Analysis Date2014-07-25 03:02:19
MD50565512e1773270959e5a6c30742c520
SHA1b1c16c55c4efdf3e1c158f173cffc6de770a9586

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: b238c5132b1ca0acbe50325f75a66941 sha1: 7815be8bdc33e3f48d7db3c4ecbd6400abe2a09c size: 265728
Section.rdata md5: f4e860632e2bbb2cd0444c7225396991 sha1: a28cbd4cafa5692d61dd84aed33f8b2b9d6a7a2c size: 88576
Section.data md5: 673338ae8554f1f5ba1bebfba1ffb4a8 sha1: c48e01fa38adcfebea8e2388cd298f7b51234083 size: 20480
Section.rsrc md5: e4e262e1260fad98442fa661d81e3aad sha1: 80b4b834fc573e3f280a7982ff4c62362426bd9c size: 8704
Section.aspack md5: 3052cf92f580242e447a9abee3bf32f1 sha1: d0349b219b524661b58a110c7361eb0f0ad7c3b4 size: 106496
Section.adata md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Timestamp2010-08-29 03:10:47
VersionLegalCopyright: QQ空间人气伴侣
http://qqmt.uueasy.com
Email:dongdong8060@qq.com

FileVersion: 1.2.0.0
CompanyName: http://qqmt.uueasy.com
Comments: QQ空间人气伴侣
ProductName: QQ空间人气伴侣
ProductVersion: 1.2.0.0
FileDescription: QQ空间人气伴侣
PackerASPack v2.1
PEhash4be1d5863d3ab09db4596f608bc6e714bb5a1983
IMPhash67aae48b1990ff583671e5da214fd3de
AV360 Safeno_virus
AVAd-Awareno_virus
AVAlwil (avast)Malware-gen:Win32:Malware-gen
AVArcabit (arcavir)no_virus
AVAuthentiumW32/OnlineGames.HI.gen!Eldorado
AVAvira (antivir)TR/Agent.491520.56
AVCA (E-Trust Ino)no_virus
AVCAT (quickheal)Backdoor.Hupigon.geso.n6
AVClamAVno_virus
AVDr. WebTrojan.PWS.Qqpass.9982
AVEmsisoftno_virus
AVEset (nod32)no_virus
AVFortinetW32/QQPass.ELG!tr.pws
AVFrisk (f-prot)W32/OnlineGames.HI.gen!Eldorado (generic, not disinfectable)
AVF-Secureno_virus
AVGrisoft (avg)PSW.Generic11.ANMN
AVIkarusTrojan-PWS.Win32.QQPass
AVK7Backdoor ( 04c528c51 )
AVKasperskyTrojan-PSW.Win32.QQPass.blzm
AVMalwareBytesno_virus
AVMcafeeno_virus
AVMicrosoft Security Essentialsno_virus
AVMicroWorld (escan)no_virus
AVNormanwinpe/Suspicious_Gen5.CBNJ
AVRising0x553476ae
AVSophosno_virus
AVSymantecno_virus
AVTrend Microno_virus
AVVirusBlokAda (vba32)TrojanPSW.QQPass

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows Script\Settings\JITDebug ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\BSDHA97U\logo[1].gif
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012014072520140726\index.dat
Creates File\Device\Afd\AsyncConnectHlp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates FileC:\config.ini
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\qqmt.uueasy[1].htm
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates FileC:\user.db
Deletes FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012013061320130614\index.dat
Deletes FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012013052720130603\index.dat
Creates Mutex_!SHMSFTHISTORY!_
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!mshist012014072520140726!
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Winsock DNSqqmt.uueasy.com

Network Details:

DNSa.uueasy.com
Type: A
42.120.63.199
DNSqqmt.uueasy.com
Type: A
HTTP GEThttp://qqmt.uueasy.com/read-htm-tid-6.html
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP GEThttp://qqmt.uueasy.com/?rqbl1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://qqmt.uueasy.com/logo.gif
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
Flows TCP192.168.1.1:1032 ➝ 42.120.63.199:80
Flows TCP192.168.1.1:1033 ➝ 42.120.63.199:80
Flows TCP192.168.1.1:1034 ➝ 42.120.63.199:80

Raw Pcap
0x00000000 (00000)   47455420 2f726561 642d6874 6d2d7469   GET /read-htm-ti
0x00000010 (00016)   642d362e 68746d6c 20485454 502f312e   d-6.html HTTP/1.
0x00000020 (00032)   310d0a41 63636570 743a2069 6d616765   1..Accept: image
0x00000030 (00048)   2f676966 2c20696d 6167652f 782d7862   /gif, image/x-xb
0x00000040 (00064)   69746d61 702c2069 6d616765 2f6a7065   itmap, image/jpe
0x00000050 (00080)   672c2069 6d616765 2f706a70 65672c20   g, image/pjpeg, 
0x00000060 (00096)   6170706c 69636174 696f6e2f 782d7368   application/x-sh
0x00000070 (00112)   6f636b77 6176652d 666c6173 682c2061   ockwave-flash, a
0x00000080 (00128)   70706c69 63617469 6f6e2f76 6e642e6d   pplication/vnd.m
0x00000090 (00144)   732d6578 63656c2c 20617070 6c696361   s-excel, applica
0x000000a0 (00160)   74696f6e 2f766e64 2e6d732d 706f7765   tion/vnd.ms-powe
0x000000b0 (00176)   72706f69 6e742c20 6170706c 69636174   rpoint, applicat
0x000000c0 (00192)   696f6e2f 6d73776f 72642c20 2a2f2a0d   ion/msword, */*.
0x000000d0 (00208)   0a526566 65726572 3a206874 74703a2f   .Referer: http:/
0x000000e0 (00224)   2f71716d 742e7575 65617379 2e636f6d   /qqmt.uueasy.com
0x000000f0 (00240)   2f726561 642d6874 6d2d7469 642d362e   /read-htm-tid-6.
0x00000100 (00256)   68746d6c 0d0a4163 63657074 2d4c616e   html..Accept-Lan
0x00000110 (00272)   67756167 653a207a 682d636e 0d0a5573   guage: zh-cn..Us
0x00000120 (00288)   65722d41 67656e74 3a204d6f 7a696c6c   er-Agent: Mozill
0x00000130 (00304)   612f342e 30202863 6f6d7061 7469626c   a/4.0 (compatibl
0x00000140 (00320)   653b204d 53494520 362e303b 2057696e   e; MSIE 6.0; Win
0x00000150 (00336)   646f7773 204e5420 352e3029 0d0a486f   dows NT 5.0)..Ho
0x00000160 (00352)   73743a20 71716d74 2e757565 6173792e   st: qqmt.uueasy.
0x00000170 (00368)   636f6d0d 0a436163 68652d43 6f6e7472   com..Cache-Contr
0x00000180 (00384)   6f6c3a20 6e6f2d63 61636865 0d0a0d0a   ol: no-cache....
0x00000190 (00400)                                         

0x00000000 (00000)   47455420 2f3f7271 626c312e 31204854   GET /?rqbl1.1 HT
0x00000010 (00016)   54502f31 2e310d0a 41636365 70743a20   TP/1.1..Accept: 
0x00000020 (00032)   2a2f2a0d 0a416363 6570742d 4c616e67   */*..Accept-Lang
0x00000030 (00048)   75616765 3a20656e 2d75730d 0a416363   uage: en-us..Acc
0x00000040 (00064)   6570742d 456e636f 64696e67 3a20677a   ept-Encoding: gz
0x00000050 (00080)   69702c20 6465666c 6174650d 0a557365   ip, deflate..Use
0x00000060 (00096)   722d4167 656e743a 204d6f7a 696c6c61   r-Agent: Mozilla
0x00000070 (00112)   2f342e30 2028636f 6d706174 69626c65   /4.0 (compatible
0x00000080 (00128)   3b204d53 49452036 2e303b20 57696e64   ; MSIE 6.0; Wind
0x00000090 (00144)   6f777320 4e542035 2e313b20 5356313b   ows NT 5.1; SV1;
0x000000a0 (00160)   202e4e45 5420434c 5220322e 302e3530    .NET CLR 2.0.50
0x000000b0 (00176)   37323729 0d0a486f 73743a20 71716d74   727)..Host: qqmt
0x000000c0 (00192)   2e757565 6173792e 636f6d0d 0a436f6e   .uueasy.com..Con
0x000000d0 (00208)   6e656374 696f6e3a 204b6565 702d416c   nection: Keep-Al
0x000000e0 (00224)   6976650d 0a0d0a                       ive....

0x00000000 (00000)   47455420 2f6c6f67 6f2e6769 66204854   GET /logo.gif HT
0x00000010 (00016)   54502f31 2e310d0a 41636365 70743a20   TP/1.1..Accept: 
0x00000020 (00032)   2a2f2a0d 0a526566 65726572 3a206874   */*..Referer: ht
0x00000030 (00048)   74703a2f 2f71716d 742e7575 65617379   tp://qqmt.uueasy
0x00000040 (00064)   2e636f6d 2f3f7271 626c312e 310d0a41   .com/?rqbl1.1..A
0x00000050 (00080)   63636570 742d4c61 6e677561 67653a20   ccept-Language: 
0x00000060 (00096)   656e2d75 730d0a41 63636570 742d456e   en-us..Accept-En
0x00000070 (00112)   636f6469 6e673a20 677a6970 2c206465   coding: gzip, de
0x00000080 (00128)   666c6174 650d0a55 7365722d 4167656e   flate..User-Agen
0x00000090 (00144)   743a204d 6f7a696c 6c612f34 2e302028   t: Mozilla/4.0 (
0x000000a0 (00160)   636f6d70 61746962 6c653b20 4d534945   compatible; MSIE
0x000000b0 (00176)   20362e30 3b205769 6e646f77 73204e54    6.0; Windows NT
0x000000c0 (00192)   20352e31 3b205356 313b202e 4e455420    5.1; SV1; .NET 
0x000000d0 (00208)   434c5220 322e302e 35303732 37290d0a   CLR 2.0.50727)..
0x000000e0 (00224)   486f7374 3a207171 6d742e75 75656173   Host: qqmt.uueas
0x000000f0 (00240)   792e636f 6d0d0a43 6f6e6e65 6374696f   y.com..Connectio
0x00000100 (00256)   6e3a204b 6565702d 416c6976 650d0a0d   n: Keep-Alive...
0x00000110 (00272)   0a756167 653a207a 682d636e 0d0a5573   .uage: zh-cn..Us
0x00000120 (00288)   65722d41 67656e74 3a204d6f 7a696c6c   er-Agent: Mozill
0x00000130 (00304)   612f342e 30202863 6f6d7061 7469626c   a/4.0 (compatibl
0x00000140 (00320)   653b204d 53494520 362e303b 2057696e   e; MSIE 6.0; Win
0x00000150 (00336)   646f7773 204e5420 352e3029 0d0a486f   dows NT 5.0)..Ho
0x00000160 (00352)   73743a20 71716d74 2e757565 6173792e   st: qqmt.uueasy.
0x00000170 (00368)   636f6d0d 0a436163 68652d43 6f6e7472   com..Cache-Contr
0x00000180 (00384)   6f6c3a20 6e6f2d63 61636865 0d0a0d0a   ol: no-cache....
0x00000190 (00400)                                         


Strings
.^
..
.)
..
U.
..
.q
..
.
.
.
.(1
..
080404B0
1.2.0.0
Comments
CompanyName
DEFAULT_ICON
Email:dongdong8060@qq.com
FileDescription
FileVersion
http://qqmt.uueasy.com
IEXT_IDB_STATEIMAGES
LegalCopyright
ProductName
ProductVersion
StringFileInfo
TEXTINCLUDE
Translation
VarFileInfo
VS_VERSION_INFO
0)2`%3
02N[M9D
04dTBu
 (08@P`p
0<,`D]
0el/* 
0{hLD$T
-0m=N:
0*ogsw
0qa@DJ
0Svbyg_Cw
0@t/h4
:~{"%1
1^%<\9_
!1/bk	
 1EA\"
@)1EK2O
1+;FLx
1m:*/`
1pc(D:
1PF:nB
1VLG@j
1[^:Wc
1X"{<;9
2)4nXN*
27^tMx
28vVw~
2(`*d-*
2=(iQv
2?K/`t
,2lqW`@0R/
2MD	s 
2mG6BDr
[:2<Rs
2s-5/(
2u	VoB
2wa^@X
2^wBm$
2z%I[R
2Z~LKz\b
__$3:}
3222tmmm
34':D'Qs
35O30|N
3c_cS+2*f
3;Det0Y
3Em?sq
3?EUJs
3%GA3	P
""3R xN
 ##3TIo
4A{T*@
~4+ _<;D
4eZ )+J
4{E.zrV
4my(N?
4nU>'k
4O3$C.
4P7)<-
4_tTFVtp'
4UKdYQ
4x[Dug
4!-xq>
4<YJgq
:4Y[;-%w
5!04TVpv
_5}2Bbx/I*@E
52H%*Q\a
(%595I6]5
5D9Bn8zxq
5d@*K|
5@:,<E
5FF,pB
5*hZo^B
5i6paI
;5n'Ib
?5r'sQ
5{;T_p-
'+66&#c
,6^8$^
)6Ao`G
\6F-im
6GXM|b
(6.ifj
6m`t-k/
6=ogmB
6o#qo7
6,Q[8g
6Q!qkpd20
>*6}Rb%
6uk	'@
6%|XlY
6ZeE%vo
7Aj}>&R
[7BeN*
-7C[;Q
;7dGkH
7ET=Vc
7frali*
7:i2 [
!7ir!#
7oSX@GSW
7p7Z7h
7p.l*)
7U#nK!
[{7&>vj^K
7X^3^M
\8|1/.
8` 5+aU
,-;86I}
8B	e52
8f`<Wm&
8;hj)w
8J8v,Y	S
8N)8@4
8p{0{p{Po`
8\S<bu
,%=8Ua
`	8v@I
;`8	WS
8!{	x8
8]XjHo
8y3r-X-Y
$$$8YYYmdsv
91.UMqw
94]	cB
9csX7K
9EePl&
9eHPJ\
@9lv>'
*9$N\'
	$(9O/0~
9QURda"KG
9qzeVc
 9R]sE
_#9u5=
9yLVoU
9YT?$?
[9z[m]
 #'(!A
a5r2"w
<!a{8X1
a>9Vn/S
'abT3A
!ACFaj
aCW*0B
.adata
A#DDPIlH
A!DmE }N
advapi32.dll
a]e6<	
Ae7Hei'
;a"h\}k46GB
aK1lXK
ALdzgq$!
$aM #d7
an%!x+Y
,anxZ)
}Aptn6
a^&,q80e
.aspack
`|AtH%
at-Ux.?
auT	wdr(
)b:9^e
B{9;Kcr
BK~7;z
BP/6	7
Bp"Z6~m&
bsn@4-T
BtXv37yV
[-b/X[
}b$X[DQ
:"by.K
{={{{bz
b<-z?1
Bzay>k
BZG*BD2
#!b}zJ
c8fWkX
@c|9qZ
`C>	a,)
ca02|g
c=?bea	J
c>=BFL"
'ce#9*xI
cedbn?5
CEX!<7
cg)g,u
cg$K6I8
ChooseColorA
ci15t3
CJ$$Yf..vx++tv#$be
cj<Zb%
Ck*	TN
ClosePrinter
C!L;s$
clS^Bt
cM)\1:
\cmTJE
c=@n=M3
CoGI]3k
comctl32.dll
comdlg32.dll
{Cp(fj
CR!).#
CS=F+w
cU()ml
cvAc3>X_
CvvK*o
?Cw.'r
c+ZLQH
Cz[r%u
'cz;vP
{@(^D4
;d)*^6
d8By:x30c
Ddmz5k
De<g *
dei5Ee_ipO,#Xq
dGc#~_@!k
dg/P|0
<%=Dh_
dH_1fX
	dHoXoXE
}dHv\6
:d,_Jn
Dk3**q
}dKPL3@
`dlvw%
D|o%AEG
D-}S;1q
[DtI@3
d'Tk~'
DWTMy1"h
d^{(]X
dxHoW?
<<!)! E
E4N$I)$
E6BE@n
,^e*<7-
E9?Y1_
:~eA|!9
?[EaGWEL~
eBT-X=
[Ecy_;
edbU@(/c
'e'E'%7b
:E`].H
~\E!~i
|eiVMT":
<'e|Jm
*]ekc:
ELR~RV
EL:tZ!.
eP 7g`t
%E(r;`
eU9b\g
E[Vu*gR
e]&=w 
EWpxt!
Ew!w*H
EXbC+Q
ExitProcess
eX{TW-[
 f>%03u
)$f,)1/
F*4T+z
=,f5CD9
F9"0	c
Fa?iv#F
FALJa	
!f%c>y
]fdBw\
FeXeCX
fFI|>@
F^G8BF4-
FhkeUR
)FHR@#^
F?L||'
		FN44
f[`n!m
FoN%v.&3
	~Fp__
[Fqzzg
fSu{' 
)fU.@:
~fw-7E
fwhel0
f`xK#xn
F?zD0&E
G\_6;T
[G9fY!<
gbo(5Z
-gd9#v
gdi32.dll
gD-o_z
gdPgdk3
GetModuleHandleA
GetProcAddress
gG=d=R
 GGGe}}}
g>J0q[
GK>)@83
{G{O{;
Go5tB}3
gQg5/p
G|r3.53
GradientFill
g^S%vh5_
|g&uBX
g]	Ux+
gw7lw&
_,"g,"wh
GY1nV/
G@Z?8%
G~{zS@
_h0_I!
h`{0!V
\H2h;w
H3`,df
H|$4Qq*
h8MW3V
hauw9w3
h]Dt"m7
he>%!~
h@G~(d
[HGlNt
H\GUh3
H@i1p 
*h]Kun{
hl_FH,R
H NRxs
(+}H]X
hYfC"o
hY@q$\
'hZ<|=
`[HZ]`s
/"i_[<
#I1d=Fd
}i3lmMZyb
I4@@7v
I4jFBwl
I6iU$n
I9OJ+I34
IcGC! 
IcMRYdy
I+F}|V!x
I&$IPQ
I$j1)A
I;J!+,F7`
IJhZ2N
^IJWgF
IkO(t7
-!%$im)
ImageList_GetImageCount
i-o$g[
~iOqEQ
ip}NYZ
iQC~^8
IQt1eScM
I?r7ii4
irKJ:2
IV.O9ZR<
+IYjf0;
I#z'|Q
#J]=_$
:j `2v
j|%3lW
!#j-9@
}jAwp@
]j-BgY
	Jhc+\hd*
j J!Rp
)jj)WkY
jlv/y/rc
JLZ^F}o}
"JM#%\`%%Vt<<
j'NOBU0
^jN|\p
:Jn`z-
jOqg@Bj
$JPiBA
@{+JPq
jq$;cYu'
JruoGW3j
j+S:>%
/J[S-;
JS%XHW
!Jt'	OBd
J$tTZB
jU<uq?
>j(u"W
JW:{|Wk
_JxE[[
{JyNFOk
.-J[Z0Lcy
!!*k_(
\+k{)3
!k3=hO
k6%L )
k7'X->
K*8<a@NQd
.kA@T<T
kemoP7
kernel32.dll
kg"Chu
kHKHJL
KHPCdSW
klnK:Z
K]lN{)q!
"kLY%~
\'kpgkg
k~Pz	.
)kS1f^
ky;DwSi
kZgzgD
l%7~3,
l/%82|
!L8l-MAt
}*LCs^
}LE*[	
@!L(EB
lFRjeI
L?iI&~
{l<I|z
```lm)
LM617n
lmrm]i
LOADER ERROR
LoadLibraryA
LoprPo8
~]lw<8
&LXjq 
'*:L}ZtIp
<LzzoW
*M0ubZ
"m3$aZX
'`M")4
(M,-5ec
	!M^br#*,D
md_O#c
MessageBoxA
MgcT>S
M(Hrav
midiStreamOut
(((Mjjj
m=$!lV
mmg_4[
mq>t_q2IP
mq+Xsl
msimg32.dll
MTi	)2
Mw{v{6
M<<<xbbb
M})Xdi
.MY5EV
$)myF~
n.2	HC
=-Nb\#
NBCRE:
<nBGjm
~"NBH,
NbHco0
|Ncrht+
%N$dk{ _U
nEig.6
nh$n}0
N	(L,Nx
Nno7/9
NosnsC
/-NpH2
!Nrly)
>n{!rt
nrz^v^r^p^j`
/[N}U+.I
nvzGxG#G
"n^X`a
NZKqy?
O4)k(Z
ob&h!R
oBL*ojQ
O(c	j7
oC=}=r
O?`|GnB
-&=o_H\
ole32.dll
oleaut32.dll
oledlg.dll
o	,	@o
(Ope<3"
>!o"s;
?OsTnHv
ou@=b:
'^\`OV
O}VD< 
P2Y*<(
P4>okz
(pb/<1
Pb?r!&
peEvX7o
pgbn;;
_^P/HQ/
P	K9'n
P'N%iF
	P	O#)
povO37
-pPwb5[bp
p:Q &+%
P;R;S9T
~;_PtUY
pzAp=j
pZO'S(
q 1w@D
Q4C>e1
:q:Bqh
<QB%x,
qg`bpD
QIN!rQ
qIQpKx
Q&I*w;
)qKU)?
q(}M_t
Qn%CVz
*QO(vvU
:qP@5"
*qpwsd
_Q\SS]
_	_qT5
Q%~TEj
Q+~-Tqt
]QtykA
q>%|]U"x
Qu! -x
^qw3N/
Qw:t9]H
@qxmWo
r3nZT4
`+%R|5`
R C)f|(
%RcTZLC
rCZccjj
.rdata
RectVisible
RegOpenKeyExA
r^.gru1
,r&hWGQ
RJ<){zSr
|r:|>k
R:kh.@
(&RL("
R{lqye:
/\rM:N&
rNJ0!U{
$rOIm:
Ro*kl+*
r^Pd.a
R`r&Ty
rSE0kI
r#t4-c
rtbBvUY ]
#RtL+s
rUPIlm
RVO+xOtr
R@v%#r
r{x=f-
r>XK+4y@
~RzUp?
	 $'$s
S!0:Xv
s2>>Ii%
@};s2n
s4JH	t'
S^"9{i
s9jiJ}2,a]
SetMenu
|SGJ}>T
shell32.dll
ShellExecuteA
@S'	i:i
/sM2h:
+Snf@=%
snj!;Zku
s~%Q2 
Sq"l,W
_SS-	aV
SsdJj}
StgOpenStorageOnILockBytes
stHlb]0
s{>w{!_
$T\]$	
_t5f	a
t8okN.
(T9Ay,H
T:Af[%89^vZE
TaGlo`
T&C,33
`tECy\
t^FcU2
/TG:#9
/tGs-[}
#th1",
The ordinal %u could not be located in the dynamic link library %s
The procedure entry point %s could not be located in the dynamic link library %s
!This program cannot be run in DOS mode.
(t-hZ?
ti`<`_
,tlfX:
t<Lnm 
tmTckO2
T|N}|3
Tnn IN
[T<R>R
tsJn R|
tt!R"H4
"tvcDi
!~T&V^n
:.Tv?P
&t:xS#)
u0oG@[
U1s"E>
}u8=s2n
U_c3|h
$uD =>+
U$(#	e
>[{ue1
u\FZ'TP
$>uH\5
)u*+i-
uj6bk:6
.UKWM5
ULNe}|
umtv!r&\
UMxQoQ
uonis,
Urs$l_A87
user32.dll
u)SF%j
'uUC}`t\
_>UuE*%
U,uZ#sT
([v\5(
%V	}5f
|$V 63RJ
v&71['
vaAI8M
VB"ET=8
#\V:BL
VCmH*E
VecI_-
veN1O^
vf[1y9
VirtualAlloc
VirtualFree
V!iVx1h
V}L86d
vLE#s"
vNwUBj
<vOsM/
,VQ[ke
VRD#r:
,vU*WfZ/p
vWiZ+5^
vW;Qw]
Vx+CU<a
W'0<Cg
<;]w+1u
w7AY|*
W)8:1Tm
W+`9tPi_n
)W A6I
W*][c*
,,wcFh
?WD2:dVd,G
,'%}wE
wE|Wr*
@wfu2#U
winmm.dll
winspool.drv
wN//80w
w<Nez\
WP`Jm?
-w/PMu$D
 $_ wR
ws2_32.dll
*\Ws[6
*W]}Sn
wsprintfA
<%wsQ+
W>t;mn1a+
Wt^{%o
WVW<	-
Wy]}B%]RS#
W&\/zK
x)65DQ
=x6&rPM]
X^~8wS
X +/A7
'xCtNkD
#?xH8o
X~(_hi
'XHLiX|O
Xj3fo?O
 xlN<5b
.]Xl_n[Km
XLSJ(2
xmrP*%3O
xmw-oM{
xqe=wM
x+r3t$
*=#]XS
Xs	.U@
XtQc$-c
Xxg6-}e
x"x~Gf
^![xY=Z
"Y{[,.
;Y0Az'
$ Y^,0e
{-	\y2T
Y8,0GL
y9Ujfw
y?bw8 
yJjcLc
YjxLN*
ylvMdF$3
YQ$t2r
yR`Yv:)
@Y's#KK~EZ
}_@]Yt7
y:)`@*Vj_
yWqF1x
y=Z20T
];&%z!
z<3233
z5<{v/gJ
zbs;V5/
Z+.d1d;7
ZD89]<N0
ZeISm3
Z*k \h\
.Z#m)G'
z}Mw-6
_zr5~%
'z[rT,.D
Zs"g,-
ZSv w$Eq
Zsx)hBR
z%[V3N
^-ZW$q
z/(_X|Z
*?ZzLG&