Analysis Date2015-01-31 16:57:25
MD5037c9a5da7298de285afe4a544ad6a3c
SHA18194baa24d053ce8590116ac8b0e9b060cf3cdba

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 0bc2ffd32265a08d72b795b18265828d sha1: dd2a446014a37556f39173b802c63a4e46e09366 size: 23552
Section.rdata md5: f179218a059068529bdb4637ef5fa28e sha1: 6035d27db526131eb0f29aee60cfcdbb5072ed7d size: 4608
Section.data md5: 975304d6dd6c4a4f076b15511e2bbbc0 sha1: 1f65340672c91ffd0f2583ff104beaece43c7855 size: 1024
Section.ndata md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Section.rsrc md5: ed4de97caf894981412ec2ea1b605dee sha1: d893aabd5ed4738473613598067f7bc4c95753c4 size: 17920
Timestamp2009-12-05 22:50:46
VersionLegalCopyright: BEARPC¾«Ñ¡Èí¼þ¼¯
ProductName: ·ßÅ­µÄСÄñ
FileDescription: ·ßÅ­µÄСÄñPCºº»¯°æ
FileVersion: 1.0.0
CompanyName: www.bearpc.net
PackerNullsoft PiMP Stub -> SFX
PEhash82a72295234bca8c0e795f0660fa246f1e8f1837
IMPhash099c0646ea7282d232219f8807883be0
AV360 Safeno_virus
AVAd-Awareno_virus
AVAlwil (avast)Malware-gen:Win32:Malware-gen
AVArcabit (arcavir)no_virus
AVAuthentiumno_virus
AVAvira (antivir)TR/Dldr.Chindo.1088255
AVBullGuardno_virus
AVCA (E-Trust Ino)no_virus
AVCAT (quickheal)no_virus
AVClamAVno_virus
AVDr. Webno_virus
AVEmsisoftno_virus
AVEset (nod32)NSIS/TrojanDownloader.Chindo.R
AVFortinetno_virus
AVFrisk (f-prot)no_virus
AVF-Secureno_virus
AVGrisoft (avg)no_virus
AVIkarusno_virus
AVK7no_virus
AVKasperskyno_virus
AVMalwareBytesno_virus
AVMcafeeno_virus
AVMicrosoft Security Essentialsno_virus
AVMicroWorld (escan)no_virus
AVRisingno_virus
AVSophosno_virus
AVSymantecTrojan.Gen.2
AVTrend Microno_virus
AVVirusBlokAda (vba32)no_virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\nsg2.tmp
Creates FileBF-BFVCenter[[AB005]].exe
Creates File1
Creates File1.rar
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates Fileyx_cqby.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\nsl3.tmp\ExecCmd.dll
Creates File\Device\Afd\Endpoint
Creates FileC:\Program Files\3.ico
Creates FileQQGame_setup_wb_20007.EXE
Creates FileC:\Program Files\1.ico
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\nsl3.tmp\Base64.dll
Creates File9377mycs_Y_mgaz2_1201B.exe
Creates FileSoHuVA_4.3.0.1-c204900003-ng-nti-s-x.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\nsl3.tmp\System.dll
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates FileMM-liao8302.exe
Creates Filesetup_95165069.exe
Creates FileOfficeAssist.0405.80.1122.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\nsl3.tmp\inetc.dll
Deletes FileQQGame_setup_wb_20007.EXE
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temp\nsl3.tmp
Deletes FileSoHuVA_4.3.0.1-c204900003-ng-nti-s-x.exe
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temp\nsq1.tmp
Deletes FileBF-BFVCenter[[AB005]].exe
Deletes File1.rar
Deletes File1
Deletes FileMM-liao8302.exe
Deletes Filesetup_95165069.exe
Deletes FileOfficeAssist.0405.80.1122.exe
Deletes Fileyx_cqby.exe
Deletes FileC:\Program Files\3.ico
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\setup_95165069.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\setup_95165069.exe"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\SoHuVA_4.3.0.1-c204900003-ng-nti-s-x.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\SoHuVA_4.3.0.1-c204900003-ng-nti-s-x.exe"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\MM-liao8302.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\MM-liao8302.exe"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\QQGame_setup_wb_20007.EXE /S" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\QQGame_setup_wb_20007.EXE /S"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\BF-BFVCenter[[AB005]].exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\BF-BFVCenter[[AB005]].exe"
Creates ProcessBF-BFVCenter[[AB005]].exe
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\yx_cqby.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\yx_cqby.exe"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\OfficeAssist.0405.80.1122.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\OfficeAssist.0405.80.1122.exe"
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates Mutex3.ico
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Winsock DNSint.dpool.sina.com.cn
Winsock DNSt.cn
Winsock DNSmmliao.jianting.net

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\SoHuVA_4.3.0.1-c204900003-ng-nti-s-x.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\SoHuVA_4.3.0.1-c204900003-ng-nti-s-x.exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\MM-liao8302.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\MM-liao8302.exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\yx_cqby.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\yx_cqby.exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\setup_95165069.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\setup_95165069.exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\QQGame_setup_wb_20007.EXE /S" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\QQGame_setup_wb_20007.EXE /S"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\OfficeAssist.0405.80.1122.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\OfficeAssist.0405.80.1122.exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\BF-BFVCenter[[AB005]].exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\BF-BFVCenter[[AB005]].exe"

Process
↳ BF-BFVCenter[[AB005]].exe

Network Details:

DNSint.dpool.sina.com.cn
Type: A
180.149.136.250
DNSt.cn
Type: A
114.134.80.138
DNSmmliao.jianting.net
Type: A
122.227.42.227
DNS37w.xdwscache.glb0.lxdns.com
Type: A
183.136.208.114
DNSdldir3.tcdn.qq.com
Type: A
182.118.37.13
DNSwww.buptinnovation.com
Type: A
223.6.254.23
DNSdownload012.e.chinacache.com.cn
Type: A
61.179.105.147
DNSdownload012.e.chinacache.com.cn
Type: A
61.179.105.148
DNSna.b9.aicdn.com
Type: A
108.186.7.130
DNSna.b9.aicdn.com
Type: A
108.186.7.131
DNSna.b9.aicdn.com
Type: A
72.8.188.90
DNSna.b9.aicdn.com
Type: A
72.8.188.94
DNSna.b9.aicdn.com
Type: A
108.186.7.129
DNSc01.i06.arnic.hadns.net
Type: A
113.17.184.10
DNSc01.i06.arnic.hadns.net
Type: A
121.10.117.139
DNSc01.i06.arnic.hadns.net
Type: A
183.56.172.47
DNSc01.i06.arnic.hadns.net
Type: A
222.186.20.122
DNSc01.i06.arnic.hadns.net
Type: A
58.220.2.5
DNScdn.coop.baofeng.com
Type: A
218.60.99.66
DNScdn.coop.baofeng.com
Type: A
58.20.193.222
DNScdn.coop.baofeng.com
Type: A
119.188.72.240
DNScdn.coop.baofeng.com
Type: A
122.142.74.12
DNScdn.coop.baofeng.com
Type: A
182.18.51.104
DNSd.14yaa.com
Type: A
DNSdldir3.qq.com
Type: A
DNSwdl1.cache.wps.cn
Type: A
DNSpubliclist.b0.upaiyun.com
Type: A
DNSdl.nx5.com
Type: A
DNSdl.baofeng.com
Type: A
HTTP GEThttp://int.dpool.sina.com.cn/iplookup/iplookup.php
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://t.cn/RZIvJQB
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://mmliao.jianting.net/mmliao/MM-liao8302.exe
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://d.14yaa.com/yx/cqby/sqft/905848/yx_cqby.exe
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://dldir3.qq.com/minigamefile/QQGame_setup_wb_20007.EXE
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://www.buptinnovation.com/ODE5NGJhYTI0ZDA1M2NlODU5MDExNmFjOGIwZTliMDYwY2YzY2RiYS5leGU=/40.html
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://wdl1.cache.wps.cn/wps/download/OfficeAssist.0405.80.1122.exe
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://dl.nx5.com/apk/20141222/setup_95165069.exe
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://dl.baofeng.com/BFVCenter/BF-BFVCenter[[AB005]].exe
User-Agent: NSIS_Inetc (Mozilla)
Flows TCP192.168.1.1:1031 ➝ 180.149.136.250:80
Flows TCP192.168.1.1:1032 ➝ 114.134.80.138:80
Flows TCP192.168.1.1:1033 ➝ 122.227.42.227:80
Flows TCP192.168.1.1:1034 ➝ 183.136.208.114:80
Flows TCP192.168.1.1:1035 ➝ 182.118.37.13:80
Flows TCP192.168.1.1:1036 ➝ 223.6.254.23:80
Flows TCP192.168.1.1:1037 ➝ 61.179.105.147:80
Flows TCP192.168.1.1:1038 ➝ 108.186.7.130:443
Flows TCP192.168.1.1:1039 ➝ 108.186.7.130:443
Flows TCP192.168.1.1:1040 ➝ 108.186.7.130:443
Flows TCP192.168.1.1:1041 ➝ 108.186.7.130:443
Flows TCP192.168.1.1:1042 ➝ 113.17.184.10:80
Flows TCP192.168.1.1:1043 ➝ 218.60.99.66:80

Raw Pcap
0x00000000 (00000)   47455420 2f69706c 6f6f6b75 702f6970   GET /iplookup/ip
0x00000010 (00016)   6c6f6f6b 75702e70 68702048 5454502f   lookup.php HTTP/
0x00000020 (00032)   312e310d 0a557365 722d4167 656e743a   1.1..User-Agent:
0x00000030 (00048)   204e5349 535f496e 65746320 284d6f7a    NSIS_Inetc (Moz
0x00000040 (00064)   696c6c61 290d0a48 6f73743a 20696e74   illa)..Host: int
0x00000050 (00080)   2e64706f 6f6c2e73 696e612e 636f6d2e   .dpool.sina.com.
0x00000060 (00096)   636e0d0a 436f6e6e 65637469 6f6e3a20   cn..Connection: 
0x00000070 (00112)   4b656570 2d416c69 76650d0a 43616368   Keep-Alive..Cach
0x00000080 (00128)   652d436f 6e74726f 6c3a206e 6f2d6361   e-Control: no-ca
0x00000090 (00144)   6368650d 0a0d0a                       che....

0x00000000 (00000)   47455420 2f525a49 764a5142 20485454   GET /RZIvJQB HTT
0x00000010 (00016)   502f312e 310d0a55 7365722d 4167656e   P/1.1..User-Agen
0x00000020 (00032)   743a204e 5349535f 496e6574 6320284d   t: NSIS_Inetc (M
0x00000030 (00048)   6f7a696c 6c61290d 0a486f73 743a2074   ozilla)..Host: t
0x00000040 (00064)   2e636e0d 0a436f6e 6e656374 696f6e3a   .cn..Connection:
0x00000050 (00080)   204b6565 702d416c 6976650d 0a436163    Keep-Alive..Cac
0x00000060 (00096)   68652d43 6f6e7472 6f6c3a20 6e6f2d63   he-Control: no-c
0x00000070 (00112)   61636865 0d0a0d0a 76650d0a 43616368   ache....ve..Cach
0x00000080 (00128)   652d436f 6e74726f 6c3a206e 6f2d6361   e-Control: no-ca
0x00000090 (00144)   6368650d 0a0d0a                       che....

0x00000000 (00000)   47455420 2f6d6d6c 69616f2f 4d4d2d6c   GET /mmliao/MM-l
0x00000010 (00016)   69616f38 3330322e 65786520 48545450   iao8302.exe HTTP
0x00000020 (00032)   2f312e31 0d0a5573 65722d41 67656e74   /1.1..User-Agent
0x00000030 (00048)   3a204e53 49535f49 6e657463 20284d6f   : NSIS_Inetc (Mo
0x00000040 (00064)   7a696c6c 61290d0a 486f7374 3a206d6d   zilla)..Host: mm
0x00000050 (00080)   6c69616f 2e6a6961 6e74696e 672e6e65   liao.jianting.ne
0x00000060 (00096)   740d0a43 6f6e6e65 6374696f 6e3a204b   t..Connection: K
0x00000070 (00112)   6565702d 416c6976 650d0a43 61636865   eep-Alive..Cache
0x00000080 (00128)   2d436f6e 74726f6c 3a206e6f 2d636163   -Control: no-cac
0x00000090 (00144)   68650d0a 0d0a0a                       he.....

0x00000000 (00000)   47455420 2f79782f 63716279 2f737166   GET /yx/cqby/sqf
0x00000010 (00016)   742f3930 35383438 2f79785f 63716279   t/905848/yx_cqby
0x00000020 (00032)   2e657865 20485454 502f312e 310d0a55   .exe HTTP/1.1..U
0x00000030 (00048)   7365722d 4167656e 743a204e 5349535f   ser-Agent: NSIS_
0x00000040 (00064)   496e6574 6320284d 6f7a696c 6c61290d   Inetc (Mozilla).
0x00000050 (00080)   0a486f73 743a2064 2e313479 61612e63   .Host: d.14yaa.c
0x00000060 (00096)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000070 (00112)   4b656570 2d416c69 76650d0a 43616368   Keep-Alive..Cach
0x00000080 (00128)   652d436f 6e74726f 6c3a206e 6f2d6361   e-Control: no-ca
0x00000090 (00144)   6368650d 0a0d0a                       che....

0x00000000 (00000)   47455420 2f6d696e 6967616d 6566696c   GET /minigamefil
0x00000010 (00016)   652f5151 47616d65 5f736574 75705f77   e/QQGame_setup_w
0x00000020 (00032)   625f3230 3030372e 45584520 48545450   b_20007.EXE HTTP
0x00000030 (00048)   2f312e31 0d0a5573 65722d41 67656e74   /1.1..User-Agent
0x00000040 (00064)   3a204e53 49535f49 6e657463 20284d6f   : NSIS_Inetc (Mo
0x00000050 (00080)   7a696c6c 61290d0a 486f7374 3a20646c   zilla)..Host: dl
0x00000060 (00096)   64697233 2e71712e 636f6d0d 0a436f6e   dir3.qq.com..Con
0x00000070 (00112)   6e656374 696f6e3a 204b6565 702d416c   nection: Keep-Al
0x00000080 (00128)   6976650d 0a436163 68652d43 6f6e7472   ive..Cache-Contr
0x00000090 (00144)   6f6c3a20 6e6f2d63 61636865 0d0a0d0a   ol: no-cache....
0x000000a0 (00160)                                         

0x00000000 (00000)   47455420 2f4f4445 354e474a 68595449   GET /ODE5NGJhYTI
0x00000010 (00016)   305a4441 314d324e 6c4f4455 354d4445   0ZDA1M2NlODU5MDE
0x00000020 (00032)   784e6d46 6a4f4749 775a546c 694d4459   xNmFjOGIwZTliMDY
0x00000030 (00048)   77593259 7a593252 69595335 6c654755   wY2YzY2RiYS5leGU
0x00000040 (00064)   3d2f3430 2e68746d 6c204854 54502f31   =/40.html HTTP/1
0x00000050 (00080)   2e310d0a 55736572 2d416765 6e743a20   .1..User-Agent: 
0x00000060 (00096)   4e534953 5f496e65 74632028 4d6f7a69   NSIS_Inetc (Mozi
0x00000070 (00112)   6c6c6129 0d0a486f 73743a20 7777772e   lla)..Host: www.
0x00000080 (00128)   62757074 696e6e6f 76617469 6f6e2e63   buptinnovation.c
0x00000090 (00144)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x000000a0 (00160)   4b656570 2d416c69 76650d0a 43616368   Keep-Alive..Cach
0x000000b0 (00176)   652d436f 6e74726f 6c3a206e 6f2d6361   e-Control: no-ca
0x000000c0 (00192)   6368650d 0a0d0a                       che....

0x00000000 (00000)   47455420 2f777073 2f646f77 6e6c6f61   GET /wps/downloa
0x00000010 (00016)   642f4f66 66696365 41737369 73742e30   d/OfficeAssist.0
0x00000020 (00032)   3430352e 38302e31 3132322e 65786520   405.80.1122.exe 
0x00000030 (00048)   48545450 2f312e31 0d0a5573 65722d41   HTTP/1.1..User-A
0x00000040 (00064)   67656e74 3a204e53 49535f49 6e657463   gent: NSIS_Inetc
0x00000050 (00080)   20284d6f 7a696c6c 61290d0a 486f7374    (Mozilla)..Host
0x00000060 (00096)   3a207764 6c312e63 61636865 2e777073   : wdl1.cache.wps
0x00000070 (00112)   2e636e0d 0a436f6e 6e656374 696f6e3a   .cn..Connection:
0x00000080 (00128)   204b6565 702d416c 6976650d 0a436163    Keep-Alive..Cac
0x00000090 (00144)   68652d43 6f6e7472 6f6c3a20 6e6f2d63   he-Control: no-c
0x000000a0 (00160)   61636865 0d0a0d0a 76650d0a 43616368   ache....ve..Cach
0x000000b0 (00176)   652d436f 6e74726f 6c3a206e 6f2d6361   e-Control: no-ca
0x000000c0 (00192)   6368650d 0a0d0a                       che....

0x00000000 (00000)   804c0103                              .L..

0x00000000 (00000)   802b01                                .+.

0x00000000 (00000)   804c0103                              .L..

0x00000000 (00000)   802b01                                .+.

0x00000000 (00000)   47455420 2f61706b 2f323031 34313232   GET /apk/2014122
0x00000010 (00016)   322f7365 7475705f 39353136 35303639   2/setup_95165069
0x00000020 (00032)   2e657865 20485454 502f312e 310d0a55   .exe HTTP/1.1..U
0x00000030 (00048)   7365722d 4167656e 743a204e 5349535f   ser-Agent: NSIS_
0x00000040 (00064)   496e6574 6320284d 6f7a696c 6c61290d   Inetc (Mozilla).
0x00000050 (00080)   0a486f73 743a2064 6c2e6e78 352e636f   .Host: dl.nx5.co
0x00000060 (00096)   6d0d0a43 6f6e6e65 6374696f 6e3a204b   m..Connection: K
0x00000070 (00112)   6565702d 416c6976 650d0a43 61636865   eep-Alive..Cache
0x00000080 (00128)   2d436f6e 74726f6c 3a206e6f 2d636163   -Control: no-cac
0x00000090 (00144)   68650d0a 0d0a7472 6f6c3a20 6e6f2d63   he....trol: no-c
0x000000a0 (00160)   61636865 0d0a0d0a 76650d0a 43616368   ache....ve..Cach
0x000000b0 (00176)   652d436f 6e74726f 6c3a206e 6f2d6361   e-Control: no-ca
0x000000c0 (00192)   6368650d 0a0d0a                       che....

0x00000000 (00000)   47455420 2f424656 43656e74 65722f42   GET /BFVCenter/B
0x00000010 (00016)   462d4246 5643656e 7465725b 5b414230   F-BFVCenter[[AB0
0x00000020 (00032)   30355d5d 2e657865 20485454 502f312e   05]].exe HTTP/1.
0x00000030 (00048)   310d0a55 7365722d 4167656e 743a204e   1..User-Agent: N
0x00000040 (00064)   5349535f 496e6574 6320284d 6f7a696c   SIS_Inetc (Mozil
0x00000050 (00080)   6c61290d 0a486f73 743a2064 6c2e6261   la)..Host: dl.ba
0x00000060 (00096)   6f66656e 672e636f 6d0d0a43 6f6e6e65   ofeng.com..Conne
0x00000070 (00112)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x00000080 (00128)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000090 (00144)   3a206e6f 2d636163 68650d0a 0d0a2d63   : no-cache....-c
0x000000a0 (00160)   61636865 0d0a0d0a 76650d0a 43616368   ache....ve..Cach
0x000000b0 (00176)   652d436f 6e74726f 6c3a206e 6f2d6361   e-Control: no-ca
0x000000c0 (00192)   6368650d 0a0d0a                       che....


Strings
 " "
E

080404e4
1.0.0
BEARPC
CompanyName
FileDescription
FileVersion
LegalCopyright
msctls_progress32
MS Shell Dlg
ProductName
StringFileInfo
SysListView32
Translation
VarFileInfo
VS_VERSION_INFO
www.bearpc.net
*?|<>/":
			#			&			)			+			,			-			,			,
							
															
01jw#E
"^02.nn	
			#			&			*			-			0			3			5			7			8			:			;			<			<			;			;
04czv\
05xqDF+w
0?7"k'
0A&axb
0;*aon
0BYug{
0%c8eg
0Eg6ObC
0/ghP8
0.`G>QM
_0Gu|WP
0hJa!	
0+jNt1
$0J*<OGX
"0K4$$jA
0L?4|@?
\-<0L>w
< 0_m*7i
0m|j{"r
0mZEKEV
;%0N&]
*,0@`O'
0O[*%V
0q7fM$
0-Q8A.b
0QGo>pA
-0T.?/
0"-T~c
0v&%f`
0@VXtl
~0wSIR
)0xbN\m
0Z75g5
@$1]a-7
~1}B=R)b
^1CI.}J
_?(^1d
"1Ew&5I
1fg.%0
1F\J?^
`1G^	0
@1G"dL
+1;;~hcT
1*i$;~
1JtK`-
`=}.1K
>1L}`GJ
1()lXN
1o2 QM-
1Pp1DP
$1'`@s+
1^s1]KZ
1,@X{f
>1yHFr
1YRYKT
1yUD@h
'1ZS}l
21MG%zq
,22v)O
22wr^%z
{~*2%;a
&2cSvT
2D\:@-
2d} h+
2dSi}y
2ej,$q
2l3vF 
2LlKgM
2m^Aev
2oufyun
-2P 7;qT}D6q
2{SRTYN
2t cbVz
+2U3*9
2(Vjak{7
'2X^X1
2'yMVB
/2YRQD
\$]31_'
31Nd>`
[32lFFC
3a!h%0
3'bdk1Q
3c0$~y
3(D7eR
)3dtqP
'.3e@|
 3*e7Tx
3et<?.
3= E(v
3e*)w7
3gCw-!
3%h'1<
3h3o8>UA
3"HN.-
3iS/3@
3jLL&g]
3K-9Ed~
?3%Knd
3mlHIS
_3nY9}3y
:3o;3-
3pAm!C
3&PIQu3
3<P lC
3RZp[h
3T 59N
~3/"tB
@+"3V6
3VW}kP*!x|
3"XD)/
3xGF&*
(%3xJ,)
3x|nB?
3_y&:j
3z^"6 
>*4`{$
&4[1QBO54
42F02m
/4{3]}
43&nPh
46l^R1
46{PFPu
*47:	AE
48:3o-
:48SFm
"4AHvO
4bQv]\Z
`4cl+n
4eZaQcP
4G6-De
4GBb*p
!4+ii[ +/
 4J46;
4jkxA<B
$4L1]-SB
4lB^,i}
(4l{\rA
4$#M.G
!4N)Qa
[{4	>rC
4sE:7]P
4tV91z
4<TX0L
~4$*U\
4u87m<
4uvgs?
4{v?AUz
4wApis
4[x_aq
4Xuf\[d
4z4Pz# K
'5.!%#
,50(d=UQdO0bE
52T8Ubo
535y99
53*:u;
58RpD!
5b3]f$N
5b'hzj+aD
5b}&+p
<5*Cq%
5!D]D_
5)DvId
{5E3ft
\5/eqD
5,f	>_
5)}.'f=G<s
5Fj]x0
@5g'['@
5'([G!
}5h7%QA
5\Io!Z
5Jcx=r
5jvUy\
5M$ot6
\5{Nu/i
5,Q#)<
$5$rQ\
5] @T'A&z
5tM+Zw
5u&'_+
[%5uF]
5uZD^6
5:&?vL
5w	f|GeJ
5+Wr	)
5>[Y;-
5:*&_Z
5ZIOZJ%
5zmUHf
63=~lv
64H~"j
66ifO6hu7
67aJMK
6"`7.F
6'$7xI]
68;8UE
6_;8e 
6)}9eC
6cjcx6<
6DLdv~X=
6GPIuo
6$@IGR
+$6JNv
6jybHl
6%kiVE
	~(/6n
6pYv~U
6QKH0t
6Q-uji
6++R35 
6?!s3{%
6S5+)"
[6	+SD
6!vvb=/
6w $/~
6xf|Rw
.6Z=7?O
,~6Zln[
6);[<ZM
6zYt&G"
76mJf~
77ow~>
7CS>PV\
7dw2&R
7-kIN3
7k'Kmt
(7Ksf%y
7,@lRB
7l;s&JOC
7M2*:bO
@7mWhC)
)>7nDL
7nn9?o
(7"ob}"*
7P,>6`
7pDi@$
\7%p*q
7qS(NjC
/(7Q.v
7QYJc^
?7W(be
~7Y{w_
7yz7J7a
#;~-#8?
86sJ&VU%b
86@wwY
+87'	9
8~7lepe
^8azk9
8b:S0j
8Di4bO
8"E]hM
8em"$=
8	^E-,T\
.8	f@B
8fUYmYl
8G=;s.
8Kh6mp
-8LOleOK
8NCRCu
8P8^1l
8P;aG}
8}#Q$]_
8}:q?dOj
8rjs#&
'8uVbg
8V4J#(37
).>}9)
9;3i(V|f
@95.fy
:$99]02-
99Vc=p
9\}\Ajb
/-9c>i
\9e&e.
9fEc14a
9ft2ic
9i^;2m
9m1%B@
9nEdPd
=/9Pk1
9*PNy8f
9QXRD/
9(:R/PU
9Td6<|
*9U'5bW6
9vl$c@r
9@w9`._
@-9xE7
9X$vwEH
9^&,yN
	9yR\'
+[9z0s
	&a,_^
~.	A@\
/a0AiQ
a0}L0F?
A0VRZn
a1kFBN
a1\q&[
a1RvTz
A4AV*y
a4gM9"
A4>sTH?}
a5HaX:
 a'`5o
A6^Pt/
;]AA	y
ABCdw18
Acp(?}
?*;&ad
Ad_I'|
AdjustTokenPrivileges
ADVAPI32
ADVAPI32.dll
A)E.=So
[A?%Ex
	a,gl%
Ag%/OO
ai-Ol==
AIRAE`
#Ajut8
Ak	Aa1
ak=G(b
Al1vTP
aL3VV9
)A.lh|'
a`:lRAzf^
ameXwO
*ao;B5&V9
a))#)p
AppendMenuA
\a~Q,c
A_RFi_
 arTru
asMi#aC`
AU1gu\
AU&_Ir
AU,	q_
a[~	Wd
Awj]pZx
awUL7_
?`A{WW
a%^x>1
[aXC[]
"ayg:[R
AY:UFmc$|
	aY'(w/
a>z<dw
AZZm1.K
B2O+mr
b3-Dw&
b4AYJD
B4Hns~
<-b@6c
_\*B7^
b^(7T\
;-B8tCY
|b8Y(H4
/b*aaDm
BaTWFX
BB1=45:
B<!B50
bbC3-SO,
bbCbOp
`BBy>\)
B@bz%.
bC%i3 
bcN@1_
BCZ<=R9
%BD.Ey+
=B[DF1
BeginPaint
@b[eRU-
bfl$_G
=BF!-O
bfUTzAo
*b:fzV
"<;bg9@
Bgaz,|
@bgS$ci
bHa_U-
Bj=4%4
|^Bj4S
?.b}Kq
.bliVt
@:b]lQ
b]lwi4
B#mB}d3
:;bmF0.
-bM_IX
Bms}tc
"bo#|c
	b+P2kp
	BP-ao
_]b"pm
B"p X|cK6Y
*Bqvbn
BRueoiy
{b\S4?
/b:tD9O
BU5,r^
Bv5	RL
b	}wt.	
bz	X<$
,*{c];
c)+=+:
~C^/	\
C1>'/[
:!c2%~D
C2r:7z2
@c%5~/
c6Gv3oVl
C;8$bV
c|]^8g
%@:C8W
CAE"(=x
caI/h=
cAI"u|
CallWindowProcA
CBk^k9'
Cc!Ev0 2k
CCYbRj3G
[*cDSf
cEF\Bh?
C@{fbl
c''Fet4
C|g9|4
c:GrAH
CG?Tm.	dZh}.{
c]H	^~
CharNextA
CharPrevA
CheckDlgButton
cH\F.T
?$C$~i
{CI h(4
c;ion|f
c|[iUC
cJ04MR%C
CJ~#NW
(C<K5'
C{Kx'+
c?l5vKU
cl+l;u
CloseClipboard
CloseHandle
Cm0}q+
cMODxBnwV7
c<MQjM
>cmR%-
C'n}a9
c%O0O`jm\
Co9.Sm,
CoCreateInstance
COMCTL32.dll
CompareFileTime
Control Panel\Desktop\ResourceLocale
CopyFileA
CoTaskMemFree
=c)/<ph
Cpm{Iw
CP`p][c
 }cQ	5
}CR 6k
?crd4V
CreateBrushIndirect
CreateDialogParamA
CreateDirectoryA
CreateFileA
CreateFontIndirectA
CreatePopupMenu
CreateProcessA
CreateThread
CreateWindowExA
cRoi*R
CS&7DZ
c*sLM]R
CS.u.mL
	CS_>x,^
cSx1sE
-ct1tq
C+&&u%
#c}V}N
CwcFT.%
cWMbA_
cY<*+<
c_@y7#f
c,z$8\
cziy!J
CZ`tu#
... %d%%
D$0+D$(P
+(d#5b#
D5Rlzvs
d9r>14
D`}9Sz
daJTV"
-dAO~]o2
@.data
~DB6Q/qD
dbYh-|
D)cP9i
Ddb&JKl	
DD;&oh
D$(+D$ SSP
DdTia%;
.DEFAULT\Control Panel\International
DefWindowProcA
D~eH2]
DeleteFileA
DeleteObject
DestroyWindow
d>FK?Y4z#l
D:G?vK
Dh 5NI
}}^DHg
&`DHPi1>
DialogBoxParamA
}dibeMD
D$IEleO1O_
[diJOS/o<,
DispatchMessageA
[DJ7A0}
DJBe=*
DjOG*Q
djpkv*
D!=[M:
DM:#8wT
dMp	.T
d}nnK|f
?D@<N$U
Dnw$sn
dp"g>:
$D>".PH'8xU
D[p>PNv
d+q5.T
"DQh*7
DQQlAx
.^_=DR
DrawTextA
>Drm@`
Ds=<!h
D$(SPS
}Dt|t-Y
Dt(yUW
D$?v$N
dV^Q{U
'dvtP9<N
,D`W|5
?	d[wl
d"wZs`
d)x6{P
D:`X`8q}U
	[dXR[|ZZ
-DxS6h7
Dy5Iy,gt;kP7S
D&yB#5
DzfIy/
 ~&"?E
(+.~,E
	E/&2$
E.238,
<e?2dRX
e@: 32.
=E3m+A
E5?n-8
E6^QNZ
e8:g:B
<E8,t-
<E9X7{
#]E||A'
eAH3mu
_EAyJRD
e<[!bK
eblp^=
)ecaf a|
E-C"	}@yd
$eD1?$'
E#E9oH
 E(<Ea
E;\EmnN
eEVypE
eE-x;s]
E_F*KfE:M
+eG'9/
eg^sW%	
\Eh>21G
e@{HN_
.eJ1*js
e#j=|D!
)eJ]r8
	{E$`K`)
ekaK4>0
]EL?f"EuZ
'E@@LQo
e^m8	1
e!<M,f"
EmptyClipboard
|eMt|\
EMu;~R
.>@+EN
EnableMenuItem
EnableWindow
EndDialog
EndPaint
EN?hmJ
e]=#nNe
*eNp0Y
eN	yrb
eou|*z
E?QGMU$
 e-	R;/
ER7*(F]#0'
Error launching installer
Error writing temporary file. Make sure your temp folder is valid.
.es4/!
#)E*T'
E(<T_a
eTd%"&
e_u:d2
Eus/I	
eU)s+J
EU s=w
ev7189
e[VCoq
,eVirZ
EVY(aS
`E[vycp
eVZl:0O
_=ew\,-4 
ExitProcess
ExitWindowsEx
ExpandEnvironmentStringsA
exsjBY|'
EY8c+P
eYr2Ch
F,124VZ
f13Lqej
f2C]J~
F2)]Es&r
F"2XVhv
&F=5gv
()%F8}
f]';9:=f>
fA*^3V
FBCCN`
{fC	 9
*[fCBO+
fc|*dN
FC/D#O
"fcO<"p
f\d$kD
]>Fdq	'e
*Fd}.UH
	&FDZu'b
fel?yj
(F<F[|
]F?F7Yh>
fF96x4
ffuZ9GM
ff>x;+c#
fg?6Uh
=^F?G9
.fgi==4
FG-\J?
=f_gP>
FH(e1%
(fhT_`m
fIc.QB
FillRect
FindClose
FindFirstFileA
FindNextFileA
FindWindowExA
FJ.G(Bj
\'$`fK
<|#Fk)
FM)8zd
fmy]v7
=/fnhr\
FOm< e)k
foX)Id
F,Pj78d
fq`B7{1
FQfe`!
F.q~H 
:?F)r{
=Frd\b&w
FreeLibrary
f"~s/7
Fs[A]Z
FSp5k\
fS%{q1I	f
FS<Z),
F@[.Ug
`fUk;I
fuPVq4(0i"
fvnP`~
fW&_JU9<
f"x$&}
G>08A+
G1NwV Du
g3m4SU
G5[;2jaxv
g`5^'H$h
g62m|O
@g6A<W
%,"G6L`
G7E/Cv
G&%~a>
gb.C,q
GBlM|q
'`@GcU
G%|cYe
G(di<]
GDI32.dll
g,dt7m
:@g;'E
|GegBX
GetClassInfoA
GetClientRect
GetCommandLineA
GetCurrentProcess
GetDeviceCaps
GetDiskFreeSpaceA
GetDiskFreeSpaceExA
GetDlgItem
GetDlgItemTextA
GetExitCodeProcess
GetFileAttributesA
GetFileSize
GetFileVersionInfoA
GetFileVersionInfoSizeA
GetFullPathNameA
GetLastError
GetMessagePos
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileStringA
GetProcAddress
GetShortPathNameA
GetSysColor
GetSystemDirectoryA
GetSystemMenu
GetSystemMetrics
GetTempFileNameA
GetTempPathA
GetTickCount
GetUserDefaultUILanguage
GetVersion
GetWindowLongA
GetWindowRect
GetWindowsDirectoryA
\gfTZQ5
Gg@,6~
<*gh+(
^G->ha
gH`Aud
@GiJ_[
g`i{Q)
g^:$lB
Gl~lH+
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
"G\lXo
GmI*n8beov
gMs81Czz
_g-NHOC
GN^(P55
{},gO6C
gO~9kw7
`goWs)pV
G:PFk{:
Gq?9`9
GRz5d8
g~&sBhe)[
Gsw!1E
G.T[^#3
G,TA}~
GTJbI#
G/uw'W
'g@Ux:Ql]
GVh$)i
gvq-|T
~G/v\w
GW6taD
) gxa>
G!xetXhSev
G"XTMI
G<.Yv-
*<gZ8Y
"H>1F"~
H2(V/s
H31g5/
h?4evl
H4PE?F
&H4whb
<h69WB
H7dl#&
h8>%B0
{H94Rn
>Ha1ES
{-h,	B
|h#b/g
=<hC)E
%\h`cW
/hCWC/a
hdSL(%
]hemS6
HfLS\+
*!hF}R
:&hGSa
	H[hqj
h_hr@A
!#,@hi
hIgGWj*
HJ84u~p
h<Jm2P=
hju4d|r
Hk~)'u!V>
)+H\(l
hL99r"*
hlk `ji
h}N{44
hO04*0
hoL^3&
HOtmG2X
H"P7o&k
HP7+U4
HPKD){
}hP;^P
HQ^BXx
hQo>q5~
hr"UA*
H!s[$r{P
*hTf)x	`
http://nsis.sf.net/NSIS_Error
H.U;(.
hu0=[V
H[.U>3z%y
_Hu|n#
<&hUzl<
Hv2 v 
#}HW?X
HX}=aS
/hYQ40*
hYZCtm
<H+;`zP
HZ(q>+B
HZ>qwV
hZR:yN\
I_0p`h
i[~4EkS
i{6E/a^/
I7Ip8_
IB#g"8
IbMp`X
I,/c//
i|CiKN
-'ID;@
I_dizhE~
i:)dJ$
i)d:<U9n
i$EALe
Ie"tJB
;if/3W
IfxXYz
IgqSTI
>I,gyK
igZ3<Tr[S
@iG$z^du
ih+'`o
II554m
ii/j^H0{
iIVUAF5
i(%I(W1I
).&I#j
=ij>ls
i~j nYG
i*j%Qlj
^IJyz3
i-KIWm
IKz.vZC
Im3hOSC
ImageList_AddMasked
ImageList_Create
ImageList_Destroy
I@M)'v
IM|["x
}_i<{N
incomplete download and damaged media. Contact the
INK3DXt
inS].iX
Installer integrity check has failed. Common causes include
installer's author to obtain a new copy.
Instu_
InvalidateRect
i)NY?:T@*
iO*`9 
 iQq3_
iRichu
IR	Uca
}I"'@s
]|i+SG
?(isI4f-G7QQ@
ispc$&
ISPm|G
IsWindow
IsWindowEnabled
IsWindowVisible
ium!~q;!
I=|U(Y
i]@)V{
i^V8Vjp
Iv	_!-:a
i&v@>/YL
;Iw(4b
IW{}?S
\I_x".
ix=hVd
#Ix?sr,oS\
i&XwYc;
Ix-xJq
iYQZ8W
iYw"9d
i#	z_{
^<~%>J
~*"j?/!0 
J__0Xv
\\J1[u
J29)*pOnR
j2\BwR;
<J2JMI
j2&(Rl
j3F-ta
J3g^,#
j4kY!9C
j5QS#3
J7tz\C
j8&~Q[>:B
{j'bQQ
jc^Lpq
(%jDgu
J]Ek_`;j
je#Q=,
JE".vN
jf-LpH
jg]2\F
j%}gp38
JgU73j
`JiNS@
J?]J~fj
!jJK+ox
JKHQk+
j+L>Z>
JmSF6^
J^nk83
@>J^NU
jN]ud|ae
j-	-NWb
JpO_F+
j~Pq^F
_=?JqL
J{q,NN
JR`it 
J'	R S
J:{S]l
(;J:SL<t
jsMdTA
j{SR!YZ9
JsvMho1>Ev#XC
jT1li2
j<tQm7
Ju.dz*n
jv}g4F
 jW}:@
&j]w$gZ
Jwkr08%9
J;xO1b/
(JX")rw
Jy'!cY
*@&JYv
J+z&'3Gj
$"k.'-
k1(ryY
k1U(}iv
k3`?';
k37f77S
K{'\}3M
~~"k4!
K4aJ 4
%K5`2C
,k54G/Obd]
k/6ir/-\/
K7oB;Ev
k|7vYa
->k9+~
Ka)/AB
k(azaP
kbPN'j
\KdFG`'
?KDH?GQV
kdjY=V
kDl'~gwJT
KERNEL32
KERNEL32.dll
k ;#fD
KFL5\S
kfO8)@XQ
}?|Kg:
$k(H|!x*4
KizYD&
=kJ \6r
kj=Dv$
kkw'oFX
Kk,W^R?
 kLc!(
k[M765
;kM8yv
k&MFz*f3w?H
?koG3;
k_+oP/_@;=
K:O~=/R
KO	>)_YO
KpRx.dD
KP~@YP
K":QeDF
$kSNh'
k-s_vt
kv}cpo
)kvsw&E
kWs3u<
Ky7BX!S
k]YA([&
Ky\xRt
Ky))*Y
~$k]z*
KZf80s
;KZL	Ju0P$
KzVPK*
L!>[?^
L$< .]
L0?,M,
{L+%1>
#l1om%
&l1{Xk
&*L3aC
L:3AZ_	Xl
l3D+0m
l]3I@t*
L3J^xS
L6|(1c
L|7c['
La;blC
L&=>%B
L&~Ba`
l/b\IN
Lbmd/a
Lb s"Dr
Lc4vVs
L~CaD/
lC>r 8
L$CRV5
),lcW%
LCzl6+SX
*l}D\9
LeaHPN
Lf"pzn?
L]>HiB
(lh	$w
Lk#%9)
LKDK	>
@lKO0P
")LK/Z
LL]:h}cr
l%[l@N
]`Lm:$
@lM^2@G
lM4s;]
LM%MQ(H
L*ms#/
lM`}VI
`!`Ln%
lN$"1j
?lo.%)7
LoadBitmapA
LoadCursorA
LoadImageA
LoadLibraryA
LoadLibraryExA
LookupPrivilegeValueA
LPg^/p
!&l?PK
l"pKKX
l?q!$4
}/LqNE
lq_ubI
lqU`TQ
`+lqY&
lRftdc
lRo9/+L
%^l-RS0
|lSK$2
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpynA
lstrlenA
`l:@	T
l^^(&T
l<U}bp
\luOhio'a
LVk@F,
l?V_P!d
*+l,@wCl
LWWO=U
lxw2u5
	=&]@ly
?(.L	Y
L.y86-
L[{Y]f
LYn+C(a
(Ly)q$
lZ0MR;
m~;|}	/
<-M.3-
M~4"b0&
m8I|ua
M9RyXz
m/A*1/MQ9
m}AqR{
mcB:O6
];*!mD
mdQtkr
M,EI6<^
^mEjwQ
mE~o%}4
MessageBoxIndirectA
Mf""2j
mgazwa
M\GC)`
m"g^$s
!}|MhZ
\Microsoft\Internet Explorer\Quick Launch
M/Iqs9
M~.@iT
,,m\jC-
m:J<*j]
MJ>Jg{
mJNRtA
Mj"O~I
;M]k?h
MK//UMg
^m?`,M
_mM~55
mMP<S]A
m.!=#NS5Oj=t
^mo#L`
More information at:
(mOtt+V
MoveFileA
MoveFileExA
-=Mp`6T
M<pQ(e
mq/%my
mqrm5U
m~-s\<$
_m/s2>
-~Msnu
|Mt(l58
	mTUY)
m-u"b\
|m>`Ug
MulDiv
MultiByteToWideChar
"]MU&U
%M'Vop
M	W8U4
mWAt5}
MwUBh]!
MW:V.?
.mX%wO
MycCw6%
myH8J5V
myp1dV
	mYP\y
mz"ADHv
'M^ZBQ
&(Mzgj
?'n{01
N0`N2>6
>'n!}1K
n1wevm)
n5dhuO
~N7f*sp
<n7u[o
n\^?-~9
N>9"H2Q
N9$$OK
)({NA|
n=(brU3,
ncha59
n-:]cl{$C.
.ndata
(	NDGf@
^NDG+sQ
N*& egR
<Neh_H
,nENU7
?(nFZRu
*NG~B2
Ng=eLd]
NgK6 $
ngR#`4
N~{gu)
|N("~h
nhE^E?>2t
NI)]bg
NiLu@p
n"JYSf
NKXF	\rj
nK~x"s
n.K%+Y
#`Nmq@
	&nnpj
n[oZi[x<t
n)*PuZ
= ~npxG
N$QH=x
NQR$A70
Nr~N@#{
{{nR'<z
ns1JTa0n
NSIS Error
~nsu.tmp
+n]]t:
Nt}N f^
-NUhiB
NullsoftInst
NulluM	E
nUQL<gd)
nuVOd-
n`*v\l
N.#]w2q
.nw*8.
')nw&f
NwPYX,%x
%NW\S$
n$w=W"O
:NXiVl
nyD3Va
*NyIz\
Ny-RBv+f[
NYsJCOSh\
;~\%o%
o))-(/
!O@~|!
;>	O@0
o0H@_O
_O1Ru88t
o2?mMM~_
O2*~Na
'o3$::=
$,o-3"
O 3FXYE
o5R|zfL
!O)5'y
O,6l'L
O*7&%Y
O8^yYe
|O9\3C
]%o!*9hX
	_O!AA
OAR[r	
o#B<d4
OBGU)F
%OC:<<
	OcCDB
-O"cIG2
Oc%sqx'H
OE/g}9)
o`\eP-
OeS~71
=oe!tCk$N
oeV~Hw
ofAZ>)h6
O;fc~!(
Of[hm'
`OFzU4
(o+in-
\oI*o"
^OI|W![
] O*	k
oK3X5-
o<l&2"
ole32.dll
OleInitialize
OleUninitialize
{+OLi)
_O|l'k
!OlnxBq
O&'`LU!
!O~M~%
Om3H\HF
O<m6Q:
/oNon;
	o^NoUh|
On Y*n
o*o;=C
<~Op5`
O*P7SIS|@
OpenClipboard
OpenProcessToken
?>@@Oq
oq4)A=~.Z
o_q7h)
$oQCw 
{	O@qrg
ORDPVykpL`
/orKUUY
O]SD7QR
Os-i\Nk
osOw>$
osTAab^Y
o*t_P?
 O>W&n 
",oxaAIwl
o}YAaW
Oy) Jc
O;YPD,
%$!P$"
%P*.$$/
-P_]1+
?.p2\Y
p\3-oF
P</4K}
:p6?$$
P%@7_$
.P7{df
)`P7S,
)p8"=>
P8}D4	
p9,kBF
P}An]!
]{'P	B
Pbsp+ Hy
]PC{fN
;(Pe."
PE33yh
PeekMessageA
P'	f5'
Pg$2W]
`(pHYn
^PhyW0
P!iMiK
p{,I^v
_p_j<>
P|jJ?w	
p>J	qf=
PKG4fI
(pKh!2
p}.KUS
p|!l.4
pM^EJqj6
|PMH'W
pm=k,c
pN=pJYa
$_Po3|
PostQuitMessage
pP~M(BdY
ppo:8LG
PPPPPP
;P#pqy
pq=I19gYp
=pR[bZ
p?S2G5
PUh`X?
puM{kO)
PVbNx;
<P^vR9@
pWgt	$
>~)Px8!t 
?P+;xH
pXZ@[[
PY2jLu2
,py9L2F
P!}Z1U#
PZ*%b|
Pz:{)H
)pZH2A
&P{Z)XHS
PZX?TV4g-
Pzz	9i
/		>"q
q{>[',
"@%~~Q
Q1;Ct	
@q1Oal
Q4{b).
Q=4QV;`
">Q^{5
Q5#z$l
q8aNlI{
q"8v]]'
|q9Fe~
}QA2Ws
q$abZ2
qA"j|9
QAMT)S
[Q~d\Ag
QdIMKG
Q[D*JY
qE`>C2
q/ezF,
QFN*O*
qf@NP:jZ
q}G0#F
Q)h0Jxd
QLajRn
(QLoW?
q%mcI2
QMm^e<
]q`mY&jg
(%QN|c
=QO;2(
(qocE3
qO;m?!
qoNTaXD
\qOOo7R
&/*QoP
q='P`v
,QP	x>v
{Qq	[=
Q"R(lZQ
Q)R"s?z
qS\)NV
"qTa3Qi
Q^tGnI
"Q]T w8
qu].PP
quY;v5
=_Q;!v@
"Q)>x*
QXC1`.E
*}~QY?
,(Q:YbT
qY]D	%
Qz	DQ*
qzJvb:H@
R+0IU|
r.\}12R;I7*
R3HBNz
R{3JxV
r5-5}>[
_:r5Q%
R7Vt8mM
_'#ra/
rAhpHT
*rARvG
rb=0EK
RB:~bx)_
r]Bgqaa
:	rc0$6doS
rcO0S%
|R)+=d
`.rdata
RdK~Yk
Rdq'VV
rDs.Rc
ReadFile
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegDeleteKeyExA
RegDeleteValueA
RegEnumKeyA
RegEnumValueA
RegisterClassA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
REH`	}
RemoveDirectoryA
[Rename]
r <+>f
rf+dCd
"RHmTK6
RichEd20
RichEd32
RichEdit
RichEdit20A
``rjDs
Rj( pa
Rkd\OE3
=rKG!9
R`LzOy
rN;~1u
RNv?'	O
rNVWjos_g
RP49Kwb
rp**}P
~;}R`pZ
rQDu^M&
++RQH+G
rSe13h
:	Rsf(
rSqNA"
'RT%(C
rT&n*HNf
>>rU#}
r\u8	Xyb
ruh!mO
rV]-A|
,!r#.VW
R`w}3i
}:RWLT
rX?A>Hr
rX@<A=P
R'xMin
RxTfT,
_"Ry#^
<R&yR8
ryZQn%
_')s+\,;
(#s2.W
~s5m>ke
`S@5,v
<s7\"9s
s^7fe8
>S8:M	
S['9|?vU
S9V'Yw
SB`OrS4
/sCM}M
ScreenToClient
:SDpk`p
SearchPathA
SelectObject
SendMessageA
SendMessageTimeoutA
SeShutdownPrivilege
SetBkColor
SetBkMode
SetClassLongA
SetClipboardData
SetCurrentDirectoryA
SetCursor
SetDlgItemTextA
SetErrorMode
SetFileAttributesA
SetFilePointer
SetFileTime
SetForegroundWindow
SetTextColor
SetTimer
SetWindowLongA
SetWindowPos
SetWindowTextA
SeU`AR
s&(f;5I
Sfk.e`
]SF&oM
sgO[Y>E
s#H0,I
@SH6C,'
SHAutoComplete
SHBrowseForFolderA
SHELL32.dll
ShellExecuteA
SHFileOperationA
SHFOLDER
SHGetFileInfoA
SHGetFolderPathA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
+shj?	
SHLWAPI
ShowWindow
SH,V{K
SIes@sY!F
s`,"iS
(S[IuYK
]	+s(j
sj<1#>
s".Jo/M
SJQ>TLA
sj!tCj
%SL=H+
>_slnp
SlzLi[
s-m:y/
sNn6I9
SNPf99
softuV
Software\Microsoft\Windows\CurrentVersion
soH~BF
s{$[p[
&S#@<<P7
Sp+T}\
spzF,J
s+_)(q
sq+}$i
s{Q.mn
SqN^0GK
SQSSSPW
s=,,S8
}ssJ,\
S	@S_W	
{s tK"
S|u+E 
~-sU/l^q
_SV;=~
Sv{bW5v
=:Sx1!
s"x1ZH
sx$9c]
SXm0~+
SxNEo@
s^y'q9
$SY%(Qi
SystemParametersInfoA
s>_zZ2
> _?=t
]~_T$?;
T><}^'
{T088.y
@	T0CU
T[]?.1
t?2[b~<3
T2;;DbP
>.t^4\y?]
>T54b^
;t5zA\
T)8cm(
t8u{Q<
%:Ta"i
T@Ap#K
TA;&Yi
T#&C5P/m
tC#V[OI
_}t!_;cX8
t`+DSf
{@Tek&
 t;ele
Tf-.8o
TFh%Jc
{T|	fk
>t%'fS
t-gb#*?]
'TgTr}
!This program cannot be run in DOS mode.
THmEIC	b
,TI;lV
\)tISl/
t	.Iza
TJcw%v#u
=@('tK
T!<|]Ku
=tKwwgZ
tLv3#[
tmp	l;
Tn8/*I
toR*:f'
_^[t	P
+Tp .},-}
T"qcr78
TrackPopupMenu
_ts13	
tSe~\f
t"Sktm
&-Tss9d
[ttnJ[
~tTQm!
tt?r5v
")t;{u
t#uhn/
tv["3p
Tvb'c`9
&Tv(]q<
tVU):5
TWe1ry<
T%]wov
T_Wv&6l
'{tww4
Tx49V\
T_x"aO
T^XEz#F
|tXLjL$
tX$SE$
(.Ty!Bf
=Tz`i'
Tzirgv
tz#(Z}H
U0SbTMh
U[1I2%
u49-,?B
u4K{ne
u7fp6h
U7$|GU
'*]-U{8V
UA6PUBg"W
,UAc=jt
ub*%xj
`U'C`]
UcHYPd
^U@CKY:
U]&~@d
%`Ud3A
]|udr5
U e,8z
Uef\V1
	UF)aF
!UFAN&$
@U\F`h
U#g	iM
uGS FZ
uH3Na]
UhGc-w%?
^~|u#i
ui6;)I
~(ui-D
(UiwuX
ui{/X9
uI`X 9
UjKk}p83=
]U~KHO
ukMb;/
u~+kYk
uLhRZm
u`Lmk+B(
:*u}{m
UMd7o3]M
unpacking data: %d%%
unY)F\8"h
U?Prft
up#t\E
upW`(3
,uQP9Y4
uQ<Q!#
UQr^xk
uR>38di6
USER32.dll
usGmiI
U\.sIZIZ
u@/'t0
UTV)od
UTV[OPK
%u.%u%s%s
Uvgbmi
uV#@ZJ5{X*l
uwq@C6a
Ux&1\f
)Ux'9q!
UxFp[;
Ux%y%g
^UynDCp
#uyQXE
uz#`(5
UZ	b]'
uZX$!1)
*V%0b[
v0v.BNS
v,	'1;
V1f41we
v	1_iY
v5z#T|
V7*Iw<&
)V8GA$DL
v95LpA
#?v9n,nd
$VC=BM%
v^#~Cm
}vcwC-Z
Ve6w</
verifying installer: %d%%
VerQueryValueA
VERSION.dll
*V|FIT
vf<<l7]
VGP,mn
(V@"h.
#Vh;+@
Vi<qfeJ
vj.\z%{
Vk-CJi
vKMqEn
VLEr)Z
\vlg2R
Vn84Sm
vN")$E=
v#nwm$
__V_N>x
vNy\YA,
,vonnE
vOY\m&_v	
vP)/f(
v%>	pm9
V#@poc
vq$_`)[.
vQ5eYq
V&qA[k
V~RDw"Tn
VrZAn?
VSo\E}
VsUrXf
VSW/gG
+VVe+9
_v@VFC
vVNWt0b
'V&/vrp
vwWR_[
v{x0	p
vx6@((
^VX}Pk
vy<[rJHF
=w]||(
w0-#{?
$w0|Knw
w-_11d
W2XdX[+"jv
$]w4n;P
\W5~UC
<W86-R{UA:
w'9l5F
WaitForSingleObject
WAUIQP
\WB*Gr
&$Wb,Jp
,wBKHG
&wbspD
 wd5f+t
w*/e	2=o
W-^hXp
Wi-0A3,
W'Ij.%
wJ;*cBU
,wjW`K
w~k0:{A
w,;K3F
|w+>.k)!e
wK~+H?\.
wk^R!lE
wKSm]p
WktGu$v3JN
@*\w,l
wl69iGC)
Wl$:p3
&}wMi>
WnzW^/Z
woh`px
W*OqjVq
WO.;Tk
W|Ou&M
w	O)_?y.
&W"-p|+
W{p)`'
WriteFile
WritePrivateProfileStringA
wRthU#
wsprintfA
wS`vs=VDk
w$/.Tr
WT#u0Q
:|W^vj3
W-w4f|_
wWEHMS;
wx:~aS
wxdwU0
W{y`x^
+Wz4; iLW
X$0pdnzw
x0YQ +2
X16,:onU
X1&sH_
	:x3pl
x4ePA"
x5j749k
))X@6n
X(8vr+9@`|
x+9[Sq\
x:aBa2]|Jp
	'xA,lt
$XAs=Q
XA)XS]T]
\Xb)pa<u
.xCxkVT
,]x}d4
X;DF~AK
xDJ6%Wrr
,:`xDP
X'[e'"-
X`E0TL
(%XEFIT
_@xf+D
.XfT*{
x\fyw.J
#/x=h8>
xhX3Aa,
&xhYB=
xiA _N
[x}j8Z
/<x]jO
XJ*{*X||
XK32Yh8K
	XlEA{}
x%Mk|p
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46</description><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>
\xN2lG
.x!N3=
=xN}S:
XntBma
XNYh$!
x>!oCZ*~
x!;)p+`:
xP1BN3
x]P'?QI'.E?""51
X#P]ZX`
xQK^+j
>$xQ,=r
+x^rG4B0
~Xr,N'g
x.Spj`
+@X|T{
xtk`Wc
XTSj$2
-(xUGoa
xuM1zR
x@Uvyd
XvaMpE
xv BK1
X v:On=
X#wxD	
>X;Y)(
xY>QyD
x\!{Y$u
x-z7gu
xZp$R@(
{&[xZx
y[0(1n
+Y0L<Q
@ Y4QR
y{"`50R
>y7]{?
Y>7\?I
y9hlhW
Y9,Lv#
yaalb"/rN
)YAM7UOQ
%YbCoPr>
YB*fBT
<y>\b!;[k
y'>C'Ic
yDz{'c
YeBeAi
:yehA"
yeS\u-
Yfac-9
"YFUJ*
+*y?G5
Y$glGpET
y@h)+\+
y;H)_D
yhFaGf
YI3x+%
YjfP!+Ln9
	yJmr@
Yk9.sR
Y>L)9Y 
Y<l	`b
?yM8TK
YMi:Qm
+Ym^m?
yMXD#h
yohu%x)
YoTv O
(_yP5%#
y&pP9E
yp*Q?}6Z
`yQ{b 
[$$y]R
yrs:%~
yrxXQ|u
ysctri
?\yTi<Zl0
y?UI?\
Y.	uX6*
yvtYy-
YW*,1+
y'WLxU
YwxmHp
Yw\ZFIm
~YxBpp
yXoLYE
YxPs[q
yx.'RX
yX~WG 
YY4}_>
yy[5waC
Y%Zd/;|nt
	(-|'"\z
\	~z1#
'Z157.c3
Z1n:DuF
Z=}1Ry
Z-1]TQ{
z[2Xxl
[z3{ W"
\]Z4\L(
z5|!/u
_{#=~Z8
?,Z:	8
Z-94BB
*ZAs-XI
Z{B3]OT
=Zc/bgJ
Z;,c+r
z(%CrG
{~!]{zCs
*ZD0;^
z)@DM`H
zdu(0BQ
'z;e\	?
ZePj,Uo 
Zeu<#T
<zFQp%
zftbc7
zGhsq2
ZGW|Ue
:,-)ZH
Z'{Hj-;N12
 :ZhsmT
;z}I#	+
Z;{iE5
`Z!izFO
zJDU<p
z>j	Ef
Z*KV%D
	Zl0o6
,zl5e?
;Z	LeK
]<,ZN>m
z}N^`.u
! *zO1
]zOR9^
Z,@pVD
Z`qf'/
]z~QM*
?z]q-u
"Zr@SRZ
zrZ-W)
@z{[T|.3#
 ZT~az
z#TrV-
~ZTv!q
ZuLdSV
zv7A	b
z/V>%H
}zw.Zx
z)`xIy
z)YA44
Z) z]fl
ZZ)I&M5
zzN[<^
zznN%:<7
>ZZ\r>eK
z!z_ue7S