Analysis
| Category | Package | Started | Completed | Duration | Options | Log(s) |
|---|---|---|---|---|---|---|
| FILE | exe | 2025-06-11 09:46:46 | 2025-06-11 10:04:27 | 1061 seconds | Show Options | Show Analysis Log |
procmemdump=1
import_reconstruction=1
unpacker=2
norefer=1
no-iat=1
2024-11-25 13:37:15,366 [root] INFO: Date set to: 20250611T07:24:04, timeout set to: 1000 2025-06-11 08:24:04,113 [root] DEBUG: Starting analyzer from: C:\tmp_gell1p8 2025-06-11 08:24:04,113 [root] DEBUG: Storing results at: C:\uyHCokWh 2025-06-11 08:24:04,113 [root] DEBUG: Pipe server name: \\.\PIPE\IpEgLKC 2025-06-11 08:24:04,113 [root] DEBUG: Python path: C:\Users\Packager\AppData\Local\Programs\Python\Python310-32 2025-06-11 08:24:04,113 [root] INFO: analysis running as an admin 2025-06-11 08:24:04,113 [root] INFO: analysis package specified: "exe" 2025-06-11 08:24:04,113 [root] DEBUG: importing analysis package module: "modules.packages.exe"... 2025-06-11 08:24:05,145 [root] DEBUG: imported analysis package "exe" 2025-06-11 08:24:05,145 [root] DEBUG: initializing analysis package "exe"... 2025-06-11 08:24:05,145 [lib.common.common] INFO: wrapping 2025-06-11 08:24:05,145 [lib.core.compound] INFO: C:\Users\Packager\AppData\Local\Temp already exists, skipping creation 2025-06-11 08:24:05,145 [root] DEBUG: New location of moved file: C:\Users\Packager\AppData\Local\Temp\PCI-ZPortable_2.0_En.exe 2025-06-11 08:24:05,145 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL option 2025-06-11 08:24:05,145 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL_64 option 2025-06-11 08:24:05,145 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader option 2025-06-11 08:24:05,145 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader_64 option 2025-06-11 08:24:05,442 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser" 2025-06-11 08:24:05,488 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig" 2025-06-11 08:24:05,535 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise" 2025-06-11 08:24:05,535 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human" 2025-06-11 08:24:05,551 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops' 2025-06-11 08:24:05,551 [lib.api.screenshot] ERROR: No module named 'PIL' 2025-06-11 08:24:05,551 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots" 2025-06-11 08:24:05,566 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump" 2025-06-11 08:24:05,566 [root] DEBUG: Initialized auxiliary module "Browser" 2025-06-11 08:24:05,566 [root] DEBUG: attempting to configure 'Browser' from data 2025-06-11 08:24:05,566 [root] DEBUG: module Browser does not support data configuration, ignoring 2025-06-11 08:24:05,566 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"... 2025-06-11 08:24:05,566 [root] DEBUG: Started auxiliary module modules.auxiliary.browser 2025-06-11 08:24:05,566 [root] DEBUG: Initialized auxiliary module "DigiSig" 2025-06-11 08:24:05,566 [root] DEBUG: attempting to configure 'DigiSig' from data 2025-06-11 08:24:05,566 [root] DEBUG: module DigiSig does not support data configuration, ignoring 2025-06-11 08:24:05,566 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.digisig"... 2025-06-11 08:24:05,566 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature 2025-06-11 08:24:05,722 [modules.auxiliary.digisig] DEBUG: File is not signed 2025-06-11 08:24:05,722 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json 2025-06-11 08:24:06,160 [root] DEBUG: Started auxiliary module modules.auxiliary.digisig 2025-06-11 08:24:06,160 [root] DEBUG: Initialized auxiliary module "Disguise" 2025-06-11 08:24:06,160 [root] DEBUG: attempting to configure 'Disguise' from data 2025-06-11 08:24:06,160 [root] DEBUG: module Disguise does not support data configuration, ignoring 2025-06-11 08:24:06,160 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.disguise"... 2025-06-11 08:24:06,160 [modules.auxiliary.disguise] INFO: Disguising GUID to 88063f41-cb09-49fe-8433-82e8a31757b9 2025-06-11 08:24:06,160 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise 2025-06-11 08:24:06,160 [root] DEBUG: Initialized auxiliary module "Human" 2025-06-11 08:24:06,160 [root] DEBUG: attempting to configure 'Human' from data 2025-06-11 08:24:06,160 [root] DEBUG: module Human does not support data configuration, ignoring 2025-06-11 08:24:06,160 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.human"... 2025-06-11 08:24:06,160 [root] DEBUG: Started auxiliary module modules.auxiliary.human 2025-06-11 08:24:06,160 [root] DEBUG: Initialized auxiliary module "Screenshots" 2025-06-11 08:24:06,160 [root] DEBUG: attempting to configure 'Screenshots' from data 2025-06-11 08:24:06,160 [root] DEBUG: module Screenshots does not support data configuration, ignoring 2025-06-11 08:24:06,160 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.screenshots"... 2025-06-11 08:24:06,160 [modules.auxiliary.screenshots] WARNING: Python Image Library is not installed, screenshots are disabled 2025-06-11 08:24:06,160 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots 2025-06-11 08:24:06,160 [root] DEBUG: Initialized auxiliary module "TLSDumpMasterSecrets" 2025-06-11 08:24:06,160 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data 2025-06-11 08:24:06,160 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring 2025-06-11 08:24:06,160 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.tlsdump"... 2025-06-11 08:24:06,175 [modules.auxiliary.tlsdump] INFO: lsass.exe found, pid 696 2025-06-11 08:24:06,207 [lib.api.process] INFO: Monitor config for <Process 696 lsass.exe>: C:\tmp_gell1p8\dll\696.ini 2025-06-11 08:24:06,207 [lib.api.process] INFO: Option 'procmemdump' with value '1' sent to monitor 2025-06-11 08:24:06,207 [lib.api.process] INFO: Option 'import_reconstruction' with value '1' sent to monitor 2025-06-11 08:24:06,207 [lib.api.process] INFO: Option 'unpacker' with value '2' sent to monitor 2025-06-11 08:24:06,207 [lib.api.process] INFO: Option 'norefer' with value '1' sent to monitor 2025-06-11 08:24:06,207 [lib.api.process] INFO: Option 'no-iat' with value '1' sent to monitor 2025-06-11 08:24:06,207 [lib.api.process] INFO: Option 'tlsdump' with value '1' sent to monitor 2025-06-11 08:24:06,222 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp_gell1p8\dll\pQxbIz.dll, loader C:\tmp_gell1p8\bin\EPCPTrhb.exe 2025-06-11 08:24:06,269 [root] DEBUG: Loader: IAT patching disabled. 2025-06-11 08:24:06,269 [root] DEBUG: Loader: Injecting process 696 with C:\tmp_gell1p8\dll\pQxbIz.dll. 2025-06-11 08:24:06,332 [root] DEBUG: 696: Python path set to 'C:\Users\Packager\AppData\Local\Programs\Python\Python310-32'. 2025-06-11 08:24:06,332 [root] INFO: Disabling sleep skipping. 2025-06-11 08:24:06,332 [root] DEBUG: 696: Full process memory dumps enabled. 2025-06-11 08:24:06,332 [root] DEBUG: 696: Import reconstruction of process dumps enabled. 2025-06-11 08:24:06,332 [root] DEBUG: 696: Active unpacking of payloads enabled 2025-06-11 08:24:06,332 [root] DEBUG: 696: CAPE debug - unrecognised key norefer. 2025-06-11 08:24:06,332 [root] DEBUG: 696: TLS secret dump mode enabled. 2025-06-11 08:24:06,332 [root] DEBUG: 696: InternalYaraScan: Scanning 0x00007FF84A790000, size 0x1f4542 2025-06-11 08:24:06,348 [root] DEBUG: 696: InternalYaraScan hit: RtlInsertInvertedFunctionTable 2025-06-11 08:24:06,348 [root] DEBUG: 696: RtlInsertInvertedFunctionTable 0x00007FF84A7A090E, LdrpInvertedFunctionTableSRWLock 0x00007FF84A8FB4F0 2025-06-11 08:24:06,348 [root] DEBUG: 696: Monitor initialised: 64-bit capemon loaded in process 696 at 0x00007FF824DE0000, thread 5140, image base 0x00007FF60D500000, stack from 0x0000008EFAA74000-0x0000008EFAA80000 2025-06-11 08:24:06,348 [root] DEBUG: 696: Commandline: C:\Windows\system32\lsass.exe 2025-06-11 08:24:06,379 [root] DEBUG: 696: Hooked 5 out of 5 functions 2025-06-11 08:24:06,379 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread. 2025-06-11 08:24:06,379 [root] DEBUG: Successfully injected DLL C:\tmp_gell1p8\dll\pQxbIz.dll. 2025-06-11 08:24:06,379 [lib.api.process] INFO: Injected into 64-bit <Process 696 lsass.exe> 2025-06-11 08:24:06,37 <truncated>
Machine
| Name | Label | Manager | Started On | Shutdown On | Route |
|---|---|---|---|---|---|
| win10-2 | win10-2 | KVM | 2025-06-11 09:46:46 | 2025-06-11 10:04:06 | none |
File Details
| File Name |
PCI-ZPortable_2.0_En.exe
|
|---|---|
| File Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| File Size | 1509840 bytes |
| MD5 | 96a224903d57aadbdeec474aeb42d724 |
| SHA1 | d3fffd3dad5790de8de5b1bd474ee77b33e8afed |
| SHA256 | ee8a99812902444c7f3769d8175c98ff936277054958735d49bc66db5f81f5f5 [VT] [MWDB] [Bazaar] |
| SHA3-384 | 2bdf27a9ce5e4850fb33d2d271ec2069eec5f01c9626ea53eb9fee1931d731480fce55c384b629ca2886358f73abe2e9 |
| CRC32 | C897B2D2 |
| TLSH | T1C0653314FB851979C0F307325F5236FEBCE8CB04286ADA5F47517E997B216848E1AA33 |
| Ssdeep | 24576:J9DuUUWUM2Kz/n/SLpcL6hI9ZeeQzoH7zzI/DT74aTktcZ5Sbluyc2ymL+7EZXGe:J9LUM5ap2jbzs/DT74xtc2BtXyg+wZX/ |
| PE | File Strings BinGraph Vba2Graph VirusTotal |
.D0Q6p`:X
_~$N}J
b:UR(
!T[#@
?LPW[
@.data
0:]cL
=:~im
$s0`T
_]MrF
,j-$C
>X-|}h
0s+=/{H
Q\1lpQE
D{{9~
iH;MU:Z
QIT7DE
]:@(7
M_pE
T#r'MHwO
];y?Sj
\CCrLC
|P,([1
GNl#t
zO7ld)Y
fPR [X
Jk=u.8wh
9-5<6
0E^|j
wzF<Rm
lAH>w}
VQSPW
*,Va37o
TR4'PB
'aL=]
j<^JY
g|c9\2
85*zDF|6
IN$B_
s-/9H
&<W}Ww
USERENV
yMhljw
CreateBrushIndirect
P!k_S
G;*xb
W6Q1t3
K~0)fbI:
JM&l_5
y]gHB>
B2r[s:
S0\M5i|
b1[D<o\
nLuaP
$Hp;?6
Ltt/\
040904b0
qi.86
XU~BU
qib:\
68Izq
ic)q1
0C:@(
]xXAW"A
Fi3'N
afy[C
<<TrnWv
H?e/"
d;`Fn
dv4mH
SK21Z
e)M>;wX
NaAMs
N,\gN
Zf@\+]
aJg?!
)'gRV
tCp/m
/kJWr
X(Ln$
zQyrk
%u.%u%s%s
j|^\#
#c.Sgs
f5zX5
]8L1G
49goXe
'~:!{
c{C#9
=tQ
t*.+)Iej'
_7Tl0C
T0/~Aw
qgC8,
H(|4%\
_74`fd
Ey@oO
\/d6li
Xtp`{
RQ:5I1
5oW{R
=|#C6
WZ^{\
Q^d,
\YV(c
/Cc_l
5/)YL
laLmU
I)F\Y
-"M5\)
z3-o]
(IAd4
JV@az
1gJ#c
:(1qN
qk n*EnG.
GLw B
@/}k4t
(LV;`@
DAAif
7g`UN
W#VBz
rD$N$
Jj!dII
.Hl|}
EW+w`
FLZ*+
{9Xx%/
1T+ Cf
LOGjp
0 IOv
c8E_^r
)TbRP
BPf L
o8Oc6g
/\0w&
^Oz/4HM
r|.vR
X;)|<R})!>>yZ
|iAeN
@OMGN+t
s.~F#
Xhpwy
NGcax
0Yne!
\`\sB
e!qLA
(w::K
N%iKF
z-O;Ne
="DLa
x-YAR
(p -?
oJO_?
b^'N"j
*EcD+
^{{g{J
d-?ti]
GO7wm
"vz2{
`oCAhX
v4@!d
`TfwVl~E
%U(k"
e?@~8
S`9hn!
|8en=
\Temp
#-0X>
E2B.+,7
CompareFileTime
5$qUf
nWZ:h
J+0qH
?t:B:
N.IdY
x@$C<X
tmqcj{R
CBQ9{
!"6,X
8Ae&Y
cL(/y
,s:pQ2
MHe*`
w^iOE
Ce;.F
m)K6;
KLumhj
]@%c&
4!hBJ
*`}tw
`s*-Su
&~aE0
_A[-M
[%|)&
g";r4<Q
FZ[!z
fr=y?{
haRdJ
e_@=Z
^QI/vnPi
dd5,
'1?%B
sZ{Ss$
q)#(y
Pbd`-
vqin=Kn
Z\ix_
3YWJ\
u+K~W
8zKB=
L}svJ
Ffz&z4|
r\'Jy
P?zg5
Mw;gB
S@N3?8
(V|K'
r>>s^
h&Ho5
*!LcH
6Ys }jAi
#`c={
lstrcpyA
4sQi_
AdjustTokenPrivileges
nzL=oq
q|;)[
AC_3i
Talx(%i^
MG>BJI]
?bd#u
TkU54P
_\Un,
orNRI
,RZ;_
5Z]-K
+R` Sw`9
${)*p
D,xR'-1
OwcE<
A|&A:I`
0dvs
[NQE7
#`_=D
^b\YD4
d<G5@
WQ4.?
[S,W*
%`gB<
yay$=
3Cw\l
Lbiy7
/?i<o
riw^6pih
m]!;j
qK3e_
&r>$D
fb'dLk[
bG=(?
?EM8:E
)!(J2)
"WD*H
gI<[i
eW.+,
,=@=XN.
dl2<mV
jb'o0
(5ki"
>P!!$QL
wYvRM
\CSu [u
AcNbo
V]6qPf
oc_(&
Upi!B4
cGv^F
MBROC
x$$RM
lyuI@
*@$]F
D/!w@
I',CQ
GGg]OQ{
nBE-i@
dK"YW
P_+z>r'KNX1
.P&w8
SHELL32
pFgMi
4_f~\
uf)6*s=
h`Heb'$
>4sqql
zZ_ynC
GetModuleHandleA
c]P+8!}B
C2FF'
@ER]e
D}q"Tf
mfZs9
m]1)>
!D][Y
Q(@]K
?(jDZ
"p0FD
Y)B!|
Y2wXS
>cm|S
Keom9
Ivyq=w
eL^eI
TZ1/s
P;"v%/4
kD{I&
c!u{]t
@$&zw
P*ahsD
?W1c,c
bvjN{L
\F+m0
!+mTC3
TwRzw
.rsrc
p|~%T
"'f/EH
GCEZ+
D87>!
0:,io
Y_rB-
<$OR>
_:p(J
)f=[Wk
V(on^
Xn;Ul
@+xl/
&U/$]fo
;|0P8
xT~\!
h'hDm
P&r&KH
\OWskYV
E"!vm
PCI-ZPortable_2.0_English.paf.exe
v]xmpX
\5p%M
%W@AE
0B>i#R
0U5S.
ZO~mJS
QHSS}
cDoF8
SZoFN< `
3A!HO.
V5x!4R
g(2%J
Ehl8j
Qz>HDz
`\ZCO
<1?go
GetFullPathNameW
wpC[$
v%4xn
jeron
>6yw/o1
S]xF3ee
W5WR$
x3}2{
V0#E!
G{;I0
FkLs0
~0q<
G~PXOW{
oQ2vL
9A"A;
R6N/T|z>#
D"QA2
Ye3p(
?$3-98)
m}Qr[G
SbrHg
U;&|k
'l+Os
2?us2
v'Qs u
qVLB$
RegEnumValueW
SeShutdownPrivilege
3e%NhO6
oBMOg
g#l|C
,4f~7
]kkX=3
NSIS Error
X)^,cskf
".cZS
eVgYP
+HN2S
.iKZp
eQcem;~d
r|6)'
`To#sl
/N9HV
cTjO$
)6Iem
m'F~
.text
"[=*+
jerp1$>
]q3Y#
Z<p"-E
wWnJDA
4Lm^$
sHVvX
W|--1"$C6
aYNde^RgHB6
jJ}d;
j ?yk
LS3,o
e<l/j
=&fY[j
mx\Pp
[n>Qmh
my_mv
y?'[=%
y]S$^)
1s;'w
_z=1QL
>QH0P
93EFJ
'm1;
JxE:&
A*=1A
B](9H
gK5l|
X`Cp_
\=%L
OcfNg>-
Ud8~~
_wb"a
NqEIU
^j\PN
iB)(J
m+Bgh
M-iOO
v'f"D
se{|-
/NdFG
kz<WF
^!kLV
!iz3:
E=)r.
:4YYd
s}J77
'X>qa
FYznh(
x11K/S
"/PT]b1z
|1sAGP
D?<JSRj
{|/(q"p
0Z|~Y
F-IEy
H5:z2
wCaIA+_
YRo47
kGl#%
nBb8Y{
2M~=D_c
LN59r
p:N.Dp
@9AY4
BgRsL
qt_>=~t
A1x%07
`(g@H
yk)d,
6)-e+
5KGtf
/|&E;8%
`J:~Q
e$*aW
F"=Cn
pOHQY
#d+{N)
q@5asBz
FeIFJ
Qz[U~
DeleteObject
YhAO,
0O1<;N
EmptyClipboard
N^@ps
KE`L)
^[rm;
@AnpR
/F5"2z
U goe0R
Pp>YB#
'}&p2
aGa!$
|YK2y
TJmQo
LECjf
^ITCD
q&p;v
&PF8vJS\$K
Rq88*
%K!#(
GVb`\?AlZ
RG !/E
l&~:[
=@uz*
(nEy+
"2RLa
r>>^:l
SDY1U
:lhT<
{3z,_>!aVC
CHX4n
TTb;9
snEB4T
"W!m*
!!$:X}
EndPaint
MI#SiU
T-<yaTR
F &:}
E!VISr
G=8QSI
b-:k.
EsE1:r3
!vb7}
As]E[(B;
V!Rh!8
zoxMR[
C[[>g
-*[5*
LX/__$
\#{iB
{Er3ZiT{
)<+$L>
l}plj|
BI4uYHj
v|7}&O
R7wfy
j!5\/*AO;
WNps*
6x<G_
|?<h"
yxes9
I1f^q
]#GD4
nM^At
mk6|9
PVi#~
qQWE)
zpA,0
\VXs7
;+\cD
)NlVG
`6iUg
/RQ||
~m_3F
vzxQq
lPsdJ
o3o3'
=[rV]hZ%
]|xt4q
UYX_?
%'}Iw
Sn]t|
H)/KS
;Prq2
]7t6H
'zO!.
j3(/K
,/+B#
`xY]x
q.~Zy
+1Cc3
P*9kG
)a@dZ
,=% 5
LegalCopyright
)TqB|
5D(S{g5
SendMessageTimeoutW
yR_uN1
tv\g*%
B0 X*<
+"u!9
+z<5C
SetCurrentDirectoryW
isAg-M
"xUMK
075benz
Fj p
KXu`G
YTnH@
=rJ3
%imz(
Sghv~^
RIW7Y3
2B^X[
vjmB\
[w)(g
{1T>
#t+{3
sCsRj
)UDVB_
-nYsi
GetMessagePos
5K8u|
K'<wW
-5Urt
0mPF=
<QN"'
9Z,x\
Kq$<|
p'go2~(
O?XuK
94gY$<
P~_PK"
u+U9(
50^<"*
xh{>,
yH(sd
iZ;qR
+ty&H
ImageList_Create
&]go#ANB
|m[&!
\*+e.Sf
A9m4C
%V:7l3
eBu't
kg3q]
&U=fB
gi4blk
2<.6;d
Y4|l@
LNRV)
&q%E.Gy
qX\aw
|Zme$
d*c<Y
x,'?vO
5,x*HD
t\ -'^@
uZv>U
F;O9|
Gqfm4
\TdpluW
GZU:F
F3r,NNX
X(d,(
W57My
rL<PW
e\~N
Wua[b
UJu41i
'j/fRB
XLl3,
|)3zKm
qZGEE
iM'D;
\?vMT
5Z1eE
JU1+q
b?_5&X
Iyg.M9\
E_[t(
6vD3O
nZGu
.'(gg
9wYAdd
p7!J.
{ehs2B
YL~ 4vZ
U1,b.BQ
T=9\*
V2n]tO p
sa^xm&
e$%H9
7{WaR
1xXX^
18bkk
v\?,.jf
"%AH}
/U*V=
Qj:P&
G6:?7
lSYB*
a*9mqH
tAJj`
s]go`Q
=%&BUhe$
`X/~Z
]#a W}5
|0h5{`
ep&~-I
^$AMT
aZx.Z
1Y;")
sP>\G
s<{x?t
jqb~k
For additional details, visit PortableApps.com
NQ3T[]
.I~9Z
:hW2e+S
vRszh]
E|d6v
Xz/1/
-N/Y$
8,3,QD
R7:f/
O1"45
msctls_progress32
JE8g>9,3
ZZ]yD
SHELL32.dll
$'^LQ
QT{tO
\)Z+5V(uU
VNJbqs
<8{;?
w`nXs
Xixe'
svuSj
jh.b)*S}
faLa,
DUY(6
-]*q-
&]0Sm
S|s:yD
4thGm
h}w]L34
ATKr7
^zttp
b$87j
;q{Hu
7ZSSv
D4q!C
!?K^^8q
40%.qh\
r?q`|
ShellExecuteW
V0{n+)e
,]"2*
\&+@I
OgLiZa
+>.Tj
wf!Jh_
8lbB/
Nqe7h
.<`P[
JvN)j
2bJ.T<v
nXr:e
x(o5e
S?<Rw
1Yz2By
mR8sN
`?:3XJia*
Hm>\/l
/ P6pL
CreateThread
tqfI7
SetBkMode
\IzHc+
f>~_%
3smCXW
N6~Of
/=*JZk
a9G1<h(
$c:4|I
R3p^}Zr
(y+Tv
*]fcN
4=5`L
<Dzfe
7h!R 9
;+y&mi
TA{]0
zl6I4
}~)o3
%ED'd
v`"p:
j|F_e
4V\m``
"_<'i
g!vk`
4ee#x
!0I2`*
%or1paAWG
=SNG~x3
2.0.0.0
:(`bL
gG'm\:M
2V>[T
;?%!6
z6`v<
Q*@W?
XC[0X
IetVF4
*y2.#d[
gNkC!
C{c,f
a)iQl
Jl'>E_
00Z|#
+_f?a"
jPuR`gM
yKJ`B
oaQZxov
Qs#g%
VEi7{
W<ifw)
jIP+`
GetUserDefaultUILanguage
V'nWgnj!~a#
,6d^@
Q{C)I
e[a(6
;C.Xq2
Bu^PFT
!]~&M
]^N@7
un`~z)o
/-P?pR
v]@tk
+%a=`
#5V7\t&
EP=}$
\Q">;Q
PortableApps.comAppID
FindFirstFileW
S"(e5D
sD"UnM}
tt;{;
yI=.4L9
wsprintfW
`ZOIKF:
U/=4D
[>}LD%
% D3t
UO/:b
HI"qv
=hxUZ
Zg<Os
=E~\a
L|cyH
y#v`[=
6(]R7&
M$b<H
ukY[#
.3b+wk\
)A51!
/$/PG8
6Mk9W
%3/S@s5
~c\9A
D/{|h
Gx?4V
~=CW^P
pH;I)
KYZ3f
[cvD2\7Z#C
#A1M(\
AH0js=_
Wg-w@@i
1'qjYH
a}ryV?
j8WUHBYs
uiMuV
JR[CC
R%D1y2
*cV a
4:iSG
Ti8&j
mku'_
R{>BCF`
yBPm|
ygEW~
&0y,C3
8pUMFZ
9l<x@j
zU_y44sK
d?n_;
a8qp4
_}8{?
t~Gizh`
IDATx
0F3GJN
}|@]NF
mwD*w
I~yD2I|J
NxoN'
H]q 3
0frai
Zpbj?
Q{udy
Nho2K
/xOP:`
JP@Z,r
]tar#
G" 4r
"N?VM
2/Uk1_
_dhVv
O&{;Q
ReleaseDC
x=9Wy
.'di2w
8gIVZg
H7fv_
|XN b }-
bg*n1t
<Yg`s
WNsvU
6%,s$
Y<ARDd
3,{%5
Y)c|-:
}:Jhq
Nd1g]
IUxD3
;B:*O
&EFPd
5;3_*
TFc$_
y~3H6{
|:GV,
R&1hw9!
pN|d>
Lrz}i)E1
bhvfx
o{]1uS
WideCharToMultiByte
8b{kw~
VarFileInfo
A^-((
MJ'm-6
7xoM[
rv7E#
]pc)[
_B!YA
WAUyC
J(tQ:
fpB,6~
$:M.;L
v\"?M,
&,cJr
NL-AL
'C,dl
GetFileVersionInfoW
cd\1e
z4&GO
g2}\I
Nk&2g
}R2?"
.pnYz
mLFlU7
CreateFileW
u/'h-
z}b$o
XkgsN
(7t'9c(Bx
;-A5y
=<^[_a
v.D4SIa
6QcP{$
p^vH[
YNfdJG
S]+]Kl
CopyFileW
dmo/|
EIFgv
YCV6[
>aB|9
60GQ,*Y/
2<:30
+:x(L9
BnFE"
[Q4S;[
|IoEl
Q< Si,
%+!nw"0
oVKXuT
0f]L$
y%@.@\
SHFOLDER
Y6KWj
3iKwX#
.2qif
wO_7{
$OTKS?)/};
"e$A>
j/MA~%J&
cq+\L
.C/CgK
!z6s!
Q1uL|
Nrr=.
RKjKz!0MU
wyW$K
GC|8i
Qk|Ri
Hz/R`5>`
i05$J8
(1dQ[@
4)cVn+
xbKh^
4FYtw
]|ub=&
*:hN9
&6(t;
WE~Bi&
E&e>l.G
GetDeviceCaps
!|ooQqw
7uCq<
zi'5 yq
;/Ey/
?6HSd
pDPLZIa4
2c(Q$
$'\E,d
v7o5>
HoS?s
6P?9}4
={n\`
mn]9Jr
NlNI.l&
f^QY_
tvBFxk,n
[!aAf
)fW#R
&?]F*
*!w%}
\HFC3
8Y|AkR
TXmA,
wc}RS
U+=ui
$.MM_
#c9dh,
KERNEL32
\wK]R
N`:mL
LGu!"
T25N$G~
N{AJ7{
BLNUaU|X v:9
d@go]dt
0TY;p
YG.sI5
!XDzK
.Jj6Z!(
B'Bm%
AJL}{8RSE
-V~vs"hL
pth1j=se
MIB7.
\u f9O
=O/j9
"4Nk7
:P2{W
tA%rZ
BbOlA
SHGetSpecialFolderLocation
?<EsI
P~klX
?To0EU?
.&Fh?
']]AJ
@>F,O>,
T\ bVL
EZS/6e
ZSb3"
~Yr'<
p2CN;
@<@lA
UWvxv
TXr&M
=l,0[
Dnm,3
? g%P
S:,y$7
s0#\'
qU*&Z
c-Zg-
P(#D3
B-?w?
J((2o
}muF9
=w4Rg
rWk&6+5
}g:hk
HL}&8Pk
xf#11T
AW|Fa
]k7k*
l@ZD&
cL#`>$
~#o&]
`~=FJ:
X,r=a
?[y&&
Vsx>"
}|l8~
:l9S1
v+Q7<
yuUSG
;_Nd7
ij&28_
!s!FC
k}D"1
`xTMv}*
>UT,%
&[f_X3
Id,gS
doGVM
Ct|Hu3
olj}xyGK
uq>M(
JQ]hb
w$?3.
l"JeO,
[,Csm%
j;[!_
E2ndB
, MfQ
e'=B(
<{(gB
|*w;L
G{F%4
&u9C0
y-NK|
[AbpIK'
X?>w"h
Tok:LAc
1o/hk
GW\j)
]{V<p
`^p{J
c)~,{
6Z>0=n
uI`b0C
O-!co
Z8jKm
u?YYo
W[AS?
BP2u$
&V._zk-Wf
;aO*y
#%1"~
c$W24
\LW:B
yFkiZ5
*HW\T
-Vw{!
Wo}0C
9_oTo
SetTimer
2}c<~8I
eF'M_
-^!I}
$ih+J
zs,Kv
WG"*%
IJOd(
dT5%Ef
q7TFI4I
Ri$"5
Bz@VV
d-.8J
6rm'BW
N,|=l!
>gnoV
(>w.o
bx1{E
@(m<,
ZNTDH$
`a+}$f)h
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="*" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v3.01</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/><supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/></application></compatibility><application xmlns="urn:schemas-microsoft-com:asm.v3"><windowsSettings><dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware></windowsSettings></application></assembly>
/9N3mR
3=((5
JYhQ;q
H1Vfgh
\-P/e
*@D#T
ne^HNh
<zpK~u
GetWindowsDirectoryW
DefWindowProcW
D`[xh
A.V^4
n$K0hj=
P$LSD
XBUsR
lZAjo
"D?2j
dfZS0
0WZHBMko:.2
J},&U
nU%EL
GS}:It
bGsD<
GetDiskFreeSpaceW
|F=O"v
'iVrC
lrXzTN
66:"G
=LRSy
a"mck
Z,)x\
bC-N}
bMk.w
ug&t6
bg1lzb
<A.@O
t\^x)E
Ky/-:
J2,ab(
g\#;F
Y_{q4
XR$m%
tZj\V
]KJ2[
lkQGZ}
P6/bej
L]l2hf.
fz}WU
G%*^
&~lK8
_jlvzyxb^
Q?W7L
H~yv%
bwfTF
Qp8%Q
OGDF5
9AGc&
q,P{$
5PtVx
AQ .}
,(h$->O
\FmT69K!
r0OS$
m+*Vq
1uZX8
bx!xD-
#rA)Z
"<fd!
6 !!*
%n{,
`bi1vrI
kH]M9
m~Pq|b
7]P`Va9
jVD/0
U{GI{
JBP)tUQT
7]]~o
iyi7`
?)rG9
oH0g/+
V9u|m
:/30m
Gd5z}
'kWis%
49mL?&m@
rJ.Tt
V!\8Y
GFeO@
v7$`K#*tr
1t}J^
[p}Mr
F7+m.
MoveFileW
L!J3Hw
http://nsis.sf.net/NSIS_Error
"G|vt
Fit1r
wLh+e|"
rf9I.
I[<'x
5'%F/
"M'KN<s
ZP]A,
h2T(bjVui
/N4z&
oTj+c0
,cngW
!:JCp#
q'_0v
qI3$C
4Nu;*Tw[(
mm=A(h
HPXR:2
cal5a
6R:2W
Uge1>
IEFNlD89A4/k
S `#%
#AZ^C
CUh3sx
I#W"F
?vqo1
Qsb8$
F P9a
+J/]<h
.P2WT[!
)]@$2c`%
'w3~o{Z
b&y?}O
UQ|+@
#{=sb
\rt]l
\YaUc
zBbe\;4
b6,Xo
cl]\y-
~WABD
NW^,)
r}>x+=
GXucA
qjz0y
VuiIv
ZP%E'
XFnXew,
EK=XN
SZmDJ
q\N"0
`j>+
Aq{(Wp
%yq|p
GDI32.dll
j_|6f:
^{qyB<.7.
m#|c+
(kK@.
TK?wAqx
2.o}y
YOxh4nhd
J-W{?
o'J~t
f,IcD
9v-0"
$4?\9$Ux
]d;|C
!yfC*z
X~>%?
/,sr'
2<Hz<zS
y4KqE
@MWxw=
nP3F<I
(7?i3p
}oY+z
^Hvlw
szsj~p
y4$y8
WH||^|
iOgpx
=eP*d
<*0=m(
-_yz&
(bN/-.
]8sXY
]/QQ*
u:FeV
Z|9<0
'Wn8Z
!W:}{&
dxUxT
XU_^RL;
8+ /k
}q5}S-
0]PQp
xz sVM
?]xLH
[@kg.
[UISaYNd|sg
p5YMQ-
xpp/l
|_Z]|
/R]YG
O/Vb4S
)Fgrm
8B1eb
]k6~a+
:3R{n
,?Q0H
}OVRi
MeHx{
UCZiH
Gu6:Zs@;
.G3T;q
WE*p/
Z4q{R:
at45U)<
(#H}^ru&-lL|
uN.D(
H|wPs@
cqE+YH
XNatN
sv]#+
Udn$9q
r>0zQ
m >gn
7"x3f
cWEnl!
i]{c}YvTzK
x5}0E
EUe>G
*%4r84Cp,#
5<'43
z~>}<
=LBPE
Psc=2
88p6,?'
$iA9>
3.5.1
+Og%E
nT8;k
PortableApps.com is a registered trademark of Rare Ideas, LLC.
SQSSSPW
GetDlgItem
Hk)IH
+$XCd
yC=<*c
!Z0i~B!~
%7bao
O0b`nd
q:27G
'^nm.
2-{Y1
k`RS?
Qa6E.
o'"Gd
wdHGy
vovZ
m*JpH
-EqW6
MOgy4
ps_SI
8".EC}
vQ1 "e
ywzIu
<4*F:5L
k%"@z
.Jv~L
?W<`8
i*ylH
!This program cannot be run in DOS mode.
PGCTl~aD
.o[3`3r
Ej9@]
VwHzO
?]n36
(5inP
(~]#C7T
=|);k
8x9\ZI
@;>n3&
8CG9*
ct`-
Q7jtNj
8mqBe
{*Gq }*
C]fOm
!5Xbp
['Cp)
/b2D8
AhfP]
KJl+b
/GF);u
6a=*X5
~(8EJ
fQV6c
V}#ElN2
g`Jm\4
"Rr^R
JZJ!5[
[!EuZq
bH}y@cDxp
@G}46
fD|GH3
O~0_LSvb
U@C$e+
,*_ia
'gJQE
HCwia
WXrUb
RegDeleteKeyExW
)KWrD
=vdqH!HZ
]DgK!
jqOksx{
ULq?aK
AQOhd
O7pUfA
P)3g(3vS8;Zo
.w1,@J
$zWoY
E,71`z
v~yme
x4ug_
t"UvY
6mRSM!#
.i=Gb
|xB66
q)]U
3xYwo
m@/U q
vvrBp
rgpL5
k&(9<
P# b5
C^}?/]
jBr #4
11gJ+
~rX0+ZX
Translation
+7/^/
vhmlF
eUf/p
aWr*7
Y'%X
nz=.'0[N
?nQ4I
2Kd'}
4nw*ci
o}|I0
0Q1H@
DZbe/
rUNzHY`S
>Em.S
j~YQX
PpZ1?
*y"+d
/;Sp,
Nb3&\
r3p\}Z&[1
JF2@v
29M,V
u(_Ec
m>;d\
>(/p#t#
LETB@
=)a&n
+VfF(_
(W/{|
UO{^H
~PirE
RRpH[
u{U:t
* }8*'
DqYqq
r(Ij9
xjBn{s
)@~EN
2Xln4]
D>Fz/*
2y]b%
O(v}-
_)=(e
@?Ysa
*CAj
z/vP,=f
MMhlH1
|}2a{
<+r]c
AIRj\
YyHt@
,ytP5
bt[E ]
N0Z)+v?
]uO6+Hc
'B]8Y
_+9e+
w="^+
19kR%
jU\;"
v5FGI *
_$NNG}
A>I]H
5Gw6l__
3\^5_A
AK$B)
5KRD;
SJCp]
{ollV_2
E."F-
qJvly
c(w:5#33
-2%<C
y/=/!
Hj\("
YDKrT
-Ht-*
Crad
7Zf}C7-
2sY+F
M>w'N
4;24
ORddE
#&w0_
@J?h9
vR^R9SG
oYy_I
A*"DS
0f:F.
+S![Y[
%4tV&
/)^Tt
NJJ;(
,>h<:q3A
f>PG7
",J<T
]=&i
:>)kg
=#1Fd
h(}vM
A!0Q{
@pTcuW,%
pmeq`
g:R,|
~E>+a
5N^~n?BI
KA 1o
8:\Jp
8T}I<
'=P9U
8sC7[
V+||p
-;5GT~
0X[tD>
T.n W
MoWAxP":
$X`DR
884B=
lW(:;V-B
~O'"m
b7w%~
;v/=
5:xL<A|
e8]u]O
giNS-}V
iKAlP
Ku4@fZq
aH[thi
.Y~?e
2On[6/
mtXe&G_
9LZyx
K<pq=
2>.a^
;r@|n
Sgfj4
9j'cJ
fYzMY
m`?pM
Na!2T7A
QQoMhi
:Xeo=
n1@'g
#,Xq]
L:d9L
@<hI/
uImB%
:!WTK:(F
]wQGIU
36p6:>y
<S.~H
'-s43C
t*?e\
U}.)]
Yjd93
)H#YZgu
\jTAI
e)ui4
z:<#,
$W6T)5
D)c%Zn
W-aAhd'
ebd"`
uYw82
y0.^a\
L*y<W#
[K%6+
>V3sR
)Wt2W
/!3M_
k*+RG
I<("'
"/<w#
HK[,&
ko[-u
:Nu*+s
2HE=%lH5C
c#]&`
EndDialog
=_9x%
Wtp~X
XeM>
nZk'|
t:ED0Sc
26Oh$
'l6f
EGFv=W
gM(yz
27J2hA
TM1(>
IW'gh
CFcYR
qWIA}rkT
8)'jkl
#[12^T
wOpl4
|hB_C&3
$g8:d
c5ZRR=
],<vN
|D 7
M$n!?o/
:7?o
B-[M3
f &ID:
F/EOT
4mq<`
(T'le
wWh$o
-R5g5q$^&^
l"gq$L
k[hJ,
)C8.b
Dirfv
ebOoJR
N7Y h
sDFT-
p4B][
*h*^G
'I[j79
R[i<Z
133#|
7}_=i
X>RCk
EZ^\i
'2XU{v
~>J}[
AGQ^b|
!z8>sH
QCD(>
`$nKCz
M?8N=
XWSab<c
T84u7r
~#,uo
fJjc"
8_6qa
xb3u'd
CdAKR~*
USPK.
;!D,9+
j1.9A]
d[MS;4
%^$&"=Fwm
E}q%-
Z?c?3,
'Py%K
?;A>#
verifying installer: %d%%
.+q?z
@l4wFt
gRv9?
r K!rk
EhFX:
@-\> ww.
1h4K8
kBOh#
r:</U
Mk'1/
nPEQ3Me
[cl\$
bRkJQp]c
#OsZ'l
m*=d9
yBH>#
KrI}(8~
V0/bU
QNR,^$(
73,5I`_
\oisc
*=MeM
m'?iR
*h{Tl
nk$'5;x
'^}aCb
SHFileOperationW
Dy3[.
(M):_
{5*tK
Tkigy*
^<|yk
R=)nB
Ea6qP
fl8>&
;EyNS
6 :SA
!ksjk*s
gG[#a
._%of|
suv[Y3
iB`VX.
@6Fwip
Cjw;s@
G3-!4
IQ'vj=}7
4A52[
MLP k
ag7#\H
Jo2+px}
yfdNgh}
o4}Av
ZKU2z
&%{Zz
GetCommandLineW
[}o2<z
7\IE,)
'!;"00
2]q`iA86\
d\%vi
'NFXjH
1(<g9
K~j*L
}E9vXZq
DyP-V
+_b9A
y(y>Q
@6:z<
h:L.FZe)#[E
{xnh*
~/,\zz
>v3sqN
3E GX
$588h
spQyywZ
Gz4V[!
tWdC_
cmFV:i
{Rt<X
x Jf~
Q~Z#q;
`K#nr
;luIz
.,8 d[$f
rTucp
lt(xZB}
CreatePopupMenu
FileDescription
`1"fS
bi4j]
;r+m>7
ErYe!
N6v?2q
1D*Sl
\bf{M`;
$h33?
$Px*#
VMYHaG$
][?0l.
^)BO$
j'_FtYDk
{iC'K
$^bY&
YoIk{
S/MGs
@?|&T
mGe1!
U}wa34
IByNq
67u]>Jc
\<I.L
[v+6`
f\1KK}
11Ool
vJho9
3|zmE
Pr-"3
X+5HC
SetWindowLongW
-8+D
W|Mg"
F49U.
GetFileVersionInfoSizeW
L7kKf
E^H5^$
ldbEy
M ..Ko
]mnP/
6UeSL
`,8CG
"'hpZ
pcr22;
')*1o
P'%=<
{J/@
&hOWlq
*?|<>/":
@2.$j
r8~y,
x v(0
ZNV?0
|aYzDD>F/w/
rBu8'
A#Jit
QH;5=
-T40*
62XNW
zu!10
zD~Mz
iX@dF%
aDt)rB
$T)VS
o]{?j
=xdX2
p4 `2
GetSysColor
CharPrevW
y>\ja
o%pSKV
?+;L?
RN#A^
D a"|
hV~xI
ll,GtR
InitiateShutdownW
#e;[P
BOH*_
2/tC+:
2r?SE
:[.rD$
(R9\#Q
, '-c&
c~&;2
KT&fuh
K^k73
MxTr&"r
)-*{[
**[Rs
mO>z3F
@t$f1r
+!G\s
1=<hxJX+
X_\,Y
PA,qq
4!7s/
<~3qK
8p7^db
S]`34
(wl@N
Xg}gh
UYad)
239.<
1d"!'
")F@D
!L.NE~-
DE+A/
uhDw6u
SetFileAttributesW
+,egq
*$?~@
SetDlgItemTextW
JE1VX
F;'dc
>L'SM
jo(#x
eB<GK
h+~uGw
U7R,'
GetModuleHandleW
Qr0l8
7!Z'M
[<ET)h
_.9g{
2dR'l'}
-ZR.VJ
Rf\Hg
[enXY
* vr&E
Bf;^xR
:vz E%{
$u<:b
>0G<i
.]|j4
cp15^
a_LQ<c
>!V*764
vuiqPK|
VB8~(
!z~j?
5QOKP}
`1ezYu
p,H%*4
Up7s{
^ju6@
RCCNcU
!fzB6"
ir`iK+
n6t|y
gRN+9
20|0NG@
IDBD $DQ47
4#4O&i
?g?O>
S@Q:<
h>tv/
r3Z2,
{!-hR
X[fuA
:1Q]2?
#omq*
H9:sjJ
x'YgEL
_nwRAM
}*v"H&)
7kIdQt
1cB;h2
pv-1d
%E\1il
pt'1`
,}<|V
!:5<~35\
y v)Te
nr.p]
9#K'E^
y/t3Qk
CK.v-Z
\:(eSt
!cw};
My+z6}O
YUK^J#
IB!O[
tj"AT
?<oZQ
eM\yT
$96NmV
0$WkA
3LiP1
5bgsH
BkaGf
34rS9
"`T~R.
ypJ[-
e^O8e
O1rDQ
nva *
d*uSRu\Q
|Ep)v
gay0>t
` FH
[-t /
p\*Mj
M+}Qf%
cj@j]
K+|Q6
*@kkK
jkQ1&
y\-*u
_x1L?hQh|o
rg@Z\dl
TlAhZ
lstrcpynW
6aVxt
U-bl_
jtncEU
c9(Lj
g54;vb`
8~fF>
/]';[
/NItp
GetDlgItemTextW
u*g%+
r/t($C
lt?E=
E6s&E!w2oM
=$`x'
|%lKV
SuiA
{7T+_H
s*%h<
g!tJ5y
asL\}
75pNr
$,1<o
Gf0jv
m>3!hC-
xfA#p
w%wGX)
P34BR*b
MF,)*
pE/w?;
4<w~v
tWf="
%'*YOA{
h3N@o
aii`2JS
T~m>M
9|I&K
BO9+u
Nstb9]
\Jwh@y
1GC\G
J21;V
@h=dG
72rdL
])ZFw
niM48KWREBm
(C;1i
+~E&z/
@M.7^
Gw)wk
T[55/
^M!-F_/
MessageBoxIndirectW
l%~BO
e+aIw
B)*vY
TYyV&
o?vX<
v,}V$
YQ2;R
TA"kg
tPG(C
%M#_Lc
k9Z0#qn
More information at:
)1lf|
~WG}V
P1ztG
hk.STM
cSFd(
#/73]
5s{%W
i;CfY
DAQf8
ar9:A
.LNki
.(]EV
}6b5QA
PI,BC xX
_6Enb
ER>wB
lX{GN
=]=<q
&`W M
5beXM
%&wxT%1
yu?*BO
QlIaE@$
Zkk3H2
'`F-z
i8Px`
)~:%/-
rMCm2W
sK~?^
!|7qO
)qQT1c
VCkwh
//h/J
bc%Du
07c`i
!dKf?
U5QO[X
Q&qVH
M6U<4k
XsT_V
-tPeb
-h)kH
oV.~t
SetClipboardData
~s-#rL"
TGek$
I%%-<
JRQO2zN
XE(4m
tJ]<5
=Zg}
I"*kL#
/(bq9
P*/~o
Y2x=l#
P,%M~
G\|l?
CreateDirectoryW
$27Wl
km~_f
^5b$S
k%8UZ=_
k26 cG_$
'T<WB
U{K,jT
;=h"T
u=|]O
{2s_!kt^
sUama
R*|v'
{$s,!RF
yMrGn
xYQ8A
v@`>c
^t@5oC|
tsD.3
~7y!>
kBU6v!n
?{j+a
<E@+OE
h#2~R
;Veuy
DhyDA
%}<'N
h$`'W
v[F8>
2YN6?aR
37soLyQ%|
/_Bza
\h>tp=
E&`^v
YAHRqE
h-'ro
/,g<7
ls,+0
Instu_
8DHL`
U|^8"
l\Hkzw
~m|)'
y>Vu|i
W rGei
\xebz
=ss[up
/@LC9BPA&E
r[V2uK
G-H>y
8*;4A
?WL*?
;r*,D[
t_'g?
o0[!U
a^N4U7&R
K'{-z
/Yix83z
?"BEM
KPYMk
uRBTD-
`UQdGt
*7AG|
b X(z
bk2M]
F\bmV
{ 7' sC
0\KST
M h9n
#f;a/
xFOfJ
+85~n
8%)kLK
*[974
A<zlu
b &SW
6Hlp2yc
=!?\h
)[ndd
RsjVK
{\mTM
((G"&uL}
Nl~w*:
7mq+h
#3QZ)
vxyalM1H
O&'&C+
>~}7G
$'B+g
\9t2Q9R{
.8=yPW&
;>bX'
0amyQ*
t{Q-n
Js_|p
lj'Uz
.DEFAULT\Control Panel\International
+:,.:
d+Xq@`
E;Mcl
97(?86I
E:2!$
lstrlenW
}<@q^
_mm6<
ffX$??
wQlX}
';,X)
/dM0x
kvrWs6
6tq&3*
Comments
q{FHF
s4V}N
J?F@X
xsExvD.
o]WaeR2i
3VFZ@
Bj 9;
r;'.l
KJ:q.
\x];KKbV
okZIN
nCSV]
,?b>;C
Js?-^_H&
^mZSZl
qpqgM
!VZ|<
scENFH
LLR/%
9mLe4<
&C*Sw
SetErrorMode
4#!yx
/@(qj3
5lL<Zea
q^RG7
XQ%#?
viw*Ff
?kGat
_A>VS*
diZAe
,daLgX
iQR~~|
SHGetFolderPathW
'YOjo
X!uo/
9^k<"S
M~M!A
h0nwH
(0bxe
'zgiE=
pjxk>
73ifdH
b(Mr|
R|z@d
544S$
LV:<S
?>G=
VXc00
EZ{dZm
qZ5Ew
!C!yma
KiT*t|a^
Um4pA@
T<\h{
BAv_2
MvcaT]
HJ@x]
sOfH'
)8:C<A
le57E
-+zx:/
a+?@{
/[-c?
n?D$3.^
Bd7CX
v(yNP
dMTCH
w1 JY
9j(A4,
|M?"A
Fl|rT
M>[~^@n
KE:i0F@
-/EF5
kUn4-[
c>YNE
5aaT"
P_g%ppe
bxW$k
@t+v@
{*mRTz5
6NXq)
'<}sV
$CXuQ}
aQ^x*
jFMcW
-$yqS
8j]'L1
{D6Ium
#`Pr)
:R@F]
"_` `
VERSION
xNd>&
}@-}E
&`!vb
o&{@w
gSWs$
Cf? jK
(Be]m-
<VoY
a=7.wT>&
}zV0_o
^Y{Q3?
/Rj$ct
8ba5N=
mnP8w
tco|xi
|KWR;
Ic"VD
O_Y/H
@HH Z
1B yP
lP#OH
2007-2017 PortableApps.com, PortableApps.com Installer 3.5.1.0
9SMFm
9^#V{
36 v*
w;w4+
J@6.Ms(J
U6Z52
TA?7c
installer's author to obtain a new copy.
89CFf
#v{r7
Wp{-f
WqZ(R
I:msF
?px3 {
ow/'+
Ti]V<n
ADVAPI32.dll
C:A#W
xb]yz
q_)aM
<m`=*
zX>\Di
4exy)T
a;v2c
,&{(&
;n%q/
A@0{Z
U;9,q
Yis69
>t(*q
_tc%'
UQB6A
^83R?'p{
/3AdH
Ka>`C
9}BQ$D
k^3cK%H
K/YAR
8!YHU
W)jw|
j^Cq<8/']
g}WMZ
<0jpy[
LvqS$\
) 46.)
<,Ej_
|88~w
T][vw
pN!eH
Eq(JPl
T=<(=q8
E6zi:&vCj5
1SD(~RWn)
` iy:cg
h/>&*
u?z_Z
CvbS\A
90u'AAf
?93do
Sz4> v
*;RQW3 <
{{/)-X
\4&>+
%AY#`v
;7"KVAx)+
fO!>)9
M~+:+~
CHLhp
FdK|?U6
F7U"D*9
9olj
lW]<wo#E
Pw(g&d
g8$j6
z\`fg
DgHL8
eB.V+
Xa%"0
$e'hhv
sP,YUt
{265J'
B_!_^w
40bT\
c czP
A6{,r
z[QZc
VACB
t8(}d
<A)7D
[wy@a
1NIg+
:n7R'f
z]Es#*q
dakU`
T]9M~
id-Vg
D$,+D$$P
*] |A
T"lEL
QF2J>
a R+Kf
1]lBK/`
q*4w3DP#
EtlF,
CQAyN
b[R2?
8i+N$
.T-(1
!'/F{@
G_M&[
Yo9H-&Y
((L0,/d
SHGetPathFromIDListW
VPPcl
w/Xxo
'|)60
S]bPz
.;tQtf
iKFGC
H*S?(
ew5cT+
`:xFd
zAaKt
gNa*D
.*<^g
J>s?=
3}0a-
Y4nA
:QpD>
[(hLZVKn-
+#i)n
dZWg9
UbWNI
knhU6
<,SU`
*s2AD}
U%X9\
&L|b|
tP0(4
S['a7
t8=Hm
+Lq_2m
.-@.R
(H9x3
Loo\^
~O? +;K
;IgEB
%e8j.
aesmX
[1CZl
lstrcmpiW
=9>a2
~t0Vp
|}*Pu
8i|;&x
ADVAPI32
2u=al
k*olD,
>~IiV
0CYi?
b3pnVf
9-(WB
LegalTrademarks
rgXys
%>Q[Uh
y@['J
a~D<y
D=,'7:e
SHAutoComplete
W,#y1
X?9qX
h:pxC
OX39{
7Gp,{
c'!G]7
Q\'+c
'd#,'
[_%7E
FFC;]
&9Z<c
QKm,y
ReadFile
T|7Fu
RegQueryValueExW
&<y$za
/ar]'7.
N! g$C
+lk+nI
~1vUp
e1JcE
DrawTextW
Y;wnD
&YNpc9Y
rdVL^
z13F/6
,@/uj
01>;3
&hjrB
nlKw!
(Nj9
hl\M[
<%tea
1f`{@
O/bSy
Mlvkh:
aBL\R
BRA2?
9.VThJ
:;coAD
=z7S?
[pNk}
|/KMb<"
J!@!sZ
GlobalAlloc
PROPSYS
E[PsO
c/a&#
$W6pu
+,NB2
Gb@-"
IsOo7
82+3])
e*i}1
S8h/S
]Ah_:-
!NjUX
w7}S5
IK2j
p%!G{
]Me;D
isM#%
2!?&L
enWeA
o6UtE
Error writing temporary file. Make sure your temp folder is valid.
xx'0+
el":4
gk6o[
Di=<-
<\-XHZb
Y..5dK
W(YwNc
&44a[
K`'i.
56d\ M
>/zBl
VSX\il
B%cbN
b5em6
^cbzh
s5R8>
>m;,Ymi
ayQ~Q_@
^=sst
Qsr?c
LE+*=F
W&mx{H
(d-Nf
6axR/mk
*aAGE
>vZ]@
qiXh(
@|BSe
sGqhw
nzQZ;
geM m
>\U\f
/lDPOK
w^ZH=b#^"
Hs&B-
iK<;UlB
}@\Y)R 1
wo<S
]`Sjg
JNh+O2
gU#pj
ZV!z^
c ,'#
;s*G?:
lstrcpyW
I!fC=
LGt]n!
`q\d~L
xd!YU
-Di/N
JK7vFU
[M*y>
#/'S_
7hiuU
?2<H#
izIA'
y!>Y]
HpiQ2b
U5VC(
2)Q?v;
fyZ&a
Y:|<O
OW}[U
b!^C^0L
s4gk.
`~x"]i
T-&8s
?L[@V
P7D}
:4MkB
'Po>Rr[bz
30<\(
~XcV=q
]}a/c
jatb!ko
Wid]L
n&:%!@
x04A4;,
xP&R(a
Sl{$S
sE_'l
.nwq3,
o6M}8)NV
>(l68
r*ddfT%
s`(E0"
2S|oa
?+<+T
cJ^=&
tF<CZK$
/0k+Bh/;
a&f'iI
P`6g,
SetWindowTextW
|v{wW
ICUJD.L
L7C&lk
{'E9<
T$`\od
%]cn{b:
'+yW&1
_u,g)
HO@DFFDD'!"
1R"pO
pr!i"
IzT G
:BPl8
QXkB8
% 7FN
EnableMenuItem
VP~W[*
dp!Gp|
MuJ<X
3S`6nx
<~'?z
K)Jaf
(DY.:
lAKm)
Evk!,
#4i-Qj4{R
n[P[5J:
c06-BrK
ole32.dll
9K 8Z
ow:&e
D%\54
$/I*@
&{?]T
=n8z_
'C6=,
>H{$4
7FYt.P
gGs)qY
4EWKS
4nYK&
Z+M`o
{U [c5
9:L.j
b#1iCN
61x_ZdD
`ZN$))
GlobalUnlock
*clV:
QY_x2
c1.m[
iM9*DP`
g@FGiV
>Cb"{D
@d@OlJ
DfT_/
vw`p`]
q\v'+
$=n\b0
!%r@C6
483`kby
SGIJ+
6B+Oi
a!?#ECv
YqrID
DX2747
F=FS[
0'ke)
8/-#J2
/#yRS
N2WUIBIikK.28
v@J^%8'
5d' N7"_
%qsO$
6&;Ywx#[O
xqDDl
Z\rMM!%
cxLg&~
L2DI04
l1+vA
`Qr![
tI?3fm(B
uc`Px
'{DK0
F;BW)-
%k}1f
xSW}B
BS fmN
Hwuj(
mpJ[N
l-JYE
m)O:P
n$CW,
2NKzk
LJ'VqWe
2:6QyVn
v({L$
3;<0A
<HN3b>
i'gl`
csD{^4
C~7G?
gYNh32Wj
m0VJE
B#J[5O
'\o'y<
5p+5{V
y(bkI
:}LPc|
wVJo;
53jof
"J|@t
QOeZ30
q}fYf_0
B=#$@9
:Ex/-
SPywSq
~.ZiR
D]u5B$
2DjqB
f9{]\z
dlB;U
(=A(s
+0 bx
Kad:w
uY!mN%
"o]8'@;
/@&y;X
1U:kr
KERNEL32.dll
lL8k{
kJ+}p
hF2?e
^bl)y
9v|/{9
!hni`a
&P~oC
PhDT@
^@)3;
ZlQ2K
kZt$x
GZpVW
)$XEw
7`wEj
2u~ q
/{YWU}i
@[Xq$?
{ ix\'pK
eXC)#
Ylk*nD
2*;gTn
G7KEi1
G4P3,
j(M-[
{I+y\
5h "10uD
mXH*r6mT
]KI'*
tV~id#
C=1V;6+
4\x$N2
DO$NH
t_:K0
Lq.mu
w[e9vL
Xc]x>
`mP9S
asr@b
g!@EQ
2RQ{S
iw Iy
F8~IZ`
];c_Y
*9_@\wh
Rw'fy
u4!+e
?hYIT/
f0Ly&
dbX<nb
q+P<6f
Vj%SSS
@j-/o
sz#u^M
}/bb`Nr
D8ucK
m`!UH!
8NKZq
SendMessageW
G>G}c
7b)P-
$rLW&
QlBm)
SVWj _3
I}mD>
!^{8~
krJO(
*T%C-
ty]xz
4S:(s
)#|Tsc
I{o#v7O
Q9kvg
x_Sy=
x-(:t
e`Hd|
=+paw
V")aZ
@mE\z
fso`H
TD'ty
FiBj@\
IsWindowEnabled
4&+/C
m@iGf
m^"yw
EIN5w
fD"UO
>KBW)
;1IyT
rp5j_?
7&2|
,^^>8~?C
&ftwC
u^Zv,
Zn*Z%
)7X17q
57IM2
:3.7U
Ve:$>
ki ZRJ
p1&!M
le_-je
R_9gJp
]%\Nu
g7 ~z
0HYVgk`d
1-GNF
_F%tZ
Y/E_~
EzZ}-
nw?D{
mAUVx
ADjv"-)Wo
72!S0
FileVersion
i@q6-2
kR;9{b
z+";{
kf[$W
ss,2I
b+Q&-
~.'ed
TcqqC
85c3CC
QNSfef
3*cbR1
FhDC
c@G0Ln9'
0=UiK1C=
xqsO<\
QNw,*
r{/'e
P (yj
Mn 87
e'8Pm\
>ZhS,
~?x*7
Ou~)(
"Mr]9LZ\
wF:IN
CG}eG9
_/eG=
D$$+D$
_7GA9
!_jL7
ZS'^|
$c}^~
9TW99k
:ii,H
#3H;?
YOv2d{
zuFCV
ph{BgA
9?%s{
c-Qd=
B]_Gb(dix0
/$d6b
CheckDlgButton
1-RZ
h$i4/
9nM603CIf9
'U[i9:
DeleteFileW
)^*ZS
:NRDQ
a$dq-A
kH\#y
tXui_
T8q]&t
.(lV$n~};
KfFmM
G*>'a
AaQpD
InvalidateRect
SQVPW
YngQu*
N1^[G
_Uw\N
h3+qs
:~y]$
9$<#E_N Q1#
:~q3y
3.5.1.0
g>D-]![
ep_RP'
xc7J^
5WJ"9
~sgj;
yP2Jo
P9a{
-LlK0
5TK^s|r
%LmKL
@alxG
OIPGv
jHjZW
x^ksk
JYspE
53:ld'
o)2[T
]P7t9
YPN6Y
y%x&<
m;Zf6[
GetDC
`^oan
Ri}-B
i2%g(Ov
B(SQ!Z^$
K@fam
ata`;7^
;8*wEZ
HcXvD>
Bn[yh
?;9Lh
FindClose
u)4Rv'
snp>1
SOcv#
{LP\G
MulDiv
@A\^A
2cXo#
MLt87
0P^t*
wt{j;
nbaeT:
J6Q*P
GmeBe2
o4M1>
&L8~6
RegCreateKeyExW
|p"6hp
H-S#B>[
Gd3ECbQ
v>J|k
*h5N2r
M:NK;
V]DWq
: S[3Av
XREZu>
Q{(}u
SETUPAPI
-'xQFb
vSH@al6
vpw/}
Rsx*}`n
kkYd1Y:
XYY Ptr
,QKA-w
OA]]5w
9<?b"a
Ya9M+x$
7^cH:
HuZ'uvEv\
dX"X*h
H`_F=
=7+1JD7cRL@
WwtC'
"d2$Un
x7*#"
<sf/c
5yAh@e
t66Pvpt5
eNN]X
_Hi)$
5r_h%
CoTaskMemFree
!jur[P
!$B_2
~"<HW.
}~'\E
.F2aL
^)>fe2
`qz v
iL-7p
MZ71%
%B&v"
apY;4r
iO[YW
Pu!:
KY,F"
GetShortPathNameW
$}c?,
&<P'}T3
@Af]WY
c8P3=
-`nBY
+QRE8
+!ECfv
SLz5w
,g5>G+
{cbv>Cx
%4Uxr
|GoO*
7 |*H
bo9hu
>objL
=x? -C
a!7jq
hB0.-
>R;N)
TCf<(
Hbu?]%y
LbIjn
cAukW
2rw3m}""
*SO/9~
7NBcb
/6,b5
W[CTW~
QQV})
;2`bG
-z,=8
qN[Zrh
0=rW7
fjWR///
APPHELP
746!%%A
}K(w/
SVWj"
<G=UK
b0}(u_v
.G`a+h
CreateFontIndirectW
g(;)>
z!p/L=
u6xGI
ujBW6
$9j?!
CEe3kl
FO"tB
LoadImageW
Dp_gF
.ZS* }[
l1N#(
a6:D.
SwrAZ
'`{]A
Az,5*
58|Z"
@h|#|
t5:*|
|f2BJ%D
%%&GW
`P q"
UGrg}
CTB2o
dKSYt
H2M+sMo
d)Bcy)
6=Im>
P{*53b
c.}Os
V__t'
PyjbC,
&{tHK
sZch6
o*^%%
-E17}
Dpem-xy
OIt:g
Vvwba
3[czQ3[
ScreenToClient
CwbgJ
I>}o%Gq'
k3H=@zp
~3ae*
iG14U
Y&dW+
?(u0n
%qkX6}s
%s%S.dll
,<0W2
mvf>$
/BjAg
%Lz3L
"6;A.
KIf6c
CWVWin|
FCK{YY~
xT9^Q
4WBdy
`_=D:
hFu0A5g"
2|x,\
E$5k`M
62\{OJ
ProductVersion
bJJe
9TS$"
:wyc'
H:_Mkz*
+`_xM7A
b|V=k|
+ROBGQ
FPk'S
+-]q8<t
y,q^7
;VV~I^
qe#R%
RichEdit
nf^l%/
ZyTGXo
<]};"lt
xWfq~A
`;}b"?
3[}Z1
wU[#PJH& ^
gh6_4
_*sZHJ3
g!'xx
+tUs*z
GkcPUU
5&9D-
Y0-u8
=v$\x!
!l|]R~!
Eaafrp(4|
S unT
Z(P, oI
BP3D:
Nv?T9p[
#k3Pg
Y_qS<Ke
%&#d5M
tnyU6E
A`X,1
?+ rX
<^#O2
x"&'C
vX95H
$vY-=
@g 58
2e`W!$
:Y^lw
L:,_&
K4XH+
5F!/
]u$Me
G0r[X
7Np6*~
'.%z*}V
Sw}"R%F\
T~T2/
#my\Y
APr{S+
-p4wVP&T
4WQ$2
0kx:r
kT@=L
5$:S7
`v?Y`
!xkrV
]v q7
:L23#
p)3-A
UH}0/
kX[0J
[r0s8
(d)a
@eOb"
s4R-T
0gMnE
bj8+[
$Mfna
ZiEJ0E
*_/y?
fPG8}
<s,$9
r\U1t
,8z+5
C>UOg
4m~>gtq
G6Swe
6u^C|
,~KK9rX
\JW>GBo
(c$A4
*Ujrj
pU3Ok
O@ntBz.
VAkde
&/<B8
wzsqa
6*+"!<
GGJEK
\mEOc
S#9Lr
VE8Z*
mAuIo
`.rdata
8mdB}
b9i?/
zcke?'
Y{XN5
RegCloseKey
1m5O@
C>5G\
{ioYfU
%GvB'
5)P4H
Ig2(br=
:@6-/c$
i^e9TCDo
lv"b&
Dr`3(<
.4x[s5
mD(6W
?U%Sf
/.Ka6
Ynvx^7
\:SMb
5VqXZ
m[aYW;dr9
i~d<n\
=5UGT
`$ecfq1
[;f}"J
.mk#<
gdeE:
8pVbK
V~ZjW
7KeLp
yYsw6
a<h({y%y2
1,WG!
8hEZi
PF5u[
!Qw`
EK0K2
WritePrivateProfileStringW
[I#(mxZ
&-#VO
/17S:
;V7r(O
O!O;p(_
euzFMga
gneot
{^e]
8E"T2Qe
(E.'48.#%3W
UXI~cs
3/uh]
ERYouy
<}mt.4
AwQo:
J{AIJ
Qz\7V
Yft&`v@`
lnQF/
\>bM8
PUo&|
$Kr0|k
gpQI\yO_
~L\_w
}=nc\
aq4j"K`
SetDefaultDllDirectories
L5.H-:
Tf9fK
T;Yr E
BR[sv
lz=6o|5
<QzWV
B?I;@;0
{dII[
2LE}z
cgwAL]
22Il*+X
SaHAT
%ls=%ls
aLLy?
$Tr2O
R(]Dkup
c`O_@
f{x^`D
:P7Q'@m
a@/qP/
i]3us
d|~O%
1/pzVu
SysListView32
?WJr7y
lxR]jH
i90<e
,7,&K
mH. s
k=ql9
XUQ_sB}E
<3,Bl
5q|+7g#it
4&D.87bfyFo
ZxHm/
]2](L
Y9`;4
@g,<t
A"m=z
D_K`j;
irV*z
v6$#V
P %Jv
HMYOi
.C]o!
5nhYrH
`5<5|Q
`$/lhib4
!?Zy+2
8@kK"
WCOp
/<Kr:z;
Evv#[
l+K#=
"|KV0f
/a]~y
HWi{$
[q|aK
OvFE:
"H=^Rn
wNoPBfU^Wx7
unpacking data: %d%%
'3V
4-y.<-
R4QX}r
QO@K{
BsG<rK
FrI[c
8W_hT
9<+dUDk68Se
_{A|,
18DTJ=
sR:e>
x8; zc
9]fH{
L7i^Ecl/
FM}V"~
O]`@dE
Bk=Su
w=3Z'
LAceq
=8C7H
9h;[s
KtHsB
tB0b6
J1bXc
MoveFileExW
~ncKn
9.uwb
9Tb\ER
[]d]`#
,2Tx8w
b~v7P
#s:v6
m(m`~
^NWcs
nEN9l
9<CRY
lN43W
g{#{[K
TQDL6z
G2-M:2
V7tz$
W`RTp-
Z]iT?
1T1{&
(68zl
[E20&
JB@y@
&GMT7
]k;6V[lrB
>b8q|&
i<&=h:
V9x"vh1
9H`5)=
'+K`y
<u|4&&>^
_Wa8C/
3D.=hw
+aSW;
NullsoftInst
-v2Bl
o<,^|
t$,VW
dx;"y:i.
>j;EH
RMMRIB6
$Sw.^
kh&~=
2}:RM
2flQvq
Ve~^;8
s&=Wp
+Kxt2
D0q-E/W
y>!w&
R[_V2
_`30h
XFTsG
-!8_L
+ fi9
eI6k:L
F4pS&
&*^AK
c}]~)
+`p[B
[|Yi-}
]imKa]2O8%y
g{ADO3vF
qVX?+
C9].K
+D%hL
'C$-Vj
e}w~J
D.P jsAe
&tS0M
msp|>
Jy!@(
9&?}9
u[zK'v
pEhXo
K?.X_.J
{wBHe
4KJ^[
w{\z(
6_J4'
,Z,dl
ES`b(
Hl|NxY
"<_V1
g0Q;W
K|Xto
278{qV
<VPXT
M^i#P
E}q:Q*
'{aOhMY
)P:DZq
5F.9h]
AF@q}
WWE3_C
O),u/
mC`pV
KcK\$
@I`T#q`
Z=^;*w
{]R'p~1
!]5dWFa
3o>\\,
K{+ZaI
!qxcx
Ed`!z
8't1OxN
_!>Hq
&pwJK
,4[_]b
>6@]f
_ZAIP
=&qA#F
Q\fj/
gYzO<5*
gx7+JG0
>M{5K
8UNY/
rRjJB
oXR`c
)4TYi
tK.|3"G
zN#%-
}~SM}
"PzHan@
"D$M&L
ZQ?<@]>
i5nr;
{$;xvSW
A(]:H
Wm*0@i
[|MA?
'kL9VO
Ps!x
,LC$g
~e-}R}
#76H`
Jtw`f
U""PgV
^ lz
2n{eU
a]Dy4
rLW;%
2rif+,
*~lS,l!
N:s~N
tcsgx?
a$2f3Su
qc .>
r?!QB
|hUkp8B
]i;MH
{rcK)I
JI}"3
WNys$Jm
5z.m&
CHHwE
A.,$-
M;Gsw
13nL05n
u$5Wl
{c? G
C`[p'
qBgN"LD
))ay v
(S'w.
4J=W0
@\^km
{i%981
]mS%aR
qU$_B
XC?lZ
6,9Q;
"v4WZ
&;[><
a>iAdL
0;M%*!>
TxqI.&
FAkz}
q4nS)O
(5|3p`
.$Sb
8'> +
HksmE|
xfRQQb|
E_!:Y0bm
ox8{;
OriginalFilename
5On6C
')Yj?
COuU[
xYgy8
${\{Yr]'
O,=rU
F7i1c?
Mq11.`E
7)`]>
l)NKh
X8PpvR
V>_,,EU
C**V&
N<Lx#
hz`!2
<0I~H
"}]6t
>fQIJ*
BD|LRS
c*0o&scQ
JVw 0
{J7-4
\{{S+[
j]JBm
GR<s3
wLo]P~f
)1oBG
'R|@T
[9C(:
"iqE/
9XoP(\A
xgB~9./
jg}!^
C}6R0
,{W8f
"Y;tT
w^}CB>
SO6Bq!
[9e+v
ZTntCt
N=aXZ
<:;t54]
z94}7
|y$^Pj
;| b{
j4yDk
Q.Mb
P68,=
ZgX*q
V6Lg8|q
^p'Vi
(ajQv
TU]USQY
@Q:pSR
CharNextW
_:tqh
@[y]M
QwhJz
0lf`8
zuL,#)
:7EkG
D#E@s;
!9V"_
l.w)B
$"fX(=jF
OvyTi
P{nlmP
+jzpS
k2RmA
U ,S
SetWindowPos
d?,jk
51|N;
}{W:V
G'c1&
(W)ny02
^y\KA
KbrDM
FWTYd
h *s#
A>Qcb
C2"H$
$Fuyx
o?71P^`
+;evr
n-l$
(sJy68
Ws%1K
|e|/]*
MS8udZV
`RiMC"
OL(+:
|<5h)
eq8D!(
@_^[]
W2mW{
'F4>"
0!hK+
S]Mn8
.Inei@
'jQRp
2f'i~
C.$@!
M<S~RMX
_S-_KtN
hEI/<T
(*^cCCk
O7<0b
chDwLG
mv,2w
0^4&l
rPY)^brO|
XN,H`zD
"k{%!
?PP<*
Z9`G6
YzyFU0aR
Xd8x7
W/n7a4
g&v&nl&G
h M}HE8y
Io[b)J
;x6vX#
<LGO$
vs)nt
<bF%>,
MW<LD
$ 6@`
{A"MW
5sHmM
Do`'
/jf}6
xvW,iW
MorQ}-
C^mhbz~G
em3K!
PKC")u
-RmjE
<eBXT
1rH_9
-?nA:
Li1JStr
p^_A
^EiBc(5
}(O+Cy
Jvn\:
~o2OF
abbab]\
&+&]a
7(p;/
`w@3o
FBH/u
[ygC9
iPWm>1
9O7l:))
=>Y;$
:y%J^
GetWindowRect
2[<W{
3e32q
X38/K
c=-i;T
z8B:l
YNOquM
^(I;}
r=q\a
_`hHg
8i#"46x
(I(TQ
MD;u"
,/KPip
U#w+O]
k&E~y
RGtnR
n0oGc1
q-^N-
rI89vy)
@zVI$
8k6Y+Vw~^
|foW"p|
Udd[Ql)<
2c{:g]
F<P/E
j [f;
'tqzQ
*13g5
4rwAJc`IM
/;T*,F
h1@o^)L
CN{1c
>IKOo
\|SS~'
X%e ds]
._n#!1
Wy:"l
fWn@Y
8>t`NP
?3L'+
tV9K-
&D1rR$
.}HKz5e
m'QQhF
uB@/h>
GHXdO9
e!MAP2r
y,5K]T
O|wA4
<l%8?%
?&)-F
P+5Je.9
d#?.i
!Jb*\/
<0?s~YE
$9XuT
\O[^_9
&8xS?
v?%=R
^'Z|lk
A&sB>
8$_^\
\5#xY:
a?&}`
N16Ga
GDR70
e5@B},
&FDtc
_ r]l
WzI9M]I
{Nliw
X+e"$D,
;Y}_G5
7qp$HN
~|ef5
LMw{$
L\whFKt
xrh7U
/n1P`
'o7V)
p.CB[
YL*LbS
N@<h=
EPiLT:
kg4VK
oO#MD
R";0];Y!>8
bmU*c
dj359AGVWd
t+zBr
OEL\<}
T*SrkZ
nK m!
Sz~8q
I94g?T
=3uPx
w`SfA4
^|D.Ne7
96GRp
ru:cJ8
Y~0t|c
n\,r*x
xzA+~
ls[D@
ru4[W
T?#*H
@m8Q,
Hff3w
sr5}y
9o$dU
X-a;GE4
MV7m0
+|kKR
XV68mB
?~FsA
{Szlj
+bcJU
xJE-r
BQQj#yp;r
^1`Io
#^[Q.
}|)`Eo
1R[uv
6nh[15
PXU,5
#=o%H
A2*%m
hE5"8lV
Vr,8i5yJ
`ukl7
uAE`4e(
=I[m-X
)7NXu
SystemParametersInfoW
},k#@
*>B&K
I4Vya
|;$P#
ADej?
w!khh
'34_r
SF=`c
Dh5{/
~d<]s
uDWWh
oy<,v
^"N_{5Owr
RFC{@
}#,e
wXQN.
i223-
s=a#&
SyVGBt
HDGPC<&
EpY;l
am8WXM
#~**5
t^!$c
7r`Qv
0BM_
[]|,d
5S[k_
Bq8,5
;^e)^a
j"WxD
;EW;2
c{hdt
x[>.'m4
s;*b$
}Eu?ru
oa)X
{)q%z@
}+RLh
@ ah"5
SearchPathW
H^<Zw
X8#<J
AFgKGBur
UN`Y*
8{u9k^
GetTickCount
`*\mR
z6|[pw
|C`w<
kQE&]
o.B?B$
OAJDP
$:){M
(G6<l
BQ}H[
X}dU'z
2TekC
vbKk,
Q-&i^l
l1!MQ
i\:%PYx
f[#PQN
9TVD|V
wdej!
ci9.a
U@^YL=dw(9
4$xorqN
L)*x{N
<VrT]
MultiByteToWideChar
KuV%x
h*5WKH
tf8ri
o>/eqG
9crpwb}]
7E-@X
2!_n$
4ocOY)
]+Th3
{23XX(
4/"]7
&' iFn
]y.HT;<
nnweJ
?<RSD
i>6A*
{Q_nfr]
mXC!>
+k5zL
9 v??!
/BG5$
O)kACKY
%3/QU
n:tyW3
XRB+PZ[J
YmM&Q.t
;:D)"Y7[
KP26i1
CT.hCW
4wLCf
`^^^sS
CreateProcessW
g_@fJ
&n~xW
dDG=_
_k4ma
2=DOe
'mTB>
... %d%%
!0 /u
g)gh@
9uVD_
t^Y:C
3:CrE-
p|{l?y
+GbO[
+"4K:<kny
,<(l/
jN$g`
Tx_gy&(
*UH5e
UUUUW
oD:Y,F
^xAS/
H+V%(s*
Pd8:L
)|^.O
TrackPopupMenu
d?]ld=
>EXR3
F"C?N
rsAa`
iI7Tn
4$&&P
lstrlenA
w;C/8
PP'=I4
}n%6P
#H|V)
^E _S
q!7X*1
/z"5n
$"aBx
_)]r\
7$z};
]*gUK
.tdP5z
=3)+R
B(8> '
!=cW)
0NDqx
l\l<a
hxG(q
l^VE;]6Ih"
j~;T7
zDTp^-?
p]Dm6M
GmN/B
#PQp*
g)[Q-ChU
gsG;1P
J'C&J
vYG ^cN\
jE1}v
3paZe
{Pn{>
Sleep
<8nqM
L98M:']
[rtZV
~]656B
$;F_E
7a_?x
N1VnFc
{lpF,CZ
GlobalFree
7w0!oQ
tBLJ>
&A7YZ
GetDiskFreeSpaceExW
C/XI-
ax]@`
= L J
^D|+-
s495l
*^/F+
'J-epE
RegOpenKeyExW
sD"):
/wtm&
)CDSZ
je4QU$
qxSIK
I+u<J
.Q4Ru
R!e5m
r:6%m
6:zhi+
Fdoyj
;.A-+H
dglOFxKs=
B.QnB
\*JO7P
t7%\m
iJWnTM
jKWFI$x
hiD{%
t:!7H
f^Ub2j
M~riC
g^-Kp
j2,g#
b+OKW
p[?ma
)LW4S
k7Jwo
ejE",+
4"DxP
6Qo6Tp}
6@m~xh
0sxL|
WE{3U
]&QwY,
4()E10N
V<Q$W
Je!ae
VbJMa
6]@|uG4
'N^B:
;+nDF
S"mG&SS
NulluM
p\D'6
Hi5*w>
f<rDCN5;/QF
i,FBcA
AppendMenuW
W5lgM
#{87D
,9rSYO/
D8>c"?W
Oss{F
LZt_[
E?!H~
gXfYH
Zy3Wz
e%y*
G^lp_
kFH>L
t&]ALQ]-9{
^m`b[
]ywu&
>"skg
CornD
0NOUr,
;E?|v
QJk[p7
]buxyubO
LjI`"]
xb4mG
Dx;TE
v0zjq
/|FrU1z
O*9"P%
nP.aF
nA?ZuE
.r5|E
o=>(p
NH=!$&`DQS
.[&~DD_S~z
6_:we
n+<VJ
a=2U*
j82~(
GetClientRect
+rWpw{bT
}{Q7t
`!6K<y
N)DH_D3
9kB{2=K|e
S/Ha2. :
pM2E7
ynMDYu
GF`gp
nI@k5
~hxX`
S&M7wd
YZy&KY)
9Im\9S
oVt*E
ImageList_Destroy
,/}NE
f=d@ V
$,h#
&0ui`O
/-)O~EkI
a[g~o
:fbnD
`[c3M
R{{_H
sf5TsAvD
G%QC#
hNjav
b>q=vA
$gJ$%
4J+GI8
/^?Z`N
83('[TH
99x&~
ExitWindowsEx
DT-[m
}HDQQ
Q~|M*9
Ywu%3
wk9?B
du?gX
/ih^s
<=N&P
(tJ<U
V&'i{w
7nM?'
O?Ig$ZW
sTzvc"
e&h1D
-|}]-
VhlO)
%~SmbT
mW?>y
\p8_b8
~\w3p
VRo<'+
d%g0t
Z7XZh
ENR3C7
Z$![
Bew|c
LcMz,h6_Z
m>1fO
'x]]5
/})3mY
%#T)p>
XKc{;(b
d_>6=
QEOQn.~
LU7M;RW
'e->3@
D&U~I
{8h6\5
:aE$1c
{M"?G
cR,}YM
`\%K<
k1c]X
GetFileSize
8&~)lK
f)8X^
|:}o\
Pe'UF
Xh_+*#[
c.(uS
H-W;8
NTf?W
i\i.xLe
xNiit
8%'2b
khC*!
|>JeB
r(t'PN
Mo8|V8*
j<Z&l
>CgDB
M1B{Omz
lSY8 V
5"dox
7A'fHT5f
!]]p8
?4@rq:
P]R;8^
Rr]l9
gG#O,#
PX\C+
[!l$E
TKK]EtX
<p?{q
(fKbW
1;f!1Pf
5u:.w7
GetVersion
"*7<Y]
C56*V
,vT$sD
2UOAn
W1l2"T
AeV4N[
e4'cm
g76j4>3I
y?@P|
&*TgM
u8k|gO?
c#{$:$
HK67;Oy;
}W$Y#
@.Wb+
LoadCursorW
|bF6L
fhRn20
8WBPk
Wh"lm
]=8^mm
S+jO1
YkW5H
Pv&oB\
CCUN<
q!nTE
H*.}q
:Mdc$
jepk$/D
rj"7M
o[#^CQ
)N?TQ
:8GSy
KrwUH
uTHDc
REBSD
&v,fu
7Hrhls
StringFileInfo
22J v.
oyp;Q
&Gqcv
SHBrowseForFolderW
k%E/=|
%V?Gc
-PB_e
..k#.ch
i2Mh&C
)h#;*!T
"75Ll
IGRwkt4
yX!wF
nju~M
%|XZK
.n=~'}%a_
,.;a#
]KZu(HJB
:'M[f
BrIeB
U1c>C
d uA&
Lzj/Zpw
k9t:-
Pf[1-
8cDy(
V}:>v
}`09r>e6
()c1K)
n+gsnm
puCdZ
{vX=U
&Zt,1;)
tF-F&1
V9Kn2
N^}1`
.oq["
oQsRX
pB*Kw
wy*hj-Y
.Q2o)
X3|Y0m
+KU2}
S,HM<
i"7l4h
QOiN0
gi*>Wb)
18nna
Ciu6S4F^
G&`uy
N8jO(
dl>gv\
D-'X3
#B$Wh"w
T^Lde^$
;7'Js;?
a6X)$
?-/MKa
8s<b]m"t
N/y4y
jU\:
NY<.
;u %L
B5Ty"
Y.SYB
m;BgH
"jQ#$C
24v`_
2^-"5E
[XL!sN
(Fb4.
&kgyC
os\Ir(
S?vZ]
.4"4!
-:eyd
URB)B
@<|zp
%XXRr
softuV
%)ifk
s8r5x{
bQt&#
026Z4hS
gK}7v
20n2EB|6"
]jdB>
(_R3!
?~'R>K
IW=Ep
P: e_
6Tl^{FA
SetClassLongW
&i{/D
`Y?uPd
7;5l\
g+~M6q
2sL!@5
B%KCA+g
MN9`d
~WW,i*K
lstrcmpW
RichEd32
OleInitialize
*f~Yzln
)Iv]r
SQw|,
~4D0p
c:z:4|K
!h05W
J!k$d
:r_AG
M=bb0{
6y5zl)
K^zs/
?03jOo
,x?PC
VtY/X/
LGGNMKg
S[P`C
TBN=F&
XEdH&
].f$\4c
GetSystemDirectoryW
c;2W\
>PCY7C
1xZiO
PW#jj
dqT8u8
]F,0D
`Uoa0
G'Ksj
Or_`B
dNwi8#
HK6dGL
EXasi
PostQuitMessage
{Qj$?3
2Em'Ed
yrfrXls
br3c'k
*C.X9
'WGm0
TW)cm
(dh@s^
nkyZ+
#TE @
l<Ik(8
6q@AP
lAebxS
4"SwLc
Y.;\I
fM.T!
o:.9\
MWUgi!
>x5tB
TZ{-M
_7p)|
R4[sM
Gf"3+g
Jt&Q2
W{n]%C
H>rX@'[
N,dY?,
g7(;jN
=;S[N@
!k~-VH+
APiYC
6:$fE
}{I1g
]zJx[&
PDMZA
w/yrg
q0~"YWH
)7_t{t([
Dy(H#M
m,i]&c
AUauQ
GetProcAddress
qu%6.
ta(bmzKB
0&DiYlB
ProductName
;4F?>@6.,
#Z? g
f|.if:'
/sNx,u
9M.bZ2
ELVOd
:ho(~
z[sfJ
OkVmV:
tzG0W|
S+[dU
bv>D9
Li2hn
SetFileSecurityW
vKP6=4
0d)T|
)yt=`
3dMos
en"h)
\}AP?
*nl`R
qWo|d6
_}VN-
EIDV
#F=r%
svUw]
E>-njqa
;|OlM
-}O"G
; oG.M
%6A!s0
i#(J*
s%@Gj
v"=6;_X
: N*g
BT(7MsYk2
~'ra~
tB`?m'
2Fu/6
9:B\1Z2rS+
li'zE|[
"^DKk
,31w)
*7E5x
@j)m\
UAvmNf
{(((J
fuS`0
nS@|r
7nrN{
m^%m0
H+})!W
A>P^p
,bg=W'
7pi}7
-|tS{
SetFilePointer
z&iIq
!IR;T
t,_q?mP
5wIRt
ppKKw
'LLxA
{/m[yy$
p@cUN3
a%$~\
"z'aOb,
RegisterClassW
)!?o ,0
GA9Mv
AY)}I
`5@bU
(/iTG3CJWf,+*
MF>yc
T6UgV
077zXbZ
6C?tXx.
^oj>>p
&s,Zz
cH`6%&
o]u7r
ngutj
bs@Cc
-B2_ot
Vh)LC&
>5C$~
]"0Uw
@ep%l
d]W58
lstrcatW
U\cLn
E,OZ
Ab:'iIK
</A3=
C/(8`
Zj}fX.3
5 |.g
7mI3e
lH5e#:X
^ci):
H:61
1M*]t$
4yIC7W
T1kX3q
s0vl{;
23Qe:?|
4G?}mM|W
EB<>R
+M:F=
=:*hY+
[0Z*7
s5kjC
W]uu!Px
.G$KRe
\?wH`"
2D3Em7
tq/z
cyW?yP"
ea$&=
%C'eR
v-+cb'
?B/@6
x=:^L
Software\Microsoft\Windows\CurrentVersion
imaF~
m.^H1{s(~K
-<qhRgb|
o3Si(
SetTextColor
oFI;X
ls%J3
l|VbQp
2Qn~RP[!/
iBaNN
sjZtaqF
6%StGO0Ll
KB6p
&8b_?J
ABB>Z
9GWgoR.
UK`90
D$ Ph
Iq@>G
GetTempPathW
Y:RX5
6G}i
`nXuhrEmh
R{]XW
,YYI*
JM[CD
[W,K@_
0.gSf
OQ-Vd
8e6~j
IUb3#
l)"_m
i#<\*
{#`8"
`f(QoR
/[koG
A:[bf<"R
\'b3>[=
N<z|1
Z;z8}h
Kdpy
/"(@(
P`&guV
djdih
WZ<"RH
[} >t
MS Shell Dlg
X(\}l
/JP*t
|>H_JZ
~=.tL}
I{o}3
Xc7zd
Tdz+W
5t"ks
ll=07r
K=S)TDPc
279%s
j$g3x
]y0IH
#FPkBK.
RQ4H+
7".t9
MpS9P
*yxyb&}y[
7R%B<
ID4V[
pvHj]/
MD5ZC
{;5@t6
9NFbA~9
)um,r
t5tQR+
"b'G6
}E/1l
mLH(X
bB}rb
wdaFs
2d:rZ=
wH|_9OZn
^"prN
[,?A"
.]3~C-
0P[Vm
\'^DD
#&DuQo
pNYuT
,X;zK
p#uOR
{nFfa
+{/.V,
#B7pL
z4uy@
iE=GB
Y9Gy/g
wQ&_B
n*$8z
A8zx?
srdql
@Lc5_"
m `FC
*B2w>
d|"vAq
G(wLo
u)h#O"
~%t\{:V
L:f-+
[alF!
`S}>K
snsaw
}d(!,
{>vw.
pFc5Xc
\:x.{k
lstrcmpiA
5R/+U
,1%T*4
h[1HK
kTJt?
v{YKW=
kqO5!
Fny\sW
2IhM5
@FmD!1o
]6Qh5rT
pFOOHSNNSMFB&%
^l2CL
SHGetFileInfoW
v8J{I
4U&)T
N;fBF
Ej_R:V
x2KYm
aW]\s1
oh?7dt
!i4$a_H
Bc'-nY
4;TPc"
]"ZtL
2Cev?
un41}
`o*|!
~S~@bU
5SXC?l
u|su.d
MSs34lw
8u/j!
<M>CO
1fC_L
@87jQ
hL%"9
+A>2b
R,A60
x/2;C
_b e|x
f=S2T
hzq*.
,0OC,
IJWBc
?84BU
yw;17
rY]80
n.|-Z.
^z~,AT)
gE[K&
&dc4?
:xH'm
XT&WR
GetTempFileNameW
ZdSKr
3M]^eNV
/T5G{
Zh2\so-
K6#hqHx
o)T4h<:EW
4?F%5
zM2+Mm
1lUk1
,%L|i
RZdBD PS
#g38!F
NZtrM{
~"- s
CJ55Z
Q2%jQ2
K52g+[
zs/$g
6Umr.^/
yz~:O
yqF;t
E&^t_
};oqg
V%k=r
,6+Ly
nxirG)8q
X[dlc
;DC]IM
,7"!I
Hd91(
8*ri~6.
.s!Wd
Y|8?#g
1nNy24
=3x:C
d4=^_L
(.:@d
d0H,T=b
7JKR1
d^N^]
^Nw7T(
1'1Q[,
CharNextA
"1?2,1$
%xvuJ
,Cz,^
ke&"il?cm;j
e"lSyk
Fs~bcY^
}|UxhR
S%gz)
OPi2N,
*2yCP
ng/4KX
]wuw9
c)444
?@Z"\
;-*<f"
tNM+n
8guQ'
G^"U]
g]0a~
eoJ1Z
*4'f`N
0R2Aus
b6#oF
RI$$Z
t(B~@
:BVU%
#"1"[/
<,h|f
bH$RH
+;"bw
[1:8e
g}U]{E
fV0q>L
'cGk[
SYYW;
^L=|3FL
6{f%O
sZ(&j
uEJ&TK
/jqgi;m)
uv$4D\
kOc>G.
3B <7!
=x3^d
T2te}K
~mfQ.
`yO2
8{1>"
f{\[(rN
;5P81h
pmdoA
\Z[:C
)}|Ho
le<%Y
Q_3,W
-* #9
lH5aX
L}^`v
Yw~=q
tX-^M^
F<3hL
_,Ph-A
ZcLL]
u=6DP
8&sxf
YWhmV],
$&kxF
]a]a]]
}@B/F
Ui):<
\Mq&a
0e(VT|
|#Spl&]d
fnR'WW
{A~A'v
,zlWE
GetSystemMenu
EIHwmh
=1.Y0
JM/rI?>v
c\ozC
H.Ua2
/#!rW
{5bq>+
)575C
Fg&H
y(:yC
o&4n5Q
o MxzH3m^o
SelectObject
`/}$$&
8QN`^<
|'Bd1
7'M=F
CLBCATQ
;jKoo0
OX?w/
it_W
:z-/0
OCW#S
!+"lX
k\p&v
osy {P|
Xk$q/
jNKB[
<P>R%
+r_bU[X
)u'xEn4
O~r$-
5,8}i
WRU|X
BC8cd
dicu}
CreateWindowExW
9/L6
.(xc}U
8V)`]m4
SetCursor
RegSetValueExW
F2.-q
ZL$&a
7L#i:F
{-VyO
~',ik
Yu>Mke9xO^KC
ROjA>9
MFVE|
SIJ3 P(X
Pgs&l
@Oc['\O
8Zepu{
2zG;E
,aADL
IS:%'=`
13o2z
GhhhP*
,A~t.
t)>Z9
Da5V} #
75jwp
]+J\
`SfA\no=
B-o@mm=
Odg,?a,
1_'U91
y[^YMt
PN(:[
>Ma0!
>R~wA=zy
FV"x4oL
w/59O
LoadLibraryExW
^F5__H
OsBDh
'Mu7n
\Qs8%s
$03C5
1<{5
9Qz2%
F1J@h
jPOPLXmjVKKWMEA'n
=(%`'
hNVwq
@bwI-
0UIdb|
[n''t
_/u+[i!+
S_X0\pcGI
!@sV)
s4(*>
OwA\D
~YH<w(
QHq'S
bj{pN
3i6`v
(o1."
PYRLZ
{X7.C/
Kh|)B
rt_#%
@s[Q
IzJXH
PJ 1t`
pr<"X
^O)Dz
cY&eL
)'^0b
:2NL1
0/UA'B
/FvER
p)`3>
:JuN:p
JtF);
_x(71I
:HFs2
4vlg8
FillRect
H4TkE'h
8\BZ\
9 L#F
cDjEk
M_^z9S"
sIZU3
"]LN'
"FXv@
OMeOx<
*)QHA
{25N~~
pTH/G
{]V9G
n|Qiu[
MI{1e8
a +*]K
Z=ff\
"i:|a!
CP;L[Z
_]*g\
<61W:=l
i]4_C0
pgwA;
=3cEO
7T!f38
Pm'e*F
s*YlL
4Yr8Q[S
#P)[*
pD?>A="
b"@\&
z:"1o
kD`pa
.D2~D
"z*-*f
h^zBR
L\(bb<4W
o'+6^
PGUG2
c d,'
"tCm'$
}3U)R
CoCreateInstance
JVJ`M}-Y
I9\jX
].~|fu
Zcgj<
KtlDC
puzS.Pi
&Igbf
k4s}J6
}W1L.
%'2K@
&JOs9
\bvv]zz`
w#V950
j~Q8Q
GetFileAttributesW
<c)5_
PortableApps.com
+"*$V
c/RU'
F$VMx
zm|#D
uAgp0
\+4k\
|'d,5
S5BSAC$IL
).P9O
eM*00
<RP2n
`aI9n]
SXqZx
+C%(QSV
DispatchMessageW
W>#^N
^]g0CpI
vn5;8
>ta)o
_O)VZRz
YSe`w1
~v!<1
G[*"`qOC
bx<4[
#sn5m
M%I-,
z^nfl
&#;`]
6@<zxP
>I3N{m
tG"o#X,
nGt\{
`$+\VhAl@
C_lhwb
meDjM
UG+)h
@Ts-UW
Eu*-=
rT"E{
Cp\tt~
vZ%wz5
B$qNM"
>1iT=TkD~
jMqI4
BeginPaint
(c:{eX
lR,!$*7
)/btWD
JT U(
&"!6K{U
UOL(ZE
k7!jB/B
qbo1=
iG_<;
P.AzXc
N>Gqt
0[4sg
/, L=
x@<Xn
B&?JR2j
<iHsm
I?wr8
8*N5O
g!kW5
!|:=*
ldBmI
o69u*
+?>)_
Y}}4P/
0Mk}$
gquu~
TiL"g
)l^x1
k#'[F
k=*YO)
n7izh
uHA62
&U]BK
ua@zm
UZ0J
4lC*L
7bEi_Dy
olw'z
,}z7{
Na_61
Hh Eh5
>s%Qp
AcAG=
^;G@D
4HYjb
> U6V
F/X'b
ijdj>
]XLpW
UZ%:;RO
'gq+c&
Ams':^
ZKp]ph
>DaImi
6y;6<n
JY"i^
dK\jd
7yVn6
BBL#%9
q!.8^p
RM1oLf
9A+J1
7g~;/?"
"Ahg7{AF
A*`FN
C`[MD
L!un@
=2yd4
`OPGg
j78nC
*i^\[r
[jXyE
2vy/#
*Y0BS
|7#WD|w
%[W7\
ia0U~
C*9DB
'~GoT.
KDin\
.'!Y;
8oK40
k/jvu
c~hn[
|"/=S
~ux3g
:-|F{
S")R{
OT=C-
n9mbB{
0-oTq.n
0rvNRR
T-_~2
N;xy(
]404x
'f,!*
$MnCC
5)QuHA
Eni\[
``|Z+<
9%c"#
3lt53
A+|o3
$W=NL
(})U?r\
7=?id
COA'l
MqT~x^^c
mBBvvc^
A'fWt
Evf{&,H
v_@P',U
)<8fsj
LyFzj
y"Or<
I&R.
p\cOdK!1
2cpnY
H'3VX
NeUvq
gbjMm
2AX2/
dvw?N
hA><_i(^i
X a+($
yB-FHw
Q)X+lw
wf WW
qYo (
iWsC=
^yWA LI?
EnableWindow
p bs)
\Microsoft\Internet Explorer\Quick Launch
OW}EX
AlefV'
&Ug7;
;:ihd
=k4ai
r>EA|
CloseHandle
!;p,M
7uKgM1
}"g)/)
\_**H
lMz_r
0gRKO
%]C17
s>B{{
%F>&T
5:#Ah
Oz;?!R
lHVBzyg
XlUwWT~\
iG5!Q
G|HQV
Hg].(
()$Q-
P-KSN
RKPN"
|%=m+aa
I^E{\
&PpIr
kl*x)
S`W\,
a+W[|>
cW^?E
@'ZKH
;Q~l!{
]OL/x
P%gcR
_g`E~
]r<&?
Wi!~`
}TVJh
WQt_V
i]3DL
V86Cf
VNJc#>#5
T39xj
8;+{`lT8
fSzgx
syd|XvA
CEJ2*
X5C38
6!pD!
NPAf(
=w;5|y\q-
;?~LIK
OL`ds
%$*Gd:
*KS`+
sPbZL`
]GO9k1y
"+=$i
IU"Qf
eYDP=
Kpv0Oh
mc~<$4
0[Z;$J
{d%^[
l#m%,;Y
48Y{db
pK AU
y>,'$
WIQ\Mjy
bJOZT
0$)bCX
x7WQ
53+F{
K[ J)ys
NgpS\"
3Dz@.
'Fzan
COMCTL32.dll
>FFf;
\=y8B
mv$6H
$EdOP
k]#N`KKuLkE
PortableApps.comInstallerVersion
"-xul
H5JX>3
.c<AJ
uwxsSA
?:.O[TH
=,nos
#MI{n
rU`<|
c pO`o
Q"E<:
> >M}
X6(;<
,Jt{++
*pKN/
VQ70/
16Pf'
1t@uc
)s?fe87
1Kf7!$
:-WND
e]GNh
RemoveDirectoryW
`fyX\
I53x~%3
![\=u)z$
6xI<^Ek
!EV*"'
haGA4
vR}KNb0
CZ0u{
6j;4F#
Heyp3
RegDeleteValueW
[=tC?:
I$E@`4/@1
'p}o*^
ax.\Y
Sa+1B
|5487q
MN{]@>i
Cd!o_
QKZ8B
b\/ \|_
;T+/!
Y$B9{oN
Yw-8:
p/:w~
fB:gC
G/=hTP
0(qoK\
O*MO|
l=;\\9b
RegEnumKeyW
yNN{*
CRYPTBASE
CcF(r
=(<V(
}\*U=
TCSzj]
^#uGs
[jI(%
IsWindow
xT<:
ADwMv
rS#H:
XFfBA
]&@qUW
UJ>fQ
&1#4]
DO/_Q
M.jLaLu
+%Rm(
+A[M(
ygYEA0ln
},OP'
</o?Up$
I%gja8f
q,p%Z=
+-o-u
t`Gd0JR
m#UR1d!G
T:+dNA
KBF5x
NF\0)
rIdD<
<OV*p?l
b|G(h
/0%J)
kYI`J
pR4Az
?%mh]
EYTCC
~{>=eY
IsWindowVisible
SELEAOl{
OR7Z9
w&b[^
Jxs<T
~*^8Y
S|0E.
#o"*o
YdkEkq
tt?\N
&>{<l
wHx|>^`w
#~gO[
@Gk3o#
/5,w|
eu+4sv
h6IQ
gq en
]gQJu
wEiE48
]#_F>
6^`!R
z]_dUh+
TU1JIW
RMH<2
.,s\7)
z!gq&
1|M&3Nu
.:IsA\,h
OIsQO
Y_Xrl
*O'PNS
zlmz*
f<'U4B
vJyPO
f!>_^
CallWindowProcW
U.S6s
()#O+0V
3/hUbQ
S"=m*
_V-S#
>=C^N
@X?50
OLQ}S
H?Kkp
"||DyQ
|>B+OO-
yXW;A6%
:TOc`.4=
4o;<'
D^+x3x~
WPWj0
F2WU#
lH#-p
3at#qh
[RF]T
0Emg:
p>xhK
( $-;m
}G~(&8
#<}1E8
.;%{z-
\a<^O
Gr'hd
RegDeleteKeyW
zyP^>V
\VQRQ
jh$9K
~p7b7Y673
en$#>
Nm \f
i=FOf`
4UUnU
FWNNK
[+Zix1l
H:,^8?2
$m8|p
3?"]r
B7"BU@
WaitForSingleObject
/NggkjC
wd-8:@
;w$7r
Ct#oUy
P4csx
od<Ks
OpenProcessToken
U5 :v
UoxAC
OzL[!
7}+,W
37GYsr
{|4rq
h&! ,i
ZMf;9
_T31W+
rF2rz/]<
NZ a"
SetForegroundWindow
-lJY[
>|',d
LG(ah
}E)4V~@evF
*I.E<
"#W2:
9_U2}i
ix;`U
S3cmn
{Oh7u
m*71Ff
)3d_Q
$/Y]t
23y$b.
,VYPu)o
L[_g5r
u;m\|
C!?|m
u,5ean@
yuZ}N
nW-:Oai
ExpandEnvironmentStringsW
F-hzK4
,$0%<q9
SetFileTime
Qm#}{IU
?Qx[2k
#U*93A
u"ZK+
(oq"h
H9:u_
;A}+N
0nC3&
-g1[C
jf~,`/o
ZFA1)ITw
wL8UW
-E5:{R,
0Xft%c
\rbmM
khqnUO
zw:/j
#mDE5
_t)Lc1
5\Kv'R
nTI(W
PCI-ZPortable
Ku.bQ
~4_x4
X)32.
ve`ivd]
4vS(B&4
~L7hu5<
Iak2k,!4
tF_%\a0
SLC '
}xQ0}*
KZ[yz
,L,$[
FzKV}
*n*(]"?
!hlXI
5Lu"a?%
03){3
1<3v(
D~J%3nz
c9t!I~Rf
ty8n6
^O=(Tv ~
I8I7&5w*E^O
6j1]bq
hBDRSPWB
buuu(
`I/eZ
Asx<v
M2d9}{
NOe/w93
^Jl'3k
"O;!N
1cASZ
KiKEH}
P+E;R#E
Ze.$uLFZFD
T7o3d
)ksGZ
PczF~
8j$qAd
LvoCovU
;5<w%&E
vgyP}\3&"
X?#P`m
tzK.x
SV3Tgh
fjs%T
8W')v
Y#0?mZ
z>a;&
$>_NC
~244L
z46*_
1XNFE#
},s"u
_Z:Zzbl
cDF*D
,zcmdSNC]
p.\I,!
"i8F>
(*?LN
Td+@8h\*Y
_?S^
Z|_|q
das_%C'
BI.ID
DialogBoxParamW
FreeLibrary
_oUV}Qp -
k;}c[
E+]Xu
mIJ96
w12,2
-45qG
[y4m:F
Zj:["N
xN&;A
.}_O&;
{(tLa
L3P.VF
j(A7/
aX7H>
Xma[%
+ci0-
q}q;}f>f
CompanyName
E6Q2C
ROj-|-
B<1Y44V
/3YGS
@~%I*
P&E$Yg3
_x5bB
uZAx}
^f*y0
!1-2qQ
.FB0)H
o~M"4
Fa!@9
jB-<\
{S8vX
Z<mX&
md*p
VICpQ
1]xNd
a>8);
=sR:[
0G%\`l[
hR .H
RZcsO~
9W`x:z}
%5S^qC
h!5&U
$O/,1*
%LgQ&b$
Aj"A[f
>ts29(
:27Q6,4N
HYqXb
t:W.6P{
NNvubw
&KRAOnw
FTi >zw
7t#DTE_
5"g.;
"xhp`
LoadBitmapW
"BnGqV
SetBkColor
Dy9-Z
v0ijCq
*^$ h
e s))9
~Zg#J
$zT{r
4eqA%;
cCn3JM
J).+TS,
I#FR5
0:zxjiOj/H
CrE~(Z
HrP8K
HX~QY
OKgNKC
q-q`v
\sn?s
l)7,en
!y6.d
tw-ezo
&BNS.
Whd"[)C
qxcl!
-,lnO
Qw'aH
+uIuJ
cg|=j>
e.uqABM
5F.K^
IrqE)
e?ki2
d42%J
bfhit
.Tpu#
.>]9r
wqlxp
"k_Q*
svaLP
?L+9p
{Y~!nc
UtKAM
kX^OfU5
ImageList_AddMasked
3__"#
f9=(7B
M5ZN$ZdloU
i4FlLBe$
U1c7nw
W<a\7
OWiV|
&*w42))+*
=P$`2]
%Cl7%gz
,G%YO
:B?y]
='%9}u8J
}80D?
m?>v"t
gD>tq
9E}s#
E*qN7
Garjl2
_AkrO
EIV;:
<|TOs[0
}QP=;{
Ho80E
BRIL8
gv>S|
p,$0L
j9/%-
!KI+OF
VHO|U
FindWindowExW
"<=SW
t"Otf q
{PC9B
_{MiV
C&-5W!s
,A@ m
KT+|[B
zV@uM5'
s<(h?
PeekMessageW
oe([:
|J<T*x
=At1_b
]/n+,
p=HR,
(`F!J
0;0]w
=VlB)
l]3>*F
-FX9x
_"uYw
!m7n]yG
+U!`4
,nPdB
\WXJA
eId??
n<sI6S
lEQ`XJ
+x\Pf
UQ9fhx
~1,p{,]
Gzp"g
jWc|!
k>ru5
!p+8P6
0[v"
mxTw@y
'!6Tc
SetEnvironmentVariableW
?J{?4B
ex2:|
K=oHx
IHR&v
*Wnb"
FE``U
.|2VVE
wsprintfA
/u#q,w
Xe/5V
sm]hf
343"r^
+]#O*
x?xb'
&n d:,p.
K40sJ
d KG@
9-XTE
?Ro,W
'[p%#
8 uG>
?sJ(^
6DaNYl
Installer integrity check has failed. Common causes include
?Da[+/
r]lDcmVW
ICCc+454
W0qG#u
pOp'S;
LCfzl
,R&Hj
"Z:.@|+
!6%$)
Control Panel\Desktop\ResourceLocale
L*boQ
%D6I8
IQsK~
AfkHA;
AlZii
bwuA
o+6nF
R2thT
,5#^}
J{k~hR
}}:$&
77%}O
mfTbt8
i:6?)@
T+h6U
h4:NucS
x$^uN
IXA/G
2;8`"2
Fu\x<C
}>`c~[
] s
GetWindowLongW
?vWgA|
BrhAm
y]d4T
`X4YQ
xgK2A
X.YQE4
mVuoP
Yf3wF|
Wzm!W
)e5^2T*
|hfonM(L
3,cc(Vq
7|f;v'k
=HKm28
)N4%G/'
_f{Z|y
o"kr=>
0,dVI
]5,2_
)<emo
w.;{S
ii+Qz
{055M
(C$5)
L#EAh
\sT#E
aL[aG
.E7Z,_
n$#a?
13W +
#Ql&D
br_Hl
{t}1*
y_dZ=
6Lf0g
v`%w#
Error launching installer
(y#qG
#*5g"
)(&L}
`CX0]
Qd<j>
!,:@R
3'@s}^
p 6MSc
WriteFile
^u?` `
<.DD$
1,d'r
h|%wU
4!cq`
cib(:[
DestroyWindow
>IxaI*
.kOO7&
}|}w'n0q
J wU)p
\mafY
"05UD:z
=ZFn{v+=I
p`gzC\
^/]WX
56kA]
:gqUV
3O2XG
cg#e
eb64g^
f;hsz
9~thf
=VjW|%
L-1pwS\g
VSUbOI:
}$/[=a
OSoVK
/'YM{Y
h`{'rL
`XK'X3!
`qI+(
wH,NT
;aTli
MBw`pW
"(K%@Y
h]0Y+
9H?[u
?Re[D
TUQHrr
@PA~oe
eCZc5
45+o&
_!'0I
kqS\"d2
(ZdQy
RichEd20
O<O?F`
SJucn}
gzU\a
+ lin
L\yeB
\.*>M
>WH$C{,t
PortableApps.comFormatVersion
m`hax
t*)91
aN:Wu
[3`(H6)F
u!!s4
'yE:v
gm;pN
"}tx\D
~VDG{
={ L`
1@aZ/
g=VB&
8kH#T
!1@-S
BMEBO
zMSmJ
E}:ue
nDS {
)&%h_>
;VyF\
!C$M?
MLT47
QZ<X@
&|+b83
r#3%B60
^=RJk
Z:%i&
U\e5O@i7
f}e2G
Q-E`F
QZMN;
FA)\/!n
E\1Rq
9Fy 0S.
ojI4($3C6f,
2BB:k
$L1hw
OLEACC
6$hH}!
Z$^:s
pt[h=V@
LHUFe
o>|p)
<^"0A
r~t;<W
~66xD
LI&61
_Tv0%W
P@JS:
`U^XO
~23a(_|
p.Bn>
e@NU$
.Vxx=
_n(@wJ<
+4q;-F
EQ">;
%4J)3
z5~eFzsL
QK?I^YM
y,{uT
.[_~`
MkSPj
2Ug^%
&w*.`j
a,n`;
Zlp)p$
BXIH,
eP\|cM
PB)Dq
P?'j>
gjO*8m+
454Ewfi
;Uwg|
WF$kA
;AuGq
|Z6{\
GetModuleFileNameW
"%SG,.V
Z+sU:
XDpj(I
42?D%'L
YEHFT
h(tM2
|!K.^
A+>b]
/'Q#x
9az;,
(PZno
o_[0[9
4CV^P
,dkF&Y,{'
"{mv+$
8W,9+p
`1P[g
2,cR]
#BW7S
vhSqF
/W4}tGk
Iw7p5
S|Sr-
"hZ?^
cv:_6^=
wf{_2k
G[e$]
CAtu'9
ah0WH
$Xq=_X
b-w]:
gW[7-
Df-u(R
ti,('B
-+-V,+O
\oL5d
/DTWc
Cic>m
vm-rL
m}+teS
-H;jf
!7gIL
g)0M,
U"W(?:
8{vK|E$
e\;a'
l(bc*
VS_VERSION_INFO
IHa}?<<
;.Q#+
K{yJe
c'R0tO
baP`g|
TA6GK
in @=
Ak$q<
sM G0
-7h~N
G1*;D
Pbumb^#
c\DfG
O=/#2
jU>U(
^10?+D
{|?d_
ezT2J
RtucD
Uqg]0
\={\}
/#?XSi
HWBQy
{49=Ii
Dhq]\ar99
"&iN`-D
q=HnHJ
"Q-*o
D Cb=
/Y#lD]\
11gO*
sPXO"
Iwg>6'
E-]:P
z)MDe
OpenClipboard
;S vjv
lg`zk
yn`5'{
]6C:^
~.'WN
87r@t
' 4'z
z[$jU
7kVqB
%QdkI
?88V5
2~5@'
SdV0D
]F>=U
3REZ>
"$Y1"
SMALHB7
OP{&;
?1J,U
.M1U]
7{2vLTO[z
vu4~%
G)uBV[
Zl%!y4
zuqYq
WrJ$/
JQ{\-
Tf{7v
?lE5z
p+!M6
g_%!h}7[b
94**wma
L18})-
mFB]"
FteDr+
Dk-\4
_!#)3
WC=||>
ExitProcess
DBTb>91
R$TLh
~#ZP=
^FnK"
V`s6h
?S.o*)
no04h
?)r4[
g;34v
-&(qf
YuLlj
5Z3"Q&
GB=2d
>)n:_
~p@{C~?
F [*V
Please wait while Setup is loading...
bKePz
sNK0F
k? nq#I
AiX9Zi
"~5KM
9hval
CreateDialogParamW
[)xkg
G%01$
*-k{@
KEKxk
GetExitCodeProcess
qXQGP
bYU'%
`/"uP
LGLtPPp
LE S#
[Rename]
7DA6OW
|f8XH=
e>Q(S
=X]km
(!crD
\EnK;#@{
T<]@o
RichEdit20W
`H6Ch
~V+c\E@
xZ60[
Qn:as
rHwlF>
Xf9w
o8ym~
Dvu@B1h
na0Fq6
30\\a
_f<*n
}/2WM\
eH>Q*
a]T(AgA7
zljj:
VerQueryValueW
H3YOC
;vC[M2
&"dm8
d_4Vu
GlobalLock
SHLWAPI
"C0vy
QWrKss
ZfWJZ
EU!+^
GetPrivateProfileStringW
~bj>lJ
}C+WwN
R`S=k
,O^t>
$?G@+M{J<q
+IerB
,T|6c
a#PHZ
/*iMn)
1u'T[2"
3TBKp
;G+2:
`,rmBpe
R=sb&j
hn&r
Gpo/U,
2=dH!L
Di,kifK
aSEu:=A
wF:^(
1YcjG
$3?U,d
!{6,i
=ER#F
1$3U?>
>G{]C
g.S%,
w_Y9DK\2
pc7LI-
InternalName
PD_[r
eGf#L
$Dh+v
~])Xq\
b93Ej
.qO3b1
ixEbZQm
`7 #Fj1p
Ua5B(D
?Z\hR
.$;-oz
>j7Kc
rE4WR
CjflHx;
qR15`
sp#g4u
R64{]
)t$ H93
Gs|+y
Dyygp
i#@[\
HCIs&%
N6waF
oCD[3
[3gTZ
FindNextFileW
dy]<B
l8Ax4n/
w'*~N
AB\/a
z^jdeL
YTKh|
TC0cJ
<qpT"G
UC)Qj
xGCu[K:j-
7V<WY
sa004
MJ'E)
wrl+}
WlZQ:
8{2Im{
6b0b4
b`Z}T
incomplete download and damaged media. Contact the
#4eoY
)S?x y*
pBbUo5
B<0crj]
uzI(i>
4|d>0
[s`R"
VjsW7z
WlE=x
5"3>~
>(m!Y
X$E|@
!k;n7bRk
&<BC"
N236<M
,5&|0
`==8U
GetSystemMetrics
D$$SPS
B-~W*
E9{72
7*vr _
MphV0EdM
/}H;~
E2Wp
8MSX/
imFy1
Gx/^G@
#Gg2T
?Lw8u
CloseClipboard
|3b 2`*
I/c",
bXyiY
u^}.?
%T3M^j62Z"
fo:t?
h?T]\
~;7%>
l.G##
tz?wr
*jXk!
|#X-yYs%T(
9C0Og
b \Sp5%
,;t<
p+?{t
G!Q&f
V'8qj
Ita|TR
\lf+*4
wBOi+
@xWz_
y/YzA$
f9zV/
tqx1s
Bh,bln
\Qa`@
USER32.dll
$noY/5d!
lU"W>$._
]~0="
ZNN`e
JFZnK
<V%ZE_
f8)p5
S+1MA
SVIr%"y
f^T}`
@K(&Q
x7NE+
X-/vw
;Q5Ge
N<h>"
_tvvC
Ddo.y.
*I0V4c
"GUY}
xliBQ
8*}(
lG6<|@-
:3SYq&
"hjMN
{kmYr
P5pBRD
b\8*v
wE~d0H
9HA $H
3H:qos
-)OwJ
GetCurrentProcess
+`,1DO
B/pw`
o#L'm
a~-dz
kgPF?0
> E"a
53gut#Z0
7~-zuY
H!%q!
@yDf<
:i2Fu>
JAPAQ
5mP[:
0q%c#
.ndata
E:S>89k
q&qP&6
5g4,|
GetClassInfoW
rJ1FP
rEPkW
\ofJ8
S i}s
$h&>`"
GA=;KJf
o@0jh
#-![k
OleUninitialize
7M:3l
mOC9]
F0(w-w
&<[D-h
v6Hxw
(<`+Ut
1zliL
E,ylm
{2=:1.
!SA_3
-ZIT3
;hqp(
uEKvJEF
6*oGH
|%!dR
bcAtE
1)#q?_C
@n,Z>
G~8Y>
f|u>+
y;\}]6
BhG[J?5
kM3=Oe$[n
Sq;_=
{2AV}q-
B-~d-
av.-{
Wsp:)
#VRZ:S-'kV
4MN>Z
ShowWindow
>cl7I
C%PjpE
rUDx8
8cXTX
2o2s[
bRa0J
*G$hZ
O/q1;WD!
0*"?%%B
_O89a,a
3o/m,{
W@A1;
"I|w%t
IVeg@-
:Zf}A|&
o&}O9
L#`6=
b<D@<Dy+
;nf[Lph
r{Q,z%*V
PCI-Z Portable
*N&:6
?H=uN
cQeg]
by/1YZ
LB8L0X
F,T%N
>Pq]d4
3 8^x
UXTHEME
*pvBh'?
]_dA|TDPZ
,GVx~L
u lwe^
G%wR$
5;>Ztk
85HO\^
14n@T
D8`_}
+s G~p5%T
p?li8=
DWMAPI
AAVuT
MG@-6@
LookupPrivilegeValueW
Tjh~-9
81 MZ
}t3%7
Cr6~+
oq?"+s
x7|r=
&3o`n
`{*YybY
vDgj26
;oG)BG
fA P|
MG@.USd
.Y/;F
M Oq|
]$>%1{
<w@A@vG
^wSW\
;{%eQ
!#+y`
E=~%R
f58ksIN
\?@s.
O5)Pw
!:sIM`
g`uo$F
+R}Xm,
9-$!c
mazIqW@
i8b!c%^
GetLastError
'5-lUc
L6r:`
K}TYP
&H3T1Ep
[7nn>1&
Celd1c
a'7UA0
vCDhj
bO'1r
sXgy1
[L. "1>-;
+&/d,-U
/uO$}
[qp8V
HFmlC
ODDf]&-
(K\Hdm
M+#'1
BT*@I1
@]c=sQ
EDr^~'*
5U"uw
{Vg8X
m1ce{
qkQ<W
pgcT1B
MO[Zf
Z%u<N
rp%_N
y/r-=
xzlGi
:~i[yA
m|E@o
,<bR=
5"#f#
IgeWWE?
s-x^T
f[4ne
QNf_
!;?VZ&
38Q\*
PE Information
| Image Base | Entry Point | Reported Checksum | Actual Checksum | Minimum OS Version | Compile Time | Import Hash | Icon | Icon Exact Hash | Icon Similarity Hash | Icon DHash |
|---|---|---|---|---|---|---|---|---|---|---|
| 0x00400000 | 0x0000344a | 0x00000000 | 0x0017f65e | 4.0 | 2016-12-11 21:50:48 | 4ea4df5d94204fc550be1874e1b77ea7 |  |
2c09465cc979677d65781d9403176c31 | 5c00f471cce984e3b873ef9ade242aed | 71e0e4b8cccccce0 |
Version Infos
| Comments | For additional details, visit PortableApps.com |
|---|---|
| CompanyName | PortableApps.com |
| FileDescription | PCI-Z Portable |
| FileVersion | 2.0.0.0 |
| InternalName | PCI-Z Portable |
| LegalCopyright | 2007-2017 PortableApps.com, PortableApps.com Installer 3.5.1.0 |
| LegalTrademarks | PortableApps.com is a registered trademark of Rare Ideas, LLC. |
| OriginalFilename | PCI-ZPortable_2.0_English.paf.exe |
| PortableApps.comAppID | PCI-ZPortable |
| PortableApps.comFormatVersion | 3.5.1 |
| PortableApps.comInstallerVersion | 3.5.1.0 |
| ProductName | PCI-Z Portable |
| ProductVersion | 2.0.0.0 |
| Translation | 0x0409 0x04b0 |
Sections
| Name | RAW Address | Virtual Address | Virtual Size | Size of Raw Data | Characteristics | Entropy |
|---|---|---|---|---|---|---|
| .text | 0x00000400 | 0x00001000 | 0x000061f1 | 0x00006200 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ | 6.48 |
| .rdata | 0x00006600 | 0x00008000 | 0x000013a4 | 0x00001400 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 5.16 |
| .data | 0x00007a00 | 0x0000a000 | 0x00020338 | 0x00000600 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 3.97 |
| .ndata | 0x00000000 | 0x0002b000 | 0x0002b000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 0.00 |
| .rsrc | 0x00008000 | 0x00056000 | 0x00019958 | 0x00019a00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 7.53 |
Overlay
| Offset | 0x00021a00 |
| Size | 0x0014efd0 |
| Name | Offset | Size | Language | Sub-language | Entropy | File type |
|---|---|---|---|---|---|---|
| RT_ICON | 0x00056358 | 0x00012524 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 7.98 | None |
| RT_ICON | 0x00068880 | 0x000025a8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.17 | None |
| RT_ICON | 0x0006ae28 | 0x000010a8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.51 | None |
| RT_ICON | 0x0006bed0 | 0x00000ea8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.70 | None |
| RT_ICON | 0x0006cd78 | 0x00000988 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.65 | None |
| RT_ICON | 0x0006d700 | 0x000008a8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 6.02 | None |
| RT_ICON | 0x0006dfa8 | 0x00000568 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.67 | None |
| RT_ICON | 0x0006e510 | 0x00000468 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.84 | None |
| RT_DIALOG | 0x0006e978 | 0x00000120 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.56 | None |
| RT_DIALOG | 0x0006ea98 | 0x00000200 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.68 | None |
| RT_DIALOG | 0x0006ec98 | 0x000000f8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.91 | None |
| RT_DIALOG | 0x0006ed90 | 0x000000ee | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.90 | None |
| RT_GROUP_ICON | 0x0006ee80 | 0x00000076 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.80 | None |
| RT_VERSION | 0x0006eef8 | 0x00000574 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 3.39 | None |
| RT_MANIFEST | 0x0006f470 | 0x000004e1 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.29 | None |
Imports
| Name | Address |
|---|---|
| SelectObject | 0x40804c |
| SetBkMode | 0x408050 |
| CreateFontIndirectW | 0x408054 |
| SetTextColor | 0x408058 |
| DeleteObject | 0x40805c |
| GetDeviceCaps | 0x408060 |
| CreateBrushIndirect | 0x408064 |
| SetBkColor | 0x408068 |
| Name | Address |
|---|---|
| SHGetSpecialFolderLocation | 0x40817c |
| SHGetPathFromIDListW | 0x408180 |
| SHBrowseForFolderW | 0x408184 |
| SHGetFileInfoW | 0x408188 |
| ShellExecuteW | 0x40818c |
| SHFileOperationW | 0x408190 |
| Name | Address |
|---|---|
| RegDeleteKeyW | 0x408000 |
| SetFileSecurityW | 0x408004 |
| OpenProcessToken | 0x408008 |
| LookupPrivilegeValueW | 0x40800c |
| AdjustTokenPrivileges | 0x408010 |
| RegOpenKeyExW | 0x408014 |
| RegEnumValueW | 0x408018 |
| RegDeleteValueW | 0x40801c |
| RegCloseKey | 0x408020 |
| RegCreateKeyExW | 0x408024 |
| RegSetValueExW | 0x408028 |
| RegQueryValueExW | 0x40802c |
| RegEnumKeyW | 0x408030 |
| Name | Address |
|---|---|
| ImageList_AddMasked | 0x408038 |
| ImageList_Destroy | 0x408040 |
| ImageList_Create | 0x408044 |
| Name | Address |
|---|---|
| OleUninitialize | 0x4082a0 |
| OleInitialize | 0x4082a4 |
| CoTaskMemFree | 0x4082a8 |
| CoCreateInstance | 0x4082ac |
Usage
Processing ( 2.87 seconds )
- 2.75 CAPE
- 0.11 BehaviorAnalysis
- 0.005 AnalysisInfo
- 0.001 Debug
Signatures ( 0.07 seconds )
- 0.008 ransomware_files
- 0.007 antiav_detectreg
- 0.006 antianalysis_detectfile
- 0.006 ransomware_extensions
- 0.004 antiav_detectfile
- 0.003 infostealer_ftp
- 0.003 territorial_disputes_sigs
- 0.003 ursnif_behavior
- 0.002 antianalysis_detectreg
- 0.002 antivm_vbox_files
- 0.002 infostealer_bitcoin
- 0.002 infostealer_im
- 0.002 infostealer_mail
- 0.002 poullight_files
- 0.002 masquerade_process_name
- 0.001 antidebug_devices
- 0.001 antivm_parallels_keys
- 0.001 antivm_vbox_keys
- 0.001 antivm_vmware_keys
- 0.001 geodo_banking_trojan
- 0.001 browser_security
- 0.001 disables_backups
- 0.001 disables_browser_warn
- 0.001 disables_power_options
- 0.001 azorult_mutexes
- 0.001 cryptbot_files
- 0.001 echelon_files
- 0.001 qulab_files
- 0.001 revil_mutexes
- 0.001 modirat_behavior
Reporting ( 0.04 seconds )
- 0.029 CAPASummary
- 0.006 JsonDump
Signatures
Queries the keyboard layout
Reads data out of its own binary image
self_read: process: PCI-ZPortable_2.0_En.exe, pid: 4552, offset: 0x00000000, length: 0x001709cc
self_read: process: PCI-ZPortable_2.0_En.exe, pid: 4552, offset: 0x30785c5a6331785c, length: 0x00008000
self_read: process: PCI-ZPortable_2.0_En.exe, pid: 4552, offset: 0x31785c096363785c, length: 0x00000004
self_read: process: PCI-ZPortable_2.0_En.exe, pid: 4552, offset: 0x6131785c6331785c, length: 0x00004000
The binary likely contains encrypted or compressed data
section: {'name': '.rsrc', 'raw_address': '0x00008000', 'virtual_address': '0x00056000', 'virtual_size': '0x00019958', 'size_of_data': '0x00019a00', 'characteristics': 'IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ', 'characteristics_raw': '0x40000040', 'entropy': '7.53'}
Anomalous binary characteristics
anomaly: Entrypoint of binary is located outside of any mapped sections
Screenshots
No screenshots available.Hosts
No hosts contacted.
DNS
No domains contacted.
Summary
C:\Windows\System32\kernel.appcore.dll
\Device\CNG
\??\MountPointManager
C:\Users\Packager\AppData\Local\Temp\
C:\Users\Packager\AppData\Local\Temp
C:\Users\Packager\AppData\Local\Temp\nsyECF8.tmp
C:\Users\Packager\AppData\Local\Temp\PCI-ZPortable_2.0_En.exe
C:\Users\Packager\AppData\Local\Temp\nsfEFD8.tmp
C:\Users\Packager\AppData\Local\Temp\nsqF19E.tmp
C:\Users
C:\Users\Packager
C:\Users\Packager\AppData
C:\Users\Packager\AppData\Local
C:\Users\Packager\PortableApps\*.*
C:\Users\Packager\AppData\Local\Temp\nsqF19E.tmp\System.dll
C:\PortableApps
C:\Users\Packager\AppData\Local\Temp\nsqF19E.tmp\FindProcDLL.dll
C:\Windows\System32\smss.exe
C:\Windows\System32\csrss.exe
C:\Windows\System32\wininit.exe
C:\Windows\System32\services.exe
C:\Windows\System32\lsass.exe
C:\Windows\System32\fontdrvhost.exe
C:\Windows
C:\Windows\System32
C:\Windows\System32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
C:\Windows\System32\SearchIndexer.exe
C:\Windows\System32\dasHost.exe
C:\Windows\System32\SecurityHealthService.exe
C:\Program Files\Windows Defender\NisSrv.exe
C:\Windows\System32\SgrmBroker.exe
C:\Windows\System32\winlogon.exe
C:\Windows\System32\dwm.exe
C:\Windows\System32\sihost.exe
C:\Windows\System32\taskhostw.exe
C:\Windows\explorer.exe
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
C:\Windows\System32\RuntimeBroker.exe
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
C:\Windows\System32\ctfmon.exe
C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp
C:\Windows\System32\smartscreen.exe
C:\Windows\System32\SecurityHealthSystray.exe
C:\Users\Packager\AppData\Local\Microsoft\OneDrive\OneDrive.exe
C:\Users\Packager\AppData\Local\Microsoft\OneDrive
C:\Windows\ImmersiveControlPanel\SystemSettings.exe
C:\Windows\System32\ApplicationFrameHost.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\audiodg.exe
C:\Windows\System32\dllhost.exe
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
C:\Windows\System32\conhost.exe
C:\Windows\System32\upfc.exe
C:\Windows\System32\backgroundTaskHost.exe
C:\Windows\System32\CompatTelRunner.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\WinSxS
C:\Windows\System32\MoUsoCoreWorker.exe
C:\Windows\System32\sppsvc.exe
C:\Windows\System32\SppExtComObj.Exe
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\System32\wbem
C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\en-US\USER32.dll.mui
C:\Users\Packager\AppData\Local\Temp\nsqF19E.tmp\modern-header.bmp
C:\Users\Packager\AppData\Local\Temp\nsqF19E.tmp\modern-wizard.bmp
C:\Windows\System32\textinputframework.dll
C:\Windows\System32\CoreUIComponents.dll
C:\Windows\System32\CoreMessaging.dll
C:\Windows\System32\ntmarta.dll
C:\Windows\System32\WinTypes.dll
C:\Windows\SystemResources\USER32.dll.mun
C:\Users\Packager\AppData\Local\Temp\nsqF19E.tmp\nsDialogs.dll
C:\Windows\Fonts\staticcache.dat
C:\Windows\System32\TextShaping.dll
C:\Windows\System32\shell32.dll
C:\Users\Packager\AppData\Local\Temp\PCI-ZPortable_2.0_En.exe.Local\
C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984
C:\Windows\System32\imageres.dll
C:\Windows\SystemResources\imageres.dll.mun
\Device\CNG
\??\MountPointManager
C:\Users\Packager\AppData\Local\Temp\
C:\Users\Packager\AppData\Local\Temp
C:\Users\Packager\AppData\Local\Temp\nsyECF8.tmp
C:\Users\Packager\AppData\Local\Temp\PCI-ZPortable_2.0_En.exe
C:\Users\Packager\AppData\Local\Temp\nsfEFD8.tmp
C:\Users\Packager\AppData\Local\Temp\nsqF19E.tmp
C:\Users
C:\Users\Packager
C:\Users\Packager\AppData
C:\Users\Packager\AppData\Local
C:\Users\Packager\PortableApps\*.*
C:\Users\Packager\AppData\Local\Temp\nsqF19E.tmp\System.dll
C:\PortableApps
C:\Users\Packager\AppData\Local\Temp\nsqF19E.tmp\FindProcDLL.dll
C:\Windows\System32\smss.exe
C:\Windows\System32\csrss.exe
C:\Windows\System32\wininit.exe
C:\Windows\System32\services.exe
C:\Windows\System32\lsass.exe
C:\Windows\System32\fontdrvhost.exe
C:\Windows
C:\Windows\System32
C:\Windows\System32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
C:\Windows\System32\SearchIndexer.exe
C:\Windows\System32\dasHost.exe
C:\Windows\System32\SecurityHealthService.exe
C:\Program Files\Windows Defender\NisSrv.exe
C:\Windows\System32\SgrmBroker.exe
C:\Windows\System32\winlogon.exe
C:\Windows\System32\dwm.exe
C:\Windows\System32\sihost.exe
C:\Windows\System32\taskhostw.exe
C:\Windows\explorer.exe
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
C:\Windows\System32\RuntimeBroker.exe
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
C:\Windows\System32\ctfmon.exe
C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp
C:\Windows\System32\smartscreen.exe
C:\Windows\System32\SecurityHealthSystray.exe
C:\Users\Packager\AppData\Local\Microsoft\OneDrive\OneDrive.exe
C:\Users\Packager\AppData\Local\Microsoft\OneDrive
C:\Windows\ImmersiveControlPanel\SystemSettings.exe
C:\Windows\System32\ApplicationFrameHost.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\audiodg.exe
C:\Windows\System32\dllhost.exe
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
C:\Windows\System32\conhost.exe
C:\Windows\System32\upfc.exe
C:\Windows\System32\backgroundTaskHost.exe
C:\Windows\System32\CompatTelRunner.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\WinSxS
C:\Windows\System32\MoUsoCoreWorker.exe
C:\Windows\System32\sppsvc.exe
C:\Windows\System32\SppExtComObj.Exe
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\System32\wbem
C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\en-US\USER32.dll.mui
C:\Users\Packager\AppData\Local\Temp\nsqF19E.tmp\modern-header.bmp
C:\Users\Packager\AppData\Local\Temp\nsqF19E.tmp\modern-wizard.bmp
C:\Windows\System32\textinputframework.dll
C:\Windows\System32\CoreUIComponents.dll
C:\Windows\System32\CoreMessaging.dll
C:\Windows\System32\ntmarta.dll
C:\Windows\System32\WinTypes.dll
C:\Windows\SystemResources\USER32.dll.mun
C:\Users\Packager\AppData\Local\Temp\nsqF19E.tmp\nsDialogs.dll
C:\Windows\Fonts\staticcache.dat
C:\Windows\System32\TextShaping.dll
C:\Windows\System32\shell32.dll
C:\Users\Packager\AppData\Local\Temp\PCI-ZPortable_2.0_En.exe.Local\
C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984
C:\Windows\System32\imageres.dll
C:\Windows\SystemResources\imageres.dll.mun
C:\Users\Packager\AppData\Local\Temp\nsfEFD8.tmp
C:\Users\Packager\AppData\Local\Temp\nsqF19E.tmp\System.dll
C:\Users\Packager\AppData\Local\Temp\nsqF19E.tmp\FindProcDLL.dll
C:\Users\Packager\AppData\Local\Temp\nsqF19E.tmp\modern-header.bmp
C:\Users\Packager\AppData\Local\Temp\nsqF19E.tmp\modern-wizard.bmp
C:\Users\Packager\AppData\Local\Temp\nsqF19E.tmp\nsDialogs.dll
C:\Users\Packager\AppData\Local\Temp\nsqF19E.tmp\System.dll
C:\Users\Packager\AppData\Local\Temp\nsqF19E.tmp\FindProcDLL.dll
C:\Users\Packager\AppData\Local\Temp\nsqF19E.tmp\modern-header.bmp
C:\Users\Packager\AppData\Local\Temp\nsqF19E.tmp\modern-wizard.bmp
C:\Users\Packager\AppData\Local\Temp\nsqF19E.tmp\nsDialogs.dll
C:\Users\Packager\AppData\Local\Temp\nsyECF8.tmp
C:\Users\Packager\AppData\Local\Temp\nsqF19E.tmp
C:\Users\Packager\AppData\Local\Temp\nsqF19E.tmp
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\STE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\Cryptography\Configuration
HKEY_CURRENT_USER
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-10e03f000000}\
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-10e03f000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-10e03f000000}\Generation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-100000000000}\
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-100000000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-100000000000}\Generation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-300300000000}\
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-300300000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-300300000000}\Generation
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\Software\Microsoft\LanguageOverlay\OverlayPackages\en-US
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\ResourcePolicies
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\SafeProcessSearchMode
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\PCI-ZPortable_2.0_En.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\OOBE\LaunchUserOOBE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\AppCompatClassName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\CTF\EnableAnchorContext
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TurnOffSPIAnimations
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\MS Shell Dlg 2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\MS Shell Dlg
HKEY_CURRENT_USER\Software\Microsoft\CTF\DirectSwitchHotkeys
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows\IsVailContainer
HKEY_LOCAL_MACHINE\Software\Microsoft\Input
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\ResyncResetTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\MaxResyncAttempts
HKEY_LOCAL_MACHINE\Software\Policies
HKEY_CURRENT_USER\Software\Policies
HKEY_CURRENT_USER\Software
HKEY_LOCAL_MACHINE\Software
HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\AutoSuggest
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Always Use Tab
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Client\
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Client\(Default)
HKEY_CURRENT_USER\Control Panel\Desktop
HKEY_CURRENT_USER\Control Panel\Desktop\SmoothScroll
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\EnableBalloonTips
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewAlphaSelect
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewShadow
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AccListViewV6
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\UseDoubleClickTimer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Segoe UI
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Segoe UI
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\STE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\Cryptography\Configuration
HKEY_CURRENT_USER
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-10e03f000000}\
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-10e03f000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-10e03f000000}\Generation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-100000000000}\
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-100000000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-100000000000}\Generation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-300300000000}\
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-300300000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-300300000000}\Generation
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\Software\Microsoft\LanguageOverlay\OverlayPackages\en-US
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\ResourcePolicies
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\SafeProcessSearchMode
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\PCI-ZPortable_2.0_En.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\OOBE\LaunchUserOOBE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\AppCompatClassName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\CTF\EnableAnchorContext
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TurnOffSPIAnimations
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\MS Shell Dlg 2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\MS Shell Dlg
HKEY_CURRENT_USER\Software\Microsoft\CTF\DirectSwitchHotkeys
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows\IsVailContainer
HKEY_LOCAL_MACHINE\Software\Microsoft\Input
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\ResyncResetTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\MaxResyncAttempts
HKEY_LOCAL_MACHINE\Software\Policies
HKEY_CURRENT_USER\Software\Policies
HKEY_CURRENT_USER\Software
HKEY_LOCAL_MACHINE\Software
HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\AutoSuggest
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Always Use Tab
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Client\
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Client\(Default)
HKEY_CURRENT_USER\Control Panel\Desktop
HKEY_CURRENT_USER\Control Panel\Desktop\SmoothScroll
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\EnableBalloonTips
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewAlphaSelect
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewShadow
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AccListViewV6
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\UseDoubleClickTimer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Segoe UI
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Segoe UI
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\STE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-10e03f000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-10e03f000000}\Generation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-100000000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-100000000000}\Generation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-300300000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-300300000000}\Generation
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\ResourcePolicies
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\SafeProcessSearchMode
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\OOBE\LaunchUserOOBE
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\CTF\EnableAnchorContext
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TurnOffSPIAnimations
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows\IsVailContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\ResyncResetTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\MaxResyncAttempts
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\AutoSuggest
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Always Use Tab
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Client\(Default)
HKEY_CURRENT_USER\Control Panel\Desktop\SmoothScroll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\EnableBalloonTips
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewAlphaSelect
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewShadow
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AccListViewV6
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\UseDoubleClickTimer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Segoe UI
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-10e03f000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-10e03f000000}\Generation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-100000000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-100000000000}\Generation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-300300000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-300300000000}\Generation
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\ResourcePolicies
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\SafeProcessSearchMode
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\OOBE\LaunchUserOOBE
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\CTF\EnableAnchorContext
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TurnOffSPIAnimations
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows\IsVailContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\ResyncResetTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\MaxResyncAttempts
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\AutoSuggest
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Always Use Tab
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Client\(Default)
HKEY_CURRENT_USER\Control Panel\Desktop\SmoothScroll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\EnableBalloonTips
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewAlphaSelect
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewShadow
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AccListViewV6
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\UseDoubleClickTimer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Segoe UI
Local\SM0:4552:168:WilStaging_02
Local\MSCTF.Asm.MutexDefault3
CicLoadWinStaWinSta0
Local\MSCTF.CtfMonitorInstMutexDefault3
DefaultTabtip-MainUI
Local\SM0:4552:64:WilError_03
Local\MSCTF.Asm.MutexDefault3
CicLoadWinStaWinSta0
Local\MSCTF.CtfMonitorInstMutexDefault3
DefaultTabtip-MainUI
Local\SM0:4552:64:WilError_03
Sorry! No behavior.
Sorry! No strace.
Sorry! No tracee.
No hosts contacted.
No TCP connections recorded.
No UDP connections recorded.
No domains contacted.
HTTP Requests
No HTTP(s) requests performed.
SMTP traffic
No SMTP traffic performed.
IRC traffic
No IRC requests performed.
No ICMP traffic performed.
CIF Results
No CIF Results
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Suricata HTTP
No Suricata HTTP
Sorry! No Suricata Extracted files.
Sorry! No dropped files.
Sorry! No process dumps.