Analysis Date2015-01-09 22:31:26
MD51a3cbabae32cd79af3c601468efbd31e
SHA183f1b170eb44827bb1a5bc1c28082aceee5e8208

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
SectionUPX0 md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
SectionUPX1 md5: d9a343efc8694f6f7eda09fed0dbf55d sha1: dd3d6d815669166ba2e4b9a3ac45cd9874dfe9ae size: 954880
Section.rsrc md5: 463375f15d70c60d78eb4a0a363a50f5 sha1: acc7a5b30ec6afa4232bfb640de67e9e14086f44 size: 3072
Timestamp2011-08-14 08:06:49
VersionLegalCopyright: © DZY Software
InternalName: Bklvwl.exe
FileVersion: 6.1.7600.16385
CompanyName: Heaventools Software
ProductName: © DZY Software
ProductVersion: 6.1.7600.16385
FileDescription: Maqoaxlaboiohednyodoledzeobeq
OriginalFilename: Axk.exe
PackerUPX -> www.upx.sourceforge.net
PEhash8ae1f7bd4343ff29fcf52e9d5ebe8855a3e8d568
IMPhashec317d547dbd464fa332867922dbf7b0
AV360 Safeno_virus
AVAd-AwareGen:Variant.Kazy.12946
AVAlwil (avast)FakeAlert-AYN [Trj]
AVArcabit (arcavir)Gen:Variant.Kazy.12946
AVAuthentiumW32/FakeAlert.OT.gen!Eldorado
AVAvira (antivir)TR/Crypt.XPACK.Gen
AVBullGuardGen:Variant.Kazy.12946
AVCA (E-Trust Ino)Win32/FakeAV.AS!generic
AVCAT (quickheal)no_virus
AVClamAVno_virus
AVDr. Webno_virus
AVEmsisoftGen:Variant.Kazy.12946
AVEset (nod32)Win32/Kryptik.RQF
AVFortinetW32/FakeAVPk.AC!tr
AVFrisk (f-prot)W32/FakeAlert.OT.gen!Eldorado
AVF-SecureGen:Variant.Kazy.12946
AVGrisoft (avg)Agent_r.ANN
AVIkarusTrojan.Win32FakeAV
AVK7Backdoor ( 04c53e771 )
AVKasperskyTrojan.Win32.Generic:Trojan.Win32.FakeAV.ehwe
AVMalwareBytesSpyware.Passwords.XGen
AVMcafeeFakeAlert-Rena.q
AVMicrosoft Security EssentialsRogue:Win32/FakeRean
AVMicroWorld (escan)Gen:Variant.Kazy.12946
AVRisingMalware.XPACK!48A2
AVSophosMal/FakeAV-LX
AVSymantecno_virus
AVTrend Microno_virus
AVVirusBlokAda (vba32)SScope.Malware-Cryptor.01499

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FilePIPE\wkssvc
Creates FilePIPE\srvsvc
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\1.tmp
Creates FilePIPE\lsarpc
Creates FileC:\Documents and Settings\All Users\Application Data\defender
Creates FileC:\Documents and Settings\All Users\Desktop\Security Protection.lnk
Creates ProcessC:\Documents and Settings\All Users\Application Data\defender.exe

Process
↳ C:\Documents and Settings\All Users\Application Data\defender.exe

RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Security Protection ➝
C:\Documents and Settings\All Users\Application Data\defender.exe\\x00
RegistryHKEY_CURRENT_USER\Software\Microsoft\GDIPlus\FontCachePath ➝
C:\Documents and Settings\Administrator\Local Settings\Application Data\\x00
RegistryHKEY_CURRENT_USER\Software\F40C5BE803CBA1BAFA8C3727B0D8A9DD\FRun ➝
0\\x00
Creates FileScsi1:
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\~DF38D2.tmp
Creates FileScsi0:
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePhysicalDrive0
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Creates MutexSecurity Protection_MUTEX

Network Details:

DNSfunnyteens.com
Type: A
192.185.119.216
DNSyazminx.com
Type: A
208.73.211.244
DNSyazminx.com
Type: A
208.73.211.250
DNSyazminx.com
Type: A
208.73.210.211
DNSyazminx.com
Type: A
208.73.211.167
HTTP GEThttp://funnyteens.com/images/s6.php?id=112
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
HTTP GEThttp://yazminx.com/scripts/ss.php?id=112
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Flows TCP192.168.1.1:1031 ➝ 192.185.119.216:80
Flows TCP192.168.1.1:1032 ➝ 208.73.211.244:80

Raw Pcap
0x00000000 (00000)   47455420 2f696d61 6765732f 73362e70   GET /images/s6.p
0x00000010 (00016)   68703f69 643d3131 32204854 54502f31   hp?id=112 HTTP/1
0x00000020 (00032)   2e310d0a 55736572 2d416765 6e743a20   .1..User-Agent: 
0x00000030 (00048)   4d6f7a69 6c6c612f 342e3020 28636f6d   Mozilla/4.0 (com
0x00000040 (00064)   70617469 626c653b 204d5349 4520362e   patible; MSIE 6.
0x00000050 (00080)   303b2057 696e646f 7773204e 5420352e   0; Windows NT 5.
0x00000060 (00096)   313b2053 5631290d 0a486f73 743a2066   1; SV1)..Host: f
0x00000070 (00112)   756e6e79 7465656e 732e636f 6d0d0a43   unnyteens.com..C
0x00000080 (00128)   61636865 2d436f6e 74726f6c 3a206e6f   ache-Control: no
0x00000090 (00144)   2d636163 68650d0a 0d0a                -cache....

0x00000000 (00000)   47455420 2f736372 69707473 2f73732e   GET /scripts/ss.
0x00000010 (00016)   7068703f 69643d31 31322048 5454502f   php?id=112 HTTP/
0x00000020 (00032)   312e310d 0a557365 722d4167 656e743a   1.1..User-Agent:
0x00000030 (00048)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000040 (00064)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000050 (00080)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000060 (00096)   2e313b20 53563129 0d0a486f 73743a20   .1; SV1)..Host: 
0x00000070 (00112)   79617a6d 696e782e 636f6d0d 0a436163   yazminx.com..Cac
0x00000080 (00128)   68652d43 6f6e7472 6f6c3a20 6e6f2d63   he-Control: no-c
0x00000090 (00144)   61636865 0d0a0d0a 0d0a                ache......


Strings
.
040904b0
6.1.7600.16385
Axk.exe
Bklvwl.exe
CompanyName
 DZY Software
FileDescription
FileVersion
Heaventools Software
InternalName
LegalCopyright
Maqoaxlaboiohednyodoledzeobeq
OriginalFilename
ProductName
ProductVersion
StringFileInfo
Translation
VarFileInfo
VS_VERSION_INFO
`%^)$_
.|@((>
"@< #+
(^$[%#
$+{[%@
00K_Na
{0&`1e
0-2;b7
?0{3SO?
04v8y4A
05&].3.
0-%=79#3
%&0a=EI
/0AJCTy
0A	!=r
%0D'<1
^|0eb[
0*`Eca(
;0ewEJj
0GRPfN
0gzvJZK
0!;hrB5\%
0hV/SR
0,$J!T
0{k2Gn
0K^2uF
0-k7wiKf
0K KYo
0Kv)A`Q
0m$){?
0M}.0q
^0#;N+
0nfEbUs
0@:Qn 
0rmR`n
}]0ROF
0%*SGm
0t#74lp
0V_4?h
,+0VO}%
0@=vvs
0-x)Hbs
>11Sa2
*	1_2)B
1[3ae9
1+	5>L
1}6?CP
16rNVA
}<17WW!
"1A8^H:n
.1<b2)
1/C[H	
1DZt~H
1fao'A
1gRaidT&j
~1hzz{a
(1:\iJ
1`M4KhX
1~[Pc5"	
^ 1p<R
<1t*Z|a
1U^/v(
+1VB"8
1 xSod
1yH'1UJ-*
1ztJvh4
20-v(~
24-w&)z
!26l/T
,2.Aad
-2A<ZCU
+2CGPqC
2-CXO5
2d0|-|
2gT7(U
2HmM5iC
=2LOe3s
2&OL%/i
2p'~0b?
2Pzc=F
2`qEXT
#2+@V#
2v5WMUlpD
2$&VK=d
2wzdVEY9
2[x!w4
2>|-X|Y
3;0y<m
3=,(2Cc_G
336c3331
34n(+x*Dle
35t	f&
<35u_S
3!_5Yb
36,2gsx
37tC3333337x
37wwwwuWwwwwwwvgq
37x]{B
3"a[t$
3~)B2"i
(3BIZ&
3C5hTe
3D6"@G[
3E_VZp
3F?@$1O
3fEF>o
3Fl?Bb;'E
3GK]	 
/3g%Ob#
3gZk(x
3j+|@{
3 +j)2.
|3!K0f
+3nDp<en
3OM@&cQ
3q7"<[
@3"q'IW
3sk[7,
&3Ts-E
3V(ipo
3:;VK9
3!x~Ae
\,3yB-
3,ZY%n-
4;&2Qg
[4^6Rj
'4`B5^
`4E].[
{4HyV_
4.I3!W
4i `4K
4]I@}S
4:J".p
)!4kX^
4L!<Lj
)4L:S=
4<N_y#
4qB>)<+
4r9&mG6
|&4$reRvF
[|4|\'S
4S5~)m
<4&t+@
4/t^|	6
4Tv!l-q:
50'	&F
544urKt
_5<4O$
55X[Wf
?_5b4m
5B[-5`~Rq=
5B"Fm]
={5Bn2
[5ee@5
-5@ :H
5[Hsq]HG
5j0pRh
`5mkgr
5M/we}i
5NoUPF
5q1[$YNd
5\QHGE
5U=MR	
5w{zwe
5y/+pm
_ ~!6?
61	OH9Gf[
6@25S/
}	=6[6
6`]?7O
68,H{+{b
.[6*9c
"6A'[5
6aH ~=h
6|a	N<W&
[~6buv
6b""%UZ
(6cZ3 VK
{6f&6x
6g!6)$Q
_"~6Gr
%<6\gs^}
6h8>]/
6I).Fj
]@6!iG
_6JTON
6j&z{p
6k/	}@
6ka1wz
>6K+;Z
6l^*qU<
6N[;Gr
6+OqzP
6Q](KC
$#6(qp
)6")*+r
.6r}S;
6RX`+E
^6R~Zf
=6s|AA
^6/uh3
@6Vi6l
6>vt1b
6X9Rl]
>6XPH[
6]yf&y
6%z*4;
%6zXJ5
&7!</~
7'5#!Q
7=77Hk
^7,a|)
7cr$^P5
	7ef0,
7EI:K^
7g!#WoB
+7Jec'
7:JGL\
7>`j{M
7*oGeP
7O?q;7
7PRk)T
7Q.^."
(7:qLr
7Rt Moy2
7sy_o>
7''=]vK
7'/vX.
7:WT:B{
,7Xg^W
7,z$$!,~
8bMeJ3
=8bSte
]8C#T%R+H
8Dh9O7.
8/gEI[}
(8HOqe-
8hyo#o
8j}4?Cz/,\C
'8%Jl:
8Li"8e
!8	;L,v
~8~M4"
@8M>(E
8O2%'WR	
8P$	_?
8`=(Q0
8qOKYX
-8>QV8S<d[G
^8rt8i
8@rxHT
8S.A(A
8sS,W3
+|8Tjghl9J
#9?1Yo
!|9~3|
$9?5f0Z
9|AGK_
9bSXp;
9'bZs?
` :@9c
9eD04=
9E![iV
9f_@@h
9@.GPS`
9HlYIR
9HU3tL
9jN?G.
*9J)xg
9]]kN6
9l$\w_
<9MB<?3
9mJ		 
$9MV#X
9Mw.e.
9r$^#c
}9ssBo5
9uNwD4
9/Uq/gm
9#Vp0R
9~WR=9
9y"&4T6k
,9y7W+)
">.'a.
% !A>(
"A1s$A
a>,2B]?#l
 A3'y_
a47<9F
A), 4y
a/5jb]
A->7'qZk
Ab)rJ>
?,:ab)Z
ac>sQ1
ADkCqhT
ad?TX."
ADVAPI32.dll
;adyAz9
:ae|T@
 AEv$F
AF|gq;
aG3`*sor}
agt%w'
A #h$J
-AiZ0q
AK5jf~
Ak'*N!
AlIR;B-
alke&L
|~+AM8
Amb}m6
~=A:M-r
.Amvv*
;An{!k
An[TuX
aOrD_A
@`AOX%-2]"
Ar3}@	
a!Rf<Ml8
ARHDs9
^aR+J`
aRTIvH
{{AS8=
a;saZ5
AS|d&#*
Asg\!:
a:SKqR
#A"&]t
=<?ATj$~1@N}
av]:>1
a&V!82
]^a/Xa
aXE0J}9t	~
axsH{U
a:Y2X)
ay#O`@
~Az%e[2HB+
A[#{`ZVB
!#'B.	>	-
=b(1_e^}
*B2[ec
",B2ef
!,B41<%^
B67R+ON9N#
B6A4.l
&b7s^Z
[\b9Zc
^~^]Ba
@bAiAlp
B@=a-k 
B/A#.Tw
b*aXU<Ed(
Bbzg*"
B;CG*l
B(e;#l~
"BFc}h
_B%"G#
BGdUMj
BgM?Uq
^+~BgT
B	Hnd5
bi2}ay4
BJ+DFE
!bJ{E~
^bL;[Il
BlS;+i
BLx>;/
BmPg)"
B<mZ!!
bn$-;.
b>nA%J
BoIk6fs
BO!x}FX
b'p_]B`
bp$ B|
b+qDmP
B.qiKVz
',brQ>
B Rw){
B^RZ1tN
-@Bt:9
(B#u"bz
BuG |k{'
.>B=Ull
/(]BVq(
BW&3a\
!BWB]rc
!b:wD\
]B>wW8;dn\
B.XYA(
Byh6^2VP
:b+zJ@Ls
b)ZyDj
b%ZzfHs
C=\",)
[C0ZMo 1
(+:c1L
C4B~$s
'</.C6:W
c	!/7I
c7N:	*
+c8E5t
C/9oHL
[cA?vw
>//cB-
.c	b2{{
cB3^c:
Cc<c`/
c%)+CZP
cdaX>/J
Ce?~	2
C-EjY+|
-%CFg%
c$,Fo~E
C}FTbL
C\/gB1
cg"g{K
CGoRqd,
cG}t+	
c[H|&|
C>$-H}
,]c{i(l
cIu	?3
C]IvO,
}'c?*Jr
C`k|O`"9D\
clHiu#
Cl*H_m
clzbfN
Cm~"@*
cm.flZ5
>Cn@/v
COB+.8ET
CoInitialize
COMCTL32.dll
CopySid
c\p8`1
$cQi>H
C[R+aK
C>`R+j*
[]crJ\S
*cSB0%
C$'SnTP
_c+([t
C)t1X?
CtE]%Y
CU9GX:
*cVw_q
:cW;B5
~cwMmK
cWPc/yrU/
CXd{"UXT|
%cxOj6
&c)YSs
 D0;LpI
:`D3C@
&d3E#aG'
D3J(BK
D3p^ZS
~	D3%[y
)}D4.Ur
D5pZng0
d7G.dhn
D$8w^,
d/94OhL
DAGJ:3
@Dag=[T
d(B"Nd*q
}^]dbp
*db	t>
DcuI6)8O
dd1J7!Jq
D>D94JX
DDDDC33?
DeleteDC
D+ex|K(
d.)F/8
;`{Dft
@*'/dG
d!g}w0
Dgx6~u
DGxBeB
.)D$H)
|dHhB9
?.di+^
}^diKb
DJ\8e+
djA%Sb
d!]JGG
djI8E'
dJk7GW
[)DK(6=
DK@C15
DKiM1P
/Dl8"Ufn
D@L dq
Dl;t/mL
d.m0iCL
Dm",' %9t
	dnEeDp
D>o%Su?
d?pPR2
d^Pq);
dq1dUo
 DQr:K
[Dr[D4
dr$,ex'`
d\Rus?
d*s1EQ
DS@.48
dsR{(*h
{^_DsU
`.Dta^
D$t+D$\
D$t#D$h
DUBZ}^
(Du$=P
duP^dWh
}dv9XT
D	-vbD
dvIlJh
D:WGSs
d^XfLv
dxGjmn
`|Dxp9Q
(D`yI\
"dz<(-
["dzAj
E&\0VI_
>'e0Y%
-e-2FN
,&e\2s=
e2uad-&X
&E3zq4>
e5?,gd
E*.88W
~}e:{9Gr^i
}E9-.x
ea	0ph
e-A7LqIq
E\B42u'Vq
ebn&$h
e*BWvY
E\d]5gT
eDCF6!
eE#&b,X
EF`\( 
#efRkN
EiH+g7
EIn:?x
Ei--{ S
E|J.-&!
$:	E#j1
eJ5bjVM
_E?Jgx
ejnbQGr
EJ\pr7!
e\#\k@
#ek5}W
elI]ADX
E?L?jq
eLU*!"j
~+/eLUXH)
/Eme%P
)]e	n`
e	Or?lT9
eOX&k$9
E#,P\s
e(`QbC
<Eq	nV
e~QVGa
,e\.*(r
er*7Pc
er"[/A
ESQOS.
Etd	'{Y%
eUnXh/
EuO0)I*a`
#EvtVHra
!ew`f$#|
Ew!R:~aI
	e_x<5
EX	i=jwiiE
ExitProcess
e\'x-L
EXw6$Q
eY,Kwf
:EzDe700\wm
ezPB`k
~f.?%$-
f0O]zF_
F1'&y4Y
]F$2dJn
F:@3\tV
F[)<"#4
F58?MAx
F5/Zip
f7-"7;
f7rp~[
)F8e8;
F>8tm	~*1B
f	9z*}0
F`a(cZ
f=[am)
	FAU@P
`~*fbgJ
Fb#tlV_:
fcq_8ld
f'}+<E
FE-q	e
^(>_fF
fffffm
{f^'fsB
FFShGb+
FH[ul#
fh,V#{pMZ
Fio^nd^
F<Io~Y
"F~|,j
/F(J &
Fj8*p1
fJyMz<
Fn1KA_
fnb\>7
`&f>/q
Fq(uMD
=Fqw"U
`-fR4]
]\fRQV
	FsC3J
Fs*r?Y7|t
FtBe)4
f%+tQ["2
FU?#%?k
|$fv?Kl
fvZ/8A
fw$0$~3
f+wBBb
FwRE+5
]F)x0f
F-x	N8
fyD-l:J
FYRpWU
@G0/Uj
,G [21
G#2{r1
[g>2T6
G2|>y(
G4D<%`
g 5L=p
G7~&pJ
g9,f3}
g9l;@|v
_g<;a=
@[Ga^N
G[.c2'n
GC5K7e
gCPXVg
]gD=1?s=M=
!%GdAZ
GDI32.dll
gdiplus.dll
GdiplusStartup
gDNq6o
g	*duV?
{gDye*
ge2>|@
GetProcAddress
-[!~GG
g,{h={2
g(h:a%~
G/_$Hd
ghlu%(
GhSYX_
g'i0_]
g;In?E
gj-?lY
g\K2r)q>
g%kE[|
_*gL-}
_g-lkeq
GLv~E&
Gm5'\1
GM(&Kp
Gn*{=#>
{G"N\(:
Gng1'T<D
`GnqaW
GoDk-B
%]Go'PQ
gS.19\<
G's(jF
gU^ibm
`GuV>R!
gV[G-Y
gw6>(N
g\w'HO~
 	g$.X
?GZm&,
h,1&IED
H1`SW:
H3`kB%
h6A=:6
H7o!8>
h8D=QG
H8i)%6B9}
h9aFHi
hA^Cnry
hAi+Zq
\HCQ-%eQ
h~)@-dI2
heg^<rVa@
he r/cV
h/gK}/
`HGUSn
Hg%!ut
[_HgYY#
*{.h(h
_h"`ih
H iH5K
hj^a/`
h%J`Uu
@hk;3w
:h^K_FcO
HLa5g3f
hN__2[
hO4<Oh@
H[o^Rz
{ho`wYy
&h-Q[dr:
H[Rz8ZnD
h~RzuR
?h.S![,_
hS{0g_
)hsQQP
~h^|t'
H'Xx9y_@.k`
'"hYi4
hYp&d?4
~H]z7h|
Hz:E|n
HZjD ]
")*i/|
i0#%fH
#i2[:A)
:I2Zg1O
I3G&!A7
i!4&2'
?I,:?5u"
I5+YJ+
i7mMdN
i9ZgOnM4
 $i\A1
Ia!IO@'CL
IAj}\z
ia	Qa]
ib:Kg|
IbT$[j
IB~,}u
iC)9[J
}i~cy7Oe
Ifi"Ukt
!=i^(g
IGV J*
Igx6 K*
;.@!Ih
i^ha*hg
~i	hepM
+ihYxk
>ii{m5 
I,!joj
ij`X@x
#~i	`k
I=ksJfoJ
-)Il],z
ImageList_Add
imjr;x#
+I"nj\
Io)H[2
Ip!`ACt
iQfdy[
*iQ.H|
*:=[Ir
Is-hOp
]i|SU?1
:(i.T"s>
iTW-7@
I/uF`aO)]t8MQ
IUJd'i
i?uk[1
i"VBeGy[.
)`IwuOW
,~+\ix
ix`=C)
I	X+mfY
*Iy2g,
i_@Y@i
>}j		#
')j$.+
j0NXlTgOc
j1jA/ 
j"44!{*
J5nS84
J<6^1n
j`6B"[
=J8EqD
j8gv	s
jAa;$3~G
jaoRJp>W
Jb"3N:
jB /z4
|jD4Bp
JE76B(
j^ET%b@
j$EVJy=
J}fuY]t
$Jgd]Z
]?	J+H
[jh@16
}%'jIi7'
j!J8et`Ar
jjhos;
*J-JI	
(JJuX@
jKs`H	
@J_]l+
Jl+Zne"
jmF>CM
jMik.(
-"J`MK
JMXPVh<
jmZDf<
J&)n:gC
joA\KC
 Jp.*7%"
jpz4j=+@
,JQ{?$'
jQA+3QH
jQ|A<R_
jQl)?$
j,|&`R.
JR=7j[
J]RGSm[
jTN<~%-
j=<\v@9
`JV&y5
jxJ {1"
jXL[\$
J?ZonO
JZp-$4
+k0ST(1-\
K1i#ny%
k%/2j3[U
}.K3fi
k	3!UL|7
*$k5`a
K5ulU]P~f4
k5\=*x
K%6w'3
k<7`5*
kA.m_p
kAq5OG
kBA^$(cI
k*>bmX
_=k]^\>C
k(cI7;!
$/.kCS
kde~Nb
K!dX=l
KE _3T
KERNEL32.DLL
kflvl'
KG.UUrL-
;kG~Y={
Kh'I2}
k]i%~c2
kiLu,a
(k|%im`
![k@\Io
KIW5*d>1
kJ^;hv
k!K[ )
{!_kl1R
kl5<'E#
K<"LCf
Kl.^MV
k+ly	+
Km(D+s
K-MQ@:H
kN*E.h
KN{iwd
+Kn"Xs
Ko2$]]S
k?@,oqx
K<>oRP
KPs6M=
K=Pznk
kRS4	M
KS_+92
	kSzUL
K"tC*}_
ktcec$l
]{K|ub
k&!uf0P4j
>];kVlw
'KX.8`
k%xp=_q
k'X ;U
l\"#~&
=L3@KCN
l:5\3|\
L6~e5u
#L6Qg^
l8A_[a
laso~T8p
!$lb@->
l-BbO&
LbhR]a
_lE!:h
l@^FD"
lfNiuu
L=gd^=
Lg$+i>
L>gWIQe
.{<Lhf
lhQob-}
LhZ17|-
_L {I/
li2SIt
l	i+n~.
L<jr9)
Lk%Zrv
%l{LC&
 LlR4g
 \[.Lm
(;Lm<]
!|lm05
LNGKd@qM
 LNkqs
LoadLibraryA
^%LO )O
:LOPd}
l:$_p@
lp\S\y
!LQd2U&
lr:\W 
}l{(~Rw
	|lt~|
LtfQ\3
~}LVONV
L@W_5[
-LW>6#M
l;}{xO+W
lyl+xS
lY	.z ?3
+`_l{'Z
.lz75!
?[LZo>>
*<lZqq
||[; M
@_M[%/
M[+0?b"@e
^,M=0O
m$0zz=b/
'M]~3B4y
M3JGCA
M5Y^+DJD
M8`A#f!r
M-@~'9
m9F1|T
&^maC8N>
MAE*8&
maf{K?[
*,MB[]
Mb7q7m=md
~M{Bll
McI A	
M;cyX)
~McZ;=
{\M,;d
MdE-{#Y
	mESJ)
_M\fI%
.M@$IYo
|mjX6:
M:kL]9H
mLex8G
M+\P]"
M;P,4D
$_	mQ$\
MQ&Ys^
mr$.@B
MRz$2mN
M,*si:V
:(MstZx
*_M%:T
mT_"N[
<m]tUzJ
mu(|)U
m*V)3^
mv5v>l
<M|VL7
m\W+U7
.MWVz3N
MxVhZfy
MY^4g&<pb
N1b/qP
n],2s{4G[
N3Ro+Z
<n6FnU
N_7w5qSo
%}n8'9
n*9w7a
na3k{J
N,acJwXN
NBH]bP
nBiR5bws
Nbutp'f
ncx3%a
_N`d7g6
!N Ed6
n~EiPJh
nE$P?du
nG7"|a
{nGK|xM
n{gOA)
n^goC>
nGrbW5
NhQzb_-
nh:Ya`5
.@Ni?6
+N;iA<
nJN*]q3
Nk|*Li*
N	"[km
!@.NkV
 N]l=xc7GL
NO7ZtP
nOGA5h
noo-@4
NO=t]!dE
.NO!&v
)%np`9
N<p` 	a
nprM0&
nr)67S
N|<S9Y
*NS'sQsB
)Nstxq
NuY'ks<
n)vGX>E
NVZ#NO
N~w#-0r
Nwg_IN
#NWs~-
Nx||G|
Nz1CLT8
_#o"\<
o)&~0}
o0M"?)
O2}'fp8
+o3N:_
O**5v)
o@6]0l]
!o;6iuh
O_7kEq
o7NJ:`
o8L)vW
&]O8s<Dz6
oaAE7-
O]&/	AI
O]bKE]
Oc/3~57
(O\cJP
ocw+8B2
odJ>lbq
.oD+:l
o=dP`h
)o&dy7
+O|E(!
OEH(wm
oF0|ss
;OFjnZeym9i
O(F.|x
ohIpW>G
]OHJv^
o*+h*v
:o"i$B
 O;I_X
oJBN-?B
[OjK	 
o;JThL
O#/_#K
ole32.dll
OLEAUT32.dll
olgvD=
}o Lr?
OLz3]7F
O%m!`)
omM}v-
On73}x*eA
O.N7}c
ON9x?Q
|o=+NFP
%O<pk88T
?~]-Oqc{}3p
O]qqlB
<o:rdalm
?OSD	p
ot2~W 
O.t6TK
#%_oti 
O-TWb<W	fa
O>-'v-
:OyLmP
`OyzO>uY
OZ!mk3H<
"p`.*^$
?*}	*P
"p3{Vo
P=4NaN+t
/;p5Y-5
p78f	v
!p7Bo<
p:+ABK	F
Pa{{M2V?
paw;i[G\
~pBn+	
PCP[Sh
Pd+-m;
-@;p,&&EA
pFjDP9
pf`k79
pFlXXo
=PF"Ph
$&p(h1
PHB5`m
p!hG@m
phixUU
ph_sB#
piuE{@D_
__pIw N
*@pJ:f
{pL1 ;
P"Lp2)
p|l%R3
`p$m\U
Pmv K<
Pn172/T
-pnd	|
//PoGb
pOihk2r
]PO^Rl
-po>&U
|Pps{1
P^QC{&>
p!qNGK
pqQ7l~
pt7pm0
P(T?a S
.p?TI[
PU|LBs
PU|OlG
p>]v"!
\~pvYc
PyD_Y?
<pYSeN
p{zim,
PzQ='D
)pzVF[
&[/'@q
Q0GY@F"
:q1w7G
q3J"Z'
q3R<@o
~#q#|5
Q}53oG#
Q\6g0V1y1
/Q$6Qz
q=6~sv `
qa9cBNE
qB3??n
q|bCMN
Q<+C5Y
QcQ~]?
qc ^q>&ZN}
QD`~/Jk
qDk&pV
^QFYT}Va
;qH;d6
QHiFE:
qiKH&{%
 qJyR5
qKQBZ`
_QL@#5
)q;?LL
Ql`PkUFt
q-|NVj
qN)~VT
qnzp]<
q-@>Q-3
qqC""xO
QQ\O,`{Q;
q*`[r@
`qt(">a#
qt[;l[vE
QUC$ o
qUzbm<
Q</V6H
q)WK(OtJ
.;?}.Q>x
Q& x:$
Qxv!-)x4OL
+qX_+z
Q}yKEs0	{
QyQY^:of
QyY=)va
	Qz1*Mf
>_+[r%
 `R}"-
-">R ~%
 R0C.:
R1NjsM
R~2*[([3XyJ
r2.7n]
R`4_IJ
(r]4okm
r^[{7]
r,*7J;
r8&FilK
r8FjIPM
|R8&]IL}=
ra:Nds
rAnK U
,RaR\lV
)_rb]I
rb(	L+
)rB-n;
RbsU&D
"r	+c2o>F
rCl*bHOM
r-~/dc
^rDN7R2q
Re98Hd
{Rf]5i
+RF#[MK
rgHaN)
R#=G?o
R%H`@UD1
RIb5	n:
riDzuq
r-I`h{
r[iO'.
rIuy,[
R\j8&O
rJ[;ni
~R_+jx8s2
'R\"k0
r|kBy%
RKDB@6
r'Kx5#
R--.Lc
]rlFaP
rlu]~C
RmPyHd
rMYz&o@r ^2I
?R\^NI<
R^OCN_e_
Rou2npu
RPCRT4.dll
|r\PJU
R&PJu<L
r)|{^Pnp
rPP5u-
RqkXkxL
'rqP8.a
>rRjB :U
RSx!L=
rTgX8B!
"RTGYL
rT*(/x
ru9sg2
!rUR"x
RV(G`m&
R_)~+Wj
RW/)j	
R'WuYk
=!>r{x
|}}s~|
s>4M~ZX?
s4z<\!
S'`7h[
 s7):P
s85J:&s
Sa'kz/
saLeIb
sB0/=;
S]cADe
sc#dn#
	sc.IP
S"$d#h
:sd@Y}K
s'%`E@
se83-H
SFrXj.
	s:G~$
sG\[%c
?sG.:Q
SHELL32.dll
ShellExecuteW
SHLWAPI.dll
ShoIJC
~SHsLu
SHStrDupW
%"Sj1&5YT
s`)L$4
(s:`$Le
smkZ7o
SmP4u@
s<%n~~<@
$$sNsx
S)%pJ`rR
'srPsQ	
s_RYL6
|*&Ss.
sS0Bn 
sssbJP
stb1uI]
S$tNJ1
StsDa~
sUaGvLq
SU%ua?
{s;VE3
- 'Sw8K
S/w}U.
s?W(-x
sxN7ybO
]}^SyX
>syXc}
S-[Z>k
_sZ..v
##]t#-
)&:%t0
t=`0zM
T3N\:d8M(x
t4c,8@
t4<Hbn
{T>'4j
\t7<:Z0
(@*T8j4
T8W|v3
t\AdGA
 tAqLiP^
Tbcml.
^|\TbM
;TBW'~g
tbwj"^
TD|f~Vzd
tD-sl}w
tdX$u*
%)td>y-d
Tf'aPB
Tfb@{p!J
t#	G}dyM
tG	f2aC
tG|P)]#
!TGTi(
!This program cannot be run in DOS mode.
-T#hl9
(thT4O
ti2JzF
,ti$eh
t?ikx-
^tI],lB$
t/iNYg
tjAS_D
T]J**K
tj(	Vpzt
T!k!?b
tm6?4"
^T*Mdp
$tMl75SuF<J
[t_N@!
Tn<-0<
t\ox_=
T[\{pY
TQ%xSH
<_T:}r
_TSp6[W
:tSv/C
ttq=QV"k
t$t#t$l
TU ZWL
tWgg=A
twq[hQ
TY-i3Q
T.y+JT
TY{}!U)z
T	Z>+Si
+<	&U?3
u3#h:m^
U3nrz*W6
u4d43o9X4?
U4LvK| 
u6g|;P
^U#6[L
u=7H\=w
U_@84yXvI
U8s}%m%dAhe
*	$u(9e(
)ua3rn,
uBVNw!
ubwA ^)6+
UCK }E
UCkp"V
UD;08G
U$DB+>
UD`-jfSO
uE7Lw{
U,eP#S%
U$,=//f
u}f7CW
ug]KZ\]A']
UG*%RL
UhBq'Y
Uhstmxo2$
UH&<z-
U]@isT
/uITvj&
/UIU19
uJ1FqT
{u;Jpg
\uK$VO
ul6t$J
U Lf2lWE
ulM$V0
'u>\[m%
un[&&cK
[U)N_J
./}Uol?7
uOtM4xS
][u-p|`
u&>P%C
UPNam\7 
+uP!O.
$UPoNLtt
< uqMSp
[uRqj#]b0V
USER32.dll
USv.#M
?U^Swtx
U,`	tz
+Uu&A8U
UuidIsNil
UU%&vLU
UVO(GN
uV~VjB
U%wQ,a
ux	6]}
&UyLA,~
U^yzSe
+:<(V[
;:?V'<0`hR	V
v30{,!j
(~v3qv"
{V4:S'
V:5e}<
<V5*p\
V5Y-QC@,
v6Cr]ilz#
.V9hu*12
-v A/a
=V;B;2TK[
VCv.3b
VC>Ywx
VC"ZrV+
+\VdW\J3
V%Dy{}
V:EO1^>3Gt?S
VfISLN
vg6,,y
v< H7,
VirtualAlloc
VirtualFree
VirtualProtect
^$VIsZ
~ViyD7
=v}j1>q
vjo($Kc:
VjxU=3_h
VliPr#
VLqQ9D ~
[]Vm_T
vN~3)+
:V}Nl:
vno/U|
vO8BSs
\V(O$F
:+VorP
]v@RPN
v!_S	B^l
v,SHMD\Q
VSM8mR
v T^{_H5
vU|&Xz7
v.w5E#d
v$X	0Z
$VXfvp
Vxt'8u
VX.tzX
VYuQ{!s
V{Zx~.'
%w< !#
w0,'xLNha
W;2D=]
'W?3(~
w37ekl
[/W(" 40~f"
w5>zk)
('w[@6
W601>v
w6R: }
w7G"*!
(^#W=8
W*8$m*
w9.3$Nv
-|w9B+m
w9Lj/2
wa"k "od
WBEl4~
wBg0P(
Wc&eIz
w:CX6$G
wD)9AC
w+F`Q$vH
W<f~*V
(w^gm<
|W_H!(
wh1<oU
W:hC^t
W	H"&j1]
."`Whk
WId}&Y
=.W;=k
WK#(v>
WLDAP32.dll
=w{~M"
	"`w(n
wnlZB`
W&&o!;
Wo0DG=!
wOS `K
WQgchY
WQnJq5ra
W=R>R?
ws7wwwwwq
W{teCH
{W%vF2
wvo)5t#s
wv _p$
wWrHkB
#wxtrz
W|Y0am
wy?dks
Wyf{dlH
w[YMwh
w,y}O5
W)Yo;X
wZUN+7
 _\] x
x`=<'>
X158,=
X"$;2D
X3`~.aJwD
x3X\Pb
x7NM4<
,x{adm
@xAe	tC
,-}}xB
xb^h~1
Xb>Ie3$
:+x@Cu
($X$DG^
}/X-E^
<X|e-L
;Xex(h
XfktgI
=Xfrh+
Xg'h/o
XG`MBk
*xg"=Q
xgQ{;}
x/hb9X
<Xhu8"
X<H,ug
XH+yzs
}xi>-_
Xiv3.1
XJ@l-F
X)k+OC
X?k'uC
+X*lc{n3
%~XLLX
xlMb/	
xLu#I	
\xl`.z
-x:{:m
xnfk93
Xnp	!u
}X#O#/
x}Oa-X
xO@``C
_x?+p	-
XP2-:S
XPTPSW
{X$}r|
xrAX7:~)
}x	rfX
X Rl`Jk
{"XS}0dw
xSM4tN
x[=u$x
xvh,p^
XV]`WL~
;xvZ7k
X&WxD0
x,+xAe?&a
.:x)y>
Xy c!4)
xZ<7l7PA
x|z)8*$p
x\Zg8w
Y.%0>9
Y^2&$:
Y23yaD
y3\f>Gd
Y]5okm
:Y5RZ?i
y:(7ASN
Y@!9WSD
yaj*s)[
yC:w/B
ydS=HM
=Ye=^!
YeQe'S
yeR.Yq
yfeZqM
Y%Fy5'3
:yIp'_
yj&cgK
&%y+K	P
#yKW6T
Y%l3A}vvc
Y{lkxb
*Y{L[nU
y}Lt4(
Y?L/VXV
Y+MFhl
y}{N%'
Y&|N\^
y-nl+J
Y'OyHbyH
y]Q7!C
yqQTB)
@~Y<{/r|
Y=s2|J
_y)`S5NQ
yS\ic'
@yT\3+P'
yU/Ii8
y;UQ/SZ;
yV}W_9
;y,W$5!O
yWeCL*Io
@ywGQ<
ywrxShO
=yx3V*GG
yxh7ZC>
(YXo)n|
#yx	u5i;
yy6>_d
.Y$Yam
YyLz\8
=yZ-)>
\YZ{"3
/Yz89W5
yZ[}L~
yZV tJ
#_\ *z
Z08PLn7
z0Fn(QO
*z19l{
Z22N*s
+Z3,\%
z(4aqX
z4I<Xg
Z5)\/G
>{Z{6B
z7@'T$
z[7w65=
z{8U?,
>Z9rWK
,za'_0
^zbE3q
zbmSg@\3
z!cfgJ
Z$cOyE<
ZD7q6p
Z&dC-.
zDZJ*4Q<
>=:z,e
 Z##~E
zE1@CA
+Ze9Ah
z"'FLN
z[FW#H
Zf^'^.zl
\z<&@g
:ZG=`H}#_
ZHCYnm
zhMoLKm
+z?Hn1(
`ZhWW0I
:Z[Im)
"zj6m 
>zKKg.
z^}'L4
@z\l%,C
Zlki1"
z}ls!i
ZLxQ74C7
}ZmxcIxN
$zNL}&
?znMxH
zno]hf
}Z=NuN
zo8cWt[
.ZOxe${\
}$@zps
^ZQ2 ~
Z.q7mZ
|z<]Qw
ZrLCi[Z
ZS$l^m
Z~S)o_
Z?so"JvS^!
\ZT^?AH
ZTE	#)
&ZTy=.
;ZU-[ 
[ZU]is
Z`v;S9
zwL}I4_
zwY/K	
zXeN<1i
ZXf0=R
Z#Z]:V