Analysis Date2015-01-16 02:58:21
MD53c93f35522f1e531fd0665d2512aefeb
SHA13c633bfd261547c85fb138c10abad39543608d19

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 0bc2ffd32265a08d72b795b18265828d sha1: dd2a446014a37556f39173b802c63a4e46e09366 size: 23552
Section.rdata md5: f179218a059068529bdb4637ef5fa28e sha1: 6035d27db526131eb0f29aee60cfcdbb5072ed7d size: 4608
Section.data md5: 975304d6dd6c4a4f076b15511e2bbbc0 sha1: 1f65340672c91ffd0f2583ff104beaece43c7855 size: 1024
Section.ndata md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Section.rsrc md5: b0c329e58e6d20a6622f38adbabfed04 sha1: 44ced87b5419c2e44cc84391c820d56ca48ebe88 size: 29184
Timestamp2009-12-05 22:50:46
VersionLegalCopyright: BEARPC精选软件集
ProductName: 愤怒的小鸟
FileDescription: 愤怒的小鸟PC汉化版
FileVersion: 1.0.0
CompanyName: www.bearpc.net
PackerNullsoft PiMP Stub -> SFX
PEhash84800011852b69c0d13e643ae837be8d73946d9b
IMPhash099c0646ea7282d232219f8807883be0
AV360 Safeno_virus
AVAd-Awareno_virus
AVAlwil (avast)no_virus
AVArcabit (arcavir)no_virus
AVAuthentiumno_virus
AVAvira (antivir)TR/Agent.1118503
AVBullGuardno_virus
AVCA (E-Trust Ino)no_virus
AVCAT (quickheal)no_virus
AVClamAVno_virus
AVDr. Webno_virus
AVEmsisoftno_virus
AVEset (nod32)no_virus
AVFortinetno_virus
AVFrisk (f-prot)no_virus
AVF-Secureno_virus
AVGrisoft (avg)no_virus
AVIkarusno_virus
AVK7no_virus
AVKasperskyno_virus
AVMalwareBytesno_virus
AVMcafeeno_virus
AVMicrosoft Security Essentialsno_virus
AVMicroWorld (escan)no_virus
AVRisingno_virus
AVSophosno_virus
AVSymantecno_virus
AVTrend Microno_virus
AVVirusBlokAda (vba32)no_virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FileIQIYIsetup_l_spl004@kb010.exe
Creates FileBF-BFVCenter[[AB027]].exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\nss3.tmp\System.dll
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\nss3.tmp\ExecCmd.dll
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\nss3.tmp\inetc.dll
Creates FileOfficeAssist.0405.80.1119.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\nss3.tmp\Base64.dll
Creates File1
Creates File1.rar
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\nsd2.tmp
Creates File9377mycs_Y_mgaz2_1201B.exe
Creates FileSoHuVA_4.3.0.1-c204900003-ng-nti-s-x.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates FileMM-liao8302.exe
Creates FileC:\Program Files\2.ico
Creates Fileyx_dts.exe
Creates FileFunshionInstall_C70699.exe
Creates Filesetup_95165069.exe
Creates FileC:\Program Files\4.ico
Deletes FileIQIYIsetup_l_spl004@kb010.exe
Deletes FileBF-BFVCenter[[AB027]].exe
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temp\nsx1.tmp
Deletes File9377mycs_Y_mgaz2_1201B.exe
Deletes FileSoHuVA_4.3.0.1-c204900003-ng-nti-s-x.exe
Deletes FileOfficeAssist.0405.80.1119.exe
Deletes File1.rar
Deletes File1
Deletes FileMM-liao8302.exe
Deletes Fileyx_dts.exe
Deletes FileFunshionInstall_C70699.exe
Deletes Filesetup_95165069.exe
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temp\nss3.tmp
Deletes FileC:\Program Files\4.ico
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\9377mycs_Y_mgaz2_1201B.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\9377mycs_Y_mgaz2_1201B.exe"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\OfficeAssist.0405.80.1119.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\OfficeAssist.0405.80.1119.exe"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\FunshionInstall_C70699.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\FunshionInstall_C70699.exe"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\setup_95165069.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\setup_95165069.exe"
Creates Process
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\MM-liao8302.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\MM-liao8302.exe"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\SoHuVA_4.3.0.1-c204900003-ng-nti-s-x.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\SoHuVA_4.3.0.1-c204900003-ng-nti-s-x.exe"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\BF-BFVCenter[[AB027]].exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\BF-BFVCenter[[AB027]].exe"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\yx_dts.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\yx_dts.exe"
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates Mutex2.ico
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Winsock DNSint.dpool.sina.com.cn
Winsock DNSt.cn
Winsock DNSmmliao.jianting.net

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\OfficeAssist.0405.80.1119.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\OfficeAssist.0405.80.1119.exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\setup_95165069.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\setup_95165069.exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\BF-BFVCenter[[AB027]].exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\BF-BFVCenter[[AB027]].exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\yx_dts.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\yx_dts.exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\9377mycs_Y_mgaz2_1201B.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\9377mycs_Y_mgaz2_1201B.exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\SoHuVA_4.3.0.1-c204900003-ng-nti-s-x.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\SoHuVA_4.3.0.1-c204900003-ng-nti-s-x.exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\MM-liao8302.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\MM-liao8302.exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\"

Creates FileC:\Program Files\2.ico

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\FunshionInstall_C70699.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\FunshionInstall_C70699.exe"

Process
↳ Pid 0

Network Details:

DNSint.dpool.sina.com.cn
Type: A
180.149.136.250
DNSt.cn
Type: A
114.134.80.138
DNSmmliao.jianting.net
Type: A
122.227.42.227
DNSc01.i06.arnic.hadns.net
Type: A
183.56.172.47
DNSc01.i06.arnic.hadns.net
Type: A
222.186.20.122
DNSc01.i06.arnic.hadns.net
Type: A
58.220.2.5
DNSc01.i06.arnic.hadns.net
Type: A
113.17.184.10
DNSc01.i06.arnic.hadns.net
Type: A
121.10.117.139
DNSdown.fspcdn.com
Type: A
221.204.189.12
DNSdown.fspcdn.com
Type: A
182.118.38.50
DNSdown.fspcdn.com
Type: A
182.118.38.51
DNSdown.fspcdn.com
Type: A
221.204.189.11
DNSwww.bangshijz.com
Type: A
42.121.255.144
DNSdownload012.rdb.cnc.ccgslb.com.cn
Type: A
61.179.105.147
DNSdownload012.rdb.cnc.ccgslb.com.cn
Type: A
218.60.107.12
DNSgnop008.tlgslb.com
Type: A
116.10.187.110
DNSgnop008.tlgslb.com
Type: A
116.10.187.111
DNSgnop008.tlgslb.com
Type: A
116.10.187.112
DNSgnop008.tlgslb.com
Type: A
116.10.187.113
DNSgnop008.tlgslb.com
Type: A
116.10.187.114
DNSgnop008.tlgslb.com
Type: A
116.10.187.118
DNSgnop008.tlgslb.com
Type: A
116.10.187.119
DNSgnop008.tlgslb.com
Type: A
116.10.187.120
DNSgnop008.tlgslb.com
Type: A
116.10.187.121
DNSgnop008.tlgslb.com
Type: A
116.10.187.122
DNScdn.coop.baofeng.com
Type: A
218.60.99.66
DNScdn.coop.baofeng.com
Type: A
182.18.51.104
DNScdn.coop.baofeng.com
Type: A
122.142.74.12
DNScdn.coop.baofeng.com
Type: A
119.188.72.240
DNScdn.coop.baofeng.com
Type: A
58.20.193.222
DNSopt.xdwscache.glb0.lxdns.com
Type: A
8.37.235.2
DNSopt.xdwscache.glb0.lxdns.com
Type: A
8.37.235.3
DNSopt.xdwscache.glb0.lxdns.com
Type: A
8.37.235.5
DNSopt.xdwscache.glb0.lxdns.com
Type: A
8.37.235.6
DNSopt.xdwscache.glb0.lxdns.com
Type: A
8.37.234.3
DNSopt.xdwscache.glb0.lxdns.com
Type: A
8.37.234.4
DNSd.qq66699.com
Type: A
DNSneirong.funshion.com
Type: A
DNSwdl1.cache.wps.cn
Type: A
DNSdl.nx5.com
Type: A
DNSdl.baofeng.com
Type: A
DNSxiazai.9377.com
Type: A
HTTP GEThttp://int.dpool.sina.com.cn/iplookup/iplookup.php
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://t.cn/RZIvNie
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://mmliao.jianting.net/mmliao/MM-liao8302.exe
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://d.qq66699.com/yx/dts/sqft/905848/yx_dts.exe
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://neirong.funshion.com/software/files/silent5/FunshionInstall_C70699.exe
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://www.bangshijz.com/M2M2MzNiZmQyNjE1NDdjODVmYjEzOGMxMGFiYWQzOTU0MzYwOGQxOS5leGU=/40.html
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://wdl1.cache.wps.cn/wps/download/OfficeAssist.0405.80.1119.exe
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://t.cn/RZII9Xg
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://dl.nx5.com/apk/20141222/setup_95165069.exe
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://dl.baofeng.com/BFVCenter/BF-BFVCenter[[AB027]].exe
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://xiazai.9377.com/20150105/9377mycs_Y_mgaz2_1201B.exe
User-Agent: NSIS_Inetc (Mozilla)
Flows TCP192.168.1.1:1031 ➝ 180.149.136.250:80
Flows TCP192.168.1.1:1032 ➝ 114.134.80.138:80
Flows TCP192.168.1.1:1033 ➝ 122.227.42.227:80
Flows TCP192.168.1.1:1034 ➝ 183.56.172.47:80
Flows TCP192.168.1.1:1035 ➝ 221.204.189.12:80
Flows TCP192.168.1.1:1036 ➝ 42.121.255.144:80
Flows TCP192.168.1.1:1037 ➝ 61.179.105.147:80
Flows TCP192.168.1.1:1038 ➝ 114.134.80.138:80
Flows TCP192.168.1.1:1039 ➝ 116.10.187.110:80
Flows TCP192.168.1.1:1040 ➝ 218.60.99.66:80
Flows TCP192.168.1.1:1041 ➝ 8.37.235.2:80

Raw Pcap
0x00000000 (00000)   47455420 2f69706c 6f6f6b75 702f6970   GET /iplookup/ip
0x00000010 (00016)   6c6f6f6b 75702e70 68702048 5454502f   lookup.php HTTP/
0x00000020 (00032)   312e310d 0a557365 722d4167 656e743a   1.1..User-Agent:
0x00000030 (00048)   204e5349 535f496e 65746320 284d6f7a    NSIS_Inetc (Moz
0x00000040 (00064)   696c6c61 290d0a48 6f73743a 20696e74   illa)..Host: int
0x00000050 (00080)   2e64706f 6f6c2e73 696e612e 636f6d2e   .dpool.sina.com.
0x00000060 (00096)   636e0d0a 436f6e6e 65637469 6f6e3a20   cn..Connection: 
0x00000070 (00112)   4b656570 2d416c69 76650d0a 43616368   Keep-Alive..Cach
0x00000080 (00128)   652d436f 6e74726f 6c3a206e 6f2d6361   e-Control: no-ca
0x00000090 (00144)   6368650d 0a0d0a                       che....

0x00000000 (00000)   47455420 2f525a49 764e6965 20485454   GET /RZIvNie HTT
0x00000010 (00016)   502f312e 310d0a55 7365722d 4167656e   P/1.1..User-Agen
0x00000020 (00032)   743a204e 5349535f 496e6574 6320284d   t: NSIS_Inetc (M
0x00000030 (00048)   6f7a696c 6c61290d 0a486f73 743a2074   ozilla)..Host: t
0x00000040 (00064)   2e636e0d 0a436f6e 6e656374 696f6e3a   .cn..Connection:
0x00000050 (00080)   204b6565 702d416c 6976650d 0a436163    Keep-Alive..Cac
0x00000060 (00096)   68652d43 6f6e7472 6f6c3a20 6e6f2d63   he-Control: no-c
0x00000070 (00112)   61636865 0d0a0d0a 76650d0a 43616368   ache....ve..Cach
0x00000080 (00128)   652d436f 6e74726f 6c3a206e 6f2d6361   e-Control: no-ca
0x00000090 (00144)   6368650d 0a0d0a                       che....

0x00000000 (00000)   47455420 2f6d6d6c 69616f2f 4d4d2d6c   GET /mmliao/MM-l
0x00000010 (00016)   69616f38 3330322e 65786520 48545450   iao8302.exe HTTP
0x00000020 (00032)   2f312e31 0d0a5573 65722d41 67656e74   /1.1..User-Agent
0x00000030 (00048)   3a204e53 49535f49 6e657463 20284d6f   : NSIS_Inetc (Mo
0x00000040 (00064)   7a696c6c 61290d0a 486f7374 3a206d6d   zilla)..Host: mm
0x00000050 (00080)   6c69616f 2e6a6961 6e74696e 672e6e65   liao.jianting.ne
0x00000060 (00096)   740d0a43 6f6e6e65 6374696f 6e3a204b   t..Connection: K
0x00000070 (00112)   6565702d 416c6976 650d0a43 61636865   eep-Alive..Cache
0x00000080 (00128)   2d436f6e 74726f6c 3a206e6f 2d636163   -Control: no-cac
0x00000090 (00144)   68650d0a 0d0a0a                       he.....

0x00000000 (00000)   47455420 2f79782f 6474732f 73716674   GET /yx/dts/sqft
0x00000010 (00016)   2f393035 3834382f 79785f64 74732e65   /905848/yx_dts.e
0x00000020 (00032)   78652048 5454502f 312e310d 0a557365   xe HTTP/1.1..Use
0x00000030 (00048)   722d4167 656e743a 204e5349 535f496e   r-Agent: NSIS_In
0x00000040 (00064)   65746320 284d6f7a 696c6c61 290d0a48   etc (Mozilla)..H
0x00000050 (00080)   6f73743a 20642e71 71363636 39392e63   ost: d.qq66699.c
0x00000060 (00096)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000070 (00112)   4b656570 2d416c69 76650d0a 43616368   Keep-Alive..Cach
0x00000080 (00128)   652d436f 6e74726f 6c3a206e 6f2d6361   e-Control: no-ca
0x00000090 (00144)   6368650d 0a0d0a                       che....

0x00000000 (00000)   47455420 2f736f66 74776172 652f6669   GET /software/fi
0x00000010 (00016)   6c65732f 73696c65 6e74352f 46756e73   les/silent5/Funs
0x00000020 (00032)   68696f6e 496e7374 616c6c5f 43373036   hionInstall_C706
0x00000030 (00048)   39392e65 78652048 5454502f 312e310d   99.exe HTTP/1.1.
0x00000040 (00064)   0a557365 722d4167 656e743a 204e5349   .User-Agent: NSI
0x00000050 (00080)   535f496e 65746320 284d6f7a 696c6c61   S_Inetc (Mozilla
0x00000060 (00096)   290d0a48 6f73743a 206e6569 726f6e67   )..Host: neirong
0x00000070 (00112)   2e66756e 7368696f 6e2e636f 6d0d0a43   .funshion.com..C
0x00000080 (00128)   6f6e6e65 6374696f 6e3a204b 6565702d   onnection: Keep-
0x00000090 (00144)   416c6976 650d0a43 61636865 2d436f6e   Alive..Cache-Con
0x000000a0 (00160)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x000000b0 (00176)   0d0a                                  ..

0x00000000 (00000)   47455420 2f4d324d 324d7a4e 695a6d51   GET /M2M2MzNiZmQ
0x00000010 (00016)   794e6a45 314e4464 6a4f4456 6d596a45   yNjE1NDdjODVmYjE
0x00000020 (00032)   7a4f474d 784d4746 69595751 7a4f5455   zOGMxMGFiYWQzOTU
0x00000030 (00048)   304d7a59 774f4751 784f5335 6c654755   0MzYwOGQxOS5leGU
0x00000040 (00064)   3d2f3430 2e68746d 6c204854 54502f31   =/40.html HTTP/1
0x00000050 (00080)   2e310d0a 55736572 2d416765 6e743a20   .1..User-Agent: 
0x00000060 (00096)   4e534953 5f496e65 74632028 4d6f7a69   NSIS_Inetc (Mozi
0x00000070 (00112)   6c6c6129 0d0a486f 73743a20 7777772e   lla)..Host: www.
0x00000080 (00128)   62616e67 7368696a 7a2e636f 6d0d0a43   bangshijz.com..C
0x00000090 (00144)   6f6e6e65 6374696f 6e3a204b 6565702d   onnection: Keep-
0x000000a0 (00160)   416c6976 650d0a43 61636865 2d436f6e   Alive..Cache-Con
0x000000b0 (00176)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x000000c0 (00192)   0d0a                                  ..

0x00000000 (00000)   47455420 2f777073 2f646f77 6e6c6f61   GET /wps/downloa
0x00000010 (00016)   642f4f66 66696365 41737369 73742e30   d/OfficeAssist.0
0x00000020 (00032)   3430352e 38302e31 3131392e 65786520   405.80.1119.exe 
0x00000030 (00048)   48545450 2f312e31 0d0a5573 65722d41   HTTP/1.1..User-A
0x00000040 (00064)   67656e74 3a204e53 49535f49 6e657463   gent: NSIS_Inetc
0x00000050 (00080)   20284d6f 7a696c6c 61290d0a 486f7374    (Mozilla)..Host
0x00000060 (00096)   3a207764 6c312e63 61636865 2e777073   : wdl1.cache.wps
0x00000070 (00112)   2e636e0d 0a436f6e 6e656374 696f6e3a   .cn..Connection:
0x00000080 (00128)   204b6565 702d416c 6976650d 0a436163    Keep-Alive..Cac
0x00000090 (00144)   68652d43 6f6e7472 6f6c3a20 6e6f2d63   he-Control: no-c
0x000000a0 (00160)   61636865 0d0a0d0a 61636865 2d436f6e   ache....ache-Con
0x000000b0 (00176)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x000000c0 (00192)   0d0a                                  ..

0x00000000 (00000)   47455420 2f525a49 49395867 20485454   GET /RZII9Xg HTT
0x00000010 (00016)   502f312e 310d0a55 7365722d 4167656e   P/1.1..User-Agen
0x00000020 (00032)   743a204e 5349535f 496e6574 6320284d   t: NSIS_Inetc (M
0x00000030 (00048)   6f7a696c 6c61290d 0a486f73 743a2074   ozilla)..Host: t
0x00000040 (00064)   2e636e0d 0a436f6e 6e656374 696f6e3a   .cn..Connection:
0x00000050 (00080)   204b6565 702d416c 6976650d 0a436163    Keep-Alive..Cac
0x00000060 (00096)   68652d43 6f6e7472 6f6c3a20 6e6f2d63   he-Control: no-c
0x00000070 (00112)   61636865 0d0a0d0a 6e656374 696f6e3a   ache....nection:
0x00000080 (00128)   204b6565 702d416c 6976650d 0a436163    Keep-Alive..Cac
0x00000090 (00144)   68652d43 6f6e7472 6f6c3a20 6e6f2d63   he-Control: no-c
0x000000a0 (00160)   61636865 0d0a0d0a 61636865 2d436f6e   ache....ache-Con
0x000000b0 (00176)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x000000c0 (00192)   0d0a                                  ..

0x00000000 (00000)   47455420 2f61706b 2f323031 34313232   GET /apk/2014122
0x00000010 (00016)   322f7365 7475705f 39353136 35303639   2/setup_95165069
0x00000020 (00032)   2e657865 20485454 502f312e 310d0a55   .exe HTTP/1.1..U
0x00000030 (00048)   7365722d 4167656e 743a204e 5349535f   ser-Agent: NSIS_
0x00000040 (00064)   496e6574 6320284d 6f7a696c 6c61290d   Inetc (Mozilla).
0x00000050 (00080)   0a486f73 743a2064 6c2e6e78 352e636f   .Host: dl.nx5.co
0x00000060 (00096)   6d0d0a43 6f6e6e65 6374696f 6e3a204b   m..Connection: K
0x00000070 (00112)   6565702d 416c6976 650d0a43 61636865   eep-Alive..Cache
0x00000080 (00128)   2d436f6e 74726f6c 3a206e6f 2d636163   -Control: no-cac
0x00000090 (00144)   68650d0a 0d0a7472 6f6c3a20 6e6f2d63   he....trol: no-c
0x000000a0 (00160)   61636865 0d0a0d0a 61636865 2d436f6e   ache....ache-Con
0x000000b0 (00176)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x000000c0 (00192)   0d0a                                  ..

0x00000000 (00000)   47455420 2f424656 43656e74 65722f42   GET /BFVCenter/B
0x00000010 (00016)   462d4246 5643656e 7465725b 5b414230   F-BFVCenter[[AB0
0x00000020 (00032)   32375d5d 2e657865 20485454 502f312e   27]].exe HTTP/1.
0x00000030 (00048)   310d0a55 7365722d 4167656e 743a204e   1..User-Agent: N
0x00000040 (00064)   5349535f 496e6574 6320284d 6f7a696c   SIS_Inetc (Mozil
0x00000050 (00080)   6c61290d 0a486f73 743a2064 6c2e6261   la)..Host: dl.ba
0x00000060 (00096)   6f66656e 672e636f 6d0d0a43 6f6e6e65   ofeng.com..Conne
0x00000070 (00112)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x00000080 (00128)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000090 (00144)   3a206e6f 2d636163 68650d0a 0d0a2d63   : no-cache....-c
0x000000a0 (00160)   61636865 0d0a0d0a 61636865 2d436f6e   ache....ache-Con
0x000000b0 (00176)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x000000c0 (00192)   0d0a                                  ..

0x00000000 (00000)   47455420 2f323031 35303130 352f3933   GET /20150105/93
0x00000010 (00016)   37376d79 63735f59 5f6d6761 7a325f31   77mycs_Y_mgaz2_1
0x00000020 (00032)   32303142 2e657865 20485454 502f312e   201B.exe HTTP/1.
0x00000030 (00048)   310d0a55 7365722d 4167656e 743a204e   1..User-Agent: N
0x00000040 (00064)   5349535f 496e6574 6320284d 6f7a696c   SIS_Inetc (Mozil
0x00000050 (00080)   6c61290d 0a486f73 743a2078 69617a61   la)..Host: xiaza
0x00000060 (00096)   692e3933 37372e63 6f6d0d0a 436f6e6e   i.9377.com..Conn
0x00000070 (00112)   65637469 6f6e3a20 4b656570 2d416c69   ection: Keep-Ali
0x00000080 (00128)   76650d0a 43616368 652d436f 6e74726f   ve..Cache-Contro
0x00000090 (00144)   6c3a206e 6f2d6361 6368650d 0a0d0a63   l: no-cache....c
0x000000a0 (00160)   61636865 0d0a0d0a 61636865 2d436f6e   ache....ache-Con
0x000000b0 (00176)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x000000c0 (00192)   0d0a                                  ..


Strings
 " "
EH.
080403a8
1.0.0
1s%P
BEARPC
bsJP2
CompanyName
FileDescription
FileVersion
Js2P
LegalCopyright
msctls_progress32
Please wait while Setup is loading...
ProductName
ssPP
StringFileInfo
SysListView32
Translation
VarFileInfo
VS_VERSION_INFO
www.bearpc.net
>@?]!}
        
,/=!#[_
:+(``(
*?|<>/":
%'~$>@
0;0\eT
>+ &01
"&.)0~1
0#}1l(Jp}
:>03M(
0)|8QG
0}@Ar'
0Ds;'t
0dv)'&
0f=*L-
0fz<:k
0gavxE
0hqk:wx
0i>)ph
0Ju,#mpP
^>0l7Y
0/oF#0l
0pe^0|[
0SKiP7R
"\0Tb>
0TK&[Z
0,'%Tn
0T(Rs!Vi
0wN,G$V
0Zje15
0,ZX^&
111~SSS
1% 1VC
1[7XT_
1[bur!
1cSY,'
1!dise
/;1f{D
1\g)\%s
1{;h>)
|1=~)J
1kq<pH:
1<M}CS
1`MFni
1N21z$
1q3u)'Z
	1Q]W1
1r(ol-
1t+i;G
1v<2`5
1vRk|R
1vTEhZ
1w5b<0
>$1~x9G?
%~1*YA6
=(1&YG
1Yx."<
>2)<#~
21W{#B|I
22sK8k0
23:kww1
2%9F/8
29|WAs
2a,iRW
 ?%2":B
2~BY7nS
2Df1dG"
2D"n+Y$
2E-7I!
$2F\_.
2G8RsD
2HCin  
^2H?XV
)2Ji>d
$2!\:K
2l+q/Wl
2L#`*tn
2#n%$!
2O"H[Bn
^2QtL[
2s]$Y>#O
*2~T/(
2$t!f`
2U0y`t
2"ulwIzg
2w(.0L0
2X@m|G
<:2~Z-N
30@~;s
3330XXX
33q|{,}
&37+pi
#:_3(8
=^$3c4
>3`D=m
*~3d?!Z
3%EJQO
3EXs]H\
3(;'F&
3GCGe9
3HY:8L
3IaX;G
!3kpo_
3Lfa|Z
3mP[I_
@3nAM7
3ncs2FLrs
3pLotk
3>q{Z`
#3.*R}
3]rOr`
3SN#5cQO
3s@YKpd
3t|L7d
`3=TWhg
3VzFQk
3;w1}@
3wzF{Bs
3x^	/'
3xJDYD
3!x)u%*
3Z)Z[6
[&4cW\
4DepqZ
4D_P>%g
4 ~h?;^a
4HZ:UAZ
'4LA!T
4/m8Pq>
4<MFX_
4))n2(
4N]Ce|
^4 o|dc
4>OHRt
4oI4yU
`,[4#q
4|r54s
4$RH&+
4s?ihq
4`S|k`
4U4_5`
4u'nC$
'4=Va7
	4~vAd?
.4v}wZ
4W)%NI
4'XiWN]?
{+*'[5
#5$_0/
:51]!4
`)52Lq
54.Efx
58OAE$
5<aY.g
5/B)r*
?5cwy#
;5dP%}
5!'e5=
5g;7|T
5)GO	{
=5gVGh7 j
5.i"|_-
5J:/1*
.5J^1_oR
;5jaRJ
5KnzUE
5krT0 
5LV<jx
@{|5lZ0
5Mcz,3
5-{nZ	|
5=pkIw
5QBJYK
#-5Qp07
+5 RjD
[[5WMZ
5W:^sxo
5W,U\%W
5`wVkC
5xw^2q
5,-Z8c
60.}Li
|#61>5
6162gD
6cIdx\zB
'&,6dsj
\6+(!e
^6Ef*,E
6\FPo 
6fVItz
-6fWaw
.6G\qm$
6@</_Gr
6]H`=d
{6\	lG-g6
6Ml(v}~
6Oh1N8p
6+PKlt
\6QOfo
6[T48 o
6ut2O/
\^`6Uyo
6vUY'S9
6V)(wN
~-6^W&
6WvZGhD
6^wZ 0
6)YEn{3
\6?Yju
@@*6+ys
#6z[S T
]	7{,/
7!5.X2Ej
@@@`777-
)7?b=6)
7c9	tR
7d_jk=
;=7EWU
7EZC+r
::%%7h
>7hb/@
7:>is<mKA
7.}J^u&
-_]7Ki
7*k_xT
7liv|$.i}
<]7L;w
7LZFjQ
^7m#A^
	7[mI>
7Mt>:Z5
7mXS8\cF
(7]n^8
7<O*1,
7pi?{m
7Qh{r'
*|7_Q~i
7s]ju>
7Xswo#Z
7$z0,_(
8>$:,0#
=83x7+
	&?8?$4
8.~5n-
87C1N)`
"88YlH
8<9^]'_
8^ag`_
8&b%k.
8b#VXp
8d[SQb
8)e6D]
=8_eSl($
8FCL:V
8FuBpr(
+)8j5ei
?8JfQH(L4
8-k*swy
8(miFp
8NCRCu
8onv7_
~8p(5i
8pZ]jLt&J
%8Qum%v
8RVh1?
8s 'Cw
[8Tdl}
8t{mE"m
8;u.-/
(8v'7\5g
+8wquXL
90b]s2D>+
9.2;nPC[6
94"B<Z
}9`:5l
995J3<=]
%9`cMN
~(9CR}Y
-9#d^8
(9;E>*
9]f%it@a
9|G@~)
9H	i!~
9ItT%.
9,K,!s
**9\n!
9n)%K9R
9pMJ{-
9%POs"(
9[q,aY
9q/_%|%it
9r $E&"
9rT1TCVy*8
9.S.]u
!=9T4y
9u(|7h
9UZBrL
9wbCkb
9W"+"j
9xBm;~
9XEU[0~^
+9xj4Q\)
9y]R&U 
<	a.+}
A^[?0F
a[3g'%<
~a>@550
/<a5Ekk'
|A*5'H
A-6"Te
a8!}WU	
AAA_ggg
ab,I,h!
;+a\BZ.
A/Cq[e>
#~:>aD
A\D(4L
ad-C#H
AdjustTokenPrivileges
A-D,L*V
ADVAPI32
ADVAPI32.dll
aEYYpM
ag_Ph@
A";H[J_;
a]HP(CU
A;~~HQ
AH]y)1
|aiA9s
<> AJlfO
a;Kd|A>
aLLdELL
a~M"4=
a:,n`h
Anh++G
aol<lz`M
AppendMenuA
aQ.8<#
AqoJ&aL)&A(>
]a"*r~
A&r53s
ARtm<{j
auwuKt
"AV0&1
$a#v\2wo
a.-{W^C^
a>W$CQ
A!(>x3uS
aXsKYO
AZnamt
Az!Smt
B<!*~^
B1i#Pc
b#1t|a
B2*]],
-#B4_q
 b,5=-
"b6m2>
B6wJ	g
B`7JBO
b[92Dx/5
BBBp;;;>
bB&o1n
b:bZLM3
bCB=p 
BCO)@\
bDQd:`H
bdZC}U~
BeginPaint
b `ew"4
 bew`N
 &)B[F
#b	gEp
B}Gk\0
B&gvpun
>_& \B h4
BhN?d7D
B+~I4w
@Bi|B.
"*|BIF
bIo\8)
bJCD8N
bjc*X};
/B;jG[7
bKfA"E
bk-jdC
b<\K!K
bk	U[J
>BlL|V
Bl,p6j
_Bmcu}
BnE2cD
bN>n"O
bNn[P 
bOs-4M
bPd+B2
b@=^Q"
\\B&q=
@*Bq!2
"BQ)QG
Br$1gE
Bs$-:/
BsB"zl~
b_SCpXY
btB0G%u
Bt=JfA
|bU1SI
Bu8kUKl
b/U"hXkG
bu|y~Qp
(BVbdO
bv@iDF
]Bv[ O
BvV0od
#		B@W
bX7*",
b-Xp"G
bXPzLD
bXr@B`
Bx@t7ph
BzBG;I
BzeQ:|fd
B@_*zl
>) C{)
$C#	;(
%.&	,C
C0Q&}Q
`^c-"2
'C@ 2<
c2:J3%[
}C-2MC
 ;C2PB4
]c	2zn
}C3,1.&V
]C3j.J
C(}+3O"
c&47_G}d
c4'{=U
C67PRmY?
C6IT35W
C/9(._[
c 9-T;
CallWindowProcA
cB\1zi
:~]ccixbg
c>d8XGuE&*
c"DA-7!
cD/Gs9
C/d}n0
 ce}aRDNs
C:f (N
c\FOn%I
+cG^`$
c,G@/+
^C|@~g
cG[W>Y>|
)c.	H-
C@*H;,
CharNextA
CharPrevA
c',hcs
CheckDlgButton
Ch?W#L>/
CIm`s~
)	cJo~
cJO1>y
cj=oYr
c|j!ST
`ck`]J
;^ckvB
'cL=\;~
CloseClipboard
CloseHandle
c^m50}
[C;\N(
C.@Ni|HB
CnK6KTN
CoCreateInstance
COMCTL32.dll
CompareFileTime
Control Panel\Desktop\ResourceLocale
CopyFileA
CoTaskMemFree
c);p:-	^#
CPNZdC2
C|q#pahA 
.C=r3"
cr8iKp*,
CreateBrushIndirect
CreateDialogParamA
CreateDirectoryA
CreateFileA
CreateFontIndirectA
CreatePopupMenu
CreateProcessA
CreateThread
CreateWindowExA
cr=XUn
CTUw$b
c'V	-._
c$vsa~
C`VtTA
cvu9;g
c.Wh#j
c	]<WkEPu
cxv.".
Cy_^>?
c'zEyB$
cZiG'S
... %d%%
{^+d:%
D$0+D$(P
D)1^K*<
D;1:n9
,D"_1qAf
D	4)&6
{`'D5(
d5#HMKvTf
d6dD~j
D70ogz
d!7 Dz
d7#Kc)-
D9|p)"y
 DA}?%^
@.data
dc{odadm
Dc(V<{
DDDI{{{
D$(+D$ SSP
d'#ee-
.DEFAULT\Control Panel\International
DefWindowProcA
DeleteFileA
DeleteObject
DestroyWindow
D+gPDPK
d{h4	Px^
D}hO;QL
DhsB8@
DialogBoxParamA
dil=Pt
dI/rx_(
DispatchMessageA
{DI>Uf
dLDOD04B
d`+ lx,
DNAW/`r
DnS*|j
dO)>c@
D#~!oX
(d@_P|
dqIkm=
DqM?S~
@^D%Qn<V
DrawTextA
.DSe_=
D$(SPS
D=ucu}
~duMLA
Dv7f/5
Dvl!R@l
=dWbgvg
dw!"i@
D:XaeW
$)?DX!N
=^dXPB~
d%xVPn
dxWg;c
Dynr b]
'dYxiv.|8
DZ7/tF
*	^&e[
E1l}h9M
/e'(1O7
e2Ml@`
}E3%{ 
}'E32j
E3@2yW;M
E3hET8
&e'4pj
eA?A${
E:b8<qA
eB9?[Fe
e&b9}`O
ec1"Z"
e_	C^Ew
ECL{JlT
EDIc\(G
eeeeeeeee
+eeg]W
}EfG${
>E|'	g2
|eH6~x9Bz
eI{16m
/.EiX#FSX
e$iY}!H
E]`JODt
EKBiUA
ekWZHO
eM3QYTzU
EmptyClipboard
Empu%GP
_EmqGvG
:@eMZzo
e=:n-+
EnableMenuItem
EnableWindow
EndDialog
endh/|
EndPaint
?<_>eNF
-en};=*hS
^eNjrT
EN\_lV
enw&{ub+
EO6uMC
~EO[/A
eokLhQ
)]eo?p%
	e*&Q^
e{<-QA
E;q}S*
ERB]t%
,erJDQ
Error launching installer
Error writing temporary file. Make sure your temp folder is valid.
:e%/[t
e!tL/H
("e	uG
eu%RW?
#e%-uz
EWO97qm
ExitProcess
ExitWindowsEx
eX]jmV
eXN~Pp|
ExpandEnvironmentStringsA
EXRL.r
F0{7Jf
f14C: 
f1rw\l
$}f33z,
F*[4Pa 
f4(T>Z
@f5w36q'
f6l:'MY
F`_=\)7
\&FaLn
!faXW~a
'f		B[b>
fB;=CoT*^
~FBm1-
fcaacopefm
fcd7{e
F$C^FG
f%c)&{zY
fd6@3H
fDRiu'
[}^fe:
FeU=Ki
|Few.E
FFF#LLL
+f%fh_\
FFQdml
%FG)B4g
fg{B,tZT@
	!fhfH
fhpxWv
	fI8oMY`q
FillRect
fimpsD
f!	&I}n
FindClose
FindFirstFileA
FindNextFileA
FindWindowExA
^(,_fjZQ
Fkv8Et"
>:f^l<8d
F]LA!G
]Fl?eVc_
FlN$CV
F (lNH
^'F:^LO
FLY6Ua
FMWi-j
FNNNN@
'"FO_K
f/OPY^
{foQ/X
f/"p1/
Fp]'M/
\fP]wy
?/fQ`^
fQ(\#`
FQ5!)w
F$qT=L
FQWc-_
FreeLibrary
F"_RY}n
!fS3B+
fs 4LLh
FsnI78I
==(fSzs
F@T{Ip
FtL<iO
FUSE \
F?uv~4
*FUV)K8
;fVf2W
F w6CWQ8
fwgww]CR
F&)wN8w
.	>Fx	_
FXDSbJ
F\:y~5
+F|$YlF1
fYsw c
%G/;'#
^G0\#N@3t
g1|>{/
g2^s(MF
g5O%Q/F
{,G6G.
g7EztV
g8q:l`
g8t,6[s1
g9r_l#%
$gA&w_
>G|['b
g~`>D^
GdAb:+Ez
GDI32.dll
gE<^g,C
>g$eov
GetClassInfoA
GetClientRect
GetCommandLineA
GetCurrentProcess
GetDeviceCaps
GetDiskFreeSpaceA
GetDiskFreeSpaceExA
GetDlgItem
GetDlgItemTextA
GetExitCodeProcess
GetFileAttributesA
GetFileSize
GetFileVersionInfoA
GetFileVersionInfoSizeA
gEtfSO
GetFullPathNameA
GetLastError
GetMessagePos
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileStringA
GetProcAddress
GetShortPathNameA
GetSysColor
GetSystemDirectoryA
GetSystemMenu
GetSystemMetrics
GetTempFileNameA
GetTempPathA
GetTickCount
GetUserDefaultUILanguage
GetVersion
GetWindowLongA
GetWindowRect
GetWindowsDirectoryA
g\EtX{y
G Ey}O
Gf1(vW
g>f8,^
GfK~H|
GFXlAL
>\Gg5'
GgMgk0
&Gg~Mw/
gGUwj%G
g_h"im
gHk"?{
ghlu#;
g{hQg(
G;H-TR-
g?I4ay}t6
<G~I|c
g"ii*]
GJ6-c9
]Gj6.'J
Gjd]"u
GkaFY4
GkhzHM
gk P\4@
GkPie~
GkYd,-
gLJFq[
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
-GL	T(B|-
gLZv7bM
GntfM`
go!o.+
GOVTgG7
GPfsi_Y
Gq"!N=+%	Z
g'r-raz
',g:t*
Gtw59X>
GtZ@P,
GU81-\
guGVGP8
Gu]XMq
Gvm(En
gvx77-
gW0OER
g%W)eN
#Gw~QW
Gx>sMDH
GYa%zt
 gYDGl
gYjxH!
Gz(`.IG
:%H-<0
\h0*(q
}H)2$}`
&H	-{2
H3>4VF
h(?>]'3p
H3r^h:Wm
h40 NV
h(4de.A
H7%8i5
[h8G O
h9X)[i
:ha%1/
>hBU-v
"#*H/C
HC	'8\
hdLC	p
?>_~he
[HEh$_
HeVku!
hEVmC9
H('FFy>
hfpa`9#z
'HF.Z^
H_gGQ3q]
(HghV8
hgt;)L
H*I9s}'
HiF-Ac
H{iKm^
HIVyKp
hiXww3
H,j8a	
HK	Q_u
hKR1?Qj
HL>d"`
*h_l/m
:h:NtF
hNwfN&
hnyu,"^
%H,[o6
hO*}9;
hom4/w
hp`I`lC
H"+qO-
HRt(v)$
H?tGk?
~h| 'trx
http://nsis.sf.net/NSIS_Error
$htU1|
<[#hU?E
HULaV2
)h'}uQbz
H<`V*<
h@v3%9/
HVOM/o
HvXzYP
H_wcu_5
HW^KPYH
hz,&Cy
[i1t2l
\?i27LB
i*,3]K
I_{^5Y(
i6#j~N
i8B-w'24{Ma
i8jg4`Y
%i8	r]
i!8Y2nA
.IACB|
i_A)t!
iC>|Cjf
ID<P`l 
~Ie@WM
	iGBO~
I=,Ge6
IgkuY]k
ih?g[BLI
%i|HiRAd
IhRE3#
Ihy~C.
IiF |6^
IJ&ELa`
iJq1;>
;ik1%i
i#K]r.
I	LK>n
~ilon~
ImageList_AddMasked
ImageList_Create
ImageList_Destroy
<i|MCN
IN9Ghthz
incomplete download and damaged media. Contact the
Installer integrity check has failed. Common causes include
installer's author to obtain a new copy.
Instu_
InvalidateRect
iO6?f+
i,o@f`P
IOTZ/k
:I^}+p<
iP&7@Z\
*iP?m%7R):
I&pRl$
iQ*"m0X
I{q,|;s
Iq[@u$\8
i/qUh8
IqxBa0
*i_R7x
iRichu
ir&&n@'
iS|e)n0
iS ;R 
IsWindow
IsWindowEnabled
IsWindowVisible
iU--rw
,IuVxp
Iv8bRqD
Iv FD:8
IVOW{O~
iVWH*u
-"I{)W
>IW5$X;
I|wLl?
<i|Xb	
Ix@;LY
-)IY">1
iyZidMP0)D#
IZ2N^<"{+Bh
(I Z\A
izA2Bg
J]@:>.
J:2 4+$
J4lE-\w"
j4UiJ1
,j(84f
}"">?Jb
[J}BH}
j_Bk?D
>/J,C(
Jd@jI\
:j<%E28N
jE5Uv#S
"JEu8d
j=!(f59|y
jFKMaq'e|ql
=J|FW=
JGuU_T
jhVSy"0
Jib|{6<
J'iBo(
j`\ibP
J\i@B!P3
`}j[{II
Jj_dW4Y.
JJJ2bjo
JJJ2HHHEEEEHHHHxHHH
JJJ2JJJ
J-jn,w#
J+:K-8
j=kb.(
JkI"7]
j#Me^|NO
~j!^n 
jNak\O
<jnF F
\jn+t9E
?JOd~dYCK1
j-ohzC
JP6EL@j
J$Q/9Ck
jqdL='5R3
jQ.;on
j=R60LL1
Jr\	RBO
jS{[si
jT7-fBP
j&TIQ)
jtK.m#
JT'Z7W
JU34}Xs
jUE:O&
JU	|/J
juld]<
?@}<jV
jVpG^"*o
=<j>W^ 
Jwp_AE
#J~XCbN
j?=Xj2`TIP
Jy*uh.B
j(y%YU
\jZiX}
*(K >}
>k 1tL{
K}2^6q
>!K2;h
k4G~0m
.K4j~g5G
K5J#P'
K5v	?:NJ
,K65Zr
k6K5Y|
'K	aIf
k<b-3[
K@(}bl
kce@OR
K#CoYPG
!kDd+L
kd#Y	j%
K_]=EN
KERNEL32
KERNEL32.dll
KF:YhVt
#kg^s]
K#HHY!;r
,k:H>r
khtQwa
K$HU!(
k""Im~
kiu\1I
\kK)E}
 KKKby
KKK!FFF#R_g
KKK!HHHDEEEGEEEYHHH
KKK!HHHDEEEGGGGhHHH
K,KS]&
K-}Kt"VY
>k	L^+
klspm7
,|K+(|;M
`K:m7j
KmABS_/+:
_K$MUs
+?k-n|
k)N0#&
KO8'nNv
k<opI?
<kOS*wE
K_p9Xvx
KpE^0r
;\Kq=/
kr!~$,
KR Qx!
k#+S^6
KSDRm^f
ksuZ^_
>k:u<@
kuH8<c
k_u(KT
;.",KV
KVC;E=
{k*vCr
kv;rTqw5
kVt(NY
KwFrS)
KW#Y\D
	k Xs"6* }
$K\z	8
kZHP<3
kzrJa:
{/*L0)
l-#0uh:
l1'Mp{
*l%{3K
]l4wP7<
l5b?K\
l5Eg"g
L@5(U<
L5Wyh=
L*asa	
`LavlPch{y
$lCc#)
Ld1ZS`#
@ld4.c@
lDA0 cH
,*ld	c
,l])\f
	lh]?|y
l$?;Jw
LK6tl	x
lK8W!X
L<kfHme
^'LKPR?
!lks_D
<l`kwF
LLi ]"Ub
L{!LMB^Jo`1
LlnkPI
l.m]OX^
ln!h5!
LNpqn T
lN`QUUW'
LoadBitmapA
LoadCursorA
LoadImageA
LoadLibraryA
LoadLibraryExA
LookupPrivilegeValueA
LO	}S r&6Z
lOTyX+Fb
lO=w?=
lq{:"8
L_Qa`YN
l'(Rlt
l S-"n)
l-StPG!
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpynA
lstrlenA
}lstV:
l$_"SV
lU|E?3
lu.+Mt
l~Vk3v
lVP6`%
L$WEF0
L	Wz.h
lXe\u0
L}XrrV
|@l'Y,
lYCFAi0
lyfCN;Q
lz+N9B
LZqZ8}
lzzpv#
`,=m:^=
/]~`_m
([%\m&
!+:#%M
*(M09t
m[|0MB
-<m138N
m!4pX+
mA44Dt
;M&a[Vo
Maw*R^@
m%-b\H7/a/ 
MB\|u9p
mC%N]Z9
mcWQ;'
%,md	c
]mD* e
m:)/E!
MessageBoxIndirectA
M:EY}H
mf.{+_Q
.Mg]_})
>mgn7H
(	[Mho
M\H)Z>
\Microsoft\Internet Explorer\Quick Launch
mIOKd)
m/%IvE
mJ{R;![Q
M$jWwq
+@M	K/
]_mL	*@9
;$=mm/
mMe_'3
M)mFX, 
***;mmm
MMx{Oy
m~n\\1
{m!n^F
MNI!(|>
*m#^-NUY
$@&#M}o
More information at:
MoveFileA
MoveFileExA
_MPb=xA
MrBdh\
mS.S]K=
<,mSz;
=MT2<_$
*MTj{q
(MUCm[
MulDiv
MultiByteToWideChar
Mv&~pV
[MW#{4
/}MW OG
MX02xb
MxPJ	6
M_X=u}
m&xY@V>t;D
,My2<V--
{my&I;?
.'{myYjM
\M)-??z>d
>~Mzpq
Mz\y(4
N^!:1}
n5m9~c"<
N{:>{6'f
/N6-tvx
	\N7hS
.ndata
NexHzR
-NE{zh
NFPv6 
>#nf*u
N]gFad
N=gf\\E
n"hEz|(
NHfn gy
n%,	hx;
n'[I0G
NI}'q}
/#n_`l
+"Nl]/&
nL`Y	R
_"n	M$
Nm{Dud
>NmhXe
n!-=nCv0
 N@=nl
No	I,s
NpGmw}
nPM&e0P
@n"P/n
-npq#:\v
Np_WYF
nqDN8*@"
*)/n'r
(n(r5	[
nr%rn9a
NSIS Error
nSR-b_
~nsu.tmp
}n]Tk"
n!UDzj
NullsoftInst=s
NulluM	E
N.u}O1<AS
nuo(uKA
NwzY.V
 [N@X=
n<x]aBg
_N-@XR
ny]z2f/
=	n'zK`
N-zko7
~[= O(
|[O:!'
O?0'jA
%O0Qw=
(O0TzQ
O &1_(
O2p/ea
o55D<D
o62fB-.
o=6"&Q
O7$KP.
[ }	o8n.
oaV	[v
O(CoJB
oC=#YV
"~ODC(
$'oD+}K}
O`EV		@
')OFgx
OFs ^3
ogI}30E5
O>	@~H
OH7"Ry
oHn4PZ
ohWG$T
Oj1VuG
"o,K](
o|K]y+LCt
ole32.dll
OleInitialize
OleUninitialize
omIkx.
OmpsC(
OMU}_LI
*;::O]N
;{ONbvU
on.)!.f`
?on?Z0
?<=o*o3H
Oo\/f$I
Oo`mt:k
OpenClipboard
OpenProcessToken
:OQ>L8
o^~`$R
OsHg81
oT T~C
	o*?uQ(P5
\ou|Z_
OUZm:@O
Ovfw,2
OVQ6Aa#G3
(owW1x
ox9b]Q
O }XH#1
o	X)HcV
O#>Y,0
O\ZF4"
Oz#LA/
>>>P,,,
P'1Y~.m
^'P	2^&
p2 ksL*
P2O|%o=;T
p36i$e
p3f"@J
P3INl|%kp
<P4[(j
p4NX*E
!P4.x{
p7& 6v
P@79m#~n
p}.7Se
p-9698N.
Pago3G'
pAqPpFln
PbFJQJ
P!bKE[[
P?c[o}XFlB
pD|8rz"
	pDQ4^
pDWrO~b
}p@dZ3fA'6
)p~E\-
PeekMessageA
Pe"tk0=[?4
PG,fOtp	
pGXq[{8
#p?IQj+~n
{<PJ9m
.+P<J	 e^
pjqHio
">p%K|
PkdzY8
pkW]Bv
pL3p&D
PL]>{dHF
Pl!IL[
P^lz6	l
P.M=%H-
!!!pMMM
#-Pm=o
pm__r`
pm>rAQ
P?nGk0
P/o`8mE
poFvaZ
PostQuitMessage
p)\Pa+
PPPPPP
*Pq6Ay
P*QkS1pJZ
pSfm9K
 P](:&sH
/|+P?Sv$
P,};	t
P!t3U;D
PT	s5S
]Pt)t<
/)P	uC
P%Ui#	
p%wSh>
pwwwww
pwwwwwx
p}]xQW;
py(9_R<
*pyLPr
PyOBLG
PyPq.[
PY-XpO
pz`<2zo
|{-pZ%]cB
'PZ.g+
="q,#{
q4:<#_
-Q4{}]
q4>iDa
-Q;`4wt
"q5afv
q5;Zxu
	q\?,6
Q8Vy|O
Q9RoYz
Q}9y%V
$qANBh
qb9[|v 
qbf2[K
qByip 
qc XO%
qD[K$D
QD<UJs^dpN3
QDxi:*
Qd>Yy\
,qe~Vs
QFivQ'
Qf'=\L
qFR+JO
.%Qh#&
+/QHK#+h(
QH!!#x
Q#Ii}c
q!ir[P
Q"J0Y.
=qJlH*:0
=	qjO]
qJ{t&d
Qj|Xsqv
Q>'KZ;
>ql!^.
)@qlbd
]qle }
qlS(gh1
qlt]lk
Qm(*-	D}
	QmQ>MZt
Q(	n_<
Q"NF\d
q#^pDtq
QP~h8z
qqqqqqqq
q?,r%7
&$|qrk
q-rYk)
){qsTX+>
Qt ^gL
?}"QU,
.qUe!sb'
Qu(Xq@
"(qv9|
;Q V#g
qv-S~u
Q> ?w'
(Qw}Zx
q${X5I
q}xnP^
>!QYqd
%}>>+r
\r0:bh6
r0O;H{
r2g+bq
R-2Qud
r30vdn
\[:R3$iC
R4B2+:
[	r5iAX
r5R[@A
r6^6vB
r,6wOF
R7p`-Vu
R+8'jE
r8"W{8
r9SLM| j
R9vc{!
R'.BeS
RCakeV8
`.rdata
rDXV;R
r'Dyq~
re<0.1
re3>Is/~v>
ReadFile
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegDeleteKeyExA
RegDeleteValueA
RegEnumKeyA
RegEnumValueA
RegisterClassA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RemoveDirectoryA
[Rename]
,rEx	E<G
r&fPOVuiRz
Rf'=XLe
rGA0yd
R|g(b1
rgdV0"
R}@Gjh{}
r>GO>sAC<
rhHAUw
r'Hk>Vw
RichEd20
RichEd32
RichEdit
RichEdit20A
r+j|-7*!
RJeX*{U
Rk`}\$
r=Kre&
r_KxdL
RL`'6Fyw
!*{Rl^z
RMqOzZ
}rMR)>
@RNuqi
r&*=>O
RoF'I0j 
R;o<jk
rp79~%zw
r;P+fJ
r+psv0|e
%rp?tf^
rq<:4Q
rQd2>j
rQ`PF$~
r	Qs[D
/"rre[|
rRy>[~
rS&xGbT
-Rs:-_y
)rt}qyb
r<>U9*
)rumwIPczO
RUTRx5
r:}>W;9y
RWnT69o;q<
{R|$!wP
RWS_d&
"RXx+`
Ry5WJNaOx
+:RYH}
! R;/Z
"[`s)@
`S,!^)
>*S'[ 
|.@S??
S0ka4G
s2m){T
s;!3w;
S_+5eJ
s6?{(]b8
S7>/<w
s~7XD]
s8kN9`h|
s|8xI<
s\a\@`
Sasl3L
S<*Bh*
]S%B#H
S/c=1g
ScrcXo
ScreenToClient
(s `d3v
\,*sE,
SearchPathA
SelectObject
SendMessageA
SendMessageTimeoutA
SeShutdownPrivilege
SetBkColor
SetBkMode
SetClassLongA
SetClipboardData
SetCurrentDirectoryA
SetCursor
SetDlgItemTextA
SetErrorMode
SetFileAttributesA
SetFilePointer
SetFileTime
SetForegroundWindow
SetTextColor
SetTimer
SetWindowLongA
SetWindowPos
SetWindowTextA
+!s$F^
sF*88e
S	f(|L{r
SGLbmv
SHAutoComplete
SHBrowseForFolderA
SHELL32.dll
ShellExecuteA
sH`eU1dJ
SHFileOperationA
SHFOLDER
SHGetFileInfoA
SHGetFolderPathA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
%S'HJozX2n
SHLWAPI
ShowWindow
sh)v"}
Si?(#i3f
siljp(
SIM-VRa
s?\ITY
sKfmF#
skZd!gC
Sl_*)	
:S,L\1V
SL7"!/
sLA2h,k
.SlSj# @
	SMb;S
Sm(DVWK
>s#muqm
SNUaNO
softuV
Software\Microsoft\Windows\CurrentVersion
sO?Our
S=oW,P
SPAo[h
SQSSSPW
s*>R;>0(
SRmP[z
sR]TB*
SSNB8q9
stHLi*
sT:rz{
$St.UD
sU?H4\<
s|.wqi
|s)wTe
sX`=3[
|s^}xS
==/SYf
SystemParametersInfoA
s+Y,?Y
SZ3D6K
sZi-C\4
!szj-A9M
sZr12Z
> _?=t
&;:=t$
t4	8)%
(t6=W,#
t[7F7Ej
\T*8pD
.tA&;[|
>?t`B+
TBCOsY 4
	;tbSt
t_bSy\Pz
*tC8-[7&
:tCsZa
TCX!z`K
@TDi5Z
@t;d;q
+.T>DrF
\Teay^E
#]t$E#ilK
TELVgu }'
tfX2Df
tFY Zy
TgiNB+
T;gL?(/
t-@gx$
!This program cannot be run in DOS mode.
-tIG94
ti/>-M
`TI,m0(+=
&TiX)=
Tj23-+
TJ5}#<
Tj:F;<
\.T=jV
Tk0ht)
=t#?KI O
tl/_@]
#}T@MYT
tnNvn~
TN&\P]
t.nt"B
[+T~o{
~t!#oA
t=ocGs+i^h
Todz"ig	
>![tO([q
_^[t	P
TP1QwLg:
;tP7o3z
t`!pbN-V
TQf>T&
tR9n*&
TrackPopupMenu
trMKVG$
\@~Ts!AX
t=seo{
t=S|r5.g
,tT	Pe
Tt(R| p'
)Tvl{mT
t/XTF:y
"txvJ17
T`yCDz
TYhGMM
tyl<:#)
[tyU':
U|0,,G
?#U^;0i
U_2To"
u49-,?B
<_`U5n
/U?6hdzbh
u=6\mp
}^U:A}
U-bd|<
=`u=-c
[:U=,d
ud@5	#%]p
"ud6bpfe
U"Eu)y
u#f8vl
U,#"G9M
,u,`GW6
u[h8|W
>;?uhquF_
U+`~/'I
uii8hm
Uitb4?
Uj| 2\
UJmYY?
uKS^/O
Ul.NVG
U/?lU	E
Um0fp^7?V
#[UMFi
 UMp:V
!ung#ZM
uNjEk~m
unpacking data: %d%%
\uPLf>
UQ]n^8i
U_RNRk
USER32.dll
U>:St*
~uT@}=
Ut05`]e
ut:B:=S
{/u;tT
%u.%u%s%s
***;uuu
^-Uuy!
UV}0O<
: UVb:
u=_`W*
uw%(7L
][uwA7
u x Js>ZegU_
U(xqOf1c
UxtO^D
UXTq!VVD
u Y]:,
*(U^yH
u|yIf0
U]YT5]
U;ZTt(,
?@?[$v
*v0.@o0
:V1'=~
V1SPQi
v2=gQL
v5t$+B
v8@ne&JPWe
*V8Nv?
v95LpA
%VAr5HO
VA-uH~v
v~aUZF
(v]C`e
^VCedoh`
{vCP=,
"!,vd#
VeA'WN
v\E\=,j
verifying installer: %d%%
VerQueryValueA
VERSION.dll
/@Vg`!=
#Vh;+@
vH~"A)
vhd"=(
V{/i6"
`VI\7Rj
~ViBlr
Vj5ep%l
V,Jh05
@^Vjmf
v;JT	1]
V>jT^X
vJ\zsl
vK?3+=
vKt=7Lj
{VLHBk
Vl)j_I
vl:OgS%F
,v<lY\
vmUn5[
VMVcgU
vm/'\YRa
VQ#:1-
|<VQde
v~QG,3
Vrg7=m
VsXx5#
vtL	'f
|)vt+N
}V'U#p)o
VU:z2$
v`w#D0
VXdV\s
VX&eO%j
VyC[>!e
\vym)g
/vyU/Kx8
v~}Y	z
Vz4uCd
W3E"8z-
"w4MqW
W5Yp:#H
W8nrWa
w`a;*b
W]AfT~
WaitForSingleObject
&%WajR
W>	a*M
\,wAzFTm
wBo|,9v
wC<5yB
wCv>:(
#WDaw	e
W{Df0w
wE8E=j
We>Pn+6k
WFE#KO
WfGr:.b
"wFnU6yJ
wg x+`@X
[)\Wh	
wH2]|0
<W[iDi
wis7GLf
W#j]-{
WK?y{ Q
!W+%>l
W?L|<"At
wmgeL%
WMH>(td
wm>qq#6Q
>wO^E8
W&oo_\
?wphFk
WQpU&/
Wqun#(
\+WR?0	
WriteFile
WritePrivateProfileStringA
wrlc2/
WrsXvD8
@wRx,@
wsprintfA
WTD]EL
W/t/[O
W&tt]>
W/U2+@*R48
Wug[9|
W}:V =
%]]WW@
wwwwww
wwwwwwp
wwwwwww
wwwwwwww
wwwwwwwww
wwwwwwwwwwp
wwwwwwwwwwww
wwwwwwwwwwwwww
wwwwwwx
wwwwwxp
wwwxxw
~]W_X!
#.^WX(^
wX$):d
wXi#)\
wxT~>#
)WxyaZ
wyw/Mji
wz|L!q
x0KAn)B&\t
x2qM?:
X<3br.g
\x4^E["
X'!6g,V
X`,7Lh
>x9^	<k
x<9nft'c$
^[X=!a
>X=\+b
_%X/B_
XBmwWD
XBVyZ]a0
xCb` b
#Xc.}~rg
xczc,#
xDGLcI
xdKLG2
.xekZ=v
Xf{?`	
_Xf7Dt
?XF}8e
x'f9&{v&
}x<FK	
X'FLo*v
}XfmzU
\X<Fv4
'X_+G{
X*gog)
xgS`A@oX
xG[(yD
XH\B=k
XHVgK-'
@Xi&Fs
x:IK%@
-XKg){
X)>	l!
xm'J[g
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>
X=!m,O
XmzkK`I5
Xn$4EC
<xNhG8
XnmJs84
>XOc\I
x*O	+D
xoR/`WZ
(x|pF@
!x={pZ
	x?qhe
XQOd	t
x_RB"S
xrC,<yxB
X-r;"Dx
!Xr^/W
x]#	s|
{	xt(^
XU:9*;S
{xU`L=Q:
_>XU'nU#
XUz<8B
xUZ'Vi
xv.b'e
#X/Vs#5C
'x,V\]y
xX``5pWg0
Xy$:1#
:xz2kX
xZa:H6
xZor7=
xzPvT"'
y,~=*=
.::(Y?
y "0;$
	@Y0dHu
y1pu@(xW
y24pVw
Y_\5EHL
#y_6$jw
y :	6M
Y6m9[m
*y%95tu=
^*YA1Y
yA7~gU
|YASy-
Ya)*YV
y}Bd~>y
Y<bl-<Z
\@YfIt
Yf &vN
$ yFX^
:yG;!^
YgUU,[
].$Y*h
Yh&.a>^
y#hq R
!}yI'"
\y @\I/
Yi>M@w
;Yi,o8
Y~I(q>K$r
y=J59)
{Y /jg
/YLHO6K
'YLW_i&
YLyPjx
%YO)LZ
[	yo/t
@YP+6-
yr[Lim
YS]a3M\
y`srh	/^t
ySvD9}XU
YT,;,I<E*j
yU=m(ON
/+y+:v
YViLyc
:;yVnO^
yVQ:9P
y\#wp1+
y~W}Y 
YWZ5K66/D`
YXp=7@2Am
*yXuk*=
]>YzxD
,:?Z&!
Z3['ds
]z4\WB
z57A{2?
z5fN"{1
Z!5S`T||i
z5Z|2I
%z7oOn
Z8<9:!
z9c<ySA,L
z)9`|*t
Z:9`~v//
^ Z"a7j
}zBMO~V
zDz~dD
ZEki%ZKL
*	%~.zF
zfhw.-^
zGE>4I
z(GUo#
ZH)5X(4
 z><hk5"
%Z>Hm'
zi+!<+1IO
!#zIM]#x
zI'VWo
)Z`^:ja
Z-JoE2
ZMpu.9
< $zm{R
z:Mz&%
Zn:c](
zO5%2NaVb
!!zrA.
ZT1#2Wq
:ztC9R
Z]*%uB
Z'Uo	i2M
ZuV8Jg[
zu/Y6Yh
~Zv$Dc
ZVO>gK
?@ZWLN
Z*wZAP
z?xnI2t
`zY/..
	Z	ZW*
z!	zxk
ZzZk{w