B162-11D1-B6EC-D27DDCF9A923}\Implemented Categories]
[HKCR\Interface\{50EA08BB-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid32]
[HKCR\CLSID\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}\Version]
[HKCR\CLSID\{550DDA30-0541-11D2-9CA9-0060B0EC3D39}\Version]
[HKCR\CLSID\{F5078F19-C551-11D3-89B9-0000F81FE221}\InProcServer32]
[HKCR\CLSID\{D2423620-51A0-11D2-9CAF-0060B0EC3D39}\ProgID]
[HKCR\CLSID\{F5078F35-C551-11D3-89B9-0000F81FE221}\TypeLib]
[HKCR\Microsoft.XMLParser]
[HKCR\Interface\{2933BF88-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
[HKCR\CLSID\{F6D90F14-9C73-11D3-B32E-00C04F990BB4}\ProgID]
[HKCR\Interface\{2933BF82-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
[HKCR\CLSID\{F5078F40-C551-11D3-89B9-0000F81FE221}\ProgID]
[HKCR\xmlfile\shell\Open\ddeexec\application]
[HKCR\MSXML.DOMDocument\CurVer]
[HKCR\Interface\{50EA08B3-DD1B-4664-9A50-C2F40F4BD79A}]
[HKCR\Interface\{10DC0586-132B-4CAC-8BB3-DB00AC8B7EE0}\ProxyStubClsid32]
[HKCR\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\3.0\0\win32]
[HKCR\xslfile\shell\Open]
[HKCR\Interface\{D4D4A0FC-3B73-11D1-B2B4-00C04FB92596}\ProxyStubClsid32]
[HKCR\CLSID\{F6D90F12-9C73-11D3-B32E-00C04F990BB4}\InProcServer32]
[HKCR\CLSID\{F5078F34-C551-11D3-89B9-0000F81FE221}\TypeLib]
[HKCR\Interface\{D963D3FE-173C-4862-9095-B92F66995F52}\ProxyStubClsid32]
[HKCR\CLSID\{F6D90F12-9C73-11D3-B32E-00C04F990BB4}\VersionIndependentProgID]
[HKCR\Interface\{808F4E35-8D5A-4FBE-8466-33A41279ED30}\ProxyStubClsid]
[HKCR\Interface\{50EA08B4-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
[HKCR\Interface\{310AFA62-0575-11D2-9CA9-0060B0EC3D39}]
[HKCR\Interface\{032AAC35-8C0E-4D9D-979F-E3B702935576}\TypeLib]
[HKCR\CLSID\{4DD441AD-526D-4A77-9F1B-9841ED802FB0}]
[HKCR\CLSID\{AFBA6B42-5692-48EA-8141-DC517DCF0EF1}\ProgID]
[HKCR\Interface\{3EFAA429-272F-11D2-836F-0000F87A7782}]
[HKCR\Interface\{2B8DE2FF-8D2D-11D1-B2FC-00C04FD915A9}\TypeLib]
[HKCR\xmlfile\shell]
[HKCR\Interface\{2933BF8B-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
[HKCR\Msxml2.XMLHTTP\CurVer]
[HKCR\Interface\{3F7F31AC-E15F-11D0-9C25-00C04FC99C8E}]
[HKCR\Interface\{24FB3297-302D-4620-BA39-3A732D850558}\TypeLib]
[HKCR\Interface\{2E01311B-C322-4B0A-BD77-B90CFDC8DCE7}\TypeLib]
[HKCR\Interface\{50EA08B8-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid32]
[HKCR\CLSID\{F5078F31-C551-11D3-89B9-0000F81FE221}\VersionIndependentProgID]
[HKCR\xslfile\shell\Open\ddeexec\topic]
[HKCR\CLSID\{550DDA30-0541-11D2-9CA9-0060B0EC3D39}\TypeLib]
[HKCR\Interface\{50EA08B5-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid]
[HKCR\Interface\{2933BF8E-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
[HKCR\Interface\{3EFAA427-272F-11D2-836F-0000F87A7782}\ProxyStubClsid]
[HKCR\Interface\{50EA08B7-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid]
[HKCR\Interface\{ED8C108D-4349-11D2-91A4-00C04F7969E8}\ProxyStubClsid]
[HKCR\Interface\{ED8C108D-4349-11D2-91A4-00C04F7969E8}\TypeLib]
[HKCR\Interface\{2933BF8A-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
[HKCR\CLSID\{F5078F31-C551-11D3-89B9-0000F81FE221}]
[HKCR\CLSID\{FC220AD8-A72A-4EE8-926E-0B7AD152A020}\VersionIndependentProgID]
[HKCR\Msxml2.SAXAttributes\CurVer]
[HKCR\Msxml2.XMLParser.3.0\CLSID]
[HKCR\CLSID\{48123BC4-99D9-11D1-A6B3-00C04FD91555}\MiscStatus]
[HKCR\Interface\{4D7FF4BA-1565-4EA8-94E1-6E724A46F98D}\TypeLib]
[HKCR\Interface\{65725580-9B5D-11D0-9BFE-00C04FC99C8E}\ProxyStubClsid32]
[HKCR\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\3.0]
[HKCR\CLSID\{F5078F34-C551-11D3-89B9-0000F81FE221}\VersionIndependentProgID]
[HKCR\Interface\{D963D3FE-173C-4862-9095-B92F66995F52}\ProxyStubClsid]
[HKCR\CLSID\{F5078F33-C551-11D3-89B9-0000F81FE221}\ProgID]
[HKCR\CLSID\{F5078F27-C551-11D3-89B9-0000F81FE221}\Version]
[HKCR\Interface\{10DC0586-132B-4CAC-8BB3-DB00AC8B7EE0}\TypeLib]
[HKCR\Microsoft.XMLDOM\CurVer]
[HKCR\CLSID\{2933BF94-7B36-11D2-B20E-00C04F983E60}]
[HKCR\CLSID\{AFBA6B42-5692-48EA-8141-DC517DCF0EF1}\InProcServer32]
[HKCR\Interface\{2B8DE2FE-8D2D-11d1-B2FC-00C04FD915A9}\TypeLib]
[HKCR\CLSID\{F5078F31-C551-11D3-89B9-0000F81FE221}\ProgID]
[HKCR\CLSID\{373984C9-B845-449B-91E7-45AC83036ADE}\ProgID]
[HKCR\Interface\{3EFAA426-272F-11D2-836F-0000F87A7782}\ProxyStubClsid]
[HKCR\CLSID\{2933BF90-7B36-11d2-B20E-00C04F983E60}\VersionIndependentProgID]
[HKCR\Msxml2.SAXXMLReader.3.0\CLSID]
[HKCR\Msxml2.FreeThreadedDOMDocument\CurVer]
[HKCR\Interface\{0C05D096-F45B-4ACA-AD1A-AA0BC25518DC}\ProxyStubClsid32]
[HKCR\Interface\{3F7F31AC-E15F-11D0-9C25-00C04FC99C8E}\ProxyStubClsid]
[HKCR\CLSID\{3124C396-FB13-4836-A6AD-1317F1713688}\InProcServer32]
[HKCR\Interface\{2E9196BF-13BA-4DD4-91CA-6C571F281495}\ProxyStubClsid32]
[HKCR\CLSID\{7E3FCEA1-31B4-11D2-AE1F-0080C7337EA1}\InProcServer32]
[HKCR\Interface\{2E9196BF-13BA-4DD4-91CA-6C571F281495}]
[HKCR\Interface\{2933BF88-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
[HKCR\CLSID\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}\InProcServer32]
[HKCR\Microsoft.FreeThreadedXMLDOM.1.0]
[HKCR\CLSID\{989D1DC0-B162-11D1-B6EC-D27DDCF9A923}\InProcServer32]
[HKCR\CLSID\{F5078F35-C551-11D3-89B9-0000F81FE221}\InProcServer32]
[HKCR\CLSID\{4DD441AD-526D-4A77-9F1B-9841ED802FB0}\ProgID]
[HKCR\Interface\{10DC0586-132B-4CAC-8BB3-DB00AC8B7EE0}]
[HKCR\CLSID\{4DD441AD-526D-4A77-9F1B-9841ED802FB0}\TypeLib]
[HKCR\Interface\{50EA08BC-DD1B-4664-9A50-C2F40F4BD79A}]
[HKCR\Msxml2.MXXMLWriter]
[HKCR\CLSID\{ED8C108E-4349-11D2-91A4-00C04F7969E8}\ProgID]
[HKCR\Interface\{2933BF82-7B36-11D2-B20E-00C04F983E60}]
[HKCR\Interface\{F52E2B61-18A1-11D1-B105-00805F49916B}\TypeLib]
[HKCR\CLSID\{2933BF94-7B36-11D2-B20E-00C04F983E60}\TypeLib]
[HKCR\Microsoft.FreeThreadedXMLDOM\CLSID]
[HKCR\Microsoft.FreeThreadedXMLDOM\CurVer]
[HKCR\Interface\{50EA08BD-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid32]
[HKCR\CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}\ProgID]
[HKCR\CLSID\{F5078F34-C551-11D3-89B9-0000F81FE221}\Version]
[HKCR\Interface\{50EA08B1-DD1B-4664-9A50-C2F40F4BD79A}]
[HKCR\Msxml2.DSOControl]
[HKCR\Interface\{2933BF83-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
[HKCR\xmlfile]
[HKCR\CLSID\{AFBA6B42-5692-48EA-8141-DC517DCF0EF1}\Version]
[HKCR\xmlfile\DefaultIcon]
[HKCR\CLSID\{F5078F33-C551-11D3-89B9-0000F81FE221}]
[HKCR\Interface\{2933BF84-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
[HKCR\Interface\{0C05D096-F45B-4ACA-AD1A-AA0BC25518DC}]
[HKCR\xslfile]
[HKCR\Interface\{2933BF87-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
[HKCR\MSXML.DOMDocument]
[HKCR\Interface\{50EA08BC-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid32]
[HKCR\Interface\{50EA08B7-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid32]
[HKCR\Interface\{AA634FC7-5888-44A7-A257-3A47150D3A0E}\ProxyStubClsid]
[HKCR\Msxml2.SAXXMLReader.3.0]
[HKCR\CLSID\{F5078F37-C551-11D3-89B9-0000F81FE221}\Version]
[HKCR\Msxml2.DOMDocument\CurVer]
[HKCR\Msxml2.MXXMLWriter.3.0]
[HKCR\CLSID\{3E784A01-F3AE-4DC0-9354-9526B9370EBA}\TypeLib]
[HKCR\Interface\{3EFAA429-272F-11D2-836F-0000F87A7782}\ProxyStubClsid]
[HKCR\CLSID\{F5078F31-C551-11D3-89B9-0000F81FE221}\Version]
[HKCR\Interface\{373984C8-B845-449B-91E7-45AC83036ADE}]
[HKCR\Interface\{3EFAA427-272F-11D2-836F-0000F87A7782}\TypeLib]
[HKCR\CLSID\{48123BC4-99D9-11D1-A6B3-00C04FD91555}\BrowseInPlace]
[HKCR\xslfile\shell\Open\ddeexec]
[HKCR\Microsoft.FreeThreadedXMLDOM.1.0\CLSID]
[HKCR\Msxml2.SAXXMLReader\CLSID]
[HKCR\CLSID\{079AA557-4A18-424A-8EEE-E39F0A8D41B9}\Version]
[HKCR\Interface\{FA4BB38C-FAF9-4CCA-9302-D1DD0FE520DB}\ProxyStubClsid]
[HKCR\CLSID\{F5078F40-C551-11D3-89B9-0000F81FE221}\DefaultIcon]
[HKCR\Msxml2.XMLHTTP]
[HKCR\CLSID\{989D1DC0-B162-11D1-B6EC-D27DDCF9A923}\Implemented Categories\{F0B7A1A2-9847-11CF-8F20-00805F2CD064}]
[HKCR\CLSID\{F6D90F14-9C73-11D3-B32E-00C04F990BB4}\VersionIndependentProgID]
[HKCR\Interface\{50EA08BD-DD1B-4664-9A50-C2F40F4BD79A}]
[HKCR\Interface\{2933BF83-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
[HKCR\Msxml2.XSLTemplate.3.0\CLSID]
[HKCR\Interface\{2933BF89-7B36-11D2-B20E-00C04F983E60}\TypeLib]
[HKCR\Interface\{2933BF80-7B36-11D2-B20E-00C04F983E60}]
[HKCR\CLSID\{AFB40FFD-B609-40A3-9828-F88BBE11E4E3}\Version]
[HKCR\Interface\{50EA08B1-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid32]
[HKCR\Interface\{50EA08B6-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid32]
[HKCR\Interface\{50EA08B6-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
[HKCR\.xml]
[HKCR\CLSID\{2933BF94-7B36-11D2-B20E-00C04F983E60}\ProgID]
[HKCR\CLSID\{F5078F36-C551-11D3-89B9-0000F81FE221}\InProcServer32]
[HKCR\Msxml2.ServerXMLHTTP.3.0]
[HKCR\CLSID\{379E501F-B231-11D1-ADC1-00805FC752D8}]
[HKCR\Interface\{2933BF89-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
[HKCR\CLSID\{3E784A01-F3AE-4DC0-9354-9526B9370EBA}]
[HKCR\xslfile\CLSID]
[HKCR\CLSID\{F5078F41-C551-11D3-89B9-0000F81FE221}\InProcServer32]
[HKCR\CLSID\{7E3FCEA1-31B4-11D2-AE1F-0080C7337EA1}]
[HKCR\Interface\{2933BF93-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
[HKCR\Interface\{0C05D096-F45B-4ACA-AD1A-AA0BC25518DC}\ProxyStubClsid]
[HKCR\CLSID\{550DDA30-0541-11D2-9CA9-0060B0EC3D39}\InProcServer32]
[HKCR\Interface\{50EA08B0-DD1B-4664-9A50-C2F40F4BD79A}]
[HKCR\CLSID\{2933BF91-7B36-11D2-B20E-00C04F983E60}\InProcServer32]
[HKCR\Interface\{E8917260-7579-4BE1-B5DD-7AFBFA6F077B}\ProxyStubClsid32]
[HKCR\Interface\{FA4BB38C-FAF9-4CCA-9302-D1DD0FE520DB}]
[HKCR\Interface\{3EFAA425-272F-11D2-836F-0000F87A7782}\ProxyStubClsid32]
[HKCR\Interface\{3EFAA425-272F-11D2-836F-0000F87A7782}\ProxyStubClsid]
[HKCR\CLSID\{CFC399AF-D876-11D0-9C10-00C04FC99C8E}\InProcServer32]
[HKCR\CLSID\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}\TypeLib]
[HKCR\Interface\{E8917260-7579-4BE1-B5DD-7AFBFA6F077B}]
[HKCR\Interface\{C90352F7-643C-4FBC-BB23-E996EB2D51FD}\TypeLib]
[HKCR\Msxml2.SAXAttributes.3.0\CLSID]
[HKCR\CLSID\{F5078F40-C551-11D3-89B9-0000F81FE221}\Version]
[HKCR\Microsoft.XMLParser\CurVer]
[HKCR\Interface\{50EA08B5-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid32]
[HKCR\CLSID\{3D813DFE-6C91-4A4E-8F41-04346A841D9C}\TypeLib]
[HKCR\Interface\{3EFAA428-272F-11D2-836F-0000F87A7782}\ProxyStubClsid]
[HKCR\XML]
[HKCR\CLSID\{F5078F36-C551-11D3-89B9-0000F81FE221}\TypeLib]
[HKCR\CLSID\{AFBA6B42-5692-48EA-8141-DC517DCF0EF1}\TypeLib]
[HKCR\CLSID\{AFB40FFD-B609-40A3-9828-F88BBE11E4E3}\VersionIndependentProgID]
[HKCR\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\TypeLib]
[HKCR\Interface\{796E7AC5-5AA2-4EFF-ACAD-3FAAF01A3288}\ProxyStubClsid]
[HKCR\Interface\{50EA08B9-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid32]
[HKCR\CLSID\{F5078F35-C551-11D3-89B9-0000F81FE221}]
[HKCR\Interface\{3EFAA413-272F-11D2-836F-0000F87A7782}\TypeLib]
[HKCR\Msxml2.XMLParser\CurVer]
[HKCR\Interface\{D4D4A0FC-3B73-11D1-B2B4-00C04FB92596}]
[HKCR\CLSID\{F5078F39-C551-11D3-89B9-0000F81FE221}]
[HKCR\CLSID\{379E501F-B231-11D1-ADC1-00805FC752D8}\InProcServer32]
[HKCR\Interface\{2933BF96-7B36-11D2-B20E-00C04F983E60}\TypeLib]
[HKCR\Interface\{2E01311B-C322-4B0A-BD77-B90CFDC8DCE7}]
[HKCR\Interface\{50EA08BE-DD1B-4664-9A50-C2F40F4BD79A}]
[HKCR\Msxml2.MXXMLWriter.3.0\CLSID]
[HKCR\Interface\{FA4BB38C-FAF9-4CCA-9302-D1DD0FE520DB}\TypeLib]
[HKCR\Interface\{2933BF8A-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
[HKCR\Microsoft.XMLDSO]
[HKCR\Msxml2.SAXAttributes.3.0]
[HKCR\Msxml2.ServerXMLHTTP.3.0\CLSID]
[HKCR\Interface\{2933BF80-7B36-11D2-B20E-00C04F983E60}\TypeLib]
[HKCR\Interface\{50EA08BE-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
[HKCR\Microsoft.XMLParser\CLSID]
[HKCR\Interface\{2933BF95-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
[HKCR\CLSID\{F5078F36-C551-11D3-89B9-0000F81FE221}\VersionIndependentProgID]
[HKCR\Interface\{2933BF80-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
[HKCR\Interface\{50EA08B3-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid32]
[HKCR\Interface\{2933BF95-7B36-11D2-B20E-00C04F983E60}]
[HKCR\Microsoft.XMLDSO\CurVer]
[HKCR\CLSID\{2933BF91-7B36-11D2-B20E-00C04F983E60}\TypeLib]
[HKCR\CLSID\{F6D90F14-9C73-11D3-B32E-00C04F990BB4}\InProcServer32]
[HKCR\Interface\{4D7FF4BA-1565-4EA8-94E1-6E724A46F98D}\ProxyStubClsid32]
[HKCR\Interface\{65725580-9B5D-11D0-9BFE-00C04FC99C8E}\ProxyStubClsid]
[HKCR\CLSID\{F6D90F12-9C73-11D3-B32E-00C04F990BB4}\ProgID]
[HKCR\CLSID\{3D813DFE-6C91-4A4E-8F41-04346A841D9C}\ProgID]
[HKCR\CLSID\{F5078F37-C551-11D3-89B9-0000F81FE221}]
[HKCR\Interface\{2933BF8C-7B36-11D2-B20E-00C04F983E60}\TypeLib]
[HKCR\CLSID\{F6D90F12-9C73-11D3-B32E-00C04F990BB4}\TypeLib]
[HKCR\CLSID\{3D813DFE-6C91-4A4E-8F41-04346A841D9C}\InProcServer32]
[HKCR\Interface\{2933BF87-7B36-11D2-B20E-00C04F983E60}\TypeLib]
[HKCR\Interface\{50EA08B0-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid]
[HKCR\Interface\{AA634FC7-5888-44A7-A257-3A47150D3A0E}\TypeLib]
[HKCR\Microsoft.XMLDSO.1.0]
[HKCR\CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}\TypeLib]
[HKCR\Msxml2.XMLParser\CLSID]
[HKCR\Msxml2.XSLTemplate]
[HKCR\Interface\{2933BF96-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
[HKCR\Interface\{2933BF83-7B36-11D2-B20E-00C04F983E60}]
[HKCR\CLSID\{F5078F39-C551-11D3-89B9-0000F81FE221}\InProcServer32]
[HKCR\CLSID\{2933BF91-7B36-11D2-B20E-00C04F983E60}\Version]
[HKCR\CLSID\{4DD441AD-526D-4A77-9F1B-9841ED802FB0}\InProcServer32]
[HKCR\Interface\{E8917260-7579-4BE1-B5DD-7AFBFA6F077B}\TypeLib]
[HKCR\Interface\{50EA08B4-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid32]
[HKCR\CLSID\{48123BC4-99D9-11D1-A6B3-00C04FD91555}]
[HKCR\Interface\{2933BF8C-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
[HKCR\CLSID\{F6D90F14-9C73-11D3-B32E-00C04F990BB4}\Version]
[HKCR\CLSID\{079AA557-4A18-424A-8EEE-E39F0A8D41B9}\VersionIndependentProgID]
[HKCR\Msxml2.MXXMLWriter\CLSID]
[HKCR\CLSID\{ED8C108E-4349-11D2-91A4-00C04F7969E8}\TypeLib]
[HKCR\CLSID\{3E784A01-F3AE-4DC0-9354-9526B9370EBA}\Version]
[HKCR\Interface\{3EFAA428-272F-11D2-836F-0000F87A7782}]
[HKCR\Interface\{C90352F5-643C-4FBC-BB23-E996EB2D51FD}\ProxyStubClsid]
[HKCR\Interface\{8C033CAA-6CD6-4F73-B728-4531AF74945F}]
[HKCR\CLSID\{373984C9-B845-449B-91E7-45AC83036ADE}\InProcServer32]
[HKCR\MSXML.FreeThreadedDOMDocument\CurVer]
[HKCR\Msxml2.XSLTemplate\CurVer]
[HKCR\Interface\{2933BF81-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
[HKCR\Interface\{373984C8-B845-449B-91E7-45AC83036ADE}\ProxyStubClsid]
[HKCR\Interface\{2933BF81-7B36-11D2-B20E-00C04F983E60}\TypeLib]
[HKCR\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\3.0\0]
[HKCR\CLSID\{F5078F35-C551-11D3-89B9-0000F81FE221}\Version]
[HKCR\CLSID\{F5078F19-C551-11D3-89B9-0000F81FE221}\VersionIndependentProgID]
[HKCR\Interface\{50EA08B5-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
[HKCR\Microsoft.XMLHTTP.1.0\CLSID]
[HKCR\CLSID\{f5078f27-c551-11d3-89b9-0000f81fe221}]
[HKCR\CLSID\{550DDA30-0541-11D2-9CA9-0060B0EC3D39}\VersionIndependentProgID]
[HKCR\CLSID\{2933BF94-7B36-11D2-B20E-00C04F983E60}\InProcServer32]
[HKCR\Msxml2.SAXXMLReader]
[HKCR\CLSID\{CFC399AF-D876-11D0-9C10-00C04FC99C8E}\TypeLib]
[HKCR\Interface\{2933BF8F-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
[HKCR\CLSID\{3124C396-FB13-4836-A6AD-1317F1713688}\TypeLib]
[HKCR\Msxml2.XMLHTTP\CLSID]
[HKCR\CLSID\{3E784A01-F3AE-4DC0-9354-9526B9370EBA}\VersionIndependentProgID]
[HKCR\XML\OLEScript]
[HKCR\Interface\{2933BF88-7B36-11D2-B20E-00C04F983E60}\TypeLib]
[HKCR\Msxml2.XMLHTTP.3.0\CLSID]
[HKCR\Interface\{2933BF92-7B36-11D2-B20E-00C04F983E60}\TypeLib]
[HKCR\Interface\{65725580-9B5D-11D0-9BFE-00C04FC99C8E}]
[HKCR\CLSID\{550DDA30-0541-11D2-9CA9-0060B0EC3D39}]
[HKCR\Msxml2.FreeThreadedDOMDocument.3.0\CLSID]
[HKCR\CLSID\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}\ProgID]
[HKCR\Interface\{50EA08B0-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
[HKCR\Interface\{3EFAA425-272F-11D2-836F-0000F87A7782}]
[HKCR\Interface\{3EFAA413-272F-11D2-836F-0000F87A7782}]
[HKCR\CLSID\{F5078F37-C551-11D3-89B9-0000F81FE221}\InProcServer32]
[HKCR\MSXML.FreeThreadedDOMDocument]
[HKCR\CLSID\{F5078F41-C551-11D3-89B9-0000F81FE221}]
[HKCR\Msxml2.DSOControl.3.0\CLSID]
[HKCR\Interface\{2933BF8C-7B36-11D2-B20E-00C04F983E60}]
[HKCR\Interface\{2B8DE2FF-8D2D-11D1-B2FC-00C04FD915A9}]
[HKCR\Interface\{032AAC35-8C0E-4D9D-979F-E3B702935576}\ProxyStubClsid32]
[HKCR\CLSID\{ED8C108E-4349-11D2-91A4-00C04F7969E8}\InProcServer32]
[HKCR\CLSID\{AFB40FFD-B609-40A3-9828-F88BBE11E4E3}]
[HKCR\Interface\{2933BF80-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
[HKCR\Interface\{2933BF8E-7B36-11D2-B20E-00C04F983E60}\TypeLib]
[HKCR\CLSID\{F5078F35-C551-11D3-89B9-0000F81FE221}\ProgID]
[HKCR\CLSID\{F5078F33-C551-11D3-89B9-0000F81FE221}\VersionIndependentProgID]
[HKCR\Interface\{032AAC35-8C0E-4D9D-979F-E3B702935576}\ProxyStubClsid]
[HKCR\CLSID\{F5078F34-C551-11D3-89B9-0000F81FE221}\InProcServer32]
[HKCR\CLSID\{989D1DC0-B162-11D1-B6EC-D27DDCF9A923}\OLEScript]
[HKCR\Interface\{2933BF83-7B36-11D2-B20E-00C04F983E60}\TypeLib]
[HKCR\Interface\{50EA08B6-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid]
[HKCR\CLSID\{373984C9-B845-449B-91E7-45AC83036ADE}\TypeLib]
[HKCR\Interface\{50EA08B0-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid32]
[HKCR\Msxml2.DOMDocument.3.0\CLSID]
[HKCR\Interface\{2933BF82-7B36-11D2-B20E-00C04F983E60}\TypeLib]
[HKCR\Interface\{10DC0586-132B-4CAC-8BB3-DB00AC8B7EE0}\ProxyStubClsid]
[HKCR\CLSID\{F5078F36-C551-11D3-89B9-0000F81FE221}\ProgID]
[HKCR\CLSID\{FC220AD8-A72A-4EE8-926E-0B7AD152A020}]
[HKCR\CLSID\{3124C396-FB13-4836-A6AD-1317F1713688}]
[HKCR\Microsoft.XMLDOM]
[HKCR\Msxml2.XMLHTTP.3.0]
[HKCR\Interface\{2933BF8F-7B36-11D2-B20E-00C04F983E60}]
[HKCR\CLSID\{4DD441AD-526D-4A77-9F1B-9841ED802FB0}\VersionIndependentProgID]
[HKCR\Interface\{50EA08B9-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid]
[HKCR\Interface\{2933BF8A-7B36-11D2-B20E-00C04F983E60}\TypeLib]
[HKCR\Msxml2.MXXMLWriter\CurVer]
[HKCR\Interface\{50EA08B5-DD1B-4664-9A50-C2F40F4BD79A}]
[HKCR\Microsoft.XMLHTTP\CurVer]
[HKCR\Interface\{2E9196BF-13BA-4DD4-91CA-6C571F281495}\ProxyStubClsid]
[HKCR\CLSID\{F5078F27-C551-11D3-89B9-0000F81FE221}\InProcServer32]
[HKCR\Interface\{50EA08B4-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid]
[HKCR\CLSID\{FC220AD8-A72A-4EE8-926E-0B7AD152A020}\InProcServer32]
[HKCR\Msxml2.ServerXMLHTTP]
[HKCR\Interface\{2933BF93-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
[HKCR\Interface\{2933BF8A-7B36-11D2-B20E-00C04F983E60}]
[HKCR\CLSID\{ED8C108E-4349-11D2-91A4-00C04F7969E8}\VersionIndependentProgID]
[HKCR\Microsoft.XMLParser.1.0]
[HKCR\CLSID\{3E784A01-F3AE-4DC0-9354-9526B9370EBA}\ProgID]
[HKCR\Interface\{796E7AC5-5AA2-4EFF-ACAD-3FAAF01A3288}]
[HKCR\Interface\{2933BF92-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
[HKCR\CLSID\{373984C9-B845-449B-91E7-45AC83036ADE}]
[HKCR\CLSID\{CFC399AF-D876-11D0-9C10-00C04FC99C8E}\ProgID]
[HKCR\Interface\{50EA08BA-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid32]
[HKCR\CLSID\{ED8C108E-4349-11D2-91A4-00C04F7969E8}]
[HKCR\CLSID\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}\VersionIndependentProgID]
[HKCR\CLSID\{F6D90F12-9C73-11D3-B32E-00C04F990BB4}]
[HKCR\Interface\{50EA08BB-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid]
[HKCR\Interface\{2E01311B-C322-4B0A-BD77-B90CFDC8DCE7}\ProxyStubClsid32]
[HKCR\CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}]
[HKCR\CLSID\{3D813DFE-6C91-4A4E-8F41-04346A841D9C}]
[HKCR\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\Version]
[HKCR\Interface\{50EA08B9-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
[HKCR\Interface\{1299EB1B-5B88-433E-82DE-82CA75AD4E04}\ProxyStubClsid32]
[HKCR\Interface\{F52E2B61-18A1-11D1-B105-00805F49916B}\ProxyStubClsid32]
[HKCR\xslfile\shell\Open\ddeexec\application]
[HKCR\Interface\{4D7FF4BA-1565-4EA8-94E1-6E724A46F98D}]
[HKCR\xmlfile\shell\Open]
[HKCR\Interface\{C90352F4-643C-4FBC-BB23-E996EB2D51FD}\ProxyStubClsid32]
[HKCR\CLSID\{3124C396-FB13-4836-A6AD-1317F1713688}\Version]
[HKCR\Msxml2.XMLSchemaCache]
[HKCR\Msxml2.SAXAttributes\CLSID]
[HKCR\Interface\{0C05D096-F45B-4ACA-AD1A-AA0BC25518DC}\TypeLib]
[HKCR\CLSID\{2933BF91-7B36-11D2-B20E-00C04F983E60}\ProgID]
[HKCR\Interface\{50EA08B3-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
[HKCR\CLSID\{379E501F-B231-11D1-ADC1-00805FC752D8}\TypeLib]
[HKCR\Interface\{2933BF86-7B36-11D2-B20E-00C04F983E60}]
[HKCR\Interface\{2933BF85-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
[HKCR\MIME\Database\Content Type\text/xml]
[HKCR\Microsoft.XMLParser.1.0\CLSID]
[HKCR\Interface\{24FB3297-302D-4620-BA39-3A732D850558}\ProxyStubClsid]
[HKCR\CLSID\{373984C9-B845-449B-91E7-45AC83036ADE}\Version]
[HKCR\Interface\{50EA08B8-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
[HKCR\CLSID\{3E784A01-F3AE-4DC0-9354-9526B9370EBA}\InProcServer32]
[HKCR\CLSID\{F5078F3F-C551-11D3-89B9-0000F81FE221}]
[HKCR\CLSID\{F5078F34-C551-11D3-89B9-0000F81FE221}]
[HKCR\CLSID\{079AA557-4A18-424A-8EEE-E39F0A8D41B9}\ProgID]
[HKCR\Interface\{1299EB1B-5B88-433E-82DE-82CA75AD4E04}\TypeLib]
[HKCR\CLSID\{FC220AD8-A72A-4EE8-926E-0B7AD152A020}\Version]
[HKCR\CLSID\{F5078F36-C551-11D3-89B9-0000F81FE221}]
[HKCR\Interface\{808F4E35-8D5A-4FBE-8466-33A41279ED30}\TypeLib]
[HKCR\XML\CLSID]
[HKCR\Interface\{2ED7290A-4DD5-4B46-BB26-4E4155E77FAA}\TypeLib]
[HKCR\CLSID\{48123BC4-99D9-11D1-A6B3-00C04FD91555}\DefaultIcon]
[HKCR\CLSID\{079AA557-4A18-424A-8EEE-E39F0A8D41B9}\InProcServer32]
[HKCR\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\VersionIndependentProgID]
[HKCR\CLSID\{373984C9-B845-449B-91E7-45AC83036ADE}\VersionIndependentProgID]
[HKCR\CLSID\{3124C396-FB13-4836-A6AD-1317F1713688}\ProgID]
[HKCR\Interface\{D963D3FE-173C-4862-9095-B92F66995F52}]
[HKCR\Interface\{2933BF8F-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
[HKCR\Interface\{1299EB1B-5B88-433E-82DE-82CA75AD4E04}]
[HKCR\CLSID\{F5078F33-C551-11D3-89B9-0000F81FE221}\Version]
[HKCR\CLSID\{F5078F19-C551-11D3-89B9-0000F81FE221}]
[HKCR\Interface\{2933BF8D-7B36-11D2-B20E-00C04F983E60}\TypeLib]
[HKCR\MIME\Database\Content Type\application/xml]
[HKCR\MSXML.FreeThreadedDOMDocument\CLSID]
[HKCR\CLSID\{F5078F39-C551-11D3-89B9-0000F81FE221}\Version]
[HKCR\xslfile\DefaultIcon]
[HKCR\Interface\{3EFAA428-272F-11D2-836F-0000F87A7782}\TypeLib]
[HKCR\CLSID\{D2423620-51A0-11D2-9CAF-0060B0EC3D39}\InProcServer32]
[HKCR\Msxml2.ServerXMLHTTP\CLSID]
[HKCR\Interface\{808F4E35-8D5A-4FBE-8466-33A41279ED30}]
[HKCR\Interface\{2933BF84-7B36-11D2-B20E-00C04F983E60}]
[HKCR\Interface\{3EFAA426-272F-11D2-836F-0000F87A7782}]
[HKCR\Msxml2.XMLSchemaCache\CurVer]
[HKCR\CLSID\{079AA557-4A18-424A-8EEE-E39F0A8D41B9}\TypeLib]
[HKCR\xslfile\shell\Open\command]
[HKCR\Interface\{2933BF85-7B36-11D2-B20E-00C04F983E60}\TypeLib]
[HKCR\Interface\{310AFA62-0575-11D2-9CA9-0060B0EC3D39}\ProxyStubClsid]
[HKCR\Interface\{2933BF86-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid]
[HKCR\CLSID\{F5078F31-C551-11D3-89B9-0000F81FE221}\InProcServer32]
[HKCR\Interface\{3EFAA426-272F-11D2-836F-0000F87A7782}\TypeLib]
[HKCR\Interface\{C90352F5-643C-4FBC-BB23-E996EB2D51FD}\TypeLib]
[HKCR\Interface\{3EFAA413-272F-11D2-836F-0000F87A7782}\ProxyStubClsid]
[HKCR\Msxml2.DSOControl\CurVer]
[HKCR\Interface\{2933BF8D-7B36-11D2-B20E-00C04F983E60}]
[HKCR\Interface\{373984C8-B845-449B-91E7-45AC83036ADE}\ProxyStubClsid32]
[HKCR\CLSID\{F5078F39-C551-11D3-89B9-0000F81FE221}\TypeLib]
[HKCR\Interface\{C90352F7-643C-4FBC-BB23-E996EB2D51FD}\ProxyStubClsid]
[HKCR\Interface\{2933BF84-7B36-11D2-B20E-00C04F983E60}\TypeLib]
[HKCR\Interface\{2933BF87-7B36-11D2-B20E-00C04F983E60}]
[HKCR\Interface\{2933BF93-7B36-11D2-B20E-00C04F983E60}]
[HKCR\Interface\{50EA08B2-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid]
[HKCR\CLSID\{F6D90F14-9C73-11D3-B32E-00C04F990BB4}]
[HKCR\Interface\{310AFA62-0575-11D2-9CA9-0060B0EC3D39}\ProxyStubClsid32]
[HKCR\CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}\VersionIndependentProgID]
[HKCR\CLSID\{2933BF90-7B36-11d2-B20E-00C04F983E60}\InProcServer32]
[HKCR\Interface\{2933BF92-7B36-11D2-B20E-00C04F983E60}]
[HKCR\Interface\{3EFAA425-272F-11D2-836F-0000F87A7782}\TypeLib]
[HKCR\xmlfile\shell\Open\ddeexec]
[HKCR\CLSID\{F5078F19-C551-11D3-89B9-0000F81FE221}\ProgID]
[HKCR\xmlfile\CLSID]
[HKCR\Interface\{2933BF8B-7B36-11D2-B20E-00C04F983E60}\TypeLib]
[HKCR\CLSID\{48123BC4-99D9-11D1-A6B3-00C04FD91555}\InProcServer32]
[HKCR\Msxml2.XSLTemplate.3.0]
[HKCR\Interface\{2933BF87-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid32]
[HKCR\CLSID\{AFB40FFD-B609-40A3-9828-F88BBE11E4E3}\InProcServer32]
[HKCR\Interface\{FA4BB38C-FAF9-4CCA-9302-D1DD0FE520DB}\ProxyStubClsid32]
[HKCR\Interface\{2933BF96-7B36-11D2-B20E-00C04F983E60}]
[HKCR\Msxml2.FreeThreadedDOMDocument.3.0]
[HKCR\Msxml2.XMLSchemaCache.3.0]
[HKCR\Interface\{D963D3FE-173C-4862-9095-B92F66995F52}\TypeLib]
[HKCR\Microsoft.XMLDSO.1.0\CLSID]
[HKCR\Interface\{50EA08B2-DD1B-4664-9A50-C2F40F4BD79A}\TypeLib]
[HKCR\Interface\{2B8DE2FE-8D2D-11d1-B2FC-00C04FD915A9}\ProxyStubClsid32]
[HKCR\Interface\{ED8C108D-4349-11D2-91A4-00C04F7969E8}\ProxyStubClsid32]
[HKCR\CLSID\{F5078F33-C551-11D3-89B9-0000F81FE221}\TypeLib]
[HKCR\Interface\{2933BF95-7B36-11D2-B20E-00C04F983E60}\TypeLib]
[HKCR\.xsl]
[HKCR\Msxml2.DSOControl.3.0]
[HKCR\Interface\{796E7AC5-5AA2-4EFF-ACAD-3FAAF01A3288}\ProxyStubClsid32]
[HKCR\Interface\{C90352F7-643C-4FBC-BB23-E996EB2D51FD}\ProxyStubClsid32]
[HKCR\CLSID\{4DD441AD-526D-4A77-9F1B-9841ED802FB0}\Version]
The process lbha.exe:1248 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "40 E9 97 FE 7C 9C 26 C3 F2 E0 55 8D 5A 83 72 64"
The process irsetup.exe:764 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Video" = ""
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Fonts" = "%WinDir%\Fonts"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Music" = "%Documents and Settings%\%current user%\My Documents\My Music"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "76 1E AB F9 22 CC 6B 1D 5C 1E B7 C3 E8 7F 53 C8"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process %original file name%.exe:376 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "26 09 B1 B8 AC 48 10 32 F1 2F 6F EF F2 B3 D9 3D"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsh7F.tmp\ExecDos.dll,"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
Dropped PE files
| MD5 | File path |
|---|---|
| dec931e86140139380ea0df57cd132b6 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\_ir_sf_temp_0\irsetup.exe |
| b5fc476c1bf08d5161346cc7dd4cb0ba | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\_ir_sf_temp_0\lua5.1.dll |
| 9f993782951aabec131489e14cd69a5e | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\dvprprld.exe |
| f0c7c1c9b295931bcf17122ff0b8e66a | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\fenopy.exe |
| 42badc1d2f03a8b1e4875740d3d49336 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\lbha.exe |
| ebcf9f71d804abab3c2e5ce4c17dc22e | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsh7F.tmp\ExecDos.dll |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.
VersionInfo
Company Name: Intuit Inc, 2012
Product Name: TurboTax 2012 Installer
Product Version: 2012.01.00.0025
Legal Copyright: (c) Intuit, Inc. All rights reserved.
Legal Trademarks:
Original Filename: MSIInstallerBootstrap.exe
Internal Name: MSIInstallerBootstrap.exe
File Version: 2012.01.00.0025
File Description: TurboTax 2012 Installer
Comments:
Language: English (United States)
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| UPX0 | 4096 | 487424 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
| UPX1 | 491520 | 53248 | 49664 | 5.46449 | 80506f4727ac0674370c74a62c4ce369 |
| .rsrc | 544768 | 4096 | 3584 | 2.38674 | 423b629103a7892b39708b1ba0f12c38 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 1
c3322c5847f010e175444e8cb26b2e86
URLs
No activity has been detected.
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Web Traffic was not found.
The Trojan connects to the servers at the folowing location(s):
.text
`.rdata
@.data
.rsrc
PSSh8
9>t.hX
tFHt:Ht.Ht"Hu`
SSSShh
tWSShW
tl9_ tgSSh
t'SShl
u$SShe
j%XtL9E
FtPW
SSh@B
FTCP
tAHt.HHt
<SShG
s%j.Zf
xSSSh
FTPjKS
FtPj;S
C.PjRV
CNotSupportedException
CCmdTarget
RegOpenKeyTransactedW
RegCreateKeyTransactedW
RegDeleteKeyTransactedW
RegDeleteKeyExW
TaskDialogIndirect
CMDITabProxyWnd
CMDIChildWndEx
CMDIFrameWndEx
CMDIChildWnd
CMDIFrameWnd
CMDIClientAreaWnd
CMFCToolBarsKeyboardPropertyPage
GetProcessWindowStation
operator
portuguese-brazilian
#Visual C CRT: Not enough memory to complete call to strerror.
Broken pipe
Inappropriate I/O control operation
Operation not permitted
D:\dev\BootStrapper\Release\MSIInstallerBootstrap.pdb
VERSION.dll
SHLWAPI.dll
PSAPI.DLL
msi.dll
WININET.dll
GetSystemWindowsDirectoryW
GetWindowsDirectoryW
GetCPInfo
GetProcessHeap
KERNEL32.dll
EnumWindows
ExitWindowsEx
CreateDialogIndirectParamW
UnhookWindowsHookEx
GetKeyState
SetWindowsHookExW
GetKeyNameTextW
MapVirtualKeyW
GetAsyncKeyState
GetKeyboardLayout
GetKeyboardState
MapVirtualKeyExW
USER32.dll
GetViewportExtEx
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
GetViewportOrgEx
GDI32.dll
MSIMG32.dll
COMDLG32.dll
WINSPOOL.DRV
RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyW
RegEnumKeyExW
ADVAPI32.dll
ShellExecuteW
SHELL32.dll
COMCTL32.dll
ole32.dll
OLEAUT32.dll
oledlg.dll
OLEACC.dll
GdiplusShutdown
gdiplus.dll
IMM32.dll
WINMM.dll
.PAVCOleException@@
.PAVCObject@@
.PAVCMemoryException@@
.PAVCSimpleException@@
.PAVCNotSupportedException@@
.PAVCInvalidArgException@@
.?AVCNotSupportedException@@
.PAVCArchiveException@@
.PAVCResourceException@@
.PAVCUserException@@
.?AVCTestCmdUI@@
.?AVCCmdUI@@
.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@
.?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@
.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WV12@PB_W@@
.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WPAVCDocument@@PAV3@@@
.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W_N_N@@
.?AV?$CMap@PAVCDocument@@PAV1@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W@@
.PAVCFileException@@
.?AVCMDITabProxyWnd@@
.?AVCMDIChildWndEx@@
.?AVCMDIChildWnd@@
.?AVCMDIFrameWndEx@@
.?AVCMDIFrameWnd@@
.?AVCMFCToolBarCmdUI@@
.PAVCOleDispatchException@@
.?AV?$CList@PAVCMDIChildWndEx@@PAV1@@@
.?AVCMDIClientAreaWnd@@
.?AVCMFCRibbonCmdUI@@
.?AVCMFCCmdUsageCount@@
.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WPAVCObList@@PAV3@@@
.?AVCMFCColorBarCmdUI@@
.?AV?$CMap@KKV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W@@
.?AVCMFCAcceleratorKey@@
.?AVCMFCRibbonKeyTip@@
.?AVCMFCToolBarsKeyboardPropertyPage@@
.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WHH@@
.?AVCMFCTasksPaneToolBarCmdUI@@
.?AVCMFCAcceleratorKeyAssignCtrl@@
zcÁ
.?AV?$CList@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AAV12@@@
.PAVCException@@
.?AVCURLEncode@@
.?AVCCmdTarget@@
C()%S
Y6.Bl-
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><application xmlns="urn:schemas-microsoft-com:asm.v3"><windowsSettings><ms_windowsSettings:dpiAware xmlns:ms_windowsSettings="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings" xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">true</ms_windowsSettings:dpiAware></windowsSettings></application><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS>Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Software\Microsoft\Windows\CurrentVersion\Policies\Network
Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32
KERNEL32.DLL
%s%s.dll
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp
lX-X-x-XX-XXXXXX
Acomctl32.dll
Acomdlg32.dll
accKeyboardShortcut
wuser32.dll
hhctrl.ocx
f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
Afx:%p:%x:%p:%p:%p
Afx:%p:%x
commctrl_DragListMsg
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp
Advapi32.dll
mfcm100u.dll
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
SHELL32.DLL
lXXxXXXXXXXX
dwmapi.dll
UxTheme.dll
eShell32.dll
%s:%x:%x:%x:%x
Af:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
A.INI
COMCTL32.DLL
USER32.DLL
%sMFCToolBar-%d%x
%sMFCToolBar-%d
%sMFCToolBarParameters
TOOLBAR_RESETKEYBAORD
KeyboardManager
MSG_CHECKEMPTYMINIFRAME
%sDockingManager-%d
MFCLink_UrlPrefix
MFCLink_Url
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp
&%d %s
%sMDIClientArea-%d
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\viewcore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleipfrm.cpp
%sBasePane-%d%x
%sBasePane-%d
%sPane-%d%x
%sPane-%d
windows
ShowCmd
IHex={X,X,X}A%sMFCOutlookBar-%d%x
%sMFCOutlookBar-%d
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp
%c%d%c%s
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olestrm.cpp
%sDockablePaneAdapter-%d%x
%sDockablePaneAdapter-%d
ENABLE_KEYS
KEYS_MENU
KEYS
ORICHED20.DLL
Pf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledrop2.cpp
RGB(%d, %d, %d)
%sMFCTasksPane-%d%x
%sMFCTasksPane-%d
mscoree.dll
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
E/q /norestart /ChainingPackage TurboTaxTY12 /pipe rbsection
%sPrerequisites\dotNetFx40c_setup.exe
{25B71949-448D-43e8-AA83-0F0F200D94A6}%sTurboTax 2012\TurboTax 2012 Installer.exe
%sPrerequisites\setupverifier.ini
autorun.inf
WOW64 value detected in the msiserver registry key. It should not be here. Removing it.
64bit OS = %d
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
admin rights = %d
Please contact us at support.turbotax.com
Local drive = %s, free bytes avail = %I64u (%I64u MB)
Local drive with enough free space = %s
Disk space (minimum %dMB)
hXXp://turbotax.intuit.com/support/in-product/439-system-requirements-2012/
SOFTWARE\Microsoft\Windows NT\CurrentVersion
Unable to open registry key value SOFTWARE\Microsoft\Windows NT\CurrentVersion\CSDVersion
Unable to open registry key value SOFTWARE\Microsoft\Windows NT\CurrentVersion\CurrentVersion
Unable to open registry key SOFTWARE\Microsoft\Windows NT\CurrentVersion
Sorry but TurboTax 2012 cannot be installed on your computer because your operating system is not supported.
Sorry but TurboTax 2012 cannot be installed on your computer because you need Windows XP Service Pack 3 installed.
WriteRegistryValue():: RegOpenKeyExW() failed.
WriteRegistryValue():: Invalid hKey returned.
%SystemRoot%\system32\msiexec.exe
FixupMsiexec1719():: Unable to ExpandEnvironmentsStringsW(MSIEXEC64PATH).
MsiExecCA64
Software\Microsoft\Windows\CurrentVersion\Installer
FixupMsiexec1719():: WriteRegistryValue(MSIEXECCA64NAME) failed.
%SystemRoot%\SysWOW64\msiexec.exe
FixupMsiexec1719():: Unable to ExpandEnvironmentsStringsW(MSIEXEC32PATH).
MsiExecCA32
FixupMsiexec1719():: WriteRegistryValue(MSIEXECCA32NAME) failed.
wusa.exe
CheckIfWindowsUpdateIsBusy()::CoCreateInstance() failed(%d).
CheckIfWindowsUpdateIsBusy()::spUpdateInstaller->get_IsBusy1() failed(%d).
We have detected that a Windows update is in progress. Please select "OK" to wait or "Cancel" to quit the install.
Windows update in progress...
CheckIfWindowsUpdateIsBusy()::spUpdateInstaller->get_IsBusy2() failed(%d).
CheckIfWindowsUpdateIsBusy():: WU restart service failed unexpectedly.
IsRebootRequired()::CoCreateInstance() failed(%d).
IsRebootRequired()::piSystemInformation->get_RebootRequired() failed(%d).
IsRebootRequired()::failed to intiialize COM(%d).
PauseAutomaticUpdates()::failed to pause automatic updates(%d).
PauseAutomaticUpdates()::CoCreateInstance() failed(%d).
PauseAutomaticUpdates()::failed to intiialize COM(%d).
\msiexec.exe
\sc.exe
\net.exe
ToggleMsiService():: Calling ExecCmd(msiexec.exe /regserver)
ToggleMsiService():: ExecCmd(msiexec.exe /regserver)=%d.
ToggleMsiService():: Calling ExecCmd(sc.exe config msiserver start= auto)
ToggleMsiService():: ExecCmd(sc.exe config msiserver start= auto)=%d.
ToggleMsiService():: Calling ExecCmd(net.exe stop msiserver)
ToggleMsiService():: ExecCmd(net.exe stop msiserver)=%d.
ToggleMsiService():: Calling ExecCmd(msiexec.exe /unreg)
ToggleMsiService():: ExecCmd(msiexec.exe /unreg)=%d.
ToggleMsiService():: Calling ExecCmd(net.exe start msiserver)
ToggleMsiService():: ExecCmd(net.exe start msiserver)=%d.
MicrosoftPreInstallNetFX()...
enabling Windows Update
Calling CheckIfWindowsUpdateIsBusy()...
CheckIfWindowsUpdateIsBusy() return = %ld.
unable to enable, check, pause Windows updates.
C:\Windows
%s\SysWOW64\regsvr32.exe
%s\SysWOW64\msxml3.dll /s
ensuring correct registry value for Windows Installer
FixupMsiexec1719() failed.
Calling ExecCmd(%s, %s, true)
unable to ExecCmd(%s, %s, true)= %d.
ExecCmd(%s, %s, true)=%d.
%s\System32\regsvr32.exe
%s\System32\msxml3.dll /s
ExecCmd(%s, %s, true)= %d.
Restoring Windows update
"%s" %s
Launching process %s
Launching process id is %d
Switching to window of process %d
Contact TurboTax Support
FxInstallRequired() - .NET 4.0 Full is already installed.
FxInstallRequired() - .NET 4.0 Client is already installed.
VerifyFXInstallation() calling VerifyFXState(%s)
hXXp://turbotax.intuit.com/support/in-product/445-repair-dot-net/
VerifyFXInstallation()::VerifyFXState(%s) failed.
VerifyFXInstallation() executing .NET utility tool.
VerifyFXInstallation() calling VerifyFXState() after .NET utility tool.
Looking for window of process %d
Found window of process %d
d:\Microsoft Visual Studio 10.0\VC\atlmfc\include\afxwin1.inl
%s (%s:%d)
hXXp://support.turbotax.com/tm/ttc/w/engn/updt/dbox/handleerr?lid=2999&pf=w
0.0.0:0.0
%d.%d.%d:%d.%d
&os=%s&ver=2012
&err=%s
Software\Microsoft\NET Framework Setup\NDP\v2.0.50727
Software\Microsoft\NET Framework Setup\NDP\v1.1.4322
Software\Microsoft\Active Setup\Installed Components\{FDC11A6F-17D1-48f9-9EA3-9051954BAA24}Software\Microsoft\Active Setup\Installed Components\{78705f0d-e8db-4b2d-8193-982bdda15ecd}Software\Microsoft\.NETFramework\Policy\v1.0
***WARNING*** %s
****ERROR**** %s
Unable to detect a valid operating system type
Detected operating system: Windows 2000
Detected operating system: Windows XP (x86)
Detected operating system: Windows XP (x64)
Detected operating system: Windows Server 2003 (x86)
Detected operating system: Windows Server 2003 (x64)
Detected operating system: Windows Vista (x86)
Detected operating system: Windows Vista (x64)
Detected operating system: Windows Server 2008 (x86)
Detected operating system: Windows Server 2008 (x64)
Detected operating system: Windows 7 (x86)
Detected operating system: Windows 7 (x64)
Detected operating system: Future version of Windows (x86)
Detected operating system: Future version of Windows (x64)
Detected operating system: Windows NT 4.0
Detected operating system: Windows 95
Detected operating system: Windows 98
Detected operating system: Windows ME
%s\shell32.dll
SOFTWARE\Microsoft\Windows\CurrentVersion
.NET Framework 4 Client
%s failed for '%s' with error code %d - %s
GetLastError returned error code %d - %s
Install state for .NET Framework 1.0: installed with service pack %i.
Install state for .NET Framework 1.0: installed with no service packs.
Install state for .NET Framework 1.0: not installed.
Install state for .NET Framework 1.1: installed with service pack %i.
Install state for .NET Framework 1.1: installed with no service packs.
Install state for .NET Framework 1.1: not installed.
Install state for .NET Framework 2.0: installed with service pack %i.
Install state for .NET Framework 2.0: installed with no service packs.
Install state for .NET Framework 2.0: not installed.
Install state for .NET Framework 3.0: installed with service pack %i.
Install state for .NET Framework 3.0: installed with no service packs.
Install state for .NET Framework 3.0: not installed.
Install state for .NET Framework 3.5: installed with service pack %i.
Install state for .NET Framework 3.5: installed with no service packs.
Install state for .NET Framework 3.5: not installed.
Install state for .NET Framework 4 Client: installed with service pack %i.
Install state for .NET Framework 4 Client: installed with no service packs.
Install state for .NET Framework 4 Client: not installed.
Install state for .NET Framework 4 Full: installed with service pack %i.
Install state for .NET Framework 4 Full: installed with no service packs.
Install state for .NET Framework 4 Full: not installed.
Section %s - start parsing entries
Section %s not found in %s - skipping
Unrecognized action type for section %s - skipping it
Section %s - stop parsing entries
Unable to find an ExecutablePath value for custom action '%s', exiting now
Processing custom action '%s'
ExecutablePath = '%s'
CommandLineParameters = '%s'
%s %s
FriendlyName = '%s'
WorkingDirectory = '%s'
TimeoutSeconds = '%s'
Running %s
Launching process '%s' now
Process successfully launched. Waiting %d seconds for it to complete.
Timeout value exceeded for process '%s'
Process '%s' exited with return code %d
Directory %s is installed on the system
Directory %s is not installed on the system
version %d.%d.%d.%d
File %s (%s) is installed on the system
File %s is not installed on the system
%s\msi.dll
MsiQueryProductState returned INSTALLSTATE_DEFAULT for product code %s
MsiGetProductInfo returned %s for locally cached MSI path
MSI product code %s is installed on the system
Locally cached MSI does not exist, skipping running msiexec /x
Badly formed INI file registry line %s
UNABLE TO OPEN REGISTRY KEY
REGISTRY KEY FOUND
Key: %s\%s
Value: %s
Checking for the existence of service '%s'
Failed to open Service Control Manager, cannot stop service '%s'
Failed to open the service '%s'
QueryServiceStatus failed for the service '%s'
The service '%s' is installed
Starting verification for product %s
Action%d
Action%d_OS
Not running action '%s' for product '%s' because the OS condition does not match
Verification succeeded for product %s
Verification failed for product %s
kernel32.dll
shell32.dll
_Hyperlink_Object_Pointer_\{AFEED740-CC6D-47c5-831D-9848FD916EEF}InstallDotNetFX::Launch() - Starting install of .NET 4.0
InstallDotNetFX::Launch() - .NET 4.0 install complete.
%d*%d*%d*%d
%ssetup.exe
Bypassing(-b) system requirements and state check.
Error opening Run registry key for insertion.
Error setting Run registry key value.
Error opening Run registry key for deletion.
Error deleting Run registry key for deletion.
TurboTax 2012 Bootstrapper Setup has failed(no animation). Please contact us at support.turbotax.com
PrerequisiteCheckerThreadProc():: .NET 4.0 installed so verify.
PrerequisiteCheckerThreadProc():: .NET 4.0 verification still failed. Try to contiue with wrapper.
Microsoft .NET Framework 4.0
hXXp://VVV.microsoft.com/downloads/details.aspx?FamilyID=ab99342f-5d1a-413d-8319-81da479ab0d7&displaylang=en
hXXp://VVV.microsoft.com
InternetInternetCheckConnection function returned %c
GetLastError returned %d
W%d%%
d:d:d:d %s %s
\Intuit\TurboTax\MSI\TY12\Logs\iii_%s.log
UtilityRunner::Run() - check if we are running on Windows 8 or later
UtilityRunner::Run() - Windows 8 or later detected, show dialog instead
%sPrerequisites\TurboTaxUtility.exe
UtilityRunner::Run() - %s %s
UtilityRunner::Run() - exit code = %d
EnableWindowsUpdate():: WU service was disabled. Try to enable it.
EnableWindowsUpdate():: Failed to change service config.
RestoreWindowsUpdate():: WU service was initially disabled. Try to put it in the disabled state again.
RestoreWindowsUpdate():: Failed to disable service config.
RestoreWindowsUpdate():: WU Service was initially enabled or was running.
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\dvprprld.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\autorun.inf
- Microsoft .NET 3.5 Service Pack 1
- Windows Installer 3.1
Microsoft .NET Framework 3.5
!&About TurboTax 2012 Installer...7.NET Utility Tool failed with the following error code:wAnother version of TurboTax 2012 Installer is already running. Only one version of this application can run at a time.
MAdministrator's privileges are required to run %s Setup. Setup will now exit.\.NET 3.5 Service Pack 1 Installer %s is not found. Please contact us at support.turbotax.com,TurboTax 2012 Bootstrapper Setup has failed.C%s could not be found. Exiting TurboTax 2012 prerequisites setup...
%s could not be found.
JNo Instance of TurboTax 2012 was detected on your system. Exiting Setup...TYou need %s or later to run this Setup. Exiting TurboTax 2012 prerequisites setup...
7We can't install TurboTax on your computer just yet...4.NET 4.0 Framework verification tool can't be found.
All Files (*.*)
No error message is available.#Attempted an unsupported operation.$A required resource was unavailable.
Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.
Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else.1Encountered an unexpected error while reading %1.1Encountered an unexpected error while writing %1.
#Unable to load mail system support.
Note that if you choose to recover the auto-saved documents, you must explicitly save them to overwrite the original documents. If you choose to not recover the auto-saved versions, they will be deleted.fRecover the auto-saved documents
%s [Recovered]
2012.01.00.0025
MSIInstallerBootstrap.exe
fenopy.exe_1856:
.text
`.rdata
@.data
.rsrc
@.reloc
Advapi32.dll
lua5.1.dll
irsetup.exe
Could not determine a temp directory name. Try running setup.exe /T:<Path>
c:\temp
%s\irsetup.exe
%s%s_%d
"__IRSID:%s"
"__IRCT:%d"
"__IRAFN:%s"
GetProcessWindowStation
operator
KERNEL32.dll
MsgWaitForMultipleObjects
USER32.dll
ADVAPI32.dll
ShellExecuteExA
SHELL32.dll
GetCPInfo
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\fenopy.exe
%xERRj3cqZQ
! !!####0
;;;9551%%0
! !!565665@
version="9.1.0.0"
name="setup.exe"/>
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
<requestedExecutionLevel level="requireAdministrator" uiAccess="false"/>
<!--Windows Vista Support -->
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/><!--Windows 7 Support -->
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><!--Windows 8 Support -->
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>7%7S7v7|7
mscoree.dll
@KERNEL32.DLL
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
WUSER32.DLL
04090000
0.0.0.0
suf_launch.exe
irsetup.exe_764:
`.rsrc
t%SSSS
SSSShh
t%SWV
u)SShd
u)SSh
@ SSh
SSSSh
u%SSSV
9^$u&SSSSh?
9^$u SSSSh?
9^$u)SSSSh?
xSShF
t.hTXj
t2SSh
Ht.Ht S
FHSSh
GHSSh
GTSSh
FlSSh
FpSSh
G\SSh
.WWWW
Nt.Nt
t'SShl
u$SShe
@ SSHPWj
tFHt:Ht.Ht"Hu`
tWSShW
tl9_ tgSSh
SSSShx
tAHt.HHt
j%XtL9E
<SShG
FtPW
SSh@B
FTCP
u.Pht]k
.FG;}
FTPQ
FTPh
V SShW
O SSh
O SSh,
kernel32.dll
%s (%s:%d)
c:\Program Files\Microsoft Visual Studio 10.0\VC\atlmfc\include\afxwin1.inl
MSG_ERROR
%s %d. %s
MSG_ASK_FOR_DISK
MSG_NEW_LOCATION
MSG_CONFIRM_ABORT
MSG_CONFIRM
A%s%s%s.%d
%s.%d
%s, Line %d: %s
File condition evaluation for file "%s"
msi.dll
\msi.dll
Software\Microsoft\Windows\CurrentVersion\Installer
C:\temp\SUF_SFX_TEST\
MSG_INITIALIZING
16670749
_IgnoreInvalidCertificate
SetEntriesInAcl Error %u
SetNamedSecurityInfo Error %u
*.gif
*.pcd
*.psd
*.emf
*.apm
*.wmf
*.tif
*.tga
*.png
*.pcx
*.jpg
*.bmp
[%d]: %s
*** LOCATION: %s
__NOREPORT__
in function <%s:%d>
in function '%s'
Line: %d
%d: [%s]
Script: %s, %s (%s)
__ir_eval_value = %s;
c:\Program Files\Microsoft Visual Studio 10.0\VC\atlmfc\include\afxwin2.inl
%Copyright%. All rights reserved. %CompanyURL%
WindowStyle
MainWindowSettings
%s at offset %d unterminated
Incorrect %s at offset %d
Element '%s' at offset %d not ended
End tag '%s' at offset %d does not match start tag '%s' at offset %d
No start tag for end tag '%s' at offset %d
%s%d bytes
%s%d wide chars to %d bytes
%d bytes to %s%d wide chars
MSG_SEARCH_FILE
(*.*)|*.*||
MSG_SEARCH_ALL
MSG_SEARCH_MASK
MSG_INSERTDISK
MSG_CANCEL
MSG_OK
MSG_BROWSE
MSG_PATH
Windows Server 2008 R2
Windows 7
Windows Server 2008
Windows Vista
Windows Server 2003
Windows XP
CPasswordData
-- Defined in _SUF70_Global_Functions.lua
number e_ErrorCode, string e_ErrorMsgID
%TempFolder%\%ProductName% Setup Log.txt
%StartupFolder%
%StartFolder%
%StartProgramsFolder%
ÞsktopFolder%
%s\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
%CommonFilesFolder%\Microsoft Shared\DAO
Software\Microsoft\Shared Tools\DAO350.dll
Software\Microsoft\Shared Tools\DAO360.dll
ÚOPath%
Software\Microsoft\Windows NT\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
%SourceFolder%
%SystemDrive%
_WindowsFolder
%WindowsFolder%
%SystemFolder%
%CommonFilesFolder%
%CommonFilesFolder64%
%CommonProgramW6432%
%CommonDocumentsFolder%
%StartupFolderCommon%
%StartProgramsFolderCommon%
%StartFolderCommon%
%FontsFolder%
ÞsktopFolderCommon%
;?;?.lua
UninstallSupportFiles
CPRegKey
Run extra uninstall script: %d
Original: %d
Calculated: %d
Unable to open archive file: %d
lua5.1.dll
%SourceDrive%
%SourceFilename%
\irsetup.dat
{D387204B-8FB9-6A21-15FA-0CD14BF40EA9}Support file added to uninstall list:
Registry key added to uninstall list:
Removed! %d
IDispatch error #%d
Error 0xx: %s
Register font: %s, %s
%sbk%d
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
Remove uninstall support file:
MSG_NO
MSG_YES_TOALL
MSG_YES
MSG_UNINSTALL_OK_REMOVE
MSG_UNINSTALL_NO_APP_USE
MSG_UNINSTALL_REMOVE_SHARED
Decrement shared file count: %s (New count = %d)
SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs
: %s (#%d)
Global include script: %s
RegisterTypeLib: %s
RegisterTypeLib failure reason: %s
RegisterTypeLib: %s - %s
Register COM file: %s
Register COM failure reason: %s
Register COM file: %s - System Error # %u
Register COM file on reboot: %s
regsvr32.exe /s %s
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Increment usage count: %s
Increment usage count: %s (New count = %d)
%s\%s
%s (%d)
\irsetup.skin
local e_Stage = %d;local e_CurrentItemText=[[%s]];local e_CurrentItemPct=%d;local e_StagePct=%d;
MSG_SYSREQ_WARN
MSG_NOTICE
MSG_SYSREQ_ABORT
%s: %s
MSG_SYSREQ_USERPERMISSION
MSG_SYSREQ_SYSTEMADMIN
MSG_SYSREQ_COLORDEPTH
MSG_BITSPERPIXEL
MSG_SYSREQ_SCREENHEIGHT
MSG_SYSREQ_SCREENWIDTH
%s: %d
%s: %d %s
MSG_SYSREQ_RAM
MSG_SIZE_MEGABYTES
Operating System
MSG_SYSREQ_OS
MSG_OS_PART_ORNEWER
MSG_OS_PART_NOSERVPACK
MSG_OS_PART_SERVPACK
MSG_OS_PART_SE
MSG_OS_PART_C
MSG_OS_PART_B
MSG_OS_PART_A
MSG_OS_ALL
MSG_OS_NONE
MSG_OS_WSRV2012
MSG_OS_W8
MSG_OS_WSRV2008_R2
MSG_OS_W7
MSG_OS_WSRV2008
MSG_OS_WVISTA
MSG_OS_WSRV2003
MSG_OS_WXP
MSG_OS_UNKNOWN
MSG_SYSREQ_NOTMET
%s %d %s
MSG_EXP_USESLEFT
MSG_EXP_USESLEFT2
%s %I64d %s
MSG_EXP_DAYSLEFT
MSG_EXP_DAYSLEFT2
Software\Microsoft\Windows\CurrentVersion\I652R9823\
MSG_EXP_CONTACT_START
Run project event: %s
local e_ErrorCode=%d; local e_ErrorMsgID = "%s"
Start project event: %s
MSG_UNINSTALLFILE_NOREMOVE
MSG_UNINSTALLFILE_INUSE
%s (%s: %u)
\WININIT.INI
MSG_FILE_EXISTS_INUSE
MSG_FILE_EXISTS_RETRY
MSG_FILE_EXISTS_ANY
MSG_FILE_EXISTS_NEWER
MSG_FILE_OVERWRITE_CONFIRM
%s\%s.lnk
%s (Return code: %d)
Product: %s, version %s
MSG_SEEKING
%s (%d):
Arc: %s
FN: %s
%s (#%d)
MSG_SKIPPING
MSG_INSTALLING
MSG_PROG_UNINSTALL_CREATECONTROLFILE
ERR_CREATEUNINSTALL_OPEN_EXE_READ
ERR_CREATEUNINSTALL_OPEN_EXE_WRITE
Overwrite uninstall executable:
Existing uninstall executable is newer. Will not overwrite.
Compared uninstall file versions. New: %s Old: %s Result: %d
Uninstall executable already exists: %s
MSG_PROG_UNINSTALL_CREATEEXE
@MSG_PROG_UNINSTALL_CREATEDATFILE
MSG_PROG_UNINSTALL_CREATEFOLDER
"/U:%s"
MSG_PROG_UNINSTALL_CREATESC
Create uninstall CP entry key
ERR_CREATEUNINSTALL_CREATEREGKEY
"%s",%d
Uninstall CP entry: URLUpdateInfo =
URLUpdateInfo
Uninstall CP entry: URLInfoAbout =
URLInfoAbout
"%s" "/U:%s"
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
MSG_PROG_UNINSTALL_CREATECPENTRY
MSG_PROG_UNINSTALL_COPYSUPPORTFILES
MSG_PROG_UNINSTALL_COPYPLUGINS
%s %s
MSG_REQUIRED_DRIVE
MSG_AVAILABLE_DRIVE
Dependency Detection Passed
MSG_PROG_CHECKING_DRIVESPACE
MSG_PROG_CHECKING_FILES
%A, %B %d, %Y
[%s] %s
%m/%d/%Y %H:%M:%S
MsgFile
ERR_MSI_PATCH_REMOVAL_UNSUPPORTED
ERR_MSI_PATCH_PACKAGE_UNSUPPORTED
ERR_MSI_INSTALL_PLATFORM_UNSUPPORTED
ERR_MSI_UNSUPPORTED_TYPE
ERR_MSI_INSTALL_LANGUAGE_UNSUPPORTED
ERR_SERVER_FILE_DOWNLOAD_SET_PROXY_PASSWORD
ERR_SERVER_FILE_DOWNLOAD_OPEN_FTP_FILE
ERR_SERVER_FILE_DOWNLOAD_OPEN_HTTP_FILE
ERR_ODBC_INVALID_KEYWORD_VALUE
ERR_WEB_503
ERR_WEB_500
ERR_WEB_404
ERR_WEB_403
ERR_WEB_400
ERR_WEB_SET_PROXY_PASSWORD
ERR_WEB_SET_PROXY_USERNAME
ERR_WEB_WRITE_MEMORY
ERR_WEB_FTP_FILE_OPEN
ERR_WEB_USER_ABORT
ERR_WEB_FILE_WRITE
ERR_WEB_DOWNLOAD_FILE_ERROR
ERR_WEB_INVALID_HTTP_RESPONSE
ERR_WEB_DESTINATION_FILE_OPEN
ERR_WEB_SEND_REQUEST
ERR_WEB_OPEN_REQUEST
ERR_WEB_CREATE_HTTP_CONNECTION
ERR_WEB_CREATE_INTERNET_SESSION
ERR_REG_GET_SUB_KEY_NAME
ERR_REG_NON_EXISTANT_SUB_KEY
ERR_REG_DELETE_KEY
ERR_REG_CREATE_KEY
ERR_FILE_EXECUTION_FAILED_ELEVATION
ERR_KEY_RUN_ON_REBOOT_FAILED
ERR_USER_ABORTED_OPERATION
ERR_NON_EXISTANT_VIEWER_EXE
ERR_FILE_EXECUTION_FAILED
ERR_SPECIFIED_EXE_FILE_INVALID
MSG_SUCCESS
Language set: Primary = %d, Secondary = %d
%CompanyURL%
%CompanyName%
UxTheme.dll
%Copyright% %CompanyName%. All rights reserved. %CompanyURL%
%TempFolder%\%ProductName% Uninstall Log.txt
%CompanyName% Support Department
%AppFolder%\uninstall.exe
uninstall.xml
CWebBrowser2
Confirm Operation
KERNEL32.DLL
PSAPI.DLL
Kernel32.dll
WS2_32.DLL
Copying "%s"
"%s" %s
%d.%d.%d.%d
\StringFileInfo\xx\ProductVersion
\StringFileInfo\xx\PrivateBuild
Sfc.dll
.bak%d
Windows ME
Windows 98
Windows 95
Windows 2000
Windows NT 4
Windows NT 3
%s\shell\open\command
NUL=%s
Software\Microsoft\Windows NT\CurrentVersion\Fonts
Software\Microsoft\Windows\CurrentVersion\Fonts
***!!!***@@
Advapi32.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
%s\%s.url
%s\%s.pif
srclient.dll
%s_%d
%s\_ir_tmpfnt_%d
/\:*?"<>|
%%x
d:d
WinINet.dll
Could not create Internet session: %u
Error downloading file: %u
Error writing the destination file: %d-%u
Could not create HTTP connection: %u
Could not create HTTP connection
Incorrect HTTP status returned by server: %d
Send request failed: %u
Content-Type: application/x-www-form-urlencoded
Could not open HTTP file: %s
PTF://
hXXps://
%s; DIRECT
jsproxy.dll
DetectAutoProxyUrl
wininet.dll
Could not HTTP file: %u
MSG_STATUS_HANDLE_CREATED
MSG_STATUS_HANDLE_CLOSING
MSG_STATUS_REQUEST_COMPLETE
MSG_REDIRECTING
MSG_CONNECTION_CLOSED
MSG_RESOLVING_HOST_NAME
MSG_HOST_NAME_RESOLVED
MSG_CONNECTING_TO_SERVER
MSG_CONNECTED_TO_SERVER
MSG_CLOSING_CONNECTION
MSG: %d
TRACE: LastError = %d ("%s")Script: %s, %s
Script: %s, Line %d
All Files (*.*)|*.*|
PasswordInput
MSG_MOVING
MSG_COPYING
MSG_FROM
MSG_TO
MSG_DELETING
MSG_SEARCHING
\StringFileInfo\xx\SpecialBuild
\StringFileInfo\xx\OriginalFilename
\StringFileInfo\xx\Comments
\StringFileInfo\xx\LegalTrademarks
\StringFileInfo\xx\LegalCopyright
\StringFileInfo\xx\ProductName
\StringFileInfo\xx\InternalName
\StringFileInfo\xx\FileDescription
\StringFileInfo\xx\CompanyName
ErrorMsg
%Y-%m-%dT%H:%M:%S
MSG_INSTALL_DO_YOU_WANT_OVERWRITE
MSG_INSTALL_ALWAYS_ASK_OVERWRITE_MSG
MSG_INSTALL_FILE_OLDER_MSG
OpenURL
\msiexec.exe
RunMsiexec
SQLInstallerError
SQLRemoveDriverManager
odbccp32.dll
SQLConfigDataSource
SQLInstallDriverEx
SQLInstallDriverManager
SQLRemoveDriver
\Kernel32.dll
GetKeyNames
DoesKeyExist
DeleteKey
CreateKey
ShortcutKey
keycode
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
MSG_SIZE_BYTES
P?MSG_SIZE_KILOBYTES
>MSG_SIZE_GIGABYTES
xxxxxx
%s-%s-%s
%s/%s/%s
%s:%s:%s
%d:%s:%s AM
%d:%s:%s PM
Windows Server 2012
Windows 8
MSG_REBOOT_FAILED
WININET.DLL
PPassword
Password
%s %s %s %s (%0.2f %s)
%0.1f %s/%0.1f %s
%I64u %s/%I64u %s
MSG_KB_PER_SEC
MSG_ESTIMATED_TIME_LEFT
MSG_SAVING
MSG_DOWNLOADING
%s %s %s %s
MSG_QUERYING_INTERNET
MSG_READING
GetHTTPErrorInfo
%s > %s
number e_CtrlID, number e_MsgID, table e_Details
Removed: %s
local e_CtrlID=%d; local e_MsgID=%d;
Button%d
Check%d
ComboBox%d
Edit%d
Space available on selected drive: %SpaceAvailable%
Space required: %SpaceRequired%
Error: The specified file: '%s' could not be found.
Error: The specified file: '%s' could not be opened.
Error: The specified file: '%s' is too large to read.
Error: The specified file: '%s' could not be read.
Application.Exit();
Screen.Next();
Screen.Back();
Radio%d
Total space required: %SpaceRequired%
IDS_CTRL_CHECK_BOX_d
IDS_CTRL_BUTTON_d
IDS_CTRL_STATICTEXT_LABEL_d
IDS_CTRL_COMBOBOX_d_DEFAULT
IDS_CTRL_EDIT_d
IDS_CTRL_RADIO_BUTTON_d
IDS_CTRL_LISTBOX_d
IDS_CTRL_SCROLLTEXT_BODY_d
IDS_CTRL_PROGRESS_BAR_d
IDS_CTRL_GROUP_BOX_d
IDS_CTRL_SELECT_PACKAGE_TREE_d
IDS_CTRL_BILLBOARD_d
CTRL_CHECK_BOX_d
CTRL_BUTTON_d
CTRL_STATICTEXT_LABEL_d
CTRL_COMBOBOX_d
CTRL_EDIT_d
CTRL_RADIO_BUTTON_d
CTRL_LIST_BOX_d
CTRL_SCROLLTEXT_BODY_d
CTRL_PROGRESS_BAR_d
CTRL_GROUP_BOX_d
CTRL_SELECT_PACKAGE_TREE_d
CTRL_BILLBOARD_d
IDS_CTRL_COMBOBOX_d_ITEMS
IDS_CTRL_SCROLLTEXT_FILE_d
WebWindow
IDS_CTRL_CATEGORY_NAME_d_%.3d
IDS_CTRL_CATEGORY_DESCRIPTION_d_%.3d
hXXp://VVV.indigorose.com/route.php?pid=suf9buy
[email protected]
.tiff
.jpeg
.wbmp
CNotSupportedException
user32.dll
Afx:%p:%x:%p:%p:%p
Afx:%p:%x
commctrl_DragListMsg
CCmdTarget
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
comctl32.dll
comdlg32.dll
shell32.dll
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Software\Microsoft\Windows\CurrentVersion\Policies\Network
Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32
%s%s.dll
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp
lX-X-x-XX-XXXXXX
RegOpenKeyTransactedA
RegCreateKeyTransactedA
RegDeleteKeyTransactedA
CHttpConnection
CHttpFile
hXXp://
HTTP/1.0
msctls_hotkey32
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp
mfcm100.dll
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
Shell32.dll
%s:%x:%x:%x:%x
RegDeleteKeyExA
lXXxXXXXXXXX
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp
ole32.dll
MFCLink_UrlPrefix
MFCLink_Url
CMDITabProxyWnd
CMDIChildWndEx
CMDIFrameWndEx
%sMFCToolBar-%d%x
%sMFCToolBar-%d
%sMFCToolBarParameters
TOOLBAR_RESETKEYBAORD
KeyboardManager
MSG_CHECKEMPTYMINIFRAME
%sDockingManager-%d
&%d %s
Hex={X,X,X}ShowCmd
CMDIChildWnd
CMDIFrameWnd
CMDIClientAreaWnd
%sMDIClientArea-%d
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\viewcore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleipfrm.cpp
%sBasePane-%d%x
%sBasePane-%d
%sPane-%d%x
%sPane-%d
windows
%sMFCOutlookBar-%d%x
%sMFCOutlookBar-%d
%c%d%c%s
RGB(%d, %d, %d)
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olestrm.cpp
%sDockablePaneAdapter-%d%x
%sDockablePaneAdapter-%d
ENABLE_KEYS
KEYS_MENU
KEYS
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledrop2.cpp
CMFCToolBarsKeyboardPropertyPage
%sMFCTasksPane-%d%x
%sMFCTasksPane-%d
Visual C CRT: Not enough memory to complete call to strerror.
Broken pipe
Inappropriate I/O control operation
Operation not permitted
operator
GetProcessWindowStation
IS 5.0.2.4
Error %d in %s (%s)
Error %d in %s (%s) [%s]
C.o.p.y.r.i.g.h.t...2.0.1.0.
ISLib PNG Error : %s
1.2.22
ISLib JPG Error : %s
DIBToHBITMAP error: GetLastError = %d
read %d. layersLen %d
Reading PCD sub-image #%d (%d x %d)
.cals
Keywords
SetWinMetaFileBits failed GetLastError = %d
GeoKeyDirectory
%s: Invalid InkNames value; expecting %d names, found %d
%s: Bad value %u for "%s" tag
%s: Invalid %stag "%s" (not supported by codec)
%s: Bad field type %d for "%s"
%s: Failed to allocate space for list of custom values
%s: Bad value %d for "%s" tag
%s: Sorry, cannot nest SubIFDs
Nonstandard tile width %d, convert file
Nonstandard tile length %d, convert file
%s: Cannot modify tag "%s" while writing
%s: Unknown %stag %u
%s: Error fetching directory link
%s: Error fetching directory count
Sorry, can not handle images with %d-bit samples
Sorry, LogL data must have %s=%d
Sorry, can not handle LogLuv images with %s=%d
Sorry, LogLuv data must have %s=%d or %d
Sorry, can not handle image with %s=%d
Sorry, can not handle contiguous data with %s=%d, and %s=%d and Bits/Sample=%d
Sorry, can not handle RGB image with %s=%d
Sorry, can not handle contiguous data with %s=%d, and %s=%d
Sorry, can not handle separated image with %s=%d
Missing needed %s tag
No space %s
%s: Read error at scanline %lu, strip %lu; got %lu bytes, expected %lu
%s: Read error at scanline %lu; got %lu bytes, expected %lu
%s: Seek error at scanline %lu, strip %lu
%s: Read error at row %ld, col %ld, tile %ld; got %lu bytes, expected %lu
%s: Read error at row %ld, col %ld; got %lu bytes, expected %lu
%s: Seek error at row %ld, col %ld, tile %ld
%s: No space for data buffer at scanline %ld
%s: Data buffer too small to hold strip %lu
%s: Read error on strip %lu; got %lu bytes, expected %lu
%s: Invalid strip byte count %lu, strip %lu
%s: Data buffer too small to hold tile %ld
"%s": Bad mode
Not a TIFF file, bad version number %d (0x%x)
This is a BigTIFF file. This format not supported
Not a TIFF or MDI file, bad magic number %d (0x%x)
%s: Out of memory (TIFF structure)
Error writing data for field "%s"
%s: Error writing SubIFD directory link
M"%s": Information lost writing value (%g) as (unsigned) RATIONAL
Integer overflow in %s
LIBTIFF, Version 3.9.1
0123456789ABCDEFlibpng error: %s
libpng error: %s, offset=%d
libpng error no. %s: %s
libpng warning: %s
libpng warning no. %s: %s
1.2.3
NULL row buffer for row %ld, pass %d
iTXt chunk not supported.
Corrupt JPEG data: found marker 0xx instead of RST%d
Warning: unknown JFIF revision number %d.d
Corrupt JPEG data: %u extraneous bytes before marker 0xx
Inconsistent progression sequence for component %d coefficient %d
Unknown Adobe color transform code %d
Obtained XMS handle %u
Freed XMS handle %u
Unrecognized component IDs %d %d %d, assuming YCbCr
JFIF extension marker: RGB thumbnail image, length %u
JFIF extension marker: palette thumbnail image, length %u
JFIF extension marker: JPEG-compressed thumbnail image, length %u
Opened temporary file %s
Closed temporary file %s
Ss=%d, Se=%d, Ah=%d, Al=%d
Component %d: dc=%d ac=%d
Start Of Scan: %d components
Component %d: %dhx%dv q=%d
Start Of Frame 0xx: width=%u, height=%u, components=%d
Smoothing not supported with nonstandard sampling ratios
RST%d
At marker 0xx, recovery action %d
Selected %d colors for quantization
Quantizing to %d colors
Quantizing to %d = %d*%d*%d colors
%4u %4u %4u %4u %4u %4u %4u %4u
Unexpected marker 0xx
Miscellaneous marker 0xx, length %u
with %d x %d thumbnail image
JFIF extension marker: type 0xx, length %u
Warning: thumbnail image size does not match data length %u
JFIF APP0 marker: version %d.d, density %dx%d %d
= = = = = = = =
Obtained EMS handle %u
Freed EMS handle %u
Define Restart Interval %u
Define Quantization Table %d precision %d
Define Huffman Table 0xx
Define Arithmetic Table 0xx: 0xx
Unknown APP14 marker (not Adobe), length %u
Unknown APP0 marker (not JFIF), length %u
Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d
Unsupported marker type 0xx
Failed to create temporary file %s
Unsupported JPEG process: SOF type 0xx
Cannot quantize to more than %d colors
Cannot quantize to fewer than %d colors
Cannot quantize more than %d color components
Insufficient memory (case %d)
Not a JPEG file: starts with 0xx 0xx
Quantization table 0xx was not defined
Huffman table 0xx was not defined
Backing store not supported
Cannot transcode due to multiple use of quantization table %d
Maximum supported image dimension is %u pixels
Empty JPEG image (DNL not supported)
Bogus DQT index %d
Bogus DHT index %d
Bogus DAC value 0x%x
Bogus DAC index %d
Unsupported color conversion request
Too many color components: %d, max %d
Buffer passed to JPEG library is too small
JPEG parameter struct mismatch: library thinks size is %u, caller expects %u
Improper call to JPEG library in state %d
Invalid scan script at entry %d
Invalid progressive parameters at scan script entry %d
Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d
Unsupported JPEG data precision %d
Invalid memory pool code %d
Wrong JPEG library version: library is %d, caller expects %d
IDCT output block size %d not supported
Invalid component ID %d in SOS
Bogus message code %d
Found bad IPTC data resource (len exceeds block end). ID=%d
ExifInteroperabilityOffset
InteroperabilityVersion
InteroperabilityIndex
AsShotPreProfileMatrix
AsShotICCProfile
AsShotWhiteXY
AsShotNeutral
InteroperabilityIFDOffset
Internal error, unknown tag 0x%x
Tag %d
Compression algorithm does not support random access
Compression scheme %u %s encoding is not implemented
%s %s encoding is not implemented
Compression scheme %u %s decoding is not implemented
%s %s decoding is not implemented
%s: Cannot determine size of unknown tag type %d
%s: TIFF directory is missing required "%s" field
incorrect count for field "%s" (%u, expecting %u); tag trimmed
incorrect count for field "%s" (%u, expecting %u); tag ignored
%s: Can not read TIFF directory
%s: Can not read TIFF directory count
%s: Seek error accessing TIFF directory
Error fetching data for field "%s"
%s: Rational with zero denominator (num = %u)
unexpected count for field "%s", %u, expected 2; ignored
cannot read TIFF_ANY type %d for field "%s"
Cannot handle different per-sample values for field "%s"
%s: cannot handle zero strip size
%s: cannot handle zero tile size
%s: cannot handle zero scanline size
%s: Wrong "%s" field, ignoring and calculating from imagelength
%s: Bogus "%s" field, ignoring and calculating from imagelength
%s: TIFF directory is missing required "%s" field, calculating from imagelength
%s: cannot handle zero number of %s
%s: wrong data type %d for "%s"; tag ignored
Registering anonymous field with tag %d (0x%x) failed
%s: unknown field with tag %d (0x%x) encountered
%s: invalid TIFF directory; tags are not sorted in ascending order
%s: Failed to read directory at offset %u
Unknown zTXt compression type %d
Incomplete compressed datastream in %s chunk
Data error in compressed datastream in %s chunk
Buffer error in compressed datastream in %s chunk
gamma = (%d/100000)
gx=%f, gy=%f, bx=%f, by=%f
wx=%f, wy=%f, rx=%f, ry=%f
incorrect gamma=(%d/100000)
deflate 1.2.3 Copyright 1995-2003 Jean-loup Gailly
%ld%c
%s compression support is not configured
inflate 1.2.3 Copyright 1995-2005 Mark Adler
LogL16Decode: Not enough data at row %d (short %d pixels)
LogLuvDecode24: Not enough data at row %d (short %d pixels)
LogLuvDecode32: Not enough data at row %d (short %d pixels)
?%s: No space for SGILog translation buffer
No support for converting user data format to LogL
No support for converting user data format to LogLuv
Inappropriate photometric interpretation %d for SGILog compression; %s
SGILog compression supported only for %s, or raw data
Unknown data format %d for LogLuv compression
Unknown encoding %d for LogLuv compression
%s: No space for LogLuv state block
?PixarLog compression can't handle bits depth/data format combination (depth: %d)
%d bit input not supported in PixarLog
PixarLogDecode: unsupported bits/sample: %d
%s: stride %d is not a multiple of sample count, %d, data truncated.
%s: zlib error: %s
%s: Not enough data at scanline %d (short %d bytes)
%s: Decoding error at scanline %d, %s
PixarLog compression can't handle %d bit linear encodings
A%s: Encoder error: %s
%s: Bad code word at line %u of %s %u (x %u)
%s: Uncompressed data (not supported) at line %u of %s %u (x %u)
%s: %s at line %u of %s %u (got %u, expected %u)
%s: Premature EOF at line %u of %s %u (x %u)
%s: No space for Group 3/4 reference line
@ Fax DCS: %s
Fax SubAddress: %s
(%u = 0x%x)
%sEOL padding
%s2-d encoding
%suncompressed data
%s: No space for state block
JpegRestartInterval: %u
JpegProc: %u
OJPEG encoding not supported; use new-style JPEG compression instead
Unknown marker type %d in JPEG data
Subsampling values [%d,%d] are not allowed in TIFF
Subsampling inside JPEG data does not match subsampling tag values [%d,%d] (nor any other values allowed in TIFF); assuming subsampling inside JPEG data is correct and desubsampling inside JPEG decompression
Subsampling inside JPEG data [%d,%d] does not match subsampling tag values [%d,%d]; assuming subsampling inside JPEG data is correct
Subsampling tag is not set, yet subsampling inside JPEG data [%d,%d] does not match default values [2,2]; assuming subsampling inside JPEG data is correct
SamplesPerPixel %d not supported for this compression scheme
JPEG strip/tile size exceeds expected dimensions, expected %dx%d, got %dx%d
Decompressor will try reading with sampling %d,%d.
Improper JPEG sampling factors %d,%d
Apparently should be %d,%d.
Improper JPEG strip/tile size, expected %dx%d, got %dx%d
RowsPerStrip must be multiple of %d for JPEG
JPEG tile width must be multiple of %d
JPEG tile height must be multiple of %d
BitsPerSample %d not allowed for JPEG
PhotometricInterpretation %d not allowed for JPEG
ThunderDecode: %s data at scanline %ld (%lu != %lu)
LZWDecode: Bogus encoding, loop in the code table; scanline %d
LZWDecode: Not enough data at scanline %d (short %ld bytes)
LZWDecode: Wrong length of decoded string: data probably corrupted at scanline %d
LZWDecode: Corrupted LZW table at scanline %d
LZWDecode: Strip %d not terminated with EOI code
LZWDecodeCompat: Corrupted LZW table at scanline %d
LZWDecodeCompat: Wrong length of decoded string: data probably corrupted at scanline %d
LZWDecodeCompat: Not enough data at scanline %d (short %ld bytes)
DumpModeDecode: Not enough data for scanline %d
Horizontal differencing "Predictor" not supported with %d-bit samples
Floating point "Predictor" not supported with %d data format
"Predictor" value %d not supported
Out of memory allocating %d byte temp buffer.
%u (0x%x)
WindowsForms
NTDLL.DLL
COMCTL32.DLL
USER32.DLL
MSCTF.DLL
GDI32.DLL
SHLWAPI.DLL
UXTHEME.DLL
API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL
LEFTPRESSED
ALWAYSSHOWSIZINGBAR
MSGBOXFONT
%[^,], %ld, %s
User32.dll
msimg32.dll
windows-1254
windows-874
SUBLANG_PORTUGUESE_BRAZILIAN
Portuguese (Brazil)
SUBLANG_PORTUGUESE
LANG_PORTUGUESE
Portuguese (Portugal)
windows-1255
windows-1257
windows-1253
windows-1252
windows-1250
windows-1256
windows-1251
1.2.40
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
WININET.dll
?#%X.y
InternetCrackUrlA
InternetCanonicalizeUrlA
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
.?AVCCmdTarget@@
.PAVCException@@
.PAVCFileException@@
.PAVCMemoryException@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDPAVCISImageEx@@PAV3@@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDVCRect@@AAV3@@@
.?AVCMainWindowSettings@@
.?AVCMD5@@
.?AVCPasswordData@@
.?AVCRTSessionVarMgr@@
.?AVCScreenCrtrMeasure@@
.?AVCWebBrowser2@@
.PAVCInternetException@@
.PAVCResourceException@@
.?AVCScreenCtrlMsg@@
.?AVCScreenCtrlMsgDetail@@
.PAVCThreadException@IR@@
.PAVCObject@@
.PAVCOleException@@
.PAVCSimpleException@@
.PAVCNotSupportedException@@
.PAVCInvalidArgException@@
.?AVCNotSupportedException@@
.PAVCArchiveException@@
.PAVCUserException@@
.?AVCTestCmdUI@@
.?AVCCmdUI@@
.?AVCHttpConnection@@
.?AVCHttpFile@@
.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@
.?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDV12@PBD@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDPAVCDocument@@PAV3@@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD_N_N@@
.?AV?$CMap@PAVCDocument@@PAV1@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@@
.PAVCOleDispatchException@@
.?AVCMDITabProxyWnd@@
.?AVCMDIChildWndEx@@
.?AVCMDIChildWnd@@
.?AVCMDIFrameWndEx@@
.?AVCMDIFrameWnd@@
.?AVCMFCToolBarCmdUI@@
.?AVCMFCAcceleratorKey@@
.?AVCMFCColorBarCmdUI@@
.?AV?$CMap@KKV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@@
.?AV?$CList@PAVCMDIChildWndEx@@PAV1@@@
.?AVCMDIClientAreaWnd@@
.?AVCMFCRibbonCmdUI@@
.?AVCMFCCmdUsageCount@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDPAVCObList@@PAV3@@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDHH@@
.?AVCMFCRibbonKeyTip@@
.?AVCMFCToolBarsKeyboardPropertyPage@@
.?AVCMFCTasksPaneToolBarCmdUI@@
.?AVCMFCAcceleratorKeyAssignCtrl@@
zcÁ
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\_ir_sf_temp_0\irsetup.exe
GetProcessHeap
GetCPInfo
GetWindowsDirectoryA
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
RegEnumKeyA
RegEnumKeyExA
RegQueryInfoKeyA
RegDeleteKeyA
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
GetViewportOrgEx
GetViewportExtEx
GdiplusShutdown
ShellExecuteA
ShellExecuteExA
UrlUnescapeA
URLDownloadToFileA
MapVirtualKeyExA
GetKeyboardState
GetKeyboardLayout
MapVirtualKeyA
GetKeyNameTextA
SetWindowsHookExA
UnhookWindowsHookEx
CreateDialogIndirectParamA
GetKeyState
ExitWindowsEx
EnumWindows
MsgWaitForMultipleObjects
GetAsyncKeyState
.text
`.rdata
@.data
.rsrc
@.reloc
.ZV7yG
n#%uBK0t
a/P%S
%XH[a
@=.tb
%xERRj3cqZQ
! !!####0
;;;9551%%0
! !!565665@
version="9.1.0.0"
name="setup.exe"/>
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
<requestedExecutionLevel level="requireAdministrator" uiAccess="false"/>
<!--Windows Vista Support -->
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/><!--Windows 7 Support -->
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><!--Windows 8 Support -->
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>ADVAPI32.dll
COMCTL32.dll
COMDLG32.dll
GDI32.dll
gdiplus.dll
imagehlp.dll
IMM32.dll
MSIMG32.dll
NETAPI32.dll
OLEACC.dll
OLEAUT32.dll
oledlg.dll
SHELL32.dll
SHLWAPI.dll
urlmon.dll
USER32.dll
VERSION.dll
WINMM.dll
WINSPOOL.DRV
accKeyboardShortcut
hhctrl.ocx
KWININET.DLL
dwmapi.dll
xUxTheme.dll
yDWrite.dll
D2D1.dll
SHELL32.DLL
YRICHED20.DLL
mscoree.dll
ekernel32.dll
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
aero.msstyles
winxp.royale.cjstyles
royale.msstyles
winxp.luna.cjstyles
luna.msstyles
Argument %d must be of type %s.
%d arguments required.
All Files (*.*)
No error message is available.#Attempted an unsupported operation.$A required resource was unavailable.
Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.
Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else.1Encountered an unexpected error while reading %1.1Encountered an unexpected error while writing %1.
#Unable to load mail system support.
Note that if you choose to recover the auto-saved documents, you must explicitly save them to overwrite the original documents. If you choose to not recover the auto-saved versions, they will be deleted.fRecover the auto-saved documents
%s [Recovered]
9.1.0.0
2012 Indigo Rose Corporation (VVV.indigorose.com)
suf_rt.exe
irsetup.exe_764_rwx_00401000_003C1000:
t%SSSS
SSSShh
t%SWV
u)SShd
u)SSh
@ SSh
SSSSh
u%SSSV
9^$u&SSSSh?
9^$u SSSSh?
9^$u)SSSSh?
xSShF
t.hTXj
t2SSh
Ht.Ht S
FHSSh
GHSSh
GTSSh
FlSSh
FpSSh
G\SSh
.WWWW
Nt.Nt
t'SShl
u$SShe
@ SSHPWj
tFHt:Ht.Ht"Hu`
tWSShW
tl9_ tgSSh
SSSShx
tAHt.HHt
j%XtL9E
<SShG
FtPW
SSh@B
FTCP
u.Pht]k
.FG;}
FTPQ
FTPh
V SShW
O SSh
O SSh,
kernel32.dll
%s (%s:%d)
c:\Program Files\Microsoft Visual Studio 10.0\VC\atlmfc\include\afxwin1.inl
MSG_ERROR
%s %d. %s
MSG_ASK_FOR_DISK
MSG_NEW_LOCATION
MSG_CONFIRM_ABORT
MSG_CONFIRM
A%s%s%s.%d
%s.%d
%s, Line %d: %s
File condition evaluation for file "%s"
msi.dll
\msi.dll
Software\Microsoft\Windows\CurrentVersion\Installer
C:\temp\SUF_SFX_TEST\
MSG_INITIALIZING
16670749
_IgnoreInvalidCertificate
SetEntriesInAcl Error %u
SetNamedSecurityInfo Error %u
*.gif
*.pcd
*.psd
*.emf
*.apm
*.wmf
*.tif
*.tga
*.png
*.pcx
*.jpg
*.bmp
[%d]: %s
*** LOCATION: %s
__NOREPORT__
in function <%s:%d>
in function '%s'
Line: %d
%d: [%s]
Script: %s, %s (%s)
__ir_eval_value = %s;
c:\Program Files\Microsoft Visual Studio 10.0\VC\atlmfc\include\afxwin2.inl
%Copyright%. All rights reserved. %CompanyURL%
WindowStyle
MainWindowSettings
%s at offset %d unterminated
Incorrect %s at offset %d
Element '%s' at offset %d not ended
End tag '%s' at offset %d does not match start tag '%s' at offset %d
No start tag for end tag '%s' at offset %d
%s%d bytes
%s%d wide chars to %d bytes
%d bytes to %s%d wide chars
MSG_SEARCH_FILE
(*.*)|*.*||
MSG_SEARCH_ALL
MSG_SEARCH_MASK
MSG_INSERTDISK
MSG_CANCEL
MSG_OK
MSG_BROWSE
MSG_PATH
Windows Server 2008 R2
Windows 7
Windows Server 2008
Windows Vista
Windows Server 2003
Windows XP
CPasswordData
-- Defined in _SUF70_Global_Functions.lua
number e_ErrorCode, string e_ErrorMsgID
%TempFolder%\%ProductName% Setup Log.txt
%StartupFolder%
%StartFolder%
%StartProgramsFolder%
ÞsktopFolder%
%s\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
%CommonFilesFolder%\Microsoft Shared\DAO
Software\Microsoft\Shared Tools\DAO350.dll
Software\Microsoft\Shared Tools\DAO360.dll
ÚOPath%
Software\Microsoft\Windows NT\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
%SourceFolder%
%SystemDrive%
_WindowsFolder
%WindowsFolder%
%SystemFolder%
%CommonFilesFolder%
%CommonFilesFolder64%
%CommonProgramW6432%
%CommonDocumentsFolder%
%StartupFolderCommon%
%StartProgramsFolderCommon%
%StartFolderCommon%
%FontsFolder%
ÞsktopFolderCommon%
;?;?.lua
UninstallSupportFiles
CPRegKey
Run extra uninstall script: %d
Original: %d
Calculated: %d
Unable to open archive file: %d
lua5.1.dll
%SourceDrive%
%SourceFilename%
\irsetup.dat
{D387204B-8FB9-6A21-15FA-0CD14BF40EA9}Support file added to uninstall list:
Registry key added to uninstall list:
Removed! %d
IDispatch error #%d
Error 0xx: %s
Register font: %s, %s
%sbk%d
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
Remove uninstall support file:
MSG_NO
MSG_YES_TOALL
MSG_YES
MSG_UNINSTALL_OK_REMOVE
MSG_UNINSTALL_NO_APP_USE
MSG_UNINSTALL_REMOVE_SHARED
Decrement shared file count: %s (New count = %d)
SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs
: %s (#%d)
Global include script: %s
RegisterTypeLib: %s
RegisterTypeLib failure reason: %s
RegisterTypeLib: %s - %s
Register COM file: %s
Register COM failure reason: %s
Register COM file: %s - System Error # %u
Register COM file on reboot: %s
regsvr32.exe /s %s
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Increment usage count: %s
Increment usage count: %s (New count = %d)
%s\%s
%s (%d)
\irsetup.skin
local e_Stage = %d;local e_CurrentItemText=[[%s]];local e_CurrentItemPct=%d;local e_StagePct=%d;
MSG_SYSREQ_WARN
MSG_NOTICE
MSG_SYSREQ_ABORT
%s: %s
MSG_SYSREQ_USERPERMISSION
MSG_SYSREQ_SYSTEMADMIN
MSG_SYSREQ_COLORDEPTH
MSG_BITSPERPIXEL
MSG_SYSREQ_SCREENHEIGHT
MSG_SYSREQ_SCREENWIDTH
%s: %d
%s: %d %s
MSG_SYSREQ_RAM
MSG_SIZE_MEGABYTES
Operating System
MSG_SYSREQ_OS
MSG_OS_PART_ORNEWER
MSG_OS_PART_NOSERVPACK
MSG_OS_PART_SERVPACK
MSG_OS_PART_SE
MSG_OS_PART_C
MSG_OS_PART_B
MSG_OS_PART_A
MSG_OS_ALL
MSG_OS_NONE
MSG_OS_WSRV2012
MSG_OS_W8
MSG_OS_WSRV2008_R2
MSG_OS_W7
MSG_OS_WSRV2008
MSG_OS_WVISTA
MSG_OS_WSRV2003
MSG_OS_WXP
MSG_OS_UNKNOWN
MSG_SYSREQ_NOTMET
%s %d %s
MSG_EXP_USESLEFT
MSG_EXP_USESLEFT2
%s %I64d %s
MSG_EXP_DAYSLEFT
MSG_EXP_DAYSLEFT2
Software\Microsoft\Windows\CurrentVersion\I652R9823\
MSG_EXP_CONTACT_START
Run project event: %s
local e_ErrorCode=%d; local e_ErrorMsgID = "%s"
Start project event: %s
MSG_UNINSTALLFILE_NOREMOVE
MSG_UNINSTALLFILE_INUSE
%s (%s: %u)
\WININIT.INI
MSG_FILE_EXISTS_INUSE
MSG_FILE_EXISTS_RETRY
MSG_FILE_EXISTS_ANY
MSG_FILE_EXISTS_NEWER
MSG_FILE_OVERWRITE_CONFIRM
%s\%s.lnk
%s (Return code: %d)
Product: %s, version %s
MSG_SEEKING
%s (%d):
Arc: %s
FN: %s
%s (#%d)
MSG_SKIPPING
MSG_INSTALLING
MSG_PROG_UNINSTALL_CREATECONTROLFILE
ERR_CREATEUNINSTALL_OPEN_EXE_READ
ERR_CREATEUNINSTALL_OPEN_EXE_WRITE
Overwrite uninstall executable:
Existing uninstall executable is newer. Will not overwrite.
Compared uninstall file versions. New: %s Old: %s Result: %d
Uninstall executable already exists: %s
MSG_PROG_UNINSTALL_CREATEEXE
@MSG_PROG_UNINSTALL_CREATEDATFILE
MSG_PROG_UNINSTALL_CREATEFOLDER
"/U:%s"
MSG_PROG_UNINSTALL_CREATESC
Create uninstall CP entry key
ERR_CREATEUNINSTALL_CREATEREGKEY
"%s",%d
Uninstall CP entry: URLUpdateInfo =
URLUpdateInfo
Uninstall CP entry: URLInfoAbout =
URLInfoAbout
"%s" "/U:%s"
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
MSG_PROG_UNINSTALL_CREATECPENTRY
MSG_PROG_UNINSTALL_COPYSUPPORTFILES
MSG_PROG_UNINSTALL_COPYPLUGINS
%s %s
MSG_REQUIRED_DRIVE
MSG_AVAILABLE_DRIVE
Dependency Detection Passed
MSG_PROG_CHECKING_DRIVESPACE
MSG_PROG_CHECKING_FILES
%A, %B %d, %Y
[%s] %s
%m/%d/%Y %H:%M:%S
MsgFile
ERR_MSI_PATCH_REMOVAL_UNSUPPORTED
ERR_MSI_PATCH_PACKAGE_UNSUPPORTED
ERR_MSI_INSTALL_PLATFORM_UNSUPPORTED
ERR_MSI_UNSUPPORTED_TYPE
ERR_MSI_INSTALL_LANGUAGE_UNSUPPORTED
ERR_SERVER_FILE_DOWNLOAD_SET_PROXY_PASSWORD
ERR_SERVER_FILE_DOWNLOAD_OPEN_FTP_FILE
ERR_SERVER_FILE_DOWNLOAD_OPEN_HTTP_FILE
ERR_ODBC_INVALID_KEYWORD_VALUE
ERR_WEB_503
ERR_WEB_500
ERR_WEB_404
ERR_WEB_403
ERR_WEB_400
ERR_WEB_SET_PROXY_PASSWORD
ERR_WEB_SET_PROXY_USERNAME
ERR_WEB_WRITE_MEMORY
ERR_WEB_FTP_FILE_OPEN
ERR_WEB_USER_ABORT
ERR_WEB_FILE_WRITE
ERR_WEB_DOWNLOAD_FILE_ERROR
ERR_WEB_INVALID_HTTP_RESPONSE
ERR_WEB_DESTINATION_FILE_OPEN
ERR_WEB_SEND_REQUEST
ERR_WEB_OPEN_REQUEST
ERR_WEB_CREATE_HTTP_CONNECTION
ERR_WEB_CREATE_INTERNET_SESSION
ERR_REG_GET_SUB_KEY_NAME
ERR_REG_NON_EXISTANT_SUB_KEY
ERR_REG_DELETE_KEY
ERR_REG_CREATE_KEY
ERR_FILE_EXECUTION_FAILED_ELEVATION
ERR_KEY_RUN_ON_REBOOT_FAILED
ERR_USER_ABORTED_OPERATION
ERR_NON_EXISTANT_VIEWER_EXE
ERR_FILE_EXECUTION_FAILED
ERR_SPECIFIED_EXE_FILE_INVALID
MSG_SUCCESS
Language set: Primary = %d, Secondary = %d
%CompanyURL%
%CompanyName%
UxTheme.dll
%Copyright% %CompanyName%. All rights reserved. %CompanyURL%
%TempFolder%\%ProductName% Uninstall Log.txt
%CompanyName% Support Department
%AppFolder%\uninstall.exe
uninstall.xml
CWebBrowser2
Confirm Operation
KERNEL32.DLL
PSAPI.DLL
Kernel32.dll
WS2_32.DLL
Copying "%s"
"%s" %s
%d.%d.%d.%d
\StringFileInfo\xx\ProductVersion
\StringFileInfo\xx\PrivateBuild
Sfc.dll
.bak%d
Windows ME
Windows 98
Windows 95
Windows 2000
Windows NT 4
Windows NT 3
%s\shell\open\command
NUL=%s
Software\Microsoft\Windows NT\CurrentVersion\Fonts
Software\Microsoft\Windows\CurrentVersion\Fonts
***!!!***@@
Advapi32.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
%s\%s.url
%s\%s.pif
srclient.dll
%s_%d
%s\_ir_tmpfnt_%d
/\:*?"<>|
%%x
d:d
WinINet.dll
Could not create Internet session: %u
Error downloading file: %u
Error writing the destination file: %d-%u
Could not create HTTP connection: %u
Could not create HTTP connection
Incorrect HTTP status returned by server: %d
Send request failed: %u
Content-Type: application/x-www-form-urlencoded
Could not open HTTP file: %s
PTF://
hXXps://
%s; DIRECT
jsproxy.dll
DetectAutoProxyUrl
wininet.dll
Could not HTTP file: %u
MSG_STATUS_HANDLE_CREATED
MSG_STATUS_HANDLE_CLOSING
MSG_STATUS_REQUEST_COMPLETE
MSG_REDIRECTING
MSG_CONNECTION_CLOSED
MSG_RESOLVING_HOST_NAME
MSG_HOST_NAME_RESOLVED
MSG_CONNECTING_TO_SERVER
MSG_CONNECTED_TO_SERVER
MSG_CLOSING_CONNECTION
MSG: %d
TRACE: LastError = %d ("%s")Script: %s, %s
Script: %s, Line %d
All Files (*.*)|*.*|
PasswordInput
MSG_MOVING
MSG_COPYING
MSG_FROM
MSG_TO
MSG_DELETING
MSG_SEARCHING
\StringFileInfo\xx\SpecialBuild
\StringFileInfo\xx\OriginalFilename
\StringFileInfo\xx\Comments
\StringFileInfo\xx\LegalTrademarks
\StringFileInfo\xx\LegalCopyright
\StringFileInfo\xx\ProductName
\StringFileInfo\xx\InternalName
\StringFileInfo\xx\FileDescription
\StringFileInfo\xx\CompanyName
ErrorMsg
%Y-%m-%dT%H:%M:%S
MSG_INSTALL_DO_YOU_WANT_OVERWRITE
MSG_INSTALL_ALWAYS_ASK_OVERWRITE_MSG
MSG_INSTALL_FILE_OLDER_MSG
OpenURL
\msiexec.exe
RunMsiexec
SQLInstallerError
SQLRemoveDriverManager
odbccp32.dll
SQLConfigDataSource
SQLInstallDriverEx
SQLInstallDriverManager
SQLRemoveDriver
\Kernel32.dll
GetKeyNames
DoesKeyExist
DeleteKey
CreateKey
ShortcutKey
keycode
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
MSG_SIZE_BYTES
P?MSG_SIZE_KILOBYTES
>MSG_SIZE_GIGABYTES
xxxxxx
%s-%s-%s
%s/%s/%s
%s:%s:%s
%d:%s:%s AM
%d:%s:%s PM
Windows Server 2012
Windows 8
MSG_REBOOT_FAILED
WININET.DLL
PPassword
Password
%s %s %s %s (%0.2f %s)
%0.1f %s/%0.1f %s
%I64u %s/%I64u %s
MSG_KB_PER_SEC
MSG_ESTIMATED_TIME_LEFT
MSG_SAVING
MSG_DOWNLOADING
%s %s %s %s
MSG_QUERYING_INTERNET
MSG_READING
GetHTTPErrorInfo
%s > %s
number e_CtrlID, number e_MsgID, table e_Details
Removed: %s
local e_CtrlID=%d; local e_MsgID=%d;
Button%d
Check%d
ComboBox%d
Edit%d
Space available on selected drive: %SpaceAvailable%
Space required: %SpaceRequired%
Error: The specified file: '%s' could not be found.
Error: The specified file: '%s' could not be opened.
Error: The specified file: '%s' is too large to read.
Error: The specified file: '%s' could not be read.
Application.Exit();
Screen.Next();
Screen.Back();
Radio%d
Total space required: %SpaceRequired%
IDS_CTRL_CHECK_BOX_d
IDS_CTRL_BUTTON_d
IDS_CTRL_STATICTEXT_LABEL_d
IDS_CTRL_COMBOBOX_d_DEFAULT
IDS_CTRL_EDIT_d
IDS_CTRL_RADIO_BUTTON_d
IDS_CTRL_LISTBOX_d
IDS_CTRL_SCROLLTEXT_BODY_d
IDS_CTRL_PROGRESS_BAR_d
IDS_CTRL_GROUP_BOX_d
IDS_CTRL_SELECT_PACKAGE_TREE_d
IDS_CTRL_BILLBOARD_d
CTRL_CHECK_BOX_d
CTRL_BUTTON_d
CTRL_STATICTEXT_LABEL_d
CTRL_COMBOBOX_d
CTRL_EDIT_d
CTRL_RADIO_BUTTON_d
CTRL_LIST_BOX_d
CTRL_SCROLLTEXT_BODY_d
CTRL_PROGRESS_BAR_d
CTRL_GROUP_BOX_d
CTRL_SELECT_PACKAGE_TREE_d
CTRL_BILLBOARD_d
IDS_CTRL_COMBOBOX_d_ITEMS
IDS_CTRL_SCROLLTEXT_FILE_d
WebWindow
IDS_CTRL_CATEGORY_NAME_d_%.3d
IDS_CTRL_CATEGORY_DESCRIPTION_d_%.3d
hXXp://VVV.indigorose.com/route.php?pid=suf9buy
[email protected]
.tiff
.jpeg
.wbmp
CNotSupportedException
user32.dll
Afx:%p:%x:%p:%p:%p
Afx:%p:%x
commctrl_DragListMsg
CCmdTarget
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
comctl32.dll
comdlg32.dll
shell32.dll
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Software\Microsoft\Windows\CurrentVersion\Policies\Network
Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32
%s%s.dll
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp
lX-X-x-XX-XXXXXX
RegOpenKeyTransactedA
RegCreateKeyTransactedA
RegDeleteKeyTransactedA
CHttpConnection
CHttpFile
hXXp://
HTTP/1.0
msctls_hotkey32
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp
mfcm100.dll
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
Shell32.dll
%s:%x:%x:%x:%x
RegDeleteKeyExA
lXXxXXXXXXXX
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp
ole32.dll
MFCLink_UrlPrefix
MFCLink_Url
CMDITabProxyWnd
CMDIChildWndEx
CMDIFrameWndEx
%sMFCToolBar-%d%x
%sMFCToolBar-%d
%sMFCToolBarParameters
TOOLBAR_RESETKEYBAORD
KeyboardManager
MSG_CHECKEMPTYMINIFRAME
%sDockingManager-%d
&%d %s
Hex={X,X,X}ShowCmd
CMDIChildWnd
CMDIFrameWnd
CMDIClientAreaWnd
%sMDIClientArea-%d
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\viewcore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleipfrm.cpp
%sBasePane-%d%x
%sBasePane-%d
%sPane-%d%x
%sPane-%d
windows
%sMFCOutlookBar-%d%x
%sMFCOutlookBar-%d
%c%d%c%s
RGB(%d, %d, %d)
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olestrm.cpp
%sDockablePaneAdapter-%d%x
%sDockablePaneAdapter-%d
ENABLE_KEYS
KEYS_MENU
KEYS
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledrop2.cpp
CMFCToolBarsKeyboardPropertyPage
%sMFCTasksPane-%d%x
%sMFCTasksPane-%d
Visual C CRT: Not enough memory to complete call to strerror.
Broken pipe
Inappropriate I/O control operation
Operation not permitted
operator
GetProcessWindowStation
IS 5.0.2.4
Error %d in %s (%s)
Error %d in %s (%s) [%s]
C.o.p.y.r.i.g.h.t...2.0.1.0.
ISLib PNG Error : %s
1.2.22
ISLib JPG Error : %s
DIBToHBITMAP error: GetLastError = %d
read %d. layersLen %d
Reading PCD sub-image #%d (%d x %d)
.cals
Keywords
SetWinMetaFileBits failed GetLastError = %d
GeoKeyDirectory
%s: Invalid InkNames value; expecting %d names, found %d
%s: Bad value %u for "%s" tag
%s: Invalid %stag "%s" (not supported by codec)
%s: Bad field type %d for "%s"
%s: Failed to allocate space for list of custom values
%s: Bad value %d for "%s" tag
%s: Sorry, cannot nest SubIFDs
Nonstandard tile width %d, convert file
Nonstandard tile length %d, convert file
%s: Cannot modify tag "%s" while writing
%s: Unknown %stag %u
%s: Error fetching directory link
%s: Error fetching directory count
Sorry, can not handle images with %d-bit samples
Sorry, LogL data must have %s=%d
Sorry, can not handle LogLuv images with %s=%d
Sorry, LogLuv data must have %s=%d or %d
Sorry, can not handle image with %s=%d
Sorry, can not handle contiguous data with %s=%d, and %s=%d and Bits/Sample=%d
Sorry, can not handle RGB image with %s=%d
Sorry, can not handle contiguous data with %s=%d, and %s=%d
Sorry, can not handle separated image with %s=%d
Missing needed %s tag
No space %s
%s: Read error at scanline %lu, strip %lu; got %lu bytes, expected %lu
%s: Read error at scanline %lu; got %lu bytes, expected %lu
%s: Seek error at scanline %lu, strip %lu
%s: Read error at row %ld, col %ld, tile %ld; got %lu bytes, expected %lu
%s: Read error at row %ld, col %ld; got %lu bytes, expected %lu
%s: Seek error at row %ld, col %ld, tile %ld
%s: No space for data buffer at scanline %ld
%s: Data buffer too small to hold strip %lu
%s: Read error on strip %lu; got %lu bytes, expected %lu
%s: Invalid strip byte count %lu, strip %lu
%s: Data buffer too small to hold tile %ld
"%s": Bad mode
Not a TIFF file, bad version number %d (0x%x)
This is a BigTIFF file. This format not supported
Not a TIFF or MDI file, bad magic number %d (0x%x)
%s: Out of memory (TIFF structure)
Error writing data for field "%s"
%s: Error writing SubIFD directory link
M"%s": Information lost writing value (%g) as (unsigned) RATIONAL
Integer overflow in %s
LIBTIFF, Version 3.9.1
0123456789ABCDEFlibpng error: %s
libpng error: %s, offset=%d
libpng error no. %s: %s
libpng warning: %s
libpng warning no. %s: %s
1.2.3
NULL row buffer for row %ld, pass %d
iTXt chunk not supported.
Corrupt JPEG data: found marker 0xx instead of RST%d
Warning: unknown JFIF revision number %d.d
Corrupt JPEG data: %u extraneous bytes before marker 0xx
Inconsistent progression sequence for component %d coefficient %d
Unknown Adobe color transform code %d
Obtained XMS handle %u
Freed XMS handle %u
Unrecognized component IDs %d %d %d, assuming YCbCr
JFIF extension marker: RGB thumbnail image, length %u
JFIF extension marker: palette thumbnail image, length %u
JFIF extension marker: JPEG-compressed thumbnail image, length %u
Opened temporary file %s
Closed temporary file %s
Ss=%d, Se=%d, Ah=%d, Al=%d
Component %d: dc=%d ac=%d
Start Of Scan: %d components
Component %d: %dhx%dv q=%d
Start Of Frame 0xx: width=%u, height=%u, components=%d
Smoothing not supported with nonstandard sampling ratios
RST%d
At marker 0xx, recovery action %d
Selected %d colors for quantization
Quantizing to %d colors
Quantizing to %d = %d*%d*%d colors
%4u %4u %4u %4u %4u %4u %4u %4u
Unexpected marker 0xx
Miscellaneous marker 0xx, length %u
with %d x %d thumbnail image
JFIF extension marker: type 0xx, length %u
Warning: thumbnail image size does not match data length %u
JFIF APP0 marker: version %d.d, density %dx%d %d
= = = = = = = =
Obtained EMS handle %u
Freed EMS handle %u
Define Restart Interval %u
Define Quantization Table %d precision %d
Define Huffman Table 0xx
Define Arithmetic Table 0xx: 0xx
Unknown APP14 marker (not Adobe), length %u
Unknown APP0 marker (not JFIF), length %u
Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d
Unsupported marker type 0xx
Failed to create temporary file %s
Unsupported JPEG process: SOF type 0xx
Cannot quantize to more than %d colors
Cannot quantize to fewer than %d colors
Cannot quantize more than %d color components
Insufficient memory (case %d)
Not a JPEG file: starts with 0xx 0xx
Quantization table 0xx was not defined
Huffman table 0xx was not defined
Backing store not supported
Cannot transcode due to multiple use of quantization table %d
Maximum supported image dimension is %u pixels
Empty JPEG image (DNL not supported)
Bogus DQT index %d
Bogus DHT index %d
Bogus DAC value 0x%x
Bogus DAC index %d
Unsupported color conversion request
Too many color components: %d, max %d
Buffer passed to JPEG library is too small
JPEG parameter struct mismatch: library thinks size is %u, caller expects %u
Improper call to JPEG library in state %d
Invalid scan script at entry %d
Invalid progressive parameters at scan script entry %d
Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d
Unsupported JPEG data precision %d
Invalid memory pool code %d
Wrong JPEG library version: library is %d, caller expects %d
IDCT output block size %d not supported
Invalid component ID %d in SOS
Bogus message code %d
Found bad IPTC data resource (len exceeds block end). ID=%d
ExifInteroperabilityOffset
InteroperabilityVersion
InteroperabilityIndex
AsShotPreProfileMatrix
AsShotICCProfile
AsShotWhiteXY
AsShotNeutral
InteroperabilityIFDOffset
Internal error, unknown tag 0x%x
Tag %d
Compression algorithm does not support random access
Compression scheme %u %s encoding is not implemented
%s %s encoding is not implemented
Compression scheme %u %s decoding is not implemented
%s %s decoding is not implemented
%s: Cannot determine size of unknown tag type %d
%s: TIFF directory is missing required "%s" field
incorrect count for field "%s" (%u, expecting %u); tag trimmed
incorrect count for field "%s" (%u, expecting %u); tag ignored
%s: Can not read TIFF directory
%s: Can not read TIFF directory count
%s: Seek error accessing TIFF directory
Error fetching data for field "%s"
%s: Rational with zero denominator (num = %u)
unexpected count for field "%s", %u, expected 2; ignored
cannot read TIFF_ANY type %d for field "%s"
Cannot handle different per-sample values for field "%s"
%s: cannot handle zero strip size
%s: cannot handle zero tile size
%s: cannot handle zero scanline size
%s: Wrong "%s" field, ignoring and calculating from imagelength
%s: Bogus "%s" field, ignoring and calculating from imagelength
%s: TIFF directory is missing required "%s" field, calculating from imagelength
%s: cannot handle zero number of %s
%s: wrong data type %d for "%s"; tag ignored
Registering anonymous field with tag %d (0x%x) failed
%s: unknown field with tag %d (0x%x) encountered
%s: invalid TIFF directory; tags are not sorted in ascending order
%s: Failed to read directory at offset %u
Unknown zTXt compression type %d
Incomplete compressed datastream in %s chunk
Data error in compressed datastream in %s chunk
Buffer error in compressed datastream in %s chunk
gamma = (%d/100000)
gx=%f, gy=%f, bx=%f, by=%f
wx=%f, wy=%f, rx=%f, ry=%f
incorrect gamma=(%d/100000)
deflate 1.2.3 Copyright 1995-2003 Jean-loup Gailly
%ld%c
%s compression support is not configured
inflate 1.2.3 Copyright 1995-2005 Mark Adler
LogL16Decode: Not enough data at row %d (short %d pixels)
LogLuvDecode24: Not enough data at row %d (short %d pixels)
LogLuvDecode32: Not enough data at row %d (short %d pixels)
?%s: No space for SGILog translation buffer
No support for converting user data format to LogL
No support for converting user data format to LogLuv
Inappropriate photometric interpretation %d for SGILog compression; %s
SGILog compression supported only for %s, or raw data
Unknown data format %d for LogLuv compression
Unknown encoding %d for LogLuv compression
%s: No space for LogLuv state block
?PixarLog compression can't handle bits depth/data format combination (depth: %d)
%d bit input not supported in PixarLog
PixarLogDecode: unsupported bits/sample: %d
%s: stride %d is not a multiple of sample count, %d, data truncated.
%s: zlib error: %s
%s: Not enough data at scanline %d (short %d bytes)
%s: Decoding error at scanline %d, %s
PixarLog compression can't handle %d bit linear encodings
A%s: Encoder error: %s
%s: Bad code word at line %u of %s %u (x %u)
%s: Uncompressed data (not supported) at line %u of %s %u (x %u)
%s: %s at line %u of %s %u (got %u, expected %u)
%s: Premature EOF at line %u of %s %u (x %u)
%s: No space for Group 3/4 reference line
@ Fax DCS: %s
Fax SubAddress: %s
(%u = 0x%x)
%sEOL padding
%s2-d encoding
%suncompressed data
%s: No space for state block
JpegRestartInterval: %u
JpegProc: %u
OJPEG encoding not supported; use new-style JPEG compression instead
Unknown marker type %d in JPEG data
Subsampling values [%d,%d] are not allowed in TIFF
Subsampling inside JPEG data does not match subsampling tag values [%d,%d] (nor any other values allowed in TIFF); assuming subsampling inside JPEG data is correct and desubsampling inside JPEG decompression
Subsampling inside JPEG data [%d,%d] does not match subsampling tag values [%d,%d]; assuming subsampling inside JPEG data is correct
Subsampling tag is not set, yet subsampling inside JPEG data [%d,%d] does not match default values [2,2]; assuming subsampling inside JPEG data is correct
SamplesPerPixel %d not supported for this compression scheme
JPEG strip/tile size exceeds expected dimensions, expected %dx%d, got %dx%d
Decompressor will try reading with sampling %d,%d.
Improper JPEG sampling factors %d,%d
Apparently should be %d,%d.
Improper JPEG strip/tile size, expected %dx%d, got %dx%d
RowsPerStrip must be multiple of %d for JPEG
JPEG tile width must be multiple of %d
JPEG tile height must be multiple of %d
BitsPerSample %d not allowed for JPEG
PhotometricInterpretation %d not allowed for JPEG
ThunderDecode: %s data at scanline %ld (%lu != %lu)
LZWDecode: Bogus encoding, loop in the code table; scanline %d
LZWDecode: Not enough data at scanline %d (short %ld bytes)
LZWDecode: Wrong length of decoded string: data probably corrupted at scanline %d
LZWDecode: Corrupted LZW table at scanline %d
LZWDecode: Strip %d not terminated with EOI code
LZWDecodeCompat: Corrupted LZW table at scanline %d
LZWDecodeCompat: Wrong length of decoded string: data probably corrupted at scanline %d
LZWDecodeCompat: Not enough data at scanline %d (short %ld bytes)
DumpModeDecode: Not enough data for scanline %d
Horizontal differencing "Predictor" not supported with %d-bit samples
Floating point "Predictor" not supported with %d data format
"Predictor" value %d not supported
Out of memory allocating %d byte temp buffer.
%u (0x%x)
WindowsForms
NTDLL.DLL
COMCTL32.DLL
USER32.DLL
MSCTF.DLL
GDI32.DLL
SHLWAPI.DLL
UXTHEME.DLL
API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0.DLL
LEFTPRESSED
ALWAYSSHOWSIZINGBAR
MSGBOXFONT
%[^,], %ld, %s
User32.dll
msimg32.dll
windows-1254
windows-874
SUBLANG_PORTUGUESE_BRAZILIAN
Portuguese (Brazil)
SUBLANG_PORTUGUESE
LANG_PORTUGUESE
Portuguese (Portugal)
windows-1255
windows-1257
windows-1253
windows-1252
windows-1250
windows-1256
windows-1251
1.2.40
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
WININET.dll
?#%X.y
InternetCrackUrlA
InternetCanonicalizeUrlA
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
.?AVCCmdTarget@@
.PAVCException@@
.PAVCFileException@@
.PAVCMemoryException@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDPAVCISImageEx@@PAV3@@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDVCRect@@AAV3@@@
.?AVCMainWindowSettings@@
.?AVCMD5@@
.?AVCPasswordData@@
.?AVCRTSessionVarMgr@@
.?AVCScreenCrtrMeasure@@
.?AVCWebBrowser2@@
.PAVCInternetException@@
.PAVCResourceException@@
.?AVCScreenCtrlMsg@@
.?AVCScreenCtrlMsgDetail@@
.PAVCThreadException@IR@@
.PAVCObject@@
.PAVCOleException@@
.PAVCSimpleException@@
.PAVCNotSupportedException@@
.PAVCInvalidArgException@@
.?AVCNotSupportedException@@
.PAVCArchiveException@@
.PAVCUserException@@
.?AVCTestCmdUI@@
.?AVCCmdUI@@
.?AVCHttpConnection@@
.?AVCHttpFile@@
.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@
.?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDV12@PBD@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDPAVCDocument@@PAV3@@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD_N_N@@
.?AV?$CMap@PAVCDocument@@PAV1@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@@
.PAVCOleDispatchException@@
.?AVCMDITabProxyWnd@@
.?AVCMDIChildWndEx@@
.?AVCMDIChildWnd@@
.?AVCMDIFrameWndEx@@
.?AVCMDIFrameWnd@@
.?AVCMFCToolBarCmdUI@@
.?AVCMFCAcceleratorKey@@
.?AVCMFCColorBarCmdUI@@
.?AV?$CMap@KKV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@@
.?AV?$CList@PAVCMDIChildWndEx@@PAV1@@@
.?AVCMDIClientAreaWnd@@
.?AVCMFCRibbonCmdUI@@
.?AVCMFCCmdUsageCount@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDPAVCObList@@PAV3@@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDHH@@
.?AVCMFCRibbonKeyTip@@
.?AVCMFCToolBarsKeyboardPropertyPage@@
.?AVCMFCTasksPaneToolBarCmdUI@@
.?AVCMFCAcceleratorKeyAssignCtrl@@
zcÁ
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\_ir_sf_temp_0\irsetup.exe
GetProcessHeap
GetCPInfo
GetWindowsDirectoryA
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
RegEnumKeyA
RegEnumKeyExA
RegQueryInfoKeyA
RegDeleteKeyA
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
GetViewportOrgEx
GetViewportExtEx
GdiplusShutdown
ShellExecuteA
ShellExecuteExA
UrlUnescapeA
URLDownloadToFileA
MapVirtualKeyExA
GetKeyboardState
GetKeyboardLayout
MapVirtualKeyA
GetKeyNameTextA
SetWindowsHookExA
UnhookWindowsHookEx
CreateDialogIndirectParamA
GetKeyState
ExitWindowsEx
EnumWindows
MsgWaitForMultipleObjects
GetAsyncKeyState
.text
`.rdata
@.data
.rsrc
@.reloc
.ZV7yG
n#%uBK0t
a/P%S
accKeyboardShortcut
hhctrl.ocx
KWININET.DLL
dwmapi.dll
xUxTheme.dll
yDWrite.dll
D2D1.dll
SHELL32.DLL
YRICHED20.DLL
mscoree.dll
ekernel32.dll
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
aero.msstyles
winxp.royale.cjstyles
royale.msstyles
winxp.luna.cjstyles
luna.msstyles
Argument %d must be of type %s.
%d arguments required.
All Files (*.*)
No error message is available.#Attempted an unsupported operation.$A required resource was unavailable.
Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.
Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else.1Encountered an unexpected error while reading %1.1Encountered an unexpected error while writing %1.
#Unable to load mail system support.
Note that if you choose to recover the auto-saved documents, you must explicitly save them to overwrite the original documents. If you choose to not recover the auto-saved versions, they will be deleted.fRecover the auto-saved documents
%s [Recovered]
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
sc.exe:1112
net1.exe:1616
net1.exe:316
net.exe:240
net.exe:668
mscorsvw.exe:1912
fenopy.exe:1856
dvprprld.exe:860
regsvr32.exe:332
lbha.exe:1248
%original file name%.exe:376 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\_ir_sf_temp_0\lua5.1.dll (325 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_ir_sf_temp_0\irsetup.exe (7386 bytes)
%Documents and Settings%\All Users\Application Data\Intuit\TurboTax\MSI\TY12\Logs\20150107_TTINSTALLER.log (5741 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fenopy.exe (10719 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_ir_sf_temp_0\IRIMG1.JPG (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_ir_sf_temp_0\IRIMG2.JPG (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_ir_sf_temp_0\irsetup.dat (131 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh7F.tmp\ExecDos.dll (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\glywv.7z (21345 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lbha.exe (15192 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dvprprld.exe (60053 bytes) - Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.
