Analysis Date2014-12-23 08:20:12
MD5987020df753033f3afb7f49375349d8a
SHA14f22783215b6ab49702ee2153867dda9eb845d6f

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
AV360 SafeTrojan.Encpk.Gen.4
AVAd-AwareTrojan.Encpk.Gen.4
AVAlwil (avast)Blackbeard-AH [Cryp]
AVArcabit (arcavir)Trojan.Encpk.Gen.4
AVAuthentiumno_virus
AVAvira (antivir)no_virus
AVBullGuardTrojan.Encpk.Gen.4
AVCA (E-Trust Ino)no_virus
AVCAT (quickheal)no_virus
AVClamAVno_virus
AVDr. WebTrojan.PWS.Siggen1.13909
AVEmsisoftTrojan.Encpk.Gen.4
AVEset (nod32)Win32/Injector.ASZG
AVFortinetW32/Injector.ATCM!tr
AVFrisk (f-prot)no_virus
AVF-SecureTrojan.Encpk.Gen.4
AVGrisoft (avg)PSW.Generic12.QTK
AVIkarusTrojan-PWS.Win32.Tepfer
AVK7Trojan ( 004910d41 )
AVKasperskyTrojan-PSW.Win32.Tepfer.srjr
AVMalwareBytesTrojan.Crypt.NKN
AVMcafeePWS-Zbot.gen.oj
AVMicrosoft Security EssentialsVirTool:Win32/VBInject.gen!LD
AVMicroWorld (escan)Trojan.Encpk.Gen.4
AVRisingno_virus
AVSophosTroj/Agent-ADBJ
AVSymantecInfostealer
AVTrend Microno_virus
AVVirusBlokAda (vba32)TrojanPSW.Tepfer

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Network Details:


Raw Pcap

Strings

<'$$
040904B0
2V?6b
@@"4
5.00.0454
8E&6
*\AD:\fzfzefzef894984\REeB.vbp
?)'cf
CompanyName
dd/MM/yyyy
Dino1
Dino1.exe
DJ5dYca
e651A8940-87C5-11d1-8BE3-0000F8754DA1
!E<9b
EBbymEhUEWa
FileVersion
FlluPT
frdehtjykuh
gtfrdeszde
H3MX
hxBHM
InternalName
LZD7CHny
mxHXRk
Ok5QGkzejk
OriginalFilename
P7YA
ProductName
ProductVersion
q7SZ5uoLai
rA133F000-CCB0-11d0-A316-00AA00688B10
StringFileInfo
sx^I|j
Translation
$U;2'N*$9_8-5[
VarFileInfo
VS_VERSION_INFO
'W84-u$4-},5-r
`~;#<~*
|||____
004dL~
*0^+0[h"
( 0>0Y<
03C;^'+
04}Fep
04Uh_xk
0#Cp74
0[c-ToT
0czL~y|
0e^sow
.(+:0f.
0FCBIF
}0fn/S
0inQb7
0=iR':
0(i'UV
0=?j!4c
0\p4c,_
-0;p]D
:0RaRZ
:-0r~b
0rb3a'
0>$/u=
0Wa]XJ
-&0wyX3k;pv
0x8>)g|
[0xyYead
0zFc_C
^&>1'<
/=1\#%
}<[1:>
	10F@d
14*A_-
=!14AF
16AAHn
?1"6G:Hx
1'6iV]j8b
17n+W:
18	&a$
1`9@"c2
1C Q8E
1}dRx!
%1Fa('
1'.	G?C
1g%~?y7?
1(IN>R
1}*iWU
1jOx:UV
1jRzV&
$|1jy55
@1,JYZ#
1/l!& 
1L9E$~
*1mZw}
1nh.0-
1n<@TS?=
1 o5ZEj
1[p2XD;
\1q79V
1.QLlfi
+1]r0[
[1SsJE
1^)S$Y
1%v'E.
1xgQc 
1?xTo^
1YmwJi
1[YmXm&
1zJLah
1"ZP3aO
	!*?2|@
2.+%+[
'2.0rV
22otSqr
2[3bc-
246dl>nx
24FRZ]
2~4J^A
24[r-I
2899:IJtw
2euC}|
#.2FJv
2}GPoa
]2Iu1J
2<l!,S
?<^2mx]
=2(n1I
2nz'0U
2?/]P]
-2QvB#
2R+'^f
<2s/R\
2>{=TB
2tQkfP
/?	2=u
2=UcU/
>2w.5P[2qP
2Wk	uP
2[$x1x#h
2x,on&|]z
2y.|r\F
2Zg&<v
33m848
3:5("	
	35eJe
}37tU^
/38J]c5
3"{8Y_
	3;(#aj
(3bTD-
3>Bz#/t
3="e(6
3EDG.}
3.|eZC
3^+Fb}p
3GHI`h
3GV8aj
	3he[p!,
@3h]	RT
3I6/:@?
3iK"=AU
]>" *3j
3JvV J
3K?m<B
 3L;^B8
3* l^L
3l`vFm
\3m`~|
,3mA's
]3n0o\)Y
%3^PMl
3sN@`#.#
%	3S'Vtj5|
-3x~x9
3Yec>xZ
3Y* HFb0
3Y%Ynl
41(=NPz
42{d3o>6 Nn(
42W8f&
_4=+~5
4?"6Vv
:[473F
49>a"G
<49)'h
4[9ta%,
4A1	zQ
\4.Adn
4B]pnN
4C^i30:
]4E9km
4?Eyp'{Z
/(4fnq
4F@Wx`c-
4H[7(`
4)H.Y8Pu
4int'q
4kkxG/]
4](#mIu
/4mJ|q
]4MnMbL
4pm)1Z%
4+PW,A
4qga3e
4*)=qo
=4,R9*
4r>Iha!
4t%anL
(4 V8@
4[;VVT9
4WW,z+
4`x#Aj("0
4Z1,(1"
/4zeXV2&
4(zFbk6
4zrmce6~
=?57g2d=
5@"97Mc
	5"AAw>cr
}@5 }BB
5caDSl
5_G2]-P
=5H4[a$dN
5|Ke+xG
5!lrcE
[5nXJc
5o(3D\
5OlHBM
5p_G~lc
5QrY/zl
5Rwfrp
/5S51b
:5s}%eW
5sjzti
-5"v;t
5WNL3R
	5(WwF
5{wWvip
5	X}MY
5*+xsX
5*XuXRo
5` Y(O
5zh_\|
}5Zp|'
5<-ZuD
62lZu<
62>U\[
)634&b
.63gtvi3
63^	"L
659'kq
}<\"66v,
67oOo[
.(68)|
68|[Kl
*6Av+22O
6B.k-X
6bRB$:
6"&c]EaMh
"!6c@I
6>D`\/L
,6E1Of
6ebpv-
&6eF-I]jH
6Jyx^h
6M@ads
6\m?Gr
6*n=$K
6oByxqN
6@P`	*
6tBL6.6-
*6[trp}
>6UQ#j`p
6Us|q?T?/
=6@vzz
 6WhSJ
6w)\yIR
'~/6X_c
6	xR]#(
72Z-+P
7}4KA7
75pp>/
7614!F
76W]b?*
7(A+Gxl
)7\E>]6
7%|E-m
'\(7g*7+Q
7gMMG+
7!G]]O
7Gztq7
7IV&[,
7iW (Z
7lecV2~O
7nFUdX
;7QtGm
7* qWU
7r\< m\
7R}&-P
7;_R#S
7S1TPPFy
=>/7T;
$7t :FP
7V|edY
7V+@VC
7X%d8i
<7xV|p
]7x= W
,7Yuj&
7]zDGXy1
"?<;8"
8[1lGn(
";81q 
{,}8/2m(
&84:W4
8~#6&*
885HeCc
$8<8lB
895mxt
8A	.{4
8-!a]x
8d?6(5$!*
{8e6mk
8f#64#|
/8F~~Z
8GiaTc
8H~Ob3E
8IO4dU:
8$ JRD>
8"Jr|u'&
8KDNzM
<8k)\f?
}"8KtF
8N:5(	
*8N)Qu
8o~`]<
*8o;do
8r)`?MiYf
8rz a}
<_;?8T=
8`](#T
8ufMSb
`.8W:n
8-[Y^;
8/Yn[U
'8~?z44
)[^);9
%"90$T
90v8Vz
92x&n_{
|9|54GQ
_9~5]R
:9;6{3
9'6_U?
	9B>b^
9<c,9w
9EP_u5c
9f>TU?
9;GS*J
?`9-Hb
9>%h?_WW
9iCc;QK
:"+9j)
}9[J~QG
9]L*}|
`\9l+}9
9M-%+'xog
9N<k)?
/9Or1U
9PV_J=e
9Ry9xk
9SN:5	
;9;sxl
9`:=@Tt
 9;vLd
=9w-D6
9>,y<]
=_A^'{
A0fH) 
a0s3@}
a1{(79
A2N1(k
"^A3/Q
]A\53S
A<5b,5
a5eA;;
*a5{Ze_U
A63pWa
a6y{'qSp
a-+7S:
a8,tzm
A9PzW?d
AAZXhWAY
a<b+?N
 A"#;c
aCOQb?U^
aD\D/+
ad"Ie6
a=})dK+
	adQZ|
%^adX6
#<A}E#4x
Aep\bL
a{fy%P
>a"g)3
:}aGmu
Agu=Xk
Ah3917
AH')+6
A='h'AHJ
]	AHapz``
A{H_fDv60@QX<
A!IboF
a=iE[5
=!Ajg7
A@j|L`	
AksYt;
A]lH|lm:T
ALn_X,
A` l!RpAdJ
>A M"Cx
~amx21
A".^/N
aO%2M[
ao*BN6
AQ?Q2D
a,QT$o
aQy({n<,2 
AR{5{(
}{&a;rc
,a(R%heT*
*+'ART
A*#{r!z
a"%S%E
a~sR)1
AS^V[W
#%a'{t
*-/At-^)
aT4k_*W
auuYed
AvNNeN4
av\sa(
a~XBSH
`Ay3NG
A+Ya,N
AY  qrB
(aZb}1J?a
AZ'|^C
:[Azdt
a;zE	O
aZog ")/&
AZQ+([
|`.	b}
b#%_}:
B0v<-e6Z
/B1+PA
@b2  l
B4WN[d
!B![.5
|B6]S$p{
}!b7"J	
>@B`?8i%(
;baNn{
bB7z.~
bbME\0
bbnB48
<b$C@g
b#Cy` sl
B+d7nV
BdV=JP$	
}\bEd[
BED|u\
BEe4^K.
Beul+[d
{BE+v_
BF6QbH
^!BGgRsi
bgNQ!l=
BgOmY6r
b|g+P8
b\iRFS
$bk`8\
b]K+k#
BKva x
>?+BkWVZH
@BLEkJ
*B%&LK:m]
bLw]b'
Bl}Z}B
[bM8c7H
bMC;Gx
/bmE"hp
(B]MwfsB6
bmz@L^
BN8n&r
b'N@b4
BoundText
&boV>9R
box-7J
bpZE^*E~
BQB+8uJ
B/Q^iv
Bq`k@p
BQZlig
brr$O<
{Bs+A=
b_t^9W
#^bTgt
Bt$h*&
btIwt`H
bus)]X
?)BVf[P
[Bwm-ycwg
bW!U/lSd
`,B,=x
B #\X2
bX5kMy
_bXTZC
bXz;_y
|'B(y|
bYWTTPLI<<Ic
bzE$<?
bz&jYy
bZQ*R.N
!{	bzS
"	c03	
c076tP
/c1Cx1$
 c+1Pl
c&29uSU\k
c6g=1Vz
C7I1$ 
C8lE(<
C90~]`zSV
C"axHT
 C'B+.
-cc(dsR
c[cM@c
ccS|k*A
c-D1^Y
-[CDb;f\Q
*>Ce|/
C	'e!e
]Cenm8
Ce*V2E
*^CEVp
C:F=\aMW
-\C[ft
.C%f/x
c g}1G
`C-*gH9
cg~q[v
cg[@V.
+cg(~Y
c\HX543QO
!CiUuk
C>J=m@
C	?K<eS
c(+?kiy
|CKkXO
CKQ[c@
ckYUXbO
C!l9t+n
CloseHandle
cMQXV-
Cn\{$4V
C-Nr$L
~&c+NV&
?c=pb?mBFPj 
C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
C:\Program Files (x86)\Microsoft Visual Studio\VB98\vbc22608.oca
CPy	|[
C%qy-~!=L|
CreateFileW
Crr]3V;
C'r)Yk
c$t(;a"
C$Tw{X
CtxtParentDate
CtZ5=<
c'UFSJ=
~cvd#GA
^CVG6Z~
C_VI1a+/?T
[C:WD(	'-/
	-cWfH
c;w"HU0
	C~wwu
cX8d 1
}c)x9F(
c`.Xn_
CY;(8>EF
_	_cZ}
C%z1-c
cz1{@e
C[#>z@$bB
c^.z_i
cZ,lR+i^
,***]D
$!'~D'
+('\D_
d%06o#'
~d0774
|d	1)H
d1"!.y/J
D*3@\C2
+?d3f"N"
d7	:fj
D7fQD=
d7U+8 
d99X=%T
&D(9J[
D9R!0T
D[a:Oa
<*DaPFd
d-~a"R
`.data
DataCombo
DataCombo1
~DataCombo1
DataList
DataList1
<'d)'b0
 Db4$j
dbf">u
=DBYs}?Ob
Dc2QfA
>]^ddc
DdGdXz0
dDs?;[AF
defrgthyf
DefWindowProcA
dexMK\
~d,F/s
DFXzm 
d}#\gH]
DhxvdF
dI(7$:\
Dj&5O%
':`dk/|
DllFunctionCall
dlNkx183i
@'dm=GJ
d|	"N`
D_>(]n
D}OA1_
d.P>*'
>dq-&#7
{dQC<03H
dqP8Ok?
d)r'<]
`D	r&c
DR,W1q
ds5,j#
^}DTA,^h
DTPicker
:DtV9gH
DTXUso?!
&-{d~TZ`i4
DUP{OU
d;v@0f
dvFA+h=
DvvlAq
D.YE^'
d+y ?f
dYwzu"-M
Dy!x6fe
>	E~$"
e1	%dU<T
E4MDHT
E52%r(
`?E5g{ZU
e5vJ+a,
)E6ptP
-E[80=
~`'E8n
\ea8zx
eahLE2
@%Eam:d
EaZr}AkE'
/E@$c$
EcB6i``
E	CC\g
<Ec~wsx
Edytg:
 e|e=B3Q
EEBAp9
EECQ!6z
EE's5.4
EFY_%T
eH'x0>
eJbW!h
E/=j$C
?ej?NOI
EJ;o/"t#f0
EmLMuI^
emni4t
EM'_o?
Emx:^D
"-e+nx
Eo8=,#
eot[xsU
E \r`7
ErD_q_z
e/_RiHuh"
e(R~M>
e=-rr7^
$ErUj=
&]e=s~
*\ET:<
ETGn&P>4Z#
=ETQ,r
e@TYEX
EuY	}*
EVENT_SINK_AddRef
EVENT_SINK_QueryInterface
EVENT_SINK_Release
$E"Vm!L
eV&{N%Q
,E.Vp3
e>~V^R
ev|-RZ
\EW+B`|
eYR?cP
E<ZF_u
;=ezH+`6$
@Ezk2Oo
ez['*v%
f0:J{1
f0Z2J7
.f13'n
F1Bid6
f1y_MfA
!F3-(4f
f3pOL$b
F4#~j5
<f5D:Ro0
*F5)MXv"F
{ f6`i{#
>F6T%.-y
#f7g\2
f7I-Ca
f{7.Yb
F]AUW~
f!B6E.
+F<bbf
`fBF_@`
fb<>G7h
f#bo5%
 ^]fc?
#\fC6`&0
fcopd3Q3cj
fD4Mg"
f-D$|a8
FdCK^{
f DG.$a
fDUPdQ1Q
].\F:E-*
$Fe4mS
!~fE]M
F\F2_J`
 fFc]<[
fF=J\ok
fgc"%>
\	f'GYY
f%IPly
#F&j|~
FJdJ9J
FKF2+v
f(KNmx
FLA4VS
?F@l!h
f+L/JS8}
F$L!MI
flX S[
F&m_@n
fNc`$QR
#f[[(p
Fp_ESrN
FPQJ<_
&fp~TI
F>q&c<
F@QTX	
f`r3#c
Frame1
FreeLibrary
FtGQuM
f(TH+>
.@fuA^
=fu(e@
 FUo&}n
fV	`PE(e,
F}wv[G;
fx&FStr
Fy3;zXq
F{Y;>l 
fZ_:<2
=Fz5F4
FzgLbyj
fZjTz 
Fz>nu/
f)%Zz!
\]g\'?
%+$~?G
G_*&|>
G1"<F(
g1Nr=n
G]$2d>
g(2j ~5
?g2SW;
G2^YrI
^g391L
G@3EP!X=7
G3^{EU
g_]4i@
g@(5*h
$g*5:LWB
g()?_6F?S4
G8%cM7N>)
G8?uH' 
GaPV(IP)
/GB*E:f
GcEw3m"		
g*e!'	!N\
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
GF<c:F
gF-DsL
GfQU@~
G^FVIu"
.g$?g1U
?gGXQm
G$h3v|
gIKBhN
%%Gj41
 ?Gj83
Gj)|rD
g_>`JX
GJykH0
gK~`N`
gkSPD,
G~l.+1
gL7mzQ
?g&;Ll
GLMS*m
gLOX*x
gm0rj:
g@N:U\
	G][%o
#@.go2ix
!GPI]t
gQn.}y
|gQY/L
*G<`rk
G*RqyLw
GR>-V(
gS5Gav
]GS'#[8\
$~g%SY
G_TaZvj
gT</"J
G%u,N~
Gv^|~(
g#vAgW
)Gvb0"Zq)
GVgK<=
gvh"jEH
GVK	>S
GVUKX<
G,w?5aw
*gxi]y0<
G]!x|s)
G=x|Sy
gXVN>L
gY;l,^,
G+["yq
g#z*Nd4
h`<{]"
.H_07yg
{H0U9h1
h"'1/j
H1o>w#
`h3bs|
H4h06Ck4
H50>7-
H	?6WY
h)!_7%J	
h7upjeX	Arp
)h9B0Q
h;~9E_+
?h9<r^
H%aeVH
Hbxqy&w
-h;c2J
HCdk(oK
hCksl2
HcS9SG
|h.d^S
+h=E5'
hefA}R
HFBF!{
hf][|x
hg9	kk`~
hG[Wlx
hh#-D~
|||_hhh
HI[YHG
.]HjFE
h$jv:tY_
:	*hk!
HKq&?o
H'krCA^
~	H=l@
hL6fPt
H.L	A.
h[!L@<[Cb
.hl:W[D
=HM}&"I
hm{wV<:#
hmZ,@(
	HOa9}
H(&(P 
:Hp3}#
$-/Hpd
h'pIzT
HPVBUf
`+ -H)q
hq\H.v
HQV&P=
[hV'Xm&
Hw3}9)
	hW}o!
hW{_Wy
Hw}za:
}] HX*
"^@hxL
hxLbax
HX$U}{
HY0igr
hygtfr
}hYn*A
h&"z4e
Hz}I>z
hzJ0%7b
HZK`S*s
 "^]i\
]I"1n{
I1y*s^
I4^C;D-
i6i_He
i8aredPG
I^a)BH
I&Azybo
:`IB*.c^
iC_gt,ks
icIpi{ 
Ic	lq8o4
Ie>2S3
Iek4}xQ
i\F	,x
I:gb8v
IG+/KK
IH7Ezh&*
IhDpHl
|iHjl'
/I)hW}
iIA5$0=
Ii?s@F@
iI}Un6'
Ii{Yw<(O
Ij:evw
I}jQ3c
ij)w-d
+"_iK]
i K2RB@
IK6e9aa\?E
.IK>,A|
ikTKil
ImOq8Vf0
\i+^N=
iN(5PZ
I|n@5"Q
I$n7OI
in(y%&
I, & O
io1Y:+
Iod*L3
Io-Vi/
iow'N.
ip4%,P
\I%P*K2
	IQ2%=
@	iQ{8
iQeO=5Q
>iqlm-%
Ir>4HU
;,IRNYy
i|r%Z:
is@-9k
/I}<SA
IT?N%B
I)TxfS`
it%zqa
-^I?U)
i=_u5t
*[I$uF
iUn>t&
i!{V5x&
;IVlT.
IVo@|^`!
Ivz&wr
IWqn.n
iX9khC
=[I	Xb
 I,y]u
iYzzfFB
iz19b=
i;zrDGa
I=z ^/>Z95bLK
 @&<	J
J &&? 
J16L`}}
j2V!U6
+j3j	"]
j4-`&%tv=
j72|<"
^J7o8"t 
j8gO2j
JBI8>a
JbkG&@
jC@0gb
jc1B ^
j<C`2??;
jc~6	/
`Jc=Any
jD[6Zp)o
j?EA!J
>Jeo+O
	j,`|f
;Jf_nw.
-jf:Zp
j^/HA>
!jH$l*
J.H	m*
jhNpP|
!Jh&q6F6p
ji0+!XG-G
jJ42j%f;
(JJ%Pxri
:^jjz3
`jk;yR
JlVA_S
'/jmEd
{#%Jn<
jNE5TS
?J{N\.n
=!j@o!*
. J$o\
jp,e{#f
/J/&pP
J!q]}1
JqB'gr
j}`>r%l
JSg|.%
J[S&_j#i
^jT]V{
j-)U\\
	JuD-=/%Sl
jU/lP2
'jUNc_
J/u{Zg
jV qP6
j#vSGLk
&j.w`/(e
Jw,MKuFR
JWsCj.g
jX=%*S
J'y!d;
)JYeR9
j_(+z=
jZ&b0C
"jZiev
jz [J=
>?@)}k
[&]-	k
K1gUjA
k2~JH:
K4}w#I
$K%5k0
k+5Rx|p
K6hdah
K7NIyy
<.K9p4
k9;R,|
K<A0qmpiH
k:A4D6
k=a&Q@S
]KaW8R
^KB^}&
kB+Kucg
{kd<Eb
kDm%Td
kernel32
kernEl32
kernel32.dll
kernEl32.DLL
;+K-ezir	
K"}FK[_@
)	k_GB
kgE:Oz
KH]'n^HB
KhP95x
!KhV3e
K%Hw.fF
#	k%I-6
"*k.i=7
k#I*k;5
kJEygE
KjL_#=
>KJP;N$
kjUBiE
[kK<3_
K>@k6j{
k}K9]e
kKK|^*
]]]?KKK?KKK?[qu?v
K)KpQ*
k(ku]G
kK~vD(
k+	kZ'}
KL2v0=vf
kMcq3,H
kMlakRf
>kM)Q8~M
kM\<umT
KnP9??
)KNQ{D
koIh6|P
kq'L	b
(%K@RXf
KT@dx+v
kupZ_.
kv;_8A
@Kvb3qF
KvCd}?
Kvn^*}2
KW0M5M
kX@J! 
k.xP^g
KY+ldifD
kYqx84
.K;\.Z
kz@1JQ
K`zC`O
!,%\l=
?/,l0G?
L0s'kX
 L%=1"
L10u~K
l-1.o6
l249hr6
L2a[Tc
l-2*si
L^2Z`E+
&L;5wzt7
^L<.5Z
L <74O
l7d6HP
l"7iTT
L8X_xq
=l?91Jvz
l9Wrys
~lA6Ws
!l'=ax(L
 L,b%g
L.*Df%
{LE'KD
:l}:F&
\LF9howT
L{	F[D7G_
L+F`G7
lfHVPx
l%gBl(<
l;gebYW
lgFc#F
LGf)QI
`LGVQ/
Lh<?by
l.HEEe
lHltT3
LhwH{3\
~LHZut
ljaoja
Ljry[,.
!&LKBm
lK(twb&
l>$*LD
lLGEg2
:.`,Lm(#
l:MBFGh
l>MdNBs6Wu5H
>l'mHP
lmopkiljuhnbh
lmopkiljuhnbh298984489489162165484gglmopkiljuhnbh
[>?]LN
	l.NeOkc
lN-RxP}A
+L^O&|
LoadLibraryW
lolololp
%=	L$'pU
L|P <W
^l}}%Q
lr%[\"
lR6k%@
"lr*zskh
L@Swr}
ls:%'Yt
>L)$}t
=?;\}LT-:
lt)7"=
l&tnbF
@^LU'9
#>lUD6$l1K
&LU	iDi
LUzm-N
.lVVsW
>L'.wE4F
lxT	v9
	L!y/`
ly0d01
LZc,4tTX
/~;M|	
^M0;;-
m|$@00
m=2XVSFn
M5 i#J	h-
m7[-sg
<`m84AI
M'8]Y#
M9+l"D
$Mb#P[
~<m>C*
M`#|C:
M-cead	kP
m~CLFl[*
.<md:>
mE4Kd1
M($E/c!p
mEh)O9
Me Npb
/M'_EX
MF_ciri
@@mg{?,
MG>jJ*.
MG#kZz
M~-gl#
mhD;7l2
mhHb:A
MhJms%3
M,IcUY`
Min-H(
M:IO0I
m J!de/
MjJ#cDU
? %~mK
&M!ki|{
{MlFH/,j)
"MM|${
@;"MM3
/>mm$7
+Mm9x zm
Mn_cpZ
;m!O} 
{<@m@O
mO)c9R
M~ORQFT
m[`-P$
}+Mp{9
mpAAYb
+=mPOY
M<Q;j!
)MqX5N3C
[mRfcc
MRN#_X%
MSCOMCT2.OCX
MSComCtl2
MSComCtl2.DTPicker
MSDataListLib
MSDataListLib.DataCombo
MSDataListLib.DataList
MSDATLST.OCX
MSVBVM60.DLL
\m+'T>
M.;!T}2
~ MT99
MteqnD~@/
MUbsqc
-muc6L>
m&Uh.s
mv?CT@L
mVTN1K
mVW."c
mw*6d{
:_Mw8o
;MXhE-TWe<G
mx>O]4
mYjiG|
myjM;LN
<m*YMJ
~")="n
N1o|HwA
n<`2NTF
n3S%R>
;N4<akd*
*N4&Q5p9Gr
N54<>08D
,!N5`/f
%n#6ey
n"7jtdW
N"AAR/
nA.cO}
Nawh<O
N+ce}n
nd#]!}
Nd7`\<o
NED+v;z
NeJF	4r
(/,Nf)
N=]-F`
N\f'G%
nFwzOm
?%ng[5
!Ng)Gi
nh^cSD
{N!|Hh
N|$H~p
N(}Iwf6
N}|=j~7
NJ7S"O
nkoddQ
~$:nKs
N\l]\!
Nl`7+1M
NL<%AI
nLn3lV
_nL#Q*Y
N^[lSF#
[Nl|SYM
N#MRG6-
nMz^H=:
nN4":b
Nn5JBlw
+n},Oh
_\n(Pa
NpH~~LK
'?NP^,Zlr>
NR0*li
n?R,#\C<=X
NRYOw7
&ns#HW`
n^s[>~t
ntYiK&
n #'U7h
"n)uf^$
*#N):v0
NV	e}@
]Nvuf%
N]X,Ou5
nYI?4j
~nYUr?
nZ:;91W"}
Nzjeak0E
NZKDQ 
Nzp|E3%
@]o0:@
{&O0L9
O-0sO7Mi]
 O^;/ 1
o1xXg8
O28d]#o\
~O4`OM
o4}O~W`&
-oa7![
-o~a	z
!O'B=1]
#O.bzc
'Od<+K
*OdmCeaX
O@DoS9
.oDSi	
-O]d	Y
O'$eiu
\O?Fs4
Og9:St
\&OgaK1x=9-
oGE="+
/@OGfF=
o%gr=2
$O.hJO
OiOf`%
-+ !~oiyy
OjC~tVL
O]kGcm
Okn&_S
Ol;-4?^
ol97[3
]^O%LK
 /}om'
OMaO5/(
O@-:+noD
#OnosB
|OnThf
o"n>U~<
,:Oo}B
Oo!p2zO
O=p5:L>
OpenProcess
O~pKI]
opt6FN
Oqjiw^y
o$Ql\^
O*Ql#s@
O'%+rGD
	o&RO(
o|?RQE
oSC+,G
{oSm{qS
OT_(/_
;=o{tP
 O&u#	
%OU9f[
Ou$e9-mz3
o$U(I{
o}v[q	
Ox(*_x
oYWat.
oZ)mOw
,")p(_
+`@p?0	
P^0mmNC
p0T(is
p1-dj4(
&P1UXl
P/?1vN
p2#7/9PW
P2cUH `N 
}p2,g'
p5b%\%
p7L]U)
p,8Ej%
p98Bp<3
&P9n	$>	P@"
Pa$-<`
pB8]i1
P:bH@k#
='p^c:
pcM}^9
pd|bKl
#P?dM)
pe8QNa
peGT}a9
PEL9ll$
P;FQxB
?p>FrC
pg5Ez]
pGidhU
PGPE1a
p;H?{A
p]!.@i:
pi.{Z_
Pk0rH/
>&pK-h
~,pL2)
)pn]5i7
p-nc#L
PnL014c
>P$Nz.
PQC&9f
@'p)R,
ProcCallEngine
Process32First
Process32Next
PropertyPage
PropertyPage1
pr`UmmXk
PRy0BM
P"Ssn]
PT2 \g~
 )ptdd
Pt[hyY
pUe|]h{2
P%um0(	
p'WK1aH
PXkc\j8h.
px,^m`
P!-X>]P"
pXXNkVR
&P<?Y_
py)eg_
?py/FqG
p{]y:P
'py.w:B
:py#wI^]
:({P.z6
pz;+-X
"_}\q~
Q0B$;zS
Q1Om!62
Q3"~f?
$Q,3SdA
q3SV |e7
Q4p9:x4
q4?(T{
Q7'F[e
q'7TYM
q8L3j49
Q9TU7w1
QAD),{Yu
,Qb0hrE!_
qbhs@J
QBtw(t
qcopqh
qC:\Program Files (x86)\Microsoft Visual Studio\VB98\vbc30554.oca
]Qc<w%
Q_|@`cW!
q(;C;z
$({q|d
q$]DBt
Q?]E1W
QE5c3.
#Q&EPR
Q|f\pa@
Q)Frr=
%Qfw^	n
!QfXvJ
#QG1I0C
qgJeAPxo
*qg`,s
q>hAWE
qhp.gY
Qi,"[5Q
qI{ r+
q$J]I(
Qj(oP@
ql~QpB
ql~sVA
&q/mh=BP
qMQU)_
+Q)m{u
QN/UY*
Q~O3-a
&qp|@+
Q$p:'O
q]PSb&k
-'QR@;
Qr(,bd
QRsHeQ
Qs&4_<
qSp67k
(QS['w[
Q!'SX_
qT<;+4`
}^Q~taW
|qTcQbL
Q)TIQ$+"
q?t?J,u
 qU[FzA
Qukhg/e
quLm/vH
qU:P8f
qvhu_:
-Qvipz
*qVrV	
Q*|w*a
qx8R[T
`qY(BG
Q[yqHj
`QYZ7/
q[}#z`b
-:-R_;
?R3!U&
R6 )u}
R6V@#Q
-R)bK?
RCl`@}U\
]Rd)/DO	
r!.d+M2
'&	rE]
R#e5Zc
ReadFile
r_ENQzr
RFE;eI
#R&	+g3
rG%$A!
RGh=qg
[rGO})
r[>?HP
$.R|hxu
Ri=)|q
r|i/:z
}\RJ+z
r/k!`H
:RKH<0.
>rKVci
"{rLRWmt
[rm/|7`Uc6
Rm"qk$
r^N.;+
[rnjQ$
R-nViiM
Roh7#^
;rOspc
RowMember
RowSource
/r+rSrN
rr{vi-
R*SCzN
R T&\_=
RtlMoveMemory
RtlUV>
ru,Q8q
ru$s06a
 :| rUu%x
RuyTiV
r\,>vDD
r|&\w/
RW1@QG
)rW2J5
r[W)c)
r!!w/ET1
/RWfCl
Rwo#O	
&\rw@X
rXLdP'
 \R@`Z
r ~>ZDm
rZh,bjH
=#,!s@-;
S=/(~|
s/-0-/
S1c4q=V
s/1yJ*
s22O>+
S2f?:l
%s%2'&Z
S3v+lw
$S4yF#
+S7A'j
S;_-7As~)
S-7l&ET
\"S7'V
|S9`<kf2o*
%S#!ah
sb(i&d
s@BnhX:
S|!BO/
s}C8s<
S#=CAE
s+*cC^7?Z
/[@s]d`
_~s'D%
/S${d*iF'
%SdW{$
}s%F-3
-+ s`f`-N
sFQTRn
sF\:#V
>SG/I`
{~=sGX
S;*.GY
Shm3i~
Sh~Qah5
#sH/ZI
s/I%*46
S<,K[.
skCCrw
S%%l\+
s"L@<h6u
slznUge
~S;^N=
Sn\Lg]
Sp1{<8
spgVzA
SP<=z/
=+s,Qa
SrEo=7
Sr:lj|
>sRU(u6J
{ss0dY!
sS1_	 
SSF<V-N
st,n9'
^Su4%W
sUv,a";
-sU[Z&
#>s+`v
sw9:Vi
sXaUhQ
]SXCk(0
S!x[*yJ@
s*#YF3
SystemParametersInfoA
sz68*?
SZ}f#,
t0	w@o
 t1n<J=
{t1UH+
\/T40}
t4`[xM
_T5;|[
T.52`Vu
?T54K]
T5$)H7
<t5^s-
t++6!y
T|~_8Tz
T8>u.F
t<.}9jT
;T9}Xd`
T!9yDB25(
T(AX!C
tbbswyseihalel
tB\f8HN
^tBl;e}
T@>cT%
}.T,dk
t{}d}O
td\zS`$
teA$Q<
t,e^Dg
;tEIMT
TerminateProcess
'tEZQf
t\FBDWji
t`F#t~
tG4n}/
=tg.hy
%,T	H$
TH]8gS!#
t#\Hgq
!This program cannot be run in DOS mode.
ti<E50
T]I[O9Q
tiUfegp\
:TJN@!A%Qt
tj$u#71o
TM:}(a
T`M:ht
|TmZ!6
;%+T)N
T_nc[9h(
TNSFbU
[*>%~To$
t;pC:d
TqJ3iO~
Tr<n*~F
T)SVO`!
t-T3df
`tT*P&
{tu)3XL
TVhG$8%^
"`tVL/
[]TvM4G
>Tw"PBf
t;XtB/
txtParentDate
`TyMwa
,,&	u^#
(#'^u=
`U1}&X
U23SA; 0
# u2Yi
<#U38um
U4-/uY#
u5,$A*N
{U5d_B
U5<F^|c
U6;^h5r
U71|UBU
|u8A!~
U9K3U3O
{u&a(#
{uaaL=
UAfnDt7
*UaHUTE
uAuQ\!c
+}u'B``
UbR@/[
$ud[gI
ud^HVt
U)e<`H
{*UEOwr
U!F}itT?
UH)+>/
uH0#znB'
uHHHoK
UIYVu-
$uJ1$>
+U\=jc
uK>@*i
U>kI:Y
u<l,Bgg
uL_yG=
uMl	t'Z
UnDhTXid/;
_ uobXw
,?uoZ9
UP{QK%
upTVr'
|`Up|wk
UQ`D'f
uQP?3<
UqQ)Du
US0xZ{
Us7sbK
user32.dll
US	Kh6V
u`<tOwd
uuQj|a
Uv|_1%
U<vL"d
u* VX>
Uwq.*%j
"@uX}=1
Ux"&^oH
U`'">XY
.@U Y2
u{Z1\X
_&v@/|
" "[|v
}=--v$
"?v0~9U
V!1"I4
V1-!wJoW
v(3^V/
!v7UW>
v80& c|E
v8%iQr.
v8 mNq
!*v]%9
VA{csR
Vay8LK
VAZI	{)8!
v/b?/~
VBA6.DLL
__vbaExceptHandler
vb#cWoIN
Vc4@v"
vCR>o!
_VcUn<
vcwm*D+	)
VD7L`e{3
v#d9P!
vDj}M<pe
vdu	*]
Ve^*^E
@ v(E|R
vEt`Nw
VFjznE
VFu\{B-
v,GAfv
Vhb&[l
*`&v;I
Vi1$Uq
vi#[9t
ViC:^vE
\\vIF	
`v(I[S
[Viy/%
VjY	3V
#VK:~[
'VkePb
V<kX-pHb
v~lA24
vlL*'O0E
V+l&#m
<V^+L?y
v!MXu=]
V-n!3>c?rV
!:vNx.1I[X
V'O7^J
V/{<pb
vQ3`:9
vQvH[6
! Vrc:
Vs:7|!
V+SeQ7
|Vs=Is
V:}<tp
!V}U!3S
V{/)uM
V:uP@e
vv3El1
@%VVnWR
VW9,Dg
V~/w(H
'vw_k6
v:YArH
v_Y&Fm
V!.Z<n
"Vz\ P;
w{1gWgm"Y
~<w1=Oh
w&?&2.L
w3AZul
#w:4/?
W4`wxp
W#7KO[
W8NJK|
{W_8,r)
;.WA6p
$Wa&Et
w=a.G?#c
W!BE^gC
wB*YqN
wd9*Bs
	WdkQ&6
 ^WDO=
WEO+.W
?}WG7IR
]-Wg*9m
wg>zk"@f
|"WH3U3
,Wh&?=p
=wIAx,F{
WIF2b(
wj+6{Z
)WL"d1t
WL*=h"qJ	r
W%ML"I
W,mZv0
| :Wov6
w: +	p
W{Po5%
w:?<P)PG
wr-'8*>D
wReE`0
WriteProcessMemory
&	WSN0
wS_,s/
<wU<}Z
=Wvcs[
Ww	Nbi
w~WQ=S
}-WW$SbIzH
Ww	"t'mw
w$^wT\U
wwv.4U
<w{YpsS
W=Z8jyn
w*Z,AT
=wzpZ)
w/zYPR
'~X@27
X2"#T8p
x3pc@]
X3zt4+_
X6$|[D
+&(]xAe
xb%A#'
x|B/jE
XB[m#"
|X=_!C 
Xc16r%
?X"C1E
~+xc.SJ
^ xd&38
xD(<wX+,
xE9F%"
x%}EIpX
x$F}2-
:XF]e\{H
{Xf@Mm0CA
xfOv/y
X-@FVI
.xFwC6e
(-\xFX
xG0HrE
xGs=@V
XHKHW@
xhS!kvJ
'xi)&`
Xi.DG@
xj1nXO
XJjF}S/
#=XKWY
XL\X2e
xm4sNt
(_XmIZ
&xm"MDOy
Xn7:b(
X`Nx:/
xO|>.j
(xo+|u
X`P9m^
XPA:X	z
Xp,i7O
X!q"t@
x^=Qy4;
XRhU+{
x@r|j@
+Xru*+g
xtfPm`m
+x|t{RA
}Xuz&C
x&VbH~
xWN'Nw%
Xwo&GF
XWwhap
!`XX6fEb
XXrp3r
xy=0#+
?xz*["
.X$ZkP
Xz[L.'W
~Y1AAz
`Y4'h)Ts
Y4W?3[
Y80.1vx
=Y8{D(
;y8ezO
y8MhW?
\Y"*8v
Y!9-0	
`y,9=&a
$y_9?J
Y(+$a!
YA";7JR
 y- aC
' yA.qY
YA}X{)
&YB^*5
yB[MNM-
##Yc5P
yc|7Q47
yC|\mD
]y@[/D
['YdG|
yd;k/r	
ye(<:(
[&YEG-
YekxsJ
%YE]yp
[>Y&>f
\'Y)F6
;YFe`@
y\fnhRW
Yf][YMcJ
,Yg13T
Ygggv&
Yggvv1)bnje5
Yg~M's
Ygt]M,jnnnjI
YHWM7Yx
Yi1N`!YM
y@}IBpc
]y<IeB
y,iU";k'
Y><K#	m
YL+jeQ
yl* ]q
Ym1C'	
y $mYU6
<#YNj8
Yn;N}=
y($)N>p
YNZ~A&wVn
YO8I?,
Yov j$
)@y\<q
yqB}%]
yQ?b|R
yQ,il)
Y@Q	Pw
yq!>yD
YRAV=N7%X
{Yrs2l
.~YRZPH
 Ys(J6e
y$.Sul
`y_(!~T
YT&m*F
yT&o*.
YtrnJ\g
|^YT+U
ytyXD.
Yu5	d4kT>
y&U=Aa^
?Y^ Uo
YurgW_4
~~yWM2
yxK*r!
Y^xkS`
y>xuYe
~yy=@E
yyyobbb
?+((Z(
Z^1RObV9K^
z:24'3
z<4Vn#
[Z,	$5
z}}6.ag
Z7l+E~
.*z86rX
.-Z9wn
&ZBh\hF
Zb$t?^L
ZC6A55
ZcJ:|vs
)?Zcl6
Z:!~d@q
zE)*e&
\z(+}F
ZF0xen
Zf=FDk
zfQw.aS5
"Z)g'P
*zgxo]
-Z'~Hh
zhidoV
${'ZIE
ziZ,v?
Z,k'n{
Zk]ow)T
z)kRXA
Zla'|\:
z%`lp&{W
ZM1}o)
zM<ciW#][
zMNd0W,o
z!MYi	K_
Znctok
zN?DPf
Z`N@UC
ZP&JXu/
ZpNQ|z
ZQAITl
zq\+o<
ZQ'~S@
\Zqyi$
z?]Rax
Z$SM'j
@zS+p0"
&Z~swp
*Zu [3
zUE'sB
zUG	v*%
:Z-uIp{{
Z`U/"n
Z&Up+Z
Z>V5BI
Zv#8eQ
#ZVGWz[
~$zVK~
ZvnW+eE
zWKn*M
-Z&wnHC
Z%y1$C
${Z(y9
'=zY*C]/
^~zYIbt
zyuYlv
Zyz^EmP
ZyZN<q
\ZZ	Hv*3PKy:4
Z+@ZI,
=zZj'J
Z)z%$l}F
ZzPM:q
Zzta{0