.- - -----÷M÷E÷N÷U÷------------------------------------------------------------- --- ---- -------------.
! WALL ! STATS ! GOODIES ! YARA ! FAQ ! RSS ! EMV !
`-------------- - --- ---------- -------- -------- -------- -------- ----------------- - ---- ---- --'
ATM MALWARE NOTICE
9f8a7828d833ed7f28f9f5ceaf1c073c6de0645172b8316d86edc16c84b61c4f
Date...........: 2018-06-12
Family.........: ATMtest
File name......: xfs_test.exe
File size......: 88.50 KB
Type file......: EXE/Windows
Virscan........: VT - HA
PDB Path found.: M:\Work\atm\xfs_test\Release\xfs_test.pdb
Entropy:
Binary Histogram:
=== SCREENSHOT ===
=== PEDUMP REPORT ===
=== MZ Header ===
signature: "MZ"
bytes_in_last_block: 144 0x90
blocks_in_file: 3 3
num_relocs: 0 0
header_paragraphs: 4 4
min_extra_paragraphs: 0 0
max_extra_paragraphs: 65535 0xffff
ss: 0 0
sp: 184 0xb8
checksum: 0 0
ip: 0 0
cs: 0 0
reloc_table_offset: 64 0x40
overlay_number: 0 0
reserved0: 0 0
oem_id: 0 0
oem_info: 0 0
reserved2: 0 0
reserved3: 0 0
reserved4: 0 0
reserved5: 0 0
reserved6: 0 0
lfanew: 248 0xf8
=== DOS STUB ===
00000000: 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno|
00000020: 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......|
=== RICH Header ===
LIB_ID VERSION TIMES_USED
4 4 8447 20ff 2 2
225 e1 20806 5146 36 24
223 df 20806 5146 17 11
224 e0 20806 5146 122 7a
147 93 30729 7809 3 3
1 1 0 0 87 57
229 e5 21005 520d 2 2
219 db 21005 520d 1 1
222 de 21005 520d 1 1
=== PE Header ===
signature: "PE\x00\x00"
# IMAGE_FILE_HEADER:
Machine: 332 0x14c x86
NumberOfSections: 5 5
TimeDateStamp: "2018-05-06 18:47:39"
PointerToSymbolTable: 0 0
NumberOfSymbols: 0 0
SizeOfOptionalHeader: 224 0xe0
Characteristics: 258 0x102 EXECUTABLE_IMAGE, 32BIT_MACHINE
# IMAGE_OPTIONAL_HEADER32:
Magic: 267 0x10b 32-bit executable
LinkerVersion: 12.0
SizeOfCode: 59392 0xe800
SizeOfInitializedData: 38400 0x9600
SizeOfUninitializedData: 0 0
AddressOfEntryPoint: 10214 0x27e6
BaseOfCode: 4096 0x1000
BaseOfData: 65536 0x10000
ImageBase: 4194304 0x400000
SectionAlignment: 4096 0x1000
FileAlignment: 512 0x200
OperatingSystemVersion: 5.1
ImageVersion: 0.0
SubsystemVersion: 5.1
Reserved1: 0 0
SizeOfImage: 114688 0x1c000
SizeOfHeaders: 1024 0x400
CheckSum: 0 0
Subsystem: 3 3 WINDOWS_CUI
DllCharacteristics: 33088 0x8140 DYNAMIC_BASE, NX_COMPAT
TERMINAL_SERVER_AWARE
SizeOfStackReserve: 1048576 0x100000
SizeOfStackCommit: 4096 0x1000
SizeOfHeapReserve: 1048576 0x100000
SizeOfHeapCommit: 4096 0x1000
LoaderFlags: 0 0
NumberOfRvaAndSizes: 16 0x10
=== DATA DIRECTORY ===
EXPORT rva:0x 0 size:0x 0
IMPORT rva:0x 14a6c size:0x 3c
RESOURCE rva:0x 1a000 size:0x 1e0
EXCEPTION rva:0x 0 size:0x 0
SECURITY rva:0x 0 size:0x 0
BASERELOC rva:0x 1b000 size:0x f84
DEBUG rva:0x 10170 size:0x 38
ARCHITECTURE rva:0x 0 size:0x 0
GLOBALPTR rva:0x 0 size:0x 0
TLS rva:0x 0 size:0x 0
LOAD_CONFIG rva:0x 145e8 size:0x 40
Bound_IAT rva:0x 0 size:0x 0
IAT rva:0x 10000 size:0x 128
Delay_IAT rva:0x 0 size:0x 0
CLR_Header rva:0x 0 size:0x 0
rva:0x 0 size:0x 0
=== SECTIONS ===
NAME RVA VSZ RAW_SZ RAW_PTR nREL REL_PTR nLINE LINE_PTR FLAGS
.text 1000 e714 e800 400 0 0 0 0 60000020 R-X CODE
.rdata 10000 50d8 5200 ec00 0 0 0 0 40000040 R-- IDATA
.data 16000 314c 1200 13e00 0 0 0 0 c0000040 RW- IDATA
.rsrc 1a000 1e0 200 15000 0 0 0 0 40000040 R-- IDATA
.reloc 1b000 f84 1000 15200 0 0 0 0 42000040 R-- IDATA DISCARDABLE
=== RESOURCES ===
FILE_OFFSET CP LANG SIZE TYPE NAME
0x15060 0 0x409 381 MANIFEST #1
=== IMPORTS ===
MODULE_NAME HINT ORD FUNCTION_NAME
KERNEL32.dll 4b2 Sleep
KERNEL32.dll 3c0 ReadFile
KERNEL32.dll 453 SetEndOfFile
KERNEL32.dll 32d LCMapStringW
KERNEL32.dll 187 GetCommandLineW
KERNEL32.dll 300 IsDebuggerPresent
KERNEL32.dll 304 IsProcessorFeaturePresent
KERNEL32.dll ea EncodePointer
KERNEL32.dll ca DecodePointer
KERNEL32.dll ee EnterCriticalSection
KERNEL32.dll 339 LeaveCriticalSection
KERNEL32.dll 418 RtlUnwind
KERNEL32.dll 52 CloseHandle
KERNEL32.dll 202 GetLastError
KERNEL32.dll 2cf HeapFree
KERNEL32.dll 473 SetLastError
KERNEL32.dll 1c5 GetCurrentThreadId
KERNEL32.dll 119 ExitProcess
KERNEL32.dll 217 GetModuleHandleExW
KERNEL32.dll 245 GetProcAddress
KERNEL32.dll 15 AreFileApisANSI
KERNEL32.dll 367 MultiByteToWideChar
KERNEL32.dll 511 WideCharToMultiByte
KERNEL32.dll 24a GetProcessHeap
KERNEL32.dll 264 GetStdHandle
KERNEL32.dll 1f3 GetFileType
KERNEL32.dll d1 DeleteCriticalSection
KERNEL32.dll 263 GetStartupInfoW
KERNEL32.dll 214 GetModuleFileNameW
KERNEL32.dll 525 WriteFile
KERNEL32.dll 3a7 QueryPerformanceCounter
KERNEL32.dll 1c1 GetCurrentProcessId
KERNEL32.dll 279 GetSystemTimeAsFileTime
KERNEL32.dll 1da GetEnvironmentStringsW
KERNEL32.dll 161 FreeEnvironmentStringsW
KERNEL32.dll 4d3 UnhandledExceptionFilter
KERNEL32.dll 4a5 SetUnhandledExceptionFilter
KERNEL32.dll 2e3 InitializeCriticalSectionAndSpinCount
KERNEL32.dll 1c0 GetCurrentProcess
KERNEL32.dll 4c0 TerminateProcess
KERNEL32.dll 4c5 TlsAlloc
KERNEL32.dll 4c7 TlsGetValue
KERNEL32.dll 4c8 TlsSetValue
KERNEL32.dll 4c6 TlsFree
KERNEL32.dll 218 GetModuleHandleW
KERNEL32.dll 30a IsValidCodePage
KERNEL32.dll 168 GetACP
KERNEL32.dll 237 GetOEMCP
KERNEL32.dll 172 GetCPInfo
KERNEL32.dll 487 SetStdHandle
KERNEL32.dll 157 FlushFileBuffers
KERNEL32.dll 19a GetConsoleCP
KERNEL32.dll 1ac GetConsoleMode
KERNEL32.dll 33e LoadLibraryExW
KERNEL32.dll 38a OutputDebugStringW
KERNEL32.dll 2cb HeapAlloc
KERNEL32.dll 2d2 HeapReAlloc
KERNEL32.dll 8f CreateFileW
KERNEL32.dll 269 GetStringTypeW
KERNEL32.dll 467 SetFilePointerEx
KERNEL32.dll 524 WriteConsoleW
KERNEL32.dll 2d4 HeapSize
KERNEL32.dll 3be ReadConsoleW
MSXFS.dll 19 WFSExecute
MSXFS.dll 15 WFSClose
MSXFS.dll 24 WFSUnlock
MSXFS.dll 1b WFSGetInfo
MSXFS.dll 1a WFSFreeResult
MSXFS.dll 1e WFSLock
MSXFS.dll 14 WFSCleanUp
MSXFS.dll 1f WFSOpen
MSXFS.dll 22 WFSStartUp
=== Packer / Compiler ===
MS Visual C++ v8.0 2005
File pos Mem pos ID Text
======== ======= == ====
00000000004D 00000040004D 0 !This program cannot be run in DOS mode.
0000000000D7 0000004000D7 0 \Rich
0000000001F0 0000004001F0 0 .text
000000000218 000000400218 0 .rdata
00000000023F 00000040023F 0 @.data
000000000268 000000400268 0 .rsrc
00000000028F 00000040028F 0 @.reloc
00000000044D 00000040104D 0 t+hT>A
000000000564 000000401164 0 VhH?A
0000000005C1 0000004011C1 0 t$hT>A
000000000738 000000401338 0 1h(BA
000000000749 000000401349 0 hPBA
0000000007EC 0000004013EC 0 ShHCA
0000000007FD 0000004013FD 0 BhlCA
00000000094F 00000040154F 0 t-hT>A
000000000A6A 00000040166A 0 VhH?A
000000000AC7 0000004016C7 0 t$hT>A
000000000B51 000000401751 0 PQRVh DA
000000000B70 000000401770 0 PQRVh DA
000000000F21 000000401B21 0 Vh(EA
000000000F2C 000000401B2C 0 Vh(EA
000000000FDF 000000401BDF 0 t-hT>A
0000000010FA 000000401CFA 0 VhH?A
000000001157 000000401D57 0 t$hT>A
0000000011E1 000000401DE1 0 PQRVh DA
000000001200 000000401E00 0 PQRVh DA
0000000015DA 0000004021DA 0 Vh(EA
0000000015E5 0000004021E5 0 Vh(EA
000000001672 000000402272 0 0f;2u
0000000016B4 0000004022B4 0 0f;2u
000000001E87 000000402A87 0 PPPPP
00000000217A 000000402D7A 0 <at-<rt"<wt
0000000021EA 000000402DEA 0 tRHtC
00000000226E 000000402E6E 0 t;Ht+
00000000266F 00000040326F 0 URPQQh
000000002AC9 0000004036C9 0 t/HHt
000000002B0C 00000040370C 0 j*Xf;
000000002B6A 00000040376A 0 j*Xf;
000000002BC1 0000004037C1 0 htHjlZ;
000000002D04 000000403904 0 HHtXHHt
000000002F41 000000403B41 0 nt'joZ;
000000002FE1 000000403BE1 0 jgXf;
0000000030B8 000000403CB8 0 YYjgXf9
00000000326E 000000403E6E 0 >0t<NAj0X
00000000334F 000000403F4F 0 Wj0XP
00000000345B 00000040405B 0 Wj XP
000000003D0F 00000040490F 0 ~pjCXf
0000000041FC 000000404DFC 0 jdh(HA
000000004215 000000404E15 0 j@j _W
0000000042D5 000000404ED5 0 } j@W
0000000044B3 0000004050B3 0 QQSVWh
000000004599 000000405199 0 j"Xf9
000000004642 000000405242 0 j"Xf9
000000004648 000000405248 0 j\Xu;
000000004656 000000405256 0 j"_f9y
00000000469C 00000040529C 0 t"f;E
000000004768 000000405368 0 tAVSP
0000000047C4 0000004053C4 0 PPPPP
0000000049DE 0000004055DE 0 SSSSS
00000000561B 00000040621B 0 r)f;q
File pos Mem pos ID Text
======== ======= == ====
000000005695 000000406295 0 r2f;A
000000005853 000000406453 0 SVWUj
0000000058F4 0000004064F4 0 ;t$,v-
000000005979 000000406579 0 UQPXY]Y[
00000000670C 00000040730C 0 ~';_t|%3
000000006720 000000407320 0 wtVj
000000006735 000000407335 0 ;_tr.
000000006756 000000407356 0 GWVj
00000000681B 00000040741B 0 v N+D$
000000007D36 000000408936 0 tO9=D
000000008559 000000409159 0 5ntel
000000008569 000000409169 0 5Genu
000000008922 000000409522 0 tHHt*Ht#
000000008E44 000000409A44 0 uJSSR
000000008FFC 000000409BFC 0 SSSSS
000000009848 00000040A448 0 PP9E u
000000009C3E 00000040A83E 0 QVWSj
00000000A158 00000040AD58 0 jA[jZZ+
00000000AFAB 00000040BBAB 0 PWWWWV
00000000B046 00000040BC46 0 PSSSSV
00000000BEED 00000040CAED 0 +t"HHt
00000000BF43 00000040CB43 0 9] t"
00000000C4B8 00000040D0B8 0 ,SVWj0X
00000000C5EC 00000040D1EC 0 u'j0X
00000000C716 00000040D316 0 Wj0XPV
00000000C7B5 00000040D3B5 0 PjdSQ
00000000C91E 00000040D51E 0 -jd[;
00000000C973 00000040D573 0 WWWWW
00000000CEC6 00000040DAC6 0 VVVVV
00000000DB12 00000040E712 0 PPPPP
00000000DBC6 00000040E7C6 0 v N+D$
00000000E645 00000040F245 0 SSSSS
00000000EDB4 0000004101B4 0 UTF-8
00000000EDBC 0000004101BC 0 UTF-16LE
00000000EDC8 0000004101C8 0 UNICODE
00000000EE88 000000410288 0 CorExitProcess
00000000F918 000000410D18 0 FlsAlloc
00000000F924 000000410D24 0 FlsFree
00000000F92C 000000410D2C 0 FlsGetValue
00000000F938 000000410D38 0 FlsSetValue
00000000F944 000000410D44 0 InitializeCriticalSectionEx
00000000F960 000000410D60 0 CreateEventExW
00000000F970 000000410D70 0 CreateSemaphoreExW
00000000F984 000000410D84 0 SetThreadStackGuarantee
00000000F99C 000000410D9C 0 CreateThreadpoolTimer
00000000F9B4 000000410DB4 0 SetThreadpoolTimer
00000000F9C8 000000410DC8 0 WaitForThreadpoolTimerCallbacks
00000000F9E8 000000410DE8 0 CloseThreadpoolTimer
00000000FA00 000000410E00 0 CreateThreadpoolWait
00000000FA18 000000410E18 0 SetThreadpoolWait
00000000FA2C 000000410E2C 0 CloseThreadpoolWait
00000000FA40 000000410E40 0 FlushProcessWriteBuffers
00000000FA5C 000000410E5C 0 FreeLibraryWhenCallbackReturns
00000000FA7C 000000410E7C 0 GetCurrentProcessorNumber
00000000FA98 000000410E98 0 GetLogicalProcessorInformation
00000000FAB8 000000410EB8 0 CreateSymbolicLinkW
00000000FACC 000000410ECC 0 SetDefaultDllDirectories
00000000FAE8 000000410EE8 0 EnumSystemLocalesEx
00000000FAFC 000000410EFC 0 CompareStringEx
00000000FB0C 000000410F0C 0 GetDateFormatEx
File pos Mem pos ID Text
======== ======= == ====
00000000FB1C 000000410F1C 0 GetLocaleInfoEx
00000000FB2C 000000410F2C 0 GetTimeFormatEx
00000000FB3C 000000410F3C 0 GetUserDefaultLocaleName
00000000FB58 000000410F58 0 IsValidLocaleName
00000000FB6C 000000410F6C 0 LCMapStringEx
00000000FB7C 000000410F7C 0 GetCurrentPackageId
00000000FB90 000000410F90 0 GetTickCount64
00000000FBA0 000000410FA0 0 GetFileInformationByHandleExW
00000000FBC0 000000410FC0 0 SetFileInformationByHandleW
00000000FC38 000000411038 0 Sunday
00000000FC40 000000411040 0 Monday
00000000FC48 000000411048 0 Tuesday
00000000FC50 000000411050 0 Wednesday
00000000FC5C 00000041105C 0 Thursday
00000000FC68 000000411068 0 Friday
00000000FC70 000000411070 0 Saturday
00000000FCAC 0000004110AC 0 January
00000000FCB4 0000004110B4 0 February
00000000FCC0 0000004110C0 0 March
00000000FCC8 0000004110C8 0 April
00000000FCE0 0000004110E0 0 August
00000000FCE8 0000004110E8 0 September
00000000FCF4 0000004110F4 0 October
00000000FCFC 0000004110FC 0 November
00000000FD08 000000411108 0 December
00000000FD1C 00000041111C 0 MM/dd/yy
00000000FD28 000000411128 0 dddd, MMMM dd, yyyy
00000000FD3C 00000041113C 0 HH:mm:ss
00000000FF78 000000411378 0 (null)
00000000FFB1 0000004113B1 0 ( 8PX
00000000FFB9 0000004113B9 0 700WP
00000000FFD1 0000004113D1 0 xpxxxx
000000010004 000000411404 0 MessageBoxW
000000010010 000000411410 0 GetActiveWindow
000000010020 000000411420 0 GetLastActivePopup
000000010034 000000411434 0 GetUserObjectInformationW
000000010050 000000411450 0 GetProcessWindowStation
000000010068 000000411468 0 CreateFile2
00000001009D 00000041149D 0 ('8PW
0000000100A6 0000004114A6 0 700PP
0000000100C1 0000004114C1 0 xppwpp
000000010680 000000411A80 0 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]
0000000106C1 000000411AC1 0 abcdefghijklmnopqrstuvwxyz{|}~
000000010800 000000411C00 0 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]
000000010841 000000411C41 0 ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
000000012977 000000413D77 0 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]
0000000129B8 000000413DB8 0 abcdefghijklmnopqrstuvwxyz{|}~
0000000129F4 000000413DF4 0 e+000
0000000129FC 000000413DFC 0 1#SNAN
000000012A04 000000413E04 0 1#IND
000000012A0C 000000413E0C 0 1#INF
000000012A14 000000413E14 0 1#QNAN
000000012A20 000000413E20 0 atm_info.log
000000012A74 000000413E74 0 CurrencyDispenser1
000000012A88 000000413E88 0 DBD_AdvFuncDisp
000000012A98 000000413E98 0 CDM30
000000012FE8 0000004143E8 0 atm_test.log
000000013164 000000414564 0 atm_disp.log
000000013248 000000414648 0 M:\Work\atm\xfs_test\Release\xfs_test.pdb
0000000137D2 000000414BD2 0 Sleep
File pos Mem pos ID Text
======== ======= == ====
0000000137D8 000000414BD8 0 KERNEL32.dll
0000000137E8 000000414BE8 0 WFSStartUp
0000000137F6 000000414BF6 0 WFSOpen
000000013800 000000414C00 0 WFSCleanUp
00000001380E 000000414C0E 0 WFSLock
000000013818 000000414C18 0 WFSFreeResult
000000013828 000000414C28 0 WFSGetInfo
000000013836 000000414C36 0 WFSUnlock
000000013842 000000414C42 0 WFSClose
00000001384E 000000414C4E 0 WFSExecute
00000001385A 000000414C5A 0 MSXFS.dll
000000013866 000000414C66 0 GetCommandLineW
000000013878 000000414C78 0 IsDebuggerPresent
00000001388C 000000414C8C 0 IsProcessorFeaturePresent
0000000138A8 000000414CA8 0 EncodePointer
0000000138B8 000000414CB8 0 DecodePointer
0000000138C8 000000414CC8 0 EnterCriticalSection
0000000138E0 000000414CE0 0 LeaveCriticalSection
0000000138F8 000000414CF8 0 RtlUnwind
000000013904 000000414D04 0 CloseHandle
000000013912 000000414D12 0 GetLastError
000000013922 000000414D22 0 HeapFree
00000001392E 000000414D2E 0 SetLastError
00000001393E 000000414D3E 0 GetCurrentThreadId
000000013954 000000414D54 0 ExitProcess
000000013962 000000414D62 0 GetModuleHandleExW
000000013978 000000414D78 0 GetProcAddress
00000001398A 000000414D8A 0 AreFileApisANSI
00000001399C 000000414D9C 0 MultiByteToWideChar
0000000139B2 000000414DB2 0 WideCharToMultiByte
0000000139C8 000000414DC8 0 GetProcessHeap
0000000139DA 000000414DDA 0 GetStdHandle
0000000139EA 000000414DEA 0 GetFileType
0000000139F8 000000414DF8 0 DeleteCriticalSection
000000013A10 000000414E10 0 GetStartupInfoW
000000013A22 000000414E22 0 GetModuleFileNameW
000000013A38 000000414E38 0 WriteFile
000000013A44 000000414E44 0 QueryPerformanceCounter
000000013A5E 000000414E5E 0 GetCurrentProcessId
000000013A74 000000414E74 0 GetSystemTimeAsFileTime
000000013A8E 000000414E8E 0 GetEnvironmentStringsW
000000013AA8 000000414EA8 0 FreeEnvironmentStringsW
000000013AC2 000000414EC2 0 UnhandledExceptionFilter
000000013ADE 000000414EDE 0 SetUnhandledExceptionFilter
000000013AFC 000000414EFC 0 InitializeCriticalSectionAndSpinCount
000000013B24 000000414F24 0 GetCurrentProcess
000000013B38 000000414F38 0 TerminateProcess
000000013B4C 000000414F4C 0 TlsAlloc
000000013B58 000000414F58 0 TlsGetValue
000000013B66 000000414F66 0 TlsSetValue
000000013B74 000000414F74 0 TlsFree
000000013B7E 000000414F7E 0 GetModuleHandleW
000000013B92 000000414F92 0 IsValidCodePage
000000013BA4 000000414FA4 0 GetACP
000000013BAE 000000414FAE 0 GetOEMCP
000000013BBA 000000414FBA 0 GetCPInfo
000000013BC6 000000414FC6 0 SetStdHandle
000000013BD6 000000414FD6 0 FlushFileBuffers
000000013BEA 000000414FEA 0 GetConsoleCP
000000013BFA 000000414FFA 0 GetConsoleMode
File pos Mem pos ID Text
======== ======= == ====
000000013C0C 00000041500C 0 LoadLibraryExW
000000013C1E 00000041501E 0 OutputDebugStringW
000000013C34 000000415034 0 HeapAlloc
000000013C40 000000415040 0 HeapReAlloc
000000013C4E 00000041504E 0 CreateFileW
000000013C5C 00000041505C 0 GetStringTypeW
000000013C6E 00000041506E 0 SetFilePointerEx
000000013C82 000000415082 0 WriteConsoleW
000000013C92 000000415092 0 HeapSize
000000013C9E 00000041509E 0 LCMapStringW
000000013CAE 0000004150AE 0 SetEndOfFile
000000013CBE 0000004150BE 0 ReadFile
000000013CCA 0000004150CA 0 ReadConsoleW
0000000143E2 0000004165E2 0
0000000144C9 0000004166C9 0 abcdefghijklmnopqrstuvwxyz
0000000144E9 0000004166E9 0 ABCDEFGHIJKLMNOPQRSTUVWXYZ
000000014602 000000416802 0
0000000146E2 0000004168E2 0 abcdefghijklmnopqrstuvwxyz
000000014702 000000416902 0 ABCDEFGHIJKLMNOPQRSTUVWXYZ
000000014EE6 0000004170E6 0 z?aUY
000000014F28 000000417128 0 zc%C1
000000014F7B 00000041717B 0 -64OS
000000015060 00000041A060 0 <?xml version='1.0' encoding='UTF-8' standalone='yes'?>
000000015099 00000041A099 0 <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
0000000150E4 00000041A0E4 0 <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
00000001511C 00000041A11C 0 <security>
00000001512C 00000041A12C 0 <requestedPrivileges>
000000015149 00000041A149 0 <requestedExecutionLevel level='asInvoker' uiAccess='false' />
000000015191 00000041A191 0 </requestedPrivileges>
0000000151AF 00000041A1AF 0 </security>
0000000151C0 00000041A1C0 0 </trustInfo>
0000000151D0 00000041A1D0 0 </assembly>
00000001520B 00000041B00B 0 0"0-0G0P0{0
00000001521F 00000041B01F 0 1 1.1T1f1m1w1
00000001525B 00000041B05B 0 3"3)333:3D3K3U3\3f3
00000001528F 00000041B08F 0 4!4+424<4d4m4s4
0000000152CD 00000041B0CD 0 5$5/5I5R5
0000000152E1 00000041B0E1 0 6$626Z6l6s6}6
000000015301 00000041B101 0 7V7u7
000000015311 00000041B111 0 99:J:h:u:
000000015325 00000041B125 0 ;#;.;H;Q;W;
00000001533F 00000041B13F 0 <A<q<
000000015353 00000041B153 0 ='=8=Q=Z=k=t=~=
00000001536B 00000041B16B 0 >Z?f?
000000015387 00000041B187 0 191E1
0000000153A1 00000041B1A1 0 2O2f2
0000000153A9 00000041B1A9 0 2/3?3
0000000153AF 00000041B1AF 0 3H4c5
0000000153C9 00000041B1C9 0 7N7S7Z7
0000000153D9 00000041B1D9 0 8G8M8S8Y8_8e8l8s8z8
000000015411 00000041B211 0 :T:_:e:
000000015423 00000041B223 0 ;";);:;H;S;[;h;r;
00000001543D 00000041B23D 0 <0<9<[<f<
000000015459 00000041B259 0 ?;?Z?
00000001546D 00000041B26D 0 0!0Q0a0~0
000000015477 00000041B277 0 0k1s1
000000015487 00000041B287 0 3"424H4g4
000000015499 00000041B299 0 5C6X6
0000000154CD 00000041B2CD 0 2N2d2
0000000154D5 00000041B2D5 0 3A3K3j3
File pos Mem pos ID Text
======== ======= == ====
000000015505 00000041B305 0 9%9g9
000000015513 00000041B313 0 :):i:
000000015525 00000041B325 0 ; ;+;o;w;
000000015551 00000041B351 0 =3===C=N=q=v=
000000015569 00000041B369 0 =2>G>M>
000000015577 00000041B377 0 >%?@?
00000001559B 00000041B39B 0 0G1L1
0000000155A1 00000041B3A1 0 233?3
0000000155B3 00000041B3B3 0 4&464u4
0000000155D1 00000041B3D1 0 5/595g5z5
0000000155E7 00000041B3E7 0 6l6{6
0000000155FD 00000041B3FD 0 7b7q7{7
00000001561F 00000041B41F 0 8*838;8S8f8l8r8y8
000000015663 00000041B463 0 9%9-92989@9E9K9S9X9
000000015677 00000041B477 0 9f9k9q9y9~9
0000000156B3 00000041B4B3 0 :$:):/:7:<:B:J:O:U:]:b:h:p:u:{:
0000000156FB 00000041B4FB 0 ;&;/;T;w;
000000015709 00000041B509 0 ;"</<4<B<w<
000000015725 00000041B525 0 =*=[=s=
000000015737 00000041B537 0 > ><>]>
000000015750 00000041B550 0 V3[3m3
000000015761 00000041B561 0 4E5_5h5
00000001576F 00000041B56F 0 6@7s7'8m8
00000001577D 00000041B57D 0 979H9r9y9
000000015795 00000041B595 0 92:d:
00000001579F 00000041B59F 0 <><S<a<j<
0000000157AB 00000041B5AB 0 =E=_=g=r=
0000000157C3 00000041B5C3 0 >A>x>
0000000157E1 00000041B5E1 0 171h1
0000000157ED 00000041B5ED 0 3J4P4V4g4
0000000157FD 00000041B5FD 0 485J5
00000001580B 00000041B60B 0 6'6a6
000000015819 00000041B619 0 6G7[7
000000015827 00000041B627 0 7!8*838c8
000000015839 00000041B639 0 9S9m9
000000015845 00000041B645 0 ;H;Q;o;
000000015853 00000041B653 0 <<=E=">->@>T>
00000001586C 00000041B66C 0 +040 1j1s1
000000015879 00000041B679 0 1,2p2
00000001588B 00000041B68B 0 2-343<3
0000000158A1 00000041B6A1 0 4,444:4F4K4P4U4
0000000158D3 00000041B6D3 0 858F8L8X8h8n8}8
000000015903 00000041B703 0 9!9*909:9E9
000000015915 00000041B715 0 :;:I:
00000001591D 00000041B71D 0 <,<3<;<@<D<H<q<
00000001593F 00000041B73F 0 <"=(=,=0=4=
00000001595B 00000041B75B 0 >Q>X>\>
000000015963 00000041B763 0 >d>h>l>p>t>
000000015983 00000041B783 0 1&111
000000015993 00000041B793 0 2$2.2G2Q2
0000000159A7 00000041B7A7 0 2@3F3R3
0000000159B7 00000041B7B7 0 3<4A4G4N4
0000000159C1 00000041B7C1 0 4I6b7m7
0000000159D5 00000041B7D5 0 ;/;\;
0000000159EF 00000041B7EF 0 >$>6>H>Z>l>~>
000000015A13 00000041B813 0 2r3a4
000000015A23 00000041B823 0 7N8j8
000000015A2B 00000041B82B 0 9#:_:|:
000000015A33 00000041B833 0 :U;_;z;
000000015A41 00000041B841 0 <s<y<
File pos Mem pos ID Text
======== ======= == ====
000000015A77 00000041B877 0 1.1Q1e1
000000015A93 00000041B893 0 273~3
000000015AA1 00000041B8A1 0 4>4[4
000000015AE1 00000041B8E1 0 ="=&=+=1=5=;=?=E=I=N=T=X=
000000015AFB 00000041B8FB 0 =b=h=l=r=v=
000000015B09 00000041B909 0 = ?(?
000000015B19 00000041B919 0 0b1n1
000000015B37 00000041B937 0 6n7v7
000000015B41 00000041B941 0 848n8
000000015B47 00000041B947 0 8V<h<
000000015B9D 00000041B99D 0 070U0\0
000000015BA5 00000041B9A5 0 0d0h0l0p0t0x0
000000015BBB 00000041B9BB 0 0:1E1
000000015BC1 00000041B9C1 0 1g1l1p1t1
000000015BE1 00000041B9E1 0 2d2h2l2p2
000000015BEF 00000041B9EF 0 8D9]9l9
000000015C1C 00000041BA1C 0 4181<1@1D1P1T1X1
000000015C51 00000041BA51 0 3$3,343<3D3L3
000000015C7F 00000041BA7F 0 =$=,=4=<=D=L=T=\=d=l=t=|=
000000015CBF 00000041BABF 0 >$>,>4><>D>L>T>\>d>l>t>|>
000000015CFF 00000041BAFF 0 ?$?,?4?<?D?L?T?\?d?l?t?|?
000000015D47 00000041BB47 0 0$0,040<0D0L0T0\0d0l0t0|0
000000015D87 00000041BB87 0 1$1,141<1D1L1T1\1d1l1t1|1
000000015DC7 00000041BBC7 0 2$2,242<2D2L2T2\2d2l2t2|2
000000015E07 00000041BC07 0 3$3,343<3D3L3T3\3d3l3t3|3
000000015E47 00000041BC47 0 4 4(40484@4H4P4X4
000000015E59 00000041BC59 0 4h4p4x4
000000015E87 00000041BC87 0 5 5(50585@5H5P5X5
000000015E99 00000041BC99 0 5h5p5x5
000000015EC7 00000041BCC7 0 6 6(60686@6H6P6X6
000000015ED9 00000041BCD9 0 6h6p6x6
000000015F07 00000041BD07 0 7 7(70787@7H7P7X7
000000015F19 00000041BD19 0 7h7p7x7
000000015F47 00000041BD47 0 8 8(80888@8H8P8X8
000000015F59 00000041BD59 0 8h8p8x8
000000015F87 00000041BD87 0 9 9(90989@9H9P9X9
000000015F99 00000041BD99 0 9h9p9x9
000000015FC7 00000041BDC7 0 : :(:0:8:@:H:P:X:
000000015FD9 00000041BDD9 0 :h:p:x:
000000016025 00000041BE25 0 7(7D7H7h7
00000001603B 00000041BE3B 0 8 8@8
00000001604D 00000041BE4D 0 9 9@9L9h9
000000016061 00000041BE61 0 :(:H:d:h:
0000000160B5 00000041BEB5 0 ; ;$;(;,;0;4;8;<;@;D;H;L;P;\;
0000000160D3 00000041BED3 0 ;d;h;l;p;t;x;|;
000000016129 00000041BF29 0 <4<D<T<d<t<
00000001615B 00000041BF5B 0 = =$=(=,=0=4=8=<=H=L=P=T=X=\=
000000016179 00000041BF79 0 =d=l=p=
00000000EE70 000000410270 0 mscoree.dll
00000000F818 000000410C18 0 runtime error
00000000F858 000000410C58 0 Program:
00000000F86C 000000410C6C 0 <program name unknown>
00000000F8B0 000000410CB0 0 Microsoft Visual C++ Runtime Library
00000000F8FC 000000410CFC 0 kernel32.dll
00000000FBEB 000000410FEB 0 Aja-JP
00000000FBF8 000000410FF8 0 zh-CN
00000000FC04 000000411004 0 ko-KR
00000000FC10 000000411010 0 zh-TW
00000000FD80 000000411180 0 Sunday
00000000FD90 000000411190 0 Monday
File pos Mem pos ID Text
======== ======= == ====
00000000FDA0 0000004111A0 0 Tuesday
00000000FDB0 0000004111B0 0 Wednesday
00000000FDC4 0000004111C4 0 Thursday
00000000FDD8 0000004111D8 0 Friday
00000000FDE8 0000004111E8 0 Saturday
00000000FE5C 00000041125C 0 January
00000000FE6C 00000041126C 0 February
00000000FE80 000000411280 0 March
00000000FE8C 00000041128C 0 April
00000000FEB0 0000004112B0 0 August
00000000FEC0 0000004112C0 0 September
00000000FED4 0000004112D4 0 October
00000000FEE4 0000004112E4 0 November
00000000FEF8 0000004112F8 0 December
00000000FF1C 00000041131C 0 MM/dd/yy
00000000FF30 000000411330 0 dddd, MMMM dd, yyyy
00000000FF58 000000411358 0 HH:mm:ss
00000000FF6C 00000041136C 0 en-US
00000000FF80 000000411380 0 (null)
00000000FFEC 0000004113EC 0 USER32.DLL
000000011738 000000412B38 0 zh-CHS
00000001193C 000000412D3C 0 ar-SA
000000011948 000000412D48 0 bg-BG
000000011954 000000412D54 0 ca-ES
000000011960 000000412D60 0 cs-CZ
00000001196C 000000412D6C 0 da-DK
000000011978 000000412D78 0 de-DE
000000011984 000000412D84 0 el-GR
000000011990 000000412D90 0 fi-FI
00000001199C 000000412D9C 0 fr-FR
0000000119A8 000000412DA8 0 he-IL
0000000119B4 000000412DB4 0 hu-HU
0000000119C0 000000412DC0 0 is-IS
0000000119CC 000000412DCC 0 it-IT
0000000119D8 000000412DD8 0 nl-NL
0000000119E4 000000412DE4 0 nb-NO
0000000119F0 000000412DF0 0 pl-PL
0000000119FC 000000412DFC 0 pt-BR
000000011A08 000000412E08 0 ro-RO
000000011A14 000000412E14 0 ru-RU
000000011A20 000000412E20 0 hr-HR
000000011A2C 000000412E2C 0 sk-SK
000000011A38 000000412E38 0 sq-AL
000000011A44 000000412E44 0 sv-SE
000000011A50 000000412E50 0 th-TH
000000011A5C 000000412E5C 0 tr-TR
000000011A68 000000412E68 0 ur-PK
000000011A74 000000412E74 0 id-ID
000000011A80 000000412E80 0 uk-UA
000000011A8C 000000412E8C 0 be-BY
000000011A98 000000412E98 0 sl-SI
000000011AA4 000000412EA4 0 et-EE
000000011AB0 000000412EB0 0 lv-LV
000000011ABC 000000412EBC 0 lt-LT
000000011AC8 000000412EC8 0 fa-IR
000000011AD4 000000412ED4 0 vi-VN
000000011AE0 000000412EE0 0 hy-AM
000000011AEC 000000412EEC 0 az-AZ-Latn
000000011B04 000000412F04 0 eu-ES
000000011B10 000000412F10 0 mk-MK
File pos Mem pos ID Text
======== ======= == ====
000000011B1C 000000412F1C 0 tn-ZA
000000011B28 000000412F28 0 xh-ZA
000000011B34 000000412F34 0 zu-ZA
000000011B40 000000412F40 0 af-ZA
000000011B4C 000000412F4C 0 ka-GE
000000011B58 000000412F58 0 fo-FO
000000011B64 000000412F64 0 hi-IN
000000011B70 000000412F70 0 mt-MT
000000011B7C 000000412F7C 0 se-NO
000000011B88 000000412F88 0 ms-MY
000000011B94 000000412F94 0 kk-KZ
000000011BA0 000000412FA0 0 ky-KG
000000011BAC 000000412FAC 0 sw-KE
000000011BB8 000000412FB8 0 uz-UZ-Latn
000000011BD0 000000412FD0 0 tt-RU
000000011BDC 000000412FDC 0 bn-IN
000000011BE8 000000412FE8 0 pa-IN
000000011BF4 000000412FF4 0 gu-IN
000000011C00 000000413000 0 ta-IN
000000011C0C 00000041300C 0 te-IN
000000011C18 000000413018 0 kn-IN
000000011C24 000000413024 0 ml-IN
000000011C30 000000413030 0 mr-IN
000000011C3C 00000041303C 0 sa-IN
000000011C48 000000413048 0 mn-MN
000000011C54 000000413054 0 cy-GB
000000011C60 000000413060 0 gl-ES
000000011C6C 00000041306C 0 kok-IN
000000011C7C 00000041307C 0 syr-SY
000000011C8C 00000041308C 0 div-MV
000000011C9C 00000041309C 0 quz-BO
000000011CAC 0000004130AC 0 ns-ZA
000000011CB8 0000004130B8 0 mi-NZ
000000011CC4 0000004130C4 0 ar-IQ
000000011CD0 0000004130D0 0 de-CH
000000011CDC 0000004130DC 0 en-GB
000000011CE8 0000004130E8 0 es-MX
000000011CF4 0000004130F4 0 fr-BE
000000011D00 000000413100 0 it-CH
000000011D0C 00000041310C 0 nl-BE
000000011D18 000000413118 0 nn-NO
000000011D24 000000413124 0 pt-PT
000000011D30 000000413130 0 sr-SP-Latn
000000011D48 000000413148 0 sv-FI
000000011D54 000000413154 0 az-AZ-Cyrl
000000011D6C 00000041316C 0 se-SE
000000011D78 000000413178 0 ms-BN
000000011D84 000000413184 0 uz-UZ-Cyrl
000000011D9C 00000041319C 0 quz-EC
000000011DAC 0000004131AC 0 ar-EG
000000011DB8 0000004131B8 0 zh-HK
000000011DC4 0000004131C4 0 de-AT
000000011DD0 0000004131D0 0 en-AU
000000011DDC 0000004131DC 0 es-ES
000000011DE8 0000004131E8 0 fr-CA
000000011DF4 0000004131F4 0 sr-SP-Cyrl
000000011E0C 00000041320C 0 se-FI
000000011E18 000000413218 0 quz-PE
000000011E28 000000413228 0 ar-LY
000000011E34 000000413234 0 zh-SG
File pos Mem pos ID Text
======== ======= == ====
000000011E40 000000413240 0 de-LU
000000011E4C 00000041324C 0 en-CA
000000011E58 000000413258 0 es-GT
000000011E64 000000413264 0 fr-CH
000000011E70 000000413270 0 hr-BA
000000011E7C 00000041327C 0 smj-NO
000000011E8C 00000041328C 0 ar-DZ
000000011E98 000000413298 0 zh-MO
000000011EA4 0000004132A4 0 de-LI
000000011EB0 0000004132B0 0 en-NZ
000000011EBC 0000004132BC 0 es-CR
000000011EC8 0000004132C8 0 fr-LU
000000011ED4 0000004132D4 0 bs-BA-Latn
000000011EEC 0000004132EC 0 smj-SE
000000011EFC 0000004132FC 0 ar-MA
000000011F08 000000413308 0 en-IE
000000011F14 000000413314 0 es-PA
000000011F20 000000413320 0 fr-MC
000000011F2C 00000041332C 0 sr-BA-Latn
000000011F44 000000413344 0 sma-NO
000000011F54 000000413354 0 ar-TN
000000011F60 000000413360 0 en-ZA
000000011F6C 00000041336C 0 es-DO
000000011F78 000000413378 0 sr-BA-Cyrl
000000011F90 000000413390 0 sma-SE
000000011FA0 0000004133A0 0 ar-OM
000000011FAC 0000004133AC 0 en-JM
000000011FB8 0000004133B8 0 es-VE
000000011FC4 0000004133C4 0 sms-FI
000000011FD4 0000004133D4 0 ar-YE
000000011FE0 0000004133E0 0 en-CB
000000011FEC 0000004133EC 0 es-CO
000000011FF8 0000004133F8 0 smn-FI
000000012008 000000413408 0 ar-SY
000000012014 000000413414 0 en-BZ
000000012020 000000413420 0 es-PE
00000001202C 00000041342C 0 ar-JO
000000012038 000000413438 0 en-TT
000000012044 000000413444 0 es-AR
000000012050 000000413450 0 ar-LB
00000001205C 00000041345C 0 en-ZW
000000012068 000000413468 0 es-EC
000000012074 000000413474 0 ar-KW
000000012080 000000413480 0 en-PH
00000001208C 00000041348C 0 es-CL
000000012098 000000413498 0 ar-AE
0000000120A4 0000004134A4 0 es-UY
0000000120B0 0000004134B0 0 ar-BH
0000000120BC 0000004134BC 0 es-PY
0000000120C8 0000004134C8 0 ar-QA
0000000120D4 0000004134D4 0 es-BO
0000000120E0 0000004134E0 0 es-SV
0000000120EC 0000004134EC 0 es-HN
0000000120F8 0000004134F8 0 es-NI
000000012104 000000413504 0 es-PR
000000012110 000000413510 0 zh-CHT
000000012128 000000413528 0 af-za
000000012134 000000413534 0 ar-ae
000000012140 000000413540 0 ar-bh
00000001214C 00000041354C 0 ar-dz
File pos Mem pos ID Text
======== ======= == ====
000000012158 000000413558 0 ar-eg
000000012164 000000413564 0 ar-iq
000000012170 000000413570 0 ar-jo
00000001217C 00000041357C 0 ar-kw
000000012188 000000413588 0 ar-lb
000000012194 000000413594 0 ar-ly
0000000121A0 0000004135A0 0 ar-ma
0000000121AC 0000004135AC 0 ar-om
0000000121B8 0000004135B8 0 ar-qa
0000000121C4 0000004135C4 0 ar-sa
0000000121D0 0000004135D0 0 ar-sy
0000000121DC 0000004135DC 0 ar-tn
0000000121E8 0000004135E8 0 ar-ye
0000000121F4 0000004135F4 0 az-az-cyrl
00000001220C 00000041360C 0 az-az-latn
000000012224 000000413624 0 be-by
000000012230 000000413630 0 bg-bg
00000001223C 00000041363C 0 bn-in
000000012248 000000413648 0 bs-ba-latn
000000012260 000000413660 0 ca-es
00000001226C 00000041366C 0 cs-cz
000000012278 000000413678 0 cy-gb
000000012284 000000413684 0 da-dk
000000012290 000000413690 0 de-at
00000001229C 00000041369C 0 de-ch
0000000122A8 0000004136A8 0 de-de
0000000122B4 0000004136B4 0 de-li
0000000122C0 0000004136C0 0 de-lu
0000000122CC 0000004136CC 0 div-mv
0000000122DC 0000004136DC 0 el-gr
0000000122E8 0000004136E8 0 en-au
0000000122F4 0000004136F4 0 en-bz
000000012300 000000413700 0 en-ca
00000001230C 00000041370C 0 en-cb
000000012318 000000413718 0 en-gb
000000012324 000000413724 0 en-ie
000000012330 000000413730 0 en-jm
00000001233C 00000041373C 0 en-nz
000000012348 000000413748 0 en-ph
000000012354 000000413754 0 en-tt
000000012360 000000413760 0 en-us
00000001236C 00000041376C 0 en-za
000000012378 000000413778 0 en-zw
000000012384 000000413784 0 es-ar
000000012390 000000413790 0 es-bo
00000001239C 00000041379C 0 es-cl
0000000123A8 0000004137A8 0 es-co
0000000123B4 0000004137B4 0 es-cr
0000000123C0 0000004137C0 0 es-do
0000000123CC 0000004137CC 0 es-ec
0000000123D8 0000004137D8 0 es-es
0000000123E4 0000004137E4 0 es-gt
0000000123F0 0000004137F0 0 es-hn
0000000123FC 0000004137FC 0 es-mx
000000012408 000000413808 0 es-ni
000000012414 000000413814 0 es-pa
000000012420 000000413820 0 es-pe
00000001242C 00000041382C 0 es-pr
000000012438 000000413838 0 es-py
000000012444 000000413844 0 es-sv
File pos Mem pos ID Text
======== ======= == ====
000000012450 000000413850 0 es-uy
00000001245C 00000041385C 0 es-ve
000000012468 000000413868 0 et-ee
000000012474 000000413874 0 eu-es
000000012480 000000413880 0 fa-ir
00000001248C 00000041388C 0 fi-fi
000000012498 000000413898 0 fo-fo
0000000124A4 0000004138A4 0 fr-be
0000000124B0 0000004138B0 0 fr-ca
0000000124BC 0000004138BC 0 fr-ch
0000000124C8 0000004138C8 0 fr-fr
0000000124D4 0000004138D4 0 fr-lu
0000000124E0 0000004138E0 0 fr-mc
0000000124EC 0000004138EC 0 gl-es
0000000124F8 0000004138F8 0 gu-in
000000012504 000000413904 0 he-il
000000012510 000000413910 0 hi-in
00000001251C 00000041391C 0 hr-ba
000000012528 000000413928 0 hr-hr
000000012534 000000413934 0 hu-hu
000000012540 000000413940 0 hy-am
00000001254C 00000041394C 0 id-id
000000012558 000000413958 0 is-is
000000012564 000000413964 0 it-ch
000000012570 000000413970 0 it-it
00000001257C 00000041397C 0 ja-jp
000000012588 000000413988 0 ka-ge
000000012594 000000413994 0 kk-kz
0000000125A0 0000004139A0 0 kn-in
0000000125AC 0000004139AC 0 kok-in
0000000125BC 0000004139BC 0 ko-kr
0000000125C8 0000004139C8 0 ky-kg
0000000125D4 0000004139D4 0 lt-lt
0000000125E0 0000004139E0 0 lv-lv
0000000125EC 0000004139EC 0 mi-nz
0000000125F8 0000004139F8 0 mk-mk
000000012604 000000413A04 0 ml-in
000000012610 000000413A10 0 mn-mn
00000001261C 000000413A1C 0 mr-in
000000012628 000000413A28 0 ms-bn
000000012634 000000413A34 0 ms-my
000000012640 000000413A40 0 mt-mt
00000001264C 000000413A4C 0 nb-no
000000012658 000000413A58 0 nl-be
000000012664 000000413A64 0 nl-nl
000000012670 000000413A70 0 nn-no
00000001267C 000000413A7C 0 ns-za
000000012688 000000413A88 0 pa-in
000000012694 000000413A94 0 pl-pl
0000000126A0 000000413AA0 0 pt-br
0000000126AC 000000413AAC 0 pt-pt
0000000126B8 000000413AB8 0 quz-bo
0000000126C8 000000413AC8 0 quz-ec
0000000126D8 000000413AD8 0 quz-pe
0000000126E8 000000413AE8 0 ro-ro
0000000126F4 000000413AF4 0 ru-ru
000000012700 000000413B00 0 sa-in
00000001270C 000000413B0C 0 se-fi
000000012718 000000413B18 0 se-no
000000012724 000000413B24 0 se-se
File pos Mem pos ID Text
======== ======= == ====
000000012730 000000413B30 0 sk-sk
00000001273C 000000413B3C 0 sl-si
000000012748 000000413B48 0 sma-no
000000012758 000000413B58 0 sma-se
000000012768 000000413B68 0 smj-no
000000012778 000000413B78 0 smj-se
000000012788 000000413B88 0 smn-fi
000000012798 000000413B98 0 sms-fi
0000000127A8 000000413BA8 0 sq-al
0000000127B4 000000413BB4 0 sr-ba-cyrl
0000000127CC 000000413BCC 0 sr-ba-latn
0000000127E4 000000413BE4 0 sr-sp-cyrl
0000000127FC 000000413BFC 0 sr-sp-latn
000000012814 000000413C14 0 sv-fi
000000012820 000000413C20 0 sv-se
00000001282C 000000413C2C 0 sw-ke
000000012838 000000413C38 0 syr-sy
000000012848 000000413C48 0 ta-in
000000012854 000000413C54 0 te-in
000000012860 000000413C60 0 th-th
00000001286C 000000413C6C 0 tn-za
000000012878 000000413C78 0 tr-tr
000000012884 000000413C84 0 tt-ru
000000012890 000000413C90 0 uk-ua
00000001289C 000000413C9C 0 ur-pk
0000000128A8 000000413CA8 0 uz-uz-cyrl
0000000128C0 000000413CC0 0 uz-uz-latn
0000000128D8 000000413CD8 0 vi-vn
0000000128E4 000000413CE4 0 xh-za
0000000128F0 000000413CF0 0 zh-chs
000000012900 000000413D00 0 zh-cht
000000012910 000000413D10 0 zh-cn
00000001291C 000000413D1C 0 zh-hk
000000012928 000000413D28 0 zh-mo
000000012934 000000413D34 0 zh-sg
000000012940 000000413D40 0 zh-tw
00000001294C 000000413D4C 0 zu-za
0000000129D8 000000413DD8 0 CONOUT$
000000012A30 000000413E30 0 [+] WFSStartUp...
000000012B28 000000413F28 0 [+] WFSOpen...
000000012B68 000000413F68 0 [+] WFSGetInfo...
000000012FF8 0000004143F8 0 [+] WFSExecute...
00000000004D 00000040004D 0 !This program cannot be run in DOS mode.
0000000000D7 0000004000D7 0 \Rich
0000000001F0 0000004001F0 0 .text
000000000218 000000400218 0 .rdata
00000000023F 00000040023F 0 @.data
000000000268 000000400268 0 .rsrc
00000000028F 00000040028F 0 @.reloc
00000000044D 00000040104D 0 t+hT>A
000000000564 000000401164 0 VhH?A
0000000005C1 0000004011C1 0 t$hT>A
000000000738 000000401338 0 1h(BA
000000000749 000000401349 0 hPBA
0000000007EC 0000004013EC 0 ShHCA
0000000007FD 0000004013FD 0 BhlCA
00000000094F 00000040154F 0 t-hT>A
000000000A6A 00000040166A 0 VhH?A
000000000AC7 0000004016C7 0 t$hT>A
000000000B51 000000401751 0 PQRVh DA
File pos Mem pos ID Text
======== ======= == ====
000000000B70 000000401770 0 PQRVh DA
000000000F21 000000401B21 0 Vh(EA
000000000F2C 000000401B2C 0 Vh(EA
000000000FDF 000000401BDF 0 t-hT>A
0000000010FA 000000401CFA 0 VhH?A
000000001157 000000401D57 0 t$hT>A
0000000011E1 000000401DE1 0 PQRVh DA
000000001200 000000401E00 0 PQRVh DA
0000000015DA 0000004021DA 0 Vh(EA
0000000015E5 0000004021E5 0 Vh(EA
000000001672 000000402272 0 0f;2u
0000000016B4 0000004022B4 0 0f;2u
000000001E87 000000402A87 0 PPPPP
00000000217A 000000402D7A 0 <at-<rt"<wt
0000000021EA 000000402DEA 0 tRHtC
00000000226E 000000402E6E 0 t;Ht+
00000000266F 00000040326F 0 URPQQh
000000002AC9 0000004036C9 0 t/HHt
000000002B0C 00000040370C 0 j*Xf;
000000002B6A 00000040376A 0 j*Xf;
000000002BC1 0000004037C1 0 htHjlZ;
000000002D04 000000403904 0 HHtXHHt
000000002F41 000000403B41 0 nt'joZ;
000000002FE1 000000403BE1 0 jgXf;
0000000030B8 000000403CB8 0 YYjgXf9
00000000326E 000000403E6E 0 >0t<NAj0X
00000000334F 000000403F4F 0 Wj0XP
00000000345B 00000040405B 0 Wj XP
000000003D0F 00000040490F 0 ~pjCXf
0000000041FC 000000404DFC 0 jdh(HA
000000004215 000000404E15 0 j@j _W
0000000042D5 000000404ED5 0 } j@W
0000000044B3 0000004050B3 0 QQSVWh
000000004599 000000405199 0 j"Xf9
000000004642 000000405242 0 j"Xf9
000000004648 000000405248 0 j\Xu;
000000004656 000000405256 0 j"_f9y
00000000469C 00000040529C 0 t"f;E
000000004768 000000405368 0 tAVSP
0000000047C4 0000004053C4 0 PPPPP
0000000049DE 0000004055DE 0 SSSSS
00000000561B 00000040621B 0 r)f;q
000000005695 000000406295 0 r2f;A
000000005853 000000406453 0 SVWUj
0000000058F4 0000004064F4 0 ;t$,v-
000000005979 000000406579 0 UQPXY]Y[
00000000670C 00000040730C 0 ~';_t|%3
000000006720 000000407320 0 wtVj
000000006735 000000407335 0 ;_tr.
000000006756 000000407356 0 GWVj
00000000681B 00000040741B 0 v N+D$
000000007D36 000000408936 0 tO9=D
000000008559 000000409159 0 5ntel
000000008569 000000409169 0 5Genu
000000008922 000000409522 0 tHHt*Ht#
000000008E44 000000409A44 0 uJSSR
000000008FFC 000000409BFC 0 SSSSS
000000009848 00000040A448 0 PP9E u
000000009C3E 00000040A83E 0 QVWSj
00000000A158 00000040AD58 0 jA[jZZ+
File pos Mem pos ID Text
======== ======= == ====
00000000AFAB 00000040BBAB 0 PWWWWV
00000000B046 00000040BC46 0 PSSSSV
00000000BEED 00000040CAED 0 +t"HHt
00000000BF43 00000040CB43 0 9] t"
00000000C4B8 00000040D0B8 0 ,SVWj0X
00000000C5EC 00000040D1EC 0 u'j0X
00000000C716 00000040D316 0 Wj0XPV
00000000C7B5 00000040D3B5 0 PjdSQ
00000000C91E 00000040D51E 0 -jd[;
00000000C973 00000040D573 0 WWWWW
00000000CEC6 00000040DAC6 0 VVVVV
00000000DB12 00000040E712 0 PPPPP
00000000DBC6 00000040E7C6 0 v N+D$
00000000E645 00000040F245 0 SSSSS
00000000EDB4 0000004101B4 0 UTF-8
00000000EDBC 0000004101BC 0 UTF-16LE
00000000EDC8 0000004101C8 0 UNICODE
00000000EE88 000000410288 0 CorExitProcess
00000000F918 000000410D18 0 FlsAlloc
00000000F924 000000410D24 0 FlsFree
00000000F92C 000000410D2C 0 FlsGetValue
00000000F938 000000410D38 0 FlsSetValue
00000000F944 000000410D44 0 InitializeCriticalSectionEx
00000000F960 000000410D60 0 CreateEventExW
00000000F970 000000410D70 0 CreateSemaphoreExW
00000000F984 000000410D84 0 SetThreadStackGuarantee
00000000F99C 000000410D9C 0 CreateThreadpoolTimer
00000000F9B4 000000410DB4 0 SetThreadpoolTimer
00000000F9C8 000000410DC8 0 WaitForThreadpoolTimerCallbacks
00000000F9E8 000000410DE8 0 CloseThreadpoolTimer
00000000FA00 000000410E00 0 CreateThreadpoolWait
00000000FA18 000000410E18 0 SetThreadpoolWait
00000000FA2C 000000410E2C 0 CloseThreadpoolWait
00000000FA40 000000410E40 0 FlushProcessWriteBuffers
00000000FA5C 000000410E5C 0 FreeLibraryWhenCallbackReturns
00000000FA7C 000000410E7C 0 GetCurrentProcessorNumber
00000000FA98 000000410E98 0 GetLogicalProcessorInformation
00000000FAB8 000000410EB8 0 CreateSymbolicLinkW
00000000FACC 000000410ECC 0 SetDefaultDllDirectories
00000000FAE8 000000410EE8 0 EnumSystemLocalesEx
00000000FAFC 000000410EFC 0 CompareStringEx
00000000FB0C 000000410F0C 0 GetDateFormatEx
00000000FB1C 000000410F1C 0 GetLocaleInfoEx
00000000FB2C 000000410F2C 0 GetTimeFormatEx
00000000FB3C 000000410F3C 0 GetUserDefaultLocaleName
00000000FB58 000000410F58 0 IsValidLocaleName
00000000FB6C 000000410F6C 0 LCMapStringEx
00000000FB7C 000000410F7C 0 GetCurrentPackageId
00000000FB90 000000410F90 0 GetTickCount64
00000000FBA0 000000410FA0 0 GetFileInformationByHandleExW
00000000FBC0 000000410FC0 0 SetFileInformationByHandleW
00000000FC38 000000411038 0 Sunday
00000000FC40 000000411040 0 Monday
00000000FC48 000000411048 0 Tuesday
00000000FC50 000000411050 0 Wednesday
00000000FC5C 00000041105C 0 Thursday
00000000FC68 000000411068 0 Friday
00000000FC70 000000411070 0 Saturday
00000000FCAC 0000004110AC 0 January
00000000FCB4 0000004110B4 0 February
File pos Mem pos ID Text
======== ======= == ====
00000000FCC0 0000004110C0 0 March
00000000FCC8 0000004110C8 0 April
00000000FCE0 0000004110E0 0 August
00000000FCE8 0000004110E8 0 September
00000000FCF4 0000004110F4 0 October
00000000FCFC 0000004110FC 0 November
00000000FD08 000000411108 0 December
00000000FD1C 00000041111C 0 MM/dd/yy
00000000FD28 000000411128 0 dddd, MMMM dd, yyyy
00000000FD3C 00000041113C 0 HH:mm:ss
00000000FF78 000000411378 0 (null)
00000000FFB1 0000004113B1 0 ( 8PX
00000000FFB9 0000004113B9 0 700WP
00000000FFD1 0000004113D1 0 xpxxxx
000000010004 000000411404 0 MessageBoxW
000000010010 000000411410 0 GetActiveWindow
000000010020 000000411420 0 GetLastActivePopup
000000010034 000000411434 0 GetUserObjectInformationW
000000010050 000000411450 0 GetProcessWindowStation
000000010068 000000411468 0 CreateFile2
00000001009D 00000041149D 0 ('8PW
0000000100A6 0000004114A6 0 700PP
0000000100C1 0000004114C1 0 xppwpp
000000010680 000000411A80 0 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]
0000000106C1 000000411AC1 0 abcdefghijklmnopqrstuvwxyz{|}~
000000010800 000000411C00 0 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]
000000010841 000000411C41 0 ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
000000012977 000000413D77 0 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]
0000000129B8 000000413DB8 0 abcdefghijklmnopqrstuvwxyz{|}~
0000000129F4 000000413DF4 0 e+000
0000000129FC 000000413DFC 0 1#SNAN
000000012A04 000000413E04 0 1#IND
000000012A0C 000000413E0C 0 1#INF
000000012A14 000000413E14 0 1#QNAN
000000012A20 000000413E20 0 atm_info.log
000000012A74 000000413E74 0 CurrencyDispenser1
000000012A88 000000413E88 0 DBD_AdvFuncDisp
000000012A98 000000413E98 0 CDM30
000000012FE8 0000004143E8 0 atm_test.log
000000013164 000000414564 0 atm_disp.log
000000013248 000000414648 0 M:\Work\atm\xfs_test\Release\xfs_test.pdb
0000000137D2 000000414BD2 0 Sleep
0000000137D8 000000414BD8 0 KERNEL32.dll
0000000137E8 000000414BE8 0 WFSStartUp
0000000137F6 000000414BF6 0 WFSOpen
000000013800 000000414C00 0 WFSCleanUp
00000001380E 000000414C0E 0 WFSLock
000000013818 000000414C18 0 WFSFreeResult
000000013828 000000414C28 0 WFSGetInfo
000000013836 000000414C36 0 WFSUnlock
000000013842 000000414C42 0 WFSClose
00000001384E 000000414C4E 0 WFSExecute
00000001385A 000000414C5A 0 MSXFS.dll
000000013866 000000414C66 0 GetCommandLineW
000000013878 000000414C78 0 IsDebuggerPresent
00000001388C 000000414C8C 0 IsProcessorFeaturePresent
0000000138A8 000000414CA8 0 EncodePointer
0000000138B8 000000414CB8 0 DecodePointer
0000000138C8 000000414CC8 0 EnterCriticalSection
0000000138E0 000000414CE0 0 LeaveCriticalSection
File pos Mem pos ID Text
======== ======= == ====
0000000138F8 000000414CF8 0 RtlUnwind
000000013904 000000414D04 0 CloseHandle
000000013912 000000414D12 0 GetLastError
000000013922 000000414D22 0 HeapFree
00000001392E 000000414D2E 0 SetLastError
00000001393E 000000414D3E 0 GetCurrentThreadId
000000013954 000000414D54 0 ExitProcess
000000013962 000000414D62 0 GetModuleHandleExW
000000013978 000000414D78 0 GetProcAddress
00000001398A 000000414D8A 0 AreFileApisANSI
00000001399C 000000414D9C 0 MultiByteToWideChar
0000000139B2 000000414DB2 0 WideCharToMultiByte
0000000139C8 000000414DC8 0 GetProcessHeap
0000000139DA 000000414DDA 0 GetStdHandle
0000000139EA 000000414DEA 0 GetFileType
0000000139F8 000000414DF8 0 DeleteCriticalSection
000000013A10 000000414E10 0 GetStartupInfoW
000000013A22 000000414E22 0 GetModuleFileNameW
000000013A38 000000414E38 0 WriteFile
000000013A44 000000414E44 0 QueryPerformanceCounter
000000013A5E 000000414E5E 0 GetCurrentProcessId
000000013A74 000000414E74 0 GetSystemTimeAsFileTime
000000013A8E 000000414E8E 0 GetEnvironmentStringsW
000000013AA8 000000414EA8 0 FreeEnvironmentStringsW
000000013AC2 000000414EC2 0 UnhandledExceptionFilter
000000013ADE 000000414EDE 0 SetUnhandledExceptionFilter
000000013AFC 000000414EFC 0 InitializeCriticalSectionAndSpinCount
000000013B24 000000414F24 0 GetCurrentProcess
000000013B38 000000414F38 0 TerminateProcess
000000013B4C 000000414F4C 0 TlsAlloc
000000013B58 000000414F58 0 TlsGetValue
000000013B66 000000414F66 0 TlsSetValue
000000013B74 000000414F74 0 TlsFree
000000013B7E 000000414F7E 0 GetModuleHandleW
000000013B92 000000414F92 0 IsValidCodePage
000000013BA4 000000414FA4 0 GetACP
000000013BAE 000000414FAE 0 GetOEMCP
000000013BBA 000000414FBA 0 GetCPInfo
000000013BC6 000000414FC6 0 SetStdHandle
000000013BD6 000000414FD6 0 FlushFileBuffers
000000013BEA 000000414FEA 0 GetConsoleCP
000000013BFA 000000414FFA 0 GetConsoleMode
000000013C0C 00000041500C 0 LoadLibraryExW
000000013C1E 00000041501E 0 OutputDebugStringW
000000013C34 000000415034 0 HeapAlloc
000000013C40 000000415040 0 HeapReAlloc
000000013C4E 00000041504E 0 CreateFileW
000000013C5C 00000041505C 0 GetStringTypeW
000000013C6E 00000041506E 0 SetFilePointerEx
000000013C82 000000415082 0 WriteConsoleW
000000013C92 000000415092 0 HeapSize
000000013C9E 00000041509E 0 LCMapStringW
000000013CAE 0000004150AE 0 SetEndOfFile
000000013CBE 0000004150BE 0 ReadFile
000000013CCA 0000004150CA 0 ReadConsoleW
0000000143E2 0000004165E2 0
0000000144C9 0000004166C9 0 abcdefghijklmnopqrstuvwxyz
0000000144E9 0000004166E9 0 ABCDEFGHIJKLMNOPQRSTUVWXYZ
000000014602 000000416802 0
0000000146E2 0000004168E2 0 abcdefghijklmnopqrstuvwxyz
File pos Mem pos ID Text
======== ======= == ====
000000014702 000000416902 0 ABCDEFGHIJKLMNOPQRSTUVWXYZ
000000014EE6 0000004170E6 0 z?aUY
000000014F28 000000417128 0 zc%C1
000000014F7B 00000041717B 0 -64OS
000000015060 00000041A060 0 <?xml version='1.0' encoding='UTF-8' standalone='yes'?>
000000015099 00000041A099 0 <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
0000000150E4 00000041A0E4 0 <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
00000001511C 00000041A11C 0 <security>
00000001512C 00000041A12C 0 <requestedPrivileges>
000000015149 00000041A149 0 <requestedExecutionLevel level='asInvoker' uiAccess='false' />
000000015191 00000041A191 0 </requestedPrivileges>
0000000151AF 00000041A1AF 0 </security>
0000000151C0 00000041A1C0 0 </trustInfo>
0000000151D0 00000041A1D0 0 </assembly>
00000001520B 00000041B00B 0 0"0-0G0P0{0
00000001521F 00000041B01F 0 1 1.1T1f1m1w1
00000001525B 00000041B05B 0 3"3)333:3D3K3U3\3f3
00000001528F 00000041B08F 0 4!4+424<4d4m4s4
0000000152CD 00000041B0CD 0 5$5/5I5R5
0000000152E1 00000041B0E1 0 6$626Z6l6s6}6
000000015301 00000041B101 0 7V7u7
000000015311 00000041B111 0 99:J:h:u:
000000015325 00000041B125 0 ;#;.;H;Q;W;
00000001533F 00000041B13F 0 <A<q<
000000015353 00000041B153 0 ='=8=Q=Z=k=t=~=
00000001536B 00000041B16B 0 >Z?f?
000000015387 00000041B187 0 191E1
0000000153A1 00000041B1A1 0 2O2f2
0000000153A9 00000041B1A9 0 2/3?3
0000000153AF 00000041B1AF 0 3H4c5
0000000153C9 00000041B1C9 0 7N7S7Z7
0000000153D9 00000041B1D9 0 8G8M8S8Y8_8e8l8s8z8
000000015411 00000041B211 0 :T:_:e:
000000015423 00000041B223 0 ;";);:;H;S;[;h;r;
00000001543D 00000041B23D 0 <0<9<[<f<
000000015459 00000041B259 0 ?;?Z?
00000001546D 00000041B26D 0 0!0Q0a0~0
000000015477 00000041B277 0 0k1s1
000000015487 00000041B287 0 3"424H4g4
000000015499 00000041B299 0 5C6X6
0000000154CD 00000041B2CD 0 2N2d2
0000000154D5 00000041B2D5 0 3A3K3j3
000000015505 00000041B305 0 9%9g9
000000015513 00000041B313 0 :):i:
000000015525 00000041B325 0 ; ;+;o;w;
000000015551 00000041B351 0 =3===C=N=q=v=
000000015569 00000041B369 0 =2>G>M>
000000015577 00000041B377 0 >%?@?
00000001559B 00000041B39B 0 0G1L1
0000000155A1 00000041B3A1 0 233?3
0000000155B3 00000041B3B3 0 4&464u4
0000000155D1 00000041B3D1 0 5/595g5z5
0000000155E7 00000041B3E7 0 6l6{6
0000000155FD 00000041B3FD 0 7b7q7{7
00000001561F 00000041B41F 0 8*838;8S8f8l8r8y8
000000015663 00000041B463 0 9%9-92989@9E9K9S9X9
000000015677 00000041B477 0 9f9k9q9y9~9
0000000156B3 00000041B4B3 0 :$:):/:7:<:B:J:O:U:]:b:h:p:u:{:
0000000156FB 00000041B4FB 0 ;&;/;T;w;
000000015709 00000041B509 0 ;"</<4<B<w<
File pos Mem pos ID Text
======== ======= == ====
000000015725 00000041B525 0 =*=[=s=
000000015737 00000041B537 0 > ><>]>
000000015750 00000041B550 0 V3[3m3
000000015761 00000041B561 0 4E5_5h5
00000001576F 00000041B56F 0 6@7s7'8m8
00000001577D 00000041B57D 0 979H9r9y9
000000015795 00000041B595 0 92:d:
00000001579F 00000041B59F 0 <><S<a<j<
0000000157AB 00000041B5AB 0 =E=_=g=r=
0000000157C3 00000041B5C3 0 >A>x>
0000000157E1 00000041B5E1 0 171h1
0000000157ED 00000041B5ED 0 3J4P4V4g4
0000000157FD 00000041B5FD 0 485J5
00000001580B 00000041B60B 0 6'6a6
000000015819 00000041B619 0 6G7[7
000000015827 00000041B627 0 7!8*838c8
000000015839 00000041B639 0 9S9m9
000000015845 00000041B645 0 ;H;Q;o;
000000015853 00000041B653 0 <<=E=">->@>T>
00000001586C 00000041B66C 0 +040 1j1s1
000000015879 00000041B679 0 1,2p2
00000001588B 00000041B68B 0 2-343<3
0000000158A1 00000041B6A1 0 4,444:4F4K4P4U4
0000000158D3 00000041B6D3 0 858F8L8X8h8n8}8
000000015903 00000041B703 0 9!9*909:9E9
000000015915 00000041B715 0 :;:I:
00000001591D 00000041B71D 0 <,<3<;<@<D<H<q<
00000001593F 00000041B73F 0 <"=(=,=0=4=
00000001595B 00000041B75B 0 >Q>X>\>
000000015963 00000041B763 0 >d>h>l>p>t>
000000015983 00000041B783 0 1&111
000000015993 00000041B793 0 2$2.2G2Q2
0000000159A7 00000041B7A7 0 2@3F3R3
0000000159B7 00000041B7B7 0 3<4A4G4N4
0000000159C1 00000041B7C1 0 4I6b7m7
0000000159D5 00000041B7D5 0 ;/;\;
0000000159EF 00000041B7EF 0 >$>6>H>Z>l>~>
000000015A13 00000041B813 0 2r3a4
000000015A23 00000041B823 0 7N8j8
000000015A2B 00000041B82B 0 9#:_:|:
000000015A33 00000041B833 0 :U;_;z;
000000015A41 00000041B841 0 <s<y<
000000015A77 00000041B877 0 1.1Q1e1
000000015A93 00000041B893 0 273~3
000000015AA1 00000041B8A1 0 4>4[4
000000015AE1 00000041B8E1 0 ="=&=+=1=5=;=?=E=I=N=T=X=
000000015AFB 00000041B8FB 0 =b=h=l=r=v=
000000015B09 00000041B909 0 = ?(?
000000015B19 00000041B919 0 0b1n1
000000015B37 00000041B937 0 6n7v7
000000015B41 00000041B941 0 848n8
000000015B47 00000041B947 0 8V<h<
000000015B9D 00000041B99D 0 070U0\0
000000015BA5 00000041B9A5 0 0d0h0l0p0t0x0
000000015BBB 00000041B9BB 0 0:1E1
000000015BC1 00000041B9C1 0 1g1l1p1t1
000000015BE1 00000041B9E1 0 2d2h2l2p2
000000015BEF 00000041B9EF 0 8D9]9l9
000000015C1C 00000041BA1C 0 4181<1@1D1P1T1X1
000000015C51 00000041BA51 0 3$3,343<3D3L3
File pos Mem pos ID Text
======== ======= == ====
000000015C7F 00000041BA7F 0 =$=,=4=<=D=L=T=\=d=l=t=|=
000000015CBF 00000041BABF 0 >$>,>4><>D>L>T>\>d>l>t>|>
000000015CFF 00000041BAFF 0 ?$?,?4?<?D?L?T?\?d?l?t?|?
000000015D47 00000041BB47 0 0$0,040<0D0L0T0\0d0l0t0|0
000000015D87 00000041BB87 0 1$1,141<1D1L1T1\1d1l1t1|1
000000015DC7 00000041BBC7 0 2$2,242<2D2L2T2\2d2l2t2|2
000000015E07 00000041BC07 0 3$3,343<3D3L3T3\3d3l3t3|3
000000015E47 00000041BC47 0 4 4(40484@4H4P4X4
000000015E59 00000041BC59 0 4h4p4x4
000000015E87 00000041BC87 0 5 5(50585@5H5P5X5
000000015E99 00000041BC99 0 5h5p5x5
000000015EC7 00000041BCC7 0 6 6(60686@6H6P6X6
000000015ED9 00000041BCD9 0 6h6p6x6
000000015F07 00000041BD07 0 7 7(70787@7H7P7X7
000000015F19 00000041BD19 0 7h7p7x7
000000015F47 00000041BD47 0 8 8(80888@8H8P8X8
000000015F59 00000041BD59 0 8h8p8x8
000000015F87 00000041BD87 0 9 9(90989@9H9P9X9
000000015F99 00000041BD99 0 9h9p9x9
000000015FC7 00000041BDC7 0 : :(:0:8:@:H:P:X:
000000015FD9 00000041BDD9 0 :h:p:x:
000000016025 00000041BE25 0 7(7D7H7h7
00000001603B 00000041BE3B 0 8 8@8
00000001604D 00000041BE4D 0 9 9@9L9h9
000000016061 00000041BE61 0 :(:H:d:h:
0000000160B5 00000041BEB5 0 ; ;$;(;,;0;4;8;<;@;D;H;L;P;\;
0000000160D3 00000041BED3 0 ;d;h;l;p;t;x;|;
000000016129 00000041BF29 0 <4<D<T<d<t<
00000001615B 00000041BF5B 0 = =$=(=,=0=4=8=<=H=L=P=T=X=\=
000000016179 00000041BF79 0 =d=l=p=
00000000EE70 000000410270 0 mscoree.dll
00000000F818 000000410C18 0 runtime error
00000000F858 000000410C58 0 Program:
00000000F86C 000000410C6C 0 <program name unknown>
00000000F8B0 000000410CB0 0 Microsoft Visual C++ Runtime Library
00000000F8FC 000000410CFC 0 kernel32.dll
00000000FBEB 000000410FEB 0 Aja-JP
00000000FBF8 000000410FF8 0 zh-CN
00000000FC04 000000411004 0 ko-KR
00000000FC10 000000411010 0 zh-TW
00000000FD80 000000411180 0 Sunday
00000000FD90 000000411190 0 Monday
00000000FDA0 0000004111A0 0 Tuesday
00000000FDB0 0000004111B0 0 Wednesday
00000000FDC4 0000004111C4 0 Thursday
00000000FDD8 0000004111D8 0 Friday
00000000FDE8 0000004111E8 0 Saturday
00000000FE5C 00000041125C 0 January
00000000FE6C 00000041126C 0 February
00000000FE80 000000411280 0 March
00000000FE8C 00000041128C 0 April
00000000FEB0 0000004112B0 0 August
00000000FEC0 0000004112C0 0 September
00000000FED4 0000004112D4 0 October
00000000FEE4 0000004112E4 0 November
00000000FEF8 0000004112F8 0 December
00000000FF1C 00000041131C 0 MM/dd/yy
00000000FF30 000000411330 0 dddd, MMMM dd, yyyy
00000000FF58 000000411358 0 HH:mm:ss
00000000FF6C 00000041136C 0 en-US
File pos Mem pos ID Text
======== ======= == ====
00000000FF80 000000411380 0 (null)
00000000FFEC 0000004113EC 0 USER32.DLL
000000011738 000000412B38 0 zh-CHS
00000001193C 000000412D3C 0 ar-SA
000000011948 000000412D48 0 bg-BG
000000011954 000000412D54 0 ca-ES
000000011960 000000412D60 0 cs-CZ
00000001196C 000000412D6C 0 da-DK
000000011978 000000412D78 0 de-DE
000000011984 000000412D84 0 el-GR
000000011990 000000412D90 0 fi-FI
00000001199C 000000412D9C 0 fr-FR
0000000119A8 000000412DA8 0 he-IL
0000000119B4 000000412DB4 0 hu-HU
0000000119C0 000000412DC0 0 is-IS
0000000119CC 000000412DCC 0 it-IT
0000000119D8 000000412DD8 0 nl-NL
0000000119E4 000000412DE4 0 nb-NO
0000000119F0 000000412DF0 0 pl-PL
0000000119FC 000000412DFC 0 pt-BR
000000011A08 000000412E08 0 ro-RO
000000011A14 000000412E14 0 ru-RU
000000011A20 000000412E20 0 hr-HR
000000011A2C 000000412E2C 0 sk-SK
000000011A38 000000412E38 0 sq-AL
000000011A44 000000412E44 0 sv-SE
000000011A50 000000412E50 0 th-TH
000000011A5C 000000412E5C 0 tr-TR
000000011A68 000000412E68 0 ur-PK
000000011A74 000000412E74 0 id-ID
000000011A80 000000412E80 0 uk-UA
000000011A8C 000000412E8C 0 be-BY
000000011A98 000000412E98 0 sl-SI
000000011AA4 000000412EA4 0 et-EE
000000011AB0 000000412EB0 0 lv-LV
000000011ABC 000000412EBC 0 lt-LT
000000011AC8 000000412EC8 0 fa-IR
000000011AD4 000000412ED4 0 vi-VN
000000011AE0 000000412EE0 0 hy-AM
000000011AEC 000000412EEC 0 az-AZ-Latn
000000011B04 000000412F04 0 eu-ES
000000011B10 000000412F10 0 mk-MK
000000011B1C 000000412F1C 0 tn-ZA
000000011B28 000000412F28 0 xh-ZA
000000011B34 000000412F34 0 zu-ZA
000000011B40 000000412F40 0 af-ZA
000000011B4C 000000412F4C 0 ka-GE
000000011B58 000000412F58 0 fo-FO
000000011B64 000000412F64 0 hi-IN
000000011B70 000000412F70 0 mt-MT
000000011B7C 000000412F7C 0 se-NO
000000011B88 000000412F88 0 ms-MY
000000011B94 000000412F94 0 kk-KZ
000000011BA0 000000412FA0 0 ky-KG
000000011BAC 000000412FAC 0 sw-KE
000000011BB8 000000412FB8 0 uz-UZ-Latn
000000011BD0 000000412FD0 0 tt-RU
000000011BDC 000000412FDC 0 bn-IN
000000011BE8 000000412FE8 0 pa-IN
000000011BF4 000000412FF4 0 gu-IN
File pos Mem pos ID Text
======== ======= == ====
000000011C00 000000413000 0 ta-IN
000000011C0C 00000041300C 0 te-IN
000000011C18 000000413018 0 kn-IN
000000011C24 000000413024 0 ml-IN
000000011C30 000000413030 0 mr-IN
000000011C3C 00000041303C 0 sa-IN
000000011C48 000000413048 0 mn-MN
000000011C54 000000413054 0 cy-GB
000000011C60 000000413060 0 gl-ES
000000011C6C 00000041306C 0 kok-IN
000000011C7C 00000041307C 0 syr-SY
000000011C8C 00000041308C 0 div-MV
000000011C9C 00000041309C 0 quz-BO
000000011CAC 0000004130AC 0 ns-ZA
000000011CB8 0000004130B8 0 mi-NZ
000000011CC4 0000004130C4 0 ar-IQ
000000011CD0 0000004130D0 0 de-CH
000000011CDC 0000004130DC 0 en-GB
000000011CE8 0000004130E8 0 es-MX
000000011CF4 0000004130F4 0 fr-BE
000000011D00 000000413100 0 it-CH
000000011D0C 00000041310C 0 nl-BE
000000011D18 000000413118 0 nn-NO
000000011D24 000000413124 0 pt-PT
000000011D30 000000413130 0 sr-SP-Latn
000000011D48 000000413148 0 sv-FI
000000011D54 000000413154 0 az-AZ-Cyrl
000000011D6C 00000041316C 0 se-SE
000000011D78 000000413178 0 ms-BN
000000011D84 000000413184 0 uz-UZ-Cyrl
000000011D9C 00000041319C 0 quz-EC
000000011DAC 0000004131AC 0 ar-EG
000000011DB8 0000004131B8 0 zh-HK
000000011DC4 0000004131C4 0 de-AT
000000011DD0 0000004131D0 0 en-AU
000000011DDC 0000004131DC 0 es-ES
000000011DE8 0000004131E8 0 fr-CA
000000011DF4 0000004131F4 0 sr-SP-Cyrl
000000011E0C 00000041320C 0 se-FI
000000011E18 000000413218 0 quz-PE
000000011E28 000000413228 0 ar-LY
000000011E34 000000413234 0 zh-SG
000000011E40 000000413240 0 de-LU
000000011E4C 00000041324C 0 en-CA
000000011E58 000000413258 0 es-GT
000000011E64 000000413264 0 fr-CH
000000011E70 000000413270 0 hr-BA
000000011E7C 00000041327C 0 smj-NO
000000011E8C 00000041328C 0 ar-DZ
000000011E98 000000413298 0 zh-MO
000000011EA4 0000004132A4 0 de-LI
000000011EB0 0000004132B0 0 en-NZ
000000011EBC 0000004132BC 0 es-CR
000000011EC8 0000004132C8 0 fr-LU
000000011ED4 0000004132D4 0 bs-BA-Latn
000000011EEC 0000004132EC 0 smj-SE
000000011EFC 0000004132FC 0 ar-MA
000000011F08 000000413308 0 en-IE
000000011F14 000000413314 0 es-PA
000000011F20 000000413320 0 fr-MC
File pos Mem pos ID Text
======== ======= == ====
000000011F2C 00000041332C 0 sr-BA-Latn
000000011F44 000000413344 0 sma-NO
000000011F54 000000413354 0 ar-TN
000000011F60 000000413360 0 en-ZA
000000011F6C 00000041336C 0 es-DO
000000011F78 000000413378 0 sr-BA-Cyrl
000000011F90 000000413390 0 sma-SE
000000011FA0 0000004133A0 0 ar-OM
000000011FAC 0000004133AC 0 en-JM
000000011FB8 0000004133B8 0 es-VE
000000011FC4 0000004133C4 0 sms-FI
000000011FD4 0000004133D4 0 ar-YE
000000011FE0 0000004133E0 0 en-CB
000000011FEC 0000004133EC 0 es-CO
000000011FF8 0000004133F8 0 smn-FI
000000012008 000000413408 0 ar-SY
000000012014 000000413414 0 en-BZ
000000012020 000000413420 0 es-PE
00000001202C 00000041342C 0 ar-JO
000000012038 000000413438 0 en-TT
000000012044 000000413444 0 es-AR
000000012050 000000413450 0 ar-LB
00000001205C 00000041345C 0 en-ZW
000000012068 000000413468 0 es-EC
000000012074 000000413474 0 ar-KW
000000012080 000000413480 0 en-PH
00000001208C 00000041348C 0 es-CL
000000012098 000000413498 0 ar-AE
0000000120A4 0000004134A4 0 es-UY
0000000120B0 0000004134B0 0 ar-BH
0000000120BC 0000004134BC 0 es-PY
0000000120C8 0000004134C8 0 ar-QA
0000000120D4 0000004134D4 0 es-BO
0000000120E0 0000004134E0 0 es-SV
0000000120EC 0000004134EC 0 es-HN
0000000120F8 0000004134F8 0 es-NI
000000012104 000000413504 0 es-PR
000000012110 000000413510 0 zh-CHT
000000012128 000000413528 0 af-za
000000012134 000000413534 0 ar-ae
000000012140 000000413540 0 ar-bh
00000001214C 00000041354C 0 ar-dz
000000012158 000000413558 0 ar-eg
000000012164 000000413564 0 ar-iq
000000012170 000000413570 0 ar-jo
00000001217C 00000041357C 0 ar-kw
000000012188 000000413588 0 ar-lb
000000012194 000000413594 0 ar-ly
0000000121A0 0000004135A0 0 ar-ma
0000000121AC 0000004135AC 0 ar-om
0000000121B8 0000004135B8 0 ar-qa
0000000121C4 0000004135C4 0 ar-sa
0000000121D0 0000004135D0 0 ar-sy
0000000121DC 0000004135DC 0 ar-tn
0000000121E8 0000004135E8 0 ar-ye
0000000121F4 0000004135F4 0 az-az-cyrl
00000001220C 00000041360C 0 az-az-latn
000000012224 000000413624 0 be-by
000000012230 000000413630 0 bg-bg
00000001223C 00000041363C 0 bn-in
File pos Mem pos ID Text
======== ======= == ====
000000012248 000000413648 0 bs-ba-latn
000000012260 000000413660 0 ca-es
00000001226C 00000041366C 0 cs-cz
000000012278 000000413678 0 cy-gb
000000012284 000000413684 0 da-dk
000000012290 000000413690 0 de-at
00000001229C 00000041369C 0 de-ch
0000000122A8 0000004136A8 0 de-de
0000000122B4 0000004136B4 0 de-li
0000000122C0 0000004136C0 0 de-lu
0000000122CC 0000004136CC 0 div-mv
0000000122DC 0000004136DC 0 el-gr
0000000122E8 0000004136E8 0 en-au
0000000122F4 0000004136F4 0 en-bz
000000012300 000000413700 0 en-ca
00000001230C 00000041370C 0 en-cb
000000012318 000000413718 0 en-gb
000000012324 000000413724 0 en-ie
000000012330 000000413730 0 en-jm
00000001233C 00000041373C 0 en-nz
000000012348 000000413748 0 en-ph
000000012354 000000413754 0 en-tt
000000012360 000000413760 0 en-us
00000001236C 00000041376C 0 en-za
000000012378 000000413778 0 en-zw
000000012384 000000413784 0 es-ar
000000012390 000000413790 0 es-bo
00000001239C 00000041379C 0 es-cl
0000000123A8 0000004137A8 0 es-co
0000000123B4 0000004137B4 0 es-cr
0000000123C0 0000004137C0 0 es-do
0000000123CC 0000004137CC 0 es-ec
0000000123D8 0000004137D8 0 es-es
0000000123E4 0000004137E4 0 es-gt
0000000123F0 0000004137F0 0 es-hn
0000000123FC 0000004137FC 0 es-mx
000000012408 000000413808 0 es-ni
000000012414 000000413814 0 es-pa
000000012420 000000413820 0 es-pe
00000001242C 00000041382C 0 es-pr
000000012438 000000413838 0 es-py
000000012444 000000413844 0 es-sv
000000012450 000000413850 0 es-uy
00000001245C 00000041385C 0 es-ve
000000012468 000000413868 0 et-ee
000000012474 000000413874 0 eu-es
000000012480 000000413880 0 fa-ir
00000001248C 00000041388C 0 fi-fi
000000012498 000000413898 0 fo-fo
0000000124A4 0000004138A4 0 fr-be
0000000124B0 0000004138B0 0 fr-ca
0000000124BC 0000004138BC 0 fr-ch
0000000124C8 0000004138C8 0 fr-fr
0000000124D4 0000004138D4 0 fr-lu
0000000124E0 0000004138E0 0 fr-mc
0000000124EC 0000004138EC 0 gl-es
0000000124F8 0000004138F8 0 gu-in
000000012504 000000413904 0 he-il
000000012510 000000413910 0 hi-in
00000001251C 00000041391C 0 hr-ba
File pos Mem pos ID Text
======== ======= == ====
000000012528 000000413928 0 hr-hr
000000012534 000000413934 0 hu-hu
000000012540 000000413940 0 hy-am
00000001254C 00000041394C 0 id-id
000000012558 000000413958 0 is-is
000000012564 000000413964 0 it-ch
000000012570 000000413970 0 it-it
00000001257C 00000041397C 0 ja-jp
000000012588 000000413988 0 ka-ge
000000012594 000000413994 0 kk-kz
0000000125A0 0000004139A0 0 kn-in
0000000125AC 0000004139AC 0 kok-in
0000000125BC 0000004139BC 0 ko-kr
0000000125C8 0000004139C8 0 ky-kg
0000000125D4 0000004139D4 0 lt-lt
0000000125E0 0000004139E0 0 lv-lv
0000000125EC 0000004139EC 0 mi-nz
0000000125F8 0000004139F8 0 mk-mk
000000012604 000000413A04 0 ml-in
000000012610 000000413A10 0 mn-mn
00000001261C 000000413A1C 0 mr-in
000000012628 000000413A28 0 ms-bn
000000012634 000000413A34 0 ms-my
000000012640 000000413A40 0 mt-mt
00000001264C 000000413A4C 0 nb-no
000000012658 000000413A58 0 nl-be
000000012664 000000413A64 0 nl-nl
000000012670 000000413A70 0 nn-no
00000001267C 000000413A7C 0 ns-za
000000012688 000000413A88 0 pa-in
000000012694 000000413A94 0 pl-pl
0000000126A0 000000413AA0 0 pt-br
0000000126AC 000000413AAC 0 pt-pt
0000000126B8 000000413AB8 0 quz-bo
0000000126C8 000000413AC8 0 quz-ec
0000000126D8 000000413AD8 0 quz-pe
0000000126E8 000000413AE8 0 ro-ro
0000000126F4 000000413AF4 0 ru-ru
000000012700 000000413B00 0 sa-in
00000001270C 000000413B0C 0 se-fi
000000012718 000000413B18 0 se-no
000000012724 000000413B24 0 se-se
000000012730 000000413B30 0 sk-sk
00000001273C 000000413B3C 0 sl-si
000000012748 000000413B48 0 sma-no
000000012758 000000413B58 0 sma-se
000000012768 000000413B68 0 smj-no
000000012778 000000413B78 0 smj-se
000000012788 000000413B88 0 smn-fi
000000012798 000000413B98 0 sms-fi
0000000127A8 000000413BA8 0 sq-al
0000000127B4 000000413BB4 0 sr-ba-cyrl
0000000127CC 000000413BCC 0 sr-ba-latn
0000000127E4 000000413BE4 0 sr-sp-cyrl
0000000127FC 000000413BFC 0 sr-sp-latn
000000012814 000000413C14 0 sv-fi
000000012820 000000413C20 0 sv-se
00000001282C 000000413C2C 0 sw-ke
000000012838 000000413C38 0 syr-sy
000000012848 000000413C48 0 ta-in
File pos Mem pos ID Text
======== ======= == ====
000000012854 000000413C54 0 te-in
000000012860 000000413C60 0 th-th
00000001286C 000000413C6C 0 tn-za
000000012878 000000413C78 0 tr-tr
000000012884 000000413C84 0 tt-ru
000000012890 000000413C90 0 uk-ua
00000001289C 000000413C9C 0 ur-pk
0000000128A8 000000413CA8 0 uz-uz-cyrl
0000000128C0 000000413CC0 0 uz-uz-latn
0000000128D8 000000413CD8 0 vi-vn
0000000128E4 000000413CE4 0 xh-za
0000000128F0 000000413CF0 0 zh-chs
000000012900 000000413D00 0 zh-cht
000000012910 000000413D10 0 zh-cn
00000001291C 000000413D1C 0 zh-hk
000000012928 000000413D28 0 zh-mo
000000012934 000000413D34 0 zh-sg
000000012940 000000413D40 0 zh-tw
00000001294C 000000413D4C 0 zu-za
0000000129D8 000000413DD8 0 CONOUT$
000000012A30 000000413E30 0 [+] WFSStartUp...
000000012B28 000000413F28 0 [+] WFSOpen...
000000012B68 000000413F68 0 [+] WFSGetInfo...
000000012FF8 0000004143F8 0 [+] WFSExecute...