Analysis Date2014-01-07 05:40:14
MD5b8b29b183d269f3801946d61f31ed935
SHA161fe359d6d100f4f7c64cd4e3a379a358243a489

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 2e50996cc73c4c2fb7ea8f79cf982b26 sha1: 4c62e23e5abafa1f03a8e80ed7ffedc9eda29f3d size: 20480
Section.rdata md5: e5615fe4c75b4f7ba6eaedb684bf431c sha1: 27541132674b32e7533d791c34de2415e887138b size: 4096
Section.data md5: 65f79c130923371bceab73bb68dbb967 sha1: feb2d4680321a46c6bde5074d3d3e12c9429bbe2 size: 8192
Section.data md5: 399bce71971c0c1f159e3e6ecb129ac9 sha1: 8271d5e1f8615d28d2407dc9bd46b00c63c15d31 size: 4096
Section.rsrc md5: fd263877500f2afd785652726111bb53 sha1: 0f929a7dc4daf65d3f8a0e4fe5d4a0e6f614ad1c size: 4096
Timestamp1972-12-25 05:33:23
VersionLegalCopyright: 作者版权所有 请尊重并使用正版
FileVersion: 1.0.0.0
Comments: 本程序使用易语言编写(http://www.eyuyan.com)
ProductName: 易语言程序
ProductVersion: 1.0.0.0
FileDescription: 易语言程序
PackerInstaller VISE Custom
PEhashd2dbb4ca57027ef2bc9f37c710578b8bd11bb8e6
AVaviraTR/Agent.690753
AVavgBackDoor.FlyAgent.D
AVclamavTrojan.Agent-64034
AVmcafeeBackDoor-DRV.gen.c

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\BSDHA97U\shenruan.uueasy[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\game68.5d6d[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IIQ3LGTM\shenruan.uueasy[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\HtmlView.fne
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\shenruan.uueasy[1].htm
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IIQ3LGTM\game68.5d6d[1].htm
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\spec.fne
Creates FileC:\WINDOWS\system32\1.bat
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012014010720140108\index.dat
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates File\Device\Afd\AsyncConnectHlp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\krnln.fnr
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\BSDHA97U\game68.5d6d[1].htm
Deletes FileC:\WINDOWS\system32\1.bat
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\BSDHA97U\shenruan.uueasy[1].htm
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\game68.5d6d[1].htm
Deletes FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012013061320130614\index.dat
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IIQ3LGTM\shenruan.uueasy[1].htm
Deletes FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012013052720130603\index.dat
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\shenruan.uueasy[1].htm
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\BSDHA97U\game68.5d6d[1].htm
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IIQ3LGTM\game68.5d6d[1].htm
Creates ProcessC:\WINDOWS\system32\1.bat
Creates Mutex_!SHMSFTHISTORY!_
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!mshist012014010720140108!
Winsock DNSshenruan.uueasy.com
Winsock DNSgame68.5d6d.com

Process
↳ C:\WINDOWS\system32\1.bat

Network Details:

DNSa.uueasy.com
Type: A
42.120.63.199
DNSgame68.5d6d.com
Type: A
119.57.62.85
DNSshenruan.uueasy.com
Type: A
HTTP GEThttp://shenruan.uueasy.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://game68.5d6d.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://shenruan.uueasy.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://game68.5d6d.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://shenruan.uueasy.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://shenruan.uueasy.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://game68.5d6d.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://shenruan.uueasy.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://game68.5d6d.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://shenruan.uueasy.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://shenruan.uueasy.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://game68.5d6d.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://shenruan.uueasy.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://shenruan.uueasy.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://game68.5d6d.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
Flows TCP192.168.1.1:1032 ➝ 42.120.63.199:80
Flows TCP192.168.1.1:1033 ➝ 119.57.62.85:80
Flows TCP192.168.1.1:1034 ➝ 42.120.63.199:80
Flows TCP192.168.1.1:1035 ➝ 119.57.62.85:80
Flows TCP192.168.1.1:1036 ➝ 42.120.63.199:80
Flows TCP192.168.1.1:1037 ➝ 42.120.63.199:80
Flows TCP192.168.1.1:1038 ➝ 119.57.62.85:80
Flows TCP192.168.1.1:1039 ➝ 42.120.63.199:80
Flows TCP192.168.1.1:1040 ➝ 119.57.62.85:80
Flows TCP192.168.1.1:1041 ➝ 42.120.63.199:80
Flows TCP192.168.1.1:1042 ➝ 42.120.63.199:80
Flows TCP192.168.1.1:1043 ➝ 119.57.62.85:80
Flows TCP192.168.1.1:1044 ➝ 42.120.63.199:80
Flows TCP192.168.1.1:1045 ➝ 42.120.63.199:80
Flows TCP192.168.1.1:1046 ➝ 119.57.62.85:80

Raw Pcap
0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   41636365 70743a20 2a2f2a0d 0a416363   Accept: */*..Acc
0x00000020 (00032)   6570742d 4c616e67 75616765 3a20656e   ept-Language: en
0x00000030 (00048)   2d75730d 0a416363 6570742d 456e636f   -us..Accept-Enco
0x00000040 (00064)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000050 (00080)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000060 (00096)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000070 (00112)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000080 (00128)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000090 (00144)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x000000a0 (00160)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000b0 (00176)   73743a20 7368656e 7275616e 2e757565   st: shenruan.uue
0x000000c0 (00192)   6173792e 636f6d0d 0a436f6e 6e656374   asy.com..Connect
0x000000d0 (00208)   696f6e3a 204b6565 702d416c 6976650d   ion: Keep-Alive.
0x000000e0 (00224)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   41636365 70743a20 2a2f2a0d 0a416363   Accept: */*..Acc
0x00000020 (00032)   6570742d 4c616e67 75616765 3a20656e   ept-Language: en
0x00000030 (00048)   2d75730d 0a416363 6570742d 456e636f   -us..Accept-Enco
0x00000040 (00064)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000050 (00080)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000060 (00096)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000070 (00112)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000080 (00128)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000090 (00144)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x000000a0 (00160)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000b0 (00176)   73743a20 67616d65 36382e35 6436642e   st: game68.5d6d.
0x000000c0 (00192)   636f6d0d 0a436f6e 6e656374 696f6e3a   com..Connection:
0x000000d0 (00208)   204b6565 702d416c 6976650d 0a0d0a0d    Keep-Alive.....
0x000000e0 (00224)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   41636365 70743a20 2a2f2a0d 0a416363   Accept: */*..Acc
0x00000020 (00032)   6570742d 4c616e67 75616765 3a20656e   ept-Language: en
0x00000030 (00048)   2d75730d 0a416363 6570742d 456e636f   -us..Accept-Enco
0x00000040 (00064)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000050 (00080)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000060 (00096)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000070 (00112)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000080 (00128)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000090 (00144)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x000000a0 (00160)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000b0 (00176)   73743a20 7368656e 7275616e 2e757565   st: shenruan.uue
0x000000c0 (00192)   6173792e 636f6d0d 0a436f6e 6e656374   asy.com..Connect
0x000000d0 (00208)   696f6e3a 204b6565 702d416c 6976650d   ion: Keep-Alive.
0x000000e0 (00224)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   41636365 70743a20 2a2f2a0d 0a416363   Accept: */*..Acc
0x00000020 (00032)   6570742d 4c616e67 75616765 3a20656e   ept-Language: en
0x00000030 (00048)   2d75730d 0a416363 6570742d 456e636f   -us..Accept-Enco
0x00000040 (00064)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000050 (00080)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000060 (00096)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000070 (00112)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000080 (00128)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000090 (00144)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x000000a0 (00160)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000b0 (00176)   73743a20 67616d65 36382e35 6436642e   st: game68.5d6d.
0x000000c0 (00192)   636f6d0d 0a436f6e 6e656374 696f6e3a   com..Connection:
0x000000d0 (00208)   204b6565 702d416c 6976650d 0a0d0a0d    Keep-Alive.....
0x000000e0 (00224)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   41636365 70743a20 2a2f2a0d 0a416363   Accept: */*..Acc
0x00000020 (00032)   6570742d 4c616e67 75616765 3a20656e   ept-Language: en
0x00000030 (00048)   2d75730d 0a416363 6570742d 456e636f   -us..Accept-Enco
0x00000040 (00064)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000050 (00080)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000060 (00096)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000070 (00112)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000080 (00128)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000090 (00144)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x000000a0 (00160)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000b0 (00176)   73743a20 7368656e 7275616e 2e757565   st: shenruan.uue
0x000000c0 (00192)   6173792e 636f6d0d 0a436f6e 6e656374   asy.com..Connect
0x000000d0 (00208)   696f6e3a 204b6565 702d416c 6976650d   ion: Keep-Alive.
0x000000e0 (00224)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   41636365 70743a20 2a2f2a0d 0a416363   Accept: */*..Acc
0x00000020 (00032)   6570742d 4c616e67 75616765 3a20656e   ept-Language: en
0x00000030 (00048)   2d75730d 0a416363 6570742d 456e636f   -us..Accept-Enco
0x00000040 (00064)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000050 (00080)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000060 (00096)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000070 (00112)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000080 (00128)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000090 (00144)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x000000a0 (00160)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000b0 (00176)   73743a20 7368656e 7275616e 2e757565   st: shenruan.uue
0x000000c0 (00192)   6173792e 636f6d0d 0a436f6e 6e656374   asy.com..Connect
0x000000d0 (00208)   696f6e3a 204b6565 702d416c 6976650d   ion: Keep-Alive.
0x000000e0 (00224)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   41636365 70743a20 2a2f2a0d 0a416363   Accept: */*..Acc
0x00000020 (00032)   6570742d 4c616e67 75616765 3a20656e   ept-Language: en
0x00000030 (00048)   2d75730d 0a416363 6570742d 456e636f   -us..Accept-Enco
0x00000040 (00064)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000050 (00080)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000060 (00096)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000070 (00112)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000080 (00128)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000090 (00144)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x000000a0 (00160)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000b0 (00176)   73743a20 67616d65 36382e35 6436642e   st: game68.5d6d.
0x000000c0 (00192)   636f6d0d 0a436f6e 6e656374 696f6e3a   com..Connection:
0x000000d0 (00208)   204b6565 702d416c 6976650d 0a0d0a0d    Keep-Alive.....
0x000000e0 (00224)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   41636365 70743a20 2a2f2a0d 0a416363   Accept: */*..Acc
0x00000020 (00032)   6570742d 4c616e67 75616765 3a20656e   ept-Language: en
0x00000030 (00048)   2d75730d 0a416363 6570742d 456e636f   -us..Accept-Enco
0x00000040 (00064)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000050 (00080)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000060 (00096)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000070 (00112)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000080 (00128)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000090 (00144)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x000000a0 (00160)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000b0 (00176)   73743a20 7368656e 7275616e 2e757565   st: shenruan.uue
0x000000c0 (00192)   6173792e 636f6d0d 0a436f6e 6e656374   asy.com..Connect
0x000000d0 (00208)   696f6e3a 204b6565 702d416c 6976650d   ion: Keep-Alive.
0x000000e0 (00224)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   41636365 70743a20 2a2f2a0d 0a416363   Accept: */*..Acc
0x00000020 (00032)   6570742d 4c616e67 75616765 3a20656e   ept-Language: en
0x00000030 (00048)   2d75730d 0a416363 6570742d 456e636f   -us..Accept-Enco
0x00000040 (00064)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000050 (00080)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000060 (00096)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000070 (00112)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000080 (00128)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000090 (00144)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x000000a0 (00160)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000b0 (00176)   73743a20 67616d65 36382e35 6436642e   st: game68.5d6d.
0x000000c0 (00192)   636f6d0d 0a436f6e 6e656374 696f6e3a   com..Connection:
0x000000d0 (00208)   204b6565 702d416c 6976650d 0a0d0a0d    Keep-Alive.....
0x000000e0 (00224)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   41636365 70743a20 2a2f2a0d 0a416363   Accept: */*..Acc
0x00000020 (00032)   6570742d 4c616e67 75616765 3a20656e   ept-Language: en
0x00000030 (00048)   2d75730d 0a416363 6570742d 456e636f   -us..Accept-Enco
0x00000040 (00064)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000050 (00080)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000060 (00096)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000070 (00112)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000080 (00128)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000090 (00144)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x000000a0 (00160)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000b0 (00176)   73743a20 7368656e 7275616e 2e757565   st: shenruan.uue
0x000000c0 (00192)   6173792e 636f6d0d 0a436f6e 6e656374   asy.com..Connect
0x000000d0 (00208)   696f6e3a 204b6565 702d416c 6976650d   ion: Keep-Alive.
0x000000e0 (00224)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   41636365 70743a20 2a2f2a0d 0a416363   Accept: */*..Acc
0x00000020 (00032)   6570742d 4c616e67 75616765 3a20656e   ept-Language: en
0x00000030 (00048)   2d75730d 0a416363 6570742d 456e636f   -us..Accept-Enco
0x00000040 (00064)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000050 (00080)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000060 (00096)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000070 (00112)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000080 (00128)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000090 (00144)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x000000a0 (00160)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000b0 (00176)   73743a20 7368656e 7275616e 2e757565   st: shenruan.uue
0x000000c0 (00192)   6173792e 636f6d0d 0a436f6e 6e656374   asy.com..Connect
0x000000d0 (00208)   696f6e3a 204b6565 702d416c 6976650d   ion: Keep-Alive.
0x000000e0 (00224)   0a0d0a6f 64793e0a 3c2f6874 6d6c3e0a   ...ody>.</html>.
0x000000f0 (00240)                                         

0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   41636365 70743a20 2a2f2a0d 0a416363   Accept: */*..Acc
0x00000020 (00032)   6570742d 4c616e67 75616765 3a20656e   ept-Language: en
0x00000030 (00048)   2d75730d 0a416363 6570742d 456e636f   -us..Accept-Enco
0x00000040 (00064)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000050 (00080)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000060 (00096)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000070 (00112)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000080 (00128)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000090 (00144)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x000000a0 (00160)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000b0 (00176)   73743a20 67616d65 36382e35 6436642e   st: game68.5d6d.
0x000000c0 (00192)   636f6d0d 0a436f6e 6e656374 696f6e3a   com..Connection:
0x000000d0 (00208)   204b6565 702d416c 6976650d 0a0d0a20    Keep-Alive.... 
0x000000e0 (00224)   3c2f626f 64793e0a 3c2f6874 6d6c3e0a   </body>.</html>.
0x000000f0 (00240)   a0                                    .

0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   41636365 70743a20 2a2f2a0d 0a416363   Accept: */*..Acc
0x00000020 (00032)   6570742d 4c616e67 75616765 3a20656e   ept-Language: en
0x00000030 (00048)   2d75730d 0a416363 6570742d 456e636f   -us..Accept-Enco
0x00000040 (00064)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000050 (00080)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000060 (00096)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000070 (00112)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000080 (00128)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000090 (00144)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x000000a0 (00160)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000b0 (00176)   73743a20 7368656e 7275616e 2e757565   st: shenruan.uue
0x000000c0 (00192)   6173792e 636f6d0d 0a436f6e 6e656374   asy.com..Connect
0x000000d0 (00208)   696f6e3a 204b6565 702d416c 6976650d   ion: Keep-Alive.
0x000000e0 (00224)   0a0d0a6f 64793e0a 3c2f6874 6d6c3e0a   ...ody>.</html>.
0x000000f0 (00240)                                         

0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   41636365 70743a20 2a2f2a0d 0a416363   Accept: */*..Acc
0x00000020 (00032)   6570742d 4c616e67 75616765 3a20656e   ept-Language: en
0x00000030 (00048)   2d75730d 0a416363 6570742d 456e636f   -us..Accept-Enco
0x00000040 (00064)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000050 (00080)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000060 (00096)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000070 (00112)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000080 (00128)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000090 (00144)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x000000a0 (00160)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000b0 (00176)   73743a20 7368656e 7275616e 2e757565   st: shenruan.uue
0x000000c0 (00192)   6173792e 636f6d0d 0a436f6e 6e656374   asy.com..Connect
0x000000d0 (00208)   696f6e3a 204b6565 702d416c 6976650d   ion: Keep-Alive.
0x000000e0 (00224)   0a0d0a6f 64793e0a 3c2f6874 6d6c3e0a   ...ody>.</html>.
0x000000f0 (00240)   a0                                    .

0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   41636365 70743a20 2a2f2a0d 0a416363   Accept: */*..Acc
0x00000020 (00032)   6570742d 4c616e67 75616765 3a20656e   ept-Language: en
0x00000030 (00048)   2d75730d 0a416363 6570742d 456e636f   -us..Accept-Enco
0x00000040 (00064)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000050 (00080)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000060 (00096)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000070 (00112)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000080 (00128)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000090 (00144)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x000000a0 (00160)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000b0 (00176)   73743a20 67616d65 36382e35 6436642e   st: game68.5d6d.
0x000000c0 (00192)   636f6d0d 0a436f6e 6e656374 696f6e3a   com..Connection:
0x000000d0 (00208)   204b6565 702d416c 6976650d 0a0d0a20    Keep-Alive.... 
0x000000e0 (00224)   3c2f626f 64793e0a 3c2f6874 6d6c3e0a   </body>.</html>.
0x000000f0 (00240)                                         


Strings
080404B0
1.0.0.0
Comments
FileDescription
FileVersion
         (((((                  H
(http://www.eyuyan.com)
LegalCopyright
ProductName
ProductVersion
StringFileInfo
Translation
VarFileInfo
VS_VERSION_INFO
07,/@dv8
07 iS7
0-fww:
0jNh)}
=0n3a;&
,0oM!O
&0Pm_J
-,0Ra	
+0vfvq
0yXnW0
1~}'<#
15@~C'!
16w19|u
19)w\g5
\1.bat
1"H!7'
1i}!V|
"1.()J
1J8!]3
1:\K#F
1m1Q+{
1P_6b}SG
|1vqL0Fy
1V/[RZ
1}W\`j=
-<1Y5A
1`\y^)?U
$1	Yv{d
<||2=\
[2?0{5
21r}]\'
-2]2j[n=V
2&{8W"
2=a{Zfd
#2Co}h
.2++GN
~2hcLy
2@&i6e0
2[{I7h
?2isUN9
2>iU0	m
2&k2Ds+J}
$2{N85
2TS8,p
@2 U*	K
2:uwv}
+37}|#
:.37}Y
39;>mU
3c^	a<\M&
}3f2~U;
\3FvY_
}~3hat
3iK;}O
<3~K8}|9=
3lF	!Y
/'3&Lt
3Ml9Z&
3Ns	os'Y
3O"=cY
3T0i[;
3<{u~V
3_ vt!R
3xVT$%
,  (4&
)_4 7X
4aC.61aY
|-4bdu
.4bf}NeQ
4cd*S*
4cyQd""
@4FGvn
4fO8 D
4g=c0V!
/4Gs%~
@4HW4![
4|;j{(
4L7UW\
$_4Om@
4pu6J(
~/4QQ-
4]RZTp
_4t.WO
4`~\w(
4w\7Gz~	
 4wVfi
4YIJ"q
^{4)^y\W
5014D8FA6DCA40b68FA626D8183666EB
56[B$E
=\5BBx
5b|m}R7_
5cOn8|_A
?5d!oD6
5#)Gw`
5Hc(&>
5i5,w3
5Kx0nnYC
5\lnRr
5PCKUr]q
5[s'O:
5T sQy
5{uhjlgn<
^5vC@f
5!>V\yY
~,5W?.
61buQ&i_w
63 Tbb
6'4;]h,u
67L.RQ
6.9BJB
6b=}#A
6!b(Ak
6BjL,mn
6%J!s?
_@6]MC#
6@NEzgs
6<v0&<
6XX$?Cqi
	}71;R
7=|5%=
[{769!
7%#ceg?
7D%:lf
 [7F&O7
7g'T:6h}
7N%628u
:7@[N{	i
7P0^lKJ
:7>QCY_5|
7VT84a
7w;=r[
'7/xwg
80bG5:
8@0@X~x
|%,8]<13
<83i>`
8,3iG_
+8A}|f0
 /8Aw6wc
*8b1N>'
8B'c)7-
8"duE/
}}8@e?
8e{SR/@N}
?-!8@g	
8gQyP,L
8h@[6?&
8~H6=`
(8M}Yl
8n-M)E
8^@`P-
*8qrtC
8v(#^|L
9(2n:-
(9/4.P
^}%950
$)9)7;s
9^\B87
9b"b6-
9FcdNH
9GkReY
,9HuFPZ
9.hUjq
)9Lz88
9]?Pd@
9PE9Xx
9Q%)XH
9!S2.;
<9?SVFu(A
~(9~$u
9uhBjVf
9v^Q+xv
9WJI	I
&9X=b^
9Z'+Ee
9Z}Jv-j
9z@O-M
.a1z:uM, 
.A4H-4
A512548E76954B6E92C21055517615B0
A_*5H`:
A6cqi^
(a6X]cj
A;??7X5(LR
".A!9}Bj
|)\aA/
]AAjay
>aARsQ
aBcDA{
abnormal program termination
aDiF5u
aG&mXP>
'agq]KO
+A::H`
a+HD/y
AH_pe9
A|i|~xJj
a:i#X$m
A;)[J6
AJ_7h7f
:AJ-"9
AjSWF7
a~,kKk1
AKVHW_
a$l8o:6
AL|qhs
AL]YDf
am{ryY
a'nL3P
A)*(o2
aO^F8Eev
aoNqo]	f
ao<.O4	
a:p[@V=#
aQEg5v
aq(+iHw}F
!%A@R=
AvIo}&E
Aw4+8:
A';Y.e
AZIByij6*
?+AzP^v
aZZ<]J+
{B2@%?
b%7LaE;
{b7\pA
+b8Ktl
*ba<5e
bACX2""
@B&-AjT
BA~m5u
b=b5'A
.Bb(iX
B$=E5M
b,eGVh
b,eMN5S
"BFK7+
bg]4\%}:_t
"*biO]
BjB+"7
BjPppw
b;$K54
BL6IJ{
!{bLjU
& Bo$8
b!T>$gP
bu![&<a"*
~B?Ud[f
buffer error
bWe_Ie
Bw,kQ^l
B@w&NW
;)BXhW+[
BZ2Fi(
bz}Nbz
_\]C%_+
C1B7N>
c/1"VN
|c2EQR
^}c+2fZ
'>c}&3
:)*%C4@q
c5! #Gt
c{7h8N
}C8Y{}9
Can't open file!
Can't retrieve the temporary directory!
C|Bf4'$U
$_c%cdKk
@cdBZO
C.eV@#
CF+}2<p
ci}7tf
cI9zpV
ciB/~kr
)c]+jJ
cJr"C,
CloseHandle
;C}LT	
CM0.?3
cM_kOB
}@~cOiI
copy explorew.exe "C:\Documents and Settings\Administrator\
c+.OzO
CQ6y[q
CreateDirectoryA
CreateFileA
CR\M^1
cR|V e
>CSFNh
'c)t}c
CUJ62N
_<cUR3|
/C[U'tK
cWb"oH
cWJI?o
CWkSc[
*>c+W)zn
<{CXU!
cX|wRv
<C|/:Y
c$>YBS0
cyHY]y
C.z\3i
d09f2340818511d396f6aaf844c7e325
D0r yR
d3WZTD
	d`79a/;
d8|xw 
D`->a!9
#<Dak,
Da_rg3a!'
@.data
data error
;dAy\m
d&BR.^
dc6*\<}
Dc)(lAqEz
d?[/f2%
DfTJ@q
D'F'W!
Dg/3~K:}
"dGR|y
DHorh/X
{)/d:Hv"=
d@iB|p
Dj^_pOGbqut%:
)dKs^]
d$lpo(N
{ \DN(
DNN9"l
d^O3c_
DOMAIN error
DPf9z<
%d<@Q&
dqmp8I
Dri[Tn
drJ[,S^
Drtq]uA
D_sIBZ
DSUVWh
D}t_}S
d/t+t}U
-DuNj{
dxhTz\
/dx,ji.3
d"Yx{b8
=	Dz45#
|e0'gL
'&&e0IK
e]0!'u
E=;11>
"(<E1F&i
e(4$y`
e{4Ztj=
E5yk^|G
|e8oLW
#e947,
E$^^A=I
eciZ\{
?ECUuM_
e&d#^!
?$E_DK
[&,E"E9
E F	hC
$e?GAXI
E<H{44
E*,ILV
}EJ.x|C7
empty distance tree with lengths
EmV^mmhr
^emXUG
E$^nM 
*eo+SM
	epFFL
e:Pw9{
_$e	Q>,?>
e_q4"%
eQu+"l
(Erdv)2
ES%jad
etAsX}=Q1
EuZ#Y)
[Ev_G#
eVTM{J
ev=VBG
^>@-ex
ExitProcess
EzOGq'
$[^F."
f0nw6R
f4#px}j
F'A)1,
Failed to decompress data!
Failed to load kernel library!
Failed to read data from the file!
Failed to read file or invalid data in file!
fa~ldS
f@Db!&{
f/{>*F
ffffff
ffffff`
fffffffff
fffffffffffhwww
fffffffffffo
fffffffffo
ffffff`ffo
fffffffh
fg2R<V
FGK-a#[
fGzd +Z
fhRb#v
,.Fi"kn
file error
>f~=.k}
''fKj0
FkJ/ K
- floating point not loaded
-fnHr2"
=|	F$o
fO3=X,
foffffff
fOg98u'\1
/&fp+ 
fPe0vb
FQ]nsD
fQ-OUK
@fq}*]-Qa
&fQR4b
~fr0#T0(
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FUmIYs
FxVIc2
f%YzF<
fy;zM	
g0\faz
G3t\[&
g5Q&Zq
=G@84W
g 8/#r
[G9cyz
)G"AXy\
G	Be5/
gCkF/@!
GetACP
GetActiveWindow
GetCommandLineA
GetCPInfo
GetCurrentProcess
GetEnvironmentStrings
GetEnvironmentStringsW
GetFileType
GetLastActivePopup
GetModuleFileNameA
GetModuleHandleA
GetNewSock
GetOEMCP
GetProcAddress
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetStringTypeW
GetTempPathA
GetVersion
g[_+f5gNw
g\F_J#
G,+G(+C
G \h<	?
{gi%b(
GjI237
@gJ%n'R
%$gk?g,
g;_n!p
.[G"P]
GpA)@)
GQM~usZ
>GqNy9
!GQ%XX.
+G!tH;XL
]gu]fR
gxoJ/r
Gy3778k
GY~~M{|
G\Y?mO
g<'{?z
H0,oi'
H0P]M6
h0T%[2x
H1=%PE
-`'H3u
}]H4s O~P8
H5),"KO
H6SOf^
Hc<lOr
H_(D415
HDuPq.Og"
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
!hEOCw
hEs6e"
=HFe	<-
*hf+q-|;=8
H"l&fi
HLJsWt
Hl!M]$
HM"O8t
 h^*N-
.HNi95
hoFk>V
Ho)%fW3
HrCg@b	g 
H^+RK}
h]S+^b
Hsc5Zf
H~#Sq{
HtmlView
http://game68.5d6d.comt
http://shenruan.uueasy.com"
h]~wnBB
h xIn2A
hXJs61|y
H&zza?;
i0{)fS
!I1o\KC
i1xZV<\
I36GPE
*i7#h.7
i AA%TY
iagAP9
^iAMvz3o"
ibB-A{Y-
I"+bO:
ie{\XG
}iF)@[
\iFD?ch
ify3ji
IG)3vc>
-~ih%;
I\i{R<
iiRVZb
II(sa#
IjXJ|y
IL~Fwd?
i]^MWl<a
incompatible version
incomplete distance tree
incomplete dynamic bit lengths tree
incomplete literal/length tree
incorrect data check
incorrect header check
insufficient memory
Insufficient memory!
invalid bit length repeat
invalid block type
Invalid data in the file!
invalid distance code
invalid literal/length code
invalid stored block lengths
invalid window size
\~,I<O
*IpfIW
(IPOz3=
IqTZ_Yx#d1^?x
IrBOR7
iR]v"^
i?t=+EBg
>I?TI.
)_.iTQ
iUh'XU
I}[ve7
I*VrJ 
I,WmrT
]iX%NW
i{y"?7
[iy9~z
|I%Y\C
Iy`_s<
{+i]z-
iz LkY
j>.0ke
J1K[TG
j2&q/VG
j45YUs
J{6	6o
J7{VUM
^J>8>W
j!\9!8^
:J9}Q.
(,Ja*S
^`;jb.
JBl{p\i
'j<bw*
jDkN3M
JD]Q3=
J:E(	0_H
:!,jF,
>jFS4N
}*JG/_
J=Ixfo3
!j$Jrh
jK.2^y
@j'KNv-
JKv;SFu
JM9kN^
jmfmsZg
JOd9Zu
  JOHm
j#P1dm
J/p5gZl
jPp5a;
jrB63z
}j~	[T
;jTVgMH
jU"b_f
jup?N%
 k[!1S
k2m3?G
k]>3{Zg
K8'>EY
 _k}a`
KAF`X,
katF=Z
kBTSoB
%k[\{bXn
Kcs<dv
KD%Ra+
KERNEL32.dll
KffD%Z
,kFUeC}~q
K-*Gtv
]K@hp`
Kh	]sW
k#%|HY@m
.KiFN.
kkW)Fo8g)
)k}[l*
kl	Dip
KLoAUB4h
KM-]1z
'KM6=X
#kPZ6h5
krnln.fne
krnln.fnr
K#sRY;
+KS-W\
k{{t/5
K#T%epu
}k=?to
ktV/W-
'<K;U#
#^ku;a
+kUt(5
KUWFBt
Kx+	7k
.)(KX^C+v
K:#YZH
&l2vveH!
 L$?4c
)L4LL2;
l5vKe$
|l8V\d
l}(9\a
*lbW(Pj
LCMapStringA
LCMapStringW
L-d[q%o
'lF.n8
&-l(M1.
LMh>gK(
lmk}Nq
LoadLibraryA
lPJ-qXU
Lq"KFJ
-L-Sm_%V
.l=T/9
)$lu]/
@?]lVk
l/:wOm
;lxI%G|
:LXl#Kpvz
lXt('i
L	ZNq~F
:m_%}*
m^&'(/
<)<M"<
?M3o'WW
M6vOn9
%,]M\(7bh
>.Mbjy
mb<o;B
m^<dG9&
Mef:APp4a
MessageBoxA
Mfg)^A
<Mf"uO
M,fyye
M)`#\hI`5
Microsoft Visual C++ Runtime Library
(M	Ig;
|MiSNd
mI|v<g@!
M-J` l
M'l `'
M(lH2%
MlJ2.@
MMjV"h
MM,x@V
~M)QD9
m<%R*=
M_r[e@
m`S1D~
}MSP	\
MultiByteToWideChar
m+)V*]
+M=V[,?
mw<+~C8Y{u9
*MwXF]
_mWY$]
&M[Xp~P\
myATpj
m|	Zvo
N0ar_Y
N1@/Au
;n1G:nh
n{3d,%i
<n5i(]
?N>A4!
nBb8|r
~\Nc{s
nc#UNp
need dictionary
\Nfpv~
N `fZ8
=nFzSJb=%
N&lYD1
":N)+m
NMc*@x
 N.N3)^
nnPHFF=/
- not enough space for arguments
- not enough space for environment
- not enough space for lowio initialization
- not enough space for _onexit/atexit table
- not enough space for stdio initialization
- not enough space for thread data
Not found the kernel library!
,N)p~<`
_[>NQB
n&R2iv
`!NrY|
NSg:Yk
n$v-)+
nW=H<-
nWly@D
@,NXF!f
nXi%K:5
.<_`	O
\|"%O?
O1bsqLB
O1ujiZ
o4iA1}
,O4MB)c7
o.(6)~
o<?`7q
O|a;];V#
`ock>}
offffff
o_]fGV
_Og<(47B
oI:_xW
o)JMqP
(oK#K$
ON1:W5
o_o^x&0
oo*x[z
O|p"&$
OQ';BwI
O	"[QRl
?oQW%#*
O:.RPRn
o/RU`V!b
OrZdLQxE
OS$!M(
O(uckHr
O.U:n$
O]u^n9
o)Uo1*
^OV4p[
oversubscribed distance tree
oversubscribed dynamic bit lengths tree
oversubscribed literal/length tree
oWLp:_
oXDLYxD3
";OXp#
O+xvR(|
O&#Yz~
#O\z/X
&P[}}<
P3NXPL
[p4*AFH
P,6-@+
,P6Qk7
{]&`p9
PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
>PCBqK{
P@Cu9^
P;c#WP
pDG{gB
$PDsbtb
Pd*~UM
PfCMRO
`P'F"u
PG,f9h0
PI2G3?U
\PkD a/:I:>
)P^&KJ|&P
$?pLGt3
p..lN-W
P[MC7O
p[,nnZD
pnU.q9
-p^_~O
],Po1n
#pOT3~
@<(,pP
%pPav-
>^PQ	'
P#qE,r
P,qs\r
\PrL2R 
Program: 
<program name unknown>
PR_ze_
"pu	QA1
- pure virtual function call
p,V`]c
PVh(f@
pVpYn "
PVsM;&#
pxrO]r
P Yg5h
]PYU%jI
\PZ8yS
P:ZFeG
`~p,zRJ8
),}[Q<[
[,Q0Bt=
'Q1@-x
Q	9v'_
>=Q.aN
q}b"pe^!
qBqHU[
Qe(tH'6
Q]g\6^
]".`QI\
<=qIP={
)<\*qKS
qNh_4`%m7
Q`n-$Wr
Q}q8pw
qQoT$SzN
q]:t7+
q+&_ v
q!V8Uw
Q'>Vb9z
q/vYI/
q^w.Bn3a
+QwIj'
$qw!w\
qx*{%K
qZ#h++
 .*(*r
`[%?R 
"=r0(1
r0j,SM<
$r0K5}Gc
R;0~V#
#?r1KIu
R3`I{}
?R`64[Ku
r7iQ$j.
r7l@jk
R8m+?2
r|94vF
R9:+YO
Rbo6y(
`.rdata
RdeJB.
ReadFile
REk( b
@reloc1
rey{Tg
R!%`_f
r(G,"G
&R~{I5
^r,\Js@.
r=m# \;|*_#
"~r:N"
	RO4D/
rO.DF9
rOx7hL7c
$rQW_eQ*
(@rqWi
RtlUnwind
runtime error 
Runtime Error!
:R_wG&916J
$rwK(5T
rX^1CxRd
RYiyu+
Rz9*k]	
S1ztdw
	s,:2mv
s30eCHM
s:^99t
S9T>~i
&/}sB'
>sB$LM^I
)S,&dP
Se6z=W
SetFilePointer
SetHandleCount
sEYBu>5
SFc5m;9
|[sF z
sGE]qi
s^g>q+
[Sh,f@
SING error
_SiO?U{
]S~J~~D
`sJNzf
skNuQz
S	K=WHG
SLR]Ed
S"Lx}b
sNE#:.
S[NIxL
S+NwTv
So/N$z
s=>o~+V
Spb~ r
Sq5i0Icq8
Sr+(qp
S;RZ3i
SS@SSPVSS
StQLFzE}f
stream end
stream error
 stz80
.SV6g5
sw4+~+8
s'w7kj
sW;V8:XXp
s|Wy*%
)S,|]xMh
SxUlE6
{>syp;Mz
S'ysU,
sZbS8Q9
^$-<t)
t>"3ps
t54sff
t7`fUw
t7\`m$Q{
t8$'h]
*tA+LQTuA
tba"l	
t<b>I.$
"Tc~^>
TC.H@17
T=Cl-|
T,DVK8
T)@<Ek
TerminateProcess
Tg25v*
-t+]H)
The interface of kernel library is invalid!
The kernel library is invalid!
!This program cannot be run in DOS mode.
tI06BM
{Tile)a
titJvw
tkh7aVmc
:T^{K+p
Tl4a,+|
tl/LFqF
TLOSS error
"TM>]CP[
?tn-uoj
"TN:%V
too many length or distance symbols
$*Tp,c2
tQs1EyI
%t}=Qw
T"->R",
t.r\7L
ts3A^q
&$;TSkg
t#SSUP
T$tRia
t.;t$$t(
T;uKH"x&
TVMpU~QDP
T%Vpw.G!
t$$VSS
TvxJV[
T,W3a`C
=twZ5V
Ty2bNm
<u>*]&
u3/J#~sH
U40NgZ3
<u522Iu21
u5Or~f
U6m47KR
U8^Hmu
uAo$-A
U(\be>yD
uc,/Q%N
UC;wQ4
:udc##V
udK,V1
uEAfL8
uEbdUn
uf6wM[
UF]hH,
u-FTpQ
U-^GAb&
 U/{Hd
u hxb@
!\uj2.
'[ULJwe
UL/}P]<
_u%m*/
U~mc#_
@umz45e}
- unable to initialize heap
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
UnhandledExceptionFilter
unknown compression method
Uo $192
UOA:7y
< UQ/l&1
[uq)QY
U r5G)6&
uR7b#l0
Us4:j2
U=Sbl<
user32.dll
USER32.dll
@Us&.Q
U;TfoF
*=uT=	{qY>=
UwD8{l
uwS7^Oc
U}X:%)
U":Y2s
UZKbDY
>"$]v^=
*v&'1KR
V1)@/Os
V3aDz`
|@V3k~
v4GCS`
>v4$[j
v5j}D;+
v5[~;s
}V_!6b=
v891~e
|v9N^e
V'!9w^
V9]Z0-K
=~&*VA
vB.2E%
VC20XC00U
v&@cccW
\vc=$pC
?{vCr:c?}Q$
;V#CT. ~
vdACVY%
`+|vE>
!VeK:Y2Th
VfrI$k
$vG[$ 
Vgkfl;
VG#x\L
vH6b[X
^Vh,f@
v$h)k	i=+
vHq.W;T
VI41~]8X
\Vi-h8Ui
VirtualAlloc
VirtualFree
vj}AsN
V/JBAl
VLY{}3C
/Vm*dhY#
Vmkt1Y
vN8uf&
;?vO6[iW3Cm
)vQ]&b
v$Rd5bC<M
v`,:T!
vT25^x
VtAl$]
vV0ezA[
VWfMt:
@vw^@(T
Vxj8!r
Vxq]\QE
W0B)FT
"(w0p(
W+]^{4
w5s^,a
w8'Oga
WaFH2F
Wb}hrtZ
;wb?m$
Wb}}^P5 tr
>&+w"~c*
Wc]89?
WDmLYA
WE~F_|
W[E#u0
|w%fPi
WgC4M:
WideCharToMultiByte
~WIk]KC
W_=m$X
w:MzCX
WnD_}CW
w@o:(=
{Wo^Z9
?W(P!k
W~q;nE
WriteFile
wrt[5!
?w?S="
;W	s4c
wsprintfA
WtA36%
WvF|7I(Y
"WWSh(f@
wwwwvf
wwwwvfo
wwwwww
wwwwwww
wwwwwwww
wwwwwwwww
wwwwwwwwwwwwwwwwwwwwwwww
W]x5kx
wXc\|<6
@Wy!/{
)WYGWD
#WyZ\y
wZ"iF0&c
*x0~i7
X2|$1-
X2Fjcf
^x2iS9
 X5r~J
.X6bc;-
x=+8",A
x:%9?=
X}9#[uW
X*]!c@B
x;EzY;
Xf0(its8
	Xg2g8iV
{X~{H2
Xi}V&f
XIzfZI
XLH`A"
[xLxhuA
X/l(Z'!
XN3b}H p
x-NUwq
x(O9Ww
'xOuQ6Y9&
XPp N):H
xrMOi}
x/}s_9
xu*5e#H
xw7<bf`
`Xw7f)
=X,w7w
x]wj;D
Xza,T&5
`^XzjF
y=4Ru.
Y4XQ.G$,
=_Y9{!
&y9^/j3L
+=/y9KS
Y9' Se]
YA"iPAE}I
YB<6z7
yBi5NI
Y*c=A '
.yd%+G/>$
yFQR &
Y^_GJG/+8
Yg*L-T
YKJA L
y_"K}Y8
&_yLf)
y-	MnX
[Ym_pi
ym+`X(
)Ym@Yd
yN1d9!
!YNis6NI
=YOE]03>
YP]+AW
=Y>_q~
$Yq6g,
!yR}Kx~T
``:ysqg
y.~`Tu
*Y#`U`
*}y%>v#
Y/*&<V
Y'VzZ7
Y$xEDH\1
Yx/+H$#DW
_^][YY
YYh p@
yy?ozC;
Z/#~3,
z3ZI{]
/Z6Xj-
Z6zp],
Z~br?f
Z%Ca>s
z}]de:
z#Dg.o
z@Dvne
ze,b~t0
z,]}Ef
zF,fxr
zfPsbF
zhT>.9
>'ziu`
Z`j1T`G
zjI}`Dl
z%<kwQ
zkY$2J
Zlc`pg\
[Z#lt8
ZLU[{Hno
Z NIBV
!Z&]?o
+ZoR,/;6
ZqB/e^
ZT"/el(
=/Zt/`ny
zU>}4Qgx+
Z/Ulr[d
ZU$.Uum
ZX'i#1
Z#Y2i(
'Zyc8q
Z	YP2H
Zz9"L;
ZZ/$WU