Sample details: 1146cc7d5b534680fe285a84c3a369b6 --

Hashes
MD5: 1146cc7d5b534680fe285a84c3a369b6
SHA1: c0cc2cf7a1daf110580b809f7e8e4f8769e7b77e
SHA256: 31dec93a49f806693017344c75b4034519a4e2518a0cae59cb3990c275bc5892
SSDEEP: 24576:ZMMpXS0hN0V0HoSPSGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFHDAGtlRXZ+CP63n5:Kwi0L0qlqt
Details
File Type: PE32
Added: 2018-05-08 20:57:19
Yara Hits
YRP/ASPack_v212_additional | YRP/ASPack_v21_additional | YRP/ASProtect_V2X_DLL_Alexey_Solodovnikov | YRP/ASPack_v212 | YRP/yodas_Protector_v1033_dllocx_Ashkbiz_Danehkar_h | YRP/ASPack_v211d | YRP/ASProtect_V2X_DLL_Alexey_Solodovnikov_additional | YRP/ASPack_212withouth_Poly_Solodovnikov_Alexey | YRP/ASPack_v212_Alexey_Solodovnikov | YRP/ASPackv212AlexeySolodovnikov | YRP/ASProtectV2XDLLAlexeySolodovnikov | YRP/IsPE32 | YRP/IsWindowsGUI | YRP/HasOverlay | YRP/domain | YRP/contentis_base64 | YRP/maldoc_OLE_file_magic_number | YRP/anti_dbg | YRP/network_dropper | YRP/keylogger | YRP/win_mutex | YRP/win_registry | YRP/win_files_operation | YRP/win_hook | YRP/Str_Win32_Winsock2_Library | YRP/Str_Win32_Wininet_Library | YRP/Str_Win32_Internet_API | YRP/suspicious_packer_section | YRP/CAP_HookExKeylogger |
Strings
		This program must be run under Win32
.idata
.rdata
.reloc
.aspack
.adata
4O=?rNNN
dZO]ynT
;3=MKj4
1,ze9s
<eo1E*
.6>9bUA
bW3TV^
b)EVjT
y#>I~'
3Ts_#K_Qp
\&l;My$Y
dx%_g/5O
PIvE%d5Oa
3,H-T,
b|La#u
x`K7Krx
C{M5m(
M$L8fo
!gMEwn
bCW$y',
#e}"+e
8%A(	0&
qfZhZ:
=O rxKsE
MA&A(A*@
E-Z}@0
"LZY]\b
lU~<W\
%ZZ_b]\
uD\!Gy
KWs`VW
F	;*5iB
&NLk;(
^dRi!C$}?
=`A"}m
\+q2J5
""|;7H
b9c|[m\sG
=!{.|Fo7
	"=KxW
'U&B|~
KI^J`2K
nch;?"CF
Ys+4RC
g8cTST`
Pc3.Ln6'
ln'/+<
f$%$WR
fbIC.C-`
s=6xUP
s{"kt'
Es!W2O
yhN~/?
m;S)&C
5o`%gN
1Jl.ys
a 0y'N
AG# `<
F:,5tW
d3QZX-dF
zRXblY
6PD-<O
ywQ_;6
YI ~a^
smey:|
kELc%b
~-efhy
HGC;]l 
9w(>:l
Sk68R#
d="-8]
RP7%B5
_1mnP7
Rw/8pR<Q
xnLl }?
r4&gXAe#D
=!2d;)
pI$.>8n
1r{<<[
}yj#8z
M=B}@}
%y6D5T
c`;X=+
s[z;cb
OD5J})
bux/:>
93'hm@
{pVS<"Xia1
VBl=!Tr
U@`1z0
j`>$y%
PhrEGTb
Ow4}nR
';G]l+
Rv8SNEh
@O9;;HQk
kx+Tl(
%YTe(%
H-9jK+
6pM6._
RY,%?b
kG"C]m
BLMH^!q
4+1 .}
#Y#GV`
zbqC(;H}
.1QGkdj:
;c9@za
[@"zm(#)
D/>b]?
zv^983YcH7
M)ET]?
Qay2AY~
	q(vMLi
9Ygc3ihK
f7b[pP
xK~m|G
2%.X2&d
q9n:=leD
T'?"&IK
[#c+qk0
gNHvrX
X-V-W-X-Y-\-],
dq2h@Ws}Z
~xR@*8
vlZ}=6
<`c)={
U|:{,r:
3Sew$v
xo'VMTz<z
kflF]lU
 )MPSP
F54JN\
0Iv5'Z
}x3P/P
y!y)y1t
sL8Ay%
\+|aJ_j
O7jo7)
S%hw>f>
P*V*hT
1{vm@M
%7(N2x
\r!<LL
F$uH5E-
c`XoTy
H{&@}EM
4	*kf5
GU:.sz
z=AH8p>
g,j*,A
{"?gQ\
ao!Jk@
@(ZP+@
6 p+{d
P-yC%N
DLfb!>zn
54K	8)
\RFM)K$
,JI1sN
_e~g{%m0i
{/26#9
rA?ugix
yXsS@N]
qeO0#R
H6)FV zPw4
dxNlI+
PVgZ*8+u
A*X*e+*B/9
io~\'R
:15>1N
G1E%2Fj
fhe?NJ
yTPjeQ
S|+Q)R
8s86 cnB
h6DWDY3
/06lMSR7
ocCI\9
1G2 t?x
~)JE J
a&:R]Mq
73B}68
nb5.<6E
c/A+5y\8[B)
.89J+ITy
f/{6,;
FkmotG
)P(xR&
KFwc!/3
C4Mgjv
=19GQe
6yU#O#]_P
,-1[hN
-'Qt]Za
7t^3?9
\@OQ23
:la\63
xA}&	HG
K4%_bGf
mDF{ZI
HUet++
_w@Klx
Av}Yu:
VT}}2h*2L
" #+-R|
%a>Ou&
itO	n[3
}riO.H
ml=>*x
j=P+ubcJ
{oixJ]dA
B5^S3,
5}d8S_
#w0+($
>}q>1QZKcg=
389k.+`X
yV2ED4[
tGqALM
&F,u(A
!%RpQJP	
UcFV"1#
RT-T|}-v
%U"hsyA
6<l@CHg
 ^Z/mG
Y2/Zjz
^m\ vNdm
SmBPbn?
mGq#^FS
hn\d9n
".&6#H.
BSL3#H
y#F^t%}
EiI2=/
1fF@i\
,RoF~iC
R)=5#-
:.bISi
?w1@40
X#V;Q9k
6vvHqF
/czGZ=
.HQ	IU%
}sv^x^g
rFnHNo@
ME7'_	
d.Ir;@PNV
~\;JCtd
'RtlDw
E;7>lRN
QI=6j@
TSfi7v
ANG"l	
xhz"%qi
HeW.]s
	,GH9r
?}58bt]f
*^{sPr3
A	r12#
:b7O'>
!cSbk;
+/r`hA
[rV2.?7
SZXMW^
B)Y%Ud
6CTl:b
n&"#m}w
ttDf8U;5
?n!IjYq{
D}a2QE
gUU$N!
#4\KV]\F
n<?twAt
(|CP1*>)}
%S0F;v
xjT04n
_sPDsc:F
?/RZ;V
(%{h)[ 
v)_f:7hR
x#Dd H
?5$n`i
+Nc`wevh
D);?Df~
\)\)\)e
F~tI/<F
@5e	[DV
M5M5M5V<-Sg
AN4ax`
FoDi]	
8M;[	U
0i4zaR
7{"%6'
JiHQ)J"Q)J"Q
TRQ^:h|
Q$.;AB
tGOKQ*ef5
)PU4'g>
rm[Kz"U*
,-Kd|MQ
}z{&Zu /OP
yx`utx
 z{=3kfw
K6M1|z
6pMbf*
u`mFz"
n+bKw|"
x;$FQc[
qqd$@aE
Y2WmWv
VirtualAlloc
VirtualFree
kernel32.dll
ExitProcess
user32.dll
MessageBoxA
wsprintfA
LOADER ERROR
The procedure entry point %s could not be located in the dynamic link library %s
The ordinal %u could not be located in the dynamic link library %s
 (08@P`p
kernel32.dll
GetProcAddress
GetModuleHandleA
LoadLibraryA
user32.dll
advapi32.dll
oleaut32.dll
advapi32.dll
version.dll
gdi32.dll
user32.dll
oleaut32.dll
ole32.dll
oleaut32.dll
comctl32.dll
shell32.dll
advapi32.dll
GetKeyboardType
RegQueryValueExA
SysFreeString
RegSetValueExA
VerQueryValueA
UnrealizeObject
CreateWindowExA
SafeArrayPtrOfIndex
OleUninitialize
GetErrorInfo
ImageList_SetIconSize
SHGetSpecialFolderLocation
SetSecurityInfo
Click to edit Master title style
Click to edit Master text styles
Second level
Third level
Fourth level
Fifth level
Click to edit Master text styles
Second level
Third level
Fourth level
Fifth level
Times New Roman
"Arial
Apple LaserWriter II NTX
PSCRIPT
Apple LaserWriter II NTX
powerpnt.ppt
!<arch>
/               1135908039  0     0     0       698       `
_re_dll_iname
__head_re_dll
_my_save_re_context
__imp__my_save_re_context
_my_regprop
__imp__my_regprop
_my_regnext
__imp__my_regnext
_my_reginitcolors
__imp__my_reginitcolors
_my_regfree
__imp__my_regfree
_my_regexec
__imp__my_regexec
_my_regdump
__imp__my_regdump
_my_regcomp
__imp__my_regcomp
_my_regclass_swash
__imp__my_regclass_swash
_my_re_intuit_string
__imp__my_re_intuit_string
_my_re_intuit_start
__imp__my_re_intuit_start
_my_pregexec
__imp__my_pregexec
_boot_re
__imp__boot_re
_XS_re_uninstall
__imp__XS_re_uninstall
_XS_re_install
__imp__XS_re_install
d000016.o/      1135908039  1005  544   644     246       `
.idata$4
.idata$5
.idata$7
re.dll
.idata$4
.idata$5
.idata$7
_re_dll_iname
d000000.o/      1135908039  1005  544   644     320       `
.idata$2
.idata$5
.idata$4
.idata$2
.idata$5
.idata$4
__head_re_dll
_re_dll_iname
d000015.o/      1135908039  1005  544   644     512       `
.idata$7
.idata$5
.idata$4
.idata$6
my_save_re_context
.idata$7
.idata$5
.idata$4
.idata$6
_my_save_re_context
__imp__my_save_re_context
__head_re_dll
d000014.o/      1135908039  1005  544   644     488       `
.idata$7
.idata$5
.idata$4
.idata$6
my_regprop
.idata$7
.idata$5
.idata$4
.idata$6
_my_regprop
__imp__my_regprop
__head_re_dll
d000013.o/      1135908039  1005  544   644     488       `
.idata$7
.idata$5
.idata$4
.idata$6
my_regnext
.idata$7
.idata$5
.idata$4
.idata$6
_my_regnext
__imp__my_regnext
__head_re_dll
d000012.o/      1135908039  1005  544   644     504       `
.idata$7
.idata$5
.idata$4
.idata$6
my_reginitcolors
.idata$7
.idata$5
.idata$4
.idata$6
_my_reginitcolors
__imp__my_reginitcolors
__head_re_dll
d000011.o/      1135908039  1005  544   644     488       `
.idata$7
.idata$5
.idata$4
.idata$6
my_regfree
.idata$7
.idata$5
.idata$4
.idata$6
_my_regfree
__imp__my_regfree
__head_re_dll
d000010.o/      1135908039  1005  544   644     488       `
.idata$7
.idata$5
.idata$4
.idata$6
my_regexec
.idata$7
.idata$5
.idata$4
.idata$6
_my_regexec
__imp__my_regexec
__head_re_dll
d000009.o/      1135908039  1005  544   644     488       `
.idata$7
.idata$5
.idata$4
.idata$6
my_regdump
.idata$7
.idata$5
.idata$4
.idata$6
_my_regdump
__imp__my_regdump
__head_re_dll
d000008.o/      1135908039  1005  544   644     488       `
.idata$7
.idata$5
.idata$4
.idata$6
my_regcomp
.idata$7
.idata$5
.idata$4
.idata$6
_my_regcomp
__imp__my_regcomp
__head_re_dll
d000007.o/      1135908039  1005  544   644     506       `
.idata$7
.idata$5
.idata$4
.idata$6
my_regclass_swash
.idata$7
.idata$5
.idata$4
.idata$6
_my_regclass_swash
__imp__my_regclass_swash
__head_re_dll
d000006.o/      1135908039  1005  544   644     514       `
.idata$7
.idata$5
.idata$4
.idata$6
my_re_intuit_string
.idata$7
.idata$5
.idata$4
.idata$6
_my_re_intuit_string
__imp__my_re_intuit_string
__head_re_dll
d000005.o/      1135908039  1005  544   644     512       `
.idata$7
.idata$5
.idata$4
.idata$6
my_re_intuit_start
.idata$7
.idata$5
.idata$4
.idata$6
_my_re_intuit_start
__imp__my_re_intuit_start
__head_re_dll
d000004.o/      1135908039  1005  544   644     490       `
.idata$7
.idata$5
.idata$4
.idata$6
my_pregexec
.idata$7
.idata$5
.idata$4
.idata$6
_my_pregexec
__imp__my_pregexec
__head_re_dll
d000003.o/      1135908039  1005  544   644     469       `
.idata$7
.idata$5
.idata$4
.idata$6
boot_re
.idata$7
.idata$5
.idata$4
.idata$6
_boot_re
__imp__boot_re
__head_re_dll
d000002.o/      1135908039  1005  544   644     502       `
.idata$7
.idata$5
.idata$4
.idata$6
XS_re_uninstall
.idata$7
.idata$5
.idata$4
.idata$6
_XS_re_uninstall
__imp__XS_re_uninstall
__head_re_dll
d000001.o/      1135908039  1005  544   644     494       `
.idata$7
.idata$5
.idata$4
.idata$6
XS_re_install
.idata$7
.idata$5
.idata$4
.idata$6
_XS_re_install
__imp__XS_re_install
__head_re_dll
libre.dll.a
!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
D$ Pj@
;T$|sF
L$LQWS
u._^]3
u=_^][
T$0WSQUR
f	U4_^][
L$0WSRUQ
f	M4_^][
f	U4_^]
33333333333333
3333333
 !"#$%&'33()3333*333+33,-./0312
@Ww@t,
HHtXHHt
?If90t
uTVWhD
j@j ^V
< tK<	tG
v	N+D$
HHtYHHt
^SSSSS
URPQQh`
t"SS9] u
;t$,v-
UQPXY]Y[
PPPPPPPP
PPPPPPPP
PostTrampSize %d
YWORD 
DQWORD 
TBYTE 
QWORD 
DWORD 
 ;NOT TAKEN
 ;TAKEN
REPNZ 
UNDEFINED
CALL FAR
LOOPNZ
JMP FAR
SYSCALL
SYSRET
WBINVD
SYSENTER
SYSEXIT
GETSEC
CMOVNO
CMOVAE
CMOVNZ
CMOVBE
CMOVNS
CMOVNP
CMOVGE
CMOVLE
CMPXCHG
MOVNTI
INVLPG
VMCALL
VMLAUNCH
VMRESUME
VMXOFF
MONITOR
XGETBV
XSETBV
VMMCALL
VMLOAD
VMSAVE
SKINIT
INVLPGA
SWAPGS
RDTSCP
PREFETCH
PREFETCHW
PFNACC
PFPNACC
PFCMPGE
PFRSQRT
PFCMPGT
PFRCPIT1
PFRSQIT1
PFSUBR
PFCMPEQ
PFRCPIT2
PMULHRW
PSWAPD
PAVGUSB
MOVUPS
MOVUPD
VMOVSS
VMOVSD
VMOVUPS
VMOVUPD
MOVHLPS
MOVLPS
MOVLPD
MOVSLDUP
MOVDDUP
VMOVHLPS
VMOVLPS
VMOVLPD
VMOVSLDUP
VMOVDDUP
UNPCKLPS
UNPCKLPD
VUNPCKLPS
VUNPCKLPD
UNPCKHPS
UNPCKHPD
VUNPCKHPS
VUNPCKHPD
MOVLHPS
MOVHPS
MOVHPD
MOVSHDUP
VMOVLHPS
VMOVHPS
VMOVHPD
VMOVSHDUP
PREFETCHNTA
PREFETCHT0
PREFETCHT1
PREFETCHT2
MOVAPS
MOVAPD
VMOVAPS
VMOVAPD
CVTPI2PS
CVTPI2PD
CVTSI2SS
CVTSI2SD
VCVTSI2SS
VCVTSI2SD
MOVNTPS
MOVNTPD
MOVNTSS
MOVNTSD
VMOVNTPS
VMOVNTPD
CVTTPS2PI
CVTTPD2PI
CVTTSS2SI
CVTTSD2SI
VCVTTSS2SI
VCVTTSD2SI
CVTPS2PI
CVTPD2PI
CVTSS2SI
CVTSD2SI
VCVTSS2SI
VCVTSD2SI
UCOMISS
UCOMISD
VUCOMISS
VUCOMISD
COMISS
COMISD
VCOMISS
VCOMISD
PSHUFB
VPSHUFB
PHADDW
VPHADDW
PHADDD
VPHADDD
PHADDSW
VPHADDSW
PMADDUBSW
VPMADDUBSW
PHSUBW
VPHSUBW
PHSUBD
VPHSUBD
PHSUBSW
VPHSUBSW
PSIGNB
VPSIGNB
PSIGNW
VPSIGNW
PSIGND
VPSIGND
PMULHRSW
VPMULHRSW
VPERMILPS
VPERMILPD
VPTESTPS
VPTESTPD
PBLENDVB
BLENDVPS
BLENDVPD
VPTEST
VBROADCASTSS
VBROADCASTSD
VBROADCASTF128
VPABSB
VPABSW
VPABSD
PMOVSXBW
VPMOVSXBW
PMOVSXBD
VPMOVSXBD
PMOVSXBQ
VPMOVSXBQ
PMOVSXWD
VPMOVSXWD
PMOVSXWQ
VPMOVSXWQ
PMOVSXDQ
VPMOVSXDQ
PMULDQ
VPMULDQ
PCMPEQQ
VPCMPEQQ
MOVNTDQA
VMOVNTDQA
PACKUSDW
VPACKUSDW
VMASKMOVPS
VMASKMOVPD
PMOVZXBW
VPMOVZXBW
PMOVZXBD
VPMOVZXBD
PMOVZXBQ
VPMOVZXBQ
PMOVZXWD
VPMOVZXWD
PMOVZXWQ
VPMOVZXWQ
PMOVZXDQ
VPMOVZXDQ
PCMPGTQ
VPCMPGTQ
PMINSB
VPMINSB
PMINSD
VPMINSD
PMINUW
VPMINUW
PMINUD
VPMINUD
PMAXSB
VPMAXSB
PMAXSD
VPMAXSD
PMAXUW
VPMAXUW
PMAXUD
VPMAXUD
PMULLD
VPMULLD
PHMINPOSUW
VPHMINPOSUW
INVEPT
INVVPID
VFMADDSUB132PS
VFMADDSUB132PD
VFMSUBADD132PS
VFMSUBADD132PD
VFMADD132PS
VFMADD132PD
VFMADD132SS
VFMADD132SD
VFMSUB132PS
VFMSUB132PD
VFMSUB132SS
VFMSUB132SD
VFNMADD132PS
VFNMADD132PD
VFNMADD132SS
VFNMADD132SD
VFNMSUB132PS
VFNMSUB132PD
VFNMSUB132SS
VFNMSUB132SD
VFMADDSUB213PS
VFMADDSUB213PD
VFMSUBADD213PS
VFMSUBADD213PD
VFMADD213PS
VFMADD213PD
VFMADD213SS
VFMADD213SD
VFMSUB213PS
VFMSUB213PD
VFMSUB213SS
VFMSUB213SD
VFNMADD213PS
VFNMADD213PD
VFNMADD213SS
VFNMADD213SD
VFNMSUB213PS
VFNMSUB213PD
VFNMSUB213SS
VFNMSUB213SD
VFMADDSUB231PS
VFMADDSUB231PD
VFMSUBADD231PS
VFMSUBADD231PD
VFMADD231PS
VFMADD231PD
VFMADD231SS
VFMADD231SD
VFMSUB231PS
VFMSUB231PD
VFMSUB231SS
VFMSUB231SD
VFNMADD231PS
VFNMADD231PD
VFNMADD231SS
VFNMADD231SD
VFNMSUB231PS
VFNMSUB231PD
VFNMSUB231SS
VFNMSUB231SD
AESIMC
VAESIMC
AESENC
VAESENC
AESENCLAST
VAESENCLAST
AESDEC
VAESDEC
AESDECLAST
VAESDECLAST
VPERM2F128
ROUNDPS
VROUNDPS
ROUNDPD
VROUNDPD
ROUNDSS
VROUNDSS
ROUNDSD
VROUNDSD
BLENDPS
VBLENDPS
BLENDPD
VBLENDPD
PBLENDW
VPBLENDVW
PALIGNR
VPALIGNR
PEXTRB
VPEXTRB
PEXTRW
VPEXTRW
PEXTRD
PEXTRQ
VPEXTRD
EXTRACTPS
VEXTRACTPS
VINSERTF128
VEXTRACTF128
PINSRB
VPINSRB
INSERTPS
VINSERTPS
PINSRD
PINSRQ
VPINSRD
VPINSRQ
MPSADBW
VMPSADBW
PCLMULQDQ
VPCLMULQDQ
VBLENDVPS
VBLENDVPD
VPBLENDVB
PCMPESTRM
VPCMPESTRM
PCMPESTRI
VCMPESTRI
PCMPISTRM
VPCMPISTRM
PCMPISTRI
VPCMPISTRI
AESKEYGENASSIST
VAESKEYGENASSIST
MOVMSKPS
MOVMSKPD
VMOVMSKPS
VMOVMSKPD
SQRTPS
SQRTPD
SQRTSS
SQRTSD
VSQRTSS
VSQRTSD
VSQRTPS
VSQRTPD
RSQRTPS
RSQRTSS
VRSQRTSS
VRSQRTPS
VRCPSS
VRCPPS
VANDPS
VANDPD
ANDNPS
ANDNPD
VANDNPS
VANDNPD
VXORPS
VXORPD
VADDPS
VADDPD
VADDSS
VADDSD
VMULPS
VMULPD
VMULSS
VMULSD
CVTPS2PD
CVTPD2PS
CVTSS2SD
CVTSD2SS
VCVTSS2SD
VCVTSD2SS
VCVTPS2PD
VCVTPD2PS
CVTDQ2PS
CVTPS2DQ
CVTTPS2DQ
VCVTDQ2PS
VCVTPS2DQ
VCVTTPS2DQ
VSUBPS
VSUBPD
VSUBSS
VSUBSD
VMINPS
VMINPD
VMINSS
VMINSD
VDIVPS
VDIVPD
VDIVSS
VDIVSD
VMAXPS
VMAXPD
VMAXSS
VMAXSD
PUNPCKLBW
VPUNPCKLBW
PUNPCKLWD
VPUNPCKLWD
PUNPCKLDQ
VPUNPCKLDQ
PACKSSWB
VPACKSSWB
PCMPGTB
VPCMPGTB
PCMPGTW
VPCMPGTW
PCMPGTD
VPCMPGTD
PACKUSWB
VPACKUSWB
PUNPCKHBW
VPUNPCKHBW
PUNPCKHWD
VPUNPCKHWD
PUNPCKHDQ
VPUNPCKHDQ
PACKSSDW
VPACKSSDW
PUNPCKLQDQ
VPUNPCKLQDQ
PUNPCKHQDQ
VPUNPCKHQDQ
MOVDQA
MOVDQU
VMOVDQA
VMOVDQU
PSHUFW
PSHUFD
PSHUFHW
PSHUFLW
VPSHUFD
VPSHUFHW
VPSHUFLW
VPSRLW
VPSRAW
VPSLLW
VPSRLD
VPSRAD
VPSLLD
VPSRLQ
PSRLDQ
VPSRLDQ
VPSLLQ
PSLLDQ
VPSLLDQ
PCMPEQB
VPCMPEQB
PCMPEQW
VPCMPEQW
PCMPEQD
VPCMPEQD
VZEROUPPER
VZEROALL
VMREAD
INSERTQ
VMWRITE
HADDPD
HADDPS
VHADDPD
VHAD# Ignore everything in this directory
# Except this file
!.gitignore
.gitignore
# Ignore everything in this directory
# Except this file
!.gitignore
.gitignore
# Ignore everything in this directory
# Except this file
!.gitignore
.gitignore
!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
D$ Pj@
;T$|sF
L$LQWS
u._^]3
u=_^][
T$0WSQUR
f	U4_^][
L$0WSRUQ
f	M4_^][
f	U4_^]
33333333333333
3333333
 !"#$%&'33()3333*333+33,-./0312
@Ww@t,
HHtXHHt
?If90t
uTVWhD
j@j ^V
< tK<	tG
v	N+D$
HHtYHHt
^SSSSS
URPQQh`
t"SS9] u
;t$,v-
UQPXY]Y[
PPPPPPPP
PPPPPPPP
PostTrampSize %d
YWORD 
DQWORD 
TBYTE 
QWORD 
DWORD 
 ;NOT TAKEN
 ;TAKEN
REPNZ 
UNDEFINED
CALL FAR
LOOPNZ
JMP FAR
SYSCALL
SYSRET
WBINVD
SYSENTER
SYSEXIT
GETSEC
CMOVNO
CMOVAE
CMOVNZ
CMOVBE
CMOVNS
CMOVNP
CMOVGE
CMOVLE
CMPXCHG
MOVNTI
INVLPG
VMCALL
VMLAUNCH
VMRESUME
VMXOFF
MONITOR
XGETBV
XSETBV
VMMCALL
VMLOAD
VMSAVE
SKINIT
INVLPGA
SWAPGS
RDTSCP
PREFETCH
PREFETCHW
PFNACC
PFPNACC
PFCMPGE
PFRSQRT
PFCMPGT
PFRCPIT1
PFRSQIT1
PFSUBR
PFCMPEQ
PFRCPIT2
PMULHRW
PSWAPD
PAVGUSB
MOVUPS
MOVUPD
VMOVSS
VMOVSD
VMOVUPS
VMOVUPD
MOVHLPS
MOVLPS
MOVLPD
MOVSLDUP
MOVDDUP
VMOVHLPS
VMOVLPS
VMOVLPD
VMOVSLDUP
VMOVDDUP
UNPCKLPS
UNPCKLPD
VUNPCKLPS
VUNPCKLPD
UNPCKHPS
UNPCKHPD
VUNPCKHPS
VUNPCKHPD
MOVLHPS
MOVHPS
MOVHPD
MOVSHDUP
VMOVLHPS
VMOVHPS
VMOVHPD
VMOVSHDUP
PREFETCHNTA
PREFETCHT0
PREFETCHT1
PREFETCHT2
MOVAPS
MOVAPD
VMOVAPS
VMOVAPD
CVTPI2PS
CVTPI2PD
CVTSI2SS
CVTSI2SD
VCVTSI2SS
VCVTSI2SD
MOVNTPS
MOVNTPD
MOVNTSS
MOVNTSD
VMOVNTPS
VMOVNTPD
CVTTPS2PI
CVTTPD2PI
CVTTSS2SI
CVTTSD2SI
VCVTTSS2SI
VCVTTSD2SI
CVTPS2PI
CVTPD2PI
CVTSS2SI
CVTSD2SI
VCVTSS2SI
VCVTSD2SI
UCOMISS
UCOMISD
VUCOMISS
VUCOMISD
COMISS
COMISD
VCOMISS
VCOMISD
PSHUFB
VPSHUFB
PHADDW
VPHADDW
PHADDD
VPHADDD
PHADDSW
VPHADDSW
PMADDUBSW
VPMADDUBSW
PHSUBW
VPHSUBW
PHSUBD
VPHSUBD
PHSUBSW
VPHSUBSW
PSIGNB
VPSIGNB
PSIGNW
VPSIGNW
PSIGND
VPSIGND
PMULHRSW
VPMULHRSW
VPERMILPS
VPERMILPD
VPTESTPS
VPTESTPD
PBLENDVB
BLENDVPS
BLENDVPD
VPTEST
VBROADCASTSS
VBROADCASTSD
VBROADCASTF128
VPABSB
VPABSW
VPABSD
PMOVSXBW
VPMOVSXBW
PMOVSXBD
VPMOVSXBD
PMOVSXBQ
VPMOVSXBQ
PMOVSXWD
VPMOVSXWD
PMOVSXWQ
VPMOVSXWQ
PMOVSXDQ
VPMOVSXDQ
PMULDQ
VPMULDQ
PCMPEQQ
VPCMPEQQ
MOVNTDQA
VMOVNTDQA
PACKUSDW
VPACKUSDW
VMASKMOVPS
VMASKMOVPD
PMOVZXBW
VPMOVZXBW
PMOVZXBD
VPMOVZXBD
PMOVZXBQ
VPMOVZXBQ
PMOVZXWD
VPMOVZXWD
PMOVZXWQ
VPMOVZXWQ
PMOVZXDQ
VPMOVZXDQ
PCMPGTQ
VPCMPGTQ
PMINSB
VPMINSB
PMINSD
VPMINSD
PMINUW
VPMINUW
PMINUD
VPMINUD
PMAXSB
VPMAXSB
PMAXSD
VPMAXSD
PMAXUW
VPMAXUW
PMAXUD
VPMAXUD
PMULLD
VPMULLD
PHMINPOSUW
VPHMINPOSUW
INVEPT
INVVPID
VFMADDSUB132PS
VFMADDSUB132PD
VFMSUBADD132PS
VFMSUBADD132PD
VFMADD132PS
VFMADD132PD
VFMADD132SS
VFMADD132SD
VFMSUB132PS
VFMSUB132PD
VFMSUB132SS
VFMSUB132SD
VFNMADD132PS
VFNMADD132PD
VFNMADD132SS
VFNMADD132SD
VFNMSUB132PS
VFNMSUB132PD
VFNMSUB132SS
VFNMSUB132SD
VFMADDSUB213PS
VFMADDSUB213PD
VFMSUBADD213PS
VFMSUBADD213PD
VFMADD213PS
VFMADD213PD
VFMADD213SS
VFMADD213SD
VFMSUB213PS
VFMSUB213PD
VFMSUB213SS
VFMSUB213SD
VFNMADD213PS
VFNMADD213PD
VFNMADD213SS
VFNMADD213SD
VFNMSUB213PS
VFNMSUB213PD
VFNMSUB213SS
VFNMSUB213SD
VFMADDSUB231PS
VFMADDSUB231PD
VFMSUBADD231PS
VFMSUBADD231PD
VFMADD231PS
VFMADD231PD
VFMADD231SS
VFMADD231SD
VFMSUB231PS
VFMSUB231PD
VFMSUB231SS
VFMSUB231SD
VFNMADD231PS
VFNMADD231PD
VFNMADD231SS
VFNMADD231SD
VFNMSUB231PS
VFNMSUB231PD
VFNMSUB231SS
VFNMSUB231SD
AESIMC
VAESIMC
AESENC
VAESENC
AESENCLAST
VAESENCLAST
AESDEC
VAESDEC
AESDECLAST
VAESDECLAST
VPERM2F128
ROUNDPS
VROUNDPS
ROUNDPD
VROUNDPD
ROUNDSS
VROUNDSS
ROUNDSD
VROUNDSD
BLENDPS
VBLENDPS
BLENDPD
VBLENDPD
PBLENDW
VPBLENDVW
PALIGNR
VPALIGNR
PEXTRB
VPEXTRB
PEXTRW
VPEXTRW
PEXTRD
PEXTRQ
VPEXTRD
EXTRACTPS
VEXTRACTPS
VINSERTF128
VEXTRACTF128
PINSRB
VPINSRB
INSERTPS
VINSERTPS
PINSRD
PINSRQ
VPINSRD
VPINSRQ
MPSADBW
VMPSADBW
PCLMULQDQ
VPCLMULQDQ
VBLENDVPS
VBLENDVPD
VPBLENDVB
PCMPESTRM
VPCMPESTRM
PCMPESTRI
VCMPESTRI
PCMPISTRM
VPCMPISTRM
PCMPISTRI
VPCMPISTRI
AESKEYGENASSIST
VAESKEYGENASSIST
MOVMSKPS
MOVMSKPD
VMOVMSKPS
VMOVMSKPD
SQRTPS
SQRTPD
SQRTSS
SQRTSD
VSQRTSS
VSQRTSD
VSQRTPS
VSQRTPD
RSQRTPS
RSQRTSS
VRSQRTSS
VRSQRTPS
VRCPSS
VRCPPS
VANDPS
VANDPD
ANDNPS
ANDNPD
VANDNPS
VANDNPD
VXORPS
VXORPD
VADDPS
VADDPD
VADDSS
VADDSD
VMULPS
VMULPD
VMULSS
VMULSD
CVTPS2PD
CVTPD2PS
CVTSS2SD
CVTSD2SS
VCVTSS2SD
VCVTSD2SS
VCVTPS2PD
VCVTPD2PS
CVTDQ2PS
CVTPS2DQ
CVTTPS2DQ
VCVTDQ2PS
VCVTPS2DQ
VCVTTPS2DQ
VSUBPS
VSUBPD
VSUBSS
VSUBSD
VMINPS
VMINPD
VMINSS
VMINSD
VDIVPS
VDIVPD
VDIVSS
VDIVSD
VMAXPS
VMAXPD
VMAXSS
VMAXSD
PUNPCKLBW
VPUNPCKLBW
PUNPCKLWD
VPUNPCKLWD
PUNPCKLDQ
VPUNPCKLDQ
PACKSSWB
VPACKSSWB
PCMPGTB
VPCMPGTB
PCMPGTW
VPCMPGTW
PCMPGTD
VPCMPGTD
PACKUSWB
VPACKUSWB
PUNPCKHBW
VPUNPCKHBW
PUNPCKHWD
VPUNPCKHWD
PUNPCKHDQ
VPUNPCKHDQ
PACKSSDW
VPACKSSDW
PUNPCKLQDQ
VPUNPCKLQDQ
PUNPCKHQDQ
VPUNPCKHQDQ
MOVDQA
MOVDQU
VMOVDQA
VMOVDQU
PSHUFW
PSHUFD
PSHUFHW
PSHUFLW
VPSHUFD
VPSHUFHW
VPSHUFLW
VPSRLW
VPSRAW
VPSLLW
VPSRLD
VPSRAD
VPSLLD
VPSRLQ
PSRLDQ
VPSRLDQ
VPSLLQ
PSLLDQ
VPSLLDQ
PCMPEQB
VPCMPEQB
PCMPEQW
VPCMPEQW
PCMPEQD
VPCMPEQD
VZEROUPPER
VZEROALL
VMREAD
INSERTQ
VMWRITE
HADDPD
HADDPS
VHADDPD
VHADDPS
HSUBPD
HSUBPS
VHSUBPD
VHSUBPS
FXSAVE
FXRSTOR
LFENCE
XRSTOR
MFENCE
SFENCE
CLFLUSH
LDMXCSR
VLDMXCSR
STMXCSR
VSTMXCSR
POPCNT
CMPEQPS
CMPLTPS
CMPLEPS
CMPUNORDPS
CMPNEQPS
CMPNLTPS
CMPNLEPS
CMPORDPS
CMPEQPD
CMPLTPD
CMPLEPD
CMPUNORDPD
CMPNEQPD
CMPNLTPD
CMPNLEPD
CMPORDPD
CMPEQSS
CMPLTSS
CMPLESS
CMPUNORDSS
CMPNEQSS
CMPNLTSS
CMPNLESS
CMPORDSS
CMPEQSD
CMPLTSD
CMPLESD
CMPUNORDSD
CMPNEQSD
CMPNLTSD
CMPNLESD
CMPORDSD
VCMPEQPS
VCMPLTPS
VCMPLEPS
VCMPUNORDPS
VCMPNEQPS
VCMPNLTPS
VCMPNLEPS
VCMPORDPS
VCMPEQPD
VCMPLTPD
VCMPLEPD
VCMPUNORDPD
VCMPNEQPD
VCMPNLTPD
VCMPNLEPD
VCMPORDPD
VCMPEQSS
VCMPLTSS
VCMPLESS
VCMPUNORDSS
VCMPNEQSS
VCMPNLTSS
VCMPNLESS
VCMPORDSS
VCMPEQSD
VCMPLTSD
VCMPLESD
VCMPUNORDSD
VCMPNEQSD
VCMPNLTSD
VCMPNLESD
VCMPORDSD
PINSRW
VPINSRW
SHUFPS
SHUFPD
VSHUFPS
VSHUFPD
CMPXCHG8B
CMPXCHG16B
VMPTRST
VMPTRLD
VMCLEAR
ADDSUBPD
ADDSUBPS
VADDSUBPD
VADDSUBPS
VPADDQ
PMULLW
VPMULLW
MOVQ2DQ
MOVDQ2Q
PMOVMSKB
VPMOVMSKB
PSUBUSB
VPSUBUSB
PSUBUSW
VPSUBUSW
PMINUB
VPMINUB
PADDUSB
VPADDUSW
PADDUSW
PMAXUB
VPMAXUB
VPANDN
VPAVGB
VPAVGW
PMULHUW
VPMULHUW
PMULHW
VPMULHW
CVTTPD2DQ
CVTDQ2PD
CVTPD2DQ
VCVTTPD2DQ
VCVTDQ2PD
VCVTPD2DQ
MOVNTQ
MOVNTDQ
VMOVNTDQ
PSUBSB
VPSUBSB
PSUBSW
VPSUBSW
PMINSW
VPMINSW
PADDSB
VPADDSB
PADDSW
VPADDSW
PMAXSW
VPMAXSW
VLDDQU
PMULUDQ
VPMULUDQ
PMADDWD
VPMADDWD
PSADBW
VPSADBW
MASKMOVQ
MASKMOVDQU
VMASKMOVDQU
VPSUBB
VPSUBW
VPSUBD
VPSUBQ
VPADDB
VPADDW
VPADDD
FLDENV
FLDL2T
FLDL2E
FLDLG2
FLDLN2
FPATAN
FXTRACT
FPREM1
FDECSTP
FINCSTP
FYL2XP1
FSINCOS
FRNDINT
FSCALE
FNSTENV
FSTENV
FNSTCW
FICOMP
FISUBR
FIDIVR
FCMOVB
FCMOVE
FCMOVBE
FCMOVU
FUCOMPP
FISTTP
FCMOVNB
FCMOVNE
FCMOVNBE
FCMOVNU
FEDISI
FSETPM
FUCOMI
FNCLEX
FNINIT
FRSTOR
FUCOMP
FNSAVE
FNSTSW
FCOMPP
FSUBRP
FDIVRP
FUCOMIP
FCOMIP
MOVSXD
bad allocation
(null)
`h````
xpxxxx
Unknown exception
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
CorExitProcess
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
`h`hhh
xppwpp
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
 Complete Object Locator'
 Class Hierarchy Descriptor'
 Base Class Array'
 Base Class Descriptor at (
 Type Descriptor'
`local static thread guard'
`managed vector copy constructor iterator'
`vector vbase copy constructor iterator'
`vector copy constructor iterator'
`dynamic atexit destructor for '
`dynamic initializer for '
`eh vector vbase copy constructor iterator'
`eh vector copy constructor iterator'
`managed vector destructor iterator'
`managed vector constructor iterator'
`placement delete[] closure'
`placement delete closure'
`omni callsig'
 delete[]
 new[]
`local vftable constructor closure'
`local vftable'
`udt returning'
`copy constructor closure'
`eh vector vbase constructor iterator'
`eh vector destructor iterator'
`eh vector constructor iterator'
`virtual displacement map'
`vector vbase constructor iterator'
`vector destructor iterator'
`vector constructor iterator'
`scalar deleting destructor'
`default constructor closure'
`vector deleting destructor'
`vbase destructor'
`string'
`local static guard'
`typeof'
`vcall'
`vbtable'
`vftable'
operator
 delete
__unaligned
__restrict
__ptr64
__eabi
__clrcall
__fastcall
__thiscall
__stdcall
__pascal
__cdecl
__based(
GetProcessWindowStation
GetUserObjectInformationW
GetLastActivePopup
GetActiveWindow
MessageBoxW
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
"%s","%d","%s","%d","windows","FindWindowW","FAILURE","","lpClassName->%s","lpWindowName->%s"
"%s","%d","%s","%d","windows","FindWindowW","SUCCESS","0x%08x","lpClassName->%s","lpWindowName->%s"
"%s","%d","%s","%d","windows","FindWindowW","FAILURE","","lpClassName->%ws","lpWindowName->%ws"
FILE:%s
FILE:%ws
"%s","%d","%s","%d","windows","FindWindowW","SUCCESS","0x%08x","lpClassName->%ws","lpWindowName->%ws"
"%s","%d","%s","%d","synchronization","CreateMutexA","FAIL","","lpName->%s"
"%s","%d","%s","%d","synchronization","CreateMutexA","SUCCESS","0x%08x","lpName->%s"
"%s","%d","%s","%d","synchronization","CreateMutexW","FAIL","","lpName->%ws"
"%s","%d","%s","%d","synchronization","CreateMutexW","SUCCESS","0x%08x","lpName->%ws"
"%s","%d","%s","%d","synchronization","OpenMutexA","FAILURE","","dwDesiredAccess->%s","lpName->%s"
"%s","%d","%s","%d","synchronization","OpenMutexA","SUCCESS","0x%08x","dwDesiredAccess->%s","lpName->%s"
python.exe
"%s","%d","%s","%d","synchronization","OpenMutexW","FAILURE","","dwDesiredAccess->%s","lpName->%ws"
"%s","%d","%s","%d","synchronization","OpenMutexW","SUCCESS","0x%08x","dwDesiredAccess->%s","lpName->%ws"
FILE:%ws
"%s","%d","%s","%d","services","OpenSCManagerA","FAILURE","","lpMachineName->%s","lpDatabaseName->%s","dwDesiredAccess->%s"
"%s","%d","%s","%d","services","OpenSCManagerA","SUCCESS","0x%08x","lpMachineName->%s","lpDatabaseName->%s","dwDesiredAccess->%s"
"%s","%d","%s","%d","system","IsDebuggerPresent","",""
"%s","%d","%s","%d","services","OpenSCManagerW","FAILURE","","lpMachineName->%ws","lpDatabaseName->%ws","dwDesiredAccess->%s"
"%s","%d","%s","%d","services","OpenSCManagerW","SUCCESS","0x%08x","lpMachineName->%ws","lpDatabaseName->%ws","dwDesiredAccess->%s"
"%s","%d","%s","%d","services","CreateServiceA","FAILURE","","lpServiceName->%s","dwServiceType->%s","dwStartType->%s","lpBinaryPathName->%s"
"%s","%d","%s","%d","services","CreateServiceA","FAILURE","0x%08x","lpServiceName->%s","dwServiceType->%s","dwStartType->%s","lpBinaryPathName->%s"
"%s","%d","%s","%d","services","CreateServiceW","FAILURE","","lpServiceName->%ws","dwServiceType->%s","dwStartType->%s","lpBinaryPathName->%ws"
PID:%d
FILE:%s
FILE:%ws
"%s","%d","%s","%d","services","CreateServiceW","SUCCESS","0x%08x","lpServiceName->%ws","dwServiceType->%s","dwStartType->%s","lpBinaryPathName->%ws"
"%s","%d","%s","%d","services","OpenServiceW","FAILURE","","lpServiceName->%s","dwDesiredAccess->%s"
"%s","%d","%s","%d","services","OpenServiceW","SUCCESS","0x%08x","lpServiceName->%s","dwDesiredAccess->%s"
"%s","%d","%s","%d","services","OpenServiceW","FAILURE","","lpServiceName->%ws","dwDesiredAccess->%s"
"%s","%d","%s","%d","services","OpenServiceW","SUCCESS","0x%08x","lpServiceName->%ws","dwDesiredAccess->%s"
"%s","%d","%s","%d","services","StartServiceW","FAILURE","","hService->0x%08x","lpServiceArgVectors->%s"
FILE:%s
C:\cuckoo\
"%s","%d","%s","%d","services","StartServiceW","SUCCESS","","hService->0x%08x","lpServiceArgVectors->%s"
%sfiles\%s
"%s","%d","%s","%d","services","StartServiceW","FAILURE","","hService->0x%08x","lpServiceArgVectors->%ws"
C:\cuckoo\
"%s","%d","%s","%d","services","StartServiceW","SUCCESS","","hService->0x%08x","lpServiceArgVectors->%ws"
%sfiles\%s
"%s","%d","%s","%d","services","ControlService","FAILURE","","hService->0x%08x","dwControl->%s"
PID:%d
GetCurrentProcessId
"%s","%d","%s","%d","services","ControlService","SUCCESS","","hService->0x%08x","dwControl->%s"
PID:%d
Kernel32
"%s","%d","%s","%d","services","DeleteService","FAILURE","","hService->0x%08x"
PID:%d
%d%02d%02d%02d%02d%02d.%03d
"%s","%d","%s","%d","services","DeleteService","SUCCESS","","hService->0x%08x"
PID:%d
GENERIC_ALL
"%s","%d","%s","%d","registry","RegOpenKeyW","SUCCESS","0x%08x","hKey->%s","lpSubKey->%ws"
"%s","%d","%s","%d","registry","RegOpenKeyW","FAILURE","","hKey->%s","lpSubKey->%ws"
explorer.exe
"%s","%d","%s","%d","registry","RegOpenKeyA","SUCCESS","0x%08x","hKey->%s","lpSubKey->%s"
ATTRIBUTES
"%s","%d","%s","%d","registry","RegOpenKeyA","FAILURE","","hKey->%s","lpSubKey->%s"
explorer.exe
"%s","%d","%s","%d","registry","RegOpenKeyExA","SUCCESS","0x%08x","hKey->%s","lpSubKey->%s"
"%s","%d","%s","%d","registry","RegOpenKeyExA","FAILURE","","hKey->%s","lpSubKey->%s"
explorer.exe
"%s","%d","%s","%d","registry","RegOpenKeyExW","SUCCESS","0x%08x","hKey->%s","lpSubKey->%ws"
"%s","%d","%s","%d","registry","RegOpenKeyExW","FAILURE","","hKey->%s","lpSubKey->%ws"
explorer.exe
PID:%d
GENERIC_EXECUTE
HKEY_CLASSES_ROOT
"%s","%d","%s","%d","registry","RegCreateKeyW","SUCCESS","0x%08x","hKey->%s","lpSubKey->%s"
"%s","%d","%s","%d","registry","RegCreateKeyW","FAILURE","","hKey->%s","lpSubKey->%s"
explorer.exe
"%s","%d","%s","%d","registry","RegCreateKeyW","SUCCESS","0x%08x","hKey->%s","lpSubKey->%ws"
"%s","%d","%s","%d","registry","RegCreateKeyW","FAILURE","","hKey->%s","lpSubKey->%ws"
explorer.exe
GENERIC_WRITE
0x%08x
HKEY_CURRENT_CONFIG
"%s","%d","%s","%d","registry","RegCreateKeyExW","SUCCESS","0x%08x","hKey->%s","lpSubKey->%s"
"%s","%d","%s","%d","registry","RegCreateKeyExW","FAILURE","","hKey->%s","lpSubKey->%s"
explorer.exe
HKEY_CURRENT_USER
"%s","%d","%s","%d","registry","RegCreateKeyExW","SUCCESS","0x%08x","hKey->%s","lpSubKey->%ws"
HKEY_LOCAL_MACHINE
"%s","%d","%s","%d","registry","RegCreateKeyExW","FAILURE","","hKey->%s","lpSubKey->%ws"
explorer.exe
HKEY_USERS
"%s","%d","%s","%d","registry","RegDeleteKeyA","SUCCESS","","hKey->%s","lpSubKey->%s"
"%s","%d","%s","%d","registry","RegDeleteKeyA","FAILURE","","hKey->%s","lpSubKey->%s"
explorer.exe
"%s","%d","%s","%d","registry","RegDeleteKeyW","SUCCESS","","hKey->%s","lpSubKey->%ws"
0x%08x
"%s","%d","%s","%d","registry","RegDeleteKeyW","FAILURE","","hKey->%s","lpSubKey->%ws"
explorer.exe
"%s","%d","%s","%d","registry","RegEnumKeyExW","SUCCESS","%ws","hKey->%s","dwIndex->%d"
"%s","%d","%s","%d","registry","RegEnumKeyExW","FAILURE","","hKey->%s","dwIndex->%d"
explorer.exe
"%s","%d","%s","%d","registry","RegEnumValueW","SUCCESS","%ws","hKey->%s","dwIndex->%d"
SERVICE_ADAPTER
SERVICE_FILE_SYSTEM_DRIVER
"%s","%d","%s","%d","registry","RegEnumValueW","FAILURE","","hKey->%s","dwIndex->%d"
explorer.exe
"%s","%d","%s","%d","registry","RegSetValueExA","SUCCESS","","hKey->%s","lpValueName->%s","dwType->%d","lpData->%s","cbData->%d"
SERVICE_RECOGNIZER_DRIVER
"%s","%d","%s","%d","registry","RegSetValueExA","FAILURE","","hKey->%s","lpValueName->%s","dwType->%d","lpData->%s","cbData->%d"
explorer.exe
SERVICE_KERNEL_DRIVER
SERVICE_WIN32_OWN_PROCESS
"%s","%d","%s","%d","registry","RegSetValueExW","SUCCESS","","hKey->%s","lpValueName->%ws","dwType->%d","lpData->%ws","cbData->%d"
"%s","%d","%s","%d","registry","RegSetValueExW","FAILURE","","hKey->%s","lpValueName->%ws","dwType->%d","lpData->%ws","cbData->%d"
explorer.exe
"%s","%d","%s","%d","registry","RegQueryValueExW","SUCCESS","","hKey->%s","lpValueName->%ws"
"%s","%d","%s","%d","registry","RegQueryValueExW","FAILURE","","hKey->%s","lpValueName->%ws"
explorer.exe
"%s","%d","%s","%d","process","CreateProcessA","FAILURE","","lpApplicationName->%s","lpCommandLine->%s"
SERVICE_WIN32_SHARE_PROCESS
"%s","%d","%s","%d","process","CreateProcessA","SUCCESS","%d","lpApplicationName->%s","lpCommandLine->%s"
SERVICE_AUTO_START
"%s","%d","%s","%d","process","CreateProcessW","FAILURE","","lpApplicationName->%ws","lpCommandLine->%ws"
SERVICE_BOOT_START
"%s","%d","%s","%d","process","CreateProcessW","SUCCESS","%d","lpApplicationName->%ws","lpCommandLine->%ws"
"%s","%d","%s","%d","process","TerminateProcess","FAILURE","","uExitCode->%d","th32ProcessID->%d","szExeFile->%s"
SERVICE_DISABLED
"%s","%d","%s","%d","process","TerminateProcess","SUCCESS","","uExitCode->%d","th32ProcessID->%d","szExeFile->%s"
SC_MANAGER_CREATE_SERVICE
"%s","%d","%s","%d","process","ExitProcess","","","uExitCode->0x%08x"
"%s","%d","%s","%d","process","ShellExecuteExW","SUCCESS","","lpVerb->%s","lpFile->%s","lpParameters->%s","lpDirectory->%s","hProcess->0x%08x"
0x%08x
SC_MANAGER_CONNECT
"%s","%d","%s","%d","process","ShellExecuteExW","FAILURE","","lpVerb->%s","lpFile->%s","lpParameters->%s","lpDirectory->%s","hProcess->0x%08x"
0x%08x
SC_MANAGER_LOCK
SERVICE_ALL_ACCESS
"%s","%d","%s","%d","process","ShellExecuteExW","SUCCESS","","lpVerb->%ws","lpFile->%ws","lpParameters->%ws","lpDirectory->%ws","hProcess->0x%08x"
"%s","%d","%s","%d","process","ShellExecuteExW","FAILURE","","lpVerb->%ws","lpFile->%ws","lpParameters->%ws","lpDirectory->%ws","hProcess->0x%08x"
"%s","%d","%s","%d","process","CreateThread","FAILURE","","lpStartAddress->0x%08x"
"%s","%d","%s","%d","process","CreateThread","SUCCESS","0x%08x","lpStartAddress->0x%08x"
SERVICE_INTERROGATE
"%s","%d","%s","%d","process","CreateRemoteThread","FAILURE","","lpStartAddress->0x%08x","th32ProcessID->%d","szExeFile->%s"
"%s","%d","%s","%d","process","CreateRemoteThread","SUCCESS","0x%08x","lpStartAddress->0x%08x","th32ProcessID->%d","szExeFile->%s"
"%s","%d","%s","%d","process","WinExec","SUCCESS","","lpCmdLine->%s"
"%s","%d","%s","%d","process","WinExec","FAILURE","","lpCmdLine->%s"
"%s","%d","%s","%d","process","CreateProcessInternalA","FAILURE","","lpApplicationName->%s","lpCommandLine->%s"
SERVICE_PAUSE_CONTINUE
WRITE_DAC
"%s","%d","%s","%d","process","CreateProcessInternalA","SUCCESS","%d","lpApplicationName->%s","lpCommandLine->%s"
WRITE_OWNER
"%s","%d","%s","%d","process","CreateProcessInternalW","FAILURE","","lpApplicationName->%ws","lpCommandLine->%ws"
GENERIC_ALL
"%s","%d","%s","%d","process","CreateProcessInternalW","SUCCESS","%d","lpApplicationName->%ws","lpCommandLine->%ws"
"%s","%d","%s","%d","network","URLDownloadToFileA","SUCCESS","S_OK","szURL->%s","szFileName->%s"
GENERIC_EXECUTE
SERVICE_CONTROL_CONTINUE
"%s","%d","%s","%d","network","URLDownloadToFileA","FAILURE","E_OUTOFMEMORY","szURL->%s","szFileName->%s"
SERVICE_CONTROL_INTERROGATE
"%s","%d","%s","%d","network","URLDownloadToFileA","FAILURE","INET_E_DOWNLOAD_FAILURE","szURL->%s","szFileName->%s"
"%s","%d","%s","%d","network","URLDownloadToFileW","SUCCESS","S_OK","szURL->%ws","szFileName->%ws"
"%s","%d","%s","%d","network","URLDownloadToFileW","FAILURE","E_OUTOFMEMORY","szURL->%ws","szFileName->%ws"
"%s","%d","%s","%d","network","URLDownloadToFileW","FAILURE","INET_E_DOWNLOAD_FAILURE","szURL->%ws","szFileName->%ws"
"%s","%d","%s","%d","network","InternetOpenUrlW","FAILURE","","lpszUrl->%s","lpszHeaders->%s","dwFlags->%s"
"%s","%d","%s","%d","network","InternetOpenUrlW","SUCCESS","0x%08x","lpszUrl->%s","lpszHeaders->%s","dwFlags->%s"
SERVICE_CONTROL_NETBINDADD
"%s","%d","%s","%d","network","InternetOpenUrlW","FAILURE","","lpszUrl->%ws","lpszHeaders->%ws","dwFlags->%s"
"%s","%d","%s","%d","network","InternetOpenUrlW","SUCCESS","0x%08x","lpszUrl->%ws","lpszHeaders->%ws","dwFlags->%s"
"%s","%d","%s","%d","system","Sleep","","","dwMilliseconds->INFINITE"
"%s","%d","%s","%d","system","Sleep","","","dwMilliseconds->%d"
ACCESS_SYSTEM_SECURITY
SERVICE_CONTROL_PARAMCHANGE
"%s","%d","%s","%d","system","LoadLibraryA","FAILURE","","lpFileName->%s"
SYNCHRONIZE
"%s","%d","%s","%d","system","LoadLibraryA","SUCCESS","0x%08x","lpFileName->%s"
DELETE
WRITE_DAC
"%s","%d","%s","%d","system","LoadLibraryW","FAILURE","","lpFileName->%ws"
"%s","%d","%s","%d","system","LoadLibraryW","SUCCESS","0x%08x","lpFileName->%ws"
WRITE_OWNER
"%s","%d","%s","%d","system","ExitWindowsEx","","","uFlags->%s","dwReason->%s"
SC_MANAGER_ALL_ACCESS
0x%08x
EVENT_ALL_ACCESS
"%s","%d","%s","%d","memory","VirtualAllocEx","FAILURE","","th32ProcessID->%d","szExeFile->%s","lpAddress->0x%08x","dwSize->%d","flAllocationType->0x%08x","flProtect->0x%08x"
SC_MANAGER_MODIFY_BOOT_CONFIG
SERVICE_CONTROL_NETBINDDISABLE
EVENT_MODIFY_STATE
"%s","%d","%s","%d","memory","VirtualAllocEx","SUCCESS","0x%08x","th32ProcessID->%d","szExeFile->%s","lpAddress->0x%08x","dwSize->%d","flAllocationType->0x%08x","flProtect->0x%08x"
"%s","%d","%s","%d","memory","WriteProcessMemory","FAILURE","","lpBaseAddress->0x%08x","lpBuffer->0x%08x","nSize->%d","th32ProcessID->%d","szExeFile->%s"
MUTEX_ALL_ACCESS
"%s","%d","%s","%d","memory","WriteProcessMemory","SUCCESS","","lpBaseAddress->0x%08x","lpBuffer->0x%08x","nSize->%d","th32ProcessID->%d","szExeFile->%s"
MUTEX_MODIFY_STATE
"%s","%d","%s","%d","memory","ReadProcessMemory","FAILURE","","th32ProcessID->%d","szExeFile->%s","lpBaseAddress->0x%08x","nSize->%d"
"%s","%d","%s","%d","memory","ReadProcessMemory","SUCCESS","","th32ProcessID->%d","szExeFile->%s","lpBaseAddress->0x%08x","nSize->%d"
"%s","%d","%s","%d","hooking","SetWindowsHookExA","FAILURE","","idHook->%s","lpfn->0x%08x","hMod->0x%08x","dwThreadId->0x%08x"
SERVICE_CHANGE_CONFIG
0x%08x
TIMER_ALL_ACCESS
"%s","%d","%s","%d","hooking","SetWindowsHookExA","SUCCESS","0x%08x","idHook->%s","lpfn->0x%08x","hMod->0x%08x","dwThreadId->0x%08x"
"%s","%d","%s","%d","hooking","SetWindowsHookExW","FAILURE","","idHook->%s","lpfn->0x%08x","hMod->0x%08x","dwThreadId->0x%08x"
SERVICE_START
DELETE
TIMER_MODIFY_STATE
"%s","%d","%s","%d","hooking","SetWindowsHookExW","SUCCESS","0x%08x","idHook->%s","lpfn->0x%08x","hMod->0x%08x","dwThreadId->0x%08x"
"%s","%d","%s","%d","filesystem","CreateFileA","FAILURE","","lpFileName->%s","dwDesiredAccess->%s"
"%s","%d","%s","%d","filesystem","CreateFileA","SUCCESS","0x%08x","lpFileName->%s","dwDesiredAccess->%s"
TIMER_QUERY_STATE
"%s","%d","%s","%d","filesystem","CreateFileW","FAILURE","","lpFileName->%ws","dwDesiredAccess->%s"
"%s","%d","%s","%d","filesystem","CreateFileW","SUCCESS","0x%08x","lpFileName->%ws","dwDesiredAccess->%s"
INTERNET_FLAG_NO_COOKIES
"%s","%d","%s","%d","filesystem","ReadFile","SUCCESS","","hFile->0x%08x","nNumberOfBytesToRead->%d"
"%s","%d","%s","%d","filesystem","ReadFile","FAILURE","","hFile->0x%08x","nNumberOfBytesToRead->%d"
"%s","%d","%s","%d","filesystem","ReadFileEx","SUCCESS","","hFile->0x%08x","nNumberOfBytesToRead->%d"
"%s","%d","%s","%d","filesystem","ReadFileEx","FAILURE","","hFile->0x%08x","nNumberOfBytesToRead->%d"
"%s","%d","%s","%d","filesystem","WriteFile","SUCCESS","","hFile->0x%08x","nNumberOfBytesToWrite->%d"
"%s","%d","%s","%d","filesystem","WriteFile","FAILURE","","hFile->0x%08x","nNumberOfBytesToWrite->%d"
"%s","%d","%s","%d","filesystem","WriteFileEx","SUCCESS","","hFile->0x%08x","nNumberOfBytesToWrite->%d"
SEMAPHORE_MODIFY_STATE
INTERNET_FLAG_HYPERLINK
INTERNET_FLAG_NO_UI
"%s","%d","%s","%d","filesystem","WriteFileEx","FAILURE","","hFile->0x%08x","nNumberOfBytesToWrite->%d"
0x%08x
INTERNET_FLAG_NEED_FILE
INTERNET_FLAG_RESYNCHRONIZE
"%s","%d","%s","%d","filesystem","DeleteFileA","SUCCESS","","lpFileName->%s"
"%s","%d","%s","%d","filesystem","DeleteFileA","FAILURE","","lpFileName->%s"
"%s","%d","%s","%d","filesystem","DeleteFileW","SUCCESS","","lpFileName->%ws"
"%s","%d","%s","%d","filesystem","DeleteFileW","FAILURE","","lpFileName->%ws"
"%s","%d","%s","%d","filesystem","MoveFileExW","SUCCESS","","lpExistingFileName->%s","lpNewFileName->%s"
EWX_LOGOFF
"%s","%d","%s","%d","filesystem","MoveFileExW","FAILURE","","lpExistingFileName->%s","lpNewFileName->%s"
EWX_REBOOT
"%s","%d","%s","%d","filesystem","MoveFileExW","SUCCESS","","lpExistingFileName->%ws","lpNewFileName->%ws"
"%s","%d","%s","%d","filesystem","MoveFileExW","FAILURE","","lpExistingFileName->%ws","lpNewFileName->%ws"
"%s","%d","%s","%d","filesystem","MoveFileWithProgressA","SUCCESS","","lpExistingFileName->%s","lpNewFileName->%s"
"%s","%d","%s","%d","filesystem","MoveFileWithProgressA","FAILURE","","lpExistingFileName->%s","lpNewFileName->%s"
"%s","%d","%s","%d","filesystem","MoveFileWithProgressW","SUCCESS","","lpExistingFileName->%ws","lpNewFileName->%ws"
"%s","%d","%s","%d","filesystem","MoveFileWithProgressW","FAILURE","","lpExistingFileName->%ws","lpNewFileName->%ws"
"%s","%d","%s","%d","filesystem","CopyFileA","SUCCESS","","lpExistingFileName->%s","lpNewFileName->%s"
GENERIC_WRITE
INTERNET_FLAG_EXISTING_CONNECT
EWX_RESTARTAPPS
SHTDN_REASON_MAJOR_HARDWARE
"%s","%d","%s","%d","filesystem","CopyFileA","FAILURE","","lpExistingFileName->%s","lpNewFileName->%s"
SERVICE_CONTROL_NETBINDENABLE
INTERNET_FLAG_IGNORE_CERT_DATE_INVALID
SHTDN_REASON_MAJOR_OPERATINGSYSTEM
"%s","%d","%s","%d","filesystem","CopyFileW","SUCCESS","","lpExistingFileName->%ws","lpNewFileName->%ws"
SHTDN_REASON_MAJOR_OTHER
"%s","%d","%s","%d","filesystem","CopyFileW","FAILURE","","lpExistingFileName->%ws","lpNewFileName->%ws"
SHTDN_REASON_MAJOR_POWER
"%s","%d","%s","%d","filesystem","CopyFileExA","SUCCESS","","lpExistingFileName->%s","lpNewFileName->%s"
SHTDN_REASON_MAJOR_SOFTWARE
"%s","%d","%s","%d","filesystem","CopyFileExA","FAILURE","","lpExistingFileName->%s","lpNewFileName->%s"
SHTDN_REASON_MAJOR_SYSTEM
"%s","%d","%s","%d","filesystem","CopyFileExW","SUCCESS","","lpExistingFileName->%ws","lpNewFileName->%ws"
"%s","%d","%s","%d","filesystem","CopyFileExW","FAILURE","","lpExistingFileName->%ws","lpNewFileName->%ws"
"%s","%d","%s","%d","filesystem","ReplaceFileA","SUCCESS","","lpReplacedFileName->%s","lpReplacementFileName->%s"
WH_CALLWNDPROCRET
"%s","%d","%s","%d","filesystem","ReplaceFileA","FAILURE","","lpReplacedFileName->%s","lpReplacementFileName->%s"
WH_DEBUG
"%s","%d","%s","%d","filesystem","ReplaceFileW","SUCCESS","","lpReplacedFileName->%ws","lpReplacementFileName->%ws"
"%s","%d","%s","%d","filesystem","ReplaceFileW","FAILURE","","lpReplacedFileName->%ws","lpReplacementFileName->%ws"
"%s","%d","%s","%d","device","DeviceIoControl","FAILURE","","hDevice->0x%08x","dwIoControlCode->0x%08x","lpInBuffer->0x%08x","nInBufferSize->0x%08x","lpOutBuffer->0x%08x","nOutBufferSize->0x%08x","lpBytesReturned->0x%08x","lpOverlapped->0x%08x"
"%s","%d","%s","%d","device","DeviceIoControl","SUCCESS","","hDevice->0x%08x","dwIoControlCode->0x%08x","lpInBuffer->0x%08x","nInBufferSize->0x%08x","lpOutBuffer->0x%08x","nOutBufferSize->0x%08x","lpBytesReturned->0x%08x","lpOverlapped->0x%08x"
GENERIC_READ
GENERIC_READ | GENERIC_WRITE
SERVICE_DEMAND_START
SERVICE_SYSTEM_START
SC_MANAGER_ENUMERATE_SERVICE
SC_MANAGER_QUERY_LOCK_STATUS
SERVICE_ENUMERATE_DEPENDENTS
SERVICE_QUERY_CONFIG
SERVICE_QUERY_STATUS
SERVICE_STOP
SERVICE_USER_DEFINED_CONTROL
READ_CONTROL
GENERIC_READ
SERVICE_CONTROL_NETBINDREMOVE
SERVICE_CONTROL_PAUSE
SERVICE_CONTROL_STOP
READ_CONTROL
SEMAPHORE_ALL_ACCESS
INTERNET_FLAG_IGNORE_CERT_CN_INVALID
INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP
INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS
INTERNET_FLAG_KEEP_CONNECTION
INTERNET_FLAG_NO_AUTH
INTERNET_FLAG_NO_AUTO_REDIRECT
INTERNET_FLAG_NO_CACHE_WRITE
INTERNET_FLAG_PASSIVE
INTERNET_FLAG_PRAGMA_NOCACHE
INTERNET_FLAG_RAW_DATA
INTERNET_FLAG_RELOAD
INTERNET_FLAG_SECURE
0x%08x
EWX_POWEROFF
EWX_SHUTDOWN
0x%08x
SHTDN_REASON_MAJOR_APPLICATION
SHTDN_REASON_MAJOR_LEGACY_API
0x%08x
WH_CALLWNDPROC
WH_CBT
WH_FOREGROUNDIDLE
WH_GETMESSAGE
WH_JOURNALPLAYBACK
WH_JOURNALRECORD
WH_KEYBOARD
WH_KEYBOARD_LL
WH_MOUSE
WH_MOUSE_LL
WH_MSGFILTER
WH_SHELL
WH_SYSMSGFILTER
kernel32.dll
CreateProcessInternalW
C:\cuckoo\
%slogs\%d.csv
RSDSHGjl
C:\Documents and Settings\emartinez\Escritorio\cmonitor\Release\cmonitor.pdb
ExitProcess
CreateMutexW
CopyFileExW
CreateRemoteThread
WriteFile
LoadLibraryW
ReadProcessMemory
TerminateProcess
ReplaceFileW
ReadFile
CreateFileW
OpenMutexW
GetProcAddress
ReadFileEx
VirtualAllocEx
LoadLibraryA
DeviceIoControl
IsDebuggerPresent
WinExec
WriteFileEx
DeleteFileW
GetCurrentProcessId
MoveFileWithProgressW
WriteProcessMemory
CreateThread
WideCharToMultiByte
GetSystemTime
GetCurrentProcess
Process32First
WaitForSingleObject
GetLastError
Process32Next
GetExitCodeThread
GetModuleHandleA
CreateToolhelp32Snapshot
DuplicateHandle
CloseHandle
MultiByteToWideChar
CreateFileA
SetFilePointer
WaitNamedPipeW
KERNEL32.dll
FindWindowA
SetWindowsHookExW
SetWindowsHookExA
ExitWindowsEx
FindWindowW
USER32.dll
CreateServiceW
OpenServiceA
DeleteService
OpenSCManagerW
OpenServiceW
RegSetValueExA
RegCreateKeyExW
CreateServiceA
RegQueryValueExW
RegDeleteKeyA
RegDeleteKeyW
StartServiceA
RegCreateKeyExA
RegOpenKeyExA
StartServiceW
OpenSCManagerA
RegEnumValueW
RegOpenKeyExW
ControlService
RegEnumKeyExW
RegSetValueExW
ADVAPI32.dll
ShellExecuteExW
ShellExecuteExA
SHELL32.dll
WS2_32.dll
InternetOpenUrlW
WININET.dll
URLDownloadToFileW
urlmon.dll
GetTickCount
VirtualProtect
OutputDebugStringA
HeapFree
GetCurrentThreadId
DecodePointer
GetCommandLineA
HeapReAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
EncodePointer
IsProcessorFeaturePresent
HeapAlloc
HeapCreate
HeapDestroy
RaiseException
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
InterlockedDecrement
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetModuleFileNameW
RtlUnwind
SetStdHandle
WriteConsoleW
LCMapStringW
GetStringTypeW
FlushFileBuffers
0123456789abcdef00
##%%&'%#&'&'
 !"#$%&'()*+,-./0123456789
 !"#$%&'()*+,-./
 !"#$%&'()*+,-./012345678
 !"#$%&'()*+
,-./0123456789:;
 !"#$%&'(
$%&'()*+,-./0123
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGXZ
!"#$%&'()*+,-.
/0123456789
<=>?@ABCDE
FGHIJKLMNO
PQRSTUVWXY
 !"#$%&'()
-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdef
ghijklmnopqrstuvwxyz{|}~
 !"#$%&
'()*+,-
./01234
56789:;
<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`
abcdefghijklmnopqrstuvwxyz{|}~
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVtype_info@@
                          
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
                          
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
31Z1c1w3
6.6?6P6a6r6
9$:E:T:
<(=D=\=`=d=h=l=
:D;H;L;P;T;X;\;`;
3.4Q4X4@5
3`3d3h3l3p3t3x3|3
4 4$4(4,4044484<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
41585P5T5X5
70:4:8:<:@:D:H:L:P:T:X:\:`:
=%=j>t>
242;2C2H2L2P2y2
2*3034383<3
3'4Y4`4d4h4l4p4t4x4|4
7M7S7X7`7p7z7
7;8s8x8
9L9R9X9m9
9&:S:#;);5;l;
<Y=a=v=
>K?Z?u?
>!>g>m>w>o?{?
0o1t1}1
122a2g2v2
2/3;3B3N3T3`3f3o3u3~3
444t4z4
576G6M6Y6_6o6u6{6
7!7&7,70767;7A7F7U7k7q7y7~7
838<8H8
:3:>:X:c:k:{:
;#<h<o<
>(>M>X>g>
2"2'2H2M2q2
6*6S6[6
020D0J0d0s0
1$1.1T1
5)535F5j5
858N8j8s8y8
<C<I<O<_<j<~=
:B;b;g;
<[<s<}<
>1>?>E>h>o>
0?0E0M0
0_1h1n1
455H5`5
7!8L8m8v8
2*2<2N2`2r2
3 3'3.363>3F3R3[3`3f3p3y3
4&4+4<4D4J4T4Z4d4j4t4}4
7U8o8x8
020T0a0x0
2:2Z2z2
3:3Z3z3
5!5J5j5
606S6v6
6"7E7h7
878W8w8
9&9I9l9
:2:O:l:
;*;J;g;
<-<M<m<
=3=S=s=
?(?C?j?
*0J0j0
202P2k2
3#3@3[3
5(5/5=5D5R5Y5g5n5|5
6$6+696@6N6U6c6j6x6
7 7'757<7J7Q7_7f7t7{7
8#81888F8M8[8b8p8w8
8%9+999C9K9Q9X9f9l9s9
:#:):0:>:D:K:Y:_:f:t:z:
;#;1;7;>;L;R;Y;g;m;t;
<!<'<.<<<B<I<W<]<d<r<x<
=!=/=5=<=J=P=W=e=k=r=
>">(>/>=>C>J>X>^>e>s>y>
>(?.?3?[?m?
0%0+050L0
1%1+151L1
2&2J2P2V2`2w2
3&3,313;3\3b3g3q3
4#4)434P4V4[4e4{4
5A5G5L5V5w5}5
5%6I6O6U6_6
6%7I7O7U7_7
778q8w8|8
:H;N;T;^;
<8=>=D=N={=
0 0*0S0Y0^0h0~0#1]1c1h1r1
4$4.4O4U4Z4d4z4
4#5]5c5i5s5
8%8+858V8\8b8l8
;$;*;0;:;P;U;g;
<N<T<Z<d<
=%>+>1>;>Q>V>h>$?
0^1d1i1s1
1A2b2h2n2x2
4%424L4r4
4-5l5r5x5
93999>9K9d9
:P:V:\:f:
:M;r;x;};
<L<-=3=9=C=Z=
22282>2K2e2
7?7E7J7T7j7
8M8S8X8b8
8Q9u9{9
=)=F=L=Q=[=q=
>B>H>M>W>x>~>
>-?R?X?]?g?
=0b0h0m0w0
0M1r1x1}1
4V4\4a4k4
5 6'6,6P6W6\6
7@7G7L7p7w7|7
80878<8`8g8l8
8 9'9,9P9W9\9
:@:G:L:p:w:|:
;0;7;<;`;g;l;
; <'<,<P<W<\<
=@=G=L=p=w=|=
>0>7><>`>g>l>
> ?'?,?P?W?\?
0@0G0L0p0w0|0
10171<1`1g1l1
1 2'2,2P2W2\2
3@3G3L3p3w3|3
2 2$2(2,2024282<2@2D2H2L2P2T2X2\2`2d2h2l2p2t2x2|2
3 3$3(3,3034383<3H3L3P3T3`3d3
6$6,646<6D6L6
5 5$5(5,5054585<5@5D5H5L5P5T5X5\5`5d5h5l5p5t5x5|5
6 6$6(6,6064686<6@6D6H6
5 585<5T5d5h5|5
6$6,6@6`6|6
707P7p7
808L8P8p8
:<:@:H:L:
:8;<;@;D;H;L;P;X;\;
<l<p<t<x<|<
=$>(>,>0>4>8><>@>D>H>L>P>T>X>\>`>d>h>l>p>t>x>|>
?0?4?<?@?l?p?x?|?
\0`0d0h0l0p0t0x0|0
1$2(2,2024282<2@2D2H2L2P2T2X2\2`2d2h2l2p2t2x2|2
3,30383<3h3l3t3x3|4
5 5$5(5,5054585<5@5D5H5L5P5T5X5\5`5d5l5p5\6`6d6h6l6p6t6x6|6
74787@7D7p7t7|7
: :$:(:,:0:4:8:<:@:D:H:L:P:T:(;,;x;|;
< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\<`<d<h<l<p<t<x<|<
=(>,>0>4>8><>@>D>L>P>
?(?0?4?
4080<0@0D0H0L0P0X0\0x0
2 2$2(2,20242<2@2
3 3(3,3p3t3x3
3 4$4(40444x4|4
4(5,50585<5
5064686@6D6
687<7@7H7L7
7084888@8D8
889<9@9H9L9
9@:D:H:P:T:
;@<D<H<P<T<
=H=L=P=X=\=
>P>T>X>`>d>
?X?\?`?h?l?
0`0d0h0p0t0
1 1$1(10141x1|1
1(2,20282<2
2H3L3P3T3\3`3
3h4l4p4t4|4
4L5P5T5\5`54686<6@6D6H6L6P6X6\6
7T7X7`7d7
8 8$8(8,80848<8@8
8D9H9L9P9T9\9`9
90:4:8:<:D:H:
:0;4;<;@;
;4<8<<<D<H<
< =$=,=0=t=x=|=
>L>P>T>\>`>
> ?$?(?0?4?x?|?
0P1T1X1\1`1h1l1
2 2$2\2`2h2l2
3`3d3h3p3t3
4 4$4h4l4p4x4|4
5 5(5,5p5t5x5
5 6$6(60646x6|6
6074787<7@7D7H7L7T7X7
9<:@:D:H:L:P:X:\:
= =$=(=0=4=
?`?d?h?l?t?x?
0 0$0(0,0004080@0D0
1P1T1\1`1
2L2P2X2\2
3H3L3T3X3
4D4H4P4T4
4@5D5L5P5|5
6X6\6d6h6
7l7p7t7|7
8$8(8l8p8x8|8
9 9$9h9l9t9x9
:0:8:<:h:p:t:|;
<0<4<<<@<l<p<x<|<
=D=H=P=T=
>H>P>T>
>(?0?4?`?h?l?
0@0H0L0x0
0 1(1,1X1`1d1
282@2D2p2x2|2
3 3$3P3X3\3
40484<4h4p4t4
5L5P5X5\5
5$6(60646l6p6x6|6
7D7H7P7T7
8 8(8,8d8h8p8t8
9<9@9H9L9
:0:8:<:h:p:t:
;<;@;H;L;
< <$<\<`<h<l<
<4=8=@=D=
=8><>@>H>L>x>
>,?0?8?<?h?p?t?
0H0P0T0
1`1d1h1p1t1
2 2$2h2l2p2x2|2
3 3(3,3p3t3x3
3 4$4(40444x4|4
6 6$6(6,6064686<6@6D6H6L6P6T6X6\6`6d6h6l6p6t6x6|6
7 7$7(7,7074787<7@7D7H7L7P7T7X7\7`7d7h7p7t7
7D8H8L8P8X8\8
8d9h9l9p9t9x9
;H<L<P<T<\<`<
=h=l=p=t=|=
=P>T>X>\>d>h>
? ?$?(?,?0?4?<?@?
0 0$0(0,0004080@0D0
1 1$1(1,1014181<1D1H1p2t2|3
5P6T6X6\6`6d6l6p6L<P<T<X<\<`<d<h<l<p<t<x<|<
= =$=(=,=0=4=8=<=@=D=H=L=P=T=X=\=`=d=h=l=p=t=x=|=
> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\>`>d>h>l>p>t>x>|>
? ?$?(?,?0?4?8?<?@?D?H?L?P?T?X?\?`?d?h?l?p?t?x?|?
t9x9|9
: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:
; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;|;
< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\<`<d<h<l<p<t<x<|<
= =$=(=,=0=4=8=<=@=H=L=
X6X7\7`7d7h7l7p7t7x7|7
8 8$8(8,8084888<8@8D8H8L8P8T8X8\8`8d8h8l8p8t8x8|8
9(989H9X9|9
;(;,;0;4;8;<;@;D;H;L;P;
TBKpRR.dll
SysObjects
MusicCore
MusicCore
Track.Key
MusicCore
Track.ModifiedTime
MusicCore
Track.Title
MusicCore
Track.TitleSortOrder
MusicCore
Track.TrackNumber
MusicCore
Track.ReleaseTime
MusicCore
Track.Duration
MusicCore
Track.FileUrlExText
MusicCore
Track.FileUrlExBit
MusicCore
Track.FileUrl
MusicCore
Track.FileSize
MusicCore
Track.Bitrate
MusicCore
Track.MediaClassPrimaryId
MusicCore
Track.MediaClassSecondaryId
MusicCore
Track.WMContentId
MusicCore
Track.TrackingId
MusicCore
Track.FileType
MusicCore
Track.UpdateTime
MusicCore
Track.FileSyncTime
MusicCore
Track.DatabaseDirty
MusicCore
Track.SubscriptionContentID
MusicCore
Track.MetadataProviderRequestState
MusicCore
Track.MetadataProviderRequestTime
MusicCore
Track.PeakValue
MusicCore
Track.AverageValue
MusicCore
Track.FakeTitle
MusicCore
Track.MetadataNeedsWork
MusicCore
Track.Mood
MusicCore
Composer.MultipleCount
MusicCore
Track.Composer.Name
MusicCore
Genre.MultipleCount
MusicCore
Genre.Name
MusicCore
Artist.MultipleCount
MusicCore
Artist.Name
MusicCore
Artist.SortOrder
MusicCore
Album.Title
MusicCore
Album.TitleSortOrder
MusicCore
Album.AlbumArtist
MusicCore
Album.AlbumArtistSortOrder
MusicCore
Album.WMCollectionId
MusicExtended
Writer.MultipleCount
MusicExtended
Track.Writer.Name
MusicExtended
Conductor.MultipleCount
MusicExtended
Track.Conductor.Name
MusicExtended
Language.MultipleCount
MusicExtended
Track.Language.Name
MusicExtended
Publisher.MultipleCount
MusicExtended
Track.Publisher.Name
MusicExtended
Album.TOCExText
MusicExtended
Album.TOCExBit
MusicExtended
Album.TOC
MusicExtended
Album.WMCollectionGroupId
MusicExtended
Album.ProviderName
MusicExtended
Album.ProviderRating
MusicExtended
Album.ProviderStyle
MusicExtended
Album.SmallArtUrl
MusicExtended
Album.LargeArtUrl
MusicExtended
Album.BuyUrl
MusicExtended
Album.BuyTicketParams
MusicExtended
Album.MoreInfoUrl
MusicExtended
Album.ProviderUrl
MusicExtended
Album.ProviderLogoUrl
MusicCore
Track.Key
MusicExtended
Track.KeyEx
MusicCore
Track.Title
MusicCore
Track.ReleaseTime
MusicCore
Track.Duration
MusicCore
Track.FileUrl
MusicCore
Track.Bitrate
MusicCore
Track.MediaClassSecondaryId
MusicCore
Track.WMContentId
MusicCore
Track.TrackingId
MusicExtended
Track.AcquisitonTime
MusicCore
Track.DatabaseDirty
MusicCore
Track.MetadataProviderRequestState
MusicCore
Track.MetadataProviderRequestTime
MusicCore
Track.MetadataNeedsWork
MusicCore
Genre.Name
MusicCore
Genre.NameMultIndex
MusicCore
Artist.Name
MusicCore
Artist.NameMultIndex
MusicCore
Album.Title
MusicExtended
Album.TOC
MusicCore
Album.WMCollectionId
MusicExtended
Album.WMCollectionGroupId
MusicCore
Album.AlbumId
MusicCore
User.LastPlayedTime
MusicCore
User.Rating
MusicCore
User.EffectiveRating
MusicCore
User.Playcount.Total
MusicCore
User.EffectiveRatingComputed
MusicCore
Track.ResultSortOrder1
MusicCore
Track.ResultSortOrder2
MusicCore
Track.ResultSortOrder3
MusicCore
Track.ResultSortOrder4
SysObjects
VideoCore
VideoCore
Video.Key
VideoCore
Video.Title
VideoCore
Video.TitleSortOrder
VideoCore
Video.Duration
VideoCore
Video.FileUrlExText
VideoCore
Video.FileUrlExBit
VideoCore
Video.FileUrl
VideoCore
Video.FileSize
VideoCore
Video.Bitrate
VideoCore
Video.MediaClassPrimaryId
VideoCore
Video.MediaClassSecondaryId
VideoCore
Video.DVDID
VideoCore
Video.TrackingId
VideoCore
Video.FileType
VideoCore
Video.UpdateTime
VideoCore
Video.FileSyncTime
VideoCore
Video.DatabaseDirty
VideoCore
Video.FakeTitle
VideoCore
Genre.MultipleCount
MusicCore
Album.AlbumId
MusicCore
User.LastPlayedTime
MusicCore
User.Rating
MusicCore
User.EffectiveRating
MusicCore
User.ServiceRating
MusicCore
User.Playcount.Total
MusicCore
User.Playcount.Morning
MusicCore
User.Playcount.Afternoon
MusicCore
User.Playcount.Evening
MusicCore
User.Playcount.Night
MusicCore
User.Playcount.Weekday
MusicCore
User.Playcount.Weekend
MusicCore
User.Custom1
MusicCore
User.Custom2
MusicCore
User.EffectiveRatingComputed
MusicCore
Track.ResultSortOrder1
MusicCore
Track.ResultSortOrder2
MusicCore
Track.ResultSortOrder3
MusicCore
Track.ResultSortOrder4
SysObjects
MusicExtended
MusicExtended
Track.KeyEx
MusicExtended
Track.PerformingGroup
MusicExtended
Track.RecordingTime
MusicExtended
Track.ContentGroupDescription
MusicExtended
Track.SubTitle
MusicExtended
Track.FileLinkTracking
MusicExtended
Track.Protected
MusicExtended
Track.ProtectionType
MusicExtended
Track.EncodingTime
MusicExtended
Track.ParentalRating
MusicExtended
Track.InitialKey
MusicExtended
Track.Copyright
MusicExtended
Track.AcquisitonTime
MusicExtended
Track.MediaType
MusicExtended
Track.MetadataState
MusicExtended
Track.Category
MusicExtended
Track.UniqueFileIdentifiers
MusicExtended
Track.Period
MusicExtended
Track.ContentDistributor
MusicExtended
Track.Lyrics
Favorites -- 4 and 5 star rated
High bitrate media in my library
Low bitrate media in my library
Favorites -- One Data CD-R worth
Music tracks I have not rated
Music tracks I dislike
Music tracks with content protection
Favorites -- Have not heard recently
Favorites -- Listen to at night
Favorites -- One Audio CD worth
Favorites -- Listen to on Weekends
Favorites -- Listen to on Weekdays
Fresh tracks -- yet to be played
Fresh tracks -- yet to be rated
Fresh tracks
VideoCore
Genre.Name
VideoCore
Actor.MultipleCount
VideoCore
Actor.Name
VideoCore
Actor.SortOrder
VideoCore
User.LastPlayedTime
VideoCore
User.Rating
VideoCore
User.EffectiveRating
VideoCore
User.ServiceRating
VideoCore
User.Playcount.Total
VideoCore
User.Playcount.Morning
VideoCore
User.Playcount.Afternoon
VideoCore
User.Playcount.Evening
VideoCore
User.Playcount.Night
VideoCore
User.Playcount.Weekday
VideoCore
User.Playcount.Weekend
VideoCore
User.Custom1
VideoCore
User.Custom2
VideoCore
User.EffectiveRatingComputed
SysObjects
VideoExtended
VideoExtended
Video.KeyEx
VideoExtended
Video.RecordingTime
VideoExtended
Video.ReleaseTime
VideoExtended
Video.FileLinkTracking
VideoExtended
Video.Protected
VideoExtended
Video.ProtectionType
VideoExtended
Video.VideoHeight
VideoExtended
Video.VideoWidth
VideoExtended
Video.VideoFrameRate
VideoExtended
Video.EncodingTime
VideoExtended
Video.ParentalRating
VideoExtended
Video.Copyright
VideoExtended
Video.AcquisitonTime
VideoExtended
Video.MediaType
VideoExtended
Video.ProviderName
VideoExtended
Video.ProviderRating
VideoExtended
Video.ProviderStyle
VideoExtended
Video.ContentDistributor
VideoExtended
Video.Category
VideoExtended
Video.SubscriptionContentID
VideoExtended
Writer.MultipleCount
OtherCore
Other.AcquisitonTime
OtherCore
Other.FileType
OtherCore
Other.MediaType
OtherCore
Other.Category
OtherCore
Other.UpdateTime
OtherCore
Other.FileSyncTime
OtherCore
Other.DatabaseDirty
OtherCore
Other.FakeTitle
OtherCore
Genre.MultipleCount
OtherCore
Genre.Name
OtherCore
User.LastPlayedTime
OtherCore
User.Rating
OtherCore
User.EffectiveRating
OtherCore
User.ServiceRating
OtherCore
User.Playcount.Total
OtherCore
User.Playcount.Morning
OtherCore
User.Playcount.Afternoon
OtherCore
User.Playcount.Evening
OtherCore
User.Playcount.Night
OtherCore
User.Playcount.Weekday
OtherCore
User.Playcount.Weekend
OtherCore
User.Custom1
OtherCore
User.Custom2
OtherCore
User.EffectiveRatingComputed
OtherCore
Other.Key
OtherCore
Other.Title
OtherCore
Other.FileUrl
OtherCore
Other.Bitrate
OtherCore
Other.MediaClassSecondaryId
OtherCore
Other.TrackingId
OtherCore
Other.DatabaseDirty
OtherCore
Genre.Name
OtherCore
Genre.NameMultIndex
OtherCore
User.LastPlayedTime
OtherCore
User.Rating
OtherCore
User.EffectiveRating
OtherCore
User.Playcount.Total
OtherCore
User.EffectiveRatingComputed
SysObjects
DeletedFilesCore
VideoExtended
Video.Writer.Name
VideoExtended
Producer.MultipleCount
VideoExtended
Video.Producer.Name
VideoExtended
Director.MultipleCount
VideoExtended
Video.Director.Name
VideoExtended
Publisher.MultipleCount
VideoExtended
Video.Publisher.Name
VideoExtended
Language.MultipleCount
VideoExtended
Video.Language.Name
VideoCore
Video.Key
VideoExtended
Video.KeyEx
VideoCore
Video.Title
VideoExtended
Video.ReleaseTime
VideoCore
Video.Duration
VideoCore
Video.FileUrl
VideoCore
Video.Bitrate
VideoCore
Video.MediaClassSecondaryId
VideoCore
Video.DVDID
VideoCore
Video.TrackingId
VideoCore
Video.DatabaseDirty
VideoCore
Genre.Name
VideoCore
Genre.NameMultIndex
VideoCore
Actor.Name
VideoCore
Actor.NameMultIndex
VideoCore
User.LastPlayedTime
VideoCore
User.Rating
VideoCore
User.EffectiveRating
VideoCore
User.Playcount.Total
VideoCore
User.EffectiveRatingComputed
SysObjects
PlaylistCore
PlaylistCore
Playlist.Key
PlaylistCore
Playlist.Title
PlaylistCore
Playlist.Author
PlaylistCore
Playlist.FileUrlExText
PlaylistCore
Playlist.FileUrlExBit
PlaylistCore
Playlist.FileUrl
PlaylistCore
Playlist.FileLinkTracking
Favorites -- 4 and 5 star rated
High bitrate media in my library
Low bitrate media in my library
Favorites -- One Data CD-R worth
Music tracks I have not rated
Music tracks I dislike
Music tracks with content protection
Favorites -- Have not heard recently
Favorites -- Listen to at night
Favorites -- One Audio CD worth
Favorites -- Listen to on Weekends
Favorites -- Listen to on Weekdays
Fresh tracks -- yet to be played
Fresh tracks -- yet to be rated
Fresh tracks
Like Humans Do (radio edit)
Sample Playlist
David Byrne
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst1.wpl
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst10.wpl
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst11.wpl
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst12.wpl
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst13.wpl
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst14.wpl
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst15.wpl
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst2.wpl
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst3.wpl
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst4.wpl
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst5.wpl
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst6.wpl
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst7.wpl
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst8.wpl
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst9.wpl
C:\Documents and Settings\All Users\Documents\My Music\music.asx
C:\Documents and Settings\All Users\Documents\My Music\My Playlists\Sample Playlist.wpl
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst1.wpl
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst10.wpl
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst11.wpl
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst12.wpl
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst13.wpl
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst14.wpl
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst15.wpl
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst2.wpl
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst3.wpl
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst4.wpl
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst5.wpl
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst6.wpl
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst7.wpl
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst8.wpl
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst9.wpl
DeletedFilesCore
DeletedFiles.Key
DeletedFilesCore
DeletedFiles.FileUrlExText
DeletedFilesCore
DeletedFiles.FileUrlExBit
DeletedFilesCore
DeletedFiles.FileUrl
DeletedFilesCore
DeletedFiles.Key
DeletedFilesCore
DeletedFiles.FileUrl
SysObjects
MetadataRequestCore
MetadataRequestCore
MetadataRequest.Key
MetadataRequestCore
MetadataRequest.TOCorDVDIDExText
MetadataRequestCore
MetadataRequest.TOCorDVDIDExBit
MetadataRequestCore
MetadataRequest.TOCorDVDID
MetadataRequestCore
MetadataRequest.CollectionID
MetadataRequestCore
MetadataRequest.MDRDocument
MetadataRequestCore
MetadataRequest.Locale
MetadataRequestCore
MetadataRequest.Pending
MetadataRequestCore
MetadataRequest.Downloaded
MetadataRequestCore
MetadataRequest.ISCD
MetadataRequestCore
MetadataRequest.RequestID
MetadataRequestCore
MetadataRequest.Validated
MetadataRequestCore
MetadataRequest.Key
MetadataRequestCore
MetadataRequest.TOCorDVDID
MetadataRequestCore
MetadataRequest.CollectionID
MetadataRequestCore
MetadataRequest.Locale
MetadataRequestCore
MetadataRequest.Pending
MetadataRequestCore
MetadataRequest.Downloaded
MetadataRequestCore
MetadataRequest.ISCD
MetadataRequestCore
MetadataRequest.Validated
MetadataRequestCore
MetadataRequestUniqueID
PlaylistCore
Playlist.CreationTime
PlaylistCore
Playlist.MediaClassPrimaryId
PlaylistCore
Playlist.MediaClassSecondaryId
PlaylistCore
Playlist.TrackingId
PlaylistCore
Playlist.AcquisitonTime
PlaylistCore
Playlist.FileType
PlaylistCore
Playlist.MediaType
PlaylistCore
Playlist.Category
PlaylistCore
Playlist.UpdateTime
PlaylistCore
Playlist.FileSyncTime
PlaylistCore
Playlist.DatabaseDirty
PlaylistCore
Playlist.FakeTitle
PlaylistCore
Genre.MultipleCount
PlaylistCore
Genre.Name
PlaylistCore
User.LastPlayedTime
PlaylistCore
User.Rating
PlaylistCore
User.EffectiveRating
PlaylistCore
User.ServiceRating
PlaylistCore
User.Playcount.Total
PlaylistCore
User.Playcount.Morning
PlaylistCore
User.Playcount.Afternoon
PlaylistCore
User.Playcount.Evening
PlaylistCore
User.Playcount.Night
PlaylistCore
User.Playcount.Weekday
PlaylistCore
User.Playcount.Weekend
PlaylistCore
User.Custom1
PlaylistCore
User.Custom2
PlaylistCore
User.EffectiveRatingComputed
PlaylistCore
Playlist.Key
PlaylistCore
Playlist.Title
PlaylistCore
Playlist.Author
PlaylistCore
Playlist.FileUrl
PlaylistCore
Playlist.MediaClassSecondaryId
PlaylistCore
Playlist.TrackingId
PlaylistCore
Playlist.DatabaseDirty
PlaylistCore
Genre.Name
PlaylistCore
Genre.NameMultIndex
PlaylistCore
User.LastPlayedTime
PlaylistCore
User.Rating
PlaylistCore
User.EffectiveRating
PlaylistCore
User.Playcount.Total
PlaylistCore
User.EffectiveRatingComputed
SysObjects
RadioCore
RadioCore
Track.Key
RadioCore
Radio.Title
RadioCore
Radio.Frequency
RadioCore
Radio.CallSign
RadioCore
Radio.Band
RadioCore
Radio.Location
RadioCore
Radio.Format
RadioCore
Radio.Author
RadioCore
Radio.ProviderName
RadioCore
Radio.Language
RadioCore
Radio.Abstract
RadioCore
Radio.StreamUrlExText
RadioCore
Radio.StreamUrlExBit
RadioCore
Radio.StreamUrl
RadioCore
Radio.Bitrate
RadioCore
Radio.MediaClassPrimaryId
RadioCore
Radio.MediaClassSecondaryId
RadioCore
Radio.AcquisitonTime
RadioCore
Radio.FileType
RadioCore
Radio.MediaType
RadioCore
Track.Key
RadioCore
Radio.StreamUrl
SysObjects
OtherCore
OtherCore
Other.Key
OtherCore
Other.Title
OtherCore
Other.TitleSortOrder
OtherCore
Other.Duration
OtherCore
Other.FileUrlExText
OtherCore
Other.FileUrlExBit
OtherCore
Other.FileUrl
OtherCore
Other.FileLinkTracking
OtherCore
Other.FileSize
OtherCore
Other.Bitrate
OtherCore
Other.MediaClassPrimaryId
OtherCore
Other.MediaClassSecondaryId
OtherCore
Other.TrackingId
Favorites -- Listen to on Weekdays
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst6.wpl
playlist
Fresh tracks -- yet to be rated
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst8.wpl
playlist
Fresh tracks
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst9.wpl
playlist
Like Humans Do (radio edit)
David Byrne
C:\Documents and Settings\All Users\Documents\My Music\music.asx
Sample Playlist
C:\Documents and Settings\All Users\Documents\My Music\My Playlists\Sample Playlist.wpl
playlist
Favorites -- 4 and 5 star rated
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst1.wpl
playlist
High bitrate media in my library
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst10.wpl
playlist
Low bitrate media in my library
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst11.wpl
playlist
Favorites -- One Data CD-R worth
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst12.wpl
playlist
Music tracks I have not rated
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst13.wpl
playlist
Music tracks I dislike
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst14.wpl
playlist
Music tracks with content protection
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst15.wpl
playlist
Favorites -- Have not heard recently
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst2.wpl
playlist
Favorites -- Listen to at night
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst3.wpl
playlist
Favorites -- One Audio CD worth
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst4.wpl
playlist
Favorites -- Listen to on Weekends
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst5.wpl
playlist
Fresh tracks -- yet to be played
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst7.wpl
playlist
Favorites -- Listen to on Weekdays
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst6.wpl
playlist
Fresh tracks -- yet to be rated
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst8.wpl
playlist
Fresh tracks
C:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0018BD9E\Plylst9.wpl
playlist
UserMigratedStore_59R.bin