PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 2,04 MBSHA-256 Hash: 3E15995894F38B2EEAD95F7FF714585471F34F3AF3D8F50A7F83344781502468 SHA-1 Hash: 8ED888A02861142E5EB576385568C2BA0DDD8589 MD5 Hash: 223B222CE387A7F446D49A1EE9B572BB Imphash: BDAFB39CFEE2E23FE0C8AE87EF4F1EA1 MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 002176A6 EntryPoint (rva): BA150 SizeOfHeaders: 400 SizeOfImage: 221000 ImageBase: 0000000140000000 Architecture: x64 ImportTable: 139FC8 IAT: F1000 Characteristics: 22 TimeDateStamp: 66745DB8 Date: 20/06/2024 16:50:00 File Type: EXE Number Of Sections: 7 ASLR: Disabled Section Names (Optional Header): .text, .rdata, .data, .pdata, _RDATA, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI UAC Execution Level Manifest: asInvoker |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | EF200 | 1000 | EF17C |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
EF600 | 4C800 | F1000 | 4C752 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
13BE00 | 7800 | 13E000 | 1AF14 |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
143600 | 9400 | 159000 | 93CC |
|
|
| _RDATA | 0x40000040 Initialized Data Readable |
14CA00 | 400 | 163000 | 280 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
14CE00 | BA400 | 164000 | BA3D0 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
207200 | 1800 | 21F000 | 1754 |
|
|
| Description |
| OriginalFilename: Process Monitor CompanyName: Sysinternals - www.sysinternals.com LegalCopyright: https://www.sysinternals.com ProductName: Sysinternals Procmon FileVersion: 4.01 FileDescription: HungWindowFromGhostWindow ProductVersion: 4.01 Language: English (United States) (ID=0x409) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Binder/Joiner/Crypter |
| 2 Executable files found |
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - B9550 Code -> 4883EC28E8770400004883C428E97AFEFFFFCCCC4883611000488D05F885050048894108488D05ED8D0300488901488BC1C3 Assembler |SUB RSP, 0X28 |CALL 0X1480 |ADD RSP, 0X28 |JMP 0XE8C |INT3 |INT3 |AND QWORD PTR [RCX + 0X10], 0 |LEA RAX, [RIP + 0X585F8] |MOV QWORD PTR [RCX + 8], RAX |LEA RAX, [RIP + 0X38DED] |MOV QWORD PTR [RCX], RAX |MOV RAX, RCX |RET |
| Signatures |
| Rich Signature Analyzer: Code -> FCC079EDB8A117BEB8A117BEB8A117BEF3D912BF00A117BEB8A117BEB9A117BE7A2012BFD9A117BE7A2013BFA9A117BE7A2014BFA8A117BECE3C6CBEBAA117BEF3D914BFBFA117BEF3D913BFA0A117BEB8A116BE83A317BEF3D916BFA7A117BE4B2313BFBAA117BE4B2312BFF1A117BE4B23E8BEB9A117BEB8A180BEB9A117BE4B2315BFB9A117BE52696368B8A117BE Footprint md5 Hash -> 2DFE0DDAB6FEF779825E232060BE2E17 • The Rich header apparently has not been modified Certificate - Digital Signature: • The file is signed and the signature is correct |
| Packer/Compiler |
| Compiler: Microsoft Visual Studio Detect It Easy (die) • PE+(64): compiler: Microsoft Visual C/C++(-)[-] • PE+(64): linker: Microsoft Linker(14.39**)[-] • PE+(64): Sign tool: Windows Authenticode(2.0)[PKCS 7] • Entropy: 5.41069 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | WriteFile | Possible Call API By Name | Writes data to a specified file or input/output (I/O) device. |
| Ws2_32.DLL | socket | Possible Call API By Name | Create a communication endpoint for networking applications. |
| Ws2_32.DLL | connect | Possible Call API By Name | Establish a connection to a specified socket. |
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | CreateToolhelp32Snapshot | Creates a snapshot of the specified processes, heaps, threads, and modules. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| USER32.DLL | GetAsyncKeyState | Retrieves the status of a virtual key asynchronously. |
| Ws2_32.DLL | socket | Create a communication endpoint for networking applications. |
| SHELL32.DLL | ShellExecuteW | Performs a run operation on a specific file. |
| SHELL32.DLL | ShellExecuteExW | Performs a run operation on a specific file. |
| NtosKrnl.exe | ZwClose | Closes a handle to an object. |
| NtosKrnl.exe | ZwCreateFile | Creates or opens a file or I/O device. |
| NtosKrnl.exe | ZwCreateKey | Creates a registry key or opens an existing registry key. |
| NtosKrnl.exe | ZwOpenKey | Opens a registry key. |
| NtosKrnl.exe | ZwOpenProcess | Opens a process object. |
| NtosKrnl.exe | ZwSetInformationFile | Sets information about a file. |
| NtosKrnl.exe | ZwSetInformationThread | Sets thread-specific information. |
| NtosKrnl.exe | ZwSetSecurityObject | Sets the security descriptor of an object. |
| NtosKrnl.exe | ZwSetValueKey | Sets a value for a registry key. |
| NtosKrnl.exe | ZwWaitForSingleObject | Waits for a specified object to reach a signaled state. |
| NtosKrnl.exe | ZwWriteFile | Writes data to a file or device. |
| NtosKrnl.exe | ZwOpenProcess | Possible Call API By Name | Opens a process object. |
| NtosKrnl.exe | ZwOpenProcessTokenEx | Possible Call API By Name | Opens an access token associated with a process. |
| Windows REG (UNICODE) |
| Software\Sysinternals\%s Software\Microsoft\windows nt\currentversion Software\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels Software\Sysinternals SOFTWARE\Microsoft\Windows NT\CurrentVersion SOFTWARE\CLASSES Software\Classes Software\Classes\ Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice Software\Microsoft\Windows\DWM Software\Microsoft\Windows NT\CurrentVersion Software\Microsoft\Windows\CurrentVersion\Policies\System Software\Sysinternals\Process Monitor32 Software\Sysinternals\Process Monitor System\CurrentControlSet\Services\PROCMON24 System\CurrentControlSet\Services\PROCMON24\Enum System\CurrentControlSet\Services\PROCMON24\Security System\CurrentControlSet\Services\PROCMON24\Parameters SYSTEM\Select SYSTEM\CURRENTCONTROLSET\HARDWARE PROFILES\CURRENT SYSTEM\ControlSet System\CurrentControlSet System\CurrentControlSet\Control\Class |
| File Access |
| ntoskrnl.exe HAL.dll ntdll.dll dwmapi.dll UxTheme.dll SHLWAPI.dll OLEAUT32.dll ole32.dll SHELL32.dll ADVAPI32.dll COMDLG32.dll GDI32.dll USER32.dll KERNEL32.dll FLTLIB.DLL COMCTL32.dll VERSION.dll WS2_32.dll atlthunk.dll //www.sys FLTMGR.SYS .dat H.dat @.dat Temp WinDir |
| File Access (UNICODE) |
| Sysinternals - www.sys www.sys Ntkrpamp.exe ntkrnlpa.exe Ntkrnlmp.exe ntoskrnl.exe 64.exe regedit.exe Procexp64.exe Procmon64.exe Autoruns.exe Procexp.exe Procmon.exe DbgHelp.dll The version of Dbghelp.dll mscoree.dll user32.dll Dbghelp DLL (dbghelp.dll *.dll Specify dbghelp.dll dbghelp.dll URLMON.DLL Kernel32.dll advapi32.dll Ntdll.dll \fltlib.dll kernel32.dll comctl32.dll Advapi32.dll ntdll.dll dwmapi.dll uxtheme.dll Shell32.dll Riched32.dll procmon.Sys Procmon.sys pagefile.sys \Drivers\PROCMON24.SYS PROCMON24.SYS //www.sys ril.Sys You bear the risk of using it.Sys ProcMon.Log Temp |
| Interest's Words |
| ToolBar PassWord exec attrib start shutdown systeminfo ping expand replace |
| Interest's Words (UNICODE) |
| ToolBar Encrypt Encryption PassWord exec attrib start regedit shutdown defrag ping dism expand replace |
| Anti-VM/Sandbox/Debug Tricks |
| LabTools - procmon |
| Anti-VM/Sandbox/Debug Tricks (UNICODE) |
| LabTools - procexp LabTools - procmon LabTools - regedit OllyDbg Libary - dbghelp.dll |
| URLs |
| http://www.microsoft.com/pkiops/crl/Microsoft%20Windows%20Third%20Party%20Component%20CA%202012.crl http://www.microsoft.com/pkiops/certs/Microsoft%20Windows%20Third%20Party%20Component%20CA%202012.crt http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt http://www.microsoft.com/pkiops/Docs/Repository.htm http://schemas.microsoft.com/SMI/2005/WindowsSettings http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt http://www.microsoft.com/pkiops/docs/primarycps.htm https://go.microsoft.com/fwlink/?LinkId=521839 https://go.microsoft.com/fwlink/?LinkId=521839\ul0\cf0}}}}\f0\fs20 https://microsoft.com/exporting https://microsoft.com/exporting}}}}\f0\fs19 https://www.sysinternals.com |
| URLs (UNICODE) |
| http://www.microsoft.com/whdc/devtools/debugging/default.mspx https://www.sysinternals.com https://sysinternals.com/downloads/procmon https://msdl.microsoft.com/download/symbols |
| PE Carving |
| Start Offset Header | End Offset | Size (Bytes) |
|---|---|---|
| 0 | 1F1E58 | 1F1E58 |
| 1F1E58 | 20B1B8 | 19360 |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Unicode | WinAPI Sockets (bind) |
| Text | Unicode | WinAPI Sockets (accept) |
| Text | Ascii | WinAPI Sockets (connect) |
| Text | Unicode | WinAPI Sockets (connect) |
| Text | Ascii | Registry (RegCreateKeyEx) |
| Text | Ascii | Registry (RegOpenKeyEx) |
| Text | Ascii | Registry (RegSetValueEx) |
| Text | Ascii | Registry (RegDeleteKeyEx) |
| Text | Ascii | Registry (RegGetValue) |
| Text | Ascii | File (GetTempPath) |
| Text | Ascii | File (CreateFile) |
| Text | Unicode | File (CreateFile) |
| Text | Ascii | File (WriteFile) |
| Text | Unicode | File (WriteFile) |
| Text | Ascii | File (ReadFile) |
| Text | Unicode | File (ReadFile) |
| Text | Ascii | Anti-Analysis VM (IsDebuggerPresent) |
| Text | Ascii | Anti-Analysis VM (GetSystemInfo) |
| Text | Ascii | Anti-Analysis VM (GlobalMemoryStatusEx) |
| Text | Ascii | Anti-Analysis VM (GetVersion) |
| Text | Ascii | Anti-Analysis VM (CreateToolhelp32Snapshot) |
| Text | Ascii | Reconnaissance (FindFirstFileW) |
| Text | Ascii | Reconnaissance (FindNextFileW) |
| Text | Ascii | Reconnaissance (FindClose) |
| Text | Ascii | Stealth (GetThreadContext) |
| Text | Ascii | Stealth (ExitThread) |
| Text | Ascii | Stealth (ReleaseSemaphore) |
| Text | Ascii | Stealth (CloseHandle) |
| Text | Ascii | Stealth (UnmapViewOfFile) |
| Text | Ascii | Stealth (MapViewOfFile) |
| Text | Ascii | Stealth (CreateFileMappingW) |
| Text | Ascii | Stealth (VirtualAlloc) |
| Text | Ascii | Stealth (VirtualProtect) |
| Text | Ascii | Execution (CreateProcessW) |
| Text | Ascii | Execution (ShellExecute) |
| Text | Ascii | Execution (ResumeThread) |
| Text | Ascii | Execution (NtResumeThread) |
| Text | Ascii | Execution (CreateSemaphoreW) |
| Text | Ascii | Execution (CreateEventW) |
| Text | Unicode | Privileges (SeChangeNotifyPrivilege) |
| Text | Unicode | Privileges (SeDebugPrivilege) |
| Text | Unicode | Privileges (SeIncreaseBasePriorityPrivilege) |
| Text | Unicode | Privileges (SeIncreaseWorkingSetPrivilege) |
| Text | Unicode | Privileges (SeLoadDriverPrivilege) |
| Text | Unicode | Privileges (SeShutdownPrivilege) |
| Text | Unicode | Privileges (SeTimeZonePrivilege) |
| Text | Unicode | Privileges (SeUndockPrivilege) |
| Text | Ascii | Keyboard Key (Scroll) |
| Text | Unicode | Keyboard Key (Scroll) |
| Text | Unicode | Keyboard Key (Ctrl+A) |
| Text | Unicode | Keyboard Key (Ctrl+C) |
| Text | Unicode | Keyboard Key (Ctrl+P) |
| Text | Unicode | Keyboard Key (Ctrl+S) |
| Text | Unicode | Keyboard Key (Ctrl+T) |
| Text | Unicode | Binary (ntkrnlpa.exe) |
| Text | Unicode | Software that records user activity (Logger) |
| Text | Unicode | Malicious rerouting of traffic to an attacker-controlled site (Redirect) |
| Text | Unicode | Technique used to circumvent security measures (Bypass) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text | PE/Payload |
|---|---|---|---|---|---|---|
| \AFX_DIALOG_LAYOUT\ABOUTBOX\1033 | 208838 | 2 | 1F1638 | 0000 | .. | N/A |
| \AFX_DIALOG_LAYOUT\BOOTLOG_OPTIONS\1033 | 208B00 | 2 | 1F1900 | 0000 | .. | N/A |
| \AFX_DIALOG_LAYOUT\COLUMNCHOOSER\1033 | 208840 | 2 | 1F1640 | 0000 | .. | N/A |
| \AFX_DIALOG_LAYOUT\FILTER_CONTROL\1033 | 208B50 | 4A | 1F1950 | 0000000000000000000000000000000000000000000064000000640000000000000064000000000000000000000000000000640000000000000064000000000000000000000064006400 | ......................d...d.......d...............d.......d...........d.d. | N/A |
| \AFX_DIALOG_LAYOUT\HISTORY_DEPTH\1033 | 208830 | 2 | 1F1630 | 0000 | .. | N/A |
| \AFX_DIALOG_LAYOUT\ORGANIZE_FILTERS\1033 | 208F28 | 2 | 1F1D28 | 0000 | .. | N/A |
| \AFX_DIALOG_LAYOUT\PROGRESS\1033 | 208F78 | 2 | 1F1D78 | 0000 | .. | N/A |
| \AFX_DIALOG_LAYOUT\SAVE\1033 | 2088A8 | 2 | 1F16A8 | 0000 | .. | N/A |
| \AFX_DIALOG_LAYOUT\SAVE_FILTER\1033 | 208F68 | 2 | 1F1D68 | 0000 | .. | N/A |
| \AFX_DIALOG_LAYOUT\USAGE\1033 | 208828 | 2 | 1F1628 | 0000 | .. | N/A |
| \AFX_DIALOG_LAYOUT\147\1033 | 208848 | 5A | 1F1648 | 000064006400000000000000000064006400640064000000000000006400640000000000640000000000000064000000000000006400640000006400640000000000000000000000000000006400000000000000640000000000 | ..d.d.........d.d.d.d.......d.d.....d.......d.......d.d...d.d...............d.......d..... | N/A |
| \AFX_DIALOG_LAYOUT\150\1033 | 2088B0 | 32 | 1F16B0 | 0000640064000000000064006400000000000000000064006400000064000000000000000000000000000000640000000000 | ..d.d.....d.d.........d.d...d...............d..... | N/A |
| \AFX_DIALOG_LAYOUT\152\1033 | 2088E8 | 32 | 1F16E8 | 0000640064000000000064006400000000000000000064006400000064000000000000000000000000000000640000000000 | ..d.d.....d.d.........d.d...d...............d..... | N/A |
| \AFX_DIALOG_LAYOUT\153\1033 | 208920 | 82 | 1F1720 | 0000640064000000000064006400000000006400640000000000000064000000000000000000000000000000640000000000 | ..d.d.....d.d.....d.d.......d...............d..... | N/A |
| \AFX_DIALOG_LAYOUT\155\1033 | 2089A8 | 6A | 1F17A8 | 0000640064000000000000000000000000000000000064000000000000000000000000000000640000000000000000000000 | ..d.d.................d...............d........... | N/A |
| \AFX_DIALOG_LAYOUT\156\1033 | 208A18 | 6A | 1F1818 | 0000640064000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | ..d.d............................................. | N/A |
| \AFX_DIALOG_LAYOUT\159\1033 | 208A88 | 3A | 1F1888 | 00006400640000000000000000000000000000006400000000006400640000000000640064000000000000006400000000000000000064006400 | ..d.d...............d.....d.d.....d.d.......d.........d.d. | N/A |
| \AFX_DIALOG_LAYOUT\160\1033 | 208AC8 | 32 | 1F18C8 | 0000640064000000000064006400000000000000000064006400000064000000000000000000000000000000640000000000 | ..d.d.....d.d.........d.d...d...............d..... | N/A |
| \AFX_DIALOG_LAYOUT\174\1033 | 208DF8 | BA | 1F1BF8 | 0000640064000000000000000000000000000000640000000000000064006400000000006400000000000000640064000000 | ..d.d...............d.......d.d.....d.......d.d... | N/A |
| \AFX_DIALOG_LAYOUT\179\1033 | 208D70 | 82 | 1F1B70 | 0000000000000000000000000000640000000000000000000000000000006400000000000000000000000000000064000000 | ..............d...............d...............d... | N/A |
| \AFX_DIALOG_LAYOUT\180\1033 | 208C58 | 112 | 1F1A58 | 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | .................................................. | N/A |
| \AFX_DIALOG_LAYOUT\181\1033 | 208EB8 | 32 | 1F1CB8 | 0000000000006400640064006400000000006400640000000000640064000000000064006400000000000000640064000000 | ......d.d.d.d.....d.d.....d.d.....d.d.......d.d... | N/A |
| \AFX_DIALOG_LAYOUT\182\1033 | 208EF0 | 32 | 1F1CF0 | 0000000000006400640000006400000000000000640000000000000064000000000064006400000000006400640000000000 | ......d.d...d.......d.......d.....d.d.....d.d..... | N/A |
| \AFX_DIALOG_LAYOUT\184\1033 | 208BA0 | 2A | 1F19A0 | 000000000000640064006400640000000000640064000000000064006400000000000000000000000000 | ......d.d.d.d.....d.d.....d.d............. | N/A |
| \AFX_DIALOG_LAYOUT\185\1033 | 208C20 | 32 | 1F1A20 | 0000000000000000000000000000000000000000000064006400640064000000000064006400000000006400640000000000 | ......................d.d.d.d.....d.d.....d.d..... | N/A |
| \AFX_DIALOG_LAYOUT\186\1033 | 208B08 | 32 | 1F1908 | 0000640064000000000064006400000000000000640064000000000000000000000000000000640064000000640000000000 | ..d.d.....d.d.......d.d...............d.d...d..... | N/A |
| \AFX_DIALOG_LAYOUT\187\1033 | 208B40 | A | 1F1940 | 00000000000064006400 | ......d.d. | N/A |
| \AFX_DIALOG_LAYOUT\188\1033 | 208F30 | 32 | 1F1D30 | 0000000000000000000000000000640064006400640000000000640064000000000064006400000000000000640000000000 | ..............d.d.d.d.....d.d.....d.d.......d..... | N/A |
| \AFX_DIALOG_LAYOUT\189\1033 | 208F70 | 2 | 1F1D70 | 0000 | .. | N/A |
| \AFX_DIALOG_LAYOUT\190\1033 | 208F80 | D2 | 1F1D80 | 00006400640000000000000000000000000000000C000000000000001900000000000000000064000C0000000C0064000C00 | ..d.d.................................d.......d... | N/A |
| \AFX_DIALOG_LAYOUT\191\1033 | 208BD0 | 4A | 1F19D0 | 0000640064000000000064006400000000000000000000000000000000000000000064000000000000000000000064006400000064000000000000006400000000000000640064000000 | ..d.d.....d.d.....................d...........d.d...d.......d.......d.d... | N/A |
| \BINRES\RCDRIVERNT\1033 | 209058 | 141A8 | 1F1E58 | 4D5A90000300000004000000FFFF0000B8000000000000004000000000000000000000000000000000000000000000000000 | MZ......................@......................... | (Executable found) |
| \INI\DARKTHEME\1033 | 167A68 | 497 | 150868 | 5B47656E6572616C5D0D0A4E616D653D4461726B0D0A4261636B436F6C6F723D33302C33302C33300D0A54657874436F6C6F | [General]..Name=Dark..BackColor=30,30,30..TextColo | N/A |
| \CURSOR\161\1033 | 208588 | 134 | 1F1388 | 0F0010002800000020000000400000000100010000000000800000000000000000000000020000000200000000000000FFFF | ....(... ...@..................................... | N/A |
| \CURSOR\162\1033 | 2086D8 | 134 | 1F14D8 | 0D0010002800000020000000400000000100010000000000800000000000000000000000020000000200000000000000FFFF | ....(... ...@..................................... | N/A |
| \ICON\1\1033 | 167F00 | 8405 | 150D00 | 89504E470D0A1A0A0000000D49484452000001000000010008060000005C72A8660000200049444154789CECBD598C1E5976 | .PNG........IHDR.............\r.f.. .IDATx...Y..Yv | N/A |
| \ICON\2\1033 | 170308 | 4228 | 159108 | 2800000040000000800000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (...@......... ................................... | N/A |
| \ICON\3\1033 | 174530 | 25A8 | 15D330 | 2800000030000000600000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (...0........ ................................... | N/A |
| \ICON\4\1033 | 176AD8 | 10A8 | 15F8D8 | 2800000020000000400000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... | N/A |
| \ICON\5\1033 | 177B80 | 988 | 160980 | 2800000018000000300000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......0..... ................................... | N/A |
| \ICON\6\1033 | 178508 | 468 | 161308 | 2800000010000000200000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (....... ..... ................................... | N/A |
| \ICON\7\1033 | 1789D0 | 128 | 1617D0 | 2800000010000000200000000100040000000000C00000000000000000000000000000000000000000000000000080000080 | (....... ......................................... | N/A |
| \ICON\8\1033 | 178B10 | 128 | 161910 | 2800000010000000200000000100040000000000C00000000000000000000000000000000000000000000000000080000080 | (....... ......................................... | N/A |
| \ICON\9\1033 | 178C50 | 25A8 | 161A50 | 2800000030000000600000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (...0........ ................................... | N/A |
| \ICON\10\1033 | 17B1F8 | 10A8 | 163FF8 | 2800000020000000400000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... | N/A |
| \ICON\11\1033 | 17C2A0 | CD8 | 1650A0 | 280000001C000000380000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......8..... ................................... | N/A |
| \ICON\12\1033 | 17CF78 | 988 | 165D78 | 2800000018000000300000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......0..... ................................... | N/A |
| \ICON\13\1033 | 17D900 | 6B8 | 166700 | 2800000014000000280000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......(..... ................................... | N/A |
| \ICON\14\1033 | 17DFB8 | 468 | 166DB8 | 2800000010000000200000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (....... ..... ................................... | N/A |
| \ICON\15\1033 | 17E480 | 25A8 | 167280 | 2800000030000000600000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (...0........ ................................... | N/A |
| \ICON\16\1033 | 180A28 | 10A8 | 169828 | 2800000020000000400000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... | N/A |
| \ICON\17\1033 | 181AD0 | CD8 | 16A8D0 | 280000001C000000380000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......8..... ................................... | N/A |
| \ICON\18\1033 | 1827A8 | 988 | 16B5A8 | 2800000018000000300000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......0..... ................................... | N/A |
| \ICON\19\1033 | 183130 | 6B8 | 16BF30 | 2800000014000000280000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......(..... ................................... | N/A |
| \ICON\20\1033 | 1837E8 | 468 | 16C5E8 | 2800000010000000200000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (....... ..... ................................... | N/A |
| \ICON\21\1033 | 183CB0 | 128 | 16CAB0 | 2800000010000000200000000100040000000000800000000000000000000000100000001000000000000000000080000080 | (....... ......................................... | N/A |
| \ICON\22\1033 | 183DF0 | 568 | 16CBF0 | 2800000010000000200000000100080000000000000100000000000000000000000100000001000000000000000080000080 | (....... ......................................... | N/A |
| \ICON\23\1033 | 184358 | 128 | 16D158 | 2800000010000000200000000100040000000000800000000000000000000000100000001000000000000000000080000080 | (....... ......................................... | N/A |
| \ICON\24\1033 | 1844A8 | 128 | 16D2A8 | 2800000010000000200000000100040000000000800000000000000000000000100000001000000000000000000080000080 | (....... ......................................... | N/A |
| \ICON\25\1033 | 1845D0 | 568 | 16D3D0 | 2800000010000000200000000100080000000000000100000000000000000000000100000001000000000000000080000080 | (....... ......................................... | N/A |
| \ICON\26\1033 | 184B60 | 25A8 | 16D960 | 2800000030000000600000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (...0........ ................................... | N/A |
| \ICON\27\1033 | 187108 | 10A8 | 16FF08 | 2800000020000000400000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... | N/A |
| \ICON\28\1033 | 1881B0 | CD8 | 170FB0 | 280000001C000000380000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......8..... ................................... | N/A |
| \ICON\29\1033 | 188E88 | 988 | 171C88 | 2800000018000000300000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......0..... ................................... | N/A |
| \ICON\30\1033 | 189810 | 6B8 | 172610 | 2800000014000000280000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......(..... ................................... | N/A |
| \ICON\31\1033 | 189EC8 | 468 | 172CC8 | 2800000010000000200000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (....... ..... ................................... | N/A |
| \ICON\32\1033 | 18A390 | 25A8 | 173190 | 2800000030000000600000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (...0........ ................................... | N/A |
| \ICON\33\1033 | 18C938 | 10A8 | 175738 | 2800000020000000400000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... | N/A |
| \ICON\34\1033 | 18D9E0 | CD8 | 1767E0 | 280000001C000000380000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......8..... ................................... | N/A |
| \ICON\35\1033 | 18E6B8 | 988 | 1774B8 | 2800000018000000300000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......0..... ................................... | N/A |
| \ICON\36\1033 | 18F040 | 6B8 | 177E40 | 2800000014000000280000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......(..... ................................... | N/A |
| \ICON\37\1033 | 18F6F8 | 468 | 1784F8 | 2800000010000000200000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (....... ..... ................................... | N/A |
| \ICON\38\1033 | 18FBC0 | 25A8 | 1789C0 | 2800000030000000600000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (...0........ ................................... | N/A |
| \ICON\39\1033 | 192168 | 10A8 | 17AF68 | 2800000020000000400000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... | N/A |
| \ICON\40\1033 | 193210 | CD8 | 17C010 | 280000001C000000380000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......8..... ................................... | N/A |
| \ICON\41\1033 | 193EE8 | 988 | 17CCE8 | 2800000018000000300000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......0..... ................................... | N/A |
| \ICON\42\1033 | 194870 | 6B8 | 17D670 | 2800000014000000280000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......(..... ................................... | N/A |
| \ICON\43\1033 | 194F28 | 468 | 17DD28 | 2800000010000000200000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (....... ..... ................................... | N/A |
| \ICON\44\1033 | 1953F0 | 25A8 | 17E1F0 | 2800000030000000600000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (...0........ ................................... | N/A |
| \ICON\45\1033 | 197998 | 10A8 | 180798 | 2800000020000000400000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... | N/A |
| \ICON\46\1033 | 198A40 | CD8 | 181840 | 280000001C000000380000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......8..... ................................... | N/A |
| \ICON\47\1033 | 199718 | 988 | 182518 | 2800000018000000300000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......0..... ................................... | N/A |
| \ICON\48\1033 | 19A0A0 | 6B8 | 182EA0 | 2800000014000000280000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......(..... ................................... | N/A |
| \ICON\49\1033 | 19A758 | 468 | 183558 | 2800000010000000200000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (....... ..... ................................... | N/A |
| \ICON\50\1033 | 19AC20 | 25A8 | 183A20 | 2800000030000000600000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (...0........ ................................... | N/A |
| \ICON\51\1033 | 19D1C8 | 10A8 | 185FC8 | 2800000020000000400000000100200000000000000000000000000000000000000000000000000000000000000000200000 | (... ...@..... ................................ .. | N/A |
| \ICON\52\1033 | 19E270 | CD8 | 187070 | 280000001C000000380000000100200000000000000000000000000000000000000000000000000000000000000000600000 | (.......8..... .................................. | N/A |
| \ICON\53\1033 | 19EF48 | 988 | 187D48 | 2800000018000000300000000100200000000000000000000000000000000000000000000000000000000000000000900000 | (.......0..... ................................... | N/A |
| \ICON\54\1033 | 19F8D0 | 6B8 | 1886D0 | 2800000014000000280000000100200000000000000000000000000000000000000000000000000000000020000000CF0000 | (.......(..... ............................ ...... | N/A |
| \ICON\55\1033 | 19FF88 | 468 | 188D88 | 2800000010000000200000000100200000000000000000000000000000000000000000000000000000000060000000DF0000 | (....... ..... .................................. | N/A |
| \ICON\56\1033 | 1A0450 | 25A8 | 189250 | 2800000030000000600000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (...0........ ................................... | N/A |
| \ICON\57\1033 | 1A29F8 | 10A8 | 18B7F8 | 2800000020000000400000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... | N/A |
| \ICON\58\1033 | 1A3AA0 | CD8 | 18C8A0 | 280000001C000000380000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......8..... ................................... | N/A |
| \ICON\59\1033 | 1A4778 | 988 | 18D578 | 2800000018000000300000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......0..... ................................... | N/A |
| \ICON\60\1033 | 1A5100 | 6B8 | 18DF00 | 2800000014000000280000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......(..... ................................... | N/A |
| \ICON\61\1033 | 1A57B8 | 468 | 18E5B8 | 2800000010000000200000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (....... ..... ................................... | N/A |
| \ICON\62\1033 | 1A5C80 | 25A8 | 18EA80 | 2800000030000000600000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (...0........ ................................... | N/A |
| \ICON\63\1033 | 1A8228 | 10A8 | 191028 | 2800000020000000400000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... | N/A |
| \ICON\64\1033 | 1A92D0 | CD8 | 1920D0 | 280000001C000000380000000100200000000000000000000000000000000000000000000000000000000000000000200000 | (.......8..... ................................ .. | N/A |
| \ICON\65\1033 | 1A9FA8 | 988 | 192DA8 | 2800000018000000300000000100200000000000000000000000000000000000000000000000000000000000000000500000 | (.......0..... ................................P.. | N/A |
| \ICON\66\1033 | 1AA930 | 6B8 | 193730 | 2800000014000000280000000100200000000000000000000000000000000000000000000000000000000000000000900000 | (.......(..... ................................... | N/A |
| \ICON\67\1033 | 1AAFE8 | 468 | 193DE8 | 2800000010000000200000000100200000000000000000000000000000000000000000000000000000000010000000A00000 | (....... ..... ................................... | N/A |
| \ICON\68\1033 | 1AB4B0 | 25A8 | 1942B0 | 2800000030000000600000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (...0........ ................................... | N/A |
| \ICON\69\1033 | 1ADA58 | 10A8 | 196858 | 2800000020000000400000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... | N/A |
| \ICON\70\1033 | 1AEB00 | CD8 | 197900 | 280000001C000000380000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......8..... ................................... | N/A |
| \ICON\71\1033 | 1AF7D8 | 988 | 1985D8 | 2800000018000000300000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......0..... ................................... | N/A |
| \ICON\72\1033 | 1B0160 | 6B8 | 198F60 | 2800000014000000280000000100200000000000000000000000000000000000000000000000000000000000000000004068 | (.......(..... .................................@h | N/A |
| \ICON\73\1033 | 1B0818 | 468 | 199618 | 2800000010000000200000000100200000000000000000000000000000000000000000000000000000000000000000004264 | (....... ..... .................................Bd | N/A |
| \ICON\74\1033 | 1B0CE0 | 25A8 | 199AE0 | 2800000030000000600000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (...0........ ................................... | N/A |
| \ICON\75\1033 | 1B3288 | 10A8 | 19C088 | 2800000020000000400000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... | N/A |
| \ICON\76\1033 | 1B4330 | CD8 | 19D130 | 280000001C000000380000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......8..... ................................... | N/A |
| \ICON\77\1033 | 1B5008 | 988 | 19DE08 | 2800000018000000300000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......0..... ................................... | N/A |
| \ICON\78\1033 | 1B5990 | 6B8 | 19E790 | 280000001400000028000000010020000000000000000000000000000000000000000000000000000000000000000000D778 | (.......(..... ..................................x | N/A |
| \ICON\79\1033 | 1B6048 | 468 | 19EE48 | 280000001000000020000000010020000000000000000000000000000000000000000000000000000000000000000000D378 | (....... ..... ..................................x | N/A |
| \ICON\80\1033 | 1B6510 | 25A8 | 19F310 | 2800000030000000600000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (...0........ ................................... | N/A |
| \ICON\81\1033 | 1B8AB8 | 10A8 | 1A18B8 | 2800000020000000400000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... | N/A |
| \ICON\82\1033 | 1B9B60 | CD8 | 1A2960 | 280000001C000000380000000100200000000000000000000000000000000000000000000000000000000000000000200000 | (.......8..... ................................ .. | N/A |
| \ICON\83\1033 | 1BA838 | 988 | 1A3638 | 2800000018000000300000000100200000000000000000000000000000000000000000000000000000000000000000200000 | (.......0..... ................................ .. | N/A |
| \ICON\84\1033 | 1BB1C0 | 6B8 | 1A3FC0 | 2800000014000000280000000100200000000000000000000000000000000000000000000000000000000010000000A00000 | (.......(..... ................................... | N/A |
| \ICON\85\1033 | 1BB878 | 468 | 1A4678 | 2800000010000000200000000100200000000000000000000000000000000000000000000000000000000020000000AF0000 | (....... ..... ............................ ...... | N/A |
| \ICON\86\1033 | 1BBD40 | 25A8 | 1A4B40 | 2800000030000000600000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (...0........ ................................... | N/A |
| \ICON\87\1033 | 1BE2E8 | 10A8 | 1A70E8 | 2800000020000000400000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... | N/A |
| \ICON\88\1033 | 1BF390 | CD8 | 1A8190 | 280000001C000000380000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......8..... ................................... | N/A |
| \ICON\89\1033 | 1C0068 | 988 | 1A8E68 | 2800000018000000300000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......0..... ................................... | N/A |
| \ICON\90\1033 | 1C09F0 | 6B8 | 1A97F0 | 2800000014000000280000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......(..... ................................... | N/A |
| \ICON\91\1033 | 1C10A8 | 468 | 1A9EA8 | 2800000010000000200000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (....... ..... ................................... | N/A |
| \ICON\92\1033 | 1C1570 | 25A8 | 1AA370 | 2800000030000000600000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (...0........ ................................... | N/A |
| \ICON\93\1033 | 1C3B18 | 10A8 | 1AC918 | 2800000020000000400000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... | N/A |
| \ICON\94\1033 | 1C4BC0 | CD8 | 1AD9C0 | 280000001C000000380000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......8..... ................................... | N/A |
| \ICON\95\1033 | 1C5898 | 988 | 1AE698 | 2800000018000000300000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......0..... ................................... | N/A |
| \ICON\96\1033 | 1C6220 | 6B8 | 1AF020 | 2800000014000000280000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......(..... ................................... | N/A |
| \ICON\97\1033 | 1C68D8 | 468 | 1AF6D8 | 2800000010000000200000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (....... ..... ................................... | N/A |
| \ICON\98\1033 | 1C6DA0 | 25A8 | 1AFBA0 | 2800000030000000600000000100200000000000000000000000000000000000000000000000000000000080000000FF0000 | (...0........ ................................... | N/A |
| \ICON\99\1033 | 1C9348 | 10A8 | 1B2148 | 28000000200000004000000001002000000000000000000000000000000000000000000000000000000000A0000000EF0000 | (... ...@..... ................................... | N/A |
| \ICON\100\1033 | 1CA3F0 | CD8 | 1B31F0 | 280000001C0000003800000001002000000000000000000000000000000000000000000000000000000000BF000000DF0000 | (.......8..... ................................... | N/A |
| \ICON\101\1033 | 1CB0C8 | 988 | 1B3EC8 | 28000000180000003000000001002000000000000000000000000000000000000000000000000000000000DF000000DF0000 | (.......0..... ................................... | N/A |
| \ICON\102\1033 | 1CBA50 | 6B8 | 1B4850 | 28000000140000002800000001002000000000000000000000000000000000000000000000000000000000DF000000800000 | (.......(..... ................................... | N/A |
| \ICON\103\1033 | 1CC108 | 468 | 1B4F08 | 28000000100000002000000001002000000000000000000000000000000000000000000000000000000000DF000000800000 | (....... ..... ................................... | N/A |
| \ICON\104\1033 | 1CC5D0 | 25A8 | 1B53D0 | 2800000030000000600000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (...0........ ................................... | N/A |
| \ICON\105\1033 | 1CEB78 | 10A8 | 1B7978 | 2800000020000000400000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... | N/A |
| \ICON\106\1033 | 1CFC20 | CD8 | 1B8A20 | 280000001C000000380000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......8..... ................................... | N/A |
| \ICON\107\1033 | 1D08F8 | 988 | 1B96F8 | 2800000018000000300000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......0..... ................................... | N/A |
| \ICON\108\1033 | 1D1280 | 6B8 | 1BA080 | 2800000014000000280000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......(..... ................................... | N/A |
| \ICON\109\1033 | 1D1938 | 468 | 1BA738 | 2800000010000000200000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (....... ..... ................................... | N/A |
| \ICON\110\1033 | 1D1E00 | 25A8 | 1BAC00 | 2800000030000000600000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (...0........ ................................... | N/A |
| \ICON\111\1033 | 1D43A8 | 10A8 | 1BD1A8 | 2800000020000000400000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... | N/A |
| \ICON\112\1033 | 1D5450 | CD8 | 1BE250 | 280000001C000000380000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......8..... ................................... | N/A |
| \ICON\113\1033 | 1D6128 | 988 | 1BEF28 | 2800000018000000300000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......0..... ................................... | N/A |
| \ICON\114\1033 | 1D6AB0 | 6B8 | 1BF8B0 | 2800000014000000280000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......(..... ................................... | N/A |
| \ICON\115\1033 | 1D7168 | 468 | 1BFF68 | 2800000010000000200000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (....... ..... ................................... | N/A |
| \ICON\116\1033 | 1D7630 | 25A8 | 1C0430 | 2800000030000000600000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (...0........ ................................... | N/A |
| \ICON\117\1033 | 1D9BD8 | 10A8 | 1C29D8 | 2800000020000000400000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... | N/A |
| \ICON\118\1033 | 1DAC80 | CD8 | 1C3A80 | 280000001C000000380000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......8..... ................................... | N/A |
| \ICON\119\1033 | 1DB958 | 988 | 1C4758 | 2800000018000000300000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......0..... ................................... | N/A |
| \ICON\120\1033 | 1DC2E0 | 6B8 | 1C50E0 | 2800000014000000280000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......(..... ................................... | N/A |
| \ICON\121\1033 | 1DC998 | 468 | 1C5798 | 2800000010000000200000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (....... ..... ................................... | N/A |
| \ICON\122\1033 | 1DCE60 | 25A8 | 1C5C60 | 2800000030000000600000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (...0........ ................................... | N/A |
| \ICON\123\1033 | 1DF408 | 10A8 | 1C8208 | 2800000020000000400000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... | N/A |
| \ICON\124\1033 | 1E04B0 | CD8 | 1C92B0 | 280000001C000000380000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......8..... ................................... | N/A |
| \ICON\125\1033 | 1E1188 | 988 | 1C9F88 | 2800000018000000300000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......0..... ................................... | N/A |
| \ICON\126\1033 | 1E1B10 | 6B8 | 1CA910 | 2800000014000000280000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......(..... ................................... | N/A |
| \ICON\127\1033 | 1E21C8 | 468 | 1CAFC8 | 2800000010000000200000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (....... ..... ................................... | N/A |
| \ICON\128\1033 | 1E2690 | 25A8 | 1CB490 | 2800000030000000600000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (...0........ ................................... | N/A |
| \ICON\129\1033 | 1E4C38 | 10A8 | 1CDA38 | 2800000020000000400000000100200000000000000000000000000000000000000000000000000000000000000000100000 | (... ...@..... ................................... | N/A |
| \ICON\130\1033 | 1E5CE0 | CD8 | 1CEAE0 | 280000001C000000380000000100200000000000000000000000000000000000000000000000000000000000000000200000 | (.......8..... ................................ .. | N/A |
| \ICON\131\1033 | 1E69B8 | 988 | 1CF7B8 | 2800000018000000300000000100200000000000000000000000000000000000000000000000000000000000000000600000 | (.......0..... .................................. | N/A |
| \ICON\132\1033 | 1E7340 | 6B8 | 1D0140 | 2800000014000000280000000100200000000000000000000000000000000000000000000000000000000010000000A00000 | (.......(..... ................................... | N/A |
| \ICON\133\1033 | 1E79F8 | 468 | 1D07F8 | 2800000010000000200000000100200000000000000000000000000000000000000000000000000000000020000000CF0000 | (....... ..... ............................ ...... | N/A |
| \ICON\134\1033 | 1E7EC0 | 25A8 | 1D0CC0 | 2800000030000000600000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (...0........ ................................... | N/A |
| \ICON\135\1033 | 1EA468 | 10A8 | 1D3268 | 2800000020000000400000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... | N/A |
| \ICON\136\1033 | 1EB510 | CD8 | 1D4310 | 280000001C000000380000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......8..... ................................... | N/A |
| \ICON\137\1033 | 1EC1E8 | 988 | 1D4FE8 | 2800000018000000300000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......0..... ................................... | N/A |
| \ICON\138\1033 | 1ECB70 | 6B8 | 1D5970 | 2800000014000000280000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......(..... ................................... | N/A |
| \ICON\139\1033 | 1ED228 | 468 | 1D6028 | 2800000010000000200000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (....... ..... ................................... | N/A |
| \ICON\140\1033 | 1ED6F0 | 25A8 | 1D64F0 | 2800000030000000600000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (...0........ ................................... | N/A |
| \ICON\141\1033 | 1EFC98 | 10A8 | 1D8A98 | 2800000020000000400000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... | N/A |
| \ICON\142\1033 | 1F0D40 | CD8 | 1D9B40 | 280000001C000000380000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......8..... ................................... | N/A |
| \ICON\143\1033 | 1F1A18 | 988 | 1DA818 | 2800000018000000300000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......0..... ................................... | N/A |
| \ICON\144\1033 | 1F23A0 | 6B8 | 1DB1A0 | 2800000014000000280000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......(..... ................................... | N/A |
| \ICON\145\1033 | 1F2A58 | 468 | 1DB858 | 2800000010000000200000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (....... ..... ................................... | N/A |
| \ICON\146\1033 | 1F2F20 | 10A8 | 1DBD20 | 2800000020000000400000000100200000000000801000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... | N/A |
| \ICON\147\1033 | 1F3FC8 | 988 | 1DCDC8 | 2800000018000000300000000100200000000000600900000000000000000000000000000000000000000000000000000000 | (.......0..... .................................. | N/A |
| \ICON\148\1033 | 1F4950 | 468 | 1DD750 | 2800000010000000200000000100200000000000400400000000000000000000000000000000000000000000000000000000 | (....... ..... .....@............................. | N/A |
| \ICON\149\1033 | 1F4DE8 | 25A8 | 1DDBE8 | 2800000030000000600000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (...0........ ................................... | N/A |
| \ICON\150\1033 | 1F7390 | 10A8 | 1E0190 | 2800000020000000400000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... | N/A |
| \ICON\151\1033 | 1F8438 | CD8 | 1E1238 | 280000001C000000380000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......8..... ................................... | N/A |
| \ICON\152\1033 | 1F9110 | 988 | 1E1F10 | 2800000018000000300000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......0..... ................................... | N/A |
| \ICON\153\1033 | 1F9A98 | 6B8 | 1E2898 | 2800000014000000280000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (.......(..... ................................... | N/A |
| \ICON\154\1033 | 1FA150 | 468 | 1E2F50 | 2800000010000000200000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (....... ..... ................................... | N/A |
| \ICON\155\1033 | 1FA618 | 25A8 | 1E3418 | 2800000030000000600000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (...0........ ................................... | N/A |
| \ICON\156\1033 | 1FCBC0 | 10A8 | 1E59C0 | 2800000020000000400000000100200000000000000000000000000000000000000000000000000000000000000000001F1F | (... ...@..... ................................... | N/A |
| \ICON\157\1033 | 1FDC68 | CD8 | 1E6A68 | 280000001C0000003800000001002000000000000000000000000000000000000000000000000000000000001E1E1E2A1E1E | (.......8..... ................................*.. | N/A |
| \ICON\158\1033 | 1FE940 | 988 | 1E7740 | 28000000180000003000000001002000000000000000000000000000000000000000000000000000000000001E1E1E641F1F | (.......0..... ................................d.. | N/A |
| \ICON\159\1033 | 1FF2C8 | 6B8 | 1E80C8 | 28000000140000002800000001002000000000000000000000000000000000000000000000000000000000001E1E1EA81F1F | (.......(..... ................................... | N/A |
| \ICON\160\1033 | 1FF980 | 468 | 1E8780 | 280000001000000020000000010020000000000000000000000000000000000000000000000000002727270D1E1E1EBF1E1E | (....... ..... .........................'''....... | N/A |
| \MENU\CONTEXT_HEADER\1033 | 200950 | 4A | 1E9750 | 00000000900043006F006E00740065007800740020004D0065006E00750000008000419C2600530065006C00650063007400200043006F006C0075006D006E0073002E002E002E000000 | ......C.o.n.t.e.x.t. .M.e.n.u.....A.&.S.e.l.e.c.t. .C.o.l.u.m.n.s......... | N/A |
| \MENU\CONTEXT_PROCESSTREE\1033 | 2009A0 | F8 | 1E97A0 | 00000000900043006F006E00740065007800740020004D0065006E007500000000002204260047006F00200054006F002000 | ......C.o.n.t.e.x.t. .M.e.n.u.....".&.G.o. .T.o. . | N/A |
| \MENU\101\1033 | 1FFE48 | A6A | 1E8C48 | 0000000010002600460069006C00650000000000649C26004F00700065006E002E002E002E0009004300740072006C002B00 | ......&.F.i.l.e.....d.&.O.p.e.n.........C.t.r.l.+. | N/A |
| \MENU\194\1033 | 200A98 | 7C | 1E9898 | 000000009000440075006D006D00790000000000ED9C2600410064006400200074006F00200049006E0063006C0075006400 | ......D.u.m.m.y.......&.A.d.d. .t.o. .I.n.c.l.u.d. | N/A |
| \MENU\197\1033 | 200B18 | 4E | 1E9918 | 000000009000440075006D006D007900000000002204440065007400610069006C002E002E002E0000008000689C260043006F00700079002E002E002E0009004300740072006C002B0043000000 | ......D.u.m.m.y.....".D.e.t.a.i.l...........h.&.C.o.p.y.........C.t.r.l.+.C... | N/A |
| \MENU\40176\1033 | 2008B8 | 98 | 1E96B8 | 000000009000440075006D006D007900000000003004500072006F0070006500720074006900650073002E002E002E000000 | ......D.u.m.m.y.....0.P.r.o.p.e.r.t.i.e.s......... | N/A |
| \DIALOG\ABOUTBOX\1033 | 200E98 | 208 | 1E9C98 | 0100FFFF0000000000000000C000C882060032003200F6003E0000000000410062006F00750074002000500072006F006300 | ..................2.2...>.....A.b.o.u.t. .P.r.o.c. | N/A |
| \DIALOG\BOOTLOG_OPTIONS\1033 | 2082D8 | 2B0 | 1F10D8 | 0100FFFF0000000000000000C800C882060032003200EF005D000000000045006E00610062006C006500200042006F006F00 | ..................2.2...].....E.n.a.b.l.e. .B.o.o. | N/A |
| \DIALOG\COLUMNCHOOSER\1033 | 2010A0 | 802 | 1E9EA0 | 0100FFFF0000000000000000C800C880220032003200CA00110100000000500072006F00630065007300730020004D006F00 | ................".2.2.........P.r.o.c.e.s.s. .M.o. | N/A |
| \DIALOG\DISCONNECTING\1033 | 2081B8 | 11A | 1F0FB8 | 0100FFFF0000000000000000C802C090010032003200BC00200000000000500072006F00630065007300730020004D006F00 | ..................2.2... .....P.r.o.c.e.s.s. .M.o. | N/A |
| \DIALOG\FILTER_CONTROL\1033 | 203CE8 | 1A6 | 1ECAE8 | 0100FFFF000000000000010050040052090032003200390176000000000000000900000000015300650067006F0065002000 | ............P..R..2.2.9.v.............S.e.g.o.e. . | N/A |
| \DIALOG\HISTORY_DEPTH\1033 | 203820 | 2BA | 1EC620 | 0100FFFF0000000000000000C000C8800B00320032000B0186000000000048006900730074006F0072007900200044006500 | ..................2.2.........H.i.s.t.o.r.y. .D.e. | N/A |
| \DIALOG\ORGANIZE_FILTERS\1033 | 2045B8 | 166 | 1ED3B8 | 0100FFFF0000000000000000C800C892060032003200DA008B00000000004F007200670061006E0069007A00650020004600 | ..................2.2.........O.r.g.a.n.i.z.e. .F. | N/A |
| \DIALOG\PROFILING_OPTIONS\1033 | 206980 | 2B4 | 1EF780 | 0100FFFF0000000000000000C800C880060032003200EE006600000000005400680072006500610064002000500072006F00 | ..................2.2...f.....T.h.r.e.a.d. .P.r.o. | N/A |
| \DIALOG\PROGRESS\1033 | 2049C8 | EE | 1ED7C8 | 0100FFFF0000000000000000C80AC092030000000000F9003F00000000004400690061006C006F0067000000090090010001 | ........................?.....D.i.a.l.o.g......... | N/A |
| \DIALOG\SAVE\1033 | 202C20 | 4CA | 1EBA20 | 0100FFFF0000000000000000C800C8901000320032000901C100000000005300610076006500200054006F00200046006900 | ..................2.2.........S.a.v.e. .T.o. .F.i. | N/A |
| \DIALOG\SAVE_FILTER\1033 | 204498 | 11C | 1ED298 | 0100FFFF0000000000000000C800C892040032003200DA0033000000000053006100760065002000460069006C0074006500 | ..................2.2...3.....S.a.v.e. .F.i.l.t.e. | N/A |
| \DIALOG\SYMBOLCONFIG\1033 | 202070 | 5E6 | 1EAE70 | 0100FFFF0000000000000000C800C8800E00320032002201B8000000000043006F006E006600690067007500720065002000 | ..................2.2.".......C.o.n.f.i.g.u.r.e. . | N/A |
| \DIALOG\SYMBOLCONFIGWARNING\1033 | 201DB0 | 2C0 | 1EABB0 | 0100FFFF0000000000000000C808C8800700320032004C01410000000000500072006F00630065007300730020004D006F00 | ..................2.2.L.A.....P.r.o.c.e.s.s. .M.o. | N/A |
| \DIALOG\SYMBOLDBGHELPGWARNING\1033 | 201A28 | 388 | 1EA828 | 0100FFFF0000000000000000C808C8800800320032005301560000000000500072006F00630065007300730020004D006F00 | ..................2.2.S.V.....P.r.o.c.e.s.s. .M.o. | N/A |
| \DIALOG\SYSTEM_DETAILS\1033 | 207CE0 | 31C | 1F0AE0 | 0100FFFF0000000000000000C808C8900E0000000000FE006C0000000000530079007300740065006D002000440065007400 | ........................l.....S.y.s.t.e.m. .D.e.t. | N/A |
| \DIALOG\UNIQUE\1033 | 203AE0 | 204 | 1EC8E0 | 0100FFFF00000000000000004800CD900800320032003101BE0000000000530068006F007700200055006E00690071007500 | ............H.....2.2.1.......S.h.o.w. .U.n.i.q.u. | N/A |
| \DIALOG\USAGE\1033 | 2051C8 | 11E2 | 1EDFC8 | 0100FFFF0000000000000000C008C8823400000000004D01590100000000500072006F00630065007300730020004D006F00 | ................4.....M.Y.....P.r.o.c.e.s.s. .M.o. | N/A |
| \DIALOG\147\1033 | 2027E0 | 43C | 1EB5E0 | 0100FFFF00000000000000004800CC920B00320032003A01B30000000000500072006F00630065007300730020004D006F00 | ............H.....2.2.:.......P.r.o.c.e.s.s. .M.o. | N/A |
| \DIALOG\150\1033 | 2065D0 | 1B8 | 1EF3D0 | 0100FFFF00000000000000004000CF920600320032003101BE00000000005200650067006900730074007200790020005300 | ............@.....2.2.1.......R.e.g.i.s.t.r.y. .S. | N/A |
| \DIALOG\152\1033 | 208000 | 1B4 | 1F0E00 | 0100FFFF00000000000000004000CF920600320032003101BE00000000004E006500740077006F0072006B00200053007500 | ............@.....2.2.1.......N.e.t.w.o.r.k. .S.u. | N/A |
| \DIALOG\153\1033 | 204C90 | 398 | 1EDA90 | 0100FFFF00000000000000004008CF921000320032003101E50000000000500072006F006300650073007300200041006300 | ............@.....2.2.1.......P.r.o.c.e.s.s. .A.c. | N/A |
| \DIALOG\155\1033 | 204228 | 270 | 1ED028 | 0100FFFF00000000000000004800CC120D0032003200E1006900000000004D006F00640075006C0065002000500072006F00 | ............H.....2.2...i.....M.o.d.u.l.e. .P.r.o. | N/A |
| \DIALOG\156\1033 | 206C38 | 328 | 1EFA38 | 0100FFFF00000000000000004800C4920D00320032003B01CA000000000044006500660069006E0065002000440065007600 | ............H.....2.2.;.......D.e.f.i.n.e. .D.e.v. | N/A |
| \DIALOG\159\1033 | 206788 | 1F2 | 1EF588 | 0100FFFF00000000000000004000CF920700320032002F01BE000000000053007400610063006B002000530075006D006D00 | ............@.....2.2./.......S.t.a.c.k. .S.u.m.m. | N/A |
| \DIALOG\160\1033 | 207500 | 1F4 | 1F0300 | 0100FFFF00000000000000004000CF920600320032003101BE0000000000430072006F007300730020005200650066006500 | ............@.....2.2.1.......C.r.o.s.s. .R.e.f.e. | N/A |
| \DIALOG\174\1033 | 206F60 | 52E | 1EFD60 | 0100FFFF00000000000001005000CD92170032003200B701420100000000500072006F006300650073007300200054007200 | ............P.....2.2...B.....P.r.o.c.e.s.s. .T.r. | N/A |
| \DIALOG\179\1033 | 204720 | 2A4 | 1ED520 | 0100FFFF0000000000000000400400521000000000003801EE000000000000000900900100005300650067006F0065002000 | ............@..R......8...............S.e.g.o.e. . | N/A |
| \DIALOG\180\1033 | 203268 | 5B2 | 1EC068 | 0100FFFF00000000000001004004005022000000000051011A010000000000000900900100005300650067006F0065002000 | ............@..P".....Q...............S.e.g.o.e. . | N/A |
| \DIALOG\181\1033 | 202658 | 182 | 1EB458 | 0100FFFF0000000000000100400400560600320032002D0193000000000000000900900100005300650067006F0065002000 | ............@..V..2.2.-...............S.e.g.o.e. . | N/A |
| \DIALOG\182\1033 | 2030F0 | 176 | 1EBEF0 | 0100FFFF00000000000001005000CF90060032003200B3014F01000000004500760065006E0074002000500072006F007000 | ............P.....2.2...O.....E.v.e.n.t. .P.r.o.p. | N/A |
| \DIALOG\184\1033 | 2018A8 | 17C | 1EA6A8 | 0100FFFF00000000000001004000CC920500320032004F01A70000000000500072006F00630065007300730020004D006F00 | ............@.....2.2.O.......P.r.o.c.e.s.s. .M.o. | N/A |
| \DIALOG\185\1033 | 2063B0 | 21C | 1EF1B0 | 0100FFFF00000000000001004000CC920600320032005101B10000000000500072006F00630065007300730020004D006F00 | ............@.....2.2.Q.......P.r.o.c.e.s.s. .M.o. | N/A |
| \DIALOG\186\1033 | 205028 | 19E | 1EDE28 | 0100FFFF00000000000000004800CF920600320032003101BE0000000000460069006C0065002000530075006D006D006100 | ............H.....2.2.1.......F.i.l.e. .S.u.m.m.a. | N/A |
| \DIALOG\187\1033 | 207490 | 70 | 1F0290 | 0100FFFF00000000000000004000CF920100640064002101AC0000000000460069006C006500200056006900650077006500 | ............@.....d.d.!.......F.i.l.e. .V.i.e.w.e. | N/A |
| \DIALOG\188\1033 | 203E90 | 1C4 | 1ECC90 | 0100FFFF00000000000000004000CC920600320032004F01A70000000000500072006F00630065007300730020004D006F00 | ............@.....2.2.O.......P.r.o.c.e.s.s. .M.o. | N/A |
| \DIALOG\189\1033 | 204058 | 1D0 | 1ECE58 | 0100FFFF0000000000000000C420C880070032003200C000720000000000430068006F006F00730065002000480069006700 | ............. ....2.2...r.....C.h.o.o.s.e. .H.i.g. | N/A |
| \DIALOG\190\1033 | 2076F8 | 5E4 | 1F04F8 | 0100FFFF00000000000000005000CD921A0000000000FF00140100000000500072006F006300650073007300200054006900 | ............P.................P.r.o.c.e.s.s. .T.i. | N/A |
| \DIALOG\191\1033 | 204AB8 | 1D8 | 1ED8B8 | 0100FFFF00000000000000004000CD920800320032003101BE000000000043006F0075006E0074002000560061006C007500 | ............@.....2.2.1.......C.o.u.n.t. .V.a.l.u. | N/A |
| \STRING\7\1033 | 21D860 | 88 | 206660 | 000000000000000000003400500072006F00630065007300730020004D006F006E00690074006F00720020002D0020005300 | ..........4.P.r.o.c.e.s.s. .M.o.n.i.t.o.r. .-. .S. | N/A |
| \STRING\2501\1033 | 21D3A0 | 8C | 2061A0 | 000000000000000000001B005300610076006500200028004300740072006C002B00530029000A0053006100760065002000 | ............S.a.v.e. .(.C.t.r.l.+.S.)...S.a.v.e. . | N/A |
| \STRING\2502\1033 | 21D200 | 19A | 206000 | 0000000021004300610070007400750072006500200028004300740072006C002B00450029000A0043006100700074007500 | ....!.C.a.p.t.u.r.e. .(.C.t.r.l.+.E.)...C.a.p.t.u. | N/A |
| \STRING\2503\1033 | 21D540 | 31A | 206340 | 000000000000000009004F00700065006E000A004F00700065006E0021004500760065006E0074002000500072006F007000 | ..........O.p.e.n...O.p.e.n.!.E.v.e.n.t. .P.r.o.p. | N/A |
| \STRING\2504\1033 | 21D430 | 10C | 206230 | 0000000000002F004A0075006D007000200074006F0020004F0062006A00650063007400200028004300740072006C002B00 | ....../.J.u.m.p. .t.o. .O.b.j.e.c.t. .(.C.t.r.l.+. | N/A |
| \STRING\2505\1033 | 21D8E8 | 128 | 2066E8 | 070043006F006D00700061006E0079000B004400650073006300720069007000740069006F006E000C0043006F006D006D00 | ..C.o.m.p.a.n.y...D.e.s.c.r.i.p.t.i.o.n...C.o.m.m. | N/A |
| \STRING\2506\1033 | 21DA10 | DA | 206810 | 08004C006F0063006100740069006F006E000700560065007200730069006F006E000B004500760065006E00740020004300 | ..L.o.c.a.t.i.o.n...V.e.r.s.i.o.n...E.v.e.n.t. .C. | N/A |
| \STRING\2511\1033 | 21DAF0 | 3E | 2068F0 | 00000000000000000F0043006F006D0070006C006500740069006F006E002000540069006D00650000000000000000000000000000000000000000000000 | ..........C.o.m.p.l.e.t.i.o.n. .T.i.m.e....................... | N/A |
| \STRING\2512\1033 | 21DB30 | 74 | 206930 | 000000000D00500072006F0063006500730073002000530074006100720074001D0048006900670068002000520065007300 | ......P.r.o.c.e.s.s. .S.t.a.r.t...H.i.g.h. .R.e.s. | N/A |
| \ACCELERATOR\101\1033 | 167950 | E0 | 150750 | 0B000900CB9C00000F000900CC9C00000B0052004E9C00000B004200D99C00000B004500529C00000B005800549C00000B00 | ..................R.N.....B.......E.R.....X.T..... | N/A |
| \ACCELERATOR\199\1033 | 167A30 | 38 | 150830 | 0B0022001B0400000B00BE001B0400000B000900CB9C00000B00BC001A0400000B0021001A0400000F000900CC9C00008B004300689C0000 | .."...............................!...............C.h... | N/A |
| \GROUP_CURSOR\SPLITTER_CURSOR\1033 | 208810 | 14 | 1F1610 | 000002000100200040000100010034010000A200 | ...... .@.....4..... | N/A |
| \GROUP_CURSOR\121\1033 | 2086C0 | 14 | 1F14C0 | 000002000100200040000100010034010000A100 | ...... .@.....4..... | N/A |
| \GROUP_ICON\101\1033 | 178970 | 5A | 161770 | 000001000600000000000100200005840000010040400000010020002842000002003030000001002000A825000003002020000001002000A8100000040018180000010020008809000005001010000001002000680400000600 | ............ .......@@.... .(B....00.... ..%.... .... ............. ............. .h..... | N/A |
| \GROUP_ICON\106\1033 | 178C38 | 14 | 161A38 | 0000010001001010100001000400280100000800 | ..............(..... | N/A |
| \GROUP_ICON\107\1033 | 178AF8 | 14 | 1618F8 | 0000010001001010100001000400280100000700 | ..............(..... | N/A |
| \GROUP_ICON\110\1033 | 17E420 | 5A | 167220 | 0000010006003030000001002000A825000009002020000001002000A81000000A001C1C000001002000D80C00000B001818000001002000880900000C001414000001002000B80600000D001010000001002000680400000E00 | ......00.... ..%.... .... ............. ............. ............. ............. .h..... | N/A |
| \GROUP_ICON\112\1033 | 1C6D40 | 5A | 1AFB40 | 0000010006003030000001002000A82500005C002020000001002000A81000005D001C1C000001002000D80C00005E001818000001002000880900005F001414000001002000B806000060001010000001002000680400006100 | ......00.... ..%..\. .... .....]....... ............ ....._....... ............ .h...a. | N/A |
| \GROUP_ICON\113\1033 | 1E2630 | 5A | 1CB430 | 0000010006003030000001002000A82500007A002020000001002000A81000007B001C1C000001002000D80C00007C001818000001002000880900007D001414000001002000B80600007E001010000001002000680400007F00 | ......00.... ..%..z. .... .....{....... .....|....... .....}....... .....~....... .h..... | N/A |
| \GROUP_ICON\114\1033 | 195390 | 5A | 17E190 | 0000010006003030000001002000A825000026002020000001002000A810000027001C1C000001002000D80C0000280018180000010020008809000029001414000001002000B80600002A001010000001002000680400002B00 | ......00.... ..%..&. .... .....'....... .....(....... .....)....... .....*....... .h...+. | N/A |
| \GROUP_ICON\115\1033 | 1D1DA0 | 5A | 1BABA0 | 0000010006003030000001002000A825000068002020000001002000A810000069001C1C000001002000D80C00006A001818000001002000880900006B001414000001002000B80600006C001010000001002000680400006D00 | ......00.... ..%..h. .... .....i....... .....j....... .....k....... .....l....... .h...m. | N/A |
| \GROUP_ICON\116\1033 | 1CC570 | 5A | 1B5370 | 0000010006003030000001002000A825000062002020000001002000A810000063001C1C000001002000D80C0000640018180000010020008809000065001414000001002000B806000066001010000001002000680400006700 | ......00.... ..%..b. .... .....c....... .....d....... .....e....... .....f....... .h...g. | N/A |
| \GROUP_ICON\117\1033 | 1D75D0 | 5A | 1C03D0 | 0000010006003030000001002000A82500006E002020000001002000A81000006F001C1C000001002000D80C0000700018180000010020008809000071001414000001002000B806000072001010000001002000680400007300 | ......00.... ..%..n. .... .....o....... .....p....... .....q....... .....r....... .h...s. | N/A |
| \GROUP_ICON\118\1033 | 1ED690 | 5A | 1D6490 | 0000010006003030000001002000A825000086002020000001002000A810000087001C1C000001002000D80C0000880018180000010020008809000089001414000001002000B80600008A001010000001002000680400008B00 | ......00.... ..%.... .... ............. ............. ............. ............. .h..... | N/A |
| \GROUP_ICON\119\1033 | 183DD8 | 14 | 16CBD8 | 0000010001001010100001000400280100001500 | ..............(..... | N/A |
| \GROUP_ICON\120\1033 | 184480 | 22 | 16D280 | 00000100020010100000010008006805000016001010100001000400280100001700 | ..............h.............(..... | N/A |
| \GROUP_ICON\122\1033 | 1DCE00 | 5A | 1C5C00 | 0000010006003030000001002000A825000074002020000001002000A810000075001C1C000001002000D80C0000760018180000010020008809000077001414000001002000B806000078001010000001002000680400007900 | ......00.... ..%..t. .... .....u....... .....v....... .....w....... .....x....... .h...y. | N/A |
| \GROUP_ICON\123\1033 | 1E7E60 | 5A | 1D0C60 | 0000010006003030000001002000A825000080002020000001002000A810000081001C1C000001002000D80C0000820018180000010020008809000083001414000001002000B806000084001010000001002000680400008500 | ......00.... ..%.... .... ............. ............. ............. ............. .h..... | N/A |
| \GROUP_ICON\124\1033 | 1F2EC0 | 5A | 1DBCC0 | 0000010006003030000001002000A82500008C002020000001002000A81000008D001C1C000001002000D80C00008E001818000001002000880900008F001414000001002000B806000090001010000001002000680400009100 | ......00.... ..%.... .... ............. ............. ............. ............. .h..... | N/A |
| \GROUP_ICON\125\1033 | 1F4DB8 | 30 | 1DDBB8 | 0000010003002020000001002000A8100000920018180000010020008809000093001010000001002000680400009400 | ...... .... ............. ............. .h..... | N/A |
| \GROUP_ICON\128\1033 | 18A330 | 5A | 173130 | 0000010006003030000001002000A82500001A002020000001002000A81000001B001C1C000001002000D80C00001C001818000001002000880900001D001414000001002000B80600001E001010000001002000680400001F00 | ......00.... ..%.... .... ............. ............. ............. ............. .h..... | N/A |
| \GROUP_ICON\129\1033 | 18FB60 | 5A | 178960 | 0000010006003030000001002000A825000020002020000001002000A810000021001C1C000001002000D80C0000220018180000010020008809000023001414000001002000B806000024001010000001002000680400002500 | ......00.... ..%.. . .... .....!....... ....."....... ............ .....$....... .h...%. | N/A |
| \GROUP_ICON\130\1033 | 19ABC0 | 5A | 1839C0 | 0000010006003030000001002000A82500002C002020000001002000A81000002D001C1C000001002000D80C00002E001818000001002000880900002F001414000001002000B806000030001010000001002000680400003100 | ......00.... ..%..,. .... .....-....... ............. ...../....... .....0....... .h...1. | N/A |
| \GROUP_ICON\131\1033 | 1A03F0 | 5A | 1891F0 | 0000010006003030000001002000A825000032002020000001002000A810000033001C1C000001002000D80C0000340018180000010020008809000035001414000001002000B806000036001010000001002000680400003700 | ......00.... ..%..2. .... .....3....... .....4....... .....5....... .....6....... .h...7. | N/A |
| \GROUP_ICON\136\1033 | 1A5C20 | 5A | 18EA20 | 0000010006003030000001002000A825000038002020000001002000A810000039001C1C000001002000D80C00003A001818000001002000880900003B001414000001002000B80600003C001010000001002000680400003D00 | ......00.... ..%..8. .... .....9....... .....:....... .....;....... .....<....... .h...=. | N/A |
| \GROUP_ICON\138\1033 | 1AB450 | 5A | 194250 | 0000010006003030000001002000A82500003E002020000001002000A81000003F001C1C000001002000D80C0000400018180000010020008809000041001414000001002000B806000042001010000001002000680400004300 | ......00.... ..%..>. .... .....?....... .....@....... .....A....... .....B....... .h...C. | N/A |
| \GROUP_ICON\140\1033 | 1B0C80 | 5A | 199A80 | 0000010006003030000001002000A825000044002020000001002000A810000045001C1C000001002000D80C0000460018180000010020008809000047001414000001002000B806000048001010000001002000680400004900 | ......00.... ..%..D. .... .....E....... .....F....... .....G....... .....H....... .h...I. | N/A |
| \GROUP_ICON\141\1033 | 1B64B0 | 5A | 19F2B0 | 0000010006003030000001002000A82500004A002020000001002000A81000004B001C1C000001002000D80C00004C001818000001002000880900004D001414000001002000B80600004E001010000001002000680400004F00 | ......00.... ..%..J. .... .....K....... .....L....... .....M....... .....N....... .h...O. | N/A |
| \GROUP_ICON\143\1033 | 1BBCE0 | 5A | 1A4AE0 | 0000010006003030000001002000A825000050002020000001002000A810000051001C1C000001002000D80C0000520018180000010020008809000053001414000001002000B806000054001010000001002000680400005500 | ......00.... ..%..P. .... .....Q....... .....R....... .....S....... .....T....... .h...U. | N/A |
| \GROUP_ICON\192\1033 | 1C1510 | 5A | 1AA310 | 0000010006003030000001002000A825000056002020000001002000A810000057001C1C000001002000D80C0000580018180000010020008809000059001414000001002000B80600005A001010000001002000680400005B00 | ......00.... ..%..V. .... .....W....... .....X....... .....Y....... .....Z....... .h...[. | N/A |
| \GROUP_ICON\195\1033 | 1FA5B8 | 5A | 1E33B8 | 0000010006003030000001002000A825000095002020000001002000A810000096001C1C000001002000D80C0000970018180000010020008809000098001414000001002000B806000099001010000001002000680400009A00 | ......00.... ..%.... .... ............. ............. ............. ............. .h..... | N/A |
| \GROUP_ICON\196\1033 | 1FFDE8 | 5A | 1E8BE8 | 0000010006003030000001002000A82500009B002020000001002000A81000009C001C1C000001002000D80C00009D001818000001002000880900009E001414000001002000B80600009F00101000000100200068040000A000 | ......00.... ..%.... .... ............. ............. ............. ............. .h..... | N/A |
| \GROUP_ICON\204\1033 | 183C50 | 5A | 16CA50 | 0000010006003030000001002000A82500000F002020000001002000A810000010001C1C000001002000D80C0000110018180000010020008809000012001414000001002000B806000013001010000001002000680400001400 | ......00.... ..%.... .... ............. ............. ............. ............. .h..... | N/A |
| \GROUP_ICON\205\1033 | 184B38 | 22 | 16D938 | 00000100020010101000010004002801000018001010000001000800680500001900 | ..............(.............h..... | N/A |
| \VERSION\1\1033 | 200B68 | 330 | 1E9968 | 300334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000100 | 0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... | N/A |
| \24\1\1033 | 21DBA8 | 824 | 2069A8 | EFBBBF3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E65 | ...<?xml version="1.0" encoding="UTF-8" standalone | N/A |
| Intelligent String |
| • Sysinternals - www.sysinternals.com • .bss • *.CSV • *.PML • \pard\fi-357\li357\sb120\sa120\tx360\b\fs20 4.\tab DATA COLLECTION. \b0 The Sysinternals tools do not collect any data. Please refer to the {{\field{\*\fldinst{HYPERLINK "https://go.microsoft.com/fwlink/?LinkId=521839" }}{\fldrslt{Microsoft Privacy Statement\ul0\cf0}}}} <{{\field{\*\fldinst{HYPERLINK "https://go.microsoft.com/fwlink/?LinkId=521839"}}{\fldrslt{https://go.microsoft.com/fwlink/?LinkId=521839\ul0\cf0}}}}\f0\fs20 >.\b\par • \caps\fs20 6.\tab\fs19 Export Restrictions\caps0 .\b0The software is subject to United States export laws and regulations. You must comply with all domestic and international export laws and regulations that apply to the software. These laws include restrictions on destinations, end users and end use. For additional information, see {\cf1\ul{\field{\*\fldinst{HYPERLINK www.microsoft.com/exporting }}{\fldrslt{www.microsoft.com/exporting}}}}\cf1\ul\f0\fs19 <{{\field{\*\fldinst{HYPERLINK "https://microsoft.com/exporting"}}{\fldrslt{https://microsoft.com/exporting}}}}\f0\fs19 >\cf0\ulnone .\b\par • These license terms are an agreement between Sysinternals(a wholly owned subsidiary of Microsoft Corporation) and you.Please read them.They apply to the software you are downloading from https://sysinternals.com, which includes the media on which you received it, if any.The terms also apply to any Sysinternals • The Sysinternals tools do not collect any data.Please refer to the Microsoft Privacy Statement - https://aka.ms/privacy . • The software is subject to United States export laws and regulations.You must comply with all domestic and international export laws and regulations that apply to the software.These laws include restrictions on destinations, end users and end use.For additional information, see https://microsoft.com/exporting . • Riched32.dll • Shell32.dll • uxtheme.dll • dwmapi.dll • ntdll.dll • https://www.sysinternals.com • .PML • %SYSTEMROOT%\Procmon.Pmb • PROCMON24.SYS • \Drivers\PROCMON24.SYS • Procmon.exe • Procexp.exe • Autoruns.exe • Procmon64.exe • Procexp64.exe • pagefile.sys • .exe • regedit.exe • .CSV • Advapi32.dll • comctl32.dll • https://sysinternals.com/downloads/procmon • ProcmonConfiguration.pmc • *.PMC • .pmc • Write Data/Add File • Append Data/Add Subdirectory/Create Pipe Instance • kernel32.dll • \fltlib.dll • FSCTL_DUMP_PROPERTY_DATA • IOCTL_SCSI_GET_DUMP_POINTERS • IOCTL_SCSI_FREE_DUMP_POINTERS • Runas • 64.exe • Ntdll.dll • advapi32.dll • .PMF • *.PMF • .XML • Process Monitor - Sysinternals: www.sysinternals.com • *.PML;*.PMB • .PMB • Bootlog.pml • Kernel32.dll • *.XML • https://msdl.microsoft.com/download/symbols • LOGIN WKSTA RESTRICTION • URLMON.DLL • ntoskrnl.exe • Ntkrnlmp.exe • ntkrnlpa.exe • Ntkrpamp.exe • http://www.microsoft.com/whdc/devtools/debugging/default.mspx • dbghelp.dll • *.dll • user32.dll • atlthunk.dll • mscoree.dll • C:\__w\1\s\exe\x64\Release\Procmon64.pdb • .tls • WS2_32.dll • FLTLIB.DLL • KERNEL32.dll • USER32.dll • ADVAPI32.dll • <a>Sysinternals - www.sysinternals.com</a> • \SystemRoot\Procmon.pmb • \DosDevices\Global\ProcmonDebugLogger • C:\__w\1\s\sys\x64\Release\ProcMonDriver.pdb • ObQueryNameStringntoskrnl.exe • FltBuildDefaultSecurityDescriptorcFltFreeSecurityDescriptorpFltGetFileNameInformationUnsafeFLTMGR.SYS • Procmon.sys • procmon.Sys • 4Process Monitor - Sysinternals: www.sysinternals.com |
| Flow Anomalies |
| Offset | RVA | Section | Description |
|---|---|---|---|
| 458 | N/A | .text | CALL QWORD PTR [RIP+0xF02F2] |
| 469 | N/A | .text | CALL QWORD PTR [RIP+0xF0321] |
| 47D | N/A | .text | CALL QWORD PTR [RIP+0xF030D] |
| 492 | N/A | .text | JMP QWORD PTR [RIP+0xF02B0] |
| 4B0 | N/A | .text | CALL QWORD PTR [RIP+0xF063A] |
| 4BA | N/A | .text | CALL QWORD PTR [RIP+0xF0638] |
| 9CB | N/A | .text | CALL QWORD PTR [RIP+0xF018F] |
| A17 | N/A | .text | CALL QWORD PTR [RIP+0xF024B] |
| A57 | N/A | .text | CALL QWORD PTR [RIP+0xF020B] |
| A97 | N/A | .text | CALL QWORD PTR [RIP+0xF01CB] |
| AD7 | N/A | .text | CALL QWORD PTR [RIP+0xF018B] |
| 11CB | N/A | .text | CALL QWORD PTR [RIP+0xEF90F] |
| 121B | N/A | .text | CALL QWORD PTR [RIP+0xEF5C7] |
| 1276 | N/A | .text | CALL QWORD PTR [RIP+0xF0114] |
| 12A3 | N/A | .text | CALL QWORD PTR [RIP+0xEFD27] |
| 12DB | N/A | .text | CALL QWORD PTR [RIP+0xEF7FF] |
| 1340 | N/A | .text | CALL QWORD PTR [RIP+0xEF7AA] |
| 134A | N/A | .text | CALL QWORD PTR [RIP+0xEF7A8] |
| 1408 | N/A | .text | CALL QWORD PTR [RIP+0xEF6D2] |
| 1440 | N/A | .text | CALL QWORD PTR [RIP+0xEF4B2] |
| 146B | N/A | .text | CALL QWORD PTR [RIP+0xEF66F] |
| 147F | N/A | .text | CALL QWORD PTR [RIP+0xEF483] |
| 14E1 | N/A | .text | CALL QWORD PTR [RIP+0xEF871] |
| 150B | N/A | .text | CALL QWORD PTR [RIP+0xEF75F] |
| 151B | N/A | .text | CALL QWORD PTR [RIP+0xEF747] |
| 153B | N/A | .text | CALL QWORD PTR [RIP+0xEF72F] |
| 154B | N/A | .text | CALL QWORD PTR [RIP+0xEF717] |
| 156B | N/A | .text | CALL QWORD PTR [RIP+0xEF6FF] |
| 157B | N/A | .text | CALL QWORD PTR [RIP+0xEF6E7] |
| 15D0 | N/A | .text | CALL QWORD PTR [RIP+0xEF322] |
| 163B | N/A | .text | CALL QWORD PTR [RIP+0xEF49F] |
| 166B | N/A | .text | CALL QWORD PTR [RIP+0xEF177] |
| 16C6 | N/A | .text | CALL QWORD PTR [RIP+0xEFCC4] |
| 16F3 | N/A | .text | CALL QWORD PTR [RIP+0xEF8D7] |
| 179B | N/A | .text | CALL QWORD PTR [RIP+0xEF33F] |
| 17D1 | N/A | .text | CALL QWORD PTR [RIP+0xEF131] |
| 18E0 | N/A | .text | CALL QWORD PTR [RIP+0xEF20A] |
| 18EA | N/A | .text | CALL QWORD PTR [RIP+0xEF208] |
| 19AB | N/A | .text | CALL QWORD PTR [RIP+0xEF15F] |
| 19B8 | N/A | .text | CALL QWORD PTR [RIP+0xEEF0A] |
| 19CA | N/A | .text | JMP QWORD PTR [RIP+0xEEF00] |
| 19EB | N/A | .text | CALL QWORD PTR [RIP+0xEEDF7] |
| 1A4B | N/A | .text | CALL QWORD PTR [RIP+0xEF08F] |
| 1AAB | N/A | .text | CALL QWORD PTR [RIP+0xEF02F] |
| 221B | N/A | .text | CALL QWORD PTR [RIP+0xEE8BF] |
| 224B | N/A | .text | CALL QWORD PTR [RIP+0xEE88F] |
| 239E | N/A | .text | CALL QWORD PTR [RIP+0xEE8F4] |
| 23C7 | N/A | .text | CALL QWORD PTR [RIP+0xEE8C3] |
| 23E2 | N/A | .text | CALL QWORD PTR [RIP+0xEE8B8] |
| 2836 | N/A | .text | CALL QWORD PTR [RIP+0xEE564] |
| 2840 | N/A | .text | CALL QWORD PTR [RIP+0xEE55A] |
| 284A | N/A | .text | CALL QWORD PTR [RIP+0xEE550] |
| 2865 | N/A | .text | CALL QWORD PTR [RIP+0xEE57D] |
| 2872 | N/A | .text | CALL QWORD PTR [RIP+0xEECE0] |
| 2895 | N/A | .text | CALL QWORD PTR [RIP+0xEECE5] |
| 28CF | N/A | .text | CALL QWORD PTR [RIP+0xEECD3] |
| 2903 | N/A | .text | CALL QWORD PTR [RIP+0xEEC7F] |
| 290E | N/A | .text | CALL QWORD PTR [RIP+0xEE4CC] |
| 2924 | N/A | .text | CALL QWORD PTR [RIP+0xEEC7E] |
| 29B6 | N/A | .text | CALL QWORD PTR [RIP+0xEE42C] |
| 29C6 | N/A | .text | CALL QWORD PTR [RIP+0xEE41C] |
| 29D6 | N/A | .text | CALL QWORD PTR [RIP+0xEE40C] |
| 29E6 | N/A | .text | CALL QWORD PTR [RIP+0xEE3FC] |
| 2A12 | N/A | .text | CALL QWORD PTR [RIP+0xEEB90] |
| 2A1D | N/A | .text | CALL QWORD PTR [RIP+0xEE3BD] |
| 2A67 | N/A | .text | CALL QWORD PTR [RIP+0xEEB3B] |
| 2A9E | N/A | .text | CALL QWORD PTR [RIP+0xEEB04] |
| 2AB0 | N/A | .text | CALL QWORD PTR [RIP+0xEE332] |
| 2AE0 | N/A | .text | CALL QWORD PTR [RIP+0xEEAC2] |
| 2AE9 | N/A | .text | CALL QWORD PTR [RIP+0xEE2F1] |
| 2AF3 | N/A | .text | CALL QWORD PTR [RIP+0xEE29F] |
| 2B2C | N/A | .text | CALL QWORD PTR [RIP+0xEEA76] |
| 2B74 | N/A | .text | CALL QWORD PTR [RIP+0xEEA2E] |
| 2B80 | N/A | .text | CALL QWORD PTR [RIP+0xEE212] |
| 2B9E | N/A | .text | CALL QWORD PTR [RIP+0xEEA04] |
| 2BB7 | N/A | .text | CALL QWORD PTR [RIP+0xEE9EB] |
| 2BD7 | N/A | .text | CALL QWORD PTR [RIP+0xEE9CB] |
| 2C02 | N/A | .text | CALL QWORD PTR [RIP+0xEE190] |
| 2C5F | N/A | .text | CALL QWORD PTR [RIP+0xEE943] |
| 2C79 | N/A | .text | CALL QWORD PTR [RIP+0xEE111] |
| 2C87 | N/A | .text | CALL QWORD PTR [RIP+0xEE10B] |
| 2CAD | N/A | .text | CALL QWORD PTR [RIP+0xEE8F5] |
| 2D09 | N/A | .text | CALL QWORD PTR [RIP+0xEE899] |
| 2D1B | N/A | .text | CALL QWORD PTR [RIP+0xEE077] |
| 2D25 | N/A | .text | CALL QWORD PTR [RIP+0xEE06D] |
| 2D2E | N/A | .text | CALL QWORD PTR [RIP+0xEE0AC] |
| 2D37 | N/A | .text | CALL QWORD PTR [RIP+0xEE0A3] |
| 2D40 | N/A | .text | CALL QWORD PTR [RIP+0xEE09A] |
| 2D86 | N/A | .text | CALL QWORD PTR [RIP+0xEE81C] |
| 2DA0 | N/A | .text | CALL QWORD PTR [RIP+0xEE802] |
| 2DC2 | N/A | .text | CALL QWORD PTR [RIP+0xEE7E0] |
| 2E57 | N/A | .text | CALL QWORD PTR [RIP+0xEDF8B] |
| 2E65 | N/A | .text | CALL QWORD PTR [RIP+0xEDF35] |
| 2E86 | N/A | .text | CALL QWORD PTR [RIP+0xEE71C] |
| 2E91 | N/A | .text | CALL QWORD PTR [RIP+0xEDF49] |
| 2EC0 | N/A | .text | CALL QWORD PTR [RIP+0xEDF22] |
| 2ECE | N/A | .text | CALL QWORD PTR [RIP+0xEDEC4] |
| 2EEF | N/A | .text | CALL QWORD PTR [RIP+0xEE6B3] |
| 2EFA | N/A | .text | CALL QWORD PTR [RIP+0xEDEE0] |
| 2F25 | N/A | .text | CALL QWORD PTR [RIP+0xEDEBD] |
| 1FC85F-1FC897 | N/A | .rsrc | Unusual BP Cave, count: 57 |
| 1FC8DB-1FC917 | N/A | .rsrc | Unusual BP Cave, count: 61 |
| 143600 | 1000 | .pdata | ExceptionHook | Pointer to 1000 - 0x400 .text + UnwindInfo: .rdata |
| 14360C | 1050 | .pdata | ExceptionHook | Pointer to 1050 - 0x450 .text + UnwindInfo: .rdata |
| 143618 | 10A0 | .pdata | ExceptionHook | Pointer to 10A0 - 0x4A0 .text + UnwindInfo: .rdata |
| 143624 | 1100 | .pdata | ExceptionHook | Pointer to 1100 - 0x500 .text + UnwindInfo: .rdata |
| 143630 | 1180 | .pdata | ExceptionHook | Pointer to 1180 - 0x580 .text + UnwindInfo: .rdata |
| 14363C | 1200 | .pdata | ExceptionHook | Pointer to 1200 - 0x600 .text + UnwindInfo: .rdata |
| 143648 | 1350 | .pdata | ExceptionHook | Pointer to 1350 - 0x750 .text + UnwindInfo: .rdata |
| 143654 | 1400 | .pdata | ExceptionHook | Pointer to 1400 - 0x800 .text + UnwindInfo: .rdata |
| 143660 | 1460 | .pdata | ExceptionHook | Pointer to 1460 - 0x860 .text + UnwindInfo: .rdata |
| 14366C | 15A0 | .pdata | ExceptionHook | Pointer to 15A0 - 0x9A0 .text + UnwindInfo: .rdata |
| 143678 | 15C0 | .pdata | ExceptionHook | Pointer to 15C0 - 0x9C0 .text + UnwindInfo: .rdata |
| 143684 | 1600 | .pdata | ExceptionHook | Pointer to 1600 - 0xA00 .text + UnwindInfo: .rdata |
| 143690 | 1640 | .pdata | ExceptionHook | Pointer to 1640 - 0xA40 .text + UnwindInfo: .rdata |
| 14369C | 1680 | .pdata | ExceptionHook | Pointer to 1680 - 0xA80 .text + UnwindInfo: .rdata |
| 1436A8 | 16C0 | .pdata | ExceptionHook | Pointer to 16C0 - 0xAC0 .text + UnwindInfo: .rdata |
| 1436B4 | 1700 | .pdata | ExceptionHook | Pointer to 1700 - 0xB00 .text + UnwindInfo: .rdata |
| 1436C0 | 1740 | .pdata | ExceptionHook | Pointer to 1740 - 0xB40 .text + UnwindInfo: .rdata |
| 1436CC | 1DC0 | .pdata | ExceptionHook | Pointer to 1DC0 - 0x11C0 .text + UnwindInfo: .rdata |
| 1436D8 | 1E10 | .pdata | ExceptionHook | Pointer to 1E10 - 0x1210 .text + UnwindInfo: .rdata |
| 1436E4 | 1E30 | .pdata | ExceptionHook | Pointer to 1E30 - 0x1230 .text + UnwindInfo: .rdata |
| 1436F0 | 1ED0 | .pdata | ExceptionHook | Pointer to 1ED0 - 0x12D0 .text + UnwindInfo: .rdata |
| 1436FC | 1F20 | .pdata | ExceptionHook | Pointer to 1F20 - 0x1320 .text + UnwindInfo: .rdata |
| 143708 | 1FB0 | .pdata | ExceptionHook | Pointer to 1FB0 - 0x13B0 .text + UnwindInfo: .rdata |
| 143714 | 2030 | .pdata | ExceptionHook | Pointer to 2030 - 0x1430 .text + UnwindInfo: .rdata |
| 143720 | 2060 | .pdata | ExceptionHook | Pointer to 2060 - 0x1460 .text + UnwindInfo: .rdata |
| 14372C | 2100 | .pdata | ExceptionHook | Pointer to 2100 - 0x1500 .text + UnwindInfo: .rdata |
| 143738 | 2130 | .pdata | ExceptionHook | Pointer to 2130 - 0x1530 .text + UnwindInfo: .rdata |
| 143744 | 2160 | .pdata | ExceptionHook | Pointer to 2160 - 0x1560 .text + UnwindInfo: .rdata |
| 143750 | 2190 | .pdata | ExceptionHook | Pointer to 2190 - 0x1590 .text + UnwindInfo: .rdata |
| 14375C | 21C0 | .pdata | ExceptionHook | Pointer to 21C0 - 0x15C0 .text + UnwindInfo: .rdata |
| 143768 | 21F0 | .pdata | ExceptionHook | Pointer to 21F0 - 0x15F0 .text + UnwindInfo: .rdata |
| 143774 | 2230 | .pdata | ExceptionHook | Pointer to 2230 - 0x1630 .text + UnwindInfo: .rdata |
| 143780 | 2260 | .pdata | ExceptionHook | Pointer to 2260 - 0x1660 .text + UnwindInfo: .rdata |
| 14378C | 2280 | .pdata | ExceptionHook | Pointer to 2280 - 0x1680 .text + UnwindInfo: .rdata |
| 143798 | 2320 | .pdata | ExceptionHook | Pointer to 2320 - 0x1720 .text + UnwindInfo: .rdata |
| 1437A4 | 2360 | .pdata | ExceptionHook | Pointer to 2360 - 0x1760 .text + UnwindInfo: .rdata |
| 1437B0 | 2390 | .pdata | ExceptionHook | Pointer to 2390 - 0x1790 .text + UnwindInfo: .rdata |
| 1437BC | 23C0 | .pdata | ExceptionHook | Pointer to 23C0 - 0x17C0 .text + UnwindInfo: .rdata |
| 1437C8 | 23F0 | .pdata | ExceptionHook | Pointer to 23F0 - 0x17F0 .text + UnwindInfo: .rdata |
| 1437D4 | 2490 | .pdata | ExceptionHook | Pointer to 2490 - 0x1890 .text + UnwindInfo: .rdata |
| 1437E0 | 24D0 | .pdata | ExceptionHook | Pointer to 24D0 - 0x18D0 .text + UnwindInfo: .rdata |
| 1437EC | 2550 | .pdata | ExceptionHook | Pointer to 2550 - 0x1950 .text + UnwindInfo: .rdata |
| 1437F8 | 25A0 | .pdata | ExceptionHook | Pointer to 25A0 - 0x19A0 .text + UnwindInfo: .rdata |
| 143804 | 25E0 | .pdata | ExceptionHook | Pointer to 25E0 - 0x19E0 .text + UnwindInfo: .rdata |
| 143810 | 2600 | .pdata | ExceptionHook | Pointer to 2600 - 0x1A00 .text + UnwindInfo: .rdata |
| 14381C | 2640 | .pdata | ExceptionHook | Pointer to 2640 - 0x1A40 .text + UnwindInfo: .rdata |
| 143828 | 26A0 | .pdata | ExceptionHook | Pointer to 26A0 - 0x1AA0 .text + UnwindInfo: .rdata |
| 143834 | 2700 | .pdata | ExceptionHook | Pointer to 2700 - 0x1B00 .text + UnwindInfo: .rdata |
| 143840 | 2E10 | .pdata | ExceptionHook | Pointer to 2E10 - 0x2210 .text + UnwindInfo: .rdata |
| 14384C | 2E40 | .pdata | ExceptionHook | Pointer to 2E40 - 0x2240 .text + UnwindInfo: .rdata |
| 143858 | 2E70 | .pdata | ExceptionHook | Pointer to 2E70 - 0x2270 .text + UnwindInfo: .rdata |
| 143864 | 2EA0 | .pdata | ExceptionHook | Pointer to 2EA0 - 0x22A0 .text + UnwindInfo: .rdata |
| 143870 | 2ED0 | .pdata | ExceptionHook | Pointer to 2ED0 - 0x22D0 .text + UnwindInfo: .rdata |
| 14387C | 2F10 | .pdata | ExceptionHook | Pointer to 2F10 - 0x2310 .text + UnwindInfo: .rdata |
| 143888 | 2F40 | .pdata | ExceptionHook | Pointer to 2F40 - 0x2340 .text + UnwindInfo: .rdata |
| 143894 | 2F77 | .pdata | ExceptionHook | Pointer to 2F77 - 0x2377 .text + UnwindInfo: .rdata |
| 1438A0 | 2FD8 | .pdata | ExceptionHook | Pointer to 2FD8 - 0x23D8 .text + UnwindInfo: .rdata |
| 1438AC | 3010 | .pdata | ExceptionHook | Pointer to 3010 - 0x2410 .text + UnwindInfo: .rdata |
| 1438B8 | 3070 | .pdata | ExceptionHook | Pointer to 3070 - 0x2470 .text + UnwindInfo: .rdata |
| 1438C4 | 30F0 | .pdata | ExceptionHook | Pointer to 30F0 - 0x24F0 .text + UnwindInfo: .rdata |
| 1438D0 | 3130 | .pdata | ExceptionHook | Pointer to 3130 - 0x2530 .text + UnwindInfo: .rdata |
| 1438DC | 31A0 | .pdata | ExceptionHook | Pointer to 31A0 - 0x25A0 .text + UnwindInfo: .rdata |
| 1438E8 | 3200 | .pdata | ExceptionHook | Pointer to 3200 - 0x2600 .text + UnwindInfo: .rdata |
| 1438F4 | 321F | .pdata | ExceptionHook | Pointer to 321F - 0x261F .text + UnwindInfo: .rdata |
| 143900 | 324A | .pdata | ExceptionHook | Pointer to 324A - 0x264A .text + UnwindInfo: .rdata |
| 14390C | 3290 | .pdata | ExceptionHook | Pointer to 3290 - 0x2690 .text + UnwindInfo: .rdata |
| 143918 | 32E0 | .pdata | ExceptionHook | Pointer to 32E0 - 0x26E0 .text + UnwindInfo: .rdata |
| 143924 | 33C0 | .pdata | ExceptionHook | Pointer to 33C0 - 0x27C0 .text + UnwindInfo: .rdata |
| 143930 | 33E3 | .pdata | ExceptionHook | Pointer to 33E3 - 0x27E3 .text + UnwindInfo: .rdata |
| 14393C | 397F | .pdata | ExceptionHook | Pointer to 397F - 0x2D7F .text + UnwindInfo: .rdata |
| 143948 | 39BB | .pdata | ExceptionHook | Pointer to 39BB - 0x2DBB .text + UnwindInfo: .rdata |
| 143954 | 39F0 | .pdata | ExceptionHook | Pointer to 39F0 - 0x2DF0 .text + UnwindInfo: .rdata |
| 143960 | 3A38 | .pdata | ExceptionHook | Pointer to 3A38 - 0x2E38 .text + UnwindInfo: .rdata |
| 14396C | 3BC1 | .pdata | ExceptionHook | Pointer to 3BC1 - 0x2FC1 .text + UnwindInfo: .rdata |
| 143978 | 3E4F | .pdata | ExceptionHook | Pointer to 3E4F - 0x324F .text + UnwindInfo: .rdata |
| 143984 | 3F20 | .pdata | ExceptionHook | Pointer to 3F20 - 0x3320 .text + UnwindInfo: .rdata |
| 143990 | 4300 | .pdata | ExceptionHook | Pointer to 4300 - 0x3700 .text + UnwindInfo: .rdata |
| 14399C | 50A0 | .pdata | ExceptionHook | Pointer to 50A0 - 0x44A0 .text + UnwindInfo: .rdata |
| 1439A8 | 5150 | .pdata | ExceptionHook | Pointer to 5150 - 0x4550 .text + UnwindInfo: .rdata |
| 1439B4 | 51C0 | .pdata | ExceptionHook | Pointer to 51C0 - 0x45C0 .text + UnwindInfo: .rdata |
| 1439C0 | 5210 | .pdata | ExceptionHook | Pointer to 5210 - 0x4610 .text + UnwindInfo: .rdata |
| 1439CC | 5270 | .pdata | ExceptionHook | Pointer to 5270 - 0x4670 .text + UnwindInfo: .rdata |
| 1439D8 | 5330 | .pdata | ExceptionHook | Pointer to 5330 - 0x4730 .text + UnwindInfo: .rdata |
| 1439E4 | 5482 | .pdata | ExceptionHook | Pointer to 5482 - 0x4882 .text + UnwindInfo: .rdata |
| 1439F0 | 54B0 | .pdata | ExceptionHook | Pointer to 54B0 - 0x48B0 .text + UnwindInfo: .rdata |
| 1439FC | 5508 | .pdata | ExceptionHook | Pointer to 5508 - 0x4908 .text + UnwindInfo: .rdata |
| 143A08 | 553C | .pdata | ExceptionHook | Pointer to 553C - 0x493C .text + UnwindInfo: .rdata |
| 143A14 | 5570 | .pdata | ExceptionHook | Pointer to 5570 - 0x4970 .text + UnwindInfo: .rdata |
| 143A20 | 5630 | .pdata | ExceptionHook | Pointer to 5630 - 0x4A30 .text + UnwindInfo: .rdata |
| 143A2C | 56AB | .pdata | ExceptionHook | Pointer to 56AB - 0x4AAB .text + UnwindInfo: .rdata |
| 143A38 | 56B8 | .pdata | ExceptionHook | Pointer to 56B8 - 0x4AB8 .text + UnwindInfo: .rdata |
| 143A44 | 583B | .pdata | ExceptionHook | Pointer to 583B - 0x4C3B .text + UnwindInfo: .rdata |
| 143A50 | 58C3 | .pdata | ExceptionHook | Pointer to 58C3 - 0x4CC3 .text + UnwindInfo: .rdata |
| 143A5C | 58E0 | .pdata | ExceptionHook | Pointer to 58E0 - 0x4CE0 .text + UnwindInfo: .rdata |
| 143A68 | 5920 | .pdata | ExceptionHook | Pointer to 5920 - 0x4D20 .text + UnwindInfo: .rdata |
| 143A74 | 5B20 | .pdata | ExceptionHook | Pointer to 5B20 - 0x4F20 .text + UnwindInfo: .rdata |
| 143A80 | 5D20 | .pdata | ExceptionHook | Pointer to 5D20 - 0x5120 .text + UnwindInfo: .rdata |
| 143A8C | 5D80 | .pdata | ExceptionHook | Pointer to 5D80 - 0x5180 .text + UnwindInfo: .rdata |
| 143A98 | 5E70 | .pdata | ExceptionHook | Pointer to 5E70 - 0x5270 .text + UnwindInfo: .rdata |
| 143AA4 | 5FB0 | .pdata | ExceptionHook | Pointer to 5FB0 - 0x53B0 .text + UnwindInfo: .rdata |
| 208A00 | N/A | *Overlay* | B827000000020200308227A506092A864886F70D | .'......0.'...*.H... |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 969379 | 45,2421% |
| Null Byte Code | 791284 | 36,9302% |
© 2026 All rights reserved.