3d184de07c696fa129629793d9c7bb99

Description

Summary

INCOMPLETE SECTION OR ARTICLE

This section/article is being written and is therefore not complete.
Thank you for your comprehension.

Identification

MD5	3d184de07c696fa129629793d9c7bb99
SHA1	f8395be1e99e4949fac4d7805647360e27febd19
SHA256	4250f5fd5a9ab6ca030457679db42560f8300593507a1a76ede146b8faa1fd6b
ssdeep	3072:IkVeS2JhI8YraZ9NlZ+h/PUKhzEV+z0eXZBMiEJ:IkGfYe8PwV+jX1E
imphash	e578ccf689e715755330215bb3189c40
File size	191.0 KB ( 195584 bytes )
File type	Win32 EXE
Magic literal	PE32 executable for MS Windows (GUI) Intel 80386 32-bit TrID Win32 Executable MS Visual C++ (generic) (67.3%) Win32 Dynamic Link Library (generic) (14.2%) Win32 Executable (generic) (9.7%) Generic Win/DOS Executable (4.3%) DOS Executable Generic (4.3%)

Antivirus detection

Antivirus	Detection	Update
Ad-Aware	Gen:Variant.Kazy.384738	20140609
AegisLab		20140609
Agnitum		20140608
AhnLab-V3		20140609
AntiVir	TR/Kazy.384738	20140609
Antiy-AVL		20140609
Avast	Win32:Rootkit-gen [Rtk]	20140609
AVG	Lebros.MW	20140609
Baidu-International	Trojan.Win32.Kryptik.bCDJH	20140609
BitDefender	Gen:Variant.Kazy.384738	20140609
Bkav	HW32.CDB.96c8	20140606
ByteHero		20140609
CAT-QuickHeal		20140609
ClamAV		20140609
CMC	Packed.Win32.Obfuscated.10!O	20140609
Commtouch		20140609
Comodo	UnclassifiedMalware	20140609
DrWeb		20140609
Emsisoft	Gen:Variant.Kazy.384738 (B)	20140609
ESET-NOD32	a variant of Win32/Kryptik.CDJH	20140609
F-Prot		20140609
F-Secure	Gen:Variant.Kazy.384738	20140609
Fortinet	W32/Generic.CDJH!tr	20140608
GData	Gen:Variant.Kazy.384738	20140609
Ikarus	Trojan.Lebros	20140609
Jiangmin		20140609
K7AntiVirus	Trojan ( 0049b3251 )	20140609
K7GW	Trojan ( 0049b3251 )	20140609
Kaspersky	HEUR:Trojan.Win32.Generic	20140609
Kingsoft		20140609
Malwarebytes	Spyware.Zbot.VXGen	20140609
McAfee	Generic Packed	20140609
McAfee-GW-Edition	Generic Packed	20140609
Microsoft		20140609
MicroWorld-eScan	Gen:Variant.Kazy.384738	20140609
NANO-Antivirus		20140609
Norman	Troj_Generic.UGOEZ	20140609
nProtect		20140609
Panda	Trj/CI.A	20140609
Qihoo-360		20140609
Rising	PE:Malware.XPACK-HIE/Heur!1.9C48	20140609
Sophos	Troj/Agent-AHHT	20140609
SUPERAntiSpyware		20140608
Symantec		20140609
Tencent		20140609
TheHacker		20140609
TotalDefense		20140609
TrendMicro	TROJ_GEN.R0CBC0FF814	20140609
TrendMicro-HouseCall	TROJ_GEN.R0CBC0FF814	20140609
VBA32		20140609
VIPRE	Trojan.Win32.Generic!BT	20140609
ViRobot		20140609

Links

• https://www.virustotal.com/en/file/4250f5fd5a9ab6ca030457679db42560f8300593507a1a76ede146b8faa1fd6b/analysis/1402319764/
• https://malwr.com/analysis/ODFiYzNhNWU1NGZmNDNkNmFjNTJhY2NjNjdjNjRlYmE/
• Download: https://www.dropbox.com/s/g0fetsi188h8uo8/4250f5fd5a9ab6ca030457679db42560f8300593507a1a76ede146b8faa1fd6b.zip (pass: infected)

Artifacts

Persistence

The malware ensures persistence by creating following entries:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

05d87e = "C:\\05d87ed\\05d87ed.exe"

05d87ed = "C:\\Documents and Settings\\malware\\Application Data\\05d87ed.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]

*5d87e = "C:\\05d87ed\\05d87ed.exe"

*5d87ed = "C:\\Documents and Settings\\malware\\Application Data\\05d87ed.exe"

Files modifications

The malware copies itself to:

• C:\05d87ed\05d87ed.exe
• C:\Documents and Settings\%user%\Application Data\05d87ed.exe
• C\Documents and Settings\%user%\Start Menu\Programmes\Startup\05d87ed.exe

Registry modifications

Key	Old value	New value
HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed	62 4E FB 9B 21 BF E1 BF BD 8A 83 F6 DB 43 F8 EB A2 D6 B3 51 86 4F 30 C2 0C 03 62 11 67 CD CA D9 F2 47 23 C6 B1 2E E9 C2 CC 6F 56 3D 46 0C 36 43 17 00 2B E5 DF 44 BD 00 F3 CB F1 CE 42 6C CD F7 0E B1 26 F7 43 0C 21 0A DA 0A 71 6A E3 2E C6 E0	07 68 9B 4A 25 48 07 F8 58 72 AD FD 3F C1 A8 1B EC D6 E6 F0 2E 94 F2 0A E2 A2 DD 09 81 2A 8E 3D EC F9 05 DD B9 57 BD 39 86 5D EB 3B 53 78 0D E9 A8 04 BD D4 84 94 14 D1 66 31 17 2A E7 04 C1 87 BF E9 13 B3 5F 90 8E 58 E7 54 E3 63 98 C3 08 A9
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\DisableSR	0x00000000	0x00000001
HKLM\SYSTEM\ControlSet001\Services\BITS\Start	0x00000003	0x00000004
HKLM\SYSTEM\ControlSet001\Services\ERSvc\Start	0x00000002	0x00000004
HKLM\SYSTEM\ControlSet001\Services\wscsvc\Start	0x00000002	0x00000004
HKLM\SYSTEM\ControlSet001\Services\wuauserv\Start	0x00000002	0x00000004
HKLM\SYSTEM\CurrentControlSet\Services\BITS\Start	0x00000003	0x00000004
HKLM\SYSTEM\CurrentControlSet\Services\ERSvc\Start	0x00000002	0x00000004
HKLM\SYSTEM\CurrentControlSet\Services\wscsvc\Start	0x00000002	0x00000004
HKLM\SYSTEM\CurrentControlSet\Services\wuauserv\Start	0x00000002	0x00000004
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings	3C 00 00 00 20 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 C0 1D 21 C2 77 DD CE 01 01 00 00 00 C0 A8 8B 80 00 00 00 00 00 00 00 00	3C 00 00 00 21 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 C0 1D 21 C2 77 DD CE 01 01 00 00 00 C0 A8 8B 80 00 00 00 00 00 00 00 00

Network indicators

Contacted domains

Domain	IP
wawamediana.com	5.101.146.182
qoweiuwea.com	199.188.203.16
khalisimilisi.com wartbartmart.com	162.213.250.163
posramosra.com	46.19.143.234

Requests

POST /9h42x194iy HTTP/1.1
Accept: */*
Content-Type: application/x-www-form-urlencoded
Connection: Close
Content-Length: 100
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E)
Host: wawamediana.com
Cache-Control: no-cache

y=0e2fc6ad081ea08630e7734848bef6650dbaf33094ca71c7ba40bed1fa6f55dc9a60e3e24b972e5778feb1bea986fa59fe

POST /j4rzq60y9u HTTP/1.1
Accept: */*
Content-Type: application/x-www-form-urlencoded
Connection: Close
Content-Length: 100
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E)
Host: wawamediana.com
Cache-Control: no-cache

z=3cdea4aeb187cd8c36d0b383cefd49ea9cf988a0dbd275197ea39b89f7ab56769a778970aa0b4be4a76badd874fd19d52a

POST /j4rzq60y9u HTTP/1.1
Accept: */*
Content-Type: application/x-www-form-urlencoded
Connection: Close
Content-Length: 100
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET4.0C; .NET4.0E)
Host: qoweiuwea.com
Cache-Control: no-cache

z=3cdea4aeb187cd8c36d0b383cefd49ea9cf988a0dbd275197ea39b89f7ab56769a778970aa0b4be4a76badd874fd19d52a

Static analysis

Version information

Publisher	Control Break International
Original name	Bxqghr.exe
Internal name	Umuxi
File version	9, 3, 8
Description	Amacet Ybecud Sutawy

Sections

Name       VirtAddr     VirtSize     RawSize      Entropy     
--------------------------------------------------------------------------------
.textM     0x1000       0x10868      0x10a00      7.337213    [SUSPICIOUS]
.rdatao    0x12000      0x3b0b       0x3c00       2.984676    
.data      0x16000      0x1148c      0x8600       6.099920    
.rsrcc     0x28000      0x12b80      0x12c00      6.453867

Resources

================================================================================
Name               RVA      Size     Lang         Sublang                  Type
--------------------------------------------------------------------------------
RT_MENU            0x2c4c8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2c550  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2c5d8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2c660  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2c6e8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2c770  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2c7f8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2c880  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2c908  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2c990  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2ca18  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2caa0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2cb28  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2cbb0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2cc38  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2ccc0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2cd48  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2cdd0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2ce58  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2cee0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2cf68  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2cff0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2d078  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2d100  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2d188  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2d210  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2d298  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2d320  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2d3a8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2d430  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2d4b8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2d540  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2d5c8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2d650  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2d6d8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2d760  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2d7e8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2d870  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2d8f8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2d980  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2da08  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2da90  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2db18  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2dba0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2dc28  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2dcb0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2dd38  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2ddc0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2de48  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2ded0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2df58  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2dfe0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2e068  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2e0f0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2e178  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2e200  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2e288  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2e310  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2e398  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2e420  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2e4a8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2e530  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2e5b8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2e640  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2e6c8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2e750  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2e7d8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2e860  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2e8e8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2e970  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2e9f8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2ea80  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2eb08  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2eb90  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2ec18  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2eca0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2ed28  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2edb0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2ee38  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2eec0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2ef48  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2efd0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2f058  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2f0e0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2f168  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2f1f0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2f278  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2f300  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2f388  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2f410  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2f498  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2f520  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2f5a8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2f630  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2f6b8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2f740  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2f7c8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2f850  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2f8d8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2f960  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2f9e8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2fa70  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2faf8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2fb80  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2fc08  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2fc90  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2fd18  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2fda0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2fe28  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2feb0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2ff38  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x2ffc0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x30048  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x300d0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x30158  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x301e0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x30268  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x302f0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x30378  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x30400  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x30488  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x30510  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x30598  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x30620  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x306a8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x30730  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x307b8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x30840  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x308c8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x30950  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x309d8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x30a60  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x30ae8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x30b70  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x30bf8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x30c80  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x30d08  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x30d90  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x30e18  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x30ea0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x30f28  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x30fb0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x31038  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x310c0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x31148  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x311d0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x31258  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x312e0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x31368  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x313f0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x31478  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x31500  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x31588  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x31610  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x31698  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x31720  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x317a8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x31830  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x318b8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x31940  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x319c8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x31a50  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x31ad8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x31b60  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x31be8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x31c70  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x31cf8  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x31d80  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x31e08  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x31e90  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x31f18  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x31fa0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x32028  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x320b0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x32138  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x321c0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x32248  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x322d0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x32358  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x323e0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x32468  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x324f0  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x32578  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x32600  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x32688  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x32710  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_MENU            0x32798  0x1a1    LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x3293c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x329c4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x32a4c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x32ad4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x32b5c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x32be4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x32c6c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x32cf4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x32d7c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x32e04  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x32e8c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x32f14  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x32f9c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x33024  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x330ac  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x33134  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x331bc  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x33244  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x332cc  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x33354  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x333dc  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x33464  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x334ec  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x33574  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x335fc  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x33684  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x3370c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x33794  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x3381c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x338a4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x3392c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x339b4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x33a3c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x33ac4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x33b4c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x33bd4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x33c5c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x33ce4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x33d6c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x33df4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x33e7c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x33f04  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x33f8c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x34014  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x3409c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x34124  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x341ac  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x34234  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x342bc  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x34344  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x343cc  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x34454  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x344dc  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x34564  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x345ec  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x34674  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x346fc  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x34784  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x3480c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x34894  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x3491c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x349a4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x34a2c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x34ab4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x34b3c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x34bc4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x34c4c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x34cd4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x34d5c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x34de4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x34e6c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x34ef4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x34f7c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x35004  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x3508c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x35114  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x3519c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x35224  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x352ac  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x35334  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x353bc  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x35444  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x354cc  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x35554  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x355dc  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x35664  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x356ec  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x35774  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x357fc  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x35884  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x3590c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x35994  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x35a1c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x35aa4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x35b2c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x35bb4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x35c3c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x35cc4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x35d4c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x35dd4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x35e5c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x35ee4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x35f6c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x35ff4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x3607c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x36104  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x3618c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x36214  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x3629c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x36324  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x363ac  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x36434  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x364bc  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x36544  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x365cc  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x36654  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x366dc  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x36764  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x367ec  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x36874  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x368fc  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x36984  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x36a0c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x36a94  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x36b1c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x36ba4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x36c2c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x36cb4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x36d3c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x36dc4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x36e4c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x36ed4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x36f5c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x36fe4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x3706c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x370f4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x3717c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x37204  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x3728c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x37314  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x3739c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x37424  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x374ac  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x37534  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x375bc  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x37644  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x376cc  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x37754  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x377dc  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x37864  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x378ec  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x37974  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x379fc  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x37a84  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x37b0c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x37b94  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x37c1c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x37ca4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x37d2c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x37db4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x37e3c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x37ec4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x37f4c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x37fd4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x3805c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x380e4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x3816c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x381f4  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x3827c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x38304  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x3838c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x38414  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x3849c  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x38524  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x385ac  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x38634  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_DIALOG          0x386bc  0x87     LANG_FRENCH  SUBLANG_FRENCH_CANADIAN  
RT_VERSION         0x38744  0x24c    LANG_FRENCH  SUBLANG_FRENCH_CANADIAN

IAT

Module	Function [[]]
KERNEL32.dll	GetUserDefaultUILanguage GetTempFileNameW DefineDosDeviceW SystemTimeToFileTime GetModuleFileNameW GetProcessTimes WaitForSingleObjectEx CreateNamedPipeA CompareFileTime CancelDeviceWakeupRequest MapViewOfFileEx SetProcessPriorityBoost GetCommProperties WriteFileGather BackupWrite DeleteFileW GetProcessHeap GetComputerNameExA CreateMutexA WaitNamedPipeW GetModuleHandleA IsSystemResumeAutomatic FindNextVolumeMountPointW GetSystemTimeAsFileTime EnumResourceLanguagesA lstrcmpW IsValidLanguageGroup IsValidCodePage GlobalHandle GetDiskFreeSpaceExW MoveFileW EnumDateFormatsA ExitProcess
MPR.dll	WNetGetConnectionW WNetGetLastErrorA WNetEnumResourceA WNetGetNetworkInformationA WNetDisconnectDialog1W WNetAddConnection3W WNetGetUniversalNameW WNetSetLastErrorA WNetAddConnection2W WNetGetNetworkInformationW WNetConnectionDialog WNetSetLastErrorW WNetCancelConnection2A WNetGetResourceInformationA
MSWSOCK.dll	TransmitFile GetTypeByNameW sethostname GetNameByTypeW rresvport dn_expand EnumProtocolsW GetAddressByNameW NPLoadNameSpaces rcmd s_perror GetServiceW getnetbyname MigrateWinsockConfiguration WSARecvEx EnumProtocolsA
OLE32.dll	CLIPFORMAT_UserSize CoCreateObjectInContext OpenOrCreateStream HENHMETAFILE_UserUnmarshal MonikerRelativePathTo DllDebugObjectRPCHook OleFlushClipboard HPALETTE_UserSize CoRegisterMessageFilter HWND_UserUnmarshal StgOpenPropStg CoGetCallContext OleDraw CoQueryProxyBlanket CoTaskMemRealloc StgConvertVariantToProperty UtConvertDvtd32toDvtd16 SetDocumentBitStg CoGetObjectContext CoCreateFreeThreadedMarshaler CreateDataAdviseHolder CoUninitialize StgCreatePropStg CoInitializeSecurity CoDosDateTimeToFileTime OleCreateFromFileEx CoTaskMemFree CoCancelCall
RESUTILS.dll	ResUtilGetDwordProperty ResUtilSetPropertyTable ResUtilDupParameterBlock ResUtilCreateDirectoryTree ResUtilVerifyPropertyTable ResUtilEnumProperties ResUtilSetPropertyParameterBlock ResUtilSetSzValue ClusWorkerStart ClusWorkerCreate ResUtilSetResourceServiceEnvironment ResUtilFindLongProperty ResUtilFindSzProperty ResUtilFindDependentDiskResourceDriveLetter ResUtilGetBinaryValue ResUtilGetPrivateProperties ResUtilGetResourceDependencyByClass ResUtilExpandEnvironmentStrings ResUtilDupString ResUtilFreeParameterBlock ResUtilPropertyListFromParameterBlock ResUtilGetResourceDependentIPAddressProps ResUtilFreeEnvironment
SAMLIB.dll	SamQueryInformationUser SamDeleteGroup SamSetSecurityObject SamRemoveMemberFromForeignDomain SamConnect SamSetInformationDomain SamQueryInformationGroup SamCloseHandle SamEnumerateAliasesInDomain SamOpenGroup SamCreateGroupInDomain SamCreateAliasInDomain SamCreateUser2InDomain SamGetGroupsForUser SamChangePasswordUser2 SamLookupDomainInSamServer SamOpenUser SamConnectWithCreds SamFreeMemory
URLMON.dll	IsAsyncMoniker RegisterMediaTypeClass CreateFormatEnumerator GetSoftwareUpdateInfo GetClassURL CopyBindInfo CoInternetQueryInfo CoInternetGetSession CoInternetCreateZoneManager URLDownloadToCacheFileA URLOpenBlockingStreamW RegisterMediaTypes CoInternetParseUrl URLDownloadToCacheFileW ObtainUserAgentString ReleaseBindInfo BindAsyncMoniker IsValidURL CoInternetCompareUrl SetSoftwareUpdateAdvertisementState URLOpenPullStreamA UrlMkBuildVersion GetClassFileOrMime Extract FindMimeFromData CoGetClassObjectFromURL
USER32.dll	SetWindowsHookA
WINMM.dll	auxGetVolume SendDriverMessage mciGetErrorStringA waveInStop mixerGetLineControlsA waveOutGetPosition midiInStart timeEndPeriod midiStreamOut waveOutGetPlaybackRate waveOutMessage waveInGetID mmioGetInfo auxOutMessage mciSetDriverData DriverCallback midiOutGetDevCapsA waveOutSetPitch mciGetDeviceIDW CloseDriver midiStreamProperty mixerSetControlDetails mixerClose joySetCapture mmsystemGetVersion mciGetDeviceIDA midiInMessage waveOutGetErrorTextA mci32Message
WINTRUST.dll	CryptCATCDFEnumMembersByCDFTagEx WVTAsn1SpcLinkDecode WVTAsn1SpcLinkEncode TrustIsCertificateSelfSigned CryptCATCatalogInfoFromContext CryptSIPPutSignedDataMsg WVTAsn1SpcSigInfoDecode SoftpubLoadSignature WVTAsn1SpcSpOpusInfoEncode SoftpubCleanup CryptCATEnumerateCatAttr CryptSIPCreateIndirectData CryptCATPutAttrInfo CryptCATEnumerateMember CryptCATCDFEnumAttributes MsCatFreeHashTag WintrustAddActionID IsCatalogFile WTHelperGetProvPrivateDataFromChain CryptCATGetCatAttrInfo WinVerifyTrust CryptCATCDFOpen CryptCATAdminAcquireContext SoftpubDumpStructure SoftpubDllRegisterServer

Strings

INCOMPLETE SECTION OR ARTICLE

This section/article is being written and is therefore not complete.
Thank you for your comprehension.

Comments

Keywords: Kazy 3d184de07c696fa129629793d9c7bb99