Analysis Report
Overview
General Information |
---|
Joe Sandbox Version: | 20.0.0 |
Analysis ID: | 366514 |
Start time: | 13:07:49 |
Joe Sandbox Product: | Cloud |
Start date: | 18.09.2017 |
Overall analysis duration: | 0h 14m 32s |
Hypervisor based Inspection enabled: | false |
Report type: | full |
Sample file name: | CCleaner.exe |
Cookbook file name: | default.jbs |
Analysis system description: | Windows 7 (Office 2010 v14.0.4, Java 1.8.0_40, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 55, Firefox 43) |
Number of analysed new started processes analysed: | 5 |
Number of new started drivers analysed: | 0 |
Number of existing processes analysed: | 0 |
Number of existing drivers analysed: | 0 |
Number of injected processes analysed: | 0 |
Technologies |
|
Detection: | MAL |
Classification: | mal72.evad.spyw.winEXE@1/11@2/5 |
HCA Information: | Failed |
EGA Information: |
|
Cookbook Comments: |
|
Warnings: | Show All
|
Detection |
---|
Strategy | Score | Range | Reporting | Detection | |
---|---|---|---|---|---|
Threshold | 72 | 0 - 100 | Report FP / FN |
Confidence |
---|
Strategy | Score | Range | Further Analysis Required? | Confidence | |
---|---|---|---|---|---|
Threshold | 5 | 0 - 5 | false |
Collider Navigation |
---|
Classification |
---|
Analysis Advice |
---|
Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior |
Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior |
Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis |
Signature Overview |
---|
Click to jump to signature section
AV Detection: |
---|
Antivirus detection for submitted file | Show sources |
Source: CCleaner.exe | virustotal: | Perma Link |
E-Banking Fraud: |
---|
Drops certificate files (DER) | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | File created: |
Networking: |
---|
Contains functionality to download additional files from the internet | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | Code function: | 0_2_000E22CB |
Downloads files | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | File created: |
Downloads files from webservers via HTTP | Show sources |
Source: global traffic | HTTP traffic detected: |
Found strings which match to known social media urls | Show sources |
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: |
Performs DNS lookups | Show sources |
Source: unknown | DNS traffic detected: |
Urls found in memory or binary data | Show sources |
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe, verify[1].htm.0.dr | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C.0.dr | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe, verify[1].htm.0.dr | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe, ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C0.0.dr | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: | ||
Source: CCleaner.exe | String found in binary or memory: |
Uses HTTPS | Show sources |
Source: unknown | Network traffic detected: | ||
Source: unknown | Network traffic detected: | ||
Source: unknown | Network traffic detected: | ||
Source: unknown | Network traffic detected: |
Uses a known web browser user agent for HTTP communication | Show sources |
Source: global traffic | HTTP traffic detected: |
Stealing of Sensitive Information: |
---|
Tries to harvest and steal browser information (history, passwords, etc) | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | File opened: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | File opened: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | File opened: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | File opened: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | File opened: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | File opened: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | File opened: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | File opened: |
Tries to harvest and steal ftp login credentials | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | File opened: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | File opened: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | File opened: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | File opened: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | File opened: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | File opened: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | File opened: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | File opened: |
Data Obfuscation: |
---|
Contains functionality to dynamically determine API calls | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | Code function: | 0_2_000E1E2A |
Uses code obfuscation techniques (call, push, ret) | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | Code function: | 0_2_01285519 |
Spreading: |
---|
Enumerates the file system | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | File opened: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | File opened: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | File opened: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | File opened: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | File opened: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | File opened: |
System Summary: |
---|
Reads internet explorer settings | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | Key opened: |
Executable creates window controls seldom found in malware | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | Window found: |
Checks if Microsoft Office is installed | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | Key opened: |
PE file has a big code size | Show sources |
Source: CCleaner.exe | Static PE information: |
PE file has a valid certificate | Show sources |
Source: CCleaner.exe | Static PE information: |
Submission file is bigger than most known malware samples | Show sources |
Source: CCleaner.exe | Static file information: |
PE file has a big raw section | Show sources |
Source: CCleaner.exe | Static PE information: | ||
Source: CCleaner.exe | Static PE information: |
PE file imports many functions | Show sources |
Source: CCleaner.exe | Static PE information: |
PE file contains a mix of data directories often seen in goodware | Show sources |
Source: CCleaner.exe | Static PE information: | ||
Source: CCleaner.exe | Static PE information: | ||
Source: CCleaner.exe | Static PE information: | ||
Source: CCleaner.exe | Static PE information: | ||
Source: CCleaner.exe | Static PE information: | ||
Source: CCleaner.exe | Static PE information: |
Contains modern PE file flags such as dynamic base (ASLR) or NX | Show sources |
Source: CCleaner.exe | Static PE information: |
PE file contains a debug data directory | Show sources |
Source: CCleaner.exe | Static PE information: |
Binary contains paths to debug symbols | Show sources |
Source: | Binary string: |
PE file contains a valid data directory to section mapping | Show sources |
Source: CCleaner.exe | Static PE information: | ||
Source: CCleaner.exe | Static PE information: | ||
Source: CCleaner.exe | Static PE information: | ||
Source: CCleaner.exe | Static PE information: | ||
Source: CCleaner.exe | Static PE information: |
Classification label | Show sources |
Source: classification engine | Classification label: |
Contains functionality to adjust token privileges (e.g. debug / backup) | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | Code function: | 0_2_000E203A |
Creates files inside the user directory | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | File created: |
PE file has an executable .text section and no other executable section | Show sources |
Source: CCleaner.exe | Static PE information: |
Queries process information (via WMI, Win32_Process) | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | WMI Queries: |
Reads ini files | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | File read: |
Reads software policies | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | Key opened: |
SQL strings found in memory and binary data | Show sources |
Source: CCleaner.exe | Binary or memory string: | ||
Source: CCleaner.exe | Binary or memory string: | ||
Source: CCleaner.exe | Binary or memory string: | ||
Source: CCleaner.exe | Binary or memory string: | ||
Source: CCleaner.exe | Binary or memory string: | ||
Source: CCleaner.exe | Binary or memory string: |
Sample is known by Antivirus (Virustotal or Metascan) | Show sources |
Source: CCleaner.exe | Virustotal: |
Uses an in-process (OLE) Automation server | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | Key value queried: |
Creates mutexes | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | Mutant created: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Mutant created: |
PE file contains executable resources (Code or Archives) | Show sources |
Source: CCleaner.exe | Static PE information: | ||
Source: CCleaner.exe | Static PE information: | ||
Source: CCleaner.exe | Static PE information: |
PE file contains strange resources | Show sources |
Source: CCleaner.exe | Static PE information: | ||
Source: CCleaner.exe | Static PE information: | ||
Source: CCleaner.exe | Static PE information: | ||
Source: CCleaner.exe | Static PE information: | ||
Source: CCleaner.exe | Static PE information: | ||
Source: CCleaner.exe | Static PE information: | ||
Source: CCleaner.exe | Static PE information: | ||
Source: CCleaner.exe | Static PE information: |
Reads the hosts file | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | File read: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | File read: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | File read: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | File read: |
Sample file is different than original file name gathered from version info | Show sources |
Source: CCleaner.exe | Binary or memory string: | ||
Source: CCleaner.exe | Binary or memory string: | ||
Source: CCleaner.exe | Binary or memory string: | ||
Source: CCleaner.exe | Binary or memory string: | ||
Source: CCleaner.exe | Binary or memory string: | ||
Source: CCleaner.exe | Binary or memory string: | ||
Source: CCleaner.exe | Binary or memory string: | ||
Source: CCleaner.exe | Binary or memory string: | ||
Source: CCleaner.exe | Binary or memory string: | ||
Source: CCleaner.exe | Binary or memory string: | ||
Source: CCleaner.exe | Binary or memory string: |
Tries to load missing DLLs | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Section loaded: |
HIPS / PFW / Operating System Protection Evasion: |
---|
May try to detect the Windows Explorer process (often used for injection) | Show sources |
Source: CCleaner.exe | Binary or memory string: | ||
Source: CCleaner.exe | Binary or memory string: | ||
Source: CCleaner.exe | Binary or memory string: | ||
Source: CCleaner.exe | Binary or memory string: | ||
Source: CCleaner.exe | Binary or memory string: | ||
Source: CCleaner.exe | Binary or memory string: |
Anti Debugging: |
---|
Contains functionality to register its own exception handler | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | Code function: | 0_2_01284811 | |
Source: C:\Users\user\Desktop\CCleaner.exe | Code function: | 0_2_0128FCD8 |
Checks for debuggers (devices) | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | File opened: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | File opened: |
Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation)) | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | System information queried: |
Contains functionality to check if a debugger is running (IsDebuggerPresent) | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | Code function: | 0_2_0128FCD8 |
Contains functionality to dynamically determine API calls | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | Code function: | 0_2_000E1E2A |
Contains functionality to read the PEB | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | Code function: | 0_2_012A1699 |
Malware Analysis System Evasion: |
---|
Queries a list of all running processes | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | Process information queried: |
Enumerates the file system | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | File opened: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | File opened: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | File opened: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | File opened: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | File opened: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | File opened: |
May sleep (evasive loops) to hinder dynamic analysis | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe TID: 3696 | Thread sleep time: |
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines) | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | WMI Queries: |
Found evasive API chain checking for user administrative privileges | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | Check user administrative privileges: | graph_0-1489 |
Found evasive API chains implementing implicit delay functionality | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | Implicit delay: | graph_0-1534 | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Implicit delay: | graph_0-1534 |
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | WMI Queries: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | WMI Queries: |
Query firmware table information (likely to detect VMs) | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | System information queried: |
Hooking and other Techniques for Hiding and Protection: |
---|
Disables application error messsages (SetErrorMode) | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | Process information set: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Process information set: |
Lowering of HIPS / PFW / Operating System Security Settings: |
---|
AV process strings found (often used to terminate AV products) | Show sources |
Source: CCleaner.exe | Binary or memory string: | ||
Source: CCleaner.exe | Binary or memory string: |
Language, Device and Operating System Detection: |
---|
Contains functionality to query local / system time | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | Code function: | 0_2_0128556B |
Contains functionality to query windows version | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | Code function: | 0_2_000E1DCB |
Queries information about the installed CPU (vendor, model number etc) | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | Registry key value queried: |
Queries the installation date of Windows | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | Key value queried: |
Queries the volume information (name, serial number etc) of a device | Show sources |
Source: C:\Users\user\Desktop\CCleaner.exe | Queries volume information: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Queries volume information: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Queries volume information: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Queries volume information: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Queries volume information: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Queries volume information: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Queries volume information: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Queries volume information: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Queries volume information: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Queries volume information: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Queries volume information: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Queries volume information: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Queries volume information: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Queries volume information: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Queries volume information: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Queries volume information: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Queries volume information: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Queries volume information: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Queries volume information: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Queries volume information: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Queries volume information: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Queries volume information: | ||
Source: C:\Users\user\Desktop\CCleaner.exe | Queries volume information: |
Behavior Graph |
---|
Simulations |
---|
Behavior and APIs |
---|
Time | Type | Description |
---|---|---|
13:09:51 | API Interceptor | 257x Sleep call for process: CCleaner.exe modified from: 60000ms to: 500ms |
Antivirus Detection |
---|
Initial Sample |
---|
Source | Ratio | Cloud | Link |
---|---|---|---|
8/64 | virustotal | Browse |
Dropped Files |
---|
No Antivirus matches |
---|
Domains |
---|
Yara Overview |
---|
Initial Sample |
---|
No yara matches |
---|
PCAP (Network Traffic) |
---|
No yara matches |
---|
Dropped Files |
---|
No yara matches |
---|
Memory Dumps |
---|
No yara matches |
---|
Joe Sandbox View / Context |
---|
IPs |
---|
Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
---|
Domains |
---|
No context |
---|
ASN |
---|
Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
---|
Dropped Files |
---|
No context |
---|
Screenshot |
---|
Startup |
---|
|
Created / dropped Files |
---|
File Type: | |
MD5: | D6DDA253119D6EB44B3E75B842EA1F7B |
SHA1: | 1E16EA0864EB514D2B7D95732D13355C2F0170C7 |
SHA-256: | 939BF747896A65E194BEEF5DE19440195EE7011AC913119C4769D76FD2A49633 |
SHA-512: | FE1162E924F273DD7389339C148709A1A378CABB60BD6CA56014D918A6C680A66A8C0A77D04523519C14B30D458B9D1F6CB2A2FD7566CF3FEEDA1AA61434AC04 |
Malicious: | false |
File Type: | |
MD5: | 440FECA9AC94F23147C135C0A42FC2B8 |
SHA1: | 100E18BCF50EBA015139EEF1430384671675F0CC |
SHA-256: | B12702BDF9E6C4079A61B59BFFFB9DAB98158EF311413C5AE4119B9B0CBBE4FF |
SHA-512: | 0E8D74D547EC0356310EAB0ACC006AE1BFE9FF652A87DB10743ECE55E1F0241090DB15EE7C1B1A65A94EC32943EE4DD6BD8947E8C937972FBC490E7175B5B6B1 |
Malicious: | false |
File Type: | |
MD5: | 8DAEC6ACB93EF4EFC4ADAD82A7C52A53 |
SHA1: | 0B5F0BE5802F30FEC6D63DB41169695E5411D34D |
SHA-256: | 0C6EE58844B9C55C9280A0B1CF7ABE6FB4E9A25A27B643BD567F3DC77B1DA9BE |
SHA-512: | C200E8CB2A008BDCBECD1E459A550742C6249643751C1092B88CF03A2E7E19F43A3955607F8CB129BC0C95464CDBC39D62DE71C7183E8D16C5A38F78EC8D97F2 |
Malicious: | false |
File Type: | |
MD5: | AE779293FB50BB3A4F1B5BAAD6B169BF |
SHA1: | CC23694C1FC7968B066A5BBE0BF476BEEEC116DB |
SHA-256: | 3EEF8B8C0D839C57EB645FD23D69F9EAFCF5EA3725DA817FCDA8079FEF2AB70C |
SHA-512: | 9A9C08C623852D8BFCCE8C664B9DE20D69B30B6CFBE524EAF9BC9055D388B02E96829BE5346D231FAFFEEC1B7C7246B23765F9C37C49AAD97DBE6982E8DBEC4D |
Malicious: | false |
File Type: | |
MD5: | 4ACA4C7925AEEE3811270ADC068F1D94 |
SHA1: | 9B5F502C4F8FD9DDC7C3DC46C60E8295A5FD46CE |
SHA-256: | 07D064338089968431DCC1FE0E7731E9234B2E34CE5D41E86EA39E856779041C |
SHA-512: | 159D5FB689CF6AD99F8DC4BD62262552530AD57B273E54BEBC451D8CAB2F46206C56C898E8FB84AC4FEAC377B40F1E2CACE6DCD680BA515633B8C9F6AE860EC5 |
Malicious: | false |
File Type: | |
MD5: | CB3C33CB1B4C2F896E5E2AA679863353 |
SHA1: | E98F44FAC2F456400817C078317B5CF5ECC2DFB4 |
SHA-256: | 0CEA2F106C7FE143C88BC40965ECF4EF7B053069C324ACFD153B5F8E468596C3 |
SHA-512: | 16573FEE0ECF715F4BF4785EA2745EAFF6160CBE82A4EA159685B100D7A38855E5BEDE4B0F587D3629D61D74F2E16CC0E87CBBDD14EA404BED825D2B94E40B13 |
Malicious: | false |
File Type: | |
MD5: | D41D8CD98F00B204E9800998ECF8427E |
SHA1: | DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 |
SHA-256: | E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 |
SHA-512: | CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E |
Malicious: | false |
File Type: | |
MD5: | 815D2DACA17A524EEAB05509DFC864AC |
SHA1: | F0B211AB631D74F0735490B0A82921D586F02407 |
SHA-256: | C4314C6866333276BCAFE5B41A23C9426A9680A033BED7F3802502549824DB9C |
SHA-512: | C5152BE6FDCB3E93499BE4726B772359833240922E35798A050C92ECB3A26637E3A556A8386B776FE7E9DC58735846FF380BF65995EAD75AAA37422172622F65 |
Malicious: | false |
File Type: | |
MD5: | D41D8CD98F00B204E9800998ECF8427E |
SHA1: | DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 |
SHA-256: | E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 |
SHA-512: | CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E |
Malicious: | false |
File Type: | |
MD5: | 43D08676A4A805C10B226AF80778309E |
SHA1: | B6837783B1D1938F9A0E779EE595D984D94B1FD4 |
SHA-256: | D30F03CD91DB0B29C0CE564FB79A5EC33141ACFF0F21CA52564FE66ADE4056F1 |
SHA-512: | BB5D7D2FA8508A23ED92F8358B0D0F032B7DBA5662EFDAC06F402CAFED32DFEDB85F4BACBE24728168D3EBBC7E4E5DD21A35CF30BCCF9474E67BE0CDA2CA30A5 |
Malicious: | false |
File Type: | |
MD5: | EC08A88EE039E4960C2083389B442C41 |
SHA1: | 5DC1EE714864EA5ECA0D7298429D6C7B09BD55D3 |
SHA-256: | 07E0D7057ADF679019643C20114C443353B47DD87EABE17001E955C20601329E |
SHA-512: | 985313784FC6D4EB1471E5BF3C943F86F10FA1DC3DA27495B68AE85D039F064F1FF10202C7A02DC0764FF6F2104A1318C35959D9E47B3D296CB101D74CECEB6B |
Malicious: | false |
Contacted Domains/Contacted IPs |
---|
Contacted Domains |
---|
Name | IP | Active | Malicious | Antivirus Detection |
---|---|---|---|---|
license.piriform.com | 151.101.0.64 | true | false | 0/65, virustotal, Browse |
www.piriform.com | 151.101.0.64 | true | false | 0/64, virustotal, Browse |
Contacted IPs |
---|
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
IP | Country | Flag | ASN | ASN Name | Malicious |
---|---|---|---|---|---|
23.34.203.27 | United States | 577 | BellCanada | false | |
8.8.8.8 | United States | 15169 | GoogleInc | false | |
192.168.1.16 | unknown | unknown | unknown | false | |
23.34.197.163 | United States | 577 | BellCanada | false | |
151.101.0.64 | United States | 137 | GARRItalianacademicandresearchnetwork | false |
Static File Info |
---|
General | |
---|---|
File type: | |
TrID: |
|
File name: | CCleaner.exe |
File size: | 7680216 |
MD5: | ef694b89ad7addb9a16bb6f26f1efaf7 |
SHA1: | 8983a49172af96178458266f93d65fa193eaaef2 |
SHA256: | 6f7840c77f99049d788155c1351e1560b62b8ad18ad0e9adda8218b9f432f0a9 |
SHA512: | 73b55632babc25a1194cf2df91a0480f35960a407c676024b095c408906fc747bb0aac8b62354f426a0e733c9877b1b3638cfd860c9803979b07994ff938235e |
File Content Preview: | MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$...........B..PB..PB..P../PT..P..-P...P..,Pb..Py..QX..PY.tPC..P...QK..Py..Qg..P...QF..Py..Q...PK.]PL..PK.ZP@..PK.MPY..PB..P...P...Q/.. |
File Icon |
---|
Static PE Info |
---|
General | |
---|---|
Entrypoint: | 0x4d4dfd |
Entrypoint Section: | .text |
Digitally signed: | true |
Imagebase: | 0x400000 |
Subsystem: | windows gui |
Image File Characteristics: | 32BIT_MACHINE, EXECUTABLE_IMAGE |
DLL Characteristics: | TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT |
Time Stamp: | 0x5982EBF9 [Thu Aug 03 09:25:13 2017 UTC] |
TLS Callbacks: | 0x4d12d0 |
CLR (.Net) Version: | |
OS Version Major: | 5 |
OS Version Minor: | 1 |
File Version Major: | 5 |
File Version Minor: | 1 |
Subsystem Version Major: | 5 |
Subsystem Version Minor: | 1 |
Import Hash: | 0a2846d08c140716112b3f476b4f75f8 |
Authenticode Signature |
---|
Signature Valid: | true |
Signature Issuer: | CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US |
Signature Validation Error: | The operation completed successfully |
Error Number: | 0 |
Not Before, Not After |
|
Subject Chain |
|
Version: | 3 |
Thumbprint: | F4BDA9EFA31EF4A8FA3B6BB0BE13862D7B8ED9B0 |
Serial: | 4B48B27C8224FE37B17A6A2ED7A81C9F |
Entrypoint Preview |
---|
Instruction |
---|
call 10CD243Eh |
jmp 10CD1B63h |
push 00888E80h |
call dword ptr [00736410h] |
ret |
mov ecx, dword ptr [ebp-0Ch] |
mov dword ptr fs:[00000000h], ecx |
pop ecx |
pop edi |
pop edi |
pop esi |
pop ebx |
mov esp, ebp |
pop ebp |
push ecx |
ret |
mov ecx, dword ptr [ebp-10h] |
xor ecx, ebp |
call 10CD119Fh |
jmp 10CD1CB0h |
mov ecx, dword ptr [ebp-14h] |
xor ecx, ebp |
call 10CD118Eh |
jmp 10CD1C9Fh |
push eax |
push dword ptr fs:[00000000h] |
lea eax, dword ptr [esp+0Ch] |
sub esp, dword ptr [esp+0Ch] |
push ebx |
push esi |
push edi |
mov dword ptr [eax], ebp |
mov ebp, eax |
mov eax, dword ptr [0082E088h] |
xor eax, ebp |
push eax |
push dword ptr [ebp-04h] |
mov dword ptr [ebp-04h], FFFFFFFFh |
lea eax, dword ptr [ebp-0Ch] |
mov dword ptr fs:[00000000h], eax |
ret |
push eax |
push dword ptr fs:[00000000h] |
lea eax, dword ptr [esp+0Ch] |
sub esp, dword ptr [esp+0Ch] |
push ebx |
push esi |
push edi |
mov dword ptr [eax], ebp |
mov ebp, eax |
mov eax, dword ptr [0082E088h] |
xor eax, ebp |
push eax |
mov dword ptr [ebp-10h], eax |
push dword ptr [ebp-04h] |
mov dword ptr [ebp-04h], FFFFFFFFh |
lea eax, dword ptr [ebp-0Ch] |
mov dword ptr fs:[00000000h], eax |
ret |
push eax |
push dword ptr fs:[00000000h] |
Data Directories |
---|
Name | Virtual Address | Virtual Size | Is in Section |
---|---|---|---|
IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_IMPORT | 0x429b38 | 0x104 | .rdata |
IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x691000 | 0x288188 | .rsrc |
IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_SECURITY | 0x74fe00 | 0x32d8 | .rsrc |
IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x91a000 | 0x3f72c | .reloc |
IMAGE_DIRECTORY_ENTRY_DEBUG | 0x3a1350 | 0x54 | .rdata |
IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_TLS | 0x3a13a4 | 0x18 | .rdata |
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x33aae0 | 0x40 | .rdata |
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_IAT | 0x336000 | 0xa68 | .rdata |
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x4291d4 | 0x160 | .rdata |
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
Sections |
---|
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Xored PE | ZLIB Complexity | File Type | Characteristics |
---|---|---|---|---|---|---|---|---|
.text | 0x1000 | 0x334d01 | 0x334e00 | unknown | unknown | unknown | unknown | IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ |
.rdata | 0x336000 | 0xf7526 | 0xf7600 | False | 0.27573703575 | ump; data | 4.55320749929 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
.data | 0x42e000 | 0x25f4cc | 0x5a800 | unknown | unknown | unknown | unknown | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ |
.gfids | 0x68e000 | 0x11d4 | 0x1200 | False | 0.384982638889 | ump; ACB archive data | 4.11345994361 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
.tls | 0x690000 | 0x9 | 0x200 | False | 0.033203125 | ump; data | 0.0203931352361 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ |
.rsrc | 0x691000 | 0x288188 | 0x288200 | unknown | unknown | unknown | unknown | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
.reloc | 0x91a000 | 0x3f72c | 0x3f800 | False | 0.472617802657 | ump; data | 6.53156734598 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
Resources |
---|
Name | RVA | Size | Type | Language | Country |
---|---|---|---|---|---|
AFX_DIALOG_LAYOUT | 0x7c56e8 | 0x2 | ump; data | English | Great Britain |
AFX_DIALOG_LAYOUT | 0x7c56f0 | 0x2 | ump; data | English | Great Britain |
AFX_DIALOG_LAYOUT | 0x7c56f8 | 0x2 | ump; data | English | Great Britain |
AFX_DIALOG_LAYOUT | 0x7c5708 | 0x2 | ump; data | English | Great Britain |
AFX_DIALOG_LAYOUT | 0x7c5700 | 0x2 | ump; data | English | Great Britain |
AFX_DIALOG_LAYOUT | 0x7c5740 | 0x2 | ump; data | English | Great Britain |
AFX_DIALOG_LAYOUT | 0x7c5710 | 0x2 | ump; data | English | Great Britain |
AFX_DIALOG_LAYOUT | 0x7c5718 | 0x2 | ump; data | English | Great Britain |
AFX_DIALOG_LAYOUT | 0x7c5720 | 0x2 | ump; data | English | Great Britain |
AFX_DIALOG_LAYOUT | 0x7c5730 | 0x2 | ump; data | English | Great Britain |
AFX_DIALOG_LAYOUT | 0x7c5728 | 0x2 | ump; data | English | Great Britain |
AFX_DIALOG_LAYOUT | 0x7c5738 | 0x2 | ump; data | English | Great Britain |
AFX_DIALOG_LAYOUT | 0x69fde0 | 0x2 | ump; data | English | Great Britain |
AFX_DIALOG_LAYOUT | 0x69fde8 | 0x2 | ump; data | English | Great Britain |
AFX_DIALOG_LAYOUT | 0x69fdf0 | 0x2 | ump; data | English | Great Britain |
AFX_DIALOG_LAYOUT | 0x69fdf8 | 0x2 | ump; data | English | Great Britain |
AFX_DIALOG_LAYOUT | 0x69fe00 | 0x2 | ump; data | English | Great Britain |
BRANDING | 0x7d8458 | 0xd4d8 | ump; PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit | English | Great Britain |
INI | 0x6a0510 | 0x47fc | ump; ISO-8859 English text, with CRLF line terminators | English | United States |
INI | 0x69fe08 | 0x701 | ump; ISO-8859 English text, with CRLF line terminators | English | United States |
INI | 0x6a4d10 | 0x2cfe5 | ump; ISO-8859 English text, with CRLF, LF line terminators | English | United States |
PNG | 0x840c50 | 0x18f | ump; PNG image, 19 x 18, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x840de0 | 0x238 | ump; PNG image, 19 x 18, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x841018 | 0x5059 | ump; PNG image, 205 x 45, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8602d8 | 0x219 | ump; PNG image, 19 x 18, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8604f8 | 0x258 | ump; PNG image, 19 x 18, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x884888 | 0x203 | ump; PNG image, 40 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8858d0 | 0x358 | ump; PNG image, 40 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x887490 | 0x153 | ump; PNG image, 40 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x888078 | 0x34a | ump; PNG image, 40 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x889c08 | 0x2c6 | ump; PNG image, 40 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8900a8 | 0x114e | ump; PNG image, 49 x 46, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8911f8 | 0x18a8 | ump; PNG image, 61 x 57, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x892aa0 | 0x1e62 | ump; PNG image, 73 x 69, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x894908 | 0x30a5 | ump; PNG image, 98 x 92, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8979b0 | 0x475d | ump; PNG image, 122 x 115, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x87c800 | 0x6328 | ump; PNG image, 206 x 48, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x882b28 | 0x608 | ump; PNG image, 60 x 60, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x883130 | 0x801 | ump; PNG image, 60 x 60, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x883938 | 0x782 | ump; PNG image, 60 x 60, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8840c0 | 0x7c3 | ump; PNG image, 60 x 60, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x860750 | 0x3f16 | ump; PNG image, 490 x 270, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x864668 | 0x7b96 | ump; PNG image, 205 x 257, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8cacd8 | 0x27fe | ump; PNG image, 768 x 64, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d0990 | 0x13d | ump; PNG image, 16 x 16, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d0ad0 | 0x167 | ump; PNG image, 20 x 20, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d0c38 | 0x182 | ump; PNG image, 24 x 24, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d0dc0 | 0x197 | ump; PNG image, 32 x 32, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d0f58 | 0x213 | ump; PNG image, 40 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x885c28 | 0x41d | ump; PNG image, 50 x 50, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x886048 | 0x4fb | ump; PNG image, 60 x 60, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x886548 | 0x6b0 | ump; PNG image, 80 x 80, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x886bf8 | 0x896 | ump; PNG image, 100 x 100, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8875e8 | 0x21e | ump; PNG image, 50 x 50, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x887808 | 0x253 | ump; PNG image, 60 x 60, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x887a60 | 0x275 | ump; PNG image, 80 x 80, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x887cd8 | 0x39e | ump; PNG image, 100 x 100, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x884a90 | 0x286 | ump; PNG image, 50 x 50, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x884d18 | 0x2ef | ump; PNG image, 60 x 60, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x885008 | 0x3ee | ump; PNG image, 80 x 80, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8853f8 | 0x4d2 | ump; PNG image, 100 x 100, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8883c8 | 0x410 | ump; PNG image, 50 x 50, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8887d8 | 0x51c | ump; PNG image, 60 x 60, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x888cf8 | 0x6d1 | ump; PNG image, 80 x 80, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8893d0 | 0x832 | ump; PNG image, 100 x 100, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x889ed0 | 0x3a9 | ump; PNG image, 50 x 50, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88a280 | 0x43d | ump; PNG image, 60 x 60, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88a6c0 | 0x5bb | ump; PNG image, 80 x 80, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88ac80 | 0x71c | ump; PNG image, 100 x 100, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d3ed8 | 0x1f4 | ump; PNG image, 18 x 18, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d40d0 | 0x266 | ump; PNG image, 23 x 23, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d4338 | 0x2c9 | ump; PNG image, 28 x 28, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d4608 | 0x386 | ump; PNG image, 37 x 37, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d4990 | 0x470 | ump; PNG image, 46 x 46, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88b3a0 | 0x10d | ump; PNG image, 40 x 32, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88b4b0 | 0x1ef | ump; PNG image, 50 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88b6a0 | 0x1ba | ump; PNG image, 60 x 48, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88b860 | 0x165 | ump; PNG image, 80 x 64, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88b9c8 | 0x20b | ump; PNG image, 100 x 80, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88bbd8 | 0x10d | ump; PNG image, 40 x 32, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88bce8 | 0x1e0 | ump; PNG image, 50 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88bec8 | 0x17d | ump; PNG image, 60 x 48, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88c048 | 0x165 | ump; PNG image, 80 x 64, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88c1b0 | 0x20e | ump; PNG image, 100 x 80, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88c3c0 | 0xf3 | ump; PNG image, 40 x 32, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88c4b8 | 0xfa | ump; PNG image, 50 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88c5b8 | 0x119 | ump; PNG image, 60 x 48, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88c6d8 | 0x14b | ump; PNG image, 80 x 64, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88c828 | 0x17e | ump; PNG image, 100 x 80, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88c9a8 | 0xef | ump; PNG image, 40 x 32, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88ca98 | 0xfe | ump; PNG image, 50 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88cb98 | 0x11a | ump; PNG image, 60 x 48, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88ccb8 | 0x14f | ump; PNG image, 80 x 64, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88ce08 | 0x181 | ump; PNG image, 100 x 80, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88cf90 | 0x105 | ump; PNG image, 40 x 32, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88d098 | 0x115 | ump; PNG image, 50 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88d1b0 | 0x122 | ump; PNG image, 60 x 48, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88d2d8 | 0x16c | ump; PNG image, 80 x 64, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88d448 | 0x1a1 | ump; PNG image, 100 x 80, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88d5f0 | 0x103 | ump; PNG image, 40 x 32, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88d6f8 | 0x118 | ump; PNG image, 50 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88d810 | 0x126 | ump; PNG image, 60 x 48, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88d938 | 0x16f | ump; PNG image, 80 x 64, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88daa8 | 0x1a5 | ump; PNG image, 100 x 80, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88dc50 | 0xde | ump; PNG image, 40 x 32, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88dd30 | 0xe9 | ump; PNG image, 50 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88de20 | 0xf0 | ump; PNG image, 60 x 48, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88df10 | 0x138 | ump; PNG image, 80 x 64, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88e048 | 0x16a | ump; PNG image, 100 x 80, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88e1b8 | 0xdc | ump; PNG image, 40 x 32, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88e298 | 0xe8 | ump; PNG image, 50 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88e380 | 0xf2 | ump; PNG image, 60 x 48, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88e478 | 0x13d | ump; PNG image, 80 x 64, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88e5b8 | 0x16f | ump; PNG image, 100 x 80, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d1ef0 | 0x1b7 | ump; PNG image, 16 x 16, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d20a8 | 0x21c | ump; PNG image, 20 x 20, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d22c8 | 0x279 | ump; PNG image, 24 x 24, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d2548 | 0x310 | ump; PNG image, 32 x 32, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d2858 | 0x3bc | ump; PNG image, 40 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x89d690 | 0x386 | ump; PNG image, 16 x 16, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x89da18 | 0x4c2 | ump; PNG image, 20 x 20, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x89dee0 | 0x665 | ump; PNG image, 24 x 24, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x89e548 | 0x998 | ump; PNG image, 32 x 32, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x89eee0 | 0xd0f | ump; PNG image, 40 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8cd4d8 | 0x2b0 | ump; PNG image, 32 x 16, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8cd788 | 0x3c5 | ump; PNG image, 42 x 21, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8cdb50 | 0x4a3 | ump; PNG image, 52 x 26, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8cdff8 | 0x5d7 | ump; PNG image, 63 x 31, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8ce5d0 | 0x715 | ump; PNG image, 84 x 42, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8bbc78 | 0x5e2 | ump; PNG image, 40 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8bc260 | 0x6f5 | ump; PNG image, 50 x 50, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8bc958 | 0x7cb | ump; PNG image, 60 x 60, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8bd128 | 0xa5f | ump; PNG image, 80 x 80, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8bdb88 | 0xcfa | ump; PNG image, 100 x 100, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8be888 | 0x7c6 | ump; PNG image, 40 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8bf050 | 0x7a2 | ump; PNG image, 50 x 50, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8bf7f8 | 0xa9e | ump; PNG image, 60 x 60, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8c0298 | 0x11ec | ump; PNG image, 80 x 80, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8c1488 | 0x176e | ump; PNG image, 100 x 100, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8c2bf8 | 0x823 | ump; PNG image, 40 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8c3420 | 0xa2c | ump; PNG image, 50 x 50, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8c3e50 | 0xc07 | ump; PNG image, 60 x 60, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8c4a58 | 0x102f | ump; PNG image, 80 x 80, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8c5a88 | 0x125f | ump; PNG image, 100 x 100, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8c6ce8 | 0x6b6 | ump; PNG image, 40 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8c73a0 | 0x8b7 | ump; PNG image, 50 x 50, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8c7c58 | 0xafc | ump; PNG image, 60 x 60, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8c8758 | 0x110e | ump; PNG image, 80 x 80, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8c9868 | 0x146a | ump; PNG image, 100 x 100, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8ba958 | 0x109 | ump; PNG image, 16 x 16, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8baa68 | 0x464 | ump; PNG image, 20 x 20, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8baed0 | 0x462 | ump; PNG image, 24 x 24, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8bb338 | 0x479 | ump; PNG image, 32 x 32, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8bb7b8 | 0x4b9 | ump; PNG image, 40 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x830388 | 0x6dc | ump; PNG image, 24 x 23, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x830a68 | 0x939 | ump; PNG image, 30 x 29, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8313a8 | 0xb1f | ump; PNG image, 36 x 34, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x831ec8 | 0x1151 | ump; PNG image, 48 x 46, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x833020 | 0x17be | ump; PNG image, 60 x 57, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x83fe88 | 0x7a9 | ump; PNG image, 68 x 22, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x840638 | 0x122 | ump; PNG image, 9 x 8, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x840760 | 0x103 | ump; PNG image, 9 x 8, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x840868 | 0x146 | ump; PNG image, 14 x 14, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8409b0 | 0x134 | ump; PNG image, 14 x 14, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x840ae8 | 0x164 | ump; PNG image, 14 x 14, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8b9c58 | 0x1c6 | ump; PNG image, 16 x 16, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8b9e20 | 0x21d | ump; PNG image, 20 x 20, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8ba040 | 0x26f | ump; PNG image, 24 x 24, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8ba2b0 | 0x2f4 | ump; PNG image, 32 x 32, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8ba5a8 | 0x3ad | ump; PNG image, 40 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x7e5930 | 0x1524 | ump; PNG image, 64 x 60, 8-bit/color RGB, non-interlaced | English | Great Britain |
PNG | 0x7e6e58 | 0x1d78 | ump; PNG image, 80 x 75, 8-bit/color RGB, non-interlaced | English | Great Britain |
PNG | 0x7e8bd0 | 0x27c8 | ump; PNG image, 96 x 90, 8-bit/color RGB, non-interlaced | English | Great Britain |
PNG | 0x7eb398 | 0x3a7a | ump; PNG image, 128 x 120, 8-bit/color RGB, non-interlaced | English | Great Britain |
PNG | 0x7eee18 | 0x51f4 | ump; PNG image, 160 x 150, 8-bit/color RGB, non-interlaced | English | Great Britain |
PNG | 0x7f4010 | 0x3946 | ump; PNG image, 120 x 113, 8-bit/color RGB, non-interlaced | English | Great Britain |
PNG | 0x7f7958 | 0x4aad | ump; PNG image, 150 x 141, 8-bit/color RGB, non-interlaced | English | Great Britain |
PNG | 0x7fc408 | 0x6301 | ump; PNG image, 180 x 169, 8-bit/color RGB, non-interlaced | English | Great Britain |
PNG | 0x802710 | 0xaa7b | ump; PNG image, 240 x 226, 8-bit/color RGB, non-interlaced | English | Great Britain |
PNG | 0x80d190 | 0xcc64 | ump; PNG image, 300 x 282, 8-bit/color RGB, non-interlaced | English | Great Britain |
PNG | 0x8347e0 | 0x107f | ump; PNG image, 48 x 48, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x835860 | 0x157d | ump; PNG image, 60 x 60, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x836de0 | 0x1dc2 | ump; PNG image, 72 x 72, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x838ba8 | 0x2fac | ump; PNG image, 96 x 96, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x83bb58 | 0x432c | ump; PNG image, 120 x 120, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88e728 | 0x102 | ump; PNG image, 40 x 32, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88e830 | 0x1b6 | ump; PNG image, 50 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88e9e8 | 0x16c | ump; PNG image, 60 x 48, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88eb58 | 0x170 | ump; PNG image, 80 x 64, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88ecc8 | 0x201 | ump; PNG image, 100 x 80, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88eed0 | 0xf6 | ump; PNG image, 40 x 32, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88efc8 | 0xff | ump; PNG image, 50 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88f0c8 | 0x118 | ump; PNG image, 60 x 48, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88f1e0 | 0x14f | ump; PNG image, 80 x 64, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88f330 | 0x182 | ump; PNG image, 100 x 80, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88f4b8 | 0xdd | ump; PNG image, 40 x 32, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88f598 | 0xe9 | ump; PNG image, 50 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88f688 | 0xf3 | ump; PNG image, 60 x 48, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88f780 | 0x13e | ump; PNG image, 80 x 64, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88f8c0 | 0x16f | ump; PNG image, 100 x 80, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88fa30 | 0x112 | ump; PNG image, 40 x 32, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88fb48 | 0x119 | ump; PNG image, 50 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88fc68 | 0x127 | ump; PNG image, 60 x 48, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88fd90 | 0x170 | ump; PNG image, 80 x 64, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x88ff00 | 0x1a6 | ump; PNG image, 100 x 80, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x89fbf0 | 0xc6 | ump; PNG image, 9 x 8, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x89fcb8 | 0xfd | ump; PNG image, 11 x 10, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x89fdb8 | 0x121 | ump; PNG image, 13 x 12, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x89fee0 | 0xed | ump; PNG image, 18 x 16, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x89ffd0 | 0x115 | ump; PNG image, 22 x 20, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8a00e8 | 0xc5 | ump; PNG image, 9 x 8, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8a01b0 | 0xfa | ump; PNG image, 11 x 10, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8a02b0 | 0xdd | ump; PNG image, 13 x 12, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8a0390 | 0x14a | ump; PNG image, 18 x 16, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8a04e0 | 0x128 | ump; PNG image, 22 x 20, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8a0608 | 0xc0 | ump; PNG image, 8 x 9, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8a06c8 | 0xcb | ump; PNG image, 10 x 11, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8a0798 | 0x116 | ump; PNG image, 12 x 13, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8a08b0 | 0xeb | ump; PNG image, 16 x 18, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8a09a0 | 0x11b | ump; PNG image, 20 x 22, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8a0ac0 | 0xbe | ump; PNG image, 8 x 9, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8a0b80 | 0xd0 | ump; PNG image, 10 x 11, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8a0c50 | 0xdc | ump; PNG image, 12 x 13, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8a0d30 | 0xe8 | ump; PNG image, 16 x 18, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8a0e18 | 0xff | ump; PNG image, 20 x 22, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8a0f18 | 0xbc | ump; PNG image, 8 x 9, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8a0fd8 | 0xcb | ump; PNG image, 10 x 11, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8a10a8 | 0x112 | ump; PNG image, 12 x 13, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8a11c0 | 0xef | ump; PNG image, 16 x 18, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8a12b0 | 0x119 | ump; PNG image, 20 x 22, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8a13d0 | 0xbf | ump; PNG image, 8 x 9, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8a1490 | 0xcf | ump; PNG image, 10 x 11, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8a1560 | 0xde | ump; PNG image, 12 x 13, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8a1640 | 0xec | ump; PNG image, 16 x 18, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8a1730 | 0xfa | ump; PNG image, 20 x 22, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8a1830 | 0xbe | ump; PNG image, 9 x 8, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8a18f0 | 0xc8 | ump; PNG image, 11 x 10, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8a19b8 | 0xbda3 | ump; PNG image, 13 x 12, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8ad760 | 0xe8 | ump; PNG image, 18 x 16, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8ad848 | 0x109 | ump; PNG image, 22 x 20, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8ad958 | 0xce | ump; PNG image, 9 x 8, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8ada28 | 0xca | ump; PNG image, 11 x 10, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8adaf8 | 0xf6 | ump; PNG image, 13 x 12, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8adbf0 | 0xee | ump; PNG image, 18 x 16, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8adce0 | 0xbf71 | ump; PNG image, 22 x 20, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d1170 | 0x12d | ump; PNG image, 16 x 16, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d12a0 | 0x13a | ump; PNG image, 20 x 20, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d13e0 | 0x161 | ump; PNG image, 24 x 24, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d1548 | 0x18a | ump; PNG image, 32 x 32, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d16d8 | 0x1ca | ump; PNG image, 40 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d18a8 | 0xff | ump; PNG image, 16 x 16, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d19a8 | 0x11b | ump; PNG image, 20 x 20, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d1ac8 | 0x135 | ump; PNG image, 24 x 24, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d1c00 | 0x160 | ump; PNG image, 32 x 32, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d1d60 | 0x18c | ump; PNG image, 40 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d5a20 | 0xf6 | ump; PNG image, 40 x 32, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d5b18 | 0xcd | ump; PNG image, 40 x 32, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d5be8 | 0x10c | ump; PNG image, 40 x 32, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d5cf8 | 0x240 | ump; PNG image, 50 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x86c200 | 0x27d | ump; PNG image, 26 x 21, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d6b68 | 0x39c | ump; PNG image, 40 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d6f08 | 0x717 | ump; PNG image, 50 x 50, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d7620 | 0x7e5 | ump; PNG image, 60 x 60, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d7e08 | 0x937 | ump; PNG image, 80 x 80, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d8740 | 0xa5e | ump; PNG image, 100 x 100, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d91a0 | 0x4a5 | ump; PNG image, 40 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d9648 | 0x7f5 | ump; PNG image, 50 x 50, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d9e40 | 0x8f0 | ump; PNG image, 60 x 60, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8da730 | 0xabf | ump; PNG image, 80 x 80, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8db1f0 | 0xcb7 | ump; PNG image, 100 x 100, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8dbea8 | 0x438 | ump; PNG image, 40 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8dc2e0 | 0x7af | ump; PNG image, 50 x 50, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8dca90 | 0x87f | ump; PNG image, 60 x 60, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8dd310 | 0xa53 | ump; PNG image, 80 x 80, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8ddd68 | 0xc5f | ump; PNG image, 100 x 100, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8de9c8 | 0x796 | ump; PNG image, 40 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8df160 | 0xbee | ump; PNG image, 50 x 50, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8dfd50 | 0xda8 | ump; PNG image, 60 x 60, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8e0af8 | 0x114b | ump; PNG image, 80 x 80, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8e1c48 | 0x14d6 | ump; PNG image, 100 x 100, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8e3120 | 0x7fa | ump; PNG image, 50 x 50, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8e3920 | 0x8e2 | ump; PNG image, 62 x 62, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8e4208 | 0xa08 | ump; PNG image, 75 x 75, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8e4c10 | 0xc4f | ump; PNG image, 100 x 100, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8e5860 | 0xf37 | ump; PNG image, 125 x 125, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8cece8 | 0x325 | ump; PNG image, 32 x 16, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8cf010 | 0x472 | ump; PNG image, 42 x 21, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8cf488 | 0x55f | ump; PNG image, 52 x 26, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8cf9e8 | 0x6ae | ump; PNG image, 63 x 31, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d0098 | 0x8f3 | ump; PNG image, 84 x 42, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x819df8 | 0x1a01 | ump; PNG image, 73 x 66, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x81b800 | 0x26c0 | ump; PNG image, 91 x 83, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x81dec0 | 0x32ef | ump; PNG image, 110 x 99, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8211b0 | 0x47e5 | ump; PNG image, 146 x 132, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x825998 | 0x6c67 | ump; PNG image, 183 x 165, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d5f38 | 0xf4 | ump; PNG image, 10 x 10, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d6030 | 0x119 | ump; PNG image, 13 x 13, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d6150 | 0x124 | ump; PNG image, 15 x 15, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d6278 | 0x152 | ump; PNG image, 20 x 20, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d63d0 | 0x176 | ump; PNG image, 25 x 25, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d6548 | 0xf7 | ump; PNG image, 10 x 10, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d6640 | 0x11e | ump; PNG image, 13 x 13, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d6760 | 0x12f | ump; PNG image, 15 x 15, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d6890 | 0x151 | ump; PNG image, 20 x 20, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d69e8 | 0x17e | ump; PNG image, 25 x 25, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x846078 | 0x2b6c | ump; PNG image, 214 x 57, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x848be8 | 0x3956 | ump; PNG image, 268 x 71, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x84c540 | 0x4745 | ump; PNG image, 321 x 86, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x850c88 | 0x66af | ump; PNG image, 428 x 114, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x857338 | 0x8fa0 | ump; PNG image, 535 x 143, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8e6798 | 0x19c | ump; PNG image, 16 x 16, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8e6938 | 0x228 | ump; PNG image, 20 x 20, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8e6b60 | 0x24d | ump; PNG image, 24 x 24, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8e6db0 | 0x2c4 | ump; PNG image, 32 x 32, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8e7078 | 0x376 | ump; PNG image, 40 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8e73f0 | 0x902 | ump; PNG image, 74 x 74, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8e7cf8 | 0xdc6 | ump; PNG image, 93 x 93, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8e8ac0 | 0xf45 | ump; PNG image, 111 x 111, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8e9a08 | 0x1358 | ump; PNG image, 148 x 148, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8ead60 | 0x19e1 | ump; PNG image, 185 x 185, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8ec748 | 0x932 | ump; PNG image, 74 x 74, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8ed080 | 0xdb4 | ump; PNG image, 93 x 93, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8ede38 | 0xef9 | ump; PNG image, 111 x 111, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8eed38 | 0x13b3 | ump; PNG image, 148 x 148, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8f00f0 | 0x1948 | ump; PNG image, 185 x 185, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8f1a38 | 0x862 | ump; PNG image, 74 x 74, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8f22a0 | 0xcac | ump; PNG image, 93 x 93, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8f2f50 | 0xd74 | ump; PNG image, 111 x 111, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8f3cc8 | 0x1204 | ump; PNG image, 148 x 148, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8f4ed0 | 0x1702 | ump; PNG image, 185 x 185, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8f65d8 | 0xaf4 | ump; PNG image, 74 x 74, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8f70d0 | 0xfba | ump; PNG image, 93 x 93, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8f8090 | 0x11a2 | ump; PNG image, 111 x 111, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8f9238 | 0x17d0 | ump; PNG image, 148 x 148, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8faa08 | 0x1e5e | ump; PNG image, 185 x 185, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8fc868 | 0x908 | ump; PNG image, 74 x 74, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8fd170 | 0xdb7 | ump; PNG image, 93 x 93, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8fdf28 | 0x1027 | ump; PNG image, 111 x 111, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8fef50 | 0x14ed | ump; PNG image, 148 x 148, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x900440 | 0x1bae | ump; PNG image, 185 x 185, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x901ff0 | 0x96e | ump; PNG image, 74 x 74, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x902960 | 0xe36 | ump; PNG image, 93 x 93, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x903798 | 0x10ae | ump; PNG image, 111 x 111, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x904848 | 0x1615 | ump; PNG image, 148 x 148, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x905e60 | 0x1d12 | ump; PNG image, 185 x 185, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x907b78 | 0x99e | ump; PNG image, 74 x 74, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x908518 | 0xe83 | ump; PNG image, 93 x 93, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x9093a0 | 0xfb9 | ump; PNG image, 111 x 111, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x90a360 | 0x1507 | ump; PNG image, 148 x 148, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x90b868 | 0x1ab5 | ump; PNG image, 185 x 185, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x90d320 | 0x945 | ump; PNG image, 74 x 74, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x90dc68 | 0xdb2 | ump; PNG image, 93 x 93, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x90ea20 | 0xf25 | ump; PNG image, 111 x 111, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x90f948 | 0x13c9 | ump; PNG image, 148 x 148, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x910d18 | 0x193b | ump; PNG image, 185 x 185, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x86c480 | 0x77d | ump; PNG image, 50 x 50, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x86cc00 | 0xc2b | ump; PNG image, 63 x 63, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x86d830 | 0xc36 | ump; PNG image, 75 x 75, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x86e468 | 0x108b | ump; PNG image, 100 x 100, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x86f4f8 | 0x17ba | ump; PNG image, 125 x 125, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x870cb8 | 0x4df | ump; PNG image, 50 x 50, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x871198 | 0x80c | ump; PNG image, 63 x 63, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8719a8 | 0x78c | ump; PNG image, 75 x 75, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x872138 | 0xa87 | ump; PNG image, 100 x 100, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x872bc0 | 0xe76 | ump; PNG image, 125 x 125, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x873a38 | 0x69a | ump; PNG image, 50 x 50, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8740d8 | 0xa0c | ump; PNG image, 63 x 63, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x874ae8 | 0xa0b | ump; PNG image, 75 x 75, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8754f8 | 0xdd4 | ump; PNG image, 100 x 100, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8762d0 | 0x12fd | ump; PNG image, 125 x 125, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8775d0 | 0x8dc | ump; PNG image, 50 x 50, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x877eb0 | 0xdbb | ump; PNG image, 63 x 63, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x878c70 | 0xd9c | ump; PNG image, 75 x 75, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x879a10 | 0x13c3 | ump; PNG image, 100 x 100, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x87add8 | 0x1a21 | ump; PNG image, 125 x 125, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d2c18 | 0xaa | ump; PNG image, 10 x 11, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d2cc8 | 0xf3 | ump; PNG image, 13 x 14, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d2dc0 | 0xef | ump; PNG image, 15 x 17, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d2eb0 | 0xfa | ump; PNG image, 20 x 22, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d2fb0 | 0x140 | ump; PNG image, 25 x 28, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x912658 | 0x24d | ump; PNG image, 20 x 20, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x9128a8 | 0x293 | ump; PNG image, 25 x 25, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x912b40 | 0x330 | ump; PNG image, 30 x 30, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x912e70 | 0x4bf | ump; PNG image, 40 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x913330 | 0x6a8 | ump; PNG image, 50 x 50, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d30f0 | 0x1a4 | ump; PNG image, 20 x 20, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d3298 | 0x236 | ump; PNG image, 25 x 25, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d34d0 | 0x263 | ump; PNG image, 30 x 30, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d3738 | 0x33b | ump; PNG image, 40 x 40, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d3a78 | 0x45d | ump; PNG image, 50 x 50, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x9139d8 | 0x8ec | ump; PNG image, 62 x 62, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x9142c8 | 0xcec | ump; PNG image, 78 x 78, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x914fb8 | 0xd9d | ump; PNG image, 93 x 93, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x915d58 | 0x1387 | ump; PNG image, 124 x 124, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x9170e0 | 0x1847 | ump; PNG image, 155 x 155, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d4e00 | 0xd4 | ump; PNG image, 10 x 10, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d4ed8 | 0xfb | ump; PNG image, 13 x 13, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d4fd8 | 0x11f | ump; PNG image, 15 x 15, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d50f8 | 0x137 | ump; PNG image, 20 x 20, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d5230 | 0x161 | ump; PNG image, 25 x 25, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d5398 | 0x107 | ump; PNG image, 10 x 10, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d54a0 | 0x122 | ump; PNG image, 13 x 13, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d55c8 | 0x148 | ump; PNG image, 15 x 15, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d5710 | 0x16b | ump; PNG image, 20 x 20, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x8d5880 | 0x19a | ump; PNG image, 25 x 25, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x89c110 | 0x9ba | ump; PNG image, 37 x 47, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x82c600 | 0x34d | ump; PNG image, 126 x 14, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x82c950 | 0xa99 | ump; PNG image, 157 x 17, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x82d3f0 | 0xc30 | ump; PNG image, 189 x 21, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x82e020 | 0xe60 | ump; PNG image, 252 x 28, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x82ee80 | 0x1506 | ump; PNG image, 315 x 35, 8-bit/color RGBA, non-interlaced | English | Great Britain |
PNG | 0x89cad0 | 0xbbe | ump; PNG image, 37 x 47, 8-bit/color RGBA, non-interlaced | English | Great Britain |
RT_BITMAP | 0x6dd8c8 | 0x6804 | ump; data | English | Great Britain |
RT_BITMAP | 0x7658e0 | 0x5c28 | ump; data | English | Great Britain |
RT_BITMAP | 0x76b508 | 0x8fe8 | ump; data | English | Great Britain |
RT_BITMAP | 0x7744f0 | 0xcf28 | ump; data | English | Great Britain |
RT_BITMAP | 0x781418 | 0x17028 | ump; data | English | Great Britain |
RT_BITMAP | 0x798440 | 0x23f28 | ump; data | English | Great Britain |
RT_BITMAP | 0x6e40d0 | 0x9ea4 | ump; data | English | Great Britain |
RT_BITMAP | 0x6edf78 | 0xe0c4 | ump; data | English | Great Britain |
RT_BITMAP | 0x6fc040 | 0x19f98 | ump; data | English | Great Britain |
RT_BITMAP | 0x715fd8 | 0x27a18 | ump; data | English | Great Britain |
RT_BITMAP | 0x747618 | 0x2028 | ump; data | English | Great Britain |
RT_BITMAP | 0x749640 | 0x3228 | ump; data | English | Great Britain |
RT_BITMAP | 0x74c868 | 0x4828 | ump; data | English | Great Britain |
RT_BITMAP | 0x751090 | 0x8028 | ump; data | English | Great Britain |
RT_BITMAP | 0x7590b8 | 0xc828 | ump; data | English | Great Britain |
RT_BITMAP | 0x73d9f0 | 0xab8 | ump; data | English | Great Britain |
RT_BITMAP | 0x73e4a8 | 0x1028 | ump; data | English | Great Britain |
RT_BITMAP | 0x73f4d0 | 0x16b8 | ump; data | English | Great Britain |
RT_BITMAP | 0x740b88 | 0x2a68 | ump; data | English | Great Britain |
RT_BITMAP | 0x7435f0 | 0x4028 | ump; data | English | Great Britain |
RT_BITMAP | 0x69ddb8 | 0x2028 | ump; GLS_BINARY_LSB_FIRST | English | Great Britain |
RT_BITMAP | 0x698e78 | 0x1028 | ump; data | English | Canada |
RT_ICON | 0x7c5748 | 0x8a8 | ump; data | English | Great Britain |
RT_ICON | 0x7c5ff0 | 0x568 | ump; GLS_BINARY_LSB_FIRST | English | Great Britain |
RT_ICON | 0x7c6558 | 0xcd63 | ump; PNG image, 256 x 256, 8-bit/color RGBA, non-interlaced | English | Great Britain |
RT_ICON | 0x7d32c0 | 0x25a8 | ump; data | English | Great Britain |
RT_ICON | 0x7d5868 | 0x10a8 | ump; data | English | Great Britain |
RT_ICON | 0x7d6910 | 0x468 | ump; GLS_BINARY_LSB_FIRST | English | Great Britain |
RT_ICON | 0x7d6dd8 | 0x468 | ump; GLS_BINARY_LSB_FIRST | English | Great Britain |
RT_ICON | 0x7d7258 | 0x468 | ump; GLS_BINARY_LSB_FIRST | English | Great Britain |
RT_ICON | 0x7d76d8 | 0x468 | ump; GLS_BINARY_LSB_FIRST | English | Great Britain |
RT_ICON | 0x7d7b58 | 0x468 | ump; GLS_BINARY_LSB_FIRST | English | Great Britain |
RT_ICON | 0x7d7fd8 | 0x468 | ump; GLS_BINARY_LSB_FIRST | English | Great Britain |
RT_MENU | 0x7c5158 | 0x5e | ump; data | English | Great Britain |
RT_MENU | 0x7c4d38 | 0x13c | ump; data | English | Great Britain |
RT_MENU | 0x7c5018 | 0x8e | ump; data | English | Great Britain |
RT_MENU | 0x7c53d8 | 0x1aa | ump; data | English | Great Britain |
RT_MENU | 0x7c4e78 | 0xda | ump; data | English | Great Britain |
RT_MENU | 0x7c51b8 | 0x164 | ump; data | English | Great Britain |
RT_MENU | 0x7c4f58 | 0xbe | ump; data | English | Great Britain |
RT_MENU | 0x7c50a8 | 0xae | ump; data | English | Great Britain |
RT_MENU | 0x7c5320 | 0xb8 | ump; data | English | Great Britain |
RT_DIALOG | 0x7bda40 | 0x278 | ump; data | English | Great Britain |
RT_DIALOG | 0x7c0f08 | 0xe8 | ump; data | English | Great Britain |
RT_DIALOG | 0x7bdd98 | 0x1c8 | ump; data | English | Great Britain |
RT_DIALOG | 0x7bdf60 | 0x1e0 | ump; data | English | Great Britain |
RT_DIALOG | 0x7be140 | 0x1ac | ump; data | English | Great Britain |
RT_DIALOG | 0x7be2f0 | 0x200 | ump; data | English | Great Britain |
RT_DIALOG | 0x7be4f0 | 0x1e4 | ump; data | English | Great Britain |
RT_DIALOG | 0x7be6d8 | 0x33c | ump; data | English | Great Britain |
RT_DIALOG | 0x7bea18 | 0x734 | ump; data | English | Great Britain |
RT_DIALOG | 0x7bcc08 | 0x1a4 | ump; data | English | Great Britain |
RT_DIALOG | 0x7bcdb0 | 0x1ce | ump; data | English | Great Britain |
RT_DIALOG | 0x7bcf80 | 0x4e4 | ump; data | English | Great Britain |
RT_DIALOG | 0x7bd468 | 0x57e | ump; data | English | Great Britain |
RT_DIALOG | 0x7bd9e8 | 0x54 | ump; data | English | Great Britain |
RT_DIALOG | 0x7bf150 | 0xe0 | ump; data | English | Great Britain |
RT_DIALOG | 0x7bf230 | 0x29a | ump; data | English | Great Britain |
RT_DIALOG | 0x7bdcb8 | 0xdc | ump; data | English | Great Britain |
RT_DIALOG | 0x7bf4d0 | 0x70 | ump; data | English | Great Britain |
RT_DIALOG | 0x7bf540 | 0x1ce | ump; data | English | Great Britain |
RT_DIALOG | 0x7bf710 | 0x180 | ump; data | English | Great Britain |
RT_DIALOG | 0x7bf890 | 0x230 | ump; data | English | Great Britain |
RT_DIALOG | 0x7bfac0 | 0xc4 | ump; data | English | Great Britain |
RT_DIALOG | 0x7bfb88 | 0x14c | ump; data | English | Great Britain |
RT_DIALOG | 0x7bfcd8 | 0x462 | ump; data | English | Great Britain |
RT_DIALOG | 0x7c0140 | 0x468 | ump; data | English | Great Britain |
RT_DIALOG | 0x7c05a8 | 0x224 | ump; data | English | Great Britain |
RT_DIALOG | 0x7c07d0 | 0x286 | ump; data | English | Great Britain |
RT_DIALOG | 0x7c0d20 | 0x1e8 | ump; data | English | Great Britain |
RT_DIALOG | 0x7c0ff0 | 0xc8 | ump; data | English | Great Britain |
RT_DIALOG | 0x7c10b8 | 0x938 | ump; data | English | Great Britain |
RT_DIALOG | 0x7c19f0 | 0x462 | ump; data | English | Great Britain |
RT_DIALOG | 0x7c22c0 | 0x48a | ump; data | English | Great Britain |
RT_DIALOG | 0x7c2b60 | 0x2dc | ump; data | English | Great Britain |
RT_DIALOG | 0x7c2750 | 0x336 | ump; data | English | Great Britain |
RT_DIALOG | 0x7c1e58 | 0x462 | ump; data | English | Great Britain |
RT_DIALOG | 0x7c2e40 | 0xd6 | ump; data | English | Great Britain |
RT_DIALOG | 0x7c2f18 | 0x37c | ump; data | English | Great Britain |
RT_DIALOG | 0x7c2a88 | 0xd4 | ump; data | English | Great Britain |
RT_DIALOG | 0x7c0a58 | 0x2c8 | ump; data | English | Great Britain |
RT_DIALOG | 0x7c3298 | 0x1a2 | ump; data | English | Great Britain |
RT_DIALOG | 0x7c3440 | 0x186 | ump; data | English | Great Britain |
RT_DIALOG | 0x7c35c8 | 0x3b4 | ump; data | English | Great Britain |
RT_DIALOG | 0x7c3980 | 0x38a | ump; data | English | Great Britain |
RT_DIALOG | 0x7c3d10 | 0x49c | ump; data | English | Great Britain |
RT_DIALOG | 0x7c41b0 | 0x188 | ump; data | English | Great Britain |
RT_DIALOG | 0x7c4338 | 0x260 | ump; data | English | Great Britain |
RT_DIALOG | 0x7c4598 | 0x154 | ump; data | English | Great Britain |
RT_DIALOG | 0x7c46f0 | 0x1b6 | ump; data | English | Great Britain |
RT_DIALOG | 0x7c48a8 | 0xfc | ump; data | English | Great Britain |
RT_DIALOG | 0x699ea0 | 0x3c8 | ump; data | English | Great Britain |
RT_DIALOG | 0x69a268 | 0x428 | ump; data | English | Great Britain |
RT_DIALOG | 0x69a8d8 | 0x92 | ump; data | English | Great Britain |
RT_DIALOG | 0x69a970 | 0x39c | ump; data | English | Great Britain |
RT_DIALOG | 0x69a690 | 0x248 | ump; data | English | Great Britain |
RT_DIALOG | 0x69ad10 | 0x51c | ump; data | English | Great Britain |
RT_DIALOG | 0x69b230 | 0x558 | ump; data | English | Great Britain |
RT_DIALOG | 0x69b788 | 0x4fe | ump; data | English | Great Britain |
RT_DIALOG | 0x69c1b8 | 0x544 | ump; data | English | Great Britain |
RT_DIALOG | 0x69c700 | 0x454 | ump; data | English | Great Britain |
RT_DIALOG | 0x69cb58 | 0x29c | ump; data | English | Great Britain |
RT_DIALOG | 0x69bc88 | 0x530 | ump; data | English | Great Britain |
RT_DIALOG | 0x69cdf8 | 0x342 | ump; data | English | Great Britain |
RT_DIALOG | 0x69d140 | 0x390 | ump; data | English | Great Britain |
RT_DIALOG | 0x69d4d0 | 0x476 | ump; data | English | Great Britain |
RT_DIALOG | 0x69d948 | 0x46c | ump; data | English | Great Britain |
RT_DIALOG | 0x698960 | 0x514 | ump; data | English | Great Britain |
RT_DIALOG | 0x7bc368 | 0x248 | ump; data | English | Great Britain |
RT_DIALOG | 0x7bc8e8 | 0x1dc | ump; data | English | Great Britain |
RT_DIALOG | 0x7bcb08 | 0xfc | ump; data | English | Great Britain |
RT_DIALOG | 0x7bcac8 | 0x40 | ump; data | English | Great Britain |
RT_DIALOG | 0x7bc5b0 | 0x334 | ump; data | English | Great Britain |
RT_STRING | 0x6d2098 | 0x66 | ump; data | English | Great Britain |
RT_STRING | 0x6d1cf8 | 0x3a0 | ump; data | English | Great Britain |
RT_STRING | 0x6d2100 | 0x1ca | ump; data | English | Great Britain |
RT_STRING | 0x6d22d0 | 0x11e | ump; data | English | Great Britain |
RT_STRING | 0x6d23f0 | 0x10e | ump; PCX ver. 2.5 image data | English | Great Britain |
RT_STRING | 0x6d2500 | 0xcc | ump; data | English | Great Britain |
RT_STRING | 0x6d25d0 | 0x10e | ump; data | English | Great Britain |
RT_STRING | 0x6d26e0 | 0x64 | ump; data | English | Great Britain |
RT_STRING | 0x6d2748 | 0x8c | ump; data | English | Great Britain |
RT_STRING | 0x6d27d8 | 0x90 | ump; data | English | Great Britain |
RT_STRING | 0x6d2868 | 0x3e6 | ump; data | English | Great Britain |
RT_STRING | 0x6d2c50 | 0x200 | ump; data | English | Great Britain |
RT_STRING | 0x6d2e50 | 0xe4 | ump; data | English | Great Britain |
RT_STRING | 0x6d2f38 | 0x40 | ump; data | English | Great Britain |
RT_STRING | 0x6d2f78 | 0xe2 | ump; data | English | Great Britain |
RT_STRING | 0x6d3060 | 0x30a | ump; data | English | Great Britain |
RT_STRING | 0x6d3370 | 0x4e | ump; data | English | Great Britain |
RT_STRING | 0x6d33c0 | 0x54 | ump; data | English | Great Britain |
RT_STRING | 0x6d3418 | 0x2ce | ump; data | English | Great Britain |
RT_STRING | 0x6d36e8 | 0x1ce | ump; data | English | Great Britain |
RT_STRING | 0x6d38b8 | 0x2dc | ump; data | English | Great Britain |
RT_STRING | 0x6d3b98 | 0x48a | ump; data | English | Great Britain |
RT_STRING | 0x6d4028 | 0x466 | ump; data | English | Great Britain |
RT_STRING | 0x6d4490 | 0x45e | ump; data | English | Great Britain |
RT_STRING | 0x6d48f0 | 0x16a | ump; data | English | Great Britain |
RT_STRING | 0x6d4a60 | 0x36e | ump; data | English | Great Britain |
RT_STRING | 0x6d4dd0 | 0x244 | ump; data | English | Great Britain |
RT_STRING | 0x6d5350 | 0x30 | ump; data | English | Great Britain |
RT_STRING | 0x6d5380 | 0x84 | ump; data | English | Great Britain |
RT_STRING | 0x6d5018 | 0x160 | ump; data | English | Great Britain |
RT_STRING | 0x6d5178 | 0x1d4 | ump; data | English | Great Britain |
RT_STRING | 0x6d5408 | 0xc4 | ump; data | English | Great Britain |
RT_STRING | 0x6d54d0 | 0x120 | ump; data | English | Great Britain |
RT_STRING | 0x6d55f0 | 0x8e | ump; data | English | Great Britain |
RT_STRING | 0x6d5680 | 0x240 | ump; data | English | Great Britain |
RT_STRING | 0x6d58c0 | 0x3e2 | ump; Sendmail frozen configuration - version r | English | Great Britain |
RT_STRING | 0x6d5ca8 | 0x390 | ump; data | English | Great Britain |
RT_STRING | 0x6d6038 | 0x17e | ump; data | English | Great Britain |
RT_STRING | 0x6d61b8 | 0x220 | ump; data | English | Great Britain |
RT_STRING | 0x6d63d8 | 0x134 | ump; data | English | Great Britain |
RT_STRING | 0x6d6510 | 0x3ba | ump; DBase 3 index file | English | Great Britain |
RT_STRING | 0x6d68d0 | 0x90 | ump; data | English | Great Britain |
RT_STRING | 0x6d6960 | 0x37e | ump; data | English | Great Britain |
RT_STRING | 0x6d6ce0 | 0x1ca | ump; data | English | Great Britain |
RT_STRING | 0x6d6eb0 | 0x24c | ump; DBase 3 index file | English | Great Britain |
RT_STRING | 0x6d7100 | 0x7e | ump; data | English | Great Britain |
RT_STRING | 0x6d7180 | 0x128 | ump; data | English | Great Britain |
RT_STRING | 0x6d72a8 | 0x162 | ump; data | English | Great Britain |
RT_STRING | 0x6d7410 | 0x3e8 | ump; Hitachi SH big-endian COFF object, not stripped | English | Great Britain |
RT_STRING | 0x6d77f8 | 0x344 | ump; AmigaOS bitmap font | English | Great Britain |
RT_STRING | 0x6d7b40 | 0xa8 | ump; data | English | Great Britain |
RT_STRING | 0x6d7be8 | 0x1c8 | ump; data | English | Great Britain |
RT_STRING | 0x6d7db0 | 0xfc | ump; DBase 3 data file (7929953 records) | English | Great Britain |
RT_STRING | 0x6d7eb0 | 0x2b2 | ump; data | English | Great Britain |
RT_STRING | 0x6d8168 | 0x196 | ump; data | English | Great Britain |
RT_STRING | 0x6d8300 | 0x7c | ump; data | English | Great Britain |
RT_STRING | 0x6d8380 | 0x5e | ump; data | English | Great Britain |
RT_STRING | 0x6d83e0 | 0x82 | ump; data | English | Great Britain |
RT_STRING | 0x6d8468 | 0x84 | ump; data | English | Great Britain |
RT_STRING | 0x6d84f0 | 0x32c | ump; data | English | Great Britain |
RT_STRING | 0x6d8820 | 0x178 | ump; data | English | Great Britain |
RT_STRING | 0x6d8998 | 0x2c8 | ump; data | English | Great Britain |
RT_STRING | 0x6d8c60 | 0xe2 | ump; AmigaOS bitmap font | English | Great Britain |
RT_STRING | 0x6d8d48 | 0x138 | ump; data | English | Great Britain |
RT_STRING | 0x6d8e80 | 0x46 | ump; data | English | Great Britain |
RT_STRING | 0x6d8ec8 | 0xfc | ump; DBase 3 index file | English | Great Britain |
RT_STRING | 0x6d8fc8 | 0x416 | ump; data | English | Great Britain |
RT_STRING | 0x6d93e0 | 0x26 | ump; DBase 3 data file (4456531 records) | English | Great Britain |
RT_STRING | 0x6d9408 | 0x192 | ump; data | English | Great Britain |
RT_STRING | 0x6d95a0 | 0x126 | ump; data | English | Great Britain |
RT_STRING | 0x6d96c8 | 0x31e | ump; data | English | Great Britain |
RT_STRING | 0x6d99e8 | 0x80 | ump; data | English | Great Britain |
RT_STRING | 0x6d9a68 | 0x9a | ump; data | English | Great Britain |
RT_STRING | 0x6d9b08 | 0x5c | ump; data | English | Great Britain |
RT_STRING | 0x6d9b68 | 0xae | ump; data | English | Great Britain |
RT_STRING | 0x6d9c18 | 0x6c | ump; data | English | Great Britain |
RT_STRING | 0x6d9c88 | 0x11c | ump; data | English | Great Britain |
RT_STRING | 0x6d9da8 | 0x238 | ump; data | English | Great Britain |
RT_STRING | 0x6d9fe0 | 0x16a | ump; data | English | Great Britain |
RT_STRING | 0x6da150 | 0x19c | ump; PCX ver. 2.5 image data | English | Great Britain |
RT_STRING | 0x6da2f0 | 0x5c | ump; data | English | Great Britain |
RT_STRING | 0x6da350 | 0x6a0 | ump; data | English | Great Britain |
RT_STRING | 0x6da9f0 | 0x5c | ump; data | English | Great Britain |
RT_STRING | 0x6daa50 | 0x1e8 | ump; data | English | Great Britain |
RT_STRING | 0x6dac38 | 0x58 | ump; data | English | Great Britain |
RT_STRING | 0x6dac90 | 0x1e0 | ump; data | English | Great Britain |
RT_STRING | 0x6dae70 | 0x22a | ump; data | English | Great Britain |
RT_STRING | 0x6db0a0 | 0x672 | ump; data | English | Great Britain |
RT_STRING | 0x6db718 | 0xdb8 | ump; data | English | Great Britain |
RT_STRING | 0x6dc4d0 | 0x108 | ump; data | English | Great Britain |
RT_STRING | 0x6dc5d8 | 0x14a | ump; data | English | Great Britain |
RT_STRING | 0x6dc728 | 0x276 | ump; Hitachi SH big-endian COFF object, not stripped | English | Great Britain |
RT_STRING | 0x6dc9a0 | 0x186 | ump; data | English | Great Britain |
RT_STRING | 0x6dcb28 | 0x3c6 | ump; Sendmail frozen configuration - version | English | Great Britain |
RT_STRING | 0x6dcef0 | 0x44e | ump; data | English | Great Britain |
RT_STRING | 0x6dd340 | 0x444 | ump; data | English | Great Britain |
RT_STRING | 0x6dd788 | 0x13a | ump; data | English | Great Britain |
RT_ACCELERATOR | 0x7c49a8 | 0x70 | ump; data | English | Great Britain |
RT_GROUP_ICON | 0x7d6d78 | 0x5a | ump; MS Windows icon resource - 6 icons, 32x32, 256-colors | English | Great Britain |
RT_GROUP_ICON | 0x7d7240 | 0x14 | ump; MS Windows icon resource - 1 icon | English | Great Britain |
RT_GROUP_ICON | 0x7d76c0 | 0x14 | ump; MS Windows icon resource - 1 icon | English | Great Britain |
RT_GROUP_ICON | 0x7d7b40 | 0x14 | ump; MS Windows icon resource - 1 icon | English | Great Britain |
RT_GROUP_ICON | 0x7d7fc0 | 0x14 | ump; MS Windows icon resource - 1 icon | English | Great Britain |
RT_GROUP_ICON | 0x7d8440 | 0x14 | ump; MS Windows icon resource - 1 icon | English | Great Britain |
RT_VERSION | 0x7c4a18 | 0x31c | ump; data | English | Great Britain |
RT_MANIFEST | 0x918928 | 0x85b | ump; XML document text | English | United States |
None | 0x7c5588 | 0xaa | ump; data | English | Great Britain |
None | 0x7c5638 | 0xaa | ump; data | English | Great Britain |
Imports |
---|
DLL | Import |
---|---|
RPCRT4.dll | UuidFromStringA |
KERNEL32.dll | GetLocaleInfoW, GetNumberFormatW, GetDateFormatW, GetTimeFormatW, CreateFileMappingW, MapViewOfFile, UnmapViewOfFile, GetFileInformationByHandle, GetModuleFileNameA, OutputDebugStringA, DeviceIoControl, FindFirstFileW, FindClose, MoveFileW, GetDiskFreeSpaceW, GetVolumeInformationW, SetFilePointerEx, SetEndOfFile, GetFileAttributesExW, SetFileTime, RemoveDirectoryW, CreateDirectoryW, GetDriveTypeW, GetCompressedFileSizeW, BackupRead, BackupSeek, lstrcmpA, GetFullPathNameW, FindNextFileW, WritePrivateProfileStringW, GetShortPathNameW, FileTimeToLocalFileTime, GetPrivateProfileSectionW, GetPrivateProfileSectionNamesW, GetUserDefaultLangID, lstrcpyW, ExpandEnvironmentStringsW, GetEnvironmentVariableW, SetFileAttributesW, GetTempPathW, GetTempFileNameW, CopyFileW, IsBadStringPtrW, GetTickCount, SystemTimeToTzSpecificLocalTime, GetTimeZoneInformation, LoadLibraryA, MoveFileExW, SetProcessWorkingSetSize, GetComputerNameW, LocalAlloc, LocalLock, LocalUnlock, CreateTimerQueue, UnregisterWaitEx, QueryDepthSList, UnregisterWait, RegisterWaitForSingleObject, SetThreadAffinityMask, GetProcessAffinityMask, GetNumaHighestNodeNumber, DeleteTimerQueueTimer, ChangeTimerQueueTimer, CreateTimerQueueTimer, GetLogicalProcessorInformation, SwitchToThread, SignalObjectAndWait, VerifyVersionInfoW, VerSetConditionMask, GlobalMemoryStatus, GetVersionExA, WaitNamedPipeW, TransactNamedPipe, DuplicateHandle, WaitForMultipleObjects, SetNamedPipeHandleState, SetUnhandledExceptionFilter, VirtualQueryEx, CreateSemaphoreW, CreateThread, TerminateThread, ReleaseSemaphore, LockFileEx, CreateFileMappingA, UnlockFile, HeapCompact, DeleteFileA, CreateFileA, FlushViewOfFile, GetFileAttributesA, GetDiskFreeSpaceA, GetTempPathA, HeapValidate, UnlockFileEx, GetFullPathNameA, LockFile, InterlockedCompareExchange, TryEnterCriticalSection, GetThreadTimes, ReadConsoleW, SetStdHandle, SetEnvironmentVariableA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, FindFirstFileExW, GetOEMCP, IsValidCodePage, GetConsoleMode, GetConsoleCP, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetLogicalDrives, GetACP, WriteConsoleW, GetFileType, GetStdHandle, ExitProcess, GetModuleHandleExW, FreeLibraryAndExitThread, ExitThread, RtlUnwind, InterlockedFlushSList, HeapCreate, UnhandledExceptionFilter, AreFileApisANSI, FormatMessageA, CreateWaitableTimerA, SetWaitableTimer, WaitForMultipleObjectsEx, WaitForSingleObjectEx, GetModuleHandleA, OpenEventA, GetCPInfo, GetStringTypeW, LCMapStringW, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, IsProcessorFeaturePresent, InterlockedPushEntrySList, InterlockedPopEntrySList, InitializeSListHead, OutputDebugStringW, IsDebuggerPresent, LoadLibraryExA, VirtualProtect, RtlCaptureContext, GetSystemTime, OpenThread, VirtualQuery, FlushInstructionCache, GetCurrentProcessId, GetThreadContext, VirtualProtectEx, GetSystemInfo, GetThreadPriority, GetCurrentThread, ResumeThread, SuspendThread, InitializeCriticalSection, SetThreadPriority, VirtualAlloc, VirtualFree, GlobalHandle, lstrcmpW, GetDiskFreeSpaceExW, GetWindowsDirectoryW, GetProcessTimes, GetCurrentProcess, FileTimeToSystemTime, GetLongPathNameW, SetFilePointer, ReadFile, GetFileSize, CompareFileTime, SystemTimeToFileTime, GetLocalTime, CompareStringW, GetVersion, GetPrivateProfileStringW, DeleteFileW, LocalFree, FormatMessageW, MulDiv, SetCurrentDirectoryW, GetCurrentDirectoryW, QueryPerformanceCounter, QueryPerformanceFrequency, GetCommandLineW, CreateProcessW, GetStartupInfoW, LoadLibraryW, GetSystemDirectoryW, SetErrorMode, InterlockedIncrement, InterlockedDecrement, LoadLibraryExW, lstrcmpiW, FreeLibrary, lstrlenW, GetVersionExW, WriteFile, FlushFileBuffers, GetFileAttributesW, WideCharToMultiByte, CreateMutexW, GetProcAddress, MultiByteToWideChar, GetModuleFileNameW, GetCurrentThreadId, SetLastError, GetModuleHandleW, CreateEventA, CloseHandle, HeapAlloc, HeapFree, GetProcessHeap, GetSystemTimeAsFileTime, GlobalAlloc, GlobalLock, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, GlobalUnlock, GlobalFree, InterlockedExchange, CreateFileW, CreateEventW, ResetEvent, SetEvent, Sleep, GetLastError, OpenProcess, TerminateProcess, WaitForSingleObject, LeaveCriticalSection, EnterCriticalSection, RaiseException, HeapReAlloc, HeapSize, HeapDestroy, FindResourceExW, FindResourceW, LoadResource, LockResource, SizeofResource |
USER32.dll | SendDlgItemMessageW, SetWindowContextHelpId, DestroyAcceleratorTable, wsprintfW, GetForegroundWindow, GetDlgItemInt, GetNextDlgTabItem, CreateDialogIndirectParamW, InvalidateRgn, CreateAcceleratorTableW, MapDialogRect, EnableScrollBar, SetScrollRange, GetScrollRange, RemovePropW, GetPropW, ShowScrollBar, DrawFrameControl, GetSystemMetrics, GetMonitorInfoW, MonitorFromWindow, GetWindowRect, SetWindowPos, GetWindowLongW, LoadBitmapW, GetWindow, GetDesktopWindow, GetClientRect, MapWindowPoints, SetWindowLongW, SendMessageW, GetDlgItem, ScreenToClient, MoveWindow, GetDC, ReleaseDC, GetWindowTextW, SetWindowTextW, IsWindow, DrawTextW, DefWindowProcW, UnregisterClassW, InvalidateRect, BeginPaint, EndPaint, GetActiveWindow, PostMessageW, SetDlgItemTextW, CloseClipboard, GetClipboardData, OpenClipboard, IsClipboardFormatAvailable, GetShellWindow, GetWindowInfo, SetMenuDefaultItem, LockWindowUpdate, PostQuitMessage, IsDialogMessageW, FindWindowExW, LoadIconW, GetComboBoxInfo, AdjustWindowRectEx, GetMenu, GetWindowPlacement, SystemParametersInfoA, DrawTextExW, GetMenuItemID, CharLowerW, CharLowerA, GetDlgItemTextW, EmptyClipboard, SetClipboardData, GetWindowThreadProcessId, WaitForInputIdle, EnumDisplaySettingsW, ExitWindowsEx, GetLastInputInfo, SendMessageTimeoutW, DestroyCursor, GetAsyncKeyState, GetNextDlgGroupItem, GetLastActivePopup, MessageBeep, DrawIcon, LoadStringW, WinHelpW, WaitMessage, GetParent, DrawEdge, DeleteMenu, SetLayeredWindowAttributes, UnhookWindowsHookEx, SetWindowsHookExW, CallNextHookEx, SetPropW, GetWindowTextLengthW, SetScrollPos, GetScrollInfo, AppendMenuW, ScrollWindowEx, SetScrollInfo, GetScrollPos, GetClassLongW, GetDialogBaseUnits, EndDialog, GetDlgCtrlID, IsZoomed, GetSystemMenu, TrackPopupMenu, SetForegroundWindow, RedrawWindow, PtInRect, TrackMouseEvent, SystemParametersInfoW, InflateRect, LoadImageW, FillRect, IsWindowEnabled, ShowWindow, ChildWindowFromPoint, IsChild, IsWindowVisible, UpdateWindow, GetSysColor, DestroyWindow, CreateDialogParamW, EnableWindow, FrameRect, CallWindowProcW, KillTimer, SetTimer, GetSysColorBrush, ClientToScreen, RegisterWindowMessageW, RegisterClassExW, GetClassInfoExW, LoadCursorW, CreateWindowExW, DestroyMenu, CopyRect, CheckDlgButton, IsDlgButtonChecked, GetClassNameW, OpenIcon, FindWindowW, EnumWindows, IsIconic, DrawFocusRect, DestroyIcon, DrawStateW, GetKeyState, GetMessagePos, InsertMenuW, SetCursorPos, SetRectEmpty, DialogBoxParamW, GetCursorPos, CreatePopupMenu, MsgWaitForMultipleObjects, IsWindowUnicode, GetMessageA, DispatchMessageA, EnableMenuItem, BringWindowToTop, GetFocus, GetWindowDC, OffsetRect, MessageBoxW, PeekMessageW, GetMessageW, TranslateMessage, DispatchMessageW, RegisterClassW, GetClassInfoW, CharNextW, SetCursor, ReleaseCapture, WindowFromPoint, SetCapture, GetCapture, SetRect, SetFocus |
GDI32.dll | SetTextColor, CreateFontIndirectW, SetDIBColorTable, GetStockObject, SaveDC, RestoreDC, TextOutW, CreateSolidBrush, CreateBitmap, CreatePatternBrush, GetClipBox, GetTextExtentPoint32W, GetTextMetricsW, ExtTextOutW, CombineRgn, CreateRectRgnIndirect, GetTextColor, GetBkColor, SetBkMode, GetDeviceCaps, BitBlt, DeleteObject, CreateCompatibleDC, CreateCompatibleBitmap, SetViewportOrgEx, SelectObject, DeleteDC, SetBkColor, ExcludeClipRect, GetObjectW, PatBlt, CreateDIBSection, Rectangle, CreatePen, StretchBlt, CreateRectRgn, CreateDCW, SelectClipRgn, MoveToEx, LineTo, Ellipse, PolylineTo, UnrealizeObject, StrokeAndFillPath, EndPath, BeginPath, GetClipRgn, GetDIBColorTable |
COMDLG32.dll | GetOpenFileNameW, GetSaveFileNameW |
ADVAPI32.dll | GetLengthSid, CryptReleaseContext, CryptAcquireContextA, CryptGetHashParam, CryptHashData, CryptCreateHash, CryptAcquireContextW, ConvertSidToStringSidW, CloseEventLog, ClearEventLogW, OpenEventLogW, LookupPrivilegeNameW, RegUnLoadKeyW, RegLoadKeyW, RegNotifyChangeKeyValue, GetUserNameW, LookupAccountNameW, CopySid, CryptGenRandom, LookupAccountSidW, EqualSid, OpenThreadToken, RegCloseKey, RegOpenKeyExW, RegDeleteKeyW, RegQueryInfoKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, RegDeleteValueW, RegQueryValueExW, OpenProcessToken, GetTokenInformation, LookupPrivilegeValueW, AdjustTokenPrivileges, FreeSid, AllocateAndInitializeSid, SetEntriesInAclW, SetNamedSecurityInfoW, GetFileSecurityW, DuplicateToken, MapGenericMask, AccessCheck, RegEnumValueW, IsValidSid, GetSidIdentifierAuthority, GetSidSubAuthorityCount, GetSidSubAuthority |
SHELL32.dll | ShellExecuteW, SHBrowseForFolderW, DragQueryFileW, DragFinish, ShellExecuteExW, Shell_NotifyIconW, SHGetSpecialFolderLocation, ExtractIconExW, SHGetFileInfoW, SHEmptyRecycleBinW, SHAddToRecentDocs, SHGetPathFromIDListW |
ole32.dll | StgOpenStorageEx, StgIsStorageFile, CoInitializeEx, PropVariantClear, CoSetProxyBlanket, OleLockRunning, StringFromGUID2, CLSIDFromString, CLSIDFromProgID, CoGetClassObject, CoInitializeSecurity, DoDragDrop, RegisterDragDrop, RevokeDragDrop, OleDuplicateData, ReleaseStgMedium, CoCreateInstance, CoTaskMemAlloc, CoTaskMemRealloc, CoTaskMemFree, OleUninitialize, OleInitialize, CreateStreamOnHGlobal, CoUninitialize, CoInitialize |
OLEAUT32.dll | SysFreeString, VarUI4FromStr, SysAllocString, VariantClear, VariantInit, SysStringLen, LoadRegTypeLib, LoadTypeLib, SysAllocStringLen, DispCallFunc, OleCreateFontIndirect, VarBstrFromR8, VarBstrFromI4, VariantChangeType, VariantTimeToSystemTime |
SHLWAPI.dll | PathIsDirectoryEmptyW, PathRemoveExtensionA, PathAddExtensionW, PathRemoveExtensionW, PathStripToRootW, PathSkipRootW, PathRemoveBackslashW, PathCombineW, PathCompactPathW, PathIsDirectoryW, PathRemoveFileSpecW, PathAppendW, PathFileExistsW, PathMatchSpecW, StrRetToStrW, PathFindExtensionW, PathUnquoteSpacesW, PathRemoveArgsW, PathStripPathW, SHStrDupW, PathIsURLW, PathCreateFromUrlW, PathStripPathA, PathIsUNCW, PathIsRelativeW, PathFindFileNameW, PathGetDriveNumberW |
COMCTL32.dll | ImageList_Add, ImageList_Create, _TrackMouseEvent, ImageList_Remove, ImageList_GetImageCount, ImageList_GetIcon, ImageList_ReplaceIcon, ImageList_SetIconSize, ImageList_Duplicate, ImageList_GetIconSize, ImageList_Draw, ImageList_Destroy, InitCommonControlsEx, ImageList_LoadImageW |
gdiplus.dll | GdipCreateBitmapFromFile, GdipDrawLine, GdipFillRectangle, GdipCreateHatchBrush, GdipDrawRectangleI, GdipDeletePen, GdipCreatePen1, GdipSetSmoothingMode, GdipCreateFromHDC, GdipFillRectangleI, GdipCreateSolidFill, GdipCloneBrush, GdipDeleteBrush, GdiplusStartup, GdiplusShutdown, GdipCreateBitmapFromStream, GdipGetImagePixelFormat, GdipGetImageHeight, GdipGetImageWidth, GdipGetImagePaletteSize, GdipGetImagePalette, GdipBitmapLockBits, GdipBitmapUnlockBits, GdipCreateBitmapFromScan0, GdipCloneImage, GdipAlloc, GdipFree, GdipDisposeImage, GdipGetImageGraphicsContext, GdipDeleteGraphics, GdipDrawImageI |
Version Infos |
---|
Description | Data |
---|---|
LegalCopyright | Copyright 2005-2017 Piriform Ltd |
InternalName | ccleaner |
FileVersion | 5, 33, 00, 6162 |
CompanyName | Piriform Ltd |
Comments | CCleaner |
ProductName | CCleaner |
ProductVersion | 5, 33, 00, 6162 |
FileDescription | CCleaner |
OriginalFilename | ccleaner.exe |
Translation | 0x0409 0x04b0 |
Possible Origin |
---|
Language of compilation system | Country where language is spoken | Map |
---|---|---|
English | Great Britain | |
English | United States | |
English | Canada |
Network Behavior |
---|
Network Port Distribution |
---|
TCP Packets |
---|
Timestamp | Source Port | Dest Port | Source IP | Dest IP |
---|---|---|---|---|
Sep 18, 2017 13:10:12.650120974 MESZ | 57618 | 53 | 192.168.1.16 | 8.8.8.8 |
Sep 18, 2017 13:10:12.840764999 MESZ | 53 | 57618 | 8.8.8.8 | 192.168.1.16 |
Sep 18, 2017 13:10:12.877826929 MESZ | 49241 | 443 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:10:12.877909899 MESZ | 443 | 49241 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:12.878027916 MESZ | 49241 | 443 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:10:12.890875101 MESZ | 49241 | 443 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:10:12.890937090 MESZ | 443 | 49241 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:12.972112894 MESZ | 443 | 49241 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:12.972258091 MESZ | 49241 | 443 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:10:12.979221106 MESZ | 443 | 49241 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:12.979239941 MESZ | 443 | 49241 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:12.979259014 MESZ | 443 | 49241 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:12.979358912 MESZ | 49241 | 443 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:10:12.993659973 MESZ | 443 | 49241 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:12.993680000 MESZ | 443 | 49241 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:12.993819952 MESZ | 49241 | 443 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:10:13.010098934 MESZ | 49241 | 443 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:10:13.010139942 MESZ | 443 | 49241 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:13.096743107 MESZ | 443 | 49241 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:13.096847057 MESZ | 49241 | 443 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:10:13.422096014 MESZ | 55120 | 53 | 192.168.1.16 | 8.8.8.8 |
Sep 18, 2017 13:10:13.550033092 MESZ | 53 | 55120 | 8.8.8.8 | 192.168.1.16 |
Sep 18, 2017 13:10:13.560333014 MESZ | 55885 | 53 | 192.168.1.16 | 8.8.8.8 |
Sep 18, 2017 13:10:13.691201925 MESZ | 53 | 55885 | 8.8.8.8 | 192.168.1.16 |
Sep 18, 2017 13:10:14.077543974 MESZ | 62228 | 53 | 192.168.1.16 | 8.8.8.8 |
Sep 18, 2017 13:10:14.248826981 MESZ | 53 | 62228 | 8.8.8.8 | 192.168.1.16 |
Sep 18, 2017 13:10:14.270484924 MESZ | 60304 | 53 | 192.168.1.16 | 8.8.8.8 |
Sep 18, 2017 13:10:14.375883102 MESZ | 53 | 60304 | 8.8.8.8 | 192.168.1.16 |
Sep 18, 2017 13:10:14.515922070 MESZ | 49241 | 443 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:10:14.515949965 MESZ | 443 | 49241 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:14.578507900 MESZ | 443 | 49241 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:14.578632116 MESZ | 49241 | 443 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:10:14.707798958 MESZ | 50518 | 53 | 192.168.1.16 | 8.8.8.8 |
Sep 18, 2017 13:10:14.901252985 MESZ | 53 | 50518 | 8.8.8.8 | 192.168.1.16 |
Sep 18, 2017 13:10:14.903940916 MESZ | 49244 | 443 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:10:14.904002905 MESZ | 443 | 49244 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:14.904103994 MESZ | 49244 | 443 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:10:14.905411005 MESZ | 49244 | 443 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:10:14.905452013 MESZ | 443 | 49244 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:15.022217989 MESZ | 443 | 49244 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:15.022378922 MESZ | 49244 | 443 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:10:15.055221081 MESZ | 443 | 49244 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:15.055257082 MESZ | 443 | 49244 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:15.055274010 MESZ | 443 | 49244 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:15.055358887 MESZ | 49244 | 443 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:10:15.061346054 MESZ | 443 | 49244 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:15.061438084 MESZ | 49244 | 443 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:10:15.068511009 MESZ | 443 | 49244 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:15.068526983 MESZ | 443 | 49244 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:15.068617105 MESZ | 49244 | 443 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:10:15.083308935 MESZ | 49244 | 443 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:10:15.083337069 MESZ | 443 | 49244 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:15.147872925 MESZ | 443 | 49244 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:15.147980928 MESZ | 49244 | 443 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:10:15.205301046 MESZ | 49244 | 443 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:10:15.205332994 MESZ | 443 | 49244 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:15.418435097 MESZ | 443 | 49244 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:15.418687105 MESZ | 49244 | 443 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:10:15.422755957 MESZ | 443 | 49244 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:15.422785044 MESZ | 443 | 49244 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:15.422797918 MESZ | 443 | 49244 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:15.423022985 MESZ | 49244 | 443 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:10:15.430670977 MESZ | 443 | 49244 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:15.430695057 MESZ | 443 | 49244 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:15.430901051 MESZ | 49244 | 443 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:10:15.439291954 MESZ | 49246 | 80 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:10:15.439347029 MESZ | 80 | 49246 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:15.439466000 MESZ | 49246 | 80 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:10:15.440088987 MESZ | 49246 | 80 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:10:15.440118074 MESZ | 80 | 49246 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:15.673459053 MESZ | 80 | 49246 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:15.673732996 MESZ | 49246 | 80 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:10:15.754657030 MESZ | 80 | 49246 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:10:15.754843950 MESZ | 49246 | 80 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:10:52.812395096 MESZ | 49239 | 80 | 192.168.1.16 | 23.34.203.27 |
Sep 18, 2017 13:10:52.812526941 MESZ | 49240 | 80 | 192.168.1.16 | 23.34.203.27 |
Sep 18, 2017 13:12:12.515746117 MESZ | 49246 | 80 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:12:12.515906096 MESZ | 80 | 49246 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:12:12.516462088 MESZ | 49246 | 80 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:12:12.516772985 MESZ | 49244 | 443 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:12:12.516891003 MESZ | 443 | 49244 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:12:12.517116070 MESZ | 49241 | 443 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:12:12.517185926 MESZ | 443 | 49241 | 151.101.0.64 | 192.168.1.16 |
Sep 18, 2017 13:12:12.517190933 MESZ | 49244 | 443 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:12:12.517524958 MESZ | 49241 | 443 | 192.168.1.16 | 151.101.0.64 |
Sep 18, 2017 13:17:55.246320009 MESZ | 49237 | 80 | 192.168.1.16 | 23.34.203.27 |
Sep 18, 2017 13:17:55.246450901 MESZ | 49238 | 80 | 192.168.1.16 | 23.34.197.163 |
UDP Packets |
---|
Timestamp | Source Port | Dest Port | Source IP | Dest IP |
---|---|---|---|---|
Sep 18, 2017 13:10:12.650120974 MESZ | 57618 | 53 | 192.168.1.16 | 8.8.8.8 |
Sep 18, 2017 13:10:12.840764999 MESZ | 53 | 57618 | 8.8.8.8 | 192.168.1.16 |
Sep 18, 2017 13:10:13.422096014 MESZ | 55120 | 53 | 192.168.1.16 | 8.8.8.8 |
Sep 18, 2017 13:10:13.550033092 MESZ | 53 | 55120 | 8.8.8.8 | 192.168.1.16 |
Sep 18, 2017 13:10:13.560333014 MESZ | 55885 | 53 | 192.168.1.16 | 8.8.8.8 |
Sep 18, 2017 13:10:13.691201925 MESZ | 53 | 55885 | 8.8.8.8 | 192.168.1.16 |
Sep 18, 2017 13:10:14.077543974 MESZ | 62228 | 53 | 192.168.1.16 | 8.8.8.8 |
Sep 18, 2017 13:10:14.248826981 MESZ | 53 | 62228 | 8.8.8.8 | 192.168.1.16 |
Sep 18, 2017 13:10:14.270484924 MESZ | 60304 | 53 | 192.168.1.16 | 8.8.8.8 |
Sep 18, 2017 13:10:14.375883102 MESZ | 53 | 60304 | 8.8.8.8 | 192.168.1.16 |
Sep 18, 2017 13:10:14.707798958 MESZ | 50518 | 53 | 192.168.1.16 | 8.8.8.8 |
Sep 18, 2017 13:10:14.901252985 MESZ | 53 | 50518 | 8.8.8.8 | 192.168.1.16 |
DNS Queries |
---|
Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class |
---|---|---|---|---|---|---|---|
Sep 18, 2017 13:10:12.650120974 MESZ | 192.168.1.16 | 8.8.8.8 | 0x3c1a | Standard query (0) | A (IP address) | IN (0x0001) | |
Sep 18, 2017 13:10:14.707798958 MESZ | 192.168.1.16 | 8.8.8.8 | 0x558a | Standard query (0) | A (IP address) | IN (0x0001) |
DNS Answers |
---|
Timestamp | Source IP | Dest IP | Trans ID | Replay Code | Name | CName | Address | Type | Class |
---|---|---|---|---|---|---|---|---|---|
Sep 18, 2017 13:10:12.840764999 MESZ | 8.8.8.8 | 192.168.1.16 | 0x3c1a | No error (0) | 151.101.0.64 | A (IP address) | IN (0x0001) | ||
Sep 18, 2017 13:10:14.901252985 MESZ | 8.8.8.8 | 192.168.1.16 | 0x558a | No error (0) | 151.101.0.64 | A (IP address) | IN (0x0001) |
HTTP Request Dependency Graph |
---|
|
HTTP Packets |
---|
Timestamp | Source Port | Dest Port | Source IP | Dest IP | Header | Total Bytes Transfered (KB) |
---|---|---|---|---|---|---|
Sep 18, 2017 13:10:15.440088987 MESZ | 49246 | 80 | 192.168.1.16 | 151.101.0.64 | 28 | |
Sep 18, 2017 13:10:15.673459053 MESZ | 80 | 49246 | 151.101.0.64 | 192.168.1.16 | 29 | |
Sep 18, 2017 13:10:15.754657030 MESZ | 80 | 49246 | 151.101.0.64 | 192.168.1.16 | 29 |
HTTPS Packets |
---|
Timestamp | Source Port | Dest Port | Source IP | Dest IP | Subject | Issuer | Not Before | Not After | Raw |
---|---|---|---|---|---|---|---|---|---|
Sep 18, 2017 13:10:12.979259014 MESZ | 443 | 49241 | 151.101.0.64 | 192.168.1.16 | CN=f.ssl.fastly.net, O="Fastly, Inc.", L=San Francisco, ST=California, C=US | CN=GlobalSign Organization Validation CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE | Fri Sep 08 20:53:07 CEST 2017 | Mon Sep 03 21:23:44 CEST 2018 | [[ Version: V3 Subject: CN=f.ssl.fastly.net, O="Fastly, Inc.", L=San Francisco, ST=California, C=US Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 21206705149499206797616234431691774100272389381679802159957645394685916649427944368937687197945680464939525188459454875830379108803574343196571398951497589131569579800434435633547969768447700882640641910178951371489995706666363023457617777414222006104418816890690107896851034689428604895246888653189390474062707331926927517053396072682649273692773085235411335026457857552279193731971752518565900655681378226883197904039493482435978017650419600023075683700930344749016051121888310657629953747738516192497642072540327874037079582254649174606746470145819864057919951411978711761631174292850773278786575964014772482215117 public exponent: 65537 Validity: [From: Fri Sep 08 20:53:07 CEST 2017, To: Mon Sep 03 21:23:44 CEST 2018] Issuer: CN=GlobalSign Organization Validation CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE SerialNumber: [ 5227977d 19bf5711 04d045a1]Certificate Extensions: 9[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: caIssuers accessLocation: URIName: http://secure.globalsign.com/cacert/gsorganizationvalsha2g2r1.crt, accessMethod: ocsp accessLocation: URIName: http://ocsp2.globalsign.com/gsorganizationvalsha2g2]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: 96 DE 61 F1 BD 1C 16 29 53 1C C0 CC 7D 3B 83 00 ..a....)S....;..0010: 40 E6 1A 7C @...]][3]: ObjectId: 2.5.29.19 Criticality=falseBasicConstraints:[ CA:false PathLen: undefined][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.globalsign.com/gs/gsorganizationvalsha2g2.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [1.3.6.1.4.1.4146.1.20][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 26 68 74 74 70 73 3A 2F 2F 77 77 77 2E 67 6C .&https://www.gl0010: 6F 62 61 6C 73 69 67 6E 2E 63 6F 6D 2F 72 65 70 obalsign.com/rep0020: 6F 73 69 74 6F 72 79 2F ository/]] ] [CertificatePolicyId: [2.23.140.1.2.2][] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][8]: ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [ DNSName: f.ssl.fastly.net DNSName: *.500px.com DNSName: *.adis.ws DNSName: *.adroll.com DNSName: *.beacon.fastlydns.net DNSName: *.bleacherreport.net DNSName: *.britishcouncil.org DNSName: *.businessinsider.com DNSName: *.catchpoint.com DNSName: *.cooladata.com DNSName: *.discogs.com DNSName: *.disq.us DNSName: *.dotabuff.com DNSName: *.e3expo.com DNSName: *.fastly-debug.com DNSName: *.fetlife.com DNSName: *.format-assets.com DNSName: *.format-staging.com DNSName: *.lsops.org DNSName: *.new.livestream.com DNSName: *.nr-data.net DNSName: *.nydailynews.com DNSName: *.piriform.com DNSName: *.romwod.com DNSName: *.services.disqus.com DNSName: *.shakr.com DNSName: *.smartmember.com DNSName: *.thisisinsider.com DNSName: *.thoughtbot.com DNSName: *.vimeo-staging.com DNSName: assets.listia.com DNSName: businessinsider.com DNSName: cdn1.leadcommerce.com DNSName: content.thinkzoom.com DNSName: creditcards.offers.com DNSName: disq.us DNSName: dotabuff.com DNSName: e3expo.com DNSName: f-jsv2.harveynichols.com DNSName: f-mediav2.harveynichols.com DNSName: f-skinv2.harveynichols.com DNSName: fast.appcues.com DNSName: fastly-debug.com DNSName: fetlife.com DNSName: format-staging.com DNSName: format.com DNSName: gems.secretcdn.net DNSName: kredo.com DNSName: nydailynews.com DNSName: piriform.com DNSName: projects.fivethirtyeight.com DNSName: projects.propublica.org DNSName: romwod.com DNSName: rubytogether.org DNSName: sfdc.fastly.com DNSName: smokeping.app.secretcdn.net DNSName: static.flocabulary.com DNSName: status-dev.banksimple.com DNSName: thoughtbot.com DNSName: thoughtbot.se DNSName: top.secretcdn.net DNSName: vimeo-staging.com DNSName: www-dev.banksimple.com DNSName: www.creativeedge.com DNSName: www.gokudos.com DNSName: www.kredo.com][9]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 77 3D 2B F9 76 8F C1 EA 9B E6 04 2C 1D C7 AD 4B w=+.v......,...K0010: CB 83 F6 0E ....]]] Algorithm: [SHA256withRSA] Signature:0000: 1D C9 7E 27 C4 8E 22 6C F6 CC AF F9 0D 5A EC 7F ...'.."l.....Z..0010: A9 D9 D2 EF 11 71 44 2B 86 4F 1B 98 C3 31 EC 2A .....qD+.O...1.*0020: 84 B5 D1 12 0D 96 02 45 B1 82 B1 35 0E 75 5F CA .......E...5.u_.0030: 7C BC C6 B0 04 9E A8 09 85 81 11 32 05 EA BB AF ...........2....0040: AC 4F ED FC 09 3C 49 AD 32 82 D0 7D F8 58 51 1F .O...<I.2....XQ.0050: 48 6A 2A 7A 65 4D 7E 64 0B 10 E3 C2 57 3E D4 D7 Hj*zeM.d....W>..0060: 7B 57 37 A9 59 57 0D 5E F3 A3 6E FC 22 C4 6E DB .W7.YW.^..n.".n.0070: 91 63 39 93 5D 92 DF 79 91 56 D1 80 56 3B A4 E2 .c9.]..y.V..V;..0080: C5 BB 83 74 39 FC 19 2C C9 A1 8D A2 5B CD 01 D1 ...t9..,....[...0090: 55 9B 40 57 A5 B0 63 2E F3 14 F9 C4 83 DA 1A 74 U.@W..c........t00A0: BF 12 EE 1D 80 E2 40 A4 8E 87 56 BC 02 35 F4 10 ......@...V..5..00B0: C6 7E FF FA 00 01 B7 E9 A9 99 52 57 39 82 76 6F ..........RW9.vo00C0: 91 1C 1A E3 F4 4D 45 87 A3 32 98 6D 6B 82 66 05 .....ME..2.mk.f.00D0: 14 77 72 B7 61 34 CC 1F 7F BB C0 0A 77 51 32 B2 .wr.a4......wQ2.00E0: DA C1 6C 81 6D 16 2E 2C 0C DB 8F 11 A8 07 3B 93 ..l.m..,......;.00F0: 1A FC A0 9D B0 FF 52 B4 BE B9 6A 6E 7A 24 99 73 ......R...jnz$.s] |
Sep 18, 2017 13:10:12.979259014 MESZ | 443 | 49241 | 151.101.0.64 | 192.168.1.16 | CN=GlobalSign Organization Validation CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE | CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE | Thu Feb 20 11:00:00 CET 2014 | Tue Feb 20 11:00:00 CET 2024 | [[ Version: V3 Subject: CN=GlobalSign Organization Validation CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 25128534854946729689874225426937401505000881204706872255627098498474475295641403147428295231173090028665490451781016201369028386293751105000607980749389164896950295472415799544200821826598281622670047877476444380361331431510582219613042406283138772574077178828514459453291208108705648245160199047848714530696719439161049181407350831720090579906068909416515809757315311589912849752912945272005465192109502201681085714022553142452002065884519487869175097916258424515352321964381962068601310395827347949688386139631202235593096601000028863153912492627308071474449386570163993017908691119484112907211941619220357798802161 public exponent: 65537 Validity: [From: Thu Feb 20 11:00:00 CET 2014, To: Tue Feb 20 11:00:00 CET 2024] Issuer: CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE SerialNumber: [ 04000000 0001444e f04247]Certificate Extensions: 7[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.globalsign.com/rootr1]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: 60 7B 66 1A 45 0D 97 CA 89 50 2F 7D 04 CD 34 A8 `.f.E....P/...4.0010: FF FC FD 4B ...K]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.globalsign.net/root.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 26 68 74 74 70 73 3A 2F 2F 77 77 77 2E 67 6C .&https://www.gl0010: 6F 62 61 6C 73 69 67 6E 2E 63 6F 6D 2F 72 65 70 obalsign.com/rep0020: 6F 73 69 74 6F 72 79 2F ository/]] ]][6]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ Key_CertSign Crl_Sign][7]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 96 DE 61 F1 BD 1C 16 29 53 1C C0 CC 7D 3B 83 00 ..a....)S....;..0010: 40 E6 1A 7C @...]]] Algorithm: [SHA256withRSA] Signature:0000: 46 2A EE 5E BD AE 01 60 37 31 11 86 71 74 B6 46 F*.^...`71..qt.F0010: 49 C8 10 16 FE 2F 62 23 17 AB 1F 87 F8 82 ED CA I..../b#........0020: DF 0E 2C DF 64 75 8E E5 18 72 A7 8C 3A 8B C9 AC ..,.du...r..:...0030: A5 77 50 F7 EF 9E A4 E0 A0 8F 14 57 A3 2A 5F EC .wP........W.*_.0040: 7E 6D 10 E6 BA 8D B0 08 87 76 0E 4C B2 D9 51 BB .m.......v.L..Q.0050: 11 02 F2 5C DD 1C BD F3 55 96 0F D4 06 C0 FC E2 ...\....U.......0060: 23 8A 24 70 D3 BB F0 79 1A A7 61 70 83 8A AF 06 #.$p...y..ap....0070: C5 20 D8 A1 63 D0 6C AE 4F 32 D7 AE 7C 18 45 75 . ..c.l.O2....Eu0080: 05 29 77 DF 42 40 64 64 86 BE 2A 76 09 31 6F 1D .)w.B@dd..*v.1o.0090: 24 F4 99 D0 85 FE F2 21 08 F9 C6 F6 F1 D0 59 ED $......!......Y.00A0: D6 56 3C 08 28 03 67 BA F0 F9 F1 90 16 47 AE 67 .V<.(.g......G.g00B0: E6 BC 80 48 E9 42 76 34 97 55 69 24 0E 83 D6 A0 ...H.Bv4.Ui$....00C0: 2D B4 F5 F3 79 8A 49 28 74 1A 41 A1 C2 D3 24 88 -...y.I(t.A...$.00D0: 35 30 60 94 17 B4 E1 04 22 31 3D 3B 2F 17 06 B2 50`....."1=;/...00E0: B8 9D 86 2B 5A 69 EF 83 F5 4B C4 AA B4 2A F8 7C ...+Zi...K...*..00F0: A1 B1 85 94 8C F4 0C 87 0C F4 AC 40 F8 59 49 98 ...........@.YI.] |
Sep 18, 2017 13:10:15.061346054 MESZ | 443 | 49244 | 151.101.0.64 | 192.168.1.16 | CN=f.ssl.fastly.net, O="Fastly, Inc.", L=San Francisco, ST=California, C=US | CN=GlobalSign Organization Validation CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE | Fri Sep 08 20:53:07 CEST 2017 | Mon Sep 03 21:23:44 CEST 2018 | [[ Version: V3 Subject: CN=f.ssl.fastly.net, O="Fastly, Inc.", L=San Francisco, ST=California, C=US Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 21206705149499206797616234431691774100272389381679802159957645394685916649427944368937687197945680464939525188459454875830379108803574343196571398951497589131569579800434435633547969768447700882640641910178951371489995706666363023457617777414222006104418816890690107896851034689428604895246888653189390474062707331926927517053396072682649273692773085235411335026457857552279193731971752518565900655681378226883197904039493482435978017650419600023075683700930344749016051121888310657629953747738516192497642072540327874037079582254649174606746470145819864057919951411978711761631174292850773278786575964014772482215117 public exponent: 65537 Validity: [From: Fri Sep 08 20:53:07 CEST 2017, To: Mon Sep 03 21:23:44 CEST 2018] Issuer: CN=GlobalSign Organization Validation CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE SerialNumber: [ 5227977d 19bf5711 04d045a1]Certificate Extensions: 9[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: caIssuers accessLocation: URIName: http://secure.globalsign.com/cacert/gsorganizationvalsha2g2r1.crt, accessMethod: ocsp accessLocation: URIName: http://ocsp2.globalsign.com/gsorganizationvalsha2g2]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: 96 DE 61 F1 BD 1C 16 29 53 1C C0 CC 7D 3B 83 00 ..a....)S....;..0010: 40 E6 1A 7C @...]][3]: ObjectId: 2.5.29.19 Criticality=falseBasicConstraints:[ CA:false PathLen: undefined][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.globalsign.com/gs/gsorganizationvalsha2g2.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [1.3.6.1.4.1.4146.1.20][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 26 68 74 74 70 73 3A 2F 2F 77 77 77 2E 67 6C .&https://www.gl0010: 6F 62 61 6C 73 69 67 6E 2E 63 6F 6D 2F 72 65 70 obalsign.com/rep0020: 6F 73 69 74 6F 72 79 2F ository/]] ] [CertificatePolicyId: [2.23.140.1.2.2][] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][8]: ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [ DNSName: f.ssl.fastly.net DNSName: *.500px.com DNSName: *.adis.ws DNSName: *.adroll.com DNSName: *.beacon.fastlydns.net DNSName: *.bleacherreport.net DNSName: *.britishcouncil.org DNSName: *.businessinsider.com DNSName: *.catchpoint.com DNSName: *.cooladata.com DNSName: *.discogs.com DNSName: *.disq.us DNSName: *.dotabuff.com DNSName: *.e3expo.com DNSName: *.fastly-debug.com DNSName: *.fetlife.com DNSName: *.format-assets.com DNSName: *.format-staging.com DNSName: *.lsops.org DNSName: *.new.livestream.com DNSName: *.nr-data.net DNSName: *.nydailynews.com DNSName: *.piriform.com DNSName: *.romwod.com DNSName: *.services.disqus.com DNSName: *.shakr.com DNSName: *.smartmember.com DNSName: *.thisisinsider.com DNSName: *.thoughtbot.com DNSName: *.vimeo-staging.com DNSName: assets.listia.com DNSName: businessinsider.com DNSName: cdn1.leadcommerce.com DNSName: content.thinkzoom.com DNSName: creditcards.offers.com DNSName: disq.us DNSName: dotabuff.com DNSName: e3expo.com DNSName: f-jsv2.harveynichols.com DNSName: f-mediav2.harveynichols.com DNSName: f-skinv2.harveynichols.com DNSName: fast.appcues.com DNSName: fastly-debug.com DNSName: fetlife.com DNSName: format-staging.com DNSName: format.com DNSName: gems.secretcdn.net DNSName: kredo.com DNSName: nydailynews.com DNSName: piriform.com DNSName: projects.fivethirtyeight.com DNSName: projects.propublica.org DNSName: romwod.com DNSName: rubytogether.org DNSName: sfdc.fastly.com DNSName: smokeping.app.secretcdn.net DNSName: static.flocabulary.com DNSName: status-dev.banksimple.com DNSName: thoughtbot.com DNSName: thoughtbot.se DNSName: top.secretcdn.net DNSName: vimeo-staging.com DNSName: www-dev.banksimple.com DNSName: www.creativeedge.com DNSName: www.gokudos.com DNSName: www.kredo.com][9]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 77 3D 2B F9 76 8F C1 EA 9B E6 04 2C 1D C7 AD 4B w=+.v......,...K0010: CB 83 F6 0E ....]]] Algorithm: [SHA256withRSA] Signature:0000: 1D C9 7E 27 C4 8E 22 6C F6 CC AF F9 0D 5A EC 7F ...'.."l.....Z..0010: A9 D9 D2 EF 11 71 44 2B 86 4F 1B 98 C3 31 EC 2A .....qD+.O...1.*0020: 84 B5 D1 12 0D 96 02 45 B1 82 B1 35 0E 75 5F CA .......E...5.u_.0030: 7C BC C6 B0 04 9E A8 09 85 81 11 32 05 EA BB AF ...........2....0040: AC 4F ED FC 09 3C 49 AD 32 82 D0 7D F8 58 51 1F .O...<I.2....XQ.0050: 48 6A 2A 7A 65 4D 7E 64 0B 10 E3 C2 57 3E D4 D7 Hj*zeM.d....W>..0060: 7B 57 37 A9 59 57 0D 5E F3 A3 6E FC 22 C4 6E DB .W7.YW.^..n.".n.0070: 91 63 39 93 5D 92 DF 79 91 56 D1 80 56 3B A4 E2 .c9.]..y.V..V;..0080: C5 BB 83 74 39 FC 19 2C C9 A1 8D A2 5B CD 01 D1 ...t9..,....[...0090: 55 9B 40 57 A5 B0 63 2E F3 14 F9 C4 83 DA 1A 74 U.@W..c........t00A0: BF 12 EE 1D 80 E2 40 A4 8E 87 56 BC 02 35 F4 10 ......@...V..5..00B0: C6 7E FF FA 00 01 B7 E9 A9 99 52 57 39 82 76 6F ..........RW9.vo00C0: 91 1C 1A E3 F4 4D 45 87 A3 32 98 6D 6B 82 66 05 .....ME..2.mk.f.00D0: 14 77 72 B7 61 34 CC 1F 7F BB C0 0A 77 51 32 B2 .wr.a4......wQ2.00E0: DA C1 6C 81 6D 16 2E 2C 0C DB 8F 11 A8 07 3B 93 ..l.m..,......;.00F0: 1A FC A0 9D B0 FF 52 B4 BE B9 6A 6E 7A 24 99 73 ......R...jnz$.s] |
Sep 18, 2017 13:10:15.061346054 MESZ | 443 | 49244 | 151.101.0.64 | 192.168.1.16 | CN=GlobalSign Organization Validation CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE | CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE | Thu Feb 20 11:00:00 CET 2014 | Tue Feb 20 11:00:00 CET 2024 | [[ Version: V3 Subject: CN=GlobalSign Organization Validation CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 25128534854946729689874225426937401505000881204706872255627098498474475295641403147428295231173090028665490451781016201369028386293751105000607980749389164896950295472415799544200821826598281622670047877476444380361331431510582219613042406283138772574077178828514459453291208108705648245160199047848714530696719439161049181407350831720090579906068909416515809757315311589912849752912945272005465192109502201681085714022553142452002065884519487869175097916258424515352321964381962068601310395827347949688386139631202235593096601000028863153912492627308071474449386570163993017908691119484112907211941619220357798802161 public exponent: 65537 Validity: [From: Thu Feb 20 11:00:00 CET 2014, To: Tue Feb 20 11:00:00 CET 2024] Issuer: CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE SerialNumber: [ 04000000 0001444e f04247]Certificate Extensions: 7[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.globalsign.com/rootr1]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: 60 7B 66 1A 45 0D 97 CA 89 50 2F 7D 04 CD 34 A8 `.f.E....P/...4.0010: FF FC FD 4B ...K]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.globalsign.net/root.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 26 68 74 74 70 73 3A 2F 2F 77 77 77 2E 67 6C .&https://www.gl0010: 6F 62 61 6C 73 69 67 6E 2E 63 6F 6D 2F 72 65 70 obalsign.com/rep0020: 6F 73 69 74 6F 72 79 2F ository/]] ]][6]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ Key_CertSign Crl_Sign][7]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 96 DE 61 F1 BD 1C 16 29 53 1C C0 CC 7D 3B 83 00 ..a....)S....;..0010: 40 E6 1A 7C @...]]] Algorithm: [SHA256withRSA] Signature:0000: 46 2A EE 5E BD AE 01 60 37 31 11 86 71 74 B6 46 F*.^...`71..qt.F0010: 49 C8 10 16 FE 2F 62 23 17 AB 1F 87 F8 82 ED CA I..../b#........0020: DF 0E 2C DF 64 75 8E E5 18 72 A7 8C 3A 8B C9 AC ..,.du...r..:...0030: A5 77 50 F7 EF 9E A4 E0 A0 8F 14 57 A3 2A 5F EC .wP........W.*_.0040: 7E 6D 10 E6 BA 8D B0 08 87 76 0E 4C B2 D9 51 BB .m.......v.L..Q.0050: 11 02 F2 5C DD 1C BD F3 55 96 0F D4 06 C0 FC E2 ...\....U.......0060: 23 8A 24 70 D3 BB F0 79 1A A7 61 70 83 8A AF 06 #.$p...y..ap....0070: C5 20 D8 A1 63 D0 6C AE 4F 32 D7 AE 7C 18 45 75 . ..c.l.O2....Eu0080: 05 29 77 DF 42 40 64 64 86 BE 2A 76 09 31 6F 1D .)w.B@dd..*v.1o.0090: 24 F4 99 D0 85 FE F2 21 08 F9 C6 F6 F1 D0 59 ED $......!......Y.00A0: D6 56 3C 08 28 03 67 BA F0 F9 F1 90 16 47 AE 67 .V<.(.g......G.g00B0: E6 BC 80 48 E9 42 76 34 97 55 69 24 0E 83 D6 A0 ...H.Bv4.Ui$....00C0: 2D B4 F5 F3 79 8A 49 28 74 1A 41 A1 C2 D3 24 88 -...y.I(t.A...$.00D0: 35 30 60 94 17 B4 E1 04 22 31 3D 3B 2F 17 06 B2 50`....."1=;/...00E0: B8 9D 86 2B 5A 69 EF 83 F5 4B C4 AA B4 2A F8 7C ...+Zi...K...*..00F0: A1 B1 85 94 8C F4 0C 87 0C F4 AC 40 F8 59 49 98 ...........@.YI.] |
Code Manipulations |
---|
Statistics |
---|
CPU Usage |
---|
Click to jump to process
Memory Usage |
---|
Click to jump to process
High Level Behavior Distribution |
---|
back
Click to dive into process behavior distribution
System Behavior |
---|
General |
---|
Start time: | 13:09:49 |
Start date: | 18/09/2017 |
Path: | C:\Users\user\Desktop\CCleaner.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x75860000 |
File size: | 7680216 bytes |
MD5 hash: | EF694B89AD7ADDB9A16BB6F26F1EFAF7 |
Programmed in: | C, C++ or other language |
Disassembly |
---|
Code Analysis |
---|
Execution Graph |
---|
Execution Coverage: | 10.4% |
Dynamic/Decrypted Code Coverage: | 23.9% |
Signature Coverage: | 8.6% |
Total number of Nodes: | 581 |
Total number of Limit Nodes: | 6 |
Graph
Executed Functions |
---|
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
C-Code - Quality: 74% |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
C-Code - Quality: 95% |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
APIs |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
C-Code - Quality: 88% |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
APIs |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
C-Code - Quality: 48% |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
C-Code - Quality: 100% |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
C-Code - Quality: 90% |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
C-Code - Quality: 95% |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Non-executed Functions |
---|
APIs |
|
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
C-Code - Quality: 100% |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
C-Code - Quality: 100% |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
C-Code - Quality: 74% |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
C-Code - Quality: 100% |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
APIs |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
APIs |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
C-Code - Quality: 83% |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
APIs |
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|