Analysis Date2014-08-28 19:19:15
MD51f799f7bbe7696e7eb13f5baec1508f4
SHA192ea9bef1ffceb2e1b000c50f31a81ff249f2da6

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 2aeb4274c380dff1befd05d2b85181d1 sha1: 70a5eb40475ebaf42e0a2f4ef14b0b97556b539f size: 888832
Section.data md5: 620f0b67a91f7f74151bc5be745b7110 sha1: 1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d size: 4096
Section.rsrc md5: de5415a9bcf133ee1a8befa9b79ed76e sha1: f313b25313ab2d7bdee6a35665eb4699f106d8cc size: 53760
Timestamp2008-06-21 04:35:32
VersionInternalName: Eset Login Viewer v1.3
FileVersion: 1.00.0015
CompanyName: ForumW.org
Comments: Developed by avi01
ProductName: ESET Login Finder by avi01!!
ProductVersion: 1.00.0015
FileDescription: Get ESET Logins!
OriginalFilename: Eset Login Viewer v1.3.exe
PackerMicrosoft Visual Basic v5.0 - v6.0
PEhash0d09d31be0616b33653a3878c516e6a17e5d51a6
IMPhashf50f32cddf5dc8b71f68b8eb016f5c7c

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\~DFBA75.tmp
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates File\Device\Afd\AsyncConnectHlp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Winsock DNSwww.for-ever.cn

Network Details:

DNSwww.for-ever.cn
Type: A
208.73.211.245
HTTP GEThttp://www.for-ever.cn/nod32
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
Flows TCP192.168.1.1:1032 ➝ 208.73.211.245:80

Raw Pcap
0x00000000 (00000)   47455420 2f6e6f64 33322048 5454502f   GET /nod32 HTTP/
0x00000010 (00016)   312e310d 0a416363 6570743a 202a2f2a   1.1..Accept: */*
0x00000020 (00032)   0d0a4163 63657074 2d4c616e 67756167   ..Accept-Languag
0x00000030 (00048)   653a2065 6e2d7573 0d0a4163 63657074   e: en-us..Accept
0x00000040 (00064)   2d456e63 6f64696e 673a2067 7a69702c   -Encoding: gzip,
0x00000050 (00080)   20646566 6c617465 0d0a5573 65722d41    deflate..User-A
0x00000060 (00096)   67656e74 3a204d6f 7a696c6c 612f342e   gent: Mozilla/4.
0x00000070 (00112)   30202863 6f6d7061 7469626c 653b204d   0 (compatible; M
0x00000080 (00128)   53494520 362e303b 2057696e 646f7773   SIE 6.0; Windows
0x00000090 (00144)   204e5420 352e313b 20535631 3b202e4e    NT 5.1; SV1; .N
0x000000a0 (00160)   45542043 4c522032 2e302e35 30373237   ET CLR 2.0.50727
0x000000b0 (00176)   290d0a48 6f73743a 20777777 2e666f72   )..Host: www.for
0x000000c0 (00192)   2d657665 722e636e 0d0a436f 6e6e6563   -ever.cn..Connec
0x000000d0 (00208)   74696f6e 3a204b65 65702d41 6c697665   tion: Keep-Alive
0x000000e0 (00224)   0d0a0d0a                              ....


Strings

040904B0
1.00.0015
2&'2
backcolor
BackColor
buttonshape
ButtonShape
buttonstyle
ButtonStyle
CallWindowProcA
caption
Caption
CheckBox
Comctl32
Comments
CompanyName
Developed by avi01
DisplayAsDefault
EbMode
Effects
Enabled
ESET Login Finder by avi01!!
Eset Login Viewer v1.3
Eset Login Viewer v1.3.exe
_extentx
_extenty
FileDescription
FileVersion
font
Font
forecolor
ForeColor
ForumW.org
Get ESET Logins!
HandPointer
<< Hide Task Pane <<
http
http:///
http://dcbutton.dacarasoftwares.cjb.net/
http://forumw.org/viewtopic.php?t=271177
http://nod32.persiangig.com/ups/
http://rapidshare.com/users/9N7HM
http://rapidshare.com/users/FA485
http://rapidshare.com/users/LW437D
http://www.for-ever.cn/nod32
Hwnd
InternalName
IsBadCodePtr
kernel32
Latest UlisesSoft NodLogin
les (*.*)
List Of Eset Unofficial Server
M*\AC:\Downloads (Programs)\Important software!!!\ESET\eset Update Viewer Source\LoginViewer.vbp
MaskColor
MouseIcon
MousePointer
ocx)
open
OriginalFilename
Parent
PicAlign
PicDown
PicHot
PicNormal
PicOpacity
PicSize
PicSizeH
PicSizeW
ProductName
ProductVersion
Reload Page
sc_Subclass
SetWindowLongA
>> Show Task pane >>
State
StringFileInfo
System does not support TrackMouseEvent.
{TAB}
+{TAB}
TrackMouseEvent
_TrackMouseEvent
Translation
@udio\VB9
UseMask
user32
User32
Value
VarFileInfo
vba6
VirtualFree
VS_VERSION_INFO
       
   (((&&&
   ()&
   $$$
 "$)+-
-,/>=?
,-.]^`
,.)$& ""!
,*/%$(
;:='&(
!!!<<<***
!!!&&&
!!!%%%
!" ))'"!%%$(,+-#"%%&#$%"
???]]\>?=
'''---
'''%%%
'*"&("
'%*#!& 
""",,,
"""&&&
"$#<>=^`_
('(')$
()&&&$%%&$$%$& !#
). )))$$%$#&*),**)###&(#)*&&*
))'"!%#"%*),$#&&'$()&
))))))
)))+++
)*(''%&&'%$%%'!#$
$$$(((
$$$#$  "
*-%,/'
*)-$#'
***)))
***###
&'"$#'"!%'%*%$)%%$&'&!%
&(#!!    !#
&&&&&&#"%('*++*####% %'" $
#'$#$,	
#$##$ 
## &&$
###'''
###(((
###***
###&&&
%, %+ ")
+(/"""&&&!$
+++&&&
						
+,)+,)+)0+(0+*,+*,+-%*-%$'
			!!!000
&&&000AAA???@@@CCCFFFDDD===666
...000<<<EEE888
001$& 
002TTVzz|
 !"#%'(()**+,,-./01123:>9-1,%($03.KNIehdrvquxtQTP<?;472@C?HKG@D?<?;AD@MRHOTJPUKNSIJOFINEKPGNSIMRHMRINSIPUKTYP]bXglbnsi
012WWYNOP234
	*)0/14#$(070
$"+%$-'%.'%.&$-'%.)'0+)2669336::=SSVqru
)*)03+
03+/1*)()''',+-,+-)+$,.':C*^fNdsG[j=ex?_r9^tB`uDg}Kq
031MMSRRXHFR?=IDCN-+7
05&16(#&
05$djVio[elT}
06$..0.-/-)3,(2++,++,,/%,/%59.?C8
#&"/'#0658=<?GFINMPRQUVUYZY]^\aedg_^b\[]\[\[\[[[Z_`]efdce`ac^aa_decjilonpomrnlqigkkimmnmoonqsltvox|q|
*-%-0(,,,***+*,(())+$*,%6?'[cKdsG]l@g{Bat;`vD]r@\r?`vDdyGf|Il
06$FL:u{f
;@07:158/:::676112;:<-/)02,7?(LT=bqFbpF^q9gzBe{A
!"!.0+:<7IKDUXPaaafgfnmpssuurzsqxqmwolvkgrlhsmksnksonrsquxxy||}
(+"++*()((')&%'&)"%'!08!U]FbpE]kAgzC`r;_uBZp=Xn;Zp=\r?]s@bxDh~Jj
-0(EH@jne
,0#SWJ
.1/[^\
-.,--+,*1+(0+*,+*,+.&,.'14+
107IHO:<?BDF290,4*
111JJJKKK\\\WWWSSSRRRQQQKKK???555333
/11X[ZQTS.1/
  &+-1()-282
12)qrh
(.#*1%-3(07+39.-5%19)7?/=E5DL<MUEX`P_gW
)+&*+'*+'(*%')%*,(13.784>A8NQH^aWlpez
14+.1(22100/..//./.0*,.(AI1ZbKaoD`nD`s<\o7av>i~Fr
141[^[X[X474
*-%14,680BE<LOFWZQgja
$#'1/4:8<<;>CBFTSTeefmmlijidebbc`qsmmojhigefddcfddfechdchrquqptoonlmllohpslw{o|
1/4OLQwxy
*&151=MHVVQ_c^lokxxt
1.553:@?CHGJDDB;<9>@:HKDXgC]lHUd?gvP
16&27'.,1/-21-81-8001.-.+/#)-!`dX
16(=>=89786<97=769:9=9<3690?H-R[@`lGcoJ]nAfwJ
-/'.1)+++)))++-*)+),%+-'9A)]eMetH]l@gzA`s:^sA\q?^tAdzGh~Ki~Ll
-1 DH6
,1'_dZ
..1EDHgfi
)1 NZ=z
./1Z[\VWX89:
 (*-#%),2-
%)(2/03;<?:?8492FO:QZE
/2*/1****(((,+-+*,)+$+.':B*^fNetG\k>ey?_s9\r@]r@bxFk
   ...222***111---"""--,MNMggflml^^^eeeuuulllmmm|||vvvssssssVVV888
222EEE
'(%;;<223769658112435:;9664794GIDhhhoooyyy~~~
 !234(**+-./11123134134245356362473362/3.140>A<SWRehc
23/XYUDEA
25,03*444121/.0001.0*,.(AI1[cKapEbpEcu>_r;bw?m
25,.1'01000//.0/.0.0*,.(BJ2\dMcqFbpFbu=^p9bw?h}Eq
")%2<7DOKW`\hkgr
|.2(9<3:;:787?>@5567936822:#>F.Xg<bqF]p8]o8^u9
2A%WfJauKcvLh~M`vE^tCh~Ni}QZnBi|T
/2)*-$--,-.--,.-,.+-'*,&@H0[cKbpFbpEbu=^q9`u=ezBn
2:'HQ>t
	:=2rvk
.2 v~_
.,2XXXOOOOOO
315<:>ECJB@GBAD?>A57312.BE;Y\Rk{TXgAXhAz
!!!325DDFSQX_]djgqqnxuq|yu
)))333111,,,##"###>>=``_jkjaa`III___kkkfffmmmxxxuuuqqqkkkWWWEEE444
333333
#$"334555*)+0/1223.-.++*676PQOfgellljjj~~~wwwrrr
340RRTyxzons
340rspZ\X
+3+4;4Z_YQVPEJC370"'
365QUQJNJCH?LQH
38(:=447.::9999334==>8:4?A:JR;bjRv
38)58/36-998665667>=?35/02,CK3[cKaoEapEcv>`s<ezAv
38$joZ
3:,SZLDK=_fY_eY
3:"v{c
'*!+.$,-,**)))*'&((+$(*$3;$X`IcrG^lBhzC`s<awD\r?Zp=]s@`vBbxEh~Ko
>;3}zr
426RQURRR888
   """444999CCCMMMSSSRRRLLLFFFCCCEEE@@@,,,
444SSSKKK&&&
.4$5:*.-1/-20,70,7//0--.+/$*.".2&
451\]ZDEA$%#
#$!453>@:BD>FT1^lJ`oJfuPdtL
453[Z]BAC
45:aah||
4/?;6EIIIXXXVVVWWW999333111QQQWWWYYY444
4:/:A5-4(
-4!bkP
:>4Z^RUYN@E7
'&#534@=?SOTfbftov
539LHTIEQ444
)/$.5(:@4gn_
54.kn[
!! 555..-
%%%,,,,,,555;;;)))
.-5/-6
563\][UWR794
!#$577JLLOSOHLHEJAIOF
5BstLPs%
.5(fm`
:<5ikd
.5!]jEgsNXi8`p?_v?^u?^u>]t=]t=^u>^u?_v?]t=^u>^u?_v?_v?^u?^u>]t=`z:a{;c{Af~Dj
6<*/.0/.0.+5.*4--.,,-,/%+/$#&
:<6461^]`
66<57:136,2+)/(7C/
'''666(((
			(((666
666<<<&&&"""888999CCC???%%%			
666DDDCCC===HEV>;L>=G76@%)%(+(
666LLLWWW
#$"667:9:435/.0223667,,+$%$;<9]^\rrrjjj
.6&7?/4<,,4%08(BJ;T\Mbj[ltden^IQA19)4<-JRB\dTt~j|
<?6=@7676998EDE,,-793792/7 3;$KZ/[i>^q9cv>_u9
!"*,-*,-689
,/,689:<<KKR\\bHGP#"+
689SUVKNN#%%
690;>5887898CCD001:<6:<65<%<D-Uc9bqFbt=dv?`v:
+&6>9HKKK```PPP]]]EEE444777```QQQXXX333
}6A)-6!HQ<_hTS\G/8$ (
6;*bhTciUmt\
:=6u{k
:6@VR]B?F
7:3txk
*+(74:
7;6LPK\`[`c_bfbfifMPMgjiuxwY\[688?AALNO>?A/12
&&&7771-?0,=?>GDCL8<9?B?&/
,/,79924577=@@F119
"#%79:WY[uvx
7E,\qCUj<`t@`t@`t?`t?`u=`u=`v;`v;bx=bx=bx=aw=av>`v=`u>`u>_vAcyEdzE`vA_u?d{Dj
7>*]jEdpKZk:`q@_v?^u?^u>]t=]t=^u>^u?_v?^u?_v?`w@`w@`w@`w@_v?^u?]w7^x8`x?c|Bh
;=8*0 X]M
8>1\cU^eWS[K9@1YaPX`OZbPaiWktav~k~
8<1MQFpti
../84?
8</48+
87:103
879SSSTTT>>>
87<ddkCCJGIL>@B<C9qxo
88;VVYddgZ[^BBE..1..1558=>AEEHMNQSTWQQTJJMILIJLJLOLPSPTWTVYVVXVTWTKMKQTQY\Y]`]]_][][Z\ZZ]ZW]Y[a]_f`_e`\dZ\dZ`j[eo_bnYmyc|
896STQPQO$$"
=@8BE=
8D!\hEjzL]m>_v>^v>^u=]u<]u<^u=^v>_v>^v>_v>`w?`x?`x?`w?_v>^v>]y3^z4_y;b{=e|Dh
<>8^`Y539
9=1SVM*.$	
(*&9:6KLH`a]wyu
"!%98<JKHJKHAD=<>7BP-cqM[jEZiCk{S
(((999000
999UUUTTT+++
$)"(-&9B-]fQ
::9^^]jjiZZZEEE@@@^^^fffdddlllnnnlllllleeeLLL999555$$$
9?'lrZ
-9#]oJ`qL\qCo
	>?9syb
9>'w}]
A?6vza
   ///;;;AAADDDFFFDDDAAA@@@@@@>>>444###
aakJ%)
ab_()&
ABG_a`CFE
About Eset's Logins Viewer
Ab|=`x>^w<^u>^u>[q<\s=^u?`wAay@ay@ay>`y>dwGauD^s>\q<^s:aw=gzCi}F{
;A.cjU
Additional Tools
_adj_fdiv_m16i
_adj_fdiv_m32
_adj_fdiv_m32i
_adj_fdiv_m64
_adj_fdiv_r
_adj_fdivr_m16i
_adj_fdivr_m32
_adj_fdivr_m32i
_adj_fdivr_m64
_adj_fpatan
_adj_fprem
_adj_fprem1
_adj_fptan
?A;HJDRQUXW[cagkiovvv}}}~
(()^]aKJN
_allmul
'()?@ALMN?@A-./()*)*+'()
\amGkm\oq_OOC
AM*`lIgwH^n@_v>^v>^u=]u<]u<^u=^v>_v>^u=^v=_w>_w?_w?_w>^v=^u=_{5_|6a{=d}?g
a]n>brCbrC_lFO\6*0
;Appearance
      avi01
avi01.dcButton
avi01 ESET Logins Viewer v1.3 
avi01 ESET Logins Viewer v1.3 .:: http://forumw.org/viewtopic.php?t=271177 ::. [Browser Mode]
@A?WVY779
@A=[Z\PPQYX[QOSEDFJIKYZXYZXTUQY[Vzzz
>B6txk
<B8=D:
BackColor
#BAH57:@BE%+#)/'r~i
BAHIIP=?B<>A;B9:B8
!"%=>B\]aopu
@BB[]]
BE2chQ
;Behavior
-/(BG8;@1
bgpUPY?"'
BitBlt
BJ5\iBanG_q=bs@_u@^u?^t?]t>]t>^t?^u?_u@`vA`wAawBaxBaxBawB`wA`vA]u:^v;`wAdzDh
BP1ZhI|
>B=SWRAD@PSPbeb.2/:=<UXW=??	
Bs-zPs
Button
ButtonShape
ButtonStyle
?C5RVHW\Kjp^
?C6BBAAA@97=B@F:9<@>BBE;?B8BJ0MV<Yf@^kEYj=evI
@C;<?7
=C9UZQ17-
CallWindowProcA
Caption
cas>^p<etG^m@emUAI1"#
Cd|Bay?_u?]t=\r>[q=_uA_uA_v@_v@_w=_w=_x<_x<ey>\p4cv=k~EaqAZk:aoHgtMBK1
Cd|Cay@_v@]t>\r>\r>_uA_uA_v@_v@_w=_w=_x<_x<ey=[p4bu<i|DbsB^n>anG`nGR[A
*+,CDE<>?"#$
ce`qsn
CF<.1(
CH2rwa
CheckBoxMode
CI7ei]
_CIatan
_CIcos
_CIexp
_CIlog
()!ciQ
_CIsin
_CIsqrt
_CItan
c^mG>G3
Coded by avi01 with the help of Digitox who made this possible [thanks!!] and also to EMM for helping the n00bs lol.. and UlieSoft, Nsane and all devoted ESET crackers!
ColorScheme
CombineRgn
comctl32.dll
Command1
Command2
Command3
Command4
Command5
Command7
Command8
Command9
CopyRect
Copyright (c) 2008 avi01 and Digitox.
C:\Program Files\Microsoft Visual Studio\VB98\VB6.OLB
CreateCompatibleBitmap
CreateCompatibleDC
CreatePatternBrush
CreatePen
CreateRectRgn
CreateRoundRectRgn
CreateSolidBrush
;ct5f9
cTd4arAhqUXaECI64;'/2+14-546768215.,0>?=00.*.",1$&-
C:\WINDOWS\system32\ieframe.oca
?c|=_y:]u;\t:\s<\s<^t?`vAbyCd{Dd{Bay@^v;\t9\p?\p?]q<]r=_t:_t;at=au=drH[h>
>=D469<>A") ,3+P\F
?D4AG6 &
D$4QPV
D$4RPV
=D8AH<'."
D$8+L$0
D$$98u
`.data
DBGMIUOKW'''
DblClick
dcButton
dcButton1
dcButton2
DCFWVX;:>	
Dd|Cay@_vA]t?\r?\q?_uB_uB_u@_u@_w>_w>_x<_x<g}=]s3au;h{A_oA\l=coNgrQ/6#
...@@@DDD<<<777===FFFB?O2/?''/
De~B`y=]u=\s<[q=\r>^sA]sA]s@]s@^u?_v?`w?`x@_sC`sDbwBezEk
De~Cb{@`wA^u?]s?]s?_uA_uA_v?_v?_w=_w=_x;_x;fyA]p8]p9as=bsAizHiwM[i?isV1;
De}Cbz@`w@^u>]s?\r>_uA_uA_v?_v?_w=_w=_x;_x;dw?\o7_r<ewAbsBduCdrI\j@_iL&0
DefaultMenu
DeleteDC
DeleteObject
dfa461
D$(fff?
D$h+T$<
D$h+T$0
d]kODK?29--4(<B7SZNQXL+2&	
DllFunctionCall
D$P+L$$pV
D$pPUV
D$ QPV
D$,QPV
D$$QPV
DrawEdge
DrawFocusRect
DrawIconEx
DrawTextA
DrawTextW
D$(RPSV
D$ RPV
D$,RPV
D$$RPV
D$ WPQS
D$$WPV
D$XPUV
(EBJ[X`01-
eblOS]@5>,%.
e(Command4
Ee}B`x<\s<[r;[q=[q=bxFavD_uA]s@]t>^u?`w?ax@buEfzJn
Ee}DbzA`wB^u@]s@]r@_uB_uB_u@_u@_w>_w>_x<_x<g|=_t5at;cw=^n@`pAbmLZeD
*).eej
),)EEKXY_PO[=;G#"-
%%$??>^_^efeKKK+++&&&323GGGhhhYYY[[[ZZZ<<<MMMoooWWWSSS222
egf')(
)+%EG@QSLNPHNQIrxlz
EJ;EH?CF=IIHFFEHGIPPQEGAAD=S[DjrZn}Rm|Qo
Enabled
End If  dcButton
ESET Logins Finder
Eset Login Viewer v1.3
esTftUq
etYetXJ^4fyOYo>cyHdzIdzIj~Rj~Rj}Us
EVENT_SINK_AddRef
EVENT_SINK_QueryInterface
EVENT_SINK_Release
EW2`rM`rD`rD`sB`sB`u?`u?`v<`v<bx=bx=bw>aw=av?`u>`t@`t?[q=Zp<]s?cyEh
Exit Browser Mode
(')>;F"
f98uQf9
:f9~bt
f9~bt*
f9^bt0
f9^btg
f9^huL
%f9~nu
~|f9~t
f9~`t}f9
f9~ttB
f9^ttrf
f9~`uKf9
FC:\WINDOWS\system32\stdole2.tlb
Fcw>]q8aoCdrFEK4
;F+evKarGVk3k
ffe:;:
FIEMQMBDD
FillRect
fjnY),
FM@LRE
FontBold
FontItalic
FontName
FontSize
FontStrikethru
FontUnderline
Forces a complete repaint of the button.
ForeColor
FptEf9
Frame1
FreeLibrary
fr{hIR?
frmAbout
frmFul
frmFull
_fuJBN* ,
gcnTT_E2<%
%GCOSPWDBI
Gd{D^u>[q>[p=\pA]rB[oA]qDbwHh}Mn
gdi32.dll
gdsFbrCdtE\hE[gD15'',
Ge|DbxD`vB_uC_tB_tC_tC_uA_uA_v?_v?_w=_w=bx6aw5bu<_r9_nDftJT]D09 
GetCapture
GetClientRect
GetCurrentProcessId
GetCursorPos
GetDIBits
  Get ESET Logins!
Get ESET Logins!
GetModuleHandleA
GetNearestColor
GetPixel
GetProcAddress
GetVersionExA
GetWindowLongA
GetWindowThreadProcessId
Gg~Fd{CaxC`vA^tB^sA_tC_tC_uA_uA_v?_v?_w=_w=d{8`w4au;`t:_mCdrH[cJCK2
)))'''"""GGGVVVKKK
*-(GJF|
[gJiuWXi=Zk@dyAZo7d{?cz>cx@cx@dwFfyHhxNizOg|MauGk
GN6syb
gnx[R[A4<"
G RWPV
GS>m~ZWhDl
HandPointer
Hby=d{?g|Dj
~|hf8M
<;<hfi
()'HHGggfeeeFFF///+++FFFiii___```___GGGQQQiii\\\QQQ:::111555   
///HHH???444CCCEEE@@@,,,
!!!HHHNNNLLL
hhkLNN?AAORKBF?X`N~
HIMTVUJML
hje793
''(HKASVMCG;&*
HKCsvl
hkfQWKIOCbjV
hmg-2+
:H-`pH`pH`qE`qE`t@`t@`v<`v<bx=bx=bw>aw=au@`u?`sA`sA^sA_tBawD`vC\r>awCx
hpX^fN^eQ\bO<A2
HT6lx[Zk@Vg;dyA_t<by=cy=cy@dyAfxHgzIizOj{P_tEn
hTa;\jBfsLUb:IV.-/)35.342*+)
ht{f<D.
huUS`A`oIn}W]p?Yl;e{Baw>`v;aw;bx>cx?bvCauA_rC^qA[p?`uEcxG`uDbxFq
ieframe.dll
i\gHbmNjsVQ[=(2
	IHLSRVTTT)))
IIIKKKEEE
ik^BC9
IN>14+58/;;;4430/188936/24.3;#EM5]lAapE]p9dv?_v:
iocag[x
IOD17-RUQeie?B@@BAegggjj}
IO@w}n
^iPcqON\:_qCk}Oav=_t<e{?d{?dzAdy@dwEdxFewJfwJ_tDavF`uEdyHy
iQYAckSbiU=D0
IR?ozb
IsBadCodePtr
is_it`hr^blX\gS_iVeo[cnZ]gTQ]E[gO`kTdpX|
IsWindow
IV6ZfG^mGXhA\n>asC_u<]s:by=by=cy?cy@cwCcvCbtEbtEXm<bwFe{IawEi~L
[ivNfrLs
jbsAar@\l<`pAMY5.:
Jby@ax=d{@atBgyGdpOS_>
Jd{EaxAi
Je|FcxFcxFdxHeyIbwGbvFavD_uC_v@_u?_v>_w>f|<Wm-dvAl~IcoLbmKLRB
Je{FcxGcxFcxIdxIdyJdxIbwFavE`wB`vA`w@`w@bv:bv:]m>gwH]fLPY? "
Jf~FaxA^sA\r?]qB^rC^rD^rE_sDauFcyGg|Jj
Jf}HczDcyC|
Jf|He{Ff}Fh
	%%%JFPNKU(%,
Jg~HczDawEawDbwGcxHcxHbwGawD`uC_v@_v@_w>_w?bx7aw7Zl7p
Jh~Jf}HdzFbyDd{Df}Fj
(JISjitxv
JJJLLLEEE
			===JJJNNN
JLGTSUMMOYW\igltsv~}
jlw^5@&
jMP@+/
jPsEjPs
JQ<Zg@`mFduBduB_u@^u?^t?]t>]t>^t?^u?_u@`wAawBbxCbyCbyCbxCawB`wAe}Bf~Ch
jrd'/!
jsc/7*
JS@u~k
juUQ[<akL^hJ0:
JW<`pH`pH`qE`qE`t@`t@`v<`v<bx=bx=bw>aw=au@`u?`sA`sA`vC_uBavCcyFbxDcyEl
{jyK^n@apD`nCblP@J-'*"(+#+)-,+/-,.++-)+&()%)+$%( 
JY<`xDUm9`t?`t?`u>`u>`v=`v=`v;`v;bx=bx=bx=aw=av=`v=`u=`u=^t?cyDd{EawBaxBg~Hk
K\7ctOx
Ke{G_uB]qB]rC_rGatHgzPj}Sp
kernel32.dll
kewB\n9dtE_o@dmRPY>&("
KeyAscii
KeyCode
KeyDown
KeyPress
Kg}Jh}Lj
Kg{Lh|Mj}Rl
Kh}Kg|Kg|Mh|MfzKeyJdyGbwFawB`wB`x@`x@fz?Xm1jzKYi:ktZ)2
*KKKNNN___JJJ%%%111***===ZZZXXX777
&("KMFMKQ<:@
!$!KNJNQM*-*
KOKTWS.00
kpl*/*
=@:KQ?DK9MV;gpU
L$0WQV
L$4RQV
L$4RWQV
L$(9)u
Label1
Label2
Label4
Label5
lblDisclaimer
L$,_^]f
^lf9~z
[lG`rD`rD`sB`sB`u?`u?`v<`v<bx=bx=bw>aw=av?`u>`t@`t?_uA\r?_uAe{Gi
LineTo
lizI\gEhtRckSFN603)03)4341020.3*(-998***-0&@C906%&,
{{{lll^^^]]]eeejjjjjjiii^^^NNN???...
lmqIJN23646879;
LoadCursorA
LoadLibraryA
lofbf\qtk|
L$(PQj
L$@PQj
L$ PQV
L$,PQV
L$(PQV
L$$PQV
lqd*-$
L$$QWUSR
L$ RQV
L$$RQV
LW>fsRYfE^pBi{MdzA]s:e|@d{?cy@cy@dwEeyGgxLhzMi~N^sC[p@n
_lxSr~Yx
Mail : 
MaskColor
mCO2#/
MfsIdrG7<'
_mIhxOQa9
mioVMS:8>%(/
MivV+8
'%,MKRWXU341
!-,/MLR}|
m~MdtDcoLcoMV^F=E--0&-0&0010/0(&+A@E$%$<<</2(/3)5:)[aO
	MMNNNNVVV333
	MMOVUX315
MNJTST000
mok##!
MouseDown
MouseEnter
MouseIcon
MouseLeave
MouseMove
MousePointer
MouseUp
MoveToEx
}m|OXh8arAhrVMW;5<(06#35.35.213435;9=
*-*MQN}
*/'MRJotl
~ms_EJ;"'
MS Sans Serif
MS Sans SerifJH
MSVBVM60.DLL
MXdAdpM7<,
n<_^]3
Nby@`w>ay=ay=]p=btAamKS_=
Nh|Hcx?_t:]q8[o7bqDdrFU[D
Ni~Ni}Oi}Oh|Ng{MezJdxHbxDawDaxBaxBi|FVi3jxP[hA_eT
NjuULW7W\LHM=
nnnRRR;;;***   $$$###)))***$$$&&&%%%
nnu`JOB
noj]\_]\`FDK?<C>=@CBEAB>;<8>B8IMCVe?\lEhxQr
nok+-)
nok/1-
NoRedraw
nosRRXCCHNNT``gaahVV\WW_ggo]^d@AGABEVWZJMJ%(%
notUV[RRX^^eiipmmtyx
npl;<8
nqi8:4
NZ6eqMaqB`pA_v>^v>^u=]u=]u=^u=^v>_v>]u=^u=^v>_v>_v>^v>^u=]u=]x4]y5_x<b{>e}Ei
@O2l}Xx
_`oBcsDbrDXdAZeC&+
Occrus when the cursor moves around the button for the first time.
Occurs when the cursor leaves/moves outside the button.
Occurs when the cursor moves over the button.
Occurs when the user clicks over the button twice.
Occurs when the user presses a key while the button has the focus.
Occurs when the user presses and releases an ANSI key.
Occurs when the user presses and then releases a mouse button over the button.
Occurs when the user presses the mouse button while the button has the focus.
Occurs when the user releases a key while the button has the focus.
Occurs when the user releases the mouse button while the button has the focus.
O];esOdrM\lD
oeuG\l>crGbqET^A6?#)+#),$+).,*.,+-+*,*+')*&&)!+-&8=.
    Off
OffsetRect
Og|LdvJasG^r?]p>_t:av<bw<bw<dtBbrAemNDL-
o|i6A4
Oi~Ni}Oi}Oj~Ph|Ng|KezIcyEbxDbyBbyBhzD`r<\jBbpH4:)
Oj~Pj~Pk
oleaut32.dll
OleTranslateColor
O]m=aqBcsDVc=>J%*1
Om}Tl}Sz
+++OOOTTTBBB
O\r<dzB[q8arB_qAbmO5@!
ORNcgbPRQpsr
O\s=dzBZp8_pA^o?fqR8C$
OsfLPs7vPs
osh04(<<<445@>E64;A@B>=@6:.26)@K+ZeFkzNm|PcuGt
OspuRs
O]s<Yo6^t;asBdvE[gGEP0
oszeqweMSA.3$+0"). ). =B3ek[u{jciX^fUjra
OverrideColor
Override the predefined color property of the button.
owfCI?FKBVZVPTP(+)
[^p<as>fuH^m@aiP3;"
PatBlt
Pd{Cby>e|BcuChzHbnMO[:
pFL:EG@JLE_^acbdvsz
p_gH-3
PhzNdvJ_sA]q>^t:`v<cx<cx<csA`p>dmLOY8
Picture3
PictureAlignment
PictureDown
PictureHot
PictureNormal
PictureOpacity
PictureSize
PictureSizeH
PictureSizeW
pi{F\n9dtEaqBbkPYbG)+%
p_iJ (
PM me @ForumW
"!$PMVIFOFFF
pnr`/3"
[_p&:O
Polyline
P[p<dyB\r;duGevGR]?*4
*+*PPNRSQ01/
PPPJJJbbb777
ppvmmtyy
P[q=dyB[q:ctEbsE[fH0:
PQh4l@
Property
+--PRQJLL.1/
Ps0jPs
^p}S,2
Ps$FPsx
PtInRegion
pto04/
ptoMPK<?:9<8=@;FIEQTP48/:>5AF<EI@GLCMRIW\R_d[ej`nsi~
pudLNHDF?<;=546GDKusz
pufej[Y^PRVINRFOSGVZN^cVkp`X^M/5#
PULDGC03/
pvf*-$7:1;<;5548897788:46822:#@H1\j@drH]p9]p8_v:
pwo?F=
PXm:cxC_t>\m@fwJ6@$
PXm:cxC_t?Zj>fvI2< 
PYn:cyB^s=`pCgxJ>H+ *
PYo;cyC]s=bsEgxJGQ5$.
pzf4;/
QaxA^t;by@btCfxG_jJIT4
qem]RZJAH:,3%
Qj~Ph}MfzJdzFcyEbyCbyCgxFfwEXdAS_<
qjzMar@evDbpG]kCCJ6&-
qlwY=D-
qote24.
..,QQPrrr
}}}||||||qqq[[[HHHAAA888777@@@EEEBBBBBB:::'''
qqqnnnyyy{{{lll^^^ZZZHHH===:::777333888888***&&&!!!
qqwlltts{ssz]]d89=
qqyllriioYZ]9;=
qr|],7
|QRH%&
(*%qrm
')$QRNHJE
%&#QRP;<9
qsn8:5
Qs&nPs*aQs
QstjPs
qt{g:A-
QVLQWM
#(!QVOtyr
qwk/4,
QXB_mD[iAfxC]o:awC]t?]s?`vB`vB^t?^t@axCd{Ff|Gg~Ih
q}XVc<aoGdrJJW/14-14-341563557436316316**+%$&
r*0 26,14+665232001434.0*,.(@H1[cKbqFcrGexAcu>f{Bs
Rapidshare Folder with Application, crack and instruction [Kept updated]
ReadyState
Rectangle
Refresh
ReleaseCapture
Returns a handle that uniquely identifies the control.
Returns/sets a color in a button's picture to be transparent.
Returns/sets a value in percent how the pictures will be blended to the button.
Returns/sets a value to determine the effect applied to button caption and icon.
Returns/sets a value to determine the shape used to draw the button.
Returns/sets a value to determine the size of the picture to draw.
Returns/sets a value to determine the style used to draw the button.
Returns/sets a value to determine where to draw the picture in the button.
Returns/sets a value to determine whether the button can respond to events.
Returns/sets a value to determine whether the control uses the system's hand pointer as its cursor.
Returns/sets a value to determine whether to use MaskColor to create transparent areas of the picture.
Returns/sets bold font style.
Returns/sets italic font style.
Returns/sets strikethrough font style.
Returns/sets the background color used for the button.
Returns/sets the Font used to display text on the button.
Returns/sets the picture displayed on a normal state button.
Returns/sets the picture displayed when the control is pressed down or in checked state.
Returns/sets the picture displayed when the cursor is over the control.
Returns/sets the standard/custom height of the defined pictures in pixels.
Returns/sets the standard/custom width of the defined pictures in pixels.
Returns/sets the text color of the button caption.
Returns/sets the text displayed in the button.
Returns/sets the type of control the button will observe.
Returns/sets the type of mouse pointer displayed when cursor over the button.
Returns/sets the value or state of the button.
Returns/sets underline font style.
Rg{McwG_tDbtG_qE]q?]q>_u;av=bw<av;csAdtBdmN9B#
Rg|MdzIk
Rj~Qh}Mf{KezGcyFcyCbyChyGduCamJ7C 
ROXOLUSSS
RPh4l@
...&&&---RRRWWW>>>
rRs1hRs
RsbrRs
RSP#$!48+*.!V]I
RtlMoveMemory
RUpePQ
RVJvwt12/
RZD`nE\jAfxC^p;_uA[q=Zp;\r>]s?\r>^t@cyDg}Ih~Ji
SbxF[s9]t:_v:]t8^q=as@`lIS_<
Se}D`w>`x<by=_r?dwDcoMT`>
SelectObject
Set BackColor to the default background color of a button style.
SetCapture
SetCursor
SetDIBitsToDevice
SetPixelV
SetPopupMenu
SetRect
Sets a custom mouse icon for the button.
SetTextColor
Set the control to handle popup operation to the specified menu and settings.
SetWindowLongA
SetWindowRgn
SeyG_sA_t;`v<cx<dy=cs@[l9blJ^gF
s_fH&)
SHDocVwCtl
SHDocVwCtl.WebBrowser
shell32.dll
ShellExecuteA
Shows information about the control and its author.
Si;ZpB`t@`t@`t?`t?`u=`u=`v;`v;bx=bx=bx=aw=av>`v=`u>`u>[q=]s?_v@`wAcyCf}Gi
s`lN=J+), 
SpecialEffect
Specifies the name of the font used for the button caption.
Specifies the size (in points) of the font used for the button caption.
SQa2GM<:@.26+8<1>?===;98<:8<658=<?"$
SRTNNNHHH
stdole
StretchBlt
{~|svrlplmrkw|u
swkcg[UYO=A6
syh.0,240317A?D=;@DBGLMIRTO[aOls`
T$4PRV
T$4QRV
Tb>XfBYiAt
TdGczGYq=`t?`t?`u>`u>`v=`v=`v;`v;bx=bx=bx=aw=av=`v=`u=`u=Yp;_u@byCbyCg~Gm
T$dQRV
t!f91u
t\f9~zf
!This program cannot be run in DOS mode.
ThzNbvC^r?_t:`v<cx<cy=cs@]m;cmLXbA
tmf9^nt=f9^tf
T_p>duCesJ^lCTZF)0
T$ PRV
T$(PRV
T$$PRV
T$(QRj
T$|QRV
T$ QRV
T$,QRV
T$$QRV
TrackMouseEvent
_TrackMouseEvent
ts{ts|
$$'::<TSVrrs
! %TSZDCK?AD9;>:A8V]T
^tt&f9^nu f9^`u
~tt!f9~pt
   TTT			
tttPPP333'''999000...+++&&&***)))
~~~~~~~~~tttqqqeeeYYYZZZbbb\\\OOO\\\XXXUUUGGG000$$$
tttVVVAAA===AAACCC<<<888888222&&&&&&'''
tuu]^^SWPJNFahW
T]V5=7
<>?TVWBEE
twkRUJ9<1!#
twn$& 
ty^EJ3
uaf9^lu[
UcBeyF
u$f9~n
|u|f[aOFL:27)
Uf@k}Wq
Ug{NbvI^sD\qBatF_rD^r>^r>`v<aw=bv<`u;ap@dsCckN2:
ugwIaqB^n?erJ\jA08!*1
uhq\FO:$-
U\Hw~o
UixKesJn{Rp|VeqKtve[]K22&
ujnb+/%
Uk~Ri|PgzPj|Rm
uKTA%* #)
umt^,3
u{nAH:
UnsetPopupMenu
Unset the control handling popup operation and restores regular button events.
UseMaskColor
user32.dll
UserControl
User specifically agrees not to distribute, reproduce, transmit or transfer, in whole or in part, the software without express prior written permission from the developer. EXCLUSIVELY DISTRIBUTED BY avi01 and gigabyte89 and NO ONE ELSE.. U'LL DIE IN HELL FOR COPYING ANY PORTION OF IT!! God bless ESET! If u don't like it, u know where the recycle bin is..
ut|]EL3
	uuf9~pt/f9~`t);
uuuKKK000...444555...***+++$$$
UUVMMMRRR$$$
uwzvx|w|
v*0 /2).1(332////./435+-')+%=E-V^G^lB_nCbt=_r:dzAt
VBA6.DLL
__vbaAryCopy
__vbaAryDestruct
__vbaAryLock
__vbaAryUnlock
__vbaBoolVar
__vbaCastObj
__vbaCastObjVar
__vbaCheckType
__vbaCheckTypeVar
__vbaChkstk
__vbaCopyBytes
__vbaEnd
__vbaErase
__vbaErrorOverflow
__vbaExceptHandler
__vbaExitProc
__vbaFPException
__vbaFpI4
__vbaFpR8
__vbaFreeObj
__vbaFreeObjList
__vbaFreeStr
__vbaFreeStrList
__vbaFreeVar
__vbaFreeVarList
__vbaGenerateBoundsError
__vbaHresultCheckObj
__vbaI2I4
__vbaI2Var
__vbaI4Var
__vbaLateIdCall
__vbaLateIdCallLd
__vbaLateIdSt
__vbaLateMemCallLd
__vbaLenBstr
__vbaLsetFixstrFree
__vbaNew
__vbaNew2
__vbaObjIs
__vbaObjSet
__vbaObjSetAddref
__vbaOnError
__vbaR4Var
__vbaRaiseEvent
__vbaRecAnsiToUni
__vbaRecUniToAnsi
__vbaRedim
__vbaRedimPreserve
__vbaSetSystemError
__vbaStrCat
__vbaStrComp
__vbaStrCopy
__vbaStrFixstr
__vbaStrI4
__vbaStrMove
__vbaStrToAnsi
__vbaStrToUnicode
__vbaStrVarMove
__vbaUbound
__vbaUI1I4
__vbaVarDup
__vbaVarLateMemCallLd
__vbaVarLateMemCallLdRf
__vbaVarVargNofree
VbtIf9^zf
Vd@lzV
Version 1.3
Vf|J_v=_w=ax<`w;]p=as@`lJS_=
VfyLatG^sD^rCatF_rD^s?_s?av<bw=av;`t:_n>csCbjN.6
Vg{I`tB_u;`v<cx<dy=ctAZk8akI`jH
VhxKq~VmzQeqKozUqta<?,
VhzLdwI`uA]q=]r9^t:bv=dy@_n@_m@\cI
Vi|Rk~Tm
VirtualAlloc
VirtualFree
V\K:<8=>:438DBG75::8=9:6562:@.MSAenSv
v|kIO>)/
Vlf9^tf
V_mDhuLv
v~o@G9LSE^dX
vs}_QZ?9B'
VVVOOO>>>
VWSSSS,,,
*(/VWTOPM'*#
WcGcsI]mC`u=h~Fby=cz>e{Bg}Di|Lj}Mk{Rk|Rh|N
WebBrowser
WebBrowser1
{}whjdXYVHIF/0-!"
Wh}MbwG`sE`rD`t@_t@`u<`u<au<av=cqD^l?_fM
wilW*+
WindowFromPoint
w[]J+,
w{n49,
W[P04(>>?767KHO97>;:==<?:?2:?2IS4\fG_nBVe9Yj=t
wqxcej\QUH37,
$#!'WWWKKK]]]!!!
wwwwwwxxxNNN///
wx~fFJ9
wx{VWZ
'))WYY|~
wyyprsprs688/12*,-)+,*--)++$''!##
WYZ-//!#$,..-00%'(')*144/11"%%
'*!WZQ>B5EJ=fk[
XbpEl{M\l=_eSEK:25*26+786342.-0.,0325769350783@E5,1!
Xd@htP[k<`p@_v>^v>^u=]u=]u=^u=^v>_v>]t<]u=^u>_v>_v>^u>]u=]t<]y5^y6`y<c|?f~Fj
~xf9~x
x>J #.
X^n=evEWg7\l=GT/%1
xv|rrrggh[_USWMTZIX^MdtLN^6^nF
xvzphkbuwikn``bUX[MRTHGI<67,(*
xw{tttrqrjmkrus}
XX\++/
xX_ShocJPE29-+2&
~~~xxx
$$$XXXQQQ333
,,,XXXrrqbbbBBB...AAAeeedddcccgggZZZ]]]ggg```JJJ555444///
YbtCn~Qt
yek_8</"'
Yh|M\p@w
y|kRUD*+!
yRTN#%
yryfKQ?+1
YW[RQU%#)
yz}stwlmqLMQ,-0&'+45778;!#$
yz|uwxvxxy{z|
ZaqC\k=fsKbpG@G0+3
zfiT$'
|Zi=^mAr
z{~nnqIJMEEHDDGDEH@@C<<?DEHRSVJMJKMKLNKLNKKMKJLJJLIILI\^[\^[[]ZXZXVXVWZW\_\ac`W]Z[a^agbflgmukz
znt]<@.(,
ZoyZt~_S[@
Z`P-0&690<<<332324879=?9:<67?'GO7apEhvLbu>exAbx=
Z`PGL<]_YNOJdcfsrt
ZSUC "
z|vDFA571 "
	&'$Z[Ycd`VXS1/4
ZZZIIIBBB
zzz~~~zzzPPPAAAIIIKKKWWW```VVVQQQPPPRRRWWWWWWIII222