Analysis
| Category | Package | Started | Completed | Duration | Options | Log(s) |
|---|---|---|---|---|---|---|
| FILE | exe | 2025-06-11 07:05:42 | 2025-06-11 07:23:29 | 1067 seconds | Show Options | Show Analysis Log |
procmemdump=1
import_reconstruction=1
unpacker=2
norefer=1
no-iat=1
2024-11-25 13:37:18,631 [root] INFO: Date set to: 20250611T05:51:34, timeout set to: 1000 2025-06-11 06:51:34,129 [root] DEBUG: Starting analyzer from: C:\tmp_gell1p8 2025-06-11 06:51:34,129 [root] DEBUG: Storing results at: C:\WodLRYuTH 2025-06-11 06:51:34,129 [root] DEBUG: Pipe server name: \\.\PIPE\hEUVZHP 2025-06-11 06:51:34,129 [root] DEBUG: Python path: C:\Users\Packager\AppData\Local\Programs\Python\Python310-32 2025-06-11 06:51:34,129 [root] INFO: analysis running as an admin 2025-06-11 06:51:34,129 [root] INFO: analysis package specified: "exe" 2025-06-11 06:51:34,129 [root] DEBUG: importing analysis package module: "modules.packages.exe"... 2025-06-11 06:51:35,113 [root] DEBUG: imported analysis package "exe" 2025-06-11 06:51:35,113 [root] DEBUG: initializing analysis package "exe"... 2025-06-11 06:51:35,113 [lib.common.common] INFO: wrapping 2025-06-11 06:51:35,113 [lib.core.compound] INFO: C:\Users\Packager\AppData\Local\Temp already exists, skipping creation 2025-06-11 06:51:35,113 [root] DEBUG: New location of moved file: C:\Users\Packager\AppData\Local\Temp\IObitUnlockerPortabl.exe 2025-06-11 06:51:35,113 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL option 2025-06-11 06:51:35,113 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL_64 option 2025-06-11 06:51:35,113 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader option 2025-06-11 06:51:35,113 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader_64 option 2025-06-11 06:51:35,285 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser" 2025-06-11 06:51:35,316 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig" 2025-06-11 06:51:35,363 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise" 2025-06-11 06:51:35,379 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human" 2025-06-11 06:51:35,379 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops' 2025-06-11 06:51:35,379 [lib.api.screenshot] ERROR: No module named 'PIL' 2025-06-11 06:51:35,379 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots" 2025-06-11 06:51:35,457 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump" 2025-06-11 06:51:35,457 [root] DEBUG: Initialized auxiliary module "Browser" 2025-06-11 06:51:35,457 [root] DEBUG: attempting to configure 'Browser' from data 2025-06-11 06:51:35,472 [root] DEBUG: module Browser does not support data configuration, ignoring 2025-06-11 06:51:35,472 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"... 2025-06-11 06:51:35,472 [root] DEBUG: Started auxiliary module modules.auxiliary.browser 2025-06-11 06:51:35,472 [root] DEBUG: Initialized auxiliary module "DigiSig" 2025-06-11 06:51:35,472 [root] DEBUG: attempting to configure 'DigiSig' from data 2025-06-11 06:51:35,472 [root] DEBUG: module DigiSig does not support data configuration, ignoring 2025-06-11 06:51:35,472 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.digisig"... 2025-06-11 06:51:35,472 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature 2025-06-11 06:51:35,676 [modules.auxiliary.digisig] DEBUG: File is not signed 2025-06-11 06:51:35,676 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json 2025-06-11 06:51:35,676 [root] DEBUG: Started auxiliary module modules.auxiliary.digisig 2025-06-11 06:51:35,676 [root] DEBUG: Initialized auxiliary module "Disguise" 2025-06-11 06:51:35,676 [root] DEBUG: attempting to configure 'Disguise' from data 2025-06-11 06:51:35,676 [root] DEBUG: module Disguise does not support data configuration, ignoring 2025-06-11 06:51:35,676 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.disguise"... 2025-06-11 06:51:35,676 [modules.auxiliary.disguise] INFO: Disguising GUID to 49b3c931-c86a-4b38-bb90-6f49beae8921 2025-06-11 06:51:35,676 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise 2025-06-11 06:51:35,676 [root] DEBUG: Initialized auxiliary module "Human" 2025-06-11 06:51:35,676 [root] DEBUG: attempting to configure 'Human' from data 2025-06-11 06:51:35,676 [root] DEBUG: module Human does not support data configuration, ignoring 2025-06-11 06:51:35,676 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.human"... 2025-06-11 06:51:35,676 [root] DEBUG: Started auxiliary module modules.auxiliary.human 2025-06-11 06:51:35,676 [root] DEBUG: Initialized auxiliary module "Screenshots" 2025-06-11 06:51:35,676 [root] DEBUG: attempting to configure 'Screenshots' from data 2025-06-11 06:51:35,676 [root] DEBUG: module Screenshots does not support data configuration, ignoring 2025-06-11 06:51:35,676 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.screenshots"... 2025-06-11 06:51:35,692 [modules.auxiliary.screenshots] WARNING: Python Image Library is not installed, screenshots are disabled 2025-06-11 06:51:35,692 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots 2025-06-11 06:51:35,692 [root] DEBUG: Initialized auxiliary module "TLSDumpMasterSecrets" 2025-06-11 06:51:35,692 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data 2025-06-11 06:51:35,692 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring 2025-06-11 06:51:35,692 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.tlsdump"... 2025-06-11 06:51:35,692 [modules.auxiliary.tlsdump] INFO: lsass.exe found, pid 696 2025-06-11 06:51:35,707 [lib.api.process] INFO: Monitor config for <Process 696 lsass.exe>: C:\tmp_gell1p8\dll\696.ini 2025-06-11 06:51:35,707 [lib.api.process] INFO: Option 'procmemdump' with value '1' sent to monitor 2025-06-11 06:51:35,707 [lib.api.process] INFO: Option 'import_reconstruction' with value '1' sent to monitor 2025-06-11 06:51:35,707 [lib.api.process] INFO: Option 'unpacker' with value '2' sent to monitor 2025-06-11 06:51:35,707 [lib.api.process] INFO: Option 'norefer' with value '1' sent to monitor 2025-06-11 06:51:35,707 [lib.api.process] INFO: Option 'no-iat' with value '1' sent to monitor 2025-06-11 06:51:35,707 [lib.api.process] INFO: Option 'tlsdump' with value '1' sent to monitor 2025-06-11 06:51:35,723 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp_gell1p8\dll\LvlXCnF.dll, loader C:\tmp_gell1p8\bin\UsVZZmjI.exe 2025-06-11 06:51:35,769 [root] DEBUG: Loader: IAT patching disabled. 2025-06-11 06:51:35,785 [root] DEBUG: Loader: Injecting process 696 with C:\tmp_gell1p8\dll\LvlXCnF.dll. 2025-06-11 06:51:35,801 [root] DEBUG: 696: Python path set to 'C:\Users\Packager\AppData\Local\Programs\Python\Python310-32'. 2025-06-11 06:51:35,801 [root] INFO: Disabling sleep skipping. 2025-06-11 06:51:35,801 [root] DEBUG: 696: Full process memory dumps enabled. 2025-06-11 06:51:35,801 [root] DEBUG: 696: Import reconstruction of process dumps enabled. 2025-06-11 06:51:35,801 [root] DEBUG: 696: Active unpacking of payloads enabled 2025-06-11 06:51:35,801 [root] DEBUG: 696: CAPE debug - unrecognised key norefer. 2025-06-11 06:51:35,801 [root] DEBUG: 696: TLS secret dump mode enabled. 2025-06-11 06:51:35,816 [root] DEBUG: 696: InternalYaraScan: Scanning 0x00007FF84A790000, size 0x1f4542 2025-06-11 06:51:35,832 [root] DEBUG: 696: InternalYaraScan hit: RtlInsertInvertedFunctionTable 2025-06-11 06:51:35,832 [root] DEBUG: 696: RtlInsertInvertedFunctionTable 0x00007FF84A7A090E, LdrpInvertedFunctionTableSRWLock 0x00007FF84A8FB4F0 2025-06-11 06:51:35,832 [root] DEBUG: 696: Monitor initialised: 64-bit capemon loaded in process 696 at 0x00007FF8234D0000, thread 4456, image base 0x00007FF60D500000, stack from 0x0000008EFAA74000-0x0000008EFAA80000 2025-06-11 06:51:35,832 [root] DEBUG: 696: Commandline: C:\Windows\system32\lsass.exe 2025-06-11 06:51:35,848 [root] DEBUG: 696: Hooked 5 out of 5 functions 2025-06-11 06:51:35,848 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread. 2025-06-11 06:51:35,848 [root] DEBUG: Successfully injected DLL C:\tmp_gell1p8\dll\LvlXCnF.dll. 2025-06-11 06:51:35,848 [lib.api.process] INFO: Injected into 64-bit <Process 696 lsass.exe> 2025-06-11 06:51:3 <truncated>
Machine
| Name | Label | Manager | Started On | Shutdown On | Route |
|---|---|---|---|---|---|
| win10-2 | win10-2 | KVM | 2025-06-11 07:05:42 | 2025-06-11 07:23:08 | none |
File Details
| File Name |
IObitUnlockerPortabl.exe
|
|---|---|
| File Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| File Size | 2000094 bytes |
| MD5 | 6e33e1b5dccb1b7d30b95c24c3c430f7 |
| SHA1 | 116cd6c6260e11ec8bdde1a89558ee10660704e5 |
| SHA256 | 30409e8c030059b1af27f735f3715186da383906ff7abc2788338a0339a382db [VT] [MWDB] [Bazaar] |
| SHA3-384 | 58318aa1ec56b84e0f15526f71b48ed57198b4976ca854f1585e9bb1eb24482262a30a499976dc121c802a8dbbecb4db |
| CRC32 | 6492077A |
| TLSH | T1249533849698C211F0E11D7122F6DAE37632FA014A0CAB5BFFA93D472D95A00ED4FBD5 |
| Ssdeep | 49152:1L89iZZem/DcEJ6J1I1+EN0jlqKttjomkD+L:J4m/oJ64Jttj53L |
| PE | File Strings BinGraph Vba2Graph |
Full Results
| Engine | Result | Engine | Result | Engine | Result | Bkav | W32.AIDetectMalware | Lionic | Trojan.Win32.Generic.4!c | CAT-QuickHeal | Trojan.Ghanarava.1749108011c430f7 | Cylance | Unsafe | Sangfor | Trojan.Win32.Agent.Vlv9 | K7AntiVirus | Unwanted-Program ( 005b46461 ) | K7GW | Unwanted-Program ( 005b46461 ) | ESET-NOD32 | a variant of Win64/IObitUnlocker.A potentially unsafe | DrWeb | Program.Unwanted.2520 | CTX | exe.trojan.iobit | Sophos | IObit Unlocker (PUA) | GData | Win32.Application.iObit.B | Varist | W32/ABApplication.GFFX-4824 | Xcitium | ApplicUnwnt@#1oza3xtrco8jq | Microsoft | Trojan:Win32/Kepavll!rfn | Detected | Malwarebytes | Generic.Malware/Suspicious | TrendMicro-HouseCall | TROJ_GEN.R002H01E825 | TrellixENS | Artemis!6E33E1B5DCCB | MaxSecure | Trojan.Malware.328790022.susgen | DeepInstinct | MALICIOUS | alibabacloud | Trojan:Win/IObitUnlocker.A |
|---|
HV4d/
f%uvJ6
:&prS
@.data
/(3>3k
9T|34
H>>QL
KXLlz
t,'{2C*r
a-F"l
F:7r&W
fRul-G
oA=!#
?7S[J
y:w"O$
i8{dl|
D{{9~
O@5IO
%0cU.
!>D\O
^xz+L
6rlh9
vWF"j
lV`&b
;vv> 2
;mOJ}zI
7#\ym
AVU"z
Y-8!bt
xt4>;
GlV[tm
V\}6F~
x+d}0,
$IZked
B:+45
G*@x[
U.$di
d<i|L/
Ru`10'
^YvUn
_F<VH
\h:},
i+L`{
M7gD,
*,Va37o
~\{*+V0mfB
>}iyIPx{
yb_DDD
.#EZ5i
>EAE^$AM",&
J"P?u
(N-kT
uG(rf
USERENV
4cAY:
CreateBrushIndirect
"j9ti
thY\8c
0b:pnj
koJQ;
YDI\N
?bTST
X+ME0=j
P<S%=
3cQDa
t>PjZ
8k9$D"Wj
Xx+:wv
J$Z_GBF
040904b0
|~jT$K
cM<@bu
Y9y<zS
CGM\N
sHNd-;:q
>OTr"
`->kg
L?BN$
Jj|7\
Tlv~_
^Q!Gl
8GgHRe
'g5.9t
lf?OP
dyqGRe6
EBF&m
d$P=o
<"4n !;
zTCM[
)~#KE1
#g.D=
M9fIQ
?*$^@
IvNrd
9JkZd
LGj8:
z}\H[
9DIpW
ksm[K
J8##D
V'c8+
n6}XL
s:DQGa}|/i
adt2<B
0g__TR
('eaw
MK*e|
voU3Y
GpBVd
V\ p#
|x^44
Br2`.
%u.%u%s%s
uO&4=
uWE@F
cdHI\s
6wJ'?
LmBy_D
<&9dt(
kbZ&8
`g4<##;
PynYS
^$c@RlQ
_S1CN
"i?QA0^
x*8j#
u>LC{
T0/~Aw
}Ql">
`ueXq
+(q+w
e&C?U
f*Gml:s-
|6b0r
1D 0Q(G{
lS}2a
i"wNR
@+??{
n~Lt)F
|[|"O@mvE
xNbT#
8F]s:a
R[GCy
!fIcg
6(,DowJy
E$-Px
J1\r|
av"o\
E}&WZ
<ywdH
<2*_Y
m_Ea50*?
1!S;g
KTZkQ
~H\>P
u(5wM
bW[{H
mzJpd
I/JVJN
=:|W&
89RSK
X(~_S
/.h-2
Ikc,"g)DVgD
sH)\qR
t)iDK(
se$.M+
rwf&^
f.7jps
KgAy
M#wzI
"$wc:Z
<*APn
`-;m-
X$6paQ
SzM5s
Yd<a^
)TbRP
c.lML
#Jr"}
Z#eF,NB_*d0
+&7{3
_;']q
'q_%G
Pb@"FQ
pog)~
/^DxL
a%*O3
$kuZL
8(@|l
+=.S?P?
73GfP@
>r!JszV
RU3Sy
jf8cB
{Hmm5
{4J}v
G9FXk
Fdxzj
<xK%=
p/mTxu
n3~64
fjjAg>'
E90ABy
RYNEo
"%?Su
T?4.,
aw7Tu
BbzJ8
l85s 8
ii8b
g_#_{r
fIX{ wXy
*GOxi
<_G$f
buzN|-C
c&xX[
['Sj5L
Fzwq8
Kh0.P
\Temp
n^7"Q
P0C;i$"H
CompareFileTime
`6ie~j*n
:6Rg'
WfG<L
S`j@td
h!E<
bGG7p
,#?I'
0WX$}
~SvbD
{%DHs
zJATF{1
R%3qQ
%|]M@
_f|YT~
;Dr,f)".(t
#4b]R
d7ikd
Bk;6E
RX$TA
cL(/y
8i$#2
K }8"
|)-uU`5
n_n1m
&^*>n
[7;Hg
,.klc
xZR#%
Rz;s!
g11G]
oQIUS
KLumhj
g-P|E
7:eqH
'7Q|t
Uf"gTU
4!hBJ
}=tN{k
u]y*gz"g
xcYWuG
UJG6b
-G^AM
Kb<2X
,G ?w
?rJh/
Vgjze
z7k55
(\l;3!
TQkCr
v9 6I
_8kQP*H
#O4RQ~.
/cE[A
Nd$,b
|7p&{
)Qq8V
]~KRSV
+:^hk&
!9G"M
y^OZA
'mu=\^3
{ZlU"
}Qr*ax
3:*aR
*_qj7
1lT9(
sdLWd
2zWsp
]8uILL
9`ZF2o
8/b7->
o{Eel,
JflDo
92DgL
Sb<4(
$H<V[h
#`c={
lstrcpyA
pP31.#
4mR?7
Z fPC3l
>9hWX
]\U*]
AdjustTokenPrivileges
a_7<5_
7'7uW8
tP[:=Q
nej&5]is]P
:8wk[u4
ND^?&
3.5.18.0
MG>BJI]
]=XbRxc
*0 ]E
5Z]-K
UgAM&
${)*p
%JCuy$,?
b.a(e
IFP;Z
3& R
_3?b[
uf0uJ
c|NJ^
G9;kd
$3ooE
e-wt/
6e\&{
0gwP5
DwlT@
t0>Js
ZS?97
)(@7J=
\!jCQ
B8JOn
^qBxPq
DTXJ(G
6)m8:
{Zgb*
9FJAI
Uv&+Y
}68-_
,43Qr@
dO9^|
Ln3]1
EseVO
o 2i,
??j`m
XBlUxd
|Rba;B
EIh}}
h4 >tD
8YKea
6-eM7
6*#uE
ZDg@)E}
#l?p(
x6CUH8
K=qO*
/&_G~
:{ZP&?%
v6~x3
H 1llT
U sV{
J9H{e
bH|W3
D/!w@
K"FSHx
4i!"}
I',CQ
xY~<NpjtW
GGg]OQ{
"c;;#
(dE$Wc
ta"S>
p3:<dP
o5g69
D;J`{s
sKcpW
,o;(toRl
ES_xe
C_zIY
{"V#8
d77PP
!n$xK,
SHELL32
L]3@f
xa1F$`*
OLamW
AB@l2
yu2f[:
?F]1<
?kmpV
GetModuleHandleA
.wfT9
*qeS\
*4/uR
P^cG5
04Xpm
aG"R'w
l6drL=
|KOWZ
56=8%
{J~.Q
MV PWlY
)f"Lw
fx&5#
GY\gK
jm&w,XS")
(\n36
P]IHkU#
>#V_E
3tsd!(
.rsrc
ybK|yU
\/e-g
,Yad(
'yDlS
"'f/EH
&hGFh
a;r.u?
%2ku.el
0F4KN
Ug<^<w
.%qZ!w
;d&fY*{<
6xo#gQP
()AG>Cd
;P3DG
2*6,Z247
<vT%(\
w3*EX`t
3eV(`
t2A~V
h'hDm
xcS'.7
G:A.Zxw
~F$p.
>!`9u
0B>i#R
P>Io'
QHSS}
y-8&]T
+_=,_
F`V[{
Se3o;
|%$ud
<+"0c
H8v`Y
?b';ez
D+L9'
V5x!4R
)3L2d
:%]Js
c=74u
/}b{/
GetFullPathNameW
F-HeG
t:}l
$ \9H
=3vBc
$2NQw
Ca=<i
&j[sz
#KG*BO3(
]@T\n
+4n(Y
8jhN}
C-E}NG'
oQ2vL
D"QA2
UEV_ aZm'B
7G>tTtP
:D0{;
wJP?}
[Vw t
<Qb_|&x
%9[=k
">r{%
O0)j7
_DZa/
t#SSS
Ubb$X
|`d}@@
/O1EY
[Wbl'a
h')]
x!W(2
RegEnumValueW
SeShutdownPrivilege
aakLl
"y3,%
7<eFU
A}<DvF
4^@wKz
7[*3@9
m~1"v
arBuR
TC*Om
%V?"{
&N^,}
^(5dg6cn
'})2.
'i%tB+\Qm
g#l|C
^1YBO
XQ.KB$.
0!6~mp
BS?.C*
+e=}^&
:j6Xq
'52V&
NSIS Error
".cZS
p+5iu
v?h+2x
NUT/>Fj
PD<)<D
&=Lv'
`m/Rj[
=0F\,
Dbk4M
lhVDk<
.SuEj
)]T X
* R_Ex
du-ME5
4@.o&r
E~"cA$
IhG-t:M
.text
Nx-*ll5
TBU]8_
;>.rq%
O!D%g
Gri;J
-('@9
*#hT6
Pgjr?
vrUc6
Bo~yW
69H0%D#
VwT8e
1E$=A
!Adcg
&BX7Q
/1Lth
(yt^4
aYNde^RgHB6
qq;AT
t90vD
rwtxw
q${Zj& H
VcL|E
YAcg"u
{Ej|b
1(fWh,O
>W.JPPg
laD>7{
%X{1J
J^%K>R
Q9bC~
WL0hp
xZx:Ms
k;Bzv
@:_Yh
?&wy._
pW&rY9
az3mA
^j\PN
DvF5`
."j$Bf
m+Bgh
M-iOO
{cdXd
Kg:*W
v'f"D
k0mp/
N[#O3
}=`II
?KUvT~\$~
s}J77
HPh~6
QR)-M7V
VgEmb
M|?6p
D?<JSRj
yT,|4
ZrWPW
A4(9Z
a!+B4
UJW=G
TwI73
^JR9r&U
N'rq38
b4*FU
5!av j
( L*V
iOJwOs
W#{qR
L;t|MJ
5b++ q
#Y4f5I
Y,f~ ~`
PI<R==
<j)JRe
`F.bf
uXA]<
&e5G<
T_H7.A
AmpC}`
?+y0MC(
MBqD9#0
lW*L[
7ILf.
z:B5A
+F}3X}
;O[yF
MRi1B
dzbyv
)aiTq
DeleteObject
[!hr$K
H}^UC
EmptyClipboard
sZ{<~f
Gnw4_
Q(n3(7
_=\73
0j}c&@
aGa!$
2P!i~
2)VO4
}+Z%:8p~
Hl'9/
_Q<Cmgw
"OKl<
i`?p;
Tf?IKB}
'#b4'
s6XiXG
_q%?C!
v"e,Hw
BoZU/
ibR.Z
RG !/E
z7[Go
MSN0cU
E&#<qs)
BBJ!+
wx*EPC
zCdqv
S%(a8{
I:bfh9
f`NHn
:`}Py
#rN D
04f5A=Zj
2W9lkQ|2o
Ydy0'h
CHi?[W
mLE!V
=h-k|BnV
K"#sOL
w0v[U
EndPaint
I1SKiP
3M9.g
Tl:|o
vW\X%J
WFOHZvoz
|%<hQ
^G@'?
9ONqe1
%cAAn
}Y^?z
5FT{5t
2G[yx
,$|8f
C[[>g
gR|vv
-*[5*
KCFmu
>|`%1
r4 bs
diw>TV7_
O^.-qX
gZl"z
bH#S(&qJ
^r/pw
yv~,M
.N1CL
NtAGT
Y$$k[
OcF@^;
(XfpLQ
w~I1 z\K,
~c;onY@
crA^i
2uda81
~2!Dx
"pI,O.+
'cc)m
G96zQ
#Xh#fv
XJgNFU
H5aLg
1*oQG@;hT&
2mY?/
FV+<#
L)Egx
>*/fq
=/W(.
8Y4r#
u$ir<|
W/&=_
gh+3G
n{(Dn
21DwW
hTcmO
9]|3uj|
: K9J
-(&P:
SZ.oP
YnD?(}
VXoE"
IRk{0
hL!M[
,/+B#
g5x'x.z
VzEDj
Xl]\n
LegalCopyright
/iHv69
Ff5t(M
"BTc%
2&M[0k
SendMessageTimeoutW
yHDNa
m,~SoM7
Kf_FC
SetCurrentDirectoryW
2;q I
;J7oP
sEmM<ou
^W""!
lRwtA
L@aaPZ
8V8S(
s-vJW_w{
[]mY3
JkhW'
@aRb%%
7.wMb
isl>Y0
IlrsM
a0qJ$I=V
Sghv~^
4Iu;tl4La
wqo+4K_
>ZV-x}
L]hHX
W\CN\M
l3XM$
N7tZ9
u~\EKA
;0iHB~
Nmp1o
Cb~fq
E*MFND
?O,X5
zlV~>
GetMessagePos
4r@E8\A
3l8Xy
v$Okfa
]b@,{>
]<Qez
RALej
cDj/k
6,Wc"
!yTz/
liPwz
hdxh8p
PZ0/,
f5[O}
-4VR4
k?-QS{Y
l:"x)
>S0pUi
P?f!4VO9
HRDZk
YL:z @u
$!po8
0RZ;t
9N*j\S
JTDO2/
(2?OuG
[:\V=
X'V[Y
CVMyH
;-M%X U4
iZ;qR
ImageList_Create
26|E4
UE{2XH
P)qwC
(G/6I
%lsV;
J{H]v2K
77C]e
%q/.Cy
Cs/uW
viAl'
Ge8F/
gi4blk
\YA/<C
>os}T~
O>~!j
/FVn`
Q`v-c
*)CyN
LNRV)
$S;5a3V
)Ne39`
/uapG
&#%7X
nB.e/
`{y;0P/
zpy&l)&
wFv&2
v}1-Z
qTDxkG
ygY*
9ZgUh
V[@7p
nE?JP%
U&]ts
fGUa^
?D%lh9
]Zv3qe
4co{_{
ykOj8EO
v!j&v&
,CgTj
"s:V;
ohr^J
ufl+2h@N
.PdP;
'==gB
jbHn|'
SYsi~Q7
R%gnz$
_(H[D
1kB5w=6>"P
s%255@
<:^qh
G./_4
cjP43l
{+-2.
DFa&7
bZEkT
Zo~$n
CvL\1
]8csV
?`MmG
TP1i3
S(rA~=
^`-0N=e^`P
]<w:s5
XR]+\.
=Mqn|
qJQFf>DI
pfG a
p7!J.
?c0eZ
YDb{)
[[dX5
<O_\@.
JXfL}
Dzw`a
k:}i
U`6#A3
u[he2
E TY)w
S`*b+
scrmYi
!IPO.eyp
/]&0/
AElMz%
=ii,%m
A\^I{
l3D _
T#S>gk
^PyGx>
s]go`Q
.e)f>t/
pW/7c
XS{ca
ePKGb
~c8]2-G
/|`[K
rO7j:*
1+@Y?
^/%Uo0
[soy*=
#Xz_G
q05):
For additional details, visit PortableApps.com
)r8es
NQ3T[]
b;rls
m?KC4@|
vwv|N'
:hW2e+S
35Max
79]PO
jj>xh
3S$.C
UontT
0N>qO
>}b3dn
qnVZcb
QJMH(
s$0PP
G'bH)
o3"gd
meQUSS
q@\w{
_b,.z
k_RlN&U
._/o_
Yd_!A
F0$\N5
msctls_progress32
JE8g>9,3
SHELL32.dll
&)]c"
rG:0.`
[Tk5q
&G2RCn
92y/:
6Du@(W
CLB|x
8CD_hw^
Mhf9l{:
7/GQs
jh.b)*S}
B}Q3@q
"_W'j
d'Vgt"O
rfs=!U
R/h|S
dF9tO
>_OXJ
?.NQ|ur
&l7{W$
iT"2$
n$2pb
W=K&0OG
vrBCm
8inrXg]
#3ICK
Hzm'@
b;.q3
UOj)U
<HRP-
/Evm#"Q
G\xl'
Drt~+
40%.qh\
aG/*gOmb8sG
bsu{%F,
!6O~J^
CTwU!
1N=Gf
a's@2
2wtpZl.fV\3
Bn`[G
ntyl@
SvM~_
esbNY
0w_1FCz
R{[|Y
Xf80*
(QhVH%V
kcP^XSA
c`iUU
.hmT#y
oG|Ij
[i=,+)Y
F^Unn
9)f'U
/ P6pL
CreateThread
SetBkMode
qdB[@>
,Pr-l
KOak0XN
ndt[Y7
_dbr$
)K/*%
\ >cp
_oU6p
_EBge/I
,[yp0f
nk&",5:
a9G1<h(
!zjmJ
~7AXL
sZ8<y
;0`oo5
M)m;9@SD
]4v^|
Ns^--^
/hPt5
npbQf
&2l{*
,}Uk\P
1n$q(
zA"^hV
@+>9U
po6bV
9OCAJ
<nmeb/M/
1Gb0[
EW%E]
*$_Po
a!?i2I
cZOC*>O
Q{t[A
xuKZA
Q*@W?
TLEf3<
YYCSF/
z")Xm<
eX<<s
5[0A6
-*+D&
A%I\rVg
9Wl2i
5<m=d+_t
SFsUs
KsD/p
?p&1c%
Fb'Yg
\/q+XL
|5 visz31\
z}[7Top
s6MsE
*`{Y_2QeI
YSXh}
/F:SFc
,^'?i
[:l[=Sy
cZ/f~
c<5%Tt
XBUG*
GetUserDefaultUILanguage
r=@fL
RswTVR
T4fs{,
B$bBo
<u>Eg-O
*L#gzv
IZS/V
L]"6>
rQSis
e;GH7{
hjhPt
F@$2]
0GE^r
_7.f[I
kxOk%
7Xk]D|
DH`.w
`[Rhz
PN7dN
.[bu]
/-P?pR
Mgd5l
PortableApps.comAppID
--KiO
v ?U&)
FindFirstFileW
,QQ45
i34B]
>$>f]}
wsprintfW
Qi;f4#
|tCal
bi68|
udV%1
[?@[8]"
`ZOIKF:
?J:Wz
nkAZ6
K:447-
'|4WbD$
Pd2fL
% D3t
&;3{0f
bfY>`
Ds~L)
|5ca-#
G1E"Ti"
/G63}
ix8,9
Ng&=2
l@GpD
y#v`[=
_Q(B:
gz1Gc
$tL$x=:
[ eq^
9{8~:(5
i{V0!
mT{^K
D/{|h
}[lTsZ*
T\n}=_
pnJ%@=b
2%K,&
BRH$g
Q>:U(0
!&}!r
4ww@4/
j8WUHBYs
i'Ls$@
"Bp)O1
c]1mY
*t~G$
*cV a
T *6Y
5q2eCw
@U_3Z
4:iSG
#}>V)
V'{~WP
CTO<%b
&7~^r
'q4Z<SF
Zt,wRX
V%#j]u
'Zu97
7[J>S
|.q[~C
uFy:>>
R80cJ
=-fXHA
yc n~
ZQpx2
"_]W9Ex:Ile
1/]w1
9l<x@j
@&[ax]zxY
W6NkK
~X8Nx
tG&y|
9/v@2t|ud
4#Ow0
X(/}Qn
:>H)G
8p=w7
M]poY
:~>]4
8"}6h
IDATx
Q:wdx
YWzS*${
|rn\t
)w>(;
@|N1i
*@Z''~
]D_+w<]
4TTpq.
68g73
hq-JL
#tmz6
}BLuO
o\9c)
Rpob1
G" 4r
ReleaseDC
"n8;G
M 5/X,
"dQ b
(o]}L
N}s{s
2~fju
c*phpgj
B@Dlo
A=)>Hz
9]*}0dY
<UB^y
12J{k
NY71V<8k6
4(ZT<
R:Wmob
:\j<Y
.]Mr"Wt
hu kr0
aZ-{{
Y#}k8
3,{%5
uQ9XF
%@8A$
y&IIw
VINxT
s%Ps3
Ov1@R
R-%pf.
&EFPd
[RP|>
yXuVs
+ashs
BI+%Zj
J&C:"
b=$eW
u3yo1.U
]W*>N
5ES<.dA+
+2+.F
Bp_?|
WideCharToMultiByte
7BQ8e\
w;yBk
6Q pT
8b{kw~
:G>r{
Lq 5*W
QA"Nj
Epgw1_*
VarFileInfo
oE:f=
^#+TV
yK(W,Dn
vx{0(
?95z+
G,EUS
L.S]F_
E6vX`q
!I1Sn
T0ITM
K9P5LFV
uEqYq
z!SMkP9
Kq4pJ
GetFileVersionInfoW
~MOU"
}}47WV
PimB0
CreateFileW
&l!0F
g$(NV
gPPFO
CTb7f
3?&@C
=<^[_a
nW:2U
p^vH[
I;W$o,
e<<^F
CopyFileW
:H*Wa
!4`yh2
(6=>9~e
E5& o>
12 K\
5!ANd
PeigP
9OoMp
7t1~e
$0pIPb
q?CLsh
os&RO
^%!wf3
BC|R|
\=nbb
M_dX;9
}LU(kX
c!ZP6
mR!dKC
DVccd
SHFOLDER
g1|cn
{2}mWI
G*AWD$R
x,4tA
^o}s1xJP
~M)9S
_13;5
wO_7{
PWV+`d
ef@sp
b]gr:Q
jl93k
rSt-`
'k?0]
K|KCu
<(P 0
VWU_3
$Wroh
BPgy}
'K;+D
j_ni.
rV-0 G
kJ?Iv
I9=57L
3o,,";
`Idr?g
{-ys.`
^DW>G/*:
53Sxa
wTJ)^
4Id_2}
A[,._
GetDeviceCaps
ymot5
CgrPx
BjysP
?c>tA
]&Oh5N
V^1y!
&f~?t
~alP:
T8&;1
RV0-J
\'iDM
,D+NL@
>P%}@J
Qzn`2
jL\&UH
v<A#K
!)F%}
|k>xxN
EAKjU
xk]n#:dV
TXmA,
BfF.j
NQ_$b
R`:'T
p9uDW
rS0wg>
M@43-
YM[HYs
_/yQS
@Ufm-
3;ILnH
-6pB&
g-UrB/W
KERNEL32
H.F3
G*e]<
P:~/D
.%lO
1i7rAR
zAB2a
M'3_6
&1&]l
hLi8*
|}X6Oo
2"% ,
C^*(5a
U1y-a.
*d~f9Q
WPXt>l
CU^GW|
]Tbd1
[>7swW!
@~%&%
Tt:ou
F$4Z;
@t9pR
:SrsaVw .
Z]{8
Vn`A,
3rW,!l
r{o?@
P#m,?s
>OfR>
*n:xV
.>Is'>
yk* !9c
3%;zp
D6'(t
<b 'yR
\u f9O
Tk4(I
wMpq>3
(_-$'?
jw0N%
q;cB:d
b<_<4
SHGetSpecialFolderLocation
;0)6+4
3^^)e
j5fHN
.rA+(
2T}7Yi
y8y~p
qh<~a
:2]k}
hISMT
p2CN;
T{[|N
U}vS$tx
-cqR}
UWvxv
'zdP3#
a.<%B"p
>(Pd0
O},3E2v
Wou&0
(8!3"
SgX)L
15ZoZ%
=TkA@vP
Dy5<|
&n"FY
}8a{c
;7WZb
d-.EO
:tI31
TUBd]
8H9L7
0)Ufv
2-+iN
{z:z`
/)YH]
b]sc!
0R]kf]
6boeM
"rPT.?
Eb=7Y
@R0j&
}="q<
qf}DL
A@:r.
Z+Dur]k
rH``U
gPhB1r
nVN:K
PC!/w1
yP.as
tBYd}E
@Vh+d
$ ,A|
!$~IW
&3HBa7
AnvsW
sz<,{
a~^9,j
2R7h>
TVhsQ
PNz8
m*%b(
2nx7PK
=[T',
zKfNc6
~/(wk
Ko07N
tb7@$
q&JW^
X+)*t
Z|ess
9\[;#
vvcY0
C,sX/
*nSi+
OZ]B%
^Ph'!
~{{1MP
rr"oM5#
k3As`
qqFL5.
WNAx10
Ydr\'
X; #|^
xsOUg
\C9P^`FC
8okqlE@
MdaHf
IbK4])X
(g(%k
ETB29N
#r\.+
n'Y%Mv
!<M[P
=t;i&
{?jH_l
I_C94
olj}xyGK
5[yYL
g/=8@
Y7c.U
//v "GE
Bb29\
=]J(Z
6|EhW
~?OY<
9C'^Q
AY&Lq-j;
jr?U_
hX{Hh
n'+8E%
=Nb/ _
28nQ\
tTE66
V:4TB
IxJ"T[
TGk&N9
x3~sT
c~[Bp
w#F6}U
DfJWC4
*Re&C
]t,F[
!sa.~rD7
e5'9]|
>q0Uc
j>v)*
@v61
lVQ6{#J
y5muz
27ri[K
FT(m\
JNmGq
r!2 @C
{p<fa
Bli/t2
CxT_*!
FmyX-@$
eV=wd!k
_CgL[f
2d8aV
:h}B8~
~!Zo<-&
x5S1f
+ynJ0
SetTimer
2KVv(
%f>qF
n9JL!
p?zx:
B'h7tr
1y:t<{
)&2Rz
>#G3o
G=DZu
YirZ"
J=EJL:
.-Hu,
ip,ke
d\,q4
`}u;mn
s(9M{.^
[&$|H
s<9FF
XG7yy
`YXB8^Ey
V^0#<
ij)l5u
%CwvE}
A^U@"
_@ZXY
>rYC.B
)%_7T
r.wS2
]H-i%
S\b0{A
|y@NZ
]K@x!d<w*
a%D-nR
l{-N91
8d9^A(X
H1Vfgh
^0x:;
f(0@U,'
kga Y7q:
GetWindowsDirectoryW
DefWindowProcW
$|p$b
NN&P%
n<u7r
w_Uyj
"av,vxdS
(d#;,
"D?2j
@F`nG
v\8mV)
0WZHBMko:.2
F&9NT
+nL6zW
*&z.v
z9<{IJ
P;&gb
4[9"1
`4<I%\Nob
GetDiskFreeSpaceW
RWM^oeNxl
z-:AU
%IRj1<
Z|1CQS
Oz5>RIJ
%Uerb
@E7dX
71M_R;
J-J2>
.`%'P
thBquE
}:}P2#
bqNgF
`<m"c
"b>qcJ
AleYy1
gGma#
JeE<.
K^6h4
J1`'u
}+YN_Z
>Jl|Z
,4$@I
P`e(}
1 VeV
D|>V*L}`
^%qN~K
+V842
,qjMP
n=Rq0
"k}?4
}97n.
M(!%6
\JrZA
1p@bW
^@0=3
q>U+0
SO,[!Y
_~ed
W"!QRa
-R;\:
2g?[l
dl]h_[
XR$m%
3-x/Q
tZj\V
^ Ww,
X#{pP
$45"Wt
2Xd,q
~ j:
o^h's
Pl|uD
qcgK"
"M"o;
_jlvzyxb^
TmV7x5
l0)c0
)[s9w
<n4?rj
Prcyv
2B(V=
|N{[J
^SRum
dF"s/
sNP2hL9
7%2?H
\FmT69K!
Z^LYH
Q0$_P
V2V"@
+do \Qn
*VkUo
ZkohG{>
=&}mqIg<7
f|p/3
/mnLBZ
'3`b7
=Uy[]
SaVX
$;"vYv:cr
Bq1F 7
M(`9d2
._{:;
g_jo,
4G>!d
\Izkw
w}Wn"
1KI[N
dd{BW
#<Mf-+
abU+|
YVm:l
Viy6T'
=@V\F
mpRvuw
KT[d-
DRLwf%
GFeO@
,*Ahoj
v"OEY=
Q~E<(
W9fR02
}/ohw
MoveFileW
LO(E\g=
Lu=rN2
)2VYVE]
G]T@aQ
http://nsis.sf.net/NSIS_Error
Y*&:p
2jI%{S
I0z^(@l
\g{,-
$>0.E
!?Xa4
xjCOG
yCr4@
LY7:M:+i
m+jX;
t%jJv
2=INe
\.!VU
#$hC:9b
zmEIP
$t(D6
=.fU/
O_2(u
.B=om
'~Qr@
5>h]I
">RC_#
Xy5m+=
DPxcK
IEFNlD89A4/k
<yxyC
LE>H6
k?E%/K
\yJn9<%?
J:O1H
TrbZeM
<RO]M
/QQvj[
9URGP
^rEtQ
[0rS[
)]@$2c`%
|"O9A
>Z)\)
]_nnE
Gtrm&
{%n"*-
H}H=z
`hrw{
ee^0X
9-HgE
1ZW(&
y//917
@qYFy
8H}~*
tqyzw^
K&gJDw
P>-~r
bQEz.Y
_hw?!
5fC\^
D;y0*
D ,t>t
K0<0a
T!y]D
pO1.-2
YB{dEn
[01G0
szGZh
BF1U<ia
]$D*;
930\bH
uon+~
GDI32.dll
#RVN=
BaQI[_
7f?_k/
'S+LK}
Y G31
cdM1Xs
mLR6q
:C./}A~
`DUe)1
tmW7n
2ck_R
E@d77
SQc8l
W?rv[
_tLe%
BET\:
3P%Xr
[Rv>j7
9+x/a
U,8i7
y69Pj$
yQ6m:?*
Z-3l]x
^.-*rx1
Qd2S}
FS {Wr/
uA{Rm
`p+>wV
Gf35B6+
l G&|!z
>gv{B<mg
wP[eJ
6f4 kM
dzeM~
~)iym
*7X7c
`uIK3
skN3E
v=1e@g
A)nhW
&]-un
$x|((
AGw5J
C@\=2
&G4.Qg
B4hzR9
!9)^F;
u:FeV
.6#hg
+BSB/SX
S{wYZ
;Tyq0
XU_^RL;
_-_8'At'
3zA/K
erhB^
>>lhT
UID}x
VQ[S G
-SDaR$
PDW<v
.o;6G w#J
EqwZ>
-&~$D
V7^Qo?
S<Og@&
%iHM.
w*U]8
:n,*&
[UISaYNd|sg
9#^6MEc
11mH5
FXQV3k
Bfrbn
_5IaVDk
+up/-
4.W A
_];:_
:8V"^g{Hx
:6M;%
3kG@{L@
:OWA|&
D(rAL
G>hQ-
I[]_`
^xXp1
Gu6:Zs@;
*[Hu(
*1}d{V
0@^L?.<
$j{PL9#
U2F^-
8~\!P-i
B#_S!
]}f{h
"Rz%U
%o#K|
\%ad]
Tv{@hp:3
RXWF
v=C$}
cWEnl!
rWShJ
\@?Q}
x5}0E
lYE'HL
mMdNs
aG&:b
*%4r84Cp,#
Psc=2
9F=/?
m'ERDz9A
weJ!I
1J?^?<
91!R*Dz
A_xh/
8\98Z
PortableApps.com is a registered trademark of Rare Ideas, LLC.
-cBK[LW
GetDlgItem
6_|fD
QBBe4
CKj,4
rxx\x
OlCKq
q:27G
'^nm.
2-{Y1
=}#*G
},'f`"Mn
m*JpH
GbzDTV
6-B#>[
tQv<^
yh4a0l
5%8lj
<4*F:5L
d&*a]
!This program cannot be run in DOS mode.
PGCTl~aD
MKxVH
*Z.K*
j1nH*
gJK/*y
|StWi
WUGG^z8e
D{*l\
/DDc8
~AyKUz
@;>n3&
8CG9*
EN nj
*)B%r
a[;TOF
oR{0j
:UACi
@K5"Se
ht1@=[w
8cGY<
K`th!N
LTTb#/
(zA8`
X-_:XE
uftK"
6:ML]
r~%#sR
HX8d7
"Rr^R
JZJ!5[
.xj*2
gw'H[
2$hM+
BPrm^X
EuBEb
T]N_d
6/grxW
I|sI^
cAxX{
GqypR
0WnW"
Z3?OE
Uq_(0
)oaRO
+`9bSy
>x5n]
RegDeleteKeyExW
q44Ze
=vdqH!HZ
C<j0V#
OgH=`0
eW;:ZUG[
c/&;
.QYBJX)p
QW2 l
nl1,FdDd
XN0PZ
!C26m
owWhr
~;**qqL
vjV_o
7b$fu
o9]*,(
y=ThgP
oUloA/S{
)dXTI-:
t;R6}
|lq5Pz
Z-B y
E/_`kn?
v~yme
D#<d8
Mga({+
nokk/
6~;z.K
((!|
[U+#w
LTyVl
nJ8J4
[[ZNy
umU:
*hqDf
?#PX*
odLZ|2
B]zQ-
aR/1HV
#Who%
I02_%1
QY7V'
t.?8r
gCx_4
R`D^0
n3;[L
I8L-b
\x.vl
59$&S
3{czG!
!svI]Zc
[wt:P
]ww56
Translation
dVw)E8
vhmlF
Kk$,t
_-\\Y^
0VoGU
7?d^w
hrji=JnK4
C>|=^KL
G<@y'
0xgEM
a>])(
@2pQ\
u~[(3
9Djv'i
,\_C4
UNk4y
(A.~^
;"`{b
`T'rKj
oK6|T
;D/gG
m6Q&~;v
9]BqP
R?%%/
ZG)qc
OHW>N
~v!o=^'
&fqM:d
6rgQ%M
+;5KT
"P-N?F
jU!g2
~hecV
UghpA!
E71@$CA
%?aF7
QjSQIN
X=!=D
xB2UVb
\fvXC2
215iF
D3]xkk
Z _`F
=)a&n
d2/'P
WS'W?Yr
hh6br
p&$hX/
,5Eln
`~cN%
h)Ysu
/IjFNd
X(KXT+
-2)(u
KEA]=W
F1@op41!
vl-ArB
3WNr9V
(xV@{
tM9Ul='k
u{U:t
^$5[o
Zv'M<
i Z_f,
aWz{$
u-{kx
bzZp'
M<_QZ$
TUMuZ
ZgwT^d
)@~EN
XsldX;S<
D>Fz/*
g~D&j
^-h_`
--na}
yxxFTs@v
i>N>x
_)=(e
r!-G3
F\Ij7}
%Vv&~I
4F;0R
#!dwQ)
\O4Ex Yy
70>lRQ
5["14
gQKyZ
M:m?tM
|`v]6Z
FJ>Rt
2[ S?]
X+rC}
fc?#b
O:[?gG
xkQ%a
IbAbX
s<nyj
qJvly
uBFr#
3"o.\
-2%<C
DH$ps
Hj\("
5Vdp5
M~`eN
YKjGxx#Q
>ZLsL
n*+>ZRu
r@fn]
eGz=U
P"~')
2sY+F
AycW>-i>
m=tPW
Qy@qj#
*\z{PH
.&\{&
l<,[j
~,Bp_G9
E#>\Q.
gR$@#
G%cW,
-#g\.IN
UFk/y
qc]1]s
R\uLA
{[Mp<
V=dvY
}/(Ft
]U^6<Y@=P
6arqk~E=k
M-#Ut)
Ksa0W
]g2X6
9R^\WP
n>45n
=:[vp
~?txeh
u5(.\8
$[Ee8
cy&V},
c@A7.r
igI2ns#
2q.;O
=%M1N
T907G
@?Qt\
H vdv
<\Jj]
\0_0W
]D)ZI
vJ,U]
J7VgcM
O~SmM
S TAW
<e1J'h
f9`;e
cRMu[
[>S^VdTg
o)|&<
=/{Ct0
~l=-o
%]IP*
Ue&-w
5W|Lk
}`+d5
@Uj1gp5
.i"j_
T6h[1
}[D,a
]~nfb
4~t}~
884B=
,o`%(
j\Pf2
Z(/a,
$L<|Zq
5:xL<A|
$b*=~i:cHEf9
3.5.18
.6,<8
;,LZ%
la-+=^.
p"$tf;
5hO~<
6[!\?
WJ\(w
6-Moi
qVLuS<|
K?%1&
$\&;2$7
A%*HL3
T0b?D1
69<*/
prRa)
*A]Lq
0ebkS
"id{%L
2hUv=c,
}Vhl*
.( 0XO
a*a\x
7FsjZ
Xi&i&
X,5mMy
QQoMhi
2$3h41
~Kp&f
} KA
m-5fq
36p6:>y
N>,q$
?i0)s
^M2tU
zeKzuK
Swa})
#?Or(
uMxN~G
\j)[1
Ew2+;|1
gw{@n
0#A3^
``B}'
;f{biBl%
GK8\ 1
ZENfg
*?0mC
FBood$
'Y,uJz_$
7%4m4
{~`5f
Lp?DE!C_
kH;a~
x6Kp!5B
1LkJGd
Q?3jUQ
1*)7)
i^'9t
EndDialog
pO&i+B
dRy;C
tC3cE-
@\$PEx
PqAGLm
I)pbD
y<'Y>
xAx>*2
A\kyA5
tMZkS*
9av"+F
tVs,(
vkADc
IW'gh
!^t_.
.)&:]
[=ba]
Xf>A4Pab
pfp4~
2Nt5&9;X3
{X\fW
ph8yzo
4MYi*J
z=<TF
O@hxq
hn]Kx
?e1~q
@yNcmwX
Ht?Hs
f/zNp
8eG9*
II4?J
<2ePw$
mdRH9}1
aJAlSCi
YvYaY
L!9x1
G5'Oh
:7?o
y'_Qb
*<ZY51
<2Z>f
=\Pnf
Q%CS0
FP!(f\
h]+FX\
D^#Aw
W!DHn
rxD[-
XI?rs
Z(5cF
Ye/b^
o"D9>
NUU-/n
n9#82
g+bM,
a>f_s
bnP}{
^1N@k}
pQq,r
r|0y~
=dv^*y
,b~u%
tOZp"\
NsV^\
yJA)$Z
Ol38*
|K5j~
a_Pe^m
\3S{;;Z
A"r'#G+%[
gbSA0
q6`/rZ
<4Bj6Hr_R
hR~At]s
)<pL%N
0{) .)
_h 'Xn
YtUBb
USPK.
(WQfH\
>gkC$
$W'`,Jdg
%,5IzS
DJ*Vb
([1tF
)2E5-Z
C4'5&
p61w>H
P=9C;
(w@/@u
RA# E
?;A>#
Qn)qi+
verifying installer: %d%%
uB|Q)
/ua~e
h@kbzU
9b)zJ
UdHwb
lYfzXp
Aw}f8
cjKZq!
;-te0
sb{jj
DW{^^D
/qQp^
r.jt3H
>jb_!
M/-q&
M=r~GE
N*[we
h2Wy>
.K$]0
,H~I?
E2J":C1
^Wq"w
Yg<Pb
i|vAo
Cya?O
HEWl3
.>t{3m
?\e_*
(fD0$rFs
Mv3jn
;.SYz
w~T[?
e}p}Ot
.|qo&
/&-\d
CMd*v
sxKq~7
Q{bFwj
nk$'5;x
UeF*+
SHFileOperationW
T3%ee
P/#0SN
d5(Q,
D{s+^sY
+Kd? 7
n&I(eG
,h|1*
*4U IE
gUgNa"
o}$nQ&+
S~7CZ
,vpR(
TH(=M
AD#PO
;EyNS
Po'AC
h4oD.
Q]65he
JQ!R(
>55W:P
Gy"v+
`P4bQ<
eVK9VT
QB(.$
^wlh6
Q-w$,
4A52[
1{""~uD
M^_#1
$".]8
zNWW>
jW_(Bt
GetCommandLineW
Oux,x
7\IE,)
fy1~|
'!;"00
*3|Bo
`)AJ"7
}|>neu
|F+O^
ADirV
QrP#?@
5iUE1
g6We~<;P
jxy.Ng
0J.Ji
WMsp'mr$D
}5E$-
&4m/9
&l4&|M?
h@WbT
0Ax|"
U<fQwI"^
5:,h%
IjsoU&
WA \]
8\c x
UP%lZo
Kf@"_
$a>^"
nk8(P
||\C&?
[`4i~
{$0=q
bq ((
w17hk"R
qaeM3;
p3>s]
.0p=Q
O=6s=:
F":+_2^`J
UCxu+
3Sy@P0t
)%}U>QFx
oKww$^z
CreatePopupMenu
(jw?}
FileDescription
fCy Q
/fGYIGYnuE
^-4:f
d>GG8
Nv]D/Mi
Ly)LBaE*
:_?6eDa27
GiBeD
V.ppz
17[/d
j'_FtYDk
<-Kt-Lw:t
%,VC~/
$K`ky
Q2@B9
HuAqS-
nor5{
sKo)Lj
/2FW;
P9IQO0
2sBxW
mGe1!
%u$ L+
/ch,@
' u.8
[EV}h4
=oo~5
,hB`#
Ya.U<%0
lg[Sj+
?-,9XiYDK
mJmYi
@!WY";
@mMTJ
K.0T#q
^zYPu
mDMZp&4as
tq)RaP
SetWindowLongW
I&:Sw
/gcX3
GetFileVersionInfoSizeW
9X?yo
8l5u]Q
;{tZS
b07Oi/)P
AYeB
Y Ag21H
r,$W$
:*%|P
H\\Os
*?|<>/":
#/v^a
9v.Je
*j6RGB
GeTFp
eKvQu
UX=R2
l:v.,
\*ok0
?(b8u
F(%eHG
yP5Ek
6lc>*
MP kv
R`};|
zD~Mz
_}_.e
CdmmK
t5wJl
x7I5W
M!t[]
-nXYP
A1+~]
GetSysColor
s6[0.
CharPrevW
X~pg-Ms
[oSAb
t|5Q-
;QVWr
cR.~ms
~z:^t
InitiateShutdownW
IG1}cC1~
)w"(
(r9v<
gD2^\
3i8NC)>
P(qe_
z+eXV
g1BF=
%wQt*"
9M{G%D
U\UJ7iz
!gPl|
lmp_~
PtD!*
, '-c&
VjiE+
`^kz}
jeQ^;F
Gy'y)
,R-VsFyd
&??LW
BZN J@~
l6bWl
3Y?U}1
B^-8AC?b,.n
$o&J9
gABW\
`el%p
A`~J:
gVii|
VTaxsY[Gm\
b^*)iO'
_N+@B
wPyF&MoRX
Wx;~|,
zf,7(
4gD3!
T<Ur4
AXuy8
~W@O,I[0
([;J_hH
3<]&x
l1^-by
i~'l7
`:j=<n
4jrE28
x[?NR
nz1jO
<`Hd3
7JyT:=
+;pQ>Y
OU@re}
DEPS[>
L^iJ8r
%3sjv
@9~A(
kSVb7
[VIX|1
|kOFq
A^djG9
NZ[H;
8%;kr
l9Sr}
|5l1G
SetFileAttributesW
Ooj\=
SetDlgItemTextW
/?4?1
NFq$I
p9*uDjb
D\21^
)d}a
i2|=2
*YuJ=
Tw)-u+
otS~7
GetModuleHandleW
Vs&8X
oZ-iw
;G3{,P
Rf\Hg
~g@?c
EK^>N
R=O~q3
b:lXp
=S9j{s
qJQnJ \p
+cmF1Y
l%Vdm
AskOd
%VzSI
&j_$&!
~9tA@J?C.E
8 RoF$k
5+ri+
kzL7}
p/aS67
N^b[a
N+ZwU
a|(-^e
n9~,4Wm
\RF3j
InHe!
W8oB5|
(##x$
]}4Ea
sY4,.M
fsW^Q
{2)o7
/'quC
IDBD $DQ47
"&d@p
$-`X<
J")^d
h>tv/
Vr84Ty!$eWr
$LAJA
X&"n\
3rj v
dvW!2}g`n
_/c0XgG>Hxs
<a;f#iN
hM!Z=
;V(k>
v +%:
!:5<~35\
$q3>Q
*`jp
?y h(
>]#TX
8h"@)c
v4IyW
PTdhN
%]'hH/
;zM,zyjcN
iT%>j
iF89`
ScY0[?
huNz?
B`aEh
eSsmX
I:\O-
^LX$f
4~)Y)
Cuh2g7`:
iHC}d
&+o'Q}
'<`|}
{nF\[x
}EPLLRA
8iCrP
Rm^4Az
i\]-3
R=;\AY
/vJ@
$"-1JF
J1Gg5
Dm("
Vd@$X
-3$("
rXu]F
9H\DY
k]v11`
sAJ$v
zvTm>
HN]vV
+pXe.Z
JMd=*hi4
Kycq}
TlAhZ
lstrcpynW
t[jom
,3;@k
,D=^k
bIXtT7
2R'g/c
L4KM7
@a j-w3
=5"";
xt7+ g
RcuSOv
8"jB#
'w'yXp
+PJL:Y
g$;||u
,]Yb
GetDlgItemTextW
Q-7U/
a84p{
,VpR6-
&=Oft
y.pMg
+rIRrd
m~'Lz
9u_By
:&NPk
Jn?Q^
zh4(u2&
x1q<U]
=E/Rz
q~Z&n
Wl4_K
q<>fN
vaSe/
J#|~]S
!0y4!
xfA#p
}7C|3
lI&.q#X
At@_:e
?vjf%
x"$vMhU
&g$`WZ
~=rHE|
"bXy;p
/W{YO
mOO#:b
)B%tvOr
M7Y'd5
[Ajex
yVnBz
tWf="
D~tq4
Cc'{N~"U
is+D?3
Y0|;+DaT
D'k9
L!sc1W
/0b*l,
4'8F`
U(`28
f_u4`
jXp!@
1[v)k
niM48KWREBm
K9vke_
UE=3Dr
9^Uv_+s!
&SNfT
6c)uO
'bcU"N
)nD2-[m<^
xd%Lt
m*<XX
JV>D9fk
MessageBoxIndirectW
NnPzc+_P
e+aIw
n'.r {
#s:qY
v2CC~
6mZSS
IlWW)
E&Vx&[
\7&B),
U+-m[%-
A[(72
|3.N^
Au{PzkI
#G*ep7
&s7oG
ajG++,
More information at:
$Mq*i=Y$L
sd^'A
sL|hA
4x.36
J(.q:vQo
<{xkya
"&pai<
_7cYyp
DAQf8
dv7@b
UX'wW"
bI._a
,&)i]v
\rqp<
q@Ob9
-0`~D
!KgZ(
HmOg9X
q>&6$
~>ado
%Rnmi
JFA$W
^yU.{
Pok&0
c^C(Q
@}w(EZa
?>w;?
%HPq55o06
qB==8
2dl~/kG!
P4n^x
TIRIc:M
$7vqk
k#a)1
[:#vW
*cKFZ
%4>U<
xYWUMa
#:te>d
Vy'vR
D,W@A
YNcZmR-
,GV&5U'
b1OqeU
KjE9j
{01x2
~r0Wn
eR!]&
%I.jo
58Y@Hq!
7La.#
B*&j$a
:Ht":PYO(
|7i/3
wC\Wr
M9iT.>$eR
(.wO.
SetClipboardData
n\46|
~]QbH
~69: b
j;zI"5
~?tjS
nD<S5
`o;LJ
/(bq9
$)uY)
4#PP$f+
^2'O(_
0|_@Q
_w=fZtg
`P3y5
1=#M9R
4GkUc<
y;m6h
CreateDirectoryW
LBA'c{
w=0Q=
iYs`/
L_Ng/lH
>T`by/5
bE\:4g
V4a&oG*
&?wh%
!Y]1X
zk[MF
zIGer
RhF"_
?^AVB`
V:|+i
!9>wY
6JV`Z,
w1=gT
qj+[{u
LQrSa(
ZzGprZ
}c-43.9k
l~#Hy
$*Yh`T
LP2zA
Td:y?
SBdwr
o!)#f
U6=pP
te_+`
:;kUGR|
?LMp:
(%\wfZ
^i%5@5X
sReKX
E&`^v
{xJvb
L{Fsg
@I/xm
YAHRqE
H `#|
~.Z(Y%
yW9V{
b\xWo
Dd@~g_6
3K;Q2F2
n4n!U
8DHL`
=>P2$
:Jdm{
313V4
yqdCa
+|j(@
\xebz
!oP~gS
$5o2/
#xF9DlA
S,*.@z
MjiF\
oNi/f
_2#~%)}
^yT7m
:Btm2
b,N!)3
lj,:8
Q7ezZ
$A;JC5O
w#%"L
M]h!V
?-KAC
W(mGl
}V"Lh_
3-'L)
I:l,>3]I/
(ZBC,
)al[*
'9=:hh
BUEIxXd,
?3zIr"
bl,g8
K]vf<
8f:9,s
F*9._L(
6+6Ro
$M4My
)=$kT
$EyG<Py`
{d{Lj
i.7~VI
*TD\{
<tC2_
p WaPf
Z$W}{x
;`5ge
UJBjI
>'bo!
kh@oQn
P|\.Ld
cua$<
R5:ke
1ixkN
o1AfgQ
-xKSl
F7z|#oC
O&'&C+
>~}7G
\^&lk
nzQ=;
lag/V
Q#AH,
mO:{7w
ia6S5
ZwUe&
g6~=/
.DEFAULT\Control Panel\International
D&H*B
9s5'R
nn*W~z=m
RO8f*
97(?86I
^a:cV
aF~TD
kd)|4
lstrlenW
]W[Wp
Wp)~-
Z7a,#
"~U"d
n8(^P$
V'9!&
=&r!/
vkNhW/0
Comments
z/B:j
6cv%>
Mk@bB
nl(qDO.
V)l%aI
6f1%U
Bj 9;
raxex
ez/k!
}=@+l
rV,[e
#B!;|
nCSV]
b]=>2
to&l@
No[_}
7d|WR
2jW!eM:
`pOF2
cL^`=d
SetErrorMode
7q]@e
Wq9PU
4^Yo=
(V&Ytv]s
4#!yx
VE}w"m4(
9#\lB_
KtF/e!;
0=dP}G
L>^#30
}}#)V
OC<6]
_A>VS*
VmZRt
5QT~a
{6%AC
{(Dv[:
a@7)C~
SHGetFolderPathW
@Muvj
b^A<b
_QyaS
)LEkv<Q
M4(p;o:i}
~dh>r'c
J2P[1/
%zM#p
s<Q~s
"QRk1
544S$
{F/,V
}e Tz
yrU1h
&a`!t
KiT*t|a^
Nq{wV1
V[t/8g
&T<4=
O{FV`+`QL
kwMhZ,Q
JEw8C
\AT_\Qo
Y~Af~
i|Xq#
D^;b2r
{Tguf
t"G}j
m&<)7[;
[U]75|L
,e9Dv
r^*H=s
YLzL
SVr$K"
M4jF'
cPN8F`
4I%/5.
Ld.<z
k=.OI
3yo/I
IwtZu
"Z<KW
"C;fo
x3\)$y&t
Re#EG!>
jui[%5<
h`xL,
n)sFA7
)xvtU1
'1|(7_$_
Y`:B/
_Dm}$L
}rms0@k
\-]2s
;wOcX
6|_c)
UJaWt
sJhl%"
Va"h3s'
/FT6Y@
`N0|F
A2"u{
LbDEtJS
K~7z?
!K3q6
y>sGn
z$~7;
?rZmD
pxyac
/4<0k
e8`8E
{D6Ium
l6Ztjp
#,}_d
p\p|+
*^=zC
"_` `
j\ljY3
VERSION
&`!vb
Lz,o
(CaS0
ES> J|
%,.5`
=Jz@}_
DIlEU
cFX))
Q92k{
h"gjA
[=QEr
Wb`t3
gU'0o"
K&Q%r
=g~Jt
\>g)J
y+?H|
MFEDr
(g`aS
gsbVf#
;/1+L
pWRUv
+R*M;
M30ls
(=<_?
R!C(0
X'95n0
!-mulD
=,\n3
[0=6+G
*D1]#
QTiQcRe
wjmU{JZM
^Ss?}~hn
>Sfzf?
2nb'V
]-'Zm
;E$mrX
l1\Sj
\|Vn/
j!'zFy
J@6.Ms(J
?V5+
\p`'.
J[53[
installer's author to obtain a new copy.
$cou,
~Y{Xy
&.8`
q/x?m
[xVxL
gv$7'
csn#:
,WQ/Q
'oD*ct
@]Xe.\
-C#)wd
Y&-WA
ADVAPI32.dll
k1{j+
s\r^4
]I/bd
5,uV6
w+*6 eyBt
sMt,I
S(fzq
D994a
MFy',
%r`[m
r?Z>"O
z>-E&
*"g"C T
53o ;
\;zfC|f
;&'.|
*)&'Z:
_0|p{Lb
3:F],
g4EZc4
vOa7JA
C53NHl
M]@(-
cn9.F
`[fR)
6P-}HI.^PM
*KQOd
n\4',=;
"jwHx
K,e/sM
oG"D+
\L'0t
MYIr.
F%otP<7
[BE}E
UwzVFq~
+Ss-4
<wT&c
fe5u4B|9e
%7F@5|
GPpJe,$E
z"R#xT
wmO#c
xp3HZ;7S
PScq>
Ln_:K
eK JD<
lqMBU
wfD_]
O-T,Xy^
ikyZu
?pf*4o
c;"m}
/)w1x
[E5_g<uYu{/
v9n:,R
90u'AAf
{$Ax)H
Djo2C`
^0Y)6z
(E-(M
p|5q4?
B`)Ou
&Qa$K
rw0x#
P0i/5
K<7[T
iR@]+
,ny(-Y4
9nKn@Hm
#G{!.
uo,iQ4Q
5j)3+
:+Kqd
&vJad?
~Snn_:
ShellExecuteExW
0HU*z
b$',y
:b/(}7
|l"S-
{* cw7
S["DE
Q7qEN
}DLyJl
WWWWjn
}9;Tb>
)H,6+>
?#R(p.
>LW ^
c-~5:#'%RQz
o_*I[E.
.A]kvT
!j3Z7
VEEG8a
cn3l3
US2"//
aV\R<
j1)X`j
b-;',>
cj/zS*
@iO5#
>V(0d
aZ)e@
d_Y&'F>
<b0JD
D$,+D$$P
5tI(rU=`4
,)}D3
$,NkL
N-X(%
,5H"&m
e{wNS
So=z%
=]#KB8U
\[=*kY:I&
w.hi,
1]lBK/`
i~H!4
vW'7*
%Zbt3
!.pvXl
XzHmd
)Sl{yD
Y@X~3
qc=x]
Lp]=Q
+!5C+
((L0,/d
SHGetPathFromIDListW
3Ik8|
Y 2H0^\Q
w/Xxo
yhtqEP
^SIfl
xBP%u[
N%7"j
QqU|m9
"YI,x
N:]ID
w~XPj
UC[0h
`ez|3
vp_rV
$^rM\
eH>[&7MA
ePGf;%]
2$G*K
lw=bY
Ck^g6b
:w/@v
]~teOH
rf;!Ng
HYbH/#
l_8?'G
( i@$rZx
FOuTlG
L{lFr9:
t[\M)
a<J'[
:QpD>
Q$'Q+Z
~_Kn&W
W>7-5
SX'09V
5B@}E
q#gB]
-C65]x
JZC8Xl
*&^hY
PUW4bt
90N,Pt
WYeH_
qAAfw0
xOTJo
:gJSX
I'x6g
5w8K>
p^7VQ
p(FaJCeT
B&gq0b
O*{>I
)AF\d+
N^@]1
unMISl
g}3%w*
.=oI=
lstrcmpiW
sh7X
@2i=B^
"%?;48C
\<U2lVq
Uv]881D
0%3h-
E{ss-
BT['zU
?-CF5
3M *\h
W`z.y
tdJQE
ADVAPI32
(;B '
"7rHle)+
nQNp1
%\/1hd
|</p#(
&e2dB
=)X;]C
dm`\[N
!iz_C
c8!OT
LegalTrademarks
D=,'7:e
SHAutoComplete
/-JM2
!LB=X
DKvx`
r*[69.(
NO3{<
WZ&*k4
'TLZz
m!of'g
WpqX|o&
^1xNT
-B{f6~UFI
H>owBR)
O]%mI]eC J
PWj$O
x?uxk
FFC;]
ReadFile
jd4{6|
Pcr5G5
RegQueryValueExW
ny<s+K
\-{brv
g"%fc
DwG3]
7Q6AN
u@.49
NulluN
spZNPm
\5'41k
[rxT_
,`JP.
P]XF>
y{!81
DrawTextW
rdVL^
/dZ=`
h?;n/
&hjrB
KBUB"
SrOg"
.Te0>
8sYdZ
S<+`G"f
[ !Ez@
n*'bgm-
{GM@n0
oe7T*
1.o@2X
b:\F}
V;L~r=n
*)Eht
P0zFi
I|P$LAb
lvxc)>C
gCAgKsa
}BZ@Z:
.qz*\
`GpJdC
1tp*(
.aoe+
`&nBO
vUk|P
}bDEs
:;coAD
]j"mN^
i6+e4
GlobalAlloc
Y\c*A_D
PROPSYS
b?,wL
/:@*HvmY
<iLky
P^1qU
(N6%e
eyGuL
-~YNC
ZE@L="
s+l4W
23Yon
(IBif
yoch_S
I9 tk
&pMq^
70^#B
dX2CH
>z%;;
9!ETD
YM67|:M
Qw+Tg
C<,;.8
Kh[:E
Error writing temporary file. Make sure your temp folder is valid.
j5FU6
El)!uK~L%
IlA,^
{\xUt
wC>nJ2
@Q"8f
D;E{OgC]
"bP_<tB,
a>!Cp
R+L2m
h8&F;P1:v
KEQs'
H"CpJcng
s6Fb`
>/zBl
VSX\il
c>}#[
,>0zF
n?EM$cf
a\DCM9
@Q:nxd
j|Ghc=`]@
L^+^5X:
'kZma
{]'x_
+5u5o+Q
KHM|=
)rvxMDC\!>f
*{Myu
#e9>^*
Bi3abL
$p`6u
q+]3 ?
L,j,3k
K#LW|*
NKb{z(L
w^ZH=b#^"
j%?P}
O#y[n
rkLVh\
wo<S
XhqM)<
PX"!hO
K^jC9OAVL
x#J6rr
K[pxx
[Jxvi
S"<X:
aa'kZ
#k;*|
P<s[i
!"EWg
7hiuU
DfT&v
-&pcqI
.vR4v
V1c2mz
2-t=Jmw
Xd&2@
?2<H#
A%'/bY;vVbW
=]r)3
m6%h4
BYy~1
U5VC(
1ps8L
cF\kG
|Ny5U
@#Cth
+% Bf
9|wJRM
50)QZ
2IY(J
r&][N
3h^eM
@qM*v
yu$,Pg
,_*bI
wGLQMB
#1qg|5
;gRFN
1+NB{
*e2hT
Wv@ Zj
#HJ*yC
avtL{
gu1RY;
2up?I
5W_fB
*kTLg
hUh@,
J*^`a
9K2pU
@XQ+r?
9&1ww
4=!T~
SetWindowTextW
s^ryXO"
1C"Il
!$P(A
1X+HBW
xR7.-
&I\At
EUj?](
2d$(W
HO@DFFDD'!"
av&Z3
3FM;N
IRr#W
xr~V7
1X>{
EnableMenuItem
nP8`A
{+Nf;
t-T=0`
GLC'M
4;tDT
v<Fn4
[ AFI
V9bO|@
;f'fNR
t}cNgd
\dIthy8
%UZm@mZP P
`^AZ:
p<%=T
83kn*
|[J#q
H8$]v~
(SI;
WXdL7
X1Mb{
bC;W$m
3Hop6
N3%L{
(:L*0
foXYpb
fJja$
yUr`R$P
et5"iU
1'"(v
ole32.dll
-Xr/eKB
*+we9
f&M6y
PcE@C
~=v~~
YiaNZ
HTI}@
5vdd{
4>Oqs
QqR,)
MZmPI
]bp>q
39u;,
<IurJ
6dHh
33d Qp
|^>C7
zh7V_iXI
e)>Aw
F5M+Z
TzNk5
GlobalUnlock
Jn%|Q
fVmnE
)0{(B
tr%ayu
K{'I4.
;LHoD
G`#&IQ
K3e=uNo
-3(@m
oF(go
.4(`$
4t$i3
:=%'{
,':(C
j(Mbu=
hF>QT
-beW-E
Bwg#C>
cTV1/
1h.#q
KT'wY
CgbX^
!%r@C6
=S"?f
<"Z>#
483`kby
2@*4&
pB YI
<.wPt
b$[M?=
riC},P/D
x`5wx
X:4YaWnu
Btg"T
tXii0
N2WUIBIikK.28
rf{8Z
64TIs
Vm`kt
_B32d
ibJx%^@6v
bE&t;h0
c^u@h
ry31<Q4
ZKlH.
Z\rMM!%
lP+b^
t9Z,d
`Qr![
M<p4[
:gG*$
c5[#(7XT
/j|wp
^-]?5^
>NFWKo
lqo77
\H8@vy;[
20R1h'\
D^Z<o=
m/ul?
Ejn\^
?+Rh-Na%h
LJ'VqWe
oIWV%
$woEEXO>9
!wVCND
P^G>i
@kd-@P
3;<0A
,t5r]
.$_wA
!_Sj8
xgI09T
bxI.4|k
:=//K
S%r2`
K @%P
,k!d]
@H#LL?
oGo1{!
GnJ9EtY
{E4@'l
f2Gl{
B=#$@9
{qTvz
mH~2%
PCBK^
h0$N3
uazF.
($;KAX*
qCW\w
|wwc_
ZFto[
aKv#z
I(L$[
>^.B)
{7-j G
$gi?t
0RLq8
TsM-i
w4'L:
K5uCL
^8`Jo
#g|2iU
&{K^x
so.r&P]Q
KERNEL32.dll
k]-kO
ioU!P7W
bG1D;
5^|#`^
xyBZz
{FrW})
!hni`a
9ltzcl
$EOVx
"tB@K
`wJEeA
Ij='6
MOZF'<G8
!r 8!
OQ]RIVnc[
:P|vrJ`f
s'0.L>$
+~)$|
ymk'pG}
yT)=
e~)GlE
(;Lbw
"tC<k(
&&#V3Tc
_':\~
b1SW-9
]*fSO
C=1V;6+
tV,-J
yz:]/36
4\x$N2
QeKa@
DUE'[
e> hJ
c9dA@mZ
\|g+9}co'Cx1
%@qYi
kQK|v
fFgBz
Cv@R.
6<-^l
_)&/9Y
)-e4#
MxFs?
FqZmx
9xQ~4
`?(_-
)YyjQ
Dx^zR
2A6)D
`v64d;
-(NG^&
(=X"L
Vj%SSS
J7S7mlQ
lRv>;|J
`,oKp
drHxgU
z"+ZH
f|@C{
SendMessageW
sK1fe
#)}q'
SVWj _3
/ap1q
cPek^
9{Qr6m
roO5A
95Qgu
Pqp.C
j`x<Pjg=XQ
;.Lyk
aqPCc
)>s'ou
wK/h[s
rUCZm
BT7#T
vDx!2
?>v3I
EC4}B
]tT mD
ql{5s
xNL^T(
.1vB7eI
#_o,x
u4v9\
& >)M
oQPr$b
,XC>e
!1]<3*v
p$[b)
V(zA9
5`*y%
|s1qR
nvq1%
IsWindowEnabled
GvS9-
U*l{P
FzN:h%
EF:\|
(&#qc
+-|c&
&W,N}
V/We3z
x~'j'
N{#)/
aE4!F
^S%xz=
|CuG?z
@_)b/
?XUvf
ax}JZ
+x8V5Q
%#07`R
oWb=X
77+Vsd
<C45tH@
.bpTY
UT66aT
BIqw)
)]XI'&
jTe4L^
244f7N
Mg,/MQ
vUVBk
z,8kh
?`tF<
E6F="
8{G{*
t%`Kk~
CHl7b
TMf.)
E$cBu
Qpl(%
dMA`"
b{Ks{
aS!\P0
&wm)w
:+s6A>
mgdu}
]3CWm
?$,vD
qISB=
FileVersion
]l<y:
Db+V]T
n/oSi P'9
6<EilM|
66zs"
&M=kV@fc
5U^sd
+}[&tz
kU"LYI
&EPLf
|Z^8e
mB"5[`
c~ZN92O
QNSfef
Pqk].
qGYuC
#e=z!
MQ=~U
tB&wN
4>Q_r
c@G0Ln9'
x'1dB
\?1ajL
;*R|Cu
^z/\(
D$$+D$
':%Ej
_7GA9
v?o~=
f#QVm
JqAtH
g9ej/
I/,+Qtok
UV<B!B
b/h}_C)E]
[fR/p5
rg$c2x*I}
lt\Gs
Qp$pEH
)WEAos
e_C&p\
w$Xr!
HG]pS
erl[<
3e A#
CheckDlgButton
G@}6q
+9XGY
1-RZ
N.9c~
9nM603CIf9
RAnX"
D-\7fY
9=8gD
l@_LG+J&y
*`zqfYl
DeleteFileW
agV"o
\'c-R
o9G|?
NTMARTA
CIZ6`59EU
H4?Ad
!HX$!
1=;D|
InvalidateRect
Z]\54
-F9bi
=?D(]w
G, SD8
4~62#*
UFG-4
K4;VO
Kt[Y
I2A8V
|RUkZ
y+?='
:4.tqr
gP.8u5)&
-?[NA
['yg9
}IL {
#vPO2H
)9Psqy
5!Q6a
JdqA(Y[i
hyij?-
jnL&9u
7/!rd
2r9'y
l.uK-:
JR~lV
`&G`c
JYspE
2vDx&
.nJ(x
f=kT+
F\f^w2\
hD*A[j
ifE[GN
K s[
o5Wsr,
}xh<?
usK-i
b$cy<wr
Xhx*$
4-zn'
cZ*{f
$2;IF[
}l?PE
6o#&;
GetDC
g`HI
U=wGE1y
\qOr/
KH)1X
#&ZY2
K@fam
uD<81
RGEd
daX8%
H2]F>[
;8*wEZ
p:|Cn#
?@jk.
p_&[&#
FindClose
gh^]&
)NJFW>*
7gt4CXX
VJQAI
$Q#jQ
flu&}
MulDiv
J"+na
Ys#:8
5g?B#d
-U"%S
/Euz[
Rf$9f
o4M1>
%j*,8
RegCreateKeyExW
b;?I8
U]<5R
vX95h
+Xxe]
,kkVG
8:<#T
s495
W[:Q=@
XCf<e?
g)Qc?
pUFfvA
SETUPAPI
@vT\1
96!Gf
vSH@al6
hMIq$
Bmd8~
vpw/}
JV9K3
(Ny9io
Nv~le
0JQCx
VY"wX
YKe>C
E5-C+
SJ8f
8lO)[
[.pen)M
m02$g
NCS)-
\:pa*
OA]]5w
]kDt2Q
[*U<.k
zMN$S
=(A5[
$vpbi0
;HM _
`R*ESI
VR\m8
=7+1JD7cRL@
s%]Q+ziQL
WwtC'
M;zP9
;]Y85
MI\P1
A[[m+
xbsC>pt#
? QY(
eX4pIB
6lR|;
jgqzU
5r_h%
M9bSk
CoTaskMemFree
i287A
&ew\%%
WW51L
,Lftj
0:}(O
]tCh}
P@&W7
gG?-6
yH;{o
i5nlr
UGN6$1
$}bR=/pl`B"Ci.
vsj6\
X4nDc
*qodv0
pU^k>
Z:TvE1
$3Sz4
cMS]C
Hh9m;cm
pP&Km
v{Q*}$
06UO/
--y;[
w/=Y%X
GetShortPathNameW
'fc)Q0
vP7F6
Ok#[i
0lys/?
7{E$NP
7tF !
WpJW`~
r!Lea
@Af]WY
N<+%ihH&_B
;t\"#
p]Y$
x)1Oz
j[tx^c
K<iKb
j~M{.
>Sg:s
W4d*#qLLHE
qne28A
R/O*sK
>sZu2
IEc;p>
kuGY:
$43A@
\a[UI
aFEj}j
/)^EZG
daJ6.
s737GX
yT1e'
FjK=P
APPHELP
`u>"%
S>]6p
AX@GC
<gG-mb
1`vN"
746!%%A
,@5^3
iONuf!
SVWj"
a(WuT
urI0G
VH^&AY
}fF,:
B%\0Ac<9
CreateFontIndirectW
3o(:21
'KrX\
^`fK(
yO!$O
]/o}3
aYB|Bw
[HjBWg
ng 4cVjA
KTowt
D*gt3
*@9qv
$9j?!
[j7ND
LoadImageW
]7bxz*
4k?4W
[z+e/
F3%S$
tZ?1!va
V#`)Ui[-"
[9I*N
<]3|H
7;M:F
$5Y(+
GT"m|
wt|Wy.
gxHdp1
/($oV
Nvv<24
?+-Sg
GijA;
,8-@U
mxjti
kU5ZLB
T9wA)
3X?*]u
"PM)Y
HXzo(1
q96FJ
v%zYN
.p}yR
=a1zG
dKSYt
R'#lE
y<#E+n
JAbd=l
<gn99jq
6=Im>
pV1k)p
Lm90U
iG 3fHeJ
4( x;
2hDnb
=m)+?\F/
W!vn)
n:`8+
]6"HvI3}
ScreenToClient
[nI1c
OV92:v;S
GroA7
GtC,vC
&*3Ck)
%s%S.dll
;eK?np
BM%j/
_^Iu<
2H?qQc
&tpmN
/5b61{
1gk%@
".x87
I\]\U
@{O#M`
CWVWin|
FCK{YY~
MI>Hqh
7B1}s
lxXm78L
a]Ay(V
ProductVersion
t~'@K6
&'&_yD
k"Ib%
#b(DmO/
&r=,~o
..68~j
h8~BJ
YfR@lMAi
mqUzB
/`#%LH
]X:ME'
!(\S{
iwO$N
+-]q8<t
\wmpMnv$)
Zn}K&1o
G;sIZ]#=
_D<w?beV
,ji/:L
RichEdit
BZg6zV2
k'aRh
<(b3$
Z;84[
+<]xO
@23q'
QSaC#
HM~Qv$|
$CKc|m
x/"'H
idI!X[
X3#c:^j
PpT0g/
XCAw.
v|4S|
:{"Ba
D'|ca
ZOVx1
_n@BZq
<D+wF`
_*<7e\`
w\06)B
TsEJAu)e
GkcPUU
?W5aL
w0^{]
6bU^W
:E8Rq`
fOk$y
j?VK&
!l|]R~!
8khI0
L0j@Q
jSXUg%Y
S<iDrL6
<:eSa
g"8Q'J
o$lo>
r~!@w
Kf-{{
NhwA'
tnyU6E
@BZN*
z(]I[
yl<{E2v
b{edo
Z=B_~
@g 58
wR'Yw
2%@."
LSI|\
pmjd2
>\.Hl
viUn#
m"agLs
dsv~X
6}-B%
;T^S4
0,!XAf\Y
axRq~
IFxJN4
tRx!H
frv}s
?J9PJ=
8N6vv
d~yBy
?/MT~'
Ji[i*mYT
;Te+J
&sL*}6
vCaT*Q
(F0Xxr
x%v['
hrh3$
`TOqh
SRX;,}
.z,?
T_@-Bq
9~Q/o
l*7C\jF
"9.t n
705f/
kT@=L
rk@{J
iW[$7^
mv@Zm5
F#WNC
d`0($-
wHwUt
"d$;z
<*%)8
Y'EDU
wNJ^k
ccwmG
meNdb
r>Ms4C
^q%O>O
e/1}RmU
;#lq
{:.8(Dh;
0?B:}
[r0s8
eEfqf
<S?MI
[p1=b\
-[<BL
s4R-T
Er+U#
#aojO
,=VWV
hw*LzL
k/reP
Gx:2.O
=Ukt\
gp;*h
6|fEY=
y?c${
O7:Xw
* t7=X
g$)Tmh1}
_go8d
jnVw(
)}]iJz:
G-"kk
cg\#m:W}6
*Ujrj
d0"{.
W.!=>6
rPi/=
8h^X@
O@ntBz.
{UxR
Z5tCN
|^~}_7
H!4\++
>|%`;ZNVG
*SS3EM
2(D{<7]}f
7aTd &(.)K0
"I<ZS
64gTlh
cg>qw
S7zt%
FnQWDkB
ertvH
V{dTJ
cw=Fj@
p1K>_
y93mN
@'tM$
k:?I0
`.rdata
HLVQ"~
lE!UV@
#PXrS-0
3a3~.
:%EIj
j0z+_MD
.3,RX.
[Ts?Qj9H
RegCloseKey
1JpaV>
>]"f6
hccY*
\ncvW
iH*5/
`O#54q]
cKEGEVN~
2.253B
<\h@"dg
Yh(4>`
(.t#/
{f{6OO
0y=|oJSV
D="hw
8tQ8}
q1sgj
B|$VWm
"YNXr
/.Ka6
t;+$A?I
?^lOI
*!)OU
6q#x@
;>4%;
?P6kYt
]U.*F
5VqXZ
ty'qb
Dmx3V
sRY^x
z"YI9
m[aYW;dr9
OPNI5
(\m@.+
nD7d0
G2&EB
P'&[8
\VP#8
OQ|cO1
FNACM
y;X[(
alx_;
Tx)y5
e.n!DG
$s?'c
veJGq
RD/)7]l
Bl]w;_
A)Ir<w
}^m1I
BLv!CzS{
YD?r'
(gx%3
e_rO:
WritePrivateProfileStringW
RF/SIX?
s$y|M:
VJ X~O>
k$e8J
K:Te^
leOU:X'_2
yJ%;iV
AwQo:
DLt+'
NE#N.
Go>/f
ZzII]
Rle'Z
Z)D[8
R>~r%
DUfQ5
Navf\
"\Pz$
!~*$"5
]kD1z.*
:3,$'
`H:rqLd
/<AD`
]!>}H
BucZ&
f"xW]
jwr,!
aq4j"K`
9>|,}
SetDefaultDllDirectories
q}UM8
.W/r}
_i.M8
bp2O;
opSUO
B?I;@;0
"@\d(h
Z],0}
22Il*+X
t$ 7!
%ls=%ls
i7_bQ
{DzU/
sqEG@@
?@G~Yp
vAx Hd
t4?]J
iVT.$<oNZ
d|~O%
iQv_7W
m!Sq%
9o3e(
b_g=Q
QNZ4 I
Jd=qAl
t6B].
SysListView32
f"bQRI
']O>N
'FYx{
u)(S6
e#boU
ir.~%
g]G9,.
GlMKG
mGA"$"
7K4<d
PAa&(
XY](0
gx# I
prJ;)Qe
6{3.6o
~GuYp
]2](L
+}T;r
`2M~d
(#+Y|
Db*wX
bdJp|
_&0W8T
Oo}^&
kOwh2
u+K-Y
!Pv^Y
l%XzJ
WmQOU
-0qNL1
]+kk&G
OEEjU
J*;Eu
7^&3V
]Etx{
;caG}'
t^`3+
)5@53,
(ovU/
jLqv&
*TM2"
~aE71
1^\CMiQ
_5%\M
E/lSr
;c,n^
t<IBd
uBny_f
Eg)lE
4&zfc~
\%)B9
tKn+|6
unpacking data: %d%%
<6m7S
@ iJp
p/7w$
bJ75)
w c^]O
:!VbZ
)oCWZ
wn0U.}
#=JwS-
d(YB%
J[Nl2
9?5Wa
+\2u|Gfd
;-!Lae
v2#l/
Z&<_@
*Al7V
^1ef}
GN4;.
M6,<[
A!Nd*
^l+'f
GmjRq!
MoveFileExW
d`5`T
N##k(
:~9b.
HHV_B
RJO^#
ySvHQ
J;;uR
g0bF>
Zt#8"
Jt(iO
m(m`~
NcEv\
mY#FC
HP'oJ{
zD-Q5
/NO]'
O TD7
\Dt2$
&Ky_6
,Dp2T
0'Wct
M~|5$0|l
4wJ3[
q}[%t"Dq
s^)#
zG|1NB
#/ael
*3Kg(
?`(B`
!KRxq
Da'."
u{?d~
prt}'
Ofs3-cQ*
@!okC">QE
,-7kN
_Y3HE%p
PV8j0
x0K5E4
_de/?
q"L*=w4
j| qML
+aSW;
NullsoftInst
HhL1c
t$,VW
(="x7L
:#3PAG'
L$ (nc
SHF&(
cX9%*
d4>71
RMMRIB6
UFa=T
3Kzm<
{xPNb}V
Z J[S
~%fr+
SepJ&
Z<(Z+x
I*o7!
`JQ\h
dW.S\=g
h[KlyNl
/vcw=
k8~k<B
VL{{ R
j`i[0
Z1t97C
1Fop/
#RTk}
|}VU>
p>&k,
w=`QzoSG
oL?"|
"]5Qr
E7-{=f.w&q
zzG5}
.uo{\
RF@JQ
,;+Lt{
7LI]]0
9IV=f
RH]L)
h-o8N|
p*=C!
Xm,D(
)h?Zr/
k8raB
$/2=*
&^?%1(Q
x83l!
WE}}B
t9S6"
/eN<k
[9sTwE
EP%Kh
+U,V[+G
N/uKn
Y-)V<,
e/I?U
C<jm:,
%#%[>Zye(U9
1i"J+
Bj!ve
D*xWUW
ABX@b2
\Y?:f?
0W$Ey"e
E!x:T
+OGFi;o#
+m>hL
Xy;:,
X=x"f
>d.9B
l?utZ{
=c`Bf
\1BE"K
^O?8mP
TmKk\
I`1SE
(?0nE
[\7-d
0D'G
\ucYU
!zsB!
|yLPi
o>Gv_
PhwV@
~o=I?
qNZHh
<!dI;
"WW}j
WSoP6
L+(,Z|4
X)M#z
v_^\^
*"Pnm
Hx]G#4
NF24W
4O'4
NH^B//
1_yXS
zW FW
,O{*a6G
D#V$Y
sd,Gw
sw*L#c
n]DFm^
pQi|.4
KU;}T
JQ>KJ-
VkHH5fV
uHD?;
i%I&[ #
KHBdW
g0sm>
qEOpfa
n*~N\
Ed`!z
UcZtq
^a&`w}
i3*!?8
_~U,
|W_kg
NIX-2
AJ2$s
Vm`Pm;
-IX`j
Te U`2
aEiZF
gx7+JG0
O~<f7
@?DDv
9:RBN
O>:G]-
s8,s%_
D[k"TI
"hkBtN
@3iit
SG1[}
hc.e~
;uO`5
?0'eU
$jo-0
yw<#nmP
R$`O[
SIys+
JH`uz1{q<
J~E}GR
+53!9
m#xYpf
~!uS|
u#=k4
u'BJ-
1k7$Wb
?B5uM$
:\dhY?
Om3"fs7>-w
31}_fO
8}$cQ_
t;n)z3
bk]{kX
Xmj)IMzM
;%4RI7[
x+|bG
5&u'_W[
Ep%>A
,LC$g
PLoXQO
Q_G=\A
L2BAq
@0m&g
82?[Mp
tEB"PL
()F;u<
0;IMR)
< 3d^G
4]&;iu
.0o?Q
Et& Z
[& H/
BP,YU$
VeEFH
< XB1;J
tcsgx?
`}{@@
XH*qy
a$2f3Su
z@TeK=
"O)w'
{~-&3
Y"|V1
GU7Qo
XjLERB
]5!cLvgY
!m >Vs
Imm6_
}{+t.
Lc&Gqv
24LH15
-)`3}
W*5c4
Z?Ob%:
rRyu-M
JH](i
$*[G?
:B+iY
*W0{UCr
?JS6
;|KTF
pE#H
13nL05n
TN=X4
3-w$Y2
<bES2
p=*tn
'+8U|
4eY+R
r6uON9
B`#t'0
R1Xtp
,Bwc7
t;)2@
{Jf58
EK]3,
p<cD*
SQ9:E
k\5'>
G'{gL
tFH`i(
n}a]>
F(hed
X@SYv
f0-8W
8'> +
w`>6;
FJnDD_
OriginalFilename
(1t7$
5On6C
)3U+HC
c3h+=
_>GE0
]wQ6i
|O@:G
Y}Rl#
Dv::u
U:[x_}
/|w<wy
"-)W4
7<}lp
NBo!c
;z}}U\m
nHcMu
VPw/.b
`x4{("
}P4"vI
&*p[\G
WVB(B
dq}O:M
@u1]n
U].E'
YMA2I
bW3]h
[ml8)[
aM,Y0
8W)RIgZW
Q1VG3
tkJ;W
0)|\3
Bvqg7
+Mo[7
XJL.R]
+N0 p
gT-%>
s"H,O
%F9h&
">RkpB
rkM*A(T}
42@Z7y
p+p\2
0wy4AmN
Ty3o:
BI02/E
BD|LRS
n$`66/
PG~QI
bu=h6
PH+'fP
/YLC;
p@]i-
`\20X5
!f<3kN
=>KH'
Yif^e
-P9d7
Eb*4U
%u~f0
BvA:_d_
='(lD
[NyD-
"iqE/
Ad6X9
owE0+/e
k>lLRK
~kKsg
JgM-C
4lw$N
3Qki^
n0;*Q
wRt?s+)
C}6R0
}bzVi9
yk_q64
^>L%ID
:eTrJr
w^}CB>
+P.xY
!#HWO
:"YgQ
DN3_[
2,j/3
-{yTb
O&\iy?
U^"_<
T9TD,t
sM!Nu/
<:;t54]
&JBuM@
'uXdi
M%C<^
E{29-
bmA:|Nq5r
^hJ@82`
P68,=
Qf[iAA
TU]USQY
TklY%
gG;,t#
Q,/|3
eFo:#
~.#Y4
.F-8A
CharNextW
HmGCQS*r
?g]_'/
<=!I>
!.EL8
S%UdB
+z ;6l
eM]X5
oU^Kl
FSnd>
#ggy`
o?\X;
w+!!v
Gb0M"
k#Jc7
P{nlmP
]~/ U*/
y?u_Y
SetWindowPos
.Ofhd2
>5 |dqw
^*+XyH
)<P+f@
{Ln_x
:PMeq
M i"r
)(psP
Oi\^#Jzn
wy,zh
&~u<ZP+
vy'>:
LX(hR9
+H!T"
<s.!
.IKl4
GS.I2~
|-`.#h
K#'gDO(/Yx
'{#zD
;4z7r
^SPoMQ
^7>'6
3H,(;
-O?#<9
0Yv"`
'0<"Lu
2"2$A&o
:K\N>
BM< )
;X@%EYYp
l/%zqe"
JOTWL
@_^[]
XQ#/F
4[n5T
^kw UE
UDUri
YwNP[
4qR*<
z:1v9
|n{a=
':HwI}
B[Zpsu
4bR<m
Pm]$"
pO'c[
(*^cCCk
"k{%!
FCYUw
^TLvdf
ss24+,.t
r:40g|
MZrkaf
d!1]@
W/Er6
+Lnp<
~(X1T#
(4("U
HE(kaJ
eswC7
^Q% h<%
l]Z/x^"1
Z@]1+C
P[<[O
k{A<^
A>g3um
irziJv
g+LQ:4
#nAXi4
Vo#l9
t/(c2
B+SsE
-]mluj
_9<h +
0|FRX
gUG^&
$ 6@`
P<lnr
VMUp|
I;L+t
SXs,|
M]p{n
G);pf
Z}QAEr
IZnjPf
0FSm"9
CAjsh
EEAP/
sUQ?~
X&p60
~^D.(.
<o$\pg:E
&h~]V<S
dXzG%y
9+\-l
1mI0k
[cng@Uy
lbLN+
Z6Bnm
Hi<b3"
2bPmU
zl}iF
abbab]\
>soNf,
$-?c3R
=>Y;$
h^<&Ws,
rxm+T
GetWindowRect
GF#[)
)@_zWC
o<Q@ln
nm\aF
]}c.&E
m;=Am&
xFS)b
eo`iD}
^8|}8
|Hi91
(I(TQ
4[V;.#
x{mzR
bOv>7
uD,Un
,/KPip
6^AOT1h;
:M1>#;
KGK'KZC
q6}'l
{hYdr
~<OXE
dxn\>
#ad*g
"^gn.
HU[p3
XI|/$
C8B:9[
j [f;
Rwe\D
f6g`(
)F]^cM
h[*}
eT96S
="9wq2
$qz-O
V)E!(
aOvd{
;[`BB
k0 w#
."'I:
9\,Bb
)r=pv{/m[w
24RL<Fs
MENmObO
rCiSF
vVkBM
xU_vd
.l=~^
kC"E;
Ftq\U
8>t`NP
s$AtB
#Dyp'
8%9e5
2Mi3l
~^-vm
XM4Ok
r"skZ
ar"W:
{|OB?
m'QQhF
m/}V,9
8T">y
Dw~_
[6l}P
1YB&4
o0=iM
Hy>Ax
VTbof
Y8!N!Y"
L4Hld
b7<ka
lef{M=E
6C*.G
NGXbZ
D} BA
WdCvy^
`h9}_
OmtJh},G
c3*VBF
a$vVq&
(:3D,|
@<ADR!
B*wfa
2bR]d
<gzjgD
?Qs;ae1F4
sGZc5
Iw[\'
oK*U8@
jLrs~}
ejt6Y
A(7yY
7Aew)
_t~|Z
FoEdW
8$_^\
%F/u9
~;+RX(
e5@B},
^#5g)
D:[~SIg
b|S6-Z
QQSEG
sb[e!k
LboTAt
LRq9-g&
,HW3$
Ko)F"=
!2Oi8
.gnq84c
gjgcJ
n RF(
~X;"e
#^r#7
lFTc'
_xe{.iC
dj359AGVWd
4?3~L
X3j.>
Qb81mz9a!K
Oa*W~
s4^0D
3VR3B
$G&ea
0Nj $
z+K4'
Ryq^a
T]6LC,
6L"./d
Vrsdu
&;u4"
}1yz0
a%=+~
o|CE^F
[<JgK*\
BKA6lCSlH
^|D.Ne7
VmLk9O#PC
)j*72BR
EDpf=
1e{S(
@m8Q,
+Z'`s
M{p3|
*U<Tg6
mBaB0G
3!Oz7
MIK-;
mo2f'
r#b4c
Buw^N
"h/UX.
fHUE{
VYa/u1
w;82C
7x2X9
j[<;B
^'~fN
7KjPL|
FIVgi
qLCk<
XZkDS
4-0<S
=or_f
TU-fM
c/ >M
o)T7y
+%jK^
?eH5n;j
Qi/V5
\f8tp
-bU{U
KpJh
fY#uC
#'ETZ
gtTo0C
!e?ctE
bQgP#
#cL8
kJJbE
xvH";
<Cua'eJ
=v*7gI
IsHTHC
u/(C1
6nh[15
K%obfC
<v+Z}R5
}BE%i
r/(R{
D8&g6^
~y`Z.
#lw.''V
+01`y~
hy3kJV
c\?\>
t$T24I
'),L#
SystemParametersInfoW
~W/->
*<9K8xy
"qUb'|
mvVpNH
/y.>a
=0z6,
[gn=H"e
SHGetKnownFolderPath
E;OqR
-uP!r:
i{=]w/aJ
XYmqO
IH)k)
uDWWh
l*lJ/JF
4W70B\
Nu.2X
i223-
jnFf;O
'RX:`
/6-qn
E7.sV
HDGPC<&
420l#9y
!=]/4
d8_L .
t^!$c
onU=v
WQzhh
Bq8,5
iN]Ry
$<8v//
Go<iB
^;sdA
c{hdt
vQFh7
5{ CV/
<K8\&
5ykv{d6>
k\V+z
GDj<;T
Wx$-Rr
"`IT
a_2Pe
c9FoT
k4"t,
~_Wg_t
t. ;D
BF1a5
@ ah"5
jDf56
SearchPathW
g* Eb
GvN.*I!
uzt?P
j\{z-
"q?KTe
&VF-p
[igT$P
Rp?'aY
z!`sz
F4H&.
(9aJ)
gN-tv
GetTickCount
GLp(1&^cg
EU'R-
<q/!k
y"%{bR
v=trm
C0!&Q
b a'=
xr4/5M\
U;\_(^`
stpyqe
-<@l}fA
Y&,/)
+tlxy
v1:2N>
.HhbG
}'W\mH0
q dqe
buk07
Y*t#P
.UI%e^
+c{mI
3Dsep
'#=uPJ
+p@Y|
LP K@
:{qW0
5"kGLI
nPbqY[
kNGWq?
V\2^?
>YS?j
B@9L?<
a]iwEe$
.:A(.
-I&JMf
[sBhX'
[sY1q
H/5YW
o>5Ni7
c}m(x1!g:
L9#]!
oeP(*
zR_ST
xDgBI
Y,pxO
ofpk-
8!NGr
#e oMKM
MultiByteToWideChar
ME0hy
O;{wUh
C@:i@
$TY)U
z55Ed!%
aeNl4
P?'f\
mi&\}[1
JL(HBK
bt2X=8
{13[e
7E-@X
4ocOY)
]+Th3
*g%Q)H
)7w@V
5z=u&
[c[2l
;d(EJ
'82ywu
?]Tb(\}
a[m`+
hrm(k
-)vq/+mdj
Vv>\56
,C@J#q
mXC!>
R#?+-8
>_r''
BYR.s3q
t_PIC.H
czPr3
M#~b`(
$VqqVh'@k
12VB04,'V
|9WsN@
t/M:]<(
bw^he
\8h2g
Ja*&Lf
WmN>V;
I~E!?
]"RVi
@\)TD(
v@fz-
B?k[J?
Sye!Y6
x.*Xx
`^^^sS
Q}..Zu
BG;nh
CreateProcessW
G'P>Wb
I.PBmeG
kqP*5
/eP:!
c:(^Of
[pl85
5bgF"
z4.PV
|GFFR
8Bk/d
jRN(K
@v=iG8
v7r-i
dM}.OM
$KvUL
w%"v[,
>gTNUe
y+c!=}
O0v}Q
@8/we_
qJ*=4
... %d%%
\$dzD;K
Pl'-5I{
zYb~b
:nm OS!>
8GTvi
y<8?!U
'G:Z5
*p}ka
NN2B|
<Z2@)
ue&(;
WQSPV
,YZO6W
l9O+e
pl9~H
UUUUW
;g_Qf
6N>no Sk
\xG9ew
TrackPopupMenu
W+Zt(
b!2FL
F"C?N
+8P;F
/1#fTX'M
I?aF)-
L6".=6
EeJED
{3DpI}65#
lstrlenA
9kWI;8
]D}{M@
7K)y+
<HK 3
6DJmn
eQJvOZPZ
5T/-:j--qm
8R<R?
LaB@a
FR(b
FkeQhI
q6h0_
1=~s6Y
+)?a*P
#)5v0w
aa0'/l
Cyp e#\
sAr\3
D@8/Q
CK(c%
mc.`hF
Co[h(
m_6fH
YN,e88we~
Z8jwa
0NDqx
NRJ?jj
a0@}u
S$p@P
6;(p#s%--&c
s;WU`
SyXFqr
{1n([
p]Dm6M
Vw\rL
s,geqw$
##\x0
br&Vl
<bejjk
1ljI.
/:3U.
*q@$z
vcFP
MHn`![R
"ux&^
Sleep
S{W)h
phai@C
H @p33
Y,mUy
n8Q(X
V`ZrfE=
Tr5KO
kqo0ki?q
7qEl+
Q!2uk
k|HLNY
(F2z$
Q*\vL
GlobalFree
:v]CV
rH-9
_0g5~
vBF;K
7`+8I
GetDiskFreeSpaceExW
d$-uM
kQEhE
ugrJ)
}h6M-?Z
LZg)u
M]HJ~
U?RW~
`b?2j
K_Yir
eOsq@
-U$;R
I63H1
<)+>jI$R"
RegOpenKeyExW
l:*^L
yy/Dn
XV@|Y
Y$5Vy~
12P<RX
]oiqH
A+k3Skb)\
,yL/i
+lZTu$
)E?rA
#YiwV
A6`X'
V_dR7
?Q%%N
^s2vI
2~CU~
(\J[(@)KH
z}Co,
_K#K_{
D*>$)
n'q,`
aMt|_
\te}Wx
'o%0S
1YbTEES4i
wpPST
A95E7
vTJ35
C"0EQ
IObit Unlocker Portable
?vG+6
iJWnTM
t1CJm
CXZZbX
oj?[m)
gxWO[
n)_Ey?c;
M~riC
4bFv&
y)fXe
lb}j<R
?DzV(
^nT})'Z=
{@)57]
:$Dglsm4
8 32#
}7vTz
ejE",+
'S97i
,b!Y\
*7Z`\
4()E10N
Mw5x4T
u6f%`>
IWol%
?'.qJ6
~"Mjr
y@BdD
^S5!Mv
'N^B:
"~4RX
ddJVnRM
>=?Tq
D,T%<
.!'Tf
"b1bP
3RFk!T
"D3=X=q
f!>P<=
|uWv'
,^,58lw4kP
AppendMenuW
$6Lc3
>UE#j
95`:R
?.<r.`KUK
E[APB
j7%yFz
lXl.K
Mhq$v
{V|[j
DVX:n
+q+ +
`+M",
F5;Fw
m[Hnz
i=a%b&k
@2*U;
SND)fF
1TxNmu
#14LK
Vuf^}dE4
AX'n*
CornD
KD0{r
+^-m@
bQBXR
]buxyubO
CVI)}M
}WmPC
n?z3sa
k{>cu
N4+Qj{
2j1dN
i0/ !
CI#qF^
FAB_gX0
Nr*M-
K,RG\
Y>Tp9
CS=}A
.c5Te
)p!g[N{
>U_e
4LcFw
F$R{C
r:eZY
9)syT
6fwMM+
~l;]=
bx]L0
%]$\-I
I\0_(
K5B!h
NH=!$&`DQS
-:e1c
AxZ>o
_/T-Z
a)Nf$_Z
hkeD
#knxNsGI
a=2U*
eNR\^
<?'ta
(IEDI
GetClientRect
%cf8v
Z]/c?
vhQ-:
?_Gbs
tLOLew
O.NYn
p@d%nm
k.I|P8,
S&M7wd
1w,cy
Sv{pY
DB$Wu
Ru Lk
U)B/S
;YJ=B
n+m/GT
mFV,nCZb\
/<1&!
ImageList_Destroy
@c@1j
R:ELF
,a=ns
+pZ"C
"Pkt7
5l|N
XO{$j
f'88v
?o}S/
gy^%y
LZ{">
-Wq53|
"p28$
<,n1{#Q
a[g~o
_1\x!s
!okOb
[+t5A%th
#$<QX
3.$>)
kuH9<#{
83('[TH
99x&~
`%kj`rO
ExitWindowsEx
fB@XL
l\_qF;
f~"U~
MV_P`
ol=*P
y1bdj
SUMt1
_I}b
EL^qa
w=?m[
GP0iu
HQ]uxB^
!h_^QC
DB;lh
8WLg"Fl[C
2Jflq
4&9%s!
V&'i{w
>sm>r
T9gHo.`&G9
=|0'=
HKHhP
,9!]!v
:R/(^
oC57\
SF:y|f
4g#n6
\JEQ`
a#f\0
\2n( {
g`7aYYL%
P=8Qd
rMh_-
.jSq}A9
m11ByIY
F:p!i<
NOTc}UJ
B3Go$
s<`nl%gF
4]CwE
*+eq{:M
QS~W5
<vPKw>
Wp]`v
d?`aQ*|
i~Pob/
\#y4k
K@(4g2
ye9;4
y_m_<
}h/,#
OB{Y*G
Okd_5
#;>~)U
05y{F
a`O}=
a3o$2-F<c^
NQgEAA
O9Hl]
8j"P\8
Fn>*1
"t#H=
GetFileSize
U@L>b
}#r5
@E,mp
~w%s:
yBvIW
TDI*[
vANaC
1.2.0.0
0n)5UW
"#!h;E
1G&e@
}1\j)
-X;%3sX
n`J[EG#
tk2`]
h!tRj
W+fIJnsfe$
(?6Z8@
e5!v3fbI
rK)X5
Dva&_E]
H l_n
@ An^
gc!Z+
o.i"(1
{P*zK
|*VQ[
r(t'PN
kA.CX
?r/#:
2&NJ)-~
LoKBn
#ub5.
Em&ag
h\gIu
glc5t9
-=rt=
T${>>
PD5XC
TYIAX
G\>rCj
V4M+kZ
Q\'hG
/)gws
c'q!TeL
o#bNw
ab1H"_E"
EDQg0
E9Ho$,
dn]@)
orgM/o8
C+b;6^
{)EYO
HjKQC
2'W~hu
<p?{q
Gdi4x
'1"nf
FA$}jq
Lk4KJ}
GetVersion
m|gs;
mWd#8o
OQs-g
sg'D<
i$aH6
>?GHKQU
g76j4>3I
y?@P|
m[' }J
T<l.u
\)~C/
Wc'Z;
BSTh12
aTzeQ
>l=p(
)^p5
R5}v.e
Uo53RZ
m:[4xR/
LoadCursorW
i"5T#
oz^,cd
^xfyI
;-{k:
ZmRzw
(\j!p
S@EkY
xv1tBU<u
Wk1g,
=idM1
dDQ4o
+85fw
b'Km
zZACQ
Jy}5e
%fGN6
jB8a~T
Rpe=7=
l5=F=1\
7Hrhls
;[x8i;i
StringFileInfo
-[][u
\i>7
>wf:p]
@23*0S
SHBrowseForFolderW
"B4,Pz.
EDH$#[
g}WCol
r<-C@E%
B%MDC<
HS\F\
)>->%
@Qu#O
J*mrP
/Sefg
S$L00
,QcaO
m3=3~/,$
=WyDe
:{fzj
d":P4
B)ME*
SO@jH
D[r%*
WUgWe
byT\c
i!oD0
O[2nW
i"G*kH
BrIeB
> K`f
aJb;:
7"txh
#J_Y,
`99tUK
Wv0ciS
H}6co'
.'=9|$
%.z&h
|}^pu}
)DJT5
SPba3B
Ew?QC
x>f&p
1OzcG
xOv=$i
9VT C
4;<G1
p6_`4%
hwFp\
niCqG(-{
p@yqF
&pOH#
Xkf'd
u\TI%
~G|l*
2Pl:/
KbJ#j
{5P Y
RN,Z$+
$p`#6$
S@4~o
OR)F(.
f9=HgD
|Xh`H
M87%*V
n`BR(
B#\I\P*
!z&`B
.wvvGD<k=;;"DB
;A,HQh
HW-\II}
^|{I)*b
6\7.{
Ci<ZH5/
A:M25
WFCpG
08=s<
@%ie*7
;(l fU
5fYO|c
x~a+%t
sbB%C@:
D2}&Hx<z
@j`R'
lY@&&
&LkXx
<UA{Y}
@+pg3E9
e)Kwo
AX8o/
Z%5J>
I2B&fe
LG=#P
tH;h=
>cQCi
~Fg#.H
%a,y]
O>&6O
D[Z]^
3n/Y
tw8>ENq
.qEeK
)?i!&
ic0AI
i}XZE
20n2EB|6"
6]`D3En
[6*5|/>
]jdB>
aYEtIG
)Qp`Y
L$g8Hh
%qiiZ}
%zuN/mrj
hp_1mu
g/-Bz
i=:Hp
P: e_
~E[7wB
SetClassLongW
4-sPq
LZ.\$
jQ!dz
8b#90
L>@.W
0>38);
%#V-)
w/wQX
{}pQY
3!fU7He
lstrcmpW
tI+2yN
{ly1^P
U!1c'(W
NzBm-
RichEd32
OleInitialize
ro2Tj"
#8[UG
UryzV
fBc\
sX\\O
Wk.!7
/p,%)
Lg[N1
Mm8xC
>v[Mgk
2:{!6
K^zs/
P:TVrvO
g!rrM
Wn$5)
LGGNMKg
Ezx.U
&s_&h
6"Kx$O%S
^Jhhq
e2cq{5
Ab>WK
LGZOZ
eo]g>I
%PB1i
GetSystemDirectoryW
P+Ky{'
dV3}N[
hm^W8
KVPOV
cGfeW
Noy#}
Lc~dn
jip1!3
m22]D
-myXox?
xXS^=s"
`#Qao
6|WXY
i0lkk
FI]F[
XIS1F
PostQuitMessage
-`&k#C.
@prtK
NAYCcI
54Gku
/,?7F?
{8PQ'
x'?9u
?k5o"s
I5H[,
Y[tvRP
I:M7m
so41<
tLAS@
dccaX
l_F"3
1[_>=
%xyj!5
L'R6L@)
}{I1g
SZ~?z
R@=o=E
jk kXuW0
6;M30
xy](P
|0oe/
x&{N;5
w02lb
#x4_,
jY8L|
p:A3R
l&kzV
V/9y$
Y%J-:u
GetProcAddress
St<@bq
%(-hM,n
0&DiYlB
9:1$Q
H6/"=OnO
ci|z[
&M;Y{OcC
ProductName
;4F?>@6.,
lS3y=
qw Pq
2N!+1
/sNx,u
sM<WQ
[a6.I
'NM|p
)1<[FzW
B$.VE
q1GTW`
_8[S{
S+[dU
ny<tV
SetFileSecurityW
Up.(rF
XqtKf
,bkJNB%
Fy~y]
8eB:X
|,FGJ[
C=R'e
amTpr
\d"Ne
m]k^J
RpTco(
t{`~t
K$olR
+"V $
zhn(A
A.`XQ]
4;xx;
U5\Go
^mJS;?`
x|=Mj
]&'#=k[
a11NB
c'tA.
t_v4+b
1j_G<
=u2Qc
:%B+2
F_Ges
bs8|y
Eq#A
Kzu9*
!fP~t
^rp%0
zy&!
]b8`RB
`U)d\4
>75VO.
s>OM#
<G;P5t
mO\-yiz~4
z~Ttc8%
[VL!J
hE8Jr
md9pW
nS@|r
p63.#
W<1Z-
VRX>'
SetFilePointer
fm6D?2
rw~YE
ghj}5x
_Rp~v
<sU<.Ir
Q&;YB
(g%s77|
#8eZAl
j@\o|
'GA7}
RegisterClassW
'dp(aB
P_+5I
+C[4;Z
e`<?E5
(/iTG3CJWf,+*
s'/K*
H7~7'+2"@
TTr\n
QlLoo
lc0zE
hE5is&Pl
D)"0+
wHG1L
A)_{Y
f5%^rc
.l-cJ+lq
z85MF
EB]IG
\q~$N
+Z7Z`
JS_IK&?
sC').
;wtOhR
"a$!q4
LB %{
'#.7_
4obS}O]
s/2<)
_j_(e
:u1j.
GXP1H
wDXmu[
|J\%\
$INzs
`/wejp
,QpUU
lstrcatW
~j-=t
|{}7s
POb<Fj
C;[ZckB
sY@BH
X"M.M
eukD7
f1Y$-
Qe1l`
0RGyR
)^v_@
Ti"Qq
=!3uT
V@RMG
-%f)C
rDf@{
JIUVP
&\o|.
wFnM2|
,h]/<
$s2%$
vf:xw
)N|j9
]C+p5}%
23Qe:?|
"=p)*
piTv0
)}p_s
Kpwx.
UIO2b
E+!/g
-V\R9
Q5xU\
FM3C<
8Wj.p
Da5`i]
{\Fz<
i@`]J
p+ #'
saadY
'Q?j|L
=U4rE
gx.<b
-2Z6*
8.*"i
S3+4t
{W>qSC
s|>\
ow/$W
~Eo~U
07uIn
W?0^C
Software\Microsoft\Windows\CurrentVersion
imaF~
fffck
%s&t6k
SetTextColor
-A5uk$n
tDj9x
KIjr
z^QL2
)?<VG
rc4WD
GK%2,
NuAIJ
0B.[R
G`,SK
W{QL?
oLa]i%
Aov26
9>'$+s
!N58IU
(~%yP+
w 6ib
j;,wc
!t>;m
KB6p
|5fs|
9GWgoR.
rKW|Bh
D$ Ph
bY{tL'
&Q\5/
GetTempPathW
,9iTA
Td{oLRw
k7Ll\
p T#e
Q1xUG
Mlj+/
Ms!<z
Aro1Lj1E"
mkRi#
25P]z
/C>$s
[7[Io
}jM;J
#E02p
vrNdq
7p1,&{#1
v*w6e
%.M}v
(+~zK
~?O%~
kYI\r,
e,@[0
A:[bf<"R
O?'H|S
m4M7y
f[C9,{
SkCO#b
"De?^
QMk(amL
>Ta|l
PG*'Nhz(
izKUKKr
?.iz(
+~tg|
R6bL%X
R{Ri3
Ty&9[i
#g"U,
Z;z8}h
}Z>%<
Kdpy
,d"TI2
^8.D1
djdih
VP?KI9
2yGYz/
sPpp;
,n M:
MS Shell Dlg
eDT|ak
lGU^Y'
1&#;S
wW]nd
#r:E9
[B1#P
|AU>.\
Ua!~q<w
)KcB2
].&l*r
&`84d
z|Iq7
g}3nP
?>i3m
z=xyI
9K!ji
v@|wd**
clH~t
;Ynhx~56
DYaKqi
Lw _/+L
TI8)m""m
&IehI
3I%|^
cjd31
#7-?_
CL^ N
NQr?Kf
lk*s{
S:e9|
-p*(^
Znv(M
|_56*
NX>2?U"(
+{ 9:
0;;fB
X9>cL
3PLtqT
%0MuA;
r29c)S
_5JtR
t)N/e
$:W"z
.rFOIYJ
?5Cd8J
0P[Vm
@XIQ6=!
"QwC6
z4uy@
Ct3_[
Wv.H;
h4wM~
(}pS9
1fTmo{
m8\YC
JM'8@
2$jR^
I.=O<
;2-L#n
mb]1e
7M"(>
s5R'L
8.%X;
gmoc^
"||<j
A8zx?
aB?S2x
bI#E>X
m[-J-Su
lX*J\
QlE->=GBXa9
((IVa.
<xwQ*
QBhVF
icw\O
?c<OUA
oH>ds
\I*tb
N$$OXA
M(bM(
`D[H1
ooYC2=)
Vx/X`I
rO'S!
|OiEiJ
*ZBd<]
lstrcmpiA
Q<s+A
G")z%b
kzO6b8
{E&%z-+
Xy?m~
YJg;P
D%F'&
0'n>2
A[>)p
1wa7g
Af%jE$E
C75Ja
dww<q
}\3,*
qZ45v%
;C#3
$R7UEr
pFOOHSNNSMFB&%
SHGetFileInfoW
Z#az&j
g^'I7
"4m+c
E_)l&(q
zL0=/
y&"&5
s>T}!
^75A;i
7 5!'
-F8<^
&M>[A
(<|JlKJ
VS~,Q
Ms6GS0
KZP>D
i.P+B
Ln0d&
8GH\5
MSs34lw
`H["V
5Y0|$
ws&@p
!7FP+
'jNZ;
x()+\S
DagpL
lK:yn
T2=-\h
L75HH
xdL*6
\T3#;
a0+!?
65,2Y
D2/<|
yj$h/ji&
~OpT>
EyR"v
RpSOkw
fPPZm]\
y$=[rm
Z (-|v
k`;*a:
2+i(qu`
tKpB-
.9DI"
u;}73
TO"RA
;jDf*
/41WS
iGRTl
QQ>P~
QF</M>Z
BFpktl
GetTempFileNameW
u7\~Ipd
;:^+tN
q"%<O
\z=5#
o.[0rv=
b;Fgjj
K6#hqHx
2O$@mcY
b.(+C#>
SN(.x'
fFA2I
)fsJ&`
RZdBD PS
nTQd>
oyFON
'veE.4
,5)U2K
l.P<v
yI)\l
pB+cp^ow
f=@*+
-2r_0
7x8rV
xNtJg.L
_3B{+
`#UMe
"Y(";Y*
\S'0(|
8Ic*^}}q
qY3+h_
\i<)V
8iew1
1f6`g
m s=b
X9T,V
7NF-(UO
pw"b%
6MBrm
y;G~p
*i@^nG
qOO]/
\)x=Mi
#[@6q
ZR$ Hth
0in{,
n~1+o
YZCF^
M8V\h>
}=Y01
kj.a0
#aC!?
\$vZEu
s`i@m
:aNgp
Ilm5P
__O[,
i@mr8|p
}>TGe
/N(^f
]B}#$
ep'V'mW
8U_6-
q}si?@|
gj%np
R:|N-
v7POJ
CharNextA
PECKf
HQ'D-O{
7uT@]:
m\F87
"1?2,1$
"I?iDs
Km8Aiuf
SEOBb
:k8<p'
XO+Wks@
;d;e;
l,sEv
s5;hV
)|1eW&
Z>`}?
{R+}Y}
ZQ0{_
[H$w3
2Qijv
@2"dTPi
kA$q}
c)444
Wi=+(
@ )[Cimb
;-*<f"
p&!Z[{
v.YRe
,HMB "y
g&Uk=
$&Ysm
1^mUF,
w&?%j
'Onb4-T
;}Da>
AtAx*Ig
M7O{(
*4'f`N
X?c]P
\8MG2
is[6%C
]7j_k
K`k=l
UEo+B8
WsrTBi5
lVx2B
z"wQa!
oen6w
Di%-Y
e`/<S
?Zu$M
]a^~#6
}9I~YP
A_5[$|
a.)pQ]
c,Nd[
b)"%v
7"\)w
Z[Muqf
u8eGb?']
2b^Jt
FR=#]
T\;)$
u6yOB
m{${&
RB9FS
=VU-e
1g)eV
m$|;v
=[([&
,9O,J
m|p}p
,U@b:b
}QpQp
wgFpj
6fq!/
sL&^h
3S`Fy
PyJxk
;NTKd
A.AcW
rI`0%
^ASw[
DVSMz
T#M, =9
Mr5fAR
>Ng[v
TP+bg
UEq2]z%
`p qu
!rEA[
>\"q$
]a]a]]
*l3t2
vH$&H
:5!WE
N*X<?
GetSystemMenu
%[siLR
-xXN]q
+U-}-
0UR\=
3(@@4
85S:Mf
{4z@t
>%R9CPC
&);C`G
*ARA~
ZS,UY
?0'L.
GC!9{k
M1=sQ;
SelectObject
iJnN?
0s#(v
,:Z(c
vDk3&oPw%
gS:Up%:
DR{X`
]ty53{
qB.i:
mKd(?
mtY;%;
C|c4`W(Em\.
N>%;P
7'M=F
0&.-g<
CLBCATQ
V~4jB]
c?Tv=
;jKoo0
ihvtn.
dRUI1
q2Fx4{Jx+
R_L98
$Wt.\
0B\RO
94x1Oi
"A^\c
h4sk-
p}1x:
@N;*0?uDN
J6=**
9Gi}7W
R<P1])i
D,<+m"
(m-GJ
F5yWv#
@]S]I
2z}^&8
g[kN"L
^}jES[
CuyN:
CreateWindowExW
B`<yD
phNT>
Xbw{:]
SetCursor
RegSetValueExW
ZL$&a
pS8|Z
7L#i:F
~',ik
Nf^$B
.92/3
!#y/c
,}JnRj
PHd&E
L!EK261
6g!RP
y_nA@
#_0pT
-/$i{
`L"2D/
"INvf;
`ksyd
GFC%l
&>5x]e
Da5V} #
>f]!N
B-o@mm=
&^/j0X
%A7`)
Z(lLE
T2slb
d=[6r
r=;xmo'
~h@jR
.2`Ig
LoadLibraryExW
4Curh1e
2a&J-
kT;D/
$03C5
<iju9
MH0!1
=F\$[
wJ2Upu
kufz!r
|<x]mM
L(z O
jPOPLXmjVKKWMEA'n
%Z }"
A,BrYY
b+RTU
NL78+:
arB_@a
!su-c
0^;+p
z$vz^
A0R@X
osxQB
{dr[A
*`q<e
H+j!:B
jfaEP
}X|`&uo
*8w1g$
PB):_
U8AO-
:}`Gs
k%36N
-e=}x
)rG>X
KV_D*
j1]ocp
##M3+
{X7.C/
K$:%(
$U&7n
sxe1;
]*D6+
E=]g"X
Eu=`O
|cX7@
+6,S.i@
Udqhy5
0',z4
s;_me
=^))I
R+\}'
W9DdW
:2NL1
v32ZT/
:JuN:p
U6mHc
)Y</5(
m.?Co95
P2D&F
} nN
R6D+1
.2/hPk
FillRect
H2osj;
Ba7@Aw
&?q^X@
2"jSZ
X]FK]
Ua`YJ
7B,2
{!`17M76r
6;<F8
~w,YX@
gEHLz
,{2_N
>/BO8
sELsA
D9Yz4
G(OjP
A<"bH_
JiB3<
J}0Fb
ut~>+p
1AL%BX
LMA8%-
?|o5d
|aUEW
TI)TP
3}{ "
bvcDg
]%D<Z
F"vB&.
lEo.w
no",:
?;K>a
{"7WM
<61W:=l
OQ!27
ya{/$H
$:#gPSL
"s}/|YP
s?pw=
mV0y{
(}.Fy&s
{)7}7
l]axH
`%}b#
;>R7#
318$H
xd<jc
OT$Vjz,
7Vqc@
8c*Vg
P_MO,
\((A
%K8a2
pD?>A="
i4lAgO
[S|^&
Eu7[sw
&6#b
xm'i1
W`gm0k
wPW6-
N%X'q
^)}|#
QhU6i
Yn?xI
}]8+j
@qh$(
c d,'
RU9cS
CoCreateInstance
GRj57
fe$bwvWK
-dgdJhB
bg6`K
yB;sI
]Z&'LH
r.fK)
HvqNJd
k4s}J6
};]y_
>$P_F
\bvv]zz`
hTq[c
56Y3u
GetFileAttributesW
PortableApps.com
u/$eq
WE$9n
Om|.s
Me;:t
Vx@!s
p<]eQv_
>aVl1<
+m7s7
6.]CIC
x->(!`
d-5mB
l`lf,
]FGv\N-
1Vv} L
A(! I
>3;?w
,Om}=
*(l'Aj
4'^,W
YuK@x
t]P40
8'D~c'
DispatchMessageW
'3Qgwu
3QOA%
(3z6Z
RV5}Wn
#Vh+/@
zE^r=i
/$6x-
RY:Yf
8(AJH
7*nr_)
M%hycPQ
%~_C.u
_mk&2
!"uYT
Q!CJO
mHWj&X8
@;"e
8Jw4[v
o]mkm
?NT'M
>1iT=TkD~
$h^@j^
P^w &
:`@e+
%ph_m
BeginPaint
vgk^HI
/_YZ@;
vm$:_^
6mvB1t
|r2dP
=>['R
T'=8>%i
M>vKf
w!iCP{
NKRD2
$}gME1
\_x^:
(a?n43
JK("9Z
Q<a#.8
@y7dG&
PCJ1]D
D5A$ks
nt(D{d
FHPmtkT
" )3w
"%SK\A
Msftl
~1wS;,
hFm4UvF
eaDPO
pP*F:
>}HymE:W
_*T!8
}X3em
{C?kcY.$
FAr}HE
VgkV{
9)0"r%
)U\}z
myDoM
G>v%0
KS9l>
wahI`?
=06o|
k!R"d
lgo}/4
rM{"{
3l^53$
_5mKC
ULr1-M
6cZK&
A)_7~
_Jf?g
|Eui98
olw'z
e}<G>A
Pxuv{
%p#tb%
z'oTQ
{R~OV
N~F,9
1+Y]uR
!q\ &7
J(lmg
}0)A_
F}?#c1
GSx]/
(}Hs$'
U|Lx$
f/2f!4
Z(4|5q
nXb@.
qe,S/&@*j
dfZ$q\
t=e&A
>s(x6
:YLg)Op
tdqlSu
,u"n>
L6N4s9
bZhL(
UKNgSW
NMWK?rMT
+.nIv
<'^Qh
u:sP!z
5$h3R
nped#
LJeg%
`IA190
<sc.[
jlTl}
dAH%?
ImZwC
BBL#%9
%6]q{QF
Z0D'v
Vu/FE
QQ$1!I
n&]Q$
WN6#X
Xz&bY
i5%^4
`Upb.
q+j)w
w?M*4
=l"Y]
*MPA6P$x
"f^n\w
C`[MD
kd.hV
&wK7\j
}0r8By
g~zRzo3
mV;v>U
!H!<B
?sP,&%oL
aOl%+
"P8PL
@.C55F
c+HCmI
g}(*u
T9ekD
`S?]v'4
,IWl#
o>S*J
$'8SA
422$}B
='$k6
83)I
A.Ad'
l:3er
8oK40
3%=sI_
v[e8ONT
ME.Jp
Z5E @k
=eu;kp
UA-:YO
g3/KRn
Pn2R^
Hnh~8
7T,.T
32%"pF]
?Xm*S
WqT'2.V
#cECOn
xt"Z]y
fZLU8(m
PM Nb
IXBN0
lg*vC
h]w74
B)sL:
+o>??
TCVMh-
fuwBGR
sNv"q*
?nmK2j
q%nh{h
MqT~x^^c
V8O"
`ROPk
# tFF
l@\my
3%cI=`
VS|~I
p\cOdK!1
\^D,R
y8>`e
C{?'p#F
5qx6^f
Z8 vn
IT#Z#
{g>6:
('LhhG
Rwe'!
.k[rL6
;c;ryeL
!\?NYe"
iWsC=
EnableWindow
\Microsoft\Internet Explorer\Quick Launch
;}D]z,
3/aKq
hh$<5
;:ihd
wc?A
-bkIF
wto\L
CloseHandle
!2v!O
!;p,M
omzs&g
vX17n
"hu66
z4tQD
Vu&rq
zH+hr(
Q]13;(
NuL"ZmY
pbLbP
1J$dVC
Fu:R,I?a
*+h~Ov
|m6mdn
Gx\$GC
Jb5/bt
OV)[~0,
GnZKBt3m
{x&HO
){%3l
6Rx0l
XRAy*C
kWx/I
-EKL` ~t
cymW8
W?d*}w@
(nk.X
`aMcm
f6]RzIq#7
'*`T4
^]' @:
Mi{K*
2tAOE
q2NHIWu*
@DG~W
%;EO7
(}AZa
;tYHq
]OL/x
X:Hab
)='vEaU
y6y+s;
e6=Wo
ddVve
_%R5z#
;zEqJ_
xur W
p(\T1k
CIlF(
IObitUnlockerPortable
yDNp1
U7rl~$
TkC:@
I>*EQ
V86Cf
w[2>J
}~'8lnv
5/2\V
5N~ax
L?Ttyk(
tRyM/
CN3H.
#|]u;6
yf|z*
;?~LIK
%Jq6cg9
O&4i@
B)8UH
0#8V:"!{
;R>0E
N1":>
ZK@9`
C1qrJ
TU_+3
*KS`+
uhW4QG
`>F,+:
{(R?^
,3E0r
y%c-7
O*Rd/
Y6z3Gc
YduJ$
w!a<O
3'ePh
_Q&}B
Y:._^3
0[Z;$J
V#[+-
WTGuo
U_-(_
uA^V!
446\v
1ru.)
nBj{6
,6k>z7Z*
X)d;F
l4N0%
bP&15
A~MGA
K^{X]
+#pmLMO0
>jI{*D
a5d'w9
^Xc)ch
$$(.?
S_8MI
/mV2YZjF
|,U_r9
COMCTL32.dll
>FFf;
h*YY$
;PP=l
HG_2V
$w)9d
O"C4F
zR'\Nc
PortableApps.comInstallerVersion
< wfH
s8?!p
}n&7k
Tq'B/
1.&sTA
6 ,?I
nUQ\=
?:.O[TH
tA0{o
{;2Bl
n^sW^!
vg(3v
;1xP;
*Kp\F
C4G7a,'
g[v.:<N
2 \9n
/|NWO{
yTw1d
$%7J_
:PFZ>
B/Qys
Z.vDg
hM}0(0O
RemoveDirectoryW
;8;{I
SzPPPH
N0,k{
0>%zEc[
-(kAZz
RM7+a
Mb36j
Qg#RO}
6j;4F#
kzg=-
\@~2g
tp#hM.
z|`2f
RegDeleteValueW
czK?
7i=v}l
t2^S~
0(4#t
MN{]@>i
,=sR3
`ZIIv5[S
GRt5-\)
2h2G7i
-qt's`
!$}cd
=\dYGjU
R75\a
MHnnU
hLpZYJY
2s2PE|
Ma{%>U
z!3'+
m~9Vg
f0uG5
7&j8/
vx8oQ
3TxM+
RegEnumKeyW
r$:3Ak
kH#:>
J,dfZ
Ou"r0
CRYPTBASE
^xvE:
E?940Z1
;"j_U
]^wSO
6.\G,
Rf~:i
!z8F:
}YPjBh\$
Gh|$x
/s3c
IsWindow
vWkTEQ
B^EdL
1L.vh
]nQ,``
\@mx*
IP^nU
Q<&Rn
sR"m7
]AE=1
T[f=+
T1:??
)90~7
|:XYX
SBMgwC
>b.8:
e(`aGsD
:S<3H
t/\$)
vxy1I
bNF~x
U.Y91
p~; s
yDB+R?
<]%p?
y8p|{
IsWindowVisible
/x"\4
PLDq?}
0\N,y
9T]J!
@kfP*
|k&xT
bTR8j
Kk~tm
Z"4+Z^[R&\
>Os5(
{mI,A`!R
nMSB53
dgEZoe
bLWK
=(+/2q
1"[L UV
>xh8M,4
_n6I*
2f-_e`
J^s&m
%9+zB
-rH\X
#~gO[
@Gk3o#
O_m}3&
>q@s8
]=n)-
=Rn5r
zCsGA
2Xt[(
w2!J7
bP&*GUZ
#9=q'
{JNEI
e0C3y
}G_TTa
OV\0\
t6/Pw
!r,'4Z
~V/*f
]jta/
V8O(YB??v&
aL/$S
A8xu.+
^>g-0
@zq'>Kp
*YA"?
nB<u,
AV<JJ
vjW6$-
=WN*GI
G9"r
f?skv
nl=7p
$6~9:w
wNP]2CV
j'Ih7
]9&1U
[.+H_
epnd
f!>_^
(frZslzL+
ba5X|
vwTgB
2-2J`W
CallWindowProcW
5x1}`
`.GK&a
_8,|I
aJs~}6
%O`,f
/2Mc-
/2J-:Z
3"zn1q
PK/5Mj
)2yWb
'ekmC|;
`.TS\
tLpR[wmg
un,.|
mZ+Ug
+*`#77Lx
*S9UZ.
?1t|GK{
{JD@F
?We&}
zo`hi
}0R,-
s8dhJ
o7yFH
[D&uB
;g5~0R
D^+x3x~
c;IiZ
^qtOL
|hwp\m
lFR4\
V9]F7
=*<%m
WPWj0
V4!$x
`ZE~a
lyd^C
r>}|75
#4NDI
qsNw_
tLoI'A
RSw4Ye
1)7A[
u`48fi
cE{&&k*3
RegDeleteKeyW
b<?zz
~p7b7Y673
]s.}6Xw
2.\t^z
I&[_v
yk9U{
-5<;C
7)X_zu
M}tf-Su
QflP_
* M:I
3UEP8z
dZ=*a
WaitForSingleObject
MCB*~
IYg>5
}Y2Y1
V%Ns~0TS[`4
wd-8:@
P!OGW
A^NRt
X[]ygw+
^Mk<|
r~M,3
OpenProcessToken
eCnOiQ
3tTF*]nO
<3}?X
2;>+
=BAT>di
V)+?;s
3M[QG
57eSa
ZO<$X
^?M3-PX
u9DkA
SQ\66
j@0Wa
{Kh,W
SetForegroundWindow
W *CQ
R;o0t
F4,di
aQviI
m-]8\L
xL;7<
GX)g]
,OrtrkH
*YY$<
NI@VI
8(WU5
Cj&&L|
R1Rjw
Vc1kZ<
xlfby.
p>]B@
`D3HTs
s2aZ1
jSSMb
azpya
hYoL7
YG/]Kb
ZR'.T
}qzf<
>7\2t
ExpandEnvironmentStringsW
M]9]N
F6"U%p
x=ULv
8C3dPW
cXVYN
K*cHo
SetFileTime
;UoMs
[U6OU
@lQ~HW'$
y<pm'
1lqs-c
@^[x4
@5om@r
h?o H
f{:O;
',g"@2,
8f<7+6mT
$#6Qox
ZQub_
>bD#!
PMqS-y
/lNevy
tNPgyBO
LnDTZ"
{v54H
o2:^X
hOw!c
5\Kv'R
XaNV(c
IinB'
N]'H@h
g,bHF9L
T.iQy|
s9}h8
l6[=]
#bqYf
SLC '
qlDL{{
cz0b^
7Ew`EI
i :o""[
b7zUj^.?|X
0qHJ.g"
)ls=U
hkdP#
*Tnjt
KZ[yz
QkNB\H
-HKS `
_6B9h
n1n]x
^|9^s
iq4'D
Am>-W
aA<w}
RhCpG
softuW
/!U-v
[a~}O
</:lc
)U^a@O
qh*>3\{
2]x@k4
AF)WB
6'yY</TlC
5+EJP
@VTw>
`LU91=3
Sw$0OW
iMNgB
%3t@Z
buuu(
zw\EJ|/
nP%mr
o)P~a
X>#8JF
+>""el
m">;|
Y@3}wBg
oWH~u
lLthm
'+TX94{
Pk7zf
,Gw=#c48
J:DxT
M[H@q
^'T+S
N[@^=P
xTQK@
m?X`y4#@Q
@J>1~=
^RZ^\
PczF~
y6:kE|
uin~IA%I
&-b[Rc
jk{;,
~!V%u~
(k$,C
;5<w%&E
AU/2^
tzK.x
(u4q!
`ex22
7Y|_W
zwPwm
U$X/W
zD/N#
#7c@x*<
x(RKs_
3OaaKbE
0DgXY
C*:TA
HF\z&b
`I/G3(C
k%t(+
!&**W
B:bo|
^L@/k
^0XN!F
yNWTiv}
"i8F>
%3BJY
Pg5*o
Ic-Y}
(}bGb
[=dj#<
_GK$3
Z|_|q
l&OO>
uk:Y(
gW|e8
:NM>N
)VT{*
8,3_:qv
DialogBoxParamW
FreeLibrary
|oSs'
+kBR5
<jal"
EYbHm
w12,2
K%Zo;E
`$Spu
zl^qm?
f"e^yl[
c%^#B
Y.^(o0r
`(46F
qS%"n
>gAV2
CompanyName
|y:@#
.]/+W
yS+96T,
B<1Y44V
2OLtZq
ilD<n
"OS-?
X)uF"
cn{lJ
py.RF
(<,!kM
aAY3s9
6S7pr
d(V0|
TqO~xUFez
o~M"4
OuKw*4^
0c~pD6
&nLhssCn
G&6?(
d]N[m
Y\Dod
md*p
V@raJ
oW`Pd<
/(tb7S#6`
a>8);
m)rdS
XVz$&
4moSJ
t5]!K
NVNId
I{USyvS
5 c$e!
u9Z`*
R:"qO
1'!"B
4<\49u
v78y>Lx
^suym
Aj"A[f
VURLySX
a@cWy
:27Q6,4N
0M:S~U
9Gvg:[W
:W}Qxv
FTZ,X
bo.~2
^Y7Z15
m{!ER
-C>/~
mL>QvV%5
A4|KL
P7!+<
n[a]K
n;G7\
6)o079
u:"qe
|{H7U
?(BsB
SetBkColor
B~4*j
iihC(
7q^0@2
Ao(45X
;Uy3}?
)kJyn
Sh,^w
'<axV
4M9WZ
VKIWI
5&/bf
gFu?_
l_lJa.
N5o|z
ruiRx
rk!U1
fKOer
OKgNKC
9Hd#9
9KM*wD\
w-Z<W
WaGTh
llXX[A
%1q^LN
T<Y>p
tw-ezo
X2g3|
L#fyHQ
A#KrGFhb
JKD!,>
,J"(V
1]4?1Y
de5xyS
npGp@
YA"w;
985?:8N#
IOX}<?@
5_YMl
C3z;N5
bd@nE
bfhit
cf"A?
["m-hq
M[n}L
_CDfB
k%L#bS'6@3M
Jy]+E-I
rtG#G
AXU2}
ImageList_AddMasked
#p'jso
"`>[4
.BhKt
c}Z`y
Kjq)\
#9k"H
wWcw>
}}2I'
nsX+a
(c]@{
.tVAP%
.tKt`
'qIeHs:
m:=qX3
EXf|d
"[w6[c%
@Yev.
S[a{c
|]:+&
QFAVK
?!DeaO
[wMID
CY{o
=`fEI
Garjl2
`=?[Sn
OIYQ)
~;PdYs
N,ukOn[n
viYQn
.!2[2a
a%fUd
.I@/ 7
"|'NU
xpXt%
X;m2O
EWy(Y
G.Yis
J_9wj
T$_"w
A-af@
9Dv8A
6_n;?
!KI+OF
(Jc&7
lJ@+*
iI^5F
lwj'L
$9wcN
FindWindowExW
#pl=I
bqRMQ
I6@7b
xJ:Ol
Rp5"E
_QR97
zV@uM5'
?Vv>G
PeekMessageW
VML7f
<4s1o
Q,m5_(t
4s-0O#0
za"ZK
_Q%#N
1__Df
y2IiM>
.q^<x
m`oZY
zvUT`
+A</q
'-e4>X
="{,%H
JbMhWMc\W
(Bu%F
ZSkAC
^k?Zp
;:NHvz
s,G"t
~4Le>*
+I%yP
#)1rz
Q3e{q/<
[+)|!
vJ+B}
[51O\
SetEnvironmentVariableW
J?2m{
,?=*?1Ft
}XT\j39&
u:G=;J
<"\]O
.B`iqL
FE``U
R+p}6
'uGtK
5+i-K>
wsprintfA
,AFb&
3+S6A
rr53S
qvP.5]
Bo-dI
+u<-+hax_
LmjT;
e"xB*
M},o;
*6;Rp
KegWs
@{p5{
/|&\aRr
^pTJcf?
<F\o"
;+Xz|
o?h)_
ASR#|
vOJdx
]m g>_mJ3
L_(hJOl
}o=V\J!
kbF$Z
xhgp#
:'](l Y
|30-B
{T7k-
T]%ze
i}a!jN
~@ZP0h
GbWr5
6<LWN
{I~:x
e)0Q1l
gZhkG!"X
e#o;x
Mq9zjx
94zf}E
e3LPiP
nu:s%
Installer integrity check has failed. Common causes include
V5po,
?Da[+/
ICCc+454
I'XVv
Xx{7^"
Drfc@
}kfCfQ
OI5,|
n_/6J]
Q6F,2
&vm7h7
m:@Mz)
4$th
G\]'0
Cm@Jk
_REAm
omO)UD
s+J^C
#R&M]
Control Panel\Desktop\ResourceLocale
,$[Q|
Q:w\#
6Ef~Z
:Z9<~
>Dl{?
P3":$
*SxF'`
8CDZI
}&kzZ"
>=H1=
#2DaU
RUL,z
hf4Kmz
T&mPI
t1-rw
i:6?)@
n@;,v
1\~U_
7%4]Q
PUoU2xz
R-4%z<{
GetWindowLongW
i_TQ=
"|)aXy
tm<1*
2007-2020 PortableApps.com, PortableApps.com Installer 3.5.18.0
.x^u*Zvk
iYiE7
!xa0Tm
K|W?r
vY +A
0)Pig
M'7jg0
T43<h
\{qOy
-)MjCZ
7[rC{
%=K)P
#$?SR-KO
a:+-n$
9y|o'
FI];`
(Ypi
ii+Qz
xh1Nt!
wy*>:*
\Hm4{
{055M
aEb[P
^?6-z
yxwWK
rQ2\b
F'cb?
<pA-[
Ww$E^
{71Ak
po,c^#ZQ
i9b=+3
a:,az'
rZYJ
G6u!p
#@)iQ
82j\>
Error launching installer
X0NC3
(8:e]gB
mqIdmI
9BA0Y
}$%1_(
lP'>x
9(aTh
NkNOIN+
\*,*'
WriteFile
;xR8_
b.479
$Ouhh
LIp `
sKRB6}
^&z-W
j-x]c
DGi3BT
b~8q^
-.g9i
%N`%v5
DestroyWindow
_U6Y>:
|4]f[
\ct06A
*ho7T
Y(|AoZ
D\\*I
Nf$Z#
`S@>*q
Dl?ajg
<=k+8
mk1q]
,>;5~
ltH#%
_(%cy
l]rQq
Yo1`0
/2qnV/
lI;pK
Zure]
an:=d
;qZTMY}}
m'F?x
jo[ 7
6!vn{D
i3uE-N
Wt.8k|
G.K)h~
+v:lu7G
cJb:\
-"|Y[
4IniCI
)AB<S
7Y["^
VSUbOI:
SQWPV
o0y(TJW
qwd_5\{
O_+9.
PgJumx:
q:8,ZB
E=6j@f
UIenf8
sF="\=['x
[}HgT
""4^Q
d)x<)jL
tp{z9
NV;jE
v/XY,
&KG<E
w^]uz
j} XX
>Q`]]
Ea05\
><[7MFG
e;M^n
c*Nr,m
cXyy7
P@yo9Q
arcj!
+st-m
RichEd20
Vw*="
ro=n@
}d:3K*]
@w.c@&
>?_vKT9!'
jHjZV
)<oO5c
N!j=,Y
{#?Hy
6iM~\
PortableApps.comFormatVersion
.RR"$
tnV9;
)IGC./
:Bg!%
I1ef5
h %f'
pgAOA
`<xE.Uk
q6cNi
FY\ex
bVMj/
WDuy,
GHRy_B
C)P;L
'Apr^
b-=$}
*4,zE
uDJ'f|
2gq,_
=9{AZG/\
QTc-JL
1@aZ/
#hX,T
6_.Z_
>]SbI
%Dl'.
\</bA
27p5nl
nDS {
x,l{@
7$K$u
-#Zq,
<tQBe
xE\@IE
o4,}[
{FjN;)
*t_+B
na|BQ
h& j
ojI4($3C6f,
?Axyd
OLEACC
$z975~
0C-,H
6V=#u
RUK#HBc
~7d&}
NFR"W6
g%,@R
r!=>+L
;HBE@
i&(XP
}#CIk
(-4B^
@)X-]
Vd<RrC
0_wkoe
K$V{Y
!fu['i
E;'^q
|?$nE
tSV6w#
D,Dq NTE
NDJ(^f
>+9Cb;
%4J)3
!+1VB
jqT(M
k3v?oK{Gy
z%'qK
uOr<F
`"YATa?
.6v$O9A
LGc@'5
}#8a<+y+9
GS~8M
oS2f6
hSGSF
QK?I^YM
V~vz}1>toezz5
yMGRoW]
L>g1z
6lEM9
bFj"9
xKhP\
2Ug^%
YZhOg
wW+`l
Ka".0
hr5i0
6!7gm
Zlp)p$
i[=pi
>)V9"r
^m qG
8(a.7J,
r7xxet
-GV<eV
s0J)iTv
P?'j>
41KmpN
9]T=j
k}5lB
ta@E.
Brgp]8
vyX?&
7ECP3
92CBQ
rt-Nn
GetModuleFileNameW
"%SG,.V
4ori;
42?D%'L
|Ii4c
$`aR\
\.);8g<3
+^o%-sg
x^zvQ
"JN<<
CAPa.
;xhRW
j\1^4yVt
]75@o}(N
hUW+q
E}Ly~K
@-+X.B
d8A["
GLWC6K
8W,9+p
Q JF)
H+DeS
wQM9r
J]qD
Id3vM
eMDXB
hHmC`
>[}T,"
B;)E~l
'f\H$
iW4H2
~/k9M5ht'O
0bVb3$
gkrQH
h*dP`
bd"C|
>f&S^
)Qr/l
L"-E9
uaz+2l
(kQy^/=
_X/QUd
[+fz0
ab7}i
IU2pu
mCQ_H2MN
1MNuo
>@xMy
64ER0
-+-V,+O
GBElO2h-xl
w9w&s7]
|+S&t
J:GqK5
T9m]=
lfW/>7P
8WRQ}
~j-Y"
6)gsu
g)0M,
TE)l8Y^
L=FA"s
rYF8D
p,SM<
e\;a'
VS_VERSION_INFO
IHa}?<<
O5fWf
m^z~FZm
w'`+4L"
baP`g|
+4mh{S
Y{!w~
sXK5.}
c\DfG
bN'N9.
k5UG$
V9j=3V]
@vC8@~
)Z9@U
KaX^>_
'k;!A
ps*lZ
_.zDt.
T9nTC
7\f)wn<{
vClbPZ
Kn/QUMc
OxZj=T
-v$:L
"Vk+eH
GiR5Q
2/t80
GK{pJ
eBS{H2
De9Bbv
{49=Ii
W/wC.
2I [M
IObitUnlockerPortable_1.2.paf.exe
^7]fl;)
BBYb]
qnzB7
V!R47
QCg;w
<MX*f
OpenClipboard
KHvwtmVl
_$3DqL
hW<Ul
t{;$X
Z%"l
j>4'`
&G4N4
NY3G,Y
c!NAS
<%1"Kr
SdV0D
]w$LW:
P$9s,
SMALHB7
OP{&;
?1J,U
c$_?_
SZc=T
H.2cA21
~XFs?{
zJ^$&
LFNlM}
SD8>>
0N$V+
,@UC{I
zuqYq
G}&f.
tjSHH
,[EKR
,F|bx
3M8,%
Quzuf
94**wma
jJ|8=
jPW:C
~#%vJ
uHHFx}5Rr?
G}:<
^vYKFK
Rr=`\
n8~?c
@=OYuF
XV*p-
Bf{1UPw
POi"i
JX08-'
&?-@f
a@!{w
$g/Z@G6
mRQ`B
mqc}8
ExitProcess
DBTb>91
9|^g>
1W&l/
pbg_i
2}SZo{
4R4pBW
G+=SC
9=4gD
e hP4.
gPF:
T+W?3
m2a&q
OoqX<
iF:JW
Hxe]$
0_(wQ
ois_?
;Rc{e<
GDp_`IW
Vm8^*
q)y,Xs
z~2Xz
Please wait while Setup is loading...
dOq)7+
:7l&-
&ht_q
\Q~-F
<."H<
E[B#-3^Lj
uE9wy+
vVZD~m(
ino-I
\M2j"a
q&S/|u
S>z.q
X;"]=(
>?2h(H*
aqSq~]
-Ma!gT
,zoVd=
CreateDialogParamW
G%01$
QY{a[
?^}@&
OrpUI
}Sd&R
x-k b
$w5h% 0
GetExitCodeProcess
+"ljv
KR/<X
~w,bN
LGLtPPp
[Rename]
iMRY[s. E
q%5)=
V>6VQ
{oiTy_
[?W8|
YNYB4@
Y%`hc
[+!S1op
ZSQL]}
\EnK;#@{
RichEdit20W
:7L^c
PVJw:4
g{L#Yax
Oj6&E
~IcKP
$ojZ5
5Qd]b
~DaF1*8$
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="*" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v3.06.1</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/><supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/></application></compatibility><application xmlns="urn:schemas-microsoft-com:asm.v3"><windowsSettings><dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware></windowsSettings></application></assembly>
v~\xm
t:9 ~
k?Mlv
`X{y`
+uYMl\n
m"ps:
]*cCR
VerQueryValueW
"ZEqvF%
9_>rh
=*s[M@
_-;\r
Kt0Qb^
^G#Xb?
?s.Xk<
9QKR=
d_4Vu
GlobalLock
SHLWAPI
nlos9
MW+9h
D2SyV
CUsH.0pu&
6A";E
GetPrivateProfileStringW
hQ0k9
hVm+A
G;3;f
%\64~=|
.TkPt
|UOHIY
iU8!y
YzY+Y
=6%{@jaW
a#PHZ
t~@s"
l%@/r
&$S%FU
N\:Q}
kM&H|
11GL4
M1QusL
~~ic$
VArea
Gpo/U,
^BH0i
=XFsyS
hBf0cx-
$o-hI
Xg#9um
p3_/c(K
[_+Rq
$3?U,d
X)4+3
!{6,i
BmpV@
8qN7*
OQVV'i
9M9#cq
InternalName
>4+BT
ax!o5
UA^M~
\`[IkP
o clr
K^NqZ
RVa;%
pkd]|
i:38\l$
2U:,V
ELR5~
cB`_G
c9mjm
;dbbK
CT%`]
?Z\hR
(]EI%+
0~8]{
LoF%^_
fFbm"
,r*^V
V'EcC
qR15`
gu~R2
"ci=1\
)F4\2
8H_0@#
r&l;^.`
7g2CH
U)>1x
i[ Iz
HCIs&%
oCD[3
lZ4xC
FindNextFileW
FFrT@N]mG
4Bun8[Yv
wdo!:
/(ndInG
*u Io
Ym\)g
[\HK@
@`jS^
%t~$h
T|ILZ
p0Lx5
jqSeM@
s`7j@
iV,`,
0guVr
oD%!L
r&rWv
L&DP%
;q\2k,in
+T~&z9
l=dkO
$si'#
0Z-SR
ZUIC_
{'Tg4
7TnK#7a
incomplete download and damaged media. Contact the
DV~;s:
MfYWj
Kbe((<
\.Q"GA
X'oz`
gODo_
B<0crj]
{wIS9
rQ[\
9DjEC
U(/d>'
rntO?uu
-[AmdC2
6~I=+
]e{2i
wS-p<
PT#Jp"
n/Ny?w~
8"Ku{
wt;&3
GetSystemMetrics
D$$SPS
<J1-qHD
;&yv5
ZbH5o_y
K0[vg
79Wp+_
{@PpW
!1p[+8^
1U'!r
7%_jG
uuKt:
y%mX{_
2TFpRm
E'BMr
/Zoog3
CloseClipboard
2/!X$&
>^vHf
Hm}?9
t<xd:
9]s]zk
lb"q7
6Tl^p
K.!k[
l.G##
4AvZI
lv5,k
4' .`q
P<\Oni_p@
wWP`|
d0Lcq
;pmLWI
joPjz
_xZQb
dJ?}{
(ffngc
5dh[t
zN^'d
n]z'1
-:?-U
#w2p<
@NeSv
Yj_Fn
BM>A u
XNd\jq[
@?kOWO
hgywh]
c).lTG<Xg4
}e)LL
=7kor
0O,!|
?wrQ9
XTJ1y
Y)Fzy
<?oha
$O=o2-
USER32.dll
}6Nz]
JBYC3
oK<.D
'OKAk
rap%.
pBNW5
D[n^(n
m8x.rH
'G{v%Q
mT*p1sr
OwSzp
S{k]V
@" zb]
Hq#JZg
;,Y6,
9E/Ud
:(F6?
+C9Xp
<|"68)
/;YAO
zqBt'
#WV@y
%{]#L
shsgQ
6Vm8Ij
Qlbl)
PAk}Pa
XStyZ!y
7F@,g
w(RR'
]0&=8P
O 1t9
=:$W:yW
_wbDshi}l
FHaU.<
,gE7LJ
wE~d0H
}0cky
g#{fT
M'0dem
n~XkH~
@"Ae_
r"=SYWq
GetCurrentProcess
([Z:4s
Ib`ny.
cTu$/
+3#:j
pA2H2
!FQ[g
:~kX;M
1w=P<$
6GYYa
s)kj%6^l
n8o1E
\DEY48k
5U!/pT
IubSw
7h"m@
t "(<yv:
aO i;
'WOMiGo
ohg4>Y
H!%q!
?#r#wW
>"9 S
9}xyB
z#G|~wO
.ndata
zi^m@
um_+D
px`;j
EuieL
GetClassInfoW
<C2&4
Ig?]U
e>fW'
?[ uNN
(}i-1d
)#n%M5
J59}`
hKw^I9
2<c~:
_Y{2A
"&&@U
E8fSjz
u7:<p
2m9LX
GA=;KJf
gztglif
iFY7G
u\G#W
z_kri
87_CIi
#w/YgO
vA@&]\}
V"Yn~
OleUninitialize
Oye74`G
[D+x(C
VyLgG
Wzcda?
}P@a_
a9@PIf
kV=y+
M:OW5
}r=8c
!SA_3
CT%P4
K#BOj4s
ymKUV:
q'}D:C\
j#w77n
8QHx$
M$^i]B
b>]K&
E}i;o [
Mc#*p~f0
ic9'M
H:2I}
8u+j!
Instu`
m#Q/0
|vmqM
U#}l7
Hp;]M
1z#<k=W
D(9^0
!V?e(
av.-{
C>~t1(
6N7+G
&zO~t
7eCQK
ShowWindow
KX^em0
}"GB)
|}%DBj'V
w+uRoZj
fXB|H
)=Lbw
0*"?%%B
-c]lY
{<<,c9
-I_Y"
f{x69
OpA1j
8+Sz.A
iF}gt
){)Ei%:
P~$^}
=Z|o?
SWWki+
VT5Tw
sDd)
V9uR7
by/1YZ
jc(%m
o8y__
(GJ1_
-_NJE
SA>fO
UXTHEME
}tJhP
Tiv`~
pL'MF
{9nPN_%;
k<2u?I
lMR<s
85HO\^
yK56t
:v@HW
^ |u-
)ZXXfmH
DWMAPI
U]"AA
I)xq#U
LookupPrivilegeValueW
rR;H#-
c{CNV
5xKVv
4OrW\
'YI\]
;lA:6,
4=RGK
5eE;9
O$2zZ%
/v6LMb
n%Ns*
Bq;\C|
.tl{^
8Eqh^
qSbgJ_
S(x2i
X0E.X
G)V|$%
fA P|
Dq{l4
MG@.USd
{CNz;8
IIDFromString
QE([v
gq@8P-h
%#,xH
-La\a|
c]UMc]
<ncgO
Z#g&N
f58ksIN
]Boau
Z_{c!
2mWp81
\+k4-|
iQ!Wy
Lcluq
~cg>k
mEF]p
4]4My
mA2VWgF
`. +j
ngmm$
8aEu9G
2kSx0
GetLastError
]ljy&
xPk'`o
X 6(8H
04>J`]
J\xS/
g3Ss=
5peAvW
end+T
#C&oi
T>'N:
U8kILU
T0xRc
oDnKt
LW#tu=|
9E1y|
"Pn@p%
]_-1T
BA%j`q4
'oRW^-
Quq2*
<to#A%
v#i:d
+&/d,-U
&3+V5
l!TYy
8Ao/O7h^
I,him
"T$xtD
nt5K.
B2=q!
pl{MX
B'CAs
z=mf*
7!^y|
y@m8{}
W]-F9
6;i!X@q
v27Jw
vL8JyE
V+g!O
{/#'y
kyMas
/{,oE
"Xf@8
K$Au(F
fM12*
T$Fw%
3@A;N
x #-@
2bQ_i
AdIK]
Ld`K5J
P3I"M%
_.iIO.
CyyoUH
"1F2?p
PE Information
| Image Base | Entry Point | Reported Checksum | Actual Checksum | Minimum OS Version | Compile Time | Import Hash | Icon | Icon Exact Hash | Icon Similarity Hash | Icon DHash |
|---|---|---|---|---|---|---|---|---|---|---|
| 0x00400000 | 0x000035d8 | 0x00000000 | 0x001f7e45 | 4.0 | 2020-08-01 02:52:49 | c05041e01f84e1ccca9c4451f3b6a383 |  |
2c09465cc979677d65781d9403176c31 | 5c00f471cce984e3b873ef9ade242aed | 71e0e4b8cccccce0 |
Version Infos
| Comments | For additional details, visit PortableApps.com |
|---|---|
| CompanyName | PortableApps.com |
| FileDescription | IObit Unlocker Portable |
| FileVersion | 1.2.0.0 |
| InternalName | IObit Unlocker Portable |
| LegalCopyright | 2007-2020 PortableApps.com, PortableApps.com Installer 3.5.18.0 |
| LegalTrademarks | PortableApps.com is a registered trademark of Rare Ideas, LLC. |
| OriginalFilename | IObitUnlockerPortable_1.2.paf.exe |
| PortableApps.comAppID | IObitUnlockerPortable |
| PortableApps.comFormatVersion | 3.5.18 |
| PortableApps.comInstallerVersion | 3.5.18.0 |
| ProductName | IObit Unlocker Portable |
| ProductVersion | 1.2.0.0 |
| Translation | 0x0409 0x04b0 |
Sections
| Name | RAW Address | Virtual Address | Virtual Size | Size of Raw Data | Characteristics | Entropy |
|---|---|---|---|---|---|---|
| .text | 0x00000400 | 0x00001000 | 0x00006572 | 0x00006600 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ | 6.45 |
| .rdata | 0x00006a00 | 0x00008000 | 0x00001398 | 0x00001400 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 5.14 |
| .data | 0x00007e00 | 0x0000a000 | 0x00066378 | 0x00000600 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 4.09 |
| .ndata | 0x00000000 | 0x00071000 | 0x00174000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 0.00 |
| .rsrc | 0x00008400 | 0x001e5000 | 0x0001cee0 | 0x0001d000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 7.19 |
Overlay
| Offset | 0x00025400 |
| Size | 0x001c30de |
| Name | Offset | Size | Language | Sub-language | Entropy | File type |
|---|---|---|---|---|---|---|
| RT_ICON | 0x001e5b08 | 0x00012524 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 7.98 | None |
| RT_ICON | 0x001f8030 | 0x000025a8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.17 | None |
| RT_ICON | 0x001fa5d8 | 0x000010a8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.51 | None |
| RT_ICON | 0x001fb680 | 0x00000ea8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.70 | None |
| RT_ICON | 0x001fc528 | 0x00000988 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.65 | None |
| RT_ICON | 0x001fceb0 | 0x000008a8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 6.02 | None |
| RT_ICON | 0x001fd758 | 0x00000568 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.67 | None |
| RT_ICON | 0x001fdcc0 | 0x00000468 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.84 | None |
| RT_DIALOG | 0x001fe128 | 0x000000b4 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.72 | None |
| RT_DIALOG | 0x001fe1e0 | 0x00000120 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.56 | None |
| RT_DIALOG | 0x001fe300 | 0x00000200 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.68 | None |
| RT_DIALOG | 0x001fe500 | 0x000000f8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.91 | None |
| RT_DIALOG | 0x001fe5f8 | 0x000000ee | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.90 | None |
| RT_DIALOG | 0x001fe6e8 | 0x000000b4 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.97 | None |
| RT_DIALOG | 0x001fe7a0 | 0x00000120 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.84 | None |
| RT_DIALOG | 0x001fe8c0 | 0x00000200 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.96 | None |
| RT_DIALOG | 0x001feac0 | 0x000000f8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 3.11 | None |
| RT_DIALOG | 0x001febb8 | 0x000000ee | LANG_ENGLISH | SUBLANG_ENGLISH_US | 3.07 | None |
| RT_DIALOG | 0x001feca8 | 0x000000b4 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.97 | None |
| RT_DIALOG | 0x001fed60 | 0x00000120 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.84 | None |
| RT_DIALOG | 0x001fee80 | 0x00000200 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.96 | None |
| RT_DIALOG | 0x001ff080 | 0x000000f8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 3.11 | None |
| RT_DIALOG | 0x001ff178 | 0x000000ee | LANG_ENGLISH | SUBLANG_ENGLISH_US | 3.07 | None |
| RT_DIALOG | 0x001ff268 | 0x000000b4 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.97 | None |
| RT_DIALOG | 0x001ff320 | 0x00000120 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.84 | None |
| RT_DIALOG | 0x001ff440 | 0x00000200 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.96 | None |
| RT_DIALOG | 0x001ff640 | 0x000000f8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 3.11 | None |
| RT_DIALOG | 0x001ff738 | 0x000000ee | LANG_ENGLISH | SUBLANG_ENGLISH_US | 3.07 | None |
| RT_DIALOG | 0x001ff828 | 0x000000ac | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.85 | None |
| RT_DIALOG | 0x001ff8d8 | 0x00000118 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.65 | None |
| RT_DIALOG | 0x001ff9f0 | 0x000001f8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.73 | None |
| RT_DIALOG | 0x001ffbe8 | 0x000000f0 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 3.05 | None |
| RT_DIALOG | 0x001ffcd8 | 0x000000e6 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 3.10 | None |
| RT_DIALOG | 0x001ffdc0 | 0x000000a0 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.62 | None |
| RT_DIALOG | 0x001ffe60 | 0x0000010c | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.48 | None |
| RT_DIALOG | 0x001fff70 | 0x000001ec | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.62 | None |
| RT_DIALOG | 0x00200160 | 0x000000e4 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.86 | None |
| RT_DIALOG | 0x00200248 | 0x000000da | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.93 | None |
| RT_DIALOG | 0x00200328 | 0x000000b4 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.97 | None |
| RT_DIALOG | 0x002003e0 | 0x00000120 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.84 | None |
| RT_DIALOG | 0x00200500 | 0x00000200 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.96 | None |
| RT_DIALOG | 0x00200700 | 0x000000f8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 3.11 | None |
| RT_DIALOG | 0x002007f8 | 0x000000ee | LANG_ENGLISH | SUBLANG_ENGLISH_US | 3.07 | None |
| RT_DIALOG | 0x002008e8 | 0x000000a0 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.63 | None |
| RT_DIALOG | 0x00200988 | 0x0000010c | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.48 | None |
| RT_DIALOG | 0x00200a98 | 0x000001ec | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.63 | None |
| RT_DIALOG | 0x00200c88 | 0x000000e4 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.87 | None |
| RT_DIALOG | 0x00200d70 | 0x000000da | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.93 | None |
| RT_DIALOG | 0x00200e50 | 0x000000a4 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.77 | None |
| RT_DIALOG | 0x00200ef8 | 0x00000110 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.58 | None |
| RT_DIALOG | 0x00201008 | 0x000001f0 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.68 | None |
| RT_DIALOG | 0x002011f8 | 0x000000e8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.97 | None |
| RT_DIALOG | 0x002012e0 | 0x000000de | LANG_ENGLISH | SUBLANG_ENGLISH_US | 3.04 | None |
| RT_GROUP_ICON | 0x002013c0 | 0x00000076 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.80 | None |
| RT_VERSION | 0x00201438 | 0x000005bc | LANG_ENGLISH | SUBLANG_ENGLISH_US | 3.41 | None |
| RT_MANIFEST | 0x002019f8 | 0x000004e3 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.29 | None |
Imports
| Name | Address |
|---|---|
| RegCreateKeyExW | 0x408000 |
| RegEnumKeyW | 0x408004 |
| RegQueryValueExW | 0x408008 |
| RegSetValueExW | 0x40800c |
| RegCloseKey | 0x408010 |
| RegDeleteValueW | 0x408014 |
| RegDeleteKeyW | 0x408018 |
| AdjustTokenPrivileges | 0x40801c |
| LookupPrivilegeValueW | 0x408020 |
| OpenProcessToken | 0x408024 |
| SetFileSecurityW | 0x408028 |
| RegOpenKeyExW | 0x40802c |
| RegEnumValueW | 0x408030 |
| Name | Address |
|---|---|
| SHGetSpecialFolderLocation | 0x408178 |
| SHFileOperationW | 0x40817c |
| SHBrowseForFolderW | 0x408180 |
| SHGetPathFromIDListW | 0x408184 |
| ShellExecuteExW | 0x408188 |
| SHGetFileInfoW | 0x40818c |
| Name | Address |
|---|---|
| OleInitialize | 0x408298 |
| OleUninitialize | 0x40829c |
| CoCreateInstance | 0x4082a0 |
| IIDFromString | 0x4082a4 |
| CoTaskMemFree | 0x4082a8 |
| Name | Address |
|---|---|
| ImageList_Create | 0x40803c |
| ImageList_Destroy | 0x408040 |
| ImageList_AddMasked | 0x408044 |
| Name | Address |
|---|---|
| SetBkMode | 0x40804c |
| SetBkColor | 0x408050 |
| GetDeviceCaps | 0x408054 |
| CreateFontIndirectW | 0x408058 |
| CreateBrushIndirect | 0x40805c |
| DeleteObject | 0x408060 |
| SetTextColor | 0x408064 |
| SelectObject | 0x408068 |
Usage
Processing ( 3.60 seconds )
- 3.448 CAPE
- 0.145 BehaviorAnalysis
- 0.006 AnalysisInfo
- 0.001 Debug
Signatures ( 0.07 seconds )
- 0.008 antiav_detectreg
- 0.008 ransomware_files
- 0.005 antianalysis_detectfile
- 0.005 ransomware_extensions
- 0.003 antiav_detectfile
- 0.003 infostealer_ftp
- 0.003 territorial_disputes_sigs
- 0.003 ursnif_behavior
- 0.002 antianalysis_detectreg
- 0.002 antivm_vbox_files
- 0.002 infostealer_bitcoin
- 0.002 infostealer_im
- 0.002 infostealer_mail
- 0.002 poullight_files
- 0.002 masquerade_process_name
- 0.001 bot_drive
- 0.001 antidebug_devices
- 0.001 antivm_parallels_keys
- 0.001 antivm_vbox_keys
- 0.001 antivm_vmware_keys
- 0.001 geodo_banking_trojan
- 0.001 browser_security
- 0.001 disables_backups
- 0.001 disables_browser_warn
- 0.001 disables_power_options
- 0.001 azorult_mutexes
- 0.001 cryptbot_files
- 0.001 echelon_files
- 0.001 revil_mutexes
- 0.001 modirat_behavior
- 0.001 lokibot_mutexes
Reporting ( 0.06 seconds )
- 0.051 CAPASummary
- 0.01 JsonDump
Signatures
Queries the keyboard layout
Enumerates running processes
process: System with pid 4
process: Registry with pid 92
process: smss.exe with pid 384
process: csrss.exe with pid 476
process: wininit.exe with pid 552
process: services.exe with pid 656
process: lsass.exe with pid 696
process: fontdrvhost.exe with pid 784
process: svchost.exe with pid 808
process: svchost.exe with pid 924
process: svchost.exe with pid 976
process: svchost.exe with pid 1036
process: svchost.exe with pid 1108
process: svchost.exe with pid 1116
process: svchost.exe with pid 1204
process: svchost.exe with pid 1240
process: svchost.exe with pid 1296
process: svchost.exe with pid 1348
process: svchost.exe with pid 1392
process: svchost.exe with pid 1428
process: svchost.exe with pid 1452
process: svchost.exe with pid 1544
process: svchost.exe with pid 1552
process: svchost.exe with pid 1676
process: svchost.exe with pid 1756
process: svchost.exe with pid 1772
process: svchost.exe with pid 1788
process: Memory Compression with pid 1844
process: svchost.exe with pid 1864
process: svchost.exe with pid 1940
process: svchost.exe with pid 1964
process: svchost.exe with pid 1976
process: svchost.exe with pid 1364
process: svchost.exe with pid 2024
process: svchost.exe with pid 1692
process: svchost.exe with pid 2116
process: svchost.exe with pid 2128
process: svchost.exe with pid 2136
process: svchost.exe with pid 2144
process: svchost.exe with pid 2252
process: spoolsv.exe with pid 2340
process: svchost.exe with pid 2384
process: svchost.exe with pid 2416
process: svchost.exe with pid 2568
process: svchost.exe with pid 2580
process: svchost.exe with pid 2596
process: svchost.exe with pid 2608
process: svchost.exe with pid 2640
process: svchost.exe with pid 2736
process: svchost.exe with pid 2756
process: svchost.exe with pid 2764
process: MsMpEng.exe with pid 2772
process: svchost.exe with pid 2800
process: svchost.exe with pid 2852
process: svchost.exe with pid 3136
process: svchost.exe with pid 3772
process: svchost.exe with pid 3912
process: MicrosoftEdgeUpdate.exe with pid 3080
process: svchost.exe with pid 64
process: svchost.exe with pid 820
process: svchost.exe with pid 3692
process: SearchIndexer.exe with pid 5088
process: svchost.exe with pid 5940
process: svchost.exe with pid 6084
process: svchost.exe with pid 6092
process: svchost.exe with pid 5208
process: svchost.exe with pid 3440
process: dasHost.exe with pid 4544
process: svchost.exe with pid 4576
process: SecurityHealthService.exe with pid 4392
process: NisSrv.exe with pid 5416
process: svchost.exe with pid 6748
process: svchost.exe with pid 7040
process: svchost.exe with pid 6580
process: SgrmBroker.exe with pid 1796
process: svchost.exe with pid 6248
process: svchost.exe with pid 572
process: svchost.exe with pid 3184
process: svchost.exe with pid 3180
process: svchost.exe with pid 5236
process: svchost.exe with pid 1572
process: svchost.exe with pid 5020
process: csrss.exe with pid 6676
process: winlogon.exe with pid 780
process: fontdrvhost.exe with pid 4680
process: dwm.exe with pid 3860
process: sihost.exe with pid 2360
process: svchost.exe with pid 2216
process: svchost.exe with pid 6832
process: svchost.exe with pid 5524
process: taskhostw.exe with pid 7156
process: explorer.exe with pid 640
process: svchost.exe with pid 4968
process: StartMenuExperienceHost.exe with pid 4628
process: RuntimeBroker.exe with pid 6224
process: SearchApp.exe with pid 2060
process: RuntimeBroker.exe with pid 2732
process: SearchApp.exe with pid 952
process: ctfmon.exe with pid 5664
process: SkypeBackgroundHost.exe with pid 648
process: TextInputHost.exe with pid 676
process: smartscreen.exe with pid 5572
process: RuntimeBroker.exe with pid 6932
process: SecurityHealthSystray.exe with pid 5404
process: OneDrive.exe with pid 4508
process: SystemSettings.exe with pid 5096
process: ApplicationFrameHost.exe with pid 4160
process: UserOOBEBroker.exe with pid 5852
process: audiodg.exe with pid 5596
process: dllhost.exe with pid 1856
process: svchost.exe with pid 1632
process: ShellExperienceHost.exe with pid 5964
process: RuntimeBroker.exe with pid 6872
process: conhost.exe with pid 2892
process: upfc.exe with pid 2032
process: svchost.exe with pid 3784
process: backgroundTaskHost.exe with pid 628
process: CompatTelRunner.exe with pid 3116
process: TrustedInstaller.exe with pid 7128
process: conhost.exe with pid 6448
process: TiWorker.exe with pid 6828
process: MoUsoCoreWorker.exe with pid 5412
process: svchost.exe with pid 1328
process: sppsvc.exe with pid 4632
process: RuntimeBroker.exe with pid 6080
process: SppExtComObj.Exe with pid 5204
process: RuntimeBroker.exe with pid 1180
process: svchost.exe with pid 188
process: WmiPrvSE.exe with pid 1304
process: WmiPrvSE.exe with pid 3552
process: svchost.exe with pid 3412
process: IObitUnlockerPortabl.exe with pid 1336
Reads data out of its own binary image
self_read: process: IObitUnlockerPortabl.exe, pid: 1336, offset: 0x00000000, length: 0x001e84da
self_read: process: IObitUnlockerPortabl.exe, pid: 1336, offset: 0x30785c546331785c, length: 0x00004000
self_read: process: IObitUnlockerPortabl.exe, pid: 1336, offset: 0x31785c343836785c, length: 0x00000004
self_read: process: IObitUnlockerPortabl.exe, pid: 1336, offset: 0x3439785c6331785c, length: 0x00014000
self_read: process: IObitUnlockerPortabl.exe, pid: 1336, offset: 0x3464785c6331785c, length: 0x00008000
The binary likely contains encrypted or compressed data
section: {'name': '.rsrc', 'raw_address': '0x00008400', 'virtual_address': '0x001e5000', 'virtual_size': '0x0001cee0', 'size_of_data': '0x0001d000', 'characteristics': 'IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ', 'characteristics_raw': '0x40000040', 'entropy': '7.19'}
Anomalous binary characteristics
anomaly: Entrypoint of binary is located outside of any mapped sections
Screenshots
No screenshots available.Hosts
No hosts contacted.
DNS
No domains contacted.
Summary
C:\Windows\System32\kernel.appcore.dll
\Device\CNG
\??\MountPointManager
C:\Users\Packager\AppData\Local\Temp\
C:\Users\Packager\AppData\Local\Temp
C:\Users\Packager\AppData\Local\Temp\nsp88F.tmp
C:\Users\Packager\AppData\Local\Temp\IObitUnlockerPortabl.exe
C:\Users\Packager\AppData\Local\Temp\nsf93C.tmp
C:\Users\Packager\AppData\Local\Temp\nsf9D9.tmp
C:\Users
C:\Users\Packager
C:\Users\Packager\AppData
C:\Users\Packager\AppData\Local
C:\Users\Packager\AppData\Local\Temp\nsf9D9.tmp\LangDLL.dll
C:\Users\Packager\AppData\Local\Temp\IObitUnlockerPortabl.exe.Local\
C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984
C:\Windows\System32\UXTHEME.dll.Config
C:\Windows\System32\uxtheme.dll
C:\Windows\System32\textinputframework.dll
C:\Windows\System32\CoreUIComponents.dll
C:\Windows\System32\CoreMessaging.dll
C:\Windows\System32\WinTypes.dll
C:\Windows\SystemResources\USER32.dll.mun
C:\Windows\Fonts\staticcache.dat
C:\Windows\System32\TextShaping.dll
C:\Users\Packager\PortableApps\*.*
C:\Users\Packager\AppData\Local\Temp\nsf9D9.tmp\System.dll
C:\PortableApps
C:\Windows\System32\en-US\USER32.dll.mui
C:\Users\Packager\AppData\Local\Temp\nsf9D9.tmp\modern-header.bmp
C:\Users\Packager\AppData\Local\Temp\nsf9D9.tmp\modern-wizard.bmp
C:\Users\Packager\AppData\Local\Temp\nsf9D9.tmp\nsDialogs.dll
C:\Data\PortableApps.comInstaller\license.ini
C:\Windows\win.ini
C:\Windows\System32\shell32.dll
C:\Windows\System32\imageres.dll
C:\Windows\SystemResources\imageres.dll.mun
\Device\CNG
\??\MountPointManager
C:\Users\Packager\AppData\Local\Temp\
C:\Users\Packager\AppData\Local\Temp
C:\Users\Packager\AppData\Local\Temp\nsp88F.tmp
C:\Users\Packager\AppData\Local\Temp\IObitUnlockerPortabl.exe
C:\Users\Packager\AppData\Local\Temp\nsf93C.tmp
C:\Users\Packager\AppData\Local\Temp\nsf9D9.tmp
C:\Users
C:\Users\Packager
C:\Users\Packager\AppData
C:\Users\Packager\AppData\Local
C:\Users\Packager\AppData\Local\Temp\nsf9D9.tmp\LangDLL.dll
C:\Users\Packager\AppData\Local\Temp\IObitUnlockerPortabl.exe.Local\
C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984
C:\Windows\System32\UXTHEME.dll.Config
C:\Windows\System32\uxtheme.dll
C:\Windows\System32\textinputframework.dll
C:\Windows\System32\CoreUIComponents.dll
C:\Windows\System32\CoreMessaging.dll
C:\Windows\System32\WinTypes.dll
C:\Windows\SystemResources\USER32.dll.mun
C:\Windows\Fonts\staticcache.dat
C:\Windows\System32\TextShaping.dll
C:\Users\Packager\PortableApps\*.*
C:\Users\Packager\AppData\Local\Temp\nsf9D9.tmp\System.dll
C:\PortableApps
C:\Windows\System32\en-US\USER32.dll.mui
C:\Users\Packager\AppData\Local\Temp\nsf9D9.tmp\modern-header.bmp
C:\Users\Packager\AppData\Local\Temp\nsf9D9.tmp\modern-wizard.bmp
C:\Users\Packager\AppData\Local\Temp\nsf9D9.tmp\nsDialogs.dll
C:\Data\PortableApps.comInstaller\license.ini
C:\Windows\win.ini
C:\Windows\System32\shell32.dll
C:\Windows\System32\imageres.dll
C:\Windows\SystemResources\imageres.dll.mun
C:\Users\Packager\AppData\Local\Temp\nsf93C.tmp
C:\Users\Packager\AppData\Local\Temp\nsf9D9.tmp\LangDLL.dll
C:\Users\Packager\AppData\Local\Temp\nsf9D9.tmp\System.dll
C:\Users\Packager\AppData\Local\Temp\nsf9D9.tmp\modern-header.bmp
C:\Users\Packager\AppData\Local\Temp\nsf9D9.tmp\modern-wizard.bmp
C:\Users\Packager\AppData\Local\Temp\nsf9D9.tmp\nsDialogs.dll
C:\Users\Packager\AppData\Local\Temp\nsf9D9.tmp\LangDLL.dll
C:\Users\Packager\AppData\Local\Temp\nsf9D9.tmp\System.dll
C:\Users\Packager\AppData\Local\Temp\nsf9D9.tmp\modern-header.bmp
C:\Users\Packager\AppData\Local\Temp\nsf9D9.tmp\modern-wizard.bmp
C:\Users\Packager\AppData\Local\Temp\nsf9D9.tmp\nsDialogs.dll
C:\Users\Packager\AppData\Local\Temp\nsp88F.tmp
C:\Users\Packager\AppData\Local\Temp\nsf9D9.tmp
C:\Users\Packager\AppData\Local\Temp\nsf9D9.tmp
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\STE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\Cryptography\Configuration
HKEY_CURRENT_USER
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-10e03f000000}\
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-10e03f000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-10e03f000000}\Generation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-100000000000}\
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-100000000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-100000000000}\Generation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-300300000000}\
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-300300000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-300300000000}\Generation
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\ResourcePolicies
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TurnOffSPIAnimations
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\IObitUnlockerPortabl.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\OOBE\LaunchUserOOBE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\AppCompatClassName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\CTF\EnableAnchorContext
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows\IsVailContainer
HKEY_LOCAL_MACHINE\Software\Microsoft\Input
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\ResyncResetTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\MaxResyncAttempts
HKEY_CURRENT_USER\Software\Microsoft\CTF\DirectSwitchHotkeys
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\MS Shell Dlg 2
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\StateSeparation\RedirectionMap\Keys
HKEY_LOCAL_MACHINE\Software\Microsoft\LanguageOverlay\OverlayPackages\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\SafeProcessSearchMode
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\MS Shell Dlg
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ScrollInset
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DragDelay
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DragMinDist
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ScrollDelay
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ScrollInterval
HKEY_LOCAL_MACHINE\Software\Policies
HKEY_CURRENT_USER\Software\Policies
HKEY_CURRENT_USER\Software
HKEY_LOCAL_MACHINE\Software
HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\AutoSuggest
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Always Use Tab
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Client\
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Client\(Default)
HKEY_CURRENT_USER\Control Panel\Desktop
HKEY_CURRENT_USER\Control Panel\Desktop\SmoothScroll
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\EnableBalloonTips
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewAlphaSelect
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewShadow
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AccListViewV6
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\UseDoubleClickTimer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Segoe UI
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Segoe UI
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\STE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\Cryptography\Configuration
HKEY_CURRENT_USER
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-10e03f000000}\
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-10e03f000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-10e03f000000}\Generation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-100000000000}\
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-100000000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-100000000000}\Generation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-300300000000}\
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-300300000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-300300000000}\Generation
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\ResourcePolicies
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TurnOffSPIAnimations
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\IObitUnlockerPortabl.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\OOBE\LaunchUserOOBE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\AppCompatClassName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\CTF\EnableAnchorContext
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows\IsVailContainer
HKEY_LOCAL_MACHINE\Software\Microsoft\Input
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\ResyncResetTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\MaxResyncAttempts
HKEY_CURRENT_USER\Software\Microsoft\CTF\DirectSwitchHotkeys
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\MS Shell Dlg 2
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\StateSeparation\RedirectionMap\Keys
HKEY_LOCAL_MACHINE\Software\Microsoft\LanguageOverlay\OverlayPackages\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\SafeProcessSearchMode
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\MS Shell Dlg
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ScrollInset
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DragDelay
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DragMinDist
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ScrollDelay
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ScrollInterval
HKEY_LOCAL_MACHINE\Software\Policies
HKEY_CURRENT_USER\Software\Policies
HKEY_CURRENT_USER\Software
HKEY_LOCAL_MACHINE\Software
HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\AutoSuggest
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Always Use Tab
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Client\
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Client\(Default)
HKEY_CURRENT_USER\Control Panel\Desktop
HKEY_CURRENT_USER\Control Panel\Desktop\SmoothScroll
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\EnableBalloonTips
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewAlphaSelect
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewShadow
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AccListViewV6
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\UseDoubleClickTimer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Segoe UI
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Segoe UI
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\STE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-10e03f000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-10e03f000000}\Generation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-100000000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-100000000000}\Generation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-300300000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-300300000000}\Generation
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\ResourcePolicies
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TurnOffSPIAnimations
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\OOBE\LaunchUserOOBE
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\CTF\EnableAnchorContext
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows\IsVailContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\ResyncResetTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\MaxResyncAttempts
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\SafeProcessSearchMode
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ScrollInset
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DragDelay
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DragMinDist
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ScrollDelay
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ScrollInterval
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\AutoSuggest
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Always Use Tab
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Client\(Default)
HKEY_CURRENT_USER\Control Panel\Desktop\SmoothScroll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\EnableBalloonTips
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewAlphaSelect
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewShadow
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AccListViewV6
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\UseDoubleClickTimer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Segoe UI
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-10e03f000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-10e03f000000}\Generation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-100000000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-100000000000}\Generation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-300300000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-300300000000}\Generation
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\ResourcePolicies
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TurnOffSPIAnimations
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\OOBE\LaunchUserOOBE
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\CTF\EnableAnchorContext
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows\IsVailContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\ResyncResetTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\MaxResyncAttempts
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\SafeProcessSearchMode
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ScrollInset
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DragDelay
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DragMinDist
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ScrollDelay
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ScrollInterval
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\AutoSuggest
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Always Use Tab
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Client\(Default)
HKEY_CURRENT_USER\Control Panel\Desktop\SmoothScroll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\EnableBalloonTips
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewAlphaSelect
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewShadow
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AccListViewV6
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\UseDoubleClickTimer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Segoe UI
Local\SM0:1336:168:WilStaging_02
Local\MSCTF.Asm.MutexDefault3
CicLoadWinStaWinSta0
Local\MSCTF.CtfMonitorInstMutexDefault3
DefaultTabtip-MainUI
Local\SM0:1336:64:WilError_03
Local\MSCTF.Asm.MutexDefault3
CicLoadWinStaWinSta0
Local\MSCTF.CtfMonitorInstMutexDefault3
DefaultTabtip-MainUI
Local\SM0:1336:64:WilError_03
Sorry! No behavior.
Sorry! No strace.
Sorry! No tracee.
No hosts contacted.
No TCP connections recorded.
No UDP connections recorded.
No domains contacted.
HTTP Requests
No HTTP(s) requests performed.
SMTP traffic
No SMTP traffic performed.
IRC traffic
No IRC requests performed.
No ICMP traffic performed.
CIF Results
No CIF Results
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Suricata HTTP
No Suricata HTTP
Sorry! No Suricata Extracted files.
Sorry! No dropped files.
Sorry! No process dumps.