File ReNamerPortable_6.9.paf.exe

Size 3.4MB Resubmit sample
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 3c4ee1546f3e89fec57b9a5a72313073
SHA1 1968af172bf3e934547a0d2078fc191f53a0a748
SHA256 de86dbe1971a59c969617dc26e0072e690a60e7377ee523fb0d756d87b21ab8a
SHA512
9ab24610498a7d847105db427b4cf37fe53ad941b52e84dfd9376dbffc943768ee5fe072f07bdd96817879b562669d753a29ab5bc8876b0c8b3b77a480757c77
CRC32 574085F5
ssdeep 98304:57zhyXylKb7ypzmlWpiSQtBkzHGAqk7Dld+pgpwyL7B0:5fhyX8KUlpYDsHGAhDlfwyfS
Yara
  • IsPE32 -
  • IsWindowsGUI -
  • IsPacked - Entropy Check
  • HasOverlay - Overlay Check
  • HasRichSignature - Rich Signature Check
  • PEiD_00055_Alias_PIX_Vivid_IMG_Graphics_format_ - [Alias PIX/Vivid IMG Graphics format]
  • PEiD_00497_dUP_v2_x_Patcher_____www_diablo2oo2_cjb_net_ - [dUP v2.x Patcher --> www.diablo2oo2.cjb.net]
  • PEiD_01091_Microsoft_Visual_C___8_ - [Microsoft Visual C++ 8]
  • PEiD_01686_Petite_v2_2____www_un4seen_com_petite_ - [Petite v2.2 -> www.un4seen.com/petite]
  • PEiD_02152_StarForce_V3_X_DLL____StarForce_Copy_Protection_System_ - [StarForce V3.X DLL -> StarForce Copy Protection System]
  • Contains_PE_File - Detect a PE file inside a byte sequence
  • escalate_priv - Escalade priviledges
  • screenshot - Take screenshot
  • win_registry - Affect system registries
  • win_token - Affect system token
  • win_files_operation - Affect private profile
  • contentis_base64 - This rule finds for base64 strings
  • CRC32_poly_Constant - Look for CRC32 [poly]
  • maldoc_function_prolog_signature -
  • maldoc_suspicious_strings -

Score

This file shows numerous signs of malicious behavior.

The score of this file is 2.6 out of 10.

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Information on Execution

Category Started Completed Duration Logs
FILE Jan. 9, 2019, 10:10 a.m. Jan. 9, 2019, 10:14 a.m. 257 seconds

Machine

Name Label Started On Shutdown On
winxpsp3pro32 winxpsp3pro32 2019-01-09 10:10:42 2019-01-09 10:14:56

Analyzer Log

2019-01-09 03:11:53,000 [analyzer] DEBUG: Starting analyzer from: C:\xegwaysf
2019-01-09 03:11:53,015 [analyzer] DEBUG: Pipe server name: \\.\PIPE\fOcvuCifLMGcJSDEMUvMucGobpdulKPk
2019-01-09 03:11:53,015 [analyzer] DEBUG: Log pipe server name: \\.\PIPE\fFkpbnrJCNJCGhgU
2019-01-09 03:11:53,015 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically.
2019-01-09 03:11:53,015 [analyzer] INFO: Automatically selected analysis package "exe"
2019-01-09 03:11:54,687 [analyzer] DEBUG: Started auxiliary module Disguise
2019-01-09 03:11:54,890 [analyzer] WARNING: Unable to find the correct offsets for functions of: 32-bit kernel32.dll (with timestamp 0x4802a12c)
2019-01-09 03:11:54,890 [analyzer] WARNING: Unable to find the correct offsets for functions of: 32-bit kernel32.dll (with timestamp 0x4802a12c)
2019-01-09 03:11:54,953 [analyzer] DEBUG: Loaded monitor into process with pid 692
2019-01-09 03:11:54,953 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2019-01-09 03:11:54,953 [analyzer] DEBUG: Started auxiliary module Human
2019-01-09 03:11:54,953 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2019-01-09 03:11:54,953 [analyzer] DEBUG: Started auxiliary module Reboot
2019-01-09 03:11:55,312 [analyzer] DEBUG: Started auxiliary module RecentFiles
2019-01-09 03:11:55,312 [analyzer] DEBUG: Started auxiliary module Screenshots
2019-01-09 03:11:55,453 [lib.api.process] INFO: Successfully executed process from path u'C:\\DOCUME~1\\zamen\\LOCALS~1\\Temp\\ReNamerPortable_6.9.paf.exe' with arguments '' and pid 404
2019-01-09 03:11:55,546 [analyzer] WARNING: Unable to find the correct offsets for functions of: 32-bit kernel32.dll (with timestamp 0x4802a12c)
2019-01-09 03:11:55,546 [analyzer] WARNING: Unable to find the correct offsets for functions of: 32-bit kernel32.dll (with timestamp 0x4802a12c)
2019-01-09 03:11:55,717 [analyzer] DEBUG: Loaded monitor into process with pid 404
2019-01-09 03:11:55,796 [analyzer] DEBUG: Received request to inject pid=404, but we are already injected there.
2019-01-09 03:11:55,953 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\nsi2.tmp
2019-01-09 03:11:56,108 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\nsd3.tmp\LangDLL.dll
2019-01-09 03:11:57,171 [modules.auxiliary.human] INFO: Found button "OK", clicking it
2019-01-09 03:11:58,203 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\nsd3.tmp\System.dll
2019-01-09 03:11:58,312 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\nsd3.tmp\FindProcDLL.dll
2019-01-09 03:11:58,483 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\nsd3.tmp\modern-header.bmp
2019-01-09 03:11:58,500 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\nsd3.tmp\modern-wizard.bmp
2019-01-09 03:11:58,717 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\nsd3.tmp\nsDialogs.dll
2019-01-09 03:11:59,233 [modules.auxiliary.human] INFO: Found button "&Next >", clicking it
2019-01-09 03:12:01,342 [modules.auxiliary.human] INFO: Found button "&Install", clicking it
2019-01-09 03:12:02,390 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\nsd3.tmp\w7tbp.dll
2019-01-09 03:12:02,500 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\ReNamerPortable.exe
2019-01-09 03:12:02,515 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\help.html
2019-01-09 03:12:02,530 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\Readme.txt
2019-01-09 03:12:02,546 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\AppInfo\appicon.ico
2019-01-09 03:12:02,546 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\AppInfo\appicon_128.png
2019-01-09 03:12:02,562 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\AppInfo\appicon_16.png
2019-01-09 03:12:02,562 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\AppInfo\appicon_32.png
2019-01-09 03:12:02,578 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\AppInfo\appicon_75.png
2019-01-09 03:12:02,578 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\AppInfo\appinfo.ini
2019-01-09 03:12:02,578 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\AppInfo\installer.ini
2019-01-09 03:12:02,592 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\AppInfo\pac_installer_log.ini
2019-01-09 03:12:02,608 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\AppInfo\Launcher\ReNamerPortable.ini
2019-01-09 03:12:02,625 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Copyrights.txt
2019-01-09 03:12:02,625 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\History.txt
2019-01-09 03:12:03,250 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\ReNamer.exe
2019-01-09 03:12:03,467 [modules.auxiliary.human] INFO: Found button "&Next >", clicking it
2019-01-09 03:12:03,765 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Help\Quick Guide.pdf
2019-01-09 03:12:04,000 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Help\User Manual.pdf
2019-01-09 03:12:04,203 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.cs.po
2019-01-09 03:12:04,233 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.de.po
2019-01-09 03:12:04,265 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.es.po
2019-01-09 03:12:04,280 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.fr.po
2019-01-09 03:12:04,312 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.id.po
2019-01-09 03:12:04,328 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.it.po
2019-01-09 03:12:04,342 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.ja.po
2019-01-09 03:12:04,375 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.nl_BE.po
2019-01-09 03:12:04,405 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.pl.po
2019-01-09 03:12:04,421 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.po
2019-01-09 03:12:04,437 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.pt_BR.po
2019-01-09 03:12:04,467 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.ru.po
2019-01-09 03:12:04,500 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.sk.po
2019-01-09 03:12:04,530 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.sr.po
2019-01-09 03:12:04,546 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.zh_CN.po
2019-01-09 03:12:04,578 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.zh_TW.po
2019-01-09 03:12:04,592 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ad.png
2019-01-09 03:12:04,608 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ae.png
2019-01-09 03:12:04,608 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\af.png
2019-01-09 03:12:04,608 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ag.png
2019-01-09 03:12:04,625 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ai.png
2019-01-09 03:12:04,625 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\al.png
2019-01-09 03:12:04,625 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\am.png
2019-01-09 03:12:04,640 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\an.png
2019-01-09 03:12:04,640 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ao.png
2019-01-09 03:12:04,640 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ar.png
2019-01-09 03:12:04,655 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\as.png
2019-01-09 03:12:04,655 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\at.png
2019-01-09 03:12:04,655 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\au.png
2019-01-09 03:12:04,671 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\aw.png
2019-01-09 03:12:04,671 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ax.png
2019-01-09 03:12:04,687 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\az.png
2019-01-09 03:12:04,687 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ba.png
2019-01-09 03:12:04,687 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bb.png
2019-01-09 03:12:04,703 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bd.png
2019-01-09 03:12:04,703 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\be.png
2019-01-09 03:12:04,717 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bf.png
2019-01-09 03:12:04,717 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bg.png
2019-01-09 03:12:04,717 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bh.png
2019-01-09 03:12:04,733 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bi.png
2019-01-09 03:12:04,733 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bj.png
2019-01-09 03:12:04,733 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bm.png
2019-01-09 03:12:04,750 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bn.png
2019-01-09 03:12:04,750 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bo.png
2019-01-09 03:12:04,765 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\br.png
2019-01-09 03:12:04,765 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bs.png
2019-01-09 03:12:04,765 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bt.png
2019-01-09 03:12:04,780 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bv.png
2019-01-09 03:12:04,780 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bw.png
2019-01-09 03:12:04,780 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\by.png
2019-01-09 03:12:04,796 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bz.png
2019-01-09 03:12:04,796 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ca.png
2019-01-09 03:12:04,796 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\catalonia.png
2019-01-09 03:12:04,812 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\cc.png
2019-01-09 03:12:04,812 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\cd.png
2019-01-09 03:12:04,828 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\cf.png
2019-01-09 03:12:04,828 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\cg.png
2019-01-09 03:12:04,828 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ch.png
2019-01-09 03:12:04,842 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ci.png
2019-01-09 03:12:04,842 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ck.png
2019-01-09 03:12:04,858 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\cl.png
2019-01-09 03:12:04,858 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\cm.png
2019-01-09 03:12:04,858 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\cn.png
2019-01-09 03:12:04,875 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\co.png
2019-01-09 03:12:04,875 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\cr.png
2019-01-09 03:12:04,875 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\cs.png
2019-01-09 03:12:04,890 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\cu.png
2019-01-09 03:12:04,890 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\cv.png
2019-01-09 03:12:04,890 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\cx.png
2019-01-09 03:12:04,905 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\cy.png
2019-01-09 03:12:04,905 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\cz.png
2019-01-09 03:12:04,905 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\de.png
2019-01-09 03:12:04,921 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\dj.png
2019-01-09 03:12:04,921 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\dk.png
2019-01-09 03:12:04,921 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\dm.png
2019-01-09 03:12:04,937 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\do.png
2019-01-09 03:12:04,937 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\dz.png
2019-01-09 03:12:04,937 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ec.png
2019-01-09 03:12:04,953 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ee.png
2019-01-09 03:12:04,953 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\eg.png
2019-01-09 03:12:04,953 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\eh.png
2019-01-09 03:12:04,967 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\england.png
2019-01-09 03:12:04,967 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\er.png
2019-01-09 03:12:04,983 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\es.png
2019-01-09 03:12:04,983 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\et.png
2019-01-09 03:12:04,983 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\europeanunion.png
2019-01-09 03:12:04,983 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\fam.png
2019-01-09 03:12:05,000 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\fi.png
2019-01-09 03:12:05,000 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\fj.png
2019-01-09 03:12:05,000 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\fk.png
2019-01-09 03:12:05,015 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\fm.png
2019-01-09 03:12:05,015 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\fo.png
2019-01-09 03:12:05,030 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\fr.png
2019-01-09 03:12:05,030 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ga.png
2019-01-09 03:12:05,030 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gb.png
2019-01-09 03:12:05,046 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gd.png
2019-01-09 03:12:05,046 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ge.png
2019-01-09 03:12:05,046 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gf.png
2019-01-09 03:12:05,062 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gh.png
2019-01-09 03:12:05,062 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gi.png
2019-01-09 03:12:05,078 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gl.png
2019-01-09 03:12:05,078 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gm.png
2019-01-09 03:12:05,092 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gn.png
2019-01-09 03:12:05,092 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gp.png
2019-01-09 03:12:05,092 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gq.png
2019-01-09 03:12:05,108 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gr.png
2019-01-09 03:12:05,108 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gs.png
2019-01-09 03:12:05,108 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gt.png
2019-01-09 03:12:05,125 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gu.png
2019-01-09 03:12:05,125 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gw.png
2019-01-09 03:12:05,125 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gy.png
2019-01-09 03:12:05,140 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\hk.png
2019-01-09 03:12:05,140 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\hm.png
2019-01-09 03:12:05,140 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\hn.png
2019-01-09 03:12:05,155 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\hr.png
2019-01-09 03:12:05,155 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ht.png
2019-01-09 03:12:05,155 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\hu.png
2019-01-09 03:12:05,187 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\id.png
2019-01-09 03:12:05,217 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ie.png
2019-01-09 03:12:05,217 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\il.png
2019-01-09 03:12:05,217 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\in.png
2019-01-09 03:12:05,233 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\io.png
2019-01-09 03:12:05,233 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\iq.png
2019-01-09 03:12:05,233 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ir.png
2019-01-09 03:12:05,233 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\is.png
2019-01-09 03:12:05,250 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\it.png
2019-01-09 03:12:05,250 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\jm.png
2019-01-09 03:12:05,250 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\jo.png
2019-01-09 03:12:05,265 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\jp.png
2019-01-09 03:12:05,265 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ke.png
2019-01-09 03:12:05,265 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\kg.png
2019-01-09 03:12:05,280 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\kh.png
2019-01-09 03:12:05,280 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ki.png
2019-01-09 03:12:05,280 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\km.png
2019-01-09 03:12:05,296 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\kn.png
2019-01-09 03:12:05,296 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\kp.png
2019-01-09 03:12:05,296 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\kr.png
2019-01-09 03:12:05,312 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\kw.png
2019-01-09 03:12:05,312 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ky.png
2019-01-09 03:12:05,328 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\kz.png
2019-01-09 03:12:05,328 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\la.png
2019-01-09 03:12:05,328 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\lb.png
2019-01-09 03:12:05,342 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\lc.png
2019-01-09 03:12:05,342 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\li.png
2019-01-09 03:12:05,358 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\lk.png
2019-01-09 03:12:05,358 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\lr.png
2019-01-09 03:12:05,358 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ls.png
2019-01-09 03:12:05,375 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\lt.png
2019-01-09 03:12:05,375 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\lu.png
2019-01-09 03:12:05,375 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\lv.png
2019-01-09 03:12:05,390 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ly.png
2019-01-09 03:12:05,405 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ma.png
2019-01-09 03:12:05,405 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mc.png
2019-01-09 03:12:05,405 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\md.png
2019-01-09 03:12:05,421 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\me.png
2019-01-09 03:12:05,421 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mg.png
2019-01-09 03:12:05,421 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mh.png
2019-01-09 03:12:05,437 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mk.png
2019-01-09 03:12:05,437 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ml.png
2019-01-09 03:12:05,437 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mm.png
2019-01-09 03:12:05,453 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mn.png
2019-01-09 03:12:05,453 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mo.png
2019-01-09 03:12:05,453 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mp.png
2019-01-09 03:12:05,467 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mq.png
2019-01-09 03:12:05,467 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mr.png
2019-01-09 03:12:05,483 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ms.png
2019-01-09 03:12:05,483 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mt.png
2019-01-09 03:12:05,483 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mu.png
2019-01-09 03:12:05,500 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mv.png
2019-01-09 03:12:05,500 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mw.png
2019-01-09 03:12:05,500 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mx.png
2019-01-09 03:12:05,515 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\my.png
2019-01-09 03:12:05,515 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mz.png
2019-01-09 03:12:05,530 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\na.png
2019-01-09 03:12:05,530 [modules.auxiliary.human] INFO: Found button "&Next >", clicking it
2019-01-09 03:12:05,530 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\nc.png
2019-01-09 03:12:05,546 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ne.png
2019-01-09 03:12:05,546 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\nf.png
2019-01-09 03:12:05,546 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ng.png
2019-01-09 03:12:05,562 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ni.png
2019-01-09 03:12:05,562 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\nl.png
2019-01-09 03:12:05,578 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\no.png
2019-01-09 03:12:05,578 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\np.png
2019-01-09 03:12:05,578 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\nr.png
2019-01-09 03:12:05,592 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\nu.png
2019-01-09 03:12:05,592 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\nz.png
2019-01-09 03:12:05,592 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\om.png
2019-01-09 03:12:05,608 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\pa.png
2019-01-09 03:12:05,608 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\pe.png
2019-01-09 03:12:05,608 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\pf.png
2019-01-09 03:12:05,625 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\pg.png
2019-01-09 03:12:05,625 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ph.png
2019-01-09 03:12:05,640 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\pk.png
2019-01-09 03:12:05,640 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\pl.png
2019-01-09 03:12:05,640 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\pm.png
2019-01-09 03:12:05,655 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\pn.png
2019-01-09 03:12:05,655 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\pr.png
2019-01-09 03:12:05,671 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ps.png
2019-01-09 03:12:05,671 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\pt.png
2019-01-09 03:12:05,671 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\pw.png
2019-01-09 03:12:05,687 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\py.png
2019-01-09 03:12:05,687 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\qa.png
2019-01-09 03:12:05,687 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\re.png
2019-01-09 03:12:05,703 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ro.png
2019-01-09 03:12:05,703 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\rs.png
2019-01-09 03:12:05,703 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ru.png
2019-01-09 03:12:05,717 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\rw.png
2019-01-09 03:12:05,717 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sa.png
2019-01-09 03:12:05,717 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sb.png
2019-01-09 03:12:05,733 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sc.png
2019-01-09 03:12:05,733 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\scotland.png
2019-01-09 03:12:05,750 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sd.png
2019-01-09 03:12:05,750 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\se.png
2019-01-09 03:12:05,750 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sg.png
2019-01-09 03:12:05,765 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sh.png
2019-01-09 03:12:05,765 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\si.png
2019-01-09 03:12:05,765 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sj.png
2019-01-09 03:12:05,780 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sk.png
2019-01-09 03:12:05,780 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sl.png
2019-01-09 03:12:05,780 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sm.png
2019-01-09 03:12:05,796 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sn.png
2019-01-09 03:12:05,796 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\so.png
2019-01-09 03:12:05,812 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sr.png
2019-01-09 03:12:05,812 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\st.png
2019-01-09 03:12:05,812 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sv.png
2019-01-09 03:12:05,828 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sy.png
2019-01-09 03:12:05,828 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sz.png
2019-01-09 03:12:05,828 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\tc.png
2019-01-09 03:12:05,842 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\td.png
2019-01-09 03:12:05,842 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\tf.png
2019-01-09 03:12:05,842 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\tg.png
2019-01-09 03:12:05,858 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\th.png
2019-01-09 03:12:05,858 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\tj.png
2019-01-09 03:12:05,858 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\tk.png
2019-01-09 03:12:05,875 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\tl.png
2019-01-09 03:12:05,875 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\tm.png
2019-01-09 03:12:05,890 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\tn.png
2019-01-09 03:12:05,890 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\to.png
2019-01-09 03:12:05,905 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\tr.png
2019-01-09 03:12:05,905 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\tt.png
2019-01-09 03:12:05,905 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\tv.png
2019-01-09 03:12:05,921 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\tw.png
2019-01-09 03:12:05,921 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\tz.png
2019-01-09 03:12:05,921 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ua.png
2019-01-09 03:12:05,937 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ug.png
2019-01-09 03:12:05,937 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\um.png
2019-01-09 03:12:05,937 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\us.png
2019-01-09 03:12:05,953 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\uy.png
2019-01-09 03:12:05,953 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\uz.png
2019-01-09 03:12:05,953 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\va.png
2019-01-09 03:12:05,967 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\vc.png
2019-01-09 03:12:05,967 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ve.png
2019-01-09 03:12:05,967 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\vg.png
2019-01-09 03:12:05,983 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\vi.png
2019-01-09 03:12:05,983 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\vn.png
2019-01-09 03:12:05,983 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\vu.png
2019-01-09 03:12:06,000 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\wales.png
2019-01-09 03:12:06,000 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\wf.png
2019-01-09 03:12:06,000 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ws.png
2019-01-09 03:12:06,015 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ye.png
2019-01-09 03:12:06,015 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\yt.png
2019-01-09 03:12:06,030 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\za.png
2019-01-09 03:12:06,030 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\zm.png
2019-01-09 03:12:06,030 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\zw.png
2019-01-09 03:12:06,062 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.ca.po
2019-01-09 03:12:06,062 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.cs.po
2019-01-09 03:12:06,078 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.de.po
2019-01-09 03:12:06,092 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.es.po
2019-01-09 03:12:06,108 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.fi.po
2019-01-09 03:12:06,108 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.fr.po
2019-01-09 03:12:06,125 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.he.po
2019-01-09 03:12:06,125 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.hu.po
2019-01-09 03:12:06,140 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.id.po
2019-01-09 03:12:06,155 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.it.po
2019-01-09 03:12:06,155 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.ja.po
2019-01-09 03:12:06,187 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.lt.po
2019-01-09 03:12:06,187 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.nl.po
2019-01-09 03:12:06,233 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.no.po
2019-01-09 03:12:06,265 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.pl.po
2019-01-09 03:12:06,280 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.po
2019-01-09 03:12:06,312 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.pt_BR.po
2019-01-09 03:12:06,312 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.ru.po
2019-01-09 03:12:06,328 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.sk.po
2019-01-09 03:12:06,328 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.tr.po
2019-01-09 03:12:06,342 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.uk.po
2019-01-09 03:12:06,358 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.zh_CN.po
2019-01-09 03:12:06,375 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Scripts\Date and Time.pas
2019-01-09 03:12:06,375 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Scripts\Encrypt filenames.pas
2019-01-09 03:12:06,390 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Scripts\Example include file.inc
2019-01-09 03:12:06,405 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Scripts\Hours span.pas
2019-01-09 03:12:06,421 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Scripts\Import DLL functions.pas
2019-01-09 03:12:06,421 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Scripts\Index filenames.pas
2019-01-09 03:12:06,437 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Scripts\Initialize renaming code.pas
2019-01-09 03:12:06,437 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Scripts\Lines from file.pas
2019-01-09 03:12:06,437 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Scripts\Move filename portion.pas
2019-01-09 03:12:06,437 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Scripts\Pad numeric sequences.pas
2019-01-09 03:12:06,453 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Scripts\Serialize duplicates.pas
2019-01-09 03:12:06,453 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Scripts\Use include files.pas
2019-01-09 03:12:06,467 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Scripts\User defined functions.pas
2019-01-09 03:12:06,467 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Bulgarian.txt
2019-01-09 03:12:06,483 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Croatian.txt
2019-01-09 03:12:06,483 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Czech.txt
2019-01-09 03:12:06,483 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\French.txt
2019-01-09 03:12:06,500 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\German.txt
2019-01-09 03:12:06,500 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Greek.txt
2019-01-09 03:12:06,500 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Japanese (Hepburn-shiki).txt
2019-01-09 03:12:06,515 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Japanese (Kunrei-shiki).txt
2019-01-09 03:12:06,515 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Polish.txt
2019-01-09 03:12:06,515 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Portuguese.txt
2019-01-09 03:12:06,530 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Romanian.txt
2019-01-09 03:12:06,530 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Russian (Alternative).txt
2019-01-09 03:12:06,530 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Russian (Latin).txt
2019-01-09 03:12:06,546 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Russian.txt
2019-01-09 03:12:06,546 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Serbian (Cyrillic).txt
2019-01-09 03:12:06,546 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Serbian (Latin).txt
2019-01-09 03:12:06,562 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Slovak.txt
2019-01-09 03:12:06,562 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Spanish.txt
2019-01-09 03:12:06,562 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Turkish.txt
2019-01-09 03:12:06,578 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Ukrainian.txt
2019-01-09 03:12:06,608 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\Other\Help\Images\Donation_Button.png
2019-01-09 03:12:06,608 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\Other\Help\Images\Favicon.ico
2019-01-09 03:12:06,608 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\Other\Help\Images\Help_Background_Footer.png
2019-01-09 03:12:06,625 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\Other\Help\Images\Help_Background_Header.png
2019-01-09 03:12:06,625 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\Other\Help\Images\Help_Logo_Top.png
2019-01-09 03:12:06,640 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\Other\Source\AppNamePortable.ini
2019-01-09 03:12:06,655 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\Other\Source\LauncherLicense.txt
2019-01-09 03:12:06,655 [analyzer] INFO: Added new file to list with pid 404 and path C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\Other\Source\Readme.txt
2019-01-09 03:12:07,592 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:12:09,655 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:12:11,717 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:12:13,780 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:12:15,842 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:12:17,905 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:12:19,967 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:12:22,030 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:12:24,092 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:12:26,155 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:12:28,217 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:12:30,280 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:12:32,342 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:12:34,405 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:12:36,467 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:12:38,530 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:12:40,592 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:12:42,655 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:12:44,717 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:12:46,780 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:12:48,842 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:12:50,905 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:12:52,967 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:12:55,030 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:12:57,092 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:12:59,155 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:13:01,217 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:13:03,280 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:13:05,342 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:13:07,405 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:13:09,467 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:13:11,530 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:13:13,592 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:13:15,655 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:13:17,717 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:13:19,780 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:13:21,842 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:13:23,905 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:13:25,967 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:13:28,030 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:13:30,092 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:13:32,155 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:13:34,233 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:13:36,296 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:13:38,358 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:13:40,421 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:13:42,483 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:13:44,562 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:13:46,625 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:13:48,687 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:13:50,750 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:13:52,812 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:13:54,875 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:13:56,953 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:13:59,015 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:14:01,078 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:14:03,140 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:14:05,203 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:14:07,265 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:14:09,328 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:14:11,390 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:14:13,453 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:14:15,515 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:14:17,578 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:14:19,640 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:14:21,703 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:14:23,765 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:14:25,828 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:14:27,890 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:14:29,953 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:14:32,015 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:14:34,078 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:14:36,140 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:14:38,203 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:14:40,265 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:14:42,358 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:14:44,421 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:14:46,483 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:14:48,562 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:14:50,625 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:14:52,687 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:14:54,750 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:14:56,812 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:14:58,875 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:15:00,937 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:15:03,000 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:15:05,078 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:15:07,140 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:15:09,203 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:15:11,265 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:15:13,328 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:15:15,405 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:15:17,467 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:15:19,546 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:15:21,608 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:15:23,671 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:15:25,733 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:15:27,796 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:15:29,858 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:15:31,921 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:15:33,983 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:15:36,046 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:15:38,108 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:15:40,171 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:15:42,233 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:15:44,296 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:15:46,358 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:15:48,421 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:15:50,483 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:15:52,562 [modules.auxiliary.human] INFO: Found button "&Run ReNamer Portable", clicking it
2019-01-09 03:15:54,530 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2019-01-09 03:15:54,530 [analyzer] INFO: Terminating remaining processes before shutdown.
2019-01-09 03:15:54,530 [lib.api.process] INFO: Successfully terminated process with pid 404.
2019-01-09 03:15:56,625 [analyzer] WARNING: File at path "u'c:\\documents and settings\\zamen\\local settings\\temp\\nsi2.tmp'" does not exist, skip.
2019-01-09 03:15:57,780 [analyzer] INFO: Analysis completed.

Cuckoo Log

2019-01-09 10:10:41,172 [lib.cuckoo.core.scheduler] INFO: Task #615: acquired machine winxpsp3pro32 (label=winxpsp3pro32)
2019-01-09 10:10:41,691 [modules.auxiliary.sniffer] INFO: Started sniffer with PID 3116 (interface=eth2, host=192.168.128.102, pcap=/opt/cuckoo/storage/analyses/615/dump.pcap)
2019-01-09 10:10:48,480 [lib.cuckoo.core.guest] INFO: Starting analysis on guest (id=winxpsp3pro32, ip=192.168.128.102)
2019-01-09 10:14:56,027 [lib.cuckoo.core.guest] INFO: winxpsp3pro32: analysis completed successfully
2019-01-09 10:17:07,713 [lib.cuckoo.core.plugins] WARNING: The processing module "Suricata" returned the following error: Unable to locate Suricata binary
2019-01-09 10:17:19,286 [elasticsearch] WARNING: HEAD http://127.0.0.1:9200/_template/cuckoo_template [status:N/A request:0.000s]
Traceback (most recent call last):
  File "/usr/local/lib/python2.7/dist-packages/elasticsearch/connection/http_urllib3.py", line 94, in perform_request
    response = self.pool.urlopen(method, url, body, retries=False, headers=self.headers, **kw)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 643, in urlopen
    _stacktrace=sys.exc_info()[2])
  File "/usr/local/lib/python2.7/dist-packages/urllib3/util/retry.py", line 251, in increment
    raise six.reraise(type(error), error, _stacktrace)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 594, in urlopen
    chunked=chunked)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 361, in _make_request
    conn.request(method, url, **httplib_request_kw)
  File "/usr/lib/python2.7/httplib.py", line 1017, in request
    self._send_request(method, url, body, headers)
  File "/usr/lib/python2.7/httplib.py", line 1051, in _send_request
    self.endheaders(body)
  File "/usr/lib/python2.7/httplib.py", line 1013, in endheaders
    self._send_output(message_body)
  File "/usr/lib/python2.7/httplib.py", line 864, in _send_output
    self.send(msg)
  File "/usr/lib/python2.7/httplib.py", line 826, in send
    self.connect()
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connection.py", line 163, in connect
    conn = self._new_conn()
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connection.py", line 147, in _new_conn
    self, "Failed to establish a new connection: %s" % e)
NewConnectionError: <urllib3.connection.HTTPConnection object at 0x7f9b5274c390>: Failed to establish a new connection: [Errno 111] Connection refused
2019-01-09 10:17:19,287 [elasticsearch] WARNING: HEAD http://127.0.0.1:9200/_template/cuckoo_template [status:N/A request:0.000s]
Traceback (most recent call last):
  File "/usr/local/lib/python2.7/dist-packages/elasticsearch/connection/http_urllib3.py", line 94, in perform_request
    response = self.pool.urlopen(method, url, body, retries=False, headers=self.headers, **kw)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 643, in urlopen
    _stacktrace=sys.exc_info()[2])
  File "/usr/local/lib/python2.7/dist-packages/urllib3/util/retry.py", line 251, in increment
    raise six.reraise(type(error), error, _stacktrace)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 594, in urlopen
    chunked=chunked)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 361, in _make_request
    conn.request(method, url, **httplib_request_kw)
  File "/usr/lib/python2.7/httplib.py", line 1017, in request
    self._send_request(method, url, body, headers)
  File "/usr/lib/python2.7/httplib.py", line 1051, in _send_request
    self.endheaders(body)
  File "/usr/lib/python2.7/httplib.py", line 1013, in endheaders
    self._send_output(message_body)
  File "/usr/lib/python2.7/httplib.py", line 864, in _send_output
    self.send(msg)
  File "/usr/lib/python2.7/httplib.py", line 826, in send
    self.connect()
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connection.py", line 163, in connect
    conn = self._new_conn()
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connection.py", line 147, in _new_conn
    self, "Failed to establish a new connection: %s" % e)
NewConnectionError: <urllib3.connection.HTTPConnection object at 0x7f9b5274c450>: Failed to establish a new connection: [Errno 111] Connection refused
2019-01-09 10:17:19,287 [elasticsearch] WARNING: HEAD http://127.0.0.1:9200/_template/cuckoo_template [status:N/A request:0.000s]
Traceback (most recent call last):
  File "/usr/local/lib/python2.7/dist-packages/elasticsearch/connection/http_urllib3.py", line 94, in perform_request
    response = self.pool.urlopen(method, url, body, retries=False, headers=self.headers, **kw)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 643, in urlopen
    _stacktrace=sys.exc_info()[2])
  File "/usr/local/lib/python2.7/dist-packages/urllib3/util/retry.py", line 251, in increment
    raise six.reraise(type(error), error, _stacktrace)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 594, in urlopen
    chunked=chunked)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 361, in _make_request
    conn.request(method, url, **httplib_request_kw)
  File "/usr/lib/python2.7/httplib.py", line 1017, in request
    self._send_request(method, url, body, headers)
  File "/usr/lib/python2.7/httplib.py", line 1051, in _send_request
    self.endheaders(body)
  File "/usr/lib/python2.7/httplib.py", line 1013, in endheaders
    self._send_output(message_body)
  File "/usr/lib/python2.7/httplib.py", line 864, in _send_output
    self.send(msg)
  File "/usr/lib/python2.7/httplib.py", line 826, in send
    self.connect()
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connection.py", line 163, in connect
    conn = self._new_conn()
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connection.py", line 147, in _new_conn
    self, "Failed to establish a new connection: %s" % e)
NewConnectionError: <urllib3.connection.HTTPConnection object at 0x7f9b5274c190>: Failed to establish a new connection: [Errno 111] Connection refused
2019-01-09 10:17:19,288 [elasticsearch] WARNING: HEAD http://127.0.0.1:9200/_template/cuckoo_template [status:N/A request:0.000s]
Traceback (most recent call last):
  File "/usr/local/lib/python2.7/dist-packages/elasticsearch/connection/http_urllib3.py", line 94, in perform_request
    response = self.pool.urlopen(method, url, body, retries=False, headers=self.headers, **kw)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 643, in urlopen
    _stacktrace=sys.exc_info()[2])
  File "/usr/local/lib/python2.7/dist-packages/urllib3/util/retry.py", line 251, in increment
    raise six.reraise(type(error), error, _stacktrace)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 594, in urlopen
    chunked=chunked)
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 361, in _make_request
    conn.request(method, url, **httplib_request_kw)
  File "/usr/lib/python2.7/httplib.py", line 1017, in request
    self._send_request(method, url, body, headers)
  File "/usr/lib/python2.7/httplib.py", line 1051, in _send_request
    self.endheaders(body)
  File "/usr/lib/python2.7/httplib.py", line 1013, in endheaders
    self._send_output(message_body)
  File "/usr/lib/python2.7/httplib.py", line 864, in _send_output
    self.send(msg)
  File "/usr/lib/python2.7/httplib.py", line 826, in send
    self.connect()
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connection.py", line 163, in connect
    conn = self._new_conn()
  File "/usr/local/lib/python2.7/dist-packages/urllib3/connection.py", line 147, in _new_conn
    self, "Failed to establish a new connection: %s" % e)
NewConnectionError: <urllib3.connection.HTTPConnection object at 0x7f9b5274cc90>: Failed to establish a new connection: [Errno 111] Connection refused
2019-01-09 10:17:19,289 [lib.cuckoo.core.plugins] ERROR: Failed to run the reporting module "ElasticSearch":
Traceback (most recent call last):
  File "/opt/cuckoo/lib/cuckoo/core/plugins.py", line 533, in process
    current.run(self.results)
  File "/opt/cuckoo/modules/reporting/elasticsearch.py", line 196, in run
    self.connect()
  File "/opt/cuckoo/modules/reporting/elasticsearch.py", line 79, in connect
    if not self.es.indices.exists_template("cuckoo_template"):
  File "/usr/local/lib/python2.7/dist-packages/elasticsearch/client/utils.py", line 69, in _wrapped
    return func(*args, params=params, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/elasticsearch/client/indices.py", line 491, in exists_template
    name), params=params)
  File "/usr/local/lib/python2.7/dist-packages/elasticsearch/transport.py", line 327, in perform_request
    status, headers, data = connection.perform_request(method, url, params, body, ignore=ignore, timeout=timeout)
  File "/usr/local/lib/python2.7/dist-packages/elasticsearch/connection/http_urllib3.py", line 105, in perform_request
    raise ConnectionError('N/A', str(e), e)
ConnectionError: ConnectionError(<urllib3.connection.HTTPConnection object at 0x7f9b5274cc90>: Failed to establish a new connection: [Errno 111] Connection refused) caused by: NewConnectionError(<urllib3.connection.HTTPConnection object at 0x7f9b5274cc90>: Failed to establish a new connection: [Errno 111] Connection refused)

Signatures

The executable has PE anomalies (could be a false positive) (1 event)
section .ndata
Allocates read-write-execute memory (usually to unpack itself) (2 events)
Time & API Arguments Status Return Repeated
Jan. 9, 2019, 12:11 a.m.
NtProtectVirtualMemory
base_address: 0x10004000
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 404
process_handle: 0xffffffff
success 0 0
Jan. 9, 2019, 12:11 a.m.
NtProtectVirtualMemory
base_address: 0x10004000
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 404
process_handle: 0xffffffff
success 0 0
Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (4 events)
Time & API Arguments Status Return Repeated
Jan. 9, 2019, 12:12 a.m.
GetDiskFreeSpaceExW
total_number_of_free_bytes: 18093906989875204
free_bytes_available: 196751008720749321
root_path: C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable
total_number_of_bytes: 563877666357248
failed 0 0
Jan. 9, 2019, 12:12 a.m.
GetDiskFreeSpaceExW
total_number_of_free_bytes: 24099598336
free_bytes_available: 24099598336
root_path: C:\Documents and Settings\zamen\Local Settings\Temp\
total_number_of_bytes: 31453437952
success 1 0
Jan. 9, 2019, 12:12 a.m.
GetDiskFreeSpaceExW
total_number_of_free_bytes: 5339348723570775
free_bytes_available: 845422886610336
root_path: C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable
total_number_of_bytes: 5340688753360896
failed 0 0
Jan. 9, 2019, 12:12 a.m.
GetDiskFreeSpaceExW
total_number_of_free_bytes: 24099598336
free_bytes_available: 24099598336
root_path: C:\Documents and Settings\zamen\Local Settings\Temp\
total_number_of_bytes: 31453437952
success 1 0
Creates (office) documents on the filesystem (2 events)
file C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Help\Quick Guide.pdf
file C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Help\User Manual.pdf
Creates executable files on the filesystem (7 events)
file C:\Documents and Settings\zamen\Local Settings\Temp\nsd3.tmp\nsDialogs.dll
file C:\Documents and Settings\zamen\Local Settings\Temp\nsd3.tmp\w7tbp.dll
file C:\Documents and Settings\zamen\Local Settings\Temp\nsd3.tmp\FindProcDLL.dll
file C:\Documents and Settings\zamen\Local Settings\Temp\nsd3.tmp\LangDLL.dll
file C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\ReNamer.exe
file C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\ReNamerPortable.exe
file C:\Documents and Settings\zamen\Local Settings\Temp\nsd3.tmp\System.dll
File has been identified by 2 AntiVirus engines on VirusTotal as malicious (2 events)
Bkav HW32.Packed.
Trapmine malicious.moderate.ml.score
The binary likely contains encrypted or compressed data. (2 events)
section {u'size_of_data': u'0x0001c800', u'virtual_address': u'0x00056000', u'entropy': 7.235463324504837, u'name': u'.rsrc', u'virtual_size': u'0x0001c6b8'} entropy 7.2354633245 description A section with a high entropy has been found
entropy 0.780821917808 description Overall entropy of this PE file is high

Network

DNS

No domains contacted.

Hosts

No hosts contacted.

Summary

Process ReNamerPortable_6.9.paf.exe (404)

  • Opened files

    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer
    • C:\WINDOWS\system32\oleaccrc.dll
    • C:\Documents and Settings\zamen\Local Settings\Temp\nsd3.tmp\modern-wizard.bmp
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\Other
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\AppInfo\Launcher
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Scripts
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\Other\Help\Images
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\Other\Help
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\Other\Source
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Help
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\AppInfo\pac_installer_log.ini
    • C:\Documents and Settings\zamen\Local Settings\Temp\nsd3.tmp\modern-header.bmp
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\AppInfo
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable_6.9.paf.exe
  • Written files

    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bg.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sy.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\lt.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\az.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\de.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\uz.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.de.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\vu.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mv.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\hr.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\id.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gi.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ar.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\French.txt
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\AppInfo\appicon.ico
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.zh_TW.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\cv.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\AppInfo\pac_installer_log.ini
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Scripts\Index filenames.pas
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\be.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Spanish.txt
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\wales.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Scripts\Example include file.inc
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\by.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.cs.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\nsd3.tmp\nsDialogs.dll
    • C:\Documents and Settings\zamen\Local Settings\Temp\nsd3.tmp\FindProcDLL.dll
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\my.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\nu.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.id.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mt.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ne.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bo.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\pt.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ky.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.fi.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ga.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\nc.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\History.txt
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mc.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Scripts\Hours span.pas
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Scripts\Lines from file.pas
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\tk.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mm.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.de.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ag.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bt.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\dm.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\ReNamerPortable.exe
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\tm.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ee.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Scripts\Pad numeric sequences.pas
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.pt_BR.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\lb.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gu.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Help\User Manual.pdf
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\pl.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mp.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.ja.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gw.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ua.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\nsd3.tmp\LangDLL.dll
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\at.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\AppInfo\Launcher\ReNamerPortable.ini
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\cl.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\vg.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\hk.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.sk.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\nf.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\zm.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ie.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ge.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\cd.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bf.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\la.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bb.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\no.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Polish.txt
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gm.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.sk.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bd.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\jo.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mk.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ae.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\catalonia.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\lr.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ec.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\iq.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\kh.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.pt_BR.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ve.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\fi.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\cr.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ug.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mu.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Japanese (Kunrei-shiki).txt
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\py.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ai.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Ukrainian.txt
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sb.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\nsd3.tmp\System.dll
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\cf.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\Other\Source\AppNamePortable.ini
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Greek.txt
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sr.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\AppInfo\installer.ini
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\il.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\st.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\nsd3.tmp\w7tbp.dll
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\europeanunion.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\pg.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sh.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ca.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\cn.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\md.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\za.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\to.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\fr.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\fm.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.hu.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.ru.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\hu.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\tf.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\zw.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bn.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\wf.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Russian.txt
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bs.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\pa.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\um.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.no.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\th.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\tg.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sj.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ao.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\ReNamer.exe
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sl.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\kn.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\am.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ch.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bj.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.tr.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Scripts\Date and Time.pas
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\dz.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\kg.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bh.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ms.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\hn.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ki.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\er.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\nsd3.tmp\modern-header.bmp
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\German.txt
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.ru.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\nr.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bv.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.lt.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\Other\Help\Images\Help_Background_Footer.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\AppInfo\appicon_32.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Copyrights.txt
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\fam.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\pr.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sz.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mg.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\cs.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\qa.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\cx.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ps.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\me.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\cu.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\dj.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\tn.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\yt.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sd.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bz.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\br.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\af.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mw.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gs.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Scripts\Serialize duplicates.pas
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\pk.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.fr.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gh.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\io.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\as.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gr.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\np.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\cm.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\fk.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\scotland.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\england.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Russian (Alternative).txt
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Scripts\Encrypt filenames.pas
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Serbian (Cyrillic).txt
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\kp.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Scripts\User defined functions.pas
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.cs.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mq.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Scripts\Use include files.pas
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\td.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\Other\Source\LauncherLicense.txt
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\pm.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ml.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\tj.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ck.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\se.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.nl_BE.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.it.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ls.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\kr.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\pe.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\lc.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ng.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.it.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\tw.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\cz.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\co.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ke.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.id.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\kz.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gl.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ly.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.fr.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mn.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.nl.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\fj.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\et.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\au.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sn.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.zh_CN.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\rw.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\cc.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\lv.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.pl.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\fo.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\Other\Source\Readme.txt
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Bulgarian.txt
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gd.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bm.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.es.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Scripts\Initialize renaming code.pas
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mr.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\tl.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.es.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gp.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Help\Quick Guide.pdf
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Slovak.txt
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sg.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\rs.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\eg.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\eh.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.sr.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.he.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\AppInfo\appicon_75.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\nz.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\tr.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\vi.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Croatian.txt
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gf.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\an.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Portuguese.txt
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Turkish.txt
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\li.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Russian (Latin).txt
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ro.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.ja.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\na.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\km.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\vn.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\va.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gq.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gn.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.ca.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\aw.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\hm.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\si.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ir.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\uy.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\tc.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\do.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ax.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sa.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mh.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\cg.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ni.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\nl.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\tz.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ws.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\al.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ye.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ma.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\lk.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mz.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\help.html
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\Other\Help\Images\Donation_Button.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gb.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\in.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\jp.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\nsd3.tmp\modern-wizard.bmp
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mo.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bi.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\Other\Help\Images\Favicon.ico
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sc.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\Readme.txt
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ad.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Serbian (Latin).txt
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\lu.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\AppInfo\appinfo.ini
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\pf.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ru.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Scripts\Move filename portion.pas
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ht.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\AppInfo\appicon_128.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.uk.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bw.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\dk.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\cy.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.pl.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\om.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mx.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\tt.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sk.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\jm.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gy.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\es.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\nsi2.tmp
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\tv.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\Other\Help\Images\Help_Background_Header.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Czech.txt
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\pw.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gt.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.zh_CN.po
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sm.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\it.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\us.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\AppInfo\appicon_16.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Scripts\Import DLL functions.pas
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\pn.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\so.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\Other\Help\Images\Help_Logo_Top.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\re.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ph.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Romanian.txt
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sv.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ba.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\is.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\vc.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ci.png
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Japanese (Hepburn-shiki).txt
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\kw.png
  • Files Read

    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\AppInfo\pac_installer_log.ini
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable_6.9.paf.exe
    • C:\Documents and Settings\zamen\Local Settings\Temp\nsi2.tmp

Process ReNamerPortable_6.9.paf.exe (404)

  • Registry keys opened

    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
    • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ProductOptions
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{d396530e-636a-11e6-ba0d-806d6172696f}\
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\AppLogLevels
    • HKEY_CLASSES_ROOT\Directory
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d396530e-636a-11e6-ba0d-806d6172696f}\
    • HKEY_CLASSES_ROOT\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InProcServer32
    • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\ShellEx\IconHandler
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MiniNT
    • HKEY_CLASSES_ROOT\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}
    • HKEY_CURRENT_USER\Control Panel\Desktop
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\LangBarAddIn\
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
    • HKEY_LOCAL_MACHINE\Software\Microsoft\windows\CurrentVersion\Explorer\AutoComplete
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
    • HKEY_CLASSES_ROOT\Folder
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ThemeManager
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
    • HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
    • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\Clsid
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d396530a-636a-11e6-ba0d-806d6172696f}\
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\ReNamerPortable_6.9.paf.exe
    • HKEY_LOCAL_MACHINE\System\Setup
    • HKEY_LOCAL_MACHINE\System\WPA\PnP
    • HKEY_CLASSES_ROOT\Drive\shellex\FolderExtensions
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\winlogon
    • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System
    • HKEY_LOCAL_MACHINE\Software\Microsoft\COM3\Debug
    • HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
    • HKEY_CURRENT_USER\Software\Microsoft\windows\CurrentVersion\Explorer\AutoComplete
    • HKEY_CLASSES_ROOT\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InProcServer32
    • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\(Default)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{d396530d-636a-11e6-ba0d-806d6172696f}\
    • HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT
    • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\Clsid
    • HKEY_CURRENT_USER\Keyboard Layout\Toggle
    • HKEY_CURRENT_USER\SOFTWARE\Microsoft\CTF\LangBarAddIn\
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{d396530a-636a-11e6-ba0d-806d6172696f}\
    • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\CurVer
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d396530d-636a-11e6-ba0d-806d6172696f}\
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
    • HKEY_LOCAL_MACHINE\SYSTEM\Setup
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{d396530b-636a-11e6-ba0d-806d6172696f}\
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d396530b-636a-11e6-ba0d-806d6172696f}\
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT\UserEra
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\(Default)
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
  • Registry keys written

    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d396530e-636a-11e6-ba0d-806d6172696f}\BaseClass
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d396530d-636a-11e6-ba0d-806d6172696f}\BaseClass
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d396530a-636a-11e6-ba0d-806d6172696f}\BaseClass
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d396530b-636a-11e6-ba0d-806d6172696f}\BaseClass
  • Registry keys read

    • HKEY_CURRENT_USER\Keyboard Layout\Toggle\Language Hotkey
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\SourcePath
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{d396530d-636a-11e6-ba0d-806d6172696f}\Data
    • HKEY_CURRENT_USER\Keyboard Layout\Toggle\Hotkey
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewAlphaSelect
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\DontPrettyPath
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{d396530a-636a-11e6-ba0d-806d6172696f}\Data
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{d396530b-636a-11e6-ba0d-806d6172696f}\Generation
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewScrollOver
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DevicePath
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceActiveDesktopOn
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\DriverCachePath
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DontShowSuperHidden
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\RsopDebugLevel
    • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32\(Default)
    • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InProcServer32\(Default)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\NoNetCrawling
    • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\IsShortcut
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\WebView
    • HKEY_LOCAL_MACHINE\SYSTEM\Setup\OsLoaderPath
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer
    • HKEY_CURRENT_USER\Keyboard Layout\Toggle\Layout Hotkey
    • HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewWatermark
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\MS Shell Dlg 2
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{d396530e-636a-11e6-ba0d-806d6172696f}\Data
    • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\NeverShowExt
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSimpleStartMenu
    • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InProcServer32\(Default)
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowCompColor
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowInfoTip
    • HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemPartition
    • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}\DriveMask
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ClassicShell
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\LogPath
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserEnvDebugLevel
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetHood
    • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\DocObject
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\MinimumFreeMemPercentageToCreateProcess
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ServicePackSourcePath
    • HKEY_LOCAL_MACHINE\SYSTEM\WPA\PnP\seed
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\MapNetDrvBtn
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Filter
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ServicePackCachePath
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\RsopLogging
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\LogLevel
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Personal
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{d396530a-636a-11e6-ba0d-806d6172696f}\Generation
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{d396530d-636a-11e6-ba0d-806d6172696f}\Generation
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName\ComputerName
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Tahoma
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{d396530b-636a-11e6-ba0d-806d6172696f}\Data
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewShadow
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{d396530e-636a-11e6-ba0d-806d6172696f}\Generation
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktop
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWebView
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideIcons
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ProductOptions\ProductType
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewScrollOver
    • HKEY_CURRENT_USER\Control Panel\Desktop\LameButtonText
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\UseDoubleClickTimer
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SeparateProcess
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\MinimumFreeMemPercentageToCreateObject
    • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\BrowseInPlace
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\SeparateProcess
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local Settings
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ChkAccDebugLevel
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetCrawling
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ThemeManager\Compositing
    • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\AlwaysShowExt

Process ReNamerPortable_6.9.paf.exe (404)

  • Mutexes accessed

    • oleacc-msaa-loaded
    • MSCTF.Shared.MUTEX.EFG

Process ReNamerPortable_6.9.paf.exe (404)

  • Directories created

    • C:\Documents and Settings
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\Other\Source
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\Other\Help
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages
    • C:\Documents and Settings\zamen\Local Settings\Temp\nsd3.tmp
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\Data
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App
    • C:\Documents and Settings\zamen\Local Settings
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\Other
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Scripts
    • C:\Documents and Settings\zamen\Local Settings\Temp\
    • C:\Documents and Settings\zamen\Local Settings\Temp
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Help
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\~PRESERVEFILE1
    • C:\Documents and Settings\zamen
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\AppInfo
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\Other\Help\Images
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\AppInfo\Launcher
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts
  • Directories removed

    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\~PRESERVEFILE1\
  • Directories enumerated

    • C:\Documents and Settings
    • C:\WINDOWS\system32\wuauclt.exe
    • C:\Program Files\Microsoft Office\Office12
    • C:\WINDOWS\system32\ctfmon.exe
    • C:\WINDOWS\explorer.exe
    • C:\Python27\pythonw.exe
    • E:\PortableApps
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\Other\*.*
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\*.*
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable
    • C:\Documents and Settings\zamen\Local Settings\Temp\nsd3.tmp
    • C:\Program Files\Java\jre7\bin\jqs.exe
    • C:\Program Files\Java\jre7
    • C:\Documents and Settings\zamen\Local Settings\Temp\PortableApps.com\PortableAppsPlatform.exe
    • C:\WINDOWS
    • C:\PortableApps
    • C:\WINDOWS\system32\svchost.exe
    • C:\Documents and Settings\zamen\Local Settings
    • C:\Documents and Settings\zamen\PortableApps\*.*
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Settings.ini
    • C:\WINDOWS\system32
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\Other
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\~PRESERVEFILE1\Settings.ini
    • C:\Python27
    • C:\Documents and Settings\zamen\Local Settings\Temp
    • C:\WINDOWS\system32\services.exe
    • C:\Program Files\Java
    • C:\WINDOWS\system32\lsass.exe
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\~PRESERVEFILE1
    • C:\Documents and Settings\zamen
    • C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\*.*
    • C:\Program Files\Common Files\Java
    • C:\Program Files\Java\jre7\bin
    • C:\WINDOWS\system32\spoolsv.exe
    • C:\WINDOWS\system32\alg.exe
    • C:\Program Files\Common Files\Java\Java Update\jusched.exe

Process ReNamerPortable_6.9.paf.exe (404)

  • DLLs Loaded

    • C:\WINDOWS\system32\APPHELP.dll
    • C:\WINDOWS\system32\USERENV.dll
    • C:\WINDOWS\system32\SHELL32.dll
    • C:\DOCUME~1\zamen\LOCALS~1\Temp\nsd3.tmp\FindProcDLL.dll
    • kernel32.dll
    • UxTheme.dll
    • C:\DOCUME~1\zamen\LOCALS~1\Temp\nsd3.tmp\w7tbp.dll
    • C:\WINDOWS\system32\OLEACC.dll
    • C:\WINDOWS\system32\CRYPTBASE.dll
    • C:\DOCUME~1\zamen\LOCALS~1\Temp\nsd3.tmp\nsDialogs.dll
    • C:\WINDOWS\system32\browseui.dll
    • ole32.dll
    • C:\WINDOWS\system32\UXTHEME.dll
    • C:\WINDOWS\system32\DWMAPI.dll
    • C:\WINDOWS\system32\RichEd20.dll
    • C:\WINDOWS\system32\PROPSYS.dll
    • C:\DOCUME~1\zamen\LOCALS~1\Temp\nsd3.tmp\LangDLL.dll
    • C:\WINDOWS\system32\SETUPAPI.dll
    • C:\WINDOWS\system32\SHFOLDER.dll
    • SHELL32.dll
    • PSAPI.DLL
    • C:\WINDOWS\system32\CLBCATQ.dll
    • C:\DOCUME~1\zamen\LOCALS~1\Temp\nsd3.tmp\System.dll
    • browseui.dll
    • shell32.dll
    • SETUPAPI.dll

PE Compile Time

2018-01-29 22:57:41

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00006409 0x00006600 6.4162226664
.rdata 0x00008000 0x0000138e 0x00001400 5.14383173215
.data 0x0000a000 0x00020358 0x00000600 4.00440232134
.ndata 0x0002b000 0x0002b000 0x00000000 0.0
.rsrc 0x00056000 0x0001c6b8 0x0001c800 7.2354633245

Imports

Library KERNEL32.dll:
0x408070 ExitProcess
0x408074 SetFileAttributesW
0x408078 Sleep
0x40807c GetTickCount
0x408080 CreateFileW
0x408084 GetFileSize
0x408088 GetModuleFileNameW
0x40808c GetCurrentProcess
0x408094 GetFileAttributesW
0x4080a0 GetTempPathW
0x4080a4 GetCommandLineW
0x4080a8 GetVersion
0x4080ac SetErrorMode
0x4080b0 lstrlenW
0x4080b4 lstrcpynW
0x4080b8 CopyFileW
0x4080bc GetShortPathNameW
0x4080c0 GlobalLock
0x4080c4 CreateThread
0x4080c8 GetLastError
0x4080cc CreateDirectoryW
0x4080d0 CreateProcessW
0x4080d4 RemoveDirectoryW
0x4080d8 lstrcmpiA
0x4080dc GetTempFileNameW
0x4080e0 WriteFile
0x4080e4 lstrcpyA
0x4080e8 MoveFileExW
0x4080ec lstrcatW
0x4080f0 GetSystemDirectoryW
0x4080f4 GetProcAddress
0x4080f8 GetModuleHandleA
0x4080fc GetExitCodeProcess
0x408100 WaitForSingleObject
0x408104 lstrcmpiW
0x408108 MoveFileW
0x40810c GetFullPathNameW
0x408110 SetFileTime
0x408114 SearchPathW
0x408118 CompareFileTime
0x40811c lstrcmpW
0x408120 CloseHandle
0x408128 GlobalFree
0x40812c GlobalUnlock
0x408130 GetDiskFreeSpaceW
0x408134 GlobalAlloc
0x408138 FindFirstFileW
0x40813c FindNextFileW
0x408140 DeleteFileW
0x408144 SetFilePointer
0x408148 ReadFile
0x40814c FindClose
0x408150 lstrlenA
0x408154 MulDiv
0x408158 MultiByteToWideChar
0x40815c WideCharToMultiByte
0x408168 FreeLibrary
0x40816c LoadLibraryExW
0x408170 GetModuleHandleW
Library USER32.dll:
0x408194 GetSystemMenu
0x408198 SetClassLongW
0x40819c EnableMenuItem
0x4081a0 IsWindowEnabled
0x4081a4 SetWindowPos
0x4081a8 GetSysColor
0x4081ac GetWindowLongW
0x4081b0 SetCursor
0x4081b4 LoadCursorW
0x4081b8 CheckDlgButton
0x4081bc GetMessagePos
0x4081c0 LoadBitmapW
0x4081c4 CallWindowProcW
0x4081c8 IsWindowVisible
0x4081cc CloseClipboard
0x4081d0 SetClipboardData
0x4081d4 EmptyClipboard
0x4081d8 OpenClipboard
0x4081dc ScreenToClient
0x4081e0 GetWindowRect
0x4081e4 GetDlgItem
0x4081e8 GetSystemMetrics
0x4081ec SetDlgItemTextW
0x4081f0 GetDlgItemTextW
0x4081f4 MessageBoxIndirectW
0x4081f8 CharPrevW
0x4081fc CharNextA
0x408200 wsprintfA
0x408204 DispatchMessageW
0x408208 PeekMessageW
0x40820c ReleaseDC
0x408210 EnableWindow
0x408214 InvalidateRect
0x408218 SendMessageW
0x40821c DefWindowProcW
0x408220 BeginPaint
0x408224 GetClientRect
0x408228 FillRect
0x40822c DrawTextW
0x408230 EndDialog
0x408234 RegisterClassW
0x40823c CreateWindowExW
0x408240 GetClassInfoW
0x408244 DialogBoxParamW
0x408248 CharNextW
0x40824c ExitWindowsEx
0x408250 DestroyWindow
0x408254 GetDC
0x408258 SetTimer
0x40825c SetWindowTextW
0x408260 LoadImageW
0x408264 SetForegroundWindow
0x408268 ShowWindow
0x40826c IsWindow
0x408270 SetWindowLongW
0x408274 FindWindowExW
0x408278 TrackPopupMenu
0x40827c AppendMenuW
0x408280 CreatePopupMenu
0x408284 EndPaint
0x408288 CreateDialogParamW
0x40828c SendMessageTimeoutW
0x408290 wsprintfW
0x408294 PostQuitMessage
Library GDI32.dll:
0x40804c SelectObject
0x408050 SetBkMode
0x408054 CreateFontIndirectW
0x408058 SetTextColor
0x40805c DeleteObject
0x408060 GetDeviceCaps
0x408064 CreateBrushIndirect
0x408068 SetBkColor
Library SHELL32.dll:
0x40817c ShellExecuteExW
0x408184 SHBrowseForFolderW
0x408188 SHGetFileInfoW
0x40818c SHFileOperationW
Library ADVAPI32.dll:
0x408004 RegCreateKeyExW
0x408008 RegOpenKeyExW
0x40800c SetFileSecurityW
0x408010 OpenProcessToken
0x408018 RegEnumValueW
0x40801c RegDeleteKeyW
0x408020 RegDeleteValueW
0x408024 RegCloseKey
0x408028 RegSetValueExW
0x40802c RegQueryValueExW
0x408030 RegEnumKeyW
Library COMCTL32.dll:
0x408038 ImageList_Create
0x40803c ImageList_AddMasked
0x408040 ImageList_Destroy
0x408044 None
Library ole32.dll:
0x40829c OleUninitialize
0x4082a0 OleInitialize
0x4082a4 CoTaskMemFree
0x4082a8 CoCreateInstance

!This program cannot be run in DOS mode.
`.rdata
@.data
.ndata
Instu_
softuV
NulluM
SVWj _3
Aj"A[f
D$$SPS
Vj%SSS
f9=(7B
D$$+D$
D$,+D$$P
\u f9O
90u'AAf
UXTHEME
USERENV
SETUPAPI
APPHELP
PROPSYS
DWMAPI
CRYPTBASE
OLEACC
CLBCATQ
RichEd32
RichEd20
MulDiv
DeleteFileW
FindFirstFileW
FindNextFileW
FindClose
SetFilePointer
ReadFile
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
GlobalAlloc
GlobalFree
ExpandEnvironmentStringsW
lstrcmpW
lstrcmpiW
CloseHandle
SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
SetFileAttributesW
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
SetEnvironmentVariableW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
GetTempFileNameW
WriteFile
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
KERNEL32.dll
EndPaint
DrawTextW
FillRect
GetClientRect
BeginPaint
DefWindowProcW
SendMessageW
InvalidateRect
EnableWindow
ReleaseDC
LoadImageW
SetWindowLongW
GetDlgItem
IsWindow
FindWindowExW
SendMessageTimeoutW
wsprintfW
ShowWindow
SetForegroundWindow
PostQuitMessage
SetWindowTextW
SetTimer
CreateDialogParamW
DestroyWindow
ExitWindowsEx
CharNextW
DialogBoxParamW
GetClassInfoW
CreateWindowExW
SystemParametersInfoW
RegisterClassW
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
AppendMenuW
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
USER32.dll
SelectObject
SetTextColor
SetBkMode
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
GetDeviceCaps
SetBkColor
GDI32.dll
SHFileOperationW
SHGetFileInfoW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetSpecialFolderLocation
SHELL32.dll
RegEnumValueW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegCreateKeyExW
ADVAPI32.dll
ImageList_Destroy
ImageList_AddMasked
ImageList_Create
COMCTL32.dll
CoCreateInstance
OleUninitialize
OleInitialize
CoTaskMemFree
ole32.dll
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
VERSION
SHGetFolderPathW
SHFOLDER
SHAutoComplete
SHLWAPI
SHELL32
InitiateShutdownW
RegDeleteKeyExW
ADVAPI32
GetUserDefaultUILanguage
GetDiskFreeSpaceExW
SetDefaultDllDirectories
KERNEL32
[Rename]
%ls=%ls
:hW2e+S
B-o@mm=
zV@uM5'
!l|]R~!
T0/~Aw
p]Dm6M
@Gk3o#
by/1YZ
s]go`Q
s}}=G
$3?U,d
Gpo/U,
OA]]5w
Garjl2
O@ntBz.
!hni`a
6nh[15
r(t'PN
ICCc+454
>1iT=TkD~
MqT~x^^c
GkcPUU
gi4blk
olj}xyGK
K6#hqHx
tw-ezo
m[aYW;dr9
"_` `
!JR6;-,
@ ah"5
4ocOY)
:JuN:p
YAHRqE
Z;z8}h
P{nlmP
6j;4F#
c{hdt
k4s}J6
NQ3T[]
CWVWin|
_A>VS*
LJ'VqWe
w^ZH=b#^"
{D6Ium
Da5V} #
aq4j"K`
BBL#%9
0[Z;$J
1]lBK/`
0B>i#R
Z\rMM!%
H1Vfgh
Zlp)p$
)]@$2c`%
A:[bf<"R
8W,9+p
wd-8:@
7Hrhls
JZJ!5[
nk$'5;x
Q#kaQ
7\IE,)
O<AO=J
m'QQhF
g76j4>3I
RZdBD PS
, '-c&
?Da[+/
"1?2,1$
RG !/E
D^+x3x~
tnyU6E
O&'&C+
;8*wEZ
w^}CB>
!KI+OF
;-*<f"
p\cOdK!1
Gu6:Zs@;
9GWgoR.
;EyNS
20n2EB|6"
yldHp
'!;"00
PGCTl~aD
*Ujrj
MSs34lw
V5x!4R
S&M7wd
qJvly
Sghv~^
j'_FtYDk
KiT*t|a^
ejE",+
y#v`[=
5\Kv'R
4\x$N2
e5@B},
V&'i{w
{X7.C/
jh.b)*S}
a$2f3Su
J@6.Ms(J
9l<x@j
OKgNKC
dj359AGVWd
i:6?)@
;jKoo0
\EnK;#@{
^|D.Ne7
=vdqH!HZ
wE~d0H
{49=Ii
/sNx,u
!%r@C6
cWEnl!
483`kby
0&DiYlB
~p7b7Y673
Hj\("XMF
vSH@al6
tcsgx?
7L#i:F
*4'f`N
_^tvAY
:27Q6,4N
;5<w%&E
HCIs&%
97(?86I
B<1Y44V
!:5<~35\
D>Fz/*
<4*F:5L
<:;t54]
@;>n3&
<61W:=l
D=,'7:e
D?<JSRj
FCK{YY~
85HO\^
8>t`NP
=<^[_a
GA=;KJf
HDGPC<&
LGLtPPp
MG>BJI]
IDBD $DQ47
((L0,/d
*,Va37o
94**wma
40%.qh\
83('[TH
B<0crj]
?:.O[TH
C=1V;6+
=7+1JD7cRL@
JE8g>9,3
*%4r84Cp,#
0*"?%%B
-+-V,+O
4()E10N
QNSfef
RMMRIB6
MG@.USd
NH=!$&`DQS
"'f/EH
LGGNMKg
VSUbOI:
23Qe:?|
+-]q8<t
MN{]@>i
"%SG,.V
QK?I^YM
SMALHB7
pD?>A="
HO@DFFDD'!"
pFOOHSNNSMFB&%
jPOPLXmjVKKWMEA'n
niM48KWREBm
f58ksIN
j8WUHBYs
0WZHBMko:.2
N2WUIBIikK.28
(/iTG3CJWf,+*
iJWnTM
9nM603CIf9
ojI4($3C6f,
gx7+JG0
]a]a]]
abbab]\
\bvv]zz`
746!%%A
IHa}?<<
42?D%'L
B?I;@;0
22Il*+X
DBTb>91
13nL05n
5:xL<A|
;?~LIK
BD|LRS
@Af]WY
QQoMhi
KLumhj
:;coAD
36p6:>y
`ZOIKF:
;4F?>@6.,
IEFNlD89A4/k
c@G0Ln9'
a9G1<h(
B=#$@9
TU]USQY
`^^^sS
\FmT69K!
8b{kw~
baP`g|
_jlvzyxb^
]buxyubO
+&/d,-U
VSX\il
XU_^RL;
GGg]OQ{
(*^cCCk
[UISaYNd|sg
aYNde^RgHB6
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="*" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v3.03</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/><supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/></application></compatibility><application xmlns="urn:schemas-microsoft-com:asm.v3"><windowsSettings><dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware></windowsSettings></application></assembly>
NullsoftInst
#J39-L
5])ijH
Bz/7_96
4)8,y9
c[_ja"
MxIfnR
afUwb'
&-eWF
bfi!n_(
bdG2CD{
1Nshr5I
O'3ou&6
w>G]kH$?
Kdl-9e
ZbJk1.
,3N8yB/}
{&7[#(X]
$/G.,7
&,P!8\
w&JD1k|
Q70H\d
k`mFYR
C1sgd$
8T&xme
|])kwm
dUBQ C
k4+a)rk
8YVqx8F\
$a!XSV&F"
E"J??P
tPKa}v
uMx17u
N;0'1]
V8'"&R/P
y=q7UM
T"F!{L
9(uL)C3
Qr-6,D
Y3O"b}{
i)OyC-k
j6<Wa
%B[i !:ax
*-C;I
>75MDp
>iUS)C
X3Z3MQ-
f,'?XA\i
_x,q7&
YCe72V
(2XaOKOx
`X&,`~
tis7@
,\dY7Iz
Fa*JVZ
T!Z*MZ
!h@J7q.
wkGVJ(
|w%Vz=
q3EjsNp
m;v N#
ZP!NS~
wGD>Pam
IXND38
eg!gwJ
_A+J*f|
99xOoD
Uyz;jK
Oy8M82
ck'?n4
7^v'(-
*y-&fbv
3\Fy,^T
H/:s`f
p!gnT?
FRlk%Jq
S`)Z*m
W`q_5}
7>@CC~
1$5n><
}.$j.v
&V+<Y(
C&b!"Lc
iilOVJx
5hULc@N
^eP{,WS
BXl`ah
4/eCNU
(?|7iWH
svq~O"t-
Y/E8})
X#[b\
Iy#}_+
Q~NYP>87I
M* ?XA
^28WO;
RK9Iw)
u,<IevT
'P(Rvj`h
v#Cg^
2uMvNAp
n5A5@<
g,F^Ja
_<b.vg
=Mq!hi%
X=eL~`
U:~9'B@2
vKthV
v`="a
0psreHm.
7s'~c
n>-2hg
|>JTk$
:N]Pt-
;Z]<RD
f8fs}}
8>`KGQL
<QeI m
R_/NI,
UYa>/
@o|v0+
86aL}M
]!WR"J[
&nS}i$
lS0U~5w
1!;+{L
`Pb0De]
V"&#'m%
!7|qC|^
}'wct?
Fy<a>psC
d)"@}`F
ix(\kV%
umC-oS
UAYg=&
.g-%A&
`+JvK2a8+
g7"RZ
(&MsHX2
D!"@<t
<EXndb&
ytoY%|
n(|fyt0I
5l^/Tr
KWRZbM68
Zi#g>@
[9nCD<
?0O=cj
SqoziUa
s:xCNdk5x
0f8{5,.
|;2X}]
=3D_sw
5omxe)
`GGy<S
P8o7%n
NlhI@Q
p]Y1Z-r
1U7}Uuv
h7BvPE$k7+1$r.
4dDyBS
Wrko%Q
8iqgF)&
9%JQ-J$l3
XZ:,H0
.Im>K~
18DS@R
QxtO-'
z.Jb\T
h!h'3
{)#%cF
}!0[ ;&
^= M%\p
a4c9yJ
d-iK>>
:pV3tn&
be@)F3vuk
x`#_TD:
_FY9av
MVi(q8,P
_ENS 
kpO,v[
FDO_5L
[Y*4>P
+6|u6\4Q
B:+/j:h
T<$c5)
lP5,*E*
>G?H}T
^7/j#Hg,9.
xxeb{,
8WWG.5
v$}~e)
J5v-/G@
?6B?{b
nTiF9f
EUf+G)
O49rZ^^
Z#(8Sd
Zl'wI`
x#SH-_
if_*$+
z-f,tM
qQ4P\j
+cq:":v
y(&AV1
[M$Z>X<
5&K6Ujt
V\wsGw
G/|FPL
\j!.,r@
$}x(gg@of
{,0_@`
US}R%j
l,(+rJ
;"5#!*>
YC"qVK$U
\OWcl4RG
-([FX4N
yW,d5
RD3Rhcj
JC">E2D<GO
>sNK^q
<K~H Iq
>ufS*j
=wuH8k
%dzc5+
p~PbLo
C/ jv2
oZR 1A
+8lxVHi
&'?:B
_{m><3
cp-<}q<A2u
(sc%FC
HKnuCOz2
Uh,!Oe
}4|N/w
oa\v*L
^j@&1W+
D9:.od>
o)&<5k%4
2bggbS
&X?A1r|
!sR!*,
$hh[gb
g7GHJD
u=>7ON'
^:)*')
cTrhH(
rb\[;L
#E]`8U
]`/q(:
lWKg#p
@o5s4o
)/fh^7B
\k{D3@
_]UI1-
gF]{:b
*zp38_M
V~j"kQ
co1`#\
C/^F>e
Oum@H1
gy> x),`
JODmoz
TV8W2n
Hr,!H_
hQsR88
Z,;_T[
8NK%vz
9)kT}2s
#'?`LLK
+C=qg5u#
N]|=usq
Wv?cH}
yjmOWh@
|$nf7Q%
wHx2|f
H+[m >9
Qcvi2]
4v|TZ|
|,:kQ!
O@q!L~>I:
_qFrf`
fa3+gq
XGkNQt
zIG>?Fg
}WX"*z
%*x:8#
ELu'X4
?<C@aN
HI/Nmc-5
UlU(BC
G?|*<T
Ft[a~5
Q`k=8l
I<D=/c($
|[J[`2
NfF{=Z s%
|z45B<
zDMw7%
$7lQgi
#\uT!>
!T+-+XDH *(l
lBCGm(
"HdG3Q
TJ,2P
g-nV_c7
rG/&X9
h0b]_n
|Osv;W
$Hq7,y
T\PtWM
RL`Ts,1a
|o5nMbc?q
^-zNzP
Ta6'rV
FCgn$:
pQ>6/zX
JzEX_F
YnJ\.S
7f&1nM;
FIi\Oe
rbH(al@J
d6h^HI
;}}"@-
QX: S
"L=*C4
2t(\TD
XPS#(k
-#+pjR^#
m\s~GDT
q}wr<3
M5Qx6?S
,V8lDvn
+W54S0
w~E*!x
U??j'2j
]Y~6C
K])}dk/I7
6HRa2
A&4JVL
uM:CP_
kS]}:L.
b3oi~T;
%dJX7{7
lfUrR
lcPFId
vL9$}I
$<*7Vp:
&0nT'-
U{dNa|
hPC^P|v
O<]Wir
T9)"=D
?BR((/
_P^B5*[y
uB!PXd
UTQ(]Qv6
Tj(~S=GQ
7j.mK
dk1,[8lIVH
=t/omk
0w j=Y
c >%0
)2z!9`
yAmb<JEjZ
$NI?fc
<mnOEC
`&@#Pv
0Wh*o6+
D]0m$p4_
74LQ]7J
08(zwu7
'J+5-8
:ri?Ka
tWC0Jo
@[2&((
A/|=?q&
Ps]'55
l.;D1D
L.Da>9
Jd9g+hr
d=O.Vhgv
L5C|%^
jd)Oy1
XCU-a<e{k;
SpZD6W
=RVXC;x
B TJF!A
24^v*D
_/nXqJ
,~1{sB
]t[3LR
9rkkpRN
So 578
|<{iWa
vPAw>_
ntdzM'
qA4IR~y
k{+aic
LUVq5d
yKJY/P
KB^I#Y
GpmZN<[d
3Tq](i
INOznic
A>)$zr
]j8Kir6
QyCYo
{F5Zmr
~Dab.B9&R
@s6W5sQ
>Q#mx]
D(W\*_
Y!sq:FM
^{/nqAb
d%](/"8,
n`4~i~
KA[SZ0W
{}ft#b
<[1-6<
36-)6zm;
$[nG'7
i'-w9|
Cn!Wun
6y6 a[`-
" wv4.a
Y>)^E0
Jf`xHh
'b&C;"
Iv8r;%
<\eg+i
XmkDOb
YSBl'RUO
;gTK"6
vF1#%zS
A.=pbj
e-LQjBcz
md@Mzc
rhC~f|
aUsGB6
#TSnzp
Na@^V
_zKi+<>r?
I`BVG6
QD9#c(
W9j15S
m+=Jmmq
IQ4^6R
Ayz.Uw
4i$@AO
|Lvl+B/
xDFq_G<
zhh~\%
,4nBF<
4g{"6suY
_n4y.l"
9JsBnm:
xZ'+y
Yk{ABWE
H.>g5'
H:22}U
^97 \>
6$:6p]
<fFD[9
&t+ rz
ikh)8%
]#21v[
|P#lRq
e~4.q-
r/8J~/5
1miHs*!
HCbm"h
;#,~!Tw0%2
gG%uk<\
"1}r.6
|hMLjo
V)MY`$
pymjN+%6
YQ@gYK
~&t.,jT
1zk4Ui
usxBNk
JHlY6OK
fh#->@
>*~5?H
TgtyJ
sL"Q_:X
LfDL41b
C,\?dF
Sfoml&
s ^pbf
.MGCC}
p=^2^e
[S$6Y#-k
DJs#jv
[L)_Qf
_%zI:0
!12s^9
!:x`.0
nX|ATc
1oX4&<
vA;tGql=-
R&v^iY
fS2~<{
XQhEd]
]aF9|X
G54dg>]
EKS"m
)4?opP
je.r6/8
y9B'4Y
H1$VR$
!Q2>lOK
4D{<r0
vV:c46/
r}iwyx
6?tr3
5sqX/$
C|q7A}1
qqG8q<
}rmS==
z{geb
PfG$c_
ZOef>#
iKkA~f
tVw.hGbG
mGF0I@
;,27P5
Z (N0VC`
gGY-7*H3
"Sw|N:v
^fBj4e
,bB>*C=
J{Y[!!gz6
z_I<KNZ
&-t3U]2L
uJ-W(%
~?s^Q@
C%ToNF"u]
~ten4kY
QIF:^"
Aks;LCg
(0:)yC$]
qOGA)kA
p4FVjF
p/p<om0
Q4^+5B
3Vq.Iw
B*!YkZ<
EO`!D-
6nMajSB
d_8x}_a
PK0F)@W1
QsIL2?
#/,T3B
<vL3[W7
Ehm6<z
_1H<)=
;;?\Io`
IQ!PZ)
qzEc`m
TKYRkP
ToxGx
O[e\ww
0LZItr
qivyJohw
Ixd=}I
MA-d\w
#Wa3<J
e Sh0d
9uW?(
a/}aCL1
r7VU)`
NSgtd
.=I#x"
)?qia:
xo RIU<
$%3g924o
dASxev
Ug_7a>
kXWxs6
|3/N4N
Os*U(y
63=>Wd
|<!`zhMH
wCq-F$
Qc;t+>
mTo82z
c&;E!M
e.a<v29
z5=|2,hF3pL
|yK >D
L#X|E"
c[ u9R
RUjP=
m^?XI1
(G5owJ
zn)y>\
~rEp;Y
kj~Mk^
-jez[@
z$&|h)
EAtl<&
W}\(25.
7|?$8
LVChQ'
7 !Yyt
^V2"{"
&#"9y"
01#i'G
TBxq=m
oX}u S
kE/emU
142W$M
0JG<w<
_,O$|d
`hR'd^]p
,c|%n@
xuxfzb
Ccu8r&
v)r`wjA
w)J6S0
u{m$\]M
2L/NS_Z
9L=zL,L=
~HKSrXu
#F(ON0
Yi6w(`
nskNlU=W)NJ`
IX]R O
ijT~x`'d9
!k!Xsi
-O`86D
2`DRU{!d
8`mX@"|
(8Z=FN
<'[ENR%p
{Qq\VhC
N}R9^7
cslAzW
d.$Ga1
iu&6P=
_28:v\
+[@FuP
PqWT-z
2)'F/W
6oFi+h
/EiQ,8
%>>=(M
x@K:K_@
wq$v5'7
\`8Kr>
[/4pD<S
V)-CF'Ak
`tdR]c
>zm96jt
7wX*oh
14?Olde
4Bk7[#
`{vf5<
qyiJd,'
,Y?OX)1
Di;eQ\
y4566B
[vUD]S
b~lv"P
:j=B4:
8(7*U(
6r(>_U
G,CYT(
"y!N!
~~cW d
8{$.RQ
PrJcFm
7{3"RX
<T;1<
w?|OVt
Zo"D1l
Fijl*L
l-WEr@H]
(d=,?bo
>m;i=Q
K%}X@v
6Kl~~p
8*r;*^)
J)rdJc
S.lUGX
O$8g15?
L.JmI@
#,IAWu:8
_p:Nrs
xrnzv{
u0y0He
I:3Sp,
?W^58e/
/.lSF
wz2A(!y
O{S9kU
jA\r~Z
Om m&L
skW|kB
X/uUg}>8)
!4*AQR7
4q#,r
C9`m:f
&(zYi=
raj_f'-
jub<$z
B2)-Tg
q"#!TT
8h\<Hr
i{TLk^
/{VA*0h
jiC(t
n;VS8ITn
--obPj
u4,4B]a
QqpwDfL$y
<teAsp
7B:xyAL+
;o/F;_
zyx,b/
v?-3yd
}3#83v
hbH`)[`^
5CpL0*
e]mDEh
>.+n"e
]q-&{
d0u!Y
z[MCvmq_
*hO@p,
Pjd65R
IA'EN
_$=2D.q
x Ac*,cO
$rHSxO[T
1~wJWD
=@5g'\
mgh1z .Z2
S7'q3o
eJr%veZ
tHgV17
/4HYQ>+
5j([Tif
-#(TD
0'XfXf
=xbGeM-
log"2~
0x"|8
'WXhOVL
-Z+6d
%"b<L*5[SC
u]e3m4
PGsSE%yY
`hy,l
g(UU34*
pa)fk:
MAhAc88
P>t;7T-
Af(jd
k96r4e
mz;nK7N
~* 2dS
YA[`c#IP
Vs?8|g
[^s(XD
SZ}9tp(
\<,Bk7T
=`TXK{
_i?S-5|
091Iw]
y`NZ4o
y59zW^
dkbb:H$lM
6W=sE
d%CM+h
TmhHUIu
[F98_7!]y
xWpaZl
fbA$3z
KkVAF)
yhV&@+`
fo(P;c
F~fUjy
kgUT`~U
X5kjM,
q}(]^_
=T%=b+3
wJ_%Qj
t-/ V)(B
=&TlF"
8nf3b
a B]_8
E3o6gNn
uio*+[
YPPNxD)
! L^7F}9m
jmp3m#z"
L6[ZoUI
oR@xgt
|!y(b}
z w |*
kGH;N=
f`+x+Q
PD{}d"
KZn5ejp)
;y] P|
NBFkZj
o/xR3p
",bVSd
7/P@!t
GR|<c{
i(j&YD
69#z+|
HdQjN|
CZ(@C,
~$(s;\
>'$!BNd0q
[N&&h*
;W-M[y
G>`NpV
;J}bU+
#G:cjA
=,ke4Y
hBf(Oh
A42Gu?(
!)3\s}
`,(12>
#\M{QEl
d@U@VHe
M=~|}:
ICF4&`
\OXWX&
-[[$)/"2
P\nQUwN"
PHU`BF
%YcrHS
w`1i"b
2%2~V%
|GV|X!
V3|o]%j
@},E-'
3pdeD:^
o,~!A-YkG
ODTeHMb
dWJge'
7k]j_U3
]7}lSWPS
LcX_Ich
(#KDIb
8<'z+
I;}o2j
*Z^bzV
l`-P(kd
N@gdx5
x/VIaQ
UFvvLhe+Q
BiAJ+E|
2,Qin~0:zY^
0{|9DO
!:LXu*
]4_Vns(E
lN3OP*I3
gemCl*&1
qUY{dCB
jgG]/J
$)"~fp
mfY0vEH
]V@`Rx
%8Kk7[
qH*10l
Ik8:8:
;m|1qq
>2?"D72
}Oy`bg-
kxkK7q
R;aIy+
@_\MYS
MfCw(1
l|)5jo
VO9:=M2h
lt,#&d
UMrf\eN
k6{.$'
5^C^\/
(dej)#
Q~ g4&
81;5K%u
:)S7^SWJ
[-A7k'
K2\"zK
|enN*X
6OaoP'
vO6By5D
U?qlv}@
6~*5*-
%f3.^l
cS/ *S_d?
;:S7B5<4
S d7vy
J<S7SB
x4ZHn
Hb&.vU
/?Aezq
5m:u@-
aLL*6x
vAL\7
`ow!|K
^nqg0]<
kg2at.\{
n(n[x?
$~Bu
7&kR6.
jfSRN{
4bTQG@kx&[
]5V5D=
y7m8BH
!-j&&OTXo
qBs(!r
L3F>^@
#(#cB'/
Q*A3&:[
-+|Hb;/q
E?X>&I
F+8Thai
_-(_]I
m44< &
>WRfQwN
;y&"eS
O6U<5iN
F(@o{I
.\VYbg{
:{>o Dvs
'}^(l#
IiUp?M>Q
aadTN-Ym
2{&??*=
O;G*iv
C:c6x
E&i2ZwI
{;*#$;
T=K}XU
G7n#b3
_m|[|?
$~!\rD
Adm0X^
}fSyO}
.S,SMM
]sQakH
NJ<2xQ
x-K*]OPd
V;B.(E_
]pnz1S]m
Kg*-y$
xUSu<(t3
"gFDGo
5}'ire
sR~jE[kt#
"88CYl
zvy"n4
DZ7_c\9*
wg_8*=
*s3E~j6
c54GaDV
SsL|=\
w*v5L~
jL:x P
wBBXuz
5m*t7C
=Rs'S=
^\r@5{
P&Y6LD5.
[)X_ZK
d<d(Fi
/HX[X%
$Y-fxU5zJ
+G2TRL
O21}Rg
eX_XK{b
(alj_
Q& $qQ
hf&t\q
+TD(ng
Q~yXm0$
Vy%LiT
f\{1h
v)qA4&
!4#t[l
3H2ns|
&2/u<
Z@,1PM
0>/ ?
urqXn:
>J_;/r
p_C]|3qi
Qx<J]R
N[ea#%H
4De$T2
T3EL/^
=pR.R)v
ql#>A%)7
,~HQ`b
pY-tM^Mn
+4P'iJS
d:`n6/_
u!Xx\N
xmB@WRC
BRw\sQCK/*
\pG05o
\godgMb
f/#rL=
LyIFAu}[
9"vz:[ <
)0+O`BT/
`Bo`8<
1uS*gF
k9H(U.
emE8\n
$DBpTw
Q<aicge
(]ew]@
hfjGtU
J_i>s08
"7BAKu
.Cc[,l"
6J;xu"
vfs!6m
fHq^yU`
R{3y{?j;
2\eJ]e
<)[5aD
*CQxPW/$
D`9(hL
+`)AKAl
Fq/\;R
?h2!)
N=Z35=@
jw3#L
6]+K+iaq
%kt43|
fs~d11
zdap<9
8bP22'
NIngo Vi
"ndQ|K
G{mi0T$
hR>c$C
/gX`[O}J
!%6:,A
J%BTv0
tB|.M)1W)
p')>!S
(Y(hG@19
)rro<7
[DdW?)}
_}r'hN
dtin.gA
M^<i[b
3bb[CV
2Pujk6U
E&1obC2[VT
h6/Q%8
SNF+DM
=J_*Jh
3L4+R1
}{,1<+z
XN!tHz
kd8.'C
5A4B/k-
7}Qb~C
VS0(le8>
kw_~.N
=(y'I1
[[}ZG3
Wex/(:
Po!.!/
>9j"yx
0Hrg7z
;C&}g6
rXG"q#
?PbPka
OK-8b~
aes,JNv|j
uqQYkIh
9!\$nb
c ;pf
I7~6PE
Y:%Vvp
H{_9>D
uaYN/r
gn,_p.
}C&JLi
4"WXtr
"`h-:c/
!ZPSpRn
@$oc"%H
g7oHK}
:=;a+{M
`o,Me$Y
jPa2m3
U1/f@
+]uPvw
RM\]Dc
NlWdD@8
vR:>c.F
kp/~n}
>vRE |i
S[#p+(!
v\zJ'Tc
72ro{).
gguENVV
PT~+(#+
% MRVxq
z%qo ,
-m&bei
ce[O,g[
D{Sg})
\L?f]u
*Vc]a}\
9fMaTy
+]6}Ly
X(uh_t
KO~N4haB
44Cn2<
qWHO&rc
GaC<.8G
y{UQkj
U_9+=x]
/W.w{
!)QMQT
N"+&"8OV
'$)tDe
QfWFk\
;l+C[8Y3
h<9;{Z)
|B%>C1
dRGZR:
6"N(]SX
hP.;sgS
@/8T32
fdB:Lxm
sA4&
mnTaZT-
5f%0+B
>k.#9E
/LA*c@
G voI}F
)]B;6H
aB=/8Exq
Swq6>i8
du'\R9
guHXm/i
c%_8EI
_}*0CAy
3Tsfy:U]
{:-:
v *?]1
9''v]1
7{q5y)r
5zV[N]B
|]FI76
m:1}JUT
qYZ,7YX
Z6#\Fr
^ t^_'
axsy\p
0\7y5(
P$7P};\
(e~#Lw
w1T'CAK
"X~P@
VQ*rZ\
e4c%L
kXBd$Q
^+~`l>l
#J|0pc9
S<`pw7
CbrA}W
BHa%%rC-
}R4^x#
'//Eon
vOTg1++
(N,,B~Mr
3TeER1
q0ua&|
hcV?N`
xYkdBd
cUxM/hi
%+hv9)
9,;k*
36xAJu:
YVX0B0
Fb>9;m_
e3Y)C{Y{/
"a~YtOs
A g^p=
,DqlJF
>oxH,d
!'~ @gg
<Q>v|A
SHE{I
>+(k,N
NJ'ed<3l
6p8#ku
]{]Q_|+`
/Ty<zZV
YK~W%@
T@R='>1p
nVi[!Y
&}@5q(
>iWid{
IU.D)k
~>L*:D
j38.\wX
(+d[to
`#F%Ug
jya;G%-
{.IGkO
+m@Ta^
*EVwfsQ1
C+_!0ZM
|a(ZHv
]4T#}#
~bXRxS
['_e=[25[Ch
`)e>.*}
F=(r<{&
XSk64.1:
Qpx_i
TX[jt@;
`Fgp`C
Bb@In6
7"f'E.w
TehJ%p
S;_Xg{
?IC$8nb
x)g+)
AzK_zZ
sFtu#yN(l
p-2.\U
nN!~e
jyRj%F
Q9o_SjW
Kr"7$#
:VAS|~
'S3.3
Pz=a*'
xu6#EF=
AjFfL5
7YuP{0
)i:nB5
_HF-{
C'D(LC
Nxd`':t
Gd^Hpi
+."YU7U
DFyD%X.
+**=JSry
~y{z;L
t)T@Cylm
VCs|:d}
?8,110x
kU!m_
l)7[?Q
Y#HQxg
Rl~]`)
9n_6)`
A(Nk9oJ
Hd%p*k
m>x]q!
:_[;o0
zA<)za
0UV+wx!
m]khrW
/E3Q2z
qrkrjL
ZvP,POT
|;>PbE+
z:lES9
)h\Cd$zE
SV8V`n
6qk>ejaj
mf/4N49
V_ZSWg
@ANa=A
fy]y(T
`D{}{z)f
`qyG[JQ
,><Tq%\>8
p_Hq wJ4j
ouQeu;
vl1}v+G
D0x`f
;^m,{Y
xFjL+\
LlT#}'
(fb+ E
SKj0dTR
p[U>w&
iy21@^
JL>>hC
QQheX t
6F0#`S&$
1*IYsL?k1U
823ds2
0iM1)x
Mr:j^1
UMjNo_
$F!IOl
)>,=<b@
=AY.9\
:!Dy=65
ecID"d
UGiW5G0
Hvv!0
!Yneo3
j>.mTO
{4Z~!U
!k#xO
[(N?:(<a
jf!r2rH
T/Qm#]
M9<FHaQ
3pF/N.gd`S8$&
O=I+2?
<)Z?`qP
7PK#H
"qC_N
U6oIW4
z<Wja3
du6fI%F
%|U/6t
:W4 >7
oJqU=A%
f:X;%5
)v+J>z
d?)cUP
(otdx>
_m3Z{N@\
uSdt(]
#7y&wauuU
G~99 A
y\jfe?[
]+A-Jq
l<xZR\k>
#%5j!KC
P9N~/h
NoJ~^k
'r19$ny
meZ6#i7
H6gq"|
<mRWnbP
DvZEj0
WD_/7Gm5K
sd"HaK
MD~@2i
W.CZ4n
s>Cn5f
5X!O|oo
d"X;d5J
DZ)+l&
GyCU+
hV yI[6=
^`|[Pp
)2j/g\)
2%4~yA`
ag,aqj
mxo!^r#
2gal(Q
wK3RUm
{F^z"V
f}S7Mr
NHFW$r
h(W0#F
%gYzDj
eH=q+<
8Tlz@+
hI:H1.S9
G_sW>R
R@"L2}|3
E\nM .
xQ$j[`
iRo~ "L
p~`CGi
(PT6GZumhg
!PE>(1
4ae42;4
Fkp}tM|
i2$Fd}5?sDH
<k~U )
;+L[*S9
si8#7
B?HAE)
Ro"_7i
%({<W&
GRr+b{
~SDi=1
?Kt?_p,
n6f5J[
7e|c:D
@_URp)
TB.YZwkv
(k-s$/dS
-a 7m*
q!>>fG
v)rgAVlh
u18fd'
jvWZp\M
AA<W~uer
8h+cqt
#Fff0F5Z
REJg\1S<H]y
-T#63:
O[* 8aM
<Bl"ps^
Izb?5a
>fGj.NL}
{sB|,}@
?Y`qH
"0Hzmz
8<D(</
EDm%?f
5VU*I3
n4=@D5p
p?]8$
(Z?tg|
,F_dvK
z}/^1rK
?8gHz%
KjR0"^mv
n<NJBn
Ck>*1G[J
X&$q%<
>@U]D:
FHyD+s
Yy)8Oh
t%iI)Fl
p/{Tj?
ZAhJhJ
ukk~-R
?Fphia
;N5&JJ(!&0
j/SsK\2
IO}59e?Y
X~;a#Y
%'h"Je
>BaMRl
;M,+S
qG7o.o
Bl\ml{=
")fKdA4P
z(5kwI'
_QI;O0hG6
WEUPg@
3qRB9U
(gM4*5
Jt=)Sq
3Y~G_$EJ
xjcFN/
mIDous3
6hO_$oCV
H%,[IQ
W)anzK
66whE/I/
T49/nt
-_TLQ}
vFS4&/#
socQ%t
}Ro@I;
UFB'wX=]
8piTbuE
Z<yWn9!c
H#MZ&r
*:q-yM
]H|9?%w
bokr'J
7>$`]p@_U
hEgHV5
l8z^Wl
dXwO'7
)|7+?}
m$W'I@
c@0]ZH
aK|m!B
YBIInF
,$;?}4
_1?'HeN4F
{b /:2H[v
VFCC "
emf9[,V
af5!(?~36
a\*PF
(dko^l
cttg=FY
uR{Y{T
N1x-lA
#;Eh+cBEfd
JisWwT
T.P`)G
G^doMT]9i
^$c\VT
,NLt3\
0qHAc&&Z
!nYkn7
4;u[ao,
r/-0%.
/62CH;.zJ
axGFHg
C B=eV
^I.++L@
VpbCjq
HdyAEEK
M"OuO|wg
L@3oN
E74:zv
CYGQ/FS
x>#2DMy
g=tWQ^
~^S ez
Owj+^.
XkkRFN=
*HWdKz
lGw7%5
\$hBdz
?(5={x)u
Rka!v7\
AI{278y
<i{fr
y[;Cgn
zU7z2'
--e~o5:
O;7Wkm
&qp,#Q
61ce'M
\0}BP!?
I6&Z*$
c|#RnN
$-av[NK+'g
;k|u7Z
0qZ"]r7
%/2ev2uT
M*6qn
X85;Jok
F;k;tS
rZ:6Q<nY
[L/tH0
KQL}2W!
]w36l|
C#tItS
eBv"+
a}/oB>
$*t-s9
l b@7E
94=Y(.4
ty!<YR f
l%/3s
%0Q,F4
l"U7lq
7V h3ybQ
C85=bM
l"]/4*'3h
ow6jn*
tAe,5i
0G<PX-Z
L|a;Z{
"kn/9[AV
q&3pow
xOA2F8
J^z)*r_
e-Yv/Y~?
/B?5Rs
o&"|!w(I
}L&@5R
B^@)=5
-x23*Z
Cr&-&=
`V7_U|
_Lr":
-UmX$au
ZagUl7
mMKZl!
|MT+oP
Z@>h<3
i:+:rRm*"
6 Pj(7
'A'/A7
O{Drl8
&@k*ksj
@ *@;:
4*iA6X
0s^b`}
mCz|aDz
Z"@M"u%<Nt
~@/fVYS
*Oo-?
*FBaB}b
iC4cNg
K(.]H5+
{]DsvpY
g]J)o|p
'>:*K~
DHm,7dW
v="z;b
\Yajhy
i"2NEFGWu@
H-#,}:
=q}hek
4rJYz4
CDWNnn
"8cV-B
L=9ejQb[z4O
4"AJnfJ
t.'oAl
\Oc 7nuVj,wht
f%RS= 8E
W/ZP<A
-Dk,Wj
I#n-$8&
6o<2tN
}QK/+qW;w
r.M5aD
U|\56M
eQKD2y
>hc&6T
^#e[o1
k(2&!!
r42C@&
h%`CL}
ZL!35L|
vtkiKZK
R:yh6x
g<'j%"i
tEA1in
hU-:ri\<s
A2 <.
/a@`Ic{0
7Nahz0"
*-^kc;T
Awkltr6
.fN\K`
Y0Yl<Y
q7i13WT
z_1).'
1(k3V?
cN-YEv
e}HD_
LGt<\$
E6Ph]J
`]P><a2
aF.{iyF3"
2yg&8<i
szbco;
) |x+/
ozOY(#
X.cw;W
%z]GsI
Y /zfH
m\ )86e
Ygwpe\
1}x`_#
hRwtVyl
-g$87_
%Oy(+t
0wdH;P
gr$l3#
hyLBQA
/M,,xQ
W5^6n
KHWUbW
zH16Ch=^M
6<o%fM
Y,h=T
:pSoxs
:<43JBq
9X|>!d)
^Xd+LG
H=En_PeCI
eo?"5fs.
YyF|(*a
9se!HJ
=a8S4-
A,1D)3
3rp[G%l}
'`}O{q
+hyFD]
5WTcmR
UBPm-q
K8EWd0,
YR8hcO
XH}3=9{
@!(;=T0[
W6b]Ow
~gKDO4J
6$Hc~E?+s
$ET^~%
G/(|(pp
`:~bMNd"N
JzWup\/
%v\=!Y
tpCpJF
%8)Z%<D
_LYH5_'
|2OeS\H
nu$ F
$]he2,
|<gK"JK
qB30]:
XEwsHJ+^
.RJ\bE
6U1'1}
>p:h ]5
wsWk!l
B"@Z+e(
3rCY/
!o4l{4
b^8gZa
%(72"T
n-I{=K
okZ4n'
1j9^+!
B^*T0g
@^/,#qI
~TwvVz'y
8(fffH
7!O8Ghuj
|Y71UQ
Ad,A!0
i+}gt
OzZVY'
!Z%%d)
NZ<Qp+
9iR[zx"G
FI"Zv;
uzQ5x?
FXZOPwK
\Y?wpH
)1ZUW~
\]|_GiW
UggW|Z
\I_#_\
].{_=P
H)**,gE,T\
XyxNYG
4[1hK$
6m9NpnFTp
|RbyP&+
]jBgpf
lYx$(Xmtw8A8
30qq?1
QvxC3z
ch1BlY
&:p"y=
!v('}$l<>
:rv@,G
CBz)pS[
,Dw,Yh
tCj-CB
U#n$ V
E{g91C
!!V&djkori
<3gnK`r
#`wh@;
o(x7-_
9kRgdg
|(y:R-
9.%F0D8
8VP.2[
vHP&hv
E|M'XZ
da[,mX
<AZKJF
j^20'
-elmyKm
B*Q!(oj
x=Q9<j
k@H0v`v
=w8,Bv
w*d&yZ
w:S4xL
oR)X%3~
U96vI5
|b0~*xu1"
Rv|{FA
=n|S9
Cb.C(Q
;GKBY_ j
$/A)msu
=4C"D#h
68`8f
m][FMH
it6f)F
x42#.8
"2)p}v
oKCCfnK
`^!5(+c
FvO'T
izjHr6
'ggs*K
i$z/:d j
T/?nT4
@{Xwl=
x'lu1lS.
yb4wEp$
kYd{eI
JJ+8c/
Q0Zra"
&?]a2`
ZCwmxx
iA($Ik
z7{K%[q
;4}6sz
Ief),D
4s\%yMc
h-lrEY
-Wq98G
4o.T=(XdH
wx-/{l{
7{PO9Rd2
ZllV*M=
yFZ_8k0
)"UjUR
|kj`ak
=pO"05{
@%HE]E
G%0YP2h
F\jQ]=
Vy|H\.@O
]gwsr*3
r?]-^
DJA_U82
OBWOv9
zo5RAI
&8pL1yS
9Grr[>
F1r(
*tw6WF
/8;:P6
Y|_3IG
+l[b89
zx0DYJ
iq@'X+
(p&@*t
fK%`3EP+
Ij<6/wBP
X1d?rP
dfax|`\
bC!=yIC
(D72Jtk/
A#H].a
Ok(1s`
jjU4u>
N*Cil(9]
KJpSo->{ySK
/b-X[A
!#(]L9
ebrt3E8
Qj'BX"
<qZbnH
]\dpHs
N+qtD
=|io0/K
sI%X::
PrH9+2
KTdohr
#b!?^)eS
G Lp#G
|LGDS?
0LMO4,
U9I&a%
-5+}.W
Yb<'F?
O:xicH
\\0,6"
+=(sD%
>@99lA
v-*7,g
Sc$8nM
p!m&x;
%$;,z,
#W*:5X
`ok4jRM
}{&qTN
:X6DX47
EdDk3;
5d}5jZ
U5KX-,
3KxEr?Vo
L$YUs|o
\)/d?926
9n<"^h
Q6=Zb`8
|NfiOD
DPHM+
#rpQS7
SiB+|c
R4!y~B
`vF}w{
Sz.~}7M
nTS<`
'*M`Xx
Tw'!BO
)|v#-c
|"5h_\jrC
L/h bP
}5fwLU
#S(#D:
L4@+2:?
yE6 D1x
D ScA7
m$E^4k
E!^e+_
r!LLoX ,
nVp<DK
#-0+ ^m5
"PjjJz
[P`V23
a.vmt:U
H(-=p
_UB1{B
ih@G~c
,HvRr#
i9dE5sb
4'4pI6
[F>3ys
:l^L/2`#
JThI,k
4~Gn<CV}
raST[y
u~>I(-
X@B"lnW:^h
UONtW_
{DB0L%
jnpQ*c
X^&!py
HiH)Q5
1udIG=90
{u]-
V`WO&a
PCq'=M
w*/}pL
34Joo{
EVP"ya
0sg&q$w
z'cjl2
<q($4r*
K0\7jo
08SG@md
^/_w~^j1
K@6o>N
AA)oi2`
\v,gmt
EEBvk{MS
>]"M[v
-Z?HIn
1OzVmT
m<;G2(`
wK\LKe
c#`VXW
.[D6mG
\WV-Xw
({uIt)
U>$e5^
~&8L=
=0*3)R
ZhV;rR
H/FL#%`
OHA#I_
A]vK~)
keUMso/
mOyj8^
6X}mzSl~t
LK%`}M
Ht5S{"/RM>
NE\8g`f
^@\yL8
( QAr[
N, 2N)3
N=1~,|
xmYkPdL
}o _n}b
E9s|UOu5l=
icQJmO
T2>~S&{c|FR
w LNx"J`-^
RX1Kg"
3`]01L
5vJV!o7I
/m]ax=
9xUMW0,
Wm[NF>i
T:>Q/Y]
DS1Fi~4%
zMZ,_DJ'
k+<N)l
4<Y>*+
l=D.F:
]~K?la
#oCJ%bwK'
Jn@f1I\
\xjj3M@?
=l$c6(3
),Ys|~b7
(%etH0}
iWARr%
+>u:5({;
=8X*_x
<Z/tEi
q_VB&4
~%r;$k
w<Q)sR
`>$$[U
V!y`Ti
XAciB'
4FcP=v
,M7+lA
AUjzX0
*o>PAc
V\Y7_!~
i|Qpvj
XI5:8\
2|3O]Z
!X@{8O
bv%@t4
8{]noU,
QAKyv5
O5r"B|!0
<i/wC)
p.8@(
K0H-_;!#Sf
wcM{$F
mcznU h
'r&/5(Dl
`d0k<_
,./,$\
ZT$y^4
:MCr.x
!UNJKy
]N5lP9
ZwDFTr}
iNnu(t
FbVJ[&
Is](zZ>o
@<Hx,U
AzR}]s
N]HoD:
GA2``B
!8aVJF]
_N}3ha
L|Vq@M
]Y$5C_
5U2n-p
=b'7Z&
,%s>1x
6V1A7`
_efGl6
G2:YEB
t*L thQ1;K
SjNsb;
x*sdl?
Oz+@X;
m| Z :E
IxPd8bo
O23D?T
|_pU]bwZ
ToEwbW
?'G.5u|_
O!.-3
M%7h+'
(0@T7/
k`QQ6?
~5/9"*
FQ"PW%O
~d#%<=
q3:-hW;
]BF-K_
n,t|7D5
?b$ (e
>M^it"O
8!KC[O6
5_8^<*n
!Zh`BY
n8o,R>
3t'r?W
'9>i_@
!rtd?~s
g5N/t6Rx_<
jz@e~
P!L+GD
0e1Wc){2DM
n2m6mz
SSD4up&'
w[c#ju
%scB1s
/."qo:
2?A8IdC
/mh?Ek
tDrccLb
}rsx5s
Di[w=X|
lgeHh(zxS]=p(L
/0D?F"
3Ay?~J
(3vb3c
8{* $k`Q
5]:7aB'
'0[|RwD
q](]b1
fuJhCDXR<B
\2Am#sm
.7<H~Cg<%
$"^TU/%
yzw2W\o*7-
MEzjiv\
[iNnb1
+~cn&E
*@-%`'
8(D'~Y
z)1r-NZ
]l6V&
&).2W6
2LTvBE
eK'(T.(
Gl3gq_
^&2P7X
@p0#4v
%Da>Q
L(R:+h
\@EaPzAq
t]xYpr<
5llQEc
\/n"'T
K0lZP/A]
N>{1'DoP
iSqCb2w
e/n#[@
26GowiR
$O`gHb
gCD?wxI
@#'vH>
^P.cPl
V^4:6s
8z4@[+"
vv{q,e(JC/
vj"f%(!e
w-Jc?E
bM"vz-
r=q{!f,
(@Xtk"|
Hp|rT7j
y^`%O]
8R%~b@
}M\O:G
".ufB*
k~HH3b
+OlI=!l
$qD`Su
{$B&m$
&VfDF2>
=l`n&V
;'LGkC
Y,;a.$F{
~f5(-zk
CN[D!9hU
u}T6Vz9
-;+])F0k
4,lmes
BE$~SF
,cK_@"
wI0L>v
S|2Cc,*3ta6?,
~~E4tm
Xc!m}z,
SS$!|
6]\\t>u
m"gnTC
U?!oT:
|$;{9k
]l%|+(
#fHI9*bz
(^?u~6H
iku{jU
%M4N4
]'"iN0
ku(<)$cs
= _bjk
jqelC2
5cn 4c
&QB*24
m^(Nyk0
Jn-<"Y4
J&Q(+*
Bn\9?0
)q06Dm
[#6Vy
U=t1js
T|CEzk
/]:Iw!
r<D/U|
_}nGf}
Ty.hr6I/e
d~vw2C
(!g|J_
2i`'9.
(.q3lR
e(A*(:k:
FIt+||I
0CKwHU!
.4*AHZV-
ic)w%F
jPOjI@
,Rpkk;NZ
^J3*q!
BFTCF@z
vOy@M|
1&'V>.q
/!Er.4
k-|_57*
X7X{N~
1Gjlh^
2-\]?n
n@!lHFY
S&9Jc/
icg;%2
0Nh!Y$c
eHUEhg
5svxB0
Zo[:(8
tq/D.R
uW6+2\74
*=dE+b
rlH+5bta
Q2Clel`6
`*"G =N~
b)EK"K
l'w` VQ
"!K$&#I=\
0<Y8gJ.a
3KN;MS
[Fu"~e
6@kdja~
_0G%y%w
=oBuQ.
&z;/a4
1Hn }A.
GbfwiN
lx}_2mdiQ
^1*aL.;
ERc3(Ab
Y 7cd`z
lbSY|z
[0d?g4
k8~F8k
D7a!;L
vxZVhQ
d:z$ s
~Zq/tM
lmSO(Y
O"j.=J*6
VX?E]_
~^Gi)r
{i3vq^
l_Xf&go
Ix52(#
#rYmI/
(x;cuO
Q5WizHC
. 4z>%
l_Hr]~
{y}'22g
9.Wtt7o<
f<E<pz
{VjHN[
]@)pO?
cl!N<R
G 8 1*(
aTb-CQ
e:A<Q_
(Z_w,%
Fx5_,H
37(N+c
<r_lv#pM
d8>Akg
<s0LaP}
r/+Np8
$*wv<"r
{k_ydi
Keuj:'
cNl^)R
fW^/H|p
S3;FQ(
irM^:?Z@
<p1u4QE/
hGCcyV
@[`z"~
nZBb{~
&a9+_sW#av
FxpUf[
t*7fAH"
/9ye-A
G,,M&^
=5tZ:&!
4rX2Ci
T#otLJ
=NpTK!
rYNNiMD
X\7G#0
JEsZ!c
|('xRt
hg4/8}
=!]*k^
JF-d}P
'N$|7t
+?4oj)
hXDJ3L
2|c0,(
}n9J[y]
1Le&(>h
Y&aWk.
+ 6BO6!J
V,~;HIs
Z0N`Ty(
i+qJA+
!D#KPz6m
nWG?ko
!VP-B|
)!]TN?
H\J5?G2$
i*q-)5Xe
uG#-"
7XeS*~
i2\y($
BOku"+ob
h]tU !!
N+w~mr
o:j6rA
|h{6(m
dLNC^c@
v;<@:/
WlM~G
! nvCoUU#L7
Y&B3Lf.w
TTJ>N*
$v]T^
wB'D[_
;25Ah3F
Rdh|$[
6/R"LC
7:G73
1A+(1= LG
Y/-~,T(
$ugiKCN
1TXvi}?aK
"07KZJ
33zFl'
k,%#/y
?"<^"W
q{$*)m
7>0VM$
1.LcN:}
TEVx{
TLPQe
Z%t9!Z
Nlg5_"s
+{Y$(i
%\*4yq
wc;kH#
}"YXO.
lR%%6
NJ&Ut@_)3
jJHOrSTo
$?.wq"&
U+A%Y/
8qb,'o3W=
c)BD+a]a
wME8z;
T9y5l3
GfGrel
\~x3Tu
Y,Yp&9\
)7d3t'\'
2*';<e
C>Q<P>
PL+@>$
?_HeVjC`
?c1Lnf7
A)d</Bv
]W;Kl1
=I56D%
,*%';^
ovCGT!
c4J*eL
WcnX_\
7R-+`R`@
Kn!mP
V:r?9P9tpU
e0I*xo
a[$~v
82*FROJ
W|G/|vE
no8Dh=]
|CVPJk
]3-A,a
ss(BuA
rI}Q>fu
j*\rHX
1=pYi>
F2'VgiV
f<HO6%h}
^[vhv*
J9O*krV
M&67H_
RFhW5PT}
Xroo8H
z3f[/a>
p`Z/$ u
ut1HZIR
LmlBO-
GYSya,J
gYz:(x
SR'ij
Jep[T[[g
?+X*/
oxh5U0
As,<fc
m<h>+ f:D4
nY*+Ha
AB~$d~
J(Yptz
Vua2og
pSy+oI%8B
?{zL@B
CU_5rR
hn8sp\
.s[vY@
f;LF'CT<
CQ0A9 t
)"e*kW
JCp#>p
AG4 6d#l2
hOpsq("
loU5y+
.:(%$!
)3MbN}
(Ckc>n,
T6JFQ:
iLB}k
1ynizM
*_hh{lllyq
VMFc\)
J-+p#Tp
lE]`Mb
lM@zk<
f1U%I4
\`S3kz'Y
oOI`MU
]OdVpc
$cWC'=e
UJ8--E
SOiOIr
xDT 2g
(REWl8
y]l|HE
)5K(hpd
AFb%1
/8DwT&v=v
<dJv`P/
yk:DoS
%{6EDz
W88Cbt~
d$E18|h
f >r~69
6fUs>K
a(G?1O
tO?keD
|A2xcX
axn$tM
Kk$ _`$Iwh
DLSl9:
%Qw/6-
P@v<)I
^lxlu<!-
$4EwLI
t&z*K
_);pkv
{N2vN|
v\SBv%
E9<#{y
_dSbnb
R@2f*6=
Dx}EKS
f41gc
,~Og`O
$Z#ewR
#z6VF#E
`L[%bb
kSJ~b?
hRd).%h
yd5/V;'+
e}j2o)
SdUDW(
tYIgmL8
ZU<1YP
m086g`uS
qJio<t
$_yS/d
$?JWa$
: 5eQ{=
G|31b1*1
l!zG%X
%y7exBN`S@
\HbK:d
-.?;#tg$
Ww;iAF
6%j@AI
nsvVgBX
XV4F;=#Pd
c ~?F(
}$Mr8+k
+q;Lc&0-
Lb>}w\
7mr#W`
C^lh>$X3O
yI~1gW0Ji
f_^xAtksi
)Q?f>.
q}vEC:
qXNp8=
)*PRpC
X]<jqr
!<5%zbP
XS?&XO9{22e
Y&]kTr
*N4Sgl
mH0G!Y
YHb8)@
_RdG]U
#)CAJLq?
W55y(
eK+vbu0
&4iGiL
&e!T6D
WbsWjk
^lRg0%^gD
zGe72|*
">Dq=:
b{<\ \
K\S?-j
HkC x~
g!P8mv8
.r.0\nc
y/&MqU
ARifAS
|hd?)'
#gPeWp
"g;%j|"
~E<5*~T
V;h5B>
,-X67n
{H4>Ux
--Z/y6
{'&K?-
k<D2VKPl
c'$Z*K
>(ZB0i
F0S{`Y
.9 /IP
l&;x
idbTR7@
kVMSh1o
Mcy\]e%
UUB)]D
N&OH"0
IFET|/E>
Tuzssa^
#h/83
{ZF`Da&s
rmm"&]
ca<u,`
4pY}&pZS*
9mW%5I
}-bx,]3
~p90wX
^&8ith
o<z5{&
bw3TAwY
eGTi-Ij
]sKwM]5
x1J4WZ
38 pk^)
scEt%Wb
~#J_`3
dx^IC%
>L1\<|;
,.}WPC
Q:-zF}
3zSYH0oc
oq7uq*
C!)M/H
|dY6^v
%.G)?l
b$1PQW
rz1i*U
iBd]a*
)KhdOD
;p0?=`
{DfNv_E%
uq%[P4
lK`3!41iC-
VVs~Et9
XAI'rD
j+w"9Z
N/z3<bL
6l?j/;
=)5hcD
t$Z3]y
6Tu{R;
zQn(pF
!ay.q87e
A(2ql%
eU}c9<
[Jlin~
PE**};
X~kF"#M
9;^TlP
ir(K1I
"0d Cw
e&qJ*G
0Y}AK4
~O$W5C&U
k$QhA_?jg
14FBE~
K+o6AT
])S<_0
rp6&o>
KS>Fwp
|M|psw
8w+N|O
x7Tw <\a
tbI8rA
aNuwi;*w5Kx@
Lw~YZs0
{6cjUr
Z]dF
:N2i1e
55Z-={v
OzQsx5=
[kAOZ*^#M
uXtPA>
OTl:-=K
9+&StI
5I@;h;
|a{|y]o
N;g`DA
4(*R%,;U
G9g8{_}
joJD+n
((?"Ne
}5m1B{
<SN=WMEiF@
s-&{nq
$R$mgY?
s,[a"n@
ZnVf2W
JTG@S~
o0^7.I
+L:0,n
VYD3G$
Rp|z/R
$rnPrO&
%Megt_
k_Qw_b
k)$t|+x"
(Sh`F
).AzRu
%ixnM%7
[d_t,s
q%^0TwA
6ZdIPK
Try5bq
E.go<z
3sp[b/
C +ng^
NTego~OS
j .X[S
L<%8AGk
6K*79:
Vnel5-%
eS<kMP
Ynh/g._
!XLKX-
9IXTay
`P~A^[sf
EA(Yp3@[
~c3m\9
s4N@CB
RBZKpz
Yo=8/A
UmQ"=2TCS
iCO/,PO
0G~,6P
OvpX4x
_w"tgU
]]g`j#
Q5^Q7{,,
jbC\3O
[g'5-[
l;0r>E
S2.f+Z
{BFS-Pd
L}zj)C|
A!XG]9;
($mYZmc
!^!2a@B
Sx_a^q
-Hp$H)g
y2 v0v
/n1LPd
u$m-AJ
'-j<&~~
Ja6F5b
n8j25/
4VFQ}$
X_ >V:
s8k!]@BS
MM$+`F
`,PY'<
<:/AMi
m0k*o`
9)Znj;
E5jg-$
QsS'\"
TjDp.MB
]gQ2!t
|Ja<0m">=d
p,y.EY
1;6`V/
e$ey!A
+PqK0}
#\cgYu
_BZtLQ
IZfofK
o&W#[?
r|]Fh/
/\*zL=uM
%*[D$
ucNr SaY
.On;5A
c{|r!G
;c(-|2
r7-&1' 6M
8:sBA|
q\uMh'#
S7}Y |
422GYNs
gq}93C
_V5?<B
g{rj!K
7'xkC
,R.n!
Bvj_nt
?~O0bb
}MI_.BiG
t6)p-3v
s2R\3G
j#.\IuF
DoB}PvQ
Ch:rz
Lu}xL
z?DAIne
>UM![cxU
nL'X K
a%Lx.A
1J;;H
l=*<e{
kGCT
*!T)j(
tj{F0IYV}
o|$n$w
<Ul!bbx
6<'jbE
V!tbD:<
a'Ya#V
^R%%O7
l@-<p7
AA'di}6
68QSPZ
MihR&6
AfLC1T
k!AnG=
C/k=)c]
c2mjpR
E<#Z(,W
5*8'w?
u!n#lR
-`nAxe
b$YCuv
)\dB#]
kBE0<FkX
Aq3+2/
G7p5L
HPtc,Z
g)@PL1
</]PV7
,rhG>r
,@oCR!
Y'nG89
_1qmW}
S4hb^V9M
,n5_@I
hk~2 2
BSsrn$-
x<$T7F
!aDwBn
a7kue3?N,
5a&B`)Fy
_69BC?
5^}_*Sx[
787uah
>T56rS
^+eCV&37MC
V6}k6/
Ug7P?6
eP@%g7
p3Z ({C
1PJMew
}(k$V|
rOT74Q;
2]Yells
-Mv6AU)&
Z|l56d
`NXcYOlK
phb)1>
rw(fwq
G}?xE
<V%GY
@,pfBlt
=|F,#v?g?~I-
{yu$*y
H/?A}tGo
b<qnp,
;9nV }
]cZ$r;
|k$ejr
iJ/=DI;
4KxL3aU
o|UQ|R;z,
##hHkA6W
\2O;8[
"H+>N"
D.l-qC
)W*tP
'y!7?M
_UWgu
$FP(JR
[cEkvJ
F\EUie
GOd{mL
^IeJgT/
SR9=}R
!-;ug`
_:9"G4(k
.I'.!
_,HQGhY
34M&GDP
F48F{4i
wFVXfu
U?CJD
FvFyctL
~+|`SB
@XP8|T/
b]nBF2
,lpEvlD
M:J^|o9n
M(nKJ'>[
Hq7Ken
w)DhuM
`VV\t_
2w.nkK
DLh}u+Sn
$jAXB#
Za^F+*
[I\o).
Vy];'"
0qC|b?
#=KRkD
Tcs7 v
09cr94-&
bV;0&I8EJ
lb<-X5I
'K5LOK.
Wt5/m5A
h5zS8y
!?gdgCd
I.Nb+@
_Mi}2)
N#}#m
EA.?l
89"5h_
ePPN]=
z!Zh~)
}1G%M7
P2^aK[
V;P1g3~
_Er|@2
D6%H8MS!
eJ||WX$F
h`+/|)s
oi9I%%
3\a<A6
N'/vzSX
&w:OjKkV
2>r%6.
Z hR.[jT[
%5jL$6^
)A},Z@Ab
q_XhG/
J7Uj$Ru+
zz`(jTC?#'
#JyJ^In
<;c=}A
!@X|=x6ko
o==*Tu
26yfXs
Fc-u=[A
pWJP|SB
[J7!+GK
[ULaVZB"
\!gBAt`
kX0Z`
}Fb;@mNb
Zm9QI[
,Yu6cz
kP$bx]
/[f77p@s
s&$do/
aMz4.1hW
7[M{U"
^&9Kn;z?4G
<ujKf8
'7+y./
P]7O!U>1
o}w-Qa
*5#<-B
+j|l]%8
wR45bA
3mpgN|
Njt{R=
?30!<1
M3on6\
i(1DD2
#4.2;K
l=?dO#
[zS\w@
=&nfv4
tM'BalP
YWt~^AZbi
*R+t.|
;\RTDd
|xMG2q
"bo!]e
Q0m'Bk
]rXbee
,v#yz3O
#PvfLr
k}12Z$.
18+ %Q
z*E\OI
a1f;l\
Q*"3PJ
| {jR\
*W0X?X
4U7Rs7
]:+;}5
X?ZqVU!
3gP]zq
N.v/bQ
CdM=qa
Hmhfp
Wn>weE
MnJX~K
")>,|G
kb,!x>A
|vm~Rk
{&Vj)X
|4mlLc
,<vrq+
.Sta,V
S~4.Z
>5<.AL$C
J:aTFw
1"Mja9
DesXqX
d?[8ym
Stbcs=)
e{;z"y
`,pg@6U
DOXW6<2"
ma%.8{
P9g\Qyt
8WR2d3
lqHvo
Op'"u@y
N@zv[H
Z!7=1ny
/^%oW5'H<
^waTafV
Hp#IYU
B,E.pI
5X6u-Z
Nf}M'>
(04LJh
TtF)Ri
Zvvq.h
|e2@'{,
8'bZ#,
ZRzmie
p@&r[T
@%?0uP
vH0l4J
m~r2AD
F'[&=1F
K?11K&
%D7<sA
xMV9 |!
z&!]":
D:]tgJ
'.]&^7h
-?]k{a
m.P\;F
_SbQQ7U
:Lm`Fb
NcWO3H
mHNgm4u
OW!VF4E
`,q&ql~
@Tv_;~1
VFiK^[
2<1W.vf
*rXycq
*[Z@s~
'i\o@d
_&)]6;
(Mh+WN
{_`FVz
!V`A=m
p<<4W*
GKz>:@
Ym-f8U!X
8giwn}
U*8&%Vg
q&%1Fz
WOr"`e$8
8V{@)
:`PQ#E
6bubFn
$s$t^y
F_Cy&/
pjp!ez
NQ#$B!K
a1^m^Y
Wi;32YZ/
ox3NE'
Y9`,3LT
?XmM<)
h}n]?'g
?<4Y8DW
?3/PD
gd,OL/
"ibw>A
h=!9lb
e82[S<J\C$
G='Rf&
$DmG,%N
Kj]HHp
]ew[
Elo=M;
T^`ny>>LM
9^D|d4
o6z`i#
%VS^~&
>Gq}oG
OI,q5p
91(_-.
IixRn
rLVuv1
B2Cd-X
kE!~dA
Aj>x=E
:c:0F
VS3W\|
5DH:1?
oBIU=$
3hwJ/"Ek
StQ-s%A
UT:P:A
wYi"I3
l'J}0_
."A'X}
680K#H
9@~(G
#Pu,;B
B{H*{H
2Rsl8Z+]
#%+F{%V
w7A#KnU
LdVNOz
[jEQhv
YzZ*0,
Th8<*@
#\3;9bD
|v3[n6<X
")r:U~
DKiCzH
$V=6$7
uNH'XS
t4AGIs
{M^KP
MwmeqS>
rXf48}
rh=W<9y
lcc4Qv*
(N,cz<
T[/:'Z:
=Y(|@q*?
:>6v;=E
7vr^t~
m~mU6s
|3IM\w_-
]v\x5,
/$-.?IW
vZdj$
uZ73q(
=99IA23
{V:*4@
JaKv^ut
qeJW
CMDQYs
T`z<lK
UVOMbC
M6&H`&3
0!t;nL
^=;H4t0
rgoLjo
Dgc~!.
ch>:*
LQy3n"
8vs L
Vr4 3i
LJFKkP
11<Vhu
~'9Dt p
6#(MC$
hj@{|~
+Q)'OFI
Y-%k5 z
:4*~k#
7\?6xS
mLq' F.
$p_'(h~
[zV`WYz
.^44/{
H~&;JP`X
i@W]abd^*
%ePxPD|
I}dp-T,
"u^;^y
`9K3t3
eXu3hY
J/|Ga"
."y9Se
7QP$k65~5
0wq|Jz\
g}qD6e
i_m^Ww
@zvKML
hOm#eF~
9KUhy
]C+FF"T@
ui2kkBZ
qrZzju%A2
0h3L}I
q'll}G
8mHj:[
Hz,l4%b
Oy.;Y
zhNptM
7r{'s.k
Ry1)N.
[.f=`<
f..x~W
W4REKZ
4FJt7>
z{v;rW+
3(?>c-\[
<Qj,"m
lI!.!^
&!Fe]tD
1IIs!`!
*53p%m9
Om9Al0
^94@y"
"ZX})I
fS36W/
gSz^;WRM
x<UtwQ
W8M00lXF
l@3an7
l2B+"M}U
1v;P6?
;K2k*/
zv*{aQ
+;Hfk-
7$<m.L[:x
];(}d7'
u)@(^L
t;:6jb
=u0fCE
N`Ex0s
$*/(y<
/=:Q)j
,(Lgwb
hdOZs")
g86peDj
t4CBgN
zWa9e
1`oRyf
IHe~%s
-gTdoN
q_jo?,+
)Kor7RT
`SuC$*1}
`$8(/K
c}[.lD
}oNb&;<
3RU%tg~+
|(-!N}
|#9y?_
}QfxF"
ONEK!i{
w9Yqx$
B)xXN]!
5Hw[jZ
$}k4P=&"
6S)FiT
&.TM]$
D\PD'z
#EGqlv
^DP/Dmx
1Qa0j;
WML;<!
k2y"iS
DP-i_?
u|N,~N
(w(XmDi
{TZq5v
$qaHu:
`&Uwx`
TfN,">
/HS_F15
,$k!N
=&lf%{(
@z6`%_
dv6Xhd5
8L5A)3K
zlHxiX!
'Ig'gy
0t<,d,
@s&DkV
u~!#tt
.y?I"5
w`(uo
i3f2zuS
zTzo^+
Q$iPgG
=rs.tu6
Sr:icf
O8E7{B
3 U,siIe
p8G\8X
2!=|iF
7AK)dmX
%x*H0d|
$b|x1S
,.#{9~
,9.q]\
<+9A*N
#TzwNy
iYpYZl
.|,.A'
V=F%3,W.
p12W<
tbn4;O
+q{YM&
L"PzQy4yq>
z/HHD-
>LHCxO
iu!(PJ'"
y(%M2abXS
zEQG8,$uUC4
[Nj}1cD
ReFzG
d')uE<
8T`FP8
[=fDa4t
nyN[1e
~pky/+
Q^{5QP
$F:rZf
B3;U#>
rB%O'J?
1hTXD#
jqo'p]
G3'a^X
/56%0
gBr1<r
hfSB59w
=gd/\\
)>Y'+%
Atm;Xx
q5@ay?8
cd@y3@-D
b(KE,\
>@ ~z@
ll+d)?
5H8J@K
bEcG3|y
ws3RrP
U(y k
I7@#*S#
X.ian:
KKh'Of
E$ch!*$
+2{nqb*
SE'{bO
095z0bVO2
^V-l^L
^'6];L
%c;<x[pqA^N
-7:G9}
&-QF V
"X]LKI.
t[x8WB
|5-z[h
$7qm.zNBdQ<
9YS&d H
RNN(Lm
EcyDHN
LIQP=(
jg{\9b
=D|]cm
4Jc8l*$
4w4FR@2i
'8Qyg=
bys-X=+
md>r62yw+C
~>'~HT
<BVk o`
Wl<UjH
i6nn8%
p1K&.S
yV9<4]
ug?r,=
28.MP8J
z{Q3vn
-pmh*e
`]Lj~
n,WT9x
+2xR?o
FJSHgx@)z
<"2RP
b8ZdSN
izx,0[M
-5f[i*
YVV6[=V
(XfT6w
|=d"qt
k"W10gq&{
G<Q(>VK
!(HQ(anR
TFd{]g?
Hl'e+-
/hOnPQJS
>dw]xp
zYClii
oIBgG$
(4QKuWz
M&O+K:e
4e-./q
;!H_q4
m/k8C6
Q7*u*m
7b=GnJ
_[fnH
o(Ki<B5
-k-V&*
{U#H$@{
PsLvk<
Q@0nX=
Z$=3Oo
&=ZHfW
_4R[a4
%M3`-7(
Jp1JM
ysdRKk
Ikd5T+F
&9yhb`.a0
ak!C!$
MD,+In6
*en`@_o
pi(Ip\g
[*Be]?
V<Xpn+u
,eMv"j
Xf0^5A
@.kcWU<Y
1@w-}C%7
-$iBKI
fUA;:B1BM
lCq'OeyY
n\t>Ib
d2hyxR
=II`$/J
Vu=AKi
~myOI
>G+k=O
X1O9rm
6e<,xl
6e^'O@
qV)B2,
&(/Cf}
eB~J^
52N9&O8
(NA~FE
![FEN6|
)VaGOo
k.B+Und
q%-?Wo
4`Ou._
@Wd:;C$
f,XIr/%Z
sP|49F
rUr,>#
Kj/./8
3;fJY:_
_'|>C
(_@2sd
|1H~jKaE
em[[6,
}=\ n{
UZZ{2~
E,ViS/
%Su0i0T
P|d#?t
[:y8MO6
`vX>gB
i#7j!8
Jk~BB^
K8Vr~$
Eu=%bE
f"D[:tQ
:XBw5MC
&Wh8RmO
L>o?;+
#cHq#:`
B~e^:!e*p
xqe5w(
+_IIRR
l[veJM
[QhP"Wh
L/RZ%
tm>Gq0G
h_MdVtg
f&&od[E
4H|IZi
4]d;p`
KYph8
7UGdxw|kl)
(D.\nl
&Xy\mA
l7lyks
w\[`$"
]C8&{I
W7\hD9
pl wk
-#nq1Ka
]nf@#S
a&sB7l
bDpY2H
)yRljS
GC} K8
xgVi3B
+cb>$D|
'_9Kbz
E$PL%B!
v-/\#QTmI
;:<G"L
,@O8iQ
uN@a]x
s,(?nH
L+7d<mA
-c$=PG
#UA4{4
2|7[s=
9e8FSq
f{D_t-
pq;`!eP
<VXZ}ic
cQ&Ku2
tSdFL)
M+/DVxX
+>4=g]
Q:O?][
(\??="
5 3vaN
8~jI~!
Z> lz/$
n%)$UY
8SwaZso
@\Z&*`2
~W_rNf
,XiESD
:NZiSA
1n)|9M/
Pl21:~
q{2g'o
0@t'!
1.,/n~
)W[PH%<H
3'A9yH:
Fa%)o$
qoV[VL
gJH}^;\b
X,,,^Y
B 73TU
V \ipw
tY>@!|
60PyA T
!&s\H5/X
F!F",oC
~!C\sf
MSjVLn6
~Kj&?#
Nt[GEa
4-_&{
zw ]yd
*W5xSz
s@#4Y6
xs@xKg
<IqIY57e@
O8<EQg
#Xg9|V
=K,?2qe
%Mw%ey
4=q1~3
45-}?<
o3E8-F
Ll!7/~
92i-US(*
kTT%|8
Uh"GAYt_
gy ;iQv
`;5;^p
&!1Bnp
T6woY%
V1X8fr
OZ>s_c
e7g(yd
wEJC5Tu
GT:'Hj
Mk:Rz]O
Y}Vq|4
23^;Dp
v~)_4w6
~ MTv#
w>/%9f
?y[A~QJy
3&Bl;4
T|D*k#
`4TGfx=
e2POS
+gi^f
,inzDW
u/Z01e
PEnv4/
<Tdi%Xg
P}JiY"0
~XPeSMv
?~1w5gK
GRp"g>
|2AFyc
I?=vyn
>!sF0[X
P~o f{r
}p8YO\40
7N6URB
,s+Ugw
01e#?:o
J^,\E7
gC4Rx&
jlS4H^\.
b$xAf/m
EKCVx9l_:F!
R[qG9C6
v{._4
\2]UP6X
x8A!+M
[9.TXD
6l$SNJ
|A.a/?
]aC&-#zT
F&9YAL
\6LxwQ
^dE$`#
_!%*|N
wN?Xt~
()ox[v
$neZW.
Pnr]nd
RG^@ *
]WbDM(
?eC-i9
1|!Un#
4-EpZb
5=x8#<
Se=nNVJ)
')D'+
k)eL0-
=mK~Ma
@1C~tn-
;,UZbf
RTfv?>c
9C^AY/0
*U%.Fc
5CPgs@
RCD%$_
i.pHYNPx
i}Y4b]l
$`eQ|-
UZ}p1_
u@Y|p34
J`APUK
vHW%l[
BazA=V
Jt57^}
3'(F.a^
Q(jsL)
q/wITp
sq|d!0
7R[wOO
H.>ga}
J8u/!G3
@ t/}iOk
\D#)4
v;f:YC9XF
7Y\$N.5
G"j7'[
P7xJ,
-A-epd(HK
e.<}{V
@eT>ch
s]n&#]
0^{$$0
n?>wI7
KLI}yM
ibyo5F
f*"-M=
-r^^]
,<Ir6T0}
7 ttP'r
qNrd|@
KrfmQK@z
2f``zGN%
?(nE`U
9QQ>D>ZU
_^DIkA
P*_45X
q^Kzb'
PLf{d,
(__BJK4H
5e(F>S
!iDpmn
zZ|3p%|
[ )@zOS
2,%YV_
&?=f3U]
lRR&{{
O^YnF<!
B6/&"C
Gz|7l2
q4}YPA
T}rPo.
C~_Y`L~
)<rb]l
OpLBS{o
px,x6S
[@K:+k
l>O*v,h
m?AE}t
Xx[#'L
=_LOh.
"OcRwtW
jKw4MZ
s}*j=@
1mp8RtZ
xy6MQz3
;aC_]|
?5wmh[
Dht1,Ze
b=97h`
-)9Eg)
D%/6X{\!
:3CZ}{
v#OF">m)
`hU5]NaX
(Pu^F[
*VM(\1
+hvM58
]<MLmv
R>pkK.
IVL'UuT
]<^0qJ
@8Ps=k
31l{Ps
`)w2"lK8
l=?[IG5
4kA59(
YqEih>
M)SWxs
!"0M.+
?NrU]N
=0uO<,
<G_;ay
J&ZM:5
WV4#81
=9tA&6
XW0]&7
|h&%<9
y:;L]%)
DO6iN^
"_A+2Ht
x$78O8
\AOFFQ
-.`p9K-$
^hnFqM
(Kr^37IT
":G{>q
1b4Xs3
L{o(P8
`I4;wS
<CIP|J
Z4qc@ik
Y|5O42
J!!bZFh
|H@r!U
vLL'z"1
%3P=
0b;r24
Ya:hL8_^
gw$bdz6_8
oI]bg/.>
K[kb\K
ay%7+wx
+Kvu/K
gNKIX
t>o^>W
=-z Vi
n1k8OM
(Z#b'^
,Mo&7
JzQkUF?
f"^54fX
yOV.d6
3~??iBg
wHjWi8
j"4N&jQ
7\INaV
k]8s|L
D/dyW'
E%R$Ij
J3{_aU
&]8*]kk_P
CX[9e|
;*[aSD7'
~1F{N9
B}3!4~
k;P.I;
X1#T(3V
d-[\>{
LgVDl4A
_<N6Y'
R9},b9
Z>Aa1-{/
(mPfZ{M$En~
Pm=bj,@
a>@e/V
JD[5}S
8Y@\2p
??1Tlb
`7Bh~j
Le2Sr#
S=GnhaG&
YrByL
y2g$/;
5DT*jew
Ouo~9R:=g
ST@UR_g
}4~}]l
2G1qZ@}
>47Uhq"
bN99'=
}}1dk
$Sx1C-Kg
fP1"Dc
;q4~kL
[Pk8Jj
o0O>MB
%<OMdD~[
?[TEb[
BsTj>'
$b?a;S
Q\SFlA
[RBujy7
L#630"
/7)J"lE[
e<d:mM
>wE$o
_10??P5
.2W-C'
l3tM3`
*>13Xs
Wj)5;oC
ol2Q%V
J=}C]K8
2t)1)S
?7Q1ap
odb3%s
Ml2d@I
{C_aZL
G<1E$u.
LaJVcD
q?kO6)(
P=$fTK
uAVnFY
g]"S~>
D!')Of
2Y) 6d,\>
6,lszF{
J^uTH[
Z@^*+mI
#.Uf)%
4Ijz5c
T+k%)~F
`>:[}b
*V76(M
8h5\sK]
p{dFm\
R:=Xjm
}u8]ht
>?qqC|
L<u9la
$^rUbE+
MCimFu:
w9vqP|g
>1YO7mx8
|i?C%{
tfds]\
=.N!3<
%pGR~V'b
[,]B}^0#
Y(MqVwj
rO`)hj
9c5(BM
WEFzki
;N*g:D5Z5
fs7r5<
2rm3!o
FP*!UG$f
-M2LP>r
B6lg3yf
;k|{ }\
yS5G4"
&cx*Yo
29>OI&
%D$-7}^
)$%?P0=
VOBXyR
.l2^Q7t
f3SQU/g
po)x1bP
bF0sW~
Q]r9%JTH
2;Xp8Yr
_S77n]
T@8A:f.
bZ#$[F
%L4\Q:
@:lPov
<' Iz
+p5TWnu
VwIFl/
%cJ&S:
eM*APm;
[A\4{v
8\/l<4b
]MPR,jj}
9\3xEr
E,*Ij8
)}9YRu
iO .$
4 %e4&
KdFUx->
3IFEq5
Jkwc>o.8
I5W1#
eR8~\7
s?L^"1]
h:gr~O
pU2^(H
H+'FhB7~
QOXDel
&aZH,]
67V.VN
O4xjUw
UU]p$v/
RgHG6'Hq
\Pq$;^
X3%N9Dd
uRyC!
`o"+P
\,)Kl&.M
6{Mw^^zICS
)S?x4q
?;:<Ta
~n;'9S0r^
nt^De"
h(%,8i
4~fD)H
Zz0[ih
sWHL-9
.M/,W!
rC]xy_M]"
NXXhM|
jo:BR7
>K~aHN
%[,*Yn=
x<L/Eym
7%{FUE%
/$5]%GJ`*
^}EcfYy
le#.|<
5.aI${'
4TAD9Fq.r
iE7O6W
w=Kfxd
cb:l}U
.C!Gr$
>q%"-x`
\,P_I?H
YO_8,v
p[g]lzX
v6;n9^
X LcvL
fmQl}ng
!;}{|7
mHX]qyZ6D
c*<\Wt
/29O1L*
R2z5K
obU}s
(e+8c)
vbb4U}
FPS"}Ig
ewpMFh
2{hb(>
&DS#C@a%
?F L)o9
J@E^,<k
^S>,)9
MAe"^|
?@XDm
9uM4>Hf
d$^^L)
!"N*71
!Hx?SLu
k)y)B+U
(w>MI~,
yXU=/}
7^}0=n
itD7(\
!&}qf15F0R3
myMYlZ
JV8L*wr
g$r* x[
Hq)wce
"{;T$TC
DB!x5W@
5 BGbC
GjP1*o
K*4)gl
k'>io(%
f]Z -aDU
yK6bQZ
6&>.wB
hXd9|>/
CuDysYI
{=w7@Y
Q&6?$*
[H@+uC
Dq3J?q
VD-I6-r (
e3G@KS
]<|oA'$
/njQlO
v\;Ku,
Hgk:P}
Ug+2tSrj:
lo+T.l
,UT[G(3
J!E@Fd={/
hk|f]FN
Fg"OgSvH&
.0HIwG^XC
-%LZ +H
!Vxv)[
T-KSs(r
w5V'P|
?^{ojS
'qcz)'
IS'uCU
rWAk_F
;U~5y=
6|y'_eO
B+v"w3
$3LV]l
W:fq>8a
xXr&@OU
NT7GaF,
s$5)v}>)w
25Mu}Y7
2!5~MW4
It}ygB
=BS7sj
lYq##2
tfgU^N
vmcjZK
4:d,}3e
wsq >\
Cup^5^
5[|ruv
!lr6!T
E6-P=~
Sg2'/TT
@OR~gq
O\3%n"
@<e.7v0~
;6BUtG.
gm_Us^
9O#g95
= Q5dp
xo{r}|1
s+qA<s
Xm=x7T
@EU`);R
C<ob+-
.O!V|P
l_x?6/Z
L"KuLNTsE
u-k">C
+1@e5@3:u
F=D` 6
j$K}}L
hZ922sKq.
5a +r-
.hT$Swr
(Ol&t<}
T?`oQf
<"ZX5G
)6M^@/{
">w7h)Z
zK;^n^T
rw-C{|?
(=*8k5
SJRF#l
+*JkbU
>&<O!g
&\Fo.w
digjo3
3`fkP"r
. y0^q
r~5[GL
9L|p'%"&]?
+&R!sZ
)J'u=-'
4Y!dj7
=%Bn1`
G3bi'p;vLM
.^GA&A
~C7,C9
V"2I7
$4I},9]
2plWo|$
^0[BR'~
sz:Gl
`{Sh?'CO
6Lx;Y
jk1Wp<
To]Zzs
l@XO}a
)+1OJv
OY7d6vB
vHYy^U
]g KZg
yc(WJ<
xS\D#H1
23H}</
d;l>No
5yABvJ
c\T jofS
: h_'c
8l$d5F~
lq'e:#
=-c%X^1
.5O?I#g
z[|P<G
{q5"M
3#(B$h
OHU1C&ym
Hm`Mif
J*"ZM'
yx}[</*3a
O9NHl
c$Qd@+
b/j03*
YXwKO8sb.
mL%.qN
WS!.f\
Tps%ZjOFf
'j9}oB
!(",of
)kj)Wz
.Tam6;
^g^u_$
x@+>3
}_!tU3
#N</zZf
qTU9rh
i03Yl_38
XO&%Ao$
Jt>=Wug:6
p` ,u(.
#hrQNo
-Y'C=y
+~KM-u
`D;!\~
HPc|K]
JJKE'
J]Q9&[
M5a\m&
|M+`D5
</<$l{8
|.DOTqup
PV^8`s
29<W%4
1cYOSdWPO
:u:_srU1q
IP7i)Gc
j48Iy\
f99|7x
JStv0q
ZG$WBO.#
#ymB9|
6$&"'J
cIDOtG
e[@PTp
hevg#`Qt
vjA-{%
s#pb<p
!)>s=*?.
`b*MaX
Q~ u{T
"J@,En
TW=M2b2
IOM"@z
0 f-^T
@lMs5-
]Tg&;4<|
B]r"i0J+
f)[XJJ'
]FZI ;CO
vU"*B$a
$TWY+p
&<Trdw
$+@O$>
V@z64p
WlcO|J
_v8HEu
hs ])T
Awjf,P
nZYry?
D|"%73
z]f_'a
o6G#yd
Fm4V|<
&nPuyMy
B@8unT
VwnT<B
E'TI&()
6a({nNM
H#z:;o
R?hF+h
1,vC4X
k{{Eg"d
za[FXj
OL=A7'k
_\zNIZ2
e[mn"p
qp>"ugR
Th*^-d
}> !`e
,U^60b
Fl9R_I
+YBe|n_
*8m$*+@
2#L";,
"ugXQA
}rV[|^
*FCP.%
<R`V~[
X{*3,X
s,^1gZ
*AAOB!!
W/c+2/
C/*W'u
7mXJwZ
7{k4s\$
6C?`&~
F+[w:S
IvJsr4OF
~fJve;gC;
K`zy(|@
H+:5-o8
Q)CI07
E(DU1
bs!|XXs
*RhSRN
?DH;U
1Z:D:E
8\/z9[*
4g%h;+
Yw*=6GO
/;$A%K
\$g6rX
(kWU5-q
}k,>V(
,XvV__
IBr~+H
8JJ[d[
wHqNYo
y?5]!#O
1\y>{p
";u6+Y
2h9r@KwR>
eVA^4lN
\#]0C=J
BK`sz7jq
d>~(a\1?4
znPxu>
vT@0(R:
]e~bQZ
4n|XjCk
/Ct)uD]
i2,A%?2
ysA=M;
#FWKxJs
DO2.y(
GrktO9(Kn"
1*iKl~
o>6=I*
tuF{H!Z!@{
XE7`/5
8kf-9re
2}/;Y\
aPr!KGy
?K@i|j
{88G77
-9x/w?
W Q(S.
Z`-<hEu7
_Sz>L
Cew0<`
/^qhU
nXK@bV
~/V1Ft
g!+7hA
1oKG6k1
-;k4}&
.b?}(N
ImoG*'
^$'5Y=K
J*A,X.
mK"/Y(
*LKw5GQu
z`^lpJ
l%ZCkp
Wgy!3m
Cb=c$[
/{,N)
HnZqbv`
%YKdGL~Ad
[Z<fM:
xMMf>Q
pG}C;_
my_<7
xl]JZ!u
%eUV{&%p
oLSaye
mn+~X]}
~u@U/9
3}FRU:
(+KZ?7Q
]Lh-6ty
lzI%^3
NT+R#9
WjV&cU
R+%eb&
9A\aPa-L
8&)H$V=
INj3RU
d@!e&,
n8>47G
WphYN"%y"
3~`$B~f
UlsGL&
rU(?{Z
mV.7/qt
M-I+Msj
(D=X_T
ptDf;Pk
ooe<TR
Q`Nb{]j<O
ab%5mC
b3I=qZ
)x'1Ok<T
vJkm1X
uI-U[Ns
AK1?Fp
Qp9og
G#ios
i|W(FZD;;
6>(Er!
J9M0I2
z>IJA8
'KdU>a
g>{|Te;_
T^N<>?.x
QTy2}w
wJmP3=t
n>B;{t
Gx<:|8
Q0l?gR
(^#6"P
#5s;-s
7M8n`-
Z K}^i
$JOD[8
.xn`\-
fFMZ]|N
rMe'yC?
e&vtEF
H~Ra(u
I)"y}\
-*D=r/
6nyIB@
B>nh-Z\b
R`a^qGv
aG!#.x,
vs5+<0(
'8akC#
4SOcoy
H \"6;
pnSJ]3
3ppJE8
,V6]M9s\
^%(}BO
)8^;c(
t[M81?
E^{cvY
{5@Fp=y
?P/@6R
:I0}s_
WG`J7.D
[QC::'
n^-aO
eiXP68
-QFnMs
F%<g^m
M)k3"Q
Oy@;D%
e)]N>Xi
DI:)q?
Ktgy:I
2F[s;"
vR]lXC
VQn7x#]
HV9l0*
:1GXA7)
cqrUC=
3'J>7yv&
~D)zF;
GZ,[4u
9b9{\U
:]M'*V<
'q`|=q
TAVf=/
MwMJfNL
=_QOIJ0f
rq|zr~
X"4S Z
;}m5\&
O+NtD/
XwR=X,
UT=8f#
k}+YFQ
:V7^ty(
CJEL7j
|y9o_
W1s:
7N\@fP
b6?UKq:
e.K$8PA
=A!x;wd
{8=a}=
$Q[>TmT
#z!pjY
pTSQ--
MfU'^c
cIEL'`
X_Y)%#
{Z\d%A
F&s &"
V%q^db
*)BWn*
ZfF3Ao?
Zm`dNTsq
5Ya^YnCE
Gib`=w-wt
U8k!:/
^1#)?9
5{R,Q+
E{ ru;S
3bA\^<
<^MyX/
uRsm2n
:0e&'N
(is0TC
IgOW#]A
>$a*R{
)K wcA
KRp8tPD
s,Jjpk8[
i2:lMuN
3@/3u-
ER:T@s
iDxF?J
c<?1k
4SZ[ND
?/qU~g
V|{)G@8~9
xc4wAiK
BkF"dX
T0h!=u{
0YNqKk
hdf.$em
<bZ_hC
kH&q}'
]|#4!sHE
Be@)B'
IkwSZ!uo
WN"+n:
wcwZc:
\?y38a
Qu^X\T=NFl'
KYSQZr
\$_P|\
60N:5%
U~wl!D
4#"(|EW
;9o+3_T
80zlelQK
`=bZk7
ypdjAF
w)7J3}
%W<S y
]rA>[]
#.^(/8&
Y.-,lg'
x&k^\y
<Z\8xS@
,X1wM
c.R*{W
4"5V%%
SPkV?zF
p\>!]S
Blb7?Ka
7^LiH\
[8+|_}
y-K<j<
SQx6i
G^&*XYI
/('?>'jr
R+x]2a~Gg
9_ovf)Ol
U1?l]#
l!n7-
l2d2 '
(j&5kt
htf0i8}&
|F e!Z
W~mCkt
jty'g6
1t%b7%
l&)q>^8
fY}[v1#L
I~J[Kk
7~!(zn
/q+k.j[>
dPx*7j
MTxeW2
q:ej^L
v8IdM!
c=GA>~7
!8T`|9yN
\6XcEj
92Oc0
zkA~?
rUtS%S
>cM8CWk
J[$E$3u!
lG9'cr
7QQT<C
YvU.I]
5!kw)W
.rvnS]
>R'*9YT=
+H+cUs
k_j`n1d#
/AJAVriY
eUG$c`
{Z/<U[m
.]nO3B
1\M=xD
O(=h[{
&43nfb
@KzFoZU(
`==Va<%
haox;d
8:.}rvT
OLrXiC$Kz
rU1u0x0
(&2(mp
QaS"w0
oJ}?^]
7%IB^^POp@t
Q!BADq
_-=bJrIH
hk" OL[
XuAIqB-
a]v3M~f2
zE<5<\
K-X9x3n
hEfKUC
gSDAwY
{'2Qc=4
9bZS|X
D8GfD
=.P73*
K@x5d
'C2_1x
asIrjU5
6I!`ydjb
?h"QcU9
8_vnb
~J"TW'
,QvdS9#
yqp(a$
{-*gH!k
lpVk@"
b3|4*\l
]"WJu2
M9.Rm6
mc\t?
6{D-b8
K@f+Lx
y8G3_(
>WL/}e
-KDl}"
]oty@:
r|A<bc
36]ckG
P-t9@!
{aM&q`Q??
vFw!J!
cc~;GlT
te`aDV)
gZ7Rkr
.7JvM$jmmm
Wob.|d'2-
y[8#h\
le|H|f
!#BwJVJ6
uF5`4;a
i5s$vF
0Ng)u*<-
g:~s@a
h.^UnoJ
~.9S#7
V-HA-$
"!(\Dj
f!e.DI
y68eRP'+U
I]je_t
"X?kY6~
0`,Ui.
_vU0y*
^dmua
uk]RrC
YznhM
7m$s#Q
g)L^4E
?zAi&Y
BK&$L$
=hyZHs
*QE|F*4
@_r=-%
bnh#uJp
4]sp;wH
v&XG.y
g]K:kLQfj
^P`? *
u9/YL
5R9}VYw
cn0,{%
swRob
<.cGzMoh^X
l8j_SL
$y|"TUU
2B)O@H!Eh
z2H|q
GRV,tm
\>K8|e,O
f.Quv281
^agUD>t
F*OW/v9
dq+~mY
C9!>%B
iR4:o3G1
R;KA3|/
En.HOUB
IL?bGY]5
p%<uw+p^O
S9x+?S
31^h(
g/EP#)
36z&s|
+]+QP7m
A:5J>:x
Vc6ca&g'
u@[|:A
.&=w}W3
JT8PS
Nx3\te
t"BI~G=
Cl4>s=G
0_F>,(
36ROX(
#fV~!{]I7<
vE.xZ^
kn69SP8g
sj\r}0
y/)<a6
&*6+g-
F0.</u
;Ck(g1
'CF%1y
h%})>|l`
$^N8R]1
n=(-Fa
(C/5boN
tYSwm]
yGo%OlfId_f
aT[Z*4
w#.WSpM
. $ FM
uSKY2|XR
Ch%c|
s<,o%i
.wUSk|
UVI/F)k
& N,i
Qjv:Yp
`b@87N
`0mB9C#F/
(:k.{y#
<MZNpK
h~<F5h
tI!dH"
9cd~uq
vN[h3r
m.@o'B=$
lmS#"j{
1U:B_g
H[.m8j
<v&Ge(
#G'qJOL5
i?U`zO|
[+EQ9\
wpAGc|H
|2f_e@_
WPlA 4/_t
* tTEp
yCqqXO
TEaI4+-B
}<lV2F
q[bA0[
L{I*JS
tW8E(m7
2&>TJAc
Z:`|;:
8SvRE`
z\5n>V
(FU5m2
F]s_>Q7
KV.OGB
GXK@L%
62Q;VyTI}
W%^u%UK
W[/Yy^
:5+S-AiZS
hZ4}Zo
g::.BSoDX
pP.0c7Lqv
d?8vV$
_r\u?g
y|m,L6
w)xacR
_hk5PM
z#W+(W
;!7|JM
Nuo+dY,
YgxRTFf
zc@p}=6
\nv|CB
\kwAL.
.GH?aO
6@a}E
Kh*AaW
-|C?J)+i+
?>+-yv
Dj8hrR{
%h{AiKX
)h:=AE
)%o5v*
vi79|<,
#UEWb&q
J8l8IB2o
o"FK+.
<KD67a1
i?sVx@
Nc%pWC
%Kop6;}
}6g:'>
Fun){3
%LO_JC
DY7{+&
Ui|@Qb
/M1N-W,NB.I
gzrX^
98C%'!=>
B6j}bq`8W
'*-fyJ
?]IY]"
-UQj_k
jvlpgm
rbtDW%
:g,T8<
M6Zy[k
]a7N@Wk
>{Z8u%V=
Yq{wr
2T=s\=
f;{&NL`T
(^gq~Z
%o"AxE
p$vj=Tq
4nsJbw
0`DYUXx
kj2.JV]
lXat=1
G4;V){
$D&h.5>N
^jNCYS
yEMtiV|
pFo5W+
1'7? 8
~@GBfj
zDE{[I
Kq?H?o]U#n
.,-I7":
s5GM3k.@
m/`#3f\
3vQujM
n-^oeJ
ryMG:Y\T
rDd$y1M
QN_4!*
+JdNFM
TOqV8?
^MT-Ew[
gPSR)x
-M%7X2j
A`#l%U
Am-R$p
/7:\i0
sM@^E84y
cFw.Z,E
OmaKd1
jT=o8g
)={R/>
Y7U1O(
jxP\,h
$@,>s#
]>Fa('d
QE+8fL
XG_N(>
_1!+RW
d:@<gh
dP$ D~!yk
6.J,$(
NUflpF
z{!`%!
,N/_#tPf#
?`p}F,A
lVs0
,~tD76
Lp(#(
6H?-4i
iA6J|g
V{i?.g
y|H<f
CsYH&MG
EP1j^ Z
`@8K p4
(a~-`#4
X>zhCr
c5_DCX
FZFE:*;
X6Dkt"6
`9?.ml`m
.xx&5;
}WDN5-~
3U|X<&
^E%#1
/Xp\]]!
f~ZjS
dgIwFQ
'XV5p%
^:#^Sd
"=BhJ&q
N)v[xK
|PTbv4
EK+'}E
HD*/9[Iy
Yvh/6g[
=Y[noJ,
tM P*^
e#oveg
P*?uv9
~o<"Mr
3X:->Z-
rcbWg
SkSWa&
$xzt_s
} ^ctt
"s4[v,j
^m{,/"
o1$zyO
E)L@4B
&p`U*+
{T/`$9
w2cX,<
MUz0Un
*p^O^1
<[MYGo
%r^M|i
^Ek(Mga
FN)&Bz
A_*OVdT[
<U'US3$
Mi)W4iq
A^x29>\
'vishO
z4*%q'
{>0G&"
IwDE'v
A&c|c`
V`WmI>
yiI6R=
jO#-wr
_*Ul3
(P~5C$
W!\)Khk
:u\w"A)
y1L0Fs
Z24a(E
!@%4^I
B.;NGY%F
M#}2Df
L)%gye
EaVHw~
x|6Y9Nb
1n/{2"
fwN1TN
XL(yP[
-ow<8I
{wh"goM
k>\Wwva/
|]s5(*
ar$0%w
4F6;vF
+`J(?u={
+N_hP3
,RH1y{
q"vugGuJ^
y>cI*r
GM483*
S#EGafv:
U]-lIb
Y#`=JZ|
8i_`c+J
DgY1CJ
aY-R k^r
)c\HEZ
dfE<D:L+
Yfb:oG*
f2K4"Y
6~;(CL"
m1#<.&l0
&r?!II
crVUFPs
/H,nH)
`)}g,{
#$p?=m
@VMvYN]
%u=LYy
<}|+.h
"RFmubi3
8QZQBY!
fUW#>X)
J3Lpm7
169r3U
z_l,n9
}y^8Su
Awrw3cy/
Q EHi
B<l(6Vv
:S_v`yK
13s9^S
=[JQ)'
@94 E]
F@C]>p
YJl$?H
M|r5;N
yI%}/X
g%7p#D
Ag4}H&
b33P+N
;fq6Sh
R(B9$Y
C})-C6
MGgUU'
JA7(CQ
M46RIH
zYJ/}H84
{~V1p
+n(PK2
!9I5-0
'y=v/M
2=qcw8
V=z*)t
h,<EB0]4
,-~#y!k
nkmZ_O
L6^J@'
fX#QT/
;ex-~b
a&zEA)z
>L_L62)
Yv1($j
V<3|6bw
!44\AS
@Je+^<
[jgVcon
*KJxm@
y:E3Q]
Nxsy1Q
!;`TT3
VpBx#d/F
Jun]b`
,QW*B6
zE575NI
q)Cs9JU~
]j}kXM
'Hh%|2{
@?f[_%
W^e`~d
D?&k{']SYk
,|sv5n
0I[x}M
/Rcs?^$
j;C5E0
RGVm'Q
kh74Bx8J
}KH)UH
:"je :
FOcg@eb
z8aO1O6
Wo}Kci7
xkQk.N,
<dCn8?y
%lw*O|
Gt[PU]
\FgeEiJ1-
;G^;t\
~*j TP
QUr9+HZ
2boM2=
^'Yt`{
)huBK~7C
;"9`9db}
=yXHtv
Xo/c/-
)O^oKN
sn4l{b
#"n7=y%
a0#W%c
{2eU9bB
y@;M)<=
64= Lr'
*uP>Y?=
|U>>T,3,
mB}Z^5
_#"D(B
_W4~Mt
D$'2c(\
v?'#HV
U+X/7BG
)~g"@p2
rXABBL
Ri.l!X
N#Qd's9
it]`)!
*P/mSr
]/;$|
0N7"b?
ZR0vx/
[2Ie_H'
}X|b3f
qH<_Tz
SCCg{e
,}`"=$
%<Xl6Ca
:'O0Kn
hS:+(T
[`hk3:5
ME''O*
C^EmU?
{8CE 7
KK{!ID
af[9dQ
K%/=0'
$A@j:-ew
FSl<4W
myDS#
1O6/-o
B;2M3u
qEz%ei
+R[j,v
Q 7p(>
)gcc{ek
.}u%F_q05
J{,ic27
ZTmE2R
^]AAoA
*=W#>m
]&i,wU
^26JQR
Rqk?mmc6
m59;tq
Q)$2F3q
/NiT2
q;S5.9c^
]":]?O~
GuU{Tz
orkYNz
6Wca.-
Ws3S?
}>{PV1
0RCS@p,F
vdS0H\
ZZ4G.o
P4Fk`P
YIS!b|!
{fkdxt
-4f9Q+
*F?r+h
"&+A^C
ZuK[r7
w@c]&E
t\vb~6
&|EYo$
J-\M&t
X_]'jq
&fu[@K-
R&rm^
W 3cSC
y_U:*Jy
1$O6^'
no<,,r
B+jP9r
!ku,pD
wC:j?{
(+9UmDZv
oiNV%
=p;emV
W||ykrw
PQW'U2
\8AW6+
ioU#^,
m/$Md0n
DKXec?
Wg~ZU_
BxE*8s>
2\H7$-
Ueu<i
iy+~:y
qH9PS,
L?sBZk
d?2f3'w
nb(ksh
lTyD+h
gzbn1)
wl>>U
B,A^{<
`*` C1
svtZ=L
`IJ(|k
LvOJ@N
V[:Htk
b]0cq'
sna}MMF4
^_a.dDs
m4D%qRL
Om%G4#VNU
;smB$JH
rA 'mMv]
w?J@F'
Fw0_^
ut]>u
nZY!NCG
lwF3Dw
y!2"43
X8aBjt/U
~5g1Nu~
G,]oc*
I'C.`.%ON-9
fi?;T{
-=C>"M
y%K=]3
@;iO#}
f[T:M
a9^'AlV
&a/JB1AMC
v#iprxn
'51fC87
0l5Y#W#f
Tp];uW
Wf4f<t2
p='VXMF
h)qvM[
#r2!!Z
Y-G+\zM
H3>;A]
+~*nu+'
*94r2j
!h{A|=
BoFScG/
k7_VdP
>ggX!A{
zlw:D<U
{\?IYQ&
WYJAH(7jVwBP
uwDq7x+K
>ZFC:p
Q['c~j
1B!wb_
h;(~cx
H9_%,(
#40A=g
1X9,yk
?b>>/(Q
[PIe?o
.dVj/k1g
W:6B.p
l/!:ni>
[ZHGr<l
F0$i29
V|r#{Lf)
cK<.RW
UX7cO;
AqTNg(|O
INrL*7
7.mq9.
{BS-8F
}(c0::
r]s8hSD_
i5tGM
@IBD>!
*~B&<ibv-s
fZJkn@[
|'g7Ve
p4+H;ctd0
q<01B.
FE|8J=p
-[H%So
c!Oun
k&+VO9
!A6p:,YZ
b|GMf
k!C\l
h'Xg\3
x,#Qy&
tSh!qH
:?Ugc-)
X%%B.N
G`.07I
KnYa]
E|&7r!Q
>I!wi[A2r
jV>\4Bh
Af&G9S
%2|&d-
6z(2wH
@H/O~$
]$+'rD]t
!p$i<m>|D
(jW\UN"
M%\Q PUF
Uc\]{psx
51,X8D
}<}'pN
UA1+ta
=.:fJ>_-
3^G~6l
}%qCXd
yP^#JD
PZ[Eo!
}<OxQWc(
!hd=NM
fLlP^V
A~Dd@B
l/z|r:
sV\:I(
@7Cyss
qrO)!k
h1+@]6
a%];fJ
@1L3,\
Hs>o;P{
b=Wq+-
_Z/-}3Bk
|ngb\v
i1B1qg
'=SR[H
x2!KM6
je/6Rm
6gp"%}
~u"ZIw
B2"eqg
~#\D?~
9tR4b'
#@+@3WQ
f,!B[_.L
k:\Tw)
:&Greh
~<?G}yAT
^v]R8(
`KKW+YEr39H
v7fd1Y
=5"3@/
8lju"C
!OLQr@)E
:Fm*m?
@}VSkP
^8kFf>
-tKr!p
qtd?Nc
.u0p!+S
cj l+Z
Z.dC80T
\HqD+j
XrYt3}e/97
F97e~G
^Hm3tz
7G^$T7
]hgMOE'
JSY9:J
uEkXDb
-To`{
_j\t?k
&r*Xi+g
4R\r3V
k/AM7ay
gE{v}c
H5%OY?/
/0 Yme
)Uz:7|
TSQ}~B
tY{dhB
3PHhu)<1(
$};}Uq
|f7mVP
ji{<+K
'}wF41fl
`9^Q,&M
\}Hq1
mUA3Mm\
.jQB*u
"SVI3F
@sWYeMC
2'"sTS
]>H p~
\C8]fCh
8{KHVyv
%{5h~p
1V[-<gz
znddRv
_/9Ln8]
F<'i&E
@NX.Mo
0#c U0
Vt>Ib>
q~qBaT~
sn$iIfn
o1:KDeIy
E5]9}i
{]\f=;;
deMQ8i
IG`4[V
X+s~a{:
M.?cjLDlOe
)U*/'B1
T~Kx[Cl.
bOs>tE
-l1-^h
'B%*`c
6V{vf;=
m5=PJX`
h)H26k9.
u1g{n(4
lgC#m
N{`Vm&
@w"A!t
kV4Ss}<
{j *J
$_/mm4
Tx5'>c
yl' ]H
ilE"z4T
3zlKfA
jqk}>#
sZyj,1
71CKf?
>.wYPl
gwD+&l/
*-i"[I9
}X:3Lf
)K_@r*.%'
%HJ0c8
-Zq5`(e
]l$Eij
mCm&i"A
W{%:*\-
cG$V9r$
,[Eue
lK=+VM
XJlwrm
_)Z?(;
#k1zr)
3wuE`6
UanD~I
xC.3#qp
,Jd^{K#u
.Ozoa5!
}ulS;?
-w1>&.
+W%g.3
c};E)ZM
t$]PF}>
U`Yd,"
mHchr=
lS7nSe
#;uzND
i60KY8<
xoyHF<"
]hF-<}
fP<^By
rH0S5
%Ji@k]
,rv{bi7
6GK.@[
/_8dgy
~%q^NH
i~rLQ/M
Aa;[s?V
WQT.):
.m=x;3
'&>|:-YS
_XXw76
9 cxNJW
04GyZ
Df}$@a*z
'<Q:{J
b1)l!?
*9O{R8h
}l_R_Qy
~E9:SSu
xJ*Wx!
_;@]d'C
p3kn^W
xT!P8
~]b^I;
5~fVZ<
=+>\f0
$xOZx3
xoK9.Z
_]M5?g+8
c%i($);
^3p<e).N
XRP)7zf
xE%&PgeC'*?
%fcf)z%
ZCWh[k
1,d=>kD
PyJq;_
1(w) N
`(Gm4
*jW\%3
Fv]ME=y
\n"4=Rj?*
;H+G+Q
9P.1r0
Ot*G%
L1"|*)
A/T?#3Q
%VIG=8
MCEM 3{
#g$!}V
bD<QrC
MfN:4?
"ILe6RR
L8.FP,
|9aMw+
X*+~-#
a630N r
os$4~\O
DAC5)!
f27#x\'
*<_4}/>jw
a@@*F|
d[7Y/K
M+f\!Qe
$;0o3b
:q=yB,
t@@\'
Lr7BfEg
L?40F$
~8P)7A
9Z+xcN
u.BLj])r
C^yqIA
a72iT2A?
OcWC=^$
PEy-+P
0Bn7RD#
D)"}rW
@0]"^vS
hC.eVD
MxA>N^
z]\1N>
`47&X\
S81(v6
*&I1t/
&<TY*`
w|[5]x
(:":<3
t@!a0]
#ia,4Oo
oP?\k!
JCMw]=
j+}n]K
(>$"z~p3
@{'&q$h
Gw<.2GOT
qt>9B
<<u_$
k`TCATI
sQ+~U}
$GW\f!
^2/SRL |w
x`/#m
l5|"Hw,
3QnGWV
'xHX*Y
iCbi_,<)
U.?&L
gi" ]
ed4^bX
+Zv1lEJuN
6iC{T,|y9
q9dr$?
w9;~b+
*_oCQ/4
Bqxlqdb
gvev7b
IYtrX
@c~qHi
-qslLm
t"h"%G
~Ad3,bm
FeO<+h6
94b#zy
=#g}k\
SY6}$1~
>|[}726&
fz$.X"3
"cd,?P\
^7,8"
Y)eXac
joz8]*
@pmHoX
?Qc9x
Z2v+ED
qc2p68
-YT.7O
t>D~F`pvL
l|[=2l
OSD!_{
c&BVqy
apfMxG
=R$Tu'
odP--_
''Wr.G
}sGiw4
^Lo^QQQ
`?n5d]h
$BIH\=
Ds H?'n~
FW'2G>
i)jdG<\V
Ww?iQ\7r
I#T!{|
gw3N3R
a4[@/=
5@&yZz
YFB{N8
tK(bSyKI
[:a[+d
J`xTyT]
uA'\my
*Evx30
S@3|!^mi
*786K$$
eye9=U
&x<sHrhn8r
Jv1{E,
fDSgzKA
6|F\.,
MI\aKrX
1nyyh,
v\xyRe9
u#.mES
6KgYe[
5D>}<S<
D*wnpB
s=O(x3I
'g5wdQi
~TX9JOV-
SJ%5Uk
O4v-5P
Xni,=3
2B3@N`
[78#N[tN%
Ooc|"-n
?k(_'j=B
qt6DPNpm$:
e^@h|
=baz(X
!yBfxo
nes"6T
+z)C[Zu
C5'`Z:
*<XC@Equ
T(jL?J
8e3\4M@
tFD2#)I
2-US,5
$volpS3
Zc|2r1
P8R!:m
FyMVx\!q
*Op]RT
xgxZ,6?
mzW;H-
a7?&=U
tBQ28
4coWoPO
4O6S=qM
<o3%`w
>_Zzx |
A4<x~e
Ke'fql
+pxzV-#
Zg29>Un
:mPP\[LG
b|n><i
,^l?lp
<W3ZK}
@a`iGI
>l=9*d
4P#Rm_
Bq2,[g
F,]I_
Zl/Z@7a
hM&r(h
[2 S'f
y?nLT*
ID3_o|P
CKk"lC
Wh=wQD
|yPErp<
2NHG
e{vh0}\
c7<21k
=w"o0`bo]
""l,0n
k*!M_!
"%x\d9
^ ft.#]$w
A<fMwmFH
B)-Myv
__ml;OIc
8u1I)^
+e)2]l
H@]~k?y
^k-8u+|
])+3m]
!8Wj9u
OP(jR=$
Jdq/<*
|xDusz
foS2i*tT"uq
6nuEmq
ruP;0{
9fu&fi:1L
,=BN#s
o:\k#t:
*8$3!|
Z(HeP4S*
N"?UT.2SQ<
3+,.?Y
k?z_$J[
v17Q&Q
2)lM.U
Wa7JZ<
@zdu&,Q
sIAa@O
@Xug^CC{
!W{yBz
jHx/*X(
&3Ax%@
vFmse~Y
=o:Z0H
Z`K0\&
@En1M89
\=A$af
V.C0/
3W'oQ
`ojJ/P
b>Ie%R_
Vnbv+BcpB}9/
;Mw5)n
C x4yfl
vUSy^M.
N<\w6C}Z
X5Lb'2
hE(lr?4
z)KSVm
bh-ujQ
N%NE1P
r;!\~v
(^$ &w
-L@M.l
9LqP)WC5
+B%!~z
RJBWPQ
FzA`(
7SFI\o
@`@~VB
q1"j'/
cM!b|[
BtXXsM
`G:Z -@
2A"~cO
T"}xj}
V%eZ6J
I\X{X@
Q!i_8Ws
3:'6`0
H=pnS`
6{<zAj
;\)H~h-
Imswy
cg.L9X
w3|wC
PtI/U||
UmW7hI
+')9b
rc_6Qb
Sgdm7W
&~).`,+?
e{2D!j
]-?\kC`
`AtIjg<
%kbmld
2JsP4:
VB0uK}
E14EDN
,hi.rp+%
HmR0WB;
0AN8 Q
A)zN`)i
Y@ |tJW
_EY rL
RK#+f9
'^7>}w
}07/X
l ?k<,t8
)4Y;)}
~t\G*hb
zqy']/_R
2=9+yy
G]/+z0
B&*alF
5a0H?/
*;|-PE
@5n3PL
f'ZSpS#Y
^o!jK3
!J}{y}
yx>d>;n
ET^p0;n
olOqJK
SV;Mi_
`3kz*ci
)B&NTB
qGo[*B
*wO|A7
@cN{j<
YBF]&-cu
_(sW&]^
aW^'x3
rgmZy}m
Op+Qq%
74KQv;sb
<j^]s6
YK3a|864
/Tf\uDK
UDoz8$
}zm87N
p)!Ll
RC;fAn
{Ro]My5
4kO6H
9o9u3.
|o.GL$
|gL|)1
?T>z_\
:z.}$zT
8Rkm.S9
%Jiz.j
="G|m!
5'gQ)82s
6]H/;n;8
z"DyWI
Pgm\_b
L/ kWdz
{tFG_b
~9WN)V
SV?DY=!
Fg{g74:6x
+aF?Sq
Po%[P|pq
2XdJ7L
+{<gR~B
u4W(}t
?BX.*9
3{mO I
A^rDN<(
J6a[HH
Q@J7f)K
8 co@z
xZ6p:t&%
ml1nGr
KT8/v./Z
]22:m0a
zpNUlT
0`n/%_
|&!G0B
)}Me(RJ
7GE>i/8
-.P|Z*1
o_o_c#j
Z mbM2
uR]zGg
tI3yl8D5
e5Wg^
BY~ANt
KCs)X*p
Wa34}x
""p(Y:L
}"ao*N
,YQX+J"
FWj^T_
}hN9ZSQ
/h@FBTk
wv[XRx
eUS>T]
}WbzCg
vIWzRP/0
B{yAcw
%3Lz[;x
u ^zih
[1Z1V&Y
Q^Xa1j
|xbsPN5yS
@S@)CN^{bg
k@cJGZ
FU6y;b
HkK-I?x
`=v~mM3
1E7_J2
ohH{.6
oa9?QC5
I4Z^D&
1n{)yML
wKtpnj
4w/b@@E*e
+6D*xj}
dk,&r}:Z
) Ez:-C|MN
cv7:<8
`21!!c
,,I"sQ
4}*JcbJUW
SLl(D\
k-gT?Y
Et,Ne]
,Q@oC{
zB)OSu
^EOK2r'
RyN"sQ
YAz[y-
>Ds[-k
DRw=y0}
9a%TgB
,_99oW
_gNK!%
3jV>nr
>aA|X/
[nG|Md
|@m JG
OxJnLQ
XLpm@M
&t?TZDW
Z7KcPN
QASMyV7
'.p^yK
ZE@9(t!
/uODp15 #
[t{JIY
YE.hhy
H$Up'"
Cb+UTzq
bZaSY(
Gaq`,-
u`8iM5
V8Mn"R
7h=OiR
npBu"m
MAq&@yp
wrh]DF(*<Ii
']!KCn
.qB}$y6
tR#4Nk+
CM>C2p#
)VVtA3.?$/
U>inxc'
|_92]*CE
u]3>-a%
hYA,C[
dvI)QXA;:
>]%-I+
NcMDNA
fuJTt/
0fRND/~.
r8W`-~o
>h1mY4
vWS{#R
mOUiE!vE
r|a2o_
*Bkk!8
,i%E\C"
>\wj9G
]h!{OJ
Ws$}r!
E$)CK%
GVWx!q
4,*ocJ
JhG)@l
nu"V.L
?_l)o\_
:kgQa?_
v:My1
xJvN67s
~oGxkr
Vt$>3c
hEx&67
i.FIB
,!,iNF
s9Lk^4
(rI0{o:
!|<@aZ
9AnWgm
wTXxuH*
!KQz0E
XR>q4S=%Y
e?|:FW@
eY/)Lg
.@d:t_
#$ijR%
5dKfv
]c?MO7
lq{UnG
Y?t!=Z
hz0f)
j& ^G%
u|?\:9
*OuJ|v
K,/[Qq
GE!U>z&
UP$dlO
tN2CWs
voAw5:
E+]JHb.
LTXL_"
i-cu2OV
,PGRegJyA
>e)Rn<
_g.^\H!T
>XFfZ}
NEZ% I
V7M>d@
8X;T,d
Ic1{P
swE!U{
YebK$ps(
e|ofX+
>Anh[
ARiO4R
'k^F}Rm
'Tv"h&
IK~-}h
1mz!@5
.k!}`G
m/^[@2
*~beLC
K[q4Oe
sy7?{f
;V@v=T
Bdvj6M
viqvp$8
,1HQ &
*c(tc=
8uj+t2
w>LE+&
|t2RB5
oXhm8B
uAbp}L
A~.1[?b
<D7WG
o7|E}s
XjhXk?
+'-7RlwY
+8PGX&f
6 NSHC
\RnMFt
F*uCW:q6
%(6'`
%]3`g(
<]<v\h
V.eM\y
d@op3`
xWidO"uA1
(A`S5F
CL|i20
Gv[&0;
}@$GQEs
7}'n)y
)fM<Lpv
6jqwG}
_D+%#>B
{:rdRQ
Vn56U-
OB2R ZOq4
icwgQJ
k+/ux@
[nLh!4
rI#^}r
<~PC1Mb
]8WX*W
#I&=qrRl
9&oS@P
6 BG}?
*Z\dDH
$go5d*v1"P
f`E7{ I
YGR,Gi
Ro3W!|C
ae,R*
y-5B.|
XsZ]F;
{(2BPI2
*\##6U
#7ls%Y_^
i,2@&G
5T*,g8{K
lUpNl=
3#"#\Kj
o(>E!7+
-C]C)g
OIGD*,Q:J@7H
&q7RNc
DuE w<
k>^Q*`)
W0TaLM'
4QcxU-?z}
_!+dzJ
$6BR @
RichEdit
RichEdit20W
.DEFAULT\Control Panel\International
Control Panel\Desktop\ResourceLocale
Software\Microsoft\Windows\CurrentVersion
\Microsoft\Internet Explorer\Quick Launch
verifying installer: %d%%
unpacking data: %d%%
... %d%%
Installer integrity check has failed. Common causes include
incomplete download and damaged media. Contact the
installer's author to obtain a new copy.
More information at:
http://nsis.sf.net/NSIS_Error
Error writing temporary file. Make sure your temp folder is valid.
Error launching installer
SeShutdownPrivilege
NSIS Error
%u.%u%s%s
*?|<>/":
%s%S.dll
/ P6pL
,/KPip
/-P?pR
MS Shell Dlg
MS Shell Dlg
MS Shell Dlg
msctls_progress32
SysListView32
MS Shell Dlg
Please wait while Setup is loading...
MS Shell Dlg
MS Shell Dlg
MS Shell Dlg
msctls_progress32
SysListView32
MS Shell Dlg
Please wait while Setup is loading...
MS Shell Dlg
MS Shell Dlg
MS Shell Dlg
msctls_progress32
SysListView32
MS Shell Dlg
Please wait while Setup is loading...
MS Shell Dlg
MS Shell Dlg
MS Shell Dlg
msctls_progress32
SysListView32
MS Shell Dlg
Please wait while Setup is loading...
msctls_progress32
SysListView32
Please wait while Setup is loading...
msctls_progress32
SysListView32
Please wait while Setup is loading...
MS Shell Dlg
MS Shell Dlg
MS Shell Dlg
msctls_progress32
SysListView32
MS Shell Dlg
Please wait while Setup is loading...
msctls_progress32
SysListView32
Please wait while Setup is loading...
msctls_progress32
SysListView32
Please wait while Setup is loading...
VS_VERSION_INFO
StringFileInfo
040904b0
Comments
For additional details, visit PortableApps.com
CompanyName
PortableApps.com
FileDescription
ReNamer Portable
FileVersion
6.9.0.0
InternalName
ReNamer Portable
LegalCopyright
2007-2017 PortableApps.com, PortableApps.com Installer 3.5.8.0
LegalTrademarks
PortableApps.com is a registered trademark of Rare Ideas, LLC.
OriginalFilename
ReNamerPortable_6.9.paf.exe
PortableApps.comAppID
ReNamerPortable
PortableApps.comFormatVersion
PortableApps.comInstallerVersion
3.5.8.0
ProductName
ReNamer Portable
ProductVersion
6.9.0.0
VarFileInfo
Translation
Antivirus Signature
Bkav HW32.Packed.
K7AntiVirus Clean
MicroWorld-eScan Clean
CMC Clean
CAT-QuickHeal Clean
McAfee Clean
Cylance Clean
TheHacker Clean
Alibaba Clean
K7GW Clean
Trustlook Clean
Arcabit Clean
Invincea Clean
Baidu Clean
Babable Clean
F-Prot Clean
Symantec Clean
ESET-NOD32 Clean
TrendMicro-HouseCall Clean
Avast Clean
ClamAV Clean
Kaspersky Clean
BitDefender Clean
NANO-Antivirus Clean
ViRobot Clean
AegisLab Clean
Tencent Clean
Ad-Aware Clean
Emsisoft Clean
Comodo Clean
DrWeb Clean
Zillya Clean
TrendMicro Clean
McAfee-GW-Edition Clean
Trapmine malicious.moderate.ml.score
Sophos Clean
Ikarus Clean
Cyren Clean
Jiangmin Clean
Webroot Clean
Avira Clean
Antiy-AVL Clean
Kingsoft Clean
Endgame Clean
Microsoft Clean
SUPERAntiSpyware Clean
ZoneAlarm Clean
Avast-Mobile Clean
GData Clean
TACHYON Clean
AhnLab-V3 Clean
ALYac Clean
MAX Clean
VBA32 Clean
Malwarebytes Clean
Panda Clean
Zoner Clean
Rising Clean
Yandex Clean
SentinelOne Clean
eGambit Clean
Fortinet Clean
AVG Clean
Cybereason Clean
Paloalto Clean
CrowdStrike Clean
Qihoo-360 Clean

Process Tree


ReNamerPortable_6.9.paf.exe, PID: 404, Parent PID: 296

default registry file network process services synchronisation iexplore office pdf

Deprecation note: While processing this analysis you did not have the httpreplay Python library installed. Installing this library (i.e., pip install httpreplay) will allow Cuckoo to do more proper PCAP analysis including but not limited to showing full HTTP and HTTPS (!) requests and responses. It is recommended that you install this library and possibly reprocess any interesting analysis tasks.

Hosts

No hosts contacted.

DNS

No domains contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.128.102 137 192.168.128.255 137
192.168.128.102 138 192.168.128.255 138

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Name 1235def1c1d682ce_li.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\li.png
Size 537.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 822034b39b46abaa91127f8342092a32
SHA1 1c21d8ebadfc5add949732ae2bbbfbf5a16c6ac0
SHA256 1235def1c1d682ce8a6c0ec7e569972cd27c70f1c72fb0f2c1ba651895af8eaa
CRC32 87EA63AC
ssdeep 12:6v/7s3Lq7VT5YTT7q+rYRC0yoxd0padz8LkbDlTwSNPdaok0:iRTGZYRC6SadAeDlTwSNP60
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name bd60963b2eb84d58_py.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\py.png
Size 473.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 b9d3d10b185a3144e21a452903857870
SHA1 fefb19f885a999025ea3a801d6d005b65e7da523
SHA256 bd60963b2eb84d58eb01e118a2d0ba5453c717e8564a8fdb4aa10dd6b6473044
CRC32 287E87F0
ssdeep 12:6v/7s3L68jAuSHCDQDC5iLM+crZzkDY+4QZOGJ9:S8UuSHCDQe5iLMLzkc+4QM89
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 763494f57739143d_slovak.txt
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Slovak.txt
Size 91.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5 07a765f789749cea7a6ecc0e63d1f191
SHA1 d95d1c40a460b78275777d33bf88ef15ae092000
SHA256 763494f57739143d9fb444bb317ddff436b899be8299559dfc6718a63f4eef07
CRC32 334092F1
ssdeep 3:jLh9Gt1QqLovhxWzA81l11Z48Kh8YmBp:jLkQwovrQz3Z4PKLBp
Yara None matched
VirusTotal Search for analysis
Name 3fe11c2a0b4c2b50_cs.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\cs.png
Size 439.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 4db37e9044c342fb819515d13768e058
SHA1 6dce9c58614eb5d5e38c9174a4567ce715c2c913
SHA256 3fe11c2a0b4c2b50035c224d2e6c87ba19a05663811c459d4e3a2f780aede957
CRC32 96A1F4DF
ssdeep 12:6v/7s3LzinjGRPsNt2lvvLjRYCLlsUj4yHptMH+EEg:b+jGG/4v9RsU3fBVg
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 34f6a1822d880608_pl.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\pl.png
Size 374.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 fad0e96c20f20be196499d26a6c74cd1
SHA1 e383eba9af578aced6f5e9b896b7fbb4d7ef120c
SHA256 34f6a1822d880608e7124d2ea0e3da4cd9b3a3b3b7d18171b61031cedbe6e72f
CRC32 A9EE5050
ssdeep 6:6v/lhPUtqMl0znDsMAIIrFWbmOdlLaNysdMk+FkQFTpv5Uze79M+5Smloy0xNQXN:6v/7s3LMAIrbm8luNys6fFZFTpv5Uz83
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 010d4d6181d71e84_renamer.po
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.po
Size 93.0KB
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type GNU gettext message catalogue, ASCII text, with very long lines, with CRLF line terminators
MD5 abfaa36321ddda7d287d907355d6535c
SHA1 cc55d42dbb7378d9db7b6bd573fac1849bb95f3e
SHA256 010d4d6181d71e844c5aa4c204c564e8aa44803219b0565d5dc674aa0cdc781b
CRC32 6243576C
ssdeep 1536:egs4tfTCXdWvLG7OQq2axmPdqEFCEgov6T:egs4tEdWvLG7OQq2axmZMov6T
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 8c115aeccde699d0_fm.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\fm.png
Size 552.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 d3767ea95466571e10c7e563d456d754
SHA1 c30dbe4bc2bad6578031290d20cf58e142027d5c
SHA256 8c115aeccde699d03d5124eb30f853129cde0f03e94e9d255eda0eae9ea58c28
CRC32 9F072570
ssdeep 12:6v/7s3L4MLSVQ8Q7UMamZ8vQc883ZYTsS4ToS:gpDQ7Ra28ZxZrT/
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 7f48ab3c10e1f6ed_lclstrconsts.pt_br.po
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.pt_BR.po
Size 45.0KB
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type GNU gettext message catalogue, UTF-8 Unicode text, with very long lines, with CRLF line terminators
MD5 0569168464054b6f568cd242391f1879
SHA1 cdf98afc7cb3d4a9b9a78ea6e37881ba2070c68a
SHA256 7f48ab3c10e1f6edb5cd329d05f563d1a0062ba1bd9494cf1e063196891e317a
CRC32 CCC12AD3
ssdeep 768:gyzCOInxjFMPXFB5+5vYyTKHbP1TVTZ9ugpkwpBeRkLT/:DmoPXFBc5vNKHbP1hZogpkwrvv/
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name ecb1de767e97ae04_mm.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mm.png
Size 483.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 82ad2104b5490e1f6adfcfa777ab8243
SHA1 f214a2b30ba351ee067c36709706ad73156366cb
SHA256 ecb1de767e97ae04cc8fc646f0a533069bb6f5e87e67c8cff13fc8c88799d6a9
CRC32 EA464CF1
ssdeep 12:6v/7s3LBg6jSLjueGTixjzzS2iSM1AHhajXKw1p9:5gHL5Guxjz+2+ABya+p9
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 10517c74355a8ddf_french.txt
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\French.txt
Size 202.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5 8e44921f4c2ebf3c2fe80eda68e7edba
SHA1 90697802f1712ab50cb8f458cc54640e78ee72c3
SHA256 10517c74355a8ddf0229970c6ead8c96748eab3fcbfaa152d03d8c48b1070d38
CRC32 04B063EA
ssdeep 3:lyC9fkymqtvms6vl1oyJjEtWdx6rHYZ2YBLlt1Fo+OaqDM1p0HbvtYcHYnuotH:lyWBhuvdJ4tWd4T428teW0HLqpuoR
Yara None matched
VirusTotal Search for analysis
Name 6d04de1086b124d5_ve.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ve.png
Size 528.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 3aee24fa5f6a85f5ce452001182fdccc
SHA1 76691b168d2cf5f86b363b0f28bc80a2d1156d92
SHA256 6d04de1086b124d5843753e2bd55f137c2537bd47e0d5ea2c55ff3bc1da7293c
CRC32 688E611E
ssdeep 12:6v/7s3L1ubLPUbBDT+nSOdYSdwHWwGeA0eVw+qXC6a5+Q3sRhv5CSjK:YsFynOHFrsw7XCx5+Q3YCS+
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name bd7198c76594a6ed_cy.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\cy.png
Size 428.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 f29741d622fe02759bb7a2a91eb5e2e0
SHA1 1886facee0c56cff9ca8dbbc208bb1325b648318
SHA256 bd7198c76594a6ed1147412a4e37d1ae258d1fd9358d96ded9b524dbeea7bc30
CRC32 B662EF5E
ssdeep 12:6v/7s3LiTFTnfGqRn2NCrPysWvcbo95KbF4TCb:aTFTeqJaCrPy5cW5MOe
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 7eb7d48fd72f83b5_ws.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ws.png
Size 476.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 68183f64328d121a9ee77a92319bbfcd
SHA1 d69e3fe0dbeb7e953040bd4652b23655695c7536
SHA256 7eb7d48fd72f83b5bcee0cc9bac9c24ad42c81927e8d336b6fd05fd9aefa0dcb
CRC32 D9ECB8FF
ssdeep 12:6v/7s3LKzv3t6QckTZKxS9IFZAlJseHqsBSAl9B6ql5w:Gv3dHyIlJMAl97w
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 932459bb0f2e1d6a_portuguese.txt
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Portuguese.txt
Size 211.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5 ce0d5a0807a80aca3e4dc9863312941a
SHA1 fca2259764ae2eae5cefa2472fc0925ced281c97
SHA256 932459bb0f2e1d6a37ba3be0b2e68231fe7fea57074d75c093729a4e082131ea
CRC32 41A9A3D0
ssdeep 6:jxXN2I36p6xq0bm5+GXvvhoB4TOpjFWdgtym:l9QYpGXvoYm
Yara None matched
VirusTotal Search for analysis
Name 7851e0941c758c05_serbian (cyrillic).txt
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Serbian (Cyrillic).txt
Size 184.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5 5affe1b14ba2e9d7ab7cd77ea23b496c
SHA1 0ced397a038cf059e17ba19063eeb011a7ce2681
SHA256 7851e0941c758c056f485424b2c7edac4b06de1392071c93b42fe81671bab714
CRC32 92DE9C6D
ssdeep 3:x3Y5oMQ7ntocpomZXkwkBy/shv1fYNeNlmYxotTCRoivsy8JggyT/Drostn:xo5oMQJoahkwEvyNeTmYUTSoivh8JPyJ
Yara None matched
VirusTotal Search for analysis
Name 189b1af95d661151_launcherlicense.txt
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\Other\Source\LauncherLicense.txt
Size 18.0KB
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type Pascal source, ASCII text, with CRLF line terminators
MD5 ffa10f40b98be2c2bc9608f56827ed23
SHA1 dc8f2e570bf431427dbc3bab9d4d551b53a60208
SHA256 189b1af95d661151e054cea10c91b3d754e4de4d3fecfb074c1fb29476f7167b
CRC32 A6D3A2F5
ssdeep 384:H4j2PmwE3b6k/iAVX/dUY2ZpEGMOZ77oPpDqHZ:H46uh1iYWrTXoPpDqHZ
Yara
  • contentis_base64 - This rule finds for base64 strings
  • embedded_pe - Contains an embedded PE32 file
VirusTotal Search for analysis
Name e8087faf03f47826_bm.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bm.png
Size 611.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 cf195bf1921659202cf8ae899e9171d0
SHA1 21034a5d819ab57acccfa58ebfc9d4d2c563cad5
SHA256 e8087faf03f478266cc279382009391155615af6a7f3eaa47b21717ce8eaa401
CRC32 B24F1B46
ssdeep 12:6v/7s3L1spQ81cbn3fRvDSBDzzEe66caZ8tnzVSsgWZc78cbepoVf+f/ReP1C:NsSGcbn3tSxIe6qZ8JV3bZc78+ee5meg
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name a07077c38e92b550_lclstrconsts.po
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.po
Size 32.1KB
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type GNU gettext message catalogue, ASCII text, with very long lines, with CRLF line terminators
MD5 c00164771330cdbcb16e23a0aeb3f50b
SHA1 b78041af1203380a475741ca3c4e520d9da64868
SHA256 a07077c38e92b5507d99d7bdc763028bffd90a58f213813b7ef59b9b1348ec6b
CRC32 29861B87
ssdeep 384:gyM0FmZFixHPee2V6bVsXfIpa2gJmg7vxAQl:gy4ZFMP8WefIpaFHl
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 6bb1d910ab5186e0_kp.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\kp.png
Size 561.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 0eaa3e8dc84bae9283a9969f2e360080
SHA1 6622d0ecd2555d84579917a79ff8ee9a1c68e9ed
SHA256 6bb1d910ab5186e0cf5518492442f6231470920e22250ad48a27a520b1d376e0
CRC32 B6A197D9
ssdeep 12:6v/7s3L7rU6DAO+Q0AaPEMWAFuiFhIdqDIkhzzAoHI4NT1:UoAO+9snyuK+dqz9Ao77
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 3eb78453cea7aac6_bj.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bj.png
Size 486.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 67bd2e990cc7e3dc5bbae821fd38f20c
SHA1 9e062661797722a7465a0b5f744423acd88c1b75
SHA256 3eb78453cea7aac6afca9a54ec8a2b0d4998df40a0c5494534992fc38f5c2402
CRC32 72CA1632
ssdeep 12:6v/7s3L3rZHSL861jSQbt3F6VBJztaA+To:fWjSQbtV6H9ta5o
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name a2870e6e9927c9ff_uz.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\uz.png
Size 515.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 37e4bdb64229f4624cacec7d4297214d
SHA1 0263ca512be200463ddaee0989a41285d6207bca
SHA256 a2870e6e9927c9ff0b80e6a58b95adb3463714f00733e9c3ddd3be1a2d5d17b5
CRC32 690C6FAC
ssdeep 12:6v/7s3LclTwIkNWTksRLKaPLaJg5WecdFPU6E7+WPv2vwdUTww8w1:GTHkNWToajaJ+WeC2bxnItTbX
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 609f7123d9d23ec4_ph.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ph.png
Size 538.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 8ff2d08518d3e1224d34467f5e24fcc2
SHA1 9741fa8884d956da4cc7475b724021c64077bf7a
SHA256 609f7123d9d23ec401c90b88f677a19125ca24e2899ebe1f3c75598623fdd251
CRC32 F1A3E551
ssdeep 12:6v/7s3LwkZeeKtEIYMydydvaISrajVfKPRLPxqasQ/KDMm:zahyAYWjVfKZV/sQ/KDL
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 776fbb0600f99ccd_ar.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ar.png
Size 506.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 2fa357868e66f1aec9c4c4230baa45b3
SHA1 4c849a943c12cf8d1cac1190b04ec82cd68483fb
SHA256 776fbb0600f99ccdc44e2ee7f8b6559988c443f3a754792585b1b7008aaedb91
CRC32 6253F265
ssdeep 12:6v/7s3LQqaTt6wbNKHH3dVeH8Dp4WSUxySgFBbTFjVNY8wqix7VN:cboHHz1cUdgFBb1bY8cxRN
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name ab0ecc4936f0623e_ec.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ec.png
Size 500.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 0152114421e281913d0c1c148e196c92
SHA1 be76ce5b2e1681e497170512078c99e95fcf6f89
SHA256 ab0ecc4936f0623e3e298ee6f45d88d208e13b72453ec1bbe2be0abdbefeabbb
CRC32 FCF8A45E
ssdeep 12:6v/7s3LTiYj4Elk8RYX9HP5QKt1kMpktOWYhep928l7:7Lj4MEtviKjkMpktOWYhel
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name a74f38227aec7523_mr.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mr.png
Size 569.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 6c1cc8a1babe91421a38ddc573ee7cb4
SHA1 2a9293a6f572ec25c7dbbd1a1f1b8f57b994b105
SHA256 a74f38227aec752324c052e9dd1851122748801ccec7aef5ecfbaa0f94390e8c
CRC32 FE94A9AD
ssdeep 12:6v/7s3LzHZkTXbuZxgU81ZG5opf/EH19S8S:raTKZGU6kcazS
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name aabf518642010552_bs.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bs.png
Size 526.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 8b45f84cb140ec2448692187a82abfc7
SHA1 db5a9faed06fe64c851985621c61b1cd22e09ff0
SHA256 aabf518642010552de4ed24400d5d40fa7e6bf1142a183f4989dad88d7cede5e
CRC32 5F6CE3F5
ssdeep 12:6v/7s3L0Gt1WD3wIRRj2XDkm1/0oU5LkrIltwB8yj4K0Vi1MLO6c:cGWD3rRCQydFm3c
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name feb6364375d0ab08_nsdialogs.dll
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\nsd3.tmp\nsDialogs.dll
Size 9.5KB
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 ca95c9da8cef7062813b989ab9486201
SHA1 c555af25df3de51aa18d487d47408d5245dba2d1
SHA256 feb6364375d0ab081e9cdf11271c40cb966af295c600903383b0730f0821c0be
CRC32 9D200B7A
ssdeep 192:oF8cSzvTyl4tgi8pPjQM0PuAg0YNy8IFtSP:EBSzm+t18pZ0WAg0R8IFg
Yara
  • IsPE32 -
  • IsDLL -
  • IsWindowsGUI -
  • HasRichSignature - Rich Signature Check
  • PEiD_00497_dUP_v2_x_Patcher_____www_diablo2oo2_cjb_net_ - [dUP v2.x Patcher --> www.diablo2oo2.cjb.net]
  • PEiD_01686_Petite_v2_2____www_un4seen_com_petite_ - [Petite v2.2 -> www.un4seen.com/petite]
  • PEiD_02152_StarForce_V3_X_DLL____StarForce_Copy_Protection_System_ - [StarForce V3.X DLL -> StarForce Copy Protection System]
  • Contains_PE_File - Detect a PE file inside a byte sequence
  • contentis_base64 - This rule finds for base64 strings
  • maldoc_function_prolog_signature -
VirusTotal Search for analysis
Name 859d360193bdc311_gd.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gd.png
Size 637.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 95b8b79fafc6b1510978977bc8067b46
SHA1 f9000bd20a10b397dd643f75dd0196a06b3abe8f
SHA256 859d360193bdc3118b13ded0bc1fe9356deb442090daa91f700267035e9dfecc
CRC32 91052E3D
ssdeep 12:6v/7s3Lrxs99WwIb4FmWyKf0ncKMrxaMiij9aH2YCj/3WBNfE2i6xBxPj/2:Dxs9rkbKf/nrcvi62vj/GzfEH6xDi
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 414895d0507b82dc_greek.txt
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Greek.txt
Size 415.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5 2c90a64fafd0c935a0c844c62d019afb
SHA1 5200645bf72fdf6c9ca1789a44fed579340c0151
SHA256 414895d0507b82dc55211a22558e2d9b530980011ca6b018f1e8c5801c32af38
CRC32 08433FBB
ssdeep 12:GycPnaQcMNpGSH6bmieGKoLGo2oHgEQT6uAOpvrW0HYq:749H6bmieGKoaoPHflYx4q
Yara None matched
VirusTotal Search for analysis
Name e0cbd1960cc662ea_sd.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sd.png
Size 492.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 b972f90fea3369c020d258d1b860a6e0
SHA1 95e7fa9c145e83903481baa40e9c96e8a9b74f46
SHA256 e0cbd1960cc662ea059c0438b92449a25b6753fada4734875545ba0f79098ce2
CRC32 1C8B70B8
ssdeep 12:6v/7s3Lvfg5pWRy8du828t53CiDKn25izulr0h9:XfmpkyEu8Tt5S925suc9
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name b7114f95668c77e6_gu.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gu.png
Size 509.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 2d058f7cea364d247fee5bb53fe70390
SHA1 d2c6d46665fff33e56aa15cf675ad66935112a4f
SHA256 b7114f95668c77e6293cb3138bf908989089179c37501a70fdc49eedb73c3d45
CRC32 579B9423
ssdeep 12:6v/7s3L3HyM60GRYVL4YfJQM7/3CysRb2hanys8cDM93:PHX60G+VHJ+ys8y6
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 4be41bfd725282ad_dj.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\dj.png
Size 572.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 197e6fc2579eec8bcd7303393de841ba
SHA1 574791d547ae7723a7f66a0ec2f661564fafbf7d
SHA256 4be41bfd725282adc410a23488c290028b8a433e614dffaa49d0cb28d6bbb39f
CRC32 AB6B8806
ssdeep 12:6v/7s3LLi9Blu0RaSuaccriujnWvbZVakofwn0H7q1Eo+qea/e1MzXsNI8lGuz8X:Dwlu0RSkGyn4a/w0bq1z+lauMzSG8Y
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 656fb035a56a50a6_mx.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mx.png
Size 574.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 479a865f838c70d654a9f818a23f9a7d
SHA1 a5e560f735fb6b246b696cb8167e9385ba508e8a
SHA256 656fb035a56a50a6431312527b106f65c7e03bb8711778018c8dc466d1d445ee
CRC32 5FFF9F71
ssdeep 12:6v/7s3L05uQieXV1kY81c/+8GVHzRDBoZNwoVGIpu:c5YYsdVH1wng
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 64a770c31e9c3372_appicon_128.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\AppInfo\appicon_128.png
Size 7.2KB
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
MD5 08209e5f601fd92eadb3ee80eb848285
SHA1 77b19c0dd8605a800927279b398ef7b9c8fb8378
SHA256 64a770c31e9c3372f29c71ee312d3dd639000ea12bafc1f42dbc098c8eb14dd5
CRC32 0AC97170
ssdeep 192:Gg3fOJ+OIjGPtSCIueM1YumgxmcWJZDeWbvS/Tqxlg:Ggv5fjG19D51YIDWPmLqxW
Yara None matched
VirusTotal Search for analysis
Name 19851391a22a4eee_pk.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\pk.png
Size 569.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 3bd18971ec170e6e9c461026068508da
SHA1 952dd97a2c10d9de24d50edd71ea7c1e9f9f0847
SHA256 19851391a22a4eee0c6a3bc4b9dec8ec2ee15d0133a8f7c8844f599c261219fb
CRC32 CAE0B90F
ssdeep 12:6v/7s3LzHxXfTtAdWn9pTfreYKS0j+8jTGHpVNsDAYH8g0vPOjbulL2H7Se:rxXbt/n9pTTeSg+8jiHpQDFcgYOjjSe
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name bd86d86bb04df9f2_lclstrconsts.fi.po
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.fi.po
Size 34.3KB
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type GNU gettext message catalogue, UTF-8 Unicode text, with very long lines, with CRLF line terminators
MD5 11fad51d48e2e893ed358ee95f3e98aa
SHA1 7d9ffff2406eea5bb07f9e454d1505b24f622a3d
SHA256 bd86d86bb04df9f2440288983e4f40343261d19ea6554e563ee8709fe95be0ee
CRC32 AF838A6B
ssdeep 384:gyPNb0FFrFObquPabehCXLV6KViaNwJIpm4iJmg7vxAbzC:gyPOrFAP1CXxRJNiIpm1KzC
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name e580415cd14ba6df_ukrainian.txt
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Ukrainian.txt
Size 200.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5 6df1ada587ae9108ff7b5d62ce786f63
SHA1 d07717a8c12f3f5a302437a10378118a6b43e526
SHA256 e580415cd14ba6dff291b6f3eeb0c09a86501a5073c9ee8577e23da794493a7d
CRC32 D592B406
ssdeep 6:mToRPxmUhkwTYZ0eTmYUTSoivLJPyTQYAn:mTodvkwTYZnTsoLJpYA
Yara None matched
VirusTotal Search for analysis
Name 2f76cd7a3e8f6206_polish.txt
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Polish.txt
Size 109.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5 f03e21a85784d30383273efe9161a353
SHA1 657f49eaaa851d6f79b2a59bbf2c85c9bb13bea1
SHA256 2f76cd7a3e8f6206e9a911a9e4c558e96e28812508a4bb354a7edbfd163a2d4c
CRC32 BE2D8D20
ssdeep 3:k/5NyjLlXdNo4kEovgkzmY+mCb7YWov6bNBaSn:SUl/o4PytzG3bcvv6bTzn
Yara None matched
VirusTotal Search for analysis
Name 92244b267742bbbf_jm.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\jm.png
Size 637.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 a582c95e205f76277afa1571940121cd
SHA1 0800ebcae9ce835987d4a934140262193d188171
SHA256 92244b267742bbbfbce7f548d5bd5e75449ee446f53032ab3bef03e53ec7fda1
CRC32 6917903B
ssdeep 12:6v/7s3LrEpy9OYbol/eTw5Alsg6FnH0n5ppoQ3qOPfSB2NNb+ewtD9Hc+zRRG:DEzYolWT+AlsVOn5AQZ6UbBwTHvRRG
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name cbef42bf392f9837_sn.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sn.png
Size 532.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 501a5fab662d127ad588825cd0cd4954
SHA1 343f8acc5f043b8312b4bd63969634fbe46e9944
SHA256 cbef42bf392f983769bebb6f52b15b2468b633ecdac03204b492fefb694c6d95
CRC32 9BFEC05D
ssdeep 12:6v/7s3LWA6AKaEO1AxkmKek/aYzbTEZmc/h9Xsc:H60TmPYz2Xsc
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 5d72c5a8bef80fca_gb.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gb.png
Size 599.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 0894999b108830afc0733ee7b6e08310
SHA1 a98ec259c5e198fffb3116e4cf950e2d8b695880
SHA256 5d72c5a8bef80fca6f99f476e15ec95ce2d5e5f65c6dab9ee8e56348be0d39fc
CRC32 2988A7A6
ssdeep 12:6v/7sU87vJ9CMOgi8p9k0HUaJ/zxgUX3vfvWh:LvJ9CM5i8pqcxn3vA
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name a911818976d01261_ge.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ge.png
Size 594.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 aa40721b7a179f6c9c8f666a64063767
SHA1 221de979474608f9eed4e31d899f219937e61598
SHA256 a911818976d012613a3cd0afa6f8e996cdffc3a32ba82d88899e69fbc55f67be
CRC32 2A19352E
ssdeep 12:6v/7s3LnA28hbt71vtaoOYh9v0QO8D0EomJajUizOCLzg:fx85FmoOM9PO8DbomMV8
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 9510efe392a1a661_sm.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sm.png
Size 502.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 56e3c1b483bf27e619146b50ee5181bc
SHA1 ad905ad2c7ff9e2f1871950f823a417c93797f46
SHA256 9510efe392a1a661b235c71faaed1f58730b42472caa0f73a7853b1e10d584d5
CRC32 253D6D35
ssdeep 12:6v/7s3L0eWCOOPvEfnipo9YJFqSuEmcEkuf/EF8c:vHPcfipo6nqSR3EkT9
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 5012ff744573ece2_tm.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\tm.png
Size 593.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 b36ce71226fad4da67764e05b800292b
SHA1 2a49b745285c9c664da73742a21f8e4060570607
SHA256 5012ff744573ece2ed5e8f6aeb6de891bae03a21700141511173d0a9d35a4237
CRC32 9C706BE0
ssdeep 12:6v/7s3LhnsxMxfxaoSg8X9XojafdBRSGe9v9CFsAc/+9:ixMxfxl8X1rgP9lm4/K
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name a632d74332b3f08f_system.dll
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\nsd3.tmp\System.dll
Size 11.5KB
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 75ed96254fbf894e42058062b4b4f0d1
SHA1 996503f1383b49021eb3427bc28d13b5bbd11977
SHA256 a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
CRC32 BFE90AC5
ssdeep 192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
Yara
  • IsPE32 -
  • IsDLL -
  • IsWindowsGUI -
  • HasRichSignature - Rich Signature Check
  • PEiD_00497_dUP_v2_x_Patcher_____www_diablo2oo2_cjb_net_ - [dUP v2.x Patcher --> www.diablo2oo2.cjb.net]
  • PEiD_01070_Microsoft_Visual_C___6_0___8_0_ - [Microsoft Visual C++ 6.0 - 8.0]
  • PEiD_01686_Petite_v2_2____www_un4seen_com_petite_ - [Petite v2.2 -> www.un4seen.com/petite]
  • Contains_PE_File - Detect a PE file inside a byte sequence
  • contentis_base64 - This rule finds for base64 strings
  • maldoc_function_prolog_signature -
  • maldoc_suspicious_strings -
VirusTotal Search for analysis
Name dfad70c1a7d2e9ac_sk.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sk.png
Size 562.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 5a7edc7e4492629ea5ce24b830839d32
SHA1 d524a8817edd710e7de7df3af43324ada9e6507e
SHA256 dfad70c1a7d2e9aca6c8e11a5a61b16e5f6ce8bf5a28d4b47c479189ace5ffba
CRC32 2548412F
ssdeep 12:6v/7s3LHVCLLD4refyBgIMN2MJqiSrwgze7fekVXxIdY/1:NWLwgNNrciSyFxudY/1
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 0b3bf2de6ac6f662_serialize duplicates.pas
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Scripts\Serialize duplicates.pas
Size 747.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type ASCII text, with CRLF line terminators
MD5 f540f90be33fc8fa89ac57050bf06178
SHA1 e7c786bbe313be51e6ed131140de9a2806d9acbc
SHA256 0b3bf2de6ac6f662cb89d219e92fbd785f952c4530479bcfd728f73d587b8606
CRC32 5F94EDEA
ssdeep 12:Fk7vowXJLh0o+Ucrv4d6qDRwSBGeEF427hJ26i2X/ZKxdWymUQ/lWFFpYm6xYAwe:0qlv2rDRVG/7Cn2X/ZcHGlCFCM1Rc
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name a6216497c02291a2_gn.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gn.png
Size 480.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 acba9c908c29db8aa890b6a20265ac22
SHA1 56b9f9062713c252049f4ac5727eea08c14b4f16
SHA256 a6216497c02291a2ea9b2a04d111362fd44f60e754ff74c81561ee730922dc98
CRC32 075280DB
ssdeep 12:6v/7s3LRCwEWVmxdUGhScOk8w5vlpdzNmAZUKhg:5CB56epLbZUmg
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name d5d3b3c24da6db1b_jo.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\jo.png
Size 473.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 9dd19e8da30782b2bfb9b5a0d1c51e8b
SHA1 d60969d60f3b9355640a18ef02a7762fd2320f2b
SHA256 d5d3b3c24da6db1b1cb098da2f8216aab85a2ba04d2088ad97495bbbb3b99da4
CRC32 F052F27F
ssdeep 12:6v/7s3LVPaqiA509M3e18JvDZcoa3fgi9Oq:dPanMO1ovDZcoaYiV
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 58d723462b9d68ae_nr.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\nr.png
Size 527.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 2fb04b74787698835b63a46cbdef6fab
SHA1 6aea78ef190ff7013a43daa8b69ddfbf94dca5e9
SHA256 58d723462b9d68ae1293bb40f72d4a3006fc0f4b0eb96ec08c30c6d07cbc8d69
CRC32 25B1B2C3
ssdeep 12:6v/7s3Lh2TQE+HTbk3ctLIf8kTOWWlV3LkbrQkGlHnQMM8f4N:5sQEeU0YTOzVCGdPf4N
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name b09eae1eaca0581c_gy.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gy.png
Size 645.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 d816170967c67a98db73cd89c56014fd
SHA1 aa668370c512232e12fa4577cc2470e20b21f4a9
SHA256 b09eae1eaca0581c47b0064825061e3939ee8a938c4c51d004b0868372f13413
CRC32 9C7AE291
ssdeep 12:6v/7s3LrmeB0Ir1rMWdbhNPPcdYiZ6eC2O9v7rQ3IfOFnPPdo7KKb5Orsdwd9:DZbzPPcFe9HfcPebMYWz
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 78565ad916ce1cf8_ga.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ga.png
Size 489.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 972da84bdea1359d69c719a37d89d219
SHA1 6d86b54305d65fcc2887217ff25c0242f0822d61
SHA256 78565ad916ce1cf8580860cff6184756cf9fbf08f80d04197f567a8f181f9a4b
CRC32 7C3D64D8
ssdeep 12:6v/7s3LT//snMhHGkbpT26XO/fzklHIN5hjqSc:DckmtrrsoNqP
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name a15608299afdeed2_gq.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gq.png
Size 537.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 70f64b2b38b8a21152e7446a1b3e1133
SHA1 9eee53cee34a4bca46a46fda54b338c18c632096
SHA256 a15608299afdeed2939b687d4bee10e9440395f61d69e402c37a81b4f34bc6ef
CRC32 438D636D
ssdeep 12:6v/7s3LANUYalKJPHxVuv9R9BgmqHo8WzqqOkWMllac90:YtRVuv9RHXahYqqOkvx90
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 604d309375c31da9_mp.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mp.png
Size 597.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 929b9802e7bfb58bab0330a4c6925595
SHA1 8bf12d5845655ff75b72def80a034a9774880561
SHA256 604d309375c31da91dce706037f4b3f1047fd04e82eedacc9d804f4abbaa70e2
CRC32 B0C1EB2A
ssdeep 12:6v/7s3LmKCjXluHc97xoMewXvBB26I78CqBJDutCm8LyYmsCSN:OKC7l+cxiMJvL2l78C+oCzLdCSN
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name eb18716d2c74a424_lclstrconsts.ru.po
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.ru.po
Size 54.0KB
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type GNU gettext message catalogue, UTF-8 Unicode text, with very long lines, with CRLF line terminators
MD5 4ccfc8b679d2e7e09ea41c7e5b5f8488
SHA1 d14c8b3abf4951fee17c722f0bf77b9d0168a577
SHA256 eb18716d2c74a424a9e04cb18b4871471d9a75ef5bfab3ec503aff7ad28dc3dc
CRC32 6C471B3A
ssdeep 1536:EKPDmaTL5v5d2sqpODqQ59Xn/uCCwkbctqHfRue:JP/dVu0WyqHZT
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 23ddd0c23304f715_lt.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\lt.png
Size 508.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 95efec9db9d274d25fbb98eb53a9c384
SHA1 909c778231cb12defc50896fc68d1bf2cf98c63b
SHA256 23ddd0c23304f715e7c5e47f893afbc827a3504ec6f6f828b4d0beb93eafbd62
CRC32 83103204
ssdeep 12:6v/7s3LL3Saa/64astkjWMAuZwGpr6GkYIw+PbpaFf9UP8+:D3S964rM56wYwFf2E+
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 04cd8be0fbd25ccd_pg.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\pg.png
Size 593.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 48f68aaeefaa3b8ee7ce1f1761e6c11d
SHA1 6a9f590e93f62cbcced14d940981c096b33f309e
SHA256 04cd8be0fbd25ccd8017fb3d9a0a2b511adc215a168dbfe671386ce6a783c802
CRC32 142A243F
ssdeep 12:6v/7s3L8e823D5T687rAeFqk5lcNm1QfntWaKdRN44tgUA1:0Kz5Tr7rpFqADynkhRN44OZ1
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 5af9de01b0475f0f_mu.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mu.png
Size 496.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 48d5cbc23fedfbb77b06ed0e9b04522f
SHA1 b4af55f5f7ad83955d1568f9f6c53abce753fcc6
SHA256 5af9de01b0475f0f9e7ed942d4196de6e6ee018a2f24a5162e3dcb833e5cd3d4
CRC32 9573C3C0
ssdeep 12:6v/7s3LHsBtcbiJ3AtplMX6USJhzuujpcNVM1N:UBmbiRATlWFSJhzuujpc7ML
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 2c90e947b0b12087_mh.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mh.png
Size 628.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 948dd15821a6fe45b0df8667b6601ead
SHA1 84eb511e066a389c6b20450299979943b53f73be
SHA256 2c90e947b0b12087942c92d69afb98af57e6de1e5acb2059854d91817c3b2176
CRC32 1130C4D8
ssdeep 12:6v/7s3LrIaywSJTU1wcHiouDYUp/3g4c8jM1Cue7meY7aODC3qU29:DkTTUeIioyYU131rddWCvY
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 0dfb5c39e2a3eebe_ag.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ag.png
Size 591.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 390af4c36d462bbf2627a1182946825a
SHA1 3bd00dff1ac2a305320f31048389fe1c57d67e70
SHA256 0dfb5c39e2a3eebe18b431cf41c8c892ab5f1249caa09d43fa1dd7394d486cd7
CRC32 9D7E765B
ssdeep 12:6v/7s3LaKnX6aalj+Yb3HiCyaFkBxKON38W60H0/pOFj:xnXzuj7LiC3FCKCM/0UE
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 5d8706b032eba892_kh.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\kh.png
Size 549.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 8658c066eb4f9d6c15efb31a821b482c
SHA1 5c24e8389ff0fd0046530a7707bd3dc21b866413
SHA256 5d8706b032eba89228abe0180923cbe1445a27dbb8126b340a9fa4a0ca41827e
CRC32 B195A8BC
ssdeep 12:6v/7s3L2+vEdFVnw9kM8OgJUYI+sxPg1g3cVpeEexu6:e+vAwGn5InPg2KpeEv6
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 8346bfd255be99c8_pf.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\pf.png
Size 498.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 e59d18e48cf0924687618bbf60ea4fee
SHA1 fd587eecab239d1185f3d70d94c359f62bf2c229
SHA256 8346bfd255be99c8bdea0e4f8d6039ac824d4a85c4a974b0cfec245eb9c58318
CRC32 73032095
ssdeep 12:6v/7s3L8Kn8GCkRHtv5Er0mu4P7gKmZ//cii1C7oq:l8xkRHReL7gKmZ3+CD
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name c91813a9d0753c4f_dm.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\dm.png
Size 620.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 85845da8ae28e94f2885ceeb16515dd0
SHA1 f83ea53dea70de57e8f562c4c703e08192fdb5cd
SHA256 c91813a9d0753c4f99503e7123c1b40b2c805ae36128afb9eb6384c275c38195
CRC32 1606DFB8
ssdeep 12:6v/7s3LRTSX4g1OabYI3dtwcPjenCLyXp8Sb4RDAsj3rB:Z2X4OLjNP7vymcsj3rB
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name f045097a33748721_to.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\to.png
Size 426.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 ce868fde2d77788a669001995f4b73df
SHA1 5709de60ca191178da73679f6340db03bd2d5c83
SHA256 f045097a337487211f80bfeaa3391aac99a5b54950380bd32c3d1c96b512f0c8
CRC32 25B67BFA
ssdeep 6:6v/lhPUtqMl0znDsFpsUklFDjhj8tUgl/K2oxo+RJlh1z3Uf9/QNnFY5SmloyTlC:6v/7s3LyTChCzRJlPU9I4NlA1
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name a3dfb202146b493e_lclstrconsts.lt.po
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.lt.po
Size 45.4KB
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type GNU gettext message catalogue, UTF-8 Unicode text, with very long lines, with CRLF line terminators
MD5 d8e0233970c5ae1bbe0d13fbd794c024
SHA1 bd49a8054c92edb99de0f2590d7d695df89d6973
SHA256 a3dfb202146b493eaaae35828373b530a43a7ba9d5f34476b9242f0b45ae4f70
CRC32 A3F041F7
ssdeep 768:Xyc1wdiF/tKP9165v6I2InndxwWQvhZ88I5qyF+CZ7p6:LwjP9165v6I2Ind1Q528I5PF1p6
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name b9d23a6ec352420f_renamer.cs.po
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.cs.po
Size 116.4KB
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type GNU gettext message catalogue, UTF-8 Unicode text, with very long lines, with CRLF line terminators
MD5 53f18df771319c9dd87f3f9d7d35e61e
SHA1 40be5babb9a2d4a39c553c0bd6399a40d88cf6d5
SHA256 b9d23a6ec352420f884470f090d55d06da66a91f3c2e1945eb7ab9e0fd917383
CRC32 D51AD3BD
ssdeep 3072:aqfpsE2B557ojXjAUMxPM0YM2Wxn+nSrvcRN/D:a95CXjAUMxPM0YM2WxnwL
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name fc9572f63afedd18_lc.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\lc.png
Size 520.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 18c05f2c79f8774bbb201593b20a06e2
SHA1 6f2b6b896af74166277d2dcf8a46d9b930af02ad
SHA256 fc9572f63afedd18082ff89cc8e9c2b51abbf09610a381939672b763da655f31
CRC32 3E36D2BE
ssdeep 12:6v/7sU8/a+wV2e0u77U8nzng8e9CW8aGUrcMp5YXKt1:P1cYus8U8e9x8avxA6t1
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name d4ca63b0d2ae73c1_appicon_16.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\AppInfo\appicon_16.png
Size 893.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
MD5 070e4a9ba91c6451ee3af9a164d8a752
SHA1 3b39839d056ed545f59569668241fd43813eeee3
SHA256 d4ca63b0d2ae73c1909870ad43a8b6b8ce2d0c64ea52c0009b9c9f0244b41e04
CRC32 4609B593
ssdeep 12:6v/7M/AF27ViTDtqkmxpHkTlaZ/XgTGZSDBROOeyhAKnZZ/5RVdDdKaDxhD44HWR:wF2cDIkmLHkTlAg8S9Hz/MathxmM/Vcb
Yara None matched
VirusTotal Search for analysis
Name 3af4d71e471cbd7d_sz.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sz.png
Size 643.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 e97675a21b5280b9cb4c1fc99aab004f
SHA1 a92c0d61243fc4f272e47fe5c3003c95b631e042
SHA256 3af4d71e471cbd7d856300a36ee6cde5fc4d29e647f90cb934b0e6f82ffdc1fb
CRC32 6AE341F8
ssdeep 12:6v/7s3LrfqIxdZNAbgfxsF6N0mTWH3WqRZREW9YwTeRj0Wg:D1ZN7xsEmmTWXWqRvF9YwT2vg
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 2ffe1ac2555e822b_findprocdll.dll
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\nsd3.tmp\FindProcDLL.dll
Size 4.0KB
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 ba4c1dfe226d573d516c0529f263011e
SHA1 d726e947633ea75c09bba1cb6a14a79ce953be24
SHA256 2ffe1ac2555e822b4a383996168031e456f09f9cf3bb763fccee35be178cf58a
CRC32 B076F3F7
ssdeep 48:qv1AJiDhU8UsnL0C8EA4G1zkxU5NMsH7pWIa1B3yx3s2mRUyNi7ftUgwQagqlNt/:uJnQChA4nsNMg0I8GiR+Uget
Yara
  • IsPE32 -
  • IsDLL -
  • IsWindowsGUI -
  • HasRichSignature - Rich Signature Check
  • PEiD_00497_dUP_v2_x_Patcher_____www_diablo2oo2_cjb_net_ - [dUP v2.x Patcher --> www.diablo2oo2.cjb.net]
  • PEiD_01686_Petite_v2_2____www_un4seen_com_petite_ - [Petite v2.2 -> www.un4seen.com/petite]
  • Contains_PE_File - Detect a PE file inside a byte sequence
  • contentis_base64 - This rule finds for base64 strings
  • maldoc_suspicious_strings -
VirusTotal Search for analysis
Name 3a6c5facc8613948_ca.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ca.png
Size 628.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 8618709a45d8d1c4d9d254c61bdf29b8
SHA1 9470a0ba81cf743d77ed3cbe98ea6dc9dfb6a583
SHA256 3a6c5facc8613948b81833101a2ff8c3a114813ce24077585faee268b8ffb541
CRC32 A317BAEB
ssdeep 12:6v/7s3Lrxido28rz3clCj73HddIthWsc4Coe5D0XhNplH:Dxij8vRjpYEseaNLH
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name a02a747916b3a5ed_pn.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\pn.png
Size 657.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 e4dcc857f534b48e8377ee36f63be013
SHA1 7706a3dad2a312e52ec506b748a7055a1db8092e
SHA256 a02a747916b3a5ed5283b6261258906408ef112351512627db0f2dda57b686cc
CRC32 1C393B40
ssdeep 12:6v/7s3Lrys42s9I2YfHTZm8ZNB+jEbHWZ8u0b6+DI6sGywXaT1VE89:DysKHYP9v4CebKI6sdVV9
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name ef5cee4b6289acfa_pw.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\pw.png
Size 550.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 f2bff7cd01d8eff6401e811f3de6af4f
SHA1 70801057c0f687d5eec1dd061bc3fa4a90e8d8c9
SHA256 ef5cee4b6289acfae6721efa130076f096d6a3481acad71178016416b17b6b29
CRC32 09727940
ssdeep 12:6v/7s3L8VrFk/LYZMj9WtaOKqmV4QMdEB6clZykua1v0qZnd:UVwYZChEY6cKiv0qZd
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 46a1d50a869dc7e2_help_logo_top.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\Other\Help\Images\Help_Logo_Top.png
Size 2.5KB
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 229 x 47, 8-bit/color RGBA, non-interlaced
MD5 0f024e316973b9d87f3f4c3a1f33c448
SHA1 8ccaf998d7b14731829c0d1104d6fa7a1adc7247
SHA256 46a1d50a869dc7e2c0511cfbc77a15f0092ad9fba0b068736f1e512683a47ee4
CRC32 8F37D7F3
ssdeep 48:NaRbpMYHmHcRu3nh77X9/aoy/b1MUOgmLFu2J:YRbqHSI7TZ/RgSuI
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 88c0749cc9ca14cc_help_background_footer.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\Other\Help\Images\Help_Background_Footer.png
Size 168.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 10 x 16, 8-bit/color RGB, non-interlaced
MD5 6af4a82693a403b0d0afde16972466f5
SHA1 1ab8a3d0cf22cde23173b6b41521377c0fdbeea8
SHA256 88c0749cc9ca14ccea1af39dffaccf7b7c35e5b5603b1e451fe7fce508252480
CRC32 8468EBFD
ssdeep 3:yionv//thPlHvtntCZRthwkBDsTBZtv9L//gbxCRQe1e//VHgNqUMwF/2g1p:6v/lhPo/nDspvmb8RQe1IgN1MwFdp
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name a3acc39d4b61f9cc_at.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\at.png
Size 403.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 62bf1a5653692b34b2ee1f734a59b062
SHA1 56dced18c23f60ee643fc024952a22a4df96d521
SHA256 a3acc39d4b61f9cc1056c19176d1559f0dacbb0587a700afdbe4d881040ccd52
CRC32 9010DDEA
ssdeep 12:6v/7s3Lc8jAuSHgtQCvncITkRVOd4BvrlnAz:k8UuSHguincGk2mlnU
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name f22dbafc8eaee237_cr.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\cr.png
Size 477.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 cd28a01f91e89fa2b844857642fd5fb7
SHA1 7d1b0f3ac8af88c072cf4526c4925446126cacba
SHA256 f22dbafc8eaee237cac9a35777e98818868e2e87e47b640bbf4c487afc10b07e
CRC32 053FAF3D
ssdeep 12:6v/7s3LDMrYhmF9DN4K0FmnJZ//+hhXqFmBpLDeHf8c:g2yR61m6h6FCLi8c
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name b83080ba01438366_bulgarian.txt
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Bulgarian.txt
Size 189.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5 f487d019c93de9766e6e49e283f1e898
SHA1 b796d74f3260dde06d995670fc12a56bbf07d8b9
SHA256 b83080ba01438366c93a8f5c18c5d435b03987727f81285371f21c19df5913f8
CRC32 421DBBC1
ssdeep 3:xsvjY5CNyrYlrzov0qYPEopmUZXkwkByVtpQqNeNlmYxotTCRoivSyJggyfc7:xscdMFy0qYPrmUhkwVp9NeTmYUTSoivX
Yara None matched
VirusTotal Search for analysis
Name 9347bffab453effa_renamer.fr.po
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.fr.po
Size 117.9KB
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type GNU gettext message catalogue, UTF-8 Unicode text, with very long lines, with CRLF line terminators
MD5 b9997c84a895542623da824e69c55b70
SHA1 76913295ccca597c6eea92a539313dcd4ddec39e
SHA256 9347bffab453effa08e18aff67f8b4c213e814cd24e8b6b9a0984798f2442aa8
CRC32 ACE0BD31
ssdeep 1536:I6Zs98sEJUeqSpv0XMAVnMJG0TL27xC/mdNBE5+QCZgAv4d+kpJa2:I6ZscSjXMAVnMJG0TL27xC/jq9v4dm2
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name ee13539f3d66cc05_modern-wizard.bmp
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\nsd3.tmp\modern-wizard.bmp
Size 603.5KB
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PC bitmap, Windows 3.x format, 328 x 628 x 24
MD5 4df53efcaa2c52f39618b2aad77bb552
SHA1 542de62a8a48a3ff57cf7845737803078062e95b
SHA256 ee13539f3d66cc0592942ea1a4c35d8fd9af67b1a7f272d0d791931e6e9ce4eb
CRC32 1CDF967B
ssdeep 1536:9Bn13fmACap7r33OCINrac3aKumetKPKqDjoo+1q7C3DNgbgNgLg7gRgeHRVAVVi:90aZr33XW1
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 8f4511b0ca233ebe_gm.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\gm.png
Size 493.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 a7d785fa41e66a5e6d82301688686f20
SHA1 c5d882faf31b9cdecd3a76cf4670c8a23ad3d8f9
SHA256 8f4511b0ca233ebe65e9c435b0d620a58bc607700469c9b4ea446d2b5db79952
CRC32 BC287287
ssdeep 12:6v/7s3LnRBKr3pmRfaViLD5WS4/ErscC7ddi7Ow:vRBidViLDUSaesZZ8
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 32c5f87ac84b412b_hours span.pas
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Scripts\Hours span.pas
Size 1.8KB
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type ASCII text, with CRLF line terminators
MD5 7d535c4230869f941c1db203ae5a13d0
SHA1 7b5db5cbe58b524393f6ef257f89a8149e5bd87b
SHA256 32c5f87ac84b412b061f336d43869c06f36e04996ff7e33a8c013ebaf738cd0b
CRC32 9539511B
ssdeep 48:UFJhu79NSV5VjbVWUYwKSUCTNOsnoV6UgkYgRQL:UEeVLV0WQm
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 1546928846ee0a83_nl.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\nl.png
Size 453.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 6186550ebc77b1c51cd3ae37e78c33c1
SHA1 622ec95e782d65a5115921b1788b7fc3e97d90ef
SHA256 1546928846ee0a8377fd30865d4c43cef501eba7d775d494b98d1ce699627a4a
CRC32 F4676D64
ssdeep 12:6v/7s3LvWgYu+NtCbVT/icg2vZwy3kKANxf8Vi33q:XWlNtCbB/d9OxK
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 7c655058691a6c83_um.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\um.png
Size 571.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 f0f12f4afaccb13ea40e15f3b81c5921
SHA1 a73b0da5854380c4ec3c273ae39865c36ad3c312
SHA256 7c655058691a6c837db9aac3c2f8662d8e06a6ebd3dd495cca6e691a67c1bf64
CRC32 512554A2
ssdeep 12:6v/7s3LR3Xw5MKYMB33COQsPrLBqPkPt7Suqd7VIy2yW14GQrVYjZHVb9:IMXaHjQszLcPk9IgNbtZ1R
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 6d4a028368989227_sb.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sb.png
Size 624.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 5e4b74f8a611742bdc3a04629e871eb4
SHA1 b47dd47e51260ad8e2ae36a23a3ad0ed55b98d95
SHA256 6d4a0283689892275b974704a1b87e65a67af641d8b7034a661b4dbb91bd8416
CRC32 DC7075D0
ssdeep 12:6v/7s3Lr6yDE1PLgk/sw8Fl+b5JBvySj1RXglPW3D+8qgVFRnHN+hS95jr:DFDECNwil+FJBvyc3XglPkDIcRnHeS99
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 3f38a42fd54e4c7c_ax.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ax.png
Size 663.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 27708378fcc025e375fd3c303fc1cbd6
SHA1 80f2cae567c864f698e995b85c315c081a923a6d
SHA256 3f38a42fd54e4c7cb1154026f734bc444f9cc942b8b91f099cc65dccf6c7f431
CRC32 51E570ED
ssdeep 12:6v/7s3LrrA/2kxt1ctm2Ip907G5CO0arBumHKh2tzGPfSuOzndlnkSEAIb4t9:DrWt12i907GhPYm7zGmLznEVct9
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 48fc49c3010bd153_pa.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\pa.png
Size 519.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 64795009d69b36b6a4461b8159dcf356
SHA1 b97ec00fedb57083292a42cef854880fe8aecb52
SHA256 48fc49c3010bd1530dd86066a61d5a9addadbf31e021c928da9da0cfa0d165f3
CRC32 E02D7652
ssdeep 12:6v/7s3L5dQbp6uIYddgFSPmAK6wYXTEmlVcOM6K0McxR2QU1RfOLN:hdOIlYdy6mAhtVl2OM6Kje2QU1gR
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 4c9bd8548dfa58fd_an.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\an.png
Size 488.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 7d7d682a9dc9f2a26a6dea1fdb87334f
SHA1 3e14814df061e038b586544045bdaf6b598f9318
SHA256 4c9bd8548dfa58fdf9e6ac703f94c8b96d8136c42b06fbdc8e2d8817e592ffde
CRC32 17CD2905
ssdeep 12:6v/7s3LgtIkvJf0hHBl76wLZC2GBUcBTx1j4k3rRO:pkvx0JnDvcb50kI
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name c6fe83ab80ec3c1a_ky.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ky.png
Size 643.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 da2c56cc2568d516031e3082713fd90c
SHA1 caca36b2375ba69a269eaf0267a645d54547c225
SHA256 c6fe83ab80ec3c1af2e81b2409673af43a0a610eecc0f2e8233d2f3886a48255
CRC32 466EB615
ssdeep 12:6v/7s3LrfBLR8xaHsr9Pq04hhCpWffRNqu+cLnRPYLQdhvyNwrXer2m/Ec:Dn8xaMrBq9jRfp7PLdRaOXe6y
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 9e184c95d183ca1f_lclstrconsts.nl.po
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.nl.po
Size 44.0KB
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type GNU gettext message catalogue, UTF-8 Unicode text, with very long lines, with CRLF line terminators
MD5 bb0874f3cbcc452f262cf85df51eb33e
SHA1 da2573c3123b1b81ffdf3938a4bc7a7a02491f9c
SHA256 9e184c95d183ca1f5baeb9be9909cfc623693e7997501f58337eb0765b0268e1
CRC32 F359755B
ssdeep 768:Ey1Wds4zFYSPAS33R5vRWwt8J/0edHiPJH9l+TJYiyy56:Y5ySPASHR5vRWwt8+sHiPJH9NiI
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name f24fdccbff3e936c_sr.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\sr.png
Size 513.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 8f9aca73767b8e7876c72add438a6007
SHA1 38acdcdb9ad32ddcd16bbb7f64a213cf30f6b075
SHA256 f24fdccbff3e936cbebd5a2beebc30a44cdca6ad85e77ce733009ca88b64fc34
CRC32 6672D82A
ssdeep 12:6v/7s3LrERxzFaxBKI11eCmLq6sXduIT0GX1ChWbeqVQ:Uz0BKI/XsvsNuIT0GX1ChWbel
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name e54f03f65087b424_lclstrconsts.de.po
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.de.po
Size 41.3KB
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type GNU gettext message catalogue, UTF-8 Unicode text, with very long lines, with CRLF line terminators
MD5 1f2b0db57831a19f8faedb2f660b29af
SHA1 f1b167f1bf84f74b004fb6a6ea8b4ec999f05ebd
SHA256 e54f03f65087b424aa9e6eeddd0ad0b19c755d22050715574ec20763f8b5fd1d
CRC32 6A8383BB
ssdeep 768:XSYHR4FIPaw4rT5vBqHNtw1SOwwgcNFIKUqGS+UgqX:HxvPaw4X5vBqttwAfwxFIKUqGbqX
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 564a654a7aab9f19_russian.txt
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Translits\Russian.txt
Size 205.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5 646c3491cd5ae59957323c079f283296
SHA1 cdb0db05319b7dd9cc60c7aee7f392db8167fb26
SHA256 564a654a7aab9f194170d56444dedaf0f318e7ba5b2b876a2523f262a01134b0
CRC32 F1BE43FF
ssdeep 6:mToRPxmUhkwCppZ0eTmYUTSoivLJPyTWiC:mTodvkwCLZnTsoLJn
Yara None matched
VirusTotal Search for analysis
Name a802b4b4b31e9c87_bo.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bo.png
Size 500.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 151854ff619d7a44894a37b5be73f463
SHA1 7015bf855de3a85d62d9f7b3cdc1a102cc4873a1
SHA256 a802b4b4b31e9c87062e725760b052083ca0d2cc2cced10f44731688289c4ca5
CRC32 FAF72D6A
ssdeep 12:6v/7s3LTiShwpK82rTjfWQFC1i8lYep8X+KNBYBU:7OKLjfWQs88lvp8X+KN2BU
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name dec6c95977d90a7e_fam.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\fam.png
Size 532.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 0b36de21772c8d87e1d0106878b65231
SHA1 cd754973c82291875242cd5e2c4cf61fcb1d751b
SHA256 dec6c95977d90a7e468b2b823d74cd92a79ba623ac3705028eeaf3669ba98906
CRC32 DCF3A66E
ssdeep 12:6v/7s3LWMBSpD3BeSzRwhNV1ZzVjFDj/bXecsos7:DMTfSvV1NVB//bX3Zs7
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 938dc6946ae403f6_renamer.zh_tw.po
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.zh_TW.po
Size 112.8KB
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type GNU gettext message catalogue, UTF-8 Unicode text, with very long lines, with CRLF line terminators
MD5 5782aaddb136a7f7516eb9993a8a40de
SHA1 2d8e312438a6ee1abb9846dcb64f359e39d23025
SHA256 938dc6946ae403f69281eef4f25230b215ab8558caacc0d72db5fcfba3884499
CRC32 F4424D32
ssdeep 3072:mRs5GLWX3AoQkBSQWV2+x2/Fk7s2vEUYU:f7X3AoQkBSQWV2+x2/F7U
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name d95a38f3825323e8_mv.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mv.png
Size 542.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 24c90cfb0c883f9d1b303276c3b069e7
SHA1 c9ad555d6dae4472d26268f8a48bffc8ee58fa3a
SHA256 d95a38f3825323e8bc65bbe40bc0092c569bd8835ecf5ec7c15d2446bb2fb7c8
CRC32 E3BE0F54
ssdeep 12:6v/7s3LYIkBFVdpJGVSNoN70TR7WaT4IRJP+o9z:HkPUATR7WaTjRMoV
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 166ffee512593873_bw.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bw.png
Size 443.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 15d59270fb25d9e467d5a730682c5644
SHA1 bd290b46274e565e5ac10bc84636f338b165e81a
SHA256 166ffee51259387356bdadeb22cdc7d053fc89ef6f51ae3c774d522a4dfaf08e
CRC32 AC720F37
ssdeep 12:6v/7s3L8ygjfmG5mdI7myMXzje3QWBhbHXS6A:0HxrMXzjF2DXS6A
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name ca9b97bb9ea93039_date and time.pas
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Scripts\Date and Time.pas
Size 217.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type ASCII text, with CRLF line terminators
MD5 851a043270265b700a69c831c6b178d4
SHA1 24c9c0ef51eb2af3446ce22d3cc803d81dea2b8a
SHA256 ca9b97bb9ea93039096ba8c83ab34234e003b82f3102c0eddea09cb7353a471d
CRC32 0A0C0213
ssdeep 3:qGwVEb8yo7pEGqwZTHHQA7wPRetEIACIMHOWANEhAEnF0X6UiUftIjjFHHFlKO8w:qJVwxo7YwZD+Re2wxH5ANWF0XAfFlIod
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 1a8a23af0c1f86ed_renamer.ja.po
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.ja.po
Size 121.8KB
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type GNU gettext message catalogue, UTF-8 Unicode text, with very long lines, with CRLF line terminators
MD5 c684b9746fcb1e98f0fa120ac1840dfa
SHA1 b8eb05a818d433c38ede34c134217868ed992e57
SHA256 1a8a23af0c1f86ed76612a1973765b18517c1d52dcf6ca3e3283fbf433d2e50b
CRC32 73865DA2
ssdeep 3072:d1aXsApIKrmsX9AzPokjyQI2Nxu/fAgvpyZ:wKUrX9AzPokjyQI2Nxu/FA
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name e34d4e7961e7e994_am.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\am.png
Size 497.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 fd5d9d1d864ea76406afec5e11f2632f
SHA1 1d65a04d04fe6acc226f51521048745aaba27455
SHA256 e34d4e7961e7e994775dddfa994e4d9f709876634d36facff6bac70155597c23
CRC32 7C97986D
ssdeep 12:6v/7s3L7HWWKQEhaqInTpZ67XgB6p85FljJz8XWM/Nuvyk3xITkz:TWWkawvS5FllzsWUS3xukz
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name abf11b67187d489d_iq.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\iq.png
Size 515.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 39cfe476621ad630cf3418c3234f0594
SHA1 5d649b60dfdcc06dbc48c4645513477c5c8d0dcf
SHA256 abf11b67187d489d9321ca074a83bf613b08cf9a9de9565fd923088e51096ab7
CRC32 E73228FC
ssdeep 12:6v/7s3LM8jAuSH0yCLSm66kougUQL7sBkHlOk:08UuSH0yi4oND7KkV
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 8aab9c83759b1a12_ba.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ba.png
Size 593.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 cbb6ce46c69e14bbd8d2c8fd91680d33
SHA1 40dab3c90fa2fabee16fa59ecafc129a104f7ac1
SHA256 8aab9c83759b1a121043ae5526d7bd4174d6612c7d0c697609731e9f7b819b6b
CRC32 2059BFFD
ssdeep 12:6v/7s3LI5gHjfC1sZ0nOGje+Kga2aJRZcdVFnpmFToDDPE597bjla6Igzr:w5gHey0nOGjBa9J8pDEbZawzr
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name a20ef40f442f089d_wales.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\wales.png
Size 652.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 42c7ca83721190322499c94d7ff2ae26
SHA1 7f7b0c84784daaca8845fd933a9220c70d380d75
SHA256 a20ef40f442f089d0a5f5dcd089a76babd86f0fe3c243d9c8e50c6c0e4aef3ab
CRC32 C685F991
ssdeep 12:6v/7s3LrtsIWH61Y+SgRCWPShxu1++KGnR12dJlK3XfMwMW6SKjCfK9RIDqnC:DtsIWa1TS6euUvunt0/SKjsK9QyC
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 9a0dc8ca81df6a16_renamer.de.po
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.de.po
Size 116.6KB
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type GNU gettext message catalogue, UTF-8 Unicode text, with very long lines, with CRLF line terminators
MD5 ebd260b0617e86b0465428fac318b9a8
SHA1 b5ffeb0f0f9d7ff25b4dc77c74f30feeff63b852
SHA256 9a0dc8ca81df6a1668068c562aae54c3812a0d1a523e01021d68ac03be9d69e2
CRC32 4BF747E3
ssdeep 1536:o9us+z476WcX0ALRjDxjMh26xJ+Mdpa7Z+YYqgTJvZZ/tbmZE0EZgEggJ:o9us+0iX0ALRjDxjMh26xJO1mJvZcEx
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name cf7718e82afa1af0_readme.txt
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\Readme.txt
Size 185.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type ASCII text, with CRLF line terminators
MD5 9d3d2c85756ff419cec6da38bd89a37b
SHA1 2f722064cefd0d48c5f5d03956a7040900d7f8b1
SHA256 cf7718e82afa1af00882af5a9b80cb1640fbfadad56d218a78371b9bcb649170
CRC32 A50CC39C
ssdeep 3:SMbKyPXtH+XR5WOpH/VVJYMQr3MeMQxF+YEJRi6Xt2vGARFKGRjZUovQ3OSbmSWe:DdH+XR5WKo8zQDuJRPt6zKGRjjRumA
Yara None matched
VirusTotal Search for analysis
Name 4926dc48b10244e0_index filenames.pas
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Scripts\Index filenames.pas
Size 76.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type ASCII text, with CRLF line terminators
MD5 74a654c75515795a8162db640cc81ce2
SHA1 9aabf385efdebc4e819d26cd6962bbaf1304b184
SHA256 4926dc48b10244e0b40f233db539488ea49d1d8723bfe6d0425a7c127f598d09
CRC32 05A685B9
ssdeep 3:q1LAfDkCCn/NEIACWl3g9:qGfDktewqg9
Yara None matched
VirusTotal Search for analysis
Name 61b4918e0904f58a_ma.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ma.png
Size 432.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 c936b9f794def7d85fbb4c120d68684e
SHA1 099a7e7366c8bfc5e581cb0708ef11eae5da226a
SHA256 61b4918e0904f58a113f7132366b1ad9d458dc5311c505f3b9b94b8458620ee2
CRC32 39E06A7F
ssdeep 12:6v/7s3LHB8jAuSHqzQJwbxHdVtjUi0vX3Gk1:p8UuSHqzJdH5UiGL
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 2354a8a69f05bf7b_ir.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ir.png
Size 512.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 2ac099e190547501704d309d59831d2b
SHA1 f027cd8ce65efc2a4432f42c7ca25c7638b4d0a8
SHA256 2354a8a69f05bf7b0fcfc5ed2f89facd8bd1d692d34513acc066103417783c44
CRC32 2E3D1B71
ssdeep 12:6v/7s3LXiO4+BR+OQU8eVv8xpXvrXEqxWy1Ekt5i46uct:Z4+VQJTxd0qxHt5nA
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 64d2bb4ebc19d7ce_tk.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\tk.png
Size 638.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 896fb1a34638a76361d4307668cd5414
SHA1 ecc34ab4a7cd551f62d3b424229ceb61537afc83
SHA256 64d2bb4ebc19d7ce6b32a640ef6831c0f3587c54686e3780e5736108b24bcc12
CRC32 069B602F
ssdeep 12:6v/7s3Lr1sW4cLxteANli92HGZSeYwuwyMN/kyI+45B7Rwut/ac6SXFVgmdbUWF:D1BRFwx2HGZSe97NJy5B7Xt/amjdbUWF
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 6c3b6bf95a58140d_lclstrconsts.hu.po
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.hu.po
Size 39.8KB
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type GNU gettext message catalogue, UTF-8 Unicode text, with very long lines, with CRLF line terminators
MD5 642c5f4d52aaa295c70afe782dd88bd3
SHA1 3405c13e9267170e42f3ee995d3f9a4bd09a1e5e
SHA256 6c3b6bf95a58140dce543af542a2aa8158623a0cec0be77ba2640977bcbcc607
CRC32 E4F15A1D
ssdeep 768:NyNdjS1FPhPsy3rt2NeCyIpg6ldu+XC+dX:tNPsy3raenIpgIdlCM
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 3f7278c0c4272b6f_al.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\al.png
Size 600.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 7c5bc720b2cf3047c9fab800e271eec9
SHA1 a8e31ed33613d407953b976ad42b3994b283b46c
SHA256 3f7278c0c4272b6ff65293c18cdbb7e2e272f59dabe16619c22051d319ef44e0
CRC32 9EE21F18
ssdeep 12:6v/7s3L3CxtbRkFrxUc/6zMa6xv3rEj8KPOb6nY0kAwVxpjT:67lkFtL0Ma6xTErPO27kASxpX
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 24efc04e761e01ac_lb.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\lb.png
Size 517.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 dad5d86f0d90cca0ff4ab5332d7fd7fc
SHA1 c4fcaec7ba2e3570f168f323a8a5ec51b0d132ef
SHA256 24efc04e761e01ac6c0aea8941bce30038fe3af40eef643c2cb9f96d1efa0230
CRC32 0D928B43
ssdeep 12:6v/7s3Lvbn8X9apHHvF25cYuuo443WBDGlQT+giTRdd5llNT:Xb8X9aNHvF2u3up4oDK++gSdd7T
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 893ed4ccb23353f5_wf.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\wf.png
Size 554.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 86cc1aa337ebb6cb74a2c3196770a7f5
SHA1 19ed5da3ad9743d7f1c1df7dfcbb932e38b169f2
SHA256 893ed4ccb23353f597bb7e9544ef8c376c896fc4f6fe56e4ca14aab70e49203e
CRC32 BD7380FB
ssdeep 12:6v/7s3LUd5Y7bpdKZRNHyIpQZcxZLHahexKyr8GYa3Pe6Jl5haHIvk6d:+5KpdKRyIycz6uLYIe6JlGGd
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 36cce5cae3d2e004_us.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\us.png
Size 609.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 968591e0050981be9fa94bd2597afb48
SHA1 dd9e149e2b5ad59dd8b4b262f5fdeb5cc10ecf43
SHA256 36cce5cae3d2e0045b2b2b6cbffdad7a0aba3e99919cc219bbf0578efdc45585
CRC32 0FE07FAC
ssdeep 12:6v/7s3LJ3ieymUGK3y3b9M7eGUMCDU3M2fRtL7Mh/hW+/URN/6/lN:3TUl3yr9MTvHLf7OpW+8K7
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name fcac6aff645d8048_tc.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\tc.png
Size 624.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 50733ccc670058e9a737b652089287ca
SHA1 c66c2508f199db7b8868ae17b0a49efd67489bc0
SHA256 fcac6aff645d8048d395b4a1e0f418be4d823c51525ecbec1d6622e72de9620a
CRC32 39A8EDC8
ssdeep 12:6v/7s3Lrm7FBSYo8A+m4+hFxew6Bh/LfU0+WcAJaBfnGVsjgdfOo:Dm3PH9+hFf63TfQWcAJaB/EQyR
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name ae10dea2abad3145_bt.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\bt.png
Size 631.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 2f13e87c1868b03b0b47cd0bb60737d5
SHA1 e5364bcff9e11f1d2722f73ff8de0e5e66ad2509
SHA256 ae10dea2abad314551038e08771857c6d67d3684487782275c094dab5dfda21e
CRC32 597D726F
ssdeep 12:6v/7s3LrztHQje9vRdCKN7TYk3yTg1YuFxa8/MN6Aegg1c5oSJKyPTwFw:DJwjSRdCKNviTgmoLBgg1c5dKyuw
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 21a3c54b0f51243f_hk.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\hk.png
Size 527.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 389d0451c5c2ff40e88a93588dcbd6f1
SHA1 bdf1eff892d67a3df37e57976a7e552e883ede62
SHA256 21a3c54b0f51243f34747eeb2feb2b2627c29133e6e3a8a1126b7bda81708dab
CRC32 BCB6E12F
ssdeep 12:6v/7s3Lhy2HbGDrf2aGd5bVrtmpFdcNQZZ3d03:5x7qo/VrtmndcG3d03
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name afb8c70cb54bd9ba_lclstrconsts.cs.po
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\LCLStrConsts\lclstrconsts.cs.po
Size 44.0KB
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type GNU gettext message catalogue, UTF-8 Unicode text, with very long lines, with CRLF line terminators
MD5 4cf3e989f77d57b4e0dd2f05d7036699
SHA1 c9976c6f750ae70a0a006529bc1c3d4af2b63e94
SHA256 afb8c70cb54bd9baaab9a8368304968a41023ed23d88d456a5a38f2ba9aa5912
CRC32 8F879054
ssdeep 768:tyEkr5FifsNPZLhIJ4AIEhNEmHwllGc7Ssr9xphB4M3:CifQPZLhIJ4AIEEmc8c7Jxd7
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 75bd9bf0f8d27cff_europeanunion.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\europeanunion.png
Size 479.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 ffce5e64df4d367a20e1ef4033f60257
SHA1 1cbec9af7db3f871389f06f5c2e1dd1e735719b2
SHA256 75bd9bf0f8d27cff7b8005c1a1808d75923ab1ee606f7220b4b35616e3e5a8ad
CRC32 82AA3B77
ssdeep 12:6v/7sU8Bd3p74vRYfNJKvKEZjIfdrC6QcFDhasC6VCc:Rd3mvRYCvKEl+u6xFDhaE
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 44f27e9e647d9a88_renamer.ru.po
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\ReNamer.ru.po
Size 134.9KB
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type GNU gettext message catalogue, UTF-8 Unicode text, with very long lines, with CRLF line terminators
MD5 06d9b0870bc293e3def3a9e1ab60405d
SHA1 30d821152782c8d6e79dc14d492d25f11643bc86
SHA256 44f27e9e647d9a8864a34d0e98d84d0c7084132cb1cf87fb4d167e3563a7b2b8
CRC32 2E3C0BBE
ssdeep 3072:QUsIL7DoMOyXcAlrK4FJCL24xZ/C6UEv71jQ4EIZg:x7sMOyXcAlrK4FJCL24xZ/C+jxEIC
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 6f20d866841c4514_ae.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\ae.png
Size 408.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 7391e6b6df7b181d51ffeb2a5a6d7bd4
SHA1 e442abb4c7713078983da019502d070f38c12e26
SHA256 6f20d866841c4514782a46142df22b70b8da9783c513e3d41d8f3313483fe38d
CRC32 2B7E80D8
ssdeep 12:6v/7s3LZSApR0cNiLzXbiwGVmcOou1fmehYd2jCbx:xSAfMPXmpkdfmeOd2jCbx
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name 58053a49f7c9d07f_appnameportable.ini
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\Other\Source\AppNamePortable.ini
Size 244.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type ASCII text, with CRLF line terminators
MD5 8634c50b01d5ea4adc0d9eca692cbb5b
SHA1 ce39ebe17200463b7625a07288bae88c688f0ab8
SHA256 58053a49f7c9d07faceb35c298022d31da5b00b8840e611074475b41ceb9b7e9
CRC32 0A3AE46A
ssdeep 6:IQE7Em2VPVJSgBYlyGqMwIjAIMLyJQBABCXh5XMWJk/71NLyJQBAK:It2hrY8fjI8IMee2cXhX28e2K
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis
Name cde4f13166c5a8ca_mg.png
Filepath C:\Documents and Settings\zamen\Local Settings\Temp\ReNamerPortable\App\ReNamer\Languages\Flags\mg.png
Size 453.0B
Processes 404 (ReNamerPortable_6.9.paf.exe)
Type PNG image data, 16 x 11, 8-bit/color RGB, non-interlaced
MD5 5aea24a18ca7e8b65770dcf2a738dd08
SHA1 e45df15653c185c90f4325591ae0462997449732
SHA256 cde4f13166c5a8ca794977b62911e567cdf7bb6b420c934f0c5b284df81c25c2
CRC32 FD25E014
ssdeep 12:6v/7s3Lvm8mdWq6CCyOcjqUxz4wZ6baaLfY318tUPGXR4:Xm3dWq6C6hw4xb/YmUmR4
Yara
  • contentis_base64 - This rule finds for base64 strings
VirusTotal Search for analysis