Analysis Date2014-12-20 00:31:06
MD508c8493888659281bdcc9dd1242f64c4
SHA16c558db991ff5653ec32c58cbbc1adc0f39cfd2f

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 5a6c8077ccbf637f004e0f4a481641c9 sha1: ce59247501546be2284ca3af338eb38b3e2dd15b size: 18944
Section.rdata md5: ee89447aff4594deee14415daff0faf2 sha1: c9f33c4f903750eef3cf4486a084b59b99b0e1d3 size: 77312
Section.data md5: bdd31127f0cf8ab5a8b0f10ed1b0912a sha1: 7d3e53fa135afbac4006051926616623b62c5326 size: 512
Section.rsrc md5: a81d7cb9e440ed4146d6e7df3f64069a sha1: 5d3911c911b530b934176e347f2cb572ad0d2ede size: 82944
Timestamp2014-11-01 18:10:34
VersionFileVersion: 51.52.0.0
FileDescription: Setup/Uninstall
PackerBorland Delphi 3.0 (???)
PEhash78a30292b537f1683b8c2affffa183f33b6d6cf1
IMPhash7fe0783cac2d274a660b9561733a05c8
AV360 SafeGen:Variant.Kazy.445839
AVAd-AwareGen:Variant.Kazy.445839
AVAlwil (avast)GenMalicious-AQL [Trj]
AVArcabit (arcavir)Gen:Variant.Kazy.445839
AVAuthentiumno_virus
AVAvira (antivir)TR/Kazy.445839
AVBullGuardGen:Variant.Kazy.445839
AVCA (E-Trust Ino)no_virus
AVCAT (quickheal)no_virus
AVClamAVno_virus
AVDr. Webno_virus
AVEmsisoftGen:Variant.Kazy.445839
AVEset (nod32)Win32/Boaxxe.BR
AVFortinetW32/Kryptik.CQAY!tr
AVFrisk (f-prot)no_virus
AVF-SecureGen:Variant.Kazy.445839
AVGrisoft (avg)Crypt_s.HKK
AVIkarusno_virus
AVK7Unwanted-Program ( 004a8e8a1 )
AVKasperskyTrojan.Win32.Generic
AVMalwareBytesTrojan.Agent.ED
AVMcafeePacked-APIXOR!08C849388865
AVMicrosoft Security EssentialsTrojan:Win32/Miuref.F
AVMicroWorld (escan)Gen:Variant.Kazy.445839
AVRisingno_virus
AVSophosno_virus
AVSymantecPacked.Generic.459
AVTrend Microno_virus
AVVirusBlokAda (vba32)Trojan.Yakes

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
RegistryHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{CA26B9AC-C5EF-3850-AD2C-1E6D32DD08C8} ➝
C:\malware.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\Etftion\malware.exe
Creates File\Device\Afd\AsyncConnectHlp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\microsoft[1].htm
Creates FilePIPE\lsarpc
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\Etftion\{34B667DE-231C-18A5-52F5-E56BC1C35382}
Creates File\Device\Afd\Endpoint
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Creates Mutexa3d78839-daf4-0b36-ca7c-bbb0e11184ab
Winsock DNSwww.microsoft.com

Network Details:

DNSservices24.org
Type: A
91.209.13.197
DNSgosearchpage.com
Type: A
195.110.138.33
DNSgosearchpage.com
Type: A
23.213.157.132
DNS1.jsservices.org
Type: A
136.243.4.68
DNS1.jsservices.org
Type: A
136.243.4.69
DNS1.jsservices.org
Type: A
148.251.80.145
DNS1.jsservices.org
Type: A
148.251.80.172
DNS1.jsservices.org
Type: A
217.23.6.72
DNS1.jsservices.org
Type: A
93.190.140.144
DNSe10088.dscb.akamaiedge.net
Type: A
23.199.200.154
DNS2.jsservices.org
Type: A
DNS3.jsservices.org
Type: A
DNS4.jsservices.org
Type: A
DNS5.jsservices.org
Type: A
DNSwww.microsoft.com
Type: A
DNS1.k5service.org
Type: A
DNS2.k5service.org
Type: A
DNS3.k5service.org
Type: A
DNS4.k5service.org
Type: A
DNS5.k5service.org
Type: A
HTTP GEThttp://www.microsoft.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://www.microsoft.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
Flows TCP192.168.1.1:1031 ➝ 136.243.4.69:443
Flows TCP192.168.1.1:1032 ➝ 148.251.80.172:443
Flows TCP192.168.1.1:1033 ➝ 93.190.140.144:443
Flows TCP192.168.1.1:1034 ➝ 136.243.4.68:443
Flows TCP192.168.1.1:1035 ➝ 148.251.80.145:443
Flows TCP192.168.1.1:1036 ➝ 217.23.6.72:443
Flows TCP192.168.1.1:1037 ➝ 23.199.200.154:80
Flows TCP192.168.1.1:1039 ➝ 23.199.200.154:80
Flows TCP192.168.1.1:1040 ➝ 136.243.4.69:443
Flows TCP192.168.1.1:1041 ➝ 148.251.80.172:443
Flows TCP192.168.1.1:1042 ➝ 93.190.140.144:443
Flows TCP192.168.1.1:1043 ➝ 136.243.4.68:443
Flows TCP192.168.1.1:1044 ➝ 148.251.80.145:443
Flows TCP192.168.1.1:1045 ➝ 217.23.6.72:443

Raw Pcap
0x00000000 (00000)   3de70d29 be30efdc e8e0799c 9b3a4780   =..).0....y..:G.
0x00000010 (00016)   6f8148a7 8fd246d9 f03ed968 a7970cae   o.H...F..>.h....
0x00000020 (00032)   7345a658 f6378445 5bd1519a 2f6b0431   sE.X.7.E[.Q./k.1
0x00000030 (00048)   d7b15cc9 4db30a1d 962a705c c4890b1c   ..\.M....*p\....
0x00000040 (00064)   33b99a19 c02f1401 c6d674b2 26d40811   3..../....t.&...
0x00000050 (00080)   ec98e613 b20abbe5 a82848c2 a0888a47   .........(H....G
0x00000060 (00096)   c5757c06 95483b78 5ec22a5f 45bfde8a   .u|..H;x^.*_E...
0x00000070 (00112)   d55a1c84 2bde8679 18424961 4731e6e3   .Z..+..y.BIaG1..
0x00000080 (00128)   c66d0242 b6547620 159b932c 6f482334   .m.B.Tv ...,oH#4
0x00000090 (00144)   0c21d31b b3ff7a17 a47d7f16 380fb394   .!....z..}..8...
0x000000a0 (00160)   6afc8b0c 8bf0cff1 1f65f0a6 dd8a5ab9   j........e....Z.
0x000000b0 (00176)   dfc16d3c b51cc947 9996e69c aecb60bb   ..m<...G......`.
0x000000c0 (00192)   1b2f2405 01f9c573                     ./$....s

0x00000000 (00000)   3de70d29 be30efdc e8e0799c 9b3a4780   =..).0....y..:G.
0x00000010 (00016)   6f8148a7 8fd246d9 f03ed968 a7970cae   o.H...F..>.h....
0x00000020 (00032)   7345a658 f6378445 5bd1519a 2f6b0431   sE.X.7.E[.Q./k.1
0x00000030 (00048)   d7b15cc9 4db30a1d 962a705c c4890b1c   ..\.M....*p\....
0x00000040 (00064)   33b99a19 c02f1401 c6d674b2 26d40811   3..../....t.&...
0x00000050 (00080)   ec98e613 b20abbe5 a82848c2 a0888a47   .........(H....G
0x00000060 (00096)   c5757c06 95483b78 5ec22a5f 45bfde8a   .u|..H;x^.*_E...
0x00000070 (00112)   d55a1c84 2bde8679 18424961 4731e6e3   .Z..+..y.BIaG1..
0x00000080 (00128)   c66d0242 b6547620 159b932c 6f482334   .m.B.Tv ...,oH#4
0x00000090 (00144)   0c21d31b b3ff7a17 a47d7f16 380fb394   .!....z..}..8...
0x000000a0 (00160)   6afc8b0c 8bf0cff1 1f65f0a6 dd8a5ab9   j........e....Z.
0x000000b0 (00176)   dfc16d3c b51cc947 9996e69c aecb60bb   ..m<...G......`.
0x000000c0 (00192)   1b2f2405 01f9c573                     ./$....s

0x00000000 (00000)   3de70d29 be30efdc e8e0799c 9b3a4780   =..).0....y..:G.
0x00000010 (00016)   6f8148a7 8fd246d9 f03ed968 a7970cae   o.H...F..>.h....
0x00000020 (00032)   7345a658 f6378445 5bd1519a 2f6b0431   sE.X.7.E[.Q./k.1
0x00000030 (00048)   d7b15cc9 4db30a1d 962a705c c4890b1c   ..\.M....*p\....
0x00000040 (00064)   33b99a19 c02f1401 c6d674b2 26d40811   3..../....t.&...
0x00000050 (00080)   ec98e613 b20abbe5 a82848c2 a0888a47   .........(H....G
0x00000060 (00096)   c5757c06 95483b78 5ec22a5f 45bfde8a   .u|..H;x^.*_E...
0x00000070 (00112)   d55a1c84 2bde8679 18424961 4731e6e3   .Z..+..y.BIaG1..
0x00000080 (00128)   c66d0242 b6547620 159b932c 6f482334   .m.B.Tv ...,oH#4
0x00000090 (00144)   0c21d31b b3ff7a17 a47d7f16 380fb394   .!....z..}..8...
0x000000a0 (00160)   6afc8b0c 8bf0cff1 1f65f0a6 dd8a5ab9   j........e....Z.
0x000000b0 (00176)   dfc16d3c b51cc947 9996e69c aecb60bb   ..m<...G......`.
0x000000c0 (00192)   1b2f2405 01f9c573                     ./$....s

0x00000000 (00000)   3de70d29 be30efdc e8e0799c 9b3a4780   =..).0....y..:G.
0x00000010 (00016)   6f8148a7 8fd246d9 f03ed968 a7970cae   o.H...F..>.h....
0x00000020 (00032)   7345a658 f6378445 5bd1519a 2f6b0431   sE.X.7.E[.Q./k.1
0x00000030 (00048)   d7b15cc9 4db30a1d 962a705c c4890b1c   ..\.M....*p\....
0x00000040 (00064)   33b99a19 c02f1401 c6d674b2 26d40811   3..../....t.&...
0x00000050 (00080)   ec98e613 b20abbe5 a82848c2 a0888a47   .........(H....G
0x00000060 (00096)   c5757c06 95483b78 5ec22a5f 45bfde8a   .u|..H;x^.*_E...
0x00000070 (00112)   d55a1c84 2bde8679 18424961 4731e6e3   .Z..+..y.BIaG1..
0x00000080 (00128)   c66d0242 b6547620 159b932c 6f482334   .m.B.Tv ...,oH#4
0x00000090 (00144)   0c21d31b b3ff7a17 a47d7f16 380fb394   .!....z..}..8...
0x000000a0 (00160)   6afc8b0c 8bf0cff1 1f65f0a6 dd8a5ab9   j........e....Z.
0x000000b0 (00176)   dfc16d3c b51cc947 9996e69c aecb60bb   ..m<...G......`.
0x000000c0 (00192)   1b2f2405 01f9c573                     ./$....s

0x00000000 (00000)   3de70d29 be30efdc e8e0799c 9b3a4780   =..).0....y..:G.
0x00000010 (00016)   6f8148a7 8fd246d9 f03ed968 a7970cae   o.H...F..>.h....
0x00000020 (00032)   7345a658 f6378445 5bd1519a 2f6b0431   sE.X.7.E[.Q./k.1
0x00000030 (00048)   d7b15cc9 4db30a1d 962a705c c4890b1c   ..\.M....*p\....
0x00000040 (00064)   33b99a19 c02f1401 c6d674b2 26d40811   3..../....t.&...
0x00000050 (00080)   ec98e613 b20abbe5 a82848c2 a0888a47   .........(H....G
0x00000060 (00096)   c5757c06 95483b78 5ec22a5f 45bfde8a   .u|..H;x^.*_E...
0x00000070 (00112)   d55a1c84 2bde8679 18424961 4731e6e3   .Z..+..y.BIaG1..
0x00000080 (00128)   c66d0242 b6547620 159b932c 6f482334   .m.B.Tv ...,oH#4
0x00000090 (00144)   0c21d31b b3ff7a17 a47d7f16 380fb394   .!....z..}..8...
0x000000a0 (00160)   6afc8b0c 8bf0cff1 1f65f0a6 dd8a5ab9   j........e....Z.
0x000000b0 (00176)   dfc16d3c b51cc947 9996e69c aecb60bb   ..m<...G......`.
0x000000c0 (00192)   1b2f2405 01f9c573                     ./$....s

0x00000000 (00000)   3de70d29 be30efdc e8e0799c 9b3a4780   =..).0....y..:G.
0x00000010 (00016)   6f8148a7 8fd246d9 f03ed968 a7970cae   o.H...F..>.h....
0x00000020 (00032)   7345a658 f6378445 5bd1519a 2f6b0431   sE.X.7.E[.Q./k.1
0x00000030 (00048)   d7b15cc9 4db30a1d 962a705c c4890b1c   ..\.M....*p\....
0x00000040 (00064)   33b99a19 c02f1401 c6d674b2 26d40811   3..../....t.&...
0x00000050 (00080)   ec98e613 b20abbe5 a82848c2 a0888a47   .........(H....G
0x00000060 (00096)   c5757c06 95483b78 5ec22a5f 45bfde8a   .u|..H;x^.*_E...
0x00000070 (00112)   d55a1c84 2bde8679 18424961 4731e6e3   .Z..+..y.BIaG1..
0x00000080 (00128)   c66d0242 b6547620 159b932c 6f482334   .m.B.Tv ...,oH#4
0x00000090 (00144)   0c21d31b b3ff7a17 a47d7f16 380fb394   .!....z..}..8...
0x000000a0 (00160)   6afc8b0c 8bf0cff1 1f65f0a6 dd8a5ab9   j........e....Z.
0x000000b0 (00176)   dfc16d3c b51cc947 9996e69c aecb60bb   ..m<...G......`.
0x000000c0 (00192)   1b2f2405 01f9c573                     ./$....s

0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x00000020 (00032)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x00000030 (00048)   626c653b 204d5349 4520362e 303b2057   ble; MSIE 6.0; W
0x00000040 (00064)   696e646f 7773204e 5420352e 313b2053   indows NT 5.1; S
0x00000050 (00080)   56313b20 2e4e4554 20434c52 20322e30   V1; .NET CLR 2.0
0x00000060 (00096)   2e353037 3237290d 0a486f73 743a2077   .50727)..Host: w
0x00000070 (00112)   77772e6d 6963726f 736f6674 2e636f6d   ww.microsoft.com
0x00000080 (00128)   0d0a0d0a b6547620 159b932c 6f482334   .....Tv ...,oH#4
0x00000090 (00144)   0c21d31b b3ff7a17 a47d7f16 380fb394   .!....z..}..8...
0x000000a0 (00160)   6afc8b0c 8bf0cff1 1f65f0a6 dd8a5ab9   j........e....Z.
0x000000b0 (00176)   dfc16d3c b51cc947 9996e69c aecb60bb   ..m<...G......`.
0x000000c0 (00192)   1b2f2405 01f9c573                     ./$....s

0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   41636365 70743a20 2a2f2a0d 0a416363   Accept: */*..Acc
0x00000020 (00032)   6570742d 456e636f 64696e67 3a20677a   ept-Encoding: gz
0x00000030 (00048)   69702c20 6465666c 6174650d 0a557365   ip, deflate..Use
0x00000040 (00064)   722d4167 656e743a 204d6f7a 696c6c61   r-Agent: Mozilla
0x00000050 (00080)   2f342e30 2028636f 6d706174 69626c65   /4.0 (compatible
0x00000060 (00096)   3b204d53 49452036 2e303b20 57696e64   ; MSIE 6.0; Wind
0x00000070 (00112)   6f777320 4e542035 2e313b20 5356313b   ows NT 5.1; SV1;
0x00000080 (00128)   202e4e45 5420434c 5220322e 302e3530    .NET CLR 2.0.50
0x00000090 (00144)   37323729 0d0a486f 73743a20 7777772e   727)..Host: www.
0x000000a0 (00160)   6d696372 6f736f66 742e636f 6d0d0a43   microsoft.com..C
0x000000b0 (00176)   6f6e6e65 6374696f 6e3a204b 6565702d   onnection: Keep-
0x000000c0 (00192)   416c6976 650d0a0d 0a                  Alive....

0x00000000 (00000)   1dfc039f bf30a30e 45f6117b 3564920d   .....0..E..{5d..
0x00000010 (00016)   da83ca9e be591f58 d92e1c30 10f56704   .....Y.X...0..g.
0x00000020 (00032)   de6cd3be 07244d2c 3170c8b2 4c4a832a   .l...$M,1p..LJ.*
0x00000030 (00048)   3c391c58 8a61b760 53400a2b cad83add   <9.X.a.`S@.+..:.
0x00000040 (00064)   9b4647ed 1a815620 146d1d30 f856402d   .FG...V .m.0.V@-
0x00000050 (00080)   b573e829 77bdf8a3 b7be53ec 7aa59c1c   .s.)w.....S.z...
0x00000060 (00096)   d3198a0a 5d419771 3da89b99 92a1ef82   ....]A.q=.......
0x00000070 (00112)   2ff71ed8 3cebf0de 87e138ae 80e65290   /...<.....8...R.
0x00000080 (00128)   e85b3112 8eab63be e1c4174e 9080dc7c   .[1...c....N...|
0x00000090 (00144)   9acf6a62 b67af380 9937a04b 656b25d3   ..jb.z...7.Kek%.
0x000000a0 (00160)   a5dbcfd3 676fad0c c403ff91 5177216b   ....go......Qw!k
0x000000b0 (00176)   14f98726 34b55876 36a9cd77 45557c99   ...&4.Xv6..wEU|.
0x000000c0 (00192)   4702d8cc 6e2b4b3f 64                  G...n+K?d

0x00000000 (00000)   1dfc039f bf30a30e 45f6117b 3564920d   .....0..E..{5d..
0x00000010 (00016)   da83ca9e be591f58 d92e1c30 10f56704   .....Y.X...0..g.
0x00000020 (00032)   de6cd3be 07244d2c 3170c8b2 4c4a832a   .l...$M,1p..LJ.*
0x00000030 (00048)   3c391c58 8a61b760 53400a2b cad83add   <9.X.a.`S@.+..:.
0x00000040 (00064)   9b4647ed 1a815620 146d1d30 f856402d   .FG...V .m.0.V@-
0x00000050 (00080)   b573e829 77bdf8a3 b7be53ec 7aa59c1c   .s.)w.....S.z...
0x00000060 (00096)   d3198a0a 5d419771 3da89b99 92a1ef82   ....]A.q=.......
0x00000070 (00112)   2ff71ed8 3cebf0de 87e138ae 80e65290   /...<.....8...R.
0x00000080 (00128)   e85b3112 8eab63be e1c4174e 9080dc7c   .[1...c....N...|
0x00000090 (00144)   9acf6a62 b67af380 9937a04b 656b25d3   ..jb.z...7.Kek%.
0x000000a0 (00160)   a5dbcfd3 676fad0c c403ff91 5177216b   ....go......Qw!k
0x000000b0 (00176)   14f98726 34b55876 36a9cd77 45557c99   ...&4.Xv6..wEU|.
0x000000c0 (00192)   4702d8cc 6e2b4b3f 64                  G...n+K?d

0x00000000 (00000)   1dfc039f bf30a30e 45f6117b 3564920d   .....0..E..{5d..
0x00000010 (00016)   da83ca9e be591f58 d92e1c30 10f56704   .....Y.X...0..g.
0x00000020 (00032)   de6cd3be 07244d2c 3170c8b2 4c4a832a   .l...$M,1p..LJ.*
0x00000030 (00048)   3c391c58 8a61b760 53400a2b cad83add   <9.X.a.`S@.+..:.
0x00000040 (00064)   9b4647ed 1a815620 146d1d30 f856402d   .FG...V .m.0.V@-
0x00000050 (00080)   b573e829 77bdf8a3 b7be53ec 7aa59c1c   .s.)w.....S.z...
0x00000060 (00096)   d3198a0a 5d419771 3da89b99 92a1ef82   ....]A.q=.......
0x00000070 (00112)   2ff71ed8 3cebf0de 87e138ae 80e65290   /...<.....8...R.
0x00000080 (00128)   e85b3112 8eab63be e1c4174e 9080dc7c   .[1...c....N...|
0x00000090 (00144)   9acf6a62 b67af380 9937a04b 656b25d3   ..jb.z...7.Kek%.
0x000000a0 (00160)   a5dbcfd3 676fad0c c403ff91 5177216b   ....go......Qw!k
0x000000b0 (00176)   14f98726 34b55876 36a9cd77 45557c99   ...&4.Xv6..wEU|.
0x000000c0 (00192)   4702d8cc 6e2b4b3f 64                  G...n+K?d

0x00000000 (00000)   1dfc039f bf30a30e 45f6117b 3564920d   .....0..E..{5d..
0x00000010 (00016)   da83ca9e be591f58 d92e1c30 10f56704   .....Y.X...0..g.
0x00000020 (00032)   de6cd3be 07244d2c 3170c8b2 4c4a832a   .l...$M,1p..LJ.*
0x00000030 (00048)   3c391c58 8a61b760 53400a2b cad83add   <9.X.a.`S@.+..:.
0x00000040 (00064)   9b4647ed 1a815620 146d1d30 f856402d   .FG...V .m.0.V@-
0x00000050 (00080)   b573e829 77bdf8a3 b7be53ec 7aa59c1c   .s.)w.....S.z...
0x00000060 (00096)   d3198a0a 5d419771 3da89b99 92a1ef82   ....]A.q=.......
0x00000070 (00112)   2ff71ed8 3cebf0de 87e138ae 80e65290   /...<.....8...R.
0x00000080 (00128)   e85b3112 8eab63be e1c4174e 9080dc7c   .[1...c....N...|
0x00000090 (00144)   9acf6a62 b67af380 9937a04b 656b25d3   ..jb.z...7.Kek%.
0x000000a0 (00160)   a5dbcfd3 676fad0c c403ff91 5177216b   ....go......Qw!k
0x000000b0 (00176)   14f98726 34b55876 36a9cd77 45557c99   ...&4.Xv6..wEU|.
0x000000c0 (00192)   4702d8cc 6e2b4b3f 64                  G...n+K?d

0x00000000 (00000)   a0b4a974 bf303114 eca78859 884599e1   ...t.01....Y.E..
0x00000010 (00016)   3a2d07d8 19741ade a0ed7698 cd2c9290   :-...t....v..,..
0x00000020 (00032)   8d96ecf4 5275cca3 b5742604 aab1e603   ....Ru...t&.....
0x00000030 (00048)   ebdb2d12 3429bfd3 b663cabe 0e53788d   ..-.4)...c...Sx.
0x00000040 (00064)   3f06c679 e08fe830 c8fb9a13 df32cbea   ?..y...0.....2..
0x00000050 (00080)   cf8bd96e ad90e977 1abe2e25 eea33b4b   ...n...w...%..;K
0x00000060 (00096)   94b3acc3 7afe92d0 7aef8cbd 0ac67f63   ....z...z......c
0x00000070 (00112)   4d39d758 b92c9089 30c05740 a162879e   M9.X.,..0.W@.b..
0x00000080 (00128)   238598c9 35a30ffb 44ef3d25 7535f895   #...5...D.=%u5..
0x00000090 (00144)   848d14d9 1e28312e b9a2fd17 4326c9b0   .....(1.....C&..
0x000000a0 (00160)   b0fcbe9f a6b7fcaf 264db65b 6bbcdb72   ........&M.[k..r
0x000000b0 (00176)   b52a4d8d dead98f1 4b6447c0 079c45e6   .*M.....KdG...E.
0x000000c0 (00192)   679738f2 c53a2418 dd                  g.8..:$..

0x00000000 (00000)   a0b4a974 bf303114 eca78859 884599e1   ...t.01....Y.E..
0x00000010 (00016)   3a2d07d8 19741ade a0ed7698 cd2c9290   :-...t....v..,..
0x00000020 (00032)   8d96ecf4 5275cca3 b5742604 aab1e603   ....Ru...t&.....
0x00000030 (00048)   ebdb2d12 3429bfd3 b663cabe 0e53788d   ..-.4)...c...Sx.
0x00000040 (00064)   3f06c679 e08fe830 c8fb9a13 df32cbea   ?..y...0.....2..
0x00000050 (00080)   cf8bd96e ad90e977 1abe2e25 eea33b4b   ...n...w...%..;K
0x00000060 (00096)   94b3acc3 7afe92d0 7aef8cbd 0ac67f63   ....z...z......c
0x00000070 (00112)   4d39d758 b92c9089 30c05740 a162879e   M9.X.,..0.W@.b..
0x00000080 (00128)   238598c9 35a30ffb 44ef3d25 7535f895   #...5...D.=%u5..
0x00000090 (00144)   848d14d9 1e28312e b9a2fd17 4326c9b0   .....(1.....C&..
0x000000a0 (00160)   b0fcbe9f a6b7fcaf 264db65b 6bbcdb72   ........&M.[k..r
0x000000b0 (00176)   b52a4d8d dead98f1 4b6447c0 079c45e6   .*M.....KdG...E.
0x000000c0 (00192)   679738f2 c53a2418 dd                  g.8..:$..


Strings
s504cd\aepe-7707{f\a-00vc636\br25dl}6s0d-c4rrd2
0o37-0ni211ibThr.
.
)
.x..
_

000004B0
040904B0
1Menu \'%s\' is already being used by another form
3Format \'%s\' invalid or incompatible with argument
51.52.0.0
5.50.4807.2300
5Cannot create form. No MDI forms are currently active
ABCDEFGHIJKLMNOP
Abort
&Abort
A class named %s already exists'\'\'%s\'\' is not a valid integer value
#A component named %s already exists(\'\'%s\'\' is not a valid component name
Administrat
Administration (F
Administrationsverktyg	Min musik
Administrative Tools
Administrative verkt
Administrazio-tresnak
&All
All files (*.*)|*.*
All Users
Alt+	(Unknown)
A minha m
Ancestor for \'%s\' not found
Anwendungsdaten
Aplikazio-datuak Ezarpen lokalak\Aplikazio-datuak(Ezarpen lokalak\Temporary Internet Files
Application Data
Application Data"Param
Application Error
April
As minhas imagens
August	September
Belgeler
Belgelerim
BG#Cannot load older version of TShape	Metafiles
Billeder
Bitmap image is not valid
Bitmap is empty!Cannot change the size of an icon
Bitmaps
Bits index out of range
BkSp
Cancel
Cannot assign a %s to a %s
Cannot create file %s
Cannot drag a form
Cannot hide an MDI Child Form)Cannot change Visible in OnShow or OnHide"Cannot make a visible window modal
Cannot open file %s
Canvas does not allow drawing
cie"Miestne nastavenia\
cie+Miestne nastavenia\Temporary Internet Files
Class %s not found
Client of TDrag not initialized
&Close
Color
CommonFilesDir
CompanyName
Confirm
Control-C hit
Cookies
Cookies	Hist
Cookies	Historial
Copyright (C) Microsoft Corp. 1981-2001
Could not load CARDS.DLL
Cronologia	Documenti
Ctrl+
Custom Colors+Operation not supported on selected printer.There is no default printer currently selected
Dades de l'aplicaci
Dados de aplicativos)Configura
daje aplik
Dane aplikacji!Ustawienia lokalne\Dane aplikacji+Ustawienia lokalne\Temporary Internet Files
\Data aplikac
Data aplikac
Dati applicazioni%Impostazioni locali\Dati applicazioni,Impostazioni locali\Temporary Internet Files
Datos de programa%Configuraci
December
Default
&Directories:
Directory &Name:
	DISKIMAGE	STOPIMAGE
Division by zero
Documenten
	Documenti
Documentos
Dokument
Dokumenter
Dokumentoak
Dokumentuak
Dokumentumok
	Dokumenty
Down
D&rives:
Duplicate CardId found"An error returned from DDE  ($0%x)/DDE Error - conversation not established ($0%x)0Error occurred when DDE ran out of memory ($0%x)"Unable to connect DDE conversation
dzia administracyjne
Eigene Bilder
Eigene Dateien
Eigene Musik
Eines administratives
Els meus documents
Enhanced Metafiles
Enter
Error
Error creating variant array
Error creating window+Cannot focus a disabled or invisible window#Control \'%s\' has no parent window
Error creating window class
Error reading %s.%s: %s
es locais\Dados de aplicativos-Configura
es locais\Temporary Internet Files
essi skj
External exception %x
Failed to create key %s
Failed to get data for \'%s\'9Synchronize called when main VCL thread in a WaitFor call0Unknown RichEdit conversion file extension (.%s)
Failed to Load Stream
Failed to Save Stream)StatusBar cannot have more than 64 panels!Error assigning Hot-Key to %s. %s
Failed to set data for \'%s\'
February
Ferramentas administrativas
File access denied
FileDescription
File load error
File not found
&Files: (*.*)
FileVersion
Floating point division by zero
Floating point overflow
Floating point underflow
Format string too long
Friday
genes
Grid index out of range1Fixed column count must be less than column count+Fixed row count must be less than row count
Grid too large for operation Too many rows or columns deleted
gyeleti eszk
Help
&Help
HELPER_EXE_AMD64
Herramientas administrativas	Mi m
Historia	Dokumenty
Historique	Documents
History
History	
History	Documents
History	Dokumenti
History	Dokumenty
Home
Hot-Key is invalid#Window is invalid or a child window%Hot-Key is assigned to another window %s is already associated with %s
Hudba
Icon image is not valid
Icons
Identifier expected
&Ignore
Immagini
Incorrect level assignment
Information
Integer overflow Invalid floating point operation
InternalName
Invalid argument to date encode
Invalid argument to time encode
Invalid binary value
Invalid class typecast0Access violation at address %p. %s of address %p
Invalid clipboard format Clipboard does not support Icons
Invalid component registration0Can only modify an image if it contains a bitmap*A control cannot have itself as its parent
Invalid data type for \'%s\'
Invalid filename
Invalid file name - %s
Invalid ImageList
Invalid ImageList Index$Error creating window device context
Invalid image size
Invalid index
Invalid input value7Invalid input value.  Use escape key to abandon changes
Invalid item level assignment
Invalid numeric input
Invalid numeric value
Invalid outline index
Invalid owner
Invalid pointer operation
Invalid property path
Invalid property value
Invalid selection
Invalid stream format
Invalid string constant
Invalid value for current item
Invalid variant operation"Variant method calls not supported
Invalid variant type conversion
I/O error %d
Irudiak
January
July
June
kalut
ka orodja
La meva m
Left
LegalCopyright
Les meves imatges
Line too long
List index out of bounds+Operation not allowed on sorted string list%String list does not allow duplicates
lles)
llningar\Programdata-Lokala inst
llningar\Temporary Internet Files
Local Settings\Anwendungsdaten'Local Settings\Temporary Internet Files
Local Settings\Application Data'Local Settings\Temporary Internet Files
Local Settings\Programdata'Local Settings\Temporary Internet Files
Logg
MAINICON
Ma musique
March
Maximum outline depth exceeded
Menu index out of range
Menu inserted twice
Mes documents
Mes images
Metafile is not valid
metres locals\Dades de l'aplicaci
metres locals\Temporary Internet Files
Meus documentos
Microsoft Corporation
Microsoft(R) Windows (R) 2000 Operating System
Mijn afbeeldingen
Mijn documenten
Mijn muziek
Mina bilder
Mina dokument
Mine bilder
Mine dokumenter
Minhas imagens
Minhas m
Min musikk
Mis documentos
Mis im
Moja glasba
Moja muzyka
Moje dokumenty
Moje obrazy
Moje slike
Moji dokumenti
Monday
Musica
Musik
Musika
My Documents
My Music
Myndirnar m
My Pictures
Narz
 nastaven
netimsel Ara
Ne&twork...
n local\Datos de programa,Configuraci
n local\Temporary Internet Files
No argument for format \'%s\'
No help available
(None)
Not enough timers available!Printer is not currently printing
November
: [ - no volume label - ]
Number expected
n%USERPROFILE%
October
OleSelfRegister
Oma musiikki
Omat kuvatiedostot
Omat tiedostot
Operation aborted%Exception %s in module %s at %p.
OriginalFilename
Os meus documentos
Outils d'administration
Outline index not found
Out of memory
Out of system resources
Oversigt
*Par
&Par
Parent must be expanded
PgDn
PgUp
Podatki o aplikaciji(Podrocne nastavitve\Podatki o aplikaciji,Podrocne nastavitve\Temporary Internet Files
Printer index out of range
Printer selected is not valid
Printing in progress
Privileged instruction
ProductName
ProductVersion
Programdata
Programdata Lokala inst
Programdata Lokale innstillinger\Programdata-Lokale innstillinger\Temporary Internet Files
ProgramFilesDir
Property does not exist
Property is read-only
PutObject to undefined item
Range check error
Read
Read beyond end of file	Disk full
REGDLL_EXE
Resimlerim
Resource %s not found!Resource %s is of incorrect class
&Retry
RichEdit line insertion error
rico
Right
r%SYSTEMROOT%
Saturday
Scrollbar property out of range
Select Directory
Setup/Uninstall
\'\'%s\'\' expected
%s expected
Shell Folder Service
shfolder
shfolder.dll
SHFOLDERDLL	TMAINFORM
Shift+
sica
sicas
\'\'%s\'\' is not a valid date
\'%s\' is not a valid date
#\'%s\' is not a valid integer value*\'%s\' is not a valid floating point value
\'\'%s\'\' is not a valid time'\'\'%s\'\' is not a valid date and time
\'%s\' is not a valid time#\'%s\' is not a valid date and time
Sivuhistoria	Tiedostot
skal
Skrbni
%s on line %d
%s on %sAGroupIndex cannot be less than a previous menu item\'s GroupIndex2Cannot have more than one MDI form per application
Space
%s property out of range
%s%s
Stack overflow
Stream read error
Stream write error+Out of memory while expanding memory stream+Can\'t write to a read-only resource stream.WriteObject called twice for the same instance
String expected
StringFileInfo
stroje
stroje pro spr
Strumenti di amministrazione
Sub-menu is not in menu
Sunday
Systeembeheer
Tab control access error
Tab index out of bounds
\Temporary Internet Files
Text exceeds memo capacity
Thursday
Tidigare
TNEWDISKFORM
Too many images3Image dimensions do not match image list dimensions
Too many open files
Translation
tres locaux\Application Data*Param
tres locaux\Temporary Internet Files
TSELECTFOLDERFORM
TSELECTLANGUAGEFORM
Tuesday	Wednesday
TUNINSTALLPROGRESSFORM
TUNINSTSHAREDFILEFORM
TWIZARDFORM
Unable to create new column
Unable to create new item
Unable to insert a line3The specified directory does not exist. Create it\?
Unable to insert an item
Unable to Replace Image
Unable to write to %s
$Unknown picture file extension (.%s)
Unsupported clipboard format
(Untitled)
Value must be between %d and %d<Cannot create a default method name for an unnamed component
Valvontaty
VarFileInfo
Variant is not an array!Variant array index out of bounds
Verlauf	Dokumente
Verwaltung
vne n
VS_VERSION_INFO
Warning
Write)Format result longer than 4096 characters
x0395
&Yes
Zene
        />
0cV#8L
0$<+}!i
0-v=&e
1*1w1|1
!22\)}F_e
}#"3jjl*
3rgw	:&!
44484P4T4X4l4p4t4
47SD(;WH<
4=7t7}7
5zh$["i@
64PK	6
6`nFbJ`
6R	0 e
6{W2X(
70F0X0
7	BackColor
>7>R>g>m>{>
@!]^=8$
818G8c8t8
819C9V9_9
*8p}	*
9%9:9b9
99$|!D
9aYvS[k
a6]O^~9
A_A^A]A\_
ActivePage
AddAccessAllowedAce
_adjust_fdiv
Administrative Tools
ADVAPI32.dll
afWX(A
aGSZuu
AllocateAndInitializeSid
AppData
</application>
    </application>
    <application>
<application xmlns="urn:schemas-microsoft-com:asm.v3">
aqd+5|eu
,arv(evjDiz%
</assembly>
<assemblyIdentity
        <assemblyIdentity
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
AutoScroll
AutoSize
_/B5ffQB
BackButton
BackButtonClick
:	BackColor
_beginthreadex
Bevel1
BeveledLabel
BevelOuter
biSystemMenu
/BNpG	
BorderIcons
BorderStyle
bo)`stu
BrowseButton
BrowseButtonClick
BrowseLabel
bsDialog
bsNone
	bsTopLine
bvNone
Cancel	
CancelButton
CancelButtonClick
Caption
Center	
CentralFile
_cexit
_c_exit
CEzWTv@,V
ChangeTimerQueueTimer
CharNextW
Checked	
	clBtnFace
ClientHeight
ClientWidth
clNavy
CloseHandle
CLSIDFromString
clWindow
clWindowText
CoCreateInstance
CoGetCallContext
CoInitializeEx
CoInitializeSecurity
COMCTL32.dll
CommandLineToArgvW
Common Administrative Tools
Common AppData
Common Documents
Common Programs
CompareStringW
</compatibility>
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
ComponentsDiskSpaceLabel
ComponentsList
ComponentsListClickCheck
_controlfp
Cookies
CoRegisterClassObject
CoRevokeClassObject
CoSuspendClassObjects
CoTaskMemAlloc
CoUninitialize
CreateDirectoryA
CreateDirectoryW
CreateEventW
CreateFileW
CreateThread
CreateTimerQueueTimer
csDropDownList
__CxxFrameHandler
_CxxThrowException
`.data
@.data
]de{5|ez
Default
Default	
DefaultDir
DeleteCriticalSection
DeleteFileW
DeleteTimerQueueTimer
</dependency>
<dependency>
    </dependentAssembly>
    <dependentAssembly>
DeregisterEventSource
<description>Inno Setup</description>
DirBrowseButton
DirBrowseButtonClick
DirEdit
DisableThreadLibraryCalls
DiskBitmapImage
DiskSpaceLabel
DispatchMessageW
DllGetVersion
__dllonexit
DllRegisterServer
dll\shfolder.dbg
DllUnregisterServer
        <dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>
DropDownCount
Ds44DB
DuplicateHandle
?e6(nX"
Enabled
EnterCriticalSection
EnumResourceLanguagesW
EnumResourceNamesW
eTQD\K
_except_handler3
ExitProcess
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
&),Exz
]+F#+"
ff_#Xf
FilenameEdit
FilenameLabel
FindResourceExW
FinishedHeadingLabel
FinishedLabel
FinishedPage
FocusControl
Font.Color
Font.Height
	Font.Name
Font.Style
ForceLTRReading	
	FormClose
FormCloseQuery
FormCloseQuery	OnKeyDown
FormKeyDown
	FormPaint
FormResize
FreeLibrary
FreeSid
Fz6SMssC9MLOKkin7TpyDswSReqFMy8NgVdR0Exaf4k6EQ5CSeQe6UFPcMIb
GetAce
GetCommandLineA
GetCommandLineW
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
GetEnvironmentVariableW
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetLastError
GetMessageW
GetModuleFileNameW
GetModuleHandleA
GetNamedSecurityInfoW
GetProcAddress
GetStartupInfoW
GetSysColor
GetSystemDefaultLangID
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemTime
GetTempPathW
GetTickCount
GetTimeZoneInformation
GetTopWindow
GetUserDefaultLCID
GetVersionExA
GetWindowsDirectoryA
GetWindowsDirectoryW
G=j)zT$1'FWM]
GlobalAlloc
GlobalFree
GlobalLock
GlobalSize
GlobalUnlock
GroupBrowseButton
GroupBrowseButtonClick
	GroupEdit
}'h1k#i
)H4P,^
h6emf4yl
h6emZ3~d
HeapDestroy
Height
History
#HpjD4!
IconBitmapImage
Ij]Vvd
InfoAfterClickLabel
InfoAfterMemo
InfoAfterPage
InfoBeforeClickLabel
InfoBeforeMemo
InfoBeforePage
InitializeAcl
InitializeCriticalSection
InitializeSecurityDescriptor
_initterm
InnerNotebook
	InnerPage
InSendMessage
InstallingPage
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsBadWritePtr
iswspace
ItemHeight
jadPw7sA
'J "@hI
:/:J:V:j:~:
KERNEL32.dll
KXi #;
>L8c	3|
            language="*"
LeaveCriticalSection
LicenseAcceptedRadio
LicenseAcceptedRadioClick
LicenseLabel1
LicenseMemo
LicenseNotAcceptedRadio
LicenseNotAcceptedRadioClick
LicensePage
LoadIconW
LoadLibraryA
LoadLibraryExA
LoadLibraryW
LoadResource
LoadStringW
LocalAlloc
Local AppData
LocalFile
LocalFree
LocationEdit
LocationLabel
LockResource
lokFD'-
LookupAccountSidW
lstrcatA
lstrcatW
lstrcmpiA
lstrcpyA
lstrcpynW
lstrcpyW
lstrlenA
lstrlenW
MainForm
malloc
MapViewOfFile
m%AUD1
	MaxLength
memmove
MIx Qn
mN0*rX3
ModalResult
mOqpkFue%
MoveFileExW
MsgWaitForMultipleObjects
MS Sans Serif
msvcrt.dll
MultiByteToWideChar
MustBeRelative
My Music
My Pictures
m^Y#qB
    name="JR.Inno.Setup"
            name="Microsoft.Windows.Common-Controls"
NewDiskForm
NewFolderButton
NewFolderButtonClick
NextButton
NextButtonClick
NoButton
NoIconsCheck
NoIconsCheckClick
NoRadio
NoToAllButton
o=5M]m
Offset
OKButton
ole32.dll
OLEAUT32.dll
OleInitialize
OleUninitialize
OnChange
OnClick
OnClickCheck
OnClose
OnCloseQuery
_onexit
OnPaint
OnResize
OpenThreadToken
OuterNotebook
%p,1n4
PageDescriptionLabel
PageNameLabel
ParentColor
ParentColor	
PasswordEdit
PasswordEditLabel
PasswordLabel
PasswordPage
PathEdit
PathEditChange
__p__commode
.pdata
PeekMessageW
Personal
__p__fmode
PixelsPerInch
)pK0Ot
PostThreadMessageW
PreparingErrorBitmapImage
PreparingLabel
PreparingNoRadio
PreparingPage
PreparingYesRadio
            processorArchitecture="*"
            processorArchitecture="x86"
    processorArchitecture="x86"
ProfileDirectory
ProgressBar
ProgressGauge
            publicKeyToken="6595b64144ccf1df"
_purecall
q<7yqmy
<q}	'p	Y
QqRMIW
qWPWSh
RaiseException
`.rdata
ReadFile
ReadOnly	
ReadyLabel
RegCloseKey
RegConnectRegistryW
RegCreateKeyExA
RegisterEventSourceW
RegKey
RegOpenKeyA
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExA
RegQueryValueExW
RegSetValueExA
RegSetValueExW
RegValue
ReleaseCapture
ReleaseMutex
@.reloc
            <requestedExecutionLevel level="asInvoker"            uiAccess="false"/>
            <requestedExecutionLevel level="asInvoker" uiAccess="false"/>
        </requestedPrivileges>
        <requestedPrivileges>
RequireRadioSelection	
RequireRadioSelection		ShowLines
ResetEvent
r:HOjb
rm'jdn
-Rqp49|o
@.rsrc
RunList
&Ru)vx.
r:Z,z6
?[s5^o
Scaled
ScrollBars
    </security>
    <security>
SelectComponentsLabel
SelectComponentsPage
SelectDirBitmapImage
SelectDirBrowseLabel
SelectDirLabel
SelectDirPage
SelectDiskLabel
SelectFolderForm
SelectGroupBitmapImage
SelectLabel
SelectLanguageForm
SelectProgramGroupPage
SelectStartMenuFolderLabel
SelectTasksLabel
SelectTasksPage
__set_app_type
SetConsoleCtrlHandler
SetCurrentDirectoryA
SetCurrentDirectoryW
SetEntriesInAclW
SetEnvironmentVariableW
SetErrorMode
SetEvent
SetFileAttributesW
SetFilePointer
SetFileSecurityW
SetLastError
SetNamedSecurityInfoW
SetProcessShutdownParameters
SetSecurityDescriptorDacl
SetThreadToken
__setusermatherr
shell32.dll
SHELL32.dll
SHFOLDER.dll
SHGetFolderPathA
SHGetFolderPathW
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
shlwapi.dll
SHLWAPI.dll
ShowAccelChar
sNo oO
SOFTWARE\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Software\Microsoft\Windows\CurrentVersion\ProfileReconciliation
Sorted	
ssBoth
ssVertical
StatusLabel
StrToInt64ExW
StrToIntW
        <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
        <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
@SUVWH
swprintf
swscanf
T3X3p3t3
TabOrder
TabStop	
TBevel
TBitmapImage
tc9t$puVL
TextHeight
!This program cannot be run in DOS mode.
timeGetTime
Tl3="?
tN	{$aO
TNewButton
TNewButton	YesButton
TNewCheckBox
TNewCheckListBox
TNewCheckListBox	TasksList
TNewComboBox
TNewComboBox	LangCombo
TNewDiskForm
TNewEdit
TNewEdit	GroupEdit
TNewMemo	ReadyMemo
TNewNotebook
TNewNotebookPage
TNewNotebookPage	InnerPage
TNewNotebookPage	ReadyPage
TNewProgressBar
TNewRadioButton
TNewStaticText
TNewStaticText	BodyLabel
TNewStaticText	PathLabel
TNewStaticText SelectStartMenuFolderBrowseLabel
T~NkE9?w
TPanel	MainPanel
TPasswordEdit
TPF0	TMainForm
%.T*@]q
TranslateMessage
TRichEditViewer
</trustInfo>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
TSelectFolderForm
TSelectLanguageForm
TUninstallProgressForm
TUninstSharedFileForm
TWizardForm
TypesCombo
TypesComboChange
            type="win32"
    type="win32"/>
=<u #a
uk4L3W
Ula)Rr
UninstallProgressForm
UninstSharedFileForm
USER32.dll
UseRichEdit
UserInfoEditChange
UserInfoNameEdit
UserInfoNameLabel
UserInfoOrgEdit
UserInfoOrgLabel
UserInfoPage
UserInfoSerialEdit
UserInfoSerialLabel
utl$U)
u#X|b~
VaxY*W
    version="1.0.0.0"
            version="6.0.0.0"
v~iQ3Y
VirtualAllocEx
Visible
WaitForMultipleObjects
WaitForSingleObject
WantReturns
WantTabs	
WATAUAVAWH
!w A|Xa
_wcmdln
wcscat
wcschr
wcscmp
wcscpy
_wcsdup
_wcsicmp
wcslen
wcsncat
_wcsnicmp
WelcomeLabel1
WelcomeLabel2
WelcomePage
__wgetmainargs
WideCharToMultiByte
*windir
    </windowsSettings>
    <windowsSettings>
WINMM.dll
WizardBitmapImage
WizardBitmapImage2
WizardForm
WizardSmallBitmapImage
WordWrap
WordWrap	
WPWShx
WriteFile
wwwwww|
wwwwwwwww
wwwwwwwwwwwww
wwwwwwwwwwwwwp
x-	)6U~
_XcptFilter
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
X&RXY.oL
Y7~>HWC
YesRadio
YesToAllButton
yg.O!#
yyyeadingModel
z7!e@l