PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Executable header (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 1,06 MBSHA-256 Hash: 81EE17C89B129496009A34BE54A7488275CBCD8A146DABFB8F3AC53193ACC6D6 SHA-1 Hash: CD18F986894E8F2BC9860EF1448855A6884D551D MD5 Hash: FF90D66A285C7072050B58C0AAF8A9EA Imphash: DFCD6BC6C8FAED503BA6AB52B846EF8F MajorOSVersion: 4 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 382FB0 SizeOfHeaders: 1000 SizeOfImage: 38F000 ImageBase: 400000 Architecture: x86 ImportTable: 38DCB4 Characteristics: 818F TimeDateStamp: 2A425E19 Date: 19/06/1992 22:22:17 File Type: EXE Number Of Sections: 3 ASLR: Disabled Section Names: UPX0, UPX1, .rsrc Number Of Executable Sections: 2 Subsystem: Windows GUI [Incomplete Binary or Compressor Packer - 2,50 MB Missing] |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| UPX0 | E0000080 (Uninitialized Data, Executable, Readable, Writeable) | 400 | 0 | 1000 | 27D000 | N/A | N/A |
| UPX1 | E0000040 (Initialized Data, Executable, Readable, Writeable) | 400 | 105200 | 27E000 | 106000 | 7,9246 | 121542,49 |
| .rsrc | C0000040 (Initialized Data, Readable, Writeable) | 105600 | A200 | 384000 | B000 | 5,5229 | 1447538,04 |
| Entry Point |
| The section number (2) - (UPX1) have the Entry Point Information -> EntryPoint (calculated) - 1053B0 Code -> 60BE00E067008DBE0030D8FFC78710772A00833CD0005783CDFFEB0E909090908A064688074701DB75078B1E83EEFC11DB72 • PUSHAD • MOV ESI, 0X67E000 • LEA EDI, [ESI - 0X27D000] • MOV DWORD PTR [EDI + 0X2A7710], 0XD03C83 • PUSH EDI • OR EBP, 0XFFFFFFFF • JMP 0X102A • NOP • NOP • NOP • NOP • MOV AL, BYTE PTR [ESI] • INC ESI • MOV BYTE PTR [EDI], AL • INC EDI • ADD EBX, EBX • JNE 0X1031 • MOV EBX, DWORD PTR [ESI] • SUB ESI, -4 • ADC EBX, EBX |
| Signatures |
| Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Compiler: Borland Delphi 7 Compression: UPX - Version: 2.02 Possible Compiler: Borland Delphi 7 Detect It Easy (die) • PE: packer: UPX(2.02)[NRV,brute] • PE: compiler: Borland Delphi(-)[-] • PE: linker: Turbo Linker(2.25*,Delphi)[-] • Entropy: 7.8981 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| Windows REG |
| SOFTWARE\Borland\Delphi\RTL |
| File Access |
| winmm.dll version.dll user32.dll shell32.dll oleaut32.dll ole32.dll MsVfW32.dll imm32.dll gdi32.dll comdlg32.dll comctl32.dll avifil32.dll advapi32.dll KERNEL32.DLL .dAt \.ppt |
| File Access (UNICODE) |
| Temp |
| Interest's Words |
| JFIF cipher |
| Interest's Words (UNICODE) |
| expand |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Stealth (VirtualProtect) |
| Text | Ascii | Stealer malware focused on obtaining CVV codes to conduct unauthorized transactions (CVV) |
| Entry Point | Hex Pattern | Microsoft Bitmap Graphics format |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 |
| Entry Point | Hex Pattern | UPX - www.upx.sourceforge.net |
| Entry Point | Hex Pattern | UPX 2.00-3.0X - Markus Oberhumer & Laszlo Molnar & John Reiser |
| Entry Point | Hex Pattern | UPX v0.80 - v0.84 |
| Entry Point | Hex Pattern | UPX v0.89.6 - v1.02 / v1.05 - v1.22 |
| Entry Point | Hex Pattern | UPX v2.0 - Markus, Laszlo & Reiser (h) |
| Entry Point | Hex Pattern | UPX V2.00-V2.90 - Markus Oberhumer & Laszlo Molnar & John Reiser |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \WAVE\CLICKX\2052 | 2DD1B8 | 1208 | 5F5B8 | 07074638C925CA7630B0350E30B8AC5C41A5968D3EC7EA5C1401276C244F83BD2C1F726941C3E0E4E0C7450AF8099FE4DD85 | ..F8.%.v0.5.0..\A...>..\..'l$O..,.riA.....E....... |
| \CURSOR\1\0 | 2DE3C0 | 134 | 607C0 | 8C57625E831721D0D22BD04AD684EB128985C804625D94FD04F10307DFC70340420F1448301CEACA0A148DFB9FDB03DC4D08 | .Wb..!..+.J........b].........@B..H0...........M. |
| \CURSOR\2\0 | 2DE4F4 | 134 | 608F4 | 8C90C820E448DEE5949846020823799AE69C08A003E4699A930CA40CA804A7694E8E10AC10B0696E3892051405B414905C9A | ... .H....F..y.......i........iN.....in8.......\. |
| \CURSOR\3\0 | 2DE628 | 134 | 60A28 | A809DD42722597B4B00AF290492AF2B8B89092E4906947BC4FBC91E49049A6C0C0925C1A5DA6C41523C4A0212B0D96E1C801 | ...Br%......I*.......iG.O....I....\.].....!+..... |
| \CURSOR\4\0 | 2DE75C | 134 | 60B5C | 899DE593DA4151D2E8EE50524A10ED81A02B93FA0A1BEA8855C884D2186260E4B6ECECF5E4A93B18356CBAC026D6B7953B71 | .....AQ...PRJ....+......U....b.......;.5l..&...;q |
| \CURSOR\5\0 | 2DE890 | 134 | 60C90 | 2DB0B3413A19E4606C2D896F39EC1FD0411D6C08A2FC773FBE5AFFABAFF8DA6884BE36E7E673C8A328F0B010F06890220E60 | -..A:..l-.o9...A.l...w?.Z.....h..6..s..(....h.". |
| \CURSOR\6\0 | 2DE9C4 | 134 | 60DC4 | 882F65642C04BB0120E366757440F937F41455731FD98BF2B8EC96102644263A181E6C382C3F0F2568E443DAFE183B5008B8 | ./ed,... .fut@.7..Us........&D&:..l8,?.%h.C...;P.. |
| \CURSOR\7\0 | 2DEAF8 | 134 | 60EF8 | 04546970316038E0B1241532281416DE8394B4D17D2C7C0495606060B27DA35F27C02485302B0742DC08EAF36DAA74344709 | .Tip18..$.2(.......},|...}._'.$.0+.B....m.t4G. |
| \CURSOR\8\1040 | 2DEC2C | 134 | 6102C | 321300CC0CC71E360194A1F8AC55BDD47183094CE0C9B623EC3A0FC1312A04B1A2B3603232A670A583A8293836EB1A4AB213 | 2......6.....U..q..L....:..1*....22.p...)86..J.. |
| \CURSOR\9\1040 | 2DED60 | 134 | 61160 | 948290D53806E82A4210304F2E4237007CB7D81B096903906F54D0C3AF61188FD82D943DE803ED860CF492ED70264EFB21DB | ....8..*B.0O.B7.|....i..oT...a...-.=........p&N.!. |
| \CURSOR\10\1040 | 2DEE94 | 134 | 61294 | A41D0A332A48F0440280A5F00958C536F01D8940EB3C0A7258154F8FA224401E8193681AF64780F85383CBFFDE7C952B4958 | ...3*H.D.....X.6...@.<.rX.O..$@...h..G..S....|.+IX |
| \CURSOR\11\1040 | 2DEFC8 | 134 | 613C8 | 4F9404DE5B5E3DFFB01DB03F993BB0DD0B3388980B9094397B588F1D06BC606DB2018976E8D204A48E157AC8183C8DBD113C | O...[=....?.;...3.....9{X....m...v......z..<...< |
| \CURSOR\12\1040 | 2DF0FC | 134 | 614FC | F5144C1CB6231A573E3C700FA2B003749E0CC3B938F753127168815BAF153BDBE708837643A87E3F9D1DF21CC9F4F4440C85 | ..L...W><p....t....8.S.qh.[..;....vC.~?.......D.. |
| \CURSOR\13\1040 | 2DF230 | 134 | 61630 | D084B0A7035B5A49FF5ADF370AD63B41F50F94381C4274F5FD87BC062820953466813BBB002B6B67F706145EFD33914C8C9F | .....[ZI.Z.7..;A...8.Bt.....( .4f.;..+kg....3.L.. |
| \CURSOR\14\1040 | 2DF364 | 134 | 61764 | A452C52609E94948325B2C170E84F949E168B99C344DE0E0D414D0FE4093A6D0D49DC4D80D642942811D0E230EAD0E8CAEBB | .R.&..IH2[,....I.h..4M......@........d)B......... |
| \CURSOR\15\1040 | 2DF498 | 134 | 61898 | 453EB9B54F88141EF21990EF00946FB82B7940E8B44FC08A83D428C981FF30A83684BF4AA61222DF088293123447A2693875 | E>..O.........o.+y@..O....(...0.6..J..".....4G.i8u |
| \CURSOR\16\1040 | 2DF5CC | 134 | 619CC | D3F296CF89BCEE8F301A2F2BB10F9DC0F308120F08BEB6D125C836EED6A101A48B3BF7A125EDC0278724AE08A1A8FF1D21BC | ........0./+............%.6......;..%..'.$......!. |
| \CURSOR\17\1033 | 2DF700 | 134 | 61B00 | 951D20C94BFCD1A89C6637BBC4CFFC64FD853840D5948B2EADC889A3943010A8342D9130D83999739804DC0D41633EBB3600 | .. .K....f7....d..8@.........0..4-.0.9.s....Ac>.6. |
| \CURSOR\18\1033 | 2DF834 | B4 | 61C34 | 0312D9976A93801297036D15F03094832323B00592A079E618D2200C9DE75ECC85572E7DCA789CEB19B0254152C3F38B4DF8 | ....j.....m..0......y... .....W.}.x....%AR...M. |
| \CURSOR\19\1040 | 2DF8E8 | 134 | 61CE8 | 2C3B462840C348D70D09CF2CDA384365472C503646454D5D931472E30F0B370405FB837F28B649DC01B00FB7F2C75626E611 | ,;F(@.H....,.8CeG,P6FEM]..r...7.....(.I.......V&.. |
| \CURSOR\20\1040 | 2DFA1C | 134 | 61E1C | 2D5CE0B1386DD15835706D607079A67D9096C120991898C85680ED34452F1DD43B11AAD62B6D10F7C60381135EC29F9D349D | -\..8m.X5pmpy.}... ....V..4E/..;...+m.........4. |
| \CURSOR\21\1040 | 2DFB50 | 134 | 61F50 | E1A045065768C87E2497E86A0E13C0E8D2E876CA947F0B1B640A4A6A0D9B38C598AD0BD4C7C5070DA766862324AA4347D807 | ..E.Wh.~$..j......v.....d.Jj..8..........f.$.CG.. |
| \CURSOR\22\1040 | 2DFC84 | CAC | 62084 | 2F1E469342370EC84FE18BC9493C6C3FA5382B7998419F15C84F5B229E11473B773869D958A35A5FF4309A265EBF3BF0472A | /.F.B7..O...I<l?.8+y.A...O["..G;w8i.X.Z_.0.&.;.G* |
| \CURSOR\23\1040 | 2E0930 | 134 | 62D30 | B503F6E7991056618EEC3E00061942865D6F883CE69B09E1605B3B839084CC4C08576F083F0C32943B697EBCA54AC74C5354 | ......Va..>...B.]o.<....[;....L.Wo.?.2.;i~..J.LST |
| \CURSOR\24\1040 | 2E0A64 | CAC | 62E64 | 412899445EED4C34CD84B0D63034C9057294D4D4C262CB430FEE5CE951B03413D6513BBF9A0961D73B049D986642500AB6D2 | A(.D.L4....04..r....b.C..\.Q.4..Q;...a.;...fBP... |
| \CURSOR\25\1040 | 2E1710 | 134 | 63B10 | 315172C47158202284CF0C7E741112C243E124507F5FE14E61508F82147F3F084BBA087E20DD7254498B187D7EDDCE9AD6C1 | 1Qr.qX "...~t...C.$P._.NaP....?.K..~ .rTI..}~..... |
| \CURSOR\26\1040 | 2E1844 | CAC | 63C44 | E1553216DFE53B7565A0007516F7A71E464278A0EF100D1C8493E741100D48D003AD50E8CA3AEA53DE484B0CD3AA1CA61614 | .U2...;ue..u....FBx........A..H...P..:.S.HK....... |
| \CURSOR\27\1040 | 2E24F0 | 134 | 648F0 | 845F172143C80355102490EB223FC03A82056C8E9905BA08E18AC0023790A9922BBC6C20B6C9AF837DF0019448504A17213C | ._.!C..U.$.."?.:..l.........7...+.l ....}...HPJ.!< |
| \CURSOR\28\1040 | 2E2624 | CAC | 64A24 | 2542682F21F9129828C9F7EC2BEBC04F5C5116D44EBF0E84A16B4468338BD19FCB487B7D702919137450A322840D73DDA9E4 | %Bh/!...(...+..O\Q..N....kDh3....H{}p)..tP."..s... |
| \CURSOR\29\1040 | 2E32D0 | 134 | 656D0 | E542D837640A46196F682C64428668685186114C97CF1582B06B7914409B24A6E489433C50E12463804B439027882E04690E | .B.7d.F.oh,dB.hhQ..L.....ky.@.$...C<P.$c.KC.'...i. |
| \CURSOR\30\1040 | 2E3404 | CAC | 65804 | CB08C281BD08BA15403E4A3E6864D9107DC0844722F9107DC0BE2E3960106F6050C70BB9C0E6E93183BF193C3108C26D107D | ........@>J>hd..}..G"..}...9.oP......1...<1..m.} |
| \CURSOR\31\1040 | 2E40B0 | 134 | 664B0 | 5C3CA627611528BC5307D580303FE072143224E41803C223B910A640EB7969A30D50393B78738395168E70DBCE7D2766836D | \<.'a.(.S...0?.r.2$.......@.yi..P9;xs....p..}'f.m |
| \CURSOR\32\1040 | 2E41E4 | CAC | 665E4 | 3F40B694B6B40093674058E43C03952AE210AF2F2E3B7584A58D14CC0C297AB875496E06DA50BC5067289C0121BB2828B850 | ?@......g@X.<..*.../.;u......)z.uIn..P.Pg(..!.((.P |
| \CURSOR\33\1040 | 2E4E90 | 134 | 67290 | 6D0C2720299FAD6B2D0D57319F8EE5A00DA7874CD13A1DC03E0BFE6DED6C5B6E872F206931871C0110CE136BEDB2003CC37D | m.' )..k-.W1.......L.:..>..m.l[n./ i1......k...<.} |
| \CURSOR\34\1040 | 2E4FC4 | CAC | 673C4 | 4C785FDAC8A27F2720298DCC000D5F071AE22BF279911F08B36460AF815742C62709478A63DB51F7537A8C4EA8E8481AED00 | Lx_....' )...._...+.y....d..WB.'.G.c.Q.Sz.N..H... |
| \CURSOR\35\1040 | 2E5C70 | 134 | 68070 | 2F0D05207187711E89ED8E21D873361E6D630871B802A59BF7A77441B00A2BC72FF6FA064E67202217828FA76BFF6EFDF5EF | /.. q.q....!.s6.mc.q......tA..+./...Ng "....k.n... |
| \CURSOR\36\1040 | 2E5DA4 | CAC | 681A4 | 6A0A6A0851B5506C04DF42612F81AE004FF9A02D217EC3FCBA788A7D402E2009B954E66DECD13E64882B6A19E184EC7305D8 | j.j.Q.Pl..Ba/...O..-!~...x.}@. ..T.m..>d.+j....s.. |
| \CURSOR\37\1040 | 2E6A50 | 134 | 68E50 | 43350DD76CB46E52C808BBA21F5829385772EC9D2F59074F13141EC7F4274547543CDDC40A7E474F50495B8381083B374F05 | C5..l.nR.....X)8Wr../Y.O.....'EGT<...~GOPI[...;7O. |
| \CURSOR\38\1040 | 2E6B84 | CAC | 68F84 | 2F1460992D301250E53F191A61C602A48FCFD474C05F744CEE276B4790900FEF0E2FBA2C33149A04B786551BDB2F4670B70C | /..-0.P.?..a......t._tL.'kG...../.,3.....U../Fp.. |
| \CURSOR\39\1040 | 2E7830 | 134 | 69C30 | 1DCB62F83D1EB6023EADE8EC751B0AD438E882F4690F94468FEC704ED534CC635B1268CA1D12D27C5AD0500C4928D094BC46 | ..b.=...>...u...8...i..F..pN.4.c[.h....|Z.P.I(...F |
| \CURSOR\40\1040 | 2E7964 | 134 | 69D64 | 27E057FC44DC05CECCC981DCDBA3DEF97224B1F8A72436DB076B6C0AEF161B08BBC6484175AD78BBC296122DBD14F0FC1C46 | '.W.D...........r$...$6..kl.......HAu.x....-.....F |
| \CURSOR\41\1040 | 2E7A98 | CAC | 69E98 | 03C21EA661179B048218FA88045F24050D7844F836BA606C395BAFB2012A1788D2754E2E83B8CC4242D3AE54AC368B75A8C6 | ....a........_$..xD.6.l9[...*...uN....BB..T.6.u.. |
| \CURSOR\42\1040 | 2E8744 | 134 | 6AB44 | 49A453489515E40E79164D87EC95DC817443BA31391B251B7830E8C9858F82A89E7A6E0FF817B40EF195ECD45330225DE03A | I.SH....y.M.....tC.19.%.x0.......zn.........S0"].: |
| \CURSOR\43\1040 | 2E8878 | CAC | 6AC78 | 2C43932B691EF0FB053CF96CDF106E205A03201DB89F15896B517FD02CB123B71F0565673F5FC0BE254F7469661F663FA5F4 | ,C.+i....<.l..n Z. .....kQ..,....eg?_..%Otif.f?.. |
| \CURSOR\44\1040 | 2E9524 | 134 | 6B924 | 85B1CBEE082521ED92E6A81C3C643A404B9A4BFE8A403188830C3410D79A4B9A381440181D440DB0E9341C3E200679E45CD2 | .....%!.....<d:@K.K..@1...4...K.8.@..D...4.> .y.\. |
| \CURSOR\45\1040 | 2E9658 | CAC | 6BA58 | 8B131B01697C1C0160AABC5C7D1E017FF1977C086E1F245080802086087E039F061788DF924B4E8888F34C755C2E238C4E8E | ....i|....\}.....|.n.$P.. ..~.......KN...Lu\..N. |
| \CURSOR\46\1033 | 2EA304 | 134 | 6C704 | 037E13754A488886905B3211CC72242686667F04167865512A0CBF2031288927FE185D7FBED83F8B3CC5A44069002904C5A0 | .~.uJH...[2..r$&.f...xeQ*.. 1(.'..]...?.<..@i.)... |
| \CURSOR\47\1033 | 2EA438 | 134 | 6C838 | C08B048920FDD11C87291990878734BA030926425578C3AA2057F18D0024D2B09261F1E64AE2A5A91FEAB36C06DE6E5A930C | .... ....)....4...&BUx.. W...$...a..J......l..nZ.. |
| \CURSOR\48\1033 | 2EA56C | 134 | 6C96C | 4CD2B414B8362EB8906B98A43238B4A3B425872C18B4841C05B098A419D8B04DB028AC4933B02B85AC4DAC300372F230A8F0 | L....6...k..28...%.,...........M.(.I3.+..M.0.r.0.. |
| \CURSOR\49\1033 | 2EA6A0 | 134 | 6CAA0 | B9904848A844CB859C8C3B4444E4646492C4403C4023935C2E40BC3C3DE47221273C3CC80B391999383E38481B549738CCA3 | ..HH.D....;DD.dd..@<@.\.@.<=.r!'<<..9..8>8H.T.8.. |
| \CURSOR\50\1033 | 2EA7D4 | 134 | 6CBD4 | 937C13D8DF34D042E3722127D0D0388B6142A61FCCCCFF4CC82497CC44C8C899E4C385C8BF68C45C2E8209C41FC4702E3621 | .|...4.B.r!'..8.aB.....L.$..D........h.\......p.6! |
| \CURSOR\51\1033 | 2EA908 | 134 | 6CD08 | 4A808080BB5CDA5B9178F4C9F8A98F84CBE5CCFCD060402447B134383C9574B0B9ABA40C39A783A79885B6035D5031A01089 | J....\.[.x...........@$G.48<.t.....9.......]P1... |
| \CURSOR\52\1033 | 2EAA3C | 134 | 6CE3C | 17AB4DDF6A7D1C5CBE4B8301C57F1E177C1BA5876BB980704B84B94CF2E020015B0864B78C0C057288B383B7527924258683 | ..M.j}.\.K......|...k..pK..L.. .[.d....r....Ry$%.. |
| \CURSOR\53\1033 | 2EAB70 | 134 | 6CF70 | 3F883B8937862AC0DE89338A87C5ABC2845C858537E11954908503A0C21A74F7B230AD30089C57523C75462989B02520EF10 | ?.;.7.*...3......\..7..T......t..0.0..WR<uF)..% .. |
| \CURSOR\54\1033 | 2EACA4 | 134 | 6D0A4 | 9835DDD99B6547D66A6789E7EEFC0A842423FCC51E620AA1AB7E0052EB5AC34A4F2F9F8417C33701557472E6830C4F826824 | .5...eG.jg......$...b...~.R.Z.JO/....7.Utr...O.h$ |
| \CURSOR\55\1033 | 2EADD8 | 134 | 6D1D8 | 00D8AE508B080D604650BA15C4E5068F1CB582227648178AC3CDF660D9FF75010C2B0606DD0401BDEF7D9A0525490527076D | ...P...FP........."vH.......u..+.......}..%I.'.m |
| \CURSOR\56\1040 | 2EAF0C | 134 | 6D30C | 04090E1E2C48D2086938F48213A40617A12D098536ACC198B07DB1540184DD1BB336EA86402E4FBE4009520059462D102B19 | ....,H..i8.......-..6....}.T.....6..@.O.@.R.YF-.+. |
| \CURSOR\57\1040 | 2EB040 | 134 | 6D440 | 1E1A8015EF9017274155B4056C931772B805B4058F366AEB22F3B4A14B177812C454C9059705042EB7F520C504A8E7E3B04E | .......'AU..l..r.....6j."...K.x..T........ ......N |
| \CURSOR\58\1040 | 2EB174 | 134 | 6D574 | 66F8974FFC8D061AA724276937D792C2838C2160853F4C5DE77220D864D7A2343AA1A7261EA031E23444049E5BB41A9BE323 | f..O.....$'i7.....!.?L].r .d..4:..&..1.4D..[.... |
| \CURSOR\59\1040 | 2EB2A8 | 134 | 6D6A8 | 12F48D7B109822DC9683D3A19B495E1ECDA7A51F046865422A9591625F010DC8244726E488695C132195CA930E1E0166F790 | ...{.."......I......heB*..b_...$G&..i\.!......f.. |
| \CURSOR\60\1040 | 2EB3DC | 134 | 6D7DC | 06071302860EC0FF1F41E010761A1DA8745AC3950DD176FFEDA114074D41474E4E20544558544D454D0E0C31884F67C40D5C | .........A..v...tZ....v.....MAGNN TEXTMEM..1.Og..\ |
| \CURSOR\61\1040 | 2EB510 | 134 | 6D910 | 6A9070242008FFDC9600DF473123AC5C8BB76B49D3701975D9314926692F79142C30223164923834C0C4D2D32DC767418446 | j.p$ ......G1.\..kI.p.u.1I&i/y.,0"1d.84....-.gA.F |
| \CURSOR\62\1040 | 2EB644 | 134 | 6DA44 | 8D54028B1F92A8B6A103FEEE2BB6C556A0891441F410EFCACC6EE8085D7D2EF92E25AE8081808205E1D2826C852994259DA8 | .T..........+..V...A.....n..]}...%.........l.).%.. |
| \BITMAP\BBABORT\0 | 2EB778 | 1D0 | 6DB78 | E04601EE8B9671140A751EDAF795404D3B865929375B68CBFE2172E6EB195E9E7E122D7DC97707BF642D0E2077EBF0BC05EA | .F....q..u....@M;.Y)7[h..!r....~.-}.w..d-. w..... |
| \BITMAP\BBALL\0 | 2EB948 | 1E4 | 6DD48 | 7D24EAF7015F4A292F7C2948D8356B3213736A4D13FC22B7C07E14B8740F8DB91778EB0D1D4D1070D158CDF876D0413FF081 | }$..._J)/|)H.5k2.sjM.."..~..t....x...M.p.X..v.A?.. |
| \BITMAP\BBCANCEL\0 | 2EBB2C | 1D0 | 6DF2C | 25F99478958EAF83063B34A59414B774DB3DDD8D55DB7FC1BFD88500BC529CD5018AB6939103728388EA213E1BCFCE9F0490 | %..x.....;4....t.=..U........R........r...!>...... |
| \BITMAP\BBCLOSE\0 | 2EBCFC | 1D0 | 6E0FC | 6193F89DA655DCB34002E479DB4E196F340C0C27C2350C03D06536049AB541642B4340084234C64775D0BA1415281F139745 | a....U..@..y.N.o4..'.5...e6...Ad+C@.B4.Gu....(...E |
| \BITMAP\BBHELP\0 | 2EBECC | 1D0 | 6E2CC | 2B144F822981BAC2B7B759FC036878C8BA860B988B8665B9B4838BD7F591091414287F2150E489A3703F527F25B903B8FD0A | +.O.).....Y..hx.......e..........(.!P...p?R.%..... |
| \BITMAP\BBIGNORE\0 | 2EC09C | 1D0 | 6E49C | D89FB0C56B2B3C981D6C00616152B0629FF1B7740F89CFAED7006DF020DB064F592F317C06AD6B0C00476C474CA04A653B49 | ....k+<..l.aaR.b...t......m. ..OY/1|..k..GlGL.Je;I |
| \BITMAP\BBNO\0 | 2EC26C | 1D0 | 6E66C | 56106B4883BA64814DF05AE345D50AC1192F0D82039370A8EFDF274D088A4988880C0247946304B73B7909701B1D8A89A3E4 | V.kH..d.M.Z.E..../....p...'M..I....G.c..;y.p...... |
| \BITMAP\BBOK\0 | 2EC43C | 1D0 | 6E83C | 6A7E0767749E01E90A4B48FF0380C313F7DA84080FA288D955BA9B04DBD409C4D06E6A24212FCC09856ABCBFC88C55D82B90 | j~.gt....KH.............U........nj$!/...j....U.+. |
| \BITMAP\BBRETRY\0 | 2EC60C | 1D0 | 6EA0C | 151FF6960CC1504960DB7B58DA1590B4737C18A100378D1D952381B14973C429C21043D23262C810356814429A82E51C0CC0 | ......PI.{X....s|...7.....Is.)..C.2b..5h.B...... |
| \BITMAP\BBYES\0 | 2EC7DC | 1D0 | 6EBDC | 659D3C26858230DADB0B108B0D6404F66011167F4D91503DF8EFA2E000ED033D5A2BC27C4F5081B37BD224559550E70A1829 | e.<&..0......d.....M.P=.......=Z+.|OP..{.$U.P...) |
| \BITMAP\IDB_PLAY\1040 | 2EC9AC | E8 | 6EDAC | 8384C08EC6F0C6279D05CE00DB9C94572A850566489FDF4F691584673D296B318A17105810169BF70C58251C1865AB375D24 | .......'.......W*..fH..Oi..g=)k1...X.....X%..e.7]$ |
| \BITMAP\IDB_PREVIEW\0 | 2ECA94 | E8 | 6EE94 | E9D16E60634B771411A5901E043F464D75C451A1C885E7832054E66D446C351C1400AFF87324656CE6B3005B40EDD86972C4 | ..ncKw......?FMu.Q..... T.mDl5.....s$el...[@..ir. |
| \BITMAP\IDB_STOP\0 | 2ECB7C | E8 | 6EF7C | 413070F661F285BE0F214321075C5CC54858305511F85A309BB855BE4F4FEB0170209A2E15E886388EEFB6073ED9633B917D | A0p.a....!C!.\\.HX0U..Z0..U.OO..p .....8....>.c;.} |
| \BITMAP\PREVIEWGLYPH\0 | 2ECC64 | E8 | 6F064 | 6AC8BB8D61845F19770B58FF410F8D42A0B00A8517FF7C65697705CF20639585AF4287B00CE984BAD097F3D1C6EB9EC6697E | j...a._.w.X.A..B......|eiw.. c...B..............i~ |
| \BITMAP\PTSCP_DELETE16_8BPP\3081 | 2ECD4C | 628 | 6F14C | 45B5DA06F73B47ED59105C65F1889C24034BC5FF6939E4F2C68B8D85C50F2EBA69C49D956B0A11EC412C41732E33BA03E708 | E....;G.Y.\e...$.K..i9..........i...k...A,As.3.... |
| \BITMAP\PTSCP_DESKTOP16_8BPP\3081 | 2ED374 | 628 | 6F774 | 21925A0D684A5FBB083D1950931A06097D68F1BF340007EB738B4E7C8D2C5BDC518FA54D1E42D3C0549A8412AD3BBD08DF71 | !.Z.hJ_..=.P....}h..4...s.N|.,[.Q..M.B..T....;...q |
| \BITMAP\PTSCP_NEWFOLDER16_8BPP\3081 | 2ED99C | 628 | 6FD9C | A158E3C5AEAF3DA270748DC9409B02A95B0D6BCDDE3C641E2C3EAA344226114CA6BD5C661A64D4A8518E105D266A7BA857A0 | .X....=.pt..@...[.k..<d.,>.4B&.L..\f.d..Q..]&j{.W. |
| \BITMAP\PTSCP_TREE16_8BPP\3081 | 2EDFC4 | 628 | 703C4 | 910338CD669F921C9358491786B0FA73689127B26078EE3EEEE83AB684BB89F6EEE44605E26F43871601AF3709ACB24F0E2E | ..8.f....XI....sh.'.x.>..:.......F..oC....7...O.. |
| \BITMAP\PTSCP_UP16_8BPP\3081 | 2EE5EC | 628 | 709EC | CBF012E13F348176D22C3B1176072B1172AAAD68D478C8D5A8DFD294F78BCA03CE81F91910D670DE76F7AD81DA944A88AA2D | ....?4.v.,;.v.+.r..h.x................p.v.....J..- |
| \BITMAP\PTSCP_VIEW16_8BPP\3081 | 2EEC14 | 578 | 71014 | 18998DD44C4046249CA05AF67C108842A7E8FEF865F00F6D5DDE6FF0E702BB2F47CA03C11A56300F731C58700510AAF93A81 | ....L@F$..Z.|..B....e..m].o..../G....V0.s.Xp....:. |
| \BITMAP\SPINDOWN\1033 | 2EF18C | 98 | 7158C | B98A1B1299EDC1E7FC6654BA061007A2B42A4006C407F092125694BBA66F5FCFA0D52E46941B3BCE7EA293C215EEDA747D10 | .........fT......*@......V...o_....F..;.~......t}. |
| \BITMAP\SPINUP\1033 | 2EF224 | 98 | 71624 | 17BFB80B19525B34484AF2700E0624ED83205A69D622436C36184D0C08342EF2F660C244A88EFBF625EA9DA5C7B3BC90760A | .....R[4HJ.p..$.. Zi."Cl6.M..4....D....%.......v. |
| \BITMAP\TBXGLYPHS\0 | 2EF2BC | B0 | 716BC | 3F02B509FD893E71A792AE10B485D729231E12BCB150202747141454F041C914B7B8B6759C4C60CB81187318180C24438118 | ?.....>q.......)....P 'G..T.A.....u.L...s...$C.. |
| \ICON\1\2052 | 3871BC | EA8 | 1087BC | 2800000030000000600000000100080000000000800A00000000000000000000000100000000000000000000397C34005D5D | (...0......................................9|4.]] |
| \ICON\2\2052 | 388068 | 8A8 | 109668 | 28000000200000004000000001000800000000008004000000000000000000000001000000000000000000002B7F28006C6C | (... ...@...................................+.(.ll |
| \ICON\3\2052 | 388914 | 6C8 | 109F14 | 2800000018000000300000000100080000000000A0020000000000000000000000010000000000000000000028792B007D7D | (.......0...................................(y+.}} |
| \ICON\4\2052 | 388FE0 | 568 | 10A5E0 | 280000001000000020000000010008000000000040010000000000000000000000010000000000000000000008841100098A | (....... ...........@............................. |
| \ICON\5\2052 | 38954C | 25A8 | 10AB4C | 2800000030000000600000000100200000000000802500000000000000000000000000000000000000000000000000000000 | (...0........ ......%............................ |
| \ICON\6\2052 | 38BAF8 | 10A8 | 10D0F8 | 2800000020000000400000000100200000000000801000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... |
| \ICON\7\2052 | 38CBA4 | 988 | 10E1A4 | 2800000018000000300000000100200000000000600900000000000000000000000000000000000000000000000000000000 | (.......0..... .................................. |
| \ICON\8\2052 | 38D530 | 468 | 10EB30 | 2800000010000000200000000100200000000000400400000000000000000000000000000000000000000000000000071C1C | (....... ..... .....@............................. |
| \DIALOG\DLGTEMPLATE\0 | 2F5B2C | 52 | 77F2C | 0279D7BE53ABB6608DD719872F480B0EB92CBF26C61F8F80D6CF038BB27CECEA4AC3930F34401D9431416355510552FAE76F58BA14805C3C8314C098654D06F0C1B4258C93C28A7180F2A1406405D09C0059 | .y..S....../H...,.&.........|..J...4@..1AcUQ.R..oX...\<....eM....%....q...@d....Y |
| \DIALOG\IDD_IETEMPLATE\0 | 2F5B80 | 3E | 77F80 | 4680830B366C4C1E8D5894F06D6ABF1E1301751D168EBC8BAB7C135A7CC990944DAE9858A12C92744C4C61639BA4303D13AEDC692283BB50F10D1003A495 | F...6lL..X..mj....u......|.Z|...M..X.,.tLLac..0=...i"..P...... |
| \DIALOG\IDD_IETEMPLATE1\0 | 2F5BC0 | 3E | 77FC0 | 3D608721B5488B19AEADBD532142CC0B62B01CD0C86F473DF6B94074E2B8EFFF669724D1B896AE55B85EBA450B69D301A26C334875B4350ACFCB5A45AB77 | =.!.H.....S!B..b....oG=..@t....f.$....U..E.i...l3Hu.5...ZE.w |
| \STRING\4078\0 | 2F5C00 | AC | 78000 | 93185B5248419A6F382E8E7CD484344973581AD8C810A490D025C96052B964ECA0691F1F70E5870C1DCC1675E0838713A495 | ..[RHA.o8..|..4IsX.......%.R.d..i..p......u...... |
| \STRING\4079\0 | 2F5CAC | 354 | 780AC | 686962EB0B2B1F1818D1C116710E77584F94A553D240585869A9A326D3073913EAACC7C394A70204E7209145EE946464DDEF | hib..+......q.wXO..S.@XXi..&..9.......... .E..dd.. |
| \STRING\4080\0 | 2F6000 | 488 | 78400 | D2DD0862CCCFE7221DDC7604A91C13EC94FC0108BE124E187FEC01B7DC8CF5D43EFF1F6D859C9C9C4004684E1318C180DF2D | ...b..."..v...........N.........>..m....@.hN.....- |
| \STRING\4081\0 | 2F6488 | 4E4 | 78888 | 0D20E1F76D7481FF0D2A3B3CA93E790CD8C4B97F701C2727C4C0AFC064DA2147B106487BBC26604E06BCB816DC9E9F19030A | . ..mt...*;<.>y.....p.''....d.!G..H{.&N.......... |
| \STRING\4082\0 | 2F696C | 3E8 | 78D6C | 6B1A9EB0D053CD7084E38C542C4A544464894383051F465C420EC929073001A9FC5C5200DC6587C01D900A7EC3753320D680 | k....S.p...T,JTDd.C...F\B..).0...\R..e.....~.u3 .. |
| \STRING\4083\0 | 2F6D54 | C0 | 79154 | 092933D20AE3ED2BE1BE91E204178A801549E000B89747006B21484C860C5ED2C680975F4FEA2D4B1F737083BE257E63128B | .)3....+.........I....G.k!HL......_O.-K.sp..%~c.. |
| \STRING\4084\0 | 2F6E14 | 104 | 79214 | 2390C093123B6549DDB1A170341EC34F0D83FAE835F7EFF2C05809E0E0106021B8ED1A101ACBC62DF88416C6919FF10D88F1 | ....;eI...p4..O....5....X....!.......-.......... |
| \STRING\4085\0 | 2F6F18 | 1A4 | 79318 | 1308192A58281AC20358D95724942EE77F5F30A5780B3673149482D6FC00FD56C153ED7FD8EE4816144B01E2D87F17150CFD | ...*X(...X.W$...._0.x.6s.......V.S....H..K........ |
| \STRING\4086\0 | 2F70BC | 3F0 | 794BC | 69278503CB1A08083BD65B83C1607D0946E2655DC01BC17FEE2AEFEB0C2B2EE8E8A0FDDE09C1E90AB7526953DA29C1E11609 | i'......;.[..}.F.e].....*...+...........RiS.).... |
| \STRING\4087\0 | 2F74AC | 3F4 | 798AC | 68188A45256D0DEDEE880325ED285222303427EC7E0000D369F45EBAEB726CF12D1C0C88C3EB654044350E5B52C54702EC5D | h..E%m.....%.(R"04'.~...i...rl.-.....e@D5.[R.G..] |
| \STRING\4088\0 | 2F78A0 | 3C4 | 79CA0 | 8D57FE118628A7AC75EE478AEAF4D5DDA6B85B6D0AEE8B8C158D131AC6B52938691514A59843293B0C2248F81A0EB0720DE6 | .W...(..u.G.......[m..........)8i....C);."H....r.. |
| \STRING\4089\0 | 2F7C64 | 3A0 | 7A064 | 5BAB0A16338AD304BD9086CD8F9F29B8F65EF90E0F82799370611D834C846E157ACE6FC9D08DBD9B847FC09D5713DFF57A0C | [...3.........)......y.pa..L.n.z.o.........W...z. |
| \STRING\4090\0 | 2F8004 | 440 | 7A404 | ABA7426B10D1D4277CDFD747034CEC8BC86543538EE5D5B1BC052C3B2DC179542269301963C9310162FCD8C02112483F975C | ..Bk...'|..G.L...eCS......,;-.yT"i0.c.1.b...!.H?.\ |
| \STRING\4091\0 | 2F8444 | EC | 7A844 | 14164801FA8443C3FE0083312E322E2AAF085A93ACFFC23324E277FE089E482A05C90F41A0B1178BDD8062605CCBEF52BA44 | ..H...C....1.2.*..Z....3$.w...H*...A......b\..R.D |
| \STRING\4092\0 | 2F8530 | D0 | 7A930 | 1BFF6C86EEE20C5874895B5CBACF4D1F447D5438D77006E8D37D04A4FAC70C0907D3EE86847828BAD5B1EB90927CED1ABAE7 | ..l....Xt.[\..M.D}T8.p...}...........x(......|.... |
| \STRING\4093\0 | 2F8600 | 29C | 7AA00 | 30EFEDA2F3A2C9013920FFA20CA332813542C0FD90B66EB78AD3EA3C08004E2B48EAF0BF5F8F36F10C6F342B7B5B92E8FE03 | 0.......9 ....2.5B....n....<..N+H..._.6..o4+{[.... |
| \STRING\4094\0 | 2F889C | 3A0 | 7AC9C | C8D64B8BCC158120089624E21C1E0CFC26DE533401AEFBD1044AC273032B4B31800BEF6DA518296B680E8437C91170D0A42E | ..K.... ..$.....&.S4.....J.s.+K1...m..)kh..7..p... |
| \STRING\4095\0 | 2F8C3C | 374 | 7B03C | 296D90773BAC294DF7AF433D647BC73ED03B158C2E010043AC9CA4B9A41C02B4083E28948EB8D2102F8A93BCB98F4A9DCA72 | )m.w;.)M..C=d{.>.;.....C.........>(...../.....J..r |
| \STRING\4096\0 | 2F8FB0 | 318 | 7B3B0 | E733C40FBC9248834E0840E70801C226AD8FBF4C50D30A13F2FF22383470E0CB54E303BC681B4EA74C600FAA1CCE7BC7B766 | .3....H.N.@....&...LP....."84p..T...h.N.L....{..f |
| \RCDATA\DVCLAL\0 | 2F92C8 | 10 | 7B6C8 | 267A8CE69DDB00F338511240FBE7D7BC | &z......8Q.@.... |
| \RCDATA\PACKAGEINFO\0 | 2F92D8 | 9D4 | 7B6D8 | D61648C8AB2AE004371AA03E0E5C7E5FF908B072A80C0AD7233F1E10C3F5146C3A3361D40F18193F06F7BBF31C1F208FC275 | ..H..*..7..>.\~_...r....?.....l:3a....?...... ..u |
| \RCDATA\TABOUTWINDOW\0 | 2F9CAC | EC5 | 7C0AC | 0E426C8307CD583ED92DFC662C0411DC916C358EDBC88BD26EEE747C938CF0911DDC8AA05670972B2BC3B0537FF85901B001 | .Bl...X>.-.f,....l5.....n.t|........Vp.++..S..Y... |
| \RCDATA\TADJUSTCOLORBCG\0 | 2FAB74 | 13DD | 7CF74 | 3109DD5AFFE972CB47681311035709349478215285B868383ECAE48A865F9C0D8A19881A464602BCFE77F35F689D01080751 | 1..Z..r.Gh...W.4.x!R..h8>...._......FF...w._h....Q |
| \RCDATA\TADJUSTCOLORHSL\0 | 2FBF54 | 13F5 | 7E354 | 644A37D07312508A0401E03700655A2372EE9A86C608A1ADF790BE5798D986A71DB4AC54027030854506CC967EDA55E4ABE4 | dJ7.s.P....7.eZr..........W.......T.p0.E...~.U... |
| \RCDATA\TADJUSTCOLORRGB\0 | 2FD34C | 13E3 | 7F74C | 5EA5D2DC331A03120D193810FCD3320F730ABA0BBC625F16947584B7AC20CA0AE18108752C5A88CB7C20E3908851DD405080 | ...3.....8...2.s....b_..u... .....u,Z..| ...Q.@P. |
| \RCDATA\TCAPTUREFREEHAND\0 | 2FE730 | 12AE | 80B30 | 43BDBBD892D96D72E0EB1BCB14AD05390561EDCEFCB0F188E715177CF0E38F1E207C60028D0F66D1A2081C61ED229EF7B108 | C.....mr.......9.a.........|.... |...f....a.".... |
| \RCDATA\TCAPTUREHTML\0 | 2FF9E0 | 293 | 81DE0 | D3041C0F1B960A61C1084C12FDD2B5971CBA9565FFBF1962DA050EF49013BAB335C71B5A406A2ABB18EA888BC1CE634BB3E6 | .......a..L........e...b........5..Z@j*.......cK.. |
| \RCDATA\TCAPTUREWINDOWS\0 | 2FFC74 | 26F | 82074 | F84262BA15D440CB8BC7054C12117024DDEFC035715613915E088E8FDF757195FEF82A8A13A0049DE9684B6305A0F606CA06 | .Bb...@....L..p$...5qV......uq...*......hKc...... |
| \RCDATA\TCOLORPICKER\0 | 2FFEE4 | E6F | 822E4 | 06E080E9641836F7C2F8BA9D971E695E90F7285F46021604FA4860690606FC77DCDA439F751D8A888A420AC88AA00ACA7486 | ....d.6.......i..(_F....Hi...w..C.u....B......t. |
| \RCDATA\TCOLORPICKERSHOW\0 | 300D54 | 14C5 | 83154 | 8456014DE7891CB7F4B54983ACC9FF59D91C090B5010017611E8B394AA1453811A495831694F8410135FE7E4D4C13CE44195 | .V.M......I....Y....P..v......S..IX1iO..._....<.A. |
| \RCDATA\TCOMMENTSETTINGS\0 | 30221C | 18D6 | 8461C | 077DC421F50EE41A223F48304D1BB636E4D1BCCA9ABCF3AE4169C49831EC363B2B78326E7F083A5E98AFE432817CA17CB4B4 | .}.!...."?H0M..6........Ai..1.6;+x2n..:...2.|.|.. |
| \RCDATA\TEDGESETTINGS\0 | 303AF4 | 19B0 | 85EF4 | A2E01A8E93BFF51108F9B4C594DD43D3EA6720F938183038E2B98A1648A00DAD9B7C5CC2619560403148FAB0211E04B50B2F | ..............C..g .8.08....H....|\.a.@1H..!..../ |
| \RCDATA\TEMAILWINDOW\0 | 3054A4 | CD8 | 878A4 | 030FC0EB1BF808AFC7D40057E04718554759106794F96C9A683414A06A95B55F413F20C1F80BC103C849C0145DF8D2862F14 | ...........W.G.UGY.g..l.h4..j.._A? ......I..].../. |
| \RCDATA\TEXPANDCANVAS\0 | 30617C | 408B | 8857C | 031C154B4635314EB71E470C2427138D3182A380B713551F2C025614A44CF515007EB22ABDEC09438B172EC758358105CD9F | ...KF51N..G.$'..1.....U.,.V..L...~.*...C....X5.... |
| \RCDATA\TFIEPRNFORM1\0 | 30A208 | 4FB4 | 8C608 | 20F80CAB0675A132CE04E2C713BC30EE75EC68B095F6EAC60E20D683429AF3D86763EBA2FF4E7FD1E54A82094F14016A2010 | ....u.2......0.u.h...... ..B...gc...N...J..O..j . |
| \RCDATA\TFIEPRNFORM2\0 | 30F1BC | 425A | 915BC | 092BA184D31A8564077F81CA2D3918C3FF48A776E81066039C12FF42805C58A416C030C9DDBBF0B702F283EECF890B0D3C23 | .+.....d....-9...H.v..f....B.\X...0.............< |
| \RCDATA\TFIEPRNFORM3\0 | 313418 | 5207 | 95818 | 83E7A23BD685E44874A192B8C9490B259BE9C3029147F428FB6DDA28AC6DDCB500310748DF04157CB35E7F9F4458262D7ED4 | ...;...Ht....I.%.....G.(.m.(.m...1.H...|...DX&-~. |
| \RCDATA\TFILETEMPLATEWIN\0 | 318620 | 17E8 | 9AA20 | DDAF269E2083FE1175CB774B17F6940DC04804FEC81B4F6B74FDE6040775DFBA603AA7B158ED075888435A041AAB9606B589 | ..&. ...u.wK.....H....Okt....u..:..X..X.CZ....... |
| \RCDATA\TFIOPREVIEWS\0 | 319E08 | 554D | 9C208 | 3C8018E4A4DB69C767FC04A400A52564FC2300A40C5DA741A612645B61256E81C05CCF6B3705E83A5017D20A11643D3F9020 | <.....i.g.....%d....].A..d[a%n..\.k7..:P....d=?. |
| \RCDATA\TFPREVIEWS\0 | 31F358 | 5080 | A1758 | 4D415F21418523F009212599C9B768570B24479126526D0A0223274D289120F89D2573FD59AABD517CF2284BA762E04AB126 | MA_!A...!%...hW.$G.&Rm..'M(. ..%s.Y..Q|.(K.b.J.& |
| \RCDATA\TFULLSCREENPREVIEW\0 | 3243D8 | 102D | A67D8 | 8C5DA067B3007E9983877013D08B3588342F9AFA11C0C11E40400A2B00BB94F0D078763C7F623E02FF2D597856C83AB64C0E | .].g..~...p...5.4/......@@.+.....xv<.b>..-YxV.:.L. |
| \RCDATA\THOTKEYWIN\0 | 325408 | 5AB | A7808 | A7109EF6AAD0F4A580373B2C03652C028DC9340584A50C8410B6B1E17E152BD626A7931DEB1329E58910C2257072CA5B4458 | .........7;,.e,...4.........~.+.&.....)....%pr.[DX |
| \RCDATA\TIMGFRAME\0 | 3259B4 | 2936D | A7DB4 | 249D440B9B89006F30B0B5250829D9053CBB6C6C4F5DFAF8B9DEC91F144F0DCED33CF0404EECB704D9B92D354E1D5D7F45B2 | $.D....o0..%.)..<.llO].......O...<.@N.....-5N.].E. |
| \RCDATA\TMAINPANEL\0 | 34ED24 | F84C | D1124 | C70AC7B1AFD1F88D5330AB8D53341D5E58A33138595FDA5BF26A6FD9181D6FE31660DC1CA7A7522F98F45BF4E7F6288564A5 | ........S0..S4.X.18Y_.[.jo...o......R/..[...(.d. |
| \RCDATA\TMAINWIN\0 | 35E570 | 273 | E0970 | 03129F3D7AB1261AAF05D72727F92082DD26B666EFB59ED07102F3EFC61CD29036B700E8779684977530F334B66629C9243F | ...=z.&....''. ..&.f....q.......6...w...u0.4.f).$? |
| \RCDATA\TMYFULLPREVIEW\0 | 35E7E4 | 1E3B | E0BE4 | F092D34E3760513764396829219C841F3240AF91C36C1DFDC0893D0213709538740774204D6006787620073648077C1B3280 | ...N7Q7d9h)!...2@...l....=..p.8t.t M.xv .6H.|.2. |
| \RCDATA\TMYMULTILINEINPUT\0 | 360620 | 439 | E2A20 | 5D5D0E74C7B6222F495E5BCA17F25E0F000D90E7C16253BB6060716C6BB91003885CC86BE3644664119A4102E32B952131C2 | ]].t.."/I[.........bS.qlk....\.k.dFd..A..+.!1. |
| \RCDATA\TPRINTWINDOW\0 | 360A5C | 567C | E2E5C | 9BD679742D4889374C6D6291C6409E8BC3142210370B2BC161C1992D31540732206B69834B5805DC305C3A45DC28A360A905 | ..yt-H.7Lmb..@....".7.+.a..-1T.2 ki.KX..0\:E.(... |
| \RCDATA\TPTFRMFOLDERBROWSEDLG\0 | 3660D8 | 8DD | E84D8 | 8084FF9140A5B933F8E0FD0CBA070B48D2BBEB1896EC316D160085040C5BA1B0A04F83FD65C203B8449B2CF2584825601085 | ....@..3.......H......1m.....[...O..e...D.,.XH%.. |
| \RCDATA\TPTFRMOPENDLG\0 | 3669B8 | 1744 | E8DB8 | 646CCFF33CCF747C848C949C3CCFF33CA4ACB4BCC4F33CCFF3CCD4DCE4ECE7693ECFF4FC04840C149EE7799E1C242C343C44 | dl..<.t|....<..<......<........i>.........y..$,4<D |
| \RCDATA\TRECTANGLECAPTURE\0 | 3680FC | 130D | EA4FC | 00C8E6C7877EE81CF81C8982FBD5083F0C1D51061F049EE7C05429A6066C01A0DDD9059FE89B7829760102B64BB8C0BF87C9 | .....~.........?..Q......T)..l........x)v...K..... |
| \RCDATA\TRESIZEIMAGE\0 | 36940C | 8E2 | EB80C | FFFF28A57289DA1BDACC57EC11783C5D5B5B457E172697CFAB7C3EC7FB5BA5923247FFFF37FCE91D0B651FC37C5B5931B479 | ..(.r.....W..x<][[E~.&...|>..[..2G..7....e..|[Y1.y |
| \RCDATA\TSCREENMAGNIFIER\0 | 369CF0 | 420 | EC0F0 | 5584ACAB0A45BC141FB411C7559D4004375AF5FF05CAF3CD98183976ECD8E0406C7E245698A7BFE3FFA66A9CF8AA53D5DC0A | U....E......U.@.7Z........9v...@l~$V......j...S... |
| \RCDATA\TSELECTIONSIZE\0 | 36A110 | 980 | EC510 | 20209E3871A2431B7193DA88C305517AEAD87AB90D347A8D14C44422E1F484CC7FD5FFFF80D269DA663654768873CDB2AC28 | .8q.C.q.....Qz..z..4z...D"..........i.f6Tv.s...( |
| \RCDATA\TSETTINGSWIN\0 | 36AA90 | 4807 | ECE90 | 05BAAC1C2610FDA8FDFF7F21DE6EDBB55DCD366C37EDAD6EDC1C44C9971EB0E86160FFEDFF375A3C46465C4F1D012F10BA91 | ....&......!.n..].6l7..n..D.....a...7Z<FF\O../... |
| \RCDATA\TSHADOWSETTINGS\0 | 36F298 | ABC | F1698 | 006BC8ECC953A91440E1C34A7BA3AC213556B9A7EDB4742DA91F17E903FAA0B38168BB04DE2E1B551D8B05B60EC32349E51A | .k...S..@..J{..!5V....t-.........h.....U......I.. |
| \RCDATA\TSHARPENBLUR\0 | 36FD54 | DD3 | F2154 | 5C8F023F2F1F856B47295C4F3F483038614B3347F4D74B3365E9008701593AD11EE8013FA02509F95B65673F453935876569 | \..?/..kG)\O?H08aK3G..K3e....Y:....?.%..[eg?E95.ei |
| \RCDATA\TTEXTBOARD\0 | 370B28 | 8644 | F2F28 | 37F8772DE3975F93ED118112FFFFFFFF68162988350ED61FE6C7A1DFDE9699BA5878A584F5576372221BFFC3839B9646FF2F | 7.w-.._.........h.).5...........Xx...Wcr"......F./ |
| \RCDATA\TTEXTOPTIONSWIN\0 | 37916C | 3E7C | FB56C | 5357AFDF342053C915103857C854722E3511C9814C253949955C215336123BB03A8555D790933985705146152D9043FE264C | SW..4 S...8W.Tr.5...L%9I.\!S6.;.:.U...9.pQF.-.C.&L |
| \RCDATA\TTIPOFDAY\0 | 37CFE8 | 331 | FF3E8 | 7FB53419061FA70704582960CF2F283A605056370082E5D13E4AC64FE88B2A8C67BD4A4A028D228E3FA5E6422230DA0C1D3E | ..4......X)./(:PV7....>J.O..*.g.JJ..".?..B"0...> |
| \RCDATA\TTREGISTER\0 | 37D31C | D0F | FF71C | BEDE07F7478C7DE42C953E108C102780689109353F20765B21E795006E4DD716BF3742D18087B707560C68FFD703095C61BE | ....G.}.,.>...'.h..5? v[!...nM...7B.....V.h....\a. |
| \GROUP_CURSOR\1795\1040 | 37E02C | 22 | 10042C | 61A329398069CB31C4BA0D1B45E2695451E7D1980EB82805099F846AC2C609220417 | a.)9.i.1....E.iTQ.....(....j...".. |
| \GROUP_CURSOR\1796\1040 | 37E050 | 22 | 100450 | 458C08246992884017A917452422C5E54D61B311C50D3FE15648D818E716808B225F | E..$i..@...E$"..Ma....?.VH......"_ |
| \GROUP_CURSOR\1797\1040 | 37E074 | 22 | 100474 | 814504C5E0C2BA700C6FEF8140818B0DF1810207C16D0DF348A6A00375371122C8C6 | .E.....p.o..@........m..H...u7.".. |
| \GROUP_CURSOR\1798\1040 | 37E098 | 22 | 100498 | 47E452E323630D3F25845D445D092F050017A3A505868D548D52A197AB4D84770083 | G.R.c.?%.]D]./........T.R...M.w.. |
| \GROUP_CURSOR\1799\1040 | 37E0BC | 22 | 1004BC | 9651262671815140462059625F227106DF8524925C063404E05AEDD88B8587889822 | .Q&&q.Q@F Yb_"q...$.\.4..Z......." |
| \GROUP_CURSOR\1800\1040 | 37E0E0 | 22 | 1004E0 | B75009122B2D182164237DB10B628AB70E4324A892889F25A28148240F2BEDA5CB23 | .P..+-.!d}..b...C$....%..H$.+... |
| \GROUP_CURSOR\1801\1040 | 37E104 | 22 | 100504 | BD90AD2829930AA84D62A8571697429C36114F72A288861706549462C8869922B1B6 | ...()...Mb.W..B.6.Or.....T.b...".. |
| \GROUP_CURSOR\1802\1040 | 37E128 | 22 | 100528 | EB202923CD33B02E0A6525FD0CC02612D8B3F1A346FAC1724808D566483F9007A0C4 | . ).3...e%...&.....F..rH..fH?.... |
| \GROUP_CURSOR\1803\1040 | 37E14C | 14 | 10054C | 17010000ED21799216304800B5B2B505A5815405 | .....!y..0H.......T. |
| \GROUP_CURSOR\1805\1040 | 37E160 | 22 | 100560 | 1EA65405EDDBD6058FD01E2088DFD6DE05D90B1A55BE0AED94AAA0058FE3DEB00523 | ..T........ ........U............ |
| \GROUP_CURSOR\1806\1040 | 37E184 | 22 | 100584 | FD05753B52159111F8347668A90559FF0005820A49C09BA6ACA7346FDE058F4B4CB7 | ..u;R....4vh..Y.....I.....4o...KL. |
| \GROUP_CURSOR\1807\1040 | 37E1A8 | 22 | 1005A8 | 04892F5B5B5B5B8329011D155B5B5BD7353B565B2CB5774D4704A1050A195F076FB5 | ../[[[[.)...[[[.5;V[,.wMG....._.o. |
| \GROUP_CURSOR\1808\1040 | 37E1CC | 22 | 1005CC | 5FBFFB1315A26A05FFD252D3D8059535A06D6B9B895F6523C5563B5ABF00653B8255 | _.....j...R....5.mk.._e.V;Z..e;.U |
| \GROUP_CURSOR\CRMYARROW\1033 | 37E1F0 | 14 | 1005F0 | 17233D82ADDA28233B1603AAB605F5DA42D3DAEB | .=...(;.......B... |
| \GROUP_CURSOR\CRMYCLOSEHAND\1033 | 37E204 | 14 | 100604 | E7059529537BA16D89595F8300DA6A1762170065 | ...)S{.m.Y_...j.b..e |
| \GROUP_CURSOR\CRMYCROSS\1033 | 37E218 | 14 | 100618 | 41C1A825DA7D2337C156B151A73B8E15554B050D | A..%.}7.V.Q.;..UK.. |
| \GROUP_CURSOR\CRMYFREEHAND\1033 | 37E22C | 14 | 10062C | D8A650D39589836D63692B011D656DB155308FDD | ..P....mci+..em.U0.. |
| \GROUP_CURSOR\CRMYHOURGLASS\1033 | 37E240 | 14 | 100640 | D1AD6ADA56018F16544DABFB8F4C8329C0019589 | ..j.V...TM...L.).... |
| \GROUP_CURSOR\CRMYMANIFIER\1033 | 37E254 | 14 | 100654 | B5845CB001003B4B6DB42D0B29833B5BB5D45217 | ..\...;Km.-.).;[..R. |
| \GROUP_CURSOR\CRMYOPENHAND\1033 | 37E268 | 14 | 100668 | 23D116B4B51101A7A8B62AD83B5B01B00F488B37 | .........*.;[...H.7 |
| \GROUP_CURSOR\CRMYPEN\1033 | 37E27C | 14 | 10067C | 053B626B1A8F47F783AD36A6053523AD9668A317 | .;bk..G...6..5..h.. |
| \GROUP_CURSOR\CRMYSWALLOW\1033 | 37E290 | 14 | 100690 | 771DB551C1A0B937A705362258432384A8DA8059 | w..Q...7..6"XC....Y |
| \GROUP_CURSOR\CRMYZOOM\1033 | 37E2A4 | 14 | 1006A4 | 05C614625BFBF3EF0595D4026DD0478365551BD5 | ...b[.......m.G.eU.. |
| \GROUP_CURSOR\CROCE\2048 | 37E2B8 | 14 | 1006B8 | 6E16A1D751B501B46B05A641F35861018F928305 | n...Q...k..A.Xa..... |
| \GROUP_CURSOR\CROCE1\2048 | 37E2CC | 14 | 1006CC | DA4101F7B685D8AD4C833B01084530083DC7AAA8 | .A......L.;..E0.=... |
| \GROUP_CURSOR\CROCE2\2048 | 37E2E0 | 14 | 1006E0 | 2D0701C7A7551B044795B00605B401765EA87D92 | -....U..G......v.}. |
| \GROUP_CURSOR\CROCE2+\1040 | 37E2F4 | 14 | 1006F4 | FBF7054CF805ECD38A808FFF0502DAA70095FF05 | ...L................ |
| \GROUP_CURSOR\CROCE2-\1040 | 37E308 | 14 | 100708 | 1D4002213ED1B4AAA0018F428002040A641B8381 | .@.!>......B....d... |
| \GROUP_CURSOR\CROCE3\2048 | 37E31C | 14 | 10071C | FF6D5512C68941B12A09638F5AA341B67F22ADD4 | .mU...A.*.c.Z.A..".. |
| \GROUP_CURSOR\CROCE3+\2048 | 37E330 | 14 | 100730 | 082B7A58C6A93D02015102A927EB4212A144A500 | .+zX..=..Q..'.B..D.. |
| \GROUP_CURSOR\CROCE3-\2048 | 37E344 | 14 | 100744 | 3D0A97A8928016D9AD58A2A5236520158760B310 | =........X..e .... |
| \GROUP_CURSOR\GOMMA\2048 | 37E358 | 14 | 100758 | 0236A231BFD0AA86557F3F625034186F41B5B869 | .6.1....U.?bP4.oA..i |
| \GROUP_CURSOR\MANO\2048 | 37E36C | 14 | 10076C | 3F856A4DB48DA53576909C8BF000085B64680544 | ?.jM...5v......[dh.D |
| \GROUP_CURSOR\MOVE\2048 | 37E380 | 14 | 100780 | 93ABDA0298D95F5535A262059313AB5675105999 | ......_U5.b....Vu.Y. |
| \GROUP_CURSOR\MOVE1\2048 | 37E394 | 14 | 100794 | 2D235064EFEFB084B9D732D72653407E6413ED10 | -Pd......2.&S@~d... |
| \GROUP_CURSOR\MOVE2\2048 | 37E3A8 | 14 | 1007A8 | 0013AE5220A6509150248B28402C62001164118B | ...R .P.P$.(@,b..d.. |
| \GROUP_CURSOR\MOVEX\2048 | 37E3BC | 14 | 1007BC | 8AED2A9358D56DED11ABB608018B585564ED99C4 | ..*.X.m.......XUd... |
| \GROUP_CURSOR\MOVEY\2048 | 37E3D0 | 14 | 1007D0 | AA266D12B44755ED6699075591450C7EED328950 | .&m..GU.f..U.E.~.2.P |
| \GROUP_CURSOR\PENNA\2048 | 37E3E4 | 14 | 1007E4 | 6D7F6C1B84AAED97CCFF06BBF4C40A4E8099DFFF | m.l............N.... |
| \GROUP_CURSOR\RESIZE\2048 | 37E3F8 | 22 | 1007F8 | D5461559ED7FA8CA241E6B6BED557B58319F07074516B18AFFED2452B5557F7DB0A8 | .F.Y....$.kk.U{X1...E.....$R.U.}.. |
| \GROUP_CURSOR\ZOOMMENO\2048 | 37E41C | 14 | 10081C | 969DDBFFC45AA08D0F0757D5561559ED7FAA2A93 | .....Z....W.V.Y...*. |
| \GROUP_CURSOR\ZOOMPIU\2048 | 37E430 | 14 | 100830 | 58EDADAD8241A6BF07C822D2AE27CC4FC4AAB6AA | X....A...."..'.O.... |
| \GROUP_CURSOR\32761\0 | 37E444 | 14 | 100844 | ED7F08465599EDFF7B5B72B70799FFFF2F83AE4F | ...FU...{[r...../..O |
| \GROUP_CURSOR\32762\0 | 37E458 | 14 | 100858 | AAC82212EDA0152CB67F2CFF075526B1DA7FEDA6 | .."....,..,..U&..... |
| \GROUP_CURSOR\32763\0 | 37E46C | 14 | 10086C | 828351E7EFA1627BD8D60727075F5A08882CED7F | ..Q...b{...'._Z..,.. |
| \GROUP_CURSOR\32764\0 | 37E480 | 14 | 100880 | 62B554C1FF7F05A1AA4CEDEFBE90E75DAA06EEF6 | b.T......L.....].... |
| \GROUP_CURSOR\32765\0 | 37E494 | 14 | 100894 | E9E9F41559443A1FED12AB0A56FF21585465EDFF | ....YD:.....V.!XTe.. |
| \GROUP_CURSOR\32766\0 | 37E4A8 | 14 | 1008A8 | C8F3BC838CB69406D8E1E959C4D117D4D4E9FF40 | ...........Y.......@ |
| \GROUP_CURSOR\32767\0 | 37E4BC | 14 | 1008BC | C10510EDC6FF555526715AED711A5188FF0E8342 | ......UU&qZ.q.Q....B |
| \GROUP_ICON\MAINICON\2052 | 38D99C | 76 | 10EF9C | 0000010008003030000001000800A80E000001002020000001000800A808000002001818000001000800C806000003001010 | ......00............ ............................ |
| \24\1\1031 | 38DA18 | 29B | 10F018 | 3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E653D2279 | <?xml version="1.0" encoding="UTF-8" standalone="y |
| Intelligent String |
| • kernel32.dll • advapi32.dll • avifil32.dll • comctl32.dll • comdlg32.dll • gdi32.dll • imm32.dll • msvfw32.dll • ole32.dll • oleaut32.dll • shell32.dll • user32.dll • version.dll • winmm.dll |
| Flow Anomalies |
| Offset | RVA | Section | Description |
|---|---|---|---|
| 571 | 6B7348 | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| 1168 | 68A030 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 1D2D | 68A030 | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| 30C0 | 68A030 | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| 4953 | 68A030 | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| 14B2D | 68A030 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 15E7B | 79762130 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 1A00E | 79762130 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 1C73F | 79762130 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 21141 | 79762130 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 28DCB | 13F93109 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 29D02 | 13F93109 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 2BE59 | 72646385 | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| 2C53F | 41C9183D | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 2CAAE | 209741F | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 3378D | 1E8C28A3 | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| 36BA9 | 1E8C28A3 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 38A78 | 1E8C28A3 | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| 3942B | 2C12FCA3 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 4140E | 4521EB64 | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| 42F73 | 607C0287 | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| 4FBB3 | FA011DC | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| 5465B | 1C995B20 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 56B4F | 4FF41F0 | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| 5FEB7 | 2B799E49 | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| 6064D | 541D8332 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 6BABB | 2ECF7E71 | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| 7753C | 38FA05F5 | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| 7D2F3 | 38FA05F5 | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| 7D34C | 38FA05F5 | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| 921BE | 5578D1DA | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| A4BBD | 5578D1DA | UPX1 | CALL [static] | Indirect call to absolute memory address |
| A64DD | 117501F3 | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| AFC26 | 117501F3 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| B50EA | 40D479D1 | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| B94F0 | 40D479D1 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| C0330 | 630A0C15 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| C1A12 | 307AB395 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| C1FE9 | 36941C11 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| C2DC9 | 1D7DE34C | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| C6E87 | 31247158 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| D8E42 | 2B188910 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| E4058 | 7A838D0B | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| E4C14 | 1D1290EC | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| E51EB | 1D1290EC | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| EBBFF | 1D1290EC | UPX1 | CALL [static] | Indirect call to absolute memory address |
| EBE83 | 7CDB6FFF | UPX1 | CALL [static] | Indirect call to absolute memory address |
| EC3CB | 7CDB6FFF | UPX1 | CALL [static] | Indirect call to absolute memory address |
| EC79B | 1C674995 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| ECBD0 | 1C674995 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| ECED0 | 680C28FF | UPX1 | CALL [static] | Indirect call to absolute memory address |
| EED47 | 680C28FF | UPX1 | CALL [static] | Indirect call to absolute memory address |
| F1AF5 | 2679295E | UPX1 | CALL [static] | Indirect call to absolute memory address |
| F3244 | 2679295E | UPX1 | CALL [static] | Indirect call to absolute memory address |
| FA55C | 2679295E | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| 100A4C | 2679295E | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 10498B | 14292227 | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| 10BE83 | BFEF04A | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 10C763 | CFE44CF | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 10CC0B | CFE44CF | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 10D977 | CFE44CF | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 10DAC7 | CFE44CF | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 10DBE3 | CFE44CF | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 400-1055FF | 27E000 | UPX1 | Executable section anomaly, first bytes: BF77FEFF04104000 |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 767998 | 69,0606% |
| Null Byte Code | 25057 | 2,2532% |
© 2026 All rights reserved.