Auto Tasks

#17817: Unpacker

Analysis

Category Package Started Completed Duration Options Log
FILE exe 2020-06-30 13:52:22 2020-06-30 13:55:02 160 seconds Show Options Show Log
route = tor
2020-05-13 09:13:54,344 [root] INFO: Date set to: 20200630T13:43:45, timeout set to: 200
2020-06-30 13:43:45,046 [root] DEBUG: Starting analyzer from: C:\tmpq_mrpfl7
2020-06-30 13:43:45,046 [root] DEBUG: Storing results at: C:\rETPYQ
2020-06-30 13:43:45,062 [root] DEBUG: Pipe server name: \\.\PIPE\YslEBgLpsb
2020-06-30 13:43:45,062 [root] DEBUG: Python path: C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32
2020-06-30 13:43:45,062 [root] DEBUG: No analysis package specified, trying to detect it automagically.
2020-06-30 13:43:45,062 [root] INFO: Automatically selected analysis package "exe"
2020-06-30 13:43:45,062 [root] DEBUG: Trying to import analysis package "exe"...
2020-06-30 13:43:45,093 [root] DEBUG: Imported analysis package "exe".
2020-06-30 13:43:45,093 [root] DEBUG: Trying to initialize analysis package "exe"...
2020-06-30 13:43:45,093 [root] DEBUG: Initialized analysis package "exe".
2020-06-30 13:43:45,156 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.browser"...
2020-06-30 13:43:45,171 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser".
2020-06-30 13:43:45,171 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.curtain"...
2020-06-30 13:43:45,249 [root] DEBUG: Imported auxiliary module "modules.auxiliary.curtain".
2020-06-30 13:43:45,249 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.digisig"...
2020-06-30 13:43:45,265 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig".
2020-06-30 13:43:45,265 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.disguise"...
2020-06-30 13:43:45,296 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise".
2020-06-30 13:43:45,296 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.human"...
2020-06-30 13:43:45,312 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human".
2020-06-30 13:43:45,312 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.procmon"...
2020-06-30 13:43:45,312 [root] DEBUG: Imported auxiliary module "modules.auxiliary.procmon".
2020-06-30 13:43:45,312 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.screenshots"...
2020-06-30 13:43:45,328 [modules.auxiliary.screenshots] DEBUG: Importing 'time'
2020-06-30 13:43:45,328 [modules.auxiliary.screenshots] DEBUG: Importing 'StringIO'
2020-06-30 13:43:45,328 [modules.auxiliary.screenshots] DEBUG: Importing 'Thread'
2020-06-30 13:43:45,328 [modules.auxiliary.screenshots] DEBUG: Importing 'Auxiliary'
2020-06-30 13:43:45,328 [modules.auxiliary.screenshots] DEBUG: Importing 'NetlogFile'
2020-06-30 13:43:45,328 [modules.auxiliary.screenshots] DEBUG: Importing 'Screenshot'
2020-06-30 13:43:45,328 [lib.api.screenshot] DEBUG: Importing 'math'
2020-06-30 13:43:45,328 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2020-06-30 13:43:47,750 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab'
2020-06-30 13:43:47,765 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw'
2020-06-30 13:43:47,859 [modules.auxiliary.screenshots] DEBUG: Imports OK
2020-06-30 13:43:47,859 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots".
2020-06-30 13:43:47,859 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.sysmon"...
2020-06-30 13:43:47,859 [root] DEBUG: Imported auxiliary module "modules.auxiliary.sysmon".
2020-06-30 13:43:47,875 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.usage"...
2020-06-30 13:43:47,890 [root] DEBUG: Imported auxiliary module "modules.auxiliary.usage".
2020-06-30 13:43:47,890 [root] DEBUG: Trying to initialize auxiliary module "Browser"...
2020-06-30 13:43:47,890 [root] DEBUG: Initialized auxiliary module "Browser".
2020-06-30 13:43:47,906 [root] DEBUG: Trying to start auxiliary module "Browser"...
2020-06-30 13:43:47,906 [root] DEBUG: Started auxiliary module Browser
2020-06-30 13:43:47,906 [root] DEBUG: Trying to initialize auxiliary module "Curtain"...
2020-06-30 13:43:47,906 [root] DEBUG: Initialized auxiliary module "Curtain".
2020-06-30 13:43:47,906 [root] DEBUG: Trying to start auxiliary module "Curtain"...
2020-06-30 13:43:47,906 [root] DEBUG: Started auxiliary module Curtain
2020-06-30 13:43:47,906 [root] DEBUG: Trying to initialize auxiliary module "DigiSig"...
2020-06-30 13:43:47,906 [root] DEBUG: Initialized auxiliary module "DigiSig".
2020-06-30 13:43:47,906 [root] DEBUG: Trying to start auxiliary module "DigiSig"...
2020-06-30 13:43:47,906 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature.
2020-06-30 13:43:48,343 [modules.auxiliary.digisig] DEBUG: File is not signed.
2020-06-30 13:43:48,343 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json
2020-06-30 13:43:48,359 [root] DEBUG: Started auxiliary module DigiSig
2020-06-30 13:43:48,359 [root] DEBUG: Trying to initialize auxiliary module "Disguise"...
2020-06-30 13:43:48,359 [root] DEBUG: Initialized auxiliary module "Disguise".
2020-06-30 13:43:48,359 [root] DEBUG: Trying to start auxiliary module "Disguise"...
2020-06-30 13:43:48,375 [root] DEBUG: Started auxiliary module Disguise
2020-06-30 13:43:48,375 [root] DEBUG: Trying to initialize auxiliary module "Human"...
2020-06-30 13:43:48,375 [root] DEBUG: Initialized auxiliary module "Human".
2020-06-30 13:43:48,375 [root] DEBUG: Trying to start auxiliary module "Human"...
2020-06-30 13:43:48,375 [root] DEBUG: Started auxiliary module Human
2020-06-30 13:43:48,375 [root] DEBUG: Trying to initialize auxiliary module "Procmon"...
2020-06-30 13:43:48,375 [root] DEBUG: Initialized auxiliary module "Procmon".
2020-06-30 13:43:48,375 [root] DEBUG: Trying to start auxiliary module "Procmon"...
2020-06-30 13:43:48,375 [root] DEBUG: Started auxiliary module Procmon
2020-06-30 13:43:48,375 [root] DEBUG: Trying to initialize auxiliary module "Screenshots"...
2020-06-30 13:43:48,390 [root] DEBUG: Initialized auxiliary module "Screenshots".
2020-06-30 13:43:48,390 [root] DEBUG: Trying to start auxiliary module "Screenshots"...
2020-06-30 13:43:48,390 [root] DEBUG: Started auxiliary module Screenshots
2020-06-30 13:43:48,390 [root] DEBUG: Trying to initialize auxiliary module "Sysmon"...
2020-06-30 13:43:48,390 [root] DEBUG: Initialized auxiliary module "Sysmon".
2020-06-30 13:43:48,390 [root] DEBUG: Trying to start auxiliary module "Sysmon"...
2020-06-30 13:43:48,390 [root] DEBUG: Started auxiliary module Sysmon
2020-06-30 13:43:48,390 [root] DEBUG: Trying to initialize auxiliary module "Usage"...
2020-06-30 13:43:48,390 [root] DEBUG: Initialized auxiliary module "Usage".
2020-06-30 13:43:48,390 [root] DEBUG: Trying to start auxiliary module "Usage"...
2020-06-30 13:43:48,390 [root] DEBUG: Started auxiliary module Usage
2020-06-30 13:43:48,390 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL option
2020-06-30 13:43:48,390 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL_64 option
2020-06-30 13:43:48,390 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader option
2020-06-30 13:43:48,390 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader_64 option
2020-06-30 13:43:49,343 [lib.api.process] INFO: Successfully executed process from path "C:\Users\Rebecca\AppData\Local\Temp\KcaNRPH3WcFfv.exe" with arguments "" with pid 4040
2020-06-30 13:43:49,343 [lib.api.process] INFO: Monitor config for process 4040: C:\tmpq_mrpfl7\dll\4040.ini
2020-06-30 13:43:49,343 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpq_mrpfl7\dll\MPyFxuj.dll, loader C:\tmpq_mrpfl7\bin\UqLAlpD.exe
2020-06-30 13:43:49,718 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\YslEBgLpsb.
2020-06-30 13:43:49,718 [root] DEBUG: Loader: Injecting process 4040 (thread 5072) with C:\tmpq_mrpfl7\dll\MPyFxuj.dll.
2020-06-30 13:43:49,718 [root] DEBUG: Process image base: 0x00400000
2020-06-30 13:43:49,734 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpq_mrpfl7\dll\MPyFxuj.dll.
2020-06-30 13:43:49,750 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-30 13:43:49,750 [root] DEBUG: Successfully injected DLL C:\tmpq_mrpfl7\dll\MPyFxuj.dll.
2020-06-30 13:43:49,750 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 4040
2020-06-30 13:43:51,750 [lib.api.process] INFO: Successfully resumed process with pid 4040
2020-06-30 13:43:52,140 [root] DEBUG: Python path set to 'C:\Users\Rebecca\AppData\Local\Programs\Python\Python38-32'.
2020-06-30 13:43:52,156 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-30 13:43:52,156 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-06-30 13:43:52,156 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 4040 at 0x6b610000, image base 0x400000, stack from 0x126000-0x130000
2020-06-30 13:43:52,156 [root] DEBUG: Commandline: C:\Users\Rebecca\AppData\Local\Temp\"C:\Users\Rebecca\AppData\Local\Temp\KcaNRPH3WcFfv.exe".
2020-06-30 13:43:52,171 [root] INFO: Loaded monitor into process with pid 4040
2020-06-30 13:43:52,171 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 4040, handle 0xbc.
2020-06-30 13:43:52,187 [root] INFO: Disabling sleep skipping.
2020-06-30 13:43:52,187 [root] INFO: Disabling sleep skipping.
2020-06-30 13:43:52,187 [root] INFO: Disabling sleep skipping.
2020-06-30 13:43:52,187 [root] INFO: Disabling sleep skipping.
2020-06-30 13:43:52,187 [root] DEBUG: DLL loaded at 0x74AC0000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32 (0x19e000 bytes).
2020-06-30 13:43:52,203 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x110 amd local view 0x02CE0000 to global list.
2020-06-30 13:43:52,249 [root] DEBUG: DLL loaded at 0x74790000: C:\Windows\system32\uxtheme (0x40000 bytes).
2020-06-30 13:43:52,296 [root] DEBUG: DLL unloaded from 0x66130000.
2020-06-30 13:43:52,312 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x130 amd local view 0x031C0000 to global list.
2020-06-30 13:43:52,328 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 4040.
2020-06-30 13:43:52,343 [root] DEBUG: DLL loaded at 0x76790000: C:\Windows\system32\WININET (0x1c4000 bytes).
2020-06-30 13:43:52,343 [root] DEBUG: DLL loaded at 0x758C0000: C:\Windows\system32\Secur32 (0x8000 bytes).
2020-06-30 13:43:52,359 [root] DEBUG: DLL loaded at 0x75BE0000: C:\Windows\system32\profapi (0xb000 bytes).
2020-06-30 13:43:52,359 [root] DEBUG: DLL loaded at 0x71990000: C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0 (0x4000 bytes).
2020-06-30 13:43:52,359 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x188 amd local view 0x00600000 to global list.
2020-06-30 13:43:52,375 [root] DEBUG: DLL loaded at 0x75C70000: C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0 (0x4000 bytes).
2020-06-30 13:43:52,375 [root] DEBUG: DLL loaded at 0x76750000: C:\Windows\system32\WS2_32 (0x35000 bytes).
2020-06-30 13:43:52,375 [root] DEBUG: DLL loaded at 0x77D80000: C:\Windows\system32\NSI (0x6000 bytes).
2020-06-30 13:43:52,390 [root] DEBUG: DLL loaded at 0x6F7C0000: C:\Windows\system32\winhttp (0x58000 bytes).
2020-06-30 13:43:52,390 [root] DEBUG: DLL loaded at 0x6F770000: C:\Windows\system32\webio (0x50000 bytes).
2020-06-30 13:43:52,390 [root] DEBUG: DLL unloaded from 0x6F7C0000.
2020-06-30 13:43:52,406 [root] DEBUG: DLL loaded at 0x755C0000: C:\Windows\system32\mswsock (0x3c000 bytes).
2020-06-30 13:43:52,406 [root] DEBUG: DLL loaded at 0x755B0000: C:\Windows\System32\wship6 (0x6000 bytes).
2020-06-30 13:43:52,406 [root] DEBUG: DLL loaded at 0x740A0000: C:\Windows\system32\IPHLPAPI (0x1c000 bytes).
2020-06-30 13:43:52,406 [root] DEBUG: DLL loaded at 0x74060000: C:\Windows\system32\WINNSI (0x7000 bytes).
2020-06-30 13:43:52,421 [root] DEBUG: DLL loaded at 0x71540000: C:\Windows\system32\winmm (0x32000 bytes).
2020-06-30 13:43:52,421 [root] DEBUG: set_caller_info: Adding region at 0x00610000 to caller regions list (ntdll::memcpy).
2020-06-30 13:43:52,421 [root] DEBUG: TestPERequirements: Possible PE image rejected due to section 3 of 6, RVA 0xb000 and size 0x61b000.
2020-06-30 13:43:52,421 [root] DEBUG: set_caller_info: Adding region at 0x01320000 to caller regions list (kernel32::GetSystemTime).
2020-06-30 13:43:52,437 [root] DEBUG: DLL loaded at 0x75B30000: C:\Windows\system32\cryptbase (0xc000 bytes).
2020-06-30 13:43:52,437 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x1320000
2020-06-30 13:43:52,437 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x01320000 size 0x400000.
2020-06-30 13:43:52,437 [root] DEBUG: DumpPEsInRange: Scanning range 0x1320000 - 0x1321000.
2020-06-30 13:43:52,437 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x1320000-0x1321000.
2020-06-30 13:43:52,640 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\rETPYQ\CAPE\4040_200960866412441230262020 (size 0xf16)
2020-06-30 13:43:52,671 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\rETPYQ\CAPE\4040_41150528012441230262020 (size 0xe007)
2020-06-30 13:43:52,671 [root] DEBUG: DumpRegion: Dumped stack region from 0x00610000, size 0xf000.
2020-06-30 13:43:52,671 [root] DEBUG: set_caller_info: Adding region at 0x04430000 to caller regions list (ntdll::NtAllocateVirtualMemory).
2020-06-30 13:43:52,671 [root] DEBUG: set_caller_info: Failed to dumping calling PE image at 0x04430000.
2020-06-30 13:44:07,684 [root] DEBUG: DLL loaded at 0x75140000: C:\Windows\System32\wshtcpip (0x5000 bytes).
2020-06-30 13:44:07,692 [root] DEBUG: DLL loaded at 0x75480000: C:\Windows\system32\DNSAPI (0x44000 bytes).
2020-06-30 13:44:07,701 [root] DEBUG: DLL loaded at 0x72290000: C:\Windows\system32\rasadhlp (0x6000 bytes).
2020-06-30 13:44:07,892 [root] DEBUG: DLL loaded at 0x74010000: C:\Windows\System32\fwpuclnt (0x38000 bytes).
2020-06-30 13:44:07,903 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x290 amd local view 0x00660000 to global list.
2020-06-30 13:44:07,906 [root] DEBUG: DLL unloaded from 0x75140000.
2020-06-30 13:44:07,912 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x294 amd local view 0x00670000 to global list.
2020-06-30 13:44:07,914 [root] DEBUG: DLL unloaded from 0x755B0000.
2020-06-30 13:44:07,918 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x298 amd local view 0x73820000 to global list.
2020-06-30 13:44:07,921 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x00680000 for section view with handle 0x298.
2020-06-30 13:44:07,925 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x73810000 for section view with handle 0x298.
2020-06-30 13:44:07,927 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x00680000 for section view with handle 0x298.
2020-06-30 13:44:07,933 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x73820000 for section view with handle 0x298.
2020-06-30 13:44:07,936 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x00680000 for section view with handle 0x298.
2020-06-30 13:44:07,939 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x73810000 for section view with handle 0x298.
2020-06-30 13:44:07,942 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x00680000 for section view with handle 0x298.
2020-06-30 13:44:07,951 [root] DEBUG: DLL loaded at 0x6C0A0000: C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0 (0x4000 bytes).
2020-06-30 13:44:07,958 [root] DEBUG: DLL loaded at 0x76010000: C:\Windows\system32\CLBCatQ (0x83000 bytes).
2020-06-30 13:44:07,961 [root] DEBUG: DLL loaded at 0x73F70000: C:\Windows\system32\dhcpcsvc6 (0xd000 bytes).
2020-06-30 13:44:07,964 [root] DEBUG: DLL loaded at 0x71060000: C:\Windows\System32\netprofm (0x5a000 bytes).
2020-06-30 13:44:07,971 [root] DEBUG: DLL loaded at 0x74720000: C:\Windows\System32\nlaapi (0x10000 bytes).
2020-06-30 13:44:07,977 [root] DEBUG: DLL loaded at 0x75D60000: C:\Windows\system32\CRYPT32 (0x122000 bytes).
2020-06-30 13:44:07,979 [root] DEBUG: DLL loaded at 0x75C50000: C:\Windows\system32\MSASN1 (0xc000 bytes).
2020-06-30 13:44:07,985 [root] DEBUG: DLL loaded at 0x75210000: C:\Windows\system32\USERENV (0x17000 bytes).
2020-06-30 13:44:07,989 [root] DEBUG: DLL loaded at 0x73F50000: C:\Windows\system32\dhcpcsvc (0x12000 bytes).
2020-06-30 13:44:07,997 [root] DEBUG: DLL loaded at 0x75600000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2020-06-30 13:44:08,000 [root] DEBUG: DLL loaded at 0x761F0000: C:\Windows\system32\urlmon (0x124000 bytes).
2020-06-30 13:44:08,012 [root] DEBUG: DLL loaded at 0x75390000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-06-30 13:44:08,015 [root] DEBUG: DLL loaded at 0x75BD0000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2020-06-30 13:44:08,023 [root] DEBUG: DLL loaded at 0x6E540000: C:\Windows\System32\npmproxy (0x8000 bytes).
2020-06-30 13:44:08,285 [root] DEBUG: DLL loaded at 0x75300000: C:\Windows\system32\credssp (0x8000 bytes).
2020-06-30 13:44:08,287 [root] DEBUG: DLL unloaded from 0x75600000.
2020-06-30 13:44:08,292 [root] DEBUG: DLL loaded at 0x75400000: C:\Windows\system32\schannel (0x41000 bytes).
2020-06-30 13:44:08,924 [root] DEBUG: DLL loaded at 0x75770000: C:\Windows\system32\ncrypt (0x39000 bytes).
2020-06-30 13:44:08,928 [root] DEBUG: DLL loaded at 0x75750000: C:\Windows\system32\bcrypt (0x17000 bytes).
2020-06-30 13:44:08,932 [root] DEBUG: DLL loaded at 0x756D0000: C:\Windows\system32\bcryptprimitives (0x3d000 bytes).
2020-06-30 13:44:08,942 [root] DEBUG: DLL loaded at 0x75E90000: C:\Windows\system32\WINTRUST (0x2f000 bytes).
2020-06-30 13:44:08,963 [root] DEBUG: DLL loaded at 0x751F0000: C:\Windows\system32\GPAPI (0x16000 bytes).
2020-06-30 13:44:08,991 [root] DEBUG: DLL loaded at 0x71000000: C:\Windows\system32\cryptnet (0x1d000 bytes).
2020-06-30 13:44:08,994 [root] DEBUG: DLL loaded at 0x761A0000: C:\Windows\system32\WLDAP32 (0x45000 bytes).
2020-06-30 13:44:09,007 [root] DEBUG: DLL loaded at 0x73820000: C:\Windows\system32\SensApi (0x6000 bytes).
2020-06-30 13:44:09,023 [root] DEBUG: DLL loaded at 0x6F7C0000: C:\Windows\system32\WINHTTP (0x58000 bytes).
2020-06-30 13:44:09,026 [root] DEBUG: DLL loaded at 0x6F770000: C:\Windows\system32\webio (0x50000 bytes).
2020-06-30 13:44:09,029 [root] DEBUG: DLL unloaded from 0x76650000.
2020-06-30 13:44:09,037 [root] DEBUG: DLL unloaded from 0x77BF0000.
2020-06-30 13:44:09,045 [root] DEBUG: DLL loaded at 0x75C90000: C:\Windows\system32\CFGMGR32 (0x27000 bytes).
2020-06-30 13:44:09,050 [root] DEBUG: DLL unloaded from 0x6F7C0000.
2020-06-30 13:44:09,055 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x380 amd local view 0x01300000 to global list.
2020-06-30 13:44:09,083 [root] DEBUG: DLL unloaded from 0x77BF0000.
2020-06-30 13:44:09,093 [root] DEBUG: DLL unloaded from 0x6F7C0000.
2020-06-30 13:44:09,720 [root] INFO: Added new file to list with pid None and path C:\Users\Rebecca\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B
2020-06-30 13:44:09,722 [root] INFO: Added new file to list with pid None and path C:\Users\Rebecca\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B
2020-06-30 13:44:09,725 [root] DEBUG: DLL unloaded from 0x71000000.
2020-06-30 13:44:09,747 [root] DEBUG: DLL unloaded from 0x77BF0000.
2020-06-30 13:44:09,759 [root] DEBUG: DLL unloaded from 0x6F7C0000.
2020-06-30 13:44:09,760 [root] DEBUG: DLL unloaded from 0x6F7C0000.
2020-06-30 13:44:09,766 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x61c amd local view 0x02C70000 to global list.
2020-06-30 13:44:09,772 [root] DEBUG: DLL unloaded from 0x77BF0000.
2020-06-30 13:44:09,827 [root] DEBUG: DLL unloaded from 0x6F7C0000.
2020-06-30 13:44:09,828 [root] DEBUG: DLL unloaded from 0x6F7C0000.
2020-06-30 13:44:10,162 [root] INFO: Added new file to list with pid None and path C:\Users\Rebecca\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BE8B021F9E811DFC8C8A28572A17C05A_34822680AE4930144B7F2ADE17366A85
2020-06-30 13:44:10,165 [root] INFO: Added new file to list with pid None and path C:\Users\Rebecca\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BE8B021F9E811DFC8C8A28572A17C05A_34822680AE4930144B7F2ADE17366A85
2020-06-30 13:44:10,166 [root] DEBUG: DLL unloaded from 0x71000000.
2020-06-30 13:44:11,496 [root] INFO: Added new file to list with pid None and path C:\Users\Rebecca\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\521F25E202FF760B8461B88413F425E7
2020-06-30 13:44:11,500 [root] INFO: Added new file to list with pid None and path C:\Users\Rebecca\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\521F25E202FF760B8461B88413F425E7
2020-06-30 13:44:16,663 [root] INFO: Added new file to list with pid None and path C:\Users\Rebecca\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat
2020-06-30 13:44:16,674 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 4040
2020-06-30 13:44:16,679 [root] DEBUG: GetHookCallerBase: thread 5292 (handle 0x0), return address 0x6B641698, allocation base 0x6B610000.
2020-06-30 13:44:16,681 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x00400000.
2020-06-30 13:44:16,685 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-06-30 13:44:16,689 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00400000.
2020-06-30 13:44:16,694 [root] DEBUG: DumpProcess: Module entry point VA is 0x0005C72C.
2020-06-30 13:44:16,798 [root] DEBUG: DumpProcess: Module image dump success - dump size 0xad200.
2020-06-30 13:44:16,808 [root] INFO: Process with pid 4040 has terminated
2020-06-30 13:44:21,866 [root] INFO: Process list is empty, terminating analysis.
2020-06-30 13:44:22,881 [root] INFO: Created shutdown mutex.
2020-06-30 13:44:23,881 [root] INFO: Shutting down package.
2020-06-30 13:44:23,881 [root] INFO: Stopping auxiliary modules.
2020-06-30 13:44:23,991 [lib.common.results] WARNING: File C:\rETPYQ\bin\procmon.xml doesn't exist anymore
2020-06-30 13:44:23,991 [root] INFO: Finishing auxiliary modules.
2020-06-30 13:44:23,991 [root] INFO: Shutting down pipe server and dumping dropped files.
2020-06-30 13:44:24,444 [root] WARNING: Folder at path "C:\rETPYQ\debugger" does not exist, skip.
2020-06-30 13:44:24,444 [root] INFO: Analysis completed.

Machine

Name Label Manager Started On Shutdown On
win7_4 win7_4 KVM 2020-06-30 13:52:24 2020-06-30 13:55:02

File Details

File Name KcaNRPH3WcFfv
File Size 696320 bytes
File Type PE32 executable (GUI) Intel 80386, for MS Windows
PE timestamp 1992-06-19 22:22:17
MD5 cd8d11d11a4a2c38bfb1ba89a9e8cef6
SHA1 27cdc50b73ce48a9d2e773fbda57fe11a67a1d40
SHA256 9d288f2ea49daa4323d1a496c42cbffdfbb148b634345ecc9147265bbdc43491
SHA512 d7efb6e34026658f0e098c028f7613ace62c36e5d10fd64185f5d5b1bb3d0d95e100e164512032d404c265c9ef448ff69c4c2055ad81a2bdff6f64d2972e27da
CRC32 C3514ED4
Ssdeep 12288:7e7+LHvP79bjBoxHyzKXAzgqGD4YdCIJuxd6Ur5IScz5ISF+gAuA1KzqrRUyqqjJ:qq779bjBoAzKXAPC4vYX/ebP2ocjc
Download Download ZIP Resubmit sample

Signatures

Behavioural detection: Executable code extraction - unpacking
Attempts to connect to a dead IP:Port (3 unique times)
IP: 95.100.210.141:443
IP: 172.217.16.131:80 (United States)
IP: 172.217.23.131:80
Creates RWX memory
Dynamic (imported) function loading detected
DynamicLoader: IMM32.DLL/ImmCreateContext
DynamicLoader: IMM32.DLL/ImmDestroyContext
DynamicLoader: IMM32.DLL/ImmNotifyIME
DynamicLoader: IMM32.DLL/ImmAssociateContext
DynamicLoader: IMM32.DLL/ImmReleaseContext
DynamicLoader: IMM32.DLL/ImmGetContext
DynamicLoader: IMM32.DLL/ImmGetCompositionStringA
DynamicLoader: IMM32.DLL/ImmSetCompositionStringA
DynamicLoader: IMM32.DLL/ImmGetCompositionStringW
DynamicLoader: IMM32.DLL/ImmSetCompositionStringW
DynamicLoader: IMM32.DLL/ImmSetCandidateWindow
DynamicLoader: kernel32.dll/InitializeSRWLock
DynamicLoader: kernel32.dll/AcquireSRWLockExclusive
DynamicLoader: kernel32.dll/AcquireSRWLockShared
DynamicLoader: kernel32.dll/ReleaseSRWLockExclusive
DynamicLoader: kernel32.dll/ReleaseSRWLockShared
DynamicLoader: comctl32.dll/InitCommonControlsEx
DynamicLoader: kernel32.dll/GetDiskFreeSpaceExA
DynamicLoader: oleaut32.dll/VariantChangeTypeEx
DynamicLoader: oleaut32.dll/VarNeg
DynamicLoader: oleaut32.dll/VarNot
DynamicLoader: oleaut32.dll/VarAdd
DynamicLoader: oleaut32.dll/VarSub
DynamicLoader: oleaut32.dll/VarMul
DynamicLoader: oleaut32.dll/VarDiv
DynamicLoader: oleaut32.dll/VarIdiv
DynamicLoader: oleaut32.dll/VarMod
DynamicLoader: oleaut32.dll/VarAnd
DynamicLoader: oleaut32.dll/VarOr
DynamicLoader: oleaut32.dll/VarXor
DynamicLoader: oleaut32.dll/VarCmp
DynamicLoader: oleaut32.dll/VarI4FromStr
DynamicLoader: oleaut32.dll/VarR4FromStr
DynamicLoader: oleaut32.dll/VarR8FromStr
DynamicLoader: oleaut32.dll/VarDateFromStr
DynamicLoader: oleaut32.dll/VarCyFromStr
DynamicLoader: oleaut32.dll/VarBoolFromStr
DynamicLoader: oleaut32.dll/VarBstrFromCy
DynamicLoader: oleaut32.dll/VarBstrFromDate
DynamicLoader: oleaut32.dll/VarBstrFromBool
DynamicLoader: USER32.dll/GetMonitorInfoA
DynamicLoader: USER32.dll/GetSystemMetrics
DynamicLoader: USER32.dll/EnumDisplayMonitors
DynamicLoader: USER32.dll/AnimateWindow
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: comctl32.dll/InitializeFlatSB
DynamicLoader: comctl32.dll/UninitializeFlatSB
DynamicLoader: comctl32.dll/FlatSB_GetScrollProp
DynamicLoader: comctl32.dll/FlatSB_SetScrollProp
DynamicLoader: comctl32.dll/FlatSB_EnableScrollBar
DynamicLoader: comctl32.dll/FlatSB_ShowScrollBar
DynamicLoader: comctl32.dll/FlatSB_GetScrollRange
DynamicLoader: comctl32.dll/FlatSB_GetScrollInfo
DynamicLoader: comctl32.dll/FlatSB_GetScrollPos
DynamicLoader: comctl32.dll/FlatSB_SetScrollPos
DynamicLoader: comctl32.dll/FlatSB_SetScrollInfo
DynamicLoader: comctl32.dll/FlatSB_SetScrollRange
DynamicLoader: USER32.dll/SetLayeredWindowAttributes
DynamicLoader: uxtheme.dll/OpenThemeData
DynamicLoader: uxtheme.dll/CloseThemeData
DynamicLoader: uxtheme.dll/DrawThemeBackground
DynamicLoader: uxtheme.dll/DrawThemeText
DynamicLoader: uxtheme.dll/GetThemeBackgroundContentRect
DynamicLoader: uxtheme.dll/GetThemePartSize
DynamicLoader: uxtheme.dll/GetThemeTextExtent
DynamicLoader: uxtheme.dll/GetThemeTextMetrics
DynamicLoader: uxtheme.dll/GetThemeBackgroundRegion
DynamicLoader: uxtheme.dll/HitTestThemeBackground
DynamicLoader: uxtheme.dll/DrawThemeEdge
DynamicLoader: uxtheme.dll/DrawThemeIcon
DynamicLoader: uxtheme.dll/IsThemePartDefined
DynamicLoader: uxtheme.dll/IsThemeBackgroundPartiallyTransparent
DynamicLoader: uxtheme.dll/GetThemeColor
DynamicLoader: uxtheme.dll/GetThemeMetric
DynamicLoader: uxtheme.dll/GetThemeString
DynamicLoader: uxtheme.dll/GetThemeBool
DynamicLoader: uxtheme.dll/GetThemeInt
DynamicLoader: uxtheme.dll/GetThemeEnumValue
DynamicLoader: uxtheme.dll/GetThemePosition
DynamicLoader: uxtheme.dll/GetThemeFont
DynamicLoader: uxtheme.dll/GetThemeRect
DynamicLoader: uxtheme.dll/GetThemeMargins
DynamicLoader: uxtheme.dll/GetThemeIntList
DynamicLoader: uxtheme.dll/GetThemePropertyOrigin
DynamicLoader: uxtheme.dll/SetWindowTheme
DynamicLoader: uxtheme.dll/GetThemeFilename
DynamicLoader: uxtheme.dll/GetThemeSysColor
DynamicLoader: uxtheme.dll/GetThemeSysColorBrush
DynamicLoader: uxtheme.dll/GetThemeSysBool
DynamicLoader: uxtheme.dll/GetThemeSysSize
DynamicLoader: uxtheme.dll/GetThemeSysFont
DynamicLoader: uxtheme.dll/GetThemeSysString
DynamicLoader: uxtheme.dll/GetThemeSysInt
DynamicLoader: uxtheme.dll/IsThemeActive
DynamicLoader: uxtheme.dll/IsAppThemed
DynamicLoader: uxtheme.dll/GetWindowTheme
DynamicLoader: uxtheme.dll/EnableThemeDialogTexture
DynamicLoader: uxtheme.dll/IsThemeDialogTextureEnabled
DynamicLoader: uxtheme.dll/GetThemeAppProperties
DynamicLoader: uxtheme.dll/SetThemeAppProperties
DynamicLoader: uxtheme.dll/GetCurrentThemeName
DynamicLoader: uxtheme.dll/GetThemeDocumentationProperty
DynamicLoader: uxtheme.dll/DrawThemeParentBackground
DynamicLoader: uxtheme.dll/EnableTheming
DynamicLoader: GDI32.dll/GetLayout
DynamicLoader: GDI32.dll/GdiRealizationInfo
DynamicLoader: GDI32.dll/FontIsLinked
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: GDI32.dll/GetTextFaceAliasW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: GDI32.dll/GetFontAssocStatus
DynamicLoader: ADVAPI32.dll/RegQueryValueExA
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: GDI32.dll/GetTextFaceAliasW
DynamicLoader: WININET.dll/InternetQueryOptionA
DynamicLoader: api-ms-win-downlevel-advapi32-l1-1-0.dll/GetTokenInformation
DynamicLoader: Secur32.dll/GetUserNameExA
DynamicLoader: api-ms-win-downlevel-advapi32-l1-1-0.dll/GetSidSubAuthorityCount
DynamicLoader: api-ms-win-downlevel-advapi32-l1-1-0.dll/GetSidSubAuthority
DynamicLoader: api-ms-win-downlevel-advapi32-l1-1-0.dll/RegCreateKeyExA
DynamicLoader: api-ms-win-downlevel-advapi32-l1-1-0.dll/RegQueryValueExA
DynamicLoader: api-ms-win-downlevel-advapi32-l1-1-0.dll/RegOpenKeyExW
DynamicLoader: api-ms-win-downlevel-advapi32-l1-1-0.dll/RegGetValueW
DynamicLoader: api-ms-win-downlevel-advapi32-l1-1-0.dll/RegCloseKey
DynamicLoader: SHELL32.dll/SHGetKnownFolderPath
DynamicLoader: SHELL32.dll/SHGetKnownFolderPath
DynamicLoader: api-ms-win-downlevel-advapi32-l1-1-0.dll/CopySid
DynamicLoader: api-ms-win-downlevel-advapi32-l2-1-0.dll/ConvertSidToStringSidW
DynamicLoader: api-ms-win-downlevel-advapi32-l2-1-0.dll/ConvertStringSecurityDescriptorToSecurityDescriptorW
DynamicLoader: api-ms-win-downlevel-ole32-l1-1-0.dll/CoTaskMemFree
DynamicLoader: api-ms-win-downlevel-advapi32-l1-1-0.dll/EventRegister
DynamicLoader: api-ms-win-downlevel-advapi32-l1-1-0.dll/RegGetValueA
DynamicLoader: iertutil.dll/
DynamicLoader: iertutil.dll/
DynamicLoader: iertutil.dll/
DynamicLoader: api-ms-win-downlevel-advapi32-l1-1-0.dll/RegOpenKeyExA
DynamicLoader: api-ms-win-downlevel-ole32-l1-1-0.dll/CoTaskMemAlloc
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: winhttp.dll/WinHttpCreateProxyResolver
DynamicLoader: iertutil.dll/
DynamicLoader: api-ms-win-downlevel-advapi32-l1-1-0.dll/RegQueryValueExW
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/WSAIoctl
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: IPHLPAPI.DLL/NotifyIpInterfaceChange
DynamicLoader: kernel32.dll/DeleteCriticalSection
DynamicLoader: kernel32.dll/LeaveCriticalSection
DynamicLoader: kernel32.dll/EnterCriticalSection
DynamicLoader: kernel32.dll/InitializeCriticalSection
DynamicLoader: kernel32.dll/VirtualFree
DynamicLoader: kernel32.dll/VirtualAlloc
DynamicLoader: kernel32.dll/LocalFree
DynamicLoader: kernel32.dll/LocalAlloc
DynamicLoader: kernel32.dll/GetVersion
DynamicLoader: kernel32.dll/GetCurrentThreadId
DynamicLoader: kernel32.dll/WideCharToMultiByte
DynamicLoader: kernel32.dll/lstrlenA
DynamicLoader: kernel32.dll/lstrcpynA
DynamicLoader: kernel32.dll/LoadLibraryExA
DynamicLoader: kernel32.dll/GetThreadLocale
DynamicLoader: kernel32.dll/GetStartupInfoA
DynamicLoader: kernel32.dll/GetProcAddress
DynamicLoader: kernel32.dll/GetModuleHandleA
DynamicLoader: kernel32.dll/GetModuleFileNameA
DynamicLoader: kernel32.dll/GetLocaleInfoA
DynamicLoader: kernel32.dll/GetLastError
DynamicLoader: kernel32.dll/GetCommandLineA
DynamicLoader: kernel32.dll/FreeLibrary
DynamicLoader: kernel32.dll/FindFirstFileA
DynamicLoader: kernel32.dll/FindClose
DynamicLoader: kernel32.dll/ExitProcess
DynamicLoader: kernel32.dll/WriteFile
DynamicLoader: kernel32.dll/UnhandledExceptionFilter
DynamicLoader: kernel32.dll/SetFilePointer
DynamicLoader: kernel32.dll/SetEndOfFile
DynamicLoader: kernel32.dll/RtlUnwind
DynamicLoader: kernel32.dll/ReadFile
DynamicLoader: kernel32.dll/RaiseException
DynamicLoader: kernel32.dll/GetStdHandle
DynamicLoader: kernel32.dll/GetFileSize
DynamicLoader: kernel32.dll/GetFileType
DynamicLoader: kernel32.dll/CreateFileA
DynamicLoader: kernel32.dll/CloseHandle
DynamicLoader: USER32.dll/GetKeyboardType
DynamicLoader: USER32.dll/LoadStringA
DynamicLoader: USER32.dll/MessageBoxA
DynamicLoader: USER32.dll/CharNextA
DynamicLoader: ADVAPI32.dll/RegQueryValueExA
DynamicLoader: ADVAPI32.dll/RegOpenKeyExA
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: oleaut32.dll/SysFreeString
DynamicLoader: kernel32.dll/TlsSetValue
DynamicLoader: kernel32.dll/TlsGetValue
DynamicLoader: kernel32.dll/TlsFree
DynamicLoader: kernel32.dll/TlsAlloc
DynamicLoader: kernel32.dll/LocalFree
DynamicLoader: kernel32.dll/LocalAlloc
DynamicLoader: kernel32.dll/WriteFile
DynamicLoader: kernel32.dll/VirtualQuery
DynamicLoader: kernel32.dll/VirtualProtect
DynamicLoader: kernel32.dll/VirtualAlloc
DynamicLoader: kernel32.dll/LoadLibraryA
DynamicLoader: kernel32.dll/GetVersionExA
DynamicLoader: kernel32.dll/GetThreadLocale
DynamicLoader: kernel32.dll/GetStringTypeExA
DynamicLoader: kernel32.dll/GetStdHandle
DynamicLoader: kernel32.dll/GetProcAddress
DynamicLoader: kernel32.dll/GetModuleHandleA
DynamicLoader: kernel32.dll/GetModuleFileNameA
DynamicLoader: kernel32.dll/GetLocaleInfoA
DynamicLoader: kernel32.dll/GetDiskFreeSpaceA
DynamicLoader: kernel32.dll/GetCPInfo
DynamicLoader: kernel32.dll/GetACP
DynamicLoader: kernel32.dll/FindFirstFileA
DynamicLoader: kernel32.dll/FindClose
DynamicLoader: kernel32.dll/FileTimeToLocalFileTime
DynamicLoader: kernel32.dll/FileTimeToDosDateTime
DynamicLoader: kernel32.dll/EnumCalendarInfoA
DynamicLoader: USER32.dll/TranslateMessage
DynamicLoader: USER32.dll/MessageBoxA
DynamicLoader: USER32.dll/LoadStringA
DynamicLoader: USER32.dll/GetSystemMetrics
DynamicLoader: USER32.dll/GetMessageA
DynamicLoader: USER32.dll/DispatchMessageA
DynamicLoader: USER32.dll/CharNextA
DynamicLoader: USER32.dll/CharToOemA
DynamicLoader: WININET.dll/InternetCheckConnectionA
DynamicLoader: WININET.dll/InternetReadFile
DynamicLoader: WININET.dll/InternetOpenUrlA
DynamicLoader: WININET.dll/InternetOpenA
DynamicLoader: WININET.dll/InternetCloseHandle
DynamicLoader: winmm.dll/timeSetEvent
DynamicLoader: IPHLPAPI.DLL/NotifyUnicastIpAddressChange
DynamicLoader: IPHLPAPI.DLL/GetBestInterfaceEx
DynamicLoader: IPHLPAPI.DLL/GetIfEntry2
DynamicLoader: kernel32.dll/GetDiskFreeSpaceExA
DynamicLoader: WS2_32.dll/GetAddrInfoExW
DynamicLoader: mswsock.dll/NSPStartup
DynamicLoader: DNSAPI.dll/DnsNameCompare_W
DynamicLoader: DNSAPI.dll/DnsApiAlloc
DynamicLoader: DNSAPI.dll/DnsQueryExW
DynamicLoader: IPHLPAPI.DLL/GetCurrentThreadCompartmentId
DynamicLoader: RPCRT4.dll/NdrClientCall2
DynamicLoader: RPCRT4.dll/RpcStringBindingComposeW
DynamicLoader: RPCRT4.dll/RpcBindingFromStringBindingW
DynamicLoader: RPCRT4.dll/RpcStringFreeW
DynamicLoader: RPCRT4.dll/RpcBindingFree
DynamicLoader: rasadhlp.dll/WSAttemptAutodialAddr
DynamicLoader: rasadhlp.dll/WSAttemptAutodialName
DynamicLoader: rasadhlp.dll/WSNoteSuccessfulHostentLookup
DynamicLoader: DNSAPI.dll/DnsApiFree
DynamicLoader: DNSAPI.dll/DnsFree
DynamicLoader: fwpuclnt.dll/NamespaceCallout
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/WSASocketA
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: api-ms-win-downlevel-ole32-l1-1-0.dll/CoInitializeEx
DynamicLoader: cryptbase.dll/SystemFunction036
DynamicLoader: api-ms-win-downlevel-advapi32-l1-1-0.dll/EventWrite
DynamicLoader: api-ms-win-downlevel-ole32-l1-1-0.dll/CoCreateInstance
DynamicLoader: IPHLPAPI.DLL/GetAdaptersAddresses
DynamicLoader: WS2_32.dll/GetAddrInfoW
DynamicLoader: oleaut32.dll/
DynamicLoader: oleaut32.dll/
DynamicLoader: oleaut32.dll/DllGetClassObject
DynamicLoader: oleaut32.dll/DllCanUnloadNow
DynamicLoader: ADVAPI32.dll/RegOpenKeyW
DynamicLoader: oleaut32.dll/
DynamicLoader: IPHLPAPI.DLL/ConvertInterfaceGuidToLuid
DynamicLoader: IPHLPAPI.DLL/GetIpForwardTable2
DynamicLoader: IPHLPAPI.DLL/GetIpNetEntry2
DynamicLoader: IPHLPAPI.DLL/FreeMibTable
DynamicLoader: api-ms-win-downlevel-ole32-l1-1-0.dll/StringFromIID
DynamicLoader: api-ms-win-downlevel-ole32-l1-1-0.dll/CoUninitialize
DynamicLoader: oleaut32.dll/
DynamicLoader: WINHTTP.dll/WinHttpOpen
DynamicLoader: WINHTTP.dll/WinHttpSetTimeouts
DynamicLoader: WINHTTP.dll/WinHttpSetOption
DynamicLoader: WINHTTP.dll/WinHttpCrackUrl
DynamicLoader: SHLWAPI.dll/StrCmpNW
DynamicLoader: WINHTTP.dll/WinHttpConnect
DynamicLoader: WINHTTP.dll/WinHttpOpenRequest
DynamicLoader: WINHTTP.dll/WinHttpGetDefaultProxyConfiguration
DynamicLoader: WINHTTP.dll/WinHttpGetIEProxyConfigForCurrentUser
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ADVAPI32.dll/RegDeleteTreeA
DynamicLoader: ADVAPI32.dll/RegDeleteTreeW
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: NSI.dll/NsiAllocateAndGetTable
DynamicLoader: CFGMGR32.dll/CM_Open_Class_Key_ExW
DynamicLoader: IPHLPAPI.DLL/ConvertInterfaceGuidToLuid
DynamicLoader: IPHLPAPI.DLL/GetIfEntry2
DynamicLoader: IPHLPAPI.DLL/GetIpForwardTable2
DynamicLoader: IPHLPAPI.DLL/GetIpNetEntry2
DynamicLoader: IPHLPAPI.DLL/FreeMibTable
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: NSI.dll/NsiFreeTable
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: WINHTTP.dll/WinHttpGetProxyForUrl
DynamicLoader: ADVAPI32.dll/RegDeleteTreeA
DynamicLoader: ADVAPI32.dll/RegDeleteTreeW
DynamicLoader: WINHTTP.dll/WinHttpSendRequest
DynamicLoader: WS2_32.dll/GetAddrInfoW
DynamicLoader: WS2_32.dll/WSASocketW
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/WSAIoctl
DynamicLoader: WS2_32.dll/FreeAddrInfoW
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/WSARecv
DynamicLoader: WS2_32.dll/WSASend
DynamicLoader: WINHTTP.dll/WinHttpReceiveResponse
DynamicLoader: WINHTTP.dll/WinHttpQueryHeaders
DynamicLoader: SHLWAPI.dll/StrStrIW
DynamicLoader: WINHTTP.dll/WinHttpQueryDataAvailable
DynamicLoader: WINHTTP.dll/WinHttpReadData
DynamicLoader: WINHTTP.dll/WinHttpCloseHandle
DynamicLoader: RPCRT4.dll/RpcBindingFree
DynamicLoader: ADVAPI32.dll/RegDeleteTreeA
DynamicLoader: ADVAPI32.dll/RegDeleteTreeW
DynamicLoader: ADVAPI32.dll/RegDeleteTreeA
DynamicLoader: ADVAPI32.dll/RegDeleteTreeW
DynamicLoader: ADVAPI32.dll/RegDeleteTreeA
DynamicLoader: ADVAPI32.dll/RegDeleteTreeW
DynamicLoader: ADVAPI32.dll/RegDeleteTreeA
DynamicLoader: ADVAPI32.dll/RegDeleteTreeW
DynamicLoader: api-ms-win-downlevel-ole32-l1-1-0.dll/CoSetProxyBlanket
DynamicLoader: ole32.dll/ObjectStublessClient10
DynamicLoader: oleaut32.dll/
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: api-ms-win-downlevel-advapi32-l1-1-0.dll/RegEnumKeyExW
DynamicLoader: oleaut32.dll/
HTTPS urls from behavior.
URL: https://drive.google.com/u/0/uc?id=1AVvkkFl2qaq933IsVFN98byeGq8XsJzI&export=download
CAPE extracted potentially suspicious content
KcaNRPH3WcFfv.exe: Unpacked Shellcode
KcaNRPH3WcFfv.exe: Unpacked Shellcode: 32-bit DLL
The binary contains an unknown PE section name indicative of packing
unknown section: name: .itext, entropy: 6.01, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x00000800, virtual_size: 0x0000077c
The binary likely contains encrypted or compressed data.
section: name: .rsrc, entropy: 7.14, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x0002da00, virtual_size: 0x0002d926
Authenticode signature is invalid
authenticode error: No signature found. SignTool Error File not valid C\Users\Rebecca\AppData\Local\Temp\KcaNRPH3WcFfv
Network activity contains more than one unique useragent.
Process: KcaNRPH3WcFfv.exe
User-Agent: Internal
Process: KcaNRPH3WcFfv.exe
User-Agent: CODE
File has been identified by 14 Antiviruses on VirusTotal as malicious
APEX: Malicious
Kaspersky: UDS:DangerousObject.Multi.Generic
Rising: [email protected] (RDML:oTYGlm10Tjn2dUHngoC2oQ)
Trapmine: malicious.moderate.ml.score
Fortinet: W32/GenKryptik.EKLE!tr
Endgame: malicious (high confidence)
Microsoft: Trojan:Win32/Wacatac.C!ml
ZoneAlarm: UDS:DangerousObject.Multi.Generic
BitDefenderTheta: Gen:[email protected]
VBA32: BScope.Backdoor.Remcos
Malwarebytes: Backdoor.NetWiredRC
ESET-NOD32: Win32/TrojanDownloader.Delf.CYI
eGambit: Unsafe.AI_Score_86%
Cybereason: malicious.b73ce4
Anomalous binary characteristics
anomaly: Timestamp on binary predates the release date of the OS version it requires by at least a year
anomaly: Actual checksum does not match that reported in PE header
Created network traffic indicative of malicious activity
signature: ET JA3 Hash - Possible Malware - Various Malspam/RigEK
signature: ET JA3 Hash - Possible Malware - Boleto Malspam

Screenshots


Hosts

Direct IP Country Name
Y 8.8.8.8 [VT] United States
N 216.58.212.174 [VT] United States
Y 172.217.16.131 [VT] United States

DNS

Name Response Post-Analysis Lookup
drive.google.com [VT] A 216.58.212.174 [VT] 108.177.122.101 [VT]

Summary

C:\Windows\System32\ieframe.dll
C:\Users\Rebecca\AppData\Local\Temp\KcaNRPH3WcFfv.ENU
C:\Users\Rebecca\AppData\Local\Temp\KcaNRPH3WcFfv.ENU.DLL
C:\Users\Rebecca\AppData\Local\Temp\KcaNRPH3WcFfv.EN
C:\Users\Rebecca\AppData\Local\Temp\KcaNRPH3WcFfv.EN.DLL
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\Fonts\staticcache.dat
C:\Users\Rebecca\AppData\Local\Microsoft\Windows\Temporary Internet Files
C:\Users\Rebecca\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat
\??\Nsi
C:\Users\Rebecca\AppData\Local\Temp\KcaNRPH3Wc
\Device\RasAcd
C:\Windows\System32\WSHTCPIP.DLL
C:\Windows\System32\en-US\wshtcpip.dll.mui
C:\Windows\System32\wship6.dll
C:\Windows\System32\en-US\wship6.dll.mui
C:\Windows\System32\wshqos.dll
C:\Windows\System32\en-US\wshqos.dll.mui
C:\Windows\System32\en-US\WINHTTP.dll.mui
C:\Users\Rebecca\AppData\LocalLow
C:\Users\Rebecca\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B
C:\Users\Rebecca\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData
C:\Users\Rebecca\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content
C:\Users\Rebecca\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B
C:\Users\Rebecca\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\521F25E202FF760B8461B88413F425E7
C:\Users\Rebecca\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BE8B021F9E811DFC8C8A28572A17C05A_34822680AE4930144B7F2ADE17366A85
C:\Users\Rebecca\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BE8B021F9E811DFC8C8A28572A17C05A_34822680AE4930144B7F2ADE17366A85
C:\Users\Rebecca\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\521F25E202FF760B8461B88413F425E7
C:\Windows\System32\ieframe.dll
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\Fonts\staticcache.dat
C:\Users\Rebecca\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat
\Device\RasAcd
C:\Windows\System32\en-US\wshtcpip.dll.mui
C:\Windows\System32\en-US\wship6.dll.mui
C:\Windows\System32\wshqos.dll
C:\Windows\System32\en-US\wshqos.dll.mui
C:\Windows\System32\en-US\WINHTTP.dll.mui
C:\Users\Rebecca\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B
C:\Users\Rebecca\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B
C:\Users\Rebecca\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\521F25E202FF760B8461B88413F425E7
C:\Users\Rebecca\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BE8B021F9E811DFC8C8A28572A17C05A_34822680AE4930144B7F2ADE17366A85
C:\Users\Rebecca\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BE8B021F9E811DFC8C8A28572A17C05A_34822680AE4930144B7F2ADE17366A85
C:\Users\Rebecca\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\521F25E202FF760B8461B88413F425E7
C:\Users\Rebecca\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat
\Device\RasAcd
C:\Users\Rebecca\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B
C:\Users\Rebecca\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B
C:\Users\Rebecca\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BE8B021F9E811DFC8C8A28572A17C05A_34822680AE4930144B7F2ADE17366A85
C:\Users\Rebecca\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BE8B021F9E811DFC8C8A28572A17C05A_34822680AE4930144B7F2ADE17366A85
C:\Users\Rebecca\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\521F25E202FF760B8461B88413F425E7
C:\Users\Rebecca\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\521F25E202FF760B8461B88413F425E7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
DisableUserModeCallbackFilter
HKEY_CURRENT_USER\Software\Borland\Locales
HKEY_LOCAL_MACHINE\Software\Borland\Locales
HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\MS Shell Dlg 2
\x1a60\x171EY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\MS Shell Dlg 2
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\00060101.00060101
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
\xbed0\x171EY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Tahoma
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SyncMode5
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\SessionStartTimeDefaultDeltaSecs
HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\MBCSAPIforCrack
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Security_HKLM_only
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\KcaNRPH3WcFfv.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\*
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CLIENTAUTHCERTFILTER
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_CLIENTAUTHCERTFILTER
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\RETRY_HEADERONLYPOST_ONCONNECTIONRESET
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\RETRY_HEADERONLYPOST_ONCONNECTIONRESET
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MIME_HANDLING
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MIME_HANDLING\KcaNRPH3WcFfv.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MIME_HANDLING\*
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BYPASS_CACHE_FOR_CREDPOLICY_KB936611
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BYPASS_CACHE_FOR_CREDPOLICY_KB936611
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IGNORE_MAPPINGS_FOR_CREDPOLICY
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_IGNORE_MAPPINGS_FOR_CREDPOLICY
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_INCLUDE_PORT_IN_SPN_KB908209
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_INCLUDE_PORT_IN_SPN_KB908209
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BUFFERBREAKING_818408
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BUFFERBREAKING_818408
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SKIP_POST_RETRY_ON_INTERNETWRITEFILE_KB895954
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_SKIP_POST_RETRY_ON_INTERNETWRITEFILE_KB895954
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_FIX_CHUNKED_PROXY_SCRIPT_DOWNLOAD_KB843289
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_FIX_CHUNKED_PROXY_SCRIPT_DOWNLOAD_KB843289
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_USE_CNAME_FOR_SPN_KB911149
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_USE_CNAME_FOR_SPN_KB911149
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PERMIT_CACHE_FOR_AUTHENTICATED_FTP_KB910274
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_PERMIT_CACHE_FOR_AUTHENTICATED_FTP_KB910274
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK\KcaNRPH3WcFfv.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK\*
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISALLOW_NULL_IN_RESPONSE_HEADERS
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_DISALLOW_NULL_IN_RESPONSE_HEADERS
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DIGEST_NO_EXTRAS_IN_URI
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_DIGEST_NO_EXTRAS_IN_URI
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ENABLE_PASSPORT_SESSION_STORE_KB948608
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_EXCLUDE_INVALID_CLIENT_CERT_KB929477
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_EXCLUDE_INVALID_CLIENT_CERT_KB929477
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_USE_UTF8_FOR_BASIC_AUTH_KB967545
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_USE_UTF8_FOR_BASIC_AUTH_KB967545
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RETURN_FAILED_CONNECT_CONTENT_KB942615
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_RETURN_FAILED_CONNECT_CONTENT_KB942615
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PRESERVE_SPACES_IN_FILENAMES_KB952730
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_PRESERVE_SPACES_IN_FILENAMES_KB952730
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\FromCacheTimeout
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\SecureProtocols
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\SecureProtocols
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SecureProtocols
HKEY_LOCAL_MACHINE\Software\Policies
HKEY_CURRENT_USER\Software\Policies
HKEY_CURRENT_USER\Software
HKEY_LOCAL_MACHINE\Software
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer
\xce70\x135EY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CertificateRevocation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\DisableKeepAlive
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\IdnEnabled
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\PreConnectLimit
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\PreResolveLimit
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SqmHttpStreamRandomUploadPoolSize
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CacheMode
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnableHttp1_1
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnableHttp1_1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnableHttp1_1
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyHttp1.1
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyHttp1.1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyHttp1.1
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyHttp1.1
\xce70\x135EY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnableNegotiate
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\DisableBasicOverClearChannel
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ClientAuthBuiltInUI
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnableAutoProxyResultCache
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\DisplayScriptDownloadFailureUI
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\MBCSServername
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\UTF8ServerNameRes
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\DisableReadRange
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SocketSendBufferLength
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SocketReceiveBufferLength
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\KeepAliveTimeout
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MaxHttpRedirects
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MaxConnectionsPerServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\MaxConnectionsPerServer
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MaxConnectionsPer1_0Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\MaxConnectionsPer1_0Server
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MaxConnectionsPerProxy
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ServerInfoTimeout
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ConnectTimeOut
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ConnectTimeOut
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ConnectRetries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ConnectRetries
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SendTimeOut
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\SendTimeOut
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ReceiveTimeOut
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ReceiveTimeOut
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\DisableNTLMPreAuth
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ScavengeCacheLowerBound
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CertCacheNoValidate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\ScavengeCacheFileLifeTime
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache
HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\ScavengeCacheFileLimit
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\ScavengeCacheFileLimit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\ScavengeCacheFileLimit
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NOTIFY_UNVERIFIED_SPN_KB2385266
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_DISABLE_NOTIFY_UNVERIFIED_SPN_KB2385266
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_COMPAT_USE_CONNECTION_BASED_NEGOTIATE_AUTH_KB2151543
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_COMPAT_USE_CONNECTION_BASED_NEGOTIATE_AUTH_KB2151543
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\HttpDefaultExpiryTimeSecs
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\FtpDefaultExpiryTimeSecs
\xce70\x135EY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\DisableCachingOfSSLPages
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\LeashLegacyCookies
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\DialupUseLanSettings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\DialupUseLanSettings
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SendExtraCRLF
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WpadSearchAllDomains
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\BypassHTTPNoCacheCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\BypassHTTPNoCacheCheck
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\BypassSSLNoCacheCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\BypassSSLNoCacheCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\EnableHttpTrace
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\NoCheckAutodialOverRide
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\NoCheckAutodialOverRide
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCH_SEND_AUX_RECORD_KB_2618444
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_SCH_SEND_AUX_RECORD_KB_2618444
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\DontUseDNSLoadBalancing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\DontUseDNSLoadBalancing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ShareCredsWithWinHttp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MimeExclusionListForCache
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\HeaderExclusionListForCache
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\DnsCacheEnabled
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\DnsCacheEntries
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\DnsCacheTimeout
\xce70\x135EY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPost
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnAlwaysOnPost
\xce70\x135EY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnZoneCrossing
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnBadCertRecving
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPostRedirect
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AlwaysDrainOnRedirect
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnHTTPSToHTTPRedirect
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\TcpAutotuning
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ProxySettingsPerUser
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnableLegacyAutoProxyFeatures
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\BadProxyExpiresTime
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FrameTabWindow
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FrameTabWindow
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FrameMerging
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FrameMerging
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\SessionMerging
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\SessionMerging
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\AdminTabProcs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\AdminTabProcs
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\TabProcGrowth
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\TabProcGrowth
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoProxyDetectType
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadOverride
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\DisableBranchCache
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\UseFirstAvailable
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CombineFalseStartData
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\DisableFalseStartBlocklist
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnforceP3PValidity
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\DuoProtocols
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnableSpdyDebugAsserts
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WinSock2\Parameters
\xbed0\x171EY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\WinSock_Registry_Version
\xbed0\x171EY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\AutodialDLL
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Classes\Interface\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{55272A00-42CB-11CE-8135-00AA004BB851}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55272A00-42CB-11CE-8135-00AA004BB851}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55272A00-42CB-11CE-8135-00AA004BB851}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocHandler
HKEY_LOCAL_MACHINE\Software\Microsoft\OleAut
HKEY_CURRENT_USER\Software\Classes\Interface\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{2A1C9EB2-DF62-4154-B800-63278FCB8037}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9F64103F-F384-44A8-88B3-DFA27402741D}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9F64103F-F384-44A8-88B3-DFA27402741D}\WpadDecision
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9F64103F-F384-44A8-88B3-DFA27402741D}\WpadDecisionTime
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadExpirationDays
HKEY_LOCAL_MACHINE\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings
\xbed0\x171EY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}
HKEY_CURRENT_USER\Software\Microsoft\windows\CurrentVersion\Internet Settings\Wpad
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05
\xc2d0\x171EY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecision
\xc2d0\x171EY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecisionTime
HKEY_USERS\S-1-5-21-479431668-4257340731-3059248302-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-479431668-4257340731-3059248302-1002
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-479431668-4257340731-3059248302-1002\ProfileImagePath
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\ChainEngine\Config
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\ChainEngine\Config\EnableInetUnknownAuth
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\EnableInetUnknownAuth
\xc2d0\x171EY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings
\x7098\x13aEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings
\x7098\x13aEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecision
\x7098\x13aEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecisionTime
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\crypt32
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DebugFlags
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9F64103F-F384-44A8-88B3-DFA27402741D}\WpadDecisionReason
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9F64103F-F384-44A8-88B3-DFA27402741D}\WpadNetworkName
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9F64103F-F384-44A8-88B3-DFA27402741D}\WpadDetectedUrl
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecisionReason
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecisionTime
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecision
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDetectedUrl
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDhcp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDns
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9F64103F-F384-44A8-88B3-DFA27402741D}\52-54-00-6f-d4-05
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
DisableUserModeCallbackFilter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\MS Shell Dlg 2
\x1a60\x171EY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\MS Shell Dlg 2
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\00060101.00060101
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
\xbed0\x171EY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SyncMode5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\SessionStartTimeDefaultDeltaSecs
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\MBCSAPIforCrack
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Security_HKLM_only
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\KcaNRPH3WcFfv.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\*
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CLIENTAUTHCERTFILTER
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_CLIENTAUTHCERTFILTER
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MIME_HANDLING\KcaNRPH3WcFfv.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MIME_HANDLING\*
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK\KcaNRPH3WcFfv.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK\*
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\FromCacheTimeout
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\SecureProtocols
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\SecureProtocols
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SecureProtocols
\xce70\x135EY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CertificateRevocation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\DisableKeepAlive
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\IdnEnabled
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\PreConnectLimit
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\PreResolveLimit
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SqmHttpStreamRandomUploadPoolSize
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CacheMode
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnableHttp1_1
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnableHttp1_1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnableHttp1_1
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyHttp1.1
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyHttp1.1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyHttp1.1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyHttp1.1
\xce70\x135EY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnableNegotiate
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\DisableBasicOverClearChannel
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ClientAuthBuiltInUI
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnableAutoProxyResultCache
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\DisplayScriptDownloadFailureUI
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\MBCSServername
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\UTF8ServerNameRes
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\DisableReadRange
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SocketSendBufferLength
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SocketReceiveBufferLength
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\KeepAliveTimeout
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MaxHttpRedirects
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MaxConnectionsPerServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\MaxConnectionsPerServer
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MaxConnectionsPer1_0Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\MaxConnectionsPer1_0Server
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MaxConnectionsPerProxy
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ServerInfoTimeout
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ConnectTimeOut
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ConnectTimeOut
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ConnectRetries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ConnectRetries
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SendTimeOut
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\SendTimeOut
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ReceiveTimeOut
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ReceiveTimeOut
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\DisableNTLMPreAuth
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ScavengeCacheLowerBound
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CertCacheNoValidate
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\ScavengeCacheFileLifeTime
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\ScavengeCacheFileLimit
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\ScavengeCacheFileLimit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\ScavengeCacheFileLimit
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\HttpDefaultExpiryTimeSecs
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\FtpDefaultExpiryTimeSecs
\xce70\x135EY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\DisableCachingOfSSLPages
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\LeashLegacyCookies
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\DialupUseLanSettings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\DialupUseLanSettings
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SendExtraCRLF
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WpadSearchAllDomains
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\BypassHTTPNoCacheCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\BypassHTTPNoCacheCheck
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\BypassSSLNoCacheCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\BypassSSLNoCacheCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\EnableHttpTrace
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\NoCheckAutodialOverRide
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\NoCheckAutodialOverRide
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\DontUseDNSLoadBalancing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\DontUseDNSLoadBalancing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ShareCredsWithWinHttp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MimeExclusionListForCache
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\HeaderExclusionListForCache
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\DnsCacheEnabled
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\DnsCacheEntries
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\DnsCacheTimeout
\xce70\x135EY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPost
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnAlwaysOnPost
\xce70\x135EY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnZoneCrossing
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnBadCertRecving
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPostRedirect
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AlwaysDrainOnRedirect
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnHTTPSToHTTPRedirect
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\TcpAutotuning
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ProxySettingsPerUser
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnableLegacyAutoProxyFeatures
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\BadProxyExpiresTime
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FrameTabWindow
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FrameTabWindow
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FrameMerging
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FrameMerging
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\SessionMerging
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\SessionMerging
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\AdminTabProcs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\AdminTabProcs
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\TabProcGrowth
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\TabProcGrowth
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoProxyDetectType
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadOverride
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\DisableBranchCache
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\UseFirstAvailable
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CombineFalseStartData
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\DisableFalseStartBlocklist
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnforceP3PValidity
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\DuoProtocols
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnableSpdyDebugAsserts
\xbed0\x171EY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\WinSock_Registry_Version
\xbed0\x171EY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\AutodialDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55272A00-42CB-11CE-8135-00AA004BB851}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9F64103F-F384-44A8-88B3-DFA27402741D}\WpadDecision
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9F64103F-F384-44A8-88B3-DFA27402741D}\WpadDecisionTime
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadExpirationDays
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings
\xbed0\x171EY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings
\xc2d0\x171EY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecision
\xc2d0\x171EY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecisionTime
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-479431668-4257340731-3059248302-1002\ProfileImagePath
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\ChainEngine\Config\EnableInetUnknownAuth
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\EnableInetUnknownAuth
\xc2d0\x171EY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings
\x7098\x13aEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings
\x7098\x13aEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecision
\x7098\x13aEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecisionTime
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DebugFlags
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecision
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecisionTime
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecisionReason
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDhcp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDns
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDetectedUrl
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9F64103F-F384-44A8-88B3-DFA27402741D}\WpadDecisionReason
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9F64103F-F384-44A8-88B3-DFA27402741D}\WpadDecisionTime
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9F64103F-F384-44A8-88B3-DFA27402741D}\WpadDecision
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9F64103F-F384-44A8-88B3-DFA27402741D}\WpadNetworkName
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecisionReason
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecisionTime
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecision
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9F64103F-F384-44A8-88B3-DFA27402741D}\WpadDetectedUrl
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDetectedUrl
kernel32.dll.FlsAlloc
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.FlsFree
kernelbase.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.ProcessIdToSessionId
imm32.dll.ImmCreateContext
imm32.dll.ImmDestroyContext
imm32.dll.ImmNotifyIME
imm32.dll.ImmAssociateContext
imm32.dll.ImmReleaseContext
imm32.dll.ImmGetContext
imm32.dll.ImmGetCompositionStringA
imm32.dll.ImmSetCompositionStringA
imm32.dll.ImmGetCompositionStringW
imm32.dll.ImmSetCompositionStringW
imm32.dll.ImmSetCandidateWindow
kernel32.dll.InitializeSRWLock
kernel32.dll.AcquireSRWLockExclusive
kernel32.dll.AcquireSRWLockShared
kernel32.dll.ReleaseSRWLockExclusive
kernel32.dll.ReleaseSRWLockShared
comctl32.dll.InitCommonControlsEx
kernel32.dll.GetDiskFreeSpaceExA
oleaut32.dll.VariantChangeTypeEx
oleaut32.dll.VarNeg
oleaut32.dll.VarNot
oleaut32.dll.VarAdd
oleaut32.dll.VarSub
oleaut32.dll.VarMul
oleaut32.dll.VarDiv
oleaut32.dll.VarIdiv
oleaut32.dll.VarMod
oleaut32.dll.VarAnd
oleaut32.dll.VarOr
oleaut32.dll.VarXor
oleaut32.dll.VarCmp
oleaut32.dll.VarI4FromStr
oleaut32.dll.VarR4FromStr
oleaut32.dll.VarR8FromStr
oleaut32.dll.VarDateFromStr
oleaut32.dll.VarCyFromStr
oleaut32.dll.VarBoolFromStr
oleaut32.dll.VarBstrFromCy
oleaut32.dll.VarBstrFromDate
oleaut32.dll.VarBstrFromBool
user32.dll.GetMonitorInfoA
user32.dll.GetSystemMetrics
user32.dll.EnumDisplayMonitors
user32.dll.AnimateWindow
kernel32.dll.SortGetHandle
kernel32.dll.SortCloseHandle
comctl32.dll.InitializeFlatSB
comctl32.dll.UninitializeFlatSB
comctl32.dll.FlatSB_GetScrollProp
comctl32.dll.FlatSB_SetScrollProp
comctl32.dll.FlatSB_EnableScrollBar
comctl32.dll.FlatSB_ShowScrollBar
comctl32.dll.FlatSB_GetScrollRange
comctl32.dll.FlatSB_GetScrollInfo
comctl32.dll.FlatSB_GetScrollPos
comctl32.dll.FlatSB_SetScrollPos
comctl32.dll.FlatSB_SetScrollInfo
comctl32.dll.FlatSB_SetScrollRange
user32.dll.SetLayeredWindowAttributes
uxtheme.dll.OpenThemeData
uxtheme.dll.CloseThemeData
uxtheme.dll.DrawThemeBackground
uxtheme.dll.DrawThemeText
uxtheme.dll.GetThemeBackgroundContentRect
uxtheme.dll.GetThemePartSize
uxtheme.dll.GetThemeTextExtent
uxtheme.dll.GetThemeTextMetrics
uxtheme.dll.GetThemeBackgroundRegion
uxtheme.dll.HitTestThemeBackground
uxtheme.dll.DrawThemeEdge
uxtheme.dll.DrawThemeIcon
uxtheme.dll.IsThemePartDefined
uxtheme.dll.IsThemeBackgroundPartiallyTransparent
uxtheme.dll.GetThemeColor
uxtheme.dll.GetThemeMetric
uxtheme.dll.GetThemeString
uxtheme.dll.GetThemeBool
uxtheme.dll.GetThemeInt
uxtheme.dll.GetThemeEnumValue
uxtheme.dll.GetThemePosition
uxtheme.dll.GetThemeFont
uxtheme.dll.GetThemeRect
uxtheme.dll.GetThemeMargins
uxtheme.dll.GetThemeIntList
uxtheme.dll.GetThemePropertyOrigin
uxtheme.dll.SetWindowTheme
uxtheme.dll.GetThemeFilename
uxtheme.dll.GetThemeSysColor
uxtheme.dll.GetThemeSysColorBrush
uxtheme.dll.GetThemeSysBool
uxtheme.dll.GetThemeSysSize
uxtheme.dll.GetThemeSysFont
uxtheme.dll.GetThemeSysString
uxtheme.dll.GetThemeSysInt
uxtheme.dll.IsThemeActive
uxtheme.dll.IsAppThemed
uxtheme.dll.GetWindowTheme
uxtheme.dll.EnableThemeDialogTexture
uxtheme.dll.IsThemeDialogTextureEnabled
uxtheme.dll.GetThemeAppProperties
uxtheme.dll.SetThemeAppProperties
uxtheme.dll.GetCurrentThemeName
uxtheme.dll.GetThemeDocumentationProperty
uxtheme.dll.DrawThemeParentBackground
uxtheme.dll.EnableTheming
gdi32.dll.GetLayout
gdi32.dll.GdiRealizationInfo
gdi32.dll.FontIsLinked
advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
gdi32.dll.GetTextFaceAliasW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
gdi32.dll.GetFontAssocStatus
advapi32.dll.RegQueryValueExA
advapi32.dll.RegEnumKeyExW
wininet.dll.InternetQueryOptionA
api-ms-win-downlevel-advapi32-l1-1-0.dll.GetTokenInformation
secur32.dll.GetUserNameExA
api-ms-win-downlevel-advapi32-l1-1-0.dll.GetSidSubAuthorityCount
api-ms-win-downlevel-advapi32-l1-1-0.dll.GetSidSubAuthority
api-ms-win-downlevel-advapi32-l1-1-0.dll.RegCreateKeyExA
api-ms-win-downlevel-advapi32-l1-1-0.dll.RegQueryValueExA
api-ms-win-downlevel-advapi32-l1-1-0.dll.RegOpenKeyExW
api-ms-win-downlevel-advapi32-l1-1-0.dll.RegGetValueW
api-ms-win-downlevel-advapi32-l1-1-0.dll.RegCloseKey
shell32.dll.SHGetKnownFolderPath
api-ms-win-downlevel-advapi32-l1-1-0.dll.CopySid
api-ms-win-downlevel-advapi32-l2-1-0.dll.ConvertSidToStringSidW
api-ms-win-downlevel-advapi32-l2-1-0.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-downlevel-ole32-l1-1-0.dll.CoTaskMemFree
api-ms-win-downlevel-advapi32-l1-1-0.dll.EventRegister
api-ms-win-downlevel-advapi32-l1-1-0.dll.RegGetValueA
iertutil.dll.#701
iertutil.dll.#703
iertutil.dll.#702
api-ms-win-downlevel-advapi32-l1-1-0.dll.RegOpenKeyExA
api-ms-win-downlevel-ole32-l1-1-0.dll.CoTaskMemAlloc
ws2_32.dll.#115
ws2_32.dll.#111
iertutil.dll.#791
api-ms-win-downlevel-advapi32-l1-1-0.dll.RegQueryValueExW
ws2_32.dll.#23
ws2_32.dll.#21
ws2_32.dll.WSAIoctl
ws2_32.dll.#3
ws2_32.dll.#116
iphlpapi.dll.NotifyIpInterfaceChange
kernel32.dll.DeleteCriticalSection
kernel32.dll.LeaveCriticalSection
kernel32.dll.EnterCriticalSection
kernel32.dll.InitializeCriticalSection
kernel32.dll.VirtualFree
kernel32.dll.VirtualAlloc
kernel32.dll.LocalFree
kernel32.dll.LocalAlloc
kernel32.dll.GetVersion
kernel32.dll.GetCurrentThreadId
kernel32.dll.WideCharToMultiByte
kernel32.dll.lstrlenA
kernel32.dll.lstrcpynA
kernel32.dll.LoadLibraryExA
kernel32.dll.GetThreadLocale
kernel32.dll.GetStartupInfoA
kernel32.dll.GetProcAddress
kernel32.dll.GetModuleHandleA
kernel32.dll.GetModuleFileNameA
kernel32.dll.GetLocaleInfoA
kernel32.dll.GetLastError
kernel32.dll.GetCommandLineA
kernel32.dll.FreeLibrary
kernel32.dll.FindFirstFileA
kernel32.dll.FindClose
kernel32.dll.ExitProcess
kernel32.dll.WriteFile
kernel32.dll.UnhandledExceptionFilter
kernel32.dll.SetFilePointer
kernel32.dll.SetEndOfFile
kernel32.dll.RtlUnwind
kernel32.dll.ReadFile
kernel32.dll.RaiseException
kernel32.dll.GetStdHandle
kernel32.dll.GetFileSize
kernel32.dll.GetFileType
kernel32.dll.CreateFileA
kernel32.dll.CloseHandle
user32.dll.GetKeyboardType
user32.dll.LoadStringA
user32.dll.MessageBoxA
user32.dll.CharNextA
advapi32.dll.RegOpenKeyExA
oleaut32.dll.SysFreeString
kernel32.dll.TlsSetValue
kernel32.dll.TlsGetValue
kernel32.dll.TlsFree
kernel32.dll.TlsAlloc
kernel32.dll.VirtualQuery
kernel32.dll.VirtualProtect
kernel32.dll.LoadLibraryA
kernel32.dll.GetVersionExA
kernel32.dll.GetStringTypeExA
kernel32.dll.GetDiskFreeSpaceA
kernel32.dll.GetCPInfo
kernel32.dll.GetACP
kernel32.dll.FileTimeToLocalFileTime
kernel32.dll.FileTimeToDosDateTime
kernel32.dll.EnumCalendarInfoA
user32.dll.TranslateMessage
user32.dll.GetMessageA
user32.dll.DispatchMessageA
user32.dll.CharToOemA
wininet.dll.InternetCheckConnectionA
wininet.dll.InternetReadFile
wininet.dll.InternetOpenUrlA
wininet.dll.InternetOpenA
wininet.dll.InternetCloseHandle
winmm.dll.timeSetEvent
iphlpapi.dll.NotifyUnicastIpAddressChange
iphlpapi.dll.GetBestInterfaceEx
iphlpapi.dll.GetIfEntry2
ws2_32.dll.GetAddrInfoExW
mswsock.dll.NSPStartup
dnsapi.dll.DnsNameCompare_W
dnsapi.dll.DnsApiAlloc
dnsapi.dll.DnsQueryExW
iphlpapi.dll.GetCurrentThreadCompartmentId
rpcrt4.dll.NdrClientCall2
rpcrt4.dll.RpcStringBindingComposeW
rpcrt4.dll.RpcBindingFromStringBindingW
rpcrt4.dll.RpcStringFreeW
rpcrt4.dll.RpcBindingFree
rasadhlp.dll.WSAttemptAutodialAddr
rasadhlp.dll.WSAttemptAutodialName
rasadhlp.dll.WSNoteSuccessfulHostentLookup
dnsapi.dll.DnsApiFree
dnsapi.dll.DnsFree
fwpuclnt.dll.NamespaceCallout
ws2_32.dll.#9
ws2_32.dll.#15
ws2_32.dll.WSASocketA
ws2_32.dll.#7
ws2_32.dll.#2
ws2_32.dll.#6
ws2_32.dll.#5
ws2_32.dll.#22
api-ms-win-downlevel-ole32-l1-1-0.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
api-ms-win-downlevel-advapi32-l1-1-0.dll.EventWrite
api-ms-win-downlevel-ole32-l1-1-0.dll.CoCreateInstance
iphlpapi.dll.GetAdaptersAddresses
ws2_32.dll.GetAddrInfoW
oleaut32.dll.#8
oleaut32.dll.#9
oleaut32.dll.DllGetClassObject
oleaut32.dll.DllCanUnloadNow
advapi32.dll.RegOpenKeyW
iphlpapi.dll.ConvertInterfaceGuidToLuid
iphlpapi.dll.GetIpForwardTable2
iphlpapi.dll.GetIpNetEntry2
iphlpapi.dll.FreeMibTable
api-ms-win-downlevel-ole32-l1-1-0.dll.StringFromIID
api-ms-win-downlevel-ole32-l1-1-0.dll.CoUninitialize
oleaut32.dll.#500
winhttp.dll.WinHttpOpen
winhttp.dll.WinHttpSetTimeouts
winhttp.dll.WinHttpSetOption
winhttp.dll.WinHttpCrackUrl
shlwapi.dll.StrCmpNW
winhttp.dll.WinHttpConnect
winhttp.dll.WinHttpOpenRequest
winhttp.dll.WinHttpGetDefaultProxyConfiguration
winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser
ole32.dll.CoInitializeEx
advapi32.dll.RegDeleteTreeA
advapi32.dll.RegDeleteTreeW
ole32.dll.CoTaskMemAlloc
ole32.dll.StringFromIID
nsi.dll.NsiAllocateAndGetTable
cfgmgr32.dll.CM_Open_Class_Key_ExW
ole32.dll.CoTaskMemFree
nsi.dll.NsiFreeTable
ole32.dll.CoUninitialize
winhttp.dll.WinHttpGetProxyForUrl
winhttp.dll.WinHttpSendRequest
ws2_32.dll.WSASocketW
ws2_32.dll.FreeAddrInfoW
ws2_32.dll.WSARecv
ws2_32.dll.WSASend
winhttp.dll.WinHttpReceiveResponse
winhttp.dll.WinHttpQueryHeaders
shlwapi.dll.StrStrIW
winhttp.dll.WinHttpQueryDataAvailable
winhttp.dll.WinHttpReadData
winhttp.dll.WinHttpCloseHandle
api-ms-win-downlevel-ole32-l1-1-0.dll.CoSetProxyBlanket
ole32.dll.ObjectStublessClient10
oleaut32.dll.#2
api-ms-win-downlevel-advapi32-l1-1-0.dll.RegEnumKeyExW
oleaut32.dll.#6

BinGraph Download graph

PE Information

Image Base Entry Point Reported Checksum Actual Checksum Minimum OS Version Compile Time Import Hash Icon Icon Exact Hash Icon Similarity Hash
0x00400000 0x0045c72c 0x000b5c9c 0x000b45e3 4.0 1992-06-19 22:22:17 3dbf6c2cd2886e109ef90dcce86638b7 ff917714599e54cb3d882a6d17c6b631 cf1f206afdd15ef1a7cd78e27d1f7e33

Sections

Name RAW Address Virtual Address Virtual Size Size of Raw Data Characteristics Entropy
.text 0x00000a00 0x00001000 0x0005a748 0x0005a800 IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 6.56
.itext 0x0005b200 0x0005c000 0x0000077c 0x00000800 IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 6.01
.data 0x0005ba00 0x0005d000 0x00017c34 0x00017e00 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 4.17
.bss 0x00073800 0x00075000 0x00003608 0x00000000 IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 0.00
.idata 0x00073800 0x00079000 0x0000281e 0x00002a00 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 5.06
.tls 0x00076200 0x0007c000 0x00000034 0x00000000 IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 0.00
.rdata 0x00076200 0x0007d000 0x00000018 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 0.21
.reloc 0x00076400 0x0007e000 0x000061b4 0x00006200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 6.66
.rsrc 0x0007c600 0x00085000 0x0002d926 0x0002da00 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 7.14

Resources

Name Offset Size Language Sub-language Entropy File type
RT_BITMAP 0x00086b64 0x000000e8 LANG_ENGLISH SUBLANG_ENGLISH_US 2.85 None
RT_BITMAP 0x00086b64 0x000000e8 LANG_ENGLISH SUBLANG_ENGLISH_US 2.85 None
RT_BITMAP 0x00086b64 0x000000e8 LANG_ENGLISH SUBLANG_ENGLISH_US 2.85 None
RT_BITMAP 0x00086b64 0x000000e8 LANG_ENGLISH SUBLANG_ENGLISH_US 2.85 None
RT_BITMAP 0x00086b64 0x000000e8 LANG_ENGLISH SUBLANG_ENGLISH_US 2.85 None
RT_BITMAP 0x00086b64 0x000000e8 LANG_ENGLISH SUBLANG_ENGLISH_US 2.85 None
RT_BITMAP 0x00086b64 0x000000e8 LANG_ENGLISH SUBLANG_ENGLISH_US 2.85 None
RT_BITMAP 0x00086b64 0x000000e8 LANG_ENGLISH SUBLANG_ENGLISH_US 2.85 None
RT_BITMAP 0x00086b64 0x000000e8 LANG_ENGLISH SUBLANG_ENGLISH_US 2.85 None
RT_BITMAP 0x00086b64 0x000000e8 LANG_ENGLISH SUBLANG_ENGLISH_US 2.85 None
RT_BITMAP 0x00086b64 0x000000e8 LANG_ENGLISH SUBLANG_ENGLISH_US 2.85 None
RT_ICON 0x00088ae4 0x000025a8 LANG_ENGLISH SUBLANG_ENGLISH_US 5.35 None
RT_ICON 0x00088ae4 0x000025a8 LANG_ENGLISH SUBLANG_ENGLISH_US 5.35 None
RT_ICON 0x00088ae4 0x000025a8 LANG_ENGLISH SUBLANG_ENGLISH_US 5.35 None
RT_ICON 0x00088ae4 0x000025a8 LANG_ENGLISH SUBLANG_ENGLISH_US 5.35 None
RT_DIALOG 0x0008b0e0 0x00000052 LANG_NEUTRAL SUBLANG_NEUTRAL 2.62 None
RT_DIALOG 0x0008b0e0 0x00000052 LANG_NEUTRAL SUBLANG_NEUTRAL 2.62 None
RT_STRING 0x0008cf64 0x00000294 LANG_NEUTRAL SUBLANG_NEUTRAL 3.29 None
RT_STRING 0x0008cf64 0x00000294 LANG_NEUTRAL SUBLANG_NEUTRAL 3.29 None
RT_STRING 0x0008cf64 0x00000294 LANG_NEUTRAL SUBLANG_NEUTRAL 3.29 None
RT_STRING 0x0008cf64 0x00000294 LANG_NEUTRAL SUBLANG_NEUTRAL 3.29 None
RT_STRING 0x0008cf64 0x00000294 LANG_NEUTRAL SUBLANG_NEUTRAL 3.29 None
RT_STRING 0x0008cf64 0x00000294 LANG_NEUTRAL SUBLANG_NEUTRAL 3.29 None
RT_STRING 0x0008cf64 0x00000294 LANG_NEUTRAL SUBLANG_NEUTRAL 3.29 None
RT_STRING 0x0008cf64 0x00000294 LANG_NEUTRAL SUBLANG_NEUTRAL 3.29 None
RT_STRING 0x0008cf64 0x00000294 LANG_NEUTRAL SUBLANG_NEUTRAL 3.29 None
RT_STRING 0x0008cf64 0x00000294 LANG_NEUTRAL SUBLANG_NEUTRAL 3.29 None
RT_STRING 0x0008cf64 0x00000294 LANG_NEUTRAL SUBLANG_NEUTRAL 3.29 None
RT_STRING 0x0008cf64 0x00000294 LANG_NEUTRAL SUBLANG_NEUTRAL 3.29 None
RT_STRING 0x0008cf64 0x00000294 LANG_NEUTRAL SUBLANG_NEUTRAL 3.29 None
RT_STRING 0x0008cf64 0x00000294 LANG_NEUTRAL SUBLANG_NEUTRAL 3.29 None
RT_RCDATA 0x0009e3e8 0x000144fd LANG_NEUTRAL SUBLANG_NEUTRAL 6.52 None
RT_RCDATA 0x0009e3e8 0x000144fd LANG_NEUTRAL SUBLANG_NEUTRAL 6.52 None
RT_RCDATA 0x0009e3e8 0x000144fd LANG_NEUTRAL SUBLANG_NEUTRAL 6.52 None
RT_RCDATA 0x0009e3e8 0x000144fd LANG_NEUTRAL SUBLANG_NEUTRAL 6.52 None
RT_RCDATA 0x0009e3e8 0x000144fd LANG_NEUTRAL SUBLANG_NEUTRAL 6.52 None
RT_RCDATA 0x0009e3e8 0x000144fd LANG_NEUTRAL SUBLANG_NEUTRAL 6.52 None
RT_GROUP_ICON 0x000b28e8 0x0000003e LANG_ENGLISH SUBLANG_ENGLISH_US 2.62 None

Imports

0x47978c SysFreeString
0x479790 SysReAllocStringLen
0x479794 SysAllocStringLen
0x47979c RegQueryValueExA
0x4797a0 RegOpenKeyExA
0x4797a4 RegCloseKey
0x4797ac GetKeyboardType
0x4797b0 DestroyWindow
0x4797b4 LoadStringA
0x4797b8 MessageBoxA
0x4797bc CharNextA
0x4797c4 GetACP
0x4797c8 Sleep
0x4797cc VirtualFree
0x4797d0 VirtualAlloc
0x4797d4 GetTickCount
0x4797dc GetCurrentThreadId
0x4797e8 VirtualQuery
0x4797ec WideCharToMultiByte
0x4797f0 MultiByteToWideChar
0x4797f4 lstrlenA
0x4797f8 lstrcpynA
0x4797fc LoadLibraryExA
0x479800 GetThreadLocale
0x479804 GetStartupInfoA
0x479808 GetProcAddress
0x47980c GetModuleHandleA
0x479810 GetModuleFileNameA
0x479814 GetLocaleInfoA
0x479818 GetLastError
0x47981c GetCommandLineA
0x479820 FreeLibrary
0x479824 FindFirstFileA
0x479828 FindClose
0x47982c ExitProcess
0x479830 CompareStringA
0x479834 WriteFile
0x47983c SetFilePointer
0x479840 SetEndOfFile
0x479844 RtlUnwind
0x479848 ReadFile
0x47984c RaiseException
0x479850 GetStdHandle
0x479854 GetFileSize
0x479858 GetFileType
0x47985c CreateFileA
0x479860 CloseHandle
0x479868 TlsSetValue
0x47986c TlsGetValue
0x479870 LocalAlloc
0x479874 GetModuleHandleA
0x47987c CreateWindowExA
0x479880 WindowFromPoint
0x479884 WaitMessage
0x479888 UpdateWindow
0x47988c UnregisterClassA
0x479890 UnhookWindowsHookEx
0x479894 TranslateMessage
0x47989c TrackPopupMenu
0x4798a4 ShowWindow
0x4798a8 ShowScrollBar
0x4798ac ShowOwnedPopups
0x4798b0 SetWindowsHookExA
0x4798b4 SetWindowPos
0x4798b8 SetWindowPlacement
0x4798bc SetWindowLongW
0x4798c0 SetWindowLongA
0x4798c4 SetTimer
0x4798c8 SetScrollRange
0x4798cc SetScrollPos
0x4798d0 SetScrollInfo
0x4798d4 SetRect
0x4798d8 SetPropA
0x4798dc SetParent
0x4798e0 SetMenuItemInfoA
0x4798e4 SetMenu
0x4798e8 SetForegroundWindow
0x4798ec SetFocus
0x4798f0 SetCursor
0x4798f4 SetClassLongA
0x4798f8 SetCapture
0x4798fc SetActiveWindow
0x479900 SendMessageW
0x479904 SendMessageA
0x479908 ScrollWindow
0x47990c ScreenToClient
0x479910 RemovePropA
0x479914 RemoveMenu
0x479918 ReleaseDC
0x47991c ReleaseCapture
0x479928 RegisterClassA
0x47992c RedrawWindow
0x479930 PtInRect
0x479934 PostQuitMessage
0x479938 PostMessageA
0x47993c PeekMessageW
0x479940 PeekMessageA
0x479944 OffsetRect
0x479948 OemToCharA
0x47994c MessageBoxA
0x479950 MapWindowPoints
0x479954 MapVirtualKeyA
0x479958 LoadStringA
0x47995c LoadKeyboardLayoutA
0x479960 LoadIconA
0x479964 LoadCursorA
0x479968 LoadBitmapA
0x47996c KillTimer
0x479970 IsZoomed
0x479974 IsWindowVisible
0x479978 IsWindowUnicode
0x47997c IsWindowEnabled
0x479980 IsWindow
0x479984 IsRectEmpty
0x479988 IsIconic
0x47998c IsDialogMessageW
0x479990 IsDialogMessageA
0x479994 IsChild
0x479998 InvalidateRect
0x47999c IntersectRect
0x4799a0 InsertMenuItemA
0x4799a4 InsertMenuA
0x4799a8 InflateRect
0x4799b0 GetWindowTextA
0x4799b4 GetWindowRect
0x4799b8 GetWindowPlacement
0x4799bc GetWindowLongW
0x4799c0 GetWindowLongA
0x4799c4 GetWindowDC
0x4799c8 GetTopWindow
0x4799cc GetSystemMetrics
0x4799d0 GetSystemMenu
0x4799d4 GetSysColorBrush
0x4799d8 GetSysColor
0x4799dc GetSubMenu
0x4799e0 GetScrollRange
0x4799e4 GetScrollPos
0x4799e8 GetScrollInfo
0x4799ec GetPropA
0x4799f0 GetParent
0x4799f4 GetWindow
0x4799f8 GetMessagePos
0x4799fc GetMenuStringA
0x479a00 GetMenuState
0x479a04 GetMenuItemInfoA
0x479a08 GetMenuItemID
0x479a0c GetMenuItemCount
0x479a10 GetMenu
0x479a14 GetLastActivePopup
0x479a18 GetKeyboardState
0x479a24 GetKeyboardLayout
0x479a28 GetKeyState
0x479a2c GetKeyNameTextA
0x479a30 GetIconInfo
0x479a34 GetForegroundWindow
0x479a38 GetFocus
0x479a3c GetDlgItem
0x479a40 GetDesktopWindow
0x479a44 GetDCEx
0x479a48 GetDC
0x479a4c GetCursorPos
0x479a50 GetCursor
0x479a54 GetClipboardData
0x479a58 GetClientRect
0x479a5c GetClassLongA
0x479a60 GetClassInfoA
0x479a64 GetCapture
0x479a68 GetActiveWindow
0x479a6c FrameRect
0x479a70 FindWindowA
0x479a74 FillRect
0x479a78 EqualRect
0x479a7c EnumWindows
0x479a80 EnumThreadWindows
0x479a84 EnumChildWindows
0x479a88 EndPaint
0x479a8c EnableWindow
0x479a90 EnableScrollBar
0x479a94 EnableMenuItem
0x479a98 DrawTextA
0x479a9c DrawMenuBar
0x479aa0 DrawIconEx
0x479aa4 DrawIcon
0x479aa8 DrawFrameControl
0x479aac DrawEdge
0x479ab0 DispatchMessageW
0x479ab4 DispatchMessageA
0x479ab8 DestroyWindow
0x479abc DestroyMenu
0x479ac0 DestroyIcon
0x479ac4 DestroyCursor
0x479ac8 DeleteMenu
0x479acc DefWindowProcA
0x479ad0 DefMDIChildProcA
0x479ad4 DefFrameProcA
0x479ad8 CreatePopupMenu
0x479adc CreateMenu
0x479ae0 CreateIcon
0x479ae4 ClientToScreen
0x479ae8 CheckMenuItem
0x479aec CallWindowProcA
0x479af0 CallNextHookEx
0x479af4 BeginPaint
0x479af8 CharNextA
0x479afc CharLowerBuffA
0x479b00 CharLowerA
0x479b04 CharToOemA
0x479b08 AdjustWindowRectEx
0x479b14 UnrealizeObject
0x479b18 StretchBlt
0x479b1c SetWindowOrgEx
0x479b20 SetWinMetaFileBits
0x479b24 SetViewportOrgEx
0x479b28 SetTextColor
0x479b2c SetStretchBltMode
0x479b30 SetROP2
0x479b34 SetPixel
0x479b38 SetEnhMetaFileBits
0x479b3c SetDIBColorTable
0x479b40 SetBrushOrgEx
0x479b44 SetBkMode
0x479b48 SetBkColor
0x479b4c SelectPalette
0x479b50 SelectObject
0x479b54 SaveDC
0x479b58 RestoreDC
0x479b5c Rectangle
0x479b60 RectVisible
0x479b64 RealizePalette
0x479b68 Polyline
0x479b6c PlayEnhMetaFile
0x479b70 PatBlt
0x479b74 MoveToEx
0x479b78 MaskBlt
0x479b7c LineTo
0x479b80 IntersectClipRect
0x479b84 GetWindowOrgEx
0x479b88 GetWinMetaFileBits
0x479b8c GetTextMetricsA
0x479b98 GetStockObject
0x479b9c GetRgnBox
0x479ba0 GetPixel
0x479ba4 GetPaletteEntries
0x479ba8 GetObjectA
0x479bb4 GetEnhMetaFileBits
0x479bb8 GetDeviceCaps
0x479bbc GetDIBits
0x479bc0 GetDIBColorTable
0x479bc4 GetDCOrgEx
0x479bcc GetClipBox
0x479bd0 GetBrushOrgEx
0x479bd4 GetBitmapBits
0x479bd8 ExcludeClipRect
0x479bdc DeleteObject
0x479be0 DeleteEnhMetaFile
0x479be4 DeleteDC
0x479be8 CreateSolidBrush
0x479bec CreatePenIndirect
0x479bf0 CreatePalette
0x479bf8 CreateFontIndirectA
0x479bfc CreateDIBitmap
0x479c00 CreateDIBSection
0x479c04 CreateCompatibleDC
0x479c0c CreateBrushIndirect
0x479c10 CreateBitmap
0x479c14 CopyEnhMetaFileA
0x479c18 BitBlt
0x479c20 VerQueryValueA
0x479c28 GetFileVersionInfoA
0x479c30 lstrcpyA
0x479c34 WriteFile
0x479c38 WaitForSingleObject
0x479c3c VirtualQuery
0x479c40 VirtualProtect
0x479c44 VirtualAlloc
0x479c48 SizeofResource
0x479c4c SetThreadLocale
0x479c50 SetFilePointer
0x479c54 SetEvent
0x479c58 SetErrorMode
0x479c5c SetEndOfFile
0x479c60 ResetEvent
0x479c64 ReadFile
0x479c68 MulDiv
0x479c6c LockResource
0x479c70 LoadResource
0x479c74 LoadLibraryA
0x479c80 GlobalFindAtomA
0x479c84 GlobalDeleteAtom
0x479c88 GlobalAddAtomA
0x479c8c GetVersionExA
0x479c90 GetVersion
0x479c94 GetTickCount
0x479c98 GetThreadLocale
0x479c9c GetStdHandle
0x479ca0 GetProcAddress
0x479ca4 GetModuleHandleA
0x479ca8 GetModuleFileNameA
0x479cac GetLocaleInfoA
0x479cb0 GetLocalTime
0x479cb4 GetLastError
0x479cb8 GetFullPathNameA
0x479cbc GetDiskFreeSpaceA
0x479cc0 GetDateFormatA
0x479cc4 GetCurrentThreadId
0x479cc8 GetCurrentProcessId
0x479ccc GetCPInfo
0x479cd0 FreeResource
0x479cd4 InterlockedExchange
0x479cd8 FreeLibrary
0x479cdc FormatMessageA
0x479ce0 FindResourceA
0x479ce4 EnumCalendarInfoA
0x479cf0 CreateThread
0x479cf4 CreateFileA
0x479cf8 CreateEventA
0x479cfc CompareStringA
0x479d00 CloseHandle
0x479d08 RegQueryValueExA
0x479d0c RegOpenKeyExA
0x479d10 RegFlushKey
0x479d14 RegCloseKey
0x479d1c Sleep
0x479d24 SafeArrayPtrOfIndex
0x479d28 SafeArrayGetUBound
0x479d2c SafeArrayGetLBound
0x479d30 SafeArrayCreate
0x479d34 VariantChangeType
0x479d38 VariantCopy
0x479d3c VariantClear
0x479d40 VariantInit
0x479d48 _TrackMouseEvent
0x479d54 ImageList_Write
0x479d58 ImageList_Read
0x479d60 ImageList_DragMove
0x479d64 ImageList_DragLeave
0x479d68 ImageList_DragEnter
0x479d6c ImageList_EndDrag
0x479d70 ImageList_BeginDrag
0x479d74 ImageList_Remove
0x479d78 ImageList_DrawEx
0x479d7c ImageList_Draw
0x479d88 ImageList_Add
0x479d90 ImageList_Destroy
0x479d94 ImageList_Create
0x479d9c GetSaveFileNameA
0x479da0 GetOpenFileNameA
0x479da8 InetIsOffline
0x479db0 QueryServiceStatus
0x479db4 OpenServiceA
0x479db8 OpenSCManagerA
0x479dbc CloseServiceHandle

This program must be run under Win32
.text
`.itext
`.data
.idata
.rdata
@.reloc
B.rsrc
Boolean
False
Integer
Cardinal
string
TObject
TObject
System
IInterface
System
TInterfacedObject
FastMM Borland Edition
2004, 2005 Pierre le Riche / Professional Software Development
#5 WG
t'QRj
An unexpected memory leak has occurred.
The unexpected small block leaks are:
bytes:
Unknown
String
The sizes of unexpected leaked medium and large blocks are:
Unexpected Memory Leak
,$YXZ
Ht Ht.
_^[Y]
~KxI[)
BkU'9
SOFTWARE\Borland\Delphi\RTL
FPUMaskValue
_^[YY]
_^[Y]
PPRTj
YZXtp
YZXtm1
VWUUh
ZTUWVSPRTj
t=HtN
_^[Y]
t-Rf;
t f;J
SVWRP
Z_^[X
tVSVWU
0f;\2
t-Rf;
t f;J
kernel32.dll
GetLongPathNameA
Software\Borland\Locales
Software\Borland\Delphi\Locales
_^[YY]
FFF;M
^[YY]
^[YY]
odSelected
odGrayed
odDisabled
odChecked
odFocused
odDefault
odHotLight
odInactive
odNoAccel
odNoFocusRect
odReserved1
odReserved2
odComboBoxEdit
Windows
TOwnerDrawState
_^[Y]
_^[Y]
_^[Y]
Magellan MSWHEEL
MouseZ
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
TFileName
Exception
EAbort
EHeapException
EOutOfMemory
EInOutErrorT{@
EExternal
EExternalException
EIntError
EDivByZero
ERangeError
EIntOverflow
EMathError
EInvalidOp
EOverflow
EUnderflow
EInvalidPointer
EInvalidCast
EConvertError
EAccessViolation
EPrivilege
EStackOverflow
EControlC
EVariantError
EAssertionFailed
EAbstractError
EIntfCastError
EOSError
ESafecallException
SysUtils
SysUtils
TThreadLocalCounter
$TMultiReadExclusiveWriteSynchronizer
-{{{{1
-ffff!
-[[[[1
-ffff!
SWSVj
sDFJu
False
$Z_^[
$Z_^[
^[YY]
<*t"<0r=<9w9i
INFNAN
QS<$t
_^[YY]
t%HtIHtm
AM/PM
SVWUQ
$Z]_^[
_^[Y]
QQQQQQSVW3
QQQQQSVW
D$PPj
D$LPj
_^[Y]
_^[YY]
TErrorRec
TExceptRec
t<HtH
$YZ_^[
$YZ^[
WUWSj
YZ]_^[
_^[Y]
m/d/yy
mmmm d, yyyy
AMPM
AMPM
:mm:ss
TUnitHashArray
SysUtils
TModuleInfo
kernel32.dll
GetDiskFreeSpaceExA
SVWUQ
Z]_^[
SVWUQ
(Z]_^[
YZ]_^[
;C$t4
_^[Y]
oleaut32.dll
VariantChangeTypeEx
VarNeg
VarNot
VarAdd
VarSub
VarMul
VarDiv
VarIdiv
VarMod
VarAnd
VarOr
VarXor
VarCmp
VarI4FromStr
VarR4FromStr
VarR8FromStr
VarDateFromStr
VarCyFromStr
VarBoolFromStr
VarBstrFromCy
VarBstrFromDate
VarBstrFromBool
TCustomVariantType
TCustomVariantType
Variants
EVariantInvalidOpError
EVariantTypeCastError
EVariantOverflowError
EVariantInvalidArgError8
EVariantBadVarTypeError
EVariantBadIndexError
EVariantArrayLockedError
EVariantArrayCreateError
EVariantNotImplError
EVariantOutOfMemoryError
EVariantUnexpectedError
EVariantDispatchError
t?Htb
QQQQSV
Empty
Smallint
Integer
Single
Double
Currency
OleStr
Dispatch
Error
Boolean
Variant
Unknown
Decimal
ShortInt
LongWord
Int64
String
Array
ByRef
Variants
_^[YY]
_^[Y]
SVWUQ
Z]_^[
_^[Y]
False
_^[Y]
_^[Y]
_^[YY]
$YZ^[
TAlignment
taLeftJustify
taRightJustify
taCenter
Classes
TBiDiMode
bdLeftToRight
bdRightToLeft
bdRightToLeftNoAlign
bdRightToLeftReadingOnly
Classes
TVerticalAlignment
taAlignTop
taAlignBottom
taVerticalCenter
Classes
ssShift
ssAlt
ssCtrl
ssLeft
ssRight
ssMiddle
ssDouble
Classes
TShiftState
THelpContext
THelpType
htKeyword
htContext
Classes(
TShortCut
TNotifyEvent
Sender
TObject
EStreamError
EFileStreamError
EFCreateError
EFOpenError$!A
EFilerError|!A
EReadError
EWriteError,"A
EClassNotFound
EResNotFound
EListError
EBitsError
EStringListError
EComponentErrorP$A
EOutOfResources
EInvalidOperation
TList
TThreadList
TBits
TPersistent
TPersistent
Classes
TInterfacedPersistentH'A
TInterfacedPersistent
Classes
IStringsAdapter
Classes
TStrings
TStrings
Classes
TStringItem
TStringList
TStringList0)A
Classes
TStream
THandleStream
TFileStream
TCustomMemoryStream4,A
TMemoryStream
TResourceStream
TStreamAdapter
TClassFinder
TFiler
TReader
EThread$0A
TComponentName80A
IDesignerNotify
Classes
TComponent
TComponent`1A
Classes
Name<
TBasicActionLink
TBasicAction
Classes
TIdentMapEntry
TRegGroup
TRegGroups
YZ]_^[
_^[Y]
_^[Y]
SVWUQ
u)FMu
Z]_^[
SVWUQ
$Z]_^[
SVWUQ
Z]_^[
SVWUQ
Z]_^[
SVWUQ
Z]_^[
Uh';A
SVWUQ
$Z]_^[
_^[YY]
Uhd?A
Uh3AA
TIntConst
_^[Y]
_^[Y]
_^[YY]
_^[Y]
Uh;KA
Uh3LA
SVWUQ
Z]_^[
W<CNu
Strings
UhETA
_^[Y]
Uh)VA
UhaWA
S$_^[Y]
Uh|YA
Uh%ZA
^[YY]
_^[YY]
Sd]_^[
Uhq\A
Uh_^A
Uh&_A
SVWUQ
$Z]_^[
S4_^[
^[YY]
Uh`jA
Uh(mA
UhvpA
_^[Y]
TPropFixup
TPropIntfFixup
UhatA
Owner
Uh0vA
UhkwA
_^[YY]
_^[Y]
C0_^[
Classes
_^[Y]
False
_^[YY]
QQQQ3
%s_%d
_^[YY]
^[YY]
QQQQQQQS
YZ_^[
SVWUQ
Z]_^[
_^[Y]
S _^[
SVWUQ
Z]_^[
YZ_^[
SVWUQ
Z]_^[
G0_^[
;CDt:
R0_^[]
_^[YY]
TPUtilWindow
TObjectList
TOrderedList
TStack
IHelpSelector
HelpIntfs
IHelpSystem
HelpIntfs
ICustomHelpViewer
HelpIntfs
IExtendedHelpViewer
HelpIntfs
ISpecialWinHelpViewer
HelpIntfs
EHelpSystemException
THelpManager
R(FKu
^[YY]
W<FKu
_^[Y]
_^[Y]
GetMonitorInfoA
GetSystemMetrics
MonitorFromRect
MonitorFromWindow
MonitorFromPoint
>(r[j
GetMonitorInfo
DISPLAY
>(r[j
GetMonitorInfoA
DISPLAY
>(r[j
GetMonitorInfoW
DISPLAY
EnumDisplayMonitors
USER32.DLL
ERegistryException
TRegistryS
SVWUQ
Z]_^[
SVWUQ
Z]_^[
TColor
EInvalidGraphic
EInvalidGraphicOperation
TFontPitch
fpDefault
fpVariable
fpFixed
Graphics
TFontName
TFontCharset
TFontStyle
fsBold
fsItalic
fsUnderline
fsStrikeOut
Graphics
TFontStyles
TPenStyle
psSolid
psDash
psDot
psDashDot
psDashDotDot
psClear
psInsideFrame
psUserStyle
psAlternate
Graphics
TPenMode
pmBlack
pmWhite
pmNop
pmNot
pmCopy
pmNotCopy
pmMergePenNot
pmMaskPenNot
pmMergeNotPen
pmMaskNotPen
pmMerge
pmNotMerge
pmMask
pmNotMask
pmXor
pmNotXor
Graphics
TBrushStyle
bsSolid
bsClear
bsHorizontal
bsVertical
bsFDiagonal
bsBDiagonal
bsCross
bsDiagCross
Graphics
TGraphicsObject
TGraphicsObject
Graphics
IChangeNotifier
Graphics
TFont
TFont
Graphics
Charset
Color<
Name<
Orientation
Pitch<
Style
TPenL
Graphics
ColorT
Style<
Width
TBrush
TBrushL
Graphics
Color
Style
TCanvas4
TCanvas
Graphics
Brush<
CopyMode
Font`
TProgressStage
psStarting
psRunning
psEnding
Graphics
TProgressEvent
Sender
TObject
Stage
TProgressStage
PercentDone
RedrawNow
Boolean
TRect
string
TGraphic
TGraphicl
Graphics
TPicture
TPicture
Graphics
TSharedImage
TMetafileImage
TMetafile
TMetafile0
Graphics
TBitmapImage
TBitmap
TBitmapt
Graphics
TIconImage
TIcon
TIcon
Graphics
TResourceManager
TBrushResourceManager
^[YY]
_^[YY]
_^[Y]
_^[Y]
^[YY]
clBlack
clMaroon
clGreen
clOlive
clNavy
clPurple
clTeal
clGray
clSilver
clRed
clLime
clYellow
clBlue
clFuchsia
clAqua
clWhite
clMoneyGreen
clSkyBlue
clCream
clMedGray
clActiveBorder
clActiveCaption
clAppWorkSpace
clBackground
clBtnFace
clBtnHighlight
clBtnShadow
clBtnText
clCaptionText
clDefault
clGradientActiveCaption
clGradientInactiveCaption
clGrayText
clHighlight
clHighlightText
clHotLight
clInactiveBorder
clInactiveCaption
clInactiveCaptionText
clInfoBk
clInfoText
clMenu
clMenuBar
clMenuHighlight
clMenuText
clNone
clScrollBar
cl3DDkShadow
cl3DLight
clWindow
clWindowFrame
clWindowText
ANSI_CHARSET
DEFAULT_CHARSET
SYMBOL_CHARSET
MAC_CHARSET
SHIFTJIS_CHARSET
HANGEUL_CHARSET
JOHAB_CHARSET
GB2312_CHARSET
CHINESEBIG5_CHARSET
GREEK_CHARSET
TURKISH_CHARSET
HEBREW_CHARSET
ARABIC_CHARSET
BALTIC_CHARSET
RUSSIAN_CHARSET
THAI_CHARSET
EASTEUROPE_CHARSET
OEM_CHARSET
Default
_^[Y]
$YZ^[
E$PVSj
YZ_^[
$Z_^[
_^[YY]
C ;C$s
Uh'$B
TFileFormat
TFileFormatsList
QQQQSV
TClipboardFormats
_^[YY]
_^[Y]
3TjdP
kD$TdP
3TjdP
kD$PdP
EMFt
UhL4B
Uhc6B
?TjdR
D$LPkD$XdPV
?TjdR
D$HPkD$TdPV
|$( EMFt
^[YY]
UhO;B
Uh/;B
zTjdR
D$HPkD$TdPV
D$LPkD$XdP
TBitmapCanvas
TBitmapCanvas
Graphics
UhSHB
UhBHB
Uh HB
UhXMB
@pPV3
UhjPB
Uh?SB
_^[YY]
Uhe[B
Uh8[B
<$BMt
T]_^[
Sd_^[
UhT_B
Sd_^[
D$*Ph
T]_^[
UhAfB
Uh`gB
C(_^[Y]
\$4Vj
Tahoma
SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
MS Shell Dlg 2
TPatternManagerSV
_^[YY]
Uh%mB
UhYnB
TSynchroObject
TCriticalSection
UhCuB
uxtheme.dll
OpenThemeData
CloseThemeData
DrawThemeBackground
DrawThemeText
GetThemeBackgroundContentRect
GetThemePartSize
GetThemeTextExtent
GetThemeTextMetrics
GetThemeBackgroundRegion
HitTestThemeBackground
DrawThemeEdge
DrawThemeIcon
IsThemePartDefined
IsThemeBackgroundPartiallyTransparent
GetThemeColor
GetThemeMetric
GetThemeString
GetThemeBool
GetThemeInt
GetThemeEnumValue
GetThemePosition
GetThemeFont
GetThemeRect
GetThemeMargins
GetThemeIntList
GetThemePropertyOrigin
SetWindowTheme
GetThemeFilename
GetThemeSysColor
GetThemeSysColorBrush
GetThemeSysBool
GetThemeSysSize
GetThemeSysFont
GetThemeSysString
GetThemeSysInt
IsThemeActive
IsAppThemed
GetWindowTheme
EnableThemeDialogTexture
IsThemeDialogTextureEnabled
GetThemeAppProperties
SetThemeAppProperties
GetCurrentThemeName
GetThemeDocumentationProperty
DrawThemeParentBackground
EnableTheming
UhdyB
IShellFolder
ShlObj
TTextLayout
tlTop
tlCenter
tlBottom
StdCtrls
TEllipsisPosition
epNone
epPathEllipsis
epEndEllipsis
epWordEllipsis
StdCtrls
TCustomLabel
TCustomLabel
StdCtrls
TLabel
TLabel
StdCtrls)
AlignP
Alignment
Anchors
AutoSize
BiDiMode
Caption
Color
ConstraintsDOC
DragCursorXWC
DragKind
DragMode
EllipsisPosition
Enabled
FocusControl
ParentBiDiMode
ParentColor
ParentFont
ParentShowHint
PopupMenu
ShowAccelChar
ShowHint
Transparent
Layout
Visible
WordWrap<
OnClick
OnContextPopup<
OnDblClickP^C
OnDragDrop
OnDragOver
OnEndDock
OnEndDrag
OnMouseActivate
OnMouseDown$\C
OnMouseMove
OnMouseUp<
OnMouseEnter<
OnMouseLeave
OnStartDock
OnStartDrag
CL+D$
CL+D$
CH+D$
_^[Y]
clWebSnow
clWebFloralWhite
clWebLavenderBlush
clWebOldLace
clWebIvory
clWebCornSilk
clWebBeige
clWebAntiqueWhite
clWebWheat
clWebAliceBlue
clWebGhostWhite
clWebLavender
clWebSeashell
clWebLightYellow
clWebPapayaWhip
clWebNavajoWhite
clWebMoccasin
clWebBurlywood
clWebAzure
clWebMintcream
clWebHoneydew
clWebLinen
clWebLemonChiffon
clWebBlanchedAlmond
clWebBisque
clWebPeachPuff
clWebTan
clWebYellow
clWebDarkOrange
clWebRed
clWebDarkRed
clWebMaroon
clWebIndianRed
clWebSalmon
clWebCoral
clWebGold
clWebTomato
clWebCrimson
clWebBrown
clWebChocolate
clWebSandyBrown
clWebLightSalmon
clWebLightCoral
clWebOrange
clWebOrangeRed
clWebFirebrick
clWebSaddleBrown
clWebSienna
clWebPeru
clWebDarkSalmon
clWebRosyBrown
clWebPaleGoldenrod
clWebLightGoldenrodYellow
clWebOlive
clWebForestGreen
clWebGreenYellow
clWebChartreuse
clWebLightGreen
clWebAquamarine
clWebSeaGreen
clWebGoldenRod
clWebKhaki
clWebOliveDrab
clWebGreen
clWebYellowGreen
clWebLawnGreen
clWebPaleGreen
clWebMediumAquamarine
clWebMediumSeaGreen
clWebDarkGoldenRod
clWebDarkKhaki
clWebDarkOliveGreen
clWebDarkgreen
clWebLimeGreen
clWebLime
clWebSpringGreen
clWebMediumSpringGreen
clWebDarkSeaGreen
clWebLightSeaGreen
clWebPaleTurquoise
clWebLightCyan
clWebLightBlue
clWebLightSkyBlue
clWebCornFlowerBlue
clWebDarkBlue
clWebIndigo
clWebMediumTurquoise
clWebTurquoise
clWebCyan
clWebPowderBlue
clWebSkyBlue
clWebRoyalBlue
clWebMediumBlue
clWebMidnightBlue
clWebDarkTurquoise
clWebCadetBlue
clWebDarkCyan
clWebTeal
clWebDeepskyBlue
clWebDodgerBlue
clWebBlue
clWebNavy
clWebDarkViolet
clWebDarkOrchid
clWebMagenta
clWebDarkMagenta
clWebMediumVioletRed
clWebPaleVioletRed
clWebBlueViolet
clWebMediumOrchid
clWebMediumPurple
clWebPurple
clWebDeepPink
clWebLightPink
clWebViolet
clWebOrchid
clWebPlum
clWebThistle
clWebHotPink
clWebPink
clWebLightSteelBlue
clWebMediumSlateBlue
clWebLightSlateGray
clWebWhite
clWebLightgrey
clWebGray
clWebSteelBlue
clWebSlateBlue
clWebSlateGray
clWebWhiteSmoke
clWebSilver
clWebDimGray
clWebMistyRose
clWebDarkSlateBlue
clWebDarkSlategray
clWebGainsboro
clWebDarkGray
clWebBlack
TImage
TImage$
ExtCtrls"
Align
Anchors
AutoSize
Center
ConstraintsDOC
DragCursorXWC
DragKind
DragMode
Enabled
IncrementalDisplay
ParentShowHint
Picture
PopupMenu
Proportional
ShowHint
Stretch
Transparent
Visible<
OnClick
OnContextPopup<
OnDblClickP^C
OnDragDrop
OnDragOver
OnEndDock
OnEndDrag
OnMouseActivate
OnMouseDown<
OnMouseEnter<
OnMouseLeave$\C
OnMouseMove
OnMouseUp
OnProgress
OnStartDock
OnStartDrag
TTimer
TTimer$
ExtCtrls
Enabled|
Interval<
OnTimer8
TCustomPanel
TCustomPanel8
ExtCtrls
TPanel
TPanel
AlignP
Alignment
Anchors
AutoSize
BevelEdges|iC
BevelInner jC
BevelKind|iC
BevelOuterdjC
BevelWidth
BiDiMode`iC
BorderWidth
BorderStyle
Caption
Color
Constraints
Ctl3D
UseDockManager
DockSiteDOC
DragCursorXWC
DragKind
DragMode
Enabled
FullRepaint
Locked
Padding
ParentBiDiMode
ParentBackground
ParentColor
ParentCtl3D
ParentFont
ParentShowHint
PopupMenu
ShowHint
TabOrder
TabStop
VerticalAlignment
Visible
OnAlignInsertBefore
OnAlignPosition
OnCanResize<
OnClick
OnConstrainedResize
OnContextPopupT_C
OnDockDrop
OnDockOver<
OnDblClickP^C
OnDragDrop
OnDragOver
OnEndDock
OnEndDrag<
OnEnter<
OnExit
OnGetSiteInfo
OnMouseActivate
OnMouseDown<
OnMouseEnter<
OnMouseLeave$\C
OnMouseMove
OnMouseUp<
OnResize
OnStartDock
OnStartDragL`C
OnUnDock
_^[Y]
_^[Y]
TCommonDialog
TCommonDialog`
Dialogs
Ctl3D
HelpContext<
OnClose<
OnShow
TOpenOption
ofReadOnly
ofOverwritePrompt
ofHideReadOnly
ofNoChangeDir
ofShowHelp
ofNoValidate
ofAllowMultiSelect
ofExtensionDifferent
ofPathMustExist
ofFileMustExist
ofCreatePrompt
ofShareAware
ofNoReadOnlyReturn
ofNoTestFileCreate
ofNoNetworkButton
ofNoLongNames
ofOldStyleDialog
ofNoDereferenceLinks
ofEnableIncludeNotify
ofEnableSizing
ofDontAddToRecent
ofForceShowHidden
Dialogs
TOpenOptions
TOpenOptionEx
ofExNoPlacesBar
Dialogsl
TOpenOptionsEx
TOFNotifyEx
TIncludeItemEvent
TOFNotifyEx
Include
Boolean
TOpenDialog
TOpenDialog8
Dialogs
FileName
Filter<
FilterIndex
InitialDir
Optionsh
OptionsEx
Title
OnCanClose<
OnFolderChange<
OnSelectionChange<
OnTypeChange
OnIncludeItem4
Execute
TSaveDialog
TSaveDialog4
Dialogs
TRedirectorWindow
TRedirectorWindow(
Dialogs
_^[Y]
_^[Y]
;Gpt3
FileEditStyle
8Z|03
u"Vh_
Cancel
Abort
Retry
Ignore
NoToAll
YesToAll
commdlg_help
commdlg_FindReplace
WndProcPtr%.8X%.8X
THintAction\
THintAction
StdActns
comctl32.dll
InitializeFlatSB
UninitializeFlatSB
FlatSB_GetScrollProp
FlatSB_SetScrollProp
FlatSB_EnableScrollBar
FlatSB_ShowScrollBar
FlatSB_GetScrollRange
FlatSB_GetScrollInfo
FlatSB_GetScrollPos
FlatSB_SetScrollPos
FlatSB_SetScrollInfo
FlatSB_SetScrollRange
TThemeServices
Theme manager
2001, 2002 Mike Lischke
comctl32.dll
^[YY]
!"#$%
EMenuError
TMenuBreak
mbNone
mbBreak
mbBarBreak
Menus
TMenuChangeEvent
Sender
TObject
Source
TMenuItem
Rebuild
Boolean
TMenuDrawItemEvent
Sender
TObject
ACanvas
TCanvas
ARect
TRect
Selected
Boolean
TAdvancedMenuDrawItemEvent
Sender
TObject
ACanvas
TCanvas
ARect
TRect
State
TOwnerDrawState
TMenuMeasureItemEvent
Sender
TObject
ACanvas
TCanvas
Width
Integer
Height
Integer
TMenuItemAutoFlag
maAutomatic
maManual
maParent
MenusP
TMenuAutoFlag
Menus
TMenuActionLink
TMenuItem4
TMenuItem
Menus
Action
AutoCheck
AutoHotkeys
AutoLineReduction
Bitmap
Break
Caption
Checked
SubMenuImages
Default
EnabledT
GroupIndex
HelpContext
HintX
ImageIndex
RadioItem$
ShortCut
Visible<
OnClick
OnDrawItem
OnAdvancedDrawItem
OnMeasureItem
TMenu
TMenu
Menus
Items
TMainMenu
TMainMenu
Menus
AutoHotkeysL
AutoLineReduction
AutoMerge
BiDiMode
Images
OwnerDraw
ParentBiDiModeX
OnChange
TPopupAlignment
paLeft
paRight
paCenter
Menus
TTrackButton
tbRightButton
tbLeftButton
Menus
TMenuAnimations
maLeftToRight
maRightToLeft
maTopToBottom
maBottomToTop
maNone
Menus
TMenuAnimation
TPopupMenu
TPopupMenu
Menus
AlignmentL
AutoHotkeysL
AutoLineReduction
AutoPopup
BiDiMode
HelpContext
Images4
MenuAnimation
OwnerDraw
ParentBiDiMode
TrackButtonX
OnChange<
OnPopup
TPopupList
TMenuItemStack
1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZ
f;B`t
CPPVj
Q<]_^[
SVWUQ
:X?s&
X?ENu
Z]_^[
ShortCutText
_^[Y]
_^[Y]
P?:S?u
:^8tA
:^9tf
Q<_^[
:^?t1
f;P`t
:]:tJ
Q<]_^[
@?:F?v
Q<]_^[
Q<_^[
W<CNu
Uh}/C
SpFOu
$YZ]_^[
_^[Y]
_^[Y]
SVWUQ
Z]_^[
Uhe6C
UhH6C
\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\
Layout File
KbdLayerDescriptor
_^[YY]
Uh\<C
S0^[]
_^[Y]
_^[Y]
Ih;J4u
Uh2CC
_^[Y]
YZ]_^[
P\YZ_^
S0_^[
YZ]_^[
Uh/NC
Uh8OC
TCursor
TAlign
alNone
alTop
alBottom
alLeft
alRight
alClient
alCustom
Controls
TDragObject8PC
TDragObject
Controls
TBaseDragControlObject
TBaseDragControlObject
Controls
TDragControlObject
TDragControlObjectEx
TDragDockObject
TDragDockObject
Controls
TDragDockObjectEx
TControlCanvas
TControlCanvas
Controls
TCustomControlAction
TCustomControlAction
Controls
TControlActionLink
TMouseButton
mbLeft
mbRight
mbMiddle
ControlsdVC
TMouseActivate
maDefault
maActivate
maActivateAndEat
maNoActivate
maNoActivateAndEat
Controls
TDragMode
dmManual
dmAutomatic
Controls
TDragState
dsDragEnter
dsDragLeave
dsDragMove
Controls
TDragKind
dkDrag
dkDock
Controls
TTabOrder
TCaption
TAnchorKind
akLeft
akTop
akRight
akBottom
Controls
TAnchors
TConstraintSize
TSizeConstraints
TSizeConstraints|XC
Controls
MaxHeight
MaxWidth
MinHeight
MinWidth
TMarginSize
TMargins
TMargins
Controls
Left`YC
Top`YC
Right`YC
Bottom
TPadding
TPadding
Controls
Left`YC
Top`YC
Right`YC
Bottom
TMouseEvent
Sender
TObject
Button
TMouseButton
Shift
TShiftState
Integer
Integer
TMouseMoveEvent
Sender
TObject
Shift
TShiftState
Integer
Integer
TMouseActivateEvent
Sender
TObject
Button
TMouseButton
Shift
TShiftState
Integer
Integer
HitTest
Integer
MouseActivate
TMouseActivate
TKeyEvent
Sender
TObject
Shift
TShiftState
TKeyPressEvent
Sender
TObject
TDragOverEvent
Sender
TObject
Source
TObject
Integer
Integer
State
TDragState
Accept
Boolean
TDragDropEvent
Sender
TObject
Source
TObject
Integer
Integer
TStartDragEvent
Sender
TObject
DragObject
TDragObject
TEndDragEvent
Sender
TObject
Target
TObject
Integer
Integer
TDockDropEvent
Sender
TObject
Source
TDragDockObject
Integer
Integer
TDockOverEvent
Sender
TObject
Source
TDragDockObject
Integer
Integer
State
TDragState
Accept
Boolean
TUnDockEvent
Sender
TObject
Client
TControl
NewTarget
TWinControl
Allow
Boolean
TStartDockEvent
Sender
TObject
DragObject
TDragDockObject
TGetSiteInfoEvent
Sender
TObject
DockClient
TControl
InfluenceRect
TRect
MousePos
TPoint
CanDock
Boolean
TCanResizeEvent
Sender
TObject
NewWidth
Integer
NewHeight
Integer
Resize
Boolean
TConstrainedResizeEvent
Sender
TObject
MinWidth
Integer
MinHeight
Integer
MaxWidth
Integer
MaxHeight
Integer
TMouseWheelEvent
Sender
TObject
Shift
TShiftState
WheelDelta
Integer
MousePos
TPoint
Handled
Boolean
TMouseWheelUpDownEvent
Sender
TObject
Shift
TShiftState
MousePos
TPoint
Handled
Boolean
TContextPopupEvent
Sender
TObject
MousePos
TPoint
Handled
Boolean
TControl
TControl4dC
Controls
AlignWithMargins<
Left<
Width<
HeightDOC
Cursor
HelpType
HelpKeyword
HelpContext
Margins
TWinControlActionLink
TImeName
TBorderWidth
TBevelCut
bvNone
bvLowered
bvRaised
bvSpace
Controls
TBevelEdge
beLeft
beTop
beRight
beBottom
Controls
TBevelEdges
TBevelKind
bkNone
bkTile
bkSoft
bkFlat
Controls
TBevelWidth
IDockManager
Controls
TAlignInsertBeforeEvent
Sender
TWinControl
TControl
TControl
Boolean
TAlignPositionEvent
Sender
TWinControl
Control
TControl
NewLeft
Integer
NewTop
Integer
NewWidth
Integer
NewHeight
Integer
AlignRect
TRect
AlignInfo
TAlignInfo
TWinControl
TWinControl8lC
Controls
TGraphicControl
TGraphicControlHpC
Controls
TCustomControl
TCustomControllqC
Controls
THintWindow
THintWindow
Controls
TDockZone
TDockTree
TMouse
crDefault
crArrow
crCross
crIBeam
crSizeNESW
crSizeNS
crSizeNWSE
crSizeWE
crUpArrow
crHourGlass
crDrag
crNoDrop
crHSplit
crVSplit
crMultiDrag
crSQLWait
crAppStart
crHelp
crHandPoint
crSizeAll
crSize
TSiteList
_^[YY]
_^[Y]
S$_^[]
;B0t'
QSVW3
_^[Y]
YZ_^[
YZ]_^[
YZ_^[
t%Jt?Jt[
%s (%s)
Z:Pjt
YZ]_^[
:FauR
;FLt&
R\Z_^[
;CLt_3
YZ_^[
Ql_^[
YZ_^[
YZ_^[
GP t;
_^[YY]
CH+D$
CL+D$
;s0t=;
:_Wt&
R\_^[
f;P|t
KHQRP
^[YY]
IsControl
ExplicitLeft
ExplicitTop
ExplicitWidth
ExplicitHeight
_^[YY]
_^[YY]
_^[Y]
8]_^[
8]_^[
YZ_^[
^[YY]
^[YY]
YZ_^[
YZ]_^[
SVWUQ
Z]_^[
:GauQFKu
_^[Y]
DesignSize
YZ_^[
_^[YY]
_^[Y]
_^[YY]
_^[YY]
_^YY]
$Z_^[
_^[YY]
_^[Y]
^[YY]
t";l$
YZ]_^[
SVWUQ
Z]_^[
SVWUQ
Z]_^[
_^[YY]
;XDt%
SVWUQ
Z]_^[
t)j7j
YZ]_^[
YZ]_^[
R\_^[
YZ]_^[
Uh~#D
t4VS
YZ]_^[
Uht+D
YZ]_^[
^[YY]
S8_^[]
Uh9;D
Uh"@D
_^[Y]
f;Pht
_^[Y]
t9;wlt4
YZ_^[
;Bdt+
;Bh|4
Wh(mD
@88mD
Vh(mD
Vh(mD
_^[Y]
Y[YY]
t';C8u
QQQQSVW
Vh(mD
;Fdu;
Vh(mD
Vh(mD
Wh(mD
UhOhD
Uh\iD
;Xdt>
t$;^dt
YZ_^[
Sh(mD
Sh(mD
Y_^[]
^[YY]
Ph(mD
+W$;U
+G$;E
Ph(mD
_^[Y]
BP_^[]
Uhf|D
USER32
WINNLSEnableIME
imm32.dll
ImmGetContext
ImmReleaseContext
ImmGetConversionStatus
ImmSetConversionStatus
ImmSetOpenStatus
ImmSetCompositionWindow
ImmSetCompositionFontA
ImmGetCompositionStringA
ImmIsIME
ImmNotifyIME
YZ_^[
Delphi%.8X
ControlOfs%.8X%.8X
USER32
AnimateWindow
Jt'Jt5
_^[Y]
TChangeLink\
TImageIndex
TCustomImageList
TCustomImageList
ImgList
Rh_^[
S0_^[]
R ;C0|
R,;C4}!
S`]_^[
Bitmap
_^[Y]
comctl32.dll
comctl32.dll
ImageList_WriteEx
TContainedAction
TContainedAction
ActnList
Category
TCustomActionList
TCustomActionList
ActnList
TShortCutList
TShortCutList
ActnList
TCustomAction
TCustomAction
ActnList
TActionLinkSV
^[YY]
u*;~8u
R0GNu
YZ]_^[
SVWUQ
S`Z]_^[
QLGNu
R0Z_^[
QPFOu
_^[Y]
$:Cjtc
QTGNu
R0Z_^[
Q`FOu
R0]_^[
$;Ctt?
Q\GNu
R0Z_^[
QhGNu
R0Z_^[
QlGNu
R0Z_^[
SVWQf
QpGNu
R0Z_^[
QtGNu
R0Z_^[
SVWUQ
$Z]_^[
TScrollBarInc
TScrollBarStyle
ssRegular
ssFlat
ssHotTrack
Forms
TControlScrollBar
TControlScrollBar
Forms
ButtonSize
Color
Incrementh
Margin
ParentColor<
Position<
Range
Smooth<
Style<
ThumbSize
Tracking
Visible
TWindowState
wsNormal
wsMinimized
wsMaximized
Forms
TScrollingWinControl
TScrollingWinControl,
Forms
OnAlignInsertBefore
OnAlignPosition
HorzScrollBar
VertScrollBar$
TFormBorderStyle
bsNone
bsSingle
bsSizeable
bsDialog
bsToolWindow
bsSizeToolWin
Forms
TBorderStyle
Forms
IDesignerHook40A
Forms
IOleForm
Forms
TPopupWndArray
Forms
TFormStyle
fsNormal
fsMDIChild
fsMDIForm
fsStayOnTop
Forms
TBorderIcon
biSystemMenu
biMinimize
biMaximize
biHelp
Forms
TBorderIcons
TPosition
poDesigned
poDefault
poDefaultPosOnly
poDefaultSizeOnly
poScreenCenter
poDesktopCenter
poMainFormCenter
poOwnerFormCenter
Forms
TDefaultMonitor
dmDesktop
dmPrimary
dmMainForm
dmActiveForm
Forms
TPrintScale
poNone
poProportional
poPrintToFit
Forms
TCloseAction
caNone
caHide
caFree
caMinimize
Forms
TCloseEvent
Sender
TObject
Action
TCloseAction
TCloseQueryEvent
Sender
TObject
CanClose
Boolean
TShortCutEvent
TWMKey
Handled
Boolean
THelpEvent
Command
Integer
CallHelp
Boolean
Boolean
TPopupMode
pmNone
pmAuto
pmExplicit
Forms
TCustomForm
TCustomForm
Forms
Left<
TForm
TForm
Forms]
Action
ActiveControl\OC
Align
AlphaBlendT
AlphaBlendValue
Anchors
AutoScroll
AutoSize
BiDiMode
BorderIcons
BorderStyle`iC
BorderWidth
Caption<
ClientHeight<
ClientWidth
Color
TransparentColor
TransparentColorValue
Constraints
Ctl3D
UseDockManager
DefaultMonitor
DockSiteXWC
DragKind
DragMode
Enabled
ParentFont
FormStyle<
Height
HelpFile
HorzScrollBar,
KeyPreview
Padding
OldCreateOrder0
ObjectMenuItem
ParentBiDiMode<
PixelsPerInch
PopupMenu
PopupMode
PopupParent
Position
PrintScale
Scaled
ScreenSnap
ShowHint<
SnapBuffer
VertScrollBar
Visible<
Width
WindowState0
WindowMenu<
OnActivate
OnAlignInsertBefore
OnAlignPosition
OnCanResize<
OnClickx
OnClose
OnCloseQuery
OnConstrainedResize
OnContextPopup<
OnCreate<
OnDblClick<
OnDestroy<
OnDeactivateT_C
OnDockDrop
OnDockOverP^C
OnDragDrop
OnDragOver
OnEndDock
OnGetSiteInfo<
OnHide<
OnKeyDown
OnKeyUp
OnMouseActivate
OnMouseDown<
OnMouseEnter<
OnMouseLeave$\C
OnMouseMove
OnMouseUp
OnMouseWheel
OnMouseWheelDown
OnMouseWheelUp<
OnPaint<
OnResize
OnShortCut<
OnShow
OnStartDockL`C
OnUnDock
TCustomDockForm
TCustomDockForm
Forms
PixelsPerInch
TMonitor
TScreen
TScreen
Forms
TPopupFormArray
Forms
TApplication
TApplication
Forms
t:GNu
^[YY]
;S$t5
;S0t5
]_^[
_^[Y]
_^[Y]
PixelsPerInch
TextHeight
IgnoreFontProperty
_^[YY]
S0_^[]
SVWUQ
Z]_^[
t9j7j
;Cpu'
YZ_^[
MDICLIENT
_^[Y]
UhI E
_^[YY]
;ADti
f#CTf
;X0tC
UhC*E
_^[Y]
;BLuy
Uh|2E
_^[YY]
t"GNu
$Z_^[
Uhm:E
_^[YY]
Uh7;E
Uhe>E
UhC>E
_^[Y]
Y_^[]
_^[Y]
_^[Y]
_^[YY]
_^[YY]
Uh<FE
_^[YY]
_^[Y]
Ch;Ctt
Cd;Cpt
C\_^[
UhoPE
Uh+PE
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
layout text
f;sDt~f
PWj W
UhWSE
_^[YY]
Uh%YE
TApplication
Sh<rE
MAINICON
Vh<eE
Uh!aE
XD;PHu
sx;P`u
;B0uGj
UhRmE
_^[YY]
vcltest3.dll
RegisterAutomation
YZ]_^[
SVWUQ
$Z]_^[
SVWUQ
Z]_^[
Uh>uE
~D_^[Y]
Uh^vE
Uh%vE
_^[Y]
Uh.|E
_^[YY]
_^[YY]
CHYZ[
Y_^[Y]
,]_^[
_^[YY]
SVWUQ
$Z]_^[
YZ]_^[
User32.dll
SetLayeredWindowAttributes
MAPI32.DLL
TConversionFormat
$]_^[
2b3b303530756b6a273d2d332661232a2c2828206d2c2b286c3a6b756c3a277a2a2b79740219322e28092877322e357c707c0d3615090a7c7b2d3d20043e7c1d30053e0c652a3c352c3d30782720332b2f202521
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
T__3765368912d
T__3765397129h
T__3765400322l
T__3765430950p
T__3765434120t
T__3765473522x
T__3765476692|
T__3765402733
T__3765218560
T__3764290569
T__3765255551
T__3765258721
T__3765261132
T__3765289349
T__3765292519
T__3765295712
T__3765323170
T__3765326340
T__3765329510
T__3765504932
T__3765437290
T__3765439724
T__3765467941
T__3765471111
T__3765508102
T__3765510513
T__3765331921
T__3765360161
T__3765363331
T__3765366501
T__3764287399
T__3765221730
T__3764068646
T__3735818730
T__3764075009
T__3764102467
T__3764105637
T__3764108807
T__3764137024
T__3764139458
T__3764142628
T__3765215390
T__3765215390p
T__23d3370U
Dextop
Haar Wavelet
wavelets rule!
BMP-Size:
Byte-Size:
HWL-Size:
Coefficients Kicked/Zero:
Coefficient Epsilon:
Subdivision Depth:
Quantizer Bits (Y-UV):
(0=Quality)
(Max=Best Compression)
(8-8=Quality)
Open .BMP
Open .HWL
Save As .HWL
Window
HWL-Raw
About
TaskbarCreated
Delphi Picture
Delphi Component
TaskbarCreated
Error
Runtime error at 00000000
0123456789ABCDEF
MS Sans Serif
0e151445414f4445474f4b45bcb04445fb4f4445434f4445034f5e45434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434e4445f95f444b5cfb4d8862f745098e6ed4d517272d36633f362a243d252863223136376f2620633d312b633a2a21263d64122a2177774e456072434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445130a44450f4e42455a11066f434f4445434f4445a34fcae4484e465c43c34445436f4445434f444587d54445435f444543ef4445434f0445435f4445434d4445474f4445434f4445474f4445434f444543bf4445434b4445434f4445414f4545434f4445434f4445434f5445435f4445434f4445534f4445434f4445434f4445438f44453b47444543af4445534f4445434f4445434f4445434f4445434f4445439f444503434445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f444500000000434f444503c44445435f444543c34445434b4445434f4445434f4445434f4445634f4425070e1004434f4445534b444543ef44454349444543df4445434f4445434f4445434f4445034f4485011c1745434f44458e48444543ff4445434f444543d94445434f4445434f4445434f4445434f44856d262024372e44453b474445438f44454345444543d94445434f4445434f4445434f4445034f44856d3d21292c2c444503434445439f44454341444543ef4445434f4445434f4445434f4445034f44156d3d3737204f4445534f444543af4445434d444543e14445434f4445434f4445434f4445034f4415434f4445434f4445434f444543bf4445434f444543f34445434f4445434f4445434f4445034f4415434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445475f04454949173131262a221b5f0445434f4445434f4445434f4445434f4445434f4445434f4445434f44451b5f0445474f4445434f44454b770445577704455b7704455f7704455377044597790445b37904454f780445441b0b27292a2731bc6a1884034fcf85bc6a1c84034fcf85bc6a1084034fcf85bc6a1484034fcf85bc6a0884034fcf85bc6a0c84034fcf85bc6a0084034fcf85bc6a0484034fcf85bc6a7884034fcf85bc6a7c84034fcf85bc6a7084034fcf85bc6a7484034fcf85bc6a3484034fcf85bc6a6884034fcf85bc6a2884034fcf85bc6a6c84034fcf85bc6a6084034fcf85bc6a6484034fcf85bc6a5884034fcf85bc6a5c84034fcf85bc6a5084034fcf85bc6a5484034fcf85bc6a4884034fcf85bc6a4c84034fcf85bc6a4084034fcf85bc6a4484034fcf85bc6ab885034fcf85bc6a2c84034fcf85bc6abc85034fcf85bc6ab085034fcf85bc6ac484034fcf85bc6a3884034fcf85bc6a3c84034fcf85bc6ab485034fcf85bc6acc84034fcf85bc6aa885034fcf85bc6aac85034fcf8510cc80f9f8454445431bacccbcb0bbb3076b6844374a4bf21f6b74ce80cc8001188ccf85bc6aa085034fcf85bc6aa485034fcf85bc6a9885034fcf85bc6a9c85034fcf85bc6a9085034fcf85bc6a9485034fcf85bc6a8885034fcf85bc6a8c85034fcf8510cc80b1f8aff10543cc7f4536162c01454f442f43a7e2babcb0cd016747c73967474430447c84cc476baf15c80b604dc85a98f0034fcd55c80b604de093f105437c84ce934c96ce0f6b4cc8179e40cc176b40ce176b40ce48c64ece176b40cc500fc7bd273a98ce40c6006147c4006147c444cc40c4006147c64061c84b60c687431f86ca4fcd05478ccf851019c781bbc4b6ce9ba722babcb0cd01674bc739674b4430477c84ae79c442ce176b40cc0147cf0347c4106147c60649c84ccd4167c4006147c45061ca5fcf01674bcd1d47c44061c81b6041ca1f40ce076b40cc40ff451c19111f86c08bbcce134bcd5167c454cc176b40ce576bcf09674bcd4fc81b6041c84360cc094bcf50a3fa0445ca5fe7a5f60f441c198ccf8510191310c08bbcce9ac4b4cebfc442cc44c446cc40c40641ca0c40ce44c444cc076b40ce54c4164dc885cf6a400248ce40748c305bc443add3b0bbbac848cf054bc647ce44c40449420c40ae554c0741789f314ac848ac34bcb0bbce44c40449420c40ce076b40cc44747330edc497ce85a7bebbbcb0c085364b7785ca4c1d1f1e101a1e80c2044510191310c08bb4cc476bcfb1c849cd016743cf4fc849cf054b748c4ac1c9444543c49cce7d4c1b49c8b6473f47749b3735748c3062c40641c84145044bc40641c8596d074fc442c63b43443015c442adb3b1bbbaa802cf9dc871471a4fc4bd46394b7f9a3645cf0747c4526c0143af76c855471f47c6186147c47ace3c47cf6b4032486eb8c638614b648cce45c60c49ce1b6041c849ac08bdb0bbc1833a407683a45cf542a450ce45c444cc45c4427e076b484ac616bbbabc7c84c6875f191a1d1487d5101913ce99c4b4c4bd4f4455433243fb434f5445a843c583bcb04445c2a94445bcb0cd364725452d436f4445152544ad77b2bbbac8b7cd7ec6b03066c89cfca1f60f44ad9fb2bbbac78f31562b4fc445432544ce401fac50beb0bb7683c6471a1d1487d510191310c896cfb7c8a78306474f44554325402d436f44452b4f4455431aaca4bfb0bbcebbc67fc0bc3a5bc485b0bb4543cea24543b0bbcc304b2e412b4f6445431911adffb3bbbaca4cc77e433b67ce90f7a0f0034fac20beb0bbc1833a572d43cf4445294fcf4613a7dab9bcb07785ca4c191a1d1487d510191310c08baccebac4b082076b4cbabcb0bb768ac608614fc60061534c106153c6106157eea0f0034fcd43a824cf43c84fcd01674bcf43c8174c7e1f6b543711c487ce554c0649780b6051340a7f1967473741ca13604dc849cf2d4bc442462b437f2967433241ca2360492b4fc445432544ce45c4044d13a752b9bcb0c1853645834083fa0445424f4445c849ac54beb0bbce076b40cc45f7a0f0034f7f4336c37785ca48c7396743443152c400614bc643ce076b486e076b4ccc044bc7815b121b1b188ccf8510191310c08bacce9ac65061ce3b604dce336041ce236049c89fcf8fc2ae44b5bcb0cd09675f475167ce86ba4c4f44c4a14fb4babcc6106157c4006153c647ce076b506e076b54cc004be5a1f60f44cc44a41fce44c4044dca49cf42c80f484645c60145c8497f01675f3743c80b6055ca49cf0043740061573943ce076b50cc064fcf43780a44365c25402d435f4445c80a446e451fcf4313a762bebcb0c18536497785ca4caf4ac848cf45ca48fca1f60f447e443ad8c68757191a1d1487d510191310c08baccc576bc9316747c939674bc9196743cf95c8a5c580bc404445c2aa44b5bcb0cd29675f475167cea645b3b0bbcc176b50ce076b54cc42c400615764006153c60541e2abf10543c643ae1bc443ce0347cd43c848cf054f4c42cc40c4427e076b543645c4006153c642ce40740061573942ce076b50cc40c4427e403c642d430f4445c84c6f4313c44215ab38bebabcca843049884185f60f4447434f44ce44c444cc44f7a0f0034f7f4236d0c7815b121b1b188ccf8510191310c08bb0ce99c4b4cebff2b0f0034fc583bc704445c2a94485bcb0cf0043c643ae02c4437e33433b71c884cf42c80f4cce95a70ebbbcb0c77e433b1bce004bcf52420d4cce004bcf526a0d48ce44cc3c49433a03ce44a746bebcb0af7bc848cf45ca487f6a36f4cf96c889ac28bfb0bbc6784f3063ce036041c89ccf80ab40bfbabccc3861474f31d7ce036041c81c40ce40a766b8bcb07785ca4cc7814f121b1b188ccf8510191310c08baccc4f6bcfbfc897c931674bf9b1f60f44c484b07b4543cea34583b0bbce064fcd43a849cf43c84fcd4378613042c8497f1d4b3aabce45741c4d3610cf437837484acdd3444543c442ce94641449c849cf054bc44a460243c9096747ac70bfb0bbc63f6b4c45377cc909675fc9116747cf80ab20bebabccc3861534f31dace036055c81b6049c80b604dab30b8babcc44061709dcd55aad5444543c208614bc493ce80a7aabebcb0c7396747443177c2086153c210614bc481ad6bb5bbbac03360554340c111bcb0bbc80f6b54ce176b48ce076b4cad77b3bbbac84b607691c654ae11c442ce2b477f98360dcf437837483a78c44861c88acf92ab98b8babcc44061c07744316dc44061c80f40ce554e064dc84b60ce034bcf536a0d48ce45cc3c49433a54ce45a7c2bcbcb0af42c84b607691c654c68757191a1d1487d510cc80adc896c9cdbc704445c2ae4485bcb0cd49674c94c4a14f84babcc6106147c40061477440613510cf8ec81b6041685b60ce476bac58beb0bbc80f6b4cce90f7b0f0034fac18bab0bbce1f6b4cc0983b5bc80f6b54ce176b48ce80a72abebcb0cf01675fcd016747cf01675bcd016743c7396747443157c210614bf7b0f0034facecbab0bbae477c84cc40cc805d188ccf8516c4a814709d112dff55044527b07621ca6d2c81f60f44adffb8bbbac37201f5034f4431492780f0034facf4b4b0bbfda7fa0445ab0cbcbabcf7b0f0034fac7cbbb0bbfd63f90445ab60bcbabc27bc4a434f2e45ab10b3babcec58f3034fc7785ff90445433b04fd404f4445c85a58f3034f778cca03c6b103724541434f31a9840ab841f50f44ce06b3cf10bfc61441c80ab8ce16b3cd55c80ab8e653f90445854af8f0034f457683151d1c27c6542d80550445c37201f5034f4431492780f0034fac64b4b0bb86aa58644543a4a1e5fffa04451a1287d516c4a8c687b7c478fffa04454340c0ad434f4476831a2c85580f4421bc7f20cc63cf7900f30f444537452c81f60f44ad97b9bbba854af8f0034f44e45ff9044513a7e6b3bcb07785e053f20543eea0f0034fcd00bba45f2d43cf4445294fcf00bbc4044d13a7cab3bcb0cf00bbc444cc06b7fca1f60f447e06b7319efbabf10543a75ab2bcb0fcb1f60f44ad57b8bbbafb6ff20543a74eb2bcb0e599f60f44cc06b3c738bf4f3064c80ab8ce43ec98f0034fcf00bf1fac68b5b0bbe49ffa0445ca0ab8c63eb344309c7c841f1a1620cc5327835e034fc47806ff0445433b4e2d87fa0445ab68b2babc2780f0034fac60b5b0bb86aa5c5b4543a49f1c1a1287d510cc80bd784a54f3034f314cc81f40cc565ff20543c41441ca5b60ce1347c5bf435f44453c017f41673a53c0913647c6814c85bf41ee58f3034f778cca03d4b1a804c1973a4cc787408ebe47c84258f3034fcf5967c618d4b7c444cc076b40ce476bcf11674bcd55c80b6041c85b60cc134baf5cc84fcd01674bcf4167c4106147c654ce076b40ce576bcd1547161e1e80c20445101ecf89c85a64f3034fcd54a857cf54c81d4c7e813d4dce5a4c1749788d3658c85ecf57ca5efe65f50f447e523a9b82468ff105434c4445437c84cc42c4451f188ccf85101ecf8fc0a640c85f4ecd5967ccbe553f5ccf5167884642434fc4ce92a79e44434f1e1e80ccbe413f40cf8fc286464543cfcd4dc84b60cc4b151f86bc4ae8f0034fcf95c0a540ce51cea6b9bcb03bc6a94b4550f3fa0445abb44245438ccf85c0b548394dcc8e47ca5fc78547a78ebabcb087c6b94b384fc885c58c414f44c5ca474787c06fba86101915ce93ccae41c85dcf8fc2ae464543cfc5bc414f44c53745834083fa0445474f4445c895c5a6bfb0bb3a688ccf8d705eb387bdb0bbba3745834083fa0445464f4445b54e45316ac494c6a943cf374b6482cc476bcf416774344d3745834083fa0445454f4445c84b60ad73b1bbba4091cf8619111f86101915ce9b7cb2ce40e6444543cf304e66b3bbba3c4cb4469bc447ed413a5ccc5f6bcf4167a7bab8bcb0cf4167c4044d40bf479dc06cbace85151a1e80c2044510191310c08bb0ceb1c4ac7698c481ad2bb1bbbaca0b604dc033604d4340c0ca434f44ce076b4cce3b47cf82c81b604d400d48ce93c2486b689ec7bf4f3040ceb364b1ce866483c6bb433953c80b604dc89a6f154b4c92ce8fc483ad5fb4bbbaa840cf89c899c7af47c20141ab44bfbabcc47861c6b0307fc8986f90c88aac78bdb0bbce176b4cce1147cf09674747144fc48346076b407e93394ec857616f95ab34bababcc490ce076b4cadbfbbbbbaf04ecf86c08b48181c111f861019c781b7c49eceb3c67061c84b60cc1b47cf41674c87c6ab43cd1d4bcebf45534f443a35c487c0833647c6834c85bd41c45159f50f44ce17cdb0cc176b40c63f6b4045366ccf505ff90445c84360cc0fcdb0ce476bcf5167c61441c84b60ce576bcd55aac7444543c4006147c444cc076b4cce476bcf11674bcd1547c44061c81b604dca5fcf01674bcf5167c654ce076b4cce576bcd1547a412c4b84f7845433349ce90c482addbb1bbbac78f3104e25ff20543c6006147c44061e05ff20543c4006147c444cc076b4cce476bcf11674bcd1547c44061c81b604dca5fcf01674bcf5167c654ce076b4cce576bcd1547cc80491d1487d5c07250f3034f443b03cc7951f50f44493e43834083fa0445444f4445a864e551f50f44c68b4dcf505bf90445ca4de55df50f44c6834bac48beb0bb7683ec5cf3034f7785e05bf205438ccf85101913c687bfcfb5ce7360e0e6c4b8ade3b0bbbace03604dc898fc65f50f44ad43bcbbbac813604dc6943141708faf17c8487f9d3045ac48beb0bb6c444e0341c848470247c4b746376b487e853c4cad2fb2bbba420840ce444c034178bf3154c0a740ff474f4445ab1cb8babccc2b4147c443e65bf90445c80840e657f90445f34ec78153101a1e80c2044510cc80bdc897cf91ce0c40adb7b9bbbac07360453744cf81ab18bbbabccb8430477c84ae41ff451c191487d51019c781bbc4b6ce9bc488c8154bcf86ab24b3babccc7861433b4fce87a762babcb0c085364b7785a84df4441a151a1e80c2044512c490768ac64ec0833647c6834c85bd41724441434f3b5cc84258f3034fcf09c2bbcd4fc07544304b0f7944474f4430a4c4461f80c2044510191310c08bb0ce9bc230614bf054f3034ff951f50f44e44bf90445ca49cf4378174c4acde4444543c443cc45c442ce03477f9d4cc1de45434fcf53ca154cce55c41641ca59cf5378154c3ab1c453cc0147cf4378483043c849cd42a839c5be435f44453c41cf86ab14bbbabcc642c67d4f3125c88caca8bdb0bbc1833a4e7683c64061aafb4445437419453cc66d1843cc39454f324c461e4f7785ca0a44e45bf90445ca0b604142525cf3034fcf86c08746ce176b40cc41c4006147cc8441ca4b60ba46e3f10543ccaf414252f4f0034faf2cc849acacbab0bbce45c4144dc88d6f86c0b748394fc4524690ddace0bfb0bbae5dc49ece4574433044c442ce034bcd42c8494786ca0b6041c80b6041c06fbace45c6006147c487c68b4dcf11674bcd47c80b6041c08f40cc476bbb40effa0445c0a440445efff10543c44061c08b48181c111f8616c4a8c687a317ce9bcf79f9f60f44453646acc8b4b0bbc1833b4cc4b8b7bbba3c314e7683c601b9aa394545437c96102ba36705432bbb7727c666c57e0af405434f304f2b8bf10543a772aabcb0c78644cca7b9c0b4483846f44845434fc5be435f44454cc0e845434fcf86c68f3d46c08f4784bb4dcf505ff90445c81bc6b1ca1abcc63eb7444ac7c6444543c411bd409ccd10afc411a9c06dbace16b7cf1747c611b5c81ab47e16b7314bc85a58f3034f778cca03c6b1a869cf505ff90445c802b4cc0fcdb0ce06b7cf45ca0ab0ce06bbcf10b3c61441c80ab4ce16bbcd55c80abccc06a3cf00bbc4044dc08746ce16a3cd47c80aa8c6834bcd00bfb041e9f60f44c6a84b4558f3fa0445ab145c4543a6c945434f7f5857f904453c1c6d5857f90445c07250f3034f48384e4c5951f50f447683ec50f3034fe55df50f44cc06a345585bf90445c88cc78d41c411a9ca4dcf00afcc8441ca0ab8ba46e3f10543ccaf414252f4f0034facb8544f44ae71c487ad03b2bbbaca0ab87683151d1c27c6542db06c0445c37201f5034f4431492780f0034facb4aeb0bb86aaa8524543a4a1ce06b31fcea61287d516c4a8c687bf17ce9b7c84e683fa0445c372f8f0034f44305ca79eb0bcb0c0853659834083fa04454b4f4445840ab84d434f44acd54e4445709d112d806a044527b07621ca6dc47806ff0445433b4e2d87fa0445ab30a9babcc619bdc80abcc6ab4bcd00bbc401bdc857b286413a4b82468ff1054346444543a66444434fbb48effa0445c88c61b9bcb03bc6ab4b6d40f3fa0445b58c453110c401bdc0a748ce0347c7bd4f3343ec404f44c53740834083fa0445494f4445aaae444543c411bd689fcd10b3c411b5780d4c314c884185f60f444f434f44ac814f44454097cf00b3c601bdc80ab4ada7b9bbbac2acb8babc30cf00bb4c87cc06bbcf00b774415df50f44306f66595df50f44445e5bf20543ce7951f50f44457f4f443b46a73ebfbcb07785ca0ab8add7594445aad2444543c401b1c84fec47375161b9bcb03bc6bb4b3949844a84f0034f4f45434faf0bc80ab0c64b4eaf79c80ab0cc06bfcf00b3cc3c41433b55ce06bfc77d433b4dce06bfc73d4b433949844a84f0034f4f45434faf5fc80ab4ce0347479dc80ab4ad7fb9bbbac89ccf00bba742bcbcb0e585f60f44cc06b3778519161d21ca5f2c8f660f44c57e0af405434f304f2b8bf10543a75ea9bcb087ac535a4445a8aacf00bf14cfa01e8ccf8510191310c08bb0ce99cc8742c0acb8c6b8433940f843444543ccac41ca4b60ce476bcf75c2a9b8babc30cf41674c82cc076b407eb03a43f542a6f944434f7fb64cc1d445434fcfab68a4cf11674b7f505bf9044536636d685bf90445426250f3034fc77857f904454f40c92a424f44446e57f20543666951f50f44ce9da61844434fcd01674bcf01674bb245413a5cce076b40cc076b4cce076b4c462b47cf016747ac14b6b0bbc6be433866c84b604680c6006147cc8947c80b6041ca67cf01674bc78547a706b3bcb0ad4a424f44ce9da64c44434fcfbe68b1cf01674b7f405bf90445362a7f7857f904453c006d7857f9044542725cf3034fc77857f904454f325ce457f90445424a5cf3034f475857f90445708fe751f50f44ce8064824446fff10543c44061c84f6146434fc44e9bc44061ca57f444aaf1444543a7c6bdbcb0cf41674c82cc076b40ce076b40b3434d310ac80b6041ca0b604dc81b604dc8254c7ebe314e4686c600614764b9ae71c400614ba73ab1bcb06faac0b248394dc44061408ccf90ab70b3babca40b469ec44061408ccd01674bcf01674bc765bda47fce076b40ce43e6444543cf306f66b3bbba3c4c006147c6006147c493ce076b40ad43b6bbbac78f304bc84b604685c6006147a6b8bbbcb07785a852cf8668894540f3fa0445c84b60ce436a474543cf4f9dc84b60cc5bff45c68743191a1d1487d516c4a8c687b71713c8bdcf9dc372f8f0034f443050a746b7bcb0c08536457785ca0ab8acdb4f4445709d112dd267044527b07621ca6dc47806ff0445433b4e2d87fa0445abfcadbabcc492ce80a7eeb8bcb0c085374acd18bfa479ce85a752bfbcb0cd00bbc487c6ab4bcf4566b3bbba3cccac4178bf3947c889c738bb4f3057c81abcce88deacd0424f44ce80a7d6bebcb0cf00bbc601b9708f1e1c1a2bcd552bd76c0543cf7900f30f444537452c81f60f44ad0fa6bbba80a60657434fafa0c80ab81b18161d1880c20445101ecf9dc6943a5fc88cbb5073ef0445ca4b60c67f6b44304dff45ad9b4f4445a84a7785ca4b60ce476b1e1e80c2044510ca843156b05171e30f44ce9bca9f3148ff46adf34f4445a84d779ec88c1f86c847c18c377dc197375714cc8bb0517de30f441c4a8f305cca4e87f541a6c245434fcd55ca87bb5077ef04454a8f31ae80ff45ac334f4445c69d305513c694ba567fe40543164d8537a8cd4480c20445ca5a40e5034facbc544f44861019cfb7c897c4a63ccc794df30f44453745cf93c88cbb504bff0445c7943148ab98634543c4dc41434f44ae4ccfbf5d34457785c98ccedd7fef0445708fce86c899ace8bcb0bb1b188ccf85c0af3bce576badecbcb0bb86131d15addf684445c0f74045434f441c19173144807e84ac9bb0bbba80c2044510c49cad3f684445cad74045434f1f8610a72a62434fcfdd474f4445ab2c6345437c96ccd34b444543c4871e80c204451518cd83ca98cd8d7ab83356376085bc41376eb6e6c685c6a24cb7e11c1187c8377eb8c83f76b884ba4d3c54bebce1cc82cca546c08947c6844cb7e1bf101a8610191310c08baccc176b40cc476bcfb1ce336051a845cf4313a72ea3bcb0cd43c849ce5dc7943040c3b46433aac442c57b6d3148c849c43d426d3140c04946ae9c7ca9ce45c600614fa41fce45cf7c67360fcf4313a76aa3bcb0cd43a85bcf4313a766a3bcb0cd42c8486f4340a7cf42ca49cf43c957c09e374ac4be613a9bce45cf7c45376fcf4313a7bea0bcb0cd43a85bcf4313a7aaa0bcb0cd42c8486f4340a7cf42ca49cf43c3776432ddc4006147c491ada7554445c80b6049ca49cf01674bcf45ca0b605570a2af3ec849c47d613a14ce451face8a6b0bbcc45a460ce451face4a6b0bbcc44c4427e443c50ce45c544ce176b54cd4765bb4306c4427e443da8ce45c55cc1983b41c5b86d318ac849c47d433b74ce451fac2ca6b0bbcc45a460ce451fac18a6b0bbcc44c4427e443c50ce45c544ce176b54cd4765bb4306c4427e443da8ce45cf7c654cc83ebabcb0cf43ca0b604dc80b604dc08b5c181c111f861019c581b7b1bbbac895cfb5c88cacf4564f44c0b53a642d464e4445ce0b604d132544ad07aabbbac887c911674bcf86ab30524543a465ad5baabbbaca4b60ce90c44061ab1cbababcc64061c6b9304dc07444314001afa2c28b4844434f1a1e80c20445c0a3489c7f6b9d39674ddf23c203604743409d29674d9b39674bdf9c6f6b1d1d198ccf851019cfb7c89722ce004b2278f39836432572f7923548ff23434f44ae682979f5943b43ce80a70a46434f22cc304bc43e0b4f3148c0345c45364883065b7b690543c487ba1057cf9dc6943042c88cac14beb0bbce80111f8625f5f592abd0bbbabc8ccf8510c49c7683c60755708fcd064f2544c8005f14ce004714ce005b14ce401faca0a0b0bbc0833a4aad07abbbbac0b72930457c841e807c841e80c20445708f87d5101915ce9bc43749c6b93141708faf63294fc901674b1413c80c5015c84c14ad8facbbbac68f3142ab4ca0babca44676837c96cc10431e1b188ccf8510c49c16ab1ca7babc074bd1831487d510c49c23840c40f594c447ada3b0bbbac78f3142ab84a7babc148776831487d515c6827483c60249ca095423c8094068f298444537440c316307306baa28454543f7444543cffe44434f44fc404f4445840958cd6f0f44ae64f74445430ffe44434f44fc414f4445a840fc45434f84ff424f4445fa4c4445438802598b630445840960516e0f4482056f8069034fc43b0b4f4bc1f14f4445294f2cc5434f4414294f1615ce090c15abe8a6babcccbcba4ccb4c44434fcd4325ce3a41f0984bc0804f444525b00a41294fbb73abdca6babc0f4bc1a54f44456ece4445433c46748325442f431fbb73abe8a6babc0f4bc1894f4445294fcda7294f162dc34f4445ced90844434f16ba75a72aa7bcb01e0d4ccaec45434f75857a9f372ec3f34209424f444b374c04aeac25462f43669415bc79ac18a1b0bb054ccbc445434fbb73ab08a6babc073133a872c9c30f4e444584094cc5434f4482056b8069034fcd035729c53b47fd93314725b2ae4dcebaa5f00f44304725b0ae4125b1adafaebbbac0b7bb317ac64223c23140f4943b53ba75a782a4bcb0c185375fc7bd413a4382056f8c69034f75851d8cbb73abd4a5babc29830347ff93fd2a4f4445a8a52282054bf492ab54a6babca499861019cfb7c897cf867086fe09424f44ad434e4445cecc0844434fcd065729830647ff937683ef60e5034f22cc004983064bcf44454388075d77620445c889acf8574f4415c889ac54554f44c810071dad87b5bbbac889ace0574f4483074c0c45708f1a1e80c204451029cf0d4729c5acf298304a0a29c7ac413c48ce99b097ce9ba45f7698a4537857fd0445374879a5f00f4430477c9fae46f42345434fc19e3748cf86ab70bebabcc4871e80c20445c81f58adf3b0bbba80c204451019cf9d70b922ce004b2278f298366a2572f79234662260f1982278f1983142c88cbb165fc4b4c0b53a43ce80b01761c8bfc1b33754cf83aba0bdbabca456c4b807f405433b4efd244f4445ab94bdbabcc4821b188ccf8514c683cd8ec68c84a35f22cc8bc69584ba4d3c4cb0e4cd94c0ae47b6e91087d510c49cc4b807f405433a567683ef60e5034f22cc0049cf86ab04b8babc29c53e47fe934ad78fcf9dc794314ffb27444543a73abcbcb0cf86188ccf8525ce3c41f298304e13a7f2babcb0c0851b3b0bce13437f15533c5823b40f424443c40c51c9434e3146cfbd5f377b06cc13437585cb878715bc1f58c0833a591dc81f487e135f369625b80443424f3057c807508347455eba035faf43ab58bdbabc17f55fcb83cc8d80c2044510191314ca81cd9225ce3c41f298304e13a706babcb0c0851b3b1fcc80cab23b16c41749c804546c924c17510a336acf410d784f37517848375b785f3749ee0b3ca5af5425b80743424f30b7a848ce477f45319d09641751ca1c48ae5ac61749ca97ac68bcb0bbce1043cf0e53669546105bc0a137f3cd9d1a66b51a1d1487d5110dac3cbcb0bb1fcb4587d51019cd86ca99cd95ab44544543cea845424f44cc9bc6a6fcbc4f4445ab9cbbbabcc6b4cca1a77257434fc47967b03174ca97cda7fab0444543a7f2babcb0cda7294fcda5ab58564543c6b4ce576bac08514f44cca3a7fa4a434f1cc57f6bbb318cce8045424f441b188ccf8510c687cc9ba7d6bbbcb0784f3751c4b9593b5d794e3aa8cc9ba73abbbcb0784f3745c4b9593b41ba0843af92188ccf85101913cc851fc185372375857294fb898f8348cf5d09c4be633bbcf043cfbf68372dc4be683b1bc5b86b301ac3b43c3119cfbf1d371ac4be733a57cf5d09c4be3b3b0cc5b8173006c7943065a84bc09e3762c4ae73cfbf4c346a7dbd346ec941c34e84449bc55a03c79431a3bd82304cc68f3911a84602ae45b89c3b08370d1e6a91af02bd8ace5b05a4d8fabcb0bb4ac95102c1983b9bc5b82e3646c3a464c5a87fc4be4a394fc5a85ec4be463894c580457dbd348685a5474e9ccf5d09c09e369aba88364db39d1a7eb2cc71101a1e80c204451518cd83ca98c5a4bc4f4445b0e91b1b80c20445aa4c4445438ccf85107e9fc08333094ac7d5444543724451434f4bc8c24f4445ca8dc7a75cc250d798e317c2700f449b8a8eac403736cd87c0ad4b314fc250d798e317f8770f449b8a8eac41372ec941c394e806107a04459d86af16b4977945574f443805c686c6a150c951d194e816c47c04459db685ad463b70cc81cca64a3743c951d194e816fe7b04459db685ad473b58c847cf9fe9001c71054391bdae4d929c9ee832770543a440989b96aa1e804f4445434f4445c3b03b45434f4445434fc4ba7c4f4445434f4445e34d0445434f4445434f8c40034f4445434f4445b9470445434f4445430fd849034f4445434f441580400445434f4445436bb057034f4445434fc4d3db590445434f444563f3fa5c034f4445434f6c2ead530445434f4445ba4dd165034f4445430ff306f96c0445434f4455e69bac63034f44454365a3c1d2650445434fc4b163a9f168034f4445e37eed1aa07f0445434f40fa8a54ca71034f44458661f8e7f2780445430f327f28449a7f034f44adca4b6782c9710445432de880a837e904034fc43f54f862929b0b0445d3e32a773bc9c30d034ff0124970522dea040445e2a2888b588d970b03efc051032e151cc71d048de656d4fce620e11003754b65b768cb8e8d1704c14adbbc3d7a70c51903aa4ffc759843cae210049a0d2840888abd8d2703d966c4060f382abf2a04dbf63f6fedee8ad92c039ae28abc065b3d819c04e657d48153e8fcab7802afc8acc38603ffd0e705ef54a93b6ee259f257012411627ac2b335a33306758a73a7bad51dcea201c19abcdeb4af3be91e07c96c25185cbf6996fe0039a789b1666bc1c269009749df9f4564ebdbd50758eebded5fa78087b5001cdfffad42dfc5b621069bb7b2a8ae0e3fd6800127e1da43999b71fc7c0588d54be5e1e45ca0ec02524f3ac5c336398d0d0eabe3d67a7471fdf1a217a01e72811878c4dad719e9b4e4638f10e0cf7825ce19c49c601ec6bd9e24b7b762fced8c189ecf2aded46fce47112f806036bf1d902d2d5570ed853f86bc6a2084034fcf85107c9f2f43a7aababcb0c7bd443a582f42a7a6babcb06145bc4f44784342444537487945474f443041fc45ce801487d516c4a8c687bb4bf2465be40543c601bdce0ab815294e2e452bc772054327464543cfac0498b0bbc0833a0976831a2c24750f4421bc7f20cc638801b1474f4445ce0ab015ce0abc15294f2e452beb720543c401b913a7529ebcb0778519161d21ca5f2c2d750f44ce06b314adb395bbba80a63641434fafaa25ee50e5034f226083b022ce16b722c6a170224e8129e751e30f44cea612874510000211140e16001f0d2b372f2e2a211f0b212933272d19111b0845051f1108223c2f1322233120434f444598acdf9c6e5be405438ccf851518cd92c83f90748ac54a04b0eb1b1b80c2044510c49cce80a76245434fac84b2b0bbce93c487ad7f4f4445188ccf8510c49cce80a7c245434fcf86ab9cb5babc1487d5c08f9cce438ccf85abd4454543cb963b46a73e44434f87d5c68f3042f14ecf4dbc1eb886101913cc80c693eec8049c74831e85ac4106b7ee1acca546b0e5cd95caadcf0efbca8d31421ecf1e9fca9f3147c45faeae7690315e14cf4ec08c40ce305fc1b33749cf3e57c67042c08c580c36a27d9136ac1b1b188ccf851019cd86ca89cf73c81984ce3593c1973748ac984d4f44cc9bcab230aa111f861019cfb7c897c19e3742cf93c84cac04434f44c1833a417683111f86f34e1a1e80c2044514d9af47c879cf3b93cabb314e40f34a12cc8347b129eb314916cf339fcab230a010871d428f6d8dc83b03b91c8ccf85a84dcf457a9f304dc80f98c0833ab786f34e87d5fbb0bb45c38ccf8580c2044580c2044580c204451529cf772546b2315429c5bb438f375513c444add3b0bbba1b3b41ccb211bba41dc44cba22bf87d5111e17c1913347ba13bb7597ce03605527c45ecc5ac62d4d840e40287b0f44cc024320cc49141d1f80a67e44434fcf016763cf054fca84314dc44cf7c21fbb14bf17ac4c434f44adeb4d444580c20445c85fbb17bb8ccf8510c49cce80c454ba11abcf86188ccf85c79d3b44801f16ce53b016ad191787d5c3725ce5034f45335225442f4325442d9cb5a94bbc5a50f5034f87d5c3725ce5034f4431541f14171725462f4327a0bfae41bb5057ff0445c08b4c1d80c204451725452f4327a4bfae41bb5057ff0445c08b401d80c20445c3725ce5034f4533441f17ac9bb0bbba80c20445c686305cc80e45c57aa63049c376af304f40fa85020eaf46c08e4144828ccf85c3725ce5034f45335e1f1614ab80bbbabc1e102f4225442da2b5a94bbc5a50f5034f1d1c191787d5c3725ce5034f4533511d102f4225442da1b5a94bbc5a50f5034f1e86131dc4785bef044542395411294d2e452bacbea84db05151f30f441f1b8ccf85c80b6041b40f4043434f444ac65c454543ce7c9bb9a24ace1357cf0d573b2ab9abacb8babcc45155f30f44c09140c0b4434f44ba91ca844ac7a8444543c410614fc4086147ce7d8bb9a04a3174a79ebbbcb0c4785fef044543396dc57e57e405434f3365ce036041131eacd095b0bbc6bb4f1c4ac7e4444543c686ce076b40ce0b43af75ca8dcf01674bcf0d4fcf7959e30f44443551c4785bef044543385115ce0b604d111e14ad1b99bbbac0b7441c19173035c0074047107e9f13141a20ce581c141712c410616b2544152bcb7e05431dbb505bff0445c833606dabf0524543b0f445434f44cce34f444543c42b4dc8104082044bf47f034fc78646a722bbbcb0bba6aa6c444543a7d653434fcfcd434f4445c85ecdd5434f4445c80e4cac0fb3bbbafb4e4445438ccf85c80b6041c81b604db40f4043434f44315cc40e41840d404d780f4416151811ce2947c78446a702bbbcb0bb941e101a1efb4e4445438ccf854a8f314ffb97444543a77243434f1e1116181216131d102f4425452d9db5a94b11b06151f30f4486c80b6075840f40c6780f44ad47594445c8df4445434fcf4fcac74445434fcf074fcc2441bece7c9bb9a24a314ec4064dabe0bfbabca70eb8bcb07585c08b5021c85f1dce51c655181c111ffd424f444580c20445abf4514543c4d445434f44ce49c6cc45434f44ce0147ac30b8b0bb1fc82b6069728f1d21ca471c18abf8b9babcb0a686729dcf096747cf01674bc784462bcd47bc9e8649438ccf8516c4a8ce1647cf477edd4445833068311f72ca45438f3b5037186940434f84311f62c345434f30780b3b0aae234a35babc70c7ad413d723173a41678d54f44853c5e30786edc4445833b6a0d375c0c3167a47e68be4f44853760c7ad7e3b62ae6fff8cae69ff8dae65ff89ae61ff8bae5dff8cae59ff93ae55ff8aae51ff9cae4dff9eae49ff9dae45ff8eae41ffbb60bc4f4445c81d48ad97a3bbba1e8d4045c80b6041b40f4043434f444ac6c6444543cf795de30f44453440c901674b14ad5b9bbbbac0b7443132c4006147b3ac48b9b0bbce176b4c2f431f2cff7f0f4417bc5a5cf5034fcf19674bc57e9db5a94bc81c50ce00573058c85a54f5034fc1974ccbbebbbcb0cd9dbc9dc1854ccbaabbbcb0cf164fa7dab9bcb0cf4847ff0445c6863047bc9ecf09674bfc9c434f44ce125bcd5167a60241434f758580c20445729dc900b72bcf4f27c646cc4b88044137730445ca274ce677f9044580c20445729de571f50f44c0833b5821c8457d8d3647cf4527c64686c846c7bcbc3b4c7c423ab1ce43c6458616c4a8c687b7171314f174f3034fcf034bca843117c41a49c80f40cc06b377851627f578034f20ba732bcd65c6943a5e08c61a49c80ab8ce079740cc06b7c738bb4f3046bc1abcc09830a17683151d1c27c654ae57a6b2bebcb0ace4bcb0bbad3bb2bbbaab88b9babc101a1e1a16198616c4a8c687b7171314f074f3034fcf024bca843117c4747698c40441ca0ab876831a2c647d0f4421bc7f20cc6374b73b59c401b9c84b9ccc06b707cc1c43c738bb4f3046bc1abc7eb030a27683151d1c27c654ae57a6c2bebcb0ac74bcb0bbad4bb2bbbaab18b9babc101a1e1a161986121913fb73f90445ce3280fc484f4445b0eacb4013f90445cc4a08f3034fcd6807f90445ca520cf3034fe77df50f44cc560ff20543c20981ca4274f3034f758cc0324845364dcf4dca4278f3034ffccd530f44e657ff0445fbd7540543ec5cf5034fac34bdb0bbce064304e71bf904450b16cf54ca5a10f3034f30427f4c3946bc5bc514c803604dc686304dc80a48ce165fbb941ac401497f4c3846bc5bc5c67e63f405434f3148854a70f5034f459c7e5be40543c401490b40c128424f44ad8fb1bbba814b4486107e9f1215c4785dce3b5c41c80940ce55c4405d4295ac504c4f44c685470b30a8111b1e80c20445107e9f1215c4785dce3b5c41c80940ce55c4405d40094ccc4755c7834f0031a91d101f86101913fb23ef0445f25fcf5843ef0445c88cfb4f434f44dcb4b0c487737c84cf82c75043c88cff4f434f44dcb4b4cf9d0aca9f3098fe58e447ef0445c89fc7a74cc5d6c5e30f447698c59dcd575185ad4706c18536a91b1b188ccf85728fc34043ef0445b4975d8503f074f3034fcf1a5bc42b51bc3858ba346fcf72fa44444543bce11a1d868649438ccf8512cf7901f30f4445371822c47e57f60543fd933057cc7965f10f44453544fc51f10f44ba567ff605432544c8076b401529512c25e30f442fb6a72295bcb014addb9fbbba294fc901674b142f41272005034f2eb0ab0494babc1fac3893b0bb1f80cf7965e30f4445365c2e452b17e405432724e5034f2e45ab3894babc158745bcb0bbba414f44454e4544451019131012f474f3034ffa05f30f44c53867443055cc7a45375ecf43ca4b607683c642ba576bc77b433aabc67e4be405434f3054abe0bababca772babcb07785e04be40543cf3f6d413a4ac67e4fe405434f3140708fcd064fa7d2b9bcb0c43e6b4e324cc07244e5034f443160c43f55c6b03059c888acf04f4f44ce285fcf30537431413745c1b3374912adb380bbbaab78b8babccf3f6d423a47ba106bc43e6b4f3040abd4bababccc7f453655c77867ff0445433b42ba566bf40543ee44e5034f14addb80bbbac84ccfb5c8b4fd4e434f44b6e6a62fbabcb01e181c111f86e04fe40543a752babcb087d5cc4a40e5034fadacbcb0bb86c85fc19737538345434f4445c805bc0c3f5fb4ba09b7314f13c206bdab1ca3babc1787d51019cd86ca99cf56c69d305f844c4445434fcf0fbb06384bb3b00ebd3647c907bba76ea2bcb0c7864701319f1d1487d5c69d3061c805bc043c551417c80db8ad1f4f4445ca8d1c17c807b8ad67a7bbba1917af41b3b006bdc45fc197375bcf0fbb06384bb3b00ebd3647c907bba79aa3bcb087d5c69d304fc805bc043d4bb4ba01b7c355c69d3051c805bc0c3f41b4ba09b7314dce0dbcadf7a9bbba80c20445c68f3a6113cc844fc0afba15ab20a2babc152282074dba4543cc844d19c614b9840fbc44434f4486728f87d5101913cc80c692cc8cc6bcad87b0bbbacab6cd82c6b9304cca8dcdb5abc8a3babcc69cadabb1bbbaca741b1b188ccf8516c4a82f4325441713c4014d131e2e45e2f7f105431fac888db0bb18814b44d510191310c28b40b5bcb014c687b3cfb4ca5b60cebbcab23a4ac483ade3b1bbbaa810c92b42ceb9ba444f44386b19c9016747cf09674bfeba4c4f44ade3b0bbbac897c19e3f40c911674bcf82c884ac18bcb0bbae6fc4994698c483ce90a79647434f12ce44c4086147c497ad33b0bbbac897c19e3e4d779ec888cf96abfc464543ce8041534f44181c111f8611c6a6fc424f4445ab58bbbabc1587d57286c197376e167f493b537f094e30547905463148750e46374ac78747a4ac07010dcd94196695acabb1bbba80c204457286c197376216237845306525740e473758227e094b304b25740e43374ac7874ba4a0c6814dc78741cc8647ca9e1e6c929eadacbfb1bbba80c204457286ce4f01a6dabbbcb087d5141f15cc947e84b7ed3a46b2921745841b10adc0bdb0bb867286c197374acf0fbf9eadac87b1bbba80c20445c68f3046c80fb886c69d307ac847c18c4ccbfab8bcb0171314c687cc95c43db9c819b844b9768a3154a78244434fcdb5c801b8ce504ebead9faabbba1c111f86abe0454543c447ccbaa4ac86c69d3024c6864bc13fb2bbba785f30197847304b131eac28beb0bb1f1ba6debabcb0171314c697cc8d1fcf06bf4c02b9ab8cb9babcc683cc81c69cce08b3accca6b0bbccb9c6b4ce0db34716bfa73ea0bcb01cccb9cabb3140b00bbdab68b9babc101a1e80c68eac5fb2bbbaca85ad0cbcb0bb861019131713c69774bcc408d157ca8d314f764c304bc68bce02b30eae417e84ce0fdb50c08a3b4d4602b37d8a364d75ba093aa8c0bc3b53cc81c44061c838b8adb34f4445c87360ba744c730ea847ac74beb0bb15ca89cf01df57cdb7c68f304fc807b8448da7aaa1bcb00f30aa151cc0bc3a48c0913b47ba09b7acd0bfb0bb1f1c111f1dce6bd0baa38ccf85c68f304fc81fbc073d4bb4ba03b787d5c68f3047804ffc04060f4486c85fc1973777cf0fbb06307710c687ce01b3ac80bfb0bbcc81c447cc501fcf0dbfa7cea1bcb01cce0bb70d394dbfbb0dbb3a4cc803b7ac14a0b0bbce5014cd9580c20445aaf8bbbabc8ccf8510ca84316ec41cb9c694306309335f7c99325b6c90ca8d395a769d3a524e86ce076b4cadd7b3bbbaa85e7597a8aacd9ca8a4cf016747acd4b8b0bb1e814b4486101913cc80c69274bcca963b0bc447c0833b67c63bb745305eccac4dc08d4d15caafacbca1b0bb1dc08f4ccc40c634b9854b4245a867cd95ab5cb8babcc683ce40ca843153c6bece0bb37db43f4dcdb4ab80a7babcc69cad73b4bbbaca741b1b188ccf85c85fc19737418345434f4445131dac6088b0bb1d80c204451019cd86ca99cf46c68f3049844c4445434f14ad4b84bbbac08c400b36a71a1e80c20445728617cf094e1212ca8cc9315245cf395249cf53c80940449bc456fc424f4445ab68444543cc824d0c30a3cc9b101a1e80c20445c07248e5034f443144b05149e30f4486f35fac98a1b0bb86c0b6444ac7af4445431f171314c687cc95c68b7491c542cf154e784f376a784e37717849371e78483713784b3739784a4ccbc045434f78544ccbcf45434fadd2434f44c6ba4ecd9d3c45ac14b9b0bbacd24f4445ca85ac2cb9b0bbacc64f4445c0b645cc9b3043ad4fb0bbbaa838cd8fab54bbbabca42acc9bcc8755ab28bbbabc003bb6a81011cc96c4106b49c69c461f6146ce0f6142ce51a726babcb00b3aab12af0416c691cc9b4c186b41c6b6ad43b0bbba0c30b418a864cd9dc08c40addb4944450c30b7ae5fc69cccb1cc8741ab0c444543003bb4a8441b1b1817f447aab8a5babc101a1e1b8ccf85f35eadaca2b0bb86111fcf01675fb36167c685ce076b40b2276b484482c44061b42b604942851d1c81474486c847c18c377c8345434f4445b3b00dbd366814cc8b7e8dcf094ecf115249c1973741cf0dbfca8d3144c456adfbb1bbbac0a74cad87afbbba1b8ccf851019c581bbb1bbbac897c73e534f316e2b4a454543c20061471fcf06471fac948bb0bbce87fd45ad2b4d4445c8bfcd3653cab23045c40741ca0c54ce005fc5814b4e44451d1487d510191314c897cfb1e267e40543c642c67d4f306ec8497f1d473b4ace45741c4d3748cf437817483048c442adcbb0bbbac8b7af48c849cf45ca49c77b433a91ceb8c4831f1c111f8616c4a8141019c930bfc642ae49c44215ab488cbabcc642ce45c55cc1983b41c5b81331acc8491a1e1a1287d516c4a8c487ebb9babc1c1212ca1abccc06b3cf00bfc601b12bcb0e0543a75a8dbcb0cfb5c6b930012bdb0e054319ac508bb0bbcc06a7c738ab4f30752b4a454543c2c1e0beb0bb15c80ab815bc1aacc0833b5dce06b714c8c6eab9babc1fcf00bf1fac4c8bb0bbac7f4e4445c80ab8c57b133104c80ab8c53b4e184ac668454543c401b9c08f46ad0bb0bbbaca0ab4ce06bfc47d4340c048424f44ce06bf04ad73b0bbbaca0ab4ce06bfc47d4340c0b0434f44ae4ac401b9c08f46cc06bfcf18b36419b9ce0c4515c80ab815cecae1b8bcb014addb88bbbaaae4444543c401b503a7aabbbcb0cd00afc439a96832b4ce844c87057e4a45454340cbec434f440214c401b513c2c1e0beb0bb46801fac1884b0bbc8c6e5bababc1fc9c0e6b2bbba13a7ae83bcb0cfb5c0b1bb313819ac9085b0bbc8c699bababc1fac7c84b0bbc8104e478703724144434f3b1985cb59e0beb0bb19fb4a45454364870d13c2c193bdb0bb15cecae1b8bcb04786031facb885b0bbc8c699bababc1facbc85b0bb054097cf00afc601b5c80ab4c57b4f4bc00ab0bbbac80abc15cecae1b8bcb014ce06b314ad8b89bbbac80ab01a1d14cfa01e8c4445282a362b262377776d2b2829434f4445042a30092c212315223b2c0b22222104434f444516c4a8c48793bababc1ccd00bf274144434fc9c09cb1bbba132544ad0389bbba850aaa45ce0abc152b56444a4325442daf0304452b4e4445c3a73683bcb0c185370fc900bb1f2c5c4340442f4327a809034f2c47434fc4ad1789bbbac68f3067ce0abc152b56444a4325442d4b0204452b4e4445c3a77283bcb0c1854ccacd45434f77851627e80e034f20ba732bcd65840aac40434f44c8c690bababcf54144434facc4beb0bbc806a714c806a1142f432544c8c690bababc1fcf00bb1facb086b0bbc0833b66c806a714c806a1142f4325442d6b020445c80abc15ab9881babcca8431478901ab438901b7437c841f1a1620cc5327f70e034fcf00bb1face086b0bb86aa68abbabca4ab2d464e4445c80ab815ceca9bbbbcb014ad3b8abbba294ac900b01f2e46ab1c81babc1fac6086b0bb7698cff99abdb0bb454ccbbd45434fc438b04f314fc332aa454ccbad45434fc9c09cb1bbba13a70680bcb0c9d09cb1bbba408dcd00a7a447ba0eabcf00a7cf7c6b3744c9c09cb1bbba780aa030a9c2c19abdb0bb7e06ab4bc1e84f4445bc0aa0c53ea144316fc411a1689ffc40424f446e811fc900ad1fcf00a71faca087b0bb2f412544c8c690bababc1fac8087b0bbce9bca9f3031cf39b6433b28c8c690bababcc411a1689ffc40424f446e811fc900b01fcf00a71facec87b0bb2f412544c8c690bababc1faccc87b0bbce9bca9f30758901b043c2c19abdb0bbce16ab6f95fb4a454543648615ce0ab715c80aa015ab2080babc25462f43c2c19abdb0bb15ab0080babcc49cce8014cfa01e8c444510202231342e36201f0d2b372f2e2a211f032b2622232136434f444510202231342e36201f0d2b372f2e2a211f0b212933272d190f2027242f2a3745434f444516c4a8c687b7171314c601b9e263e40543c601bdc032bc453776778516272308034f20ba732bcd65c812bcce06b3bb16477c841f1a1620cc53a44eac03a3bbbaab54aababcc401bdc84fcd00bbcc39bd433a831a1d141d1c1e8ccf85c85a6ce5034fcd55e067e405438ccf8516c4a8c687b7cd00bf7c84102b5e0a05432bbb7527c664ce06b3cf0547a736babcb0778519161d21ca5f2c5d0d0f44ce06b37f406bef04453643cf00bfc444e66bef0445a87de56de30f44cc06b7c738bb4f3061c80abcce437401b93643cf00bfc444ce16b7cd47a841cf00bbc444cc06b7c738bb4f319980a686a9bcb0afea1a161986c85fc19737418345434f4445131dcf47bc1f4c1d80c204451019c58147bfbbba13c4b6ce9bca9f317ece3f41434f45453e652c45534f44c8076b4015c80c4015c84ccf45abb8bdbabc1fac8881b0bbce8bc490ce85a79eb6bcb0af4fc889cf1647a7feb1bcb0c581435f44451d1487d516c4a8c687bf177691c611b5709d112db101044527b07621ca6d2e42ce1ab1172b4b5445431fac0c81b0bbc806bfc910b6f64345434faca8b7b0bbce06bfc910bfa756a6bcb0cf9dc032b845374d779e708f1e1c1a2bcd552bb60a0543c201b5ab20b6babc8cada4a8b0bbaeb3c4871ec8aa198616c4a876831a2c0f0c0f4421bc7f20cc63b041f1f60f443060f70cf5034fac3ca3b0bbfd57fd0445ab20a4babcf7a4f6034fac20a3b0bbadd384bbba708f1e1c1a2bcd552b1e0b05438cadcca8b0bbaebb1287d5c062f0f0034f454ac08a44454389414de30f4447844a50f5034fcc55034f83405bff0445db5f0445854a02f5034f4682464ff40543e3030543a76aa3bcb0c085374aac10a5b0bbad57a8bbba25884109f30f44f5942983405bfd0445f398228246abf70543ff93ad738ebbbae073f40543a7fa84bcb0e77df30f44adef8ebbba664f4445c372444543cf3068abd485babc6abb45434f22c6bb4b3249844afcf0034f4745434faf65ab6885babca7c2bbbcb0e7fdf60f44ae4ca75284bcb0ac30bdb0bbe6fbfa0445ab1885babcec74f5034f87d5bc6ae084034fcf85bc6ae484034fcf85bc6ad884034fcf85bc6adc84034fcf85bc6ad084034fcf85bc6ad484034fcf85101ecf9d102504ad87b0bbbaca4b60ce476b1e1e80c20445fb474445438ccf85101eacb4bcb0bbce9bca9f317dcc79d5e30f44ba3645fca7434f44adffbfbbbac88cacfcbcb0bbcc476bc779674f3149fbad444543a7e6b5bcb0af4ac84b6015e2dfe405431facc8bcb0bb1f188ccf85fb47444543ca84315ca726babcb0e7d5e30f44addbb0bbbae2dfe405431fac18bcb0bbe62ff9044580c2044512f74c45434fc1853769c778d3ef0445bc3b59e4d3ef044513a772babcb0cd4167cc7861433b4dce476b14ad4fb0bbba198ccf85fb47444543ca84315aa7fababcb0c778d3ef0445bc3b4fe4d3ef044513a7b2bbbcb087d5c94218f3034fe5d5e30f44c18a3a6221c85a6845434fcf41c18cac48bcb0bbe4d3ef044513a796bbbcb0c185374e87e42ff90445801fac84bdb0bbc0833b9f86fbdbe40543a7b6bebcb087d5f9dbe40543cc3949423a6e1511894119f50f4444c8024ccc4e2ff20543c60e41840d4c45434f448201434445434fac84bcb0bb1f1bb07121f50f44fcefef0445ab10a8babc8ccf8516c4a876831a2c40110f4421bc7f20cc63b0412df50f447683151d1c27c6542d4f1d044580a68aadbcb0afbd1e8ccf85c0622cf3034f458616c4a876831a2c78110f4421bc7f20cc63b04135f50f447683151d1c27c6542d071d044580a6d2adbcb0afbd1e8ccf85c06234f3034f4586bc6ab884034fcf85bc6abc84034fcf85bc6ab084034fcf85bc6ab484034fcf85bc6aa884034fcf85bc6aac84034fcf85bc6aa084034fcf85bc6aa484034fcf85bc6a9884034fcf85bc6a9c84034fcf85bc6a9084034fcf85bc6a9484034fcf85bc6a8884034fcf85bc6a8c84034fcf85bc6a8084034fcf85bc6a8484034fcf85bc6af884034fcf85bc6afc84034fcf85bc6af084034fcf85bc6af484034fcf85bc6ae884034fcf85bc6a5887034fcf85bc6a6487034fcf85bc6a5c87034fcf85bc6a5087034fcf85bc6a5487034fcf85bc6a4887034fcf85bc6a4c87034fcf85bc6a4087034fcf85d1a7fe93bcb087d57086ace89fb0bb8616c4a876831a2c28100f4421bc7f20cc63b04131f50f447683151d1c27c6542d371c044580a622a2bcb0afbd1e8ccf85c06230f3034f458623f90445b3b0444523f90445b2b0444523f90445b1b0444523f90445b0b0444523f90445b7b0444523f90445b6b0444523f90445b5b0444523f90445b4b0444523f90445bbb0444523f90445bab0444523f90445b9b0444523f90445b8b0444523f90445bfb0444523f90445beb0444523f90445bdb0444523f90445bcb0444523f90445a3b0444523f90445a2b0444523f90445a1b0444523f90445a0b0444523f90445a7b0444523f90445a6b0444523f90445a5b0444523f90445a4b0444523f90445abb0444523f90445aab0444523f90445a9b0444523f90445a8b0444523f90445afb0444523f90445aeb0444523f90445adb0444523f90445acb0444523f9044593b0444523f9044592b0444523f9044591b0444523f9044590b0444523f9044597b0444523f9044596b0444523f9044595b0444523f9044594b0444523f904459bb0444523f904459ab0444523f9044599b0444523f9044598b0444523f904459fb0444523f904459eb0444523f904459db0444523f904459cb0444523f9044583b0444523f9044582b0444523f9044581b0444523f9044580b0444523f9044587b0444523f9044586b0444523f9044585b0444523f9044584b0444523f904458bb0444523f904458ab0444523f9044589b0444523f9044588b0444523f904458fb0444523f904458eb0444523f904458db0444523f904458cb0444523f90445f3b0444523f90445f2b0444523f90445f1b0444523f90445f0b0444523f90445f7b0444523f90445f6b0444523f90445f5b0444523f90445f4b0444523f90445fbb0444523f90445fab0444523f90445f9b0444523f90445f8b0444523f90445ffb0444523f90445feb0444523f90445fdb0444523f90445fcb0444516c4a876831a2c60150f4421bc7f20cc63b0413df50f447683151d1c27c6542d6f19044580a6eaa1bcb0afbd1e8ccf85c0623cf3034f4586c7190445434f4445434f4445c7190445434f4445434f4445434f4445434f4445d51904454f4f44454f5f04454b770445577704455b7704455f7704455377044597790445b37904454f7804454d4f4445434f4545434f4455034f4045434f4d003b2c213537262b2baf190445434f4445434f4445434f4445434f4445434f4445434f4445434f4445af190445534f44457b1904454b770445577704455b7704455f7704455377044597790445df3804454f7804454d0a0c20223f013d202a34312a202ad50b180445434f4445434f4445434f4445434f4445434f4445434f4445434f44450b180445534f4445e31904454b770445577704455b7704455f7704455377044597790445df3804454f7804454f0a0b303700220826222b373ac20445e7180445434f4445434f4445434f4445434f4445434f4445434f4445434f4445e7180445534f44457b1904454b770445577704455b7704455f7704455377044597790445b37904454f780445480a0d2b0c3a3000313d2b37bf180445434f4445434f4445434f4445434f4445434f4445434f4445434f4445bf180445534f44457b1904454b770445577704455b7704455f7704455377044597790445b37904454f7804454a0a013d372a362b2223cf8517170445434f4445434f4445434f4445434f4445434f4445434f4445434f444517170445534f4445f31804454b770445577704455b7704455f7704455377044597790445b37904454f780445510a013d372a362b2223013d202a34312a202ad5f7170445434f4445434f4445434f4445434f4445434f4445434f4445434f4445f7170445534f4445f31804454b770445577704455b7704455f7704455377044597790445b37904454f7804454a0a0d2b370a36372c3dcf854f160445434f4445434f4445434f4445434f4445434f4445434f4445434f44454f160445534f44452b1704454b770445577704455b7704455f7704455377044597790445b37904454f780445490a002c350d3d1f263d2bd527160445434f4445434f4445434f4445434f4445434f4445434f4445434f444527160445534f44452b1704454b770445577704455b7704455f7704455377044597790445b37904454f780445480a16242d282100313d2b37ff160445434f4445434f4445434f4445434f4445434f4445434f4445434f4445ff160445534f44452b1704454b770445577704455b7704455f7704455377044597790445b37904454f7804454f0a0d2b370032203129282a34c204455b150445434f4445434f4445434f4445434f4445434f4445434f4445434f44455b150445534f4445f31804454b770445577704455b7704455f7704455377044597790445b37904454f780445490a092437270137312036d533150445434f4445434f4445434f4445434f4445434f4445434f4445434f444533150445534f44458f1604454b770445577704455b7704455f7704455377044597790445b37904454f780445490a0d2b352e282c270034d58b150445434f4445434f4445434f4445434f4445434f4445434f4445434f44458b150445534f44458f1604454b770445577704455b7704455f7704455377044597790445b37904454f780445480a1e203120002c3526202063140445434f4445434f4445434f4445434f4445434f4445434f4445434f444563140445534f44458f1604454b770445577704455b7704455f7704455377044597790445b37904454f7804454a0a0b33263d22292c38cf853b140445434f4445434f4445434f4445434f4445434f4445434f4445434f44453b140445534f44458f1604454b770445577704455b7704455f7704455377044597790445b37904454f780445490a112b272a36232f2033d593140445434f4445434f4445434f4445434f4445434f4445434f4445434f444593140445534f4445e31904454b770445577704455b7704455f7704455377044597790445df3804454f7804454c0a0d2b352e282c271f2b2c2d3b21376f130445434f4445434f4445434f4445434f4445434f4445434f4445434f44456f1304454f4f44457b1904454b770445577704455b7704455f7704455377044597790445b37904454f7804454f0a0d2b352e282c270c253637c20445cb130445434f4445434f4445434f4445434f4445434f4445434f4445434f4445cb1304454f4f44457b1904454b770445577704455b7704455f7704455377044597790445b37904454f7804454e0a072a2d392137370a36372c3dcf85a7130445434f4445434f4445434f4445434f4445434f4445434f4445434f4445a7130445534f4445f31804454b770445577704455b7704455f7704455377044597790445b37904454f780445530a0526202a373615262b29223b2d2a2dc2044507120445434f4445434f4445434f4445434f4445434f4445434f4445434f444507120445534f4445f31804454b770445577704455b7704455f7704455377044597790445b37904454f780445490a14372a392d29262821d5df120445434f4445434f4445434f4445434f4445434f4445434f4445434f4445df120445534f4445f31804454b770445577704455b7704455f7704455377044597790445b37904454f7804454d0a1731222c2f0a352a36232f2033d5bb120445434f4445434f4445434f4445434f4445434f4445434f4445434f4445bb120445534f4445f31804454b770445577704455b7704455f7704455377044597790445b37904454f7804454a0a072a2d3b362a2f0ccf8513110445434f4445434f4445434f4445434f4445434f4445434f4445434f4445131104454f4f44457b1904454b770445577704455b7704455f7704455377044597790445b37904454f7804454e0a12243126252b370a36372c3dcf85ef110445434f4445434f4445434f4445434f4445434f4445434f4445434f4445ef1104454f4f44457b1904454b770445577704455b7704455f7704455377044597790445b37904454f780445530a0536302a36312a202a032226282027c204454f100445434f4445434f4445434f4445434f4445434f4445434f4445434f44454f1004454f4f44457b1904454b770445577704455b7704455f7704455377044597790445b37904454f7804454d0a0527303b3624203b0137312036d52b100445434f4445434f4445434f4445434f4445434f4445434f4445434f44452b1004454f4f44457b1904454b770445577704455b7704455f7704455377044597790445b37904454f7804454d0a0d2b37290724303b0137312036d587100445434f4445434f4445434f4445434f4445434f4445434f4445434f4445871004454f4f44457b1904454b770445577704455b7704455f7704455377044597790445b37904454f780445510a1724252a27242f23013d202a34312a202ad59f100445524c6a72774b4445434f540543074445434f54054347173c301a302c2f3ccf85432f0445524c6a7d774b4445434f540543074445434f54054347173c301a302c2f3ccf85bcb0bbba424f4445674f4445101913cebac4b6ce9b1913ce88fd45e47f130445ab8c524543a7829fbcb01b1b188ccf854b8631524a8f3d4bb497ac42434f44f56e0e0acd458cfd4f434f4417157e96b2b201c48773cfbe7f314cc48744c7524c833aae1c1966b56c8939544492ff746c95a447cd477d0e30b9c742864b863175fa45444543b80441434f44c5376dbb3547b074cca3b85861c01b604143b8186147a74e45434f8203bc620a04c08b4c8615cca8419a3360479a736023c24360454c96686125c648619aa7b305474f4445c33b63ba334bbb75c22b6041bcb0bb3a2bb0bbba3c27bbbabcb09b2967479b696797869b82cc8055a84d9b6d9c4b609c82019dbd9c536099bac54061477f787f314d4042cb499d849b9cdf9aa3d137a49a236047c08b4098809286988292841c6abe6d8f355f6d93f37f4594a84ccc41710531bfcb4987d5101ecf9fc89bac3493b0bbc67f6b443141c4871f188ccf85bcb0bbba424f4445734f4445bcb0bbba414f44456e7e444516c4a8c487fbbababc1ccf9dcecaf0bbbcb014ce80a7cea6bcb014adfbbfbbbac0b7bb31771face0b3b0bbb3c6fbbababc5f3160ce0ab015ceca8cbbbcb014adc7bfbbbace0ab815ce0aba15ce0ab015ab24b4babcca8430448801b9bcb0bbbac80ab81ec8aa198610c49cce80a7cababcb0044ad68f1f8610191314c8bdcf9dc889ac84a2b0bbcebbc487ad57acbbbaca4b60c0bc316dcf1f71bbc1983b58ce90c44061ab38454543ca84314dc493ce85a73659434f784736490b0ac6b03b92c8881e1a1d1487d5101913ceb9c49cce90f7d027034facd8bcb0bbceb318c91342f6bbbabc30cf86ab40a7babc101a1e804f4445bcb0bbba414f44451f75444516c4a8c687ab17ce0647c185374acd00a7a4417683c601a1ce0ab415ce0ab015ce0abc15ce0ab815c80aa015abf0abbabcc49cce06b3b328bb7c96cc06a7cd10afc401b1709d1615c80aacce16a3ac8ca7b0bbce0e43cd44ca1e40ce06bf7797111fcf00abc411a9abe0a0babcc40955ca4ecd1447c4871ec8aa1987534fcf85cab5cd82fab0bbbabc7d84b7edf7bababcb06d8dca9887d512c64061d1a7fa83bcb0cf41671587d5141917cc85c693cc887d84c08a3b41b7ed3a45046a84cdb2ca99cdbfca9685ac41bce1cc9acca546b0ebeecc93141a1a80c20445141917cc94c682cc887e844c8a3b6bb7ed668fcc9ac6937491bce23162c502ba7f2e36437f3533476f6fce12bccfbe243147c4bf393847c5a96f6d9537941f1b1c8ccf8512c488cc42a448c1833a427683c645ae49b045ce42c5447f933aa8ce421587d5101913c68797cf9cc8bdcfbdc0b45b3346f45b45434fcf9609c482adaf5544457f4e314408c480ce88c492ad6bb0bbba854b5845c88bcd01676f8201676b42c8176b64ce47f24ce4034f778cab4cb8babccc806d1c111f8610c449bde00f44c67a4f3049c852bce6034fcf5ebc9c1f86f35fac0886b0bb1e80c2044510c49cce80a74698bcb01f8616c4a8c687db177698c619a9101913cc84c68a7483c601b9400254cc3eb77585ca0ab0cc06bfcd00af4696314e768a314ae378603741ee0f36bccdbd680abcac604c44457a8130b7ef736131aac21abbca12accd06a87868364a7d8b3793e8ad3d4f44457f75314fca12b07c8d3b8fe9a8aecd18a3f4bbbabcb0786b36457d8b37f7e8ad194f4445ca1298cc36971517abda44454315cf18a3668f36417e9fc53ea8693049668e36474e957491bce0c29a668e36474e957491ff64b6e9c89d6c893c4044927e96b6e7cc39b5433b4e17ce0ab4ad5fb0bbba1916cf309ba603babcb0759e7f6530677f7f36787f76337c2a944e45434f68754cf9844480768a3140e3afa11ba674babcb0cf00b774014d3c5dbb00b7c41949c333874143c45886374d759e7a813099ef8c609acb8efc44434f44ce1ebb7f184b3018ba06bbcf304fc2709bc8494bf3154bbb61d6fe2105430d220543ba210543342205430d230543e42205436c2305434c230543ba210543ba210543ba210543f3220543a822054371230543c5220543ba2105438c220543432205437e84adf84e4445c81aacce0e976d94c812b8ad8fb2bbbace3af3ce1693c7bf6339467491c68fc5aa0b4bc13bb5bbbafa5f444543cfbf1d4ccb2ebfbcb0fd4f434f44c5b81a4bc11fb5bbbaa8fcc930e4c41199ca84c7bf5339467491cfad014ccbb2bcbcb0fd55434f44c5b8174bc1abb6bbbafa45444543cfbf104ccb9ebcbcb0ad3fbcb0bbc5ba1c4bc032b0bbbafa4e4445438cc4bc1040c127bcb0bb23c07745334cc686c806bfacc8beb0bbce36bfaf0f728687c5ba1c4bc002b0bbbaca89e84af587af78fd23070543a441fb8f0c0445403ab8c5ba1c4bc062b0bbbaca8dc900af1ccf18bfb0921ec83aa8ccb3a44fc5ba1c4bc046b0bbbaca894db337fdcf0bbf740999344e87ce0e9387c5ba1c4bc0aab1bbbaca8913cc847d84ce0e93a740b1e131440cc6bd6cb21087c5ba1f4bc08ab1bbbaf947444543f65445434fc930e4a656bcbcb0f344a84df345ca89f745c3b603317cfc45c5ba0a307df04dc4bc053b56f640cfbd0b3744c4bc0e40c1cfbdb0bbf647f75645434fcf109f76863366f54645434fc4bc0e3a5f4af55ac0f3034faf57c80a98ff404f4445c0b7563346f74b45434f171511c201d2cabd4bf38cc419b9abdc454543c685c836d8871613c201a9c812b8addf96bbba1b1487ada8b0bbba1c111f1ec8aa19874f4fcf8516c4a814101913ceb2c4bece9bca9f316bcab23167c482ad67b4bbba13c4014913c4014d13c48ace80c493ad1bb3bbba854b4745ca12b8ae467c84cc06b3cf00bf101a1e1a12864d43c2044516c4a814c8024cd4c49eac40434f4418814b44d516c4a8c4874bb4babc1fc781bb1c1212ca02bccc16b3cfb5f84f544543c401b9abcc9fbabc724449434f396dc80ab8ad3794bbba13c401bd13c4014d13c409b9cecabcaabcb0feba4c4f44ad9bb4bbbac8b7af49c80ab8ad0f94bbbac897cfbec88c0c7ebb3302ae714c9fce85a7f29dbcb0cf83c89cac649eb0bbce06b3ac6098b0bb15c80abc15c80a4c15c802b8ce9005cf43abc0bfbabcc4bcce80077fbd3e88cf83c898acb49fb0bbae4cc2d1bdacb0bbce85c48bad1f96bbba1c111fcea612864143c20445157eb2ef4b943141729daf4f4a9d3943f362b39fa8494ca1374ccca5e9dd14cca07e96b2f553e50543cf8675cb5c070c4a8f31a84a863bac08c547ef7aac31bd1b1187d516c4a8c6879b131310c601b9e3ccf20543c701bee3cdf20543c701bfe233f20543c601b1e3cff20543c701b6e3cef20543c701b7840aa845434f44fd504f4445c3b6443054c40149c0b7463846f74645434fc7bd513141fd514f4445ca0a4815fb40634543cf3955413d47ce064714c8069bac18414f44ce3eb34bf2069b69ba3c4f44c6bb4d375fca8eac35434f44c8f706702f034f4730aff64745434fb7e1a862c9309440f21853cfbf44375fc4be47384d4afc0a907e06433a47f04fc959de6f2e05434c19a9c8544718afb097ccbb6401b918111bacb24e44450e250445ea250445a3250445a3250445092404450a01020b0201e84d833a47f5730187c53e99443140ff69ef80a7b5babcb04bfa0e9b75977802483a5eccbdb83f574d8c3c55f475e9cf7a453775ce00b8e5b39cf37fb7efa855fd44434f4407ef47843154e5a6bdef47843150c780cf06b422eeef47843144e5afbdf37fb7ef4a9d3041728faf5b80a7d1babcb0acc2bcb0bbcf26b422eec802480cab36bbbabce5a6bdf764cf084bccbd41354d758cf30ace189440fb109705ac64bdb0bb86ab11bbbabcc4114dc0b5563746f55645434f4bfa0e9b4d8c3c4af475e9a46e7498cf3955413b4ecc8b07f746b5bccca600a760babcb0ee0c37400f30b7c501bfc78f30a8e9fc47aeab4696315fc501bec78f3044e9ac4df573e50e314f0e31bcabbabababce50e30b48c759ec912b7fc404f4445c33292453747ce18b1f64b41434f7c8e354dcc8e43a4c9d9d8e22f05434c19a9fa4a444543c54779033b5a141073603144736e3149e5af49ab42444543a441ad0eb0bbba181607a79f8c12ce36bbc1b3374acf0bbfbce01b806b6e05030f6e61030f046163650405696f60050367606f6a0f6961690f04616e6504056765690503676e616a0f696f670f046f6e6b0405696b690503626e65670f69616365046f636b6905676f6e68036b6468690f6e68636b046d676f6e6c6b6564616ac4a118814344d516c4a8c687af131310c687cc958801b9434f4445c3b6443149a77544434fad45414f44ad464f4445aab945454329cf034bc68660bc304445375179ba3c4f44306129b303454fc43152cc7a453646c53b474f4445c33b4705729d8206404fad88434f449e6d62bb7a434f2d855302444582b75405ca0abcfd514f4445680abc9ca21ccf18bfa76e83bcb01f9cbfc439b998e054e4034f9c9cd89239b3d829b300b54f05314a95f359e20f44ba06b79b30abc23f46f946444543d4ce0169a8cc8183a740c5a7402240737f22ee093aaf7783e5cf38bb4c394d3a487585aa38bbbabc743949314ccf384fccbb573068c439784c71376689007e404f0b3d4eb1007e40cf387e407633a8a8502282004c7545bc0abcae57f05645434f8201784c440a3b56c439784c7431b229cf134bc401bd258eae4a25c647cd104d877491a4aa4f434f4421434f44ad404f4455644f44ce45c41241ca8e4d944ccbf345434f4d973a48b39fb497c79f437e8dce3e474dba3e4d75bac0b040395cf04045434f0568434f20e2c295f7f3a34237b70a4a444527e8c597f0f9a448ca0aa4cc16ab9b28a3c6befd474f44456a9f304fc832b89ff7c81728034f9b30abc23f46d8468d3058f64d45434fce016aa8cc8183a740305dc7a4614c3a5b0c36a3af7ccb874075e9f64d45434fce016aa8cc8183a7404173e5cca567404075e90631afcab7c909504c6d8d8548440ac3707431b4c4124182a55bae447e847491c7074625c647cd104d871e1d10cfa01e8d4c4516c4a8c4874fbbbabc1c12ceb2c4194d2b4f454543c2c945bcb0bb14111fac6ca7b0bbc0833156ce8b06c9d043b0bbbac88cac9090b0bbae4ac487ce95a76a96bcb01a1ec8aa1987474fcf8510191314c896cfb7c8b72e47ce0b6041131913adabacbbbac68f3a40c94b60ae41c4871f1c111f8616c4a814101913cc0eb3cfbfc8bfcf184b1ccf0053c404b97086cf93ab24bbbabccc7f453642cf00bfc440fdc89cac0c9cb0bb1a1d141d18814744d516c4a8768a1e1514121e15161518778516274335034f20ba732bcd65abe4a7babcc601b9f84e444543f1e0f3034ffb91f50f44102944c900b71ffd65e20f44ce9005c9060707ac3cbcb0bb1cc81ab0ce85a72e97bcb0112f48c201b513f614e4034fcf9609c2077d0ba712babcb01dce16bfcf82ab0896babc0cc78247cc8241c0b44930edf44545434ffa41f40f44fa63f80445ce0c41fc444f4445dab8bdcc16b7112f45c201a913f6c4e4034fcf9609c401bdc08f75ad4bb0bbba1ac411a9c889acbc92b0bb102949c900ab1ffdd9e20f44ce9005cf00bbcc846fabacbababc16cf10abc483ad979ebbba00cc8341c08940c6b84731d9708f1e1c1a2bcd552b41340543c201adf94b444543a73a94bcb087ac8f85bbbaa8a41b1b18c4a11880c2044516c4a816157cb2fe424f4445a849c7be443b5b06c073d90df40f444536bfc941de07f30543c4114dabb896babcf14545434fcf831d141987474fcf8516c4a82f431c1276831a2cfc330f4421bc7f20cc637cb2fe424f4445a849c7be443b6806c073d921f40f44ba36bfc900bfc4114dabe096babcc401b9709dac94b3b0bbcc47d220f2034ffa44434f447683151d1c27c6542d833f0445ce0ab8adeb9fbbba80a65e8fbcb0afb5c8891a1e1a12864143c2044516c4a82f4319778516272734034f20ba732bcd65ce0ab815ab98a5babcf63c34034ffe4e534f44ad0fb2bbbac80ab8ff424f4445ab2cb4babcc4b4ce85cc84b8c0a747367f254013abe8a5babc1f2c5d330f44ad6faebbbaf948444543f72cf2034f8345bcb0bbbac08f400f36bb2e4615a73aa4bcb0142d173f0445ab4ca5babc7c841f1a1620cc53272e34034fc900bfa7ba8abcb087ac3386bbbaa8bf1a1c1e8c4445bcb0bbba424f4445724f444516c4a8768a1e1514121e171314c4beceb37c84102b093705432bbb7527c664fe424f4445c888acfc8cb0bbc806b714ad53aebbbafa13370543f54d55434facc0bfb0bbce06b7fe44434f44addfa0bbbac08fb9c6ab4c4bc7074e4445e20ff30543ccac413743c785b0ccac47314b7785a84df444c78f3070a86cce015db06802375568653759c900b7c5105bbca75a94bcb0cf10b7c483ad939ebbba00c482ad839ebbba78973a97aa4d454543c483ce95a7c68abcb0adb1434f44cf0751bb60bc4f44454cec419de30f44366dc497ce85a78e49434fcd00bfc201b513c409b9c89ccf83ab6097babcc411b5c888ac3c92b0bb461eb3ade0434f44ff233c0445ce0b5abafa4d444543a7aeb5bcb0c1853640cf82f923370543a70a94bcb007ae3df53436034fc9015db0fd41434f44ad87bfbbbac68f3154c888fec5300f44ad6b9ebbbac08c47ae15f5cc36034fc9015db0fd47434f44addfbfbbbac68f314ac888fed1300f44ad439ebbba00a474cf0751bb691a3b4069633a4ace84f5e436034faca093b0bbae55c201a9c91b5abaab5494babcc411a9c888ac8893b0bb06c889acf893b0bb7e9b40ca49bcb0bb7683151d1c27c6542d0e3c0445ce0aa8ff474f4445ab708ababc8cadc884b0bbaea8101a1ec8aa1986bcb0bbba424f4445724f444524284445bcb0bbba404f4445242823453a363d3c434f4445bcb0bbba474f4445262a2120434f44453a364445bcb0bbba414f4445262a4445bcb0bbba424f4445264f4445c68f30406e4f5445438ccf8516c4a8c487ebbfbabc1c1212c8b6cfb7c8972e59ceca88b9bcb01413ab589bbabccef999bfb0bb45534f44305f274144434fc9c0a9b2bbba13c4c195bfb0bb15abec9ababcca843060274144434fc9c0a9b2bbba13ee24f3034f14adcb91bbbac889acc8bcb0bbcc06bbaf4c68fa94b9bcb0cd30b7c2c1afbeb0bbf71fa7624e434fcf9501c2c1aabdb0bbfc474e4445abb4aababcf70430034fcd00bff70430034fcd00bbc487ce5677120543a77a86bcb0c0853766cf0647a78a95bcb0cd00bfc401b9abd0aababcca843151c411b9c33346ba6d3b4cfd073a0445ca0abc2d434e4445cecaaeb9bcb014e4bfec0445c80f4015e22ff20543a7ea96bcb014ad2f91bbbacedae0bebcb0cf46abb085babcc2c1e1b8b0bbccc6ebb8babc89c1edbfb0bb41cecaabbbbcb0cdc0efb3bbba85caf4b9bcb042ce06bbcdc0f7b3bbba85cafcb9bcb041ce06b3cdc0ffb3bbba85ca84b9bcb042ce06b7cdc087b3bbba85ca8cb9bcb042c8c6ebb8babc1f2e41cec2aeb9bcb0cf104bc483adebbdbbbac888aca4aeb0bb1a1d14cfa01e8d4045434f44456d4f4445c28bf8bebcb02c45474f44c80f6b0cad17b1bbbae2f7e70543cf7c453711e551e00f44ad63f5bbbaab7cf0babcc20061071fc901670714ad3f92bbba294fc901674b14c8076b08adc7a2bbba13c20061131f2eb1ab4099babc1fac0c9eb0bb2f43c20061471f2e472b4332054325b0adb793bbba13a76a98bcb0af73290fc901674714e4b7ed0445c80f4015e22ff20543a73a97bcb014ad7f92bbba2b5f644543c200614b1fc9016703142f43a76a98bcb0c581074b4445804f4445bcb0bbba414f44454e454445101913c1913b4cc687bfac6081b0bbceb2c49ecebbc20341c899acc088b0bbce84cb9f314ca72687bcb020ca464f444543cc8049c8881b1b188ccf8516c4a82f431c1212c79d304dc08bb4ada78ebbbac8becf9fc8b777851627e233034f20ba732bcd65ce0ab815c81a48ce0e47cf83abd0b5babcc411b9ce0840ad6784bbba708f1e1c1a2bcd552be2320543c201b9abf48ebabc8cad6887b0bbaeb3c483c1983b4bada78ebbba27c04145434f44c68743cf821c111f1c1e8d4c45101913c1913b4cc687bfac2c82b0bbceb2c49ecebbc21341c889ac0c94b0bbce84cb9f314ca7e284bcb020ca464f444543cc8049c8881b1b188ccf8516c4a82f432544161518c0973747c781b3a76284bcb0cfb4c895cfbd708f112d3738044527b07421ca6fc900bf1fc910bbc482adb799bbbac80abcce1643cf084ba792b5bcb0cf10bfc20341ab148ebabc7c841f1a1620cc53273f32034fc900bbf54645434fac5489b0bb86aa1087babca4afce84cb9f314ca75284bcb020ca464f444543cc8049c8881b1b18161d18814744d5c3374845374aac0cfcb0bb86ef3804454d461000313d2b37112a274d434f4444434f4445530f4441434f44d51019c781bb7c9fad47fdbbbac8bfaf4400ccbf433c467f719ef7e505433ab5c6b8493b50c84399f9e20f44f742ee1c12034fac54bdb0bbae5ec67061850b6041431b2e45c842b4e7034ff644e217130543a7aebbbcb0cd354f161e1b188ccf856f3704454d4510003b2c2135371d21264b4f4445424f4445435f0445474f444510c49ece93b18e314fb18e315305c4af553d56ae6fc451d5f40f44ae68c451d1f40f44ae606abb45434fc9418697e50543c40c41c84ff644abc4b9babcc494ae44a77ebabcb0cf9510c486ac3b8dbbba188ccf8516c4a8c687af1713147c9fcc1eafcd18bfc4bdceb1c49c76831a2c7d3a0f4421bc7f20cc63ca9f314fc201b9c89cac6c8ab0bbae4ec211b9e2e3e70543a71290bcb0cf00bfc601a1850aac4eca3aa88306bf4fcc3ebb8200bb4fc900a71f2e47ce1aa4e48fec0445ab6491babcc409a5f14ee5251d0f44ad77b2bbbac897778519161d21ca5f2c7a3a0f44c806afac748bb0bbc806b3ac6c8bb0bb86aad485babca4acce80101a1ec8aa1986ca83cd5167c42945aaf485babc8ccf8516c4a8ad7fb0bbbace024cc6824bcf104ba79ebabcb01987474fcf85c8424ce6034ff644e28f1a0543a702b8bcb0acc082b0bb86c84f79d7434f843a6f3b1d78cd4f44853c5a30166e4a4445833b1168c44f444537730c310ba4114032b0bb7ac0a74637703b73ae0472d245438f3b54377a69d6434f84316b0730560b3b52ae6c62b945438f3060c0a779315ea465f5408cf44180ff4186f34987f5448cf44d80ff4d86f34487f54f8cf44880ff4a86f35987d510c49cce80a732babcb061ba434f44ce478a9ce4034f1f8616c4a8c487c3bababc1c7785cacac8bbbcb0cdc0f3b1bbbacacaecbbbcb0cdc0efb1bbbaca0ab876831a2ca2380f4421bc7f20cc63c4014dc817b8c6385b44304cc211b9e247e00543a78696bcb0af48ce1ab8e4dfec0445abfc97babcc4075dca0abc2f5fc2019913c4074913a7169dbcb0c538af4f54454340c1f3434f442d464e4445ceca93bbbcb014ce06af14ada398bbbac68f4bc1da4f4445c80c48ccc6fbbababc89c1fdbdb0bb40cecae8bbbcb0c9d094b1bbbafa4a454543a78a8dbcb0cfc0efb1bbbacedaf4bbbcb0ac2ca4b0bbcec6ffbababcc6c1f9bdb0bb83c68fbababc44cf00bfc6c181bdb0bb83c687bababc44cf00bbc6c189bdb0bb83c69fbababc4ac9c0f7b1bbba132547c8d6e7bababcee80e6034facb491b0bbcecee7bababcfd45e4db130445abb8bebabcc49cae1ec40749cacad4bbbcb082c0d7b1bbba46c401b9cacadcbbbcb082c0dfb1bbba48c401bdcacae4bbbcb082c0e7b1bbba46c2c1d5bdb0bb15294dc9d0cfb1bbbae2efe70543a7d697bcb0cfc8cfb1bbbaf14ee5dd1f0f44addbb5bbbac897778519161d21ca5f2cab380f44c8c6c3bababca7d680bcb0c9c0ebb1bbbaf94c444543a7e280bcb0c900bfa73e80bcb087acaff1bbbaa89acf8618c4a11880c2044516c4a8c687bf177691c611b5ca0ab876831a2cf63f0f4421bc7f20cc63c401b9ab20b9babc6abb45434fcf95c08db9c6a947364d37520ec6a9453767ce4b819de20f44ce0b4bcf45f14eac8cbab0bbce9ba47f10ab9cb9babc16cf9da87fcf00bfc444cc06bb8200bb4fc900b71f2e45ce1ab4e48bed0445abf095babcc409b5f14ee54d1b0f44ad8bb6bbbac897cf86c85af412034fac48f8b0bbc1833b42ce06b3cd064f7c841f1a1620cc5327fe39034fc900b3a7ea81bcb087ac63f1bbbaa8bfcf8618c4a11880c20445ab30bcbabcf74545434fac3087b0bb86c842bce7034ff644e2b3120543a7a2bcbcb0e7d5f40f44ce4ecbe70543fd45e4c7140445ab80bdbabcecd0f2034fe595e10f448243073c0543ee60e6034f834587330445e2a3e60543c4517d150f44cc53ee58e6034f83454f350445e267e705438844bd380f44fd1b360445c85ad0e6034fcd47fb3b3d0543c45181e10f44cc418ccf85c072d4f2034f443159eed4f2034f82054f4ee5d5f40f44ce53b016bd708fe7d5f40f44c67edbf305434f305fe2dbf3054389044942eed0f2034facc0fab0bb7683ecd0f2034fe595e10f447691c654e467ec0445709dcd55e2a3e605437c96cc53ee58e6034f7797ca5fe56de00f447691c654e4d7ec0445709dcd5580c20445c28b28babcb0834167db4445431bac9897b0bbc0833b14ce076b54e687ef0445c80b6041e087e40543c400614bec88e5034fc77887ef0445423a54ce076b4860bcb04445e09fe40543a44dce076b48e693ef0445fb9be40543c2106157f6c445434fac3086b0bbc487db4445438ccf851518cfbf709dc1853729c4797b4f3025c6b03151c94f61ba434f444ae04a9ce5034f3709f14eaf0dc8b80aae4201c1b33f5dce4973cea5ba434f444ae0429ce5034f36acc8806f8bc2ae454543cf3d400acc8dbb02ca8d3047fd46ae50c5407d66b044454340e7409bef0445304df644c88d1b1b80c204451019cfb7c8977785c3720cf2034f44314cc487ad2789bbbac8990ead2bb0bbba1d1487d57086c4780bf80445433b43ad17b0bbbac887cf8480c2044510c49cc57e07f305434f304f10a7ae96bcb06f86188cfc44434f441e80c204451019cfb7c897fc44434f44c57e07f305434f3067c91b77bac2adbb45434f4be65697e405433c4bce80a7b680bcb047830ba7eebabcb01a1e80c204451019c781bbc49ecc476bcfb1c89ccf43ab7c444543c642ce45c6006147cb9f315ecc7a453757cf43ca0b6041bc49cf96c849ac54434f44cc45cc7a4536a7cf01674b1d1f1d1487d510191314c895cfb5c8b3cf96c889ac40a7b0bbcc44cc7b453768cf526899cf83ab50bbbabc6345375b3b46ae41b043ba44c497ce44a79aa6bcb0cd42c07044309ac4431f1c111f8616c4a8c687bb177691c611b1709d112d0fcf044527b07621ca6d2e42ce1abd172b4b5445431fac3891b0bbc806bbc910baf64345434facd480b0bbce06bb14ad0f9dbbbac89f1cad77aebbbac897778519161d21ca5f2c16c30f44c806bbac5082b0bb86aac8febabca4b4ce8014cfa01e8ccf8516c4a814101913ce3e47c782af18e579f40f44ad37b0bbba13a74297bcb077b3a866ce017449ce1974486e9d315507cd06b0ce00bc6abb45434f4bee4697e40543b101babd8431afc08946c6bd43394fc90b7343490b734236871b1b18161986e20ff30543ccbc5a34484be646efe6054340d68580c2044516c4a8c4872bbababc1c1212844a78f2034f4d41434f834003f804454a4f4445844a00f2034f4545434facf892b0bbc0833b41e67ff8044525ca843158c49423c2adbb464cf896cc560ff3054340f38582a74ee607f80445fd63c60543f09ce5034ffd4d434f44b6e6cc7981e30f44474ccae945434fac28bcb0bbc1833b57834606f305434f82400bf8044543a6fb45434f11adb3b1bbba1af79ce5034ffe69c10f44f463a77ef4bcb04bd080c7590df40f44c1983b48834606f305434fadcb434f44fdc34f4445ceda2cbabcb0cc47030d7945424f4430b6c2c12dbcb0bbcc06a7c9c025b1bbba1327c445434fcf00ab1f2e47e273f305431faca093b0bbfdc34f4445ceda22bbbcb022c6794d4bd182c7490cf40f44c18a3a72c6814d0c30aaa46a2f09a75e94bcb0c1854cda84e70af804452965ac4c92b0bbc08340d186cb520cf2034fc09e374811ad7bb1bbba1a101a1ec8aa1986434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f444516c4a8fc4b4f4445294f2e450a3abd16708f112d54ca044527b07421ca6fac20bdb0bbadc3a3bbbac3720cf2034f443146a70eabbcb0ac7c93b0bbce9bc201b5137c8dff574f4445c88caceca8b0bbce16bffc39f50f44ad4ff0bbbace0aa815fa63c10543f55f45434fcf86abc8afbabcc401a9709dace49db0bbe7c3f90445ce0aac15fa63c10543f55845434fcf86ab2cafbabcc401ad709dac389db0bbe7c2f90445f263fe4a434f44ce80a7d6aebcb0e6c7f50f44f46df54a45434fcf86ab30afbabcedc7f3034fc900a71ffd69c60f44ff5a4f4445c88cac5ca8b0bbce06ab7797ab7c9ababcedc0f3034ff56af952444543c487ad0ba4bbbae1caf20543c2019913f67cc0034ffe5a434f44ce80a7a6afbcb0cf009fc211a5ab40aababcc411a5fbc7f20543a77efbbcb0c900971ffd0dc60f44ff634f4445c88cacf0a9b0bbce069bc9109ba7a6a8bcb0cf109bf7c8f3034fac48fdb0bbf479f55a45434fcf86ab94aebabcedd4f3034fc900931ffd25c60f44ff6b4f4445c88cac30a9b0bbce169ffcd1f50f44ad9bf2bbbace0a8815fa23c10543f56d45434fcf86ab1caebabcc41189fbd7f20543a7f2f8bcb0c900bba71ef8bcb0c900b7a716f8bcb0c9008b1ffd69c60f44ff664f4445c88cac64a9b0bbce06877797ab7499babcca84304cc201b9f937c10543a7fef8bcb0af48ce0ab8ffc7ca0445abe4f9babcc2018113f668c0034ffe66434f44ce80a7a6acbcb0cf00877c96adbf93bbbac68f317ace0a8415fa63c10543f54155434fcf86abf0adbabcc40185709dac9c9fb0bbc0833a4bc806bbfed5c60f44ad1bf2bbbaa842c900bbf5e4c0034fac0cfeb0bbba36b7bb30bf27f4c0034fbb30b7f7d8f3034ffe41434f44ad97f0bbbabc3abcba36b32cf9c60f44ba36bbfce5f50f44ff474f4445abf8fbbabcfe68ff4f4f4445c88cacdcaab0bbe709f80445708f1e1c1a2bcd552b51c10543c20185f95f444543a72af9bcb087acfffabbbaa8a41fcea6128745bcb0bbba424f4445734f4445bcb0bbba454f44452e60206a3a364445bcb0bbba4f4f44452e222928632b68653a363d3c434f4445bcb0bbba414f444522224445bcb0bbba414f444533224445bcb0bbba424f44452b4f4445bcb0bbba414f44452b274445bcb0bbba464f4445630e09150e4f4445bcb0bbba464f444502021408634f4445bcb0bbba404f444579222945bcb0bbba454f44457922297f303c4445101915fee7ed0445c8bbaf53c84ccd43c849cf45ca4cfe4d434f44ce45a7aae7bcb0c77e433aa11f1d1487d510276cc3034face08fb0bbce9bca9f3153277cc3034f17addf83bbbae0b3e40543cc79b9e30f44453645fcdd210f44e6bfef0445188c4445282a362b262377776d2b2829434f4445042a30012a3c2f03312a2116332e272006370545c85f778cca47cf87ab8cf4babc8ccf855e4f4445dfed0445dbec0445d7ed044517ec0445cfed04458bed0445c7ed0445efec04453fed044583ec044537ed04454fec04452fed04450fec044527ed0445efed04451fed04451fec044517ed04452bec04450fed044573ec044507ed04457bec04457fed0445a3ec044577ed044577ec04456fed044543eb044567ed0445cfec04455fed04453fec044557ed044547eb04454fed0445b3ec044547ed044507ec0445bfee0445a7ec0445b7ee0445abec0445afee044543ec0445a7ee04459fed04459fee04453bec044597ee0445ebec04458fee0445f3ed044587ee04459fec0445ffee044503ec04456b4f4445f7ee044597ec0445434f4445f3ee04458fed0445434f4445efee0445e7ec0445434f4445ebee0445ffed0445434f4445e7ee0445abed0445434f4445e3ee0445a3ed0445434f4445dfee044597ed0445434f4445dbee04457fec0445434f4445d7ee0445cbec0445434f4445d3ee0445a7ed0445434f4445cfee044537ec0445434f4445cbee0445ffec0445434f4445c7ee0445f7ec0445434f4445c3ee0445d3ec0445434f44453fee04456fec0445434f44453bee04455bec0445434f444537ee0445fbed0445434f444533ee0445f3ec0445434f44452fee044527ec0445434f44452bee044553ec0445434f444527ee04451bec0445434f444523ee0445c3ec0445434f44451fee044523ec0445434f44451bee044563ec0445434f444517ee0445f7ed0445434f444513ee044513ec0445434f44450fee0445afec0445434f44450bee044593ec0445434f444507ee044533ec0445434f444503ee0445bfed0445434f44457fee044583ed0445434f44457bee04458bec0445434f444577ee04454feb0445434f444573ee04459bed0445434f44456fee0445ebed0445434f44456bee04459bec0445434f444567ee04452fec0445434f444563ee0445b7ec0445434f44454fee04450bec0445434f44454bee044547ec0445434f444516c4a876831a2ce4c90f4421bc7f20cc63b041c9f40f444ac605454543f7dcf2034facbcbfb0bbad2fb3bbbaabb4b7babcf7b4e4034ffd53434f44ce56673c0543a70af8bcb0fcfde20f44fc444f4445c85aec32034fac7cfeb0bbfd43ee0445fa4d444543c45145530f44ad67f2bbbafbb7e40543a7fef2bcb0fccdf40f44ce56b31b0543a766fbbcb0fcc1f40f44ce56971b0543a756fbbcb0fc09f40f44fc444f4445c85a4455034faca0ffb0bbfd63f80445fa48444543c45145530f44ad93f3bbbafb4bf30543f64345434fcf50435f0445abf4f8babcf790f3034ffd49434f44ce564f540543a7e2f9bcb0fce1f50f44fc4f4f4445c85a4455034facd4ffb0bbfde3f90445ab68f3babcf7d8f3034fac58f4b0bbfddbf90445ab5cf3babcf7d0f3034fac4cf4b0bbfdcff90445abb0f2babcf7ccf3034facb0f5b0bbfd3ff90445aba4f2babcf790e5034faca4f5b0bbfd83ef0445abe0ffbabcf7f8e5034fac88f5b0bb7683151d1c27c6542debc5044580a676f5bcb0afbd1e8ccf8516c4a876831a2c51c80f4421bc7f20cc63cc69c9f40f4444300ffc19c50f44ad77fbbbbafb07c30543a716f1bcb0c4781ef90445433b4bfdbbef0445f967cf0543a786f3bcb0ac98b2b0bbad9fbdbbbaaba0bebabca702b2bcb0778519161d21ca5f2c5ec80f4486aaf0ebbabca4bc18804f4445bcb0bbba414f444573374445bc6a7c87034fcf85bc6a7087034fcf85bc6a7487034fcf85bc6a6887034fcf85bc6a6c87034fcf8516c4a876831a2c3cc80f4421bc7f20cc63b041d9f40f447683151d1c27c6542dc3c4044580a61eeabcb0afbd1e8ccf85c062d8f2034f4586709ded45434f403145ce8e45414f44ec434f44653762ed45434f043152e6444543cf3040c08504ae02cc8e65a873ed45434fc4314bce8ec5434f44ae6ecc8e55c88d87ec434f4405375eed45434fc43146cc8e41a85bc78f41a44bec434f44c5374ac78f4ba447c6894ecf8780c2044510191310c08bf8ceb3c2386167dfd4d5d3dfd4d5d3dfd4d5d3dfd47683c64061d3dfd4d5d3dfd4d5d3dfd4d5d3dfcd316747cf83709d1615c80b6055c80f78dc404b6056176b40c68747cd01674bd4d5d3dfd4d5d3dfd4d5d3dfd4d5294b2c45634f44ce076b48ce031f14ce076b54ce037b14ad2789bbbaca0b6051c0336051433a5e2f47274475434fcf016743cf05131f2e45ab0c82babcc6006157dfd4d5d3dfd4d5d3dfd4d5d3dfd4ce076b40ce0b1bcf93c80b6051ab3082babcdfd4d5d3dfd4d5d3dfd4d5d3dfd4ce076b50cc076b54ce0f6b50ce827c961713c400615bc40479da4c4061501b6041c08b4ccc076b48ce076b48cc0b7bd4d5d3dfd4d5d3dfd4d5d3dfd4d5c80b604946b7444543c600615bc400614f40f31d4504c19e3f2f07ce076b5cce035fc1853656cf016757cf154bc400615bc40449400b6051abb081babca45fce8bc400615bc414514099cf016757cf054f4c006157a79e80bcb0cf016757cf054f4c006157c410615bc6064dc80b605dc08f6ccc076b5c0e36eed4d5d3dfd4d5d3dfd4d5d3dfd4d5c80b6049c8cfc445434f4701675bcd016753cf016753cd01676faf39c80b6065c80f4846076b5015ab5881babcc4b4ce076b64cc3347cf01676fcf05534c006157c643ae034c186157c618616bc443ce6bb88145434fc43150cea1babc4f441015a7f281bcb0cf52ca4daf57c80b606dc08f461515a7e681bcb0cf52ca4dcf42c08f40cc44c443ce5bca9f30fbc4006163cc8451ca0b6065c80b6065c03748454cca32babcb0d4d5d3dfd4d5d3dfd4d5d3dfd4d5c80b6049c8cfe445434f4701675bcd016763cf016763cd01677faddf434f44ce076b74ce034bc7ad4bc600617f7c84cc076b049a2f6b789d76f3cb0543a73ad8bcb0cd016777cf01677fc7854bc6006177c418617b04c19e3f0d07ce076b7023c8674bf2868eac49c0b7473062c4006147c4386157c4936e137bcf01677fcf45408822c4a6b04b4af4824784425fcf01677bc78541c60061770431fad3dfd4d5d3dfd4d5d3dfd4d5d3dfcf01677fcf05474c006173c6006173c40061736400616fc410614f74c6e1434f444ac101bbbabcdfd4d5d3dfd4d5d3dfd4d5d3dfd4ce076b4840bb4f4445ca0b605dc80b60494cf81c4308ca9f39740c2e45c80b6059c80f60ad07b3bbba13c4006163c4044d13c4006167c40449400b606513a73a86bcb0cf016757c7856bc600615b04318fd3dfd4d5d3dfd4d5d3dfd4d5d3dfcf116743cf176bc40061574c94cc56ebf3054325442f421fbb50e7f80445d3dfd4d5d3dfd4d5d3dfd4d5d3dfcf01675bcd4167c44061c08b00181c111f86434f440516c4a876831a2ca0cc0f4421bc7f20cc63b041e5f40f447683151d1c27c6542dafc0044580a6aaefbcb0afbd1e8ccf85c062e4f2034f4586bc6a0487034fcf8516c4a876831a2c60d30f4421bc7f20cc63b041edf40f447683151d1c27c6542d6fdf044580a6eaefbcb0afbd1e8ccf85c062ecf2034f458616c4a8c687a71713147c9fcc1ea7cd18b3c619a9ca02b0cc16b7cd00bfc401b9ab80f0babcc401bdab88f0babc7c84102b09d505432bbb7527c664d5d3dfd4d5d3dfd4ce06bbac98f3b0bbce06b3ac10f0b0bbcebb9ebb3c40cc93450ccabb4acfce4445430877b3d3dfd4d5ce0aa815c899479701f64645434fcf00bfa79ef1bcb0cf08afc201b5f913d50543a726f6bcb0cf00b3f56445434facd493b0bbce9bc401bdabb0f6babcca843b5ec401bdabbcf6babc1fcf8319c48edcb4b606ce06b7ce0153b07686c897c900abc497ad63fdbbbac81aacce06bbac94f1b0bbce06bb020a36cd778519161d21ca5f2c08d20f44c806a7fe46434f44ad0fffbbbace0abcff414f4445ab70f4babc8cadc8eab0bbae9d101a1ec8aa1986bcb0bbba424f4445674f444516c4a82f431c1212c8bdcfbd708f112d84de044527b07421ca6fd4d5d3dfd4d5d3dfd4d5d3dfd4d5c888ac14f1b0bbce9bccbf443f54c900bfc5105abca7cef4bcb0cf10bfc482ad7ffdbbba08ca9f30a67c841f1a1620cc53278ad4034fc900bfa7deeabcb087ac4fe6bbbaa8bf1b1b1816198616c4a8c687b71713c8becd10bbc601b9c80ab8ad03fcbbbac80abcad7bfcbbba708f112d04dd044527b07421ca6fc900bfa7c6f6bcb0cf10bfc55ece908ea6417086ce8e82a6404f92c754ce85c409bdc81ab8ad43fdbbba708f1e1c1a2bcd552b01d60543c201bdf94d444543a77aeabcb087accfe7bbbaa8a41a1e1a16198616c4a8c48793bfbabc1c12768ac6c999b8b0bbcccea3bfbabcc6c9adb8b0bbccceabbfbabcc6c9a5b8b0bbce99c4b476831a2ca2d00f4421bc7f20cc63dfd4d5d3dfd4d5d3c487ad83e1bbba294f2e45294f2e45cec2a4bebcb07797fbb3d70543a75ebabcb0cfd0a3b4bbbacec2a0bebcb0fc4dd70f44ad47b0bbbac8daa0bebcb0c9c8abb4bbbafb5bd00543a7aabbbcb0cfd0abb4bbbacec2a8bebcb0fc65d70f44ad9bb1bbbac8caa8bebcb0ac70f1b0bb15ab68bcbabcc601b9c032b8454ccbeb45434fd4d5d3dfd4d5d3dfd4d5294f2c45434fc42f432544ce85a742f7bcb014ce06b314adbfb8bbbaca0abcc63eb7443134dfd4d5d3dfd4c8c6bcbfbabc7c8dff424b4445abdcd8babcc2c199b8b0bbc8d6bcbfbabcf64541434fac78f3b0bbced693bfbabcc487ad27ffbbbacecab7bebcb0778cf94e404543a71ad9bcb0c900b71f2c44474f44c8c6bcbfbabc1fcf00bb1facd0b4b0bbc63ebb4430efc401bd13a72ab2bcb0af4cc80ab815ab2cb3babc7c841f1a1620cc5327aad6034fc9c09fb4bbbaf94a444543a7dae8bcb087acafe9bbbaa8a71a1ec8aa1986bcb0bbba424f4445174f4445bcb0bbba424f4445074f4445bcb0bbba424f4445b74f4445bcb0bbba424f4445774f444516c4a8fc024f4445294f2e450a3abd76831a2c61d50f4421bc7f20cc63dfd4d5d3dfd4d5d3dfc9d05fb1bbba708fac00d4b0bbcec653bababcc211a9abb489babcc201b913c401a9ab20ebbabcc48cc6aa48fe44434f44ce06a3ac54f2b0bbce06b3ac308eb0bbc1833b09d5c81ab8c8c66fbababca706dfbcb0c9c063b1bbbaab9cd3babca7bed1bcb0c910bbc2c165bdb0bbadcfd3bbbaceca64bbbcb0aca8dfb0bbad9fdbbbbaceca64bbbcb0ac80d9b0bbad8fdbbbbac80ab8ad5f82bbbac78f4bc0cb4f4445d3dfd4d5d3dfd4d5d3dfd4c806a3fe7dd50f44adb7e3bbbacec248bbbcb07797fba3d20543a7fab9bcb0cfd04fb1bbbacec254bbbcb0fcbdd50f44adebb3bbbac8da54bbbcb0c9c857b1bbbafb4bd30543a7d6b9bcb0cfd057b1bbbacec25cbbbcb0fc55d40f44ad3fb3bbbac8da5cbbbcb0c908b7c401a9ab80bebabcc211bdc80ab0ada3b3bbbacec2b8b8bcb07797fba3d20543a70ab9bcb0cfd0bfb2bbbacec244bbbcb0fcbdd50f44ad7bb3bbbac8da44bbbcb0c9c847b1bbbafb4bd30543a766b9bcb0cfd047b1bbbacec24cbbbcb0fc55d40f44ad4fb3bbbac8ca4cbbbcb014c8d6b7b9babcc401bdabccbfbabcc4c1bdbeb0bbc80ebf1ead0fb5bbbace0ab4addbe0bbbaab4cb2babc7c841f1a1620cc53276fd3034fc9c0bbb2bbbaf945444543a72aeebcb0c900aff54145434fac24e8b0bb86aae0e0babca49fcea6128745bcb0bbbaeb4f4445252922232529222325292223252922232529222325292223252922232529222325292223252922232529222325292223252922232529222325292223252922232529222325292223252922232529222325292223252922232529222325292223252922232529222325292223252922232529222325292223252922232529222325292223252922232529222325292223252922232529222325292223252922232529222325292223434f4445bcb0bbba424f4445174f4445bcb0bbba424f4445074f4445bcb0bbba424f4445b74f4445bcb0bbba424f4445774f444516c4a8fc4d4f4445294f2e450a3abd76831a2c2ada0f4421bc7f20cc63dfd4d5d3dfd4d5d3dfd4d5d3dfd4c816bb7785ab1cd0babcc401b1ce1abcad4f84bbbace0ab815c80abcadc3e3bbbac887c7ac44f54545434fcf00bba766ebbcb0cf00bfa7c28fbcb0c0853745ace4bfb0bbac8f4e4445d3dfd4d5d3dfd4d5294f2e44ce02d47691f7c0dc034fac74b9b0bbce16dfc908d7f7d4dc034fac64b9b0bbce16dbc908dbf7d8dc034fac54b9b0bbce16d7c908dff7ecdc034fac44b9b0bbce16d3c908e3f7f0dc034facb4bab0bbce16efc908e7f784dc034faca4bab0bbce16ebc908ebf7d4dc034fac94bab0bbce16e7c908eff788dc034fac84bab0bbce16e3c908f3f7d4dc034facf4bab0bbce16ffc908f7f79cdc034face4bab0bbce16fbc908fbf7d8dc034facd4bab0bbce16f7c908fff7a0dc034facc4bab0bbce16f3c90883f7c0dc034fac34bab0bbce168fc90887f7ecdc034fac24bab0bbce168bc9088bf7b4dc034fac14bab0bbce1687c9088ff7b4dc034fac04bab0bbce1683c90893f7b4dc034fac74bab0bbce169fc90897f7b8dc034fac64bab0bbce169bc9089bf7b8dc034fac54bab0bbce1697c9089ff74cdf034fac44bab0bbce1693c908a3f788dc034facb4bbb0bbce16afc908a7f750df034faca4bbb0bbce16abc908abf7f0dc034fac94bbb0bbce16a7c908aff7f0dc034fac84bbb0bbce16a3c908b3f764df034facf4bbb0bbce06bfac54efb0bb15ab54b6babcca843157dfd4d5d3dfd4d5d3dfd4d5d3dfac98b9b0bbae48dfd4d5d3dfd4d5d3dfd4d5708f1e1c1a2bcd552b39dd0543c201d5f953444543a752edbcb087ac27eebbbaa8a4cfa01e8d5045bcb0bbba424f4445954f4445bcb0bbba424f4445b54f4445bcb0bbba424f4445754f4445bcb0bbba424f4445a14f4445bcb0bbba424f4445044f4445bcb0bbba424f4445254f4445bcb0bbba424f4445744f4445bcb0bbba424f4445644f4445bcb0bbba424f4445d54f4445bcb0bbba424f4445344f4445bcb0bbba424f4445b14f4445bcb0bbba424f4445e04f4445bcb0bbba424f4445444f4445bcb0bbba424f4445c54f444510c49cd5d3dfd42f422544fd57d8044513254416abf4b1babcec8cf2034f1f8616c4a876831a2c26d90f4421bc7f20cc637c841f1a1620cc53272edf034f87ac33efbbbaa8b71986494f444537d50445531d0445a31e044517000445430004450b1d04455b1d04453b1c04450b1c04457319044543190445efc504456fc60445c7c4044517c40445b3c0044583c0044573df044543df0445434f444507d5044516c4a8c6878b17fd2fd50445ab8cf2babcf4e8f2034f7785162777de034f20ba732bcd65d3dfd4d5d3dfd4d5d3dfd4d5d3dfd4d5fbd77e4543a766babcb0af54d3dfd4d5d31cac64fbb0bb16abbcf3babc25442f43254416aba0f3babcca84309c7c841f1a1620cc53277ede034f87ace3d0bbbaa8b71fad6beabbba434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f444541c20445434f4445434f4445715ccf8543c2044543c2044543c2044542c20445434f4445434f4445136d0445bf6c04459b6804454384888d8a988b8d8e819f9d99968e999e919ba5a2ac44a1a6c20445063d362a314fcf85113a2a312a222165263d362a316f6465636f2531637f7475737f7475734fcf85737e7676777a72727b760507000b0103bcb0bbba434f4445434f4445434f4445434f4445434f4445434f44456b1e04458b1f04453b1f0445b71f0445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f44456b2f0445434f4445cb2e0445d72e04450b1b0445131b0445434f043379244f9b790fcf85494f4445931b04459b1b0445a31b0445ab1b0445b31b0445bb1b0445431a04454b1a0445531a04455b1a0445631a04456b1a0445731a04457b1a0445031a04450b1a0445131a04451b1a0445231a04452b1a0445331a04453b1a0445c31a0445cb1a0445d31a0445db1a0445e31a0445eb1a0445f31a0445fb1a0445831a04458b1a0445931a04459b1a0445a31a0445ab1a0445b31a0445bb1a0445414f4445434f4445404f4445434f4445474f4445434f4445464f4445434f4445274f4445434f4445264f4445434f4445294f4445434f44454f160445434f444527160445434f4445ff160445434f444533150445434f44458b150445434f444563140445434f44453b140445434f44456f130445434f4445a7130445434f444507120445434f4445bb120445434f4445df120445434f444513110445434f444513110445434f444513110445434f444513110445434f444513110445434f444513110445434f4445ef110445434f444517170445434f44452b100445434f444587100445434f444582511d65434f4445ab1b04451b1b0445e31c04457b1a04453b1a0445a31a04454b1a04456bff0445db1b0445b31a04454bff04458b1a0445b31b0445fb1c0445931a0445f31a04459b1a04455fff0445cb1c0445031b0445c31c0445531a0445831c04450b1b0445831b0445d31b0445231a044557fd0445c31a04454fff0445031a044547ff044553ff0445cb1a0445631b04455b1b04456b1b0445831a0445d31c04459b1c0445131b0445331b0445731a0445eb1b04451b1a0445cb1b04450b1a04452b1a0445c31b04459b1b04455b1a0445eb1a0445f31c0445b31c0445131a0445431b0445fb1a0445bb1c0445d31a044563ff0445f31b04452b1b0445531b0445ab1a0445eb1c0445e31b0445331a0445db1a044507ff0445e31a04453b1b04458b1b0445431a0445fb1b0445631a0445bb1a0445a31b0445db1c0445731b0445931c04458b1c04456b1a0445a31c0445931b044553ef04457b1b04454b1b0445ab1c0445231b0445bb1b0445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f44450b8d44458b8f4445434f4445434f4445434f4445a38b4445278e4445434f4445434f4445434f4445658a44453b8e4445434f4445434f4445434f4445258a4445cb8e4445434f4445434f4445434f4445c78a4445d38e4445434f4445434f4445434f44459d8a4445ef8e4445434f4445434f4445434f44451f884445478d4445434f4445434f4445434f4445ab8844456b8d4445434f4445434f4445434f44451d874445038d4445434f4445434f4445434f4445434f4445434f4445158d44452d8d4445c58d4445dd8d4445f98d44458b8d44459b8d4445a78d4445b18d4445438c4445558c44456f8c44457b8c4445078c4445158c44452b8c4445398c4445cf8c4445e38c4445f58c44458b8c44459b8c4445a98c4445bb8c4445498b4445558b4445678b4445738b44450f8b44451d8b44452d8b4445398b4445c58b4445db8b4445eb8b4445f58b4445878b4445918b4445434f4445af8b4445bd8b44454f8a4445598a4445434f4445778a44450b8a44451b8a4445434f4445378a4445434f4445d18a4445e38a4445ed8a4445fb8a4445878a4445938a4445434f4445af8a4445bb8a44454b894445598944456989444579894445098944451f89444533894445c3894445d1894445e5894445ff8944458d894445a1894445ad894445bb8944454988444555884445738844450b884445434f44452b8844453f884445c9884445db884445ef884445f98844458d88444599884445434f4445b788444553874445678744457b8744450b874445434f44452b874445434f4445282a362b262377776d2b2829434f4445072a2820372a07372a3b2d2622231720203b2d2a2d4f44450f2a2533260c362c372627242f1c212637262b2b434f444506213020310c362c372627242f1c212637262b2b434f44450a212d312a2e282c392a07372a3b2d2622231720203b2d2a2d4f444515263631362e2803312a2145434f122c313b31242f0e28292c2c4445434f082a202e2803312a2145434f082a202e28042f232b26434f4445042a3013263d372c2c214445434f0320370c3137312a2a3117273620222b0d21434f44451426202000272537172009302f3b2d073a3b2145434f2836373d28202d0e4445434f2836373d27353a210545434f082a222b082c213d25373a0a3c04434f4445042a30112b3d212427032b2622232145434f0320371c3024313b31350a21222a024f4445042a301531202704272b3620303c4445434f032037022b213623210d22212029260e4445434f032037022b21362321032a23210b22222104434f4445042a30092c2c252926062a232c0e4445434f032037032536370a36372c3d4445434f0320370c2b282e2e2a210f262a20024f4445053d21200f262637223d3d45434f022c2d2b022c313c30032a232104434f444505262a2100232b36264f444506372d31133d2b26263c3745434f13372a3b21032a232145434f112b2b2e2a212f2a20003b2c213537262b2b05262831263d4445434f172037092d29261f2b2c2d3b2137434f4445102a30002d2b0b2305262820434f4445113b28102d382d2b274f4445112a252105262820434f4445112e2d36260a3c26263f302c2c214445434f0320371c30210b2e2a212f2a4445434f032037092d29261c2d3f264f4445042a30032a2321113a3f2145434f0737262e302005262820024f444500232b362607252b27232145363c2137707d6a212f234445434f03203704213c21202537271b3d35264f44450f202521103b362c2d280545434f0920303c2522260d2b3d024f4445002725370d2a3c31024f2521352e342c707d6a212f234445434f1620241e3120313612242f3a21003b0e4445434f1620240034202d04213c06370545434f1620240c282a302a0f203a4f2b29262e3131707d6a212f234445434f173c30093620261c30372a212345282a362b262377776d2b2829434f444517233716263b12242f3a2145434f102930082131152e2830264f444517233703312a2145434f1029300e28292c2c4445434f082a202e2803312a2145434f082a202e28042f232b26434f2f2031212129707d6a212f234445434f13372a3b21032a232145434f122c313b31242f1e312031364445434f122c313b31242f1f362a372a2731434f444515263631362e28042f232b26434f44450f2025210f262637223d3d04434f4445042a3013263d372c2c21013d024f4445042a30112b3d212427032b2622232145434f0320371c30372a2123113a3f21003b0e4445434f0320371c30210b2e2a212f2a4445434f0320371f362a200e2021312a3736434f4445042a30082c2b31292607252b27232104434f4445042a30082c2b312926092d2926012528260e4445434f032037032b262223210c2d292b04434f4445042a30012a3c2f03312a2116332e2720024f4445042a300613062a232c4f4445042a3004001f4445434f022c2d2b022c313c30032a232104434f444505262a2100232b36264f444505262820172629201720082a202e28032a2321112a222145434f022c2f2a102c2e2a102a07203701223b21112a222145434f012b362207242f2a2a21223d0d2b25200545363c2137707d6a212f234445434f103722213729223b2108263c3724242a4445434f0920303c2522260d2b3d024f44450f202521103b362c2d280545434f0320371c3d36372a2908263b362c203c4445434f032037022136302e2320024f444507263735223b272d0e2a373622282104434f4445002725370d2a3c31024f44450027253717200b202e0e444534262a2c2d2a306b27232845434f0d2b372a362b263b072d262c2f062c212a20203b2d2a2d0e4445434f0d2b372a362b263b1620222b022c2f2a4445434f0d2b372a362b263b0b35262111372f0e4445434f0d2b372a362b263b0b3526210545434f0d2b372a362b263b07292c3c210d22212029264f332c2d22296b27232845434f302c2e2a1720370a32202d3b4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445435f44455b4e4445437f48756f7f7c757f7f0475077f0c750f7f1475177f2675297f3675397fc675c97fd675d97fe675e97ff675f97f8675897f9675997fa675a97fb675b97f4674497e5674597e6674697e7674797e0674097e1674197e2674297e3674397ec674ed7ef274fd7e82748d7e92749d7ea274b27e5a776a7dbc77bc7dd771497a1270f77a8e700079e373427817722178c6726c77e67c9d76b87c4475567f5975607f6d757c7f0d75107f2175337fd375d27fe775ee7ff175807f9775a77fac75b37f41744c7e56745e7e7c740d7e1074197e24743e7ecb74da7ee774e87ef574967e9e74467959732279c473d579a173bc790b722c78cf72977bab71157a1e70de7ae070e87af470847a8470927a9e70bb7a436f4445934f44451b7f2475a97f5274587e6474eb7ef6748e7e92747b7d0577187dc577ce7dd1778b7dba774f7c0b761b7c2c76337c32763c7cc276c87cd076ee7cf276977c9e76a17c4c714d7b64717b7b00710f7b29713f7bc871ef7b8f71b87b47704a7a4b70017a3270d87aef70f27afd706779687371797c7306790f73f779f87387798e7393799c739d79a073a879b173fb78a2724777547d5b773d7d3c77c37df3779f7d4076587c7676027c18762c7ccb7625792472d478d472da782d71c77bf571427a5b702c7a2c70997a437f4445ef4f44455a7f6675b47d4b76637c7876177c2176327cfe70ba7a4d735c79797310792e733c79fd731c77fa7d91779e7db3774c7c55760e7c2576367cc576d47ce076977c43754d7f7875007f3a75c47fe175ab7f70747b7ec473eb79f5738a79b37360786f72737825723a789572ab780371147b1571187b2171237b2e71327bc571cf7bd371d17bd971ec7bf171997ba571a97b1770187acb70d77af370fe7a9c70ad7ab070bf7a430f4445c74f4445427f4b75697f7b750a7f0a752d7f3775d67fed75f67f8a755b7e6574657e0d74157ed577007aee73f079217daa77bd7d9b75b27f57746a7e3f74da7e7a720e78c972d578e67287788f729c789c72d87ba671437a50705e7a67706a7a0670127a20702e7a2d70307a3b703a7ac670cd7ae070e87af670857a8870b67a431f4445db4c4445447f5c75617f6e75717f7e75017f0e75117fc375fa7f9375a27fa875437e4c747b7e04740d7e17742f7e3874ce7edd74e47ef5748c7e9074a47eb774437d56775c7d6f777b7d0e77117d1e77217d2e77317d3e77c17dce77d17dde77e17dee77f17dfe77817d8e77917d9e77a17dae77b17dbe77417c4e76517c5e76617c6e76717c0b76187c2c76397cc476cb7cd476db7ce476eb7cf476fb7c84768b7c94769b7ca476ab7cb476bb7c44714b7b54715b7b64716b7b74717b7b04710b7b14711b7b24712b7b34713b7bc471cb7bd471db7be471eb7bf471fb7b84718b7b94719b7ba471ab7bb471bb7b44704b7a54705b7a64706b7a74707b7a04700b7a14701b7a24702b7a34703b7ac470cb7ad470db7ae470eb7af470fb7a84708b7a94709b7aa470ab7ab470bb7a43735079647371797c7307791c73237920732b792873337930733b793873c379ca73e37984738b798873937990739b799873a379a073ab79b8735f7860726b786872737870727b787872037800721b783c72c378c072cb78c872d378d072db78d872e378f47293789c729f78a472a778ac72af78b472b778bc724b776c7d7377707d7b77787d0377007d0b77087d13772c7dcb77d47dd777dc7ddf77e47de777ec7def77f47d8377a47dab77a87db377b07dbb77b87d4376407c4b765c7c7b76047c07760c7c0f76147c17761c7c1f76247c3376d47cdb76d87ce376e07ceb76e87cf376f07cfb76887caf76b07cbb76b87c4375407f4b75487f5375507f6775007f0f75147f17751c7f1f75247f27752c7f2f75387fdf75e07feb75e87ff375f07ffb75f87f8375807f9775b07fbf75447e47744c7e4f74547e57745c7e5f74687e0f74107e1b74187e2374207e2b74287e3374307ec774e07eef74f47ef774fc7eff74847e87748c7e8f74a47e43734c794f73547957735c795f73647967736c797f73187927732c792f73347937733c793f73c479c773dc79fb73847987738c798f73947997739c799f73a479bb735c78637260786b726878737270787b7278780372147833723c783f72c478c772cc78cf72d478d772dc78ef72887897729c789f72a478a772ac78af72b478b772407b6771687b7371707b7b71787b0371007b0b71087b2371c47bcb71c87bd371d07bdb71d87be371e07beb71847ba371ac7baf71b47bb771bc7bbf71447a47704c7a5f70787a07700c7a0f70147a17701c7a1f70247a27703c7adb70e47ae770ec7aef70f47af770fc7aff70847a9b70a17aae70b87a432f44453b4f44454a7f55757f7f2e775d7b77717d7be970f27af170fa7af970827a81708a7a8970927a91709a7a9970a27aa170aa7aa970b27af9738779c2726676157c1a76257c2a76357c9576417f6375607f6b75687f7375297ee973fb798972427a5d70677a6c70167a3c70c07add70877ab6704445433f4445434e44456c7f7d751c7f3f75d97fe875957fae75587e6e74077e1274d27ef5749a7e07773b7dd577dd7df377857d9b77b97d7076457b02710d7b1d71cb7bd871e67b1970247af5708f7a91702979dd736b782672eb78fb72a278ab72b5784a7d56776c7d03771b7d2477317df477917d43764b7c6076327c3e765a7f0c752d7f3b757e7e0f74dd7ee874fb7e487373792f733f79c973e27995739979a473a979b773ba7940724d784d7250785a725b7865726878727273787f7206780a720b7819722678287233783e72c178cd72de78dc72ec78f272fe7880728878b772b9784571487b5e716c7b6e71227bc571f47b8971ac7b42706d7a7e70bc7a43cf44455b4d44457c7f2f75da7ff9758a7fa675af7fb2754b7e59746b7e6974717e7b74167e18742d7e3774c07ec9748a7ea374477d5277237d3277dc7de9778b7d9577af7dbb77517c5f76757c0d76117c35763c7cda76f57cfb76907ca576b67c5771767b0071117b3171d47be271f57bfa71907b9f71bb7b41708b7ab6704179497350795f736379247327792c732f79347337793c733f79c473c779cc73cf79d473d779dc73df79e473e779ec73ef79f473f779fc73ff79847387798c738f79947397799c739f79a473a779ac73af79b473b779bc73bf79447247784c724f78547257785c725f78647267786c726f78747277787c727f7804720778087213781c721f7820722b78347237783872c378cc72cf78d072db78e472e778e872f378fc72ff7880728b78947297789872a378ac72af78b072bb78447d4777487d53775c7d5f77607d6b77747d7777787d03770c7d0f77107d1b77247d2777287d33773c7d3f77c07dcb77d47dd777d87de377ec7def77f07dfb77847d8777887d93779c7d9f77a07dab77b47db777b87d43764c7c4f76507c5b76647c6776777c7c760e7c1d762d7c30763a7ccb76d77cde76e37cee76f37cfe76837c9176987ca476b57cbf76427f52755f7f6575747f7975007f0d751c7f2175287f3575c47fc975d87ff075fb7f8475957f9f75a07faa754b7e6d74727e7d74027e0d741f7e2474307ec5743d7bce70dc7a8470977aa370b67ab970444543df4445f34f4445447f5775637f76752a7f8575647e3474f97ebc74767dc377f27d83779e7db777917c7371b87b4970607a7d700c7a3970d07aed70fc7a46736478de72e978fe7289789e72a978be7249775e7d69777e7d09771e7d29773e7dc977de7de977fe7d89779e7da977be7d49765e7c1e76747f7d750f7f1d75347f37753c7f3f75c47fc775cc7fcf75d47fd775dc7fdf75e47fe775ec7fef75f47ff775fc7f8375887f95759a7f6d74444543ef4445134e4445737f70757b7fe875f37ff075fb7fbc75437e40744b7e4874637e60746b7e6874737e70747b7e7874037e00740b7e0874137e10741b7e1874237e20742b7e2874337e30743b7e3874c37ec074cb7ec874d37ed074db7ed874e37ee074eb7ee874f37ef074b37ebc74437d4c77537d5c77637d6c77737d7c77037d0c77137d1c77237d2c77337d3c77c37dcc77d37ddc77eb7de877f37df077fb7df877837d80778b7d8877937d90779b7d9877a37da077ab7da877b37db077bb7db877437c40764b7c4876537c50765b7c5876637c60766b7c6876737c70767b7c7876037c00760b7c0876137c10761b7c1876237c20762b7c2876337c30763b7c3876c37cc076cb7cc876d37cd076db7cd876e37ce076eb7ce876f37cf076fb7cf876837c80768b7c8876937c90769b7c9876a37ca076ab7ca876b37cb076bb7cb876437b40714b7b4871434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445ac399815434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445434f4445
oleaut32.dll
SysFreeString
SysReAllocStringLen
SysAllocStringLen
advapi32.dll
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
user32.dll
GetKeyboardType
DestroyWindow
LoadStringA
MessageBoxA
CharNextA
kernel32.dll
GetACP
Sleep
VirtualFree
VirtualAlloc
GetTickCount
QueryPerformanceCounter
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
CompareStringA
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
kernel32.dll
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
user32.dll
CreateWindowExA
WindowFromPoint
WaitMessage
UpdateWindow
UnregisterClassA
UnhookWindowsHookEx
TranslateMessage
TranslateMDISysAccel
TrackPopupMenu
SystemParametersInfoA
ShowWindow
ShowScrollBar
ShowOwnedPopups
SetWindowsHookExA
SetWindowPos
SetWindowPlacement
SetWindowLongW
SetWindowLongA
SetTimer
SetScrollRange
SetScrollPos
SetScrollInfo
SetRect
SetPropA
SetParent
SetMenuItemInfoA
SetMenu
SetForegroundWindow
SetFocus
SetCursor
SetClassLongA
SetCapture
SetActiveWindow
SendMessageW
SendMessageA
ScrollWindow
ScreenToClient
RemovePropA
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterWindowMessageA
RegisterClipboardFormatA
RegisterClassA
RedrawWindow
PtInRect
PostQuitMessage
PostMessageA
PeekMessageW
PeekMessageA
OffsetRect
OemToCharA
MessageBoxA
MapWindowPoints
MapVirtualKeyA
LoadStringA
LoadKeyboardLayoutA
LoadIconA
LoadCursorA
LoadBitmapA
KillTimer
IsZoomed
IsWindowVisible
IsWindowUnicode
IsWindowEnabled
IsWindow
IsRectEmpty
IsIconic
IsDialogMessageW
IsDialogMessageA
IsChild
InvalidateRect
IntersectRect
InsertMenuItemA
InsertMenuA
InflateRect
GetWindowThreadProcessId
GetWindowTextA
GetWindowRect
GetWindowPlacement
GetWindowLongW
GetWindowLongA
GetWindowDC
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetPropA
GetParent
GetWindow
GetMessagePos
GetMenuStringA
GetMenuState
GetMenuItemInfoA
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastActivePopup
GetKeyboardState
GetKeyboardLayoutNameA
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextA
GetIconInfo
GetForegroundWindow
GetFocus
GetDlgItem
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClipboardData
GetClientRect
GetClassLongA
GetClassInfoA
GetCapture
GetActiveWindow
FrameRect
FindWindowA
FillRect
EqualRect
EnumWindows
EnumThreadWindows
EnumChildWindows
EndPaint
EnableWindow
EnableScrollBar
EnableMenuItem
DrawTextA
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawEdge
DispatchMessageW
DispatchMessageA
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DeleteMenu
DefWindowProcA
DefMDIChildProcA
DefFrameProcA
CreatePopupMenu
CreateMenu
CreateIcon
ClientToScreen
CheckMenuItem
CallWindowProcA
CallNextHookEx
BeginPaint
CharNextA
CharLowerBuffA
CharLowerA
CharToOemA
AdjustWindowRectEx
ActivateKeyboardLayout
gdi32.dll
UnrealizeObject
StretchBlt
SetWindowOrgEx
SetWinMetaFileBits
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetROP2
SetPixel
SetEnhMetaFileBits
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SelectPalette
SelectObject
SaveDC
RestoreDC
Rectangle
RectVisible
RealizePalette
Polyline
PlayEnhMetaFile
PatBlt
MoveToEx
MaskBlt
LineTo
IntersectClipRect
GetWindowOrgEx
GetWinMetaFileBits
GetTextMetricsA
GetTextExtentPoint32A
GetSystemPaletteEntries
GetStockObject
GetRgnBox
GetPixel
GetPaletteEntries
GetObjectA
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileBits
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetDCOrgEx
GetCurrentPositionEx
GetClipBox
GetBrushOrgEx
GetBitmapBits
ExcludeClipRect
DeleteObject
DeleteEnhMetaFile
DeleteDC
CreateSolidBrush
CreatePenIndirect
CreatePalette
CreateHalftonePalette
CreateFontIndirectA
CreateDIBitmap
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileA
BitBlt
version.dll
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
kernel32.dll
lstrcpyA
WriteFile
WaitForSingleObject
VirtualQuery
VirtualProtect
VirtualAlloc
SizeofResource
SetThreadLocale
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResetEvent
ReadFile
MulDiv
LockResource
LoadResource
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
GlobalFindAtomA
GlobalDeleteAtom
GlobalAddAtomA
GetVersionExA
GetVersion
GetTickCount
GetThreadLocale
GetStdHandle
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCurrentProcessId
GetCPInfo
FreeResource
InterlockedExchange
FreeLibrary
FormatMessageA
FindResourceA
EnumCalendarInfoA
EnterCriticalSection
DeleteCriticalSection
CreateThread
CreateFileA
CreateEventA
CompareStringA
CloseHandle
advapi32.dll
RegQueryValueExA
RegOpenKeyExA
RegFlushKey
RegCloseKey
kernel32.dll
Sleep
oleaut32.dll
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
comctl32.dll
_TrackMouseEvent
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Remove
ImageList_DrawEx
ImageList_Draw
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_Add
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create
comdlg32.dll
GetSaveFileNameA
GetOpenFileNameA
url.dll
InetIsOffline
advapi32.dll
QueryServiceStatus
OpenServiceA
OpenSCManagerA
CloseServiceHandle
0(0<0T0h0|0
1e1i1m1
2&2.262>2F2N2V2^2f2n2v2~2
3&3.363>3F3N3V3
6'6.696I6~6
7#7<7
9;9D9z9
:#:j:
;A;c;
=/>?>W>
111=1H1
4%424:4C4Q4^4
6(7]7}7
7*8Y8n8
<:<r<z<
=8=Q=
? ?$?(?,?0?
0J0S0C1l1s1z1J2_2
2D3K3z3
9%9n;
<4<m<
0&1z1
262B2V2`2s2
3I3P3r3
3U4d4m4
4I5~5
536?6
7$8,878c8m8x8
8*9.94989=9D9J9R9]9
:&:K:U:_:g:m:{:
5>7G7N8W8o=
0Y0{0
2,2<2C2
3&32393
9F9p9~9
9d:u:
;*;2;:;B;J;R;Z;b;j;r;z;
<"<*<2<:<B<J<R<Z<b<j<r<z<
="=*=2=:=B=J=R=Z=b=j=r=z=
>">*>2>:>B>J>R>Z>b>j>r>z>
?"?*?2?:?B?J?R?Z?b?j?r?z?
0"0*020:0B0J0R0Z0b0j0r0z0
1"1*121:1B1J1R1Z1b1j1r1z1
2"2*222:2B2J2R2Z2b2j2r2z2
3"3*323:3B3J3R3Z3b3j3r3z3
4"4*424:4B4J4R4b4'5,585G5S5
6#6+636F6T6\6d6l6t6|6
7$7,747<7D7L7T7\7d7l7t7|7
8$8,848<8D8L8T8\8d8l8t8|8
9$9,9<9H9\9d9h9l9p9t9x9|9
: :$:(:,:0:4:8:<:@:T:t:|:
;(;0;4;8;<;@;D;H;L;P;`;
<8<@<D<H<L<P<T<X<\<`<p<
=$=D=L=P=T=X=\=`=d=h=l=|=
>,>L>T>X>\>`>d>h>l>p>t>
? ?$?8?X?`?d?h?l?p?t?x?|?
0 0$0(0,0004080P0p0x0|0
1$1,1014181<[email protected]\1|1
3(3H3P3T3X3\3`3d3h3l3p3
4 4$4|4
5X5n5v5|5
;E<U<`<m<r<|<
>2>y>
3e5i5m5q5u5y5}5
5u6|6>7%9Q9Y9a9i9q9
: :$:(:,:0:m;
=Y>k>
U0o0y0
6'767
9!9%9)9-9195999=9A9E9I92:L:
:*;i;~;
=W=w=
>M>|>
0q1-2r2w2
223S3e3
4$5:5G5L5^5
717_7
8::R:W:c:
:);c;m;
<O<^<x<
>3>n>C?
3"3:3A3T3l3
3(474K4
4D5x5
5]6o6
6+7U7
8%8*80858;8B8H8M8S8X8^8e8k8v8~8
9"9(999D9I9f9n9v9
:0:M:
<5=e=w=
222;2V2i2r2
333U3d3r3
5-5A5
6.6V6~6
767g7n7}7
> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\>`>d>h>l>p>t>x>|>
?$?(?0?4?<[email protected]?H?L?T?X?`?d?l?p?x?|?
0 0$0,00080<0D0H0P0T0\0`0h0l0t0x0
1"1,[email protected]^1h1s1}1
2%202B2R2Z2b2j2
3:3p3}3
4H4U4~4
5%6Y6
7'7-727=7C7H7S7Y7^7i7o7t7
8$8/858:8E8K8P8[8a8f8q8w8|8
:#:0:b:f:j:
;,;D;H;\;|;
<$<D<L<P<T<X<\<`<d<h<l<
= =$=(=,=0=4=P=p=x=|=
><>D>H>L>P>T>X>\>`>d>
? ?$?(?,?0?P?p?x?|?
!0/0>0U0
1.1E1w1
252b2
3(3?3N3e3t3
4L4[4r4
=U=n=
>B>^>b>f>j>n>r>v>z>~>
1"1&1*1.12161:1
454N4e4
5+5a5}5
8 8$8(8,8084888<[email protected] :
=*>A>T>f>
2-2E2J2
313_3k3w3
4 4([email protected]`4h4p4x4
7r7~8
:!:%:g:
;@;D;H;L;P;T;
=%=/=A=P=i=
>->d>u>
?$?<?a?h?
0$0D0L0P0T0X0\0`0d0h0l0
1 101P1X1\1`1d1h1l1p1t1x1
2 2$2(2<2\2d2h2l2p2t2x2|2
3 3$3(3,3034383H3h3p3t3x3|3
4$4,4044484<[email protected]`4
5$5D5L5P5T5X5\5`5d5h5l5|5
6 6$6.626D6U6Y6
7&7D7_7c7t7
8 8$8(8,8084888<[email protected]\8`8d8h8l8p8t8
9 9$9(9,9094989<[email protected]\9`9d9h9l9p9t9x9|9
:$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:l:
; ;$;(;,;0;4;8;<;@;D;H;V;l;
< <$<(<,<0<4<8<<<@<D<H<L<P<d<
> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\>`>d>x>
? ?$?(?,?8?D?X?`?d?h?l?p?t?x?|?
0 040I0
1 1$10141<[email protected]\1`1d1h1l1p1t1x1|1
2 2$242S2t2
3 3$3(3,3034383<[email protected]\3`3d3h3l3p3t3x3|3
5*6d7
7g9~9
<?=O=\=m=x=
0$0:0?0[0h0u0
1$1)1H1U1`1m1
1<2H2g2v2
2^3h3r3{3
4'4L4\4{4
616>6R6Y6s6
8!838}8
:";j;
<&<~<
272T2
3b3k3y3
6U6G7
:M:g:
:-;K;
</<d<
<(=>=g=
=R>o>
0/1e1
82999j9q9
= ?'?
;0J0a0"1)1
2$2D2L2P2T2X2\2`2d2h2l2p2C3
5&555L5\5i5y5#6U6u6
6\7a7
878>8_9o9
;,;u;z;
=q>x>
?C?w?
4-5P5
5$6:6v6
6%7{7
9*9.92969:9>9v9
;$<2<K<
0 0?0C0G0K0O0S0W0[0_0c0g0k0o0s0w0{0
2S3k3x3
3I4_4
4P5~5
6!6;6w6
6.757
8<9_9>:_:c:g:k:o:s:w:{:
<F=M=d=
2&2=2
4H4y4
5!5G5T5c5s5
5&6+6
;h<o<
314`4
6.737E7
7"8*8H8M8V8\8q8
: :$:4:T:\:`:d:h:l:p:t:x:|:
;D<W<|<
=(=C=h=
=Z>^>b>f>j>n>r>v>z>~>
? ?$?(?,?0?4?8?<?J?R?h?p?x?
0!000
0;1K1
1?2F2]2
3=3F3
4Q4a4r5
7S7i7y7
7!8P8
91989p9
=)=6=^=o=x=
=1>9>?>K>R>
?P?X?^?j?r?
0(0:0
1U1]1c1o1w1
1)21272C2K2
3'3L3W3
4'4-41474;4A4E4K4O4U4Y4_4c4i4m4s4w4
5"5*525:5B5J5R5X5`5h5p5x5
6 6([email protected]`6h6p6x6
7 7([email protected]`7h7p7x7
8/8;8B8M8_8p8
9&9K9R9
> >8>X>`>d>h>l>p>t>x>|>
2(2=2`2l2p2|2
3"3:3>3B3[3_3c3z3~3
4 4(4,4044484<[email protected]`4j4n4
5 5(5,5054585<[email protected]`5l5p5
6 6$606=6A6R6Z6r6
8 8$808<[email protected]\8`8d8h8l8p8t8x8|8
8B9F9J9N9R9j9x9|9
:$:D:L:P:T:X:\:`:d:h:l:p:
; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;|;
<(<8<H<P<T<X<\<`<d<h<l<p<t<x<|<
=4=<[email protected]=D=H=L=P=T=X=\=`=p=
> >,>7>;>R>`>|>
132v2
;^;{;
;N<^<p<
0#1N1k1
1"222D2
4/4G4X4j4
576<6
7&707f7
879`9m9
:K:}:
;1;6;];j;
;*<i<
<L=h=o=$>
?0?A?M?Y?m?{?
1,2t2
2'3d3b4a5
<-=R=r=
2e3u3
4T4f4
5#696B6O6]6f6s6
9,9:9K9\9
:(:2:7:>:H:R:W:i;
=T=r=
6/6T6s6
;?;u;
= =$=(=<=O=S=k={=
= >/>q>v>
?i?{?
808t8a9
:N;e;
?D?j?
4/5?5
6D7L8d8
:X;{<
9!919I9]9z9
9L:l:t:x:|:
=`=y=
>">->7>B>T>d>
0"0)00070>0E0L0S0Z0a0h0o0v0}0
1%1,131:1A1H1O1V1]1d1k1x1}1
2,212>2C2P2U2b2g2t2y2
3(3-3:3?3L3Q3^3c3p3u3
4$4)464;4H4M4Z4_4l4q4~4
5 54595
9#9/979E9M9_9p9
:D:T:`:d:l:p:t:x:|:
; ;$;4;8;<;@;D;X;j;n;
< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\<`<l<x<|<
="=9===A=E=[=c=g={=
>7>C>Y>a>
?<?D?`?h?
070C0Y0
191c1
1!2G2
283{3
:7:C:J:\:n:v:
8 8$8(8,8084888<[email protected]\8`8d8h8l8p8t8x8|8
939V9^9w9
:*:W:_:
;2;:;X;`;d;z;
<4<X<|<
> >$>(>,>0>4>8><>@>D>H>L>P>X>d>p>t>
? ?$?(?,?0?4?8?<[email protected]?D?H?L?P?T?X?\?`?d?h?l?p?t?x?|?
0$0(0,0004080<0P0b0f0x0
1 1$1(1,1014181<[email protected]\1`1d1h1l1p1t1x1|1
2/2R2Z2w2
3-353S3[3y3}3
4*424M4r4
6'6/6P6X6t6|6
7*7X7
7!8F8k8
8"9D9e9
:+:Q:u:
:Q<[<r<
3T3c3z3
8Z9C:
;$;0;4;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;|;
<A<c<
>+>0>L>h>}>
? ?$?(?,?0?4?8?<[email protected]?D?H?L?P?T?X?\?`?d?h?l?p?t?x?|?
0*0.0M0n0r0
1D1m1
2 2$2(2,2024282<[email protected]\2`2d2h2l2p2t2x2
4 4$4(4,4044484<[email protected]\4`4d4h4l4p4t4x4|4
53575
6"7D7
829?9I9V9<:@:D:H:L:P:T:X:\:
<h=p=
4`4d4l4p4x4|4
5'505:5E5P5b5w5
6 6$6(6,6064686<[email protected]~6
7"7;7O7Z7_7j7o7z7
8!8*8/848B8K8P8U8c8l8q8v8
: :$:(:,:0:4:8:<:
< <(<-<X<
>O>r>
>n?u?
0"0&0*0.02060:0>0B0F0J0N0R0V0Z0^0b0f0j0n0r0v0M3,4w4
515X5
7$7L7h7t7
8 8$8(8,8084888L8X8\8h8l8t8x8|8
9"909?9C9Q9U9Y9r9
:):1:5:K:S:W:m:u:
;$;0;C;K;O;h;p;
<E<p<|<
= =,=7=;=I=l=|=
>!>%>)>G>K>O>s>{>
?(?L?j?
40I0P0`0p0x0|0
12161:1X1\1`1
2:2B2^2f2
3 3$3(3,3034383<[email protected]`3
546b6u6
8>:X:
:#;S;
?[?l?
0 0+090D0O0
212O3
4(4Q4\4
:\;D=z>
0H0A1
:&:c:
<]=:>|>
>9?]?
9D:y:~:
:H;z;
2$2m2
4*5r5
6-6:6X6u6
7*717j8
8$919Z9g9
<A<y<
383k3
4[5q5}5
606I6
7+7;7U7k7
9-9^9
:d;n;x;
;[<{<J=
>D>H>L>P>T>X>\>`>d>h>l>p>t>x>|>
?!?3?D?\?q?
0 0$040E0I0\0|0
1 [email protected]\1`1d1h1l1p1t1x1|1
2 2<2\2d2h2l2p2t2x2|2
3$3,3034383<[email protected]\3`3d3h3l3p3t3x3|3
4,404D4T4d4l4p4t4x4|4
5,5L5T5X5\5`5d5h5l5p5t5x5|5
6 6;6`6}6
7%7X7p7
[email protected]\8`8d8h8l8p8t8x8|8
9:9B9`9|9
:2:::P:X:p:x:
;+;3;J;R;h;p;
<$<u<y<}<
=7>;>?>C>G>K>P>
>D?H?L?P?T?
3070;0?0C0G0L0
1z1~1
2z2~2
4 4$4(4,4044484<[email protected]\4`4d4h4l4p4t4x4|4
4z5~5
6"6&6*6.62666:6>6B6F6J6N6R6V6Z6^6b6f6j6n6r6v6z6~6
7%7-7C7K7c7k7
838;8X8x8
9 9$9(9,90949P9`9|9
: :9:d:
< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\<`<d<h<l<p<t<x<|<
>">&>*>.>2>6>:>>>B>F>J>N>R>V>Z>^>b>f>j>n>r>v>z>~>
?"?&?*?.?2?6?:?>?B?F?J?N?R?V?Z?^?b?f?j?n?r?v?z?~?
0$0(0,0004080<[email protected]\0`0d0h0l0p0t0x0|0
1 101<[email protected]\1`1d1h1l1p1t1x1|1
2 2$2(2,2024282<[email protected]`2t2x2
3 3$3(3,3034383<[email protected]\3`3d3h3l3p3t3x3|3
4<4D4H4L4P4T4X4\4`4d4
5"5&5*5.52565:5>5B5Z5h5l5
6(707?7G7b7h7
7*858;8H8Y8
:2:v:
;';7;C;X;p;
?E?^?
0x1Y3
3"4i4o4}4
4*5E5X5b5x5
6)646p6z6
697K7T7
8=8~8
:1:>:P:]:g:
;(;O;X;a;
=:=B=S=q=
0&090V0e0
1*151J1U1a1k1u1~1
2 2(2.2<2B2P2V2d2o2
454:4W4g4
4P5_5
9<9[9
<1<:<N<
>F?v?
;=<D<
3"4:4R4n4w4
4R5[5z5f9
:e<u<
2&242C2
3*383
4q5x5
5b6i6
7'7G7W7_7
:";N;z;|=
:J:_:q:
;(;5;j<z<
=6=S=
=$?.?^?h?
'0+0/03070;0?0C0
1*2.22262:2>2B2F2&4/4G4D5
677G7
>A>{>
2B3W3
4#5I5_6
6L7V7
828F;N;Y;
4!6^7%8
>&>}>
>,?7?R?
9<;h;~;
=.>K>
0[1b1]3
494S4
;$;z;
0B0_0
293V3m3r3
5>7{7 8>8j8
5v698
:B;Q;+<;<a=~=
1,4>4O4g4
7B8r8O9
;%;1;9;E;P;V;b;l;r;~;
<!<&<+<6<;<@<K<X<j={=
>$>4>J>R>^>h>q>}>
?+?8?B?S?\?|?
0$0)030C0N0[0
5 5$5(5,5054585<[email protected]
6 666:6P7]7
9 :/:Y:
>!?1?
2,2C2
3"4?4}4
4C5S5
5,6A7n7
7$848
929T9[9
:!:,:<:G:R:b:n:
< <$<(<,<0<4<8<<<@<N<`<d<h<l<
= =$=(=,=0=4=8=<[email protected]=D=H=L=P=T=X=f=j=n=r=
> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\>`>d>h>l>p>t>x>|>
? ?$?(?,?0?4?8?<[email protected]?D?H?L?P?T?X?\?`?d?h?l?z?
0 0$0(0,0004080<[email protected]\0`0d0h0l0p0t0x0|0
7 747H7\7p7
7o8C9
9*:`:
?D?T?d?l?p?t?x?|?
0*0B0c0k0
1,141P1s1{1
2 2$2(2,2024282<[email protected]\2`2d2h2l2p2t2x2|2
3"3&3*3.323L3f3j3x3
4 4?4
707K7x7
888<8
9 9$9(9,9094989<[email protected]\9`9d9h9l9p9t9x9|9
: :.:6:>:F:
;";&;*;.;2;6;:;>;B;F;J;N;R;V;Z;^;b;f;j;n;r;v;z;~;
<2<6<:<P<`<p<x<|<
= =$=(=,=0=4=8=<[email protected]=D=H=L=P=T=X=\=`=d=h=l=p=t=x=|=
>.>6>S>[>}>
?0?8?<?V?^?|?
060>0f0n0
1!1D1g1s1
252=2A2]2e2i2|2
343]3a3e3
4"4;4?4C4G4\4
535;5?5Y5a5e5~5
6!6-6C6O6e6q6
7+777O7[7v7
8.8V8b8w8
9-999S9z9
:=:f:r:
;<;L;X;\;d;h;l;p;t;x;|;
< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\<`<d<h<l<p<t<x<|<
=$=D=L=P=T=X=\=`=d=h=l=|=
>!>%>4>K>T>
?&?.?6?L?^?b?q?y?
030=0d0m0u0|0
1Y1`1
2D2c2y2
2;3{3
4C4Z4
5G6Q6
6G8y8p9v;z;~;
>(?Y?
6&7V7q7
8:9E9T9y9
:C:H:d:
:);=;Q;r;
<\<o<
;0t0}0
;X<h<
=b=o=
>$>D>
2^2|2
5"5&5*5
<9<H<
>7>~?
1%1A1d1
102B2`2s2
3+3J3b3t3
3'4F4W4
7a8l8
>(><>J>R>a>t>
-070Q0
1#2e2$3M3k3
4Z5o8{8
:$:6::;F;
212\2
383F3R3`3
3&4?4X4f4r4
6"6G6c6
8'8A8
8Y9c9
;!<.<O<}<
>V>[>u>
3T4u5/6
:E:N:S:\:t:
;8;H;X;
<G<S<_<k<w<
<T=l=
1"1"2*2<2H2R2;3A3M3
4^5b5f5j5n5r5v5
7:8i8
9,919P9Z9
:1:7:D:U:^:f:s:y:
:g;~;
;R<^<g<l<x<
===N=
=d>i>u>
0%080Q0k0
212m3
4*4L4j4
5&5I5p5}5
6(7,7074787<[email protected]\7`7d7h7l7p7
7T8v8
9=9L9
;!<V<
<$=:=
=(>r>
> ?K?r?
1 4F4p4
595y5
<t=x=
> >$>,>0>8><>D>H>P>T>\>`>h>l>{>
? ?$?C?O?W?_?j?|?
0 0$0(0,0<0[0
1p3<4G4f4x4
;/;<;
6$6064686<6D6L6P6T6X6\6`6d6h6l6p6t6x6|6
7 7$7(7,7074787<[email protected]\7`7d7h7l7p7~7
:$:8:L:`:t:
;1<T<
=.=:>i>n>#?Y?
1?1u1
2)2;2M2_2q2
[email protected]`5d5h5l5p5t5
6(6,60646p6t6x6|6
0%0)0/060:0T0]0f0r0|0
161K1W1_1i1n1s1x1}1
2$272C2M2T2^2e2o2|2
3%303:3E3O3V3`3g3q3x3
3V4^4i4n4x4
525B5J5R5\5f5q5v5
6*6/6:6?6Q6b6k6p6{6
7&737=7J7O7W7a7l7
9 9$9(9,909l9t9|9
:P:T:X:\:`:d:h:l:p:t:x:|:
;$;(;,;0;4;p;x;
< <(<0<8<@<H<P<X<`<h<p<x<
= =([email protected]=H=P=X=`=h=p=x=
=l>t>|>
?$?,?4?<?D?L?T?\?d?l?t?|?
0$0,040<0D0L0T0\0d0l0t0|0
1$1,141<1D1L1T1\1d1l1t1|1
2$2,242<2D2L2T2\2d2l2t2|2
[email protected]\3`3d3h3l3p3t3x3|3
5 5([email protected]`5h5p5x5
5d6`7
8 8$8(8,8084888<[email protected]\8`8d8h8l8p8t8x8|8
9 9$9(9,9094989<[email protected]\9`9d9h9l9p9t9x9|9
: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:
; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;|;
< <$<(<,<0<
333333333333333333
33333333?333333
33?33
33338
33333
33833
333338
33333833
33333
333838
3333339
3333333333333338
333333333333333333
334C33333338
33333
33B$3333333
34""C33333833
3B""$33333
4"*""C3338
"C3338
:*"*"$3338
"C338
"*"$33
"*:"$
"J"$3
:33:"$
"C8338
"J"C3333
3333:"$
#33338
33333
"J333333
33333:"$3333338
333333
$3333333
333333:"33333338
3333333
33333333
333333333333333333
33333333?333333
33?33
33338
33333
33833
333338
33333833
33333
333838
3333339
3333333333333338
333333333333333333
33DDDDD3333
33333333333
333333?
333333
333333
3333f3333333?
3336Dc3333338
333>fC333333
c333333
3333333333338
3333Dc3333333
3336fC3333338
333>fC333333
333>fd333333
fC33333
3333>fd333338
334C3
fC333?3
33fd3>fC333
fDFfC338
33>ffffc338
fff3333
33833
33338
3333333333338
4DF334DC33
333*C33
c33*C333
338?3
33338?383
F*F333383
"$c33333
"dc3333833
CjC338
CjC338
D*C33383
33333
3332*
C33333833?33
3333"
3333333
3334JC33333338?333
C3333333
C3333333
3333fc33333338
333333333333?
33333?
333333
333333333333333333
333333333333333333
333333333333
33333
334C33333338
33333
33B$3333333
34""C33333833
3B""$33333
4"*""C3338
"C3338
:*3:"$3338
"C333
3333:"$3333338
33333
"C333333
33333:"$3333338
333333
"C333333
333333:"C3333338
3333333
#3333333
3333333:3333333383
333333333333333333
333DDD33333?
2C4"""D338
2$B""""C38
2""333:"C8
83338
2""#33:DC8
333338
33333
333333333333333
333333DDD3
:DC33:""$8
:"C333
$334B"$3
"DDB""$3
3:"""""
333333
333333333333333333
333333333333333333
333333333333
33333
334C33333338
33333
33B$3333333
34""C33333833
3B""$33333
4"*""C3338
"C3338
:*3:"$3338
"C333
3333:"$3333338
33333
"C333333
33333:"$3333338
333333
"C333333
333333:"C3333338
3333333
#3333333
3333333:3333333383
333333333333333333
33333333
]]]XVVV
MMM!PPP
YYY!ZZZ
bbb"ccc
fff"mmm
NNN6SSS
VVV7WWW
\\\7^^^
bbb7ddd
fff7mmm
WRHDFHPLFBXWAQWTZXSVQBKWXEBTYQLBNYWCUJKOEIROMYHPDYWUNUDMQOSPEIJDDCWDIVRYOZNWADFTTTZJRETJPAZURIZHUSIJPSQWBOJQAXGJZFVLYXDZJEJQOUFQILIYWXKKOGUGTHJXRKHZKRZPQIVCRFMOCHYCSHSMBBTPHYRHTPF0
T__3764284229
T__3764281036
BorderStyle
bsDialog
Caption
About
ClientHeight
ClientWidth
Color
clBlack
Font.Charset
DEFAULT_CHARSET
Font.Color
clWindowText
Font.Height
Font.Name
MS Sans Serif
Font.Style
OldCreateOrder
PixelsPerInch
TextHeight
TImage
T__3764287399
Width
Height
Picture.Data
TBitmap
)#"+%#0*'72/=<:=;674'53"/.
59*:>2:=269+./!%$
1- 0)
>P!CP#GO$JO%MN&NL&MI&LE&IA&G>%E;$C9"A7!?5!>3 <1 90
3**<33D<:LEBVRP\][]\YZWMYYIRT<QW=S]FT^JT]JNVB?F/=B*KL4LH1F=*H;)J;(K;&N>%QC%SK*TP.PN-HG*@?&;8#74!50
BS!GT$MV&SX)YZ+]Z-]X/[T0YP1WM1TJ1RG0OD/LA/I?-F<,D:*A8)>6'<5%:3#:3!:3
!7*,G:;QEEe[Zogexwu}}|}}|}|z|}xx|ot}io~dk~ah|][email protected]^kEjpJc`<^T4^N2aN1iT3o[5qb6rh<qlAljAec>]Z;WR7RM4NG1JA.E9)@0#:%
BN GP#LR&RT)VU,XU0YU4ZS7ZR9YQ<XP=VM<SJ;PG:[email protected]?/E?-E>.F>*G?%HA%IC#ID"JD
F\ Ic"Lj$Mk%H`#>K
A+0K6:VDGl[\
UyzDvo=zl=
{WzuUtnQnfLh][email protected]*;
i&"r/$y7%~>$
GH!II$LJ(OK,[email protected]>OI<PJ;PK;QK8SI/UK)UN'VO'UQ%UT&SV&QV%LV#HV
I\#Oe)Tn/Yw2\~3\}[email protected] +0
%( #"
"%"%& ''
>:(>4'B.#>& 2
A%*Y6=aAGkNS
n[kTIS96?#)4
(_ )n'+|2.
IF!TO)XR/[S4]T9^[email protected]_WG`YL`[Q`[U_[W]ZXZXWXVVWTTVSRURPUPMWQLYQM[QK\PL]RI_T=`Y0a]0`_4`a4^c3\c3Yc2Tb.Rf/Xo6_z=e
BRh<=L//9*'/*"*+
$(%+*-/(21%11".2!0:!:G#=N$5I"*?
5O"<S$9L#7H!7D!#-
~(jp Tc
=J%@[email protected]??DIIDDCI=8E31;+,=&)[email protected]
qs[XT:??%25
/] 1o%2
JC#ZP/g[:l`BobIqdQrfYrg`qifpikninlhnifmecka_h][d\W`]T]_U_aV^cX]dZ]f][[email protected]^m=Zp9_yBh
S]zOF[B4D9(66"/6
%-&.1/3037/5</3>.2B,9L.>U/<X.1N*!;%
1#!<'4P-A]1<U0/E+4H-0C*
-Wh&I\#<O!?Q#>O&[email protected][QE\^EYeTixat
XgxTU_QKUIAJX:=
zmX]O9F=';7
J;$TE.\M9aRAeVIj[Qn`[qddrglpgqmftidueara\n\WjYTiZRh\Ti^Vi`Xia[hc^fdaaeeUejJemMeoNcpM`pK]nG[qF]yJe
[JgQ5LE&9?
(5$/7$/5%35+:7-?7,A60H68U7<[70Q4"A1
;/ =0.L5=\;?];0L7)D4/J7"<1
>, B,(N-)N*.O(>[(Ql*g
:Sh/J^,@T*J_/@[email protected][FGh\KopOr
]g|^_quPS
or]KWE2F9&?6!>4
T;%aG1mR=s[HoZNlYSlZXk\^j\cf[h_VjWOhTMiSLgSKeSKfTOmVRpXTqYVq[Xp\[n^^i_b`_eX_iX_lY^nY\oWYoSWpOZwSa
gJp_6VT&AJ
6? 9>!<='E>[email protected]:]@[email protected]?-N?1SA;]E?aG8YE(I?'[email protected]#D>
@; D<
G<#K<%N:-Y:5g98d4:_3Df4Vx7q
KIb8E^4=T2Ja9A[>EhUR
n^iSBUB1J8(E3!B2
X-$j<0{K?
ekzbmr]niXn_QmVIkQFjOFlOFmOEmPHoQLsSNuTOuVTtWYrX]kX`eXcdXdeWedVjbRl^SmZTt\Z
tIyn9be(K[
<X(D^.Ha/F].AX.=S,=Q*>P%=O
>G&[email protected];`P7\O;aR?fT<cS-VN%MJ#KH#JG#NH#PI%SI*[K+]I0cG9oE>tB?m?IuAW
K\zHQoFYyHCa=A_<?[<GdEImUT
tzeVgPAYB2Q9*M5%J6$J7#J9#K;"K<"J>!I?!HA GI IZ Kl K
bR~ZO|UKzQJyQJxQIwQJwQPvQUtQVrQYpQ[pP]oO_mLehHkeMqgS}kY
<ny.Yp$Jh#Gg-On:[email protected]?Ng;Mf6Me-Ia%F]"DZ
CW EV'NW4\[email protected]]Ck_;d^;[email protected]_*YZ&UW'UU(XV*_Y-bZ0hZ4nY9rV?xSH
QW~R[
aW{dRwaSxZFiMCfJCfLJs]X
{kwbSiNA`B6Z<0V;-W<+W=*X?*XA)YC)XE(XF(VI'UQ&Xb&[s'Z
JR{IQxITwIXvH[uGatFgtFovKzwP
O_}FYzAWx;Uu2Qq.Qn.Sk*Ri&Qf(Uf5bjConBno>ko?noDur?rq2gk,bg+`d,ce0kh2oh5th>
sO{lR
yiy`SoODiE<fB9eB6gB3gD2gF2hH1iK1hM0hP/gS.f\-hk.kz/k
+X%?o1P
;a~7a{1^y4byAn}Gv
<w~3py0lt2ot7xx<
dW{[email protected]<xJ;xM:yP9zU9{[8|a6|d5zi5{s6|
;#:X8WrMr
:'<U;ZmMu
5%:N5UfHs~^
1!6J4SeKsz_
0"6J7T`HpoS
0"6F3PT>faG{lQ
.!4?-IK6]V>q^F
08(BD1VM8iV?~bJ
,3$=>-PI4cV>{bG
(.!9:*LI3bW={_C
6:(JI1aT8vR9
49&IF.]J1lB.u6+~1(
26$F=(T:&\3$f3&y6(
`7%{='
Ewz=hv7Yq1Kh+>^%2T
}H|o?na4`[-RQ%EE
sG}oBpi<ca5VV-JE ?:
gC{fApe>db;X^[email protected]
GE ZI"kC r?
[=wY;mX9cX8X]9M^7BQ,8>
-8 ;D%LQ)_Z,rY*xS&|O"
{S yU%uV+rV0tX6u\=vcHvjTvq]trdrpetiaxb\|^X~VP
;5}:5|;6~?9
H7~G3{E0{C.|D-}J1
S7~\@~iN~oX~wd|ylyjava[s`Zq[TsOIuQHv^Ov\IuYBt\Av^K
lS~kQzdZ
i8~f6
>:{=5w>3w?1wA1wD1wG3wJ6wP8vU<uU;sQ7oN5hO4_O4VP3LR2BR18O,0D#(4
!4!2A)BL-RW1b`3sd2|f0
oa lb&hc+eb/ea3eb9ed>egDdhHcdIbcLc_JeZJhYKjUIkSHlPGmMFnKFpIGqHHrGHrGIqGKpILsMMtSNuXMuWFsQ<pK3mF,[email protected]&j=$jD(lO-mX3me;mlClnKkzYi
egw`dfTb]Ma^NbZIdN?dK:dM7dW7cX6gZAxYJ}XSxXYxW`
cY{bNpbHhWRjT]oTVoTLnUDmUBnVApW?qX=rX:sY7sY3tW2}S1
[email protected]~<5m9/f8-e8+e9*e;*e>,[email protected]/dD0dE1bD0_C.YB,RB*JF-AK/8G*0A$(A" <
"2"2A,BK1RQ3_Z5n_5xd4
X_ W_#Wb(Vf-Vi4Ui9Sf<ReASeEUdIWhRYl[[od]pj`nmblneingfnhcmiamianicnjgmlollthloZidHeX8aM,^B"[7
YM(Zg5]s=\tBZ}PX
bTxYRXCQA2RF4TA1T8*T;(TK+SI+XU6f_?n\FlWLsSU
GZrFT{JZ
zUu_RlXJaWDWKQWG][GPZG?WG<YH<[H;^I9bJ8cJ7dK5jJ4tH0uE,uA(p=%g?*iE1mL=uQS
I?uB4d=,Z8(U4%U3$U4#U6%U8&U9(T;)T;+R;*O;(K9&E7#>:$7B*/B('8
"0"3C/JT8_[:lW5oR.nL'lL#nO#rN qH
Jl Jr'Hz0G~9E
a_pJZ]6TN'PB
FI I`*Js7J{DH
YDgFCC-D;'E=(E5"E5 E:#E;(KL1VZ9_Z?`PBoGE
?XtD]sMk}Ty
IqsLtsN
~Lj[I^MKPKKGBPF>XI<QH:=F:9I;:N;6P<5U<6Z=6_=4d<1g;*^9#U6!U2!X3*d87p>G|A^
ZGyQ<jI1[C)N:#G2!F.
F1 F2!E3#E3&C4%A3%>2"90
-3 '5
/#4E1MM4Y<'P-
XE dD
9s$8{,6
ROl;JV(DB
9b&:p39j68wE7
Q7vI6a<7J-75 82
83!<8,CG7JO?PRDTICj=A
[email protected];Ke?Z^AYQH^QJe_Qr
Ai}EenEkmKjfOzzLuzKnrGa`AOMM=CW8<U89^84c</P=/IC/KN/:I07N0?^1:]1/T0(M/$I-"M+(\(,e(4n-D~1W
hMwdDj]:]V1OM)BC"98 81
6. 4- 1,
/8(A8'D0
MB UJ"ZI
MAv:>d(;P
-\#,P!,V,+]5+_7+]7+K-+/
-1$7:[email protected]=CIEEMIJCLf7J
3Fk5C]0Ao7KY<M>>R7BV=E[GKcWPeaSh
?b}KcdIihLjfKaWH^ZFZ_GORD>II.?c,:`,5e-,r4&g8%[email protected]%OF%<B&9H&AW&7Q'+F&'C%'H#)S!/^
vb}q[ylTthMmeEec>[`7O]0CV)8N$0G#,@",8
BC!GJ!HQ!HV
@1x//f!-T
9 7 +
$2$4;1<B><ED:IKBCTg9P
4Kd-Gb*Gi5KQ>M4=M->N5AP:ES=LZCLZRN[tbb
Ac|?[~KavjopdlhMZQIPEENIAT\GMWM3GP$>h"8m"-c"#i(
dn{]kuVgnObgG\[email protected]]9K]2B[,8U'/M#(G "C!"@"">#":""4 !+
3<$9F'=N(?V(@\&>a$:e!5g
)8*5>[email protected][email protected]@Dh08q27V56K/7Y/EX5OG>K.?J)@P6=H?>G>CN=JUKESXOOh\P}eS
@QuCQWJVTbfc
wusmlPSMEF=ERNFahNQc^)IX
\Y|UVtMQmEKe=D^6=[06X+.S''M# F
&. +6%[email protected]*5J.9T2<]5>b2;e/7h-2k+-m&(p!#s t
9#*8,(?5)B8F:9o16q6=R3=T.;a/AN7E1AG'FI'BH0EK\DIi?FVIOWBMJBMKHI`ECPPG`]Qri[~h_
=Bw=BQDJGFI;UREh^bSUm>GaAFNISLJOWR7Px
RE{LAuF=o?7i91f4*b/$Z+
[email protected]`50B63D45J;?:AI(BK/>A1<>=FKhDK
KX~KSvHNjFMdJInNH
[email protected]=DC5ID9LIQDJt;En=ATDA=E=MY.Y
W8~R7zM6vH3rB0m=,i7'j4!j2
.(&90.<30E86O>;XC?dIDtRH{RFuI<rB3t<-v6'|2"
c1"Q/QA2c86K=;O=BU?E?>?!>A!CB?>AfGMxKO
PP{@AT=E>CHILEXVIacQxiR
DI|GHiQSddhl_]j]O
XL~TWmLVhBFSGCPQMM]WXKLfFE`[email protected]*U
P*yI'qA%i9!c2
'$"-)%61,=60=5/F;5RD<_KBkSG{[K
X2HM?iNEWVBHT6>S46Y9+U>[email protected]
KEc;<B9=7JDRXKgeP
a^~|z{pkubQ~bT
POyXKxoer|phd_SOJ=SK6GF3B62X C
)%":[email protected]:3I=6O?8ZF<kQC
\6=\CSgGHoA9c/.]).^*-`1-aB=WU[]^
NEd<7CC>HXKneS
qez^T
<Q}=F
qnxhbnXKiZOmgiv`ewTRn[Mrqdm{o_j_ESK/H?/=8;=29V
'$ 3.(=6/F=5NA8VF;fPBy\G}[C
S&"]63iA?sB?f15`+3_)1_*1^16\BBe\oyw
F<a>7JWKqh[
EDyNLmOJcKFSGCGJJENOKIKGKIBVQ?YT7RL*HF(BE<9?QC3M`
2/)[email protected]?`WJk^Ok[Kp[Jy_H{]C
e.&^35g:B`2>a-;`+6\+7S,BG2VKEdlk
ZN~E7e\KyZM
@EsECtGBfB?L?<;==5AB6?D2CF-LJ-KH*MK)UT/JN==8EH#Ac
)&!95.ID9^UHqdTziV
b,0g9Gc6Hc/@^.<P2L>[email protected]?nb]
K;zWC{E3zE4{ZG|[email protected]*
GU}GJ
FD{HCgB>M?==<<4<@->B*EF)IH*MP7TS/QK&GC2>2FP!Jg
-*%83-<70B<3LC:VJ?aRCs^K
f%*h6C^2?a0?[4KMHmGR
:L|5Bt89jJGne_
3/{MA}B2x4)x1(x/+z1:
;X};P
GF|[email protected]>?<=2?B-?C*KJ*TQ.QO0PJ*SJ.OFDK3Z]!Vd
)&"62,;5/@81F<4L>7VF;iSC{_I~^D
"h/8e1:b0>\;Zca
NY~?Iy.8o55dVMWc\k\U
+6~/C~5N
4NvPawZ`|KRvDNsO`
II{JFeDCLDCD>>[email protected]<HO4HW)Fs
1,'=60JA9VI?^NAjVFx^I{^D
o#+o-8h/CdDixt
+>z.0gD6FWOE[[eSY
0O~.N{0MuUez|u
vlv]`wVe
GIuHF][email protected]@C/EH0MK2OJ>SHRY>J`3?^':_
/,'C=5PI?aXJqeTxhU
y"*u+9p/GnDj
=2dIEHBM?AIMON
N^ubgtS^sO^
[email protected]?A*CE1IEEUGXcANg8Ab,;[
.+%<8/FA7OJ=[SDk`L
-9t+Eu9]
/PxAVx;MqFQ{BEwCBZ?=AA>E>>3?A'@[email protected]@AMD\_APl<Fp6Dh+AZ
)("42+FE9WVGWUEURCXUEb^JxqW
-:w+Kw0[uBtua
GCkFG=AK9EIaC>L]Oat^|
0Gx8?p<:g<:H?;A?98=<'<>%==1?>\I;_\:Pi9Lo6Kh,EY
%% 53,<<2XXHpq[nmYsr[}{a
2-}/Dx.Uv1_p8kiL
GHUFOKIJ^MIP{po
+9u20k92Z;3E=8.>>$>@/79F65h;0bB1\V8]f8Wk3Pm,R
(xx ]M
&%!;:1JK?`bQmo[su_}
q';v.My4][email protected]|VU
SPfMTUPSdXUf
1/|5.r81\959>>[email protected],59_-1x..t-/l61iN;fd<_i8^r2du)e
IA ZQ']R)fY-
:92PQE^bRacTdfVikYst_}
1J}8_v;qr=weB~WQ
ZWnQVUXVhfY~
5-p81X<84:;5/9s+5
*8v3;qQEn`GldHmj9k}3t
1ny0^s/OJ#2E#)S/*T8+\F.]N/_W0ba2hh5[X/a]2
r3w_)WE
=azAxtE
eb|UXc\\tlb
6-s74W7<F-:{/B
0F|<LvQ`|Ye{mSx
F`Y5?Y:9nMBrXCo^[email protected]
Ot}Ey
y:r^(K<
# "420FE?PPHPPINMHPOIZXPifXyua
^avcf
60s;;[-8|4I
d^|gZsfTvqVw{X|
t3aQ%A5
/*+A=:OKFOJIMGJNGKUMOdYXvja
1 p%!k
`bx]aujl
><o69s;G
fh|ucy
:oa+NC
-&-=5<D:[email protected]>P\HWhP]pT`xVb
%.~#-x',v),j",n#,{&,
Bj#F|'H{&Iq%G|*J
1Q~,Sz3`~F}
`d{_czoo
AC|@ElIM
cl~mo|
@xp1VP$<7
#,!03&<5%E5$H;'KD-QN4VT7YX7Z[9\c<`pBi}Gq
":~ 8v$8~/8x*8t'8{,8t%8`
@Y#Ec(Ip+L{.Ox-Qm+Tq,Yv/`~<s
HQp^T~rc
sz~xz}s{
{ayje{ex
8&}7"r7
s\#yd*
9`b+FH'<<&97"/-
*/!78%[email protected]*RE,WL1\S6aY:eZ9gZ7hX5hX3i_5og8uq<{[email protected]
1Fx-Fz1Fm,FN
FP!FJ GQ%J_.Pa/Rh2Tn4Vo3Yl2at6i}?w
u[w|^{
dvzcsufz}
YxxCaaFa]]tft
F0|E,sE(jD#_C
`T!sc&xk+{q3
@jw2NY.EM/GJ/CD&23
1/ @7%P?)^B*dF-hI/lM1pQ4tW8xY9xY9zZ7}X4~Z3
4Uz3Us3Uf/UT'US'UQ'UO(UW/X`7]_6]Y2[\3\c5bi8lzD
`y}b}
LpuCfjMllb{r~
U6yT2nT.eR)ZQ$IQ#BR#AT#GU#WZ%kf)xr.{y4
;Zs2J^6N[6OV1DG$11
8/#J7)^>,[email protected],vA,yA,{A+}B-~F/
;e~:en4ec1e]0eZ0e^4eg<gg>id>j^:iW7hY7h][email protected]{R
eC}e<sd8jd3`b.Va)Ka)Jb)Nd)\f*il-rv1x
<Wy9Rm<Xh6NX-?D!-.
1*$D/'Y4)o7*
Bwy>[email protected]>y];w]<v_=wmJ
wJ~wCtv>ju9_s3Yq0Yq0^s1gv1oz3q
A\}<Vl2FV*;C
&$!:)&P.)h2*
-#"B&#Y)$r+#
!3$$J&#b'"~)"
:Mv2B_'4E
"$&8(*P))k)&
5Ff(6I
"#%9)+S*+p*(
5Gi(7K
#$':(+T)*q(&
1Cg&4J
#%):+-T+,q'&
+<b -E
"#%8)+S,-q))
/Cz$5\
6&&Q))p))
,D|"6\
5"!O&$n'%
@@d35G%(/
G6g;-J,#1
N!#sxy
I2t='T.
A/t7%U*
cL}aF
oa}m[shRtbI}\B
naysipqeijZicOp[FyT>
4'x-!b$
q3!s6$u:'v=*vA-uD1sG4oK7iN;eS?jYBq^DvbE{gF
8*|6)z4(u4&p2%n0$q0#t0"v0"w1$x3'y1%x."w. w1"w=&wL+wW0wX3vT5uT;sZGpdXjmeckc]bW][email protected]'w?!w;
8 z9!w:#x;%x;&y;'y:)y:)y9)x8)w7(t5'o2%f*
b0 d4#d7%d:'d<+b>/[email protected]/YB1VG5YK8`O:eS;lZ=yaA
eBx^>k^>gfFovU}xMtuAhx;e
[K|eV
S0{>&q<&q;&q5!k3
eJ%eZ+e]0dX2dQ4bQ;`WI[^UU]VPULPLAUF8[B2`>,d;&e7!e3
e9!e:#e:%e:&e9'e9(e7(d6(d4&b3$_/!W'
T1 T4"T6%R7)O7)L8(I;+L?.QC0VG2`N4mU9{^>
eE}aCpaEebD\jJa{Zt~VqxB]
`Mw[JsXGoN?fK=dXNp`Uyob
y=}f.wH#i8
U[%Ud-T^/[email protected];C<2H8+M4&Q0!S-
X8 U9"U9$U8%U8%U6&U5&T3$T1!R/
F&$F($F$
E0 C1"A2$>2$<3%?5&C9([email protected]*VG.bN3mT8x[=
`D{`EseJkeK_cGTdCNgCRpCS}?L
2E~/Ex,C
[IlL:]E4WF6WF7VA4S>2PLB^YNlla
8nm&i\
Ff(Fc,FX-EL,[email protected]=;186+70$;*
F7 F7 F6
F4!F2"E0
8 !8''8,+8,)8&#8
4,!2,!0- 3/ 84"A:&LA)VG,_L1hQ6oW;u`D}cG
]B{ZAyYAwYAsZBn_Gj_Ha[DUW=HT7?\6>p:=
4:z,8t&8u#7~"6
mYv[IeI8T=,I9*E9*E6'A6(A8,B6,AG>QXOclbu|o
8e$:h+<^-;Q*9E'6=(46'1/".)
,"#,**,/-,-+,&#+
85"A;%[email protected]%RE*YI/_N5dU=kT<kP:iO:hO:gO:cO:_O;ZL8QI5HI1>P17a66v94
51|,.s"-r
n>ptMn|Uo|WnxSnfFaP8Q?-E8'>2#96'<3$8.
40#58-:7,:I>I^S[ock
.e%1m,3e-2V(1H#/=!,3 *-
!%%!,*!,)!"
64 =9
n)pY*Xe5Wk=Wj?Vh>VZ7LG.?:'87&60!12%2*
*6*04&0C5=aSQsb_
%h))o.*h-*Y&)I
62!98(@9*B5'A5'@5'@4'?4&=3%:1#62"19$.E(*S)'a*$t)"
v)zl&po&n[!ZC
AV&H\,HX-CV.?K+8>'25#-/ ))
!3%&-
$7)-\KBo[N
b+ g."`)"R"!C
#G#!S#
5K!6G!0D#,9 '/
2""WB4iQ?zaJ
s,xh(lO
R:)]C0fL7
w[]zD8
Th(jj+kZ%_O"VG
N7#Q:'kS8wcMwibpddultwr}xs
xs}wnvt_eiNSL.4J"!Z"
Q=$ZJ3ZOCUJGUMOZU[[W^\X_\X_[V]WMQP:<K-05
<4'80*6-,;79=:==;>=;><9<8-/0
"!"" !!
TLabel
T__3764290569
Width
Height
Caption
HaarWavelet0.6b (C)2K2 Carsten W
chter
Color
clBlack
Font.Charset
ANSI_CHARSET
Font.Color
clWhite
Font.Height
Font.Name
Tahoma
Font.Style
ParentColor
ParentFont
T__3764321197
T__3764318027
BorderStyle
bsDialog
Caption
ClientHeight
ClientWidth
Color
clBtnFace
Font.Charset
DEFAULT_CHARSET
Font.Color
clWindowText
Font.Height
Font.Name
MS Sans Serif
Font.Style
OldCreateOrder
Visible
OnClose
T__3735753522
OnPaint
T__3735750352
PixelsPerInch
TextHeight
T__3764326801
T__3764324390
BorderStyle
bsDialog
Caption
ClientHeight
ClientWidth
Font.Charset
DEFAULT_CHARSET
Font.Color
clWindowText
Font.Height
Font.Name
MS Sans Serif
Font.Style
Visible
OnClose
T__3735753522
OnCreate
T__3735818730
OnDestroy
T__3735821141
OnPaint
T__3735750352
PixelsPerInch
TextHeight
T__3765184739
T__3765181569
BorderStyle
bsDialog
Caption
ClientHeight
ClientWidth
Font.Charset
DEFAULT_CHARSET
Font.Color
clWindowText
Font.Height
Font.Name
MS Sans Serif
Font.Style
OnClose
T__3735753522
OnCreate
T__3735818730
OnDestroy
T__3735821141
OnPaint
T__3735750352
PixelsPerInch
TextHeight
T__3765215390
__3765215390
BorderIcons
biSystemMenu
biMinimize
BorderStyle
bsSingle
ClientHeight
ClientWidth
Color
Font.Charset
ANSI_CHARSET
Font.Color
clWindowText
Font.Height
Font.Name
Tahoma
Font.Style
T__3765368912
OldCreateOrder
Position
poDesktopCenter
OnCreate
T__3735818730
PixelsPerInch
TextHeight
TPanel
T__3765218560
Width
Height
Color
TabOrder
TImage
T__3765221730
Width
Height
Picture.Data
TBitmap2
uukRO,,,,,MWw}
}{wgffUJ##"
..06==
?????
TT<TTlQOQl
T55::))))
ukRO,,,,,,MUjw{}{{wjrcJE##
ttetu
1222=
??5<<T
TT<TTTQQl
T<5::))))'
"IPsy|
uuuuuuuuuukRO,
,,,,EUfjwwwwjcUE#
tteeku
TT5:)))4'
H[{{H!
"IPPeeeeeRRRfffRROO,
EMUcggYUE
zzznvmmmvz
uteOORo
l<:))4'),
+H+[{[!HH
"",,,,,
ffjjjii\iimvv
utI"IPPe
(++++
T<QO)4*,
''V4''4'4_
l5T?4)*YHHH
:iv**EEEEMMMUWWinvv
IPPh:
m545T
TTTTT
<Q5454*@
*EMUWWivvm
%.Z[[Z
,EMMWWivvm
(+/'18[[Z
MMMMUWivz
(88'1(Z[Z
))MMWWiv
**555)'
(*8'')ZZ*
*MMWiv
44VVQ554)'5
&*'*)))EE
'''''''
)MMWiv
tO,O,)
,,:V]mmQX55_:
''()))'''
)*MWjv
okQQ"OQ:X5OV]
):V5)44*)'
kQQQQQmm:QV
TTmQ4(&
m]Z+ **8E):VX5):::*)
kQelo
*VE)V]]5UU6'4*'
uohooRD
*8EY*V]Z5WWW6')*
uooooR,
*ZY[ZZ]]WW]WV4)
zkoooR"uu
*Z[[[]]w]W]WW))
oukkukhku
]]8+**ZZZV]]]]]_YE)
*EMMM**
]]8+*+ZYZY]w]m]WE4'
*MWWWWVM8'
)Vmmo
v]]88*++8YYY[]VWW)'
)MWWjjmi\V8
vZZ(8
**YYV:)E
):Qfin
vZZ*V***
*E*))*
),:Qiv
'MW\m
QWV(V8
),:ho
m\V8)8VWW
l:E'58*
),:Ql
miVMVVVVm
?51'0'
OQ44*
),,Qh
m\VVWWMW
1.3>0$
),,,:hv
mmWW\WMV
),:OQi
iQW\\MMm
)MQQhv
viWi\VV\
)MQho
viniVWW
4.20$
-..'====
mmO')
vwnW\\
=13=2
$$$..'16?
nwniin
:V\\imvnwwnwnjnm
km<:)
'4:VVWimnjjnnnnm
mOOO4
'44VW\WW]j]nnj
kdOOOko
vQO))"))
'4:VMMW]]nnin
sODJOOOOk
)4**MMWnnnn
",,OOQvv
Q::*+
''**V]\n
,OO<Qv
''MVW\n
,,OOOQkkymmO)
)8Vjjm
,,OOOOOUU,*@
)MW\in
",,,,J"""@
)))VWm
)4:\m
ukkuk
"",,,,""
",OQo
uukkkk
"""D,,,,""
||||||
kkkeekku
""""""""
||sss|||
|eeePPdeeuu
|ssxssyxx|||keeePPbFbbekky}
|xsbbbbbxxsedddbL`FFCFFcPkk}}
kwgggH
BLk||
||xxbFbbbbbbbbcLLFFBBCCFFFDLby}
ukrgHHH !
))):)
BBLe|s|
|xsbFFFFbbbaaaa`CBCCCCCCFFFBBDy}}u
)))M\V)):)
4:::)
BBBLLss|||ssFaCBCCCCCCaaCCC
BBFrryk
'4:44)
)QQWimV)M:
)<S<:)
"OWiw
DLpssssdL`CBBCBBCCCCCCC
FcrWek}}keWrEE
5):<TQ::,45<
"####
)4:Qmmm
mQ):V::SS:)
,UfvviPOR
|ss||
||kPD
LLeddLFFCC
BBCCCCCA
)<QQm
mTQWWWQ,
""EEJJE##
,WQQi
m::\:::<Q:)
,OPUJ
uePku||pFbbbs|
s|keD"
):,,,,,,"
DLLLLFBBB
BBCCCC
FFcFDOWyeeUrUEUYE
ooooml,
),EEEEE,)
""EJJJJJJJE#
),,,,,)
))):QSho
_::V:::Q:,)
ebbPLPbCCFbDbbsppskP,,
"",,:54,:444,,"
CCCCC
FFFFDDUUeeOUUUUUU
UkPDDJ",
*)4:T
,,MUUUUUM,,,)
"",JJcccccUJJ#"
##"""
,,,MM,,,)
))))4:QQlo
mmmQ:::::::))
kDBBBBBBCBBBBBDFLLeP,,"
,4,,O45,,,,,44O444::OQQ:O::444))
BCFCFFBDDJOOOOLD,PWDLy
E"@g][E
*ZVWl
GGGG#
,,,OUWWWWWWUOM,,,,
"",IJUccqqqqccJJ#"
#EJJJJE""
,,MMMMM,,,)
'))444:QSho
mi\Q:VQ:,))))),,,
"ekkeDBB
BBLP:"
)4:O:<OOOOOO<<QTQ<Q<<OOOO5454))
BBCFDDCBBBDDDDPPDDPQek
Q:,"UJFJ{{
E]]mm
GGGKGGGG#
#EEEEEE,,,OOQffiiiiifQOOO,,,,,,,,IJUcqqqrrrqqcJJ#"
"EJUUccUJJ"""
,,MUUUMM,,,)
)))))4:::Qhlo
mmi\\\\SQ:,:::,::,
":PPP
))5:OOOOOTTTl
TT<<OOO<555'''
BBBDDDCBBBLPPLO:LDLek
ueeOrvww
wEYwwm
GKYYYYYKGG######EEEEEEEMOOOQRivvvvvviiRQOOO,,,,IIJUccqrrrrrrrqcJJ#"
",JcffffccJJI"""
",,UUUUUMM,,,,)
))4::::QQSSlo
mhi\\\SSSQQQOOOQShO,OlO:,,D
'5)OOOOTT
TTOOO::44'''''
CDBBDDLDBFDPkeLePLLLek
WUwW]v
GGYYggggYYKGGEEEEEEEEUUUUUQRRhkvvovovviiRQOOOOIIIUUPcqqrrzzzyrqqcJJ"""
""""""
,UfqrrrrqccJJI"""
",,,JUUUUUMM,,,,)
)):::QQSShhlo
omS\SSSTlmlhROORh
oQDDDBBB
'))4OO<T
TT<OO))))'''''
BBDBBDDc"FsLekkPoPPeeku
yOWwWl
GGYYgggggYYKGGGEEEEEUUUUWWRRhkvvo
vviiRQOOOOOUUUPfqrrrzzzyrrqqcJI"""
"""""""""""""
"IPqyzzzzrfcPJJI""""
"",,,,IIOOUUMM,,,,,)
))4:QS\iihhlloo
lhSQQQSmmmllQORv
ueD""BBBB
'))4O<QT
T<OO))
BBDU"DudevkP
uekku
GGKYYggggggYYKKGGEEEJUUUUfffhhkoo
ovviffWUUUUUUUcffqrrzzzyrrqqcPJI,"""
""""",,,,,,,""""
",OfeyzzzzrqcPJJJJI""""""",,,,,IIIOOMMM,,,,,)
')):QQ\immmlllloo
olhQ::Smm
llShu
uP:"DBBB
'444<QT
TTO4)
'''''
BBBD,"L
yevkPu
GGKYYgggggggYYKGGEEEJUUUUfffhkkooo
ovviffWUUUUUUUcffqrrrrzrrrqqcPPII,""""
""""",,,,IIIIII""""
,IPetyzzzzrfcPJJJJJII""",IIIII,,,,,MMM,,,,,,)
),))))
')4:QSimmmmolllllooollS:::Sl
uPDDD
'555<T
Q4))4'''''
BBFLPDs
evePu
ukkuu
GGYYYggggggYYKGEEEEEJUUUWfRRhkkoooooovviifWUUUUUUUUUfffrrrrrrrrqqfPPOIII,"""""
"""""",,,IIIIIIIIDDDDD"
))),,,OPevyyzzvrfcPJJPPPJJIIIIIIIII,,,,,,,,,,,,,,))
),,)))
'')4:QSmm
molllllllllhS:::Sll
'''1=<T<l
:,)41''''
Fd|dsu
GGGYYYgggggYYKGEEEEEEJUUUfRRRhkkkkovviiiWWUUUUUUUUUUcfffrrrrrrqqqcPPUOIIIIII""""""""""",,,,IIIIIIIIIIDDDDDDD
""""""
,,,,,,IOReeyyyrrfcUJJPPccPPLLLJJUIIII,,,,,,,,,,,,,))
),,))))
'))4:QSmm
olhhSShhllSQQ::QSl
)4445?
Q<6565''
olQlv
GGYYYggggYKGE#####EEJUUUPRRRRRhhhhhRQWWMMMEEEEJUUUUffffrvrrqfffPPPOOUOIIIIID""""""""",,,,IIOOOIILLLFFFDDDDDDDDDDD""""
",,,,,,IOPeeeqqqfcUJJJPcqqqqqPPPPPPIII,,,,,,,,,,,,,))
)),,))))
''))44:QSmv
mmhhSSSSSSSSSQQ::S
|LLD"
BBCL"
))444<
lQ?56<4))
)))))E*
kPOkk
vrWmQOQmv
GGGYYYYYYKE#
#EEUUOOPPRRRRQQQOOMME,**EEEEJUUUfffivvvvffffPUOUOUPPIIIIIDDD"""""",,,IOOOOOILLLLFLFFFFFDDDDDDIDD"""
",,,,,,,OPPPddqPPJJIIJPqqrqqqqqqqPPOIIII,,,,,,,,,,)))))))),,,,))))
'')4445:VSimmmmiSSQQQQSS\\_S<:Qh
|sLDDDDLD`BAAAABCFFLF
"",,,:?
m_5V544))
))),,,"
QP:Oeu
vlWWUUW::m
GGYYYYKE#
#EIIOOOOOOOOOO,,,)*
*EEEEEUUWffivvvvvffffPOOffRPPIIIIIIDD""""",,,OOOOOPPPLLLLLLFFFFFFFLLLLLIDD"""
E,,,,,,,IOLLLLIII,,IIPeyzyyysqqqqPPIIIIIIIMMM,,,,,))))),,,,,,,)))
'444:VV::W\iiii\SQQ::<<\\m
|e`FPeeb`CCCBCCppppbF
_<:OO::)
,,,,LLDC
AABBF"
lO,,,OQQl
lQ:E*):V4_
kQO<)
GGGGGE#
",,III,,,,,,,))
GGGGMMUWfivvvvviiffRRRRhhRPPLLLLLLFDDD"",IIOOORPPPPPLLLbLLLFFFFLLLbbLLLLDD"
",,IIIIID""""IOfez}}}}yyyqqqPPIIIIOOUMMMMM,,,,)),,,,,,,,,)))
'44:V\\V5VVWWii\\SQ::::V\m
dFLdesppCCCCpp~~ppbFB
mQO::::,"",OPLLLFBBB
AABBBF",,,"
::::<T<54'
kvlO)''
"",,,,""
+GGGGNUWWimvvvvvviRRhhhvkkRPPPLLLLLDDDDDIIIORRRRRRPPddbbbbbb```bbbbbbbbLFDD"
"""""""""""IOey}
}}}|ysqqPPPOOUUUUUMMMMMM,,,,,,E,,,,,)))
''445V\\\VV8:VWWW\\V:::::<
dbbb|||ppppp~~~~ppLCB
m_<O,,"""
"LLLLpFCCBA
ABBBFFLP,,"
,,,"Q
')4'5''
++++GNWW\mvvvvvvvvkkvvookkRRPPLbbLLLFDIIIORRRRReeedddddbbbbbbbbbbppbppbLLFDD
",Pez
}}ysqqPPPPfffWWWU:MMMMMMMMMMME,,,,)))
''44V<\m\\X88MMMVW\XV:::5<T
xxbx~~~~ppp~~
~~pFC
'4<_TT
mm]::,"
DFppppppCCBAAAAAABFFLPL,,
,",lll
%''.''%
5_m]lQUUU<)
++NWWimmvvmoovvvoo
ookkeeedddbbLLLLLLPRRRhkkkeedddddddbbbbbbbxxpxppbbLFD
",Okz
}}yyeqqfffffffWWWWWUUUUUUUUUUMM,,,)))
'''8VVST_\\V988MVVVVVV:?<<<
}}y~}
)'5_6??
BBBFFpppppppCCBAAAAABCbdPLL,""",,,o
%%%.%.%
Z*ZEE::E,E'
++NMW\ivvm
okkkkeeqqqbbbLLLPRekkoouuteeddddddbbbbbbpxxxxxxdbbLFD
}yyseqqrvvviiifWWWWWWWWWWWUUUMMM,,))
''449<<S_m\_XV99VVVVVXX???5
''<66
BBFLppp~~pppCCCBCCCFFFbddPLDLLDDLP
%''''''''6
+GNV\imvmm
okkkkessqqpbbbddekkkuuuuuteeeesddbbbbbpxxxx~~xxxpbbFDD
}|yyyyzzzzvvviiifffffffffWWUUUMMM,))
'**845V<XS_mnnX9VVVVVVXX^^T<
)))<6?
BFLpps~~~ppppCCCCCCFFbeeeeLLDDDDLe
%.'11=?
*EMW\imvmvo
ooookkttsxxqxqqqetvvuu
utkeessssdbbbppxxx~~~~|xxpbLFD
}}}zz}}}zzzzvvviiiiiiiiiffWWWWUUMM,))
***895V<V<_
m__XXX\\\\^^
||kkOD,4<566?
BFLps~~~~~~pppCCCC`ppskkekdLFFFBDPu
%%'555?
+EEWWiimvvo
ooooktyysxxxxxxszzuu
utkesssssdpdppxxx~~~
|~xxxbLLD
}zzzzzvvvvvvvviiffWWWWWUME))
*888VX95VX\m
||kQO,,4
CLps~~
~~~ppppppppps||eeedLLCCFbku
T5'''1'5?6?
EEMWWiiivvv
ooookyyy||||~|}}}u
uuttttssxxxdxxx~~~
||xxdLID""
}zzzzzzzzzvvviifffffWUME))
*M8VXX99VX__
ukkO444
DLLs~~
~~pppppppps|||||dxdLFLeku
<61'=65
EEEMUWWiivvz
ookuy|||
uuuttyyysxxxxx|||
||sdPLI,"
}zzzzzzzzvvviiiiiiiWWMM))
**88VX9VX__
ukl<4'%
"DDLss~
~ppppppp||||||xxdbFLkyk
T<55??1
#EEJUUfffivzz
llouu||
uuutyyyyy|xx|||
||tePPI,"
}}zzzzzzvvvvvvvvvvifWM,)'
MM8XXXX_mm
<'.%=
)),,DLLsx~
~~pppp~~~~||||x}xbbbsy
#EKYUcffjvvvvoo
llouuy
uuutyyy||||||||
yeeRO,,
zzzzzvvvvvvzzzwvifWM))'
(88V__^_m
?4.'6
X5'')5<OODPssx|
|~~~~~~~~~~~~xx}bbbxk
T<45??<
##EKKUfcrjvvihlllllllllouu|
uuyy||||||||
uukRO,,
(VX\m
zzzvvvvvvzzzzzzvviWM))'
6.16?
=<66?
QQWwux||
~~~~~
~~}}xx}pbbdku
T<54<??
##KKJccgjjjiiSSSTTTSShkuu
uuy|||||||
ukROMEE
(8VV\m
zzvvvvvvvzzz}z
zziiWM4)))
Qmw{}|||
xxpxbbbxk
Q555??<
##EJKYcgjjjfWSSSSSSSShhku
}}}}}}
ukhWME*
(885<_
zvvvivvvzz}}
vm\V:44)******
??=??
?:Wwvyu||
xxbpbbbds
Q4<4<<4<
_'%X5'''
#EJJccggjgfWWQQQQQQQQhkt}
oiWUM*
(8885<
vviiiivvzz
vi\V:::48MMMM*
'''8]
2016?
?=====66666==?
5)Ww{
xxxxxxxy
l,44454OT
>%%8%'
;5X65''
#EJJcrrrrgffWOQQQ::QQRhk}
viWME
((785X_
vviiiivvzz
mi\::VVMM]]V[M(
''*8VV]n
22316==?====6111166666=?
}|||}}}}
')):Ql
;%%8%'
_?_<5'
#EJccrr{{wgffWUOOQ:::QQRku
viWM)
&&&/95;
vhiiiiivzz
mmS:V\WVVnj]gZ*
(*(4*8[]nn]n
=16616661111111111116??
)5Wkkyu
1%%8%6
_T_<5
#EKcrr{{{{rrffUUOO:OOOQRku
v\V8'
&&&&&&..;^^
omhiiimvv
ml<VSi\\]wnnw[*
*******
('''')**''''''
(88VZjn
===111''''''''111111????
>11=1'44QWkuu
oO,,))),:<
?11;15
_<<5)
#Jcrw{{
{}{wrrfffOOOOOORku
oiQ:4'%%%''9(%%%%/(%
&((((%%.1^
ollmmmivv
l<Q\mm_n
nnn]*
***********((
'))'))*)')'4'''8VV]wn
===61.%......%'11111=???
1111''4QQkuu
dU,,,,:Ql
"EJcqz{
}{zrrfffWOOOQRou
uvS<:4'.1699;1.%%%77&%%
&&(1//..1
***EEE*******((
')4'''))44445''4:V]nn
==61.%%%%%%%%%'11116=?
;1110%'55<Qk
od,D,OQTl
,",,Uvz}
zvrcPQUORku
oh<54413>^;>>>1%%%78%.%
/(79//016
***EEEEEE**88***(
'44)''4444555445<\mn
==1..%%$
%%%%''116==?
?1'(.%/1;6??lo
||sLOQlu
",,EUUUvv}{{
zzhdbPPo
olT<516=
6.%%/(%1.
%%%./(11136?
*****EEEMMMMMM888888*'
'44''4454555<5<<Slm
=61.%%%
%%%'116=?
;11.1;>
TX5+
",UPety{{{
zkdekeou
T<56?
1../'%1%%
%.%...'11336?
****EEEMMMMMMMMMMVVMMM8'
'44444:V5<<<?<<Tl
=61.%%%
%%.''1=?
311;;
,,UWy{{{
kkkoou
11''.'1.%%%''.'.%.11311?
i:M)'4)48(
))***EEEMMMMMVVVVVVVVVVVV8'%'5<V45:<<<TT
=61..%%
%%%.'16==
3131>
::Wy{{
kkkkuu
3111''''.%.1.....'1'111>
S::))44VV8*(
''''''))**EEMMMMMWWWWWVVVX<XVXXXV''45<:55<<<T
?661'.%%%%
%%%%'166=
}kkkk|
=11''''....%%..''111.'>>6
mQ::):::VVZ8*
''''))444MMMMMMWWWW\\\\\\S<<<____X5456Tm__T<<T
=661'..%%%%
%'.%%16=?
vQ65'
kkk||
=1''1611'1....11'16'.'=61>
hQQ::VVSVV[Z8(
'''')444MMMMMWWWWW\\\___TTTTT_____X55<^
6611...%%%%%
%11''16=
mQ)4'
6'1==6111..1'11'16'.1==56
oQQQ:\i_\]]][N(
''''44:::::VWWWW\\iimmmmmTTTT
6611'.%.%%%%%
%%1'16=
=66=61''....16111=1116656
hQQQQmm
m]n][M*
''''44:::::QWW\S\iimmmm
>1115?
==1''.%%%..%%
%%.''1?
?=6661...%..'1111661166=66
>>X;>>;111;>>33=
T\\iv
hRRQi
nn][8'
''''44::::QQ\iihhhllll
1.';;;;0231131'1?
5'%%%...1'%%%.1116
=6111'''...'161116616=6666=
>XX;;;77((872(0
T\\Qfv
vhhhhv
'''4:::::QSiiihhllo
1.%7/(
$/7/1>1%.6
61.%..1.1=.%%'1616
=6111111'..111111166===6666>;6;;;;7+8(8(//03
m]WQfz
zvkhoko
'')45::::Qhiihhhlo
'%;;%
//.3>=.%5
??'..'6''=1.'1166=
=111111'..116611'1116===6;66;11;;;7+((+/8/03
zvvkvoo
nW)'''
''4445::QSiihhhhl
(($.>>
6'6?61'=
1'1166<
kmkddddyy
?616=1.'1116611111''16666;61..(77++
+&(/03=
}vfRRko
jV)'''
'')444::QShhhSQho
vzyru
11116;<
<O))'
)4444''.%
kQQQQQQOQ:LLLdkyy
=1'116===61111111161111%%..778
((&$03=
urJqz
}zfRfekk
wiV*)''
'''4444:QQSSQQQho
tvyyek
%1;;;=
?66611<
T5))''''
''4454555''.%
kv{WOOOOOOO:,LLLWWky{
=16661=?
=6111111111'...%
%.(((
kqcLeu
}zifPfekvz
wW:**)
''))444:QWQQQQQho
?655?
uktkeeo
1.1;>78.;>>>
?666?
O4<'11''65555<<TT51'%
'45Tll
uokm{{QdkkkkkkUdLUWPWkmy
?=11666==?=16111111111'..%%
uPrcPez}zwfccfkkv}
vW:))'
''''')4:QWQQ::Qhooooo
65.115?
ookekk
;7[;;_
lT5<1161'<55<?<TTT<51'
444<QTTTTT
=<5QQo
kyydWWQPQWdyy
?6116==?
=1111111111111..%%
$.23?
usLbddzzzzrcfcqkez
vS:))
'*ME*'
'''''')4:QQ::,,Qhvvlllllm
?1'%%%%4<l
lukkko
[[[>]
T5<1'661<<5<??TT
<<5'%
)::::TT
665Qm
}yymkQQWLdyy
=666=?
??=11111111'1611'%%%
$-.1?
u|ssezvzzzzrcqqqkkz
v\:M)))MNM*)'''''
')4:O:,,,,QRihhhhllmmm_X5<
[[;;[
T<<11566<<5<<?TTTTT54'
,EE::5<
6<OQv
kkkWUdyy
=6616=?=
1.11.111166611.%.
ukssszzzvzzzrfqqrtkvz
mmWV,,MMYM)))''
)4M:,))),OfhQQQSSS\_\XX9?
khQII:e
=1[[;;1;[[w
>>;;11>
TO?51166<<<<<<TTTTT54'
5E,,::5TTT
?4<OQQ
ymddyy
?=6616?==
=1....'1145555.%
oQeey
zv|zzrqqrqtvvz
m\W:VWgWMME)'
),,,)
,OWQQWQQQVVVVV6X
,II""",,IIQltou
=1';;7''7[[[
[[]][
=;1((11>
=556=<<<??<<TTT?54'
**5,EE:45:<
?)4OOQ
=61116>;===1.....154'454''
.116?
okePk}
vkzzrrqqrysevzzz
i\WWijjjWUMM
,OOOWWW:MM:M889^
mO,,D"
"DDD,"
=61;;7&%.7[+[;>
[[[ww
6(%(/1;
T666?<<<??<<<T?514'
E,EEE::*E566?65)),<Qv
=111;16;6=61((/..1'44'''''''
%111=?
5O:OQkokkkk
eezzrqqrzystzzz
mi\inw
wiWWM)
)))))
,,,UUMM))8*88X
"D,:D,
BLdev
=66;8(
&%++8+(1>[
w[[[[_]]
=56X?_<<___<<<544'
)EE*415''''
)O<ku
y}}}}
3111111166'.((('.1')'''
))))'
%'1556??
QT5)D)4<QQkokk
wvvzwrqrz|yskvvvmm
zviWM
,E,E)
****8_
,:OkQD
a{{}k
?<<1&
%%/7>[[]w[V5]__
=1%$/11>
T=656
_55X__X<<44''
*****
***'''
))):Qku
ykyy}}
=1('1(.'((..(8(((('15''4)
%.1166=?
O4))"
4:QQkkkvw
vzzzryrrzqefiiiml
dDOku
%8(7Z[g]V5X;<
?==.%
<66<__51X>_XX11''%
****
",Okuu
ykxxx|}
=31((..&&/+(%(++(8((('''))
$%116366<544<<Q))))
'::OeQWWwvvz}zyzz}rqfRRS_ll
mD,,,DDDFcy
8*ZZZ:E445?
///1233=
__X65X>
>>61'
)DOQkuu
}kdxx||}
3100//.&(((+&%+[++8(((**)))
%''11'4'''')44)
4::,EUrPxyyy|}}}}yzkolmTll
yD",DOkssx
?T_m_
?1111%
(Z+*'E:446?=
$.%%0011;
>155X_
>>6'%
*EUQQkuuu
yykdxxx||}
100./&
(++(+%%+[H(&(((+*))'
%.%.%%
"JcPccyxy
kkllTT
kE"DOds|
???;X7=????===?
611'.
+*'1*(55666=
$$-021;?=?>=
61.5_]X>4%
EEUeQkkkuuu
}}vvv
vvvv}}ykddxxx||||||}}}
>1--$&
(+*+*'
FFLLcry|
,OhO)),"
wk}{mOOOduu
ukeeo
l:5?666*
%.%.%%%%.1%511%
'*'1156=6=
.0..'5=>=6<
6'.'[VX5%
*EUUOQQQQQQQQmmmmmrrwrUWUWUccrwwUUrWWdddddxxxxxxxx|||kkkkk
;0-&&
(+*+*
"DLLbexu
yeLLelTl
5'''.%
'651.
''156?61=
0.$$'16=666
1''1;17(%
*E,):,5,,,,,,,,,,EYY*
Eggg,:U:rrWddddddxxddxxxdkkmmmm
>1-$&&
DJcPexu
usPPLOQ::<<6%
$.3?601?
?=1%$..
$$%'';666
5...''7%
,E:UUcWdLLLbbbLLLLLcQQQQTml
>1-$&
JcPx|
|sPLD",
$.11.01=
??=1$.
&1('666
5....%
,,JUUcLLLLLLDD:DD:U:::5<TTmlluu
33>1-$$
"JOeuu
wmWO,,
YwY{{
ukP:D"
-..$..6?
????==1.%
&&&(''666
X'%%%%
,EEE:,,DDDDD,,,,EV:::V5VlllQQv
23322-$
"OPku
kkeWD,,
Q,*gYr{
ukP:"
$%1==??????=3..
..0;66
?66]]5'%%$$$
,UUE,DDDDDD,,,,EE5,,,EVV5QOTQmv
===2223000-$$
":Pe|u
kPPdu
ukQOcD,,,,
:,YYYw{mk
u|eP:"
%.1=?????==1.
.'1.666
===6;X.%%$
,UU,:::DDDDD,E,UUV:::VVXlTTTlvu
===23300-$$
"D::PPe|
ukePd|
|uuuksLDDE,D,Ly
yLUYU]wUd}y
|ePP::D"
$.6?????631.
..1;66
??=611'%%$$$
,,JW:LLLLLLLDD:DcU::::5?
===3330--$
)))):PP|u
u|kek|uuuuukkQ:D))E"DLddyxyy{
{yyxyddccEY]5OWQkkuu
u|PP:))))
%1=????6110$&
..'_66
==651'%%%
TImage
T__3764287399
Width
Height
Cursor
crHelp
ParentShowHint
Picture.Data
TBitmap
!(+B-++(!
!'"!"!!""((
!$$!$!!
!',*&$
!!!!
'*,%!
$,HKPPMLLI("!!
'**'!
!'*-BC,B-)! !$
! $''$$&(**B*'!! $
!$!''$
$$!$$$$'**('$!!$!
$*HBB'%$(($
!(*PTIC+MLII+('""
!!"""'(LMMKC!
**!
!'+--CCB-,**!
!!''-HBHBH-$'!
''*,,-BBHH$'',H!
!-'('%'''$
!''*--BBBHB'!''''*,-'!---*'$--*--,'$%
,ZB-H+*IHB*!
!%$%%%%$''!
'IUTTT!P
MT-I---(!
!$!'H+(+(C++IPII"+I-
$$%((*$B**H$
!$'*----BBH-HB*$!$!!$%$%'*GKIH*-*KYCBCPB,,
),-HP^
M(KLCKBUB
U^CGMB
'$HCB*****'
$*-BHLMHPLK,IPTKPHV\
^MIB*UUKMP-"
U*$UTj\l^
YH*CUZTK, )PK'(*'$'
$$*H**B*-*!CYK!
$%'***''*'*B,,'
P-FMH%
%'$%!
,BBYZ
HMUU-PP*%,&!HK*%,-UK+T^
%CHHMTPKHCB-+'!
*BHPKPZ^^^HB
Z^K*M
*(!'B
IUUK-(U^
ZPC*%!!88t!o
sf%'*/% !zo
aeAtg
zv=qO*^YY^^PKHHB*'
%,HPPZU^
**UB-T!"L
PYUB!,!tN,
TLHB*
'HPUP
'HPTPLZI
+H-!+!
}x:9c
'HTUMP
MI"(I
}<75g
UZULF-+
'HLTLUL
T!I"!
!(+"-
g9!*BW
H!ZTLIII-**
'CLM-ZP
B$434bs
ITUMPII--*
*IPPZ
YC*(.AP
CTTLIIC+**
!-YUUZ
01E$MH(PLMI-----
BMU-IUPIIC---
.*BWYTIITPIICC--
!-UZL
_lO-1dh,^UIUILPIIIFB
!CUUU
`a76hU
MIIZZLIIFB
$HYZPZ
}1.dgC
LIPULLIHB
(MP"'
Z+PMPLLHH
PUI*$
VC-Cs
'IZZTTKC
L--T"+-
-((I-
TU+'--
mHCNn
U+IZZUTKB
-M-(+
U+I+(
YKHPn
TCLZZPKKB
(LUPC(L
!-"+I++(+-+
P-'(CMI-+IZP+
!!CI--K"
-CIUUULHHB
(IUPPUL(
H+I"!'
KZ--M
I-+LZ
TPT!I
UYB--
+^' -*%**(-MTM
+CMMULIBBB
*IPZUZ
YKCTC,'!P
KL-"C+((+ICCI"I%
!BK---
IUI-TZTHP'
CKHB-MC-FKL!
((+HT
'*H$Cj
^KUZPPKHC-
HMK-+--LBKHHU
KLZP+UPU
ZLT^KB*''''(BB^YMHIIPUII+
ITPI(
!"I(+I"((CC,T
BBIKB'I
CIUPCC--B''*-+*-B*'H-KP
ZPTFKPP
U--,-HB**HUTI'
+HPT-
^MT]m-cW
PUTTPMHHB*
!*HKUT
ZZZZZZPIP
ZPKIHKHHHKHB+%%H,H',+I--LPLLPUPUTKPKPT
UUYYJ'
$!! $'-HB*+(+++"'((+('+IIU^K%H(ITTMC("
$,CC*-TP
Y^B*(!! $$%%'+-B*HHPTZPUTF*KPYH($$%*'BB-PMTKBUF-TP$PP*'
BPPKJC*+*-''*-KK*KTU
Y,PLK-'BIP
HKUPHFCB-*'
$*-BKK--B--*TPUPKPK^TK^UTPPMLLLILHKPJHH,MPT-HPKKKIHCB-------B-*----BHIKJKUUUZPPPPPMHJH--*'! !B-KHTL
ZILPPKHHH'
!$%%(('''(--((++ILLUIILLLL+(!
'+LMLLKH*'
!%'-BCHCH-'*+*%
!'BMTKPKHHYT-UU+!'%*-%*PJ-B--KPKPK-IKTH-('''$!
$*$$BLIH--**''!
$'*CBKKKCB)!''$''*-*--HIHHCFB-BCCB,)$!!! !$*-*****'''%''''%!%$%%%)*---HKPPPLIIIHH-*%$!!!
$(BBHPMFILIIC**!
!''((++++++"!
"((((%$
!!$$!!
'-BMTHYYKL*K-*
*'*(''(,-B-,*,HKBC-('!
*-BCBB+**('%
'-CHCH*,'$
!',B-,*--****($
!!! $!!
!(*--*((('%!
!%,CCB-+((%$
$'*CMTTL-%,BB$
! !$''''%%%'%*'%$$
! %(***''''%
$''''''$$$$ !$!$'$''$$'%!
!%*-B-$!','*%!!
&%&$$
ShowHint
TLabel
T__3764290569
Width
Height
Font.Charset
ANSI_CHARSET
Font.Color
clWhite
Font.Height
Font.Name
Tahoma
Font.Style
ParentFont
Transparent
TLabel
T__3765255551
Width
Height
Font.Charset
ANSI_CHARSET
Font.Color
clWhite
Font.Height
Font.Name
Tahoma
Font.Style
ParentFont
Transparent
TLabel
T__3765258721
Width
Height
Font.Charset
ANSI_CHARSET
Font.Color
clWhite
Font.Height
Font.Name
Tahoma
Font.Style
ParentFont
Transparent
TLabel
T__3765261132
Width
Height
Font.Charset
ANSI_CHARSET
Font.Color
clWhite
Font.Height
Font.Name
Tahoma
Font.Style
ParentFont
Transparent
TLabel
T__3765289349
Width
Height
Enabled
Font.Charset
ANSI_CHARSET
Font.Color
clWhite
Font.Height
Font.Name
Tahoma
Font.Style
ParentFont
Transparent
TLabel
T__3765292519
Width
Height
Font.Charset
ANSI_CHARSET
Font.Color
clWhite
Font.Height
Font.Name
Tahoma
Font.Style
ParentFont
Transparent
TLabel
T__3765295712
Width
Height
Enabled
Font.Charset
ANSI_CHARSET
Font.Color
clWhite
Font.Height
Font.Name
Tahoma
Font.Style
ParentFont
Transparent
TLabel
T__3765323170
Width
Height
Font.Charset
ANSI_CHARSET
Font.Color
clWhite
Font.Height
Font.Name
Tahoma
Font.Style
ParentFont
Transparent
TLabel
T__3765326340
Width
Height
Font.Charset
ANSI_CHARSET
Font.Color
clWhite
Font.Height
Font.Name
Tahoma
Font.Style
ParentFont
Transparent
TLabel
T__3765329510
Width
Height
Font.Charset
ANSI_CHARSET
Font.Color
clWhite
Font.Height
Font.Name
Tahoma
Font.Style
ParentFont
Transparent
TLabel
T__3765331921
Width
Height
Font.Charset
ANSI_CHARSET
Font.Color
clWhite
Font.Height
Font.Name
Tahoma
Font.Style
ParentFont
Transparent
TLabel
T__3765360161
Width
Height
Font.Charset
ANSI_CHARSET
Font.Color
clWhite
Font.Height
Font.Name
Tahoma
Font.Style
ParentFont
Transparent
TLabel
T__3765363331
Width
Height
Font.Charset
ANSI_CHARSET
Font.Color
clWhite
Font.Height
Font.Name
Tahoma
Font.Style
ParentFont
Transparent
TLabel
T__3765366501
Width
Height
Font.Charset
ANSI_CHARSET
Font.Color
clWhite
Font.Height
Font.Name
Tahoma
Font.Style
ParentFont
Transparent
TMainMenu
T__3765368912
TMenuItem
T__3765397129
TMenuItem
T__3765400322
TMenuItem
T__3765402733
OnClick
T__3764139458
TMenuItem
T__3765430950
OnClick
T__3764137024
TMenuItem
T__3765434120
OnClick
T__3764068646
TMenuItem
T__3765437290
TMenuItem
T__3765439724
Checked
OnClick
T__3764102467
TMenuItem
T__3765467941
Checked
OnClick
T__3764105637
TMenuItem
T__3765471111
OnClick
T__3764108807
TMenuItem
T__3765473522
TMenuItem
T__3765476692
OnClick
T__3764075009
TOpenDialog
T__3765504932
DefaultExt
Filter
Bitmap (*.BMP)|*.BMP
TSaveDialog
T__3765508102
DefaultExt
Filter
Haar Wavelet (*.HWL)|*.HWL
TOpenDialog
T__3765510513
DefaultExt
Filter
Haar Wavelet (*.HWL)|*.HWL
@gAxA
A,AJA
jjjjjj
ApBxB
ebutton
clock
combobox
explorerbar
header
listview
progress
rebar
scrollbar
startpanel
status
taskband
taskbar
toolbar
tooltip
trackbar
traynotify
treeview
window
jjjjjj
jjjjj
jjjjj
jjjjj
jjjjj
jjjjj
jjjjj
jjjjj
jjjjj
jjjjj
jjjjj
jjjjj
jjjjjjj
BBABORT
BBALL
BBCANCEL
BBCLOSE
BBHELP
BBIGNORE
BBRETRY
BBYES
PREVIEWGLYPH
DLGTEMPLATE
TEXTFILEDLG
T__3764284229
T__3764321197
T__3764326801
T__3765184739
T__3765215390
MS Sans Serif
MS Sans Serif
ASCII
Unicode
Big Endian Unicode
UTF-8
UTF-7
Right
Shift+
Ctrl+
Alt+ Clipboard does not support Icons/Menu '%s' is already being used by another form
Docked control must have a name%Error removing control from dock tree
- Dock zone not found
- Dock zone has no controlLError loading dock zone from the stream. Expecting version %d, but found %d.
&Help
&Abort
&Retry
&Ignore
N&o to All
Yes to &All
Enter
Space
&Retry
Abort
Cannot drag a form
Metafiles
Enhanced Metafiles
Icons
Bitmaps
Warning
Error
Information
Confirm
Cancel
)Cannot change Visible in OnShow or OnHide"Cannot make a visible window modal
Menu index out of range
Menu inserted twice
Sub-menu is not in menu
Not enough timers [email protected] cannot be less than a previous menu item's GroupIndex5Cannot create form. No MDI forms are currently active*A control cannot have itself as its parent
Cancel
&Help
&Close
&Ignore
Icon image is not valid
Metafile is not valid!Cannot change the size of an icon
Unsupported clipboard format
Out of system resources
Canvas does not allow drawing
Invalid image size
Invalid ImageList
Invalid ImageList Index)Failed to read ImageList data from stream(Failed to write ImageList data to stream$Error creating window device context
Error creating window class+Cannot focus a disabled or invisible window!Control '%s' has no parent window
Cannot hide an MDI Child Form
Error reading %s%s%s: %s
Stream read error
Property is read-only
Failed to get data for '%s'
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
Property %s does not exist
Stream write error"Unable to find a Table of Contents
No help found for %s#No context-sensitive help installed
No help found for context$No topic-based help system installed
Bitmap image is not valid
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s
Invalid stream format$''%s'' is not a valid component name
Invalid property path
Invalid property value
Invalid data type for '%s' List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d)+Out of memory while expanding memory stream
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
Ancestor for '%s' not found
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
January
February
March
April
August
September
October
November
December
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
A call to an OS function failed
)Variant or safe array index out of bounds
Variant or safe array is locked
Invalid variant type conversion
Invalid variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Variant overflow
Invalid argument
Invalid variant type
Operation not supported
Unexpected variant error
External exception %x
Assertion failed
Interface not supported
Exception in safecall method
Floating point underflow
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Access violation
Stack overflow
Control-C hit
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
Write$Error creating variant or safe array!'%s' is not a valid integer value
Out of memory
I/O error %d
File not found
Invalid filename
Too many open files
File access denied
Read beyond end of file
Disk full
Invalid numeric input
Division by zero
Range check error
Integer overflow Invalid floating point operation
Floating point division by zero
Floating point overflow
!)))11)119)B)
1)919
199B1
91B9BBB
!J)R)Z)N1
=Z9NFZB
`ZccZ
[{R{Z~`
)!))1!1)9)91B)B1B9J1J9JBR9RBZBZJcBcJcRkJkRkZsRsZsc{R{Z{c

Full Results

Engine Signature Engine Signature Engine Signature
Bkav Clean ClamAV Clean FireEye Clean
CAT-QuickHeal Clean McAfee Clean Cylance Clean
Zillya Clean SUPERAntiSpyware Clean Sangfor Clean
K7AntiVirus Clean Alibaba Clean K7GW Clean
CrowdStrike Clean Arcabit Clean TrendMicro Clean
Baidu Clean F-Prot Clean Symantec Clean
TotalDefense Clean APEX Malicious Paloalto Clean
Cynet Clean Kaspersky UDS:DangerousObject.Multi.Generic BitDefender Clean
NANO-Antivirus Clean AegisLab Clean MicroWorld-eScan Clean
Rising [email protected] (RDML:oTYGlm10Tjn2dUHngoC2oQ) Ad-Aware Clean Sophos Clean
Comodo Clean F-Secure Clean DrWeb Clean
VIPRE Clean Invincea Clean Trapmine malicious.moderate.ml.score
CMC Clean Emsisoft Clean SentinelOne Clean
Cyren Clean Jiangmin Clean Webroot Clean
Avira Clean Fortinet W32/GenKryptik.EKLE!tr Antiy-AVL Clean
Kingsoft Clean Endgame malicious (high confidence) Microsoft Trojan:Win32/Wacatac.C!ml
ViRobot Clean ZoneAlarm UDS:DangerousObject.Multi.Generic Avast-Mobile Clean
TACHYON Clean AhnLab-V3 Clean Acronis Clean
BitDefenderTheta Gen:[email protected] ALYac Clean MAX Clean
VBA32 BScope.Backdoor.Remcos Malwarebytes Backdoor.NetWiredRC Panda Clean
Zoner Clean ESET-NOD32 Win32/TrojanDownloader.Delf.CYI TrendMicro-HouseCall Clean
Tencent Clean Yandex Clean Ikarus Clean
eGambit Unsafe.AI_Score_86% GData Clean AVG Clean
Cybereason malicious.b73ce4 Avast Clean Qihoo-360 Clean
Sorry! No behavior.

Hosts

Direct IP Country Name
Y 8.8.8.8 [VT] United States
N 216.58.212.174 [VT] United States
Y 172.217.16.131 [VT] United States

TCP

Source Source Port Destination Destination Port
192.168.1.5 49185 172.217.16.131 80
192.168.1.5 49183 216.58.212.174 drive.google.com 443
192.168.1.5 49182 95.100.210.141 443

UDP

Source Source Port Destination Destination Port
192.168.1.5 137 192.168.1.255 137
192.168.1.5 50775 8.8.8.8 53
192.168.1.5 52876 8.8.8.8 53
192.168.1.5 54312 8.8.8.8 53
192.168.1.5 54724 8.8.8.8 53
192.168.1.5 61410 8.8.8.8 53
192.168.1.5 63931 8.8.8.8 53

DNS

Name Response Post-Analysis Lookup
drive.google.com [VT] A 216.58.212.174 [VT] 108.177.122.101 [VT]

HTTP Requests

No HTTP requests performed.

SMTP traffic

No SMTP traffic performed.

IRC traffic

No IRC requests performed.

ICMP traffic

No ICMP traffic performed.

CIF Results

No CIF Results

Suricata Alerts

Timestamp Source IP Source Port Destination IP Destination Port Protocol GID SID REV Signature Category Severity
2020-06-30 13:54:23.672 192.168.1.5 [VT] 49175 13.107.42.23 [VT] 443 TCP 1 2028397 2 ET JA3 Hash - Possible Malware - Various Malspam/RigEK Unknown Traffic 3
2020-06-30 13:54:50.171 192.168.1.5 [VT] 49186 52.158.209.219 [VT] 443 TCP 1 2028363 2 ET JA3 Hash - Possible Malware - Boleto Malspam Unknown Traffic 3

Suricata TLS

Timestamp Source IP Source Port Destination IP Destination Port Subject Issuer Fingerprint Version
2020-06-30 13:54:23.754 192.168.1.5 [VT] 49175 13.107.42.23 [VT] 443 CN=edge.skype.com 5c:3b:53:ee:b8:65:a3:2a:66:d4:04:36:67:98:af:88:8d:96:5d:74 TLS 1.2
2020-06-30 13:54:44.914 192.168.1.5 [VT] 49183 216.58.212.174 [VT] 443 C=US, ST=California, L=Mountain View, O=Google LLC, CN=*.google.com 8f:1b:3a:c6:ef:ed:81:79:4d:14:07:4b:80:d9:20:83:04:d0:9e:96 TLS 1.2
2020-06-30 13:54:50.239 192.168.1.5 [VT] 49186 52.158.209.219 [VT] 443 CN=watson.microsoft.com e1:6a:52:eb:a9:ec:f3:58:ca:9a:f9:fb:05:f8:bf:38:d8:76:1d:50 TLSv1

Suricata HTTP

Timestamp Source IP Source Port Destination IP Destination Port Method Status Hostname URI Content Type User Agent Referrer Length
2020-06-30 13:54:46.080 192.168.1.5 [VT] 49184 172.217.23.131 [VT] 80 200 ocsp.pki.goog [VT] /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D application/ocsp-response Microsoft-CryptoAPI/6.1 None 468
2020-06-30 13:54:46.588 192.168.1.5 [VT] 49184 172.217.23.131 [VT] 80 200 ocsp.pki.goog [VT] /gts1o1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEHpeRGQT6s1kAgAAAABtwSc%3D application/ocsp-response Microsoft-CryptoAPI/6.1 None 471
2020-06-30 13:54:47.633 192.168.1.5 [VT] 49185 172.217.16.131 [VT] 80 200 crl.pki.goog [VT] /GTS1O1.crl application/pkix-crl Microsoft-CryptoAPI/6.1 None 109615
Sorry! No dropped Suricata Extracted files.

JA3

Source Source Port Destination Destination Port JA3 Hash JA3 Description
192.168.1.5 49175 13.107.42.23 443 3b483d0b34894548b602e8d18cdc24c5 unknown
192.168.1.5 49183 216.58.212.174 drive.google.com 443 fb795b29362f81d10fa6c45b24c3c262 unknown
192.168.1.5 49186 52.158.209.219 443 4f635262ad3fb6e634daee798082c788 unknown
Sorry! No dropped files.
Sorry! No CAPE files.
Process Name KcaNRPH3WcFfv.exe
PID 4040
Dump Size 709120 bytes
Module Path C:\Users\Rebecca\AppData\Local\Temp\KcaNRPH3WcFfv.exe
Type PE image: 32-bit executable
PE timestamp 1992-06-19 22:22:17
MD5 dfce4b4e1ee99c03f9bfec87073ce34d
SHA1 b73594585d04dbf6be87f168eb4c8b0afbd13ca7
SHA256 6f157b180c5687c2e76e81d960c65183f752db19eec9cfff5883901ef326296f
CRC32 CBF278AF
Ssdeep 12288:pe7+LHvP79bjBoxHyzKXAzgqGD49YCIJuxd6Ur5IScz5ISF+gAuA1KzqrRUyqqjG:Mq779bjBoAzKXAPC4pYX/ebPJocjc
Dump Filename 6f157b180c5687c2e76e81d960c65183f752db19eec9cfff5883901ef326296f
Download Download Zip

BinGraph Download graph

JSON Report Download
Defense Evasion Command and Control
  • T1116 - Code Signing
    • Signature - invalid_authenticode_signature
  • T1045 - Software Packing
    • Signature - packer_unknown_pe_section_name
  • T1071 - Standard Application Layer Protocol
    • Signature - multiple_useragents

    Processing ( 11.660000000000002 seconds )

    • 5.344 Suricata
    • 3.954 BehaviorAnalysis
    • 1.1 Static
    • 0.375 NetworkAnalysis
    • 0.275 VirusTotal
    • 0.259 CAPE
    • 0.082 TargetInfo
    • 0.074 ProcDump
    • 0.07 AnalysisInfo
    • 0.057 Deduplicate
    • 0.032 Dropped
    • 0.02 Strings
    • 0.01 peid
    • 0.008 Debug

    Signatures ( 0.7050000000000003 seconds )

    • 0.181 antiav_detectreg
    • 0.063 infostealer_ftp
    • 0.059 territorial_disputes_sigs
    • 0.037 antianalysis_detectreg
    • 0.035 infostealer_im
    • 0.02 antivm_vbox_keys
    • 0.017 ransomware_files
    • 0.013 antivm_vmware_keys
    • 0.013 infostealer_mail
    • 0.012 stealth_timeout
    • 0.011 decoy_document
    • 0.01 api_spamming
    • 0.01 antivm_parallels_keys
    • 0.01 ransomware_extensions
    • 0.009 NewtWire Behavior
    • 0.009 antivm_xen_keys
    • 0.008 antiav_detectfile
    • 0.007 antivm_generic_disk
    • 0.007 modify_proxy
    • 0.007 masquerade_process_name
    • 0.006 antiemu_wine_func
    • 0.006 antivm_generic_scsi
    • 0.006 dynamic_function_loading
    • 0.006 antivm_generic_diskreg
    • 0.006 antivm_vpc_keys
    • 0.006 geodo_banking_trojan
    • 0.005 malicious_dynamic_function_loading
    • 0.005 persistence_autorun
    • 0.005 antianalysis_detectfile
    • 0.005 infostealer_bitcoin
    • 0.004 antidbg_windows
    • 0.004 bootkit
    • 0.004 guloader_apis
    • 0.004 infostealer_browser_password
    • 0.004 kovter_behavior
    • 0.004 mimics_filetime
    • 0.003 kibex_behavior
    • 0.003 reads_self
    • 0.003 recon_programs
    • 0.003 stealth_file
    • 0.003 virus
    • 0.003 antivm_xen_keys
    • 0.003 antivm_hyperv_keys
    • 0.003 antivm_vbox_files
    • 0.003 bypass_firewall
    • 0.002 antivm_generic_services
    • 0.002 antivm_vbox_libs
    • 0.002 betabot_behavior
    • 0.002 dridex_behavior
    • 0.002 exec_crash
    • 0.002 exploit_getbasekerneladdress
    • 0.002 hancitor_behavior
    • 0.002 tinba_behavior
    • 0.002 antivm_generic_bios
    • 0.002 antivm_generic_system
    • 0.002 ketrican_regkeys
    • 0.002 browser_security
    • 0.002 darkcomet_regkeys
    • 0.002 disables_browser_warn
    • 0.002 network_torgateway
    • 0.002 limerat_regkeys
    • 0.002 recon_fingerprint
    • 0.001 Doppelganging
    • 0.001 InjectionCreateRemoteThread
    • 0.001 antiav_avast_libs
    • 0.001 antidebug_guardpages
    • 0.001 uac_bypass_eventvwr
    • 0.001 exploit_gethaldispatchtable
    • 0.001 injection_createremotethread
    • 0.001 injection_runpe
    • 0.001 network_anomaly
    • 0.001 network_tor
    • 0.001 blackrat_registry_keys
    • 0.001 rat_nanocore
    • 0.001 OrcusRAT Behavior
    • 0.001 antidbg_devices
    • 0.001 antivm_vmware_files
    • 0.001 bot_drive
    • 0.001 azorult_mutexes
    • 0.001 masslogger_files
    • 0.001 predatorthethief_files
    • 0.001 qulab_files
    • 0.001 network_dns_opennic
    • 0.001 medusalocker_regkeys
    • 0.001 revil_mutexes
    • 0.001 modirat_bheavior
    • 0.001 warzonerat_regkeys
    • 0.001 remcos_regkeys

    Reporting ( 14.264000000000001 seconds )

    • 12.41 BinGraph
    • 1.704 JsonDump
    • 0.072 SubmitCAPE
    • 0.06 MITRE_TTPS
    • 0.018 PCAP2CERT