Analysis Date2018-03-29 23:13:24
MD5029ca44e160a080b02edba2d29eba623
SHA10d4c6a014a01d84742ab0802cba63fd38efc064e

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section md5: a65880479c880eb9faf870d785a5dd0e sha1: cf64e1c78cee01517bf60355199a53420dc4248c size: 222208
Section md5: b55ccfc7ebd511e7f1b37ae9770f611c sha1: 82dd49d54967f416ed81c29cc8bbd062e3f72024 size: 53760
Section md5: ab2ec0492aead93deb76eb614b8d2a2d sha1: ed57d86499d68838a991de274efc50752f8398f5 size: 5632
Section.rsrc md5: 29f5f3707da7c980afccfb5f4759249b sha1: 4e069332c249095667f28da2aff76c6c2e55652b size: 351232
Section md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Section.678df md5: 34e3cf53db99616f9614d6fe8760cf31 sha1: f7d752363281bdc83037b871a1c1a5e6627a4a7a size: 355840
Section.adata md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Timestamp2014-01-12 07:06:06
VersionLegalCopyright: Copyright (C) 2014-2015
ProductVersion11: 1, 3sdfg, 0, 1
FileVersion: 1, 1wer3, 0, 1
FileVersion11: 1, 1sdfsdf1, 0, 1
LegalCopyright11: Copyright (C) 2014-2015
ProductVersion: 1, 3qrweqwfg, 0, 1
FileDescription: 345sldflsdkflsdkf
PackerASProtect v1.2
PEhashebd306ad42d5aa8e0a9a571ee1c54ab12f397ead
AVavgFakeAV_r.XQ
AVmcafeeFakeAlert-FSY!029CA44E160A
AVmsseRogue:Win32/FakePAV
AVaviraTR/Crypt.XPACK.Gen2

Runtime Details:

Screenshot

Process
↳ C:\Windows\System32\lsass.exe

Process
↳ C:\Users\Phil\AppData\Local\Temp\0d4c6a014a01d84742ab0802cba63fd38efc064e.exe

Creates FileC:\Users\Phil\AppData\Local\Temp\0d4c6a014a01d84742ab0802cba63fd38efc064e.exe

Process
↳ C:\Users\Phil\AppData\Roaming\safe-oydh.exe

Creates FileC:\Users\Phil\AppData\Roaming\safe-oydh.exe

Process
↳ C:\Windows\SysWOW64\cmd.exe

Creates File\??\NUL

Process
↳ C:\Windows\SysWOW64\mshta.exe

Creates MutexLocal\!PrivacIE!SharedMemory!Mutex
Creates Mutex
Creates MutexRasPbFile
Creates FileC:\Windows\Globalization\Sorting\sortdefault.nls
Creates FileC:\Users\Phil\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
Creates FileC:\Users\Phil\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
Creates FileC:\Users\Phil\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\mshta_RASAPI32\EnableFileTracing ➝
0
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\mshta_RASAPI32\EnableConsoleTracing ➝
0
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\mshta_RASAPI32\FileTracingMask ➝
4294901760
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\mshta_RASAPI32\ConsoleTracingMask ➝
4294901760
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\mshta_RASAPI32\MaxFileSize ➝
1048576
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\mshta_RASAPI32\FileDirectory ➝
%windir%\tracing

Process
↳ C:\Windows\SysWOW64\sc.exe

Creates FileC:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui
Creates FileC:\Windows\SysWOW64\en-US\sc.exe.mui

Process
↳ C:\Windows\SysWOW64\sc.exe

Creates FileC:\Windows\SysWOW64\en-US\sc.exe.mui

Network Details:

DNScheckip.dyndns.com
Type: A
216.146.39.70
DNScheckip.dyndns.com
Type: A
216.146.43.70
DNScheckip.dyndns.com
Type: A
91.198.22.70
DNScheckip.dyndns.com
Type: A
216.146.38.70
DNScheckip.dyndns.org
Type: A
HTTP GEThttp://checkip.dyndns.org/
User-Agent: Mozilla/4.0
HTTP GEThttp://93.115.86.197/?0=13&1=0&2=10&3=i&4=2600&5=1&6=1111&7=rerhvhdjjd
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
Flows TCP192.168.1.1:1031 ➝ 216.146.39.70:80
Flows TCP192.168.1.1:1033 ➝ 93.115.86.197:80

Raw Pcap
0x00000000 (00000)   47455420 2f6e6373 692e7478 74204854   GET /ncsi.txt HT
0x00000010 (00016)   54502f31 2e310d0a 436f6e6e 65637469   TP/1.1..Connecti
0x00000020 (00032)   6f6e3a20 436c6f73 650d0a55 7365722d   on: Close..User-
0x00000030 (00048)   4167656e 743a204d 6963726f 736f6674   Agent: Microsoft
0x00000040 (00064)   204e4353 490d0a48 6f73743a 20777777    NCSI..Host: www
0x00000050 (00080)   2e6d7366 746e6373 692e636f 6d0d0a0d   .msftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f6e6373 692e7478 74204854   GET /ncsi.txt HT
0x00000010 (00016)   54502f31 2e310d0a 436f6e6e 65637469   TP/1.1..Connecti
0x00000020 (00032)   6f6e3a20 436c6f73 650d0a55 7365722d   on: Close..User-
0x00000030 (00048)   4167656e 743a204d 6963726f 736f6674   Agent: Microsoft
0x00000040 (00064)   204e4353 490d0a48 6f73743a 20777777    NCSI..Host: www
0x00000050 (00080)   2e6d7366 746e6373 692e636f 6d0d0a0d   .msftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f6e6373 692e7478 74204854   GET /ncsi.txt HT
0x00000010 (00016)   54502f31 2e310d0a 436f6e6e 65637469   TP/1.1..Connecti
0x00000020 (00032)   6f6e3a20 436c6f73 650d0a55 7365722d   on: Close..User-
0x00000030 (00048)   4167656e 743a204d 6963726f 736f6674   Agent: Microsoft
0x00000040 (00064)   204e4353 490d0a48 6f73743a 20777777    NCSI..Host: www
0x00000050 (00080)   2e6d7366 746e6373 692e636f 6d0d0a0d   .msftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f6e6373 692e7478 74204854   GET /ncsi.txt HT
0x00000010 (00016)   54502f31 2e310d0a 436f6e6e 65637469   TP/1.1..Connecti
0x00000020 (00032)   6f6e3a20 436c6f73 650d0a55 7365722d   on: Close..User-
0x00000030 (00048)   4167656e 743a204d 6963726f 736f6674   Agent: Microsoft
0x00000040 (00064)   204e4353 490d0a48 6f73743a 20777777    NCSI..Host: www
0x00000050 (00080)   2e6d7366 746e6373 692e636f 6d0d0a0d   .msftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x00000020 (00032)   6c6c612f 342e300d 0a486f73 743a2063   lla/4.0..Host: c
0x00000030 (00048)   6865636b 69702e64 796e646e 732e6f72   heckip.dyndns.or
0x00000040 (00064)   670d0a0d 0a0d0a48 6f73743a 20777777   g......Host: www
0x00000050 (00080)   2e6d7366 746e6373 692e636f 6d0d0a0d   .msftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   504f5354 202f3365 31363236 34372d63   POST /3e162647-c
0x00000010 (00016)   3364382d 34346333 2d393937 622d3061   3d8-44c3-997b-0a
0x00000020 (00032)   63396135 66363838 33322f20 48545450   c9a5f68832/ HTTP
0x00000030 (00048)   2f312e31 0d0a4361 6368652d 436f6e74   /1.1..Cache-Cont
0x00000040 (00064)   726f6c3a 206e6f2d 63616368 650d0a43   rol: no-cache..C
0x00000050 (00080)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000060 (00096)   0d0a5072 61676d61 3a206e6f 2d636163   ..Pragma: no-cac
0x00000070 (00112)   68650d0a 436f6e74 656e742d 54797065   he..Content-Type
0x00000080 (00128)   3a206170 706c6963 6174696f 6e2f736f   : application/so
0x00000090 (00144)   61702b78 6d6c0d0a 55736572 2d416765   ap+xml..User-Age
0x000000a0 (00160)   6e743a20 57534441 50490d0a 436f6e74   nt: WSDAPI..Cont
0x000000b0 (00176)   656e742d 4c656e67 74683a20 3733330d   ent-Length: 733.
0x000000c0 (00192)   0a486f73 743a2031 39322e31 36382e31   .Host: 192.168.1
0x000000d0 (00208)   30302e31 35313a35 3335370d 0a0d0a3c   00.151:5357....<
0x000000e0 (00224)   3f786d6c 20766572 73696f6e 3d22312e   ?xml version="1.
0x000000f0 (00240)   30222065 6e636f64 696e673d 22757466   0" encoding="utf
0x00000100 (00256)   2d38223f 3e3c736f 61703a45 6e76656c   -8"?><soap:Envel
0x00000110 (00272)   6f706520 786d6c6e 733a736f 61703d22   ope xmlns:soap="
0x00000120 (00288)   68747470 3a2f2f77 77772e77 332e6f72   http://www.w3.or
0x00000130 (00304)   672f3230 30332f30 352f736f 61702d65   g/2003/05/soap-e
0x00000140 (00320)   6e76656c 6f706522 20786d6c 6e733a77   nvelope" xmlns:w
0x00000150 (00336)   73613d22 68747470 3a2f2f73 6368656d   sa="http://schem
0x00000160 (00352)   61732e78 6d6c736f 61702e6f 72672f77   as.xmlsoap.org/w
0x00000170 (00368)   732f3230 30342f30 382f6164 64726573   s/2004/08/addres
0x00000180 (00384)   73696e67 2220786d 6c6e733a 6c6d733d   sing" xmlns:lms=
0x00000190 (00400)   22687474 703a2f2f 73636865 6d61732e   "http://schemas.
0x000001a0 (00416)   6d696372 6f736f66 742e636f 6d2f7769   microsoft.com/wi
0x000001b0 (00432)   6e646f77 732f6c6d 732f3230 30372f30   ndows/lms/2007/0
0x000001c0 (00448)   38223e3c 736f6170 3a486561 6465723e   8"><soap:Header>
0x000001d0 (00464)   3c777361 3a546f3e 75726e3a 75756964   <wsa:To>urn:uuid
0x000001e0 (00480)   3a336531 36323634 372d6333 64382d34   :3e162647-c3d8-4
0x000001f0 (00496)   3463332d 39393762 2d306163 39613566   4c3-997b-0ac9a5f
0x00000200 (00512)   36383833 323c2f77 73613a54 6f3e3c77   68832</wsa:To><w
0x00000210 (00528)   73613a41 6374696f 6e3e6874 74703a2f   sa:Action>http:/
0x00000220 (00544)   2f736368 656d6173 2e786d6c 736f6170   /schemas.xmlsoap
0x00000230 (00560)   2e6f7267 2f77732f 32303034 2f30392f   .org/ws/2004/09/
0x00000240 (00576)   7472616e 73666572 2f476574 3c2f7773   transfer/Get</ws
0x00000250 (00592)   613a4163 74696f6e 3e3c7773 613a4d65   a:Action><wsa:Me
0x00000260 (00608)   73736167 6549443e 75726e3a 75756964   ssageID>urn:uuid
0x00000270 (00624)   3a316639 64353130 662d3262 38312d34   :1f9d510f-2b81-4
0x00000280 (00640)   3033322d 39633565 2d316565 65633663   032-9c5e-1eeec6c
0x00000290 (00656)   39646432 373c2f77 73613a4d 65737361   9dd27</wsa:Messa
0x000002a0 (00672)   67654944 3e3c7773 613a5265 706c7954   geID><wsa:ReplyT
0x000002b0 (00688)   6f3e3c77 73613a41 64647265 73733e68   o><wsa:Address>h
0x000002c0 (00704)   7474703a 2f2f7363 68656d61 732e786d   ttp://schemas.xm
0x000002d0 (00720)   6c736f61 702e6f72 672f7773 2f323030   lsoap.org/ws/200
0x000002e0 (00736)   342f3038 2f616464 72657373 696e672f   4/08/addressing/
0x000002f0 (00752)   726f6c65 2f616e6f 6e796d6f 75733c2f   role/anonymous</
0x00000300 (00768)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000310 (00784)   613a5265 706c7954 6f3e3c77 73613a46   a:ReplyTo><wsa:F
0x00000320 (00800)   726f6d3e 3c777361 3a416464 72657373   rom><wsa:Address
0x00000330 (00816)   3e75726e 3a757569 643a3034 31383461   >urn:uuid:04184a
0x00000340 (00832)   30382d30 3537332d 34613535 2d383239   08-0573-4a55-829
0x00000350 (00848)   652d3532 34313262 37326330 63373c2f   e-52412b72c0c7</
0x00000360 (00864)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000370 (00880)   613a4672 6f6d3e3c 6c6d733a 4c617267   a:From><lms:Larg
0x00000380 (00896)   654d6574 61646174 61537570 706f7274   eMetadataSupport
0x00000390 (00912)   2f3e3c2f 736f6170 3a486561 6465723e   /></soap:Header>
0x000003a0 (00928)   3c736f61 703a426f 64792f3e 3c2f736f   <soap:Body/></so
0x000003b0 (00944)   61703a45 6e76656c 6f70653e            ap:Envelope>

0x00000000 (00000)   504f5354 202f3365 31363236 34372d63   POST /3e162647-c
0x00000010 (00016)   3364382d 34346333 2d393937 622d3061   3d8-44c3-997b-0a
0x00000020 (00032)   63396135 66363838 33322f20 48545450   c9a5f68832/ HTTP
0x00000030 (00048)   2f312e31 0d0a4361 6368652d 436f6e74   /1.1..Cache-Cont
0x00000040 (00064)   726f6c3a 206e6f2d 63616368 650d0a43   rol: no-cache..C
0x00000050 (00080)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000060 (00096)   0d0a5072 61676d61 3a206e6f 2d636163   ..Pragma: no-cac
0x00000070 (00112)   68650d0a 436f6e74 656e742d 54797065   he..Content-Type
0x00000080 (00128)   3a206170 706c6963 6174696f 6e2f736f   : application/so
0x00000090 (00144)   61702b78 6d6c0d0a 55736572 2d416765   ap+xml..User-Age
0x000000a0 (00160)   6e743a20 57534441 50490d0a 436f6e74   nt: WSDAPI..Cont
0x000000b0 (00176)   656e742d 4c656e67 74683a20 3733330d   ent-Length: 733.
0x000000c0 (00192)   0a486f73 743a2031 39322e31 36382e31   .Host: 192.168.1
0x000000d0 (00208)   30302e31 34363a35 3335370d 0a0d0a3c   00.146:5357....<
0x000000e0 (00224)   3f786d6c 20766572 73696f6e 3d22312e   ?xml version="1.
0x000000f0 (00240)   30222065 6e636f64 696e673d 22757466   0" encoding="utf
0x00000100 (00256)   2d38223f 3e3c736f 61703a45 6e76656c   -8"?><soap:Envel
0x00000110 (00272)   6f706520 786d6c6e 733a736f 61703d22   ope xmlns:soap="
0x00000120 (00288)   68747470 3a2f2f77 77772e77 332e6f72   http://www.w3.or
0x00000130 (00304)   672f3230 30332f30 352f736f 61702d65   g/2003/05/soap-e
0x00000140 (00320)   6e76656c 6f706522 20786d6c 6e733a77   nvelope" xmlns:w
0x00000150 (00336)   73613d22 68747470 3a2f2f73 6368656d   sa="http://schem
0x00000160 (00352)   61732e78 6d6c736f 61702e6f 72672f77   as.xmlsoap.org/w
0x00000170 (00368)   732f3230 30342f30 382f6164 64726573   s/2004/08/addres
0x00000180 (00384)   73696e67 2220786d 6c6e733a 6c6d733d   sing" xmlns:lms=
0x00000190 (00400)   22687474 703a2f2f 73636865 6d61732e   "http://schemas.
0x000001a0 (00416)   6d696372 6f736f66 742e636f 6d2f7769   microsoft.com/wi
0x000001b0 (00432)   6e646f77 732f6c6d 732f3230 30372f30   ndows/lms/2007/0
0x000001c0 (00448)   38223e3c 736f6170 3a486561 6465723e   8"><soap:Header>
0x000001d0 (00464)   3c777361 3a546f3e 75726e3a 75756964   <wsa:To>urn:uuid
0x000001e0 (00480)   3a336531 36323634 372d6333 64382d34   :3e162647-c3d8-4
0x000001f0 (00496)   3463332d 39393762 2d306163 39613566   4c3-997b-0ac9a5f
0x00000200 (00512)   36383833 323c2f77 73613a54 6f3e3c77   68832</wsa:To><w
0x00000210 (00528)   73613a41 6374696f 6e3e6874 74703a2f   sa:Action>http:/
0x00000220 (00544)   2f736368 656d6173 2e786d6c 736f6170   /schemas.xmlsoap
0x00000230 (00560)   2e6f7267 2f77732f 32303034 2f30392f   .org/ws/2004/09/
0x00000240 (00576)   7472616e 73666572 2f476574 3c2f7773   transfer/Get</ws
0x00000250 (00592)   613a4163 74696f6e 3e3c7773 613a4d65   a:Action><wsa:Me
0x00000260 (00608)   73736167 6549443e 75726e3a 75756964   ssageID>urn:uuid
0x00000270 (00624)   3a393364 39393733 392d3962 36322d34   :93d99739-9b62-4
0x00000280 (00640)   3236642d 61616237 2d343161 36376437   26d-aab7-41a67d7
0x00000290 (00656)   30613631 323c2f77 73613a4d 65737361   0a612</wsa:Messa
0x000002a0 (00672)   67654944 3e3c7773 613a5265 706c7954   geID><wsa:ReplyT
0x000002b0 (00688)   6f3e3c77 73613a41 64647265 73733e68   o><wsa:Address>h
0x000002c0 (00704)   7474703a 2f2f7363 68656d61 732e786d   ttp://schemas.xm
0x000002d0 (00720)   6c736f61 702e6f72 672f7773 2f323030   lsoap.org/ws/200
0x000002e0 (00736)   342f3038 2f616464 72657373 696e672f   4/08/addressing/
0x000002f0 (00752)   726f6c65 2f616e6f 6e796d6f 75733c2f   role/anonymous</
0x00000300 (00768)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000310 (00784)   613a5265 706c7954 6f3e3c77 73613a46   a:ReplyTo><wsa:F
0x00000320 (00800)   726f6d3e 3c777361 3a416464 72657373   rom><wsa:Address
0x00000330 (00816)   3e75726e 3a757569 643a6233 63393439   >urn:uuid:b3c949
0x00000340 (00832)   65302d36 3430382d 34316133 2d616234   e0-6408-41a3-ab4
0x00000350 (00848)   622d6636 36306361 62623136 66663c2f   b-f660cabb16ff</
0x00000360 (00864)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000370 (00880)   613a4672 6f6d3e3c 6c6d733a 4c617267   a:From><lms:Larg
0x00000380 (00896)   654d6574 61646174 61537570 706f7274   eMetadataSupport
0x00000390 (00912)   2f3e3c2f 736f6170 3a486561 6465723e   /></soap:Header>
0x000003a0 (00928)   3c736f61 703a426f 64792f3e 3c2f736f   <soap:Body/></so
0x000003b0 (00944)   61703a45 6e76656c 6f70653e            ap:Envelope>


Strings
02ab4vz0
1, 1sdfsdf1, 0, 1
1, 1wer3, 0, 1
1, 3qrweqwfg, 0, 1
1, 3sdfg, 0, 1
345sldflsdkflsdkf
APPROVE
Copyright (C) 2014-2015
DECLINE
DFGHJKL100
DFGHJKL1001
DFGHJKL10399
DFGHJKL111
DFGHJKL1122	DFGHJKL13
DFGHJKL134	DFGHJKL14
DFGHJKL160
DFGHJKL177
DFGHJKL18211
DFGHJKL190
DFGHJKL201
DFGHJKL202
DFGHJKL203
DFGHJKL204
DFGHJKL205
DFGHJKL206
DFGHJKL207
DFGHJKL20797
DFGHJKL208
DFGHJKL20804	DFGHJKL21	DFGHJKL23	DFGHJKL24
DFGHJKL240
DFGHJKL250
DFGHJKL274
DFGHJKL300
DFGHJKL301
DFGHJKL302
DFGHJKL303
DFGHJKL31048
DFGHJKL337
DFGHJKL349
DFGHJKL350
DFGHJKL351
DFGHJKL36867
DFGHJKL36869
DFGHJKL36871
DFGHJKL368711
DFGHJKL36872
DFGHJKL36884
DFGHJKL38738	DFGHJKL47
FileDescription
FileVersion
FileVersion11
FLASH
FORM
LegalCopyright
LegalCopyright11
PANEL1
PANEL2
ProductVersion
ProductVersion11
SETTINGS
StringFileInfo
VS_VERSION_INFO
-@[[,[
:-_\*"'	
)>%|<,
$#'^{~
0!#_*#
,"0@48
09Q*kG
0}:Aoq
0<B 6@
|0c_,N}AP
0(CPk;
0gp"3[
0h:Wz$
;0$I}1)
0KU>TmxW
@0LkZKB
0LZOaW
0pGxUvE
0^q7@FO
.0R\%E
0rkTm;
0R"mya
0:t,c[
0uxkVn:
_0v	~r
}0=vUk@
0wm1E;
0^W.t=
;0x.Ty
;0.yGp
;1<^=&~>
(1]{>]
10:Bhm
1,_?A&0
1b|!a2
1b%J%f
1dDS6P
+ 1fCv 
+.'1GV
@1H.1yo
1 %*`i
.}1m0U
1M+3Dy
1}M.iD}
1&MOb/
1$_oEX
1oMZpc
>1}pdFj
-1qkz3
 1Q!O4l
1R2/F*
>1|R^C
1{trpI
1u(xQK6
1	w!fce.
1xa|,F
 1X{L{
1XYVfMk
1zHsM:
+2*>-:
2):[*,
"]\22D
24	+76
2.@4\Q
2^5gvJ
263`Ig
26m(0.
2\7,OyS
2A<Jg$
:$2-aP
]2	AY7
!2B^N!V
2cGmyd
}2\>d\
2ee|nx
2EV{RA
2f4c9X
2FIMN2
2}\gICb
2(H>f9B$
2i@'U*
2i?U8Q
2jbWR=
2Jz6]|
2m'.hS
>2M\uR
2mXYL;
2p]<}"
-2,QZw
2~_=\r
2r].Jt
2t}]IR=
2\-&#U
2u{Ovrk
2x+hHA
#2X[-woJ3
.33Wynyc
34bQ%TE
38 z#)z
3]938d[L
3bm`I-
3Cg&aN
!.3@^D>
3D$ec<
3k!Wn]
3[lfxZmXD
3\lyGw
3mgng^c;&
3/P-!px
3_) [s(
3@%U6c=
)<:3VF
3_/	w/
3xry1*}0JZ
3Z$/A	h
3ZM%7C
42}(AB
4~4q '
*44q%O
45#4!m
46*nnGo
47l4}S
>47$SQ/
4a-wmJ
4BIL5I
4b"j}CJ
4_?btP7
,4D{"+
4@d%1& 
4>d_*V
4E`[41ZV
4g">dN|
4HVH6B
4k(|!$5
4NQ>Bc
4Q%axD
4S`OlX
]4}>t[	
4tB,]4
4	!}tZz
/-4u~==3
\+4VF'g
"4}vhv
4X(W%K
@4]YdH
`4`+_z
;4_]=`z
5  0J5
5#1T}]K
#56	c}
5&97sgD
5A'IEk
\="5bXu
5E5z5^
-5.fyW
5h4|MnV
^5hgQQ
>5HJ$d!
&#\-5I)
5j4if%
.5jVdt
5K1tGH
{[5>l,
5lO$Mj
5"MUQO
5n.4<2O
:,5N*6`<(4
5o/_4a
;5:!pk
 5.R-,
5rJ4]S
\5(/RW
5UXatd
5YGI|`v
<&=.>6?
6&2/8`
62^_d!
64ORPU
%64wqG
.678df
67aQm3
#[6_ C
(6&efm
6eQ|qH
6E'v}I7
/#6,g(1
@6gfoU
6H<2u$qv
6	'!Ho
}<6:.[~I
6J/' Zg\*
6ke^5F
6klVJU
6"[kY,
6L"6=w
-#|6~n
6-P|0L
_]6plL
6rYkd[
6;w]w5L
='.! 7)
7.;='#
70s&L d
72}TUD@
7[2va2}Q
77@n}M
789+/=
/{7FJVE
7*g"}~
7!GD5b(
*7G	oK>&
|7%}HS[
7kI:Q)
7,;L"<.^Pas`
7m5`Hi
7{mOXNa
7+n4fl
7RP'	>
7sEYORm$
<7.tD!
7tj+Ng
7!VNFwmrGd+H
7|VUBR
7w;d_t
7`-WTl
7yyivB[7
,7Z/d^
[80`:K
~8}0Uq
)8@=),2
8[42CU
8>_5Ry7q
8	7cdp
8$7Y?VVm
88e]z'F
8Al'_Uv
%{8+\aT
8AYc.J
8b%AgB
8C~W\G
8]\(Du
8ejSB9
8>Gw/g
8<&,ha
8+,_n7o
8+Oi5K
%8P9n~'
#8qvWk
8r#((8B
:}8tc7`
91m'eTi
92=}&Vj
93KK`}#
(93M:V
@94}Q=
95U2w9e
9<>/^a&
9bq#BY-(
9c|$B>H<4
:9CL*/6
[9]`&g
.9[GON
9G:V0UXekY
9 +h~s,
9Lm?"J
9L}q@u*W
9&lWRHX
9}ly|H
9*N|>N
@9O]58
9&	;od
9Op!u&,<
; 9PAd9
9~P:T;X$\
}#_9T+
(9Ts3G
<!9T&x
$9]tyr
^9VDBc
9VY'Nv
#9w7rd
9W/L_OI
<9=X->
9Z\r=`#
)&A$\@
>a3=uq
a4~Pc.A
a6(4#U
A>986J
aAY2#4in:
@Ab*9c
ABCDpE
+$A+-C
acV`b~
.adata
advapi32.dll
'aE'5+
AEur{l.
&a,(F2
aGXe	|
%:a&h$
a?@i}]
aI2Ky3|
ajuH`x
aL2k}Y'),W
AL,p~MC
Am:*>&_
A$MD\[
AmGehx
AmgXpy
+a"M)o
A|^M/u
An*2V\ 
and`	$j
aoC{!%XL
=a[,OV
(\Ap{}
A(QKn$
ARE\Borl
A	r+H"
a=R(o3
As3d>#{
</assembly>
      <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
aTGq>|
aTn=H^
\;A]t X
,Au)(L
?A('	V
(/,aV<c
A%.VOR
aW!n$y
axmmrO
!A!yG=
;AY\oh;et
.aZF"+\
!b$_<<
=[b?:#>0
B_1$^o
b1uhsY2
b#2lnS
B2?Tv>
b2}u2.
B~4I7U
	#^B84
&b8E+:
-B8n'@
^`b8qU
b8U@>ul
B9nbjP
B9]O%J<
'#b}$af
_(b]AV6
bbBy2j
%b B[K
-bbmt/
%BC%\l9
B>cZpb
b	DIlJ
B~dlom
:;b[E}
$* be5
BeginDeferWindowPos
BF/0	f
&BF]8`
BFK*uZ
bgD{/mC
%bGY^=
:BhkR@v
#b-\HM
bi({^\
()BJ(%
BJ^){:
bKivD#
bkmo:v
`bKp=rk
'bM&0`kI
bmZ`Nh
bnMFc]
bQh\UR
bS?1%8
`<BS8P@
Bsc'":
"bTZ8QL<
B{uhSZ
BV&b xF
B@VNztLG
bv~ydVC
B%[wf+
{bX2q<
bXgygd
b^Xp!$d
~%BYrJ
Bz.	)e
'c*;$>
C~1!-C`
:C.1k^	
c*.`2,G9
C2{p[+%
?c 7o:
-`c80.
c80*qF
C}8F|G,
cA[65#
CAQg1S
Cc@5Cm
{}Cch`u%V#x\
CciW_sS
cDCxn.U
CDEFW 
CDhN	t"
cefA5w
cefT_2
Cgfrn0
)<(c"H
CH~KUN
chsHf_
{}	CI%x
c^Jx$s
[|ck|}"
Ckgv-]
$~cM>\!
CM1`nnj
?CMVO_F
%>CmwV
[^c>Nj
cn@]P+
CO}2`x&$
cocbKO
comctl32.dll
comdlg32.dll
CO.M>v
CoTaskMemAlloc
cPDAvr;
}cPE.	;f
%CpT2I
cQrA`[/
%c_rd0
CreateStdAccessibleObject
%C`rZ@)
Cr+zp=
CRZR,DrW
c&Sm{m
<csZ[N
c\t_1V
C,/v`0
cv#	q,9n
CVQ#@FD*
c!w}6bI
{cW7_0g
C%Wa^p0
. (C]Xe
]C-&,Z
>C?ZS	
)=d<|~
d1*3Ef
D2(4	Gy}"
D_-\2f
D63zxc0m
d/{9mus\
d{~B-t
d<bw')cw
DC7,\Gb'
>dDB-k
DDj6KzF
@dD	lH
  </dependency>
  <dependency>
    </dependentAssembly>
    <dependentAssembly>
d	,ePg
>%Df-~
'df%0c@
dF4ADpl
D'(G\0
D+g{0F$
D@G50\
<DH0R+4U
<Dh^3wO
D|hc3`
Dhde?4"C
D!H^Lt
Dii^:o
D%]In^7
DJBHc4
d=ji_3
^dJn@A
~}.{dk
Dka9_A
	*"<DL\
d^nQ@	
&}d(O8
d/%P QX
dQhDsk
dQiAI;
dr:]|o
d\tJE+
\dT]#L
D#t)O:
DV;<]8
dV	Plp
dV	%W?
DwGq%G_
d:wm${
dx.>Kl
`dy.I_!.
d-Y\x0b)
DyZ9s9j
@[DZ4;
*DzEILfpU"m!u
DZ@OFi
|> ?$'(E,
*E0_72]
e0j:i-
$\E0mS
e0Yst8
e27%)H
~e#5\Wj
e78]X<
e'{85w
e8F9	J$N
,E>8}_Xq
e,@8yo
eA}4CZ
eai Lf
|{eAw<X
eB7tOFCf>y
ebg'hT
e^	c9f
e?,d.Dj
e,<Dg`0
	EdituQ
E+F_0+
]!"E@G:
"e%/h|C
`ei0*e
E-jFDd
eKlzqU8
?E@`$l
&elD?J
e[&lHp_|=
EL'oIA
e\l?Qk
	emA%L`
E[MHK%
EN7)"XuCCiL
 En^h5
-E/nL8
Enu`!R
eOy*<1
Ephm@wc
ePr>Al;
eQ'*9IV9
(eqfl%i
(.EqO%
#er<Mb0
?erP(/Y
Escape
@EStre
e:t PX<@H
<e-#tQ
E>V0!*
\evS`I
E;X*.D
EXSMQ)
e{yK\t'
<EYQ1	
ezc1;w1p
	|Ez:f
EznJ%#x
>:E=ZP
EZPKhA
!EZZ)'
^\f,{[
/f>0#D 5
F1"X}q
f2_DPS?8
f/2{\maE
:}F3ir
f3%n#t
 F|3V*
.F58:u
<f5CvkIK,
F7GH[ 
F8ydBY
f'9"r#
FBoM8u'
{fb<v!
+ fB$?x
#fCH_=
(Fc[Jo
F(	D,*
fdKc@U^
FdRzgc
f"EaU`,
f[E,_]c
FE\)Of
F*gfv>
FGHIJKLM
F$Io&"Z
fj^>fSS
%f[#_K
 	^~fK0Gk
FLND(e%,
 fMHw(%
F`.[N3
"fO5q<:NW
FO: H9
>Foq$;P
FQ}9FB
F:]qkd
f,=r.<
Fr?;=&!
FRJV2@
FSb~QQ
fSl;t]
f:@?So
FT(8tf
@|;ftw
:FTz"g*
}F]vIW
f"W[`[k
,FwnT9
;$FwVb
_ ;FXQ
?#fzS[
G0(;TC
G0.XW"}h
 g1\YD~
g!%5Ce
G5hfzr%?
-G.[5$TB
'gBGbLa
gbVx[4
gdi32.dll
GdipGetImagePaletteSize
gdiplus.dll
&gE^Mk
GetFileTitleW
GetFileVersionInfoSizeW
GetModuleHandleA
GetProcAddress
GetProcessImageFileNameW
;(GeWb
GF(H0OP
'!G)g3
]g;G	d+
GhlfQ|
g:`iKh
gj/3-_Yp
G(j?/57t
#g.jH0=R
g=k/B_-0omZ
gkdY6n
g/K$J{
$|Gk:R
GK>xW>(
G}kyj?7
gL&bm&
glgj\%
G_$M<~
Gn3p\Q
`GNnvW
go>b}h
Go*=G"U
g-olw)
gp2MZ.D
g|]pB/
gQ"#3?12S
gQd+7?
&G/QUs?|
;{G]r_
gR0&@;T
GradientFill
gR eA	)
(G=sN3{
G%TR'G
gtz$">
<;gU-0
:GUhS^
gxepR-0
gyRg/R
Gz}d\$
,	g-zlU
gz*|#s
Gzv$y*
h{}$)`
`>?H)+
; @H=-
}]	~H.
	h04M//<
@h0GvMO
H2Fr(Wp
h# " 5%[
"}H5K=
^H6H=]
H6vq#ex
`|h8Oo`
h9d=x-
H	~9m#
HAhRB=
H+a{-r
H_.b2pte[K
H|b="R
=Hc'OD^
H"\D<@
Hd;e	 
HdO'gy
]>H`[E
HF[4g`
hGEh,C
_@=H>H
h?|HApA
hhH|%08
,,hhJh
hH`lK{
h{-HOI
h`Hzm7
hijklmnpo
	.hJ}Xge
hKN>p%
hLL1:(
HMC4>b
HM]?Q(B
#h)*NN
{HNP_D
hn	TN9
H'o5}TD
Ho'I{Q
/h&P2.
hp_aCV
H<ph*Z
hPi!	"
@:H;P,X
h>p.xp
H(Q$_/
-h!+qL
hR`#Rv 
.Hs!	L8D
ht2-l\O
H::tKD
h&*u:0E*
@#hUoR
hVP#q@
Hvx$y(
h")W+1
hXikC").F
hz|b.!
hZorIQ
hZqi@D8
.$i0(3
I;5!	48
i\+581
<I5@g`
I'(5s0
]I)7is
I`7{STh
i\[$B"
(I:b>.
ibm.Ff
#i$)C1U|
icO]ql
iCoqze
i_cP*w
+iD'b.
,idu#d
i~Dw=$Y
Ie5m9u{
ieHVU{
i$]Ep+
	i~*Ey
I!f&H0
>iG?_^}
igFL)T
" iH-A
=,:Ihj
I;HYLIV
II#.=Oy
i&_|IU
I_/ka~
I$LI=<
ILY[b,-qs
`i~/mU
IN.ASQf
InternetOpenA
+iOH~GxZ
i=O=LrY,
io@^\n
Ipt kl
"~#[It
*)it>.?k
i"'U<`
IV=r(K8
ivzr-O
Iw8(T/!
{_iwz/Y
ixC[^d
IXI|3"
Iy2&!L
iyWxQJ
j,04?SUN^
J0b@	Ll
.j1x4]
j2RMzy
+J@2#v
j4)%?~
J~4s"[
j4YD%4,Q
J5(L-%
^?J5l,p
J5~m\I
&j5" V
j%6>&fg
J&{6K:<=
J8'2pS
j9'rkB
Jac@P`
j):\A)(%dg0R
jA*'jS_
|j.B_h
/JF>dhe
JfpO|h
j$(Gf5#Y3
JGklZ;
Jh52/	
jI\-:H
J-IYQr
*J&-+J
(jkdTS
J}K:o|
jLfOYs
<[j]lKb#""
"J?md<
><Jml2L>
J*mPG4
Jn[#@#uj,z#
jO4qfM?
jO\;dZx
,j-O/J
J.,opY
Jo#s\qi
j&P1M$
J{p$7/
Jq*DA_
JqiGyx
jQ)p5#g
,`jQ@q4
jsJS\IO}
js{`*T{
?j#$=T
|jtr=Me
j/v4%vZ
jv#f5h'
j>v&ng
jVYvvq
jw*.<#
>_jWfw?$
Jwz3;T
jX'B?	
jXG'W &
JxSJi 
J"z]`_
Jz3[[j
\:K0&>
K0i[~N7
K0y%6n
K1rWOd
K1x%Nt
_K2CHvc
k9!BJM
}K	9+N
k9zxUv#
kA15M,
KAu.La~
?Kblro
$kb}t7
kDFaKqn u
K}dF^o+
K+.dk6&,M
ke)#(g
kernel32.dll
KeW%d`
Kg#[0Q:
KG~&42Q
;!KG.k
KHyVEK
}(:*Kj
KjXvG<
%/,kk+
kK3u`r
k}KmnT
Kkw'{-^d
K?lQtm
Kma1;_
kML5<\
Kmp@u 
K\M 'r<
KO++P	F({
=ko vq
kOY]nV*4
_	kPd~
K	P,~M
	kPma `f
Kq5kLm
KrYq<.
K TSuUW
"K$u~P
kV2R`ii
kVeoi>
K~>v_ki
KV!lHw
*k=w.0v
^=~KW~Mq#
kWP|=?e
[&kW r
kx=w1j
K?-y`"j
K|yPq4
)!<*{'L(
l32:.d
~L_,6j
l?7Hv4
$&l	9/
Lai\#J
L;aV,WP
LcFDv|W
]@L=D1
"l_e5Vf
L {EVV
l'$eX{
+&l(F}';
lg4vcY
Lh}E;(
L&h&Qt
;LH(WZg
	LibcP
LIH0X:
`L*IOv7
lI't')|
lmgX`@|
LMQOu,9
L=<myQ
LN!(}\	
Ln46QUM!Y
lO"1%hk
LoadLibraryA
L'PGTg`
>*lQ5-
lQa'`Q
LR)-Q/
L[^&RTq
l%S%)x
;\<l=u>
"l[?[v
LvkTX|.&
LVzNA`@
LW~i 2
L}wM<bh
(L?~\X
Lxn.	<,
L$y3&t]
<+},M?%
M%2oLz6G
M5G_eY[	3NM
m'5^KB
m.6O:fB
m7 qD=
/m9D<ZO3
 :m/:9O
MaQCF!"
?:mA^Y
m(@+cqd
!>M,-d
MD#C!4d
^"mDH|
M/Dq=2'
m~Ds&"
M;dS-my!p
mefQ|W
>M[eN%
MEuDA?
mf4`8Np
M"g+,3
mGA*/%W
M{HeGg
 ?MHn~X%P
/{&m"I
Mi<CNT
mi"%n_/\h
MKGgCk
mk^I__:/
mM%.=t
mnpqrst
Mo	[d&
mog4}{
mP0f#/y#
mP#lkT;
mQ~]C|
m$QdLR
[M#;qE
?m!Qv.
M<QX/h
m~}rCId
mRks'4
msimg32.dll
Ms'W#CE
m|;TJoD+Em
mu1-&^wQ|#
=.|mV[
`?mVq3k
Mw>5+u
+]mWNQ;
m@wtCus
mXZ8)V
m~@]]y
M/ y&s
>MyuP7|
<]|Mz;
"#n>0!
^N~2}g
N>2,S53
N|(3CG
~_n4UHo
n!*6Li
;,N>7m
{N:.9x
?n/a9`
nA%tE^
NA*u%6
`Nd7~>Q/
\NDwR_4
	Nd",&Z
nei#a`
>Nekf~{OQj
netapi
Nf8M!G
NFakK.; 
%N%-fdQ0
N)gGfQ
_N.Gu3	
;?&;Nh
_N=(hO
n(HUd%*
nHv_`0%
NhW~.g
N\iaDE
nii #zV0
n{,i(!t
n.^JU6e
-NKC H)
\?nkS`)q3XNE
]NMB:y
NnO{4R
N.N.>y
<*No;4,
'nOg~`
not2fI
nOyrJL
\nP?$9
Np9}X*
NP#f'uur?]Pb|H
N(P%$;hl(
NpI:;?
n(pI[k
NQ#g3j
n|RN81
|n~rR	
nRY 85
[n,T8J
nv<mc6
]$n<wa
>nX22o
N[<XD0
nxP<&^:
nxVThr
N.^@%Y.Iw
n'z/m`J
Nzz	r(
~<,%(,o
,o0@I8
O22Q%&
O<2P/s
O%3	9I
*o[|6[
o7B(j_
o7~>zZ
o8	`#B
!oAIB)I
_O|b]LO~)
&>o"bp<
)o	Bre:1@
O^BW-sf
oC?pEc
oD`A#(
+Oe9{1d
ofa>aB6
oga.qI
Og}r0[
OH@WP(
O#il!}
	\[O]l
ole32.dll
oleacc.dll
oleaut32.dll
oledlg.dll
OleUIBusyW
OMA<U3DL
oN24j;v
o_ne7l`
OnLRvO
OoK3^M
O\ow4W5
OpenPrinterW
O'?}PF
OPQRSTU
%Oq`L>
{OR#@cq
orPe' 
OSRj(2
OuAqmsw
OUmmc1
OUskt*|
o-$*"W
#Ow#=t
OW!v	P
OY	+|D
o|Z$~.
\`~p^^
P01'kFL
;p[)0p
p1oTUG&|
P2%t[K
:P4Jzm
P-5xtY
[P600e
p+#=,8^
p	8?2k
P~?8=G
P9=8FXD}
#P^9Xg
\p'.a$
	P$aHr
PathIsUNCW
pB7(?_
pbko=Q
pCC%!Hp>s
PdpO~cH
pek9:"!
pFVzUw
,pgaZ.+dmY
{pg^DD
Ph:hrx_
PH)PMP
Ph&Ub	
[:pK#&
](~p(m
pm/KX1
'pMlSw
PMxrC1
Pn	O;{
pn"uvh
>P,oW;
POwZDa
P@p9=J
Pq6 H.
PQBPV{ 
-pQ[kz
pqrstuvw
printf
@%Ps*	
pSAFw~
psapi.dll
psVKl'
pTs2cUB@k@
!PT+_v
#pu FU
Pu)Gtz
PUMaskV
"PV!ty
PwB-pk
PW%?|O
{>(.px
pXc9ans
P+XcpJ,
p<x)Xs
pY'FMT)
PYoD z.
pz<VF|D
q=`^	&
q;^"%*&
q}_*/<
q0e-;O
q}0pI,
Q1;SX*Y@
q,1v`	
?q2"I(B
q(38nw;
+q;4M4U6
	Q[4Vo
q{5vhL|d
q?ad8T
q`#a&Qh0
qB>Gz+
Q#C#}b
	Q_"D~
 {q?Da
qdf|L{
qdX,`T
q%eiuw
Q*e~R<
,QF~@]
QFIao$d
]@qfnN)
>Q>FQI
"Qfqrm
Q$g2,)N
.\QgYO
Q\ I)K
;QiqNs
Qiw^0+C
Q/	J<37#
Q}k,'x
qL0H9F?`
Qlo&Sy
q#`n_+[
Q(o+0}bl
Q_o_jw
`qOW&O
#*qp" 7HW
 ?q:Q28
qq\Avs
Qql"R<20c
qrF#.m
Q:t	?J
qUnws0
,QuOdPv
QUt0z{
%+>q_v?7W_
q~w&Y@
:qxPg!B
qYAZJ(
#Q,Yx~t
QZdA[]
=}&`R~
$+r1c8
r&1d~w
}r1_h8
R2GBw<
r/3^h|
R3\"_wj
R4f0HUF
r6Io(N
R,?)83
%r8*C:P
;\r`,9
R9CE=	lU
R9^:soD
RaiseException
r}au8]
-R<axM~
=Ra>+`Z
>RB4&r
r-*bEH
r=b	.G
# RBHw
r*C)1D
r}_:E}
RegQueryValueW
        <requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
      </requestedPrivileges>
      <requestedPrivileges>
-Rf;bl 
]rG;&0
r`i@82+
 Rich|
Rk:5g	
rl <CQ	
)Rl'N=
#.Rl`/N
r Lu"F
R\|Ly,D-
rMnuKA
RN6?XW+
R%n@bc
R>|Ng}c
rO:eO!}
R;P#"T
=rPur+
RP:@v+
;}=[rq
]	\&rqS
!R;}R@
rr|J"3
 RRRx]r
	rs-}}
R#>#T4
rTmd=l
ruI2Xa\
$#rwoH
RwVmEw1'/
@]!RX6g<V
 rxgz$1
r(xU}Vw
r[XyYi
r?YC;b
r.z6M;vi
R|Z~b'jGrg{
#[*}@s
s?`\,0
&s0Z6G}I
s1^34!
s2|~$r
& S4MX
s4#Yj`P
%`s5:V
]s.a7.
#sA8EI
sAb^(r-
SaPS+G+
*]@sB}-
sB22@-
Sc1z {
@#sCdb
    </security>
    <security>
SeMf`F
:s^EPm(N
sE^Tp#
shell32.dll
ShellExecuteExW
.sh$H_}
shlwapi.dll
SHy Kl
](si9ae
s_]%JuC
sJ }yL
}=sK&l
s ][L2q#
s?Lb%$
SlXA] N
#+:s&m
sMYi. 
S!n0Z(k
sN*K8G
snW%FM
s:nWS`
S/NZFY
SOFTpW
>sOQifI
spv&ub
~^spXEj
;sQ"7r
sRm>3Y
	s<_-T
STk{`p
stomInKi
Strin5g:X
sTs&Kl+5
S,w1BY
+sX}FA
=SxtT?<D
sXuYwZH[_{}]
}sx:v.
SyeFx"xF,W@
S!zrM,
t0@	pv
	"T0S&
t	`2A>
]T\2%rvW_
T3n$7h
T3pE+,K
T4Tx5o
t6z;,1K
?<t :@7
]t/~:7
t>8 5O=
T?,a!#
tAS &Po
=Tb2$ 
'TBmYW&
tCbsvc-3&
td{`"PE
TdWW+Q
t(Dz0J
tEkTC<
[T>FBZ,m
@tFgavc
	TFile
+TFQ8+tVAA
t!=h]F
!This program cannot be run in DOS mode.
ThJM}6
THLQnO
{ti.L0_dwY
`TIu44
TIv#$d%
TI@wjb
.tk8BY
Tk*juSZ
T lbHR
$TM3ul
tmB3Be
=,	tnq
tp),:8
tPch!`
+tQ8f_
_TrackMouseEvent
  </trustInfo>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
trvjPBq#
T.sKcCp
.tSNy*
t	SQ32
ts]z@R1B
t_t!xOx
ttY_JQ
t>U|2/
? t@u@B,&
T[UpQx
tU|q6SS{
tv4x8Y
t:vBxJz
&/TVI~l
TVkgXO(S
tvNd.	
tVR`{-
TvzO@lz7
-%T|%w
TW}N[O
?TXT7]*L
Tx^UJBS
t.YAF-[
_ty>BE
&~TypZ
t')ZPL
u0lRV,
u}^|.2
>u2@ZD
U+3?'vE
U 5wnBr
U%71!6
u8;-vA
u}9?x!
ua:;9w
UAo_8>
u-!=,B
UbR^T;
ud:dRy
u``em0
u>+(F**
ufLW\'_8
Ug]r9/
UGxKdQE m
=~U_hU
Ui(7J?
uiXqiA
uJL(~]
U&<j!SQ
(U=k7N
u`.KaRX
U @L-A
~u!lm	
uNHAx %@
UnkGowZ
U=nr=e
UOJz>x
upex	~
Up{--T
:U/qhw
U 'q=n
uqrMZI
user32.dll
ut6[R"ei
'u:"Td
ut`fMemo
uuAUYw
uuBM^4
UUEr}T0
UUnp*3
Uu|sIf
uuZnsh
U%va(OVA
\U*Vg1
UvG89}
.UYyCr
\;U\zj
?"v0[g
v"2O))
v!6&>PE
V9_D00
vAbHp3
VariantChangeTypeEx
^vB-(|
vc.jQJ:\
v%cSP6
!vCxd}
V}*cYr}
vd~+~b
V=|dQ.+
version.dll
"V];f_
{V"gE~)
vGS>$j
V=\Gv?
VILwG_
}vjuU(
-vjz1Ua9
^vLbZ+
v$l+l[;
,V{Nu]
vODOa]"
`#v]oSr
vOYTx\
V@:,](P
&<"V'p4
VP (d/q9
 Vp%hZM
vpm-~d
 VQ{5P~
VriPa*
V!}S-]|
@Vs0z lTz
VT;#`$r=d
vu}67$;
Vw"7aF,Q,
vwU:vv
v(x@zH
v.;!Y(J	E
{V~Z$e>t8j
V%[ZGA
v,z s-}
w2`_VE
W{!3s!
`w4*}'
:w5,jI(
W&6JIym
@W8Rh?w
w8T!YL
>WA*r.p
WB1GZE
wC*D\A
wc`K\P
w<D0Q-u
#Wdpqjrl
Wd(t(W%
WDv+:R
We)r;_W'}&
W@eXP8
W[{F{Xcgg
_=wH$=
~~wH3]
wininet.dll
winspool.drv
Wjk!s~
wk.	$*
WKaqq[
-wk:hI
WLf-(@
WLkuw;B
})WlvH
W[`lw:
Wm~nDz
wNhmpj9G
W#NRnS"
WOxQ:_
)wpH"iX
\~|;wQ
Wripb--B~U
WRsGcH
(w/s%/
WS1+m!
$?W=t7
WvG8T__8
WVolBm:
#WWU^z
Ww=@yc
>Wwz-&BwX
wY|36x'
w=y+@x
w&;@ Z
WZ.BZg
W\z_J:ZV
]x4A<c
X5MJX3u8
X!6&d]C58
X7bvaOsD
x7@f3_d
x7T1`2
X9l(&c<
XA.3|+
x"A5[@
XC(n>_
. _-xcv
^XDPp4
/X:e"C,
Xe,V~t
%x,F H
XiO2Gc
xJeT	J
Xjsf*{
xkz,w|`
|X:L9R
xlcm1"
`xlvpQ
XMsw<^XI
x&-NJ$
XohE%]o
Xo'hZ-p
Xow1,d
XoZ.wp
Xp" 7HW
X"pSh-
X!PXN=
/,XQ@]
xq"6<RM
XRYg`w
xs}H;N
XSQWRV
Xs$>/y
X_:u,E
xuvj3%
#XVRl|
Xv[Z"X
]XW@-(m
<XZ5KF
x_zc|g~k
XzN]/a
Y[2xc{c
/y5<.`
Y8MVNi
;~y+:8y'
Y`%aJr
y"c\>|\~
>~Yc1t`
_Yd0USbv
YD:lr7<
YdQFK@
)y&>e&
|]Y_=E
Y$f;6,,
YfqB>I
,&&(Yg+
	ygt&9
YhG);b	c
'&y^|I
.yi	U1Y
}yIWIn
@Yj!$`
yJA3DM
YJl`o<z
Yj|Z"n
ylS9 O
{\Ylue/
YmVB/qJS
ym;w}TJ
YMz}e0
>"Y*nsc
YODr<fu|
$y>OI7
Y:PVoI
y\q{-KA
YSBg>*
'$\yT	
Y.tKr;H
:#Y(T,u
y"UEF?C
YUtBB9BlC
?!(yVG5
Y]!W@|
y?X4c(
YX5h"}Z1
]Y!Y-_4
{}\:yz
yz01234
Z$~`0<
Z3wmj]*
Z4s'wG
}z6|W"
#:Z7*M
Z;9o1Jo	
Zabcde8fg
{Z!A#L$
Za -;q
zb8}t)&
^.@zC@
ZCHcn7
ZcwFj>
{?zc&X
+zD<>0\
zD_GL	
z<e4qR
ZFuw73T
ZhGt\`V
Z^	=I*
z\i@GvD
z J3F]
zj}X:Z
	)z]K{
z:,L5Rq
,(zLF?
	Z&/LF
Z:m[fp1
zM,+#IS
ZN_MsM
_zo3`>
./]~zP:;
Z-%}`P
ZP_:fM
ZrdMMU
ZrI*ZE[
Zrpd P
zR:]|q
z:$S}e
$;) &ZT
zu:=G4
Z?u(RH
ZuUr}!
/ZV7z~
z]v	~K
zvli2|'
ZvLSekn-
;Z!=Wh
zX6i}w^
 zxi=7u
)Z$Y6^
Zyd2%5
^Z_Y:z[
|Z~Z2F
|}ZZTS