4.6
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.75
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | Trojan:Win32/Occamy.c90711cf | 20190527 | 0.3.0.5 |
| Avast | Win32:Malware-gen | 20200717 | 18.4.3895.0 |
| Baidu | Win32.Trojan.Delf.ae | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (W) | 20190702 | 1.0 |
| Kingsoft | None | 20200717 | 2013.8.14.323 |
| Tencent | Malware.Win32.Gencirc.10b9c4c1 | 20200717 | 1.0.0.1 |
静态指标
观察到命令行控制台输出
(1 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545312.343625 WriteConsoleW |
console_handle:
0x0000000b
buffer: 找不到批处理文件。 |
success | 1 | 0 |
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(3 个事件)
| section | CODE |
| section | DATA |
| section | BSS |
动态指标
解析可疑的顶级域名（TLD）
(2 个事件)
| domain | ggteam2024.gnway.cc | description | 科科斯群岛域名 TLD | ||||||
| domain | love2024.vicp.cc | description | 科科斯群岛域名 TLD | ||||||
一个进程试图延迟分析任务。
(1 个事件)
| description | DBSever0.EXE 试图睡眠 220.54 秒，实际延迟分析时间 220.54 秒 | |||
在 PE 资源中识别到外语
(1 个事件)
| name | RT_VERSION | language | LANG_CHINESE | filetype | None | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x00072594 | size | 0x00000314 | ||||||||||||||||||
在文件系统上创建可执行文件
(2 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\Temp0.bat |
| file | C:\Windows\DBSever0.EXE |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\Temp0.bat |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\07a7e197d12b66f60cbe83fecf699d88ac5747a100eefa860b02cd1b4068c663.exe |
一个进程创建了一个隐藏窗口
(1 个事件)
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(1 个事件)
| section | {'name': 'DATA', 'virtual_address': '0x00059000', 'virtual_size': '0x000036e0', 'size_of_data': '0x00003800', 'entropy': 7.04052798507646} | entropy | 7.04052798507646 | description | 发现高熵的节 | |||||||||
检查系统上可疑权限的本地唯一标识符
(1 个事件)
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
在 Windows 启动时自我安装以实现自动运行
(3 个事件)
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\WDDBSever0.EXE | reg_value | "C:\Windows\DBSever0.EXE" /Auto | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\WDDBSever0.EXE | reg_value | "C:\Windows\DBSever0.EXE" /Auto | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDDBSever0.EXE | reg_value | "C:\Windows\DBSever0.EXE" /Auto | ||||||
从磁盘删除已执行的文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\Temp0.bat |
创建已知的 Dibik/Shark 后门文件、注册表项和/或互斥体
(2 个事件)
| mutex | $OKDBSsever0 |
| mutex | $AZDBSsever0 |
创建并运行一个批处理文件以删除原始二进制文件
(1 个事件)
| file | 009a5ee4bfdfccc3_Temp0.bat |
连接到不再响应请求的 IP 地址（合法服务通常会保持运行）
(1 个事件)
| dead_host | 47.88.148.135:8098 |
文件已被 VirusTotal 上 56 个反病毒引擎识别为恶意
(50 out of 56 个事件)
| ALYac | Gen:Trojan.Keylogger.DG3@aaCHNQcj |
| APEX | Malicious |
| AVG | Win32:Malware-gen |
| Ad-Aware | Gen:Trojan.Keylogger.DG3@aaCHNQcj |
| AhnLab-V3 | Backdoor/Win32.Agent.R115864 |
| Alibaba | Trojan:Win32/Occamy.c90711cf |
| Antiy-AVL | Trojan/Win32.AGeneric |
| Arcabit | Trojan.Keylogger.E5EFFA |
| Avast | Win32:Malware-gen |
| Avira | BDS/Backdoor.Gen |
| Baidu | Win32.Trojan.Delf.ae |
| BitDefender | Gen:Trojan.Keylogger.DG3@aaCHNQcj |
| BitDefenderTheta | AI:Packer.ADB0C07E1C |
| Bkav | W32.AIDetectVM.malware1 |
| CAT-QuickHeal | Trojan.GenericCS.S13783964 |
| Comodo | TrojWare.Win32.Spy.Banker.Gen@1qlojk |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cybereason | malicious.2ee97d |
| Cylance | Unsafe |
| Cynet | Malicious (score: 100) |
| Cyren | W32/Delf.XFNF-6995 |
| DrWeb | Trojan.DownLoader33.21631 |
| ESET-NOD32 | a variant of Win32/Delf.NWT |
| Emsisoft | Gen:Trojan.Keylogger.DG3@aaCHNQcj (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Delf.AGR |
| F-Secure | Backdoor.BDS/Backdoor.Gen |
| FireEye | Generic.mg.3d5c8222ee97db84 |
| Fortinet | W32/Delf.NWT!tr |
| GData | Gen:Trojan.Keylogger.DG3@aaCHNQcj |
| Invincea | heuristic |
| Jiangmin | Trojan.Generic.ezuqc |
| K7AntiVirus | Trojan ( 7000000f1 ) |
| K7GW | Trojan ( 7000000f1 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| Lionic | Trojan.Win32.Generic.4!c |
| MAX | malware (ai score=86) |
| MicroWorld-eScan | Gen:Trojan.Keylogger.DG3@aaCHNQcj |
| Microsoft | Trojan:Win32/Ymacco.AA69 |
| NANO-Antivirus | Trojan.Win32.Delf.hkdylj |
| Paloalto | generic.ml |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | Generic/HEUR/QVM05.1.0474.Malware.Gen |
| Rising | Trojan.Delf!1.6515 (CLOUD) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Mal/SpyAgent-F |
| Symantec | ML.Attribute.HighConfidence |
| Tencent | Malware.Win32.Gencirc.10b9c4c1 |
| Trapmine | malicious.high.ml.score |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
1992-06-20 06:22:17
PE Imphash
4cca3a40d43897162b45e7061f7a7c4e
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| CODE | 0x00001000 | 0x00057e50 | 0x00058000 | 6.594364235282875 |
| DATA | 0x00059000 | 0x000036e0 | 0x00003800 | 7.04052798507646 |
| BSS | 0x0005d000 | 0x00006741 | 0x00000000 | 0.0 |
| .idata | 0x00064000 | 0x00001b50 | 0x00001c00 | 4.79189021059803 |
| .tls | 0x00066000 | 0x0000000c | 0x00000000 | 0.0 |
| .rdata | 0x00067000 | 0x00000018 | 0x00000200 | 0.2694448386073115 |
| .reloc | 0x00068000 | 0x00006a9c | 0x00006c00 | 6.757888066331192 |
| .rsrc | 0x0006f000 | 0x00003a00 | 0x00003a00 | 4.363100705050973 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x0006f40c | 0x000010a8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00071f90 | 0x000002b4 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00071f90 | 0x000002b4 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00071f90 | 0x000002b4 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00071f90 | 0x000002b4 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00071f90 | 0x000002b4 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00071f90 | 0x000002b4 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00071f90 | 0x000002b4 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00071f90 | 0x000002b4 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00071f90 | 0x000002b4 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00071f90 | 0x000002b4 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_RCDATA | 0x00072300 | 0x00000280 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_RCDATA | 0x00072300 | 0x00000280 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_RCDATA | 0x00072300 | 0x00000280 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_GROUP_ICON | 0x00072580 | 0x00000014 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_VERSION | 0x00072594 | 0x00000314 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | None |
| RT_MANIFEST | 0x000728a8 | 0x00000156 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library kernel32.dll:
• 0x100641f4 DeleteCriticalSection
• 0x100641f8 LeaveCriticalSection
• 0x100641fc EnterCriticalSection
• 0x10064200 InitializeCriticalSection
• 0x10064204 VirtualFree
• 0x10064208 VirtualAlloc
• 0x1006420c LocalFree
• 0x10064210 LocalAlloc
• 0x10064214 GetTickCount
• 0x10064218 QueryPerformanceCounter
• 0x1006421c GetVersion
• 0x10064220 GetCurrentThreadId
• 0x10064224 InterlockedDecrement
• 0x10064228 InterlockedIncrement
• 0x1006422c VirtualQuery
• 0x10064230 WideCharToMultiByte
• 0x10064234 MultiByteToWideChar
• 0x10064238 lstrlenA
• 0x1006423c lstrcpynA
• 0x10064240 LoadLibraryExA
• 0x10064244 GetThreadLocale
• 0x10064248 GetStartupInfoA
• 0x1006424c GetProcAddress
• 0x10064250 GetModuleHandleA
• 0x10064254 GetModuleFileNameA
• 0x10064258 GetLocaleInfoA
• 0x1006425c GetLastError
• 0x10064260 GetCommandLineA
• 0x10064264 FreeLibrary
• 0x10064268 FindFirstFileA
• 0x1006426c FindClose
• 0x10064270 CreateDirectoryA
• 0x10064274 ExitProcess
• 0x10064278 CreateThread
• 0x1006427c WriteFile
• 0x10064280 UnhandledExceptionFilter
• 0x10064284 RtlUnwind
• 0x10064288 RaiseException
• 0x1006428c GetStdHandle
Library user32.dll:
• 0x10064294 GetKeyboardType
• 0x10064298 LoadStringA
• 0x1006429c MessageBoxA
• 0x100642a0 CharNextA
Library advapi32.dll:
• 0x100642a8 RegQueryValueExA
• 0x100642ac RegOpenKeyExA
• 0x100642b0 RegCloseKey
Library oleaut32.dll:
• 0x100642b8 SysFreeString
• 0x100642bc SysReAllocStringLen
• 0x100642c0 SysAllocStringLen
Library kernel32.dll:
• 0x100642c8 TlsSetValue
• 0x100642cc TlsGetValue
• 0x100642d0 LocalAlloc
• 0x100642d4 GetModuleHandleA
Library advapi32.dll:
• 0x100642dc RegSetValueExA
• 0x100642e0 RegQueryValueExA
• 0x100642e4 RegOpenKeyExA
• 0x100642e8 RegOpenKeyA
• 0x100642ec RegEnumValueA
• 0x100642f0 RegEnumKeyA
• 0x100642f4 RegDeleteValueA
• 0x100642f8 RegDeleteKeyA
• 0x100642fc RegCreateKeyA
• 0x10064300 RegCloseKey
• 0x10064304 OpenProcessToken
• 0x10064308 LookupPrivilegeValueA
• 0x1006430c GetUserNameA
• 0x10064310 AdjustTokenPrivileges
Library kernel32.dll:
• 0x10064318 lstrlenW
• 0x1006431c lstrlenA
• 0x10064320 lstrcpyW
• 0x10064324 lstrcmpA
• 0x10064328 lstrcatW
• 0x1006432c WriteFile
• 0x10064330 WaitForSingleObject
• 0x10064334 VirtualQuery
• 0x10064338 VirtualFree
• 0x1006433c VirtualAlloc
• 0x10064340 UnmapViewOfFile
• 0x10064344 TerminateThread
• 0x10064348 TerminateProcess
• 0x1006434c Sleep
• 0x10064350 SetThreadPriority
• 0x10064354 SetPriorityClass
• 0x10064358 SetFilePointer
• 0x1006435c SetFileAttributesA
• 0x10064360 SetEvent
• 0x10064364 SetErrorMode
• 0x10064368 SetEndOfFile
• 0x1006436c ResetEvent
• 0x10064370 ReleaseMutex
• 0x10064374 ReadFile
• 0x10064378 QueryDosDeviceA
• 0x1006437c PeekNamedPipe
• 0x10064380 OutputDebugStringA
• 0x10064384 OpenMutexA
• 0x10064388 OpenFileMappingA
• 0x1006438c MultiByteToWideChar
• 0x10064390 MoveFileA
• 0x10064394 MapViewOfFile
• 0x10064398 LockResource
• 0x1006439c LoadResource
• 0x100643a0 LoadLibraryA
• 0x100643a4 LeaveCriticalSection
• 0x100643a8 InitializeCriticalSection
• 0x100643ac GlobalUnlock
• 0x100643b0 GlobalReAlloc
• 0x100643b4 GlobalMemoryStatus
• 0x100643b8 GlobalHandle
• 0x100643bc GlobalLock
• 0x100643c0 GlobalFree
• 0x100643c4 GlobalAlloc
• 0x100643c8 GetVersionExA
• 0x100643cc GetTickCount
• 0x100643d0 GetThreadPriority
• 0x100643d4 GetThreadLocale
• 0x100643d8 GetSystemTimeAsFileTime
• 0x100643dc GetStringTypeExA
• 0x100643e0 GetStdHandle
• 0x100643e4 GetProcessTimes
• 0x100643e8 GetProcAddress
• 0x100643ec GetPriorityClass
• 0x100643f0 GetModuleHandleA
• 0x100643f4 GetModuleFileNameA
• 0x100643f8 GetLogicalDriveStringsA
• 0x100643fc GetLocaleInfoA
• 0x10064400 GetLocalTime
• 0x10064404 GetLastError
• 0x10064408 GetFullPathNameA
• 0x1006440c GetFileSize
• 0x10064410 GetExitCodeProcess
• 0x10064414 GetEnvironmentVariableA
• 0x10064418 GetDriveTypeA
• 0x1006441c GetDiskFreeSpaceExA
• 0x10064420 GetDiskFreeSpaceA
• 0x10064424 GetDateFormatA
• 0x10064428 GetCurrentThreadId
• 0x1006442c GetCurrentThread
• 0x10064430 GetCurrentProcessId
• 0x10064434 GetCurrentProcess
• 0x10064438 GetComputerNameA
• 0x1006443c GetCPInfo
• 0x10064440 GetACP
• 0x10064444 FreeResource
• 0x10064448 InterlockedIncrement
• 0x1006444c InterlockedDecrement
• 0x10064450 FreeLibrary
• 0x10064454 FormatMessageA
• 0x10064458 FindResourceA
• 0x1006445c FindNextFileA
• 0x10064460 FindFirstFileA
• 0x10064464 FindClose
• 0x10064468 FileTimeToSystemTime
• 0x1006446c FileTimeToLocalFileTime
• 0x10064470 ExitProcess
• 0x10064474 EnumCalendarInfoA
• 0x10064478 EnterCriticalSection
• 0x1006447c DeleteFileA
• 0x10064480 DeleteCriticalSection
• 0x10064484 CreateThread
• 0x10064488 CreatePipe
• 0x1006448c CreateMutexA
• 0x10064490 CreateFileMappingA
• 0x10064494 CreateFileA
• 0x10064498 CreateEventA
• 0x1006449c CreateDirectoryA
• 0x100644a0 CompareStringA
• 0x100644a4 CloseHandle
Library gdi32.dll:
• 0x100644ac TextOutA
• 0x100644b0 SetTextColor
• 0x100644b4 SetBkMode
• 0x100644b8 SelectObject
• 0x100644bc GetDIBits
• 0x100644c0 DeleteObject
• 0x100644c4 DeleteDC
• 0x100644c8 CreateFontA
• 0x100644cc CreateCompatibleDC
• 0x100644d0 CreateCompatibleBitmap
• 0x100644d4 BitBlt
Library user32.dll:
• 0x100644dc mouse_event
• 0x100644e0 keybd_event
• 0x100644e4 TranslateMessage
• 0x100644e8 SwapMouseButton
• 0x100644ec ShowWindow
• 0x100644f0 SetWindowTextA
• 0x100644f4 SetThreadDesktop
• 0x100644f8 SetRect
• 0x100644fc SetCursorPos
• 0x10064500 SendMessageA
• 0x10064504 ReleaseDC
• 0x10064508 PostMessageA
• 0x1006450c OpenInputDesktop
• 0x10064510 OpenClipboard
• 0x10064514 MessageBoxA
• 0x10064518 LoadStringA
• 0x1006451c IsWindowVisible
• 0x10064520 GetWindowThreadProcessId
• 0x10064524 GetWindowTextW
• 0x10064528 GetWindowTextA
• 0x1006452c GetUserObjectInformationA
• 0x10064530 GetThreadDesktop
• 0x10064534 GetSystemMetrics
• 0x10064538 GetSystemMenu
• 0x1006453c GetMessageA
• 0x10064540 GetForegroundWindow
• 0x10064544 GetDesktopWindow
• 0x10064548 GetDC
• 0x1006454c GetCursorPos
• 0x10064550 GetClipboardData
• 0x10064554 FindWindowExA
• 0x10064558 FindWindowA
• 0x1006455c ExitWindowsEx
• 0x10064560 EnumWindows
• 0x10064564 EnableWindow
• 0x10064568 EnableMenuItem
• 0x1006456c DispatchMessageA
• 0x10064570 DestroyWindow
• 0x10064574 CloseDesktop
• 0x10064578 CloseClipboard
• 0x1006457c ClipCursor
• 0x10064580 CharNextA
• 0x10064584 CharToOemA
Library kernel32.dll:
• 0x1006458c Sleep
Library kernel32.dll:
• 0x10064594 GetNativeSystemInfo
Library oleaut32.dll:
• 0x1006459c SafeArrayPtrOfIndex
• 0x100645a0 SafeArrayGetUBound
• 0x100645a4 SafeArrayGetLBound
• 0x100645a8 SafeArrayCreate
• 0x100645ac VariantChangeType
• 0x100645b0 VariantCopyInd
• 0x100645b4 VariantCopy
• 0x100645b8 VariantClear
• 0x100645bc VariantInit
Library ole32.dll:
• 0x100645c4 CoCreateInstance
• 0x100645c8 CoUninitialize
• 0x100645cc CoInitialize
Library oleaut32.dll:
• 0x100645d4 CreateErrorInfo
• 0x100645d8 GetErrorInfo
• 0x100645dc SetErrorInfo
• 0x100645e0 SysFreeString
Library shlwapi.dll:
• 0x100645e8 PathIsDirectoryA
• 0x100645ec PathFileExistsA
• 0x100645f0 StrToIntA
• 0x100645f4 StrCmpNIA
Library shlwapi.dll:
• 0x100645fc PathFileExistsA
Library ws2_32.dll:
• 0x10064604 WSAIoctl
• 0x10064608 WSAGetLastError
• 0x1006460c WSACleanup
• 0x10064610 WSAStartup
• 0x10064614 gethostbyname
• 0x10064618 socket
• 0x1006461c shutdown
• 0x10064620 setsockopt
• 0x10064624 send
• 0x10064628 recv
• 0x1006462c htons
• 0x10064630 connect
• 0x10064634 closesocket
Library PsAPI.DLL:
• 0x1006463c GetProcessImageFileNameA
Library kernel32.dll:
• 0x10064644 IsWow64Process
• 0x10064648 Module32First
• 0x1006464c Process32Next
• 0x10064650 CreateToolhelp32Snapshot
Library wininet.dll:
• 0x10064658 InternetGetConnectedState
Library user32.DLL:
• 0x10064660 BlockInput
Library advapi32.dll:
• 0x10064668 StartServiceA
• 0x1006466c QueryServiceConfigA
• 0x10064670 OpenServiceA
• 0x10064674 OpenSCManagerA
• 0x10064678 DeleteService
• 0x1006467c ControlService
• 0x10064680 CloseServiceHandle
• 0x10064684 ChangeServiceConfigA
• 0x10064688 EnumServicesStatusExA
• 0x1006468c QueryServiceConfig2A
Library MSVFW32.DLL:
• 0x10064694 ICCompressorFree
• 0x10064698 ICSeqCompressFrame
• 0x1006469c ICSeqCompressFrameEnd
• 0x100646a0 ICSeqCompressFrameStart
• 0x100646a4 ICSendMessage
• 0x100646a8 ICClose
• 0x100646ac ICOpen
• 0x100646b0 ICGetInfo
• 0x100646b4 ICInfo
L!This program must be run under Win32
.idata
.rdata
P.reloc
P.rsrc
Boolean
Integer
Stringd
WideStringt
OleVariant
TObject
TObject
System
IInterface
System
IDispatch
System
TInterfacedObject
TInterfacedObject
System
YZ]_^[
;rv;u!B
SVWUD$
d0d =M
u3ZYYd
Z^[SVQ3
]_^[SV
SVW<$L$
]_^[US
d2d"=M
2@E3ZYYd
d2d"=M
E3ZYYd
d2d"=M
EE3ZYYd
E^[YY]
_^SVWUT$
]_^[SV
f=r/f=w)f%f=u
1^[^8u
SVWPtl11
-tb+t_$t_xtZXtU0u
FxtHXtCt
~KxI[)G
Y12_^[
@aQYR@
b@"E@|oe@p+
BkU'9p|B0<RB~QC/j\
Cv)/&D
dEJzEb
9;5S]=];Z T7aZ%]g']
R`%uYnb
uM3Uh=5
EP3ZYYd
f%fUf?f
SOFTWARE\Borland\Delphi\RTL
FPUMaskValue
Iu9u_^[
_^[YY]
_^[RQS|
PRQQTj
YZXtpH
S1VWUd
SPRQT$(j
9t7H;Ou
Ku]_^[
YZXtm1d
SPRQT$(H
ZTUWVSPRTj
Zd$,1Yd
t=HtN`
r6t0R=
t/=t&,*&"
E3UheA
x_^[YY]USVW8
d0d ;~
W_^[YY]
QS1WV<
Ou^_[SV
SVWUQ8
kZ]_^[
UU1h(@
QRZX1Yd
PVSE_^[]
XRH8ZX
X_iWPQ1fu
ISVWRP1L
J9Z_^[X$
thtkFW)w
9uXJt
8uAJt
t8JIt2S
PHXHI|
St-Xt&J|
t0JN|*9}&~")9~
t@t1SVW
1Z)_^[
WPQ1fu
$Z]_^[
YZ]_^[SVRP1L
dKuZX>Z^[X$SVW
9trtQtTFW)w
9uAJt
f f9u!
|i;|e~aK++
$Z]_^[
tKt:SVW
OWVJx f
VWf_^t
1Z)_^[SVQ
Mu]_^[
USVW1\$
USVW1\$
E|. tD$
|.$t(D.C<Xt
USVWMUEE
3EEE;t
u<EE;~ }
U'EUXEEcE
EE};]}
MUkFKuEU
Z_^[UQSVu
SVWUEEEhd^
E8\uAEx
E@0EE8
E@E}+}
IEPPEP
kernel32.dll
GetLongPathNameA
Bt@EPh
$t"EPh
t"EPEPj
+PEPEP
+PEPEPqj
+PEPEP7j
Software\Borland\Locales
Software\Borland\Delphi\Locales
uYZ_^[
USVWE<
t93Uha
d0d ]ES
u_^[YY]
UE3Uhb
d0d E@
r3ZYYd
USVMU3
;ur;ur
USVMUE}
2Ftl;u
r@EE^[]
SV3Uhf
@E,PE@P
U3ZYYd
E0^[Y]
SV3Uh7g
PE]YZ~
U3ZYYd
SV3Uhg
d0d EE3ZYYd
E><^[Y]
U3UhRh
33ZYYd
Eq[]U3Uhh
QRPPPP
need dictionary
stream end
file error
stream error
data error
insufficient memory
buffer error
incompatible version
Hu3ZYYd
USVMUE
C0S,JS4
CPSLJST3
F(S,V C8
S,F(V C@
SLF(V CDM
VUS8Rsls\K83
CHS8KX
3#CTCH3=KXSHK8
3#STSHKDf
3YZ]_^[
fff#3f
^[SVWUQ3
F03C C
,333mF0{
+C C S
+C C S
u"SDKLfDJ
]_^[SV
*t)Et$It [t
S,F(V C8
S,F(V C@
SLF(V CD
RO8QC8P
RO@QC@P
RODQCDPn
3Z]_^[
C<SDKLfDJ
C|Sl33K\Ct
3SxS`Ch3
KH[SVW
PlH8xx
4$pp;\$
}1\9\$
SVWX8p8
PpPt;s
SVWUQs,{<+{t+{l
;ClwpVC8
)sp)sl)k\CL
r%C8Sl
CHKXS8Kl
3#CTCH{t
SlKtC\Sl
Kl+K\{\
Kl+K\|
*3e!<$
RKl+K\{\
Z^[SVWQ
s&uCt=
r@KXCHKlS8
3#CTCHKDSl#S4f
QfKlCDSHf
PtOClS,
S`)StK`;
rSK`ClKXSHK8sl
3#STSHKDf
QKl#K4s@f
SDKHf{lf<JK`uCl
SlK`KlS8
SHKX{lK8
3#STSHVC8Sl
Kl+K\{\
v3em<$
RKl+K\{\
s&oCt=
r@KXCHKlS8
3#CTCHKDSl#S4f
QfKlCDSHf
PC`CxSpSdC`
syClS,
f+CdSxf
SxJ)Stkx
ClKl;L$
wBKXsHS8Kl
3#sTsHKDf
qKl#K4s@f
SDKHf{lf<JKxu3
Kl+K\{\
Kl+K\{\
ClKt{h
tVS8KlD
PKl+K\{\
_^[SVWU
l<$fW<
L$$t^D$$
KuJD$$u(]_^[
L$ fl$
[USVWMU
USVMUu
_^[YY]
USVMUU
43BIuZ^[SVW
43BIu_^[
|]_^[VW
Exception
EHeapException
EOutOfMemory@
EInOutError
EExternal
EExternalException
EIntError
EDivByZero0
ERangeError
EIntOverflow@
EMathError<
EInvalidOp
EZeroDivide
EOverflowD
EUnderflow
EInvalidPointer
EInvalidCast@
EConvertError
EAccessViolation@
EPrivilegeh
EStackOverflow
EControlC
EVariantErrorx
EAssertionFailed@
EAbstractError4
EIntfCastError
EOSError@
ESafecallException
SysUtils$
SysUtils
TThreadLocalCounter
$TMultiReadExclusiveWriteSynchronizer@
KuYZ_^[SVW}
KuYZ_^[VW
9t*^ar
|P~P|P~Pj
s|Pk~Pc|P[~Pj
SVWU!|
| v;}
N|7 vU+A
H~]_^[
f|^ vW
RV1N0:r
uYZ))v
UV 1P1
UQSVWE
NuE_^[Y]
$Z_^[SVWQj
PWVSSu
$Z_^[USV
EVEPEPSEEU^[YY]
@[SVQ4v
$~)\>t
3EEPEPEPEPEPW
EUE3RPEU
E3RPEU
1t!F<ar
)t[^_
$Z^[SVW
D$ D$$
3W(_^[S
9t<%t^]E<-u
ZYuG1<*t"<0r=<9w9i
uSPE]$lX[_^[[]
t(t$PE
3EE_^[Y]
PSVWMU
}(EXnPEPE
INFNAN
M[YCVut
N^$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)]
+ES]S[}
00fJu2}
S]Q[-u
< tN11
EEBN11
[^_]USj
sMf<sGf<sAf
E+EMf`8V
Uf;\Bwd
USVMUE]
}EPEftf}
fMfEfkEdf
ufLNfMfMf;Mr
fMf)M@
EZY^[]
d0d Q^E
PEbPEPj
U@^3ZYYd
8]E0]U^[]
d0d \E
PEqaPEPj
a3ZYYd
E7\T^[]
U~YUY}
U/YUXYE
EYEuYn
UYUYEH
t%HtIHtm
UYU$YE
Eiu3f}
E u1U.YE
Eu1UYE
|YUYf}
M_^[]AM/PM
t _^[USVWMUE
ER2K_^[YY]
)D>$,Dt
SVWUQ3
$Z]_^[
d0d 3fE
UEU"EE
t"t:Rf}EEfEfEfEfE6f}EEfEfEfEfE
f}EEfEfEfEfE}
;~5fd/0}
fEfEfEfE
fEfEfEfE
zuEPfMfUE3ZYYd
NFE_^[]
QRPMr~
Z_^[UQSVWM]
Ul_^[Y]
U3QQQQQQSVW3Uh[
d0d qE
JCDHyYUIUj
JC8HVYUIC
YUiIUj
JE*YUDIC
u3ZYYd
HhA_^[]
H@^[Y]
d0d EP
wn3ZYYd
U3QQQQQSVW3Uh
)GEPTo
HUICI;~
GUHCH;
E)>_^[]
PPlu#h
-O*D$DPD$HPhmj
PD$LPD$PPjKkPlj
j0kPl6j@D$
PD$LPj
d0d EPU
B3ZYYd
d0d EPU
A3ZYYd
_^[YY]
TErrorRec
TExceptRec
EY?EQ?7_^[]
t<HtHU
r3t7G=
S3E3Uh
P3ZYYd
UE3UhO
d0d Eo%
E;t4[]
TbtPD$
SVWU3~F+<;
USVWMU;E
;u|;uu#;]}
$~J;;;
J6K;\$
$YZ^[SV
$~F:;~
$YZ^[S
4$+FZ]_^[
$YZ]_^[
Z_^[US3
UQSVW}
tPN\3)D7
u_^[Y]
U8Y_^[]
IuS3Uh
1E^1EV1EP
vE3Tu?EP
M1uuhp
44uuh|
m/d/yy
mmmm d, yyyy
:mm:ss
US3E3Uh
d0d MW
(3ZYYd
X[SVQ\
kernel32.dll
GetDiskFreeSpaceExA
]_^[UQSUfEE2E$
Y]SVWU
YZ]_^[
Z^[SVt
}$E(H;D$
YZ]_^[
u 3C$C
+R;G$t@u<'G
Q;C$t4C
SVW3Uh
d0d t9E G
EF!_^[Y]
SV3UhH
d0d EF
EmF{!^[Y]
$3ZYYd
d0d u1U
&3ZYYd
(Bulid:
d0d E$E
_^[YY]
SVW3h#
zJt\h#
VIt>T(IP
kernel32.dll
IsWow64Process
GetNativeSystemInfo
Hu3^[SVD$
3^[V^[
kernel32.dll
Wow64DisableWow64FsRedirection
3^[V^[
kernel32.dll
Wow64RevertWow64FsRedirection
U3Uh-%
S3UhZ'
US3E3UhE(
$33ZYYd
4$33ZYYd
#33ZYYd
@PACE}
]E^[Y]
Y]oleaut32.dll
VariantChangeTypeEx
VarNeg
VarNot
VarAdd
VarSub
VarMul
VarDiv
VarIdiv
VarMod
VarAnd
VarXor
VarCmp
VarI4FromStr
VarR4FromStr
VarR8FromStr
VarDateFromStr
VarCyFromStr
VarBoolFromStr
VarBstrFromCy
VarBstrFromDate
VarBstrFromBool
U3Uh5-
TCustomVariantType@.
TCustomVariantType-
Variants
EVariantInvalidOpError
EVariantTypeCastError/
EVariantOverflowError/
EVariantInvalidArgErrorH0
EVariantBadVarTypeError0
EVariantBadIndexError
EVariantArrayLockedError@
EVariantArrayCreateError@
EVariantNotImplError@
EVariantOutOfMemoryError@
EVariantUnexpectedError
EVariantDispatchErrort3
EVariantInvalidNullOpErrorUj
Y]USV3
MMM3Uhs4
d0d UEj
Y]USV3
MMM3Uh5
d0d U|
IuS3Uh]8
t?Htbk
KuUKLYt*P
UEYuP_^[]SVQf3f
S7S)Z^[
SP_^[]
EP<3UhHB
E{_^[]
d0d E&6
d0d E.
S3Uh.C
d0d E&<
S3UhzC
E; I[Y]
S3UhCG
S3ZYYd
EP3UhG
E3ZYYd
_^[USVWE3UhYL
d2d"Ef
E3ZYYd
?3EE_^[YY]
FUQSVWEEf
t(.3}=
d0d EF
UQSVWEEf
t(.3t=
3j_^[Y]
UQSVWEE
3q_^[Y]
UQSVWEE
3_^[Y]UQSVWEE
F3UhuP
33ZYYd
#3_^[Y]S
UU3Uh2R
EUPEU5}
EEUaEPj
E9EU5=
EEEU[]US
EP3UhR
EU3ZYYd
E(EU[]
USVWE3Uh
d2d"Ef
3EU-EEU
EEU3ZYYd
EU_^[]
UU3UhW
EUwu f
E6EE[]
EP3UhX
E3ZYYd
E,EE[]S
EP3Uh]
]3ZYYd
E[]SVWf
FUSVWEE
EE]eE@
E3Em]NEh
]B3Uhb
d0d E-]3ZYYd
3E5E_^[]
UUU3Uhc
uWaEUMEU
uGEU3EUp}t
EEEE f
*EEEEE[]
EP~3Uh
]3ZYYd
E[]SVWf
UU3Uh\i
u/9EUEUMxu f
:3ZYYd
EEigm[]
EEEEm[]
}3ZYYd
EVm[]SVWf
$ <$3C
n<$%e<$
U3QQQQSV
d0d Pj
fEUZU&E
EEUrZU
MM3Uhp
d0d EPM3Uhep
TEPEUE
Uy3ZYYd
E^3ZYYd
V<^[]USV
EU!3ZYYd
EVE[]U
3RPEdZU
<$EkUk
<$EkUkH
0EWUlLC
b>UUH(
M3Uhbw
d0d EP`3UhEw
E~3ZYYd
Eca^[]
d0d Uf
tdEP%3Uhox
ET3ZYYd
E97E[]
<$EfUu
3RPERSU
<$EdUHk
3RPEPUBhC
0EPU&LC
p>UU(y
UVU3ZYYd
EP;3UhZ~
U3ZYYd
@t6BYm=
_^[SVf
SV3Uh3
d0d E1UC3ZYYd
}Z_^[U3QQQQSV3Uh
d0d f;
u-E6EPE(UXU+E)EPE
UXU3ZYYd
USMUE]f
f;Et_EP
7EPMUE
\EPUME
f;EtdEP3Uh
fEf;Et
S,3ZYYd
tcEPQ3UhB
d3ZYYd
f;Et_EP
H[USVWf;
Ot Ot)4
EEmEU)
EE}E9E}U-Me%Mm
USVWMUE3
EEUEEUE
Ht*?EU
UEU+EU+E
uuEUwEU3ZYYd
uuEUDEU
uuEUEUqE
EUAEU#E#UEU-EU
EU3E3UEU
<ht]f>
uWN^[f;
"3ZYYd
u&,}!m5
}m}(h}m}
FSVWUQf
Mt0MtU
aZ]_^[
EPp3Uh{
uWEP83UhO
E3ZYYd
E3ZYYd
HE_^[]<
433ZYYd
tRPkRP
_<$<$!<
USVMUE
f;Et{EPT3UhW
ElfEf%
E3ZYYd
ME3ZYYd
f;EtwEP
MUEfEf;Et
E3ZYYd
sfEP 3Uhw
MbE3ZYYd
f;EtwEPz3Uh-
fEf;Et
E3ZYYd
VWf0f:f
Smallint
Integer
Single
Double
Currency
OleStr
Dispatch
Boolean
Variant
Unknown
Decimal
ShortInt
LongWord
String
Array
ByRef
VariantsUSV(
Ku3ZYYd
Z_^[USVWU
_^[YY]
UQSVWEP
UAUEh,
d2d"Ef@
E3ZYYd
1;E_^[Y]USVW3
MUE3Uhn
EmEU%t
GNu3ZYYd
hr3ZYYd
UE_^[]
d0d -$
SVWt;1
uKu_^[SW:?
SVW3UhD
d0d E"M
[E[~[USVW3
EU3ZYYd
$EU;fE
<$EU_^[]
^[U3Uh
tagEXCEPINFO
TNotifyEvent
Sender
TObject
EStreamError@
EFileStreamError@
EFCreateError<
EFOpenError
EFilerError
EReadErrorD
EWriteError
EClassNotFound
EListErrorP
EStringListError@
EComponentError
TListp
TThreadList
IInterfaceList
Classes
TInterfaceListt
TPersistent
TPersistentt
Classes
IStringsAdapter
Classes
TStrings
TStringsH
Classes
TStringItem
TStringList
TStringListx
Classes
TStream
THandleStreamx
TFileStream
TCustomMemoryStreamh
TMemoryStream
TStringStream
TStreamAdapter
TFilerl
TReader
TComponentName
YEkOAQ
TComponentl
TComponent
Classes
TRegGroupp
TRegGroupsUQSVWt
$^ru%CNuE
3Z]_^[
QHKu_^[
SVWU'u
]qGMuF
K|%C3E
Ku]_^[
USVWU3Ed
K|)C3G
?y#FKu3ZYYd
.twE_^[YY]
d0d ]E
x3ZYYd
EY~v[]UQS
)E3ZYYd
_vE[Y]US
23ZYYd
Uv[]UQSVW3E`
Ew%Ku3ZYYd
uE_^[Y]
SVW3=h
q^[SVW
k9uYZ^[
d0d U1U
E{;t^[Y]SVWQ
$Z[SVWQ
d0d E@
iUEi3ZYYd
d0d Ex
k^[UQSVWEE@
tVO3Uhs
Po_^[Y]UQSV
n^[Y]SV
^[UQSVW
2hn_^[Y]UEE@
E3ZYYd
E3ZYYd
E3ZYYd
=smE[YY]
USVEE@
(3ZYYd
mE^[YY]
UQSVWEE@
cl_^[Y]
UQSVEE@
JE3ZYYd
>l^[Y]
k_^[Y]USVEE@
dUF3ZYYd
PkE^[YY]
d2d"3ZYYd
d2d"3ZYYd
A3ZYYd
!Wj^[Y]
.Tj3ZYYd
Ep=i^[]
`rftct3fecUfYc}
s3ZYYd
Eoh_^[]
$Z[UQSEE@
R$g[Y]
S`]_^[
0V$_^[
MUE3Uh
d0d E&
EZ8W<CNu3ZYYd
f3ZYYd
nf_^[]
Q@3ZYYd
USUEEPh
Strings
MMUE3Uh
;u;N|0F3
4ldE_^[]
G)feYZ^[
SVW3Uh
d_^[Y]
d0d E3Uhr
S$3ZYYd
EQc3ZYYd
j/c_^[]
E"oE3ZYYd
E)jbE[YY]
MMMUE3Uh
njuN|2FE
EuN|XFE
]ENu3ZYYd
2ia_^[]
ENuE3ZYYd
aE_^[]
MMMU3Uh
H|g@EE
EiEU0t%EPI
EMuE3ZYYd
gEg@`E^[]
FKu]_^[UQSVWMM
S$_^[Y]
Ql3ZYYd
E!X_^Y]
d0d E<3Uh
+E3ugU
Q,3ZYYd
E^3ZYYd
E<f^^[YY]
d0d ;tdE3Uh|
Sd3ZYYd
EG^3ZYYd
Ee*^_^[YY]
SdZ]_^[
MUE3Uh
d0d E'
t3ZYYd
Qx3ZYYd
EU\^Y]
SV3Uh5
Ec\^[Y]
d0d E}eU
Q,3ZYYd
ME]3Uh
d0d E3Uhy
+MEUcUE
u3ZYYd
EJ[3ZYYd
Eb-[^[]
MUE3Uh
d0d Ez9
K| C3M
FKuEL9
bZ_^[]
3F F$3F(F,
S<^[SVWUQ
$Z]_^[
SVWUL$
]_^[SVW
Sd^[USVW
_^[USVMUE]uE
]CN;};u~
UE|];]|^[]
USVfME]EE
EUEU^[YY]
EUEUYY]
P2%)[]
d0d fuiU
}HUEEE
jP3ZYYd
3]_^[SVWt
TPropFixup@
TPropIntfFixupUSVt
SV3Uho
d0d Ent.C
EFnTI^[Y]
d0d 3Ety
+MEUAQU
u}3ZYYd
EOHE_^[]
USVWUE=l
@Ku3ZYYd
G_^[YY]
UQSVWE=l
@Ku3ZYYd
HG_^[Y]S
CpM^[]
N>E3UhE
>~EEpL[]
$Z[SVW
C<S8|$
RKu3ZYYd
!WD_^[]USVW3
d0d E@0
UEE@0}
u5xt*E@0
o3ZYYd
ZC3ZYYd
EJ=C_^[]S
;GNuC0v;3C0_^[
SVWUL$
$:GLD$
K| C3D$
:u7EKu:;=(
d0d UH
EH,A[Y]UQSVU
R 3UhD
d0d uLEB
@^[Y]T
Classes@
@@4FKu^[]
RYLCNu_^[]
UQSVWUfEE
@?[N|AF3
@<fEf#G
CNu_^[Y]
USV3n,
USVW3Uh
S,3ZYYd
>'?_^[]
USVW3Uh
6>>_^[]USVW3Uh;
RB,3ZYYd
==_^[]
MMMUE3Uh
d0d MUE
d0d EE}
d0d UEYEfH
E@,MUf5E
t,E@4U}}2UEYE@4Ue
UEzYE@4UK3ZYYd
"7UrYt
<3ZYYd
n:3ZYYd
q2UB03Uh
E3ZYYd
[Y]USVW
E@,EE@(Ef
4UB,3Uh
d0d f3Ex(u
EUP,EUP(8_^[]S
t t6DT$
y3qSVW
53ZYYd
E8<4[]
MUE3Uh
d0d 3Uh
d2d"UE%
E>EEE@x
.uEpP+MUE@;|hE
.URp E}
EPpE3E
UY}CiE
EPpE>3ZYYd
UiY43ZYYd
4h43ZYYd
E7:2_^[]USVWE
f_^[YY]
U3QQQQ3Uh
d0d UE
@@03ZYYd
E8E#V11YY]
]]MUE3Uh
d0d Ex
UEeMUEW
E<$UE6R
t7MUEh'U,Y
UhY3ZYYd
d0d 3Uh9
d0d Ee
..3ZYYd
E4]-_^[]
$3y593
Z^[USV3
U6S3EP
My3ZYYd
Ed:b,^[YY]
SV3UhG
EU%9UM
w3ZYYd
E2E2|+^[]Q
d0d U}
u3ZYYd
E2 +[Y]
uYwEmU
]Y_UYV
Y3ZYYd
E20(YY]
d0d UX=3ZYYd
E/([Y]USV3
d0d t*MU
t3ZYYd
i/'^[]
d0d E/3Es
E(3ZYYd
E..'E_^[]
SVWfxB
_^[SVQ
CdS`<$
UU3UhM
ERPEBEP
d0d UENU
ENERPEEP
ME/UEt
$3ZYYd
$3ZYYd
EpIE+v$[]
0U3QQQQQQQS
d0d "E
UEUcgmUEUxgVEb<
f@UEYUD$*EJRPe
#3ZYYd
E Eg0E)]"[]
<$| <$
$Z_^[Uj
SV3Uh9
d0d U-JM
93ZYYd
E' ^[Y]
SVWB2G
GNu_^[
K}Z]_^[UQSVW3EF t
E?u6;_
S _^[]
K|"C3G
EKu3Z]_^[
u"4$D$
GMuZ]_^[
^[USVWU
33ZYYd
33ZYYd
33ZYYd
_^[YY]
33ZYYd
;3UhO)
d0d 3EE
EPSEPE
d0d t9C
3C 3C$C,
@3Uh}*
FKu3ZYYd
U3Uh@+
73ZYYd
d0d -\
U3Uhe-
EOleError
EOleSysError@
EOleExceptionUj
SVW3Uh/
E13Ph/
Apartment
Neutral
ole32.dll
CoCreateInstanceEx
CoInitializeEx
CoAddRefServerProcess
CoReleaseServerProcess
CoResumeClassObjects
CoSuspendClassObjects
U3QQQQQQQQSV3Uh
d0d 3EEb/Pj
EPEPEU
SVWMEE
d0d 3E3UhC7
u3ZYYd
YY]USVWMUE}E
5EUfDP
F;uuE
P4PEPEP`
E^[]Uj
SVM3Uh
eREPQREZYu
EPQRh<
1PPPPPE
IXMLDOMImplementation$
IXMLDOMNode$
msxml$
IXMLDOMNodeList$
IXMLDOMNamedNodeMap$
IXMLDOMDocument=
msxml!
IXMLDOMAttribute=
IXMLDOMCharacterData=
IXMLDOMText>
TMSDOMInterface
TMSDOMImplementation
TMSDOMNode@
TMSDOMNodeList@
TMSDOMNamedNodeMap@
TMSDOMCharacterData
TMSDOMAttr
TMSDOMElement
TMSDOMText
TMSDOMComment
TMSDOMCDATASection
TMSDOMDocumentType@
TMSDOMNotation
TMSDOMEntity@
TMSDOMEntityReference
TMSDOMProcessingInstruction
TMSDOMDocumentFragment
TMSDOMEventHandler
TMSDOMDocument
TMSDOMImplementationFactory0g
TMSDOMImplementationFactory
msxmldom
EE3Uhg
t8EPEP
SV3Uhh
d0d u!UT
SV3UhWi
EU EPhi
i3ZYYd
EvEl^[YY]
O`SVWUQ
$3<$|&G
PZ]_^[
UU3Uhj
\3ZYYd
EE/=_^[]
O>`UQSVt
Ec3Uhj
U3ZYYd
^[Y]Uj
W3ZYYd
createDocumentType
SV3Uhl
qf];EPVSEMPE
4f]3ZYYd
)3ZYYd
^[Y]Uj
d0d UE8PEPC
PT5E;Eu
E3ZYYd
_^[YY]
S3Uh9n
d0d EPfE
83ZYYd
En_^[Y]
uJE-PC
EEE_^[]
S3Uh~o
u-EsPC
P0tEUUC
[3ZYYd
}E)E!_^[YY]
d0d EPC
}3ZYYd
E_^[Y]
S3Uh`p
d0d E{PC
EG_^[Y]
S3Uh|q
d0d E_PC
E+_^[Y]
UQSVW]
S3Uh-r
d0d EPC
U3QQQQSVW]
d0d EPC
P HE-u
'3ZYYd
QEy_^[]
S3Uh>s
Ei_^[Y]
d0d E/PC
OE_^[Y]
S3Uhpt
d0d EkPC
E7_^[Y]
UQSVW]
d0d EPC
1_^[Y]
U3QQQQQQQSVW]
S3Uhhu
d0d EPUE
uuuuUE
(EE$_^[]
normalize
S3Uhiv
d0d EPUE
'_^[YY]
d0d EPUE
o3ZYYd
U3QQQQSVW]
9S3Uhw
d0d EU
P$Q3ZYYd
supports
S3UhWx
d0d EPE
j3ZYYd
EP_^[Y]
E_^[Y]
S3Uh;y
Ph3ZYYd
PlN3ZYYd
S3UhIz
d0d EPUE
E^Ef_^[YY]
U3QQQQQQSVW]
d0d UE
uuuuUE
E5_^[]
E3Uha{
U3ZYYd
^[Y]Uj
E_^[Y]
UQSVW]
S3Uh4|
d0d EPC
UE3ZYYd
^[Y]Uj
d0d EPE
Y3ZYYd
E_^[Y]
UQSVW]
S3Uhp}
d0d EPC
#E_^[Y]
S3UhL~
d0d EPE
%3ZYYd
E[_^[Y]
d0d E#PE
?E_^[Y]
d0d EPE
A3ZYYd
Ew_^[Y]
d0d E=PUE
_^[YY]
d0d EPUE
<3ZYYd
[_^[YY]
5E_^[Y]
E}_^[Y]
73ZYYd
USVW3E]
d0d EPUvEP
E_^[YY]
g3ZYYd
E=_^[Y]
)E_^[Y]
Eu_^[Y]
'3ZYYd
QE_^[Y]
Ee_^[Y]
3ZYYd
get_ownerElement
USVW3E]
d0d EPUEP
Ex_^[YY]
U3QQQQQSVW]
MEEm_^[]
U3QQQQQSVW]
d0d EU
fuuuuUEP
EyE_^[]
-E_^[Y]
U3QQQQQSVW]
U3QQQQQQSVW]
t/EPEP
d0d ESPE
\3ZYYd
REEE_^[]
O`U3QQQQSVW]
d0d EPE
PEPU EP
E2E*E"E
d0d EPE
EE_^[YY]
getElementsByTagNameNS
d0d 3Uh)
d0d EPE
E_EW_^[YY]
d0d 3Uh
g3ZYYd
E_^[Y]
Ea_^[Y]
U3QQQQQSVW]
d0d E"PUE
JEPUEP
d0d E>PE
PE-PUEP
@EEE_^[]
U3QQQQQSVW]
d0d EU
RuuuuE
U3QQQQQSVW]
BEPUEP
O`USVW]
PS13ZYYd
IuQSVW]
d0d EPE
GuuuuEPC
P$fENPEPU
>3ZYYd
EEpEE_^[]
d0d U@EP
Ey_^[Y]
d0d E;PE
>3ZYYd
d0d {(
u:EAPUEP
5EU~UC('E
>EEE_^[]
get_internalSubset
7PU|EP
EE_^[Y]
d0d {,
EUUC,E
S,3ZYYd
EVENEF_^[]
get_publicId
get_systemId
O>`U3QQQQQSVW]
d0d ErPUEP
EE)_^[]
U3QQQQQSVW]
d0d EPU
/3ZYYd
E_^[Y]
U3QQQQQSVW]
U3QQQQQSVW]
d0d EBPUEP
EE_^[]
9E_^[Y]
Eu_^[Y]
?3ZYYd
UQSVW]
d0d EPC
3_^[Y]$
d0d EPE
EEE_^[]
O`U3QQQQQQQSVW]
d0d EDPE
uuuuUEP
.3ZYYd
$EEDEE_^[]
d0d EmPE
l3ZYYd
_^[YY]
d0d EPE
EZER_^[YY]
EE_^[YY]
d0d ESPE
\3ZYYd
REEE_^[]
O`U3QQQQQQQSVW]
d0d EPE
d0d EPE
EkEc_^[YY]
d0d E)PE
EE_^[YY]
d0d EPE
E2E*E"_^[]
d0d EPUvEP
Ew_^[YY]
d0d E;PUEP
H3ZYYd
i3ZYYd
E7E/_^[YY]
getElementById
E<E4_^[YY]
getElementsByTagNameNS
importNode
IuQSVWu
d0d t;UUE
*EPUEP
PPb3ZYYd
EE_^[]
O>`USVW3E]
d0d EPUVEP
Er_^[YY]
73ZYYd
USVW3E]
d0d EPU~EP
_^[YY]
USVW3E]
d0d EPU
zE&_^[YY]
USVW3E]
d0d EPUEP
_^[YY]
w3ZYYd
EM_^[Y]
=E_^[Y]
USVW3E]
d0d EPUEP
_^[YY]
USVW3E]
d0d EPu
_^[YY]
U3QQQQQQQSVW]
EEPEUuuuuUTEP
EsEEc_^[]
3ZYYd
i_^[Y]
U3QQQQQQSVW]
EUwuuuuU)EP
|3ZYYd
EB_^[]
USVW3E]
d0d EPE
_^[YY]
IuQSVW]
d0d f}
UEkuuuuUEP
E>_^[]
FU3QQQQQQSVW]
d0d EPEU
YuuuuU
U3QQQQQSVW]
d0d EU
uuuuUEP
d0d EPEjPU
d0d EPE
d0d EPERPUEP
d0d EPE
EzEr_^[]
EPE,PUEP
<EE_^[YY]
EXEP_^[YY]
P 3ZYYd
E_^[YY]
DOMException@
EDOMParseError@
IDOMImplementation
xmldom
IDOMNode
xmldom
IDOMNodeList
xmldom
IDOMNamedNodeMap
xmldom
IDOMAttr
xmldom
IDOMElement
xmldom
IDOMDocument
xmldom
TAsyncEventHandler
Sender
TObject
AsyncLoadState
Integer
IDOMPersist
xmldom
IDOMParseError
xmldom
IDOMParseOptions
xmldom
TDOMVendor<
TDOMVendor$
xmldom
TDOMVendorArray
xmldom
TDOMVendorList@
SV3UhS
d0d E?EPE1EZ
^[YY]Uj
SVW3Uhe
x^_^[YY]
F3ZYYd
ED^[Y]
d0d ]E
E83ZYYd
MU3Uh2
d0d 3EN|,F3
CNu3ZYYd
U3QQQQQSVW3Uh
<3ZYYd
PE$~_^[]
@Juh;}EPZ
@Ju7HPC
}]U3UhV
EXMLDocError@
IXMLNode
XMLIntf*
IXMLNodeList
XMLIntf
IXMLNodeCollection
XMLIntf
TXMLDocOption
doNodeAutoCreate
doNodeAutoIndent
doAttrNull
doAutoPrefix
doNamespaceDecl
doAutoSave
XMLIntf@
TXMLDocOptions
TParseOption
poResolveExternals
poValidateOnParse
poPreserveWhiteSpace
poAsyncLoad
XMLIntf@
TParseOptions
Element
Attribute
CDATASection
EntityRef
Entity
ProcessingInstr
Comment
Document
DocumentType
DocumentFragment
Notation
Q3ZYYd
TXMLNodeList,
TXMLNodeArray
XMLDocX
TNodeClassInfo
TNodeClassArray
XMLDoc
TNodeChange
ncUpdateValue
ncInsertChild
ncRemoveChild
ncAddAttribute
ncRemoveAttribute
XMLDoc
TXMLNode@
TXMLNode
XMLDoc
TXMLNodeCollection@
TNodeChangeEvent
IXMLNode
ChangeType
TNodeChange
4PRQf`YZ
TXMLDocument8
TXMLDocumentX
XMLDoc
Active`
FileName8
DOMVendor`
NodeIndentStr
Optionsh
ParseOptions
BeforeOpen
AfterOpen
BeforeClose
AfterCloseD
BeforeNodeChangeD
AfterNodeChange
OnAsyncLoad
%Bb[SVWVW
&"b_^[
EEd3Uh
E3ZYYd
)_^[YY]
]ME3Uh
uEPM+IS
l3ZYYd
Ee,^_^[]
Jt2JtW
PE<E?ExEmE
PELEoEEE
[Y]UQE
USVEuE
u#UEEE
t3ZYYd
Nu3_^[
SVW3Uh
d0d EPEP
iUEbU3
i3ZYYd
encoding
ISO-8859-1
US-ASCII
UTF-16
UNICODE
USVWMU
kFOuEHP
d0d t?;
y`EP}E
UK`3ZYYd
ER]U_^[]
%s="%s"
UQSVWU
SV3Uh;
Q43ZYYd
EzyT^[Y]
]]MUE3Uh
d0d EMK|1C3M
ExExS^[]
Ecf3UhG
d0d VK U#
E~a|S^[Y]
USVWMU
d0d MU|
x3ZYYd
aR_^[YY]
d0d K|.C3M
Enw3ZYYd
EYwgR_^[]
w3ZYYd
EvQ^[Y]
SV3UhF
v3ZYYd
Eov}Q^[Y]
O`USVWMU}
v_^[YY]
v3ZYYd
EuP^[YY]
O`USV3
]]]M3Uh
U3X3ZYYd
E#WE]EtO^[]
IuMSVWM3Uh7
d2d"~"UE
@M93ZYYd
[Eor}M_^[]
UQSVWEEX
E%_^[Y]
SV3Uhw
E>qLL^[Y]
SVW3Uh
d0d EP
EpK_^[Y]
IuQSVW3Uh
#3ZYYd
^E{IEo
O`USVW
d0d E@
E\UEEy
RL;J3ZYYd
sEnG nE
G03ZYYd
C$uC(PC
t-F,zdH|
3y$BHuF,
D_^[USV]
IuQSVW3Uh
d0d 3F
EU:UMF
EKu3ZYYd
lEyEEkEkF_^[]
IuQSVWU3Uh
EEkPC P
EPE`kPC P
P4alEP
SluN|ZFE
E+kPEPE
P4 lEP
Q8ENuEUt
j3ZYYd
EjEjEjEjEjE_^[]
SVW3Uh
d0d s$t
Lj3ZYYd
E j-E_^[Y]
t#C,`N|
GNu]_^[
SV3Uhx
d0d ,$
u,EPVU#
EEiE=iKD^[]
]]M3Uh#
u0EPVEPU"
EhEhC^[]
IuMSVM3Uhd
E@EigEagEYgEaP_B^[]
SVW3UhX
d0d EPVWU
t3EOPVWU
E?EmfEuOE]fkA_^[]
IuMSVWMU3Uha
d0d E|
EePF P
u}EePEPUF
fEU{EPEP
fEePEPEtePF P
P4ufEP
EJePEPE=ePF P
P4>fEP
UzEPEPU
SEMEdEdE|dEtdE|MEddE\dETdb?_^[]
d0d EPM
yEPEPEPU
d#EPEPU
~Ld>_^[]
IuQMSVMU3Uhy
d0d 3E8
P|Mc@j
E*bUEU
tFC,XH|9@EE
RMUFDV@EMu3ZYYd
EaEJEaEaEzaE
[PE_aEWaE
8PE<aJ<^[]
IuQSVWU3Uh
EEPE`PC P
auN|[FE
E`PEPE`PC P
Q8ENuEUt
J`3ZYYd
SQTC P
PX`f<$
SVW3UhR
d0d s$t
_3ZYYd
Ec_q:_^[Y]
t#C,UN|
GNu]_^[
EG9^[Y]
]]]MU3Uh
EPEz^PG P
P {_EP
m_]K|NC3EJ^PVE@^PG P
P A_EP
3_EMU-t
FKu3ZYYd
E]E]E]8E_^[]Uj
SVW3Uhx
eFK8_^[]
SVW3Uh
d0d EpFM
t&35Ht
Sx3ZYYd
ZEE*\87_^[]
USVWWE
V{P^CdU
uDs6_^[]
IuMSVMU3Uh
d0d 3E<
Q EPC P
EPEZPC P
?;w*ENZPU
Q EPC P
PT>[cE$ZPE
Q EPC P
oUUEY{,
tFC,?PH|9@EE
RMUF<V8EMu3ZYYd
GEXEXE
GEX3^[]
'USVW3
]]MU3Uh
d0d s$t
ENO|=GE
EW3ZYYd
F2_^[]USVW
d0d C$t
6W3ZYYd
1@/2_^[]
EVPC P
SX3ZYYd
EBVE:VE2V@1_^[]
IuMSVWM
d0d E>
rUMX8W
E@u>UuEPE
urUMX8W
.ETETE
bCEfTE^TE
y=E-EATE9TEA=E)TE1=//_^[]
IuMSVWMUE3UhN
d0d ESUE8E
>u)UEEPE
pUMX0V
ME@(U3ZYYd
E3,ERE
5E;E+E
cAEgRu-_^[]
IuMSVW3Uh
d0d 3=t.EqEPE
E-+E:E
+,_^[]
t\7uQMU}
93ZYYd
9EsP+_^[]
P\ QEP"
P3ZYYd
EO*_^[Y]
SVWUL$
t>C,UFO|/G3C,,
FOuYZ]_^[SV
C,ES,4^[
C,EH|G@3S,;,u8
@JuOWC,
FHu]_^[
d0d {(
t6VUC(EPE
NN3ZYYd
E9NE1N?)^[YY]
d0d {(
t4VUC(
M3ZYYd
EMEM(^[YY]
SVW3Uh
d0d WU
Q EPUC
PtBN3ZYYd
M#(_^[YY]
SVW3Uh+
Q EPUC
PxM3ZYYd
ELELEL'_^[]
QDUEFL}
u3ZYYd
'^[YY]S
d2d"x1
PEf3ZYYd
IuS3Uh
d0d EPC P
PXjLf}
u\EKKPEBKPj
E7KPC P
P88LEP
'LEPC P
EPEJPC P
OEPEJPj
EJPC P
r=E3PC P
E,E/3E
JEIEIEI$[]
SV3Uh}
uO'2PEIPj
EIPC P
t2PC P
eJ3ZYYd
E@IE8IF$^[YY]
SVW3Uh>
uHcVEHPj
EHPC P
HEwH#_^[YY]U
d0d UZUgE3bhUu
i3ZYYd
Eo!Eg!E0"^[]
SV3Uh#
d0d UmU
E0"^[Y]
SVU3Uh
d0d UEPEU)]UMX
h3ZYYd
0EFEF!^[]
SVM3Uh@
d0d UEM
Q`3ZYYd
E}FEuF!^[]
d0d T/PUC EP
Pl:G3ZYYd
F#!^[Y]SV
E3ZYYd
( ^[Y]
O`SQTC P
_.PC P
PDPF^[
?.PC P
P<0F^[
.PC P
U3QQQQQS3Uh
d0d B<
uxEPEDPC P
uIEPE{DPj
EpDPC P
P qEEP
E3Uh]
d0d ;]
GE]|*G
Ou3ZYYd
Ep+E$f
d0d [<C8&
UUC`[+B3ZYYd
d0d {h
ShA3ZYYd
IuSVW3Uh#
@E3U?EPE
I^UMX8W
Chu@UE
@E3UfEPE
]UMX8W
tzU2EPE
v]UMX8W
0]pMX8W
H3ZYYd
Ed?E\?E
EL?ED?E<?E
E,?E$?E
E>E>E>
SV3Uhj$
d0d SPt"U
ESd;*t
IuMSVWU
E>3Uh&
d0d UC
ntBULEPEUZUMX0V
63ZYYd
Ej<Eb<E
ER<EJ<E
++E/<E'<5
_^[]7lfJ
SVW3Uh'
]U;]t)U
SVW3Uh'
d0d Cd3&u
VWK`Sd3ZYYd
U3QQQQQQQSV3Uh(
WUMX0V
SVW3Uh )
Q`3ZYYd
_^[YY]
E)9E!9/
[YY]Uj
SVM3Uht*
83ZYYd
EI8EA8O
R0t'~\
c3ZYYd
s8^,F(x7
Q4C@P?^[
UQSVWEE3Uh
d0d Ext
Q43ZYYd
E3Uh(.
tu3Uh-
_^[YY]
SVW3Uh.
d0d s<t
U3ZYYd
USUEUEEPhl-
DOMVendorDesc
d0d UD
d0d E@
3UEL}23Uhs0
d0d Ef
_^[YY]
UTF-16
UNICODE
IuQSE3Uh4
2E3Uh1
d0d EPEPUEF
@E3ZYYd
E@0f8u
EPE@0PU
E@4tL33
EPE@4PU
P4aE@`3
UR`OOuuuu
x/EPE8
%s%s%s: %d%s%s
C\-CH-CLy-CTq-3Ch3
SV3Uh5
C\,[Uj
SV3Uh6
Q43ZYYd
^[YY]U
IuSV3Uhk7
u1ES`KuuuuU
PKuuuu
UQEE@83
H(H,3Uh7
Q,3ZYYd
E@8UP,@(x7
S3UhB8
d0d C|;Cxt
UzCxC|3ZYYd
SV3Uh8
P$*3ZYYd
kE3Uh9
SV3Uh9
^[YY]U
d0d UZ
E+Ep(Ph;
version
standalone
encoding
<?xml
d0d UE
SV3Uh=
d0d {P
UCPU%3ZYYd
CT$Ph=
d0d Fd t<
Uf3ZYYd
U3QQQQQQQS3Uh:@
d0d Uy}
P k$CX
P$K$CX
P(+$CX
P(# H@
'Ec3ZYYd
SVWU3Uh@
d0d ChUCh
E8W|E3
u3ZYYd
]M3Uh;A
d0d EPU
Sl3ZYYd
Ez!^[YY]USV3
]M3UhA
Sp3ZYYd
!$^[YY]
USVWWE
3ZYYd
Ex _^[Y]
SV3UhB
E& 4^[Y]
C\ E PUr
d0d C\
23ZYYd
d0d EPU~EP
D ]3ZYYd
f|_^[Uj
SVW3UhwE
L_^[Y]U3QQQQSV
R$tHU!EU
u3ZYYd
U3QQQQQQSV3Uh
t(EPU`EU
Sd U<EU
SV;sPt
$PXZUj
S3Uh~H
IuQSVWu
6UMX8W
{6|MX0V
Q<EUVUE
j_^[]
U3QQQQQQQQSVW3UhK
d0d EPUE
f|X w)EP
d0d UE
TY3ZYYd
UUEEU~YE
IuQSVW3UhN
d0d UEU
]2UMX8W
IuMSVWM
t2FPEP
t(CVMUpP
U3ZYYd
version
encoding
standalone
d0d tSEPQ
version
encoding
standalone
IuMSVW
d0d Ef
E%EPEP
E%EPEP
UAEPEP
SX3ZYYd
E`_^[]
U3QQQQSV3UhQT
d0d E1.U
U3QQQQSV3UhT
d0d E-U3
q3ZYYd
U3QQQQSV3Uh1U
d0d EQ-U
J3ZYYd
ESchemaError@
ESchemaValidationW
ESchemaParse@
IXMLElementDefList|
XMLSchema
IXMLAttributeDefList|
XMLSchema
IXMLSchemaNode
XMLSchema
IXMLAnnotatedItemHX
XMLSchema
IXMLSchemaItemX
XMLSchema
IXMLTypeDefX
XMLSchema$
IXMLSchemaRefItemX
XMLSchema
IXMLTypedSchemaItem(Y
umD41J
XMLSchema
IXMLElementDefdY
XMLSchema
IXMLElementCompositorX
XMLSchema
IXMLElementGroup(Y
XMLSchema
IXMLAnnotationHX
m1JL[6
XMLSchema
IXMLSchemaDocRefs
XMLSchema
IXMLSchemaImportsZ
XMLSchema
IXMLSchemaIncludesZ
XMLSchema
IXMLSchemaItems
XMLSchema
IXMLSimpleTypeDefs@[
XMLSchema
IXMLComplexTypeDefs@[
XMLSchema
IXMLAttributeDefs@[
XMLSchema
IXMLElementDefs@[
XMLSchema
IXMLAttributeGroups@[
XMLSchema
IXMLElementGroups@[
XMLSchema
IXMLElementCompositors@[
XMLSchema
IXMLNotationDefs@[
JcIBCG
XMLSchema
IXMLAnnotationItems
XMLSchema
IXMLAppInfoCollection
XMLSchema
IXMLDocumentationCollection
|@,rmCS
XMLSchema
IXMLEnumerationCollection
XMLSchema
IXMLSchemaDef
XMLSchema
t;oo?to
qcqq+rr[t_tD$
TXMLAttributeDefList@
n/owoKq3r{rm
nrgnoo?ppgqrrD$
TXMLElementDefList
TXMLSchemaNode
TXMLSchemaItem@
TXMLSchemaDocRef
z]0B2_{
TXMLSchemaImport@
7?gs ?
d.:=@W
TXMLSchemaInclude
TXMLTypeDef
EI}!n~
TXMLSimpleTypeContent
e{Y'N7Xzc
TXMLSimpleTypeRestriction
TXMLSimpleTypeList
TXMLSimpleTypeUnion
9Avittu!
TXMLSimpleTypeDef$
IXMLComplexContentHX
XMLSchema
rop#{c
TXMLComplexContent@
TXMLBaseTypeIndicator
:|B~jjhhv"
TXMLComplexTypeDef@
@ Lg@8
$pp}{wyfcd
umD41JY
TXMLTypedSchemaItem
`@lc`X
Dllywsub
`` {}{yhe,||D$
TXMLAttributeDef@
}Thhusoq^$\\0wywuxa<xxD$
TXMLElementDef
3}GcO~}}}}z~G
ydoeCrCpsl{n3[X7Ys[v;t{r]t'uD$
TXMLElementCompositor
xW4U_(x{y_z(z@zXzyv\{{Pz0|\uxXPxHw
|u4aanlhjW
prpnXZ
TXMLAttributeGroup@
SQ4\tt(xu[vtvvv@vHswwv|xq
u,UtsPx0r]
^jh e(gSPQQ\l
ol(kVhmmD$
TXMLElementGroup
=PMXptYrmXusr
sro!tmt
st!nqQ
ptnYZigieacYPM]Nhkaig
SiMjD$
TXMLNotationDef
;MJUmqWokUspo
pol qkq
pq knN
mqkVWgdgb^`WMJ[Ke
PfKgD$
KI5Tul)pmSnunnnAnIkoon}pi
m-MlkQp1jU
Vb`!])_KQII]d
gd)cNieeD$
5to D?w}
TXMLAnnotationItem
HEPhwl/jCPKkjjjjgkCljleki{Ihgl
fQkR?_?]oYw[/HE3F`Wc7aw_Ja#bD$
m1JL[6
TXMLAnnotation@
'EBMeiCgWM_hgg
fFedicN
OS\SZVXCEBGC]k`K^\
H^7_D$
TXMLEnumeration
qq#qopCB?Jbf_dsJ{ed
e#eda'fsf
ef'`cC
bf`KLoYoWSU_B?c@Z]g[Y#E[S\D$
TXMLSchemaDocRefs
nlm/?<G_cKa_Ggbaa
`^c]HI[V[TPRK?<O=WsZSXV
BX?YD$
TXMLSchemaImports
okkjigj
D\s`+^?DG_^^^^[_?`^`Yg]w=\[`{ZEgF;S;QkMsO+<9/:TSW3UsS>U VD$
TXMLSchemaIncludes
WhhgfOg86gAY[]
['A/\[[[s[{X\'][]VOZ_:YX]cWBOC#P#NSJ[L
TXMLSchemaItems
+esed{c#d53;>{V/ZW=
Y{XXXGXOUYYXZS#W37VUWZ7T?#@LJ'G/I5W33cN
QN/M8oOOD$
TXMLSimpleTypeDefs
TXMLBuiltInTypes@
+^s^]{\#].,;7{O/SP6
R{QQQGQONRRQSL#P30ONWS7M8#9EC'@/B.W,,cG
JG/F1oHHD$
TXMLComplexTypeDefs
Z [WZ'YYw+3)3'LOM3N'N?NWNMJ[OOON/P[IL,OLGK
PI355B@<>+
DFDBW.
TXMLAttributeDefs
{WWVUsV
L7JK0SKJJJJGKKLJLEsI)HGLF1s2G?G=w9
;7(%;&@_C?A
?*A+BD$
TXMLElementDefs
;TTSR3S$"K-E?IF
HGGGWG_DH
IGIB3FC&EDgIGC.3/
:76?8$g""s= @=?<'
TXMLElementCompositors
P?QwPGOO!S
*GBEC)DGD_DwD
A{EEoDOF{?B"oBgA#F
@S++8624!# /:<:8w$;;;D$
TXMLAttributeGroups
?Bs@&A
A A7A@=;BB/A
C;<? /?'>B<
((53/1s
69{757!7g8D$
TXMLElementGroups
#;?O=c#k>==
;?9$%_2_0,.O
3w6W42
TXMLAnnotationCollection@
sGGFEkF
8w</:C K;::::7;C<:<5k9{
6!k"?/?-o)w+/
0W371w/
TXMLAppInfoCollection
[DDCBSC
38777w7
48+9792S6c
S ','*W&_(
-?0 ._,
|@,rmCS
TXMLDocumentationCollection
?AA@?7@
5444[4c15
646/73G
21k6K0
TXMLEnumerationCollection`
TAppInfoClassInfo
TAppInfoClassArray
XMLSchema
TXMLSchemaDef
bOK10B
TXMLSchemaDocx
TXMLSchemaDoc
XMLSchema
TXMLSchemaTranslator
TXMLSchemaTranslatorFactory@
Nu3_^[
U3QQQQQQSVWU3Uh
d0d Ej=
jEPETUX
Ku3ZYYd
EiEiEREiEiD_^[]&Q
IS~U3QQQQQQSVWU3Uh
d0d Ei=
iEPESUX
Ku3ZYYd
EhEhEQEhEhC_^[]&Q
SVW3UhM
h3ZYYd
EhhvC_^[Y]
SVW3Uh
Uh3ZYYd
C_^[Y]
IuSV3UhA
O3ZYYd
hUA^[]
U3QQQQQQSV3Uh
EL?E8HEe@^[]
SV3UhW
EnNl@^[Y]
U3QQQQSV3Uh
IuQSV3Uh
d0d 3Pu'E}UE
E3<PtL
uAU}EU
d3ZYYd
Eh=EcE
LEK=EcELE3=E+=>^[]
c[U3QQQQQQQQSVW3Uh
d0d {X
c3ZYYd
EbEN<EKEbEb=_^[]
IuSV3Uh
EJEZ;ER;E>D<^[]
SVW3Uh
d0d {\
8W8UC\
S\Ha3ZYYd
m1JL[6
d0d ~\
Q`F\\`3ZYYd
EG`U;^[Y]
d0d UeE
E_:^[Y]
d0d ES(t
E/_E7H5:[YY]PY9]~
U3QQQQSV3Uh
d0d M
|Ez3ZYYd
E%89^[]
d0d {h
u)UUEPMZQ
Sh8^3ZYYd
9^[YY]
U3QQQQSV3Uh
d0d Ey}M
r3ZYYd
E%78^[]
SVW3UhV
d0d s(t'
$3ZYYd
E>m7_^[Y]
U3QQQQQQQQSVW3Uh
d0d s(tA
`E3ZnEx{M0
q3ZYYd
>ED6_^[]
=D3ZYYd
6^[YY]
bounded
cardinality
SVWU3Uh
d0d ~h
QdEVhY3ZYYd
EYEY4_^[]
fractionalDigits
length
maxExclusive
maxInclusive
maxLength
minExclusive
minInclusive
minLength
numeric
ordered
pattern
totalDigits
whiteSpace
SVU3UhE
EPEUQAUMX
dE~1^[]
IuMSVWM3Uh
8W0E@UtDUE
SX9EPE
SlEPEUvM
SX3ZYYd
E.Ew>E_UE
@DEDUE<UED>E,U:0_^[]
bounded
cardinality
fractionalDigits
length
maxExclusive
maxInclusive
maxLength
minExclusive
minInclusive
minLength
numeric
ordered
pattern
totalDigits
whiteSpace
U3QQQQSV3UhP
d0d Md
8E63ZYYd
E+s-^[]
U3QQQQQQSV3Uh
d0d U?EM
EQE:EH+,^[]
pQ3ZYYd
,^[YY]
O`U3QQQQSV3Uh
d0d M$
xEv3ZYYd
E!*+^[]
U3QQQQQQSV3Uh
d0d UwEM
O`'~CL
O`U3QQQQSV3Uh
E3ZYYd
E('*^[]
U3QQQQQQSV3UhA
d0d UEM
UETnMT
M3ZYYd
ENE7E')^[]
S`PN^[
IuQSV3Uh
E7bEPU
5EKEKE
5EKEK&^[]
IuSV3Uh
EJE3E?$EJE3EJEJ%^[]
e{Y'N7Xzc
IuQMSVWU3Uh
d0d UF}
MNE3Z3ZYYd
E+EU2E=IE5IE-IE%IE
I+$_^[]
e{Y'N7Xzc
SV3Uh*
d0d UEM8
H3ZYYd
EHEH#^[YY]
e{Y'N7Xzc
d0d U{EM
lH3ZYYd
#^[YY]
EI}!n~
SV3UhD
e{Y'N7Xzc
#VU3QQQQSV3Uh
Ea !^[]
U3QQQQQQSV3Uhi
d0d UEM
UE,fM|
%3ZYYd
E\FEd/E Z!^[]
D$4T$
O`1~CL
O`U3QQQQQSVW3Uh
d0d {`
8W@UC`
CdyUEM
8W@UCh
UC`CCd
S`cC3ZYYd
E6CE.CE&CE
SV3Uh>
d0d U!E
SV3Uh
d0d UE
SV3Uh
d0d UyE
S3Uh3!
d0d {`
U"[d3ZYYd
d0d Q:
tZUwEU
t7U\EU
EPU8UX
@^d3ZYYd
E[)EC@E
$/E(@E @E
SV3Uh#
d0d UE#
U3QQQQQSV3Uhj$
d0d U4E|$
D$4T$
D$4D$0Pj
D$DT$@
IuQMSVMU3UhT(
d0d UE
@REPUE
@EY0V<EU
E0V<EUYujE
?E3Z3ZYYd
E#E#E:E#E:E:E#Eq:Ey#Ea:o
U3QQQQQQQQS3Uh4)
wEPEt)
extension
PUYXtYY]
SV3Uh*
IuSVWEE73Uh0,
TUME8W
o3ZYYd
E6E6E!
E6E6E6E6
d0d Exx
Ex&6UUE
URx53ZYYd
IuSVWEE
9E3ZVME4
E3E3E3E3E3
_^[]$~CL
d0d Ex|
UR|%33ZYYd
U3QQQQQQQSV3Uhc0
d0d UEM
UEGREPUM
SX3ZYYd
Ej2Eb2Ej
SV3Uh0
d0d U}
SV3Uhn1
d0d U)
IuSVW3Uh'3
EU>nUEK
{tDM<3
FEPU;EU
E/E/ER
E/E/E/E/E/E
S3Uhf4
d0d U:
EW.EO.]
Sp;.^[S
d0d E:
Q E;F t5UjEM|6
SlUFp6
D3ZYYd
EX,EP,EH,V
SV3Uh6
d0d UE
U3QQQQQQQQS3Uh7
d0d M7
EJEU3nE$3ZYYd
U3QQQQQQQQSV
d0d EIUEKM
{3ZYYd
d0d 8,
SV3Uh69
d0d UEMD9
)3ZYYd
IuQS3Uh4:
d0d UiE
tIU4EU
t"EkU
uCh(3ZYYd
IuQSVW3Uh$>
d0d U}
t,UUE8>
UCeUEP
EPUuEU
MU.U#EU
EU^dUEk
u{x(x|
UCh%{h
Sh%3ZYYd
xi%|^%EV%EN%EF%E>%E6%E.%E&%E
E$E$E$E
E$E$E$E:E&
E$E$E$E
umD41J
SV3Uh>
d0d UE
E#^[Y]
d0d t0U
y^[YY]
IuSV3Uh$@
z3ZYYd
DataType
d0d UEU
"3ZYYd
E!^[Y]%~CL
U3QQQQSV3UhA
d0d E1BMA
IuSV3UhB
d0d E3 @Uct"EWcU
%E_AMB
EEEE9^[]
IuSV3UhC
d0d E3'?Ubt"E_bU
-Eg@MC
EEEEA^[]
SV3UhD
d0d UE
SV3UhE
d0d U!E
O`U3QQQQQQQS3UhF
d0d tbE
33ZYYd
O`U3QQQQQSV3Uh%G
d0d U^
Y3ZYYd
U3QQQQSV3UhG
U3QQQQSV3UhH
d0d E=;MH
d0d UMU
^[Y]$~CL
O`$~CL
O`0~CL
O`)~CL
U3QQQQSV3UhDL
d0d E7MXL
:3ZYYd
U3QQQQSV3Uh
d0d E6M
v3ZYYd
SV3UhUN
d0d US}
n^[YY]
O`1~CL
SV3Uh=O
d0d Uk}
d0d UIU
D$,T$(
U3QQQQSVW3Uh
d0d {h
8W@UCh(R
SV3Uh~R
d0d UE
SV3UhR
d0d UE
SV3Uh&S
d0d U-E
SV3UhS
U3QQQQSV3UhtT
d0d E]/MT
U3QQQQSV3UhT
d0d E.MT
IuMSVWM3UhTW
d0d EPV
EP1ZK8
5to D?w}
|@,rmCSSV
U3QQQQSV3Uh<Y
d0d E*MPY
B3ZYYd
U3QQQQSV3UhY
d0d E)MY
SVM3UhxZ
j}USV3
]U3UhZ
z]0B2_{
SVM3Uh[
z]0B2_{
S UE \
z]0B2_{
]U3Uh\
2^[YY]
d.:=@W
SVM3Uh4]
d.:=@W
]M3Uh]
d.:=@W
S3Uh"^
d0d UpE4^
CpCxd3ZYYd
SV3Uh^
d0d {t
u[ES$t
SV3Uhh_
Ct3ZYYd
[^[Y]7lfJ
IuMSVWMU3Uh
UJ@EU3ZtpM
IuQMSVWMUE3Uhb
d0d UE
UeXt^EUb
@VUME8
*3ZYYd
EEEE_^[]
O`7lfJ
IuQMSVMUEu
d0d mUE
uRUE%EU
QDEMUYUf3ZYYd
E9E1E)E!E
EEEE]EE^[]
SVWM3Uhje
d0d EPU
ESE[Y_^[]Uj
SVM3Uhe
"3ZYYd
EEEE^[]
IuQSVW
d0d RtgUEEM
U9UEUESt
uEfEK|YC3U
FKu3ZYYd
EEnEfE^EfENEEEFE.E
_^[] ~CL
d2d"x(
EUD3ZYYd
Y]USV3
E03Uhh
SVU3Uhii
d0d MUU
u(U EU
E\ETELZ^[]
SVM3Uh
E5EE^[]
O`USV3
]M3Uhj
E5C^[YY]
E?EE_^[]
Q0"UE5EM
0V|ULErK|sC3UE
FKu3ZYYd
EEE`EEE
d0d UE
Q EqLu4m
U3QQQQQSV
d0d &Jt&UUEbEM
0V|E5YtiU
33ZYYd
IuQMSVMU3Uhp
d0d U|;U
Ust|EHt`
U#3ZYYd
EEEEEBEE^[]"~CL
O`USV3
EWe^[]
SVW3Uhr
A3ZYYd
E_^[Y]
SVW3Uh9s
E|_^[Y]
O`USV3
]M3Uhs
b3ZYYd
O`UQSVM]
]U3Uht
E4B^[YY]
O`USV3
SVW3Uhv
E,:_^[Y]
SVW3Uhv
E_^[Y]
O`USV3
]M3Uhhw
S UExw
EM[^[YY]
O`UQSVM]
SVW3Uh)x
E_^[Y]
O`USV3
O`USV3
]U3UhIy
Elz^[YY]
EYEQEIEAE
]M3UhL{
S UE\{
Eiw^[YY]
SVW3Uh{
U3ZYYd
d0d EP3
EDR_^[Y]
O`USV3
]M3Uh|
*3ZYYd
E^[YY]
SVM3Uh}
E5E-;^[]
SV3Uh}
O`USV3
]M3Uhd~
S UEt~
EQ_^[YY]
SVW3Uh~
=3ZYYd
E_^[Y]
SVW3Uh=
O`USVW3
E_^[YY]
O`USV3
]M3UhT
Eao^[YY]
SVW3Uh
M3ZYYd
SVW3Uh-
w3ZYYd
m1JL[6Uj
SVM3Uh8
m1JL[6USV3
b3ZYYd
m1JL[6Uj
5to D?w}
SVWMU3Uh"
d0d ;K|.C3M
tOEPjEPU
5to D?w}
SVM3Uh
B3ZYYd
EeEE^[]
5to D?w}
]M3UhP
Ees^[YY]
5to D?w}
S3ZYYd
SVM3Uh\
EEaEYg^[]
>3ZYYd
E^[YY]
SVU3Uhh
EM[^[]
23ZYYd
E^[YY]
SVM3Uh
EE=E5C^[]
O`(~CL
O`"~CL
O`'~CL
O`%~CL
O`1~CL
O`$~CL
O`0~CL
O`)~CL
O`m1JL[6OA
z]0B2_{
O`d.:=@W
SVWUL$
GxN|9F3
33ZYYd
U3QQQQQQSVW3Uh
d0d {\
PUzEPEPU
x)EPUC
kcVW~P
SVW3Uh
}3ZYYd
U3QQQQQQQQSV3UhA
jgEPEX
qualified
d0d E3
h3ZYYd
U3QQQQSV3Uh<
d0d MP
U3QQQQSV3Uh
d0d EM
f3ZYYd
IuMSVMUEE
d0d E3r
E@xN|4FE
ENu3ZYYd
SV3Uhx
d0d UaU
E=K^[Y]<hkN
bOK10B
IuMSVWM3Uh
E3ltSU
EMk!EPU%EMZ8
U^EM1!-UE3
!3ZYYd
EE_^[]S
EU\3ZYYd
[YY]2~CL
EwE_m[YY]
U3QQQQQQSV3Uhy
tXUoUEEU
EPU4UEY0V
EtE\EdE
ETE<J^[]
SV3Uhp
d0d U9U
EES^[Y]2~CL
SV3Uh/
t1EEU4EPES
t1E[EU<4EPES
TXMLSchema1999TranslatorFactory
TXMLSchema1999Translator
TXMLComplexTypeDef99@
TXMLSchemaDoc99
TXMLSchemaDoc99
XMLSchema99
SVW3Uh
d0d U+;E
K3p3ZYYd
IuQMSVWM3Uhd
1UMX8W
8WtEPUE
QHUXuAUE
QHEPUEu
E8WXFM
rEEnEfE^E
y_s_^[]
IuQMSVWMUE3UhK
d0d UE
E8WlMUE%M3
E8WtEPUE
^x_^[]
O`"~CL
IuMSVW
d0d EP
EPEURUMX8W
E3St4UE
t7EPUE
E'pt=|E
E8Wl#EPtE
Q,tE8WlMUEE
6EJE2E*E
O`$~CL
O`m1JL[6
IuMSVWM
d0d EP
E8WlUE
_3ZYYd
qEAE9G_^[]
SVW3UhV
`3ZYYd
EgE_m_^[YY]S
W3ZYYd
E3ZYYd
RV1N0:r
uYZ))v
| v;}
N|7 vU+A
SVjPjPj
PUc]_^[
ET~5EH
kGKu3ZYYd
_^[YY]
PEPE3Uh
t"EPEPQ
3ZYYd
_^[YY]
PWt;D$
SeDebugPrivilege
d0d EPEP
E3RPU3luhx
13ZYYd
IuQSVW3Uha
d0d ht
}EPW"5
URLMON.DLL
ImdaNg\ligdf
kernel32.dll
{{mkgzXfmxG
I{{mkgzXm|imzK
ImdaNqxgK
kmpMfa_
user32.dll
m|i|[qmC|mO
m|i|[qmCkfq{I|mO
shell32.dll
Im|}kmpMddm`[
Ifga|izmxGmdaN@[
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
%SystemRoot%\system32\CMD.EXE
SOFTWARE\Microsoft\Active Setup\Installed Components\{21E9C5D3-EBFF-11CD-B6FD-00AA00B4E22A}
StubPath
SOFTWARE\Microsoft\DBS
<3ZYYd
3RPU3M
_Share_DBS_
EcEPJ3ZYYd
;ECP$S
PfF$ffU
_EgPhU
PZ3ZYYd
\B{^[]
IuSVW}3Uhh
EPKUE(UE)
3RPU3u
3RPU3U
3RPU3UE
3RPU3WUE|uh
3RPU3UEuh
3RPU3sUE
PV3ZYYd
u[v=_^[]
z^cOvpenc
N~-Nv0W@W
N~0W@W1
N~0W@W2
N~0W@W3
N~0W@W4
N~0W@W5
/f&TleQ
U3QQQQQQQSVWUE}3Uh
RPU3MEU~E
A3ZYYd
<{s_^[]
Mz3ZYYd
*fE3UhE
E3ZYYd
EP~rE_^[YY]
IuQSVW}3Uh@
d0d 3Uh
d0d yC G
3RPEUZEUW
6EzuhX
uuU3uhd
uuU3uhp
uuU3uhd
uuU3suhp
uuU39uhd
uuU3!uhp
r3ZYYd
xp_^[]
d0d gwE
d0d W(
3RP3kh@
G 3RP3
3RP3h@
y3ZYYd
n3ZYYd
;kbo3ZYYd
MuE!um_^[]
;wExExEfE
Eskl^[]
TTCPClient@
oe^[USVWU3{
rf{ _^[YY]
SVWUQ3
uZ]_^[
SVWUQ3
uZ]_^[
i3ZYYd
d0d Ph
j9PPUo
rsrP}P)SVPu4T
ZoPUEoYgp
o3ZYYd
+me_^[]SV
d0d kj
3RP3eh
3RP3Fh
3RP3'h
Pn,3W$
"nWEP0
b3ZYYd
]jb_^[]
]E3Uh2
U'Uii?
ES|3ZYYd
EhaE_^[]
d0d dh
t3HtXHtz
u'3RP`3`
3RP\3\h
di3ZYYd
Windows NT
Windows 2000
Windows XP
Windows 03(Server)
Windows Vista
Windows 08(Server)
Windows 7
Windows 08_R2(Server)
Windows 8
Windows 12(Server)
Windows 8.1
Windows 12_R2(Server)
Windows 6.
(Server)
-64Bit
-32Bit
UMUEWSEM
r*EPEPEPM3
@C>EPEPEPM3
C"PC&PC*PK
C2PC6PC:PK.3
EPEPEPM3
C"PC&PC*PK
C2PC6PC:PK.3
r$EPEPEPM3
USVgPjP
UEUV P
EE3Em5
UQSVWUj
EPScPePE
_GB2312
U3QQQQSVWE3Uh
33RPU3uh
3RPU3uh
3RPU3uh
\c3ZYYd
_DX_^[]
SVt/Tet$
Shell_TrayWnd
U3QQQQQSVW3Uhx
< \uoEPE(`E
]cEbPwu@EbP]t
]KVE_^[]
K`3ZYYd
]U^[Y]
]]M3Uh
d0d h86
@EEJaP
HE^uh0
EPVE\`PSt
S3ZYYd
IuQSVWE3Uh
d0d h86
EA_T8E[U
_T8E[E
Q3ZYYd
d0d h86
d0d E5E]
EZE+E3ZYYd
!+Q3ZYYd
QE]USV3]
3X3ZYYd
OWO^[]
U3QQQQQQSVW5
EMZu=}
(UM_^[]
USVW3Uh
d0d EPj(:|PzEPh
EPqz3ZYYd
^JN_^[]
SeShutdownPrivilege
z]_^[U3QQQQQQSVW3Uh7
d0d UP
3RPU3[uEVUuE
VE"XPu6hP
V3ZYYd
SK_^[]
U3ZYYd
dRJ^[YY]
@echo off
if exist "
" goto loop
U3QQQQSV3UhB
d0d UP
@EFVPw
tXE1VPzj
VPSzt.;uu)Swj
x3ZYYd
d0d rP
S+UEPU/R
STP2wE}
3RXRTPw
QXMR:TPw
QRPEPu
EPu%G3ZYYd
DBS_Plugs\
BDX_Info
BDX_Starting
P3ZYYd
EM F^[Y]
US3E3Uh
d0d BvU
@P#vEPE
Ptq3Uh
d0d ERV
EPSEkRP
Ps3ZYYd
PrBEPs
P6s3ZYYd
P.r8B3ZYYd
PTIELIEOEOA^[]
UxSVW3x|3Uh
ft$~ }@~
ft#} }@~
PP2dUYf
H@Hu(C
PPcUpYf
PPcUHYf
%3ZYYd
/ERP|3|>PbERPx3
x>Pb33ZYYd
9;2_^[]
EPS^5T6
3RP3bh<
E3RP3*hH
63ZYYd
'3+^[]
13ZYYd
IuSE3UhX
d0d E0j
EPEPEPSPj
PEPE3Uh
EPEPet }
E@$3RP3
E@$3RP3
EPM0E+1E3ZYYd
0EE,fM
EPb&3ZYYd
2PEPE}
EP!EmEPj
EPEPFEPj
E2EPE$j
j3EPjEPE3ZYYd
EPEP$E^[]
d0d m+EP>0PVQ
GVPWEP1Qt3ZYYd
EPPy#3ZYYd
*Y#_^[]
d0d Ef*EP7/PSP
d0d 3E3E?
d0d EPj
EPEPEPEP<PEX
d0d E?
EPEPEPj
EPEPEPEPO
3RPU3Duh
uN|{F3u
,GNuFuN|&F3E
Un*E0uh
E3RPU3Huh
"+3ZYYd
3ZYYd
EPMe 3ZYYd
'6 _^[]
u_RegistryUj
SVW3Uh
d0d 3EEPj
d0d 3E
uE9PEPj
)PEPdK
)PEP/K
t)PEPJ
E3ZYYd
USVW3EEPh
d0d EPj
EPSEPj
VEPIu7EPSEPj
H(PEPIu
SVQT'PS"I
IZ^[SV
^[SVWQT'PSHu
USVMU]
E.'E&'3Uh#
d0d E"EPE
'PV~Hus3Uhb#
EPPEPj
E&PEPSHu
I$3ZYYd
PHuESV3
|||3Uh0&
EPEPEPG
EPEP~G3Uh
d0d E3
#|}{EPEPj
PEPHtl}
PEPH|P|
!|M3$|U"
GEPEEPE3ZYYd
EPEEPE
cmd /c
U3Uhu&
SZI[SVWV
S?I_^[
S&I[SVWV
SH[SVWV
U3Uh5(
TMainTypeUj
NEEv PxB
@ PBBj
SB3ZYYd
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
U3QQQQQSVW3Uh+
d0d 3Uh+
d0d U+
3RPU3Luh+
EPuuh+
@3ZYYd
^[U3QQQQSVU
d0d U-
USVW] }
u)3v u
d0d EPj
EwCEE]U
MUJ3ZYYd
tk3Uht/
d0d EPj
EBEE]U
IuSV3Uh1
EPP0;Ej
E3RP33h1
3E3RP3
P!3ZYYd
InstallTime
IuQSVW3Uh5U
d0d 3UhT
:3ZYYd
P93ZYYd
E}PEPE
@(Ht/E
EWvPEU
@(Yt j
EttZt j
E^sPEU
E_qZYt
fR Yq1
f@ PjUE
f@ PjDE
P!3UhJ
(Q3ZYYd
#RPD3hDhDV
w#RP@3h@hU
@ 3RP(3g(hU
3RP$3tg$hU
cPy PS
BPX P2 y
P3ZYYd
Ah3ZYYd
P*QA3ZYYd
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WinRAR.exe
SYSTEM32\
cmd.exe
[Stoping]
Desktop
Personal
Favorites
Progman
Button
Program Files\Internet Explorer\iexplore.exe
fDenyTSConnections
SYSTEM\CurrentControlSet\Control\Terminal Server
BDX_Start
DBS_Plugs\
BDX_Stop
U3Uh}W
TUoDFilesUSVWt
UQSVW3UhnY
t~3Uh=Y
p|3ZYYd
{3ZYYd
f3ZYYd
UQSVEj
E@ PE@
PSE(PE@
E@ PE@
PSE(PE@
PE(PE@
y3ZYYd
^[Y]UQSVEj
E@ PE@
E@ PE@
PE(PE@
PE(PE@
Rw3ZYYd
U3Uh=_
TVideoSpyUxSV3
|x3Uhb`
d0d L3j@EPj@EP3PtJ6|U@
u3ZYYd
d0d ErfE
tu3UhIa
d0d h8
PEPE03RP3Sha
EPzfEP
EPhvidc^
K3ZYYd
USVW3Uha
d0d =x6
1X_^[]
USVWMU
d2d"x6
PEPEPj
E3ZYYd
Uep_^[]
USVWUE3Uh@f
d0d E<
EB_^[YY]
3_^[SVW
t33D$ 3D$<D$
3D$,3D$0f`
USVWMUE
C$vidcCD
{ tKE3
MUC Yh
C PqEPC
@EE_^[]
PJC P)C
YUY2uG3
,]_^[USVWfM3Uhj
d0d 3E
fM+jtWj
YE_^[YY]
SVWU|$
N|<FT$
PD$ P26
D$ PWu-6
$ ]_^[
SVW<$6
SVWU<$6
d0d *n
u3ZYYd
hS3ZYYd
t>3Uhw
d0d EP
@E3ZYYd
EPEYY]
d0d EPh
St8EPh
E3ZYYd
EP4E[]
U3Uh5y
SYSTEM32\
PROGRAMFILES
t.tIr}
SYSTEM32\
userinit.exe
ipconfig.exe
Program Files\Internet Explorer\iexplore.exe
explorer.exe
:UyU?UeU+E8fF
E#8fF$UiU
U8E7U|U
d0d EP
Ov3ZYYd
WINDIR
SVWUWj
d0d ;]vdj
EPVEPEPMt0
EPEP/t
;]w3ZYYd
EPE^[]Uj
SVWU3Uhe
d0d E)N~)
UEECNu
U@QUEE3ZYYd
USVW3Uh
U3QQQQQQQQSVW3Uh
d0d 3Uhc
d0d EP
.3ZYYd
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ssr3)c:
U3QQQQQQQ3Uh
aL3ZYYd
WINDIR
Not Config
InstallTime
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
C3ZYYd
d0d E{EsEkEcE[ESEKECE;E3E+E#E
EEEEEEEEEEEE|xtpwllhadV`K\@X5T*P L
D@<840,($
StS\SF3ZYYd
Runtime error at 00000000
0123456789ABCDEF
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
jHqA}
kdzbeO\
iLA`rqg
@l2u\E
a=-fAv
\cQkkbal
eLXaMQ:t
jiCn4Fg
c;d>jm
i]Wbgeq6l
8ROggW
A`Ugn1yiFa
fo%6hRw
[&wowG
eibkaEl
`MGiIwn>Jj
)WTg#.zfJa
h]+o*7
b62S-+
ldEw}ZV
#SpxAaU
Faw$e
]]FD(koipvk19Z* ,
]qTp0ek*1u
%8<ysHj}
OyD~b-O
\H1EbnSwT]
p8$A#=keZ|%
3`*$?-
S)F~hwey?/H$6t
SKHRpey1~`|=6
xT9eK;
#AplAwG6
Aq[ZhwClZ
k1**yk
].*F6f
cTT"eM
g0&):{
pHkQ6Fzw]cN
#pAF]#
T~yUbL 8^#
TZ1ObbSy
OIV~P-{
~^eGnHl/Su6
?&~?$p
i;FBzw[keZ~7
FM8,9;
>R:<eP
^6o}765
3k$%1'[-&LMb#{'""
$!(x*
q-v,.7/pXqY
%w+OQvr
}!b|ty
z{.lD~m8onlk[wj
R1h58i
mcf+aQ`
"fig H
IN SKyuJcO
GN@E$DD2AsX
|P~Q9ZS [fYX4]
)\ZEo^m/_
s\<k2g
+O`]xW7
^'~*I@
@wm.B+
wJ1}05
/3vUuA?)C:|s
Wb27_k%8
e:ZO?(3w
H*0"ZOWoI
aLoD~Pf
g9x+ n
&;f?/X)T`D1
p'Hq/L0UEc?k
y7]P\@TN%s
'>$ !AxU
\3;Y^U~PG
(Q_V:1X:
^y9*O]#
kM`~b_R
z`rs"WG
&DAdQy/4
iLQ<6'5P..T&
\[YI>U!
]&nv|o
fq>,o,I
H>C-Yn
dj qHA
lVdkbze
^`Agqr<
@2lE\u
$/o|XhL
m=-dlc\
labe0b
-I|LeMaX:Q
mCij4ngF`D
Wh% of
mj>zjZ
gU1nFiyaf
\ebiak
IiGM>nw
TW)#gfz.aJ]h
1A26b+-Sdl
}wEVZOA
xpaA.U7
e]]DFok(vpi91k *Z
pTqke0*1
%y<8syjHA
}X*<yO
b~DO-T
E1HnbwS
$8p=#Aek|ZW
~F)ewh/?y6$H
*5KSRHyep`~1
Txe9;K"
lpwA6G-
hZ[CwZl
1k**kypH]
oF*.f6
TTcMe"
1wsHpQkzF6c]wN
O1ZbbySIO
P~V{-b
lHnuS/:
&??~p$i
BF;[wzek~ZS
zM8MF9,;
X7}o564
$k%'1&-[#bML"'{ "!$
*x(+ )`F(>
/7pqXs
|b!ytxB
{l.m~Do8nkljw[h1R
?a+f`Qeddf"
KS NJuyOcN
E@ND$A2D@
XsBI*C
Q~Z9[ SYfX]4\)
^oEZ_/m5
qs<\kg2z
V`a/6i\
A+Ox]`
-@mw+B.(
1J}50K_
3/uUv?A)
bW72%k_
OZw3(?
Qh+HZ"0*WO
X=#?X1
LDofP~V7
+xn ;&
f/?)XD`T
qHL/0cEUk?
r]7\PNT@%s
@>'! $UxA
3\Y;U^GP~
QV_:X1:
I)/NJ2"v
O*9y]#Mk
!10cV"aj
Fv#fu`z
cD&dA/yQA
5..P&T]q
?E v[\
A8n&]|vY
C>HnY-Qg
DBSCCP
GenuineIntelAuthenticAMD
kernel32.dll
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
CreateDirectoryA
ExitProcess
CreateThread
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
user32.dll
GetKeyboardType
LoadStringA
MessageBoxA
CharNextA
advapi32.dll
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
oleaut32.dll
SysFreeString
SysReAllocStringLen
SysAllocStringLen
kernel32.dll
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
advapi32.dll
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegEnumValueA
RegEnumKeyA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
GetUserNameA
AdjustTokenPrivileges
kernel32.dll
lstrlenW
lstrlenA
lstrcpyW
lstrcmpA
lstrcatW
WriteFile
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
UnmapViewOfFile
TerminateThread
TerminateProcess
SetThreadPriority
SetPriorityClass
SetFilePointer
SetFileAttributesA
SetEvent
SetErrorMode
SetEndOfFile
ResetEvent
ReleaseMutex
ReadFile
QueryDosDeviceA
PeekNamedPipe
OutputDebugStringA
OpenMutexA
OpenFileMappingA
MultiByteToWideChar
MoveFileA
MapViewOfFile
LockResource
LoadResource
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
GlobalUnlock
GlobalReAlloc
GlobalMemoryStatus
GlobalHandle
GlobalLock
GlobalFree
GlobalAlloc
GetVersionExA
GetTickCount
GetThreadPriority
GetThreadLocale
GetSystemTimeAsFileTime
GetStringTypeExA
GetStdHandle
GetProcessTimes
GetProcAddress
GetPriorityClass
GetModuleHandleA
GetModuleFileNameA
GetLogicalDriveStringsA
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileSize
GetExitCodeProcess
GetEnvironmentVariableA
GetDriveTypeA
GetDiskFreeSpaceExA
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetComputerNameA
GetCPInfo
GetACP
FreeResource
InterlockedIncrement
InterlockedDecrement
FreeLibrary
FormatMessageA
FindResourceA
FindNextFileA
FindFirstFileA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
ExitProcess
EnumCalendarInfoA
EnterCriticalSection
DeleteFileA
DeleteCriticalSection
CreateThread
CreatePipe
CreateMutexA
CreateFileMappingA
CreateFileA
CreateEventA
CreateDirectoryA
CompareStringA
CloseHandle
gdi32.dll
TextOutA
SetTextColor
SetBkMode
SelectObject
GetDIBits
DeleteObject
DeleteDC
CreateFontA
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
user32.dll
mouse_event
keybd_event
TranslateMessage
SwapMouseButton
ShowWindow
SetWindowTextA
SetThreadDesktop
SetRect
SetCursorPos
SendMessageA
ReleaseDC
PostMessageA
OpenInputDesktop
OpenClipboard
MessageBoxA
LoadStringA
IsWindowVisible
GetWindowThreadProcessId
GetWindowTextW
GetWindowTextA
GetUserObjectInformationA
GetThreadDesktop
GetSystemMetrics
GetSystemMenu
GetMessageA
GetForegroundWindow
GetDesktopWindow
GetCursorPos
GetClipboardData
FindWindowExA
FindWindowA
ExitWindowsEx
EnumWindows
EnableWindow
EnableMenuItem
DispatchMessageA
DestroyWindow
CloseDesktop
CloseClipboard
ClipCursor
CharNextA
CharToOemA
kernel32.dll
kernel32.dll
GetNativeSystemInfo
oleaut32.dll
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopyInd
VariantCopy
VariantClear
VariantInit
ole32.dll
CoCreateInstance
CoUninitialize
CoInitialize
oleaut32.dll
CreateErrorInfo
GetErrorInfo
SetErrorInfo
SysFreeString
shlwapi.dll
PathIsDirectoryA
PathFileExistsA
StrToIntA
StrCmpNIA
shlwapi.dll
PathFileExistsA
ws2_32.dll
WSAIoctl
WSAGetLastError
WSACleanup
WSAStartup
gethostbyname
socket
shutdown
setsockopt
connect
closesocket
PsAPI.DLL
GetProcessImageFileNameA
kernel32.dll
IsWow64Process
Module32First
Process32Next
CreateToolhelp32Snapshot
wininet.dll
InternetGetConnectedState
user32.DLL
BlockInput
advapi32.dll
StartServiceA
QueryServiceConfigA
OpenServiceA
OpenSCManagerA
DeleteService
ControlService
CloseServiceHandle
ChangeServiceConfigA
EnumServicesStatusExA
QueryServiceConfig2A
MSVFW32.DLL
ICCompressorFree
ICSeqCompressFrame
ICSeqCompressFrameEnd
ICSeqCompressFrameStart
ICSendMessage
ICClose
ICOpen
ICGetInfo
ICInfo
AVICAP32.dll
capCreateCaptureWindowA
capGetDriverDescriptionA
0(0@0T0`0p00000000000000$131u1y1}11111111111111
2 222:2B2J2R2Z2b2j2r2z22222222222222222
3"3*323:3B3J3R3Z3b3j3333333333
444{66>777+888;9J9j9
:;;;;;
< <6<<<J<_<x<~<<<<<<<<<<<<
='=1=;=E=O=b=p========
>N>o>y>>>0?P?t?
0091E1111111111@2H222
33333 4)4C4i4u4}444475@5P5X5^5g5n5s5|55555555
6 6,646U6d6t6666666*7^77777
8 8-83888888888889999
:a:g:o::::
;;;;;>>
?'?X?_??
y00111
202A2M24444
5/5F5[55,779
:&:.:D:\:j:~::::::
;;;h;q;;;;;
=.=7=i=p===!>*>H>Q>g>n>>>
;0c0j000000
12111111
2%222222
3'313;3C3I3W3r333333333
4`4i4n4444
1122E<<<>>>
+151I1a1h111"2)2=2[2d2p2w23
666*7S7z77E8g8s8z8888888888888
9!9+9R9g9x9999999
: :8:H:Y:j:v:{:::::::::::
;";*;2;:;B;J;R;Z;b;j;r;z;;;;;;;;;;;;;
<"<*<2<:<B<J<R<Z<b<j<r<z<<<<<<<<<<<<<<<<<
="=*=2=:=B=J=R=Z=b=j=r=z=================
>">*>2>:>B>J>R>Z>b>j>r>z>>>>>>>>>>>>>>>>>
?"?*?2?:?B?J?R?Z?b?j?r?z?????????????????
0"0*020:0B0J0R0Z0b0j0r0z00000
11H2r22:6l6~67::::
2227777===
1+1333
13*6C6677!899::
<<<==x>>
22236:::::::
;$;,;4;<;D;L;T;\;d;l;t;|;;;;;;;;;;;;;;;;;
<$<,<4<<<D<L<T<\<d<l<t<|<<<<<<<<<<<<<<<<<
=$=,=4=<=D=L=T=\=d=l=t=|==============
>$>,>0>4>8><>@>D>H>L>Z>l>>>>>>>>>>>>>>>>>
?$?D?L?P?T?X?\?`?d?h?l?|??????????????
040T0\0`0d0h0l0p0t0x0|0000000000000
1 1$1(1,1<1\1d1h1l1p1t1x1|111111111111111
2 2$2(2,2024282H2h2p2t2x2|222222222222222222
3 3$3(3,3034383<3@3P3p3x3|3333333333333333333
4(4044484<4@4D4H4L4P4d444444444444444444
5<5D5H5L5P5T5X5\5`5d5x555555555555555
6,6L6T6X6\6`6d6h6l6p6t6666666666666
7 7$7(7,707D7d7l7p7t7x7|77777777777777777
8 8-858P8p8x8|888888888888
9 9,909L9T9X9\9`9d9h9l9p9t99j>>>>
? ?+?8?=?????
000R222Z5o5z5666666
7!7%7)7-77
88a::::::
;A;\;`;d;h;l;<==
224566I7v77(8c8r88399998:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:];w;;;
<$<\<<<<==
>[>>>>>
?*?^??????
0=00 1122>3333B4c4v4~44444"55566L6Y6^6p66666)7{7777
878d88888
:Z;r;w;;;;;;
<I<<<<<<
=*=>=o=~====
>->>>>>
?3?N??
Z000000011
2 2)222|33D4[4}44444444
5S5q5555
77758G8[888
9&9B9r9y999999999999999999999
:!:*:6:;:D:M:V:_:h::::::::
;";L;f;;;;P<<<8=u=====??
+0Y0}00000000000
1.131C1M11111 262_2m22222222
313?3^3v3
333333
454W4f4v4~44444555555
6<6f6v666668~;;;
<;<\<`<d<h<l<p<t<x<|<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
= =$=(=,=0=4=8=<=@=H=L=T=X=`=d=l=p=x=|======================
> >$>,>0>8><>D>H>P>T>\>`>h>l>t>x>>>>>>>>>>>>>>>>>>>>>>>
? ?/?;?F?Z?e?o?z??????????????
0"0,060@0J0T0^0h0r0|0000000000
1C1a1111111p22
3-3=3M3Z3U4a444
5(5:5B5J5R5Z5b555
626h6u6666
7@7M7v7777
888m888
9M999999
:':-:2:=:C:H:S:Y:^:i:o:t:
::::::::::::::::::
; ;$;/;5;:;E;K;P;[;a;f;q;w;|;;;;;;;;;;;;;;;;;
=#=0=B=r=v=z===================
> >$><>T>X>l>>>>>>>>>>>>>>>
?4?T?\?`?d?h?l?p?t?x?|?????????????
0$0(0,0004080<0@0D0`000000000000000000
1,1L1T1X1\1`1d1h1l1p1t1111111111111
2 2$2(2,2024282<2@2`222222222222222222
3(3H3P3T3X3\3`3d3h3l3p333333;4J4a44444444
555555
6.66666
717@7W7f7}7777777
8'8>888
999G9V9m9;
0105090=0A0E0I0M0Q0U0Y0]0a0e0i0m0q0u0y0}00011
2!2;2d22222!3H3m3334444444444444444444
566.7p7777H8g8k8o8s8w8{8
88888888888888888P9::::::::::::::::::::::T;<<d===
> >$>(>,>0>=>}>>>
?!?+?b?????????
0N000Y111
2Z2s22
3+3/33373;3?3C3G3K3O3S3W3[3_3c3g3k3o3s3w3{3
4O5S5W5[5_5c5g5k5o5s5w5{5
5555555555
6U7y77$8^8w88
9"9&9*9.92969:9>9B9F9J9N9R9V9Z9^9b9q99999::::::::::::
; ;$;N;e;|;;a<<<0=r===$>(>,>0>4>8><>@>D>H>L>P>T>X>\>`>d>h>l>p>t>x>>>
0!0%0)0-0105090=0A0E0I0M0Q0U001111111111111111111111
2203T33:44444x5|5555555555555555555555C7G7K7O7S7W7[7_7c7g7k7o7s7w7{7
777777788G999.:G:`:::::::::
; ;$;(;,;0;4;H;o;;;;
<0<P<<<<<<<<
=!=%=)=-=1=5=9=D=X====
?2?H????
0X0u000001`1111111111111111111111
202;4?4C4G4K4O4S4W4[4_4c4g4k4o4s4w4{4
44444c666687U77777 8b8
88888888888888
9!9%979O9M;Q;U;Y;];a;e;i;m;q;u;y;};;;;;;;;;;u=
>">M>>
02&3Y3r3344+55A6
666W7775888V9n999
;!;%;);-;1;'<+</<3<7<;<?<C<G<K<O<S<[<<<<>>>>>
1"1&1*133
4%4B4n444
5"5=5E5`5b66666
7!7%7)7-7175797869J9x999r::::%;j;;
< <N<t>>>>2?I?\?n?
1-1B1G1T1t111e22222
4 4*4K4a4y4~4444444B5G5a55555555
636?6G6Q6V6[6`6e6k6p6u6{66666666666666
7 7(70787@7H7P7X7`7h7p7x777777777777788
;7;;:<<<<<<<
=L=P=T=X=\=`========E>????????
0&020:0B0J0R0Z0b0{00000000
1 141T1\1`1d1h1l1p1t1x1|1111111111111
2 2$2(2,2024282H2h2p2t2x2|222222222222222222
3 3$3(3,3034383<3@3P3p3x3|3333333333333333333
4$4,4044484<4@4D4H4L4d4444444444444444444
5$5D5L5P5T5X5\5`5d5h5l5|55\6`6d6h6l6p6t6x6|6666666666666666666
7(787D7H7P7T7X7\7`7d7h7l7p7t7x7|777777777
8$8(8,8084888<8@8D8H8L8P8T8X8\8`8d8h8l8p8t8x8|88888888888888888888888
9!9,9<9L9T9X9\9`9d9h9l9p9t9x9|999999999999999999999999999999999
:-:1:D:d:l:p:t:x:|:::::::::::::::::::::::
;,;L;T;X;\;`;d;h;l;p;t;x;|;;;;;;;;;;;;;;;;;;;;;;
<<<D<H<L<P<T<X<\<`<d<h<l<p<t<x<|<<<<<<<<<<<<<<<<<<<<<<
===========
>&>4>8>T>\>`>d>h>l>p>t>x>|>>>>>>>>>>>>>>>>>>>>>
? ?,?@?H?L?P?T?X?\?`?d?h?l?p?t?x?|????????
0"0&0*0B0^0l0p0x0|0000000000000000000000000
1 1$1(1,1014181<1@1D1H1L1P1T1X1h1x1|11111111
2$2D2L2P2T2X2\2`2d2h2l2222{44455@6E6~6666666
737@7M7_7d777777
88,9O9i9{9999:
;;;G<<<
=C=_==/>c>>>
?(?K?????
#0@0~000
1T1u1111&2c2222
3@3\33
4[4b4y44
54555x6666'7@77728;8I88
9P9v9999e::::*;E;
<K<<<i=
>3>b>x>>>
?+?o???
0R0w00000(11111l222
444445L5\66@7X7
8!8h8}9:::
;X;;;*<1<}===E>L>c>
0.0J0Q0\2h2|2222222222222222
4b444*5i5u5555
6'6l6q666667788
9]9b999(:\:y:V;-<4<X<<<7=P=e==>
2!2o22>3e3{3333e445
6 6165696=6A6E6
8+88888
909>9W99:::::c;;;;[<}<<<
=8=<=@=D=H=L=P=T=X=\=`=d=h=l=p=t=x=|=
Y00T1122t22v333333333333333333333334
505^55
6j6q66;77777A8Q88888
98999999999999999999999999+;2;I;
=,=]=g=w=}====>??
222Z3a35
7q7778B99/:>:n:s:::::::::
; ;);;;S;_;l;x;;;;;;;;;;;;;
< <(<0<8<@<H<P<X<`<h<p<x<<<<<<<<<<<<<<<<
= =(=0=8=G=S=`=r=x===============
>,>8>L>T>X>\>`>d>h>l>p>t>>>>(?e???
1r111"222=2B2M2R2]2b2m2r2}222;333=4J4]4r4y46%7S7\777c88888^99999:I;M;Q;U;Y;];a;e;i;m;q;u;y;};;;;;;
<#<-<2<=<F<U<i<w<<<<<<<<<<<<<
=$=.=5=:=@=H=c======
> >5>T>j>>>>>>
?*?0?P?X?\?`?d?h?l?p?t?x????????
0 0(0,0004080<0@0D0H0V0
2"2&2*2.22262:2>2B2F2J2N2R2V2Z2^2b2f2j2n2r2v2z2~222222222222
3$383@3D3H3L3P3T3X3\3`3n3v3~33333333
4(4044484<4@4D4H4L4P4^4444444
5*585<5D5X5`5d5h5l5p5t5x5|555
7"7&7*7.72767:7>7B7F7J7N7R7V7Z7^7b7f7j7n7r7v7z7~7777777777777777B9F9J9N9R9V9Z9^9b9f9j9n9r9v9z9~9999999999999999999
: :$:(:;;;;;;;;;
< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\<`<d<h<l<p<t<x<|<<<<<<<<<<<<<<<^>b>f>j>n>r>v>z>~>>>>>>>>>>>>>>>>>>>>>>>>>>>>
?,?4?8?<?@?D?H?L?P?T?
000000000000000000
1 1$1(1,1014181<1T1`1d11111111111
3"3&3*3.32363:3>3B3F3J3N3R3V3Z3^3b3f3j3n3r3v3z3~333333333333333333
4h5l5p5t5x5|5555555555555555555555555555
6(6064686<6@6D6H6L6P6^6f67777777777777777777777777
8"80848P8X8\8`8d8h8l8p8t8x899999999999999999999
: :8:D:H:d:l:p:t:x:|:::::;;;;;;;;;;;;;;;;;;;;;;;
< <,<0<L<T<X<\<`<d<h<l<p<t<====================
>">:>H>L>h>p>t>x>|>>>>>>???????????????????
020@0D0`0h0l0p0t0x0|00000
1,181<1X1`1d1h1l1p1t1x1|1111114444444444444444444
5 5$5(5,5054585<5@5D5H5L5P5T5X5\5`5d5h5l5p5t5x5|5555555555555555555555555555
686T6`6d666666666666666666666
7,7M7Q7|7777#8Q8c8r88888
9*9B99999
:9:K:Z:q:::B;Q;[;;;;/<m<<<
=`===o>)??
'000C111[22
3s337444r5555!6s66
9Z999::-;T;;
<i<<<?==
>>e???
?0d000_110222g33
444h55\66
9_99X:c:h:::x;;
=d==>>>
000g1111 2[2
3{33444
5p554666T77P888\9
:l:::^;;5<m<<<!=7====O>>
3I3333!4444(5358555y66`77>88 999R::6;;;t<<<=
>/>E>&??
400L11m223
4*4O4[4b4l4~4444444444444444
50585<5@5D5H5L5P5T5X5f5555555
626T6b666666/73787I7l7777777
8 8$8(888H8L8\8}888888888888888"9b9996:u:::S;;;;;;
<9<k<<<<<M=o=~===%>Y>>>>>???
0"070C0Q0`000000000000000 181\1x1111
2h2|2{333333
9'9.999C9N9`9t9x9|999999999999999999999999999999999
: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:::::::::::::::::::::::::::::::::
; ;$;(;,;0;4;8;>;F;)<-<1<5<9<=<A<E<I<M<Q<U<Y<]<a<e<i<m<q<u<y<}<<<<<<<<<<<<<<<<<<<
=(=G=T=p=x======
"0&0*0.02060:0>0B0F0J0N0R0V0Z0^0b0f0j0n0r0v0z0~000000000000000000000000000000000
1.1J1X1\1d1t1x111111111111111111111111
2333333333333333333
4"4&4*4.42464:4>4B4F4J4N4R4V4Z4^4b4f4j4n4r4v444444444444444444444
5&5D5557777777777
8"8&8*8.82868:8>8B8F8J8N8R8V8Z8^8b8f8j8n8r8v8z8~8888888888888888
9(9,94989<9@9D9H9L9P9T9X9\9`9d9h9l9p9t9x9|9999999999999999
:":4:F:J:Y:z:~:::::::::::
;2;6;:;>;P;u;;;;
<9<A<t<<<<<<<<<<<
=k>>>>?
5D5q5566
7p7777
:::|:::O;{;;;;
<9<<<<F=v===m>>>
0?1j111
2K222&3?3x3333C4"55
77<888c99
:H::7;;3<<<
>>>:?C???
1?1b11122E333 444f55q66C777
889991:i:::0;;;;f<<U=
>8>>p???
7000000011(2v2233
4F4o444
6K66666
7>7d888h99):f:::
;P;;;+<_<<<<<
==>>D???
H0|0000
2=2293
4X444#6,6o66j7s7777
8U8q888
:E:W:(;`;;;
<#<H<\<<(=<=====
>H>u>>>>h????
S0001}111
2w333364I4j44u555
6J6~66F7777
85888B9T9s999
:F::::::
;5;C;`;~;<<</=a====
>9>X>r>>>
0+0e00
1.1`111
202[22233
4+4Z44
5*5N5j55
6 6a666
;;)<R<k<~<G==G>>
000$1n1}111<2P2
4D4444$5 6+626=6G6R6\6g6q66666666666666666
70787<7@7D7H7L7P7T7X7p7777777777777
8"8H8\888888
9(9?9d9}99999
:.:T:h:::::
;@;U;x;;;;;
<,<A<d<}<<<<<
=2=X=q=====
>7>\>o>F?J?N?R?V?Z?^?b?f?j?n?r?v?z?~??????????????????
00000000000000
1 171D1H1d1l1p1t1x1|11111
3 3#3'3+3/33373;3?3C3G3K3O3S3W3[3_3c3g3k3o3s3w3{3
3333333333333333333
4 4$4(4,4044484<4@4#6'6+6/63676;6?6C6G6K6O6S6W6[6_6c6g6k6o6s6w6{6
66666666666666666666666666666666
7/7K7X7\7d7x777777777777777777777779999999999999999999999999
:!:%:):-:1:5:9:=:A:E:I:M:Q:U:Y:]:a:e:}::::::::::::::::::::::::
;<<<<<<<<<<<<<<
=!=%=)=-=1=5=9===A=E=I=M=Q=U=Y=]=a=e=i=m=q=u=y=}==================
> >$>(>,>????????
0 0#0'0+0/03070;0?0C0G0K0O0S0W0[0_0c0g0k0o0s0w0{0
000000000000000000
1 1$1(1,1014181<1@1D1=4A4E4I4M4Q4U4Y4]4a4e4i4m4q4u4y4}444444444444444444444444444444444
5!5%5)5-5155595=5A5E5I5M5Q5U5Y5]5a5e5i5m5q5u5y5}5555555555555555555
6 6$6(6,6064686<6@6D6H6V677777777777
8 8$8(8,8084888<8@8D8H8L8P8T8X8\8`8d8h8l8p8t8x8|8888888888888888888
9:::::::::::::::::::::::::
;!;%;);-;1;5;9;=;A;E;I;M;Q;i;x;|;;;;;;;;;;;;;;;;;;}=================================
>!>%>)>->1>5>M>\>`>|>>>>>>>>>>>>>>>>>
W0[0_0c0g0k0o0s0w0{0
000000000000000000000000000000000
1'14181@1T1\1`1d1h1l1p1t1x1|11111111144444444
5 5#5'5+5/53575;5?5C5G5K5O5S5W5[5_5c5g5k5o5s5w5{5
555555555555555555555555555555555
6 6#6'6+6/63676;6?6C6G6K6O6S6W6[6s66666666666666666666666666
9"9&9*9.92969:9>9B9F9J9N9R9V9Z9^9b9f9j9n9r9v9z9~99999999999999999999999999
:$:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:v:~:::%<)<-<1<5<9<=<A<E<I<M<Q<U<Y<]<a<e<i<m<q<u<y<}<<<<<<<<<<<<<<<<<<<<<<<<<
= =(=,=0=4=8=<=@=D=H=L=P=T=X=\=`=d=
00000000
1!1%1)1-1115191=1A1E1I1M1Q1U1Y1]1a1e1i1m1q1u1y1}111111111111111111111111111111111
2!2%2)2-2125292=2A2E2I2M2Q2U2Y2]2a2e2i2m2q2u2y2}2222222222222222222
3 3$3(3,3:3B3J3Y5]5a5e5i5m5q5u5y5}555555555555555555555555555555555
6!6%6)6-6165696=6A6Y6h6l6t6666666666666666666666679;9?9C9G9K9O9S9W9[9_9c9g9k9o9s9w9{9
999999999999999999999999999999999
: :#:':+:/:3:7:;:?:W:d:h::::::::::::::::::::::'=+=/=3=7=;=?=C=G=K=O=S=W=[=_=c=g=k=o=s=w={=
=================================
> >#>'>+>/>3>K>X>\>x>>>>>>>>>>>>>>>>>>>>>
00000000000000000000000
1 1#1'1+1/13171;1?1C1G1K1O1S1W1[1_1c1g1k1o1s1w1{1
1111111111111111111
2*222:2G4K4O4S4W4[4_4c4g4k4o4s4w4{4
444444444444444444444444444444444
5 5#5'5+5/5G5T5X5`5t5|55555555555555555555557
8!8%8)8-8185898=8A8E8I8M8Q8U8Y8]8a8e8i8m8q8u8y8}88888888888888888888888888888
9 949<9@9D9H9L9P9T9X9\9`9d9h9l9p9t9x9|99999;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
<!<%<)<-<1<5<9<=<A<E<I<M<Q<U<Y<]<u<<<<<<<<<<<<<<<<<<<<<<<<??
0!0%0)0-0105090=0A0E0I0M0Q0U0Y0]0a0e0i0m0q0u0y0}000000000000000000000000000000000
1!1%1)1-1115191=1A1E1I1M1Q1U1Y1]1a1e1}11111111111111111
23333333333333333333333
4 4#4'4+4/43474;4?4C4G4K4O4S4W4[4_4c4g4
4444444444444444444444
566666666666666666666666666
7!7%7)7-7175797=7A7E7I7M7e7t7x777777777777777777}999999999999999999999999999999999
:!:%:):-:1:5:9:=:U:d:h::::::::::::::::::::<<<<<<<<<<<<<<<<<<<<<<<<<<<<
=!=%=)=-=1=5=9===A=E=I=M=Q=U=Y=]=u======================????????????????????
0!0%0)0-0105090=0A0E0I0M0Q0U0Y0]0a0e0i0m0q0u0y0}000000000000000000
1222222222222222
3 3#3'3+3/33373;3?3C3G3K3O3S3W3[3_3c3g3k3o3s3w3{3
333333333333333333
4 4555
6!6%6)6-6165696=6A6E6I6M6Q6U6Y6]6a6e6i6m6q6u6y6}666666666666666666666666
7 7$7(7,7074787<7@7D7H7L7P7T7X7\7`79999999999999999999999
: :#:':+:/:3:7:;:?:C:G:K:O:S:W:[:_:c:g:k:o:s:w:{:
::::::::::::::::::
= =#='=+=/=3=7=;=?=C=G=K=O=S=W=[=_=c=g=k=o=s=w={=
========================
> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\>`>
I0M0Q0U0Y0]0a0e0i0m0q0u0y0}000000000000000000000000000000000
1!1%1)1A1P1T1p1x1|1111111111111111133333333333333333333333
4!4%4)4-4145494=4A4E4I4M4Q4U4Y4]4a4e4i4m4q4u4y4}444444444444444444
56666666
7!7%7)7-7175797=7A7E7I7M7Q7U7Y7]7a7e7i7m7q7u7y7}7777777777777777777
8 8$8(8,8084888<8@8D8H8L8':+:/:3:7:;:?:C:G:K:O:S:W:[:_:c:g:k:o:s:w:{:
:::::::::::::::::::::::::::::::::
;$;(;D;L;P;T;X;\;`;d;h;l;p;t;x;|;;;;;;i=m=q=u=y=}=================================
>!>%>)>->1>5>9>=>A>Y>h>l>>>>>>>>>>>>>>>>>>>>
000000000000000000000000000000
1 1#1'1+1/13171;1?1C1G1K1O1S1k1x1|111111111111111111113333333333333333333333
4 4#4'4+4/43474;4?4C4G4K4O4S4W4[4_4c4g4k4o4s4w44444444444444444444
5666666666666666
7!7%7)7-7175797=7A7E7I7M7Q7U7Y7]7a7e7i7m7q7u7y7}777777777777777777
8 899999999
:!:%:):-:1:5:9:=:A:E:I:M:Q:U:Y:]:a:e:i:m:q:u:y:}::::::::::::::::::
; ;$;(;,;0;4;8;<;\;{;;;;;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
? ?$?(?,?0?4?8?<?@?D?H?L?P?T?X?\?`?d?h?l?p?t?x?|????????????????????
0 0$020:0B0J0R0Z0b0j0r0z00000222222222222
3 3#3'3+3/33373;3?3C3G3K3O3S3W3[3_3c3g3k3o3s3w3{3
33333333333333333333
4 4$4(4,4044484<4@4D4H4L4X4\4`4t44444444
5 5(5,5054585<5@5D5H5L5Z5b555555555
6 646<6@6D6H6L6P6T6X6\6`6d6r6z6 7\777777777
8#8+8B8R8|888
9'9/9F9V9999
:.:@:~:::
;/;4;};;;;;
< <2<<<<<#=J=w====
>>>>D?U?x???
A0Z000
191I1_1q111
2a2222
323J3b3y3333Q44444G5O5[5d5555
6 6I66666
7M77777
8M8888888a9999
:I:y::::%;M;y;;
<6<<<&=9=Z====
>;>c>>>>>#?C?c?????
0%0C0000
2M222222
3c3q333
4$444444444g55<6O66!7S7e777~88
9>9[999
:Y:t:::::
;7;;;;
<8<L<<<<<<<<<<<<<
=2=<=C=I=a=Q>~>>>>>
010[0000
1&1162H2]2v2222
3k3333
4(4A4U4444444444
5A5J5Z5c55566h777788888
9%99999
::::9;~;;;s<<<!=f==
>'>z>>;?Q???
+0>0000
171a111f2y22T3~3333&4Q4>55555
6-6F666
7*7h7q7777K8888
9!9k999
;%;I;;
<-<c<y<<<1=>>>8?q?????
_0d000091g1
282Q2e22203I3]33333o4444/5c5~555
7=7V7777
8[8s88888=9H9P9X9`9h9v9~999999999
:%:+:C:M:T:Z:r::;;
<#<7<u<<<<<7=?=K=T===
>$>@>>>>>
?(????
30;0D0P0Y0b00000D11111G2q2222
3s3333
4;4S4g4444
5#5,555
7u777777I8P8V8n88
9/9i9999
:I:[::::6;m;
<H<e<<<
=l=====
>W>>>>+?;?[??
Y000h11
212r2633o4
5U55558662777
8L8i888
9L9999D:a:s::::
;:;K;i;;f<<<:=l=|===>
?!?H?p?y??
!0J0q000T1q111
2Q22222
3,3p333
484U4t444
5Z5w5555N6j6|6666,7I7[777
9<99999
;-;?;~;;;"<><R<d<<<<"=Y=k====(>E>W>>>>
?0?u????
050G00000
1 1[1x111
2p22222
5555-6?6666
7)7S7777
8Q8c88888888888
9#9+939;9C9K9S9[9r9y9
99999999999
:$:.:5:;:S:]:d:j:::::::::::::
>F>S>>>
?-?:?d?m??
0@0Q0_0001@2X222
3)323333
4?4}44
5/5s55556?7Y7k778888
9#9(9E9V:n:
; ;-;A;;D<<<7=Q=c==
>S>>????????????
0#080<0@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0000000000000000000000
1 1$1H1T1h1p1t1x1|111111111111111
2 2$2(2,2024282<2@2D2H2L2h2x222222222222222222222222222222
3%3)3R3m3333t44@5O555(66
8<8888
;m;;;d<<<====B>>>A?????
$0)09000071C1J1T1f1
111111111'232@2R2_2k2x2222222222
3 323?3K3X3j3r3z333333333Z56667Z7777b88888
9>9P9999999
: :;:A:I:e:k:s:::::::::
; ;<;B;O;
<<<<<<==
> >*>4>>>H>R>\>f>p>z>>>>>>>>>>>>
?:????????
0?0D0w0}00000011
2!2F2o222*3X33333333333'4,44494V4444444
5:5d5i55555555"6'6J6O66
92999:::::
;6;t;;;; <8<P<u<<<<<<.=====
>G>>>>>
?8?Q?}?????
V0k00000
111K1{111111111111111
2'242F2w33333333333333333s6
6666666666
9799999
:+:`::::,;F;e;t;;;;;%<W<c<p<<<<<)=:=K========
>5>A>_>w>>>>>
363Z3t333
44#5;5S5m5
66f77777777
8n8y888
9(9p9999Z:e:r:';w;;;;9<D<Q<<<<<~===5>r>z>>>>$?f?
0I0i0E1N1v11111%2u2222222222s33
4(44444 555555
6$6A6G6_66617=7X7n7{7777777738<8U8[8l8r888888888
9(9o99
:):Y:r::::::
;/;=;N;f;{;;;<<<<<<<
=#=.=C=N=c=n=========
>#>.>C>N>c>n>>>>>>>>>
?#?.?C?N?c?n?????????
0#0.0C0N0c0n000000000
1#1.1C1N1c1n111111111
2#2.2C2N2c2n222222222
3#3.3C3N3c3n333333333
4#4.4C4N4c4n444444444
5#5.5C5N5c5n555555555
6#6.6C6N6c6n666666666
7#7.7C7N7c7n777777777
8%848<8K8S8b8j8y8888888888
9.9C9Z99s;
1z111111
2P2\2i2?3K3R3d3v3~33333333333333
5555555
64696>6C6_66666
888<8@8D8H8L88'939@9R999
:<:Z:::
;;;;;;;(<<<<<<!=3=P=n=4>H>v>>>>>>>>>>>4?`?v???
000U1122T3r33333
4v4445
6W6c6p66667777777
8#808B8H8T8h8p8t8x8|8888888888888888
9$959<9I9P9`9g99999u:::::::
;6;L;Y;m;t;;A<U<<<<(=y==t>>
0 060W0x00000
1)1.151B1I1P1`1e1l11+292h2v22F33G4r44444444444
53575;5?5C5G5K5O5S5W5[5_5c55q6x66'7H7g7p7u7778v9;\<`<d<h<l<p<t<x<|<<<<<A>j?n?r?v?z?~?????
2h2&3o4444444
5"5&5*5.5?5u555
6-6;6l6q6666
7I7w777"8-8;8N8888
9,9;9C9R9d999999999$:2:?:h:::::~;
<4<V<x<}<<<<<<<<<<<<<==O=]=======
>!>%>)>->1>5>9>>>
?/????????????????
0'0>0Z0_00000000
1)1114222
3K3S3Z333333@4E4L4
444_7k7x7777777777777777s8888-9M99 <<>>>>
? ?+?8?J?P?p?x?|?????????
0.0M000!1;1{111113344?4445$6N6'79/::::::#;);.;C;M;U;g;{;;;;;;;;;;;
< <5<;<D<P<b<h<o<v<<<<<<<<<<<<<@=E=Q=V=g=m========
>%>-><>B>c>p>w>}>>>>>
?*?2?A?Y?i?}????????
050>0\0000000000
1 1*161?1m111111112L2X2`2k2s2222222a333333
414:4H4N4Y4a444444444444
5 5&5.5;5A5I5V5n5s5
5566666
7#7.7:7D7X7c7p777
888888888
9#909B9R99999
:8:?:D:W:^:c:z:::::;;;;;;;<
=$=;=E=g=q=======
>/>A>S>]>m>u>|>>>[??
0000S1{11111$222B2I2_2x2222222
363<3{3
4%4/4=4G4k444444444444
5D5P5w555555555
606<6P6]6j66666666666
7%7/7A7S7Y7j7t7~777778888888
9 9$9(9,9094989<9@9D9H9L9P9T9X9\9`9d9h9l9p9t9x9|999999999999999999999999999999999
: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:::::::::::::::::->
@0D0H0000000000000
1 1,181D1P1\188888
<<<<<<<<<<<<<<<
= =$=(=,=0=4=8=<=@=D=H=L=P=T=X=\=`=d=h=l============
> >(>0>8>@>H>P>??????????????
000408000000000000000000
1 1$1(1,10141$2(2,20242@2D2H222222222
3 3$3(3,3034383<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|333333333333333333333333333333333
4 4$4(4,4044484<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|444444444444444444444444444444444
5 5$5(5,5054585<5@5D5H5L5P5T5X5\5`5d5h5l5p5t5x5|555555555555555555555555555555555
6 6$6(6,6064686<6@6D6H6L6P6T6X6\6`6d6h6l6p6t6x6|6666666666666666666666666
(LB3e`L.hL"nJ
gL$YK4
F>2ZsN
#! (tR
,@EFL`x]
k.7CLeN)
lP'nN yH
H@2\`O4^M4]L4]L4]L4[J3UF0|JA3`
o'Jn?du
5Rgo!e
o&p+m+k+i+g+e+c+}`*|_*{_*z]*z]*|^*z^*UH1v
+48@tH
gN*hO*hO*hO*hN*fM*n>
51)BrM
$&&.CG.r
8`ms-vV
{;S\nqK
/.UvXI3
eO,+($4
{3Om{/]/
;[tSH8qOD5kA:0S%# +
988888t8zm~m{[JLt9:;:9nl{itm|gemZ[JLtzm~zm[W[JLt8tMPM&8zm~m[JLt9t8;t;908[JLt0180t9&8&8&?:9t0180t(t0180tkk&xka~&<:8:m~gdt0180t|mf&eim|%oo&|
f&:xat0180tkk&qi
fo&<:8:eim|oo
)MyServer
Pu_UpOrDownFiles
u_ReadCMD
4u_VideoSpy
KWindows
System
SysInit
UTypes
Fu_OtherFun
*ShellAPI
PublicPas
SysUtils
SysConst
XSFSock_Client
`XSFSock_Funs
yWinSock2
3Messages
uu_ScreenSpy
&u_CMD
zu_Registry
u_ServiceM
WinSvcAPI
u_Process
ShLwApi
sActiveX
(ShlObj
CommCtrl
RegStr
?WinInet
UrlMon
u_VarAndConst
u_Windows
u_FileManager
nu_FunProc
u_Tray
u_ShareAppInfo
1XMLDoc
XXMLSchema
|XMLSchemaTags
XMLConst
CVariants
$VarUtils
^Classes
"RTLConsts
QTypInfo
<xmldom
msxmldom
FComObj
qComConst
XMLIntf
vu_MemRunExe
XMLSchema99
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="requireAdministrator"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
j j j j j j j
s t r i n g
b o o l e a n
d e c i m a l
d o u b l e
d u r a t i o n
d a t e T i m e
g Y e a r M o n t h
g M o n t h D a y
g M o n t h
h e x B i n a r y
b a s e 6 4 B i n a r y
a n y U R I
N O T A T I O N
n o r m a l i z e d S t r i n g
l a n g u a g e
I D R E F S
E N T I T I E S
N M T O K E N
N M T O K E N S
N C N a m e
E N T I T Y
i n t e g e r
n o n P o s i t i v e I n t e g e r
n e g a t i v e I n t e g e r
n o n N e g a t i v e I n t e g e r
u n s i g n e d L o n g
u n s i g n e d I n t
u n s i g n e d S h o r t
u n s i g n e d B y t e
p o s i t i v e I n t e g e r
a n y S i m p l e T y p e
a n y T y p e
t i m e D u r a t i o n
b i n a r y
u r i R e f e r e n c e
t i m e I n s t a n t
r e c u r r i n g D a t e
r e c u r r i n g D a y
t i m e P e r i o d
r e c u r r i n g D u r a t i o n
c e n t u r y
e n c o d i n g
j j j j j j j j
x m l n s :
h t t p : / / w w w . w 3 . o r g / 2 0 0 0 / x m l n s /
j j j j j j j j
j j j j j j j
j j j j j j
S Y S T E M
h t t p : / / w w w . w 3 . o r g / 2 0 0 1 / X M L S c h e m a - i n s t a n c e
s c h e m a L o c a t i o n
n o N a m e s p a c e S c h e m a L o c a t i o n
j j j j j j j
h t t p : / / w w w . w 3 . o r g / 2 0 0 1 / X M L S c h e m a
a n n o t a t i o n
a n n o t a t i o n
a n n o t a t i o n
s c h e m a
s c h e m a L o c a t i o n
s c h e m a L o c a t i o n
a t t r i b u t e
a t t r i b u t e G r o u p
e n u m e r a t i o n
e n u m e r a t i o n
s i m p l e T y p e
i t e m T y p e
i t e m T y p e
s i m p l e T y p e
m e m b e r T y p e s
m e m b e r T y p e s
r e s t r i c t i o n
e n u m e r a t i o n
r e s t r i c t i o n
c h o i c e
s e q u e n c e
a t t r i b u t e
a t t r i b u t e G r o u p
c h o i c e
s e q u e n c e
r e s t r i c t i o n
e x t e n s i o n
c o m p l e x C o n t e n t
c o m p l e x C o n t e n t
c h o i c e
s e q u e n c e
a t t r i b u t e
a t t r i b u t e G r o u p
c o m p l e x C o n t e n t
s i m p l e C o n t e n t
e l e m e n t
e x t e n s i o n
r e s t r i c t i o n
d e r i v e d B y
c o m p l e x C o n t e n t
s i m p l e C o n t e n t
c o m p l e x C o n t e n t
s i m p l e C o n t e n t
e x t e n s i o n
r e s t r i c t i o n
d e r i v e d B y
a b s t r a c t
a b s t r a c t
s t r i n g
s i m p l e T y p e
d e f a u l t
d e f a u l t
s i m p l e T y p e
c o m p l e x T y p e
m a x O c c u r s
m a x O c c u r s
m i n O c c u r s
m i n O c c u r s
e l e m e n t
c h o i c e
s e q u e n c e
m a x O c c u r s
m a x O c c u r s
m i n O c c u r s
m i n O c c u r s
a t t r i b u t e
a t t r i b u t e G r o u p
a t t r i b u t e
a t t r i b u t e G r o u p
c h o i c e
s e q u e n c e
e l e m e n t
p u b l i c
s y s t e m
p u b l i c
s y s t e m
d o c u m e n t a t i o n
a p p i n f o
a p p i n f o
d o c u m e n t a t i o n
a p p i n f o
d o c u m e n t a t i o n
s o u r c e
s o u r c e
j j j j j j j
j j j j j j j
j j j j j j j
s c h e m a
j j j j j j j
j j j j j j j
s i m p l e T y p e
s i m p l e T y p e
h t t p : / / w w w . w 3 . o r g / 1 9 9 9 / X M L S c h e m a
h t t p : / / w w w . w 3 . o r g / 2 0 0 0 / 1 0 / X M L S c h e m a
h t t p : / / w w w . w 3 . o r g / 2 0 0 1 / X M L S c h e m a
u r - t y p e
s i m p l e T y p e
s i m p l e T y p e
j j j j j j j j
c o m p l e x T y p e
s i m p l e T y p e
c h o i c e
s e q u e n c e
j j j j j j j
j j j j j j j
j j j j j j j
a p p i n f o
j j j j j j j
j j j j j j j
j j j j j j
j j j j j j j
i m p o r t
i n c l u d e
a n n o t a t i o n
s i m p l e T y p e
c o m p l e x T y p e
e l e m e n t
a t t r i b u t e
a t t r i b u t e G r o u p
n o t a t i o n
h t t p : / / w w w . w 3 . o r g / 1 9 9 9 / X M L S c h e m a
s c h e m a T y p e s
s i m p l e T y p e
t a r g e t N a m e s p a c e
t a r g e t N a m e s p a c e
q u a l i f i e d
u n q u a l i f i e d
a t t r i b u t e F o r m D e f a u l t
a t t r i b u t e F o r m D e f a u l t
e l e m e n t F o r m D e f a u l t
e l e m e n t F o r m D e f a u l t
v e r s i o n
v e r s i o n
h t t p : / / w w w . w 3 . o r g / 2 0 0 1 / X M L S c h e m a
s c h e m a
h t t p : / / w w w . w 3 . o r g / 2 0 0 0 / 1 0 / X M L S c h e m a
h t t p : / / w w w . w 3 . o r g / 1 9 9 9 / X M L S c h e m a
s c h e m a
h t t p : / / w w w . w 3 . o r g / 1 9 9 9 / X M L S c h e m a
c o m p l e x T y p e
a n n o t a t i o n
s i m p l e T y p e
c o m p l e x C o n t e n t
s i m p l e C o n t e n t
e l e m e n t
h t t p : / / w w w . w 3 . o r g / 1 9 9 9 / X M L S c h e m a
c o m p l e x T y p e
h t t p : / / w w w . w 3 . o r g / 1 9 9 9 / X M L S c h e m a
s c h e m a
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
j j j j j j
] : ( P I D
[ M ~ e n u ]
[ M e ~ n u ]
[ B ~ a c k ]
[ B a ~ c k ]
[ B ~ a c k S ~ p a ~ c e ]
[ B ~ a c k ~ S p ~ a c e ]
[ T A ~ B ]
[ T ~ A B ]
[ C l e ~ a r ]
[ A ~ l t ]
[ S h i ~ f t ]
[ S h ~ i f t ]
[ P a ~ u s e B r e ~ a k ]
[ P a u ~ s e B r ~ e a k ]
[ C ~ T R L ]
[ W ~ I N ]
[ S ~ p a c e b a r ]
[ P r ~ i n t S c r e ~ e n ]
[ P r i n t S ~ c r e e n ]
[ I ~ n s e r t ]
[ D ~ e l e t e ]
[ H ~ o m e ]
[ P a g e ~ U p ]
[ P a g e u ~ U p ]
[ E ~ n d ]
[ E n ~ d ]
[ P a g e ~ D o w n ]
[ L e ~ f t ]
[ R i ~ g h t ]
[ D o ~ w n ]
[ D ~ o w n ]
[ N u ~ m L o c k ]
[ ~ N u m L o c k ]
[ S c ~ r o l l L o c k ]
[ E ~ n t e r ]
[ E ~ s c ]
[ F ~ 1 0 ]
[ F ~ 1 1 ]
[ F ~ 1 2 ]
j j j j j j j
j j j j j j j
D V C L A L
P A C K A G E I N F O
M A I N I C O N (
} { z w r m i
| v q m k m p _
| o e ` _ d l
} h Z U V _ i
f U O S ] j
e S O U ` l
! d U S Z f o
z d Z \ e n b
X o u y { | }
@ F a c e t s a n d E n u m e r a t i o n n o t a l l o w e d o n t h i s k i n d o f d a t a t y p e " % s " I n v a l i d b u i l t - i n t y p e n a m e " % s " * 1 9 9 9 X M L S c h e m a T r a n s l a t o r ( . x s d < - > . x s d )
O L E e r r o r % . 8 x . M e t h o d ' % s ' n o t s u p p o r t e d b y a u t o m a t i o n o b j e c t / V a r i a n t d o e s n o t r e f e r e n c e a n a u t o m a t i o n o b j e c t 7 D i s p a t c h m e t h o d s d o n o t s u p p o r t m o r e t h a n 6 4 p a r a m e t e r s
# I t e m T a g p r o p e r t y i s n o t i n i t i a l i z e d
N o d e i s r e a d o n l y C R e f r e s h i s o n l y s u p p o r t e d i f t h e F i l e N a m e o r X M L p r o p e r t i e s a r e s e t
F i l e N a m e c a n n o t b e b l a n k
L i n e * I n v a l i d o r u n s u p p o r t e d X M L S c h e m a d o c u m e n t 8 L o c a l t y p e d e c l a r a t i o n s c a n n o t h a v e a n a m e . E l e m e n t : % s
U n k n o w n d a t a t y p e " % s " ! I n v a l i d g r o u p d e c l a r a t i o n i n " % s "
M i s s i n g T y p e n a m e # I n v a l i d c o m p l e x t y p e d e r i v a t i o n : % s
N a m e n o t a l l o w e d o n a r e f i t e m ) G l o b a l s c h e a m i t e m s m a y n o t c o n t a i n a r e f
% s c a n n o t b e s e t o n a r e f i t e m : S e t t h e G r o u p R e f p r o p e r t y f o r t h e c m G r o u p R e f c o n t e n t m o d e l
C o n t e n t M o d e l n o t s e t
P r o p e r t y % s d o e s n o t e x i s t
S t r e a m w r i t e e r r o r ) " % s " D O M I m p l e m e n t a t i o n a l r e a d y r e g i s t e r e d
N o m a t c h i n g D O M V e n d o r : " % s " < S e l e c t e d D O M V e n d o r d o e s n o t s u p p o r t t h i s p r o p e r t y o r m e t h o d ; P r o p e r t y o r M e t h o d " % s " i s n o t s u p p o r t e d b y D O M V e n d o r " % s "
N o d e c a n n o t b e n u l l M i c r o s o f t M S X M L i s n o t i n s t a l l e d
N o a c t i v e d o c u m e n t
N o d e " % s " n o t f o u n d
I D O M N o d e r e q u i r e d . A t t r i b u t e s a r e n o t s u p p o r t e d o n t h i s n o d e t y p e
I n v a l i d n o d e t y p e + M i s m a t c h e d p a r a m a t e r s t o R e g i s t e r C h i l d N o d e s + E l e m e n t d o e s n o t c o n t a i n a s i n g l e t e x t n o d e 4 D O M I m p l e m e n t a t i o n d o e s n o t s u p p o r t I D O M P a r s e O p t i o n s
# A c o m p o n e n t n a m e d % s a l r e a d y e x i s t s % S t r i n g l i s t d o e s n o t a l l o w d u p l i c a t e s
C a n n o t c r e a t e f i l e " % s " . % s
C a n n o t o p e n f i l e " % s " . % s $ ' ' % s ' ' i s n o t a v a l i d c o m p o n e n t n a m e
I n v a l i d p r o p e r t y p a t h
I n v a l i d p r o p e r t y v a l u e L i s t c a p a c i t y o u t o f b o u n d s ( % d )
L i s t c o u n t o u t o f b o u n d s ( % d )
L i s t i n d e x o u t o f b o u n d s ( % d ) + O u t o f m e m o r y w h i l e e x p a n d i n g m e m o r y s t r e a m
E r r o r r e a d i n g % s % s % s : % s
S t r e a m r e a d e r r o r
P r o p e r t y i s r e a d - o n l y
% s . S e e k n o t i m p l e m e n t e d $ O p e r a t i o n n o t a l l o w e d o n s o r t e d l i s t
S u n d a y
M o n d a y
T u e s d a y
W e d n e s d a y
T h u r s d a y
F r i d a y
S a t u r d a y
A n c e s t o r f o r ' % s ' n o t f o u n d
C a n n o t a s s i g n a % s t o a % s
C l a s s % s n o t f o u n d % L i s t d o e s n o t a l l o w d u p l i c a t e s ( $ 0 % x )
J a n u a r y
F e b r u a r y
A u g u s t
S e p t e m b e r
O c t o b e r
N o v e m b e r
D e c e m b e r
E x c e p t i o n i n s a f e c a l l m e t h o d
% s ( % s , l i n e % d )
A b s t r a c t E r r o r ? A c c e s s v i o l a t i o n a t a d d r e s s % p i n m o d u l e ' % s ' . % s o f a d d r e s s % p
S y s t e m E r r o r . C o d e : % d .
% s A c a l l t o a n O S f u n c t i o n f a i l e d
) V a r i a n t o r s a f e a r r a y i n d e x o u t o f b o u n d s V a r i a n t o r s a f e a r r a y i s l o c k e d I n v a l i d v a r i a n t t y p e c o n v e r s i o n
I n v a l i d v a r i a n t o p e r a t i o n
I n v a l i d N U L L v a r i a n t o p e r a t i o n % I n v a l i d v a r i a n t o p e r a t i o n ( % s % . 8 x )
% s 5 C o u l d n o t c o n v e r t v a r i a n t o f t y p e ( % s ) i n t o t y p e ( % s ) = O v e r f l o w w h i l e c o n v e r t i n g v a r i a n t o f t y p e ( % s ) i n t o t y p e ( % s )
V a r i a n t o v e r f l o w
I n v a l i d a r g u m e n t
I n v a l i d v a r i a n t t y p e
O p e r a t i o n n o t s u p p o r t e d
U n e x p e c t e d v a r i a n t e r r o r
E x t e r n a l e x c e p t i o n % x
A s s e r t i o n f a i l e d
I n t e r f a c e n o t s u p p o r t e d
F l o a t i n g p o i n t u n d e r f l o w
I n v a l i d p o i n t e r o p e r a t i o n
I n v a l i d c l a s s t y p e c a s t 0 A c c e s s v i o l a t i o n a t a d d r e s s % p . % s o f a d d r e s s % p
A c c e s s v i o l a t i o n
S t a c k o v e r f l o w
C o n t r o l - C h i t
P r i v i l e g e d i n s t r u c t i o n ( E x c e p t i o n % s i n m o d u l e % s a t % p .
A p p l i c a t i o n E r r o r 1 F o r m a t ' % s ' i n v a l i d o r i n c o m p a t i b l e w i t h a r g u m e n t
N o a r g u m e n t f o r f o r m a t ' % s ' " V a r i a n t m e t h o d c a l l s n o t s u p p o r t e d
W r i t e $ E r r o r c r e a t i n g v a r i a n t o r s a f e a r r a y
! ' % s ' i s n o t a v a l i d i n t e g e r v a l u e
O u t o f m e m o r y
I / O e r r o r % d
F i l e n o t f o u n d
I n v a l i d f i l e n a m e
T o o m a n y o p e n f i l e s
F i l e a c c e s s d e n i e d
R e a d b e y o n d e n d o f f i l e
D i s k f u l l
I n v a l i d n u m e r i c i n p u t
D i v i s i o n b y z e r o
R a n g e c h e c k e r r o r
I n t e g e r o v e r f l o w I n v a l i d f l o a t i n g p o i n t o p e r a t i o n F l o a t i n g p o i n t d i v i s i o n b y z e r o
F l o a t i n g p o i n t o v e r f l o w
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 4 0 9 0 4 E 4
C o m p a n y N a m e
M i c r o s o f t C o r p o r a t i o n
F i l e D e s c r i p t i o n
M i c r o s o f t . N E T F r a m e w o r k 2 . 3 . 1 . 0
F i l e V e r s i o n
2 . 3 . 1 . 0
I n t e r n a l N a m e
L e g a l C o p y r i g h t
M i c r o s o f t C o r p o r a t i o n . A l l r i g h t s r e s e r v e d .
L e g a l T r a d e m a r k s
O r i g i n a l F i l e n a m e
P r o d u c t N a m e
P r o d u c t V e r s i o n
2 . 3 . 1 . 0
V a r F i l e I n f o
T r a n s l a t i o n
Process Tree
-
07a7e197d12b66f60cbe83fecf699d88ac5747a100eefa860b02cd1b4068c663.exe (1064)
"C:\Users\Administrator\AppData\Local\Temp\07a7e197d12b66f60cbe83fecf699d88ac5747a100eefa860b02cd1b4068c663.exe"
- cmd.exe (1852) cmd /c ""C:\Users\ADMINI~1\AppData\Local\Temp\Temp0.bat" "
- DBSever0.EXE (2112) C:\Windows\DBSever0.EXE
07a7e197d12b66f60cbe83fecf699d88ac5747a100eefa860b02cd1b4068c663.exe, PID: 1064, Parent PID: 2284
default registry file network process services synchronisation iexplore office pdf
Hosts
| IP |
|---|
| 114.114.114.114 |
| 47.88.148.135 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| ggteam2024.gnway.cc | A 47.88.148.135 | 47.88.148.135 |
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
| ip2.nwt.gg-team.net | ||
| love2024.vicp.cc | A 0.0.0.0 | 0.0.0.0 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 57665 | 114.114.114.114 | 53 |
| 192.168.56.101 | 51758 | 114.114.114.114 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | 96a296d224f285c6_dbsever0.kinf |
|---|---|
| Filepath | C:\Windows\DBSever0.KInf |
| Size | 2.0B |
| Processes | 2112 (DBSever0.EXE) |
| Type | data |
| MD5 | c4103f122d27677c9db144cae1394a66 |
| SHA1 | 1489f923c4dca729178b3e3233458550d8dddf29 |
| SHA256 | 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7 |
| CRC32 | 41D912FF |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 07a7e197d12b66f6_07a7e197d12b66f60cbe83fecf699d88ac5747a100eefa860b02cd1b4068c663.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\07a7e197d12b66f60cbe83fecf699d88ac5747a100eefa860b02cd1b4068c663.exe |
| Size | 465.2KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | 3d5c8222ee97db84db2bca14bfc0c378 |
| SHA1 | ae5540b2d634cef8d7e88d76aaa7ae4687a78bc9 |
| SHA256 | 07a7e197d12b66f60cbe83fecf699d88ac5747a100eefa860b02cd1b4068c663 |
| CRC32 | 85351D90 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 009a5ee4bfdfccc3_Temp0.bat |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\Temp0.bat |
| Size | 321.0B |
| Processes | 1064 (07a7e197d12b66f60cbe83fecf699d88ac5747a100eefa860b02cd1b4068c663.exe) 1852 (cmd.exe) |
| Type | DOS batch file, ASCII text, with CRLF line terminators |
| MD5 | 0b9a85265f44b64d94287f88081fd2cb |
| SHA1 | eb5b873f9da66a924d40f89a0727450fe8f88497 |
| SHA256 | 009a5ee4bfdfccc3b85d2aae2c5db673b70c13870f26438a5fe35314d9c97cd8 |
| CRC32 | 16670DA3 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 3b998cda227cd4a3_dbsever0.exe |
|---|---|
| Filepath | C:\Windows\DBSever0.EXE |
| Size | 473.5KB |
| Processes | 1064 (07a7e197d12b66f60cbe83fecf699d88ac5747a100eefa860b02cd1b4068c663.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | fa410d987b5485fe7d6427a0f141b0f7 |
| SHA1 | 28720a7ede449bdbcccbbb4f30daf94c962f6657 |
| SHA256 | 3b998cda227cd4a3851daf9f0a69c0e74aa862fbfabcaa125d51719fd7ab7b13 |
| CRC32 | D623E077 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.