Analysis Date2014-04-24 17:56:29
MD516268af9cf0a98024c73e52f743f1aa1
SHA1c9dae3c07534c59301d0d9479cbd20ceb2cf89fe

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
SectionUPX0 md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
SectionUPX1 md5: 5d5a489533139bf1311618b297de0767 sha1: eb4c4106c53a775b857a4f4a76df6be7f2c7fb24 size: 524800
Section.rsrc md5: 1d0ef327dc7e17025ba6f3e400be0dbc sha1: 0dbf3cb5e56f3f9005f0b93f6d5cbd6b895051e7 size: 27136
Timestamp1992-06-19 22:22:17
VersionLegalCopyright:
InternalName:
FileVersion: 1.0.0.0
CompanyName: Arquivo Solicitado
LegalTrademarks:
Comments:
ProductName: Arquivo Solicitado
ProductVersion: 1.0.0.0
FileDescription: Arquivo Solicitado
OriginalFilename:
PackerUPX -> www.upx.sourceforge.net
PEhash5fe0ef1832e92f00593cd12a7a1dfaaaf58e9399
IMPhashb460e412b82a7ff63ffe3bb2e551ec65

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\Administrator\Desktop\CONTAPRIME.url
Creates File\Device\Afd\AsyncConnectHlp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Winsock DNSgoo.gl

Network Details:

DNSgoo.gl
Type: A
62.253.3.99
DNSgoo.gl
Type: A
62.253.3.103
DNSgoo.gl
Type: A
62.253.3.84
DNSgoo.gl
Type: A
62.253.3.118
DNSgoo.gl
Type: A
62.253.3.108
DNSgoo.gl
Type: A
62.253.3.98
DNSgoo.gl
Type: A
62.253.3.89
DNSgoo.gl
Type: A
62.253.3.119
DNSgoo.gl
Type: A
62.253.3.123
DNSgoo.gl
Type: A
62.253.3.94
DNSgoo.gl
Type: A
62.253.3.114
DNSgoo.gl
Type: A
62.253.3.104
DNSgoo.gl
Type: A
62.253.3.93
DNSgoo.gl
Type: A
62.253.3.88
DNSgoo.gl
Type: A
62.253.3.113
DNSgoo.gl
Type: A
62.253.3.109
HTTP GEThttp://goo.gl/HzjJkR
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
Flows TCP192.168.1.1:1032 ➝ 62.253.3.99:80

Raw Pcap
0x00000000 (00000)   47455420 2f487a6a 4a6b5220 48545450   GET /HzjJkR HTTP
0x00000010 (00016)   2f312e31 0d0a4163 63657074 3a202a2f   /1.1..Accept: */
0x00000020 (00032)   2a0d0a41 63636570 742d4c61 6e677561   *..Accept-Langua
0x00000030 (00048)   67653a20 656e2d75 730d0a41 63636570   ge: en-us..Accep
0x00000040 (00064)   742d456e 636f6469 6e673a20 677a6970   t-Encoding: gzip
0x00000050 (00080)   2c206465 666c6174 650d0a55 7365722d   , deflate..User-
0x00000060 (00096)   4167656e 743a204d 6f7a696c 6c612f34   Agent: Mozilla/4
0x00000070 (00112)   2e302028 636f6d70 61746962 6c653b20   .0 (compatible; 
0x00000080 (00128)   4d534945 20362e30 3b205769 6e646f77   MSIE 6.0; Window
0x00000090 (00144)   73204e54 20352e31 3b205356 313b202e   s NT 5.1; SV1; .
0x000000a0 (00160)   4e455420 434c5220 322e302e 35303732   NET CLR 2.0.5072
0x000000b0 (00176)   37290d0a 486f7374 3a20676f 6f2e676c   7)..Host: goo.gl
0x000000c0 (00192)   0d0a436f 6e6e6563 74696f6e 3a204b65   ..Connection: Ke
0x000000d0 (00208)   65702d41 6c697665 0d0a0d0a            ep-Alive....


Strings
.v
.
$...
1
.
[
..
.5
~
R$0.
.
j&'.
"
.
..
.3
*. .$..I
HRA
{
'f..
...
.
.
.
N^..
.
.
.
.g6
.O.
3
l
.....7
X.
..
.Y.
.
.
.
e.
.
.
..
"@.]
.
...
1
.&.....v
.
$...
1
.
[
..
.5
~
R$0.
.
j&'.
"
.
..
.3
*. .$..I
HRA
{
'f..
...
.
.
.
N^..
.
.
.
.g6
.O.
3
l
.....7
X.
..
.Y.
.
.
.
e.
.
.
..
"@.]
.
...
1
.&....
041604E4
1.0.0.0
333f3
Arquivo Solicitado
BBABORT
BBALL
BBCANCEL
BBCLOSE
BBHELP
BBIGNORE
BBNO
BBOK
BBRETRY
BBYES
BLUEGLASS_BUTTON
BLUEGLASS_CHECKBOX
BLUEGLASS_CHECKLIST
BLUEGLASS_PROGRESSBAR
BLUEGLASS_RADIOBUTTON
BLUEGLASS_SCROLLBAR_BUTTON
BLUEGLASS_SCROLLBAR_TRACK
BLUEGLASS_SIDECHENNEL_BAR
BLUEGLASS_SIDECHENNEL_HANDLE
BLUEGLASS_TAB
BLUEGLASS_TAB_LINE
BLUEGLASS_TITLEBTN
BLUEGLASS_TITLE_CLIENT
BLUEGLASS_TITLE_LEFT
BLUEGLASS_TITLE_RIGHT
BLUEGLASS_TRACKBAR_BAR
BLUEGLASS_TRACKBAR_SLIDER
BLUEGLASS_TRACKBAR_SLIDER_V
Comments
CompanyName
DBEDIT
DBGARROW
DBINSERT
DBMULTIARROW
DBMULTIDOT
DBNAV_BUTTON
DBN_CANCEL
DBN_DELETE
DBN_EDIT	DBN_FIRST
DBN_INSERT
DBN_LAST
DBN_NEXT
DBN_POST	DBN_PRIOR
DBN_REFRESH
DEEPBLUE_BUTTON
DEEPBLUE_CHECKBOX
DEEPBLUE_CHECKLIST
DEEPBLUE_PROGRESSBAR
DEEPBLUE_RADIOBUTTON
DEEPBLUE_SCROLLBAR_BUTTON
DEEPBLUE_SCROLLBAR_TRACK
DEEPBLUE_SIDECHENNEL_BAR
DEEPBLUE_SIDECHENNEL_HANDLE
DEEPBLUE_TAB
DEEPBLUE_TAB_LINE
DEEPBLUE_TITLEBTN
DEEPBLUE_TITLE_CLIENT
DEEPBLUE_TITLE_LEFT
DEEPBLUE_TITLE_RIGHT
DEEPBLUE_TRACKBAR_BAR
DEEPBLUE_TRACKBAR_SLIDER
DEEPBLUE_TRACKBAR_SLIDER_V
DLGTEMPLATE
DVCLAL
f3fff
FileDescription
FileVersion
FONTCOMBO_DEVICE_FNT
FONTCOMBO_TRUETYPE_FNT
fSOM
InternalName
LegalCopyright
LegalTrademarks
MACOS_BUTTON
MACOS_CHECKBOX
MACOS_CHECKLIST
MACOS_COMBOBOX_BUTTON
MACOS_FORM_BACKGROUND
MACOS_MENU_BAR
MACOS_MENU_SELECT
MACOS_PROGRESSBAR
MACOS_RADIOBUTTON
MACOS_SCROLLBAR_BUTTON
MACOS_SCROLLBAR_TRACK
MACOS_SCROLLBUTTON
MACOS_SIDECHENNEL_BAR
MACOS_SIDECHENNEL_HANDLE	MACOS_TAB
MACOS_TAB_LINE
MACOS_TITLEBTN
MACOS_TITLE_CLIENT
MACOS_TITLE_LEFT
MACOS_TITLE_RIGHT
MACOS_TRACKBAR_BAR
MACOS_TRACKBAR_SLIDER
MACOS_TRACKBAR_SLIDER_V
MAINICON
MDI_CONTROL_BUTTON
MENU_CHECKED
MORE_SCROLLBUTTON
MSGDLG
MSNPOPFORM
<<<Obsolete>>
OriginalFilename
PACKAGEINFO
PANEL_BUTTON
PREVIEWGLYPH
ProductName
ProductVersion
PROTEIN_BUTTON
PROTEIN_CHECKBOX
PROTEIN_CHECKLIST
PROTEIN_FORM_BACKGROUND
PROTEIN_PROGRESSBAR
PROTEIN_RADIOBUTTON
PROTEIN_SCROLLBAR_BUTTON
PROTEIN_SCROLLBAR_TRACK
PROTEIN_SIDECHENNEL_BAR
PROTEIN_SIDECHENNEL_HANDLE
PROTEIN_TAB
PROTEIN_TAB_LINE
PROTEIN_TITLEBTN
PROTEIN_TITLE_CLIENT
PROTEIN_TITLE_LEFT
PROTEIN_TITLE_RIGHT
PROTEIN_TRACKBAR_BAR
PROTEIN_TRACKBAR_SLIDER
PROTEIN_TRACKBAR_SLIDER_V
SIDECHANNEL_BTN
STATUSBAR_HANDLE
StringFileInfo
TFORM2
TFORM3
TFORM5
TFORM6
TFORM7
TFORM8
TFORM9
TFRMMGR
TFRMMSNPOPFORM
TFRM_NAVEGA
TLOGINDIALOG
TMAINSCREEN
TPASSWORDDIALOG
Translation
TSUIARROWBUTTON
TSUIBUILTINFILETHEME
TSUIBUTTON
TSUICHECKBOX
TSUICHECKGROUP
TSUICHECKLISTBOX
TSUICOLORBOX
TSUICOMBOBOX
TSUICONVERTOR
TSUIDBCHECKBOX
TSUIDBCOMBOBOX
TSUIDBEDIT
TSUIDBGRID
TSUIDBIMAGE
TSUIDBLISTBOX
TSUIDBLOOKUPCOMBOBOX
TSUIDBLOOKUPLISTBOX
TSUIDBMEMO
TSUIDBNAVIGATOR
TSUIDBRADIOGROUP
TSUIDIRECTORYLISTBOX
TSUIDRAWGRID
TSUIDRIVECOMBOBOX
TSUIEDIT
TSUIFILELISTBOX
TSUIFILETHEME
TSUIFILTERCOMBOBOX
TSUIFONTCOMBOBOX
TSUIFONTSIZECOMBOBOX
TSUIFORM
TSUIGROUPBOX
TSUIIMAGEBUTTON
TSUIIMAGEPANEL
TSUIINPUTDIALOG
TSUILISTBOX
TSUILISTVIEW
TSUIMAINMENU
TSUIMASKEDIT
TSUIMDIFORM
TSUIMEMO
TSUIMESSAGEDIALOG
TSUIMSNPOPFORM
TSUINUMBEREDIT
TSUIPAGECONTROL	TSUIPANEL
TSUIPASSWORDDIALOG
TSUIPOPUPMENU
TSUIPROGRESSBAR
TSUIRADIOBUTTON
TSUIRADIOGROUP
TSUISCROLLBAR
TSUISIDECHANNEL
TSUISKINCONTROL
TSUISKINFORM
TSUISPINEDIT
TSUISTATUSBAR
TSUISTRINGGRID
TSUITABCONTROL
TSUITHEMEMANAGER
TSUITITLEBAR
TSUITOOLBAR
TSUITRACKBAR
TSUITREEVIEW
TSUIUNCONVERTOR
TSUIURLLABEL
VarFileInfo
VS_VERSION_INFO
WINXP_BUTTON
WINXP_CHECKBOX
WINXP_CHECKLIST
WINXP_COMBOBOX_BUTTON
WINXP_PROGRESSBAR
WINXP_RADIOBUTTON
WINXP_SCROLLBAR_BUTTON
WINXP_SCROLLBAR_TRACK
WINXP_SCROLLBUTTON
WINXP_SIDECHENNEL_BAR
WINXP_SIDECHENNEL_HANDLE	WINXP_TAB
WINXP_TAB_LINE
WINXP_TITLEBTN
WINXP_TITLE_CLIENT
WINXP_TITLE_LEFT
WINXP_TITLE_RIGHT
WINXP_TRACKBAR_BAR
WINXP_TRACKBAR_SLIDER
WINXP_TRACKBAR_SLIDER_V
<>:.#%
  ">_\
 !"#$%
!*/ @=
"""""/
%&'()*
)\0,::
-0-(0%()(k7M
	01aO0
020611104639Z
 %0.2d	
079:BEchgom{o
090303125356Z
`09" V
+0acspMSFT
0;BR$-
0D;`MT
0eQL;@?
,&=0[/g
0hc	N!
0"Hea!
$'<,0j
0k,NMk
0!M{N}
	"%?/<0p
$0P(8$9
\0pLQ@
0p+p5X
0$_PXR 
0#s/TYx
0"	w%9
0 XPx(	7p
$1:@@&
%1$$$$
10>;~+
@116E2
1234567890ABC
=12839
12$X;?
130805055316Z
13'C1<JQ$g&
140418073103Z0
140805055316Z0{1
14?<8,*
1+<d/ 
1E]:Fe
1;EHQV\
~1es"a
1f, no
1hO7l50pQ
1%kz:^8
1l.H+f;
'1MQS'9
,,)#),1O
1oqom<
!1| ;P
1 sb@h
-+1vFc
1W*'*a
1x hpD
1y$m:Z
1 Y+Nl!
2332:kj
240303125356Z0x1
'2699640**&#
270611104639Z0>1
2Blr"/
\)<2Bw
2.(.d^
2@dmndTpdx>
2EBgmszz
2)g6%' 
2 <Hd@^2`
2I;[^t
(2KaA*
^~2kBp
|2LW%,
2m)D4J
2 Mik2~c
2N6/P2x
2)O1Pod-0
2p7}{P%
2SSD@R@
2$UO"+
2/UQ29
2WS2Stub]
;2w;;thsz
(()@-3$-	*-&*$
3.0 (.mp
!#3277
&33n'E
358-B4D1-169048547C
3GH"HG
,3)" JK
3_\@,O
]~3O;H
3P,oCRT0
3	^(Pq"
3s5YWZA%
3to4V'
3Viewe
3X*/+x
3%Z/PC
,4 <$^
4'((00
40D1H2
43\oH@
4488<<
**44*;g
<49CwA
4)a_J6
4a'"XJL
~ 	*4b
4""C['B
}4E?AQ@
?4\heX
4HIkHH
4JYaC y$#lq
4#'MK&$F
\4!.Mn
4$NVs%RAJ
4P%7Tg
4>PWOt
4/qeex
4r+"182I
4-RA<!
|4UhkR%1
4vZd15
4$'%#W2
=.4W"D
4W@PPI
(5>>`(
;*5,2'
52"5dS"#S
*53&8&(
'.5<=6%
56C+6+
^,5C~}~\
.*`5d=}
5.:eG(
$5FWhy<
5HuKB&y7
.5{{i%
>5Jgu4I
5)l'1PX
5l#8p9t
]5Mb i.
5MS55`V
#}5/sa
@5$[ui
61nc0'	`
6)2=r$
|64-TP
<6''5C
>66J~d~.
66+Lfs
 6_CTX_s
6]D#\=
6D49-459F
)/6DOO
6,fk<dd
6gSilver`
/,.6H0Z
6JL"v$iH
6kkn6"2AB##%$#A1@..1
6L9T-=
;6~;LN
6!McBi
6NE"BIG5
:+.6P 
!6q43]%
6Tu^fIW
6Vf`1p
%,6vHu
6Vla|Zhuxc
6WUp4 
6=>@<?&$x
</7>?''
<700,?@
#&'7'61
7%7H%Ho
7_7IE(AL("%s",lo
781C-7394
\%78$C
`<7a2G<
$7A'O9
7!bImpl
>_7CdL
7=gjz2V
'/7?GOC
7Jmc@:9
7KSup,(
7-L:&,
7lwF`M;
(}((7nD
7\NNn'X
'!7OUc
7pCcu=
7Rf +Qh
7WF+x$
7yat 0>
8`0@p4<
8$1'=+
87 [dFL>
889DF117r}4
[898($
8BB9bG_?{
8C8<{9@
-8C]oPNp
&*8DMRNN>1"
`/8egul6
#|!8hG 
8?IRXb
#8iUVJ
\8J7LU;!
?8J96gQRkTUpX
;8?=k+
8]L^v{{}
8oe	&(
8 +PB4
8TD+Bg
`8\u=*
`8)	w`$
8wIXwI
8XD(CA
 !' 9 
%='#/9
90e.	3M
9.0YXW,R*Nj
':91E5
96&]#?
9[=6GF
;=99@*
'99(9:770
|9999xtpl9999hd`\9999XTPL9999HD@<9999840,9999($ 
999TPL'''
9CC-`E^h~
&9EKRG
@&9 	F
9`GABK
9M0$qE
#9|MhaU
-9omj`
9q0y,m7q"%
9QnCZk 
9rL$X$d$p$
"9<ThD
@~]A}	
!a[@1)
A]1/s9BNK`a
<A44RO3
A4g\3[
A7T]O@6
aafB"y
?@AA@L
aa_O[O_ai
}abcZfg
>:ABv>25C=7-$z
]"a%[cbJ
A>C@~n
A.DHDDHy
#;ADtiw
advapi32.dll
a_^^eUG
AF76/8
AFECd@=m;
AgZ$tt
aH_MACW
AhrD;Jv`
ALb|[+2
a)lIium
ALL:!ADH:RC4+RSA:+HIG
AlOW@Q
and\Delphi\RTL
a)(N_FU,*
aN&OlbsfN
ANSI_CHA
A<+o[>)+
      </application>
      <application>
ar/AprZ[A
"aSj43pK
</assembly>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
At$chTok-
a&_uj:
auURFa
<AvTf8
awow}n7e
\;awpou;i4
`^>]a^;x
!@AX@@
"AXT$_
AX${,y
#B]2Qm(
b4w	[D
	b9mgDL
bA2"(D
?BbPg}
BCm/\@<u
b'`dJ^
BE_E`p
Beg@T/W&
;!/be HT
BEiW2%
bF	brX
BFP\_fqux{
'BG{3{3;$),,:D
B[=gJM
"B	>_h
BhiklUVXY\
b&h@n 
Bi/l0P7
bI{tSr
bK55Kb
	BKC/N
B	L\8F
),:BMGR=6
bM'OUf:
boBoxEdit
Boolean
!BO+'PP*C
box_skipH
<'_bpd
bq0tJF
b\R\aEp
BrBgh<.
BrmF>P
BR SOFTWARE LLC1*0(
brsoftwarellc@gmail.com0
bRVNQRW
)bS'4VELN
B'<%sp/x
BUTTONy	
)]bUUH
bw9	lw
B~Wr9,
bX^IAd
-/by3G
bYY.)'
B:Z>nGK+
c0OMA?
c2bI{I
C2/fC;
;c[2Pkq
c2s6a2
;>C4~A
C4WGeneral
C5FB5D6F68B}
CA,`A_
[cA;du
cales27
 CBAEG
C/BALT
(cBd<@
\$C()C
CEn$	)>
cEop=<
	Certum CA
	Certum CA0
Certum Certification Authority1
Certum Level III CA
Certum Level III CA0
CF2?:F!
Cf_xatU	/
Ch0Ryg
;Ch"Typ
CHURIAT^
Ci'0B`
cipher_?
cis\ v
CK_lzPxxmO
[:cL5p
(CL8}/
CLhPrH
clMaroonfR
Close!$
CL|R;&
_?cm# 
%+) CmDEpsMOab	
cm<I,)
c'mL'nHl
^cMM T
comctl32.dll
   </compatibility>
   <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
Cookie
cOrR9d
.C*P?2a@
c.P7C&
C';P8u+~
?CPB\b@?
cPtr%.8X
cQkm{,
;<@~c?_r
C	r^BwDa_
;CREATOR: gd-
Crji_lT
 '(csh
,c-{Sky
"CT06D
ctap)|
CTEDUI
CTRA0/
!cTz;C
cUWG*w
cu<Zlr4
C?VA=N
C/vH.|\
C.W"&%2
c+W	#F
c,wPL5
c>x|H~
cX^mbA
$d_[#_
$d(. &
d,-.`(
d0a_@P~0
d0zj -
D1f7q$
d34df> 
D3d,-v
d3 W:qx
@{D4FMu
d5>794+8]
.D6b$DG
d7OGOJ
[d8:hw
D@<8rr!'40,rrrr($ 
d(8tkE
DAio%'
d	a}Js
,_Dated
daU"Oj
\dB]@'`
&dB&PTX(AhB|!j_&tjZ
Dc<8eN
;DCPDSu
D#cr^@
DD1:\\
dd8-br/
dddd $(,dddd048<Q
DDd%_FD
_.dDjfl
dehjkmoN*&'
"dFBWA
dfjSDFrt
%#=df<z
D#Gr$Gp
DgTSXN
DhAh@!
d"h$"O
@#di"_
divod_nOr
d`['JLH
dk)BP_!+
$';DL(0 v
DL3<2D)9!
*d`LO_&
dmhu/	
DmTIyIFCOKwFnbYWdukA
dnifEr
do|<|\p7
Dowww7
D%oYh<
DP)'?7
(dPAv;r
dQq3MZ5D
d^]R]^
-^("Ds8
ds&Q<0/
Dxwhid
d-YK5Ih
DYp @W
e$<![1
E<2OjTM
+E:3:<vi
)&E4O/N
e*8VcM^NH
EAbort
eam(&j	
EAST!O
].:eb$
eb1@gqck:o
Eb)J'M4
"e-bm/
EC61966-2.1
Ec}s}e
EDivByZero
.E,E,,
eEbebe
EEE_yw
!:EE>>L4K[2
,e fQ72
(e_fu+k
-[#EgeUUM
e_he'yHww
>EI]Ldn
{E Jm[]
eJy}@v3LH
=EKU`ejqy}
)EL/F`
'&E'nC
EOutOfMemjy
E'PG,RwT*
=E==;pmEm
EPy?w=z
es?gEd
E&tFiH#
E$t(;G
ETXu.0q'
E(=+U>
E.url7[
e|&};V
EW(`q^Z
EXCEPbO t
	Exception
e[X[gc
ExitProcess
,F1::Lv
&F1|/q}
_F6|o|
f:<86?>
f@8i?EtD
!! F#A?75G9C@~s
faultPHotLigh
FB5I23
f&bf^v
".:FcO
?F@D2HU&
.FDiag
__"FD&	oQ
f/dQ>F52
".:FeD0-
F+E+hw
].:FeN'
Feo$|-
(:FeX0
FFFFpqrs
f g`@uS|
:FH#I8
;FIl3 
$@FIqH
FIRjX	
=Fj$XO
FkZn]S
fm8FC"
F-.Mb+7
F@MEh3Ec
fMJ)K`
>FmtEO
^!FNN>_0000e
	@F/NsHs
FocusDenw
FOOIKN
F*~Pm@
FPUMaskValue@
>fQTvRtlb7
".:FR^
:FRnLO
".:FRv
F{S{-_
f*ShellAPI&C
F,T;s$|
FT 'S(
+)FU;\)
"FUa>Zo9r
_FuchsiaAqua
F-U<!E
fu'J:e\=4 
=Full{
funmoods
;F;uR8
&F]_^`.v]
\fx")2
".:FYe
&=@G[#
=G0Drm`80guo4
G0;,N}
g3"0vP
G6ZD34
G+AR, F*J
GB2312
G BBDEROV
gb)X2x
gC`CAP
g	/?D1d	
gdi32.dll
GDOWsp
gdOYZrpqqppnjcXR_mls
g_EADXj:
GERENCIADOR DE
GetProcAddress
!G.GHL
~#gGP&|
gGroup
GgS0.v
: G*/H@
GHIJKLMNO
GHZqWLP
!g#I{,
gju"IP]H02
$gKIN2_
.gl/NMQvA7WQoF
`Global
|gN^}-
GntKzM
;g}NxK
][Go*I
G= p"+
GRDFI;
GREEK$
g%s_%di#
GShttp
g%u@jl
Gu_l	6
Gu,L	R#
guro5	
#g?wq9
G X509_STORE
gXK4Mw
GyZO4Oxs
<<#h(_
  $$?h
h-0/j	
/!<=H4
|%h47%$&
h9999d`\X9999TPLH9999D@<8999940,(9999$ 
H_${AX
h c po 
HDa|w53
\HE3$%*
hE5m :@
!Heb2F
hEFH ~
HEG+LBy
HeH@&[
_h^FontPitch
Hg_LD,R'@L
>H^`gR
H;H\9)
^hhg J
Hh(ja4
HH":"NN":"SS
HIFTJIS
HIh;J4u
HK`M+v
h>|	l>
Hl2K_	
H""Ll14
@`:hm!
\Hmc4b
hM)n~|
HMpp{t
.hND0wSt
<H?}?NL
}{+$ho
;h~'OA;
H$oT6%8
houssx
!HP;5|
@$~H\s
_`h}ST
http://crl.certum.pl/ca.crl0:
http://crl.certum.pl/l3.crl0Z
http://ocsp.certum.pl0'
https://www.certum.pl/CPS0
http://www.certum.pl/l3.cer0
Ht[xy{_
hu}:M)3
'hunJR
HveB^fCfbI
:-`H"WP>
hww".:Fe
(<HXl.|
h%&Ze 
^{)I_/
I06tTY
+i|_21
`i+{2i6&K@
I4N6 \
i(#6-) 96u/PsRn%x
=i^7MI
i]aBCH
iA*hMe
IAs`>	
IaxP 1%cg/
 I!b%,
ICpp)G
,I!&d-
ID\{4AA4
i@@DDc
_	IDispatc
iE7iEB
I$eger
*I ERa
_Ign^.Ok@e
i`Gq#1
i/(}<IB
IiEG)2\
IIEJ;Y~<
>iijdjjpp
iJI{2Ap
ij-RmBy
IKIGEC
il@eP^$l
ilZ|}|ynh_
ImageList_Add
)%i(OK
IONQid
IOutxH&
 ^~ipbo
IPersist
?iPk++
&i'pWW:
iQ~$kX
iQunW{
=I/r?f
I]Rser
ISPLAY
iTLPTX5
IuIB%u
)`I*v5|
iVf2tRR
"I)V--((%% !G
 ^iVh"
IVlap2d
ivrebBI|JV
I `w(+
IWeb H7
IWWDDQ
Ix3"F $
IxdPB0
IYsAdap
IZm	D:L
}.IZxK
J0L}	7
J`5A!*U
#JAFEB.
JDsTP?
{je}?|
JEGI:tmA
JE:$@VW4d
\J/F[D
JFIFP)
)?j{=g
jGh8=]
J@GKJt
J]H9UP
jkccCog
%j_ks=p
JL08#::J
J(o1J#
JO BaoB
JoinLeaf
j+]Q!,
j`qaW;
*]j:\rH
JuA	9s
JumpIDH
jW6q%{
\-jw".e/T"
J/w)f%
*j^XhM
*jx>Q#
JX>untZ
"|J:YIB
%k1s,Q
ka&i([c[0U
>_-KC"
kd"g*16L7G
K["DR]
KEEP-ALIVE'L
KERNEL32.DLL
kernel32.dllwGetLong(_
keysK<
kFB\CK^
@,|?kg
k-#{i2G
\K|.IG
>k]:]J
kJ_H'}
?	_:kJr
kkhe`QULi
)Klm.(
KM]$A":
kmO88&
KmR'{y0=
Kn|:Ht
kn,q=YW
K[)Rk=
kt4/xDd
KUUn	C3
>_KV88+
k:v\"v
kV&~&z^
kW>_Pr
kX}a5r
~KxI[)
/|/+kZ
kzJ~3|8
^K&zoh
;;;:>L
""\^^L
l!0DIf
l0,m#Jw
|`,(@L2
l2]HX 
L>>>3aw
^L3'L3'L'
L6ViUIn
/,+L7O
((,l\8
l/8d02W8f6
l9-HM/Q
&l9Q9$
)L9v5+
LA.phpk
	lbl_>
Lc".:ev7
LCID'K
  L Cj
%&;l%d&
ldAL5(
lDe<FV
lEC~(O`=
l:ele7
               level="highestAvailable"
L}Ew	K
lExxt`XC=
_l.exzo
^lHz;~
libeayssl
_LINES/G
LJF/O8M
L(Kma=
lk`VMS
l^L`d`p`
l{Lu+h
lmnopq
lm<pp!
@LMsgIa;
load_e
LoadLibraryA
LOCALHOS
%Lo*HN
l#ONNhd
LPP*)(J" 
lqA.CX
lrRH*^
$]Lr-Z
'lSiFB
l\#Sk.
lstrcpyA
L[Sy$q
l?uRnl
-l'**Y
lz"#>~%
m0VYlkngh2m
:m1g+ 
\[~m3aF
 ?m8{)
malsYl;
/MARAPRY
ma`UKB
M	Ch:k
.m$c*$R
Md,.#[
Mfl,28LW
M_g.#;
\m`G2X\
m@@~Gd
`MI@O|
#m+jF3
mJuS}2KD
mkgo]j-?
,m"mGJ]
?)|mNpG8
"M[p[p
MQMQ)A
&M#rQmg
MsgI"7)
<m|:Sov
MT0&d'
mtWZKR
]m_u5n/
MWaz`S
m.xMrm&
<m^YI9(
#n2a,J u
n3mT	AL
n+a}To
nda asf
NER=vn
Ng4.-h
nhznHnP
ni>%v}
[n\jF?|"
nj}n}G
NjrhNMGD>
NLSyIM
nn4L!"9<
	nNprN3
/?N_nW-
>NoAcc
no-cbD
NovDec
\noWSA
NqK>Y;
'NRF%&
N".s0a
NSCOLOR
~N>UpW9:
Nurrency
%nvizI
$NVY]/
n W:q%
nw?R0h
N x3!8
NYtCT^`
~*O@\@
o0MXZV
o+17B 
O1&BIp
o3@]W|
o42 G2
@o8Hu6
O +%aw;
oBThumb
<o:Bx`
	%	:	O	d	y	
&oeH('
oFC3F@
oftwareWH
OJ3?e-'
oKl`CK
)'+okZ
{>,.oL
ole32.dll
oleaut32.dll
OleDraw
>oLeftEd
oLLLLL
o`lm<!
Om 0-N
oMAX-AGEVER
O?MBJJK
ONNH RQk<
ONUEED
!Open Source Developer, BRSOFTWARE1&0$
Op|"G^
OpGK:S
OQ#,{>B
O qQp	
ORT_(_.SCK
Ot8D:0
O	TBiDi
]otW/W
ov4Z>#\5
O!V=by
OXJ|eX
oyE9`O
o}ygow
*OYN9F
oyNxeH
	$&-[-oyv
ozp$J4
ozR1ML
#.!@P#
>p0BX'qq
P3desc
P4;.l:
+}p:5=|
[':P'6
P6G1WV
P7]-_Z
P%8%h%
@*PA82
pAF	Z2
p|A:l^<
patheVP
PathNameA'o
PATHXPIRES
PBGCEz
pcd2.VT
PDt1!FW
pe{,P 
=PF6>Mak
PFFA?1n
'pGJYz0
_,[{PH	
pHxL\Iz
pi [z1
P;J@Aet
PjH5Cw
p=jT[2b
pk1lLx
<P`k+BObSW]
PKL=*A
P/K'Q3
PL1"0 
+PL)DS'
:p>lz6U?7
?PMNNPf
p)MUQ)U
pNNNNlhd`
Pnr@"1
PopupL<
Pouco!
pPixTsPf
P-'PN+& 
^ppp&n
ppWXkx
)ppyk^U
PQA.RP
Primary
Property
?PRYPXWD
ps6* P
P\SdUh
+#PsZ%@
+PTmY(
 p Tp3
PUgC`NEC'9!
PurpleGTeal
pu?v"f!
P`>w'L
Px}f)w&Iy
P"xmc0
p?xxJi<T
Pxy{`n
PxZO<VTU
py5Cum
Pytptt
`;`*PZ 
Q0@cPa
;&q0q%
.Q1UQUXq
q8	+1&
Q]/A2A
q^\Aa,
qal.Cren
qCzm[aPI
%qExAC
qFf">)
QGW-uL
qhCmbT@oj
qHlGr$G
.Qhq\1
qHr%Wrl
QJDBC!
qkd&YP
<+qk<wV
%>Q\Mp
<qN#@4%p
Q`n'a~
*Qp8ye
 (q[ph
Q& :"Q
"Q[Q&B"Q
q|rC (c) 
QRGolepro@
"Q\u{u
Q?VYvo'H
QWo)faV
QwQk_We
"Q[X<Oo{
QY{CCc
R3O#S>u
R7'hb'-
~Range
Rebuil
RegFlushKey
!_reicobmp@_k
ReKPy>
            <requestedExecutionLevel
         </requestedPrivileges>
         <requestedPrivileges>
rfaceK
rf#e$C,
rGGhqp
.RhL 2
r!;HUpd
`'Ri8x
rI]!x@
RjCoWXZ
R.JZgX
-R\][L
r!/Lea
]Rmh{5
R~;Nq$
R$[O][
%_ROLL
R OWSE
RpJ;.A
rrrZRJ
,@R(@Ui
ru++I|e
RUSSIAN
#)`%rw*
`rWE'Up
~rw~#T
r/=XAv
r>x<>x
RzBy c
 rZVe^
~!S;?2
@]S 3`
S3)`D+
}S3$fG
s3s5vw7
^S4?'h
s4LGmm
.s7.Xq
Safecalns
sa?$UsJ
SaveDC
s|b}[R
^SB'U+Q
%	\sBZ2k`2
s cfsp1%C
%s, %d
S(dT>x
secuOb
      </security>
      <security>
s	fMh(
,sfs/7.I
sgcAV982
Sh|3t<
shell32.dll
ShellExecuteA
SH+p!)
~#ShxNVh
^ -sil.
SI[NFb
SjBMNF
SJJ5#S
SmNlint
s#m=W\
Sn~^:/O
soBZw:\X
SOFTWARE\Borl
spG#P3P
SqhHai
Sq#RTR
?-sr|(
sRGB I`
SR|Qrm
+ssq|N
SStSXVV
S`Tm	JK
_Sub/MulDivI
         <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
         <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
S`u-Sbo
].Susp5
SV/<dr
 s_)x?
Sxf}%!
SX=kqe?F
sYCirS
SYMBOLc
T~)\0 
t/130214
t6Br#s
t6[u&h
`^]T73\[
t!7OPT
TAdxncP
tagMULTI_QI
TAlignme2h
#TargetT=
T(%|]	!	B
T*'-B-/
T	BPPwG`0
[T[]Bqr
t;Cpu'
TC;*TJ
[[t+ D	
TDY'l"
t<ePhh*\
	TFileN
T"Fixup
t,F(?p
T~g9$(8
TGc@x`
"TgP0J
Tgr}"X
This program must be run under Win32
ThX[\\F.#N`Adr
~"tjaJY
t<j@jsDE
	TJPEG
TjU]Kt
t \k.a0l
TkFreeSp
TKi[-_
TLSv1/)
tmSk0c
T \n3Ui
TNum=s
TObject
T.#ooN
 t\oqy
Tou8k F
t}=o#]z
TPF0oY
TPLNNNNHD@<NNNN840,XNNN($ 
Tqo<0y.
-T[`R#
tr6QT!
TRACE 
Trackl
t(RmoS
   </trustInfo>
   <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
tShd;O
t sj/$
TThreadg
TTLExpiN$
tU35,I
TU/6n#=
tuG.Ty
:tu;<l
TURKISHm[kvH
TVCLw!]
tVRumW
t+W3rKn
Twe'$<
tWI#!X	
TWP\Aq
|.tW U>
TXPA-gP
TXS@Eih
+t_$xtZXtU
TXX9iN
Tyw0i\
tyy,^\
`.)tZ!~QL
u0NHJ-6
U[8ie!
@]u9n 
u/a4v&
u?Con?
U+Di	AN;@
UE7MhL
uEWTuE
U>\,"F
U`FH|"
Ufv0idOp
UG$;+~
UGEPCT
UGRNM|
;u+#HU
               uiAccess="False"/>
ujcOlb\
UJSU5f
uK{UM2yu
uMz-jG
Unizeto Sp. z o.o.1
Unizeto Technologies S.A.0
Unizeto Technologies S.A.1'0%
?UnknowDeci
UNxxr!'m.{{}
upHaBM
{uqjXU
Ur !"2
`Ur2GD
Ur4562
urmnpc
Usage of this certificate is strictly subjected to the CERTUM Certification Practice Statement (CPS) incorporated by reference herein and in the repository at https://www.certum.pl/repository.0
user32.dll
USER"DLL
\$&USlA;}c
UV5UUSeUf
uvwxyz0
uW*_ a
UxrB'ui
U)Z,2f.I(~O,[
)\(v>,
v!(0(1y
v@(0	WS
V1qV|v	]
v2_m:v
v#2QQP
v8 56$
$vAcTcB'D
VariantCopy
v-BQ?~^#
V..$$CGK
VCLCp)
v!`cT]
Ve}emsj
!VEGGiG
VerQueryValueA
version.dll
v#-	f$
vf16']h
V&FH_5?
!VfpyP
<vH+Lg/$
v!=I83&
-Vi/d+Z
V[IGHE
Virt.=i
VirtualAlloc
VirtualFree
VirtualProtect
Visibl
}.vk42E, j
V-k)~D!
v:L*y8
vmg+$@
v#NIu:
!{(v_p
VPB8	.0@
V(PPEb
VpQ&S<'
V;:QQ744Q:D@@
v:qx5h
Vr O? 
vrr|xt
v!}s$E
|}V{Tl
+/V-TQO(IB
<Vu0*N
_V\[#Ufgb
vu{Op4
{vww7vww
Vww?fY
:V(x"{ZM
w0B|I#U7N
w~3I*1G
w^422HH
w>4>?W
W-5^`Y!
)w+999+
WAM/PM
wAnZR 
wAoross&%
!WBaidu
W&b"ff
wbI2AKF
]W~,c-`@
wCLr!S
|W:d4ShKl
/WedhuFrI
wEHeapO.
W*e-nos
Wf&b%9
Wheeli
whK@RxOum
Windows
_WINHELP
,wis rq Z
@w]lN %
WMal`T
.wmf.t
|W'nj\
)wo]2!
w#qI0Z
wr""/p
>WRR]R
WSpoo&^
w "sup
{;w$t|
WUA>ZT
W..|Uzuk[
wV0043
(%W%V%7
{W/(wa
WWH=LB#`
[w\ w},qh
wwwwwwww
wwwwwwwxp
$W"w'x
WXen/A
wX%q%q%q
wxr""/p
wXS3XP
WYe9NB
w	z@+x
X+.&\_
X1\Vi#Dr
{X3#NFX
x4'5pxX:
X5{ov\
X'7, */*/&
x9999tpl
|x9999tplh9999d`\X
xaah{$~
X_a/Qk#X
XAW=cEA=UT7
XcNL<A
xd,\'*,
#X#DEX
X{Dv$*kE|-
xffbC'
X H9'{
xh{)*C?
Xj58|9x%
	xJt4[
x@@Kw)
X{l"*3
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
X MSWHEEL
	Xo`"A
XorCmp4FromSt*J
X+Pj,A
Xpl@Lr
XPTPSW
#x/q/2
xqa^Z 
xr"':r
?:X?s&
{(x^_Sh
xtheme
|''''xtpl''''hd`\''''XTPL''''HD@<''''840,''''($ 
x.uv[p?
){X<W1&
*x%W#2"33
X%W%V#
X%W%Wp
^XXioE
X'*%xp
xx<Sr!
xxxsssi
:\xYDmu
:X?YSx$#
Xy}y0"
[XZj0\
y*0_`$F
Y3aHwP]
y3ffff
Y*442A5
Y4A	Yi^y
!&y5L-X!
Y6fLFj
y6H +@
)y@6XU
Y@7:Cc:
}*y<{8
ya_KF>
ybG7iI	XP
}yb%sK
ycLong
&YD@%+
yDAq&YR
yDLT\d
ydsaflt=l01zSX
Yellow
Yg.4,*
Y{iIGH
=$Y%l3
<Ymckh
,yooAn
y;s+$h	f
YSU<HtH
ytqQ$+U
yTznsp
|Yu$ i;
yu+Mrk
y	VLengt&
=Yw0p;
yW3#2%
yWMLSRRQQRSM{
(y"X5`YyR
yx86;_
/y~x'?H
YXNaa~
yYQ 7S
yyvvy|v
Y	YY0SM
YYY775
,=yz&EV
z0&[K~\
[_Z0Od
z=;842
Z8fg1tz W
ZC(CHoZt
"*Z,c,Z/X
~Ze3a6p
$	(zEe4!X
%_z=F8W
ZG8vRr
z+G"bX^P
zgE<b$G
z:<h(c
 zHDF<
-ZHZER
$z.	I*G&
,ZLLa8
z[L!U|
Zms4s_p
z"o0S[
z'p#^ 
*@<zp0$
z\P6<U
}_ZP(b.
`zPlmt
ZP' th
[ZQgcx
ZSw B) 
ZT`m H
ZTUWVSpp
z:uVD%
z%w&{'|
[ZWfnk
Z#Wmp`('
ZXhaMOS
&zY=mg{_
']\[ZY/US*(%F
^zz111
^zz1111
^zz1111M
^zz1111MM
zz1111MMM
$.ZZZTZ