Analysis Date2015-01-30 14:17:42
MD55ee692ceac6816d253f485706f348237
SHA14005060f9dcea19ca230e8e640555820f54bfc75

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 0bc2ffd32265a08d72b795b18265828d sha1: dd2a446014a37556f39173b802c63a4e46e09366 size: 23552
Section.rdata md5: f179218a059068529bdb4637ef5fa28e sha1: 6035d27db526131eb0f29aee60cfcdbb5072ed7d size: 4608
Section.data md5: 975304d6dd6c4a4f076b15511e2bbbc0 sha1: 1f65340672c91ffd0f2583ff104beaece43c7855 size: 1024
Section.ndata md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Section.rsrc md5: 78232b155dbd8b2c03035a94f57f7a96 sha1: 3d5c5f7deed878f9916ce0e14d7889d83584d12b size: 30720
Timestamp2009-12-05 22:50:46
VersionLegalCopyright: BEARPC精选软件集
ProductName: 愤怒的小鸟
FileDescription: 愤怒的小鸟PC汉化版
FileVersion: 1.0.0
CompanyName: www.bearpc.net
PackerNullsoft PiMP Stub -> SFX
PEhash151de1be67052e3331537104452150a4936a3a76
IMPhash099c0646ea7282d232219f8807883be0
AV360 Safeno_virus
AVAd-Awareno_virus
AVAlwil (avast)no_virus
AVArcabit (arcavir)Error Scanning File
AVAuthentiumno_virus
AVAvira (antivir)no_virus
AVBullGuardno_virus
AVCA (E-Trust Ino)no_virus
AVCAT (quickheal)no_virus
AVClamAVno_virus
AVDr. Webno_virus
AVEmsisoftno_virus
AVEset (nod32)NSIS/TrojanDownloader.Chindo.R
AVFortinetno_virus
AVFrisk (f-prot)no_virus
AVF-Secureno_virus
AVGrisoft (avg)no_virus
AVIkarusno_virus
AVK7no_virus
AVKasperskyno_virus
AVMalwareBytesRiskware.Chindo
AVMcafeeno_virus
AVMicrosoft Security Essentialsno_virus
AVMicroWorld (escan)no_virus
AVRisingno_virus
AVSophosno_virus
AVSymantecno_virus
AVTrend Microno_virus
AVVirusBlokAda (vba32)no_virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FileBF-BFVCenter[[AB027]].exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileOfficeAssist.0405.80.1119.exe
Creates File1
Creates File1.rar
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\nsr3.tmp\System.dll
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates File9377mycs_Y_mgaz2_1201B.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\nsr3.tmp\ExecCmd.dll
Creates FileSoHuVA_4.3.0.1-c204900003-ng-nti-s-x.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates FileMM-liao8302.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\nsr3.tmp\inetc.dll
Creates FileC:\Program Files\2.ico
Creates Fileyx_dts.exe
Creates FileFunshionInstall_C70699.exe
Creates Filesetup_95165069.exe
Creates FileC:\Program Files\4.ico
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\nsr3.tmp\Base64.dll
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\nsm2.tmp
Deletes FileBF-BFVCenter[[AB027]].exe
Deletes File9377mycs_Y_mgaz2_1201B.exe
Deletes FileSoHuVA_4.3.0.1-c204900003-ng-nti-s-x.exe
Deletes FileOfficeAssist.0405.80.1119.exe
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temp\nsr1.tmp
Deletes File1.rar
Deletes File1
Deletes FileMM-liao8302.exe
Deletes Fileyx_dts.exe
Deletes FileFunshionInstall_C70699.exe
Deletes Filesetup_95165069.exe
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temp\nsr3.tmp
Deletes FileC:\Program Files\4.ico
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\OfficeAssist.0405.80.1119.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\OfficeAssist.0405.80.1119.exe"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\yx_dts.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\yx_dts.exe"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\MM-liao8302.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\MM-liao8302.exe"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\9377mycs_Y_mgaz2_1201B.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\9377mycs_Y_mgaz2_1201B.exe"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\BF-BFVCenter[[AB027]].exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\BF-BFVCenter[[AB027]].exe"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\setup_95165069.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\setup_95165069.exe"
Creates Process
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\FunshionInstall_C70699.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\FunshionInstall_C70699.exe"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\SoHuVA_4.3.0.1-c204900003-ng-nti-s-x.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\SoHuVA_4.3.0.1-c204900003-ng-nti-s-x.exe"
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates Mutex2.ico
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Winsock DNSint.dpool.sina.com.cn
Winsock DNSt.cn
Winsock DNSmmliao.jianting.net

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\9377mycs_Y_mgaz2_1201B.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\9377mycs_Y_mgaz2_1201B.exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\BF-BFVCenter[[AB027]].exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\BF-BFVCenter[[AB027]].exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\"

Creates FileC:\Program Files\2.ico

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\setup_95165069.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\setup_95165069.exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\FunshionInstall_C70699.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\FunshionInstall_C70699.exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\SoHuVA_4.3.0.1-c204900003-ng-nti-s-x.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\SoHuVA_4.3.0.1-c204900003-ng-nti-s-x.exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\OfficeAssist.0405.80.1119.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\OfficeAssist.0405.80.1119.exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\MM-liao8302.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\MM-liao8302.exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\yx_dts.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\yx_dts.exe"

Process
↳ Pid 0

Network Details:

DNSint.dpool.sina.com.cn
Type: A
180.149.136.250
DNSt.cn
Type: A
114.134.80.138
DNSmmliao.jianting.net
Type: A
122.227.42.227
DNS37w.xdwscache.glb0.lxdns.com
Type: A
183.136.208.114
DNSdown.fspcdn.com
Type: A
221.204.189.12
DNSdown.fspcdn.com
Type: A
182.118.38.50
DNSdown.fspcdn.com
Type: A
182.118.38.51
DNSdown.fspcdn.com
Type: A
221.204.189.11
DNSwww.bangshijz.com
Type: A
42.121.255.144
DNSdownload012.e.chinacache.com.cn
Type: A
61.179.105.148
DNSdownload012.e.chinacache.com.cn
Type: A
61.179.105.147
DNSc01.i06.arnic.hadns.net
Type: A
222.186.20.122
DNSc01.i06.arnic.hadns.net
Type: A
58.220.2.5
DNSc01.i06.arnic.hadns.net
Type: A
113.17.184.10
DNSc01.i06.arnic.hadns.net
Type: A
121.10.117.139
DNSc01.i06.arnic.hadns.net
Type: A
183.56.172.47
DNScdn.coop.baofeng.com
Type: A
122.142.74.12
DNScdn.coop.baofeng.com
Type: A
182.18.51.104
DNScdn.coop.baofeng.com
Type: A
218.60.99.66
DNScdn.coop.baofeng.com
Type: A
58.20.193.222
DNScdn.coop.baofeng.com
Type: A
119.188.72.240
DNSopt.xdwscache.glb0.lxdns.com
Type: A
8.37.234.4
DNSopt.xdwscache.glb0.lxdns.com
Type: A
8.37.235.2
DNSopt.xdwscache.glb0.lxdns.com
Type: A
8.37.235.3
DNSopt.xdwscache.glb0.lxdns.com
Type: A
8.37.235.5
DNSopt.xdwscache.glb0.lxdns.com
Type: A
8.37.235.6
DNSopt.xdwscache.glb0.lxdns.com
Type: A
8.37.234.3
DNSd.qq66699.com
Type: A
DNSneirong.funshion.com
Type: A
DNSwdl1.cache.wps.cn
Type: A
DNSdl.nx5.com
Type: A
DNSdl.baofeng.com
Type: A
DNSxiazai.9377.com
Type: A
HTTP GEThttp://int.dpool.sina.com.cn/iplookup/iplookup.php
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://t.cn/RZIvNie
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://mmliao.jianting.net/mmliao/MM-liao8302.exe
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://d.qq66699.com/yx/dts/sqft/905848/yx_dts.exe
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://neirong.funshion.com/software/files/silent5/FunshionInstall_C70699.exe
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://www.bangshijz.com/NDAwNTA2MGY5ZGNlYTE5Y2EyMzBlOGU2NDA1NTU4MjBmNTRiZmM3NS5leGU=/40.html
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://wdl1.cache.wps.cn/wps/download/OfficeAssist.0405.80.1119.exe
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://t.cn/RZII9Xg
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://dl.nx5.com/apk/20141222/setup_95165069.exe
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://dl.baofeng.com/BFVCenter/BF-BFVCenter[[AB027]].exe
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://xiazai.9377.com/20150105/9377mycs_Y_mgaz2_1201B.exe
User-Agent: NSIS_Inetc (Mozilla)
Flows TCP192.168.1.1:1031 ➝ 180.149.136.250:80
Flows TCP192.168.1.1:1032 ➝ 114.134.80.138:80
Flows TCP192.168.1.1:1033 ➝ 122.227.42.227:80
Flows TCP192.168.1.1:1034 ➝ 183.136.208.114:80
Flows TCP192.168.1.1:1035 ➝ 221.204.189.12:80
Flows TCP192.168.1.1:1036 ➝ 42.121.255.144:80
Flows TCP192.168.1.1:1037 ➝ 61.179.105.148:80
Flows TCP192.168.1.1:1038 ➝ 114.134.80.138:80
Flows TCP192.168.1.1:1039 ➝ 222.186.20.122:80
Flows TCP192.168.1.1:1040 ➝ 122.142.74.12:80
Flows TCP192.168.1.1:1041 ➝ 8.37.234.4:80

Raw Pcap
0x00000000 (00000)   47455420 2f69706c 6f6f6b75 702f6970   GET /iplookup/ip
0x00000010 (00016)   6c6f6f6b 75702e70 68702048 5454502f   lookup.php HTTP/
0x00000020 (00032)   312e310d 0a557365 722d4167 656e743a   1.1..User-Agent:
0x00000030 (00048)   204e5349 535f496e 65746320 284d6f7a    NSIS_Inetc (Moz
0x00000040 (00064)   696c6c61 290d0a48 6f73743a 20696e74   illa)..Host: int
0x00000050 (00080)   2e64706f 6f6c2e73 696e612e 636f6d2e   .dpool.sina.com.
0x00000060 (00096)   636e0d0a 436f6e6e 65637469 6f6e3a20   cn..Connection: 
0x00000070 (00112)   4b656570 2d416c69 76650d0a 43616368   Keep-Alive..Cach
0x00000080 (00128)   652d436f 6e74726f 6c3a206e 6f2d6361   e-Control: no-ca
0x00000090 (00144)   6368650d 0a0d0a                       che....

0x00000000 (00000)   47455420 2f525a49 764e6965 20485454   GET /RZIvNie HTT
0x00000010 (00016)   502f312e 310d0a55 7365722d 4167656e   P/1.1..User-Agen
0x00000020 (00032)   743a204e 5349535f 496e6574 6320284d   t: NSIS_Inetc (M
0x00000030 (00048)   6f7a696c 6c61290d 0a486f73 743a2074   ozilla)..Host: t
0x00000040 (00064)   2e636e0d 0a436f6e 6e656374 696f6e3a   .cn..Connection:
0x00000050 (00080)   204b6565 702d416c 6976650d 0a436163    Keep-Alive..Cac
0x00000060 (00096)   68652d43 6f6e7472 6f6c3a20 6e6f2d63   he-Control: no-c
0x00000070 (00112)   61636865 0d0a0d0a 76650d0a 43616368   ache....ve..Cach
0x00000080 (00128)   652d436f 6e74726f 6c3a206e 6f2d6361   e-Control: no-ca
0x00000090 (00144)   6368650d 0a0d0a                       che....

0x00000000 (00000)   47455420 2f6d6d6c 69616f2f 4d4d2d6c   GET /mmliao/MM-l
0x00000010 (00016)   69616f38 3330322e 65786520 48545450   iao8302.exe HTTP
0x00000020 (00032)   2f312e31 0d0a5573 65722d41 67656e74   /1.1..User-Agent
0x00000030 (00048)   3a204e53 49535f49 6e657463 20284d6f   : NSIS_Inetc (Mo
0x00000040 (00064)   7a696c6c 61290d0a 486f7374 3a206d6d   zilla)..Host: mm
0x00000050 (00080)   6c69616f 2e6a6961 6e74696e 672e6e65   liao.jianting.ne
0x00000060 (00096)   740d0a43 6f6e6e65 6374696f 6e3a204b   t..Connection: K
0x00000070 (00112)   6565702d 416c6976 650d0a43 61636865   eep-Alive..Cache
0x00000080 (00128)   2d436f6e 74726f6c 3a206e6f 2d636163   -Control: no-cac
0x00000090 (00144)   68650d0a 0d0a0a                       he.....

0x00000000 (00000)   47455420 2f79782f 6474732f 73716674   GET /yx/dts/sqft
0x00000010 (00016)   2f393035 3834382f 79785f64 74732e65   /905848/yx_dts.e
0x00000020 (00032)   78652048 5454502f 312e310d 0a557365   xe HTTP/1.1..Use
0x00000030 (00048)   722d4167 656e743a 204e5349 535f496e   r-Agent: NSIS_In
0x00000040 (00064)   65746320 284d6f7a 696c6c61 290d0a48   etc (Mozilla)..H
0x00000050 (00080)   6f73743a 20642e71 71363636 39392e63   ost: d.qq66699.c
0x00000060 (00096)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000070 (00112)   4b656570 2d416c69 76650d0a 43616368   Keep-Alive..Cach
0x00000080 (00128)   652d436f 6e74726f 6c3a206e 6f2d6361   e-Control: no-ca
0x00000090 (00144)   6368650d 0a0d0a                       che....

0x00000000 (00000)   47455420 2f736f66 74776172 652f6669   GET /software/fi
0x00000010 (00016)   6c65732f 73696c65 6e74352f 46756e73   les/silent5/Funs
0x00000020 (00032)   68696f6e 496e7374 616c6c5f 43373036   hionInstall_C706
0x00000030 (00048)   39392e65 78652048 5454502f 312e310d   99.exe HTTP/1.1.
0x00000040 (00064)   0a557365 722d4167 656e743a 204e5349   .User-Agent: NSI
0x00000050 (00080)   535f496e 65746320 284d6f7a 696c6c61   S_Inetc (Mozilla
0x00000060 (00096)   290d0a48 6f73743a 206e6569 726f6e67   )..Host: neirong
0x00000070 (00112)   2e66756e 7368696f 6e2e636f 6d0d0a43   .funshion.com..C
0x00000080 (00128)   6f6e6e65 6374696f 6e3a204b 6565702d   onnection: Keep-
0x00000090 (00144)   416c6976 650d0a43 61636865 2d436f6e   Alive..Cache-Con
0x000000a0 (00160)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x000000b0 (00176)   0d0a                                  ..

0x00000000 (00000)   47455420 2f4e4441 774e5441 324d4759   GET /NDAwNTA2MGY
0x00000010 (00016)   355a474e 6c595445 35593245 794d7a42   5ZGNlYTE5Y2EyMzB
0x00000020 (00032)   6c4f4755 324e4441 314e5455 344d6a42   lOGU2NDA1NTU4MjB
0x00000030 (00048)   6d4e5452 695a6d4d 334e5335 6c654755   mNTRiZmM3NS5leGU
0x00000040 (00064)   3d2f3430 2e68746d 6c204854 54502f31   =/40.html HTTP/1
0x00000050 (00080)   2e310d0a 55736572 2d416765 6e743a20   .1..User-Agent: 
0x00000060 (00096)   4e534953 5f496e65 74632028 4d6f7a69   NSIS_Inetc (Mozi
0x00000070 (00112)   6c6c6129 0d0a486f 73743a20 7777772e   lla)..Host: www.
0x00000080 (00128)   62616e67 7368696a 7a2e636f 6d0d0a43   bangshijz.com..C
0x00000090 (00144)   6f6e6e65 6374696f 6e3a204b 6565702d   onnection: Keep-
0x000000a0 (00160)   416c6976 650d0a43 61636865 2d436f6e   Alive..Cache-Con
0x000000b0 (00176)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x000000c0 (00192)   0d0a                                  ..

0x00000000 (00000)   47455420 2f777073 2f646f77 6e6c6f61   GET /wps/downloa
0x00000010 (00016)   642f4f66 66696365 41737369 73742e30   d/OfficeAssist.0
0x00000020 (00032)   3430352e 38302e31 3131392e 65786520   405.80.1119.exe 
0x00000030 (00048)   48545450 2f312e31 0d0a5573 65722d41   HTTP/1.1..User-A
0x00000040 (00064)   67656e74 3a204e53 49535f49 6e657463   gent: NSIS_Inetc
0x00000050 (00080)   20284d6f 7a696c6c 61290d0a 486f7374    (Mozilla)..Host
0x00000060 (00096)   3a207764 6c312e63 61636865 2e777073   : wdl1.cache.wps
0x00000070 (00112)   2e636e0d 0a436f6e 6e656374 696f6e3a   .cn..Connection:
0x00000080 (00128)   204b6565 702d416c 6976650d 0a436163    Keep-Alive..Cac
0x00000090 (00144)   68652d43 6f6e7472 6f6c3a20 6e6f2d63   he-Control: no-c
0x000000a0 (00160)   61636865 0d0a0d0a 61636865 2d436f6e   ache....ache-Con
0x000000b0 (00176)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x000000c0 (00192)   0d0a                                  ..

0x00000000 (00000)   47455420 2f525a49 49395867 20485454   GET /RZII9Xg HTT
0x00000010 (00016)   502f312e 310d0a55 7365722d 4167656e   P/1.1..User-Agen
0x00000020 (00032)   743a204e 5349535f 496e6574 6320284d   t: NSIS_Inetc (M
0x00000030 (00048)   6f7a696c 6c61290d 0a486f73 743a2074   ozilla)..Host: t
0x00000040 (00064)   2e636e0d 0a436f6e 6e656374 696f6e3a   .cn..Connection:
0x00000050 (00080)   204b6565 702d416c 6976650d 0a436163    Keep-Alive..Cac
0x00000060 (00096)   68652d43 6f6e7472 6f6c3a20 6e6f2d63   he-Control: no-c
0x00000070 (00112)   61636865 0d0a0d0a 6e656374 696f6e3a   ache....nection:
0x00000080 (00128)   204b6565 702d416c 6976650d 0a436163    Keep-Alive..Cac
0x00000090 (00144)   68652d43 6f6e7472 6f6c3a20 6e6f2d63   he-Control: no-c
0x000000a0 (00160)   61636865 0d0a0d0a 61636865 2d436f6e   ache....ache-Con
0x000000b0 (00176)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x000000c0 (00192)   0d0a                                  ..

0x00000000 (00000)   47455420 2f61706b 2f323031 34313232   GET /apk/2014122
0x00000010 (00016)   322f7365 7475705f 39353136 35303639   2/setup_95165069
0x00000020 (00032)   2e657865 20485454 502f312e 310d0a55   .exe HTTP/1.1..U
0x00000030 (00048)   7365722d 4167656e 743a204e 5349535f   ser-Agent: NSIS_
0x00000040 (00064)   496e6574 6320284d 6f7a696c 6c61290d   Inetc (Mozilla).
0x00000050 (00080)   0a486f73 743a2064 6c2e6e78 352e636f   .Host: dl.nx5.co
0x00000060 (00096)   6d0d0a43 6f6e6e65 6374696f 6e3a204b   m..Connection: K
0x00000070 (00112)   6565702d 416c6976 650d0a43 61636865   eep-Alive..Cache
0x00000080 (00128)   2d436f6e 74726f6c 3a206e6f 2d636163   -Control: no-cac
0x00000090 (00144)   68650d0a 0d0a7472 6f6c3a20 6e6f2d63   he....trol: no-c
0x000000a0 (00160)   61636865 0d0a0d0a 61636865 2d436f6e   ache....ache-Con
0x000000b0 (00176)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x000000c0 (00192)   0d0a                                  ..

0x00000000 (00000)   47455420 2f424656 43656e74 65722f42   GET /BFVCenter/B
0x00000010 (00016)   462d4246 5643656e 7465725b 5b414230   F-BFVCenter[[AB0
0x00000020 (00032)   32375d5d 2e657865 20485454 502f312e   27]].exe HTTP/1.
0x00000030 (00048)   310d0a55 7365722d 4167656e 743a204e   1..User-Agent: N
0x00000040 (00064)   5349535f 496e6574 6320284d 6f7a696c   SIS_Inetc (Mozil
0x00000050 (00080)   6c61290d 0a486f73 743a2064 6c2e6261   la)..Host: dl.ba
0x00000060 (00096)   6f66656e 672e636f 6d0d0a43 6f6e6e65   ofeng.com..Conne
0x00000070 (00112)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x00000080 (00128)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000090 (00144)   3a206e6f 2d636163 68650d0a 0d0a2d63   : no-cache....-c
0x000000a0 (00160)   61636865 0d0a0d0a 61636865 2d436f6e   ache....ache-Con
0x000000b0 (00176)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x000000c0 (00192)   0d0a                                  ..

0x00000000 (00000)   47455420 2f323031 35303130 352f3933   GET /20150105/93
0x00000010 (00016)   37376d79 63735f59 5f6d6761 7a325f31   77mycs_Y_mgaz2_1
0x00000020 (00032)   32303142 2e657865 20485454 502f312e   201B.exe HTTP/1.
0x00000030 (00048)   310d0a55 7365722d 4167656e 743a204e   1..User-Agent: N
0x00000040 (00064)   5349535f 496e6574 6320284d 6f7a696c   SIS_Inetc (Mozil
0x00000050 (00080)   6c61290d 0a486f73 743a2078 69617a61   la)..Host: xiaza
0x00000060 (00096)   692e3933 37372e63 6f6d0d0a 436f6e6e   i.9377.com..Conn
0x00000070 (00112)   65637469 6f6e3a20 4b656570 2d416c69   ection: Keep-Ali
0x00000080 (00128)   76650d0a 43616368 652d436f 6e74726f   ve..Cache-Contro
0x00000090 (00144)   6c3a206e 6f2d6361 6368650d 0a0d0a63   l: no-cache....c
0x000000a0 (00160)   61636865 0d0a0d0a 61636865 2d436f6e   ache....ache-Con
0x000000b0 (00176)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x000000c0 (00192)   0d0a                                  ..


Strings
 " "
EH.
080403a8
1.0.0
1s%P
BEARPC
bsJP2
CompanyName
FileDescription
FileVersion
Js2P
LegalCopyright
msctls_progress32
MS Shell Dlg
Please wait while Setup is loading...
ProductName
ssPP
StringFileInfo
SysListView32
Translation
VarFileInfo
VS_VERSION_INFO
www.bearpc.net
        
 $))*~
{+"(-=
}~$_	"
*?|<>/":
0[4{Fc&Ql
06VgiA
089@&e
0{ednW
}0eyG	/,
=	0GL}
^.\0h!
:0[$H[
0k(-Q}
?0l3;NW
0Mz;@Y`=q
|;0O3:
0P*5*>
0r>O%P
0rqZ	U
0s[Jx%
0Sp5F2o
0ts7iT
0U) 	]
0U/`5R
0UF{	FU
0Ug\F([:
	0Vb-I
0wQgI>
0z^h7PZ
'0Zl3(b
111~SSS
1:16,1
12Rq]7
13,$:@
19l2.X
1:bIgNW
1:b~%.Q&_
1d?C3;
+1& +-E
1/>E'e?
1#et4bi
&#1Ev 
1flGwN
1fu:q|
]1GP"P
1j	@4C
{1]J6RU
1]N?P.
1O4=?q$x
&1Od@uz
1PD-{Ij
1pjuud
1qb.vK
1-)rv].s
#1+U3_y
=1ubhB
1*W5np
1,wy<F8
^.1$X!
"^)1X\9#/D
1xK;0#
-<&1!yp
->2}\{
21(*[Q
2217fM
2	 49>
24/Hji
2	$4j4
26^jt_
27@'}h
27J,`G
"\;2A|
2dj$!gg
2dvtyEg
.2)Epp
2<H@'C
2ho S 
2I0MF7
2I8to	
2#	^J2
2K6?>`
2!$p>3
?2=pRj
&2RA}4C
.2S9]0
2{Vi~2
2wlQ;{
3&1%f?C
3330XXX
3b3	[e+
3"}_bA
3cJfWm
3d"JKb
3eH))r|
3G0V?-
3g2g]U
\3hbZ*	
3Hnb(R
3iTrHb
3JxA'T
3kB|LH
3Kd{_xI
3KM\/%{
3l7>w:
(3L$}J
3lVd(a
3'=mUW
3Py|Rl
-=3Sdm*
3sO5Jw
3tncB%Z
"$,4)-
\42TXH~!
43ITnk
455\-@
?4&5<M
4a# +l
4"~Ar2U
4=B7jj3
/%4BKx,
4cIW=+"
4cZuiq
4d{?u!h
4f@^@B
4fJ5m^
4g{opp
 4hN3]
4?Hq=x@
%*+4I?
4%iA$^>`x
4KJpb7
4K:p?[\
4L[m	S
4m_cFl
4'M((t
^4O0$zj
4owy+{
4|"PZ"p
4R@$'<\
>>*4t^
4Tfqz%
4uz	j%
4+v{&,
|4va^C
|4Vsw~*v
4w1.&/
4]x+v.K
`4YAL,
4;Z:'}`
4Z>c2F
(4zguUM
^}5>*	
?5:%&`
*503IVZq
51m\\D
[5&[4ZsvW_0AE
5%}##$51
}.58h%
5bAZ'B
5BLa%k v:
5BuUqG
^5# }C
- ~5CD
5d0(2V
/5d+-t,
5&evwi
5jptK]
5k+LV0>
5k(+S 
5l76x\h
?5L\$D
5LiJuDB|z
5M7jb9
|5MRq~t&
5o/; x
@5tODA
5v~0B@:B
5xd}Bs5
5z^o]V
[	/#+6
],6@,:
60E^jf
65Z1fD
	66CDR
6*A*0Rc
@6b/RS
6)	'bX^_d
>6']f+(
{6Fe\Hf7
6Hp4;&7
6IdG|P
^6J3o$
6j4{`Au:P/Z
/6@jNX
6=kF+j
6!~lf8+R82L
6?O~`.<c6
6<}Q6$
-6 R1x
6R5w&b
6R:%o{<z!
6sQ0.?
6!TNfpgV
{6!Wh{
<6W}N7Yu
6zXR^K
7	#\.[
70H:QPU
71;[%R_
>\732"
73{>T'
7}52W"
75mNe+@
@@@`777-
79JU+t}Q"
7A)LfN
7&	B*4_
7.d2 /
,7FBy@
:7`F:XE
]7I-*=
7]I'6a
7i%K<oq
7jv4D.
7k'wre
7,l+P'g
<7=\mw
7n/3.+
;7Njnb
7q7GXxh4~Y
}7'Qimf%
7R	0]X?xp '
7r0Z0x
)?7SVn
&7T{R^
7tt?B"R
7UJWhC
,7#v "#]
.;7VPJ
%7V ZGf
-`7{y$
7YeB0D
+7Z0u&
7Z=tt0
8[0cchJw
82Fx to
8^4AIT
86mfd7
8AocE[Ba	>%
8CZ#?}}%0]
8D89@	"
^8ddg:
8Do/;3v
8dxB)&
8) e;F
8~Fx^&([FQ=$
8\h\dJ
$8iQg7
8I[x>LU
8j6e.Z
 8!kEV
8k+GA`u
8NCRCu
8)[RJ6
8S#188
8SM 7h
8V@,L?
 8,+;w
_"8X:1
8)+_]y2
&8Zn;Y[
?"	#9<
90:SW~
94P8]8+O
99 qz{?N]
'9B#<)
9bHi-m
[9#c6p
9)c?_he
9cKW}!+
9?D8P[
,9(DR#[
9fId0O]s
9HRMHB
9#HSy-
9I23D"
9]I2te
9I`9\s
9Il%`:|
:9}IQn
9}(kRj
,9L2{t
9l/fa4!7q
9l"Z^;
9m"?(J
9ML	j]
9OFKTDM
9pTpJF
-_-9q>
9>RE^()
!9Rg:R
9S~zXb8^
*9t[.0
}>9T?n
9U	7H~
^9U,pt
9WvMCgf[cs
'9YE@g
_,a*,?
A'[:(-
A.3ja!
A4[^9I
a&4!e]
*^[a5v
A!~62m
A7[kgj
	-A8a]
a8Nn!g
|a9-4iY
$A.9*!y
	a#|a5
AAA_ggg
Aa?S\:
AasnC>
>AA)ziQ
{a]baj
[_Acmz
AdjustTokenPrivileges
ADVAPI32
ADVAPI32.dll
A:Em|@
Aeog>	
AF\bvg
$aFlo|4
AFZl R
/{a@h 
AHFw\L!
AH:/*Nm
aHZPTd4a
"<*A$i
Aj,`3e
Ajm[:~N
]aJv'V
Ajw3<j
Ajz-[f
[ALaWV
&A}l_hFX$
|am10LR5W
a@%NJ]
 AO6]Hz
ao}8Ixy$
a%P+$?
{a(pEOf
AppendMenuA
AqHsYS
A?Rb3?
a(RJmcn
\=ARTG
A.}S|`
+as!NB
atb5rR:
a|&/Tz
]{)Aup9
A.&^!V
Av`C2@
$avTy|FnE|
a~w'f;&
a{wZ_!
ayq^YF
az2c#"{V
Az7?1z
azhIq:]
?AZ_HY:
!az>P_
^?(_B;
}?B$;!
B0N1)"
b_<3<'
B3Vof`
B:4t9(
<b!~5"
b~;5N~
~*&B{7
B8&([8
B*9B(i
B9u|Gx@
B9"yIC"~
ba$	]{
BAD[ZL~Zh
BBBp;;;>
Bbio}MA
b[%C\kQ
bdYlo m=
BeginPaint
B~FAHW
&>B'FQ
B;g@3 	
]BGa}	
]bGf3Yo
BgwufP^,2n ;
bHp\+z
'/B[^!i
bi;KQ9
 ,bI?<x
>BJKp}
B'#jS6
bkuOn4f
bL- 6D
Bl7V5`
?*\BlKa
BLQY#N
bM?!3uCd
|B#\O1f
Bo=I*k
BPB]Fap/
bpeVb_ 
BqXeEyT
bqY#%u
Br}CA,
bs/UfM~
bTAR:t
BU"9d,
	buQ7;
_b?Uvf8
bU(z(A
bv'4&2s
bv"Ej8
bVr|/H
&$Bw9G
B-WlO_7<'
Bxy^,D
B@`Y<;
b'YkiD
bYrJ9*
b'(y=TI
<C+,/\
$C@&:<|
_c1V#@
c|3+F8
`\c3s9
C3,s)s(
"C6Z2=
)C7-`vrSu
ca7S|_[
CAFzKX
CallWindowProcA
C%AO6[
]}c\b\
}C@]bG
,CbkW>q
cB(/qN
CCf$Wi
)_cD3d
cdSq:c@
C_e']%
#"c(f-
CFQ1(-
,c{{g4
C;G|BlV
c g=wk
(c}Gx^
_CH7T:1
CH97J)
CharNextA
CharPrevA
chC%9X_H
CheckDlgButton
{	chEE
ci6wB;
cKu+DCu
|CkylXP>
C~&}}L>'
cl.O1>
CloseClipboard
CloseHandle
@?CMH[U
cMl89Y
C$~mM:/
#<#C\o
CoCreateInstance
COMCTL32.dll
CompareFileTime
Control Panel\Desktop\ResourceLocale
CopyFileA
CoTaskMemFree
(cPaGb
c{]pc`
%_CPG7
CpL{d&
;}c R3
c"r55j+3
CreateBrushIndirect
CreateDialogParamA
CreateDirectoryA
CreateFileA
CreateFontIndirectA
CreatePopupMenu
CreateProcessA
CreateThread
CreateWindowExA
Cs| AM~
cSFOG(6"
CS&Gs;
C%T:H.
ct<]o0
CT|SuAz
"`cV	|[
CWbgd(
cX>E//
cXM|`B
CxnWO(/
C,@xo.Vc
_cYgbC
CYLWnq
=cz4Z,
cZCeX`
,^[\#d
... %d%%
D$0+D$(P
D0n3}6
D!1I~ 
`	D`3N
D4}5U"
*$D/5ma
D=8c LM
d|8?#D
&{*D9)
@|D )"9P
daS1h%
@.data
Da,%wJ
>D %Bg
DBpQi6
}D#Bzk|L
dc{odadm
d(%\D4
DDDI{{{
*%dd?o
D$(+D$ SSP
d[*E:	
.DEFAULT\Control Panel\International
DefWindowProcA
_De`Io
DeleteFileA
DeleteObject
DEl*pZ
d e\m=}
DestroyWindow
dfHnEt
|DFZ`	
D#!>	g
{D#\Gy
dH6!(46
/>DhUmW
di,2yj
DialogBoxParamA
DispatchMessageA
dj-Ayh
dkLf-mZ\
DkzHiI
d+l$F~
Dm,4j/
Dm_5uUO
D!.	m9
dMNWk(
&Dm?Qa
!dmqU9=
D|)ngV8A
;DNi:1
}DogPZ
D-OrbU
[D*p6~
Dp&h%5
@DP;(Hk?
d/&P-u
	~dpuc
DqE^Sc\T
D)Q!z/K
DrawTextA
DrMK\96
D$(SPS
DT&48=
DUsa{>
D/VS!w
d^wf[$
DW;N#!
:Dwtj;
+dyE,k
#Dy	py
	(dyuTH2
Dz:-cS
e1u-?J
E2Imolqd&
E3m	h?z
\e?4{m
e4w_b{
E8b[6]
E8B/9)P[
EA44;V
`eA}nb
{eB^b]
ecmN%'g
EDhTqwM=o
EDu,5.
|E\&ecc%
eeeeeeeee
eEH7T)$
_EeOj@\;
e"G.12
eh5.+2
!E~H?i
>E=H^P|
eHtdd1
EJKs3O
Ek7G)r
ekGpd]m
EkP!%s
E{Lf@Z
!@	]ELi2
eL /LM1
E#:'{M9
EmptyClipboard
e|=|:n
:eN6,^KFt2
EnableMenuItem
EnableWindow
EndDialog
EndPaint
/E;Ng5
En}@ Z
Eog~`,
E.OMifS
 ePFQE
E`PI%>st
eq^i<m-&A
E$ <r%
ER~@6A}
Error launching installer
Error writing temporary file. Make sure your temp folder is valid.
Ertk Q
er)zGe
E,S/_A1
esv#r`
:]&Et6t
^)E?tF?
etio0k
eu|r8U
eU*uS?
-EW`'!
)&-EW.
!ew;4V
`Ew^6u
=eWGuIX
	e}$wyrUN
ExitProcess
ExitWindowsEx
ExpandEnvironmentStringsA
Ex?vah
ExW<%j0	
^|( |f
f*}+^%=
F$") <
f -/0~kH
f#30MZ
	F^&_5
f5?0eX
f]7_^?
F}7Oe*N
>f(8Ab9
F8F-if
f}a,de
FA|g9r
FAMcF}
=f<amU
f$AV M
^F~a-<W68
FB!50S
F"b7De
fcaacopefm
{FCc/I
F/c#:g}R
F_` dv
|?F@e/
Fe_7ah
f#$	f#
FFF#LLL
ffj`w2\S
f.FQLy
'#fGBW
Fg*kmC
F?h{][
`f,I3.g	3
FillRect
FindClose
FindFirstFileA
FindNextFileA
FindWindowExA
firTmU
)fi*v`
}fiwBuu
;(FJ:M
%<fjt_
{fk-@h$
F = .Kx
Fl8h#<
	flb.ZF
fLTClw
F"LY.\l g
fMsPq.Ym
^-f.nl
FNNNN@
FNT^Jf
FoZdip
F&$\p#
Fp:?nSJ
*fPo_H
,]F'p R
fqk)Bt
F^qu{7
\;F,$QW
`Fq&w.O
FreeLibrary
f[s?48
f\SwD5Bb
*FT^Up
f/)tZX
fvE2:9g
[=FX:E3
#FyNMTS
fZ'29JXxN
+Fzx, 
	}?,g:
g0`]5`e
 g+2EZ
G;328<
g@3ne]
G3O	CX
`g-4 0	;
G50\/~
\g6HCO
G6Q&( 
G7$yD"
;G9:0QVx
g#91|XQFR
G-95BND
;g%>A q
<GbCTvG
GB	vb;
/[GCfa7
Gc!myfno4
gCv3G5
gDg)B;
GDI32.dll
g@_DY<
G)er(7
GetClassInfoA
GetClientRect
GetCommandLineA
GetCurrentProcess
GetDeviceCaps
GetDiskFreeSpaceA
GetDiskFreeSpaceExA
GetDlgItem
GetDlgItemTextA
GetExitCodeProcess
GetFileAttributesA
GetFileSize
GetFileVersionInfoA
GetFileVersionInfoSizeA
GetFullPathNameA
GetLastError
GetMessagePos
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileStringA
GetProcAddress
GetShortPathNameA
GetSysColor
GetSystemDirectoryA
GetSystemMenu
GetSystemMetrics
GetTempFileNameA
GetTempPathA
GetTickCount
GetUserDefaultUILanguage
GetVersion
GetWindowLongA
GetWindowRect
GetWindowsDirectoryA
Ge~y*JGI\
<G|fw:_
G.)&H&
g#H8%f
G,Hc(m
ghdo-r1g
G~hkCk
GHmc;CL
GhRo^`sL
GHT;Jp
]}gHz<[
`gjc`_
GJL_B<
GJ,$"Xg
:@G/KkM
@gKvqm
#G='((L
GLfPyC;S;
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
G:\lz3
>G/N_G
GNi(A?
G*N\M=
go!;{9
"gOAZ@Xj
gOV?{H
GOx9*=
G\P|}D
GqV|M5"
[GR`r$
\)GRsS
,GS#kt6Y
gspF9x;
G?%*:t
GTjsf;Q
g	tl6~
g#Tlmx
gV,:qt
G&Vr]0%qz
gv'V(5
]g?W[b
g%wF8ah.lV
gx$erg
,G{X:p
> .G{X"tOq
/!GxWd
_	;"gY
}Gz .}
~H=,%	
 !%.&H,
h$/1Ug-t
$h{	'2
h;2E[x
H5<B{\
H5&E`G?KC
H5+\q%n
H6D;R*
, H6SO
h\7s]$z
H[*87?
H9	c$7
=_h9[D
H9izF~
H9MU_J
;-ha55r
HajXP;
]}[|H&b
hc8/-"f
HC?'K<
HC^k\@B/
hEDD)q
:HGli,
H~g\?uC
H+#IC3&eC
_hjCn?
)	]h-ji>
,Hj`oP]A}
'HJ+Q>
h;Kd"gT
h>koSUhP
HLDw[B
HM5UA%
hma.,fJ
h(#ML&
hm$mhx
-\h>o8z
_*hp<e@F:v
`HPg^Z
<_HQhl
^hQQjS
HqrKZ;
H\Q*Zod
h:R|A_
h%s1(7
-h<SEfy
H{.&sL,p%tW
h[s&vf
htBFve
H{t,g"
H<T (`k
http://nsis.sf.net/NSIS_Error
HTVM_zt
H?UC]'P
hu|E.*
H/u~Heq
HUmcW.
*H=VfVY
Hw& +|
hWJ\E&>
hwz(on
h[)x.`
hxh!HD5
h&#"^y<
;HYX[m
h:Zsz(
HZX9Q:
_({+$I
{",}(I
I0:f(W
i1Bf.^
i1RBM{
_I23&Z$
i3||	|%Q
|i5Q@9
	I7*g*
Ia5AEc
 i(B$f
ibFDT"7j
%iBXD`"
IbY."Jgc
i.C<*;
iC6pB_H
IC-HB:
[i+\CV
icxk\!w
^i{d>`
iD{V7$
IF2d4xx
	if6I8
iFpU66~
ig|MlN
+iG'uH
I+G"V[
iH/A 1
IHhPoQe1
I@Ir{F
Iix cKK
`!iJ|j
\)Ijo<
|iJ-Qi*
+iJw!^
'i(+k7O@
ikyPVF^s4
I]lDJl
ImageList_AddMasked
ImageList_Create
ImageList_Destroy
iMQA7		,
incomplete download and damaged media. Contact the
Installer integrity check has failed. Common causes include
installer's author to obtain a new copy.
Instu_
InvalidateRect
>in;Vk
&IoEjq0_
<#i=}p
IPY=pV
!I#pZ&I
Iqov{P
ir"&/&
iRichu
)IR"_u
iS?gU+
I`_smd
i#sni 
IsWindow
IsWindowEnabled
IsWindowVisible
>I/SWs
iSZN5G%
?iS-zV\
ItP8dhqz
I$#T|q
i`U TY
I, VFn,
IvX$5X-
i}w|fz
iw}:*g
iwZ$I8>R
i:x<KF
*I?*(xo
iX?Xg3
	IYWd|Q
&|Iz/(o
j&)\?]
 ^"	}^J
j1<dsC
J%24)}
J=4#s}
j6_k9QH
J7qLzX(L
,\}j"8"
J8nqY0
J8qGwrY
Ja$2o$ 
	*?jaM
"/{*j^C
@`![JC
J/+d2.
jDQ%4\\>
jGQhJw
 &(j|H
jI*jzFW
JJJ2bjo
JJJ2HHHEEEEHHHHxHHH
JJJ2JJJ
'j	.k~
J=ljI|
jLMDB`QI
?JLMZ2 c
jLS+/i
	}J$lT
,jm1<v
jMYTrz
J">( N
>jNuB2
JNW3ki
j`|p)/`%
,:J+Q`$
jqAo;q
$Jq"_T
j-R0];{
J|S#!{
%JS>E6
j}:sHdc
jsX%>$
`jTE!XHp
jTpJiI
\jtyNq
'JUq6&
#JuuUS
jVa02?
{|j{vE
JX3pBU
Jx{4Vc&
%Jx?7O!Q
:j)XBf
j*(") y
k_"""#
k0"N]on1u.Fjz
<k0r$P
K15bpG 	
_*k+	2
k2[GM_G
k/2#,w
=k(4@v
k;~5VJ`%
~k8k|r
K!A> Z
kb2k!Qe
K&b`_)3
k_bbk8_V
K-buWO
k#Bw#?
kC_5I!!
KcTRjXs
K_/Cx\3
"^k%D*n~
K\EIVi
KERNEL32
KERNEL32.dll
k@E/URk
K"Ev{?Q
kE	^zd
kFZ%8j
K(g/}L
]kH#),D
?Kh KBL
KHo0W{e$	
khPuSa
=kIO	J,
<ki"Shn
 KKKby
KKK!FFF#R_g
KKKGGhEg
KKK!HHHDEEEGEEEYHHH
KKK!HHHDEEEGGGGhHHH
kkl2iZ
@!KL[BMj
'KLI7 
kLJ%`=}
:-k{^M
knf;IM
?kntp|7P
;~~;?]k]oI
<(>_KOT
`kP(wC
]K!.q?
>K)QFHG/G
@kQh#x
kR)g]H
kR<+To
kR}uQD
K)SUL[n-
\~K]t;(%
k ~T }K
kTL&)&e
+KUmMhv
]@kU &N
k^V?	 t
k/w*8N
kxd|qS
kx+~qs^
K'Xr:E_c
Ky[*>}
KZ~BsI
)kZTDP
KZW	(F
L~1Bk}N@
L;^-2@
L20&{P
l3i~YL
*L({3y{
'L5tYl
L7^pS.
l7@+qIL
l8/1O[
(l'=9D
L(9NA}
>l9'.WeS
la;@GjsL5
laO|O)
lCKIm'
\L%D%~
&LdB'6
,^][le
le3C%]h
lffu~l,
LFQyM5't
}lFWfX
LHee&/
lH`j+^
.l!hokJY8P
lHXd9=
LI#N{7E
LI\sB.z	
Lj3@l_
lJ$jYk
`:^LKD
l-&kDf
l~kvkmN*
#>ll|~b]
Lm.	7Y&
*lm)u)
Lm;ZGf
,?LN~/	
Ln(nS9Vy
ln+r-{xX
lN}y>!+p
<	l^?o
LoadBitmapA
LoadCursorA
LoadImageA
LoadLibraryA
LoadLibraryExA
LookupPrivilegeValueA
lo^%=xJ
lQvBTp
L:,r-i
>LSTmb3
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpynA
lstrlenA
lSu(CLF\
!.}.lt
LtAbs%
=#l#Tk
[l.UJ[
>lUnoe
!lVR} 
_lw>aA
L>W\f\W
LwIl26|D
?>&Lw^OB
l?X'B^mR
l"XV.AN<
Ly(@+k
LZBtA@
Lzz#7&
!M0%l10<m
'm1&nXPTJ
[`m&4r
M.5*Bd
_M 8!`|
M8BDM0C
M8?u$mr
	']M{(9
_;M9l9
mA&8@\O
#}Ma{NQ
MBe	CO
MBHZn@b?
mbQyo/=
 MCa@R~i=,}
mDds:*e
+mde<O
m+D{JA
ME&)8k8W
meghc^46Ka
=+MEI	]
MeM]@?
MessageBoxIndirectA
m(f8t+
mgMd&%
\Microsoft\Internet Explorer\Quick Launch
M?J",%
Mj2	8b
-MJk_M
mjkxS1
mK5kA4-
m,k9?fX
mK	WMm
M/`&lP
<(m~mE
***;mmm
MMp;<xQ
m:N2'{:G
MnAg@&
mNiI-~
MNJ*5\
`Mo!<P
More information at:
MoveFileA
MoveFileExA
mO?W3	
MPMO5j
M#|<ps
Mq10'*]
^Mq)6X
mqd\kJ
#m"_Qw`
)mQzm`
Mr.ALb
	m?r_S
MRVl_W,
	M]sNk
.msu"Y
mtN-G0
MulDiv
MultiByteToWideChar
MW8ca^
mw{l[%8
?mx=7j
.MxEc,
:Mxu;z
MYWW-v
MZ=3Ym
MzL0DR8!
mzZ=gq
n`1XF/\<
n@==`2
N44PZb
N4C2ae
n4OY.-
N5CA1x(
n5hEgyv
N&6@h+
,N6kXDe
N7}>9k)
n8'=)GL
N9*l@@'
_nafUAN{
Nag!6N
~}:Nbgd8
nB"#k,
|'nBzw#
nCJI`k
.ndata
N eBo`
nFX!/l&
 nGhUZ
ng*U\:
}Nh?(4jO
n%_hI=
NhSa*j
n<"hW"
nHyMx	
NIh=CG
N+('J+(
njc5wgO
nJOT:e
^'nk<5
nK.n1-)
NlavO%
nLvZFG=7Ss
[n]NXj
)N,;nY
NPDQ*m
[nq{vR
(N+R{l
N?-S&:
NSIS Error
~nsu.tmp
NullsoftInst
NulluM	E
NU||;r
|N^UZE
!n%Vz'
|NwfBH
N/xPbZw#:aCb
n"Yn/I
{%NY U
]['N[YW;	
./:)"o
@	?o&!
o]`}-)
o7=W1X
O^<a1%
_O@ahA
OATbF(Z
oBdLhk
oe@,K/
@,@	og
oGLm?2|v}Ih
,oh)4g
O<H8<IsB+
OH]+["\a
O=hdTbL
OiDi|K
^OJ#JT
o|J MO
OjsO=R
ole32.dll
OleInitialize
OleUninitialize
OL^Oj[
OL*@r|
Oo(_G~
:O:[op
O^oz(8;%
OpenClipboard
OpenProcessToken
OPG[6l
`O*RBq
#:oS@Q
o!,{&#t
Otc eVEj
Oth0i}y
OU+UFC_
!ov84@
&oVqVM^}-$
o[w}HR
OWU 'we
|#-oX%
Ox62^J
`Ox))V
OYOI	<
_OZE<<
>>>P,,,
_P,-<\
{P0v.}it
p>|0yJ
p>2bJW
%p2>i:
P3>vQJ
/p5d'Y
*P6P%6
p6SZp)
p8.V[d5
p9O&-iG0
|')Pblq\
p!b|.Nb~!
pC{:(4&
'P'c~D
P")>C|u
p~d%&k
 pdQwf
pe2TNA
|PEcbL
PeekMessageA
,pfiz6{
_Pfq1|j
+{p</g
pG/b)d
phFBi*
P+HITM
pIsN^I
!&PK0TN
P&ke|n
pl\0Ve
/@PL~n
-pm0NE&
P/M2 6X
!!!pMMM
p\M(mr
P)mO26
PostQuitMessage
P*p1zM
PP9{`lg
Pp%HXB3M
PPPPPP
PQ~nQR
pr&qT8
PS0n=2
.PS35g
Ps3.uT
PSHK,~
p.tzB?t}
p{u;#I
(-puqlw
pVm'NFx
.:pvUS
p[{vV\
|^!P:w6
P	w(Uw
pwwwww
pwwwwwx
P?xG-6
PX$HV^
pXYzaL|
py3jDf
.p)+Yf
P#zPfb4nN;
PZrsk^g
}})$Q_
+Q:0=k
Q0oa(H
q2	4`>Q
q%35;#
Q&4K~i
q4![}r
Q5m/w]044
~.Q,^5!SY
q6<'E9R9
q6_@j_
Q7AaTP
QA2PE2
Qa6-C9*
qAaI(4
,Q%B";/y
qC[5bOkeb
Q#cIb,
q$cM tj
QDEB.0L
q_D*H>M"%V
*Qd,P*7j_j
qdx(I`
qE^jCBa
qe {wbS
Qg7Dd 
QgbOfF
&qgxkT
QHBnq{
`"q?hL
qi*2Bbo
qiCStZ1
>?|QI"i
qje^=$
q<j	E=
@Qjk|E
qK5-}_
Qk}C?	
['Q!l<
ql<1Q|
q?~LLZ
ql{s5>k
~QM>b4
!Q,mJl
q=_*N;
$qNiFhT*
_QnO%[zKrzWE{
qnP&DaF
qo8Uo"
qP-MTTE
qqqqqqqq
qq{SW:`
qQYwY/J
"/Q#)r9
Q>{(s:?
Qs&={%
q.s^/5
(QT1UwK
q?TF+G	
}q>:XF 	^w
&QXLJB	{
;%=QxM
\Qyik<
QzwYo#
QzzFkZ	
qz)Z_R
R|-/{	
R0={%zZ
R}1h"\
(R?:1zf
R#4{h0
R][_(5
r	$)6O
r7ee6&
/%r,*8
r9tI3]za
Ra	"+h
RBC1!-.}vg
RB&eRx
r~.%bV
`.rdata
rDfa95IN
&rdiHO
	Rdt`2
ReadFile
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegDeleteKeyExA
RegDeleteValueA
RegEnumKeyA
RegEnumValueA
RegisterClassA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RemoveDirectoryA
[Rename]
{rErd9
=reSzS5}
 rFx96
RGaU~@y
)rG%gd
^|rGien
rhG9%f
~"riB}
RichEd20
RichEd32
RichEdit
RichEdit20A
+rj6Wu
*R@k0!
r)kr;X
RLb{yD
R~LEJ5E;]
}r._M^
(rmX!z
<<RN&{
<(Rn11
`\rN{S
rN%x#w
Ro`S.-2V
Rph	0y{
R+PsK*
R;PTH}
RpxmW2/
RQ4lK/}r
rR!9}-
R}r9fP
R \Rpcv
}R"s+W
)\^<RU
\:RUm^^
%{=RuTo
R{VGmp
r)v>PO<
RVq-{K
~_|rW'
RWiURK
_rwN}5IT\'m
RX9Q:f
:/RXhj
Rxu!7|
rxw{;A
rY&l>KT
rY<Lm!
ry+|mW2[YN
RZ]7Xu=h(
$,]|<S
S>=\%),
s_1>/#
-s1zLv
[s4,W&
S5DMw1
s6!)-Sx
S9aJz/o
..sae18
s&ak;n
sB17!}8
 sb9j%
SBw[!:
;]SBW|"
sc[~n]
ScreenToClient
SD0VEw
S!{e5bX
SearchPathA
SelectObject
SendMessageA
SendMessageTimeoutA
SeShutdownPrivilege
SetBkColor
SetBkMode
SetClassLongA
SetClipboardData
SetCurrentDirectoryA
SetCursor
SetDlgItemTextA
SetErrorMode
SetFileAttributesA
SetFilePointer
SetFileTime
SetForegroundWindow
SetTextColor
SetTimer
SetWindowLongA
SetWindowPos
SetWindowTextA
s\'fDw
SFg6En
(SfVS\
@>&Sh6
SHAutoComplete
SHBrowseForFolderA
SHELL32.dll
ShellExecuteA
SHFileOperationA
SHFOLDER
SHGetFileInfoA
SHGetFolderPathA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHLWAPI
ShowWindow
SI8}Bj
siGt!lL)
 sJ:~C
s^-',JK
*"S-jv
(sJ>y;
s`)JYmL
SK&-]6g
s;\! KV#
#S/N>m
:SNuD3
softuV
Software\Microsoft\Windows\CurrentVersion
)SOtB>
sPkI~7GE
sP;Z2J
sq|6gnh
sq^jO9
SQSSSPW
st9'rN
St!_D;k+k
"}stsC
sUz4zD
Sv""|X
SystemParametersInfoA
S-zki#
]SZS7n
> _?=t
t0o-Q.`
(t|16o.L
}t|1R7
t53@yL
t6Jy!d:
$@t#6:uf
.T6y08
t7?g)S>
.T7Wna
{t9E,#
ta)~hVn
#T|\AQp
Tb*`[2
T?d$^;
+tERG,
tE	vYc
:tgp>_
!This program cannot be run in DOS mode.
TI^BJ`,
 TijbjpJZ!
tiN9km
tIr3Ebc
tK,9{/
)TKGJCq
TLiH?1
.'TLJ^
TLK/;\
{tnoh99
$T%/nR#
TnswvV
*t&o?.
t	;>O-4
T?oJPP
TO>rdaS$
_^[t	P
TPHA4s
:Tqsay
Tqt%5O
 \+tr,
TrackPopupMenu
T;,RY^u
TRzq=b
t'srP,
T~THg62
Tt@XL:
`?^t|W3
TY`:;6z
TzdQy+
TZFdG:
TZ#Hy)a
:u0QTmY/
-U39!r
*U[3kt
u49-,?B
u6BigQ
U7;`sgv
ua}cZ@
_~uaPm
UbBR|:
U#BtEI
u*cU{J
ue	;o2#
=U,^,F
u"@*fJt
ufK9x=
~~Ug]-
uG:&;Cz
!UGPA|
uI#g}d
UI)rQe
uIz'#v,
u-(kF&
ulC}HM*
UlG8@Y
{<uM"KUW
UM'~=Y
u+n1%F
>un^D.a'
u%NH0$
unpacking data: %d%%
uO5MEc
uOtI]t
,uOy?yr
u<'/,r
USER32.dll
uSr4:{
)<U=+t
UT/8da
uTE'P>N
U>t{Hj
[uUR\9
%u.%u%s%s
***;uuu
uVnj+&
U!;)Vu
U`vUKC
ux)BH 
/$uxE^
uX;o2`
uY> ]c
Uz8&ie
UZA>Qc
v>0)2F
V0ia~$
v,0-(o
V1":B{
V1om7>
`V-"2E
v3xB^0~t
V'5d+Pt}Z^W
v}5oWCr
'v6{>{/
V6!dz.
V 8E4+
v95LpA
v>Aa)#k
& v{b^
Vb')$79 y|
vcDJ5'
vch~/1
Vcq<`#
_VdW<w
vdXO5A
vD	>zY
vE]2$=
verifying installer: %d%%
VerQueryValueA
VERSION.dll
v\&E{`z
Vf>mRF
VFn{Kd]
Vg#EU>
Vg\u,p
#Vh;+@
vhtJ,;'
Vip^?t
v'IqF_
v[_,\J
v*%$J5e
vJ675_
vJ8efg
V@[jd8}_
v=Jkbx
v[j)Qry
(v+_Jr
v|@JVL
VknQEe
V>kO?"d
^Vlw&VK
;Vm*}A?
vmi(&2
vMm,&B
v=	+NH
[V<n;H
Vo*|ezi(
vo	HLx
'.Vp`B
V>pT>&:
vPwg,a
VP|YgR
v	#`Q2
vqaghV
VQieU*
)-?vqJ^
^V.RAD
v|rH"D
vS3=rt
_VSEUB@
v=%tUu
'vtZ04
}vW;2/
$VWF{j
v@#:wq<
V}w}VJ
@vXiX|k!
-*V|ZF
vZH(OV
\vzRV{_
"vzYGr
w05TfE
}(>w4W
w5+|,c
W-8e'ZF#
w/8 v+
w,*9<r
Wa|7})
WaitForSingleObject
w?aX#V\
@wb1-F
{Wbu$AK1U
W})<Bvd
wCM>Tz
=~*<we+."
w_eAG7
We~{x	
&#w>f2
W:F E+
Wf@rN.#7
WFviBK
~}w=g%-
w&\h/5d
"whHw~U
(whY'0
whZUSj
wih;_(
wi.-IP
,W+&<?j
	_wjlb
wk	*r*
WK>U+Gs
WL@@:+
wl2jNB
$?wLfv
wmw`_]k
W"n,^L2>;
*wNri`
w~nT E
wNxt{	~
|wocH(v
WoOM.I
&wpDG7A-
W[-pwQ
"Wq0/.
W=~qmb
WriteFile
WritePrivateProfileStringA
)Wr'k@
wR:UNd
WrW/:[
wsprintfA
wSY'Y`y
wtpv26
"Wu]<:
|W@ub-
ww7@y13
wW~P3/5
w"wTy?
wwwwww
wwwwwwp
wwwwwww
wwwwwwww
wwwwwwwww
wwwwwwwwwwp
wwwwwwwwwwww
wwwwwwwwwwwwww
wwwwwwx
wwwwwxp
wwwxxw
w%.x@c
WY.6rk
_/WY)Z
Wz%KYF
`WZ;pJ
X&;`~^
	X0sKg
X1_q6h 
_]x1%z
')x>*30C
x/38<u
x3<CHM
X$+44}
x,64i/
! X8/(aM%>j
Xa{1(^b
xAdZ63[
^X;,b#
xb3NIP
xbo8Zn7|
	_|?Xc
XcCHqz
xcE@I`
xcH68*
%[xcq{Y9
\xCs|0
);xDfJcd|2
(x?Df%tD
xE!}%'
xE[@[aY
>x(E}ej
x>>EY,0
xE|:z"
@XFIw254n
x$#~gwS
x>hXy<JY
?XiJ%kN
xir%;	=
$.XjKC\9{
Xjta&3
Xk<q\IP
x=Ksoh
{$x('(Lh7
Xlkcq~%
x@>l;u
xMC&|7
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>
|?)#Xn}
XnB^Vc%
xnI90E
xN|s/W
X[& \O
XodvAP
Xo\P\@
x.PKav.'2
xpR\oBye
~(Xqmk
XqMn0l
]}x >R
XrIEn<M
x`?RY5
Xs<F\]Lkv
x @^UG
/~-XUNS9
x=u}.W
xv3B(>
>XVG0l
*X~xD#K
&_x:xm
Y/||~<
'Y0R})
Y0X[Lf
,y2[$b
y}2sH*
Y4G{W,
y4ukjS
Y	6.$F
Y;6gaLy
y6k/hU
y8o]LF
^%YAcZ
yak!#Y
@:yaW"(
y;c8/b'#b=
Y\c[bQ
yChx[:
y}C];Y5sw
$YD *(
ye9q`|
yEBPkJ9
;yEz"|wt
Yg|b_BJ
YGgLS@
\/y@H}4
Y@I7Y0	
_yJgd;
y|kJW/
yKm2bv/Q
	ylQj\
[ <ym?
yn"5y}]
Y;N%Q2
#"Y[pA
YpXgaz
Y*R.< 
*#yS-\
^[YS	'-D4
y(S@H(/r
yt\3[#zTM
y%t=&b
Y}tPX&
 {YT)Th
yu{*}A
Y*VUFH
Y@w"DH
Ywp\h)
y]X'kL
'.>z>_~
^,'Z( `
==|Z @	
Z2[E\'
Z(38VA
Z=5aRM
.Z5wI/~l
Z6$OS:
Z8(Ff'7
*)^z9-8
Z9;~I 
z9=p17
Z9xA8]%
ZA3^0<
ZAivW|G
ZBGS^$v
ZbuZtM
z(c]!)
Z$@c8g
ZCGe+(171
zCk"f0
-zCP%W4
zCT_Z).>
ZDbz9n
Z'DMhb
zeol?K
/ZfB@Y
ZgCLrK[;
zIA[(kP
ZIDRr5
:,]"zJ
zj>_ t
ZJT6R#g
Z!k53v
Zk-pCDF
,Zl|#b
_z_(M*
\Z#MaX
zm^Rde$v
	Z^MT/
z"n+]$
Z{Ng c
.,zN>gZ
	|zo)/
Z o4~<
|Zo6k\
Zoo4|{
ZpN$$6
'zppb]/TW
zpSUO)t
zqf~)m
;zqHA=4
`Zr4h0&*
Z'SLD	i
zsUN+s
;Z`T*g
Z=t:?Nx
ZuVaK>
<zuVn%
!ZvGW@
z[vPAe
{Zw@/&
||%.ZW
ZWdhz5N
zw#j,+
z^.x1c
~ ZX3>
Z\xA]VP6
'& ^zY
':{ZY%
ZY:!OJ
|]z{z,