Analysis Date2016-01-05 19:22:29
MD5433bb5463e6e5cb88f9ab93c412da2f6
SHA1b6e259b998c510ad18909340398e31352417dce9

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: c00a6d1f36404febae39f41b636ade77 sha1: 7c02d3c74c74bfbae8e84d30c6c95925e89d91bd size: 72704
Section.data md5: 2be6b593f8a658867baa31344f9be227 sha1: 25eb1a9a0854a8ef795223ca660cd1a78c363a2b size: 137728
Section.xcpad md5: sha1: size:
Section.idata md5: sha1: size:
Section.reloc md5: sha1: size:
Section.rsrc md5: 2667c6031c9a453fced4dbe0a505851c sha1: e81c8f0741f9d3d3522df6e24d8143076c83e44d size: 37376
Timestamp
VersionLegalCopyright:
PackagerVersion:
InternalName:
FileVersion:
CompanyName:
Comments:
ProductName:
ProductVersion:
FileDescription:
Packager:
OriginalFilename:
PackerMicrosoft Visual C++ ?.?
PEhash
IMPhash6d3235e6b1bff12aaa22f934972b7a70
AVAd-AwareTrojan.Foreign.1
AVAlwil (avast)GenMaliciousA-NB [Trj]
AVArcabit (arcavir)Trojan.Foreign.1
AVAuthentiumno_virus
AVAvira (antivir)TR/Htbot.A.8
AVBitDefenderTrojan.Foreign.1
AVBullGuardTrojan.Foreign.1
AVCA (E-Trust Ino)Win32/Tnega.XAXV!suspicious
AVCAT (quickheal)Trojan.Generic.B4
AVClamAVno_virus
AVDr. WebTrojan.DownLoader12.6699
AVEmsisoftTrojan.Foreign.1
AVEset (nod32)Win32/Agent.QVD
AVF-SecureTrojan.Foreign.1
AVFortinetW32/Agent.B!tr
AVFrisk (f-prot)no_virus
AVGrisoft (avg)Win32/Cryptor
AVIkarusTrojan-Ransom.Win32.Foreign
AVK7Trojan ( 004b2f9e1 )
AVKasperskyTrojan-Ransom.Win32.Foreign.lits
AVMalwareBytesTrojan.Agent.ED
AVMcafeeGeneric.dx!433BB5463E6E
AVMicroWorld (escan)Trojan.Foreign.1
AVMicrosoft Security EssentialsBackdoor:Win32/Htbot.B
AVRisingno_virus
AVSymantecBackdoor.Proxyback
AVTrend Microno_virus
AVTwisterTrojanRansom.Foreign.lits.bxhx
AVVirusBlokAda (vba32)Hoax.Foreign
AVZillya!Trojan.Foreign.Win32.47930

Runtime Details:

Screenshot

Process
↳ Pid 2524

Process
↳ C:\Users\Admin\AppData\Local\JCB\systemUpdater.exe

Creates Mutex
Creates MutexPB_MAIN_MUTEX_GL_63785462387
Creates Mutex
Creates MutexLocal\ZonesCounterMutex
Creates MutexLocal\ZoneAttributeCacheCounterMutex
Creates MutexLocal\ZonesCacheCounterMutex
Creates MutexLocal\ZoneAttributeCacheCounterMutex
Creates MutexLocal\ZonesLockedCacheCounterMutex
Creates MutexLocal\_!MSFTHISTORY!_
Creates MutexLocal\c:!users!admin!appdata!local!microsoft!windows!temporary internet files!content.ie5!
Creates MutexLocal\c:!users!admin!appdata!roaming!microsoft!windows!cookies!
Creates MutexLocal\c:!users!admin!appdata!local!microsoft!windows!history!history.ie5!
Creates MutexLocal\WininetStartupMutex
Creates MutexLocal\WininetConnectionMutex
Creates MutexLocal\WininetProxyRegistryMutex
Creates MutexRasPbFile
Creates MutexLocal\!IETld!Mutex
RegistryHKEY_USERS\S-1-5-21-3094808917-3256310808-1409756109-1001\Software\pb\h ➝
4
RegistryHKEY_USERS\S-1-5-21-3094808917-3256310808-1409756109-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet ➝
0
RegistryHKEY_USERS\S-1-5-21-3094808917-3256310808-1409756109-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect ➝
1
RegistryHKEY_USERS\S-1-5-21-3094808917-3256310808-1409756109-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet ➝
0
RegistryHKEY_USERS\S-1-5-21-3094808917-3256310808-1409756109-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect ➝
1
RegistryHKEY_USERS\S-1-5-21-3094808917-3256310808-1409756109-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable ➝
0
Creates File\SystemRoot\AppPatch\sysmain.sdb
Creates FileC:\Windows\SysWOW64\ieframe.dll
Creates FileC:\Windows\SysWOW64\ieframe.dll
Creates FileC:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\cversions.1.db
Creates FileC:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db
Creates FileC:\Users\Admin\Desktop\desktop.ini
Creates FileC:\Windows\System32\netsh.exe
Creates FileC:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
Creates FileC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
Creates FileC:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
Creates FileNsi

Process
↳ C:\b6e259b998c510ad18909340398e31352417dce9.exe

Creates Mutex
Creates Mutex
Creates MutexLocal\ZonesCounterMutex
Creates MutexLocal\ZoneAttributeCacheCounterMutex
Creates MutexLocal\ZonesCacheCounterMutex
Creates MutexLocal\ZoneAttributeCacheCounterMutex
Creates MutexLocal\ZonesLockedCacheCounterMutex
RegistryHKEY_USERS\S-1-5-21-3094808917-3256310808-1409756109-1001\Software\pb\cat ➝
JCB\\x00
RegistryHKEY_USERS\S-1-5-21-3094808917-3256310808-1409756109-1001\Software\pb\main ➝
systemUpdater.exe\\x00
RegistryHKEY_USERS\S-1-5-21-3094808917-3256310808-1409756109-1001\Software\pb\chk ➝
win[system process].exe\\x00
RegistryHKEY_USERS\S-1-5-21-3094808917-3256310808-1409756109-1001\Software\pb\name ➝
Windows Media Center Receiver Service Updater\\x00
RegistryHKEY_USERS\S-1-5-21-3094808917-3256310808-1409756109-1001\Software\pb\del ➝
C:\b6e259b998c510ad18909340398e31352417dce9.exe\\x00
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Media Center Receiver Service Updater ➝
C:\Users\Admin\AppData\Local\JCB\systemUpdater.exe\\x00
RegistryHKEY_USERS\S-1-5-21-3094808917-3256310808-1409756109-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet ➝
0
RegistryHKEY_USERS\S-1-5-21-3094808917-3256310808-1409756109-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect ➝
1
RegistryHKEY_USERS\S-1-5-21-3094808917-3256310808-1409756109-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet ➝
0
RegistryHKEY_USERS\S-1-5-21-3094808917-3256310808-1409756109-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect ➝
1
Creates FileC:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\cversions.1.db
Creates FileC:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db
Creates FileC:\Users\Admin\Desktop\desktop.ini
Creates FileC:\Users\desktop.ini
Creates FileC:\Users\Admin\Searches\desktop.ini
Creates FileC:\Users\Admin\Videos\desktop.ini
Creates FileC:\Users\Admin\Pictures\desktop.ini
Creates FileC:\Users\Admin\Contacts\desktop.ini
Creates FileC:\Users\Admin\Favorites\desktop.ini
Creates FileC:\Users\Admin\Music\desktop.ini
Creates FileC:\Users\Admin\Downloads\desktop.ini
Creates FileC:\Users\Admin\Documents\desktop.ini
Creates FileC:\Users\Admin\Links\desktop.ini
Creates FileC:\Users\Admin\Saved Games\desktop.ini
Creates File\SystemRoot\AppPatch\sysmain.sdb
Creates FileC:\Windows\System32\shdocvw.dll
Creates FileC:\Windows\System32\shdocvw.dll
Creates FileC:\Users\Admin\AppData\Local\JCB\systemUpdater.exe

Network Details:


Raw Pcap

Strings
PSSh
u2SS
SSSQRSP
=80A
h$RA
h,RA
h0RA
=h0A
Y_^[
h,<C
hh<C
TSj$h
j<SW
j<SW
j<SW
WWWWW
YQPVh
hD2A
woVW
oV f
o^0f
of@f
onPf
ov`f
o~pf
FGIu
X^_]
FGIu
PPPPP
hL2A
t!PV
SSSSS
PSj?
0Wh,
PSj?
>:u8FV
jd_Fj
PPPPP
Pf95
PVVRV
Pf95l
VVVVVQRSSj
VVVVV
VVVVV
WVS3
h(=C
hH=C
Y__^[
35|PC
9csm
h|PC
h|PC
hh=C
t&:a
8csm
hl1A
uTVWh>R@
=xPC
ht<A
hD<A
PPPPP
<v*V
h<<A
h4<A
^SSSSS
=xPC
t$<"u	3
t?VSP
Y[_^
PPPPP
>"u&
< tK<	tG
wf93t
f90u
f90u
VVV+
@PSVV
t*VV
j@j ^V
SWf9M
j@j
hL=A
Y;= \C
WhL=A
5 0A
h|=A
hp=A
hh=A
h.T@
5|PC
VW9]
_^[]
t"Ou
u,9E
u,9E
<8=u
URPQQh
L$,3
UVWS
[_^]
SVWj
RhV^@
_^[]
_^[]
h8>C
Y_^[
Y_^[
j hX>C
t!Ht
u}h EA
= 0A
_^[]
t'Ou
hx>C
_^[]
to=h\C
Y_^[]
Fpt"
5 \C
<Xt
u+9u
h$\C
_^[]
QQSV3
VVVVj
tCVV
9]$u
5<0A
9](SS
5@0A
t"SS9] u
5<0A
9] SS
SVWUj
hH}@
]_^[
hP}@
;t$,v-
UQPXY]Y[
v	N+D$
v4;5
vL;5
5<0A
tx~?j
t1SW
tSj=V
u`9]
?sjj
tPVV
SSSSS
PPPPPPPP
PPPPPPPP
SSSSS
_^[]
^_[3
%d0A
>';Em
?-.T{0b
=#naIf
;'!
#uu#
cuu#
#uu#
#uu#
#uu#
#uu#
#uu#
#uu#
#uu#
#uu#
#uu#
#uu#
#uu#
#uu#
#uu#
!Gqb
,Z=`
Z-]C;
^uSw
@{G!
|-BS5
}SCi
5coJ
T"!i
?\Dt
1F[5
ykFa
(8Q\I
3^%]sZq
$mc/
SL0.|C
Yio:
bLAj
B[iI
-E3`
 sUAl
JV34
M+<)Z
LUJR
B}gcJ3<
 z`L12
3OU[
"ec3
R7po
"WSCX[
~=\-
A	{,
}meCT
1Y]>
bc8I
'CHi
7Syfy
#uu,
SEAM
exc=
Ig/
Qi3<
._CXi'
*=-H
E&wg
wQEq
]pk=
]8dJ
E{_]
]e^O
"&3ZT
#uuz
V./J
/IN f
K,yK
g5y/s
Qzl'}7
f_|$
c-_X
A';}
hc25
%#O]
3o99o3X
M+41
D@7:^
_c="
CO;1
B	][
5c?B?b
apOyQ
sB =
Nnip
hL"V
r1c0LD
Wq0+%
f-O$
CoDO9
y/4O
<&uI
s>vc
hc25
OyQ\
ss0a
3o99o
8b<4
"5>;:
}(.z
]ScZ
ZiTDD
 u.Uk]
,p&d
AJu,aad
QyOP
pcJd
ev*wJK
\%6o
9gSU
rcf%xm
o^mA
*K+m
wMm3
O4+o01%
5> gf
q}y23qK
t#'Xq
?+wF
1!IM
QQSVWd
QSVW
<$Xf
-p7C
@_^]
=RCC
=MOC
=csm
8csm
9csm
j,hX@C
~A;L
>csm
taSV
YYPV
t)SV
Hu4j
=MOC
t*=RCC
;7|G;p
9>u&
h|~C
tR99u2
r,9Y
@_^[]
80t/
PPPPP
SQRP
jdRP
@PVS
@PVS
Wj0S
|-;E
VVVVV
=`6C
T%`6C
V%p6C
=`6C
-.7C
-p7C
u:9U
u@9U
u(9U
uU9U
SSSSW
SSSSW
@PWV
_^[]
PPPPP
WVU3
v	N+D$
tWItHIt9It
tRHtCHt4Ht%HtFHHt
HYYt
r"9U
r"9U
9M$u
<+t"<-t
+t HHt
PPPPP
u"9U
u	9p
u	9E
;9u
0K;]
SVW3
	X 9}
t/Ht
9] t
_^[]
@tH9
Unknown exception
bad allocation
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
CorExitProcess
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
 Complete Object Locator'
 Class Hierarchy Descriptor'
 Base Class Array'
 Base Class Descriptor at (
 Type Descriptor'
`local static thread guard'
`managed vector copy constructor iterator'
`vector vbase copy constructor iterator'
`vector copy constructor iterator'
`dynamic atexit destructor for '
`dynamic initializer for '
`eh vector vbase copy constructor iterator'
`eh vector copy constructor iterator'
`managed vector destructor iterator'
`managed vector constructor iterator'
`placement delete[] closure'
`placement delete closure'
`omni callsig'
 delete[]
 new[]
`local vftable constructor closure'
`local vftable'
`RTTI
`udt returning'
`copy constructor closure'
`eh vector vbase constructor iterator'
`eh vector destructor iterator'
`eh vector constructor iterator'
`virtual displacement map'
`vector vbase constructor iterator'
`vector destructor iterator'
`vector constructor iterator'
`scalar deleting destructor'
`default constructor closure'
`vector deleting destructor'
`vbase destructor'
`string'
`local static guard'
`typeof'
`vcall'
`vbtable'
`vftable'
operator
 delete
 new
__unaligned
__restrict
__ptr64
__eabi
__clrcall
__fastcall
__thiscall
__stdcall
__pascal
__cdecl
__based(
GetProcessWindowStation
GetUserObjectInformationW
GetLastActivePopup
GetActiveWindow
MessageBoxW
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
July
June
April
March
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
ForceRemove
NoRemove
Delete
AppID
CLSID
Component Categories
FileType
Interface
Hardware
Mime
SECURITY
SYSTEM
Software
TypeLib
Heap
kernel32
CreateBitmap
Error:
Error:
+H,e
!G@_
\LF2U
u&unY
ngYT
Kg)_C
AyQ\
gM#@
z'JY
\Mz<9
G{)7
Y]4?
tm~"KI
;dH!
gvi
PD1R
}E0
7x&G
fgJi
)B'@
]YyOP
	 Y.
HyH{
kUT\O
/)q_
=L/N
{b<*mD
YJe?
t+}P
)&unR
&6l:
8!f8
="b?
OD*9
IO_3
fm{k*
qB23
K-%S
=-F[5
3O	R
YH-*
3o99o3
,C+f
M+<7
ql;i
B<XEA
*nhF
N<7P
]m*w
ZiTW
	rw;
*fm{_
eh?c5
0Z=M
){w1
UC7D
	t6'
8>-4
=-@[5
hVx{
`99o3
fp-G
D@p=
3o99o3
^9m1
z;1+
qA9jU
o0aU
K{#z
N3P(
eYq7
;m2R
1){!
;A\U
$NWNu
=v|/>
I6xs=
';b
P=lD
	<o9v
P6*_
ONk'
`;bG
15=k
Hb+;
!|]e
9\$"
4D-J
$x'm
	Bk5
,Zea
;'JL
Y>2g
?_qA
{8Fy
+ms7
sh-=
	YHK
KyQ(
XKr,
KEMN
t+}P
->8b
{8m>
8^E:
N:	8[R
NyQW
2:vju4
>0cU
c56'
cpi
f]rl
[R30
QyOX
aM-'N
f;t)
QNG;"
8<iG/@]
kpq
p#&&p
X0hYl
gXZh
Ew:3Q
V H@!
ocl@
r#uu#&
T_XE
>Wi1
FerB
([OVuu
[ 0wk
0R.<
<(vmc
Ay1+
61f}
/)	Q
VkH,
5W@
.8;Z
T"Uh
;E3oShLk
YOkcq\
Zi^M
\Ke?
__H#q
fJAi
*'<
[MMW3
K.ys
]b$G!L
t_G6
Z9dW
\_Td
\_C^
3	2c7
/x(a
ab)G
qsh-=
_ra
}LEN
KEIN
-=p#
'-^-[
CEu;
D-=p
yWLYq7
/UtY
]=\6A
tKv?\
{YI0&
\^S@#
>vWf
:|#u
 sUu
\M{_
|-F[5
?	a}
"sUqfw
,WS?
]Hk8
@e5p
q<M()
@4#/aq.
Qf3%F
o07&
+|"|
-#wf
DwlA
bPww
`GKu
G\Q'
]r"P
390K7
 ec/u-
(m{k
\6I)B
uSC]5[0 i
E&wg
X/~)
c'le
Uzk=
)BS5
yb*G,
4XPp#
"?DM
>[Gn07
]S[x'
ET#n
buLw[
aCZf
 sUEl
{/D-J
K-%S
/)mw
7_Qq
>aG+
R>?hB
v3=@
]jjpd
_X*`
]Ysl
enUBb
M+45
GP0uQZT
B]DV
"WOC^Y'
^QyOX
}<Fa
$-7qYdu-
F48a
BRbG
6!#"
B{G16#O
Z9dQ
Mc!uu
a8OZA
I-UC
ii.J
K;6?S
}zS=
KRmH.:
-,]!
9np:
d3d	}
XT	Obu
SuQM
7$%G
9*w[
.cM{
YHG_
 uu#
v>hJ
&tl_r
)_LW
(D9~
BO[W
5Fc5
}2-Y}
% EqYl
R"?B
qRG~
UX"5
W!*'
]YZO
]ScxW3Pan
0??'
oB<-
0{ns/Q
!Uds-
)&$"
#wu#
mPyO
%sX]u
]Dj4
Zbz%
X}1~1
8x\#
K-%S
tc8h
=hgv
x(a4
61:/
sx]K
y=iw1
8PyQ
Je+p
3%d3h
@sG!
gxF!
&pa
f|Ji
/S-qt
X#]I
[]!G
Hdq5Hf
8{oC
_Nk7dI
23/a
	<o99o3
tC?h
{U-`
s+~!
6>u5=9
aOW>
9*KN}
1mH|G
U# A
o)p^
d8*E{s^P
V>O*
qu#D
WD)%{
gB5-
[_c
dr"R
BIbG
S.}kn
d3TXq7
<  ec
/(:x
]5k=
DWNHuj
qqqQk
m'@=
B]DV
<iIJd
*e{_V
@wr3
k"uu#
pQ$xb)
:=*j
jE[MQ
-j*w
Z+]q\
nec?b2T
S%-K
;YLc
1wkT
'=tc8h
^3]y?
N#^K
%7oM
C_)J
Adr<
{jZg
P eLtN
RMt&
WfTq7
3"+*wU8
6!#"
!G(kD
DCG-<
}#uw
PyOXA
?c0]
O9eYZ
'49&
6jlC
Hm?l
5'@j
VHXU
HOdM
VyQ\
rcf%xm
?\Dt
)]n+
+uH_+
@F@`
396*@
["r`
OF@v
a*kuu
"ec?
j'wR
_xc56'
Fwr@-#
5TB-`
-=p+
Nl5~$u
BogcJ1y
Z{^L
d3b%U
V#^u
`{UCc
9mzp
5/0a
8qG7
&y}%
h@HT
a{@V
&!4UA
;48&
e`xYG#
/@S5
Yq7
IOG3
OyQZG
l2XD
 9JR
8^+x#
OGR00
/P4>
Nk3!
A';}s
-#G9
eSs_
Q/9i
C0eU
"=*j
|-@G
]=&g}
r;15=k
ORmH'
?o.-
SM}m[7
OQE,
${A
%#o]
teTG
t!r-
e6]K
_k]Y
5c?h!
=6 O
5Bs5
-j*w`
CE}N
5c;!
7qYb
$xb)
7',v
f|Ji
v5SrA
$Wje
48)a
]4U3
'4;&
?)U	me9
V4k+
 {UU
x3j_
ElpL
#uus,
&wk\8
\/TG
99o3
iw1~*
*0W5
>Vte
+!$1
8%$x
IV F
K-%S
Av<
FCVw?
nrCM
opq
(8Q(
teTG
wf%3
ksj
O(k&
op{)
[Mu<
}yOX
cszfD.'Q
ght@
E&wc\1
r9tq
c6e`Yz:
E&rnZ1
IAw1
?{xQ
#e,n
`r%6
!<X7y]
KMymK
AO[`
ZQyO`
C?GY
g{{*
%#G7
5B	lj
A';}
	\;'
X"5<
S_),
[t'v
3*Ic
f;p9
2:q\=IkHi
dIJ!
$bnG
fvI
|-FS5
?|')
Z{^L
vi[y
S%-K
A';}s
Tpp-
;sgf}
@`=pf
t]	|
dO=p
f;v=
~W	8
C_)^
M@$u
b=QdK:
,e{S
@brs
=5G_i
"mc;
1-FH
a 3ZT
`	dq!:
?c5<
)wv1
4G=p
pcJd
|-Bi!2I?
 ec3
(m{i^R/
/A0K7
h07&
EGZ]
hv#t
Jw+~
uA)XQ
7[mi
"nkK
lpM[
-Yrj
S%-K
}<Fa
"sUA)
R"?6
`9bG
Qiwqu
_yQZ
a/wQyO^Q
+Ghf
kJ~_
_4]3
e{-m7;
}m4t
9!aq
X3]yT
q#uNT
~=:$t9
zfC!&
tN5_
9m$2
1/	d
7]fp!NU
ha6N
DOQQu
CyO8	n'
3%L`
>qGOJ
~nrM
7A4j|
T?c56*@
/D-J
	 Y.
{5c?Bs
%"ZVn
R$G.
ew1r
V;KwQ
)m>QN
U+uu
p;a/
Y{Ednh
}#e%o#u|
5c?9
>R9H
+NN%hN
[UBmh
<1yg
q7BT
` 3ZT
EK[(G
XTQNbu
uS/g
?t<AH
+4	&`7
!%6%O
q/}k
|vy7>
V.;l@
x< h`]
c 3ZT
#u^n
/vy
MNh'
 ;/6#u-
#u%r
)`T-
{)o;
GZ1G
S/M}
vj+D4#
/D-J
OF@v
`V H
IysT
:dqL
zMT;
]m*w
qyO^A
..DU
,IN `
E&w{
nKx\
r%N^
qRnS
g;vN3
L9A0
HV <?
g}/n
9c?J
qB%}
"n	B
1wRPI.
@?YJ>
V6O>Bt
P)B_)
#u%t
p6%[
y_<m=
lZ^e
opu%
Rgv0
cf< xz
 THzm
ZJz/
=-FZ
N~?f
9ghAE_
Fn6W
%>4T
bvv7
DXd5Mbu
DXY9
	%$h
cX%r
YqnhFbN
DXe9
~SS(
0FmU
r"$@
A5)^
	ULP
G97m[5
k71q
vj'G4#
dL^|
|-FR
7 iw
*m{K"
ob"p
xIY61
:Qrg
Sbw
c`q9
;9d>n
/$x(*
HGru!@
<A\~
d.pJ
rTf3
'/&>u
pl.e
}RYI
vCNIu
.np,Z5L
%Ulg
R <U
ux#uz
mT/{{
(Isk
5$3x
.`+_C"
Z8d=
	kw>/o#
+~8Q
>/}O
`W?J
*Uh%
TH]dA
_;$fq
UJZE
ezc0t
.p]X
WZ!L
(Q7:r3v"$
^8s3
j|F0
2La#;
_"5>
e*rb
@Fi5
~-dn?
":qY
%j.l
O;H][so
	)=p
[=Lk
Zzy1
>#+*x
AyWrh
R@h1x
aB^_1
4M?R
3=0*w
oc),)
< $gCKb
%n2c>
~{rZL
0?3'>}
w0G	Le;-]q
47=yNf
  Vx
qWqA
*A*'"z
|-@Z
kxeU
Oc)$
pv#(
};'APVc
7@QR
\99o3
"$n4
j6	D
1'aS
&rv;
r[N}
w"?
74%M
K-%S
?4%N
?\uk
K-%S
u`I3
j6UD
^8#%
Kg <
};'A
K-%S
^8rx@
Wbg0
3o9x
91 }Z
BDH7n
`ddS4"r
$xb)
nw`I
h>Gp
jx\< $
~P0pl
gTsw
3o9x.
bNk'
3o9x./
I?T2
Oc)$]
1_h4u
h>Gp
};'A
K-%S
C <=B
AULbu
{` i
A';}
\H8d
#uu#
#uu#
#uu#
#uu#
#uu#
#uu#
#uu#
HF!-
i5QZ]M=v1
AI*"u
-"uaq~
Imb59
WZ]Q;v1
/"ucs~
udoYv7
w#r}#
J'42g
[]-kw1
3[fa
7]dk
Quu#
[] k
>[oai
[]>kE1
}[fa
:]~k
:]ikw1
9[:aL
:]nk
PuJ#
{[na
1YA5km-$<<
-x$"
)_8d
W2"5
kw1MP
Apnbuu#
3%].N
G!V <
#uu#
dFai
?c5J
#uu#
4@Fah
;*`|
YS28
	bbuW&
C_)^8d
bh$+
A)`buw#
kw11
A2_buW&
C_)^8d
bh$)
#u]e>
#uu#
xFaK
[buw#
?c5m
G!V <
[]uN61
Q[J@
[]SM61
G!V <
|FaK
C_)q
ia7Z]
1"uu#
Clb5
UZ]/2v1
2%AE
i1_Z]
A)0"u	l~
5%c?I
myj&
IF!?
/"u)s~
F1(G
Ae{N
q7>L
	P'd
.?<T
g.<r
b/(~
P[]9k4]
t<l4/A
i'n59_
hc5!
b:9D
7q7&
u23j*w1N
n6>c"
Ju<M
f>%D
#uu#
#uu#
#uu#
#uu#
#uu#
#uu#
?c5J
+5u#
dM][
&~p\
"l&9
3o99o
*L/p
WH`0
7Sq7
^i]4
?b!9c?
#uu#
#uu#
#uu#
#uu#
#uu#
#uu#
#uu#
#uu#
#uu#
#uu#
#uu#
#uu#
#um#
c>3y*
_DY/}5f
j91tU'p
>g1<m8
i'*I
I&9^
X19W
I"9v
>g1<m8
i'*I
I&9^
X19W
I"9v
>g1<m8
i'*I
I&9^
X19W
I"9v
>g1<m8
i'*I
I&9^
X19W
I"9v
>g1<m8
i'*I
I&9^
X19W
I"9v
>g1<m8
i'*I
I&9^
X19W
I"9v
>g1<m8
i'*I
I&9^
^-%N
]*3u
1d--s>
u>%J
C% Q
^-%N
]*3u
1d--s>
u>%J
C% Q
^-%N
]*3u
1d--s>
u>%J
C% Q
^-%N
]*3u
1d--s>
u>%J
C% Q
^-%N
]*3u
1d--s>
u>%J
C% Q
^-%N
]*3u
1d--s>
u>%J
C% Q
^-%N
]*3u
1d--s>
u>%J
C% Q
^-%N
]*3u
1d--s>
u>%J
C% Q
E-pk
oD!1
/pe7
F#)"
Cw`M
Yy['
C:%M
G5=4
o{!1
/He7
6w%l
I}Cw*M
kL-EG
s	9Sw
/=57
-?;!
!;?-
75=/
wS9	s
aaK?
wCaI
ocWt
S9us
oM!1
/qe7JI
"Om@
7e@/
mq{v
ImCw
S1!#o
sl9S
@=5X
CX%M
jS9$s
MugX
o{q
e7~I
 OmH
7e-/
IQCw
1!?o
sq9Sr
S9qs
E-#k
]aK&
oH!1
MewC
C7%M
E-Mk
raKC
ow!1D
	ugZ
e7kI
(q{=
,gut
1!wo
M%cC
,5=S
ot!1
M%wC
IJ7e
CweM
r1!Io
kt-E(
LYyf'
M%{C
oB!1y
MhwC
/Me7
Cw%M
:;?Q
E-1k
MhwC
bcW)
1!So
kS-E\
sA9Sd
M%vC
Y;?S
M%wC
/He7_I
 Om@
@mOG
7eH/
dM%2C
C?%Mf
'JyY:
S9us
MmwC
~#)J
I@7eX/
CwoM
Cw%M
S9fs
wCvI
jcW)
7ep/
CwuM
kc-E<
sy9S
CL%M
W5=4
E-ck
M`wCaI
E-Fk
 Om@
c#)"
@mO_
1Wcb
Cw`M
kQ-E
Cv%M
S9ms
%ug;
e7LI
Cw%M
IACw
1!Ho
kG-E?
y;?>
'nyY{
ot!1D
M`wC|I
M-wC
Cw@M
sA9Sl
0Yyk'
M)wC
!cWN
I}Cw
fM%2C
A;?>
'nyY_
ow!10
oJ!1S
M%wC
h#)V
IuCw
YyS'
dM%2C
CR%M
@mO[
^%wC
7es/
IbCw!M
kw-E
dM%:C
C2%M
'VyYK
M`wC}I
e7@I
'VyYG
p5=A
MhwC}I
I{7e
ks-E(
sf9S
M%wC
S9qs
E-dk
e7@I
@mOK
Ic7e
IqCw*M
k=5X
S9fs
CL%M
S5=T
ok!18
IfCw
G1!Bo
CKar
8YyV'
M%sC
X5=6
S9Es
ov!1D
I[7e
IJCwpM
_Kaz
X5=@
S9ms
E-pk
od!1D
MhwCiI
hcW)
g5=2
S9es
M%wC
9ugP
lOm@
I'7e
D1!to
Ct%M
'nyY[
E-;k
/%e7kI
,)#W
[guv
I>CweM
S=5,
C2%M7
M@wC
'GyY
wCbI
]ugX
e7|I
U%wx
:Wcb
Xgux
IvCw
1!`o
@=5X
N;?B
MUwCvI
/-e7hI
IXCw
+M%{C
C2%M
N5=a
S9fs
E-Gk
9aK$
wCaI
invalid string position
string too long
bad exception
e+000
?X&eB
?Ltm
tLVv
?h6_~
37.=
?7Tf(
=\uI=
g:"(
$O1=
uXO=
1w<=
>'eH
pnJ=
Ht=c
]vQ<)8
z1}B
X4I+
|)P!?Ua0
		!=
+34?
??7;
MkK?
R_V?
9&\?
Eb2]A=
f#I=
hb?O2
H`3=
c?e2
Le?2
0h?[
2ieO=
|W8A=
np?z
)(q?
}~:f
t?,&
u?^p?o4
!9v?
GYM=
Pex?0
6K{?
E	M=
X-F=
w}?0
y1~?|"
V%A+=
4';=
q	!
#D5p
La8i
{4Wf
Ai0T
@VNQ
p4"%
P'E=
ls1=
?PiB
{^C=
n{;=
3<L=
?|I7Z#
aDJ=
>,'1D=
+NB=
?g)([|X>=
?|[{
~*L=
u!K=
?IT$7
-8 ?
.h ?
2 !?
4P!?
!y##
98"?
:h"?bC
? #?
@H#?43
Ax#?uN}*
r7Yr7=
.K="=
F0$?3=1
H`$?h|
%?uY
NH%?
Px%?
%?\9
&?~YK|
sU0&?W
VX&?
4g%6
:]=O>
#w_j
(+E
V~|_
!|.4
G"jm
6(`J
k:UG
UY =
Bfe9
CqTR;
AiFC.
?5a1
<{Q}<
hI{L[
<8bunz8
<V/>
?(FN\
<'*6
?3xj
<)TH
K<<H!
m1WY$
?#%X.y
F||<##
$x<e
<]%>
T~OXu
?.)T
zyC7
k7+%
<@En[vP
modf
floor
ceil
atan
exp10
acos
asin
log10
1#QNAN
1#INF
1#IND
1#SNAN
_nextafter
_logb
frexp
fmod
_hypot
_cabs
ldexp
fabs
sqrt
atan2
tanh
cosh
sinh
RSDS
I:\train\fourth\Release\fourth.pdb
ExitProcess
HeapAlloc
GetQueuedCompletionStatus
WriteFile
ReadFile
GetStdHandle
GetLastError
GetLongPathNameW
GetProcAddress
LoadLibraryA
GetModuleHandleA
CloseHandle
KERNEL32.dll
GetDialogBaseUnits
DestroyMenu
UpdateWindow
AllowSetForegroundWindow
CreateWindowExW
ShowWindow
EndDialog
MessageBoxA
LoadMenuA
GetSubMenu
TrackPopupMenu
USER32.dll
ReplaceTextA
COMDLG32.dll
GetFileVersionInfoW
VERSION.dll
ImageList_GetDragImage
InitCommonControlsEx
COMCTL32.dll
WinVerifyTrust
WINTRUST.dll
EnumerateSecurityPackagesA
Secur32.dll
GetSystemTimeAsFileTime
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
WideCharToMultiByte
GetTimeZoneInformation
GetModuleHandleW
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
LeaveCriticalSection
EnterCriticalSection
Sleep
GetCPInfo
RtlUnwind
HeapSize
LoadLibraryW
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
LCMapStringW
MultiByteToWideChar
GetStringTypeW
CompareStringW
SetEnvironmentVariableA
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVout_of_range@std@@
.?AVtype_info@@

abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ

abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AVexception@std@@
pjY_o
.U:G}Q
p6wP:k
N2RE
9<vC
@169
1k%$
Xx$D
{*)x
#%8Gi`
+Cj}
nwI0
bM%G>~;
19tX
`XwE
PGNf
+j{*
}Vjj
f	'I
VT@P
p\.)
A7=8lD
Fq_+d(h
W.Br-/i
o~V%@
1oQ,
2}oT
}W6Z
8 kZtT:9h,U
v)wY
RveTs
FV	3
w19L
[+d$$
XHWe
{ZIx
B>K,
rdoe
UXt{q
M/&OR
g%	<
yKZVuk
,vye
nE4S
cRi>
{y4(|
wFEt
q rK
~oB^
W-&!
.?AVbad_alloc@std@@
?pow
.?AVbad_exception@std@@
kU'9
HMXB
?Zd;
?/L[
S;uD
z?aUY
D?$?
U>c{
zc%C1
.:3q
-64OS
NKeb
wwwwww
xxxxxxxxx
xxxxxxxxx
xxxxxxxxxxxxxxx
xxxxxxxxx
xxxxxxxxxxxxxxx
xxxxxxxxx
xxxxxxxxx
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>PA