Edit tour

Windows Analysis Report
Siopel.exe

Overview

General Information

Sample name:	Siopel.exe
Analysis ID:	1559580
MD5:	fdc8014d627b85ec211f282a696653b7
SHA1:	49a850bff30eedbc04a34fd3f6479225726d0377
SHA256:	73b1da090537fc3acb0aedce8231f95082433246a23a83c838a810a3d0c9f168
Infos:

Detection

Score:	23
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Sigma detected: Potential Persistence Via COM Hijacking From Suspicious Locations

Creates files inside the system directory

Entry point lies outside standard sections

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Process Tree

System is w10x64_ra

Siopel.exe (PID: 7020 cmdline: "C:\Users\user\Desktop\Siopel.exe" MD5: FDC8014D627B85EC211F282A696653B7)

cleanup

Sigma Signatures

System Summary

Sigma detected: Potential Persistence Via COM Hijacking From Suspicious Locations

Source: Registry Key set

Author: Nasreddine Bencherchali (Nextron Systems): Data: Details: C:\Users\user\Desktop\Siopel.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Siopel.exe, ProcessId: 7020, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{380BFC1D-3E4F-41DD-ACBD-CE03C2E4923D}\LocalServer32\(Default)

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: Siopel.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://fastmm.sourceforge.net).
Source: Siopel.exe, 00000005.00000002.2388756843.00000000015C2000.00000004.00000001.01000000.00000004.sdmp, Siopel.exe, 00000005.00000003.1285763715.0000000004166000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mae.com.ar
Source: Siopel.exe, 00000005.00000003.1285763715.0000000004707000.00000004.00001000.00020000.00000000.sdmp, Siopel.exe, 00000005.00000002.2388756843.0000000001B63000.00000004.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.qusoft.com
Source: Siopel.exe, 00000005.00000002.2388263506.0000000000D34000.00000004.00000001.01000000.00000004.sdmp, Siopel.exe, 00000005.00000003.1284176551.0000000003980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: Siopel.exe, 00000005.00000002.2388263506.0000000000D34000.00000004.00000001.01000000.00000004.sdmp, Siopel.exe, 00000005.00000003.1284176551.0000000003980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll-1.2.3rbr
Source: Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/Jcl8087.pas
Source: Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclAnsiStrings.
Source: Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclBase.pas
Source: Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclCharsets.pas
Source: Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclDateTime.pas
Source: Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclFileUtils.pa
Source: Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclIniFiles.pas
Source: Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclLogic.pas
Source: Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclMath.pas
Source: Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclMime.pas
Source: Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclRTTI.pas
Source: Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclResources.pa
Source: Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclStreams.pas
Source: Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclStringConver
Source: Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclStrings.pas
Source: Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclSynch.pas
Source: Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclSysInfo.pas
Source: Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclSysUtils.pas
Source: Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclUnicode.pas
Source: Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclUnitVersioni
Source: Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclWideStrings.
Source: Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/windows/JclConsole.pas
Source: Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/windows/JclRegistry.pa
Source: Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/windows/JclSecurity.pa
Source: Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/windows/JclShell.pas
Source: Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/windows/JclWin32.pas

Source: C:\Users\user\Desktop\Siopel.exe

File created: C:\Windows\SIOPEL.INI

Jump to behavior

Source: Siopel.exe

Static PE information: Number of sections : 11 > 10

Source: Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: OriginalFilename vs Siopel.exe

Source: Siopel.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: Siopel.exe

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: Siopel.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: Siopel.exe	Static PE information: Section: DATA ZLIB complexity 0.9942132318773235
Source: Siopel.exe	Static PE information: Section: .idata ZLIB complexity 0.9939778645833334

Source: classification engine

Classification label: sus23.winEXE@1/2@0/1

Source: C:\Users\user\Desktop\Siopel.exe

File created: C:\Users\user\Desktop\_PruebaAcceso

Jump to behavior

Source: C:\Users\user\Desktop\Siopel.exe

Mutant created: \Sessions\1\BaseNamedObjects\MutexNPA_UnitVersioning_7020

Source: C:\Users\user\Desktop\Siopel.exe

File created: C:\Users\user\AppData\Local\Temp\TRADE_0

Jump to behavior

Source: C:\Users\user\Desktop\Siopel.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Jump to behavior

Source: C:\Users\user\Desktop\Siopel.exe

File read: C:\Windows\SIOPEL.INI

Jump to behavior

Source: C:\Users\user\Desktop\Siopel.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Siopel.exe

File read: C:\Users\user\Desktop\Siopel.exe

Jump to behavior

Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\Siopel.exe

File written: C:\Windows\SIOPEL.INI

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Siopel.exe

Static file information: File size 7617536 > 1048576

Source: Siopel.exe	Static PE information: Raw size of CODE is bigger than: 0x100000 < 0x2e8400
Source: Siopel.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x435e00

Source: initial sample

Static PE information: section where entry point is pointing to: .aspack

Source: Siopel.exe	Static PE information: section name: .aspack
Source: Siopel.exe	Static PE information: section name: .adata

Source: C:\Users\user\Desktop\Siopel.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Siopel.exe, 00000005.00000002.2407084724.0000000001D54000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Siopel.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\Siopel.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Software Packing	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	11 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Siopel.exe	3%	ReversingLabs

Source	Detection	Scanner	Label
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/windows/JclConsole.pas	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclStrings.pas	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclIniFiles.pas	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclBase.pas	0%	Avira URL Cloud	safe
http://www.qusoft.com	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclFileUtils.pa	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclSynch.pas	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclResources.pa	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclLogic.pas	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/windows/JclRegistry.pa	0%	Avira URL Cloud	safe
http://www.winimage.com/zLibDll-1.2.3rbr	0%	Avira URL Cloud	safe
http://fastmm.sourceforge.net).	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclSysInfo.pas	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclMime.pas	0%	Avira URL Cloud	safe
http://www.mae.com.ar	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclUnitVersioni	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclMath.pas	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclSysUtils.pas	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclStreams.pas	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/windows/JclWin32.pas	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclCharsets.pas	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclDateTime.pas	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclStringConver	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclRTTI.pas	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/Jcl8087.pas	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclUnicode.pas	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclWideStrings.	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclAnsiStrings.	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/windows/JclShell.pas	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/windows/JclSecurity.pa	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclFileUtils.pa	Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclIniFiles.pas	Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclSynch.pas	Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.qusoft.com	Siopel.exe, 00000005.00000003.1285763715.0000000004707000.00000004.00001000.00020000.00000000.sdmp, Siopel.exe, 00000005.00000002.2388756843.0000000001B63000.00000004.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/windows/JclConsole.pas	Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclBase.pas	Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclResources.pa	Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/windows/JclRegistry.pa	Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclLogic.pas	Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclStrings.pas	Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclSysInfo.pas	Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclMime.pas	Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll-1.2.3rbr	Siopel.exe, 00000005.00000002.2388263506.0000000000D34000.00000004.00000001.01000000.00000004.sdmp, Siopel.exe, 00000005.00000003.1284176551.0000000003980000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mae.com.ar	Siopel.exe, 00000005.00000002.2388756843.00000000015C2000.00000004.00000001.01000000.00000004.sdmp, Siopel.exe, 00000005.00000003.1285763715.0000000004166000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclMath.pas	Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://fastmm.sourceforge.net).	Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclUnitVersioni	Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclStreams.pas	Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclSysUtils.pas	Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/windows/JclWin32.pas	Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclCharsets.pas	Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclDateTime.pas	Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclUnicode.pas	Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll	Siopel.exe, 00000005.00000002.2388263506.0000000000D34000.00000004.00000001.01000000.00000004.sdmp, Siopel.exe, 00000005.00000003.1284176551.0000000003980000.00000004.00001000.00020000.00000000.sdmp	false		high
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclRTTI.pas	Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/Jcl8087.pas	Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/windows/JclShell.pas	Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclStringConver	Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclWideStrings.	Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/windows/JclSecurity.pa	Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/tags/JCL-2.1-Build3536/jcl/source/common/JclAnsiStrings.	Siopel.exe, 00000005.00000003.1280823541.0000000003A40000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559580
Start date and time:	2024-11-20 17:26:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Siopel.exe
Detection:	SUS
Classification:	sus23.winEXE@1/2@0/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 2 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, slscr.update.microsoft.com, login.live.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Siopel.exe, PID 7020 because it is empty
Not all processes where analyzed, report is missing behavior information
Reached maximum number of file to list during submission archive extraction
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Siopel.exe

Process:	C:\Users\user\Desktop\Siopel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:rkn:rkn
MD5:	66DC17313BC3F7E4103E4703B9CF08B3
SHA1:	A4E04A957AEF009F30F84D92E281406FE5405141
SHA-256:	8CDF20CF398C7344AE888D7FACA0E5D83A2599CC9C50CB244CAEF0D4AA435D15
SHA-512:	FFA4F7D914FFB001322B4781844BB49D4B9CE3F54A76747F41CFB4F867F947090EC1F7F56CC72439D8694935ED13266F4B3D764ABF500799D66C862C84A66F70
Malicious:	false
Reputation:	low
Preview:	Prueba!..

C:\Windows\SIOPEL.INI

Download File

Process:	C:\Users\user\Desktop\Siopel.exe
File Type:	Generic INItialization configuration [Negociacion]
Category:	dropped
Size (bytes):	124
Entropy (8bit):	4.900989004502707
Encrypted:	false
SSDEEP:	3:1MKfiAVLyxSiOcjbEGtRqVKHEBQovztsWfovkEEGTG/Y1ov:GXAVLy3q8oQydgr1y
MD5:	21359AF55419E998258C9904E0F2D1D6
SHA1:	0A60303B9F17D6C3936C03B638D0FE030E63892B
SHA-256:	C901D120662EB4F653458FEF929AE572554154320AB5E7E151242F42A38E8DBC
SHA-512:	550D014DA804AC8235FAF0F3607C58B282CCFF39C5C1DD7C713440F38999AE1E388246472A09F200E27A418EEC08DBF776E73C30F2BA489E449A1A3747CB09AF
Malicious:	false
Reputation:	low
Preview:	[ConfiguracionN]..SkinDefault=SiopelV830.skn..[Negociacion]..CarpetasTempBorradas=SI..Version=3846..Error actualizacion=Ok..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.98715649506092
TrID:	Win32 Executable (generic) a (10002005/4) 99.53% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	Siopel.exe
File size:	7'617'536 bytes
MD5:	fdc8014d627b85ec211f282a696653b7
SHA1:	49a850bff30eedbc04a34fd3f6479225726d0377
SHA256:	73b1da090537fc3acb0aedce8231f95082433246a23a83c838a810a3d0c9f168
SHA512:	68b9e68c626034ea70fda9ac892c1735deb654943db2e9d1c3a3ce8d3644b590c893e4428376d9ed01b86a20f7e3f2218ed62cf0a88f9b715460902e8091a6be
SSDEEP:	196608:PUK1TZW1q/9OQNgjrf5l+XMPPkgtq8vMqNW84U:RTZQq96l+XMPPkf8kqNWK
TLSH:	9776333372EAC025D004FA780F89C2545B5A70E984D646ABF15C7E9FCA73AECA1535BC
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	18030c3c136f4f41

Static PE Info

General

Entrypoint:	0x1beb001
Entrypoint Section:	.aspack
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	acad26d1ba90cd969f71bb50d80157e0

Entrypoint Preview

Instruction
pushad
call 00007FEE288A4708h
jmp 00007FEE6DE74BF0h
push ebp
ret
call 00007FEE288A4706h
jmp 00007FEE288A475Fh
mov ebx, FFFFFFEDh
add ebx, ebp
sub ebx, 017EB000h
cmp dword ptr [ebp+00000422h], 00000000h
mov dword ptr [ebp+00000422h], ebx
jne 00007FEE288A4A6Bh
lea eax, dword ptr [ebp+0000042Eh]
push eax
call dword ptr [ebp+00000F4Dh]
mov dword ptr [ebp+00000426h], eax
mov edi, eax
lea ebx, dword ptr [ebp+5Eh]
push ebx
push eax
call dword ptr [ebp+00000F49h]
mov dword ptr [ebp+0000054Dh], eax
lea ebx, dword ptr [ebp+6Bh]
push ebx
push edi
call dword ptr [ebp+00000F49h]
mov dword ptr [ebp+00000551h], eax
lea eax, dword ptr [ebp+77h]
jmp eax
push esi
imul esi, dword ptr [edx+74h], 416C6175h
insb
insb
outsd
arpl word ptr [eax], ax
push esi
imul esi, dword ptr [edx+74h], 466C6175h
jc 00007FEE288A4767h
add byte ptr [ebx+0005319Dh], cl
add byte ptr [ebx], cl

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x984000	0x2ed	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x17ebfac	0x5f0	.aspack
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa11000	0xdd9600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x17ebf54	0x8	.aspack
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x17ebf3c	0x18	.aspack
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x100000

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x933000	0x2e8400	5051058520f82920026455f2dcdf5c5d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
DATA	0x934000	0x3d000	0x21a00	675c5a025b3a6791403b9f4058533119	False	0.9942132318773235	data	7.996877231407539	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0x971000	0xe000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x97f000	0x5000	0x1800	493fdf8562ab1ea37642bb0148366899	False	0.9939778645833334	data	7.947608021499819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x984000	0x1000	0x400	5a8f1ef15a7117f4e70693b3fbf787d2	False	0.3623046875	data	4.406973811340517	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x985000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x986000	0x1000	0x200	35e26e811425f8a5bfec02f5fcd44cfd	False	0.0546875	data	0.2147325177871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x987000	0x8a000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xa11000	0xdda000	0x435e00	140aae48851f4a2a1d01c36b5b4d0984	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.aspack	0x17eb000	0x2000	0x1e00	f748fd0fe3e898ec8f39827691ae5751	False	0.51015625	data	5.43042200597361	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.adata	0x17ed000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AVI	0xa25004	0x1b62	RIFF (little-endian) data, AVI, 48 x 48, 5.00 fps, video: uncompressed RLE 8bpp			0.20542082738944364
GIF	0xa26b68	0x18f93	GIF image data, version 89a, 72 x 72			0.9460265321484783
GIF	0xa3fafc	0x9b9b	GIF image data, version 89a, 32 x 32			0.8268608008033137
GIF	0xa49698	0x1a820	GIF image data, version 89a, 72 x 72			0.8147564839375184
GIF	0xa63eb8	0x10735	GIF image data, version 89a, 32 x 32			0.5128745492052655
GIF	0xa745f0	0x996d	GIF image data, version 89a, 75 x 75			0.5608371311454541
GIF	0xa7df60	0xa02b	GIF image data, version 87a, 84 x 84			0.9769529058849352
RTF	0xa87f8c	0xdfe4	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 11274			0.06120455021285505
TYPELIB	0xa95f70	0x6118	data			0.37085613131638234
UNICODEDATA	0xa9c088	0xedc0	data	French	France	0.9768993165089379
UNICODEDATA	0xaaae48	0x7870	data	French	France	1.0005189413596263
UNICODEDATA	0xab26b8	0x8d8	data	French	France	1.0048586572438163
UNICODEDATA	0xab2f90	0x3e84	data	French	France	1.000687328167958
UNICODEDATA	0xab6e14	0x7498	data	French	France	1.0005360493165372
UNICODEDATA	0xabe2ac	0x20a0	data	French	France	1.0013170498084292
RT_CURSOR	0xac034c	0x134	data			1.0357142857142858
RT_CURSOR	0xac0480	0x134	data			1.0357142857142858
RT_CURSOR	0xac05b4	0x134	data			1.0357142857142858
RT_CURSOR	0xac06e8	0x134	data	Spanish	Argentina	1.0357142857142858
RT_CURSOR	0xac081c	0x134	data			1.0357142857142858
RT_CURSOR	0xac0950	0x134	data			1.0357142857142858
RT_CURSOR	0xac0a84	0x134	data			1.0357142857142858
RT_CURSOR	0xac0bb8	0x134	data	German	Germany	1.0357142857142858
RT_CURSOR	0xac0cec	0x134	data	German	Germany	1.0357142857142858
RT_CURSOR	0xac0e20	0x134	data	Spanish	Argentina	1.0357142857142858
RT_CURSOR	0xac0f54	0x134	data	Spanish	Argentina	1.0357142857142858
RT_CURSOR	0xac1088	0x134	data	Spanish	Argentina	1.0357142857142858
RT_CURSOR	0xac11bc	0x134	data			1.0357142857142858
RT_CURSOR	0xac12f0	0x134	data			1.0357142857142858
RT_CURSOR	0xac1424	0x134	data	Spanish	Argentina	1.0357142857142858
RT_CURSOR	0xac1558	0x134	data	Spanish	Argentina	1.0357142857142858
RT_CURSOR	0xac168c	0x134	data			1.0357142857142858
RT_CURSOR	0xac17c0	0x134	data			1.0357142857142858
RT_BITMAP	0xac18f4	0x1d0	data			1.0237068965517242
RT_BITMAP	0xac1ac4	0x1e4	data			1.0227272727272727
RT_BITMAP	0xac1ca8	0x1d0	data			1.0237068965517242
RT_BITMAP	0xac1e78	0x1d0	data			1.0237068965517242
RT_BITMAP	0xac2048	0x1d0	data			1.0237068965517242
RT_BITMAP	0xac2218	0x1d0	data			1.0237068965517242
RT_BITMAP	0xac23e8	0x1d0	OpenPGP Public Key			1.0237068965517242
RT_BITMAP	0xac25b8	0x1d0	data			1.0237068965517242
RT_BITMAP	0xac2788	0x1d0	data			1.0237068965517242
RT_BITMAP	0xac2958	0x1d0	data			1.0237068965517242
RT_BITMAP	0xac2b28	0x5c	data			1.1195652173913044
RT_BITMAP	0xac2b84	0x5c	data			1.1195652173913044
RT_BITMAP	0xac2be0	0x5c	data			1.1195652173913044
RT_BITMAP	0xac2c3c	0x5c	data			1.1195652173913044
RT_BITMAP	0xac2c98	0x5c	data			1.1195652173913044
RT_BITMAP	0xac2cf4	0x138	data			1.0352564102564104
RT_BITMAP	0xac2e2c	0x628	data			1.006979695431472
RT_BITMAP	0xac3454	0x138	data			1.0352564102564104
RT_BITMAP	0xac358c	0x628	data			1.006979695431472
RT_BITMAP	0xac3bb4	0x138	data			1.0352564102564104
RT_BITMAP	0xac3cec	0x628	data			1.006979695431472
RT_BITMAP	0xac4314	0x138	data			1.0352564102564104
RT_BITMAP	0xac444c	0x628	data			1.006979695431472
RT_BITMAP	0xac4a74	0x138	data			1.0352564102564104
RT_BITMAP	0xac4bac	0x628	data			1.006979695431472
RT_BITMAP	0xac51d4	0x138	data			1.0352564102564104
RT_BITMAP	0xac530c	0x628	data			1.006979695431472
RT_BITMAP	0xac5934	0x104	data			1.0423076923076924
RT_BITMAP	0xac5a38	0x628	data			1.006979695431472
RT_BITMAP	0xac6060	0x138	Dyalog APL version 76.101			1.0352564102564104
RT_BITMAP	0xac6198	0x628	data			1.006979695431472
RT_BITMAP	0xac67c0	0x104	data			1.0423076923076924
RT_BITMAP	0xac68c4	0x628	data			1.006979695431472
RT_BITMAP	0xac6eec	0x138	data			1.0352564102564104
RT_BITMAP	0xac7024	0x628	data			1.006979695431472
RT_BITMAP	0xac764c	0x528	data			1.0083333333333333
RT_BITMAP	0xac7b74	0xc0	data	Russian	Russia	1.0572916666666667
RT_BITMAP	0xac7c34	0xc0	data	Russian	Russia	1.0572916666666667
RT_BITMAP	0xac7cf4	0x528	data	Russian	Russia	1.0083333333333333
RT_BITMAP	0xac821c	0x528	data	Russian	Russia	1.0083333333333333
RT_BITMAP	0xac8744	0x528	data	Russian	Russia	1.0083333333333333
RT_BITMAP	0xac8c6c	0x568	data	Russian	Russia	1.0079479768786128
RT_BITMAP	0xac91d4	0x668	data	Russian	Russia	1.0067073170731706
RT_BITMAP	0xac983c	0xe8	data	Russian	Russia	1.0474137931034482
RT_BITMAP	0xac9924	0x528	data			1.0083333333333333
RT_BITMAP	0xac9e4c	0x518	data			1.008435582822086
RT_BITMAP	0xaca364	0x528	data	Russian	Russia	1.0083333333333333
RT_BITMAP	0xaca88c	0x518	data			1.008435582822086
RT_BITMAP	0xacada4	0x528	data	Russian	Russia	1.0083333333333333
RT_BITMAP	0xacb2cc	0x528	data	Russian	Russia	1.0083333333333333
RT_BITMAP	0xacb7f4	0x528	data			1.0083333333333333
RT_BITMAP	0xacbd1c	0x528	data			1.0083333333333333
RT_BITMAP	0xacc244	0xa8	data			1.0654761904761905
RT_BITMAP	0xacc2ec	0x134	data			1.0357142857142858
RT_BITMAP	0xacc420	0x528	data	Russian	Russia	1.0083333333333333
RT_BITMAP	0xacc948	0x668	data	Russian	Russia	1.0067073170731706
RT_BITMAP	0xaccfb0	0x528	data			1.0083333333333333
RT_BITMAP	0xacd4d8	0x528	data			1.0083333333333333
RT_BITMAP	0xacda00	0x528	data	Russian	Russia	1.0083333333333333
RT_BITMAP	0xacdf28	0x528	data			1.0083333333333333
RT_BITMAP	0xace450	0x17e	data	Russian	Russia	1.0287958115183247
RT_BITMAP	0xace5d0	0x528	data	Russian	Russia	1.0083333333333333
RT_BITMAP	0xaceaf8	0x528	data	Russian	Russia	1.0083333333333333
RT_BITMAP	0xacf020	0x518	data			1.008435582822086
RT_BITMAP	0xacf538	0x528	data	Russian	Russia	1.0083333333333333
RT_BITMAP	0xacfa60	0x17e	data	Russian	Russia	1.0287958115183247
RT_BITMAP	0xacfbe0	0x528	data	Russian	Russia	1.0083333333333333
RT_BITMAP	0xad0108	0xc0	data			1.0572916666666667
RT_BITMAP	0xad01c8	0x528	data	Russian	Russia	1.0083333333333333
RT_BITMAP	0xad06f0	0x528	data	Russian	Russia	1.0083333333333333
RT_BITMAP	0xad0c18	0x528	data	Russian	Russia	1.0083333333333333
RT_BITMAP	0xad1140	0x528	data	Russian	Russia	1.0083333333333333
RT_BITMAP	0xad1668	0x528	data	Russian	Russia	1.0083333333333333
RT_BITMAP	0xad1b90	0x90	data			1.0763888888888888
RT_BITMAP	0xad1c20	0x11c	data			1.0387323943661972
RT_BITMAP	0xad1d3c	0x2a4	data			1.0162721893491125
RT_BITMAP	0xad1fe0	0xc0	data			1.0572916666666667
RT_BITMAP	0xad20a0	0x128	data			1.037162162162162
RT_BITMAP	0xad21c8	0xe0	data	Spanish	Argentina	1.0491071428571428
RT_BITMAP	0xad22a8	0x7b8	data			1.0055668016194332
RT_BITMAP	0xad2a60	0xe0	data			1.0491071428571428
RT_BITMAP	0xad2b40	0x128	data			1.037162162162162
RT_BITMAP	0xad2c68	0x128	data			1.037162162162162
RT_BITMAP	0xad2d90	0x128	data			1.037162162162162
RT_BITMAP	0xad2eb8	0xe8	data			1.0474137931034482
RT_BITMAP	0xad2fa0	0x128	data			1.037162162162162
RT_BITMAP	0xad30c8	0x128	data			1.037162162162162
RT_BITMAP	0xad31f0	0xd0	OpenPGP Public Key			1.0528846153846154
RT_BITMAP	0xad32c0	0x128	data			1.037162162162162
RT_BITMAP	0xad33e8	0x128	data			1.037162162162162
RT_BITMAP	0xad3510	0xe0	data			1.0491071428571428
RT_BITMAP	0xad35f0	0x5c	data			1.1195652173913044
RT_BITMAP	0xad364c	0x5c	data			1.1195652173913044
RT_BITMAP	0xad36a8	0x5c	data			1.1195652173913044
RT_BITMAP	0xad3704	0x5c	data			1.1195652173913044
RT_BITMAP	0xad3760	0x5c	data			1.1195652173913044
RT_BITMAP	0xad37bc	0x138	data			1.0352564102564104
RT_BITMAP	0xad38f4	0x138	data			1.0352564102564104
RT_BITMAP	0xad3a2c	0x138	data			1.0352564102564104
RT_BITMAP	0xad3b64	0x138	data			1.0352564102564104
RT_BITMAP	0xad3c9c	0x138	data			1.0352564102564104
RT_BITMAP	0xad3dd4	0x138	data			1.0352564102564104
RT_BITMAP	0xad3f0c	0x104	data			1.0423076923076924
RT_BITMAP	0xad4010	0x138	data			1.0352564102564104
RT_BITMAP	0xad4148	0x104	data			1.0423076923076924
RT_BITMAP	0xad424c	0x138	data			1.0352564102564104
RT_BITMAP	0xad4384	0x128	data			1.037162162162162
RT_BITMAP	0xad44ac	0xf8	data			1.0443548387096775
RT_BITMAP	0xad45a4	0x128	data			1.037162162162162
RT_BITMAP	0xad46cc	0x128	data			1.037162162162162
RT_BITMAP	0xad47f4	0x128	data			1.037162162162162
RT_BITMAP	0xad491c	0xe8	data			1.0474137931034482
RT_BITMAP	0xad4a04	0x128	data			1.037162162162162
RT_BITMAP	0xad4b2c	0x128	data			1.037162162162162
RT_BITMAP	0xad4c54	0xd0	data			1.0528846153846154
RT_BITMAP	0xad4d24	0x128	data			1.037162162162162
RT_BITMAP	0xad4e4c	0x128	data			1.037162162162162
RT_BITMAP	0xad4f74	0xe8	data			1.0474137931034482
RT_BITMAP	0xad505c	0x528	data			1.0083333333333333
RT_BITMAP	0xad5584	0x852	data			1.0051643192488262
RT_BITMAP	0xad5dd8	0xf8	data			1.0443548387096775
RT_BITMAP	0xad5ed0	0x528	data			1.0083333333333333
RT_BITMAP	0xad63f8	0xe8	data			1.0474137931034482
RT_BITMAP	0xad64e0	0xf8	data			1.0443548387096775
RT_BITMAP	0xad65d8	0x828	data			1.0052681992337165
RT_BITMAP	0xad6e00	0xe8	data			1.0474137931034482
RT_BITMAP	0xad6ee8	0x128	data			1.037162162162162
RT_BITMAP	0xad7010	0x128	data			1.037162162162162
RT_BITMAP	0xad7138	0x128	OpenPGP Public Key			1.037162162162162
RT_BITMAP	0xad7260	0xe8	data			1.0474137931034482
RT_BITMAP	0xad7348	0x128	data			1.037162162162162
RT_BITMAP	0xad7470	0x128	data			1.037162162162162
RT_BITMAP	0xad7598	0xd0	data			1.0528846153846154
RT_BITMAP	0xad7668	0x128	data			1.037162162162162
RT_BITMAP	0xad7790	0x128	data			1.037162162162162
RT_BITMAP	0xad78b8	0xe0	data			1.0491071428571428
RT_BITMAP	0xad7998	0x88	data	English	United States	1.0808823529411764
RT_BITMAP	0xad7a20	0x90	data	English	United States	1.0763888888888888
RT_BITMAP	0xad7ab0	0x90	data	English	United States	1.0763888888888888
RT_BITMAP	0xad7b40	0x88	data	English	United States	1.0808823529411764
RT_BITMAP	0xad7bc8	0xb8	data	English	United States	1.059782608695652
RT_BITMAP	0xad7c80	0xc8	data	English	United States	1.055
RT_BITMAP	0xad7d48	0x7c	data	English	United States	1.0887096774193548
RT_BITMAP	0xad7dc4	0xc8	data	English	United States	1.055
RT_BITMAP	0xad7e8c	0xc8	data	English	United States	1.055
RT_BITMAP	0xad7f54	0xc8	data	English	United States	1.055
RT_BITMAP	0xad801c	0xc8	data			1.055
RT_BITMAP	0xad80e4	0xc0	data			1.0572916666666667
RT_BITMAP	0xad81a4	0xafcaa	data			1.0003138705797718
RT_BITMAP	0xb87e50	0xafca8	data			0.9970904394200322
RT_BITMAP	0xc37af8	0xafca8	data			0.9956099661129937
RT_BITMAP	0xce77a0	0xafca8	data			1.0000458307871785
RT_BITMAP	0xd97448	0xafca8	data			0.9963575090923247
RT_BITMAP	0xe470f0	0xafca8	empty			0
RT_BITMAP	0xef6d98	0xb8	empty	Spanish	Argentina	0
RT_BITMAP	0xef6e50	0xc0	empty			0
RT_BITMAP	0xef6f10	0xe0	empty			0
RT_BITMAP	0xef6ff0	0x4d5c	empty			0
RT_BITMAP	0xefbd4c	0xae	empty			0
RT_BITMAP	0xefbdfc	0xae	empty			0
RT_BITMAP	0xefbeac	0xae	empty			0
RT_BITMAP	0xefbf5c	0x84	empty	Spanish	Argentina	0
RT_BITMAP	0xefbfe0	0x7c	empty	Spanish	Argentina	0
RT_BITMAP	0xefc05c	0x84	empty	Spanish	Argentina	0
RT_BITMAP	0xefc0e0	0xae	empty			0
RT_BITMAP	0xefc190	0xae	empty			0
RT_BITMAP	0xefc240	0xae	empty			0
RT_BITMAP	0xefc2f0	0x84	empty	Spanish	Argentina	0
RT_BITMAP	0xefc374	0x7c	empty	Spanish	Argentina	0
RT_BITMAP	0xefc3f0	0xb8	empty	Spanish	Argentina	0
RT_BITMAP	0xefc4a8	0xc0	empty			0
RT_BITMAP	0xefc568	0x48	empty			0
RT_BITMAP	0xefc5b0	0x48	empty			0
RT_BITMAP	0xefc5f8	0xe0	empty			0
RT_BITMAP	0xefc6d8	0x48	empty			0
RT_BITMAP	0xefc720	0x48	empty			0
RT_BITMAP	0xefc768	0xe8	empty			0
RT_BITMAP	0xefc850	0x158	empty			0
RT_BITMAP	0xefc9a8	0x158	empty			0
RT_BITMAP	0xefcb00	0x158	empty			0
RT_BITMAP	0xefcc58	0x158	empty			0
RT_BITMAP	0xefcdb0	0x140	empty			0
RT_BITMAP	0xefcef0	0x140	empty			0
RT_BITMAP	0xefd030	0x140	empty			0
RT_BITMAP	0xefd170	0x158	empty			0
RT_BITMAP	0xefd2c8	0x140	empty			0
RT_BITMAP	0xefd408	0x140	empty			0
RT_BITMAP	0xefd548	0x140	empty			0
RT_BITMAP	0xefd688	0x158	empty			0
RT_BITMAP	0xefd7e0	0x140	empty			0
RT_BITMAP	0xefd920	0x140	empty			0
RT_BITMAP	0xefda60	0x158	empty			0
RT_BITMAP	0xefdbb8	0x140	empty			0
RT_BITMAP	0xefdcf8	0x140	empty			0
RT_BITMAP	0xefde38	0x158	empty			0
RT_BITMAP	0xefdf90	0x158	empty			0
RT_BITMAP	0xefe0e8	0x158	empty			0
RT_BITMAP	0xefe240	0x158	empty			0
RT_BITMAP	0xefe398	0x158	empty			0
RT_BITMAP	0xefe4f0	0x158	empty			0
RT_BITMAP	0xefe648	0x158	empty			0
RT_BITMAP	0xefe7a0	0x158	empty			0
RT_BITMAP	0xefe8f8	0x158	empty			0
RT_BITMAP	0xefea50	0x158	empty			0
RT_BITMAP	0xefeba8	0x158	empty			0
RT_BITMAP	0xefed00	0x158	empty			0
RT_BITMAP	0xefee58	0x158	empty			0
RT_BITMAP	0xefefb0	0x140	empty			0
RT_BITMAP	0xeff0f0	0x158	empty			0
RT_BITMAP	0xeff248	0x158	empty			0
RT_BITMAP	0xeff3a0	0x140	empty			0
RT_BITMAP	0xeff4e0	0x158	empty			0
RT_BITMAP	0xeff638	0x140	empty			0
RT_BITMAP	0xeff778	0x158	empty			0
RT_BITMAP	0xeff8d0	0x158	empty			0
RT_BITMAP	0xeffa28	0x158	empty			0
RT_BITMAP	0xeffb80	0x158	empty			0
RT_BITMAP	0xeffcd8	0x140	empty			0
RT_BITMAP	0xeffe18	0x140	empty			0
RT_BITMAP	0xefff58	0x140	empty			0
RT_BITMAP	0xf00098	0x158	empty			0
RT_BITMAP	0xf001f0	0x140	empty			0
RT_BITMAP	0xf00330	0x158	empty			0
RT_BITMAP	0xf00488	0x158	empty			0
RT_BITMAP	0xf005e0	0x158	empty			0
RT_BITMAP	0xf00738	0x140	empty			0
RT_BITMAP	0xf00878	0x140	empty			0
RT_BITMAP	0xf009b8	0x140	empty			0
RT_BITMAP	0xf00af8	0xc0	empty			0
RT_BITMAP	0xf00bb8	0x48	empty			0
RT_BITMAP	0xf00c00	0x48	empty			0
RT_BITMAP	0xf00c48	0xd0	empty			0
RT_BITMAP	0xf00d18	0xd0	empty			0
RT_BITMAP	0xf00de8	0xd0	empty			0
RT_BITMAP	0xf00eb8	0xd0	empty			0
RT_BITMAP	0xf00f88	0xd0	empty			0
RT_BITMAP	0xf01058	0xd0	empty			0
RT_BITMAP	0xf01128	0xc8	empty			0
RT_BITMAP	0xf011f0	0x88	empty	English	United States	0
RT_BITMAP	0xf01278	0x88	empty	English	United States	0
RT_BITMAP	0xf01300	0x468	empty	English	United States	0
RT_BITMAP	0xf01768	0x88	empty	English	United States	0
RT_BITMAP	0xf017f0	0x98	empty			0
RT_BITMAP	0xf01888	0x98	empty			0
RT_BITMAP	0xf01920	0x188	empty			0
RT_BITMAP	0xf01aa8	0x188	empty	Catalan	Spain	0
RT_BITMAP	0xf01c30	0x188	empty			0
RT_BITMAP	0xf01db8	0x188	empty			0
RT_BITMAP	0xf01f40	0x110	empty			0
RT_BITMAP	0xf02050	0x110	empty			0
RT_BITMAP	0xf02160	0xf8	empty			0
RT_BITMAP	0xf02258	0x188	empty			0
RT_BITMAP	0xf023e0	0x188	empty			0
RT_BITMAP	0xf02568	0xe0	empty	Spanish	Argentina	0
RT_BITMAP	0xf02648	0xe0	empty			0
RT_BITMAP	0xf02728	0x84	empty	English	United States	0
RT_BITMAP	0xf027ac	0x94	empty			0
RT_BITMAP	0xf02840	0x94	empty			0
RT_BITMAP	0xf028d4	0x94	empty			0
RT_BITMAP	0xf02968	0x94	empty			0
RT_BITMAP	0xf029fc	0x94	empty			0
RT_BITMAP	0xf02a90	0x94	empty			0
RT_BITMAP	0xf02b24	0x94	empty	English	United States	0
RT_BITMAP	0xf02bb8	0x94	empty	English	United States	0
RT_BITMAP	0xf02c4c	0x94	empty	English	United States	0
RT_BITMAP	0xf02ce0	0x94	empty	English	United States	0
RT_BITMAP	0xf02d74	0x40	empty			0
RT_BITMAP	0xf02db4	0x50	empty	English	United States	0
RT_BITMAP	0xf02e04	0x84	empty	English	United States	0
RT_BITMAP	0xf02e88	0xd8	empty	English	United States	0
RT_BITMAP	0xf02f60	0xd8	empty	English	United States	0
RT_BITMAP	0xf03038	0xc0	empty			0
RT_BITMAP	0xf030f8	0xc0	empty			0
RT_BITMAP	0xf031b8	0x140	empty	English	United States	0
RT_BITMAP	0xf032f8	0x140	empty	English	United States	0
RT_BITMAP	0xf03438	0x140	empty	English	United States	0
RT_BITMAP	0xf03578	0x140	empty	English	United States	0
RT_BITMAP	0xf036b8	0x140	empty	English	United States	0
RT_BITMAP	0xf037f8	0x140	empty	English	United States	0
RT_BITMAP	0xf03938	0x140	empty	English	United States	0
RT_BITMAP	0xf03a78	0x140	empty	English	United States	0
RT_BITMAP	0xf03bb8	0x140	empty	English	United States	0
RT_BITMAP	0xf03cf8	0x140	empty	English	United States	0
RT_BITMAP	0xf03e38	0x140	empty	English	United States	0
RT_BITMAP	0xf03f78	0x140	empty	English	United States	0
RT_BITMAP	0xf040b8	0x140	empty	English	United States	0
RT_BITMAP	0xf041f8	0x140	empty	English	United States	0
RT_BITMAP	0xf04338	0x140	empty	English	United States	0
RT_BITMAP	0xf04478	0x140	empty	English	United States	0
RT_BITMAP	0xf045b8	0x140	empty	English	United States	0
RT_BITMAP	0xf046f8	0x140	empty	English	United States	0
RT_BITMAP	0xf04838	0x140	empty	English	United States	0
RT_BITMAP	0xf04978	0x140	empty	English	United States	0
RT_BITMAP	0xf04ab8	0x140	empty	English	United States	0
RT_BITMAP	0xf04bf8	0x140	empty	English	United States	0
RT_BITMAP	0xf04d38	0x140	empty	English	United States	0
RT_BITMAP	0xf04e78	0x140	empty	English	United States	0
RT_BITMAP	0xf04fb8	0x140	empty	English	United States	0
RT_BITMAP	0xf050f8	0x140	empty	English	United States	0
RT_BITMAP	0xf05238	0x140	empty	English	United States	0
RT_BITMAP	0xf05378	0x140	empty	English	United States	0
RT_BITMAP	0xf054b8	0x140	empty	English	United States	0
RT_BITMAP	0xf055f8	0x140	empty	English	United States	0
RT_BITMAP	0xf05738	0x140	empty	English	United States	0
RT_BITMAP	0xf05878	0x140	empty	English	United States	0
RT_BITMAP	0xf059b8	0x140	empty	English	United States	0
RT_BITMAP	0xf05af8	0x140	empty	English	United States	0
RT_BITMAP	0xf05c38	0x140	empty	English	United States	0
RT_BITMAP	0xf05d78	0x140	empty	English	United States	0
RT_ICON	0x17ec928	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Spanish	Argentina	0.29838709677419356
RT_DIALOG	0xf061a0	0x52	empty			0
RT_DIALOG	0xf061f4	0x268	empty			0
RT_DIALOG	0xf0645c	0x540	empty			0
RT_DIALOG	0xf0699c	0x114	empty			0
RT_DIALOG	0xf06ab0	0xb2	empty			0
RT_DIALOG	0xf06b64	0xbc	empty			0
RT_DIALOG	0xf06c20	0xc0	empty			0
RT_DIALOG	0xf06ce0	0xbc	empty			0
RT_DIALOG	0xf06d9c	0xbc	empty			0
RT_DIALOG	0xf06e58	0xc0	empty			0
RT_DIALOG	0xf06f18	0xc0	empty			0
RT_STRING	0xf06fd8	0x4c	empty	English	United States	0
RT_STRING	0xf07024	0x10e	empty	English	United States	0
RT_STRING	0xf07134	0x6e	empty	English	United States	0
RT_STRING	0xf071a4	0xd6	empty	English	United States	0
RT_STRING	0xf0727c	0x9c	empty	English	United States	0
RT_STRING	0xf07318	0xae	empty	English	United States	0
RT_STRING	0xf073c8	0x98	empty	English	United States	0
RT_STRING	0xf07460	0xd0	empty	English	United States	0
RT_STRING	0xf07530	0x62	empty	English	United States	0
RT_STRING	0xf07594	0xc4	empty	English	United States	0
RT_STRING	0xf07658	0x58	empty	English	United States	0
RT_STRING	0xf076b0	0x64	empty	English	United States	0
RT_STRING	0xf07714	0x52	empty	English	United States	0
RT_STRING	0xf07768	0x328	empty	English	United States	0
RT_STRING	0xf07a90	0xae	empty	English	United States	0
RT_STRING	0xf07b40	0x224	empty			0
RT_STRING	0xf07d64	0x336	empty			0
RT_STRING	0xf0809c	0x27a	empty			0
RT_STRING	0xf08318	0x32e	empty			0
RT_STRING	0xf08648	0x1d8	empty			0
RT_STRING	0xf08820	0x2c	empty			0
RT_STRING	0xf0884c	0x1ac	empty			0
RT_STRING	0xf089f8	0x45c	empty			0
RT_STRING	0xf08e54	0x3d8	empty			0
RT_STRING	0xf0922c	0x4b4	empty			0
RT_STRING	0xf096e0	0x3d0	empty			0
RT_STRING	0xf09ab0	0x414	empty			0
RT_STRING	0xf09ec4	0x364	empty			0
RT_STRING	0xf0a228	0x2e4	empty			0
RT_STRING	0xf0a50c	0x774	empty			0
RT_STRING	0xf0ac80	0x490	empty			0
RT_STRING	0xf0b110	0x3d8	empty			0
RT_STRING	0xf0b4e8	0x468	empty			0
RT_STRING	0xf0b950	0x378	empty			0
RT_STRING	0xf0bcc8	0x238	empty			0
RT_STRING	0xf0bf00	0x288	empty			0
RT_STRING	0xf0c188	0x404	empty			0
RT_STRING	0xf0c58c	0x3d0	empty			0
RT_STRING	0xf0c95c	0x330	empty			0
RT_STRING	0xf0cc8c	0x414	empty			0
RT_STRING	0xf0d0a0	0x1b4	empty			0
RT_STRING	0xf0d254	0x288	empty			0
RT_STRING	0xf0d4dc	0x470	empty			0
RT_STRING	0xf0d94c	0x27c	empty			0
RT_STRING	0xf0dbc8	0x3a0	empty			0
RT_STRING	0xf0df68	0x360	empty			0
RT_STRING	0xf0e2c8	0x1ac	empty			0
RT_STRING	0xf0e474	0x2a8	empty			0
RT_STRING	0xf0e71c	0x1f8	empty			0
RT_STRING	0xf0e914	0x234	empty			0
RT_STRING	0xf0eb48	0x1a4	empty			0
RT_STRING	0xf0ecec	0x278	empty			0
RT_STRING	0xf0ef64	0x1fc	empty			0
RT_STRING	0xf0f160	0x350	empty			0
RT_STRING	0xf0f4b0	0x2e0	empty			0
RT_STRING	0xf0f790	0x1bc	empty			0
RT_STRING	0xf0f94c	0x320	empty			0
RT_STRING	0xf0fc6c	0x398	empty			0
RT_STRING	0xf10004	0x510	empty			0
RT_STRING	0xf10514	0x26c	empty			0
RT_STRING	0xf10780	0x258	empty			0
RT_STRING	0xf109d8	0x3bc	empty			0
RT_STRING	0xf10d94	0x5e0	empty			0
RT_STRING	0xf11374	0x3e0	empty			0
RT_STRING	0xf11754	0x3d8	empty			0
RT_STRING	0xf11b2c	0x360	empty			0
RT_STRING	0xf11e8c	0x470	empty			0
RT_STRING	0xf122fc	0x57c	empty			0
RT_STRING	0xf12878	0x480	empty			0
RT_STRING	0xf12cf8	0x4cc	empty			0
RT_STRING	0xf131c4	0x268	empty			0
RT_STRING	0xf1342c	0x22c	empty			0
RT_STRING	0xf13658	0x1bc	empty			0
RT_STRING	0xf13814	0x268	empty			0
RT_STRING	0xf13a7c	0x4a8	empty			0
RT_STRING	0xf13f24	0x3bc	empty			0
RT_STRING	0xf142e0	0x5fc	empty			0
RT_STRING	0xf148dc	0x1ac	empty			0
RT_STRING	0xf14a88	0x584	empty			0
RT_STRING	0xf1500c	0x48c	empty			0
RT_STRING	0xf15498	0x2ac	empty			0
RT_STRING	0xf15744	0x428	empty			0
RT_STRING	0xf15b6c	0x268	empty			0
RT_STRING	0xf15dd4	0x330	empty			0
RT_STRING	0xf16104	0x204	empty			0
RT_STRING	0xf16308	0x1f0	empty			0
RT_STRING	0xf164f8	0x1e0	empty			0
RT_STRING	0xf166d8	0x720	empty			0
RT_STRING	0xf16df8	0xc4c	empty			0
RT_STRING	0xf17a44	0x750	empty			0
RT_STRING	0xf18194	0x398	empty			0
RT_STRING	0xf1852c	0x450	empty			0
RT_STRING	0xf1897c	0x260	empty			0
RT_STRING	0xf18bdc	0x4ac	empty			0
RT_STRING	0xf19088	0x150	empty			0
RT_STRING	0xf191d8	0x168	empty			0
RT_STRING	0xf19340	0x1bc	empty			0
RT_STRING	0xf194fc	0x260	empty			0
RT_STRING	0xf1975c	0x3b0	empty			0
RT_STRING	0xf19b0c	0x348	empty			0
RT_STRING	0xf19e54	0x39c	empty			0
RT_STRING	0xf1a1f0	0x164	empty			0
RT_STRING	0xf1a354	0x178	empty			0
RT_STRING	0xf1a4cc	0x6a8	empty			0
RT_STRING	0xf1ab74	0x440	empty			0
RT_STRING	0xf1afb4	0x3d0	empty			0
RT_STRING	0xf1b384	0x1f0	empty			0
RT_STRING	0xf1b574	0x498	empty			0
RT_STRING	0xf1ba0c	0x4a0	empty			0
RT_STRING	0xf1beac	0x258	empty			0
RT_STRING	0xf1c104	0x618	empty			0
RT_STRING	0xf1c71c	0x380	empty			0
RT_STRING	0xf1ca9c	0x574	empty			0
RT_STRING	0xf1d010	0x398	empty			0
RT_STRING	0xf1d3a8	0x4bc	empty			0
RT_STRING	0xf1d864	0x4d8	empty			0
RT_STRING	0xf1dd3c	0x488	empty			0
RT_STRING	0xf1e1c4	0x424	empty			0
RT_STRING	0xf1e5e8	0x4c0	empty			0
RT_STRING	0xf1eaa8	0x2a0	empty			0
RT_STRING	0xf1ed48	0x11c	empty			0
RT_STRING	0xf1ee64	0x170	empty			0
RT_STRING	0xf1efd4	0x44c	empty			0
RT_STRING	0xf1f420	0x238	empty			0
RT_STRING	0xf1f658	0x3a0	empty			0
RT_STRING	0xf1f9f8	0x414	empty			0
RT_STRING	0xf1fe0c	0x164	empty			0
RT_STRING	0xf1ff70	0x14c	empty			0
RT_STRING	0xf200bc	0x374	empty			0
RT_STRING	0xf20430	0x41c	empty			0
RT_STRING	0xf2084c	0x1d4	empty			0
RT_STRING	0xf20a20	0x520	empty			0
RT_STRING	0xf20f40	0x2e4	empty			0
RT_STRING	0xf21224	0x270	empty			0
RT_STRING	0xf21494	0x430	empty			0
RT_STRING	0xf218c4	0x2b0	empty			0
RT_STRING	0xf21b74	0x1ac	empty			0
RT_STRING	0xf21d20	0x178	empty			0
RT_STRING	0xf21e98	0x280	empty			0
RT_STRING	0xf22118	0x2e8	empty			0
RT_STRING	0xf22400	0x5dc	empty			0
RT_STRING	0xf229dc	0x3d4	empty			0
RT_STRING	0xf22db0	0x2dc	empty			0
RT_STRING	0xf2308c	0x484	empty			0
RT_STRING	0xf23510	0x538	empty			0
RT_STRING	0xf23a48	0x454	empty			0
RT_STRING	0xf23e9c	0x4f8	empty			0
RT_STRING	0xf24394	0x600	empty			0
RT_STRING	0xf24994	0x4e0	empty			0
RT_STRING	0xf24e74	0x458	empty			0
RT_STRING	0xf252cc	0x554	empty			0
RT_STRING	0xf25820	0x460	empty			0
RT_STRING	0xf25c80	0x904	empty			0
RT_STRING	0xf26584	0x448	empty			0
RT_STRING	0xf269cc	0x2fc	empty			0
RT_STRING	0xf26cc8	0x2bc	empty			0
RT_STRING	0xf26f84	0x498	empty			0
RT_STRING	0xf2741c	0x27c	empty			0
RT_STRING	0xf27698	0x204	empty			0
RT_STRING	0xf2789c	0x138	empty			0
RT_STRING	0xf279d4	0x134	empty			0
RT_STRING	0xf27b08	0x1f8	empty			0
RT_STRING	0xf27d00	0x40c	empty			0
RT_STRING	0xf2810c	0x818	empty			0
RT_STRING	0xf28924	0x8d4	empty			0
RT_STRING	0xf291f8	0x7bc	empty			0
RT_STRING	0xf299b4	0x988	empty			0
RT_STRING	0xf2a33c	0xa08	empty			0
RT_STRING	0xf2ad44	0x40c	empty			0
RT_STRING	0xf2b150	0x164	empty			0
RT_STRING	0xf2b2b4	0x174	empty			0
RT_STRING	0xf2b428	0x144	empty			0
RT_STRING	0xf2b56c	0x138	empty			0
RT_STRING	0xf2b6a4	0x33c	empty			0
RT_STRING	0xf2b9e0	0x318	empty			0
RT_STRING	0xf2bcf8	0x524	empty			0
RT_STRING	0xf2c21c	0x97c	empty			0
RT_STRING	0xf2cb98	0x3d8	empty			0
RT_STRING	0xf2cf70	0x36c	empty			0
RT_STRING	0xf2d2dc	0x494	empty			0
RT_STRING	0xf2d770	0x2ec	empty			0
RT_STRING	0xf2da5c	0x2a0	empty			0
RT_STRING	0xf2dcfc	0x2e8	empty			0
RT_STRING	0xf2dfe4	0x28c	empty			0
RT_STRING	0xf2e270	0x348	empty			0
RT_STRING	0xf2e5b8	0x3bc	empty			0
RT_STRING	0xf2e974	0x444	empty			0
RT_STRING	0xf2edb8	0x2bc	empty			0
RT_STRING	0xf2f074	0x2bc	empty			0
RT_STRING	0xf2f330	0x2e4	empty			0
RT_STRING	0xf2f614	0x368	empty			0
RT_STRING	0xf2f97c	0x2e0	empty			0
RT_STRING	0xf2fc5c	0x2ec	empty			0
RT_STRING	0xf2ff48	0x26c	empty			0
RT_STRING	0xf301b4	0x300	empty			0
RT_STRING	0xf304b4	0x21c	empty			0
RT_STRING	0xf306d0	0x268	empty			0
RT_STRING	0xf30938	0x2b0	empty			0
RT_STRING	0xf30be8	0x270	empty			0
RT_STRING	0xf30e58	0x484	empty			0
RT_STRING	0xf312dc	0x2e0	empty			0
RT_STRING	0xf315bc	0x360	empty			0
RT_STRING	0xf3191c	0x26c	empty			0
RT_STRING	0xf31b88	0x2d4	empty			0
RT_STRING	0xf31e5c	0x2e4	empty			0
RT_STRING	0xf32140	0x220	empty			0
RT_STRING	0xf32360	0x2f8	empty			0
RT_STRING	0xf32658	0x5c4	empty			0
RT_STRING	0xf32c1c	0x4f0	empty			0
RT_STRING	0xf3310c	0x5f0	empty			0
RT_STRING	0xf336fc	0x2c4	empty			0
RT_STRING	0xf339c0	0x1a8	empty			0
RT_STRING	0xf33b68	0x1ac	empty			0
RT_STRING	0xf33d14	0x1dc	empty			0
RT_STRING	0xf33ef0	0x248	empty			0
RT_STRING	0xf34138	0x1a4	empty			0
RT_STRING	0xf342dc	0x17c	empty			0
RT_STRING	0xf34458	0x140	empty			0
RT_STRING	0xf34598	0x180	empty			0
RT_STRING	0xf34718	0x158	empty			0
RT_STRING	0xf34870	0x158	empty			0
RT_STRING	0xf349c8	0x134	empty			0
RT_STRING	0xf34afc	0x14c	empty			0
RT_STRING	0xf34c48	0x118	empty			0
RT_STRING	0xf34d60	0x208	empty			0
RT_STRING	0xf34f68	0x340	empty			0
RT_STRING	0xf352a8	0x3c0	empty			0
RT_STRING	0xf35668	0x3a4	empty			0
RT_STRING	0xf35a0c	0x32c	empty			0
RT_STRING	0xf35d38	0x414	empty			0
RT_STRING	0xf3614c	0x2d0	empty			0
RT_STRING	0xf3641c	0x4ec	empty			0
RT_STRING	0xf36908	0x570	empty			0
RT_STRING	0xf36e78	0x5a4	empty			0
RT_STRING	0xf3741c	0x5dc	empty			0
RT_STRING	0xf379f8	0x378	empty			0
RT_STRING	0xf37d70	0x488	empty			0
RT_STRING	0xf381f8	0x464	empty			0
RT_STRING	0xf3865c	0x4d4	empty			0
RT_STRING	0xf38b30	0x598	empty			0
RT_STRING	0xf390c8	0x434	empty			0
RT_STRING	0xf394fc	0x408	empty			0
RT_STRING	0xf39904	0x1e0	empty			0
RT_STRING	0xf39ae4	0x198	empty			0
RT_STRING	0xf39c7c	0x158	empty			0
RT_STRING	0xf39dd4	0x444	empty			0
RT_STRING	0xf3a218	0x1c4	empty			0
RT_STRING	0xf3a3dc	0xe8	empty			0
RT_STRING	0xf3a4c4	0x2d8	empty			0
RT_STRING	0xf3a79c	0x270	empty			0
RT_STRING	0xf3aa0c	0x370	empty			0
RT_STRING	0xf3ad7c	0x410	empty			0
RT_STRING	0xf3b18c	0x3cc	empty			0
RT_STRING	0xf3b558	0x270	empty			0
RT_STRING	0xf3b7c8	0x1fc	empty			0
RT_STRING	0xf3b9c4	0xf0	empty			0
RT_STRING	0xf3bab4	0xc0	empty			0
RT_STRING	0xf3bb74	0x318	empty			0
RT_STRING	0xf3be8c	0x4fc	empty			0
RT_STRING	0xf3c388	0x330	empty			0
RT_STRING	0xf3c6b8	0x2a0	empty			0
RT_STRING	0xf3c958	0x3fc	empty			0
RT_STRING	0xf3cd54	0x358	empty			0
RT_STRING	0xf3d0ac	0x3c0	empty			0
RT_STRING	0xf3d46c	0x478	empty			0
RT_RCDATA	0xf3d8e4	0x10	empty			0
RT_RCDATA	0xf3d8f4	0x3ab8	empty			0
RT_RCDATA	0xf413ac	0x1a60	empty			0
RT_RCDATA	0xf42e0c	0xf6	empty			0
RT_RCDATA	0xf42f04	0xf6	empty			0
RT_RCDATA	0xf42ffc	0xf6	empty			0
RT_RCDATA	0xf430f4	0x23c	empty			0
RT_RCDATA	0xf43330	0xf6	empty			0
RT_RCDATA	0xf43428	0xf6	empty			0
RT_RCDATA	0xf43520	0xf8	empty			0
RT_RCDATA	0xf43618	0x2d9	empty			0
RT_RCDATA	0xf438f4	0x14	empty	Spanish	Argentina	0
RT_RCDATA	0xf43908	0x79	empty			0
RT_RCDATA	0xf43984	0x227	empty			0
RT_RCDATA	0xf43bac	0xc5	empty			0
RT_RCDATA	0xf43c74	0x8b	empty			0
RT_RCDATA	0xf43d00	0x7b17	empty			0
RT_RCDATA	0xf4b818	0x275d	empty			0
RT_RCDATA	0xf4df78	0x488a	empty			0
RT_RCDATA	0xf52804	0x139b	empty			0
RT_RCDATA	0xf53ba0	0x4f38	empty			0
RT_RCDATA	0xf58ad8	0x3d0e	empty			0
RT_RCDATA	0xf5c7e8	0x12c0	empty			0
RT_RCDATA	0xf5daa8	0x1dd1	empty			0
RT_RCDATA	0xf5f87c	0x2292	empty			0
RT_RCDATA	0xf61b10	0xc3	empty			0
RT_RCDATA	0xf61bd4	0x7f	empty			0
RT_RCDATA	0xf61c54	0x1c23	empty			0
RT_RCDATA	0xf63878	0x2ad1	empty			0
RT_RCDATA	0xf6634c	0x6aa4	empty			0
RT_RCDATA	0xf6cdf0	0x5b	empty			0
RT_RCDATA	0xf6ce4c	0x115	empty			0
RT_RCDATA	0xf6cf64	0x42	empty			0
RT_RCDATA	0xf6cfa8	0x3e	empty			0
RT_RCDATA	0xf6cfe8	0x40	empty			0
RT_RCDATA	0xf6d028	0x40	empty			0
RT_RCDATA	0xf6d068	0xb4	empty			0
RT_RCDATA	0xf6d11c	0xb2	empty			0
RT_RCDATA	0xf6d1d0	0x88	empty			0
RT_RCDATA	0xf6d258	0x57	empty			0
RT_RCDATA	0xf6d2b0	0x6a	empty			0
RT_RCDATA	0xf6d31c	0xb0	empty			0
RT_RCDATA	0xf6d3cc	0x5b	empty			0
RT_RCDATA	0xf6d428	0x46	empty			0
RT_RCDATA	0xf6d470	0x41	empty			0
RT_RCDATA	0xf6d4b4	0x4f	empty			0
RT_RCDATA	0xf6d504	0xa6	empty			0
RT_RCDATA	0xf6d5ac	0x42	empty			0
RT_RCDATA	0xf6d5f0	0x79	empty			0
RT_RCDATA	0xf6d66c	0x52	empty			0
RT_RCDATA	0xf6d6c0	0x55	empty			0
RT_RCDATA	0xf6d718	0x5e	empty			0
RT_RCDATA	0xf6d778	0x124	empty			0
RT_RCDATA	0xf6d89c	0x45	empty			0
RT_RCDATA	0xf6d8e4	0x76	empty			0
RT_RCDATA	0xf6d95c	0x3a	empty			0
RT_RCDATA	0xf6d998	0x1e10	empty			0
RT_RCDATA	0xf6f7a8	0x46	empty			0
RT_RCDATA	0xf6f7f0	0x36	empty			0
RT_RCDATA	0xf6f828	0x1d61	empty			0
RT_RCDATA	0xf7158c	0x1018	empty			0
RT_RCDATA	0xf725a4	0x57	empty			0
RT_RCDATA	0xf725fc	0x229	empty			0
RT_RCDATA	0xf72828	0x3f85	empty			0
RT_RCDATA	0xf767b0	0x716e	empty			0
RT_RCDATA	0xf7d920	0x1b5a	empty			0
RT_RCDATA	0xf7f47c	0x1b87	empty			0
RT_RCDATA	0xf81004	0x3ac2	empty			0
RT_RCDATA	0xf84ac8	0x3c60	empty			0
RT_RCDATA	0xf88728	0x5879	empty			0
RT_RCDATA	0xf8dfa4	0x3f64	empty			0
RT_RCDATA	0xf91f08	0x1a5	empty			0
RT_RCDATA	0xf920b0	0x1332	empty			0
RT_RCDATA	0xf933e4	0x49f3	empty			0
RT_RCDATA	0xf97dd8	0x130	empty			0
RT_RCDATA	0xf97f08	0x1450	empty			0
RT_RCDATA	0xf99358	0x1334	empty			0
RT_RCDATA	0xf9a68c	0x5389	empty			0
RT_RCDATA	0xf9fa18	0x294b	empty			0
RT_RCDATA	0xfa2364	0x219d	empty			0
RT_RCDATA	0xfa4504	0xc3c	empty			0
RT_RCDATA	0xfa5140	0x848	empty			0
RT_RCDATA	0xfa5988	0x2425	empty			0
RT_RCDATA	0xfa7db0	0x5c98	empty			0
RT_RCDATA	0xfada48	0x4a9e	empty			0
RT_RCDATA	0xfb24e8	0x252e	empty			0
RT_RCDATA	0xfb4a18	0x682	empty			0
RT_RCDATA	0xfb509c	0x703	empty			0
RT_RCDATA	0xfb57a0	0x4bf	empty			0
RT_RCDATA	0xfb5c60	0x620	empty			0
RT_RCDATA	0xfb6280	0x5f6	empty			0
RT_RCDATA	0xfb6878	0x3ef	empty			0
RT_RCDATA	0xfb6c68	0x646	empty			0
RT_RCDATA	0xfb72b0	0x1fee	empty			0
RT_RCDATA	0xfb92a0	0x1ffc	empty			0
RT_RCDATA	0xfbb29c	0x2cb9	empty			0
RT_RCDATA	0xfbdf58	0x4a3d	empty			0
RT_RCDATA	0xfc2998	0x6d23	empty			0
RT_RCDATA	0xfc96bc	0x2711	empty			0
RT_RCDATA	0xfcbdd0	0x93a8	empty			0
RT_RCDATA	0xfd5178	0x2304	empty			0
RT_RCDATA	0xfd747c	0x67a3	empty			0
RT_RCDATA	0xfddc20	0x5a70	empty			0
RT_RCDATA	0xfe3690	0x25c8	empty			0
RT_RCDATA	0xfe5c58	0x2309	empty			0
RT_RCDATA	0xfe7f64	0x2a57	empty			0
RT_RCDATA	0xfea9bc	0x238	empty			0
RT_RCDATA	0xfeabf4	0xe09	empty			0
RT_RCDATA	0xfeba00	0x1f68	empty			0
RT_RCDATA	0xfed968	0xb5c1	empty			0
RT_RCDATA	0xff8f2c	0x3550	empty			0
RT_RCDATA	0xffc47c	0x3359	empty			0
RT_RCDATA	0xfff7d8	0x2d24	empty			0
RT_RCDATA	0x10024fc	0x301f	empty			0
RT_RCDATA	0x100551c	0x25dd	empty			0
RT_RCDATA	0x1007afc	0x5b0d	empty			0
RT_RCDATA	0x100d60c	0x4eb3	empty			0
RT_RCDATA	0x10124c0	0x5823	empty			0
RT_RCDATA	0x1017ce4	0x1e52	empty			0
RT_RCDATA	0x1019b38	0x1a9d	empty			0
RT_RCDATA	0x101b5d8	0x75a2	empty			0
RT_RCDATA	0x1022b7c	0x3d8f	empty			0
RT_RCDATA	0x102690c	0x81c7	empty			0
RT_RCDATA	0x102ead4	0x7196	empty			0
RT_RCDATA	0x1035c6c	0xc067	empty			0
RT_RCDATA	0x1041cd4	0x6b5b	empty			0
RT_RCDATA	0x1048830	0x7c45	empty			0
RT_RCDATA	0x1050478	0x1c5	empty			0
RT_RCDATA	0x1050640	0x45cf	empty			0
RT_RCDATA	0x1054c10	0x4f9	empty			0
RT_RCDATA	0x105510c	0x46bd	empty			0
RT_RCDATA	0x10597cc	0x8c9	empty			0
RT_RCDATA	0x105a098	0x6b4b	empty			0
RT_RCDATA	0x1060be4	0x13e8	empty			0
RT_RCDATA	0x1061fcc	0x20e4	empty			0
RT_RCDATA	0x10640b0	0x2fe0	empty			0
RT_RCDATA	0x1067090	0x7b4	empty			0
RT_RCDATA	0x1067844	0x1a58	empty			0
RT_RCDATA	0x106929c	0x3d65	empty			0
RT_RCDATA	0x106d004	0x28b8	empty			0
RT_RCDATA	0x106f8bc	0x2bd9	empty			0
RT_RCDATA	0x1072498	0x48e4	empty			0
RT_RCDATA	0x1076d7c	0x1d2b	empty			0
RT_RCDATA	0x1078aa8	0x3387	empty			0
RT_RCDATA	0x107be30	0x333b	empty			0
RT_RCDATA	0x107f16c	0x49d6	empty			0
RT_RCDATA	0x1083b44	0x1ff0	empty			0
RT_RCDATA	0x1085b34	0x431	empty			0
RT_RCDATA	0x1085f68	0x29be	empty			0
RT_RCDATA	0x1088928	0x96	empty			0
RT_RCDATA	0x10889c0	0x1c64	empty			0
RT_RCDATA	0x108a624	0xbe2b	empty			0
RT_RCDATA	0x1096450	0x3dcf	empty			0
RT_RCDATA	0x109a220	0x14eb2	empty			0
RT_RCDATA	0x10af0d4	0x7533	empty			0
RT_RCDATA	0x10b6608	0x1c4e	empty			0
RT_RCDATA	0x10b8258	0x16bc	empty			0
RT_RCDATA	0x10b9914	0x1c59	empty			0
RT_RCDATA	0x10bb570	0x5e36	empty			0
RT_RCDATA	0x10c13a8	0x8dee	empty			0
RT_RCDATA	0x10ca198	0x1b80	empty			0
RT_RCDATA	0x10cbd18	0x47d6	empty			0
RT_RCDATA	0x10d04f0	0xab6a	empty			0
RT_RCDATA	0x10db05c	0x49b1	empty			0
RT_RCDATA	0x10dfa10	0x3418	empty			0
RT_RCDATA	0x10e2e28	0x4f17	empty			0
RT_RCDATA	0x10e7d40	0x761	empty			0
RT_RCDATA	0x10e84a4	0x37e5	empty			0
RT_RCDATA	0x10ebc8c	0x2295	empty			0
RT_RCDATA	0x10edf24	0x2548	empty			0
RT_RCDATA	0x10f046c	0x1add	empty			0
RT_RCDATA	0x10f1f4c	0x3698	empty			0
RT_RCDATA	0x10f55e4	0x826d	empty			0
RT_RCDATA	0x10fd854	0x1bb	empty			0
RT_RCDATA	0x10fda10	0x64a	empty			0
RT_RCDATA	0x10fe05c	0x5df0	empty			0
RT_RCDATA	0x1103e4c	0x251f	empty			0
RT_RCDATA	0x110636c	0x12f3	empty			0
RT_RCDATA	0x1107660	0xaf3	empty			0
RT_RCDATA	0x1108154	0xdd0	empty			0
RT_RCDATA	0x1108f24	0xb175	empty			0
RT_RCDATA	0x111409c	0x20b7	empty			0
RT_RCDATA	0x1116154	0x96a	empty			0
RT_RCDATA	0x1116ac0	0xf36	empty			0
RT_RCDATA	0x11179f8	0x13de	empty			0
RT_RCDATA	0x1118dd8	0xefa	empty			0
RT_RCDATA	0x1119cd4	0x4208	empty			0
RT_RCDATA	0x111dedc	0x2dce	empty			0
RT_RCDATA	0x1120cac	0x183e	empty			0
RT_RCDATA	0x11224ec	0x5b4	empty			0
RT_RCDATA	0x1122aa0	0x1b7c	empty			0
RT_RCDATA	0x112461c	0x669	empty			0
RT_RCDATA	0x1124c88	0x1024	empty			0
RT_RCDATA	0x1125cac	0xe20	empty			0
RT_RCDATA	0x1126acc	0x1add	empty			0
RT_RCDATA	0x11285ac	0xe2ec	empty			0
RT_RCDATA	0x1136898	0x2ffd	empty			0
RT_RCDATA	0x1139898	0xf7c	empty			0
RT_RCDATA	0x113a814	0x2276	empty			0
RT_RCDATA	0x113ca8c	0x1c08	empty			0
RT_RCDATA	0x113e694	0x307a	empty			0
RT_RCDATA	0x1141710	0x12e2	empty			0
RT_RCDATA	0x11429f4	0x14219	empty			0
RT_RCDATA	0x1156c10	0x16eb	empty			0
RT_RCDATA	0x11582fc	0x55d9	empty			0
RT_RCDATA	0x115d8d8	0x3bb0	empty			0
RT_RCDATA	0x1161488	0x3601	empty			0
RT_RCDATA	0x1164a8c	0x3cbe	empty			0
RT_RCDATA	0x116874c	0xe02	empty			0
RT_RCDATA	0x1169550	0x5d27	empty			0
RT_RCDATA	0x116f278	0x13ba7	empty			0
RT_RCDATA	0x1182e20	0x45aa	empty			0
RT_RCDATA	0x11873cc	0x64cc	empty			0
RT_RCDATA	0x118d898	0x2257	empty			0
RT_RCDATA	0x118faf0	0xf5a	empty			0
RT_RCDATA	0x1190a4c	0xe5f	empty			0
RT_RCDATA	0x11918ac	0x3c9	empty			0
RT_RCDATA	0x1191c78	0x42e1	empty			0
RT_RCDATA	0x1195f5c	0x42e5	empty			0
RT_RCDATA	0x119a244	0x2ee4	empty			0
RT_RCDATA	0x119d128	0x1f36	empty			0
RT_RCDATA	0x119f060	0x2113	empty			0
RT_RCDATA	0x11a1174	0x1cee	empty			0
RT_RCDATA	0x11a2e64	0x651	empty			0
RT_RCDATA	0x11a34b8	0x7a	empty			0
RT_RCDATA	0x11a3534	0x9623d	empty			0
RT_RCDATA	0x1239774	0x11b	empty			0
RT_RCDATA	0x1239890	0x230a7	empty			0
RT_RCDATA	0x125c938	0x12f72	empty			0
RT_RCDATA	0x126f8ac	0x101cf	empty			0
RT_RCDATA	0x127fa7c	0x7d3c	empty			0
RT_RCDATA	0x12877b8	0x21ef	empty			0
RT_RCDATA	0x12899a8	0x1d95	empty			0
RT_RCDATA	0x128b740	0xd24	empty			0
RT_RCDATA	0x128c464	0x737	empty			0
RT_RCDATA	0x128cb9c	0x424d	empty			0
RT_RCDATA	0x1290dec	0x3232	empty			0
RT_RCDATA	0x1294020	0x3031	empty			0
RT_RCDATA	0x1297054	0xaee1	empty			0
RT_RCDATA	0x12a1f38	0x273bc	empty			0
RT_RCDATA	0x12c92f4	0xd7c	empty			0
RT_RCDATA	0x12ca070	0x81f5	empty			0
RT_RCDATA	0x12d2268	0x1ab8	empty			0
RT_RCDATA	0x12d3d20	0x12f0	empty			0
RT_RCDATA	0x12d5010	0x2ba9	empty			0
RT_RCDATA	0x12d7bbc	0x620	empty			0
RT_RCDATA	0x12d81dc	0x26c	empty			0
RT_RCDATA	0x12d8448	0x221d	empty			0
RT_RCDATA	0x12da668	0x97e	empty			0
RT_RCDATA	0x12dafe8	0x110f	empty			0
RT_RCDATA	0x12dc0f8	0x753c	empty			0
RT_RCDATA	0x12e3634	0x471e	empty			0
RT_RCDATA	0x12e7d54	0x2488	empty			0
RT_RCDATA	0x12ea1dc	0x3234	empty			0
RT_RCDATA	0x12ed410	0x74d	empty			0
RT_RCDATA	0x12edb60	0x3fb4	empty			0
RT_RCDATA	0x12f1b14	0x2b46	empty			0
RT_RCDATA	0x12f465c	0x1d6b	empty			0
RT_RCDATA	0x12f63c8	0x121e	empty			0
RT_RCDATA	0x12f75e8	0xc35	empty			0
RT_RCDATA	0x12f8220	0x18176	empty			0
RT_RCDATA	0x1310398	0x1048	empty			0
RT_RCDATA	0x13113e0	0x2da	empty			0
RT_RCDATA	0x13116bc	0x3bf6	empty			0
RT_RCDATA	0x13152b4	0x535	empty			0
RT_RCDATA	0x13157ec	0x5209	empty			0
RT_RCDATA	0x131a9f8	0x147b	empty			0
RT_RCDATA	0x131be74	0x7051	empty			0
RT_RCDATA	0x1322ec8	0x7c5c	empty			0
RT_RCDATA	0x132ab24	0x79c5	empty			0
RT_RCDATA	0x13324ec	0x8cbc	empty			0
RT_RCDATA	0x133b1a8	0x47c7	empty			0
RT_RCDATA	0x133f970	0x34b6	empty			0
RT_RCDATA	0x1342e28	0x408	empty			0
RT_RCDATA	0x1343230	0x6b3	empty			0
RT_RCDATA	0x13438e4	0x1186	empty			0
RT_RCDATA	0x1344a6c	0xe35	empty			0
RT_RCDATA	0x13458a4	0x1d22	empty			0
RT_RCDATA	0x13475c8	0x829	empty			0
RT_RCDATA	0x1347df4	0x1388	empty			0
RT_RCDATA	0x134917c	0x3914	empty			0
RT_RCDATA	0x134ca90	0xc23	empty			0
RT_RCDATA	0x134d6b4	0xfd9	empty			0
RT_RCDATA	0x134e690	0x17e	empty			0
RT_RCDATA	0x134e810	0xa65	empty			0
RT_RCDATA	0x134f278	0x191a	empty			0
RT_RCDATA	0x1350b94	0x1881	empty			0
RT_RCDATA	0x1352418	0x8a7	empty			0
RT_RCDATA	0x1352cc0	0xec2	empty			0
RT_RCDATA	0x1353b84	0xc2d	empty			0
RT_RCDATA	0x13547b4	0xbe1	empty			0
RT_RCDATA	0x1355398	0x31b	empty			0
RT_RCDATA	0x13556b4	0x7d2e	empty			0
RT_RCDATA	0x135d3e4	0x11e78	empty			0
RT_RCDATA	0x136f25c	0x615f	empty			0
RT_RCDATA	0x13753bc	0x2b20	empty			0
RT_RCDATA	0x1377edc	0x78c	empty			0
RT_RCDATA	0x1378668	0x15bf	empty			0
RT_RCDATA	0x1379c28	0x16a4	empty			0
RT_RCDATA	0x137b2cc	0xd25	empty			0
RT_RCDATA	0x137bff4	0x6c7	empty			0
RT_RCDATA	0x137c6bc	0x2a44	empty			0
RT_RCDATA	0x137f100	0x502d	empty			0
RT_RCDATA	0x1384130	0x4a19	empty			0
RT_RCDATA	0x1388b4c	0x248e	empty			0
RT_RCDATA	0x138afdc	0xcf47	empty			0
RT_RCDATA	0x1397f24	0xccbe	empty			0
RT_RCDATA	0x13a4be4	0x2875	empty			0
RT_RCDATA	0x13a745c	0x2f0a	empty			0
RT_RCDATA	0x13aa368	0xf865	empty			0
RT_RCDATA	0x13b9bd0	0x4454	empty			0
RT_RCDATA	0x13be024	0xb29d	empty			0
RT_RCDATA	0x13c92c4	0x23b4	empty			0
RT_RCDATA	0x13cb678	0x318d	empty			0
RT_RCDATA	0x13ce808	0x30df	empty			0
RT_RCDATA	0x13d18e8	0x36a8	empty			0
RT_RCDATA	0x13d4f90	0x251b5	empty			0
RT_RCDATA	0x13fa148	0x23e2	empty			0
RT_RCDATA	0x13fc52c	0x87b7	empty			0
RT_RCDATA	0x1404ce4	0x44b3	empty			0
RT_RCDATA	0x1409198	0x665c	empty			0
RT_RCDATA	0x140f7f4	0x1510	empty			0
RT_RCDATA	0x1410d04	0x7562	empty			0
RT_RCDATA	0x1418268	0xb7	empty			0
RT_RCDATA	0x1418320	0x4ca	empty			0
RT_RCDATA	0x14187ec	0xc16	empty			0
RT_RCDATA	0x1419404	0x12e9	empty			0
RT_RCDATA	0x141a6f0	0xde1	empty			0
RT_RCDATA	0x141b4d4	0x3e2a	empty			0
RT_RCDATA	0x141f300	0x2825	empty			0
RT_RCDATA	0x1421b28	0xa7c	empty			0
RT_RCDATA	0x14225a4	0x2854	empty			0
RT_RCDATA	0x1424df8	0x25e	empty			0
RT_RCDATA	0x1425058	0x2902	empty			0
RT_RCDATA	0x142795c	0x1595	empty			0
RT_RCDATA	0x1428ef4	0x40	empty			0
RT_RCDATA	0x1428f34	0x46	empty			0
RT_RCDATA	0x1428f7c	0x12d1	empty			0
RT_RCDATA	0x142a250	0x1499	empty			0
RT_RCDATA	0x142b6ec	0x3aeb	empty			0
RT_RCDATA	0x142f1d8	0x3cdc	empty			0
RT_RCDATA	0x1432eb4	0x60f	empty			0
RT_RCDATA	0x14334c4	0x1d04	empty			0
RT_RCDATA	0x14351c8	0x3f81	empty			0
RT_RCDATA	0x143914c	0x3a17	empty			0
RT_RCDATA	0x143cb64	0x14bd	empty			0
RT_RCDATA	0x143e024	0x3dea	empty			0
RT_RCDATA	0x1441e10	0x3182	empty			0
RT_RCDATA	0x1444f94	0x5818	empty			0
RT_RCDATA	0x144a7ac	0x3c27	empty			0
RT_RCDATA	0x144e3d4	0x679e	empty			0
RT_RCDATA	0x1454b74	0x2bac	empty			0
RT_RCDATA	0x1457720	0x315c	empty			0
RT_RCDATA	0x145a87c	0xcb9d	empty			0
RT_RCDATA	0x146741c	0x3596	empty			0
RT_RCDATA	0x146a9b4	0xac8	empty			0
RT_RCDATA	0x146b47c	0x74d4	empty			0
RT_RCDATA	0x1472950	0x19776	empty			0
RT_RCDATA	0x148c0c8	0x1d95	empty			0
RT_RCDATA	0x148de60	0x2ee	empty			0
RT_RCDATA	0x148e150	0x144	empty			0
RT_RCDATA	0x148e294	0x11410	empty			0
RT_RCDATA	0x149f6a4	0x43f8	empty			0
RT_RCDATA	0x14a3a9c	0x1dd8	empty			0
RT_RCDATA	0x14a5874	0xf244	empty			0
RT_RCDATA	0x14b4ab8	0x2fd0	empty			0
RT_RCDATA	0x14b7a88	0x2457	empty			0
RT_RCDATA	0x14b9ee0	0x7e2f	empty			0
RT_RCDATA	0x14c1d10	0x1e68	empty			0
RT_RCDATA	0x14c3b78	0x53a6	empty			0
RT_RCDATA	0x14c8f20	0x34d8	empty			0
RT_RCDATA	0x14cc3f8	0x223f	empty			0
RT_RCDATA	0x14ce638	0x609c	empty			0
RT_RCDATA	0x14d46d4	0x7e8e	empty			0
RT_RCDATA	0x14dc564	0x3cb1	empty			0
RT_RCDATA	0x14e0218	0x36e7	empty			0
RT_RCDATA	0x14e3900	0x1756a	empty			0
RT_RCDATA	0x14fae6c	0xb504	empty			0
RT_RCDATA	0x1506370	0x494	empty			0
RT_RCDATA	0x1506804	0x68154	empty			0
RT_RCDATA	0x156e958	0x3408	empty			0
RT_RCDATA	0x1571d60	0xc1	empty			0
RT_RCDATA	0x1571e24	0x10c	empty			0
RT_RCDATA	0x1571f30	0x105	empty			0
RT_RCDATA	0x1572038	0xd7	empty			0
RT_RCDATA	0x1572110	0xb4	empty			0
RT_RCDATA	0x15721c4	0x3d0	empty			0
RT_RCDATA	0x1572594	0x88	empty			0
RT_RCDATA	0x157261c	0xa7	empty			0
RT_RCDATA	0x15726c4	0x9b	empty			0
RT_RCDATA	0x1572760	0x95	empty			0
RT_RCDATA	0x15727f8	0xe0	empty			0
RT_RCDATA	0x15728d8	0x110	empty			0
RT_RCDATA	0x15729e8	0xd5	empty			0
RT_RCDATA	0x1572ac0	0xe9	empty			0
RT_RCDATA	0x1572bac	0xa6a	empty			0
RT_RCDATA	0x1573618	0x131f	empty			0
RT_RCDATA	0x1574938	0x7c	empty			0
RT_RCDATA	0x15749b4	0x89	empty			0
RT_RCDATA	0x1574a40	0x9d	empty			0
RT_RCDATA	0x1574ae0	0x151	empty			0
RT_RCDATA	0x1574c34	0xa3	empty			0
RT_RCDATA	0x1574cd8	0x24c	empty			0
RT_RCDATA	0x1574f24	0x15a	empty			0
RT_RCDATA	0x1575080	0xf8	empty			0
RT_RCDATA	0x1575178	0x83	empty			0
RT_RCDATA	0x15751fc	0x96	empty			0
RT_RCDATA	0x1575294	0xb5	empty			0
RT_RCDATA	0x157534c	0xc843	empty			0
RT_RCDATA	0x1581b90	0x749	empty			0
RT_RCDATA	0x15822dc	0x74	empty			0
RT_RCDATA	0x1582350	0x103dcc	empty			0
RT_RCDATA	0x168611c	0x7cc	empty			0
RT_RCDATA	0x16868e8	0x9d3d	empty			0
RT_RCDATA	0x1690628	0x69b6	empty			0
RT_RCDATA	0x1696fe0	0x6592	empty			0
RT_RCDATA	0x169d574	0x550a	empty			0
RT_RCDATA	0x16a2a80	0x6d56	empty			0
RT_RCDATA	0x16a97d8	0x6062	empty			0
RT_RCDATA	0x16af83c	0x4b43	empty			0
RT_RCDATA	0x16b4380	0x130c	empty			0
RT_RCDATA	0x16b568c	0x3a9f	empty			0
RT_RCDATA	0x16b912c	0x44e7	empty			0
RT_RCDATA	0x16bd614	0x66673	empty			0
RT_RCDATA	0x1723c88	0x985	empty			0
RT_RCDATA	0x1724610	0x3ef7	empty			0
RT_RCDATA	0x1728508	0x1565b	empty			0
RT_RCDATA	0x173db64	0x3720	empty			0
RT_RCDATA	0x1741284	0x22cd	empty			0
RT_RCDATA	0x1743554	0x3c4	empty			0
RT_RCDATA	0x1743918	0x5f7	empty			0
RT_RCDATA	0x1743f10	0x2187	empty			0
RT_RCDATA	0x1746098	0x576b	empty			0
RT_RCDATA	0x174b804	0x649e	empty			0
RT_RCDATA	0x1751ca4	0x56ab	empty			0
RT_RCDATA	0x1757350	0x5249	empty			0
RT_RCDATA	0x175c59c	0x17f2	empty			0
RT_RCDATA	0x175dd90	0x7790	empty			0
RT_RCDATA	0x1765520	0x559a	empty			0
RT_RCDATA	0x176aabc	0x1ad4	empty			0
RT_RCDATA	0x176c590	0x391e	empty			0
RT_RCDATA	0x176feb0	0x7d3	empty			0
RT_RCDATA	0x1770684	0x66c	empty			0
RT_RCDATA	0x1770cf0	0x1b23	empty			0
RT_RCDATA	0x1772814	0x562	empty			0
RT_RCDATA	0x1772d78	0x4ebd	empty			0
RT_RCDATA	0x1777c38	0x1dc	empty			0
RT_RCDATA	0x1777e14	0x3eb5	empty			0
RT_RCDATA	0x177bccc	0x6a94	empty			0
RT_RCDATA	0x1782760	0x3d2b	empty			0
RT_RCDATA	0x178648c	0x5780	empty			0
RT_RCDATA	0x178bc0c	0x154c1	empty			0
RT_RCDATA	0x17a10d0	0x4634	empty			0
RT_RCDATA	0x17a5704	0x133b	empty			0
RT_RCDATA	0x17a6a40	0x36d	empty			0
RT_RCDATA	0x17a6db0	0x1be	empty			0
RT_RCDATA	0x17a6f70	0x5d28	empty			0
RT_RCDATA	0x17acc98	0xb6	empty			0
RT_RCDATA	0x17acd50	0x76f3	empty			0
RT_RCDATA	0x17b4444	0xda7a	empty			0
RT_RCDATA	0x17c1ec0	0xda8f	empty			0
RT_RCDATA	0x17cf950	0x4a65	empty			0
RT_RCDATA	0x17d43b8	0x3aa	empty			0
RT_RCDATA	0x17d4764	0x163a	empty			0
RT_RCDATA	0x17d5da0	0x8d8	empty			0
RT_RCDATA	0x17d6678	0x815	empty			0
RT_RCDATA	0x17d6e90	0x3bc	empty			0
RT_RCDATA	0x17d724c	0x144	empty			0
RT_RCDATA	0x17d7390	0x7a4b	empty			0
RT_RCDATA	0x17deddc	0xafa	empty			0
RT_RCDATA	0x17df8d8	0x46d	empty			0
RT_RCDATA	0x17dfd48	0x175	empty			0
RT_RCDATA	0x17dfec0	0x10d6	empty			0
RT_RCDATA	0x17e0f98	0x1093	empty			0
RT_RCDATA	0x17e202c	0x4970	empty			0
RT_RCDATA	0x17e699c	0x566	empty			0
RT_RCDATA	0x17e6f04	0x566	empty			0
RT_RCDATA	0x17e746c	0x566	empty			0
RT_RCDATA	0x17e79d4	0x1244	empty			0
RT_RCDATA	0x17e8c18	0x566	empty			0
RT_RCDATA	0x17e9180	0x566	empty			0
RT_RCDATA	0x17e96e8	0x588	empty			0
RT_GROUP_CURSOR	0x17e9c70	0x146	empty	Spanish	Argentina	0
RT_GROUP_CURSOR	0x17e9db8	0x14	empty	German	Germany	0
RT_GROUP_CURSOR	0x17e9dcc	0x14	empty	German	Germany	0
RT_GROUP_CURSOR	0x17e9de0	0x14	empty	Spanish	Argentina	0
RT_GROUP_CURSOR	0x17e9df4	0x14	empty	Spanish	Argentina	0
RT_GROUP_CURSOR	0x17e9e08	0x146	empty	Spanish	Argentina	0
RT_GROUP_CURSOR	0x17e9f50	0x14	empty			0
RT_GROUP_CURSOR	0x17e9f64	0x14	empty			0
RT_GROUP_CURSOR	0x17e9f78	0x146	empty	Spanish	Argentina	0
RT_GROUP_CURSOR	0x17ea0c0	0x14	empty	Spanish	Argentina	0
RT_GROUP_CURSOR	0x17ea0d4	0x14	empty			0
RT_GROUP_CURSOR	0x17ea0e8	0x14	empty			0
RT_GROUP_CURSOR	0x17ea0fc	0x14	empty			0
RT_GROUP_CURSOR	0x17ea110	0x14	empty			0
RT_GROUP_CURSOR	0x17ea124	0x14	empty			0
RT_GROUP_CURSOR	0x17ea138	0x14	empty			0
RT_GROUP_CURSOR	0x17ea14c	0x14	empty			0
RT_GROUP_CURSOR	0x17ea160	0x14	empty			0
RT_GROUP_ICON	0x17ec914	0x14	data	Spanish	Argentina	1.2
RT_VERSION	0x17ec59c	0x378	data	Spanish	Argentina	0.42680180180180183

Imports

DLL	Import
kernel32.dll	GetProcAddress, GetModuleHandleA, LoadLibraryA
user32.dll	GetKeyboardType
advapi32.dll	RegQueryValueExA
oleaut32.dll	SysFreeString
advapi32.dll	ReportEventA
mpr.dll	WNetGetConnectionA
version.dll	VerQueryValueA
gdi32.dll	WidenPath
user32.dll	CreateWindowExA
ole32.dll	CoTaskMemFree
oleaut32.dll	SafeArrayPtrOfIndex
ole32.dll	CreateStreamOnHGlobal
oleaut32.dll	CreateErrorInfo
wsock32.dll	WSACleanup
shell32.dll	Shell_NotifyIconA
gdi32.dll	TranslateCharsetInfo
comctl32.dll	ImageList_Destroy
comctl32.dll	ImageList_SetIconSize
shell32.dll	SHGetSpecialFolderLocation
comdlg32.dll	PageSetupDlgA
winspool.drv	OpenPrinterA
imm32.dll	ImmGetOpenStatus
oledlg.dll	OleUIObjectPropertiesA
user32.dll	DdeCmpStringHandles
winmm.dll	waveOutGetNumDevs
avicap32.dll	capGetDriverDescriptionA

Exports

Name	Ordinal	Address
EurekaLog_AttachedFilesRequestEvent	15	0x474f24
EurekaLog_CallCreateThread	2	0x48efb4
EurekaLog_CallExceptObject	5	0x48e734
EurekaLog_CallExitThread	4	0x48f0f8
EurekaLog_CallGeneralRaise	6	0x48e5b0
EurekaLog_CallResumeThread	3	0x48f054
EurekaLog_CustomButtonClickEvent	17	0x47506c
EurekaLog_CustomDataRequestEventEx	14	0x474e80
EurekaLog_CustomWebFieldsRequestEvent	16	0x474fc8
EurekaLog_ExceptionActionNotifyEvent	12	0x474d38
EurekaLog_ExceptionErrorNotifyEvent	13	0x474ddc
EurekaLog_ExceptionNotifyEvent	10	0x474bf0
EurekaLog_HandledExceptionNotifyEvent	11	0x474c94
EurekaLog_LastDelphiException	1	0x48efac
EurekaLog_PasswordRequestEvent	8	0x474adc
EurekaLog_PasswordRequestEventEx	9	0x474b20
ExceptionManager	7	0x4907b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
French	France
Spanish	Argentina
German	Germany
Russian	Russia
English	United States
Catalan	Spain

Target ID:	5
Start time:	11:26:39
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\Siopel.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Siopel.exe"
Imagebase:	0x400000
File size:	7'617'536 bytes
MD5 hash:	FDC8014D627B85EC211F282A696653B7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Function 00D33001 Relevance: 6.5, Strings: 5, Instructions: 243COMMON

Download Yara Rule

Strings

Negociacion.pdf, xrefs: 00D330F5
TRADE, xrefs: 00D330AD
Negociacion, xrefs: 00D33106
SIOPEL.INI, xrefs: 00D330D3
NEGOCIA.INI, xrefs: 00D330E4

Memory Dump Source

Source File: 00000005.00000002.2388217551.0000000000D33000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D33000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d33000_Siopel.jbxd

Similarity

API ID:
String ID: NEGOCIA.INI$Negociacion$Negociacion.pdf$SIOPEL.INI$TRADE
API String ID: 0-164315787
Opcode ID: 86dcb0bbca1fd214d6f700ad13560867e3c3b491d77628eac61c88390b591903
Instruction ID: 53963cc1ce23a28cd287c7e3e90808ae95562d4312078dc17bb8676d033eac89
Opcode Fuzzy Hash: 86dcb0bbca1fd214d6f700ad13560867e3c3b491d77628eac61c88390b591903
Instruction Fuzzy Hash: 4DB1B838744650DFD744EB18F8E5E2637A2FB9A30071081A5E6018B37ACB75AC46CFB2

Function 00D33068 Relevance: 6.5, Strings: 5, Instructions: 215COMMON

Download Yara Rule

Strings

Negociacion.pdf, xrefs: 00D330F5
TRADE, xrefs: 00D330AD
Negociacion, xrefs: 00D33106
SIOPEL.INI, xrefs: 00D330D3
NEGOCIA.INI, xrefs: 00D330E4

Memory Dump Source

Source File: 00000005.00000002.2388217551.0000000000D33000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D33000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d33000_Siopel.jbxd

Similarity

API ID:
String ID: NEGOCIA.INI$Negociacion$Negociacion.pdf$SIOPEL.INI$TRADE
API String ID: 0-164315787
Opcode ID: 53b9d7d77f5f6af16ec0d824d053816351d486b01a5a998b2c730cc9558219a6
Instruction ID: f850b9ac4196d3fad935a57c3c81a72cdff606510310bd998e66ccf4515d5a8e
Opcode Fuzzy Hash: 53b9d7d77f5f6af16ec0d824d053816351d486b01a5a998b2c730cc9558219a6
Instruction Fuzzy Hash: 70B14638644650DFD744EB18F9E5E2633A2FB9A30471081A5E6058B37ACB75BC46CFB2

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Siopel.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\Desktop\_PruebaAcceso\_PruebaAcceso.txt

C:\Windows\SIOPEL.INI

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: Siopel.exePID: 7020, Parent PID: 4380

General

Chronological Activities

Disassembly

Analysis Process: Siopel.exePID: 7020, Parent PID: 4380COMMON

Windows Analysis Report
Siopel.exe