Warning! We are currently in recovery mode. The complete archive is not available.

Sample details: 424af858ca2bcd6cee976b1936b20113 --

Hashes
MD5: 424af858ca2bcd6cee976b1936b20113
SHA1: 3864ae77940ece5ab9b10c1870669f2c1218586a
SHA256: 177651993450fde3c964b35505b3786a7a384132b4d4d5e71ca1e7a20804108a
SSDEEP: 12288:BBuYUQL/XY+4fRwXzBYZkCPSvk9btYeohlrTB7J:BBumL/46pCPSvopYeArTB7J
Details
File Type: PE32
Yara Hits
YRP/Visual_Cpp_2005_DLL_Microsoft | YRP/Visual_Cpp_2003_DLL_Microsoft | YRP/Armadillo_v4x | YRP/IsPE32 | YRP/IsDLL | YRP/IsWindowsGUI | YRP/HasOverlay | YRP/HasDigitalSignature | YRP/HasRichSignature | YRP/domain | YRP/IP | YRP/url | YRP/contentis_base64 | YRP/WMI_strings | YRP/Check_OutputDebugStringA_iat | YRP/anti_dbg | YRP/antisb_threatExpert | YRP/create_com_service | YRP/win_mutex | YRP/win_registry | YRP/win_files_operation | YRP/MD5_Constants | YRP/Str_Win32_Http_API |
Parent Files
0146b14dea4e6241e2b42e933a712b18
Strings
		!This program cannot be run in DOS mode.
`.rdata
@.data
_ht_set_
gsh1are
@.reloc
NTPWSQ
D$`SVW
\$89|$0r
D$(SVW
F@9^8u
;;8t`j
F@9^8u
F@9^8u
H$99tX
H 99t7
D$XSVW
t$<RPQVS
D$ j@P
RSPQWV
D$ j@P
RSPQWV
M QRPh
L$$j@Q
PSQRWV
M QRPh
L$$j@Q
PSQRWV
D$XjlP
D$lSQRVP
D$XjlP
D$lSQRVP
RSPQVW
D$xSVW
L$$j0Q
D$$j0PS
\$l9D$d
L$,SQV
09|$dr
D$HSVW
<+t'<-t#<0u
L$0)L$,V
D$XSVW
t$<RPQVS
D$ j@P
RSPQWV
D$ j@P
RSPQWV
M QRPh
L$$j@Q
PSQRWV
M QRPh
L$$j@Q
PSQRWV
D$XjlP
D$lSQRVP
D$XjlP
D$lSQRVP
RSPQVW
D$xSVW
L$,<-u
D$ SPW
T$$j0R
L$$j0QS
D$P9t$ds
|$P9t$ds
L$ SQW
09t$dr
D$HSVW
<+t'<-t#<0u
L$0)L$,WR
Nx9^pr
F\9^Tr
V@9^8r
L$`Qj&W
L$lQj&R
T$ RPSQ
SS@PQj
T$(@PQRS
L$P+L$L
L$P+L$L
G$SV9G
t,</t(
9D$0u7
9D$(u7
;8u"Qj
D$xSVW
8_~tg9_ptb
FT;FPt
NT;NPu
FT;FPu
FT;FPt
NT;NPu
FT;FPu
qP9qTt#
rP9rTt#
BT;BPt*
JT;JPu
ST;SPt&
KT;CPu
												
																																												
							
f;A,s7
@(QRSV
																									
																			
																												
																												
SVW=#I
;0u WVj
}Lf	{$
9F@u99
U SQRP
;0u RVj
SVW=CDD
;0u RVj
@SVW_^[
@SVWh0G
x9;~$}4
SVWj>3
QQSVWd
PPPPPPPP
u)jAXf;
PPPPPPPP
t"SS9] u
.t|PVj@
t*=RCC
;7|G;p
tR99u2
^SSSSS
HHtYHHt
j@j ^V
< tK<	tG
>:u8FV
VVVVVQRSSj
v	N+D$
<at,<rt"<wt
URPQQhP~
F Pj*S
F$Pj+Sj
F(Pj,S
F,Pj-S
F0Pj.S
F4Pj/S
F8PjDS
F<PjES
F@PjFS
FDPjGS
FHPjHS
FLPjIS
FPPjJS
FTPjKS
FXPjLS
F\PjMS
F`PjNS
FdPjOS
FhPj8S
FlPj9S
FpPj:S
FtPj;S
FxPj<S
F|Pj=S
C PjPV
C$PjQV
C*PjTV
C+PjUV
C,PjVV
C-PjWV
C.PjRV
C/PjSV
CHPjPV
CLPjQV
;t$,v-
UQPXY]Y[
t VV9u
v	N+D$
tCHt(Ht 
<+t"<-t
+t HHt
UnRegisterTypeLibForUser
RegisterTypeLibForUser
RegOpenKeyTransactedW
UPDATE
Updatedate
d:\devleop\yht-client\project\htproject\source\notewebhepler\../HTUpdate/HTUpdateMgr.h
CRLUpdateMgr::RunUpdatePro
InjectMainIE.cpp
CInjectMainIE::GetHEditAndHBrowser
CRLUpdateMgr::RunUpdate
()$^.*+?[]|\-{},:=!
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_
urlCfgTime
urlCfg
corrupted regex pattern
D:\devleop\yht-client\project\HTProject\Common\LibCommon/ParseJson.h
CParseJson::GetValueByKeyJson
Parse failed! path:
whiteList
source
target
data.hp
data.un
"jsVersion":
IF0GFlwCXAMfRh85QANZWh4wByUGEQMIWRYBHh0Ed18SSkZZPAY
RLExtension.cpp
CRLExtension::NavigateComplete2
CRLExtension::InjectHtmlAElement
try...catch: 
CRLExtension::InjectJSCode
CRLExtension::OnAddingTimer
CRLExtension::DoInject
ChangeWindowMessageFilter
ChangeWindowMessageFilterEx
LEwQEwEDBwtF
CxMuOg5MGkJFFhg
DEBUG@
l	g~b0R
rff-ss1w
other SEH exception
invalide handle exception
divide by zero Exception
NULL Pointer Exception
d:\devleop\yht-client\project\htproject\common\libcommon\filehelper.cpp
CFileHelper::GetParentDir
IsWow64Process
0123456789abcdef
generic
iostream
system
iostream stream error
bad allocation
regular expression error
Unknown exception
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
LC_TIME
LC_NUMERIC
LC_MONETARY
LC_CTYPE
LC_COLLATE
LC_ALL
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
Visual C++ CRT: Not enough memory to complete call to strerror.
bad exception
(null)
`h````
xpxxxx
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
CorExitProcess
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
`h`hhh
xppwpp
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
UTF-16LE
UNICODE
GetProcessWindowStation
GetUserObjectInformationW
GetLastActivePopup
GetActiveWindow
MessageBoxW
united-states
united-kingdom
trinidad & tobago
south-korea
south-africa
south korea
south africa
slovak
puerto-rico
pr-china
pr china
new-zealand
hong-kong
holland
great britain
england
britain
america
swedish-finland
spanish-venezuela
spanish-uruguay
spanish-puerto rico
spanish-peru
spanish-paraguay
spanish-panama
spanish-nicaragua
spanish-modern
spanish-mexican
spanish-honduras
spanish-guatemala
spanish-el salvador
spanish-ecuador
spanish-dominican republic
spanish-costa rica
spanish-colombia
spanish-chile
spanish-bolivia
spanish-argentina
portuguese-brazilian
norwegian-nynorsk
norwegian-bokmal
norwegian
italian-swiss
irish-english
german-swiss
german-luxembourg
german-lichtenstein
german-austrian
french-swiss
french-luxembourg
french-canadian
french-belgian
english-usa
english-us
english-uk
english-trinidad y tobago
english-south africa
english-nz
english-jamaica
english-ire
english-caribbean
english-can
english-belize
english-aus
english-american
dutch-belgian
chinese-traditional
chinese-singapore
chinese-simplified
chinese-hongkong
chinese
canadian
belgian
australian
american-english
american english
american
Norwegian-Nynorsk
Illegal byte sequence
Directory not empty
Function not implemented
No locks available
Filename too long
Resource deadlock avoided
Result too large
Domain error
Broken pipe
Too many links
Read-only file system
Invalid seek
No space left on device
File too large
Inappropriate I/O control operation
Too many open files
Too many open files in system
Invalid argument
Is a directory
Not a directory
No such device
Improper link
File exists
Resource device
Unknown error
Bad address
Permission denied
Not enough space
Resource temporarily unavailable
No child processes
Bad file descriptor
Exec format error
Arg list too long
No such device or address
Input/output error
Interrupted function call
No such process
No such file or directory
Operation not permitted
No error
 Complete Object Locator'
 Class Hierarchy Descriptor'
 Base Class Array'
 Base Class Descriptor at (
 Type Descriptor'
`local static thread guard'
`managed vector copy constructor iterator'
`vector vbase copy constructor iterator'
`vector copy constructor iterator'
`dynamic atexit destructor for '
`dynamic initializer for '
`eh vector vbase copy constructor iterator'
`eh vector copy constructor iterator'
`managed vector destructor iterator'
`managed vector constructor iterator'
`placement delete[] closure'
`placement delete closure'
`omni callsig'
 delete[]
 new[]
`local vftable constructor closure'
`local vftable'
`udt returning'
`copy constructor closure'
`eh vector vbase constructor iterator'
`eh vector destructor iterator'
`eh vector constructor iterator'
`virtual displacement map'
`vector vbase constructor iterator'
`vector destructor iterator'
`vector constructor iterator'
`scalar deleting destructor'
`default constructor closure'
`vector deleting destructor'
`vbase destructor'
`string'
`local static guard'
`typeof'
`vcall'
`vbtable'
`vftable'
operator
 delete
__unaligned
__restrict
__ptr64
__eabi
__clrcall
__fastcall
__thiscall
__stdcall
__pascal
__cdecl
__based(
1#QNAN
1#SNAN
d:\devleop\yht-client\project\htproject\common\libcommon\regcommon.cpp
CRegCommon::ReadRegValue
CRegCommon::WriteRegValue
d:\devleop\yht-client\project\htproject\common\libcommon\idmanager.cpp
IdManager::IdManager
IdManager::Init
IdManager::GetUuid
SELECT SerialNumber,Product FROM Win32_BaseBoard WHERE (SerialNumber IS NOT NULL)
SELECT Manufacturer,Name,ProcessorId FROM Win32_Processor
SELECT MACAddress FROM Win32_NetworkAdapter WHERE (MACAddress IS NOT NULL) AND (NOT (PNPDeviceID LIKE 'ROOT%'))
SELECT Product FROM Win32_BaseBoard WHERE (Product IS NOT NULL)
SELECT SerialNumber FROM Win32_BIOS WHERE (SerialNumber IS NOT NULL)
SELECT ProcessorId FROM Win32_Processor WHERE (ProcessorId IS NOT NULL)
SELECT SerialNumber FROM Win32_BaseBoard WHERE (SerialNumber IS NOT NULL)
SELECT SerialNumber FROM Win32_DiskDrive WHERE (SerialNumber IS NOT NULL) AND (MediaType LIKE 'Fixed hard disk%')
SELECT PNPDeviceID FROM Win32_NetworkAdapter WHERE (MACAddress IS NOT NULL) AND (NOT (PNPDeviceID LIKE 'ROOT%'))
d:\devleop\yht-client\project\htproject\common\libcommon\wmi_devicequery.cpp
WMI_DeviceQuery_Init
WMI_DeviceQuery_Init :
\\.\PhysicalDrive%d
ERROR: Could not open IDE21201.VXD file
DiskId32
\\.\IDE21201.VXD
SCSIDISK
\\.\Scsi%d:
d:\devleop\yht-client\project\htproject\common\libcommon\diskid32.cpp
GetHardDriveComputerID
%02X%02X%02X%02X%02X%02X
 bad locale name
ios_base::badbit set
ios_base::failbit set
ios_base::eofbit set
invalid string position
string too long
bad cast
map/set<T> too long
invalid map/set<T> iterator
haitao
\baseData.ini
SERVER
UserID
Version
2.1.0.0
instPath
CLIENT
LatestDate
LocalDay
ACTIVE
%04d%02d%02d
\htbusiness.ini
ED8FgdFFcFHv3CK8lvx
s-rr1403
SHGetKnownFolderPath
PathHelper.cpp
Catch Exception. Error message is: 
CPathHelper::GetPathFromCSIDL
ActiveDate
&uuid=
&channel=
HttpReport.cpp
http://
client/activate
&activateType=
CHttpReport::ActivateReport
vector<T> too long
CHttpHelper::RequestData
HttpHelper.cpp
/center/
?version=
CHttpHelper::SendReport
Comments must start with /
Type is not convertible to string
A valid JSON document must be either an array or an object value.
Syntax error: value, object or array expected.
Missing ':' after object member name
Missing ',' or '}' in object declaration
Missing '}' or object member name
Missing ',' or ']' in array declaration
' is not a number.
Empty escape sequence in string
Bad escape sequence in string
additional six characters expected to parse unicode surrogate pair.
expecting another \u token to begin the second half of a unicode surrogate pair
Bad unicode escape sequence in string: four digits expected.
Bad unicode escape sequence in string: hexadecimal digit expected.
deque<T> too long
RaiseException
EnterCriticalSection
LeaveCriticalSection
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetProcAddress
GetModuleHandleW
InterlockedIncrement
InterlockedDecrement
GetLocalTime
lstrlenW
GetModuleFileNameW
GetCurrentProcessId
CreateMutexW
OutputDebugStringW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
SetThreadLocale
GetThreadLocale
GetTickCount
Process32NextW
CloseHandle
Process32FirstW
CreateToolhelp32Snapshot
FlushInstructionCache
GetCurrentProcess
SetLastError
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
DeleteFileA
WTSGetActiveConsoleSessionId
CreateFileA
OutputDebugStringA
WaitForSingleObject
TerminateProcess
GetModuleHandleExW
CreateFileW
GetCurrentThreadId
GetTempPathW
FindClose
FindFirstFileW
CreateDirectoryW
GetVersionExW
SetEvent
CreateEventW
LoadLibraryW
FreeLibrary
GlobalFree
KERNEL32.dll
CharNextW
GetClassInfoExW
LoadCursorW
RegisterClassExW
GetParent
DefWindowProcW
SetWindowLongW
GetWindowLongW
KillTimer
CallWindowProcW
IsWindow
GetWindow
IsWindowVisible
GetClassNameW
EnumChildWindows
GetWindowThreadProcessId
SendMessageW
SetTimer
CreateWindowExW
DestroyWindow
SetWindowTextW
ShowWindow
wsprintfW
USER32.dll
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ADVAPI32.dll
ShellExecuteExW
SHGetPathFromIDListW
SHGetFolderLocation
SHELL32.dll
CoCreateInstance
CoTaskMemFree
ole32.dll
OLEAUT32.dll
ATL100.DLL
StrStrIW
PathFileExistsW
SHLWAPI.dll
GetModuleBaseNameA
PSAPI.DLL
MiniDumpWriteDump
dbghelp.dll
WTSQueryUserToken
WTSAPI32.dll
WinHttpCloseHandle
WinHttpOpen
WinHttpSetTimeouts
WinHttpCrackUrl
WinHttpConnect
WinHttpOpenRequest
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpWriteData
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WINHTTP.dll
InterlockedCompareExchange
InterlockedPushEntrySList
HeapFree
GetProcessHeap
HeapAlloc
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
GetStringTypeW
InterlockedExchange
InitializeCriticalSection
EncodePointer
DecodePointer
RtlUnwind
HeapReAlloc
GetCommandLineA
GetSystemTimeAsFileTime
WriteConsoleW
GetFileType
GetStdHandle
LCMapStringW
GetCPInfo
CompareStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
HeapSize
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
WriteFile
GetLocaleInfoW
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointer
FlushFileBuffers
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
SetEndOfFile
SetEnvironmentVariableA
LocalFree
DeviceIoControl
SetPriorityClass
UnregisterClassA
MessageBoxA
RegSetValueExW
RegCreateKeyExW
CoSetProxyBlanket
CoInitializeSecurity
CoInitialize
CoUninitialize
GetAdaptersInfo
IPHLPAPI.DLL
HTDataView.dll
ProcessAddressControl
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
.?AVCNoteWebHeplerModule@@
.?AV?$CAtlDllModuleT@VCNoteWebHeplerModule@@@ATL@@
.?AV?$CAtlModuleT@VCNoteWebHeplerModule@@@ATL@@
.?AVCAtlModule@ATL@@
.?AU_ATL_MODULE70@ATL@@
.?AVCComClassFactory@ATL@@
.?AUIClassFactory@@
.?AUIUnknown@@
.?AV?$CComObjectRootEx@VCComMultiThreadModel@ATL@@@ATL@@
.?AVCComObjectRootBase@ATL@@
.?AV?$CComObjectCached@VCComClassFactory@ATL@@@ATL@@
.?AV?$CTimerWnd@VCRLExtension@@@@
.?AV?$CWindowImpl@V?$CTimerWnd@VCRLExtension@@@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@
.?AV?$CWindowImplBaseT@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@2@@ATL@@
.?AV?$CWindowImplRoot@VCWindow@ATL@@@ATL@@
.?AVCWindow@ATL@@
.?AVCMessageMap@ATL@@
.?AV?$CComObject@VCRLExtension@@@ATL@@
.?AVCRLExtension@@
.?AV?$CComObjectRootEx@VCComSingleThreadModel@ATL@@@ATL@@
.?AV?$CComCoClass@VCRLExtension@@$1?CLSID_RLExtension@@3U_GUID@@B@ATL@@
.?AV?$IObjectWithSiteImpl@VCRLExtension@@@ATL@@
.?AUIObjectWithSite@@
.?AV?$IDispatchImpl@UIRLExtension@@$1?IID_IRLExtension@@3U_GUID@@B$1?LIBID_NoteWebHeplerLib@@3U3@B$00$0A@VCComTypeInfoHolder@ATL@@@ATL@@
.?AUIRLExtension@@
.?AUIDispatch@@
.?AV?$IDispEventImpl@$00VCRLExtension@@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B$1?LIBID_SHDocVw@@3U3@B$00$00VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispEventSimpleImpl@$00VCRLExtension@@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@
.?AV?$_IDispEventLocator@$00$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@
.?AV_IDispEvent@ATL@@
.?AV_Node_base@tr1@std@@
.?AV_Root_node@tr1@std@@
.?AV_Node_end_group@tr1@std@@
.?AV_Node_assert@tr1@std@@
.?AV_Node_capture@tr1@std@@
.?AV_Node_back@tr1@std@@
.?AV_Node_endif@tr1@std@@
.?AV_Node_if@tr1@std@@
.?AV_Node_end_rep@tr1@std@@
.?AV_Node_rep@tr1@std@@
.?AVlogic_error@std@@
.?AV?$_Node_class@_WV?$regex_traits@_W@tr1@std@@@tr1@std@@
.?AV?$collate@_W@std@@
.?AV?$_Node_str@_W@tr1@std@@
.?AVseh_exception_access_violation@@
.?AVseh_exception_divide_by_zero@@
.?AVseh_exception_invalid_handle@@
.?AVseh_exception_base@@
.?AVUrlAddressEdit@@
.?AV?$CWindowImpl@VUrlAddressEdit@@VCWindow@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@
.?AV_Locimp@locale@std@@
.?AVerror_category@std@@
.?AV_Generic_error_category@std@@
.?AV_Iostream_error_category@std@@
.?AV_System_error_category@std@@
.?AVlength_error@std@@
.?AVout_of_range@std@@
.?AVregex_error@tr1@std@@
Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.
.?AVtype_info@@
.?AVbad_exception@std@@
                          
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
                          
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AV_com_error@@
.?AVCHTConfigBase@@
.?AV?$codecvt@DDH@std@@
.?AV?$ctype@D@std@@
.?AUctype_base@std@@
.?AVcodecvt_base@std@@
.?AVfacet@locale@std@@
.?AV?$basic_ofstream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ifstream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_filebuf@DU?$char_traits@D@std@@@std@@
.?AV?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AV?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AV?$basic_iostream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ostream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_istream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_streambuf@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ios@DU?$char_traits@D@std@@@std@@
.?AV?$_Iosb@H@std@@
.?AVios_base@std@@
.?AVruntime_error@std@@
.?AVexception@std@@
.?AVfailure@ios_base@std@@
.?AVsystem_error@std@@
.?AVbad_cast@std@@
.?AVbad_alloc@std@@
.?AVCBaseInfoConfig@@
.?AVCHTConfig@@
.?AV?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AV?$ctype@_W@std@@
.?AV?$numpunct@_W@std@@
.?AV?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@
.?AV?$basic_ios@_WU?$char_traits@_W@std@@@std@@
.?AV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@
.?AV?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@
.?AV?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@
.?AV?$basic_stringbuf@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@
.?AV?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AV?$numpunct@D@std@@
.?AV?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
.?AVCAtlException@ATL@@
.?AVDefaultValueAllocator@Json@@
.?AVValueAllocator@Json@@
    NoRemove SOFTWARE
        NoRemove Microsoft
        {
            NoRemove Windows
            {
                NoRemove CurrentVersion
                {
                    NoRemove Explorer
                    {
                        NoRemove 'Browser Helper Objects'
                        {
                            ForceRemove {97510FAC-ED50-46BF-B2A1-25F434BF1030} = s '
                            {
                                val NoExplorer = d '1'
                            }
                        }
                    }
                }
            }
        }
}PHKCR
	NoRemove CLSID
		ForceRemove {97510FAC-ED50-46BF-B2A1-25F434BF1030} = s '
			ForceRemove Programmable
			InprocServer32 = s '%MODULE%'
				val ThreadingModel = s 'Apartment'
			TypeLib = s '{7237A7B9-A57A-47F7-AA32-542848F408E1}'
			Version = s '1.0'
PAMSFT
stdole2.tlbWWW
NoteWebHeplerLib
RLExtensionWd
8lOIRLExtension
Created by MIDL version 7.00.0555 at Thu Mar 31 14:48:24 2016
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX
797C7X7R8e8
5b6*7B7h:n:
?	?[?e?
)0/0f0x0
2V3e3&656
;&<7<V<i<
162s2"3
8&83859
263H3b3f5x5
=$=7=D=J=\=c= >&>->4>
2+2<2{2
4=5N5j5v5
7%7*7;7
:0H0V0
5 5'5f5u5F6[6v6
5&656]6
888~8&959
:*;J;x;
383?3f3v3
4<4C4v4
697e7p7
:$:+:::
;+;Q;X;
5%5A5a5{5
6!6*656<6K6[6
8'8.8V8d8
9>:n:i;
<(<6<v<
=&>8>t?
2g2{2	3
7K8U8.949f9x9
;%>F>X>{>
M0Z0q0
X2u2F3U334U4v4
;!<M<V<u=
677J8b8
8;8B8W8_8e8j8{8
8F9X9{9
B0I0p0t0x0|0
7"7Z7z7
8(8H8h8
<.<F<v<
0E0c0q0
0 1<1S1k1~1C2^2m2|2
8@>D>H>L>P>T>X>\>`>d>h>l>p>t>x>|>
d1m114
74787<7@7
:/:7:<:B:F:T:}:
;(;U;];b;h;l;z;
= =F=V=
?*?H?L?P?T?X?\?`?d?
0&0A0]0d0
1 1T1Y1l1p1t1x1|1
2M3U3Z3`3d3r3
5*62676=6A6O6
8"8q:y:~:
<9<&=8=
?'?,?2?6?D?
>&?5?g?
3 3$3(3
7P7T7X7\7`7d7h7l7p7t7x7|7
<e=6>G>q>
91<L<9=W=h>
0C2J2p2t2x2|2
606q6w6
7 8-868>8D8J8S8d8j8p8*90969<9A9F9L9R9W9]9u9
:C:K:Q:
	0;0L0t0}0
1(1M1Z1~1
2A3Y3_3
4(424u4
:+;T;~;
=9=>=\=
0 0&0,02070<0B0H0N0W0\0b0h0n0w0|0
0S1^1i1t1
5$606_6f6
;4;G;e;y;
?!?,?7?
0,070F0U0`0k0s0|0
0h1o1v1}1
1&282g2
4!4(4/454t4
7'737J7b7
:::Z:v:1;N;X;i;
?(?1?E?Y?_?e?k?
0-080X0t0/1
3$3H3W3`3o3
4-4B4K4b4
4F5U5l5
9(9 :N:U:
3#3@3I3z3
<F=X=N>
061H1d1k1
9y;&<6<
2B225<5G5P5T5X5\5`5d5h5l5p5t5x5|5
123V3}3
5#6A8t8
>'?9???Z?b?
0&080]0c0.1;1
3)3^3u3
5.6<6A6b6
:0;F;X;
1H1N1X1
272>2T2f2s2
575f5x5
9:9B9I9P9U9^9
11_3j3
505K5]5f5l5r5x5~5
6A6L6Q6[6i6
7(7=7H7V7e7
8%8E8Z8x8
:A:S:e:m:
:O<Z=v?
8D9V9h9z9
;2;T;v;
=&>5>b>
071K1E2
5c7::L:
2)232R2\2f2
566H6#:
?#?4?|?
1 121C1
2#3G3\3
5(5<5]5
0F1U1l1r1
2C2T2v2
657d7j7
9%94999Z9
=R>X>^>d>
?#?,?6?@?\?h?~?
0)0:0@0
4(4.484H4f4
5(50565E5N5
717_7i7
:#:I:T:p:
2#2l2x2
3!3.3@3F3L3S3\3c3i3p3|3
3$4G5M5_5}5
:%;*;3;B;e;j;o;
<<<T<[<c<h<l<p<
=J=P=T=X=\=
	0/0M0T0X0\0`0d0h0l0p0
021=1X1_1d1h1l1
2V2\2`2d2h2
3-4`4f4k4s4
5\5b5P7:8?8E8I8O8S8Y8]8c8g8l8r8v8|8
=9=>=H=|=
;6;E;R;^;n;u;
<&<Y<h<q<
>+?1?@?
"2_2k2
?$?.?Y?a?
0'030j0s0
4*505F5N5
=L=V=a=x?
8!8%8)8-8185898=8A8E8I8M8Q8U8Y8]8a8e8i8
:$:-:M:R:1;C;#<-<:<x<
7C:G:K:O:S:W:[:_:n;
<"<(<1<}<
>$><>W>
?"?*?2?>?G?L?R?\?e?p?|?
0!0'00060?0K0Q0Y0_0k0q0~0
051;1e1k1q1
1?2b2l2
3 30363<3K3Y3c3i3
4,424:4?4G4L4T4Y4`4o4t4z4
42585A5H5j5
6&6+6G6Q6g6r6
6	7/767P7W7
;D<^<o<
>)>D>L>R>`>
;W;d;n;|;
?2?;?A?J?O?^?
262H2v2
6#6?6g6
<>=G=M=R=j=
>!>0>7>D>d>n>
0(111U1[1a1p1v1
2(2/272?2G2P2Y2e2q2~2
6<6E6l6y6~6
7	7,737L7`7f7o7
7:8Z8q8
_0V1m1
8G8Q8i8
=,===J=Q=a=s=x=
P1W1.3F3
3t4y4~4
5V5[5b5g5n5s5
7$7-777B7}7
818C8z8
9Y:k:}:
50F0f0
8P8]8}8
:&;I;[;f;z<
8\;`;d;h;l;p;t;x;
</<M<a<g<
5=5[5n5
747?7m7{7
878D8l8
4%5<5v5
j1n1r1v1z1~1
p0v0{0
8@8L8[8g8
;4;O;Z;
=E>q>z>
9C9^9r9
91:Y:t:
<7=R>f>
+0@1T1
102X2s2
4=4X4l4
4'5L5g5{5
9=9_9z9
0*0:0e0
9l:p:t:x:|:
1!2'2L2V2_2d2l2
485f5x5
6!7<7P7
8,8G8[8
9@9[9o9
9,:T:o:
0.1(2-2<2i2
9":R:r:
2"3B3m3
9#:B:r:
;2;A;\;
=8=Q=Y=p=
>6?R?r?
:=:b:);
7#7(727C7H7R7c7h7r7
8!8'8-82878=8C8H8e8l8t8}8
9:9?9I9j9o9y9
:!:-:9:E:Q:[:p:
;";*;;;E;P;b;j;{;
<"<*<;<E<P<b<j<{<
=$=.=8=V=c=t=
>:>Z>k>u>
l3p3t3x3|3
4<5@5D5H5
6 6$6(6,6064686<6@6D6H6L6P6T6X6\6`6d6h6l6p6t6x6|6
6$7(7,7074787<7@7D7H7L7P7T7X7\7`7d7h7l7p7t7x7|7
8 8$8(8,8084888<8@8D8H84989<9@9D9H9L9P9T9X9\9`9d9h9l9p9t9x9|9
9 =,=8=D=P=\=h=t=
> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\>`>d>h>l>
h5l5p5t5x5
6 6$6(6,6064686<6@6<7@7D7H7L7P7T7X7\7`7d7h7l7p7t7x7|7
8$9(9094989<9@9D9H9T9X9\9`9d9h9l9|9
:0:4:8:<:@:D:H:L:P:T:X:\:`:d:
4$4,444<4D4L4T4\4d4l4t4|4
< <(<0<8<@<H<P<X<`<h<p<x<
= =(=0=8=@=H=P=X=`=h=p=x=
> >(>0>8>@>H>P>X>`>h>
8 8$8(8,8084888<8@8D8H8L8P8T8X8\8`8d8h8l8p8t8x8|8
0(000D0L0P0T0`0h0l0,6064686L6P6
7@8D8h8l8
0<4@4T4X4h4l4p4t4x4|4
545D5H5L5T5l5|5
6$6(6,646L6\6`6h6
7,7074787<7@7D7L7d7t7x7
8 8084888<8@8H8`8p8t8x8|8
9(9094989<9@9D9H9L9P9T9X9\9`9d9h9l9p9t9x9|9
: :$:(:0:H:X:\:`:h:
; ;$;,;D;T;X;\;d;|;
<0<@<D<H<P<h<l<
=(=,=0=4=<=T=d=h=l=t=
>0>4>L>P>h>l>
?$?4?8?H?L?P?X?p?
0,00040<0T0d0h0x0|0
1 181H1L1\1`1d1l1
2,202@2D2H2P2h2x2|2
3$3(3,3034383<3D3\3`3x3
4$4<4L4P4`4d4h4l4t4
5(585<5L5P5X5p5
6,6064686@6X6h6l6|6
7 7$7(707H7X7\7l7p7x7
8$8<8L8P8`8d8l8
9(989<9L9P9T9X9`9x9
: :8:H:L:\:`:h:
;$;4;8;H;L;P;T;X;\;d;|;
<4<D<H<X<\<`<h<
=(=,=0=4=8=@=X=h=l=|=
>$>(>0>H>X>\>l>p>t>x>
?4?D?H?X?\?`?h?
0$0(0,040L0\0`0p0t0x0|0
1,101@1D1T1X1\1d1|1
2 2024282<2@2H2`2p2t2x2|2
3 383H3L3\3`3d3h3l3p3x3
4(484<4L4P4T4\4t4
9(9P9t9
:4:<:D:\:d:l:x:
;,;8;X;`;h;p;|;
<$<H<T<\<x<
=$=,=4=<=D=L=T=\=d=l=t=|=
>$>0>P>\>
?4?<?H?p?
0,0L0T0\0d0l0t0|0
101T1`1h1
242T2\2d2l2t2|2
383@3L3l3t3|3
4$444<4P4X4t4
5 5(50585D5d5l5t5|5
60686@6H6T6x6
7 7(7H7P7X7`7h7p7x7
8 8(848\8
9$9,989X9d9
:(:H:P:X:`:h:p:x:
; ;(;0;8;@;H;P;X;`;h;p;x;
<8<@<H<P<X<`<h<p<x<
= =,=4=X=l=t=|=
> >,>4>T>\>d>l>|>
?,?4?@?`?h?t?
0$0,040@0`0l0
1$1D1P1
2$20282P2X2`2h2p2x2
3 30383D3d3l3x3
4 4(40484@4H4P4X4`4h4p4x4
5(50585@5H5P5X5`5l5
6(606<6\6d6p6
747<7D7P7p7x7
8 8@8H8P8\8|8
9$9,949<9D9P9p9x9
:$:8:@:D:L:T:`:
;4;T;\;d;l;t;|;
<$<0<P<\<|<
= =(=0=8=<=@=H=\=t=x=
>8>X>x>
? ?@?`?
0<0H0P0
1 1@1\1`1|1
202P2p2
303P3p3
4,404P4p4|4
585@5H5P5X5`5h5p5|5
6 6(60686@6H6P6\6|6
7 7(70787@7H7P7X7`7h7p7x7
8 8(80888@8H8P8X8`8h8p8x8
949<9D9L9T9\9d9l9t9|9
:<:\:d:l:t:|:
;$;,;4;<;D;L;T;l;p;x;
< <(<<<D<H<P<X<`<t<|<
=<=P=\=d=|=
> >,>4>d>x>
?4?@?`?l?
0$0,0D0P0p0|0
1 1,1L1T1`1
1$2<2P2\2d2|2
343@3`3h3t3
4(40484@4L4l4t4
5$5D5L5T5\5h5
6$6,686X6d6
7 7,7L7T7\7h7
8 8@8H8P8\8|8
8 949l9
:4:<:D:L:T:\:d:l:t:|:
; ;@;L;l;t;
<,<8<X<`<l<
=8=@=H=P=\=|=
>8>D>d>l>
?$?,?D?L?X?x?
0$0,0D0T0h0t0|0
101<1D1\1l1t1
2$2,2D2L2T2`2
3(383L3X3`3x3
4(484L4`4l4t4
585@5L5t5|5
6,646<6D6L6T6\6d6p6
7,787@7X7`7x7
848D8X8d8l8
9$9,949<9H9h9p9x9
:$:,:4:@:`:h:p:x:
;<;D;L;X;|;
<<<P<\<d<|<
=0=8=@=L=l=x=
>0>8>@>H>P>\>|>
?(?H?h?|?
040@0`0h0p0x0
1$1,141<1D1L1T1\1d1t1|1
2$2,242@2`2h2p2x2
3 3(30383D3d3l3t3
4(4H4T4|4
5(5L5T5\5d5l5t5|5
101L1h1
383T3t3
4D5`5x5
808X8|8
9,9L9p9
:$;H;h;
3 3$3(3,3034383<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|3
4 4$4(4,4044484
5 5$5(5,5054585<5@5D5H5x9@;D;
= =$=(=,=0=4=8=<=@=D=H=L=P=T=X=\=`=d=h=l=p=t=x=|=
182T2t2
6(6D6`6
Western Cape1
Durbanville1
Thawte1
Thawte Certification1
Thawte Timestamping CA0
121221000000Z
201230235959Z0^1
Symantec Corporation100.
'Symantec Time Stamping Services CA - G20
http://ocsp.thawte.com0
.http://crl.thawte.com/ThawteTimestampingCA.crl0
TimeStamp-2048-10
Symantec Corporation100.
'Symantec Time Stamping Services CA - G20
121018000000Z
201229235959Z0b1
Symantec Corporation1402
+Symantec Time Stamping Services Signer - G40
http://ts-ocsp.ws.symantec.com07
+http://ts-aia.ws.symantec.com/tss-ca-g2.cer0<
+http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
TimeStamp-2048-20
WoSign CA Limited1'0%
WoSign Class 3 Code Signing CA0
160214060639Z
170314060639Z0
Shanghai1
Shanghai1<0:
3Shanghai  Zichou Liuhe Network Technology Co., Ltd.1<0:
3Shanghai  Zichou Liuhe Network Technology Co., Ltd.0
'http://ocsp1.wosign.com/class3/code/ca106
*http://aia1.wosign.com/class3.code.ca1.cer07
&http://crls1.wosign.com/ca1-code-3.crl0O
http://www.wosign.com/policy/0
\V	'-"
WoSign CA Limited1*0(
!Certification Authority of WoSign0
090808010005Z
240808010005Z0R1
WoSign CA Limited1'0%
WoSign Class 3 Code Signing CA0
%DEe3F
http://crls1.wosign.com/ca1.crl0o
http://ocsp1.wosign.com/ca106
*http://aia1.wosign.com/ca1-class3-code.cer0
http://www.wosign.com/policy/0
cbf^W	
>'H7G^
StartCom Ltd.1+0)
"Secure Digital Certificate Signing1)0'
 StartCom Certification Authority0
060917224636Z
191231235959Z0U1
WoSign CA Limited1*0(
!Certification Authority of WoSign0
TzQhnw
http://ocsp.startssl.com/ca00
$http://aia.startssl.com/certs/ca.crt02
!http://crl.startssl.com/sfsca.crl0
7CE[2.E
WoSign CA Limited1'0%
WoSign Class 3 Code Signing CA
Xs<CT*
Symantec Corporation100.
'Symantec Time Stamping Services CA - G2
160331102551Z0#