Analysis Date | 2014-08-19 18:50:22 |
---|---|
MD5 | 5e1527030cfe2752840fb72612bb3775 |
SHA1 | 28aeb8f7dffbc73d34c807d619026f0b08e848cc |
Static Details:
File type | PE32 executable for MS Windows (GUI) Intel 80386 32-bit | |
---|---|---|
Section | .text md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0 | |
Section | .rdata md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0 | |
Section | .data md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0 | |
Section | .rsrc md5: 13f0834914639245cb55ac79a5783a09 sha1: 19fb86a5c9427d15b2ee1d93bca732949e10b168 size: 12288 | |
Section | .vmp0 md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0 | |
Section | .vmp1 md5: 0922f1d8c074c11356fd49794cce9847 sha1: 2c8203e4ad46de82c623fb4ef1064998a77d8dd1 size: 1433600 | |
Section | .reloc md5: 7c92657ef078dd7ba9920cb48a7f5678 sha1: fedf95c7160da3441631350c8517af4222755c4c size: 4096 | |
Timestamp | 2012-02-11 09:59:34 | |
Version | LegalCopyright: 作者版权所有 请尊重并使用正版 FileVersion: 2.5.0.0 Comments: 本程序使用易语言编写(http://www.eyuyan.com) ProductName: 逆天 ProductVersion: 2.5.0.0 FileDescription: 易语言程序 | |
PEhash | 572ea8a9f7b45e32c44c9264dbac9ea9544fdf34 | |
IMPhash | fd1f4da873df97e4c6613062d3de2da6 | |
AV | 360 Safe | Gen:Heur.PWSIME.2 |
AV | Ad-Aware | Gen:Heur.PWSIME.2 |
AV | Alwil (avast) | Malware-gen:Win32:Malware-gen |
AV | Arcabit (arcavir) | Heur.W32 |
AV | Authentium | no_virus |
AV | Avira (antivir) | TR/Agent.1454080.45 |
AV | CA (E-Trust Ino) | no_virus |
AV | CAT (quickheal) | no_virus |
AV | ClamAV | no_virus |
AV | Dr. Web | Trojan.PWS.Wsgame.44345 |
AV | Emsisoft | Gen:Heur.PWSIME.2 |
AV | Eset (nod32) | no_virus |
AV | Fortinet | W32/Reconyc.CBMR!tr |
AV | Frisk (f-prot) | no_virus |
AV | F-Secure | Gen:Heur.PWSIME.2 |
AV | Grisoft (avg) | no_virus |
AV | Ikarus | no_virus |
AV | K7 | no_virus |
AV | Kaspersky | Trojan.Win32.Reconyc.cbmr |
AV | MalwareBytes | no_virus |
AV | Mcafee | no_virus |
AV | Microsoft Security Essentials | no_virus |
AV | MicroWorld (escan) | Gen:Heur.PWSIME.2 |
AV | Norman | no_virus |
AV | Rising | no_virus |
AV | Sophos | no_virus |
AV | Symantec | no_virus |
AV | Trend Micro | no_virus |
AV | VirusBlokAda (vba32) | HackTool.Sniffer.WpePro |
AV | Yara APT | no_virus |
AV | Zillya! | no_virus |
Runtime Details:
Screenshot | ![]() |
---|
Process
↳ C:\malware.exe
Registry | HKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝ NULL |
---|---|
Registry | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝ 1 |
Creates File | C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\BSDHA97U\logo[1].gif |
Creates File | C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat |
Creates File | C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012014081920140820\index.dat |
Creates File | C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\xiaoyuang.ys168[1].htm |
Creates File | \Device\Afd\AsyncConnectHlp |
Creates File | C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat |
Creates File | C:\Documents and Settings\Administrator\Local Settings\Temp\3075_appcompat.txt |
Creates File | C:\windows\svchost.exe |
Creates File | C:\Documents and Settings\Administrator\Cookies\index.dat |
Creates File | PIPE\lsarpc |
Creates File | \Device\Afd\Endpoint |
Deletes File | C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012013061320130614\index.dat |
Deletes File | C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012013052720130603\index.dat |
Creates Process | C:\WINDOWS\system32\drwtsn32 -p 1220 -e 172 -g |
Creates Process | C:\WINDOWS\system32\dwwin.exe -x -s 356 |
Creates Process | C:\windows\svchost.exe |
Creates Mutex | _!SHMSFTHISTORY!_ |
Creates Mutex | c:!documents and settings!administrator!local settings!history!history.ie5! |
Creates Mutex | WininetConnectionMutex |
Creates Mutex | c:!documents and settings!administrator!cookies! |
Creates Mutex | c:!documents and settings!administrator!local settings!temporary internet files!content.ie5! |
Creates Mutex | c:!documents and settings!administrator!local settings!history!history.ie5!mshist012014081920140820! |
Winsock DNS | www.11111wg.com |
Winsock DNS | www.7798k.com |
Winsock DNS | www.5213dy.com |
Winsock DNS | xiaoyuang.ys168.com |
Winsock DNS | www.0419dj.com |
Winsock DNS | www.11111wg.net |
Process
↳ C:\windows\svchost.exe
Registry | HKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝ NULL |
---|---|
Registry | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝ 1 |
Creates File | C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\BSDHA97U\logo[2].gif |
Creates File | C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\D4Z32ED8\logo[1].gif |
Creates File | C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat |
Creates File | \Device\Afd\AsyncConnectHlp |
Creates File | C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat |
Creates File | C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\logo[1].gif |
Creates File | C:\Documents and Settings\Administrator\Cookies\index.dat |
Creates File | PIPE\lsarpc |
Creates File | C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IIQ3LGTM\3214[1].htm |
Creates File | C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IIQ3LGTM\52shanhu[1].htm |
Creates File | \Device\Afd\Endpoint |
Creates File | C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IIQ3LGTM\feixiandao.uueasy[1].htm |
Winsock DNS | www.5266.me |
Winsock DNS | feixiandao.uueasy.com |
Winsock DNS | www.7798k.com |
Winsock DNS | www.5213dy.com |
Winsock DNS | www.3214.cn |
Winsock DNS | www.0419dj.com |
Winsock DNS | www.lelev8.net |
Winsock DNS | www.ewasai.com |
Winsock DNS | www.7799k.com |
Winsock DNS | 7798k.com |
Winsock DNS | www.1314521li.com |
Winsock DNS | www.1314521kan.com |
Winsock DNS | www.87dyw.com |
Winsock DNS | www.llv8.cc |
Winsock DNS | www.52shanhu.com |
Winsock DNS | www.11111wg.com |
Winsock DNS | www.6699kan.com |
Winsock DNS | www.0419kan.com |
Winsock DNS | www.66iu.com |
Winsock DNS | www.le6tv.com |
Winsock DNS | www.6625.me |
Winsock DNS | www.11111wg.net |
Process
↳ C:\WINDOWS\system32\dwwin.exe -x -s 356
Process
↳ C:\WINDOWS\system32\drwtsn32 -p 1220 -e 172 -g
Network Details:
DNS | xiaoyuang.ys168.com Type: A 222.73.47.229 |
---|---|
DNS | www.0419dj.com Type: A 59.45.79.57 |
DNS | www.6699kan.com Type: A 23.110.26.14 |
DNS | www.52shanhu.com Type: A 109.234.109.82 |
DNS | a.uueasy.com Type: A 42.120.63.199 |
DNS | 39712.vhost13.cloudvhost.net Type: A 116.255.200.35 |
DNS | www.7799k.com Type: A 23.80.195.34 |
DNS | www.87dyw.com Type: A 192.187.97.125 |
DNS | www.11111wg.com Type: A |
DNS | www.11111wg.net Type: A |
DNS | www.5213dy.com Type: A |
DNS | www.7798k.com Type: A |
DNS | 7798k.com Type: A |
DNS | www.le6tv.com Type: A |
DNS | feixiandao.uueasy.com Type: A |
DNS | www.6625.me Type: A |
DNS | www.ewasai.com Type: A |
DNS | www.5266.me Type: A |
DNS | www.3214.cn Type: A |
DNS | www.lelev8.net Type: A |
DNS | www.66iu.com Type: A |
DNS | www.llv8.cc Type: A |
DNS | www.1314521kan.com Type: A |
DNS | www.1314521li.com Type: A |
DNS | www.0419kan.com Type: A |
HTTP GET | http://xiaoyuang.ys168.com/ User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) |
HTTP GET | http://xiaoyuang.ys168.com/logo.gif User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) |
HTTP GET | http://www.0419dj.com/0419 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) |
HTTP GET | http://www.0419dj.com/nitian.htm User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) |
HTTP GET | http://www.6699kan.com/tongji/ User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) |
HTTP GET | http://www.52shanhu.com/1.htm User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) |
HTTP GET | http://www.52shanhu.com/jueai.htm User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) |
HTTP GET | http://feixiandao.uueasy.com/index-htm-m-bbs-cateid-6.html User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) |
HTTP GET | http://feixiandao.uueasy.com/ User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) |
HTTP GET | http://www.0419dj.com/tongji User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) |
HTTP GET | http://www.3214.cn/?jueai User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) |
HTTP GET | http://www.52shanhu.com/ User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) |
HTTP GET | http://www.7799k.com/tongji/ User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) |
HTTP GET | http://feixiandao.uueasy.com/logo.gif User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) |
HTTP GET | http://www.3214.cn/logo.gif User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) |
HTTP GET | http://www.52shanhu.com/logo.gif User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) |
HTTP GET | http://www.87dyw.com/tv/ User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) |
Flows TCP | 192.168.1.1:1032 ➝ 222.73.47.229:80 |
Flows TCP | 192.168.1.1:1034 ➝ 222.73.47.229:80 |
Flows TCP | 192.168.1.1:1035 ➝ 59.45.79.57:80 |
Flows TCP | 192.168.1.1:1037 ➝ 59.45.79.57:80 |
Flows TCP | 192.168.1.1:1038 ➝ 23.110.26.14:80 |
Flows TCP | 192.168.1.1:1040 ➝ 109.234.109.82:80 |
Flows TCP | 192.168.1.1:1039 ➝ 109.234.109.82:80 |
Flows TCP | 192.168.1.1:1041 ➝ 42.120.63.199:80 |
Flows TCP | 192.168.1.1:1042 ➝ 42.120.63.199:80 |
Flows TCP | 192.168.1.1:1044 ➝ 59.45.79.57:80 |
Flows TCP | 192.168.1.1:1045 ➝ 116.255.200.35:80 |
Flows TCP | 192.168.1.1:1046 ➝ 109.234.109.82:80 |
Flows TCP | 192.168.1.1:1047 ➝ 23.80.195.34:80 |
Flows TCP | 192.168.1.1:1048 ➝ 42.120.63.199:80 |
Flows TCP | 192.168.1.1:1049 ➝ 116.255.200.35:80 |
Flows TCP | 192.168.1.1:1050 ➝ 109.234.109.82:80 |
Flows TCP | 192.168.1.1:1051 ➝ 192.187.97.125:80 |
Raw Pcap
0x00000000 (00000) 47455420 2f204854 54502f31 2e310d0a GET / HTTP/1.1.. 0x00000010 (00016) 41636365 70743a20 2a2f2a0d 0a416363 Accept: */*..Acc 0x00000020 (00032) 6570742d 4c616e67 75616765 3a20656e ept-Language: en 0x00000030 (00048) 2d75730d 0a416363 6570742d 456e636f -us..Accept-Enco 0x00000040 (00064) 64696e67 3a20677a 69702c20 6465666c ding: gzip, defl 0x00000050 (00080) 6174650d 0a557365 722d4167 656e743a ate..User-Agent: 0x00000060 (00096) 204d6f7a 696c6c61 2f342e30 2028636f Mozilla/4.0 (co 0x00000070 (00112) 6d706174 69626c65 3b204d53 49452036 mpatible; MSIE 6 0x00000080 (00128) 2e303b20 57696e64 6f777320 4e542035 .0; Windows NT 5 0x00000090 (00144) 2e313b20 5356313b 202e4e45 5420434c .1; SV1; .NET CL 0x000000a0 (00160) 5220322e 302e3530 37323729 0d0a486f R 2.0.50727)..Ho 0x000000b0 (00176) 73743a20 7869616f 7975616e 672e7973 st: xiaoyuang.ys 0x000000c0 (00192) 3136382e 636f6d0d 0a436f6e 6e656374 168.com..Connect 0x000000d0 (00208) 696f6e3a 204b6565 702d416c 6976650d ion: Keep-Alive. 0x000000e0 (00224) 0a0d0a ... 0x00000000 (00000) 47455420 2f6c6f67 6f2e6769 66204854 GET /logo.gif HT 0x00000010 (00016) 54502f31 2e310d0a 41636365 70743a20 TP/1.1..Accept: 0x00000020 (00032) 2a2f2a0d 0a526566 65726572 3a206874 */*..Referer: ht 0x00000030 (00048) 74703a2f 2f786961 6f797561 6e672e79 tp://xiaoyuang.y 0x00000040 (00064) 73313638 2e636f6d 2f0d0a41 63636570 s168.com/..Accep 0x00000050 (00080) 742d4c61 6e677561 67653a20 656e2d75 t-Language: en-u 0x00000060 (00096) 730d0a41 63636570 742d456e 636f6469 s..Accept-Encodi 0x00000070 (00112) 6e673a20 677a6970 2c206465 666c6174 ng: gzip, deflat 0x00000080 (00128) 650d0a55 7365722d 4167656e 743a204d e..User-Agent: M 0x00000090 (00144) 6f7a696c 6c612f34 2e302028 636f6d70 ozilla/4.0 (comp 0x000000a0 (00160) 61746962 6c653b20 4d534945 20362e30 atible; MSIE 6.0 0x000000b0 (00176) 3b205769 6e646f77 73204e54 20352e31 ; Windows NT 5.1 0x000000c0 (00192) 3b205356 313b202e 4e455420 434c5220 ; SV1; .NET CLR 0x000000d0 (00208) 322e302e 35303732 37290d0a 486f7374 2.0.50727)..Host 0x000000e0 (00224) 3a207869 616f7975 616e672e 79733136 : xiaoyuang.ys16 0x000000f0 (00240) 382e636f 6d0d0a43 6f6e6e65 6374696f 8.com..Connectio 0x00000100 (00256) 6e3a204b 6565702d 416c6976 650d0a0d n: Keep-Alive... 0x00000110 (00272) 0a . 0x00000000 (00000) 47455420 2f303431 39204854 54502f31 GET /0419 HTTP/1 0x00000010 (00016) 2e310d0a 41636365 70743a20 2a2f2a0d .1..Accept: */*. 0x00000020 (00032) 0a416363 6570742d 4c616e67 75616765 .Accept-Language 0x00000030 (00048) 3a20656e 2d75730d 0a416363 6570742d : en-us..Accept- 0x00000040 (00064) 456e636f 64696e67 3a20677a 69702c20 Encoding: gzip, 0x00000050 (00080) 6465666c 6174650d 0a557365 722d4167 deflate..User-Ag 0x00000060 (00096) 656e743a 204d6f7a 696c6c61 2f342e30 ent: Mozilla/4.0 0x00000070 (00112) 2028636f 6d706174 69626c65 3b204d53 (compatible; MS 0x00000080 (00128) 49452036 2e303b20 57696e64 6f777320 IE 6.0; Windows 0x00000090 (00144) 4e542035 2e313b20 5356313b 202e4e45 NT 5.1; SV1; .NE 0x000000a0 (00160) 5420434c 5220322e 302e3530 37323729 T CLR 2.0.50727) 0x000000b0 (00176) 0d0a486f 73743a20 7777772e 30343139 ..Host: www.0419 0x000000c0 (00192) 646a2e63 6f6d0d0a 436f6e6e 65637469 dj.com..Connecti 0x000000d0 (00208) 6f6e3a20 4b656570 2d416c69 76650d0a on: Keep-Alive.. 0x000000e0 (00224) 0d0a7869 616f7975 616e672e 79733136 ..xiaoyuang.ys16 0x000000f0 (00240) 382e636f 6d0d0a43 6f6e6e65 6374696f 8.com..Connectio 0x00000100 (00256) 6e3a204b 6565702d 416c6976 650d0a0d n: Keep-Alive... 0x00000110 (00272) 0a . 0x00000000 (00000) 47455420 2f6e6974 69616e2e 68746d20 GET /nitian.htm 0x00000010 (00016) 48545450 2f312e31 0d0a4163 63657074 HTTP/1.1..Accept 0x00000020 (00032) 3a202a2f 2a0d0a41 63636570 742d4c61 : */*..Accept-La 0x00000030 (00048) 6e677561 67653a20 656e2d75 730d0a41 nguage: en-us..A 0x00000040 (00064) 63636570 742d456e 636f6469 6e673a20 ccept-Encoding: 0x00000050 (00080) 677a6970 2c206465 666c6174 650d0a55 gzip, deflate..U 0x00000060 (00096) 7365722d 4167656e 743a204d 6f7a696c ser-Agent: Mozil 0x00000070 (00112) 6c612f34 2e302028 636f6d70 61746962 la/4.0 (compatib 0x00000080 (00128) 6c653b20 4d534945 20362e30 3b205769 le; MSIE 6.0; Wi 0x00000090 (00144) 6e646f77 73204e54 20352e31 3b205356 ndows NT 5.1; SV 0x000000a0 (00160) 313b202e 4e455420 434c5220 322e302e 1; .NET CLR 2.0. 0x000000b0 (00176) 35303732 37290d0a 486f7374 3a207777 50727)..Host: ww 0x000000c0 (00192) 772e3034 3139646a 2e636f6d 0d0a436f w.0419dj.com..Co 0x000000d0 (00208) 6e6e6563 74696f6e 3a204b65 65702d41 nnection: Keep-A 0x000000e0 (00224) 6c697665 0d0a0d0a 616e672e 79733136 live....ang.ys16 0x000000f0 (00240) 382e636f 6d0d0a43 6f6e6e65 6374696f 8.com..Connectio 0x00000100 (00256) 6e3a204b 6565702d 416c6976 650d0a0d n: Keep-Alive... 0x00000110 (00272) 0a . 0x00000000 (00000) 47455420 2f746f6e 676a692f 20485454 GET /tongji/ HTT 0x00000010 (00016) 502f312e 310d0a41 63636570 743a202a P/1.1..Accept: * 0x00000020 (00032) 2f2a0d0a 41636365 70742d4c 616e6775 /*..Accept-Langu 0x00000030 (00048) 6167653a 20656e2d 75730d0a 41636365 age: en-us..Acce 0x00000040 (00064) 70742d45 6e636f64 696e673a 20677a69 pt-Encoding: gzi 0x00000050 (00080) 702c2064 65666c61 74650d0a 55736572 p, deflate..User 0x00000060 (00096) 2d416765 6e743a20 4d6f7a69 6c6c612f -Agent: Mozilla/ 0x00000070 (00112) 342e3020 28636f6d 70617469 626c653b 4.0 (compatible; 0x00000080 (00128) 204d5349 4520362e 303b2057 696e646f MSIE 6.0; Windo 0x00000090 (00144) 7773204e 5420352e 313b2053 56313b20 ws NT 5.1; SV1; 0x000000a0 (00160) 2e4e4554 20434c52 20322e30 2e353037 .NET CLR 2.0.507 0x000000b0 (00176) 3237290d 0a486f73 743a2077 77772e36 27)..Host: www.6 0x000000c0 (00192) 3639396b 616e2e63 6f6d0d0a 436f6e6e 699kan.com..Conn 0x000000d0 (00208) 65637469 6f6e3a20 4b656570 2d416c69 ection: Keep-Ali 0x000000e0 (00224) 76650d0a 0d0a2034 31366336 39373620 ve.... 416c6976 0x000000f0 (00240) 36353064 30613064 2020206e 3a204b65 650d0a0d n: Ke 0x00000100 (00256) 65702d41 6c697665 2e2e2e0a ep-Alive.... 0x00000000 (00000) 47455420 2f6a7565 61692e68 746d2048 GET /jueai.htm H 0x00000010 (00016) 5454502f 312e310d 0a416363 6570743a TTP/1.1..Accept: 0x00000020 (00032) 202a2f2a 0d0a4163 63657074 2d4c616e */*..Accept-Lan 0x00000030 (00048) 67756167 653a2065 6e2d7573 0d0a4163 guage: en-us..Ac 0x00000040 (00064) 63657074 2d456e63 6f64696e 673a2067 cept-Encoding: g 0x00000050 (00080) 7a69702c 20646566 6c617465 0d0a5573 zip, deflate..Us 0x00000060 (00096) 65722d41 67656e74 3a204d6f 7a696c6c er-Agent: Mozill 0x00000070 (00112) 612f342e 30202863 6f6d7061 7469626c a/4.0 (compatibl 0x00000080 (00128) 653b204d 53494520 362e303b 2057696e e; MSIE 6.0; Win 0x00000090 (00144) 646f7773 204e5420 352e313b 20535631 dows NT 5.1; SV1 0x000000a0 (00160) 3b202e4e 45542043 4c522032 2e302e35 ; .NET CLR 2.0.5 0x000000b0 (00176) 30373237 290d0a48 6f73743a 20777777 0727)..Host: www 0x000000c0 (00192) 2e353273 68616e68 752e636f 6d0d0a43 .52shanhu.com..C 0x000000d0 (00208) 6f6e6e65 6374696f 6e3a204b 6565702d onnection: Keep- 0x000000e0 (00224) 416c6976 650d0a0d 0a5802d9 7360090d Alive....X..s`.. 0x000000f0 (00240) 5705230d ed1b9117 e2183ca2 c01732a7 W.#.......<...2. 0x00000100 (00256) 605b1f55 19ea8990 fe251b88 4ba926e2 `[.U.....%..K.&. 0x00000110 (00272) 89ae7906 ec8494aa 66a9a328 7fc75f32 ..y.....f..(.._2 0x00000120 (00288) c94841ed 8a13ceda f9e74043 b5b17729 .HA.......@C..w) 0x00000130 (00304) e6b30344 a2f460b8 28ed9273 5116f895 ...D..`.(..sQ... 0x00000140 (00320) 61f8e1 a.. 0x00000000 (00000) 47455420 2f312e68 746d2048 5454502f GET /1.htm HTTP/ 0x00000010 (00016) 312e310d 0a416363 6570743a 202a2f2a 1.1..Accept: */* 0x00000020 (00032) 0d0a4163 63657074 2d4c616e 67756167 ..Accept-Languag 0x00000030 (00048) 653a2065 6e2d7573 0d0a4163 63657074 e: en-us..Accept 0x00000040 (00064) 2d456e63 6f64696e 673a2067 7a69702c -Encoding: gzip, 0x00000050 (00080) 20646566 6c617465 0d0a5573 65722d41 deflate..User-A 0x00000060 (00096) 67656e74 3a204d6f 7a696c6c 612f342e gent: Mozilla/4. 0x00000070 (00112) 30202863 6f6d7061 7469626c 653b204d 0 (compatible; M 0x00000080 (00128) 53494520 362e303b 2057696e 646f7773 SIE 6.0; Windows 0x00000090 (00144) 204e5420 352e313b 20535631 3b202e4e NT 5.1; SV1; .N 0x000000a0 (00160) 45542043 4c522032 2e302e35 30373237 ET CLR 2.0.50727 0x000000b0 (00176) 290d0a48 6f73743a 20777777 2e353273 )..Host: www.52s 0x000000c0 (00192) 68616e68 752e636f 6d0d0a43 6f6e6e65 hanhu.com..Conne 0x000000d0 (00208) 6374696f 6e3a204b 6565702d 416c6976 ction: Keep-Aliv 0x000000e0 (00224) 650d0a0d 0aae64a2 5010b0ec 6a3845e1 e.....d.P...j8E. 0x000000f0 (00240) 070f .. 0x00000000 (00000) 47455420 2f696e64 65782d68 746d2d6d GET /index-htm-m 0x00000010 (00016) 2d626273 2d636174 6569642d 362e6874 -bbs-cateid-6.ht 0x00000020 (00032) 6d6c2048 5454502f 312e310d 0a416363 ml HTTP/1.1..Acc 0x00000030 (00048) 6570743a 202a2f2a 0d0a4163 63657074 ept: */*..Accept 0x00000040 (00064) 2d4c616e 67756167 653a2065 6e2d7573 -Language: en-us 0x00000050 (00080) 0d0a4163 63657074 2d456e63 6f64696e ..Accept-Encodin 0x00000060 (00096) 673a2067 7a69702c 20646566 6c617465 g: gzip, deflate 0x00000070 (00112) 0d0a5573 65722d41 67656e74 3a204d6f ..User-Agent: Mo 0x00000080 (00128) 7a696c6c 612f342e 30202863 6f6d7061 zilla/4.0 (compa 0x00000090 (00144) 7469626c 653b204d 53494520 362e303b tible; MSIE 6.0; 0x000000a0 (00160) 2057696e 646f7773 204e5420 352e313b Windows NT 5.1; 0x000000b0 (00176) 20535631 3b202e4e 45542043 4c522032 SV1; .NET CLR 2 0x000000c0 (00192) 2e302e35 30373237 290d0a48 6f73743a .0.50727)..Host: 0x000000d0 (00208) 20666569 7869616e 64616f2e 75756561 feixiandao.uuea 0x000000e0 (00224) 73792e63 6f6d0d0a 436f6e6e 65637469 sy.com..Connecti 0x000000f0 (00240) 6f6e3a20 4b656570 2d416c69 76650d0a on: Keep-Alive.. 0x00000100 (00256) 0d0af6c4 d209d105 c94d4442 8d3dec81 .........MDB.=.. 0x00000110 (00272) 117b3080 07944003 0694a209 a8508721 .{0...@......P.! 0x00000120 (00288) 9af08251 bc60 ...Q.` 0x00000000 (00000) 47455420 2f204854 54502f31 2e310d0a GET / HTTP/1.1.. 0x00000010 (00016) 41636365 70743a20 2a2f2a0d 0a416363 Accept: */*..Acc 0x00000020 (00032) 6570742d 4c616e67 75616765 3a20656e ept-Language: en 0x00000030 (00048) 2d75730d 0a416363 6570742d 456e636f -us..Accept-Enco 0x00000040 (00064) 64696e67 3a20677a 69702c20 6465666c ding: gzip, defl 0x00000050 (00080) 6174650d 0a557365 722d4167 656e743a ate..User-Agent: 0x00000060 (00096) 204d6f7a 696c6c61 2f342e30 2028636f Mozilla/4.0 (co 0x00000070 (00112) 6d706174 69626c65 3b204d53 49452036 mpatible; MSIE 6 0x00000080 (00128) 2e303b20 57696e64 6f777320 4e542035 .0; Windows NT 5 0x00000090 (00144) 2e313b20 5356313b 202e4e45 5420434c .1; SV1; .NET CL 0x000000a0 (00160) 5220322e 302e3530 37323729 0d0a486f R 2.0.50727)..Ho 0x000000b0 (00176) 73743a20 66656978 69616e64 616f2e75 st: feixiandao.u 0x000000c0 (00192) 75656173 792e636f 6d0d0a43 6f6e6e65 ueasy.com..Conne 0x000000d0 (00208) 6374696f 6e3a204b 6565702d 416c6976 ction: Keep-Aliv 0x000000e0 (00224) 650d0a0d 0a98d66f 9d40d4b1 e20cdbb3 e......o.@...... 0x000000f0 (00240) 70c79587 f9f080e8 389108e8 804bc287 p.......8....K.. 0x00000100 (00256) 872e5498 d00bbd78 80793037 1f500195 ..T....x.y07.P.. 0x00000110 (00272) 0a07a130 01b428a0 851312bd 50d9e0f2 ...0..(.....P... 0x00000120 (00288) ea8062ad 311317c4 e607b450 6d08ff47 ..b.1......Pm..G 0x00000130 (00304) 83fef123 0a5f0ab6 468a197c 0ca56009 ...#._..F..|..`. 0x00000140 (00320) 7b { 0x00000000 (00000) 47455420 2f6c6f67 6f2e6769 66204854 GET /logo.gif HT 0x00000010 (00016) 54502f31 2e310d0a 41636365 70743a20 TP/1.1..Accept: 0x00000020 (00032) 2a2f2a0d 0a526566 65726572 3a206874 */*..Referer: ht 0x00000030 (00048) 74703a2f 2f666569 7869616e 64616f2e tp://feixiandao. 0x00000040 (00064) 75756561 73792e63 6f6d2f0d 0a416363 uueasy.com/..Acc 0x00000050 (00080) 6570742d 4c616e67 75616765 3a20656e ept-Language: en 0x00000060 (00096) 2d75730d 0a416363 6570742d 456e636f -us..Accept-Enco 0x00000070 (00112) 64696e67 3a20677a 69702c20 6465666c ding: gzip, defl 0x00000080 (00128) 6174650d 0a557365 722d4167 656e743a ate..User-Agent: 0x00000090 (00144) 204d6f7a 696c6c61 2f342e30 2028636f Mozilla/4.0 (co 0x000000a0 (00160) 6d706174 69626c65 3b204d53 49452036 mpatible; MSIE 6 0x000000b0 (00176) 2e303b20 57696e64 6f777320 4e542035 .0; Windows NT 5 0x000000c0 (00192) 2e313b20 5356313b 202e4e45 5420434c .1; SV1; .NET CL 0x000000d0 (00208) 5220322e 302e3530 37323729 0d0a486f R 2.0.50727)..Ho 0x000000e0 (00224) 73743a20 66656978 69616e64 616f2e75 st: feixiandao.u 0x000000f0 (00240) 75656173 792e636f 6d0d0a43 6f6e6e65 ueasy.com..Conne 0x00000100 (00256) 6374696f 6e3a204b 6565702d 416c6976 ction: Keep-Aliv 0x00000110 (00272) 650d0a0d 0a636f75 6c64206e 6f742075 e....could not u 0x00000120 (00288) 6e646572 7374616e 642e3c2f 703e0a20 nderstand.</p>. 0x00000130 (00304) 2020203c 703e4e6f 20737563 68206669 <p>No such fi 0x00000140 (00320) 6c65206f 72206469 72656374 6f72792e le or directory. 0x00000150 (00336) 3c2f703e 0a20203c 6872202f 3e0a2020 </p>. <hr />. 0x00000160 (00352) 3c616464 72657373 3e4d6963 726f736f <address>Microso 0x00000170 (00368) 66742d49 49532f37 2e303c2f 61646472 ft-IIS/7.0</addr 0x00000180 (00384) 6573733e 0a20203c 2f626f64 793e0a3c ess>. </body>.< 0x00000190 (00400) 2f68746d 6c3e0a01 e08130c3 80bfec /html>....0.... 0x00000000 (00000) 47455420 2f3f6a75 65616920 48545450 GET /?jueai HTTP 0x00000010 (00016) 2f312e31 0d0a4163 63657074 3a202a2f /1.1..Accept: */ 0x00000020 (00032) 2a0d0a41 63636570 742d4c61 6e677561 *..Accept-Langua 0x00000030 (00048) 67653a20 656e2d75 730d0a41 63636570 ge: en-us..Accep 0x00000040 (00064) 742d456e 636f6469 6e673a20 677a6970 t-Encoding: gzip 0x00000050 (00080) 2c206465 666c6174 650d0a55 7365722d , deflate..User- 0x00000060 (00096) 4167656e 743a204d 6f7a696c 6c612f34 Agent: Mozilla/4 0x00000070 (00112) 2e302028 636f6d70 61746962 6c653b20 .0 (compatible; 0x00000080 (00128) 4d534945 20362e30 3b205769 6e646f77 MSIE 6.0; Window 0x00000090 (00144) 73204e54 20352e31 3b205356 313b202e s NT 5.1; SV1; . 0x000000a0 (00160) 4e455420 434c5220 322e302e 35303732 NET CLR 2.0.5072 0x000000b0 (00176) 37290d0a 486f7374 3a207777 772e3332 7)..Host: www.32 0x000000c0 (00192) 31342e63 6e0d0a43 6f6e6e65 6374696f 14.cn..Connectio 0x000000d0 (00208) 6e3a204b 6565702d 416c6976 650d0a0d n: Keep-Alive... 0x000000e0 (00224) 0a21e835 29b04e27 13cdbdf8 cd21ff3a .!.5).N'.....!.: 0x000000f0 (00240) 78177551 6ad80dc6 9ac0bd25 21f1283d x.uQj......%!.(= 0x00000100 (00256) 2104b2b7 2c7dbf71 1acc59b0 71cf1e08 !...,}.q..Y.q... 0x00000110 (00272) 81b0d8cd bed881cf e681303d 27a05705 ..........0='.W. 0x00000120 (00288) 2314c408 4180132a 6a9a0ff6 701b4145 #...A..*j...p.AE 0x00000130 (00304) 5e81200b d64727f9 5c36e2dc 28c2d35b ^. ..G'.\6..(..[ 0x00000140 (00320) 0ec85bc0 e12827b1 1141f18a fce43f19 ..[..('..A....?. 0x00000150 (00336) 42108dd3 b7711a93 0404da1d 16a8b505 B....q.......... 0x00000160 (00352) 430f0215 e435 C....5 0x00000000 (00000) 47455420 2f746f6e 676a6920 48545450 GET /tongji HTTP 0x00000010 (00016) 2f312e31 0d0a4163 63657074 3a202a2f /1.1..Accept: */ 0x00000020 (00032) 2a0d0a41 63636570 742d4c61 6e677561 *..Accept-Langua 0x00000030 (00048) 67653a20 656e2d75 730d0a41 63636570 ge: en-us..Accep 0x00000040 (00064) 742d456e 636f6469 6e673a20 677a6970 t-Encoding: gzip 0x00000050 (00080) 2c206465 666c6174 650d0a55 7365722d , deflate..User- 0x00000060 (00096) 4167656e 743a204d 6f7a696c 6c612f34 Agent: Mozilla/4 0x00000070 (00112) 2e302028 636f6d70 61746962 6c653b20 .0 (compatible; 0x00000080 (00128) 4d534945 20362e30 3b205769 6e646f77 MSIE 6.0; Window 0x00000090 (00144) 73204e54 20352e31 3b205356 313b202e s NT 5.1; SV1; . 0x000000a0 (00160) 4e455420 434c5220 322e302e 35303732 NET CLR 2.0.5072 0x000000b0 (00176) 37290d0a 486f7374 3a207777 772e3034 7)..Host: www.04 0x000000c0 (00192) 3139646a 2e636f6d 0d0a436f 6e6e6563 19dj.com..Connec 0x000000d0 (00208) 74696f6e 3a204b65 65702d41 6c697665 tion: Keep-Alive 0x000000e0 (00224) 0d0a0d0a 091fa081 1a18a109 f8c30b18 ................ 0x000000f0 (00240) 61ee52af f20ca09f 764015c4 60 a.R.....v@..` 0x00000000 (00000) 47455420 2f6c6f67 6f2e6769 66204854 GET /logo.gif HT 0x00000010 (00016) 54502f31 2e310d0a 41636365 70743a20 TP/1.1..Accept: 0x00000020 (00032) 2a2f2a0d 0a526566 65726572 3a206874 */*..Referer: ht 0x00000030 (00048) 74703a2f 2f777777 2e333231 342e636e tp://www.3214.cn 0x00000040 (00064) 2f3f6a75 6561690d 0a416363 6570742d /?jueai..Accept- 0x00000050 (00080) 4c616e67 75616765 3a20656e 2d75730d Language: en-us. 0x00000060 (00096) 0a416363 6570742d 456e636f 64696e67 .Accept-Encoding 0x00000070 (00112) 3a20677a 69702c20 6465666c 6174650d : gzip, deflate. 0x00000080 (00128) 0a557365 722d4167 656e743a 204d6f7a .User-Agent: Moz 0x00000090 (00144) 696c6c61 2f342e30 2028636f 6d706174 illa/4.0 (compat 0x000000a0 (00160) 69626c65 3b204d53 49452036 2e303b20 ible; MSIE 6.0; 0x000000b0 (00176) 57696e64 6f777320 4e542035 2e313b20 Windows NT 5.1; 0x000000c0 (00192) 5356313b 202e4e45 5420434c 5220322e SV1; .NET CLR 2. 0x000000d0 (00208) 302e3530 37323729 0d0a486f 73743a20 0.50727)..Host: 0x000000e0 (00224) 7777772e 33323134 2e636e0d 0a436f6e www.3214.cn..Con 0x000000f0 (00240) 6e656374 696f6e3a 204b6565 702d416c nection: Keep-Al 0x00000100 (00256) 6976650d 0a0d0a4b 6565702d 416c6976 ive....Keep-Aliv 0x00000110 (00272) 650d0a0d 0a636f75 6c64206e 6f742075 e....could not u 0x00000120 (00288) 6e646572 7374616e 642e3c2f 703e0a20 nderstand.</p>. 0x00000130 (00304) 2020203c 703e4e6f 20737563 68206669 <p>No such fi 0x00000140 (00320) 6c65206f 72206469 72656374 6f72792e le or directory. 0x00000150 (00336) 3c2f703e 0a20203c 6872202f 3e0a2020 </p>. <hr />. 0x00000160 (00352) 3c616464 72657373 3e4d6963 726f736f <address>Microso 0x00000170 (00368) 66742d49 49532f37 2e303c2f 61646472 ft-IIS/7.0</addr 0x00000180 (00384) 6573733e 0a20203c 2f626f64 793e0a3c ess>. </body>.< 0x00000190 (00400) 2f68746d 6c3e0a01 e08130c3 80bfec /html>....0.... 0x00000000 (00000) 47455420 2f746f6e 676a692f 20485454 GET /tongji/ HTT 0x00000010 (00016) 502f312e 310d0a41 63636570 743a202a P/1.1..Accept: * 0x00000020 (00032) 2f2a0d0a 41636365 70742d4c 616e6775 /*..Accept-Langu 0x00000030 (00048) 6167653a 20656e2d 75730d0a 41636365 age: en-us..Acce 0x00000040 (00064) 70742d45 6e636f64 696e673a 20677a69 pt-Encoding: gzi 0x00000050 (00080) 702c2064 65666c61 74650d0a 55736572 p, deflate..User 0x00000060 (00096) 2d416765 6e743a20 4d6f7a69 6c6c612f -Agent: Mozilla/ 0x00000070 (00112) 342e3020 28636f6d 70617469 626c653b 4.0 (compatible; 0x00000080 (00128) 204d5349 4520362e 303b2057 696e646f MSIE 6.0; Windo 0x00000090 (00144) 7773204e 5420352e 313b2053 56313b20 ws NT 5.1; SV1; 0x000000a0 (00160) 2e4e4554 20434c52 20322e30 2e353037 .NET CLR 2.0.507 0x000000b0 (00176) 3237290d 0a486f73 743a2077 77772e37 27)..Host: www.7 0x000000c0 (00192) 3739396b 2e636f6d 0d0a436f 6e6e6563 799k.com..Connec 0x000000d0 (00208) 74696f6e 3a204b65 65702d41 6c697665 tion: Keep-Alive 0x000000e0 (00224) 0d0a0d0a 650d0a0d 0a5802d9 7360090d ....e....X..s`.. 0x000000f0 (00240) 5705230d ed1b9117 e2183ca2 c01732a7 W.#.......<...2. 0x00000100 (00256) 605b1f55 19ea8990 fe251b88 4ba926e2 `[.U.....%..K.&. 0x00000110 (00272) 89ae7906 ec8494aa 66a9a328 7fc75f32 ..y.....f..(.._2 0x00000120 (00288) c94841ed 8a13ceda f9e74043 b5b17729 .HA.......@C..w) 0x00000130 (00304) e6b30344 a2f460b8 28ed9273 5116f895 ...D..`.(..sQ... 0x00000140 (00320) 61f8e1 a.. 0x00000000 (00000) 47455420 2f204854 54502f31 2e310d0a GET / HTTP/1.1.. 0x00000010 (00016) 41636365 70743a20 2a2f2a0d 0a416363 Accept: */*..Acc 0x00000020 (00032) 6570742d 4c616e67 75616765 3a20656e ept-Language: en 0x00000030 (00048) 2d75730d 0a416363 6570742d 456e636f -us..Accept-Enco 0x00000040 (00064) 64696e67 3a20677a 69702c20 6465666c ding: gzip, defl 0x00000050 (00080) 6174650d 0a557365 722d4167 656e743a ate..User-Agent: 0x00000060 (00096) 204d6f7a 696c6c61 2f342e30 2028636f Mozilla/4.0 (co 0x00000070 (00112) 6d706174 69626c65 3b204d53 49452036 mpatible; MSIE 6 0x00000080 (00128) 2e303b20 57696e64 6f777320 4e542035 .0; Windows NT 5 0x00000090 (00144) 2e313b20 5356313b 202e4e45 5420434c .1; SV1; .NET CL 0x000000a0 (00160) 5220322e 302e3530 37323729 0d0a486f R 2.0.50727)..Ho 0x000000b0 (00176) 73743a20 7777772e 35327368 616e6875 st: www.52shanhu 0x000000c0 (00192) 2e636f6d 0d0a436f 6e6e6563 74696f6e .com..Connection 0x000000d0 (00208) 3a204b65 65702d41 6c697665 0d0a0d0a : Keep-Alive.... 0x000000e0 (00224) 0a202020 203c703e 596f7572 2062726f . <p>Your bro 0x000000f0 (00240) 77736572 2073656e 74206120 72657175 wser sent a requ 0x00000100 (00256) 65737420 74686174 20746869 73207365 est that this se 0x00000110 (00272) 72766572 20636f75 6c64206e 6f742075 rver could not u 0x00000120 (00288) 6e646572 7374616e 642e3c2f 703e0a20 nderstand.</p>. 0x00000130 (00304) 2020203c 703e4e6f 20737563 68206669 <p>No such fi 0x00000140 (00320) 6c65206f 72206469 72656374 6f72792e le or directory. 0x00000150 (00336) 3c2f703e 0a20203c 6872202f 3e0a2020 </p>. <hr />. 0x00000160 (00352) 3c616464 72657373 3e4d6963 726f736f <address>Microso 0x00000170 (00368) 66742d49 49532f37 2e303c2f 61646472 ft-IIS/7.0</addr 0x00000180 (00384) 6573733e 0a20203c 2f626f64 793e0a3c ess>. </body>.< 0x00000190 (00400) 2f68746d 6c3e0a64 35156009 ef74a020 /html>.d5.`..t. 0x000001a0 (00416) 652f970a 7d320a9f 1055eb2c 603d7708 e/..}2...U.,`=w. 0x000001b0 (00432) 17b75581 365767b5 61b3e162 a9b075d3 ..U.6Wg.a..b..u. 0x000001c0 (00448) aa521d14 0c24 .R...$ 0x00000000 (00000) 47455420 2f6c6f67 6f2e6769 66204854 GET /logo.gif HT 0x00000010 (00016) 54502f31 2e310d0a 41636365 70743a20 TP/1.1..Accept: 0x00000020 (00032) 2a2f2a0d 0a526566 65726572 3a206874 */*..Referer: ht 0x00000030 (00048) 74703a2f 2f777777 2e353273 68616e68 tp://www.52shanh 0x00000040 (00064) 752e636f 6d2f0d0a 41636365 70742d4c u.com/..Accept-L 0x00000050 (00080) 616e6775 6167653a 20656e2d 75730d0a anguage: en-us.. 0x00000060 (00096) 41636365 70742d45 6e636f64 696e673a Accept-Encoding: 0x00000070 (00112) 20677a69 702c2064 65666c61 74650d0a gzip, deflate.. 0x00000080 (00128) 55736572 2d416765 6e743a20 4d6f7a69 User-Agent: Mozi 0x00000090 (00144) 6c6c612f 342e3020 28636f6d 70617469 lla/4.0 (compati 0x000000a0 (00160) 626c653b 204d5349 4520362e 303b2057 ble; MSIE 6.0; W 0x000000b0 (00176) 696e646f 7773204e 5420352e 313b2053 indows NT 5.1; S 0x000000c0 (00192) 56313b20 2e4e4554 20434c52 20322e30 V1; .NET CLR 2.0 0x000000d0 (00208) 2e353037 3237290d 0a486f73 743a2077 .50727)..Host: w 0x000000e0 (00224) 77772e35 32736861 6e68752e 636f6d0d ww.52shanhu.com. 0x000000f0 (00240) 0a436f6e 6e656374 696f6e3a 204b6565 .Connection: Kee 0x00000100 (00256) 702d416c 6976650d 0a0d0a64 793e0a20 p-Alive....dy>. 0x00000110 (00272) 2020203c 68333e54 68697320 69732074 <h3>This is t 0x00000120 (00288) 68652072 65616c2d 6d6f6465 20746573 he real-mode tes 0x00000130 (00304) 74207061 67652e2e 2e3c2f68 333e0a09 t page...</h3>.. 0x00000140 (00320) 093c696d 67207372 633d226c 6f676f2e .<img src="logo. 0x00000150 (00336) 67696622 3e0a2020 3c2f626f 64793e0a gif">. </body>. 0x00000160 (00352) 3c2f6874 6d6c3e0a 28ed9273 5116f895 </html>.(..sQ... 0x00000170 (00368) 5001 P. 0x00000000 (00000) 47455420 2f74762f 20485454 502f312e GET /tv/ HTTP/1. 0x00000010 (00016) 310d0a41 63636570 743a202a 2f2a0d0a 1..Accept: */*.. 0x00000020 (00032) 41636365 70742d4c 616e6775 6167653a Accept-Language: 0x00000030 (00048) 20656e2d 75730d0a 41636365 70742d45 en-us..Accept-E 0x00000040 (00064) 6e636f64 696e673a 20677a69 702c2064 ncoding: gzip, d 0x00000050 (00080) 65666c61 74650d0a 55736572 2d416765 eflate..User-Age 0x00000060 (00096) 6e743a20 4d6f7a69 6c6c612f 342e3020 nt: Mozilla/4.0 0x00000070 (00112) 28636f6d 70617469 626c653b 204d5349 (compatible; MSI 0x00000080 (00128) 4520362e 303b2057 696e646f 7773204e E 6.0; Windows N 0x00000090 (00144) 5420352e 313b2053 56313b20 2e4e4554 T 5.1; SV1; .NET 0x000000a0 (00160) 20434c52 20322e30 2e353037 3237290d CLR 2.0.50727). 0x000000b0 (00176) 0a486f73 743a2077 77772e38 37647977 .Host: www.87dyw 0x000000c0 (00192) 2e636f6d 0d0a436f 6e6e6563 74696f6e .com..Connection 0x000000d0 (00208) 3a204b65 65702d41 6c697665 0d0a0d0a : Keep-Alive.... 0x000000e0 (00224) 77772e35 32736861 6e68752e 636f6d0d ww.52shanhu.com. 0x000000f0 (00240) 0a436f6e 6e656374 696f6e3a 204b6565 .Connection: Kee 0x00000100 (00256) 702d416c 6976650d 0a0d0a64 793e0a20 p-Alive....dy>. 0x00000110 (00272) 2020203c 68333e54 68697320 69732074 <h3>This is t 0x00000120 (00288) 68652072 65616c2d 6d6f6465 20746573 he real-mode tes 0x00000130 (00304) 74207061 67652e2e 2e3c2f68 333e0a09 t page...</h3>.. 0x00000140 (00320) 093c696d 67207372 633d226c 6f676f2e .<img src="logo. 0x00000150 (00336) 67696622 3e0a2020 3c2f626f 64793e0a gif">. </body>. 0x00000160 (00352) 3c2f6874 6d6c3e0a 28ed9273 5116f895 </html>.(..sQ... 0x00000170 (00368) 8001 ..
Strings
. ..... x.@ . [ N . ..? . . ] .e . .... . 080404B0 2.5.0.0 Comments DEFAULT_ICON( FileDescription FileVersion (http://www.eyuyan.com) IEXT_IDB_STATEIMAGES LegalCopyright ProductName ProductVersion StringFileInfo TEXTINCLUDE Translation VarFileInfo VS_VERSION_INFO *.&>*: ,<00*N ,0$0N\ 02LmQbr /=,02tm 0.3 n.N 0$,4 (, 04$ 0(,$42"N )0$4<8 $, 04w 04( ,w 0"6N@7H >07,.l8 "&{<08 , <084$> )<0(84 $,08<4 08<4 2 0bl)YZ 0%:Dl4 0|JlC7 0l1Qt< 0?lnkm 0lPs&F %0lzuUG,d)& =0m?-] )0m"~ g !0m@"l 0N8*Re@ ,0< $>O ]@0oiu =@0o<"l )0~PMhd 0{q mI 0R9U2l 0rlIQY 0RnsTCl 0S,PlE 0t #?Q 0U`]xI 0\vY V= <0$(&w 0w$"F( 0^<Wim( ]0~ WS 102#4d4 1@0hl$r4D2P 1 4zjc 1"7nk^ 1BbjOyl 1BDN"G M 1bxlp 1cJWm. 1dC23Hl 1fNtT4 1g)lJ` 1 :}Ki~MwW 1;l<2^ /]1l7V_& 1^lkDQ 1lqB>C 1-l(s.RTt 1lyT^# #1Mc9[ 1MmA<h 1mm<b[C 1-<NEw 1#N fG 1Nl8}t 1!~P5< ._1S2t 1VD/%]h.Sm |=1Vz; 1zlQTq 1{Zzl3 (2":.& *&2>) 2&.":*> 2`|<0, (&22>. .22&2N 237zeO 23Nindow 23NlushO .":2*6 *>*2.6 2>6*">:& 2&*:.6 26>CZz 26>)hr 26hw\Yb% >2&.6O 27D)1l :.2{ 84,( 2D%aT@ 2.dlNGDI3 2<dZlz 2E1.M? ~2=GM3 2{hMyl 2>.")hr 2">)hS 2jGl| 2Kd0i1@ 2Kd0iQ@)" ,2l%:~ <2)"lN _-#2lN 2"L/tMY 2|-*lX *2lz4J 2m_lRk ]2mr@h 2NBitB2 2Nessaw 2NExcl2 2Ng)]E 2NGetV2 2NGetW2Y3( "&2Nloc 2NokWi 2:NP0H < (2Nt5H 2OeNClosO 2,OOW8 2T7Bld 2u7?pj #2U%LJ 2v?CqR (>2weO \2wl@] 2wPMlI ~2xTlK. 2+?zcl 30$86" "30n"30 >30(NClos*YNePriw 30NleA 3<0Nt2H :30Y:".> 30Y0Y3 .30Y30 30YNgeTiNessaO *30Y*u >#*33Wn 34n2NQvl 34YNikl "35vDs *37ctNetRew &38, 4 .38Y3<Y 3 8YNs _3B 2j _3BH:l 3b(jZl 3BkB.b 3>cIh! 3-EMbp 3-EsMo>u ="3Ey{ 3f,4b0z 3f,4bsz *3GN>3j. 3;{hND 3IP6ld ="3i PY 3iq"ljJ 3jD'*] 3JI4A# 3JZ!5[zj(jN 3l +8" 3lcB"o!z 3lH|3x 3l/|_o 3M0"Bw 3mMRL8H 3mXYh| 3.^N4= (3N/;6 3$n638 3NAdju 3NameAw 3Naptuw 3NceleO 3NCrea >3NCrea>Y( .3NCrea.Y 3NCrea"Y, 3nd9-o 3NDisp 3NeHanO 3NempPO 3NePopw 3NEsca 3NextCw 3NFramO 3NGetM 3NGetM: 3NGetS* 3NGetV6 *3NHead 3NileA 3Nindo 3NineRO 3NInte6 3NIsZo 3Nlg32O 3NmentO 3NndowNopWi 3NntStO "3NntVaNonme >3Nnvir 3NObjew 3NolorO 3NowMeO 3NRegC 3<$"NRegO&YNpenK&w 3NringO 3NRoun& :3NroyAO 3NroyIO *3NroyWw 3NSizew *3NStriO 3Nstro&w &3Ntate&O 3NtePrNCrea 3NText 3NTimew 3NtModw 3 ,Nu&f 3NundRw 3Nursow 3NWindw 3NwLonO 3Nwspr 3NxtenO 3nXV-e _3o=HM "3(OnO ="3Pix 3"QoLY 3RBkB.@ 3` r/Cl 3-&Rk0 3@Sl]0 3)t@Y|m -*3uh\ 3Un" la *3uvhi 3VB .d 3vm)Civ 3vMl\J 3w/N]Z 3&{W]y 3>"=*x :3$Y:N4 3 YNAcce 3(YNCoTa 3(YNGetP> 3(YNGetS2Y 3<YNMess 3 YNOffs*n .3<$YNPI32w &3,YNSetR 3(YNtSpe [%3yQIxE 3,Y"u4Y 3,Yu(Y 3<Y<Y* 3 z;c\9? 3Z'eSN. <(,4" ::4+' /, 4.<>& :.{$<40 )4,( 0<$ 4($,06 40,((6 4,08< 4*_1l] ,4"30Y <( 44> $$44.>N 44:NP6H 45m*jh?l 4`5nI4e 4< $6O 47Jo=O. 49luSF 4Akl!j 4blPj =4BZlA (4Cl,{A {4;j. 4{j$,C? 4Jjt+ 4l04r% 4:lJE(e )4 lT? 4l;T71B 4lTBt2 <4M^[:% 4"moS;)lkJ\z - \/4n 4>N<2H |4pt.P 4&q RO )4%Rl. 4{SP/@ 4t^CKl \4,tJU <4*U*O 4([x:G 4xlt1D 4ycCMdg (4YNiewp6w *4Z5RMQ 4)z\^lK= 516?]? [56SZevl 5AZblS~ 5b&d\lq =>5"jW #5kls\ {'5,lq 5+N6@B 5NA6<N /5nHCq 5nioRk3 5njeiW %5)n}o 5olDVYJR -5qB~n 5r%2lt,K6" 5r++ty 5S5Vql 5up=UZ _@5uUk ~,}5W7 5%_yjI 5zlK:U 5/&Zmdi .6{(,$ *6.&:{,(< &:".6{ 6."*:>) >6:*2" ."*:6>2 .&6>>".2 >6:"2)4$ 6*2&7eAO "62:&.)h >6:2we>O 63NCrea6 63Nhreaw 63Nyte ,66:6> -6.7B0/ ]67lIe^c 6)<8$, 6>)84$( $ 6Cl{ 6)comdlg32.dll }"6%Dli ~6E"lL 6Ev]fT 6g8#l$ "*6{h8 6hh9)crJp 6iiu[3 6,ilWXN9 6JI0$w %~6JmnOJ 6jRt4C 6\(l|3h 6"l4o5 6{lD:dC 6Lfm~l 6lfq/P52t )[6l@R }6l[z9 6M&m}] 6m% n "6N03H 6.Nage 6NalLo6w 6NceEx6w 6NCoFr6 6NCrea6 6NdLocw <"6Nect 6NGetV6 6NjectO 6NkedIw 6NmentNncreO 6nQiP~ 6NtionO 6Nwave6Y3 n6u 6[+~ Oe 6{oHkx :..:6OhO 6p.)u/ArC) 6Q=/dF"l 6RJ=)Eb $,6Rln 6r l.wy *6"s<( 6T8BIYga 6T|%;e"l !6THbK}1 6u,,*3< 6uA]Yl &6)ulO 6u$Y6N 6vLilE24] (< ,6w *6.:&w &6::>"w 6wnNicRgw 6YQcNny6 71u>^l/ 7,>5rs 78J?C{ 7-8_!L 7 92N; /7:9n( 7'AdlT 7Bj|J$ 7DA?vYl4 ">7eAw $7ExNndowO 7FT%Wfm *"7gAw 7G)U-O 7ip=#- 7<=lb9 7$=lE .?*7Li ~7lVX" &7me>O 7mH9ip ."7ntNcemew "7ntNCliew "7nt:w 7nxRlL 7opNamStw 7o<tZ2 7OVEb+ 7Pd{h!E 7PN1g$ !'7Q$);' >7Q]?4 >7QQ?t '7Q]V1 :&*7rAw "7RO[l 7(romM 7<tIl| 7tsNbjec 7u3iw-} 7V'Irv 7X/~Ok >.7%/y! 7@zTkA:J <,804( 8(0< 4 8<(04,>NT6H "&80%)<M 8,($0N0 =8:^(26 (82NP2H , $<84 84cCvlitmy <,84(>N 0H 8>.**&6."2 8>6>*2 8>626. 86NgEx "'8+"'8 $); "&8!"&8 8AfTh8u #]8*b& @8`b=8 8*Exj 8`="f=+ 8 =he{ 8)i,l4 8%^ KXC 8KyT: ?8lAzk7 *8lbt} 8lIX?T 8lKkEB 8l !Ov `8lZ!D <8&N`5H "&8n!%7 8>"NH2H 8*"NP5H 8.*Om>O 8'ORml ]8oYvQ 8s p0l 8v5_SHk 8vA(bP 8vC^$[ 8VczTlf 8!VZ5G 8WRSl4 "&8y"&8@!'8 8YNpboa \93kl# =[94FQ| .9}4v& *)95lA\ 96KP7 u 96(:Y c 97vlp4 #'98'+> 9@-\A5 "(9d"&8G"&7 ,9 El@ 9JT*j/ "(:9KS_ 9l148#QJ 9l9So0 9laq*J 9lbJXK% 9:lo~FV 9ls.N[ 9;%l'!#WQS]_lY[EGACKulwqs} ~9M2jd _9m+_X*+ 9olZrL*R 9= pB[n @9SEl= 9spl&1 9T0A`O>V 9T#Iyg 9TSJ3j 9 VlZ~ 9ZnJ) Wp ~-A0Rp A2ci-l A3\lc4S {A5l"O% # @A8/ aC4,s|c AClkHO= acZN"lCmuTt ADeRklp> AdlKb{ ad*UKw ADVAPI32.dll A;Ei)P }AElC> AflQ?r ag6=l* A*\gHl agQ!lvt ah4<._g A-h'hN AhnB@ .AIcqe AiiO(H AiJn"l `aIqJ0 A J3Wx ALAd-fC/b alAlNGlob !AlD(hX alFr.O alGe2O A:@lk~ Al\L| AlriSH: alSe>O alSi.w amAu@'l ameA*O |aMPnW% aN,7eub andlNSetH:YO a<}o.h, AOKT6l apNssHe aren"O arie6O Arv%s@O :$-AS$ as)l+_@ assANerCl AS)s]T At^lUk; aT!Ok] AU|9zi Aulpq"4~a (.A_W\( a&wdl%- a)(WS/- =A]Y}l\g A,zh~#I A~zn~# b195n5 b1 Exj %b$2qy@ b3Ymhv =b3(Z) +B4l%" B4LoR^l B5#Oii b 6LB, B7?0o" b9_+l* b bCK5T bchNh4BZ BD6lYq/ bdb`bbbNbabMacOc$c c"c B'?D!hE b*Dl5A- b=d?nAl ="Be( B^fD 7v bga5l A Bg$aJ0 Bgl3DF| <% bi% bIDDBX ?^B`iL Bitm2O BL,1Mz Bl/6sL /{Bl[K @(BlN"%E bl]O^) $blqv8r B&l@q)W `Bl$|S BlSgxm \BlT,D7d Bl-U=`s B?l!x+ blYwKt ~Bm, 5l(U BM|l4R BmM0]s.n b*N=lw bNU-w, bn&wlu B/o"5ih Boa# h/ boar.w >boAU% `BO}#CW) Bq4hIsZJ bqtd1f bRerl.3 BRMYNzrN brnl4s B<T2&x BT3nI. 'bT6"o bTiM1a b U4m/ b>=u!Q BV0I.R <BvhK@ \BvmIo BXch`C@{MTSm\ B]*\ypl byVpLJ c1f#nA' C-3,cX C`3Ul~ C4ogyIa C6;=^5 }C7lf^ c%;94oP cANwProw catA2O cB( $l c<}BM2 CDM7$1 ,*+cEC <C EU9 Char*O Char*Y*w CH@_Bl6 chBl>O ChMwx[ ChooseColorA C+I+_* _CI2+_* CIiw$Y< Cjeo)I cJERo c+&jNO c;JPml [CKs{ck {~$C-l Cl'D:I C~lg , Clip&w C+LlB4 Clos6Y ClosePrinter Cl'sJV cl@x2| ClX$;M cMcQce cmpiNlstr [CnOi\ C!omc QPJ {COMCTL32.dll )coPZ l CpS4l` C'Q"\l C:Qle> cRl*Qh crol.O csJn\zh }ct~G> -Cu5.l cu,/e; cute&w Cv-*i@z&3J c@xG,B Czl4Pi d 0~bl D1^)#i d4{N|q /D$ 66S D8%8u< d9S[qf D<9Tql DahZT"4 dateNVali DAWl $ d B"-4om DCNible dC<{ R> `dd@dB }+dD'l5 DdR'=G DefW*n Dele6n63 ']DEWt D(fCtq DG5rUp .'d*Gl Dh_4l-9 D#_h BI DhM:)S Dh wE| dI}n5Q dIW /F dj\HO ^*D#JlC DJ r8ql dj}_U. DjU %l d^k=I>J dk#\lo DlbxOF dl)fE` dl s?@] !dlSF[ <dl\T*E ~Dl<ud ~=Dlz* D{`=M$;@ dM\g8!9 d%_mlb9I D`N2fr %dn3Ly D{n7St0l dNu N@c ;dO^lz.: DOl)Zt dPo$M{w Dp>V;? |dQ4lN\ dQD Sl D*ql.= DQopl%r dRec&O Dr.jh- D\r<l4 ^Drlz5 Ds~lcC DTCFlu DTCSl2 dtL%FX6 )dtylh D!Uc_j duh^{l d/uOk d VlD1_ dWin>w {Dx)j/ DX JSH dy1e?o- @-dy#P> dypbmI0 E0l 7r" ^'`E0V e'3-7dl e3"|CKy3 E42qe- e4ewe<%/l \E4Jy? .e%:5mh E#;= 6G( E!c)S ectR.O e[D amA EDlW&n edTeNTabb6 eeole32.dll =EeTP.{,@ e,H2`Zbl e?h-N(w EHxhza *EizML E*-j"H EJJjucl , el68 elE47O elj,Q( <E.\Lm/ e#l^q. ElUB{t^ E[luh. {E&lxb @EM36WL EM~@Al "EmBkYquX E{*N:. eNhaU` ENl>4q <!EnMn EN|\mp enuC:O Eo}_}% \EPlh EPO1J0 e?&pUh EP[zT`j23 erti"O |E\t[' E?\)|T Et09pEi? E >{TB EtI5xN e;%u04(< $ `E(uhHiJ ]E.uqw euS)M5 /ev@iP ew@1.v /eXlb extE.O <eY5il EY:rhI -e$zz. =F^%, f03{ y f.0[l;< f2`#|kn f`9^ X FAGh e fAIBil F{Bc`) <FbhK@ "fblW|7 _^ %FD fEcltA FEhT : fh0lx+E =Fh+ h &%+(FHP "FhWpg f.]^i> FileNndOfw Fill&Y&3 Find"Y>N fjC/>( F -K4)3@ =^]f}l F/@l2z fl/6W?\ flDVc{ .f@=,lH _flkHtRb >F&l!P flt)[I FL tY= fl[}U1 (FmH2l f n-4:#m Fn$Ppf FNz(_A ~/fOfo ForI&w #\FO<y :Fp<e~ f~Pih3 fqmaOA%@ FR l,o Fsl!dD,mW(o fS_X,m fUX/=9 FX.@4Q fyMeNModi6 [#+g<! G2;mgul( g/3->f "g5 7QT .#G7x {g@<@8@:@&@9@%@;p'p G=8F J #g8U^l @G9Sp& @ga\^b gANwLonw /Gb}8h gB{`!l gcZcFcYcE gd5b3Hl gDDVW^ G>d<G$oTSVokB GDI32.dll Gd?*jJ. gd_m5t gElZ$# g@/E{N ;Ge:n^ `G[ERg GetC:n GetD:Y GetF>Y>3 GetM:n GetModuleHandleA GetM:YO GetN>Y GetProcAddress GetS*Y0 GetT*n* GetVersion GetW:Y:w ghQW/*_ G?;)hs gion"O (g ~JU gJXO!Z Gj,z9l ]gk_`% ^_G\l7Z G"laX]r_^h ~gLlfo G@+l-N /~=\GlNW Glob2Y2w gMbn\NJ G]*MO4 gMTX5S {gm%YB g~ nU. /GP{lA gthANtLenw \guBJ7/ g}U(ge Gu gryz .GY9Bli gyq(/< gZ3oXA >:"*{h .h0C@R H0CXal+ h1ZG4@ \H3xdx h&@4(# h4W*5vb }H5Gkm ]&h6cml H6V+hrv7 h7W'j:u >h8ptQ h8q:l{ h8*tl] ha~l^* hAPc:H 'hBHwaYl H blos hbnaoT< Hd|[il -hD,l6 +hdlLv `|@Hdpdxd` Heap>n Heap:Y3 Heap.Y3 hg@lNy,\A HgrlW Hg&WlK *hh5ocD h'H=E Hh)L=! Hh[@Vx hi9laT #&]H#IA h'imm$ 'hio?P "hJ*_1U hjbsh` _hj?l HJZ5(O /hklG; h\kn.1 <h?;l{ ?HlA'T }H;LCk {HLheIc h;lIUD]K hlNzeW Hl#S*:y ,%^hlv h<lWw= >"&*)hM h$m<D\ hmK$}h Hnk~_6 hnmP)J .h-n&o ]HnWl3 hNzlRw| HooSvM hoqP[*r HOVk68>R ^H}@pn hp 'U$a ``h{%!%Q!%( hqEhkg $hQ@ge` HrCg@b g Hrdlq-b &")hRGQ hSltgu [h|SvOf H){)T3lZ0 hTlP4W Ht"^XQ ")h:ul ]~hU m hU&Ylo %`Hv]y hvZ.}x ["h.W#jMMT ".&)hWpl hW +).Q Hxha]& Hyz}ot# hZAB#l i0u5)_ @,+i19 I3BP*b I3dL8D ~I3o6L I5h Es I9O$Up i|A+;=@ iAh%n0 iaH!N1$?Z i~Ajl] ibfOO( IBit:w icatNDupl I]cG"1 i!cR^: Ict_L? ^IdM V( IE7?fJ IE7?`J iE}l4UX ieO-j^B4 +i+)eP iewp6O iewp6w =IGlId IG(ovmB ihnVMJx ;ihu-n[; 'Ih:W @$i|I`sk ij8I/> iJj8zwPl /ikHlq iKmR+r iKnRr2 il"7y@O$D i=l9 p ileN*w I|- /Lh I[li+e Ilj0p> |IlORh(}v^ i?};lp <IlRG8 -Il ~rm ~i!l[T> I l_Tcy Ilv8!& in-B q indoNGetW. indoNSetW indoNSetW.Yw indo:O indo:w indo"w iNf It8: .InU-c.mh in!vw! IN W_< .I"ovM I+p2]I iq*'%HyLy bj irec"w ]IrM!^N ?i'S=[> IsBa*n IsBa.YN:vf i\sBUl isioUW Is/nUc IsWi&n& .It+eU }Iu0a' .i~u4n >iUj' iU-n5h - I;v} IV#2xi ivNMulD" Ivuk%/P I:?Wb!Z iY5Tk( iyT)"mV {J <,$ j1'l~# j3 3EwQ j3e"l. .|^j3ul "j4twT2 *j7@i3n >J8`4% j^8MRm j,9L]A4} J9ydl/ jbJM,) JBnl'?- JBpSkMM jBTh/3B_ .jC@2lJ) JD%Aex jDfI>{ jElw3L& Jfb=Jx j| fjJ J"fP0al JgBld7 jg<h@& jgiSQp ^j]h0j {*<JhGl ; JhOhVa0t .`jhT5 jhYl-*v ?jI0:] ji^M[l9 ji)n>i&< Jj@Sl| `.,jko j\.l,} [$!J\l j=^l"n Jl$O+V }jl%q2 j l~s j]*^l,u /%JlYr jmfkOk jmMlAY .j$&MQ %J~m^t4 J!myMU J:<@n1 jNSLgZ jn>?w vt? J=)*O>@ JoDN&u JOja0V JOmVaLt jON=SW@ $JoSIoks jo>Ta* JowE#D]" jPB]5& JPLC;_K JPLw `v ~!j}R|c] j$rDD] JS`N si J|T7R= );ju|V. JVMk9Eo Jvs>ST jW0w3Q jwkn'op JWSyl| j>wy\] jW_<z0 jW_<zp j|Z<o.> K23MX8 K@4gl7]$ !k7dluT K7_qi| k8XnIH _%/k:}9 k9D, l $ .ka k*ABsl k@a]'l ka\y:cn +?,KC#. `kCds< k>d=< @ kedDNrlocw KERNEL32.dll KEum]V )*~>KG k<h!55 $kHHL, k\H+S}j k#I%@3 $/kioB KI%P}lZ kj1)`+ [KJaB65 kjL`$T kK#C=[ k$@kj3 K^LAwo$ KlkT^1? k<Ll/' Kl`}L< KlpBx4 klQfFu KlT{Hz K$lw=/ @k lwn0M k>L]Z\G K{>'\M kmkV81 kmn(Rl K%Mvn )kN1^MB ?k$nlu kNXvI4 Kolmp!+r koL`$T kP3!-& kPImK< ^kRhlT yi "KRylc K,S6-< ]K>s`ei ,k<{TNRN K~,\ts ktycqInD ]k(u1;6 KUDZl$ Kufhm7L kUhWP. k#ulBN[ k)=vn @kw] > kWAsl!P KWuQpl kx NSf kX, t(te kX\U>+ kxv=9] KY@Ml$ ]ky_StH kZF,lU $|\l,* {l=,` l/*+(- l#^" ; l+),-/ L=_*~ L,0a][ @l1S,{ l1~)@T ,L2lkJ~ l]2<*m "; l2&O L38b#~lY l&<3J6 @ l4{; )l4#2 *l4 6r:^f,l l4_fFt }l4]i: l~[}4N TL l4oECQ l(4$x[ l4Xo3@ l4z Hl` 7vl` l4z@ijG1 }l6nV> l, -|7 #l73{p< l75&Q" L7Cil? l7<)SE l^7}wO4( l83)RZ \=l8t! l#\8:v L93Rl{ \l{9_L \=l:9Q l9$qt1 lA0.p> @lA1!8 lA2Ds lA'I|k, [l*AmF lA)NkJ l_\a(R +la RDz lA!;)s lAW7PCO ;lb2H9 lBD4I. "lB@fT :lbk\X l,Bp^ClQ{D lBQ-xZ @lbUKm /lbWdq5 ,^]lcEQ LCJ!ld LCMa6n @{lcsD l@C`/u lCwsgr _lcx2Y lc.XE$ \ |l#d l^D~_" ld1bR.F l@D+9U l<Da@r lDbQ+"?' lo6 lDCmbz +?lDH! lDnJ1vtm |/ld#t l\{dZX -}l;E6yf l&ea$0Sx1 lEb/{Xz| ~lec~) l#EfUl leWiNEnab& ;lEw>v@ l?=f[| ~ {l\F l.?*F) lf3P4= lFN;"H lFnOa, lf$V}h LfwW{B l]*g`4 {lg@ a|l lgCt&w lg]GEW lG-isQ lgItNGetD> +l*[GpA% ;l|gPdh !lGq=<D lgs9<L {*lGU;n ` LGy5 lh:0VW :Lhf,6K /lhFGC lh\(@J L$@hSe l$! HV l<)H]Y <{?li( LI2S~( >lI5#P li(6Qf9 |l$i@6r LI9|zSM !l^{id@ lI*,jP )'liL_ lipBNGetC&n&O lipb*O lI?T>/ lJ2r=6 lJ%5 T ?lJCtS ^l,jDp `L}"jo l<JpHz lJ!u5Q ljzZbB ,[lK|* lK^9.ucr lknihm ;l$*kO lkR2D, lKT|`h lLD_N` lL@IeOT Llri<O l_-LTy L`lW>Hz ,"\LM@ l! mh8P` (lML+tE lMr0D{/ l+ M!r4X l,m/tG< lN1D-= Ln4OJl lnoYr l ,:nVl $lNWtp\ 'L,?OA Load>n3 Loca:Y4n4 Lock*Y ^&loEI- LO]gn5O .LO{ql lOT^GB LoZo|2 ~*$LP\ lPhb|6& l.P^j# ^lPKts lpOZ@% ~lpuoP lq7D]4 l}Q&=a" lQ}#A- l=Qaph lqDnA4 lqf7!9 l QgW_^)8 l</qS lQt+h +(l*qV# lQ;xrh `l r.~ .l$r#>< \lr1|.l lr dj6) lR .h<U> +lroyTX lRu~:- lR~X3@% "lS51o (lsa'H l!S|EZ lSHELL32.dll lS^i-% l#'Ss2c lSTpvi3 }l@SVZ Lt0jld Lt6. % lt8m\ns ltBReyi l TDPr l TLv& LT|:lX%` +LTm!, (ltN$W l *Tu] ^l=u[! >~/_lU lU3mXd lU4I{L lu :aD L`$UBr \lUbS= LuD/pr0l lu~e& >l(u}m l}u{si $_luw+ lUw^v> lV~,C6 l^v/hw lVNMFf l~vxph l'w!:) lw76)P lWA:hs $@lWf* L~Wl-b LW%l.Y ])l`WM %l{W[P9 :/l^w"r LWrN32 l!W )s @-l#Wt L`wx]h ~lX7B\K l)x*m2 l,`xTS" lXVqtw l~y'4! #lY*4q *lY4Zh ly8-7/ |l:y~j lyRXWa lYS;z:- lYvI-yo Lyz]1l/ '"l\z- !lz45x 'lz-9~ lZJ[>O -lZpPx lzr|tm lzu*0` _lZ.+z !M,.,$ M0%oH1 M0]QyU m1lqLd m1yMGl< m2G/ 7h- [ m2Z":F m5Jm=[q M5Pn J m!6lA# m7nE36 maGA\C m=A|lC MapW>Y MBjp,K mBQNib mBs0{B *MbT"J2q MBYF~lq U M^CNaR ]!mc QJPJnI m)d0&8 mdl)A7Q M.dl&O /MDmI/u }Md~Uq MeM~ML-( "m)ephPh MessageBoxA meTh.O /mGs}hg MGS]tC M=h9s1 <-mhC=y0 mh!jo *Mhk7I mi$9(xG MiaoK| midi6YO midi*nu midiStreamOut +/MI,L MJA,^4 mjAnmq Mj}(iu MJN?94lF mj[Ow& M{K\4r *?Mk_dl ml0} r <M&LJd M&Llog% Ml\qZ&E !(M_m5 mMenNystew #mmhn. =+mmi{G M?M=jO Mm( lw mMwl9: mmYm5n MNn--J m<#n{o> MN}q`Ml7C mn-.QW -<mOEx [<mOEx moFh}h^> mOm-}1 MpbfSF M@Pf6coH MPl$)F M PT*Y M\P(z=& M/q7(B !_}mql M^QuIU MQ]+ZS m(}\r2| <Mrm'C {$mS)! M_sHAQ \m>$/T@ m+Tlj'^ mTS*ehNE M;u]MN @MU>Os MU:vi= <m?#]V MvD<kNj M]wQ_&k;W )MXGlVQF M(XYL"s M-ZRS: ^.~n@@ [/N?"[ _n&1JAR N24Z_e n":."2.6 N32.dw n38n(n, , >N\3H N3rLl_V $n3 Y> :.N41H .N.4.T. n63(n( ;N71l~ n7naN=krv N7Vt\h *N80H n8o4-` Nader"w &NADVA& :NageAO NageA&O N|}al5 NaletNizePNReal NalHaO NAlloO NalReO NamOuw !%<namq@ NanglO na'n#Vn NapMow ]N|APRl NareSO NaryAO NastEO NastEw Natchw NatorO NawWiO nBGErh N}%{bh NBitm>O Nb&kHN NboarNClip NckFiO NClasO NClas.w NcmpAw .NCoRe. .NCoRe.Yu "NcpyA"w NCrea. NCrea2Y23 NCreaw NCrea"Y Nctivw NctObw NctPa"w NctRgO NdCod.w Nddre&w :NDest: NdF0Vo NDFroO N.dllw n[d Lu NDn{,.94 &NdowF ndowNIsWi ndow&w NdWinw ndYlh] nEB1l4 NeCapO NeCliNClos NeCouO >NeDoc N}EdQx NeKeyO NelerNeAccO NEnab.YND NEndD6 NEndP* NenTow NEntrw "NentSO NentSw NeProNinat NeptiO Nepti*w NePtr.O :NeratO Nersi"O NetVaO NeWinNctiv *NewpoNetVi*w &NeyStO -NF)B[ NForSO nf*PHU NfUC- ,nfZ]l NgePoO NGetD& NGetF>Y>3, NGetM& NGetO: NGetO:YN NGetP" NGetP* NGetS2n( NGetS*Y >NGetS>Y34Y,n3( NGetT. NGetT6Y63 .NGlob. NGlob. nglpU> NgRecO ngsANettiw NgTypNtrin*w /NgvrW .N"h[( n'hb`l NHeadO NhFilw NhOBvZbr NHookw NhoreNemapw Nh:TtlL nia[-9 Nible>w NiBytNMult NIconO NIconw NileNNpenFO NileSO NindoNGetW> *Nindo*O Nindow NInfoO "NInte" ^=(nIo NI(PiM :n <IPT( N]isb3~ NIsCh: Nitlew Nitmaw N$IXaLy :>"Nize nJ4'5b nJ=Cdo NjectO NJ}g h !Nj"XNHt *nj}Z/ &NkColNGetB&Yw NkedEO Nk`+ZD "Nlass Nlassw >"NleA .NleMe.w Nletew Nlett"w NlExe&O Nlg.dw NlgTaO "NLibr"O "NLine" NlipRw NlJasET nlKOE& NllocO NllWiO *NLoad* NLoad" NLock" NlorAO nl,p~7V Nlstr2 NlterO NltiBO @NlZ&\o nm3(w| *NmaphO *NmDir*w NMessO NMessw NmMetO NmNamw NModew NmStrw NndAtO Nndlew NndLiNomma Nndoww &Nndoww NNextO "NNext"O +n?NF1 nNFill nNGetC&Y nNGetT nNGray* Nni_J& nNingAO (nNInte>YNN Nno-Jh nNovYl >NntDiw nNTL32O nNtrinw NntThO .NnuItO Nocal&O NocesNntPrO NockBO NockBw Nocusw NodulO Noled"Y"u NomPoO NomRew NonExO NonmeO &@noOv=s NOpen& NopWiNesktw NoreDO NorTaw NoryAO Nountw NOutOw NOutP6O NOutUw "NowFrO .NowPrw N^ p@| NParaw nPat6O NpboaO NPInfO npjl?qw nPleA_ NpleOw NPOOLw NpStrNLCMa "NPtIn" NptioO nput&w NQ^8sW n_qO=" Nramew .Nread Nreatw NRectO NRectw NRedr&n&3 "NReso"O NrgExw nRgn&O "Nriabw >Nringw NrocAO *NroceO Nronmw NrounO NroyMw NrrorNSetE Nrushw NS1swl NseCoO NSetE& NSetR>Y>O >NSetW> NSetW" $$NShel& >NShow> NsiblO nsNnsiow Ns *+q nS*Q" h "NsRecNFocuO .NssagNerMeNgistw Nssagw &Nstarw nSZ0Unu2 (.NT7H N>t(&c# >NteCoO NteEvNCrea NteFiw n!T[ElZ NtemIO NtePaO NtePow nter*O NteSeNCrea* NThrew &NticaO NTimew &NtionNlSecO NtionNlSecw NtockO NToEx.O NToSyNTimew NtPagNStar. (nTPlq- N>t(Qc#@ Ntrinw N* Tx[lP ^!%NuB NudeCO NultiO NurceO >Nurre>O NUT32O nuvvz& nUW < NvateNePriw NvI:gn nvirNSetE"YO NVirt2Y2u NVisiw ?Nvy:t NWait& NWide*Y "NWind" NWindO nW[o_j "NwOrgw >NwPoiw NwPosw :NwTexO N~)@Wv .:NX2H NXcUjIU @]<n]Xm N$XqK- NxtEx6O NxtExO NysCoNGetS NysCo*w >NysteO NzLe-| `nzU;h O0~ylN o10nmW o1;N=< O1.Q/-' O3DZ}. o3ETAl o3S\x= %o4;NJ$ .O4sgl .O9hrl o9Z>\M OA:]Gz =oA@|jS O^am;=*[ OAt&Vhzk OaW`xA |oaX,h :oAY^o !oB)4. o]blL( ob/xlD #OCTCO oDdj{0G( OdNnwinw odulNGetM Of,FlT o f<G*X ofl[Q+] o}g&@D O$G ^ZlX .oH1V~^ {o>H h Oh`sgl OHZKl8 ointNileP `oIWkilPmi^V ,Oj>__\ o\kGSl ol>]&/ ol8utF @ol@9I0 *o?&LB O]lDxE O,L.DY OLEA6Y6u )OLEAUT32.dll oledlg.dll OleI.Y ol@ENQ #Ol(R, !oltpv* olyF:O om? lD O&M`wp [O.n*] [ON0nUv ON[6m9 oneINimeZ onFr6O onxSyVC 'Oo>]Rl *o:Ovs oo>Zj| oOzlY)Z operNamPrNStre oPl26S oQ?Lcm orChIj orCnIj ormaNeInfNolumw o+#RPR ortE6w ortO6w ,,o|SE ot^AL" Ot j`-k6o otl,3 oTle/7 otvQwl O(uckHr =o>UHwD oUJ:!RIOi oupI.w OutGNwave OutR.O OutR&O oW7|t@ ~|owe`[3**" }O?Ylx %^p]0l P0lQmv P17nNot -P1l`Gf <p293t P%^4Ie p5jy3r P8b.GB p9Cn{VZ p|a_!AP6hN pare6w Path"Y"u$ ]paui{ Pb zlE pc/k<eh PCYEoMM .pDJCARn P<D}@l )!PdLs PeekMessageA Peek&nNMessO pe(IE5 p=eUo| (PEX?m PglL*] Ph,;$j P$HlV- PHO^fN pHQg|n p\ijz> P^Ik*t= pinXr| <PIXH/ #;*>pJ Pje (> pK;b%e /%&\PL ,"PLl, P]ls)hb8q }plw45 (p&lzR pnz 7a~o4 Po1h0n Po)lTn )P,olV; @PO@rl *)ppL-/ p|p pdp PpXh[# PropNmentw P$rp=l P"(S/. .<!Ps.1 PsEl]` p\SpVixH p \`SRb pStr6O PT/H6dK P)/UL' pU|R ?w Pw>J(U Pxr1R7 #p.Z4z? (p]ZG. PZhJnN P('zO1 'q]?-( q2aC ut&/ Q2PDL1d Q3l<:x Q%>4ln9 Q5(K$lH |q5pOl Q6-2o@ {Q7ks! Q&\8 0l ,q[8l? Q9:VTb =qAI:lt- QBElL@} QCalso Qcl-xo&` @QClYZko QCxSS* {q#*.d6= %q]DjL Qd p`6 QF^\dlY Qg/x c Q}hf\f, qHLc ? qh/l~v#j ?Q?JQ_ QJqwG,J qj>wh8 QkCR@Yl% qk]/ x ql7M1"sGD ql9xE] Q)ldR< <QLj0Bl ql{?M@9|B _qLO8p Ql_, P *q]lV0 Q'l@wt qlXi/Q Q lXNx QLX$ql Qm/f-,8` q`/.[o $QoT3 Qpj{ F Q`*POYl Q#PRlq $Q]rM6 qs1p*l {QsHSw qt7@Hl @+QT-j !q?tNl qU 5,YD [QuEN=y Q=ul"ZO Q~UM:@ /QVuqN Qwjo9* qX(gQ + `qY]Ml qz1`P! QZ|DNJ qzn/l> _qZyB\ -*.]^R r?1A~\, r*3~fI &r^~3u R4M<hN R8#z5;3 rA5yy{ RbjN`Z rb&lHW .rdata RdpAVrk .`.>RE rectNIndiO RectVisible RegOpenKeyExA .reloc rEsj@4N R_gBbe>l rgEx2O Rgl|"D rgNTf5 rh<&elX RH>q,b riabNntVa R_I.=B RichRe R:i|?K }ri=]q >r|j=~ (Rj3TLQm `rjAMl RK*~v8Z Rl^4CD Rl8HUn (RlJ'} RLOADER ERROR rloc6w RMDo"} rM EvT-[ r{m}sx8` rNoe"@ ~RNs?0 &rN URG R`_<o> (rO2"3lI& rOMNW~ ronmNEnviO royC.w @;{/Rpl {rR0<- RrR2m-B rtlfgv Rt`XV7hn RtZ2!L rush*w .rvBU> RV|S "< _R!Wl) rz@b@j@ *R@Z@B@J@r@z@b@j ])@R)Zlr ,R.Zn0 S"#08RN s0:xlp1 S1C!lX S2lh,| ~s]/34w S4""D,7 s\4hRZ _S4,lU S6(0C| |s6p*A S7C3u@l "s7&Dc s'7dcl S8@~Y5 S9l6nV> SAI,uk sANbuteNttri Sar MT Save:n0 sAXlwt! s,bl<r s;BR3@ sBrktl s,CDoj s]cGLZ sC/ }H SCOlP^U S &&D 7 @SDVjB se#J` Send:Y3(YNJ SetF>Y>3 SetM*Y SetR>Y* SetS6YNtretw SetT.YN SetV6Y< SetW>Y3, sF`"'J S(.;f)w s#gebwx sGlv^+ S:Gn n= ShellExecuteA SHGe"Y"O sHi`}> &shj#f s_iJ<z SI%'nk S@KGL sK q 4H sL, %? S>l0Dz< Sl27ao Sl4)A S l{)d Slee*n*3, s$l'L` +SLlbt /slM%F S)lR1T }slTxX S(L{!"U slZf!U ,s&N#l-2 ^;s{Ol },Spl&@ SpXCls srB{., srN_[P SS4NZ0 `s}_t< sterNRegi StgCreateDocfileOnILockBytes STlm=D SUbTlsw s?UK\ su(OmY8 {suS]7 < SVA< sw]l1' }sy0eXa sy'VOx [sz/M szUl-` @T,07E ;^t|1- |t1Dl`y (T1W2lSBd +:T/27 "T[5Ion t6elVO t}+6 Nv t">6vlY t7{jIpl t9i]\- t9iK`"| tANxtOuO tAto2O [t+,au tbG-Bt tCgFly tClM86 t)])Co tCoAn- t_De&w tdHa2w tdHaNSetS {)td,l t.e0j' teCoNCrea teCr>w tedwS?l teILNCrea2 Tell3n> teMeNCrea temMNDlgI t:&@Ep tePeNCrea" terA"O teRe>O teRe"O teTh"O tf4 x@ )T%Fb) tgf\XT The ordinal %u could not be located in the dynamic link library %s The procedure entry point %s could not be located in the dynamic link library %s !This program cannot be run in DOS mode. Ti}2l: t/I6,lA tica*O ~*tIW$ tiZ-3vj T/?j~Ll tJzQKYSLA T>KlJR &tkrXI \>,Tl}] T?&{!l T^l8aqE tlgBJ>-X tlgBJ>-X- T)=LM0 Tlm/#P !TlV-t tmapNteBiw tM`n-. j Tm<{Y, )$Tn.^ *tNDvy TNE@yV ~tNlq5CSv_l" ?t"o3O3 tog35 TO"h9Z toraNpenS"O tox="J TpBl@^ tPfqwmG{ TPM<_} tPoi.O <TPSl& Tq8FlP TQjE-F tQl<8(~ t/;q{lH, TQlx| trin2w trinNileSNProfO T;rn+5 @t@r@q@s [-T\sU TSwt,h TtF6Ol>N tTgH~\n ttri"O {T`US.l T(VJGO4 +}Ty} tYD[<, tzEA[F TZRlj> u0Y8&*" U14]?E }u 1~h^ u2ALNeM U2r)hp u3)h,x<# u4n$YN u4Y2u4 u4YNble u4YwAw U7(vl\ u7yj5h .u8Y.3 (u9]9L ualA>O uCfql{ $Ucfzp" Ucl5s` Ud(8`{ )>U|E2X !{>UeZM u~Fl ] >Uh#BmJ3 >Uh Is uh$N)R u-+H$Tl uhtxCS &u#i 5 ]Uid"S UitE;x uJflY$ uKlzE2 UkOh] Uk{^Sn -ULBF8 $UleBM #ulhg5 ulO*^w Ul<p6! ul?pBd u|LR=slI }u{lsi uL syl $U_M7, UMi+7Sj Umm{"^ ,Un9lF uNamClO uNBegi6Y "uNbute"w uNCopy uNcrol uNctCl >uNctioO *uNDataw uNDele>Y$ uNDest uN.DRVw uNeHanO uNGetE "uNGetF" &uNGetK& uNGlob6n uNlAll "uNlue uNndMe u$nNocusw >uNntStw *uNoardw uNonmeNnvir uNortO2w uNpRgn uNRele :uNScre:Y0 uNSetV6n uNsHooO uNskMew uNssOb *uNssVew uNStreO uNteIcw uNtialNnini uNTlsF uNtretw uNyste Uo2`j| uo %*D "/,UP= \u.Q<g $ur /%S ursoNSetC used6w )USER32.dll u=S.`IcaNA U&t=gG UvRnBgB uw0EX/ /UX"$} ,UXly6 :u Y.>.:& .u$Y2>* >u(YNElli u<YNFind"Y u YNGlob2 :u,Y:w uzH7c 9 U^ZM3P `=*?-v _[v; : V\(,1Lu V1(pO! v2b)h4 {]*V, 3 V3b4EH -V3CT/ V[>55x V7@h%n &v7&TY_-u v8C-M> v8in"r v8kV:0@ 'v# 93H v+9Rn= &v}>bqb6b .VcBZH V.c="o $VewCz @? VFGcD V Fl!Ui v=`'FN vg1s l V-!Gm) "v(H,l vhX}wbklspZR v@I]5lV V,I5olG VirtualProtect Virt>Y |"?vj~ vjes.O VJG.i, vl2{:D vl4B}U9 .vl\d V)leKr- v^liZd vL}lF_ VlP&{< V~lV4d ]Vlx?v vm39Fg ,VmCl{U v MN"- ]V&my-c Vn0AF6 vN7^Q\a$ VN.'I} V`?o0i VoI3=v voJmv" VPf6qg V?p,l* vPl"SK VP<Wmn :|V.R> Vr6FOx vsjYxG ,#vSwpAl /),#vt vt]1ql vu1h0` VUBn!G|= vU]<ni V"v/,2/l /V vBnW >V wBn %vWIluM VWl/$ V>XgbX VxH;6j ~vxlph vx@'_u V~Y>Tq (w>0^l =W3+l"z w, ):4 ^W9 (k=7 W 9KtX W)B@lI wBmx1 W_b&[r wCon>w W\dN$) w|@Ej/ :WE#p Wf2iW> @^WfPN WG_M3L W`goDn7 whw*Wh WH?XO87 WINMM.dll WINM&n {WINSPOOL.DRV WL8Dhm W`lAAR@ w+l`bB wl{L8^ *W',lM W\->ls WlS? $ }%@Wlt w?lU\% wl-yAG W-lZjh <wmNuIteO <wMyn; Wn[@|@ ~W'N-| -W!N{4iZ *wrNtePtNdWri*O WS2_32.dll w, S:4 W.smik W;sSlI wT5(f' w!uj*- .wUl2k WUlA3S wUl@Es *W<?w<^un w>XoWf wz-l8k !*x0/$ x0pqNS. X5=A&E x6jM,c !"X7PZ /xbjQn X"bL'L +X Clv %^.xcXW =xDslN{P xEhtVT xFA*&Y xh-jnI xh=vlmN xiB?kV X\IBnI xkl@RjO9 XlDMV> xlEVzB Xlg >z xlGZ+FC Xlr56` XlTt~I @Xl,U_O /[xl!v xM}7b3 XmfOHn=k X#]Mwh XncB @ xNOkMC`{A x"n|Vr Xn{Xn[O=o <xO/kb xPnn5) X\QAl1^ x$R2yFDlc +.xs) xS6:CDz4 xS{i*Q x]up^(VE XVfGsha xV+l TMP-4 }<xYHX | x z f y e x/,ZMj Y*>.26 Y2GG/Z Y&2:)h Y2.*>)h Y2,@(l*!V Y2u n2O Y2WlP0 Y.38Y. Y>.6)h !Y6!yn % Yb1gB /yb )l @Y ,bT YC4&s.1! ;y@D8d YHslI" , .Y?I *yiG)/ ylQknf ylW/$O !Yml#2S Ym%m{G- <Y"N2sl YNalFiw YNChil& YNClip.O <YNCopy YNCrea YNeeUnw YNFree" YNgeOn"O YNGlob YNGlob2 Y:N!ql YNread YNrectw YNsObjO YNToReO -YNX)t YNyste*w Y,P*7e %|y$/Q _ys_bO Yslt4$ y/<_T'Bl7s Yt_h}N `*y^UL Yv7L"t y wc*] YW@:sJ YxwW}5 Y$Y8Y.6 Yz3vjZ <'Z~|# $Z([+. *):Z48 z4|<IjA #/Z<4l! Z7k{@K z894ePlfZ zAv4kn z;cb[T.ki "zDAWO zdlZqo ^zfDN@ Z^fQ5=A #]|zHl zHy, ? ZH(YR6 ZI.l8/ ZJBf~-7l Z?jiK- Zkd1g Zl >/8[l zlc|"jw ZlFXnk ZlV2i$a{t zlVp, ^z]m?;Bo (z`n~C ZP1uKS zP 8Bwo zpGlDtoC /ZPI}j Zqo.ljbx :Zr} % ZRf/lT Z%R(jn zr|ltm Z>sjW] Z)tcF$ Zt]h&}l &Zt]l8z ZUhP-4 *(z)V zWUB)] ZZbM7L