Analysis Date2014-04-23 20:53:51
MD52d2bbfb4934eca4268d6adb6cf74e420
SHA1c75065e45c3b77831606789c18920b938e3875f4

Static Details:

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\Administrator\Desktop\CONTAPRIME.url
Creates File\Device\Afd\AsyncConnectHlp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Winsock DNSgoo.gl

Network Details:

DNSgoo.gl
Type: A
173.194.34.169
DNSgoo.gl
Type: A
173.194.34.174
DNSgoo.gl
Type: A
173.194.34.166
DNSgoo.gl
Type: A
173.194.34.160
DNSgoo.gl
Type: A
173.194.34.163
DNSgoo.gl
Type: A
173.194.34.165
DNSgoo.gl
Type: A
173.194.34.164
DNSgoo.gl
Type: A
173.194.34.168
DNSgoo.gl
Type: A
173.194.34.162
DNSgoo.gl
Type: A
173.194.34.167
DNSgoo.gl
Type: A
173.194.34.161
HTTP GEThttp://goo.gl/HzjJkR
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
Flows TCP192.168.1.1:1032 ➝ 173.194.34.169:80

Raw Pcap
0x00000000 (00000)   47455420 2f487a6a 4a6b5220 48545450   GET /HzjJkR HTTP
0x00000010 (00016)   2f312e31 0d0a4163 63657074 3a202a2f   /1.1..Accept: */
0x00000020 (00032)   2a0d0a41 63636570 742d4c61 6e677561   *..Accept-Langua
0x00000030 (00048)   67653a20 656e2d75 730d0a41 63636570   ge: en-us..Accep
0x00000040 (00064)   742d456e 636f6469 6e673a20 677a6970   t-Encoding: gzip
0x00000050 (00080)   2c206465 666c6174 650d0a55 7365722d   , deflate..User-
0x00000060 (00096)   4167656e 743a204d 6f7a696c 6c612f34   Agent: Mozilla/4
0x00000070 (00112)   2e302028 636f6d70 61746962 6c653b20   .0 (compatible; 
0x00000080 (00128)   4d534945 20362e30 3b205769 6e646f77   MSIE 6.0; Window
0x00000090 (00144)   73204e54 20352e31 3b205356 313b202e   s NT 5.1; SV1; .
0x000000a0 (00160)   4e455420 434c5220 322e302e 35303732   NET CLR 2.0.5072
0x000000b0 (00176)   37290d0a 486f7374 3a20676f 6f2e676c   7)..Host: goo.gl
0x000000c0 (00192)   0d0a436f 6e6e6563 74696f6e 3a204b65   ..Connection: Ke
0x000000d0 (00208)   65702d41 6c697665 0d0a0d0a            ep-Alive....


Strings
...;.+.].-...$
.
.
C
.u.g
t
.
.0.
.
.
(
.
.|8
..>
.#e
.W.
.
H.
.
{8.c
.
Z
<!
...H
.p...
#'..GC.
I
...p.
..%...
,.P
..X.k.
.
.
,.
.
<.
..
".].
X
...
..
.....;.+.].-...$
.
.
C
.u.g
t
.
.0.
.
.
(
.
.|8
..>
.#e
.W.
.
H.
.
{8.c
.
Z
<!
...H
.p...
#'..GC.
I
...p.
..%...
,.P
..X.k.
.
.
,.
.
<.
..
".].
X
...
..
..
041604E4
1.0.0.0
333f3
Arquivo Solicitado
BBABORT
BBALL
BBCANCEL
BBCLOSE
BBHELP
BBIGNORE
BBNO
BBOK
BBRETRY
BBYES
BLUEGLASS_BUTTON
BLUEGLASS_CHECKBOX
BLUEGLASS_CHECKLIST
BLUEGLASS_PROGRESSBAR
BLUEGLASS_RADIOBUTTON
BLUEGLASS_SCROLLBAR_BUTTON
BLUEGLASS_SCROLLBAR_TRACK
BLUEGLASS_SIDECHENNEL_BAR
BLUEGLASS_SIDECHENNEL_HANDLE
BLUEGLASS_TAB
BLUEGLASS_TAB_LINE
BLUEGLASS_TITLEBTN
BLUEGLASS_TITLE_CLIENT
BLUEGLASS_TITLE_LEFT
BLUEGLASS_TITLE_RIGHT
BLUEGLASS_TRACKBAR_BAR
BLUEGLASS_TRACKBAR_SLIDER
BLUEGLASS_TRACKBAR_SLIDER_V
Comments
CompanyName
DBEDIT
DBGARROW
DBINSERT
DBMULTIARROW
DBMULTIDOT
DBNAV_BUTTON
DBN_CANCEL
DBN_DELETE
DBN_EDIT	DBN_FIRST
DBN_INSERT
DBN_LAST
DBN_NEXT
DBN_POST	DBN_PRIOR
DBN_REFRESH
DEEPBLUE_BUTTON
DEEPBLUE_CHECKBOX
DEEPBLUE_CHECKLIST
DEEPBLUE_PROGRESSBAR
DEEPBLUE_RADIOBUTTON
DEEPBLUE_SCROLLBAR_BUTTON
DEEPBLUE_SCROLLBAR_TRACK
DEEPBLUE_SIDECHENNEL_BAR
DEEPBLUE_SIDECHENNEL_HANDLE
DEEPBLUE_TAB
DEEPBLUE_TAB_LINE
DEEPBLUE_TITLEBTN
DEEPBLUE_TITLE_CLIENT
DEEPBLUE_TITLE_LEFT
DEEPBLUE_TITLE_RIGHT
DEEPBLUE_TRACKBAR_BAR
DEEPBLUE_TRACKBAR_SLIDER
DEEPBLUE_TRACKBAR_SLIDER_V
DLGTEMPLATE
DVCLAL
f3fff
FileDescription
FileVersion
FONTCOMBO_DEVICE_FNT
FONTCOMBO_TRUETYPE_FNT
InternalName
LegalCopyright
LegalTrademarks
MACOS_BUTTON
MACOS_CHECKBOX
MACOS_CHECKLIST
MACOS_COMBOBOX_BUTTON
MACOS_FORM_BACKGROUND
MACOS_MENU_BAR
MACOS_MENU_SELECT
MACOS_PROGRESSBAR
MACOS_RADIOBUTTON
MACOS_SCROLLBAR_BUTTON
MACOS_SCROLLBAR_TRACK
MACOS_SCROLLBUTTON
MACOS_SIDECHENNEL_BAR
MACOS_SIDECHENNEL_HANDLE	MACOS_TAB
MACOS_TAB_LINE
MACOS_TITLEBTN
MACOS_TITLE_CLIENT
MACOS_TITLE_LEFT
MACOS_TITLE_RIGHT
MACOS_TRACKBAR_BAR
MACOS_TRACKBAR_SLIDER
MACOS_TRACKBAR_SLIDER_V
MAINICON
MDI_CONTROL_BUTTON
MENU_CHECKED
MORE_SCROLLBUTTON
MSGDLG
MSNPOPFORM
<<<Obsolete>>
OriginalFilename
PACKAGEINFO
PANEL_BUTTON
PREVIEWGLYPH
ProductName
ProductVersion
PROTEIN_BUTTON
PROTEIN_CHECKBOX
PROTEIN_CHECKLIST
PROTEIN_FORM_BACKGROUND
PROTEIN_PROGRESSBAR
PROTEIN_RADIOBUTTON
PROTEIN_SCROLLBAR_BUTTON
PROTEIN_SCROLLBAR_TRACK
PROTEIN_SIDECHENNEL_BAR
PROTEIN_SIDECHENNEL_HANDLE
PROTEIN_TAB
PROTEIN_TAB_LINE
PROTEIN_TITLEBTN
PROTEIN_TITLE_CLIENT
PROTEIN_TITLE_LEFT
PROTEIN_TITLE_RIGHT
PROTEIN_TRACKBAR_BAR
PROTEIN_TRACKBAR_SLIDER
PROTEIN_TRACKBAR_SLIDER_V
SIDECHANNEL_BTN
STATUSBAR_HANDLE
StringFileInfo
TFORM2
TFORM3
TFORM5
TFORM6
TFORM7
TFORM8
TFORM9
TFRMMGR
TFRMMSNPOPFORM
TFRM_NAVEGA
TLOGINDIALOG
TMAINSCREEN
TPASSWORDDIALOG
Translation
TSUIARROWBUTTON
TSUIBUILTINFILETHEME
TSUIBUTTON
TSUICHECKBOX
TSUICHECKGROUP
TSUICHECKLISTBOX
TSUICOLORBOX
TSUICOMBOBOX
TSUICOMBOBOXEX
TSUICONVERTOR
TSUIDBCHECKBOX
TSUIDBCOMBOBOX
TSUIDBEDIT
TSUIDBGRID
TSUIDBIMAGE
TSUIDBLISTBOX
TSUIDBLOOKUPCOMBOBOX
TSUIDBLOOKUPLISTBOX
TSUIDBMEMO
TSUIDBNAVIGATOR
TSUIDBRADIOGROUP
TSUIDIRECTORYLISTBOX
TSUIDRAWGRID
TSUIDRIVECOMBOBOX
TSUIEDIT
TSUIFILELISTBOX
TSUIFILETHEME
TSUIFILTERCOMBOBOX
TSUIFONTCOMBOBOX
TSUIFONTSIZECOMBOBOX
TSUIFORM
TSUIGROUPBOX
TSUIIMAGEBUTTON
TSUIIMAGEPANEL
TSUIINPUTDIALOG
TSUILISTBOX
TSUILISTVIEW
TSUIMAINMENU
TSUIMASKEDIT
TSUIMDIFORM
TSUIMEMO
TSUIMESSAGEDIALOG
TSUIMSNPOPFORM
TSUINUMBEREDIT
TSUIPAGECONTROL	TSUIPANEL
TSUIPASSWORDDIALOG
TSUIPOPUPMENU
TSUIPROGRESSBAR
TSUIRADIOBUTTON
TSUIRADIOGROUP
TSUISCROLLBAR
TSUISIDECHANNEL
TSUISKINCONTROL
TSUISKINFORM
TSUISPINEDIT
TSUISTATUSBAR
TSUISTRINGGRID
TSUITABCONTROL
TSUITHEMEMANAGER
TSUITITLEBAR
TSUITOOLBAR
TSUITRACKBAR
TSUITREEVIEW
TSUIUNCONVERTOR
TSUIURLLABEL
VarFileInfo
VS_VERSION_INFO
WINXP_BUTTON
WINXP_CHECKBOX
WINXP_CHECKLIST
WINXP_COMBOBOX_BUTTON
WINXP_PROGRESSBAR
WINXP_RADIOBUTTON
WINXP_SCROLLBAR_BUTTON
WINXP_SCROLLBAR_TRACK
WINXP_SCROLLBUTTON
WINXP_SIDECHENNEL_BAR
WINXP_SIDECHENNEL_HANDLE	WINXP_TAB
WINXP_TAB_LINE
WINXP_TITLEBTN
WINXP_TITLE_CLIENT
WINXP_TITLE_LEFT
WINXP_TITLE_RIGHT
WINXP_TRACKBAR_BAR
WINXP_TRACKBAR_SLIDER
WINXP_TRACKBAR_SLIDER_V
<>:.#%
 !"#$%
_".:' 	
.\"%-`
"""""/
]`~)):
&{'|},
)\0,::
-0-(0%()(
020611104639Z
 %0.2d	
03@VQ`$Wk
06tTY2
079:BEchgom{
@08:~y
090303125356Z
`09" V
0;BR$-2
0D0g2 
0\Det\
&0$E,N
0eQL;@?
"[`0eR
0 'GFeKe#
+!0I8/
0kR>t_o?
[0! Kt
0Lb-yO
0$_PXR
|/0qqaqw#
0r=<9w9i
0""RG`
;0u[cda
0UE.O6"
0$$@(y
%^0	Yu-
}?11,1V.
'127.0
130805055316Z
140404170702Z0
140805055316Z0{1
14?<8,*
@1.8+f{b
#18N%@
1[C4Z]
$ 1e)n
1$h0'`
1hO7l50 /9
1oqom<
-+1vFc
1vq,xp/
"1w$}4
1~X0Xw{
?1+}Y'\
1y$m:Z
 2001,
22q#7z
2"3` &:C'
240303125356Z0x1
24h'l#
'2699640**&#
270611104639Z0>1
2740wO
2C`"(8
2{CC1<
!2CTevy
,2CW6Z
|2Dv*`
2EBgmszz
2{fG*[
?2gBrTm!H
2 H`[@
%2@[	K/f
2MCM13
2 Mik2
2N6/P2x
2)O1Pod-
2p7}{P%
)=2tnrH
2$UO"+
2^w=A6;1
2WS2StubO
;2w;;thsz
34567890ABC
358-B4D1-16
35GYNE
3D(;P5
3	El#p
3_f*=<
3'GH"HG
,3)" haKeJK13.)
3J2U)'Q
"',3LN
3RZbv y
3"|T2^D
3to4Vh
3w{X{/zw'
 3X5Q5O%
3X[E42]
!/`/`/4
4~"]2+Q
43\oH@
\48PnR)
:4ai#:n(
4a'"XJL
4BD%s[%dd
4""C['BQ
#@4%Fa,-
4FromSt*
,4JYaC y$#l
?[?4*}l
4L!"9<
 4Le a
4mDdpp
4MS&@H@H
4nCJ	tT
4$nKWr
4P%7Tg3X
4r+"182I
4tSqu;
/4vP'-
4vZd15
%%4]xbI
4zNER=vn
50sBy~k
>51^Bc
;*5,2'
*53&8&(
#5AQub
5C~}~\
[5;f05
:5gf:<86?>
.5{{i%
`5IP3U
>5Jgu>
5{v`fK
$5(W7N
5zV&(^6
	6?=&.
6)2=r$
>66J~d~.
6A#?C\
6<'Aj!
6cjt_9
/,.6	Fk
6foh4	
6keZW1&
+6,:>L
6L9T-=
6NfY	4
 6oP:\k
6-)/Ps<k
/6pV~a
!6q43]%
(6R%H?
*6tw7-
6tw".:B
6u;Ayt
 $6Uz0
@6W+u$
6!Z5YBL
7, */*/&
<700,?
[7*,(+4
7566nlg
#&'7'61
7%7H%H
`/7&C!HA
7Cqgmpc
7%_Dn'
7+ePQm
~7h%H7vP
7Jmc@:9
7M8zVn`a
7n5pEa
7QGL><G|
7.%sZ'
7WF+x$
=7-$?z
^86f$^
87 [dFL>
889DF117
[898(0H
{]&8B`
8BB9bG_f
-8C]ozp0
,8DP\hy
`@8e\P.d^
;8e[pDp
8,fk<dm.
8H[Lj';
8?IRXb
\8J7LU;!
(^8nwR
8o_D:0	
8p9t9xi
8\p"q7
8sm|s!
`8\u=*
8UOYN9F
8,<`UY
8wt,F(
9048547C23}'=B
9.0YXW,R*N
':91E5
9567[>
96&]#?(
;=99@*
99(9:770
99j7dzGWS
>_9CC-
$\9gpB~W
9Hp{d2
+9iP$8tI
9iX\\d	L
9l`(zPlmt
9 q3h 
/9T+Wx
9wgkX@
_a`+/0@0PO
a0NHG;
a/3.0 (c
A,4WR3 /
A5-ty0
A5tZ\T@
}A6RC^g
a_7IE(AL({
^A7>_o?sx
A7WQoFD
@A8A:=
aah{$~
`AAk}aB
AA>n.@'A4
Ab)EL/
>:ABvh5Ck
]"a%[cbJ
A>C@~n
AC{/t6Y'
advapi32.dll
a_^^eUJ
AFECd@=95
aflt=pc01Z
_-A?F{y
a{GUF/
`#!AgZ
AhotoL7
a	]IB[
aiP_UY
/(A@";#>j
akAPm`:
A,%LD*
+>A*LH
	ALL:!ADH:RC4+RSA:+HIG
A?LMsgI
AlOW@Q
@:am9q
A?MBJJK
ANSI_CHARSET
A<+o[0x
A"O{o-
a_OpO_8i
      </application>
      <application>
aQA.RGBlH
;ar/AprywvZ[A
As<gK+
"aSj43pK
</assembly>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
At$chT-
atJaFeb
At!R)@Qla
a'u{Op4
Auto-Dy
avP#D0
_\;awpou;i4
@AW<]yXq$1eX
 Axe^$
$/AXVA
-++={b
*[}b*.
b!1|Sc78 ;P
B3>A8Gp
`b6A`S
bA2"(D
B:atV%"
 BBDEROn
?BbPg}
BC/)#A9
b'.c&g,4
BcI%O1
Bdos $u
{++bdTo
bF	brX
bF*E	>l)
BFP\_fq
BG;$),,:D
BH0QdPR
bh#aRpGMc!
bHhqlh
BJx2DB
bK55Kb
BK[6$i
blu$=&
blyvtVkkn6"2AB##%$#A1@.
|B= ^m
),:BMGR=6w_
bM'OUf:
bO Id0
Boolean
BO+'PP*C
Boross&
box_sk
bqo\[J
b\R\aP
BR SOFTWARE LLC1*0(
brsoftwarellc@gmail.com0
B'<%sp3
B	<sz$
>BtnFU
BUTTON
B>%v}$
bVDcAs
BV!	EQfw/"
Bwvclt.K
bX^IAdo
#+By cPx
by^	#JdBP
'B^y&y0
b[z:	8egul6
;<@~c?_
 @C>0>`
C4ED78
c''5C`
)c*5)t
'C9hBL=D
C/BA@/
cbUJdf
c}	cdNSKX
c[cNL<
CCx70$
CcZ!pW
(C/^!E9
	Certum CA
	Certum CA0
Certum Certification Authority1
Certum Level III CA
Certum Level III CA0
	C^`@hO?
CIGHEG
cipher_?.
_{c,.iuO
Cj%7S~W
Clo9$C
$cLObbK
_%+) CmDEpsMOab	
cm<I,)
|*CODE
comctl32.dll
   </compatibility>
   <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
.C*P?2
?CPB\b@?6
cPtr%.8X
"cQ[t-
;CREATOR: gd-e
CTEDUIG
CTOVEC
C,	TWP\Aq
	$;CUh
cu<Zlr4
C?VA=N
cw9Lh	
c,wPL5
C<xDf)
c>x|H~
Cxk_EAD 
C){X<W
-cx;YX
CY8,u>
!cY+Lj
$'#  &d"
D>)+|/
d00B_@~0
".d07p:deL
 !d!>0d
D*0_`$F
d0IfNo%C
d0sw".;Fe/1>
d{,0zfuO
d11#c#
-;d2/.
d4Sh|KR>Kl-
d5>794+8]H
D6ABIv
.D6b$DG
;^d9d-.
d9Uo6N
\dB]@'`
DbHg9b#S
DB/:=XhC
D$CW!=
%?DDA?L
_.dDjfl
(ddx8T
DEaLW-	
&=@?<dehjkm?
Delphi\RTL
dfjSDFrt
%#=df<z
dhh'MW
\dH.H~Z
D!HHZ`P-t
@#di"_
D(i40h	
DISCARD
DJgnZ]w
$';DL(0 v
DMRRN>1"
dnifEr"Tk<3
DN*q*s$N
DoK+b#
}do)<]r
Do"rZr
d>p0BX}
(dPAv;r
d)p*V`
D:<SB3
Dw`5eF
d[Ww'qQ1
dXS@Q\Eihl[>J
dY1(*Y*
D@.Yo*
dYPKL=*A
_E;@ 1
E<2OjTM
E>*5"*
E5d8Lc
&-E6^G
e8FHd4n
\E9eKPau
EAbort
eB`/~b
E|C	8J
Ec}s}e
edhuFri
EDHURI
EDivByZe
.E,E,,
ee6hhP
e ecW-J=?S
,EE>>L4[2
E_E`pXEv&
>_EEvw
E{Feo$
?^EGGiG
EHeap]yr
EH(Tm_
>EI]Ldns
 $%e`K
Ek^QsF
=EKU`ejqy}
em 'Avan
emD<\s
Enco2X
/en/EULA.php
~enl,`
EOutOfMemjy
E';P8u+>A`
eP^`W8
EPy?w=z
e`QULi
E$t(;tt
~ETXu.0q'
eu cM"4
)EV@6,Of
eWh>,Zw
E_$W"w
	Exception
E/XE8\
ExitProcess
Exxt``
_EZ;vd
f}%!$!
f`0gLx
F4IR[{
f-#)59R#
f5(i_l
-$FaS0
F>C4~Ank
fC)~D!
[^fCfbD
f_c uLl
+FCVT/
__"FD&
FDA#Qlst
f/dQ>F
FEB/MARAPR
f#eG]$C,o#k
):Fe.[= ?L
 $(FFFF,048q
!F$(Fo
Fg%s_%d
F`H&yx
;FIl3 
,"Fixup6
fj2^BW
F*JQJe
]fJ\$v	
FkZn]S
_%f@Lc$R
FLL\L|
F-.Mb+7
FnS:w`
.Fo(<!<
FocusDefaultPHotLigh
]f[pk'xx
FPUMaskValu
".:FR^
".:FR^e
:FR^ez
(F{sBrr
Ft?Htb
ft s.u
+)FU;\)
"FUa>Zo9r
f_$W" 7
FwpfoA
fx|u/k
`FXvoUh
f^X&]W
FxY1  
:FYe]`
@FZ3g+~
G0;,Nh|
g1tz W
 G2<4C#nP
G3DDklp
g7	L	n
G87Z!{=
GB2312
 G+&BR
gdi32.dll
gdOYZrpqq
GERENCIADOR DE
GetProcAddress
GET SO
@GFR50
Ggo+K1i
GHZqWLGJ
GIKIG6X{
gjpqw9
.gl/NMQv
`Global
|gN^}-
Go[CgO
][Go*I
(goP`A+
gP5Y6#
gQRkTUpX
GREEKQP
:GT(~9F
Gt xx'H4mX||W
#g?wq9
GYtCTb`
gz7'+ m
gZ}h=R
<<#h(_
_/&/@h
\&[[=H
\H{,)($
[(\h~0
"h0Z_'0
H&4L"YG
H4 nda as
H4P,YKB
h4ZN3T
,h8=?*'
h8IOpl
_ hb	#3R
H=@^bd
{h`BOS`Q
 hb:#u&
?)hcpM
hD+0C Y
H+dH*TH
h>/E@c
HEDITDu
HEG+LBy
{@!Hel6
he$VaU
_he'yHL
HF+ |?LP
H=fouuf6
HfUQo	
>H^`gR
HH":"NN
Hies?g
HIFTJIS
HiSg_,R'
H^iWq||
HJ%NHJ
*<Hj=Y
H@kDX 	
<h?kGWR
h>|	l>
\HmdV5
hn28IH~
H?}?NLS$6
hO*@a+
'hp0ORM]bbm
HPsQd)
HP;t@IT
HQR	dCE
<Hr(2Vg
h,s@)5hwwO
H/@s<H
'HSplit
H_#SUw
HTCum=
%=HtNm
http://crl.certum.pl/ca.crl0:
http://crl.certum.pl/l3.crl0Z
http://ocsp.certum.pl0'
https://www.certum.pl/CPS0
http://www.certum.pl/l3.cer0
hu}:M)
\;HUps
>hVf2tRR
Hv lz\
Hv!=pfL
Hx5e4(
hxCE)P
(<HXly
(HxQ#G
h]YzhAoFYz
i.	1?wM
i@<2aN$
i`2K'^
,I%4	x]
I6<<Xt
i88<<@
)i*-8d
(I8]jW
i8K3	3
&i<9	P
iAAO`-
i]aBCH
 I!b%,
(IBQ8{
icobmp
ID\{4AA46D49-459F
_	IDispatc
%,i=dL
IDlgz3
IEC6\66-2.1
I$eger
ie"nQU
*I ERa
ifigBF
i`Gq#1
Ih;J4u
IIEJ;Y~<
iJI{2Ap
IJKLMNO
ij-RmBy
@&IJ>X
iklUVXY\
I;(LeI%0
ImageList_Add
ImeIdB
 i<+NCB
I[>^Ni
InPlkp{
IONQidE?
IPersis=
ipS4F:
ISPLAY
isRrS(
IuIB@VK
Iv4\`p
<IVdq+0
ive>NoAcc
:I)V--((%% !GY8
 ^iVh=xm
IWWDDQ
%'iwX.:p
i/%@.X
IYrd(Y
IZGeD\T
I/zOeo
J;0Np%%
;J$1)`{
-<-j75V
 JahBUG, a
JE3sA%
JeNjrhNMGD>
\J/F[D
)?j{=g
	J[H(E.
J`hga	
".jH`w:Fe
>jKr9D
#jL0-1
JL08#:
jllhMch4
Jn@PJL
!J+^o? 
j$!P("H
JR0P4RN6O@c
jR}6Cz<= ?K{
*]j:\rH
$>j)(S
JumpID
JVfx")
*j^XhM
*jx>Q#
J< Y8m
%k1s,Q
K[{2i6&S
K3?UnknowDeci<L
&;K>:AB
~K'b7YVD>
KBeg@T/W`
k'(D&%S
KEEP-ALIVE$[
KERNEL32.DLL
keysK<
.:KFejcw
@,|?kg
\K|.IG
>k]:]JS
Kk"`2Q	uj2.d
klmnop
KM]$A":
"k/NsH/
k P=D@
K\P/L%
k;r!#G6
KSa`!&
kS-coK$
K's@(QK
k:v\;a
/|Kvv\
k!WB0 
k/x8"!/_s
~KxI[)
^K&zoh
l!0DIf
l0,m#Jw
'L3'L3'L
-L:	98
l9-HM/Q
lap2dAp
lAPI*&(
lbcpyA
L,bUei
]l}bxD
}LCID'
;lCJXq
L`d`p*8
l!D),W{a.@
.LE]=@
               level="highestAvailable"
LExpir
lExZQ`
:lf=2l
lG.$$CG
!L.GHH
lhd`RI
^lHz;~
>$:L!\i
libeayssl
$Licel5Z+
LIENT?
&@)LJE
;lJ!JZ
LKUUnf>w
lL1nc0'
Ll$x"'
]lN %(
load_e
LoadLibraryA
lOB,P 
LOdoJ>
LOWE7o
*LO`XXX
%*@}lP
^Lp`yS
LSM^n-
L[Sy$q
?$lumi
<l?.|W
*Lw3eb
=~_lwn
lWt!$h
#L$X$d$@>9rp$|$
@LXdp|y
lYPNL0
lyTznsp
l}y~y,*
++)%	m
+%@M	{
M0LdZy/
m0M227
m0VYlkn
m38r%J
M~	5QL
m66||{{
$-m7'H
m7tr5X
 ?m8{)
.!M."8
m	8CRL
Magel+P
MAINIC
m-AMGA
ma`UKB
MAX-AGEVER^h
$M@B;Z0
Md,';Dm
M/DhAh@!
mdlg_h|
 #mG{`
M[gx/m
M*H2,O
Mhnq+L
@m?if-
mJuS}2K
_#'MK&$F
mkgo]j-?
,m"mGJ]
mmpQ-#E
?)|mNpG8
mo#Eg0Ug7
MO	/R'
}\M`Ov
}{mP6~~6
m pIiEG)2.
`MP'Qk*
Mr^BwDa
<m|:Sov
M_T|Kz`
"mUJ-v
MVBU-[
<m^YI9(
_M|^z*G
~N|*(}&
$[N@!,
/n&1p}
n()@-3$-	*-&F&
n3mTn&
>\na-R
/navegar	m
	NB+yD0Y Bp
}"	ndS
nel32.dllwGetLongPathNameX(_
~NEXT"
~Nexus
/nFAGM
(N_FU,*
#NFXZ;
nHveB"
NiK_bh
njcXR_m
:}n[L4
nlnqoNsq
NLSoIM^6
Nn''84
n`NEC'G
NNN`dhLn
	nNprQ
nn`:'r
nnv?KJ
no-c"t
@n o G5iadw
NONQXA
 /np 1
npwVHw(
`/NPy"
NQE5%5
NQr%C2
n:q%X%
'NR2E:
N|Runn
N".s0K
NSCOLOR
#;N^TcW
ntg#C}
Nurrency
%nviz&K
Nx'l;>
NXoo,j
N]Z!6=1
	$&-[-o
~*O@\@
o1J,8`
o{},2[
&o422HH
@o8Hu6
O8+OX;9
 oAKnKe
O)]bUUH
O)-"C)
o{<C')D[R
	%	:	O	d	y	
oF1za+
O	_@.f`O	
o?foBh'
og~<T8/*
oh8O*#
OHXmt:
OJ3?e-'
Ok>G*w
)'+okZ
Olbsfv
ole32.dll
oleaut32.dll
OleDraw
	OliCU
oLLLLL
"oLWFN
	Om 0-N
omboBoxEdit
oNAMl:e
oO;>.5
!Open Source Developer, BRSOFTWARE1&0$
Op|"Gf
Oq!F9K 
orI64(
ORT_(_.SCK_LIC
otAddSub
oU4uIw5
out tml#|E
o_V#0(
ov4Z>#
O!V=by
@OWAVA
O,wOL@:
\oWSAC
o}ygow
ozR1ML
'p#	^ 
P^~2kBp
P36Ywi
(p51T?
p6Z:	Z4
P%8%h%
p8'''qrs
,~(]pa_
P	AgJ%
%PaG)l&P
P`a` %-Rh
PATHXPIRE
pBFZ/ll:
!p$C2$tx
PcQf,(o$
PCr@&H
PDt1!p
PEWMtk%G2
PFFA?1n
P'hunZ
PIgKIN2_uH
/:piJKi
pi [z1
PjEOuJ
PjH5Cw
PL1"0 
PL:99904|X
@(pL@B
:p>lz6
-'PN+& 
POA`]{
PopupL<t
@PPI`e
pPWiDCZ
'_ppWXk
pQ2t8x
pQ4hJF#
p&QhB>
PRjCoWXZ
PRQ1aC<,
p`Rq!d
PRYPXWD
p,S&1(
p$TMniR
=P=\TTz-
-:P;uB
PUe@5P
PuEWT$&
PuT\F.#hX[\r
pwjjD|v
PW	xFn/PGd
p#@&~z
^P>Z:d
'P?Z=@U"`
pzvbh^K
>	'pz#y
`._&:q
Q1ca?<r
"q3Ix5
q3-@Zu
$q67UH8
[Q[=6GF
Q9qdyZ
Q]/A2A
q^\Aa,
[Q&B"Qbg
qcAq"'
+*q)DC
{q)do-
qEh ca%
q#F/_!Cf
qGHt[xy{_
QGW-uL
]Q^hK [
qHK3m:-`P
.Qhq\1
q`k_/E
<+qk<wV
Q&'KZ%
/ qLR`
QMC7G<
qOWr%C
!_QOx{D
&qpq%=
Q& :"Q
QQ2@5y
;:QQ744Q:DH
%q%q%qU
<QrfPr
qrstuvwxyz0
QT7gd3$w
quaHtT= 80
<>Q\vXA
QWo)faV
qw$^ULor
qWUpKP 
QX4&r6`@q
-$>qXh(?
qYV~fg
r4a%uy
R7'hb'-
r7$"O7@p
-~r7"t
R8mg@	F#
~Range,~
rC (c) 
rEAIt.
RebuilcK
RegFlushKey
r'&E'nC
            <requestedExecutionLevel
         </requestedPrivileges>
         <requestedPrivileges>
_-Rf;`
rfaceK
rgA~V6
r%G;R'
r\@,@G@v;
RHA)~Z
rHLtlx
-R\][L
?Rl#IsTP@
]Rmh{5
R~;Nq$
%_ROLL
RPeHXM
RpJ;.A
rTN`WA
$rw~oke
R'{X(8HycEa
rx.{{h '
<R;/z$
r-Z'6>X;
r^z"|i
\%'(%S
s00B0Ypo
S0, <!ik
S#0r$GrT
S0ZHpu
@]S 3`
*s?37pg
"%s",4),"
S5VrAM
.s7.XD
s8VVz:
SaveDC
+.[Sb+
 Sb?dG
s|b}[R
s\C^X\
%s, %d
      </security>
      <security>
sfs/7w
sgcAV982
{S>gle
@/S%-H
shell32.dll
ShellExecuteA
~#ShxNVh
SjBMNF
SJJ5#S
%sjmc?
s\ )La
SL_CTX_;
SmNlint
Sn~^:/O
SOFTWARE\Borland\@
'S Os!$_WSE
SoTsq~
spMSFT
Spoo&^
<sp@v}54
Sq#RTR
Sq;Xhk
?-sr|(
SR|Qrm
Ss7Z-A
+ssq|N
ssr3w$t
stfS7F
STROPE
S$T@Rv
#S /}ttn <v!]
STUVWX
StylY\
S<&uO8
         <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
         <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
S`u-Sb
].Susp&
s[W0&d'
 s_)x?
sYCircjN
SYMBOLc_MAC`
syRPC"
;>sZ*C
?  t.<
t/130214
T1n>.n:
T1qf%E
t6Br#s
T6]D#\=
t6[u&h
`^]T73\[
T$7)j j
t7NdRh
"[T8~6
"}/tA*
t#;ADti;
TAdxnc,
Ta{	-G"
tagMULTI_QI
TAlignme
+ t%An
TA@^@y
TB+{{$
#!T!Bp
TC~(O 
t;Cpu'
,tDNbHex\
;T,d=ZF
t<ePhh*
t\fd	L{\3
	TFileN
T~g9$(8
THBa{{
This program must be run under Win32
Th-~r~
tH RQk
 T?[i?_!
Ti'6'.
)t<j@I
	TJPEG
TjU]Kt
TkFreeSp
t*KPW3
TLogiG
tmGMfh,_
tmymQG
TNum=s
TObject
t}=o#]C
TOwnND0wSt
TPF0yY
tPZ7hM
t);q313
TQO(I!
tQrr$o
TRACE PUgC
t(RmoS
   </trustInfo>
   <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
,T;s$|
TS7H|B
TThreadg
t$+tui
TURK*H
t+W3rK=
tw9hEu
twareW
"'TWMF
T"wwd)
Tx`tXG
t&y;'u
tYV)ct@ 
T<yW]ZO
TyYQ 7
.)tZ!~Q
u2>iijdjjpp
U	;(7s
u90&`4[
@]u9n 
?(ud~-
\@U)d2
/U/dcu
U>\,"F
uG	Fuchsia
UGRNM|
uhi1Yl9
               uiAccess="False"/>
u"IP]H0
ujX6.D#
UkFHBz
]ukkdb\
uK{UM2yu
ULsdLSf
 Um7w9X
uMz-jG
!<(uNH
Unizeto Sp. z o.o.1
Unizeto Technologies S.A.0
Unizeto Technologies S.A.1'0%
UNONUE
uo4|\2 G4
`Ur2GD
urmn/_d
Usage of this certificate is strictly subjected to the CERTUM Certification Practice Statement (CPS) incorporated by reference herein and in the repository at https://www.certum.pl/repository.0
user32.dll
\$&USl
us/S8-l
uw\`"L
uwv<9}
UYKGh`
v0fs1W
v0idOp
V,28LW
v#2QQP
v3^j??
%V4=z'C
v7Z,2f.I(~O,
v8 56$
V\AdIV
VariantCopy
VDLHpG,pH
@v*eH+|
VerQueryValueA
version.dll
v#-	f$
VirtualAlloc
VirtualFree
VirtualProtect
virug-
#viXnHa
.vk2E, j
--Vla$
VLength
vl{Lu+h
v*L:PO
!vM;q=v
.VNIdfM
!{(v_p
vPhY8<`UC
VpQ&S<'
Vq7q6u
=VQoml
vrr|xt
|vTD+BgG
|}V{Tl
$VtL4vO
Vt*q<_
v*~!'u
Vu0C'.
V^[U 1
Vu2q \
_V\[#Ufgb
vwFR^e}?|
Vww?fY
v<`YmdW
VyRtlb
VZW/SR
[ &~@w
W0H7Dx
w1S'X6	
W)"2W/<
w30SBHDg5A
w>4>?W
;@"W8A
W8gBCt
wAf8j.
WAM/PM
+]:wB,
wbE HT
wbI2A/F
wCLM.d*
+W.D\$
Wevel	
 "wfR6
\Wg\9C
W+G.!'+K
	WGl3p
@'w@gx>
$Wh>[^
!wH:2rX'|
W,H,UB
Windows
WJ2[KOMZ0
wmeas.
|W'nj\
Wn$VH.Wz
w?P0*Xgk
'w~$Prx
Wq%W\o
*)WQWX
wRf +Q
wr""/p
>WRR]R
WSiF:P
 w "sup
;W,_Tne	S
;w$t|Q
!W	+u0)
WU*dTd	
w+vgVQ
Wvq.{G
[w\ w},
wwwwwwww
wwwwwwwxp
wxr""/p
W"Xz"~
w\X,Z=B
WY{.c5
WYD@RWo)Y
X+1qV|v
&X`$~4*
x4aA[k
X509_STORE
X;6]tOW
x#A?75G9C
>XA"nOTV
XAW=cEA=UT7H*
#X#DEX
!#XG9n
xhaph<}
=-xingig=
=xJiHT
!x@@K.
X{l"*3
%X|L~6FA=X
x/Leave
	$XLed
<X/L<p
XLu7;C
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+XMOPp
X MSWHEEL
,xnAEx
xN-AiO~
-Xn+<xt
+xOPY\
Xor_Cmp
/_X@pD
XPTPSW
\X[]s?cVS
?X. -sil.y
XTp$WK
+xtZXtU0u
|:xu}/
x-u@RpbP*
XV6ecN[YE
&X:(/[@x
:X?YSx$#
x%yU-O
xy''''z{|}:'''~
_xZO<VTU
y01P*`
$Y+0d W
y0,r\AP0
y*1892
y	#24@68mt)
y2Qpp4
Y*442A~
Y6B7lw
?Y6fLFj'
}*y<{8
Y8<1B:
y8DXd|
y8Z?yvJ"Q
ybG7iI	X
}yb%s$
Y__cb_^+
yh|3t<
yHG#A2
YH:i|-
:ykm"x$Xy
)yl s 
<Ymckh
~|}|ynh
/", yo
y,P,8`
y}p"C^:x
y^RAtN.
YsAdap
y;s+$h	f
&~Yu$ 
yVr$GNh ;r-
/y~x5-%7'?
YXNaam
y x!z"{
YyD.f2/
yyvvy|v
~"*Z,,
z-/1,/
z6w+n`
z=;842E/
zDkt4/xD
~Ze3a6p
` z)e9Ar
zej45x
Z\EZG(
z=F8W;+Y
/z"F^Q
ZG8vRr
zgE<b$G
ZG\iKz
z:<h(c
Z%[H/dH
ZhoCbxBPhrjAGDCOTcCI
|Zhuxc
-ZHZER
)ZiGy'
]_ZJ{b[
/zK82C<
zMH?[xg
Zms4s_p
ZO4Ox+
z"okg 
ZTUWVS
zudzDB>(
[ZWfnk
&zY=mg{_
ZY/US*(%F
^zz111
^zz1111
^zz1111M
^zz1111MM
zz1111MMM