Analysis Date2015-01-16 02:28:52
MD5974fe8909a6fa767e97bdc8e54d51620
SHA17d9d68280da0e699893d24eba42e59e62e06e4e9

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 856b32eb77dfd6fb67f21d6543272da5 sha1: 6597c511c2ee72f68f5246460f0683dae16dcade size: 24064
Section.rdata md5: dc77f8a1e6985a4361c55642680ddb4f sha1: 3d397ee25b2dd83ab741c67375880151cae94ed8 size: 5120
Section.data md5: 7922d4ce117d7d5b3ac2cffe4b0b5e4f sha1: 4e56bb1994226ae0285c7adee470777262de2c99 size: 1024
Section.ndata md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Section.rsrc md5: d338f2ed9b603b5b2167b4d054076975 sha1: a0ce4630c664b28531852b2cc208c2f00e52f048 size: 30208
Timestamp2009-12-05 22:50:52
VersionLegalCopyright: BEARPC精选软件集
ProductName: 愤怒的小鸟
FileDescription: 愤怒的小鸟PC汉化版
FileVersion: 1.0.0
CompanyName: www.bearpc.net
PackerNullsoft PiMP Stub -> SFX
PEhashcf2688d6dc103910ca674261590fb8f4a1634b0d
IMPhash7fa974366048f9c551ef45714595665e
AV360 Safeno_virus
AVAd-Awareno_virus
AVAlwil (avast)Dropper-gen [Drp]
AVArcabit (arcavir)no_virus
AVAuthentiumno_virus
AVAvira (antivir)no_virus
AVBullGuardno_virus
AVCA (E-Trust Ino)no_virus
AVCAT (quickheal)no_virus
AVClamAVno_virus
AVDr. Webno_virus
AVEmsisoftno_virus
AVEset (nod32)no_virus
AVFortinetno_virus
AVFrisk (f-prot)no_virus
AVF-Secureno_virus
AVGrisoft (avg)no_virus
AVIkarusno_virus
AVK7no_virus
AVKasperskyno_virus
AVMalwareBytesno_virus
AVMcafeeno_virus
AVMicrosoft Security Essentialsno_virus
AVMicroWorld (escan)no_virus
AVRisingno_virus
AVSophosno_virus
AVSymantecno_virus
AVTrend Microno_virus
AVVirusBlokAda (vba32)no_virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FileIQIYIsetup_l_spl004@kb010.exe
Creates FileBF-BFVCenter[[AB027]].exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\nsg2.tmp\System.dll
Creates FileOfficeAssist.0405.80.1119.exe
Creates File1
Creates File1.rar
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\nsg2.tmp\ExecCmd.dll
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates FileC:\Program Files\3.ico
Creates FileC:\Program Files\1.ico
Creates File9377mycs_Y_mgaz2_1201B.exe
Creates FileSoHuVA_4.3.0.1-c204900003-ng-nti-s-x.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\nsg2.tmp\inetc.dll
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates FileMM-liao8302.exe
Creates Fileyx_dts.exe
Creates FileFunshionInstall_C70699.exe
Creates Filesetup_95165069.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\nsg2.tmp\Base64.dll
Deletes FileBF-BFVCenter[[AB027]].exe
Deletes File9377mycs_Y_mgaz2_1201B.exe
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temp\nsg2.tmp
Deletes FileSoHuVA_4.3.0.1-c204900003-ng-nti-s-x.exe
Deletes FileOfficeAssist.0405.80.1119.exe
Deletes File1.rar
Deletes File1
Deletes FileMM-liao8302.exe
Deletes Fileyx_dts.exe
Deletes FileFunshionInstall_C70699.exe
Deletes Filesetup_95165069.exe
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temp\nsa1.tmp
Deletes FileC:\Program Files\3.ico
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\9377mycs_Y_mgaz2_1201B.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\9377mycs_Y_mgaz2_1201B.exe"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\MM-liao8302.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\MM-liao8302.exe"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\BF-BFVCenter[[AB027]].exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\BF-BFVCenter[[AB027]].exe"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\yx_dts.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\yx_dts.exe"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\setup_95165069.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\setup_95165069.exe"
Creates Process
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\SoHuVA_4.3.0.1-c204900003-ng-nti-s-x.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\SoHuVA_4.3.0.1-c204900003-ng-nti-s-x.exe"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\OfficeAssist.0405.80.1119.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\OfficeAssist.0405.80.1119.exe"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\FunshionInstall_C70699.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\FunshionInstall_C70699.exe"
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Creates Mutex1.ico
Winsock DNSint.dpool.sina.com.cn
Winsock DNSt.cn
Winsock DNSmmliao.jianting.net

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\OfficeAssist.0405.80.1119.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\OfficeAssist.0405.80.1119.exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\9377mycs_Y_mgaz2_1201B.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\9377mycs_Y_mgaz2_1201B.exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\FunshionInstall_C70699.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\FunshionInstall_C70699.exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\yx_dts.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\yx_dts.exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\MM-liao8302.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\MM-liao8302.exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\"

Creates FileC:\Program Files\1.ico

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\BF-BFVCenter[[AB027]].exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\BF-BFVCenter[[AB027]].exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\SoHuVA_4.3.0.1-c204900003-ng-nti-s-x.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\SoHuVA_4.3.0.1-c204900003-ng-nti-s-x.exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\setup_95165069.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\setup_95165069.exe"

Process
↳ Pid 0

Network Details:

DNSint.dpool.sina.com.cn
Type: A
180.149.136.250
DNSt.cn
Type: A
114.134.80.138
DNSmmliao.jianting.net
Type: A
122.227.42.227
DNSc01.i06.arnic.hadns.net
Type: A
58.220.2.5
DNSc01.i06.arnic.hadns.net
Type: A
113.17.184.10
DNSc01.i06.arnic.hadns.net
Type: A
121.10.117.139
DNSc01.i06.arnic.hadns.net
Type: A
183.56.172.47
DNSc01.i06.arnic.hadns.net
Type: A
222.186.20.122
DNSdown.fspcdn.com
Type: A
182.118.38.50
DNSdown.fspcdn.com
Type: A
182.118.38.51
DNSdown.fspcdn.com
Type: A
221.204.189.11
DNSdown.fspcdn.com
Type: A
221.204.189.12
DNSwww.fengzhangyu.com
Type: A
223.6.254.23
DNSdownload012.rdb.cnc.ccgslb.com.cn
Type: A
218.60.107.12
DNSdownload012.rdb.cnc.ccgslb.com.cn
Type: A
61.179.105.147
DNSgnop008.tlgslb.com
Type: A
116.10.187.120
DNSgnop008.tlgslb.com
Type: A
116.10.187.121
DNSgnop008.tlgslb.com
Type: A
116.10.187.122
DNSgnop008.tlgslb.com
Type: A
116.10.187.110
DNSgnop008.tlgslb.com
Type: A
116.10.187.111
DNSgnop008.tlgslb.com
Type: A
116.10.187.112
DNSgnop008.tlgslb.com
Type: A
116.10.187.113
DNSgnop008.tlgslb.com
Type: A
116.10.187.114
DNSgnop008.tlgslb.com
Type: A
116.10.187.118
DNSgnop008.tlgslb.com
Type: A
116.10.187.119
DNScdn.coop.baofeng.com
Type: A
218.60.99.66
DNScdn.coop.baofeng.com
Type: A
58.20.193.222
DNScdn.coop.baofeng.com
Type: A
119.188.72.240
DNScdn.coop.baofeng.com
Type: A
122.142.74.12
DNScdn.coop.baofeng.com
Type: A
182.18.51.104
DNSopt.xdwscache.glb0.lxdns.com
Type: A
8.37.234.3
DNSopt.xdwscache.glb0.lxdns.com
Type: A
8.37.234.4
DNSopt.xdwscache.glb0.lxdns.com
Type: A
8.37.235.2
DNSopt.xdwscache.glb0.lxdns.com
Type: A
8.37.235.3
DNSopt.xdwscache.glb0.lxdns.com
Type: A
8.37.235.5
DNSopt.xdwscache.glb0.lxdns.com
Type: A
8.37.235.6
DNSd.qq66699.com
Type: A
DNSneirong.funshion.com
Type: A
DNSwdl1.cache.wps.cn
Type: A
DNSdl.nx5.com
Type: A
DNSdl.baofeng.com
Type: A
DNSxiazai.9377.com
Type: A
HTTP GEThttp://int.dpool.sina.com.cn/iplookup/iplookup.php
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://t.cn/RZIvJQB
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://mmliao.jianting.net/mmliao/MM-liao8302.exe
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://d.qq66699.com/yx/dts/sqft/905848/yx_dts.exe
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://neirong.funshion.com/software/files/silent5/FunshionInstall_C70699.exe
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://www.fengzhangyu.com/N2Q5ZDY4MjgwZGEwZTY5OTg5M2QyNGViYTQyZTU5ZTYyZTA2ZTRlOS5leGU=/40.html
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://wdl1.cache.wps.cn/wps/download/OfficeAssist.0405.80.1119.exe
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://t.cn/RZII9Xg
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://dl.nx5.com/apk/20141222/setup_95165069.exe
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://dl.baofeng.com/BFVCenter/BF-BFVCenter[[AB027]].exe
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://xiazai.9377.com/20150105/9377mycs_Y_mgaz2_1201B.exe
User-Agent: NSIS_Inetc (Mozilla)
Flows TCP192.168.1.1:1031 ➝ 180.149.136.250:80
Flows TCP192.168.1.1:1032 ➝ 114.134.80.138:80
Flows TCP192.168.1.1:1033 ➝ 122.227.42.227:80
Flows TCP192.168.1.1:1034 ➝ 58.220.2.5:80
Flows TCP192.168.1.1:1035 ➝ 182.118.38.50:80
Flows TCP192.168.1.1:1036 ➝ 223.6.254.23:80
Flows TCP192.168.1.1:1037 ➝ 218.60.107.12:80
Flows TCP192.168.1.1:1038 ➝ 114.134.80.138:80
Flows TCP192.168.1.1:1039 ➝ 116.10.187.120:80
Flows TCP192.168.1.1:1040 ➝ 218.60.99.66:80
Flows TCP192.168.1.1:1041 ➝ 8.37.234.3:80

Raw Pcap
0x00000000 (00000)   47455420 2f69706c 6f6f6b75 702f6970   GET /iplookup/ip
0x00000010 (00016)   6c6f6f6b 75702e70 68702048 5454502f   lookup.php HTTP/
0x00000020 (00032)   312e310d 0a557365 722d4167 656e743a   1.1..User-Agent:
0x00000030 (00048)   204e5349 535f496e 65746320 284d6f7a    NSIS_Inetc (Moz
0x00000040 (00064)   696c6c61 290d0a48 6f73743a 20696e74   illa)..Host: int
0x00000050 (00080)   2e64706f 6f6c2e73 696e612e 636f6d2e   .dpool.sina.com.
0x00000060 (00096)   636e0d0a 436f6e6e 65637469 6f6e3a20   cn..Connection: 
0x00000070 (00112)   4b656570 2d416c69 76650d0a 43616368   Keep-Alive..Cach
0x00000080 (00128)   652d436f 6e74726f 6c3a206e 6f2d6361   e-Control: no-ca
0x00000090 (00144)   6368650d 0a0d0a                       che....

0x00000000 (00000)   47455420 2f525a49 764a5142 20485454   GET /RZIvJQB HTT
0x00000010 (00016)   502f312e 310d0a55 7365722d 4167656e   P/1.1..User-Agen
0x00000020 (00032)   743a204e 5349535f 496e6574 6320284d   t: NSIS_Inetc (M
0x00000030 (00048)   6f7a696c 6c61290d 0a486f73 743a2074   ozilla)..Host: t
0x00000040 (00064)   2e636e0d 0a436f6e 6e656374 696f6e3a   .cn..Connection:
0x00000050 (00080)   204b6565 702d416c 6976650d 0a436163    Keep-Alive..Cac
0x00000060 (00096)   68652d43 6f6e7472 6f6c3a20 6e6f2d63   he-Control: no-c
0x00000070 (00112)   61636865 0d0a0d0a 76650d0a 43616368   ache....ve..Cach
0x00000080 (00128)   652d436f 6e74726f 6c3a206e 6f2d6361   e-Control: no-ca
0x00000090 (00144)   6368650d 0a0d0a                       che....

0x00000000 (00000)   47455420 2f6d6d6c 69616f2f 4d4d2d6c   GET /mmliao/MM-l
0x00000010 (00016)   69616f38 3330322e 65786520 48545450   iao8302.exe HTTP
0x00000020 (00032)   2f312e31 0d0a5573 65722d41 67656e74   /1.1..User-Agent
0x00000030 (00048)   3a204e53 49535f49 6e657463 20284d6f   : NSIS_Inetc (Mo
0x00000040 (00064)   7a696c6c 61290d0a 486f7374 3a206d6d   zilla)..Host: mm
0x00000050 (00080)   6c69616f 2e6a6961 6e74696e 672e6e65   liao.jianting.ne
0x00000060 (00096)   740d0a43 6f6e6e65 6374696f 6e3a204b   t..Connection: K
0x00000070 (00112)   6565702d 416c6976 650d0a43 61636865   eep-Alive..Cache
0x00000080 (00128)   2d436f6e 74726f6c 3a206e6f 2d636163   -Control: no-cac
0x00000090 (00144)   68650d0a 0d0a0a                       he.....

0x00000000 (00000)   47455420 2f79782f 6474732f 73716674   GET /yx/dts/sqft
0x00000010 (00016)   2f393035 3834382f 79785f64 74732e65   /905848/yx_dts.e
0x00000020 (00032)   78652048 5454502f 312e310d 0a557365   xe HTTP/1.1..Use
0x00000030 (00048)   722d4167 656e743a 204e5349 535f496e   r-Agent: NSIS_In
0x00000040 (00064)   65746320 284d6f7a 696c6c61 290d0a48   etc (Mozilla)..H
0x00000050 (00080)   6f73743a 20642e71 71363636 39392e63   ost: d.qq66699.c
0x00000060 (00096)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000070 (00112)   4b656570 2d416c69 76650d0a 43616368   Keep-Alive..Cach
0x00000080 (00128)   652d436f 6e74726f 6c3a206e 6f2d6361   e-Control: no-ca
0x00000090 (00144)   6368650d 0a0d0a                       che....

0x00000000 (00000)   47455420 2f736f66 74776172 652f6669   GET /software/fi
0x00000010 (00016)   6c65732f 73696c65 6e74352f 46756e73   les/silent5/Funs
0x00000020 (00032)   68696f6e 496e7374 616c6c5f 43373036   hionInstall_C706
0x00000030 (00048)   39392e65 78652048 5454502f 312e310d   99.exe HTTP/1.1.
0x00000040 (00064)   0a557365 722d4167 656e743a 204e5349   .User-Agent: NSI
0x00000050 (00080)   535f496e 65746320 284d6f7a 696c6c61   S_Inetc (Mozilla
0x00000060 (00096)   290d0a48 6f73743a 206e6569 726f6e67   )..Host: neirong
0x00000070 (00112)   2e66756e 7368696f 6e2e636f 6d0d0a43   .funshion.com..C
0x00000080 (00128)   6f6e6e65 6374696f 6e3a204b 6565702d   onnection: Keep-
0x00000090 (00144)   416c6976 650d0a43 61636865 2d436f6e   Alive..Cache-Con
0x000000a0 (00160)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x000000b0 (00176)   0d0a                                  ..

0x00000000 (00000)   47455420 2f4e3251 355a4459 344d6a67   GET /N2Q5ZDY4Mjg
0x00000010 (00016)   775a4745 775a5459 354f5467 354d3251   wZGEwZTY5OTg5M2Q
0x00000020 (00032)   794e4756 69595451 795a5455 355a5459   yNGViYTQyZTU5ZTY
0x00000030 (00048)   795a5441 325a5452 6c4f5335 6c654755   yZTA2ZTRlOS5leGU
0x00000040 (00064)   3d2f3430 2e68746d 6c204854 54502f31   =/40.html HTTP/1
0x00000050 (00080)   2e310d0a 55736572 2d416765 6e743a20   .1..User-Agent: 
0x00000060 (00096)   4e534953 5f496e65 74632028 4d6f7a69   NSIS_Inetc (Mozi
0x00000070 (00112)   6c6c6129 0d0a486f 73743a20 7777772e   lla)..Host: www.
0x00000080 (00128)   66656e67 7a68616e 6779752e 636f6d0d   fengzhangyu.com.
0x00000090 (00144)   0a436f6e 6e656374 696f6e3a 204b6565   .Connection: Kee
0x000000a0 (00160)   702d416c 6976650d 0a436163 68652d43   p-Alive..Cache-C
0x000000b0 (00176)   6f6e7472 6f6c3a20 6e6f2d63 61636865   ontrol: no-cache
0x000000c0 (00192)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f777073 2f646f77 6e6c6f61   GET /wps/downloa
0x00000010 (00016)   642f4f66 66696365 41737369 73742e30   d/OfficeAssist.0
0x00000020 (00032)   3430352e 38302e31 3131392e 65786520   405.80.1119.exe 
0x00000030 (00048)   48545450 2f312e31 0d0a5573 65722d41   HTTP/1.1..User-A
0x00000040 (00064)   67656e74 3a204e53 49535f49 6e657463   gent: NSIS_Inetc
0x00000050 (00080)   20284d6f 7a696c6c 61290d0a 486f7374    (Mozilla)..Host
0x00000060 (00096)   3a207764 6c312e63 61636865 2e777073   : wdl1.cache.wps
0x00000070 (00112)   2e636e0d 0a436f6e 6e656374 696f6e3a   .cn..Connection:
0x00000080 (00128)   204b6565 702d416c 6976650d 0a436163    Keep-Alive..Cac
0x00000090 (00144)   68652d43 6f6e7472 6f6c3a20 6e6f2d63   he-Control: no-c
0x000000a0 (00160)   61636865 0d0a0d0a 0a436163 68652d43   ache.....Cache-C
0x000000b0 (00176)   6f6e7472 6f6c3a20 6e6f2d63 61636865   ontrol: no-cache
0x000000c0 (00192)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f525a49 49395867 20485454   GET /RZII9Xg HTT
0x00000010 (00016)   502f312e 310d0a55 7365722d 4167656e   P/1.1..User-Agen
0x00000020 (00032)   743a204e 5349535f 496e6574 6320284d   t: NSIS_Inetc (M
0x00000030 (00048)   6f7a696c 6c61290d 0a486f73 743a2074   ozilla)..Host: t
0x00000040 (00064)   2e636e0d 0a436f6e 6e656374 696f6e3a   .cn..Connection:
0x00000050 (00080)   204b6565 702d416c 6976650d 0a436163    Keep-Alive..Cac
0x00000060 (00096)   68652d43 6f6e7472 6f6c3a20 6e6f2d63   he-Control: no-c
0x00000070 (00112)   61636865 0d0a0d0a 6e656374 696f6e3a   ache....nection:
0x00000080 (00128)   204b6565 702d416c 6976650d 0a436163    Keep-Alive..Cac
0x00000090 (00144)   68652d43 6f6e7472 6f6c3a20 6e6f2d63   he-Control: no-c
0x000000a0 (00160)   61636865 0d0a0d0a 0a436163 68652d43   ache.....Cache-C
0x000000b0 (00176)   6f6e7472 6f6c3a20 6e6f2d63 61636865   ontrol: no-cache
0x000000c0 (00192)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f61706b 2f323031 34313232   GET /apk/2014122
0x00000010 (00016)   322f7365 7475705f 39353136 35303639   2/setup_95165069
0x00000020 (00032)   2e657865 20485454 502f312e 310d0a55   .exe HTTP/1.1..U
0x00000030 (00048)   7365722d 4167656e 743a204e 5349535f   ser-Agent: NSIS_
0x00000040 (00064)   496e6574 6320284d 6f7a696c 6c61290d   Inetc (Mozilla).
0x00000050 (00080)   0a486f73 743a2064 6c2e6e78 352e636f   .Host: dl.nx5.co
0x00000060 (00096)   6d0d0a43 6f6e6e65 6374696f 6e3a204b   m..Connection: K
0x00000070 (00112)   6565702d 416c6976 650d0a43 61636865   eep-Alive..Cache
0x00000080 (00128)   2d436f6e 74726f6c 3a206e6f 2d636163   -Control: no-cac
0x00000090 (00144)   68650d0a 0d0a7472 6f6c3a20 6e6f2d63   he....trol: no-c
0x000000a0 (00160)   61636865 0d0a0d0a 0a436163 68652d43   ache.....Cache-C
0x000000b0 (00176)   6f6e7472 6f6c3a20 6e6f2d63 61636865   ontrol: no-cache
0x000000c0 (00192)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f424656 43656e74 65722f42   GET /BFVCenter/B
0x00000010 (00016)   462d4246 5643656e 7465725b 5b414230   F-BFVCenter[[AB0
0x00000020 (00032)   32375d5d 2e657865 20485454 502f312e   27]].exe HTTP/1.
0x00000030 (00048)   310d0a55 7365722d 4167656e 743a204e   1..User-Agent: N
0x00000040 (00064)   5349535f 496e6574 6320284d 6f7a696c   SIS_Inetc (Mozil
0x00000050 (00080)   6c61290d 0a486f73 743a2064 6c2e6261   la)..Host: dl.ba
0x00000060 (00096)   6f66656e 672e636f 6d0d0a43 6f6e6e65   ofeng.com..Conne
0x00000070 (00112)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x00000080 (00128)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000090 (00144)   3a206e6f 2d636163 68650d0a 0d0a2d63   : no-cache....-c
0x000000a0 (00160)   61636865 0d0a0d0a 0a436163 68652d43   ache.....Cache-C
0x000000b0 (00176)   6f6e7472 6f6c3a20 6e6f2d63 61636865   ontrol: no-cache
0x000000c0 (00192)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f323031 35303130 352f3933   GET /20150105/93
0x00000010 (00016)   37376d79 63735f59 5f6d6761 7a325f31   77mycs_Y_mgaz2_1
0x00000020 (00032)   32303142 2e657865 20485454 502f312e   201B.exe HTTP/1.
0x00000030 (00048)   310d0a55 7365722d 4167656e 743a204e   1..User-Agent: N
0x00000040 (00064)   5349535f 496e6574 6320284d 6f7a696c   SIS_Inetc (Mozil
0x00000050 (00080)   6c61290d 0a486f73 743a2078 69617a61   la)..Host: xiaza
0x00000060 (00096)   692e3933 37372e63 6f6d0d0a 436f6e6e   i.9377.com..Conn
0x00000070 (00112)   65637469 6f6e3a20 4b656570 2d416c69   ection: Keep-Ali
0x00000080 (00128)   76650d0a 43616368 652d436f 6e74726f   ve..Cache-Contro
0x00000090 (00144)   6c3a206e 6f2d6361 6368650d 0a0d0a63   l: no-cache....c
0x000000a0 (00160)   61636865 0d0a0d0a 0a436163 68652d43   ache.....Cache-C
0x000000b0 (00176)   6f6e7472 6f6c3a20 6e6f2d63 61636865   ontrol: no-cache
0x000000c0 (00192)   0d0a0d0a                              ....


Strings
 " ".E:a
/
080403a8
1.0.0
!1Aa
#+3;CScs
BEARPC
CompanyName
FileDescription
FileVersion
LegalCopyright
msctls_progress32
Please wait while Setup is loading...
ProductName
StringFileInfo
SysListView32
Translation
VarFileInfo
VS_VERSION_INFO
www.bearpc.net
 !"#$%&'(
-:~\,_
(* +$;
*?|<>/":
&.=={	
&'()*)+,
	,-./0
0#-"^#,
/012345
.%/01234567)89!:;<=>?#
')01vP
02QYe_
_\0	7G
08\\]HUU^VR@K<_`
!0`9Lu#l
09y,]^
0)a7F1
0aDG$we!
0B5&+P
0B7Qw}
0cKq])
0CPm.s
0ec3Z5k
0.eIP:$
0|F$w`
0FW\W8k
?0FY%<
0gM1]$zl
}0[h$=[
0iN7VSr
<0kaey
0lU_j5
0L"_Yy
0(Mjq]p
0M+soV_
_0n4n1
-0N{M1
0~NNNq~
0POpgN
0RV0ff'
0tAUY;Z
0|||UO
 0XMj~h
0}xyN5
0y:AE{
@<1?\^
1(0KvG"h
 11;~2P
\136(r
1,3dCV
1/5>uqk
1/8Bl%
19nxUZ4
1?@A2B56CDEFG
1AH@7t
1>biDe
1B,<XL
%1(g#]
1GGVG{
*(1hfPV
>1hsD!
}1i5Bw
[1n'.H=B
1}?|,O
1oaFY*
%]$1QSmY2e`
1r\3a_F
1R9Dph
#1U&T{
1^}?Veb}
,*1VOB
)1YTQc
$(2,*_
23456789
}2696NQ
2 8.p~
29.[p?
2acEDl
[2C{:-
2c N*&
-2cUB5
#2Ea+@
2EES7{
2eLm_,
2$eV(I
2hc8Q	
2iavRQ
2J9V9I
2lM=lY
\2nVl\
;{2OCJj
\?`2p?Y
2*qJ;Z
=2~r*Y
2T9sg/$
2U+=oT4?
2v:(=/e$h
,2}v.YP<
2Wat :
2zrzOmcH
30n8pzG
32=h\8g
3)~_2u<",
3((456
_35%q\
35%S7(
>`)>3`8
3a +<_W
3b~.Cy
3^COCO
$3eb=U\#
+|3! F
3gvBJ=
3H	C^U`~8
=3##iVLL3#
}3M3l].
/3Ml:h
{3N7"TAz
*!3_Ol|
3<.oTx
3pVC!Dw
3~qMgk
3T,N^d`
3#u,4FI
;|3,:ve
[3vFJ:
3VS5IZ
3w`Y3J
_:._]4
^	"4[0
<,40ag
4;1;c6
4'4FNtQ
44L;6l
/46R()&
47&1JhQ^D
=4>>?@ABCDEFGDHEIJ-K<<
4[_-C,1d
4Cj&nTR
4d8]VBw
(>4d%h
4+ET-~
4G>E~UOi$z
4}},h_
4K.|y"
<4\NK	
4};O%U
4-.#QI2
4`?s%0
4SM,vpdmjh
4t<<+@.
 4{UX3
4-$vt+
;4|y3]#v$
4yCIt4
>52:46
52mBd`
55	L5O
572>nL
57)U`>
57w'+=
5+>	7x0c
$59V&}
]5A+Os
5a vP^
5{C55EM2
*%5Cf`
5Cr}>+
5DNOP78+!::HIQRST
[5E''01
5=#!e]%7_f
5"/ess
'/5gGO
5iLBe's
5|):iQ
5Ixq^P
5NPe(I
}|=5s,
5S?CQ8
5(S-E?%
5U8$\p
#5*v!;Z7X
)5~:y=
%5Y0-F
5ziZ%YT
6[@$6k
673KF_
6789:;<=>?
*~68QV+x
<6911F
6<+'9P
6c_dr*<"
)>6F9D	
~6FZ$1
6IGFR^^^V^VVEJ
6+jS ,
[6LKvv
6>:lLXM
6,%lzXqXY
6M,R0|
6n6>n|
}#}6Q~
6 |rV\q
6tvCI[KR/
 6U^>-
6ui:Nr4
|6uui&
6Wd*D0
6!we\1
6w\wg}
6Ww,yN
6y)@ Z
=-/+;:7
7;2M'B
7+5}nIL
77$Q/&=M
*78:YU
795[IvBDQB
79DdOfq
79&nwP
7~a<f<n<e
7@B{]g
 	7c+]
7C-R?sg
7$eDB{
(7E$Z|
7fK1w]
&7=}ga
7G"=G&
7h3]w`
;7K"74
7lH_,%
7?noy"A
7p<*hn
7 ~PjT
{({7PzAJ]
7QF`_~,9
7+SaIf3
7<|SnZ
7S*;YS
<7[v5#
7VClI#
,'7X/Q
7! Y|-1
[%8>1~
83h-CX"
84{z,|c
85 Nt79d
,&8	88
^8&8fc
8^A#DC
8B"a*B
8B-OSac
|8h81q
/8HxelH
<~|]8I*
8~i5*P
&}>8J7u9"
8LAdp6l*
8>,LgL
8Lx/}G[3
8.l\y-
8mos5f
8n^52/
8NCRCu
8|Nix~
^8p^:H]
~8]q4gv
8q*_LN
8^{{%r
8RBx?\"\
8slggtz
8SzaS/
'8Tf)p
<-8ul.
/8V6gK
8VSp>r
	8Y?cX
92uz"I
93cQa\
~9)<3U
?9#(70
9735G?
<98=xz
)99Gm"
%9A<3z=
9AadCuc
9>aCUyX?
9<Buaz
9B?u zXmo
:^9d-B
9dBnC[
'9E^oP
9]fP]3M
9Gqd=v
9;h";a
9idwqqwixURAJ;11
/+9JUL
^'9k9a
9kaDy-
:9La{j
9lf!uEj
,9l|XhJ1
|9LY^um
9)mx]!
9NCo[Ns
9oI &-l
9	R6(_U
9s$2e^
9UY?;[
[9V#lnb
#=9(w*
9,xv"0Rb
&9Y4wz{(!
@9y$+ig:
9},zIev!
.%@A0BC5
`@a8oA
a]8)TG
-AA~wH
%Ab@<>
_`abcde2X2$4fY7ghijk8
@ABCDEFGHIJK
/aBdRY
~a~{d9a
ADC"sw
^aDeR/x)1
AdjustTokenPrivileges
	AD Qd
a`ds&2U
ad	tu+(
ADVAPI32
ADVAPI32.dll
aEG5WX
;aEvNV	
AF-:9[V
ag~/0$
)*Ag,B-:
"AG>GI{
[AgN(=
Ag*}RQ=
a@h1J*
)a.hJb< 
aI4b^n
A_JeuO
ajfdr%f?
"aK{Q/y]
aL_8Hj
A]Lnnq
^|>an=
*An`c^
%an#`_;T
	Ao94w
a<'P!oq
AppendMenuA
a`qR/E
+aqY+e
}ARDgf
A)(rU]1
A'S2=5
^`a s7
'AS9VY
A[TNgk
a'<U,;
a]u;t'
Av"%4p
]awDPhk
A}\y}@
A[/!:Y
Ay::9|2
_a=	ZY
azy Gvm3wf
B%!/+	
b%0I:/
b1l^Q[
b1U?@xZ
b2h {P
B4i4C<
B61I&4ht
b9m~Cw
b>;af{
bB^g	%
BB*u\>
bC./2M,
bCgv|2
)=BD5oEFg
,BDfBOh
BeginPaint
B	.E(v	[
:bFDX2R
^B"	G`
<^b)hd
bh)F5sA
bHrh}VK
bHS\f(+
=BhX[03
]=bi-\
|+:Bi)%f
B^Im.ox
+bj<nE)
bK0Zo<
)bkVBh
(b+[LS9z
BL<V!`j
Bm5A`;
 [bMao
b*`mcV
BmiS{tJS
bm/MvKb
\BmX)JU\
bN(3o+
B+=n7+
$b.Ni>
B-O=cQb
]b,([pM5
/BP$$u
bQMzzg
Bq<!Pg}
B?r8@d
b'ROB~
?b}S"5
BsfW*<3
`BSn93$z
btpHndZ
B]u-;W+
Bv~rqu
BwA'F=
{BWF|R
byj~Y96C
byoC65
|BzsWP
/^`'C0$
c?06?(
c0"u-$
C1'SA~
C2a2N2q
.-c;2c
c3\&Km
c3Nm4Y
c@/$3?Y
C4*)4c
C.|5::
C5qyt@HR
c68P)a)
C7-%VO
c99C,7
"C9zms
-C-{Aj
CallWindowProcA
c:A^!U
>CaZm-
C)B7 1
cB9'Doc
ccpD56u~
cdbxYj
?CD}/ei	
cdF-dr
/;cD|z
cE/08N
CeaGE1P
CENNOP7*Y!"GH;QZ[\
ce o|p
cEVtRXQ
{C]fHT_
CF'R"2
cGc=<<
"CgEpc
CharNextA
CharPrevA
CheckDlgButton
cHrg'gBp?
~chZAoI
	c<i%-
&C[iV'
C<k[J`
^c=:?L
C'}L1;
cl1svXAl
CloseClipboard
CloseHandle
cmqQBX,
C&N9@6o
Cnwh#)N
cO8`&s
~C=o`c
CoCreateInstance
COMCTL32.dll
CompareFileTime
Control Panel\Desktop\ResourceLocale
CopyFileA
cOqIz8,$
CoTaskMemFree
C;/O;yA
%-cP%%!h
c*PPS+0
c>{PrH
cQ.Hf@
|CQQ"$
CreateBrushIndirect
CreateDialogParamA
CreateDirectoryA
CreateFileA
CreateFontIndirectA
CreatePopupMenu
CreateProcessA
CreateThread
CreateWindowExA
,c"roN
cR{wRg
CRyAn2
CSH,&\!
CSYp0y
`cs_+@Z
cT_rEs
cT)/st
cTWp_i
CTZM.V
c`>/Uf
cvBIp}f1nt"
c(V<>oC
.CvZ0Ah]
cwD!o9
CwM{DY
c.XY;_
CyR	Eb((n
cYZ[\]^_`abdefg
czAbToH
*]c&Z;p
... %d%%
 d=0_-
D$0+D$(P
D2a8.RD
d5C?!*
D&6|A[
?d:7vY
/d+7Zj
D->9=<
@.data
d c<9MN
)	dCp'
d)|{d@?
Dd=4wg
)-dd9J
dDq$^y<
D$(+D$ SSP
DEF7*+!"GHIJ
.DEFAULT\Control Panel\International
DefWindowProcA
DeleteFileA
DeleteObject
DestroyWindow
/dfe	u
dfT&Yj
-d:H(G
<DhIwU
DialogBoxParamA
DispatchMessageA
_dIwj9
d[IzXX\
+D/)jB
dJRl~n
Dk%	LW
DNM8'?qn.;q
Do-?[q
D$$Ph,
"!#Dq(
DrawTextA
D[R|VpL
DRw_R&
& `~Ds
D%S'~"#
D-S&/oi&
D$(SPS
}d\SpVI
d;TFhO
;duF*Ec
DUl)yn
dUU^VJ<<
.d;(VG
DV'lr(XJ)
Dvy hN"
d@% w\
 DWE].f
D~X`3 
dy77G;9
/dZN[Z
-*!$%d:ZU1N
<D/ZUkJ
d$zVH'}
%:e|:#
e\2BMoI
``e2crstr
E(2LJS|
"E*('3
e5^QZ*@
e6CEgE
e]\78~
}`E7z 
E[A;5*N
EA/q$}
eaS3slyn
($e$%b?
e=b+!f	
ec16QIF
)EC,\\5xm
=E\ce"X_
ec	HE+
ed;/%T
=+E}	, E
eeaz{S{a
e\.f_$
eg1]V>
$-egL3
eGLS;d
@e_GrA
E	h\FQ-,
e{Ifa$
eINrXX
.EjIOT
.e|jY5
``ek(aWlm
E>kE%7P
E/LKrN
e,\]M/{
EM_BG,
EM/ n>%l
EmptyClipboard
e@n1?5e
EN3b w
E<_'N3$f
EnableMenuItem
EnableWindow
&>E)_N`b
EndDialog
EndPaint
"E}n#G
`enMbe
E\n&N\
enYYFS
*)Eo:9`
_EO	'X
Ergbo1
ERLH4W
Error launching installer
Error writing temporary file. Make sure your temp folder is valid.
e=S5H~
,.eT'$)
!et7@*
EtjF2]
e%uy%u
Ev4nC'Q3
ew@bNhvr
ExitProcess
ExitWindowsEx
ExpandEnvironmentStringsA
E|&`Xr
eyve<}
#'EY,Y
EZ_%_cH
ezo+T(
ezw(L/>~;By
f0Q6fC@
^%F,2k/
F2ONDv^
F2s0k}
f+3zn=
\F4Xk3GK
F7%\(fP\
+f7&[jv
F	_]_a
f('AUY
	fB"~%gW
FBHG,M
fB!HIP
F^BJ8e
f"dCXppDc
f%Di?`b
[fECiBC
fELEN8'
_FEm/p
FeXhS<+~
'$ffm\
)|f#FO
Ff&R`:^
^?fg/}i
^fhD/\
fHgb)i
F?i19V
FI}aJj''
F>)ICk
FillRect
FindClose
FindFirstFileA
FindNextFileA
FindWindowExA
Fj7(-"ASY4
F,KMPLy0I
Fkoke*
F	_,[#`MAhS
f##MDA
f<;mu1
FM%Ujqjp
';%f.o
 =f`o`f
*<FOO#-4
f)p<9D
`F_$?q
+]fq% M,c
_f}qtG
FreeLibrary
?}"F*rk8
#FT>AW
[FUwf\bj
FV0E>;`,
FVtsDE
FW	4TR
FW<Hz+
F"-|\x
fX1FmQq
$=Fxao
F)XQ^v)
[F>${Y
FYZr9g;Z
#%FZm4
fZ!Ug1"B
g5/k6il
G7m	yk=
g`A6%r
}.GAN\
Gapq&\
GA +Ufv
gBp-]\7P
G=C2RO
gCK"Sg
GC,!uz_KN
GDI32.dll
gdk Gh
GetClassInfoA
GetClientRect
GetCommandLineA
GetCurrentProcess
GetDeviceCaps
GetDiskFreeSpaceA
GetDiskFreeSpaceExA
GetDlgItem
GetDlgItemTextA
GetExitCodeProcess
GetFileAttributesA
GetFileSize
GetFileVersionInfoA
GetFileVersionInfoSizeA
GetFullPathNameA
GetLastError
GetMessagePos
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileStringA
GetProcAddress
GetShortPathNameA
GetSysColor
GetSystemDirectoryA
GetSystemMenu
GetSystemMetrics
GetTempFileNameA
GetTempPathA
GetTickCount
GetUserDefaultUILanguage
GetVersion
GetWindowLongA
GetWindowRect
GetWindowsDirectoryA
]gF47Q
^g^#g[
#  <Gg7
G,G)I009n
::GGRJRGAAJ
&:GG;v}
#G?$h66
"GHU7+
GH"v5ST
gHw=J@9S
::::G:I
g"}IPN
 *G(;j
gJ^)iL
GjP].;
G<jtI]
Gk7m1z5
~GkH_.
g^K?Sx
-gkX-F
G"\_l?
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
G::M?3,
G>Nk<u
G?Np:2M+
gNp-#F
%,GNw%
g|nWcE
G[os84\^
g{oSqn:
gPM?5@
G(Qjva
"[@GQQ
'g_R9p
/@GrOt
G*s?%B
gsNBJ~
:gS*tV
=g#T]I
GU*gODq
,"]g&v
G"vM]$wA&$
GWTEBR
g,<~<&x
GXEH_/
+#gxl+
_@gXm,
GYY;s1
G=Z]:^
g.ZO||k[
.h0j?'d
h3Q6C3f
h4g2+y
H4^Ug-|	
h!5K'(TjEV?
&[H5Lf{U
h.	%"6Nc
$H7Db@
h7$J$O
H7Wl~|@
,*{]ha2<+
h/a&oZ
H/B,JG
hB JqoD
H_bK*?
hbR6Jx
h,bUy'
H=e'6[
!HE.nvGv
Hf7orO
>@_hfc
{_HFlJJ
`hFt4h({
h$	fTD2
hg<aI[y
"*`\HGU
H\Gu9t
]]$hH#9iU^@jj<<
h,?i\&{
H.IJKLM@@N2B567OPQRS
hijklmnopqrstuv
HiL);51
hjA/n@=[Y
hJy]8b
H-JYF{r
H~Khyw1'OD
h &l'^
hm`g2>
H( &N$X
hOeFv0
hpy9+D
'{Hq9O
hQLDJ\rFTI
Hqqhhqwix^@j-<
hqwix^AJj1
H><@]s
H(^>sq
[htA_v
http://nsis.sf.net/NSIS_Error
:HTUUVWNAAX4&Y6OZ[\]^
HtVHtHH
	HtZY>
;)HuUT
hv\XEh^
h&.W>~-
H$,]W=
hW6J%9
/h!W(Q
Hx>.na0
hxt9|Y{
H@XWFb
H` XXM}3+
h+|y8 
h`-YBBU^
HYyDAX
`hY}y!;FV
H]z4X,
I0h:L!
i/=3xq@	
i]4<'~p
#I5d39
<I6lTx
,I8[1b
I-8Ig6
i%"9~|
i9_|Tb
Ia?Oj|P
'iB%*A
*#IbNb
{i|C,!/
iCAfg 
I)CYXH
#iDs|I\
Ie.k`	y$C1
IF^]K:
iG`niJs
igSU"x
IH`3%&V
'$Ihex
II9LcY
iIIQw1
I`J7^VpZ
_.i>JAi
iJc*MG
I)#kc9
ik%`!o
I-L\E`R
ImageList_AddMasked
ImageList_Create
ImageList_Destroy
	i["nc
incomplete download and damaged media. Contact the
INeObW
iNI,Pm
Installer integrity check has failed. Common causes include
installer's author to obtain a new copy.
Instu`
InvalidateRect
Io_z^z
@	I:?p	
:iPa{=
i,&PInK
Iq6bt?u#n
I#qh:P>
iQoV.g
IQPp	2
IQ~t(HQ
i(QT`S
I}r4ThH
!.%ir6
iR%7uy
|'iRCY
:`i"Re
iRichu
i\~RIG
[';iS$
IsWindow
IsWindowEnabled
IsWindowVisible
iVYk6o
I#^wnU%
;I\]W^p
IX2{Ym@
iy0"sJF
I/^,-[:yJ/i
%iynMH
Iy%`U~
I*yWy2
iz+$.n
>~|J;=
j07Ms>
$+j2	6
j3Ur#B
]&>J4s|
j8;Rgm&
J9#/~FY
Jao? L
J{?%b1
jB1Q=<
JC[1NU
>jC4`R8
JCz#.i`G
j:d65Os
$J|dGl5
jDNLDP
J!Dr?E
j"'dU|
j#-E&~
J&e1&$
Jen?TT
-*!JEqfi
JF}~~C
|j@FO7
)JGco!
JG[uxA
=% ]Jh
,JH	~@
jH!*g2
&Jh!\v
J;[&}i
JIq	O`
J=i?XU
jj4k4/j^
+J~J/RC
jk|I[#
JL+&B-
JNN#-[m
Jo|gv&
jO;<@p
&j%PVk
J`rE/K
jr!V<?
{-<jRy
jsynL	
jU7~YEd
J.U+A)oe
j<uc*X
jV?9wq@
.%#JV,g
|"J*Vn
jw9T}	
J"Wf_)
jXjL<P"
.jYGtJ
=jy/Je
_+]]k|
k1-D?:#
k_26Lb
)k2S9L
k3[||}~[oZ
~{ K4o
k%;5g+oX
k5[@vF	c{
K6X)H4
K8|?,-h>
K[8r'[
k9~b]4
K9"h;x
)%;KA^
Ka)gWr
kAI!)E
_,kAIi
%kAQ2a vU
kb#075E
)?kB"2
%KB\$6l
KbWcNP
_k:C??
Kc|!Ll
KC/%W^T
k<d<a<kl6
kDk044
ke<atb
K.E(hr|
KERNEL32
KERNEL32.dll
KE^T;.
k[FL1g
*)k^?H
KhKH6Z
-Kh?Q!
kI*o<(
KitKq rN
KJDX-fb9:
kJNmR|y 
k`J'Vk
K^j%Zzr
``kk	9X
K}kG;%Y$
klDbCm
KL/@@M
-KMAu*
kNj~D[
Kno=\`z
KNwwIc(p
\!Ko,eC
KOR>vck7;/
KphFk,
+Kp!LZ
Kpt]g\W
%k	q_C
"Ks <"
kSIO*%Qf
,ks.`Oy~N
K^S;zZ
-K(TH!/
kTICjUHB
	KTt6T
!KUH^r
kV7V65
k/:V{g2
KwS2rs/
<Kx_=\
k.xCJE%
?K?%`y
\kyFP>)u
kY(S)R
k@Zb%^
kZ{:@l*
~l,#~.
	l5gxQ>
'l5wmD+
L6{i?$-
l ~8FU
L8pj3g
:L9E2o
:"l9IU
L9YM:jiJn
laAQn2
lAk;QT
/lB4+e
l:CE8 W
?lDg*_
LdQ	1^
LD_rtr
lDvXt{
#&LfHu
LfQZgPPO?
l.fy7B3I
lfZW\#[
$L(hpS)
l$!hR[M
LiJ0LX
lino,d
 -l_j(
lJ$fS"3
lk|F|N4
l_Ln& 
L&Ls};
LLYT]T/
LMbmhop
lmnopqrsse&ftugvwxyz{|
LMNOPQRSTUVWX
LnFy*#
LoadBitmapA
LoadCursorA
LoadImageA
LoadLibraryA
LoadLibraryExA
LOe}%"
LookupPrivilegeValueA
L[prn\q
L$QBBV
,L,QF?
lq$_L.{
>lQMy2
L_QoI>\
l;r*,*
L$rH#=
.,lRXn
l%*Ry`Kx
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpynA
lstrlenA
}>lS@W
lt+>>|
l?TGP8YHd
LU5iT+
LuZovovPO)S\p#h
lv4wUP0
lvqZ.`U~E
';lWc7b
+LwCN;
lWQJ0Z"
l#x$'?'=
lx61|Ud
Lx&f&ff&
lxtaC41
lZ H; 
>Lzjd~
LZ.(L'
M+@~?/
m0\,:k
m1&(!hZ
M1S95a
"m2}mX
,M3i6Xg
%m3[vvv[[Zb+
}M54K"
@|M5ssT($
M[6	[f%/
m72RTj
m8zKWQo
]m9&}WO
"mA0AD
+}\M\AZ
m`Bj*Lz
m(BTf{09
?m\c_}
M+*cb|
MC^FP&
mC%o0[
MessageBoxIndirectA
m{E>:|UJ$ 
M<F]d!K#
;mfF+k0 ~
MFMFvgn
-}M_GAR\
/m=GKn
~m]" h
\Microsoft\Internet Explorer\Quick Launch
?mI}D/
m<IzJN
M~jdSQ
%^m:kT
&mn]Pe
[MN\'z/p
More information at:
&M=orp
MoveFileA
MoveFileExA
~M&p9MW
M-#PB6kK
MPibJH
m(P,OB
Mq_cYk/
m:qFo'
mrf^ivl
:+mrg 
%\MRGS2Z
mR+QA]TE\Z.
!`mRu+
.msc2I
^=M/Sy
m*sZy&
MT#@ 65
\m,@tv
MulDiv
MultiByteToWideChar
mUmM8Fs<*
m@V@s/
	~M&wj)
m]WJHJ
+mwvv~
mw,y?u
((#M#X2
}MX6{ZX
m*	XA+y
m-XyGk
mZ.edU
m/}z=K
N]]-0:
N-0d6BP#
N0uCsj
N'2BVq
n2{v-yc
.	n3@7
n4|e=h
N55OPQERCS8TURV@AAAKK<
n>"5v*i
N9L/LN
n%`b|r
nCOq,7l
N=CX2F
.ndata
(}nd~$ytP
|"n&=!e
*NE9U|
`>nEGSz
Nex568(
N	%f>g
n|(g [a
nG=G;]
^>NH*Qn
Nht,Ba
Nj,R^r
)`Nk6=
N.Kb1|
N\l%jk
nM=J>q
N_mp<[18
/"n"n#
!^n|N]
NN8_Rd
nNZgoPgg?T$$pp
NO02fFFm
 nQrX3
nr	)-p
n&RsI4
'NRY	,
NSIS Error
~nsu.tmp
$/|NT9#'
	{NtC6gO5.t
nTwAne8
NullsoftInst
NulluN	E
/nve>5
NVnh(92LX
Nwb(iY
NWV:U1}{Fh
nX[_MH
nX+R9$
NY,?J:
]nyjY]
nyn<%o
NYtl8`
NZ!^c"
NZikkO
}(\_o?
&]^">o
	^-{:o
O0m~uf=
"o22PX
O2D!\)
O^2F9t{M
~o:>*3
O48Im{
o5tvE{
o@5w	Ft1
o'7&B*
(O8QRd
oB][1h
]oc<_[
'O?%c&
>OCb8&@
OC`v|#
}od_a]VJ
OddD*:-
oD)eAv
|od&M"
?o#ebM
o''G~[
]o&G=:6
|O}}]gM
-O|_H6e
o]I55]&
&OihD;
oI]WB\
oK&3tr
OKPeAh
?ol4}WD
oL!dm=@
ole32.dll
OleInitialize
OleUninitialize
^(}Olp
Ome@6M
ong%b^
.oNkIV*=
+On:W)SDon
OO~,sR
o'\pD1Q
OpenClipboard
OpenProcessToken
"~?oR:
or$>H)}|
,o?sBV
o ##t*;
Ota<i#
oW@"DjNX
Owg8	q
o\Wx7H
	o@Y;/
*&_'OY
"oy2#%
};Ozz;3
$*/{&P
P1--u?
P2+^VB
\P3zUkP
P:5q&O
(P6`LX
P#9vkk
PANn!Q;{
~P*b h
pBIkj/
\;~PB&m
pBv'<{u
p,cc,Z7.
PC|GS#
pD:fe;
PE@,d8
PeekMessageA
*%p`E'GD5%
pepmpnp
pFfw I
pfLB'u
p|!F(W
PF\YU@~
P-)H51
Phj{p*
<Phk>.|
p'hO8t
P=,"i+
P|I*GBo
p:j"/S'
p>!le1%Ey
':p LmU?9
],)pm>'fUo
pn1KtQ
pn]c^O
Po0d.x
pO8'K?=
$%P"oN
PostQuitMessage
POY	`|i
PpB*{`
&PpDup|a
PPPPPP
pPR1LK
P-Qm;;
p\qrstuvw)7777*9Yhijxy	z{1n
pq<wAq^
p'rbJ4
P-\RbZ+e
}pRZj+
p%sB1)
^p:S H
Pswe,:
ptkAZz
PudZ,%
?P)UeV
p]V]g/aY
PX-O#	
.(Pyi|S_v
\P|Yk[M
'PYo.x/
pZ:aZ9}
]p|zU >
*q`3	E
|Q7#5oCxx
	q8I\4Q 
>Q8|M&
q=/9);I
^q?9w.
Q#&A% Dx
,qBRUU
"q[BzF
Q!Dc'<T<
QD+nT0
,Q*eMV`
'Q)F]N@
qF?]&t
QGg	4h
q~GPwpn
Q|i+]&
qIUI<~;
q	/izW
q}^j21?
qK0 6U
])QK]D
qKKEx~
QkKX+y
qKLCl+^
:Q\kV~
 >qL1I
Q^l5V7
q|>}lA7&
\qll\ca%
qmD_5f
/qMqfC
Q,m}rW
QmsLez
]q*N1r6
qNEI{5@
q OL|!
QP\X\Z
!#qP$(Y
QQ4nmz
QqAl5R\
Qq]D;N
qqqiUVVJj<
$=#qS{
qsH!Rz
|qs<ts
^QTz>O#
QU7eOP
.q~u9=
qUfAEE8
Q#u"L!k
QUNug|
qUyY*#
'Q%V_fn
=Q(vJ9f
QV{k_m
qw(q[`
QXT|}C]
QxY8V`Z
qzT)Ju+QWq
	QZt>kh
<R[]&_
r0/,~&
]r1N?S:
r3!?cH
_|`R:3P
R4K:`.
?r4-wz@g
+r4Zpn@
R5i;72
;RA%c:0
&Ra~ct
\RAI3D
rawOxv
`.rdata
RdeefeMgF6PPFF8'hijGklmnnoI
RdOGaa#
rd} *v3
ReadFile
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegDeleteKeyExA
RegDeleteValueA
RegEnumKeyA
RegEnumValueA
RegisterClassA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RemoveDirectoryA
[Rename]
r)|:}enz
RE;sk[*
"r"&ET
r(EYU]
Rfhf`bp
)rFmsF
`rG02e.
,r-g>/D=
`r.!GR#
rgv(0[
r#H+evPG
|:[\RHf8E
RichEd20
RichEd32
RichEdit
RichEdit20A
R]IlQ 
*<R%$is
=r\iz`
r'}^JX
\R"=k6
RK8%.r
r[l@3?
R Mz/C
+{-rn}
RNjDQ	
R*:P~;#
'}r%PG^A
r]Q@seAd
rRej[zd
?rrr%T|
RRSScl
-RR^xiixx^xV@J;;1
rsz.8s
rT*)#)
+r+T*C
r|TH&a
rt<N;{DSA
:rufP[~
*r[ugs
`r^UTw
R{WdST
	r	w,\#P@
r'xevS
R{(/Y/
|,`r=yh
#$Rzv0%D
s@%/<}
S0?67)'
S0C~zH
S<0_ ;X
s2w4Tk'
s3=R|HW_
@.)S5(
S6'nl4
|"S,?a
SaSRO"
&*SB,z%'
S+ca3<w%r
SC.Hu[
sC(PZB!
ScreenToClient
scU:BU
~SDIw.P
S\(D<t
s;E=,1
SearchPathA
SelectObject
SendMessageA
SendMessageTimeoutA
SeShutdownPrivilege
SetBkColor
SetBkMode
SetClassLongA
SetClipboardData
SetCurrentDirectoryA
SetCursor
SetDlgItemTextA
SetErrorMode
SetFileAttributesA
SetFilePointer
SetFileTime
SetForegroundWindow
SetTextColor
SetTimer
SetWindowLongA
SetWindowPos
SetWindowTextA
S{_ewb
SFuP1e
S:*fWU
S%H!%7
SHAutoComplete
SHBrowseForFolderA
SHELL32.dll
ShellExecuteA
SHFileOperationA
SHFOLDER
SHGetFileInfoA
SHGetFolderPathA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHLWAPI
ShowWindow
"SI4$I_,^
S$J1MQa>
Sj4TE'
S+jT+:
S$,jVbI
sk`z5w
!s>\^]l
sl&2GuZ
SL6V#}
SMH'-p
:$sMym
SN+hby
softuW
Software\Microsoft\Windows\CurrentVersion
S%[OkCa 
soKj!p*
^soP;u
@Sq]lE
SQSSSPW
Sqw]=.
ss#Gyyi
_"Ss\Kw
SSS@4&3
sS@.YQ
STN-H!od7
}STQj+
[S_Tq}n
Sujf}\
~}s)vK$
swd#/	6
:SwQp[
s=w"ya`
sWzo#X
S}*,X:hV
SxU3-/
SXV.g2
*"s'"&y
sYR]r=
SystemParametersInfoA
|SYUFA
sz0!M2B
s'Z!99
> _?=t
t+{_1]4\
}T1><z
T2k[-Z
~,t37?N
t 3W2,
t#5{e*
t7>]$MT
T7o_wD
T<_96@
#]T9MLPv
t9|O+y
=t+9p3
"<]:`Tb
{tCB:g
T&(e^0]{
TeCjxb
t#ElHT-
TE^"N*
TEp/0G.
)T|>f$
=TF{-b
`tFk>ZL
t )HHQz$
!This program cannot be run in DOS mode.
T?::#IFT
^;%T]K
%t-l$[
#|T\L2
!,TLaC
TM&;G!d
{tmV!M
'T?+%n
t~[N>G
TN=GDP
tNJ.7O
~?TO.]
_^[t	P
:-tQhM
tQ>$;o?
tQ.r'K8
>tR0~%
TrackPopupMenu
tRzf^K
T~&S:k
tt|f}"-
t}/#Uv
tVfKxp
;tvht4
tVPe7[
Tvs4+,]
T[We]i
tw<Kt*-;h
TWRL/dN
t% X^ 
}=T)x:
TX9[T=F
t~=*XD
tXp.LSC
#,t[&Y
T\Y6;7
TYvV)0y
T}Z+b%!
]TZ*k$h
	U0PQc\
U-37unk%
U3@P$\
u4?N8}
U5"\%0
U5k7)?
u6lFF/(
u7;IQFsC
U7/p{5Z,<
u<8e?I
u8kAI8;C
.>)u94{
U:9H\R
U~9J3/
UaR8B{ 
_uaZS*
ub0wfU8?
UbVJS+*
uC{7Qi
$uC(lq
UD#Ebvo8
UdiZb#+
u{Dl|M
U*-D.p*
<UEe(p
U E[nl
uEXTLs
u{)~F*
u}f7_&{
+Uh@B%
uHJJ=~Y
Uiidddii^^AIj;_
UIMVVWX
~+u_kH
ULO9B5
un,nqW
UNUgyLu
UonX3pUbME
uO&pCMX^^
u,oRzr
UpF<Kf
:u%r8#
USER32.dll
u=T1}x1
uTDkt4g
uU4v81
UuB6:G
%u.%u%s%s
%UW1La@
`uX\%M
Uy{HA8
UZB4'{
\[v|\;
V2fp-9
)v3@yLH
<v4^[!8
v 4-HP
V"4?	i)
V5{k2Fh
&V?7&q
V7szkqy
#V&,7X
v8^hX[W\"
v9(q.s
VA3n`wTJ
VA(T=ZR
'VB?[,{
v)]DN>
;v@}e9
VEfRu1
vEOr?[
verifying installer: %d%%
VerQueryValueA
VERSION.dll
%ve^Xm
]v)]G_-/
=V>G:s
V	Huo!=
VhusA3
VHz\-o
v]jU]V
vk6`l0N
VK9qCAa
VK_uf_g
	=vk\X
%_V'lA:
*:VlOhx!5
V/_lpj
}VL^Qh
v`mMKs
vmPGa1
VnL "G
Vn{NC.
vNoBqOyX
v\{.oj
VpgZy]
Vpk4?/
V>>>_R
+V/RoX
$VRqPM],
V.S6)[
vSoOXF>
>vt	Sx
VTz;qP
VU4YR1z@N*
VU+-o%t
-v@[>v
"VV`^+'
}v[!Va*%
VVCcFj
v#Vh;+@
v#:=vQ
V<WN;>ap
vx6S8j7{
V[X?gO
Vx&Z=]
V"y8B&
VYApIn
vyVm:5;
:	}:-W
W&0L[tT*
-|W1wD
@W@1xb>
W!5(|@
w5OqZpQ
W6K{,o
W8;2,ufpq
;w!9	u
w<)a+!
(waFe#
WaitForSingleObject
&w!av3v
	=/Wb02
WbFlK\G{
W<b^x >1}
;"w]&d7
wdc{FJ
<wee|`=3
|w;erK
w}F[7m`
\WF`j5=
W&G39|
wH_BCete
];(W?hh-
wH&ink
	w}IWl\
]^W_``/JaPONOF78+ ";Hbc
w=k$2<9|
wk"4+4[5
W@>~kl
WKq2o6
wKtrv3:
w&KWu"
WL@b'R$
)WlD-e
WL?>FuMN
WmkA7>
WMKwB.
WNZY!S1
|wOpT+M@
Wpb"oc
W?|Pc-F
w(	PR8
|#w[Q&
W"R?46
WR4i&`
wr/elN
`Wrfb*
WriteFile
WritePrivateProfileStringA
wRO?D)
W?rYg~#
WSF?es
wsprintfA
W**sR'
wsSx,D
wT3QeH
"WTZ{4SUS\*g
]w}?:U
\W'/u@X0
ww''w'Yhi
}wxKp$3
!wx_Q[
Wx}})u7M/
wxyz{|}~
wY<2<y
w<yH$<3
wYn	g-6
X0IUqC
x]2H$C
X6W/P#$
XA<FCB
Xa#% j
Xam7tq
{X_bB}w:
xCdK)1
X-{cLf
xcrUQ>
+XCZwgX
xD_)>9C
xe"@@&
?xe ?A
x (e)X
:`x&f 
X<I*2kr
X;I@b?
XIKH{]
XKAg< 
x!kdnw
X,KN>~ 
_Xlp{!"X
X?LzQF
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>
.;xn1$
,`*X"nB
XOKq?3
`xoM#L
.xoO5A
x/P"u?
XQ`\:"e
xQ`}m<
^XrW_4b
X!s8|E
xt> gc
#x)uC;t
[XV<86
x~!vt2
XVu`Bxo
X%WSV9
'XX`)9h;
x	yDf+p
XZ|c |
y1rG."E
Y3?OPOP?+
Y3ZZZ[O*
y.<(-4l
y5CMOg
<Y:5wd
Y7M]*s
-y:7O[
^y=9ldso
y9Q"Bc
YBGNB:
yd^	d (
*YG)EM
YGG{nB
yGl(w	
Y=Gr`2
{yg vg5
%yhEXK
y{/I -
YI)A\!
Y IV[Y
yJIM%")
YJ\KfL
:yj-"R
Y`ke	&]
y`KS_L
Y.m3@%J8
}YO qk2
Ypw.f.W
YPwsw|
Yq@$9+\&
^Yqo].
,Yq%XR(
YrMq0)
yRPCL>
yRpZK_7&&*
(YS!<d
ys<)[q
y@sZ38dFHM
-Y)"t@
_YU5~i
<@<yU8
yv@k[S
yW"\B<)
Y<=WCP3;.DP
y/:/wfV
YW|u_G
='y\$x
yx&	(r
)yx{Tv|f
YY3E+56.
YYiokX`G
Yy%P1Q
Y%@+z@
y"z\_p
/$z_}_
_|z\>0i=
z	0+	I
z276	W
z2K'cz;
Z33<x5
Z.3j4x_$
z3Xi)++
z?*5>2
;z5lJZ
Z\5yF~j
Z_ >6e
.z7wxa
zAY:rGf
Z^B=l!
])zBs-F
Zcs'Ms
zC"X8sp*Z
	z cyI5
zd(tR 
ZDX!8s
zf6TZR
/ZfcOw*
#ZG}#&
zGuf@}
zH;B"y2
'&zH|H
zHkVZX
ZHmD~G
z:Hw%Qy}L
zi3d1D
zJQlB!
~z'k1SR
[#Z}kl~
Z+lh56=
zlZC07
(zMjDA2
 '{Zn>
Z nf`S
'ZNk$R
Z}o;8%
z+$p=~
/\zqyz
zsmd;W
_=zT0^
zU,w77
{>'z-X
}z!X"=
zxD-z]
`zxn}M
zxw1L7
?ZyKFE
	zz2BD
/z(zD@
zz#f.<
zz#Rl8:,.-K
%-zz+tR
zZv/p[