1.2
低危

15c1cee5836f96a385af995d1eb84bbc22a452e16334b83e392d17bc9b6b9c73

15c1cee5836f96a385af995d1eb84bbc22a452e16334b83e392d17bc9b6b9c73.exe

分析耗时

194s

最近分析

374天前

文件大小

1.2MB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN WORM RIDNU
鹰眼引擎
DACN 0.12
FACILE 1.00
IMCLNet 0.87
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Malware:Win32/km_2ca3f6.None 20190527 0.3.0.5
Avast Win32:Malware-gen 20240216 23.9.8494.0
Baidu None 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (W) 20231026 1.0
Kingsoft None 20230906 None
McAfee Artemis!BAFC08FBD75C 20240216 6.0.6.653
Tencent Malware.Win32.Gencirc.10b0ea0b 20240216 1.0.0.1
行为判定
动态指标
该二进制文件可能包含加密或压缩数据,表明使用了打包工具 (5 个事件)
section {'name': '.CryptX', 'virtual_address': '0x00001000', 'virtual_size': '0x00020000', 'size_of_data': '0x0000c200', 'entropy': 7.995672918745246} entropy 7.995672918745246 description 发现高熵的节
section {'name': '.CryptX', 'virtual_address': '0x00021000', 'virtual_size': '0x00002000', 'size_of_data': '0x00000c00', 'entropy': 7.936296214020559} entropy 7.936296214020559 description 发现高熵的节
section {'name': '.CryptX', 'virtual_address': '0x00023000', 'virtual_size': '0x0000a000', 'size_of_data': '0x00002600', 'entropy': 7.98290340625035} entropy 7.98290340625035 description 发现高熵的节
section {'name': '.CryptX', 'virtual_address': '0x00030000', 'virtual_size': '0x00005000', 'size_of_data': '0x00004600', 'entropy': 6.9146549057422115} entropy 6.9146549057422115 description 发现高熵的节
entropy 0.9936708860759493 description 此PE文件的整体熵值较高
网络通信
与未执行 DNS 查询的主机进行通信 (1 个事件)
host 114.114.114.114
文件已被 VirusTotal 上 63 个反病毒引擎识别为恶意 (50 out of 63 个事件)
ALYac Gen:Trojan.Malware.nvZca8qd8yki
APEX Malicious
AVG Win32:Malware-gen
AhnLab-V3 Worm/Win32.Ridnu.C125843
Alibaba Malware:Win32/km_2ca3f6.None
Antiy-AVL Worm/Win32.AutoRun
Arcabit Trojan.Malware.nvZca8qd8yki
Avast Win32:Malware-gen
Avira TR/Crypt.CFI.Gen
BitDefender Gen:Trojan.Malware.nvZca8qd8yki
BitDefenderTheta AI:Packer.54BF063E1C
Bkav W32.AIDetectMalware
CrowdStrike win/malicious_confidence_100% (W)
Cybereason malicious.5a534e
Cylance unsafe
Cynet Malicious (score: 100)
DeepInstinct MALICIOUS
DrWeb Win32.HLLW.Ridnu.6
ESET-NOD32 a variant of Win32/Ridnu.NAC
Elastic malicious (high confidence)
Emsisoft Gen:Trojan.Malware.nvZca8qd8yki (B)
F-Secure Trojan.TR/Crypt.CFI.Gen
FireEye Generic.mg.bafc08fbd75c30ec
Fortinet W32/Ridnu.E@mm
GData Gen:Trojan.Malware.nvZca8qd8yki
Google Detected
Gridinsoft Spy.Win32.Small.sm!s1
Ikarus Email-Worm.Win32.Ridnu
Jiangmin Worm/AutoRun.xn
K7AntiVirus Trojan ( 0053224b1 )
K7GW Trojan ( 0053224b1 )
Kaspersky Worm.Win32.AutoRun.cqk
Lionic Trojan.Win32.Llac.lgbh
MAX malware (ai score=83)
Malwarebytes Generic.Malware.AI.DDS
MaxSecure Trojan.Malware.121218.susgen
McAfee Artemis!BAFC08FBD75C
MicroWorld-eScan Gen:Trojan.Malware.nvZca8qd8yki
Microsoft Virus:Win32/Ridnu.gen!A
NANO-Antivirus Trojan.Win32.AutoRun.gbrwmt
Panda W32/Ridnu.H
Rising Worm.Agent.na (CLOUD)
Sangfor Suspicious.Win32.Save.ins
SentinelOne Static AI - Malicious PE
Skyhigh BehavesLike.Win32.Ridnu.tm
Sophos Mal/Sily-A
Symantec W32.Miprinc@mm
TACHYON Worm/W32.Ridnu.Zen
Tencent Malware.Win32.Gencirc.10b0ea0b
Trapmine malicious.high.ml.score
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2006-08-13 02:17:49

PE Imphash

3c0e70bfa5f73f1f1cef484e2bcb5bf8

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.CryptX 0x00001000 0x00020000 0x0000c200 7.995672918745246
.CryptX 0x00021000 0x00002000 0x00000c00 7.936296214020559
.CryptX 0x00023000 0x0000a000 0x00002600 7.98290340625035
.rsrc 0x0002d000 0x00003000 0x00000200 4.674847935738507
.CryptX 0x00030000 0x00005000 0x00004600 6.9146549057422115

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x00033fa2 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x00033fa2 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x00033fa2 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x00033fa2 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_GROUP_ICON 0x000320aa 0x0000003e LANG_ENGLISH SUBLANG_ENGLISH_US None

Imports

Library kernel32.dll:
0x431c2e GetModuleHandleA
Library user32.dll:
0x431c36 MessageBoxA

L!This program cannot be run in DOS mode.
RichpH
.CryptX
.CryptX
.CryptX
.CryptX
@,):?qCLFT,
EM9CsJ<
K?EV>UY
ACVDc
dyI$um
U2(aN?1i*mX
~Y3T;
Dw>h<]3Q)Y9&T
q)EuqF
(X)Xr>uG*E`
,V/W!)h
,dcS DO
ZXo:Fk^
FwwB)Z54
NJ%jAF^$
fz"FrBV
Kn}<hY
TK_L=4W
,A SqNSFp\-
PI<{oxW
`v:*z%
nFB/1-&%
&i[^("j1
_Vqh09'Fh
5gnG47<
F8s6/Y
M>JH$bcNCo
%Nm.X[0
(g~[oo'4
gRcx\Ub}Gt=
!iqe6l
%.zC4*TK\heG
,'KK47Ly
`]p*E)k~F&^
j!7{?
cu%ptH\
jAL\{
%Crf#+|Ym`\
bb5cvM}2'%.=t )H
85OBy3
[,NQ'FHx7f
^ES(V~ao0
Thd?"U-N
"J%z!JvD
PQ%S|efZ?.o<
c[Ms4`
3@,[G7y|aW
[88!sn?
NX?P~QB
$<&]p^
-U9f`m
/Dy@YUif+KRX{$
K Gx,-G
k&C.}{-G[-
%>K~X_
|%22k9Sw
f)0[I_J
|uQs:O_b
u`twEc
B6x~es'U3fUe3l
$c|BL5R~U4]CZ9r,PU
c|}.f.H
c7/),%
CFPSJJ^+F$fuy
.v07@k
3G_~r[T
q|'BX+
}3{{/U
X$L#uZY=
>X*?(&
pL5g9;WB
[ZJkr
={o$eFu,o
Fn=G2#WjS\U
hC@VBc
74/Ws]/
F&.n|K5
E'>)n80zZK
;}k:)bI;
R`[/{Sn
.:w@a=
A6#f]E7
\VB% {
*gG'.2
'x:jgC9zxLfdfB7|
^FuJ,tQ
S]W79D]
W*cD,u
qlS9V7Oe;
nSMM-3tV
B2-rchf9
jS.#^.{
dui*Oj
>,L'C
{H~[$`<>
Vuq~'mlK|
5:z99@
Am#>@1
;88v9q
Q)2G/J}qi|Lk
]$=y'ji
IcOik15r
y:#gF#B2
( HIZJq
:OH~4O
Oc*dvpo
CsY-z$
'j(q.V
7Z8WKh>3*
2C7w:3
n|iU9* MjK
:(z&F`W<
/JCOLU
ljm*e"4&~ic
{mt!5ZV/e~q'AihBu#Wb09?Z9
<vM{UtO
C5?'+3K~
gi(}5f
*)J-l*Q
O#g@L+
Y|f]A(H1
['IeNi@p
NdbMX~
|TwW.$"yL
`wBgDO=J?Jd
n'!,k8e|$
$ dt0zqJ
&1O>v<`Y\nGgV~
XI5sP/
1_ZndM(oh,#,QHS~+p
C51,RO
'{D?3+}
"9=[R$_``
D`0@{C
Y3@iVHWbTB
6iCG<h!%<
:tXWWr
9BL)KGInuJgv
t}$,+XS
gKC@AZ<fj
a >6"'&O
cP1Gi0H'P
RU4>>]H
`^>7d%+?= Tt
5{Yk85Onp
g*v]P]
,ttX,e[35HT
Y9LhJe0\CCA@bRg
6K)=/$G9
bV n*WI^)5}
VP?}Bi
jDrnrfA
E#>9l({
v2:-Bsd&v
Cu,[@v@8n~
ch~<#mz
/r(}pu-]|hz
.dc$EIGbU
9q%Z]#
BX!+b`~d
U?H79$vqj
Ldb4]]+
[LQ}I+
XkXNy(.#
6DZt+hJx
8ROh("tqcx
Jezo|3Ku
UUH!96U3T$5
;AG9|1.
m{O/R!W-N2xG\
ov1li;#]
_EWf0\0
q]x8i0
-*V$]'
+d|`r3"`9
e tY]:nJh
;YkKkvgv72A
HUv{>Q
e)Q7kSQE.;-TD
/J.^p5
l~#`N{
y.2r3V
8NwQtqS)o~0u#',@;
C(vpSN,<.K mz
%@?n~\e%zr $Y0V
d`A[X{W
U_Ur6}
7InwJvD? to
)dkhR\f*G6{j#$
P7ch-E5
5fP":go)D9r p
7:NYDH
jg.$.^r,p7
!ScC3EWKw|
#[PGk_+g
0C:8(SzrE
P*1a6H+1pR!V
2I-zS_.kU+
]Li3<=n}J
1~,y=Q$(
AB;ZRf
B4-Wb&
Nc-l,"1|i
rR!T$L
#q.b$L4
Bzk-lXL%D
q(*xhjSWA
|_O6r#A
(;GBT|T
7f:DURgyQx
@OeUXAj/3^W
Z'^z[Y\
0:)L|%QV
gkaPyfcY
?J)RQ'#EC\])"6r
egIXX_
\Q\.k
vcSx]Lv
LcBZ\QA`
hD<46{39vsWW
a;T]z/;`1K6
&|+cs!
vpK 3Eiox
W.KH9DzzD*
}LS6fq%"]%)8VX
ng679N9Y hk9n[r
aIqS8(
B1RC(G`
m/@XJ#N
xBzl1LvE90
]XJu[8}
2WMHB`
8Nb3lw
wsJhg>l~_
3PPxeL
">ED[eqk
7v$!9[>;&d
4=nT2WSLf
>gf#~^\/^F
9)fLqc
<trWq}
%jw]|O4
M <j*/
}-s* $8
K5W|;X@h2,b
zCS\9p!
^%QmeP
VL)g9[<
S_CM)u{Z'[br
sC'BMdpYKW
l|Nz[zjX5[I^p
Q\N6DIE
W(1${E
V"`K^@
#rmRvm
>Tk`>`l{
@xD[o3^/B``nj
EHfV>K-
Vp3x;6
W<^Hu[
{1IiN({T{s
(y<0=<~
M7L*Q"*
{5=R,.
_<I:?Cai
}+L< {/v
k>,#U<
?<]x^a
@W+|@E
TR!GfU
ug-1?&!^F!f=
n&fG[<E%+DGe
OsE^nG
+4oJrE
[$ce2,
`P"vs)
3k*"bgZ8eU
z$84;^
*B^d$W6
Y@?&4rJKU
Sf=%`a+wQ
r[UpS-2
n8sWIlZYbRbY?%]
KlI^=G(G%O0ILa@b#a
`cyL{66JF
N+]W%R
`v \S%'su^Q8(?-HAK39hLW2vp
Vd/x!_;m<y@i)
,W;^f?
pL,@Fa|r~ufdt
DT'\_p"OxX52u
RVmyX;
|Y\snESwW=stMO
}{nb[u/='R
JSV'Bu^hrc=7"Rf`
nJ!#<\88R'IS%
[kBWq[5
{59/e+M
;e?w/ZGM
5DxH>#
J>6[f_
:4q!G;^J<8
(yy)/^
L#\,gQgSgdvr
pqK^A"co
:m"tb9P`1U0FlCB+''Te
6tHjSk"Y|5QSLX[e
&C^rtB
-!f-!
WHF+Vx
6MYN+_
EOr0^J
T3;~1oO@
'hWq^>[hkauEe'&L
xTyfOpn
~uG`&2Au-\MA1
i7A8f-
@uORmO?y^
l!'G%r&(5?o
)$zU;[
~JR=a(1
P0PO jIK
CRcWa(x;s
q^~.:XK{!R.
44S2u.?
x%??.D
4U`-6H
+51Vs*
[8rIG>
DS"BK#
's=*ciMyDW
hPOcu]
A6XZfrc
zN1zvc|
CcEJK;&S7y
=D%r!P'
;Z:P9>ll\D]#,:ml
d .=XSz?&to
nXG%\/
BG=@J3
RQDtt~P
]2Z#dlY(J
N][\l2
Cto;,*
<CHFjz
}hUb1(
13@Tjd
p(|9Xh?
Xm/%Jt
;}YwRe
KQ~|je
rP"nzC<
m oD7^ )
O]Vl05;Wp
B]s]H%
C\DaGt1#X
^"}):<S@7l!
%HJjF[
o6RmXz#S
"xF4jaYE
G%Rm7l
``=JvO+
j&b,]n?
kf>d'\nHSa
>tC~g_$
]`Lt@+l/
Bf8dVuV=7v
8@G\Y\&
#9y-JXS*
% hT@-
%%bWae'
~hoyg/C~,P\TK
Z1^ 9V(X
cFUV$kHZiI
?"C0""
_2vf;I@
pbk+*T
Do=eE(
%!3B9k
pEG;O:
HfJ>U5r
P$/O~`P(!
qUfO}V#e4
\_K8l0L
rGsHXB=_?
HMYeXR/d{]^
7@BHY%I
K($(H^e
\dzPd3
acLzf@
LF~ZOk\
ZE_\MK$
8N$N#kcPq
Y#+Ti0D
Otq&Ca$C-
Q>F:M6:i&O;h7
$v_~P<$X
=|?yP:N
=O>).CfAKc&
oX8l+xxI
I+pt
(d1Poaz
G7q\$IN
W24Syy\
_c$!%{9QVE"t
$/g )}
C?dTq
"EL^#m&@
X[i|>wLtN
<dN".}]g'8*Pb@S|Fp
|M+d59Veqo|h
;ns5f)~ukRCdH,+?}
"v#-"Y&rm
X0kb3h2@qh
ix8_-zG.bL
}%\v2lG^2Ni
Cvf~3e`9
\&SsYOtO
)M)*^]O
B='C-gbB
A&@o]#Moa[v
oPA).{
\#}1O.
3*oG7Ke(wvI4+#[8
8MSOV).nYX2J"
iQ?COl
E>rsVL
4 =?Nu
hlzu2{
b4kt$H
Gm/ *fJObB_
*4pi3MN:@+Ht
:OdJuBL
hcA_4 I1
Dc0;w:`
({&2Gu
@a2@y(Bpi4%\d:
la&%\6%2
5-Z7s~
bn7a4%ibW
kfBA@xR\f
lsnN>gH'
M%ARvS
cqFfJb
S=R L;
<1KP F
=muSAsv#p+;
v2wh&l
;!\8fp
^zFn6P)'uJ
Kpz'KW
xjL9`-
6i]6S>M9]P%a
Kc')|$/%
@4V@AspoON"~
2ngwtWab
K#t?]>
6p&^$iHkMi`,.''i
I!Q93g
g[y;M'zotw
!i[C~,R!3,{D#PWR
kM`Vsy
&l]cn{
{kO&g,
hAa^pEA~[@v8f
38)5\J3
K&Qt_|!J
BHrZGy#Zl\F
tq(ynb
'$O4QAP<
wHfH65
$w'Kx?k
/5AhHJP
&@cr[?$[
2#YV`_ENaq;B
F.31^w
$hgURr#
;m5F=a
&)fG/G>
6ZgIKQM
(G#"}O-{
Z:ZnlwdL
IvVXyg3
^Z(I4lj
+vI-6jg
T*0:Z#O
v%+BL_5
M/sB#H;l!
W8|L(s[
p,@4/
mQo41}
W$xii.o
8R2oG>9n
hW<[KqE
MK#R#$(
(L=]3Sjf#|
"V}J?LRY<
BoMJ9y BV[)C}
%^nzv!
>MUA=q}On
~myS5
H&Lqqe.
";*8Kn(
lx,^X>&\|
}L8H?`Rpp
Fi!r(8
:CVH]A]Y&^^cF
OENP21|
rpQ;pH
P1\=xw
--jEN&
5n;d`_
[TUun}NOh2
|S6X~'pu
1n>3`Z7
"u8!R6
<&!SAU
fq79,O
be4~[K+
Rjw_(t!
|@zbi_+L
q6f/\SMna
?M!2a}xmc@z9D
(/ZqZ5H
u&,5IV:B%
!&"@Rd
4fd?|#O
1%uPH'&l
Q\[Bo)*e
_Q5BN6
+[*q_}Yd/>8>Fm
b3#I@gN,
2>7Q5;/X;VQ%
tUDfkouiV.;
E!md0Q
(x!2Q"o*
*D2>(qv
DSc$sZA8r?^
DekuWW7
=ZnEC,
:rRk:"IP=F
&s['q_m7luR\txNv?6=IM)^NYwbU-Xs1W`a
(-sN#/6F
==w`L#
-YsU]_uGF1PiJ$k
H/~bEWV
)16M8%
n\r?~-M.{(-J
v|W$O?^iFwH
m=Z$b&
m|s)\_0Ni
~eND)pHBI!B
Cz(UKa
YT^;T{&
<}UnoW[,Dt
$]Gzo$g~-)
1u_7<J.
Y|"'(p
b3'9F^r
@TZQx,
?pCNB\O
dH{$[N
kMn#kx!bzmyaF
1}P'fv@
|1,\Os.(|.khd QbfS5N
p>Y>>Fo
/h)>=8d4
U[pg[}
#Q3J?zoY1
#.H6$nF<
QAKv:JwuT<
a0H!gm9
&q}T$TlFf5
e]3w5pObeF
;CzUsei@
kD>JH
-I=k\*)+A
_HJIr9u#
'SitGl
V'K'6f)iU
JvSHaxlQ
=07Vz(
ms/i3x
'`:{Xj}!
Kq$(D!K((
{I~KhwdM$
FgJ[y_@"*M9Z
|96/^(
k|QFqZ
Z^9$Eh
?vdk'We$JPx
/eh\f(
$3xDM_
U2!qO~ !n>*W'ip
s!_F5'
IEGk'Ty^lw>
++R|:[W
+wT]t;P)GU802<s^M
HzA./t
|t}mF(*`K!6wy]i
"ZWSWz*W
w~iLTD"7
GR5}O,)+]
Wxqq?/N
&U2$_5m
u9f)9<w
DcI&))
a@gU`E2
G~hF^2
-id5YG6
Cy9v{u
'7Jr+S
9vs`E
]j{nZ&
uGS}BZ=X%y%#W
'wb_L[(~
V+=BVpWe&s
3CEcr1$uJp>P~1]Q0le
P!-ET$f\1/{FK7
CeWxRE
50_1&BV^-G5FU
8}=I<J[=Z463$
?g\XENi
tmuI@9><wTQ
p.^aOh
F[hDy9Y
F{_LEP|J
J-NHsC%
AEWvfQ
S?Mblss@}
nFUYx[VM:nS&26
YO_p3[UH2/ow
4rHHx"
,a5gF*.B
GY(0&MS$k
/7e76`JVF
&A?cc,f9
OQ[/RJ'jqO&sq
5,2G,2.7
OXT]TP
AGNo")v
1v4zwj;K
xf\]O=BW]|
&y+^si 0PT^
*5Sqo:Oy&:
BwGOzhO
ccpxp8I?
XW[*Z
!1!gxgf94>
mzg15|
/KgYe;i
vod9P)m!3txEU
>`_{$Q+/
Mhpe3U
|K?ytF
rv*U}^{
qEz\_-.G
\2lr,G
E>otOg|Oq+
F:#cD&_cM7# IG1~;
!:qS&=^M2vmc
cfHtG7-
.(q-(u
S8aOg,m]F@alB
(jeO&q=e+v
V&TPX3%
,{F4t625QcYAj
fM!.!fBeS6
%F,nc*+: ;HPW_
^I^'%Yn
2S~0`h
BI`b*-I
r^]MdJ=
%2z<w_
GNV/5yl
q!Zib"l,r+eC/E
jk+<Grf@
%"3~>+J
>wwaw4C]
hL3juk~mL?
fF"6+~Rl
EaQNu~
:Z/^z&1Q
!OQ}#7k%YT
vCb;7-Fzx$
EH<EjN3
D&G.u/d"
!ab+yM
cd"Wqg
ya%Kk(DBnR=]
\33lc?
E,]gj|I&
<R:tUVMIRxDk>
C/Nzq=|#
-C`]$-
.N(7Wq
9KmFb}T{
)Nlf[/
%aB*.k
KSAJ"X`
lAqDGgC
^f?g8uG&x:
b;Xcu:
^cLne=z
>[$UK7XF
/rbyx{h,e$$1 ]/
xH}Q-B
Gp`52/D,0j!TYaKA>+Fy
ecSqh{Q$w@pR
~r8g`:&
Jm}YtR*
`/8Q1MSf
Urp'Tu
fPT4FhYA2@
:h_v^1
+v3dvtM
O{yM/J
I(f1HI
fO05/$n
-Tbl9Z tDW}}09:bI
w7p`(80j0<G
judsRtp*
5ZVU!7]
o9l'D*p,i[B
$|x'E4j
08MMS=
1xVADa!q?
sas`BRmU[
c8JJYt{VbM
uXI)m$Zdt
T^kx9LF=/9]Z
h[a$Il
}JefBP
jW#*}rM
}Glt@"
U}b+2 n*
D_9HOT
qA+)U}</
K"MUt8/{
{M#0jKJU
JUsXgxv
*l\cJb
x^\ Ygn
'*.B.;pH)
T<^OopQ
kjRwS(fHmt@t7Iw
y<Y!%^
%wnr2$
k<DBgf
x%%cu?S
[ZMv1G$*QdBX
_R> \{
l9Rh_-@|$
m%*{.g3
e=Et^
RYo 'j;/Z
~vz(WE
wKPZn=z
XqO@o@@w"l
tj3MWwe
ia0]$p
?,yQs\^
jm(C9TT
/pZ29ihK5WG`7s.G
ri8,@R
Uw\.K3
}h79DR
tv,8t,
Y$3Z60q
KjpA#qDI<J
FGK:(l
,1%-aNyAj5a
C;+@f/
wSBShcqXVZH:pB4~
Hm#8Ff^
=X b$L
+CAU,"}Ijy)}\
_|jV#5
-_@xu@
$,4p9#d
1UCa;DFlB
,v@vN D%p6?#
ibZeu5xR
8a=F0O7
>]K^sGa
(pc}1IuH7UZf!Uu<_
IFOgOZF
(rhLyr{X
I ,#+,")&,{J
U@GNc|(Qi1
L16y<x
ef#p48F
.ydk\k
~nhsjI
$+`}iZXu
z@{'o zM
"Asf5jS[1"
FoxwxIbe,mx+w
C%MCALR5Gk
!E?fSifb^
nhhC}5HH
L(A(%x
M2IzI!'4^C{Pba=9
ng$#?V
#.[+{_
2kpo._d+bh8
I~KRm
%v]@K)a}
+[.KnEF<>ztd
O#kVl
[}@.G3
yC957"HmEzF
S=41=Uig
TuuZPE
HFd`h_GnJ`
!O g#K
=/Yo%5
-*)vjmW
=e,#3V:m?Y
7$&Y&K8'#PE1
DiFolO#G/g
UBwzz]
Ub1k~6&
>(e;7kPb0
jwtM7lL|S5:]x
('5(&5gLt!
l\9g*u
?1FKZnG^'
?Sxk"m
&@6P2\y
HK}->"H
xaj/6;h/I:?
gSrC{zKV:>
0p6O:t.>HRQ
}m '0EVd
ytF 9G
`DjlN:D}m:m%o|(
jT-!]3r:
58/#LQ
hzuURt.D^nHG
%L=vW*:
X~_Q&+.uL>
M#+D'\
Fy9Y`?
iGCx&LL;
nN]KmN
14WR`C
E-||B1L
jSJ `Bvu+D=2
C'y'y=NQ
N!!KR03m
I`O-,V+
l>Y]yy
x^Hoz7P[
KX$^ut
xi(|c2+I
X*r) }3
}zISI?}|zN
ryxub6
,JQ.tU~
,W5?Jt.#+
EpZjS.C
V'@boAI
V#Nm\gRz
\(;QSL
Lf$i5:
%s<tj[,
4EuhJ2(
@k=2_)}.yD%*:BWRv-
S-I4="gbc
>!8av)~l
xXV]yiLT!
x'wJn/C
>{#njTbVvR;.lB
+!>WLJ(L
ri3vyZ~By7yjO
4b+#P@t=
!D8)g7
;R:.V7-XHA
I8'4;L$
lPGU!]s
m3:ypP
1=7i{S8^@-
qzJLk1
H$"kC0ymc$ 1V;
H!^[dI,R.
|6FfUq
+~ES;My~OJX9=~/
}V"YQ_DZ5
7=6,kP
:s&rz`ZL+S
2DYb[X+L
[KRHj0wni
ZI'`s]{k
6HTsLT.i
N\ l./<
Ag>k+]S33\zKkwAK
rRX+0_ 1LB
8Oxki(yyDD2T
RsCznXt
^o;^lB
hU(XWB
t' 5$y%yBG)@q=v5,[}]+e&yk0
+tr+FQKPq>m
&>*@QXIb?4
,':==BOc
I7U'Vd['Ax
N~}}^t
#N}T3A
8W?,Z(2w3.4
4 STM5^
.jES&a
,=wa+J
qP:8qA
#r=F5DL|%iQiM*pK
P0RhEa
bSH":[
4/Cb[1
&d&8*?$#?e
Lb_P838
A` -BEP
B>0tM#
+S)Pb_rXCz[
?.MAI-at~ZG
dT8!&
>5z*yyr
CMcKW5n3[6
dalq?_{
;,^IYe4Z1
1C.W)*
tqCInr
2-9SEB
qLbKKP|`j]n5F>,
1v"{5t*P
-5H~VJ
j}$i:v
f{eqW!
W#4MaON3;c.&h{'BP'
",@KF8UV
\\s2LgVr
hT|nP"8^
'j']s}v=Jw
Vb?A8K
DYFl^M @=
\si>5)rJG
Br/RTbW>0
Vl~6Iz
:?H3wU6a
a.16&u*MMN?bH'
i')x[sl6D
H7`}yb'|&
riu<ee
)EQ}je1w)Jy>RB
Ab$!2[
L$Lwik9
+2FU1a'
S@-A7YdS
S6S;BGDAK
35m#8:^
v|T-'T
(4wJ4kn
9!D0`Kif
b)dmP+$
^@T6bn&J}$
k]%bhV
$NI8v98pi
/82k)Sc^2
DK><~oZd
$@N))Tc
sAuilB>u
XI`do3_
9SduYYceD
H!P,:{8(tC
d{jV2<Z
b?q"BR`FE2"B
{A75,>w<
]eEf/5o
"t+l}
uZ^hUR&"Y
R{\'m[
??"G49-3
'f|s>R^
XF=d:rSB}9
nh7Mw%
"jatCRjo`
l~_8S
/gf[4n$l
$:JG1R
kl#P+'
]Q'gIQ
&l)s:*iV
RCz!VY
2{sN8)Z
J`/5a0.f
{d?FbXbQO)
vFNX/J)/
xa~mfcAc
v+RV`o
fD/cs<
KyLPIdwZl&
j1}384
Q^3XS/zfep9
-CB]VsEOC
^yz8/P
:vcia<
FW}Od*(@
wu@a_9}2F5YtJX
e~}ZSv
1rHnKh;_e
>Jz#z~&d
/%);tPxy
(NwG~+J
:VggEmiu|
R[@^$i
'J?5edY3
9UQRrv!)S.I
f=M.%l9=
6/;Uv02sX}{
|o_# `
)3Sz Vo
-kRtsls|6yL9u;,B#MUe|xg
K"%LJg"tSftmE:
(C?fe2n[3
OW>9(nkdXc)4Xg?RBW.'K
i2q3L X]>
wkG%*Y-
h8}(18
n`hd+.
t.C;^?#X
>EH,U|
YS$KEG=
EQ@q8ShZRA#wt
RKaAo|G%B=(+U
#4CuB]
63A4&'
ahE#RF0?
k>s^rH
wKDv'}1L
@v~bAe;
7rW-(nd
7\!fM}9MB
AAk`=D}(b--<]e[:
E~;3-O/
h;H?n!
|m(E(71tg. (c
j#UO"M
Z^a?,o3^'u
rS{yXE*
~MT}GKY
.4}8,h%&
AGB&QX5%XQW?O
lQ15
SO/_#4k4
y|*h(H'K
Z]D%&uV
P[1Zf#
1&'n]BjYCn
t~b,D`(:
>;p,bzArZ
YE~E7J
k(WrK
.M"L:]r
^0%l [Z3a7mhL
@)i\LY,a&,>`d-}
qwJ\Fn;r1W
o]/XLec&}"}
T1\@Z=3]
Ky8f:M
nl%+=9NqEO
\=tToQe*
,VQnh)
dqI g4
aCq{a@v
#&B[4y6
<smBw}'%:v7(
&{p=09Z
|8#fX/XjL#vIx*
KvR}wT
;d2uc:
< pJ!a
5GkB0V
]e.w;vG
L>{1,:bu
5("]aG;)
^Vr&??
8S)zD(R?'1y{D
%AMRIS
AU,?Xk[n
Dg0%*<
(k`~AB1h
Z|LTgF.
quVs/C!y
G(i=K{rb
3kNp2htg-&'FI8~:e=^vg
]LmyiY
VCYcp5^evo
*Ik}5!Xu
l]6[wO%%
8NU/1 0tG#6Uj[
'|pi"_
~z.?50DR"!
8{EN$Z
)P`Y!%
!<G]c@
EZn +n1 |e2o7
#V#j)9'dG?{
wA9QwH
,DEdC'v[vRH;di-7l@8A)&
F_]1_xzyv+J
ybLRt5
vtS_[1-
F'!/ l-
7!~WQ)
Vrn(f9
(1&d7VU<Y
Q'L3Q*
Eq6@s$Ae1}(
U-=_bf:)i
@df#PH
DJWtNo
0yLvD1UN
fv1aEy
c .xFxn
F.|W9g].
G.f[B/F
_$NL&`6
22\<4G
{Kgf?C.
$GT(2:5|I(K7
bN_`MhgG
J\?IHuF
^/c=d4
;<,$9u|~ Xx-y@dT
^k`Gx{J<C
vS;lH3d9k
uJokKN
bQK-l/$
>Jb=G/(O.
IZ)*O2yc
RHm_J-p
yJ6%]{O&
g!Y&&TW~u/
a`up>|,K
GGd&>\)x[.F
~_z4JM&P5.K|Is
Z%x0\1#+
>4r$!>Q
,vYlk~fjL=8
'@U5w0|Pm"
BA`tYNR[
P*I=&k
K*C5:M
_|U;HC/Pl_~
[NPZLn
Iai7_(
C6tctZ
1o dzV"
9oEgFo,GRn6UP
PRDL\Gh
jNG$V'Kn4/)$FCv
e#! U!
qT<5?
v=MF}i
AFo%7 +&Xq
ch`&RFpp{V
}J^9#@
Lc+L1y
KwJc5S2"^"6ERYfXW9;ayAH
uk6!rJQ
U[POU8T~U
aKDL+i#`H#_.g6
ePBuX?
LMT"/$3YZd(&
9v_se1I@3k%q
iCj+;j
ly:lo-l
A!y=U7w
fC.A0I3a
I.'l"y
l/3inpYC
?z=d~A}lpB`o+xC
@?d'aYxQev
S>]713`HR&
B?aaV}s&4&?
FP<#6&2[
"_/J sjqH
> Q"8*
s (Gh4tM|H<
iYkS<[P
NZ#3_/]45
\T(CiE*'4?YF
*ZT.9"#.Vk}|
FnlF (
>"[h,C4[
a#QP7qt%=O
j0=EMA"[|0N]1HC
Cwd|()ifz
_uOYqe$smjv'ainD
Ghv*hF
?B=u5g
Z:Z{DM)
TE)bnJIv
bf?y}%
+F5B3*ZWI
!_$&rP[
IhEz6v
^S[d2cy
3fDNU!w;
BuA-+$h
PJY+Gn
RGtSt(a+`=
llhAdh ` q!n><HBy1
pXL6"Y/8q*?
#.vj2
gtU>@~&#Z
Nva>&?EMo4f
T*\OQ0[x
rYo9AAl
qwG#(7A
|p-7_"AMdw
h2ke5f[u
%(qk3T&
k,WM@?s
t3`?_|KD
vnlk~!
Eb$WRgzf}
u%3u%=3U0&$
t~BL =f374
6&@v,
G9Ax"a6r!
.;\d2R!/,z#
]V]:i&-
:K,&+9
i2 `FroJ[{64~
<!F(k
YoY{aA
C$H& 7X
^#N_hd9qb
x/{>>{6OqH(
g7{4(;m
72KF-
$R6Kg&
"-D0+mT
wq$?(H"-gd*w
Z\ b5#B#
oTI-$c@qTY|&
tS%k<a
E.h e`j
w}Mf(l3,7
EW@tnHH-m
MAn.ONf]
szazmlOtOv}~u@"]D
s-LU]j
UV0m5t4ft>~)a4l^:
Ndl."]<yb4<
aSOUNelwxM^Z
?o=T[e#
%puye|*/A<K
hV^TA~
j}UHtX#Ni
F4eWevU\281).%.
ue1b0e?>|)bW
.uO_i(xg~s,e*Dw
E^n%ML6
J<nr8)7|
%J{SVd"
'3!Yd/<|vP.
>Xv{,?f
2S/G[@
t7E%4Q(
BuI%?7M
\KpQ`RgQ
'-}W7%r
>'5q<k4"eS
sI ?GI
v[yO/L`U*DBXr%
^_H Yr
>99)O
4%fmRXy2?Nb
enu. R
W1rn>5=
YC7nA3
Py)A(0q
N8jNzsU[1D|8p
91Dif8
;Bw:.o[R
|v~o)&
~i?h#^[
GwL\d^h:
B{<z?2
U/qboS&z2aAL1
1@;[/H+>r
?%LK^1[
3y"'HT)iE$3*i
{o9Emn-R1{U{_yv-(a$k
#E&)a=h-oQ
+4go>|zG5
+@Z$2KK
Xl>A*sni-V
D>,t\FI!xM TFhEQM
$-6T+[~
^Gar c
FTQ)d/
_-.09-vB` HE`qPKl{!
M}HvP#!
8df(Gu*
sPx"7=f:9j|Bxm
N@CFoGn
';w"^K3
(k#\^YQ}=0(/u
~Y,p8'
lDtOhY
bFOXhzII|sPL
Xhi,9t?J
Z9^bH~X
=j4jKNu
f[ITl9
?ovCBfYqnQ
"C7{.v%k@gh^}
%tQ~pL[
mb&Dk>PA
EmbwTs
-%J44af
F-N^aKi1ste
K,@"{.,A
bv[~Pj
zgUY^!v
Io\&,+}z?
*j%]#T
~z,3|+
aJFn2y(
|)'mnKN
f])F@7
;qw~W$3p=
MA%VLHIO
6`px=wh
=TuCy-Fr
1"U#X3
!kBp@F
?0]S&F
"g*/_D
JHHb'pY^
B29Lvj
"qI"#4H
m\UdB*3m
>_<>[{
n}V5+X p)
+wU3e<#
<SC\[rx;F8
xQ;u`
U%cys-
Q{{yTQ
d0lF41
Ie6"36-,<
}iPki(~
E@d;RS>1{
4*"gM]Y4}
1Bv!dfy%
^EHmv|Y
pKAA`r
vOLw|5Au(?vuc8
<F}SI$4-
p0g%M:Ps
!r\k)1
igkc}wf_
:twh;G
kernel32.dll
user32.dll
GetModuleHandleA
MessageBoxA
#YuW3]qLI
k7"J,]agJ
rB2OT3
#H)TWd
Wh\:8DL
rCBT+tN(
C,aH2WA-Gt8
^VBUc`C|WF%#05
{UBR65D2
~}}}}r,7,~
|}}~~}Qr
ozzo,3{
wQrxxyrr,,o]zorQ{
qrs>tusjjve]]ovj
ijkklmn_R]]]]oRjp
,__`JabZZcde]fg_^
YZ[JJ9SSSX\7]\[Z^
RSTJUVNNN177WXNSQ
MNOJ9N///P17///NQ
?HIJKCEE=F<<<<F=G
?@AABCCDEF<<<<F=G
&-99-6/::;1+1/<=>
&-84-6/0027
&-45-6/0012722103
'-.---//0122210/3
%&&&&'())*+++*),
DDDDRE
NNNOOOKKM
KKBBLLLKM
C:DEFFGH6FIB
9:;<=>5?@A8B
!/012345678
)*+,-"..-
"#$%&'&%(
yizkzm{o{p{qwu
uLL_nr
~4E`GY}autx|y
tqLa.@[ETegfjyru
gd,@\&7P9V]ZY_i{ldh
wYT'6N.Lq@vOLKYwya^SY
lKD*8S,_BA?=F\r@AEJ
G!O'Y-a'\'X$Q!H}h
&0k,?g
=!I'T*\+](V#L
U4o3J)Z6u>D6o9wCYvZG-_Dm
U4o5X'm7v?GOV^~
U4o5e-r7v>FNU]d
a4o4m4o6r<
DLRY_b`ZTM
UUUV[afkptvuql
5aI/"bH4''99
Q7+<Y@3
]_C4T8,@X;1
j^A3Q:+BUB/
\?0Q8,RZB1`@@
yC@Wos{|
~R|-BbVSy~_
]1Z+a46d6>
A)X+\!H
U0_8vHYuS
w4l6tET`
N. HY7!
vhH2O3$dS7"%U9
vq.exeC:\
rbpvwdxi.exeC:\
\tmegsx.exe
xlzngn
xdjfdbaa
lhfrlkqgm
ufwcwtlAlexis
\hjugtckhgy.exe
qswhzzqcwr
qpqerdUniversal 09
Metro03
\akdlw.exe
gqsqapX
xfpfqfh
oewtntm.exeC:\
L!This program cannot be run in DOS mode.
nnn\nnnnoBnnnnRichn
`.rdata
@.data
PMQUREPMQUREPM
LQUREPM
EPMQURe
EPMQUREPM
PMQUREP|QxRtPM
4QlRhPM
PMQUREPMQUR\PM
(($E $QURj
Y]UjhiC
Y]Ujh<jC
Y]UQMj
E]UQM}
REPMQUREPMQURE
HPMQURE
MAEM2E
MQUR6U
MbUREPM6
EPMQUREPM
REPMQUREP|QxRE
0PpQlRE
Q\EURTE dP
QUREPMQUR`P\QU
$$ E! RTPj
0E XAET2E
MEMPMd
Y]UjhkC
Y]UjhkC
PMHEMME
Y]Ujh7lC
Y]U EPj(
tCRPMQU
]UjhlC
uYj0hC
M:EM+W
MfEMW75
MQUREPMQ
UREPh+
XREPh+
MtEMe6C
0fj0h4C
Y^]Ujh
PMEMME
Y]UjhNmC
]UjhwmC
~$EPMQ
EUREPMQU
MQUREPM
PMQURE
Q(UEPM
REPQUR
MQUREP
Y]UjhmC
EEMMURE
dREPMQU
txht!M
t+ltp+hp
hp+hplM
U<E+E@M+MDURhPC
ty<tpj
EjHjZEP
LURhHC
4t3<t*j
DR@P<Q4Rj
Y]Ujh/nC
,IEM:b
M;M}9E
,!MQh
MQ0REPMQR
]UjhbnC
UREPMQ`
UUEMfE)E
sqEPMQURj
j@UREPU
EPMQj@8RUE
]UjhnC
Ex|QxREPMQ0
Y]UjhnC
Y]Ujh<oC
\t2j MR
Y]UjhoC
:t:j UR
Y]UjhoC
Y^]Ujh0pC
"uZj"M
Y]UjhtpC
VM%EPMy
MQMkMs
M/UREPj
uDURM_h
MEPMQj
PMvMQM
]Ujh#qC
ESVWPEd
Y_^[M3
]Ujh|qC
EEMQURh C
Y]UjhqC
ttQURj
EPxQUREP
EP4QhLC
]UjhqC
pEMnpMd
E]Ujh0rC
URM&:EPhC
Y^]UjhlrC
QMDEUUE
]UjhrC
RMEEEE
u'EPh
MCEM4EMd
Y]UjhtC
RMEPMj\M
DSURMgEPM[j\Ma
EPMQURl
u5j\MB
pB$PM$
pxx EPj
upQ$RMJ
4<<URj
upQ$RM
t/QREPj
EtpQ$RM
dXP8Qh+
(W{EMH{Md
EPMQURj
MQUREPj
EMQUREPj
PMQURz
rwE`wREP
E]UjhuC
DrEMr+
MQUBHP:
UREH$
u"MQ$R@PMQ
EPMQ$
DkEMk*Md
]UjhuC
EMrjEw
EM2jE7
UEPMQURE
EEMhEMd
EEMQh`D
E]UjhvC
0uEj0hC
;fEM,f
PPM^dE
|cEPhC
`MQh<C
M'a/j\M
]UjhvC
EMQURjE
Y]UjhNwC
hUEEEM
MQxV\\XE
t|VExjVMA
Y]UjhwC
EMPgeh
EMGPfMd
tZU,RE0PM<QU@RM Q
)OM$QM4
OU(RM8
M+QDE@
9E}AMQj
9E}bEPj
u#E<EMGL<)
`QURh+
0$REPh+
t_U$RhHC
lREPh.
D0PMQh.
EM;M}N
Y^]UjhmxC
EPMQFE
UREPge
URMNFE
Y]UjhyC
M QUREPMQUR|PxQU
RpPlQU
M-CURD
Mj"UR[~
dAEPMQM}
EEP\aAE
MQUREP\QU
U RTPPQLRHPDQ@RE
P8Q4RE
R$>EEP
U REPMQUREP(Q$RE
QB0EE ]>E
RM<EEEE
EEM<Md
Y]Ujh{C
PQRPQRPM
8MQURMt
UREPMQRE
RPQRPQRE
PMQUREPMQRPM
XXTE TQRj
RH0EEc5E
M4EM4Md
]Ujh{C
URM^4E
Y]Ujh}C
E PMQUREPMQUREPM
QUREPM
UREPMQK
URM.Mj
p-EPMQMi
dm,EPh
MQ`RTK
EQM ,E
E RM+E
X+EPMQMg
E!RMD+E
E"RM*E
P*EPMQMf
tDj\Mf
t!j\Mf
EPMk*MQUREPMQU
D)E%hC
<)E'hC
8|)E(M
Q4i)E)hC
,U)E*U
R(B)E+LP
M QHRDP@Q<R8P4QU
E,R,P(QU
E,$(E+0(E*((E),w(E(4h(E'8Y(E&<J(E%@;(E$D,(E#H
R 'E.EP
M QUREPMQUREP QU
E/REPj
Y]Ujh}C
URMM&E
E]UjhgC
EM"E t
EM!j,h
tFdt=j,hC
EM( hC
EMj,h<C
MQUREPj
uj,hC
;MuA=D
Mj-URD
Ej-MQ[D
xu+MQUREPMQUREPhC
}2j-EPkC
U9U}/ELQhC
EPMQUREPMQUREPMQUREPMQ
PQRPQRj
MQ,RhC
P8G,,(E
UFUE<Ej
M+MQU+UREPMQU
UEPMQU
EMQURE
RE+EPM+MQUREPMQhC
MUUEPMQh
j$j$h6
(VWPEd
HHNw=HN
PTQ`R2
MlREPh
4,80,Ph
,<0@<Qj
lB$|Q xdPQh-
t$jRh,
QUREPj
U+URE+EPMQURj
tX4Qh<C
PX4RhdC
+EP+QURPMk
Y_^(3m
taEPMQUR
]UjhHC
Y]UjhC
Y]UQMM
E]UQME@$2
MA4Uz0
MUQ<EPMQ
MQUREP
pQtB<PtQ4
UTMEMP
MA URhP^A
EM+MMU+UUEEM
MMUUEPMQUR
EPMQUR
ul++;|
l6E@ A
`7UB(P
T7MA$J
H7E@,A
+Q+RPQj
EMU;QD}(Ek8MQ@D
UJDEHDk8QUB@P
MA@UBDk8MQ@D
]UQMM!
MQ<REH8
]UQME@
Y]UQMEM
UUEEE}
E]UQME8
]UQME8
]UQME@
E]UQME
u(MMUU}
E]UQMM
UQME]UQMEx
t(64UZ
~E]UQMM
E]UjhC
UREPMQUREPMQU
DREPMQU
EUUEPMQj
ubMQME
MQURMPE
UREPMQURE
MQUR|PxQtRpPM
,QhRdPM
RTEEPL
REPMQUREPXQTRE
Q_U0E P}ELnE
EPMQhC
EMMEME
Y]UjhC
EE]UjhqC
2]UjhC
MMEM#E
E]UjhC
EPMQUREPMQURE
0PMQURE
MQUREPv
=EPMQj
tZMQURMzPE
EPM5MQUREPMQU
MQlRhPdQ`R\PXQU
RPPLQU
QPF0EE
MQUREPMQUREP@QU
E0E<1E
EEtMxU|EEh`h`tQ
E]UjhCC
TRPP`QR\HE
RHPDQ@R<PMQURj
EPMQUR
E$HEPMQURxPM
REPMQj
<E -j
PMQUREPMQUR
UREPMQ
UREPMQ#
h~E(M!
||xE)xPQZ
ttpE*pPQ
llhE+hPQ
dd`E,`PQF
\\XE-XPM}E,}E+}E*}E)}E(
TTPE.PPhQ}E("}Qj
LLHE/HPh|E(|MQURhPE
DD@E0@RP
<<8E18RM\|E0-|E(
|EPMQhRlPM
QRPQREPMQj
E5<{E4-{E3
REPMQURhPMQlRj
*0E(zE'hzEP
MyEMyMd
PMxEMME
Y]UjhC
Y]UjhFC
PMQUREPMQUREPM
LQUREPM
EPMQUR
4PM&tE
MrMQURMPE
EMQUREPMQU
QUREPMQ|RxPtQU
$RlPhQU
`+pE U
QUREPMQUREP\QU
P0E!XoE \oE
MFoEM7oTMd
Y]UjhC
PMnEMME
Y]UjhC
Y]UjhC
QMmEUUE
Y]Ujh(C
Y]UjhC
PMQUREPMQUREPM
DQUREPM
EPMQUR
MQURMePE
MgMQMgURD
EPMigMQ
UREPMQURE
P`<fEMQ
REP|QxRtPpQlRE
PdQ`RE
E \eEheE
PTdE#XQ
REPMQUREPMQTRE
E$PMQj
0E#PpdE"TadE
McEMcLMd
PM0dMQM
PMbEMME
Y]UjhSC
QM4bEUUE
Y]Ujh~C
EMKaMd
PMQUREPMQUREPM
HQUREPM
EPMQUR,
M.\S5E
u"Mbh$C
MZUREPM
UREPMQURE
REPMQ|RxPtQpRE
$$ E PhQdRE
PXWE"\Q
REPMQUREPMQXRE
0E"TWE!XWE
Y^]Ujh
MQM{PU
EM+VMd
Y]UjhIC
PMQUREPMQUREPM
LQUREPM
MCSEM4SER
EPMQUR
M`REPMQM
EPMQUREPM
PMQUREP|QxRtPM
4QlRhPM
Q\OE`R
PMQUREPMQUR\PM
(($E $QURj
Rb0EXOE
MNEMNTMd
Y]UjhwC
URM^NE
EPMTPM
PQRPQRE
|PxQtRpPlQhRE
,P`Q\RE
QRPQRPPLQU
sFEaFQ
]UjhHC
EPMQhpC
PMQUREPMQUREPM
<QUREPM
M~PEP1
MQUREP
M@`M|u
M{MQM@URhC
PME@E
M3|P|Q
|?MQURM{PE
EM{uPM{tDj\M{P{
t!j\M{Pp{
MQMc?UREPMQURE
dt>EU
R`a>E hC
XM>E!E
PT:>E"xQ
RtPpQlRhPdQ`RE
PXQTRE
E#P=E"\=E!T~=E Xo=E``=E
PL<E%MQ
REPMQUREPMQLRE
QX0E%Hv<E
M;EM;DMd
Y]UjhMC
PM:EMME
Y]UjhC
EPMuPM
EPM~9E
MQMruPU
EM"9Md
Y]UjhC
UREPMQUREPMQU
PREPMQU
M97EM*7E
EEEMQURj
EPMQM+rPU
MQUREPMQU
EPMQUREPMQ|RE
@PtQpRE
URX\3E
QUREPMQURdP`QU
440E0RXPj
Y]UjhC
EEEEM^~E
Y]Ujh>C
PMQUREPMQUREPM
LQUREPM
M.EM.EF
EPMQUR
M;jPUR
M-UREPMiPM
UREPMQURE
REPMQUR|PxQtRE
4PlQhRE
REPMQUREPMQ\RE
(($E$PMQj
Mh*EMY*TMd
Y]UjhlC
EPMePM
EEM)Md
Y]UjhC
Y]UjhC
dPMP)MQM
UUEM'E
E]UjhcC
EPMQUREPMQURE
(PMQURE
M#EMx#|6
MQUREP
Mn_PUR
=EPMQj
M4UREPj
MS^PxQ|
pu!M]PlQ{
UREPM&]PM
MQM UREPMQURE
URdP`Q\RXPTQPRE
PHQDRE
UREPMQUREPMQ8RE
E!PMQj
Uj"EPW
#j,MQmW
j,UR[W
tQhhlD
tRhhlD
tPhhlD
E]UjhC
E]UjhC
Q|RxPtQpRlPhQj
umILPM
j\M4KP
JPTQJi
MQURMJPE
UREPMQLRE
PDQ@R<P8Q4R0Pj
REPMQUREPQ(Rj
HP$Pf
EPMQMGPU
EMQUREP
REPMQUREPQRj
R@0E'^
Y]Ujh@C
Y]UjhcC
QMAPMAPU
E]UjhC
Y]UjhC
QMOEUUE
Y]UjhC
dP`Q\RXPTQPRj
URfEPM
HmKlRE
tv:PEPX
MQURMU:PE
xlQ<0ZE
<R8PDQt9P@RJ
JUREPMQURE
R fExlD
QE 4Qj
0R,P(Q$R P
REPMQUREPtQURj
QRPQRPj
RPM2PM
PQURPM
PQRPQR|Pj
PQRPMQtRpPj
]Ujh^C
PMQUREPMQUREPM
LQUREPM
EPMQURN
M`,PUR
MUREPM+PM
UREPMQURE
REPMQUR|PxQtRE
4PlQhRE
REPMQUREPMQ\RE
(($E$PMQj
MHEM9TMd
Y]UjhC
EPM'PM
EEMaMd
PMEMME
&PM0MQM
Y]UjhC
RPQRPQh
8REP$QLit
$RxBPPLE
QHRM!PE
tPA@@<E
$2@RHPMQ
PQRPQRh
4RxPtQh
00,E,Qj
lzE hYC
hfE!lQj
@R PHQURhPQh
(($E"$Q
R0E!dE hE
<EM-Md
WPPPVV
ESVWPEd
3YVSWM
Y_^[M3$
PQSVWlD
$UQQSVWd5
SVWE3PPPuu
E_^[E]Vt$
^U8S}
E[UQSE
k 3@[UQSVW}
VW395dD
8_^[]U
;YYt SVW
UUUUUR
3_^][j
DDDDDDDDDDDDDD
^_UWVu
DDDDDDDDDDDDDD
tAt2t$
wIVSP~=
YE;t'CH;r
PSulSU8
9}uH;u
E;t CH;r
YtvVWH
V3;v)j3X;D$
:t3^[_]
@@fu+D$
vr3Wf]}f
E`p3?j
tf9]u6E u03@8]t
BYYQL$
Wru{vnM
tR:QuMPt<:Qu7Pt&:Qu!Pt
@AE9]r3_[
QSUVW5
;YYr|+
;r;Pt$
3_^][YVj
YHU S39]
;tVEEE
WWWWW@
Y}V.YEE
EE3;u$9]
SSSSSk@
Yt1V__
Yt%VS_
SSSSS?
]9]tAM
SSSSS>
]8u *=
jEPhlD
B:t6t:t't
;t_+^U
@YY4VE
;t+^8]t
Map_[UV395D
^]UQQE
3b339u
0VVVVV:
ES3;Vu
^SSSSS0$:
;u 8t
SSjWVQRp
j"^;~Ej3X
QujWVp
e^[M3U
MapS39
u[Sjt$
pXPTYE
QTPTQXPXQ
LUQSW}
3;]u j3
;YYtJM
EV9]Yt
^0WWWWW1
3EEEE;E
EE8csmt
E`p`E9X
8]tDMap;E
;t+3_^[UV395D
SVW3;t
^0WWWWW.
BBFFf;t
3_^[U S39]
;t$;u ,
tU;|BMx
YYt"Mx
39]f\~
HH_^[Uu
3j`hAD
E3CS%
S\$ UVs
8WD$(@
L$ St^Dm
L$(9csmu*=xC
QR^YYt
=csmu+
8csmu8x
t*9csmu"A
j,hpBD
>csmuB~
YYtaSVZ
YYt)SV"
HtHu4j
VP9]UQQVu
t+>MOCt#u$u u
EPEPVu W
;Es[S;7|G;w
@u"u$u
;Er[_^U,M
Yu\39~
EPEPuu W
(u$]u E
u$u uSu
_^[Vt$
tR99u2y
u$Vu u
Q 3@_^[]V5lmD
YV5lmD
^YP5lmD
YYt:V5hmD
PEYF,t
P7YF4t
P)YF<t
PYF\=yD
~lt#W#
u&V5lmD
>YW_lmD
YYt4V5hmD
VW_^]M
F$|3@_^
_^UQQM
MOI;|9M
3@_^[U
SI VW}
HD9#U#
MLD3#u
]#\D\D
+SVWlD
1E3PeuEEEEd
Y__^[]QUQQVE3PuuG
VVVVV%
X^95lD
6YYuTVWhpB
3PPPPP
VS@<Yv8VF;
3VVVVV
VVVVVa
VVVVV?
;t%t j
]_^[Yj
]|ux}tf
f]pfElfehfmd
S3;VWt
^0SSSSS
Iuu}]U
+EPRQL
ANu_^][U$d
j BYqj
whu;5tD
8]tEMap<u
E`p[U lD
Zf1Af0A@@Ju
@;vFF~
M_^3[j
*Y%u pD
3SUVt$
3;Wto= {D
;t^9(uZ
;tD9(u@
KuVrY_^][SUVt$
^P]{uD
P_^][Vt$
SUW=$C
^P]{uD
t7t3V0;t(W8Yt
VxY^3j
Fpt"~l
j ,Y[j
EPQEPEj
SV3;Wu:EP3FVh\C
39] SSu
ESBEYu39]
e_^[M3
u$Mu u
MapVW3t$
_^VW3j
u_^VW3t$
YYu-9D$
u_^VW3t$
rYUQVu
9uu-VVVV
ItFht8lt
Pu|YEYt
HHt@HHt
UM@9u]
itYnto
EGEEPu
u}PuESP50zD
EPS5<zD
YYY}gu
EPS58zD
YYY;-u
0@2If90t
@@;u+E;u
]+]+]E
WSj0E^
EtQ~Mu
PEFPF]
WSj EC^
3PPPPP#}
U S39]
u SSSSS
iSSSSS
t4;|"Mx
EPS]YYt
HH_^[US39]
^[]Vt$
W>+~,WPVxYPM
Y}3u;5D
YY3BUD
1 BPwD
|_3^;=D
V4YP>l
_^jThDD
Ej(j ^V)YY;
3FRj(j YYtM
;rF9=D
<at9<rt,<wt
J9]u:eE
(Y]3u;5D
PVYYYF
FYSVWT$
URPQQhB
t;T$4t
;v.4v\
UVWS33333[_^]
33333USVWj
_^[]Ul$
RQMQVp
;u'0VVVVV
u&H30,VVVVV
FE3PPj
MQPuFEu
M3+ME;(
@@FF}f
++PPVh
GE+E;(
EEuV}39ut j
WWWWW<
Wu8SS3GWh\C
39]$SSu
;~Ej3X
3;tAuVWuu
EV)Yu EYY
3;tuSW}
PWu u<
uguYE;t
e_^[M3sU
u(Mu$u u
Map39D$
t&P7|FVsYYG
Wt1t'P{GW:sYYF
(;r3_^[j
RsYt=E
+PRYYt+@$
EYF`[_^Vt$
YYt{ ;u
@;u_3@
uNSW< D
_3[@^3^
R(YST$
~Yu[U$t
]]]u GSSSSS
uVYt.VYt"V
P|Yt3uM
LubExO
JdtEit@ot;xt6Xu
/E*htlt
 n]t5ct
EGEMtHEME
EGEMtHE
PaxYu}
EGEMtHE
PawYuM
EHP54zD
EEPEE?
EPEP&Y
oUjF<-uHtD
]t=F:s
u+uMu
x]tGXtB}xE
FuLGFM
}xtO}ptI
WsYtVE
}xt)}pt#
PrrYta}ou
VrYt>V
f>}EG}BUE
u?dY}u
Fu8M^t
3@3UQQ}
Mm3;u+
_VVVVV8
SSSSS@
F80t.G
E`p3_^[U,lD
^VMQMQp
SSSSS0}
M_^3[^Uj
]U$VWu
^WWWWW0
E`p3[_^U
^03PPPPP3
(Wj0Vc
E`p3_^[U,lD
^VMQMQp
SSSSS0+
M_^3[tYU0lD
_WMQMQp
SSSSS8r
EHE3}-
M_^3[|XUE
et_EtZfu
]EuMm]]
3@3hLC
PCC>Yu
j?rY|$
}}b9}u-
ItHht:lt
QPaYYt
FFE9}|
Et-EEPEE
EPEPrC
fEEEuN
kitYnto
W@UYEt
ECEEPu
u]PuEVP50zD
EPV5<zD
YYYf}gu
EPV58zD
YYY>-u
90t9MM
@@u+EE}
uN~J}uM
MVEKY}
fEt$M]
3PPPPP}
_^3[<M
t.t$<"u
u_^S39
GVdUYt
U@V3UE>=Yt/j
SSSSSm
3Y]_^[5D
FA>\t>"u&
uUEPSS}
=?sJMsB
;r6P);Yt)UEP
_^[QQ0D
SUVW=\C
SSS+S@PVSSD$4
;t2UR;YD$
t#SSUPt$$VSS
u+@U;Yu
DUVWgJ
_^][YYVW
;r_^VW
E3E3;u
8csmu*x
Vt"5<D
3PeuEEd
]|ux}tf
f]pfElfehfmd
eUSVWUj
P(RP$R
t:|$,t
;t$,v-4v
UQPXY]Y[
c3}5DD
\}Y;uSEPY;t
[|Yj h`ED
Y+t"+t
+td+uD}}
3PPPPPb
P{EY3}
u@OdMGd
uwdSUY
U SVW~z39
WPry;Y|D
WPZyYxD
u;tm95|D
tePyY;t%MQj
u3EPVYt
;t(P8yY;
S3;VWt
^0SSSSSe
3_^[USVu
3_^[];t
^0SSSSS
3SEEESX5
PZ+tQ3
R>6K>v C>v$;>v(3>v,+>v0#>v4
>@v@=vD=vH=vL=vP=vT=vX=v\=v`=vd=vh=vl=vp=vt=vx=v|=@
=,^Vt$
V<Y^Vt$
P]<YF ;
PK<Yv$;5D{D
V9<Y^UV3PPPPPPPPU
$s ^UV3PPPPPPPPU
$sF ^U
33C;u3EPSh\C
;u9} }u
6~;w6F
3;tb9} u
SYuREYe_^[M3
MDu Eu
YM37U4lD
u?YF;~[
w/b;t8
-WWuuj
t`][9}
WWWWVuWu
;YYEt+WWVPVuWu
uPYEe_^[M35j
3;v.jX3;E
EU_^j
~VVVVV
^SSSSS0u
Map_^[;t.;w(
j"^SSSSS0
8]tE`pu
0E`p$M
QPcYYu
uuK<9uu-'VVVV
PYt6uYt(u
3MEEEE
ItFht8lt
P;YEYt
HHtAHHt
V?UYEj
GEGEEPu
u}PuESP50zD
EPS5<zD
cYYY}gu
EPS58zD
bYYY;-u
C]StuM!s
RPSW309]~
0@3If8
@@u+Eu
]+]+]E
EtQ~Mu
WSj E~
3PPPPP
_^3[1&
S3;VW|[;
t58t0=
V3;|";
u$x0xVVVVV
uqM3}j
eY3C]~
E}uyG&j(j jYYEta
SSSSS8w
jX;EUu
r'Vt8<tWWWWW
PpYME;E
j3[_^j
CYU(SV3E
SSSSS4n
EP;iYt
t>Ht2Ht&wm
^SSSSS0n
+t5+t(+t
>t3;t/=
$ MeHM
tSSS6#
CSSS6_
E+PD=P6=
_8VVVVV
9ut(9ut
79YUj
3;u/fVVVVV
;u/fVVVVV
u$EPSR*
f;u,ft<U
E`p3_[^j
u.`dSSSSS
;u.*dSSSSS
3f;u!f;t
E`p3^_[
H8]tMapj
EV395`|D
ug=`|D
tVURPEPQ
eMapYa
E`p:39]
V7;Y`yD
t.V'Yt"V
uAV;Yt.VYt"V
@$t!`3WWWWW
EP3SSSSWEPEP
E`p3M_^3[w
EP3SSSSWEPEPy
E`p3M_^3[
^0SSSSS_
3_^[]UQU
3PPPPP-]
WVU33D$
%#Vt1W}
_VVVVV8\
YY3^]U
V{Y`yD
t.V{Yt"V{
V{Yt.V{Yt"V{
VPmYYu
VP|mYYtf
{Yt"Vz
l39]~4N
7C;]|fE
YYM_^3[q
0;u,XWWWWW
u,9uv'
E`p3[_^U39
SVVVVV
3^3PPj
WMEu'339\u
JB|j3Y+@M
JBjY+3B\M
3+BL1<
}3^jY+
WMEu'339\u
JB|j3Y+@M
JBjY+3B\M
3+BL1<
}3^jY+
_[U|lD
S3V3EE
F39]$WE}]u]]]]]]]uEHSSSSS
<+t(<-t$:t<C
]<+t<-t`}
+t HHt
B:t,1<
+JMtHHt
B:}OMEO?
tEPuEP
3f;u!GC
]FFEM}
u3}u*e
M_^3[1
]EEEEEEEEEEEE?E
u}u.u*u&f!;f;
;u0u,h
VVVVV#A
VVVVV@
`;fUu}fEM
3##EEEE
f;u$U@B
u-U}ue
EU}um
u3}u*e
fUfUUUU
3f;~<E
u.U]ue
EU]um
H]Uu39Et
u1}u(}Eu
M36fEfEEEE
fE[E}Me
~(E}Mm
0K;]s;]Es
EM_^3[o
SUVW|$
t$(L$$##
\$(D$(3
u,;W ;t
M_^3[j
^SSSSS0h2
;u 8t
SSjWVQRh
d0j"^;~Ej3X
QujWVp
e_^[M3U
MapS39
W/SSSSS
u[Sjt$
MhM`MXMPMHM@M8M0M(M M
pvdk``\UXJT$
MxMpMhM`MXMPMHM@M8M0M(M M
d{`p\eTZXOT$
M)M!T$
MxMpPeLZHO@D<98.0#,
3\43O
=M5M-M%M
MIMAM9M1E
MA 6T$
MQMIMAM9M1M)M!M
HtDi@^<S8H4=02,'(
4t0i,^T$
M8M0M(T$
yn|cxXT$
MlMdM\xQtFp;hPuY
MPMHM@M8M0M(M M
HyDn@c8X4M<B07,,(!$
yncXMB7,!
|qf[PT$
M}MuMmMeM]MUMMME|:x/t$p
4t,i(^0S$H =
|~xsthp]lRhGd<`1\&X
J3sH D
xtvpkl`
ZOD9X.
3~43ql D
J3F0!D
ZM0OM4DM89M<.T$
MxMpMhM`MXMPMHM@M8M0M(M M
\uXjT_LTPIT$
lyhndc`X\MXBP7L,T!H
MxT]`R\WX<P1L6H+D @
@3HJ3>%D
MxMpMhM`MXMPMHM@M8M0M(M M
MxMpMhM`MXMPMHM@M8M0M(M M
`{hp\eXZTOPDT$
MjMbT$
M?M7M/M'MM
|txit^pShHd=l2`'\
M}MuMmMeM]MUMMMEM=M5M-M%M
MqMiT$
|zxotdpYlNhC`8\-d"X
9MMMMT$
J3FD0D
MhM`MXMPMHM@M8M0M(M M
p|lqhfd[`PXET:\/P$L
J3A@2D
MpMhM`T$
M8M0M(M M
tzpoxdlYhNdC`8X-\"T$
MMMMT$
MxMpMhM`MXMPMHM@M8M0M(M M
,3M 4D
M|MtT$
J3"T5D
M}MuMmMeM]MUMMMEM=M5M-x"l
M~M~~|~x~t~p~l~h~d~~~
U~XJ~T?~L4~H)~D
~8}4}0},}(}$}
n}c}X}T$
9M|M|M|T$
J3NX9D
|h{d{`{\{X{T{P{Lt{HM{M{<iD^@S8H|M{4B{07{,,{(!{$
zzMzzzzz{zpzezZzOzDz9z.z#z
z|yxytypyT$
J3w4;D
MyMyMyMyMxyMpyMhyM`yMXyMPyMHyM@yM8yM0yM(yM yM
yMxMx|xxxtxlxhxpxdx`x\xXxT$
M\xMTxT$
wHw w@wvwkw`wUwJw?w4w)w
wvvvvvvvvvxvtyv|nvpcvlXvhMvdBvT$
,3J3=D
StubPath
\AutorunsDisabled
\AutorunsDisabled
Wow64EnableWow64FsRedirection
Kernel32.dll
Wow64DisableWow64FsRedirection
Kernel32.dll
Wow64RevertWow64FsRedirection
Kernel32.dll
RegDeleteKeyExA
advapi32.dll
IsWow64Process
Kernel32.dll
rsaenh.dll
GetSystemWindowsDirectoryA
Kernel32.dll
\System32
GetSystemWow64DirectoryA
Kernel32.dll
PROGRAMFILES
PROGRAMFILES(X86)
AutoRuns
No items to search
Cannot find string "
AutoRuns
Cannot find string "
AutoRuns
Cannot find string "
AutoRuns
balloon
BALLOON
SOFTWARE\Sysinternals\Autoruns
height
showall
shownomicrosoft
verifysignatures
google
column%d
columnPos%d
MS Sans Serif
SOFTWARE\Sysinternals\Autoruns
height
column%d
columnPos%d
showall
shownomicrosoft
verifysignatures
google
AutoRuns
AutoRuns
AutoRuns Data (*.txt)
All (*.*)
Compare to Saved AutoRuns File...
Error opening file
System\CurrentControlSet\Control\ProductOptions
ProductSuite
ProductSuite
ntdll.dll
VerSetConditionMask
KERNEL32.DLL
VerifyVersionInfoA
Terminal Server
GetLongPathNameA
kernel32.dll
RUNDLL32
RUNDLL
CSCRIPT
WSCRIPT
\SYSTEMROOT\
\SYSTEMROOT\
\SYSTEMROOT\
Software\Microsoft\Windows\CurrentVersion\App Paths\
File not found:
%d.%02d.%04d.%04d
\StringFileInfo\%04X%04X\%s
\VarFileInfo\Translation
InternalName
FileDescription
CompanyName
File not found:
File not found:
File not found:
http://www.google.com/search?q=
http://search.msn.com/results.aspx?q=
http://www.google.com/search?q=
\ntuser.dat
Error loading profile for
] - Sysinternals: www.sysinternals.com
Autoruns [
Autoruns
Winsock Service Providers cannot be disabled (only deletion is supported)
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
Disabling or deleting Userinit will prevent users from logging on.
Are you sure you want to disable autorun of
Autoruns
AutorunsDisabled.ini
windows
windows
AutorunsDisabled.ini
windows
AutorunsDisabled.ini
windows
windows
AutorunsDisabled.ini
windows
windows
AutorunsDisabled.ini
windows
windows
windows
AutorunsDisabled.ini
windows
windows
AutorunsDisabled
AutorunsDisabled
AutorunsDisabled
(Default)
(Default)
(Default)
(Default)
"%1" %*
(Default)
(Default)
(Default)
Error changing item state
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
Deleting Userinit will prevent users from logging on.
Are you sure you want to delete autorun of
Are you sure you want to delete autorun of
Autoruns
AutorunsDisabled.ini
windows
windows
AutorunsDisabled.ini
windows
windows
"%1" %*
(Default)
(Default)
Error deleting start setting
properties
AutoRuns
AutoRuns Data (*.txt)
All (*.*)
Save AutoRuns Output to File...
Error saving file
regedit.exe
AutoRuns
The full name of the selected key or value is not available.
\HKEY_LOCAL_MACHINE
\HKEY_USERS\
\HKEY_CURRENT_USER
\fohrplgw
\tgrdpfigva.exe
bdx.exeC:\
\nkiwym.exe
exxqlnk.exeC:\
vxrrgpwwfkme
\smcp.exe
hxtlbjmhme
hrxtexgcwb
eoctame
\wpgovwkgmq.exe
\gitvmuubjw.exe
L!This program cannot be run in DOS mode.
|]}L
`.data
@.reloc
ADVAPI32.dll
Unknown exception
CorExitProcess
runtime error
TLOSS error
SING error
DOMAIN error
An application has made an attempt to load the C runtime library incorrectly.
Please contact the application's support team for more information.
- Attempt to use MSIL code from this assembly during native code initialization
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
- not enough space for locale information
- Attempt to initialize the CRT more than once.
This indicates a bug in your application.
- CRT not initialized
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
This application has requested the Runtime to terminate it in an unusual way.
Please contact the application's support team for more information.
- not enough space for environment
- not enough space for arguments
- floating point support not loaded
Microsoft Visual C++ Runtime Library
<program name unknown>
Runtime Error!
Program:
EncodePointer
DecodePointer
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
GetProcessWindowStation
GetUserObjectInformationA
GetLastActivePopup
GetActiveWindow
MessageBoxA
USER32.DLL
(null)
`h````
xpxxxx
`h`hhh
xppwpp
Complete Object Locator'
Class Hierarchy Descriptor'
Base Class Array'
Base Class Descriptor at (
Type Descriptor'
`local static thread guard'
`managed vector copy constructor iterator'
`vector vbase copy constructor iterator'
`vector copy constructor iterator'
`dynamic atexit destructor for '
`dynamic initializer for '
`eh vector vbase copy constructor iterator'
`eh vector copy constructor iterator'
`managed vector destructor iterator'
`managed vector constructor iterator'
`placement delete[] closure'
`placement delete closure'
`omni callsig'
delete[]
new[]
`local vftable constructor closure'
`local vftable'
`udt returning'
`copy constructor closure'
`eh vector vbase constructor iterator'
`eh vector destructor iterator'
`eh vector constructor iterator'
`virtual displacement map'
`vector vbase constructor iterator'
`vector destructor iterator'
`vector constructor iterator'
`scalar deleting destructor'
`default constructor closure'
`vector deleting destructor'
`vbase destructor'
`string'
`local static guard'
`typeof'
`vcall'
`vbtable'
`vftable'
operator
delete
__unaligned
__restrict
__ptr64
__clrcall
__fastcall
__thiscall
__stdcall
__pascal
__cdecl
__based(
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
CONOUT$
string too long
invalid string position
OyzInterlockedPopEntrySList
InterlockedPushEntrySList
kernel32.dll
msi.dll
HKLM\Software\Microsoft\Internet Explorer\Registration\DigitalProductID
DW0200
Software\Microsoft\PCHealth\ErrorReporting\DW\Installed
GetStartupInfoW
GetFileAttributesW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
IsValidCodePage
LCMapStringW
GetStringTypeW
GetLocaleInfoW
WriteConsoleW
CompareStringW
GetWindowsDirectoryW
RemoveDirectoryW
SetCurrentDirectoryW
GetCurrentDirectoryW
version.dll
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
GetPrivateProfileSectionW
GetPrivateProfileStringW
CreateMutexW
advapi32.dll
RegOpenKeyW
RegCreateKeyW
CopyFileW
GetTempFileNameW
FindNextFileW
FindFirstFileW
setupapi.dll
msvfw32.dll
sensapi.dll
oledlg.dll
oleacc.dll
secur32.dll
avicap32.dll
winspool.drv
winmm.dll
rasapi32.dll
mpr.dll
comdlg32.dll
shell32.dll
gdi32.dll
user32.dll
unicows.dll
security.dll
ntdll.dll
LdrUnloadDll
bad exception
Secur32.dll
GetFullPathNameW
GAIsProcessorFeaturePresent
KERNEL32
1#QNAN
1#SNAN
MsiSetInternalUI
MsiCloseHandle
MsiGetActiveDatabase
MsiViewExecute
MsiViewFetch
MsiRecordGetInteger
MsiCreateRecord
MsiEnableLogW
MsiGetProductInfoW
MsiGetPropertyW
MsiSetPropertyW
MsiOpenPackageW
MsiSequenceW
MsiDoActionW
MsiSetFeatureStateW
MsiSetExternalUIW
MsiGetTargetPathW
MsiSetTargetPathW
MsiDatabaseOpenViewW
MsiRecordSetStringW
MsiRecordGetStringW
MsiQueryProductStateW
MsiOpenDatabaseW
MsiInstallProductW
DllGetVersion
list<T> too long
F59N\IPKP
vector<T> too long
invalid map/set<T> iterator
map/set<T> too long
GetUserDefaultUILanguage
RegDeleteKeyExW
GetSystemWow64DirectoryA
bad allocation
RSDS~\
install.pdb
U0SVW3Sh
U0SVWu
XS3VW;u
Yux(tc}
UQW39}
UQQW39}
;tAEPj
WWVuuWu
SEPj(EPu
(tXru}
M]]]]EE
f9]t]}
SEPuE}k
+Pb[_^
@@fu+Vp
Y}3E;t
F F$F(F,F0F4F8F<F@FDFHFLFPFTFXF\FdFhFl>
uPWPPVVh$@
jSPMZ]Sj
jD3|VP
EP|PVVj
VEPEPu
3MEh7G
th9~4tc9~
tT9~ tO9~$tJ9~(tE9~,t@9~0t;9~8t69~<t19~@t,9~Ht'9~Pt"9~Dt
3MEh7G
3C]j.W
EWhQPM
jWEPMEP
]WSMuE
UQQVW339>tpfEEPEPu
uKEES3j
Y;t(EPSu
UQQVW339>tpfEEPEPu
uKEES3j
Y;t(EPSu
UQQVW339>tpfEEPEPu
uKEES3j
Y;t(EPSu
tx!EWfEEPEPH
uJEES3j
Yt'EPSWu
Vf0@@fu+Pu
u2SFFV
|\Ef8^u
|5EPEPE
SVWMtnu
u4RGGW
}CCHf;
GG;}r3Ex
QM4SSfMH
Y3@:A
+WVb+F
JPW[_^]
Vf0@@fu+Pu
SVW3;u
G;8r_^[]
USVW3~$>^
UVF$F$9F
f}tf]tf)tftf.u
|Sf$u)fx
VWj}}
f8}u,j
f8)u+j
SSj^W3wt
Cj]Wht
4E|SVuw
SWaf]thEPE
ft$f]t
3EEEE;E
Vf0@@fu+Pu
E$PN(~E
E@PNDnE
;ErJEF
NP^L^M^NE
]~tSSSS
EPj&Xa
jSEPh@
@jSEPn
VQVQP.
SSPPVP
*E;uJh(
uE;uJh(
E!tNh(
MuMh0@
<Et4PMS
RQP8xE
;tQ0PVxE
jSPM0E
MOEPl0PVE
RQP8xE
;tQ0PV0E
\9]t?w0h
jSEPh$@
|jSEP|E
RQPV@x;
jSEP>h<@
jSEP$h@
M(j XsN
u w0hH@
jS|Pj-XFN
XjSEPh@
QPx]Sj
EVMQPuhH@
J;tHh(
;tVSuh@
lEEh7G
txl]ME
p;t]h(
MQP0P
|QPEP
p;tth(
EpxQPthH@
p;t\h(
;t'pSxh@
Wp;t\h(
;t'pSth
SVM]SVMM
7LTh7G
q;t^h(
EWMQPuhH@
;tWSuh@
4EEh7G
VM]j"XE
EPuuuu
D3`h\h
`QWPVh;
V`QWPh(@
:d3;tih(
;t4dhQlQ`hH@
d;t\h(
;t'dWhh@
d;tbh(
;t-d\Qhh@
\=C,\h`
9{,uOh(
\NhA`48Ph7G
3PPPEP
^[jp.F
EVMQPuhH@
;tVWuh@
u9;ux}
t0MQP3p
YYt Mq
3@M_3^
t9t5f>
f90t|u
u;t%h@
jVGtPj
ud38^Mt]8^NuX
t!PNPj
uSPh@@
3:EuHh(
tu3h@
t#SMQVuhH@
t#Vh0@
ESuLtKh(
tVSuh@
E}EPu0tMh(
t!Vuuh@
u{uqugE
3jbfE3EWP
hWW`QMQP(
MQPh`@
M-3Fuu
G(PN(PE
GDPND@E
G`F`GaFaMa
PEM-eE
@PMsEE
MPM93u3F1fEWEPM
WEPME
Vf0@@fu+Pu
SVW;sh+9U
wa3F+u
3+t3Ht
Hu|>tw
tP]HsE
AAB;P |
U,SVW3Wh
;tP]qE
AAB;P |
5;tH90
U(SV39,
6uuW6v^[
;t,WWWh
M_3^V;
tSPh@@
3GVVVPV
EPSSSSSSh
twSu3FVu
t;u}]E
EPEPEPEPEPVuu
3VfWP#
@@f;u+M_3^ 6
3M3^n5
@@f;u+
Y3_^M3[
VSPoPu,]Sj
@@f;u+u=3E
eWZ}E
eW%}E"
eWQ|E*
eW?{E4
${E5]v
MEleE8
PMeMEeE9M9eE:F
PMeEPEPtP
E;SWPMeE:Wj
ePizE<F
PM?eEPEPtP4
ePyE>F
MlcE8Vj
M]c]Vj
@@fu+u,2E
3fE}f3h
f3WPQw
$EPu}P9v
@@fu+x
3Y(;t.,L
,f;u3fE}
ft&P!+
YYSP,mE
YY,Sl mE
t9PWPEjWPDWE
.PkE Wh`@
PWP"E!jWPVE 3WCS#VP
WSlUMWS
0PjE#F
YY4TE$;
WVlTMWV 2E
f;uj"X
C$C$S.
S4hs0;
SE%SE&Pj
0PHhE(F
PMRh8@
MQP|PE
uPDPnE
MQPEP\$E
MoQMSj
uCVEhP@
Y;u3h@
Me3G}}
POoBV7
UQQSW39}
zu=3VVuu
USV3W9]
3F4~8E
~<Nd~@~D~H~\~`JE
}^LWWj
G4V0;tNS^
O8Y9_4u[E
P<SWDG
3PD$Hd
D$,D$0
|$<|$@D$4
|$8D$P
UG4V0;tF
69w4u^]
2PVu'9
|$`|$\|$d|$hr
^dP2@$
D$$9=xG
t$(F PhHG
t$(D$pPt$<
F(PF$PR
F4|$,|$0|$4|$8
3L$,Q0
D$4+D$,L$8+L$0D$
L$$;D$ v
D$ ;L$
F<F4;F<
fD$lP3
\$l|$p+\$t+|$x+\$L+|$P
T$ D$D+D$<L$H+L$@
W|$ R3SSS7
-39D$@u
WRjjPD$00
jS~LWj
HtkHuJ$
F@8D$|PW
D$$h7G
PPt$ 9
PPt$ [9
D$ h7G
D$$Uh(
D$(h7G
EPj!Xh|@
^<;^4t
F<uZF<@
3@N4V<;
N<~F<@
L$\D$,@
\$L\$P\$T\$X
@@f;u+^
Pt$ t$
NF3@;u
D$$-D$ Ph8@
|$ 9|$$u
D$ Ph8@
Pt$,t$,
Pt$ t$
t$0YYv
j$L$tQP
3MEh7G
3MEh7G
EPMPhp8G
Wt%Vh$A
3;tL;tH
3b3f9} tSW9}
|C?w;j
PxSVWDG
L$$QPV5
uCC0L$$QP5G
sBj%Vp
YT$TR|$XK
fC@fu%S
S3~L~P~T~X&
j!Y=NP
tPEPY"
SSSPFPR
USV39u
F,;F(w
;tI.r//v"7t
EPEP$PE
;tnVV`Qh
8F)t'F$
L!This program cannot be run in DOS mode.
YYY_Y^
[XmXRichY
`.data
msvcrt.dll
KERNEL32.dll
NTDLL.DLL
USER32.dll
MM#MuMgMM8
iMPoMMM
MNMJMz]MM/M"MM~MwMMqM|SMM
MJMMMj
MM7M1<M
Ma~MlMkMn
MMrM~M=McMtmM~MjMgM+M
MMhM/MaM\M~M
||f||t|P|)|
|=|U|h|,|
<|;|G|
|]|X||[|
|Y|Rj||<x|
|7|2#|
||l|x,|
|f|y||1
|w||(|<|
||,|8|
|Y||+|_|
x;JVW}
J3fG8Y@
+SVWEePEEEEd
JYPhJj
U$x;JVu
PIf=;J3fE
Ef}t2E;Juuu
fffEufd]
3@EE3f
PEPzu?e
PuA_[M^
PYt0F<f8
JYYSYfdC
UQQW39}
JYYf97
UVW39}
|$;Jvu
~`J_^]
N8f<Yf"
WhCJu
F8f<Xf
J5xJ%J
J$J0J]
V3ShFJ;YYuHS
JY@=FJ
UQQSVWj
h@FJYY
!$J0Juu@
UQQSVW
$J_^0J[
}x;JVE$JW3;
1j%[f;
M_^a3f
UVW=FJ
"u+=:J
t;Jf8:
J1t095DJu
h(Jh$Jj-h0%J
0J$J3LfEM
UQQSVWE3P]]{
t$SMEP]F
5t;JhFJ
5t;JhBJ
5t;JhFJ
5t;Jh,CJ
5t;JhFJ
^UQSV3WVu]
VVqEG4_^[
(Jj0h,%J
SS3_^[]
(Jh(Jj/h(Js
h(Jh(Jj.h(JN
JYYw<3UVu
|*3fXS
W3t)9}
fEf;JfEEPfE:
3VKJS;t
uKJFB;|f$uKJ
t4V3f7V
5J__^[
J3F!0R
SV3WC3
x;JEfE
fEf;JVfEE3PfE:
t)VVVVPh
h2J(x;JEE
$(3A,jdX04DfH
J|MQSSj
JxMQSSj
JE;tMMQuPj
GGEPuWj
E +JW;u
DJVSSj
JSuh+Ju
J(;JEM[
J1J_1J
JEPhH3JEP=
JVEPh;Jx}
Vh2Jh;J^9t
JYY3f;JPP.
f;JfEEPPfE:
3f;JPP
JSYYWSS
3f;JPSf
GCF3f9
Y@@M_^[
wft f="
3f<w"tf
x;JSVu
EWt j*V8
PPj'V3
Sh4:JD
FJ5(Y4VW
5t;JEfX
VW=:JG
t)t)6Pv
x;JSVW}
w4E3;tXF
Y3M_^[
PVYY3f;JPVF
j8h@J23
]Sg]EP}
EKJKJ5JPV};
WSE;tE
hhAJx;JE
JJh;JP
Ef;Jf;
S3;fEfE:
fEffEfVP
J3YYPPh
u"ff;Eu
DJ3[_M^`
GGrEFFg3mUh
FFfu3@[_M^
JSWPSRM
_^[3=dJ
U`x;JS]
VEHJWP]xJ
JYPVVj
Jh;JPJ
JPS3SJP9
JJt5;t1h
JhIJPXHJhlIJ5XHJlJhTIJ5XHJpJ
3@M_^[
SetConsoleInputExeNameW
IsDebuggerPresent
CopyFileExW
JVu+WEuE
EPEhLJ4
P3VhLJuu
PVhLJu}
dJEPPE
PVhLJu}
PVhlLJu}
ffJEPPE
PVhLLJu}
ffXJf;t
PVh$LJu}
ff\Jf;t
XJj Zf;
\JEPPE
JYY_^[
J2XHJu
JXHJhMJP
SetThreadUILanguage
M9}t>v
3@UQQVu
Jh;JPJ
;JY@GJ
JE3E3%
j(hxQJ3W
TJ9=xHJ
hpHJhlHJt
EP5|HJEPEPEP
JEhhHJh`HJ>
}=iJJ%
3YdJ3f;J
f>"u*Fj"FV
U SVW5
HJ|J_^[
x;JSVWE6
JYY<JhVJh IJhVJhHJ
0KJVJSPj$
j JJSj1
j JJSj2
j `JJSj3
j JJSj4
j IJSj5
j IJSj6
j `IJSj7
JYYM_^[A
YP\UQQE
SX8@<VWj(E
E9=(;JEt
JYP5(;J
W=(;J=J;
6T]>9;
$;J=(;J=Ju
(;JE J
W5Jm[3%J
3%SPW
G3CUQVu
WJ;t,@
f;Wt,=
W~A3GW
+FFSSu
FFfuf9
j>V$usj(V
uOj^VuCj|Vu7f9
SVW5t;J3hFJ3
Wj+5t;J
JYY_^[
HuKQS1=dJ
;WEDHJ
?3f;Jf;}
u/%H;J
;JtZf=:
tXAAC~
ij.WUF
x;JSVW}
j E-V>-F
JYYtgf
;tqWSx
h%*JG]
UQQSVu
tDSSVWju
3+U@SVWu
x;JSVEE
3PSVPu
f1rGf9wAEj%PuuE;E
x;JV3Vh@FJE"YY
95h;Ju
PPPPPPPu
x;JSVu
JYY3f;JPP
e3f;JPP2@@t
x;JSV5
3@M_^[
ftSf=
r,Vh0nJW
Wh+JPj
CCfuf;
JYYu S
uN3f;JPU
CC3f;JP
JYYu$PSW
39tS3f;JP
PYtGSYD0
JYYM_^3[
t7=P;J
J9u=9t
95P;Jt$I
J950;J
=L;J5P;J3j!s
UQSVW3j
Wh@FJ0;JZYY
DJ?J3F5P;J5L;J=`;J5<;J5H;J=D;J=@;J=8;J
:E5`;JhwJS
0;JE_^[
U0x;Jf
h;JVW}
EEP+JV
PEPVPzj
EPW3f9>
JYYuEPEPEPEPuV
u]3SuuuJ
<;Jt(}
u1Wu'<;J
3@=<;J
,thPYN
JYYE_^[
3f;JSVu
CC3f;JPW
JYY+f$p
JYYM_^[
SV3fW}
JYY_^[
PPou"PV
vEPEPEPEPuuuV
GYGU<x;JEE
395JWE
N8f9:tq9]
PJWv8j(
Jh;JPJ
J;uV=
J%j*v8
;Jx;Jfe
6f;t8V
JQ3@SP:J3
J_[^]
S@VfEWEPfE=
PZSW6*v
P_[^UVu
g]a33jZ
5 Jlh|
hJ3Y=4J
DJh`^JSh5#
4F)lt(
Sh`^JV
FFup=dJ
]tPPEPa
DJhJPW
4EJGNQ
JJPJJEJbJ#J#JlJJU
f9:t6/
Hv8F<t
PSvYYV
hHJYvDhJvH
h<Jh@J
h(Jh,%JhPJj
v<v8hJ
JlJJJJJ*JoJoJJ
JF88,Jtj
v8F88,t
JWgY9}
hDJWFLYYt
PWYYhBJ
F8,Pv<hlJxv@3
th(JHWWv<
JYMWDA
JYMWDA
?v<Qv8hJE
YY@<QSv<YY3y
3@B=dJ
Rh JPVh@FJNu
SPVh@FJ
X$J4FM0
Wft+f}
f;t"=dJ
QPYYF<f
hJ<|x;JEU
3Cx3|j
PJVJ0C
JY<EPJf'
JAHJ@HD
JA J@
JYYJH HpjLX
|PpPtP3GW
fdu1fHfMt
fmu!fHfCt
PVw_^[]
SSp<-y
Yu3_^[]
AAQhl*Jp<x=dJ
JYYf9;unW
DJVuVhJPYY= J3M_^[4s
x;JSVu
E3W=J3@;
JSv<;8
M_^[]q
USVW3Su
Wh;J(qu*Wh8J
f<XCFF;]
@@SP{f8:
j:hPJf
EPJIo;
JYY<GJ@
WPYYJ@
t+jL_p}#Jt
Pf2f t
JYYL3C
NtQueryInformationProcess
UPSVW3Fj
]twf;Etqf=*
UAHuEf
3B;~7E
f93EEu
E3SuuE
ECCf!4Ch4JS]
S}st;Jf
u;t-} }'M3@#EEt
t@3f9>t
hJ5t;J
F<;tSP
v<Nz;t
:J3^[]
x;JSVu
:JcSSV,ff9
J3Gf9\F
JYVAat
iM_^[~`
hJp< J]
3@^[M__
JYuSh;J_uS
NNcW3;
Vh]Jff
PP{8-u
PH_39^
;Jx;Jfe
QPd_39N@^D]
f;Mtyf;
3M_^[Y
\JE3@3
XJBSVW3
JcSSVc}
JJh;JP
JSZWSWZ
JJh;JP
JSZjpE
3M+fMV
JEPuuj S
JE39}E
3d;JT;J4;J\;JX;Ju
V395l;Ju
p;J;t^W}
JS]EPh
E[_fE^
SVW39M
=\;J_54;J^T;JX;J3[;
X;Jd;J
JT;JYYMP
3SV395d;JWuuuufufu}fufu}fufu}fufu}fufu}fufu}uu
EPSp9u
VVVVVuuWuL
J;YYd;J
ft(PhJ
JULx;Je
ESPYHWE
hJ9}}E
M3MQPMQPu
J@hPJP
JUQS39
:Ju@VWE
JiL[Ks
;JVW3;
;J=$;J=(;J_^
W3PVH}
3w _^[]
39}u&j
u;PMf8\t
SM_^[E
3M_^lE
JYYEWWWWWj
JYYu:E
;Er3u|utul;u
u(Eu$F
x;JS3VWffE3ffu
ffffffff=Jh
DJYYW$B
M_^[@
JRh3JQV
NXN`WNd
[M_^=>
SVWj,A&
JYYPPSVWR
UQ3S@9E
VWErC5
hL`JS
YYt3hJS
YYt%hlJS
hJp< J]
H7PPV^O
hPhat+VP
:JPPf
PHu@3G;
Fx;JSVW}
33SFWER
JSSSYP
WQPPS5J
}OM_^[]4
SVWtHu
J395T;J~
d;J4G;=T;JY|5d;JY5d;J;
3^3iuhdJj
Ju.EPj
fEfJf9
3@j EP?
+hJ9}Sh4#
3Y3@gUQQE
UQSV38
G<]tcj/P0;tU3fF
V|0;u9]t$SSj
J3_^[
[t:f>f'
fhtcfHt]fmtW
j EPPPSrP
dJW]tcj/P\.;tU3fG
W0.;u9]t$SSj
J3_^[
x;JSVu
u35J5JPPSp=P
JujSSPPSvpP
VPJPPS5J-pP
5JPhJv
3AFFf9
f;Jf9E
}U3f;JVu
hJu=<;J
g=<;J\UE
UjhxJhJd
t8x;JESVWeE
DHLPTX\lf
J3GSP@f
JYYSV'5
P=Ph]J=P
=PYY=9
J;t_PVj
nJJUQSVu
JYu69E
;Ju3;]
@@}PPWd;
th4J}PYY
hJ}PYY
shJ}PYY
hJ}PYY
hJ}PYY
hJ}PYY
hJ}PYY
hJ}PYY
fEYEPfE:
JYY3_#j<hJ$x;JEE
Q3Sp<"&u8
dJt!V(;v
Vl J;u
JMu !
ZJSVWj
JFFF3f
f>0u!Jt
8+FFN0
PP O5
Jj\P;YY
PYYPVV
JYY_^]
x;JVW}
PPj7P2
W3f9>EE
WWv<&SPuuV
3=3^9E
f\t)f:
x;JSVu
JfD_f=:
JYYChL`JP
x;JS3WxffE3ffM
ffffffffJxPQ
EEPEPj
;Jx;Jfe
39O@_D]
q3M_^[
u)j?v8
t#SP`YY3@3h9
Q+`YY3@<
F8SPV;
U\x;JSVu
W33Cj E}=
2SuV+Eu;
;JEM_^[S
R3@kUS]
Vs<>6W
Wt;Jf
t;Jf8(uv
v8~f=@
W3Wv<,
F<@@PhJWYY_3^]
UQS39]
% J.UW}
WYY^_]
t;JtPW
_^^SVW5t;J3hFJ3
j)5t;J_
5t;Jh<J
5t;JhDJ
;5t;JhLJ
t;Jf8%
FD3fFDPh;J
I5t;JF8PPhXJ]
5t;JF8PP
h,JF<;
JYYj)p
t;Jf8)
5t;JWW'/
^SVW5t;J3hFJ3
j*5t;J}
5t;Jh`J
USVW3S
5t;JhBJ
dJt65t;JhAJ
5t;JhAJ
W3j0E=
JYYPYD
JYYPYD
"3M_^[p
x;JVEE
PVPVVVP
E E$SE(Vu
^ ^$^(^,
JYO0DA
JWtpSY39E
WYY3_^[]
UlW39=J}
u(u$u u
ffVWE3M
ff5JffffffffPQ
WEP3Wj
;Jx;Jfe
x;JSVu
3M_^[f
a<;Ja}
_3@z^7
X3hJWDhJMD
u 5`;JhwJ]Pj
WVS3D$
;JQPFF3f
3f;JPVu%J
u!VJ0p
JShJ@Yy=
t"gjnghl#
BYYggJH
WPHL;YY
;J0tS+
FFf>FFCC
F<3f98
F<Gf<x
A3Y@Y J
FFeSEPj
v@gv<_u
JfSht#
?YY33@wWe
J>YY3@
SSSSVhPJS5J
t$SSSShPJS5J
SPJ+SFSFSVP9t
JP3FVh#
J+M+kd
lcP5Jj
3@c3@cf='
E+PVS]
JE+f$C
u)CCS]Ef8"u
f0EHH;
f8 t3PPj
J3PPPW
J9uu8]
;JE4e]
@@BBf^u
YYu&Sj
3qcPh#
9YY3@\c
;J3C{FL;u
JWWWPE;
u3FVh#
oWPuu;t;E}uTf8\t
JYYWWv<PuuVum
;JWht#
0KJ)J,
0KJ)Jq,h
JSYY,h)JSYY,h)JSYY,h)JSYY,h)JSYY,h)JSYY,h)JSYY,h)JSYY,h
-h)JSYY
IJ| JJrj
YPllPq
C50KJP
JPhSc}
=J }3j@5J
SPKJPWPVhJj 5J
J 3g5JhJ2YuP5J
uIj_t#5JW
Jh]JW5J5JWYYW
JY3QPo
h@KJP`KJPQP
JYY!39
f!Ez=<J
RQh`KJPhHJEj P
SPJF<f9
u"Sh7#
<YYSSj
hJ0YSv<Po
u"Sh8#
d<YYSSj
SOhJf0Yjw<
JhTJ@hJP
hhJp<3f9
0Y3Y@mBmPCo
.mBAAf9;t;
\PWSht#
Sh0nJWut
DJVSSj
JYYu?~
E5J JE
K,@Ru+j
Q[-YYZdj
V+YY3A9GGf
W9\9Vh
_83@Y83R8h
*Y3Y@{j
*Y3Y@{h*#
$PhJ&YY5=
HEf8.u
g53<3F-i5hwJ?Pj
953@295J
hxAJp;t6SQh
LHJu=9u=SPVWj
Pt PPYD
J@hPJP
PVYYf>:uj
PVYYf>:u)j
PVYYf>:u"j
*95JYYusVh#
tT95JuLVh#
*95JYYu7Vh#
*95JYYu"Vh#
x*95JYYu
Vhl*JW4
JE3f;JYYPS1MLK;t
JYYVSW6
V3VSHHt
Xst2Ht#
HHuwD;f
JYYt.f&
u 9tPj
WetGPPh
t1Jf;t'JQt
tT`PPuW
WVS`P%4Ff
FWFVS`P4F
FFVSPSH
YY>PYY5<f=
YYjh@FJ
x$J4$Jf
{C+PQ5$J
`#YY;]EPEj
;EEf<EJ
fk50Jh|HJ
JYYF<t
JYYF8~<f$X
EPVEPj
PW;WtG>6h
Y3P}EPV
hHJ>F8~<
eJSh)'
VLSFS@Sh)'
YY3+Pj
YY3C3,N
;Jv i}H
J ;JWp
;J@ ;J|Wj
;Jp$ ;JF ~$5 ;J5
JCPVu4|=
HF$|SWj
CC;r;t?j
EP+VWj
CC;]r;t9VL|
EP+VWj
Jt;9uu6u
xh`^JP
zf?" t
GG;}r;t;j
+MQWPj
Jtr9}umEE
GG};}r;t>V
;WN_^]
MHJ%3@
5t;J5DJh0RJ
t;Jf<AC
]]PF<]=dJ
hSJ5t;J
uhSJ5t;J
YhSJ5t;J
=hSJ5t;J
!hSJ5t;J
AGgt;Jf
JYYj*D;
Y3Y@P\S
f:j\^j
f;twf;t
t]Kf;t
f;uf;u9f
3EPPPEP
Jt!Ut
;JfDfEf
PPUPDW}
ftXf=
JYYXX"Su
&  j:W
J$=<;J
3jna=<;J
5P;JPSRt
395P;Jt,=<;J
eP;J3;t
=<;JPPSs
PhyJPs
JPPPYP
J3PPPYP
tX9uJ9t
!3GPWh'
3VWPWw
u<958;Ju
u<=<;J
3950;Jt<u-PPl
PeC |3~]
PurIHf
u&=@;J
@EFHJy
VgPDSh*#
zY3Y@}D
mVWh]#
j EPjEPj
JEPSVj
B;UrPSVj
JT J;E
EPEPRp
J;r+E
JE<U3E}
@ Hu3B
Y202*u
395JuAVu
YYt-};t
YY95Jt
ffEff;Jfh
JPEPuP
vREh`tJP
JYYRuj
EPhJYY/SEhJEYTN
3Y@|3CEPP
JYYt;v
YYWW>Ht
rf;JfEfF
qf;JfEfF
JP9YYCPP
JP)YYP
31Sh*#
JYYh(#
UWP+YY
YYGGdj
Y+tS+t4
2Bd :du
];3f;JPW)u[f?.
JhL`JS
;PSYY
6YY3@zUPPYYPw
u(Thl*JP
T6F`PvXPo
Tv\6Pro
THt?Ht"
~T6@vTu
YY9_f;JfEfG
Jr|PPq5
{OShw#
{YYiOf|OP
SDC,P6KIJ
JtPPPPPj
hhJ)PGhl
S,S6GI
K,SQPg`
CG]C;]]r[39
3@FS5Jj
JJcPPj
@fEabb@b
}PPWe;
bPWhb#
ahJ}PYY
PYYh88J
J}PWhu#
PYYtahHJu;u
J(tof9tfP=
s#h]J}P
J`3aSS
BB8Zu8
3P[f8.
JYYtPj0y
joqjoXeQP^<
jo3Fdht#
J@}3@3@^Aot
1HX;J1@
JY0u9}u
Null environment
JvDNt@Nt4Nt(Nt
USV5JW3;
@<;t'WP
@@f/uUf
f0rLf9sF
:8x,x(uF
3;t8f9
3Y@Y J
NDNl3_^[]
JPZhJ+Y3
ub3!5Jj
JY33f97t
@@fuf90u+D
CCFFf9
uCCFFf9
VYYV'FFhL`JVYYP
trPXFFPVhl
M_^[Iz
JS3+VWt
JYYtzVC
U x;JM
PEP"xuW}
ftfPEPwt-f
f3@M_^['w
x;JSVu
f`KJfE:
fEh@KJEP
J;YYt.f9
PhJYYEPEP
JEh48JP
EPPyf9
J;EPVPu
JPYY3@M_^[
JhTJ@hJP
}9}vL9=Ju?E9Er.u
4Cf>f&
YY3E\C
JhTJ@hJP
APerformUnaryOperation: '%c'
zt]%t>Ht0
T<tUHtGHt* t
APerformArithmeticOperation: '%c'
YYuWSpJS
JYYt<E
,EPEPE
3F_^[]
UHx;Je
JEEj P
JEPSot
JEMEf>_^[&m
F<W3;t
u*j;v<llt
Jhl*JP*j
h48Jv<
JPQn,9}
JRatPVhJ
pPh$FJ$nP
mpPh$FJ
x;JSVu
uj"V;YYt
FFf>"u
f;uj"V;YYt
v"Mf8 s
;t.fEh
YY3@M_^[0i
P2ftIf=t4ShPJ
JYYt1E
u0uu)u
S3;VWtvf9
E]]uEPm}9]u
HY3Y@_^[
VWjuS5J
E_tuVUe
j X;wC
IIt/It,IIt$
;w1tx+tqIt
+t@3t4
Jugf.uMPPPS
uo3k3@hj
Pyj W~ht
3;twf9>trV
JE;uG}WWWh
x;JSVW}
Jugf!uPPPj
f?.u$j{^Wj
M_^[g^
VWvj We;t
f0WhlJh
PPPVhl*J
ShlJEh
;ttf9>to
FFf9>uf
WWWPf>
;tIf9>tDV
JM_^[[
UQQSEPhJh
hhJp<O`f9u
f8=YEu_WV[5
WF[PWYY
3t W2[t
W([PWYY
UQQSEPhJh
hhJp<1_f9u
f8=YEu_W8Z5
W(ZPWYY
PWuX_3F9u
x;JSVW3Vh@FJE
VVp<]f93
XPYYW}Xt
WsXPWYY8
t!QPYY
;JQPgW
YEPmj ;XQq
ts3f;JPP]
QPYYPP
UDx;JVEj EPj"}
VmYEPj
VMYM% J
x;JEhJVu
WElJ3f9>Eu
JYWWWWPh
J;u+hJ
Ph`JPj
Ph`JPj
3@M_^R
Jp< J]
VW3VVp<:Wf97u!95JVt
JShBJpT3JSW
YY[_3^]
v TYY^3]
YYjh@FJ
WYf|G t
JYY_^[]
uaj!EPVj
JEY<_]Y4F0=J
Vr4W{4E
JYYE9F
C4;{4u
R/x_^[
Vp4W3;f}tSS]
EPSNf~
JWPS(Wv
Ht^HuR}
:uRv4j
|3_^[]
H9uv4}
|iUSVu
3CSv8WlF<86u
JWOWv<tWv@k~H
SvDW)WvH
3CShBJW
ShLJWFLt
SPWShBJ
JWF8S,PWsWv@
3C,|d-~X.tL/t@0t41t
9uFShPJu
JtHFD;u
v<_^3[]
h@FJZTYYt
UV3zt!U
UQSVW3u
Utx;JV5
j EPjEPj
3@M_^C
h|JY`EfEfEfEfEfEfEWfE3EPf}uEWPSf}f}fE
Jf}f}ujP
p<5IIt
P/YY3]
v<O5HH
Hubv<=X38P
fuVWf8
Vp4t=h
uhJ>^]
hJ/t;Jf
j hJOYYu
YYSv<Sv@~~H
j hJzOYYuvDh8JhvHOF8H,Qv<Ph JNv@
5~j6uRv8h8J
HuhSVh(J
SVh0%JvSVh
JjSVh(Ja7t
9u7SVhPJN6v8hJ
YYV6%6hJ
SVh,%J
SVWt#j
3_^[]4
x;JVW}
VPPnDu/VWP\Du
3M_^{<
SVW3Vj
t#EPEPF
3uU3Vj
J3_^[]
UQQ<;J
CCjnQ@j
S?_^[]
x;JSVu
0;Jt7j
PVB3G;
PVPW/9
0;Jt=Ou.PP
PhJfYYP^
trSP=0;J
!=3M_^[3
=3@<<jn9j
SR<WN<Njn9
<SwNlNj
J3PPh]Jh+#
PP7hJP
EPj)0{(=#
EPj*=#
P*YYM3/1
x;JVQQEE
Jt#;sf
UQx;JEE
u3_^[]
W8j.0V06
P @$Vq ;
tAHt3HHt$
j P+D5
j.Sk3+
33f}Pt
t0_t'3fG
VQPPPh
JWuQVPj
P#Ph`^JWXu%PPD
J3M_^)
JYPWVu
VM_^^)
t0Pf;w@F
r_^f[]
JYY3WWWWPh
WPxuY3Y@
ff9t PPj
V$_M^S'
x;JSVEE
Wh KJ$
WS-/N0N0
t(9,t ,,
4Fh KJV
,Wh KJV
Yt83;w2r
9(s(;$r
A3A;wr
JYY$YM_^[%
tVwF F
PW,Ph`^JWJ
W>M_^+%
t.u*F' t$J
@PWUF F
PWPh`^JWO[M_^
JYYPIt
Wffffff
E(Ex;J tHJ$j
QRPh J
ADVAPI32.dll
ZSHELL32.dll
MPR.dll
SaferRecordEventLogEntry
ImpersonateLoggedOnUser
SaferCloseLevel
SaferComputeTokenFromLevel
SaferIdentifyLevel
RevertToSelf
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
RegSetValueW
RegCloseKey
RegQueryValueExW
RegOpenKeyW
RegSetValueExW
RegCreateKeyExW
CreateProcessAsUserW
RegOpenKeyExW
FreeSid
LookupAccountSidW
GetSecurityDescriptorOwner
GetFileSecurityW
ShellExecuteExW
SHChangeNotify
WNetCancelConnection2W
WNetGetConnectionW
WNetAddConnection2W
msvcrt.dll
KERNEL32.dll
USER32.dll
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__initenv
_cexit
_XcptFilter
_c_exit
calloc
_wcslwr
_vsnwprintf
wcsstr
_open_osfhandle
_close
swscanf
_ultoa
_seh_longjmp_unwind
_setmode
wcsncmp
iswxdigit
fflush
__set_app_type
wcsrchr
malloc
wcstoul
_errno
iswalpha
printf
swprintf
fprintf
towlower
realloc
setlocale
_snwprintf
wcscat
_wcsupr
wcsncpy
_wpopen
_pclose
memmove
wcschr
iswspace
longjmp
wcscmp
_wcsnicmp
_wcsicmp
wcstol
iswdigit
_getch
_get_osfhandle
_controlfp
_setjmp3
_except_handler3
wcscpy
wcslen
wcsspn
towupper
FlushConsoleInputBuffer
LoadLibraryA
InterlockedExchange
FreeLibrary
LocalAlloc
GetVDMCurrentDirectories
CmdBatNotification
GetModuleHandleA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetThreadLocale
GetDiskFreeSpaceExW
CompareFileTime
RemoveDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
TerminateProcess
WaitForSingleObject
GetExitCodeProcess
CopyFileW
SetFileAttributesW
DeleteFileW
SetFileTime
CreateDirectoryW
FillConsoleOutputAttribute
SetConsoleTextAttribute
ScrollConsoleScreenBufferW
FormatMessageW
DuplicateHandle
FlushFileBuffers
HeapReAlloc
HeapSize
GetFileAttributesExW
LocalFree
GetDriveTypeW
InitializeCriticalSection
SetConsoleCtrlHandler
GetWindowsDirectoryW
GetConsoleTitleW
GetModuleFileNameW
GetVersion
EnterCriticalSection
LeaveCriticalSection
ExpandEnvironmentStringsW
SearchPathW
WriteFile
GetVolumeInformationW
SetLastError
MoveFileW
SetConsoleTitleW
MoveFileExW
GetBinaryTypeW
GetFileAttributesW
GetCurrentThreadId
CreateProcessW
LoadLibraryW
ReadProcessMemory
SetErrorMode
GetConsoleMode
SetConsoleMode
VirtualAlloc
VirtualFree
SetEnvironmentVariableW
GetEnvironmentVariableW
GetCommandLineW
GetEnvironmentStringsW
GetLocalTime
GetTimeFormatW
FileTimeToLocalFileTime
GetDateFormatW
GetLastError
CloseHandle
SetThreadLocale
GetProcAddress
GetModuleHandleW
SetFilePointer
lstrcmpW
lstrcmpiW
HeapAlloc
GetProcessHeap
HeapFree
MultiByteToWideChar
ReadFile
WriteConsoleW
FillConsoleOutputCharacterW
SetConsoleCursorPosition
ReadConsoleW
GetConsoleScreenBufferInfo
GetStdHandle
GetFileType
VirtualQuery
RaiseException
GetCPInfo
GetConsoleOutputCP
WideCharToMultiByte
GetFileSize
CreateFileW
FindClose
FindNextFileW
FindFirstFileW
GetFullPathNameW
GetUserDefaultLCID
GetLocaleInfoW
SetLocalTime
SystemTimeToFileTime
GetSystemTime
FileTimeToSystemTime
GetUserObjectInformationW
GetThreadDesktop
MessageBeep
GetProcessWindowStation
cmd.pdb
JJaJaJaJJJJJJ4WJ?MJNMJ
J'JOJ6JEJTJcJ
CMD Internal Error %s
wwwwwwwwwwwwwwww
wwwwwwww
T3333333333333333333333333333333333333333B7501'22222222222222222222222222222222222222'46A(
))))):::::::::::::::::::::::::::::::;+
8!RhyvegggggggggggggggggggggggffwL
=C]xz|}}}}}}}}}}}}}}}}}}}}}}{z~
$WjkkkkkkkkkkkkkkkkkkkkkkkklrtpmnsqocdO9
SPQ^[KIIIIIIIIIIIIIIIIIIIIIIIIJEDHJZDFGYa`_XV/
&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
22222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222.............................22
000000000000000000000000000
111111111111111111111111111
111111111111111111111111111
111111111111111111111111111
111111111111111111111111111
111111111111111111111111111
111111111111111111111111111
111111111111111111111111111
111/---/11-111-1-------1111
111-/1/-11111/-111111111111
111-111111111-/111111111111
111-111111-1/-1111111111111
111-/1/-1111-/1111111111111
111/---/1111-11111111111111
111111111111111111111111111
111111111111111111111111111
111111111111111111111111111
111111111111111111111111111
.2"***************************
.2!$$$$$$$$$$$$$$$$$$'#)(#)
&.2222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222
*****************'''''''''''''''
)))))))))))))
)))))))))))))
)(&&())))(&))
)&((&)&))&())
)&))))))(&)))
)&((&)&)&()))
)(&&()))&))))
)))))))))))))
' $""""""""!#!%
*********************************11
pH\=oE/tG1uH1uI1uI1uI1uI1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1sJ1qI2U.NU+
!,tA*NW+
@@@PPP
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
``````
@@@000
@@@000
h[uiKzkL|mN|mN|mN|mN|mN|mN|mN|mN|mN|mN|mN|mN|mN|mN|mN|mN|mN|mN|mN|mN|mN|mN|mN|mN|mN|mMzhDyf@{iG{lKzjIyf@ygD}jHnFn<o:pDd4I
}|||||||||||||||||||||||||~
k4qDRh@nslS
M4h@xMwwozsHS
t/FOKKKKKKKKKKKKKKKKKKKKKKKKNZ^VOR]ZTUq
szIg7Q'\/
H{D{D{D{D{D{D{D{D{D{D{D{D{D{D{D{D{D{D{D{D{D{D{D{D{Ct:r7v=zBy?r7s:x={;
;w2Z#Q!F
P#NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNO"H
"U&$R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##T&$N
O!M!M M M M M M M M M M M M M M M M M M M M M M M M M M M B#
c---------------------------------------------------------------------------------L!E$
HHHHHH
HHHHHH
;wwwwwwwwwwwwwwwwwwwwwwwwwwwJ
?yMSswj?
?iMMmh14
Zh9X.I(
P!O!O!O!O!O!O!O!O!O!O!O!O!O!O!O!O!O!O!O!O!O!O!O!O!i:
O3U5 Z8#Z8#Z8#Z8#Z8#Z8#Z8#Z8#Z8#Z8#Z8#X8$t>L'
HHHHHH
HHHHHH
HHHHHH
HHHHHH
uDpZ1v]3v]3v]3v]3v]3v]3v]3v]3v_9v_8v_9l^AP*L%
[O_\9H
i.k1j0j0j0j0j0j0j0o6n5p7k;I
iogyoluyfmme
ubnide.exeC:\
L!This program cannot be run in DOS mode.
YYY_Y^
[XmXRichY
`.data
msvcrt.dll
KERNEL32.dll
NTDLL.DLL
USER32.dll
MM#MuMgMM8
iMPoMMM
MNMJMz]MM/M"MM~MwMMqM|SMM
MJMMMj
MM7M1<M
Ma~MlMkMn
MMrM~M=McMtmM~MjMgM+M
MMhM/MaM\M~M
||f||t|P|)|
|=|U|h|,|
<|;|G|
|]|X||[|
|Y|Rj||<x|
|7|2#|
||l|x,|
|f|y||1
|w||(|<|
||,|8|
|Y||+|_|
x;JVW}
J3fG8Y@
+SVWEePEEEEd
JYPhJj
U$x;JVu
PIf=;J3fE
Ef}t2E;Juuu
fffEufd]
3@EE3f
PEPzu?e
PuA_[M^
PYt0F<f8
JYYSYfdC
UQQW39}
JYYf97
UVW39}
|$;Jvu
~`J_^]
N8f<Yf"
WhCJu
F8f<Xf
J5xJ%J
J$J0J]
V3ShFJ;YYuHS
JY@=FJ
UQQSVWj
h@FJYY
!$J0Juu@
UQQSVW
$J_^0J[
}x;JVE$JW3;
1j%[f;
M_^a3f
UVW=FJ
"u+=:J
t;Jf8:
J1t095DJu
h(Jh$Jj-h0%J
0J$J3LfEM
UQQSVWE3P]]{
t$SMEP]F
5t;JhFJ
5t;JhBJ
5t;JhFJ
5t;Jh,CJ
5t;JhFJ
^UQSV3WVu]
VVqEG4_^[
(Jj0h,%J
SS3_^[]
(Jh(Jj/h(Js
h(Jh(Jj.h(JN
JYYw<3UVu
|*3fXS
W3t)9}
fEf;JfEEPfE:
3VKJS;t
uKJFB;|f$uKJ
t4V3f7V
5J__^[
J3F!0R
SV3WC3
x;JEfE
fEf;JVfEE3PfE:
t)VVVVPh
h2J(x;JEE
$(3A,jdX04DfH
J|MQSSj
JxMQSSj
JE;tMMQuPj
GGEPuWj
E +JW;u
DJVSSj
JSuh+Ju
J(;JEM[
J1J_1J
JEPhH3JEP=
JVEPh;Jx}
Vh2Jh;J^9t
JYY3f;JPP.
f;JfEEPPfE:
3f;JPP
JSYYWSS
3f;JPSf
GCF3f9
Y@@M_^[
wft f="
3f<w"tf
x;JSVu
EWt j*V8
PPj'V3
Sh4:JD
FJ5(Y4VW
5t;JEfX
VW=:JG
t)t)6Pv
x;JSVW}
w4E3;tXF
Y3M_^[
PVYY3f;JPVF
j8h@J23
]Sg]EP}
EKJKJ5JPV};
WSE;tE
hhAJx;JE
JJh;JP
Ef;Jf;
S3;fEfE:
fEffEfVP
J3YYPPh
u"ff;Eu
DJ3[_M^`
GGrEFFg3mUh
FFfu3@[_M^
JSWPSRM
_^[3=dJ
U`x;JS]
VEHJWP]xJ
JYPVVj
Jh;JPJ
JPS3SJP9
JJt5;t1h
JhIJPXHJhlIJ5XHJlJhTIJ5XHJpJ
3@M_^[
SetConsoleInputExeNameW
IsDebuggerPresent
CopyFileExW
JVu+WEuE
EPEhLJ4
P3VhLJuu
PVhLJu}
dJEPPE
PVhLJu}
PVhlLJu}
ffJEPPE
PVhLLJu}
ffXJf;t
PVh$LJu}
ff\Jf;t
XJj Zf;
\JEPPE
JYY_^[
J2XHJu
JXHJhMJP
SetThreadUILanguage
M9}t>v
3@UQQVu
Jh;JPJ
;JY@GJ
JE3E3%
j(hxQJ3W
TJ9=xHJ
hpHJhlHJt
EP5|HJEPEPEP
JEhhHJh`HJ>
}=iJJ%
3YdJ3f;J
f>"u*Fj"FV
U SVW5
HJ|J_^[
x;JSVWE6
JYY<JhVJh IJhVJhHJ
0KJVJSPj$
j JJSj1
j JJSj2
j `JJSj3
j JJSj4
j IJSj5
j IJSj6
j `IJSj7
JYYM_^[A
YP\UQQE
SX8@<VWj(E
E9=(;JEt
JYP5(;J
W=(;J=J;
6T]>9;
$;J=(;J=Ju
(;JE J
W5Jm[3%J
3%SPW
G3CUQVu
WJ;t,@
f;Wt,=
W~A3GW
+FFSSu
FFfuf9
j>V$usj(V
uOj^VuCj|Vu7f9
SVW5t;J3hFJ3
Wj+5t;J
JYY_^[
HuKQS1=dJ
;WEDHJ
?3f;Jf;}
u/%H;J
;JtZf=:
tXAAC~
ij.WUF
x;JSVW}
j E-V>-F
JYYtgf
;tqWSx
h%*JG]
UQQSVu
tDSSVWju
3+U@SVWu
x;JSVEE
3PSVPu
f1rGf9wAEj%PuuE;E
x;JV3Vh@FJE"YY
95h;Ju
PPPPPPPu
x;JSVu
JYY3f;JPP
e3f;JPP2@@t
x;JSV5
3@M_^[
ftSf=
r,Vh0nJW
Wh+JPj
CCfuf;
JYYu S
uN3f;JPU
CC3f;JP
JYYu$PSW
39tS3f;JP
PYtGSYD0
JYYM_^3[
t7=P;J
J9u=9t
95P;Jt$I
J950;J
=L;J5P;J3j!s
UQSVW3j
Wh@FJ0;JZYY
DJ?J3F5P;J5L;J=`;J5<;J5H;J=D;J=@;J=8;J
:E5`;JhwJS
0;JE_^[
U0x;Jf
h;JVW}
EEP+JV
PEPVPzj
EPW3f9>
JYYuEPEPEPEPuV
u]3SuuuJ
<;Jt(}
u1Wu'<;J
3@=<;J
,thPYN
JYYE_^[
3f;JSVu
CC3f;JPW
JYY+f$p
JYYM_^[
SV3fW}
JYY_^[
PPou"PV
vEPEPEPEPuuuV
GYGU<x;JEE
395JWE
N8f9:tq9]
PJWv8j(
Jh;JPJ
J;uV=
J%j*v8
;Jx;Jfe
6f;t8V
JQ3@SP:J3
J_[^]
S@VfEWEPfE=
PZSW6*v
P_[^UVu
g]a33jZ
5 Jlh|
hJ3Y=4J
DJh`^JSh5#
4F)lt(
Sh`^JV
FFup=dJ
]tPPEPa
DJhJPW
4EJGNQ
JJPJJEJbJ#J#JlJJU
f9:t6/
Hv8F<t
PSvYYV
hHJYvDhJvH
h<Jh@J
h(Jh,%JhPJj
v<v8hJ
JlJJJJJ*JoJoJJ
JF88,Jtj
v8F88,t
JWgY9}
hDJWFLYYt
PWYYhBJ
F8,Pv<hlJxv@3
th(JHWWv<
JYMWDA
JYMWDA
?v<Qv8hJE
YY@<QSv<YY3y
3@B=dJ
Rh JPVh@FJNu
SPVh@FJ
X$J4FM0
Wft+f}
f;t"=dJ
QPYYF<f
hJ<|x;JEU
3Cx3|j
PJVJ0C
JY<EPJf'
JAHJ@HD
JA J@
JYYJH HpjLX
|PpPtP3GW
fdu1fHfMt
fmu!fHfCt
PVw_^[]
SSp<-y
Yu3_^[]
AAQhl*Jp<x=dJ
JYYf9;unW
DJVuVhJPYY= J3M_^[4s
x;JSVu
E3W=J3@;
JSv<;8
M_^[]q
USVW3Su
Wh;J(qu*Wh8J
f<XCFF;]
@@SP{f8:
j:hPJf
EPJIo;
JYY<GJ@
WPYYJ@
t+jL_p}#Jt
Pf2f t
JYYL3C
NtQueryInformationProcess
UPSVW3Fj
]twf;Etqf=*
UAHuEf
3B;~7E
f93EEu
E3SuuE
ECCf!4Ch4JS]
S}st;Jf
u;t-} }'M3@#EEt
t@3f9>t
hJ5t;J
F<;tSP
v<Nz;t
:J3^[]
x;JSVu
:JcSSV,ff9
J3Gf9\F
JYVAat
iM_^[~`
hJp< J]
3@^[M__
JYuSh;J_uS
NNcW3;
Vh]Jff
PP{8-u
PH_39^
;Jx;Jfe
QPd_39N@^D]
f;Mtyf;
3M_^[Y
\JE3@3
XJBSVW3
JcSSVc}
JJh;JP
JSZWSWZ
JJh;JP
JSZjpE
3M+fMV
JEPuuj S
JE39}E
3d;JT;J4;J\;JX;Ju
V395l;Ju
p;J;t^W}
JS]EPh
E[_fE^
SVW39M
=\;J_54;J^T;JX;J3[;
X;Jd;J
JT;JYYMP
3SV395d;JWuuuufufu}fufu}fufu}fufu}fufu}fufu}uu
EPSp9u
VVVVVuuWuL
J;YYd;J
ft(PhJ
JULx;Je
ESPYHWE
hJ9}}E
M3MQPMQPu
J@hPJP
JUQS39
:Ju@VWE
JiL[Ks
;JVW3;
;J=$;J=(;J_^
W3PVH}
3w _^[]
39}u&j
u;PMf8\t
SM_^[E
3M_^lE
JYYEWWWWWj
JYYu:E
;Er3u|utul;u
u(Eu$F
x;JS3VWffE3ffu
ffffffff=Jh
DJYYW$B
M_^[@
JRh3JQV
NXN`WNd
[M_^=>
SVWj,A&
JYYPPSVWR
UQ3S@9E
VWErC5
hL`JS
YYt3hJS
YYt%hlJS
hJp< J]
H7PPV^O
hPhat+VP
:JPPf
PHu@3G;
Fx;JSVW}
33SFWER
JSSSYP
WQPPS5J
}OM_^[]4
SVWtHu
J395T;J~
d;J4G;=T;JY|5d;JY5d;J;
3^3iuhdJj
Ju.EPj
fEfJf9
3@j EP?
+hJ9}Sh4#
3Y3@gUQQE
UQSV38
G<]tcj/P0;tU3fF
V|0;u9]t$SSj
J3_^[
[t:f>f'
fhtcfHt]fmtW
j EPPPSrP
dJW]tcj/P\.;tU3fG
W0.;u9]t$SSj
J3_^[
x;JSVu
u35J5JPPSp=P
JujSSPPSvpP
VPJPPS5J-pP
5JPhJv
3AFFf9
f;Jf9E
}U3f;JVu
hJu=<;J
g=<;J\UE
UjhxJhJd
t8x;JESVWeE
DHLPTX\lf
J3GSP@f
JYYSV'5
P=Ph]J=P
=PYY=9
J;t_PVj
nJJUQSVu
JYu69E
;Ju3;]
@@}PPWd;
th4J}PYY
hJ}PYY
shJ}PYY
hJ}PYY
hJ}PYY
hJ}PYY
hJ}PYY
hJ}PYY
fEYEPfE:
JYY3_#j<hJ$x;JEE
Q3Sp<"&u8
dJt!V(;v
Vl J;u
JMu !
ZJSVWj
JFFF3f
f>0u!Jt
8+FFN0
PP O5
Jj\P;YY
PYYPVV
JYY_^]
x;JVW}
PPj7P2
W3f9>EE
WWv<&SPuuV
3=3^9E
f\t)f:
x;JSVu
JfD_f=:
JYYChL`JP
x;JS3WxffE3ffM
ffffffffJxPQ
EEPEPj
;Jx;Jfe
39O@_D]
q3M_^[
u)j?v8
t#SP`YY3@3h9
Q+`YY3@<
F8SPV;
U\x;JSVu
W33Cj E}=
2SuV+Eu;
;JEM_^[S
R3@kUS]
Vs<>6W
Wt;Jf
t;Jf8(uv
v8~f=@
W3Wv<,
F<@@PhJWYY_3^]
UQS39]
% J.UW}
WYY^_]
t;JtPW
_^^SVW5t;J3hFJ3
j)5t;J_
5t;Jh<J
5t;JhDJ
;5t;JhLJ
t;Jf8%
FD3fFDPh;J
I5t;JF8PPhXJ]
5t;JF8PP
h,JF<;
JYYj)p
t;Jf8)
5t;JWW'/
^SVW5t;J3hFJ3
j*5t;J}
5t;Jh`J
USVW3S
5t;JhBJ
dJt65t;JhAJ
5t;JhAJ
W3j0E=
JYYPYD
JYYPYD
"3M_^[p
x;JVEE
PVPVVVP
E E$SE(Vu
^ ^$^(^,
JYO0DA
JWtpSY39E
WYY3_^[]
UlW39=J}
u(u$u u
ffVWE3M
ff5JffffffffPQ
WEP3Wj
;Jx;Jfe
x;JSVu
3M_^[f
a<;Ja}
_3@z^7
X3hJWDhJMD
u 5`;JhwJ]Pj
WVS3D$
;JQPFF3f
3f;JPVu%J
u!VJ0p
JShJ@Yy=
t"gjnghl#
BYYggJH
WPHL;YY
;J0tS+
FFf>FFCC
F<3f98
F<Gf<x
A3Y@Y J
FFeSEPj
v@gv<_u
JfSht#
?YY33@wWe
J>YY3@
SSSSVhPJS5J
t$SSSShPJS5J
SPJ+SFSFSVP9t
JP3FVh#
J+M+kd
lcP5Jj
3@c3@cf='
E+PVS]
JE+f$C
u)CCS]Ef8"u
f0EHH;
f8 t3PPj
J3PPPW
J9uu8]
;JE4e]
@@BBf^u
YYu&Sj
3qcPh#
9YY3@\c
;J3C{FL;u
JWWWPE;
u3FVh#
oWPuu;t;E}uTf8\t
JYYWWv<PuuVum
;JWht#
0KJ)J,
0KJ)Jq,h
JSYY,h)JSYY,h)JSYY,h)JSYY,h)JSYY,h)JSYY,h)JSYY,h)JSYY,h
-h)JSYY
IJ| JJrj
YPllPq
C50KJP
JPhSc}
=J }3j@5J
SPKJPWPVhJj 5J
J 3g5JhJ2YuP5J
uIj_t#5JW
Jh]JW5J5JWYYW
JY3QPo
h@KJP`KJPQP
JYY!39
f!Ez=<J
RQh`KJPhHJEj P
SPJF<f9
u"Sh7#
<YYSSj
hJ0YSv<Po
u"Sh8#
d<YYSSj
SOhJf0Yjw<
JhTJ@hJP
hhJp<3f9
0Y3Y@mBmPCo
.mBAAf9;t;
\PWSht#
Sh0nJWut
DJVSSj
JYYu?~
E5J JE
K,@Ru+j
Q[-YYZdj
V+YY3A9GGf
W9\9Vh
_83@Y83R8h
*Y3Y@{j
*Y3Y@{h*#
$PhJ&YY5=
HEf8.u
g53<3F-i5hwJ?Pj
953@295J
hxAJp;t6SQh
LHJu=9u=SPVWj
Pt PPYD
J@hPJP
PVYYf>:uj
PVYYf>:u)j
PVYYf>:u"j
*95JYYusVh#
tT95JuLVh#
*95JYYu7Vh#
*95JYYu"Vh#
x*95JYYu
Vhl*JW4
JE3f;JYYPS1MLK;t
JYYVSW6
V3VSHHt
Xst2Ht#
HHuwD;f
JYYt.f&
u 9tPj
WetGPPh
t1Jf;t'JQt
tT`PPuW
WVS`P%4Ff
FWFVS`P4F
FFVSPSH
YY>PYY5<f=
YYjh@FJ
x$J4$Jf
{C+PQ5$J
`#YY;]EPEj
;EEf<EJ
fk50Jh|HJ
JYYF<t
JYYF8~<f$X
EPVEPj
PW;WtG>6h
Y3P}EPV
hHJ>F8~<
eJSh)'
VLSFS@Sh)'
YY3+Pj
YY3C3,N
;Jv i}H
J ;JWp
;J@ ;J|Wj
;Jp$ ;JF ~$5 ;J5
JCPVu4|=
HF$|SWj
CC;r;t?j
EP+VWj
CC;]r;t9VL|
EP+VWj
Jt;9uu6u
xh`^JP
zf?" t
GG;}r;t;j
+MQWPj
Jtr9}umEE
GG};}r;t>V
;WN_^]
MHJ%3@
5t;J5DJh0RJ
t;Jf<AC
]]PF<]=dJ
hSJ5t;J
uhSJ5t;J
YhSJ5t;J
=hSJ5t;J
!hSJ5t;J
AGgt;Jf
JYYj*D;
Y3Y@P\S
f:j\^j
f;twf;t
t]Kf;t
f;uf;u9f
3EPPPEP
Jt!Ut
;JfDfEf
PPUPDW}
ftXf=
JYYXX"Su
&  j:W
J$=<;J
3jna=<;J
5P;JPSRt
395P;Jt,=<;J
eP;J3;t
=<;JPPSs
PhyJPs
JPPPYP
J3PPPYP
tX9uJ9t
!3GPWh'
3VWPWw
u<958;Ju
u<=<;J
3950;Jt<u-PPl
PeC |3~]
PurIHf
u&=@;J
@EFHJy
VgPDSh*#
zY3Y@}D
mVWh]#
j EPjEPj
JEPSVj
B;UrPSVj
JT J;E
EPEPRp
J;r+E
JE<U3E}
@ Hu3B
Y202*u
395JuAVu
YYt-};t
YY95Jt
ffEff;Jfh
JPEPuP
vREh`tJP
JYYRuj
EPhJYY/SEhJEYTN
3Y@|3CEPP
JYYt;v
YYWW>Ht
rf;JfEfF
qf;JfEfF
JP9YYCPP
JP)YYP
31Sh*#
JYYh(#
UWP+YY
YYGGdj
Y+tS+t4
2Bd :du
];3f;JPW)u[f?.
JhL`JS
;PSYY
6YY3@zUPPYYPw
u(Thl*JP
T6F`PvXPo
Tv\6Pro
THt?Ht"
~T6@vTu
YY9_f;JfEfG
Jr|PPq5
{OShw#
{YYiOf|OP
SDC,P6KIJ
JtPPPPPj
hhJ)PGhl
S,S6GI
K,SQPg`
CG]C;]]r[39
3@FS5Jj
JJcPPj
@fEabb@b
}PPWe;
bPWhb#
ahJ}PYY
PYYh88J
J}PWhu#
PYYtahHJu;u
J(tof9tfP=
s#h]J}P
J`3aSS
BB8Zu8
3P[f8.
JYYtPj0y
joqjoXeQP^<
jo3Fdht#
J@}3@3@^Aot
1HX;J1@
JY0u9}u
Null environment
JvDNt@Nt4Nt(Nt
USV5JW3;
@<;t'WP
@@f/uUf
f0rLf9sF
:8x,x(uF
3;t8f9
3Y@Y J
NDNl3_^[]
JPZhJ+Y3
ub3!5Jj
JY33f97t
@@fuf90u+D
CCFFf9
uCCFFf9
VYYV'FFhL`JVYYP
trPXFFPVhl
M_^[Iz
JS3+VWt
JYYtzVC
U x;JM
PEP"xuW}
ftfPEPwt-f
f3@M_^['w
x;JSVu
f`KJfE:
fEh@KJEP
J;YYt.f9
PhJYYEPEP
JEh48JP
EPPyf9
J;EPVPu
JPYY3@M_^[
JhTJ@hJP
}9}vL9=Ju?E9Er.u
4Cf>f&
YY3E\C
JhTJ@hJP
APerformUnaryOperation: '%c'
zt]%t>Ht0
T<tUHtGHt* t
APerformArithmeticOperation: '%c'
YYuWSpJS
JYYt<E
,EPEPE
3F_^[]
UHx;Je
JEEj P
JEPSot
JEMEf>_^[&m
F<W3;t
u*j;v<llt
Jhl*JP*j
h48Jv<
JPQn,9}
JRatPVhJ
pPh$FJ$nP
mpPh$FJ
x;JSVu
uj"V;YYt
FFf>"u
f;uj"V;YYt
v"Mf8 s
;t.fEh
YY3@M_^[0i
P2ftIf=t4ShPJ
JYYt1E
u0uu)u
S3;VWtvf9
E]]uEPm}9]u
HY3Y@_^[
VWjuS5J
E_tuVUe
j X;wC
IIt/It,IIt$
;w1tx+tqIt
+t@3t4
Jugf.uMPPPS
uo3k3@hj
Pyj W~ht
3;twf9>trV
JE;uG}WWWh
x;JSVW}
Jugf!uPPPj
f?.u$j{^Wj
M_^[g^
VWvj We;t
f0WhlJh
PPPVhl*J
ShlJEh
;ttf9>to
FFf9>uf
WWWPf>
;tIf9>tDV
JM_^[[
UQQSEPhJh
hhJp<O`f9u
f8=YEu_WV[5
WF[PWYY
3t W2[t
W([PWYY
UQQSEPhJh
hhJp<1_f9u
f8=YEu_W8Z5
W(ZPWYY
PWuX_3F9u
x;JSVW3Vh@FJE
VVp<]f93
XPYYW}Xt
WsXPWYY8
t!QPYY
;JQPgW
YEPmj ;XQq
ts3f;JPP]
QPYYPP
UDx;JVEj EPj"}
VmYEPj
VMYM% J
x;JEhJVu
WElJ3f9>Eu
JYWWWWPh
J;u+hJ
Ph`JPj
Ph`JPj
3@M_^R
Jp< J]
VW3VVp<:Wf97u!95JVt
JShBJpT3JSW
YY[_3^]
v TYY^3]
YYjh@FJ
WYf|G t
JYY_^[]
uaj!EPVj
JEY<_]Y4F0=J
Vr4W{4E
JYYE9F
C4;{4u
R/x_^[
Vp4W3;f}tSS]
EPSNf~
JWPS(Wv
Ht^HuR}
:uRv4j
|3_^[]
H9uv4}
|iUSVu
3CSv8WlF<86u
JWOWv<tWv@k~H
SvDW)WvH
3CShBJW
ShLJWFLt
SPWShBJ
JWF8S,PWsWv@
3C,|d-~X.tL/t@0t41t
9uFShPJu
JtHFD;u
v<_^3[]
h@FJZTYYt
UV3zt!U
UQSVW3u
Utx;JV5
j EPjEPj
3@M_^C
h|JY`EfEfEfEfEfEfEWfE3EPf}uEWPSf}f}fE
Jf}f}ujP
p<5IIt
P/YY3]
v<O5HH
Hubv<=X38P
fuVWf8
Vp4t=h
uhJ>^]
hJ/t;Jf
j hJOYYu
YYSv<Sv@~~H
j hJzOYYuvDh8JhvHOF8H,Qv<Ph JNv@
5~j6uRv8h8J
HuhSVh(J
SVh0%JvSVh
JjSVh(Ja7t
9u7SVhPJN6v8hJ
YYV6%6hJ
SVh,%J
SVWt#j
3_^[]4
x;JVW}
VPPnDu/VWP\Du
3M_^{<
SVW3Vj
t#EPEPF
3uU3Vj
J3_^[]
UQQ<;J
CCjnQ@j
S?_^[]
x;JSVu
0;Jt7j
PVB3G;
PVPW/9
0;Jt=Ou.PP
PhJfYYP^
trSP=0;J
!=3M_^[3
=3@<<jn9j
SR<WN<Njn9
<SwNlNj
J3PPh]Jh+#
PP7hJP
EPj)0{(=#
EPj*=#
P*YYM3/1
x;JVQQEE
Jt#;sf
UQx;JEE
u3_^[]
W8j.0V06
P @$Vq ;
tAHt3HHt$
j P+D5
j.Sk3+
33f}Pt
t0_t'3fG
VQPPPh
JWuQVPj
P#Ph`^JWXu%PPD
J3M_^)
JYPWVu
VM_^^)
t0Pf;w@F
r_^f[]
JYY3WWWWPh
WPxuY3Y@
ff9t PPj
V$_M^S'
x;JSVEE
Wh KJ$
WS-/N0N0
t(9,t ,,
4Fh KJV
,Wh KJV
Yt83;w2r
9(s(;$r
A3A;wr
JYY$YM_^[%
tVwF F
PW,Ph`^JWJ
W>M_^+%
t.u*F' t$J
@PWUF F
PWPh`^JWO[M_^
JYYPIt
Wffffff
E(Ex;J tHJ$j
QRPh J
ADVAPI32.dll
ZSHELL32.dll
MPR.dll
SaferRecordEventLogEntry
ImpersonateLoggedOnUser
SaferCloseLevel
SaferComputeTokenFromLevel
SaferIdentifyLevel
RevertToSelf
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
RegSetValueW
RegCloseKey
RegQueryValueExW
RegOpenKeyW
RegSetValueExW
RegCreateKeyExW
CreateProcessAsUserW
RegOpenKeyExW
FreeSid
LookupAccountSidW
GetSecurityDescriptorOwner
GetFileSecurityW
ShellExecuteExW
SHChangeNotify
WNetCancelConnection2W
WNetGetConnectionW
WNetAddConnection2W
msvcrt.dll
KERNEL32.dll
USER32.dll
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__initenv
_cexit
_XcptFilter
_c_exit
calloc
_wcslwr
_vsnwprintf
wcsstr
_open_osfhandle
_close
swscanf
_ultoa
_seh_longjmp_unwind
_setmode
wcsncmp
iswxdigit
fflush
__set_app_type
wcsrchr
malloc
wcstoul
_errno
iswalpha
printf
swprintf
fprintf
towlower
realloc
setlocale
_snwprintf
wcscat
_wcsupr
wcsncpy
_wpopen
_pclose
memmove
wcschr
iswspace
longjmp
wcscmp
_wcsnicmp
_wcsicmp
wcstol
iswdigit
_getch
_get_osfhandle
_controlfp
_setjmp3
_except_handler3
wcscpy
wcslen
wcsspn
towupper
FlushConsoleInputBuffer
LoadLibraryA
InterlockedExchange
FreeLibrary
LocalAlloc
GetVDMCurrentDirectories
CmdBatNotification
GetModuleHandleA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetThreadLocale
GetDiskFreeSpaceExW
CompareFileTime
RemoveDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
TerminateProcess
WaitForSingleObject
GetExitCodeProcess
CopyFileW
SetFileAttributesW
DeleteFileW
SetFileTime
CreateDirectoryW
FillConsoleOutputAttribute
SetConsoleTextAttribute
ScrollConsoleScreenBufferW
FormatMessageW
DuplicateHandle
FlushFileBuffers
HeapReAlloc
HeapSize
GetFileAttributesExW
LocalFree
GetDriveTypeW
InitializeCriticalSection
SetConsoleCtrlHandler
GetWindowsDirectoryW
GetConsoleTitleW
GetModuleFileNameW
GetVersion
EnterCriticalSection
LeaveCriticalSection
ExpandEnvironmentStringsW
SearchPathW
WriteFile
GetVolumeInformationW
SetLastError
MoveFileW
SetConsoleTitleW
MoveFileExW
GetBinaryTypeW
GetFileAttributesW
GetCurrentThreadId
CreateProcessW
LoadLibraryW
ReadProcessMemory
SetErrorMode
GetConsoleMode
SetConsoleMode
VirtualAlloc
VirtualFree
SetEnvironmentVariableW
GetEnvironmentVariableW
GetCommandLineW
GetEnvironmentStringsW
GetLocalTime
GetTimeFormatW
FileTimeToLocalFileTime
GetDateFormatW
GetLastError
CloseHandle
SetThreadLocale
GetProcAddress
GetModuleHandleW
SetFilePointer
lstrcmpW
lstrcmpiW
HeapAlloc
GetProcessHeap
HeapFree
MultiByteToWideChar
ReadFile
WriteConsoleW
FillConsoleOutputCharacterW
SetConsoleCursorPosition
ReadConsoleW
GetConsoleScreenBufferInfo
GetStdHandle
GetFileType
VirtualQuery
RaiseException
GetCPInfo
GetConsoleOutputCP
WideCharToMultiByte
GetFileSize
CreateFileW
FindClose
FindNextFileW
FindFirstFileW
GetFullPathNameW
GetUserDefaultLCID
GetLocaleInfoW
SetLocalTime
SystemTimeToFileTime
GetSystemTime
FileTimeToSystemTime
GetUserObjectInformationW
GetThreadDesktop
MessageBeep
GetProcessWindowStation
cmd.pdb
JJaJaJaJJJJJJ4WJ?MJNMJ
J'JOJ6JEJTJcJ
CMD Internal Error %s
wwwwwwwwwwwwwwww
wwwwwwww
T3333333333333333333333333333333333333333B7501'22222222222222222222222222222222222222'46A(
))))):::::::::::::::::::::::::::::::;+
8!RhyvegggggggggggggggggggggggffwL
=C]xz|}}}}}}}}}}}}}}}}}}}}}}{z~
$WjkkkkkkkkkkkkkkkkkkkkkkkklrtpmnsqocdO9
SPQ^[KIIIIIIIIIIIIIIIIIIIIIIIIJEDHJZDFGYa`_XV/
&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
22222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222.............................22
000000000000000000000000000
111111111111111111111111111
111111111111111111111111111
111111111111111111111111111
111111111111111111111111111
111111111111111111111111111
111111111111111111111111111
111111111111111111111111111
111/---/11-111-1-------1111
111-/1/-11111/-111111111111
111-111111111-/111111111111
111-111111-1/-1111111111111
111-/1/-1111-/1111111111111
111/---/1111-11111111111111
111111111111111111111111111
111111111111111111111111111
111111111111111111111111111
111111111111111111111111111
.2"***************************
.2!$$$$$$$$$$$$$$$$$$'#)(#)
&.2222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222
*****************'''''''''''''''
)))))))))))))
)))))))))))))
)(&&())))(&))
)&((&)&))&())
)&))))))(&)))
)&((&)&)&()))
)(&&()))&))))
)))))))))))))
' $""""""""!#!%
*********************************11
pH\=oE/tG1uH1uI1uI1uI1uI1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1uJ1sJ1qI2U.NU+
!,tA*NW+
@@@PPP
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
``````
@@@000
@@@000
h[uiKzkL|mN|mN|mN|mN|mN|mN|mN|mN|mN|mN|mN|mN|mN|mN|mN|mN|mN|mN|mN|mN|mN|mN|mN|mN|mN|mMzhDyf@{iG{lKzjIyf@ygD}jHnFn<o:pDd4I
}|||||||||||||||||||||||||~
k4qDRh@nslS
M4h@xMwwozsHS
t/FOKKKKKKKKKKKKKKKKKKKKKKKKNZ^VOR]ZTUq
szIg7Q'\/
H{D{D{D{D{D{D{D{D{D{D{D{D{D{D{D{D{D{D{D{D{D{D{D{D{Ct:r7v=zBy?r7s:x={;
;w2Z#Q!F
P#NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNO"H
"U&$R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##R##T&$N
O!M!M M M M M M M M M M M M M M M M M M M M M M M M M M M B#
c---------------------------------------------------------------------------------L!E$
HHHHHH
HHHHHH
;wwwwwwwwwwwwwwwwwwwwwwwwwwwJ
?yMSswj?
?iMMmh14
Zh9X.I(
P!O!O!O!O!O!O!O!O!O!O!O!O!O!O!O!O!O!O!O!O!O!O!O!O!i:
O3U5 Z8#Z8#Z8#Z8#Z8#Z8#Z8#Z8#Z8#Z8#Z8#X8$t>L'
HHHHHH
HHHHHH
HHHHHH
HHHHHH
uDpZ1v]3v]3v]3v]3v]3v]3v]3v]3v_9v_8v_9l^AP*L%
[O_\9H
i.k1j0j0j0j0j0j0j0o6n5p7k;I
T]fitt
]f[LRYiqjvidt_{btnyz
o{9;=DYTYistebqkvwJSCTE]f[LRYiqjvidt_{btnyz
jjjjjjj
jjjjjj
jjjjjj
jjjjjjjj
jjjjjjjj
Djjjjjj
jjjjjj
jjjjjjj
jjjjjj
jjjjjjj
FFFFFF
(null)
((((( H
h(((( H
H
@@@sitsetup.dll
VS Custom
ProductDir
Microsoft Visual Studio
Microsoft Visual InterDev
Microsoft Visual Basic
Microsoft Visual C++
Software\Microsoft\VisualStudio\6.0\Setup
@@@VS Custom
CLOCK$
\StringFileInfo\%04x%04x\OriginalFilename
\StringFileInfo\%04x%04x\InternalName
\StringFileInfo\%04x%04x\FileVersion
\VarFileInfo\Translation
( ---- )
( ---- )
(--:--:--)
( %s )
.\LocData
@.1033.ini
ESTATUS: Logging Started
-x -s %u
Setup.exe
DVS Setup Watson Report
WARNING: g_strVSSWProdVerKey property not defined; can not initialize registry settings .
WARNING: g_strVSSWProdNameKey property not defined; can not initialize registry settings .
ERROR: Failed to initialize from the registry
Entering InitializeParameters
[VSSWProdName]
setup.exe
FilesToDelete={.*}
STATUS: Finished Running Watson
ERROR: Failed to Launch Watson.
STATUS: Running Watson...
STATUS: Finished Initializing Externals
ERROR: Failed to initialize the Watson Externals.
STATUS: Initializing Externals...
STATUS: LangID Set to: %s
ERROR: The Property bag collection did not contain a LangID as expected.
STATUS: Exiting because of abort
STATUS: Watson Reporting Completed Successfuly.
STATUS: Finished Generating Watson Manifest
STATUS: Manifest FileName: %s
STATUS: Manifest Exported Successfully
ERROR: Failed to export the Manifest to a file.
ERROR: Failed to merge existing manifest
STATUS: Using existing manifest: %s
STATUS: Preparing the manifest...
STATUS: Finished Preparing the tools...
ERROR: The Setup Event's tools failed in PrepareTools().
STATUS: Preparing the tools...
STATUS: Finished Initializing Watson
ERROR: Failed to initialize manifest data.
ERROR: Failed to initialize the setup event's parameters
STATUS: Initializing Watson...
@@@PriorityQuantumMatrix
SYSTEM\CurrentControlSet\Control\Session Manager\Executive
ProductId
Software\Microsoft\Windows\CurrentVersion
microsoft.com
EUserID
%s, %s, %s, %s, %s, %s, %s
%s, %s, %s, %s, %s, %s, %s, %s, %s, %s
==============================
CWUXLog
InstallRetryAttempted
DL_Info
BPrecheck
BFIFIDownload
ProgressRestore
ProgressMinimize
DownLoadRetry
NewCertificate
SMTPNotifEnabled
CustomPropIni
HTTPSEnabled
DepCheck
DepCheck_Result
DL_Error
AdminMode_Failure
Maintenance_Close
Maintenance_Cancel_Yes
Maintenance_Cancel_No
Previous_Version
AppsRunning
HWInfo
PID_Trial_Entered
PID_Expired
PID_Invalid
Channel_ID
Selection_Restore_Default
Selection_Comp_Path_Changed
Feature_Select
IsInternal
TargetDriveSize
InstallAction
Complete_Close
SessionCancelled
Destination_Cancel_Yes
Destination_Cancel_No
EULA_Cancel_Yes
EULA_Cancel_No
Welcome_Cancel_Yes
Welcome_Cancel_No
ConnectionType
WebInstall
InstallReturnValue
ProductLang
SysInfo
OODS_OK
OODS_Ignore
ProductVersion
SessionID
Complete_Save
Complete_Finish
OODS_Cancel
OODS_Retry
Restart_Later
Restart_Now
Download_Cancel_No
Download_Cancel_Yes
Install_Cancel_No
Install_Cancel_Yes
Config_Cancel_No
Config_Cancel_Yes
Download_Close
Download_Cancel
Install_Close
Install_Cancel
Destination_Change
Destination_Close
Destination_Cancel
Destination_Back
Destination_Next
Selection_SL_AUpolicy
Selection_SL_EULA
Selection_Readme
Selection_Comp_Select
Selection_Close
Selection_Cancel
Selection_Back
Selection_Next
EULA_Click
EULA_Close
EULA_Print
EULA_Accept
EULA_Cancel
EULA_Back
EULA_Next
Welcome_Close
Welcome_Cancel
Welcome_Next
Admin_Mode
VI_Override
Successful_Completion
Setup_Warn
Setup_Blocked
Reboot
Multiple_SKUs
Diskspace_check
BITS_Version
BITS_Bitrate
BITS_Transient_Error
OODS_Install
OODS_DL
HTTP_FileVer_Fail
Certificate_Fail
BITS_Fatal_Error
End_Session
Begin_Session
@@@Outer UIFlags=%d
IsCorpnet=%d
Failed to DoOP() param tool in CSetupEvent::PrepareTools()!
Failed to initialize param tool in CSetupEvent::PrepareTools()!
Missing ParamTool member in CSetupEvent::PrepareTools()!
WARNING: UX Log not available; failing to initialize
WARNING: CreateFile on [%s] failed with [%d]
WARNING: No need to send empty UX log.
Watson UX Log file size [%d].
/StageOne/Simple/vs_ux.htm
/dw/SimpleTwo.asp?Client=vs_ux
Simple
@@@[%s,%s] %s
EERROR: Failed to get the temp path in ProcessFile()
ERROR: Failed to enumerate the Streams in CWatsonExternalsHandler::FindDWInMSICab()
ERROR: Failed to find the MSI DB in CWatsonExternalsHandler::FindDWInMSICab()
Extracted DLL file [%s]
ERROR: Failed to Create Temporary Watson Intl Folder
Extracted EXE file [%s]
ERROR: Failed to Create Temporary Watson Folder
_1033.
Processing file [%s]
ERROR: Failed to enumerate the Files for the following cab:
ERROR: Failed to extract the stream:
Processing Stream [%s] into file [%s]
ERROR: Failed to get a unique file name!
ERROR: Failed to get the temp path
_watsonintl.msm
_watson.msm
STATUS: Launching watson with command lines:
CMD: %s
ARGS: %s
ERROR: Watson binaries not found.
STATUS: Watson binaries found in MSI Cab; Located at: %s
STATUS: Searching the MSI for binaries to extract.
STATUS: Watson binaries found in VSSetupWatson sub-folder at: %s
WARNING: Failed to find source dll for copying: %s; attempting to look for watson elsewhere
WARNING: Failed to create Directory: %s; attempting to look for watson elsewhere
STATUS: Searching the VSSetupWatson sub folder.
WARNING: Failed to copy watson dll to new location: %s; attempting to look for watson elsewhere
STATUS: Watson binaries found in current folder at: %s
STATUS: Searching the current folder.
STATUS: Watson binaries found in Shared install location at: %s
dSTATUS: Searching the registry (installed DW2.0).
STATUS: Searching for the Watson binaries.
@@@ERROR:Failed to delete the temp manifest in MergeManifestFile().
ERROR:Failed to copy the new manifest in MergeManifestFile().
ERROR:Failed to delete the original manifest in MergeManifestFile().
UIFlags=1
UIFlags=
ERROR: Failed to open output manifest file in MergeManifestFile().
ERROR: Failed to open input manifest file in MergeManifestFile().
P10=%s
P9=%s
P8=%s
P7=%s
P6=%s
P5=%s
P4=%s
P3=%s
P2=%s
P1=%s
Preparing Watson:
ERROR: Failed to merge the manifest file in MergeWithExistingManifest().
ERROR: Failed while trying to access existing manifest in MergeWithExistingManifest().
@@@NoMSI
WARNING: Failed to generate random temp sub folder for data files; failing to initialize
WARNING: MSI Log not available.
LAST 100 LINES INFO :
CA NAME: %s
MSI CA LOG ENTRY INFO:
======================
VSSWMSIFailInfo.txt
STATUS: Writing Data to temp file: VSSWMSIFailInfo.txt
Action: %s
StartTime: %s
EndTime: %s
Duration: %s
MSI ACTION INSTALL TIME:
========================
VSSWMSIInstallTime.txt
STATUS: Writing Data to temp file: VSSWMSIInstallTime.txt
Feature Selection Code:%s
FEATURE SELECTION INFORMATION:
STATUS: Writing Feature Selection Data to temp file
OSName: %s;OSVer: %s;OSServicePack: %s
REBOOT INFORMATION:
===================
STATUS: Writing Reboot Data to temp file
MSI FOOTER INFORMATION:
MSI COMPONENT LIST INFO:
MSI HEADER INFORMATION:
=======================
VSSWMSISummary.txt
STATUS: Writing Summary data to temp file: VSSWMSISummary.txt
ERROR: Failed to Open Destination file for Stream in ExtractStream()
ERROR: Failed to Read Full Record Stream in ExtractStream()
ERROR: Failed to allocate memory in ExtractStream()
ERROR: Failed to Read Record Stream in ExtractStream()
ERROR: Failed to Fetch View in ExtractStream()
ERROR: Failed to Execute View in ExtractStream()
ERROR: Failed to open MSI Database in ExtractStream()
SELECT `Data` FROM `_Streams` WHERE `Name` = '%s'
ERROR: Failed to Read the full stream
ERROR: Failed to read the Msi Record stream
ERROR: Failed in call to MsiViewExecute
ERROR: Failed to open MSIDatabase View
ERROR: Failed to open MSI Database in EnumerateStreams()
SELECT `Name` FROM `_Streams`
@@@ERROR: Failed to find cab file to use in EnumerateFiles())
@@@Win 95
Win 98
Win NT
Win 2k
Win XP
Win XP Server
Win NT Next
Win 3.1
Win Millenium
Win Vista
Win Longhorn Server
Second Edition
Software\Microsoft\Windows\CurrentVersion\Setup\OptionalComponents\ICS
LANSECNT
LanmanNT
ServerNT
ProductType
SYSTEM\CurrentControlSet\Control\ProductOptions
MSI (s) [1]: Executing op: ActionStart(Name=[2],
MSI (s) [1]: Executing op: RollbackInfo(,RollbackAction=Rollback,RollbackDescription=
MSI (s) [6]: Note: 1: 1935 2: [1] 3: [2] 4: [5] 5: [3] 6: [4]
Scheduling reboot operation: Deleting file [2]. Must reboot to complete operation.
Scheduling reboot operation: Renaming file [2] to [3]. Must reboot to complete operation.
Action ended [Time]: [1]. Return value [2].
Action start [Time]: [1].
Action [Time]: [1]. [2]
Error [1].
Rollback
SetupDW
@@@DDSet_Entry:
DDSet_Exit:
DDSet_Warning:
DDSet_Error:
DDSet_Status:
DDSet_CARetVal:
%2.2d:%2.2d:%2.2d
ADVERTISE
INSTALL
: Component:
SetupDW could not open MSI log file.
SetupDW could not find Action Start Execute Op in Error table
SetupDW could not find RollBack Execute Op in Error table
SetupDW could not find Install Assembly Component (1935) in Error table
SetupDW could not find Scheduling reboot operation (1903) in Error table
SetupDW could not find Scheduling reboot operation (1902) in Error table
SetupDW could not find Error in Error table
SetupDW could not find Action in Error table
SetupDW could not find ActionEnd in Error table
SetupDW could not find ActionStart in Error table
FindError: Empty MSI Log file passed.
UTF-16LE
UNICODE
@@@VS Custom
Locale
.Default\Control Panel\International
\kernel32.dll
.Default\Control Panel\desktop\ResourceLocale
z([0-9]+)
w([a-zA-Z]+)
q("[^"]*")|('[^']*')
h([0-9a-fA-F])
d([0-9])
c([a-zA-Z])
b([ \t])
a([a-zA-Z0-9])
Link9x
LinkNT4
VS Custom
REPAIR
UNINSTALL
REPAIR
UNINSTALL
VS Custom
netfx.msi
USING_EXUIH=1 REBOOT=ReallySuppress FILESINUSETEXT=""
InstallerLocation
USING_EXUIH_SILENT=1 REBOOT=ReallySuppress FILESINUSETEXT=""
ADDEPLOY=1 ACTION=ADMIN
AdminProperties=ADDEPLOY=1
MSCOREE_DLL_____X86.3643236F_FC70_11D3_A536_0090278A1BB8
SOFTWARE\Microsoft\Windows\CurrentVersion\Installer
InstMsi.exe" /c:"msiinst /delayrebootq"
InstMsiW.exe" /c:"msiinst /delayrebootq"
\msi.dll
msi.dll
Checking Windows Installer version...
msi.dll loaded ok
Looking for: %d.%d.%d
Found: %d.%d.%d
Detected old Windows Installer
Windows Installer version ok
Cannot find Windows Installer.
Cannot detect Windows Installer 2.0 or higher on Windows XP or higher. You need to repair operating system to reinstall Windows Installer.
Finished Checking Windows Installer version. Return code %d
QuietExec(%s) returned %d
QuietExec(%s) threw an exception.
CreateProcess(NULL, %s, ...) returned false
Failed to GetProcAddress() on one or more functions in msi.dll.
\.[A-Fa-f0-9]+_[A-Fa-f0-9]+_[A-Fa-f0-9]+_[A-Fa-f0-9]+_[A-Fa-f0-9]+
Checking for existance of property %s
Vertical integration component found
Vertical integration component not found
Stage2URL
Stage1URL
MANIFEST_ERR2
MANIFEST_ERR1
MANIFEST_ERR0
MANIFEST_GENERIC1
MANIFEST_GENERIC0
MANIFEST_COMP_RESULT
MANIFEST_COMP_NAME
MANIFEST_VERB_RESULT
MANIFEST_VERB
MANIFEST_SETUP_TYPE
MANIFEST_EVENTTYPENAME
MANIFEST_MAIN_PLEA_REG
MANIFEST_MAIN_PLEA_BOLD
MANIFEST_MAIN_INTRO_REG
MANIFEST_MAIN_INTRO_BOLD
MANIFEST_GENERALAPPNAME
MANIFEST_LOGGINGFLAGS
MANIFEST_REPORTINGFLAGS
MANIFEST_UIFLAGS
LANG_ID
Queued_EventDescription
Queued_Event_Description
Main_ReportBtn
Main_NoReportBtn
Main_DetailsLink
VSSW_ADMIN_MODE
VSSW_ADMIN_MODE_UI
VSSW_ADMIN_MODE_SILENT
IS_CORPNET
UX_LOG_FILE
SETUP_DATA_FILE
WRAPPER_LOG_FILE
MSICOMP_LOG_FILE
MSI_DB_FILE
MSI_LOG_FILE
FSC_FULL
FSC_CUSTOM
FSC_DEFAULT
VSSW_DATA_FEATURESELECTIONCODE
Software\Policies\Microsoft\PCHealth\ErrorReporting\DW\VSSetup
WatsonPrivacyURL
VSSAttachBITSLog
VSWUXREGRegKey
VSSWUXThrottleFile
VSSWProdVer
VSSWProdSAID
VSSWProdName
VSSWInternalRelease
VSSWUXHeadless
VSSWFailedHeadless
VSSWSuccessHeadless
VSSWUXEnabled
VSSWFailedEnabled
VSSWSectionEnabled
VSSWSuccessEnabled
/watsongenman=
RENAME
DELETE
VSSetupWatson
dwintl20.dll
dw20.exe
VisualStudio8Setup
<NoFiles>
Feature: %s
SetupWatson_Mutex_Name
SetupWatson_FileMapping_Name
Main_DetailsLink=%1
Main_NoReportBtn=%1
Main_ReportBtn=%1
Queued_Event_Description=%1
Queued_EventDescription=%1
UIFlags=%1
ReportingFlags=%1
LoggingFLags=%1
Main_Intro_Bold=%1
Main_Intro_Reg=%1
Main_Plea_Bold=%1
Main_Plea_Reg=%1
General_AppName=%1
UI LCID=%2
EventType=%3
Version=131072
P7=%10
P8=%11
P9=%12
P10=%13
General_AppName=%1
UI LCID=%2
Version=131072
Stage1URL=%3
Stage2URL=%4
ErrorSubPath=%5
FilesToKeep=%1
FilesToDelete=%1
VSSetupWatsonInitEvent
VSSetupWatsonStartEvent
VSSetupWatsonEndEvent
StopDarwinService: Entering the function
StopDarwinService: Win9X platfrom. No Darwin service to stop. Return TRUE
StopDarwinService: Can't open Service Manager. Return FALSE
msiserver
StopDarwinService: Can't open [msiserver] service. Return FALSE
StopDarwinService: 'QueryServiceStatus' failed. Return FALSE
StopDarwinService: 'ControlService' failed. Return FALSE
StopDarwinService: 'WaitForServiceState' failed. Return FALSE
StopDarwinService: Stopped successfully! Return TRUE
StopDarwinService: Service was already Stopped! Return TRUE
Cannot create Event objects
LOCPRODUCTNAME="
MsiSetInternalUI(%d, %d) returned %d
VSSetupMsi.log
Unable to create the requested log file at %s
MsiEnableLog(%d, %s, %d) returned %d
Entering CMsiInstaller::RegisterUIInterfaces
Leaving CMsiInstaller::RegisterUIInterfaces
Entering CMsiInstaller::ThreadInit
Worker Thread creation failed!
Leaving CMsiInstaller::ThreadInit
MsiGetActiveDatabase(%d) returned %d
MsiDatabaseOpenView(%d, %s, %d) returned %d
MsiRecordSetString(%d, %d, %s) returned %d
MsiViewExecute(%d, %d) returned %d
Entering CMsiInstaller::StartInitialization
Leaving CMsiInstaller::StartInitialization
Entering CMsiInstaller::InitSequence
MsiOpenPackage(%s, %d) returned %d
CostInitialize
MsiDoAction(%d, "%s") returned %d
FileCost
CostFinalize
ROOTDRIVE
PrimaryDir
Error occured in CMsiInstaller::InitSequence, failed to create exception
Leaving CMsiInstaller::InitSequence
Entering CMsiInstaller::BeginInstall
REINSTALL=ALL REINSTALLMODE=emusc
REMOVE=ALL
Darwin service failed to to stop, after UNINSTALL
Darwin service was successfully stopped after UNINSTALL
MsiSetFeatureState(%d, "%s", %d) returned %d
ADDLOCAL=
;ADDLOCAL=
InstallValidate
MsiInstallProduct called with Command line:
Darwin service failed to to stop, after INSTALL
Darwin service was successfully stopped after INSTALL
Select InstallExecuteSequence.Sequence from InstallExecuteSequence where InstallExecuteSequence.Action = 'CostInitialize'
Starting dynamic costing Sequence
AppSearch
MsiDoAction(%d, %d) returned %d
Select InstallExecuteSequence.Action, InstallExecuteSequence.Condition from CustomAction, InstallExecuteSequence where CustomAction.Action = InstallExecuteSequence.Action and (CustomAction.Type = 51 or CustomAction.Type = 35) and InstallExecuteSequence.Sequence
order by InstallExecuteSequence.Sequence
SELECT * FROM `Feature` WHERE `Feature`.`Feature_Parent` = '' AND (`Feature`.`Display` IS NULL OR `Feature`.`Display` = 0 ) AND `Level` <> 0
Entering CMsiInstaller::BeginUninstall
Entering CMsiInstaller::BeginRepair
Entering CMsiInstaller::GetProductCode
MsiOpenDatabase(%s, %d, %d) returned %d
SELECT `Value` FROM `Property` WHERE `Property` = 'ProductCode'
MsiViewFetch(%d, %d) returned %d
NULL ProductCode
Leaving CMsiInstaller::GetProductCode
Entering CMsiInstaller::IsInstalled
Leaving CMsiInstaller::IsInstalled
Entering CMsiInstaller::Stop
Leaving CMsiInstaller::Stop
INSTALLLEVEL
SELECT * FROM `Feature` WHERE `Feature`.`Feature_Parent` = '
' AND `Feature`.`Display` IS NOT NULL AND `Feature`.`Display` <> 0 AND `Level` <> 0 ORDER BY `Feature`.`Display`
MsiRecordGetInteger(%d, %d) returned %d
Return value
Disable the cancel button.
Custom Action Failure:%s.
See Windows Install log %s for details.
mscoree.dll
Leaving CMsiInstaller::WorkerThread
Entering CMsiInstaller::SuppressReboot
MSCOREE.DLL is in use and is the only file in use.
Suppressing reboot. System version of MSCOREE.DLL equals msi version
Leaving CMsiInstaller::SuppressReboot
Entering CMsiInstaller::GetMscoreeVersionFromMsi
SELECT `Version` FROM `File` WHERE `File`.`Component_` = ?
Version of mscoree.dll in the msi package is %s.
MsiRecordGetString(%d, %d) returned NULL
Leaving CMsiInstaller::GetMscoreeVersionFromMsi
Entering CMsiInstaller::GetMscoreeVersionFromSystem
\mscoree.dll
***WARNING***: Cannot obtain MSCOREE.DLL version at %s
Version of %s is %s
Leaving CMsiInstaller::GetMscoreeVersionFromSystem
UIWrapperApplicationGroupMap
System\CurrentControlSet\Control\Terminal Server
PerSessionTempDir
FlatTempDir
SeShutdownPrivilege
%s%04X.%s
guih_globdata.ini
globdata.ini
ProductName.
ProductNames
install.ini
Ini Filename
ProductName
ProductMsi
ProductCode
ProductRegKey
ProductRegValue
ProductRegData
ProductSupportURL
DefaultDirInstallToken
SupportWin9X
MinNTVersion
CheckAdminRights
BlockOn64Platform
ShowFeatureOptions
ShowDestinationFolder
LogFilePrefix
CustomTextPrefix
PostSetupCommandRegKey
VerboseLog
RebootMode
BitmapFile
UILanguage
UninstallWarning
ControlMSIService
DetectDarwin
Install
BackColor
Maintenance Mode
User Canceled
RTL Language
GlobDataINIPresent
Current Dir
Temp Dir
Silent Mode
Silent Mode Uninstall
Silent Mode UI string
WatsonSilent
WatsonUI
WatsonGenerateManifestOnly
/watsonsilent
/watsonui
SkipAllChecks
/skip_all_checks
Usage Mode
Admin Mode
/msipassthru
MSI_PROP_BEGIN"
"MSI_PROP_END
MSI_ARGS_FILENAME_BEGIN
MSI_ARGS_FILENAME_END
Msi Command Line properties
MsiLog.txt
MSI Log name
Logging property values
PROPERTY
Failed to open file:
new allocation failed in CPropertyBag::GetArgsFromArgFile()
TARGETDIR
Entering CNavigator::OnDestroy
Making synchronous call to worker to stop
Leaving CNavigator::OnDestroy
Entering CNavigator::OnClose
Leaving CNavigator::OnClose
Entering CNavigator::LoadPages
Entering Maintenance Mode
CErrorPage instantiation failed!
CErrorPage creation failed!
Created Page:
Error Page
CMaintenancePage instantiation failed!
CMaintenancePage creation failed!
Created Page:
Maintenance Page
CWelcomePage instantiation failed!
CWelcomePage creation failed!
Created Page:
Welcome Page
CEulaPage instantiation failed!
CEulaPage creation failed!
Created Page:
EULA Page
CFeaturePage instantiation failed!
CFeaturePage creation failed!
Created Page:
Selection Page
CInstallationPathPage instantiation failed!
CInstallationPathPage creation failed!
Created Page:
Installation Path Page
CProgressPage instantiation failed!
CProgressPage creation failed!
Created Page:
Progress Page
CFinalPage instantiation failed!
CFinalPage creation failed!
Created Page:
Final Page
Leaving CNavigator::LoadPages
Entering CNavigator::WindowCreation
Main Window Creation failed!
LoadPages() failed!
Cannot reset Event object
Leaving CNavigator::WindowCreation
Entering CNavigator::Start
Leaving CNavigator::Start
Entering CNavigator::Next
pbBeginInstallation - invalid value!
ShowWindow failed!
Leaving CNavigator::Next
Entering CNavigator::Prev
Display cancel message
Display Incorrect Path message
Display message
Display Files In Use
Cannot Set Event object
AAAAAA
ATL:%p
Entering Silent Mode CSilentNavigator::Start
Leaving CSilentNavigator::Start
Cancel message in silent mode
DisplayIncorrectPathMessage message in silent mode
Display message called in silent mode with
Files in use called in silent mode with
Out of disk space called in silent mode with
Called cancel on worker
Returned cancel call from worker
BOLD_DISABLE
guih_eula.txt
\RichEd20.dll
eula.1033.txt
Entering CFinalPage::Cancel. - Post Quit message to UI thread
appwiz.cpl
control.exe
Worker called SetInstallationPathInUI with %s
B#32770
AXWIN Frame Window
AXWIN UI Window
AtlAxWin90
WM_ATLGETHOST
WM_ATLGETCONTROL
AtlAxWinLic90
UNINSTALL
REPAIR
Current possition is invalid: fMin < fCur < fMax: %f < %f < %f
New Value:%u
BReboot requested and being attempted
Shell Execute of URL %s
Attempt to spawn process from regkey %s
Key not found
Error reading key
Spawned process with command line %s
Error trying to spawn process with command line %s
User decided not to uninstall after warning
User decided to uninstall after warning
BBError: %d
Event: %d
Log.txt
=========== Logging ended ===========
=====================================
========== Logging started ==========
[%s,%s]
***ERROR EVENT*** :
CCCCCC
CCentire network
microsoft windows network
BThis file, 1
%s (%i)
ThisFile
tooltips_class32
BHKEY_CURRENT_CONFIG
HKEY_DYN_DATA
HKEY_PERFORMANCE_DATA
HKEY_USERS
HKEY_LOCAL_MACHINE
HKEY_CURRENT_USER
HKEY_CLASSES_ROOT
TypeLib
Software
SYSTEM
SECURITY
Hardware
Interface
FileType
Component Categories
Delete
NoRemove
ForceRemove
Required file install.ini not found. Setup will now exit.
No language specified in ini file default to OS language
Failed to set lang to requested lang code %s
KERNEL32.DLL
Set lang to %s
Failed to set lang to OS language %s
Set lang to ENU 1033
Failed last resort to set lang to ENU - no resources
install.res.????.dll
RTL_True
Darwin not present - user declined
Could not find the msi %s
Process returning code %i
install.res.
Pending Reboot Table state : Logging start
_________________________________________
SYSTEM\CurrentControlSet\Control\Session Manager
Failed to open Pending Reboot table key
PendingFileRenameOperations
There are no queued up pending reboot entries.
out of memory. Cannot allocate memory for variable.
There was an error reading from the pending file rename operation.
Unknown format in the Pending Reboot Table
(%s, %s) %s %s %s Delete
(%s, %s) %s %s %s To %s %s %s
Pending Reboot Table state : Logging end
Exception occured while trying to read the pending reboot table
Advapi32.dll
WCLSID
Software
Classes
Module
Module_Raw
REGISTRY
B.,|/\
CSDVersion
System\CurrentControlSet\Control\Windows
Version
SOFTWARE\Microsoft\Internet Explorer
FullInstallVer
SOFTWARE\Microsoft\DataAccess
SOFTWARE\Microsoft\NET Framework Setup\NDP\
SOFTWARE\Microsoft\Visual Jsharp Setup\Redist\
SYSTEM CHECK:
Passed
Failed
PREREQ CHECK:
One instance of setup running
Administrative rights check
Minimum NT Version
Not runing on 9x check
Runing on 64 bit wow check
OCM product installed
BlockProductCode
DetectIE
DetectMDAC
DetectNETFX
DetectNetFxLangPack
DetectVJS
DetectVJSLangPack
DetectWin2KSP
DetectWinXPSP
DetectWin2003ServerSP
Running all checks
Running system checks
Running prereq checks
PREREQ CHECKS:
Passed
PREREQ CHECKS:
Failed
Running block checks
BETA CHECK:
Found
BETA CHECK:
Passed
BETA CHECK:
Failed
InstalledProductName
LangDetectionNeutral
www.microsoft.com
VersionDisplay
CMD.EXE
()|&=,;"
COPYCMD
\XCOPY.EXE
RANDOM
CMDCMDLINE
WKERNEL32.DLL
AutoRun
PathCompletionChar
CompletionChar
DefaultColor
DelayedExpansion
EnableExtensions
DisableUNCCheck
Software\Microsoft\Command Processor
Software\Policies\Microsoft\Windows\System
PMM/dd/yy
Unknown
0123456789
ENABLEEXTENSIONS
sNTDLL.DLL
tokens=
delims=
useback
usebackq
pushd
mkdir
rmdir
chdir
<noalias>
DIRCMD
????????.???
%d.%d.%04d
cmd.exe
SHARED
SEPARATE
REALTIME
NORMAL
BELOWNORMAL
ABOVENORMAL
DISABLEDELAYEDEXPANSION
ENABLEDELAYEDEXPANSION
DISABLEEXTENSIONS
dd/MM/yy
yy/MM/dd
HH:mm:ss t
Ungetting: '%s'
DisableCMD
GeToken: (%x) '%s'
%s\Shell\Open\Command
Software\Classes
System
Application
*** no open command defined ***
\Shell\Open\Command
REM /?
FOR /?
/D /c"
%x %c
Redir:
*** Unknown type: %x
Args: `%s'
Cmd: %s Type: %x
%s (%s) %s
=ExitCode
=ExitCodeAscii
CMDEXTVERSION
DEFINED
PROMPT
ENDLOCAL
ERRORLEVEL
RENAME
SETLOCAL
VERIFY
=,;+/[]
PATHEXT
PROMPT
COMSPEC
fdpnxsatz
(%s) %s
%s %s%s
%s %s
&()[]{}^=;!%'+,`~
%02d%s%02d%s
%2d%s%02d%s%02d%s%02d
%02d%s%02d%s%02d
%04X-%04X
.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS
<>+-*/%()|^&=,
\CMD.EXE
IDI_APPICON
@FKNORTVZZ]^
ronnnnnnnnnnnnnnnnnnnnnnnmmu
l{{{{{{{{{{{{{{{{{{
gggggggggggggggggg
VS_VERSION_INFO
StringFileInfo
040904B0
CompanyName
Microsoft Corporation
FileDescription
Windows Command Processor
FileVersion
5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
InternalName
LegalCopyright
Microsoft Corporation. All rights reserved.
OriginalFilename
Cmd.Exe
ProductName
Microsoft
Windows
Operating System
ProductVersion
5.1.2600.2180
VarFileInfo
Translation
An incorrect parameter was
entered for the command.
The syntax of the command is incorrect.
Press any key to continue . . . %0
%1, Delete (Y/N)? %0
The system cannot accept the path
or file name requested.
The system cannot accept the date entered.
No batch label specified to GOTO command.
'%1' is not recognized as an internal or external command,
operable program or batch file.
The system cannot accept the time entered.
(C) Copyright 1985-2001 Microsoft Corp.
%1 file(s) copied.
The current date is: %0
The current time is: %0
Directory of %1
The system is out of environment space.
The system cannot execute the specified program.
The input line is too long.
The contents of the target file
were lost.
Insert the diskette that contains the batch file
and press any key when ready. %0
Enter the new date: (mm-dd-yy) %0
Enter the new time: %0
The handle could not be duplicated
during redirection of handle %1.
ECHO is off.
ECHO is on.
VERIFY is off.
VERIFY is on.
The file cannot be copied onto itself.
%1 was unexpected at this time.
The Process Identification Number is %1.
A duplicate file name exists, or the file
cannot be found.
%1, Are you sure (Y/N)? %0
The following character string is too long:
Microsoft Windows XP [Version %1]%0
The handle could not be duplicated during
a pipe operation.
More? %0
The system cannot complete the process.
Volume Serial Number is %1
A subdirectory or file %1 already exists.
Error occurred while processing: %1.
Volume in drive %1 has no label.
Volume in drive %1 is %2
KEYS is on.
KEYS is off.
The system cannot accept the START command parameter %1.
The system cannot find the file %1.
The process tried to write to a nonexistent pipe.
"%1" is not a recognized device.
The batch file cannot be found.
%1 file(s) moved.
A program attempted to reference storage outside the
limits of a stack segment. The program was ended.
Command not implemented.
<DIR> %0
Out of memory.
Invalid switch - "%1".
Parameter format not correct - "%1".
(Error occurred in environment variable)
%1 File(s) %2 bytes
%1 Dir(s) %2 bytes free
Total Files Listed:
Terminate batch job (Y/N)? %0
The current directory is invalid.
Displays the name of or changes the current directory.
CHDIR [/D] [drive:][path]
CHDIR [..]
CD [/D] [drive:][path]
CD [..]
.. Specifies that you want to change to the parent directory.
Type CD drive: to display the current directory in the specified drive.
Type CD without parameters to display the current drive and directory.
Use the /D switch to change current drive in addition to changing current
directory for a drive.
Clears the screen.
Copies one or more files to another location.
COPY [/D] [/V] [/N] [/Y | /-Y] [/Z] [/A | /B ] source [/A | /B]
[+ source [/A | /B] [+ ...]] [destination [/A | /B]]
source Specifies the file or files to be copied.
/A Indicates an ASCII text file.
/B Indicates a binary file.
/D Allow the destination file to be created decrypted
destination Specifies the directory and/or filename for the new file(s).
/V Verifies that new files are written correctly.
/N Uses short filename, if available, when copying a file with a
non-8dot3 name.
/Y Suppresses prompting to confirm you want to overwrite an
existing destination file.
/-Y Causes prompting to confirm you want to overwrite an
existing destination file.
/Z Copies networked files in restartable mode.
The switch /Y may be preset in the COPYCMD environment variable.
This may be overridden with /-Y on the command line. Default is
to prompt on overwrites unless COPY command is being executed from
within a batch script.
To append files, specify a single file for destination, but multiple files
for source (using wildcards or file1+file2+file3 format).
Displays or sets the date.
DATE [/T | date]
Type DATE without parameters to display the current date setting and
a prompt for a new one. Press ENTER to keep the same date.
Deletes one or more files.
DEL [/P] [/F] [/S] [/Q] [/A[[:]attributes]] names
ERASE [/P] [/F] [/S] [/Q] [/A[[:]attributes]] names
names Specifies a list of one or more files or directories.
Wildcards may be used to delete multiple files. If a
directory is specified, all files within the directory
will be deleted.
/P Prompts for confirmation before deleting each file.
/F Force deleting of read-only files.
/S Delete specified files from all subdirectories.
/Q Quiet mode, do not ask if ok to delete on global wildcard
/A Selects files to delete based on attributes
attributes R Read-only files S System files
H Hidden files A Files ready for archiving
- Prefix meaning not
Displays a list of files and subdirectories in a directory.
DIR [drive:][path][filename] [/A[[:]attributes]] [/B] [/C] [/D] [/L] [/N]
[/O[[:]sortorder]] [/P] [/Q] [/S] [/T[[:]timefield]] [/W] [/X] [/4]
[drive:][path][filename]
Specifies drive, directory, and/or files to list.
/A Displays files with specified attributes.
attributes D Directories R Read-only files
H Hidden files A Files ready for archiving
S System files - Prefix meaning not
/B Uses bare format (no heading information or summary).
/C Display the thousand separator in file sizes. This is the
default. Use /-C to disable display of separator.
/D Same as wide but files are list sorted by column.
/L Uses lowercase.
/N New long list format where filenames are on the far right.
/O List by files in sorted order.
sortorder N By name (alphabetic) S By size (smallest first)
E By extension (alphabetic) D By date/time (oldest first)
G Group directories first - Prefix to reverse order
/P Pauses after each screenful of information.
/Q Display the owner of the file.
/S Displays files in specified directory and all subdirectories.
/T Controls which time field displayed or used for sorting
timefield C Creation
A Last Access
W Last Written
/W Uses wide list format.
/X This displays the short names generated for non-8dot3 file
names. The format is that of /N with the short name inserted
before the long name. If no short name is present, blanks are
displayed in its place.
/4 Displays four-digit years
Switches may be preset in the DIRCMD environment variable. Override
preset switches by prefixing any switch with - (hyphen)--for example, /-W.
Quits the CMD.EXE program (command interpreter) or the current batch
script.
EXIT [/B] [exitCode]
/B specifies to exit the current batch script instead of
CMD.EXE. If executed from outside a batch script, it
will quit CMD.EXE
exitCode specifies a numeric number. if /B is specified, sets
ERRORLEVEL that number. If quitting CMD.EXE, sets the process
exit code with that number.
Creates a directory.
MKDIR [drive:]path
MD [drive:]path
Displays or sets a search path for executable files.
PATH [[drive:]path[;...][;%%PATH%%]
PATH ;
Type PATH ; to clear all search-path settings and direct cmd.exe to search
only in the current directory.
Type PATH without parameters to display the current path.
Including %%PATH%% in the new path setting causes the old path to be
appended to the new setting.
Changes the cmd.exe command prompt.
PROMPT [text]
text Specifies a new command prompt.
Prompt can be made up of normal characters and the following special codes:
$A & (Ampersand)
$B | (pipe)
$C ( (Left parenthesis)
$D Current date
$E Escape code (ASCII code 27)
$F ) (Right parenthesis)
$G > (greater-than sign)
$H Backspace (erases previous character)
$L < (less-than sign)
$N Current drive
$P Current drive and path
$Q = (equal sign)
$S (space)
$T Current time
$V Windows XP version number
$_ Carriage return and linefeed
$$ $ (dollar sign)
Removes (deletes) a directory.
RMDIR [/S] [/Q] [drive:]path
RD [/S] [/Q] [drive:]path
/S Removes all directories and files in the specified directory
in addition to the directory itself. Used to remove a directory
tree.
/Q Quiet mode, do not ask if ok to remove a directory tree with /S
Renames a file or files.
RENAME [drive:][path]filename1 filename2.
REN [drive:][path]filename1 filename2.
Note that you cannot specify a new drive or path for your destination file.
Displays, sets, or removes cmd.exe environment variables.
SET [variable=[string]]
variable Specifies the environment-variable name.
string Specifies a series of characters to assign to the variable.
Type SET without parameters to display the current environment variables.
Displays or sets the system time.
TIME [/T | time]
Type TIME with no parameters to display the current time setting and a prompt
for a new one. Press ENTER to keep the same time.
Displays the contents of a text file or files.
TYPE [drive:][path]filename
Displays the Windows XP version.
Tells cmd.exe whether to verify that your files are written correctly to a
VERIFY [ON | OFF]
Type VERIFY without a parameter to display the current VERIFY setting.
Displays the disk volume label and serial number, if they exist.
VOL [drive:]
Calls one batch program from another.
CALL [drive:][path]filename [batch-parameters]
batch-parameters Specifies any command-line information required by the
batch program.
Records comments (remarks) in a batch file or CONFIG.SYS.
REM [comment]
Suspends processing of a batch program and displays the message
Press any key to continue . . . %0
Displays messages, or turns command-echoing on or off.
ECHO [ON | OFF]
ECHO [message]
Type ECHO without parameters to display the current echo setting.
Directs cmd.exe to a labeled line in a batch program.
GOTO label
label Specifies a text string used in the batch program as a label.
You type a label on a line by itself, beginning with a colon.
Changes the position of replaceable parameters in a batch file.
SHIFT [/n]
Performs conditional processing in batch programs.
IF [NOT] ERRORLEVEL number command
IF [NOT] string1==string2 command
IF [NOT] EXIST filename command
NOT Specifies that Windows XP should carry out
the command only if the condition is false.
ERRORLEVEL number Specifies a true condition if the last program run
returned an exit code equal to or greater than the number
specified.
string1==string2 Specifies a true condition if the specified text strings
match.
EXIST filename Specifies a true condition if the specified filename
exists.
command Specifies the command to carry out if the condition is
met. Command can be followed by ELSE command which
will execute the command after the ELSE keyword if the
specified condition is FALSE
The ELSE clause must occur on the same line as the command after the IF. For
example:
IF EXIST filename. (
del filename.
) ELSE (
echo filename. missing.
The following would NOT work because the del command needs to be terminated
by a newline:
IF EXIST filename. del filename. ELSE echo filename. missing
Nor would the following work, since the ELSE command must be on the same line
as the end of the IF command:
IF EXIST filename. del filename.
ELSE echo filename. missing
The following would work if you want it all on one line:
IF EXIST filename. (del filename.) ELSE echo filename. missing
Runs a specified command for each file in a set of files.
FOR %%variable IN (set) DO command [command-parameters]
%%variable Specifies a single letter replaceable parameter.
(set) Specifies a set of one or more files. Wildcards may be used.
command Specifies the command to carry out for each file.
command-parameters
Specifies parameters or switches for the specified command.
To use the FOR command in a batch program, specify %%%%variable instead
of %%variable. Variable names are case sensitive, so %%i is different
from %%I.
Starts a separate window to run a specified program or command.
START ["title"] [/Dpath] [/I] [/MIN] [/MAX] [/SEPARATE | /SHARED]
[/LOW | /NORMAL | /HIGH | /REALTIME | /ABOVENORMAL | /BELOWNORMAL]
[/WAIT] [/B] [command/program]
[parameters]
"title" Title to display in window title bar.
path Starting directory
B Start application without creating a new window. The
application has ^C handling ignored. Unless the application
enables ^C processing, ^Break is the only way to interrupt
the application
I The new environment will be the original environment passed
to the cmd.exe and not the current environment.
MIN Start window minimized
MAX Start window maximized
SEPARATE Start 16-bit Windows program in separate memory space
SHARED Start 16-bit Windows program in shared memory space
LOW Start application in the IDLE priority class
NORMAL Start application in the NORMAL priority class
HIGH Start application in the HIGH priority class
REALTIME Start application in the REALTIME priority class
ABOVENORMAL Start application in the ABOVENORMAL priority class
BELOWNORMAL Start application in the BELOWNORMAL priority class
WAIT Start application and wait for it to terminate
command/program
If it is an internal cmd command or a batch file then
the command processor is run with the /K switch to cmd.exe.
This means that the window will remain after the command
has been run.
If it is not an internal cmd command or batch file then
it is a program and will run as either a windowed application
or a console application.
parameters These are the parameters passed to the command/program
Sets or Clears Extended CTRL+C checking on DOS system
This is present for Compatibility with DOS systems. It has no effect
under Windows XP.
Starts a new instance of the Windows XP command interpreter
CMD [/A | /U] [/Q] [/D] [/E:ON | /E:OFF] [/F:ON | /F:OFF] [/V:ON | /V:OFF]
[[/S] [/C | /K] string]
/C Carries out the command specified by string and then terminates
/K Carries out the command specified by string but remains
/S Modifies the treatment of string after /C or /K (see below)
/Q Turns echo off
/D Disable execution of AutoRun commands from registry (see below)
/A Causes the output of internal commands to a pipe or file to be ANSI
/U Causes the output of internal commands to a pipe or file to be
Unicode
/T:fg Sets the foreground/background colors (see COLOR /? for more info)
/E:ON Enable command extensions (see below)
/E:OFF Disable command extensions (see below)
/F:ON Enable file and directory name completion characters (see below)
/F:OFF Disable file and directory name completion characters (see below)
/V:ON Enable delayed environment variable expansion using ! as the
delimiter. For example, /V:ON would allow !var! to expand the
variable var at execution time. The %var% syntax expands variables
at input time, which is quite a different thing when inside of a FOR
loop.
/V:OFF Disable delayed environment expansion.
Note that multiple commands separated by the command separator '&&'
are accepted for string if surrounded by quotes. Also, for compatibility
reasons, /X is the same as /E:ON, /Y is the same as /E:OFF and /R is the
same as /C. Any other switches are ignored.
If /C or /K is specified, then the remainder of the command line after
the switch is processed as a command line, where the following logic is
used to process quote (") characters:
1. If all of the following conditions are met, then quote characters
on the command line are preserved:
- no /S switch
- exactly two quote characters
- no special characters between the two quote characters,
where special is one of: &<>()@^|
- there are one or more whitespace characters between the
the two quote characters
- the string between the two quote characters is the name
of an executable file.
2. Otherwise, old behavior is to see if the first character is
a quote character and if so, strip the leading character and
remove the last quote character on the command line, preserving
any text after the last quote character.
If /D was NOT specified on the command line, then when CMD.EXE starts, it
looks for the following REG_SZ/REG_EXPAND_SZ registry variables, and if
either or both are present, they are executed first.
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun
and/or
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun
Command Extensions are enabled by default. You may also disable
extensions for a particular invocation by using the /E:OFF switch. You
can enable or disable extensions for all invocations of CMD.EXE on a
machine and/or user logon session by setting either or both of the
following REG_DWORD values in the registry using REGEDT32.EXE:
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions
and/or
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions
to either 0x1 or 0x0. The user specific setting takes precedence over
the machine setting. The command line switches take precedence over the
registry settings.
The command extensions involve changes and/or additions to the following
commands:
DEL or ERASE
COLOR
CD or CHDIR
MD or MKDIR
PROMPT
PUSHD
POPD
SET
SETLOCAL
ENDLOCAL
IF
FOR
CALL
SHIFT
GOTO
START (also includes changes to external command invocation)
ASSOC
FTYPE
To get specific details, type commandname /? to view the specifics.
Delayed environment variable expansion is NOT enabled by default. You
can enable or disable delayed environment variable expansion for a
particular invocation of CMD.EXE with the /V:ON or /V:OFF switch. You
can enable or disable completion for all invocations of CMD.EXE on a
machine and/or user logon session by setting either or both of the
following REG_DWORD values in the registry using REGEDT32.EXE:
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion
and/or
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion
to either 0x1 or 0x0. The user specific setting takes precedence over
the machine setting. The command line switches take precedence over the
registry settings.
If delayed environment variable expansion is enabled, then the exclamation
character can be used to substitute the value of an environment variable
at execution time.
File and Directory name completion is NOT enabled by default. You can
enable or disable file name completion for a particular invocation of
CMD.EXE with the /F:ON or /F:OFF switch. You can enable or disable
completion for all invocations of CMD.EXE on a machine and/or user logon
session by setting either or both of the following REG_DWORD values in
the registry using REGEDT32.EXE:
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar
and/or
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar
with the hex value of a control character to use for a particular
function (e.g. 0x4 is Ctrl-D and 0x6 is Ctrl-F). The user specific
settings take precedence over the machine settings. The command line
switches take precedence over the registry settings.
If completion is enabled with the /F:ON switch, the two control
characters used are Ctrl-D for directory name completion and Ctrl-F for
file name completion. To disable a particular completion character in
the registry, use the value for space (0x20) as it is not a valid
control character.
Completion is invoked when you type either of the two control
characters. The completion function takes the path string to the left
of the cursor appends a wild card character to it if none is already
present and builds up a list of paths that match. It then displays the
first matching path. If no paths match, it just beeps and leaves the
display alone. Thereafter, repeated pressing of the same control
character will cycle through the list of matching paths. Pressing the
Shift key with the control character will move through the list
backwards. If you edit the line in any way and press the control
character again, the saved list of matching paths is discarded and a new
one generated. The same occurs if you switch between file and directory
name completion. The only difference between the two control characters
is the file completion character matches both file and directory names,
while the directory completion character only matches directory names.
If file completion is used on any of the built in directory commands
(CD, MD or RD) then directory completion is assumed.
The completion code deals correctly with file names that contain spaces
or other special characters by placing quotes around the matching path.
Also, if you back up, then invoke completion from within a line, the
text to the right of the cursor at the point completion was invoked is
discarded.
The special characters that require quotes are:
<space>
&()[]{}^=;!%'+,`~
Command Processor Extensions Enabled
Command Processor Extensions enabled by default. Use CMD /? for details.
Deleted file - %1
Displays or modifies file extension associations
ASSOC [.ext[=[fileType]]]
.ext Specifies the file extension to associate the file type with
fileType Specifies the file type to associate with the file extension
Type ASSOC without parameters to display the current file associations.
If ASSOC is invoked with just a file extension, it displays the current
file association for that file extension. Specify nothing for the file
type and the command will delete the association for the file extension.
File association not found for extension %1
Displays or modifies file types used in file extension associations
FTYPE [fileType[=[openCommandString]]]
fileType Specifies the file type to examine or change
openCommandString Specifies the open command to use when launching files
of this type.
Type FTYPE without parameters to display the current file types that
have open command strings defined. FTYPE is invoked with just a file
type, it displays the current open command string for that file type.
Specify nothing for the open command string and the FTYPE command will
delete the open command string for the file type. Within an open
command string %%0 or %%1 are substituted with the file name being
launched through the assocation. %%* gets all the parameters and %%2
gets the 1st parameter, %%3 the second, etc. %%~n gets all the remaining
parameters starting with the nth parameter, where n may be between 2 and 9,
inclusive. For example:
ASSOC .pl=PerlScript
FTYPE PerlScript=perl.exe %%1 %%*
would allow you to invoke a Perl script as follows:
script.pl 1 2 3
If you want to eliminate the need to type the extensions, then do the
following:
set PATHEXT=.pl;%%PATHEXT%%
and the script could be invoked as follows:
script 1 2 3
File type '%1' not found or no open command associated with it.
Invalid parameter to SETLOCAL command
The restartable option to the COPY command is not supported by
this version of the operating system.
The following usage of the path operator in batch-parameter
substitution is invalid: %1
For valid formats type CALL /? or FOR /?
Environment variable %1 not defined
Invalid attempt to call batch label outside of batch script.
The system cannot find the batch label specified - %1
The unicode output option to CMD.EXE is not supported by this
version of the operating system.
If Command Extensions are enabled DEL and ERASE change as follows:
The display semantics of the /S switch are reversed in that it shows
you only the files that are deleted, not the ones it could not find.
If Command Extensions are enabled CHDIR changes as follows:
The current directory string is converted to use the same case as
the on disk names. So CD C:\TEMP would actually set the current
directory to C:\Temp if that is the case on disk.
CHDIR command does not treat spaces as delimiters, so it is possible to
CD into a subdirectory name that contains a space without surrounding
the name with quotes. For example:
cd \winnt\profiles\username\programs\start menu
is the same as:
cd "\winnt\profiles\username\programs\start menu"
which is what you would have to type if extensions were disabled.
If Command Extensions are enabled MKDIR changes as follows:
MKDIR creates any intermediate directories in the path, if needed.
For example, assume \a does not exist then:
mkdir \a\b\c\d
is the same as:
mkdir \a
chdir \a
mkdir b
chdir b
mkdir c
chdir c
mkdir d
which is what you would have to type if extensions were disabled.
If Command Extensions are enabled the DATE command supports
the /T switch which tells the command to just output the
current date, without prompting for a new date.
If Command Extensions are enabled the TIME command supports
the /T switch which tells the command to just output the
current time, without prompting for a new time.
If Command Extensions are enabled the PROMPT command supports
the following additional formatting characters:
$+ zero or more plus sign (+) characters depending upon the
depth of the PUSHD directory stack, one character for each
level pushed.
$M Displays the remote name associated with the current drive
letter or the empty string if current drive is not a network
drive.
If Command Extensions are enabled the PUSHD command accepts
network paths in addition to the normal drive letter and path.
If a network path is specified, PUSHD will create a temporary
drive letter that points to that specified network resource and
then change the current drive and directory, using the newly
defined drive letter. Temporary drive letters are allocated from
Z: on down, using the first unused drive letter found.
If Command Extensions are enabled the POPD command will delete
any temporary drive letter created by PUSHD when you POPD that
drive off the pushed directory stack.
If Command Extensions are enabled SET changes as follows:
SET command invoked with just a variable name, no equal sign or value
will display the value of all variables whose prefix matches the name
given to the SET command. For example:
SET P
would display all variables that begin with the letter 'P'
SET command will set the ERRORLEVEL to 1 if the variable name is not
found in the current environment.
SET command will not allow an equal sign to be part of the name of
a variable.
Two new switches have been added to the SET command:
SET /A expression
SET /P variable=[promptString]
The /A switch specifies that the string to the right of the equal sign
is a numerical expression that is evaluated. The expression evaluator
is pretty simple and supports the following operations, in decreasing
order of precedence:
() - grouping
! ~ - - unary operators
* / %% - arithmetic operators
+ - - arithmetic operators
<< >> - logical shift
& - bitwise and
^ - bitwise exclusive or
| - bitwise or
= *= /= %%= += -= - assignment
&= ^= |= <<= >>=
, - expression separator
If you use any of the logical or modulus operators, you will need to
enclose the expression string in quotes. Any non-numeric strings in the
expression are treated as environment variable names whose values are
converted to numbers before using them. If an environment variable name
is specified but is not defined in the current environment, then a value
of zero is used. This allows you to do arithmetic with environment
variable values without having to type all those %% signs to get their
values. If SET /A is executed from the command line outside of a
command script, then it displays the final value of the expression. The
assignment operator requires an environment variable name to the left of
the assignment operator. Numeric values are decimal numbers, unless
prefixed by 0x for hexadecimal numbers, and 0 for octal numbers.
So 0x12 is the same as 18 is the same as 022. Please note that the octal
notation can be confusing: 08 and 09 are not valid numbers because 8 and
9 are not valid octal digits.
The /P switch allows you to set the value of a variable to a line of input
entered by the user. Displays the specified promptString before reading
the line of input. The promptString can be empty.
Environment variable substitution has been enhanced as follows:
%%PATH:str1=str2%%
would expand the PATH environment variable, substituting each occurrence
of "str1" in the expanded result with "str2". "str2" can be the empty
string to effectively delete all occurrences of "str1" from the expanded
output. "str1" can begin with an asterisk, in which case it will match
everything from the beginning of the expanded output to the first
occurrence of the remaining portion of str1.
May also specify substrings for an expansion.
%%PATH:~10,5%%
would expand the PATH environment variable, and then use only the 5
characters that begin at the 11th (offset 10) character of the expanded
result. If the length is not specified, then it defaults to the
remainder of the variable value. If either number (offset or length) is
negative, then the number used is the length of the environment variable
value added to the offset or length specified.
%%PATH:~-10%%
would extract the last 10 characters of the PATH variable.
%%PATH:~0,-2%%
would extract all but the last 2 characters of the PATH variable.
Finally, support for delayed environment variable expansion has been
added. This support is always disabled by default, but may be
enabled/disabled via the /V command line switch to CMD.EXE. See CMD /?
Delayed environment variable expansion is useful for getting around
the limitations of the current expansion which happens when a line
of text is read, not when it is executed. The following example
demonstrates the problem with immediate variable expansion:
set VAR=before
if "%%VAR%%" == "before" (
set VAR=after
if "%%VAR%%" == "after" @echo If you see this, it worked
would never display the message, since the %%VAR%% in BOTH IF statements
is substituted when the first IF statement is read, since it logically
includes the body of the IF, which is a compound statement. So the
IF inside the compound statement is really comparing "before" with
"after" which will never be equal. Similarly, the following example
will not work as expected:
set LIST=
for %%i in (*) do set LIST=%%LIST%% %%i
echo %%LIST%%
in that it will NOT build up a list of files in the current directory,
but instead will just set the LIST variable to the last file found.
Again, this is because the %%LIST%% is expanded just once when the
FOR statement is read, and at that time the LIST variable is empty.
So the actual FOR loop we are executing is:
for %%i in (*) do set LIST= %%i
which just keeps setting LIST to the last file found.
Delayed environment variable expansion allows you to use a different
character (the exclamation mark) to expand environment variables at
execution time. If delayed variable expansion is enabled, the above
examples could be written as follows to work as intended:
set VAR=before
if "%%VAR%%" == "before" (
set VAR=after
if "!VAR!" == "after" @echo If you see this, it worked
set LIST=
for %%i in (*) do set LIST=!LIST! %%i
echo %%LIST%%
If Command Extensions are enabled, then there are several dynamic
environment variables that can be expanded but which don't show up in
the list of variables displayed by SET. These variable values are
computed dynamically each time the value of the variable is expanded.
If the user explicitly defines a variable with one of these names, then
that definition will override the dynamic one described below:
%%CD%% - expands to the current directory string.
%%DATE%% - expands to current date using same format as DATE command.
%%TIME%% - expands to current time using same format as TIME command.
%%RANDOM%% - expands to a random decimal number between 0 and 32767.
%%ERRORLEVEL%% - expands to the current ERRORLEVEL value
%%CMDEXTVERSION%% - expands to the current Command Processor Extensions
version number.
%%CMDCMDLINE%% - expands to the original command line that invoked the
Command Processor.
If Command Extensions are enabled GOTO changes as follows:
GOTO command now accepts a target label of :EOF which transfers control
to the end of the current batch script file. This is an easy way to
exit a batch script file without defining a label. Type CALL /? for a
description of extensions to the CALL command that make this feature
useful.
If Command Extensions are enabled the SHIFT command supports
the /n switch which tells the command to start shifting at the
nth argument, where n may be between zero and eight. For example:
SHIFT /2
would shift %%3 to %%2, %%4 to %%3, etc. and leave %%0 and %%1 unaffected.
If Command Extensions are enabled CALL changes as follows:
CALL command now accepts labels as the target of the CALL. The syntax
CALL :label arguments
A new batch file context is created with the specified arguments and
control is passed to the statement after the label specified. You must
"exit" twice by reaching the end of the batch script file twice. The
first time you read the end, control will return to just after the CALL
statement. The second time will exit the batch script. Type GOTO /?
for a description of the GOTO :EOF extension that will allow you to
"return" from a batch script.
In addition, expansion of batch script argument references (%%0, %%1,
etc.) have been changed as follows:
%%* in a batch script refers to all the arguments (e.g. %%1 %%2 %%3
%%4 %%5 ...)
Substitution of batch parameters (%%n) has been enhanced. You can
now use the following optional syntax:
%%~1 - expands %%1 removing any surrounding quotes (")
%%~f1 - expands %%1 to a fully qualified path name
%%~d1 - expands %%1 to a drive letter only
%%~p1 - expands %%1 to a path only
%%~n1 - expands %%1 to a file name only
%%~x1 - expands %%1 to a file extension only
%%~s1 - expanded path contains short names only
%%~a1 - expands %%1 to file attributes
%%~t1 - expands %%1 to date/time of file
%%~z1 - expands %%1 to size of file
%%~$PATH:1 - searches the directories listed in the PATH
environment variable and expands %%1 to the fully
qualified name of the first one found. If the
environment variable name is not defined or the
file is not found by the search, then this
modifier expands to the empty string
The modifiers can be combined to get compound results:
%%~dp1 - expands %%1 to a drive letter and path only
%%~nx1 - expands %%1 to a file name and extension only
%%~dp$PATH:1 - searches the directories listed in the PATH
environment variable for %%1 and expands to the
drive letter and path of the first one found.
%%~ftza1 - expands %%1 to a DIR like output line
In the above examples %%1 and PATH can be replaced by other
valid values. The %%~ syntax is terminated by a valid argument
number. The %%~ modifiers may not be used with %%*
If Command Extensions are enabled SETLOCAL changes as follows:
SETLOCAL batch command now accepts optional arguments:
ENABLEEXTENSIONS / DISABLEEXTENSIONS
enable or disable command processor extensions. See
CMD /? for details.
ENABLEDELAYEDEXPANSION / DISABLEDELAYEDEXPANSION
enable or disable delayed environment variable
expansion. See SET /? for details.
These modifications last until the matching ENDLOCAL command,
regardless of their setting prior to the SETLOCAL command.
The SETLOCAL command will set the ERRORLEVEL value if given
an argument. It will be zero if one of the two valid arguments
is given and one otherwise. You can use this in batch scripts
to determine if the extensions are available, using the following
technique:
VERIFY OTHER 2>nul
SETLOCAL ENABLEEXTENSIONS
IF ERRORLEVEL 1 echo Unable to enable extensions
This works because on old versions of CMD.EXE, SETLOCAL does NOT
set the ERRORLEVEL value. The VERIFY command with a bad argument
initializes the ERRORLEVEL value to a non-zero value.
If Command Extensions are enabled ENDLOCAL changes as follows:
If the corresponding SETLOCAL enable or disabled command extensions
using the new ENABLEEXTENSIONS or DISABLEEXTENSIONS options, then
after the ENDLOCAL, the enabled/disabled state of command extensions
will be restored to what it was prior to the matching SETLOCAL
command execution.
If Command Extensions are enabled, external command invocation
through the command line or the START command changes as follows:
non-executable files may be invoked through their file association just
by typing the name of the file as a command. (e.g. WORD.DOC would
launch the application associated with the .DOC file extension).
See the ASSOC and FTYPE commands for how to create these
associations from within a command script.
When executing an application that is a 32-bit GUI application, CMD.EXE
does not wait for the application to terminate before returning to
the command prompt. This new behavior does NOT occur if executing
within a command script.
When executing a command line whose first token is the string "CMD "
without an extension or path qualifier, then "CMD" is replaced with
the value of the COMSPEC variable. This prevents picking up CMD.EXE
from the current directory.
When executing a command line whose first token does NOT contain an
extension, then CMD.EXE uses the value of the PATHEXT
environment variable to determine which extensions to look for
and in what order. The default value for the PATHEXT variable
is:
.COM;.EXE;.BAT;.CMD
Notice the syntax is the same as the PATH variable, with
semicolons separating the different elements.
When searching for an executable, if there is no match on any extension,
then looks to see if the name matches a directory name. If it does, the
START command launches the Explorer on that path. If done from the
command line, it is the equivalent to doing a CD /D to that path.
If Command Extensions are enabled, and running on the Windows XP
platform, then the BREAK command will enter a hard coded breakpoint
if being debugged by a debugger.
If Command Extensions are enabled, the following additional
forms of the FOR command are supported:
FOR /D %%variable IN (set) DO command [command-parameters]
If set contains wildcards, then specifies to match against directory
names instead of file names.
FOR /R [[drive:]path] %%variable IN (set) DO command [command-parameters]
Walks the directory tree rooted at [drive:]path, executing the FOR
statement in each directory of the tree. If no directory
specification is specified after /R then the current directory is
assumed. If set is just a single period (.) character then it
will just enumerate the directory tree.
FOR /L %%variable IN (start,step,end) DO command [command-parameters]
The set is a sequence of numbers from start to end, by step amount.
So (1,1,5) would generate the sequence 1 2 3 4 5 and (5,-1,1) would
generate the sequence (5 4 3 2 1)
FOR /F ["options"] %%variable IN (file-set) DO command [command-parameters]
FOR /F ["options"] %%variable IN ("string") DO command [command-parameters]
FOR /F ["options"] %%variable IN ('command') DO command [command-parameters]
or, if usebackq option present:
FOR /F ["options"] %%variable IN (file-set) DO command [command-parameters]
FOR /F ["options"] %%variable IN ('string') DO command [command-parameters]
FOR /F ["options"] %%variable IN (`command`) DO command [command-parameters]
filenameset is one or more file names. Each file is opened, read
and processed before going on to the next file in filenameset.
Processing consists of reading in the file, breaking it up into
individual lines of text and then parsing each line into zero or
more tokens. The body of the for loop is then called with the
variable value(s) set to the found token string(s). By default, /F
passes the first blank separated token from each line of each file.
Blank lines are skipped. You can override the default parsing
behavior by specifying the optional "options" parameter. This
is a quoted string which contains one or more keywords to specify
different parsing options. The keywords are:
eol=c - specifies an end of line comment character
(just one)
skip=n - specifies the number of lines to skip at the
beginning of the file.
delims=xxx - specifies a delimiter set. This replaces the
default delimiter set of space and tab.
tokens=x,y,m-n - specifies which tokens from each line are to
be passed to the for body for each iteration.
This will cause additional variable names to
be allocated. The m-n form is a range,
specifying the mth through the nth tokens. If
the last character in the tokens= string is an
asterisk, then an additional variable is
allocated and receives the remaining text on
the line after the last token parsed.
usebackq - specifies that the new semantics are in force,
where a back quoted string is executed as a
command and a single quoted string is a
literal string command and allows the use of
double quotes to quote file names in
filenameset.
Some examples might help:
FOR /F "eol=; tokens=2,3* delims=, " %%i in (myfile.txt) do @echo %%i %%j %%k
would parse each line in myfile.txt, ignoring lines that begin with
a semicolon, passing the 2nd and 3rd token from each line to the for
body, with tokens delimited by commas and/or spaces. Notice the for
body statements reference %%i to get the 2nd token, %%j to get the
3rd token, and %%k to get all remaining tokens after the 3rd. For
file names that contain spaces, you need to quote the filenames with
double quotes. In order to use double quotes in this manner, you also
need to use the usebackq option, otherwise the double quotes will be
interpreted as defining a literal string to parse.
%%i is explicitly declared in the for statement and the %%j and %%k
are implicitly declared via the tokens= option. You can specify up
to 26 tokens via the tokens= line, provided it does not cause an
attempt to declare a variable higher than the letter 'z' or 'Z'.
Remember, FOR variables are single-letter, case sensitive, global,
and you can't have more than 52 total active at any one time.
You can also use the FOR /F parsing logic on an immediate string, by
making the filenameset between the parenthesis a quoted string,
using single quote characters. It will be treated as a single line
of input from a file and parsed.
Finally, you can use the FOR /F command to parse the output of a
command. You do this by making the filenameset between the
parenthesis a back quoted string. It will be treated as a command
line, which is passed to a child CMD.EXE and the output is captured
into memory and parsed as if it was a file. So the following
example:
FOR /F "usebackq delims==" %%i IN (`set`) DO @echo %%i
would enumerate the environment variable names in the current
environment.
In addition, substitution of FOR variable references has been enhanced.
You can now use the following optional syntax:
%%~I - expands %%I removing any surrounding quotes (")
%%~fI - expands %%I to a fully qualified path name
%%~dI - expands %%I to a drive letter only
%%~pI - expands %%I to a path only
%%~nI - expands %%I to a file name only
%%~xI - expands %%I to a file extension only
%%~sI - expanded path contains short names only
%%~aI - expands %%I to file attributes of file
%%~tI - expands %%I to date/time of file
%%~zI - expands %%I to size of file
%%~$PATH:I - searches the directories listed in the PATH
environment variable and expands %%I to the
fully qualified name of the first one found.
If the environment variable name is not
defined or the file is not found by the
search, then this modifier expands to the
empty string
The modifiers can be combined to get compound results:
%%~dpI - expands %%I to a drive letter and path only
%%~nxI - expands %%I to a file name and extension only
%%~fsI - expands %%I to a full path name with short names only
%%~dp$PATH:I - searches the directories listed in the PATH
environment variable for %%I and expands to the
drive letter and path of the first one found.
%%~ftzaI - expands %%I to a DIR like output line
In the above examples %%I and PATH can be replaced by other valid
values. The %%~ syntax is terminated by a valid FOR variable name.
Picking upper case variable names like %%I makes it more readable and
avoids confusion with the modifiers, which are not case sensitive.
If Command Extensions are enabled IF changes as follows:
IF [/I] string1 compare-op string2 command
IF CMDEXTVERSION number command
IF DEFINED variable command
where compare-op may be one of:
EQU - equal
NEQ - not equal
LSS - less than
LEQ - less than or equal
GTR - greater than
GEQ - greater than or equal
and the /I switch, if specified, says to do case insensitive string
compares. The /I switch can also be used on the string1==string2 form
of IF. These comparisons are generic, in that if both string1 and
string2 are both comprised of all numeric digits, then the strings are
converted to numbers and a numeric comparison is performed.
The CMDEXTVERSION conditional works just like ERRORLEVEL, except it is
comparing against an internal version number associated with the Command
Extensions. The first version is 1. It will be incremented by one when
significant enhancements are added to the Command Extensions.
CMDEXTVERSION conditional is never true when Command Extensions are
disabled.
The DEFINED conditional works just like EXISTS except it takes an
environment variable name and returns true if the environment variable
is defined.
%%ERRORLEVEL%% will expand into a string representation of
the current value of ERRORLEVEL, provided that there is not already
an environment variable with the name ERRORLEVEL, in which case you
will get its value instead. After running a program, the following
illustrates ERRORLEVEL use:
goto answer%%ERRORLEVEL%%
:answer0
echo Program had return code 0
:answer1
echo Program had return code 1
You can also using the numerical comparisons above:
IF %%ERRORLEVEL%% LEQ 1 goto okay
%%CMDCMDLINE%% will expand into the original command line passed to
CMD.EXE prior to any processing by CMD.EXE, provided that there is not
already an environment variable with the name CMDCMDLINE, in which case
you will get its value instead.
%%CMDEXTVERSION%% will expand into a string representation of the
current value of CMDEXTVERSION, provided that there is not already
an environment variable with the name CMDEXTVERSION, in which case you
will get its value instead.
Enables or disables command line editing on DOS system
This is present for Compatibility with DOS systems. It has no effect
under Windows XP, as command line editing is always enabled.
CMD.EXE was started with the above path as the current directory.
UNC paths are not supported. Defaulting to Windows directory.
CMD does not support UNC paths as current directories.
UNC paths not supported for current directory. Using
PUSHD %1
to create temporary drive letter to support UNC current
directory. Use POPD or EXIT to delete temporary drive
letter.
Invalid parameter to SHIFT command
Unbalanced parenthesis.
Missing operand.
Missing operator.
Invalid number. Numeric constants are either decimal (17),
hexadecimal (0x11), or octal (021).
Invalid number. Numbers are limited to 32-bits of precision.
Divide by zero error.
The COMSPEC environment variable does not point to CMD.EXE.
Overwrite %1? (Yes/No/All): %0
<JUNCTION> %0
The directory name %1\%2 is too long.
The full path of %1 is too long.
The path %1\%2 is too long.
Unable to find library %1.
Cannot find function %1!S!:%2!S!.
Cannot find ordinal %1!S!:%2!d!.
File Not Found
Could Not Find %1
The FAT File System only support Last Write Times
Begins localization of environment changes in a batch file. Environment
changes made after SETLOCAL has been issued are local to the batch file.
ENDLOCAL must be issued to restore the previous settings. When the end
of a batch script is reached, an implied ENDLOCAL is executed for any
outstanding SETLOCAL commands issued by that batch script.
SETLOCAL
Ends localization of environment changes in a batch file.
Environment changes made after ENDLOCAL has been issued are
not local to the batch file; the previous settings are not
restored on termination of the batch file.
ENDLOCAL
Sets the window title for the command prompt window.
TITLE [string]
string Specifies the title for the command prompt window.
Allows programs to open data files in specified directories as if they were
in the current directory.
APPEND [[drive:]path[;...]] [/X[:ON | :OFF]] [/PATH:ON | /PATH:OFF] [/E]
APPEND ;
[drive:]path Specifies a drive and directory to append.
/X:ON Applies appended directories to file searches and
application execution.
/X:OFF Applies appended directories only to requests to open files.
/X:OFF is the default setting.
/PATH:ON Applies the appended directories to file requests that already
specify a path. /PATH:ON is the default setting.
/PATH:OFF Turns off the effect of /PATH:ON.
/E Stores a copy of the appended directory list in an environment
variable named APPEND. /E may be used only the first time
you use APPEND after starting up your system.
Type APPEND ; to clear the appended directory list.
Type APPEND without parameters to display the appended directory list.
Moves files and renames files and directories.
To move one or more files:
MOVE [/Y | /-Y] [drive:][path]filename1[,...] destination
To rename a directory:
MOVE [/Y | /-Y] [drive:][path]dirname1 dirname2
[drive:][path]filename1 Specifies the location and name of the file
or files you want to move.
destination Specifies the new location of the file. Destination
can consist of a drive letter and colon, a
directory name, or a combination. If you are moving
only one file, you can also include a filename if
you want to rename the file when you move it.
[drive:][path]dirname1 Specifies the directory you want to rename.
dirname2 Specifies the new name of the directory.
/Y Suppresses prompting to confirm you want to
overwrite an existing destination file.
/-Y Causes prompting to confirm you want to overwrite
an existing destination file.
The switch /Y may be present in the COPYCMD environment variable.
This may be overridden with /-Y on the command line. Default is
to prompt on overwrites unless MOVE command is being executed from
within a batch script.
Stores the current directory for use by the POPD command, then
changes to the specified directory.
PUSHD [path | ..]
path Specifies the directory to make the current directory.
Changes to the directory stored by the PUSHD command.
%1 - %0
Maximum setlocal recursion level reached.
Enter the new date: (yy-mm-dd) %0
Enter the new date: (dd-mm-yy) %0
ERROR Verify - %1
Cannot move multiple files to a single file.
The handle could not be opened
during redirection of handle %1.
%r%1%% copied %0
Sets the default console foreground and background colors.
COLOR [attr]
attr Specifies color attribute of console output
Color attributes are specified by TWO hex digits -- the first
corresponds to the background; the second the foreground. Each digit
can be any of the following values:
0 = Black 8 = Gray
1 = Blue 9 = Light Blue
2 = Green A = Light Green
3 = Aqua B = Light Aqua
4 = Red C = Light Red
5 = Purple D = Light Purple
6 = Yellow E = Light Yellow
7 = White F = Bright White
If no argument is given, this command restores the color to what it was
when CMD.EXE started. This value either comes from the current console
window, the /T command line switch or from the DefaultColor registry
value.
The COLOR command sets ERRORLEVEL to 1 if an attempt is made to execute
the COLOR command with a foreground and background color that are the
Example: "COLOR fc" produces light red on bright white
Maximum path length exceeded - %1
****** B A T C H R E C U R S I O N exceeds STACK limits ******
Recursion Count=%1!d!, Stack Usage=%2!d! percent
****** B A T C H PROCESSING IS A B O R T E D ******
There are too many directories already in the PUSHD stack.
The command prompt has been disabled by your administrator.
CMD.EXE
()|&=,;"
COPYCMD
\XCOPY.EXE
RANDOM
CMDCMDLINE
WKERNEL32.DLL
AutoRun
PathCompletionChar
CompletionChar
DefaultColor
DelayedExpansion
EnableExtensions
DisableUNCCheck
Software\Microsoft\Command Processor
Software\Policies\Microsoft\Windows\System
PMM/dd/yy
Unknown
0123456789
ENABLEEXTENSIONS
sNTDLL.DLL
tokens=
delims=
useback
usebackq
pushd
mkdir
rmdir
chdir
<noalias>
DIRCMD
????????.???
%d.%d.%04d
cmd.exe
SHARED
SEPARATE
REALTIME
NORMAL
BELOWNORMAL
ABOVENORMAL
DISABLEDELAYEDEXPANSION
ENABLEDELAYEDEXPANSION
DISABLEEXTENSIONS
dd/MM/yy
yy/MM/dd
HH:mm:ss t
Ungetting: '%s'
DisableCMD
GeToken: (%x) '%s'
%s\Shell\Open\Command
Software\Classes
System
Application
*** no open command defined ***
\Shell\Open\Command
REM /?
FOR /?
/D /c"
%x %c
Redir:
*** Unknown type: %x
Args: `%s'
Cmd: %s Type: %x
%s (%s) %s
=ExitCode
=ExitCodeAscii
CMDEXTVERSION
DEFINED
PROMPT
ENDLOCAL
ERRORLEVEL
RENAME
SETLOCAL
VERIFY
=,;+/[]
PATHEXT
PROMPT
COMSPEC
fdpnxsatz
(%s) %s
%s %s%s
%s %s
&()[]{}^=;!%'+,`~
%02d%s%02d%s
%2d%s%02d%s%02d%s%02d
%02d%s%02d%s%02d
%04X-%04X
.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS
<>+-*/%()|^&=,
\CMD.EXE
IDI_APPICON
@FKNORTVZZ]^
ronnnnnnnnnnnnnnnnnnnnnnnmmu
l{{{{{{{{{{{{{{{{{{
gggggggggggggggggg
VS_VERSION_INFO
StringFileInfo
040904B0
CompanyName
Microsoft Corporation
FileDescription
Windows Command Processor
FileVersion
5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
InternalName
LegalCopyright
Microsoft Corporation. All rights reserved.
OriginalFilename
Cmd.Exe
ProductName
Microsoft
Windows
Operating System
ProductVersion
5.1.2600.2180
VarFileInfo
Translation
An incorrect parameter was
entered for the command.
The syntax of the command is incorrect.
Press any key to continue . . . %0
%1, Delete (Y/N)? %0
The system cannot accept the path
or file name requested.
The system cannot accept the date entered.
No batch label specified to GOTO command.
'%1' is not recognized as an internal or external command,
operable program or batch file.
The system cannot accept the time entered.
(C) Copyright 1985-2001 Microsoft Corp.
%1 file(s) copied.
The current date is: %0
The current time is: %0
Directory of %1
The system is out of environment space.
The system cannot execute the specified program.
The input line is too long.
The contents of the target file
were lost.
Insert the diskette that contains the batch file
and press any key when ready. %0
Enter the new date: (mm-dd-yy) %0
Enter the new time: %0
The handle could not be duplicated
during redirection of handle %1.
ECHO is off.
ECHO is on.
VERIFY is off.
VERIFY is on.
The file cannot be copied onto itself.
%1 was unexpected at this time.
The Process Identification Number is %1.
A duplicate file name exists, or the file
cannot be found.
%1, Are you sure (Y/N)? %0
The following character string is too long:
Microsoft Windows XP [Version %1]%0
The handle could not be duplicated during
a pipe operation.
More? %0
The system cannot complete the process.
Volume Serial Number is %1
A subdirectory or file %1 already exists.
Error occurred while processing: %1.
Volume in drive %1 has no label.
Volume in drive %1 is %2
KEYS is on.
KEYS is off.
The system cannot accept the START command parameter %1.
The system cannot find the file %1.
The process tried to write to a nonexistent pipe.
"%1" is not a recognized device.
The batch file cannot be found.
%1 file(s) moved.
A program attempted to reference storage outside the
limits of a stack segment. The program was ended.
Command not implemented.
<DIR> %0
Out of memory.
Invalid switch - "%1".
Parameter format not correct - "%1".
(Error occurred in environment variable)
%1 File(s) %2 bytes
%1 Dir(s) %2 bytes free
Total Files Listed:
Terminate batch job (Y/N)? %0
The current directory is invalid.
Displays the name of or changes the current directory.
CHDIR [/D] [drive:][path]
CHDIR [..]
CD [/D] [drive:][path]
CD [..]
.. Specifies that you want to change to the parent directory.
Type CD drive: to display the current directory in the specified drive.
Type CD without parameters to display the current drive and directory.
Use the /D switch to change current drive in addition to changing current
directory for a drive.
Clears the screen.
Copies one or more files to another location.
COPY [/D] [/V] [/N] [/Y | /-Y] [/Z] [/A | /B ] source [/A | /B]
[+ source [/A | /B] [+ ...]] [destination [/A | /B]]
source Specifies the file or files to be copied.
/A Indicates an ASCII text file.
/B Indicates a binary file.
/D Allow the destination file to be created decrypted
destination Specifies the directory and/or filename for the new file(s).
/V Verifies that new files are written correctly.
/N Uses short filename, if available, when copying a file with a
non-8dot3 name.
/Y Suppresses prompting to confirm you want to overwrite an
existing destination file.
/-Y Causes prompting to confirm you want to overwrite an
existing destination file.
/Z Copies networked files in restartable mode.
The switch /Y may be preset in the COPYCMD environment variable.
This may be overridden with /-Y on the command line. Default is
to prompt on overwrites unless COPY command is being executed from
within a batch script.
To append files, specify a single file for destination, but multiple files
for source (using wildcards or file1+file2+file3 format).
Displays or sets the date.
DATE [/T | date]
Type DATE without parameters to display the current date setting and
a prompt for a new one. Press ENTER to keep the same date.
Deletes one or more files.
DEL [/P] [/F] [/S] [/Q] [/A[[:]attributes]] names
ERASE [/P] [/F] [/S] [/Q] [/A[[:]attributes]] names
names Specifies a list of one or more files or directories.
Wildcards may be used to delete multiple files. If a
directory is specified, all files within the directory
will be deleted.
/P Prompts for confirmation before deleting each file.
/F Force deleting of read-only files.
/S Delete specified files from all subdirectories.
/Q Quiet mode, do not ask if ok to delete on global wildcard
/A Selects files to delete based on attributes
attributes R Read-only files S System files
H Hidden files A Files ready for archiving
- Prefix meaning not
Displays a list of files and subdirectories in a directory.
DIR [drive:][path][filename] [/A[[:]attributes]] [/B] [/C] [/D] [/L] [/N]
[/O[[:]sortorder]] [/P] [/Q] [/S] [/T[[:]timefield]] [/W] [/X] [/4]
[drive:][path][filename]
Specifies drive, directory, and/or files to list.
/A Displays files with specified attributes.
attributes D Directories R Read-only files
H Hidden files A Files ready for archiving
S System files - Prefix meaning not
/B Uses bare format (no heading information or summary).
/C Display the thousand separator in file sizes. This is the
default. Use /-C to disable display of separator.
/D Same as wide but files are list sorted by column.
/L Uses lowercase.
/N New long list format where filenames are on the far right.
/O List by files in sorted order.
sortorder N By name (alphabetic) S By size (smallest first)
E By extension (alphabetic) D By date/time (oldest first)
G Group directories first - Prefix to reverse order
/P Pauses after each screenful of information.
/Q Display the owner of the file.
/S Displays files in specified directory and all subdirectories.
/T Controls which time field displayed or used for sorting
timefield C Creation
A Last Access
W Last Written
/W Uses wide list format.
/X This displays the short names generated for non-8dot3 file
names. The format is that of /N with the short name inserted
before the long name. If no short name is present, blanks are
displayed in its place.
/4 Displays four-digit years
Switches may be preset in the DIRCMD environment variable. Override
preset switches by prefixing any switch with - (hyphen)--for example, /-W.
Quits the CMD.EXE program (command interpreter) or the current batch
script.
EXIT [/B] [exitCode]
/B specifies to exit the current batch script instead of
CMD.EXE. If executed from outside a batch script, it
will quit CMD.EXE
exitCode specifies a numeric number. if /B is specified, sets
ERRORLEVEL that number. If quitting CMD.EXE, sets the process
exit code with that number.
Creates a directory.
MKDIR [drive:]path
MD [drive:]path
Displays or sets a search path for executable files.
PATH [[drive:]path[;...][;%%PATH%%]
PATH ;
Type PATH ; to clear all search-path settings and direct cmd.exe to search
only in the current directory.
Type PATH without parameters to display the current path.
Including %%PATH%% in the new path setting causes the old path to be
appended to the new setting.
Changes the cmd.exe command prompt.
PROMPT [text]
text Specifies a new command prompt.
Prompt can be made up of normal characters and the following special codes:
$A & (Ampersand)
$B | (pipe)
$C ( (Left parenthesis)
$D Current date
$E Escape code (ASCII code 27)
$F ) (Right parenthesis)
$G > (greater-than sign)
$H Backspace (erases previous character)
$L < (less-than sign)
$N Current drive
$P Current drive and path
$Q = (equal sign)
$S (space)
$T Current time
$V Windows XP version number
$_ Carriage return and linefeed
$$ $ (dollar sign)
Removes (deletes) a directory.
RMDIR [/S] [/Q] [drive:]path
RD [/S] [/Q] [drive:]path
/S Removes all directories and files in the specified directory
in addition to the directory itself. Used to remove a directory
tree.
/Q Quiet mode, do not ask if ok to remove a directory tree with /S
Renames a file or files.
RENAME [drive:][path]filename1 filename2.
REN [drive:][path]filename1 filename2.
Note that you cannot specify a new drive or path for your destination file.
Displays, sets, or removes cmd.exe environment variables.
SET [variable=[string]]
variable Specifies the environment-variable name.
string Specifies a series of characters to assign to the variable.
Type SET without parameters to display the current environment variables.
Displays or sets the system time.
TIME [/T | time]
Type TIME with no parameters to display the current time setting and a prompt
for a new one. Press ENTER to keep the same time.
Displays the contents of a text file or files.
TYPE [drive:][path]filename
Displays the Windows XP version.
Tells cmd.exe whether to verify that your files are written correctly to a
VERIFY [ON | OFF]
Type VERIFY without a parameter to display the current VERIFY setting.
Displays the disk volume label and serial number, if they exist.
VOL [drive:]
Calls one batch program from another.
CALL [drive:][path]filename [batch-parameters]
batch-parameters Specifies any command-line information required by the
batch program.
Records comments (remarks) in a batch file or CONFIG.SYS.
REM [comment]
Suspends processing of a batch program and displays the message
Press any key to continue . . . %0
Displays messages, or turns command-echoing on or off.
ECHO [ON | OFF]
ECHO [message]
Type ECHO without parameters to display the current echo setting.
Directs cmd.exe to a labeled line in a batch program.
GOTO label
label Specifies a text string used in the batch program as a label.
You type a label on a line by itself, beginning with a colon.
Changes the position of replaceable parameters in a batch file.
SHIFT [/n]
Performs conditional processing in batch programs.
IF [NOT] ERRORLEVEL number command
IF [NOT] string1==string2 command
IF [NOT] EXIST filename command
NOT Specifies that Windows XP should carry out
the command only if the condition is false.
ERRORLEVEL number Specifies a true condition if the last program run
returned an exit code equal to or greater than the number
specified.
string1==string2 Specifies a true condition if the specified text strings
match.
EXIST filename Specifies a true condition if the specified filename
exists.
command Specifies the command to carry out if the condition is
met. Command can be followed by ELSE command which
will execute the command after the ELSE keyword if the
specified condition is FALSE
The ELSE clause must occur on the same line as the command after the IF. For
example:
IF EXIST filename. (
del filename.
) ELSE (
echo filename. missing.
The following would NOT work because the del command needs to be terminated
by a newline:
IF EXIST filename. del filename. ELSE echo filename. missing
Nor would the following work, since the ELSE command must be on the same line
as the end of the IF command:
IF EXIST filename. del filename.
ELSE echo filename. missing
The following would work if you want it all on one line:
IF EXIST filename. (del filename.) ELSE echo filename. missing
Runs a specified command for each file in a set of files.
FOR %%variable IN (set) DO command [command-parameters]
%%variable Specifies a single letter replaceable parameter.
(set) Specifies a set of one or more files. Wildcards may be used.
command Specifies the command to carry out for each file.
command-parameters
Specifies parameters or switches for the specified command.
To use the FOR command in a batch program, specify %%%%variable instead
of %%variable. Variable names are case sensitive, so %%i is different
from %%I.
Starts a separate window to run a specified program or command.
START ["title"] [/Dpath] [/I] [/MIN] [/MAX] [/SEPARATE | /SHARED]
[/LOW | /NORMAL | /HIGH | /REALTIME | /ABOVENORMAL | /BELOWNORMAL]
[/WAIT] [/B] [command/program]
[parameters]
"title" Title to display in window title bar.
path Starting directory
B Start application without creating a new window. The
application has ^C handling ignored. Unless the application
enables ^C processing, ^Break is the only way to interrupt
the application
I The new environment will be the original environment passed
to the cmd.exe and not the current environment.
MIN Start window minimized
MAX Start window maximized
SEPARATE Start 16-bit Windows program in separate memory space
SHARED Start 16-bit Windows program in shared memory space
LOW Start application in the IDLE priority class
NORMAL Start application in the NORMAL priority class
HIGH Start application in the HIGH priority class
REALTIME Start application in the REALTIME priority class
ABOVENORMAL Start application in the ABOVENORMAL priority class
BELOWNORMAL Start application in the BELOWNORMAL priority class
WAIT Start application and wait for it to terminate
command/program
If it is an internal cmd command or a batch file then
the command processor is run with the /K switch to cmd.exe.
This means that the window will remain after the command
has been run.
If it is not an internal cmd command or batch file then
it is a program and will run as either a windowed application
or a console application.
parameters These are the parameters passed to the command/program
Sets or Clears Extended CTRL+C checking on DOS system
This is present for Compatibility with DOS systems. It has no effect
under Windows XP.
Starts a new instance of the Windows XP command interpreter
CMD [/A | /U] [/Q] [/D] [/E:ON | /E:OFF] [/F:ON | /F:OFF] [/V:ON | /V:OFF]
[[/S] [/C | /K] string]
/C Carries out the command specified by string and then terminates
/K Carries out the command specified by string but remains
/S Modifies the treatment of string after /C or /K (see below)
/Q Turns echo off
/D Disable execution of AutoRun commands from registry (see below)
/A Causes the output of internal commands to a pipe or file to be ANSI
/U Causes the output of internal commands to a pipe or file to be
Unicode
/T:fg Sets the foreground/background colors (see COLOR /? for more info)
/E:ON Enable command extensions (see below)
/E:OFF Disable command extensions (see below)
/F:ON Enable file and directory name completion characters (see below)
/F:OFF Disable file and directory name completion characters (see below)
/V:ON Enable delayed environment variable expansion using ! as the
delimiter. For example, /V:ON would allow !var! to expand the
variable var at execution time. The %var% syntax expands variables
at input time, which is quite a different thing when inside of a FOR
loop.
/V:OFF Disable delayed environment expansion.
Note that multiple commands separated by the command separator '&&'
are accepted for string if surrounded by quotes. Also, for compatibility
reasons, /X is the same as /E:ON, /Y is the same as /E:OFF and /R is the
same as /C. Any other switches are ignored.
If /C or /K is specified, then the remainder of the command line after
the switch is processed as a command line, where the following logic is
used to process quote (") characters:
1. If all of the following conditions are met, then quote characters
on the command line are preserved:
- no /S switch
- exactly two quote characters
- no special characters between the two quote characters,
where special is one of: &<>()@^|
- there are one or more whitespace characters between the
the two quote characters
- the string between the two quote characters is the name
of an executable file.
2. Otherwise, old behavior is to see if the first character is
a quote character and if so, strip the leading character and
remove the last quote character on the command line, preserving
any text after the last quote character.
If /D was NOT specified on the command line, then when CMD.EXE starts, it
looks for the following REG_SZ/REG_EXPAND_SZ registry variables, and if
either or both are present, they are executed first.
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun
and/or
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun
Command Extensions are enabled by default. You may also disable
extensions for a particular invocation by using the /E:OFF switch. You
can enable or disable extensions for all invocations of CMD.EXE on a
machine and/or user logon session by setting either or both of the
following REG_DWORD values in the registry using REGEDT32.EXE:
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions
and/or
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions
to either 0x1 or 0x0. The user specific setting takes precedence over
the machine setting. The command line switches take precedence over the
registry settings.
The command extensions involve changes and/or additions to the following
commands:
DEL or ERASE
COLOR
CD or CHDIR
MD or MKDIR
PROMPT
PUSHD
POPD
SET
SETLOCAL
ENDLOCAL
IF
FOR
CALL
SHIFT
GOTO
START (also includes changes to external command invocation)
ASSOC
FTYPE
To get specific details, type commandname /? to view the specifics.
Delayed environment variable expansion is NOT enabled by default. You
can enable or disable delayed environment variable expansion for a
particular invocation of CMD.EXE with the /V:ON or /V:OFF switch. You
can enable or disable completion for all invocations of CMD.EXE on a
machine and/or user logon session by setting either or both of the
following REG_DWORD values in the registry using REGEDT32.EXE:
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion
and/or
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion
to either 0x1 or 0x0. The user specific setting takes precedence over
the machine setting. The command line switches take precedence over the
registry settings.
If delayed environment variable expansion is enabled, then the exclamation
character can be used to substitute the value of an environment variable
at execution time.
File and Directory name completion is NOT enabled by default. You can
enable or disable file name completion for a particular invocation of
CMD.EXE with the /F:ON or /F:OFF switch. You can enable or disable
completion for all invocations of CMD.EXE on a machine and/or user logon
session by setting either or both of the following REG_DWORD values in
the registry using REGEDT32.EXE:
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar
and/or
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar
with the hex value of a control character to use for a particular
function (e.g. 0x4 is Ctrl-D and 0x6 is Ctrl-F). The user specific
settings take precedence over the machine settings. The command line
switches take precedence over the registry settings.
If completion is enabled with the /F:ON switch, the two control
characters used are Ctrl-D for directory name completion and Ctrl-F for
file name completion. To disable a particular completion character in
the registry, use the value for space (0x20) as it is not a valid
control character.
Completion is invoked when you type either of the two control
characters. The completion function takes the path string to the left
of the cursor appends a wild card character to it if none is already
present and builds up a list of paths that match. It then displays the
first matching path. If no paths match, it just beeps and leaves the
display alone. Thereafter, repeated pressing of the same control
character will cycle through the list of matching paths. Pressing the
Shift key with the control character will move through the list
backwards. If you edit the line in any way and press the control
character again, the saved list of matching paths is discarded and a new
one generated. The same occurs if you switch between file and directory
name completion. The only difference between the two control characters
is the file completion character matches both file and directory names,
while the directory completion character only matches directory names.
If file completion is used on any of the built in directory commands
(CD, MD or RD) then directory completion is assumed.
The completion code deals correctly with file names that contain spaces
or other special characters by placing quotes around the matching path.
Also, if you back up, then invoke completion from within a line, the
text to the right of the cursor at the point completion was invoked is
discarded.
The special characters that require quotes are:
<space>
&()[]{}^=;!%'+,`~
Command Processor Extensions Enabled
Command Processor Extensions enabled by default. Use CMD /? for details.
Deleted file - %1
Displays or modifies file extension associations
ASSOC [.ext[=[fileType]]]
.ext Specifies the file extension to associate the file type with
fileType Specifies the file type to associate with the file extension
Type ASSOC without parameters to display the current file associations.
If ASSOC is invoked with just a file extension, it displays the current
file association for that file extension. Specify nothing for the file
type and the command will delete the association for the file extension.
File association not found for extension %1
Displays or modifies file types used in file extension associations
FTYPE [fileType[=[openCommandString]]]
fileType Specifies the file type to examine or change
openCommandString Specifies the open command to use when launching files
of this type.
Type FTYPE without parameters to display the current file types that
have open command strings defined. FTYPE is invoked with just a file
type, it displays the current open command string for that file type.
Specify nothing for the open command string and the FTYPE command will
delete the open command string for the file type. Within an open
command string %%0 or %%1 are substituted with the file name being
launched through the assocation. %%* gets all the parameters and %%2
gets the 1st parameter, %%3 the second, etc. %%~n gets all the remaining
parameters starting with the nth parameter, where n may be between 2 and 9,
inclusive. For example:
ASSOC .pl=PerlScript
FTYPE PerlScript=perl.exe %%1 %%*
would allow you to invoke a Perl script as follows:
script.pl 1 2 3
If you want to eliminate the need to type the extensions, then do the
following:
set PATHEXT=.pl;%%PATHEXT%%
and the script could be invoked as follows:
script 1 2 3
File type '%1' not found or no open command associated with it.
Invalid parameter to SETLOCAL command
The restartable option to the COPY command is not supported by
this version of the operating system.
The following usage of the path operator in batch-parameter
substitution is invalid: %1
For valid formats type CALL /? or FOR /?
Environment variable %1 not defined
Invalid attempt to call batch label outside of batch script.
The system cannot find the batch label specified - %1
The unicode output option to CMD.EXE is not supported by this
version of the operating system.
If Command Extensions are enabled DEL and ERASE change as follows:
The display semantics of the /S switch are reversed in that it shows
you only the files that are deleted, not the ones it could not find.
If Command Extensions are enabled CHDIR changes as follows:
The current directory string is converted to use the same case as
the on disk names. So CD C:\TEMP would actually set the current
directory to C:\Temp if that is the case on disk.
CHDIR command does not treat spaces as delimiters, so it is possible to
CD into a subdirectory name that contains a space without surrounding
the name with quotes. For example:
cd \winnt\profiles\username\programs\start menu
is the same as:
cd "\winnt\profiles\username\programs\start menu"
which is what you would have to type if extensions were disabled.
If Command Extensions are enabled MKDIR changes as follows:
MKDIR creates any intermediate directories in the path, if needed.
For example, assume \a does not exist then:
mkdir \a\b\c\d
is the same as:
mkdir \a
chdir \a
mkdir b
chdir b
mkdir c
chdir c
mkdir d
which is what you would have to type if extensions were disabled.
If Command Extensions are enabled the DATE command supports
the /T switch which tells the command to just output the
current date, without prompting for a new date.
If Command Extensions are enabled the TIME command supports
the /T switch which tells the command to just output the
current time, without prompting for a new time.
If Command Extensions are enabled the PROMPT command supports
the following additional formatting characters:
$+ zero or more plus sign (+) characters depending upon the
depth of the PUSHD directory stack, one character for each
level pushed.
$M Displays the remote name associated with the current drive
letter or the empty string if current drive is not a network
drive.
If Command Extensions are enabled the PUSHD command accepts
network paths in addition to the normal drive letter and path.
If a network path is specified, PUSHD will create a temporary
drive letter that points to that specified network resource and
then change the current drive and directory, using the newly
defined drive letter. Temporary drive letters are allocated from
Z: on down, using the first unused drive letter found.
If Command Extensions are enabled the POPD command will delete
any temporary drive letter created by PUSHD when you POPD that
drive off the pushed directory stack.
If Command Extensions are enabled SET changes as follows:
SET command invoked with just a variable name, no equal sign or value
will display the value of all variables whose prefix matches the name
given to the SET command. For example:
SET P
would display all variables that begin with the letter 'P'
SET command will set the ERRORLEVEL to 1 if the variable name is not
found in the current environment.
SET command will not allow an equal sign to be part of the name of
a variable.
Two new switches have been added to the SET command:
SET /A expression
SET /P variable=[promptString]
The /A switch specifies that the string to the right of the equal sign
is a numerical expression that is evaluated. The expression evaluator
is pretty simple and supports the following operations, in decreasing
order of precedence:
() - grouping
! ~ - - unary operators
* / %% - arithmetic operators
+ - - arithmetic operators
<< >> - logical shift
& - bitwise and
^ - bitwise exclusive or
| - bitwise or
= *= /= %%= += -= - assignment
&= ^= |= <<= >>=
, - expression separator
If you use any of the logical or modulus operators, you will need to
enclose the expression string in quotes. Any non-numeric strings in the
expression are treated as environment variable names whose values are
converted to numbers before using them. If an environment variable name
is specified but is not defined in the current environment, then a value
of zero is used. This allows you to do arithmetic with environment
variable values without having to type all those %% signs to get their
values. If SET /A is executed from the command line outside of a
command script, then it displays the final value of the expression. The
assignment operator requires an environment variable name to the left of
the assignment operator. Numeric values are decimal numbers, unless
prefixed by 0x for hexadecimal numbers, and 0 for octal numbers.
So 0x12 is the same as 18 is the same as 022. Please note that the octal
notation can be confusing: 08 and 09 are not valid numbers because 8 and
9 are not valid octal digits.
The /P switch allows you to set the value of a variable to a line of input
entered by the user. Displays the specified promptString before reading
the line of input. The promptString can be empty.
Environment variable substitution has been enhanced as follows:
%%PATH:str1=str2%%
would expand the PATH environment variable, substituting each occurrence
of "str1" in the expanded result with "str2". "str2" can be the empty
string to effectively delete all occurrences of "str1" from the expanded
output. "str1" can begin with an asterisk, in which case it will match
everything from the beginning of the expanded output to the first
occurrence of the remaining portion of str1.
May also specify substrings for an expansion.
%%PATH:~10,5%%
would expand the PATH environment variable, and then use only the 5
characters that begin at the 11th (offset 10) character of the expanded
result. If the length is not specified, then it defaults to the
remainder of the variable value. If either number (offset or length) is
negative, then the number used is the length of the environment variable
value added to the offset or length specified.
%%PATH:~-10%%
would extract the last 10 characters of the PATH variable.
%%PATH:~0,-2%%
would extract all but the last 2 characters of the PATH variable.
Finally, support for delayed environment variable expansion has been
added. This support is always disabled by default, but may be
enabled/disabled via the /V command line switch to CMD.EXE. See CMD /?
Delayed environment variable expansion is useful for getting around
the limitations of the current expansion which happens when a line
of text is read, not when it is executed. The following example
demonstrates the problem with immediate variable expansion:
set VAR=before
if "%%VAR%%" == "before" (
set VAR=after
if "%%VAR%%" == "after" @echo If you see this, it worked
would never display the message, since the %%VAR%% in BOTH IF statements
is substituted when the first IF statement is read, since it logically
includes the body of the IF, which is a compound statement. So the
IF inside the compound statement is really comparing "before" with
"after" which will never be equal. Similarly, the following example
will not work as expected:
set LIST=
for %%i in (*) do set LIST=%%LIST%% %%i
echo %%LIST%%
in that it will NOT build up a list of files in the current directory,
but instead will just set the LIST variable to the last file found.
Again, this is because the %%LIST%% is expanded just once when the
FOR statement is read, and at that time the LIST variable is empty.
So the actual FOR loop we are executing is:
for %%i in (*) do set LIST= %%i
which just keeps setting LIST to the last file found.
Delayed environment variable expansion allows you to use a different
character (the exclamation mark) to expand environment variables at
execution time. If delayed variable expansion is enabled, the above
examples could be written as follows to work as intended:
set VAR=before
if "%%VAR%%" == "before" (
set VAR=after
if "!VAR!" == "after" @echo If you see this, it worked
set LIST=
for %%i in (*) do set LIST=!LIST! %%i
echo %%LIST%%
If Command Extensions are enabled, then there are several dynamic
environment variables that can be expanded but which don't show up in
the list of variables displayed by SET. These variable values are
computed dynamically each time the value of the variable is expanded.
If the user explicitly defines a variable with one of these names, then
that definition will override the dynamic one described below:
%%CD%% - expands to the current directory string.
%%DATE%% - expands to current date using same format as DATE command.
%%TIME%% - expands to current time using same format as TIME command.
%%RANDOM%% - expands to a random decimal number between 0 and 32767.
%%ERRORLEVEL%% - expands to the current ERRORLEVEL value
%%CMDEXTVERSION%% - expands to the current Command Processor Extensions
version number.
%%CMDCMDLINE%% - expands to the original command line that invoked the
Command Processor.
If Command Extensions are enabled GOTO changes as follows:
GOTO command now accepts a target label of :EOF which transfers control
to the end of the current batch script file. This is an easy way to
exit a batch script file without defining a label. Type CALL /? for a
description of extensions to the CALL command that make this feature
useful.
If Command Extensions are enabled the SHIFT command supports
the /n switch which tells the command to start shifting at the
nth argument, where n may be between zero and eight. For example:
SHIFT /2
would shift %%3 to %%2, %%4 to %%3, etc. and leave %%0 and %%1 unaffected.
If Command Extensions are enabled CALL changes as follows:
CALL command now accepts labels as the target of the CALL. The syntax
CALL :label arguments
A new batch file context is created with the specified arguments and
control is passed to the statement after the label specified. You must
"exit" twice by reaching the end of the batch script file twice. The
first time you read the end, control will return to just after the CALL
statement. The second time will exit the batch script. Type GOTO /?
for a description of the GOTO :EOF extension that will allow you to
"return" from a batch script.
In addition, expansion of batch script argument references (%%0, %%1,
etc.) have been changed as follows:
%%* in a batch script refers to all the arguments (e.g. %%1 %%2 %%3
%%4 %%5 ...)
Substitution of batch parameters (%%n) has been enhanced. You can
now use the following optional syntax:
%%~1 - expands %%1 removing any surrounding quotes (")
%%~f1 - expands %%1 to a fully qualified path name
%%~d1 - expands %%1 to a drive letter only
%%~p1 - expands %%1 to a path only
%%~n1 - expands %%1 to a file name only
%%~x1 - expands %%1 to a file extension only
%%~s1 - expanded path contains short names only
%%~a1 - expands %%1 to file attributes
%%~t1 - expands %%1 to date/time of file
%%~z1 - expands %%1 to size of file
%%~$PATH:1 - searches the directories listed in the PATH
environment variable and expands %%1 to the fully
qualified name of the first one found. If the
environment variable name is not defined or the
file is not found by the search, then this
modifier expands to the empty string
The modifiers can be combined to get compound results:
%%~dp1 - expands %%1 to a drive letter and path only
%%~nx1 - expands %%1 to a file name and extension only
%%~dp$PATH:1 - searches the directories listed in the PATH
environment variable for %%1 and expands to the
drive letter and path of the first one found.
%%~ftza1 - expands %%1 to a DIR like output line
In the above examples %%1 and PATH can be replaced by other
valid values. The %%~ syntax is terminated by a valid argument
number. The %%~ modifiers may not be used with %%*
If Command Extensions are enabled SETLOCAL changes as follows:
SETLOCAL batch command now accepts optional arguments:
ENABLEEXTENSIONS / DISABLEEXTENSIONS
enable or disable command processor extensions. See
CMD /? for details.
ENABLEDELAYEDEXPANSION / DISABLEDELAYEDEXPANSION
enable or disable delayed environment variable
expansion. See SET /? for details.
These modifications last until the matching ENDLOCAL command,
regardless of their setting prior to the SETLOCAL command.
The SETLOCAL command will set the ERRORLEVEL value if given
an argument. It will be zero if one of the two valid arguments
is given and one otherwise. You can use this in batch scripts
to determine if the extensions are available, using the following
technique:
VERIFY OTHER 2>nul
SETLOCAL ENABLEEXTENSIONS
IF ERRORLEVEL 1 echo Unable to enable extensions
This works because on old versions of CMD.EXE, SETLOCAL does NOT
set the ERRORLEVEL value. The VERIFY command with a bad argument
initializes the ERRORLEVEL value to a non-zero value.
If Command Extensions are enabled ENDLOCAL changes as follows:
If the corresponding SETLOCAL enable or disabled command extensions
using the new ENABLEEXTENSIONS or DISABLEEXTENSIONS options, then
after the ENDLOCAL, the enabled/disabled state of command extensions
will be restored to what it was prior to the matching SETLOCAL
command execution.
If Command Extensions are enabled, external command invocation
through the command line or the START command changes as follows:
non-executable files may be invoked through their file association just
by typing the name of the file as a command. (e.g. WORD.DOC would
launch the application associated with the .DOC file extension).
See the ASSOC and FTYPE commands for how to create these
associations from within a command script.
When executing an application that is a 32-bit GUI application, CMD.EXE
does not wait for the application to terminate before returning to
the command prompt. This new behavior does NOT occur if executing
within a command script.
When executing a command line whose first token is the string "CMD "
without an extension or path qualifier, then "CMD" is replaced with
the value of the COMSPEC variable. This prevents picking up CMD.EXE
from the current directory.
When executing a command line whose first token does NOT contain an
extension, then CMD.EXE uses the value of the PATHEXT
environment variable to determine which extensions to look for
and in what order. The default value for the PATHEXT variable
is:
.COM;.EXE;.BAT;.CMD
Notice the syntax is the same as the PATH variable, with
semicolons separating the different elements.
When searching for an executable, if there is no match on any extension,
then looks to see if the name matches a directory name. If it does, the
START command launches the Explorer on that path. If done from the
command line, it is the equivalent to doing a CD /D to that path.
If Command Extensions are enabled, and running on the Windows XP
platform, then the BREAK command will enter a hard coded breakpoint
if being debugged by a debugger.
If Command Extensions are enabled, the following additional
forms of the FOR command are supported:
FOR /D %%variable IN (set) DO command [command-parameters]
If set contains wildcards, then specifies to match against directory
names instead of file names.
FOR /R [[drive:]path] %%variable IN (set) DO command [command-parameters]
Walks the directory tree rooted at [drive:]path, executing the FOR
statement in each directory of the tree. If no directory
specification is specified after /R then the current directory is
assumed. If set is just a single period (.) character then it
will just enumerate the directory tree.
FOR /L %%variable IN (start,step,end) DO command [command-parameters]
The set is a sequence of numbers from start to end, by step amount.
So (1,1,5) would generate the sequence 1 2 3 4 5 and (5,-1,1) would
generate the sequence (5 4 3 2 1)
FOR /F ["options"] %%variable IN (file-set) DO command [command-parameters]
FOR /F ["options"] %%variable IN ("string") DO command [command-parameters]
FOR /F ["options"] %%variable IN ('command') DO command [command-parameters]
or, if usebackq option present:
FOR /F ["options"] %%variable IN (file-set) DO command [command-parameters]
FOR /F ["options"] %%variable IN ('string') DO command [command-parameters]
FOR /F ["options"] %%variable IN (`command`) DO command [command-parameters]
filenameset is one or more file names. Each file is opened, read
and processed before going on to the next file in filenameset.
Processing consists of reading in the file, breaking it up into
individual lines of text and then parsing each line into zero or
more tokens. The body of the for loop is then called with the
variable value(s) set to the found token string(s). By default, /F
passes the first blank separated token from each line of each file.
Blank lines are skipped. You can override the default parsing
behavior by specifying the optional "options" parameter. This
is a quoted string which contains one or more keywords to specify
different parsing options. The keywords are:
eol=c - specifies an end of line comment character
(just one)
skip=n - specifies the number of lines to skip at the
beginning of the file.
delims=xxx - specifies a delimiter set. This replaces the
default delimiter set of space and tab.
tokens=x,y,m-n - specifies which tokens from each line are to
be passed to the for body for each iteration.
This will cause additional variable names to
be allocated. The m-n form is a range,
specifying the mth through the nth tokens. If
the last character in the tokens= string is an
asterisk, then an additional variable is
allocated and receives the remaining text on
the line after the last token parsed.
usebackq - specifies that the new semantics are in force,
where a back quoted string is executed as a
command and a single quoted string is a
literal string command and allows the use of
double quotes to quote file names in
filenameset.
Some examples might help:
FOR /F "eol=; tokens=2,3* delims=, " %%i in (myfile.txt) do @echo %%i %%j %%k
would parse each line in myfile.txt, ignoring lines that begin with
a semicolon, passing the 2nd and 3rd token from each line to the for
body, with tokens delimited by commas and/or spaces. Notice the for
body statements reference %%i to get the 2nd token, %%j to get the
3rd token, and %%k to get all remaining tokens after the 3rd. For
file names that contain spaces, you need to quote the filenames with
double quotes. In order to use double quotes in this manner, you also
need to use the usebackq option, otherwise the double quotes will be
interpreted as defining a literal string to parse.
%%i is explicitly declared in the for statement and the %%j and %%k
are implicitly declared via the tokens= option. You can specify up
to 26 tokens via the tokens= line, provided it does not cause an
attempt to declare a variable higher than the letter 'z' or 'Z'.
Remember, FOR variables are single-letter, case sensitive, global,
and you can't have more than 52 total active at any one time.
You can also use the FOR /F parsing logic on an immediate string, by
making the filenameset between the parenthesis a quoted string,
using single quote characters. It will be treated as a single line
of input from a file and parsed.
Finally, you can use the FOR /F command to parse the output of a
command. You do this by making the filenameset between the
parenthesis a back quoted string. It will be treated as a command
line, which is passed to a child CMD.EXE and the output is captured
into memory and parsed as if it was a file. So the following
example:
FOR /F "usebackq delims==" %%i IN (`set`) DO @echo %%i
would enumerate the environment variable names in the current
environment.
In addition, substitution of FOR variable references has been enhanced.
You can now use the following optional syntax:
%%~I - expands %%I removing any surrounding quotes (")
%%~fI - expands %%I to a fully qualified path name
%%~dI - expands %%I to a drive letter only
%%~pI - expands %%I to a path only
%%~nI - expands %%I to a file name only
%%~xI - expands %%I to a file extension only
%%~sI - expanded path contains short names only
%%~aI - expands %%I to file attributes of file
%%~tI - expands %%I to date/time of file
%%~zI - expands %%I to size of file
%%~$PATH:I - searches the directories listed in the PATH
environment variable and expands %%I to the
fully qualified name of the first one found.
If the environment variable name is not
defined or the file is not found by the
search, then this modifier expands to the
empty string
The modifiers can be combined to get compound results:
%%~dpI - expands %%I to a drive letter and path only
%%~nxI - expands %%I to a file name and extension only
%%~fsI - expands %%I to a full path name with short names only
%%~dp$PATH:I - searches the directories listed in the PATH
environment variable for %%I and expands to the
drive letter and path of the first one found.
%%~ftzaI - expands %%I to a DIR like output line
In the above examples %%I and PATH can be replaced by other valid
values. The %%~ syntax is terminated by a valid FOR variable name.
Picking upper case variable names like %%I makes it more readable and
avoids confusion with the modifiers, which are not case sensitive.
If Command Extensions are enabled IF changes as follows:
IF [/I] string1 compare-op string2 command
IF CMDEXTVERSION number command
IF DEFINED variable command
where compare-op may be one of:
EQU - equal
NEQ - not equal
LSS - less than
LEQ - less than or equal
GTR - greater than
GEQ - greater than or equal
and the /I switch, if specified, says to do case insensitive string
compares. The /I switch can also be used on the string1==string2 form
of IF. These comparisons are generic, in that if both string1 and
string2 are both comprised of all numeric digits, then the strings are
converted to numbers and a numeric comparison is performed.
The CMDEXTVERSION conditional works just like ERRORLEVEL, except it is
comparing against an internal version number associated with the Command
Extensions. The first version is 1. It will be incremented by one when
significant enhancements are added to the Command Extensions.
CMDEXTVERSION conditional is never true when Command Extensions are
disabled.
The DEFINED conditional works just like EXISTS except it takes an
environment variable name and returns true if the environment variable
is defined.
%%ERRORLEVEL%% will expand into a string representation of
the current value of ERRORLEVEL, provided that there is not already
an environment variable with the name ERRORLEVEL, in which case you
will get its value instead. After running a program, the following
illustrates ERRORLEVEL use:
goto answer%%ERRORLEVEL%%
:answer0
echo Program had return code 0
:answer1
echo Program had return code 1
You can also using the numerical comparisons above:
IF %%ERRORLEVEL%% LEQ 1 goto okay
%%CMDCMDLINE%% will expand into the original command line passed to
CMD.EXE prior to any processing by CMD.EXE, provided that there is not
already an environment variable with the name CMDCMDLINE, in which case
you will get its value instead.
%%CMDEXTVERSION%% will expand into a string representation of the
current value of CMDEXTVERSION, provided that there is not already
an environment variable with the name CMDEXTVERSION, in which case you
will get its value instead.
Enables or disables command line editing on DOS system
This is present for Compatibility with DOS systems. It has no effect
under Windows XP, as command line editing is always enabled.
CMD.EXE was started with the above path as the current directory.
UNC paths are not supported. Defaulting to Windows directory.
CMD does not support UNC paths as current directories.
UNC paths not supported for current directory. Using
PUSHD %1
to create temporary drive letter to support UNC current
directory. Use POPD or EXIT to delete temporary drive
letter.
Invalid parameter to SHIFT command
Unbalanced parenthesis.
Missing operand.
Missing operator.
Invalid number. Numeric constants are either decimal (17),
hexadecimal (0x11), or octal (021).
Invalid number. Numbers are limited to 32-bits of precision.
Divide by zero error.
The COMSPEC environment variable does not point to CMD.EXE.
Overwrite %1? (Yes/No/All): %0
<JUNCTION> %0
The directory name %1\%2 is too long.
The full path of %1 is too long.
The path %1\%2 is too long.
Unable to find library %1.
Cannot find function %1!S!:%2!S!.
Cannot find ordinal %1!S!:%2!d!.
File Not Found
Could Not Find %1
The FAT File System only support Last Write Times
Begins localization of environment changes in a batch file. Environment
changes made after SETLOCAL has been issued are local to the batch file.
ENDLOCAL must be issued to restore the previous settings. When the end
of a batch script is reached, an implied ENDLOCAL is executed for any
outstanding SETLOCAL commands issued by that batch script.
SETLOCAL
Ends localization of environment changes in a batch file.
Environment changes made after ENDLOCAL has been issued are
not local to the batch file; the previous settings are not
restored on termination of the batch file.
ENDLOCAL
Sets the window title for the command prompt window.
TITLE [string]
string Specifies the title for the command prompt window.
Allows programs to open data files in specified directories as if they were
in the current directory.
APPEND [[drive:]path[;...]] [/X[:ON | :OFF]] [/PATH:ON | /PATH:OFF] [/E]
APPEND ;
[drive:]path Specifies a drive and directory to append.
/X:ON Applies appended directories to file searches and
application execution.
/X:OFF Applies appended directories only to requests to open files.
/X:OFF is the default setting.
/PATH:ON Applies the appended directories to file requests that already
specify a path. /PATH:ON is the default setting.
/PATH:OFF Turns off the effect of /PATH:ON.
/E Stores a copy of the appended directory list in an environment
variable named APPEND. /E may be used only the first time
you use APPEND after starting up your system.
Type APPEND ; to clear the appended directory list.
Type APPEND without parameters to display the appended directory list.
Moves files and renames files and directories.
To move one or more files:
MOVE [/Y | /-Y] [drive:][path]filename1[,...] destination
To rename a directory:
MOVE [/Y | /-Y] [drive:][path]dirname1 dirname2
[drive:][path]filename1 Specifies the location and name of the file
or files you want to move.
destination Specifies the new location of the file. Destination
can consist of a drive letter and colon, a
directory name, or a combination. If you are moving
only one file, you can also include a filename if
you want to rename the file when you move it.
[drive:][path]dirname1 Specifies the directory you want to rename.
dirname2 Specifies the new name of the directory.
/Y Suppresses prompting to confirm you want to
overwrite an existing destination file.
/-Y Causes prompting to confirm you want to overwrite
an existing destination file.
The switch /Y may be present in the COPYCMD environment variable.
This may be overridden with /-Y on the command line. Default is
to prompt on overwrites unless MOVE command is being executed from
within a batch script.
Stores the current directory for use by the POPD command, then
changes to the specified directory.
PUSHD [path | ..]
path Specifies the directory to make the current directory.
Changes to the directory stored by the PUSHD command.
%1 - %0
Maximum setlocal recursion level reached.
Enter the new date: (yy-mm-dd) %0
Enter the new date: (dd-mm-yy) %0
ERROR Verify - %1
Cannot move multiple files to a single file.
The handle could not be opened
during redirection of handle %1.
%r%1%% copied %0
Sets the default console foreground and background colors.
COLOR [attr]
attr Specifies color attribute of console output
Color attributes are specified by TWO hex digits -- the first
corresponds to the background; the second the foreground. Each digit
can be any of the following values:
0 = Black 8 = Gray
1 = Blue 9 = Light Blue
2 = Green A = Light Green
3 = Aqua B = Light Aqua
4 = Red C = Light Red
5 = Purple D = Light Purple
6 = Yellow E = Light Yellow
7 = White F = Bright White
If no argument is given, this command restores the color to what it was
when CMD.EXE started. This value either comes from the current console
window, the /T command line switch or from the DefaultColor registry
value.
The COLOR command sets ERRORLEVEL to 1 if an attempt is made to execute
the COLOR command with a foreground and background color that are the
Example: "COLOR fc" produces light red on bright white
Maximum path length exceeded - %1
****** B A T C H R E C U R S I O N exceeds STACK limits ******
Recursion Count=%1!d!, Stack Usage=%2!d! percent
****** B A T C H PROCESSING IS A B O R T E D ******
There are too many directories already in the PUSHD stack.
The command prompt has been disabled by your administrator.

DNS

Name Response Post-Analysis Lookup
dns.msftncsi.com A 131.107.255.255 131.107.255.255
dns.msftncsi.com AAAA fd3e:4f5a:5b81::1 131.107.255.255

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 56933 114.114.114.114 53
192.168.56.101 138 192.168.56.255 138

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.