Backdoor.Win32.PcClient_0109a57754

by malwarelabrobot on August 8th, 2014 in Malware Descriptions.

Backdoor.Win32.PcClient.FD, Trojan.Win32.Swrort.3.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)
Behaviour: Trojan, Backdoor


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 0109a577549d0c58f8f67abbeb07b039
SHA1: 7a5e6239de9dcf98df3bdcc9b6076601422d7059
SHA256: a7b7901f7a800b2df3b87bab1ee7663ce6ed0beeede981040c714e5c373c97f0
SSDeep: 196608:lOG/7EobI1aTZr QjgcjhXc6IQtnQDRbUFjeVbBLTwbL:lFE81oQj GQ2Fje5BLEX
Size: 8705536 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Somoto LTD
Created at: 2013-05-30 11:09:10
Analyzed on: WindowsXP SP3 32-bit


Summary:

Backdoor. Malware that enables a remote control of victim's machine.

Payload

No specific payload has been found.

Process activity

The Backdoor creates the following process(es):

%original file name%.exe:1152
imapi.exe:2352
mediabar.exe:244
patch_ff.exe:2300
MoviesToolbarMediaBar.exe:296
MoviesToolbarMediaBar.exe:380
MoviesToolbarMediaBar.exe:212
SafetyNutManager.exe:1572
SafetyNutManager.exe:908
regsvr32.exe:1280
regsvr32.exe:1636
rundll32.exe:2332
pack.exe:140

The Backdoor injects its code into the following process(es):

safetynut.exe:464
SafetyNutManager.exe:332

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:1152 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsw4\Helper.dll (66604 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1B.tmp (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1E.tmp (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\16.tmp (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw4\nsk8.tmp\pack.exe (112669 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw4\CHAppConfirm.exe (16944 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\12.tmp (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\15.tmp (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\14.tmp (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw4.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\10.tmp (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\21.tmp (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\D.tmp (4545 bytes)
%Program Files%\Movies App\SafetyNut\Helper.dll (15116 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw4\nsk8.tmp\mediabar.exe (69109 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\C.tmp (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1F.tmp (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\F.tmp (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\9.tmp (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw4\Starter.exe (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1D.tmp (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc2.tmp (351881 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\11.tmp (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1C.tmp (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw4.tmp\UserInfo.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\A.tmp (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\19.tmp (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KXYJW12F\install_statistics[1].xml (498 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\B.tmp (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\13.tmp (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw4.tmp\registry.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\18.tmp (4545 bytes)
%Program Files%\Movies App\SafetyNut\Uninstall.exe (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\E.tmp (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\17.tmp (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1A.tmp (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20.tmp (4545 bytes)

The Backdoor deletes the following file(s):

%Program Files%\Movies App\SafetyNut\safetycrt36.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1B.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1E.tmp (0 bytes)
%Program Files%\Movies App\SafetyNut\x64\safetynut.dll (0 bytes)
%Program Files%\Movies App\SafetyNut\x64\configmgrc2.cfg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\12.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\15.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\14.tmp (0 bytes)
%Program Files%\Movies App\SafetyNut\x64\safetyldr.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\10.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\21.tmp (0 bytes)
%Program Files%\Movies App\SafetyNut\x64\safetycrt36.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw4.tmp\registry.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\D.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw4.tmp (0 bytes)
%Program Files%\Movies App\SafetyNut\x64\safetycrt.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\C.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1F.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\F.tmp (0 bytes)
%Program Files%\Movies App\SafetyNut\x64\safetynut_ie.dll (0 bytes)
%Program Files%\Movies App\SafetyNut\SRToolBar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\16.tmp (0 bytes)
%Program Files%\Movies App\SafetyNut\x64 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw4.tmp\System.dll (0 bytes)
%Program Files%\Movies App\SafetyNut\x64\safetyldr_u.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1D.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\11.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1C.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw4.tmp\UserInfo.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\A.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\19.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KXYJW12F\install_statistics[1].xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\B.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\13.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\9.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\18.tmp (0 bytes)
%Program Files%\Movies App\SafetyNut\x64\Internet Explorer Settings Update.exe (0 bytes)
%Program Files%\Movies App\SafetyNut\Internet Explorer Settings Update.exe (0 bytes)
%Program Files%\Movies App\SafetyNut\x64\Internet Explorer Settings.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\E.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\17.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1A.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20.tmp (0 bytes)

The process imapi.exe:2352 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%WinDir%\Temp\8l737cjp.TMP (146970 bytes)

The process mediabar.exe:244 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsw4\nsk8.tmp\MoviesToolbarMediaBar.exe (17083 bytes)

The process patch_ff.exe:2300 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%WinDir%\Temp\nsg2D.tmp\registry.dll (784 bytes)
%WinDir%\Temp\nsg2C.tmp (3615 bytes)
%WinDir%\Temp\nsg2D\Helper.dll (15116 bytes)
%WinDir%\Temp\nsg2D.tmp\System.dll (11 bytes)

The Backdoor deletes the following file(s):

%WinDir%\Temp\nsg2D.tmp (0 bytes)
%WinDir%\Temp\nsg2D.tmp\registry.dll (0 bytes)
%WinDir%\Temp\nsr2B.tmp (0 bytes)
%WinDir%\Temp\nsg2D.tmp\System.dll (0 bytes)

The process MoviesToolbarMediaBar.exe:296 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\remove.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\skin-bluesky.png (3 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\scroll-bg-206.png (663 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_14.png (270 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\logo-over.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\footer-short-middle.png (968 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\sprite-dropdown.png (2 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\icon-play.png (290 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\menuitemleft.png (323 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\css\ie-only.css (153 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\like.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_15.png (344 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\scrollt.png (893 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\lib\dtxprefwin.xul (307 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\scroll-bg.png (663 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\button-splitter-vista.png (264 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F (176 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\bg-pnl520x350blue.png (3 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\bg-btnover-start.png (352 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\js\jquery.qtip.min.js (1552 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\Koyotesoft_Icon_16x16.png (723 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\tab-on-r.png (278 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DTX\Reporting\ReportingHelper.dll (6584 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\settings_stb_19x_over.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_06.png (316 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\btn-widgets-over.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\facebook.png (235 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\TRUSTe_about.png (5 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\powered-by-weatherbug.png (3 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\options-weather.png (2 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\searchtheweb.png (664 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\metacafe.gif (125 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\popupHTML.html (802 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_09.png (288 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\menul-bgover.png (168 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\manifest.xml (2264 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\imap.png (278 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\over-blue.png (163 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\divider.png (134 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-drag.png (486 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\menuitemback-vista.png (209 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\locale\locale.js (257 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\lib\dtxpanel.xul (573 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\btn-search.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-close-grey.png (283 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\searchbar\searchbar-background-right.png (288 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\btn-settings.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\ico-news24.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\youtube.png (608 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq23.tmp (140992 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\win-top-middleglow.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\btn-close-greyover.png (460 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\lib\dtxwin.xul (387 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\win-right-topglow.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\ico-hotandhumid-s.png (2 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\js\jquery.js (3312 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\arrow-right-disabled.gif (46 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\logo-separator.png (582 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\tab-off-l.png (205 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\throbber.gif (825 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\bg-btnover-mdl.png (210 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_21.png (300 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\button-splitter-down-vista.png (261 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-dark-left22.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-dark-right22.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\featured-bg-btm-gradient.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\win-right-middleglow.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\minus.gif (152 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\ask_logo_18x14.png (634 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\searchtheweb.png (664 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-close.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-back.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\ico-pref-over.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\btn-search-over.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\panel-botm-noscroll.png (448 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\highlight_magenta.png (302 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\win-btm-right-resize.png (214 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\tv.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\setting_stb_16x.png (999 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\btn-search-pnlbtm-over.png (3 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\launchers.css (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\gmail.png (741 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\apps-bg-gradient-grid.png (995 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_16.png (278 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\searchbox.png (2 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\options\options-weather.gif (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\arrow-up.gif (46 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\searchboxlite_end.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\settings_stb_19x.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\add.png (653 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\trackid.dat (6 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\scroll-left.png (257 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\titlebar-right.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\options\options-search.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\icon-shop.png (233 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\resize-box.gif (92 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\trailer.png (684 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\bg-btn-end.png (299 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-launch-over.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-next.png (471 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\ttlbar-mdl.png (146 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\modules\nsDragAndDrop.js (784 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\edit-back.png (214 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\highlight_lime.png (300 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\icons\weather.png (3 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\transparent_1px.gif (45 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\reload.png (905 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\ajax-loader.gif (6 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\arrow-up.gif (46 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\ttlbar-left.png (266 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\rss.png (832 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F (533 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\categories-bg-gradient-grid.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\AccessControl.dll (9 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-install.png (2 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\scrollb.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\btn-wide-close.png (857 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\initHTML.html (481 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\toolbarsplitter.gif (76 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\appsfeatured-bg-gradient-grid.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\arrow-right.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\gameData.js (784 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\view-thumb-on.png (402 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\modules\datastore.jsm (3 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\options-search.png (4 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\3_Free_FLV_Converter.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\titlebar-right.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\btn-delete.png (196 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\bullet-orange.gif (43 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\win-right-bottomglow.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\main.html.bak (2 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\data\search\search.xsl (955 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\data\search\engines.xml (3 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\custom.js (784 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\scrollt-disable.png (832 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_18.png (312 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\ico-info.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\btn-close-greyover.png (444 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\lib\rsswin.xml (2 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\gamecategory.xsl (700 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\highlight_cyan.png (299 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-dark-middle22.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\footer-short-left.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\star_x_grey.png (328 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\js\jquery.tinyscrollbar.min.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\nsisFirewall.dll (8 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\scrollb-down.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\1_Free_Video_Converter.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\js\default.js (784 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\components\windowmediator.js (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\locale\toolbar\fr.js (2 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\star_x_orange.png (367 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\ico-box-next.png (791 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\add.png (653 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-search-pnlbtm-over.png (3 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\6_Easy-Audio-MP3-WMA-OGG-Cutter.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\transparent.gif (49 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-close-grey-over.png (457 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\dtuser.exe (33888 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{a4ad8fd9-b395-43e3-88b5-240710b48e27}\geodata.xml (162 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\bg.gif (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\inetc.dll (784 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\locale\toolbar\de.js (2 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\btn_slider.png (763 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton.css (2 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\btnright-vista.png (309 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\template.xml (810 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\video.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\lib\external.js (24832 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\scroll.png (455 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\arrowr-bluew5.png (205 bytes)
%Documents and Settings%\%current user%\Application Data\somotoimeshmoviestoolbar\sysid.dat (3 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\btnarrow-previous.png (683 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\paneltemplate.html (5 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\arrow-sml.png (211 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\btn-widgets.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\btn_settings.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\rsschannelback.png (604 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\templateFF.html (6 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\bg-btnover-mdl_ff.png (179 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\partner.xml (218 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\install.ico (8 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\options\options-widgets.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\data\weather\icons.xml (6 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\2_Free_FLV_Player.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\vmn.css (9 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\move.gif (58 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\titlebar-left.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\like_over.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\locale\toolbar\en.js (4 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\titlebar-left.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\appid.dat (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\icons\na-s.png (4 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\bg-btnover.png (179 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\view-detailed-over.png (451 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\options\options-main.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\tab-on-l.png (167 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\footer.htm (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\bg-btn-divider.png (205 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-close-greyover.png (457 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\as_guid.dat (38 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\lib\rsspreview.html (241 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\search.png (712 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\lib\dtxtransparentwin.xul (657 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-play-left.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\titlebar-middle.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\System.dll (11 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\menu_bg-basic.png (446 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\review.png (812 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\scripts\defscript.js.bak (3 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\sv.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\lib\rsswin.xsl (7 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\lib\neterror.xhtml (344 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\menul-bgon.png (179 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-dark-right22-over.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\titlebar-middle.png (999 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\uninstall.exe (7801 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\radio.png (355 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\InetLoad.dll (784 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\bg-scrollbar-thumb-y.png (966 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\icons\na.png (784 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\scroll-topwin.png (951 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\lastsearch-thumb-back.gif (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\ask_search_212wide.png (671 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\expand.png (303 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\menuitemright-down-vista.png (252 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\ico-info-over.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\search-go.png (840 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\web.png (566 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\ocode.xml (390 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\ico-hotandhumid.png (784 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\bg-pnl520x390.png (3 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\close-hot.png (579 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-dark-left22-over.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\icon_games.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\ask_logo_24x20.png (682 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\5_FREE_WMA_MP3_Converter.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\star.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\toolbar.xml (784 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-search-pnlbtm.png (916 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\searchbox-pnlbtm.png (532 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\websearch.png (853 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\logo.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\css\ie7-only.css (136 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-launch.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\orange.gif (153 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\bg-btnover-end.png (284 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\skin-yellow.png (3 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\weather-contour.png (431 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\dtx.css (784 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\view-thumb-over.png (380 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\widgets.png (447 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\blank.gif (55 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-addtoolbar-right.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\popupGames.html (10 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\over-orange.png (169 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\62B5AF9BE9ADC1085C3C56EC07A82BF6 (224 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\bluesky.gif (153 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\left-menu-hover.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\throbber.gif (825 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\icon-Add.png (228 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\js\jquery.url.js (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\neterror.xhtml (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\bg-btn-start.png (342 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\hotmail.png (297 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\bg-aboutbox.png (2 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\btn-search-pnlbtm.png (916 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_19.png (299 bytes)
%Documents and Settings%\%current user%\Application Data\somotoimeshmoviestoolbar\setupCfg.xml (557 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-right-over.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\notifylabel-right.png (267 bytes)
%Documents and Settings%\%current user%\Application Data\somotoimeshmoviestoolbar\geodata.xml (162 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\45MNWPEZ\geolocation[1].xml (162 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\radio-checked.png (336 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\ico-play.png (248 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\apnuserid.dat (16 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\btn-widgets.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\ico-pref.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\notifylabel_ff.png (210 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\modifyhot.png (149 bytes)
%Documents and Settings%\%current user%\Application Data\somotoimeshmoviestoolbar\apnuserid.dat (16 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\btn-close-grey.png (263 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\menuitemleft-down-vista.png (289 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\vmnrsswin.xml (2 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\movetarget.png (507 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\arrowr-bluew5.png (205 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\bg-btn-mdl.png (205 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\skin-grey.png (3 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\default.png (867 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_11.png (284 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\bg-scrollbar-track-y.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\toolbarsplitter.png (763 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_10.png (250 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-mdl-over.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\skin-lichen.png (3 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\icon-Info.png (218 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\apps-hover.png (2 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_07.png (254 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\ttlbar-right.png (286 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_02.png (248 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\bg-btnover-divider.png (240 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\searchbox-pnlbtm.png (532 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\rename.gif (223 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\css\popupWidgets.css (9 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\lib\about.xml (5 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\win-left-bottomglow.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\lock.png (316 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\dtx-test.css (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-moredetails.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\yellow.gif (153 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\proxy.html (354 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-add-over.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\checkmark.png (309 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\icons\icons.xml (6 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\edit-back-hot.png (217 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-previous.png (476 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\lib\dtxpaneltransparent.xul (653 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\css\jquery.qtip.css (13 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\search-over.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\icons\cond999.png (3 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\vmncode.js (7 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\62B5AF9BE9ADC1085C3C56EC07A82BF6 (133 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\dislike.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\text-ellipsis.xml (423 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\scroll-right.png (258 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\ico-calendar.png (566 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\btn_settings_17padding_18pxheight.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\rsstabdivider.gif (85 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\win-bottom-middleglow.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\powered-by-weatherbug2.png (3 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\highlight_blue.png (309 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\scrollb-disable.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\veoh.png (790 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\logo_movies_18h.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\btnback-down-vista.png (207 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\menuseparatorback.gif (165 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\box-uncheck.png (160 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\tab-off-r.png (312 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\lib\custom.js (784 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-mdl.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\gamethumb-on.png (2 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\skin-bluelite.png (3 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\modify.png (708 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\toolbar.htm (722 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\star_blank.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\win-btm-right.png (205 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\chevron.png (191 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\searchresultstb.dll (19096 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\scripts\defscript.js (3 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\plus.gif (157 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\lib\emailnotifierproviders.xml (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\template.xml (144 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\js\jquery.tinyscrollbar.js (5 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\ico-dollar.png (3 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\btnleft-vista.png (307 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\arrow-down-white.png (982 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\nsProcess.dll (4 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\ico-download.png (692 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\btn-close-grey.png (279 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\menuitemback-down-vista.png (202 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\modify.png (724 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\button-splitter.png (264 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\dislike_over.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\widgets-square-24px.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\4_Free_CD_DVD_burner.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\blip.png (315 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\menuitem-splitter.png (136 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\btnarrow-next-off.png (607 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\css\panels.css (5 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-add.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_13.png (277 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\born_star.png (782 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\lib\wmpstreamer.html (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\ioSpecial.ini (26 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\btnarrow-previous-off.png (649 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-addtoolbar-left-over.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\video_tool.png (557 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\menuitemright-vista.png (309 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\radio-unchecked.png (313 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\options\options-weather.png (2 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\lib\dtxpanelwin.xul (407 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\somotoimeshmoviestoolbar-manifest.xml (9 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\ico-joystick24.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\bg-scrollbar-trackend-y.png (964 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\gameList.xsl (7 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\main.html (2 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\win-left-topglow.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\scrollb-over.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\bg-pnl520x350blue-whitebg.png (4 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_12.png (173 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\radiobeta-stopped.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\arrow-sml-drop.png (188 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\search_icon.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\loadingMid.gif (7 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\btn-close.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-dark-middle22-over.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\icon-download.png (251 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\grey.gif (152 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\locale\lib\en.js (14 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\separator.png (139 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\pop.png (543 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\template.html.bak (7 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\debugbar\debug.html (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\locale\toolbar\it.js (2 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\TRUSTe_about.png (152 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\loadingMid.gif (7 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\btnback-vista.png (207 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\RSSLogo.png (7 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\popupWeather.html (784 bytes)
%Documents and Settings%\%current user%\Application Data\somotoimeshmoviestoolbar\appid.dat (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\preferences.xml (663 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\dailymotion.gif (138 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\win-btm-mdl.png (118 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\xml.dll (784 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\settings.png (3 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\view-detailed-on.png (496 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\images.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\ico-user-monitor.png (853 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-try-left-over.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\bg-btn-mdl_ff.png (203 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-play-left-over.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\bg-pnl.png (7 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\arrow-dn.gif (46 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\css\dialog.css (3 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\mailcom.png (254 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\throbber.gif (825 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\searchbar\searchbar-background-left.png (286 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_08.png (328 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\btnarrow-next.png (643 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\win-left.png (114 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\gamethumb2-over.png (574 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\template.html (7 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\find-videos.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\ask_search_215wide.png (671 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\widgets-square-16px.png (690 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\close-normal.png (585 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-previous-over.png (440 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\menu_separator_bar.png (129 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\highlight.png (811 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\UAC.dll (784 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\arrow-right.gif (46 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\scrollt-down.png (864 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\skin-orange.png (3 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\yahoo.png (244 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\win-btm-left.png (204 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\toolbar.xul (24832 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\bg-pnl520x350.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\notifylabel-left.png (274 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\vimeo.gif (255 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\locale\toolbar\es.js (2 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\btn-search.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\alexabutton.css (596 bytes)
%Documents and Settings%\%current user%\Application Data\somotoimeshmoviestoolbar\guid.dat (38 bytes)
%Documents and Settings%\%current user%\Application Data\somotoimeshmoviestoolbar\trackid.dat (6 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\win-right.png (114 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\btn-settings-over.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\footer-short-middle.png (968 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\popupWeather.css (7 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\ebay.png (3 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\topbar-inside-gradient.png (964 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\notifylabel-middle.png (203 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\css\popupAbout.css (907 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\break.gif (582 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\bluelite.gif (153 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\scrollt-over.png (892 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\searchresultsDx.dll (4992 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\arrow-dn.gif (46 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\btnleft-down-vista.png (310 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\btn-widgets-over.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\searchboxlite.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\highlight_yellow.png (309 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\btn-close-over.png (3 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\thumb-up.png (754 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\collapse.png (264 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\menu_separator_white.png (133 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\gametype.xsl (681 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-next-over.png (442 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\footer-short-left.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\icons\na-t.png (5 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\found.png (902 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\logo-separator.png (566 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_20.png (287 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\popupWidgets.html (14 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\footer-short-right.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\btnright-down-vista.png (289 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\menuitemleft-vista.png (307 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\custom.css (8 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\ico-tags.png (209 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-addtoolbar-left.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\searchbar\searchbar-background-middle.png (152 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lichen.gif (153 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\css\popupGames.css (7 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\ico-check.png (248 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\twitter.png (721 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_03.png (218 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-try-left.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\shadow-leftmenu.png (963 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\modify-save.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\tb_icon.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sysid.dat (3 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\js\jquery.uniform.min.js (9 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\box-check.png (174 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-close-over.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\arrow-left.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\win-left-middleglow.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\btn_ask_search.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\btn-wide-close-over.png (873 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\footer-short-right.png (1 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\logo-about.png (3 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\aol.png (648 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\skin.xml (3 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_04.png (293 bytes)

The Backdoor deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\ocode.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\UAC.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\AccessControl.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\nsisFirewall.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\ioSpecial.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\xml.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa22.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\nsProcess.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\toolbar.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\InetLoad.dll (0 bytes)

The process MoviesToolbarMediaBar.exe:380 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsq2A.tmp\toolbar.xml (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2A.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa29.tmp (131002 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2A.tmp\xml.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2A.tmp\UAC.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2A.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2A.tmp\ocode.xml (390 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DTX\Reporting\ReportingHelper.dll (6584 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\somotoimeshmoviestoolbar-manifest.xml (9 bytes)

The Backdoor deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsq2A.tmp\toolbar.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2A.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2A.tmp\xml.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2A.tmp\UAC.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2A.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2A.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2A.tmp\ocode.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl28.tmp (0 bytes)

The process MoviesToolbarMediaBar.exe:212 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\sysid.dat (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy27.tmp\toolbar.xml (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy27.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DTX\Reporting\ReportingHelper.dll (6584 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy27.tmp\xml.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\apnuserid.dat (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy27.tmp\UAC.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy27.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\trackid.dat (6 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\uninstall.exe (7801 bytes)
%Program Files%\Movies App\SafetyNut\SRTOOL~1\install.ico (8 bytes)
%Documents and Settings%\%current user%\Application Data\somotoimeshmoviestoolbar\setupCfg.xml (557 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy27.tmp\ocode.xml (390 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\somotoimeshmoviestoolbar-manifest.xml (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\appid.dat (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss26.tmp (140992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy27.tmp\AccessControl.dll (9 bytes)

The Backdoor deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\sysid.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy27.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy27.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy27.tmp\xml.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy27.tmp\UAC.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss25.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\apnuserid.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy27.tmp\toolbar.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy27.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\trackid.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy27.tmp\ocode.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\appid.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy27.tmp\AccessControl.dll (0 bytes)

The process SafetyNutManager.exe:908 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%WinDir%\Temp\cd681a53\patch_ff.exe (72036 bytes)
%Documents and Settings%\All Users\Application Data\SafetyNut\general.cfg (1 bytes)
%Documents and Settings%\All Users\Application Data\SafetyNut\S-1-5-21-1844237615-1960408961-1801674531-1003.cfg (3978 bytes)
%Documents and Settings%\All Users\Application Data\SafetyNut\coordinator.cfg (1864 bytes)

The Backdoor deletes the following file(s):

%Documents and Settings%\All Users\Application Data\SafetyNut\S-1-5-21-1844237615-1960408961-1801674531-1003.cfg.bak (0 bytes)
%Documents and Settings%\All Users\Application Data\SafetyNut\coordinator.cfg.bak (0 bytes)

The process regsvr32.exe:1636 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\somotoimeshmoviestoolbar\dtx.ini (15 bytes)

The process pack.exe:140 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%Program Files%\Movies App\SafetyNut\safetycrt36.dll (5369 bytes)
%Program Files%\Movies App\SafetyNut\safetyldr.dll (19 bytes)
%Program Files%\Movies App\SafetyNut\x64\Internet Explorer Settings Update.exe (11142 bytes)
%Program Files%\Movies App\SafetyNut\favicon.ico (1 bytes)
%Program Files%\Movies App\SafetyNut\Internet Explorer Settings Update.exe (9662 bytes)
%Program Files%\Movies App\SafetyNut\safetynut.exe (27527 bytes)
%Program Files%\Movies App\SafetyNut\SafetyNutManager.exe (32108 bytes)
%Program Files%\Movies App\SafetyNut\safetynut.dll (18275 bytes)
%Program Files%\Movies App\SafetyNut\x64\Internet Explorer Settings.exe (11715 bytes)
%Program Files%\Movies App\SafetyNut\safetynut_ie.dll (18283 bytes)
%Program Files%\Movies App\SafetyNut\x64\safetyldr_u.dll (22 bytes)
%Program Files%\Movies App\SafetyNut\configmgrc2.cfg (34 bytes)
%Program Files%\Movies App\SafetyNut\x64\safetycrt.dll (5937 bytes)
%Program Files%\Movies App\SafetyNut\x64\configmgrc2.cfg (42 bytes)
%Program Files%\Movies App\SafetyNut\Internet Explorer Settings.exe (9685 bytes)
%Program Files%\Movies App\SafetyNut\x64\safetycrt36.dll (6469 bytes)
%Program Files%\Movies App\SafetyNut\safetycrt.dll (4511 bytes)
%Program Files%\Movies App\SafetyNut\x64\safetyldr.dll (1426 bytes)
%Program Files%\Movies App\SafetyNut\safetyldr_u.dll (19 bytes)
%Program Files%\Movies App\SafetyNut\x64\safetynut.dll (17310 bytes)
%Program Files%\Movies App\SafetyNut\x64\safetynut_ie.dll (19440 bytes)

Registry activity

The process %original file name%.exe:1152 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utiljumpflip.exe]
"debugger" = "tasklist.exe"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsersafeguard.exe]
"debugger" = "tasklist.exe"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\volaro]
"debugger" = "tasklist.exe"

[HKLM\SOFTWARE\SafetyNut]
"Version" = "5.0.0.13452"

[HKLM\System\CurrentControlSet\Control\Session Manager\AppCertDlls]
"x86" = "%Program Files%\Movies App\SafetyNut\safetycrt.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{338a754c-b46e-4bf2-8ac8-23de36862ad3}]
"Flags" = "1024"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\SafetyNut\General]
"UID" = "7415672225104011"
"iver" = "5.0.0.13452"
"Country" = "UA"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vonteera]
"debugger" = "tasklist.exe"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchprotection.exe]
"debugger" = "tasklist.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchprotector.exe]
"debugger" = "tasklist.exe"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.search.ask.com/?o=APN10640A&gct=hp&d=473-0&v=n13452-432&t=4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\SafetyNut\General]
"ostype" = "win32"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserdefender.exe]
"debugger" = "tasklist.exe"

[HKLM\SOFTWARE\SafetyNut\General]
"kbn" = "13452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bprotect.exe]
"debugger" = "tasklist.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\SafetyNut]
"browser" = " ie ff cr"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchsettings.exe]
"debugger" = "tasklist.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\websteroidsservice.exe]
"debugger" = "tasklist.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Internet Explorer\Approved Extensions]
"{338A754C-B46E-4BF2-8AC8-23DE36862AD3}" = "51 66 7A 6C 4C 1D 3B 1B 5C 6A 90 2E 5D E5 9E 01"

[HKLM\SOFTWARE\SafetyNut\General]
"ie_hp_supported" = "1"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"FrameAuto" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\SafetyNut\General]
"LN" = "en"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snapdo.exe]
"debugger" = "tasklist.exe"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stinst64.exe]
"debugger" = "tasklist.exe"

[HKLM\SOFTWARE\SafetyNut\General]
"home" = "%Program Files%\Movies App"
"clid" = "{7E156722-25B0-40B1-82FD-94270937ED8F}"
"osl" = "en-US"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "28 C7 EE 1F 30 37 4E CA 26 C4 6A DC 3A 48 FD 30"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitguard.exe]
"debugger" = "tasklist.exe"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchsettings64.exe]
"debugger" = "tasklist.exe"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protectedsearch.exe]
"debugger" = "tasklist.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant" = "http://dts.search.ask.com/sidebar.html?src=ssb&gct=ds&appid=0&systemid=473"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"10" = "10"

[HKLM\SOFTWARE\SafetyNut\General]
"kapid" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\websteroids.exe]
"debugger" = "tasklist.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\SafetyNut\General]
"iTime" = "2014-08-07"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserprotect.exe]
"debugger" = "tasklist.exe"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Use Search Asst" = "no"

[HKLM\SOFTWARE\SafetyNut\General]
"pver" = "5.0.0.13452"
"kisid" = "0"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\SafetyNut\General]
"sysid" = "473"
"UC" = "432"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\SafetyNut\General]
"osver" = "5.1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bpsvc.exe]
"debugger" = "tasklist.exe"

[HKLM\SOFTWARE\SafetyNut\General]
"sitime" = "1407381353"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dprotectsvc.exe]
"debugger" = "tasklist.exe"

[HKLM\SOFTWARE\SafetyNut\General]
"AppID" = "0"
"os_user_type" = "Admin"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchinstaller.exe]
"debugger" = "tasklist.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\SafetyNut\General]
"Guid" = "{03E46FFD-1B45-9B96-5809-03FFC361AA10}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\SafetyNut\General]
"aw" = "No"
"ptype" = "n"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jumpflip]
"debugger" = "tasklist.exe"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Search Bar" = "http://dts.search.ask.com/sidebar.html?src=ssb&gct=ds&appid=0&systemid=473"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stinst32.exe]
"debugger" = "tasklist.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKLM\SOFTWARE\SafetyNut\General]
"ie_ds_supported" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\umbrella.exe]
"debugger" = "tasklist.exe"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Search]
"SearchAssistant" = "http://dts.search.ask.com/sidebar.html?src=ssb&gct=ds&appid=0&systemid=473"

The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Backdoor adds the reference to itself to be executed when a user logs on:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"AutoRestartShell" = "1"

The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Backdoor deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"Appinit_Dlls"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

"AutoConfigURL"

The Backdoor disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"removeMoviesToolbartoolbar"

"removeMoviesToolbardatamngr"

The process imapi.exe:2352 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E3 5E 0D CF 64 CE 6A D3 B7 4C 67 62 BA C1 34 F8"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\Imapi]
"ControlFlags" = "1"
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\Imapi\ImapiSvc]
"BitNames" = " ImapiDebugError ImapiDebugWarning ImapiDebugTrace ImapiDebugInfo ImapiDebugX ImapiDebugSort"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\Imapi]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\Imapi\ImapiSvc]
"Guid" = "8107d8e9-e323-49f5-bba2-abc35c243dca"

The process mediabar.exe:244 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5F 07 F6 15 6B E7 2A 6A 85 B6 05 87 5A EE 7F 7D"

The process patch_ff.exe:2300 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0A 2F 6E AF CB C3 93 37 44 A7 56 75 6A B6 DE 79"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf24.tmp\nsProcess.dll, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf24.tmp\xml.dll, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf24.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsy27.tmp\xml.dll, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsy27.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsq2A.tmp\xml.dll, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsq2A.tmp\, , \??\%WinDir%\TEMP\nsg2D.tmp\registry.dll,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\C]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D]
"BaseClass" = "Drive"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\safetynut\General\patches]
"3" = "1"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\A]
"BaseClass" = "Drive"

The process safetynut.exe:464 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3A 62 09 F5 8D 38 EB 28 9E D5 25 A6 00 9F 75 E9"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process MoviesToolbarMediaBar.exe:296 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62B54972-065C-463B-880B-3F13B1A806CA}]
"AppPath" = "C:\PROGRA~1\MOVIES~1\SAFETY~1\SRTOOL~1\IE"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf24.tmp\nsProcess.dll,"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62B54972-065C-463B-880B-3F13B1A806CA}]
"AppName" = "dtuser.exe"

[HKCU\Software\somotoimeshmoviestoolbar]
"Installer Language" = "1033"

[HKCU\Software\APNDTX\BUN2-DTX\IE\macro]
"Version" = "2.1.0.0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCU\Software\APNDTX\BUN2-DTX\IE\macro]
"apn_dtid" = "^BND101^YY^UA"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\APNDTX\BUN2-DTX]
"Browsers" = "1-IE"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\APNDTX\BUN2-DTX\IE\macro]
"sysid" = "473"

[HKCU\Software\APNDTX\{a4ad8fd9-b395-43e3-88b5-240710b48e27}\IE]
"DisplayName" = "Movies Search App (Dist. by Somoto Ltd.)"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\somotoimeshmoviestoolbarIE]
"InstallLocation" = "C:\PROGRA~1\MOVIES~1\SAFETY~1\SRTOOL~1\IE"

[HKCU\Software\APNDTX\BUN2-DTX\IE\macro]
"nthp_cr" = "1"

[HKCU\Software\APNDTX\BUN2-DTX]
"trgb" = "IE"

[HKCU\Software\APNDTX\{a4ad8fd9-b395-43e3-88b5-240710b48e27}]
"lastinstalled" = "IE"

[HKCU\Software\APNDTX\BUN2-DTX]
"lastinstalled" = "IE"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\${dtUserElevationPolicyID}]
"AppName" = "dtuser.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\somotoimeshmoviestoolbarIE]
"DisplayName" = "Movies Search App for Internet Explorer (Dist. by Somoto Ltd.)"

[HKCU\Software\APNDTX\{a4ad8fd9-b395-43e3-88b5-240710b48e27}\IE]
"App ID" = "somotoimeshmoviestoolbar"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\APNDTX\BUN2-DTX\IE\macro]
"hp" = "http://www.search.ask.com/?o=APN10640&p2=^AG1^BND101^YY^UA&apn_uid=7415672225104011&apn_ptnrs=^AG1&tpid=BUN2-DTX&apn_dtid=^BND101^YY^UA&apn_dbr=IE&doi=2014-08-07&trgb=IE&psv=&gct=hp"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\somotoimeshmoviestoolbarIE]
"Publisher" = "IAC Search and Media, Inc."

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\APNDTX]
"ToolbarID" = "Movies Search App (Dist. by Somoto Ltd.)"

[HKCU\Software\APNDTX\BUN2-DTX\IE\macro]
"Locale" = "en_UA"
"timeofinstall" = "2014-08-07T6:15:42"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\APNDTX\BUN2-DTX\IE\macro]
"doi" = "2014-08-07"
"apn_ptnrs" = "^AG1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\somotoimeshmoviestoolbarIE]
"NoModify" = "1"

[HKCU\Software\APNDTX\BUN2-DTX\IE\macro]
"apn_uid" = "7415672225104011"

[HKCU\Software\APNDTX\BUN2-DTX]
"Class ID" = "{a4ad8fd9-b395-43e3-88b5-240710b48e27}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\somotoimeshmoviestoolbarIE]
"EstimatedSize" = "0"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\APNDTX\IMH-LPD]
"lastinstalled" = "BUN2-DTX"

[HKCU\Software\APNDTX\BUN2-DTX\IE\macro]
"SB" = "http://www.search.ask.com/web?o=APN10640&p2=^AG1^BND101^YY^UA&apn_uid=7415672225104011&apn_ptnrs=^AG1&tpid=BUN2-DTX&apn_dtid=^BND101^YY^UA&apn_dbr=IE&doi=2014-08-07&trgb=IE&psv=&gct=sb&q={searchTerms}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\APNDTX\BUN2-DTX\IE\macro]
"dbr" = "IE"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\somotoimeshmoviestoolbarIE]
"UninstallString" = "C:\PROGRA~1\MOVIES~1\SAFETY~1\SRTOOL~1\IE\uninstall.exe /UN=IE /PID=BUN2-DTX /PCD=IMH"

[HKCU\Software\APNDTX\BUN2-DTX\IE\macro]
"TrackID" = "BND101"
"ds" = "http://www.search.ask.com/web?o=APN10640&p2=^AG1^BND101^YY^UA&apn_uid=7415672225104011&apn_ptnrs=^AG1&tpid=BUN2-DTX&apn_dtid=^BND101^YY^UA&apn_dbr=IE&doi=2014-08-07&trgb=IE&psv=&gct=&q={searchTerms}"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62B54972-065C-463B-880B-3F13B1A806CA}]
"Policy" = "3"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.search.ask.com/?o=APN10640A&gct=hp&d=473-0&v=n13452-432&t=4"

[HKCU\Software\APNDTX\IMH-LPD]
"lastinstalled-IE" = "BUN2-DTX"

[HKCU\Software\APNDTX]
"Version" = "2.1.0.0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\APNDTX\BUN2-DTX\IE\macro]
"nt" = "http://www.search.ask.com/?o=APN10640&p2=^AG1^BND101^YY^UA&apn_uid=7415672225104011&apn_ptnrs=^AG1&tpid=BUN2-DTX&apn_dtid=^BND101^YY^UA&apn_dbr=IE&doi=2014-08-07&trgb=IE&psv=&gct=tab"
"CountryCode" = "UA"
"o" = "APN10640"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\${dtUserElevationPolicyID}]
"Policy" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E0 90 F3 E3 74 E4 4B D4 5B 26 7D A8 5D 87 A7 47"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a4ad8fd9-b395-43e3-88b5-240710b48e27}]
"Policy" = "3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\somotoimeshmoviestoolbarIE]
"DisplayIcon" = "C:\PROGRA~1\MOVIES~1\SAFETY~1\SRTOOL~1\IE\install.ico"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a4ad8fd9-b395-43e3-88b5-240710b48e27}]
"AppPath" = "C:\PROGRA~1\MOVIES~1\SAFETY~1\SRTOOL~1\IE"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\somotoimeshmoviestoolbarIE]
"NoRepair" = "1"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\${dtUserElevationPolicyID}]
"AppPath" = "C:\PROGRA~1\MOVIES~1\SAFETY~1\SRTOOL~1\IE"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\APNDTX\BUN2-DTX\IE\macro]
"hpr_cr" = "http://www.search.ask.com/?o=APN10640&p2=^AG1^BND101^YY^UA&apn_uid=7415672225104011&apn_ptnrs=^AG1&tpid=BUN2-DTX&apn_dtid=^BND101^YY^UA&apn_dbr=IE&doi=2014-08-07&trgb=IE&psv=&gct=hp"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\APNDTX\{a4ad8fd9-b395-43e3-88b5-240710b48e27}\IE]
"Path" = "C:\PROGRA~1\MOVIES~1\SAFETY~1\SRTOOL~1\IE"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\somotoimeshmoviestoolbarIE]
"DisplayVersion" = "2.1.0.0"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a4ad8fd9-b395-43e3-88b5-240710b48e27}]
"AppName" = "uninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\APNDTX\BUN2-DTX\IE\macro]
"AppID" = "0"

The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE]
"dtUser.exe" = "%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\dtuser.exe:*:Enabled:Movies Search App (Dist. by Somoto Ltd.) DTX Broker"

The Backdoor deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"ProxyServer"
"AutoConfigURL"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Program Files%\Movies App\SafetyNut\SRTOOL~1\IE]
"dtuser.exe"

[HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"ITBarLayout"

The Backdoor disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"NSIS.Library.RegTool.v1"

"NSIS.Library.RegTool.v3"

"NSIS.Library.RegTool.v2"

"NSIS.Library.RegTool.v5"

"NSIS.Library.RegTool.v4"

The process MoviesToolbarMediaBar.exe:380 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf24.tmp\nsProcess.dll, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf24.tmp\xml.dll, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf24.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsy27.tmp\xml.dll, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsy27.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsq2A.tmp\xml.dll,"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "09 2B 8E A1 80 9E EA CE 14 58 37 80 AA 31 11 95"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Backdoor deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process MoviesToolbarMediaBar.exe:212 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKCU\Software\APNDTX\BUN2-DTX\FF\macro]
"CountryCode" = "UA"

[HKCU\Software\APNDTX\{a4ad8fd9-b395-43e3-88b5-240710b48e27}\FF]
"Path" = "C:\PROGRA~1\MOVIES~1\SAFETY~1\SRTOOL~1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\somotoimeshmoviestoolbarFF]
"NoRepair" = "1"

[HKCU\Software\APNDTX\{a4ad8fd9-b395-43e3-88b5-240710b48e27}\FF]
"App ID" = "somotoimeshmoviestoolbar"

[HKCU\Software\APNDTX]
"Version" = "2.1.0.0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\somotoimeshmoviestoolbarFF]
"UninstallString" = "C:\PROGRA~1\MOVIES~1\SAFETY~1\SRTOOL~1\uninstall.exe /UN=FF /PID=BUN2-DTX /PCD=IMH"
"EstimatedSize" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\APNDTX\BUN2-DTX\FF\macro]
"nthp_cr" = "1"

[HKCU\Software\APNDTX\BUN2-DTX]
"lastinstalled" = "FF"

[HKCU\Software\APNDTX\{a4ad8fd9-b395-43e3-88b5-240710b48e27}]
"lastinstalled" = "FF"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf24.tmp\nsProcess.dll, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf24.tmp\xml.dll, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf24.tmp\, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsy27.tmp\xml.dll,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\APNDTX\BUN2-DTX\FF\macro]
"doi" = "2014-08-07"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\somotoimeshmoviestoolbarFF]
"NoModify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\somotoimeshmoviestoolbarFF]
"InstallLocation" = "C:\PROGRA~1\MOVIES~1\SAFETY~1\SRTOOL~1"

[HKCU\Software\APNDTX\IMH-LPD]
"lastinstalled-FF" = "BUN2-DTX"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\APNDTX\BUN2-DTX\FF\macro]
"sysid" = "473"

[HKCU\Software\APNDTX\{a4ad8fd9-b395-43e3-88b5-240710b48e27}\FF]
"DisplayName" = "Movies Search App (Dist. by Somoto Ltd.)"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\APNDTX\BUN2-DTX\FF\macro]
"AppID" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\somotoimeshmoviestoolbarFF]
"DisplayVersion" = "2.1.0.0"

"DisplayIcon" = "C:\PROGRA~1\MOVIES~1\SAFETY~1\SRTOOL~1\install.ico"

[HKCU\Software\APNDTX\BUN2-DTX\FF\macro]
"ds" = "http://www.search.ask.com/web?o=APN10640&p2=^AG1^BND101^YY^UA&apn_uid=7415672225104011&apn_ptnrs=^AG1&tpid=BUN2-DTX&apn_dtid=^BND101^YY^UA&apn_dbr=IE&doi=2014-08-07&trgb=FF&psv=&gct=&q={searchTerms}"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\APNDTX\BUN2-DTX\FF\macro]
"nt" = "http://www.search.ask.com/?o=APN10640&p2=^AG1^BND101^YY^UA&apn_uid=7415672225104011&apn_ptnrs=^AG1&tpid=BUN2-DTX&apn_dtid=^BND101^YY^UA&apn_dbr=IE&doi=2014-08-07&trgb=FF&psv=&gct=tab"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\APNDTX\BUN2-DTX\FF\macro]
"TrackID" = "BND101"

"apn_dtid" = "^BND101^YY^UA"
"o" = "APN10640"

[HKCU\Software\APNDTX]
"ToolbarID" = "Movies Search App (Dist. by Somoto Ltd.)"

[HKCU\Software\APNDTX\BUN2-DTX]
"Browsers" = "1-IE,2-FF"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.search.ask.com/?o=APN10640A&gct=hp&d=473-0&v=n13452-432&t=4"

[HKCU\Software\APNDTX\BUN2-DTX\FF\macro]
"timeofinstall" = "2014-08-07T6:15:50"
"hpr_cr" = "http://www.search.ask.com/?o=APN10640&p2=^AG1^BND101^YY^UA&apn_uid=7415672225104011&apn_ptnrs=^AG1&tpid=BUN2-DTX&apn_dtid=^BND101^YY^UA&apn_dbr=IE&doi=2014-08-07&trgb=FF&psv=&gct=hp"
"SB" = "http://www.search.ask.com/web?o=APN10640&p2=^AG1^BND101^YY^UA&apn_uid=7415672225104011&apn_ptnrs=^AG1&tpid=BUN2-DTX&apn_dtid=^BND101^YY^UA&apn_dbr=IE&doi=2014-08-07&trgb=FF&psv=&gct=sb&q={searchTerms}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\APNDTX\BUN2-DTX\FF\macro]
"Locale" = "en_UA"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5B 1D 8C 83 A3 6A 30 57 4C 18 02 D7 1D CD 7A CC"

[HKCU\Software\APNDTX\BUN2-DTX\FF\macro]
"apn_uid" = "7415672225104011"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a4ad8fd9-b395-43e3-88b5-240710b48e27}]
"Policy" = "3"

[HKCU\Software\APNDTX\BUN2-DTX\FF\macro]
"hp" = "http://www.search.ask.com/?o=APN10640&p2=^AG1^BND101^YY^UA&apn_uid=7415672225104011&apn_ptnrs=^AG1&tpid=BUN2-DTX&apn_dtid=^BND101^YY^UA&apn_dbr=IE&doi=2014-08-07&trgb=FF&psv=&gct=hp"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a4ad8fd9-b395-43e3-88b5-240710b48e27}]
"AppPath" = "C:\PROGRA~1\MOVIES~1\SAFETY~1\SRTOOL~1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\somotoimeshmoviestoolbarFF]
"DisplayName" = "Movies Search App for Firefox (Dist. by Somoto Ltd.)"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\somotoimeshmoviestoolbar]
"Installer Language" = "1033"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\somotoimeshmoviestoolbarFF]
"Publisher" = "IAC Search and Media, Inc."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\APNDTX\BUN2-DTX\FF\macro]
"apn_ptnrs" = "^AG1"

[HKCU\Software\APNDTX\IMH-LPD]
"lastinstalled" = "BUN2-DTX"

[HKCU\Software\APNDTX\BUN2-DTX\FF\macro]
"dbr" = "IE"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a4ad8fd9-b395-43e3-88b5-240710b48e27}]
"AppName" = "uninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\APNDTX\BUN2-DTX\FF\macro]
"Version" = "2.1.0.0"

The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Backdoor deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process SafetyNutManager.exe:1572 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "93 65 9A BC 20 34 D3 EF 2A 38 F6 88 F2 28 D0 0C"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\SafetyNut\General]
"srn1" = "F06DEFF2-5B9C-490D-910F-35D3A9119622"
"srn0" = "SafetyNutManager"

The process SafetyNutManager.exe:908 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "38 ED C8 E1 4E AC 14 17 98 13 D3 BE 8A DA E6 48"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process SafetyNutManager.exe:332 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "54 A3 D9 F3 9A 8A 25 AB FB CD 68 EE 44 05 E6 91"

[HKLM\System\CurrentControlSet\Control\Session Manager\AppCertDlls]
"x64" = "c:\program files\movies app\safetynut\x64\safetycrt.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process regsvr32.exe:1280 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKCR\CLSID\{338a754c-b46e-4bf2-8ac8-23de36862ad3}\ProgID]
"(Default)" = "MoviesToolbarHelper.UrlHelper.1"

[HKCR\MoviesToolbarHelper.DNSGuard]
"(Default)" = "SafetyNut"

[HKCR\Interface\{6014D692-4409-4EDD-ABB2-36CA26DC2A2E}\TypeLib]
"Version" = "1.0"
"(Default)" = "{934BEE21-C5A4-457E-B130-77CA098FBBD3}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCR\MoviesToolbarHelper.DNSGuard\CurVer]
"(Default)" = "MoviesToolbarHelper.UrlHelper.1"

[HKCR\Interface\{6014D692-4409-4EDD-ABB2-36CA26DC2A2E}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCR\TypeLib\{934BEE21-C5A4-457E-B130-77CA098FBBD3}\1.0\0\win32]
"(Default)" = "C:\PROGRA~1\MOVIES~1\SAFETY~1\SAE8B3~1.DLL"

[HKCR\Interface\{6014D692-4409-4EDD-ABB2-36CA26DC2A2E}]
"(Default)" = "IDNSGuard"

[HKCR\CLSID\{338a754c-b46e-4bf2-8ac8-23de36862ad3}\VersionIndependentProgID]
"(Default)" = "MoviesToolbarHelper.UrlHelper"

[HKCR\Interface\{6014D692-4409-4EDD-ABB2-36CA26DC2A2E}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\MoviesToolbarHelper.DNSGuard.1]
"(Default)" = "SafetyNut"

[HKCR\MoviesToolbarHelper.DNSGuard\CLSID]
"(Default)" = "{338a754c-b46e-4bf2-8ac8-23de36862ad3}"

[HKCR\TypeLib\{934BEE21-C5A4-457E-B130-77CA098FBBD3}\1.0\HELPDIR]
"(Default)" = "C:\PROGRA~1\MOVIES~1\SAFETY~1"

[HKCR\TypeLib\{934BEE21-C5A4-457E-B130-77CA098FBBD3}\1.0]
"(Default)" = "MoviesToolbarHelper Type Library"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6F 80 C8 0E B5 3C 63 82 6A D0 30 75 97 CF 9C 85"

[HKCR\TypeLib\{934BEE21-C5A4-457E-B130-77CA098FBBD3}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\CLSID\{d6715933-3f8b-44bc-b4b2-682164832b31}\InprocServer32]
"(Default)" = "C:\PROGRA~1\MOVIES~1\SAFETY~1\SAE8B3~1.DLL"
"ThreadingModel" = "Apartment"

[HKCR\MoviesToolbarHelper.DNSGuard.1\CLSID]
"(Default)" = "{338a754c-b46e-4bf2-8ac8-23de36862ad3}"

[HKCR\CLSID\{338a754c-b46e-4bf2-8ac8-23de36862ad3}]
"(Default)" = "SafetyNut"

[HKCR\CLSID\{338a754c-b46e-4bf2-8ac8-23de36862ad3}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\CLSID\{d6715933-3f8b-44bc-b4b2-682164832b31}]
"(Default)" = "ErrorFilter Class"

[HKCR\CLSID\{338a754c-b46e-4bf2-8ac8-23de36862ad3}\InprocServer32]
"(Default)" = "C:\PROGRA~1\MOVIES~1\SAFETY~1\SAE8B3~1.DLL"

The Backdoor deletes the following registry key(s):

[HKCR\CLSID\{d6715933-3f8b-44bc-b4b2-682164832b31}]
[HKCR\CLSID\{d6715933-3f8b-44bc-b4b2-682164832b31}\Programmable]
[HKCR\CLSID\{d6715933-3f8b-44bc-b4b2-682164832b31}\InprocServer32]
[HKCR\CLSID\{338a754c-b46e-4bf2-8ac8-23de36862ad3}\Programmable]
[HKCR\CLSID\{338a754c-b46e-4bf2-8ac8-23de36862ad3}\ProgID]
[HKCR\CLSID\{338a754c-b46e-4bf2-8ac8-23de36862ad3}]
[HKCR\CLSID\{338a754c-b46e-4bf2-8ac8-23de36862ad3}\VersionIndependentProgID]
[HKCR\CLSID\{338a754c-b46e-4bf2-8ac8-23de36862ad3}\InprocServer32]

The process regsvr32.exe:1636 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "80 9C 16 C5 46 74 BF 0D 64 5D 09 C2 57 06 84 DE"

[HKCR\CLSID\{a4ad8fd9-b395-43e3-88b5-240710b48e27}\InprocServer32]
"ThreadingModel" = "Apartment"
"(Default)" = "C:\PROGRA~1\MOVIES~1\SAFETY~1\SRTOOL~1\IE\searchresultsDx.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCR\CLSID\{a4ad8fd9-b395-43e3-88b5-240710b48e27}]
"(Default)" = "Movies Search App (Dist. by Somoto Ltd.)"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{a4ad8fd9-b395-43e3-88b5-240710b48e27}" = "Movies Search App (Dist. by Somoto Ltd.)"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a4ad8fd9-b395-43e3-88b5-240710b48e27}]
"(Default)" = "Movies Search App (Dist. by Somoto Ltd.)"

The process rundll32.exe:2332 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3B AC AE 05 8E 06 63 EE 9C 4E C2 2A 06 FF 3B 14"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The process pack.exe:140 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EA 40 D6 53 89 E3 BA 37 CE 18 3F 5C 42 39 B0 BE"

Dropped PE files

MD5 File path
27d9ed8cb8b62d1e0a8e5ace6cf52e2f c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\19.tmp
cd36c68e6c1263092527ff8f699b44f1 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\DTX\Reporting\ReportingHelper.dll
05450face243b3a7472407b999b03a72 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsf24.tmp\nsProcess.dll
fbda05aa26e02d38effb82294e83ea69 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsf24.tmp\xml.dll
fbda05aa26e02d38effb82294e83ea69 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsq2A.tmp\xml.dll
92504f0e882ac7903c3f59052322c04e c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsw4\CHAppConfirm.exe
df80fd9ee2891ecc997e48a09fa74f88 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsw4\Helper.dll
641b3db148dc09ac6d2a11df65669c34 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsw4\Starter.exe
0b572a69b95f40b1f67a059625fa2063 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsw4\nsk8.tmp\MoviesToolbarMediaBar.exe
c7d2e92fe164f51e4426cf9571cd5510 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsw4\nsk8.tmp\mediabar.exe
2c0c8f844b8db194494ec0862aca1bf8 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsw4\nsk8.tmp\pack.exe
fbda05aa26e02d38effb82294e83ea69 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsy27.tmp\xml.dll
df80fd9ee2891ecc997e48a09fa74f88 c:\Program Files\Movies App\SafetyNut\Helper.dll
45c4b60e0ef429a2d934fd6f3f624b63 c:\Program Files\Movies App\SafetyNut\Internet Explorer Settings.exe
b3dfef830957cd1206d0a0e4b54a9a68 c:\Program Files\Movies App\SafetyNut\SRTOOL~1\IE\dtuser.exe
775b7ee21c3bf311359c6f17ab7faa42 c:\Program Files\Movies App\SafetyNut\SRTOOL~1\IE\searchresultsDx.dll
4e6a4c964300a51c7fb93cff092cedc3 c:\Program Files\Movies App\SafetyNut\SRTOOL~1\IE\searchresultstb.dll
9c0ca5d5479667ca6939a99f6d76f95e c:\Program Files\Movies App\SafetyNut\SRTOOL~1\IE\uninstall.exe
9c0ca5d5479667ca6939a99f6d76f95e c:\Program Files\Movies App\SafetyNut\SRTOOL~1\uninstall.exe
3cdbf5529c59874b0dcba5eda1a0531f c:\Program Files\Movies App\SafetyNut\SafetyNutManager.exe
4def694063fe7a845c0923c08832dcf0 c:\Program Files\Movies App\SafetyNut\Uninstall.exe
6fc72206cbc42a0915c93711dc99df0f c:\Program Files\Movies App\SafetyNut\configmgrc2.cfg
c1df2bf04a3f5463af5139182471bd88 c:\Program Files\Movies App\SafetyNut\safetycrt.dll
a94afe33b321903aae1a559fc83c5201 c:\Program Files\Movies App\SafetyNut\safetyldr.dll
d950bfb435f1f04c5c18f4d80e8e4507 c:\Program Files\Movies App\SafetyNut\safetyldr_u.dll
88e3ca99859307c1b4658cebe6ba04e0 c:\Program Files\Movies App\SafetyNut\safetynut.dll
fe3c2789186f1981dc9b4ed9938d169c c:\Program Files\Movies App\SafetyNut\safetynut.exe
2f390b9703fca4764e6192775fdef4ee c:\Program Files\Movies App\SafetyNut\safetynut_ie.dll
e8119e6bd19743b3a1791a963e47a0cc c:\WINDOWS\Temp\cd681a53\patch_ff.exe
2b7007ed0262ca02ef69d8990815cbeb c:\WINDOWS\Temp\nsg2D.tmp\registry.dll
df80fd9ee2891ecc997e48a09fa74f88 c:\WINDOWS\Temp\nsg2D\Helper.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

Using the driver "\??\%Program Files%\Movies App\SafetyNut\configmgrc2.cfg" the Backdoor controls operations with a system registry by installing the registry notifier.
The Backdoor installs the following kernel-mode hooks:

ZwOpenProcess
ZwOpenThread

Using the driver " \??\%Program Files%\Movies App\SafetyNut\configmgrc2.cfg" the Backdoor attaches its filter-device object to the Volume Device Object (VDO) of the file system driver.

Propagation

VersionInfo

Company Name: Somoto LTD
Product Name: MoviesToolbar
Product Version: 5.0.0.13452
Legal Copyright: Copyright (c) 2005 - 2014
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 5.0.0.13452
File Description: Movies App Install
Comments:
Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 28852 29184 4.49139 b7dd7ef0e5ad7002a5410c08a455d9a2
.rdata 36864 10930 11264 3.0441 8acc145fd5b0b8d5e29138559785c9da
.data 49152 425660 512 1.01815 7a21637804e89fb9667b4619ab7edba1
.ndata 475136 5263360 0 0 d41d8cd98f00b204e9800998ecf8427e
.rsrc 5738496 3232 3584 2.81249 b89220113293159826f16ad0665e44dc
.reloc 5742592 4010 4096 3.76371 9f5cb9c788e020c0081d2cb3163900b9

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 1
7dec5d9b8a0b0789d119392827e0e4f3

URLs

URL IP
hxxp://websearch.ask.com/geolocation 199.36.100.106
hxxp://e6845.ce.akamaiedge.net/pca3-g5.crl
hxxp://e6845.ce.akamaiedge.net/CSC3-2010.crl
hxxp://www187.apnanalytics.com/tr.gif?anxa=APNImeshToolbar&anxe=SuccessfulInstall&anxt=7415672225104011&anxv=2.1.0.0&anxp=^AG1^BND101^YY^UA&tpid=BUN2-DTX&appid=0&sysid=473&psv=&installationResult=success&executionTime=0&targetbrowser=IE&browsers=1-IE&locale=en_UA&homepageChoice=&defaultSearchChoice=&osDetail=5.1.1.sp3.x86&osArchitecture=32&ieVersionInstalled=6.0.2900.5512&ffVersionInstalled=&crVersionInstalled=&apn_dbr=IE&ie_ds=&ie_hpr=1&ff_crm=&ff_hpr=&cr_ds=&cr_hb=&cr_start=&ie_tbon=1&cr_tbon=&ff_tbon=&ie_tboff=0&ff_tboff=&cr_tboff=&ie_tbs=&ff_tbs=&cr_tbs=&OSlanguage=en
hxxp://www187.apnanalytics.com/tr.gif?anxa=APNImeshToolbar&anxe=SuccessfulInstall&anxt=7415672225104011&anxv=2.1.0.0&anxp=^AG1^BND101^YY^UA&tpid=BUN2-DTX&appid=0&sysid=473&psv=&installationResult=success&executionTime=0&targetbrowser=FF&browsers=1-IE,2-FF&locale=en_UA&homepageChoice=&defaultSearchChoice=&osDetail=5.1.1.sp3.x86&osArchitecture=32&ieVersionInstalled=6.0.2900.5512&ffVersionInstalled=&crVersionInstalled=&apn_dbr=IE&ie_ds=&ie_hpr=1&ff_crm=&ff_hpr=&cr_ds=&cr_hb=&cr_start=&ie_tbon=1&cr_tbon=&ff_tbon=&ie_tboff=0&ff_tboff=&cr_tboff=&ie_tbs=&ff_tbs=&cr_tbs=&OSlanguage=en
hxxp://www187.apnanalytics.com/tr.gif?anxa=APNImeshToolbar&anxe=SuccessfulInstall&anxt=7415672225104011&anxv=2.1.0.0&anxp=^AG1^BND101^YY^UA&tpid=BUN2-DTX&appid=0&sysid=473&psv=&installationResult=fail&executionTime=0&targetbrowser=CR&browsers=&locale=en_UA&homepageChoice=&defaultSearchChoice=&osDetail=5.1.1.sp3.x86&osArchitecture=32&ieVersionInstalled=6.0.2900.5512&ffVersionInstalled=&crVersionInstalled=&apn_dbr=IE&ie_ds=&ie_hpr=1&ff_crm=&ff_hpr=&cr_ds=&cr_hb=&cr_start=&ie_tbon=1&cr_tbon=&ff_tbon=&ie_tboff=0&ff_tboff=&cr_tboff=&ie_tbs=&ff_tbs=&cr_tbs=&OSlanguage=en
hxxp://snutbe-lb-1790352312.us-east-1.elb.amazonaws.com/login
hxxp://a1755.g.akamai.net/cdn/update/somoto/patches/3/patch_ff.exe
hxxp://snutbe-lb-1790352312.us-east-1.elb.amazonaws.com/install_statistics.php
hxxp://service.safetynutbe.com/install_statistics.php 174.129.22.63
hxxp://anx.apnanalytics.com/tr.gif?anxa=APNImeshToolbar&anxe=SuccessfulInstall&anxt=7415672225104011&anxv=2.1.0.0&anxp=^AG1^BND101^YY^UA&tpid=BUN2-DTX&appid=0&sysid=473&psv=&installationResult=success&executionTime=0&targetbrowser=FF&browsers=1-IE,2-FF&locale=en_UA&homepageChoice=&defaultSearchChoice=&osDetail=5.1.1.sp3.x86&osArchitecture=32&ieVersionInstalled=6.0.2900.5512&ffVersionInstalled=&crVersionInstalled=&apn_dbr=IE&ie_ds=&ie_hpr=1&ff_crm=&ff_hpr=&cr_ds=&cr_hb=&cr_start=&ie_tbon=1&cr_tbon=&ff_tbon=&ie_tboff=0&ff_tboff=&cr_tboff=&ie_tbs=&ff_tbs=&cr_tbs=&OSlanguage=en 74.113.233.187
hxxp://download.cdn.safetynutbe.com/cdn/update/somoto/patches/3/patch_ff.exe 129.7.130.141
hxxp://crl.verisign.com/pca3-g5.crl 23.9.117.163
hxxp://preved.safetynutbe.com/login 50.17.206.223
hxxp://anx.apnanalytics.com/tr.gif?anxa=APNImeshToolbar&anxe=SuccessfulInstall&anxt=7415672225104011&anxv=2.1.0.0&anxp=^AG1^BND101^YY^UA&tpid=BUN2-DTX&appid=0&sysid=473&psv=&installationResult=fail&executionTime=0&targetbrowser=CR&browsers=&locale=en_UA&homepageChoice=&defaultSearchChoice=&osDetail=5.1.1.sp3.x86&osArchitecture=32&ieVersionInstalled=6.0.2900.5512&ffVersionInstalled=&crVersionInstalled=&apn_dbr=IE&ie_ds=&ie_hpr=1&ff_crm=&ff_hpr=&cr_ds=&cr_hb=&cr_start=&ie_tbon=1&cr_tbon=&ff_tbon=&ie_tboff=0&ff_tboff=&cr_tboff=&ie_tbs=&ff_tbs=&cr_tbs=&OSlanguage=en 74.113.233.187
hxxp://anx.apnanalytics.com/tr.gif?anxa=APNImeshToolbar&anxe=SuccessfulInstall&anxt=7415672225104011&anxv=2.1.0.0&anxp=^AG1^BND101^YY^UA&tpid=BUN2-DTX&appid=0&sysid=473&psv=&installationResult=success&executionTime=0&targetbrowser=IE&browsers=1-IE&locale=en_UA&homepageChoice=&defaultSearchChoice=&osDetail=5.1.1.sp3.x86&osArchitecture=32&ieVersionInstalled=6.0.2900.5512&ffVersionInstalled=&crVersionInstalled=&apn_dbr=IE&ie_ds=&ie_hpr=1&ff_crm=&ff_hpr=&cr_ds=&cr_hb=&cr_start=&ie_tbon=1&cr_tbon=&ff_tbon=&ie_tboff=0&ff_tboff=&cr_tboff=&ie_tbs=&ff_tbs=&cr_tbs=&OSlanguage=en 74.113.233.187
hxxp://csc3-2010-crl.verisign.com/CSC3-2010.crl 23.9.117.163


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers
ET TROJAN Suspicious User-Agent (NSIS_DOWNLOAD)

Traffic

<font color="red">GET /tr.gif?anxa=APNImeshToolbar&anxe=SuccessfulInstall&anxt=7415672225104011&anxv=2.1.0.0&anxp=^AG1^BND101^YY^UA&tpid=BUN2-DTX&appid=0&sysid=473&psv=&installationResult=success&executionTime=0&targetbrowser=FF&browsers=1-IE,2-FF&locale=en_UA&homepageChoice=&defaultSearchChoice=&osDetail=5.1.1.sp3.x86&osArchitecture=32&ieVersionInstalled=6.0.2900.5512&ffVersionInstalled=&crVersionInstalled=&apn_dbr=IE&ie_ds=&ie_hpr=1&ff_crm=&ff_hpr=&cr_ds=&cr_hb=&cr_start=&ie_tbon=1&cr_tbon=&ff_tbon=&ie_tboff=0&ff_tboff=&cr_tboff=&ie_tbs=&ff_tbs=&cr_tbs=&OSlanguage=en HTTP/1.1<br>
User-Agent: NSIS_Inetc (Mozilla)<br>
Host: anx.apnanalytics.com<br>
Connection: Keep-Alive<br>
Cache-Control: no-cache<br>
<br>
</font><br><font color="blue">HTTP/1.1 204 No Content<br>
Server: nginx/1.0.10<br>
Date: Thu, 07 Aug 2014 03:15:46 GMT<br>
Connection: close<br>
Expires: Thu, 01 Jan 1970 00:00:01 GMT<br>
Cache-Control: no-cache<br>
Cache-Control: max-age=0<br><pre></pre></font><br><br
<font color="red">GET /geolocation HTTP/1.1<br>
User-Agent: NSIS_DOWNLOAD<br>
Host: websearch.ask.com<br>
Connection: Keep-Alive<br>
Cache-Control: no-cache<br>
<br>
</font><br><font color="blue">HTTP/1.1 200 OK<br>
Date: Thu, 07 Aug 2014 03:15:37 GMT<br>
Server: Apache<br>
Content-Length: 162<br>
Connection: close<br>
Content-Type: text/xml;charset=UTF-8<br><pre><?xml version="1.0" encoding="UTF-8"?>.<geodata><locati<br>on country="UA" countryName="Ukraine" state="" city="Kharkiv" zipcode=<br>"" ip="193.138.244.231"/>.</geodata>...</pre></font><br><br
<font color="red">GET /CSC3-2010.crl HTTP/1.1<br>
Accept: */*<br>
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512<br>
Host: csc3-2010-crl.verisign.com<br>
Connection: Keep-Alive<br>
Cache-Control: no-cache<br>
Pragma: no-cache<br>
<br>
</font><br><font color="blue">HTTP/1.1 200 OK<br>
Server: Apache<br>
ETag: "64d69e28a6bc86d88d796a1205d7bc59:1407359711"<br>
Last-Modified: Wed, 06 Aug 2014 21:15:11 GMT<br>
Date: Thu, 07 Aug 2014 03:15:42 GMT<br>
Transfer-Encoding:  chunked<br>
Connection: keep-alive<br>
Connection: Transfer-Encoding<br>
Content-Type: application/pkix-crl<br><pre>00004000..0....0...h...0...*.H........0..1.0...U....US1.0...U....VeriS<br>ign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at h<br>ttps://VVV.verisign.com/rpa (c)101.0,..U...%VeriSign Class 3 Code Sign<br>ing 2010 CA..140806210003Z..140820210003Z0...J0!.....S.@.k....6..c..14<br>0730092631Z0!....c..k....D.k.....120708062201Z0!... _...u.t.=.<.&..<br>.130218061114Z0!...&..].....P.k.:...120125130117Z0!...7P.x....8.Q...s.<br>.130227010252Z0!...J.....Q..Y.[.....110404153956Z0!...d...=..q!_...g9.<br>.130729145216Z0!...d....Y.......o...140711083257Z0!...l.....h2<.H..<br>....120329152211Z0!...q.9...`H.*.Y.C...120525202212Z0!...s...TM.......<br>0...121221080842Z0!...t..,.. ...eL.....130314222305Z0!...y..r.HW.v....<br>.w..140423054643Z0!..../u.......A..5...101214165045Z0!.....0.Xc...%...<br>iM..121102230226Z0!.......S.a&.X5t.E]..111206083350Z0!....c.(....B.[M8<br>3...140108164517Z0!....A.Sv.....f,.....110609003155Z0!.....z......!.ID<br>{]..101228182208Z0!....b^......{d.J'...130102154110Z0!.......n........<br>'u..140521222808Z0!......0..........I..130912181631Z0!....6e...~..T...<br>....130131012247Z0!.........bD#*u......130226223939Z0!.......@..'$.).;<br>}\..130121172259Z0!....7.v..........n..120724160733Z0!....P;.Y..d...c.<br>(...120209181451Z0!.....].bb[.....!....140328205453Z0!.....a...L`..IV.<br>....130402103508Z0!......fFW.z.....@T..130117000242Z0!...........].{7.<br>....120730000000Z0!...".......Z.V.,.e..121031192224Z0!...'....[.1.....<br>.g..130318195659Z0!...,GI.jH.|...J.....120518121623Z0!...<%a.=.d...<br>....O..120424164254Z0!...@........... .a..121109212441Z0!...L.&L..</pre><<< skipped >>></font><br><br
<font color="red">GET /pca3-g5.crl HTTP/1.1<br>
Accept: */*<br>
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512<br>
Host: crl.verisign.com<br>
Connection: Keep-Alive<br>
Cache-Control: no-cache<br>
Pragma: no-cache<br>
<br>
</font><br><font color="blue">HTTP/1.1 200 OK<br>
Server: Apache<br>
ETag: "dad74562eea63e24f12699a6f02c517d:1403752510"<br>
Last-Modified: Thu, 26 Jun 2014 03:15:10 GMT<br>
Accept-Ranges: bytes<br>
Content-Length: 533<br>
Date: Thu, 07 Aug 2014 03:15:41 GMT<br>
Connection: keep-alive<br>
Content-Type: application/pkix-crl<br><pre>0...0..0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U<br>....VeriSign Trust Network1:08..U...1(c) 2006 VeriSign, Inc. - For aut<br>horized use only1E0C..U...<VeriSign Class 3 Public Primary Certific<br>ation Authority - G5..140617000000Z..140930235959Z0...*.H.............<br>Z.....{.......iV}.pm@..]...q....MT.....c.......[....?....zZ.....,. P.~<br>........*.'.....,......Y..!..s$..;.v..y<.................gf.? ...9#<br>...........O"5u....q1`.H....3...>.....l9g.X..i7.b.N]..<....@....<br>j.IO..V.oU_v2X....kf.q.......oq.j.e?v..o.l..Y.......!..HTTP/1.1 200 OK<br>..Server: Apache..ETag: "dad74562eea63e24f12699a6f02c517d:1403752510".<br>.Last-Modified: Thu, 26 Jun 2014 03:15:10 GMT..Accept-Ranges: bytes..C<br>ontent-Length: 533..Date: Thu, 07 Aug 2014 03:15:41 GMT..Connection: k<br>eep-alive..Content-Type: application/pkix-crl..0...0..0...*.H........0<br>..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Netw<br>ork1:08..U...1(c) 2006 VeriSign, Inc. - For authorized use only1E0C..U<br>...<VeriSign Class 3 Public Primary Certification Authority - G5..1<br>40617000000Z..140930235959Z0...*.H.............Z.....{.......iV}.pm@..<br>]...q....MT.....c.......[....?....zZ.....,. P.~........*.'.....,......<br>Y..!..s$..;.v..y<.................gf.? ...9#...........O"5u....q1`.<br>H....3...>.....l9g.X..i7.b.N]..<....@....j.IO..V.oU_v2X....kf.q.<br>......oq.j.e?v..o.l..Y.......!....</pre><<< skipped >>></font><br><br
<font color="red">GET /cdn/update/somoto/patches/3/patch_ff.exe HTTP/1.1<br>
Accept: */*<br>
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)<br>
Host: download.cdn.safetynutbe.com<br>
Connection: Keep-Alive<br>
<br>
</font><br><font color="blue">HTTP/1.1 200 OK<br>
Server: Apache<br>
Last-Modified: Sun, 03 Aug 2014 11:04:22 GMT<br>
Accept-Ranges: bytes<br>
Content-Length: 564952<br>
X-Stat-Server: web3<br>
Content-Type: application/octet-stream<br>
Cache-Control: max-age=2592000<br>
Expires: Sat, 06 Sep 2014 03:15:50 GMT<br>
Date: Thu, 07 Aug 2014 03:15:50 GMT<br>
Connection: keep-alive<br><pre>MZ......................@.............................................<br>..!..L.!This program cannot be run in DOS mode....$.......A{.c...0...0<br>...0.b<0...0.b,0...0...0...0...0...0..%0...0.."0...0Rich...0.......<br>.................PE..L...&..Q.................r.......B...9...........<br>.@.................................,.....@............................<br>......................................................................<br>........................................................text....p.....<br>..r.................. ..`.rdata...*.......,...v..............@..@.data<br>....~..........................@....ndata.......@.....................<br>......rsrc...............................@..@.reloc...................<br>...........@..B.......................................................<br>......................................................................<br>......................................................................<br>......................................................................<br>...............................................U....\.}..t .}.F.E.u..H<br>.....=G..H.P.u..u..u.....@..K...SV.5.=G.W.E.P.u.....@..e...E..E.P.u...<br>..@..}..e....D.@........FR..VV..U... M..........M........E...FQ.....NU<br>..M.......M...VT..U........FP..E...............E.P.M...H.@..E..P.E..E.<br>P.u.....@..u....E..9}...n....~X.te.v4..L.@..E...tU.}.j.W.E......E.....<br>..P.@..vXW..T.@..u..5X.@.W..h ....E..E.Pj.h..F.W....@..u.W...u....E.P.<br>u.....@._^3.[.....L$...=G...i. @...T.....tUVW.q.3.;5.=G.sD..i. @...D..<br>S.....t.G.....t...O..t .....u...3....3...F. @..;5.=G.r.[_^...U..QQ</pre><<< skipped >>></font><br><br
<font color="red">GET /tr.gif?anxa=APNImeshToolbar&anxe=SuccessfulInstall&anxt=7415672225104011&anxv=2.1.0.0&anxp=^AG1^BND101^YY^UA&tpid=BUN2-DTX&appid=0&sysid=473&psv=&installationResult=success&executionTime=0&targetbrowser=IE&browsers=1-IE&locale=en_UA&homepageChoice=&defaultSearchChoice=&osDetail=5.1.1.sp3.x86&osArchitecture=32&ieVersionInstalled=6.0.2900.5512&ffVersionInstalled=&crVersionInstalled=&apn_dbr=IE&ie_ds=&ie_hpr=1&ff_crm=&ff_hpr=&cr_ds=&cr_hb=&cr_start=&ie_tbon=1&cr_tbon=&ff_tbon=&ie_tboff=0&ff_tboff=&cr_tboff=&ie_tbs=&ff_tbs=&cr_tbs=&OSlanguage=en HTTP/1.1<br>
User-Agent: NSIS_Inetc (Mozilla)<br>
Host: anx.apnanalytics.com<br>
Connection: Keep-Alive<br>
Cache-Control: no-cache<br>
<br>
</font><br><font color="blue">HTTP/1.1 204 No Content<br>
Server: nginx/1.0.10<br>
Date: Thu, 07 Aug 2014 03:15:44 GMT<br>
Connection: close<br>
Expires: Thu, 01 Jan 1970 00:00:01 GMT<br>
Cache-Control: no-cache<br>
Cache-Control: max-age=0<br><pre></pre></font><br><br
<font color="red">POST /install_statistics.php HTTP/1.1<br>
Accept: */*<br>
Content-Type: application/x-www-form-urlencoded<br>
User-Agent: Mozilla/4.0 (compatible; MSIE; Win32)<br>
Host: service.safetynutbe.com<br>
Content-Length: 1626<br>
Cache-Control: no-cache<br>
<br>
XML=<secure_request><salt>473</salt><data>4gXg6gQOl3lzDy/i4URJaYxQXybBKPh1MQwKWnj77wppbe1HOPyhHF8GMMS6AE0QXAZ34dwtcLTFncC3ckE45Xbr0hhA41f7smIeORMx5rJJOR pv3HG97Cnr7/F i8bpEgwA/3LrwT2u5dvNqwBGjHvVvz jp9VVEQkzOIEBQb6A5LWYiVeingMe9FhPjisIWsKUVxQqaMXf22EdMVQWT0RsisTtsGRpHHD/XT3UYqESHe/ld6IWDU/5jK2ZrVjqv6fA8pkoOusJWs4AjzmKEUgQpDVMt4a2 TlP9l/XpEe56qy4bfQEgDG9DW0e9oOrWYHzhilfwLT21qHypml772qb1mRUZu66R3eXHcEntl0a4sU5IOFJYQCmbOY2leEHnOO8cv99KsyOPat/txH8z599fGgrXzAIWKKQSrtsbNhAVAk0Cwd//5XFcBAeNupgYgsfI1Wd8KkZER/m5I5vkcBnGEKPHtf7rKASYsn4aqep 3fhxAQU DPSrK25sgJkf2Ajgr7YTe3ortg950RS6Hy3mrRdOjlxXMguQFEzyG MXTj4nXlUT3oHcFhhpEZJGM /lg0G7FZeRXyA1eL1jBtis3eLUp6iMSfBe2f JYfVu6KfZOiM7POkRnHQF47LeAoj5FdMUhsUoX8TZaEagC37 oDvdAbBmVOarVF9FGRCbVLZOGhMrQsi4/L5thKb0Hp6tAX2uhUHYOSHGmN06Vti9TdTlSK3IcKgbFedY2qh4G/ai7TUYq1djSYEMSKjJhWPku/11ox2lM3zzhn6QkmxS/07cmVXx67d7V yi7yInaCfDhLKKAl8v8Isi KY/xnUqr7K0fqsHzn7DUT1BBLj7VOQ3z2XSlIzq/7HSK1xvnZtBEpzCZRuEbHmEP fDO2FfQJeHPPHljlpifzFq6pqfP8HP9d1bz VQrzy1bJRD5f9KYanZ81LbCRsU3YDf3AVJCzRhRKyh 9S 6XrM9OZ536G/ZV5NF3gsK3j/TXvdaRfyFYhlcXjjiUB1rWGsu2EsQAzRzEgJAKhkOdkKo LE2hCipSIGIQOJUSdPWRGGFGaL1DEWpM599VGk8viXcFskszK/FomJmu2q4nQYtfxduyfSjyjfIVjX9CMlJFD2gMghlkqJ9lBmvrlXlTnUjlIHb8itfSjc bEw63/uX8CsTtKNBbWXwBYV4K1p7eC5/KlND179wJA3oT0/s0wYONYr4b4fh9nMeDnR8SWf</font><br><font color="blue">HTTP/1.1 200 OK<br>
Content-Type: text/xml<br>
Date: Thu, 07 Aug 2014 03:15:53 GMT<br>
Server: nginx<br>
X-Server: web6<br>
Content-Length: 498<br>
Connection: keep-alive<br><pre><?xml version="1.0" encoding="utf-8"?>..<secure_reply>..  <br><data>4gXg6gQOl3lzDy/i4URJaUxrNbxdn4dVvWpNIIQpGOg2vNNAFBlDG1B08p<br>wXzlt5qRA2qS/WNEuRIU1DCy7nEOsGlw02uzE5qsXoq5uIZnHD5kahgZZZF0lO8izoFM0L<br>wX0/Ph1FjABb56ky8k4gPXAS34Crpj8hX0NrzU4y7yG8UJdta4X3fjuNvEbnYxsGt3C0q4<br>gy3aK94Sczf1 nLmt/jUUQpJS1xKe32kXOLRkcU0eykUN/D2jgKHbepnJInUz56P pARZp<br>B/2iSKMs8y/zSVVL6LOjs4njCpj4sRLqFpTDBXsZNTDdaRmL7I8H6DpYVljbADBFR2P97B<br>CIwOg6WFZY2wAwRUdj/ewQiMDoOlhWWNsAMEVHY/3sEIjAvDfxy7HFSVz 8Q7GdCTsAg==<br></data>..</secure_reply>..HTTP/1.1 200 OK..Content-Type: t<br>ext/xml..Date: Thu, 07 Aug 2014 03:15:53 GMT..Server: nginx..X-Server:<br> web6..Content-Length: 498..Connection: keep-alive..<?xml version="<br>1.0" encoding="utf-8"?>..<secure_reply>..  <data>4gXg6g<br>QOl3lzDy/i4URJaUxrNbxdn4dVvWpNIIQpGOg2vNNAFBlDG1B08pwXzlt5qRA2qS/WNEuR<br>IU1DCy7nEOsGlw02uzE5qsXoq5uIZnHD5kahgZZZF0lO8izoFM0LwX0/Ph1FjABb56ky8k<br>4gPXAS34Crpj8hX0NrzU4y7yG8UJdta4X3fjuNvEbnYxsGt3C0q4gy3aK94Sczf1 nLmt/<br>jUUQpJS1xKe32kXOLRkcU0eykUN/D2jgKHbepnJInUz56P pARZpB/2iSKMs8y/zSVVL6L<br>Ojs4njCpj4sRLqFpTDBXsZNTDdaRmL7I8H6DpYVljbADBFR2P97BCIwOg6WFZY2wAwRUdj<br>/ewQiMDoOlhWWNsAMEVHY/3sEIjAvDfxy7HFSVz 8Q7GdCTsAg==</data>..<<br>;/secure_reply>....</pre></font><br><br
<font color="red">POST /login HTTP/1.1<br>
Content-Type: application/x-www-form-urlencoded<br>
Content-Length: 1188<br>
Accept: */*<br>
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)<br>
Host: preved.safetynutbe.com<br>
Connection: Keep-Alive<br>
<br>
XML=473tLTwKI4+/gWoMnOvniSAWY3aEZ9IwGs+lvw0l2YHy3I8OtEaHOsWnDD77HUnpAFwG5SANPA9q8MQlCbU1KBdQFqufSJGbfznrBEXIIMwX77WvoaWYfxXRakylV16E6ixWtdd7u9t65fmVhfA5989H0/ZKd0tj7KB5SxrBiugYENdWEamM892ZeSw+5ct0Ei4RX2lQ4IKIZyM35mc9OaGE/eyMGsHvxCPUwI9HkzthZar8IemIu4TKCuC3lEO4am45ozCfZJ0NijzqZ2ErfrwKmScOrlcmkiGiEOFdqmn03yh75Z3aYWbd8iF/qxst/xeEz9957SRbyVtX/U1L395QT8N8HllphUFkfRA4jxShIKSdc/r1jPWO99tf/8vEcAUtNXgfe6DJEFP14Wpj+yJOtgTkFEofaYi5XR4vQ4rtryblyElbnikQMiPtHGvabzJcQ3FqLS+5kPqNdovuli3GEjsc0s5Q+8bLpqstWEqMg0hCWylEwILhfv6sB3fsEEBlf0bbzoPBVy3Rqz82hHx/laBOw8Lxe+VwPZbl4+9/rSh6/sbQnLjBJYX9lYoZM2cE0sUFDbfUKpGPLHfo2rtqW5ndcw7awwUk3vOHDg4yDVkeOKqB4ny/ACsVcf5o+ig13M/OcNRO2Gpw+KoMxyruho06EGEWYDN1Qrx0x9aoXcVF6JuDKSuKYv8Q4KLnAF/x01+0Su3mUGwhfenCzXhG3BJn1ywys3IRxr288fOh3b1/NwlseoVtuPp8qtQpGmo+N8tgn7WAVWe6VTQ0ShBK1n1za4nxs+znhXYjxkbaR+zHVLescThqELEgWboJamPhZvST6tSwIM/XYeNcBCJE5umheZNGQB0PxOjzU5SwJkr+21Zvp8tV83MoNtBxkiqktsX2FTXA3FXDi4iih16W39gK6FvOSd7CV6old9HJSC2Km93JEblqxGCK8QzTgrrKbquHehHf6wuCTULPlGWBCtM5SsO2IVTB+ALlzWBDlxaxyV+gRNxjq32voE83JI/</font><br><font color="blue">HTTP/1.1 200 OK<br>
Content-Type: text/xml<br>
Date: Thu, 07 Aug 2014 03:15:49 GMT<br>
Server: nginx<br>
X-Server: web3<br>
Content-Length: 3910<br>
Connection: keep-alive<br><pre><?xml version="1.0" encoding="utf-8"?>..<secure_reply>..  <br><data>4gXg6gQOl3lzDy/i4URJaUxrNbxdn4dVvWpNIIQpGOgXYNo6zSJgwSteqj<br>szDWng VAF9v4e1TAlXeHaEImzjLUmzuSfdwgiM4FBr87DwmcT0/JKGrCU2IDmSiHgVgyW<br>mDGjfXrAKcFVvVBb5UUgOqisFFnmySQUk8MYzlwaOxse1FFeYx/QX319zbA2ZYmgu15QNF<br>kn7FCBOBNrXtYCLr W5cHWkw lOwsCzKFHHrQD5Uc6SW362LGkBCPd5ZPUHaCfQRqtc7i/<br>a/MZs9Nja31MltqBQljB91OHXpdOG2sy0bDo2rrlbbpIDH8HBPGAP1odVY VFHj9k7aupK<br>ZGVhi wxudQ1EzMBd6jYhSCRmsB48VVtI4sqUE5vGs/PZimRPqFmjqzL2DO5oFg5QBIJrr<br>21sSWe5EaTWFRCQAUexAHm5ei6SK/12ADZ8V1fyFlDkCnnhjL4srbHVytgDk7PdTfXIzf2<br>ohZTdMO/DeK549SO3bXY8nsu3toKaIciBvaL vWvb6W5N0L9IjQjMQf44JdlyRDeo8916t<br>Yr9h2PIjl/WZ3tOgHZcmJM BuxQKfCN4lKkuQe8irzksZsM/wTysR7HflEllQZfdWjhQr/<br>gEs7Udsc61pHMcLKvh0QM0/rdqbeMLws7MXI3jN3LHVTn8/WbCGtQaYmZT/Njoz4IDgizl<br>84c6uKpSRPSIjoCtBFN2y/ThswfGZ8jyFnHdlmd6ZrBGfhHPrXrFit2kI8nZN5q2uKzmVG<br>1d469M5 MG9VwAal7WrknLHA3JcViZQMZf85lzaREzqulpg77wlX7IcsmjOlvOnsP3Zkqu<br>nh7jxwfcvouw5XgtBTYyHrLQuMNwlsWj20naR696H wTWzReO39Xoc9f5J2Kmbh4Eqj oN<br>UE7ivnq3hASANZE/rXc4BcqU2m5Szd/vzVrqHuXGS6mGuqACNtRy5LN0FKLMf43H3qMRqa<br>ePzKakPwO7ChzL4HyJupdN3UCEEQdtwZfzCMQU/5obhAyfILXnkYSKOgraWmX6jsk0Zy33<br>AAPguLBwb/363p/ivSQcITWCrO 3gOK8NuZdLO0/3t3d6fyBM9JO9TE/Xq00h87lo9Ymkw<br>EQ0PtOUEWPrU6sLe/pFvJYriPTYC2dTyXloAaMuqgwOVpF18wW5WJZQv6v4/WPrJPoQJxh<br>ue5bqXWfuArD6mgctxKUiBplcNRJ6c5 gIpD6RiXnYg5lHHra3ZgigI8l u2XKK0e9Qk5n<br>VnLtA/YRNXDJAJBX6mzoTvT28b0Jtr6H2b4GtThlcdsJw6ejdqOYzIl52IOZRx62t2YIoC<br>PJfrtlyitHvUJOZ1Zy7QP2ETVwWIPljpbps9oEyVGny1fCb3G6b8prOL/r58H999LbAO6e<br>TYlsDJyEm11wLLNyGORCRi aUWQjlt0PcD1Ffr8B2mcCV2 qqXVUV66nLDrPxjn52C</pre><<< skipped >>></font><br><br
<font color="red">GET /tr.gif?anxa=APNImeshToolbar&anxe=SuccessfulInstall&anxt=7415672225104011&anxv=2.1.0.0&anxp=^AG1^BND101^YY^UA&tpid=BUN2-DTX&appid=0&sysid=473&psv=&installationResult=fail&executionTime=0&targetbrowser=CR&browsers=&locale=en_UA&homepageChoice=&defaultSearchChoice=&osDetail=5.1.1.sp3.x86&osArchitecture=32&ieVersionInstalled=6.0.2900.5512&ffVersionInstalled=&crVersionInstalled=&apn_dbr=IE&ie_ds=&ie_hpr=1&ff_crm=&ff_hpr=&cr_ds=&cr_hb=&cr_start=&ie_tbon=1&cr_tbon=&ff_tbon=&ie_tboff=0&ff_tboff=&cr_tboff=&ie_tbs=&ff_tbs=&cr_tbs=&OSlanguage=en HTTP/1.1<br>
User-Agent: NSIS_Inetc (Mozilla)<br>
Host: anx.apnanalytics.com<br>
Connection: Keep-Alive<br>
Cache-Control: no-cache<br>
<br>
</font><br><font color="blue">HTTP/1.1 204 No Content<br>
Server: nginx/1.0.10<br>
Date: Thu, 07 Aug 2014 03:15:47 GMT<br>
Connection: close<br>
Expires: Thu, 01 Jan 1970 00:00:01 GMT<br>
Cache-Control: no-cache<br>
Cache-Control: max-age=0<br><pre></pre></font><br><br

The Backdoor connects to the servers at the folowing location(s):

SafetyNutManager.exe_908:

.text
`.rdata
@.data
.rsrc
@.reloc
.hP=m
t.Pj:
3|$83|$0
3|$@3|$4
\$,3\$43
.QZ^&
~$)~()|$
T$DRSSh
xSSSh
FTPjKS
FtPj;S
C.PjRV
.GFy,
8sqliu
u.VWh|/l
 2 34 567
<%u7j
X<%u2j
boost::filesystem::directory_iterator::operator  
kernel32.dll
Visual C   CRT: Not enough memory to complete call to strerror.
Broken pipe
Inappropriate I/O control operation
Operation not permitted
portuguese-brazilian
GetProcessWindowStation
operator
CPPSQLITE_ERROR
SQLITE_DONE
SQLITE_ROW
SQLITE_RANGE
SQLITE_FORMAT
SQLITE_AUTH
SQLITE_NOLFS
SQLITE_MISUSE
SQLITE_MISMATCH
SQLITE_CONSTRAINT
SQLITE_TOOBIG
SQLITE_SCHEMA
SQLITE_EMPTY
SQLITE_PROTOCOL
SQLITE_CANTOPEN
SQLITE_FULL
SQLITE_NOTFOUND
SQLITE_CORRUPT
SQLITE_IOERR
SQLITE_INTERRUPT
SQLITE_READONLY
SQLITE_NOMEM
SQLITE_LOCKED
SQLITE_BUSY
SQLITE_ABORT
SQLITE_PERM
SQLITE_INTERNAL
SQLITE_ERROR
SQLITE_OK
%s[%d]: %s
select count(*) from sqlite_master where type='table' and name='%s'
large file support is disabled
SQL logic error or missing database
foreign_keys
sqlite_compileoption_get
sqlite_compileoption_used
sqlite_source_id
sqlite_version
sqlite_attach
sqlite_detach
sqlite_stat1
sqlite_rename_parent
sqlite_rename_trigger
sqlite_rename_table
RowKey
3.7.3
SQLite format 3
CREATE TABLE sqlite_master(
sql text
CREATE TEMP TABLE sqlite_temp_master(
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
922337203685477580
SQLITE_
?API call with %s database connection pointer
%s\etilqs_
OsError 0x%x (%u)
2nd reference to page %d
invalid page number %d
%s(%d)
keyinfo(%d
%r %s BY term out of range - should be between 1 and %d
Expression tree is too large (maximum depth %d)
too many SQL variables
variable number must be between ?1 and ?%d
too many columns in %s
%s OR name=%Q
type='trigger' AND (%s)
SELECT tbl, idx, stat FROM %Q.sqlite_stat1
access to %s.%s.%s is prohibited
access to %s.%s is prohibited
object name reserved for internal use: %s
sqlite_
duplicate column name: %s
too many columns on %s
unknown column "%s" in foreign key definition
number of columns in foreign key does not match the number of columns in the referenced table
foreign key on %s should reference only one column of table %T
a JOIN clause is required before %s
cannot modify %s because it is a view
table %s may not be modified
foreign key mismatch
error during initialization: %s
no entry point [%s] in shared library [%s]
unable to open shared library [%s]
sqlite3_extension_init
unknown or unsupported join type: %T %T%s%T
RIGHT and FULL OUTER JOINs are not currently supported
%s:%d
no such index: %s
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
sqlite_master
sqlite_temp_master
vtable constructor did not declare schema: %s
vtable constructor failed: %s
no such module: %s
table %s: xBestIndex returned an invalid plan
database corruption at line %d of [%.10s]
misuse at line %d of [%.10s]
cannot open file at line %d of [%.10s]
failed to allocate %u bytes of memory
failed memory resize %u to %u bytes
Recovered %d frames from WAL file %s
foreign key constraint failed
DELETE FROM %Q.%s WHERE tbl=%Q
CREATE TABLE %Q.%s(%s)
%s %T cannot reference objects in database %s
default value of column [%s] is not constant
UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d
%s - %s
malformed database schema (%s)
cannot join using column %s - column not present in both tables
cannot have both ON and USING clauses in the same join
a NATURAL join may not have an ON or USING clause
%s: %s
%s: %s.%s
%s: %s.%s.%s
misuse of aliased aggregate %s
not authorized to use function: %s
too many terms in %s BY clause
invalid name: "%s"
Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)
Failed to read ptrmap key=%d
failed to get page %d
%d of %d pages missing from overflow list starting at %d
freelist leaf count too big on page %d
Fragmentation of %d bytes reported as %d on page %d
Multiple uses for byte %d of page %d
Corruption detected in cell %d on page %d
On page %d at right child:
On tree page %d cell %d:
unable to get the page. error code=%d
btreeInitPage() returns error code %d
Page %d:
Outstanding page count goes from %d to %d during this analysis
Pointer map page %d is referenced
Page %d is never used
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
%s-mjX
unable to use function %s in the requested context
zeroblob(%d)
database %s is locked
cannot detach database %s
no such database: %s
no such collation sequence: %s
%s.%s
unknown database %s
bind on a busy prepared statement: [%s]
%.*s"%w"%s
%s%.*s"%w"
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
Cannot add a PRIMARY KEY column
automatic extension loading failed: %s
B}Tunable to close due to unfinished backup operation
d-d-d d:d:d
d:d:d
d-d-d
database schema is locked: %s
SELECTs to the left and right of %s do not have the same number of result columns
LIMIT clause should come after %s not before
ORDER BY clause should come after %s not before
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
PRAGMA vacuum_db.synchronous=OFF
cannot VACUUM - SQL statements in progress
BmTunknown database: %s
misuse of aggregate: %s()
indexed columns are not unique
PRIMARY KEY must be unique
%s.%s may not be NULL
no such vfs: %s
%s-shm
constraint failed at %d in [%s]
abort at %d in [%s]: %s
database table is locked: %s
cannot change %s wal mode from within a transaction
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
cannot commit transaction - SQL statements in progress
cannot rollback transaction - SQL statements in progress
cannot %s savepoint - SQL statements in progress
no such savepoint: %s
cannot open savepoint - SQL statements in progress
statement aborts at %d: [%s] %s
sqlite3_get_table() called with two or more incompatible queries
%s ORDER BY
%s VIRTUAL TABLE INDEX %d:%s
%s USING PRIMARY KEY
%s VIA MULTI-INDEX UNION
%s WITH INDEX %s
cannot use index: %s
%s WITH AUTOMATIC INDEX
%s AS %s
TABLE %s
at most %d tables in a join
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
unsupported file format
no such trigger: %S
unable to open database: %s
database %s is already in use
too many attached databases - max %d
sqlite_sequence
there is already an index named %s
DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q
DELETE FROM %Q.%s WHERE name=%Q AND type='index'
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
no such index: %S
unable to identify the object to be reindexed
no such table: %s
sqlite_subquery_%p_
cannot create INSTEAD OF trigger on table: %S
cannot create %s trigger on view: %S
cannot open value of type %s
cannot open %s column for writing
no such column: "%s"
cannot open view: %s
cannot open virtual table: %s
indexed
foreign key
sqlite_altertab_%s
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
CREATE%s INDEX %.*s
table %s has no column named %s
sqlite_autoindex_%s_%d
index %s already exists
there is already a table named %s
virtual tables may not be indexed
views may not be indexed
table %s may not be indexed
AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY
table "%s" has more than one primary key
CREATE TABLE %Q.sqlite_sequence(name,seq)
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
CREATE %s %.*s
view %s is circularly defined
table %S has no column named %s
%d values for %d columns
table %S has %d columns but %d values were supplied
*** in database %s ***
unsupported encoding: %s
foreign_key_list
no such column: %s
there is already another table or index with this name: %s
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
view %s may not be altered
table %s may not be altered
-- TRIGGER %s
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
DELETE FROM %s.sqlite_sequence WHERE name=%Q
use DROP VIEW to delete view %s
use DROP TABLE to delete table %s
table %s may not be dropped
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers
E:\Work\SearchSuite\G13_Release\CGL\Libs\boost/exception/detail/exception_ptr.hpp
class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > __cdecl Tools::SystemTools::ReadStringFromRegistry(struct HKEY__ *,const class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > &,const class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > &)
E:\Work\SearchSuite\G13_Release\CGL\Tools\SystemTools.cpp
void __cdecl Tools::SystemTools::WriteStringToRegistry(struct HKEY__ *,const class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > &,const class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > &,const class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > &)
void __cdecl Tools::SystemTools::RemoveRegistryValue(struct HKEY__ *,const class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > &,const class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > &)
unsigned long __cdecl Tools::SystemTools::GetMyExeName(class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > &)
E:\Work\SearchSuite\G13_Release\CGL\Tools\StringTools.cpp
E:\Work\SearchSuite\G13_Release\CGL\Tools\FileTools.cpp
keywords
SELECT value FROM meta WHERE key = 'version'
SELECT %s FROM keywords_backup ORDER BY id ASC
Not supported chrome db
CREATE TABLE %s AS SELECT %sFROM keywords ORDER BY id ASC
UPDATE meta SET value = ?WHERE key = 'Default Search Provider ID Backup Signature'
UPDATE meta SET value = %s WHERE key = 'Default Search Provider ID Backup'
UPDATE meta SET value = %s WHERE key = 'Default Search Provider ID'
E:\Work\SearchSuite\G13_Release\SearchSuite\Client\Kipod\KipodTools\KipodTools.cpp
void __cdecl KipodTools::UpdateChromeBackupKeywordsTable(const class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > &)
DROP TABLE %s
select %s from %s where key = '%s';
select * from %s where %s = '%s';
update %s set %s = %d where key = '%s';
DELETE FROM keywords WHERE short_name = '%s';
INSERT INTO keywords (short_name, keyword, url, favicon_url, input_encodings, show_in_default_list, safe_for_autoreplace) VALUES ('%s', '%s', '%s', '', 'UTF-8', 1, 1);
SELECT active, userDisabled, appDisabled, softDisabled FROM addon WHERE id='%s'
UPDATE addon SET userDisabled='%s', appDisabled='%s', softDisabled='%s', active='%i' WHERE id='%s'
id || short_name || keyword || favicon_url || url || safe_for_autoreplace || originating_url || date_created || usage_count || input_encodings || show_in_default_list || suggest_url || prepopulate_id || autogenerate_keyword || logo_id || created_by_policy || instant_url || last_modified || sync_guid
id || short_name || keyword || favicon_url || url || safe_for_autoreplace || originating_url || date_created || usage_count || input_encodings || show_in_default_list || suggest_url || prepopulate_id || created_by_policy || instant_url || last_modified || sync_guid
id, short_name, keyword, favicon_url, url, safe_for_autoreplace, originating_url, date_created, usage_count, input_encodings, show_in_default_list, suggest_url, prepopulate_id, autogenerate_keyword, logo_id, created_by_policy, instant_url, last_modified, sync_guid
id, short_name, keyword, favicon_url, url, safe_for_autoreplace, originating_url, date_created, usage_count, input_encodings, show_in_default_list, suggest_url, prepopulate_id, created_by_policy, instant_url, last_modified, sync_guid
keywords_backup
E:\Work\SearchSuite\G13_Release\CGL\libs\boost/exception/detail/exception_ptr.hpp
e:\work\searchsuite\g13_release\searchsuite\client\kipodlogger\kipodlogger\SharedLogBuffer.hpp
{DB859B9F-5A74-439e-B1FA-1356ECBCF59A}
void __thiscall PTL::Interprocess<struct KipodLogger::InterprocessName,class boost::interprocess::windows_shared_memory,class PTL::EmptyErrorPolicy,struct KipodLogger::LowIntegrityLevelAccessPolicy>::Event<class KipodLogger::NewLogEvent,0>::Notify(const class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > &,bool)
E:\Work\SearchSuite\G13_Release\CGL\PTL/Observer/InterprocessEvent/InterprocessEvent.hpp
%d / %m / %y
%I : %M : %S %p
%m / %d / %y
%b %d %H : %M : %S %Y
unsupported version
asio.misc
asio.misc error
Open/Key
Service/Create, Path=%s, Reg=%s
Args=%s
../../../../CGL/Libs\boost/exception/detail/exception_ptr.hpp
IDdqdCtx/Connect, File=%s
Unsupported IDdqd version = 0x%x. Expected = 0x%x
IDdqd/Ctl Code = 0x%x
WStr::FromRsrc, ID=%u
%s*.%s
%s%u.%s
RegKey::%s %s, Access=0x%x
RegKey::%s %s
VMem/Alloc, Size=%u
HomoHeap/Init, Size=%u
HomoHeap/Alloc, Size=%u
Access violation. Address=0xX, access=%s
SEH Exception. Code=0xX, NumParams=%u, Addr=0xX
System error %u (0xX)
%s. Source=
[u/u/u u:u:u.u]
boost::too_few_args: format-string referred to more arguments than were passed
boost::too_many_args: format-string referred to less arguments than were passed
iddqd Protection Status = 0xX, Process=%u, Files=%u, Registry=%u
\Registry\Machine\System\ControlSetu\Services\%s
Cannot create HTTP request instance
Login to
Login request (not encrypted)
Login request (encrypted)
Update/patch exec timed out
Login successful, attempt to send stats to "
Url is empty, it means statistics will not be sent, but will be deleted
Exception in Login thread:
Unknown exception in Login thread
As I cannot login with url:
thread.entry_event
thread.exit_event
key does not exist. Attempt to create it
BrowserDefendert.job
BrowserDefender.job
BitGuard.job
RegOpenKeyTransactedW
E:\Work\SearchSuite\G13_Release\SearchSuite\Client\Kipod\Coordinator\src\updateService\Statistic\CollectedItems.cpp
select url from keywords where short_name like '%s'
SQLite Error
E:\Work\SearchSuite\G13_Release\SearchSuite\Client\Common\BrowserManagement\src\fire_fox.cpp
class std::vector<class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >,class std::allocator<class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > > > __cdecl `anonymous-namespace'::GetUrlList(const class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > &)
delete from engine_data where engineid = '%s';
update engine_data set value = '%s' where name = 'order' and value = '%s';
insert into engine_data (engineid, name, value) VALUES ('%s', 'order', '1');
DELETE FROM addon WHERE id='%s'
INSERT INTO addon (id, location, version, type, visible, active, userDisabled, appDisabled, pendingUninstall, descriptor, softDisabled) VALUES ('%s', 'app-profile', '%s', 'extension', 1, 1, 0, 0, 0, '%s', 0)
INSERT INTO addon (id, location, version, type, visible, active, userDisabled, appDisabled, pendingUninstall, descriptor) VALUES ('%s', 'app-profile', '%s', 'extension', 1, 1, 0, 0, 0, '%s')
unsupported exception
E:\Work\SearchSuite\G13_Release\CGL\libs\boost/property_tree_typed/string_path.hpp
Local\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flag
E:\Work\SearchSuite\G13_Release\CGL\libs\boost/property_tree_typed/json_parser.hpp
E:\Work\SearchSuite\G13_Release\CGL\libs\boost/property_tree_typed/detail/json_parser_read.hpp
E:\Work\SearchSuite\G13_Release\CGL\libs\boost/property_tree_typed/detail/json_parser_write.hpp
E:\Work\SearchSuite\G13_Release\CGL\libs\boost/property_tree_typed/detail/ptree_implementation.hpp
update meta set value = %s where key = 'Default Search Provider ID';
SELECT * FROM keywords WHERE short_name = '%s' AND url = '%s';
E:\Work\SearchSuite\G13_Release\SearchSuite\Client\Common\BrowserManagement\src\chrome.cpp
void __thiscall Chrome::UpdateChromeBackupKeywordsTable(const class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > &)
KeySize
: this object does't support a special last block
NullRNG: NullRNG should only be passed to functions that don't need to generate random bytes
: this object doesn't support multiple channels
is not a valid key length
%Y-%m-%d %H:%M:%S
UrlEscape failed
UrlEscape succeeded
CMD_LIST_SETTINGS called
CMD_LIST_FOLDERS called
CreateThread failed, GLE=%d.
%s/[d-d-d d_d_d]%s
Crash detected > attempt to %s address %x
Last Error: %d. %s
: this object doesn't support resynchronization
StreamTransformation: this object doesn't support random access
Boost.Variant internal error: 'which' out of range.
E:\Work\SearchSuite\G13_Release\SearchSuite\Client\Kipod\Bin\Release\Coordinator.pdb
OLEAUT32.dll
RegCloseKey
ADVAPI32.dll
SHLWAPI.dll
WS2_32.dll
USER32.dll
GetProcessHeap
CreateIoCompletionPort
KERNEL32.dll
SHELL32.dll
ole32.dll
RegOpenKeyExW
RegCreateKeyExW
ReportEventW
RPCRT4.dll
SensApi.dll
WININET.dll
VERSION.dll
WTSAPI32.dll
GetCPInfo
ConnectNamedPipe
CreateNamedPipeW
DisconnectNamedPipe
WaitNamedPipeW
dbghelp.dll
PSAPI.DLL
ShellExecuteExW
SHFileOperationW
RegDeleteKeyW
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyW
UrlEscapeW
USERENV.dll
PeekNamedPipe
Coordinator.exe
??0?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@QAE@XZ
??_B?1??get_instance@?$singleton@V?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@23@XZ@51
??_B?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ@51
??_B?1??get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@3@XZ@51
?get_const_instance@?$singleton@V?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@23@XZ
?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@3@XZ
?get_instance@?$singleton@V?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@23@XZ
?get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?instance@?$singleton@V?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@@serialization@boost@@0AAV?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@23@A
?instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@0AAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@A
?instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@@serialization@boost@@0AAV?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@3@A
?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@@detail@34@A
?t@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ@4V?$singleton_wrapper@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@detail@34@A
?t@?1??get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@@634@A
.?AVwindows_file_codecvt@@
zcÁ
.?AVCppSQLite3Query@@
.?AVCppSQLite3Table@@
.?AVCppSQLite3Statement@@
.?AVCppSQLite3DB@@
.?AV?$clone_impl@VFailedToOpenRegistryKeyException@SystemTools@Tools@@@exception_detail@boost@@
.?AVFailedToOpenRegistryKeyException@SystemTools@Tools@@
.?AV?$sp_counted_impl_p@VHolder@?$HoldPolicy@V?$HandlePolicy@PAUHKEY__@@$0A@P6GJPAU1@@Z$1?RegCloseKey@@YGJ0@ZVRegCloseKeyChecker@Tools@@VOpenRegPolicy@4@@HTL@PTL@@Vshared_ptr@boost@@@Fast@Detail@HTL@PTL@@@detail@boost@@
.PAUErrorTag@SystemTools@Tools@@
.PAUPathTag@ErrorInfo@FileTools@Tools@@
.PAUErrorCodeTag@ErrorInfo@StringTools@Tools@@
.PAUErrorCodeDescription@ErrorInfo@StringTools@Tools@@
.PAUOSErrorCodeTag@ErrorInfo@FileTools@Tools@@
.PAUDestinationDirectoryTag@ErrorInfo@FileTools@Tools@@
.PAUDestinationFileNameTag@ErrorInfo@FileTools@Tools@@
.PAUIllegalFileNameCharTag@ErrorInfo@FileTools@Tools@@
.PAUFileNamePrefixTag@ErrorInfo@FileTools@Tools@@
.PAUFileNameRootTag@ErrorInfo@FileTools@Tools@@
.PAUFileNameSuffixTag@ErrorInfo@FileTools@Tools@@
.PAUFileNameExtTag@ErrorInfo@FileTools@Tools@@
.?AV?$singleton_wrapper@V?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@@detail@serialization@boost@@
.?AV?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@
.?AV?$singleton_wrapper@V?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@@detail@serialization@boost@@
.?AV?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@
.?AV?$singleton@V?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@@serialization@boost@@
.?AV?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@
.?AVException@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@
.PAUMessageTag@ErrorInfo@KipodLogger@@
.PAUWhatTag@PTL@@
.?AV?$clone_impl@VException@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@exception_detail@boost@@
.?AV?$sp_counted_impl_p@Vwindows_shared_memory@interprocess@boost@@@detail@boost@@
.?AUwincert_x64_token@detail@protection@kipod@@
.?AUwincert_x86_token@detail@protection@kipod@@
.?AUapcrtldr_x86_token@detail@protection@kipod@@
.?AUapcrtldr_x64_token@detail@protection@kipod@@
.?AVOperaStatistic@KipodStatistic@@
.?AVChromeStatistic@KipodStatistic@@
.?AV?$_Ref_count_obj@VOperaStatistic@KipodStatistic@@@tr1@std@@
.?AV?$_Ref_count_obj@VChromeStatistic@KipodStatistic@@@tr1@std@@
.?AVCppSQLite3Exception@@
.?AV?$sp_counted_impl_pd@PAUdelete_data@?$thread_specific_ptr@V?$weak_ptr@U?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@@boost@@@boost@@U?$do_heap_delete@Udelete_data@?$thread_specific_ptr@V?$weak_ptr@U?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@@boost@@@boost@@@detail@3@@detail@boost@@
.?AV?$sp_counted_impl_p@U?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@@detail@boost@@
.?AU?$concrete_parser@U?$alternative@V?$action@V?$chset@_W@classic@spirit@boost@@Ua_escape@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$chlit@D@classic@spirit@boost@@V?$action@U?$uint_parser@K$0BA@$03$03@classic@spirit@boost@@Ua_unicode@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$alternative@V?$action@U?$difference@U?$difference@Uanychar_parser@classic@spirit@boost@@V?$strlit@PBD@234@@classic@spirit@boost@@V?$strlit@PBD@234@@classic@spirit@boost@@Ua_char@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$chlit@D@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$positive@U?$contiguous@U?$confix_parser@U?$chlit@D@classic@spirit@boost@@U?$kleene_star@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@U1234@Uunary_parser_category@234@Unon_nested@234@Unon_lexeme@234@@classic@spirit@boost@@@classic@spirit@boost@@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@U?$sequence@U?$sequence@U?$optional@U?$chlit@D@classic@spirit@boost@@@classic@spirit@boost@@U?$alternative@U?$chlit@D@classic@spirit@boost@@U?$sequence@U?$range@_W@classic@spirit@boost@@U?$kleene_star@Udigit_parser@classic@spirit@boost@@@234@@234@@234@@classic@spirit@boost@@U?$optional@U?$sequence@U?$chlit@D@classic@spirit@boost@@U?$positive@Udigit_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$optional@U?$sequence@U?$sequence@V?$chset@_W@classic@spirit@boost@@U?$optional@V?$chset@_W@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$positive@Udigit_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@U?$sequence@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$action@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@Ua_name@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$chlit@D@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_s@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$alternative@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_e@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$list_parser@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@U?$chlit@D@234@Uno_list_endtoken@234@Uplain_parser_category@234@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_e@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@@234@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$alternative@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@V1234@@classic@spirit@boost@@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@Uend_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$abstract_parser@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$abstract_parser@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@@impl@classic@spirit@boost@@
.?AUdelete_data@?$thread_specific_ptr@V?$weak_ptr@U?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@@boost@@@boost@@
.?AU?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@
.?AVFireFox@@
.?AVJsonParserExecption@Json@KipodTools@@
.?AU?$do_heap_delete@Udelete_data@?$thread_specific_ptr@V?$weak_ptr@U?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@@boost@@@boost@@@detail@boost@@
.?AVOpera@@
.?AVChrome@@
.?AUNoChannelSupport@BufferedTransformation@CryptoPP@@
.?AVInvalidKeyLength@CryptoPP@@
.PAVBufferedTransformation@CryptoPP@@
.PAVRandomNumberGenerator@CryptoPP@@
.?AVsettings_pipe_failed@@
.PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AV?$VariableKeyLength@$0BA@$0BA@$0CA@$07$03$0A@@CryptoPP@@
.?AVSimpleKeyingInterface@CryptoPP@@
.?AV?$SimpleKeyingInterfaceImpl@V?$TwoBases@VBlockCipher@CryptoPP@@URijndael_Info@2@@CryptoPP@@V12@@CryptoPP@@
.?AV?$AlgorithmImpl@V?$SimpleKeyingInterfaceImpl@V?$TwoBases@VBlockCipher@CryptoPP@@URijndael_Info@2@@CryptoPP@@V12@@CryptoPP@@V12@@CryptoPP@@
<!-- Windows 8.1 -->
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
<!-- Windows Vista -->
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<!-- Windows 7 -->
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
<!-- Windows 8 -->
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
</assembly>P<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"></supportedOS>
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS>
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS>
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"></supportedOS>
4(5.585_5
4%4x5
5&505:5~5
24383<3@3
6-6}6
7Œ8M8\8
!0(0/060;0
3(4,4044484 5
5#5*51585
99
7x7U7h7
0%0X0
3 3$3(3,3
9 9$9(9,909
6}7H7L7P7T7X7\7
;6;;;#=2=@=
3#3'3-313L3Z3}7
4I4s4
4(4@4_4|4
0 2?3x3
6&7573888
99J9P9V9i9
>#?2???[?
2 2$2(2,2
1%1U1g1
5#5'5 5/5
7}7
7!7%7)767,9
>0>4>8><>
2034383
4#5,555}5
9(:,:0:4:
5&656^7}7
41484?4{4
4O5U5
7"8'8&:3:
4-585`5}5
3 3$3(3,3034383~3
; ;$;(;,;0;4;8;<;|;
0 0(01080
5%6U6
: :$:(:,:0:4:8:<:
2 2$2(2,20242
3 3$3(3,303
6 6$6(6,606
8 8$80=4=
5 5$5(5,505
6 6$6(6,6064686
7(747<7\7
pKERNEL32.DLL
mscoree.dll
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
ADVAPI32.DLL
WUSER32.DLL
777705555443332
5555443332
5555443332
Software\Microsoft\Windows\CurrentVersion\Run
duser32.dll
%s\%s%X%X
\cmd.exe
Web Server Edition
%1%.%2%.%3%
\/:*?"<>|
_<>:"/\|?*
\\?\UNC\
FirefoxExtension
ChromeDS
FirefoxHomepage
FirefoxSE
FirefoxDE
FirefoxKeyword
ChromeStartPages
ChromeStartPages32
ChromeHomepage
ChromePrefs
ChromeNewTab
Firefox/ProtectionEnabled
Chrome/ProtectionEnabled
ff_nt_supported
ie_ds_supported
ff_ds_supported
chrome_ds_supported
ie_hp_supported
ff_hp_supported
chrome_hp_supported
chrome_nt_supported
hXXp://VVV.search.ask.com/?o=APN10640A&gct=hp&d=#sysid#-#appid#&v=#ptype##kbn#-#uc#&t=4
{52db1893-8a90-4192-aede-08e00b8f8#sysid#}
Ask.com
hXXp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=#appid#&systemid=#sysid#&v=#ptype##kbn#-#uc#&apn_uid=#uid#&apn_dtid=BND101&o=APN10640&apn_ptnrs=AG1&q=
hXXp://VVV.search.ask.com/suggest.php?src=ieb&gct=ds&appid=#appid#&systemid=#sysid#&v=#ptype##kbn#-#uc#&apn_uid=#uid#&apn_dtid=BND101&o=APN10640&apn_ptnrs=AG1&qu=
hXXp://dts.search.ask.com/sr?l=dis&o=APN10640&qsrc=2870&apn_dtid=BND101&apn_ptnrs=AG1&apn_uid=#uid#&gct=dns&gc=1&appid=#appid#&sysid=#sysid#&sver=3&q=
{DB3CB725-C39D-434E-80D1-DB271BB972C8}
hXXp://dts.search.ask.com/sr?src=ffb&gct=ds&appid=#appid#&systemid=#sysid#&v=#ptype##kbn#-#uc#&apn_dtid=BND101&apn_ptnrs=AG1&apn_uid=#uid#&o=APN10640&q=
Firefox/Extension
hXXp://VVV.search.ask.com?o=APN10640A&gct=hp&d=#sysid#-#appid#&v=#ptype##kbn#-#uc#&t=4&tag=newtab
hXXp://dts.search.ask.com/sr?src=crb&gct=ds&appid=#appid#&systemid=#sysid#&v=#ptype##kbn#-#uc#&apn_uid=#uid#&apn_dtid=BND101&o=APN10640&apn_ptnrs=AG1&q=
hXXp://VVV.search.ask.com/?o=APN10640A&gct=hp&d=#sysid#-#appid#&v=#ptype##kbn#-#uc#&t=4&tag=newtab
\extensions.sqlite
\extensions.sqlite-journal
Chrome/DefaultSearch
DefaultUrl
DefaultKeyword
\Web Data
\Web Data-journal
Firefox/Homepage
Firefox/HomepageAsked
user_pref("browser.startup.homepage", "$(Value)");
user_pref\("browser\.startup\.homepage", "([^"]*)"\);
\prefs.js
Firefox/SelectedSearch
Firefox/SelectedSearchAsked
user_pref("browser.search.selectedEngine", "$(Value)");
user_pref\("browser\.search\.selectedEngine", "([^"]*)"\);
Firefox/DefaultSearch
Firefox/DefaultSearchAsked
user_pref("browser.search.defaultenginename", "$(Value)");
user_pref\("browser\.search\.defaultenginename", "([^"]*)"\);
Firefox/UrlbarSearch
Firefox/UrlbarSearchAsked
user_pref("keyword.URL", "$(Value)");
user_pref\("keyword\.URL", "([^"]*)"\);
FFUrlbar search
DefaultSuggestionUrl
Chrome/Homepage
backup.homepage
Chrome homepage
Chrome/StartPages
backup.session.urls_to_restore_on_startup
Chrome Start Page
session.urls_to_restore_on_startup
Chrome/StartPagesFrom32Version
backup.session.startup_urls
Chrome Start Page Since 32 version
session.startup_urls
Chrome
Chrome/NewTab
404Url
DNSUrl
SearchUrl
NewTabUrl
RelatedSearchUrl
Firefox/BHO
Error404URL
DNSErrorURL
SearchURL
Firefox/BHO/NativeHelper
Firefox/BHO/DnsBHO
Firefox/BHO/SearchBHO
Firefox/BHO/MainBHO
Firefox/BHO/Error404BHO
Firefox/BHO/NewTabBHO
Firefox/BHO/SessionRestore
SOFTWARE\Mozilla\Mozilla Firefox
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe
SOFTWARE\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Chrome.exe
hXXp://
%d.%d.%d.%d
\FirefoxToolbar\
\profiles.ini
\Mozilla\Firefox\
\Google\Chrome\User Data\Default
chrome-extension://%1%/config/skin/new-tab.html
\ChromeExtension
JX
{B358EFE4-A25E-4fd6-A2CA-71081B7CDB47}_%1%
\\.\pipe\SafetyNutPipe
backup.homepage_is_newtabpage
backup.extensions.ids
backup.browser.show_home_button
backup.session.restore_on_startup
lbackup.session.urls_to_restore_on_startup
lchrome.exe
\Google\Chrome\User Data\Default\Preferences
\Google\Chrome\User Data\
\Google\Chrome\User Data\Default\Web Data
search_url
"%1%" : "%2%"
chrome_url_overrides
chrome-extension://%1%/%2%
opera.exe
session.restore_on_startup
\Opera\Opera\operaprefs.ini
\Opera\operaprefs_default.ini
\Opera\Opera\search.ini
\Opera\locale\%1%\search.ini
\Opera\Opera\toolbar\standard_toolbar.ini
Home URL
\Opera\Opera\sessions\autosave.win
Search Panel Toolbar.content
firefox.exe
\Mozilla\Firefox
\search.json
\search.sqlite
\extensions.ini
user_pref("browser.startup.homepage", "
user_pref("browser.startup.page",
user_pref("browser.search.selectedEngine", "
user_pref("browser.search.defaultenginename", "
user_pref("browser.search.order.1", "
user_pref("keyword.URL", "
user_pref("general.useragent.extra.%1%", "
user_pref("%1%.Updater.Enabled", "
xmlns:G="hXXp://a9.com/-/spec/opensearch/1.1/" xmlns:moz="hXXp://VVV.mozilla.org/2006/browser/search/"
Url[@type='text/html']
windows
Software\SafetyNut\Files\ChromeHomepage
Software\SafetyNut\Chrome\DS
Software\Mozilla\Mozilla Firefox
http\shell\open\command
software\Microsoft\Windows\shell\associations\urlassociations\http\userchoice
Software\Opera Software
Opera.exe
Software\Microsoft\Windows\CurrentVersion\Ext\Settings
extensions.ini
\install.rdf
xmlns:G="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:em="hXXp://VVV.mozilla.org/2004/em-rdf#"
firefox
chrome
opera
G:Url[@type='text/html']
coordinator.cfg
lSafetyNut\safetyldr.dll
SafetyNut\x64\safetyldr.dll
SafetyNut\x64\safetycrt.dll
SafetyNut\safetycrt.dll
lcoordinator.cfg
general.cfg
SafetyNutManager.exe
safetynut.exe
Global\F473573F-4750-4AA6-B7B0-4595E7DEA3E2
\\.\Global\F06DEFF2-5B9C-490D-910F-35D3A9119622configmgrc2
configmgrc2.cfg
F06DEFF2-5B9C-490D-910F-35D3A9119622
{5A08D1A5-925A-401D-AFE3-8D61426B0E3E}
Service failed. %s
BInternet Explorer Settings.exe
new_chrome.exe
chrome.exe
ieuser.exe
iexplore.exe
ucsrss.exe
lsass.exe
services.exe
svchost.exe
Windows
Starting SafetyNut Manager Service, version 5.0.0.13452 built Thu Jul 10 16:42:18 2014
stats.cfg
firefox/homepage
firefox/selectedsearch
chrome/homepage
chrome/defaultsearch
<url>%3%</url>
WinHttp.WinHttpRequest.5.1
5.0.0.13452
application/x-www-form-urlencoded
login_request
/login_reply/properties/node()
/login_reply/block_exec/file
/login_reply/auto_update/pack_url/node()
/login_reply/patch_update/patch/node()
target_statistics_url
.XML=
SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls
Wincert\win32cert.dll
Wincert\win64cert.dll
%s failed w/err 0xlx
hAdvapi32.dll
safetynutbe.com
/login
hXXp://preved.%s
{1112c7f9-2d8b-4550-bf47-68ef2e02ff20}
{d48c9ead-f59f-4dea-ac97-7065fea79f42}
{af6ac4f2-9825-4fb6-a600-92bc5361f209}
{23cd218f-af09-443f-bbb1-adb89fd5986d}
{9a95b751-bf3e-4ea8-a938-2d4d84cd4964}
{99079a25-328f-4bd4-be04-00955acaa0a7}
{28387537-e3f9-4ed7-860c-11e69af4a8a0}
{b7b37500-99b4-46ad-8bf3-2480bcedc38c}
{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}
search.fantastigames.com
dts.search-results.com
VVV.gotsearch.com
VVV.insertsearch.com
VVV.mlsearch.com
VVV.searchsupreme.com
VVV.newsearchtab.com
VVV.adoresearch.com
VVV.searchsheet.com
VVV.searchqu.com
VVV.searchnu.com
VVV.searchcore.net
search.lphant.net
search.lphant.com
search.shareazaweb.com
search.shareazaweb.net
search.bearshare.net
search.bearshare.com
search.imesh.com
search.imesh.net
%1%.%2%.%3%.%4%
PathToExe
user_pref("extensions.lastAppVersion", "
user_pref("extensions.lastPlatformVersion", "
user_pref("extensions.extensions.databaseSchema",
%s|%d|%d|%d
backup.pinned_tabs
https
%d.%d
Hlogfile.txt
dwinlogon.exe
Msxml2.DOMDocument.3.0
E:\Work\SearchSuite\G13_Release\SearchSuite\Client\Common\json_parser\JsonPropertyTreeParser.cpp
!valueName.empty()
e:\work\searchsuite\g13_release\searchsuite\client\common\json_parser\JsonPropertyTreeParser.h
E:\Work\SearchSuite\G13_Release\CGL\libs\boost/optional/optional.hpp
!value.empty()
!p.empty() && "Empty path not allowed for put_child."
.E:\Work\SearchSuite\G13_Release\CGL\libs\boost/variant/detail/visitation_impl.hpp
!"Boost.Variant internal error: 'which' out of range."
E:\Work\SearchSuite\G13_Release\CGL\libs\boost/variant/detail/forced_return.hpp
!"#$%&'()* ,
{029ea614-c5b4-4b79-ac5c-d2b17f0fcb01}
{285e37e7-90b6-4318-b84f-941c18ad07e8}
{54a32f25-e2e2-411f-8853-e5f7b32db6a7}
Assertion failed: %s, file %s, line %d
m{029ea614-c5b4-4b79-ac5c-d2b17f0fcb01}
%Program Files%\Movies App\SafetyNut\SafetyNutManager.exe

SafetyNutManager.exe_332:

.text
`.rdata
@.data
.rsrc
@.reloc
.hP=m
t.Pj:
3|$83|$0
3|$@3|$4
\$,3\$43
.QZ^&
~$)~()|$
T$DRSSh
xSSSh
FTPjKS
FtPj;S
C.PjRV
.GFy,
8sqliu
u.VWh|/l
 2 34 567
<%u7j
X<%u2j
boost::filesystem::directory_iterator::operator  
kernel32.dll
Visual C   CRT: Not enough memory to complete call to strerror.
Broken pipe
Inappropriate I/O control operation
Operation not permitted
portuguese-brazilian
GetProcessWindowStation
operator
CPPSQLITE_ERROR
SQLITE_DONE
SQLITE_ROW
SQLITE_RANGE
SQLITE_FORMAT
SQLITE_AUTH
SQLITE_NOLFS
SQLITE_MISUSE
SQLITE_MISMATCH
SQLITE_CONSTRAINT
SQLITE_TOOBIG
SQLITE_SCHEMA
SQLITE_EMPTY
SQLITE_PROTOCOL
SQLITE_CANTOPEN
SQLITE_FULL
SQLITE_NOTFOUND
SQLITE_CORRUPT
SQLITE_IOERR
SQLITE_INTERRUPT
SQLITE_READONLY
SQLITE_NOMEM
SQLITE_LOCKED
SQLITE_BUSY
SQLITE_ABORT
SQLITE_PERM
SQLITE_INTERNAL
SQLITE_ERROR
SQLITE_OK
%s[%d]: %s
select count(*) from sqlite_master where type='table' and name='%s'
large file support is disabled
SQL logic error or missing database
foreign_keys
sqlite_compileoption_get
sqlite_compileoption_used
sqlite_source_id
sqlite_version
sqlite_attach
sqlite_detach
sqlite_stat1
sqlite_rename_parent
sqlite_rename_trigger
sqlite_rename_table
RowKey
3.7.3
SQLite format 3
CREATE TABLE sqlite_master(
sql text
CREATE TEMP TABLE sqlite_temp_master(
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
922337203685477580
SQLITE_
?API call with %s database connection pointer
%s\etilqs_
OsError 0x%x (%u)
2nd reference to page %d
invalid page number %d
%s(%d)
keyinfo(%d
%r %s BY term out of range - should be between 1 and %d
Expression tree is too large (maximum depth %d)
too many SQL variables
variable number must be between ?1 and ?%d
too many columns in %s
%s OR name=%Q
type='trigger' AND (%s)
SELECT tbl, idx, stat FROM %Q.sqlite_stat1
access to %s.%s.%s is prohibited
access to %s.%s is prohibited
object name reserved for internal use: %s
sqlite_
duplicate column name: %s
too many columns on %s
unknown column "%s" in foreign key definition
number of columns in foreign key does not match the number of columns in the referenced table
foreign key on %s should reference only one column of table %T
a JOIN clause is required before %s
cannot modify %s because it is a view
table %s may not be modified
foreign key mismatch
error during initialization: %s
no entry point [%s] in shared library [%s]
unable to open shared library [%s]
sqlite3_extension_init
unknown or unsupported join type: %T %T%s%T
RIGHT and FULL OUTER JOINs are not currently supported
%s:%d
no such index: %s
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
sqlite_master
sqlite_temp_master
vtable constructor did not declare schema: %s
vtable constructor failed: %s
no such module: %s
table %s: xBestIndex returned an invalid plan
database corruption at line %d of [%.10s]
misuse at line %d of [%.10s]
cannot open file at line %d of [%.10s]
failed to allocate %u bytes of memory
failed memory resize %u to %u bytes
Recovered %d frames from WAL file %s
foreign key constraint failed
DELETE FROM %Q.%s WHERE tbl=%Q
CREATE TABLE %Q.%s(%s)
%s %T cannot reference objects in database %s
default value of column [%s] is not constant
UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d
%s - %s
malformed database schema (%s)
cannot join using column %s - column not present in both tables
cannot have both ON and USING clauses in the same join
a NATURAL join may not have an ON or USING clause
%s: %s
%s: %s.%s
%s: %s.%s.%s
misuse of aliased aggregate %s
not authorized to use function: %s
too many terms in %s BY clause
invalid name: "%s"
Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)
Failed to read ptrmap key=%d
failed to get page %d
%d of %d pages missing from overflow list starting at %d
freelist leaf count too big on page %d
Fragmentation of %d bytes reported as %d on page %d
Multiple uses for byte %d of page %d
Corruption detected in cell %d on page %d
On page %d at right child:
On tree page %d cell %d:
unable to get the page. error code=%d
btreeInitPage() returns error code %d
Page %d:
Outstanding page count goes from %d to %d during this analysis
Pointer map page %d is referenced
Page %d is never used
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
%s-mjX
unable to use function %s in the requested context
zeroblob(%d)
database %s is locked
cannot detach database %s
no such database: %s
no such collation sequence: %s
%s.%s
unknown database %s
bind on a busy prepared statement: [%s]
%.*s"%w"%s
%s%.*s"%w"
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
Cannot add a PRIMARY KEY column
automatic extension loading failed: %s
B}Tunable to close due to unfinished backup operation
d-d-d d:d:d
d:d:d
d-d-d
database schema is locked: %s
SELECTs to the left and right of %s do not have the same number of result columns
LIMIT clause should come after %s not before
ORDER BY clause should come after %s not before
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
PRAGMA vacuum_db.synchronous=OFF
cannot VACUUM - SQL statements in progress
BmTunknown database: %s
misuse of aggregate: %s()
indexed columns are not unique
PRIMARY KEY must be unique
%s.%s may not be NULL
no such vfs: %s
%s-shm
constraint failed at %d in [%s]
abort at %d in [%s]: %s
database table is locked: %s
cannot change %s wal mode from within a transaction
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
cannot commit transaction - SQL statements in progress
cannot rollback transaction - SQL statements in progress
cannot %s savepoint - SQL statements in progress
no such savepoint: %s
cannot open savepoint - SQL statements in progress
statement aborts at %d: [%s] %s
sqlite3_get_table() called with two or more incompatible queries
%s ORDER BY
%s VIRTUAL TABLE INDEX %d:%s
%s USING PRIMARY KEY
%s VIA MULTI-INDEX UNION
%s WITH INDEX %s
cannot use index: %s
%s WITH AUTOMATIC INDEX
%s AS %s
TABLE %s
at most %d tables in a join
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
unsupported file format
no such trigger: %S
unable to open database: %s
database %s is already in use
too many attached databases - max %d
sqlite_sequence
there is already an index named %s
DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q
DELETE FROM %Q.%s WHERE name=%Q AND type='index'
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
no such index: %S
unable to identify the object to be reindexed
no such table: %s
sqlite_subquery_%p_
cannot create INSTEAD OF trigger on table: %S
cannot create %s trigger on view: %S
cannot open value of type %s
cannot open %s column for writing
no such column: "%s"
cannot open view: %s
cannot open virtual table: %s
indexed
foreign key
sqlite_altertab_%s
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
CREATE%s INDEX %.*s
table %s has no column named %s
sqlite_autoindex_%s_%d
index %s already exists
there is already a table named %s
virtual tables may not be indexed
views may not be indexed
table %s may not be indexed
AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY
table "%s" has more than one primary key
CREATE TABLE %Q.sqlite_sequence(name,seq)
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
CREATE %s %.*s
view %s is circularly defined
table %S has no column named %s
%d values for %d columns
table %S has %d columns but %d values were supplied
*** in database %s ***
unsupported encoding: %s
foreign_key_list
no such column: %s
there is already another table or index with this name: %s
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
view %s may not be altered
table %s may not be altered
-- TRIGGER %s
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
DELETE FROM %s.sqlite_sequence WHERE name=%Q
use DROP VIEW to delete view %s
use DROP TABLE to delete table %s
table %s may not be dropped
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers
E:\Work\SearchSuite\G13_Release\CGL\Libs\boost/exception/detail/exception_ptr.hpp
class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > __cdecl Tools::SystemTools::ReadStringFromRegistry(struct HKEY__ *,const class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > &,const class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > &)
E:\Work\SearchSuite\G13_Release\CGL\Tools\SystemTools.cpp
void __cdecl Tools::SystemTools::WriteStringToRegistry(struct HKEY__ *,const class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > &,const class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > &,const class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > &)
void __cdecl Tools::SystemTools::RemoveRegistryValue(struct HKEY__ *,const class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > &,const class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > &)
unsigned long __cdecl Tools::SystemTools::GetMyExeName(class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > &)
E:\Work\SearchSuite\G13_Release\CGL\Tools\StringTools.cpp
E:\Work\SearchSuite\G13_Release\CGL\Tools\FileTools.cpp
keywords
SELECT value FROM meta WHERE key = 'version'
SELECT %s FROM keywords_backup ORDER BY id ASC
Not supported chrome db
CREATE TABLE %s AS SELECT %sFROM keywords ORDER BY id ASC
UPDATE meta SET value = ?WHERE key = 'Default Search Provider ID Backup Signature'
UPDATE meta SET value = %s WHERE key = 'Default Search Provider ID Backup'
UPDATE meta SET value = %s WHERE key = 'Default Search Provider ID'
E:\Work\SearchSuite\G13_Release\SearchSuite\Client\Kipod\KipodTools\KipodTools.cpp
void __cdecl KipodTools::UpdateChromeBackupKeywordsTable(const class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > &)
DROP TABLE %s
select %s from %s where key = '%s';
select * from %s where %s = '%s';
update %s set %s = %d where key = '%s';
DELETE FROM keywords WHERE short_name = '%s';
INSERT INTO keywords (short_name, keyword, url, favicon_url, input_encodings, show_in_default_list, safe_for_autoreplace) VALUES ('%s', '%s', '%s', '', 'UTF-8', 1, 1);
SELECT active, userDisabled, appDisabled, softDisabled FROM addon WHERE id='%s'
UPDATE addon SET userDisabled='%s', appDisabled='%s', softDisabled='%s', active='%i' WHERE id='%s'
id || short_name || keyword || favicon_url || url || safe_for_autoreplace || originating_url || date_created || usage_count || input_encodings || show_in_default_list || suggest_url || prepopulate_id || autogenerate_keyword || logo_id || created_by_policy || instant_url || last_modified || sync_guid
id || short_name || keyword || favicon_url || url || safe_for_autoreplace || originating_url || date_created || usage_count || input_encodings || show_in_default_list || suggest_url || prepopulate_id || created_by_policy || instant_url || last_modified || sync_guid
id, short_name, keyword, favicon_url, url, safe_for_autoreplace, originating_url, date_created, usage_count, input_encodings, show_in_default_list, suggest_url, prepopulate_id, autogenerate_keyword, logo_id, created_by_policy, instant_url, last_modified, sync_guid
id, short_name, keyword, favicon_url, url, safe_for_autoreplace, originating_url, date_created, usage_count, input_encodings, show_in_default_list, suggest_url, prepopulate_id, created_by_policy, instant_url, last_modified, sync_guid
keywords_backup
E:\Work\SearchSuite\G13_Release\CGL\libs\boost/exception/detail/exception_ptr.hpp
e:\work\searchsuite\g13_release\searchsuite\client\kipodlogger\kipodlogger\SharedLogBuffer.hpp
{DB859B9F-5A74-439e-B1FA-1356ECBCF59A}
void __thiscall PTL::Interprocess<struct KipodLogger::InterprocessName,class boost::interprocess::windows_shared_memory,class PTL::EmptyErrorPolicy,struct KipodLogger::LowIntegrityLevelAccessPolicy>::Event<class KipodLogger::NewLogEvent,0>::Notify(const class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > &,bool)
E:\Work\SearchSuite\G13_Release\CGL\PTL/Observer/InterprocessEvent/InterprocessEvent.hpp
%d / %m / %y
%I : %M : %S %p
%m / %d / %y
%b %d %H : %M : %S %Y
unsupported version
asio.misc
asio.misc error
Open/Key
Service/Create, Path=%s, Reg=%s
Args=%s
../../../../CGL/Libs\boost/exception/detail/exception_ptr.hpp
IDdqdCtx/Connect, File=%s
Unsupported IDdqd version = 0x%x. Expected = 0x%x
IDdqd/Ctl Code = 0x%x
WStr::FromRsrc, ID=%u
%s*.%s
%s%u.%s
RegKey::%s %s, Access=0x%x
RegKey::%s %s
VMem/Alloc, Size=%u
HomoHeap/Init, Size=%u
HomoHeap/Alloc, Size=%u
Access violation. Address=0xX, access=%s
SEH Exception. Code=0xX, NumParams=%u, Addr=0xX
System error %u (0xX)
%s. Source=
[u/u/u u:u:u.u]
boost::too_few_args: format-string referred to more arguments than were passed
boost::too_many_args: format-string referred to less arguments than were passed
iddqd Protection Status = 0xX, Process=%u, Files=%u, Registry=%u
\Registry\Machine\System\ControlSetu\Services\%s
Cannot create HTTP request instance
Login to
Login request (not encrypted)
Login request (encrypted)
Update/patch exec timed out
Login successful, attempt to send stats to "
Url is empty, it means statistics will not be sent, but will be deleted
Exception in Login thread:
Unknown exception in Login thread
As I cannot login with url:
thread.entry_event
thread.exit_event
key does not exist. Attempt to create it
BrowserDefendert.job
BrowserDefender.job
BitGuard.job
RegOpenKeyTransactedW
E:\Work\SearchSuite\G13_Release\SearchSuite\Client\Kipod\Coordinator\src\updateService\Statistic\CollectedItems.cpp
select url from keywords where short_name like '%s'
SQLite Error
E:\Work\SearchSuite\G13_Release\SearchSuite\Client\Common\BrowserManagement\src\fire_fox.cpp
class std::vector<class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >,class std::allocator<class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > > > __cdecl `anonymous-namespace'::GetUrlList(const class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > &)
delete from engine_data where engineid = '%s';
update engine_data set value = '%s' where name = 'order' and value = '%s';
insert into engine_data (engineid, name, value) VALUES ('%s', 'order', '1');
DELETE FROM addon WHERE id='%s'
INSERT INTO addon (id, location, version, type, visible, active, userDisabled, appDisabled, pendingUninstall, descriptor, softDisabled) VALUES ('%s', 'app-profile', '%s', 'extension', 1, 1, 0, 0, 0, '%s', 0)
INSERT INTO addon (id, location, version, type, visible, active, userDisabled, appDisabled, pendingUninstall, descriptor) VALUES ('%s', 'app-profile', '%s', 'extension', 1, 1, 0, 0, 0, '%s')
unsupported exception
E:\Work\SearchSuite\G13_Release\CGL\libs\boost/property_tree_typed/string_path.hpp
Local\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flag
E:\Work\SearchSuite\G13_Release\CGL\libs\boost/property_tree_typed/json_parser.hpp
E:\Work\SearchSuite\G13_Release\CGL\libs\boost/property_tree_typed/detail/json_parser_read.hpp
E:\Work\SearchSuite\G13_Release\CGL\libs\boost/property_tree_typed/detail/json_parser_write.hpp
E:\Work\SearchSuite\G13_Release\CGL\libs\boost/property_tree_typed/detail/ptree_implementation.hpp
update meta set value = %s where key = 'Default Search Provider ID';
SELECT * FROM keywords WHERE short_name = '%s' AND url = '%s';
E:\Work\SearchSuite\G13_Release\SearchSuite\Client\Common\BrowserManagement\src\chrome.cpp
void __thiscall Chrome::UpdateChromeBackupKeywordsTable(const class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > &)
KeySize
: this object does't support a special last block
NullRNG: NullRNG should only be passed to functions that don't need to generate random bytes
: this object doesn't support multiple channels
is not a valid key length
%Y-%m-%d %H:%M:%S
UrlEscape failed
UrlEscape succeeded
CMD_LIST_SETTINGS called
CMD_LIST_FOLDERS called
CreateThread failed, GLE=%d.
%s/[d-d-d d_d_d]%s
Crash detected > attempt to %s address %x
Last Error: %d. %s
: this object doesn't support resynchronization
StreamTransformation: this object doesn't support random access
Boost.Variant internal error: 'which' out of range.
E:\Work\SearchSuite\G13_Release\SearchSuite\Client\Kipod\Bin\Release\Coordinator.pdb
OLEAUT32.dll
RegCloseKey
ADVAPI32.dll
SHLWAPI.dll
WS2_32.dll
USER32.dll
GetProcessHeap
CreateIoCompletionPort
KERNEL32.dll
SHELL32.dll
ole32.dll
RegOpenKeyExW
RegCreateKeyExW
ReportEventW
RPCRT4.dll
SensApi.dll
WININET.dll
VERSION.dll
WTSAPI32.dll
GetCPInfo
ConnectNamedPipe
CreateNamedPipeW
DisconnectNamedPipe
WaitNamedPipeW
dbghelp.dll
PSAPI.DLL
ShellExecuteExW
SHFileOperationW
RegDeleteKeyW
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyW
UrlEscapeW
USERENV.dll
PeekNamedPipe
Coordinator.exe
??0?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@QAE@XZ
??_B?1??get_instance@?$singleton@V?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@23@XZ@51
??_B?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ@51
??_B?1??get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@3@XZ@51
?get_const_instance@?$singleton@V?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@23@XZ
?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@3@XZ
?get_instance@?$singleton@V?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@23@XZ
?get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?instance@?$singleton@V?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@@serialization@boost@@0AAV?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@23@A
?instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@0AAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@A
?instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@@serialization@boost@@0AAV?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@3@A
?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@@detail@34@A
?t@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ@4V?$singleton_wrapper@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@detail@34@A
?t@?1??get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@@634@A
.?AVwindows_file_codecvt@@
zcÁ
.?AVCppSQLite3Query@@
.?AVCppSQLite3Table@@
.?AVCppSQLite3Statement@@
.?AVCppSQLite3DB@@
.?AV?$clone_impl@VFailedToOpenRegistryKeyException@SystemTools@Tools@@@exception_detail@boost@@
.?AVFailedToOpenRegistryKeyException@SystemTools@Tools@@
.?AV?$sp_counted_impl_p@VHolder@?$HoldPolicy@V?$HandlePolicy@PAUHKEY__@@$0A@P6GJPAU1@@Z$1?RegCloseKey@@YGJ0@ZVRegCloseKeyChecker@Tools@@VOpenRegPolicy@4@@HTL@PTL@@Vshared_ptr@boost@@@Fast@Detail@HTL@PTL@@@detail@boost@@
.PAUErrorTag@SystemTools@Tools@@
.PAUPathTag@ErrorInfo@FileTools@Tools@@
.PAUErrorCodeTag@ErrorInfo@StringTools@Tools@@
.PAUErrorCodeDescription@ErrorInfo@StringTools@Tools@@
.PAUOSErrorCodeTag@ErrorInfo@FileTools@Tools@@
.PAUDestinationDirectoryTag@ErrorInfo@FileTools@Tools@@
.PAUDestinationFileNameTag@ErrorInfo@FileTools@Tools@@
.PAUIllegalFileNameCharTag@ErrorInfo@FileTools@Tools@@
.PAUFileNamePrefixTag@ErrorInfo@FileTools@Tools@@
.PAUFileNameRootTag@ErrorInfo@FileTools@Tools@@
.PAUFileNameSuffixTag@ErrorInfo@FileTools@Tools@@
.PAUFileNameExtTag@ErrorInfo@FileTools@Tools@@
.?AV?$singleton_wrapper@V?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@@detail@serialization@boost@@
.?AV?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@
.?AV?$singleton_wrapper@V?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@@detail@serialization@boost@@
.?AV?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@
.?AV?$singleton@V?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@@serialization@boost@@
.?AV?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@
.?AVException@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@
.PAUMessageTag@ErrorInfo@KipodLogger@@
.PAUWhatTag@PTL@@
.?AV?$clone_impl@VException@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@exception_detail@boost@@
.?AV?$sp_counted_impl_p@Vwindows_shared_memory@interprocess@boost@@@detail@boost@@
.?AUwincert_x64_token@detail@protection@kipod@@
.?AUwincert_x86_token@detail@protection@kipod@@
.?AUapcrtldr_x86_token@detail@protection@kipod@@
.?AUapcrtldr_x64_token@detail@protection@kipod@@
.?AVOperaStatistic@KipodStatistic@@
.?AVChromeStatistic@KipodStatistic@@
.?AV?$_Ref_count_obj@VOperaStatistic@KipodStatistic@@@tr1@std@@
.?AV?$_Ref_count_obj@VChromeStatistic@KipodStatistic@@@tr1@std@@
.?AVCppSQLite3Exception@@
.?AV?$sp_counted_impl_pd@PAUdelete_data@?$thread_specific_ptr@V?$weak_ptr@U?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@@boost@@@boost@@U?$do_heap_delete@Udelete_data@?$thread_specific_ptr@V?$weak_ptr@U?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@@boost@@@boost@@@detail@3@@detail@boost@@
.?AV?$sp_counted_impl_p@U?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@@detail@boost@@
.?AU?$concrete_parser@U?$alternative@V?$action@V?$chset@_W@classic@spirit@boost@@Ua_escape@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$chlit@D@classic@spirit@boost@@V?$action@U?$uint_parser@K$0BA@$03$03@classic@spirit@boost@@Ua_unicode@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$alternative@V?$action@U?$difference@U?$difference@Uanychar_parser@classic@spirit@boost@@V?$strlit@PBD@234@@classic@spirit@boost@@V?$strlit@PBD@234@@classic@spirit@boost@@Ua_char@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$chlit@D@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$positive@U?$contiguous@U?$confix_parser@U?$chlit@D@classic@spirit@boost@@U?$kleene_star@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@U1234@Uunary_parser_category@234@Unon_nested@234@Unon_lexeme@234@@classic@spirit@boost@@@classic@spirit@boost@@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@U?$sequence@U?$sequence@U?$optional@U?$chlit@D@classic@spirit@boost@@@classic@spirit@boost@@U?$alternative@U?$chlit@D@classic@spirit@boost@@U?$sequence@U?$range@_W@classic@spirit@boost@@U?$kleene_star@Udigit_parser@classic@spirit@boost@@@234@@234@@234@@classic@spirit@boost@@U?$optional@U?$sequence@U?$chlit@D@classic@spirit@boost@@U?$positive@Udigit_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$optional@U?$sequence@U?$sequence@V?$chset@_W@classic@spirit@boost@@U?$optional@V?$chset@_W@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$positive@Udigit_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@U?$sequence@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$action@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@Ua_name@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$chlit@D@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_s@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$alternative@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_e@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$list_parser@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@U?$chlit@D@234@Uno_list_endtoken@234@Uplain_parser_category@234@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_e@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@@234@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$alternative@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@V1234@@classic@spirit@boost@@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@Uend_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$abstract_parser@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$abstract_parser@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@@impl@classic@spirit@boost@@
.?AUdelete_data@?$thread_specific_ptr@V?$weak_ptr@U?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@@boost@@@boost@@
.?AU?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@
.?AVFireFox@@
.?AVJsonParserExecption@Json@KipodTools@@
.?AU?$do_heap_delete@Udelete_data@?$thread_specific_ptr@V?$weak_ptr@U?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@@boost@@@boost@@@detail@boost@@
.?AVOpera@@
.?AVChrome@@
.?AUNoChannelSupport@BufferedTransformation@CryptoPP@@
.?AVInvalidKeyLength@CryptoPP@@
.PAVBufferedTransformation@CryptoPP@@
.PAVRandomNumberGenerator@CryptoPP@@
.?AVsettings_pipe_failed@@
.PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AV?$VariableKeyLength@$0BA@$0BA@$0CA@$07$03$0A@@CryptoPP@@
.?AVSimpleKeyingInterface@CryptoPP@@
.?AV?$SimpleKeyingInterfaceImpl@V?$TwoBases@VBlockCipher@CryptoPP@@URijndael_Info@2@@CryptoPP@@V12@@CryptoPP@@
.?AV?$AlgorithmImpl@V?$SimpleKeyingInterfaceImpl@V?$TwoBases@VBlockCipher@CryptoPP@@URijndael_Info@2@@CryptoPP@@V12@@CryptoPP@@V12@@CryptoPP@@
<!-- Windows 8.1 -->
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
<!-- Windows Vista -->
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<!-- Windows 7 -->
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
<!-- Windows 8 -->
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
</assembly>P<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"></supportedOS>
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS>
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS>
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"></supportedOS>
4(5.585_5
4%4x5
5&505:5~5
24383<3@3
6-6}6
7Œ8M8\8
!0(0/060;0
3(4,4044484 5
5#5*51585
99
7x7U7h7
0%0X0
3 3$3(3,3
9 9$9(9,909
6}7H7L7P7T7X7\7
;6;;;#=2=@=
3#3'3-313L3Z3}7
4I4s4
4(4@4_4|4
0 2?3x3
6&7573888
99J9P9V9i9
>#?2???[?
2 2$2(2,2
1%1U1g1
5#5'5 5/5
7}7
7!7%7)767,9
>0>4>8><>
2034383
4#5,555}5
9(:,:0:4:
5&656^7}7
41484?4{4
4O5U5
7"8'8&:3:
4-585`5}5
3 3$3(3,3034383~3
; ;$;(;,;0;4;8;<;|;
0 0(01080
5%6U6
: :$:(:,:0:4:8:<:
2 2$2(2,20242
3 3$3(3,303
6 6$6(6,606
8 8$80=4=
5 5$5(5,505
6 6$6(6,6064686
7(747<7\7
pKERNEL32.DLL
mscoree.dll
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
ADVAPI32.DLL
WUSER32.DLL
777705555443332
5555443332
5555443332
Software\Microsoft\Windows\CurrentVersion\Run
duser32.dll
%s\%s%X%X
\cmd.exe
Web Server Edition
%1%.%2%.%3%
\/:*?"<>|
_<>:"/\|?*
\\?\UNC\
FirefoxExtension
ChromeDS
FirefoxHomepage
FirefoxSE
FirefoxDE
FirefoxKeyword
ChromeStartPages
ChromeStartPages32
ChromeHomepage
ChromePrefs
ChromeNewTab
Firefox/ProtectionEnabled
Chrome/ProtectionEnabled
ff_nt_supported
ie_ds_supported
ff_ds_supported
chrome_ds_supported
ie_hp_supported
ff_hp_supported
chrome_hp_supported
chrome_nt_supported
hXXp://VVV.search.ask.com/?o=APN10640A&gct=hp&d=#sysid#-#appid#&v=#ptype##kbn#-#uc#&t=4
{52db1893-8a90-4192-aede-08e00b8f8#sysid#}
Ask.com
hXXp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=#appid#&systemid=#sysid#&v=#ptype##kbn#-#uc#&apn_uid=#uid#&apn_dtid=BND101&o=APN10640&apn_ptnrs=AG1&q=
hXXp://VVV.search.ask.com/suggest.php?src=ieb&gct=ds&appid=#appid#&systemid=#sysid#&v=#ptype##kbn#-#uc#&apn_uid=#uid#&apn_dtid=BND101&o=APN10640&apn_ptnrs=AG1&qu=
hXXp://dts.search.ask.com/sr?l=dis&o=APN10640&qsrc=2870&apn_dtid=BND101&apn_ptnrs=AG1&apn_uid=#uid#&gct=dns&gc=1&appid=#appid#&sysid=#sysid#&sver=3&q=
{DB3CB725-C39D-434E-80D1-DB271BB972C8}
hXXp://dts.search.ask.com/sr?src=ffb&gct=ds&appid=#appid#&systemid=#sysid#&v=#ptype##kbn#-#uc#&apn_dtid=BND101&apn_ptnrs=AG1&apn_uid=#uid#&o=APN10640&q=
Firefox/Extension
hXXp://VVV.search.ask.com?o=APN10640A&gct=hp&d=#sysid#-#appid#&v=#ptype##kbn#-#uc#&t=4&tag=newtab
hXXp://dts.search.ask.com/sr?src=crb&gct=ds&appid=#appid#&systemid=#sysid#&v=#ptype##kbn#-#uc#&apn_uid=#uid#&apn_dtid=BND101&o=APN10640&apn_ptnrs=AG1&q=
hXXp://VVV.search.ask.com/?o=APN10640A&gct=hp&d=#sysid#-#appid#&v=#ptype##kbn#-#uc#&t=4&tag=newtab
\extensions.sqlite
\extensions.sqlite-journal
Chrome/DefaultSearch
DefaultUrl
DefaultKeyword
\Web Data
\Web Data-journal
Firefox/Homepage
Firefox/HomepageAsked
user_pref("browser.startup.homepage", "$(Value)");
user_pref\("browser\.startup\.homepage", "([^"]*)"\);
\prefs.js
Firefox/SelectedSearch
Firefox/SelectedSearchAsked
user_pref("browser.search.selectedEngine", "$(Value)");
user_pref\("browser\.search\.selectedEngine", "([^"]*)"\);
Firefox/DefaultSearch
Firefox/DefaultSearchAsked
user_pref("browser.search.defaultenginename", "$(Value)");
user_pref\("browser\.search\.defaultenginename", "([^"]*)"\);
Firefox/UrlbarSearch
Firefox/UrlbarSearchAsked
user_pref("keyword.URL", "$(Value)");
user_pref\("keyword\.URL", "([^"]*)"\);
FFUrlbar search
DefaultSuggestionUrl
Chrome/Homepage
backup.homepage
Chrome homepage
Chrome/StartPages
backup.session.urls_to_restore_on_startup
Chrome Start Page
session.urls_to_restore_on_startup
Chrome/StartPagesFrom32Version
backup.session.startup_urls
Chrome Start Page Since 32 version
session.startup_urls
Chrome
Chrome/NewTab
404Url
DNSUrl
SearchUrl
NewTabUrl
RelatedSearchUrl
Firefox/BHO
Error404URL
DNSErrorURL
SearchURL
Firefox/BHO/NativeHelper
Firefox/BHO/DnsBHO
Firefox/BHO/SearchBHO
Firefox/BHO/MainBHO
Firefox/BHO/Error404BHO
Firefox/BHO/NewTabBHO
Firefox/BHO/SessionRestore
SOFTWARE\Mozilla\Mozilla Firefox
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe
SOFTWARE\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Chrome.exe
hXXp://
%d.%d.%d.%d
\FirefoxToolbar\
\profiles.ini
\Mozilla\Firefox\
\Google\Chrome\User Data\Default
chrome-extension://%1%/config/skin/new-tab.html
\ChromeExtension
JX
{B358EFE4-A25E-4fd6-A2CA-71081B7CDB47}_%1%
\\.\pipe\SafetyNutPipe
backup.homepage_is_newtabpage
backup.extensions.ids
backup.browser.show_home_button
backup.session.restore_on_startup
lbackup.session.urls_to_restore_on_startup
lchrome.exe
\Google\Chrome\User Data\Default\Preferences
\Google\Chrome\User Data\
\Google\Chrome\User Data\Default\Web Data
search_url
"%1%" : "%2%"
chrome_url_overrides
chrome-extension://%1%/%2%
opera.exe
session.restore_on_startup
\Opera\Opera\operaprefs.ini
\Opera\operaprefs_default.ini
\Opera\Opera\search.ini
\Opera\locale\%1%\search.ini
\Opera\Opera\toolbar\standard_toolbar.ini
Home URL
\Opera\Opera\sessions\autosave.win
Search Panel Toolbar.content
firefox.exe
\Mozilla\Firefox
\search.json
\search.sqlite
\extensions.ini
user_pref("browser.startup.homepage", "
user_pref("browser.startup.page",
user_pref("browser.search.selectedEngine", "
user_pref("browser.search.defaultenginename", "
user_pref("browser.search.order.1", "
user_pref("keyword.URL", "
user_pref("general.useragent.extra.%1%", "
user_pref("%1%.Updater.Enabled", "
xmlns:G="hXXp://a9.com/-/spec/opensearch/1.1/" xmlns:moz="hXXp://VVV.mozilla.org/2006/browser/search/"
Url[@type='text/html']
windows
Software\SafetyNut\Files\ChromeHomepage
Software\SafetyNut\Chrome\DS
Software\Mozilla\Mozilla Firefox
http\shell\open\command
software\Microsoft\Windows\shell\associations\urlassociations\http\userchoice
Software\Opera Software
Opera.exe
Software\Microsoft\Windows\CurrentVersion\Ext\Settings
extensions.ini
\install.rdf
xmlns:G="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:em="hXXp://VVV.mozilla.org/2004/em-rdf#"
firefox
chrome
opera
G:Url[@type='text/html']
coordinator.cfg
lSafetyNut\safetyldr.dll
SafetyNut\x64\safetyldr.dll
SafetyNut\x64\safetycrt.dll
SafetyNut\safetycrt.dll
lcoordinator.cfg
general.cfg
SafetyNutManager.exe
safetynut.exe
Global\F473573F-4750-4AA6-B7B0-4595E7DEA3E2
\\.\Global\F06DEFF2-5B9C-490D-910F-35D3A9119622configmgrc2
configmgrc2.cfg
F06DEFF2-5B9C-490D-910F-35D3A9119622
{5A08D1A5-925A-401D-AFE3-8D61426B0E3E}
Service failed. %s
BInternet Explorer Settings.exe
new_chrome.exe
chrome.exe
ieuser.exe
iexplore.exe
ucsrss.exe
lsass.exe
services.exe
svchost.exe
Windows
Starting SafetyNut Manager Service, version 5.0.0.13452 built Thu Jul 10 16:42:18 2014
stats.cfg
firefox/homepage
firefox/selectedsearch
chrome/homepage
chrome/defaultsearch
<url>%3%</url>
WinHttp.WinHttpRequest.5.1
5.0.0.13452
application/x-www-form-urlencoded
login_request
/login_reply/properties/node()
/login_reply/block_exec/file
/login_reply/auto_update/pack_url/node()
/login_reply/patch_update/patch/node()
target_statistics_url
.XML=
SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls
Wincert\win32cert.dll
Wincert\win64cert.dll
%s failed w/err 0xlx
hAdvapi32.dll
safetynutbe.com
/login
hXXp://preved.%s
{1112c7f9-2d8b-4550-bf47-68ef2e02ff20}
{d48c9ead-f59f-4dea-ac97-7065fea79f42}
{af6ac4f2-9825-4fb6-a600-92bc5361f209}
{23cd218f-af09-443f-bbb1-adb89fd5986d}
{9a95b751-bf3e-4ea8-a938-2d4d84cd4964}
{99079a25-328f-4bd4-be04-00955acaa0a7}
{28387537-e3f9-4ed7-860c-11e69af4a8a0}
{b7b37500-99b4-46ad-8bf3-2480bcedc38c}
{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}
search.fantastigames.com
dts.search-results.com
VVV.gotsearch.com
VVV.insertsearch.com
VVV.mlsearch.com
VVV.searchsupreme.com
VVV.newsearchtab.com
VVV.adoresearch.com
VVV.searchsheet.com
VVV.searchqu.com
VVV.searchnu.com
VVV.searchcore.net
search.lphant.net
search.lphant.com
search.shareazaweb.com
search.shareazaweb.net
search.bearshare.net
search.bearshare.com
search.imesh.com
search.imesh.net
%1%.%2%.%3%.%4%
PathToExe
user_pref("extensions.lastAppVersion", "
user_pref("extensions.lastPlatformVersion", "
user_pref("extensions.extensions.databaseSchema",
%s|%d|%d|%d
backup.pinned_tabs
https
%d.%d
Hlogfile.txt
dwinlogon.exe
Msxml2.DOMDocument.3.0
E:\Work\SearchSuite\G13_Release\SearchSuite\Client\Common\json_parser\JsonPropertyTreeParser.cpp
!valueName.empty()
e:\work\searchsuite\g13_release\searchsuite\client\common\json_parser\JsonPropertyTreeParser.h
E:\Work\SearchSuite\G13_Release\CGL\libs\boost/optional/optional.hpp
!value.empty()
!p.empty() && "Empty path not allowed for put_child."
.E:\Work\SearchSuite\G13_Release\CGL\libs\boost/variant/detail/visitation_impl.hpp
!"Boost.Variant internal error: 'which' out of range."
E:\Work\SearchSuite\G13_Release\CGL\libs\boost/variant/detail/forced_return.hpp
!"#$%&'()* ,
{029ea614-c5b4-4b79-ac5c-d2b17f0fcb01}
{285e37e7-90b6-4318-b84f-941c18ad07e8}
{54a32f25-e2e2-411f-8853-e5f7b32db6a7}
Assertion failed: %s, file %s, line %d
m{029ea614-c5b4-4b79-ac5c-d2b17f0fcb01}
%Program Files%\Movies App\SafetyNut\SafetyNutManager.exe

SafetyNutManager.exe_332_rwx_00030000_00001000:

%Program Files%\Movies App\SafetyNut\safetyldr.dll

safetynut.exe_464:

.text
`.rdata
@.data
.rsrc
@.reloc
8%uNP
tùX
SSSSh
3|$83|$0
3|$@3|$4
\$,3\$43
~$)~()|$
.QZ^&
.GFy,
8sqliu
u.VWhl
 2 34 567
T$DRSSh
xSSSh
FTPjKS
FtPj;S
C.PjRV
<%u7j
X<%u2j
CPPSQLITE_ERROR
SQLITE_DONE
SQLITE_ROW
SQLITE_RANGE
SQLITE_FORMAT
SQLITE_AUTH
SQLITE_NOLFS
SQLITE_MISUSE
SQLITE_MISMATCH
SQLITE_CONSTRAINT
SQLITE_TOOBIG
SQLITE_SCHEMA
SQLITE_EMPTY
SQLITE_PROTOCOL
SQLITE_CANTOPEN
SQLITE_FULL
SQLITE_NOTFOUND
SQLITE_CORRUPT
SQLITE_IOERR
SQLITE_INTERRUPT
SQLITE_READONLY
SQLITE_NOMEM
SQLITE_LOCKED
SQLITE_BUSY
SQLITE_ABORT
SQLITE_PERM
SQLITE_INTERNAL
SQLITE_ERROR
SQLITE_OK
%s[%d]: %s
select count(*) from sqlite_master where type='table' and name='%s'
large file support is disabled
SQL logic error or missing database
foreign_keys
sqlite_compileoption_get
sqlite_compileoption_used
sqlite_source_id
sqlite_version
sqlite_attach
sqlite_detach
sqlite_stat1
sqlite_rename_parent
sqlite_rename_trigger
sqlite_rename_table
RowKey
3.7.3
SQLite format 3
CREATE TABLE sqlite_master(
sql text
CREATE TEMP TABLE sqlite_temp_master(
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
922337203685477580
SQLITE_
?API call with %s database connection pointer
%s\etilqs_
OsError 0x%x (%u)
2nd reference to page %d
invalid page number %d
%s(%d)
keyinfo(%d
%r %s BY term out of range - should be between 1 and %d
Expression tree is too large (maximum depth %d)
too many SQL variables
variable number must be between ?1 and ?%d
too many columns in %s
%s OR name=%Q
type='trigger' AND (%s)
SELECT tbl, idx, stat FROM %Q.sqlite_stat1
access to %s.%s.%s is prohibited
access to %s.%s is prohibited
object name reserved for internal use: %s
sqlite_
duplicate column name: %s
too many columns on %s
unknown column "%s" in foreign key definition
number of columns in foreign key does not match the number of columns in the referenced table
foreign key on %s should reference only one column of table %T
a JOIN clause is required before %s
cannot modify %s because it is a view
table %s may not be modified
foreign key mismatch
error during initialization: %s
no entry point [%s] in shared library [%s]
unable to open shared library [%s]
sqlite3_extension_init
unknown or unsupported join type: %T %T%s%T
RIGHT and FULL OUTER JOINs are not currently supported
%s:%d
no such index: %s
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
sqlite_master
sqlite_temp_master
vtable constructor did not declare schema: %s
vtable constructor failed: %s
no such module: %s
table %s: xBestIndex returned an invalid plan
database corruption at line %d of [%.10s]
misuse at line %d of [%.10s]
cannot open file at line %d of [%.10s]
failed to allocate %u bytes of memory
failed memory resize %u to %u bytes
Recovered %d frames from WAL file %s
foreign key constraint failed
DELETE FROM %Q.%s WHERE tbl=%Q
CREATE TABLE %Q.%s(%s)
%s %T cannot reference objects in database %s
default value of column [%s] is not constant
UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d
%s - %s
malformed database schema (%s)
cannot join using column %s - column not present in both tables
cannot have both ON and USING clauses in the same join
a NATURAL join may not have an ON or USING clause
%s: %s
%s: %s.%s
%s: %s.%s.%s
misuse of aliased aggregate %s
not authorized to use function: %s
too many terms in %s BY clause
invalid name: "%s"
Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)
Failed to read ptrmap key=%d
failed to get page %d
%d of %d pages missing from overflow list starting at %d
freelist leaf count too big on page %d
Fragmentation of %d bytes reported as %d on page %d
Multiple uses for byte %d of page %d
Corruption detected in cell %d on page %d
On page %d at right child:
On tree page %d cell %d:
unable to get the page. error code=%d
btreeInitPage() returns error code %d
Page %d:
Outstanding page count goes from %d to %d during this analysis
Pointer map page %d is referenced
Page %d is never used
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
%s-mjX
unable to use function %s in the requested context
zeroblob(%d)
database %s is locked
cannot detach database %s
no such database: %s
no such collation sequence: %s
%s.%s
unknown database %s
bind on a busy prepared statement: [%s]
%.*s"%w"%s
%s%.*s"%w"
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
Cannot add a PRIMARY KEY column
automatic extension loading failed: %s
B}Tunable to close due to unfinished backup operation
d-d-d d:d:d
d:d:d
d-d-d
database schema is locked: %s
SELECTs to the left and right of %s do not have the same number of result columns
LIMIT clause should come after %s not before
ORDER BY clause should come after %s not before
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
PRAGMA vacuum_db.synchronous=OFF
cannot VACUUM - SQL statements in progress
BmTunknown database: %s
misuse of aggregate: %s()
indexed columns are not unique
PRIMARY KEY must be unique
%s.%s may not be NULL
no such vfs: %s
%s-shm
constraint failed at %d in [%s]
abort at %d in [%s]: %s
database table is locked: %s
cannot change %s wal mode from within a transaction
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
cannot commit transaction - SQL statements in progress
cannot rollback transaction - SQL statements in progress
cannot %s savepoint - SQL statements in progress
no such savepoint: %s
cannot open savepoint - SQL statements in progress
statement aborts at %d: [%s] %s
sqlite3_get_table() called with two or more incompatible queries
%s ORDER BY
%s VIRTUAL TABLE INDEX %d:%s
%s USING PRIMARY KEY
%s VIA MULTI-INDEX UNION
%s WITH INDEX %s
cannot use index: %s
%s WITH AUTOMATIC INDEX
%s AS %s
TABLE %s
at most %d tables in a join
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
unsupported file format
no such trigger: %S
unable to open database: %s
database %s is already in use
too many attached databases - max %d
sqlite_sequence
there is already an index named %s
DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q
DELETE FROM %Q.%s WHERE name=%Q AND type='index'
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
no such index: %S
unable to identify the object to be reindexed
no such table: %s
sqlite_subquery_%p_
cannot create INSTEAD OF trigger on table: %S
cannot create %s trigger on view: %S
cannot open value of type %s
cannot open %s column for writing
no such column: "%s"
cannot open view: %s
cannot open virtual table: %s
indexed
foreign key
sqlite_altertab_%s
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
CREATE%s INDEX %.*s
table %s has no column named %s
sqlite_autoindex_%s_%d
index %s already exists
there is already a table named %s
virtual tables may not be indexed
views may not be indexed
table %s may not be indexed
AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY
table "%s" has more than one primary key
CREATE TABLE %Q.sqlite_sequence(name,seq)
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
CREATE %s %.*s
view %s is circularly defined
table %S has no column named %s
%d values for %d columns
table %S has %d columns but %d values were supplied
*** in database %s ***
unsupported encoding: %s
foreign_key_list
no such column: %s
there is already another table or index with this name: %s
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
view %s may not be altered
table %s may not be altered
-- TRIGGER %s
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
DELETE FROM %s.sqlite_sequence WHERE name=%Q
use DROP VIEW to delete view %s
use DROP TABLE to delete table %s
table %s may not be dropped
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers
E:\Work\SearchSuite\G13_Release\CGL\Libs\boost/exception/detail/exception_ptr.hpp
class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > __cdecl Tools::SystemTools::ReadStringFromRegistry(struct HKEY__ *,const class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > &,const class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > &)
E:\Work\SearchSuite\G13_Release\CGL\Tools\SystemTools.cpp
void __cdecl Tools::SystemTools::WriteStringToRegistry(struct HKEY__ *,const class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > &,const class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > &,const class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > &)
void __cdecl Tools::SystemTools::RemoveRegistryValue(struct HKEY__ *,const class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > &,const class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > &)
unsigned long __cdecl Tools::SystemTools::GetMyExeName(class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > &)
E:\Work\SearchSuite\G13_Release\CGL\Tools\StringTools.cpp
E:\Work\SearchSuite\G13_Release\CGL\Tools\FileTools.cpp
keywords
SELECT value FROM meta WHERE key = 'version'
SELECT %s FROM keywords_backup ORDER BY id ASC
Not supported chrome db
CREATE TABLE %s AS SELECT %sFROM keywords ORDER BY id ASC
UPDATE meta SET value = ?WHERE key = 'Default Search Provider ID Backup Signature'
UPDATE meta SET value = %s WHERE key = 'Default Search Provider ID Backup'
UPDATE meta SET value = %s WHERE key = 'Default Search Provider ID'
E:\Work\SearchSuite\G13_Release\SearchSuite\Client\Kipod\KipodTools\KipodTools.cpp
void __cdecl KipodTools::UpdateChromeBackupKeywordsTable(const class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > &)
DROP TABLE %s
select %s from %s where key = '%s';
select * from %s where %s = '%s';
update %s set %s = %d where key = '%s';
DELETE FROM keywords WHERE short_name = '%s';
INSERT INTO keywords (short_name, keyword, url, favicon_url, input_encodings, show_in_default_list, safe_for_autoreplace) VALUES ('%s', '%s', '%s', '', 'UTF-8', 1, 1);
SELECT active, userDisabled, appDisabled, softDisabled FROM addon WHERE id='%s'
UPDATE addon SET userDisabled='%s', appDisabled='%s', softDisabled='%s', active='%i' WHERE id='%s'
id || short_name || keyword || favicon_url || url || safe_for_autoreplace || originating_url || date_created || usage_count || input_encodings || show_in_default_list || suggest_url || prepopulate_id || autogenerate_keyword || logo_id || created_by_policy || instant_url || last_modified || sync_guid
id || short_name || keyword || favicon_url || url || safe_for_autoreplace || originating_url || date_created || usage_count || input_encodings || show_in_default_list || suggest_url || prepopulate_id || created_by_policy || instant_url || last_modified || sync_guid
id, short_name, keyword, favicon_url, url, safe_for_autoreplace, originating_url, date_created, usage_count, input_encodings, show_in_default_list, suggest_url, prepopulate_id, autogenerate_keyword, logo_id, created_by_policy, instant_url, last_modified, sync_guid
id, short_name, keyword, favicon_url, url, safe_for_autoreplace, originating_url, date_created, usage_count, input_encodings, show_in_default_list, suggest_url, prepopulate_id, created_by_policy, instant_url, last_modified, sync_guid
keywords_backup
E:\Work\SearchSuite\G13_Release\SearchSuite\Client\Kipod\KipodTools\IETools.cpp
bool __cdecl KipodTools::IETools::`anonymous-namespace'::UnlockKey(struct HKEY__ *)
bool __cdecl KipodTools::IETools::`anonymous-namespace'::LockKey(struct HKEY__ *)
Only Internet Explorer code should write this user setting. See hXXp://go.microsoft.com/fwlink/?LinkId=159651 for more details.
WTSAPI32.dll
E:\Work\SearchSuite\G13_Release\CGL\libs\boost/exception/detail/exception_ptr.hpp
E:\Work\SearchSuite\G13_Release\CGL\PTL/Observer/InterprocessEvent/InterprocessEvent.hpp
boost::filesystem::directory_iterator::operator  
kernel32.dll
Can't terminate a sub-expression with an alternation operator |.
A regular expression can start with the alternation operator |.
Alternation operators are not allowed inside a DEFINE block.
More than one alternation operator | was encountered inside a conditional expression.
A repetition operator cannot be applied to a zero-width assertion.
Invalid alternation operators within (?...) block.
The \c and \C escape sequences are not supported by POSIX basic regular expressions: try the Perl syntax instead.
Found a closing repetition operator } with no corresponding {.
The repeat operator " " cannot start a regular expression.
The repeat operator "?" cannot start a regular expression.
The repeat operator "*" cannot start a regular expression.
right-curly-bracket
left-curly-bracket
0123456789
Unmatched quantified repeat operator { or \{.
Invalid preceding regular expression prior to repetition operator.
unsupported version
Visual C   CRT: Not enough memory to complete call to strerror.
GetProcessWindowStation
Broken pipe
Inappropriate I/O control operation
Operation not permitted
portuguese-brazilian
operator
%d / %m / %y
%I : %M : %S %p
%m / %d / %y
%b %d %H : %M : %S %Y
backup.homepage
backup.homepage_is_newtabpage
backup.browser.show_home_button
backup.session.restore_on_startup
backup.session.urls_to_restore_on_startup
backup.extensions.ids
RegOpenKeyTransactedW
RegCreateKeyTransactedW
RegDeleteKeyTransactedW
RegDeleteKeyExW
unsupported exception
../../../../CGL/Libs\boost/property_tree_typed/string_path.hpp
Local\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flag
../../../../CGL/Libs\boost/property_tree_typed/json_parser.hpp
../../../../CGL/Libs\boost/property_tree_typed/detail/json_parser_read.hpp
../../../../CGL/Libs\boost/property_tree_typed/detail/json_parser_write.hpp
../../../../CGL/Libs\boost/property_tree_typed/detail/ptree_implementation.hpp
%s|%d|%d|%d
backup.pinned_tabs
boost::too_few_args: format-string referred to more arguments than were passed
boost::too_many_args: format-string referred to less arguments than were passed
SELECT internal_id FROM addon WHERE id='%s'
INSERT INTO addon (id, location, type, visible, active, userDisabled, appDisabled, descriptor, softDisabled, pendingUninstall) VALUES ('%s', 'app-profile', 'extension', 1, 1, 0, 0, '%s', 0, 0)
UPDATE addon SET userDisabled='%i', appDisabled='%i', softDisabled='%i', active='%i' WHERE id='%s'
e:\work\searchsuite\g13_release\searchsuite\client\kipodlogger\kipodlogger\SharedLogBuffer.hpp
{DB859B9F-5A74-439e-B1FA-1356ECBCF59A}
../../../../CGL\PTL/Observer/InterprocessEvent/InterprocessEvent.hpp
void __thiscall PTL::Interprocess<struct KipodLogger::InterprocessName,class boost::interprocess::windows_shared_memory,class PTL::EmptyErrorPolicy,struct KipodLogger::LowIntegrityLevelAccessPolicy>::Event<class KipodLogger::NewLogEvent,0>::Notify(const class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > &,bool)
../../../../CGL/Libs\boost/exception/detail/exception_ptr.hpp
E:\Work\SearchSuite\G13_Release\SearchSuite\Client\Kipod\KipodUI\KipodUI\Protector\KeyProtect.cpp
class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > __thiscall ProtectKeyInfo::GetDisplayRealValue(void) const
yahoo.com
ask.com
imesh web search
.default-search.net
.search-results.com
.search.ask.com
.unthreat.com
.fantastigames.com
.gotsearch.com
.insertsearch.com
.mlsearch.com
.searchsupreme.com
.newsearchtab.com
.adoresearch.com
.searchsheet.com
.searchqu.com
.searchnu.com
.searchcore.net
.lphant.net
.lphant.com
.shareazaweb.com
.shareazaweb.net
.bearshare.net
.bearshare.com
.imesh.com
.imesh.net
KeySize
: this object does't support a special last block
NullRNG: NullRNG should only be passed to functions that don't need to generate random bytes
: this object doesn't support multiple channels
is not a valid key length
E:\Work\SearchSuite\G13_Release\CGL\libs\boost/property_tree_typed/detail/ptree_implementation.hpp
E:\Work\SearchSuite\G13_Release\CGL\libs\boost/property_tree_typed/string_path.hpp
Boost.Variant internal error: 'which' out of range.
%Y-%m-%d %H:%M:%S
UrlEscape failed
UrlEscape succeeded
E:\Work\SearchSuite\G13_Release\SearchSuite\Client\Kipod\Bin\Release\DataMngrUI.pdb
GetProcessHeap
KERNEL32.dll
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
USER32.dll
GDI32.dll
RegDeleteKeyW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegNotifyChangeKeyValue
RegEnumKeyW
ADVAPI32.dll
SHELL32.dll
ole32.dll
OLEAUT32.dll
SensApi.dll
WININET.dll
VERSION.dll
ImageGetCertificateData
CertGetCertificateContextProperty
ImageEnumerateCertificates
CertGetNameStringW
CertFreeCertificateContext
CRYPT32.dll
imagehlp.dll
UrlIsW
UrlEscapeW
SHLWAPI.dll
COMCTL32.dll
USERENV.dll
WaitNamedPipeW
GetCPInfo
PeekNamedPipe
RegOpenKeyW
ShellExecuteExW
SHFileOperationW
DataMngrUI.exe
??0?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@QAE@XZ
??_B?1??get_instance@?$singleton@V?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@23@XZ@51
??_B?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ@51
??_B?1??get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@3@XZ@51
?get_const_instance@?$singleton@V?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@23@XZ
?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@3@XZ
?get_instance@?$singleton@V?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@23@XZ
?get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?instance@?$singleton@V?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@@serialization@boost@@0AAV?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@23@A
?instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@0AAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@A
?instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@@serialization@boost@@0AAV?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@3@A
?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@@detail@34@A
?t@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ@4V?$singleton_wrapper@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@detail@34@A
?t@?1??get_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@@634@A
.?AVCppSQLite3Query@@
.?AVCppSQLite3Table@@
.?AVCppSQLite3Statement@@
.?AVCppSQLite3DB@@
.?AV?$clone_impl@VFailedToOpenRegistryKeyException@SystemTools@Tools@@@exception_detail@boost@@
.?AVFailedToOpenRegistryKeyException@SystemTools@Tools@@
.PAUErrorTag@SystemTools@Tools@@
.PAUPathTag@ErrorInfo@FileTools@Tools@@
.PAUErrorCodeTag@ErrorInfo@StringTools@Tools@@
.PAUErrorCodeDescription@ErrorInfo@StringTools@Tools@@
.PAUOSErrorCodeTag@ErrorInfo@FileTools@Tools@@
.PAUDestinationDirectoryTag@ErrorInfo@FileTools@Tools@@
.PAUDestinationFileNameTag@ErrorInfo@FileTools@Tools@@
.PAUIllegalFileNameCharTag@ErrorInfo@FileTools@Tools@@
.PAUFileNamePrefixTag@ErrorInfo@FileTools@Tools@@
.PAUFileNameRootTag@ErrorInfo@FileTools@Tools@@
.PAUFileNameSuffixTag@ErrorInfo@FileTools@Tools@@
.PAUFileNameExtTag@ErrorInfo@FileTools@Tools@@
.?AV?$sp_counted_impl_p@VHolder@?$HoldPolicy@V?$HandlePolicy@PBU_CERT_CONTEXT@@$0A@P6GHPBU1@@Z$1?CertFreeCertificateContext@@YGH0@ZVCloseResultPolicy@Default@HTL@PTL@@VCreatePolicy@456@@HTL@PTL@@Vshared_ptr@boost@@@Fast@Detail@HTL@PTL@@@detail@boost@@
.PAUMessageTag@ErrorInfo@@
.?AVwindows_file_codecvt@@
zcÁ
.?AV?$sp_counted_impl_pd@PAUdelete_data@?$thread_specific_ptr@V?$weak_ptr@U?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@@boost@@@boost@@U?$do_heap_delete@Udelete_data@?$thread_specific_ptr@V?$weak_ptr@U?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@@boost@@@boost@@@detail@3@@detail@boost@@
.?AV?$sp_counted_impl_p@U?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@@detail@boost@@
.?AU?$concrete_parser@U?$alternative@V?$action@V?$chset@_W@classic@spirit@boost@@Ua_escape@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$chlit@D@classic@spirit@boost@@V?$action@U?$uint_parser@K$0BA@$03$03@classic@spirit@boost@@Ua_unicode@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$alternative@V?$action@U?$difference@U?$difference@Uanychar_parser@classic@spirit@boost@@V?$strlit@PBD@234@@classic@spirit@boost@@V?$strlit@PBD@234@@classic@spirit@boost@@Ua_char@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$chlit@D@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$positive@U?$contiguous@U?$confix_parser@U?$chlit@D@classic@spirit@boost@@U?$kleene_star@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@U1234@Uunary_parser_category@234@Unon_nested@234@Unon_lexeme@234@@classic@spirit@boost@@@classic@spirit@boost@@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@U?$sequence@U?$sequence@U?$optional@U?$chlit@D@classic@spirit@boost@@@classic@spirit@boost@@U?$alternative@U?$chlit@D@classic@spirit@boost@@U?$sequence@U?$range@_W@classic@spirit@boost@@U?$kleene_star@Udigit_parser@classic@spirit@boost@@@234@@234@@234@@classic@spirit@boost@@U?$optional@U?$sequence@U?$chlit@D@classic@spirit@boost@@U?$positive@Udigit_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$optional@U?$sequence@U?$sequence@V?$chset@_W@classic@spirit@boost@@U?$optional@V?$chset@_W@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$positive@Udigit_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@U?$sequence@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$action@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@Ua_name@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$chlit@D@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_s@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$alternative@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_e@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$list_parser@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@U?$chlit@D@234@Uno_list_endtoken@234@Uplain_parser_category@234@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_e@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@@234@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$concrete_parser@U?$sequence@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$alternative@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@V1234@@classic@spirit@boost@@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@Uend_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$abstract_parser@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@@impl@classic@spirit@boost@@
.?AU?$abstract_parser@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@@impl@classic@spirit@boost@@
.?AUdelete_data@?$thread_specific_ptr@V?$weak_ptr@U?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@@boost@@@boost@@
.?AU?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@
.?AVJsonParserExecption@Json@KipodTools@@
.?AU?$do_heap_delete@Udelete_data@?$thread_specific_ptr@V?$weak_ptr@U?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@@boost@@@boost@@@detail@boost@@
.?AVCppSQLite3Exception@@
.?AV?$singleton_wrapper@V?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@@detail@serialization@boost@@
.?AV?$singleton@V?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@@serialization@boost@@
.?AV?$extended_type_info_typeid@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@serialization@boost@@
.?AV?$singleton_wrapper@V?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@@detail@serialization@boost@@
.?AV?$oserializer@Vbinary_oarchive@archive@boost@@V?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@detail@archive@boost@@
.?AV?$sp_counted_impl_p@Vwindows_shared_memory@interprocess@boost@@@detail@boost@@
.PAUMessageTag@ErrorInfo@KipodLogger@@
.PAUWhatTag@PTL@@
.?AV?$clone_impl@VException@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@@exception_detail@boost@@
.?AVException@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@
.?AV?$Event@VNewLogEvent@KipodLogger@@$0A@@?$Interprocess@UInterprocessName@KipodLogger@@Vwindows_shared_memory@interprocess@boost@@VEmptyErrorPolicy@PTL@@ULowIntegrityLevelAccessPolicy@2@@PTL@@
.?AVProtectChromeDBInfo@@
.?AVProtectKeyInfo@@
.?AV?$sp_counted_impl_p@VHolder@?$HoldPolicy@V?$HandlePolicy@PAUHKEY__@@$0A@P6GJPAU1@@Z$1?RegCloseKey@@YGJ0@ZVRegCloseKeyChecker@Tools@@VOpenRegPolicy@4@@HTL@PTL@@Vshared_ptr@boost@@@Fast@Detail@HTL@PTL@@@detail@boost@@
.?AV?$_Ref_count@V?$ProtectedValues@VUrlLess@Protection@KipodTools@@_W@Protection@KipodTools@@@tr1@std@@
.?AV?$ProtectedValues@VUrlLess@Protection@KipodTools@@_W@Protection@KipodTools@@
.?AV?$sp_counted_impl_p@VProtectKeyInfo@@@detail@boost@@
.?AV?$sp_counted_impl_p@VProtectChromeDBInfo@@@detail@boost@@
.?AUNoChannelSupport@BufferedTransformation@CryptoPP@@
.?AVInvalidKeyLength@CryptoPP@@
.PAVBufferedTransformation@CryptoPP@@
.PAVRandomNumberGenerator@CryptoPP@@
.?AVsettings_pipe_failed@@
.PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>
5 6-636:6
4&484"5|5
<4<8<<<@<
2&383&464
<,>0>4>8><>
535]5&6=6
0d0o0
9œ9j9o9v9}9
3!3&3-3D3}3
: ;$;(;,;0;4;8;
; ;$;(;,;0;4;
=#>(>4>>>
? ?$?(?,?0?4?8?<?@?
:!;&;?;[;`;
11181?1{1
4[4&585_5
<,<2<9<?<
11Z1i1
3<3Z3i3
< <$<(<\=
9!:.:6:>:
>!> >?>}>
#020@0#131|1
7 7$7(7,7
:$:(:,:0:4:8:<:@:
;(;/;4;8;<;];
;&<,<0<4<8<
6%6u7
2#2'2 2/232
4%5U5
303C3
1 1$1(1,1014181<1
2 2$2(2,2024282
: :$:(:,:0:4:
7 7$7(7,70747
=0=8=@=|=
8$8,888\8|8
;$;,;8;\;|;
8,888\8|8
2 2@2\2`2|2
3 3@3\3`3
4 4@4`4|4
5 5(545|5
7$8<8\8|8
777705555443332
5555443332
5555443332
Software\Microsoft\Windows\CurrentVersion\Run
duser32.dll
%s\%s%X%X
\cmd.exe
Web Server Edition
%1%.%2%.%3%
\/:*?"<>|
\\?\UNC\
SOFTWARE\Mozilla\Mozilla Firefox
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe
SOFTWARE\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Chrome.exe
hXXp://
%d.%d.%d.%d
\FirefoxToolbar\
\profiles.ini
\Mozilla\Firefox\
\Google\Chrome\User Data\Default
chrome-extension://%1%/config/skin/new-tab.html
\ChromeExtension
NX
FirefoxExtension
ChromeDS
FirefoxHomepage
FirefoxSE
FirefoxDE
FirefoxKeyword
ChromeStartPages
ChromeStartPages32
ChromeHomepage
ChromePrefs
ChromeNewTab
Firefox/ProtectionEnabled
Chrome/ProtectionEnabled
ff_nt_supported
ie_ds_supported
ff_ds_supported
chrome_ds_supported
ie_hp_supported
ff_hp_supported
chrome_hp_supported
chrome_nt_supported
hXXp://VVV.search.ask.com/?o=APN10640A&gct=hp&d=#sysid#-#appid#&v=#ptype##kbn#-#uc#&t=4
{52db1893-8a90-4192-aede-08e00b8f8#sysid#}
Ask.com
hXXp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=#appid#&systemid=#sysid#&v=#ptype##kbn#-#uc#&apn_uid=#uid#&apn_dtid=BND101&o=APN10640&apn_ptnrs=AG1&q=
hXXp://VVV.search.ask.com/suggest.php?src=ieb&gct=ds&appid=#appid#&systemid=#sysid#&v=#ptype##kbn#-#uc#&apn_uid=#uid#&apn_dtid=BND101&o=APN10640&apn_ptnrs=AG1&qu=
hXXp://dts.search.ask.com/sr?l=dis&o=APN10640&qsrc=2870&apn_dtid=BND101&apn_ptnrs=AG1&apn_uid=#uid#&gct=dns&gc=1&appid=#appid#&sysid=#sysid#&sver=3&q=
{DB3CB725-C39D-434E-80D1-DB271BB972C8}
hXXp://dts.search.ask.com/sr?src=ffb&gct=ds&appid=#appid#&systemid=#sysid#&v=#ptype##kbn#-#uc#&apn_dtid=BND101&apn_ptnrs=AG1&apn_uid=#uid#&o=APN10640&q=
Firefox/Extension
hXXp://VVV.search.ask.com?o=APN10640A&gct=hp&d=#sysid#-#appid#&v=#ptype##kbn#-#uc#&t=4&tag=newtab
hXXp://dts.search.ask.com/sr?src=crb&gct=ds&appid=#appid#&systemid=#sysid#&v=#ptype##kbn#-#uc#&apn_uid=#uid#&apn_dtid=BND101&o=APN10640&apn_ptnrs=AG1&q=
hXXp://VVV.search.ask.com/?o=APN10640A&gct=hp&d=#sysid#-#appid#&v=#ptype##kbn#-#uc#&t=4&tag=newtab
\extensions.sqlite
\extensions.sqlite-journal
Chrome/DefaultSearch
DefaultUrl
DefaultKeyword
\Web Data
\Web Data-journal
Firefox/Homepage
Firefox/HomepageAsked
user_pref("browser.startup.homepage", "$(Value)");
user_pref\("browser\.startup\.homepage", "([^"]*)"\);
\prefs.js
Firefox/SelectedSearch
Firefox/SelectedSearchAsked
user_pref("browser.search.selectedEngine", "$(Value)");
user_pref\("browser\.search\.selectedEngine", "([^"]*)"\);
Firefox/DefaultSearch
Firefox/DefaultSearchAsked
user_pref("browser.search.defaultenginename", "$(Value)");
user_pref\("browser\.search\.defaultenginename", "([^"]*)"\);
Firefox/UrlbarSearch
Firefox/UrlbarSearchAsked
user_pref("keyword.URL", "$(Value)");
user_pref\("keyword\.URL", "([^"]*)"\);
FFUrlbar search
DefaultSuggestionUrl
Chrome/Homepage
Chrome homepage
Chrome/StartPages
Chrome Start Page
session.urls_to_restore_on_startup
Chrome/StartPagesFrom32Version
backup.session.startup_urls
Chrome Start Page Since 32 version
session.startup_urls
Chrome
Chrome/NewTab
404Url
DNSUrl
SearchUrl
NewTabUrl
RelatedSearchUrl
Firefox/BHO
Error404URL
DNSErrorURL
SearchURL
Firefox/BHO/NativeHelper
Firefox/BHO/DnsBHO
Firefox/BHO/SearchBHO
Firefox/BHO/MainBHO
Firefox/BHO/Error404BHO
Firefox/BHO/NewTabBHO
Firefox/BHO/SessionRestore
Cannot open key
Cannot unlock key
Cannot open key for writing
Cannot set key value
Cannot lock key
Cannot delete key value
{B358EFE4-A25E-4fd6-A2CA-71081B7CDB47}_%1%
mscoree.dll
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
nKERNEL32.DLL
WUSER32.DLL
ADVAPI32.DLL
dHKEY_CURRENT_CONFIG
HKEY_DYN_DATA
HKEY_PERFORMANCE_DATA
HKEY_USERS
HKEY_LOCAL_MACHINE
HKEY_CURRENT_USER
HKEY_CLASSES_ROOT
i\\.\pipe\SafetyNutPipe
software\Web Assistant\script_storage
software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\%1%\Software\Web Assistant
{6338b328-94f8-4baf-8705-2dd99277e145}
{7fa0174c-f11b-41a6-bcc7-4023e41c2df7}
Software\Microsoft\Windows\CurrentVersion\Ext\Settings
DependentKey
Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
{4f2fbda2-b7d9-4330-ad7e-67382de0699e}
\Mozilla\Firefox
{a7bcb4f3-1ecf-49ad-8a8b-073d960c91d6}
{7afa8245-3d06-42eb-961a-faa64025aa33}
{5476c609-a0ba-41c5-848e-44c6eaeeaf36}
Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
{98f07288-6e90-498c-a53d-cbf6c8f54eec}L
{98f07288-6e90-498c-a53d-cbf6c8f54eec}R
Software\Mozilla\Mozilla Firefox
{cf22b27b-8143-4cc3-9903-2de08768b93b}L
{cf22b27b-8143-4cc3-9903-2de08768b93b}R
extensions.settings
\Google\Chrome\User Data\Default\Preferences
{c7a9770e-d7ae-4970-a081-c35e2141e293}
Cannot create mutex to control KipodUI instance, error with code %d
@Advapi32.dll
https
Init %s
Current value changed to %s
%s: failed to get current value
\StringFileInfo\xx\CompanyName
Cannot get wow keys
GRiched20.dll
Received event: kn - %s, nv - %s, size - %i
%s: set enabled %i
ILoad in %s
Load vn %s
Load ii %s
Opera
FireFox
Enable %i for %s
IVBoxHook.dll
\\.\VBoxMiniRdrDN
Changes for %s
E:\Work\SearchSuite\G13_Release\SearchSuite\Client\Common\json_parser\JsonPropertyTreeParser.cpp
!valueName.empty()
e:\work\searchsuite\g13_release\searchsuite\client\common\json_parser\JsonPropertyTreeParser.h
E:\Work\SearchSuite\G13_Release\CGL\libs\boost/optional/optional.hpp
!value.empty()
!p.empty() && "Empty path not allowed for put_child."
E:\Work\SearchSuite\G13_Release\CGL\libs\boost/variant/detail/visitation_impl.hpp
!"Boost.Variant internal error: 'which' out of range."
E:\Work\SearchSuite\G13_Release\CGL\libs\boost/variant/detail/forced_return.hpp
%d.%d
logfile.txt
%I%x%
!"#$%&'()* ,
{029ea614-c5b4-4b79-ac5c-d2b17f0fcb01}
{285e37e7-90b6-4318-b84f-941c18ad07e8}
{54a32f25-e2e2-411f-8853-e5f7b32db6a7}
Assertion failed: %s, file %s, line %d
o{029ea614-c5b4-4b79-ac5c-d2b17f0fcb01}
j{029ea614-c5b4-4b79-ac5c-d2b17f0fcb01}
%Program Files%\Movies App\SafetyNut\safetynut.exe
Display the new toolbarJMovies App has detected an attempt to change your browser homepage settingJThis setting controls the website you see each time you open your browser.
%1%^Movies App has detected an attempt to change your default search and browser homepage settingsrThese settings control the website you see each time you open your browser and the searches made via your browser.
add a new add-on or extension to your browser1Enable Movies App Add-on or Extensions protectionLMovies App protects your browser from enabling unwanted Add-on or Extensions$Display the new Add-on or Extensions Do not display the new Add-on or Extensions\An Add-on/Extension is a piece of software which is added into another software application.VMovies App has detected an attempt to enable a new Add-on or Extension on your browserCMovies App has blocked an attempt to
add a new extension to FirefoxJMovies App has blocked an attempt to
add a new add-on or extension to Chrome
5.0.0.13452
safetynut.exe

explorer.exe_1900:

.text
`.data
.rsrc
@.reloc
ADVAPI32.dll
BROWSEUI.dll
GDI32.dll
KERNEL32.dll
NTDLL.DLL
msvcrt.dll
ole32.dll
OLEAUT32.dll
SHDOCVW.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
UxTheme.dll
FTSSh
t0SSh
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
SShwk
98~%SP
ExplorerStartMsgLoop
PSSh;
6SSSSh
SSSSh
SPSSSShL
u%SSh
t.WWWW
xpsp2res.dll
xpsp3res.dll
tbSSh
Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartMenu
Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartPanel
kernel32.dll
GetSystemWindowsDirectoryW
NetGetJoinInformation
WINMM.dll
SETUPAPI.dll
WINSTA.dll
OLEACC.dll
USERENV.dll
ntdll.dll
RegEnumKeyExW
RegNotifyChangeKeyValue
RegOpenKeyExA
RegEnumKeyW
RegCloseKey
RegCreateKeyW
RegQueryInfoKeyW
RegOpenKeyExW
RegCreateKeyExW
OffsetViewportOrgEx
GetViewportOrgEx
SetViewportOrgEx
SetProcessShutdownParameters
GetProcessHeap
GetWindowsDirectoryW
CreateIoCompletionPort
ShellExecuteExW
SHRegCloseUSKey
SHRegCreateUSKeyW
AssocQueryKeyW
SHRegOpenUSKeyW
SHDeleteKeyW
TileWindows
ExitWindowsEx
RegisterHotKey
UnregisterHotKey
EnumChildWindows
GetKeyState
GetAsyncKeyState
CascadeWindows
MsgWaitForMultipleObjects
EnumWindows
explorer.pdb
name="Microsoft.Windows.Shell.explorer"
version="5.1.0.0"
<description>Windows Shell</description>
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
]]"```^]]\
3333333330
3333330
333333334
)@.   '5 !*
.DEHHF>?/
2<===@@=
&$%Uooqkezs
['$$#%&(4
3333333333333333333
33333333333330
7'''')) 
3'')))33.
222`444(555
%%%{///-
000000000
00000000
`[66...00
0000000
`]66./.000
/./././././././.
66///0000
0000000000000
0000000000
6666,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,0.010.010.010.010.010.010.010.010.010.010.001
4366666666K,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6.010.010.010.010.010.010.010.010.010.010.000
:;<;:;<;:;<;:;<;:;<0
)   )   )   )   )
|2222'2'2'2'2'2'2'2'2'2'2'2'2'2'2'2',),),),),),),),),),),),),),),),),),),),),),, 
22222222222
3333333
.SB99;;;99twv}ut{oxt~
.SB;;;:::2:w}{{qddgghg
" """ """ """ """ "" #
""" """ """ "#
.SG>''';;9::p
:5:5:5:5:5:5:5:5:5:5#"
# # # # # # # # # # # # # # # # # # # # # ##$
( # # # # # # # # # # # # # # # # # # # # ###
1232123212321232123
(&(((&(((&(((&(((&((&&)
&(((&(((&(((&()
`,''')))
'4,4'4,4'4,4'4,4'4,4)(
55///0000
5555-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-0
555555555
55555555
5555555
14441444144414441
4343434343434343
5555555555555
5555555555
-,-,-,-,-,-,-,-,-,-,-*.
..............................JFJFJFJFJFJFJFJFJFJFJ.-
{22*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-../
|ujjjjuhF..BBBBBBBBBBBBT
~j|F.BB*BBB*BBB*Bwop
&!!!&!!!&
44466666
44444444416
4446666
66666666
|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= 
|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= 
DDDDE%CTDD@
A%US$
%UUUU
%%UUU
33U
""2222!!
!"!"%UUR""
!""!"#2"""
"!!"#3"!"
dnnnnn:n.nfCnmddddd
////;/;;88
;888;;!/
!//!!;;^
:;:!::!!!
.88.88.8
.N.NN.M
::8.8...
:::!;;:!
//!!;888
.8.8.88...
:;!::!!;!//!;
!!;:!!::
.88..8..
!!:::/^!
!;/;!;;;!!!:
.8:!!!!^
!!:;:::..
/:!^^!;{8{../
...:::.-
**6***66*6**6566*5666 ,
6*6666*6*6 655*65
6*65 56*5 55  555 *5  6
555( 55 (5 5(  
76 5   66  555*677
6*6 5 5(5 (55( '5((5 (556 ('5
665**6(('S((((((S(((]('((@('SS((S(((((((6C-.NEC66S5sU
555(555(5((5(5(5(
5 5 5 5555 (555(555'(((5(5('55(((
((''('5'5(5('('('('('((''('(((@(((('&(((&
%&&%&&&&3>&3&3&33&3&3333&&3>3333
'(3&'&3&
3&33&&((
3323>33>%>3%>3>33>3%3&%
*5'(('((&@3(
,63%3>323>3%>&>33323>>%>
3(3'(((@@'5('@(@(&('(
>2>323%>3
75((((@3&333&3&&&%&3&&3&33>33%3>23%>3
>2%$32%>2>%>2$3>
3&%&&3&33>3>33
3>%>3%&3$23>23$2>2%$>2>
)4433((&(&('*
('((((''(**6(('' *
32323>3>
2$%>22%>%3' (
&(&''((5(5 *
'(&(&((&('''
&&%&3&&%3%
2%>22>22
5''3(((3(('&(&'&
3%%3%3%2#$
22$22$2%$22$2%2%$2%$2$222%$22
&>2$2$2$222$22$%%
:7'((('(3('(3(&(&
222222222222
22222222222222
222222222222222
22$22$22$22$
&(%3%&&&&3&&&3%3
222222222222222222
&&(&3(&(&'('((3'(&&
2222222
22$<$$2$22$%
&&(3(3('(&'
222"2212
22<2<22"
(&(3(3((
((565 ((( 6
333&33(&&
'(('('(('( 
 '&%%"$
2"2"22"2
2222<2"222
"2"22<2<22
2%('(3'32222?&'
2"2"2"121212<
2"2"2$"?
%%22%2
&3(3(3((&
"2"<"2<2<
<2<"<"<"<
1"?((&21
<?<?22<$2
2%""22&&
2<2$$2222
'&('(3(''
((%%%"
5(3%"%
"2%5*67
))) ))))
""**<****"""
"*<<<<*"
#2#---2222-222442-
--&#-(-%
$/222(--444222!
#&-221269924999;
&$-22-($2%
#(2---222622212-
#2221299629968
#&--%#(2##!
-222422422426662-%
"2-##&
!##-#&#-&&#%---#---#&-219662%
$&-(151,44.9
&1242662-
-(..19.19
,4492.12
12-$-,-,
-, $$----
#%#-15/-&
-,(,,(,(,
$$11651566/,$&&
,2592&&&-
2466/!$$
""*<*"****""
) '????[
&&&$-556>>61,,5994511-
$(//$$$(6>6/,$,-$
#$-22692/,,$,-&
-266661..4514#
&,2-&&##
&-222,22--#
#&&---2-,-&$&(,,291.566..BNNNTNNNNNAABIAA88
&!#&!-##
&#--//11468>885882&
$266961$&--$&%
,1661,!-((#
&$,4255$,92
&$,44..&
""**""***""
"****<*<<**"
"**""""*""""
&-569./-,16522$
.BAA=86546888=AAAEAAEMNRMQQSWZZ\]gk__m__\
bTRHHHHHQQHQJQWJSSSSSSSSSSSSSSSSWWSSSS\\V]VZW8,.FW]\\]\]\]\\ZZ\\WFR>38(
.BTTkgn]ktvgmvvvvvmvvvsvzzzyzyzyzyyyzmkkkkkZSRA816;F87
yzyzyzym^Z]WN3   $&$.Wt\
""*"""****""""
"***"**""**<**"
$5612,.2,
&$$,,,5]
$]t.Ft
7%8U8
3 303<3]3
2<3
8 8$8(8,8084888<8}8
5%5,575{6
<,<0<4<8<
7 7$7(7,70747
rundll32.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
::{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}
::{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}
::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
::{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}
::{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}
::{D20EA4E1-3957-11d2-A40B-0C5020524153}
::{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}
{208D2C60-3AEA-1069-A2D7-08002B30309D}
{20D04FE0-3AEA-1069-A2D8-08002B30309D}
Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites
{450D8FBA-AD25-11D0-98A8-0800361B1103}
CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}
Software\Microsoft\Windows\CurrentVersion\RunOnce
Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
Software\Microsoft\Windows\CurrentVersion\Explorer\DontShowMeThisDialogAgain
Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\CleanupWiz
\\.\WMIDataDevice
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Software\Microsoft\Windows NT\CurrentVersion\Windows
ExplorerIsShellMutex
desk.cpl
Software\Microsoft\Windows\CurrentVersion\Explorer
tourstart.exe
tourstart.exe,0
Microsoft.OfferTour
WINWORD.EXE
Software\Microsoft\Windows\CurrentVersion\Applets
Software\Microsoft\Windows\CurrentVersion\Applets\Tour
explorer.exe,9
Microsoft.FixScreenResolution
shell:::{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}
Software\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation
Software\Microsoft\Windows NT\CurrentVersion
shell:::{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}
Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
DDEEXECUTESHORTCIRCUIT
http\shell
IEXPLORE.EXE
Software\Microsoft\Windows\CurrentVersion\Explorer\Streams\Desktop
Software\Microsoft\Windows\CurrentVersion\RunOnceEx
comctl32.dll
Software\Microsoft\Windows\Internet Settings
AutoConfigURL
system.ini
AppEvents\Schemes\Apps\.Default\%s\.current
Software\Microsoft\Windows\CurrentVersion\Explorer\TrayNotify
MSShellRunDlgReady
res://mys.dll/mys.hta /explorer
mshta.exe
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Setup\Welcome
Software\Microsoft\Windows\CurrentVersion\Explorer\Tips
SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\MYS
cys.exe
SOFTWARE\Microsoft\Windows NT\CurrentVersion\srvWiz
install.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel
OUTLOOK.EXE
explorer.exe,16
iernonce.dll
WININET.DLL
UpdateURL
WindowsUpdate
HWND%x
Software\Microsoft\Windows\CurrentVersion\OemStartMenuData
fldrclnr.dll,Wizard_RunDLL
iexplore.exe
winbrand.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\Remote\%d
shell32.dll
nusrmgr.cpl ,initialTask=ChangePicture
NewExeName
Windows
ediskeer.dll
timedate.cpl
Software\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\LastVisitedMRU
Software\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\OpenSaveMRU
Software\Microsoft\Windows\CurrentVersion\Explorer\Doc Find Spec MRU
Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
Software\Microsoft\Internet Explorer\TypedURLs
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Calculator.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Games\Solitaire.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Paint.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\WordPad.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\Files and Settings Transfer Wizard.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Windows Movie Maker.lnk
%USERPROFILE%\Start Menu\Programs\Accessories\Tour Windows XP.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Windows Messenger.lnk
%USERPROFILE%\Start Menu\Programs\Windows Media Player.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\MSN.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Get Online with MSN.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Get Going with Tablet PC.lnk
%ALLUSERSPROFILE%\Start Menu\Set Program Access and Defaults.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Windows Journal.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Media Center\Media Center.lnk
%USERPROFILE%\Start Menu\Programs\Internet Explorer.lnk
Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel
TSAppCMP.DLL
netapi32.dll
%SystemRoot%\system32\restore\rstrui.exe
RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL ?0x%X?%s
RunDLL32.EXE
%s%d%s
Software\Microsoft\Windows\CurrentVersion\Policies\System
settings.dll
explorer.exe "
explorer.exe /e, "
WindowsLogon
WindowsLogoff
%s %s
Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count
uAppWiz.Cpl
\explorer.exe
Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu
::{20D04FE0-3AEA-1069-A2D8-08002B30309D}
taskmgr.exe
ShellExecute
Software\Microsoft\Windows\CurrentVersion\Explorer\AppKey\%d
\WindowsShell.Manifest
Get Online with MSN.lnk
Set Program Access and Defaults.lnk
Link%d
OEM%d
Software\Microsoft\Windows\CurrentVersion\SMDEn
::{D20EA4E1-3957-11d2-A40B-0C5020524152}
%WinDir%\explorer.exe
There is a file or folder on your computer called "%s" which could cause certain applications to not function correctly. Renaming it to "%s" would solve this problem. Would you like to rename it now?
Ca&scade Windows
Tile Windows &Horizontally
Tile Windows V&ertically
&Windows Security...
&Help and Support
&Log Off %s...
Windows Explorer
6.00.2900.5512 (xpsp.080413-2105)
EXPLORER.EXE
Windows
Operating System
6.00.2900.5512
Keep the &taskbar on top of other windows
To remove records of recently accessed documents, programs, and Web sites, click Clear.
Windows displays icons for active and urgent notifications, and hides inactive ones. You can change this behavior for items in the list below.
Select this option to use the menu style from earlier versions of Windows.
6There is not enough memory to complete this operation.8Unable to run command.
The folder '%1' has been removed.WMy Computer or Windows Explorer has not been properly initialized yet. Try again later.
&Undo %s
Windows is running in safe mode.
This special diagnostic mode of Windows enables you to fix a problem which may be caused by your network or hardware settings. Make sure these settings are correct in Control Panel, and then try starting Windows again. While in safe mode, some of your devices may not be available.
startRThere was an internal error and one of the windows you were using has been closed.
Restrictions{This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.
&Show Open Windows
Windows was unable to change the display settings for the new configuration. Return the computer to the previous state, shut down Windows, and restart the computer in the desired configuration.
There may be a problem with your display settings if you continue. To safely change to a new configuration, you should shut down Windows and restart the computer in the desired configuration. Do you want to continue anyway?
This pre-release version of "Internet Explorer 4.0" Desktop/Explorer has expired. Please update to the latest release of "Internet Explorer 4.0" from WWW.MICROSOFT.COM
helpctr.exe>-FromStartHelp
Take a tour of Windows XP
NOpens a window where you can pick search options and work with search results.aOpens a central location for Help topics, tutorials, troubleshooting, and other support services.
/Opens a program, folder, document, or Web site.
Provides options for closing your programs and logging off, or for leaving your programs running and switching to another user.lProvides options for turning off or restarting your computer, or for activating Stand By or Hibernate modes.RDisconnects your session. You can reconnect to the session when you log on again.
&Windows Security
iOpens the My Documents folder, where you can store letters, reports, notes, and other kinds of documents./Displays recently opened documents and folders.KOpens the My Music folder, where you can store music and other audio files.]Opens the My Pictures folder, where you can store digital photos, images, and graphics files.zGives access to, and information about, the disk drives, cameras, scanners, and other hardware connected to your computer.MGives access to, and information about, folders and files on other computers.8Connects to other computers, networks, and the Internet.

rundll32.exe_2332:

.text
`.data
.rsrc
msvcrt.dll
KERNEL32.dll
NTDLL.DLL
GDI32.dll
USER32.dll
IMAGEHLP.dll
rundll32.pdb
.....eZXnnnnnnnnnnnn3
....eDXnnnnnnnnnnnn3
...eDXnnnnnnnnnnnn,
.eDXnnnnnnnnnnnn,
%Xnnnnnnnnnnnnnnn1
O3$dS7"%U9
.manifest
5.1.2600.5512 (xpsp.080413-2105)
RUNDLL.EXE
Windows
Operating System
5.1.2600.5512
YThere is not enough memory to run the file %s.
Please close other windows and try again.
9The file %s or one of its components could not be opened.
0The file %s or one of its components cannot run.
MThe file %s or one of its components requires a different version of Windows.
UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"
Error in %s
Missing entry:%s
Error loading %s


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Scan a system with an anti-rootkit tool.
  2. Terminate malicious process(es) (How to End a Process With the Task Manager):

    %original file name%.exe:1152
    imapi.exe:2352
    mediabar.exe:244
    patch_ff.exe:2300
    MoviesToolbarMediaBar.exe:296
    MoviesToolbarMediaBar.exe:380
    MoviesToolbarMediaBar.exe:212
    SafetyNutManager.exe:1572
    SafetyNutManager.exe:908
    regsvr32.exe:1280
    regsvr32.exe:1636
    rundll32.exe:2332
    pack.exe:140

  3. Delete the original Backdoor file.
  4. Delete or disinfect the following files created/modified by the Backdoor:

    %Documents and Settings%\%current user%\Local Settings\Temp\nsw4\Helper.dll (66604 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\1B.tmp (4545 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\1E.tmp (4545 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\16.tmp (4545 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsw4\nsk8.tmp\pack.exe (112669 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsw4\CHAppConfirm.exe (16944 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\12.tmp (4545 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\15.tmp (4545 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\14.tmp (4545 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsw4.tmp\System.dll (11 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\10.tmp (4545 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\21.tmp (4545 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\D.tmp (4545 bytes)
    %Program Files%\Movies App\SafetyNut\Helper.dll (15116 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsw4\nsk8.tmp\mediabar.exe (69109 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\C.tmp (4545 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\1F.tmp (4545 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\F.tmp (4545 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\9.tmp (4545 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsw4\Starter.exe (4992 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\1D.tmp (4545 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsc2.tmp (351881 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\11.tmp (4545 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\1C.tmp (4545 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsw4.tmp\UserInfo.dll (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\A.tmp (4545 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\19.tmp (4545 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KXYJW12F\install_statistics[1].xml (498 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\B.tmp (4545 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\13.tmp (4545 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsw4.tmp\registry.dll (784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\18.tmp (4545 bytes)
    %Program Files%\Movies App\SafetyNut\Uninstall.exe (4992 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\E.tmp (4545 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\17.tmp (4545 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\1A.tmp (4545 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\20.tmp (4545 bytes)
    %WinDir%\Temp\8l737cjp.TMP (146970 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsw4\nsk8.tmp\MoviesToolbarMediaBar.exe (17083 bytes)
    %WinDir%\Temp\nsg2D.tmp\registry.dll (784 bytes)
    %WinDir%\Temp\nsg2C.tmp (3615 bytes)
    %WinDir%\Temp\nsg2D\Helper.dll (15116 bytes)
    %WinDir%\Temp\nsg2D.tmp\System.dll (11 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\remove.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\skin-bluesky.png (3 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\scroll-bg-206.png (663 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_14.png (270 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\logo-over.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\footer-short-middle.png (968 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\sprite-dropdown.png (2 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\icon-play.png (290 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\menuitemleft.png (323 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\css\ie-only.css (153 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\like.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_15.png (344 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\scrollt.png (893 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\lib\dtxprefwin.xul (307 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\scroll-bg.png (663 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\button-splitter-vista.png (264 bytes)
    %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F (176 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\bg-pnl520x350blue.png (3 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\bg-btnover-start.png (352 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\js\jquery.qtip.min.js (1552 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\Koyotesoft_Icon_16x16.png (723 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\tab-on-r.png (278 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\DTX\Reporting\ReportingHelper.dll (6584 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\settings_stb_19x_over.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_06.png (316 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\btn-widgets-over.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\facebook.png (235 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\TRUSTe_about.png (5 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\powered-by-weatherbug.png (3 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\options-weather.png (2 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\searchtheweb.png (664 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\metacafe.gif (125 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\popupHTML.html (802 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_09.png (288 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\menul-bgover.png (168 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\manifest.xml (2264 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\imap.png (278 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\over-blue.png (163 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\divider.png (134 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-drag.png (486 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\menuitemback-vista.png (209 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\locale\locale.js (257 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\lib\dtxpanel.xul (573 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\btn-search.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-close-grey.png (283 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\searchbar\searchbar-background-right.png (288 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\btn-settings.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\ico-news24.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\youtube.png (608 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsq23.tmp (140992 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\win-top-middleglow.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\btn-close-greyover.png (460 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\lib\dtxwin.xul (387 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\win-right-topglow.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\ico-hotandhumid-s.png (2 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\js\jquery.js (3312 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\arrow-right-disabled.gif (46 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\logo-separator.png (582 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\tab-off-l.png (205 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\throbber.gif (825 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\bg-btnover-mdl.png (210 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_21.png (300 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\button-splitter-down-vista.png (261 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-dark-left22.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-dark-right22.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\featured-bg-btm-gradient.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\win-right-middleglow.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\minus.gif (152 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\ask_logo_18x14.png (634 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\searchtheweb.png (664 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-close.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-back.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\ico-pref-over.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\btn-search-over.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\panel-botm-noscroll.png (448 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\highlight_magenta.png (302 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\win-btm-right-resize.png (214 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\tv.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\setting_stb_16x.png (999 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\btn-search-pnlbtm-over.png (3 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\launchers.css (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\gmail.png (741 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\apps-bg-gradient-grid.png (995 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_16.png (278 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\searchbox.png (2 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\options\options-weather.gif (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\arrow-up.gif (46 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\searchboxlite_end.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\settings_stb_19x.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\add.png (653 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\trackid.dat (6 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\scroll-left.png (257 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\titlebar-right.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\options\options-search.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\icon-shop.png (233 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\resize-box.gif (92 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\trailer.png (684 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\bg-btn-end.png (299 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-launch-over.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-next.png (471 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\ttlbar-mdl.png (146 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\modules\nsDragAndDrop.js (784 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\edit-back.png (214 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\highlight_lime.png (300 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\icons\weather.png (3 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\transparent_1px.gif (45 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\reload.png (905 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\ajax-loader.gif (6 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\arrow-up.gif (46 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\ttlbar-left.png (266 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\rss.png (832 bytes)
    %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F (533 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\categories-bg-gradient-grid.png (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\AccessControl.dll (9 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-install.png (2 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\scrollb.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\btn-wide-close.png (857 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\initHTML.html (481 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\toolbarsplitter.gif (76 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\appsfeatured-bg-gradient-grid.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\arrow-right.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\gameData.js (784 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\view-thumb-on.png (402 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\modules\datastore.jsm (3 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\options-search.png (4 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\3_Free_FLV_Converter.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\titlebar-right.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\btn-delete.png (196 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\bullet-orange.gif (43 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\win-right-bottomglow.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\main.html.bak (2 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\data\search\search.xsl (955 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\data\search\engines.xml (3 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\custom.js (784 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\scrollt-disable.png (832 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_18.png (312 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\ico-info.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\btn-close-greyover.png (444 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\lib\rsswin.xml (2 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\gamecategory.xsl (700 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\highlight_cyan.png (299 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-dark-middle22.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\footer-short-left.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\star_x_grey.png (328 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\js\jquery.tinyscrollbar.min.js (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\nsisFirewall.dll (8 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\scrollb-down.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\1_Free_Video_Converter.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\js\default.js (784 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\components\windowmediator.js (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\locale\toolbar\fr.js (2 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\star_x_orange.png (367 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\ico-box-next.png (791 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\add.png (653 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-search-pnlbtm-over.png (3 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\6_Easy-Audio-MP3-WMA-OGG-Cutter.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\transparent.gif (49 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-close-grey-over.png (457 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\dtuser.exe (33888 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\{a4ad8fd9-b395-43e3-88b5-240710b48e27}\geodata.xml (162 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\bg.gif (8 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\inetc.dll (784 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\locale\toolbar\de.js (2 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\btn_slider.png (763 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton.css (2 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\btnright-vista.png (309 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\template.xml (810 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\video.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\lib\external.js (24832 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\scroll.png (455 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\arrowr-bluew5.png (205 bytes)
    %Documents and Settings%\%current user%\Application Data\somotoimeshmoviestoolbar\sysid.dat (3 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\btnarrow-previous.png (683 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\paneltemplate.html (5 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\arrow-sml.png (211 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\btn-widgets.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\btn_settings.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\rsschannelback.png (604 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\templateFF.html (6 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\bg-btnover-mdl_ff.png (179 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\partner.xml (218 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\install.ico (8 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\options\options-widgets.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\data\weather\icons.xml (6 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\2_Free_FLV_Player.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\vmn.css (9 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\move.gif (58 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\titlebar-left.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\like_over.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\locale\toolbar\en.js (4 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\titlebar-left.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\appid.dat (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\icons\na-s.png (4 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\bg-btnover.png (179 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\view-detailed-over.png (451 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\options\options-main.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\tab-on-l.png (167 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\footer.htm (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\bg-btn-divider.png (205 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-close-greyover.png (457 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\as_guid.dat (38 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\lib\rsspreview.html (241 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\search.png (712 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\lib\dtxtransparentwin.xul (657 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-play-left.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\titlebar-middle.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\System.dll (11 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\menu_bg-basic.png (446 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\review.png (812 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\scripts\defscript.js.bak (3 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\sv.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\lib\rsswin.xsl (7 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\lib\neterror.xhtml (344 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\menul-bgon.png (179 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-dark-right22-over.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\titlebar-middle.png (999 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\uninstall.exe (7801 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\radio.png (355 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\InetLoad.dll (784 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\bg-scrollbar-thumb-y.png (966 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\icons\na.png (784 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\scroll-topwin.png (951 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\lastsearch-thumb-back.gif (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\ask_search_212wide.png (671 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\expand.png (303 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\menuitemright-down-vista.png (252 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\ico-info-over.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\search-go.png (840 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\web.png (566 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\ocode.xml (390 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\ico-hotandhumid.png (784 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\bg-pnl520x390.png (3 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\close-hot.png (579 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-dark-left22-over.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\icon_games.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\ask_logo_24x20.png (682 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\5_FREE_WMA_MP3_Converter.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\star.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\toolbar.xml (784 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-search-pnlbtm.png (916 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\searchbox-pnlbtm.png (532 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\websearch.png (853 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\logo.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\css\ie7-only.css (136 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-launch.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\orange.gif (153 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\bg-btnover-end.png (284 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\skin-yellow.png (3 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\weather-contour.png (431 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\dtx.css (784 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\view-thumb-over.png (380 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\widgets.png (447 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\blank.gif (55 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-addtoolbar-right.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\popupGames.html (10 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\over-orange.png (169 bytes)
    %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\62B5AF9BE9ADC1085C3C56EC07A82BF6 (224 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\bluesky.gif (153 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\left-menu-hover.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\throbber.gif (825 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\icon-Add.png (228 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\js\jquery.url.js (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\neterror.xhtml (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\bg-btn-start.png (342 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\hotmail.png (297 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\bg-aboutbox.png (2 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\btn-search-pnlbtm.png (916 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_19.png (299 bytes)
    %Documents and Settings%\%current user%\Application Data\somotoimeshmoviestoolbar\setupCfg.xml (557 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-right-over.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\notifylabel-right.png (267 bytes)
    %Documents and Settings%\%current user%\Application Data\somotoimeshmoviestoolbar\geodata.xml (162 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\45MNWPEZ\geolocation[1].xml (162 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\radio-checked.png (336 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\ico-play.png (248 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\apnuserid.dat (16 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\btn-widgets.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\ico-pref.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\notifylabel_ff.png (210 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\modifyhot.png (149 bytes)
    %Documents and Settings%\%current user%\Application Data\somotoimeshmoviestoolbar\apnuserid.dat (16 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\btn-close-grey.png (263 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\menuitemleft-down-vista.png (289 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\vmnrsswin.xml (2 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\movetarget.png (507 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\arrowr-bluew5.png (205 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\bg-btn-mdl.png (205 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\skin-grey.png (3 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\default.png (867 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_11.png (284 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\bg-scrollbar-track-y.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\toolbarsplitter.png (763 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_10.png (250 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-mdl-over.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\skin-lichen.png (3 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\icon-Info.png (218 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\apps-hover.png (2 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_07.png (254 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\ttlbar-right.png (286 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_02.png (248 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\bg-btnover-divider.png (240 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\searchbox-pnlbtm.png (532 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\rename.gif (223 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\css\popupWidgets.css (9 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\lib\about.xml (5 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\win-left-bottomglow.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\lock.png (316 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\dtx-test.css (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-moredetails.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\yellow.gif (153 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\proxy.html (354 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-add-over.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\checkmark.png (309 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\icons\icons.xml (6 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\edit-back-hot.png (217 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-previous.png (476 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\lib\dtxpaneltransparent.xul (653 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\css\jquery.qtip.css (13 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\search-over.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\icons\cond999.png (3 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\vmncode.js (7 bytes)
    %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\62B5AF9BE9ADC1085C3C56EC07A82BF6 (133 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\dislike.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\text-ellipsis.xml (423 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\scroll-right.png (258 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\ico-calendar.png (566 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\btn_settings_17padding_18pxheight.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\rsstabdivider.gif (85 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\win-bottom-middleglow.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\powered-by-weatherbug2.png (3 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\highlight_blue.png (309 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\scrollb-disable.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\veoh.png (790 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\logo_movies_18h.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\btnback-down-vista.png (207 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\menuseparatorback.gif (165 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\box-uncheck.png (160 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\tab-off-r.png (312 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\lib\custom.js (784 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-mdl.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\gamethumb-on.png (2 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\skin-bluelite.png (3 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\modify.png (708 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\toolbar.htm (722 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\star_blank.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\win-btm-right.png (205 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\chevron.png (191 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\searchresultstb.dll (19096 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\plus.gif (157 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\lib\emailnotifierproviders.xml (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\template.xml (144 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\js\jquery.tinyscrollbar.js (5 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\ico-dollar.png (3 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\btnleft-vista.png (307 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\arrow-down-white.png (982 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\nsProcess.dll (4 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\ico-download.png (692 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\btn-close-grey.png (279 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\menuitemback-down-vista.png (202 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\modify.png (724 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\button-splitter.png (264 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\dislike_over.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\widgets-square-24px.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\4_Free_CD_DVD_burner.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\blip.png (315 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\menuitem-splitter.png (136 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\btnarrow-next-off.png (607 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\css\panels.css (5 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-add.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_13.png (277 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\born_star.png (782 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\lib\wmpstreamer.html (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\ioSpecial.ini (26 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\btnarrow-previous-off.png (649 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-addtoolbar-left-over.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\video_tool.png (557 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\menuitemright-vista.png (309 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\radio-unchecked.png (313 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\options\options-weather.png (2 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\lib\dtxpanelwin.xul (407 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\somotoimeshmoviestoolbar-manifest.xml (9 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\ico-joystick24.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\bg-scrollbar-trackend-y.png (964 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\gameList.xsl (7 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\win-left-topglow.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\scrollb-over.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\bg-pnl520x350blue-whitebg.png (4 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_12.png (173 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\radiobeta-stopped.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\arrow-sml-drop.png (188 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\search_icon.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\loadingMid.gif (7 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\btn-close.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-dark-middle22-over.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\icon-download.png (251 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\grey.gif (152 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\locale\lib\en.js (14 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\separator.png (139 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\pop.png (543 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\template.html.bak (7 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\debugbar\debug.html (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\locale\toolbar\it.js (2 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\TRUSTe_about.png (152 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\loadingMid.gif (7 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\btnback-vista.png (207 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\RSSLogo.png (7 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\popupWeather.html (784 bytes)
    %Documents and Settings%\%current user%\Application Data\somotoimeshmoviestoolbar\appid.dat (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\preferences.xml (663 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\dailymotion.gif (138 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\win-btm-mdl.png (118 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\xml.dll (784 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\settings.png (3 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\view-detailed-on.png (496 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\images.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\ico-user-monitor.png (853 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-try-left-over.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\bg-btn-mdl_ff.png (203 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-play-left-over.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\bg-pnl.png (7 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\arrow-dn.gif (46 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\css\dialog.css (3 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\mailcom.png (254 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\throbber.gif (825 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\searchbar\searchbar-background-left.png (286 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_08.png (328 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\btnarrow-next.png (643 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\win-left.png (114 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\gamethumb2-over.png (574 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\find-videos.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\ask_search_215wide.png (671 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\widgets-square-16px.png (690 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\close-normal.png (585 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-previous-over.png (440 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\menu_separator_bar.png (129 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\highlight.png (811 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsf24.tmp\UAC.dll (784 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\arrow-right.gif (46 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\scrollt-down.png (864 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\skin-orange.png (3 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\yahoo.png (244 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\win-btm-left.png (204 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\content\toolbar.xul (24832 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\bg-pnl520x350.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\notifylabel-left.png (274 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\vimeo.gif (255 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\locale\toolbar\es.js (2 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\btn-search.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\alexabutton.css (596 bytes)
    %Documents and Settings%\%current user%\Application Data\somotoimeshmoviestoolbar\guid.dat (38 bytes)
    %Documents and Settings%\%current user%\Application Data\somotoimeshmoviestoolbar\trackid.dat (6 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\win-right.png (114 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\btn-settings-over.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\footer-short-middle.png (968 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\popupWeather.css (7 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\ebay.png (3 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\topbar-inside-gradient.png (964 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\notifylabel-middle.png (203 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\css\popupAbout.css (907 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\break.gif (582 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\bluelite.gif (153 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\scrollt-over.png (892 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\searchresultsDx.dll (4992 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\arrow-dn.gif (46 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\btnleft-down-vista.png (310 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\btn-widgets-over.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\searchboxlite.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\highlight_yellow.png (309 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\btn-close-over.png (3 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\thumb-up.png (754 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\collapse.png (264 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\menu_separator_white.png (133 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\gametype.xsl (681 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-next-over.png (442 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\footer-short-left.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\icons\na-t.png (5 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\found.png (902 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\logo-separator.png (566 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_20.png (287 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\popupWidgets.html (14 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\footer-short-right.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\btnright-down-vista.png (289 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\menuitemleft-vista.png (307 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\custom.css (8 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\ico-tags.png (209 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-addtoolbar-left.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\searchbar\searchbar-background-middle.png (152 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lichen.gif (153 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\css\popupGames.css (7 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\ico-check.png (248 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\twitter.png (721 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_03.png (218 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-try-left.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\shadow-leftmenu.png (963 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\modify-save.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\tb_icon.png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\sysid.dat (3 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\js\jquery.uniform.min.js (9 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images\box-check.png (174 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\btn-close-over.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\arrow-left.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\win-left-middleglow.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\btn_ask_search.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\default\images\btn-wide-close-over.png (873 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\panels\images\footer-short-right.png (1 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\logo-about.png (3 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\aol.png (648 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\skin.xml (3 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\IE\chrome\skin\lib\uwa\border_04.png (293 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsq2A.tmp\toolbar.xml (784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsq2A.tmp\inetc.dll (784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsa29.tmp (131002 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsq2A.tmp\xml.dll (784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsq2A.tmp\UAC.dll (784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsq2A.tmp\System.dll (11 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsq2A.tmp\ocode.xml (390 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsy27.tmp\toolbar.xml (784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsy27.tmp\System.dll (11 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsy27.tmp\xml.dll (784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsy27.tmp\UAC.dll (784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsy27.tmp\inetc.dll (784 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\uninstall.exe (7801 bytes)
    %Program Files%\Movies App\SafetyNut\SRTOOL~1\install.ico (8 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsy27.tmp\ocode.xml (390 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nss26.tmp (140992 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsy27.tmp\AccessControl.dll (9 bytes)
    %WinDir%\Temp\cd681a53\patch_ff.exe (72036 bytes)
    %Documents and Settings%\All Users\Application Data\SafetyNut\general.cfg (1 bytes)
    %Documents and Settings%\All Users\Application Data\SafetyNut\S-1-5-21-1844237615-1960408961-1801674531-1003.cfg (3978 bytes)
    %Documents and Settings%\All Users\Application Data\SafetyNut\coordinator.cfg (1864 bytes)
    %Documents and Settings%\%current user%\Application Data\somotoimeshmoviestoolbar\dtx.ini (15 bytes)
    %Program Files%\Movies App\SafetyNut\safetycrt36.dll (5369 bytes)
    %Program Files%\Movies App\SafetyNut\safetyldr.dll (19 bytes)
    %Program Files%\Movies App\SafetyNut\x64\Internet Explorer Settings Update.exe (11142 bytes)
    %Program Files%\Movies App\SafetyNut\favicon.ico (1 bytes)
    %Program Files%\Movies App\SafetyNut\Internet Explorer Settings Update.exe (9662 bytes)
    %Program Files%\Movies App\SafetyNut\safetynut.exe (27527 bytes)
    %Program Files%\Movies App\SafetyNut\SafetyNutManager.exe (32108 bytes)
    %Program Files%\Movies App\SafetyNut\safetynut.dll (18275 bytes)
    %Program Files%\Movies App\SafetyNut\x64\Internet Explorer Settings.exe (11715 bytes)
    %Program Files%\Movies App\SafetyNut\safetynut_ie.dll (18283 bytes)
    %Program Files%\Movies App\SafetyNut\x64\safetyldr_u.dll (22 bytes)
    %Program Files%\Movies App\SafetyNut\configmgrc2.cfg (34 bytes)
    %Program Files%\Movies App\SafetyNut\x64\safetycrt.dll (5937 bytes)
    %Program Files%\Movies App\SafetyNut\x64\configmgrc2.cfg (42 bytes)
    %Program Files%\Movies App\SafetyNut\Internet Explorer Settings.exe (9685 bytes)
    %Program Files%\Movies App\SafetyNut\x64\safetycrt36.dll (6469 bytes)
    %Program Files%\Movies App\SafetyNut\safetycrt.dll (4511 bytes)
    %Program Files%\Movies App\SafetyNut\x64\safetyldr.dll (1426 bytes)
    %Program Files%\Movies App\SafetyNut\safetyldr_u.dll (19 bytes)
    %Program Files%\Movies App\SafetyNut\x64\safetynut.dll (17310 bytes)
    %Program Files%\Movies App\SafetyNut\x64\safetynut_ie.dll (19440 bytes)

  5. Remove the references to the Backdoor by modifying the following registry value(s) (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "AutoRestartShell" = "1"

  6. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  7. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.