2.6
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.70
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Agent-AXZD [Trj] | 20200420 | 18.4.3895.0 |
| Baidu | Win32.Trojan.Kryptik.ks | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200421 | 2013.8.14.323 |
| McAfee | GenericRXFL-UV!82779F0A2CA4 | 20200421 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b07678 | 20200421 | 1.0.0.1 |
静态指标
查询计算机名称
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545273.37475 GetComputerNameW |
computer_name:
TU-PC
|
success | 1 | 0 |
|
1727545275.936625 GetComputerNameW |
computer_name:
TU-PC
|
success | 1 | 0 |
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(1 个事件)
| section | .imports |
一个或多个进程崩溃
(22 个事件)
动态指标
分配可读-可写-可执行内存（通常用于自解压）
(2 个事件)
在 PE 资源中识别到外语
(12 个事件)
| name | RT_BITMAP | language | LANG_RUSSIAN | filetype | None | sublanguage | SUBLANG_RUSSIAN | offset | 0x000dc2e0 | size | 0x00000b28 | ||||||||||||||||||
| name | RT_ICON | language | LANG_RUSSIAN | filetype | None | sublanguage | SUBLANG_RUSSIAN | offset | 0x000e7894 | size | 0x000010a8 | ||||||||||||||||||
| name | RT_ICON | language | LANG_RUSSIAN | filetype | None | sublanguage | SUBLANG_RUSSIAN | offset | 0x000e7894 | size | 0x000010a8 | ||||||||||||||||||
| name | RT_ICON | language | LANG_RUSSIAN | filetype | None | sublanguage | SUBLANG_RUSSIAN | offset | 0x000e7894 | size | 0x000010a8 | ||||||||||||||||||
| name | RT_ICON | language | LANG_RUSSIAN | filetype | None | sublanguage | SUBLANG_RUSSIAN | offset | 0x000e7894 | size | 0x000010a8 | ||||||||||||||||||
| name | RT_ICON | language | LANG_RUSSIAN | filetype | None | sublanguage | SUBLANG_RUSSIAN | offset | 0x000e7894 | size | 0x000010a8 | ||||||||||||||||||
| name | RT_ICON | language | LANG_RUSSIAN | filetype | None | sublanguage | SUBLANG_RUSSIAN | offset | 0x000e7894 | size | 0x000010a8 | ||||||||||||||||||
| name | RT_DIALOG | language | LANG_RUSSIAN | filetype | None | sublanguage | SUBLANG_RUSSIAN | offset | 0x000e1cc8 | size | 0x00000096 | ||||||||||||||||||
| name | RT_GROUP_ICON | language | LANG_RUSSIAN | filetype | None | sublanguage | SUBLANG_RUSSIAN | offset | 0x000dd4d0 | size | 0x00000014 | ||||||||||||||||||
| name | RT_GROUP_ICON | language | LANG_RUSSIAN | filetype | None | sublanguage | SUBLANG_RUSSIAN | offset | 0x000dd4d0 | size | 0x00000014 | ||||||||||||||||||
| name | RT_VERSION | language | LANG_RUSSIAN | filetype | None | sublanguage | SUBLANG_RUSSIAN | offset | 0x000e8990 | size | 0x0000011c | ||||||||||||||||||
| name | RT_HTML | language | LANG_RUSSIAN | filetype | None | sublanguage | SUBLANG_RUSSIAN | offset | 0x000e1ca0 | size | 0x00000022 | ||||||||||||||||||
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\biwagox.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\biwagox.exe |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\biwagox.exe |
一个进程创建了一个隐藏窗口
(1 个事件)
可执行文件使用UPX压缩
(2 个事件)
| section | UPX0 | description | 节名称指示UPX | ||||||
| section | UPX1 | description | 节名称指示UPX | ||||||
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 61 个反病毒引擎识别为恶意
(50 out of 61 个事件)
| ALYac | Trojan.Upatre.ET |
| APEX | Malicious |
| AVG | Win32:Agent-AXZD [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.Upatre.ET |
| AhnLab-V3 | Downloader/Win32.Upatre.R231156 |
| Antiy-AVL | Trojan/Win32.TSGeneric |
| Arcabit | Trojan.Upatre.ET |
| Avast | Win32:Agent-AXZD [Trj] |
| Avira | TR/Dldr.Upatre.MX |
| Baidu | Win32.Trojan.Kryptik.ks |
| BitDefender | Trojan.Upatre.ET |
| BitDefenderTheta | Gen:NN.ZexaF.34106.lrZ@aqFiITkc |
| Bkav | W32.AIDetectVM.malware |
| ClamAV | Win.Downloader.Upatre-5744089-0 |
| Comodo | TrojWare.Win32.TrojanDownloader.Upatre.DLF@5t0aja |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.a2ca41 |
| Cylance | Unsafe |
| Cyren | W32/Nitol.R.gen!Eldorado |
| DrWeb | Trojan.Upatre.5834 |
| ESET-NOD32 | a variant of Win32/Kryptik.DQFN |
| Emsisoft | Trojan.Upatre.ET (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Nitol.R.gen!Eldorado |
| F-Secure | Trojan.TR/Dldr.Upatre.MX |
| FireEye | Generic.mg.82779f0a2ca41ffb |
| Fortinet | W32/Kryptik.DQBA!tr |
| GData | Trojan.Upatre.ET |
| Ikarus | Trojan.Upatre |
| Invincea | heuristic |
| Jiangmin | TrojanDownloader.Upatre.rnk |
| K7AntiVirus | Trojan ( 0049a84a1 ) |
| K7GW | Trojan ( 0049a84a1 ) |
| Kaspersky | Trojan-Downloader.Win32.Upatre.dmid |
| MAX | malware (ai score=85) |
| Malwarebytes | Trojan.Agent.MBF |
| MaxSecure | Trojan.Upatre.Gen |
| McAfee | GenericRXFL-UV!82779F0A2CA4 |
| McAfee-GW-Edition | BehavesLike.Win32.PWSZbot.tz |
| MicroWorld-eScan | Trojan.Upatre.ET |
| Microsoft | TrojanDownloader:Win32/Upatre.A |
| NANO-Antivirus | Trojan.Win32.Upatre.duciqm |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | QVM41.1.Malware.Gen |
| Rising | Worm.ServStart!8.10D (TFE:dGZlOgXif9ckj9ge1w) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Agent-BDRM |
| Symantec | SMG.Heur!gen |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2015-07-16 19:57:30
PE Imphash
080b979eabbabd1eb8c588088cbbead9
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| UPX0 | 0x00001000 | 0x000dd000 | 0x000dc600 | 0.4027725745921125 |
| UPX1 | 0x000de000 | 0x00006000 | 0x00005200 | 2.1573438562384837 |
| .rsrc | 0x000e4000 | 0x00005000 | 0x00004e00 | 5.515413836401483 |
| .imports | 0x000e9000 | 0x00001000 | 0x00000600 | 3.6902899509462124 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_BITMAP | 0x000dc2e0 | 0x00000b28 | LANG_RUSSIAN | SUBLANG_RUSSIAN | None |
| RT_ICON | 0x000e7894 | 0x000010a8 | LANG_RUSSIAN | SUBLANG_RUSSIAN | None |
| RT_ICON | 0x000e7894 | 0x000010a8 | LANG_RUSSIAN | SUBLANG_RUSSIAN | None |
| RT_ICON | 0x000e7894 | 0x000010a8 | LANG_RUSSIAN | SUBLANG_RUSSIAN | None |
| RT_ICON | 0x000e7894 | 0x000010a8 | LANG_RUSSIAN | SUBLANG_RUSSIAN | None |
| RT_ICON | 0x000e7894 | 0x000010a8 | LANG_RUSSIAN | SUBLANG_RUSSIAN | None |
| RT_ICON | 0x000e7894 | 0x000010a8 | LANG_RUSSIAN | SUBLANG_RUSSIAN | None |
| RT_DIALOG | 0x000e1cc8 | 0x00000096 | LANG_RUSSIAN | SUBLANG_RUSSIAN | None |
| RT_GROUP_ICON | 0x000dd4d0 | 0x00000014 | LANG_RUSSIAN | SUBLANG_RUSSIAN | None |
| RT_GROUP_ICON | 0x000dd4d0 | 0x00000014 | LANG_RUSSIAN | SUBLANG_RUSSIAN | None |
| RT_VERSION | 0x000e8990 | 0x0000011c | LANG_RUSSIAN | SUBLANG_RUSSIAN | None |
| RT_HTML | 0x000e1ca0 | 0x00000022 | LANG_RUSSIAN | SUBLANG_RUSSIAN | None |
Imports
Library KERNEL32.DLL:
• 0x40500c GetModuleHandleW
• 0x405010 InterlockedExchange
• 0x405014 GetFileAttributesA
• 0x405018 GetLastError
• 0x40501c GetCurrentThread
• 0x405020 VirtualFree
• 0x405024 GetModuleHandleA
• 0x405028 TerminateProcess
• 0x40502c GetProcAddress
• 0x405030 OpenEventW
• 0x405034 OpenEventA
• 0x405038 OpenSemaphoreW
• 0x40503c FindClose
• 0x405040 GetStringTypeA
• 0x405044 LCMapStringW
• 0x405048 LCMapStringA
• 0x40504c MultiByteToWideChar
• 0x405050 Sleep
• 0x405054 VirtualAlloc
• 0x405058 RemoveDirectoryA
• 0x40505c LoadLibraryA
• 0x405060 GetOEMCP
• 0x405064 GetACP
• 0x405068 GetCPInfo
• 0x40506c WriteFile
• 0x405070 GetStartupInfoA
• 0x405074 GetCommandLineA
• 0x405078 GetVersion
• 0x40507c ExitProcess
• 0x405080 HeapReAlloc
• 0x405084 HeapAlloc
• 0x405088 GetCurrentProcess
• 0x40508c HeapSize
• 0x405090 UnhandledExceptionFilter
• 0x405094 GetModuleFileNameA
• 0x405098 FreeEnvironmentStringsA
• 0x40509c FreeEnvironmentStringsW
• 0x4050a0 WideCharToMultiByte
• 0x4050a4 GetEnvironmentStrings
• 0x4050a8 GetEnvironmentStringsW
• 0x4050ac SetHandleCount
• 0x4050b0 GetStdHandle
• 0x4050b4 GetFileType
• 0x4050b8 HeapDestroy
• 0x4050bc HeapCreate
• 0x4050c0 HeapFree
• 0x4050c4 RtlUnwind
• 0x4050c8 GetStringTypeW
Library ole32.dll:
• 0x4050f0 CoUninitialize
Library WinSCard.dll:
• 0x4050e8 SCardForgetReaderW
Library WS2_32.dll:
• 0x4050e0 select
L!This program cannot be run in DOS mode.
P111Z.11-1.111Z.1
71Rich1
.imports
rtualAllocEx
7uygfhjgh4jg6h54j345874jhg
U,SVWE
_^[]U SVWE
MEiURh
EE_^[]UtSVWE
uu_^[]U
]U]%P@
DDDDDDDDDDDDDD
Yt$CH;r
PSWLSU
tACH;r
s^h p@
YYh(p@
Yu3Vt$
YtF>"u
< v^S39
PqY;5pM
8 t9UW
YE?=t"U<;Y
8 u]5<M
[UQQS39
EPEPSSWM
YEPEPE
@"t)t%
F8"uF@C
@C8"u,
VW333;u3
SS@SSPVSSD$4
t#SSUPt$$VSS
;t<8 t
u+@UY;u
3_^][YY
DSUVWh
_^][D3j
XUSVWUj
t.;t$$t(4v
VC20XC00U
]_^[]UL$
YY\WP\R
@Y<v)\P?
j?UIZ;
r;]uy;
;uY;]s
pD#U#ue
j #M_|
]#\D\D
VW3;u0DP
X_^[Vt$
t$VYVt
90tr0B= zA
@;vAA9
t7SWU
BBBu_[j
VPVPV5
@AA;rI3
tAt2t$
VWuBhi@
;tg5,P@
GIt%t)
Gt/KuD$
GKu[^D$
[^_UWVu
DDDDDDDDDDDDDD
^_Ujhi@
SVWe39=
"WWShi@
M]9}tfSuu
tMWWSuu
Mu;tVSuuu
3;u>EPj
EPVhi@
E;tc]<
e33M;t)uVu
runtime error
TLOSS error
SING error
DOMAIN error
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
abnormal program termination
- not enough space for environment
- not enough space for arguments
- floating point not loaded
Microsoft Visual C++ Runtime Library
Runtime Error!
Program:
<program name unknown>
GetLastActivePopup
GetActiveWindow
MessageBoxA
user32.dll
IZDS>L#E'>
~}|Awvu:~pon3xihg,rba`%l[ZY
N876H10/B*)((""!s
fz]sYlTe@^GW@P
{zy>tsr7mlk0fed)_^]"XWV
W<;:Q543K.-,E'&%q?
pF<i@Hb:J[4ET.?M($F"(?
vwwv;pppo4jiih-dbba&^\[Z XUTS
@987:2100}+*)nw$#"q
S[{MVtG]mAVf;
k}}|Aevvu:_oon3Yhhg,Saa`%MZZY
/776)00//r}njfba^Z
@ey:br4Mk.)d(;]"AV
Xyyx=Rrrq6Lkkj/Fddc(@]]\!:VVU
,,++njfb^ZAVsRwNsJ
h<]0ukM=dGG]A?V;-O53H/%A)|:#
Q?"ssrrqpoY|
_100.q
.$#"su
M>GJ|w}zy
8q:56hcf]#]
"TO=RY
2-K0''
qpodidUV[VTTS
BGB@@?
::9|.3.u
1+:)(s
yg5rak[
OCH=A7
|:1u3+on*e ["_
*W,)3ggffedca^]\]XWVUP
NKI8FED
5110++*z(&#
Dca_G4r+gj%i*
5.+7b{12,U'nN#
xxwwvut:aponmWtP(fJL
VUTS;ONM;KXFED>>==K987
>A/.-x
TO@IC|>9
dg"f a\B]
^|_]RMF
ssrdr&ggf-Pcba`
RRQYMe
B~G@vrk}1tc
ZSH\]g
Cd7q%96.+(
Sponejihx
GGFU@@?
z5mhiZ]`O|7V8ENt?7|y
:$+_fedcba`_^]\
~}|B]xwvu;Zqpon4gjihg-<ba`e:7\V
303A/.-p&u/)mDo
=B~G+@
`.ng\"p)m.j3[b-a
?97T41
fnml) `
m5sgYUvl[u#l+kQ
F<}3E<n
C)g"3k!#e
QeTM?}6ru0t5!2Vl52f
xwvvuts9onml2hgfe+a`_^$ZYXW
J54w0/.-p)('&i"! b
F?8q3k
FiS!{BI
{zyyxwv
{<6elkji^
A3%ICRA@
z w)0/.-p"
$#""]k
>C?wy<xAmp;
8W;0m3n
rWKV+*)(
mEiL@ua)g[)4
;R?N3f
*L<5u.p+o0j-i2d/c
rDczyxwa~Z2pTeNlR`C [XB7
5<;:9|
qspa#je
>-@nozCW
t-qqh+g0Da
vcevyx;^rqpbP,hgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-,+*)('&%$#"!
0%{z946@Q>A`
BHa=fi&X=TdY
TdYr`|&
9u| ,F0%3
9tk|, F@%
{[{|`M!.)~,b94}G+oM0
WqG</c
[Gf;sh-
-/R#:G%WN:`6
y7SLQ[
.S9Tc:
<,C!cck
s#8SQM4n#
BO._J%
6r:J%M4
F<C5RHP
hPbu-KL U341
nIKH+[t>
(4>&de`JCP\'
g8*O`v
4+.hr,
.tKH|wb
R;&PUKH,;
!s +Z/
yd=toD0%23
<(S%oK?A
czqTMs
Ec=t/8q!E
@g` vB
=AoZ(ba za
|@/BtW
D<_w^g*q|/h
qG1/4,K
\\4.Q5
wCX0.h
*]0.h1&
tF0.Q7
=[S|+g0%
SE/$=U8s/|
c_Aq G*X0
{Q5r*<s
2+s&>78
Z?K6xA97F\
G8~LF==3G
{3q\y/
/pgD/$
5[uN7D"
LQI4/.qRq
1T;{s^20%Q;Rq
}w_dwK.
uS5t,8
u( P/7
K`&9'Z
2|9tC:[+
4?yS"^1L
?{31?E
d?y#m+I/p
zTe[lL
7ttEs$
{>1:2F
twC~+CR 0jn>+C<BU^>f
{6-3Ul%$NG6F
mRB&~6
<Of'FGIB:B9B6O&(S
&O&>(Z
h(m.972z#,mID
:6|#NWt+
~B~-~FGIB:B96
_&~->NWQ
6~,&mID
Ns&.+%\
mRB&nv2
66Ofn'FGIB:B9:6Oh.S%
mRB&NyG6F)
)tB$O^U%
yGW?->WR
6>(OWR>6
Bs&.+%
FO&(FGIB:B9^
WQI>vJ~-T
|#NWt+
O8F&[d.G2
mRB&N><6O'
-B-NOWR
yGW?&-NZ
6PBN1E
U.3~&,
<0ts]|
Fvlhhup"F~
*$dhik|
SSTRT[TNQT\A
Y_^LM`A
?w{&cm!
y<t@Df
b#23650441354003/]
ret2wer3t1wer3twer42342X{V
GetModuleHandleW
InterlockedExchange
GetFileAttributesA
GetLastError
GetCurrentThread
VirtualFree
GetModuleHandleA
TerminateProcess
GetProcAddress
OpenEventW
OpenEventA
OpenSemaphoreW
FindClose
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
VirtualAlloc
RemoveDirectoryA
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
WriteFile
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapReAlloc
HeapAlloc
GetCurrentProcess
HeapSize
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
HeapFree
RtlUnwind
GetStringTypeW
CreateBitmap
SelectObject
CoUninitialize
LoadIconA
SetWindowPos
EnableWindow
SCardForgetReaderW
`.rdata
@.data
/A_!w_
^__j2 &91~
?#2wPa?
n>L#CR
\l7Rc^_i
;Jnn3M
PdWp?s
po|3{z
\.QqM4?
-?Rc4M4v4MM4
!&4M4,>Xq%M
Fvlhhup"F~
*$dhik|??e(
+-=>g/v
SSTRT[TNQT\A
Y_^LM`A
,z%H)J
?w{&cm!
y<t@Df
Vab#2365044135400
re"t2wer3t1
@GeMo*mduleHand
Intj(edExch
nvge&Fi
Attribu sAzPQ
e=TEEv
eg>Tn(lPr
2`OpMEvQW
SemaphxRC7wsfSTypdLCM&
ltiByToWideCSA
EryWo?a
nb<aYpl}
8ComnLne
sion8Ex
oUnhmtU/
Nam{ENHBQ's
O6@bIKZ,
w[;;$D:o{y
fCF}Rtlwi
(}8IcA4FP{(2q
/SC d+F5g,R
.telxt3@
`.Aaj .
k.&K\F
GPGWHUH{
XPTPSWXaD$j
xxy1q599
xSSy17
Fvlhhup"F~
*$dhik|
SSTRT[TNQT\A
Y_^LM`A
?w{&cm!
y<t@Df
b#23650441354003/]
$flEP}^e
sq * /
*8 0 / 1
ss"-#.
/"2#0 0
:D:D=KESCP8DAN@N7D?KDQ?L:G:F<H7B
0@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@mnf
@H9Cos@
z%.w}@
XaLTUd@
CQBU\chp?JAQFP@
+ZaOT~!,+:R`@
KX]hy]mRaYjyu,9
0<N+80?2D2D5C5CQ[@
CSZk#:Yh@
'>)>ly@
WkVi 9k{@
88HTh@
6$@Vc@
$@$,@
-@ 0@ 0@
"@U]Za[eZa[a[`Z_XcXbZ`[`Z^ZbZbZbZb[bZbZbZbZb[`[`
rss@+2@ #"0!-
&NTinn@+2@ $"-
$QXhp1>
)AItwlr=D
*gkU[%2
& .V^;88@.3@ #"( , (
#IR -#2 .}.9
'5>".!0 . -!.#3 .!-#0
~}rv}rusz}{
.3@ # *!0"1#0 -
bk)4 ."/
$3B#1&5#1"-$.!0!/#0#0
nsonso|} .3@ # '#5#5%9&4
&am?P -ek/?$6#5$8#5"2$8$6 -RZ
+0@ #'5%5"3#4!2
,S`cq#1#17?"/$5"1#4!2#4$5!0S_
+0@ #&2$6%9$8#4!1M\q~es#2"4bnKW(<#3&:'9&6%9$8&7!0U_
+0@ #(5&4*6'<#5
(MZo{clYc
23>'8)?+A%;':&7'=*@&:"1U_
.4@ #'4'4(.'9(;"1HUP]
+cq&8';';'<+0'9)>#1T_
/4@ $+:*<+:,?%9$5wXc(9gtXb&;#3Tc':(;(;+@,A*=*?(>\j
29@ $(8)?)?*@*?(>2F:J;K0@*=-B3G:J8K1B)?+A+<<Q9I8M:N2F+<*=->*;*=->+?$3\j
$*9"-!+*=(9'9
5M.EOaWbPZU`\nZkYgR^Q]TbZgZk\hXeUbXeVcXeVe[hZfVeQ[~
EgkcgkcflaenaemcikefkbenaenaenaenaenaenaenaenaenaenaenaenaenaenaenaenaE
:E/9qwj
BXntswj
9KjtxFX8Fouh
"7$4UhYmWiNXouj
@U'>mrh
F]":mrh
@XL`mrh
9V%;lsf
PVO78E (
4@zAN~BO~FR
CN~@N~BM~DO~BO~ETDR
ETCPBN
49/ ( '
()5QZ7D
#zvovnnviE!(
)r~4A\i4F
&"( /!6
/r|^q^n5C
-ES!4"7 4"8"8 4
!("+"+"7 3r}bp
/ 5#9$4#9
#,#,#:$:%=-ACR4C"60EAR:K!6#6DVCUAS$8$8$7#6%9 1
!3/J_q|}y{|
GDI32.dll
KERNEL32.DLL
ole32.dll
USER32.dll
WinSCard.dll
WS2_32.dll
CreateBitmap
ExitProcess
GetProcAddress
LoadLibraryA
VirtualProtect
CoUninitialize
LoadIconA
SCardForgetReaderW
KERNEL32.DLL
GetModuleHandleW
InterlockedExchange
GetFileAttributesA
GetLastError
GetCurrentThread
VirtualFree
GetModuleHandleA
TerminateProcess
GetProcAddress
OpenEventW
OpenEventA
OpenSemaphoreW
FindClose
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
VirtualAlloc
RemoveDirectoryA
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
WriteFile
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapReAlloc
HeapAlloc
GetCurrentProcess
HeapSize
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
HeapFree
RtlUnwind
GetStringTypeW
GDI32.dll
CreateBitmap
SelectObject
ole32.dll
CoUninitialize
USER32.dll
LoadIconA
SetWindowPos
EnableWindow
WinSCard.dll
SCardForgetReaderW
WS2_32.dll
L!This program cannot be run in DOS mode.
1bbbbb>bbbbbb~
bbbbUbbzbbRichb
7*@C'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz012345w6789+/htons
WS2_32.dll
KERNEL
CopyFileA_oclosesocketDVAPI'RegigerS
viceCtrlHan
6l\Ch-g
tnfig2sUnl=oOpenKey[v%S
t\0ValueEx
lSCMage
l rcN/
4ebQ1tH
8sd5RAQEd3NHkCRQLCgpDH@ VY9
D M',
FC P Xy H
}eMmpr
WNjAdd%nect)NULL#"%s"
\ipc${a
admin$\g1fd.exe#
VwA-{Xn C:.#D
" %d:
hAomzjc
Y63rootm
oi N'y
cacktXpb
9zOeQu
ac=la|.
$f\8h%u#OMSPEC
/c dp
coW gw
.lx-i3.c
SizeKteofRuKeg
"RIPTION\Sy
mVJq3(RlP)o7\0~MHz*k
sH-=Wi~CSF+
Fengn uDir
Ps3t>t
AJupdco!
GET$HTTP/1.1
-Ty=:
U]}-Ag=:Mozi^a/5/mo* (Xs; U
4$)Me/!08Mo(
fox/0m^kY
R"nZkq
tp:/,s:%;/
^&he-l
m8s @
IE b02Wdow
"#VR
?x-xbitp
/sh1wav
v.ms-q
po\B3>
HkR-Ll:uezhn
-En[dAg
Ke}^v0
65aQ"Y
W^&&m%$
.$0B!Dp
%3MM|U
UfYUEH
hFhD}ll
h"PjRs`g
#/3oz}]j
89]n664
dpB.y$H&d
yIvuDE<#9
3sYM9P
P fh`$o
9r$(08
9rPX`h#Gpx
i04iF8<f
iFHLPfTX
4#x4|8
RR;bVX[
=.ptJ^
=T}5}ri%
627S\$
HHuQt J
C}co<ANH
7K{Ou
[|}K9:g
-&P{{t
2is)rP
|rvB[0[11
'D4Rj!<p
7J4h?0
lH;VPS
Bv^=hzjS+m
)$ 1YlK
4c7=t<
<McElm<
wf]xt)0
%K\SS[GB6t/0
S)Olm}K
u!rlmron.dr[6l*URm
LDw.v]&
heJW2rA
`k#xd*]
b6m@:lHDT
Xt|xes.Y%
Vpud{ H;tlSD
%7 TUj
y!YX*@@NI!inX
VJm]v\SY
\.EM\CuZfrQsm
mlrlKk+
ics,,7\<l]1OH
9 *9E
6 eih&9nqlsib.f33i22.net+@vAZGi+E
n(G<yL 9
yY'8(,
"thU%q\
$h9 O^8[\+3"lAA8E
P S 4$
DD$J3Vc
h@aV?j
"`H#jds
Y#~L7C%.?(Q
p5d twH%F<$
3mn`t?\
h0L#8h4
'gePah`
|WcSSj
lCSWz<
SQd*Xvu
#8sXQ`ah
327YhYGeeYetLastNEro2r,
.RGeA.tC=i-iT
IZdKi&
reiateMu
lYuMr!
=s_r [
"]`s-h
_V=q\k
+-0V P,9V
(w`{{!W$
&e=BtpeO
`v,pT,T
@Muj*GAzJ
dulx,4"0S
yoI8]V<P
]`3#h0
*P l`|
.NC8-u6AhdhP
SXUuWoN@f;l
:LOfl{$#y
d3c41@
<fldHD1
u8mM=1
~2Y<Ao
TEM,\Cu,r0e,,nt
%$r4_$D%&wvvv't()*tg'Kp+,
0K.n/NnV
x<x<N=Fpb>
(@Xf;KAPB
\di2]0^_"Bp3`mVi
,sta:D999EFG84
jklR"mn
M7N01O
w\P SBu
u&1/fH
Q*)wXh`
v2]]dh]VM-!coB
:u1.(W
=#7i>nD?4
R<njl@
l,C8@T{E
8Bd;03
:8YUCE38;Y
hdU-`RY\
nfDR*U
?3<i\
5l^?6&6ml6R
FFFF8<@FFFDXNddd+/
ud=!D}/
H9hPF/6e$6
n0um>"u:F
in?F@C
28:<rlx2]\
I4 n#/>$n'(E
)3*p]+$,o-
/;0O41i#34567kv
Bom-Z;Q
~][W_D
<NK|@$X?h<
0Ix.VlVPin[
P't4-.
.R^`&o?lQVYOuj
3a'88'
HNR$elkxB}~^eW'
q.2|r~
fiois4g|"
V@%$W!
t@;S|KYlJ
7!8C3c5l
|{mlP|N2
s1tGfm @$P
M40(,$
LwtPKmW,Q
+Pmy@/L$DQ
#]SP*\d
`?h=8xZ4
HY3vcfZP%`
JBuC@k!
j,3Lp3
],!:.tg$|#&
`j3Qx/KC{
m:$m<8Dl,p"
4LP5<axI]R6
DrgM6u:wr45Q
B4&2x0:
;|Lu.{Nz
tNPu$V
1F;WMGu;)g;lL
[APkllQ8
K<5?d\
I&Urj>6(p@}X
?RVPU8[
DqK(#Vf")e9(
RI> g-
K'd"u$(7<u[tP
(Br(,K
(^-@|Q
2%X.:;
HS;+1!
uV1@5DQ9
X?]f'b
r;dEp4%FEm
J .Qpf>
Pq5* "fc$
Cu}pqt!^
\&amRx(
8.L7 $;*4
5rPLhJ.,r
BEP&LX
R0X6@=J(
L6G$ OK
wORB(0
67$p1U4
H22$;H}A
0xSE.@
\|mb8h
!HsTQxM}
1D`E]KWt\
!YV_SRM69
.`b$QPt
@0B[C]?
u^_o[3
B8t6Y8st
ThdPrioe
wb71Cla
$EnvPvi nm(Va
\5xeMu
WaVFiS
Obj"VPs
GbalF[
InfoMMA
aultUI*`!
`SATmpSepf8mM
>eModk
*Lraxo
nF:0Xr@d
en)sp)ch
apsp9/@
_c*m7f
__t_Ep_k
YjuHdh
??2@YAPAXI@Z3X
py1#F+0tHxo[tf
_hr3y:L
SHFNo4
;fy A8Fx48&H
skp|2]m
GPGWHU
XPTPSWXaD$j
6MIm:(.
KERNEL32.DLL
ADVAPI32.dll
iphlpapi.dll
MSVCRT.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
WS2_32.dll
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
OpenServiceA
GetIfTable
ShellExecuteA
SHDeleteKeyA
wsprintfA
R5(\I3A{w
7&2E00^
jihu7]X
7}!l# H[#Aj8l
)f1u3NV,XCZxUqdOx
Vn<5j~P
#j,YIOUnE[4i;.5(a]Q> 7,}m
~bWOB-o
c[3hwnZ.(y
s0(o-.@q
(|85&I
*??R#iv4kR6
5 T#V'
zrnl74^Y#e\F@[&
8\IF+Z?
Z$I!Y7*
85\lsz\R1V(
\C??!U
h*D$ "!3j@E
=#]k7+T
~m~^5E
pL"9 &$0HP4
`cqv-. *NF
F/biV[9
i{u:MjR2
>_uRo5
I|'9G$\L
EUm8`+B
xYERn1G"f
+)|!x3b+D5y,
Dc>b>^m}z@o.jkmWYr6RU&
U1fF)[]
(y4sYI|
~kAd-~1
G5yT4 K
6_r?(l7t{6u>c
Q3vC|#i
ap4V`I+-
D5=EM1s
{S0u;RR
|DrS.5|9
$%S~NnJ9
n>@^nUJN6-gaq+h2x#u
]q0iP-[%I
i2Tshh
v|OwHi
5~qu7AU1I`W)d]
pFH!'N>4L
Jl<j!ne{("%s
{i$>5<
YC=cGGp
//BCT'
< g!8H
4~~h>N
IB'<=@D$'
p=t7dJ
/,N'GSD
Dc12xA
yHftmk:
^QfoR|q
$`=*Ryg
+X_T8X7F2xpqvfvir
[\_Tia
3WfC16.
q^J?Q){C.b
Lvm9v}
f6e##AE\
pjEtC"
g**DW]
/!dcGi
YorrJl[
,ZX$_OQ
Bb0+Ebo:%-<$6eJ^IsmO
zE0zXtpaX8}m,H-
Go;pY8
4Z:NT7.:W
05We*u~g
y07q)Z4B1PY0DoH
?17YCq8H-Z@
x%/"Xj].mU!
b$Ti8c
"\[rrCQF
4mdLcG:=i
TM&>NE(
TO[zXhE+]z!`c
4AF?RvIgxmv
I]o0;<xUhM8]&
^3oS~qQH"x<AQ
P34rc6
v@[i6%s
ddSX[
De$Y%[ov
8 \l!UQ:jkW(o
5$\N6p
p&ARH7
Y/CI` M
7!_&He
sW-2Neh
S?f=`_
c7:l69
OBH6rvm9
&R+{mV/
TM1|XAN
HV,O4<]
a _i,eT
vC}fOI0
3V1SR
6jY&7Q'
~7v"-rs
tgt@M*Pb#a7
<US"2]
7{t6X!I0
&mV}`$=$
>iur#1
UYT7(_ A[
=Bb1UEw
G,(mKwv=E
6E3B:m_R
f3">r~9
'ah'-3U
xe_c`%B7;rB
1L8ZO8Fd-D
9Fr?Oe{
ov'8UwX/O>
/nBoEXA
.Hgn80"k
qd?Wk+
>g^V;au=
@+1\J7!Y
ZtJRLH\*
u=:~<.
Rtt{V$&
*wUtnB)B
]&?C0J)7mJ(_$W- h
^R]Oso{
)1Acx-"T-T
D5 gEiuO>.
]_*J[I
^E\K6Bui
sLBr=e]YW&
,/OVWucq
8C\wA;
Z}1v-XV*
je+{f>I
5/+lK=
@,#_4$+xv1WFI
m((;[K
k*~.9o
9V/@$D
&t~@*h_:
W[_{),(-=#]e*g\4@
+#R2+/+0
!_{-Mp
<6\bK+_"9vr
Y6z}F'
zh]6:FnP
xEd,Px#{O
Ee,&'gZHN'
cwYjx]F
spQ1/3
+GB1&vM
`p|NO#Jt
v2S@v_l
,EeU ;~:F;
>7BcG9JiL76s
/LbCR,
@(BO9/
Mr~=sq`OW!2;X
6hKS/*'R
?s:dKy
{2wJ'D
bO%e:_V%5
@Tg P'
[.aqO#_w.
;)UP8@m"tgO F
10HRiu
10dAs=
[?1PR>#
fVv+5<CWG0U"$ef PH\Uw:
5i(_WA?
3cl.R/e.
PQ`&w3+!W}_=Z&;v,,D5
?C&#~*=
a3Bu$YO
~v9yDb}
{^Tr#,9f
govT(q
VV#Wr#/Y1
m*HJT.2
<%AI=dXT6!
r z5N3GI
!"q@k5Qe&%
,A%!mI3#}/
zZZ;OX
;zbCDuPS=
t^8=v!
6#Gw[-/
ag6m>sj#-1
`:+:bK
(\Apz/
b'`}xm
BflC!8/I
.n|?1_
>ohj5Fv
#@!9>b>yg A4^^Z4u
9?W*zln
~c=)6kaj9
2}%Yf'
Ija9:AN
RD9wiN>Y
)Lw'ma
m|~LfVWYW
9r$y.d[nk
m^3h"fv
;zQB*zv
q*;]y1 L
YS`Gec
_T:ZjNz
( 7-}w iq8
Gf`SVhf%
IpN($OG
qk%Z?(i<
O\si_uyP\ZS#x
s J,(!
u ,U)+
e}2O7\>iB~I&
;FxT.[
-__N" PST_
Sv5LgNKH3,S)&ty&ux
'Hu<K"
I-P3|I
t`TD|T
xt,YBq0;z
UY> S}?TQ@l
!r(kh#P4R
0$u~ j5S
osHU,/Ui
fC)b2rIDI
Ymm?"[-
8h]`$cQ3[
'Vq=U@*${cqB
]Ff +w*uR
dlJ$5j
_V$|wPC&
#i_I-'`
to&}!F
tX\V+%&1
} -taY!3^5
jwh79~/
BB&5}][
V9}+g%
=Du#ND
ZUv"aQ{Z-
\~}$kP_Li
A`l1T"aD**
(9nd5Nt}l}zv
1u|K'5
s!Xb i
[oZgL*
q(:W;wyRK^
d?Gw/VOQ
+abrz@rgJRI
9#*z%WL5a#P2
ReWpwO
h}J;vF
a=Y"D@7fm$KwzsKGT
71y,>!3* H6}
yN#BRoN
's#i);
{~+%CA
"@iz<]n
U;<JdT
zMlg&%?bVe
9MRW3t-IP>|X{
AM7=W>^_E
o*E^?$7[
0DZl Y
3;A(>f
@d+SVE\
[?)7%I
+_$DErq-6$FpC"
e:(DS"icJ/y
6vE#(e
uL6 N,l
%;Ww>^B(gd
SsHl|;
3#vshhM*
#3#K9szY
8E{?O*fIE79nH_
8;fo]G
sPMn3I`oi`JO?
'c[IIk
HKKdUI~+
Qh?nTe"0
]S}V~/#h1*
9Q\HwU
+csui4''o@
GT@@Yl~
B% PNf
`OFv-_DsL|
^< >u;
AP*u@0S d_
PMtfQn[jA
xt?x+pBx=]
Q;1F"q
.]%=BM3
G;"%w-
dit$_4ya
G~of:L
\Uzz${
-zG;ym+
!;JyxI
[X]?m5>Fk5
g:)U1J9q wfrB
g}C=Wg
h:O9b2N
@!)CJos y:G{
$&f\E<v
'9u7og66
$10q e
R[&eOn L
gbyW> vq?
\5{`FX
b8]Of}x_N$A<K|Iw(-
j.;&OahlZqjvlyr
Alm)7Tq
Ao8|+v2
nRFiwSV`
e/L$I
nP{YyR
"v\o@w
7w~a$l
tmf~.Uq
!"I9}m%b+#>R5
(](L]r?x'Bb!
0NAlix.&VAgwCT
60;JN'=M8.l|l
chD``\n^
>uh{1b
bC8-iLx
1xQRby6
g[)6,PY k~w
8N2bU]l }n@xV7Tfw
~6onjG]!j>z}
Ut ;&UZe
q[kKGp6
mH*qkxPFd
vaUJ*"mN6
,@K1lB
*N3aO6>D
dRHG`JD
kDnb{c
d1z71Y7o'U
I9\hRaS(11_^e>UjhN
NY~u_SeC
FH6w$-
W-Lw:3-hMtJI:ox
E!dRb^n2-
o-nC8Bf|
xC_zm,3
?ax]"p+
DCFngf9z
fs~#)%GW@Ws26^i
tVHG&(5sN Z\
5E%%b{+
5C3!UcU
9V-x"Fo,!hK<kH0q
8mwAiJdTS
9cWTmc30w
RAjam0
E[-KWBPEOo
bh*r} Bl
PaU&o_4(zTZkfj
U|o0^vV
lU&RT\
Vh9'OVn7k
=Cfn;D
OD+;z*
w^A-~AxI_48a )56=FH
"HHK&b<s:+J4
i9JGP;wm28pC
_GZu@T=-Q[
^ANXUR@-
'r(o+E@&R.
$PLxG3tkA+
kNIJK,
mfN'k]
#3&JUT/
\.~r-6m`w;!*
FbV9lRDeS*!
!+ Aw+Ev2
7U| fHmuvDil
:1194~
{-QW\#j},
6UZbN=
{T!-,5[
o(e=Zyd
O/)G$
e>q(YN
(L=~ wc
mCM<xA
lY8rg!@G*L]Er Ub
B<@)aV6v2?
W wVi|i#&
1fiG`HG0Qr[k
ess+@n
cC'E>
A} { *s
Y:?u6tw-
#bvY.lZ}
MM1|kxt
[/VYHjP
q*gSmJ"x
7i I5n
.%5!5i|
;CtJk,
860jVAl
_>h``_w0|!100
_i<%4j
'w{\pG(
UT[J<pV
Wxq\_spo
Oi1wTr7Z*'m(N(qo
i\biSX[
ED<'Z#}z}Sy`
rHL BT
x[S=.]q[dB
WrDP7"pub'3-@?~
s$/P'LTN
|Qf2 ?
$D{QQeu|
]3@=dcH/?
-+AE}sRKeI
Hp.O((BMsb
=`%~[mK5
us1>e=xH52
f:;EG6Z0c
1U="rXN#R?2R
x,Fd3Bd&JP1L
z>JJ[j
8Dv]( w=
m@n]_T;w3!iE
6rZZlW
,:h<,>o
B ZAe15g
g.P37&f}
}[TrBV
G{rP0&+
qO.UX%[#
!H!<G\-a0
&-NZ?*d
P{k8#c
SH oAK
91^9sRqgh
:F1 "66J
VJ);_pp
U[F+JR
RD!K.&b\
)`'czfs
oG$d8hyJ'Z`tl
\i^skb2O
N-cox5\
N{!OrZud
S[8`yO
GS]gc^wL
$k=<b.
j2u#[w
[>%`s$
_9qt|^+?
n[FnASP`vn
Y)`$CG/7=i
;@Li#9x
n:yQC4u2&,]5Ogq>,
l*pS#gaLP
w?c%)fH|I
wwxZxaM
"*4p8RO
xB k!$T
N7(}Rw
+hvZH+
Fo>'\)l
)Q8]x0+
AQ:DI~H8Af)9
!z"k}N C
V+0@C1
A>UqtTP$
,0R2>pAap%*<4p
X+mj7e
mp]#bcdb4>
{wLXh"jO
S5Xrwe
L!This program cannot be run in DOS mode.
898k8k8Rich8
`.rdata
@.data
@.reloc
uEWuEV
_3^@[VP
BVMQuPu
VuVuh @
tVVVVh @
EV;t=\ @
0EPVVh(!@
_EPEPj u}
WEPj u
tVEPEPh
uEPuuu
WPh`!@
InternetOpenW
InternetConnectW
HttpOpenRequestW
InternetQueryOptionW
InternetSetOptionW
HttpSendRequestW
HttpQueryInfoW
InternetReadFile
WININET.dll
GetModuleHandleW
ExitProcess
HeapCreate
HeapAlloc
GetModuleFileNameW
GetTempPathW
CreateFileW
GetFileSize
lstrlenW
ReadFile
lstrcmpW
WriteFile
CloseHandle
DeleteFileW
GetCurrentDirectoryW
KERNEL32.dll
wsprintfW
USER32.dll
ShellExecuteW
SHELL32.dll
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
10>0L0R0t00000000
1N1u1~1111111
2!232F2M2T2j22222
3*313E3L3^3k3r3
L!This program cannot be run in DOS mode.
ADVAPI32.dll
KERNEL32.dll
NTDLL.DLL
USER32.dll
COMCTL32.dll
vwwwxw
|f|(|b_|)|1
||7|N|
|,|Q(|
|,|W|?
|))||=
|@z||Y|C|*|+|
|*|||]|
wwwRw`ww
w|wwkwwbww
description
EXPORT
IMPORT
shlwapi.dll
DllGetVersion
wab32res.dll
wab32.dll
Software\Microsoft\WAB
Software\Microsoft\WAB\DLLPath
WAB32.DLL
WABOpen
MailSupport
Software\Microsoft\Office\8.0\Outlook\Setup
Import
Export
CorExitProcess
mscoree.dll
runtime error
TLOSS error
SING error
DOMAIN error
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
This application has requested the Runtime to terminate it in an unusual way.
Please contact the application's support team for more information.
- not enough space for environment
- not enough space for arguments
- floating point not loaded
Microsoft Visual C++ Runtime Library
Runtime Error!
Program:
<program name unknown>
GetProcessWindowStation
GetUserObjectInformationA
GetLastActivePopup
GetActiveWindow
MessageBoxA
user32.dll
grC|"))
wabmig.pdb
u<ME_^[
WEPEPEPj
t(MQPEPj
3PPPEP
ujPPPSh
P3PQPPPh
3@M_^x
u8EPEPEPVh<
UQS39]
;t^;W=
SSSSSSSPSSS
3SSSSPP
uVP@Pj@
@:u+@PPQ
HHth39
W;t,W=
3SPfShY
HHte39
3SP}ShY
Wffffff
YY]j`h
+SVWEePEEEEd
Y_^[QVC20XC00U
33333]^]
]_^[]UL$
UV3F95l
3^YY[]
3BYY[]
SVEW3;
@u+@<v)P
<"u>"u
3Y[^_5L
@B8\t8"u&
UQQSVW39=
W33;u.
;tuf9 t
SSS+S@PWSSE;
;YEt!SSuPuWSS
;rSVWEP
3]3@]=
u8WW3FVh4
YE;t@E
t!SS9]
E;tWWu
EPSu u5
USVWUj
P(RP$R
UPjhXO
t5|$(t
;t$(v(4v
UQPXY]Y[
EtVMf9MZ
GIt%t)
Gt/KuD$
GKu[^D$
Wj@3Y`
VPVPV5@
@;rD3Ar
@;rM^K
3G9}5d
@;vAAy
W3;u4DP
WI <}}
MLD3#um
#Mj _^{
;]r;]u&
]#\D\D
39}t WWu
tjEEb9}u
WWWWVSWu
;tG3Vj
YYE;t43WWVPVSWu
UDSVWj
u5EP3GWh4
3@]3]UWVu
DDDDDDDDDDDDDD
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
RegEnumKeyExA
RegQueryInfoKeyA
ADVAPI32.dll
LocalFree
LocalAlloc
lstrcpynA
GetFileAttributesA
ExpandEnvironmentStringsA
LoadLibraryA
lstrlenA
FreeLibrary
GetProcAddress
FormatMessageA
lstrcmpiA
GetLastError
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoA
GetCommandLineA
GetVersionExA
ExitProcess
GetModuleHandleA
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
LCMapStringA
MultiByteToWideChar
LCMapStringW
RtlUnwind
InterlockedExchange
VirtualQuery
GetACP
GetOEMCP
GetCPInfo
HeapAlloc
VirtualAlloc
HeapReAlloc
GetLocaleInfoA
VirtualProtect
GetSystemInfo
GetStringTypeA
GetStringTypeW
KERNEL32.dll
DispatchMessageA
TranslateMessage
PeekMessageA
SendMessageA
ShowWindow
GetDlgItem
SetDlgItemTextA
LoadStringA
MessageBoxA
DialogBoxParamA
EndDialog
SetWindowLongA
IsDlgButtonChecked
GetWindowLongA
EnableWindow
DefWindowProcA
IsWindowEnabled
PostMessageA
USER32.dll
COMCTL32.dll
""""""p
""""""pp""""""""pp""p''/'/p""rrr
pp''/'
xx'''rrrx'/
;^A[1}
;E1:;h
nz^% r2
k][TDC?3
fT"-\N78
7 p(O1w*
) `s `y
ccs:'fw
60oF$8
K$-S)r]
so J'G{c
PJ-c{D
oZKpI~6<]Lu1Z
&=sGS{4I6&M
3PV:ku
y}Lz0k,AUI
MZd.l]
k:~$7M
O"1?]&Y
4F%XxO
zd9r/,J>%hSJ
tL*G'%=H
I$#xVMzHS
SaFJ&M\|`_I
?uvzvB
RAPF-c8ny;"N,c
LaqWMp?
;30iwmU.
y:00"%
BPW-cC};Bg'^
#Z=OEhw)q
Uu9jw
B@G6t)(
mDzn,{1
RAPF-c8l;" g
w#YxOEb`'V
H|2a0&Md
43ji_^U
B@G6t)(
mDzn,{1
RAPF-c8l;" g
w#YxOEb`'V
H|2a0&Md
43ji_^U
B@G6t)(
mDzn,{1
RAPF-c8l;" g
w#YxOEb`'V
H|2a0&Md
43ji_^U
B@G6t)(
mDzn,{1
RAPF-c8l;" g
w#YxOEb`'V
H|2a0&Md
43ji_^U
B@G6t)(
mDzn,{1
RAPF-c8l;" g
w#YxOEd`'v
~x3!0&M
cfh^_+W
_!/sD#rnAD
RAPF-c8l;" g
w#YxOEb`'V
H|2a0&Md
43ji_^U
aT`Mv,JWj
"9\{&y
Au-c,oqg
SQVH=s
Wx|$Z|PF
t.b>0Ol0O\
Q5k_XD
pAGju*)
nFzxv{1
ku2+gW
XSA-cKNW; g
=s(N"K
FLz`'z
_rW]^{
JCzog@
JGD++
fN*JCv#>
NDoo`'
R{192`OI
LehQr7
MD' 0Lq!k!
C>yo0e
fzmDi}<D,l*N
v JO|wwgXS<>
NzM6":_
q)fQ_E
fUTr>C
I*Ro2_h[-wb_;x
;7O<r!p
\o1U\Gnis9 xKi.Ha#e),I(|
a-g6q?Yk
u@CtC(
_ DOFzS#S
M++)uANgC[
Dz&_H|7
H0c)4d
TK~)* QeS
Oli8N7
3 Mz.(K
#~.m/lZq4
$B?Vzd
I!|zw9
%su&4Q
pKdx:xOE
]_cejB#Qr
]aEVd^mN
9IgFjb
Rik:!~bmR8
Y:s**
)z0 f`'
fcFLS{
`3ji(]8.f!_3
CV](r&XW:|
2DI<Bn
"VgaJ:~
c@~5Ko>
f^8j?X-NQG]idp*g#_=
`'UO%I
owxlP^U
E$=<=r$g-dHk
5kb@3_~8/^EAR-wP
DO|AGq3
3k\~UMS
;hsy[T,
Idz4@DE+i
cE21@|
wQ'GWwNWf`'V~WPL(
j!<.m m=
rs+E"fR
mXq9/
Kro
/%vp%+<
=_zVoe@d
oC8mR3c,RH
jMV+Y
BIHG]&Ppu#!
VVOdYN $
11.W"9s
E^/7(6XNQ
't#L<k
ai|wn ;q
5<_*B]&
2J'GMMY
,3b%kg
h4i<.W`9
!|"SbI#dwn
;k*9/`xp2P
+" [q!D
5;D7VE
'r%v-&
CixcdaFY
4/WMkV
hs-1BrsQ9
gc=F(:3mR324[C#L
<="t#rV
43j.hWe/}
S}!pS)
8G((r,z
C8V,{$ sY
9w]x .
0HRPFmbO[_
e83jiu
HAh[ec
Lnwjq~o,0tEc>
Yq8Y#Tm
QK"+J0uN&
k$ r).z
XoF-OaeX)0
JKR{4\
6`Q=@q8A[#YC?Bh
B#T$tEvAB'?Kk[`F_
Ml;"Gg
]M\dkuz
vYI9)zEog2
W2}dA\I8
p5_-&r
}HH89Y;tsVJ}LO
VIo}NQd>_W
{._(Ms
>uZVj{yk=
B. h~&c
i\^}":71v
ZcedRh8XoABF
2k{w#L@
DY&rJf;
eM_h2l
NBe=K7
z)d$%%
"Yo(;Y
*uKC]&sJ`-
E/Yh4^
P*DrckmQ
S-D;?UL
.>|20o2
<A6:tG
,#Y:cb`
=F%pU}-
|po/oYp
SFROLPTe?YG
C,z,bBq
):~*sMN
mE#CGf
n@Ag-(~#s&|8
LAe}p3Nf
K{55mnfb
3ZKr4biJ2%*c
a5 ?u+\,MY
n"x^sb!e2T
~2rl2,$:
J|2#XR
^gw]Uhpv
$I*-ghL
Un+(OS
uN|4;u
@yXw{]9Z5
K1zk%pY_mTotEk W
mmrUBg
1<}4JKp
JsKVC,
c`yc!5]P
Nu<K/bS
$=@uNF
:1n[NRB#|v
9=?s*$hW
LH<}-V
gK+,M}4ad<M,
=0x9-P
nygA3@
ObW]&&.W
sl]#^&G{
@H8.,N
Un[K'buZK3
M;o_8@&d
n9O:uN[
Q^V%Dz
[2K=11
>NYo/*
d S-';
<2(`(e
&riB.G8
T#JQ^f
))VW|r
v$PG|l
m!(t!@KH5
d0<=#qv
VZ7XJ8; 0 F
i:WTQ" OS
0Z]!n.W
uib<F"
ghFkzet9?VY
NKQ@s!r
q$!YXG
bwbT!Re
k8v]LS
7GGHQQ
KPr~1XZ_S<
{8:r0?g
BTk6)(
Yw}>,kd7lU
E/zdT}
eO#Gs]
WL8pYQ
36{f<Dy
aeaU<IZoClbNDh2<
>>& )(<
\8JdLIl
)Rh.SAPH>Te/
n<"](V
gH=!WH]&q
HC'{4E
|.W^L[,.0
Nkr!;v
R_XoI[BG6!Kr
:1>;1grBw
`^uC3A
fBe%*x
V1c{SFoqw
1FR:k^e?U[o!<c
2~=%/g
O_)MA"
jZ*Xd/
-G>sr~
].Yi`Y
v|'|U`1
f];7jP
V;SVC,=e
6kKPcWA9
z5ppUW.:B#f
G2aLd./
SJtEDY&\B
seT;3!Ll17
n?aWJ5;FWhX{
1H >sKM!
?7D{+Yxh7N
B(<W*zu8
Ftn;A#K'G
"-bN7<
X~3nS;Pn(
Je15*ivfjn
%5cUC=2B=0
j;Dl4;D
TP43j^]^7IP:
$rr!pNNB
g{5S<-
"lRB;3$
GXf7U+Mh
rs-|8[
jRB#o,
gq\v],^
-Fv.\h1
g[TOLPTe
w#YxO.Eb`'f
H|2b0&Nd
43jj_^V
D@G6t*(
RBPF.c8l;$ g
w#YxOEb`'V
H|2a0&Md
43ji_^U
H@G@t)(
nDzn,{1
SAPG-c8l;# g
w#ZxOFb`'V
H|2a0&Md
43ji_^U
B@G6t)(
mDzn,{1
AP-c8l;b gVT
w#YxOEb`'V
H|2b0&Nd
43jj_^V
C@G7t)(
mDzn,{1
RAPF-c8l;" g
w#YxOFb`'V
H|2b0&Nd
43jj_^U
C@G6t*(
nDzn,{2
RAPF-c8l;" g
w#ZxOFb`'V
H|2b0&Nd
43jj_^V
B@G6t*(
nDzn,{2
RBPF.c8l;" g
Q=sj^K
w#:YxO.E`'
H|2b0&Nd
43jj_^V
B@G6t)(
nD{n,{1
SBPF.c8l;" g
w#YxOEb`'V
H|2b0&Nd
43jj_^V
B@G6t*(
nDzn,{2
RBPF.c8l;" g
m [,i'
!p=sAg
7 ~i0&k
t@O-c]
;" 1gjl}I6u=
a| PkL0^
k `@SEM
PWDFCQm
)^=FjT}g*
Ay$%#~jSM|@u
kr!2fCy@
)( `A\Xf
4<Xn,{m
3.7!O@]G
yG\{3"m'j
G/d0i|
l4*D7+
;"m",f
Bf6n.TS>~
:@~#MUL?K
T%Z\=]Wm
Ct2^OTr
Hz*#_/
?]=*{TO
AS4a+%Q)
Zn\>g?k1e,
\yX2*e
RAPF-c8l;" g
@CE*aL
,1%JE1U56b
e%(i&rn
L!This program cannot be run in DOS mode.
5C^4q"0gq"0gq"0ggp"0g|pg["0g|pgf"0g|pg"0gxZgt"0gq"1g*"0g
[gs"0g|pgp"0g
[gp"0gRichq"0g
`.rdata
@.data
@.reloc
f9FXuy
FFftpk(@
eE3@.k
SUV3W3
G(JuFt+-
D_^][j
FF;sTW
j$h8HD
E3u;sG
QQSUVW
3_^][YYj
XUQSVW33
f;GFsh$
XMEQPFv
GFC(;r3_^[]j
@C$E3DC
uuuuuuE
jEPhpaD
QHLYYuL3uL
Y3}fMQ
L"jEPhpaD
ejMQhpaD
u1]t*H}
GH;}rSL
3@^Vt$
D$ SUVWpaD
3PD$8d
3T$,fD$
!D$@3y
Gc<}u8Ou\tXj}L$ -
Y_^][L$ 3G
@_^YjhVQA
SUVWpaD
\$(\$,\$0T$ D$$$
PL$ TP
G03D$P
\$LfD$<D$h
\$dfD$T\$t\$x\$|$
PL$ PL$@*
PL$ xPL$X*
L$l+D$p
;s69D$tw0+\$t
QL$xx3
JL$xT$
PL$ lPO@)
P)PO`S)
Y_^][$
SUVWpaD
D$(D$,D$0$
D$,L$(+j
t$T|$\
jDC`]P;
t&HuA~
D$DPD$hP
F4T$4t$
D$8F0QD$@^YY
s0[4\$4;
l$$j@D$DD$lj
D$ @uB
L$dQt$Dt$(t$(
D$DPD$hP
T$(t$@D$,C
QD$4YY
\$4l$$DDl$$;
Y_^][$
D$PSUVWpaD
3PD$hd
D$ \$ P
UD$ P*
D$4+IQUP"$
D$4|$H
CD$4PF
WD$TP#
jWPL$(D$|
L$TD$x
PUL$$;)
PD$TP#
jWPL$(D$|
L$TD$x
D$ WPQ(
Y_^][L$P3=
`jh@RA
D$@SUVWpaD
3PD$Xd
PL$@u!
L$D\$h)
D$ PQO
L$4L$$D$`
L$$|$4
L$(+D$8P$
6QQWPQV
D$ PQN
Y_^][L$@3;
PVW39~8t
Y~8~<~@Wj
_^jh(SA
D$0SUVWpaD
3PD$Hd
VEU\$X$
\$PVUL$
V\$TUL$
V\$TL$
D$,D$P
Y_^][L$035
@jh[SA
SUVWpaD
;ul$ \$
Y_^][$X
SUVWpaD
3PD$(d
t$$PQL$(t$0|$ R/
t$0|$<+SD$
Y_^][ UE
^]jhSA
D$XSUVWpaD
3PD$td
_jSQL$`|$t\$p\$`d
L$@SV|$\\$X\$HD
L$TD$|
t$@\$(|$X
Ct$@T$
Y_^][L$X30
E3fE0E
fEfE3@
D$ SUVWpaD
3PD$8d
3YL$0T$,T$
!T$@33f;
L$0T$,
Y_^][L$ 34.
SUVW|$$
tJ?#uE 8
f;r2v4u
;w3_^][
j hHLD
E3fE,E
fEfE3@
UQQVWA
W_^]QQVW@A
_^YYQVWB
W_^YUQQVWB
u$3u QQQQQQWQ_^]QQVB
W_^YUQVC
UjhETA
\$L3\$dfD$<fD$Tj
YL$PL$h\$l\$p\$t\$x$
L$<L$<o
3@^YYVF
E2]2]2
E2M2M2
E2U2M2M
ZA0AA0
A0AA0AOu
^[A0AA0
A0AA0AJuSUVWj
1D10D1
SUVWl$
[G@|$ u
+W +D$
L$ |$%Y3$
\$ j@SfD$HPB
3rVt$ U
_^][3!
QQSUV3
Y_^][YYQSUVW3j
3VUfD}
Y_^][YUQQSVWN
Fu+FVa(
1t+"t"
Q\M?I"E
t1HHt)HHt!HHu2EPE
^_^[]QQSUVW3
f;u+3F
1t+"t"
Uj\Qj?Mj"Ij
t5+t-+t%+u9D$
3j\Zf9
J_^][YYQSUVWN
9A;|7.
<_^][YQSUVWN
9A;|7-
_^][YUQEP
V3jPt$
SV3W|$
;rCS\$
_F(^[]
;s69>w2+>Sj
VW>t,S^
][_^VW>t,S^
;s>9>w:+>j
VW>t'S^
;s>9>w:+>jD[;N
+;v>t3S
;rr+9|$
tg;wc3@+
+;v[tD
+WV?NN
+;vBt6U,
;rd+9|$
V;su+;wo3@+
Hu3t5T$
s6+1W?
UVWjD]~
SVDW|$
ySO[_^
Ut$$QQ
t+;t |$
Ut$$QQ
t+;t |$
M;Mu7T
PQQSUVWpaD
BPnY3;
M3}90t
O8F0G0F4G4F8P
t2?w2Vh
t.w/PVsU
;t]UWj
G;u_]^[SVt$
u;t?uE
AC;u_^[;
3^]UVu
on0v00f
on0v00f
on0v00f
DDDDDDDDDDDDDD
HuYU]2
3wWu.95(xD
uK5,xD
tJ2t#2t
t'@-rA
u';v#RU
Map_^[]U=
jxYf;t
jXYf;t
jxYf;t
jXYf;u
YuHjAXf;w
_^[]Uj
UQSV5P`A
;r>PS,
3_^[]Uu
0ffffffE
YM3_h]UE
3PPPPP
;r =cD
+SVWpaD
1E3PeuEEEEd
Y__^[]QU
8csmu(=
t6hpaD
2E_^[]
URPQQh~@
t;T$4t
;v.4v\
UVWS33333[_^]
33333USVWj
_^[]Ul$
3@]3]UE
]UQEPhaA
YYuCh1@
VVFVQ!
C;r_^[]UVu
YYh|aA
Yu =PxD
@Y<v5hxD
[M_3^]SSSSSUE
3^]USVu
t9W>+~
tWPVYYE
PYt G}
rdUVW}
3_^]UVu
^]U%~D
EMEineIE5ntel5
E5Genu
MMtCE%?
_^3[]UVu
^0^]W+
Ju3_uf
;kSjA[jZ^+
8jZZf;r
+(SWSu
Map^_[]UVu
|3_@^UE
]SV5tD
GV2Y4F
j=YfuG
YYt5tD
tDVYj=X
YYtAVSPv
Y_^[5,xD
3PPPPPPUQV5(xD
W3}KWWjPWW
EYYtAWPj63WW
t$EWPG
u_^]9}t
tGS3Vf9 t
v$;Y~,
v,,Y~4
vHY~\qA
YYt3V5(fD
~pjCXf
YYt-V5(fD
A_^[]USVu
tf=hoD
t_FxtX9
uVuY_^[]UU
1N_^[]j
Npt"~l
t4V0;t(W8Yt
Map]US]
AJu_^[]U
A;rM_^3[B]j
,Yuwhu;5\jD
Gh5\jD
Eph33Su
YEXh3@
3U paD
C9]vO}
kE0EpjD
OuVIY3_M^3[
EPQEPEj
Map[]j
f;rQvf;
f;rQvf;
f;rQvf;
Qvf;rgJ
Pf;rSPf;
]UVW3j
_^]USVW=
Yu#t V
u_^[]UVW3u
YYu*9E
_^]UVW3u
u_^]UU
8_]UQQM
3GW3Au
EmIuEt
@tJ=nD
E]UQ}M
E]UQQM
u2t&:a
8csmu%x
S^`F`y
j$_F\d
3_^]jdhRD
]j@j _WYY
jEPhpaD
Y8Y4@M
} j@WYY
2t[;tW
Y8Y4@MFu
EtLtHP
YUQQSVWh
3S3f D
EPEPWWVc
;r6QYt)EPEP
_^[]UQQE
tj"Xf9
j"_f9y
t"f;Et
ME3M3M3;u
_^]VWGD
;r_^VWGD
3@]UQV5
]VWh@rA
3SVWH<
B(;r3_^[]UjhRD
SVWpaD
1E3PEd
Y_^[]UE
]USVWUj
P(RP$R
t:|$,t
;t$,v-4v
UQPXY]Y[
]j$hHSD
Y+t"+t
+t^+uH
u?GdEGd
u wdVUY
Gd3\UU
tAt2t$
^0R_^]
ft%Ou +
3jPfTAX3f
j"U$paD
}E95PD
VVh$uA
;tO9=`D
tGP5`D
MEt/t+
3M_^3[
on0v00f
on0v00f
on0v00f
DDDDDDDDDDDDDD
KuZ^UM
t7=PxD
]UQQVu
WVcY;u
EU_^]QL$
trWQYuE
t(WJYP
V38W30@9u
YtD0,+
,3@@QQj
8Q$PEP(
Y4f;uu
Y4f;uOFD@,;U
<+0;sD
r3VVhU
QH++PPVh
+[M_3^
Wtsj=S6
YYtc;t_3f9w
E;5DxD
EY5,xD
ey\>tS
PYYtTSSlY
3R3PPPPPUVu
x=t!ft
_^]+5,xD
PKYF ;
P9YF$;
P'YF8;
Y^]UVu
PxYF0;
PfYF4;
PTY^]UVu
v$v(v,v0v4
v`wvdovhgvl_vpWvtOvxGv|?@
^]UQQpaD
E$39E(j
3tAEWVPSu
t!3PP9E u
e_^[M3]U
u(Eu$u u
Map]UE
PkY]UQpaD
W39E Wu
e_^[M3e]U
Map]Uj
YY]US]
_^[]UTD
]3]UpD
jA[jZZ+U
_+[^]U}
gY3MS0u
t@VyYt
3[^]|q
t*f u!f t
ZmZ,$Z
et_EtZfu
]U,SVWj0Xu
(lj"_8w
uy3;uu;t
]u'j0XF
EfyfxW
v6j0F[
Wj0XPV\
ap_^[]Uj
MSWu Bi]
hj"_8nt
-jd[;|
Map_[]WWWWW{sU,paD
^VQMQp
rg0%stu
M_^3[\]U
Wj0V^|
Map^[]U,paD
[SQMQp
^M_3[ []U0paD
[SQMQp
E3H}-E
^M_3[ Z]Uj
uVJ:0t
E`p]Uj
Fu^8Et
E`p]UE
3@]3]UW}
^VVVVV(nUVu
^0m^]W+
3^[]Wu
P[YYt@}
~';_t|%39E
;_tr.~
Map_4Uj
3_[]3PPPPP'lSQQ
Ht+Ht$Ht
Ht HHt
PQW|PEP
YM_3^YT][U
E`p]U=
;s`Myt
Et%Map
Map_[]U=
YY]UW=~D
#3+#I#[
SL@PSVCR
3[_^]U,paD
EZE3PWWWWVEPEPs
apM_^3[O]U(paD
ZE3PSSSSVEPEP
MapM_^3[BO]Uj
_^[]U0paD
3^[M]3PPPPPcWVU33D$
YY3^]VD$
IA+3@u
DJx.t'D
<+3M9]t
j EX+j
MTCE;|
IAj X+E3M@D
OGD+3G
};Ej_r
3ADJx(t!D
UTMEE@E;|
IAMj X+]
IAj ]X+
Iy}j X+
7M_^3[.F]UDpaD
IA+3@u
DJx.t'D
<+3M9]t
j EX+j
MTCE;|
IAj X+E3M@D
OGD+3G
};Ej_r
3ADJx(t!D
UTMEE@E;|
IAMj X+]
IAj ]X+
Iy}j X+
7M_^3[@]U
E3S3@VE
]W}]]]]]9E$u
+t HHt
X]3@EA<
+t+-t&0tC
3@E0|*Eu9
B0}uEE$
kE3@EEEu
HB0tEE0|%u9
B0}uE+
+t"HHt
v09] t"BE
mH3@E 9
B0}JEM
HAO8 tMMQPEP?
U_E}}~Xu
Uf~;x2E
f;r 3]f9E]
Mfu 3f9E
M_^3[D9]
A#EE?UEWft
;u%u!h
u]]]]}
U^|uu~ru
uEf~;x2E
E}B}Ut
M]Euuj
u@Eu4E]u fE
f;s fE
}fEEEuMUf}!3f9E
UX~X}E
[f~[fM
fMU<f@fE
f;s fE
}fEEEuUuf}
u]Ou}]Uuj
UuuE@E~
AEHME~
EE>u}A
0I;s;s
3@M_^3[/]
3SSSSS!EUM
YEm}E3
_^[]UM
PM>ohPD
Po%X`A
G;r_^]
Y__^[]QPd5
SVW(paD
3PuEEd
SVW(paD
3PeuEEd
^]UQSE
k 3@[]U
E[]UQQE
MuWx3U
UQQSVWd5
^]UV#Pu
u3@]3]U
SVWE3PPPuu
E_^[E]U
m)zVW_^]M
tr8csmujx
VO2Y^]
EPYYE N
>csmuH~
u,uVu$6u
WP_]UE
8csmu9x
]3]U<E
u>csmu+~
YYuD}9
EPEPuu WrM
u*EUHM
u$u uuuWu
SV,UEMA
YYuVHHH
u3u$u uWu
is_^[]sj
PMgbh\UD
cu$]jWu
\UQQW}
t1?MOCt)?RCCt!u$u Su
rEPEPu
;F|c;F
u$Nu Qj
M;r^[_]UQQSVu
;>|_^[]kqqUM
Ht Hu4j
WxE03@
e0o3.UE
8RCCt!8MOCt
8csmu*C
USVWBM
RM 3@_^[]UVu
PQZYYt
t3@_^]UE
+SVWpaD
EPeuEEEEd
(MMMMT$
MMMMMMMMMMMMMMMMMxMpMhM`MXMPMHM@T$
6M.8*T$
bad allocation
CorExitProcess
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
_hypot
_nextafter
Unknown exception
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
CreateEventExW
CreateSemaphoreExW
SetThreadStackGuarantee
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
FlushProcessWriteBuffers
FreeLibraryWhenCallbackReturns
GetCurrentProcessorNumber
GetLogicalProcessorInformation
CreateSymbolicLinkW
SetDefaultDllDirectories
EnumSystemLocalesEx
CompareStringEx
GetDateFormatEx
GetLocaleInfoEx
GetTimeFormatEx
GetUserDefaultLocaleName
IsValidLocaleName
LCMapStringEx
GetCurrentPackageId
GetTickCount64
GetFileInformationByHandleExW
SetFileInformationByHandleW
MessageBoxW
GetActiveWindow
GetLastActivePopup
GetUserObjectInformationW
GetProcessWindowStation
!"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
1#SNAN
1#QNAN
permission denied
file exists
no such device
filename too long
device or resource busy
io error
directory not empty
invalid argument
no space on device
no such file or directory
function not supported
no lock available
not enough memory
resource unavailable try again
cross device link
operation canceled
too many files open
permission_denied
address_in_use
address_not_available
address_family_not_supported
connection_already_in_progress
bad_file_descriptor
connection_aborted
connection_refused
connection_reset
destination_address_required
bad_address
host_unreachable
operation_in_progress
interrupted
invalid_argument
already_connected
too_many_files_open
message_size
filename_too_long
network_down
network_reset
network_unreachable
no_buffer_space
no_protocol_option
not_connected
not_a_socket
operation_not_supported
protocol_not_supported
wrong_protocol_type
timed_out
operation_would_block
address family not supported
address in use
address not available
already connected
argument list too long
argument out of domain
bad address
bad file descriptor
bad message
broken pipe
connection aborted
connection already in progress
connection refused
connection reset
destination address required
executable format error
file too large
host unreachable
identifier removed
illegal byte sequence
inappropriate io control operation
invalid seek
is a directory
message size
network down
network reset
network unreachable
no buffer space
no child process
no link
no message available
no message
no protocol option
no stream resources
no such device or address
no such process
not a directory
not a socket
not a stream
not connected
not supported
operation in progress
operation not permitted
operation not supported
operation would block
owner dead
protocol error
protocol not supported
read only file system
resource deadlock would occur
result out of range
state not recoverable
stream timeout
text file busy
timed out
too many files open in system
too many links
too many symbolic link levels
value too large
wrong protocol type
bad exception
generic
unknown error
iostream
iostream stream error
system
yehoron
KKPSSSSSamw|&-29EGPVZZaipvx}+.:AHIT\bkz$%*8FQXagu|,6ANTVbor"(7BNU]bllssx
PYZ]]]]]dqqv!.09AJXfjty}")77:?FHT[`fr!+0
O]`iiiiiu"$$12=GVW[hpuw}}!-8DSWbky'.9>>BGNU^mtz{++33@NPTUYelt%4@BIS[`jr!
KSZaaaaaemmmoos}+:?HRRW[ijt}$%+1;;ENY`cr
KY_nnnnnv&+5BKP[jssty %+59<KY\ft}*+9?JY\^^mp (.;ET_fu%)099FLP[^cffnw|!++
JMOUUUUU[jwz##2AMP[et""((11;CGJSV^bq!&+3
LRX`````hw{}&059GGPVZcrr#(,-7:GRT_boy *4=KVV]jp !'-6<EJRRSTYbflqz"-:GMQR
PVWccccciipy"*//<GPU[ehm{,9@BKRYccjx}$.7
NQSaaaaakv'+/8<ALWfnwz&(+7?KN]l{+7CCCKMOQQTX[fltt!%((-;=GIKZZanz|-0>FGJX
BDFQQQQQ_nny&/7:;ENUZckv}} ,3<HPSY]hlw .
AHIRRRRR]iu%)49@KMV]`ly '17FFUWadeeq}&.:@EPY]fqz&'028@KS\`bnq}-0>GSZ`ix(
OSYfffffio}-/9HT`dfq{#)3;@HW^ajor!#169AB
AKRVVVVVachu$02AGQ]dky -<=FTW_jklu!#.:<GTXfky{*14BIOT`o{%'.9ACFPS]^^koos
GOSWWWWWakr{}'446DMSV_anqr"..=HOXaho{&&(
ETVYYYYYdjuz)5@DO^`hiw}+-4AIPSV\^etx)39BN]iruy#((*/4?LRX^`gpw(,59?GJQWai
M[[]]]]]bitx ,6DLQVekt!(/3?BELVaaaaor##/
HQXXXXXX`iist{"&/22:>MMSWcdeo|,4>L[[bmx#,05:GMS]iqt")-.24BJYdor{{)7AMTWe
HKLPPPPPS\fnsz'-24@LLNNQ_jw '+3<ACQZhirz
JPP_____bgt%*8EFTaioy")+,7>HUXegmwwx#'.3>HQT^bpz{|#)0>@CJWdjnyz*..<GGJR`
O]aiiiiinxz#%4?AFN]efpsy|+6@IP\ffjp $2?C
HWYdddddllt}!'5;HUZghr{!$+-8;CFGIJUahnx|+05>ITbcry!!!*,889GTUV`jsx".66EO
NY\hhhhhqx$-57AACGSVYelq{}'+-89@JQYcnntv
M\coooooz'6:GN\gp}++08>@DLM[eouu %2=?BHT``fr{*66:GS\hv})4>CLMOQ^`bekx(7>
AEKOOOOO[``iwx&48;<JVW_bknrv#*7BOYfnsttv
PQVaaaaalru"%'.2>KYdepx ((099<IRYbehkz*,3;<DPUcnrru|&)6DRS_deo}"&+:AMRZe
JQRUUUUUbqy&)*59>MMVZ[fiopz'+17<GGVejmv$
BBFPPPPP\ghnx')-.//<EKX\`ky$%(6>AO[hw{$./;HS^eikkru{,,0<JMXffmw!+69ACDR`
MQWaaaaaehu#-:@OWZhs"#%%.4CEEKN]lu!.118A
GTYccccccot$0<CJRWZ`dq}.:EL[fgs #0>EQT`lsx$&,56BLSbfpr!!/7AKS]et$$.6=LL
FGKVVVVV\ku#(379DS`my"0036:=INOPWbfpu ,4
NUYhhhhhht$04CP\ds#149EOS[couuy'*9:BPVXcemx#,56>JUao|'4BKQUdoow'4==EHTTZ
CLQ]]]]]bdm|(,6<DKKNYffhlsx%.26>DLT]cr %
MX[iiiiiuw&)2;HIRU\agr| #$08CJJRZipv},4CPVcdryy}%3BGOZ^mq"+9EGJLUZ\dlw()
OY_mmmmmpqz!-1>CGHJKSV`ko -0?DPSWaiqsw".
DJKQQQQQ]ixx$34ADQ[]``abggtu!&19DJVXZesv{(6>EIIJTTWeenv%..118?AMW]ikls"#
ENOXXXXXacqx)24>BHW[[efrsz)8>DO\_ckt{+3@
JQTTTTTTaalq /6?JOV`cijlw{}-28:<KOR^mu$+-.8GGV_cgnrx!(*5<DP]fhhqx(38>DEK
BJPPPPPPXYcp{'2:CGKKSZdpqx#-3:@MXfhu|(6=
ACESSSSSVdlr!(6:GLN\bgpz!'4<CHUZ`cdgmsy|%(*8@NZ[hlmm{))+78<DDFPQ^^ir{!""
NNNPPPPPS[jww!')3AP\^cpuu ()-;?EP\^biirr
KPR]]]]]]_fmsv$%44<BLU`fu|#.7<FFNTZft!-169=BPUbkt{$%3;EIWZ^jsy%+/099?KZi
EHKPPPPPXcftx!$2@KZ\is '37::;FKOP]flru&5
LNOOOOOOUZ[alu!,4<EEO^kooz+,.7CM[]ku!!&39GIMXeor|}$.3>EGOV^fp|,7ESWfgp (
DPQYYYYYboxy).;?LLMV]jx)1;BLZix|)-;>FGIW
DPPZZZZZ^dmz|(2>DINPVVeor!!#%*17AEQXfgmy|%.;EN[ir"/8ELRY_kz'///1;CEGGINT
GLNPPPPPW[dnv"-:HW\iu$3<IIO]kp !%%,25@MV
LOVXXXXXY[achnx$+,.9;AILTXcijkmu{+3BBEOPTTYeiv})8CJT[jmyy .8ACCLUcdmy}"0
BIJKKKKKL[]]_gn}!-9@EHRUWdenpt!"&26EKQY[
OVYbbbbbqtw&38FS\bggqt!/:GGLXdknnr##))/0=>CIMTTcerr"1:GGN\dp{""%11<=CORU
KZ`nnnnnpq!$)18DLOSVY_iss %/39FGIMQ\\egi
MNUWWWWW\]gpqx{*8:<HWZ^jlv|*6>ACJU]hirtu{(48?GLLZcjprx(.45<JSabdlr"+8CHV
HNOPPPPPU^^gtv"158AHHP]gjo| &5@EFGJNNO\`
MNQTTTTT]^blz!''49FIV_`emnz+9<ACOOR_et ,7:EHHMW_jv#$(003@KR[gt!*27DGHLRV
KSVdddddry$24AILO\eetz|((+8GUZZblpwx -<?
KV[gggggky*/5677>AADLOZefgp}$,9CQ_jvz}'(168DGLX_kx)3>KXgtu$'',,-0>JRS`dp
GJQRRRRR]eksv'(68CORRTWW\ioqqrv|,1?NQW\c
NRWZZZZZ[^flw$&17BIX_gv"+4@@APWalx"&,558:=AKTXdks",,4==?MQTYeiiw"&'1?EEN
P^`iiiiiv{},8CN[`gsz -19ACRXeoqrv{)7>HIO
KW[bbbbbcksz),6;GQT_jmo %268@IW^behvz#'6<>GQ`esy*4CEMY`lvwz",47AOYapz +.
FU\gggggnz")68>JJOSVeqy!(/55:HKYY_hquz"/
IVZ\\\\\ho|$,;EM\ky(,3AJNY_klw%'59HSU^cpy)38:?NNS`hlrv|$%(.56>JRZafhpwz{
DEHIIIIIJV]ky'')+/:@IQ\dfsw{+9HVV\hv$*27
GSTXXXXXem{&+-8@FQS_hox"-27=L[_elz#&3>KS^_hr#/27CMQZhpw!)35:DMU`jpz!+.9=
PTXaaaaajw|&-.=?COO^js"&++:FSTUackw|)8;F
BLQVVVVVcguvv|%/<?GRWepu#+-28@O[[gq!".2>?HHR[jx#*6:?AMMW\bhu%08<HSValllx
LPWfffffrs"&00:=FMS[got#)7BPYbqruz{+7EOO
AFLOOOOOVYeq!$/4<HVWcfu!//;BJY]`ll{+/=LYdly*02;GOUV]_bot!'48?MVbpr!)6:;D
LQQ\\\\\bfs}%%4CRako|*0=EFOP_jw $/<JNVV_
HPWaaaaabnrwy*7>FGKU_cfr!06>>HMS`iky",6CMQR`jjxy|,.5DFM[inruv})47;ANN]`c
PYYccccciu%*-005?BDPX[gjnsy"/5;DGKY^lmw!
IIIPPPPP[fghjrw|,789GPZeqt$*7ENPW\\hnq{|,19CQW[[hhkx%3AJXerw!$'68=LZccr"
HVY^^^^^^m{)*/26;BLS^`mnp!%/38FKT]]fnx"%
AIKQQQQQ^_dirry **27ES\gu&.;ABKMYfnx%0>CRXcftv##19?LMS[ellr!")1<FJSWefu{
APRRRRRRX[```bm|&(+/17@MMWZgpsxx$3BPYdn|
ORS\\\\\gox *58>HKQUdov{ &/6<HO\bdjs"*/=KQ`dp!!.7=AEN[anx|,488<KZ`kr}.7?
JPSbbbbbjt|$,,6:ILUV_mtu #+8>MPZ_jmqu#(3
AFIQQQQQZfu##.4CLLSSUX]^itv$%+4>FLVdr")/<BPQQQ]ju{#)668DNOW]`bjuz!$36ERR
IJMNNNNNVepvx(5DJUY_fjjkvv"#*37=FTbbms *
DOVcccccjxy%.9DQTXckuv"*8<KNV]flu&,,0>FKY^cptvy"$+1=DJOZais}-119=LWdimr"
CGISSSSS\kow".01=>DMUbluw!01>KTVW_adsxx$
BJOPPPPPT[\abgmz(4;IQTX[dp|'09AHSX\bjkt$3=LVdkns$)+.;=CIJX`hps"038:IV]_b
PPVWWWWWeq{)39;HWXYdgjkv&&18BLLYds '+6BH
ABITTTTT]blqxz!*28>BDMZ`iktx !.<CCGRapqv"..78ESW[`lu !&57>CCEPZamvz*4AJS
EORWWWWWZ_jt%%0:@FQZ_ipwy$)--..9HMX]ccoq
MTV\\\\\kux$$.66;IQZfu!(+6=HILUbdit{}.//:BPZbhvy"$/168AJLR^`dkx$$$,7FR\]
JUUXXXXX]kv"*18ACDS`ipty'--6CKP]hhjv%)16
LZ]`````jopy $&--3AMTacgsx)167:;<HLPSSVV^_cfprsz%+.08;FSZ_ejx)*/>LZcdqtz
CPSYYYYYaknnu #057BNRVboq /<BLY\]kls"(38
GQT]]]]]ix|(5>JU[gpu#,:GMY]lu!()/35DS]kosv{{'/=INPQ[ehu%0;ABES[ioq}+//6?
HTUWWWWW``hv#)-/66CIP_iot$.3@KLQ\jx!-./:
HV\\\\\\dehkrz})1=IMM\hox)13<IKNW```ggt%''.46BLYap},2@JKU\^eovv#014<FSUV
P[\\\\\\_mt!"/2@NVdjnz+1144?NUVY_ceflrs#
CHN]]]]]jnp -7CLMW\_dott *47EJOS`fs| *-9>KMS[ipv&1:;=FU`dfl{*+9GGUcrty $
HIOSSSSS`fjppz"-::>EKP[\acpx},/039:DNVci
GVZccccciv|)*66;HHVWapxz(6ELMM[_mrvwxz|%*-:HQQ_aktv|(58==BGGQ^fr|"-27CQU
HRVcccccm|*117?DOV[bgry{(2>GSYadp!*6AFJP
BOQRRRRRaivx!,,,4@DMN[fuwy!$$.2=KTYacqww#.7FMZboooz!(2<DIVefuwz{+49DP\hh
IVV^^^^^blpwy)/=GS_jwz*9CEKY[hmz#12346CH
IIPYYYYY\]]_gv!,,9HPV]iu#)/>JWZajl{#1?ELNS_ls"12AGM\kty|)006>JOSblu|"'1<
JPU\\\\\apx%&+3=JPPW_cm||}$2;JXdfju&*88C
NNRaaaaabght|$(4BQ^js}&/==GNU`hny'+0<?M[\ejmx&(-;DMZefpt$+,:CMYbdennx)0?
FHJJJJJJVbn{)-9@N\^joy{$-14?JV\kkv#,9>DL
N\`aaaaapz%&(17>FOP[eeeggqsuw{&1<IOSV[\afox$)3?MQ[_kw&&&,668GMRSUbgoz)00
M\apppppy &*.;;CEQTX]is$/:FKS_`gt"".44=L
EFLMMMMMNS_joy#1;ACRU]lltwx(/4<JTT\bgu#.8=KPVZblqy}.09CDES_ht"+8=>GTaivz
ENSUUUUUbflmxz{%3?NWddgkt!'+7@MOT[[bkq!!
KX^`````hmqw!#)4>IQXbhp}#1=AGKQXZ`jor{{)*7AIWbfky*5;CCLSVV_cqqv|+9<<BJO^
ENT^^^^^ix -/1>BKOVco}#2:?ELZhwy'28EM[``
N[_aaaaaegsv|%%29;ADIJM\iw'4<JY\`o ')-<@GMNS]fiit#,8C
JKLADKwe
!"#$%&'()*+,-./0123456789:;78<
;<=>????@?????????7???@B?@?@B???????@?????
Pu^t~MY
Y=T rt
P@UV7P@;<t
9V4H9u$x
k e r n e l 3 2 . d l l
@ j j j j j
( ( ( ( ( H
, / K P i p
/ - P ? p R
D i a l o g
C a n c e l
, / K P i p
/ - P ? p R
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 4 1 9 2 4 b 2
B u i l d V e r s i o n
7 , 1 5 , 2 2 , 1 2 9
V a r F i l e I n f o
T r a n s l a t i o n
C : \ j 5 D V L M K T . e x e
C : \ q H 8 C A R h S . e x e
C : \ T P 1 J H Y c 6 . e x e
C : \ O s m y n n e R . e x e
C : \ F R C 5 7 5 P i . e x e
C : \ d u n n O D 7 J . e x e
C : \ 1 v k O o g w m . e x e
C : \ t M 7 a D m Z c . e x e
C : \ Q E 6 S i n 6 y . e x e
C : \ 5 E 7 B O 0 1 3 . e x e
C : \ 4 C W q W u a X . e x e
C : \ F y w 5 E f I o . e x e
C : \ c e b d 1 e 4 e 4 1 f 9 1 c 0 d 9 d 7 c 6 0 2 d b d 1 e d 3 4 2 c 3 f 0 8 1 b d 7 5 e 5 4 0 d 6 2 f 7 8 0 6 b 8 0 1 a 8 d a 1 7
C : \ h 4 Q q 2 G 6 L . e x e
C : \ 6 5 4 0 0 6 8 6 1 7 4 7 7 1 5 7 e 6 2 4 0 d 1 a 0 5 9 0 7 d 3 5 0 b 8 8 d 4 5 7 6 e 3 3 5 1 2 4 5 c 9 a 1 3 9 a 4 d b 8 5 4 a 3
C : \ l _ z z 6 P v A . e x e
C : \ v _ b c e b t v . e x e
C : \ L X n w 4 N J p . e x e
C : \ v x 5 h l 0 4 e . e x e
C : \ K G d Z F c 6 Z . e x e
C : \ w a Q a S x B p . e x e
C : \ 9 n Z o W D f T . e x e
C : \ I I J x b I X q . e x e
C : \ 6 N o P Q q 5 h . e x e
C : \ a p Y h g W l e . e x e
C : \ d J p M D R k O . e x e
C : \ 0 5 p G L v _ 2 . e x e
C : \ w V N _ q t w j . e x e
C : \ L l 8 x D m i t . e x e
q u i p . e x e
U p d a t e s d o w n l o a d e r
t r a d e r s t r u t h r e v e a l e d . c o m
t e x t / *
a p p l i c a t i o n / *
/ i m a g e s / d o 1 5 . e x e
w i p e t . e x e
C : \ N I 5 h d 1 h S . e x e
C : \ E b F O h d x S . e x e
C : \ H T M m U r 0 4 . e x e
C : \ i 5 X F 0 q 9 a . e x e
C : \ 6 i _ t y S e K . e x e
C : \ 5 0 m D n V l 3 . e x e
C : \ n 2 L i m E Q r . e x e
C : \ N Y H e 8 Y h 2 . e x e
C : \ f n a y O _ Q k . e x e
C : \ Y 3 G L q N V y . e x e
C : \ M x i T e 3 X f . e x e
C : \ 4 o J x F 9 4 v . e x e
C : \ Z T G n v P s w . e x e
C : \ h M z 3 F L m B . e x e
C : \ m Y E _ a K q i . e x e
C : \ 5 C O T U 7 S t . e x e
C : \ 1 0 E b M X n X . e x e
C : \ W 5 L 9 5 q M y . e x e
C : \ 8 r w X f f 2 d . e x e
C : \ j k I D P d _ 7 . e x e
C : \ O i e b x E u O . e x e
C : \ C N u j C P l M . e x e
C : \ B m S H R n l X . e x e
C : \ 6 8 M 2 f K H i . e x e
C : \ o e Q t Z h l 3 . e x e
C : \ G n z V X T v Z . e x e
C : \ m b G I b m r p . e x e
C : \ T Z W O H Z b h . e x e
C : \ 5 1 q n 3 b P 0 . e x e
C : \ W L D i s O 3 P . e x e
C : \ T w 9 t R T N 3 . e x e
C : \ Q E w 7 f K 6 J . e x e
C : \ k d S M X 0 V y . e x e
C : \ v 2 C _ P p G e . e x e
C : \ 1 Q y g K Y v n . e x e
C : \ w F P 2 Y 8 w _ . e x e
C : \ g Q 4 j h 8 R _ . e x e
C : \ I a t 2 Z r r w . e x e
C : \ u y 6 i q j g f . e x e
C : \ 8 _ F l x V D 0 . e x e
C : \ X J 0 c V B a P . e x e
C : \ x 4 J 6 m c a t . e x e
C : \ O B 9 M k N t d . e x e
C : \ g 3 f Y 6 6 x H . e x e
C : \ D U 9 3 B Q A 4 . e x e
C : \ 8 D 8 S G G j l . e x e
C : \ c I Z A I 0 E j . e x e
C : \ O 4 f 3 k W E g . e x e
C : \ m S q 7 I K 7 K . e x e
C : \ 7 Y 2 R P m h j . e x e
C : \ W P 8 X F m _ X . e x e
C : \ x W V M m C k D . e x e
C : \ o J Z D 4 u 6 h . e x e
C : \ X c h h V i A L . e x e
C : \ K i T n j w _ P . e x e
C : \ U 1 o S 9 S l l . e x e
C : \ r s S b 9 2 F 8 . e x e
C : \ M I t b Z T u v . e x e
C : \ 7 8 O x p n Z Q . e x e
C : \ G Q e H j G E a . e x e
C : \ 8 1 3 0 3 7 0 5 6 a 8 a 6 c d 0 b 7 5 1 3 f 0 0 c e 8 2 f 6 5 8 6 8 2 d 8 1 1 8 7 0 9 9 5 1 e b c f 0 b 7 1 1 4 a 4 9 1 8 7 a b
C : \ l u h v 0 w S S . e x e
C : \ Z 0 K O z 0 i s . e x e
C : \ 8 t A u 9 T Z f . e x e
C : \ 4 S o 2 j H F x . e x e
C : \ 5 1 V M B c T q . e x e
C : \ W X a Z 9 J x B . e x e
C : \ X O Q r D h 9 U . e x e
C : \ D Y Q V K d o g . e x e
C : \ 5 2 y 2 n t M r . e x e
C : \ 5 K t u 2 5 b I . e x e
C : \ 0 R i t i 2 6 s . e x e
C : \ 0 L U c Q q a 0 . e x e
C : \ X Z A w U O P d . e x e
C : \ m P 9 5 V H y l . e x e
C : \ u s 0 K f A V I . e x e
C : \ C j L U l f E B . e x e
C : \ 9 4 H E 4 k L c . e x e
C : \ V 3 _ w y R k U . e x e
C : \ _ i 7 a e s Z g . e x e
C : \ 3 D 6 O t R Z n . e x e
C : \ q F 9 O o o 1 p . e x e
C : \ g 8 K D 4 o A 9 . e x e
C : \ b _ n 8 S W e 9 . e x e
C : \ f H q I U g q 8 . e x e
C : \ u F D F i q 2 s . e x e
C : \ Y Y u T u 1 D B . e x e
C : \ V u i v Q t W X . e x e
C : \ f 3 3 C s F v e . e x e
C : \ f 7 g M W S Y c . e x e
C : \ P Q x p 2 9 7 k . e x e
C : \ c D s P 7 R y 0 . e x e
C : \ P _ q x V E x 4 . e x e
C : \ 4 V E 0 b z H 5 . e x e
C : \ A 8 o t E S l v . e x e
C : \ 1 W f G R T c v . e x e
C : \ M 0 L 3 9 G v K . e x e
C : \ G I F D R N m Q . e x e
C : \ T Q D p Z 0 F g . e x e
C : \ m 6 Y 0 c u 0 i . e x e
C : \ c 5 1 x T t b M . e x e
C : \ p N L x W u R I . e x e
C : \ 8 l E 3 m I X F . e x e
C : \ h 3 6 h A I A r . e x e
C : \ f 9 d H 2 X U L . e x e
C : \ e X E C 2 Q s P . e x e
C : \ d j U C g D 9 Y . e x e
C : \ V o J I A O N u . e x e
C : \ o 4 D X x r 4 f . e x e
C : \ E w Z e V z H h . e x e
C : \ 7 m d 2 R I h V . e x e
C : \ b E x j W s I d . e x e
C : \ W V z H 6 u h c . e x e
C : \ 6 p i h H E r C . e x e
C : \ n c 2 5 w k m _ . e x e
C : \ 8 h a P i D N Y . e x e
C : \ 9 W C d q M w H . e x e
C : \ k k T j I Q Q b . e x e
C : \ G j o B K _ b u . e x e
C : \ C Z 0 W s n R a . e x e
C : \ 1 M a 5 c o L U . e x e
C : \ W x d o 5 J 2 v . e x e
C : \ z S 7 G L A 4 v . e x e
C : \ r z m 2 q j 9 X . e x e
C : \ V h j G r 7 R v . e x e
C : \ S E D r y q l 3 . e x e
C : \ 7 e e b g w f U . e x e
C : \ 1 5 g f R b j r . e x e
C : \ H t x q S 7 n w . e x e
C : \ q D R n R X C H . e x e
C : \ R 0 E e X j k x . e x e
C : \ p K A 4 x _ 0 C . e x e
C : \ 4 5 k 9 p X v C . e x e
C : \ F s H P L 0 s E . e x e
C : \ y u g u y a n d . e x e
C : \ r X 6 z 9 j p h . e x e
C : \ 0 d U q 6 G s v . e x e
C : \ H Z 6 S e D w E . e x e
C : \ 6 s n Y T W q 2 . e x e
C : \ U G Q 9 p Z X E . e x e
C : \ C G l 9 G n n _ . e x e
C : \ B L d G t A D k . e x e
C : \ i B n l x E Y F . e x e
C : \ p c k a o V I 0 . e x e
C : \ H 4 X d 2 3 g b . e x e
C : \ J 2 L k W I h j . e x e
C : \ f 4 g Q d s P u . e x e
C : \ d m h 9 i _ V d . e x e
C : \ z q M 2 4 I w e . e x e
C : \ x I 7 w M x u d . e x e
C : \ n Z r I 3 _ m 7 . e x e
C : \ I Z i N W u 0 e . e x e
C : \ B s c f G 2 E Y . e x e
C : \ d _ 8 z O a A w . e x e
C : \ B V y e Y s f n . e x e
C : \ v G _ R P _ b K . e x e
C : \ B 4 R n H t Z M . e x e
C : \ q p Y K g K b o . e x e
C : \ U J E O P 2 v 9 . e x e
C : \ 1 D k R n 8 1 g . e x e
C : \ S p y W p B a D . e x e
C : \ j w X D s Q H 1 . e x e
C : \ F N v E Z t J 1 . e x e
C : \ J G Z c X D Z 3 . e x e
C : \ Y f _ 3 j n 2 H . e x e
C : \ d N J b y L X H . e x e
C : \ b 1 k 8 G E w X . e x e
C : \ h R x Z G T 9 M . e x e
C : \ 6 B X 9 f y G T . e x e
C : \ x L G A U U 6 9 . e x e
C : \ P c q z p p 8 a . e x e
C : \ a Y C f h Z 1 V . e x e
C : \ 0 z r R E z 9 l . e x e
C : \ t k M w 2 v N e . e x e
C : \ r w h v K r V a . e x e
C : \ j d x W 3 A b k . e x e
C : \ w P 8 4 9 u g O . e x e
C : \ f O h L F H Z Z . e x e
C : \ X m S h b N l _ . e x e
C : \ I f n p e M X z . e x e
C : \ q M g 9 6 v F V . e x e
C : \ j I 8 3 G 9 q 7 . e x e
C : \ k E K E 5 c w O . e x e
C : \ f 2 Z 9 m T C l . e x e
C : \ _ X w Q c 4 s y . e x e
C : \ F Q f Z f m X M . e x e
C : \ S U s 4 k o 3 5 . e x e
C : \ 1 _ u y Y c k p . e x e
C : \ e t y 4 R R F V . e x e
C : \ _ 0 k j E U 7 m . e x e
C : \ c a J G O 4 I e . e x e
C : \ 9 B N H 5 H J X . e x e
C : \ U o q F K k E L . e x e
C : \ R O 0 k G s R u . e x e
C : \ g S w R x Y w W . e x e
C : \ 1 1 W l B x l 0 . e x e
C : \ s Y G 3 7 f S K . e x e
C : \ T p J b n 7 W 4 . e x e
C : \ J i 3 w q u U G . e x e
C : \ z 3 c 7 _ t 2 1 . e x e
C : \ 5 D A 4 F R 0 V . e x e
C : \ a h X 0 I x Q B . e x e
C : \ w r Q i j x I K . e x e
C : \ s 9 z B R J W n . e x e
C : \ x z y 4 V a D S . e x e
C : \ k 4 v x s L 1 B . e x e
C : \ _ V f R Z g P q . e x e
C : \ D C 1 P J c C t . e x e
C : \ v 5 H U G y e t . e x e
C : \ B F x J q R a P . e x e
C : \ g W P D _ g R r . e x e
C : \ W I 5 T z 6 e R . e x e
C : \ 9 e R O o C b u . e x e
C : \ H o 0 R 0 H w l . e x e
C : \ j M A x f 9 r e . e x e
C : \ f q J a w T a k . e x e
C : \ s U w s J K 0 7 . e x e
C : \ L l j z P X U 2 . e x e
C : \ a D b U D f p o . e x e
C : \ a 3 2 9 0 a e 8 9 2 9 4 0 4 2 4 1 5 8 e 1 4 b 4 2 1 0 9 f e 9 3 e d 7 a 7 3 5 c 8 2 f b b 7 1 8 1 b e d c 4 0 d 8 0 7 8 5 a 9 a
C : \ p M e V K d W F . e x e
C : \ Q U Z u s Z C f . e x e
C : \ u v 4 6 n 8 n I . e x e
C : \ O F S Q X P n l . e x e
C : \ k _ w i W A q 5 . e x e
C : \ 9 M 1 w E B z E . e x e
C : \ p 1 a q Y C l a . e x e
C : \ m 4 N s 4 F D v . e x e
C : \ 6 7 l s D F a k . e x e
C : \ p 9 U R K o D Q . e x e
C : \ l x 7 _ e J j 7 . e x e
C : \ i U g I g m T i . e x e
C : \ k B l 8 O H Y s . e x e
C : \ D J p 0 d h _ D . e x e
C : \ Q j 1 b S s G 5 . e x e
C : \ 7 6 b z R y q F . e x e
C : \ C M R o _ 2 W n . e x e
C : \ I o Z i 9 i t b . e x e
C : \ L e _ j x v Q m . e x e
C : \ E S X f C O V I . e x e
C : \ X h Q i Z W x j . e x e
C : \ 9 J V Q r z F Q . e x e
C : \ m p D v A B 3 w . e x e
C : \ v u y u F f A Y . e x e
C : \ w A o D c K 4 V . e x e
C : \ 4 6 f P t h v x . e x e
C : \ Z s o H V S T 0 . e x e
C : \ e s Z J d r w l . e x e
C : \ G P u u Y r G M . e x e
C : \ u w 8 V R s u Z . e x e
C : \ I 0 w l 1 S 0 d . e x e
C : \ 0 y 0 4 W H H _ . e x e
C : \ 3 x y i E X 6 D . e x e
C : \ C c T E D w w J . e x e
C : \ 0 S X 8 l c f K . e x e
C : \ b B D S P 0 x _ . e x e
C : \ A v 3 t E P 4 c . e x e
C : \ N c D h P r a L . e x e
C : \ p F j 8 J Y _ B . e x e
C : \ m M X p B o a Z . e x e
C : \ q E o p 5 m r Y . e x e
C : \ i 8 i F y 0 S o . e x e
C : \ y h X T r r H 0 . e x e
C : \ u 5 U O G Q F o . e x e
C : \ b 7 B J d F 3 7 . e x e
C : \ 4 M L E y A W G . e x e
C : \ u K 2 B r m h 2 . e x e
C : \ F c X S X E y L . e x e
C : \ M X 2 H i 4 j x . e x e
C : \ R _ T i f t H I . e x e
C : \ c p 8 A e f 8 4 . e x e
C : \ Q R h K G G D E . e x e
C : \ t X P c _ Y J m . e x e
C : \ 0 r Z v Y i P Y . e x e
C : \ z W B m G U q l . e x e
C : \ d J R 0 v t A i . e x e
C : \ 6 v p E A w f U . e x e
C : \ y G Z c a 9 Q m . e x e
C : \ y J P j C k j j . e x e
C : \ B R 7 7 D O z M . e x e
C : \ 9 Z x Q I v U 7 . e x e
C : \ O _ v b T r F R . e x e
C : \ G y P j 3 A t H . e x e
C : \ M V 9 6 p V V M . e x e
C : \ 4 d d g M o b b . e x e
C : \ L u C A o j G 4 . e x e
C : \ i C X 6 B D 1 J . e x e
C : \ 6 Q c E T 8 B 8 . e x e
C : \ 2 0 g C 7 j z v . e x e
C : \ Q g V r c 1 H X . e x e
C : \ X f 3 s 4 b d d . e x e
C : \ g 5 y N h f 2 A . e x e
C : \ D t g A V 3 S 8 . e x e
C : \ 3 d 2 d Q X M i . e x e
C : \ z s Z Z C R i 4 . e x e
C : \ 6 M e r i w q Q . e x e
C : \ i j B X H N b 5 . e x e
C : \ C P x H k u U L . e x e
C : \ 6 9 m S P F 7 F . e x e
C : \ Z U w 0 Z l k U . e x e
C : \ M 8 j n q _ h i . e x e
C : \ A V o _ U w a E . e x e
C : \ F _ V T z 0 y J . e x e
C : \ s A g t B x T _ . e x e
C : \ M h 3 K M h M n . e x e
C : \ B o U y v e U 8 . e x e
C : \ a y i 4 m E 1 N . e x e
C : \ n a C N o N J q . e x e
C : \ 5 f Q o W 8 z R . e x e
C : \ M W l Z m 4 I J . e x e
C : \ l B a j 0 d s u . e x e
C : \ M b v s B 5 U p . e x e
C : \ 0 p n o W l U Y . e x e
C : \ Y j 3 u L V D S . e x e
C : \ O 2 T _ 4 Q B a . e x e
C : \ g X Q T B K g 5 . e x e
C : \ 1 S w k l k O f . e x e
C : \ j 2 9 k n 4 B m . e x e
C : \ W 2 S 0 i 1 A O . e x e
C : \ 6 7 W a d G L b . e x e
C : \ 7 3 1 O L W 4 A . e x e
C : \ z i o c f v F g . e x e
C : \ B P 9 H M U H Y . e x e
C : \ 8 x 8 M e T H j . e x e
C : \ D z G E 6 1 R z . e x e
C : \ s M n W l y q u . e x e
C : \ 1 Y w F U a b v . e x e
C : \ _ 8 L N k H 7 n . e x e
C : \ l 8 e 5 8 e t B . e x e
C : \ z Z t 6 Q I 9 z . e x e
C : \ n Y o 7 P T J c . e x e
C : \ S w I g x H q j . e x e
C : \ 2 a v t c b 6 r . e x e
C : \ _ Z I p 2 8 T r . e x e
C : \ 3 a E 8 c E f K . e x e
C : \ w w P v 5 o r 1 . e x e
C : \ 3 G n q X N 3 n . e x e
C : \ k Q V 9 G b h Z . e x e
C : \ n 3 y 6 3 l Z Q . e x e
C : \ R E b w M y J D . e x e
C : \ N W 3 H e H a P . e x e
C : \ _ 9 R L M d v 3 . e x e
C : \ D 9 E V e F A r . e x e
C : \ L R B z V D n g . e x e
C : \ c f S N O e v 8 . e x e
C : \ 0 F H n W V G O . e x e
C : \ G 1 p 9 h u v q . e x e
C : \ Y D d Z w k W d . e x e
C : \ s F q f 0 e R k . e x e
C : \ 5 J 1 D c 6 p 1 . e x e
C : \ S X y 5 x K l a . e x e
C : \ R R j c E N f t . e x e
C : \ E c _ Y R L 6 W . e x e
C : \ T Y t n w 6 e N . e x e
C : \ I 0 P s 9 1 X x . e x e
C : \ l d b D 3 5 d 9 . e x e
C : \ q t 1 _ m h d B . e x e
C : \ h W 1 2 p V i 3 . e x e
C : \ c v L _ e r Y _ . e x e
C : \ R u 1 X a P U P . e x e
C : \ s 6 y b G k h F . e x e
C : \ k i p J n W G X . e x e
C : \ Y L B g p h V K . e x e
C : \ Z w F i w w _ _ . e x e
C : \ X 0 B n d P b 2 . e x e
C : \ _ f Q Q 2 F o q . e x e
C : \ u o S _ C C g l . e x e
C : \ X f M H R m e N . e x e
C : \ Y e e d F H 9 i . e x e
C : \ S v P F O q x A . e x e
C : \ p i K B L E 0 F . e x e
C : \ s r T S y X 6 U . e x e
C : \ O K B F v w O 4 . e x e
C : \ H X R j k f e L . e x e
C : \ 5 J A 4 q g Y a . e x e
C : \ r W U G i L r 6 . e x e
C : \ C P V O 1 2 N c . e x e
C : \ O 6 c C p h 0 v . e x e
C : \ C h 1 E q 9 K 4 . e x e
C : \ e I O B N I K B . e x e
C : \ Y 8 D f 3 4 C K . e x e
C : \ j r o 8 g G 6 b . e x e
C : \ L F 8 _ P 4 d U . e x e
C : \ Z j l G k x p u . e x e
C : \ B s w 6 B d R 3 . e x e
C : \ n 7 d 7 e L q I . e x e
C : \ p H d i 3 X D 8 . e x e
C : \ P P a W k R P p . e x e
( ( ( ( ( H
h ( ( ( ( H
H
I D I _ I C O N _ I M P O R T
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 4 0 9 0 4 B 0
C o m p a n y N a m e
M i c r o s o f t C o r p o r a t i o n
F i l e D e s c r i p t i o n
M i c r o s o f t ( R ) A d d r e s s B o o k I m p o r t T o o l
F i l e V e r s i o n
6 . 0 0 . 2 9 0 0 . 2 1 8 0 ( x p s p _ s p 2 _ r t m . 0 4 0 8 0 3 - 2 1 5 8 )
I n t e r n a l N a m e
W A B M I G . E X E
L e g a l C o p y r i g h t
M i c r o s o f t C o r p o r a t i o n . A l l r i g h t s r e s e r v e d .
O r i g i n a l F i l e n a m e
W A B M I G . E X E
P r o d u c t N a m e
M i c r o s o f t
W i n d o w s
O p e r a t i n g S y s t e m
P r o d u c t V e r s i o n
6 . 0 0 . 2 9 0 0 . 2 1 8 0
V a r F i l e I n f o
T r a n s l a t i o n
@ I @ @ @ @ @ @ @
U T F - 1 6 L E
U N I C O D E
m s c o r e e . d l l
A R 6 0 0 2
- f l o a t i n g p o i n t s u p p o r t n o t l o a d e d
- n o t e n o u g h s p a c e f o r a r g u m e n t s
- n o t e n o u g h s p a c e f o r e n v i r o n m e n t
- a b o r t ( ) h a s b e e n c a l l e d
- n o t e n o u g h s p a c e f o r t h r e a d d a t a
- u n e x p e c t e d m u l t i t h r e a d l o c k e r r o r
- u n e x p e c t e d h e a p e r r o r
- u n a b l e t o o p e n c o n s o l e d e v i c e
- n o t e n o u g h s p a c e f o r _ o n e x i t / a t e x i t t a b l e
- p u r e v i r t u a l f u n c t i o n c a l l
- n o t e n o u g h s p a c e f o r s t d i o i n i t i a l i z a t i o n
- n o t e n o u g h s p a c e f o r l o w i o i n i t i a l i z a t i o n
- u n a b l e t o i n i t i a l i z e h e a p
- C R T n o t i n i t i a l i z e d
- A t t e m p t t o i n i t i a l i z e t h e C R T m o r e t h a n o n c e .
T h i s i n d i c a t e s a b u g i n y o u r a p p l i c a t i o n .
- n o t e n o u g h s p a c e f o r l o c a l e i n f o r m a t i o n
- A t t e m p t t o u s e M S I L c o d e f r o m t h i s a s s e m b l y d u r i n g n a t i v e c o d e i n i t i a l i z a t i o n
T h i s i n d i c a t e s a b u g i n y o u r a p p l i c a t i o n . I t i s m o s t l i k e l y t h e r e s u l t o f c a l l i n g a n M S I L - c o m p i l e d ( / c l r ) f u n c t i o n f r o m a n a t i v e c o n s t r u c t o r o r f r o m D l l M a i n .
- i n c o n s i s t e n t o n e x i t b e g i n - e n d v a r i a b l e s
D O M A I N e r r o r
S I N G e r r o r
T L O S S e r r o r
r u n t i m e e r r o r
R u n t i m e E r r o r !
P r o g r a m :
< p r o g r a m n a m e u n k n o w n >
M i c r o s o f t V i s u a l C + + R u n t i m e L i b r a r y
A j a - J P
S u n d a y
M o n d a y
T u e s d a y
W e d n e s d a y
T h u r s d a y
F r i d a y
S a t u r d a y
J a n u a r y
F e b r u a r y
A u g u s t
S e p t e m b e r
O c t o b e r
N o v e m b e r
D e c e m b e r
M M / d d / y y
d d d d , M M M M d d , y y y y
H H : m m : s s
k e r n e l 3 2 . d l l
U S E R 3 2 . D L L
( ( ( ( ( H
( ( ( ( ( H
z h - C H S
a z - A Z - L a t n
u z - U Z - L a t n
k o k - I N
s y r - S Y
d i v - M V
q u z - B O
s r - S P - L a t n
a z - A Z - C y r l
u z - U Z - C y r l
q u z - E C
s r - S P - C y r l
q u z - P E
s m j - N O
b s - B A - L a t n
s m j - S E
s r - B A - L a t n
s m a - N O
s r - B A - C y r l
s m a - S E
s m s - F I
s m n - F I
z h - C H T
a z - a z - c y r l
a z - a z - l a t n
b s - b a - l a t n
d i v - m v
k o k - i n
q u z - b o
q u z - e c
q u z - p e
s m a - n o
s m a - s e
s m j - n o
s m j - s e
s m n - f i
s m s - f i
s r - b a - c y r l
s r - b a - l a t n
s r - s p - c y r l
s r - s p - l a t n
s y r - s y
u z - u z - c y r l
u z - u z - l a t n
z h - c h s
z h - c h t
A A A A A A A
A A A A A A A A A
A A A A A A A
C O N O U T $
C : \ c F O N s l V s . e x e
C : \ K h D T r r M x . e x e
C : \ u L J j K I p Z . e x e
C : \ e g g g h b N 5 . e x e
C : \ Z i A 9 4 e z q . e x e
C : \ Y E s W H B S y . e x e
C : \ C H 5 F D q Z M . e x e
C : \ H s r H m X q p . e x e
C : \ I v 5 2 t L N M . e x e
C : \ h C 8 3 x 5 I 7 . e x e
C : \ G j 0 j G 6 W a . e x e
C : \ D N b U 4 v s q . e x e
C : \ i 3 X v 8 5 n s . e x e
C : \ c W j z 7 e 7 o . e x e
C : \ f _ f T 9 f V x . e x e
C : \ 5 L B u t W H S . e x e
C : \ i U D t v _ S 8 . e x e
C : \ S s j 1 d E V X . e x e
C : \ r m i C j T g u . e x e
C : \ m v B N l w j H . e x e
C : \ C U H e U L v 7 . e x e
C : \ 0 p P j 1 e o S . e x e
C : \ q m 7 A h y y S . e x e
C : \ p n r x R Q 5 7 . e x e
C : \ R D H E h V 5 7 . e x e
C : \ W S b M S F K 5 . e x e
C : \ d n P 5 M l n m . e x e
C : \ o O K 8 c Z h V . e x e
C : \ N D B G R e O Y . e x e
C : \ b L y 8 H A E U . e x e
C : \ e u m s v 6 v z . e x e
C : \ L J G w T b F F . e x e
C : \ 4 V q V P F X r . e x e
C : \ Q j 2 o H U N j . e x e
C : \ n z T o 8 M L q . e x e
C : \ h N P Q q K l t . e x e
C : \ b R Q c 2 K 7 N . e x e
C : \ T Y W D H c h 6 . e x e
C : \ 3 r o 0 z 4 j U . e x e
C : \ J 5 K F P e n q . e x e
C : \ Z F x 9 o U m 7 . e x e
C : \ 0 5 y D p z D U . e x e
C : \ L d g 0 6 e k J . e x e
C : \ x t a w t m q l . e x e
C : \ n A B n s T B j . e x e
C : \ X I P d W w C g . e x e
C : \ y I A U I u J 4 . e x e
C : \ b 7 K b t R o i . e x e
C : \ 8 u 5 K b T s T . e x e
C : \ K 5 Z J Q s 3 4 . e x e
C : \ a f 8 3 6 b b 4 e d 0 b 7 1 9 f a 4 e f b 0 6 9 d a 5 c 2 7 a 1 a 0 a 8 b 4 2 d 8 6 c 7 0 3 e b 9 7 9 7 4 d 0 a f 8 7 5 e d 5 d
C : \ q y Q 8 Z M m X . e x e
C : \ P A P F a 7 Q d . e x e
C : \ B c Z Q Q 2 0 E . e x e
C : \ B 2 V A g n M x . e x e
C : \ 4 e Z 4 c n n n . e x e
C : \ V j s n 3 I U 4 . e x e
C : \ B l F 0 F D h D . e x e
C : \ a P r U 5 3 W I . e x e
C : \ 2 R m 6 W L o T . e x e
C : \ z h r 7 h _ N 2 . e x e
C : \ k N I s K 4 s o . e x e
C : \ o Y 2 L S A B w . e x e
C : \ s m q B 5 G I Y . e x e
C : \ G 3 D f l 1 y 6 . e x e
C : \ 5 U U e X 2 N v . e x e
C : \ c N T A e _ u d . e x e
C : \ X U f m f J X 3 . e x e
C : \ e w w H Z 7 y S . e x e
C : \ a m Z T j 7 8 m . e x e
C : \ u T Z m u f 4 h . e x e
C : \ h s e 2 0 y 3 R . e x e
C : \ f F i r 1 r _ R . e x e
C : \ F _ V B _ i d M . e x e
C : \ N g o z 4 5 6 v . e x e
C : \ c V _ G C x T k . e x e
C : \ q 5 V L W Z v d . e x e
C : \ 7 m W 9 _ P W b . e x e
C : \ V 7 9 x U C k T . e x e
C : \ o G v a Y L d S . e x e
C : \ U 2 C B R 5 z 8 . e x e
C : \ f h Q V 1 2 o C . e x e
C : \ E c p y 7 W P Y . e x e
C : \ H Y T Z U s 7 P . e x e
C : \ J m e R U x O D . e x e
C : \ W W j O k O r L . e x e
C : \ G P S w U k q Q . e x e
C : \ m W f j c y G A . e x e
C : \ 7 i w I 9 n _ 1 . e x e
C : \ X 8 y w x c n x . e x e
C : \ c G K f 1 1 x u . e x e
C : \ y m E 0 A 7 V V . e x e
C : \ O i 8 z 6 P t i . e x e
C : \ k T w p h 0 w y . e x e
C : \ 3 D y d t V 4 G . e x e
C : \ w 5 c A n l 4 y . e x e
C : \ w q J h V h G T . e x e
C : \ R 5 h 4 6 V l v . e x e
C : \ c D q s i g b c . e x e
C : \ O k X b 0 W N I . e x e
C : \ _ l 0 3 U 0 g X . e x e
C : \ G N U m u j X 6 . e x e
C : \ C W M F P j 6 u . e x e
C : \ 5 l S w B j 5 G . e x e
C : \ a f n i e 5 r w . e x e
C : \ 7 b X y m d Q M . e x e
C : \ E 1 z J C I D N . e x e
C : \ b d M L T 1 A Q . e x e
C : \ p O I S c Y e c . e x e
C : \ B O c g I z q v . e x e
C : \ u r 7 g 8 w 8 i . e x e
C : \ z 4 K z g o j I . e x e
C : \ s 9 J Z C q G d . e x e
C : \ v w 0 G u s m g . e x e
C : \ s y u S M V y G . e x e
C : \ L O W H c d 2 J . e x e
C : \ t S U P p 2 _ b . e x e
C : \ I g i f 5 e k f . e x e
C : \ r t y J T X A 3 . e x e
C : \ U 4 G i R P 8 y . e x e
C : \ l q u I m f B z . e x e
C : \ h n Q w 2 p d 3 . e x e
C : \ J E M D s i v L . e x e
C : \ n t C E H B 2 z . e x e
C : \ 8 V Z 0 E 2 G E . e x e
C : \ 4 Z r f M p w C . e x e
C : \ F r K _ V X G e . e x e
C : \ D D V T Z i v Y . e x e
C : \ W I 7 u U 4 j D . e x e
C : \ L C E i B N d N . e x e
C : \ N j x p l l X w . e x e
C : \ 1 L t s j f P m . e x e
C : \ r 3 7 b X v T Y . e x e
C : \ e V C 2 w l Z R . e x e
C : \ R H K U A f V _ . e x e
C : \ n y y 5 3 g 5 8 . e x e
C : \ C f 1 V _ x T 1 . e x e
C : \ U x k f w k N n . e x e
C : \ x u X F 6 w N E . e x e
C : \ g O R V T K S N . e x e
C : \ O G H W 4 H N P . e x e
C : \ u F S m l y s 2 . e x e
C : \ F 9 h J 3 Z B D . e x e
C : \ A I 5 Z 0 K B E . e x e
C : \ 3 O D P 6 q v s . e x e
C : \ m S 0 Q 0 u L s . e x e
C : \ P R Q d w A t T . e x e
C : \ 2 9 2 a 1 5 c 9 8 5 0 a 8 0 d 3 5 3 4 d 1 9 2 b f c 0 4 5 d f 8 5 c d 9 b a 1 a c 1 4 1 c d 9 e a a a b 3 5 f 8 4 1 d 6 c 7 4 e
C : \ E C 1 h 9 V U v . e x e
C : \ z l E 0 V f N B . e x e
C : \ H e r a h 8 9 c . e x e
C : \ g C j R n 1 R u . e x e
C : \ B V r i 6 k p F . e x e
C : \ V X u o y u g v . e x e
C : \ 7 E E X t U B c . e x e
C : \ Z I c T _ 8 f O . e x e
C : \ 5 u g R Z X S 6 . e x e
C : \ D b T Z Y F W q . e x e
C : \ p i j L t j d O . e x e
C : \ 5 a v P 6 b E m . e x e
C : \ H W r j 0 N O 9 . e x e
C : \ G h T P 7 5 9 Q . e x e
C : \ A 3 6 G I x d j . e x e
C : \ h g _ S B v x R . e x e
C : \ i u S M z 6 p Y . e x e
C : \ X 8 x X T I I v . e x e
C : \ A T r i K M V f . e x e
C : \ t H U t J m U k . e x e
C : \ o y U 5 5 O 0 Z . e x e
C : \ A n f b 9 _ r t . e x e
C : \ Q 3 L o Y K r O . e x e
C : \ q x C d Y f Y O . e x e
C : \ r o m W d 8 e q . e x e
C : \ 5 t v S E U P T . e x e
C : \ p x 0 3 _ H q o . e x e
C : \ q j T 4 W r d z . e x e
C : \ z s n a N d j q . e x e
C : \ J X g z i g f y . e x e
C : \ m 2 r R V H h b . e x e
C : \ J L A _ 5 c 0 f . e x e
C : \ w a 3 p y N o E . e x e
C : \ h P 1 A c R U B . e x e
C : \ Q l Q 8 q t Z t . e x e
C : \ f h 8 x T L 5 f . e x e
C : \ M O O K v 1 0 6 . e x e
C : \ 8 3 9 1 3 2 3 3 d 5 9 0 0 f 7 d 2 c b 4 3 4 8 a 4 e a 2 0 b 4 d c 6 c e a 3 4 1 3 5 9 d c 8 3 d 9 9 e 5 1 0 8 c 8 f 2 b a 2 2 8
C : \ 7 f e b 5 0 5 f 0 8 d 9 3 2 8 4 6 c d 0 9 9 2 a 0 8 f 3 f 0 a 6 9 f 3 4 c d f f 7 7 e 0 7 f 2 0 8 e 6 6 8 1 f 0 9 1 b 5 3 e 9 f
C : \ J 1 H _ l X Y 0 . e x e
C : \ I Z 4 e 0 n 4 5 . e x e
C : \ v l 6 w 9 w F P . e x e
C : \ k q 1 v T o E t . e x e
C : \ d 7 A W 0 p T h . e x e
C : \ p L _ 0 R p r x . e x e
C : \ U z O 8 r z 6 M . e x e
C : \ 3 U 4 l Z H 4 2 . e x e
C : \ I 5 A F K 3 A 5 . e x e
C : \ y 7 _ m 4 g K h . e x e
C : \ i w 6 3 C O V 5 . e x e
C : \ Y D W 1 b S m N . e x e
C : \ j F N d q B 0 u . e x e
C : \ s G I 2 i X O C . e x e
C : \ o S g P t 0 C I . e x e
C : \ L _ Q 1 7 3 Q 2 . e x e
L r m a s o
. n N a r o r a t r a r a r a v f a d C
l r y e e e r o d y d o
e r r a r h r h r a n o
n n n n a n g n
a r a / n - n n a o d l n
n a r a n a r n u
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 5 d 7 4 4 1 9 0 a 5 a 2 4 1 c 2 e f a b b b 0 1 2 9 a 8 5 0 1 4 2 4 2 4 a 9 0 c 1 f c c c d 8 6 2 5 4 6 2 4 2 1 7 d 1 c 2 5 4 0 . e x e
C : \ 2 3 e 5 c 3 f 2 4 3 3 f 9 c b f 5 7 c c b 3 6 3 8 2 a 5 d 1 3 6 9 0 b c 1 7 1 8 9 e 4 0 2 a 5 6 9 1 1 7 f a 1 f 9 e f f 7 2 4 3
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b i w a g o x . e x e
C : \ e 2 c 6 2 8 c 3 d 7 4 e f 7 c 9 b 5 b 1 1 b 5 2 8 8 1 2 1 9 9 3 0 4 1 a 0 8 4 a 1 f b c d b 1 3 b b 9 0 f 6 9 f b 5 7 9 f 4 d 8
C : \ e 7 4 3 1 5 4 7 3 7 7 7 9 4 7 2 e 2 d 1 a e a 8 6 8 1 5 d b 4 5 1 f c 8 3 1 1 5 9 d f 9 8 f 8 8 3 5 0 4 9 0 3 3 2 4 0 d e 5 c 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b i w a g o x . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b i w a g o x . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b i w a g o x . p e 3 2
C : \ 0 d f 2 5 7 9 b 3 2 d 1 b c f 7 5 0 a 5 c 1 c 7 4 d 1 4 1 e d 7 d f 8 9 c e 8 8 8 0 7 d 0 f 1 2 4 9 4 9 a 4 9 0 b 3 f c d 6 a e
C : \ 5 3 0 6 0 8 4 f d a 4 5 a a 8 3 6 1 1 3 3 e a c 5 7 2 f 0 2 8 3 4 7 7 3 8 8 5 b 2 4 0 5 0 9 1 e 0 6 1 0 d 6 9 6 d 3 7 5 e 1 e 4
C : \ 4 1 e 0 0 6 8 8 c d 0 8 6 8 b 8 6 4 d 0 0 8 c 3 c 3 c 7 b c f 8 2 e 3 c 0 b 4 3 0 2 4 8 c 3 6 d 1 b 2 2 0 5 a e 8 7 0 7 0 3 f a
C : \ 6 a c 2 6 0 1 2 9 b 3 6 7 e 4 9 b e 7 d e 9 b 8 c 8 a 8 2 1 7 4 0 4 f 7 8 8 6 9 f 6 1 2 5 3 9 d 1 8 2 6 a 5 0 c 8 2 c f 0 3 c 0
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b i w a g o x . p e 3 2
C : \ 6 f a 7 4 e 2 5 7 4 f 0 5 d 1 4 e a 2 d d 9 5 c a c 9 5 4 5 2 2 d a d d a e 0 8 1 1 0 1 4 c f 9 9 4 a 8 4 7 f 7 2 6 7 0 6 4 e 5
C : \ d 6 c 6 9 5 a 5 3 9 a 0 c b 1 4 f 8 1 8 0 7 7 e 1 c 2 3 6 c 0 4 9 6 2 a 5 c a c e 1 a 2 9 5 9 e 1 5 e f 2 b d 5 f 0 1 5 d 9 0 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b i w a g o x . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b i w a g o x . p e 3 2
C : \ d f d 1 0 2 c 3 3 0 e 9 6 b 8 a d 7 8 f b 4 e 6 8 c 6 e e f d 1 2 0 2 4 7 7 1 f d 3 6 1 7 a d 6 8 4 3 f 8 9 b b e 5 c 8 3 d e 2
C : \ e a 6 9 1 5 0 a d 5 1 e 3 b f e 5 8 3 c 2 7 c 4 c e f 0 6 8 7 7 8 8 4 c 8 d 2 3 d 5 8 5 d 1 5 6 3 6 7 f d 4 4 c 7 0 b b 2 b d 7
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b i w a g o x . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 9 8 6 f 9 b 4 9 b 8 b 0 8 e f 0 _ b i w a g o x . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b i w a g o x . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ 5 4 0 c e 8 2 b f 2 6 7 f 5 a 8 - b i w . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ d a 6 4 0 1 6 3 4 a 2 0 6 3 d 0 - b i w . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b i w a g o x . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 5 7 3 b b 3 e b 4 b 6 6 6 4 4 9 _ b i w a g o x . e x e
C : \ 8 6 d 2 e 3 a e 6 a 1 f 5 e 0 7 5 9 c 2 d a 4 5 f b 3 d f 2 9 d 6 7 8 e 4 0 d 1 1 3 0 2 c 0 5 b 4 e e f 2 6 0 0 a 2 4 9 e 1 1 f
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b i w a g o x . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e b 6 4 1 a 7 a 5 7 4 5 a c 8 9 _ b i w a g o x . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b i w a g o x . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d e 2 d e e 5 5 6 6 b 0 6 3 4 a _ b i w a g o x . e x e
C : \ b 6 0 c 8 f 0 4 7 9 b 0 0 6 9 1 5 f 7 d 7 7 6 e f f d d 7 a 7 5 3 2 4 0 9 0 9 3 2 4 c a d e 1 8 7 f 0 c 5 6 b 9 b c 7 3 8 e 4 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b i w a g o x . e x e
C : \ d a f 2 8 e 1 2 3 a b a 6 a 4 3 5 d 3 5 f 7 a a d 9 6 b a f 1 e 7 f 3 9 a 2 9 8 c f 6 2 5 b 6 c d 9 e 1 b 6 d e e e 8 a d d 7 d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b i w a g o x . e x e
C : \ 4 c a 5 0 1 5 c 5 4 3 7 a 2 3 a 2 e 4 5 8 9 1 b 9 a 2 5 7 a e 0 1 c d 8 6 3 8 5 d 7 a f f a 8 d 1 4 2 d a 3 2 7 8 8 8 2 e 6 5 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b i w a g o x . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b i w a g o x . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e e 0 e 0 4 6 c 9 7 0 8 6 b a 9 _ b i w a g o x . e x e
C : \ 9 a d 0 a d 8 0 1 d 4 0 7 d 2 1 a b 3 1 1 a 6 e d a 3 b 6 e 8 5 b 9 5 7 4 2 f a 8 0 5 9 1 5 e e e 5 a 3 c d 8 6 8 a 3 7 1 1 0 5
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b i w a g o x . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d 7 4 d c 5 c 5 2 0 b 9 5 7 7 2 _ b i w a g o x . e x e
C : \ 2 9 f 4 6 7 6 0 7 8 a d c 6 1 a 3 2 7 2 a 1 7 6 c b 3 5 5 9 1 a c 9 5 6 e 1 9 5 b 5 3 8 e 1 e 2 c b 5 d c 7 e 4 9 a 7 7 0 3 7 f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b i w a g o x . e x e
C : \ f 6 b a 3 4 e 7 0 1 0 1 c 5 3 d d 0 c c 6 c 5 2 d 3 0 f 0 9 1 1 d 9 8 f 6 d 0 f 3 1 b 5 4 f 9 2 2 0 0 1 b 1 d 5 f 8 7 c 7 6 4 f
C : \ 4 1 f 1 6 4 a b 8 b 2 9 b 1 6 9 0 c d c a d 2 d d 7 c 5 4 c e 0 2 3 1 8 d d 2 5 d 8 8 3 5 8 4 4 7 1 8 3 0 6 6 3 c 9 0 7 7 3 7 0
C : \ b 5 5 b 0 b c b d f f 6 3 8 4 e 0 d 8 1 9 b 0 0 8 0 5 f e f 4 0 f a 4 8 b c a 1 7 1 0 8 e 0 3 7 4 e d 1 4 b 3 0 6 b a 3 9 3 2 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b i w a g o x . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b i w a g o x . p e 3 2
C : \ 8 4 8 e b d b 6 a b 5 8 2 b b 6 1 9 5 5 f 6 8 c 0 d d 6 6 c 9 9 5 0 5 c d e f f 6 7 7 2 7 2 e c 9 0 0 c e f 0 3 4 9 8 d 4 e 6 0
C : \ 1 3 0 8 e 2 7 b c e c 5 a 8 7 8 e c 2 c 9 0 5 0 7 f 7 4 7 8 1 9 0 1 1 7 6 3 3 d f 4 8 0 f 9 5 7 c c 2 b 4 3 6 7 9 7 1 b b 0 5 e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b i w a g o x . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c 4 3 0 d 6 7 6 3 b 5 7 f 0 f 7 _ b i w a g o x . e x e
C : \ d 2 a d 5 d 0 d 3 2 c e 6 3 f d 8 5 0 6 3 7 4 5 9 3 7 c 7 7 9 a f c c 1 b f 2 a 5 3 5 8 a 9 f c 9 0 e 6 e 6 0 5 8 a 2 9 2 3 e 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b i w a g o x . e x e
C : \ 9 e 4 8 7 3 7 5 3 5 9 4 0 2 8 9 4 d 0 8 3 3 4 a 2 3 c e b 7 7 8 b 0 0 7 0 d 1 b d 3 1 5 3 6 6 f 5 4 6 0 7 9 5 7 7 5 3 b d 6 f 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b i w a g o x . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b i w a g o x . p e 3 2
C : \ f K L u b v R x . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f 9 1 a d 5 2 f a e e 6 3 d b e 3 9 c c e 9 0 4 1 d a a 3 1 4 2 . v i r u s . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b i w a g o x . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 0 8 a 2 a 3 f f b b b 9 e a 2 7 _ b i w a g o x . e x e
C : \ 8 b c 1 d b 0 b f d c e 2 c a 9 6 d 5 5 0 6 2 a a 5 0 3 1 8 9 3 3 8 8 7 a e 5 d 9 f 8 c 9 8 4 0 0 f 9 e 2 5 4 9 f 8 8 6 f f 6 9
C : \ 3 5 6 b f 5 2 b 1 e 6 a 6 0 e d 0 3 2 e f b 8 1 1 5 3 8 c b 9 8 e 6 a 9 6 2 f 5 9 9 2 8 3 b 4 1 7 4 8 f 6 d c 4 2 5 b 9 7 a 1 3
C : \ e 0 1 a a f a 9 8 1 e e f 4 7 8 d 9 b a 8 b 9 4 d 5 7 3 0 6 c 2 0 c 8 a 5 8 d 6 3 5 4 3 2 c 4 f 4 2 d 3 6 3 4 4 f 7 3 4 1 3 9 b
C : \ 5 f 7 4 3 d 9 3 8 0 9 6 a 2 c b 5 1 1 4 3 7 c 4 0 c 5 2 9 2 1 7 c d 4 5 5 c 7 c 2 a 8 8 0 7 f a b f 8 5 7 3 4 d d c c b e 6 9 c
C : \ 0 d 2 4 f 6 2 6 a 9 f 1 d b 0 5 6 6 a d e a e 1 7 0 8 f f f 2 7 e 2 6 7 f c 6 5 c 2 3 3 c 5 0 3 e b a 4 7 0 1 5 e 0 0 4 c d 5 5
C : \ 9 9 d 2 d 3 2 b e 9 d 6 4 6 f 8 7 1 f 6 5 5 7 1 a 5 1 d 1 1 7 2 5 4 8 f 3 e c 8 f 4 b 0 8 0 a 1 5 7 b a e 5 5 6 3 8 d a 4 a 9 6
C : \ c 1 1 3 b 3 a c b 2 e b e 3 4 6 1 c a 3 6 1 1 1 b 2 3 0 0 f f c a 9 9 7 2 3 f e 4 d b 1 8 0 d 4 e 4 c 4 1 2 0 8 d e 0 2 8 b c 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b i w a g o x . e x e
C : \ a d b 7 0 1 0 8 7 d f 0 e d d 6 2 f 6 5 a a 3 6 2 f f 9 5 6 e b 1 1 3 0 2 1 3 3 b 8 3 0 b 1 3 f b 6 b 7 d c 1 b 0 8 d 8 0 2 7 e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b i w a g o x . p e 3 2
C : \ f 2 3 a d 6 e f d 7 7 f 4 4 9 9 a 6 d 6 c f 2 6 2 0 4 7 b e c d b f 2 2 f a 6 2 b 7 4 a 5 c e 7 e 5 6 a 1 b 3 8 8 2 3 9 0 c 7 6
C : \ 0 7 8 f 2 7 f 5 3 2 f f 3 f c 5 4 b 7 b b f e 7 2 d 1 6 1 3 4 b d 6 e 7 6 3 1 1 0 6 3 4 e 0 8 3 e c 2 1 b d b 7 2 e e 7 a 0 f 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b i w a g o x . e x e
C : \ 6 b e 7 1 a c f e b 5 2 b f 2 1 1 1 b f d 9 1 d f 0 6 9 d f 6 5 4 5 e f 1 9 e b f c 1 f 7 4 1 9 d 8 7 e 0 b e b b 1 5 6 4 0 2 4
C : \ d 4 c 4 c d 2 3 7 4 4 4 e 1 9 6 d e c 5 5 d 8 c c c 1 e 5 6 6 e 8 8 3 d 1 3 0 2 e 5 e d f d e 8 6 0 b a f 1 9 f 8 8 8 a b 9 a 2
C : \ d 5 2 7 5 4 6 7 0 0 7 5 f 6 9 9 5 d 7 5 3 5 3 5 b 4 3 a 6 1 c c 9 0 a a 1 c a f 7 7 c 4 a 7 c b 5 8 6 6 7 f a e e e f e 1 8 2 a
C : \ e 5 2 1 b 9 1 6 f b 6 e 1 2 1 b f 3 b 6 c 8 9 1 0 a e 1 e 6 4 3 8 5 4 7 5 4 6 a 7 1 a e 3 9 b 3 8 9 6 f e 1 8 2 7 4 e 8 c 2 0 f
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b i w a g o x . p e 3 2
C : \ 9 4 5 4 f 7 c a d 3 4 9 2 1 0 6 b a 9 f d 7 5 7 9 5 b c 9 e 5 b 9 b 4 8 3 4 d 3 c d 5 c 5 5 3 9 d d c 4 b 2 d 0 d b 4 a 8 b 2 f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b i w a g o x . e x e
C : \ b 0 f d 1 c e e 7 8 b a 5 d 1 c c 2 f 2 5 1 d 7 8 4 c 1 c 6 d 9 f b 9 f 5 6 5 5 5 b f b c 9 b 2 0 b f 3 d 9 5 0 d f c 9 c 2 b 8
C : \ 6 3 1 5 d 1 6 8 a 1 9 f 7 b 9 4 4 c e a b 1 6 d c 1 0 f 6 d c 2 6 8 b 6 e c e 6 d 9 d 9 d e c 9 a 5 e d 0 b c 5 2 1 2 b 3 e f 7
C : \ 3 3 y Y i G c 6 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f i l e . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d 2 e 9 d 7 0 4 e b 7 a e 2 5 6 _ b i w a g o x . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 3 2 b 7 5 d a c 3 4 5 4 0 a d d 7 e b 2 a a 1 7 8 3 4 6 a 8 d 7 f 1 0 e 1 c a 8 e e 5 6 1 4 9 0 e d 5 7 6 a c c 9 5 d e d a e 3 . e x e
C : \ 6 2 d 3 8 a 1 b 5 8 1 b b b 9 a 3 a 8 5 4 8 9 6 8 0 1 9 9 f 0 2 e 0 2 7 d 9 1 9 3 c 0 7 8 5 b d 5 9 4 2 e 3 0 5 c c 8 8 c 8 3 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b i w a g o x . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b i w a g o x . p e 3 2
C : \ f b 0 5 b d 5 3 7 8 5 d 5 6 b d 9 c 8 5 9 7 e 3 d 5 a 6 7 e e c 3 3 7 9 c 7 f 4 7 4 1 8 1 1 a 4 0 b 6 a c 6 f 7 9 b 1 8 a 9 4 3
C : \ 0 5 f e 2 5 2 0 b 4 9 a 3 6 c f b 0 0 b c 7 c 9 8 0 0 6 a a c b e 2 e d 6 7 d e d d 3 d 0 f 2 d 3 f 8 f e e d 6 b 8 d 6 b e 3 f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b i w a g o x . e x e
C : \ 3 4 f a 4 9 4 4 0 1 6 7 c b 2 6 f f b 3 3 f e 6 7 c 6 2 c 0 a 7 8 3 3 0 e 9 9 5 b 3 6 3 7 9 c 2 f 7 2 d d 8 a 1 e c 4 f 3 3 3 6
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b i w a g o x . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a 3 4 8 7 0 7 1 4 8 f 1 9 8 8 _ b i w a g o x . e x e
C : \ f 4 9 0 a a 0 7 2 f 0 0 3 9 e a 6 e 8 1 c 4 0 b 5 4 9 c 2 e 2 4 f 6 b f c 3 d 9 4 f 1 3 c 2 a 5 9 4 d a 5 8 0 8 d e 0 2 b a 8 d
C : \ b a 8 c 0 9 8 7 9 4 e 7 9 6 f f a 9 a 6 1 4 1 a 4 3 6 2 1 7 4 2 6 a 9 9 5 c 7 d 8 8 b 3 6 1 8 7 b e 0 b 0 7 b 9 9 1 1 5 4 2 8 8
C : \ 1 4 e e 5 7 3 a f 5 3 3 1 6 f a 1 5 4 e f d 1 8 4 2 9 8 0 c 7 9 a 7 1 4 7 a 4 6 4 e 1 0 3 d 3 f 4 0 6 8 6 f 4 2 5 6 4 5 1 b 8 3
C : \ 6 4 9 9 9 8 6 3 a 1 1 1 3 5 5 f 7 4 4 f f 4 f 9 8 f 4 e a a a 6 0 0 3 3 d a e b c 6 9 5 a 3 f 5 4 d 7 d 5 2 3 9 8 9 d c c 2 9 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b i w a g o x . e x e
C : \ 4 d 2 a 8 2 e a 1 f f f 2 8 f f 1 2 3 a 2 8 3 d 9 4 9 9 7 6 0 1 6 3 e 9 f 5 7 3 9 d 4 a b f 5 9 9 4 6 6 8 1 1 8 8 0 8 c 2 6 5 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b i w a g o x . e x e
C : \ 5 3 e a 4 b d 1 0 8 7 d 9 3 2 4 4 5 d 4 c 2 a d 7 9 6 6 6 0 6 d 1 8 6 7 7 c 2 e 5 a d b a a 5 9 f d 4 f 7 f 7 4 7 6 0 9 a 8 e 9
Process Tree
-
004075580a54abaf6813519828cba9fe01742a9712c47182e98fa1e91305c691.exe (1784)
"C:\Users\Administrator\AppData\Local\Temp\004075580a54abaf6813519828cba9fe01742a9712c47182e98fa1e91305c691.exe"
- biwagox.exe (2660) "C:\Users\ADMINI~1\AppData\Local\Temp\biwagox.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | 1159fcfaf770daf2_biwagox.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\biwagox.exe |
| Size | 1.2MB |
| Processes | 1784 (004075580a54abaf6813519828cba9fe01742a9712c47182e98fa1e91305c691.exe) |
| Type | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed |
| MD5 | b231f892e4473c9c99179e7561229c1c |
| SHA1 | 0ba5345f5e5d5c672f63827f118a2a4f565243ac |
| SHA256 | 1159fcfaf770daf2a68916227d417daea3d8f340004528d09909b9a080300ebd |
| CRC32 | 32C51460 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.