Analysis
| Category | Package | Started | Completed | Duration | Options | Log(s) |
|---|---|---|---|---|---|---|
| FILE | exe | 2025-06-12 07:37:47 | 2025-06-12 08:09:04 | 1877 seconds | Show Options | Show Analysis Log |
procmemdump=1
import_reconstruction=1
unpacker=2
norefer=1
no-iat=1
2024-11-25 13:37:15,147 [root] INFO: Date set to: 20250611T17:08:49, timeout set to: 1800 2025-06-11 18:08:49,068 [root] DEBUG: Starting analyzer from: C:\tmp_gell1p8 2025-06-11 18:08:49,068 [root] DEBUG: Storing results at: C:\iDarMfdE 2025-06-11 18:08:49,068 [root] DEBUG: Pipe server name: \\.\PIPE\IMPWOAOm 2025-06-11 18:08:49,068 [root] DEBUG: Python path: C:\Users\Packager\AppData\Local\Programs\Python\Python310-32 2025-06-11 18:08:49,099 [root] INFO: analysis running as an admin 2025-06-11 18:08:49,099 [root] INFO: analysis package specified: "exe" 2025-06-11 18:08:49,099 [root] DEBUG: importing analysis package module: "modules.packages.exe"... 2025-06-11 18:08:50,240 [root] DEBUG: imported analysis package "exe" 2025-06-11 18:08:50,240 [root] DEBUG: initializing analysis package "exe"... 2025-06-11 18:08:50,240 [lib.common.common] INFO: wrapping 2025-06-11 18:08:50,240 [lib.core.compound] INFO: C:\Users\Packager\AppData\Local\Temp already exists, skipping creation 2025-06-11 18:08:50,255 [root] DEBUG: New location of moved file: C:\Users\Packager\AppData\Local\Temp\WinPenguinsPortable_.exe 2025-06-11 18:08:50,255 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL option 2025-06-11 18:08:50,255 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL_64 option 2025-06-11 18:08:50,255 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader option 2025-06-11 18:08:50,255 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader_64 option 2025-06-11 18:08:50,506 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser" 2025-06-11 18:08:50,537 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig" 2025-06-11 18:08:50,568 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise" 2025-06-11 18:08:50,583 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human" 2025-06-11 18:08:50,583 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops' 2025-06-11 18:08:50,583 [lib.api.screenshot] ERROR: No module named 'PIL' 2025-06-11 18:08:50,583 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots" 2025-06-11 18:08:50,599 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump" 2025-06-11 18:08:50,599 [root] DEBUG: Initialized auxiliary module "Browser" 2025-06-11 18:08:50,599 [root] DEBUG: attempting to configure 'Browser' from data 2025-06-11 18:08:50,599 [root] DEBUG: module Browser does not support data configuration, ignoring 2025-06-11 18:08:50,599 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"... 2025-06-11 18:08:50,599 [root] DEBUG: Started auxiliary module modules.auxiliary.browser 2025-06-11 18:08:50,599 [root] DEBUG: Initialized auxiliary module "DigiSig" 2025-06-11 18:08:50,599 [root] DEBUG: attempting to configure 'DigiSig' from data 2025-06-11 18:08:50,599 [root] DEBUG: module DigiSig does not support data configuration, ignoring 2025-06-11 18:08:50,599 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.digisig"... 2025-06-11 18:08:50,599 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature 2025-06-11 18:09:12,974 [modules.auxiliary.digisig] DEBUG: File has a valid signature 2025-06-11 18:09:12,974 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json 2025-06-11 18:09:12,974 [root] DEBUG: Started auxiliary module modules.auxiliary.digisig 2025-06-11 18:09:12,974 [root] DEBUG: Initialized auxiliary module "Disguise" 2025-06-11 18:09:12,974 [root] DEBUG: attempting to configure 'Disguise' from data 2025-06-11 18:09:12,974 [root] DEBUG: module Disguise does not support data configuration, ignoring 2025-06-11 18:09:12,974 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.disguise"... 2025-06-11 18:09:12,974 [modules.auxiliary.disguise] INFO: Disguising GUID to 88063f41-cb09-49fe-8433-82e8a31757b9 2025-06-11 18:09:12,974 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise 2025-06-11 18:09:12,974 [root] DEBUG: Initialized auxiliary module "Human" 2025-06-11 18:09:12,974 [root] DEBUG: attempting to configure 'Human' from data 2025-06-11 18:09:12,974 [root] DEBUG: module Human does not support data configuration, ignoring 2025-06-11 18:09:12,974 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.human"... 2025-06-11 18:09:12,974 [root] DEBUG: Started auxiliary module modules.auxiliary.human 2025-06-11 18:09:12,974 [root] DEBUG: Initialized auxiliary module "Screenshots" 2025-06-11 18:09:12,974 [root] DEBUG: attempting to configure 'Screenshots' from data 2025-06-11 18:09:12,974 [root] DEBUG: module Screenshots does not support data configuration, ignoring 2025-06-11 18:09:12,974 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.screenshots"... 2025-06-11 18:09:12,990 [modules.auxiliary.screenshots] WARNING: Python Image Library is not installed, screenshots are disabled 2025-06-11 18:09:12,990 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots 2025-06-11 18:09:12,990 [root] DEBUG: Initialized auxiliary module "TLSDumpMasterSecrets" 2025-06-11 18:09:12,990 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data 2025-06-11 18:09:12,990 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring 2025-06-11 18:09:12,990 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.tlsdump"... 2025-06-11 18:09:12,990 [modules.auxiliary.tlsdump] INFO: lsass.exe found, pid 696 2025-06-11 18:09:13,005 [lib.api.process] INFO: Monitor config for <Process 696 lsass.exe>: C:\tmp_gell1p8\dll\696.ini 2025-06-11 18:09:13,005 [lib.api.process] INFO: Option 'procmemdump' with value '1' sent to monitor 2025-06-11 18:09:13,005 [lib.api.process] INFO: Option 'import_reconstruction' with value '1' sent to monitor 2025-06-11 18:09:13,005 [lib.api.process] INFO: Option 'unpacker' with value '2' sent to monitor 2025-06-11 18:09:13,021 [lib.api.process] INFO: Option 'norefer' with value '1' sent to monitor 2025-06-11 18:09:13,021 [lib.api.process] INFO: Option 'no-iat' with value '1' sent to monitor 2025-06-11 18:09:13,021 [lib.api.process] INFO: Option 'tlsdump' with value '1' sent to monitor 2025-06-11 18:09:13,021 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp_gell1p8\dll\NmhMelLB.dll, loader C:\tmp_gell1p8\bin\TfDuBatI.exe 2025-06-11 18:09:13,068 [root] DEBUG: Loader: IAT patching disabled. 2025-06-11 18:09:13,068 [root] DEBUG: Loader: Injecting process 696 with C:\tmp_gell1p8\dll\NmhMelLB.dll. 2025-06-11 18:09:13,068 [root] DEBUG: 696: Python path set to 'C:\Users\Packager\AppData\Local\Programs\Python\Python310-32'. 2025-06-11 18:09:13,084 [root] INFO: Disabling sleep skipping. 2025-06-11 18:09:13,084 [root] DEBUG: 696: Full process memory dumps enabled. 2025-06-11 18:09:13,084 [root] DEBUG: 696: Import reconstruction of process dumps enabled. 2025-06-11 18:09:13,084 [root] DEBUG: 696: Active unpacking of payloads enabled 2025-06-11 18:09:13,084 [root] DEBUG: 696: CAPE debug - unrecognised key norefer. 2025-06-11 18:09:13,084 [root] DEBUG: 696: TLS secret dump mode enabled. 2025-06-11 18:09:13,084 [root] DEBUG: 696: InternalYaraScan: Scanning 0x00007FF84A790000, size 0x1f4542 2025-06-11 18:09:13,099 [root] DEBUG: 696: InternalYaraScan hit: RtlInsertInvertedFunctionTable 2025-06-11 18:09:13,099 [root] DEBUG: 696: RtlInsertInvertedFunctionTable 0x00007FF84A7A090E, LdrpInvertedFunctionTableSRWLock 0x00007FF84A8FB4F0 2025-06-11 18:09:13,099 [root] DEBUG: 696: Monitor initialised: 64-bit capemon loaded in process 696 at 0x00007FF822E30000, thread 940, image base 0x00007FF60D500000, stack from 0x0000008EFACF4000-0x0000008EFAD00000 2025-06-11 18:09:13,099 [root] DEBUG: 696: Commandline: C:\Windows\system32\lsass.exe 2025-06-11 18:09:13,099 [root] DEBUG: 696: Hooked 5 out of 5 functions 2025-06-11 18:09:13,115 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread. 2025-06-11 18:09:13,115 [root] DEBUG: Successfully injected DLL C:\tmp_gell1p8\dll\NmhMelLB.dll. 2025-06-11 18:09:13,115 [lib.api.process] INFO: Injected into 64-bit <Process 696 lsass.exe> 2025-06- <truncated>
Machine
| Name | Label | Manager | Started On | Shutdown On | Route |
|---|---|---|---|---|---|
| win10-2 | win10-2 | KVM | 2025-06-12 07:37:47 | 2025-06-12 08:08:44 | none |
File Details
| File Name |
WinPenguinsPortable_.exe
|
|---|---|
| File Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| File Size | 1446064 bytes |
| MD5 | 19f85dfca643fbbdb97b1f05abf15d30 |
| SHA1 | 51f379142982165d7191b0be91c5f9b6560d5c94 |
| SHA256 | 91da25a19cde4f3eeb591e92adeedd34a4eba6761028439d24805a305c428a05 [VT] [MWDB] [Bazaar] |
| SHA3-384 | 850be6b70d29babf48ba2fab686c95eb77ada15287d708d1271e9a97f6e792d8eae8aa163f788486b44e09e81d680560 |
| CRC32 | CC0DE116 |
| TLSH | T131653344E9F5D1A2EA210F712E769B036FB39D15157AF647E340FAEF2B3B0086318619 |
| Ssdeep | 24576:k69DMQ9qImivWkkglGXPz3bMpNNNFx320nQd1QCzEmec3S0fk3vJ6k36K:T9aImEGXPz36PFU0MHZe0j8J66N |
| PE | File Strings BinGraph Vba2Graph VirusTotal |
4D/x)
m =g6
sy":h
@.data
+kU$F
)-"0x
IsDlgButtonChecked
Y^v@C
8YE|_
L]U]q
%dK/e%LM9
A6)-_
-@O7[
Wde8'R!M="
:m'7$[
(Y:pQ
kAGu9:)z
$:Fe&
D{{9~
jvM6
.*ynw[*
F9JAp
wB=t<
9fa=g"
R9Q/>
,/"M?
5Au{l
qE~sk0
g-Oe-
{\]S%-
57/Jra
;7gzX
!!2=Z2
8@yJK
9q7H7
V^k5s
YZPx!5*
j^67Bk
|PP<{d7
;-%fL
#7]yC
{Ag":|
hxpK6I<
X0pSv
7ja2S1
&jN_$
*,Va37o
=hu;A
/E;D'
`1<rd
@=D\x
+D}Ta
H>)h\
GetTTFNameString
2uC/s
CreateBrushIndirect
opQRD
^/!..
=X+ZRA
bq5B30$+7
S{73ZNA
'ar|8_
OiPb+"
8XrDjao0
%R8&b
ea|*1
k)sk!
3L+.
`kw7R
Lj%
{ejXV
3n>d@
Error registering DLL: Could not initialize OLE
dSu.LA
McU(u
=0=f=w=
~>xP'Ji<9D
&EF#j
D$4+D$,P
}cJ8gd>
v7_sK
Ufe{*.c
#]6Pv+J
aFPFm7
_HhJQ3,
m`ANl
LlDWL-
[BpK:(8
uKe<BuH
D$oxn3
"> .B
O_L15o
L/]kb
Ya<`O
BiqW|
w0$Tn
%u.%u%s%s
LoadLibraryW
{-0XW
a|!8w
kg)\a
SXtOL
(QHNkL
nMI#bG
m$LcP
#68v]$
&KP-nn?
!xEC6x
T0/~Aw
!z_)D
2oFs.
Sm"7[
MchdtX
*CJXp
DEQ1|idL
^4v8-
Dqs9*J3
KovL|
W`G@*
i?`'V
!3M>O
XJ+L
8k%~*
l*-'[
K1\Q/
iC=iB
Lc<&GM2bk[
K"L@A`
2!E6+
.1$=r
7E@Yx
=TwPE
A;<B-
WSw"~
e&'\S
._@G*
BZ \V
-9"|~
tggz`.~~
pxa]S
'ZT=Z
o'0\b
IbVz/3
.TLm}/~
@eBZY
A,{XQ
)TbRP
Ek|R<Gw
3I*](
kz|.\
=YJct
;`A?puc
K:0Il/
[2*\ %T
cssam
S*Zf-
`,hx\
T3e~w
^d~22
_{$D'
;#?<@
y+!5c
1\?,I
WriteRegStr: "%s\%s" "%s"="%s"
&t*{NU
igOyg
uE7qd`
r!B"`
EXh,"K
_+:Pe
^P.>I
:QEDT_
~{y;~]c
_?%kx]
;L;V;b;w;|;
!.3x[e
E59B$6
cm0AB
{Q9>aY
366&Vst
P5Sb|
%s=%s
uL@I2
.r0$]2
)YN<'W/
q^Q{Y
-vGrM
g8,<T
jMwZg8
\Temp
MX~I^
Q$['4
<~0Ch
RX5{'
CompareFileTime
@g=[44
Rename on reboot: %s
qN:}Li/
?zH_)
\Bu^3
xhP*I
ml?UD
H[lkHz
.*$bY
j4|Mu
http://ocsp.usertrust.com0
BX,4p
'\_O-
\T)Uu_
cL(/y
Ki(*"T7
tlO.B
[2 LH
JmfsE
|qN]`1
*#lZ|
&+4UZ
4!hBJ
;6"mw
]J0 g
U$DBGF
v-Xc~
1W'n]
I[yLJ,
vO?[6
/%Cd^
$k|7/f
ILSTg
KwEjJ
IJSEn
[i^EwE!
*=Yms
: ^LJw
p2)^5
%{)W.0C
gjyr\
/SVGLX
&U.Y@
}1f7;
:]%Pj7IU3
z!x}2
b[*x~
j~t-x
#`c={
lstrcpyA
t@ <`
*hTg=
j];.<
logging set to %d
AdjustTokenPrivileges
/L%N{
[4ij)!
:J +l
|aRq2
t6}!W
IJj""
->*7$
^iXqgH
zzNO;
MG>BJI]
L{)r,-
EjVX*CO
$f%3u
,%dH.h
5Z]-K
]%._r
${)*p
@"kstcR3C
5s2?x
#3GQ_!0
b,4}Y
COO:XY~^#D
>]91W
'qyY:
z'@ge]
>5"=~
PA%~6
/IhF]q
3]?GPt
;+<P<w<
9ZDi~y
;=uYk
*]yj/T
iMPgu
c33Os
#4c4w
$qe4O
#8,\|
@vLh/
;hA6Y
^Xd-=
5cicV
C`y2G
UMB_N
]iH_|
,2ls=
kG!:T&
@HY\+
!&91X
U~s93
D/!w@
q*P3y
yhP!o
xD{hB
?#\O
I',CQ
GGg]OQ{
J6jWk
Y xLNi
6h&t0
!qNk\T`
e<C{h0F
;]a!;
nt.T#
G-:a+
k]|D}J
$yiF2
lLjS._
3GeMa[
tKn(2
GetModuleHandleA
RMDir: "%s"
f,%(G{V
mXVl"
8g(m!CN)
=KaK0 $q
MDO8L
~A%,`
-)Uh)Ul3
)g//z[?
uC?vU
#W%.K,
AGd}H
C^|;u
xyGE/
,sU+r
6aLbY
m,(u[
.rsrc
"'f/EH
<3<S<X<c<k<w<~<
w,Iz$|
EEx\m
3r,rx
AY2Rk'
wt5p<E
C~tns
.PZg^
Y'#2t
aHRkL
*#Y<e
;,cX;
h'hDm
X=|XB
9@;+y
:d*$a-
0B>i#R
m=XjN
QHSS}
@;!T-
475z9
u2O"[
qJ-e*q@
>E{!!
1Kr *
CM$td
n0i9"
V5x!4R
o2$.
GetFullPathNameW
yXb,O
p#L'8p
&lEbEG
=r*/F
C&yA'
fJvVG!7
#ja3;
Oty,]0
4]>3M
F*7gU
oQ2vL
)0<1uNvfT
D"QA2
:KE90^
j4Oj}`
!C-e:
oFo*3
0zM\g
D2@V"g
S6/Py
VH\5dyv
RegEnumValueW
SeShutdownPrivilege
[FAg$>
U4irXe[
94}1-
]^V}-
M"x5[
L]NYT
$W@z9
4THM~
g#l|C
TkOsP
q0fe\iWs
i TH;
NSIS Error
".cZS
~'UCt
9E9V9
CreateDirectory: can't create "%s" - a file already exists
;@kFd,
a44D=
7dv-2v#qs{r
Uy+gD
|f;Wm
5me{V
.text
BeB;2
Z.NHA
DS>3SO
SSLvO
b,n%4
,5tbyST
5~81>
9sBnI\
Oj9C1
@~\.K/R
Nxq<3D
U-Ok1
'zcDh
N'5P3B
H5\'F
aYNde^RgHB6
q,cIs
|o$[t^
S3j'=*~t
9xu7O
2,<.C-a
^=\>!
xfR;l~#
1pvsl
)>^K/
Zkc-V0
}3TGD
8855D;^O0
S?P{N
ulw`E>f
'.our
!(OG,
^j\PN
t{+,p.l
WriteReg: error writing into "%s\%s" "%s"
m+Bgh
M-iOO
v'f"D
$W(dt
jp?>k
E0C0A
gWbLw
,12Bn%
Y;?rn
D0oXef0Se
s}J77
d`bW1
wa3HI
aG[c/
CZy`^s=
(tH(1D
T)bFM.
+Symantec Time Stamping Services Signer - G40
D?<JSRj
;!;';-;N;W;n;
}n4ah
7Ev[Qe
p\B_n
Np/qA]
NE4S~
*/$_x
2HB?[
_m.eL
diI$O
OOW4W
HW<|@
/g#OX
VDPS'*
K,@^:
LDJyEC
5c+/16
uu!O/
&.Rk&G
]\2^r:
Xc^H.i
{5wV6!
H\Tv5
DeleteObject
TpYu)
>f+(E
phP]X~=S#
Z1qB%[;
=d.['j
EmptyClipboard
+_qw4
f_=wD
qG8un
u+lDb
6A@-x>
SE6j?
T9c^|
7W_i$
BEECL
S&m&%S
UYmf-EW
aGa!$
dhQfs
fMg!y
9569)
qt\4I
F>DCU
~4<FJ)
7j06O
#_#18
RG !/E
Z,V67:r
1I]fL
?D}<{#c
md:qq<
CT+9AG
g`i8>;
#=QIh
fJbJ8
W6OE*
A{wU+
w/s#ap
yw JnH
n FgePW
xWrs|
(8VCX
%:HL_
G""s?
dQ:5oS
c|CU)
EndPaint
O?CKe
/+<$3
Ck\S2
Pk++?
u/=QS
~C3;&D?
]\Puj
$4[F.
@17/d
V?^X=
t`H7zk
L^t!C
C[[>g
-*[5*
XG2*^
?r^h>
yrBo<
\3FqQ
/DKMx+
.8^#\1
H%?VO
!cOti|
{ 7b\
98i5M
y"!"G
.,Bx&
Ftsvp8d
CMGc.=
Mkr!Z
j2e,.;
kU_J1
lsL$A
}(,x+I
kTF[e
0M28gx
4.+3Z
MY#oG
/OxhF
d@0k)
X^%4&l
80858A8i8n8x8
&zUxS
j=@zJ
nhtSE
D%\8G
HKaXb
`DWtF[,.
,/+B#
b4\F@Egu
]M]8t[
3Xgv|s
iNaIU
LegalCopyright
^UxH+
SendMessageTimeoutW
Exch: stack < %d elements
P]s=!
$$="ee
x~E6Mr
XZmyf
kPfmLSz
zXfd0
SetCurrentDirectoryW
2007-2015 PortableApps.com, PortableApps.com Installer 3.0.16.0
}"5HDo4
bfjW$
GEitwG
b5/\"
~Tn M
Sghv~^
^fObT
ksnr#
;kStn
z{04x
$d 2L
File: wrote %d to "%s"
GetMessagePos
RMDir: RemoveDirectory("%s")
_6Uop
I6Yq==p*r
lq+Sqn<
%naU*
5M4(,
GA9\.
~JL!OZPr
ZW2YC
^,:>p
909>9c9o9
http://ocsp.thawte.com0
)9,:3
IX"ll
^Ur^J
mPm)^
[E=<|
XyaDf
iZ;qR
)z[9D
]K%P^
ImageList_Create
uj<1/
OPTe'
Rn; v
onm4|
|j1!^
C'uz)
`OC5Z:n
gi4blk
l(e/c
Mk4nK
0+2?d
Mu@FJ
LNRV)
eKN)s
@k$yE
Vr~Li?
MX5j:
XVLb97
0)5ei
J@MY% M
QYie`
a.[\H
g$FB2;
T;ymz&T
xwX)~
N]f3P
Kk$M?
Y&IPe>b
COMODO RSA Code Signing CA
j8Pve
L6^=7
000004b0
5\HPe
RFApC
i0OxIi
LU5&g
=3P`H
$q#sZ
LT+?e7
O5"Cv
<l>;v
5b/\J
1Ua4x&
A-OFL
|zL>"
/53ab
v9v-SB
#;&5s
zX5~*
c+.+%
AddTrust External TTP Network1"0
WZLzxlV
_-UG$
)rIdh3
@-wC.
,JlpN(
i\QBo
p7!J.
)(<G_R
AA~yV+_
>6;UG
PEu^o
\*_uQ
3"#9h\
t=PuM
:E H&2
8{vYtY+.n?
o_'tV
.[*A)
C0Ovr
)*/b(
0Y0i0n0
tL07vZC3
s]go`Q
L\73SW
HP@A+
9!bbS
5<rR5)
)qNtBd0
4:n%Iw
;v;wh"
\H1kH
J<7,\
DqBS|6
For additional details, visit PortableApps.com
oOyKt
NQ3T[]
Acp.!
e=v%I
\"*QZ
:hW2e+S
d!Y"T
File: error, user cancel
v:9Cc
],CSM$
v0Jst
-{^Pw
ph1%-e
@_[f_
5VD1j
^|x/w
W]&.p
%L?bG]
T$?1p
WfZQW+
;nnB<
msctls_progress32
JE8g>9,3
@dzE_T4
SHELL32.dll
\Yw<u
P4~)o
GW]w4
+muD%`L8V
7{[jjy
hx^cSh
jh.b)*S}
sx.2p
4)8kc^
cq6CW
OyetF
^tS_;
7]\z*P
'XydY
S7<$/p
RMDir: RemoveDirectory invalid input("%s")
nx@w3
xrj$q
~>\pz
g Piw
0BaKT
34HLN
W*@@"
40%.qh\
WhR)4
y[xmJALp
ShellExecuteW
s^"F
kqhO jk
9E8um
7kc#O
GG3w:
}2]j:
OWb(t/q
clX2V
Pz.)<
}.IzS
{Q;s:TC;
?TK3DcK
f.?^|
$\",:
/ P6pL
CreateThread
'y\??
SetBkMode
F?gNZ9
qMJWLI
"@|nk,
&S,*%
(\w$0X
a9G1<h(
5G6Z6
-91|Tyq
s&v0V
qwvbP6
&eLu/
94&uv
o@1yQY6
Dh+i@
^_2Hzo6
"bm)MP
@oF<{wW
$zGTNl
7W{Ux-
-hSNkN
pG3~k
>fC+C9
ji#=6$
O7/Ruv
3->'Jg#C
1~@7-R#B
FLyw
]EMKz_~
,/?=W
" 6uUKc
Q*@W?
s?vWA
T'9aS~
gM4g;
ExecShell: success ("%s": file:"%s" params:"%s")
=G42'
Y$kM,
-1r=H+y
H]mYb
bsjjYP
i"GZ$`
})+Hi
=Fd{@
K+p\)f
+vf8L$T
2b8hp
4.g&J
GetUserDefaultUILanguage
SWxugW
DH3_/
tv>ZU
1sb;P]:<D
{N8D<
Zy2Bc5}R
/-P?pR
I(Y57
1~B7y
Tj\ #
PortableApps.comAppID
p)qS\j
Y5c(G<
FindFirstFileW
_~8r^?
-Ja}8
]C-Ow
wsprintfW
Jf Y'
979=9
YE6'RU
Yr+"G
\0#5#
00@[_Q
:oFab
J3|!4x
zCYjW
2n3D]T
OSz}M
k(U9\
% D3t
%:p%|
BN'6s
S+*7I
S[GB3
1&2U2a2g2s2
)Mh)Mlf
y#v`[=
Bsw0RK
ooq<;
{VLnj
~X$8T
<T*|u
D/{|h
0uU\|
j8WUHBYs
<+<4<J<U<m<v<
/<cH
Y@|&*
)L)ey~p
*cV a
7a?k&
[p(5H
5Tdo?
u)7>F}
4:iSG
OWQ@?
d q:^3
2'Bm.
xm^>Q
x6WPf
4F#Z6%
~]L7)
5+/u}CY
4/4o4t4y4
U\e<ZD
ViEY%V
i:F7Z
tI'^V
j9j T
Z*&R"
D:n&62
5aC^W
AUpm&;
9l<x@j
$)K5A
m|L0F
2=SQ(
UQGPd
:}zW]
IDATx
<o~-9
_\j2G
2^?5v
hdq7i
tGk5>&U]B
QG(B+
{z&ws[
] hmR
h|hLb<
G" 4r
V?T"0
v-~hV
sk:K*
(S~FP
,]W+f
*{m%;
m:+"`
NeTG&S
knD6E
1%\:H
f(@0h
4V\7_
3,{%5
^cm>r
S-H0_+
.r5]tq
uHB0D
TFxzQ
&EFPd
<96U'
0h|fbpAL
ZP*oO
D/I>+
a.Hj~
]n?PAf
=D6irJ
>RKxj
;S}ig
WideCharToMultiByte
\#7/Nh
8b{kw~
VarFileInfo
JMW-Y
#T6*c
272q2}2
e{1q4
2|H.bQF
I)\S"
mE +p
D@710+
amru/
!:\c?
&BUi
ln>"-
oo";4
'5ykf
D65| Ea
=:Te_F
GetFileVersionInfoW
=v)t_
Xs5;/
Z7`{
_kV$7
-3wx<
detailprint: %s
CreateFileW
b2U:O4
=<^[_a
%[hfJ
p^vH[
A-k)"
(lp]3
CopyFileW
5B(<@QF
Df7$u
GJW5
qipG*
raZ!M7M
BS,.q
*le4LQ
W3J7g
fcN8V
CN@oMv
<;ZRi
SHFOLDER
JWU`y
N[""D
;mMKA
Hr[KL
Ib bo
2+BBH
Z`P-m
]~'&n
;3}N/
$*}A]A+
'Qx0,
wO_7{
g@\Ld
@-s[*
^w]fu(
fwGJ/
Module32NextW
nRQTWq
'E{^8
7UUA;-
wF_2v
*qtZ'
QQg9/
=/N32
,}4;O[
GR)1]I>
;I2 [
7I%!0
M!B`1
XaB'L
GetDeviceCaps
h,iU/
Nfk)W
Mo$c"
rxZPs
3]r3[
?T<#]
f%NL\s
HKEY_LOCAL_MACHINE
\J6/B
K056>w
y33 D
?`1m5
TXmA,
1m/``NI
n1)10
qLY)BE
EQbK=u
KERNEL32
t@b7rNu
se8*;
x)N_ej
Q0!~(t
0HVhx
ZS5]Q'm
^8j-\0S
n[7;UxwR
A1yl"
eN)l[6
WriteINIStr: wrote [%s] %s=%s in %s
>j+c(
{(a_k3
<drEJ
NhIdv/{
?3?(^
f7bL=(m
Q[ld@
>*b&m
X#w'>u7
k!Bk?/[m%
1;0w`
f.;y4
Wg559s
q<%@YVb
u][Yn
9pqy/C
SHGetSpecialFolderLocation
Ax'< e
^!Pb(
wvsprintfW
T-`f$
8H3u\
p2CN;
&#m%-t
GU?%#zN
R-$!q
QpbFU
]pA(^
yv]>1
U76* ZS
UWvxv
{F47#U
EqVj@
J3H:r
w5_ H
yGt1X
:esZq
k~sK1
[4Svi
kEj[]
Ha6ES
T3=of}m
}"PZUim
:e?41
:H_e8
[wj R
1fKFW;
hojw(
t]k]1
B]0#*
B3Cqu
40)2
T[ALh
_.uD]9l
{plsY~
S(Ty {
il)F*|
{{[P3yB
B6cskb:
G)0\B
#D')NAerh&
WriteRegDWORD: "%s\%s" "%s"="0x%08x"
-0W\{
Dk5 J
4}p|BO
p|z*O
Ki t~
bwVZC
2%~wP
lT2pQ
=NZ4\r
)ubog
I_<lWo
y3=P[Z
gI3FY
9#{p?
X=7=g!G
:I`&]+
6Xbf<T
BHxX^
i7PMX
ls0L#
;UMyf
@Bvk}
4vz!c
=eM^ZS
}@Or5,yZ
Xm?"ei
qsLm
Go6x,y
BoA8WeS
olj}xyGK
!vZYw
#]x@}[
s;YRw
6M0r\
)bDw$
=k|v/
j$'bd
Salford1
H3|<0
GNpF}
!g.t9}G
!lg,l
$R:3}
JX"`/%
:lopL&B
oa_21
sLOqoy
sTnkHP
_Blw5
C1vPd}
G6o&!
><f(V
"(,/.
S|5)6
AyE5l?9
?00Jk
J5v.7
%cPCC
SetTimer
tJ_,SO
)i2Bx
QY%13
XU;q"<
oSbLQ
Yq"xRXl
L\R:H
6q7v7
Rhc*U=
oUy~O9
cb3Y'
K\7 }]
-<BN'
>L4pW
K7z`A
(r+/'
T],?[^P
tWmYa
a<7'5-
H1Vfgh
gtJ{-
New install of "%s" to "%s"
(%zMG
eKJ%-g
GetWindowsDirectoryW
DefWindowProcW
M9=$_
"D?2j
_7S3Mo
0WZHBMko:.2
t{s`fT
tSL#x
GVeYN
$ZU`4id
>&>P>^>e>}>
J7zZw
F#u4m
GetDiskFreeSpaceW
D@0[P
uBuO.
0E9=En
,7BD1
Sleep(%d)
l!G"m>
;SM1K
aTX%3
jOM^t
'jf<"
b}0{*
JkOnf
XR$m%
\Tm t
i"|ok
pk)JM
WO/yY_f
#yA7NB
(H JC
Yfo827
yzPVL
EL^jt
_jlvzyxb^
PvgYT?%
<iU\3
28H[kF
*uwfVY
a2qNr
AU`JrC
ly$^0
bA(7
V,1#q
0zkI8
\FmT69K!
pCABy3R^
|A%Jt
*g!=)b
-CK.Uj
Kh!*Z
u/I.O
XpAVw
LUu}pV
K7bs'
9Dn#T
;CN9>
hB"+a
-Wy:|;k
/,,z)c
4ZmJC~?
O&-g,
FCemF
Z*Ff>
J.|E7
;!;2;A;T;
8m#n,
C}oWq
&XVE!
NW(zkM
|&#`dyD
$^7ReW
cK|S6{B
=A*1g
x.Nv\
GFeO@
m`0-l%
hLdb1|
6M{.z
MoveFileW
g)lu-G
http://nsis.sf.net/NSIS_Error
s (ZD
9*";q
iza2A
|b85J
qt7;;
j^1de
62Kfh
X}7OC
J0N.R
COMODO CA Limited1#0!
&dn5St{nIW
LT"pf
A]rx&
o-~CTd
@KguQ
"i2,?k
KTg~2
xV,;uI'`
4&bg}
#sX_H
IEFNlD89A4/k
C7TI]
@/4@<r
\1T8ha
^O{8L
FY4\.
A2z!J
0|zLp
:'yBb
eUq8u
hDO#S
eDsP0
.j9.t
/http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$
)]@$2c`%
K@W$0
kZv>@C
aKU?e
#m#~6
<m@jx
qe]b\
qZnc^
L7lYR}is
Q7zs<Q
h/]Z.
=jJFZ/VI-
6gdo,Y
!s#sh
LcP-R
Jj&LnD
4&sDq
5#1ff
$++VVf
3"%uL
-,TPW
M~7r5;
OoV;u
GDI32.dll
[yU?cB'83
Y"XQX>
*>dAe
"2Amma
(itzt
N]u[C
n}WT\
:)zBY
cEU>`
tL=$t
6*F~":
^y~e"c
yB/P$a
5ZCQr
KDxaH
:3FPs
OR;R.p
kwRI@
Oe>%M
xplI.$xr
)!C'0J
,-.!~
w8qfU
0qIkz
+3g8/
http://ts-ocsp.ws.symantec.com07
r38CE
"\Gff
HKEY_CURRENT_CONFIG
Ntez<{
.K_%a
BringToFront
U{A*p
0j1qN
COMODO CA Limited1+0)
;_bds
$XvNDa
uw6^r
u*dH@
]aJf:
O=A'SwP
u:FeV
201230235959Z0^1
IkNwd
:>NtD
^pmMu
XU_^RL;
ooI{#
Ks9BqqY
E!1Ig{
0 9e8
"COMODO RSA Certification Authority0
MF\3G
[UISaYNd|sg
d-Gn
XOi/y
w^j)8
AO|Q;
QU>7t
Wtv\P
x7Vwo\8'.
*c)_N
{Fj0V
zVxW<
i}C">
a,Hvf`s
Nb8z|C
7h&E.
N3r%l=
GkQ(K
GwB[Rq`E
qH:vr>
sE,I_
0hbk~
Gu6:Zs@;
+-lay
<wm1}
<kv/v
YFbmG
0GA@0
bkSK05;
SVCj5
^oLvqPa6
cWEnl!
x5}0E
3S-f+'Y
\T@P~
*%4r84Cp,#
%\m0#D]
wQYb_
Psc=2
T: <Cm
t$(VV
A2kZ&
_3\XD
PortableApps.com is a registered trademark of Rare Ideas, LLC.
GetDlgItem
pREzN
`K5-qc
"YB3^
q:27G
'^nm.
2-{Y1
m&{%' S)
nA+n.
Q!IYk
m*JpH
n7}L)
<(*Up.
<+m;"BA?{
4&='k
<4*F:5L
6x:Y,
SU^-{
<vE@l
!This program cannot be run in DOS mode.
PGCTl~aD
Mq$6
9+9L9Z9
.X88CG
RPwr?K>
hHG6/3?!
[W-Uc
@;>n3&
8CG9*
GAV-D+
s|lDN8
:P+_v
%"GyR
@^B]e
\$)cf
mB]t)
QhM~2!"
z.Dz]
.i9fe '
"Rr^R
JZJ!5[
uVi'WQ
>OmE"
fw8MCD?
8=G$o
Lt,YS
"TN([ o
<~4|4
,)A)Un
2_^H(
,9uRL
B/LJ9MP
RegDeleteKeyExW
=vdqH!HZ
I&k9G
@qJ}(#
-dUF{:*4
wb +V
q+4=k0n#
^%!]M
R*>q* yf
.[Ffi
XGi&/*eQ{
-YI(\+
*%|n0
G>cdH`
CopyFiles "%s"->"%s"
*TnZg
v~yme
M]w?xt
;(/kR4y
; z%p
ry;#+A)=+
`k7CwSJhu
92%K8
+`d%w
-JdmC
aZm{C
<|")$
o3A :
1m[FLRM
`74Z,//
=W:O>
P8g/C
Translation
vhmlF
~Q?'h
{YI<c
*U\T7
_c<z<
05To@
HP:e~
%Z<_-8
B{e`w
~)*}E
NKgvWv
9g]iV
J*gvQ
,['Td
'!!c2
xG_(hc
-5w:8x
B/>%:
fPGNSP
,=q|(
N!p8g<
<u`Reb
(KxU^E
(Q?z{
=E%VB3
b8Q&x
&e.*/m
BAvojI
]w[Sj
M@CPu
,M+Eu0
=)a&n
lmyTnq
`Fuhj
>8aVd
>1|J7
FqJFM
aR<U,
6D*h/K
hdQ(!"
u{U:t
})m#0= h5>
*'9B-7
1;]eiN
00N!rq
)@~EN
D>Fz/*
T&H!{
9V2?z
{rOT#ZY
"V*NL
Y@,o%o
_)=(e
dDOt_G
3q,q-
8mTXt
nj[Ca
`hRr3$8NBU
-h2=w
Vhrl:
\ff8(s
8^hm*W
MK66.a
@e GvW
+^<YCT
xyPP)
VB+kU[
Hv2uP
}9mB0
X,H<neB{
W7cOq[
^N;Z`
F@f)k
hB0I#0::
c;(>J
K_n*8
H--_t
Z]sSr
qJvly
R]3*f
;;rz5
z2c"0M$8
c:}D"0
-2%<C
Hj\("
BhTE.vD
ZQ8]kK
\P%t7b
2sY+F
2a=bJ
u(\nm
}mM3#!
2}em3
byius
3Y"?4
U/a:}
Pzzd|
(Y\SRX
y?n&*>
Nv3l@!
~b5l"b7
>v,\oG)_
AIna_OL
gW\O<
2gg-q+.
m!!hJ
F-4"j
;bQ*[
;Xdot
Skipping section: "%s"
iDMfC6
$>>'9sk
V0/Xus
B2[-=8
hA0W^
Cdpfn
72=\Z
#+M1B
/rY.y
1L(N-k5
3F?nP
|D*`\
D3$QI#d
rF"]I
884B=
;jYw@
:E8 ]
ER(ge
8RHmq
Od%F\
'x)1v3
*"L@+B
tND`z)
Qdy"b
Ce%{u
install.log
9Wmmn
m3RSq
sOz^W]9
EQJ:Z
Hhd#v
?VsP=
3p)^e
6zK{x
_a,J;#
Ek9`F
!@A'T
K-zbZAi
Thawte Certification1
7f@)>
hsKH,
o9HvR
d4"|i
1a,`:b
MsH*%6
Es8<{
%MVVT
>~xW<
N-Rtdj
?sZCtP
/2M .
ao}kuF
'xH7w
mGDl`
RJ:RD
VT't3
{@JF8i
[(-V0
D{U[s
p$)'z6">
Jd>w6
EndDialog
[7a.7UF
WinPenguins Portable
qo{.y
?y%F+M
RE)kS
5x|HR<
icQ3S
TY8KB|
MUh)._
zXxj-
IW'gh
~E6by3S!
sLM(c
P'&"E
iXu~\
ri&>w
nQT&fV
1Y%J/
p1.19>
'*1:\2
bN>{i
O\9\l
^^(%7d
}N'%z2
_v'W6<z
)'33b
rjT1;
eLP"co
IC 6>~
File: error, user abort
HWs:p
/l1!|
:7?o
/%5;|/
Z+73Y
kla)[
cm5f_b
ke['HP
[uq!Dw
A\|LA
usT<%
ph3T,L
R~\s@
M? 4FSYq
o\|0zct{
Y2O)8
R'XYV
y{<bS
P2]HwN
mI<7-`
Nlt[R
meccp
!c{zj
A&cLa
1#101>1J1P1U1[1f1l1
M=$zk
invalid registry key
qzoVN
+R9P\fQ;
S}]7Xj
_|*)7
ZC\c'
USPK.
m7RFA]9
(nC9z
0'dG0
G@me_)X
(\.T_
3+Zw.
"HZl?F
XpJK4G
!K`QX
@D o1bFVn
=o]zi
S47xZaY
?;A>#
verifying installer: %d%%
`-1@O*?e
\f{*S
?mud=
&V-tdP
6]4LJ
;9SE+
ucUic
';h3w
J_,vdRX
^39o0
3C[`u
LdS5t
pQUf$Pm9
1XZVTO
ms]W[
jL\u;
|GJ+D
rBR[H
LoadLibraryA
qb7dH
v%g[}
Zr,L`
>].Kf<
)+kk)
oG:nsZ{
SetFileAttributes failed.
d:5Vi
!A!)#sF
b:40gy
323V3j3
f<=dS
7w'@)
nk$'5;x
,_\yK
SHFileOperationW
tRJzx`
V,VH$g
8:J+\
s,1Z=
o:R%j}
+http://ts-aia.ws.symantec.com/tss-ca-g2.cer0<
s%;JY+EUC
z8xXU
enjn:
R8Db8
'(8p0_S=
Q];$K
,M8gU
-_}<:M
qaxwG.
$Al);
CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
2"y!3:{C
CY"&K
(ZgJ.
=0tW2
;EyNS
bPtRX>r
-n(^O1I
e5p=,i
R}vNP
`KLyx
LE7Lh
-u+Cu;w
K9bc
? ?K?
+L5`j+
ZzM+g8"
maw!{
:y0%6
m.~~H
[+<H0
4A52[
KB,J2
|g]{5k
}]^D/
=/lW1
zd\9f
H5~2#
GetCommandLineW
1I^Teo5t
7\IE,)
>yZR)
'!;"00
}VzB8
3IPuwy
\|Zb2
h;hn_=
} M"|
{Y"Fh
~11#)
Aw[<{
x3Y/J|
Ed+EL;E
yaj=>
\w4R7n
uWgCl
Oai%G
:9^P#
b,s]!
IZwhX
1!1*1
UNw#0'
21Yp^
YWV9]
[nt0kMf5!
y>q"~
CreatePopupMenu
WriteRegBin: "%s\%s" "%s"="%s"
q~zxVzc
FileDescription
g#vFA~
>\&cHl*
<*J{g7
*`r'1
aT!dY#
@1Y"H
j'_FtYDk
&8T.}0d
,U8[I
?XNHfN
mGe1!
"Xqta
.vD tt
\G#x:
+qx>,.
WWW8(
HKEY_DYN_DATA
uDR2A
lF:lK4sBb
c~t~uI
eC/5
SetWindowLongW
YGo r
4I[o`N
%G(8z
K]r#h
GetFileVersionInfoSizeW
,[fvl
QgP48
R27A7
Je}V;,
:qL[*
G/xac
*?|<>/":
$"7WX
>u+s_][{I
zw{{ca
/kmp]uQ
qT_Ku`
zD~Mz
;ngft>
LynzK
2G`&m
atQm@w:
Yu:#Px
[:"f,IM
T*c]O
vP?`%
GetSysColor
CharPrevW
Qr[Aaq
ocY|J
:}Ab9
T<<Z$<1w
',=i8
m@~0oI
|&33e
'-Hq8
8,888J8e8y8
,r3]m
B72%Q
<B6o]
W$5gT
wP]`d
WriteReg: error creating key "%s\%s"
n&]8\
aYCxU
}'?/T
ynBbv
^VEX_s
KR33v
, '-c&
b0$YU
2M]CH
6#sH)
SoY{6
=to~;
w#=br'
IfFileExists: file "%s" exists, jumping %d
5%v6@cSi
+pAf[
/sP$drE
.Ho|&b
,Dr R
6Goq;1
~bUnoOh
Western Cape1
ZwWjl
+k6n>C/--
%On?'
fSRiX
kg7rr
`U'Cd
3.(Sa
SetFileAttributesW
kD#e&#
I`,hp
L>j k
SetDlgItemTextW
mS{%vn
?Fu'V5
J[8dt
: m=:
maK i
GetModuleHandleW
\$bXj"
>Po-F
^YnS*
'oEN0
y|I{,
d.P),
ztK`8
=HTe;
{552#
)&Qq3
Rf\Hg
Jz^5Z
H`a/81N
kEfzc
VUXev}#
@%RK%
DV8/xsaq
WO qCc
L2RGX5AW
+PV=e
PxGEg
TN<Fj
`S3R%
I/2o{
Z^Ky$
4-1@-
v"I<6
I$9P]
Lyz=2i6
,|"f\|
Y<qfp
:@F4w
*`VH)
1)MU/
q3>rI
Roqxh/3
!eO7.@
q"v>:
:(:.:@:F:L:R:Y:_:g:r:x:
6ZX'n
engi7
m@MbR
IDBD $DQ47
V^.1hF@dX
.KqUj
M4<pH
h>tv/
G<i7/
qIy$Y
l~+PN
ApLALL
-.H\L)
%B}ML
9S%|{
Pop: stack empty
?=@Js
}`CdP
*/x9e
`x$WO
O2;R9$=7
0-OImb
l-}LU.
3+~WGH
!:5<~35\
c\[~A5$~
`"S;L
:3{#u
\6iOIR&
S}QP8
.x)Htrq)%
}9rle
~J.0M
^zmWlc
fBs-cE
}mpj#
VMh+q
l%&4J
c3}7[J
ts$1S
92!1_`a
rD%z5
;QUj6
h&3fb
0"jo3
Z[I:G
7au[?
k0pcA
qv^f;
ht)t:u[
>OmiyqB
9C`Xr
f:S0d$
6PgD`]
3-3:3G3T3a3n3y3
2*}tO
r0+0z
o{X";E*o
^lr"sT
OB+o):
AdqL%
pH~Jj
FyZ<Tl
TCa'F
NT7`H&
@6Fp
=0X,r
\zwC^_
dSk8jR
p(<NI
+K3EI
9RD'Q
d"K0E
j(J&nE
<5}{j
5nmC-/>Ba
*l1R&r
a^/a@W
?VeIl
TlAhZ
lstrcpynW
JT8}o
JZ8;5
#X}^I
|Pxb&>N<
nZPzF
GgsUKA
Pq}4Z
v%c,5
/_v,f0
RichEdit20A
GetDlgItemTextW
:Sevo
I?D7j
^dg@;D
Tq88
[-0TB
a(D(7
`#yxk
P]f&>
%k&[d#O
C8::Y
j=Rh5`
i>,4{b
\XYZ)
2<|9)
=1wf9
&Ma(^
18tf(
Y\M5a,%-
'YDOm}
xfA#p
^U17Z
YV(!nw
5kHqne
T}LB\
PpR6,r
VhIf/
)`a"n
'Ag1%=
&J0J}v
#z[ B
NB3HM}I
Eyvit
1*DC)
fOh4^
<6%*%
w<esV
w9a<U
Ol@ac*;
PwN5"
I7f1(m
!CuV2
niM48KWREBm
s41t8
Op=G&rm
ZFVBTl
#k&\U
7A}bli#o&
HYW7EP
plx:|
MessageBoxIndirectW
jRX?E2
7/%PzU
e+aIw
Z#{pMW
Ge\#G
-2nIgu
#@=E:
$OE8g
we"zs
{,k=\
E{!,Y
5N3Acd
More information at:
wl]l{u
{n]HB
Io@f}
4t5vOS
m0&H\
c<]Ql
3EPEoa
m^OIi
_cKog
1b1|7
R.4#
Y!eNi
8Z/tp
nvfks
Hr}.S"0Y
0B;=.j
DAQf8
tE6L:3
jHeM&8
($tps
>J}>F
_n$DTO
nBZ?Kq
~,iRr82
6>6J6[6z6
&qsi+5
H0=K?
Jp~j\
^7At:
,Z?%x
d\2,^*
D3`<3
ugZD!
mDllY},
UQ$?XW
+,l3Z
pN"Ic
_QzCa
Fh"8C
"W|s
q:IVf
>RJ5E
L'6G%D
E8EfU
Fa]5*?
tQ@;j(
~O_s8o
GetModuleBaseNameW
SetClipboardData
s\LEX
Symantec Corporation1402
.Ai_V
w5M}!
2http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
qfP.|
/(bq9
m?s5q
ar%C.
Gci:fD
wU;-{TWI?
-R2LA-
)de&\7
AB;wH
U#UJu
CreateDirectoryW
^(U|Any
I@'19
&r<dB<
s&Nu[U
.http://crl.thawte.com/ThawteTimestampingCA.crl0
2http://crt.comodoca.com/COMODORSACodeSigningCA.crt0$
}>m(3
#^:hWy
Wa1Wc
[HR=7
ho#/+
]",@v
ul3Y4
6.6T6c6
CzS\OJ
DO\-6
eVQ.x
{99Fr
I~AGE8
130509000000Z
5l0G6
tk[h'
+7y{u
k8!n-*B
"}]<[
E&`^v
Tv\|FEb
>Y\CN
VMG:@
YAHRqE
xIjUn
.JeEyF9
Mc-'dP
h_<ks
8DHL`
CcWEe
+mUJa
\xebz
x>uMM]
;/C.u|4QO'
Ye)od
7*757@7
wS4if
byiqpM6~
-;!w3_
hYzF4
uW5h;D
RB<{-
#&/~?
gJ/[xzr8I
E0dAC~
!*(mm
" G!R3
xCh9ob>
w|pZ:
=%sq+
c}0oq
4.aEo
C$>m3
,* M0.
fm=U
\jGen
FLJsx
g#E.tZ
\jMO@U
PmPo_
}04wj
,'z~8
ORIyA
qK(y8
O&'&C+
>~}7G
d_P<2%k
!~M h
_T~|8
.DEFAULT\Control Panel\International
+V PanU
fBO 3
97(?86I
,Z)Ag
2"6JM
oB@&J
lstrlenW
E5i5uQ
0b/o\
%og$`
g0e0*
#6`p[S
[%o5`90
z<Cp
YS0$x$
Comments
0:]h1
/Q:_\W
4ji6I
;d<)$
Bj 9;
N7\/SG
cIP{H
>EY=m
|x:P:
0'lD}m
8!828j8t8
J%*dW
nCSV]
(>'?y
cyV}r=
,X5~'
>C&h
ba -%
99WP*`
File: skipped: "%s" (overwriteflag=%d)
B5) jV
C6C%d
SN20s
IsPmC}`z
SetErrorMode
]uT!;
U-JUW
y'f8
4#!yx
F#()g]
=BEFx@
_*3|!
_W1i%
Bp('h(q.
_Q~ZR
y3+.{
*R4UPV:?
_A>VS*
FAB<{
2>dcddv
SHGetFolderPathW
w+B1'
MNt%}
LKd G
_t/Zw
544S$
AddTrust AB1&0$
m.p-_
=q^WZ
KiT*t|a^
kb%fP
LPxSG
S\,:
d?uA6F
+S8{q
Tb6gDV
2c\a^
Jtk'$
mBK&{
&=1js
}3bI7}
:OrJ{
{y;OY,
b@d7h
6U2w^
a4%|4
u\+x{9
&I7PhI8w
D4O]t
U`76)_
3AaduE
>tug$
`PKRJ
pSYw`cWd};
o:egO`
:<#YA
"zUxX
,$rrO
WinPenguinsPortable_0.76_English.paf.exe
)5c2e3-
v$bV9<
;g>5h
`#S$m
0.0;0I0]0j0
"K; :-
~5>=u4x
j LG1f{Q
{D6Ium
HXmaX
NQnLF
|EA?J
"_` `
7<PS%
&`!vb
|U{l4
^.=7Xs
'2wXw
3J0vSK|
r$G[k~
'b%Ta
gz*1&
4-iQL
"9Bc&
h*0xSR
b,7Q]
|]^)x@u
kzOZCz&%
-k+J1!
h$HVA/
c1,P:v
S~Rmx
LToq^s
tE/Jle
0_{CN
9N5h=
PpSm_
\EJ>@RP}
-@EuPJ
2?2P2b2q2{2
*ThsPJ
*N~p~
?q%s~AF
z+uQn5
[VkZ/
J@6.Ms(J
A7IFM
fI=OF
FPPJt!~
installer's author to obtain a new copy.
223@3I3
X6w8p
\=o7#
6#v'4;Y/
=Nu|-
~Xs]i
"*[K{
_9R53
ayIM>
u"y>.
{D~[yy
WinPenguinsPortable
PSAPI.DLL
B~cdI
0]d`R
ADVAPI32.dll
1?,]n
)([J/
]4IzM
MessageBox: %d,"%s"
>"?@?Q?
?*)`p
qVS@uR
c8ovT{
xq\%/
rdL%H
?Bz3mQ
:o3[S63v
?0=0;
u1`'2
zf]K$
UCpY2
5+5;5I5W5i5x5
#DMxz
3Q@(`
3M>{1W
?'DH]
gVL|6
m iVP
c%iEN
a&as$\+
&I:y '<%=
O.IHh5=
OQ+8C
D_R)N
\p<(K
.K(2[
`zs}m
Jp^Vf"
@}r2y
(''Z!
eC,'O2s
5Rf<@
UdZHj
8+~%G
+I&v:
*4mFY
+ys%^
`l)\t
\I3/@
*jd/b
)~kIL#
gBmqG
{wZE~
yz'[)
rE:4V
l;:'Q
MZ{K;
[rArpU
Q=Pr
,,RRT
g*AmE\
k'(r@
Os!!#W]
qy~i)
Cqj+0%
@J<+:
@R=PC
j$tW;CO
'B't3
=8YSw
)n3*|`
J5U$R
</)Zkg
j`)Vi
mu}7\
c-7T:
020T0y0
-;8-C
}5QZ
a1@i{U
)Q<AFqO
M8)RD(
N]0[D
_RyrJjJ
*(*+-=
Tqg'JN
~$~j-
F_x/3
&A?`(~
Wb@h/
1]lBK/`
L^QeR
G/ t$
((L0,/d
SHGetPathFromIDListW
w/Xxo
|%WDl
RngCq
A>p@L
5XC?Vx
7:l2X
>iyFy
c!<(b
Jw4D5A`
qJW{!\cbg
C4fNVp
/[#R.L
d>uzv
MU3V
W6&52/
f<_R]
BGO 3
:QpD>
LrX,5
Xkk3D
axxw%
6yHdb*1}
PWZx7
H}EXW
?knNb
;Ilf;
~TGm^
oR19\
(5pJi
V{$1V
Rare Ideas, LLC0
qY"-)
(5V@'
JAshO
<yb'N
d%q;-
>{m[KC$
Xn}[b
u"<|1Wf
Wt_hw
uu(GH
~P<'?
w$q[Q
CreateDirectory: "%s" (%d)
Sg++V
;]XP9
mp%_T.
36}c2
lstrcmpiW
lh4w%
hJuel
ADVAPI32
umTlS
'*9XQI
}cQi[
%UEd&
{4'Zhj
LegalTrademarks
E{liuH
\/K<%)
k>yd!
<qb]P
8e}@
i$}6H
D=,'7:e
&w<ZZ
SHAutoComplete
VQ&4U
!Q=[Xx
uib/:
hqjo%
[0;u;
):>Zh
^xVpL
Vd\0Aa
dq1Fx
uJEDw
M%[FHM
CreateToolhelp32Snapshot
ReadFile
.w%&H[
|3WA<
D0LuE
RegQueryValueExW
l|u(?
uBB|5w
RK=,:)|\
J9:^y"
&K%]'
5abU+
NulluN
"WpI_
HYX@I
DrawTextW
mRvUCt
rdVL^
LJ>g1Wf
&hjrB
V#Ex4Io
C"@!u
oxJQ=
3(di+
g3XRB
J+X/D
MWr2dC
[$.[
GlobalAlloc
C4xx[
U3|)zt
"-i[xZK
;bf\o
a)E3lT
Module32FirstW
8/}?u@v
dvqUQ
D?)pCcL\8*
GetTTFFontName(%s) returned %s
Error writing temporary file. Make sure your temp folder is valid.
z-Z2&
QVpy$wn
1^i:h
s695
sh'uBn|G/K
5vU*f^
1^<$G
>/zBl
VSX\il
Zg1Hs
)2uHu<,+
*x7o~
ZUrs`G
yTRH(
Y5hsw
#hm?w
OA+W+
M%5R@
PX[bQc
}IF<k
180KG
Call: %d
&#aM;
y&BE$
G$<z& @2S
!j,;,
w^ZH=b#^"
f=@nj
k`1;w
wo<S
^|`p.
\HvefN
~SqPr|o'
lstrcpyW
EG2CJ
wQox+,+
Sz;n$
V#::?M
%%<i2t
@nm*h.
7hiuU
AJ=!]t\
| dX6
p!OXO
?2<H#
=I&rS
OdQJ;
U5VC(
8@uDo
E89E0}s
"gx%O>-
>=>o?
C;/E`
RymoFj
#Z*E4
{tVT\
.PK1{
rIIe{]
ZaFC?o
>N>_>i>
<&'Y0
9#}mn
7ep`<R
Vgg9<G
h){l6
zwv;
Pn<=_H
j1bOq
^*%Jm6
(']o3
[(utY
SetWindowTextW
$?2En
='Fcx
YcW`|
$jAE"
o_~,8
5n Zk
r0g1q
E89E0
HO@DFFDD'!"
3g9<<{
C 4cb
2DZs-B
hU)yW
*RFt-
EnableMenuItem
,u4)q0}
t9kaq
Nqvu4
DCB{H
iCBj?
Error registering DLL: %s not found in %s
kB>?P(c
ilnK9
6Vn[E
`#!Vf
<A=td
::LZX
wq%:?
L-Af\
F=:H)
bfrF2
,.`wg
\]1x|{
ole32.dll
!Uhj"
0TVn!
"/>57
zFpx4
qfzx=
}"mzn_{
u4 LL-
<!FgXDH
'/G9h<
"$]F%
Process32FirstW
!$X"2
jWtEI%
.tjuA
b<YkG7s
GlobalUnlock
MI$>1y
nH3Dn
}e{O.@
mxWt$u^
VhVCn
zS@"h9
?5z*e{
nwR39
0Qve/
`+DN:
1neSHhTH
t)r_T
j),Ok
[xX1a
$$wzqKh
767@7I7S7_7j7s7
ipRqP
!%r@C6
|2o|%
I<:6klUgu
483`kby
U8CPXC
203Y3
gduXB
U|g0"
N2WUIBIikK.28
IUMIy
0KGa}
A,xZs
Z\rMM!%
u\Fq1
`Qr![
@54>X
xc!>j^
zgQ^d
E8]RP
"*4[k<X
LJ'VqWe
6u3}$,
P.$b9
3;<0A
H,1kwM
[*~lD
dvop/dL2
nW:|b
O~.GFp
npq~q
-%B|!S
B=#$@9
OQ!^nD
G/Nvf
mzj3>
vQYq$
~2ojRXx
-_(VW
yDc_49
~`A+,ks
kp/sw(c
Sp;Z~
g7!g[
myhN/
GetAsyncKeyState
GE^XE
\!p_^
]%G5:
KERNEL32.dll
%)mk9*
\=z*"
?-?I?\?o?w?
!T;Rn
!hni`a
6#616i6n6
hic}{
9!dEj
R-'`X%
I@G}<
Delete: DeleteFile on Reboot("%s")
g7<u,
DM\Xf
cA}>hRM
8LW`S
+2D"k
j4.z1
(78?Y;
$mT>(0
_jN`8
`Ow_~
h;W1R
mfQro
vj>5e
VP~`y
7Yj^^
%X9;t
;>g0Tztp
LK9*/
g7Fex
-'X<h
$[*OS}
pSl&|$
C=1V;6+
m3{ovvp
4\x$N2
D*v}s
TpGl'L
`gPF_
4sy>{
*M~ii
-17}.
pA`]]
tfDUr
/3paJf
V!UUYlI
Mi}BSa
KX!V?4
bkBHr
Nx1@p
xMBBO
2/Xh kQn
<a"|_
SendMessageW
L$CE0
tEh8N
*M^BC
dIvpQ
d@z~h<ifJe
`WGJM
0f,P}z
zTpKd
#KkQp{
979D9L9w9
YLe)D
X^"k;
:'=/_
l]d9O
#\par
99"h\}
2sek;
Exec: failed createprocess ("%s")
>YUizD
FT'?v
P8uni
qho.aE1
IsWindowEnabled
J=gho
>,>1>6>;>D>I>O>S>Y>_>v>
Qr` +
6`I%C
FO 7
&!5"X
\*M0i
CV9{2
Rjp~Cs
5=4&'q
3O_lm
9!%tC;
~o|T:
2kz?0
HZX'm
IShd]"
v=A Z
$c!A7
W2q_M
l:U-{
qqy)lv
@tHBV
crT4*F
ikM<^
>~:(o
=kU]gX
:iKS}H
8+>|9
6/j6H
svn/G+
FileVersion
]Ecx<
O`H/w:
7yr"/t
QNSfef
X`jZj
z%kVip
2R]llU=
AtMun
c@G0Ln9'
O/#wb
5FgMA
vRt< F
n35[t
C"Xsm
0'.@B\
D$$+D$
@\Vt[
0KsO'-
_7GA9
sn=G-
[#%Ug
-cE$VC8}
Pe4ldy
}hFTuxE}
k0xFH
IK034
PSaB~
CheckDlgButton
BGh>4
=h-]0
1-RZ
Ckr5Gry
AGd@Y
9nM603CIf9
fgOm>id
HhZSn
jRVl%
~6x%Y(?]
?f,wd
#@-jmg
DeleteFileW
ERR,2
Wg|gR{
Jm+^z
EnumProcessModules
a0.I[
=qRWc
}aFt!
}3gSd
w;frhq
InvalidateRect
fl{6NO
VUHG_
J@y?X
k[6ygN)
Aj-,4l
[?gCp
}IY\r
I,ua@_`H_9h
(lT5{
rzemH
Tw* d3
Bq#t:+
"P^f7
F=zas
>lp4`
byS<>
Y$]1Bv
\2ueuz
%}sVm
tyW9u
>nt:x
8{+|;
Zlr'=
;> 3ZQy
/8nrgl5\
U}iqd
xAG?>
_QoMJ5
@wxGC<
}N:yG
JYspE
e/Q?Z
\BGAx
MTTX#
u=I~C
-)0G|Z
:^BWEk
rkV`a
]]`>v
0M(9k
&$mLP
9e @7{>
A|"N/
GetDC
,ZzF^A
Q>_m7
p*tV%
ewc|T
}qgea
:h:uO
#6)^L}
K@fam
3vGfV
9)+dp}
;8*wEZ
FindClose
":UwM
MulDiv
)/H#H
Ug(~.
1 (%L
reU.I$
\\@2Z$
o4M1>
RegCreateKeyExW
rqW,_
H-}P"
7I-dYY
)]hrV
6;`}[
Cd4]>v
-L&9=q
~Z#rM
vSH@al6
0Xc{m
vpw/}
aydA5
e>IHGCLE
d'z5m"7
{n~8E>
bo}JK~
OA]]5w
<0:08
67e^WY
=7+1JD7cRL@
;6;;;Q;Y;^;d;j;p;~;
CharUpperW
S&PNn
WwtC'
\;z[[^
>vK(_
n?sPUf
"`N*#
(F:Y.
9su:8
KC8.l
5r_h%
l7/j{
CoTaskMemFree
ip\i?
"]a1a
a'\B@V
5}Y*S
cm%g*
X wo=
F]VL+^b?[
$!nRu
2sA\tC
2n\3Fw
GetShortPathNameW
^DC_l
Z\xER
_j"|9Ce
3T$_)P+,
";{fZp
hsD2(
pm*sSy
}]&aK
R`w1
7hHhL
8xz\4
rY"[z
ruo:
#EF0:
^)4yhG
APqFl
_X#jy
R!9V2p
GUHEz=
oY(;-c
4"4/4C4_4i4
^:ovP
3YikcQ
jL5!a
26a}]d
4?v\&
a1m&C
9$|bUJ
!iL-$
XxvMvi
"Fph=y
kJR@z
pff O
CreateFontIndirectW
s<t2pLh
qdq.eYC4
hb87J
Mo'DT
f@Mz9
$9j?!
R]5?P^i
spk~K`
LoadImageW
b?FsR
afuQ\
KQEKkz
c-;HQ
|2e!U
vv1?v
8Rich
i6!*9
Xd)MId
X#D Q
a #nT
HKEY_CURRENT_USER
IfFileExists: file "%s" does not exist, jumping %d
121018000000Z
G6o!P
K!DUg
D$,PU
%a.!L
dKSYt
q2&j4#
?z|T]s6
N!9E#
dndUkW
6=Im>
<pNGpj{
voZh.>!]
?BJU1rg
wDVZaT
dJ0Yw
Em'X_
ScreenToClient
X'{_<p
AJ6yaK
Z))a*
>n+}v74
c& ,C=
ZK}!4
]J@J&
=mV+=
1K*V-
CWVWin|
FCK{YY~
_1Z]j
!k2;=
BrY<U
HV|H1
UNY;b<
`*cmc
I0[l%H
ProductVersion
p =F(
.3dI5
Xr?2B
ZMi]Bb
2DJe=a
CR4MOK
@S<jr
UG_qk
)Zr%1
LepF57
vh"!0O
+-]q8<t
)yy3 {#
ItH4AWG
[H@bDl
RichEdit
+2j^|
+=-]]
%t3480
PO?]y
IKA1a
]9")M
A#x4E
^v/1%
,gr7$
Ba0o7g
<)FPjWqZ
GkcPUU
6Ko(wT{
t0j;K
!5~A:
J]dg
Ctp)a
dT44>
h%"3sy6
!l|]R~!
dVpqz
K=EU{
E<?@i
w[XYQ
ur!%Q
}{N^T
9=UZB
yiZ?_
F#H$#
})FoR
Eq<X!
L#1Mm
tnyU6E
7z}fPlG
7Hram
sC*yfK
qYDd_G%
%g[)|ie
xy>'.
@g 58
0.7cB`+1
Z}:=E
{?Z"[T
4_Xp/-C
4(a\lt
V/-be
ngB]sXP
VQ$Bh7
1%H8L
|Zj N
EZ36nt
$7I%I
rUSNm
1.0.76.0
D\eP]Dz2
>>Bxk
OMnAf
%c5$X
VXa9 Y
3.0.16
h9t;2
+2Y?j
>z8F
Hwn?(
xtA2=i
f/vR{
P'tHY
n4O z
Vz|v3:
cdyl]x
.A])!
kT@=L
baiy5
bOl"<
|?qwN
E0h"?
|%Eqo
$Hs|)Y
~n.5}
COMODO RSA Code Signing CA0
settings logging to %d
Qg,t8
[r0s8
Q?2'Va
1G?C:
s4R-T
~`-;Ykb
n0>&/u=
\?L[wxB
27{&BrQ
]bLS_L
TY+Wy^<
{iQ~[)
dG/47
*'VeH|
H?c{=
Unknown
/" ov
+JED'u
ks2x<
z Ei3+
*Ujrj
^a10-
qmA_t"
O@ntBz.
#oCEt
RJQ__
r685`T
QvR&f`
m0r/4w
gEd~u
u#yV$
zz`c]
A``|;
J6k=R[
\ZJR`
"FXyG
-NzVKv
-M8)kW&
7'2W]
8NVvc
Z`5KH
liax0
`.rdata
6Sc;;
M{3(]5
rg=`>
hqVr/
s&[q"
RegCloseKey
X;NbL
h"$w;
FIX[!:;
<xY6]
ZNH*fO
Lu)j=7
8.CJ0w
i11kOK
KD|~.
Rare Ideas, LLC1
xUwoz
/.Ka6
,A*9|
*_H'(
B\?]|
5VqXZ
*.Z'k'
@J@R7
QmK?i
m[aYW;dr9
j9O*83
qn^/r
7&_D}
II~5Z
Ufw4B
=ywE:Z3
NnZ!{
YnXji~
7LX7O
d >hJ\"
X;q:}
_vu\4
f`}+EZ
WritePrivateProfileStringW
X4i<<
aAn]+
i:aK'
IUQSP
;t(Y&
Version
;UFoQ
,]Z?
/(3JkR
AwQo:
2kn[&
kN32C
_Z,/Ivt
_u/G7
vWQho
;XB<3u
eyxCHz
`C1AXZ;
4~*-h
D]HN*
New York1
"6/9GD
nqJ?1
Gi.F]
0tkYU?
40iQi1
Hw{]V
h]kL6%
/kZTW
6-PhZ
X44(;F
aq4j"K`
K"cVb
<56H<T)
-w2&M
2d63;
|\;1iE
AY@U)J
ZK3#B
XKPm*H
pXLaA
"Z9LA
"|\J&"
5T4@1
https://secure.comodo.net/CPS0C
d|~O%
;_.&&E
I}| q
uR,|:
FBqkS
SysListView32
U,PIJ
OOcpF^a1&'v$
L=;l]t
.y[cT
(dRHo
F!;>Q
W_^Ks5s
)G;?R
TYqUe|OE=
Ctvc>ZJ7
Ry7^0
gx]xL
jCKd]s
5 |~M
Zd&mx
^OK~M
{?t=/
3xzc5
]2](L
}~{Nu
c(+-qm
,ch~SLQ
drwa
ZrT]r
/8%5p&
P#$>,f
pD8)!
'Rvf35
276@j
)xB4<
<E[y7
cmw%O
1JHv?
4#464G4g4~4
7hucOr
ToUPu^,
unpacking data: %d%%
7P<a_
-043=
f}zom
q]t 8q8b
6.646B6H6Q6d6
u.MEZZq
HN%4<]
P%hXO
W~(!=
MoveFileExW
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"
8V&#|w
AHrqA
-q%0Y
Vz4?b)
M#>w![T*Y
wT)(%
ylQI-<
<m?"+
m(m`~
.9G:J{
,c^<]
#p 5g
.DXSy
t$(WW
>I?) }VKJ
HZL0k
eclK!
+PG[-
L^WVkTE5
Ea.{f
wjH_n
Qg{]M
9oCv.#Y
^AObI
[\RZ^
f#_a;
fz4&h(X
:@"{~Y
sYZ6;
7ZTGw
InuN&
g_YP!
+aSW;
S|#&Q
t$,VW
.kb^&
M6CB
wPsj3
]XlWV
G@n'/
J~xa"
RMMRIB6
dn.@K
<x;2"
[??t[
7pm2RL
%02x%c
o[<r7
=:SL=
RMDir: RemoveDirectory failed("%s")
yFKw)
?#?F?Y?n?z?
q[wXP)U
5HM)e
(-&,b
[x7R~H
|a{iTOxJ
[;-Ked
c0[c`
`5up;
|:9pb
USg6h
Uw(U`
n|EGC
X--fi8`
q#6sw3
(JVT}
,g*z:
PWSVh@
=y"T6.
I*@GR
g[\B`
1.E&4
U.1F/8CN_
9zNY}g
-hRftH
'v8@%q
'hO7'
P~b+WP{3
riFiaC
eq"Ul
|<r3/
@*%F5
"_UnM
"jm(.G
m_+alb
n]cz'
Section: "%s"
(ib6D
Q G9D
]#+bVK
<~4fG
*Xrf*
o=V9|o!-
lOwaoU
Ed`!z
|m3)a
rVyQ7
WcQe4
\S{7Z{
Aborting: "%s"
Fzpj4
!$L=G
2&YVN
gx7+JG0
/ [zO
s;0Gg
a$NgX
JYm9=M+
Greater Manchester1
1oFou
Y@QVV
1EZtLFF!
6uIpe
&*Rw,a
<W za
dd@a(4P,
[`':b
z3i{tGq
C^DFoH
d3SV>
;G~Tdc
w#gf}
;C0cE
=4G/-
V$jt3n
dfH+>I
E^?(G
1d'd\
mp;-h1
R -2<
b>y35Ur
,4/<o
o7$4t
,LC$g
FpRga
}{g06
F)z`X
I]3kCx
Y}x,C
[u(FUoZF}
^[h%5
Mea'3f
Lf+Iwr
tcsgx?
?'8Nj
_fJ:#
)]`k26u
a$2f3Su
wQ)7y9
^0+0'I<
v}2=t?
$t)<-
3#~>*
ryP;>
|tk9mgF/
e&S.W
@{Ke2
Ef'b`"
vv=H#z{N
9ttO4
u/3{&
M7GWH
{]&`c}
KW[ 6n
bx5Ib
?ilp/
+$YOl
f)b/C
;qI=/
O"d #!$
#75CO
"05[YM#&
Y4[h']/u
C:5iz
5ka1H#
io|}3
8'> +
OriginalFilename
5On6C
uo1YoK
sQ'aw
{%cO;
000530104838Z
|TLwx|
Eu,eVhl
Z"[4L7
!k-;/
sI_kH
#qRUHAh5q
]^=#f
G5h`v
x&2->
tfmfb]q
*H,U}
4(515
b~q5vQ
nvs!-
jqiha
&vCdh
l*uUg
WE8.v
CRBc?
HcNl!
Ce G3^
wt/KyT
N ]L{
$'chD
NSW|p
Tbx33
#ZP:^
gHczf
R _w`UE-G
Rm0w93
e^jl8T
Oe\~^JO
l3W:I
@.reloc
gGrx#
"iqE/
2&0hG
i+2HP
>/~Yi^
7MqJ@
Vh@&e
YD\{f
"T(Vj
C}6R0
w^}CB>
00PaH3M
WKbjE
<:;t54]
3hZ[8*
WCkl+Z
c%ZYmP
tcIL
H7m5o
P68,=
>+$;N
TU]USQY
lL5>3U
#-fC`
CharNextW
G%GDA
TA=h2]
z-Uq{
lPb/$|S
}b1lb
rsg`,
ckc`Q
ij:E
)xyV(
&u4pT
^kBJw
>HBD&
Nj%|X
P{nlmP
DeleteRegValue: "%s\%s" "%s"
}@XhW;
7a}n@k
FjXZy
CreateDirectory: can't create "%s" (err=%d)
SetWindowPos
$R '(X~
s/zYVw
~d`<L
ha='O
+f#=k
=0;09
>"hcS
Ct \EU
}aUtB
jmjR3
KR,dwn
~yJ_W
qs"S1
Q$T`$O[5
=v_%B
96vwd
J1Z4l
qc8@&~
5&5,5b5k5p5v5
Thawte Timestamping CA0
R/~0I
hY2fm0
VMp97'>
VERSION.dll
ZYY:Z>
B7{CY
lstrcmpA
! #F@
FE39Y
>MM~v
K1KBE
S3\_mq
9*Zbe
nFSPVL
(*^cCCk
clbMF
"k{%!
>FZ#R<?
Ij36w
?H:f[26
C+dA*u
VUyq>
/(h,.
d=^gZH
BncP|
&0i<e
K3/G|
943QI
&?XIxl[
&!ta/
*DK:a
C! cd
eEi&o.
Thawte1
k|2;u
77j!h
;+K5NS
4,mn8p29
$ 6@`
Jsz%(
+vg}+
/=]Q*
Kg'yc
Zjr"(t
W^fsV
<P3"J6
u!n_x
XWv(z
=*=9=C=M=
?tXL+
)ea\5
U7n72
3http://crl.usertrust.com/AddTrustExternalCARoot.crl05
jDfb_
Q1PY(p
:-;[;c;l;
b3zbH
sh-v/V
j1 v'
b00(@>
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46.5-Unicode</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>
abbab]\
f$e9:?
\/V;q
Lr1G0
kMKxL
d4`*96
=>Y;$
^STJz
sT8WF
GetWindowRect
AQ!]U
3+-}%m
b*7BZ4
V$./=
1HBPK
VXKMBQ4
80604
W}*ji
oQIi-3
?^w!8R!
(I(TQ
;.d68
,/KPip
ak%K&sqt
%8XZA
^~O2X
#[l`*
M{2;<}{
4^I2I
qI@V%!
e0c0;
*FS-x
j [f;
CM;TK
j18&7
/na~_
repNR
5[>_>c>g>k>o>s>w>{>
dea3H
+~tC-
Yf|%h
8Ix=C
R\oJb;
oMdlxs
8>t`NP
[j0Xjxf
5[1'2
PRZHD
DY P$
Q-F07.
'BK@kcw
`i\Y`
4W)a"L1
m'QQhF
C[Ny0C
160224235959Z0
{I%XD
_bnYp
Em:uN
vI|_d
|he:K7
6d_X1
cvqzW
lE!c0
\ec/3
$Tz9V
lAq[I\
kh7S*
|rPvE;
iBz!d
0{"AEg U
=q<<)V:i
8$_^\
C</7<g
{q$%a
]/3x&
$M?}s
u5G%*
e5@B},
#AJX"iBs=
K37LG
OQ9/(
:>9'"
W[9A;+
w'VbR
K4CC`
GpTX,r
Aj+(!
9Y9l=
2/ :7
?n`L-9w
$mgsN
5frZ{
*Ag\=
dj359AGVWd
}3J[;
p15`;
NOvOM
]~#^~K
]^o[^
xWI<E
o\Xp6"
Vm;dlJ
^|D.Ne7
#G_FJ)
QD|%d
3QCi4
"L^+I
?n^,W
m@kt7
@m8Q,
W6t$N
+8&FL
IycjQ
oRMIaD`
hAgUw
0|C ,px
7E8%'4
M=|>+LQv
PPPPPP
k%^~+u
XZ_Q
5"5:5]5m5s5
rANld
w0-a=
C?KgW
(Uo+r
E0V_s
8gd%$
2{<d,I
[,S,;
6nh[15
@]_a4a
!*|.g
c_h&)]
[gtvZ
$t)[ J
B}+OX
p.~m?
92Rlh
&^F(U
^]YU*-
N_6(/
`!JBwe
SystemParametersInfoW
&Z3tya
WQ0X}"q
!7Vy9
(Idbl
)jN]_
8Np1@*
{O^gax`R
;]_`gZk
jbW'Uz
uDWWh
`z_(l^i3
k:H=l%
i223-
=LnOd
gXb&vi
Rename failed: %s
%s: failed opening file "%s"
6m../
{9^4m
HDGPC<&
BbA@b
Gm#";
Xqe;\x
t^!$c
lPT|f
P5/To?A
[RGG7
Bq8,5
TimeStamp-2048-10
L3BJ!M
Qg0d\
c{hdt
;>1BV
/us1j
,=[ZR
DGsiH
m]4gTq
s0 ST
=.+,e
Bd3`I
MhH^L
Nge.!nS+
=%=/=5=:=@=N=T=x=
D$,9-
odz4M<
@ ah"5
SearchPathW
l4[AB
$)U*4
]')aa
SetFileAttributes: "%s":%08X
FSl5g
eV4ge)6
6J4HQj
{Gu_;
e;.CK
GetTickCount
<',3X
)te4g
fJai,
g=pjR
@J#sz
rmb7hb
4>b\7
E,S'Ot
> NX8
O+A+_
'YFYO
D?8s{
J2Y q
mKl%* !
.e,Sb
HTM1Bu
J*Ap]
#N6G[F
:x-n\PH
yoo\sT
MultiByteToWideChar
Mm<y%G
2DQA4
0SM3_
wMb(i
k@Ex_^
{nJD[
)m#*X
7E-@X
4ocOY)
%6oB{
r)H};
]+Th3
]r(Wcf%
FR",u
UW OVb
VL~&$
^E[c1c
W5V; [
"c79|
U+J+]
Cl C0
zS~>#
tm>mg]g
lbK2i
2jZKw
hb[% jr
;6m@F_
mXC!>
'&I}9E
$@ne@#V
[Wp^U{
an?sc
p=b9O
5l1ED
|@[B\
?5Mwz,
rk"l0
F/kh.
Z[rPS
p{GfT~
`^^^sS
CreateProcessW
]V3=<
Ucd<&81
BSP6l
LeAMw
Z:5EQMq
fjF]DX
o?h+a
17#OQoc
... %d%%
..Ia@/
<tF^89!
1iz[F@C
x*9eA
rQBPN
PP\s<
0{C[5
B\nj5
grNUkTQ
D]vth
]_:NP
4.`zP
9H4K19
?.UKR5
rmu+o
[j!|Jl
8p%np+
JLP\S
)L3B~@j
0EJs[
^S\^|
UUUUW
TrackPopupMenu
<8SM?
F"C?N
fL@=v
aj1crn4
#W?P5(6
dS>2r
=B,Ch
7H[J`
LGQ/5
lstrlenA
b)+ m
9,78<
X !`H
S9}Qc
w"Kpv
G^)]0
Egdl4
u"SIb
fKr-}L
w{\7sRL
82s&&
0NDqx
rM@=R
A/dhL
veEl*
iK\+n6
OnemC.
.2@T'
]/1[97=
p]Dm6M
EnumProcesses
M"?(]
hgN.W
Sleep
%5g18
HKEY_CLASSES_ROOT
_9XJ7W2G
]y#Df
1#xz<
Q$~f{
rZ,'S
pV(ib+|uM?x
/-L0R
DJnx-
GlobalFree
(\mH"
xm.Sb
#"Y?
+yZf)n
GetDiskFreeSpaceExW
l,;C>f
4Ecs
I=wO:
.0!yB
RegOpenKeyExW
5hC34kM
VR8\b
BWnRX
UWqV=
I{Ou8C
V62Go
zFI/!O
/dk^"
2yjZ5
i}w7x
MY/2k
Lb%AV
Q>ba#z
NPy)<
m4ZG$
8Uq%AiO
.96;a
)7?hX7
6+WOe^
?b8x1
iJWnTM
]tv:A
?Luzc
|fwc*l
f+|JK
(cq2a
P]_X.
5GN]6G
(] WY
-y.36
.Jv~$
M~riC
nwei`
\-5_T
HJ*;M
os2<jID
j[KS)
ejE",+
+'QInr
p4r"1
?*M>}U$
4()E10N
Q68w%IV
;1z8L|
'N^B:
=`_y-
M,o%98jD
rTcOQM
2"!;RHO6
&,+T0
OM$CN
f8C9&
o\F4h
HQ;\eb=
G&@K:
*j'(ag~[Z
ZR&8fW
0A^9+
AppendMenuW
X.:?u
Uw/b_
150224000000Z
8NEZJ
}oN|:
OpenProcess
{>hG*
(q?vJT
%C&zQ
kD+lO
X_}G:A}
2U*W0
CornD
.>'L@H
]buxyubO
Alv+B
*QKV0
U1'e0
VS[<k
\ep":
8c5PZv%
:RGIM
Y)6vx
?t!+^
NH=!$&`DQS
~a6@W
KF)|r
q.bU}
BvE x@
b;_@A
zZ}wP
o^Il^e
a=2U*
KMj~u
^c}Y6
mpFJ9
GetClientRect
;A~sn
.Ik]A
7~2?&(
5n?\'
I*v6-
DS:%Q
H%QxA
h0f0>
:}Kb@
iMZ-C
){He^
< (P2N~V
S&M7wd
IE6c2
sEo,R
6{XeP
F6 MF
{\4{=
Dz7Epq
0"14`A
lYhr8
(`(ga
rL;f0
ImageList_Destroy
9!5ob
-DG@T,_
Z"\?Lt
:-:8:>:C:H:S:Y:f:m:s:
a[g~o
9|581
-6-Ed
vzbnk
N`e{U
R>BBm@
zp^v
d*mav
67s7E
83('[TH
99x&~
u\`~(C3
ExitWindowsEx
|Pk{w
.7l;J]~V
Isssj
n?=>F[
kF1IZ
\,7by.
mk{L(L$
:hJ^8
cKIp^|RMx
LC?yy
~b'NV
v&t?~
V&'i{w
}CfLHf
\vnO^
:[GRPOi
_*0S
!t"Op
Y9>,L
k7GZ
tCG<#
):Wl0
W4@2H
CbD:x
gZma^
"]nyZ
:am85a
;&K#1|
BHFDl
H)79\
;FTFH
V)W}s`U
b]('dn6
Lpfi:/
w8C|o
mXYVq
vypM)"$
ZYquZ
)SXbi`
3O;Jj
kJ`Er
+XDAH
*9,(P9
GetFileSize
K=)syR
f8[yj{<W
>+,?LL6'
ixY8I
y&{*_
_I2%g#
M I?i |
mVmJ~
EeujNi"
+w@Q$
8xv%f'!
fCnIUpoL
y:"@)
xNs3a
w"xL6
E`,RAn
\xEN{
r(t'PN
S/PVS*%
a:4tcxY
vT*`c
h}uaL5+
8RL,T
vV".A
~HoEK
@x^XY
0h)md
9~d>1w
ay'%r
iq8f5o
/2_7a
i?||b
^q1d|^{=
S@P^G
nU*K5&~
^BW0\
6SapK
<p?{q
AQ?Q9<p
GetVersion
?dDdP
0!#\3
tj;t$
)yzx=
g76j4>3I
WAJ5]
y?@P|
CreateDirectory: "%s" created
z}PDiz
8:8C8U8\8h8
;tCKx
;hP<qs
`l5j=
}{O:@Yx
ma\I1
LoadCursorW
q?[YU
oabcX
{F+W}w{P
,IhnT:K
X(v(F
@(`];
Ve1'F
e{`g8.!
2/DOv
a({73
Sp*7,
\7#9j
M3]n<
2XQ~d
7] ~l
]H|s~f
*|rFDW
r(Wo)^knd
kD`.FO
7Hrhls
StringFileInfo
YI6D.^
b1a>k
7]zn.
a'o8xEF
vwTEC
Y5.&h
7n~9/
BJ?5DS$U
m&.%!L
SHBrowseForFolderW
*I}W\
?df{V
!uzm<
< ?J[
:h0Jj
yAt.saX
9>uY8
Qb:qy
BrIeB
xd=I!
l5l>l
=r9!_
nK=T}u
BNBG
0S:8C
EJA(.
vSs~n
|z}t5
o#D`ziM
G:P;W
SZT9/
"KTCE7
O'o9i%
y?VQc
sL6(:
8]B"H
P=4"t
|fbj~
yV{Dd
K3'[+
}RU>eu
h51GC
&5f[7
jG924
2:3oE
@E#sJ
^~a$F6
\qW?^
w IInA
R~lxv(
]r*oT
IdIry
mrv+s
K69G{c8
R1=5l
.VAx_
Lh0ys
BHP\h
V?*4o
U$Y*Tq
qtX['
0^_^h
vSB{N
vT65G+
QSUVWh
mP" |
Kdz]w
@\Oz]_
IrLcSk
?eFu8+
pT8Go
20n2EB|6"
CZyM^i
]jdB>
I(qZt
ckcJT_|
\b_G JF]E
#$}:)~
P: e_
VVyK-
SetClassLongW
q&,9Lj
-KPK
]4;Mhr
7]3~%
-qK#Q
-})\g
lstrcmpW
TQy(]4L
|s#$]
{hrz!
IT!OR
OleInitialize
RichEd32
Z+rxB
+#Nt
YefI(
azB!vi
ro0|W
^zX'k
K^zs/
3.G@d
SVH{B
9!9N9u9
bOj@w
ps@m}
s(ws8m\
LGGNMKg
G2e_~Z
GetVersionExW
9::T:e:
^w/fO
?MtTyqI
w;zsk<
URPpn5
r?zWR
G;i'\
kVk`<
GetSystemDirectoryW
G5ZXb
)MxFL
:B7+{
,8.J`
b(DSKa
eUNZp
)uX6Tu
CXiKb V
)b5Lu
ezWT.
PostQuitMessage
n)EW|
;http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
NQ3-.P
OGTEF"a'
j(4SC
y?RGP
)cijx
YQ(''
fEfL8
Uy ]9
LyG-b
HideWindow
}%H0w
3Us.F^
3;}<uC
OA*6S
}{I1g
PG'6<
)2l #
Cd!\^
p(AiBQ
# %PP
9AvV[
^U;M^gR
/DP|wu
Wm!<S
~ON;s
4aM;+
%r3Dc
X`+[/
FtB)A
}c_3rYJ|}R
GetProcAddress
'[&M*Cc
0&DiYlB
ProductName
;4F?>@6.,
cTr>O
<byI:nA
/sNx,u
b6|_[
3mCn*
hD}7I-%
`Ti%w
S+[dU
9"jLg
=)cvv
HhG`p
i'KgLL
"T>k.c
lJ']m
k:}v4k
yI.Zvz
$,j\mS
{SfqJ(
lb.G:
]EHE]aQ}
KY7A:Q
-{l1w
lstrcpynA
a7pL`Q},
EzlF]
vRsO/
XDq>A
w"d`*\
)Tly!
?VKPgea
=MMA;
YefS>
2 2$2(2,2024282<2@2D2H2N2S2c2
%#BK];
^Iz5_
a8Vww
7H<hz
OxfBW
<ZA_Wc^
w1)v0
eCS+zkg
_T4BY
nS@|r
aZs=>
V[K~.
``yc ?g{
SetFilePointer
hGcV9}
icgr;R
2SX.A"{
6.C4C3
](smhs
RegisterClassW
MqWWm'
2GL-6X
JiZF=
RgDNC
(o+=qJ1
SdOg$
fi\Bx"
(/iTG3CJWf,+*
{=L!x=
<37F@
\u!f9O
#@jkH,
,dB5.
elu}.
Y\Ftc
b)h!j
~3?DE
FD,ln
k{[V>
I5Ru?
eJWVR
.a&:5
~MF~pa+g
ZaQ8\
BE;~HR
/9R#w
Ra@{EdC1$
7dw<x
bCTW1C\
rZS2]
lstrcatW
1gJo$L
jNN(t
zr=#Iy
/]%m7
!zYbK
`/DbD
E/k;a
lo`@c
8LP9hz
eE4?y
-zLs'
h&/\~
xq:q+
|R.rrf
wc]2n
z8KzW
]|Q]c
23Qe:?|
0r0^1
%d:y4
sVk7H
5&b'D
v(NEfl
8//qx
dIG^k4
25udQ
^"),p
JI4(z
DgE:N
e^HvU
K*}U)
\ N9/
Software\Microsoft\Windows\CurrentVersion
imaF~
jw4q>
w<V{A
Efpcu
P9h1v
u@`c:|D-I+aAE
xlFUB
SetTextColor
1PR~"
nKu(p
c9/JVqy/Br
w>)KS
I&fTE|
S!GsEv
04o>;
!66}Z
_bOCRW
0-1R1r1~1
rwwf8
rxB|44
j<p]'
JIT[`
[:<Asu
7P)7Y
KB6p
aWI?J][
9GWgoR.
0~1~!
GetTempPathW
9Ljfo
+qvX,
&(=PZ^
a>Vqo
,:g%_
$%a>;q
4{luL
3eH*]2
S6^fVg
}:;pM
P|1\)
wgy)(
O.<AN
|dp;yM
ecdXWO
ylj]-
<+$zq
,%'|u
cy?]<
A:[bf<"R
{Mz$g
pn}{8V*
K?w!U
GlQGR
TrEc3I+?
4K^uLv!
vO/M\
j\G,V
6wEl%
Z;z8}h
j1fJ<t
GQa8K>
<](op7
Kdpy
&U42_
1SQT<
djdih
MgpU$
}=KC^#
MS Shell Dlg
S50?c
tBmmFj
bF"0{
)dx}\
w|V'z'
>a(bA
o3S^>#
.#x5w
P"&P7o
Z&N@>2
FIZ%4=
UT@6>
_ErH5
_"GX2
*Y9FT
avnJ0!W\
-BT)f
<~(j<
7b~Vj}
b LG/
<'<3<=<G<L<W<[<a<f<l<
ZI#0-
9-SVj
!|2D#
+ntV|>
X-lAD
&YH51Px
/sgD7
.~D]\K
<83G-
81VL\
3"3(30383I3P3e3n3t3|3
0P[Vm
"8#n]R
)<@qqL
P+"ODL
M@9]LpdK)T
x:*jY
iU/+cP
8!808D8X8
ZR\vB
m(GCf6n
z4uy@
BOL8)
Z!5A'#
Durbanville1
Exec: success ("%s")
A8zx?
#Ocf}
P'p#b
L2HFi
rOh)^
:jdkR
@$%Tf;f
+Ln=4=a
/p=CeS
,.YL\
}Il|.
lstrcmpiA
\Ok"^
@%N5F
wK4Hf
}xWWb
5>Ql`
G2-VsF
m1PgvBe
Ym7Uo
d4XDW
pFOOHSNNSMFB&%
SHGetFileInfoW
Fk1Kj
#fQ/9R
vL<.E
3PWFT
T"1MpWi
4a5r5z5
WE.Vj
qn7%g&
"~ J7
u$9Mls
ljjBZF
'f^MF
9d>C,
?3Rk=
MSs34lw
>:#"
111;1D1Z1a1y1
http://ocsp.comodoca.com0
0r?W_
pAqj2\
pa~CI
inksf
'"lTt
rlGp\e
Z:[H&
!`TD&Z
2|g|m
%BKv_
2'2B2d2v2
x\%Je
1Xd^7n
GetTempFileNameW
5"D<-Ia
H^LFi
)?2Z1
mhF?N
K6#hqHx
#Vhh2@
6lJ)<6G#
"l]mV
; l`s
_>ccBK;
yBO"S
I+0lAE+
(V 9]
RZdBD PS
O)VZe
~JH9!)
)"oMlJ
GauMB
d2f*)y]
{<bZK
\>?tv
Wm(B\
d#(w[X
* @vP
6)#[&H
File: error creating "%s"
,j#e&d?
"St>o
;E"`W;
`:s>GE
<w|Y6
8,GW[-B
Py8%P
ze^$(
IX,z:
F N?1
DeleteRegKey: "%s\%s"
Iq^{~
2gKoa
\mB[S
91i}k_6
j>p:"d
Zp^/L
T\A^+
yVhxC
9*prS
c34z(
CharNextA
Rb5M)/j|
121221000000Z
"1?2,1$
eoPhY
^H\/i,
!Mw)r
d0C#P=
MMT)T
SC@G]
U|=RUMt
X1hxNG
r28#zt
eFO:Q
vGc~K
<AHiG
<5E<l
B("2<=<
"7wmA
c)444
7.7q7v7
yvlxC*
*Ke9)\
;-*<f"
p<IWv
6ug&P
GS`]d<
AS,0U
Qtm]I
^]*/i
*4'f`N
:Y6y4
gt#eD
2n>e
#c/:3
)l{&%9
c6$^W
5>A2
jh@mec
N55cC
OTPS\
dU|*V
.?.;$'"
l/2>=
y+JGC
r'bo)
.\:.9G
I0[0`0
& A(A!
sI>4/
YR%s]
gc"btR
he02
t,iz{
N+k6"
'*b.N
'3^~q
*[IFl
RYuOe
99:f:{:
7:\P4
&=2df/W
^\|6
$O5F~
_HCQM*
Pv"/P
^a:tfx
#QH3k
]a]a]]
]wZ c
WLdH>6
iS(W/
k}_;v
/[[2VO
\CmF#S
GetSystemMenu
Y1c|Z
n@|sPP
jKt:P
\\xU&?W
N#3;<
iI:?t
IVV}%
q[0XKGr
X\{=jY
HMh'<e
SelectObject
X|7,fB$z
_h!v;
8NuD$
L;WSK4
."^Ru
fzu>q
\"d_]qi
7'M=F
;jKoo0
X=HK!
^[fq-s
SUVWj 3
yn\C~j
f}>AC
]+|1!
V E,
4:4P;
pvX7:tz
CreateWindowExW
n3oi9
R5J1N
#I>vtw
X*)K@
)^?[i
im;:"
uO_13#
>mA5-
SetCursor
RegSetValueExW
ZL$&a
R~()`"
>eYC$C
jD"Eq
7L#i:F
~',ik
+l(i;<
:2fhY+Zo
MDgsgG
c7frYi
ZN%H~Z
q*Q^6
4}O*5
%epLd
".Rg5k
[}~eq
7|NR+
8o!;=
DIsC
iVp4v
Da5V} #
DZS~173
B-o@mm=
06`s2
k #Q<
|qN6b3
Wo:N/k
H`dxB
h?Fd^
FmAX'
:29H2
LoadLibraryExW
*mI`nF
u(vGo
BFdn(
$03C5
100091
{CCGL
1K?/3
%N)`k
jPOPLXmjVKKWMEA'n
I?70W
%2Do9
t{Q;h
Sir$x
%](BU
R/M`N
\VcNH
PS)bpl
\n+y/
YFB<Y
{X7.C/
2`nP
7Y$+l^
8|LLa
J|v>UK
_ExC3
nmE$#
&C+Va:k .Jm
:2NL1
|Fp^-I
&k/6i
'C}q|
:JuN:p
OB E`k
[I(Jw
]ziyW
TY|9d
`=--:
.3M#X[
>\lm4k
G*|sJ
>ziQ#
+ABhy
FillRect
l%\J\
Mh#jWMnD
ATT|P
W/,f)
Se'RF ~
.O!Cq
\3(g(-6
{$=Y&
ZWD5#-{K
P*doO
@rCMe
1[bvA
g1A'*6
J!|ifB
l0`0-
`O45}
l"x(il
.d5%GEb
WqAM`:
eb{$o/
,peME
XkVIGR
Cs]LU
%=i1X
"Zs=Z
<61W:=l
D\ccn
32djHay
6r+!b
vKE#@<
nO}jf
#|UzX
gRPbY3
HKEY_PERFORMANCE_DATA
pD?>A="
)!qCd
1\:jG
cSp)0d
b<Nyn)ZFtZ
5Rh1=|2
=]EBj
t/4Lv
DX1(Z
Xr;Wpz
&1,cQ
c d,'
@'=UZ
"0]]_Hk^
CoCreateInstance
Rename: %s
U*bx:
=*p[m
24+wr
d[AWX
k4s}J6
6/iWaO
G8xVH?J
JY9y3Pr
\bvv]zz`
GetFileAttributesW
4AMpt
PortableApps.com
4%444@4I4X4
#iD9<"s
eMGZ^E
?j@b{bV
$S#m4T
tBxeZ
AV7Z9
X:y!MD
rH`4^B
DispatchMessageW
%o&nK
~V>}`
UkP:.
5WKP<
S`A:xh
5v\TJ
d`(B:
TimeStamp-2048-20
cYg-W
;SJW.
!JP"r
>1iT=TkD~
NU':o
9bI<\
.7MW]/
qqwN:]
":J<xFX*
RR0:,N
BeginPaint
J*\ZKu
R=H\K
H<x-k~
8S](@x
{{.X*
[-|>g
uv,I;
xVQy)
K5Aw
eHI@
n]Ulz
tBx7z-
t].)\
`^e5Xm
D=nc1v
|V/M']Sk
z@H^V
6pABc
_5ODS
q-e/dt
3c\Npx*>-i
w/4oDA
fdv1
11vNz$E
9]l?M
[O$0&
,(a6G
8;@ds
M;Z6(`Z
FDN3~
x{Mb8
uEu@W01
OnC}?
t,R}1A
d8@L<
olw'z
2HtEou
q'i\H[T
:)<2{
T#w1jk
#lSaL
@0p>v
8T;/W
ims(7J
zNmP`^}
*koPS;
=VrP{Y
m&b*f
N%Du+
+w}}]
&l9:SX
/n ^a_;o
x[Lm7u
Ii8;WfA
Rkd;Z
=P^')
`(>dD
-[dpI
=)#R
[j`t\xt$
`vJ?^\
sY_N9
<0%.i
ItpLi
/w3xN.
_obUbUX
BBL#%9
j#[&I
g>Y&:
pmk?n
N_O<j
5$ksI
"9v7w
juHkp
h{GzT
C`[MD
0v; '
Q\*gT
yc}`Gh
=$F&o
U*|__G
7 KtV"f
x55CC4
(/})d!
\R.|q
^rSVQA
8*>Q%
,}W)1
JYZ!8
hP[~ID8
e.%Q6
c>bvf
>3^&Q
8oK40
NZPbq
"m+]
xLV6<
).aKW
^pCOC
'Symantec Time Stamping Services CA - G20
ks{L(4~
)*!Y}#
Z)-Z)
|xf?f
j]~F7
yliHQS
IxZrb#
riqX"
]pw\0
H_Hu`
pG{d
<(y3.:?
iAq&g
wVI52QB
Ke`\_
~NWTD
!n <L
k $~?sh<|
6;Wp9bK
EE]J&
HZ6uk
k,J4&
MqT~x^^c
x$agv
+7P1,R~
p\cOdK!1
4P_ 1
(|vc}
i87$w
'j+:i
\M9L@
)ED+^(
E`th:c
6#MgJ
{b\]_Q&>7
DX-MnS24
_)w'N
iWsC=
[ZHMx
EnableWindow
6qYYn
[ck!4
\Microsoft\Internet Explorer\Quick Launch
ux6$?
4?o{'
\To_h4
;:ihd
Q_N3T_
h8Y/\
CloseHandle
!;p,M
1_r=y
#aU r
}|&6g@zh
XS*&kL
P [iL
5"5/5
1_2gt
B}leR
h>"<^
lk*-=
s$-dR{A]
$'WP1y
-_Ze4
7{pqMtvb
x@fFf
[iv0-
Nen#L
={6c4U
BwL@*
gLffv.
mHQ`8
?kl34
a}hUP
GgSVX
(|3^5
M..La^
>>=.-
`EyTN
&0$0"
]OL/x
{3`D%
/xb+9SE
4#4*484C4O4f4m4x4
TNAO6bA
#"xGU
klw5(
V86Cf
T*;xF
9~Q>E
5/1Pd
@bc:u~
tRZ~R
D;Co<Fw
AhX@P
AWdp@
^6Vxo
IniP8
*KS`+
a\4II
6aiZ2
YK9>T&
kL$.O
G$$41
65]Y=
P^u3V
,:a;Z0VG
fBU SD
0[Z;$J
$q8Pv
[NjCk
q:UtU9
1mSd;
$)1S4
*X>CS
E@9oG
created uninstaller: %d, "%s"
8Y0r"
COMCTL32.dll
$#7f^9
,=3dD6EC
Y[yW5gRn
("HC/k
ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
PR0Vr
PortableApps.comInstallerVersion
t&Fa5N(f
200530104838Z0
q| ~#
c=rP`
)Ez/Y
Q%@4d,
?:.O[TH
4R}xIR`
`0tFS
44hZ8
x6=Ut[
/XTBdD
V;b5A h
[o_M2seG/C
y@+Ed
Erp>7
|P%]H
XFH+h
A~29~e
H5y4IY
2N|>~}
RemoveDirectoryW
+OprJE
#dCwa
#hozK{6
0 0$0(0,0`0d0h0l0p0t0x0|0
Nkmi2
6j;4F#
N^[,HB
0mq&l
9U~t|
b@T8p
t nz-e
RegDeleteValueW
<XIAx8
9uW20
*uAMd
[2?iM
__<wq
MN{]@>i
{_|U,
F-9xr`
UR[U$/
y9NF%
0nDN6
0)3APb^
?:""{
&^k{Z
fss%^
RegEnumKeyW
}:9|EV
i23}<t
\U2Bl
c!nvsO[
Z)ti\
jA_?d
_:Agw
4"4(4-42484I4]4c4i4o4w4~4
}WR2l
l5hh&
B<-9k
Symantec Corporation100.
IsWindow
#<7 %
l`3RM
a|n3J
Error registering DLL: Could not load %s
E6\Fj
Psd"o{
!AuE>w
O*2o*
Jdk+}
qAa,(Q
L,r{!
PO Box 2271
0?Cb>
4&vr7
%BNwU
_`G:K
|5`Z6
i2fPs
wUSoP
v?W=Qm
5Ths5.?Y
PJ?7;
IsWindowVisible
zA[r8
^=v-Zd'8
$5'-`
*x]fp
Ie\Ff
AddTrust External CA Root0
150331231826Z0#
de3\C
7j~KGG %
}ZY<g
T0bUP:b
aIVp%r
Rk{{ -
#~gO[
@Gk3o#
e7mW}
>uJHH
J'z<a)
wpNF&
Y-gy|3%
~T!{8H
9G~o}
GtzjI
/pU$k
\>"Yg5FF
%`(dB
j8JZ!
}.Knt#*
.B2;C
edME2,
`\h%-
MOGfH
QS -!J
^-1{O~LI
CallWindowProcW
f3\#p
\bVXn#o
i;2lS
hBuJN
MJ7\=
z@;p"
b8'#M
Ug,`+
G~'fW
:P'{&
U<$@Gv#
.,xZM{[{
?wn?'
"`_DV
Eb69Q
~te*M
WriteRegExpandStr: "%s\%s" "%s"="%s"
D^+x3x~
2XNWb7y
4.Xk=
q!-%H
-+yo}
jyIdJ
~QqW;
Process32NextW
n (-]:
`Fg${
|\eR)
z,Drk
RegDeleteKeyW
9P#X4
Z!4%Sp
]_E3&
~p7b7Y673
7Y2bWUO\
wk(jZ
|:Nd+
|RQ-X%5
l1DP1
5'Q.^-
bnzYU
V{'%dh
M#KQl-
>iQ]%A
Ne"zF"
u}9-$.G
GSzcL
<NQF[89
Delete: DeleteFile failed("%s")
bqH']
E<xjP
reqX"
Q-pl
e7%5wu_
T16a@
gcM!8v
WaitForSingleObject
A/M!{
LCg)Y
VnRk4
L^@G"%W
wd-8:@
<!XSCK
>~YoG
w$>b:bAu8/
oqotc
"UTI`oE
OpenProcessToken
Gf?3Y
-Z(>P
xGj<J
k }\ dwx
&'^i+
NullsoftInstHD
B}~&2?l
0;@eM
YN9qDh)
F{>K\
qt"Tj
J/5A2c
e=J$Y
SWi]/
SetForegroundWindow
G>I$~
1U8<(t@}A?[eyj
"+>_c
fL>z"
23F~'
R1p5#
u$gfo
-'&7%
45cl* r
bR9 .
?1?<?X?t?
w2-0k
vi\gj-
n=xTm
d,I'Z1~\B
@,a)w
]nKxQ
[D3GSm
jR;(M
ExpandEnvironmentStringsW
4vnW/
R`tfD
SetFileTime
^%rS&
AvJ4)
C>.-O
IxB?a
^'!^s
3.XmJI^
wm^HN
ifu278
7, n}
kK-l=
->-t+
brTJx
hz09h;I!(Z%pk~
$8ijP
9OZs7
Ro[|r
yu*"V
@|`G\2n
5\Kv'R
V;|@b1=V!
!J~U^
r%K:3d
]A`]=
KC8Zl
Wik*P
SLC '
+Fj4 =
H(nH=
8T]$gj
]ld>v
}UwE{Lp
H,$9#?
KZ[yz
#@:^?
YISAq
softuW
C9H.{;
g(T0.DzNp
g`R[Z/
zCqG^+
V{NZm
+[/Q_MY
:#L0q
(=k9eh
vPI2]
N#x4#
_Pn8l
buuu(
bO2W
wU]78
T/Rsj
lg '&;0
0N"F"
zPXUd
CPvwP,.
}I2<h
202t2
hs2qe
<(uy}Z
|WAclX
Ae0;|
hK_{/
{Qfs,
W5s3;
+rJ3!
jK,/&
c2gd<*&
#U~uD
>6_bh=
PczF~
sGRcw2u
|?AWX
."/hQ
4"RHs
;5<w%&E
KcPj.+\2
7gB}m
tzK.x
d2:$
0KWQa+;
4xh{}
M?c\\2
x$Iug
SpIs~
Q2UB6
"tm!H
WT/5<.
-;9Y09
6<`TU-
cE}@pW
6$9(xbU_A
9r|+9
v'pN8,
`>:"$
F0*,g
YMQJc`Co
"i8F>
A;k(A3
/TPCm
D*xB~
[I_@_
50301
kxhI#
^RfRs
Q-5S"6)
}3%(+
Z|_|q
vi:@W
wY&qCY
'/C[2
DialogBoxParamW
FreeLibrary
pQ~*,
!f${vS
B2%xT
D$$Ph
w12,2
VET{T
<+CEi
eHR-s
qpXDv
]-96^
CompanyName
Kernel32.DLL
B<1Y44V
<?Zu/
mrBMW
#ei=s
.$K4
Ppm{[,
Lj~:5
:!e[C+
}l"<f
E|?M.
X{4w?
o~M"4
g.g_K
md*p
cBxA]J
^6\aY
G%}'{
a>8);
2,KKlD
2u.RL
u C0Z
-XEa5
KfCYo
j9v$%
/@4RV
|??RhKo
)eC}Cde
Y|jd$
]1y]5#
s_DU'
:27Q6,4N
qM{E&w\J2
KWY.TWa
?Oc)e
#Q:I2
,Fk>|R
e_N3H
5Rliz
M2S3Vq
LoadBitmapW
)%aH%
mK^;G
-Cf|[
SetBkColor
GetTTFVersionString(%s) returned %s
OQLjd
nZ!w.
]][['
lk^gf
DWwbq
V}K9:
]f&VE
Z2aFBj
x]Cz4
H+4.sv
OKgNKC
"YUsC
{!'dJ4dX0
W~AFc
Y$Y@v
tw-ezo
h(Cr57
7s^bSP
G|tA`
~ft0F
1z-C?
Sn1O+
-@>rfM
Exec: command="%s"
lySu?
[fJrf6
bfhit
q=mt[0
6DOg%
y.SYe
Fie<:
GB[<z
79oEy
ImageList_AddMasked
280508235959Z0}1
t&nDK[
Y\+{[
X3p(7E
I"U1m;e
4@<Lz
^SLw~
{[5D,0
JkN%;
T N3!
>BBEb
2t"S_
5YMku
f9|M,z
}ug:MU
_p'Yj
Garjl2
g'&V:
yYf:K
\+Ca3
!KI+OF
FindWindowExW
zV@uM5'
zccCK
PeekMessageW
T(k2<
}Uo+{
aS{b
VUXs)
*{kc+
^; Id\|
s[z<+[y#
ER$Oe2
vI#R:
ZWf~q
((`5s
Eqr7Z
FE``U
bj8uSZvq
Q7w5u
hM{%}/
wsprintfA
GXN\Z
gVo?_q
<%hch
V}Aa\
Pu7Xw
t$$VV
1}N%g
.wX[=
Delete: DeleteFile("%s")
ut1(v
`(@AU|]
hvTBv
({:p3
1_*-;
MH?#g>p,
Installer integrity check has failed. Common causes include
z{>L+eG8
6Bh33
?Da[+/
ICCc+454
bSAJwG
M HH4m
T-on_
L+YEfC8
q=<D^s
gQXM~U
'|.\C
L;WSD|
bYd,k
/bITM
G|Ewo
*8M0!
Control Panel\Desktop\ResourceLocale
d|YhPPA
@[f<A
+MS>-jc
Kk}fr<
nmP8HH
3vS^(
m?x<v
wW.q1,
i:6?)@
0'0D0M0o0
KF6?O
GetWindowLongW
JCE6:
?9h25
3uo=[8w
O/\9P
v{,U)hD=v
'O9D?I
u'\2Z
8Uz!b
)=IW^
j+I\bb:
cx2Ej
[scuy
8.Ohp]
v%C]^&
q(9^tq
_-LQ0
2y^2y0
ii+Qz
$eE9xZ
{055M
t=;Eh
]UzM(
y+ FVB(
'vt*x
?L7t15
xvcI!
SaE#|*
`VPU)
)2CH#
WjDU\w
DZ-HLm
Error launching installer
6&0g
Dm/YfhM
M[vG%N
797C7I7Y7|7
zk(K.
2>Xsy{
sE_vl
&2uYd
i`+.*
WriteFile
4-uCf
Sgm*fUT
R_zKD
:NiH[P
jF`Q0
DestroyWindow
HCgNr*
O9l6G
3iE-5
^:'/\
_xWI,
]_7"~
0;1A1Z1
kA9;4
rR'"{
h!xwx
")D$P
vmBg-
H],SS
p,(_r
VSUbOI:
1Mm;P
HKlW!e
;;D=$>v
V3c&
'Symantec Time Stamping Services CA - G2
6p&@)!(
!~v"fmk
te%dp
|0M0-U
Ph%m&2N
Uz@o-
s`04x
g[hB_*y
Wo5i%
$IdIO
!,,JP
;",xbb
GAy9)^
y(Ycu
/eM>8
~#7SQ
RichEd20
bRJ^9
+http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
>>`l:pRLx
_>Kq*
PFL"C
/+L9nn
; Hz+
.Bl&a
PortableApps.comFormatVersion
MACcD#
4R_a<
FJ&":
P z2L
^}P}<
ENK4x
QnNkg
oW1,p
LSVW3
.Q8@<
}Zm7-.
vT8M.
'3m~4W
1F\\J
A|42/
7JZNj
jS^cL~
1@aZ/
|:cdz
tnq6Y3
'wAiZ)
201229235959Z0b1
XdgCT
Iy+;>
1 1$1(1,1014181<1@1D1H1L1P1T1X1\1`1d1h1l1p1t1x1|1
nDS {
Xsx+I
[\tnZ
l5 [>\
RMDir: RemoveDirectory on Reboot("%s")
BDIjS;0K
IDIep
eBRinr
ojI4($3C6f,
Ftl35
_3W[3
"yt_X
yHGm=
Y~iVj
t6MHb;
L4/^.#
[Vuwa
UD~\#z<
ZdwU-
s%[OJ
&"d&P
bK"MW
%4J)3
l^\0g
~D*rX
l+}ju;,
+ai 9z
QK?I^YM
>-5wk
KZRdv.G
%pb}>
2Ug^%
d:<fL\
b&PAF
GQfiL_
VVVVj
x`'o2^
Zlp)p$
SZlJ3Y
9XiTK=
Xbq!f
vKQsE
$dBy3#&
P?'j>
@V% U
W~*UW
Da (L[
o+x`n&
D4pM0C`
GetModuleFileNameW
"%SG,.V
\\>%j
Yd*^@a
>e8"/*
5AuQh
)9_4v
)"[T
LLONx
Y30/E
b,@Sgh
'ZT(|
zGQmzf
hy1ta
F\$y;
\n@$H
8W,9+p
aa[|=
(p$T:
4yCoA
>zI#)
/Rk[nD[
t'x8L7
40A9|
M{6dr4
.Hn%'
P[:iU
I%#QF
ZpAoP
_X&F$
k(m?q
12B{/G
KZ#3'
nA)8/
-+-V,+O
G+f\]_,
sHW7C
Th%XMF
<;T"uu
= =1=
^Nu2m
PjExW
tdQX>
^G+NG
g)0M,
kn76}
.Tm)|l
9R$;v
`,mzA
vJ_NF
*6\WY9/gG
$LiP.
e\;a'
VS_VERSION_INFO
koWR9B}
|ypD/
baP`g|
c\DfG
VU~rv
Ev6qXc
S`wc/d
#3|9b
]jxdE
$8bm'U
mFPcS^
wW8\"
jqD/B
Zr) "4
!Mzz
1;QIA
)O;*1;
Ui2'5
jhnt{;Nj
yUZ\k2
{49=Ii
W*{j
'\2Ne
=;~SNi
"W!_6
+gVu6O
"/Y#fB
OpenClipboard
`3@w/1f
@lvkb
xRvUV
O:Ue9
H@Bfo
)0'0%
7A|z~M?
[>?Z3K
m}|>k
4m8vH
8I&k`
SdV0D
t!Nd_O
9\p~t
SMALHB7
OP{&;
?1J,U
(Dh42
cn3Gc
j`,4.
Ax3Q,)
??G3b
zuqYq
*0\HI
-(1$.
U'(o:
[(Oa*s
>uM({
DUL=z=
94**wma
qNm:J
"P30n
ce#}+V)
il^Kq
x"jSW
JbZGJ
@PIdun
CbPzz
i*dVn
D]r(.
w2"Pa[m
^3q`S
ExitProcess
y.3}n
E+E3"#
,R29$
xSo1 P
PS\")
|M3YI
!#mAj
V)*9/
gCL%*
]7k$
MNM8?F
J}9DG
56"]S
gLWm<N
Y,7IP
D$8PUh
=\BwvHui
zQmA!
tRZRC
6/0SH
mG+kf
chc`o
NXU$[
Please wait while Setup is loading...
Nx.$Lt
Ni`Sn
a&+RD
}{FL2;
QA(`0;w
UV*O5
C+I`Ra
]$y.o
Y1[~J
EE"hsW
CreateDialogParamW
G%01$
E~sBd
'L<KG
QNO%:
b+f`d
GetExitCodeProcess
2GZi@9
B&_hN
LGLtPPp
h]^*`}
)a`B,
[Rename]
_1u,&
.(U.W
c:,9d
-h?2=Q
^hg0h
~/S;.
- ,Y@
uM-XeF
~wIQ~BI3J
,SWzv
V>_{T
xajypH
/OF0r
vHF4B
Fb>1*I
ZRBQe*cJ
\EnK;#@{
s_y]7RW
if&Tn
[]U4X
VL8z/
eYK9\E
D,Chp)w
06s\}
|/ZRY*
PLih`
4wnyW
k0_@/
K.Lta
Tq{;,O
Q.99}i2
,MHv(
[9ma?3
-C=44
uS)`9%
VerQueryValueW
I[] C
d_4Vu
{MV`X
fclFh
GlobalLock
SHLWAPI
GetPrivateProfileStringW
xPhHP
*ECzfW
=,eo"
2<S5jz
oE8d&\
Oo.o@
a#PHZ
sM^eusN
SEHck)
_^][Y
$"'&
$0G<N
tq4FR
6U_Ah
|.Ou_P0!
Gpo/U,
4'Fvw
Y^2;-2Y
$3?U,d
!{6,i
)"/8FJ
(`QVd
InternalName
>{Fv)
*Wvo'!J'
wu@C1
E?MME
(>c0)
~OT1.
5\u]s
;{(QQ^P
?Z\hR
PmZON
&HZuR,
;7uP}
qR15`
A87b.
tt/[T
+{l;x!
:Tcz(
HCIs&%
`M4DUX
oCD[3
FindNextFileW
70Bp8E
zofa$b
yCJj
N,jS6
p]O62
}'B&Wx4
5f4%S
JE:=,
@m28D
k;#/}@
[.)/|o
';9wF
0=x?Q
{%6*9|7Yj
>f3U
4@d 0
incomplete download and damaged media. Contact the
Hk(S^
<!A7|r
B<0crj]
GSv%@
ZjQ]M
-Gp1~
SyJzw
99y w
+oH}B
3Ed-Z
iS5?/1
GetSystemMetrics
)dByX
dpmP.
W~:#I
~3U:S
Y^Vt_
Oi/-e
2%XhE
Yj#-`
%&8Z6
CloseClipboard
BriyY
J>Gm&
)/o8S
WPxM:
Zn:;$
5-S*r
J[!'{
9FCY,~
Oj\f3
dT>T
l.G##
&_.m$
M(y{p
d{\sM
DgbG%Yi
M%PL}?
WiRJJ3
bV%6n
J# n)x9
DUNA@
Y]Gj1
VZ~*d
}vo,>
s}(u%
TX}qN
USER32.dll
3QN_/
^<PsBg
pL)1M^4
JKEwM
:="I0
k ,hc
W$| T
Cj"QF
^)Vm"
sm3A6
$MZeX6
b4ME,j:
;Yy{+
p_{'p
^9t,U
$A:(<
#2R f
"_Ao~\
f8+>(
WOAq:
TnIYt
wE~d0H
?+Op`n
t3FI~&
l0/r>37
73 L35
GetCurrentProcess
{en9`
ztp]{
%\4~[p
F_+r=#Z
4"M~P
@d-TY
7$<Ab
iS',h{
H!%q!
.ndata
GetClassInfoW
>t#{,
WrG_5
Wt.bR
hUqg
l0o{A@
nZ,a|
,$u&G
*.@g\
?2?B?_?j?
vA6xRt
GA=;KJf
LtVKy
=+sIw
v#{uF
tU?{T
];-T+
7A]nS
OleUninitialize
mnP0}}
V0b~(
^)v"y9
D/&UE
!SA_3
SQcGs<
%d"hE
([<4o
->SEZ
B?~;f
"G{va
ihtFx
^$s]J
Instu`
}?isd
av.-{
_qzZG
RvS#h+
ShowWindow
Ht@h@
sw-/n
s@.wV
Vp zS
rjXWI
nkB-re
T./9qk
NHgAk
0*"?%%B
oQx).
Jump: %d
~xIl(
K:hMM
<"^pg
T|4#=f
-)V$qV
File: error, user retry
#a cT2
by/1YZ
[sdbd
0'FY1
t-EU.
mw^>>
y~mV@
a<E :_
85HO\^
47$0fD.rh
i"PRg
k|'L
}el+J,
Cxa9r:
nObi`
2]Xr1
HKEY_USERS
/_c>}
pf:^(
[B3(f)[P
LookupPrivilegeValueW
xWGpG
~nsu.tmp
;#;A;H;`;u;
ZQl[3
!o+g$_
cvjJq
u$9Uls
g@D(Z
Delete: "%s"
p-J;4>
'j%S%
d*]Ee
'wAka
0_G$g$
Bn6Rf
fA P|
MG@.USd
;n: 5>
#j;d2j
?\D6
-S8J#L
1{zX]
ZNS9FR
f58ksIN
U.n]k
=z?Bs
95u{\a`[1
!udc5
Ezc :}rb"
(U`v.
T.]wM
@Zp5u$
GetLastError
&:LHO
D7PY)A
4%%EDC
|-7o*
-2DUH
0Bmno
:~|Z&
Cq-&q
jg.xwF
576@6^6k6
rn!Mc
dycDB3
+&/d,-U
T$4HHy`x
P&nv'@@
en?pL
' CJ*
yVbXyy%F7
]M<]S
up'+y[
pI*L0*
`Y3Yx
`$;O+zm
buv2 8
D~O:!0n4j
<8]4u
:znc\
{:(eBiG
=DPj%M
*&'SUL
'+8oY
Q>A:q
r\J6<
_h>9I[
g8z~;&,"
9YzLdn
{%%+HCqQ
!E:2F
h/,&f
F=["t9
i)j>^
)v>v.
9rUFV
3.0.16.0
PE Information
| Image Base | Entry Point | Reported Checksum | Actual Checksum | Minimum OS Version | Compile Time | Import Hash | Icon | Icon Exact Hash | Icon Similarity Hash | Icon DHash |
|---|---|---|---|---|---|---|---|---|---|---|
| 0x00400000 | 0x000039e3 | 0x00163e91 | 0x00163e91 | 5.0 | 2012-02-24 19:19:59 | 32f3282581436269b3a75b6675fe3e08 |  |
2c09465cc979677d65781d9403176c31 | 5c00f471cce984e3b873ef9ade242aed | 71e0e4b8cccccce0 |
Version Infos
| Comments | For additional details, visit PortableApps.com |
|---|---|
| CompanyName | PortableApps.com |
| FileDescription | WinPenguins Portable |
| FileVersion | 1.0.76.0 |
| InternalName | WinPenguins Portable |
| LegalCopyright | 2007-2015 PortableApps.com, PortableApps.com Installer 3.0.16.0 |
| LegalTrademarks | PortableApps.com is a registered trademark of Rare Ideas, LLC. |
| OriginalFilename | WinPenguinsPortable_0.76_English.paf.exe |
| PortableApps.comAppID | WinPenguinsPortable |
| PortableApps.comFormatVersion | 3.0.16 |
| PortableApps.comInstallerVersion | 3.0.16.0 |
| ProductName | WinPenguins Portable |
| ProductVersion | 1.0.76.0 |
| Translation | 0x0000 0x04b0 |
Sections
| Name | RAW Address | Virtual Address | Virtual Size | Size of Raw Data | Characteristics | Entropy |
|---|---|---|---|---|---|---|
| .text | 0x00000400 | 0x00001000 | 0x00006f10 | 0x00007000 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ | 6.50 |
| .rdata | 0x00007400 | 0x00008000 | 0x00002a92 | 0x00002c00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 4.39 |
| .data | 0x0000a000 | 0x0000b000 | 0x00067ebc | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 1.47 |
| .ndata | 0x00000000 | 0x00073000 | 0x00159000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 0.00 |
| .rsrc | 0x0000a200 | 0x001cc000 | 0x00018eb8 | 0x00019000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 7.56 |
| .reloc | 0x0000b400 | 0x001e5000 | 0x00000f8a | 0x00001000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ | 7.88 |
Overlay
| Offset | 0x00023200 |
| Size | 0x0013deb0 |
| Name | Offset | Size | Language | Sub-language | Entropy | File type |
|---|---|---|---|---|---|---|
| RT_ICON | 0x001cc328 | 0x00012524 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 7.98 | None |
| RT_ICON | 0x001de850 | 0x000025a8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.18 | None |
| RT_ICON | 0x001e0df8 | 0x000010a8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.51 | None |
| RT_ICON | 0x001e1ea0 | 0x00000ea8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.70 | None |
| RT_ICON | 0x001e2d48 | 0x000008a8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 6.02 | None |
| RT_ICON | 0x001e35f0 | 0x00000568 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.67 | None |
| RT_ICON | 0x001e3b58 | 0x00000468 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.84 | None |
| RT_DIALOG | 0x001e3fc0 | 0x00000120 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.56 | None |
| RT_DIALOG | 0x001e40e0 | 0x00000200 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.68 | None |
| RT_DIALOG | 0x001e42e0 | 0x000000f8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.91 | None |
| RT_DIALOG | 0x001e43d8 | 0x000000ee | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.93 | None |
| RT_GROUP_ICON | 0x001e44c8 | 0x00000068 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.72 | None |
| RT_VERSION | 0x001e4530 | 0x000005c4 | LANG_NEUTRAL | SUBLANG_NEUTRAL | 3.37 | None |
| RT_MANIFEST | 0x001e4af8 | 0x000003bd | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.23 | None |
Imports
| Name | Address |
|---|---|
| SetBkColor | 0x40803c |
| GetDeviceCaps | 0x408040 |
| DeleteObject | 0x408044 |
| CreateBrushIndirect | 0x408048 |
| CreateFontIndirectW | 0x40804c |
| SetBkMode | 0x408050 |
| SetTextColor | 0x408054 |
| SelectObject | 0x408058 |
| Name | Address |
|---|---|
| SHBrowseForFolderW | 0x40817c |
| SHGetPathFromIDListW | 0x408180 |
| SHGetFileInfoW | 0x408184 |
| ShellExecuteW | 0x408188 |
| SHFileOperationW | 0x40818c |
| SHGetSpecialFolderLocation | 0x408190 |
| Name | Address |
|---|---|
| RegEnumKeyW | 0x408000 |
| RegOpenKeyExW | 0x408004 |
| RegCloseKey | 0x408008 |
| RegDeleteKeyW | 0x40800c |
| RegDeleteValueW | 0x408010 |
| RegCreateKeyExW | 0x408014 |
| RegSetValueExW | 0x408018 |
| RegQueryValueExW | 0x40801c |
| RegEnumValueW | 0x408020 |
| Name | Address |
|---|---|
| ImageList_AddMasked | 0x408028 |
| ImageList_Destroy | 0x40802c |
| ImageList_Create | 0x408034 |
| Name | Address |
|---|---|
| CoTaskMemFree | 0x4082bc |
| OleInitialize | 0x4082c0 |
| OleUninitialize | 0x4082c4 |
| CoCreateInstance | 0x4082c8 |
| Name | Address |
|---|---|
| GetFileVersionInfoSizeW | 0x4082ac |
| GetFileVersionInfoW | 0x4082b0 |
| VerQueryValueW | 0x4082b4 |
Usage
Processing ( 2.90 seconds )
- 2.756 CAPE
- 0.131 BehaviorAnalysis
- 0.007 AnalysisInfo
- 0.001 Debug
Signatures ( 0.07 seconds )
- 0.008 ransomware_files
- 0.007 antiav_detectreg
- 0.005 antianalysis_detectfile
- 0.005 ransomware_extensions
- 0.003 antiav_detectfile
- 0.003 infostealer_ftp
- 0.003 territorial_disputes_sigs
- 0.003 ursnif_behavior
- 0.002 antianalysis_detectreg
- 0.002 antivm_vbox_files
- 0.002 infostealer_bitcoin
- 0.002 infostealer_im
- 0.002 infostealer_mail
- 0.002 poullight_files
- 0.002 masquerade_process_name
- 0.001 antidebug_devices
- 0.001 antivm_parallels_keys
- 0.001 antivm_vbox_keys
- 0.001 antivm_vmware_keys
- 0.001 geodo_banking_trojan
- 0.001 browser_security
- 0.001 disables_backups
- 0.001 disables_browser_warn
- 0.001 disables_power_options
- 0.001 azorult_mutexes
- 0.001 cryptbot_files
- 0.001 echelon_files
- 0.001 qulab_files
- 0.001 revil_mutexes
- 0.001 modirat_behavior
- 0.001 lokibot_mutexes
Reporting ( 0.03 seconds )
- 0.026 CAPASummary
- 0.007 JsonDump
Signatures
Queries the keyboard layout
Reads data out of its own binary image
self_read: process: WinPenguinsPortable_.exe, pid: 1560, offset: 0x00000000, length: 0x0015f2d2
self_read: process: WinPenguinsPortable_.exe, pid: 1560, offset: 0x30785c426331785c, length: 0x00004000
self_read: process: WinPenguinsPortable_.exe, pid: 1560, offset: 0x3238785c6331785c, length: 0x00008000
self_read: process: WinPenguinsPortable_.exe, pid: 1560, offset: 0x3266785c3264785c, length: 0x00000004
The binary likely contains encrypted or compressed data
section: {'name': '.rsrc', 'raw_address': '0x0000a200', 'virtual_address': '0x001cc000', 'virtual_size': '0x00018eb8', 'size_of_data': '0x00019000', 'characteristics': 'IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ', 'characteristics_raw': '0x40000040', 'entropy': '7.56'}
section: {'name': '.reloc', 'raw_address': '0x0000b400', 'virtual_address': '0x001e5000', 'virtual_size': '0x00000f8a', 'size_of_data': '0x00001000', 'characteristics': 'IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ', 'characteristics_raw': '0x42000040', 'entropy': '7.88'}
Anomalous binary characteristics
anomaly: Entrypoint of binary is located outside of any mapped sections
Screenshots
No screenshots available.Hosts
No hosts contacted.
DNS
No domains contacted.
Summary
C:\Windows\System32\kernel.appcore.dll
C:\Windows\System32\bcryptPrimitives.dll
\Device\CNG
C:\Users\Packager\AppData\Local\Temp\SHFOLDER.DLL
C:\Windows\System32\shfolder.dll
C:\Windows\System32\cfgmgr32.dll
\Device\DeviceApi\CMApi
\??\MountPointManager
C:\Users\Packager\AppData\Local\Temp\
C:\Users\Packager\AppData\Local\Temp
C:\Users\Packager\AppData\Local\Temp\nsw4058.tmp
C:\Users\Packager\AppData\Local\Temp\WinPenguinsPortable_.exe
C:\Users\Packager\AppData\Local\Temp\nsm4105.tmp
C:\Users\Packager\AppData\Local\Temp\nsr4125.tmp
C:\Users
C:\Users\Packager
C:\Users\Packager\AppData
C:\Users\Packager\AppData\Local
C:\Users\Packager\PortableApps\*.*
C:\Users\Packager\AppData\Local\Temp\nsr4125.tmp\System.dll
C:\PortableApps
C:\Users\Packager\AppData\Local\Temp\nsr4125.tmp\FindProcDLL.dll
C:\Users\Packager\AppData\Local\Temp\RichEd20.DLL
C:\Windows\System32\riched20.dll
C:\Users\Packager\AppData\Local\Temp\USP10.dll
C:\Windows\System32\usp10.dll
C:\Users\Packager\AppData\Local\Temp\msls31.dll
C:\Windows\System32\msls31.dll
C:\Windows\System32\msctf.dll
C:\Windows\System32\en-US\USER32.dll.mui
C:\Users\Packager\AppData\Local\Temp\nsr4125.tmp\modern-header.bmp
C:\Users\Packager\AppData\Local\Temp\nsr4125.tmp\modern-wizard.bmp
C:\Windows\System32\textinputframework.dll
C:\Windows\System32\CoreUIComponents.dll
C:\Windows\System32\CoreMessaging.dll
C:\Windows\System32\ntmarta.dll
C:\Windows\System32\WinTypes.dll
C:\Windows\SystemResources\USER32.dll.mun
C:\Users\Packager\AppData\Local\Temp\nsr4125.tmp\nsDialogs.dll
C:\Windows\Fonts\staticcache.dat
C:\Users\Packager\AppData\Local\Temp\TextShaping.dll
C:\Windows\System32\TextShaping.dll
C:\Windows\System32\shell32.dll
C:\Users\Packager\AppData\Local\Temp\imageres.dll
C:\Windows\System32\imageres.dll
C:\Windows\SystemResources\imageres.dll.mun
C:\Windows\System32\bcryptPrimitives.dll
\Device\CNG
C:\Users\Packager\AppData\Local\Temp\SHFOLDER.DLL
C:\Windows\System32\shfolder.dll
C:\Windows\System32\cfgmgr32.dll
\Device\DeviceApi\CMApi
\??\MountPointManager
C:\Users\Packager\AppData\Local\Temp\
C:\Users\Packager\AppData\Local\Temp
C:\Users\Packager\AppData\Local\Temp\nsw4058.tmp
C:\Users\Packager\AppData\Local\Temp\WinPenguinsPortable_.exe
C:\Users\Packager\AppData\Local\Temp\nsm4105.tmp
C:\Users\Packager\AppData\Local\Temp\nsr4125.tmp
C:\Users
C:\Users\Packager
C:\Users\Packager\AppData
C:\Users\Packager\AppData\Local
C:\Users\Packager\PortableApps\*.*
C:\Users\Packager\AppData\Local\Temp\nsr4125.tmp\System.dll
C:\PortableApps
C:\Users\Packager\AppData\Local\Temp\nsr4125.tmp\FindProcDLL.dll
C:\Users\Packager\AppData\Local\Temp\RichEd20.DLL
C:\Windows\System32\riched20.dll
C:\Users\Packager\AppData\Local\Temp\USP10.dll
C:\Windows\System32\usp10.dll
C:\Users\Packager\AppData\Local\Temp\msls31.dll
C:\Windows\System32\msls31.dll
C:\Windows\System32\msctf.dll
C:\Windows\System32\en-US\USER32.dll.mui
C:\Users\Packager\AppData\Local\Temp\nsr4125.tmp\modern-header.bmp
C:\Users\Packager\AppData\Local\Temp\nsr4125.tmp\modern-wizard.bmp
C:\Windows\System32\textinputframework.dll
C:\Windows\System32\CoreUIComponents.dll
C:\Windows\System32\CoreMessaging.dll
C:\Windows\System32\ntmarta.dll
C:\Windows\System32\WinTypes.dll
C:\Windows\SystemResources\USER32.dll.mun
C:\Users\Packager\AppData\Local\Temp\nsr4125.tmp\nsDialogs.dll
C:\Windows\Fonts\staticcache.dat
C:\Users\Packager\AppData\Local\Temp\TextShaping.dll
C:\Windows\System32\TextShaping.dll
C:\Windows\System32\shell32.dll
C:\Users\Packager\AppData\Local\Temp\imageres.dll
C:\Windows\System32\imageres.dll
C:\Windows\SystemResources\imageres.dll.mun
C:\Users\Packager\AppData\Local\Temp\nsm4105.tmp
C:\Users\Packager\AppData\Local\Temp\nsr4125.tmp\System.dll
C:\Users\Packager\AppData\Local\Temp\nsr4125.tmp\FindProcDLL.dll
C:\Users\Packager\AppData\Local\Temp\nsr4125.tmp\modern-header.bmp
C:\Users\Packager\AppData\Local\Temp\nsr4125.tmp\modern-wizard.bmp
C:\Users\Packager\AppData\Local\Temp\nsr4125.tmp\nsDialogs.dll
C:\Users\Packager\AppData\Local\Temp\nsr4125.tmp\System.dll
C:\Users\Packager\AppData\Local\Temp\nsr4125.tmp\FindProcDLL.dll
C:\Users\Packager\AppData\Local\Temp\nsr4125.tmp\modern-header.bmp
C:\Users\Packager\AppData\Local\Temp\nsr4125.tmp\modern-wizard.bmp
C:\Users\Packager\AppData\Local\Temp\nsr4125.tmp\nsDialogs.dll
C:\Users\Packager\AppData\Local\Temp\nsw4058.tmp
C:\Users\Packager\AppData\Local\Temp\nsr4125.tmp
C:\Users\Packager\AppData\Local\Temp\nsr4125.tmp
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\STE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\Cryptography\Configuration
HKEY_CURRENT_USER
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-10e03f000000}\
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-10e03f000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-10e03f000000}\Generation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-100000000000}\
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-100000000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-100000000000}\Generation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-300300000000}\
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-300300000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-300300000000}\Generation
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\StateSeparation\RedirectionMap\Keys
HKEY_LOCAL_MACHINE\Software\Microsoft\LanguageOverlay\OverlayPackages\en-US
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\ResourcePolicies
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\SafeProcessSearchMode
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\WinPenguinsPortable_.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\OOBE\LaunchUserOOBE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\CTF\EnableAnchorContext
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TurnOffSPIAnimations
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\MS Shell Dlg 2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\MS Shell Dlg
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\AppCompatClassName
HKEY_CURRENT_USER\Software\Microsoft\CTF\DirectSwitchHotkeys
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows\IsVailContainer
HKEY_LOCAL_MACHINE\Software\Microsoft\Input
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\ResyncResetTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\MaxResyncAttempts
HKEY_LOCAL_MACHINE\Software\Policies
HKEY_CURRENT_USER\Software\Policies
HKEY_CURRENT_USER\Software
HKEY_LOCAL_MACHINE\Software
HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\AutoSuggest
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Always Use Tab
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Client\
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Client\(Default)
HKEY_CURRENT_USER\Control Panel\Desktop
HKEY_CURRENT_USER\Control Panel\Desktop\SmoothScroll
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\EnableBalloonTips
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewAlphaSelect
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewShadow
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AccListViewV6
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\UseDoubleClickTimer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Segoe UI
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Segoe UI
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\STE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\Cryptography\Configuration
HKEY_CURRENT_USER
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-10e03f000000}\
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-10e03f000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-10e03f000000}\Generation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-100000000000}\
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-100000000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-100000000000}\Generation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-300300000000}\
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-300300000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-300300000000}\Generation
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\StateSeparation\RedirectionMap\Keys
HKEY_LOCAL_MACHINE\Software\Microsoft\LanguageOverlay\OverlayPackages\en-US
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\ResourcePolicies
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\SafeProcessSearchMode
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\WinPenguinsPortable_.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\OOBE\LaunchUserOOBE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\CTF\EnableAnchorContext
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TurnOffSPIAnimations
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\MS Shell Dlg 2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\MS Shell Dlg
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\AppCompatClassName
HKEY_CURRENT_USER\Software\Microsoft\CTF\DirectSwitchHotkeys
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows\IsVailContainer
HKEY_LOCAL_MACHINE\Software\Microsoft\Input
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\ResyncResetTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\MaxResyncAttempts
HKEY_LOCAL_MACHINE\Software\Policies
HKEY_CURRENT_USER\Software\Policies
HKEY_CURRENT_USER\Software
HKEY_LOCAL_MACHINE\Software
HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\AutoSuggest
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Always Use Tab
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Client\
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Client\(Default)
HKEY_CURRENT_USER\Control Panel\Desktop
HKEY_CURRENT_USER\Control Panel\Desktop\SmoothScroll
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\EnableBalloonTips
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewAlphaSelect
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewShadow
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AccListViewV6
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\UseDoubleClickTimer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Segoe UI
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Segoe UI
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\STE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-10e03f000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-10e03f000000}\Generation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-100000000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-100000000000}\Generation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-300300000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-300300000000}\Generation
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\ResourcePolicies
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\SafeProcessSearchMode
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\OOBE\LaunchUserOOBE
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\CTF\EnableAnchorContext
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TurnOffSPIAnimations
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows\IsVailContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\ResyncResetTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\MaxResyncAttempts
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\AutoSuggest
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Always Use Tab
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Client\(Default)
HKEY_CURRENT_USER\Control Panel\Desktop\SmoothScroll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\EnableBalloonTips
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewAlphaSelect
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewShadow
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AccListViewV6
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\UseDoubleClickTimer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Segoe UI
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-10e03f000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-10e03f000000}\Generation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-100000000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-100000000000}\Generation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-300300000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{01989354-0000-0000-0000-300300000000}\Generation
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\ResourcePolicies
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\SafeProcessSearchMode
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\OOBE\LaunchUserOOBE
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\CTF\EnableAnchorContext
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TurnOffSPIAnimations
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows\IsVailContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\ResyncResetTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\MaxResyncAttempts
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\AutoSuggest
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Always Use Tab
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Client\(Default)
HKEY_CURRENT_USER\Control Panel\Desktop\SmoothScroll
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\EnableBalloonTips
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewAlphaSelect
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewShadow
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AccListViewV6
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\UseDoubleClickTimer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Segoe UI
Local\SM0:1560:168:WilStaging_02
Local\MSCTF.Asm.MutexDefault3
CicLoadWinStaWinSta0
Local\MSCTF.CtfMonitorInstMutexDefault3
DefaultTabtip-MainUI
Local\SM0:1560:64:WilError_03
Local\MSCTF.Asm.MutexDefault3
CicLoadWinStaWinSta0
Local\MSCTF.CtfMonitorInstMutexDefault3
DefaultTabtip-MainUI
Local\SM0:1560:64:WilError_03
Sorry! No behavior.
Sorry! No strace.
Sorry! No tracee.
No hosts contacted.
No TCP connections recorded.
No UDP connections recorded.
No domains contacted.
HTTP Requests
No HTTP(s) requests performed.
SMTP traffic
No SMTP traffic performed.
IRC traffic
No IRC requests performed.
No ICMP traffic performed.
CIF Results
No CIF Results
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Suricata HTTP
No Suricata HTTP
Sorry! No Suricata Extracted files.
Sorry! No dropped files.
Sorry! No process dumps.