.- - -----÷M÷E÷N÷U÷------------------------------------------------------------- --- ----  -------------.
!  WALL ! STATS ! GOODIES ! YARA ! FAQ ! RSS ! EMV                                                      !
`--------------  - ---  ---------- -------- -------- -------- -------- ----------------- -  ---- ---- --'

                                           ATM MALWARE NOTICE 
                    f6609bb3c3197ace26ebdeb372ba657ac84b05a3e9e265b5211e1ea42da70dbe
 
Date...........: 2018-01-28
Family.........: HelloWorld
File name......: HelloWorld.exe
File size......: 98.50 KB
Type file......: EXE/Windows
Virscan........: VT - HA
Additional note: wipe every drives after dispensing and if the environment don't meet criteria.

Entropy:


Binary Histogram:



=== SCREENSHOT === 



=== PEDUMP REPORT === 
=== MZ Header === signature: "MZ" bytes_in_last_block: 144 0x90 blocks_in_file: 3 3 num_relocs: 0 0 header_paragraphs: 4 4 min_extra_paragraphs: 0 0 max_extra_paragraphs: 65535 0xffff ss: 0 0 sp: 184 0xb8 checksum: 0 0 ip: 0 0 cs: 0 0 reloc_table_offset: 64 0x40 overlay_number: 0 0 reserved0: 0 0 oem_id: 0 0 oem_info: 0 0 reserved2: 0 0 reserved3: 0 0 reserved4: 0 0 reserved5: 0 0 reserved6: 0 0 lfanew: 248 0xf8 === DOS STUB === 00000000: 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th| 00000010: 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno| 00000020: 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS | 00000030: 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......| === RICH Header === LIB_ID VERSION TIMES_USED 199 c7 41118 a09e 1 1 225 e1 21005 520d 34 22 223 df 21005 520d 18 12 224 e0 21005 520d 121 79 203 cb 65501 ffdd 7 7 1 1 0 0 123 7b 229 e5 30501 7725 5 5 220 dc 30501 7725 1 1 219 db 21005 520d 1 1 222 de 30501 7725 1 1 === PE Header === signature: "PE\x00\x00" # IMAGE_FILE_HEADER: Machine: 332 0x14c x86 NumberOfSections: 5 5 TimeDateStamp: "2017-10-22 22:25:55" PointerToSymbolTable: 0 0 NumberOfSymbols: 0 0 SizeOfOptionalHeader: 224 0xe0 Characteristics: 258 0x102 EXECUTABLE_IMAGE, 32BIT_MACHINE # IMAGE_OPTIONAL_HEADER32: Magic: 267 0x10b 32-bit executable LinkerVersion: 12.0 SizeOfCode: 62464 0xf400 SizeOfInitializedData: 49664 0xc200 SizeOfUninitializedData: 0 0 AddressOfEntryPoint: 16312 0x3fb8 BaseOfCode: 4096 0x1000 BaseOfData: 69632 0x11000 ImageBase: 4194304 0x400000 SectionAlignment: 4096 0x1000 FileAlignment: 512 0x200 OperatingSystemVersion: 5.1 ImageVersion: 0.0 SubsystemVersion: 5.1 Reserved1: 0 0 SizeOfImage: 131072 0x20000 SizeOfHeaders: 1024 0x400 CheckSum: 0 0 Subsystem: 2 2 WINDOWS_GUI DllCharacteristics: 33088 0x8140 DYNAMIC_BASE, NX_COMPAT TERMINAL_SERVER_AWARE SizeOfStackReserve: 1048576 0x100000 SizeOfStackCommit: 4096 0x1000 SizeOfHeapReserve: 1048576 0x100000 SizeOfHeapCommit: 4096 0x1000 LoaderFlags: 0 0 NumberOfRvaAndSizes: 16 0x10 === DATA DIRECTORY === EXPORT rva:0x 15df0 size:0x 11c IMPORT rva:0x 15f0c size:0x 50 RESOURCE rva:0x 1d000 size:0x 1e0 EXCEPTION rva:0x 0 size:0x 0 SECURITY rva:0x 0 size:0x 0 BASERELOC rva:0x 1e000 size:0x 1048 DEBUG rva:0x 0 size:0x 0 ARCHITECTURE rva:0x 0 size:0x 0 GLOBALPTR rva:0x 0 size:0x 0 TLS rva:0x 0 size:0x 0 LOAD_CONFIG rva:0x 15a88 size:0x 40 Bound_IAT rva:0x 0 size:0x 0 IAT rva:0x 11000 size:0x 1c0 Delay_IAT rva:0x 0 size:0x 0 CLR_Header rva:0x 0 size:0x 0 rva:0x 0 size:0x 0 === SECTIONS === NAME RVA VSZ RAW_SZ RAW_PTR nREL REL_PTR nLINE LINE_PTR FLAGS .text 1000 f352 f400 400 0 0 0 0 60000020 R-X CODE .rdata 11000 58cc 5a00 f800 0 0 0 0 40000040 R-- IDATA .data 17000 5340 2400 15200 0 0 0 0 c0000040 RW- IDATA .rsrc 1d000 1e0 200 17600 0 0 0 0 40000040 R-- IDATA .reloc 1e000 1048 1200 17800 0 0 0 0 42000040 R-- IDATA DISCARDABLE === RESOURCES === FILE_OFFSET CP LANG SIZE TYPE NAME 0x17660 0 0x409 381 MANIFEST #1 === IMPORTS === MODULE_NAME HINT ORD FUNCTION_NAME KERNEL32.dll 7f CloseHandle KERNEL32.dll 310 GetWindowsDirectoryW KERNEL32.dll 10a DeleteFileW KERNEL32.dll 3b2 LocalFree KERNEL32.dll 155 ExpandEnvironmentStringsW KERNEL32.dll e8 CreateThread KERNEL32.dll 151 ExitProcess KERNEL32.dll 608 lstrlenA KERNEL32.dll 19e FreeLibrary KERNEL32.dll 29d GetProcAddress KERNEL32.dll 3a5 LoadLibraryA KERNEL32.dll 267 GetModuleHandleW KERNEL32.dll 336 HeapReAlloc KERNEL32.dll 5de WriteConsoleW KERNEL32.dll 520 SetStdHandle KERNEL32.dll 3fa OutputDebugStringW KERNEL32.dll 4ac RtlUnwind KERNEL32.dll 3a7 LoadLibraryExW KERNEL32.dll 17f FindNextFileW KERNEL32.dll 396 LCMapStringW KERNEL32.dll 4fc SetFilePointerEx KERNEL32.dll 1ee GetConsoleMode KERNEL32.dll 1dc GetConsoleCP KERNEL32.dll 3a2 LeaveCriticalSection KERNEL32.dll 125 EnterCriticalSection KERNEL32.dll 572 TlsFree KERNEL32.dll 574 TlsSetValue KERNEL32.dll 573 TlsGetValue KERNEL32.dll 168 FindClose KERNEL32.dll 250 GetLastError KERNEL32.dll 23c GetFileSizeEx KERNEL32.dll 192 FlushFileBuffers KERNEL32.dll c2 CreateFileW KERNEL32.dll 550 Sleep KERNEL32.dll 5df WriteFile KERNEL32.dll 2a2 GetProcessHeap KERNEL32.dll 333 HeapFree KERNEL32.dll 209 GetCurrentProcess KERNEL32.dll 32f HeapAlloc KERNEL32.dll 173 FindFirstFileW KERNEL32.dll 2d6 GetSystemTimeAsFileTime KERNEL32.dll 1c8 GetCommandLineA KERNEL32.dll 367 IsDebuggerPresent KERNEL32.dll 36d IsProcessorFeaturePresent KERNEL32.dll 121 EncodePointer KERNEL32.dll fe DecodePointer KERNEL32.dll 372 IsValidCodePage KERNEL32.dll 1a4 GetACP KERNEL32.dll 286 GetOEMCP KERNEL32.dll 1b3 GetCPInfo KERNEL32.dll 2c5 GetStringTypeW KERNEL32.dll 50a SetLastError KERNEL32.dll 20e GetCurrentThreadId KERNEL32.dll 266 GetModuleHandleExW KERNEL32.dll 3d1 MultiByteToWideChar KERNEL32.dll 5cb WideCharToMultiByte KERNEL32.dll 2c0 GetStdHandle KERNEL32.dll 23e GetFileType KERNEL32.dll 105 DeleteCriticalSection KERNEL32.dll 2be GetStartupInfoW KERNEL32.dll 262 GetModuleFileNameA KERNEL32.dll 263 GetModuleFileNameW KERNEL32.dll 42d QueryPerformanceCounter KERNEL32.dll 20a GetCurrentProcessId KERNEL32.dll 227 GetEnvironmentStringsW KERNEL32.dll 19d FreeEnvironmentStringsW KERNEL32.dll 580 UnhandledExceptionFilter KERNEL32.dll 541 SetUnhandledExceptionFilter KERNEL32.dll 348 InitializeCriticalSectionAndSpinCount KERNEL32.dll 55f TerminateProcess KERNEL32.dll 571 TlsAlloc KERNEL32.dll 338 HeapSize USER32.dll e9 EndPaint USER32.dll ad DestroyWindow USER32.dll 173 GetMessageW USER32.dll 271 PostQuitMessage USER32.dll 105 FillRect USER32.dll d6 DrawTextW USER32.dll 221 LoadCursorW USER32.dll 2d4 SetFocus USER32.dll 2b7 SendMessageA USER32.dll e BeginPaint USER32.dll 33f TranslateMessage USER32.dll 289 RegisterClassExW USER32.dll 223 LoadIconW USER32.dll 2f3 SetRect USER32.dll 70 CreateWindowExA USER32.dll 30d SetWindowLongW USER32.dll 285 RedrawWindow USER32.dll 320 ShowWindow USER32.dll 71 CreateWindowExW USER32.dll 24d MessageBoxW USER32.dll 2bc SendMessageW USER32.dll 357 UpdateWindow USER32.dll 1e CallWindowProcW USER32.dll a1 DefWindowProcW USER32.dll b5 DispatchMessageW ADVAPI32.dll 254 RegCloseKey ADVAPI32.dll 1f AdjustTokenPrivileges ADVAPI32.dll 273 RegEnumKeyExW ADVAPI32.dll 285 RegOpenKeyExW ADVAPI32.dll 133 FreeSid ADVAPI32.dll 2cf SetEntriesInAclW ADVAPI32.dll 20 AllocateAndInitializeSid ADVAPI32.dll 1ad LookupPrivilegeValueW ADVAPI32.dll 2da SetNamedSecurityInfoW ADVAPI32.dll 268 RegDeleteKeyW ADVAPI32.dll 16f GetTokenInformation ADVAPI32.dll 212 OpenProcessToken === EXPORTS === # module "dispenser_NO_TOKEN.exe" # flags=0x0 ts="2017-10-22 22:25:54" version=0.0 ord_base=1 # nFuncs=9 nNames=9 ORD ENTRY_VA NAME 1 2f3b ChooseColorA 2 2f3b ChooseFontA 3 2f3e Dispense 4 2f3b FindTextA 5 2f3b GetOpenFileNameA 6 2f3b GetSaveFileNameA 7 2f3b PrintDlgA 8 2f3b WNetAddConnection2A 9 2f3b WNetCancelConnection2A === Packer / Compiler === MS Visual C++ 6.0 - 8.0
=== Strings ===
File pos Mem pos ID Text ======== ======= == ==== 00000000004D 00000040004D 0 !This program cannot be run in DOS mode. 0000000000DE 0000004000DE 0 twRich 0000000001F0 0000004001F0 0 .text 000000000218 000000400218 0 .rdata 00000000023F 00000040023F 0 @.data 000000000268 000000400268 0 .rsrc 00000000028F 00000040028F 0 @.reloc 000000000824 000000401424 0 PSSSSSS 0000000008B5 0000004014B5 0 u(SSS 000000000BFA 0000004017FA 0 PhDSA 000000000C14 000000401814 0 PhpSA 000000000C62 000000401862 0 Ph TA 000000000C7C 00000040187C 0 PhhTA 000000001289 000000401E89 0 Ph\VA 0000000015DF 0000004021DF 0 RVhPWA 000000001841 000000402441 0 D$8SVWj 3 00000000184C 00000040244C 0 D$@CSCCY3 000000001860 000000402460 0 D$@NG 0000000018EC 0000004024EC 0 u2hdXA 000000001B81 000000402781 0 VVVh0$@ 000000001C77 000000402877 0 Qjdjd 000000001DE9 0000004029E9 0 D$ PS 000000001F34 000000402B34 0 D$ PS 000000001FF0 000000402BF0 0 j2jdZ 0000000021C4 000000402DC4 0 D$\PQQ 00000000227C 000000402E7C 0 SWSSh 0000000032F6 000000403EF6 0 PPPPPPPP 0000000037D0 0000004043D0 0 PPPPP 000000003B10 000000404710 0 t/HHt 000000003B53 000000404753 0 j*Xf; 000000003BB1 0000004047B1 0 j*Xf; 000000003C08 000000404808 0 htHjlZ; 000000003D4B 00000040494B 0 HHtXHHt 000000003F88 000000404B88 0 nt'joZ; 000000004028 000000404C28 0 jgXf; 0000000040FF 000000404CFF 0 YYjgXf9 0000000042B5 000000404EB5 0 >0t<NAj0X 000000004396 000000404F96 0 Wj0XP 0000000044A2 0000004050A2 0 Wj XP 000000004963 000000405563 0 t/HHt 000000004BAF 0000004057AF 0 HHtVHHt 0000000050A6 000000405CA6 0 >0t-N 00000000544F 00000040604F 0 5ntel 00000000545F 00000040605F 0 5Genu 000000006217 000000406E17 0 ~pjCXf 000000006AD1 0000004076D1 0 j@j _W 000000006B91 000000407791 0 } j@W 000000006F3C 000000407B3C 0 < t8< t4 000000007016 000000407C16 0 t@VSP 000000007071 000000407C71 0 PPPPP 0000000071A3 000000407DA3 0 <v5hJ 00000000728B 000000407E8B 0 SSSSS 0000000073EA 000000407FEA 0 SPPP+ 0000000073F3 000000407FF3 0 FVWPP 000000007419 000000408019 0 SVWPP 00000000755B 00000040815B 0 VWhD!A 000000008B0C 00000040970C 0 ~';_t|%3 000000008B20 000000409720 0 wtVj 000000008B35 000000409735 0 ;_tr. 000000008B56 000000409756 0 GWVj File pos Mem pos ID Text ======== ======= == ==== 000000008D2B 00000040992B 0 v N+D$ 000000008E3C 000000409A3C 0 QVWSj 0000000096D6 00000040A2D6 0 PP9E u 0000000099AD 00000040A5AD 0 jA[jZZ+ 000000009AE9 00000040A6E9 0 PWWWWV 000000009B84 00000040A784 0 PSSSSV 00000000A25F 00000040AE5F 0 URPQQh 00000000BDBD 00000040C9BD 0 +t"HHt 00000000BE13 00000040CA13 0 9] t" 00000000C9D0 00000040D5D0 0 ,SVWj0X 00000000CB04 00000040D704 0 u'j0X 00000000CC2E 00000040D82E 0 Wj0XPV 00000000CCCD 00000040D8CD 0 PjdSQ 00000000CE36 00000040DA36 0 -jd[; 00000000CE8B 00000040DA8B 0 WWWWW 00000000D3DE 00000040DFDE 0 VVVVV 00000000D463 00000040E063 0 SVWUj 00000000D504 00000040E104 0 ;t$,v- 00000000D589 00000040E189 0 UQPXY]Y[ 00000000E4F2 00000040F0F2 0 PPPPP 00000000E5A6 00000040F1A6 0 v N+D$ 00000000E8DF 00000040F4DF 0 u0h0NA 00000000E8EE 00000040F4EE 0 u!h8NA 00000000F1CA 00000040FDCA 0 SSSSS 00000000FA08 000000411208 0 (null) 00000000FA41 000000411241 0 ( 8PX 00000000FA49 000000411249 0 700WP 00000000FA61 000000411261 0 xpxxxx 00000000FAD8 0000004112D8 0 Sunday 00000000FAE0 0000004112E0 0 Monday 00000000FAE8 0000004112E8 0 Tuesday 00000000FAF0 0000004112F0 0 Wednesday 00000000FAFC 0000004112FC 0 Thursday 00000000FB08 000000411308 0 Friday 00000000FB10 000000411310 0 Saturday 00000000FB4C 00000041134C 0 January 00000000FB54 000000411354 0 February 00000000FB60 000000411360 0 March 00000000FB68 000000411368 0 April 00000000FB80 000000411380 0 August 00000000FB88 000000411388 0 September 00000000FB94 000000411394 0 October 00000000FB9C 00000041139C 0 November 00000000FBA8 0000004113A8 0 December 00000000FBBC 0000004113BC 0 MM/dd/yy 00000000FBC8 0000004113C8 0 dddd, MMMM dd, yyyy 00000000FBDC 0000004113DC 0 HH:mm:ss 00000000FED0 0000004116D0 0 CorExitProcess 000000010960 000000412160 0 FlsAlloc 00000001096C 00000041216C 0 FlsFree 000000010974 000000412174 0 FlsGetValue 000000010980 000000412180 0 FlsSetValue 00000001098C 00000041218C 0 InitializeCriticalSectionEx 0000000109A8 0000004121A8 0 CreateEventExW 0000000109B8 0000004121B8 0 CreateSemaphoreExW 0000000109CC 0000004121CC 0 SetThreadStackGuarantee 0000000109E4 0000004121E4 0 CreateThreadpoolTimer 0000000109FC 0000004121FC 0 SetThreadpoolTimer 000000010A10 000000412210 0 WaitForThreadpoolTimerCallbacks 000000010A30 000000412230 0 CloseThreadpoolTimer File pos Mem pos ID Text ======== ======= == ==== 000000010A48 000000412248 0 CreateThreadpoolWait 000000010A60 000000412260 0 SetThreadpoolWait 000000010A74 000000412274 0 CloseThreadpoolWait 000000010A88 000000412288 0 FlushProcessWriteBuffers 000000010AA4 0000004122A4 0 FreeLibraryWhenCallbackReturns 000000010AC4 0000004122C4 0 GetCurrentProcessorNumber 000000010AE0 0000004122E0 0 GetLogicalProcessorInformation 000000010B00 000000412300 0 CreateSymbolicLinkW 000000010B14 000000412314 0 SetDefaultDllDirectories 000000010B30 000000412330 0 EnumSystemLocalesEx 000000010B44 000000412344 0 CompareStringEx 000000010B54 000000412354 0 GetDateFormatEx 000000010B64 000000412364 0 GetLocaleInfoEx 000000010B74 000000412374 0 GetTimeFormatEx 000000010B84 000000412384 0 GetUserDefaultLocaleName 000000010BA0 0000004123A0 0 IsValidLocaleName 000000010BB4 0000004123B4 0 LCMapStringEx 000000010BC4 0000004123C4 0 GetCurrentPackageId 000000010BD8 0000004123D8 0 GetTickCount64 000000010BE8 0000004123E8 0 GetFileInformationByHandleExW 000000010C08 000000412408 0 SetFileInformationByHandleW 0000000111D0 0000004129D0 0 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\] 000000011211 000000412A11 0 abcdefghijklmnopqrstuvwxyz{|}~ 000000011350 000000412B50 0 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\] 000000011391 000000412B91 0 ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~ 0000000134CD 000000414CCD 0 ('8PW 0000000134D6 000000414CD6 0 700PP 0000000134F1 000000414CF1 0 xppwpp 000000013527 000000414D27 0 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\] 000000013568 000000414D68 0 abcdefghijklmnopqrstuvwxyz{|}~ 0000000135A4 000000414DA4 0 MessageBoxW 0000000135B0 000000414DB0 0 GetActiveWindow 0000000135C0 000000414DC0 0 GetLastActivePopup 0000000135D4 000000414DD4 0 GetUserObjectInformationW 0000000135F0 000000414DF0 0 GetProcessWindowStation 000000013610 000000414E10 0 e+000 000000013628 000000414E28 0 1#SNAN 000000013630 000000414E30 0 1#IND 000000013638 000000414E38 0 1#INF 000000013640 000000414E40 0 1#QNAN 000000013880 000000415080 0 Deleting: 000000013D88 000000415588 0 CscCngOpen 000000013D94 000000415594 0 CscCngClose 000000013DA0 0000004155A0 0 CscCngLock 000000013DAC 0000004155AC 0 CscCngUnlock 000000013DBC 0000004155BC 0 CscCngDispense 000000013DCC 0000004155CC 0 CscCngTransport 000000013DDC 0000004155DC 0 CscCngStatusRead 000000013DF0 0000004155F0 0 CscCngReset 000000013E04 000000415604 0 Locking CSCCNG... 000000013E18 000000415618 0 Unlocking CSCCNG... 000000013E2C 00000041562C 0 Resetting csccng 000000013E40 000000415640 0 Resetted csccng 000000013E50 000000415650 0 %d,%02d; 000000013E5C 00000041565C 0 Dispensing (%s)... 000000013E70 000000415670 0 Dispense failed 000000013E84 000000415684 0 Success, transporting now. Raw response: %s 000000013EB4 0000004156B4 0 transport waitpos failed 000000013ED0 0000004156D0 0 Transporting to customer... 000000013EEC 0000004156EC 0 transport offer failed File pos Mem pos ID Text ======== ======= == ==== 000000013F04 000000415704 0 money not taken 000000013F18 000000415718 0 locking failed 000000013F28 000000415728 0 MaxNotes: %d 000000013F38 000000415738 0 %dSTA 000000013F40 000000415740 0 %dVAL 000000013F48 000000415748 0 %dACT 000000013F50 000000415750 0 CAS%d: %d, %d 000000013F60 000000415760 0 MAX_NOTES 000000013F6C 00000041576C 0 loading cscwcng.dll 000000013F80 000000415780 0 trying cscwcng.dll ... 000000013F98 000000415798 0 cscwcng.dll 000000013FA4 0000004157A4 0 failed finding cscwcng.dll 000000013FC0 0000004157C0 0 trying C:\CSCW32\DLL\cscwcng.dll ... 000000013FE8 0000004157E8 0 C:\CSCW32\DLL\cscwcng.dll 000000014004 000000415804 0 failed finding C:\CSCW32\DLL\cscwcng.dll 000000014030 000000415830 0 trying C:\DLL\cscwcng.dll ... 000000014050 000000415850 0 C:\DLL\cscwcng.dll 000000014064 000000415864 0 failed finding C:\DLL\cscwcng.dll 000000014088 000000415888 0 Loaded cscwcng.dll! 0000000140A0 0000004158A0 0 failed resolving functions in cscwcng.dll! 0000000140CC 0000004158CC 0 Connecting... 0000000140DC 0000004158DC 0 Failed opening CSCCNG 0000000140F4 0000004158F4 0 Connected 000000014100 000000415900 0 Finished dispensing, bestCassete:%d, billcount:%d. 000000014134 000000415934 0 User left, cleaning up. 00000001414C 00000041594C 0 Disconnecting... 000000014160 000000415960 0 Failed disconnecting 000000014178 000000415978 0 Disconnected 000000014188 000000415988 0 BUTTON 000000014190 000000415990 0 STATIC 0000000141CC 0000004159CC 0 ENTER 0000000141DC 0000004159DC 0 %010u 000000014672 000000415E72 0 dispenser_NO_TOKEN.exe 000000014689 000000415E89 0 ChooseColorA 000000014696 000000415E96 0 ChooseFontA 0000000146A2 000000415EA2 0 Dispense 0000000146AB 000000415EAB 0 FindTextA 0000000146B5 000000415EB5 0 GetOpenFileNameA 0000000146C6 000000415EC6 0 GetSaveFileNameA 0000000146D7 000000415ED7 0 PrintDlgA 0000000146E1 000000415EE1 0 WNetAddConnection2A 0000000146F5 000000415EF5 0 WNetCancelConnection2A 00000001491E 00000041611E 0 FindFirstFileW 000000014930 000000416130 0 HeapAlloc 00000001493C 00000041613C 0 GetCurrentProcess 000000014950 000000416150 0 HeapFree 00000001495C 00000041615C 0 GetProcessHeap 00000001496E 00000041616E 0 WriteFile 00000001497A 00000041617A 0 Sleep 000000014982 000000416182 0 CreateFileW 000000014990 000000416190 0 FlushFileBuffers 0000000149A4 0000004161A4 0 GetFileSizeEx 0000000149B4 0000004161B4 0 GetLastError 0000000149C4 0000004161C4 0 FindClose 0000000149D0 0000004161D0 0 FindNextFileW 0000000149E0 0000004161E0 0 CloseHandle 0000000149EE 0000004161EE 0 GetWindowsDirectoryW 000000014A06 000000416206 0 DeleteFileW 000000014A14 000000416214 0 LocalFree 000000014A20 000000416220 0 ExpandEnvironmentStringsW File pos Mem pos ID Text ======== ======= == ==== 000000014A3C 00000041623C 0 CreateThread 000000014A4C 00000041624C 0 ExitProcess 000000014A5A 00000041625A 0 lstrlenA 000000014A66 000000416266 0 FreeLibrary 000000014A74 000000416274 0 GetProcAddress 000000014A86 000000416286 0 LoadLibraryA 000000014A96 000000416296 0 GetModuleHandleW 000000014AA8 0000004162A8 0 KERNEL32.dll 000000014AB8 0000004162B8 0 DispatchMessageW 000000014ACC 0000004162CC 0 DefWindowProcW 000000014ADE 0000004162DE 0 CallWindowProcW 000000014AF0 0000004162F0 0 UpdateWindow 000000014B00 000000416300 0 SendMessageW 000000014B10 000000416310 0 MessageBoxW 000000014B1E 00000041631E 0 CreateWindowExW 000000014B30 000000416330 0 ShowWindow 000000014B3E 00000041633E 0 RedrawWindow 000000014B4E 00000041634E 0 SetWindowLongW 000000014B60 000000416360 0 CreateWindowExA 000000014B72 000000416372 0 SetRect 000000014B7C 00000041637C 0 LoadIconW 000000014B88 000000416388 0 RegisterClassExW 000000014B9C 00000041639C 0 TranslateMessage 000000014BB0 0000004163B0 0 BeginPaint 000000014BBE 0000004163BE 0 SendMessageA 000000014BCE 0000004163CE 0 SetFocus 000000014BDA 0000004163DA 0 LoadCursorW 000000014BE8 0000004163E8 0 DrawTextW 000000014BF4 0000004163F4 0 FillRect 000000014C00 000000416400 0 PostQuitMessage 000000014C12 000000416412 0 GetMessageW 000000014C20 000000416420 0 DestroyWindow 000000014C30 000000416430 0 EndPaint 000000014C3A 00000041643A 0 USER32.dll 000000014C48 000000416448 0 OpenProcessToken 000000014C5C 00000041645C 0 GetTokenInformation 000000014C72 000000416472 0 RegDeleteKeyW 000000014C82 000000416482 0 SetNamedSecurityInfoW 000000014C9A 00000041649A 0 LookupPrivilegeValueW 000000014CB2 0000004164B2 0 AllocateAndInitializeSid 000000014CCE 0000004164CE 0 SetEntriesInAclW 000000014CE2 0000004164E2 0 FreeSid 000000014CEC 0000004164EC 0 RegOpenKeyExW 000000014CFC 0000004164FC 0 RegEnumKeyExW 000000014D0C 00000041650C 0 AdjustTokenPrivileges 000000014D24 000000416524 0 RegCloseKey 000000014D30 000000416530 0 ADVAPI32.dll 000000014D40 000000416540 0 GetSystemTimeAsFileTime 000000014D5A 00000041655A 0 GetCommandLineA 000000014D6C 00000041656C 0 IsDebuggerPresent 000000014D80 000000416580 0 IsProcessorFeaturePresent 000000014D9C 00000041659C 0 EncodePointer 000000014DAC 0000004165AC 0 DecodePointer 000000014DBC 0000004165BC 0 IsValidCodePage 000000014DCE 0000004165CE 0 GetACP 000000014DD8 0000004165D8 0 GetOEMCP 000000014DE4 0000004165E4 0 GetCPInfo 000000014DF0 0000004165F0 0 GetStringTypeW 000000014E02 000000416602 0 SetLastError 000000014E12 000000416612 0 GetCurrentThreadId File pos Mem pos ID Text ======== ======= == ==== 000000014E28 000000416628 0 GetModuleHandleExW 000000014E3E 00000041663E 0 MultiByteToWideChar 000000014E54 000000416654 0 WideCharToMultiByte 000000014E6A 00000041666A 0 GetStdHandle 000000014E7A 00000041667A 0 GetFileType 000000014E88 000000416688 0 DeleteCriticalSection 000000014EA0 0000004166A0 0 GetStartupInfoW 000000014EB2 0000004166B2 0 GetModuleFileNameA 000000014EC8 0000004166C8 0 GetModuleFileNameW 000000014EDE 0000004166DE 0 QueryPerformanceCounter 000000014EF8 0000004166F8 0 GetCurrentProcessId 000000014F0E 00000041670E 0 GetEnvironmentStringsW 000000014F28 000000416728 0 FreeEnvironmentStringsW 000000014F42 000000416742 0 UnhandledExceptionFilter 000000014F5E 00000041675E 0 SetUnhandledExceptionFilter 000000014F7C 00000041677C 0 InitializeCriticalSectionAndSpinCount 000000014FA4 0000004167A4 0 TerminateProcess 000000014FB8 0000004167B8 0 TlsAlloc 000000014FC4 0000004167C4 0 TlsGetValue 000000014FD2 0000004167D2 0 TlsSetValue 000000014FE0 0000004167E0 0 TlsFree 000000014FEA 0000004167EA 0 EnterCriticalSection 000000015002 000000416802 0 LeaveCriticalSection 00000001501A 00000041681A 0 GetConsoleCP 00000001502A 00000041682A 0 GetConsoleMode 00000001503C 00000041683C 0 SetFilePointerEx 000000015050 000000416850 0 LCMapStringW 000000015060 000000416860 0 LoadLibraryExW 000000015072 000000416872 0 RtlUnwind 00000001507E 00000041687E 0 OutputDebugStringW 000000015094 000000416894 0 SetStdHandle 0000000150A4 0000004168A4 0 WriteConsoleW 0000000150B4 0000004168B4 0 HeapReAlloc 0000000150C2 0000004168C2 0 HeapSize 0000000153EA 0000004171EA 0 0000000154D1 0000004172D1 0 abcdefghijklmnopqrstuvwxyz 0000000154F1 0000004172F1 0 ABCDEFGHIJKLMNOPQRSTUVWXYZ 00000001560A 00000041740A 0 0000000156EA 0000004174EA 0 abcdefghijklmnopqrstuvwxyz 00000001570A 00000041750A 0 ABCDEFGHIJKLMNOPQRSTUVWXYZ 0000000161D6 000000417FD6 0 z?aUY 000000016218 000000418018 0 zc%C1 00000001626B 00000041806B 0 -64OS 00000001636C 00000041816C 0 k L-zh! 00000001702C 000000418E2C 0 nothing 000000017660 00000041D060 0 <?xml version='1.0' encoding='UTF-8' standalone='yes'?> 000000017699 00000041D099 0 <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> 0000000176E4 00000041D0E4 0 <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> 00000001771C 00000041D11C 0 <security> 00000001772C 00000041D12C 0 <requestedPrivileges> 000000017749 00000041D149 0 <requestedExecutionLevel level='asInvoker' uiAccess='false' /> 000000017791 00000041D191 0 </requestedPrivileges> 0000000177AF 00000041D1AF 0 </security> 0000000177C0 00000041D1C0 0 </trustInfo> 0000000177D0 00000041D1D0 0 </assembly> 000000017811 00000041E011 0 1 1\1c1 000000017823 00000041E023 0 242r2 00000001782D 00000041E02D 0 2V3e3 00000001784D 00000041E04D 0 515h5 000000017855 00000041E055 0 5*6:6B6g6 File pos Mem pos ID Text ======== ======= == ==== 00000001786D 00000041E06D 0 7%7*787=7K7P7a7h7t7z7 00000001788D 00000041E08D 0 808J8d8~8 00000001789F 00000041E09F 0 9&9O9Y9m9s9 0000000178C3 00000041E0C3 0 : :':-:2:9:?:D:K:Q:V:]:c:h:o:u:z: 0000000178F3 00000041E0F3 0 :*;@;)<q< 00000001791B 00000041E11B 0 ?/?8???x? 000000017935 00000041E135 0 0.1m1 00000001793D 00000041E13D 0 1g2q2 000000017949 00000041E149 0 3:4h4x4 00000001796D 00000041E16D 0 5!5-5A5M5S5_5 000000017981 00000041E181 0 546R6t6 0000000179A3 00000041E1A3 0 7"7*727:7B7J7R7Z7b7n7w7}7 0000000179CB 00000041E1CB 0 8 8M8X8 0000000179DB 00000041E1DB 0 9)9:9K9\9m9~9 0000000179F7 00000041E1F7 0 :/:4:V:]:s:x: 000000017A13 00000041E213 0 ;(;/;;;O;\;g; 000000017A3B 00000041E23B 0 <&<.<B<M<\<d<x< 000000017A61 00000041E261 0 =2=<=P=V=e= 000000017A77 00000041E277 0 > >>>O>[> 000000017A81 00000041E281 0 >h>x> 000000017AB9 00000041E2B9 0 141u1 000000017AC1 00000041E2C1 0 :'=.=D=N=r? 000000017AE1 00000041E2E1 0 0d0i0s0 000000017AEB 00000041E2EB 0 1>1E1X1 000000017B19 00000041E319 0 2!2+2;2K2[2d2{2]3 000000017B3B 00000041E33B 0 6 :L; 000000017B58 00000041E358 0 <1@1D1H1L1P1T1X1A2u2 000000017B71 00000041E371 0 3;4B4h4o4 000000017B7F 00000041E37F 0 5i8V9 000000017BAF 00000041E3AF 0 0'0V0 000000017BBF 00000041E3BF 0 1$1=1G1T1 000000017BE7 00000041E3E7 0 5/5>5H5U5_5o5 000000017C13 00000041E413 0 939N9V9d9i9x9 000000017C25 00000041E425 0 :>:Q: 000000017C3B 00000041E43B 0 <"=*= 000000017C4D 00000041E44D 0 >->o> 000000017C59 00000041E459 0 ? ?1? 000000017C68 00000041E468 0 g1z1:2 000000017C77 00000041E477 0 3+434F4Q4V4f4r4w4 000000017C8F 00000041E48F 0 4c5z5 000000017CA7 00000041E4A7 0 6-626>6C6b6 000000017CBB 00000041E4BB 0 7 7A7M7 000000017CC9 00000041E4C9 0 7A8G8N8 000000017CD5 00000041E4D5 0 8?9s9 000000017CEF 00000041E4EF 0 ;3<?<K<Z<e< 000000017D01 00000041E501 0 <"=:=D= 000000017D09 00000041E509 0 =g=m={= 000000017D21 00000041E521 0 >'>v> 000000017D33 00000041E533 0 ?(?1?>?m?u? 000000017D54 00000041E554 0 040?0P0V0f0n0t0 000000017D79 00000041E579 0 1"1+131K1 000000017D83 00000041E583 0 1d1j1q1z1 000000017DBF 00000041E5BF 0 2%2*20282=2C2K2P2V2 000000017DD3 00000041E5D3 0 2c2i2q2v2|2 000000017E0F 00000041E60F 0 3!3'3/343:3B3G3M3U3Z3 000000017E25 00000041E625 0 3h3m3s3{3 000000017E57 00000041E657 0 4'434@4I4 000000017E75 00000041E675 0 6!7;7H7W7a7s7 000000017E93 00000041E693 0 7)868?8c8 000000017EA3 00000041E6A3 0 9H9b9 File pos Mem pos ID Text ======== ======= == ==== 000000017EAF 00000041E6AF 0 :=;F;d; 000000017EBD 00000041E6BD 0 <1=:= 000000017EC3 00000041E6C3 0 >">5>I> 000000017EDD 00000041E6DD 0 1_1h1 000000017EE5 00000041E6E5 0 1!2e2 000000017EFD 00000041E6FD 0 575h5 000000017F13 00000041E713 0 8+8L8 000000017F1F 00000041E71F 0 9f9L:h: 000000017F31 00000041E731 0 ;);2;>;I;p; 000000017F45 00000041E745 0 <&<,<F<X<j<|< 000000017F63 00000041E763 0 ===O=a=s= 000000017F83 00000041E783 0 3@4R4 000000017F8B 00000041E78B 0 5B5P5V5 000000017F95 00000041E795 0 6b7G8Q8W8k8w8 000000017FC9 00000041E7C9 0 9B9H9M9 000000017FE5 00000041E7E5 0 ;#;+; 000000017FFB 00000041E7FB 0 <#<)<5<:<?<D<M< 00000001801B 00000041E81B 0 =o=y= 000000018025 00000041E825 0 >F>e>q>|? 00000001803B 00000041E83B 0 2?2P2V2b2r2x2 000000018069 00000041E869 0 3%3+343:3D3O3 00000001808B 00000041E88B 0 6-686Z6 000000018097 00000041E897 0 7Q7]7 0000000180A5 00000041E8A5 0 7"868z8 0000000180BF 00000041E8BF 0 :(;.;:;q; 0000000180F5 00000041E8F5 0 1@2b3j3 000000018101 00000041E901 0 5>6F6R6a6 000000018111 00000041E911 0 7&;8; 00000001812F 00000041E92F 0 ?+?9? 000000018141 00000041E941 0 1#1+1014181a1 000000018167 00000041E967 0 2 2$2 00000001817D 00000041E97D 0 3A3H3L3P3T3X3\3 0000000181B0 00000041E9B0 0 Q0W0l0 0000000181B9 00000041E9B9 0 0U1o1x1 0000000181CD 00000041E9CD 0 3d3u3 0000000181F7 00000041E9F7 0 :5:<:@:D:H:L:P:T:X: 000000018215 00000041EA15 0 ;%;@;G;L;P;T;u; 000000018237 00000041EA37 0 ;><D<H<L<P< 000000018279 00000041EA79 0 2%252g2 0000000182B7 00000041EAB7 0 7$7,747<7D7L7T7\7d7l7t7|7 0000000182E0 00000041EAE0 0 4<<<D<L<T<\<d<l<t<|< 00000001831B 00000041EB1B 0 =$=,=4=<=D=L=T=\=d=l=t=|= 00000001835B 00000041EB5B 0 >$>,>4><>D>L>T>\>d>l>t>|> 00000001839B 00000041EB9B 0 ?$?,?4?<?D?L?T?\?d?l?t?|? 0000000183E3 00000041EBE3 0 0$0,040<0D0L0T0\0d0l0t0|0 000000018423 00000041EC23 0 1$1,141<1D1L1T1\1d1l1t1|1 000000018463 00000041EC63 0 2$2,242<2D2L2T2\2d2l2t2|2 0000000184A3 00000041ECA3 0 3$3,343<3D3L3P3X3 0000000184B5 00000041ECB5 0 3h3p3x3 0000000184E3 00000041ECE3 0 4 4(40484@4H4P4X4 0000000184F5 00000041ECF5 0 4h4p4x4 000000018523 00000041ED23 0 5 5(50585@5H5P5X5 000000018535 00000041ED35 0 5h5p5x5 000000018563 00000041ED63 0 6 6(60686@6H6P6X6 000000018575 00000041ED75 0 6h6p6x6 0000000185A3 00000041EDA3 0 7 7(70787@7H7P7X7 0000000185B5 00000041EDB5 0 7h7p7x7 0000000185E3 00000041EDE3 0 8 8(80888@8H8P8X8 0000000185F5 00000041EDF5 0 8h8p8x8 000000018623 00000041EE23 0 9 9(90989@9H9P9X9 File pos Mem pos ID Text ======== ======= == ==== 000000018635 00000041EE35 0 9h9p9x9 000000018663 00000041EE63 0 : :(:0:8:@:H:P:X: 0000000186B5 00000041EEB5 0 5 5$5(5,5054585<5@5D5H5L5P5T5X5\5 0000000186D7 00000041EED7 0 5d5h5l5p5t5x5|5 0000000186F1 00000041EEF1 0 ;(;H;h; 000000018705 00000041EF05 0 <8<X<x< 000000018719 00000041EF19 0 =8=D= 00000001876D 00000041EF6D 0 7 7$7(7,7074787<7@7D7H7L7P7T7X7\7 00000001878F 00000041EF8F 0 7l7p7t7x7|7 0000000187E9 00000041EFE9 0 8D8T8d8t8 000000018801 00000041F001 0 8@9H9 000000018823 00000041F023 0 = =$=(=,=0=4=@=D=H=L=P=T=X=\=d=h=p= 00000000FA10 000000411210 0 (null) 00000000FA8B 00000041128B 0 Aja-JP 00000000FA98 000000411298 0 zh-CN 00000000FAA4 0000004112A4 0 ko-KR 00000000FAB0 0000004112B0 0 zh-TW 00000000FC20 000000411420 0 Sunday 00000000FC30 000000411430 0 Monday 00000000FC40 000000411440 0 Tuesday 00000000FC50 000000411450 0 Wednesday 00000000FC64 000000411464 0 Thursday 00000000FC78 000000411478 0 Friday 00000000FC88 000000411488 0 Saturday 00000000FCFC 0000004114FC 0 January 00000000FD0C 00000041150C 0 February 00000000FD20 000000411520 0 March 00000000FD2C 00000041152C 0 April 00000000FD50 000000411550 0 August 00000000FD60 000000411560 0 September 00000000FD74 000000411574 0 October 00000000FD84 000000411584 0 November 00000000FD98 000000411598 0 December 00000000FDBC 0000004115BC 0 MM/dd/yy 00000000FDD0 0000004115D0 0 dddd, MMMM dd, yyyy 00000000FDF8 0000004115F8 0 HH:mm:ss 00000000FE0C 00000041160C 0 en-US 00000000FEB8 0000004116B8 0 mscoree.dll 000000010860 000000412060 0 runtime error 0000000108A0 0000004120A0 0 Program: 0000000108B4 0000004120B4 0 <program name unknown> 0000000108F8 0000004120F8 0 Microsoft Visual C++ Runtime Library 000000010944 000000412144 0 kernel32.dll 000000012288 000000413A88 0 zh-CHS 00000001248C 000000413C8C 0 ar-SA 000000012498 000000413C98 0 bg-BG 0000000124A4 000000413CA4 0 ca-ES 0000000124B0 000000413CB0 0 cs-CZ 0000000124BC 000000413CBC 0 da-DK 0000000124C8 000000413CC8 0 de-DE 0000000124D4 000000413CD4 0 el-GR 0000000124E0 000000413CE0 0 fi-FI 0000000124EC 000000413CEC 0 fr-FR 0000000124F8 000000413CF8 0 he-IL 000000012504 000000413D04 0 hu-HU 000000012510 000000413D10 0 is-IS 00000001251C 000000413D1C 0 it-IT 000000012528 000000413D28 0 nl-NL 000000012534 000000413D34 0 nb-NO 000000012540 000000413D40 0 pl-PL File pos Mem pos ID Text ======== ======= == ==== 00000001254C 000000413D4C 0 pt-BR 000000012558 000000413D58 0 ro-RO 000000012564 000000413D64 0 ru-RU 000000012570 000000413D70 0 hr-HR 00000001257C 000000413D7C 0 sk-SK 000000012588 000000413D88 0 sq-AL 000000012594 000000413D94 0 sv-SE 0000000125A0 000000413DA0 0 th-TH 0000000125AC 000000413DAC 0 tr-TR 0000000125B8 000000413DB8 0 ur-PK 0000000125C4 000000413DC4 0 id-ID 0000000125D0 000000413DD0 0 uk-UA 0000000125DC 000000413DDC 0 be-BY 0000000125E8 000000413DE8 0 sl-SI 0000000125F4 000000413DF4 0 et-EE 000000012600 000000413E00 0 lv-LV 00000001260C 000000413E0C 0 lt-LT 000000012618 000000413E18 0 fa-IR 000000012624 000000413E24 0 vi-VN 000000012630 000000413E30 0 hy-AM 00000001263C 000000413E3C 0 az-AZ-Latn 000000012654 000000413E54 0 eu-ES 000000012660 000000413E60 0 mk-MK 00000001266C 000000413E6C 0 tn-ZA 000000012678 000000413E78 0 xh-ZA 000000012684 000000413E84 0 zu-ZA 000000012690 000000413E90 0 af-ZA 00000001269C 000000413E9C 0 ka-GE 0000000126A8 000000413EA8 0 fo-FO 0000000126B4 000000413EB4 0 hi-IN 0000000126C0 000000413EC0 0 mt-MT 0000000126CC 000000413ECC 0 se-NO 0000000126D8 000000413ED8 0 ms-MY 0000000126E4 000000413EE4 0 kk-KZ 0000000126F0 000000413EF0 0 ky-KG 0000000126FC 000000413EFC 0 sw-KE 000000012708 000000413F08 0 uz-UZ-Latn 000000012720 000000413F20 0 tt-RU 00000001272C 000000413F2C 0 bn-IN 000000012738 000000413F38 0 pa-IN 000000012744 000000413F44 0 gu-IN 000000012750 000000413F50 0 ta-IN 00000001275C 000000413F5C 0 te-IN 000000012768 000000413F68 0 kn-IN 000000012774 000000413F74 0 ml-IN 000000012780 000000413F80 0 mr-IN 00000001278C 000000413F8C 0 sa-IN 000000012798 000000413F98 0 mn-MN 0000000127A4 000000413FA4 0 cy-GB 0000000127B0 000000413FB0 0 gl-ES 0000000127BC 000000413FBC 0 kok-IN 0000000127CC 000000413FCC 0 syr-SY 0000000127DC 000000413FDC 0 div-MV 0000000127EC 000000413FEC 0 quz-BO 0000000127FC 000000413FFC 0 ns-ZA 000000012808 000000414008 0 mi-NZ 000000012814 000000414014 0 ar-IQ 000000012820 000000414020 0 de-CH 00000001282C 00000041402C 0 en-GB 000000012838 000000414038 0 es-MX File pos Mem pos ID Text ======== ======= == ==== 000000012844 000000414044 0 fr-BE 000000012850 000000414050 0 it-CH 00000001285C 00000041405C 0 nl-BE 000000012868 000000414068 0 nn-NO 000000012874 000000414074 0 pt-PT 000000012880 000000414080 0 sr-SP-Latn 000000012898 000000414098 0 sv-FI 0000000128A4 0000004140A4 0 az-AZ-Cyrl 0000000128BC 0000004140BC 0 se-SE 0000000128C8 0000004140C8 0 ms-BN 0000000128D4 0000004140D4 0 uz-UZ-Cyrl 0000000128EC 0000004140EC 0 quz-EC 0000000128FC 0000004140FC 0 ar-EG 000000012908 000000414108 0 zh-HK 000000012914 000000414114 0 de-AT 000000012920 000000414120 0 en-AU 00000001292C 00000041412C 0 es-ES 000000012938 000000414138 0 fr-CA 000000012944 000000414144 0 sr-SP-Cyrl 00000001295C 00000041415C 0 se-FI 000000012968 000000414168 0 quz-PE 000000012978 000000414178 0 ar-LY 000000012984 000000414184 0 zh-SG 000000012990 000000414190 0 de-LU 00000001299C 00000041419C 0 en-CA 0000000129A8 0000004141A8 0 es-GT 0000000129B4 0000004141B4 0 fr-CH 0000000129C0 0000004141C0 0 hr-BA 0000000129CC 0000004141CC 0 smj-NO 0000000129DC 0000004141DC 0 ar-DZ 0000000129E8 0000004141E8 0 zh-MO 0000000129F4 0000004141F4 0 de-LI 000000012A00 000000414200 0 en-NZ 000000012A0C 00000041420C 0 es-CR 000000012A18 000000414218 0 fr-LU 000000012A24 000000414224 0 bs-BA-Latn 000000012A3C 00000041423C 0 smj-SE 000000012A4C 00000041424C 0 ar-MA 000000012A58 000000414258 0 en-IE 000000012A64 000000414264 0 es-PA 000000012A70 000000414270 0 fr-MC 000000012A7C 00000041427C 0 sr-BA-Latn 000000012A94 000000414294 0 sma-NO 000000012AA4 0000004142A4 0 ar-TN 000000012AB0 0000004142B0 0 en-ZA 000000012ABC 0000004142BC 0 es-DO 000000012AC8 0000004142C8 0 sr-BA-Cyrl 000000012AE0 0000004142E0 0 sma-SE 000000012AF0 0000004142F0 0 ar-OM 000000012AFC 0000004142FC 0 en-JM 000000012B08 000000414308 0 es-VE 000000012B14 000000414314 0 sms-FI 000000012B24 000000414324 0 ar-YE 000000012B30 000000414330 0 en-CB 000000012B3C 00000041433C 0 es-CO 000000012B48 000000414348 0 smn-FI 000000012B58 000000414358 0 ar-SY 000000012B64 000000414364 0 en-BZ 000000012B70 000000414370 0 es-PE 000000012B7C 00000041437C 0 ar-JO File pos Mem pos ID Text ======== ======= == ==== 000000012B88 000000414388 0 en-TT 000000012B94 000000414394 0 es-AR 000000012BA0 0000004143A0 0 ar-LB 000000012BAC 0000004143AC 0 en-ZW 000000012BB8 0000004143B8 0 es-EC 000000012BC4 0000004143C4 0 ar-KW 000000012BD0 0000004143D0 0 en-PH 000000012BDC 0000004143DC 0 es-CL 000000012BE8 0000004143E8 0 ar-AE 000000012BF4 0000004143F4 0 es-UY 000000012C00 000000414400 0 ar-BH 000000012C0C 00000041440C 0 es-PY 000000012C18 000000414418 0 ar-QA 000000012C24 000000414424 0 es-BO 000000012C30 000000414430 0 es-SV 000000012C3C 00000041443C 0 es-HN 000000012C48 000000414448 0 es-NI 000000012C54 000000414454 0 es-PR 000000012C60 000000414460 0 zh-CHT 000000012C78 000000414478 0 af-za 000000012C84 000000414484 0 ar-ae 000000012C90 000000414490 0 ar-bh 000000012C9C 00000041449C 0 ar-dz 000000012CA8 0000004144A8 0 ar-eg 000000012CB4 0000004144B4 0 ar-iq 000000012CC0 0000004144C0 0 ar-jo 000000012CCC 0000004144CC 0 ar-kw 000000012CD8 0000004144D8 0 ar-lb 000000012CE4 0000004144E4 0 ar-ly 000000012CF0 0000004144F0 0 ar-ma 000000012CFC 0000004144FC 0 ar-om 000000012D08 000000414508 0 ar-qa 000000012D14 000000414514 0 ar-sa 000000012D20 000000414520 0 ar-sy 000000012D2C 00000041452C 0 ar-tn 000000012D38 000000414538 0 ar-ye 000000012D44 000000414544 0 az-az-cyrl 000000012D5C 00000041455C 0 az-az-latn 000000012D74 000000414574 0 be-by 000000012D80 000000414580 0 bg-bg 000000012D8C 00000041458C 0 bn-in 000000012D98 000000414598 0 bs-ba-latn 000000012DB0 0000004145B0 0 ca-es 000000012DBC 0000004145BC 0 cs-cz 000000012DC8 0000004145C8 0 cy-gb 000000012DD4 0000004145D4 0 da-dk 000000012DE0 0000004145E0 0 de-at 000000012DEC 0000004145EC 0 de-ch 000000012DF8 0000004145F8 0 de-de 000000012E04 000000414604 0 de-li 000000012E10 000000414610 0 de-lu 000000012E1C 00000041461C 0 div-mv 000000012E2C 00000041462C 0 el-gr 000000012E38 000000414638 0 en-au 000000012E44 000000414644 0 en-bz 000000012E50 000000414650 0 en-ca 000000012E5C 00000041465C 0 en-cb 000000012E68 000000414668 0 en-gb 000000012E74 000000414674 0 en-ie 000000012E80 000000414680 0 en-jm File pos Mem pos ID Text ======== ======= == ==== 000000012E8C 00000041468C 0 en-nz 000000012E98 000000414698 0 en-ph 000000012EA4 0000004146A4 0 en-tt 000000012EB0 0000004146B0 0 en-us 000000012EBC 0000004146BC 0 en-za 000000012EC8 0000004146C8 0 en-zw 000000012ED4 0000004146D4 0 es-ar 000000012EE0 0000004146E0 0 es-bo 000000012EEC 0000004146EC 0 es-cl 000000012EF8 0000004146F8 0 es-co 000000012F04 000000414704 0 es-cr 000000012F10 000000414710 0 es-do 000000012F1C 00000041471C 0 es-ec 000000012F28 000000414728 0 es-es 000000012F34 000000414734 0 es-gt 000000012F40 000000414740 0 es-hn 000000012F4C 00000041474C 0 es-mx 000000012F58 000000414758 0 es-ni 000000012F64 000000414764 0 es-pa 000000012F70 000000414770 0 es-pe 000000012F7C 00000041477C 0 es-pr 000000012F88 000000414788 0 es-py 000000012F94 000000414794 0 es-sv 000000012FA0 0000004147A0 0 es-uy 000000012FAC 0000004147AC 0 es-ve 000000012FB8 0000004147B8 0 et-ee 000000012FC4 0000004147C4 0 eu-es 000000012FD0 0000004147D0 0 fa-ir 000000012FDC 0000004147DC 0 fi-fi 000000012FE8 0000004147E8 0 fo-fo 000000012FF4 0000004147F4 0 fr-be 000000013000 000000414800 0 fr-ca 00000001300C 00000041480C 0 fr-ch 000000013018 000000414818 0 fr-fr 000000013024 000000414824 0 fr-lu 000000013030 000000414830 0 fr-mc 00000001303C 00000041483C 0 gl-es 000000013048 000000414848 0 gu-in 000000013054 000000414854 0 he-il 000000013060 000000414860 0 hi-in 00000001306C 00000041486C 0 hr-ba 000000013078 000000414878 0 hr-hr 000000013084 000000414884 0 hu-hu 000000013090 000000414890 0 hy-am 00000001309C 00000041489C 0 id-id 0000000130A8 0000004148A8 0 is-is 0000000130B4 0000004148B4 0 it-ch 0000000130C0 0000004148C0 0 it-it 0000000130CC 0000004148CC 0 ja-jp 0000000130D8 0000004148D8 0 ka-ge 0000000130E4 0000004148E4 0 kk-kz 0000000130F0 0000004148F0 0 kn-in 0000000130FC 0000004148FC 0 kok-in 00000001310C 00000041490C 0 ko-kr 000000013118 000000414918 0 ky-kg 000000013124 000000414924 0 lt-lt 000000013130 000000414930 0 lv-lv 00000001313C 00000041493C 0 mi-nz 000000013148 000000414948 0 mk-mk 000000013154 000000414954 0 ml-in File pos Mem pos ID Text ======== ======= == ==== 000000013160 000000414960 0 mn-mn 00000001316C 00000041496C 0 mr-in 000000013178 000000414978 0 ms-bn 000000013184 000000414984 0 ms-my 000000013190 000000414990 0 mt-mt 00000001319C 00000041499C 0 nb-no 0000000131A8 0000004149A8 0 nl-be 0000000131B4 0000004149B4 0 nl-nl 0000000131C0 0000004149C0 0 nn-no 0000000131CC 0000004149CC 0 ns-za 0000000131D8 0000004149D8 0 pa-in 0000000131E4 0000004149E4 0 pl-pl 0000000131F0 0000004149F0 0 pt-br 0000000131FC 0000004149FC 0 pt-pt 000000013208 000000414A08 0 quz-bo 000000013218 000000414A18 0 quz-ec 000000013228 000000414A28 0 quz-pe 000000013238 000000414A38 0 ro-ro 000000013244 000000414A44 0 ru-ru 000000013250 000000414A50 0 sa-in 00000001325C 000000414A5C 0 se-fi 000000013268 000000414A68 0 se-no 000000013274 000000414A74 0 se-se 000000013280 000000414A80 0 sk-sk 00000001328C 000000414A8C 0 sl-si 000000013298 000000414A98 0 sma-no 0000000132A8 000000414AA8 0 sma-se 0000000132B8 000000414AB8 0 smj-no 0000000132C8 000000414AC8 0 smj-se 0000000132D8 000000414AD8 0 smn-fi 0000000132E8 000000414AE8 0 sms-fi 0000000132F8 000000414AF8 0 sq-al 000000013304 000000414B04 0 sr-ba-cyrl 00000001331C 000000414B1C 0 sr-ba-latn 000000013334 000000414B34 0 sr-sp-cyrl 00000001334C 000000414B4C 0 sr-sp-latn 000000013364 000000414B64 0 sv-fi 000000013370 000000414B70 0 sv-se 00000001337C 000000414B7C 0 sw-ke 000000013388 000000414B88 0 syr-sy 000000013398 000000414B98 0 ta-in 0000000133A4 000000414BA4 0 te-in 0000000133B0 000000414BB0 0 th-th 0000000133BC 000000414BBC 0 tn-za 0000000133C8 000000414BC8 0 tr-tr 0000000133D4 000000414BD4 0 tt-ru 0000000133E0 000000414BE0 0 uk-ua 0000000133EC 000000414BEC 0 ur-pk 0000000133F8 000000414BF8 0 uz-uz-cyrl 000000013410 000000414C10 0 uz-uz-latn 000000013428 000000414C28 0 vi-vn 000000013434 000000414C34 0 xh-za 000000013440 000000414C40 0 zh-chs 000000013450 000000414C50 0 zh-cht 000000013460 000000414C60 0 zh-cn 00000001346C 000000414C6C 0 zh-hk 000000013478 000000414C78 0 zh-mo 000000013484 000000414C84 0 zh-sg 000000013490 000000414C90 0 zh-tw 00000001349C 000000414C9C 0 zu-za File pos Mem pos ID Text ======== ======= == ==== 00000001358B 000000414D8B 0 @USER32.DLL 000000013618 000000414E18 0 CONOUT$ 00000001366C 000000414E6C 0 .AVCHD 0000000136A0 000000414EA0 0 .COLLAB 0000000136C8 000000414EC8 0 .MPEG 000000013728 000000414F28 0 .WRAP 0000000137C0 000000414FC0 0 .WEBM 0000000137D8 000000414FD8 0 .JPEG 0000000137FC 000000414FFC 0 .TIFF 00000001384C 00000041504C 0 .DB.TRX 000000013874 000000415074 0 .EVTX 00000001389C 00000041509C 0 %s\%s 0000000138B4 0000004150B4 0 SeTakeOwnershipPrivilege 0000000138E8 0000004150E8 0 SYSTEM\CurrentControlSet\Enum\STORAGE\RemovableMedia 000000013954 000000415154 0 MACHINE 000000013968 000000415168 0 SYSTEM\CurrentControlSet\Enum\USB 0000000139B0 0000004151B0 0 SYSTEM\CurrentControlSet\Enum\USBSTOR 000000013A00 000000415200 0 SYSTEM\CurrentControlSet\Control\DeviceClasses 000000013A60 000000415260 0 %SystemRoot%\Prefetch 000000013A8C 00000041528C 0 %Windir%\Minidump 000000013AB0 0000004152B0 0 %ProgramData%\Microsoft\Windows\WER 000000013AF8 0000004152F8 0 %LocalAppData%\Microsoft\Windows\WER 000000013B44 000000415344 0 %Windir%\setupapi.log 000000013B70 000000415370 0 %Windir%\setupapi.log.old 000000013BA4 0000004153A4 0 %Windir%\inf\setupapi.app.log 000000013BE0 0000004153E0 0 %Windir%\inf\setupapi.dev.log 000000013C20 000000415420 0 %Windir%\inf\setupapi.offline.log 000000013C68 000000415468 0 %Windir%\inf\setupapi.upgrade.log 0000000141E4 0000004159E4 0 Win32 Guided Tour 000000014208 000000415A08 0 Call to RegisterClassEx failed! 000000014248 000000415A48 0 Call to CreateWindow failed! 0000000163D1 0000004181D1 0 No error 0000000167D0 0000004185D0 0 No cassetes 000000016BD0 0000004189D0 0 le meme about cutting cookie dough 000000016C18 000000418A18 0 No status 000000017018 000000418E18 0 win32app 000000017040 000000418E40 0 No device status 00000000004D 00000040004D 0 !This program cannot be run in DOS mode. 0000000000DE 0000004000DE 0 twRich 0000000001F0 0000004001F0 0 .text 000000000218 000000400218 0 .rdata 00000000023F 00000040023F 0 @.data 000000000268 000000400268 0 .rsrc 00000000028F 00000040028F 0 @.reloc 000000000824 000000401424 0 PSSSSSS 0000000008B5 0000004014B5 0 u(SSS 000000000BFA 0000004017FA 0 PhDSA 000000000C14 000000401814 0 PhpSA 000000000C62 000000401862 0 Ph TA 000000000C7C 00000040187C 0 PhhTA 000000001289 000000401E89 0 Ph\VA 0000000015DF 0000004021DF 0 RVhPWA 000000001841 000000402441 0 D$8SVWj 3 00000000184C 00000040244C 0 D$@CSCCY3 000000001860 000000402460 0 D$@NG 0000000018EC 0000004024EC 0 u2hdXA 000000001B81 000000402781 0 VVVh0$@ 000000001C77 000000402877 0 Qjdjd 000000001DE9 0000004029E9 0 D$ PS 000000001F34 000000402B34 0 D$ PS File pos Mem pos ID Text ======== ======= == ==== 000000001FF0 000000402BF0 0 j2jdZ 0000000021C4 000000402DC4 0 D$\PQQ 00000000227C 000000402E7C 0 SWSSh 0000000032F6 000000403EF6 0 PPPPPPPP 0000000037D0 0000004043D0 0 PPPPP 000000003B10 000000404710 0 t/HHt 000000003B53 000000404753 0 j*Xf; 000000003BB1 0000004047B1 0 j*Xf; 000000003C08 000000404808 0 htHjlZ; 000000003D4B 00000040494B 0 HHtXHHt 000000003F88 000000404B88 0 nt'joZ; 000000004028 000000404C28 0 jgXf; 0000000040FF 000000404CFF 0 YYjgXf9 0000000042B5 000000404EB5 0 >0t<NAj0X 000000004396 000000404F96 0 Wj0XP 0000000044A2 0000004050A2 0 Wj XP 000000004963 000000405563 0 t/HHt 000000004BAF 0000004057AF 0 HHtVHHt 0000000050A6 000000405CA6 0 >0t-N 00000000544F 00000040604F 0 5ntel 00000000545F 00000040605F 0 5Genu 000000006217 000000406E17 0 ~pjCXf 000000006AD1 0000004076D1 0 j@j _W 000000006B91 000000407791 0 } j@W 000000006F3C 000000407B3C 0 < t8< t4 000000007016 000000407C16 0 t@VSP 000000007071 000000407C71 0 PPPPP 0000000071A3 000000407DA3 0 <v5hJ 00000000728B 000000407E8B 0 SSSSS 0000000073EA 000000407FEA 0 SPPP+ 0000000073F3 000000407FF3 0 FVWPP 000000007419 000000408019 0 SVWPP 00000000755B 00000040815B 0 VWhD!A 000000008B0C 00000040970C 0 ~';_t|%3 000000008B20 000000409720 0 wtVj 000000008B35 000000409735 0 ;_tr. 000000008B56 000000409756 0 GWVj 000000008D2B 00000040992B 0 v N+D$ 000000008E3C 000000409A3C 0 QVWSj 0000000096D6 00000040A2D6 0 PP9E u 0000000099AD 00000040A5AD 0 jA[jZZ+ 000000009AE9 00000040A6E9 0 PWWWWV 000000009B84 00000040A784 0 PSSSSV 00000000A25F 00000040AE5F 0 URPQQh 00000000BDBD 00000040C9BD 0 +t"HHt 00000000BE13 00000040CA13 0 9] t" 00000000C9D0 00000040D5D0 0 ,SVWj0X 00000000CB04 00000040D704 0 u'j0X 00000000CC2E 00000040D82E 0 Wj0XPV 00000000CCCD 00000040D8CD 0 PjdSQ 00000000CE36 00000040DA36 0 -jd[; 00000000CE8B 00000040DA8B 0 WWWWW 00000000D3DE 00000040DFDE 0 VVVVV 00000000D463 00000040E063 0 SVWUj 00000000D504 00000040E104 0 ;t$,v- 00000000D589 00000040E189 0 UQPXY]Y[ 00000000E4F2 00000040F0F2 0 PPPPP 00000000E5A6 00000040F1A6 0 v N+D$ 00000000E8DF 00000040F4DF 0 u0h0NA 00000000E8EE 00000040F4EE 0 u!h8NA File pos Mem pos ID Text ======== ======= == ==== 00000000F1CA 00000040FDCA 0 SSSSS 00000000FA08 000000411208 0 (null) 00000000FA41 000000411241 0 ( 8PX 00000000FA49 000000411249 0 700WP 00000000FA61 000000411261 0 xpxxxx 00000000FAD8 0000004112D8 0 Sunday 00000000FAE0 0000004112E0 0 Monday 00000000FAE8 0000004112E8 0 Tuesday 00000000FAF0 0000004112F0 0 Wednesday 00000000FAFC 0000004112FC 0 Thursday 00000000FB08 000000411308 0 Friday 00000000FB10 000000411310 0 Saturday 00000000FB4C 00000041134C 0 January 00000000FB54 000000411354 0 February 00000000FB60 000000411360 0 March 00000000FB68 000000411368 0 April 00000000FB80 000000411380 0 August 00000000FB88 000000411388 0 September 00000000FB94 000000411394 0 October 00000000FB9C 00000041139C 0 November 00000000FBA8 0000004113A8 0 December 00000000FBBC 0000004113BC 0 MM/dd/yy 00000000FBC8 0000004113C8 0 dddd, MMMM dd, yyyy 00000000FBDC 0000004113DC 0 HH:mm:ss 00000000FED0 0000004116D0 0 CorExitProcess 000000010960 000000412160 0 FlsAlloc 00000001096C 00000041216C 0 FlsFree 000000010974 000000412174 0 FlsGetValue 000000010980 000000412180 0 FlsSetValue 00000001098C 00000041218C 0 InitializeCriticalSectionEx 0000000109A8 0000004121A8 0 CreateEventExW 0000000109B8 0000004121B8 0 CreateSemaphoreExW 0000000109CC 0000004121CC 0 SetThreadStackGuarantee 0000000109E4 0000004121E4 0 CreateThreadpoolTimer 0000000109FC 0000004121FC 0 SetThreadpoolTimer 000000010A10 000000412210 0 WaitForThreadpoolTimerCallbacks 000000010A30 000000412230 0 CloseThreadpoolTimer 000000010A48 000000412248 0 CreateThreadpoolWait 000000010A60 000000412260 0 SetThreadpoolWait 000000010A74 000000412274 0 CloseThreadpoolWait 000000010A88 000000412288 0 FlushProcessWriteBuffers 000000010AA4 0000004122A4 0 FreeLibraryWhenCallbackReturns 000000010AC4 0000004122C4 0 GetCurrentProcessorNumber 000000010AE0 0000004122E0 0 GetLogicalProcessorInformation 000000010B00 000000412300 0 CreateSymbolicLinkW 000000010B14 000000412314 0 SetDefaultDllDirectories 000000010B30 000000412330 0 EnumSystemLocalesEx 000000010B44 000000412344 0 CompareStringEx 000000010B54 000000412354 0 GetDateFormatEx 000000010B64 000000412364 0 GetLocaleInfoEx 000000010B74 000000412374 0 GetTimeFormatEx 000000010B84 000000412384 0 GetUserDefaultLocaleName 000000010BA0 0000004123A0 0 IsValidLocaleName 000000010BB4 0000004123B4 0 LCMapStringEx 000000010BC4 0000004123C4 0 GetCurrentPackageId 000000010BD8 0000004123D8 0 GetTickCount64 000000010BE8 0000004123E8 0 GetFileInformationByHandleExW 000000010C08 000000412408 0 SetFileInformationByHandleW 0000000111D0 0000004129D0 0 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\] 000000011211 000000412A11 0 abcdefghijklmnopqrstuvwxyz{|}~ File pos Mem pos ID Text ======== ======= == ==== 000000011350 000000412B50 0 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\] 000000011391 000000412B91 0 ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~ 0000000134CD 000000414CCD 0 ('8PW 0000000134D6 000000414CD6 0 700PP 0000000134F1 000000414CF1 0 xppwpp 000000013527 000000414D27 0 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\] 000000013568 000000414D68 0 abcdefghijklmnopqrstuvwxyz{|}~ 0000000135A4 000000414DA4 0 MessageBoxW 0000000135B0 000000414DB0 0 GetActiveWindow 0000000135C0 000000414DC0 0 GetLastActivePopup 0000000135D4 000000414DD4 0 GetUserObjectInformationW 0000000135F0 000000414DF0 0 GetProcessWindowStation 000000013610 000000414E10 0 e+000 000000013628 000000414E28 0 1#SNAN 000000013630 000000414E30 0 1#IND 000000013638 000000414E38 0 1#INF 000000013640 000000414E40 0 1#QNAN 000000013880 000000415080 0 Deleting: 000000013D88 000000415588 0 CscCngOpen 000000013D94 000000415594 0 CscCngClose 000000013DA0 0000004155A0 0 CscCngLock 000000013DAC 0000004155AC 0 CscCngUnlock 000000013DBC 0000004155BC 0 CscCngDispense 000000013DCC 0000004155CC 0 CscCngTransport 000000013DDC 0000004155DC 0 CscCngStatusRead 000000013DF0 0000004155F0 0 CscCngReset 000000013E04 000000415604 0 Locking CSCCNG... 000000013E18 000000415618 0 Unlocking CSCCNG... 000000013E2C 00000041562C 0 Resetting csccng 000000013E40 000000415640 0 Resetted csccng 000000013E50 000000415650 0 %d,%02d; 000000013E5C 00000041565C 0 Dispensing (%s)... 000000013E70 000000415670 0 Dispense failed 000000013E84 000000415684 0 Success, transporting now. Raw response: %s 000000013EB4 0000004156B4 0 transport waitpos failed 000000013ED0 0000004156D0 0 Transporting to customer... 000000013EEC 0000004156EC 0 transport offer failed 000000013F04 000000415704 0 money not taken 000000013F18 000000415718 0 locking failed 000000013F28 000000415728 0 MaxNotes: %d 000000013F38 000000415738 0 %dSTA 000000013F40 000000415740 0 %dVAL 000000013F48 000000415748 0 %dACT 000000013F50 000000415750 0 CAS%d: %d, %d 000000013F60 000000415760 0 MAX_NOTES 000000013F6C 00000041576C 0 loading cscwcng.dll 000000013F80 000000415780 0 trying cscwcng.dll ... 000000013F98 000000415798 0 cscwcng.dll 000000013FA4 0000004157A4 0 failed finding cscwcng.dll 000000013FC0 0000004157C0 0 trying C:\CSCW32\DLL\cscwcng.dll ... 000000013FE8 0000004157E8 0 C:\CSCW32\DLL\cscwcng.dll 000000014004 000000415804 0 failed finding C:\CSCW32\DLL\cscwcng.dll 000000014030 000000415830 0 trying C:\DLL\cscwcng.dll ... 000000014050 000000415850 0 C:\DLL\cscwcng.dll 000000014064 000000415864 0 failed finding C:\DLL\cscwcng.dll 000000014088 000000415888 0 Loaded cscwcng.dll! 0000000140A0 0000004158A0 0 failed resolving functions in cscwcng.dll! 0000000140CC 0000004158CC 0 Connecting... 0000000140DC 0000004158DC 0 Failed opening CSCCNG 0000000140F4 0000004158F4 0 Connected File pos Mem pos ID Text ======== ======= == ==== 000000014100 000000415900 0 Finished dispensing, bestCassete:%d, billcount:%d. 000000014134 000000415934 0 User left, cleaning up. 00000001414C 00000041594C 0 Disconnecting... 000000014160 000000415960 0 Failed disconnecting 000000014178 000000415978 0 Disconnected 000000014188 000000415988 0 BUTTON 000000014190 000000415990 0 STATIC 0000000141CC 0000004159CC 0 ENTER 0000000141DC 0000004159DC 0 %010u 000000014672 000000415E72 0 dispenser_NO_TOKEN.exe 000000014689 000000415E89 0 ChooseColorA 000000014696 000000415E96 0 ChooseFontA 0000000146A2 000000415EA2 0 Dispense 0000000146AB 000000415EAB 0 FindTextA 0000000146B5 000000415EB5 0 GetOpenFileNameA 0000000146C6 000000415EC6 0 GetSaveFileNameA 0000000146D7 000000415ED7 0 PrintDlgA 0000000146E1 000000415EE1 0 WNetAddConnection2A 0000000146F5 000000415EF5 0 WNetCancelConnection2A 00000001491E 00000041611E 0 FindFirstFileW 000000014930 000000416130 0 HeapAlloc 00000001493C 00000041613C 0 GetCurrentProcess 000000014950 000000416150 0 HeapFree 00000001495C 00000041615C 0 GetProcessHeap 00000001496E 00000041616E 0 WriteFile 00000001497A 00000041617A 0 Sleep 000000014982 000000416182 0 CreateFileW 000000014990 000000416190 0 FlushFileBuffers 0000000149A4 0000004161A4 0 GetFileSizeEx 0000000149B4 0000004161B4 0 GetLastError 0000000149C4 0000004161C4 0 FindClose 0000000149D0 0000004161D0 0 FindNextFileW 0000000149E0 0000004161E0 0 CloseHandle 0000000149EE 0000004161EE 0 GetWindowsDirectoryW 000000014A06 000000416206 0 DeleteFileW 000000014A14 000000416214 0 LocalFree 000000014A20 000000416220 0 ExpandEnvironmentStringsW 000000014A3C 00000041623C 0 CreateThread 000000014A4C 00000041624C 0 ExitProcess 000000014A5A 00000041625A 0 lstrlenA 000000014A66 000000416266 0 FreeLibrary 000000014A74 000000416274 0 GetProcAddress 000000014A86 000000416286 0 LoadLibraryA 000000014A96 000000416296 0 GetModuleHandleW 000000014AA8 0000004162A8 0 KERNEL32.dll 000000014AB8 0000004162B8 0 DispatchMessageW 000000014ACC 0000004162CC 0 DefWindowProcW 000000014ADE 0000004162DE 0 CallWindowProcW 000000014AF0 0000004162F0 0 UpdateWindow 000000014B00 000000416300 0 SendMessageW 000000014B10 000000416310 0 MessageBoxW 000000014B1E 00000041631E 0 CreateWindowExW 000000014B30 000000416330 0 ShowWindow 000000014B3E 00000041633E 0 RedrawWindow 000000014B4E 00000041634E 0 SetWindowLongW 000000014B60 000000416360 0 CreateWindowExA 000000014B72 000000416372 0 SetRect 000000014B7C 00000041637C 0 LoadIconW 000000014B88 000000416388 0 RegisterClassExW 000000014B9C 00000041639C 0 TranslateMessage File pos Mem pos ID Text ======== ======= == ==== 000000014BB0 0000004163B0 0 BeginPaint 000000014BBE 0000004163BE 0 SendMessageA 000000014BCE 0000004163CE 0 SetFocus 000000014BDA 0000004163DA 0 LoadCursorW 000000014BE8 0000004163E8 0 DrawTextW 000000014BF4 0000004163F4 0 FillRect 000000014C00 000000416400 0 PostQuitMessage 000000014C12 000000416412 0 GetMessageW 000000014C20 000000416420 0 DestroyWindow 000000014C30 000000416430 0 EndPaint 000000014C3A 00000041643A 0 USER32.dll 000000014C48 000000416448 0 OpenProcessToken 000000014C5C 00000041645C 0 GetTokenInformation 000000014C72 000000416472 0 RegDeleteKeyW 000000014C82 000000416482 0 SetNamedSecurityInfoW 000000014C9A 00000041649A 0 LookupPrivilegeValueW 000000014CB2 0000004164B2 0 AllocateAndInitializeSid 000000014CCE 0000004164CE 0 SetEntriesInAclW 000000014CE2 0000004164E2 0 FreeSid 000000014CEC 0000004164EC 0 RegOpenKeyExW 000000014CFC 0000004164FC 0 RegEnumKeyExW 000000014D0C 00000041650C 0 AdjustTokenPrivileges 000000014D24 000000416524 0 RegCloseKey 000000014D30 000000416530 0 ADVAPI32.dll 000000014D40 000000416540 0 GetSystemTimeAsFileTime 000000014D5A 00000041655A 0 GetCommandLineA 000000014D6C 00000041656C 0 IsDebuggerPresent 000000014D80 000000416580 0 IsProcessorFeaturePresent 000000014D9C 00000041659C 0 EncodePointer 000000014DAC 0000004165AC 0 DecodePointer 000000014DBC 0000004165BC 0 IsValidCodePage 000000014DCE 0000004165CE 0 GetACP 000000014DD8 0000004165D8 0 GetOEMCP 000000014DE4 0000004165E4 0 GetCPInfo 000000014DF0 0000004165F0 0 GetStringTypeW 000000014E02 000000416602 0 SetLastError 000000014E12 000000416612 0 GetCurrentThreadId 000000014E28 000000416628 0 GetModuleHandleExW 000000014E3E 00000041663E 0 MultiByteToWideChar 000000014E54 000000416654 0 WideCharToMultiByte 000000014E6A 00000041666A 0 GetStdHandle 000000014E7A 00000041667A 0 GetFileType 000000014E88 000000416688 0 DeleteCriticalSection 000000014EA0 0000004166A0 0 GetStartupInfoW 000000014EB2 0000004166B2 0 GetModuleFileNameA 000000014EC8 0000004166C8 0 GetModuleFileNameW 000000014EDE 0000004166DE 0 QueryPerformanceCounter 000000014EF8 0000004166F8 0 GetCurrentProcessId 000000014F0E 00000041670E 0 GetEnvironmentStringsW 000000014F28 000000416728 0 FreeEnvironmentStringsW 000000014F42 000000416742 0 UnhandledExceptionFilter 000000014F5E 00000041675E 0 SetUnhandledExceptionFilter 000000014F7C 00000041677C 0 InitializeCriticalSectionAndSpinCount 000000014FA4 0000004167A4 0 TerminateProcess 000000014FB8 0000004167B8 0 TlsAlloc 000000014FC4 0000004167C4 0 TlsGetValue 000000014FD2 0000004167D2 0 TlsSetValue 000000014FE0 0000004167E0 0 TlsFree 000000014FEA 0000004167EA 0 EnterCriticalSection 000000015002 000000416802 0 LeaveCriticalSection File pos Mem pos ID Text ======== ======= == ==== 00000001501A 00000041681A 0 GetConsoleCP 00000001502A 00000041682A 0 GetConsoleMode 00000001503C 00000041683C 0 SetFilePointerEx 000000015050 000000416850 0 LCMapStringW 000000015060 000000416860 0 LoadLibraryExW 000000015072 000000416872 0 RtlUnwind 00000001507E 00000041687E 0 OutputDebugStringW 000000015094 000000416894 0 SetStdHandle 0000000150A4 0000004168A4 0 WriteConsoleW 0000000150B4 0000004168B4 0 HeapReAlloc 0000000150C2 0000004168C2 0 HeapSize 0000000153EA 0000004171EA 0 0000000154D1 0000004172D1 0 abcdefghijklmnopqrstuvwxyz 0000000154F1 0000004172F1 0 ABCDEFGHIJKLMNOPQRSTUVWXYZ 00000001560A 00000041740A 0 0000000156EA 0000004174EA 0 abcdefghijklmnopqrstuvwxyz 00000001570A 00000041750A 0 ABCDEFGHIJKLMNOPQRSTUVWXYZ 0000000161D6 000000417FD6 0 z?aUY 000000016218 000000418018 0 zc%C1 00000001626B 00000041806B 0 -64OS 00000001636C 00000041816C 0 k L-zh! 00000001702C 000000418E2C 0 nothing 000000017660 00000041D060 0 <?xml version='1.0' encoding='UTF-8' standalone='yes'?> 000000017699 00000041D099 0 <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> 0000000176E4 00000041D0E4 0 <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> 00000001771C 00000041D11C 0 <security> 00000001772C 00000041D12C 0 <requestedPrivileges> 000000017749 00000041D149 0 <requestedExecutionLevel level='asInvoker' uiAccess='false' /> 000000017791 00000041D191 0 </requestedPrivileges> 0000000177AF 00000041D1AF 0 </security> 0000000177C0 00000041D1C0 0 </trustInfo> 0000000177D0 00000041D1D0 0 </assembly> 000000017811 00000041E011 0 1 1\1c1 000000017823 00000041E023 0 242r2 00000001782D 00000041E02D 0 2V3e3 00000001784D 00000041E04D 0 515h5 000000017855 00000041E055 0 5*6:6B6g6 00000001786D 00000041E06D 0 7%7*787=7K7P7a7h7t7z7 00000001788D 00000041E08D 0 808J8d8~8 00000001789F 00000041E09F 0 9&9O9Y9m9s9 0000000178C3 00000041E0C3 0 : :':-:2:9:?:D:K:Q:V:]:c:h:o:u:z: 0000000178F3 00000041E0F3 0 :*;@;)<q< 00000001791B 00000041E11B 0 ?/?8???x? 000000017935 00000041E135 0 0.1m1 00000001793D 00000041E13D 0 1g2q2 000000017949 00000041E149 0 3:4h4x4 00000001796D 00000041E16D 0 5!5-5A5M5S5_5 000000017981 00000041E181 0 546R6t6 0000000179A3 00000041E1A3 0 7"7*727:7B7J7R7Z7b7n7w7}7 0000000179CB 00000041E1CB 0 8 8M8X8 0000000179DB 00000041E1DB 0 9)9:9K9\9m9~9 0000000179F7 00000041E1F7 0 :/:4:V:]:s:x: 000000017A13 00000041E213 0 ;(;/;;;O;\;g; 000000017A3B 00000041E23B 0 <&<.<B<M<\<d<x< 000000017A61 00000041E261 0 =2=<=P=V=e= 000000017A77 00000041E277 0 > >>>O>[> 000000017A81 00000041E281 0 >h>x> 000000017AB9 00000041E2B9 0 141u1 000000017AC1 00000041E2C1 0 :'=.=D=N=r? 000000017AE1 00000041E2E1 0 0d0i0s0 File pos Mem pos ID Text ======== ======= == ==== 000000017AEB 00000041E2EB 0 1>1E1X1 000000017B19 00000041E319 0 2!2+2;2K2[2d2{2]3 000000017B3B 00000041E33B 0 6 :L; 000000017B58 00000041E358 0 <1@1D1H1L1P1T1X1A2u2 000000017B71 00000041E371 0 3;4B4h4o4 000000017B7F 00000041E37F 0 5i8V9 000000017BAF 00000041E3AF 0 0'0V0 000000017BBF 00000041E3BF 0 1$1=1G1T1 000000017BE7 00000041E3E7 0 5/5>5H5U5_5o5 000000017C13 00000041E413 0 939N9V9d9i9x9 000000017C25 00000041E425 0 :>:Q: 000000017C3B 00000041E43B 0 <"=*= 000000017C4D 00000041E44D 0 >->o> 000000017C59 00000041E459 0 ? ?1? 000000017C68 00000041E468 0 g1z1:2 000000017C77 00000041E477 0 3+434F4Q4V4f4r4w4 000000017C8F 00000041E48F 0 4c5z5 000000017CA7 00000041E4A7 0 6-626>6C6b6 000000017CBB 00000041E4BB 0 7 7A7M7 000000017CC9 00000041E4C9 0 7A8G8N8 000000017CD5 00000041E4D5 0 8?9s9 000000017CEF 00000041E4EF 0 ;3<?<K<Z<e< 000000017D01 00000041E501 0 <"=:=D= 000000017D09 00000041E509 0 =g=m={= 000000017D21 00000041E521 0 >'>v> 000000017D33 00000041E533 0 ?(?1?>?m?u? 000000017D54 00000041E554 0 040?0P0V0f0n0t0 000000017D79 00000041E579 0 1"1+131K1 000000017D83 00000041E583 0 1d1j1q1z1 000000017DBF 00000041E5BF 0 2%2*20282=2C2K2P2V2 000000017DD3 00000041E5D3 0 2c2i2q2v2|2 000000017E0F 00000041E60F 0 3!3'3/343:3B3G3M3U3Z3 000000017E25 00000041E625 0 3h3m3s3{3 000000017E57 00000041E657 0 4'434@4I4 000000017E75 00000041E675 0 6!7;7H7W7a7s7 000000017E93 00000041E693 0 7)868?8c8 000000017EA3 00000041E6A3 0 9H9b9 000000017EAF 00000041E6AF 0 :=;F;d; 000000017EBD 00000041E6BD 0 <1=:= 000000017EC3 00000041E6C3 0 >">5>I> 000000017EDD 00000041E6DD 0 1_1h1 000000017EE5 00000041E6E5 0 1!2e2 000000017EFD 00000041E6FD 0 575h5 000000017F13 00000041E713 0 8+8L8 000000017F1F 00000041E71F 0 9f9L:h: 000000017F31 00000041E731 0 ;);2;>;I;p; 000000017F45 00000041E745 0 <&<,<F<X<j<|< 000000017F63 00000041E763 0 ===O=a=s= 000000017F83 00000041E783 0 3@4R4 000000017F8B 00000041E78B 0 5B5P5V5 000000017F95 00000041E795 0 6b7G8Q8W8k8w8 000000017FC9 00000041E7C9 0 9B9H9M9 000000017FE5 00000041E7E5 0 ;#;+; 000000017FFB 00000041E7FB 0 <#<)<5<:<?<D<M< 00000001801B 00000041E81B 0 =o=y= 000000018025 00000041E825 0 >F>e>q>|? 00000001803B 00000041E83B 0 2?2P2V2b2r2x2 000000018069 00000041E869 0 3%3+343:3D3O3 00000001808B 00000041E88B 0 6-686Z6 000000018097 00000041E897 0 7Q7]7 File pos Mem pos ID Text ======== ======= == ==== 0000000180A5 00000041E8A5 0 7"868z8 0000000180BF 00000041E8BF 0 :(;.;:;q; 0000000180F5 00000041E8F5 0 1@2b3j3 000000018101 00000041E901 0 5>6F6R6a6 000000018111 00000041E911 0 7&;8; 00000001812F 00000041E92F 0 ?+?9? 000000018141 00000041E941 0 1#1+1014181a1 000000018167 00000041E967 0 2 2$2 00000001817D 00000041E97D 0 3A3H3L3P3T3X3\3 0000000181B0 00000041E9B0 0 Q0W0l0 0000000181B9 00000041E9B9 0 0U1o1x1 0000000181CD 00000041E9CD 0 3d3u3 0000000181F7 00000041E9F7 0 :5:<:@:D:H:L:P:T:X: 000000018215 00000041EA15 0 ;%;@;G;L;P;T;u; 000000018237 00000041EA37 0 ;><D<H<L<P< 000000018279 00000041EA79 0 2%252g2 0000000182B7 00000041EAB7 0 7$7,747<7D7L7T7\7d7l7t7|7 0000000182E0 00000041EAE0 0 4<<<D<L<T<\<d<l<t<|< 00000001831B 00000041EB1B 0 =$=,=4=<=D=L=T=\=d=l=t=|= 00000001835B 00000041EB5B 0 >$>,>4><>D>L>T>\>d>l>t>|> 00000001839B 00000041EB9B 0 ?$?,?4?<?D?L?T?\?d?l?t?|? 0000000183E3 00000041EBE3 0 0$0,040<0D0L0T0\0d0l0t0|0 000000018423 00000041EC23 0 1$1,141<1D1L1T1\1d1l1t1|1 000000018463 00000041EC63 0 2$2,242<2D2L2T2\2d2l2t2|2 0000000184A3 00000041ECA3 0 3$3,343<3D3L3P3X3 0000000184B5 00000041ECB5 0 3h3p3x3 0000000184E3 00000041ECE3 0 4 4(40484@4H4P4X4 0000000184F5 00000041ECF5 0 4h4p4x4 000000018523 00000041ED23 0 5 5(50585@5H5P5X5 000000018535 00000041ED35 0 5h5p5x5 000000018563 00000041ED63 0 6 6(60686@6H6P6X6 000000018575 00000041ED75 0 6h6p6x6 0000000185A3 00000041EDA3 0 7 7(70787@7H7P7X7 0000000185B5 00000041EDB5 0 7h7p7x7 0000000185E3 00000041EDE3 0 8 8(80888@8H8P8X8 0000000185F5 00000041EDF5 0 8h8p8x8 000000018623 00000041EE23 0 9 9(90989@9H9P9X9 000000018635 00000041EE35 0 9h9p9x9 000000018663 00000041EE63 0 : :(:0:8:@:H:P:X: 0000000186B5 00000041EEB5 0 5 5$5(5,5054585<5@5D5H5L5P5T5X5\5 0000000186D7 00000041EED7 0 5d5h5l5p5t5x5|5 0000000186F1 00000041EEF1 0 ;(;H;h; 000000018705 00000041EF05 0 <8<X<x< 000000018719 00000041EF19 0 =8=D= 00000001876D 00000041EF6D 0 7 7$7(7,7074787<7@7D7H7L7P7T7X7\7 00000001878F 00000041EF8F 0 7l7p7t7x7|7 0000000187E9 00000041EFE9 0 8D8T8d8t8 000000018801 00000041F001 0 8@9H9 000000018823 00000041F023 0 = =$=(=,=0=4=@=D=H=L=P=T=X=\=d=h=p= 00000000FA10 000000411210 0 (null) 00000000FA8B 00000041128B 0 Aja-JP 00000000FA98 000000411298 0 zh-CN 00000000FAA4 0000004112A4 0 ko-KR 00000000FAB0 0000004112B0 0 zh-TW 00000000FC20 000000411420 0 Sunday 00000000FC30 000000411430 0 Monday 00000000FC40 000000411440 0 Tuesday 00000000FC50 000000411450 0 Wednesday 00000000FC64 000000411464 0 Thursday 00000000FC78 000000411478 0 Friday File pos Mem pos ID Text ======== ======= == ==== 00000000FC88 000000411488 0 Saturday 00000000FCFC 0000004114FC 0 January 00000000FD0C 00000041150C 0 February 00000000FD20 000000411520 0 March 00000000FD2C 00000041152C 0 April 00000000FD50 000000411550 0 August 00000000FD60 000000411560 0 September 00000000FD74 000000411574 0 October 00000000FD84 000000411584 0 November 00000000FD98 000000411598 0 December 00000000FDBC 0000004115BC 0 MM/dd/yy 00000000FDD0 0000004115D0 0 dddd, MMMM dd, yyyy 00000000FDF8 0000004115F8 0 HH:mm:ss 00000000FE0C 00000041160C 0 en-US 00000000FEB8 0000004116B8 0 mscoree.dll 000000010860 000000412060 0 runtime error 0000000108A0 0000004120A0 0 Program: 0000000108B4 0000004120B4 0 <program name unknown> 0000000108F8 0000004120F8 0 Microsoft Visual C++ Runtime Library 000000010944 000000412144 0 kernel32.dll 000000012288 000000413A88 0 zh-CHS 00000001248C 000000413C8C 0 ar-SA 000000012498 000000413C98 0 bg-BG 0000000124A4 000000413CA4 0 ca-ES 0000000124B0 000000413CB0 0 cs-CZ 0000000124BC 000000413CBC 0 da-DK 0000000124C8 000000413CC8 0 de-DE 0000000124D4 000000413CD4 0 el-GR 0000000124E0 000000413CE0 0 fi-FI 0000000124EC 000000413CEC 0 fr-FR 0000000124F8 000000413CF8 0 he-IL 000000012504 000000413D04 0 hu-HU 000000012510 000000413D10 0 is-IS 00000001251C 000000413D1C 0 it-IT 000000012528 000000413D28 0 nl-NL 000000012534 000000413D34 0 nb-NO 000000012540 000000413D40 0 pl-PL 00000001254C 000000413D4C 0 pt-BR 000000012558 000000413D58 0 ro-RO 000000012564 000000413D64 0 ru-RU 000000012570 000000413D70 0 hr-HR 00000001257C 000000413D7C 0 sk-SK 000000012588 000000413D88 0 sq-AL 000000012594 000000413D94 0 sv-SE 0000000125A0 000000413DA0 0 th-TH 0000000125AC 000000413DAC 0 tr-TR 0000000125B8 000000413DB8 0 ur-PK 0000000125C4 000000413DC4 0 id-ID 0000000125D0 000000413DD0 0 uk-UA 0000000125DC 000000413DDC 0 be-BY 0000000125E8 000000413DE8 0 sl-SI 0000000125F4 000000413DF4 0 et-EE 000000012600 000000413E00 0 lv-LV 00000001260C 000000413E0C 0 lt-LT 000000012618 000000413E18 0 fa-IR 000000012624 000000413E24 0 vi-VN 000000012630 000000413E30 0 hy-AM 00000001263C 000000413E3C 0 az-AZ-Latn 000000012654 000000413E54 0 eu-ES 000000012660 000000413E60 0 mk-MK File pos Mem pos ID Text ======== ======= == ==== 00000001266C 000000413E6C 0 tn-ZA 000000012678 000000413E78 0 xh-ZA 000000012684 000000413E84 0 zu-ZA 000000012690 000000413E90 0 af-ZA 00000001269C 000000413E9C 0 ka-GE 0000000126A8 000000413EA8 0 fo-FO 0000000126B4 000000413EB4 0 hi-IN 0000000126C0 000000413EC0 0 mt-MT 0000000126CC 000000413ECC 0 se-NO 0000000126D8 000000413ED8 0 ms-MY 0000000126E4 000000413EE4 0 kk-KZ 0000000126F0 000000413EF0 0 ky-KG 0000000126FC 000000413EFC 0 sw-KE 000000012708 000000413F08 0 uz-UZ-Latn 000000012720 000000413F20 0 tt-RU 00000001272C 000000413F2C 0 bn-IN 000000012738 000000413F38 0 pa-IN 000000012744 000000413F44 0 gu-IN 000000012750 000000413F50 0 ta-IN 00000001275C 000000413F5C 0 te-IN 000000012768 000000413F68 0 kn-IN 000000012774 000000413F74 0 ml-IN 000000012780 000000413F80 0 mr-IN 00000001278C 000000413F8C 0 sa-IN 000000012798 000000413F98 0 mn-MN 0000000127A4 000000413FA4 0 cy-GB 0000000127B0 000000413FB0 0 gl-ES 0000000127BC 000000413FBC 0 kok-IN 0000000127CC 000000413FCC 0 syr-SY 0000000127DC 000000413FDC 0 div-MV 0000000127EC 000000413FEC 0 quz-BO 0000000127FC 000000413FFC 0 ns-ZA 000000012808 000000414008 0 mi-NZ 000000012814 000000414014 0 ar-IQ 000000012820 000000414020 0 de-CH 00000001282C 00000041402C 0 en-GB 000000012838 000000414038 0 es-MX 000000012844 000000414044 0 fr-BE 000000012850 000000414050 0 it-CH 00000001285C 00000041405C 0 nl-BE 000000012868 000000414068 0 nn-NO 000000012874 000000414074 0 pt-PT 000000012880 000000414080 0 sr-SP-Latn 000000012898 000000414098 0 sv-FI 0000000128A4 0000004140A4 0 az-AZ-Cyrl 0000000128BC 0000004140BC 0 se-SE 0000000128C8 0000004140C8 0 ms-BN 0000000128D4 0000004140D4 0 uz-UZ-Cyrl 0000000128EC 0000004140EC 0 quz-EC 0000000128FC 0000004140FC 0 ar-EG 000000012908 000000414108 0 zh-HK 000000012914 000000414114 0 de-AT 000000012920 000000414120 0 en-AU 00000001292C 00000041412C 0 es-ES 000000012938 000000414138 0 fr-CA 000000012944 000000414144 0 sr-SP-Cyrl 00000001295C 00000041415C 0 se-FI 000000012968 000000414168 0 quz-PE 000000012978 000000414178 0 ar-LY 000000012984 000000414184 0 zh-SG File pos Mem pos ID Text ======== ======= == ==== 000000012990 000000414190 0 de-LU 00000001299C 00000041419C 0 en-CA 0000000129A8 0000004141A8 0 es-GT 0000000129B4 0000004141B4 0 fr-CH 0000000129C0 0000004141C0 0 hr-BA 0000000129CC 0000004141CC 0 smj-NO 0000000129DC 0000004141DC 0 ar-DZ 0000000129E8 0000004141E8 0 zh-MO 0000000129F4 0000004141F4 0 de-LI 000000012A00 000000414200 0 en-NZ 000000012A0C 00000041420C 0 es-CR 000000012A18 000000414218 0 fr-LU 000000012A24 000000414224 0 bs-BA-Latn 000000012A3C 00000041423C 0 smj-SE 000000012A4C 00000041424C 0 ar-MA 000000012A58 000000414258 0 en-IE 000000012A64 000000414264 0 es-PA 000000012A70 000000414270 0 fr-MC 000000012A7C 00000041427C 0 sr-BA-Latn 000000012A94 000000414294 0 sma-NO 000000012AA4 0000004142A4 0 ar-TN 000000012AB0 0000004142B0 0 en-ZA 000000012ABC 0000004142BC 0 es-DO 000000012AC8 0000004142C8 0 sr-BA-Cyrl 000000012AE0 0000004142E0 0 sma-SE 000000012AF0 0000004142F0 0 ar-OM 000000012AFC 0000004142FC 0 en-JM 000000012B08 000000414308 0 es-VE 000000012B14 000000414314 0 sms-FI 000000012B24 000000414324 0 ar-YE 000000012B30 000000414330 0 en-CB 000000012B3C 00000041433C 0 es-CO 000000012B48 000000414348 0 smn-FI 000000012B58 000000414358 0 ar-SY 000000012B64 000000414364 0 en-BZ 000000012B70 000000414370 0 es-PE 000000012B7C 00000041437C 0 ar-JO 000000012B88 000000414388 0 en-TT 000000012B94 000000414394 0 es-AR 000000012BA0 0000004143A0 0 ar-LB 000000012BAC 0000004143AC 0 en-ZW 000000012BB8 0000004143B8 0 es-EC 000000012BC4 0000004143C4 0 ar-KW 000000012BD0 0000004143D0 0 en-PH 000000012BDC 0000004143DC 0 es-CL 000000012BE8 0000004143E8 0 ar-AE 000000012BF4 0000004143F4 0 es-UY 000000012C00 000000414400 0 ar-BH 000000012C0C 00000041440C 0 es-PY 000000012C18 000000414418 0 ar-QA 000000012C24 000000414424 0 es-BO 000000012C30 000000414430 0 es-SV 000000012C3C 00000041443C 0 es-HN 000000012C48 000000414448 0 es-NI 000000012C54 000000414454 0 es-PR 000000012C60 000000414460 0 zh-CHT 000000012C78 000000414478 0 af-za 000000012C84 000000414484 0 ar-ae 000000012C90 000000414490 0 ar-bh 000000012C9C 00000041449C 0 ar-dz File pos Mem pos ID Text ======== ======= == ==== 000000012CA8 0000004144A8 0 ar-eg 000000012CB4 0000004144B4 0 ar-iq 000000012CC0 0000004144C0 0 ar-jo 000000012CCC 0000004144CC 0 ar-kw 000000012CD8 0000004144D8 0 ar-lb 000000012CE4 0000004144E4 0 ar-ly 000000012CF0 0000004144F0 0 ar-ma 000000012CFC 0000004144FC 0 ar-om 000000012D08 000000414508 0 ar-qa 000000012D14 000000414514 0 ar-sa 000000012D20 000000414520 0 ar-sy 000000012D2C 00000041452C 0 ar-tn 000000012D38 000000414538 0 ar-ye 000000012D44 000000414544 0 az-az-cyrl 000000012D5C 00000041455C 0 az-az-latn 000000012D74 000000414574 0 be-by 000000012D80 000000414580 0 bg-bg 000000012D8C 00000041458C 0 bn-in 000000012D98 000000414598 0 bs-ba-latn 000000012DB0 0000004145B0 0 ca-es 000000012DBC 0000004145BC 0 cs-cz 000000012DC8 0000004145C8 0 cy-gb 000000012DD4 0000004145D4 0 da-dk 000000012DE0 0000004145E0 0 de-at 000000012DEC 0000004145EC 0 de-ch 000000012DF8 0000004145F8 0 de-de 000000012E04 000000414604 0 de-li 000000012E10 000000414610 0 de-lu 000000012E1C 00000041461C 0 div-mv 000000012E2C 00000041462C 0 el-gr 000000012E38 000000414638 0 en-au 000000012E44 000000414644 0 en-bz 000000012E50 000000414650 0 en-ca 000000012E5C 00000041465C 0 en-cb 000000012E68 000000414668 0 en-gb 000000012E74 000000414674 0 en-ie 000000012E80 000000414680 0 en-jm 000000012E8C 00000041468C 0 en-nz 000000012E98 000000414698 0 en-ph 000000012EA4 0000004146A4 0 en-tt 000000012EB0 0000004146B0 0 en-us 000000012EBC 0000004146BC 0 en-za 000000012EC8 0000004146C8 0 en-zw 000000012ED4 0000004146D4 0 es-ar 000000012EE0 0000004146E0 0 es-bo 000000012EEC 0000004146EC 0 es-cl 000000012EF8 0000004146F8 0 es-co 000000012F04 000000414704 0 es-cr 000000012F10 000000414710 0 es-do 000000012F1C 00000041471C 0 es-ec 000000012F28 000000414728 0 es-es 000000012F34 000000414734 0 es-gt 000000012F40 000000414740 0 es-hn 000000012F4C 00000041474C 0 es-mx 000000012F58 000000414758 0 es-ni 000000012F64 000000414764 0 es-pa 000000012F70 000000414770 0 es-pe 000000012F7C 00000041477C 0 es-pr 000000012F88 000000414788 0 es-py 000000012F94 000000414794 0 es-sv File pos Mem pos ID Text ======== ======= == ==== 000000012FA0 0000004147A0 0 es-uy 000000012FAC 0000004147AC 0 es-ve 000000012FB8 0000004147B8 0 et-ee 000000012FC4 0000004147C4 0 eu-es 000000012FD0 0000004147D0 0 fa-ir 000000012FDC 0000004147DC 0 fi-fi 000000012FE8 0000004147E8 0 fo-fo 000000012FF4 0000004147F4 0 fr-be 000000013000 000000414800 0 fr-ca 00000001300C 00000041480C 0 fr-ch 000000013018 000000414818 0 fr-fr 000000013024 000000414824 0 fr-lu 000000013030 000000414830 0 fr-mc 00000001303C 00000041483C 0 gl-es 000000013048 000000414848 0 gu-in 000000013054 000000414854 0 he-il 000000013060 000000414860 0 hi-in 00000001306C 00000041486C 0 hr-ba 000000013078 000000414878 0 hr-hr 000000013084 000000414884 0 hu-hu 000000013090 000000414890 0 hy-am 00000001309C 00000041489C 0 id-id 0000000130A8 0000004148A8 0 is-is 0000000130B4 0000004148B4 0 it-ch 0000000130C0 0000004148C0 0 it-it 0000000130CC 0000004148CC 0 ja-jp 0000000130D8 0000004148D8 0 ka-ge 0000000130E4 0000004148E4 0 kk-kz 0000000130F0 0000004148F0 0 kn-in 0000000130FC 0000004148FC 0 kok-in 00000001310C 00000041490C 0 ko-kr 000000013118 000000414918 0 ky-kg 000000013124 000000414924 0 lt-lt 000000013130 000000414930 0 lv-lv 00000001313C 00000041493C 0 mi-nz 000000013148 000000414948 0 mk-mk 000000013154 000000414954 0 ml-in 000000013160 000000414960 0 mn-mn 00000001316C 00000041496C 0 mr-in 000000013178 000000414978 0 ms-bn 000000013184 000000414984 0 ms-my 000000013190 000000414990 0 mt-mt 00000001319C 00000041499C 0 nb-no 0000000131A8 0000004149A8 0 nl-be 0000000131B4 0000004149B4 0 nl-nl 0000000131C0 0000004149C0 0 nn-no 0000000131CC 0000004149CC 0 ns-za 0000000131D8 0000004149D8 0 pa-in 0000000131E4 0000004149E4 0 pl-pl 0000000131F0 0000004149F0 0 pt-br 0000000131FC 0000004149FC 0 pt-pt 000000013208 000000414A08 0 quz-bo 000000013218 000000414A18 0 quz-ec 000000013228 000000414A28 0 quz-pe 000000013238 000000414A38 0 ro-ro 000000013244 000000414A44 0 ru-ru 000000013250 000000414A50 0 sa-in 00000001325C 000000414A5C 0 se-fi 000000013268 000000414A68 0 se-no 000000013274 000000414A74 0 se-se File pos Mem pos ID Text ======== ======= == ==== 000000013280 000000414A80 0 sk-sk 00000001328C 000000414A8C 0 sl-si 000000013298 000000414A98 0 sma-no 0000000132A8 000000414AA8 0 sma-se 0000000132B8 000000414AB8 0 smj-no 0000000132C8 000000414AC8 0 smj-se 0000000132D8 000000414AD8 0 smn-fi 0000000132E8 000000414AE8 0 sms-fi 0000000132F8 000000414AF8 0 sq-al 000000013304 000000414B04 0 sr-ba-cyrl 00000001331C 000000414B1C 0 sr-ba-latn 000000013334 000000414B34 0 sr-sp-cyrl 00000001334C 000000414B4C 0 sr-sp-latn 000000013364 000000414B64 0 sv-fi 000000013370 000000414B70 0 sv-se 00000001337C 000000414B7C 0 sw-ke 000000013388 000000414B88 0 syr-sy 000000013398 000000414B98 0 ta-in 0000000133A4 000000414BA4 0 te-in 0000000133B0 000000414BB0 0 th-th 0000000133BC 000000414BBC 0 tn-za 0000000133C8 000000414BC8 0 tr-tr 0000000133D4 000000414BD4 0 tt-ru 0000000133E0 000000414BE0 0 uk-ua 0000000133EC 000000414BEC 0 ur-pk 0000000133F8 000000414BF8 0 uz-uz-cyrl 000000013410 000000414C10 0 uz-uz-latn 000000013428 000000414C28 0 vi-vn 000000013434 000000414C34 0 xh-za 000000013440 000000414C40 0 zh-chs 000000013450 000000414C50 0 zh-cht 000000013460 000000414C60 0 zh-cn 00000001346C 000000414C6C 0 zh-hk 000000013478 000000414C78 0 zh-mo 000000013484 000000414C84 0 zh-sg 000000013490 000000414C90 0 zh-tw 00000001349C 000000414C9C 0 zu-za 00000001358B 000000414D8B 0 @USER32.DLL 000000013618 000000414E18 0 CONOUT$ 00000001366C 000000414E6C 0 .AVCHD 0000000136A0 000000414EA0 0 .COLLAB 0000000136C8 000000414EC8 0 .MPEG 000000013728 000000414F28 0 .WRAP 0000000137C0 000000414FC0 0 .WEBM 0000000137D8 000000414FD8 0 .JPEG 0000000137FC 000000414FFC 0 .TIFF 00000001384C 00000041504C 0 .DB.TRX 000000013874 000000415074 0 .EVTX 00000001389C 00000041509C 0 %s\%s 0000000138B4 0000004150B4 0 SeTakeOwnershipPrivilege 0000000138E8 0000004150E8 0 SYSTEM\CurrentControlSet\Enum\STORAGE\RemovableMedia 000000013954 000000415154 0 MACHINE 000000013968 000000415168 0 SYSTEM\CurrentControlSet\Enum\USB 0000000139B0 0000004151B0 0 SYSTEM\CurrentControlSet\Enum\USBSTOR 000000013A00 000000415200 0 SYSTEM\CurrentControlSet\Control\DeviceClasses 000000013A60 000000415260 0 %SystemRoot%\Prefetch 000000013A8C 00000041528C 0 %Windir%\Minidump 000000013AB0 0000004152B0 0 %ProgramData%\Microsoft\Windows\WER 000000013AF8 0000004152F8 0 %LocalAppData%\Microsoft\Windows\WER 000000013B44 000000415344 0 %Windir%\setupapi.log File pos Mem pos ID Text ======== ======= == ==== 000000013B70 000000415370 0 %Windir%\setupapi.log.old 000000013BA4 0000004153A4 0 %Windir%\inf\setupapi.app.log 000000013BE0 0000004153E0 0 %Windir%\inf\setupapi.dev.log 000000013C20 000000415420 0 %Windir%\inf\setupapi.offline.log 000000013C68 000000415468 0 %Windir%\inf\setupapi.upgrade.log 0000000141E4 0000004159E4 0 Win32 Guided Tour 000000014208 000000415A08 0 Call to RegisterClassEx failed! 000000014248 000000415A48 0 Call to CreateWindow failed! 0000000163D1 0000004181D1 0 No error 0000000167D0 0000004185D0 0 No cassetes 000000016BD0 0000004189D0 0 le meme about cutting cookie dough 000000016C18 000000418A18 0 No status 000000017018 000000418E18 0 win32app 000000017040 000000418E40 0 No device status
=== DOWNLOAD === Mirror provided by vx-underground.org, thx!