About contagio exchange

CONTAGIO EXCHANGE Contagio exchange was created to absorb malware samples shared by readers of Contagio. This is meant to be a community driven malware collection.
Edit Aug 2013 - The community is busy and Mila too so this was not a very active site (my fault probably) so I will be just dumping malware strings here - it often helps in malware identification and googling is the best way.
With just strings, not exactly a fun blog to read but might become s useful resource over time.
I will not be posting samples here, just md5. You can find the corresponding samples on contagio or ping me if you can't find
M
P.S. Robot pictures delivered by Robohash.com (generated from file hashes)

Tuesday, November 12, 2013

Brazilian Bamker _ C__Internet_Banking.cpl - strings - CRIME

File: C__Internet_Banking.cpl
MD5:  563707b4edcc0bb0c88365a6702d4ba0
Size: 192000

Ascii Strings:
---------------------------------------------------------------------------
This program must be run under Win32
CODE
`DATA
.idata
.edata
P.reloc
P.rsrc
Boolean
False
True
Integer
String
TObject
TObject
System
IInterface
System
TInterfacedObject
%|qB
%xqB
%tqB
%pqB
%lqB
%hqB
%dqB
%`qB
%\qB
%XqB
%TqB
%PqB
%LqB
%HqB
%DqB
%@qB
%<qB
%8qB
%4qB
%0qB
%,qB
%(qB
%$qB
% qB
u:hD
SVWUQ
Z]_^[
SVWU
YZ]_^[
SVWU
]_^[
SVWU
w;;t$
]_^[
SVWU
]_^[
SVWUQ
Z]_^[
SVWU
YZ]_^[
SVWU
uW;{
u:;{
]_^[
=E`B
ZYYd
=E`B
=E`B
ZYYd
=E`B
SVWU
]_^[
YZ^[
SVWU
]_^[
Uh "@
=E`B
ZYYd
h'"@
=E`B
_^[YY]
QSVW
=E`B
ZYYd
=E`B
_^[Y]
SVWU
$;L$
$)D$
YZ]_^[
QSVW
Uhe&@
=E`B
ZYYd
hl&@
=E`B
_^[Y]
YZXu
=(`B
r/f=
w)f%
uENt
u0Nt
u%Nt
~KxI[)
2_^[
S!-@
S!-@
@v:k
@aQY
E@|o
BkU'9
ZYYd
SOFTWARE\Borland\Delphi\RTL
FPUMaskValue
-  B
SVW3
ZYYd
_^[YY]
2;0u
SVW1
SVW1
=( B
=( B
PPRTj
=( B
=( B
=( B
YYZX
=( B
=( B
=, B
=( B
=, B
=( B
YZXtp
VWUd
SPRQ
T$(j
Ph 5@
SVWU
]_^[
=, B
=( B
=, B
=( B
YZXtm1
SPRQ
SVWU
]_^[
ZTUWVSPRTj
]_^[
d$,1
,t\=
t=HtN
r6t0
t.Ht
=( B
ZYYd
_^[]
Uh&:@
ZYYd
_^[]
-DfB
=,`B
=  B
=D`B
= bB
hl B
hh<@
=0 B
hd B
hl B
SVWU
=$`B
]_^[
_^[]
;_^[
SVWU
]_^[
t!R:
t-Rf;
t f;J
SVWRP
Z_^[X
uXJt
uAJt
u:Jt
It2S
t&J|
N|*9
t1SVW
;_^[
SVWU
]_^[
t-Rf;
t f;J
uAJt
_^[]
]_^[
PSVW
_^[X
_^[X
SVWU
]_^[
]_^[
SVWU
]_^[
]_^[
8\u8
kernel32.dll
GetLongPathNameA
h0R@
hPR@
ZYYd
Software\Borland\Locales
Software\Borland\Delphi\Locales
58 B
UhSS@
ZYYd
_^[YY]
ZYYd
FFF;M
^[YY]
tl;u
B@;u
t0;u
Uh{W@
ZYYd
^[Y]
ZYYd
h&X@
^[Y]
UhoX@
ZYYd
hvX@
^[Y]
Uh:Y@
ZYYd
hAY@
ZYYd
u*PR
5dfB
Uh)\@
ZYYd
h0\@
-hfB
Uha\@
ZYYd
hh\@
-pfB
HICON
%|rB
%xrB
%trB
%prB
%lrB
%hrB
%drB
%`rB
%\rB
%XrB
%TrB
%PrB
%LrB
%HrB
%DrB
%@rB
%<rB
%8rB
%4rB
%0rB
%,rB
%(rB
%$rB
% rB
%<sB
%8sB
%4sB
%0sB
%,sB
%(sB
%$sB
% sB
%xsB
%|sB
%tsB
%psB
%lsB
%hsB
%dsB
%`sB
%\sB
%XsB
%TsB
%PsB
%LsB
%HsB
%DsB
UhA`@
ZYYd
hH`@
-tfB
UhYc@
ZYYd
h`c@
-xfB
Exception d@
EHeapException
EOutOfMemory
EInOutError0e@
EExternal
EExternalException
EIntError
EDivByZero
ERangeError
EIntOverflow
EMathError
EInvalidOp
EZeroDivideTh@
EOverflow
EUnderflow
EInvalidPointer`i@
EInvalidCast
EConvertError
EAccessViolation
EPrivilege
EStackOverflow
EControlC
EVariantError
EAssertionFailed
EAbstractError
EIntfCastError
EOSError
ESafecallException
SysUtils
SysUtils
TThreadLocalCounter
=?Xn@
$TMultiReadExclusiveWriteSynchronizer
SVWU
]_^[
0<:r
True
False
QSVW
_^[Y]
TStrData
UhZv@
ZYYd
hav@
^[YY]
@w2j
SVWQ
PWVS
$Z_^[
SVWQ
PWVS
$Z_^[
^[YY]
QQQQS
ZYYd
SVWU
]_^[
(_^[
<*t"<0r=<9w9i
_^[[
_^[]
INFNAN
QS<$t
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
<sGf
<sAf
^YY]
'w~f
f;\F
_^[YY]
@YY]
=DgB
ZYYd
ZYYd
yyyy
t%HtIHtm
ZYYd
AM/PM
AMPM
AAAA
SVW3
ZYYd
_^[YY]
SVWQ
Z_^[
SVWUQ
$Z]_^[
=@gB
SVW3
8gu4
=HgB
ZYYd
SVWU
]_^[
SVWQ
Z_^[
QSVW
_^[Y]
QQQQQQSVW3
ZYYd
ZYYd
^[Y]
ZYYd
QQQQQSVW
ZYYd
yyyy
eeee
D$DP
D$HP
D$PPj
D$LPj
ZYYd
_^[Y]
ZYYd
_^[YY]
TErrorRec
YZ^[
TExceptRec
SVW3
ZYYd
,tY=
t<HtH
r3t7
t(Ht
ZYYd
ZYYd
=HgB
=HgB
=HgB
u#;]
=HgB
K;\$
$YZ^[
=HgB
$YZ^[
=HgB
=HgB
=HgB
SVWU
]_^[
SVWU
WUWSj
YZ]_^[
ZYYd
QSVW
_^[Y]
Y_^[
=HgB
ZYYd
m/d/yy
mmmm d, yyyy
 AMPM
AMPM
:mm:ss
ZYYd
ZYYd
=@!B
kernel32.dll
GetDiskFreeSpaceExA
SVWU
]_^[
SVWUQ
(Z]_^[
SVWUQ
;w$t|
Z]_^[
;F$t=
;C$t4
ZYYd
_^[Y]
FSVWU
]_^[
ZYYd
=]fB
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
[YY]
ZYYd
ZYYd
ZYYd
oleaut32.dll
VariantChangeTypeEx
VarNeg
VarNot
VarAdd
VarSub
VarMul
VarDiv
VarIdiv
VarMod
VarAnd
VarOr
VarXor
VarCmp
VarI4FromStr
VarR4FromStr
VarR8FromStr
VarDateFromStr
VarCyFromStr
VarBoolFromStr
VarBstrFromCy
VarBstrFromDate
VarBstrFromBool
ZYYd
TCustomVariantType
TCustomVariantTypeP
Variants
EVariantInvalidOpError
EVariantTypeCastError
EVariantOverflowError
EVariantInvalidArgError
EVariantBadVarTypeError
EVariantBadIndexError
EVariantArrayLockedError
EVariantArrayCreateError
EVariantNotImplError
EVariantOutOfMemoryError
EVariantUnexpectedErrort
EVariantDispatchError
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
t?Htb
ZYYd
ZYYd
|kC3
|kC3
SVWQ
Z_^[
QQQQSV
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
=$#B
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
=$#B
ZYYd
=,#B
E@#B
Empty
Null
Smallint
Integer
Single
Double
Currency
Date
OleStr
Dispatch
Error
Boolean
Variant
Unknown
Decimal
ShortInt
Byte
Word
LongWord
Int64
SVW3
ZYYd
String
Array
ByRef
Variants
h$hB
ZYYd
h$hB
SVWQ
Z_^[
_^[YY]
QSVW
_^[Y]
SVWUQ
Z]_^[
h$hB
ZYYd
h$hB
QSVW
= hB
t~h$hB
ZYYd
h$hB
_^[Y]
SVW3
h$hB
|PF3
ZYYd
h$hB
ZYYd
h$hB
ZYYd
h$hB
ZYYd
ZYYd
-<hB
False
True
ZYYd
_^[Y]
SVW3
ZYYd
_^[YY]
$YZ^[
ZYYd
-@hB
ZYYd
-DhB
TNotifyEvent
Sender
TObject
EStreamError
EFileStreamError
EFCreateError
EFOpenError
EFilerErrorp
EReadError
EWriteError
EClassNotFound
EResNotFound
EListError
EStringListError
EComponentError
EOutOfResourcesH
EInvalidOperation
TList
TThreadListd
TPersistent
TPersistentd
Classes
TInterfacedPersistent
TInterfacedPersistentT
Classes
IStringsAdapter
Classes
TStrings
TStrings@
Classes
TStringItem
TStringList
TStringListp
Classes
TStream
THandleStream
TFileStream
TCustomMemoryStream`
TMemoryStream
TResourceStreamT
TClassFinder
TFiler
TReader
EThread
TThread
TComponentName
TComponent
TComponent
Classes
Name(
TDataModule
TDataModulep
Classes
OldCreateOrder0
OnCreate0
OnDestroy
TIdentMapEntry
TRegGroup
TRegGroups
QSVW
_^[Y]
SVWUQ
|!F3
u%CNu
Z]_^[
SVWUQ
$Z]_^[
SVWU
]_^[
SVWUQ
|%C3
Z]_^[
SVWU
]_^[
|3F3
|+F3
ZYYd
|)C3
#FKu
ZYYd
_^[YY]
ZYYd
ZYYd
ZYYd
TIntConst
QSVW
ZYYd
_^[Y]
QSVW
_^[Y]
_^[YY]
=`hB
=LhB
QSVW
tMWj
ZYYd
_^[Y]
ZYYd
ZYYd
ZYYd
YZ^[
Uh4$A
ZYYd
h;$A
^[Y]
SVWU
]_^[
ZYYd
Uh4'A
ZYYd
h;'A
ZYYd
ZYYd
SVW3
Uha)A
hx)A
ZYYd
hh)A
ZYYd
SVWU
]_^[
SVW3
|-F3
W<CNu
ZYYd
ZYYd
Uhp,A
ZYYd
^[Y]
Ph`7A
[YY]
Strings
SVW3
|0F3
ZYYd
YZ^[
ZYYd
_^[Y]
SVW3
Uhl/A
UhJ/A
ZYYd
hQ/A
ZYYd
hs/A
ZYYd
SVW3
ZYYd
SVW3
Uh|1A
ZYYd
UhS2A
ZYYd
hZ2A
SVWU
]_^[
QSVW
S$_^[Y]
ZYYd
ZYYd
ZYYd
^[YY]
SVW3
Uhi4A
UhL4A
ZYYd
hS4A
ZYYd
hp4A
_^[YY]
SVWUQ
SdZ]_^[
UhT5A
Uh/5A
ZYYd
h65A
ZYYd
h[5A
ZYYd
ZYYd
^[Y]
ZYYd
^[Y]
UhP7A
Uh37A
ZYYd
h:7A
ZYYd
hW7A
[YY]
SVW3
ZYYd
SVWUQ
$Z]_^[
SVWU
]_^[
$Z^[
Sd^[
_^[]
_^[]
^[YY]
ZYYd
Uh8BA
ZYYd
h?BA
[YY]
SVW3
UhyDA
ZYYd
SVWU
~,;{
]_^[
_^[]
UhkGA
ZYYd
hrGA
QSVW
_^[Y]
_^[]
TPropFixup
TPropIntfFixup
SVWU
]_^[
ZYYd
^[Y]
SVW3
UhZKA
ZYYd
haKA
_^[YY]
Owner
UhvMA
UhWMA
YF;w
ZYYd
|*C3
ZYYd
h^MA
ZYYd
h}MA
ZYYd
=dhB
Uh?NA
ZYYd
hFNA
_^[YY]
QSVW
=dhB
ZYYd
_^[Y]
ZYYd
ZYYd
_^[]
SVW3
ZYYd
ZYYd
C0_^[
SVWU
]_^[
ZYYd
ZYYd
^[Y]
Classes
|\F3
_^[]
QSVW
|AF3
_^[Y]
SVW3
UhFXA
ZYYd
ZYYd
_^[]
SVW3
ZYYd
_^[]
SVW3
ZYYd
_^[]
SVW3
Uhc[A
ZYYd
ZYYd
ZYYd
ZYYd
UhK\A
ZYYd
h\\A
Uh"]A
ZYYd
h)]A
False
True
Null
$YZ[
Uh=aA
ZYYd
hDaA
SVW3
Uh8cA
ZYYd
ZYYd
ZYYd
h?cA
_^[YY]
_^[]
QQQQ3
ZYYd
h&dA
ZYYd
ZYYd
%s_%d
SVW3
UhokA
UhMkA
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
hTkA
ZYYd
hvkA
SVW3
Uh*lA
ZYYd
ZYYd
h1lA
_^[YY]
UhImA
ZYYd
hPmA
^[YY]
Uh/nA
ZYYd
h6nA
ZYYd
ZYYd
Uh%qA
ZYYd
h,qA
ZYYd
SVW3
Uh}rA
ZYYd
$Z^[
Uh5uA
ZYYd
ZYYd
ZYYd
h<uA
B^*L
QQQQQQQS
UhNwA
ZYYd
hUwA
SVWQ
Z_^[
Uh!yA
ZYYd
h(yA
^[Y]
hhhB
htyA
=PhB
hhhB
hhhB
Uhj{A
UhK{A
hhhB
ZYYd
ZYYd
hhhB
ZYYd
hR{A
ZYYd
hq{A
hhhB
QSVW
ZYYd
ZYYd
_^[Y]
ZYYd
ZYYd
 hhhB
hhhB
ZYYd
hhhB
ZYYd
hhhB
ZYYd
SVWUQ
Z]_^[
QSVW
_^[Y]
Left
u6;_
S _^[
SVWUQ
|"C3
Z]_^[
YZ_^[
SVWUQ
Z]_^[
_^[]
ZYYd
_^[]
ZYYd
ZYYd
ZYYd
QSVW
ZYYd
_^[Y]
QSVW
ZYYd
_^[Y]
^[YY]
Height
HorizontalOffset
VerticalOffset
Width
_^[YY]
C0^[
C8^[
C<^[
C4^[
ZYYd
-ThB
ZYYd
ZYYd
TColor
EInvalidGraphic
EInvalidGraphicOperation
TFontCharset
TGraphic
TGraphic
Graphics
TSharedImage
TIconImage
TIcon
TIconh
Graphics
TResourceManager
clBlack
clMaroon
clGreen
clOlive
clNavy
clPurple
clTeal
clGray
clSilver
clRed
clLime
clYellow
clBlue
clFuchsia
clAqua
clWhite
clMoneyGreen
clSkyBlue
clCream
clMedGray
clActiveBorder
clActiveCaption
clAppWorkSpace
clBackground
clBtnFace
clBtnHighlight
clBtnShadow
clBtnText
clCaptionText
clDefault
clGradientActiveCaption
clGradientInactiveCaption
clGrayText
clHighlight
clHighlightText
clHotLight
clInactiveBorder
clInactiveCaption
clInactiveCaptionText
clInfoBk
clInfoText
clMenu
clMenuBar
clMenuHighlight
clMenuText
clNone
clScrollBar
cl3DDkShadow
cl3DLight
clWindow
clWindowFrame
clWindowText
ANSI_CHARSET
DEFAULT_CHARSET
SYMBOL_CHARSET
MAC_CHARSET
SHIFTJIS_CHARSET
HANGEUL_CHARSET
JOHAB_CHARSET
GB2312_CHARSET
CHINESEBIG5_CHARSET
GREEK_CHARSET
TURKISH_CHARSET
HEBREW_CHARSET
ARABIC_CHARSET
BALTIC_CHARSET
RUSSIAN_CHARSET
THAI_CHARSET
EASTEUROPE_CHARSET
OEM_CHARSET
ZYYd
ZYYd
Default
EL&B
ZYYd
ZYYd
ZYYd
YZ_^
YZ^[
E\&B
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
_^[YY]
ZYYd
ZYYd
ZYYd
ZYYd
TjTP
C ;C$s
T_^[
ZYYd
ZYYd
ZYYd
@DPU
[YY]
Data
$ZXu
ZYYd
ZYYd
ZYYd
ZYYd
:P!t
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
QSVW
ZYYd
C(_^[Y]
\$4Vj
SVWjH
TPatternManagerSV
ZYYd
ZYYd
ZYYd
ZYYd
EAppletException
TActivateEvent
Sender
TObject
Data
Integer
TStopEvent
Sender
TObject
Data
Integer
TInquireEvent
Sender
TObject
idIcon
Integer
idName
Integer
idInfo
Integer
lData
Integer
TNewInquireEvent
Sender
TObject
lData
Integer
hIcon
HICON
AppletName
String
AppletInfo
String
TStartWParmsEvent
Sender
TObject
Params
String
TAppletModule
TAppletModule
CtlPanel
OnStop
OnActivatet
OnInquire
OnNewInquirep
OnStartWParms@
Caption
AppletIcon@
Help(
ResidIcon(
ResidName(
ResidInfo
TAppletApplication
TAppletApplication
CtlPanel
ZYYd
_^[YY]
SVW3
Ht;HtVH
HtQ-
ZYYd
ZYYd
ZYYd
_^[YY]
ZYYd
ZYYd
TCustomZStream
TZDecompressionStream
EZLibError
EZDecompressionError
need dictionary
stream end
file error
stream error
data error
insufficient memory
buffer error
incompatible version
1.2.3
$+C(
XZRP
$+C(Z^[
Invalid ZStream operation!
SVWP
Invalid ZStream operation!
ZYYd
_^[Y]
^[Y]
SVWQ
K0;K(u
S,;S(s
Z_^[
SVWU
D$(;C$v
+D$(
L$0Q
P ;S@v
P(;S@v
t^;|$
Et/B
Sh;S\r
Et/B
H#D$
D$ 3
T$!;
D$!;
D$!3
T$"f
D$!3
D$!3
D$!3
D$(f
Kd;Kh
H#D$
D$ 3
T$!;
T$$3
L$%#T$
T$ 3
L$%3
T$%+
L$!3
D$  t
D$ @t
;sHr
J#T$
H#D$
D$ 3
T$!;
T$$3
L$%#T$
T$ 3
L$%3
T$%+
L$!3
D$!+
D$ @t
;sHr
J#T$
;CDs
SD;T$
KD+L$
C0;D$
C(+D$
S@;T$
S@+CD
4]_^[
SVWU
]_^[
SVWU
]_^[
SVWUQ
)S<3
Z]_^[
SVWUQ
S4RU
Z]_^[
D$(#D$8
l$()t$,
t:;t$,v
J#T$(
l$()t$,
L$(#L$<
l$()t$,
;t$,v:
;t$,v
#T$(
l$()t$,
T$$J
`;t$ v?
L$ +
+t$ ;
T$$J;D$ v0
t$ +
L$ +
J#T$(
J#T$(
)D$,
!T$(
D_^[
]_^[
SVWUQ
Z]_^[
SVWU
]_^[
ZYYd
ZYYd
QSVW
ZYYd
QSVW
ZYYd
_^[Y]
ZYYd
SVW3
ZYYd
ZYYd
ZYYd
BC0134F10535E45C9731DE
9FC75DF8679748F93195B551F73DB45A8ABBCC
QQQQS
ZYYd
0202
62A2
SVWU
]_^[
ZYYd
ZYYd
ZYYd
ZYYd
[YY]
QSVW
ZYYd
ZYYd
ZYYd
67FB27CC74A54834316A8DB24D
03668CA2BF739F4E95CF58F6223D8287
35B45D95B2598AAF4687BF6EE10076
6081A158C470A25996D479B9
ZYYd
LX4CJRY6EMU2
SVW3
ZYYd
A8373DDD71F3050602
214D
C6111A32DA67F30C07
40AE
9AC654CC41CD54E37E
1442
0957DD77E278FA021062E87799B136D7
EB7A
E00F150C172C36C75A949EBA5DF572E072
CA1B
QSVW3
ZYYd
2E6F9B5AE4
09042EF707
0A0B37FE3E
4C49E933C2
A724D3688C
ZYYd
-0iB
TThreadGeral
QSVW3
ZYYd
1A7BAF4EE8
CBCA7FBF7E
2D689253ED
67A65393AD
68A55492AC
B1EC1DDD18
ZYYd
-4iB
AppletModuleActivate
TENU19GNV3BIQ
TENU19GNV3BIQ\
UnitSZ7ELT0G
r+C3
ZYYd
0956
085A8DAC4BED25C9
316D98E94DF254CE140172E9
67E915DB0A2FD91EDB
ZYYd
-<iB
ZYYd
Error
Runtime error     at 00000000
0123456789ABCDEF
@v:k
%.*d
TPF0
MS Sans Serif
1.2.3
incorrect header check
unknown compression method
invalid window size
unknown header flags set
header crc mismatch
invalid block type
invalid stored block lengths
too many length or distance symbols
invalid code lengths set
invalid bit length repeat
invalid literal/lengths set
invalid distances set
invalid literal/length code
invalid distance code
invalid distance too far back
incorrect data check
incorrect length check
 inflate 1.2.3 Copyright 1995-2005 Mark Adler
invalid distance too far back
invalid distance code
invalid literal/length code
 n;^
Qkkbal
i]Wb
9a&g
MGiI
wn>Jj
#.zf
+o*7
Z* ,
H$6t
52F*
#jT$
^6o}
[-&LMb#{'
w+OQvr
R1h58
SKyu
)\ZEo^m/
ru&o
i8P/
?(3w
H*0"ZOW
{kHw
)T`D
!AxU
l!;b
:1X:
y9*O
kM`~
Vc0a
dQy/
lDa>
7~8A
C-Yn
gqr<
$/o|
f-=v
mj>zjZ
l6qnk
IiGM>nw
1A26b
i91k
ewh/?y
*5KS
6~_'
F*.f
1wsHp
M8MF
Pe6^
#bML"
`F(>
vQO+t
[h1R
XsBI
hPU3
^oEZ_
2%k_
w3Xc
/P8i
OZw3(?
Z"0*
fP~V
^GP~
b;!l
V_:X1:
NJ2"v
O*9y]
fu`z
/yQA
&]|v
kernel32.dll
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
user32.dll
GetKeyboardType
LoadStringA
MessageBoxA
CharNextA
advapi32.dll
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
oleaut32.dll
SysFreeString
SysReAllocStringLen
SysAllocStringLen
kernel32.dll
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
kernel32.dll
WriteFile
WinExec
WaitForSingleObject
VirtualQuery
SizeofResource
SetFilePointer
SetEvent
SetEndOfFile
ResumeThread
ResetEvent
ReadFile
MulDiv
LockResource
LoadResource
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
GlobalUnlock
GlobalReAlloc
GlobalHandle
GlobalLock
GlobalFree
GlobalAlloc
GetVersionExA
GetThreadLocale
GetStringTypeExA
GetStdHandle
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileAttributesA
GetExitCodeThread
GetEnvironmentVariableA
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCPInfo
GetACP
FreeResource
InterlockedIncrement
InterlockedExchange
InterlockedDecrement
FreeLibrary
FormatMessageA
FindResourceA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnumCalendarInfoA
EnterCriticalSection
DeleteFileA
DeleteCriticalSection
CreateFileA
CreateEventA
CreateDirectoryA
CompareStringA
CloseHandle
gdi32.dll
UnrealizeObject
StretchBlt
SetTextColor
SetROP2
SetBkMode
SetBkColor
SelectPalette
SelectObject
RealizePalette
MoveToEx
GetTextMetricsA
GetSystemPaletteEntries
GetStockObject
GetObjectA
GetDeviceCaps
GetDIBits
GetCurrentPositionEx
GetBitmapBits
DeleteObject
DeleteDC
CreatePenIndirect
CreatePalette
CreateFontIndirectA
CreateDIBitmap
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
user32.dll
ReleaseDC
PeekMessageA
MsgWaitForMultipleObjects
MessageBoxA
LoadStringA
LoadIconA
GetSystemMetrics
GetSysColor
GetIconInfo
GetDC
DrawIconEx
DestroyIcon
CreateIcon
CharNextA
CharUpperBuffA
CharToOemA
kernel32.dll
Sleep
oleaut32.dll
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
shell32.dll
ShellExecuteA
O5CMV4CKRZ7F.cpl
CPlApplet
0(0@0L0l0x0|0
111@1D1`1h1l1p1t1x1|1
2"2*222:2B2J2R2Z2b2j2r2z2
3&3/3P3X3
6)7]7i7
:%:8:B:H:V:\:d:v:
;0;6;>;H;_;j;
;"<8<
=/>5>N>W>`>k>t>{>
.040D0M0
1H1b1
2@2F2X2p2|2
3$3*3\3
3!4,454;4K4T4
5M6S6[6
8e9[;s;
>]>m>
2F3Z3b3x3
4"4,4?4o4
5!60696b6k6
7W7c7
9H9P9[9
:D:T:Z:`:f:k:q:z:
:X;`;
<.<C<M<R<q<v<{<
=E=R=h=
=E>U>
030Q0k0
2%363v3}3
8;8b8
8-9O9[9b9l9v9
:::O:`:j:r:z:
;/;7;\;d;r;w;
<$<6<C<O<\<n<t<
="=*=2=:=B=J=R=Z=b=j=r=z=
>">*>2>:>B>J>R>Z>b>j>r>z>
?"?*?2?:?B?J?R?Z?b?j?r?z?
#0/0<0N0T0\0d0l0t0|0
1$1,141<1D1L1T1\1d1l1t1|1
2$2,242<2D2L2T2\2d2l2t2|2
3$3,3;3G3T3f3l3x3
404P4X4\4`4d4h4l4p4t4x4
5 5$5(5,5<5\5d5h5l5p5t5x5|5
6 6$6(6,6064686<6L6l6t6x6|6
7 7(7,7074787<7@7D7H7X7x7
8(8084888<8@8D8H8L8P8`8
949<9@9D9H9L9P9T9X9\9p9
:,:L:T:X:\:`:d:h:l:p:t:
; ;$;(;8;X;`;d;h;l;p;t;x;|;
< <$<(<,<0<4<8<<<P<p<x<|<
=$=,=0=4=8=<=@=D=H=L=d=q=y=
>X>\>`>d>h>l>p>
4,474D4I4
5c5t5
6+6G6P6
6M8a8h8
<Y>]>a>e>i>m>q>u>y>}>
>i?p?
4B5W5b6
9w9S:
>&?p?
)0w0
081?1|1
3@3T3h3
6;6O6
727>7\7
7D8U9
=Z=p=}=
>!>M>
>.?[?
1J2b2g2s2
393s3}3
4.4_4n4
6#6>6x6K7
;#;*;B;I;\;t;
<4<C<W<
=i>{>
>7?c?
0 0*0/050:0@0E0K0R0X0]0c0h0n0u0{0
0 1)12181I1T1Y1
414E4k4
7)7B7L7V7h7}7
7#8A8^8p8
9$9-9H9[9n9w9
:/:=:Q:o:
;/;7;T;a;><1=V=l=
>*>:>E>K>S>X>
4 4$4(4,4044484<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
5$5(50545<5@5H5L5T5X5`5d5l5p5x5|5
6 6$6,60686<6D6H6P6T6\6`6h6l6t6x6
7&707;7E7P7Z7e7o7z7
8%80888=8c8
869l9y9
:D:Q:z:
;);X;
=&=.=6=m={=
>%>+>0>;>A>F>Q>W>\>g>m>r>}>
?"?-?3?8?C?I?N?Y?
1$1,1014181<1@1D1H1L1P1T1X1\1`1d1h1l1p1t1x1|1
242T2\2`2d2h2l2p2t2x2|2
3$3(3,3034383<3@3D3`3
4(4H4P4T4X4\4`4d4h4l4p4
5 5$5(5,5054585<5@5\5|5
6(6H6P6T6X6\6`6d6h6l6p6
677F7]7
7'868M8u8
8]9l9
:%:4:K:Z:n:}:
:];k;z;
2/2J2`2
3(3p3
3H4x4
5/5G5]7a7e7i7m7q7u7y7}7
:X:u:
<"<&<*<.<2<6<:<><B<F<X<p<y>}>
051C1
4#4;4
4d5y5
7:7@7T7Y798^8k8v8
9&999F9
:":,:>:S:_:g:q:v:{:
; ;(;0;8;@;H;P;X;`;h;p;x;
<&?O?
1L1P1T1X1\1`1
4*404U4\4|4
585@5D5H5L5P5T5X5\5`5t5
6$6D6L6P6T6X6\6`6d6h6l6|6
707P7X7\7`7d7h7l7p7t7x7
8 8$8(8,8D8d8l8p8t8x8|8
9$9(9,9094989<9@9D9\9|9
:(:4:8:@:D:H:L:P:T:X:\:`:d:h:l:v:z:
;(;0;4;8;<;@;D;H;L;P;T;X;\;`;n;
< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\<`<d<h<l<p<t<x<|<
=$=4=D=L=P=T=X=\=`=d=h=l=p=t=x=|=
>%>)><>\>d>h>l>p>t>x>|>
?$?D?L?P?T?X?\?`?d?h?l?p?t?x?|?
040<0@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0
1(1014181<1@1D1H1L1P1d1
2 2$2(2,2024282F2X2x2
3j3n3r3v3z3~3
4 4$4(4,4044484<4J4t4x4|4
5$545@5D5L5P5T5X5\5`5d5h5l5p5t5x5|5
696`6|6
7 7$7Z7i7x7w9
;-;8;K;
;D<Q<
=8=E=R=g=l=
> >$>(>,>0>4>8>
#0H0X0w0
2-2:2N2U2o2
4'4Q4
7'7j7
878{8
899T9
:P;f;
=!=s=
=(>N>w>
>=?Z?
323H3
3?4\4
4"5G5o5
6&7C7x7
8C9y9
?$?u?|?
H0O0
3I4P4g4
6*6B6I6
787G7^7
9 9@9H9L9P9T9X9\9`9d9h9l9?:
<-<D<T<a<q<
<*=J=g=l=
=0>5>\>d>s>
%050
0Q1`1
:P:q:
=h>o>
0a0{0
101[1
595X5x5|5
7'8{8
:>;C;];
<N<U<
<<=k=
1R2Y2p2#3
3)494
4 5j5
9E9O9_9e9y9
:7:D:S:c:
;>;[;`;
;H<n<
>5>_>j>w>
1l2w2
8)8j8u8
9)9.9H9
9/:<:Z:f:l:
:(;P;\;b;N<W<e<u<~<
=g>s>z>
?#?0?<?O?[?e?l?v?}?
0$0D0L0P0T0X0\0`0d0h0l0
0B1F1J1N1R1j1x1|1
2 2$2,2<2J2N2`2
3,3<3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|3
4 4$4(4,4044484<4
;(;F;S;
;b<g<
=7=<=z=
>#>L>Y>{>
?(?p?
%0A0H0
2/3a3
97:\:|:
=K=^>
-0=0T0d0
1&1C1
2V2q2
2)3;3
6,7<7
8'848C8a8
9 9(9,9094989<9@9D9H9
:W:c:n:x:
;&;7;A;R;^;j;{;
<'<3<@<R<X<g<s<
<-=1=8=i=m=t=
=[>_>c>g>k>p>
? ?$?(?,?0?4?8?F?N?b?f?j?n?r?
0=0e0i0m0
181H1T1X1`1d1h1l1p1t1x1|1
2B2}2
4J4W4`4m4w4}4
4-5H5X5
6X6s6
:#:6:D:`:d:l:p:t:x:|:
; ;$;(;D;d;l;p;t;x;|;
.0E0f0r1
1?2M2
4#4'4+4/43474;4?4C4G4K4O4S4W4[4_4c4g4k4o4s4G5h5
5*6E6X:
=Q>O?
4[4-888X9.<
W0c0p0
1>1s1
3!3B3
3G4b4
6O6\6
707@7g7
828S8z8
829P9/:<:F:K:S:Z:d:i:n:{:
;n;{;
< <G<g<
=.=F=b=
>[?f?
060C0}0
0g1s1z1
232>2_2q2
293Z3l3
3*4:4
5 5(50585<5@5D5H5L5P5T5X5\5`5d5h5l5p5t5x5|5
5&6e6
7"7.797@7K7i7
888D8P8d8
9"9/9B9T9X9\9`9d9h9l9p9t9x9|9
:(:2:?:D:L:V:
<0@0D0
0<1D1H1l1p1
2 2$2(2d2l2t2|2
3L3P3T3X3\3`3d3h3l3p3t3x3|3
3 4(40484@4H4P4X4`4h4p4x4
5 5(50585@5H5P5X5`5h5p5x5
6 6(60686@6H6
3 3$3(3,3034383<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|3
4 4$4(4,4044484<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
5 5$5(5,5054585<5@5D5H5L5P5
mmmmmm
mmmmm******mmmmmmm
1YXXY*
nKLLKJm
RXXRRR
nKLL+LLSSLD
ttRSM$$$$$zzzn
zzzzuuRR
uzzzYS
yzzzzS
tzzzzS
ttKttL
&=O8
.<e&y
5c(9}
)O+!=
l<M]
6f}O
}|jk
<Oi,
w|w=9
?yf~
.%&2
vveg
v}xx
Gb3X
y*~0
o:X=
xW#l
XPle
86B*
j:i5
a51Ab?<dU@
@H<%
?AGC!| ?
Dw)(8
G}x.
2HYv
Z4;0
r``X
[$j!
x`\8
?3It
l/B+Hg
k>`D
\X41
z>/l)
+QO~
I0Us*X
>u6z
cjnw
_-\G
7_mm
=,21
Paa/?<
,&kb
biH]`
zEXa
Z19hz
<jTsZ
/F)"d
BT+B
;Ms.
yvoh
/lNR
^T=7F
#U8""
")=&K
 PWO#
^VFL
Pn~w
9Qz`b
3c41
8GlV
(pVL%`P
4q5@
hWOM
~K=d
|7h6
/>OS
<4nX
5K(V
!4Vk
gun^
pGt+
vYN7~sb
#:6aVf
kiVNZ
D!t9O
?J7^a
:lX:
Q\!]J
^"21
BF;<
>U#xZ0%l
DKCnE
Vlga
/,5z
z<<.J
ywL<
~@7<
`g5RT
dvX,
VR.{kp
zC]U
Q'0&
0JlH
eV<X
%c{,
b=}X
:|c[!
LU`!31
X+j1
2@01c
eSA6k
.2TK
gGT7
:OUT
&|#@'PW
V_`?
!B|"
4zRa078Ee
VGYIj
eF6)d.
H)2J
@>O#o
pWMz"
3)`)
N 4p9
ib29O
9P$|
<Z0}
/,(1
Ndt-
SDTk
|'iD
638!
3f a
M{=X:
@nzX
_4y%{d
 (CY
r}kT
>s "
y'HD
`>?9];
c+xu+)
(|w3#
uwg.
JnkFP
7-Md4
SU@/)
h:hl
=5!t
)?U;
JDBU
+*>E
,3,`
*|{FJ[Kl\
vd]5
edT`p
}[`-
oz!Qr<
8PsF
+VAX
e$OG)
3_23
ZMV"
\ML;5
W/a%
q,)6
d.BY
N~iw
6M=FG
ne_Y
{,!ZMf
QVNxh
#ce/e6
Sq8=
l\]|
LDkKf
~Hob
wHwB
b<:O
JLuF
@_YV^
-s,&
_`H?=
oy|g
w#{mI
e/Zo
1.'(B
nd3z
svIU
<f@Y
1!=?
/<?gY
Qx:4
O:YT
~N5J
7fy*
,/k^
bO5CMV4CKRZ7F
*ShellAPI
System
SysInit
KWindows
UTypes
ZLibEx
SysUtils
SysConst
^Classes
"RTLConsts
3Messages
CVariants
$VarUtils
QTypInfo
sActiveX
[CtlConsts
+Graphics
Consts
Unit18GNV3AI
UnitQX4CKQY5
vUnitBHPW4CJR
\UnitSZ7ELT0G
CtlPanel
TPF0
TENU19GNV3BIQ
ENU19GNV3BIQ
OldCreateOrder
OnActivate
AppletModuleActivate
Caption
ENU19GNV3BIQ
ResidIcon
ResidName
ResidInfo
Left
Height
Width

Unicode Strings:
---------------------------------------------------------------------------
jjjjj
jjjj
jjjj
jjjj
#+3;CScs
!1Aa
DVCLAL
LX4CJRY6EMU2
PACKAGEINFO
TENU19GNV3BIQ
MAINICON
333f3
f3fff
Property is read-only
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list
Property %s does not exist
Stream write error
Thread creation error: %s
Thread Error: %s (%d)
Bitmap image is not valid
Icon image is not valid!Cannot change the size of an icon
Out of system resources
Canvas does not allow drawing Clipboard does not support Icons.Invalid class reference for TAppletApplication
Class %s not found%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s
Invalid stream format$''%s'' is not a valid component name
Invalid property path
Invalid property value List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d)+Out of memory while expanding memory stream
Error reading %s%s%s: %s
Stream read error
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
Unable to create directory
Ancestor for '%s' not found
Cannot assign a %s to a %s*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
January
February
March
April
June
July
August
September
October
November
December
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error.  Code: %d.
A call to an OS function failed
)Variant or safe array index out of bounds
Variant or safe array is locked
Invalid variant type conversion
Invalid variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Variant overflow
Invalid argument
Invalid variant type
Operation not supported
Unexpected variant error
External exception %x
Assertion failed
Interface not supported
Exception in safecall method
Floating point underflow
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Access violation
Stack overflow
Control-C hit
Privileged instruction(Exception %s in module %s at %p.
%s%s
Application Error
Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
Read
Write$Error creating variant or safe array
!'%s' is not a valid integer value
Out of memory
I/O error %d
File not found
Invalid filename
Too many open files
File access denied
Read beyond end of file
Disk full
Invalid numeric input
Division by zero
Range check error
Integer overflow Invalid floating point operation
Floating point division by zero
Floating point overflow