Analysis
| Category | Package | Started | Completed | Duration | Options | Log(s) |
|---|---|---|---|---|---|---|
| FILE | exe | 2025-06-11 17:57:08 | 2025-06-11 18:27:59 | 1851 seconds | Show Options | Show Analysis Log |
procmemdump=1
import_reconstruction=1
unpacker=2
norefer=1
no-iat=1
2024-11-25 13:37:15,225 [root] INFO: Date set to: 20250611T16:18:26, timeout set to: 1800 2025-06-11 17:18:26,260 [root] DEBUG: Starting analyzer from: C:\tmp_gell1p8 2025-06-11 17:18:26,275 [root] DEBUG: Storing results at: C:\qDdlkFnGz 2025-06-11 17:18:26,385 [root] DEBUG: Pipe server name: \\.\PIPE\wXevDSJXBA 2025-06-11 17:18:26,385 [root] DEBUG: Python path: C:\Users\Packager\AppData\Local\Programs\Python\Python310-32 2025-06-11 17:18:26,385 [root] INFO: analysis running as an admin 2025-06-11 17:18:26,385 [root] INFO: analysis package specified: "exe" 2025-06-11 17:18:26,385 [root] DEBUG: importing analysis package module: "modules.packages.exe"... 2025-06-11 17:18:27,150 [root] DEBUG: imported analysis package "exe" 2025-06-11 17:18:27,150 [root] DEBUG: initializing analysis package "exe"... 2025-06-11 17:18:27,150 [lib.common.common] INFO: wrapping 2025-06-11 17:18:27,150 [lib.core.compound] INFO: C:\Users\Packager\AppData\Local\Temp already exists, skipping creation 2025-06-11 17:18:27,166 [root] DEBUG: New location of moved file: C:\Users\Packager\AppData\Local\Temp\UltraISO_cn.exe 2025-06-11 17:18:27,166 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL option 2025-06-11 17:18:27,166 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL_64 option 2025-06-11 17:18:27,166 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader option 2025-06-11 17:18:27,166 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader_64 option 2025-06-11 17:18:27,322 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser" 2025-06-11 17:18:27,338 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig" 2025-06-11 17:18:27,416 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise" 2025-06-11 17:18:27,447 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human" 2025-06-11 17:18:27,463 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops' 2025-06-11 17:18:27,463 [lib.api.screenshot] ERROR: No module named 'PIL' 2025-06-11 17:18:27,463 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots" 2025-06-11 17:18:27,463 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump" 2025-06-11 17:18:27,463 [root] DEBUG: Initialized auxiliary module "Browser" 2025-06-11 17:18:27,463 [root] DEBUG: attempting to configure 'Browser' from data 2025-06-11 17:18:27,463 [root] DEBUG: module Browser does not support data configuration, ignoring 2025-06-11 17:18:27,463 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"... 2025-06-11 17:18:27,463 [root] DEBUG: Started auxiliary module modules.auxiliary.browser 2025-06-11 17:18:27,463 [root] DEBUG: Initialized auxiliary module "DigiSig" 2025-06-11 17:18:27,479 [root] DEBUG: attempting to configure 'DigiSig' from data 2025-06-11 17:18:27,479 [root] DEBUG: module DigiSig does not support data configuration, ignoring 2025-06-11 17:18:27,479 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.digisig"... 2025-06-11 17:18:27,479 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature 2025-06-11 17:18:27,635 [modules.auxiliary.digisig] DEBUG: File is not signed 2025-06-11 17:18:27,635 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json 2025-06-11 17:18:28,072 [root] DEBUG: Started auxiliary module modules.auxiliary.digisig 2025-06-11 17:18:28,072 [root] DEBUG: Initialized auxiliary module "Disguise" 2025-06-11 17:18:28,072 [root] DEBUG: attempting to configure 'Disguise' from data 2025-06-11 17:18:28,072 [root] DEBUG: module Disguise does not support data configuration, ignoring 2025-06-11 17:18:28,072 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.disguise"... 2025-06-11 17:18:28,072 [modules.auxiliary.disguise] INFO: Disguising GUID to 681fd063-b6e3-4307-92e0-097646af0c7f 2025-06-11 17:18:28,072 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise 2025-06-11 17:18:28,072 [root] DEBUG: Initialized auxiliary module "Human" 2025-06-11 17:18:28,072 [root] DEBUG: attempting to configure 'Human' from data 2025-06-11 17:18:28,072 [root] DEBUG: module Human does not support data configuration, ignoring 2025-06-11 17:18:28,072 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.human"... 2025-06-11 17:18:28,072 [root] DEBUG: Started auxiliary module modules.auxiliary.human 2025-06-11 17:18:28,072 [root] DEBUG: Initialized auxiliary module "Screenshots" 2025-06-11 17:18:28,072 [root] DEBUG: attempting to configure 'Screenshots' from data 2025-06-11 17:18:28,072 [root] DEBUG: module Screenshots does not support data configuration, ignoring 2025-06-11 17:18:28,072 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.screenshots"... 2025-06-11 17:18:28,088 [modules.auxiliary.screenshots] WARNING: Python Image Library is not installed, screenshots are disabled 2025-06-11 17:18:28,088 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots 2025-06-11 17:18:28,088 [root] DEBUG: Initialized auxiliary module "TLSDumpMasterSecrets" 2025-06-11 17:18:28,088 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data 2025-06-11 17:18:28,088 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring 2025-06-11 17:18:28,088 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.tlsdump"... 2025-06-11 17:18:28,088 [modules.auxiliary.tlsdump] INFO: lsass.exe found, pid 696 2025-06-11 17:18:28,103 [lib.api.process] INFO: Monitor config for <Process 696 lsass.exe>: C:\tmp_gell1p8\dll\696.ini 2025-06-11 17:18:28,103 [lib.api.process] INFO: Option 'procmemdump' with value '1' sent to monitor 2025-06-11 17:18:28,103 [lib.api.process] INFO: Option 'import_reconstruction' with value '1' sent to monitor 2025-06-11 17:18:28,103 [lib.api.process] INFO: Option 'unpacker' with value '2' sent to monitor 2025-06-11 17:18:28,103 [lib.api.process] INFO: Option 'norefer' with value '1' sent to monitor 2025-06-11 17:18:28,103 [lib.api.process] INFO: Option 'no-iat' with value '1' sent to monitor 2025-06-11 17:18:28,103 [lib.api.process] INFO: Option 'tlsdump' with value '1' sent to monitor 2025-06-11 17:18:28,103 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp_gell1p8\dll\EeGlvdpK.dll, loader C:\tmp_gell1p8\bin\PoaYJsgW.exe 2025-06-11 17:18:28,150 [root] DEBUG: Loader: IAT patching disabled. 2025-06-11 17:18:28,150 [root] DEBUG: Loader: Injecting process 696 with C:\tmp_gell1p8\dll\EeGlvdpK.dll. 2025-06-11 17:18:28,182 [root] DEBUG: 696: Python path set to 'C:\Users\Packager\AppData\Local\Programs\Python\Python310-32'. 2025-06-11 17:18:28,182 [root] INFO: Disabling sleep skipping. 2025-06-11 17:18:28,182 [root] DEBUG: 696: Full process memory dumps enabled. 2025-06-11 17:18:28,182 [root] DEBUG: 696: Import reconstruction of process dumps enabled. 2025-06-11 17:18:28,197 [root] DEBUG: 696: Active unpacking of payloads enabled 2025-06-11 17:18:28,197 [root] DEBUG: 696: CAPE debug - unrecognised key norefer. 2025-06-11 17:18:28,197 [root] DEBUG: 696: TLS secret dump mode enabled. 2025-06-11 17:18:28,197 [root] DEBUG: 696: InternalYaraScan: Scanning 0x00007FF84A790000, size 0x1f4542 2025-06-11 17:18:28,213 [root] DEBUG: 696: InternalYaraScan hit: RtlInsertInvertedFunctionTable 2025-06-11 17:18:28,213 [root] DEBUG: 696: RtlInsertInvertedFunctionTable 0x00007FF84A7A090E, LdrpInvertedFunctionTableSRWLock 0x00007FF84A8FB4F0 2025-06-11 17:18:28,213 [root] DEBUG: 696: Monitor initialised: 64-bit capemon loaded in process 696 at 0x00007FF824DE0000, thread 3532, image base 0x00007FF60D500000, stack from 0x0000008EFAA74000-0x0000008EFAA80000 2025-06-11 17:18:28,213 [root] DEBUG: 696: Commandline: C:\Windows\system32\lsass.exe 2025-06-11 17:18:28,229 [root] DEBUG: 696: Hooked 5 out of 5 functions 2025-06-11 17:18:28,229 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread. 2025-06-11 17:18:28,229 [root] DEBUG: Successfully injected DLL C:\tmp_gell1p8\dll\EeGlvdpK.dll. 2025-06-11 17:18:28,229 [lib.api.process] INFO: Injected into 64-bit <Process 696 lsass.exe> 2025-06-11 17:18:28,2 <truncated>
Machine
| Name | Label | Manager | Started On | Shutdown On | Route |
|---|---|---|---|---|---|
| win10-2 | win10-2 | KVM | 2025-06-11 17:57:08 | 2025-06-11 18:27:39 | none |
File Details
| File Name |
UltraISO_cn.exe
|
|---|---|
| File Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| File Size | 2103140 bytes |
| MD5 | 04917b24a62401c3be7d6402145bfd7a |
| SHA1 | 79fc2928aaa8dfeec9ae5273792b7bb744c608c0 |
| SHA256 | 9ea21744e33d0eef5b6f346d05a31f428fa4ede6f64211e78f582d2448a10296 [VT] [MWDB] [Bazaar] |
| SHA3-384 | 77834c88ea4bf6751cd21afc894c6c91a841b6b960fae507915b1d945836c6738b426dbefa2dd7718c3af2d523392308 |
| CRC32 | 24557780 |
| TLSH | T1B4A53383D1C79A72C5718AF41C48C6162E3B3F370E3A796D764C45CABE63068AE4E356 |
| Ssdeep | 49152:xaojc80QcYDOJYDiOqWn/k9SgI5OW+SBbt0Au9tGuHeQhZkdw5Ka:Yojc80QDK8k9Sg6OWnN5ufGu+skE |
| PE | File Strings BinGraph Vba2Graph VirusTotal |
r^E4y`fnZ
w&^Db
6Yth$
ZS:uw
+o X2
h&'qA
wH$7XO
1jU(A)
h!EV(c
JyZ8hKB
{kz1rq
?~^D,
CXtYXU
oScDW
!ran_
U#3 O
6T6r|
OI1nogBS
=i{8$
@NEMg
efj&'?
(S7}cC)
^D|DW
2lS|u
u1qDb
67^8#
ew57`
EOverflow
XjX/k
!,pN-
H3&PV
af"@3-TO)g
tuV+R
Sunday
-oily
`Gkq'
=y/Y`**
<Ew N!6
GA#6a
.TADM5
do"6/&]
=p6LQ0
%a&U~Q
8)7/z
{VrxV
/]d~"g\#
!BY>1
=~w]kKU
L|u=d
kYrCm
{bx!<
"^+sF
8:xx$
sX-V_{
[;o'Q&m
S/VZk
47'T-*
9) 40
h5EmA
92 \x6p
fS|A3?
L3X2+
Xbv6.0
*>/y(
*{Om!
40UF
g'w{a
581ncc
6V1ck
mEI!w
cgWq]
XT2aAR>
:3i=O
QDXvC
^?nk_A
^d-iVH
kLk}$k7
F$O:@
/,UM]
QX_qS
`vOyb
QI*R)
\{7mjej
9a K)IO
''nDT
q'Mi]\
dG~]G{
vjH~<
.bOHWl
9&}lH
N{s<d
$Ux`D
ilp.)b
%(Ib;1V
%L&]K
D[#TH
R4/T@
qu'kI~
_6c4F
QuQ`im
mD)h`!
@G\qq?
zs6bg2{,TQx
gDLhnS
-1?j0k
sVSo4
np1tq
\w4Vi
Eg(Urc
dfIF0N
R:wz1
5Ol^w
H~t;=
`(DvGz
r"?FQ
nA}P
cs5u}
XumjM
=A*(6
processorArchitecture="x86"
#:=NQ
Q4so-i
L^pY?
#`&O!
G\FgA
(^@"ZH|
J])KHd
fVrQ:#
H,u<$:
,.#]^
W%%ss
U,FUO
K,^<MFN
Dpr``
(w4PC
Q)]yI<
2C_AXj
f(A0s/
IbVEAv43|
{yh1KRi
,&)0&
Q3yiC
f3F@T
+|9As
+=_{s
1=//.
`:[[x
Pfa!19W
+l9p:
iyXW%
[29 kX9
Ol[A>
c{Ukk!
wETw$Fn{E
c{>_d
O']qnl
YG[1Ja
$d?vnib
Rug?p
]*hIS
J`i/hzM
Znj>5x
V:2p;
&>GS9
FLO&g
&QFZ*
dlj#]
3<k<,
I|f;&
F8uMtW
q>Uf_gK
VNvxn
}L\6B
GetFileAttributesA
L|=3b
wlo.E
qfq=t
qa\bf
W C:cW
.__70
UE^pd#b8poH
@WaxW/
],WYf
H}sKgN
~`?1U
^h2@uj
8vJtU
72q1E
qK?&d(
JoTf>
O0~UO
pN9><
OH?xY
HlJTX
%h.aQq
tLBdQ
W$L\h5
h^OD'
JzJ"*f
TB#SY
uyD%v
(hD X
[pV)R*
%>"on
/Lang=
w>dclO
.HRu*
:SSU%*
FXj.=
wXG*Si
=|TGC
Y/-)0EQK7~
\mbZmN
|{YR-
.&I8j
-:A)ba
Yt.ZB
nd}dev
clI/C
_|9>(`
v]<lpg
'/^SL
vErDY
iC'Nx
w#r?#
fh%2M
mmwZ! .
=xn1s)
'l|By
9EgK0
Y-cwj
hI4)c
TM\H6h
a[>gj^RV
svHMI
H (ZO
=RM@w
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
B5H:Y4-
4/O"S
)NaHP
*vc'G
sHp9w
,x*2.)
a(uP^v2
N0DB4
@"hN?
J/{b*cA
2&U$@/l/H
[~mSi
Y|eM<o
7\1,3
bj?KR
crCnb
&''|f
VY3%7
n*pS9LD
zy=e:kQH
XH6orM
la<j!
<-O*1
]\tr
.B7B@j
QMXo^
)2V)>
1+LL1
{RD8T
$:I9nlu
*bDkX
k.3VS
jg* De
~]ak)[
_ v)hgA
%8[5cq
PPRTj
5X#-D~
{)#|V
#>md^1
b41VF&L
%2vW7
:~U#"<g
<HSqea
kOD]b
V~DHYc
OT;po
ZW]kF
#E$T:
AdjustTokenPrivileges
5N3K7
L!;=0zW
}dDB2
7#P/L2%
H\Z6-
`hB\~N)
;>DS[9e
`?j%i
O#"5}|
U$4Ar
*#{^r
He0mx1
~{Ed%
ouMV)~
~nj=45
M`.1$
^?9s>
ttaX!
)*c|Ef3
/gJ5mo^c
>]G6vw
(:5qo
`nV&^
kho&h
I6qb]
q:0Ko
Txl^k
C^<*J
e!P4,|
hfir}7
O>$*]
f~IELw
`I=Ow
Ol+M.
<RByK
ERangeError
wUPYe=(
y,SS*mk9
YR00(
+!zzQ
F"S}L
NI&)E
ozOr8
6c~re
"1EV^\
t,HjM
e yF~"L
NUr9rvxy
[{b8'5
eBfLw
5*,#s
v^w^0
rcjgm
=O|(*
>H9IC
u /NM
jY,on
5sG}.~
B&(,`E
(x$|Y
y/?H4
(kZ@W
iGY~'J
:'zYO
AFbS4
'Jp}z
{'P,
7}Y11
vuE$7
Qbl9(/
BmT3}
Z (tP
$6lRp}D
YLSu@
\iAKM
a!'H}
ZXJ7E
*Nx2/
`("FE
>MH'H6g
Uhw\@
kVE%F
}5Z*5
PA9qI~
L/r^?j%
u/e>x
u%^!.
X>~mpul
Knk$?
l,#.BV
_J@-s
^Jr;u
6BM~n
5*u{
GetModuleHandleA
e +wWDZXA
vu`<V
ea'4(f
%qCs
#z\\C
AZ!O1
TIsP|
fS.nEFT
{|(5zQQ
9Uqib
T*4;Kq
f -hh
sSI-G
P7 wJE
&=29G
iyNz5
uzTqW
F;4$|
SQ8&1&8
K9Q8T
Zjw}8
'S!+h+
cOvyF
cqNwk
tm1Fj^
S/R*d
";dY&
5Aw*^
oCGIf
#Nzbl
q< g240
z|K""O
K3',p
'<"{<
8#P',
&""9_
IDATw
<p>XdoZ1
$xG{)
(x|Mq[v
{f.tV}
Jei:vx
#D7xo
& bVe
$Q1AO;\
Ns{a6
</compatibility>
|"pIK
iu5F;
b+rbT
z|JR#
m^jLM
?D>)'
>1xr$
a*Wf%
k`Oxr]
:wV7,N
FdyX\
Ze[}@
VAAIx3)
jAN%_
UQQWr
6ra%T
D(z~7
:n%hJN
X@?$M
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
p`$2'|
~1eE7
^<)1O34
$Z]_^[
i%d[7E
vGq1d
V*[7#
`Yrst}
f|Wnz
jKlW@
}6uU@
SDA|1{+v
LoadResource
-o&,Lngf
ty=A+
q"Ou7
Bj=t'
r>`f9
y10\L
G_/dV
&%fa+Y
7]CGF;
SeShutdownPrivilege
*SjcT
?vd%1
2F*PSv
- O8"
QWW/5
YnwI<
g#~i.
Wednesday
8T8L9Q9
m"x!;J*[
u\kE`
mWF&?
!4NYW7
)Z{\%f
vX3@o9
L@.cs
2_B&T@g
S]c7BT]w{
pio~ta
uN$wY
#)'H(*A
]_Tjy
Vt>Ys
I9xk1A
#sK8
)blrx
P3*}q
;$<#oK
~BX/j
November
Ho$h3
5&3.Sd
%f\8")aJ
wJ4wd
zVjYv
W)qW6
VN8jRBN
4TUSL'9&
ny$fb
lw%sE
/@j\0
^|0Hj
[ug89&
5'}I@
,-E]j
.~|Vn.D
l ^7&iP
ECompressError
b3%F'l
`\2TiQV
8nJ69
-49Pz
\xf,d
;.p4o
D##Yd
LocalAlloc
/O-JmJO>
.U*zj
=&Zd=
];!f@r
zQ0E$
KD%t>
Nfysa
GetACP
iJlM'
{d;x$
^P}6{
0kwa@8
BUF5^
M)E+Do\
9my,Y
0TgjHT+_-
WFv1m
U{R[#
uX]u[
syp'F"T
[`ec=
5 IG2
bu7po;
'iH}oV
xKL&z
6}_;&
k80F;
xuQ|T>
N!c#c
eg%~hZ
DA1Blg?TWPU
?4f,K
f\f"~
S.#aZK-U~
LookupPrivilegeValueA
+pbA/
>(i>_
>?XUh"
rc$G''1g'
e7?%K
^JRWpg
N:wL+*
,*O}qf
/kqXn
RYd7'!
l;uo.S
#SMdC
N0J&W
S;_p}
S3gqw
L;1<J
zTK3-
>ahy`
UqZcC
m4<4t}]DEL
^l;w9
+;N\xl
V~2tzJ
xTv53
9a"wb
EIntOverflow
K4@0PIc
:oz(.
Jpd)3L
~9t>U
^tmGT
XC *0J0
O+K=Thq
+Tn!6
"F/8\
0<v2G>LU
+:h+-
jy=tgB
Q-[(G
rKWKt
X9k"f
raeaI
kOf:#
SetLastError
$3.j
S31TL
0va{-
i_=*on=
g]yZ#
Q<F!>
I|5(ZX3
dx I@
k>MpV
J8JU%
b/{1#
YpW,4,
iUK'w
!7WS)u
h\'cN
UKI*")J
L9oHn
CJ%WB
5Ew#+
l,[oh
m-T:.q
*R)QQ
XCYPv
Z{VdLG(
YZ_^[
Z^[[6#k
U:U>k
YpU]y{
bz=0O'
VirtualAlloc
2y}zXV
hT`d~
;E;woc
hcGbz0
n2`QA
7%2qA
&tz5=R
PM,`(
I{TYq
H-y#7b
*:d!6
Gusefq
_Inyl#
bh4H-
@0Vmbt
i"yus
H$q[FV
]YF5G
@^/~P
-W!KSQ
lB~Li~Cfl
:*$`,
7RrPpX}
F&ROS
npU.[
4R6*%
T2?;W*
~1yI)
6i4@t
G&f->
H%O>D
o#M\)_
PA[?7
W}Fs0
23f/RX#j
qMB9w
?'{$_
WH_3z3'$
yjOt31
X1Ct<
h$6o|
pJ|"z
;fjFIv
gSn[35
fA)f(
wt5i[h-
N+A(L
O"@XT
;>;0&4
qc:(9H
IXq^f"
]koWt7K
6DnP2
ekb`0
N<MIk
%'fe/
`O9&yI
nT'qr1
xT]Bw
n+u9H*
zzS"n?
%wdp6
)[{k{
XH cB,
F@P@m,
zrk^i[
@%SLo
Hm{NI
PgB'y
EAccessViolation
GGQ$R
@R,t\
Qh6Ix
|R%?J
X<-:0
?0H|x
~Cj-t
*X\vzp
m+yk}
^'@x{
dN;03
aT|k~
Uh-9@
36:5yU
~~ Vg
yD("O
<:*Fpz
9!DW^
YkNT#
PEHvo
sP']:
dc(Wp
?jQ@s
fB~$,
LegalCopyright
l.+q:
v!z~I
n<*=Y
oS%Of
I>$4A
FUp)X
&W%fV
@I184c
a8GdvAGmBe
cnLa4
8WWY6
<dependentAssembly>
^DC,G
[B,tK
lUi-+
JS#[yn
BZ<O"^BR
->Rc5
E%y4D
CGH5k
z=VuN
X+naU
>Gje=T
c2-\d%[_rh
k_[sj
WD3i,
"%Ay6
)4ks1k,&
a9|20
p`fCw
^5> l
[yL?GI
VOuwQiz
]*M]<
J6H$<d
dkdsn
f~zN/F
a{uKO
| 4Td
k/I5j
CnETcb
kPh5;
:\%H=U
XSV$S
&yBat
.n-J\
k*[%9l
St:]N
i1M6)B
\;vVO&
M!e=4
X.\>&Sv
e_&b=
j0RKM
<|nBk
?%M]&
{P*R8-'
)#{7L
ryJF5QT#[(
h>]^v
y-yO7
U",VF
!Tjmn
M *0>
(UWHH
Ua?.'}h
sFa<-
]Ouubq
:9quK
>u0s"O
Q_Bv;
xlD9-
8Cdzo)
MZUjOw
LL>828
lpjZ*9
CrTlT"q
@$h!:}>
w)ZAYA$
k4*~F
Bu"xXQI
[92HnaT
5$+{db
c'T,v
rXl*1
%Dcfz
Fu#a+
df*?A
sXGIH
t}rBp
[#{Poj
svg R0
~os&uXr1;&
]EgP;
:61+3
pR'":
ZTUWVSPRTj
,UTtD
sGKn+d
F(#$r
6VP<%[7
ICCb?
7>&]?
'0"?8o
t%blW
@r(>`Zc
1+ktO
$h| $
zbYZ
*,csS
+,X n
\@=,NhF
Tav[j
6lrd2
4d-d3
*6De(Q
GdO+B
000004b0
M=u5Qb
\]^iu
'yN 6lP
\+UdGq
~}sQd@+
Uh4g@
ZD9sJ
;.}Ua
90fWzNc\
UO-Ch
^tG\/8
H4^fR
3#] s
d3:Md
;FKmJ
s^M.4-
/k`)4
ouyokm
C<8 Y
jV^(I
c=j}.
0NkZ0
[nDWv
O#,&Y
4?*+3
6\Fe;K
8^34Vb@
h(A@S
z2&U#[
0J8xi
Cu+.7
:H&*/-
bX$tw
+"hcU
:x}lP"A
?_.b$\
PiuYY
,>[)U
EaAF{
sV*(&
@?pSV
1j8HU01c#-
JDC07]
E }q<
I~fB8
Z0SBB&
"?H}P
; -XB
<!sTT
VQ5++t#
IAiYx
"fc|VJ
T[I!g#
rQp3'
0&#C/
<<YQ*l
}$cLF
s@;eU
Th!D8
%eoc]
)pNZ]:?
{ii6p
L]pmp
FV0z=V
}!yY(+
q&}`0
4x+kF7
H$ceH&f
Privileged instruction
:]~79
8$FX7
XCZcoY
h%MYO
TcN4U
XLUQUM
?S4/p
^B9h\]J
2hqQ/
GetSystemDefaultLCID
N QwAf
3a6-r]
6$oAD"
O]Xnnn
* tXJ
CVz?N
\3iH`
6a;GZ,O
^),}1
UhH!@
DWI'_
!Se[T
!T/>+
BL-ZG
"'6h62\
1F~,i
ECompressDataError
JS- /
,u)kB
V~u3A'
a2j8A
NR2Tm
_h"k-
_1|Rw
@Kt#(
(t)Hy
hr@tjId
CGS~U[o
6$Z \{
XE8(,L
nx?]
k}R]O
41%tQ
L>}m1?d
:mV=N
+XQx >dJ
>i$Q@]
S(DE0;
"&xrHp
W/`f1g
k{qI>>
!@nFO
0 j-f
f\aVP
WB+ByS
zjKOl
ibR"8
A2IEC
\xy!G
y:6Et
$Iwgl
PE>cY\
M^57;
lmYip
CBFHD
n*Tm=
LTX`J
?vbrx
*7h fi%yDD
>5ASQ5
DtGR=
|#8mA
5#nSJn
SOHCx
Kh7dT
:A~nO
9e,a'9ht
@|/F;
fg/DV^}W
ivGuL
xv't;pi
bf=yQ
:uLmp
f1\8)>
5Xt KW
2>i]_
.zUwY
}t^)=
T1|xQ
l_|O45mV
!oF{dx2
Gk.V&@N
|mci}
*x-pf]
u/_N4g
bUTZz
)L5ml|Be
BNv}7(&2
ohl$`
/_40r
Error
5p4RtW
;{jF[
QFs0AZ;~
e\s2O
M[&FL
3l8Bz
16@~+
pvaSE
*{{?;
x]~@K+
AF\a@5
?z/4uh
2Q8!x
ghv7r
j!bo0A
UT{7`
R&WY%
YMRnI|
]4_0W
B|?c[
4|r5h
p`ag1TvP
ptg<e
D.#mc
!*K;3
Uc}Yd
&`!4B$
6/mHD
5NK-s9
dD bJ
FhUQ5bi
REN^S&
2pcse
rRLSt
x;COa
'YtG)ktB
jjjjjj
x?\+%
lzn'JN
e-X:rZ
cy|:}R|D
$\@j(
f}}{-B\P
BTEkRX;
l`5]O5c[|-36d
GetUserDefaultUILanguage
O):E9
O5UL%TSB8
~y^P!
4TzrWjTS
1nXz1
k,.^K
fG<clu
SHfI#3
.+>!li`
x5(E`
EnWv F
ae:|'>
TH'3[hn
Pd@7Jy
3Cwr/
~]Ag}
BL]vaU
4BJ6v"{['
O@eF<
vs?*HY)
HZ`Q%
P1[Zv
?5><9
!n:$EN
w'w&G1
x3yH8
/%P(
Cfjmz
rTNL=
j'jG>
QyO,}=
v'muHOG
>P1!>+
jYAcz
qQbSN
R\^q*
f]EA;
,y;I<
ooOOZ
l]ZOKR
|jP-0
LCMd ,
jELEvv
Q/[*{h
3}7O<
6z<uWj
NX;d}+]0+
w!sof^
;.dE&
8/*@D
#$8!+
+92jR
TN'Z\
!QP katN
^GB/@
59#GDS
kfC}+.
XeX7G'
P%2z/
NF}%1B
/eJEO
3`Dhi
U<%4xK9
VariantCopyInd
{f2LY
+\t'>
iF2]Ynw
4PXfL
t1nb"1
fT>?Ia<
X,%i}
)\y56
JWwz\
$OPOK`
5II3!$
zI2(}
7?!b1s
8FR{M
pVW~Nw
(V@.DqPu
+|7:.q
kyhn8
.xLI\
56v~g
j3V.O
uGD#6
l?U ,k
>ux\L:
9!{W)
jV<p)jo
%V0%v
DA*{ch
vz`~_
8{(`7
l}O!f
RnPC3
jQgBb
0OSjyG3
IdOWkR
;U5ue[:
@C9u`am
dn~N ~OM%
-&R*g
yMTeB'
A:ncc
&l%%?
`{]_q
d0h$'
N%5il9
5d4s-
6o4OAk
\ur0qj
\o+[(o
4JZ8y
Kx0f;
|HtE=
gke|`
?25I
y>iSRDl
$h5x\
wmWwn\
e8Fa]
+2%/5#
{!D1zc
jUam%{
*a->5
w7nTz
@6T|N
gMO~b
I"{yn
`:>b/
Okb:+
<yRj7A
<#t'<0t#<.t
;ys2F
IDATx
9`j9v$
CzWzrR
Ey)Y!Z
aHCwa
uxQ'Z
;q;dp
!(x~5%
uS3W-
u+^Q[#
)(H!n
SizeofResource
t,+*t{
]a)L5
3SsZU4
gRObx
<Q?xD
8iZ_$5@
@vJ>#e
s:l0_
z)P'-
y6xyj
PV(KT
Q'NJ+
kJ3ju
Y}o<=
@[`VA
TyBf d
D[VpS['
HMz}=
^'"9@4
7xn^+*L&
WsB|X
IH?>P
7Dmot
x8Hq~
&Rcb6
-YSW`
L5x:C0t
zsw_O
oaV(U2W
8lMwK
/#A\M>-yg
,zuEY
cz;Wj
September
Stack overflow
#U\Z@
u9Op|
%y;N@
f/wgg
n>YvF
;?wM8
i7<[H
-CQ@|
Ww\R&g
^uUv7
zt'Qx
q~a5+g
Y,f!$
Bx6wX
[y=s[
.,.h[
qcxftr
Ynn[w
pH6Ff
dXwD%
7we p
TxK=Y
$9=_7U
03`*!
25,"2?
mpdbc
z/Z'L
]V0o=
WideCharToMultiByte
{iiIEz
Z}4;XL
VarFileInfo
9\?E"
GS`\o
?d@N5>
N-GfS,
p1]2Y1
8CDW4/
gx|[.
C&&.B
EBQY+`
s<&v{E!
XNA]*
)21lo
shfhi
sF5~?R[
8a@7P
h+O<JD
5b_uU R
*9g-!
]0wi'L
9Eg$P
u2_<Jo
[R1(qo
%C;F`k
z^[kb
.bOPNn
M;Za}
'fdDB
5ra8A
[>;&#{_
iQi"K3
^"%H9dJ
RBh?!
hbS@Z
zTR,E
C1%[<
Pqs6$H
gA x@N
F@*\?
sLB8r
`fKkSSc
l$]LX]
EInvalidPointer
6SdpoP
W0::?
5*G,x
RhRpR S
0jI`u
pRR_(
1vf(Sx
/QZk[_m_
[[]dQM
\25tY30.
HJdDe/d
c(tsR(
,Mcx"
2,)l+
c:ab@G
%.as=$
l&W_J
CLYDK
WOsfYV
zg21)
^n2DZ
5<Iq7
z*%<?
3?b#I
*0XI
[R^m"
z1x29;
;nm3
e{.Yj+G
D7T/~
_Q} WiD
Fl\v2
k{WV8
{e/ug@+
GHtDDF
2>foM
DeleteCriticalSection
pZUzB
$MG,n
`g`bL
-SRQumO
m|U}>
b\0-)
G,4lX
4|tec
qY&g*
q8VGJM.o
"Q9Y?
s'D^Z
1zG{N~
ClassInfo
K?DZ'
WLP]V
_uGN7
w;;t$
%@e|P
o%!7i
SE)Y+
Y9Fo%
T=o&Q
iW&]^
NBp:|w
Wfx#6T
5)_<_
B~5eK
DLHdwTp
r1_+C
k{e+H2
x5?4^e>
GG(&yO
<$6wV
*+Pp>
-"n.ll
1{V6$s
This installation was built with Inno Setup.
#;YSmnR%
}7my9
?.2q*
r>"PH
atc!%
{zsQzM7
oRa1u_%
pV,DK
=Uzm<
5aV&9
1aOkk"
'@6tFH
w4ckV
pY+lxW
publicKeyToken="6595b64144ccf1df"
BV$gi<
}^b3^
}yq(Y
se3t7dg
YW&'o
g^\#)
cZYs~
@D0Y&
VP)Xr
,\=y+
\&E|eQ1
2t3CU
VirtualFree
3#PANz
0WFb1
G@sbQp
Fnk_CY
BuAMH)l
'1~B4X
N;+Re
+a/Y0
P.rsrc
9[+]i_
rLH{G
p&0X]
h@rB\
`KDS+p
{CrX[
VL]x8
h=FJ"`fF.
0ZHSC
Wo!% u
G!zno
`LH5M
&h;p)
"!MAy
k"fWD26=
_"SDY
a,yP~}t=
QR*k-z_
ROjkN
ncTDYM
uB}Q"
mVgRW
w^R-9s
azGw>
g6*P}
PqvNkzk,
fQ$y.
EmL-r
+Tvj%
~&Yseh*^}>b
.5+:@
h Ojmh
Thursday
S\D<!
W;(!F
&(>E2
XJQErq
9g6[e
byyZw
[ytR@
December
eBOY?
hz%,Kl
bUd^@
D8eO?
wdjce
1.0^=*
\ kbn
$^61(
PfeXJ{
w^Q!g
;C6<6I
G1CRrJ
yz]iec\f8D;I
?r%Kp
Xvrqb
]0RWs4U
eDonMUc)+
;Dkm5
6,okP
HO;l4
>NJOZ
I3RjSk
6^~jO
a`k(c
6PVXC
'?doG
~AX0!~
Qo%C6
mS5ku
"&9LL
lN6w6
z5MBO
9dn3O
p1s.*.\I
.!?@m?%
=B-RN
ObPwog
HW7oc
^rv&F
nd]Es
Z__u,
ji\}Te
*^Wb&
pn>Z3
!]*,|e
8t[gv7
]\ihj
tIl6M#O
wJ9`rj~
fY!XK:<
-x&'mK
vjH_R
</application>
*Q\NUo4
y2s(uqH
z}R2d
u?sMWEc?
$aQo"Q
:@X4*
m4wv
7~cg/!
No argument for format '%s'
Y=mj;
\W{QzX(
#VF,V
IXesY
LwE|_
yGq 2
>V.nUd
aVFxSP
tN'-'
aG <n
>@rEcB%
PpXD`
MI.@P;
P5rmNo
.8,yC
n";/D
fT"$0U%
j4fmRi
/cvQ{.e
X@R=*
|%n[9hqBsh
q$,KB
378vS
ME}m"
LN,=W?t
wl2kJ
$IUxA
~i,{}n
F1\Y>
O.~(z
mP8Q!
s`lx)
BGU_<
},*t2
yKxTB
[f_#[i
SR'bS;`
[,0PzA/C
ljR|R
AMPM
NkT"S
on}'M
F@.Q6
DJU W
1edst
lDUgS
sT'eM
V/;JO
I6xQF
\2QJ9
s?cWE
|8vt/g
)aU.k
Ct}KsB
*IZS>
.0kD!
gZOjl
U7?:X
mJ:I>HP
.Idfe-
(E*Rt2
a#yf!f)
`{O82Y
s(![U
oA{Fh
April
dpba1@
j-Z~<
U~0WX
6;TEW
e`y"f
~k5=@qN?h
=fBgq
1#iD<j
ejV~\fX
evZWH&1
1}ec:tS
TQ0JG~?
9jHs%NO v
#Yoxd
M,$/lI.
49oI0
GYQmT
l+L/Ro
AJoV`
G\`Vi
S5PD%
y`V%N
9<I]\
}[&E+
Q*DIS
ANm^$
Li(qx
bJD k`
5}V GbL
,pjn9j
vu?#o<
0EQSg
<windowsSettings>
fO4%eQT
JO.!7s
-Y;[7
&'(l|
$]$&s6
u24~\U
CQ~+R
iwU][eK
Q_soW
1;]Xx
!nnxD
U.]ttO
.xqf]
llkj>
/UT^
[Q0VuH
lY$o6
1=%8a
<z_"%@2W*{
EzV!%hn'oNK
(~!ms
9;'I/6
{T_|R
s(u{:
ls8g"
(zI5"
yj%7]
mK00*
HCG!aS
</dependency>
|^nIt
E3Ym~
Ht Ht.
.TuoD
]aKQ
!^h;{
9MIP_
$h'J%
G^gUxh:<
J J@^
:WlFn,
^[oan
'V4U7
Ii-'h
Lr@:6N
Od)I-|
ERp+I
3tgg(
?I}&x5
fXW!kP
QUY]aeimquy}
:!,lH
4U>HM
XOi+~
QT9{DT
|f~G(
J=]VL
-<J03~=0
LXR7>
S98|P
\25\4
K*i?"l
nrS@?
oBxM3-r
c%0Z1-y
E*KK!
%GMEj
IUi-1%B
PH}4K
*x;UW
6eMwt
;~7QCB"*
rF]I6K&k
3Xg"!
Q$[H1o
sU!^v
Q7=;T
mZ^OQ1
97zwV
i6>'*
';Iyar
IJ{n4K
)&oAH
?0|aFO
X};Z!
U;P}Y
,^6sp;&
q^nJ[
CP3g"
j=IUjY
?!d@ic:D'
=>=m"
.p1"l
nLZ:d
8!8q1D
WZe%=
{)2X}J
,IB)c
}0KLa
@YaRD
T^h}iE
'be?).
Qz'G%
>LyxC
@9a:e
]Myhu
o@:~}
InitCommonControls
-+oij
H[GRgQ
UxR9m
E6uJ3yy
F:bm`
$_piC
7X7AN
T~7hG
d7mrlO
W\|x#
!.9*(=
0%UHsC!
4^}+Dd4;!T
]%b8
wv|n{
y>Rvb
x>wH#
BX1p#Hg
Un09a4
Mc7=#b
Ni&V"
2(ofg|
iLRz:-
InnoSetupLdrWindow
oR~V%L
bHI"g
9i5N.
Lyt`H
4,]"#U
.B5[.
e.gT>
; )3k4
<y9/B
;{qA_
IXBxg0'
"Ap\R
tv&?i4P
H<:W'
8fV3b
<C=7h
+AGz>!
Q<7C%ZAS
V+P0>
[(S(j
-bh4"
vYk+K
}|w"d
P&6&cq
Z~sU3
^m>-t
N,h[H
oB\oD
mEj~'
vgT6yx
hXm)j
9d.CW,
aKPi/
;E3qJ
?_&f;6
4kS'7
|99Oi
#GF[Q
oq4905/
m1|"x
VB{7^X&Dv
OJCB/A
x<^O7
P|Yym
@UZ*C
MT&Np
\wV"n
SbtOo7
=~_!
=~RS!
Eku]o
'!ne)w
>Iu*f
r{1zzDP
7_3t2E
:mm:ss
yL4]8M
>&HQl%
K4rqg
4k1d0
T~+rd+?
=6I2)7
c}PmS}
J.QhJ
AjGN}p
M?b+|
-ZJ*p
!pDr?
mp^jd
!PEyd
Y]u9GD
28),d|
nXPP<
*"v7W
CreateProcessA
?]oMq
{h}C\-
eRh'(cY
-+%/,
>Q6q=
("C,P
W"eR*F
+=ES0
JA_lrE
vXrW!
$*rTv
p#h<(
DRHmy9
Q6kOVa
V]G$)
}t3Pn
ci[?>f
(R;KR
ZjpKA
A?@<H
.!v]f
^L'!?$
_UQV}$X$
QTCg8
6JJ0c
'R|MeJ
Jq1`K
nE{,<?e
[('}V
Fpv@gpL
Eo'#M
!9T,u]S
B<&TY
HoQTT
x<s V
Z}o04y
w6/s=~
c^+25'
ByjH3%
8DL4/
Z=cBw
^3j69
aLey\
?th]U
> X63
*<S}w
2wag|H!z=x
QQQQQQQQSVW
mCHg}YE
HJF{]
' t|0jhc
$im]F
%;%#"r
$)B(]p
g\A<6
u3kuu
+XN,6
>~VKh
4D4SHs
]1o/J
00YhN
~`CVe-}
BwL)ZRyf
%N,CSk
=|F>#VXG
QcN0E
,+SS|
dIffm
[2{fd
bX7+z
kKpw9X
,Owa<
-{a/g
cZ>A+
f|G)TBr
];_oB
X5Lh6l
_YF:g
h!?rTL
54>?u
:[y`H
0w='n
EExternalException
hU,`k
;#*ik|\
;/a-2
QEC)3Wr
;8ht=1s
</requestedPrivileges>
~%tc$
2x+L"
V{iW@
/-tj%
62NV>K
a4[|^
#F?R3
I?@oF>
srCy0?
8 zfY
/:37cIM`
.U(zg
yI;_y
)I74c
F.TxT(
4%7k~
ClassName
vupFz
|mz_.
b/Ov?
9#Qg@=8
H5og(
IDAT{
AbG u
<assemblyIdentity
>R`I{
?z"B8>e?
6!1U]
Q<;4"/a
S|dl!
n>b|Ws
$e+M`
Uh$j@
1^7&AP
/%L1)
[m[E^
b4qS"m
&f(euT4
3=AC?
;ve<r!&
(O!|!m}
xMrfUg
~VRQ#
x<)=r
f=s{"
PfN=_B
;5auQ
U9BDM{
A?>eV
e459B
12"11
=/_M8
g78=v
7U.w
N2#]To
UzEjJ
dq(/B
z{T5|,
3XA-N
X<Ags
1#JtE
aHF1Z
vyeIw
AHC:sHj
7b-wU
TCompressedBlockReader
n]kiOJ
:QOVG
$WV/T
-T\B;
rj!cc=
>]UQSX
!1P/*3M%
z9ZyQ
4oMdv
k{0+v
W3*0a
s !c0V
Kxz/`y6u6
8]HaGA
l.|q~
=s<y\G
MMdmR
t{~hi
$dr"Y
2S9'~
2F< '
==O%w
>w.1T
h,#jx
t3F_xV
"d!t*;R
M'.]Q)wQ
LB}p@``
w_md{
P~:u.F
.r1,^
xLxu{
GR`Eg
InitInstance
$Y]"U
_9FLI
qbScq
|2/iJ
ZF[`G
?0eIj3
" PA`v
6DhP)&
7]r//1L
`w:@7
'KN_0
Vm.WH
05~gQxY
Pf@PM&
.]?@X
8$Hs`
!r0Q/
b@[tx]
VGffX
AT:xm
66666Dcccccd,l
_>C%h8
{\GtI
8_;&3
wQ_Tj
6Q8Km_
5m#Wh
^.O!6
$ g@-
~!Z|z
v3]]}q
JmR*V,O
:1:1;
Xd4Nb!
\y)\>u
hT>\I'
n%-uE,
Nr&BN44
HJ3T?
dL+L[lA,
5jFx%w
<LDPF
WR"hj
7d\ C
Xh3`J
F<NASn6
r9$hN
9Xal&sV?
_::PHg
9HlM\
P[HgC
f.41n
File I/O error %d
<ynt'
b>U3(
T1_K;
55U^v.W
vHVhQ
|Ak e
Inno Setup Setup Data (5.4.2)
-ccBH
z|&w|;
7K).MY
Gi\x?
+5kva
YZl0K."<
_^<[J)
4FVH=
s[OA9
$\HA"
#77@r
;GmvB
(mT!"
"j@bu1
OG,b%AI
+HaG[
A(q&"^
NKW-]zL6
eYU_UM
3Zs5="
kNyi-
=)kd2
kCgMU
M!01~3sg
@\4V-l
a{)7HT
Vk%Nj
LocalFree
.*]uQ#v/
vnkHs
GQ]HB
0.*}\m
l-uQg
cNm^>
X%b`K
(ah'%*>
qt',)+
]MOs:
LqrUQ
Vmh'K
Translation
H\S3`
JQP;!
tVSVWU
3LXV2i
n^]<(
rSD'4
P*]xJ|
TGr.*
X,[pw
lPSWk
&-Z5n<1
6Y}"0
GetEnvironmentVariableA
[aYl6,Yld
EOutOfMemory
PCDQ0
+-2yOz7,"t
##wDKH
b,b#'
R 4R9
bkV/T
R?'nUL8R
pWo,n
0%e@G1V
\nr9f)
c?s\d
+l#Uu|
4'b;NB3
IPU-I
KM#a&
/WK6J=
/@cN/
Tr)s)
Q/-H4
U!9[jC:9
/:`#3S
2Hn(Q#
suUJZG
D4B"p0
u5~v0
"9|^4
0V*
8w@/z
9\Wd3y
u)Dl'
1C,1nXF
= 9pzpi
-:5|Yxont7
Z=y8V
e$@:[
p=%9A
J2nO$
a-_aYt.0
I3i$sJ
ZPzv~9&
'4Wc\
UJj\#
t<0@*b
G)WLj
n[lW
]5B3R
p4 8*
gBpA,
fP*\C
i!.9f
L"]pHb
`Spd(
:oKw2t
RF](9
?u8;r
h.]l?)
NNz\~
MXST`
.~T{B~
/L7~.
:{1{[
Q(B[I
WA\lv
fkQo,
6P!tQ
rB-(R3E
\k8L_
GAuJz]?]
9>i9Z7,
/bK$w
4&ixoB
.c'*3%r
iUY6<
W(73I
!%\Td
.4NDM
(-=X<Y,
\~.1L
'$K~+
q$O/X
`%7R
[F16Fn
( jCb
lUPN&+q
pG?ih
Lt[Zo
$0+u?
49E8~?
B&|>/e
2`c'D
MethodName
FormatMessageA
fXdSb
_Y9sjRP
lJdJy
MD{]a:
kE:ng
name="JR.Inno.Setup"
yMl ~
.X?jP
*40tj
BlfO=
n_AU
ME* i
p5DFi
]fLF5
tzk9y
e1oAbZ
7MwLi0
xCBW&v
(fQ&#
ugBJVU
~i.1P
96=**
#0;6sRc
jlU7\
p'0Qh
VRKCD
(c) EZB Systems, Inc.
]dn{,
pB!&k9
Uhat@
`B<e"m)
8aVx$
8Lu%Y
OR2,G
k/oBu
@r ml
r*x;MZb
$7IjW
?wHk_"
M(Z_v
A.!i5b
(SLty
#A!;#5
=0N4s
1@vqt
&p bN^
abc'nA
cY5n=@?Y+
yH,+1
'6-N'S
[mS--)B
Zv("]
soSu8
7{}'U
*8SmT
B{'y>
4Jg0rP
_Ir+N
v4j<_
WEUo.WU
#2/Q$
xPRKI
#/Y"Jd
wf#Xu
U4}vsf
+yp^7
m:Mt;?
%/p`
E&E{`
qDE.4
N/\OhU
P9~gcy
Kd,Y=J
%L2Ph
4'A.\
^}NmJb?r
_YpWJ|
8y3Rq
zHSDw
k^tTl
{*)>40
Z3b^jf
CqxR5
ZgnbRt$
.30Rc<
Ph<0@
)z lZ
gay&o6P
L&]F3t
9$U?e
t2W1o
_K*Lk
ysuNI
g#Jb'GP
#40$lIN
)y^-p
CPFq:
AjyQ-9H
@ A],
^kG;D
@03WIW
T#eUWp
CreateDirectoryA
ULiS^
F|F8uf
eC:/|k
sZj=}
_ZqrD
INruJC
`?GwB:
/zQ QL
oux7,
?y78!
B-MoX
9)bZ,
AE*_E
OpM-Z,
.6)w&
lR' i
i\}]*
E{/>`W
V~Tpf
Vn7s^
N:pWG
3Hh`j
IhDbz
MrINyu
/acl[
7aX]v
bbhy{
iCs u(
O;N4NU
3)ebJ
<!T2E
P:kZz
;p+li
|!e+G
B@5WhL6AX
DY--g
Dxk5'?
nsD}Sw
]97JS
)Sv|`
+Q}~c3
S7?x#
7@ha{
L;/nD
`vo@H
@<:FV3
|O(Xf
'XTu$X6
y]6rR"
S70gkkk
p%rhK/e
]ww7/=
The setup files are corrupted. Please obtain a new copy of the program.
</security>
/^\:?
\S^bhbJ
1V;{d
@=Q?sx
~xc%J~
YHJ3X[
+{i4M
\9d';-
KPRuC
kG,CC
ein~T
wWj&J
w9|aW1
:d\#un/
v-n@T
4(&Y^
}6 "E
n+^"?~
hlfKI
OV:.!.2
'V")d
ceJKl
x__|B/
GCK@_w
~?<}kF
i@O]#
mQssy
1B{<&
Z?>W_
_Cj|%,
1N&0q-k
xXTuo
nx{b'
ji2q82
ACy<:A
tY2xX
dZh0#b\(
aOo4kY
b92_Z
A'>~]
v!Mr8
i}BQ8]
"6i1^b/
(^wUV
z}Ak4Cie2
E^gp4
STATIC
1)&dK
Q$jqc%
,f/-M;n
|w^o{~o)(m
'`QIz
?1UhO
)?Lcm
3V4Mw
Npw[%
)e2Y.
:KDR~
xJ>en
rqj16
L[])j
EHEMy
AypfF
X|f/6
p8=[CBl
M*Jku
sAs;MsN
%`c-c*
#Ah=g
^<J.Jdb
F+^8$
t0H{t$
Sa0eB
|7Axpv]
8C/a;Y
aeC!Ss
34P.g""
ZwusZ
[B`g;
ARP`{k
Hj8=|
~LC+s
\|<V<
}Z^MMp
[Yu2Z$
IM4n:
ECompressInternalError
ZOCd'|Y
>7X}:
PXkk+
E32JMN
~*!iG0
R@o#)`
!c'^.4v<
i;2Df
rj1xM
%zCL;1
L7[EB{
)`Hi9
Lcpqu
!>9PpZ#
kJsG@
F5t7ZEJ
a@Zn]
%7F$#
r'1uh
m!M'#q
[.K>f
,VmU*
mXcu#
1oD[G
LoadLibraryA
/ $YxX
]O+=[
*nNm4s
?#!P.
Sxn(`~
&E!iia"
JUlp]
Ow*2[
yVk;>[
N\h~ `
doD[;
Y+;%%
Ebp@_Y
=gD%,#D
TP9P4
;!`j|
h+:1x=&&
L#QWg
G^tBh
!>`a-
t/ZbO
4]y=j
.Ur8Py
/\I?'
AlQU.
]CLqbN7
bJWK9
&T-_d_P#n0
S]5GF
nnPfoL
Vy#$d
R`:7R
9N5w3
@5[0!:_
I>^#]
k}|jO
F jb!
PZ!_<:~
~7E%f
!/o5>
1GvjSb
5fI_d
]n{}J
fl9dG
WdB@2C>u
Id|MS
?I> w0
ac-pzmlC
{SobJ
#zMs[
,DO;9
D:X6(
Hq7b)m^
ee<Hr{I+cS
>"o,7
Ti0&`
*'p]q]k
5Rs*i
#v+vF|
QqipFt
DuWCm
6m1Zw
T575<
h5aI3
kF*tK
:S,F*
s1Y<BIa
%?in%
<,k>C
JZNTl<
eyLc2G@Qy
VQ'$B
]cl?|FZ
O?k^=Z
zJH9-
a%2eg
kA;g.
0fB|S
(ht&T
}N@&|
@4cDj
3HhWb\oG
x)LU#Y>
"fE!;
c97R:{
Kv+!*}S
xIexu
FileDescription
[1 0h
]W]q,
7{2n1w2
`9SLMj
E%*K4
k=,AK [3w{
*m?vs
.-.r](/
FDd1Aae=
dakA$-;1e~
TJrEfIL
+o|#ja
%uBOd
Q0zj=
<:T?|
S|&0@
LlHrr;ok
XO6Sy
Rvy`p$
@<QZ5
d]Akl
9uL.sN
A,WjR
?!<e2
processorArchitecture="x86"
sRcF$
<description>Inno Setup</description>
RR6eJ
version="6.0.0.0"
#;3)n
3GQk*
`I<e1
I\/*z
IsDBCSLeadByte
@DEBU
(mxvq4
$X{vIy
xqVwD
+?rzc]&c
.&a-iY
F&^x1
\A}1n
C&A@`
c/('0
1aUP}
j(vW'
R*@RP7D
HBG|X
qG"/8Q
gw&Y9
Iu}b{:l\
v\E:5
5>}eA
$^#`E
vO&pG
p(V\E!
:WXK:
iXJu?
K^VaQ
+/9Q;D[
ZkqXuol
2V.M(
_x/Dn
kPhj@b
FT!N"w
D2!&l
+zy;Oq}
W5G%6
FKuBt
Of\GC3
`!A5c
wVV9G
kN&U=l
e42 w
HUr&A5Q{
o'p;`U
V9,V%,
Qa^QK
M52=G
w7Mxni
GetWindowsDirectoryA
EControlC
KA&kB4
mc:#o]
yF;+~N
rZ}9t_
bdz01
M46_N
rRf18
;66"8
*XH>v7
cqag`X
Range check error
w9lum
!f.HW
O_<:[
A$[nc
#"C/u[f<
^%?~J
BLi53
P2MUff
!{,B"0'
l.FcW
WSA`\
Z[DUf
7G'rUm|
s*B:,
sOQMIX
HSC%X/
h1Ly1
5}yQs
%7ndy
LO|--
e*z]/r%)
TH(e!.W
a'V &ou~5
ASpkC
J%mSw
'ag;s
]Q\3ER
R|K? s~
jyR1$
m}6SJc[Be
O2,1w}
>:o+[
HG=W#
zopQq
JDxPR
2V"^H
RtlUnwind
~8:Tf
qn6Hj
:EL>I
tm"YR
!V#2_
'(]Yc
{a|x)S
'A&Rc
V4~n*e_
0s4/2
reMPX
Jl^MNtxQ[
:p;%)7A
4[gEeT\
8l050
x5*:2
1j_x!
=Qd2$UyG"
y$ V'2
B{$=D
&_WEx
N"MP(
0$Lv%
`F=OH|
JWK*K
EG#$^
%WIu|
kH)+&
iq?-#EP
/uFC@
"8.f~
(bz(,
pX'vc
;B(u.
Ze%>3
fSLar.
$H'tR
N36++
<<]]A~
/p`o^
!dJ=4
!B0QLu
P@%6J
?@y_3
{UpTH
;IF=qZ
6, Y@
m\MKW
LR2^_
jq~qA
Tbk9d
D rA(
'I!(!
DxAZA
FreeInstance
;67wln^
G`9}T
0>-Vd
VG9.]
n~t1\bx
GetFileType
7]<)@
Bk1wM
T;z~[j
Invalid filename
l$$Z|W
;*|LR
>Q[l
,q0I,
1nA7g
cNN2j%
^Qk\j
:[axIVlX
}A/FC
EPX@|/t
~p7$9c
VirtualProtect
fD;Hs
!CI2v
Ne]2C
PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGzlb
Y4w]/>
vWF.C_W
,69Y0
X}@f3:
-M5c-
g!.(7GD^(
QM8R2n
brW;Z
{VdC]
/g>uX
Invalid class typecast0Access violation at address %p. %s of address %p
INxW`
OyKZ!E
7MNekE
'0$%,z)
iI[Hp
Crp_K
X}p_LF
4^|J[
Gmgf=f
l.Hj3
xQEed
h__[,
*M`ib6\fo
5%bhBaW
MessageBoxA
]e}"V
:$cV7
iq!m2_tQP"|+z
XLR2SCf
RQwFP
yC9pz
6CC>t
#3kf3
j[t-a
;ruCp
9#qsi
LoadStringA
5}HkA
WxA!({
Zkj[F_
>F`D4IF
/1b(n{K\<
F]m:~
E5`YX
Q9[(qD
VsW%Iq
5!?[g
w,k8Mk~FW
8FKb
?AaaRPB
yf-UFu;
E|}z+@>L
@tr.]^Pi>
Ag%i'
W9wA@+
_1W|w
W;z\ e
sZ+*#G
cpq}r
!2HYc
1j_MB4
ffCgv
*!dZ6(
Ux&.Q
T~/DX
hQ;X}ens
c__Cc
~Ehci
B/$xmQ
RtknI
~x9{i
V\C["
;Ax&\
cbW(0|Z
Lb>m 2
!]Q"P
~c:Ag
RW~A\
Y<Q:u
lKrK,
N2_58
lN;']
|Fx"U
Wl;c7
ySU*(
aB{2pz
@{{fc
HXS?Y
{?cPO
mkS+'
cIJ>k
^2jP\
fyGo
$!Q&]
VYl~-
EVariantError
cHa>9
5&8Og
h6\k5
a~`e}
#^+y'
Z`.vg
WF(w0
mhxAq
ipf\]
K;%bR$
Jqx-tw
rQb$8!/
-7s*}
U?lY=
,BKk(
_a~^)
c\2x9
uxuI#L2
$v*kV
;r#%E
M`&B^f
R$?j6
#J3-s
vL`O3
#E92?
:D?G9o
mamtdV
8wI:i
Np's)
Ug{*k
q@,v|s
sFRoF
`h=k:
c78hW
dTPK_
l:n9b
+uKBF
bn(e;
!&ypa
r$,B%
MQ"Er
'?{JTe
JPeUO
tn6l}
q"">l
c%StW
Dn.YH
H?3A-
y0XdV
+7c`X,
%FFLP
#&!(1
59fu)_^
9bYf\e
kmsF_
U?bN5I
8h}Z:1M
6H2l.;a
q;',>J
NZT+L
.idata
.X"1VbX
TKI'~
f0M,.
+)SAc
MGKGo
L1M"g7
!2cz9
a0?>o
zfW-h
N9A 9$
'9R@Be
q[p\J
Eq%]b
d/QK1Q
elEyf
7W3i!Ad6j
Y.p_W
tCg(h
)~8PHW
PyUOa0
Q,6Ki
]8$ _
]*2b0Z
n8M>c
~YDKo
}$pC
C^,6;
L:I}~
2f[+=
^xbko
Xeg{-*
)RRm|
'\n<G
InheritsFrom
kY^$L
,&HGi
5LL)/
kmdfC?
pm,-*
FMjFl
,Y`,v
EIntError
Kcl7i
"go#%
zzSF|
@L4yH
OZ(q1m6A
h)IhC"x
g>(2+
[RB.x
EYd0/J
uk]|Y3
External exception %x
n~+8'
R'T!_P<K
GrPE!
TZ.ai
yJsX5Q
2p}"Wf*
)hy*{
^c"Gw
";4~[
$!l5>
hgO,UX
tg2*-
/oSDs
:l!cA
ZO's|
Wh1P$*
[PNRW
TM8%.A$
)sD-6
p\!'(
O8>.&8
TD;9C)
q3ir!
7SuLt
^}n$Y
phfnz
(Lq'V@
+ET0d
LDUjy
hp4f
TKkX.
#&8XM
o!;ay
gC-9-
%D5ouj
aQU=X
+WN0n
bo^Ks
@NB}y
IyaZY5
.qM9R
om0d/B
W!]7g
,Sq"+
\V"r6
.PHBV
c-u"2g^
,Md.@
CET G
0hfh0
vzc1IsD3*
SD6[.
CQ|dY
ZB>5rn*u
?>Jq)T
+*><s
9kSO"
yFt|Q
r9(j#
BlBKeR
&YEWU?_?+
Dt01q m
~XS[x
Fwu!r-
Vd\_#
TQK95SY.
Q9 @G
0Q^pr
R][/Of
VirtualQuery
M)]U[
N3zA~X0
Qh+&D
b>?YW
s~E>HPQ
bC)4s9
h<q@
*T!PZ[.
FindResourceA
P;LEH=8
_^[Y]
Mf&)^
%?@;9-
}wEVF
q8w'w
MF7}a
!'3Jl
5[mZPz+
\+-I6
-zWQ:
YQa~``
T\AH?
m@P6b
&+43V
O^ZaSi
!)ooH
9!(O
]EpqB
17~, &q
|j1 -
%~@S[]
uz{-$
dwU"\
~|nL
^88^
(!<w^
f|M}x
F}88s~A
!mBp!
.rdata
_Vm~Fm
b#`)J
Q+~u"9!=
,|w(~n
{u$.]
t7(v |*90
p3RQW
}eju2m
x6H2=
(eq2Ua^
R<T!N&
Yuk[W
7T$]OV3
U:*h'$
-24{m
&Pc/_Bt
<assemblyIdentity
_g6(4%
8nZ<x
4"XPi
3?@24
wm>8k~+qXJq
.DEFAULT\Control Panel\International
xEB9Mr^
J[M.^
<h8=z
y9s/>
Z,@8~
5au*l
^m[:A
'x{p8
tk+>Iu]
@AkQY`
}|}5!
M'->9 8
Redkx
.y2}v
m>}r&
Comments
lmo{=y
Y<)s{
A@}0Vf
AE<BB
48@HpV
cm:{.X
.%:2mp
Km`e1
F O:@
OKIlj
Jv35[
3UMj5Y
U!o`1
p&I$1I
{F~T&DN#
Z&mtiT
[PRO>!
H\.sc
HO >;+
hOsUi
)rel%
t<HtH
+p^dP
~6[^E
f`sjH'
"w-|u
IVQXP
0UPRD
sf(H`
IG'\5(
)e^:D
'WwV.
PVtB^
Jt7#^E
Y)(~~Cwk
,"&6H
Zs(Lx
x8~jh#nxkM$
EGuNoX
X}qT)
SetErrorMode
mGNE^
]A4fC
})6I3NG
bTlP8R
{*H44
\pjTn,,\`~
MkD{c
&X'na'
Z-7CV
\4zl0_
M5k0>(
LCVfPZ
TE>"_{4
#jkO]
_v/mI
DRWD`
'`uv!
12,&KB
_C?d;
File access denied
];8V3Cs
QsLL3
+vIRK
f"UrQ:
Qh!l"
j*AYf
>cGNY
hv0I&2N
ugoW N
3'V~y
<#t&<0t%<.t,<,t3<'t5<"t1<Et:<et6<;tF
y#CR&mIkE
T4-Lu1
R7jMI
yi7/j
d:@xd5?%
Tdw"C
lSuKoY
X(rj9
9)VX`
b[ vwP
EazMP
~{fVD
Division by zero
VW31Cz
Friday
bH$Ym
$}5kpVAw
zW41J
}MOqL
`i?i;
bE#/Q)[
'/J1/
4SMgu
%D#9'
PAkYTp
l:c9<X)X
E.SRA
VF]?y
fM&,Y"
Gdr)$
t jho
H#cV!P
b!9h0.]
nB?Y/(
y07s{
]}I;/
Fr"%g
]o8I\S
Mb:eR
L7=n;'
ER;Rt
XBgj~
Y>zA)U
ycVUl7
@{~G}N
wbd*ia
_z,ad
:0BbP
:;sNh
2"qa*
gPKg4
&AK0W
m2^"S
Ni@&}
Rb7_bW
F8~N{
5#c@~J
Ix@4Uv
UltraISO
R'1e#
dILI"
ORNo0
&iar
J;td&
y$R.0!
oy.B:+
_n&"fh
m,J^\
3zl1~E
JEkWI
=e~CrR
L4iA$
7~al.
r0{>1
/-6%Y
/sbN?
Wzk*m[m
-IVHk
HZ,n<f}
g+XYC
EWi 0
>sV>2@U
]"z#Fz
grv2s
S|m4s$
KfRkY
[ ddbj)
?1[fg
bTZIs
30>yq
D?S3^A|:
^.[]/
sO=Nf
@q8:K
9s'#A
Fn!d)A
WS81;
!%fI%-P
fVIvsw#
*+x5a3
jq|$U
eaK4W
1VZ1si
/&v8+
h&OsF
/(Z"v
'ef8zl
^{h.&yv}
D`4#e
WIlv(
8+8:S8~
<IE33
N8i&Kl
aY4PA&H:
#.N:!
Z;?@-
yn+YG
XeYH]
?e,|9ms
e2lGRb
XP3{2
gCW|h
D1(tt
.O5whf
,ZCD;
am*q]
k8;WQ
U?F'r
!dh<*
mK/=}
u8M)Q
a@*Pj
_|weU>pX
V94DO
>e$/y
do`|[
}cI>k`
t*$~
L0]:/|B8N
*P' 4
&B##;[
n2uX21K[SegL
w*ob1\
f3`9s
b*@}v
tpHB(
R{t{ca
DFK#^
n,Rb;
^y9C%
U|)x}
UhHo@
hc7f#O
7]8l2
joL>B,
jjjjj
qS2T0
q1Kd[
/H}`!
=r&K'
+2c4{
[0PZ
)>nQo
-e(i+
s)$1E
BE>#U7
KqQ2_Lc
+75oQ
K<cx{cq
7~Ho~
~irRB
k6{!Lt
_0ttv4E
QbZhq{
w}(<O
EdUwg
'F>@,z
X[lQu\
CXo]>
B'$]h
USERPROFILE
zyw{4Fu
jRz)f
(ZtwX
x<pss
idEq,
&NmtC>
oO9U
C10A)%
Invalid pointer operation
Ra".e
fH0f}
n<*|\
@dZyEE
b>,GH
Dy*^K
zd4Z
Rrd#e
)uN0~
D"iOW
?B98[<R
3.l3[=
fe_4F
Lwr0R
,8x_y
flGG&
<$]=)
a2F|U`I
xotf[
io1r(
&AY%aXp
nT5>o
jq4B%u
RX7rP^?
dk^)o
G3*/&P
"{ZtF
\w0AZW
%5tl^Bc
v`~m.*?
.Z9:u
.&L7G
:1hV)d
)[viwE
WBMl)$
$||Cj
M[m<{
`O2#7
|!-C&Y
e?#H"a
60<&~Y
uuy9C
-EQ,M
{:\$V
.ou%Pf
dbNLY
LockResource
ozeMH
fp\D@o
e!c>U
pEUHlf
UDZHNs<
)@3UZn^(
hca_d
[g67nF1V
'8+!%q
V-=.m
Xe(]w
u<+A$
X6wjn
-l<Y%2
!~w4[r
pP24lI.
(Zb4BM
8p8iW
xKS86g
5!OsB
]?TEy
S,&2,`g
3{w{x]
%hQ*c
A#Bj-M
Ttwnh
PMUmH
w/ Q,
A-e91
H%w7G
hTV%Dq
.{R?X*
%[z8%
j*/t1
<k3ye;
6D$Xf
p|w1!U
oE.SSY
qLm#)
NQNRN
lzmadecompsmall: %s
oGi]Y
95LpVP,{
vRKeD
ig)d9j
LzmaDecode failed (%d)
@1e\Y
?&rxl*
}17aG
)MXa[
CpF($
V"^e0p
}@S\d
?s88Y#
L&t<:;
idi>J
f{]5P03;>
c*IbsO2k
(2##xg$
9a;n|}
<g%{w
-E:7a3lq
P+8aiCWEE
g7sp$
m9)*o
pW|jt
{Gx.0r
9>Vgo6
0-k.k
bAlt~=d
?'1:JqT;
3 fKq
Ds26R
`PzLO
,Kwp(e
&Df:A
KYNL_GjM_
,t7ns
2f3#}T
lQsg$
-z|8O
XZ6::
jjjjjjj
khF+"bBr.OILFK
Mo@sH
%L7D5
`~P=f
8LZ8vH
vb3B&FK&&5
g?>tu
A#x]Kw
q5IQI
vJf*$
|_dlM
|*F'@
X@K#"J
Kjw}0
p6R1zY
xh<Cx
ghf%6
48<eg
P.b`B
LJ1T#
BpWK6}A
{h",^
e/NSV*M
4-[t}
dJg~=f
=JzV8?ZQ
P!E#O
sIh!M
GwE4hu
J$W4
UmR;Qd
D!y~uE
:~M<*!O
l3y=n
"We6g
'%s' is not a valid date
6~Ikb'Y1
1trZQ
|mVtn
j1/GL
ClassParent
d3h6n
ze#e%c
oU3A@
aALFp+1%Z
<L[jB
ReadFile
o|C3t
tUQoQ
m2Au*
sj\O[f
ml&4m
:fF"}
~.-ej
>a+~O
-/B| z0^
TsYELHJ{
8t*kt
rl<Oa
MAINICON
\1|3b
ge')+
nz-dX
+5;{y
7['6?
VariantChangeTypeEx
UD_GjD
:B{l0
Hl5=S
XnAL:
>/]^*$
U)-x2
h^16+
L7P93
W'@D}5
BFXCc@+H
]e57u
zonl)
wV}q!
~Z=+Q7{
t(-l,cKU
W ^x~J
yR[ib
L3#%U
vx19,
eA<CM
#X'fN-
hm}1v
h0@lZ
v<Spn
C;@%g
4,:\;
oe{L!
YarZ"sz
{r/:}X
Rv*X/
Jd,,#
GvH6M
JZ!&h
NC7px!
afWx=u
hS2Jk
>(93{
?xkdN
pZaf?
oA\^v
gp}7P=
_)ZIKn>
zo~!/a
d-eZ5gU
_&VsMo
T!AGI
RaiseException
U9yyb
C71JpH
69H-C
R-sXE
DVa2v
lzmadecompsmall: Compressed data is corrupted (%d)
wMvju
?~)Kf
e&!lb
gMbr1
7/lK[%
BQ\K.B
fN"jm
A1I}%q
pP8IP
ORrqd!%C
#nHfF
]IOBG
AstNF
',}|?
ADN"2
Y|2lq
dmKWc
7p;?v
m4')|4
C5uOr;U
\ItS'MR~?
OC|s&
]zu>;N
x,.Mal
u'9+u69
1p:BB
1A`R%
Tf8Xy
a{\Vt
ak+!Y
UWDQq
rV3-4[
hF'^-
{:=:A
DE7uss
+5(/H
Cv)tc
j@jyq
N)bgf
n!5t2
}h2Ka
pb=ea!'
./2RlR
<ObCB
pLVX\
#?}.[
'zB>iV
kb@Le
pG#[wCg
QMk7F
6&sK\7
-wp+%
*J\T)i
{NG\y8/
yLiGVr
eq!^-a
x:>hW
+FZia
b$:A_
YT:7=
G/4[e
?/e{!
a("#n
<hi!j
WQ+9)t
J1a*`
W:KuK)
-YO)jp
?33~bG
bp=N?
&|q(!
0c+i0
5+;f?
vtYQ2
lOy`5
WvNnJ
+4q#)
1zQ=3g
PA'9%
=G*A~
~3&iAG
QPOoM
Ul; =N
&/EhUk
?gG;1
<application>
L}59)7
MEn+F
~m_u7
U4?1^
O@'>+
,_~6&Qc
$8nz~
ygvu)ntd
yZB@m
Format string too long
E}kvjh
HU<|F
%,}~h)
7^)l)
l(|yk<
H47\W
Hmfet
'B%6_
H} 38
Tuesday
`k++bg
M%(Wr
+9v//
Ggwm,A.
zsMqm
Q$0(zyI
-x.xPZ
V<xQR@
$+o0h
&\RA`
&,h|
$EV}{T
(PZ-d
UK6Qf
a%=*)P
COCs+
7:i4v
(D~|U
Lr{[%D
PDBYF
tlTud3
naXs[6?(
o(@0g
I)>P-
6v4DZ&w
BoDof!\us
in1wV
K%JCBi<P
fdB;);
AeTkw
/AfL\
[cks{
9U.QP
KAfbw
z:$F{
c;__l
:D$qm
ey}3~
5R?:6u
8IX1Uu
vT3l4
N:cF:*r3Bb
u'1]V
3#`mc
D:KOX
Y99|Vg
5xk~~[Q
jTyy&
e9wv&
o}OC\
)lNRur
"l)7Gm
y}w@zD
_%cj%
EZB Systems, Inc.
r,!a.(
f:i84
lyRi`
%CehgpO
}CCav#
pl6Y.
ZH-%?*
G<^6+
|=LuM
c:?of
@Nza>0[
ySJ$:M
i<w-r}J
]xG+{
@~A|~
/Pmkf
q5)R&|
Zz}{A
OdmLQ"
>)%8^
*kTfV
]Bk1TX
IA$fwpT
sy1T}x&
Phy,@
nhE`!
ufs:Qp
Use-L
h'I\um=
Ue@dw
\G{"e\
+Ffc+
bd)!(
k%fDUS
J]U*$
msQq
DrM8B=
aulo^
6(O}zf
3k[r4;_
k=7lR
,}LK0
;.i {
`m$p%p
CDmbYw^?
GY.Yy^
$|4nv
q-#a?
!v~dbb
GO UN
,]+MM
R*K c
hWl~=a
evw%@
?/ikK'
+2Z)I
G{bpX
Revoc
!M:n?
pq[o0tD
%!mWUT
9z:i@
3n@J*0""
Q<RRp
nVsj<
KdN~h
=PBEX
k0{M^
8C5np
TSetupLanguageEntryA
=a>1%
Y/j8<
4B%rI
r;pUm
WD^Dz
=HmBS\
JNTl=SEZ
L;@ki!
[mo^"]
()+iYt+
Bh5R\
xej&q
MR0rG
aFCauJ+
21.7p
~x8n!
SQ_u?
.eC-+
,>stM
17(gy0o
OU$'gL
|XSo-
;5S{N5
n~%Tf
}C'`%q
)y-|T
Z@I"v
8hhvI
31u9<3
hr*vX
"%y(`$
%*!XP
BVsf>q
!:yQ!
Ag8Pp<
^2)H6
lZohf
`A)ae
N~AyZ
kK=e6J
9^had\
`U8DO
DZ7P(oH
td.nb
"od!
/(OQ<
0>Q=4+O
.y^<be
W(FKd|
ClpFL
x]ilh
Akd3+
r:h"<
,ji-I'
Sa;,t
a`&*XG#
#Nx;y
} ;8",
ygOE+
B!(^3$
1 Hp#
e+v/m
a!}.e
]):wY&#o
\uz{6
H"%n/
e1M'-
TjGd-x
^!CZ(
"+Uy>
Et@yp
)^mz5O
3^ueb
}W3m5
IuAm1
~P&X=N
`x6t^Y\}M
*Yne"
;zE'gSr
*whC!
Exception
Zw[x#
A1kpy9b
CwPRP
L}D1f
h*0}.l
Rj95{
bcdefghijklmnopD
7}ME#
[;>Y9q
H,+.:
iu,uf
vf~c}T
T)HhC
^um&8
#9=Jw
~q:8|mi
d{PK`6g
e@eiFZ
'I5yM
d'>P*
d[$BgW
0{G @6O
2<n:l
$9>QR
`B@##
t+&'ba
]dO]o
+KH@p
fL+P^
VdH`2@
0r-AV
Y,](<
"- DB+m
IN+$^
m0}{]
A_)}U
SetSearchPathMode
e34W^W
)pIF!
7En/d
Q$awD
hjL=e
|8rBI
(W6=/
,yE-O
eP,=S"6D
B@yBWC
D6+L*
C*]fb
oI%%n
X'dm5
QwQf}
Iufz|Id0S
~{^O3q
YK`{Tc
TZ!WA
s~1iKau
t=HtN
@~ZJp
dLuyB
ORL.SL/
B< 1<
o(nZ@z
F9o4B
6V+H96
"}^|C
VF):D
>I$?C
ZFkG%
'$PXM
Y6~]v@
SyzQ0NI5
3KH@1
~XY/p-
7y=?h
$(B&<
noIH0/]l^
7@9PLCt{y?
_ <d1
c4*,}@
wBn>)
l*$'uR
?B|$M
KCl|,
c!`X)
/`$R2
'p`1D
,47!,
-UTN]
`\%)N
8IcH+
_vqj7#
b|:`7
`wX^_i
FileVersion
?tNN8{
w<r[CtT
"((t_C
r}ZY;
>@lQCk
3w"^x
bGR+};
6Lkz>
Locale
h}lp}8
Tcx=?
?P3JT
5/1`n
&K2)w
C^vwM] n|
&*<z]u0a
^zr]Lq
zn=49
Dk|T>
\qSC~
<\TZVs
'O.(b
d\a0]
oLgQf
.d{f\M
np\mi
z|V|k
8E2O<Q~
GetFullPathNameA
A)yMZh
P^d!O
R?0z!6S
</dependentAssembly>
3el}'P
hl7^t
?04>O
_bVG8}
<*1<]
-:A~~
9;vT>
%X!%'D:
xe*-9
bZq)]
}y_y[m
:?r?(
$mEWDk
#_+ym
%^cIU
)#Bg2M
f}4q=
T0oUE
N^MHL
~tud5
6/ay<
gM-KM|m
Ppc<8
0%iM|
orvknJr56
'3Bvg.[
Zk+(E
#N!pS
/>
qb8{:WS$
=d8x7
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)U
l D"<
SQN/O
E~@lM
rj!@z
5a{r)
z4j5tg
Mx\ l}
TO.qU
~'4:)
dwb33q
A<ic1
B RC=
;7;z{
_USV5n
\2#e#
O \5X/y
\Q:XT
|$#BG)
]CuTH
?#(hC?
R6W"X
+&gJs]
:}??o
l`;eJ
g$[vH{`hyjA;tN
#6lQR
+X+=u+
h%eL!
6;Ea|
O$_!/
=s#x7
H4=E0
-e]gP
L}nl`
@7`=*B
Ab 0~
MOZ5~
k|zH{PL
yGl&f\/
e(,D7
$"<TDG
"<3Ic
.:L.40|
r~J%H:
hK8"y
!G:Fn
}b[:^[
m$!-2
]vS!G
-T#0d
HfX:e)
k:}V+
eC:/Vg
-H4zu
)_AMu
+8qH
em`zE
Gb:+O7
Vs_Fj
~=IO|
|nP`5Yz
Q~-Vq
(Xhtu
3&$z"CH
Zy$7G
5+soy
j.`/;3
t[5*v
y$Uw|
[1A:X
[ExceptObject=nil]
4Ix51
Wkgdk
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
qYu/R?a
iE![*
|jV-<
August
</application>
kOQro
'"0Ao
$V(H-
5|gYX
eh%FVB
iaDFA
^VG&H
RegQueryValueExA
D`y!b
QxgxN'_
Akquu
8w!+J
9%xXP#
v}n]O
j,QNO9
=+ahk
cxGhv
G;z6K8K
>fmrU
V>n_n
##AY7WR
4qAsY
7`\F]
'} 'x
%+Rti"
TUVWXYZz
\.)r7
JMCgn
Bs`p`
lS_?dKi
1WWIQt
BLa@1
[zD*d
>TKg/C=
O!.Gd
Ct;ee
w)#nf
h>qvAL^
UltraISO Setup
Mo')%:)
l*4*U[
~ADgKN
7Y)c'
,Wra2Yh
Vp}$/s
<VH[qB9
>Bqc`v
J9pnAp
$BK7JC
T`2ia;
SysAllocStringLen
VWee1
O[_OY
W`}\
Uy~Nqo>2m
3ebj9
,G90y
mh 6fL
DNm#2
SnDn{k
PWLi[+
uhe-2
;4WtzY
0=l+X1
lD=TD
+X@D3
'oFumymC
7OG"d
ib(<{U04
EFileError
Iq169:s
dR{b7
;_RQR=%%
~;w! 4
89uh%z
f0:o]
<S+2<
HaYcM
x5Ueh
rICz\
2 hD
w:y~(
H/IO)3
,;W.U
r.Rj0
8IiQ[
Uh)q@
E7'~@U
@laY@Ls
dk{`2
W%*|0
cQDrI
*.4mw-
6AY+"a
5un6R
;uv\&
>7mWE
*_]@{?
VmA=f
;[4}g
lIwC,
/}c>h
~~< |$
[<V=V
5v[Z/
*!JxR
spGBEeg
;n}l7G
[mR-<a
sg3N\
D\B]Tc
`SDAPi8FjC
!FFx+
U,LKNn
k*W_d
34>h!4
g_r4"[
TZ"*T
PdG[)
fwK,&
oya}a
(Ra(C
lr@L<%
%-159=AE
Lhkq'@
wLW}O
lm,LJ
UWX:-*
$J(#E
Mm"pr
97MUm{9
;c~ne
Ua)Z^A
u|%{cn
:b,,~
nNrK3
y?Efc
L6 r@
Bl!-K
/`#tN
NDw!j3
1Hf?
X28:*ZU
s0_nd
fjv9]
Hj]/Q
_|FMd]
@qE~D
LfpkP
Gcm`-!
"]nMa
hVDp*
,}/FUc
.@%"u
p?m`0
B_u~F
mD-Wsl3
2<5HM]
Qb(+C`)=.Y
^2u0:\
hd|"s
p(^dg
WN3X(
\"{JW
N#@%J
8<:4L
`{|'\\
9GTTC
<FGw*=
mhZw`T
cEySmAIj
)99Pz
c!.o?
L=h#W
>+Y3+
dT9-zQ&
;4<(X
FJX+_e
U-)x8()
Eb$R5
d.;JHj
3I-(W
6-FvT
OGR_g
BOZ1^
+UG67
R']32
NO8tF
|v'=-]y
BvK"ec
ay"T*
VI<RF
gK{P.V
dlT(?8
{0F%e
jH7ifa
Z3PLq
#2U'G
l'd82
^nTEi
J~&0%
).6Ov}
</assembly>
4BU)t
u$41K
b8O-S
ur}i/
6]uQ;F
~IUsU
*,4Ha
JI^tD|
x);\g
NOa3R
RrT]5
5d07_
39-*U'
L>+aZM
pE=$i
x4I@"Z
s?ED\
O fm.l
_S@9T4mO
_nffs
4T|c\;
(x'Yd
?adGk
'~+X<3
-[9!d
pT.J'
MAE%H$
6;8.L
B"bZp
e[2n{
mN%Hy>
';~^@
+x?$Z
b5__9
#0+M?
<s}M6
6x12\F
L?BJv
ProductVersion
\h@>(
L}/SF
c'*NM
R$V-FQ
0[FE`
R)GZ@
0<loYM
3`IB[
;FQyc
{RDOX5
_ySjv
,SfT{
c3=B.
;5QaQV
4Oe)s
^#\K>
8`b"_
yxOHr
`yT3*;B
MIpyIg
u-P"~^Gpf\aM
o_uV[
{vR7aHy
PBxAY2
_MATtV
t$!+m
NKR=|y
]. E4+0
trVk\
;Z#?|TbS
F?%hy
2'Fr2~
OHeBJ
zkX?R
,|+wH(j
s&L +
a_&1[
xe-3h
YcF>4<
i@k\:*
^pKd=
KOw!>R<
kNd0I
8*'=m
y[86A
|2!G`'
C{G2$R
ym)v]D"c
d%_F2a<
i<M.#
O&Pi|
3}Hf'
(z>RQ
h c0I
[$hQw
)yPY?
ZLe9.
}1fW@
AvafMK`Z
k9n@z
=^`M<(}
*St&a=
p1z9H+XS
95z/,
"3x.5
Q&S2G
RxY*8>
"4[fK
-5UcO
pT=[.
/e4Zls
Rny}7
BZChu
]}/@K
ClassNameIs
xP@B>R
IGB"!
g>8%#
{npmfR
q$uq(
FL85*z=
+BvxM
Floating point division by zero
T|"lj`fw
&p1on
d8B,|6
yp|qCB
R5_6R
vEe[
@d@21?
<[dSi
HZM|,
LJ5&V
nD_tc
NBX62K6
>*)DS\
]6hVFT
kD2cYcZ
ByIu/i
1*gh:s
fbkS~
YZMwq
%$82k%
@<>Q
p@6-OA
MeQkW~
wbpT
&Nyh~
o649
VVEK"
vD3[G/
ouI>~UOO9
6tf\`
Z0f}]
*o@e{
.uUI$q
w>ukm
` Dsn
m67NSO
*=234E*8c
H 6`.|
qqo~a
Z"Ijm
7W9H[J
t6HId
xS*t.
OM\>T
.sB'7
TFile
KP6L6
8:FWc
5X;(`
+'N3Wevs
~WWvp
T>1-B
Btp1)z
fCZ(uC
!Ab=`
TPItO
Re<WWX|
Ce,w!
5IxcK
u!~f`P
F_C9DJ
<xBSO
Zk)"d
,G'H^
N1yu'W\.J
xC&?\8
^3y:wR'^
|}DU:
ioD,}jf
GetSystemInfo
@jy'D
gWvdH~
/SeGA
%E7xWyJ
pyYqM
Gc5It
'O2$hJ
"8e|4
BMN@mcWV
xqRP%
2FIJ3
RegCloseKey
7.=E>]
V-/0t
1!_4*B;
#Iy8x
>8R,69
V5n<Xe
7E%wo
R,U\
CiPlX)
<KAk|
6]}Z0
3GeTO
Oq y*
M[K$T
QLf)E
_5i$-
%}.mR-
U)i()
eFA(.
V0:Vj
@<OIg
;7>^.>'w~
[2p?0c&E
;{i1*
`'-G(
EY"YD
DS K$
Iz"o%
:sUCd
zIi:M
NU>F"
bH):Q
$TfIWD
RnEtB'4
Fiq%|
MeA<G
V9^bd
cml[I
F)IDe$t
;/t.Y
aEBuU
nPt&pKu
(ymA 5}
}spF|+k
Saturday
*Ab)4
[,A~^
CUaST
l]lzz
v~aA%
)l&`|
@k&>6
PdIRQ
U:VJ)
*Nf_D
I&JIHIS
k:]N
4-0N}/
Zv8Yu
z>qTeR
[IWJ'h
E="zGxgB
LcS=:|
d"CRv
0BWw%
qmSC{
y2T^5
$]p7^
&6m.}}
dK1bhUP
)-}L5
'Y]C=AT
4yuF=
q!$>y^x
Mu1J6
dG|]h
y-|yj
gV$|I^
Sh0f\
EInOutError
HSv`<
D3CQnU
l'ghk
&80qi
R[Yo/
t2A\#
5+ss'
P\?dX
?oD}K
g5nC5
g.!fC3=
B,~u*
nE,ZJ_
e sLa
f'NR65
~>u)|
<application xmlns="urn:schemas-microsoft-com:asm.v3">
3FSF34
=a"]68i
6a!/T
t_%yfs
~*`cY
v.Bu!
:4f[j
&\"#`
}2Z=2
D$DPh
@*rc7
'AGCa
;L*,lL
m1tn^
+e$U
fvUff
FKZ`fD
D]_^[
8)XcX
2.(&"
a-WFpJ
N[syh
Z+7Vve
yn[7k
SEm(D
xu?x6
%>OO~e4
x{@F(
S&WEm
Rwpgf
TA#w?
rh5y^M_
FC#yL
-Y"xtC
TEB<>/-
yv/T8
tV%F+
lE$;tZ
IJ1]X
)5* .
$HMMq
&2v?C
CharPrevA
'/Z},
y_f7@
(^e=:
.b G"
xWw!h
Gmd:q
HcQ@<
gUppY
:36JP
ro9^D
-[*J[R
"|-u5&
zXCNc
\W/ZL
fS:^:
bYT|f
I-R)k
Gq=:3#N
K;d`ra
D)f}S
xpk~t@
|3IwN
}h8.%\d
6Y*.>
?CpISB
OzBMKly
_{l@s
N(Z7:j
fD}{6
wNuL~
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
YpHeP
H')i4
"k_;v
HTWU :cC
!3KNG
R]R3%
>UyVSF
W|rR|
(1!&5
I7Ma)
]#|rq
>YY@R
|omC>
a%xGy1
F$ROB<
p39]Xc
}<T;T
r#!<q
M?DeW
rNE{G
c|_D7
RIVKf
>k9,t
Sl!Hs
+p']|
dQd$jv7
qx|-ovrza
g<LLte1
crE"}E5A
#Z6?S
XCwc%
XP)zL
K}-9,.o
4$3sM
1#T@/
~CT2z
1jAHA
s\Ri>*
">9QtCD
Q2!32
nZ!@t
`A{yA
rsy+m
OdR Y
H`, [qp[rQaM
]%0E2
AHV-"n+p
u3NeQ
:jX4x|y
dai?hn
r}0Vpz
@4Z,\
`JLCF
shell32.dll
xHXR:(Oh
V0R>tF
1'Z$^
0BJ6.
;,7BDS
}7HmZ
nj-LUA
iCsQ^HM.0
c742_
X7,gY-
`9D"F
_!3zo
"Mgx!
;&k,tc
."j=y
L'KoN
'g*G*
m7(H7/7
[ZmI^
=l7=_
z]i^h_
PqEz\
7)ny
%i(8;
?RnYS
O5cuC
dDkRu.8
vPg.N
S)Ma-x
X!yM9
=hC$>M
)a;gk
./H4dt
=x+1;R
mB<'-#
+>jfc
)~^HY
:~GtW
T^3^!
0w6?Z
^{)(3
g9|tT
f`lD{
Vpo62b
?s]]:.
rtbLj
I^&fe
1NX3e.
7=Ec7l
7[O,k
(J3c?
5N422`q
3ge%,
\)yag
aXfJ-
&[(O,
"&v%H
dlg;O
Q4>l$
KW]OO
Ih}4U
v3P,@
++a0{7
HBw|zF
V_cE[
[vGvB,
aAz!Y
\3O/I
:~d}r
TeTkjX
Fr(ZI<EJh
&_whN @
v\#EP6H
dSdR<
|4_9J
!z("t=%Ov
&]I>51#
%?TFm6
6Bz8S
1Oifb
.`q)m
c9n8M29
__~4n
($=PzP"
@}qWr
@>~[x
yn~\Q
|L{TA#
eF6!d:
tD~*3
e-_ERb
Z]LK0_
d\8@o
"%\J5\
l?z&K
/ge<v
InitializeCriticalSection
z<#NF
)?9w_
/Tr.1!
3;.m?5
%1F[4p19x
{Ds#.
u =1e
l#:N}
o%e]'
[QV\N
S:-138
cv!W#
5J+ut)
>B:l
F#=FN~
K|>((
'+%I M
n(^74@
a<#bg+
GNgMz
qnG<?
ke>2~I
[fLm>
v-!:}
b6aS;K
^(u&8
Z3_gV
(wx{/
]"x3c
I8Q555
> )~l(
s,QF+
#>H8_lw
+9$UU
[OC
va'0[[6,
X@!N~
`(5CztQJ
FCL*x
qQ*MU
Q>5\}
s= xAbQu
5ps(Q\
|+}zi
V%w/c
{#B;@
!2N'g
&7#.P*
Lc9<XI
>@MfV
6hK5\`
aCt&:*
(uU|bC/$c
~#0>RPK
d`/xs
!LA[H
f<!#a
4`_}9
]As?X
Q\aGo
t"vs%
slOq8
+BEI9
FO:{x
M'~ry|
<'_2)
8&RkF
/!3byP
8rOC4
mW]n=
Ju7f!
?<%DU
(N-l4yl
s=dH\
&U,d"Fe
?C-}J>u6
#^Spi[
bnvX!
xyVEFo~
4}s[Z
lUYN}
J^GgA
y\fym
d4H{!/{
; 1Q+7JQe
mT,W7
&{^8+f&
GwR]&
#[xoC
roBCp
JXE*O
(W<tI
*0u~.N
t`k8,
cN{5q
h\Np;&
V.1@z8
&MEsw
u.e'c
9lF::
R:6A?
<t$S0n
~PUib
Qe7]l|
}Fi9D
_Ni:n
(.]q/e
&^mlM
}nVUo
lzf=6L
ox'{+
eyXMQ
ClassType
QLJ+)
~Fki
3i%@)
6+/A3o
HpG)5)
=DJSw
_YpDHi
7N5E|
T<{Ma
G j6f
UH"F)
D-=c9
.oD.)
81W1{
*@B0Ur
SetDllDirectoryW
D8xG!
C\AS@F
HEbC+m
1{}[-
!5*({
K5f/*
6OiSVz5sM
{/i/Qn
,cRFg
cYDoF
q=YWr?
+~| I
+*7z{
\&$bc
(pi%d
8>sz8;
}?mU2
ITi{.
veFkE$uZ
|,C2-f3
`E}Q.R
Sn/sZ?
#]>y8a
7b\LV
-lG\q
m1>SJn
WA#Hk
>2[y5
"A_{Y
mmmm d, yyyy
io/-_&
7o;?^C
g2~9h
)Ird?
!CHO[gj[
RFf4pF
mNT`U
[]@~'D
25\tP
A1.9Qp
Otxmv
R73Y7
YmLxZ
V}T' <
m) {f"
M(%]};
!s-:6
`NC9Z
*-*gP
#_'j+
c8~Tc
5nd>k
kjqGp
"Xf'8
iaBCa
6Y-jh
73rjv
D7X^<
z94wf
?/}Yw
u.(%N
z'mt~
P,llTI!
$&Y@O=q
!>JkM
P{c`Z
FGr$9RR
NLoc+
K_$A/
j`~<-#Z
Ao7t`
%P7`L
y_~Ch
:{|.9
wt>eI
=z'j
5Tug.
ej$"P
DispatchMessageA
Bk-SH
<w4<mY
Hh@A8v
wwvXko
U~*:{O"u
Sgc%_wo
de'=iB`
T9ZlT*
5w|]M
6-X<;
QML@x
SMfS|wb
Dz|Yh
fRpsk
7kO0S
p,zS#
m]ns(
k<K[(z
/*' .
qK>B"
,\nYaw/A
hEwOR
XD0N`
{#:'$
0xnGt
&Y4u
Cu.U1
`Z(JX
?ze|6M
C69pom
9A}aq
rr 8'
cg{GBn
YHb%d
}NLVR
~#um1
BHHnn"
657Jb
7g_Cru5
X$=Jd
uPtU0
7Xbh$
&Jejo
`\;\3
X5Z+2
oG$2`V
I"60,
CFqmD
- TqC
|yaxo
Tt'GE
IEPSE
1c:5>k
2K#h4
U5Y:1iS
(!h&uT\4
a`=P<K
L3Kn.
w1um)
Y3f+}2fTH
c(<eM
06QBFI
G:}Zo"/
2{L*=
P~cH=li.5t{
_.6*(
v6!aP[I;
E:H'p
7l*?~
D='V-
WX\]a
2<TySWL
u@* J
uhlQ[2#8
!6C}I~6W
:]5-E
9.5.2.2836
s^A8+C
f/ZpQd8rv
cQOU6
Dwj[5Y
yi'^d
VMznWe\
o|$jW
I="8w
w$GIm8
"}]H"
E.$t]
0Y!|FMN
sZY\hX
+?od6
sT{h3m
[bjJg
8|4,QQAp
UOqYF1Bw
p*h/^
[1VB0
qX|Eq6w(
^Iusj4~Z
|JorZ
#I)6G
6"$Uk
K%lSJ
nt^D~
h1j{g_
:yd0T
,!HA%
'/\&9t
A,_S-f
x10QP
=-J1}
U},|U
~'[R7
,S"0>4
Ui:UDU
(}cf&
m*&D8
9SxP}
;tmu
"yq]s
7^G5v
ZOx'4
hs*LG^e
[7y4KA_
Ah ~s
</windowsSettings>
&[}h\^
m*$%K
HB|et2
DxiVE
_a[[_
f_B^o
p?a|y
{gnKja
0AS|K^
-fm6@
+zkmZ
8u?H!
*JdR@
M%pZj
i29*?
X(iuG
r Wem~
B5)@7
oCPnw
J &'K
\ i6x:}
S|z'adl
i{sZo
Av(#V
}X0A}
Zty0o>:
1=dzP
g&Cz+
<EEdg
}vsr#/
hig=o
`r9I?{
sL(*<|U*Z
vZ-X"<
wQ]MgE
;p9MW
1DoRCR
:MZ<j7r=
5h!D4C
](vU+
[;;:1
&6hc)q)
` `j+@
g4vy=
Zgt6d-
<wm*}
@jvH%
K>mwv
i&DTDF
LbV4G
uP~.K
?93"v
\N[Fpc2i?
Pp\`0
1h^%AL
LeaveCriticalSection
;G">k1G
PV6jK
H(K8[
Hc\ z
) kRO
6&nQs:9iOM
t?{oh
s@_gx
OIa>#,
}~|0Fm)
Sn_pF
ne 69
~*$3K
f0Yr5
N#6Ay
i3Yu2j}bI
9WMFD%
(sp7X
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
~ZCPzLHt
-@gI<4@8
O#4SL"\'
L&Yob
]ZA7hM
|$Sue
s(f3ID
Z#07YS%!
,Y|T}o
9.$Ik
JNpq#
m@&j5
[NPy+
^yrXXt
CEeLl
I!3FD
=i|+\Z
O+6a}
MiSI0
Ng#WU@sIH
gAa0yM
P~,]J
B+aGaK
8`;~I
GghDl
J&Vso
comctl32.dll
;\J'N
<dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>
ivN*h
`m]u"x
g.}d"
&^.hTe
TQ\J.
+S_:a
5QF~!
Uhlk@
%j<b&
M\JZJ[`O
H=4MLO>
VN[:}
H-b#/
ab2ZU
}[}uUC
p$K,#
October
chaT(a
}5[e)
src(y}
KuZ4Bm
Dbxeh
[poJ}J
o32&Q
XF2;qC
^|c!X
0/Jw>
G#~I}
/SL5="$%x,%d,%d,
|1wR9
O+Pd8jV0]S
MsgWaitForMultipleObjects
E[p_!
R91'9$W'S
R1J"@
OpU^\
7*)s.
":>cQ2
GetSystemTime
hsK{{8
version="1.0.0.0"
zps;t
'P2"7Z
"_/9
R^[sU
F;F7I
w>PwM
uOXR6
:*.=QjX4
sfD_5fm6
Q|AY`G(
mbbft
4C,/C@
`em)R:
]~q4Y"
Q3C]P!
txVOU
|Z{:e3sX
[6'N{
ET^{k
IUtx?
=;wk-
(~#.q
ZTT~>W
p: me
u:Q\V
y"I[AL
@KBJ<
`%UoR
hB"[T
1Mk#g
srC8H
$5)%,\6h
<'t$<"t
-&Ghw)n
E77F?
P{`SU
@ZZyh
$bANSI#A
ZH\.5
$=N72
O#M&#f
.F`s[
\"CB%l
``````A
.b5zxCE
pb@g"
UuowOw
_mW0s6
s<hNt
xwmP[
0:UR{
oV&D\]VU,
U<5?P
yip\Qu
yV'7t
f2,D$@
/TyJ:
v`)El
^%B+N
NewInstance
SVWUQ
LO`X
KSc"@
&;n_M
Y\:yC
\<H8nE
8|)C"3
8_MlcJS
BqyV _
iNV3a
F=Yf
rjC`H
v;@_}
N1I*P
zhA}W?
OHM'Z
5tev4
sHiX
k@1Bw
t+srZ
5/xjW
string
ffZr>@
pE,,T
YCX2r"
9k>4K
P0&?<DE
nG#D#E
JpF!\
?>XT,
:0"#A7fYMg
XP}\Dz
^@S-&
zh#f%
l>wk(
pIZ%!
Y8m40
Qs^QY
MXHX[
~$''I|^(
@-wNl
8-bI7
dn,o{
{6}$tt
lH<#
RGu&X
]pjB(
eyNr3
=5mCxY
%!Gd}
hSh:!
>)Qqe
*~kHy54
[ps{'
B/x^,
u_|e=
5 2EM
c`A#!
O lr$
jTk!"
1},[N
HTMnR
x`xo{
pG2x,
II:qq
9s8c\l
<TXvc>
dT^-^
kaXFu
,Fa-S
mzI"2
l3@AG
zlkbU<V
UgSr-
w/dmS
</pl0
CXQ#"
9Yba2
|/>?Z
0123456789ABCDEFGHIJKLMNOPQRSTUV
t&7ah
k(4`5F,
j2Np.
WbA@:
xp`B#
/y`f>
C>*YE
`s_y(o
I`fn)
S7!M!
m'/1g
+!Yj%kH
user32.dll
J"Adx
(`tzx
%T6&'`
-pc.{/
Oi)t&
8 qU9
#{>5\
/c_|%@
#T[J(
%yX>4redZL
v,{"Q
&_&F1
=Z.oT
%iA7]
j]UAj
Se'hI
`kha:
)\!$s<
a)>Uq
VariantClear
c4^:gr
s{+_|ld
0[@8pg s!
$~'~%O
M m_g
=+@x4
s^`)8
!tptf
F"<1(H
MultiByteToWideChar
8{{U;i
T{[x6
+J\@]
'tO7{
|fog$
H:3uH\
TAaZ~
_wgL\>)
:B`Be
`zj6b[
I(S#U:o
5E3}KZ
RB,VQ
eD1Uq
XH]x{
IqGsu
13MYq9
vRp>D
;ik[W
|.P0<
#TKjJ
^BN;'
yFh:aU
C(s?9*
XXm,
?_V^5Gc
OGNBS&Q
XW,vP
w'T*g
'uf?oU"
m;3]9
|9e@}1
Q}$'j
@O,:S
ZVvvlx
pcC'kD
j"`^`h
X]ClG
Nn6-i
P#se{
%>tkT
cR+Ah;
b}nNP
o u,M
)MN~r05
Nbndo@61
,]n,*
Z._yu
}7F:[P1
9Fnr(:#
4jS.P
c903/
;OUQ6
OC hO
hm?N}
_usq]8J
Llkbxj:nLu
IhK*X
<duQ>
lNpt7
FR>fNr
PgH;@
bi7h!B7Q
N5'DE
41^3$t
s1iQu
GXoH!
O6$E@:b
5EWj_
D#+;v=
+O@Mf
N#PW#%XX
f]Ed.
]<<'E
H(%R"6
z7(+6
Vn1FUo
a4<-k5
O?^3@
_]lF(
F}xZ
I`sSqj
=$%v$
9Z3#*J
3wo1w
'_|M<
gdJ94
]Cahg
r#>5%
4>C:qz
ypC$"M
}/0/1H
Lm{6\
ZdM!e
}^&/rv
*Mg>6pJ
jXs~<
eLM_RqZRl
l!QPm
/|I)6i
C?gh`z
LCh P
_IlM9
ozxvXq
SV)Qg]!
File not found
zS 8E
j33s/Eh
hGn8~
)uQ*-m
h_Rng
XK*"z
nK<bVGk
BTI{5
w#1C/
~p$a2
|}\Fy
wp:SUW
3kX(w
.D$\g
IRMrwS6
W-c?H "
d.@xoJ6
T<eZl
u37 K^J
o`9]`]
vAq6*:
MPw_-Q/x
mzh.d
UX<*LP
r~_A-I
^L}ff
S;@Qrg&
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
=9h6\
{/ [1
3h~$5
X1.}/x
)f94Y,
[T+N$M
sv#.w 8
Sleep
~BXCM
l%[`H
w-_d4
g["x7-v
QHITD
i2@nP
kry5y
LA9u))
V#_%g
Ld_ *
usg~k
|&?W/
C8[F]
5VjPl
3xgW(n[\1
cD u|
/,}ya
heyjC0
7,N"$
6A)mA?
HFTpR+e
AW:]J
|N{HF?
^L:D[jsUw
7BL<&
E,HC7
tjr]/*
da)D~
&t(~)ml
?y`NfG
d,VOwo
=3rWJr.
d6Z4h8Y
4V/dx
Xt$78
i2$ 7
#mF/Y
j r`t
gI)[X5
Dispatch
0~%)@
R>{AN
"<gm}
U3c#p
r,oF[
&kAkP|WSlC
(Tl8q
'UIFi
x=X?&
zC<_A
W00bWW
A?YM
f9]!I]
1kCU
Bs0"pr
]FG&V
!z@-&
1VA1+&
J0#`Ix
+00RP!
pu,-R
l_E3[O
GAKea=
n49vC
z%RoG
.T"Q7
z^Q#(
,>[sa
%f=D\
'Si`Y
~#IyK\
;T}<}
{^uCU
*0d`$x
I?7YS
_y4pw
!GBL7
d?\.0h
U7#/TU
&aKt-]W
sdLvO
:@ZdQ
I`3@m
{G5Lk-
+ENJI
w\%yY
1$USK
.P6b4
=JI(K
ewd|_
n0s.;au
+u.cd
b),D)0K
;=aC1
G#}p-
w!pwL
F;R-{-
~0Y?ZZt
:&E<X
VNO/<Z
{ybP0
kWK=<
rH-6FJc7
|4YUx
GetVersionExA
414)8gnP|f
#@;DIU
O;s)y
EY3L#Q
Nv1}0
]o:D_
JOh$#
Z$`Z"Y
!:fu@
:J\ZxQ
,NJgIK
)k(]6-
tU$gU
WsMEs
Fx5S/h(
f^q9\
}=$S#
}8\*-
E+AIz
"97;4E
#p#[^|
KiJeYj/
,Jb(-
(,Gx&
[bfIU
o6l`r!@
XCMt%
"NSC:
Kn[EY
.Q&O.
5PnM+Q3
'k"c:?
6zyxq
r)<&y
0)/S_
d5e#-
.Yc';
HPheP
e6$_v
MMOSq)
k\,z s_3
ASdg!
c9 -1
52PB2
do6gE
XH%RK
s<spu
xHp_x
aDr"/
ZAP.t~5
;EAF'
aR*<r<
gjhuX
LFHzZ
lIuZ}
4MD@SN
JLSlx
_2Gm ~
W{'T(
$]HRO
4B;9i
pG"`W
IuNg9rU
l#lCMF
-*-;@
{%O17
fbmb!(
{~J3k
>-MX/
yo/Ii
.msnY(s^
Z)Kd%
.Z=wL
zh:P:8.C
&hQ1Q
zDCmO
4vM65
F}q93
|8&2,
;mp5\
s&f=6
/NnAC
NHCH4
{0!Y4
qiF.6
^1dpVv
b%9jd
bdlte1r
k*);>
(C)vs
^)UC7)
ExitWindowsEx
[=._WG
{LSH;
l#{h_
_w34w`3
f9&GtD
pZX@'
C)mMA
$c4|5
/Oc&6|
/+-]b
gN3CB
>(Jwa
*D?_b`C
Wy:kG:
z~NY'
GdQ$`
-W,TB
v@bp)g:
lQvy}
=<QqEz
@/f3d
nx6+b
8{KQ@
*Q?R:
DvF+f
<security>
Y4KL%
R.1n*
bj*pt
`^WS-
$V0oa
4u={C
DzTme0
a^UV;%=6V
h,&Z`[M1
$yr;=
34MhX
BU&D3{*
T4GO|v
2T9lT
&XH7ob
Y=%S=b!{+k
fBD|>
u0g`
BPShM
W>U=H
"GdHA
#[uX,
|ZQ1{"
6CW6A_e
0X.CF
%0/dl
4AQB^
S)J>.)
IaQ\$
Rc)mm+Z
cU]\)
E`zk=B
va5#)D
xsnR;|N
I\4's
6pC) _
B}!Y0
GetFileSize
Sx.]?
<=nz/
0}3r'
r'-ivV
bD}D|
r$n43c
|Ps\^
gy [b
Lk@sy
Gb/MK
$t=V0
"(X6xp
w<5*q
h+!3(RNw#
O:9EB
g.X/g)
a|ouA.
_$0]^
'X&X{I!@
[D7iW
Floating point overflow
&k5@>
zw|4ra61
i9:nh
ld6iM
^v39:gR
h+JFV
6n<9d
p:stW2\r
O&g+O
=pQKX
?(kig
2KBno
"#+4!
[ams[
6_8Uc[
fa(dK
546!{
E"`F"
.t+~4[
z]2;s
arO:(
Zrz;z
'>k$
!L5M2H
_$;bo
?Da8Cm
Gsjd,\
vy]>z
OF}JR
{ONb\6
CU yg
uNA+6aFb
\,DAz
SHE:i
{.eueyJ
t]D:<
JUgd,
7!LLuS uQ4
?]hgqn
FATc|
m'nmxi
`ZnkO
DNrep
WOB|@l+
T$<g8
_ve!l
]}6_n*
D (O#
pnEl6
6RR)v
~_kxF
U0"`L
L[<JD
`_,7`i
|S5h@
olM.;
w+8:T
lJu[[
f*?_8j&
D-yCNN
"8d<L,
Qk|;SGz
n]_;@=
fZ)i
%`$!,
.@AtB
f<,#Z
-NHt$
C72aI!
Ht<d?^
\oW0*
4nd"d
WtSIf
| 0w3
]#EU`
AX2d.
!&[8G
Q 4ML)
rf?,l
\VKT<
Runtime error at 00000000
]wvO^H
j6+iT
q-bmZ
1(b1nqJ
_[@~g
pLGiR
Prv7A
59"x!Y
Xo8a\~
!'\e"
GmD;d~
StringFileInfo
C+=SFso
9:(%=
X-ho)s
**c*cTi
noKhw
DAxpoH
-T}"]
IKLMNOPQs)9
Hq{Vi
y_nuU'
?J|7m
w/j#Q
YKuC+{3
pt8*;
Ih$Rm
/SPAWNWND=
q}+yy=K
4Pv{B7
.98(7n[
jB,n(
c2O)Y
</Ey=
KiCs9
' n\Q
&yb5i
n.x&c}Y
5l(D$F
zXI]p
7Tkh,
SKl'{
2IGW8
^jF&a
DXa h
lH_zV
F_s`C~
|5|Uw
Sh\|@
-pk`*
64OC^i
:nh%y
4o=0~
-jt@U
`vV5<
9/_|}8
9-w$3
Zo&2P-
;J<7*
_ cDN
1N$==
3yWzE`
?\%<A
rXRBX)-'K
Fi tj!
.h[jx
!`$jGl2
ln@~@
1kHW{
OFNrb
2h|hi
5RAI}"
;L,mW
a3VMVo4
z(p66
`]2e&
;=M5y
JLupu
l"Od;
%=nt:
yF(:vj
N.3N8
8d,[\
C`~Xj
$m0ipvU~
}MxPC@
mz[pRH
h4ij:
Y]oyn
^&Z`]
50sGQnc
`vSCl
gyz65
O.;3dd`Bdx
T\! |7F0
H3ugd:
%!3DJc
'QD%0
bnxfT
b-vGlS
R]QmZ
*V}#!
Kqw]D
i$Ye`{R.L
;i5@~f
"w([]
Ez]=O
n<@w/Y
OUVUd
Xs)h\
\=Q]t
$8CI6
:<iXt
L2V(d
1lqMJf
'nF|*
;[!>8:F
J(8KU8
#nVU#
H,T6$
I8$v0t
~fvcl
SyI$8
HeDfc\
~xXj]
pT~"<;
,H*P8B
Monday
O-Dr+
]NYYs@
~e55"1
`5.1B
97ANx
%^iU|
5w}r[O
&bcM]Mj
u]oYd
Ht8W3
8QRU,
]^:]t
Q.=7ek
|yU*umQ
Y%X3C
u*|zN;
lyGJB
5UG~\
EJ6nX
}D,P`
m!3E#&
z[|oKf
s;HmH
Gdv6+2
_,#eO
J%f=\
C3C;\hZ
?l YV
hJff
_:w'6
A&b$zg\
zQYyAm
kMoMR
ecYfRCf
T$RNy~
co'?
FuaA<
83-o"
zU}l9.
*qjgj
bVi@PN
*T[DP/
^jvlU
kG1(9
m;^#%
%sJ<0
i;vC#xV
K;JeVx
v8/<k
)}M7<
+,g+
3&F%d
Y_!<$
C.yfc
d_r%3
wJxuy
slH/`
%H=lG
Ir_o*
77z`G
<:I9+
/@)x0
9aAE93f!
}lg_/
A}ylr~|
c(Ho<Ra
mU<st
[S]O@N
Q=i&'
ht>z t
5V'@c
tu(f-
A[=OQd
El:|1
- -0)
2iLiGR
`s/:d
~J@%SSG
L]C,/
q@Dtk
=-wOqR
-PexU0
Biag8
Zut7a
b3K=a
zOCnJ
X[2oF
Zt"X)
&0:&A
'>rw5
`n1M4
(>'t7
.24NA,_
y4ylN
%Vivn
J(gHE
U<}Nz
\6pW9
Zo;md
,r/b7Z
x_gND
+\0L#
88G^.h
WM2-|
MehBWU
lAnst
)Iv0R
gh[}kP-
q`c1},
oJ6qk
GetProcAddress
jt|G>H
iLiJi
7&Vw:
ProductName
i+ST`
;MK}q
,6%s:yX
O,v2A
^NiBo
_C>z3zV
3L?F*oZk(
{@Y!+
fH91.
5*_Yn
!@aed
~oVwV
CgZR./
EJr[N
$[H.[
WT'p,
T ns?
d"LQz/K
yc;w!
rTCTn
.?GC8wG
e{q,E
j2*)g
xF#]PV
-;7Jw
i#/K+
nS\*}Rb-;
XE";:
UhRS(
CE&f{&
|</REi
EUnderflow
br$SR&
]8_Md
UlX%*a
cC7;G;
uO`t|
"1q|h
,PH5e
m/[C'
06=&C
25&%c>
Sn$8v
;kqLL
Bh+~n
hk9v1CM}
XOL,E
};cvg
sg">vA
)f<e`41I8j
D%Ui3A
D(OuQn
3fMpF7*g
[_bcW
<&3@PC'B
g7VGJE_s
):14vp
`DATA
0W)dC
Wow64DisableWow64FsRedirection
Z/RWi
RT[zv
_21<d
l(]'/
nRJq:
>_K8t
+.<pI
]eS>`:
"^m!X
o:tM?
Wx|+S
x,^ .p
?~.Rr
CrAiK
')#Y2p[
yK#Ni
uluu{
vN*".a
UO-65lXM
^#!B%+
SetFilePointer
OLW[[Z
0w~;{""
Pa(*S
Application Error1Format '%s' invalid or incompatible with argument
gk,ljI
Ks\S5
Ti_7'
dNh7uY
z<l>#
N$*[@
hU}i5iB
Y!=ng`d
+PE*J
]l\P|
^8TT:
:oMf5
&u4$a
3zi9(9M
=![7K
p20%3
.=Lve
f~'6:P
`D?N0
LB.++
}&`fZ-
cl&!u
S&e^R0
+g.WO
h0q)uN`
5J>{!m
&FITK
yA:B^R
#CQ|h
W+"Kd
@]HcYT
v07~oIn~
j0Zaug2
q2I\c^
nZJd`}
#cVjU
Sw+Cu
8wh*`Mg
AkfIyK
\t-fy
H}bq[
B},W)+
e>hnLgm
R/[Xq<
\HK0sl
{ecVK
yZ}UJT
S%;\^
Z2VgP
J47rz
5"`?&c
vxF'b
c(7Te
*Tli%
!o n8
HzfkUJ
ptrnv
-0Ht9/
erg.Mv
vmTr;
*h{#d
'R@/8
TA3C$
RVpzg
6}Zd2
>K>mE
$`,L1
!#5{$C
NeZWW
{$rr6
-'67Q
:~W81U75
(Pp%+=1u$
_t{qT
R*S~Z
QWv$Vz
U74_`
Invalid argument to time encode
\E1)z0
;sdt'
Hq?sdI$
qe~NS
$yTg8
b;;rv
*/}?]
pr`z5R
jm)7$
R0}q&
K`U8"
EAbort
{@_N\
(>mj<
hC/j-I
]DuX"w
NF6ZVm
|/RBO
?YMtS
Operation aborted%Exception %s in module %s at %p.
9pn)zoP
h+6#N/[u?
||7R--\
%d]dY
Q92x-
+g%Th
U^8,a
D7U$)
XQ1`F
r22t*
kR07c
;piDtR
lO(6-
jDAy0
/[lR#
TDU.d9
TlsSetValue
k3LCX
i}c)YYNP
HT1N}
ynG!F<
er,Z4
J}=~(E
uTG{Q7
!G,c)
j*3IR
i%2o2
A~;hL
t^J7&Nk
x6j8`
YbzSS
M>\Z|O
uxK,X
nIG~7\
H]A9SW
D&2/b
={.%
NhZC:
}$)"=
NOEcx
>ZK2R
zARX%
T}4Bz
zbAW/
<^1G[
x0Y1n
UEDA5
mC.V$
FvGs-;XT
*SZ|C
language="*"
i]G$j
~)L>w
OdC;jo
r*:;!
9h]el
uxu&FQ
e2Cf_6
PNrl^8
`:yg\tv
L^$FL
rSY-/j
m)ypb
\don]
^rT%7l
wi3H"
To+8U_
{rC~G.
9Mprt]
V02W}r
Write)Format result longer than 4096 characters
}i/0o]
c|ve]h
-}M,>
y)Ll7
lGpQ-=@
#{JP5J+
x_z.e
3Y`ZV
Hc3@`
:z&f!3
9S=4v+
B:gk0
&A&eJph*T
N8Yc>!A
32&SJ
+ T5[;
k#:M"
B"i_=mu
2Mn5#@
p,(E*;(w
;J0F\
vjaZ%
hQoA#
fqO.0
^U:6q
F/:=T^[
HuJp7
Clipf%
>i9ZxK
g!H@x
xJ1;Ug
,)MLE>Y
h)b(k
{>dg4
.l$DEM
_qA$K
-2(I|
RySRB
Jr=6.m
EK+4A
x6VeS>
}h+5<
Z]_^[
m37"=*
N/c^J
2 \N4}
O9oEq
`YV#v
%dxL(
WS\xR
h*N&N
?ZbL{n"
+)&'}
n.:e_
;Sf76
]F`k=
0o2MJ%F<
#YWA~
!K9hgG
Z#M#9
}r/+O
Invalid argument to date encode
K*/Y3
.)%E"p
fJZL8R
6.k#OQ
V<d9{
b:f^%
ox@B2
h Qt[
MB&As
yu=C;+
Gg\Rd
)_-!Q
Z1jxdm3Y
_Giq[E
"}#Ys
Cl}J@
%c\^F#A
uh/I:?G
Y\|'H
3+Yis
U86I%
z0NX;
;SGHKmY~
AkPQ`
t>by-Q
LOojt
O}pE1D
.n[1R
/r3@p
B'K]K
]2>R+
|}V'&TEl
f56M#
+HS*;
<a\c:
0|Z!K9
]8~.?l'05
MUh,Y
*='tA)L
F)?c6
+LbM{naw
(M5'n
|Y)17
yo)mWSWP
}L|VD
TH~"h
-oEC&
-#Rw)|&u
3"Q$(
0L*{tP
nXZW[
ARB5]zh
!ca&*
cXmr}
>$05V
elJ&Kms
Tj mQ
2mz+e
,#-CT
_n%_g
pg}at
q%vOM)
MWDT(w
D>$~OigNrg
di,Ee
RwQ^3
l4j3]
c,DBx*L
fHwY6
w P-e
Y09_s'K
r)Cy}
xEZ T
S<pea
M]cIq
W%^ k)
]{yPw
4"v=Fr
@<0m
_`;-lB
@iiG-
P|xyE
^lw2W
leFpA
__7eX
cI7q6
type="win32"/>
"rA%A
sf>;y
"{j:I
Inno Setup Messages (5.1.11)
kmDkMC
XS>1mB_
?8H62
%N;l2
imYl)
O?2sy8
fRr]*
?guH&
hTEs%
%"H6R
Q)tg8
m?!{}
+|sysOmu
= >,*
!Ds {
1]]c'
:w0i]
OIjb*
RjvYJ
ud%k4
80Q3S
T%G)W%
CmQtm
$OX^P
p.%/9
:0C~T
o)"dv
zp*wo
>F.i$
$JtIU
7?u99
nOiXU
g*FLX
RM3so
z"u*=G
LW@@y
,^E|&
rfc0=
Fi&]F
0+Su$Y
%1xPH
1I4$D/
qB]zW
YUB33
!UhAw:
Too many open files
`9l&v
>gdNbuH
oCYfq
g~|bS
w6ry7x
z_*]c
f{o3<q3#
4ji%_TjAI
A@E+~
,,[|tQV
L(nv.r$
39|{;
z]xpf
k,ykw
l'*T
?bTmv
!pk\(
SPd^58
C)_v(+
lOx7[
aXaN~
Tru1HmlO
z-,),
Jh^i%
5;pdA^
YT!OG
|\Mm$
fm#bgHz
,tXXZ
/*|dg6FF
<Et$<et <;tS
Nmyy;\
4mTfN
aS.V\R
9~>\n1
Kz _8
U4SC[
<LW%LU
F R:@
dw7QH
3hVm'
umwlq
OU._TWT
%qnTr9
#E,_]\g
-cO:v
;IJTZ&
(bO\-
zj~(zr
]C~hN
}PU.q
W7[w{[
,`}Z6|
=^|%O
).F|-
dw@#n_
qOo[j
7$K~C
_A+'Y
1VfXr
?DoC9
OU-5CT
&NlxQ
^{D*P
`zpDr
F[3(6
s|c?E
tNOqL
AWoKj
>/)@7
<?gH]i~
[AsG4U*G
j#SSf
4<9Vb
hL-Mm
NO69-`
\DF_\
oVU\/
q){nO
TXP^:
W?r(w31!DSL
P=`,
\Ns6l
Dy]]-h
q%mU+
\Muj1t
b~Tn61
r/T*y
<=vg]
(L{3z+*<
dbU'}
;?sO!w
jJLDz
/89G%
Q-k3T
6#Vp<g
!@3!% apB>WO
7^qtE+
<dependency>
INFNANU
vEIpCv
I%Mj[
DEbyK2
}?Mbi
l<cnAN,
!q8k1
kZ%Kn
= rPk
YsW?a
VvA;'
"Rmgc
8esIa
njy1,
b}31P
{E,,
-l_0d
name="Microsoft.Windows.Common-Controls"
xFJ^jB
!OtFG9R
->n]T
x>C2Q
x['K[e
u^[SK!
!2s?i
m7h2CGs
J'-Lq55
"y@`o
=hJdA9)N
^)Jtg
I-x9/e
Z5^iH
_ Y>u:
IPg&YS
..ylX
@[XC6
&NGBQ
aqV{G.
IiH|
F5awC
pJj1I
D}5)0'
Z6R^X
w@xt!
~"IC8A
3^+X'
S+Z-,
}!@|T
ygo;J
YvuwnJ$
)(45?5?>BCIC
cW(gr
7Wjt#
0IF:QT
EInvalidCast
)=fpW%g
|p)Nmn
g"unD
4-}S2
;qcHX
D'v`4
QUp<C2Rz
CbgR[
m=MSE0
1wq2GZO
=`/Vut
;W+9~T
A#JB)o>A2
A_:TR
~Y#="V
,wk[*g
N<]x-
LJ=qd
E]_Z%
JMm"<
n:*go
5MpXp
!ECM
7HA!BCH
hmNHsq
p-S[+
hc?$N
YzTE~
CyJ$r:
'0},B
oko5D
B.6xD
K%6[IN
O_&gDs
MrgJA1
%^Ee]0
Floating point underflow
P*a:-
&*Pq<T
NbjW(
qNDQd
E:MJ?
Hp;/;
jb5[g
c5d,}
zt:46
9lsw[o
yy=o3
0t,Ev |z
Wr(_p
*S"QeL
FU7!y
{tMs<
8f[}r#S+7
xuF4t
+i\|t
JZ}8|
p{OAD
m?|$01EPZ!
=/fO@
u^Mj-
js_,w
UU8}xQ
HZMFu
3`,fe
U+e!LxE
9;"n9%
#_lD+
$=={|3
g/_88
?$g"p
FsPa6G
Invalid variant type conversion
"?iS"
gXg~
noz3.
i/@|l
6~)5{
6"h<1|
{SWqN
()GbJ
+AAB<c
G^IMro
b|(Sr
8/c\2#
F8\ZT
type="win32"
xFLYe
tvtpf
Q63!j
x289j
GN]|yFuj2
qRME(G8
xxt%O)
:\44j
k.jPm2
vpfz`
?tfSN
wHUgY=
6"ewCg
ljx@?
)we5]
{2Y;jTD
:W`E!AB.:L'n
}_r)4
p4vAR\
.B'9v
1WG0|
eead[
]0i/:
RqgE,
*;J|p
Ew5Xl
Mtvs$
hLfZtn>h
v:eiPS#<
|a,*u
kVQKw
PaZN4e
e18vAd
p+[\j
}T};}
j^=6|t
@JsV0
v}tS2"
Gd@h5
UBO8'+W
8,HU0
66szx
-G6sd
}2all
>,^h#
;x<k&3
Abbut
Mgh<%
xP6UH
9RKC(*
TDgj:
<U`Pu
jylTv
fe-uy
HH\Ard
$TH#(
PLku@
EMt)kC
d(\kZ
DbOv@E
0\rh]z;
g,alm
P{lSN&*
g*01D
AKG?m
"u^>F&6R/j
YK#({
U`2?Z
E#g\]
rtCVt
FieldAddress
Y}1v[
Z\?yS
LbNv&
y:Cng
>JQ*IWFn
2]Us7
UWVSj
F?DR9
:{dI'Z
yz{%c
N[%6!E@
.~ u&
A_c\D%i
)W^R,
{)yf
}#2(4
"n1r
MG7B1
]`IqH
nR|O?
+,9f=f
Ip+B?
bO5Ds
%.[Yt@
'y`Lg
fFoT'
'5P^W
7o0;o
\g7)*
NyOxA
?;F<2
'.z3)
g@[#$
'xwf'l
"GATE
[WVarD
pIv"m
yjy{W
}UYD}
<ip8:
>cA5p
TWV,1
OzuM0g
ifzFj
+llLm
8J.n0
$s[rt
]]cG/mT
]Sxe.
v(@ o
JQ9Q}(
CCQ&J
<9xz,
),X,5;
bz%39
V{QsFjfx
"LJ<_
$Wbw+
Fa1,U
R,A+ w
\b}kF
ce7)M
AYzS+^
V%1*OV
/t4V!
`o$nM(
o2k_i
BkU'9
4EtA}
MyHux)X
Siy!WCoP
u~nnu(
<p.nC
M,tEU
if%0<
Z>vsXSQ
A8o{4Y
%$iDD
CW6(aHA
x;[c7
/wJ<m
oX4c-
|wArI
RemoveDirectoryA
b%UMH4
S8dh*3{U
x=0A\
4;+m;
E7R+R
:;b@r
1iON'
m4\~n
GgX>}
.2||
!^A5*
pacy?
WZZS?
(K}W8S
-}07aG
l;%]Ap
[YB!\
2/zhn,
5bV}^
%O};oS
$/.%m
tG6j)
.zpK@/
PHURE|t
KO<4^p
*?u2Z
'ayMB
4+^\-s
{pbLE\v
l=@}#M
v`fyx
6<V-Ln
lm,y2
Disk full
*'D%9'
`w<6:C
L9)H5
`%y0z
,0f$VE>
>MdM-V
gC#)^
(u_Xe7+)
ic!CH
"irY.VSg
u[oaAz
7g:sX
|V5iy]
_,ACk
&n8lC
;]#Pn/
Q_&B/
\E\|H
p?-Lt
tDWDxV
K]M='U
)3:?@aA
|iVzY
?C>Tje
0I/RP
n89G@R
YZ|01
CC0/*F
InstanceSize
%nl&6;
IKJdT
SG@'j?
?z<~Q
wIt5,
j&~^B?
9t*Zu
*,*Cj
$r~ {
\d0{*x
oK]@<jek
I|y V
-5&sk%=
wNa^D$N
8m3e<&E`
B~\l;!
\btCz'G
Dm|&!
u6qWm
9E6!M
>VIVj
hZALp*\
j6pu]rJ
!3O.X5
vh\|uK@~E
"dAcm
E)nfS
bi8{.
N,`d$
t^Py%
Tj5v6
|dA5gwY
`LMWZ
mt`fa
`]!SS
+{]IY
l@"Kv
n22!D
xWq'
"b"2
=,|>D
.awei
ca [^
V9y":
>Okq8
sc?Qz
MpZ6vc
-Bn>2$R/I
p<\rSI
u'qK8
^Z1yR
(Din:
])As=
)f-D>
Lw)[;
~, T*
e8z{dJ#
[]psk
&JC#z6
V|l5W)S
B40na
_TPxN
uiw*,^v
ozX(<|W
:v~_
{s@oNrY
wyBG,!
Cuu9n
!3}BRn?
EZeroDivide
*t\*2
QU*)d
dHE$h
}/]T*N
G$V7M
?le9mP|
~+0fN(~
4iJ<~
i_=_`
A;<1|
]sz[p
=$aXc
;Q%)1
o<b\S:
<&^)}Y
9N@em
jA7RK_
CG#pi
z3:M^bZ
YZOkT
SyC!n
FK**+
NXuVU[/P
[ BG#
.Xp6a
GCI<;V
Y\,8.
M,gDb
UYGN+
!qJ]6
hNR)[xK<kq
6C5Y9
"l44+
Y$U#o
BT#"X
!We_a
OlFo1
Iwox]
{|B3:
0|?^U
\C|l
@m}.KG5
,f!Q{
P[9GA
&oC_n
)hJ7}
l*h14
2H)D+`@oX
)i;I`
K:Xk\
'e,.,?
1Sq@$
:Ae-Sp
QG/^=
$k#}}
Muw&N
1R$t_<m
V5=5c~
}u.i)
NfhNOc
Iw?o`
jiK|[]
)}'ev
^;BZZ
laJuP
I"f$?
]i]i]i]i]i\
+fY#O
}m2ef
"ZHsa-
,`z7zN
>vk24
B~.Ep
DN^.`9P1
wl06qq
.ix;qd/
*.F>l
&1w(%
^R)`S
n0W@q
T]Jr
ADc!/
FU_7U=j
=_tXJ
TrBNW`
PaFan
<{^l(
7Ot;Y
VrVeY
K<v<V
6Yv:W
dI>oC
-E27p>&V
qn|$+
}eVF1f
C5!-&
WUNw
~~)B6w
3tpEO
7<E2^ _
_pvn\
p3,CeA
ukY;H
)'PT|C!
j8VSf
a?/$DO
,u+lwa
-m!AK
S!iEH
CloseHandle
+{<%7
%DD*y
h#5IZj
Y-DR+
Om^P9
q78(Yn7y
G)bRAC(
~gSTZ
,KdUsE
Cb]w{
bFRmk
sC<#M[
`=4.#
9J:Du
z2S`-^
J:MM <v
y3bu+
.lxz<
;V\&W+
1c)$yt
s+s&v
w'erE
P='.@
-U/Ai
raHYk
.wy-8
t:O}?
HlNZt
:XfDRLA<
gZ&t/
rH5JH8
GM9hx
February
;~(fJ
.h_2P-
`W}+`
0|e/H5
(P!Ym
w;DO:
8oP#J
\8y!<
Q&{ZK
Q ,ou?
;gcRl
t4{Z(
N$.=9
Wr`)0
o[[vl
)zcd4`+
hp<s`
t'-'*f
haSlwR
EConvertError
N^?{e
IYp`H
]sjw2y
Bf<u;J
ZT,?^$
(\<7=,
=/nebC
l_tGgI~W=A
wK,qNE{$s
-/&xg
gXj#t{5
TC0n
l-H]KLe|
w2iQv
:;~Z<`
,[Rwl&W:<P
8!RxR
J5V%r
w2C}@:EDo
d nac
vTKgN%
^/DRo
{Xh!0
8~!hl
^`(:>
fC,D
w#Xn)m
+ >gA
i0){&
sl@7;
5-=hD~
1-RM;u
0123456789ABCDEF3
>=SAh
sFSJ7
XP#S
])WUT
@WF_G
h7j."A
q0Rai
4"ijnp
nl{PS
[q`wk
\@![eb
fn[sC
!$jvL
wqlLo
tr#I:
Q1ezN
[/w}j
lpvu@
Ys7f4
<|Pcfz
Gx#S#
M"<k>
F;*&i
ZdSZ}
m_O"gz~
VV!bz5
^F*'G
Zc09T
loa?A
7b%:ZcB
%/\*$
IpJRk+s
D%$*S
C87i&
\-S&U
%H0+4
[=v-]
/AMk
n('&#
Ze';u
3X^|Zj
qzNnQ
kIdD*w
+*&6Xt
i=tkh
%#.3r
W1E}~4
<s(0!
:+B[p
+\iE]
Invalid numeric input
1R<mhA/
^fBxI
pHP]9
or:ny,
8o@p&
WJ\|L,
k<}.]
4M'Q_J1
6o6G.
&fo22
}DxDZ
9V@m:
/07g\dx
#Vbrf
HcEzLA
pn{:oG
h)=hh
2%eO8
%4=A3
,Zk&?@
2pHUf
&,QBM
03w<`
G-UXG
/\oX]
K:AkC8M:,_
'XI#iP
_:SNfq
fNTX:k
x)'+K
<M(p+
EPrivilege
!OtV#
0(oCa
i6III%
T xM^
q#_fw
PArDlPtS
IO_8!
j?l=l
[R$D+
.SiA[
}m}>n%
=o(#Ba
Xgo:e
'_$<70
a"i?;
byWe~
ew10J
XVyEY/n"
*l+/I
rHaJX
TCustomFile
|s@k>
HP+`Jy
X1"cn
uno*7
gKS1kC
w5%wO
6Cg[x
nU6_,
&<9pT>
.CqQB~*
$op0"g
6fKf;
wDk"M~
P("nH
J`nff
kXAck
dkbX}
!r3lq
h=&UlR^
E2\lv
GJO{`
M=-IJ
*)Fvj
e^bA77
jbrJop
az.}?
~4`JOs
!WMXk
jvYps
z/S%m
Xwlaz
lweY7m
c#t";
VpcZ@
$%!gNPH
mc1"x]
'ycNu
H"D[HW
>=+T{
8E/cb
y)o&n
e4I,d
V0^L2
F5TUb
1IM!]
Xs)/1`
y'.7"
'sHxi
?kK!z)
Gc|U,
IC;S:
\p'!I`
G~dm8
A8:j0
|r2T[
a0}e
0)V.u
)Q -X
SetEndOfFile
Oy'&Fz
@pM2o
W+@QI
*G(D3
VA#i^
qWNj8Z
V7HmA
7]@K.
1&eZ0
tmCF?
veKL_
KWCPy
;Uh;H
T7"s;
GJ[jB
}jXtt
(exj#B
k'hd~5v
yjF,v?
c=IgXl
Z=.(`
mLx^w
Z,K?1e
&M'E]
90HZn
QT+(R
?bA6[5
swH}|
e9HbxE
gUc9$h
+N/1TGr
@tpmU
s{cyDCs
$+5$?3\[;
/}z(5X
?0uV+
IO/2gg
BN\%W[
3ToZ~
0U'9n
4<ecE
<7}x{
G<e{.
l3:;=]
e2 Nd
1$#R.
Xi#;Q
7y"/&
*/-[Di>p
52R/l
U}W-}p
sLJwlw
DpkR3%p
aBn[q93
]\)c&
,(37|
|/fW0Fi/
AJ6SB
o:.:#
H0pG_
YbH[a
a]#0S
22[zptQ
H]Hh(x
GlJ^@
i"Vf%
>t2^3
WB1JQ7
^)F8>g
C<5~K
A~RI#
VwBz}
m?!N%7cU
V5+{T
p;^7NH
i"erXA
kEh&/
Z9)j"O
"vTmA
\]QL{h
Y ?o-X
HJ5)mH
JP45s
a7_D7^
}XenO
QmW##{
"|e!0
Hc7{p
_1=8g9
W'S~p
\Ecy-
SetWindowLongA
,X^it
.3Z&4
-D-Gj
Wow64RevertWow64FsRedirection
g>Y||
O(,i+m
&G^ 1
$8da9r
;8aZ}L
a}KZE2
VJ*U/Z
V,Way
k#kCI
SysStringLen
%4Mb"
W$Q?%{eI
1j=MW
`6^,k;
EXC`:
%zP2$Y
'yy;o
\KqL#
=q)a.
6QPJR
T/]lJM
glAw5I
|D%NC
oxz|6
e>"5m^p
Bc5-X
OpenProcessToken
u|I{!
G/1.@A
G`#Th
m_i`i
GetModuleFileNameA
ehuJ%
NSH{{
~X91k
eoagJ
F#PY)d2
H5!TM
YC?hYL?
&!sRZ
W&v(AO
W$MYL9
cbRTY.
hnj)(
eFpf-
Ft@*3
Zz_C&f
a>\:v
>HO%p
xvK0c
jp+m<"
FR2<L
fUidE
j{qrb
;PG)!
,\.;G
q[JSm
%A1:X)/L
5i& ^}
Qytuu*
e^VE#_
;+/!i
,-CZa
kYQmp
m"E4M
S/ R+CQb
2NZD*
^qTr&
s<1##
;[%b`
VRD(>
3@SM2
l+,;k>
i?.-[B
k;L<+
"L):R
hX}@
&r,7'
D#OBs
,hX_\
eNdfE
.`mj:
\6D]$%
D~ =Q
u%s(]
pte6v
E-Q0Y|
vN^qI
h1*aV
!E"% 7PG
Hhln$T
&o^&:
f7&z^
tZ?Xf#
I|:/2.!
CleanupInstance
X*3Ba
wgYS5
"?SRd+x
%wB'M
yNtjs
_1-hk
#G+/e
k&J>z'
%hII5
#|$2+<
a[ kjUz
G(MB|
cz"&F
n_UaD
,_%i0
R,won
oc>6^
#/LDq
uMoV3
[WT)s
=ueFzMd
bLE7sv
!JU|2>y
a"*Zd
xkCcC
P,{yD0
i.S?wWU
p[@:R
yWw0$
HtC;w/u
WU=:_
wk7@x
m/$#oI
)br_)=
8Wl&G
KM;pO
8o9Ts
-6,C*
ad#M(E
&#h>*q
xIx*`#
NErCfI
P3Q'?3
xeF:e"IY
@jQ=Zr
_#6T*M
,^nV$B
v'(Cv
4Hy6I
7QID&}
TC\X;u
yr!^bP
trTbq}(y:
iS=QR.
T$F8 m_G
)MF=[
A=v?L`
bHf4L
* )*8
ADIu_
p6uem,#.
I,bt*UC
Rd?vp
)@!79
"qEn<
8p@>vxr
qGTpw
z!,Wmyb
b78!/
\ns'6
P?!e[ii
DmhaCG-
qdmGu
m&/h5
.!w4rGv
a`W(s
4dq-S\
fLYA{
(q&Z2
C7ehR
Error creating variant array
g`g`g`
M=We{
K<I++
6H:n%:
a-g[~
G.No(J3
[UQh4
_oB6lw&
=;uK#
"xAUN
l4ewhx
KiAjP
Bcv5Xvh}'p
?V%O*1^
U>Xfl
!'sBJ
Vbn-il
w< VS
dja1b%
<&:30Z
@'n{h
yo/OV
oTje0
Xv3a|U
EInvalidOp
,IlE!Y
e`35;
#}c/JS<
K3j:Ocp
bA-[K{3A
#q/l:
ST}am-
P)XGQx
`WP&9
v+7jvd)k
7}Yy1
HAx,"
x;\ug
K&4pP
k)K A[
N8>k8:oX,}Z
!](zs
;FsdG
4o0Wd1
~r-#hf
xAPKU
~2HP&
SS^)u+
Bdq_z
K;${T
2@ W"
?F48$:d
x N|F3
MD\L-
b{C~
Z d>J
>}NVm
dtJ$sf
,~lMXw[l
]l`~+m
[1l*(YN
Q4'!z
WJ@hO6
4^U1.]l
_^[YY]
JyTb&
74&f]
8nG/;KU
P.reloc
l6=hFY
|'86h
CompanyName
#V'}b^^
0e|J/_
r ~~0{
(ZiQD"
xFFXN
8"#OK/
ns'VG
DHyk"
pIBIF
Sj|P{
AvG4.~
XGI o
?"3!Z
\l5fq{TWR
~N[5x6
S|>Lq
pa~(b]
\0o'<
}r;LH
fk;%|
d`:0=
~/7<y#
Vzxk,
cFGf.c
M+Z(D
zR(k=x
<GVi'v
P>yU~
nbP_9
/sNz#
oleaut32.dll
+Fdl7
1u0++>
p8{B
2/#>T
:FXi]@
6W9Sk
'J?[{s!EM
x56)8s
L<y0 h
|z|fis
hMF9v
LFI s
dCtIW+
Z"Zb]
oG_",
ldmP
}MH?q
\%q\,'I0F
TD; B=P
y=a{*
2> =\
%MorW"
*Y8_2F
<C4d(
,If.D
~_)mG
y=6Z-=<w
GetUserDefaultLangID
/=fsNt
V%!HF
a0%rS
Up8L4J
}$H;P&
?7E)5DO
wuV\L
wicn]
?sZ:3j +/
*&4i9
^7cs[*
>Kn&Zr~C
}<""Yln
CZ%uo
68uRK
,ZdV;
zQw#~
MV04_
hj1'S$
T)d|'l/-
ULKj4
.HIx
?'n'C
36N7i
9p_>@
j"4<@~
\b{G=
hn6HF'
mfG'#O
yvad
U*XAb
c.aSt
Variant is not an array!Variant array index out of bounds
^ky|s
6<"&lGK
^I(X$
Npzc$
7$,$\
l`0ZB
h1:$\
1V)`G
J@iLb
z|yU:L
anoQ|C
@%io>
pZo*!
u<bfC
y+8R-[*
^iBL,C
Jyg2#(
(EPJ@I
%d >c
@*00G
pDLEP
upEXUXX
re,fiC
OP-XD
#'Q!EW
C<&kF
<h[,tY
jNz5k
m/d/yy
0]}PRZ
!;=|cY
#&:C)
.2KMy
8;py}
v>|B
X|?_s-"
AyU~*
>M](ny0
3#LR!
_591
[ /BL
A+gJ.
y$asJQ
E)+Zh
z*)$,
pdMEB
z4wH KT
BEvA8
E9`f@)xq
NGIa>K
G]KGK(
+Eyv.
f:3RY}
K2tR?
WbjQ*
TgcBF
>WMmG
Kt7B? l"0
=R,:S0
03Q,a
KE+s[
X<Xe]
j-Gpr`
~0>J(2
rF8*+|
2bV9-
M,ds).
3Ibg=D
_;_Q8
+G~8 ?.
i9'NX
.@102
xkmCs
DR%8
j,U+_?
k*0u!
>]l1xt
@Rj<-
zW6(@
[[9cK
=?~CE
t#<z/K><.
9paVJQ
,2iq]
=>bDa
:1Nk4
IL>|
ik5h!
nXOfN
[(u<6jO
+r2g_
P9>wH
R!?Z"
&9S58
@OLbr#u
L8B@v-i&
1^@-oI"ENh
C%,i*
Q,[Q9
@1i"y
Na6tV
k-hH!
|G+#L
Y;g6K
&9pV;
H~Z8IrJ
yHn"ej
m]6eq
klSGwtx
/RM;?
TranslateMessage
0YgML
i(*(J
AhW"tv
E'_Cs
?$t>v
U5Jj:
Rf8DX
qu5/A
G/v <
:2ufI
$ZDpKUp
[a}vO<^
:dwq
d;![hF
asrf>q/P
17-_\
6x7+FQ
' NrB
6{3<0
jG`r:
z[==s_
\XP%2
Q61[T
P6}H/
*i`Eglu%
$)."2
;+X-f
mgJbL
4 34t
F4H+0]
X"*"%KXx
`.f$y
s|kzr
@W.boN
]%!/[U
kgWcwo
)x9RK3
@W*PA
VwL-o
XiNuS
"Eh8e/tj
g'TJO
vjW'+
U?6L#
C$ArG
X_eaN(*6
w FRi
6IR2FY2
WglX`
z[*H,a
EV,1R
XLbxB
=;2d*
8`)jX.
%q~_8]
{+>n]
fR.bM4M
sIo|F
+!%}7
1)gX:F
w0(fP
\s[,+
+VEe#
) `{|
L: F6
=W^Wp
Hi}}4
MWt#m
c#Lm.
QK8rm
pi~Q< Y
~OBqF8
5B8gRmJ
ZCp$A
X|)]m
^1"Oi
B\M\Fp
eR$7DRJ
Control Panel\Desktop\ResourceLocale
un-5i
}r'tW/
W~?7)
}-IIK
OdYN)\a
EStackOverflow
LU6cb
1Ml=@1
|eX]Cs
)Z$)b
l^TC
\WnZN
pF].H
1&BS2|
if"/{
5'ZO3
:Oa(\
8tXdB
hi01
uVsp
'&VG!
tRI0^/
e^S{7
Nud5"
,w'Cz
)lvt^
8%]!cx
2t"0CJ
em$*#
efSjX
njoAg
m)K0**
u[Tj(
9*qdj8
!p`W`
oMljz{Th0{@
~Y!Nm
1ClD,rL
KX6GM
DrQJ*
crm#X
bD:oj-O
b'zvO
U"8kO
9;QWa
CreateWindowExA
hS{)q;|
8DO9hr
l^".g
)ou*Z
GetStdHandle
aK7'4R
@N (&
Yq6I62
s0yKO
VT@ T
Dq)}s
'%s' is not a valid time!'%s' is not a valid date and time
qn&Nw
w_L`t
#ItIHM
@jjX4
WriteFile
DkjT;^1
8'w!Y
xqz.w
HGy5!
<+;6S
*D]*O@
DestroyWindow
"dE@N
EDivByZero
HnNj$
2<7)'?=6c
2!+S|>
I/O error %d
_0vQI)\
T)A$v
TCustomDecompressor
qaM'q
bL-]n
@H&U%
2BWZX5Y
U{H:pg79
March
nPq^:
upou^
)H\cDT
pF1^@
olxg,d2Ao
5;TB5?Bvx6I:6
{S>I6Dy
P,h&`
J(x6oy
/6@*Ez
HRmVr4Hw
T({<h)B(
@Y5O`C
%V=0{
t+|ic
e-'N*n5
aow28
0qB$H
3qD-3Uz8fD
xRJ~J
z! 9p
ux5eI3
ns9Z<
R~j.jS
w|t\\
<6e;.A*
(;a?2
X:PV2
<U{E]
P]Yqlw
=#(P<
e}EL|
ys<su
wkaHd
!xNsI
xzJo @
=F,QE
[(=hc
ycU*6
GetCommandLineA
V`!i$
&?7M\
0*Poc
Z:. J
,bJs(I
LA"w|
~u/ R
)+Pq<
g zG4
powY!
kh!Ij
J,~7?
$_jXL.k
1W3O'
#}8rUjc"P
4bT[A
&@_:<*
Read beyond end of file
6^N[H
<qyb(]m=
2)<bi
Oam!S"
Integer overflow Invalid floating point operation
_IuA<`^?
%l<8I
wkv|7
dFm^,YHJ
1R}t2
4_|WXx
qnZr19
:`F*?
;S}vP"
MWRn2
:g/{:
9AvH2
W"CWL
MFC[B
''|Iz
vc4)d
4tDfPcm
7+yDW}s
?[e0d
5+[{qD/
}e_2!HBrw
}\<][
$),tB
"jt*aO
xTXt^
*H-D{
fJ4'xl
JGcWMj
09M=h2%g
%@s;3
qjeZm"
DWe{[Eu
O(1ZP
bUsR' p
3rIv3l
:q=/B
IjzWu
.nnn.
O?iR*
TvZKK
70A0g
<WZ>?L}
6Nn/av!
Vb-da
#5Dd1
?X,\S
wLjH6u4n
UEexK
.5HBZ
xgIb%
qn-sP
XF}Y-
~w[oB
[ZPkV
Q3@)@
Y*%'em
Gd~7\B
2?17|#
t=P=&
m1NcN'
EIxLD
99miL
!r"{1
+vqWI
z:ROy-*PpC
ZzhUn
NL7Ms
pU|P
S^-3+
;qKvn9E
|Td#s
LwvCCT
J7c'4f
{(L}8
k#[6?V2
H6.>Co
|}e.7
DeleteFileA
aX[u%+
0Z>b?
QAtP|
ZbNY u
R!on
Aw{,]
KEp/W#
}j7KVc
KX_Eo
70#&.
AGa&d
AHsW8
(&'\`2
| H}
YZ]_^[
[{HjE
xSkFS>p
rB3&V
Th%yP
YFcA]E
$h$.m
0&q,`Jn
oUX?*
b|uDB
6r|D+!t
J)u)+
_RE{y
Pe0g;
"}HLdYb
h;\=2
L IK;
BWhHv
|/sbx
jL8"!
2XOWLP
Xl))F!6
;S\;+
.T/J<
+ui,"
\KA=6
-=sjt3
N8~Y7
M<8`u
IDx<h
69mdd}
{Y}o*
7K4[f
;7FZh_
E/x#_
EZNQs
JM#"y
[QeTd
i6!aV
>qHEG
bosGKb
wN`&$;7
}?yT)mL
FWdm`
'jHW}
}hkE*
VS_VERSION_INFO
Zy{uZ@
`9zpV
~U5wb\6
cyQKQ
K~@K6
l~^NM
JKfsA
{AFRZ
MhX.L-3O
~}r]5
\#ue'
T|`*f8]
~*C{!
LUBe{
Q(P&#gt
A&k&<N
WbRE$8
sVK{%
:z]t;
>[uhx
y<"j@!
3Q,]O
R1"HG
4q,w8\
_iy-$
EZ_M,
]E`X`
Sh0"\9
$Z_^[
3VlYd
cp;u>oz}F
bt(z|
Sh&q!
/ &2<
g cSk
xZt+r
31]Zm
SetProcessDEPPolicy
P^s<G
&K .N
]=gq*!q
dC]#&Q
Do5i&
^pQ`]
wynwFQ
&C9wZ
FZtF%_w
E?QtE
<VJk/
>:\lI
UN1id
R"M-]"
CreateFileA
Ll`lxh
Wo)Fm
[$#ka
&4P'z
YzQiy/
<:S3e+
S7#p(
</trustInfo>
.h 0D/|H
Y>Qp7
R ,E4
TlsGetValue
{+FY
Kvc;`
%_z_<
#w!^|
3d^_S0
WQ<N^
~$,-{
^)3sb}
0:2PS
a~\CJl
ki:p'
aqeC6t
Mg~sb
tm#%p
|Z|&9
0b^%P
ExitProcess
|oFj7
6+@B,
This program must be run under Win32
Sw9li)tZ
|cd,h
AQ{va$O]
;tsN1
^^[Tm
E]=yc
>SzH{G
Edq)iZ
pM*m%+M
PK_Bu`-
|mQ$E
hgM;
'>Bvbt
j 206
MnA })
ndt:9
AA=FqE!A
?UEx8
et5CL
g CLA
@>]Fz
1#e</x
xStS;
Ece^c
:IJy*
A8.!/
'o_"Z0_
iziiH
1Kdu-8
P\Wm=5_":
U0pDj
60^?S
5J5S/
J|6{N
!'%s' is not a valid integer value('%s' is not a valid floating point value
L}Z>T
s(n!Vd+
meaXy
;r0H%j
b[h+ad
(:LwEE
4;<w_
dE'Y>
pga=q~~
B~rDSt
-cqK,`
GetExitCodeProcess
Pd[~4
pf!h?
@,.aG
:3GXWF
T*Hc=[
<requestedPrivileges>
K6!an
)e;Kl
<uAHR
$$E:K
OS2[u
M|U]-
P|SPT
Mv5-EW
'v^vh
wd_+Q
s<Xvp
*<(Q>
N))((oA
V\lNjdi,s
e @a5
Ge~]+
,Q:3/?
H3v2$
.s7-C5
r,)@jlb
fB;W^
$|5jy
&.EWn
~ujEg
"cAjRh
zy33"2r9
Ot{;U7
a^r@YLN?
Uhu~@
=:c|k
G184&
WSN;p
1Uny7
@bx|o
nd~}hq
UmH#3
kGA"V
`kH'[
Ip`>(
``"LI
F^Rh
W-xW<
T_oDx
/-Muy:b
#VUv~>t
sw'#YdV
&*t>q
L)6PX
nj4V3
@zA(s
7mBPT
]WS/BlwI5
bL![EN
$`<gIT
DXyB(P/
r$)@0
WIb!"
UsAJy
M+^a7%
2zo 6
A.~e|
e%(hn
26G4&OU2XS
"jSU(
nt]LPd
IcZkne
8@>Y>
/~qtOu
TLZMA1SmallDecompressorS
J-*$x
%o%5-
u#UaR
}L_+C
1Y$Q
<5`OT-a
q5;1hd*
!Wg\4%d=
D.P0V
$@0`\x
YP`{i
1/)*z
lU40j
!.Hw6Y{p
r1k @P,
("<}i
BGu2_{
Out of memory
p!D{gy
d9v"G0
<H{z}
1[+GU;
N_#&<K
"9nO6
ua/Ia~
TeFIE
!*z.(
<mj.E
9/.UJV;9=
YLC0j
JJ+F@
"U%J9/
Q<gSJ
J!gzt
Um\4lFk4
G=0x!
%]rsW_s
<S-kL
/,6(|
.-'h}
V)@@z
o_AT;
Q\)f6
t_y3]3su
@e6hrL
kernel32.dll
}|]~QH]
;qb/i
n5m5`Q
Control-C hit
Ot7Tp
hJLWX
kP<dv
O*drS
^mAIjn
hry29
Y)<c 5I
I=7}I
aqj;o
g=z#=
"!l;w}{3/
p?yU`
N")DP
DIc)?.
4OCgzN
5eWTJ_
G[nw0qwv_
CflF{
yWl~=A
*s+Gf
*xrAxd
=]@C6
4>!qSW
H#e6_
w]pk,
le'OCrKB
|efS&`YN
?nHvh
:v[Ea
@xgV8
rCp4$
?-Ep'
A(_O%
WlE4.
Lv}G*
O:7(X;
iY?@$
NwFUa^
QS<$t
s&{vA!
+5C1Qw
`KDNI
%Eg}`5
wx%7G
_f|/m
H>b!Ua
(Ua\V
7(vzW
;W&v?
OP2sW
^j~q*
a1oy6
m(:lj
{c-_#
K-T2;[
M4R)M
FJ8ed
Z#W(Z
9+oxn
;%M{ J
wdmfV,
z:YU(
|$09I
.%%%m
I;s/"j
i)7~E
.c$ie
?kXr'
).3Z=
nS)sW
RegOpenKeyExA
oUeDZV
(kTD1i]
D*QfU
2]uz<
Tj:^R
W{W>e
,vd{C
N kJ/5/
J9:^y
UAJg*`
-otcs
_a94
KZ^ZM
s?qG*
D]1Pd
6ZZ&g
>r!=DwS
$){+X>
Rr6"=2
#|qiSC
EXFPQ*
a RVQ
UjVKMg
si Ib
qCN75
VJ:^0
ZBk^JE#~
EAe""
$bG*`
}r%T.N
/31Q]
JGEg-
8nN'@
X2BJ@
sKVH!
2:Z?5kX
T|%KQ
Q"^=G
R`rE90
%QHx}
January
p[V-%P
_C^U4
)(~<A
)v}?U$
&;o)r#C
jDN$Of
Leh}
vE72'/
r=Qs$
zhuMVd
ih Z(
,5fsxH
B@(Lt
u!VA
uFW 3
=En]_
ZR0N<
VtAXa45
{P^Cg
3jl+d
Q)v.%
[23U)b
EnterCriticalSection
:$#<@_?4B
*_s5
T{00-
8XBL5
$#=#|
!9tI"Q.
yDSv]
'V(M7
Vc|`g
_+^D_Z
&hZB4
'N*S6
ST_bV
6Sbm;C
A(\ut|h
Zn\ .
}T5TfU
7"kuO
CS]GB
:=ad#
3oX,1
`30bv
+ VKRUN
GetCurrentProcess
e)^8ZxY/
P!f*
%s5-E
ryzRO=(h
@)v)c
r8IK&L
7$3H1kA
*XYL~I
SPPDe
-al%vH
LBm|(
m>#A,\
tw]nQS
(,b6.
2Q3N[
ql:)^
advapi32.dll
?s_^?_
r627Rb
RlmZ2
h@t@4
z){U]Gr0
}.E{i
c2_/B
ul-mx
Mo^16
B08iQ
.*fG~
327k>
E&^&5!
TObject
x_85M
.Uc2`#4
rh:b+m
RB%SUC5S
*#\CB
yj8|;
.bs1l
DefaultHandler
Y#?U*
Zx9F6
v6NST
T;8}N
./@G-
EPb@C
')S~-
Th, -s@!
p/-xZ
{U2a;
tp?.>E
%#xmN
YmX\x<
iGi9u
&\%>w
YBO8d
?oru.
@oY}s;x
C4L[BcP
[3kBU
puFnT
Xg9pk
VV>nUy
>1/{L
)+XK~
2rApB
bFM/+
Bjrrt
I^Wu!
wB"QLJ
?Yl"O
m$g\
LM_x{
3xT&{
GetLocaleInfoA
o7We.
!aDBX
CallWindowProcA
0+"Ay
2YZR.
+eTR=
D 7~=zs
gc+!8mRs
'`JtD
EMathError
yx+qi
-ToY:
S%4-T!
@34?'
Z*6Xm
,RAv;
Z(^#(
;>yrz
&f[<1
|=6<A
u]/+I)
=GD065
}PA/h)
PeekMessageA
Ye5n,V
VH'G3P~=AA
t3F%8!
Hw^Ed
u@[U_
{]6'N$
v9R?5n
!s4\.
XU$*C
J)*o,u
Q:jf;E|l
m.p!w
^JkVd
InterlockedExchange
7I>~=
MmP+?
!(-"4
3&#^r!eA
dt5F 9Q3
d;)/T
Invalid variant operation"Variant method calls not supported
+-~|o
&S`7_8
!:Sa\
\O1'GJ&
}#n]El
G8 GUdQ
S0Dz8l
P8Z*;
A`M]U
rayS1
H^bbN
3n /p
OHuVa
7iB,J
TH Mo/
]+"54c
IlF>#a
b;m"Mf
2mt|)
qaXy?)
V:~Mg
b&nZ]Gt{
J84aAl
f3wll
<yj!
R4Z@\
ZFB\!
MZT*[
0)Wq}
i!Fe?
V3)TP
#CoRA
nD>3w
8XO9![
u><Pz0
vWSye
;n/0t
u]ucq
QrGEbY
RE{y6\
%H(RO
|8F'F;
)P0u\
;13iV4f
4~-pJ
xi7 I
1eaZ]<[
N9!GG
ZyukEC
s]7}%
qZvmp
gPW73L
&aJ*A
~AFRTg
lIqOq
Q7id0
hAkzYD
oj\+zx
]|GCy
.%{{|
J*9amu
hP`rf
Z*:N|
ZqZ(_$
Z(Z@6
GetLastError
Compressed block is corrupted
%19R&Q
5U}e2
NC:;U
zz6r8[
Zz<GN
[teeB
RNCLq
4,D<TL
>52Z~8
sCy0@
ShO9G
o73">
H[J.FD
:9Jg]
D/0YL
=O!)B
!0g">
}W0|h(
q5(8(
xUX5XgV
11iCtQ
MethodAddress
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
W>1((}E
Tb)K0}t
d`? '
~#zti
v"ehf$
|$1 (
?6SQ'
TGpRX
Q+f9lS
:q6{?
4orTZ&
6O",t
}c5GiP]
%>Ga=
tKS|2Sn2m
]U7it
)?F_H
UIiPc\
O/RT/sBZ
>nh3Z
xGfv"
W/cVC
%)h:-
Q_4qR
`,pgf
!*u@O
#W$#L
lbr8@R
gw&XZ!^n
c($)j
k.Td((+0
=K@x8
7Y,KX
$OJ;K
ud0oo
sOoCW
xOx',
?^i&@
'1c:oD
+~ A,{Z
HK<4%
kZ*)Zr]
8WskN@
zU;8o&
)e6rj
>80I6
mi?Z2c/
R6ZXL[
bmbw&
p ^I~
PE Information
| Image Base | Entry Point | Reported Checksum | Actual Checksum | Minimum OS Version | Compile Time | Import Hash | Icon | Icon Exact Hash | Icon Similarity Hash | Icon DHash |
|---|---|---|---|---|---|---|---|---|---|---|
| 0x00400000 | 0x00009c40 | 0x00000000 | 0x00206d4c | 1.0 | 1992-06-19 22:22:17 | 884310b1928934402ea6fec1dbd3cf5e |  |
60af678b83c8d275acfbf5f632256920 | 093a74c9680f142f577e26a170c39300 | 79fcfefca8a4a0c1 |
Version Infos
| Comments | This installation was built with Inno Setup. |
|---|---|
| CompanyName | EZB Systems, Inc. |
| FileDescription | UltraISO Setup |
| FileVersion | 9.5.2.2836 |
| LegalCopyright | (c) EZB Systems, Inc. |
| ProductName | UltraISO |
| ProductVersion | 9.5.2.2836 |
| Translation | 0x0000 0x04b0 |
Sections
| Name | RAW Address | Virtual Address | Virtual Size | Size of Raw Data | Characteristics | Entropy |
|---|---|---|---|---|---|---|
| CODE | 0x00000400 | 0x00001000 | 0x00009364 | 0x00009400 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ | 6.56 |
| DATA | 0x00009800 | 0x0000b000 | 0x0000024c | 0x00000400 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 2.75 |
| BSS | 0x00009c00 | 0x0000c000 | 0x00000e4c | 0x00000000 | IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 0.00 |
| .idata | 0x00009c00 | 0x0000d000 | 0x00000950 | 0x00000a00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 4.43 |
| .tls | 0x0000a600 | 0x0000e000 | 0x00000008 | 0x00000000 | IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 0.00 |
| .rdata | 0x0000a600 | 0x0000f000 | 0x00000018 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ | 0.20 |
| .reloc | 0x00000000 | 0x00010000 | 0x000008b4 | 0x00000000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ | 0.00 |
| .rsrc | 0x0000a800 | 0x00011000 | 0x00013ba0 | 0x00013c00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ | 7.61 |
Overlay
| Offset | 0x0001e400 |
| Size | 0x001e3364 |
| Name | Offset | Size | Language | Sub-language | Entropy | File type |
|---|---|---|---|---|---|---|
| RT_ICON | 0x00011354 | 0x0000e872 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 7.98 | None |
| RT_ICON | 0x0001fbc8 | 0x000025a8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.69 | None |
| RT_ICON | 0x00022170 | 0x000010a8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.87 | None |
| RT_ICON | 0x00023218 | 0x00000468 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.93 | None |
| RT_STRING | 0x00023680 | 0x000002f2 | LANG_NEUTRAL | SUBLANG_NEUTRAL | 3.22 | None |
| RT_STRING | 0x00023974 | 0x0000030c | LANG_NEUTRAL | SUBLANG_NEUTRAL | 3.32 | None |
| RT_STRING | 0x00023c80 | 0x000002ce | LANG_NEUTRAL | SUBLANG_NEUTRAL | 3.25 | None |
| RT_STRING | 0x00023f50 | 0x00000068 | LANG_NEUTRAL | SUBLANG_NEUTRAL | 2.86 | None |
| RT_STRING | 0x00023fb8 | 0x000000b4 | LANG_NEUTRAL | SUBLANG_NEUTRAL | 3.21 | None |
| RT_STRING | 0x0002406c | 0x000000ae | LANG_NEUTRAL | SUBLANG_NEUTRAL | 3.05 | None |
| RT_RCDATA | 0x0002411c | 0x0000002c | LANG_NEUTRAL | SUBLANG_NEUTRAL | 4.48 | None |
| RT_GROUP_ICON | 0x00024148 | 0x0000003e | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.45 | None |
| RT_VERSION | 0x00024188 | 0x000004b8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.89 | None |
| RT_MANIFEST | 0x00024640 | 0x00000560 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.05 | None |
Imports
| Name | Address |
|---|---|
| MessageBoxA | 0x40d128 |
| TranslateMessage | 0x40d210 |
| SetWindowLongA | 0x40d214 |
| PeekMessageA | 0x40d218 |
| MsgWaitForMultipleObjects | 0x40d21c |
| MessageBoxA | 0x40d220 |
| LoadStringA | 0x40d224 |
| ExitWindowsEx | 0x40d228 |
| DispatchMessageA | 0x40d22c |
| DestroyWindow | 0x40d230 |
| CreateWindowExA | 0x40d234 |
| CallWindowProcA | 0x40d238 |
| CharPrevA | 0x40d23c |
| Name | Address |
|---|---|
| VariantChangeTypeEx | 0x40d130 |
| VariantCopyInd | 0x40d134 |
| VariantClear | 0x40d138 |
| SysStringLen | 0x40d13c |
| SysAllocStringLen | 0x40d140 |
| Name | Address |
|---|---|
| RegQueryValueExA | 0x40d148 |
| RegOpenKeyExA | 0x40d14c |
| RegCloseKey | 0x40d150 |
| OpenProcessToken | 0x40d154 |
| LookupPrivilegeValueA | 0x40d158 |
| AdjustTokenPrivileges | 0x40d24c |
| Name | Address |
|---|---|
| InitCommonControls | 0x40d244 |
Usage
Processing ( 53.78 seconds )
- 50.73 ProcessMemory
- 2.915 CAPE
- 0.127 BehaviorAnalysis
- 0.008 AnalysisInfo
- 0.001 Debug
Signatures ( 0.08 seconds )
- 0.009 antiav_detectreg
- 0.008 ransomware_files
- 0.005 antianalysis_detectfile
- 0.005 ransomware_extensions
- 0.004 infostealer_ftp
- 0.004 territorial_disputes_sigs
- 0.003 antiav_detectfile
- 0.003 ursnif_behavior
- 0.002 antianalysis_detectreg
- 0.002 antivm_vbox_files
- 0.002 geodo_banking_trojan
- 0.002 infostealer_bitcoin
- 0.002 infostealer_im
- 0.002 infostealer_mail
- 0.002 poullight_files
- 0.002 masquerade_process_name
- 0.001 antidebug_devices
- 0.001 antivm_generic_diskreg
- 0.001 antivm_parallels_keys
- 0.001 antivm_vbox_keys
- 0.001 antivm_vmware_keys
- 0.001 ketrican_regkeys
- 0.001 browser_security
- 0.001 disables_backups
- 0.001 disables_browser_warn
- 0.001 disables_power_options
- 0.001 azorult_mutexes
- 0.001 cryptbot_files
- 0.001 echelon_files
- 0.001 qulab_files
- 0.001 revil_mutexes
- 0.001 modirat_behavior
- 0.001 recon_fingerprint
- 0.001 suspicious_command_tools
- 0.001 uses_windows_utilities
Reporting ( 0.11 seconds )
- 0.101 CAPASummary
- 0.007 JsonDump
Signatures
Queries the keyboard layout
Reads data out of its own binary image
self_read: process: UltraISO_cn.exe, pid: 188, offset: 0x785c6231785c5264, length: 0x00001e2c
self_read: process: UltraISO_cn.exe, pid: 188, offset: 0x785c6231785c7275, length: 0x0004a4ef
Contains .tls (Thread Local Storage) section
section: {'name': '.tls', 'raw_address': '0x0000a600', 'virtual_address': '0x0000e000', 'virtual_size': '0x00000008', 'size_of_data': '0x00000000', 'characteristics': 'IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE', 'characteristics_raw': '0xc0000000', 'entropy': '0.00'}
The binary contains an unknown PE section name indicative of packing
unknown section: {'name': 'CODE', 'raw_address': '0x00000400', 'virtual_address': '0x00001000', 'virtual_size': '0x00009364', 'size_of_data': '0x00009400', 'characteristics': 'IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ', 'characteristics_raw': '0x60000020', 'entropy': '6.56'}
unknown section: {'name': 'DATA', 'raw_address': '0x00009800', 'virtual_address': '0x0000b000', 'virtual_size': '0x0000024c', 'size_of_data': '0x00000400', 'characteristics': 'IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE', 'characteristics_raw': '0xc0000040', 'entropy': '2.75'}
unknown section: {'name': 'BSS', 'raw_address': '0x00009c00', 'virtual_address': '0x0000c000', 'virtual_size': '0x00000e4c', 'size_of_data': '0x00000000', 'characteristics': 'IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE', 'characteristics_raw': '0xc0000000', 'entropy': '0.00'}
The binary likely contains encrypted or compressed data
section: {'name': '.rsrc', 'raw_address': '0x0000a800', 'virtual_address': '0x00011000', 'virtual_size': '0x00013ba0', 'size_of_data': '0x00013c00', 'characteristics': 'IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ', 'characteristics_raw': '0x50000040', 'entropy': '7.61'}
Drops a binary and executes it
binary: C:\Users\Packager\AppData\Local\Temp\is-A58BV.tmp\UltraISO_cn.tmp
Creates RWX memory
Yara detections observed in process dumps, payloads or dropped files
Hit: PID 4760 triggered the Yara rule 'shellcode_get_eip' with data '['{ E8 00 00 00 00 58 }']'
Hit: PID 188 triggered the Yara rule 'shellcode_get_eip' with data '['{ E8 00 00 00 00 58 }']'
Anomalous binary characteristics
anomaly: Entrypoint of binary is located outside of any mapped sections
Screenshots
No screenshots available.Hosts
No hosts contacted.
DNS
No domains contacted.
Summary
C:\Windows\System32\en-US\KERNELBASE.dll.mui
C:\Windows\sysnative\en-US\KERNELBASE.dll.mui
C:\Users\Packager\AppData\Local\Temp\netmsg.dll
C:\Windows\System32\netmsg.dll
C:\Windows\System32\en-US\netmsg.dll.mui
C:\Windows\sysnative\en-US\netmsg.dll.mui
C:\Windows\System32\en\netmsg.dll.mui
C:\Windows\sysnative\en\netmsg.dll.mui
C:\Users\Packager\AppData\Local\Temp\UltraISO_cn.exe
C:\Users\Packager\AppData\Local\Temp
C:\Users\Packager\AppData\Local\Temp\is-A58BV.tmp
C:\Users\Packager\AppData\Local\Temp\is-A58BV.tmp\UltraISO_cn.tmp
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\System32\msctf.dll
C:\Windows\System32\kernel.appcore.dll
C:\Windows\System32\bcryptPrimitives.dll
\Device\CNG
C:\Windows\System32\textinputframework.dll
C:\Windows\System32\CoreUIComponents.dll
C:\Windows\System32\CoreMessaging.dll
C:\Windows\System32\ntmarta.dll
C:\Windows\System32\WinTypes.dll
C:\Windows\SystemResources\user32.dll.mun
C:\Windows\System32\en-US\user32.dll.mui
C:\Users\Packager\AppData\Local\Temp\is-A58BV.tmp\netmsg.dll
C:\Users\Packager\AppData\Local\Temp\is-8NHRP.tmp
C:\Users\Packager\AppData\Local\Temp\is-8NHRP.tmp\_isetup
C:\Users\Packager\AppData\Local\Temp\is-8NHRP.tmp\_isetup\_RegDLL.tmp
C:\Users\Packager\AppData\Local\Temp\is-8NHRP.tmp\_isetup\_setup64.tmp
C:\Users\Packager\AppData\Local\Temp\is-8NHRP.tmp\_isetup\_shfoldr.dll
C:\Users\Packager\AppData\Local\Temp\is-A58BV.tmp\shfolder.dll
C:\Windows\System32\shfolder.dll
C:\Users\Packager\AppData\Local\Temp\shfolder.dll
C:\Windows\System32\uxtheme.dll.Config
C:\Windows\System32\uxtheme.dll
C:\Users\Packager\AppData\Local\Temp\is-A58BV.tmp\UltraISO_cn.tmp.Local\
C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984
C:\Windows\Fonts\staticcache.dat
C:\Users\Packager\AppData\Local\Temp\is-A58BV.tmp\TextShaping.dll
C:\Windows\System32\TextShaping.dll
C:\Windows\System32\windows.storage.dll
C:\Users\Packager\AppData\Local\Temp\is-A58BV.tmp\Wldp.dll
C:\Windows\System32\wldp.dll
C:\Windows\System32\imageres.dll
C:\Windows\System32\en-US\imageres.dll.mui
C:\Windows\sysnative\en-US\imageres.dll.mui
C:\Windows\System32\SystemResources\imageres.dll.mui.mun
C:\Windows\sysnative\SystemResources\imageres.dll.mui.mun
C:\Windows\SystemResources\imageres.dll.mun
C:\Windows\System32\shell32.dll
C:\Windows\System32\en-US\shell32.dll.mui
C:\Windows\sysnative\en-US\shell32.dll.mui
C:\Windows\System32\SystemResources\shell32.dll.mui.mun
C:\Windows\sysnative\SystemResources\shell32.dll.mui.mun
C:\Windows\SystemResources\shell32.dll.mun
C:\Windows\win.ini
C:\Windows\sysnative\en-US\KERNELBASE.dll.mui
C:\Users\Packager\AppData\Local\Temp\netmsg.dll
C:\Windows\System32\netmsg.dll
C:\Windows\System32\en-US\netmsg.dll.mui
C:\Windows\sysnative\en-US\netmsg.dll.mui
C:\Windows\System32\en\netmsg.dll.mui
C:\Windows\sysnative\en\netmsg.dll.mui
C:\Users\Packager\AppData\Local\Temp\UltraISO_cn.exe
C:\Users\Packager\AppData\Local\Temp
C:\Users\Packager\AppData\Local\Temp\is-A58BV.tmp
C:\Users\Packager\AppData\Local\Temp\is-A58BV.tmp\UltraISO_cn.tmp
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\System32\msctf.dll
C:\Windows\System32\kernel.appcore.dll
C:\Windows\System32\bcryptPrimitives.dll
\Device\CNG
C:\Windows\System32\textinputframework.dll
C:\Windows\System32\CoreUIComponents.dll
C:\Windows\System32\CoreMessaging.dll
C:\Windows\System32\ntmarta.dll
C:\Windows\System32\WinTypes.dll
C:\Windows\SystemResources\user32.dll.mun
C:\Windows\System32\en-US\user32.dll.mui
C:\Users\Packager\AppData\Local\Temp\is-A58BV.tmp\netmsg.dll
C:\Users\Packager\AppData\Local\Temp\is-8NHRP.tmp
C:\Users\Packager\AppData\Local\Temp\is-8NHRP.tmp\_isetup
C:\Users\Packager\AppData\Local\Temp\is-8NHRP.tmp\_isetup\_RegDLL.tmp
C:\Users\Packager\AppData\Local\Temp\is-8NHRP.tmp\_isetup\_setup64.tmp
C:\Users\Packager\AppData\Local\Temp\is-8NHRP.tmp\_isetup\_shfoldr.dll
C:\Users\Packager\AppData\Local\Temp\is-A58BV.tmp\shfolder.dll
C:\Windows\System32\shfolder.dll
C:\Users\Packager\AppData\Local\Temp\shfolder.dll
C:\Windows\System32\uxtheme.dll.Config
C:\Windows\System32\uxtheme.dll
C:\Users\Packager\AppData\Local\Temp\is-A58BV.tmp\UltraISO_cn.tmp.Local\
C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984
C:\Windows\Fonts\staticcache.dat
C:\Users\Packager\AppData\Local\Temp\is-A58BV.tmp\TextShaping.dll
C:\Windows\System32\TextShaping.dll
C:\Windows\System32\windows.storage.dll
C:\Users\Packager\AppData\Local\Temp\is-A58BV.tmp\Wldp.dll
C:\Windows\System32\wldp.dll
C:\Windows\System32\imageres.dll
C:\Windows\System32\en-US\imageres.dll.mui
C:\Windows\sysnative\en-US\imageres.dll.mui
C:\Windows\System32\SystemResources\imageres.dll.mui.mun
C:\Windows\sysnative\SystemResources\imageres.dll.mui.mun
C:\Windows\SystemResources\imageres.dll.mun
C:\Windows\System32\shell32.dll
C:\Windows\System32\en-US\shell32.dll.mui
C:\Windows\sysnative\en-US\shell32.dll.mui
C:\Windows\System32\SystemResources\shell32.dll.mui.mun
C:\Windows\sysnative\SystemResources\shell32.dll.mui.mun
C:\Windows\SystemResources\shell32.dll.mun
C:\Windows\win.ini
C:\Users\Packager\AppData\Local\Temp\is-A58BV.tmp\UltraISO_cn.tmp
C:\Users\Packager\AppData\Local\Temp\is-8NHRP.tmp\_isetup\_RegDLL.tmp
C:\Users\Packager\AppData\Local\Temp\is-8NHRP.tmp\_isetup\_setup64.tmp
C:\Users\Packager\AppData\Local\Temp\is-8NHRP.tmp\_isetup\_shfoldr.dll
C:\Users\Packager\AppData\Local\Temp\is-8NHRP.tmp\_isetup\_RegDLL.tmp
C:\Users\Packager\AppData\Local\Temp\is-8NHRP.tmp\_isetup\_setup64.tmp
C:\Users\Packager\AppData\Local\Temp\is-8NHRP.tmp\_isetup\_shfoldr.dll
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\StateSeparation\RedirectionMap\Keys
HKEY_LOCAL_MACHINE\Software\Microsoft\LanguageOverlay\OverlayPackages\en-US
HKEY_LOCAL_MACHINE\Software\Microsoft\LanguageOverlay\OverlayPackages\en
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\000603xx
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Sorting\Ids
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Ids\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Ids\en
HKEY_CURRENT_USER
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\ResourcePolicies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\UltraISO_cn.tmp
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\STE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\Cryptography\Configuration
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\OOBE\LaunchUserOOBE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\AppCompatClassName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\CTF\EnableAnchorContext
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows\IsVailContainer
HKEY_LOCAL_MACHINE\Software\Microsoft\Input
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\ResyncResetTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\MaxResyncAttempts
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOwner
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOrganization
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\MS Sans Serif
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Microsoft Sans Serif
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesRecycleBin
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\UltraISO_cn.tmp
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\ValidateRegItems
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\MonitorRegistry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
HKEY_CURRENT_USER\Software\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\CallForAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\RestrictedAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\FolderValueFlags
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\ValidateRegItems
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\MonitorRegistry
HKEY_CURRENT_USER\Software\Classes\Drive\shellex\FolderExtensions
HKEY_LOCAL_MACHINE\Software\Classes\Drive\shellex\FolderExtensions
HKEY_CURRENT_USER\Software\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}
HKEY_LOCAL_MACHINE\Software\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}\DriveMask
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Verdana
HKEY_LOCAL_MACHINE\Software\Policies
HKEY_CURRENT_USER\Software\Policies
HKEY_CURRENT_USER\Software
HKEY_LOCAL_MACHINE\Software
HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\AutoSuggest
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Always Use Tab
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Client\
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Client\(Default)
HKEY_CURRENT_USER\Control Panel\Desktop
HKEY_CURRENT_USER\Control Panel\Desktop\SmoothScroll
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\EnableBalloonTips
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewAlphaSelect
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewShadow
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AccListViewV6
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\UseDoubleClickTimer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Segoe UI
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Segoe UI
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ScrollInset
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DragDelay
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DragMinDist
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ScrollDelay
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ScrollInterval
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arabic Transparent
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arabic Transparent Bold
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arabic Transparent Bold,0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arabic Transparent,0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arial Baltic,186
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arial CE,238
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arial CYR,204
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arial Greek,161
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arial TUR,162
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Courier New Baltic,186
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Courier New CE,238
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Courier New CYR,204
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Courier New Greek,161
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Courier New TUR,162
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Helv
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Helvetica
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\MS Shell Dlg 2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Tahoma Armenian
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Times
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Times New Roman Baltic,186
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Times New Roman CE,238
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Times New Roman CYR,204
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Times New Roman Greek,161
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Times New Roman TUR,162
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Tms Rmn
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\MS Shell Dlg
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\UltraISO_is1
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\UltraISO_is1
HKEY_CURRENT_USER\Software\Microsoft\CTF\DirectSwitchHotkeys
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TurnOffSPIAnimations
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\StateSeparation\RedirectionMap\Keys
HKEY_LOCAL_MACHINE\Software\Microsoft\LanguageOverlay\OverlayPackages\en-US
HKEY_LOCAL_MACHINE\Software\Microsoft\LanguageOverlay\OverlayPackages\en
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\000603xx
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Sorting\Ids
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Ids\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Ids\en
HKEY_CURRENT_USER
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\ResourcePolicies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\UltraISO_cn.tmp
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\STE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\Cryptography\Configuration
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\OOBE\LaunchUserOOBE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\AppCompatClassName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\CTF\EnableAnchorContext
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows\IsVailContainer
HKEY_LOCAL_MACHINE\Software\Microsoft\Input
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\ResyncResetTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\MaxResyncAttempts
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOwner
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOrganization
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\MS Sans Serif
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Microsoft Sans Serif
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesRecycleBin
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\UltraISO_cn.tmp
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\ValidateRegItems
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\MonitorRegistry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
HKEY_CURRENT_USER\Software\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\CallForAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\RestrictedAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\FolderValueFlags
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\ValidateRegItems
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\MonitorRegistry
HKEY_CURRENT_USER\Software\Classes\Drive\shellex\FolderExtensions
HKEY_LOCAL_MACHINE\Software\Classes\Drive\shellex\FolderExtensions
HKEY_CURRENT_USER\Software\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}
HKEY_LOCAL_MACHINE\Software\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}\DriveMask
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Verdana
HKEY_LOCAL_MACHINE\Software\Policies
HKEY_CURRENT_USER\Software\Policies
HKEY_CURRENT_USER\Software
HKEY_LOCAL_MACHINE\Software
HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\AutoSuggest
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Always Use Tab
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Client\
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Client\(Default)
HKEY_CURRENT_USER\Control Panel\Desktop
HKEY_CURRENT_USER\Control Panel\Desktop\SmoothScroll
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\EnableBalloonTips
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewAlphaSelect
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewShadow
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AccListViewV6
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\UseDoubleClickTimer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Segoe UI
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Segoe UI
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ScrollInset
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DragDelay
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DragMinDist
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ScrollDelay
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ScrollInterval
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arabic Transparent
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arabic Transparent Bold
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arabic Transparent Bold,0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arabic Transparent,0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arial Baltic,186
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arial CE,238
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arial CYR,204
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arial Greek,161
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arial TUR,162
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Courier New Baltic,186
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Courier New CE,238
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Courier New CYR,204
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Courier New Greek,161
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Courier New TUR,162
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Helv
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Helvetica
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\MS Shell Dlg 2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Tahoma Armenian
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Times
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Times New Roman Baltic,186
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Times New Roman CE,238
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Times New Roman CYR,204
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Times New Roman Greek,161
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Times New Roman TUR,162
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Tms Rmn
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\MS Shell Dlg
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\UltraISO_is1
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\UltraISO_is1
HKEY_CURRENT_USER\Software\Microsoft\CTF\DirectSwitchHotkeys
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TurnOffSPIAnimations
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\000603xx
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Ids\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Ids\en
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\ResourcePolicies
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\STE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\OOBE\LaunchUserOOBE
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\CTF\EnableAnchorContext
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows\IsVailContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\ResyncResetTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\MaxResyncAttempts
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOwner
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOrganization
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesRecycleBin
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\ValidateRegItems
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\MonitorRegistry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\CallForAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\RestrictedAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\FolderValueFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\ValidateRegItems
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\MonitorRegistry
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}\DriveMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\AutoSuggest
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Always Use Tab
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Client\(Default)
HKEY_CURRENT_USER\Control Panel\Desktop\SmoothScroll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\EnableBalloonTips
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewAlphaSelect
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewShadow
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AccListViewV6
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\UseDoubleClickTimer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Segoe UI
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ScrollInset
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DragDelay
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DragMinDist
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ScrollDelay
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ScrollInterval
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arabic Transparent
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arabic Transparent Bold
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arabic Transparent Bold,0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arabic Transparent,0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arial Baltic,186
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arial CE,238
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arial CYR,204
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arial Greek,161
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arial TUR,162
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Courier New Baltic,186
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Courier New CE,238
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Courier New CYR,204
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Courier New Greek,161
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Courier New TUR,162
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Helv
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Helvetica
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\MS Shell Dlg 2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Tahoma Armenian
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Times
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Times New Roman Baltic,186
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Times New Roman CE,238
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Times New Roman CYR,204
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Times New Roman Greek,161
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Times New Roman TUR,162
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Tms Rmn
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\MS Shell Dlg
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TurnOffSPIAnimations
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\000603xx
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Ids\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Ids\en
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\ResourcePolicies
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\STE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\OOBE\LaunchUserOOBE
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\CTF\EnableAnchorContext
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows\IsVailContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\ResyncResetTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\MaxResyncAttempts
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOwner
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOrganization
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesRecycleBin
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\ValidateRegItems
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\MonitorRegistry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\CallForAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\RestrictedAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\FolderValueFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\ValidateRegItems
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\MonitorRegistry
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}\DriveMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\AutoSuggest
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Always Use Tab
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Client\(Default)
HKEY_CURRENT_USER\Control Panel\Desktop\SmoothScroll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\EnableBalloonTips
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewAlphaSelect
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewShadow
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AccListViewV6
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\UseDoubleClickTimer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Segoe UI
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ScrollInset
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DragDelay
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DragMinDist
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ScrollDelay
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ScrollInterval
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arabic Transparent
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arabic Transparent Bold
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arabic Transparent Bold,0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arabic Transparent,0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arial Baltic,186
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arial CE,238
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arial CYR,204
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arial Greek,161
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Arial TUR,162
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Courier New Baltic,186
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Courier New CE,238
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Courier New CYR,204
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Courier New Greek,161
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Courier New TUR,162
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Helv
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Helvetica
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\MS Shell Dlg 2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Tahoma Armenian
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Times
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Times New Roman Baltic,186
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Times New Roman CE,238
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Times New Roman CYR,204
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Times New Roman Greek,161
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Times New Roman TUR,162
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Tms Rmn
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\MS Shell Dlg
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TurnOffSPIAnimations
"C:\Users\Packager\AppData\Local\Temp\is-A58BV.tmp\UltraISO_cn.tmp" /SL5="$2017A,1790564,123904,C:\Users\Packager\AppData\Local\Temp\UltraISO_cn.exe"
Local\SM0:188:168:WilStaging_02
Local\SM0:4760:168:WilStaging_02
Local\MSCTF.Asm.MutexDefault3
CicLoadWinStaWinSta0
Local\MSCTF.CtfMonitorInstMutexDefault3
Local\SM0:4760:64:WilError_03
DefaultTabtip-MainUI
Local\SM0:4760:168:WilStaging_02
Local\MSCTF.Asm.MutexDefault3
CicLoadWinStaWinSta0
Local\MSCTF.CtfMonitorInstMutexDefault3
Local\SM0:4760:64:WilError_03
DefaultTabtip-MainUI
Sorry! No behavior.
Sorry! No strace.
Sorry! No tracee.
No hosts contacted.
No TCP connections recorded.
No UDP connections recorded.
No domains contacted.
HTTP Requests
No HTTP(s) requests performed.
SMTP traffic
No SMTP traffic performed.
IRC traffic
No IRC requests performed.
No ICMP traffic performed.
CIF Results
No CIF Results
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Suricata HTTP
No Suricata HTTP
Sorry! No Suricata Extracted files.
Sorry! No dropped files.
Sorry! No process dumps.
Sorry! No process dumps.