Analysis Date2015-01-16 03:54:41
MD5fb152ab92726a2c953790a3f15a573b0
SHA19e9ddc2dd551e31586ae3c4e2a08d53ba8859e20

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: c69726ed422d3dcfdec9731986daa752 sha1: 4546608e3b1a2ab1d69a34018d2ddfa7fa411885 size: 23040
Section.rdata md5: a2c7710fa66fcbb43c7ef0ab9eea5e9a sha1: 60485025c47935e745e57b6efc7042f2261b7d53 size: 4608
Section.data md5: e59cdcb732e4bfbc84cc61dd68354f78 sha1: ffc24489dd56b406f9078ba1cb9c71e9b430dbee size: 1024
Section.ndata md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Section.rsrc md5: 868661c4236d9cb8813448733f3bc4ca sha1: 88acb41483af0a341248faae8b729e5336588a97 size: 80896
Timestamp2009-12-05 22:50:41
VersionLegalCopyright: BEARPC精选软件集
ProductName: 愤怒的小鸟
FileDescription: 愤怒的小鸟PC汉化版
FileVersion: 1.0.0
CompanyName: www.bearpc.net
PackerNullsoft PiMP Stub -> SFX
PEhash8404dc3a28cd675f1039de404f7f5e3e9a470ebb
IMPhash7fa974366048f9c551ef45714595665e
AV360 Safeno_virus
AVAd-Awareno_virus
AVAlwil (avast)no_virus
AVArcabit (arcavir)no_virus
AVAuthentiumno_virus
AVAvira (antivir)TR/Agent.1174460
AVBullGuardno_virus
AVCA (E-Trust Ino)no_virus
AVCAT (quickheal)no_virus
AVClamAVno_virus
AVDr. Webno_virus
AVEmsisoftno_virus
AVEset (nod32)no_virus
AVFortinetno_virus
AVFrisk (f-prot)no_virus
AVF-Secureno_virus
AVGrisoft (avg)no_virus
AVIkarusno_virus
AVK7no_virus
AVKasperskyno_virus
AVMalwareBytesno_virus
AVMcafeeno_virus
AVMicrosoft Security Essentialsno_virus
AVMicroWorld (escan)no_virus
AVRisingno_virus
AVSophosno_virus
AVSymantecTrojan.Gen
AVTrend Microno_virus
AVVirusBlokAda (vba32)no_virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FileIQIYIsetup_l_spl004@kb010.exe
Creates FileBF-BFVCenter[[AB027]].exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\nsu2.tmp\Base64.dll
Creates FileOfficeAssist.0405.80.1119.exe
Creates File1
Creates File1.rar
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\nsu2.tmp\inetc.dll
Creates File9377mycs_Y_mgaz2_1201B.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\nsu2.tmp\System.dll
Creates FileSoHuVA_4.3.0.1-c204900003-ng-nti-s-x.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates FileMM-liao8302.exe
Creates FileC:\Program Files\2.ico
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\nsu2.tmp\ExecCmd.dll
Creates Fileyx_dts.exe
Creates FileFunshionInstall_C70699.exe
Creates Filesetup_95165069.exe
Creates FileC:\Program Files\4.ico
Deletes FileBF-BFVCenter[[AB027]].exe
Deletes File9377mycs_Y_mgaz2_1201B.exe
Deletes FileSoHuVA_4.3.0.1-c204900003-ng-nti-s-x.exe
Deletes FileOfficeAssist.0405.80.1119.exe
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temp\nst1.tmp
Deletes File1.rar
Deletes File1
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temp\nsu2.tmp
Deletes FileMM-liao8302.exe
Deletes Fileyx_dts.exe
Deletes FileFunshionInstall_C70699.exe
Deletes Filesetup_95165069.exe
Deletes FileC:\Program Files\4.ico
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\BF-BFVCenter[[AB027]].exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\BF-BFVCenter[[AB027]].exe"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\SoHuVA_4.3.0.1-c204900003-ng-nti-s-x.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\SoHuVA_4.3.0.1-c204900003-ng-nti-s-x.exe"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\9377mycs_Y_mgaz2_1201B.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\9377mycs_Y_mgaz2_1201B.exe"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\yx_dts.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\yx_dts.exe"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\FunshionInstall_C70699.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\FunshionInstall_C70699.exe"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\MM-liao8302.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\MM-liao8302.exe"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\OfficeAssist.0405.80.1119.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\OfficeAssist.0405.80.1119.exe"
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\"
Creates Process
Creates ProcessC:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\setup_95165069.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\setup_95165069.exe"
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates Mutex2.ico
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Winsock DNSint.dpool.sina.com.cn
Winsock DNSt.cn
Winsock DNSmmliao.jianting.net

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\MM-liao8302.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\MM-liao8302.exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\SoHuVA_4.3.0.1-c204900003-ng-nti-s-x.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\SoHuVA_4.3.0.1-c204900003-ng-nti-s-x.exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\FunshionInstall_C70699.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\FunshionInstall_C70699.exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\setup_95165069.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\setup_95165069.exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\OfficeAssist.0405.80.1119.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\OfficeAssist.0405.80.1119.exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\"

Creates FileC:\Program Files\2.ico

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\BF-BFVCenter[[AB027]].exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\BF-BFVCenter[[AB027]].exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\9377mycs_Y_mgaz2_1201B.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\9377mycs_Y_mgaz2_1201B.exe"

Process
↳ C:\WINDOWS\system32\cmd.exe /C copy /b "C:\Program Files\yx_dts.exe" + "C:\WINDOWS\Fonts\gulim.ttc" "C:\Program Files\yx_dts.exe"

Process
↳ Pid 0

Network Details:

DNSint.dpool.sina.com.cn
Type: A
180.149.136.250
DNSt.cn
Type: A
114.134.80.138
DNSmmliao.jianting.net
Type: A
122.227.42.227
DNSc01.i06.arnic.hadns.net
Type: A
113.17.184.10
DNSc01.i06.arnic.hadns.net
Type: A
121.10.117.139
DNSc01.i06.arnic.hadns.net
Type: A
183.56.172.47
DNSc01.i06.arnic.hadns.net
Type: A
222.186.20.122
DNSc01.i06.arnic.hadns.net
Type: A
58.220.2.5
DNSdown.fspcdn.com
Type: A
221.204.189.12
DNSdown.fspcdn.com
Type: A
182.118.38.50
DNSdown.fspcdn.com
Type: A
182.118.38.51
DNSdown.fspcdn.com
Type: A
221.204.189.11
DNSwww.bangshijz.com
Type: A
42.121.255.144
DNSdownload012.rdb.cnc.ccgslb.com.cn
Type: A
61.179.105.147
DNSdownload012.rdb.cnc.ccgslb.com.cn
Type: A
218.60.107.12
DNSgnop008.tlgslb.com
Type: A
116.10.187.112
DNSgnop008.tlgslb.com
Type: A
116.10.187.113
DNSgnop008.tlgslb.com
Type: A
116.10.187.114
DNSgnop008.tlgslb.com
Type: A
116.10.187.118
DNSgnop008.tlgslb.com
Type: A
116.10.187.119
DNSgnop008.tlgslb.com
Type: A
116.10.187.120
DNSgnop008.tlgslb.com
Type: A
116.10.187.121
DNSgnop008.tlgslb.com
Type: A
116.10.187.122
DNSgnop008.tlgslb.com
Type: A
116.10.187.110
DNSgnop008.tlgslb.com
Type: A
116.10.187.111
DNScdn.coop.baofeng.com
Type: A
122.142.74.12
DNScdn.coop.baofeng.com
Type: A
182.18.51.104
DNScdn.coop.baofeng.com
Type: A
218.60.99.66
DNScdn.coop.baofeng.com
Type: A
58.20.193.222
DNScdn.coop.baofeng.com
Type: A
119.188.72.240
DNSopt.xdwscache.glb0.lxdns.com
Type: A
8.37.235.5
DNSopt.xdwscache.glb0.lxdns.com
Type: A
8.37.235.6
DNSopt.xdwscache.glb0.lxdns.com
Type: A
8.37.234.3
DNSopt.xdwscache.glb0.lxdns.com
Type: A
8.37.234.4
DNSopt.xdwscache.glb0.lxdns.com
Type: A
8.37.235.2
DNSopt.xdwscache.glb0.lxdns.com
Type: A
8.37.235.3
DNSd.qq66699.com
Type: A
DNSneirong.funshion.com
Type: A
DNSwdl1.cache.wps.cn
Type: A
DNSdl.nx5.com
Type: A
DNSdl.baofeng.com
Type: A
DNSxiazai.9377.com
Type: A
HTTP GEThttp://int.dpool.sina.com.cn/iplookup/iplookup.php
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://t.cn/RZIvNie
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://mmliao.jianting.net/mmliao/MM-liao8302.exe
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://d.qq66699.com/yx/dts/sqft/905848/yx_dts.exe
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://neirong.funshion.com/software/files/silent5/FunshionInstall_C70699.exe
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://www.bangshijz.com/OWU5ZGRjMmRkNTUxZTMxNTg2YWUzYzRlMmEwOGQ1M2JhODg1OWUyMC5leGU=/40.html
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://wdl1.cache.wps.cn/wps/download/OfficeAssist.0405.80.1119.exe
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://t.cn/RZII9Xg
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://dl.nx5.com/apk/20141222/setup_95165069.exe
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://dl.baofeng.com/BFVCenter/BF-BFVCenter[[AB027]].exe
User-Agent: NSIS_Inetc (Mozilla)
HTTP GEThttp://xiazai.9377.com/20150105/9377mycs_Y_mgaz2_1201B.exe
User-Agent: NSIS_Inetc (Mozilla)
Flows TCP192.168.1.1:1031 ➝ 180.149.136.250:80
Flows TCP192.168.1.1:1032 ➝ 114.134.80.138:80
Flows TCP192.168.1.1:1033 ➝ 122.227.42.227:80
Flows TCP192.168.1.1:1034 ➝ 113.17.184.10:80
Flows TCP192.168.1.1:1035 ➝ 221.204.189.12:80
Flows TCP192.168.1.1:1036 ➝ 42.121.255.144:80
Flows TCP192.168.1.1:1037 ➝ 61.179.105.147:80
Flows TCP192.168.1.1:1038 ➝ 114.134.80.138:80
Flows TCP192.168.1.1:1039 ➝ 116.10.187.112:80
Flows TCP192.168.1.1:1040 ➝ 122.142.74.12:80
Flows TCP192.168.1.1:1041 ➝ 8.37.235.5:80

Raw Pcap
0x00000000 (00000)   47455420 2f69706c 6f6f6b75 702f6970   GET /iplookup/ip
0x00000010 (00016)   6c6f6f6b 75702e70 68702048 5454502f   lookup.php HTTP/
0x00000020 (00032)   312e310d 0a557365 722d4167 656e743a   1.1..User-Agent:
0x00000030 (00048)   204e5349 535f496e 65746320 284d6f7a    NSIS_Inetc (Moz
0x00000040 (00064)   696c6c61 290d0a48 6f73743a 20696e74   illa)..Host: int
0x00000050 (00080)   2e64706f 6f6c2e73 696e612e 636f6d2e   .dpool.sina.com.
0x00000060 (00096)   636e0d0a 436f6e6e 65637469 6f6e3a20   cn..Connection: 
0x00000070 (00112)   4b656570 2d416c69 76650d0a 43616368   Keep-Alive..Cach
0x00000080 (00128)   652d436f 6e74726f 6c3a206e 6f2d6361   e-Control: no-ca
0x00000090 (00144)   6368650d 0a0d0a                       che....

0x00000000 (00000)   47455420 2f525a49 764e6965 20485454   GET /RZIvNie HTT
0x00000010 (00016)   502f312e 310d0a55 7365722d 4167656e   P/1.1..User-Agen
0x00000020 (00032)   743a204e 5349535f 496e6574 6320284d   t: NSIS_Inetc (M
0x00000030 (00048)   6f7a696c 6c61290d 0a486f73 743a2074   ozilla)..Host: t
0x00000040 (00064)   2e636e0d 0a436f6e 6e656374 696f6e3a   .cn..Connection:
0x00000050 (00080)   204b6565 702d416c 6976650d 0a436163    Keep-Alive..Cac
0x00000060 (00096)   68652d43 6f6e7472 6f6c3a20 6e6f2d63   he-Control: no-c
0x00000070 (00112)   61636865 0d0a0d0a 76650d0a 43616368   ache....ve..Cach
0x00000080 (00128)   652d436f 6e74726f 6c3a206e 6f2d6361   e-Control: no-ca
0x00000090 (00144)   6368650d 0a0d0a                       che....

0x00000000 (00000)   47455420 2f6d6d6c 69616f2f 4d4d2d6c   GET /mmliao/MM-l
0x00000010 (00016)   69616f38 3330322e 65786520 48545450   iao8302.exe HTTP
0x00000020 (00032)   2f312e31 0d0a5573 65722d41 67656e74   /1.1..User-Agent
0x00000030 (00048)   3a204e53 49535f49 6e657463 20284d6f   : NSIS_Inetc (Mo
0x00000040 (00064)   7a696c6c 61290d0a 486f7374 3a206d6d   zilla)..Host: mm
0x00000050 (00080)   6c69616f 2e6a6961 6e74696e 672e6e65   liao.jianting.ne
0x00000060 (00096)   740d0a43 6f6e6e65 6374696f 6e3a204b   t..Connection: K
0x00000070 (00112)   6565702d 416c6976 650d0a43 61636865   eep-Alive..Cache
0x00000080 (00128)   2d436f6e 74726f6c 3a206e6f 2d636163   -Control: no-cac
0x00000090 (00144)   68650d0a 0d0a0a                       he.....

0x00000000 (00000)   47455420 2f79782f 6474732f 73716674   GET /yx/dts/sqft
0x00000010 (00016)   2f393035 3834382f 79785f64 74732e65   /905848/yx_dts.e
0x00000020 (00032)   78652048 5454502f 312e310d 0a557365   xe HTTP/1.1..Use
0x00000030 (00048)   722d4167 656e743a 204e5349 535f496e   r-Agent: NSIS_In
0x00000040 (00064)   65746320 284d6f7a 696c6c61 290d0a48   etc (Mozilla)..H
0x00000050 (00080)   6f73743a 20642e71 71363636 39392e63   ost: d.qq66699.c
0x00000060 (00096)   6f6d0d0a 436f6e6e 65637469 6f6e3a20   om..Connection: 
0x00000070 (00112)   4b656570 2d416c69 76650d0a 43616368   Keep-Alive..Cach
0x00000080 (00128)   652d436f 6e74726f 6c3a206e 6f2d6361   e-Control: no-ca
0x00000090 (00144)   6368650d 0a0d0a                       che....

0x00000000 (00000)   47455420 2f736f66 74776172 652f6669   GET /software/fi
0x00000010 (00016)   6c65732f 73696c65 6e74352f 46756e73   les/silent5/Funs
0x00000020 (00032)   68696f6e 496e7374 616c6c5f 43373036   hionInstall_C706
0x00000030 (00048)   39392e65 78652048 5454502f 312e310d   99.exe HTTP/1.1.
0x00000040 (00064)   0a557365 722d4167 656e743a 204e5349   .User-Agent: NSI
0x00000050 (00080)   535f496e 65746320 284d6f7a 696c6c61   S_Inetc (Mozilla
0x00000060 (00096)   290d0a48 6f73743a 206e6569 726f6e67   )..Host: neirong
0x00000070 (00112)   2e66756e 7368696f 6e2e636f 6d0d0a43   .funshion.com..C
0x00000080 (00128)   6f6e6e65 6374696f 6e3a204b 6565702d   onnection: Keep-
0x00000090 (00144)   416c6976 650d0a43 61636865 2d436f6e   Alive..Cache-Con
0x000000a0 (00160)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x000000b0 (00176)   0d0a                                  ..

0x00000000 (00000)   47455420 2f4f5755 355a4752 6a4d6d52   GET /OWU5ZGRjMmR
0x00000010 (00016)   6b4e5455 785a544d 784e5467 32595755   kNTUxZTMxNTg2YWU
0x00000020 (00032)   7a597a52 6c4d6d45 774f4751 314d324a   zYzRlMmEwOGQ1M2J
0x00000030 (00048)   684f4467 314f5755 794d4335 6c654755   hODg1OWUyMC5leGU
0x00000040 (00064)   3d2f3430 2e68746d 6c204854 54502f31   =/40.html HTTP/1
0x00000050 (00080)   2e310d0a 55736572 2d416765 6e743a20   .1..User-Agent: 
0x00000060 (00096)   4e534953 5f496e65 74632028 4d6f7a69   NSIS_Inetc (Mozi
0x00000070 (00112)   6c6c6129 0d0a486f 73743a20 7777772e   lla)..Host: www.
0x00000080 (00128)   62616e67 7368696a 7a2e636f 6d0d0a43   bangshijz.com..C
0x00000090 (00144)   6f6e6e65 6374696f 6e3a204b 6565702d   onnection: Keep-
0x000000a0 (00160)   416c6976 650d0a43 61636865 2d436f6e   Alive..Cache-Con
0x000000b0 (00176)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x000000c0 (00192)   0d0a                                  ..

0x00000000 (00000)   47455420 2f777073 2f646f77 6e6c6f61   GET /wps/downloa
0x00000010 (00016)   642f4f66 66696365 41737369 73742e30   d/OfficeAssist.0
0x00000020 (00032)   3430352e 38302e31 3131392e 65786520   405.80.1119.exe 
0x00000030 (00048)   48545450 2f312e31 0d0a5573 65722d41   HTTP/1.1..User-A
0x00000040 (00064)   67656e74 3a204e53 49535f49 6e657463   gent: NSIS_Inetc
0x00000050 (00080)   20284d6f 7a696c6c 61290d0a 486f7374    (Mozilla)..Host
0x00000060 (00096)   3a207764 6c312e63 61636865 2e777073   : wdl1.cache.wps
0x00000070 (00112)   2e636e0d 0a436f6e 6e656374 696f6e3a   .cn..Connection:
0x00000080 (00128)   204b6565 702d416c 6976650d 0a436163    Keep-Alive..Cac
0x00000090 (00144)   68652d43 6f6e7472 6f6c3a20 6e6f2d63   he-Control: no-c
0x000000a0 (00160)   61636865 0d0a0d0a 61636865 2d436f6e   ache....ache-Con
0x000000b0 (00176)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x000000c0 (00192)   0d0a                                  ..

0x00000000 (00000)   47455420 2f525a49 49395867 20485454   GET /RZII9Xg HTT
0x00000010 (00016)   502f312e 310d0a55 7365722d 4167656e   P/1.1..User-Agen
0x00000020 (00032)   743a204e 5349535f 496e6574 6320284d   t: NSIS_Inetc (M
0x00000030 (00048)   6f7a696c 6c61290d 0a486f73 743a2074   ozilla)..Host: t
0x00000040 (00064)   2e636e0d 0a436f6e 6e656374 696f6e3a   .cn..Connection:
0x00000050 (00080)   204b6565 702d416c 6976650d 0a436163    Keep-Alive..Cac
0x00000060 (00096)   68652d43 6f6e7472 6f6c3a20 6e6f2d63   he-Control: no-c
0x00000070 (00112)   61636865 0d0a0d0a 6e656374 696f6e3a   ache....nection:
0x00000080 (00128)   204b6565 702d416c 6976650d 0a436163    Keep-Alive..Cac
0x00000090 (00144)   68652d43 6f6e7472 6f6c3a20 6e6f2d63   he-Control: no-c
0x000000a0 (00160)   61636865 0d0a0d0a 61636865 2d436f6e   ache....ache-Con
0x000000b0 (00176)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x000000c0 (00192)   0d0a                                  ..

0x00000000 (00000)   47455420 2f61706b 2f323031 34313232   GET /apk/2014122
0x00000010 (00016)   322f7365 7475705f 39353136 35303639   2/setup_95165069
0x00000020 (00032)   2e657865 20485454 502f312e 310d0a55   .exe HTTP/1.1..U
0x00000030 (00048)   7365722d 4167656e 743a204e 5349535f   ser-Agent: NSIS_
0x00000040 (00064)   496e6574 6320284d 6f7a696c 6c61290d   Inetc (Mozilla).
0x00000050 (00080)   0a486f73 743a2064 6c2e6e78 352e636f   .Host: dl.nx5.co
0x00000060 (00096)   6d0d0a43 6f6e6e65 6374696f 6e3a204b   m..Connection: K
0x00000070 (00112)   6565702d 416c6976 650d0a43 61636865   eep-Alive..Cache
0x00000080 (00128)   2d436f6e 74726f6c 3a206e6f 2d636163   -Control: no-cac
0x00000090 (00144)   68650d0a 0d0a7472 6f6c3a20 6e6f2d63   he....trol: no-c
0x000000a0 (00160)   61636865 0d0a0d0a 61636865 2d436f6e   ache....ache-Con
0x000000b0 (00176)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x000000c0 (00192)   0d0a                                  ..

0x00000000 (00000)   47455420 2f424656 43656e74 65722f42   GET /BFVCenter/B
0x00000010 (00016)   462d4246 5643656e 7465725b 5b414230   F-BFVCenter[[AB0
0x00000020 (00032)   32375d5d 2e657865 20485454 502f312e   27]].exe HTTP/1.
0x00000030 (00048)   310d0a55 7365722d 4167656e 743a204e   1..User-Agent: N
0x00000040 (00064)   5349535f 496e6574 6320284d 6f7a696c   SIS_Inetc (Mozil
0x00000050 (00080)   6c61290d 0a486f73 743a2064 6c2e6261   la)..Host: dl.ba
0x00000060 (00096)   6f66656e 672e636f 6d0d0a43 6f6e6e65   ofeng.com..Conne
0x00000070 (00112)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x00000080 (00128)   650d0a43 61636865 2d436f6e 74726f6c   e..Cache-Control
0x00000090 (00144)   3a206e6f 2d636163 68650d0a 0d0a2d63   : no-cache....-c
0x000000a0 (00160)   61636865 0d0a0d0a 61636865 2d436f6e   ache....ache-Con
0x000000b0 (00176)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x000000c0 (00192)   0d0a                                  ..

0x00000000 (00000)   47455420 2f323031 35303130 352f3933   GET /20150105/93
0x00000010 (00016)   37376d79 63735f59 5f6d6761 7a325f31   77mycs_Y_mgaz2_1
0x00000020 (00032)   32303142 2e657865 20485454 502f312e   201B.exe HTTP/1.
0x00000030 (00048)   310d0a55 7365722d 4167656e 743a204e   1..User-Agent: N
0x00000040 (00064)   5349535f 496e6574 6320284d 6f7a696c   SIS_Inetc (Mozil
0x00000050 (00080)   6c61290d 0a486f73 743a2078 69617a61   la)..Host: xiaza
0x00000060 (00096)   692e3933 37372e63 6f6d0d0a 436f6e6e   i.9377.com..Conn
0x00000070 (00112)   65637469 6f6e3a20 4b656570 2d416c69   ection: Keep-Ali
0x00000080 (00128)   76650d0a 43616368 652d436f 6e74726f   ve..Cache-Contro
0x00000090 (00144)   6c3a206e 6f2d6361 6368650d 0a0d0a63   l: no-cache....c
0x000000a0 (00160)   61636865 0d0a0d0a 61636865 2d436f6e   ache....ache-Con
0x000000b0 (00176)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x000000c0 (00192)   0d0a                                  ..


Strings
 " "
E
....
...
.
080403a8
1.0.0
BEARPC
CompanyName
FileDescription
FileVersion
LegalCopyright
msctls_progress32
Please wait while Setup is loading...
ProductName
StringFileInfo
SysListView32
Translation
VarFileInfo
VS_VERSION_INFO
www.bearpc.net
*?|<>/":
\=@_~-
">!$0=
0/[1r|
/07g\dx
0&}8^'
0|{*<a!BN{
	^;0&B
[0<,DS*
0'\DxR
,0e4PyB
0e_Di7
0|e/H5
0Hfh:&4F
'0IfC',R
0JoXbGxQF
0K(~0x;
0L^?[{
.0\ldk
0L%sk:
0OC'^i
0ODJ$3=
0`PM]1k
0$+@;Q
0Qan"4
0R;7c*
~0-)rS"
0:,si:$ g
>=0SpY
0+Su$Y
~:0Uv-
0vS*Rt*
0VSttl
0w2q\\
}0>X4(
|)0YEZ
0y{t2"
:0]>Z!)
}&_"1#
15_#P(
17[h~v
1/*8rx
1a7%#R
1[.bi-
1Bl+Dn
1D9:=.
1Dr?{A
1+,D}z
1EL\3V
1_`#&g
1"GtZa&
1i?Z&[I
@1~K*P
|1o9j9DB
1r*	Hfq
1T\;=k
<1;Y9Q
<*?!2\
,201!c
20I1|vt
'20s*}<
-21 b?
$22/vHK
^23ub}
=24E)c
25`wO#sN@H
2AEV"Yw
2aM?OH
`~+2B$
2C]e("
2ch]Kl
2<C'I5
2{d3,T
)2DpPD
@2=E7j#
2{"|H	
2i<@ ]Cg
2J-ho8 
*2J(nf3
2kmRc?
2'Li1m
2mA13y
.%:2mp
2)N.bI1
(2OdJ,
2OE}4 
*2=P\3
2PLiiN
("*2r~
/2r`V'
2r@ZlX
2sMWUm
2\]UMP
@,2woh
&2[Z|	
	3[+$!:
3 1\N&C\,*U
32Az^?C
3<4?F<
3%(60%
3"]:/6y@mKG
371;)hJ
3]7q2-i
,38*&D
!@3!% apB>WO
3#Bt/,
3[d7n<Z
3dRBuUR`
3_E8 bF
3_eU|/f
3F&f}]Y
3	f{>N
3gSrw*
3IE)EOD
3JT9u1
3k,0rv
+~3&!L"1
3L=x3U
=~<~3m
$3/mDe(a`K39k
3n0G?#1
3o`RTw
3o/V6Lr
*3o{wN
3/Q0j&
\#+3S7
3SG7L)
}.>	)3t
3T%bn$E
3Uc?}Q8
3*/UHG0yiN`
-3v@)'
3 V.zY
~3W0;<@
3WCNUD
3 ,w+Ct
^3wD~4w
3!+W?F
/3Wq!OK
3%w/zw<g"
40Z5v$.&
4_58]<
45u8+]I
4']7UU
4B]L2J3#
4c\fhs0
{4"cM0c
4>C:qz
=}4e:,
4_%EZa
4g\'}1J^
&4&g>8
4?Gi3|+
#(4:Gp
4gx7*PD
_4He$XZ>e
4|IL:x
>4ixQZ
[4;J?>GM
4{Kl~3
4%mu9$E
'4n8"$o
4N>M5TXE
4N.X]h8
@4{Peg
-]}4Po55
4Pr~_ft
(4<q`-
4%qi$;
4sIXq$U
	4sm;&
4S mvu
,@|'4TK
4TUSL'9&
!'^4ua&
4u_)eA3
+4u\ZC
}4]v|F
(4v!sh4
4(#yA.3
 4{z_[
4z.0M:w
4:zDDrw
`?>{![5
.@51]U
*:][52
]+"54c
55db){dH
57j]T@
5Cd81M
`5)dugi
}5dW%U
5eWTJ_
5.F%`#
#@5|g6
5g;s)m
5Guh6HpTb
5":&hR
&5-(hz
 "5I:xt
5jg~|E
!5k:5Ih
(5LP`,
5^LXNP
5-\-m;
5=no9ywl[
5OkicJ
5oN=Z!
5.p~	;
.5q?,_
5Q|o}@
5._REg
~5RS5C
5v0K~B,j
>5|wy)
5y]E>V
;5+]yw
	)5z~i
65(EwE
^=$67l
;67wln^
>%68qV
$6@9?i
6coV3<P
6d	LxR
^=<6e,S
6#+fb^
#6F%F;C
%6fs*`
6(h*r}
6$Hs+T
&=6IT[
}6K j|
\^~|6L
6_<'n!
6_o5WM
,6q84i
% /6$S%
\6teQ,
6uHbx<@
 6V?7t
6Ve~A2
+6V]Rtm
6x;QR(
@6y3u_
6!YKC:*
70FCrE
:@7$5g
75|RGmFd
]_;76<
?77cuK
\79dB~
7[aLkh`
|7E5kPq
7E9O66
7e/g|:dSm
[]7#Ej
7FZ~\;
7<G5<@e
'7' gM
*7h fi%yDD
7%{i5`	u
7.JY>hQ
7KY?1u
7*liMk
"7mdNp
7mZ>R5
$7N,o^
7O(ff){
7*pv:1
7Qu7xlh6m
7QX5Ko
7ST9I6d
7TX[,C
7uhKOy5
7u]tUR
7<VmDq
7vMPDR6`
!7"++/&W
&7	]'Y
80Ly>L
%8[5cq
8`6g#5
87ePx+
8+8:S8~
8A{{L{
8/BwWqg
8c$Ex*o,
.	8dL%<
8<JO_zi
!8K	3%&
8k7CGn
8kco{d0
8L<yc.
&_8N?c8
8NCRCu
~ 8(O<
8QjtlDyz
8RKs]g#
8"`u!=S
8UwxabH
8v]Lx=
[8V|z7
8;{WFV
8WTt>=
|8x<QB
8y|7?L|
)8:;yEbu
8Y*uk]
8YwF1?P
* !8z^2
#=!{9]#
[9:2}$
@931nBs4V
93]a(;
95\oX}
97+mYZ
,97$WQ
9aAE93f!
9"aEA|
9B4SG-
9BHv_i
?9Bl1F
9;bYZ;
9D'?gF
_9DIgJR%,p
9>i9Z7,
9,_|Ih
9	)MmK~
9Mprt]
9N6#rO
9o<)_	
+/9Q;D[
 >9Qn-
 :9<R#
,9{Rss
9sH+>J3
9 so|B
9uL.sN
9}V~~XJ
9vZ#I	S
9@W5O%
9x!xB4
:=9]Y.e
].a~?0
(a0$*f8
A"&0Kw
a/3.(>
a||=4\
(A4!7h
a80v9e
{a8NmleZcM
%A.9qN
?aalmf%^"
 A^aqe@_,u
-a\b8:
aB%85U
,Ac{Bt`
".ADe"7
AdjustTokenPrivileges
ADVAPI32
ADVAPI32.dll
 $ aF>~e
 A@F!_e
\Af,!I.
,]\A!G
*AG~1zo7
AG8j-T
}AhIG5
aHS-5@I
"\&a<I
AI0&FZ:p5.
!a>?iF
&ai =r
*}Aj{/
A#JB)o>A2
aJ@;Gs
>AJ l?
aJ;O=1
Akc)]p
aKcZ<< I@
a|k`RW
aKZ9k-
a}l2~ 
aM>,./G 
amrY.y
A?n3~;
AO;8s2
	apf!|m_35
AppendMenuA
A$q_:]n
AQn2y	4
aQR 7i
$A{RH2@
aS4J'5
a$~t$?)Q"fX
AttppY
A?ttT(
au@29]
AugYTn\f
Av[DD/N
Aw0R+B
AWk`@m&
]/	aXq
aX[u%+
AXu|[F
b	:>-'
B!~_1R(f
`/b1W}?
 b1Zg4
\b2diZ
{;B3 .
^_B3.g
b3;#&V
B'6cC] @
B6$eaI
b%6mO/{
B8o"oaJ4
B8z<w9W*
&,*b9H
Bas][,
BAs7	Y'4v
-bA!=tz8\pl
BbgxP7&
*;Bc/s
BD=F/"8(
!bd}g(
bd(JzI(
BeginPaint
Be]W/|(
bE~Z iQ>V
;?`B<g
&}=BG{
Bg96jh
~bHkd#
:B(;iV
#b	/je
[{BKOL
#>BL|B
]BlFId
bl$<mco
.	!bmh
BmJv5$.
.b|]mR
b|ni8@
<BnQ\\f;q
\b'Nsdq
bNuVQY
~(b-O>a
Bo//b>" 
bojVW%
b/:?p'
=B,p*J
^BpK$!99al
b`	`P`OiU
B_qc'%L
Bqv[pS
';b|r-
Br=2ue
'B	,R9
b/t5	Ob
b@[tx]
b	u0AE
($BuJi
BV|01LI
-bVg.}
?&bv"%k
b	vokMe$
|bvVz^
b|vY)!T
b\,%WA9
*bw)nR
BY0h"+
b)`}-z
bz[S".
*C//^&
c<0A]^
c{:0cR
C1mbx	O	m
C(1T'D
C1trP%
c257|y9
c2Ww|r
"%c3Ju
C'4gxv
(C/ 4&}Rg
~c6E"\
c6e#TB
c9)}a|
CallWindowProcA
'cA<<=sZ
Cc65Q!
c{cM^m
C"d:drTOn
cdV-pJ
|cD+ye
ce#DgN
"C)Ey.
'C-F` A
(cfCXC'
(c/fk%
/cG-bD|+=
%cG mD
CGS~U[o
CharNextA
CharPrevA
C}hEaoW+
CheckDlgButton
 Chr~E
c<Ia68
}cI>k`
c$IX!_
cJaFL]Z5
*Ck!k{:G
c,k~l0V2
C"K!Zw?
>cl3XY
CloseClipboard
CloseHandle
%c=%lTo
cM7t8Km_G
CO5[|k
CoCreateInstance
COMCTL32.dll
CompareFileTime
Control Panel\Desktop\ResourceLocale
CopyFileA
CoTaskMemFree
cp;u>oz}F
|C^QG''J
CreateBrushIndirect
CreateDialogParamA
CreateDirectoryA
CreateFileA
CreateFontIndirectA
CreatePopupMenu
CreateProcessA
CreateThread
CreateWindowExA
CSJg\B
cTkha]
~^cT{W
.CTzT`B
=cTZV#
CuATQ 
cU_c=t
C.uLg`t
"C:vOK
CW(@*C
+c_!ww
cy	2_J
c}y|hm
{Cykh"
cZt-S!
... %d%%
<.`)D`
D$0+D$(P
!d0G1R
:*d+0;R
d2U)r}
D4C$<;
D4vTc.T
.D5k6e
d8*H;m
{Da"c$
&:d[AQ
@.data
Db@Ok)
dB'Sn-
	} _dc
	dC60-v
dcQ"RX
D+\d:0H
D$(+D$ SSP
.DEFAULT\Control Panel\International
DefWindowProcA
DeleteFileA
DeleteObject
DeN!J'
DestroyWindow
DE=TM# 
d-eZ5gU
(dgd\p
DgX3Wf
D%ht~0
DialogBoxParamA
d`i"c#8
DispatchMessageA
D'&IUr
DjstJ\
=>:Djt)
djU!Knp
d;<<k]
dk4aEp
!DK>b8
dk};"n
~d()kR
DM+(D'c
D#"-Me
DM;/&E
*%_dMy
d?)}#n
%DnMvT
Do7:|X
~d;|oKY
D$$Ph,
&#dq7b
D/qdl/d
Dq<?r'^<]
d\qvx<q>
d>R&|>
]DR2q0
DrawTextA
Dr/MA{
D$(SPS
D%TjcE
d	!tk1`
%D}tUP
)	!DUeZ
Du+LSNl
Du(Sal
[DV)^{
DW703G
>-}Dww
!DXCJ-
D"xY,2
DY[gf  
D>Ym17
dyyq$V
'DzLm6
d."z\qu
]~e[?-
][e<+`
&,=	e/
e0`$a%~C
e0 Q=s
*!&E2>,
E]2\3>
E2aO9!
e2*qIcT
e3"A~OZGY
e3atT	dT
E3H#B~
e3	VHd
E4)U{	
e5%6mz
e5c{A%
#E62_[
@e6hrL
E6)p}.
,e>7eA
E\8615
e8,It|
"e	+8x
e)^8ZxY/
e9z6-d
e!b?%{
eb0}UY
ec8fyN
E(<c O
::E\Cs
eCU)k*~
EF,#f#*
 e,%g@
;eG0UtZHmCA
}eg5[[
EG)88a
eg>:F@
_<egrb
eGY`w "
:EH4w,
eH75rR
E$_$I1
EI=NJn:E
EivQ1"-
e J.B=
Ej<l(F-<]0
|Ek89[
eld86p
 ElEXi
eLmv$wRf
]ELn_^
EM`0\_t,
EmptyClipboard
/EmZw)
{*e(N6.
EnableMenuItem
EnableWindow
EndDialog
EndPaint
E@N	Ij
e;N/\q
eo\6bC_
EO\u7@
e;p%&?
e*p]9|
(EPJ@I
e_PRm&
E.p!s+
+@<-Eq
E&q:7fu+
`E%qh%
,,-Erc
Error launching installer
Error writing temporary file. Make sure your temp folder is valid.
(E*Rt2
&e+&S|
 e[sl/
euoq=I
}[EUR$
eux`X/
eU.ZWv
eVbO-D
]Evc%1
Ev_G]8x
[e$v&ia
+evLnF^
E%vx"@a
EwJH;4
eWM0l>
e=wmVZ
E!wQ)A
E-xc_:76
Exf$DX`st
ExitProcess
ExitWindowsEx
ExpandEnvironmentStringsA
e!;Xq	[6
EYBlx/
EY#mqPa T"
)ey]N>
eYU_UM
E*~yzN
ez'5:l!m?
e<zq*Bt
e*z]/r%)
),>	{F
F0X5o,
|F1>HU
f2:)3x
f2BJs'#Rg
f>2e"o
;F#2<o
F3mT6E=
?F48$:d
f]6	z1
&F;^7ZH5q
F9d,:I
'F?9L/
_%Fa	2
F\<a#x
fBm'dw
fB['X?F_
fD)_%W
FEFG/[/C]
f+FL h
ff\t$}
FillRect
^-Fi_N\
FindClose
FindFirstFileA
FindNextFileA
FindWindowExA
F{?Iq1
FJ6@N/
\FJ-zwC
Fk3EbLJ
fk,74J
Fk/DW^
fK:Yd`
?fLe5qhhpm
!FMKj6+
f:M`U(
@F$N!jh
$fNzt"
F=o2J/
#FO-DY
>FOT}`
FPEX0\
f>pg1z
F/qXN0
FreeLibrary
#(F,rQ
Frz qY`
Fs^}]>7
f?)SmM;]
fT9<~Av
>fTF}zvr
@fu__O
{fU`O0
Fw{2>5
FWAd6v
FwY)nkt
f`x5wlKjt4\
fYC[5s
fyvC7<l
fZPgnj
*g1g=N
g1U^F$
G2T9=	
g2.].u
G?3]%g
G43lBe
(g;4=DDg
G!4-O*
|g6mFA
|G\8@4
G8%Xyb
g~ BDa
{GBIi)
gB.( R]C
G;D3=$
gdFIsI
GDI32.dll
G>Di4T
{ge0E$-~
GetClassInfoA
GetClientRect
GetCommandLineA
GetCurrentProcess
GetDeviceCaps
GetDiskFreeSpaceA
GetDiskFreeSpaceExA
GetDlgItem
GetDlgItemTextA
GetExitCodeProcess
GetFileAttributesA
GetFileSize
GetFileVersionInfoA
GetFileVersionInfoSizeA
GetFullPathNameA
GetLastError
GetMessagePos
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileStringA
GetProcAddress
GetShortPathNameA
GetSysColor
GetSystemDirectoryA
GetSystemMenu
GetSystemMetrics
GetTempFileNameA
GetTempPathA
GetTickCount
GetUserDefaultUILanguage
GetVersion
GetWindowLongA
GetWindowRect
GetWindowsDirectoryA
gEx(I&
GfSS[Z(~N
=+$GG;7
gg8<$(
g|_gaj2h
;GG>F#>S.
(gGPiz
	^g!gR
@gHcX3-
g^iV%~
gI)[X5
G\j=X,
_gKb!_cu\
>gKd, >1GPA
gL?'d7
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
*_GL>Z
Gm#XmbU
%/gn'\
&=;gNK
gnUmm&u
gNZ_$\k,
gpqCLP
Gq#?e%
 gR}fXa
}grrj=w
@_g|?s
g '$,S
G<,=S~
	GSBdt
$gT8qj
GUlj/{cm
$|gv*3}
gW5N5t
gWhMiU
G{Wk`#
gW%Ybr`
?G?:&X
g!{"X9
[G(xdJ
g$x\Wj
,-GYmC
gyv2><
Gz7ean
Gzb7%L
=GzVX\
G	zx!p
|>H.+@
H0FvP}X
[h?[0k
h0|km\`
|H0VQQ.
H"!"(1M
h'	<2 
H2q5K!_
H3	sF P
{H5=?e
<h_6%2
hA~i0~
H@(Al_)
@hA_La
'hb8I-
h!`cA@
H^*cN^
*h'+dA
HD}/@g
	He1SA
HfJZwF
h_-FKPvy
;HGM?4
hGMMcFF
HG>W)X
:\[`Hh.
Hier(p
^hIGz^$
%hII5	K
HJs{),
HK	E-16
.HK >Oc
'H+kz&
hmNHsq
Hm,y])
HN>lc:
Ho8CI2
hoB'_)
HOf\sc
H~OH0x
h@oK7S
homqXH
H{OthN
H~=|Ox
hP6zEa
^=h+PE
!HpH7?
hPj2h5
Hq4Fl/
~h/~Qn
HRu|>+b
hS08[Lo
H^SOKf
H]}|sr
h.Sw=z
H<tf/<
http://nsis.sf.net/NSIS_Error
/&htX~t
HUCFtC
,h"$V=
h v2>V
HVt2Zo4
hW7H k
H"(Wd>PY
H\W+FQO
H'"{wM
{h`"x*
hXt/]K
hy|!e.
<h]ZdV$
HZl2F0
h/z.nq
h`ZrU(
H;Zrwh
i0Bf/M
I1du1k||
i\	1j\Y
I2{e\W7<E
I3RjSk
I3^umb
i5<7UO
i/6gq4Ec
%I,<;7
>i9ZxK
Ia54"n#E
iAaNA 
IA@ejl
I	=*aR
IB	|sW"
#i.bVy}
_iC	;2
?'\iCE
/iD		_<
{Idj}a
i&DTDF
idxRCC
I=Ei5c-
IFvNuTo
_iG^#A
"/+Ih3H
ih)vb>
I=-i*C
ii\u_g
IJB]+_
i,:JlOI
iJm` b
ij`uy2
iK&4H+
iKk\3x'
iKrz>wl
)IkS0T`
IKvm!Y
i]KwWo
I_{l34
il-aJ2
IL|W"b
i,,M4F59
ImageList_AddMasked
ImageList_Create
ImageList_Destroy
iMh%L	
i)M`]z
incomplete download and damaged media. Contact the
Installer integrity check has failed. Common causes include
installer's author to obtain a new copy.
Instu`
InvalidateRect
IOA&Ha
,%I<p{
iP'I9GY
ipQh%Ij*
I-QyxP
iRichu
[/IRt*q
"irY.VSg
IS/9f-Qv
IsWindow
IsWindowEnabled
IsWindowVisible
i;Tawk
itN9zhIs
iU6#=b.
i$)ui@
iuZ5d$
I@;V:p;
	i}`]_X
IYP\F6
I;Zn75
Iz{Swx
.j/?_ (
@;$/j&
#.(J~0
^[J0\z7
j2_P1s
'J4]sfH~
~j<6$=;pi
^j7_'c
j8Hy2a$VV
J\%'8m
j8p)"&)F
J[8x^#P
J?9]=y
j9YV9"
>Ja6U&
/jA";b
\|ja$q
j'f,_(
JgT*kp
J`hBpkW
%j`,Hf@8
j}h;T}%
##Jiax
JI@Ocu
(:j~iy
j<J]d,2Qj
jJt`;e
JLyRhV
JNdF@$
J-N;Wp
JoL5T5
J^"Om#
J`op26
J}O&T+
jPds0#!
jpQNYIz,
'JQ5%Kb
*{J/qA
jqNfib
%,j{|S2
Jsa^u9
Jsm &A
>JTOo-<
Ju33Hb
Ju]J(7}
*juk.v,S^/
JUqNJ%I
J{u&V~l
jv=b5{ (
Jve{k(%
_'^JvZM
J/w|c5
j_}W,i
JWS0+_S
!}$jX0qa
Jy][_qd
<k{!-@
^k!]&0
K1oe6t`_
K:'3qF
$K5<MT
k5N-wOm6
@k<7*3
%@>k.8`N
]K{/`9d
K9{$pg
k=~/A4
KA&kB4
<KAX0>
kb4.Mh
Kbgdm"FP
Kb^z03Jv
?K%~E)
KeaU9h
:KEL9a
KERNEL32
KERNEL32.dll
KEtd&Hx`4Y
_#k(F--
Kf#'b+
k)fLZ+
kH;18a
K)	h\4s
kho.gvF
k!HR\EX
k=Htx6{
*~kHy54
"!kJ$%
k$.<jVp_
{K"kE%D='
kL'<9LK
*?KlQelW
kLW]ph
kM}@IX"G
kNmP?r
K#nT;7
KPDdSC
kp\"k<
KQbiI?)
kQ\M/t
k'\~.R
#KR;omYC
=Kr*xb
k>>-{T
;&k,tc
<k|uoy
K`u$Qm
kUSLEj
>k._v{
kv.L_G
KvP[w|
;kVyA;~j
K>}'w-
"'|K@W
\K&W./
kW2`Pt
(K}W8S
]+KWM~
&@K'X`
kx(I}^,+
KY\<g$m
+kyjf,4!
@-!Kzl'
<"}L<*!
l04Tb;
l!*1-7
L34	C[
l{,=3Q
l4w"-{
l5}"X)$
l6j;O&
L]}7o\
-.!l8'
L-81k'+K
L856[%$&:
laeN({
LA}~q7(
laxQ_)2
lb2uLmM
l;c}~,
_Lc`BL
Lc}n	"
lD]jjm
\LD!y\}4H9
"~L+e6
le+Im{
]lEO'%7
l~&eYh	
"lF``<
L&fGsP
lg1y2 e
l}"G#c
lGh+TT
lH(_;+
lH_'5Z9
<l\?*ha
L?hN}EN
>Lh!TT
lj= a?
$)LJxs
Ll7hD(
l^LmmU
,L(l`wb
"LlwKku5
"Lm33l
lmwEU	&l
\ln@cg
LnrYsrU
L[N*x%
Ln,X2'
Ln>zsG
LO"}@	A
LoadBitmapA
LoadCursorA
LoadImageA
LoadLibraryA
LoadLibraryExA
LookupPrivilegeValueA
LO/qtM8h
_l)PTXt
lq^!%\
l.+!)Q
lQ$'duJ
?LQLan
lQlnTO
LqX#4/
LrK$XGrh
LS6zxy
LsS$-<
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpynA
lstrlenA
lSyj}F{
L\tg-"
'l:(tZ
Lu2;0w
	Lu(Kv
lvA#0E
L W2VS?I
LW4%6b
LwA#3a	
lweY7m
L?_wl;
`/L$wo
|Ly^<#
lz_#M'y
~"LZoGR+l
l%ZWb2
l<&>Z]WIx
M:=*~`*1
M|+22@
$M3<	(
&|m~3g
M3go"E
	m5H.G
m6R?v	
,M{7/UV
M86Djo
'M8RF*nC
}+m*\9N
mb5m:j
MBmL@s
`MC_>;
MC_`:i
mC$r;7
#M-&d.
MD4Qeq
M'}d/o
mDyRLJ
 mdZ\"
Megi3j
MessageBoxIndirectA
|m	^Fm
mG^d1v
m?	'h8
MH#~&I
#MhyRh
\Microsoft\Internet Explorer\Quick Launch
] *\mj
,m}J`q5
m?j T8
Mkv/rd
MLZJ;A>}a
MM`dL'
m=@mUR9
mMX!e4
MN>\hs
m:nuF#J?
MnZ-WR
\.!M?O=
mOc:j"C
m?oLof
More information at:
MoveFileA
MoveFileExA
*m(P$lI
{M?+pZ
M^Q)gq
_ms\Cf
msL:GB
'M%	SU
." mT 
"{,~mT
MulDiv
MultiByteToWideChar
mV["m$
m@VvL~%.r
m.wCVw
MW"MN<
]MW[n^
)M/wp7N
M*z04>
`n:0Eg%7
N0I|L3
N1/>TS
>._#n2
}N2"eh
N2^`!H
^N2j!e,
N8f<]_
N8>k8:oX,}Z
|%n[9hqBsh
n`BG(@	
&Nbi{Za
NC@*0-]g
!%#ncS
ND(7Kv
{nd9AXn
.ndata
:nFSa"
nfu,uWg
NGIa>K
n`GjM)
NGn,Cr
NH4`37
nHuha)
:>Nh_v
N>iDno2
 NJ|ei
N.Jn-1Q
nj%V"Q.>[
njwHQrz8
Nj"ZU,
NK;CSm
,N_kM{]
><NL[R~#O%
Nm/`0G
nn\r7j+
<[NO3B
NOav_,
NO(I<~
n$}p;	
nP!Q)Eg\
NQ#9#h
NqVNEHvTV
N,R,}1
N'r/cRY3,8
 nR+G4
Nrrdm`b-
n|S57`p
]NS6WN
NSIS Error
NSp"]'p
NSr"Hoo
~nsu.tmp
#N?T6H_
N%T>B#U
Nu^4d+
n%-uE,
NullsoftInst
NullsoftInst=s
NulluN	E
~N<uRj
-N']W"1q
Nw353\R
N`W_*A
`	nXbbc
?|_nXv
=NXWEoU
NZ1 v*
nZJd`}
nZ'K(O
!NzWOr
o1PU(M6
`O64xU
O6@NfI
O7>4znN
o8n&rW
(O9*a[
)Oa*|kO(2
OaR~a6
obc4)b
|ob@m0bR
OD~4d#
(ODBL(
od_%$W
o*ezM'/
o>{F].MS
O'F QI
#OH^%^
o>HF	 2@
\o	hpW
O im2J
OK//^2wm
ol:dT^Z
ole32.dll
OleInitialize
OleUninitialize
oLftVh
(O!|!m}
+o/m3C4
oMljz{Th0{@
]oMO#	
*oM-R=
oNdLrX
$Onj96
:	oNr2
$>O@NX
OpenClipboard
OpenProcessToken
$Op[fU
	OPg>M
$OPOK`
 :oq5Ji^c
or-=)8^b!
ORL.SL/
%(os-8FS
O{[ sI"
oUH1Gx
ouMV)~
OUr*~~T
#{OWDo7
ow+#F+GuH
oWTxU-
Oxb%-3
oY^jeV
O$yvk4!C
O^ZaSi
>-/o-zf
}OzfZ$
\[o&zK
p)2rhq]
P2.t]_`
_,+-p>63R
P79PoN
P8E=^V
PaerP&
pAm=DN
_P]_b?
p$}bBl+
PB]M\N
PdA/A=
P+E=:"+
PE3Nl.
PeekMessageA
PE_l,6
&pF|Rs
Pg2]:"i
p)G53`
PGt#,:
PH2IZy.L$/qM
Pi&ROf
PJ<_q4*
p@k,2-
-"PK9f
PK_Bu`-
?Pl7oU
\*p!)lM
pOhGV`
PostQuitMessage
PPM}wn
PPPPPP
pp/@Xj
P!qoW{
)PRC=8!
]P^rYygWd
PSvSc5
PtG_|_
Ptt5{(
=p"uvg
{pW*b0
P-Y6w3
PzuB;a
	[ \+(q%(2
)Q~#3?
q\3u0}[
~q4BT4{
Q\4U:`o
q74/'+`Z
Q7c&w;
q>8HPK
Q>8i*Ni
:q8ktv&)5M
Q8TWV9B;
q9lz?1
Q9[(qD
QA/@:3X
Q,b9nU
q*Bf_{
=}q$bs
=qB"^UMjg~
qC>!$,	5
qCz#z3
q'?d<t
QE/9)o
]q]$fh
Qgb*QD
]Q_(G~B>\"r
qgx>,Ri5
qH5!^"s
qh/%Fo.X
QhN".2y
qHvpf8if
QHwr)9
QhY24x
(QiF4^
`Q	i;J
QJ7Q"U
qj*UMf
qK?&d(
q\@kl5$
'qL8Pd
~QLhCWO^
QlO@EL
QL:*#Yn_Kx:zM
QM<7+R
qM!AHtms/
q$MN	)
qNFx<c
"\qOfS
QPAMMJ_
QPs^M[
.QR=FM
QR*k-z_
q&rP=Zg
Qt+0-l5
;q%TD$
&Q=tD,
+'#qv.
q{==vD
 qv-jK,
qwJB}u	
qXFGu+
qXG;_m_
qy]lQ?
q}+yy=K
Q.Z}p=
QZ$vTz
/\%_*R
R|09ul
;r0H%j
R1J"@ 
R1	Z.`
 r2dSaO
r5`f>Q
:r6%zl
r7J{K!
R[?7oEgK
/ra5`.P
	R)A+.j
Ra t4P
*Rb9n1
&R$[bKv
~-] RC
R,C?Bj0
+rC	F1k
rD0a.>-
`.rdata
]rD+LE
rDq7 00cQM
Rdu6<Tr_g8l(
RD]y|W
r^E4y`fnZ
ReadFile
RE&"fu
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegDeleteKeyExA
RegDeleteValueA
RegEnumKeyA
RegEnumValueA
RegisterClassA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RemoveDirectoryA
[Rename]
R(E@?Y
RF)%0pL
,Rh+I$#
RH I"{
RichEd20
RichEd32
RichEdit
RichEdit20A
rJ'Xu|$
 ;r=	m
]rM17AIh
+r^o8J
:rPE4i
|R?pG	>
R$.,pG
"\RPJ/%OiB
_%r_q'
rqFIsMQ
|`|r:_R
RRbcp9g
\Rr#F^c)
RRRw3S
R<T!N&
RTwE^o
&ru#h-
R|UoOK
}^&/rv
\&rv"Et
rVZ_yu
!R]wf#
;rWJpK
R#x1j-*
rX+9 [
R@Xgl_
rX(N&n
#rxQ1,
RXXtD#
R^y^}x
$ r(Z,\
@r(>`Zc
rzf-)0}
[rZx0:wo>
&s^0@3
:s0N@>
?S3fmN
\S	4@d
S%4-T!
S"#61=
S@7Q%y
{$%|S9
}S$9!6f
SA	Ue~
s*b2A:
]~\'SBde
s_^{,B?K
	+:!SBl1
SB 	QC)
ScreenToClient
"*SDDt
.sD]!H
SearchPathA
S_ekk~w
SelectObject
SendMessageA
SendMessageTimeoutA
SeShutdownPrivilege
SetBkColor
SetBkMode
SetClassLongA
SetClipboardData
SetCurrentDirectoryA
SetCursor
SetDlgItemTextA
SetErrorMode
SetFileAttributesA
SetFilePointer
SetFileTime
SetForegroundWindow
SetTextColor
SetTimer
SetWindowLongA
SetWindowPos
SetWindowTextA
s`F,6{4
S#g_u[
SHAutoComplete
SHBrowseForFolderA
SHELL32.dll
ShellExecuteA
SHFileOperationA
SHFOLDER
SHGetFileInfoA
SHGetFolderPathA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHLWAPI
ShowWindow
sI0!RI	lO
*sI&kT
sjas*_
sjE}k"
s)jf[A
:?SJ!l
skJ5~mL-
.SL~0{
S]!L2	s
~S*L	dX
S/&mJu
)S'off
softuW
Software\Microsoft\Windows\CurrentVersion
sp:eSx
s>pfx'g>
Sp{i/j
]Sq[aq
S;Qc39
SQSSSPW
:>sQyf
s{>?R,
sr'oQp
sSU3!1d
ssz	>1
StaOole
ST:+fQ[
sT"pO1
S|"u}8
 S"VQ8
SW!`>M
*swrwH.[
sxaYsV
SxdK{4q
S'XOVj
S]X-u8
s)X&?>Z
SystemParametersInfoA
SY</{x\
> _?=t
T2W7kB
t*3dkQY
t4e[=eub
t[4M~U|
"t5\lN
T?.5o<
?t7mVs
t"7pYS
t9;k{ 
+-TA1F
T~af8Y_K7
.tA}@l
!_&TaoH
TbC	Y#
tCwG[3
Tdn'Yj?9
t%Dz[y
Te(>eE
:TF1[t,R
tfVPw5
!This program cannot be run in DOS mode.
]TIb8AG!
tieK~=-^
t/IXDK
tJk[Z$
T*J}PX)9
tk+>Iu]
Tk!V">[b
	`tL0r
]T(lvz
tMFmN4K(hiK
"Tn:UG
_^[t	P
T<P,"=
tPVZQ}
TQK95SY.
tq_ V4
TrackPopupMenu
~>t^Ry
ts84VN\i
tu^VI+
/tV~8S
_TV(DS
t,W\dS
TwZ9Kf
tYbud&
tyK+S(
&Tyz6;RR>
 TzAh;
tzO)mh9!
%"U[->
\u:1oV
u*{2~#/g
"|-u5&
\U5\a6
u&5f{yA
U|6b!1x81N
u6~`s2[
?u>8^^
~U8U-HE
;uA8:;
UAAbL%[>
UAJg*`
~(UaS%
UawF|Z
ub8W\>
U":Bmk
}?uC)F
_uCJ}Ft
UC:$rt
U~CvvfT7&
*:]uDc
u;dIhl
*Ud/S^[
UdV%Ni
U|e\ _
ue-+BNGN
uer($n
?`U*"_%f
uF 9{,	
u!~f`P
)-|;UG
UG2g`+
Ugd!O#
ugugFc
Ug'Zl=
U{@/h\
!UhAw:
u<IVVy%
%UjI7|
UjKnO<
 u{J'MW
uj w]O*
'Ukh4.
ukK\U_O
uk@W'}x
:Ul!f:
UMPsj`
|un{9<
UN9G%2}
u?OD$BM
UOqYF1Bw
u)pA	=
UP^N0?<
UPX?%sD
-upZHy
U^q0*%
uQcq#BOr
%UqZP3
u(`+?r
]U~R$6
USER32.dll
uSgm-B
U'Snc*c
&UTT_o
u~[U)$
+UUbdN}r
u@Ufq#
UuowOw
=u&}U|r
%u.%u%s%s
U	v 8uL
^UVb2}
!UV<fHh+P+7
U[ vK_
UvxI!?
U.w$CPs
U,X8(6
uxA>om
u@Xg~I
UXK:0V}
UX&,Q{!
UxQFFX
Uxya"[<d
Uyw{%C+
uZHrw[
uZ~NoT	JB
_Uz(zE(
V:0r$\
V<2DG3jh
V3\$U^*P
<}v45W
v.5B6G?7Y
=v*:<5mk
v7fSEq
%v=7S]` j
	V86R 
V~aa&%c
[Va:BZ
#V'}b^^
vB/JQ-
Vbn-il
VC;6ax
V$c%B0
V;cD(Yi2P
v]cEBf@
VC^eYE
VCF#ra
V:\CqB
v]((D2
VdK:<'
vdOUKn
VE0=Ru
VeI>G7c
verifying installer: %d%%
VerQueryValueA
VERSION.dll
-Vf5Vcb
.vF>w+
v)<gd=
v?Gs0_
vh6Mjt?L
vh\|uK@~E
}v}HV|
#Vii7Xr(
VIt|Le
VJ*U/Z
VKNj2&&
VKXveZ
V(L_)E
v<lXc|;w
vm)/PggPa
Vmq}j6
;/v\MT"Y
Vm)xD|e
vN;"36`*Ke
VN8jRBN
v{NOJQ
VN%YII
v--ogH
VPB+vO
 V#PF%
vPh6< 
V-PM}i
vPnl/+U
vq(	BxA
v{rwm(
vS='db
Vs,%E~
VSs[mQ
|v}#(tEX$
VT ++h
) %vTpfg
vuhd#e	
vvEUz8
v#Vh;+@
VW31Cz
VWI\qR
vx7r|1
vy,lcw
Vz_13K
VZ,Dp_-
+!'(w;
^W>26s
,w32iJ
w:8\~;
_`w9HVX"
+#/``W9M
WaitForSingleObject
wANiC+
<Wb~`>N
<W+bOq
wCf	N%
~wcPYkV>
{>Wdce8
W:dcSf
W\F"0Y
w.?F'@TYy
}]W|!g
/(/WG(
~Wg|=^n\7i
W\gO}X;
whk!*ezvh
WHs8{X
wj4E(]
w^kdAX
!W|Kjz?
Wl23	.
wMl'o*J
:w?m`?;T
,wN~5i
WNtQ^7
;>W.]O
W<O2.^
'*}WOS
(;wOuX
;wp!= 
|_(wp1
)W~!/>R
#+WR@e
WriteFile
WritePrivateProfileStringA
#Wr^MV
/w&SG8
wsprintfA
W{Tn/c
wU%5Ao
w=Vc$;
`W'vxo_}J(AF
W{wjPU
W_XQt	
wYpxnk
 w>}YZ
`^$w?zRl
x@,^@?
@x0WGt)!
x1{a!psHfo.
 x3Aci
X`3[,N*M
X47'xaG7
X/4?lE
x)(4Xz
X#!6{e
X6RfXM	
x7c+)%
X:@9V|
	x(9wO
/Xa,+..
X)A-1s
xA@qRsO
'X/ b]
XbhEuo
X\B'Pc
xCW!@&p
=x;=D1
[X_>e.
XeQ[Lq
;XE*Xt
x+F)+=
Xf7~EW%
\x{F[f
{XGMba
/XgS+C
XgX9ocy
X=>i!w
xJ2OSE
xk:o*T,c
]#xl9w
\x~LBoqY
xLU	!0
xM1m(t3
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>
xm|}`w(
x>NyY)r
$x+O(1
(xoB]nE
Xo	,g(p@
x{OM];
Xo].S6
xO(Z$[
Xp^gu?
X/q.!\bx
_%XR2k
~X,Rg%
xR'LZz
x,S3$PfI
xs%Oou{8
xsse,P/#
_Xs @uK
$Xt\2B"
,@xtAT
xT"aW7
!(Xt#j
X^u)-{
xvH6c@
XWb?I\
)'X$(WmG
|xx^Et
X&<xprU
xY}Gg"
XZ?^r~5
$-|(.Y
Y4cGuJY
Y5dE+%E
Y61$)W
y7h[-<>
y7zz6;z
y8b4#-
Y9iNe3B
Ya8ac5~
.yab`?
:YAJI"B
Ya{z2E0
yb ap9@
y*) *c
&}yC8rA
'Y]C=AT
yCiBUi
y{DgB^^;r
yDmbi)
ydXKGY
y*eW[Y
Y@gz>%p
`y;H K
yij@Ly
,#\yjOj
^=yJp%
y+j&Xn
YK%CnvN
YkTb|:`4-
YkY_?u
?'Ylhq
Ym)'B:
YMC%U"
Y"n+1r
_Y~N#5
~Y+NKY
YnWKAl
Y%of/>(
Yq3#q.
yQL6FQ
Y~`~=R
yr:HV!
#;YSmnR%
y	S{Ok
!]yT3M
Y)TCmS
yT;sV#
YuM$+:
YV?-22
`yvAmj
Yv@_#C
&+Yv^l
Yw##ky
!Y@wT?4
ywWepr;x
yX	A}W(,Y^
y]+#Xc
Y@XjS#
<Y=Yj<
yZ2${V
&y?Z.rx{
@%z!;-
]\Z0>]
z|:0*QP'
z1lqRc~yu
z2g<TJ
z2\,HI
$=Z5GA
}Z5qd7	
z5QOb$
Z"6r8w
 Z8]&QIY
?z`9;*[
zaBG0o
zbP0q~
zC'bpJ	
zCgy0}
Zd/J1)
zDX)d-
#ZE8oWj:p
Z<:Eg/j
Z~f+'1
z`fsyk
Zg{D=|
ZG.hLf
zGJ>}`+
zh?4b9
zh	<WOkJ
@zKC<iO
Z,k.MB
Zk`^q!
ZktW?f
zkVCp=2>
=ZlG0<&
ZM_K{+/
%\Z#n/
Z] +\n
;>zN#q
ZnZ\:~
ZO%9Y-
"zPpkV
z=^q[(>
z`q	A;
&Zq	a_9
z>qTeR
.*zRe`
Z:;*sb
zTeeQ>hW
]ztLOm
zVf(TMU
'zvK.i
Z- -?Ww
:(z}WY
#z$xg@
@z-y"&
%{Z<y$
zy33"2r9
+	ZYkN
.Z<yp 
zZ&3!4
!ZZsY\