Analysis Date2014-10-09 14:21:13
MD519e47b6345aba550e028b72005c370cd
SHA170fa6e953d96af2f8b5307c118fcb819d6c257c7

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
SectionCODE md5: 63a94f6cfc20db8c3ce4a727d53dd7a5 sha1: d13ef30c79e9b5d07f6f9bab8cdc4741d52ce1aa size: 253952
SectionDATA md5: cf508c06ae9c51582fee41882ff4fc3a sha1: 759a1b47e6cc449a7db0e0eac60311e41c5028cb size: 6144
SectionBSS md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Section.idata md5: 3ce3b8644f75198a912096383621099b sha1: 646eec25442d25e642115248376def4a37bc2512 size: 4096
Section.tls md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Section.rsrc md5: 9890eb6d224cf90f9b84eba35ee417e7 sha1: f0c1a618108207dcae0595de8f2be08d4140f4d8 size: 370688
Section.XComp md5: 1d37858c571d4fff755bb1fb5b146fb5 sha1: 282f83d9b890954d8aa1778076790cb7312eecf2 size: 904
Section.ccp3p md5: 96412937c274be4d9b269be75213e63f sha1: 881a6cfaa4b1673270adec2dd838e3820a7ea2fb size: 2048
Timestamp1992-06-19 22:22:17
PackerCRYPToCRACk's PE Protector v0.9.3 -> Lucas Fleischer (h)
PEhasha912b5a4fcb0e56bf4dcb6a4e807158b5f8eab27
IMPhasheee9062b8cbe1efb89c250150605b1a4
AV360 SafePacker.Cryptocrack.A
AVAd-AwarePacker.Cryptocrack.A
AVAlwil (avast)Crypt-ECL [Trj]
AVArcabit (arcavir)no_virus
AVAuthentiumW32/Heuristic-210!Eldorado
AVAvira (antivir)TR/Dropper.Gen
AVCA (E-Trust Ino)no_virus
AVCAT (quickheal)no_virus
AVClamAVno_virus
AVDr. WebTrojan.PWS.Banker.28793
AVEmsisoftPacker.Cryptocrack.A
AVEset (nod32)Win32/TrojanDownloader.Banload.PNJ
AVFortinetPossibleThreat
AVFrisk (f-prot)W32/Heuristic-210!Eldorado
AVF-SecurePacker.Cryptocrack.A
AVGrisoft (avg)PSW.Banker5.LSU
AVIkarusMemScanBackdoor.Hupigon.YWT
AVK7Trojan ( 7000000f1 )
AVKasperskyno_virus
AVMalwareBytesno_virus
AVMcafeeno_virus
AVMicrosoft Security EssentialsTrojanDownloader:Win32/Small.gen!AO
AVMicroWorld (escan)Packer.Cryptocrack.A
AVNormandoslegacy/Crypt.OSO
AVRisingTrojan.Win32.Generic.1230E9E0
AVSophosno_virus
AVSymantecPacked.Generic.48
AVTrend Microno_virus
AVVirusBlokAda (vba32)no_virus
AVYara APTno_virus
AVZillya!Trojan.Banker.Win32.3458

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\Client\SuperSocketNetLib\LastConnect\200.234.197.22 ➝
7:tcp:200.234.197.22,1433
RegistryHKEY_LOCAL_MACHINE\Software\Description\Microsoft\Rpc\UuidTemporaryData\NetworkAddress ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates File\Device\Netbios
Creates File\Device\Afd\AsyncConnectHlp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates ProcessC:\WINDOWS\inf\bootscan.exe
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates MutexMODZJJ1251
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Winsock DNSwww.pousadaaldeiadosanjo.hpg.com.br

Process
↳ C:\WINDOWS\inf\bootscan.exe

Network Details:

DNSwww.pousadaaldeiadosanjo.hpg.com.br
Type: A
187.31.64.20
HTTP GEThttp://www.pousadaaldeiadosanjo.hpg.com.br/plug.jpg
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://www.pousadaaldeiadosanjo.hpg.com.br/plug.jpg
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://www.pousadaaldeiadosanjo.hpg.com.br/plug.jpg
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://www.pousadaaldeiadosanjo.hpg.com.br/plug.jpg
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://www.pousadaaldeiadosanjo.hpg.com.br/plug.jpg
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://www.pousadaaldeiadosanjo.hpg.com.br/plug.jpg
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://www.pousadaaldeiadosanjo.hpg.com.br/plug.jpg
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://www.pousadaaldeiadosanjo.hpg.com.br/plug.jpg
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://www.pousadaaldeiadosanjo.hpg.com.br/plug.jpg
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://www.pousadaaldeiadosanjo.hpg.com.br/plug.jpg
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://www.pousadaaldeiadosanjo.hpg.com.br/plug.jpg
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://www.pousadaaldeiadosanjo.hpg.com.br/plug.jpg
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://www.pousadaaldeiadosanjo.hpg.com.br/plug.jpg
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://www.pousadaaldeiadosanjo.hpg.com.br/plug.jpg
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://www.pousadaaldeiadosanjo.hpg.com.br/plug.jpg
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://www.pousadaaldeiadosanjo.hpg.com.br/plug.jpg
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://www.pousadaaldeiadosanjo.hpg.com.br/plug.jpg
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://www.pousadaaldeiadosanjo.hpg.com.br/plug.jpg
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://www.pousadaaldeiadosanjo.hpg.com.br/plug.jpg
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
Flows TCP192.168.1.1:1032 ➝ 187.31.64.20:80
Flows TCP192.168.1.1:1033 ➝ 200.234.197.22:1433
Flows TCP192.168.1.1:1034 ➝ 200.234.197.22:1433
Flows TCP192.168.1.1:1035 ➝ 187.31.64.20:80
Flows TCP192.168.1.1:1036 ➝ 200.234.197.22:1433
Flows TCP192.168.1.1:1037 ➝ 187.31.64.20:80
Flows TCP192.168.1.1:1038 ➝ 200.234.197.22:1433
Flows TCP192.168.1.1:1039 ➝ 187.31.64.20:80
Flows TCP192.168.1.1:1040 ➝ 200.234.197.22:1433
Flows TCP192.168.1.1:1041 ➝ 187.31.64.20:80
Flows TCP192.168.1.1:1042 ➝ 187.31.64.20:80
Flows TCP192.168.1.1:1043 ➝ 187.31.64.20:80
Flows TCP192.168.1.1:1044 ➝ 187.31.64.20:80
Flows TCP192.168.1.1:1045 ➝ 200.234.197.22:1433
Flows TCP192.168.1.1:1046 ➝ 187.31.64.20:80
Flows TCP192.168.1.1:1047 ➝ 187.31.64.20:80
Flows TCP192.168.1.1:1048 ➝ 187.31.64.20:80
Flows TCP192.168.1.1:1049 ➝ 187.31.64.20:80
Flows TCP192.168.1.1:1050 ➝ 187.31.64.20:80
Flows TCP192.168.1.1:1051 ➝ 187.31.64.20:80
Flows TCP192.168.1.1:1052 ➝ 187.31.64.20:80
Flows TCP192.168.1.1:1053 ➝ 187.31.64.20:80
Flows TCP192.168.1.1:1054 ➝ 187.31.64.20:80
Flows TCP192.168.1.1:1055 ➝ 187.31.64.20:80
Flows TCP192.168.1.1:1056 ➝ 187.31.64.20:80
Flows TCP192.168.1.1:1057 ➝ 200.234.197.22:1433

Raw Pcap
0x00000000 (00000)   47455420 2f706c75 672e6a70 67204854   GET /plug.jpg HT
0x00000010 (00016)   54502f31 2e310d0a 41636365 70743a20   TP/1.1..Accept: 
0x00000020 (00032)   2a2f2a0d 0a416363 6570742d 456e636f   */*..Accept-Enco
0x00000030 (00048)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000040 (00064)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000050 (00080)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000060 (00096)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000070 (00112)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000080 (00128)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x00000090 (00144)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000a0 (00160)   73743a20 7777772e 706f7573 61646161   st: www.pousadaa
0x000000b0 (00176)   6c646569 61646f73 616e6a6f 2e687067   ldeiadosanjo.hpg
0x000000c0 (00192)   2e636f6d 2e62720d 0a436f6e 6e656374   .com.br..Connect
0x000000d0 (00208)   696f6e3a 204b6565 702d416c 6976650d   ion: Keep-Alive.
0x000000e0 (00224)   0a0d0a                                ...

0x00000000 (00000)   1201                                  ..

0x00000000 (00000)   1001                                  ..

0x00000000 (00000)   47455420 2f706c75 672e6a70 67204854   GET /plug.jpg HT
0x00000010 (00016)   54502f31 2e310d0a 41636365 70743a20   TP/1.1..Accept: 
0x00000020 (00032)   2a2f2a0d 0a416363 6570742d 456e636f   */*..Accept-Enco
0x00000030 (00048)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000040 (00064)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000050 (00080)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000060 (00096)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000070 (00112)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000080 (00128)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x00000090 (00144)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000a0 (00160)   73743a20 7777772e 706f7573 61646161   st: www.pousadaa
0x000000b0 (00176)   6c646569 61646f73 616e6a6f 2e687067   ldeiadosanjo.hpg
0x000000c0 (00192)   2e636f6d 2e62720d 0a436f6e 6e656374   .com.br..Connect
0x000000d0 (00208)   696f6e3a 204b6565 702d416c 6976650d   ion: Keep-Alive.
0x000000e0 (00224)   0a0d0a                                ...

0x00000000 (00000)   1001                                  ..

0x00000000 (00000)   47455420 2f706c75 672e6a70 67204854   GET /plug.jpg HT
0x00000010 (00016)   54502f31 2e310d0a 41636365 70743a20   TP/1.1..Accept: 
0x00000020 (00032)   2a2f2a0d 0a416363 6570742d 456e636f   */*..Accept-Enco
0x00000030 (00048)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000040 (00064)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000050 (00080)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000060 (00096)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000070 (00112)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000080 (00128)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x00000090 (00144)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000a0 (00160)   73743a20 7777772e 706f7573 61646161   st: www.pousadaa
0x000000b0 (00176)   6c646569 61646f73 616e6a6f 2e687067   ldeiadosanjo.hpg
0x000000c0 (00192)   2e636f6d 2e62720d 0a436f6e 6e656374   .com.br..Connect
0x000000d0 (00208)   696f6e3a 204b6565 702d416c 6976650d   ion: Keep-Alive.
0x000000e0 (00224)   0a0d0a                                ...

0x00000000 (00000)   1001                                  ..

0x00000000 (00000)   47455420 2f706c75 672e6a70 67204854   GET /plug.jpg HT
0x00000010 (00016)   54502f31 2e310d0a 41636365 70743a20   TP/1.1..Accept: 
0x00000020 (00032)   2a2f2a0d 0a416363 6570742d 456e636f   */*..Accept-Enco
0x00000030 (00048)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000040 (00064)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000050 (00080)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000060 (00096)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000070 (00112)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000080 (00128)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x00000090 (00144)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000a0 (00160)   73743a20 7777772e 706f7573 61646161   st: www.pousadaa
0x000000b0 (00176)   6c646569 61646f73 616e6a6f 2e687067   ldeiadosanjo.hpg
0x000000c0 (00192)   2e636f6d 2e62720d 0a436f6e 6e656374   .com.br..Connect
0x000000d0 (00208)   696f6e3a 204b6565 702d416c 6976650d   ion: Keep-Alive.
0x000000e0 (00224)   0a0d0a                                ...

0x00000000 (00000)   1001                                  ..

0x00000000 (00000)   47455420 2f706c75 672e6a70 67204854   GET /plug.jpg HT
0x00000010 (00016)   54502f31 2e310d0a 41636365 70743a20   TP/1.1..Accept: 
0x00000020 (00032)   2a2f2a0d 0a416363 6570742d 456e636f   */*..Accept-Enco
0x00000030 (00048)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000040 (00064)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000050 (00080)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000060 (00096)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000070 (00112)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000080 (00128)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x00000090 (00144)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000a0 (00160)   73743a20 7777772e 706f7573 61646161   st: www.pousadaa
0x000000b0 (00176)   6c646569 61646f73 616e6a6f 2e687067   ldeiadosanjo.hpg
0x000000c0 (00192)   2e636f6d 2e62720d 0a436f6e 6e656374   .com.br..Connect
0x000000d0 (00208)   696f6e3a 204b6565 702d416c 6976650d   ion: Keep-Alive.
0x000000e0 (00224)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f706c75 672e6a70 67204854   GET /plug.jpg HT
0x00000010 (00016)   54502f31 2e310d0a 41636365 70743a20   TP/1.1..Accept: 
0x00000020 (00032)   2a2f2a0d 0a416363 6570742d 456e636f   */*..Accept-Enco
0x00000030 (00048)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000040 (00064)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000050 (00080)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000060 (00096)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000070 (00112)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000080 (00128)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x00000090 (00144)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000a0 (00160)   73743a20 7777772e 706f7573 61646161   st: www.pousadaa
0x000000b0 (00176)   6c646569 61646f73 616e6a6f 2e687067   ldeiadosanjo.hpg
0x000000c0 (00192)   2e636f6d 2e62720d 0a436f6e 6e656374   .com.br..Connect
0x000000d0 (00208)   696f6e3a 204b6565 702d416c 6976650d   ion: Keep-Alive.
0x000000e0 (00224)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f706c75 672e6a70 67204854   GET /plug.jpg HT
0x00000010 (00016)   54502f31 2e310d0a 41636365 70743a20   TP/1.1..Accept: 
0x00000020 (00032)   2a2f2a0d 0a416363 6570742d 456e636f   */*..Accept-Enco
0x00000030 (00048)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000040 (00064)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000050 (00080)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000060 (00096)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000070 (00112)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000080 (00128)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x00000090 (00144)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000a0 (00160)   73743a20 7777772e 706f7573 61646161   st: www.pousadaa
0x000000b0 (00176)   6c646569 61646f73 616e6a6f 2e687067   ldeiadosanjo.hpg
0x000000c0 (00192)   2e636f6d 2e62720d 0a436f6e 6e656374   .com.br..Connect
0x000000d0 (00208)   696f6e3a 204b6565 702d416c 6976650d   ion: Keep-Alive.
0x000000e0 (00224)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f706c75 672e6a70 67204854   GET /plug.jpg HT
0x00000010 (00016)   54502f31 2e310d0a 41636365 70743a20   TP/1.1..Accept: 
0x00000020 (00032)   2a2f2a0d 0a416363 6570742d 456e636f   */*..Accept-Enco
0x00000030 (00048)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000040 (00064)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000050 (00080)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000060 (00096)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000070 (00112)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000080 (00128)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x00000090 (00144)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000a0 (00160)   73743a20 7777772e 706f7573 61646161   st: www.pousadaa
0x000000b0 (00176)   6c646569 61646f73 616e6a6f 2e687067   ldeiadosanjo.hpg
0x000000c0 (00192)   2e636f6d 2e62720d 0a436f6e 6e656374   .com.br..Connect
0x000000d0 (00208)   696f6e3a 204b6565 702d416c 6976650d   ion: Keep-Alive.
0x000000e0 (00224)   0a0d0a                                ...

0x00000000 (00000)   1001                                  ..

0x00000000 (00000)   47455420 2f706c75 672e6a70 67204854   GET /plug.jpg HT
0x00000010 (00016)   54502f31 2e310d0a 41636365 70743a20   TP/1.1..Accept: 
0x00000020 (00032)   2a2f2a0d 0a416363 6570742d 456e636f   */*..Accept-Enco
0x00000030 (00048)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000040 (00064)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000050 (00080)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000060 (00096)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000070 (00112)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000080 (00128)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x00000090 (00144)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000a0 (00160)   73743a20 7777772e 706f7573 61646161   st: www.pousadaa
0x000000b0 (00176)   6c646569 61646f73 616e6a6f 2e687067   ldeiadosanjo.hpg
0x000000c0 (00192)   2e636f6d 2e62720d 0a436f6e 6e656374   .com.br..Connect
0x000000d0 (00208)   696f6e3a 204b6565 702d416c 6976650d   ion: Keep-Alive.
0x000000e0 (00224)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f706c75 672e6a70 67204854   GET /plug.jpg HT
0x00000010 (00016)   54502f31 2e310d0a 41636365 70743a20   TP/1.1..Accept: 
0x00000020 (00032)   2a2f2a0d 0a416363 6570742d 456e636f   */*..Accept-Enco
0x00000030 (00048)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000040 (00064)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000050 (00080)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000060 (00096)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000070 (00112)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000080 (00128)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x00000090 (00144)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000a0 (00160)   73743a20 7777772e 706f7573 61646161   st: www.pousadaa
0x000000b0 (00176)   6c646569 61646f73 616e6a6f 2e687067   ldeiadosanjo.hpg
0x000000c0 (00192)   2e636f6d 2e62720d 0a436f6e 6e656374   .com.br..Connect
0x000000d0 (00208)   696f6e3a 204b6565 702d416c 6976650d   ion: Keep-Alive.
0x000000e0 (00224)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f706c75 672e6a70 67204854   GET /plug.jpg HT
0x00000010 (00016)   54502f31 2e310d0a 41636365 70743a20   TP/1.1..Accept: 
0x00000020 (00032)   2a2f2a0d 0a416363 6570742d 456e636f   */*..Accept-Enco
0x00000030 (00048)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000040 (00064)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000050 (00080)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000060 (00096)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000070 (00112)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000080 (00128)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x00000090 (00144)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000a0 (00160)   73743a20 7777772e 706f7573 61646161   st: www.pousadaa
0x000000b0 (00176)   6c646569 61646f73 616e6a6f 2e687067   ldeiadosanjo.hpg
0x000000c0 (00192)   2e636f6d 2e62720d 0a436f6e 6e656374   .com.br..Connect
0x000000d0 (00208)   696f6e3a 204b6565 702d416c 6976650d   ion: Keep-Alive.
0x000000e0 (00224)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f706c75 672e6a70 67204854   GET /plug.jpg HT
0x00000010 (00016)   54502f31 2e310d0a 41636365 70743a20   TP/1.1..Accept: 
0x00000020 (00032)   2a2f2a0d 0a416363 6570742d 456e636f   */*..Accept-Enco
0x00000030 (00048)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000040 (00064)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000050 (00080)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000060 (00096)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000070 (00112)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000080 (00128)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x00000090 (00144)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000a0 (00160)   73743a20 7777772e 706f7573 61646161   st: www.pousadaa
0x000000b0 (00176)   6c646569 61646f73 616e6a6f 2e687067   ldeiadosanjo.hpg
0x000000c0 (00192)   2e636f6d 2e62720d 0a436f6e 6e656374   .com.br..Connect
0x000000d0 (00208)   696f6e3a 204b6565 702d416c 6976650d   ion: Keep-Alive.
0x000000e0 (00224)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f706c75 672e6a70 67204854   GET /plug.jpg HT
0x00000010 (00016)   54502f31 2e310d0a 41636365 70743a20   TP/1.1..Accept: 
0x00000020 (00032)   2a2f2a0d 0a416363 6570742d 456e636f   */*..Accept-Enco
0x00000030 (00048)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000040 (00064)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000050 (00080)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000060 (00096)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000070 (00112)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000080 (00128)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x00000090 (00144)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000a0 (00160)   73743a20 7777772e 706f7573 61646161   st: www.pousadaa
0x000000b0 (00176)   6c646569 61646f73 616e6a6f 2e687067   ldeiadosanjo.hpg
0x000000c0 (00192)   2e636f6d 2e62720d 0a436f6e 6e656374   .com.br..Connect
0x000000d0 (00208)   696f6e3a 204b6565 702d416c 6976650d   ion: Keep-Alive.
0x000000e0 (00224)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f706c75 672e6a70 67204854   GET /plug.jpg HT
0x00000010 (00016)   54502f31 2e310d0a 41636365 70743a20   TP/1.1..Accept: 
0x00000020 (00032)   2a2f2a0d 0a416363 6570742d 456e636f   */*..Accept-Enco
0x00000030 (00048)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000040 (00064)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000050 (00080)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000060 (00096)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000070 (00112)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000080 (00128)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x00000090 (00144)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000a0 (00160)   73743a20 7777772e 706f7573 61646161   st: www.pousadaa
0x000000b0 (00176)   6c646569 61646f73 616e6a6f 2e687067   ldeiadosanjo.hpg
0x000000c0 (00192)   2e636f6d 2e62720d 0a436f6e 6e656374   .com.br..Connect
0x000000d0 (00208)   696f6e3a 204b6565 702d416c 6976650d   ion: Keep-Alive.
0x000000e0 (00224)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f706c75 672e6a70 67204854   GET /plug.jpg HT
0x00000010 (00016)   54502f31 2e310d0a 41636365 70743a20   TP/1.1..Accept: 
0x00000020 (00032)   2a2f2a0d 0a416363 6570742d 456e636f   */*..Accept-Enco
0x00000030 (00048)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000040 (00064)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000050 (00080)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000060 (00096)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000070 (00112)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000080 (00128)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x00000090 (00144)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000a0 (00160)   73743a20 7777772e 706f7573 61646161   st: www.pousadaa
0x000000b0 (00176)   6c646569 61646f73 616e6a6f 2e687067   ldeiadosanjo.hpg
0x000000c0 (00192)   2e636f6d 2e62720d 0a436f6e 6e656374   .com.br..Connect
0x000000d0 (00208)   696f6e3a 204b6565 702d416c 6976650d   ion: Keep-Alive.
0x000000e0 (00224)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f706c75 672e6a70 67204854   GET /plug.jpg HT
0x00000010 (00016)   54502f31 2e310d0a 41636365 70743a20   TP/1.1..Accept: 
0x00000020 (00032)   2a2f2a0d 0a416363 6570742d 456e636f   */*..Accept-Enco
0x00000030 (00048)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000040 (00064)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000050 (00080)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000060 (00096)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000070 (00112)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000080 (00128)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x00000090 (00144)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000a0 (00160)   73743a20 7777772e 706f7573 61646161   st: www.pousadaa
0x000000b0 (00176)   6c646569 61646f73 616e6a6f 2e687067   ldeiadosanjo.hpg
0x000000c0 (00192)   2e636f6d 2e62720d 0a436f6e 6e656374   .com.br..Connect
0x000000d0 (00208)   696f6e3a 204b6565 702d416c 6976650d   ion: Keep-Alive.
0x000000e0 (00224)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f706c75 672e6a70 67204854   GET /plug.jpg HT
0x00000010 (00016)   54502f31 2e310d0a 41636365 70743a20   TP/1.1..Accept: 
0x00000020 (00032)   2a2f2a0d 0a416363 6570742d 456e636f   */*..Accept-Enco
0x00000030 (00048)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000040 (00064)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000050 (00080)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000060 (00096)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000070 (00112)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000080 (00128)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x00000090 (00144)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000a0 (00160)   73743a20 7777772e 706f7573 61646161   st: www.pousadaa
0x000000b0 (00176)   6c646569 61646f73 616e6a6f 2e687067   ldeiadosanjo.hpg
0x000000c0 (00192)   2e636f6d 2e62720d 0a436f6e 6e656374   .com.br..Connect
0x000000d0 (00208)   696f6e3a 204b6565 702d416c 6976650d   ion: Keep-Alive.
0x000000e0 (00224)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f706c75 672e6a70 67204854   GET /plug.jpg HT
0x00000010 (00016)   54502f31 2e310d0a 41636365 70743a20   TP/1.1..Accept: 
0x00000020 (00032)   2a2f2a0d 0a416363 6570742d 456e636f   */*..Accept-Enco
0x00000030 (00048)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000040 (00064)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000050 (00080)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000060 (00096)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000070 (00112)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000080 (00128)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x00000090 (00144)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000a0 (00160)   73743a20 7777772e 706f7573 61646161   st: www.pousadaa
0x000000b0 (00176)   6c646569 61646f73 616e6a6f 2e687067   ldeiadosanjo.hpg
0x000000c0 (00192)   2e636f6d 2e62720d 0a436f6e 6e656374   .com.br..Connect
0x000000d0 (00208)   696f6e3a 204b6565 702d416c 6976650d   ion: Keep-Alive.
0x000000e0 (00224)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f706c75 672e6a70 67204854   GET /plug.jpg HT
0x00000010 (00016)   54502f31 2e310d0a 41636365 70743a20   TP/1.1..Accept: 
0x00000020 (00032)   2a2f2a0d 0a416363 6570742d 456e636f   */*..Accept-Enco
0x00000030 (00048)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000040 (00064)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000050 (00080)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000060 (00096)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000070 (00112)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000080 (00128)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x00000090 (00144)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000a0 (00160)   73743a20 7777772e 706f7573 61646161   st: www.pousadaa
0x000000b0 (00176)   6c646569 61646f73 616e6a6f 2e687067   ldeiadosanjo.hpg
0x000000c0 (00192)   2e636f6d 2e62720d 0a436f6e 6e656374   .com.br..Connect
0x000000d0 (00208)   696f6e3a 204b6565 702d416c 6976650d   ion: Keep-Alive.
0x000000e0 (00224)   0a0d0a                                ...

0x00000000 (00000)   1001                                  ..


Strings
.
.
h
.
.
L. 
u.
BBABORT
BBALL
BBCANCEL
BBCLOSE
BBHELP
BBIGNORE
BBNO
BBOK
BBRETRY
BBYES
DLGTEMPLATE
DLLS
DVCLAL
MAINICON(
MIDAS
MIDAS1
PACKAGEINFO
PREVIEWGLYPH
TFORM1
TFORM2
!)>]:=
.,-+*(
&"^` |
00&&,,
<0044HHL;
00FQFd
&01cww
{01Ucp
04tDZ:S
08$p="
#08t(t=D
0hgZE[g
0h[(y^p
-0@(J[`
_0p_#+
0Qw[arf
-\0TR*F
0[U :M-A
0Um/y59^
0UxOXQ
0YTAUAH
0Z>8|+
!!11A-
<11WzYEn^
12UzD=j
*13Do@Y-
1-8E?L1
(1dqr3\
:1GxMj
1HR*aV
1HXV/t}U*X
)1iq/7f
?1iuwOD	
1[[J79
]1>jJxW
1KW&+&
>1m&H J
{1oKUi
1P1RA^
,1$"pL~Ztz(@
|1p!=o
1`q-'A
(1;QOp
1vm:o\
 1Z1&\
-2*::>
26t,4d
294:S^
2b7s:M
>\2'C"
2D"'<v%@
2f0'Ru
]2gZzQ
2kk|HM
;2KsxmT
2kWV6R/
2lOU,9
2nAY8U/
2oPM|oe
&:-2P%
2pi *v
` 2r}\
*?2]]RC
2wg	bH
/#33KK
]^34Z+Ex!z
3`9Car`
3BZtuu
/>3F//K)
<,<3/I
3kJ?1%
3lK&VU
3lX?bpr)
?`3M{:
3o"8kS
3pMV?KN
3.,r=0 
3;Rwg"Kr
3Sl?a4
&|3=x'
3zSA~+
4(3E\y
43 {m?lZ
43v>XKbH
45)r[|
49\C%9
4,a}/6
^4D&lh
;4fV	:O
`4.fZJ+
4Jym]p
.4{p2{
4)-$.[~T5>
4TOV#=_
4>=vH*
!4Vx[G|S
4YcL/x
5`{*@"
.-55}l
 5~6gz
,,5A:'
.5c3#P'
5FE}Y;
'5[g~&
5ha}_8
(|`5k%
5$'ke`kQ
5MATz\
5N4uAw
5#O"p\
5Qm5S]	
]5@q	W
-5=T'Qb
*,"5"u
 5>)!W
'.5x{h9
~5	y#g$
6%fmn%%(
6^fySMeK
#6	=G",0
6Iz)+5
?6n4kW
6nT @I 
6O#ut2UM-
6!QHC&x
6t4{T,
#6UEEmm*	
6u"Es.[
6X}rm?
7/0U@CD3(
_72MWdZhA
@7'80.
7'Bd@$
#[{7	c8
7cPT1G
7E	#5%
(7H_s`
7j_9]"*d
7,m[6.P
7o	4p1
7SK?>DT[S
7squ'.
7}T=ly
+7vUt#i
&7W@s)
	82I3s
84HsQy{
8|D'!11IIBD
8lKO^0
8m>nh&
8O%2t^TW
8p<L_b
8&q(_1A
8SkW#t
(8$vqLo
+8VWU#<
%8w5T)y
8wGA	@
8xj #	p
~!98}2
9cI'*7L&{
	$`9Ecm_
9`g246+
9kCj1O
9Mpd\&
[.9n!w
9R}Mmn`
9r>~=qt
9s2pPi
-#9?s?v
9UnKqw[
9wCPo"
?+9Wm[
{]?a)'
'^!A1C
)a1Ch_
_$*a6q
=[.A7B
AAk|Y]
Ab6Y -
!AbO=@^Pn
#%?&`AD
aDSm-	v
A((eX4
]afItc
*A+HV&
(AkK\B9
al5xft
AlKcF#
#aL"{y
A:!{nmr
-aO3J%D
A;]o/z
,&A^)P
|.-AP1
Aqqii!
arrCC3
;,a$T&CE
]au GR*
A#x'dnVDB
a{X*\qF
AY/v,S
A~yW4.Q
Az<rqLc8)Nz
B$,:; 
`B0T9(UG+@@@
b1$m?.
'B+	6[
B8Sj`z
b9UOg@#z
B!`BvL
(bcGdt,
}}.BD^
/b(dDi
^BE0:>
.B,$Ft
BgdS2+
bG]GNg
 bG!kfb
bGk/Yz
bGwxq<
&B-hkN
bI?`4w
!+biiPP
^b\JID
b'KU8B
b!#L/q
b@?MeE
bp |Tm8*
B&tA.%
{bt>Y,
'b-#U$
B'Ujn?
(bUY"@
bV1mh?E#
B+vz$Z
Bw=ZVAXt$
bz1?k\
'@_#C-
{#=>@C
#%+*C	
	!&.>C
'c6LJf
c^7khP
C[8I`1
CA6@LZ
-/CaDp
cB$Whz
C%	_C*
 ccG[X
.ccp3p
?.ccpt3
_%CcY7
|cdk](s
	cEblt
c@'fn@5
cG2Y{0|
<cHHm%
CH+Kvl
Ci'3_M
;C<kew
c__KKGGDB
CkUXjF
c{MgND
cmY.aB
Cn9k-;
|cN_Pps
<C|QI4
CrE&'q
c<)S,,
}Cs[9qhzi
CsFb[|
CUEENg
C_u%xH
CUZpMCVny
-%CvA-
\C vqZ
cx6_-`
[!.cx9bY
CZJJig
+,-D<;
+&d06$$
;d07i<
^d;1")
D]{>1X
d3:j\F~
,D4/?cB
=D$7qL
?d8Bs3E
d95m#b
D}`Aob*
Db6?e'
DbhdS!
^dC0P0 Z-
dC]KgF
\DDJJppxx
?D#fR8
Dfy,u]
-Dgqii
:dhB z
Dh%P93
%dI2#{4
	Diecv~S
d=@J0=
%	^dj5
,dK_0D
d^<&me
dNn<pc
d~oh" '
dqS! 6
dSLe,\,Q
d|:`'*ts
	>durJ7K
Dvd -;v
\D)vQt^
D/y}R1.
_&	DYT
'e3!7^K
<E3U1d|
E5;xa@
=E7QV+!]
"EarY,
e/,aZ	
E;C3C$8
^E]clbY5
e[C/mi;DC
?.edatK
,%eG40v
,e!gd*
ege!zYf>V
E!]Gx%
E hkX2Qs
ei)5Uh
eIN	J{
EJ9F?n
<e@l,K/8aT
eLV+95
(e~	M^
Eoo84>X
e[PgeLD
*eP<!p
ERD{7~
?E.r'r
e,tV-m
Exgk)J
e=X	xjK*R
*""Eym
E"Zb%u
:	f6{J=
*F~Ac`_
(`*fah%
FatalExit
f)b2r<#p
Fbcd|j 
Fc'$vq-
fEvU0{=l}kz
F-F~Cb
FfY:'}
fG!aHac
{fjyz'G
f|k<4?
flj1les;.
flQZ^#
f	np6.i(
	+fP/H,
FQs097
F|rC2)t
f	R-oY9
]fuKk?
^f@vjm9#
F$#vv/
/Fy@;U
<fzhu^
@g>|=}
G1 `|(:
G 4bUu
!G5HQ-=
/'g7uk
g~8b,P
G8dd||
g8XQQ7
ga Z[h{
G%Dhf_
GfJM)v
g.fUJ@
g#;f%V^
gfZXY[
?=GHjy.
GJwR;|F
|,gL\t
G)M2~s
'gn)cP
$GO4F#+
G`?,Q1!U3"U
gS3~US
"g_TJ3 
GyhXs	
h0MTP 
h4ELKub
h79KS{
H7@gF6
>h9Q^6[
"haZTz
HBcojs
H`[__ccoo{{;$
H*D/?rZ
\$hE^%\
H\gl9D
hHU{8E
HiTG)}T
HiY)XQ"
hJAWI7i
\\hjp,.,[
Hk^1-;g
h%ks3m
)h,ls"D
hmOE=c?
h-@msG
}>HNt~
hoJEqz
H$o;|P'
h\\PPDD
,H	]q&
hRi?!OU
HRUxr}Y
^HsE-XC
h+tc"!
[H:u.?
Hu-\pG
/hv^12
+H(.WE
HWG|kX
/HWgYGyJ
('hx1=
hx&Y`aG
_"<*!=]'*I
_}i{;4s
(i5Dxf
I	 +_?5s
~i\6MJB
I8!JD6
'_i#9dhj
IbBM O
IB@%sG
?id_aK
.idata
I`!*&dK
;:^?idT
!iES)7
?~'i"G}
iH1&kb
IHD ]-
ihMGE.
ij}L+Y
I=>JnU
IkadrK
il |uN
IM\u{E
,in@.=
IN]1hda
iNR``w
,@?ip)
I`?P1nz
IqX)`^
IsB`~N[
is	i>n|H
ix{TqU"[
IYYaav
izjVr;
J}0'fD
J\3q%e
j6UWb"
Ja}c\g
|J.Axu
jb b$C
+j-eeG>x
jE(;PWad
[!*_jg
JgLzFg0C
j~G`<Pv
/JHjkL
JiUNPi
jj&?5fm^
Jki{P,.]W>
jL#?uf
j(NaY(E%
<jnpNb|
JpDT;j
~~JpTb
>/.J-%R
JRk)hou
jr&?V6
js N5$
Jt6yd`
j}u0px
_*jU&D
J :wDf
[JWR$f_Z
j*<x1?
}j_y./
JYf=W-N
J/ylrQ
/K=0fn
K.1J$C
k1l@A7
k|aQ|_Wn
kbA1P5 `@0@@@
\kBAe`
K:b^za
K-	<<C/
k=\c2"
[?K=cF
KdRPp,
*~~#&KE4
%kEcFG]?
kernel32.dll
KfDD*`
KGn~AN
?}kItn
KJ>uM]
#K)ke4
KkVT\*
K@L~r1
KM}\&n[
?Kmt/G
kN&a$OVt?
 kNjfR
K%}Oc)
k;:sR	T1
(Kw:2g#
KX	Xz#
)&[kyh
`[)".L
L>2u<~h
;_L3c)
l"4UD=
L9py&/
L,:aep>
l$bTYt
]l"Bw2
le1y72
lE<sf2U
lEtoe|
Lf!)`}
l[Fc@f
l FP&E,;QB
l]!fuG
LGJ}7<1m
lH5aDsH
L~Ig5Q
^L|L7=D
<LLddG
.L]:ll
l+LW#/
l`-lyT
Lm,&~O
[LnKb\
}L{np39
l[rv)S*
>$lSmA
!(lszp
LtsXm]
,l{['.U
lx"_%%
LXs-hiL-
lYa#Lh8v
@LYg		
ly{	L)
l(zhp;J
m0N*C?
`m1\K"
m4$Ljb
M6m#aN
{MAIaa}
m:aZJz
 :M-B;
m@	[C9d
M)_dow
Mf6:(Sm
mgBVwl3
mhn-PEj
MHvZ`*
MH<wFv
MHYDdk
Mi^0UG
mITxen
'-ml*-
mLg<.H
M<L+p2
?m/LUcCl
m<mB"<
mmdd__
m'MjHPO
MO>lQ<2
mPHL]7
M!PX+x
M'qJFu
M`R^=2
ms]1~i
mT)>,A
MTw1hA
<mu~"DL
M~Un]Ug
mU-x=^
mU>Zx D
MV2CyR
mwJaSv
Mx5't0
mY2Ql0
<MY(BaO/
mY-[;G
mYtKp0
myUD=~
%mywmH
MZpHU$
"n!?)&
	!"<N^^..>(
N3(g#R-
n3Y`6.31
N5Q3(= 
N:5Y2g
#\}n6*
\n6l74
^;n7I?
N8QS0|,
n(9lUl
_na^1 
N+axJw
)n&cav
N\C,$G!
ncG(WwO
[Nc`h(
)n)^c+j
/nD-,P@
;n|e 0
n`EFZ<x
N{^f1g
],{NfR
nfT7R	
NHn|h_
n$I?h[8
nj?16G
n	=n}+
&nNB7m03
N|,NM<&	
N<O,=g'0[i
Np6I[_
N#PD<!
NQ"jo4
:(N	Qnj
}(,nSj
nsNvGf
ntl_g?
NU#D$)
/`nWj[
%_n=X+
'nXh.%NN]
?{NyrV/j
o.01(3B
{O:4sjq
o	 5RA@
o8"Cc=
oA^@8<
	/Oa[jUa
oA[ZMf
OB(NPJ
OBrrjj
Ob%s9q
oc<[Ine
oeRe*5
o^[Fk6
oH!0=9
$)OIptr
Oj]pq)
.OJqO+
OKs!|o
@O()lN
o~[M0,S(I
{_{O"o
O[<os@
O}P:U}
[O=q7%
Oq&'.U
orUGD*
OtQn@^Vc
ouoi{K,
O	_Xye=
OY8QW70
oyI7JZ
?o>*yND
^@;{/P_
*,P3~n2
p67`CY
P6AZjA
\p7#%]:RY
?p9kvz
=]>pcg
=\p>^D
pF>G>8
PGR?R$
pgu{;,{
PHH#CL=
p&hHqS
P-(N@bos"
'?}%Po
<?P`p06q
,)PQr?
}Pq(vJo
pTKM{EQ
p'TS 0
P=vk4@
PYU0u$
p/zO7$|
PZ	Xxe
  ~Q^/
*]{Q[`
Q0M)bVr
'Q1jL#
q>1O&1
Q2A<vf
~'q3cZ
Q4aimYu
q4v!#&,o
Q@5&z:
}Q6uWV
qa}fkpf|
;Q|b-AB"
`[q!.c
!Q>C+~
qF~,=-
$qf9W~
QF*sJ"
@Qg(1'
QGK0F!
qGW.m4
qHg6\75:
`=:{QI
QiX.t#sa
@[Q|K\
qkG?x+
Q<\<K<i>yn
QKy1/E
qLI$O(9
q;L}|R\
\,QN"?
]QQEEM9
$q	q}K
_=~~qQP
qSyzm?
qtC]w7
QW D'Y
@QZ.8Y
\R:#" 
r&0i5F
r0jJXw
R]1LET#
r1R-xK
R5_~q,
r-5skG
R-}71S
|_}r7=N
R+8>&P
\RAJO#
r\#aWkQ
rb8E_Tu
rbbZ!$
R]B(Ef
R|]\bm	
:RBPBv
R^bs`7
rc.M}@m
rcQ0um
Rd,><#
R	#ega
=rG)#Z
RH/0`sY
/r)i7u
R;}+iwG
rLB:1%$
@rMK2[
RNXeHE
R@q\+|
):_<rqLc8
?rsrct;
?.rsrtC
="rs{`z
ruiiBB
ruv],x:M
rYbaO}2
rYt}{#
|R&zTA
s2gl*k
S'6{Ek
S:6t<,
S:,@	-7
S7mrN 
-s8;7O
(S/9<,
sB322x
:=SBku7
S$CxDaG
Sdj[Ip
SFh1:e
sgeuZd
S >gN;v
SG+P1&sZ
SH;85r
shiTf?6
s$hPsT
SIT9wfa
&S J,	
~SjLDV
SK!>r4@
sLV|m{.
S,_Mz-P
s;ns&*J.Mh
S%ot#Ym
@Spzt|XF
sRljZB
#Sr,uBB9
Sr~w'#
s rY(v
SSOO;;
/;;SSWW
SV>#2>
Sw@|0.
SxC<\`
& S)XCbW
SX_da#JL%
sZneZE
S:zYI<^A
szZ)on
t:_,-+
t6jfsCJ9i`
t,8|D?
T(8	y.U+
/&}t$a
{tAlU<5
tc3ZK!d
;t=eH*b
Tgk-rS?|t
TGz\if
This program must be run under Win32
T=]`?i6
%tLb>0
(t(Ld')
`tn]RVYng
TOL'-5
TouhZ\
Tp%8nC(
tp` [dA0
tPK48}
TPk^#k
TP,z]y
trqL+(3
_ts	`^
tT7a+7%gH
T]T(V~M]
%)TtX[Z
T}U1wh9jg
t[u:F*
tun7*z
Tw0w$Ss
!#TX7Uau
 t]Xlp
;t{xs*N
T%YQKp>
T/z=2:
!u<##**
."U5i{
-u,/5M"t
+U	6~.
u7bq-2
u{7du+
U\*89v?
u99O9a
@_}uaA
|%UAC.f
ub`(C@
^u	BoF
udFO-B=
	U)~fJs
'.>>ug
uG%6|f
[uHlHm
((.Uie>`
u<LVqT
um7N$"
UnOS%:
U	`N}Y
up{I4+
#[UqKUg
Uqp(}L
!UU#3g
UU[[AAwG
UU}}!D
\UUNNGG
.u@w`g
U>.~|x
/?UX\p
U~[xZ}
~u$ZT\
>v!;`\
V1i869
"V9K;m
VAA8844f!B
>-va\V
V\c:SVO
~;<vdp
VEnz1^3
Ve+s{c^
v@FXz>
vh_7'K[k
vH%fcR9
#vHj2X
vJTlYnH9
.v {l_
vLDUUc
v:&Lf0
vM?6/M
?vo+F1
v,qaBN
+v:(Qc
|['vqM$e
#VrNe4
,Vr]p'
VT|HaSb
V,tz]q2
:Vuy**
?VWcM,@_
Vw,rJX
vx.~9=
VyE~:b
v"zEL*
W+[1/.
|W[11:
_-W5'u
W77Ft/
W7;.tbt
W,7^[y
w@8.!D
\WAR*e
WB		k1
[WEX;2[
W#f-G)+
WF;PZ(
&+WH{2
W$H:gZ<
wH	N?ZA
?WhZS8%@99
wJ21kU
WJXSUB
WK=8z*e
Wk/ii8
`|wL[Ok8
w*mLEm
W>mTu+>
 ;wn<d
W-N+:z
Wo)`#F
`WPPsLx
wR^8D>
Wrh#J?O
wRnlW'Aj
ws:S~1
*WTH`7)
wtN3=d
:+	wT-O
w}+t>p^
(.>W^v;
w[%v;H
w%@~<VQ
(!wvqL<
www'G_
W}xt9^
!$"`x 
} x\;|(
X??]0v+;
X1/fU6
X@{3^o
.XComp
.Xd~):-]
xg7V*F
&x~Gl_
xkAX	YU
XkSQQp
xl}pooC3
X^NN&&
xN\_q0
^X#o=_a
X'OOo-
^X+O<R
xp!oY.!T
xqk~(\
x+QlFl_yF
X;q$M,
Xq}}	n
;xTgpy
Xt>\hq
XtrqL+(cm
xVr#xC5o
XW<E9YM
X@w@Y`
.X,]XA
xXXTTT
XYil!	
Y6C}m,
Y&Adt 
yB7fV5cI&(
yBXfBt
 YC{`RH
YdeFzx
YEiai:F
y eiVw 
YGEL1{r
/y.=ip.
Ylnz|z
>y_oO6
`_yoTK(
ypji)D>
YQ5LfG
,-YQkvt
yr.OVM
"y`/sj
ysOq{RV'
:/yTj2
 ^YV5r
yvblg"
y}wdB:
'yw/ur.&
}y{xg%
y_X_t+v
y.Y4N+Q
yyD->/
\%`_z(
Z1i8JK
z1w'Q(if@
z`%3)fo
z$?a3M2
zaX9CO
Z{_cr$
}Z_;E97
ZeQ_+tt
zfA7:5
}Zfo 	r
zGueecI
-!z<.h
z(hN]]
zJ.qaQ
zJ.qtD
zm`QQQ
Z@Na~n
zNJ%[8
Zn{QO-s
z>P"FuS
?@	ZpY
'zrdw#
Zs 530
Z;vJ*J
zX-6E+
_\ZYac
Z(yk~s