Analysis Date2014-08-02 23:30:32
MD5bcfc82cc1a1491915b42055c83cbe213
SHA1cd36d8f4b9dcf58734f7757e957018536a12c54e

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
SectionCODE md5: 07f444205f1a50b292507ffabe5d505f sha1: 6cc7449102739f214795667adb401bc80b1e3b4d size: 90624
SectionDATA md5: 8b6e221bf51b5773c276c32566c4de79 sha1: 6100e3f775e3a31afae0b0d3c183a11bd57b2611 size: 1536
SectionBSS md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Section.idata md5: d763533a99942bcd3858f01d84066b79 sha1: 12daa6f0aa8e08ee6c6b1af0a8e9c16c35ab65c0 size: 3584
Section.tls md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Section.rdata md5: fc9c8613a402c85ee1a121781bf2d309 sha1: abe611db8539816bc69bb706b75fb95dc596d302 size: 512
Section.reloc md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Section.rsrc md5: b1c7d971c539c3fd9ed377547cc99b6f sha1: cd7b08a2bf1409480deaa5e6fbd5859d3ad49e09 size: 30720
Section.aspack md5: 1b3f303fe57b53d4ed819199c52b6f42 sha1: f1f04a2146f7ae17f498cee498b739d6f5ef994b size: 6144
Section.data md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Timestamp1992-06-19 22:22:17
PackerASPack v2.11
PEhash653bbffaa608fa30914cd83ac97c3b830e7c57bb
IMPhashf195d34154809e37a65822014b2973fe
AV360 SafeWin32.Worm.Benjamin.A
AVAd-AwareWin32.Worm.Benjamin.A
AVAlwil (avast)Benjamin:Win32:Benjamin
AVArcabit (arcavir)P2P.Worm.Benjamin.a
AVAuthentiumW32/Benjamin.A@mm
AVAvira (antivir)Worm/Kazaa
AVCA (E-Trust Ino)Win32/Benjamin
AVCAT (quickheal)W32.Benjamin
AVClamAVWorm.Kazaa
AVDr. WebWin32.HLLW.Benjamin
AVEmsisoftWin32.Worm.Benjamin.A
AVEset (nod32)Win32/Kazaa.Benjamin worm
AVFortinetW32/Benjamin.A@mm
AVFrisk (f-prot)W32/Benjamin.A@mm
AVF-SecureWin32.Worm.Benjamin.A
AVGrisoft (avg)Collected_c.BHIQ
AVIkarusP2P-Worm.Win32.Benjamin.a
AVK7Trojan ( 00005e8c1 )
AVKasperskyP2P-Worm.Win32.Benjamin.a
AVMalwareBytesWorm.Benjamin
AVMcafeeW32/Benjamin.worm
AVMicrosoft Security Essentialsno_virus
AVMicroWorld (escan)Win32.Worm.Benjamin.A
AVNormandoslegacy/Benjamin.A
AVRisingWorm.Kazaa
AVSophosW32/Benjamin-A
AVSymantecW32.Benjamin.Worm
AVTrend MicroWORM_BENJAMIN.A
AVVirusBlokAda (vba32)Worm.Benjamin

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\syscod ➝
000A53D026300089FE0347
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System-Service ➝
C:\WINDOWS\SYSTEM\EXPLORER.SCR
Creates FileC:\WINDOWS\temp\sys32\$30 FOR FREE .exe
Creates FileC:\WINDOWS\temp\sys32\0.scr
Creates FileC:\WINDOWS\temp\sys32\$2.scr
Creates FileC:\WINDOWS\temp\sys32\$30 FOR FREE.scr
Creates FileC:\WINDOWS\SYSTEM\EXPLORER.SCR
Creates FileC:\WINDOWS\temp\sys32\0 .exe
Creates FileC:\WINDOWS\temp\sys32\$$FREE$$ .exe
Creates FileC:\WINDOWS\temp\sys32\$1 .exe
Creates FileC:\WINDOWS\temp\sys32\$30.scr
Creates FileC:\WINDOWS\temp\sys32\10000 .exe
Creates FileC:\WINDOWS\temp\sys32\10000.scr
Creates FileC:\WINDOWS\temp\sys32\1.scr
Creates FileC:\WINDOWS\temp\sys32\$30 .exe
Creates FileC:\WINDOWS\temp\sys32\$$FREE$$.scr
Creates FileC:\WINDOWS\temp\sys32\$2 .exe
Creates FileC:\WINDOWS\temp\sys32\$1.scr
Creates FileC:\WINDOWS\temp\sys32\1 .exe
Creates FileC:\WINDOWS\temp\sys32\100000.scr

Network Details:

DNSyahoo.com
Type: A
206.190.36.45
DNSyahoo.com
Type: A
98.139.183.24
DNSyahoo.com
Type: A
98.138.253.109

Raw Pcap

Strings
.
.1
eAi
..
...Q.
..
DVCLAL
MAINICON
PACKAGEINFO
TFORM1
^_`*/(,
00I~Z~,
03%)~z
\04UEw
0,6/t]
07\obeIx
 (08@P`p
0H-_T50
0L'jt^
0\~ nf/QJ)
0Ocu?_
0pZIRT
0Qv`4!OW
0SM\Z	
/0s$,Up{
0'%sx_
{0S;X3
0/T04i
0&tXq%8
0)vD]f
0vL3Nhe
0vLg;8
0wzyD!a
0xF]vO4T
0xlw5j
]\0Z,:
0z7Ak8
1_2aIDLt
{{13`Q
14cbd<o
>16.ai;xqF
@}^1#B
,1c3"%
1Cf%;0
1#F(Wy
1FZ94,
1~'G@irH
`1Gm}1
1i4X$\
>1i;K-I5mJ|
1iV+%\[
1jxrxp
/1?Kkp
+@1)"l
1LbhZ',%P
>1lQdml
1n},|WP;
=1/oWS
1PC[=I
1%%(pM
1%p[w\
1\qpN!
1,qq&6
|1R{{X
1%u,Y@
21	VJl
2+8E\{
28m,nP
2"'&9Q
2;9QSnuE
2_B6z,6
2cH`sc
2c'(!k@
2dhI:Y
{?2dS*}q0Y
2eK*I(
2FEew(Jn!
=2J'98
.2}jbn
2_jO.n>
2l6No3}
:2l_F6b
2+N/aB
2nS	Fh
2P4NbH
2%&-@q
2-QKj:3)
2R"gmd
2?r:h#
2UbF(2$
2$U/<F
2{ufT4Q
2`>ugt
2{x	'J
2%Yku;!
2*z.:8
2ZKYe>lZKm
""&	=3$
3|1K/F
33	ku@&`
36g(	,
#3`7z}T
 38=\@2pm
+396zP
3|a7p H
3b_am1
3c0$<^
:3c3nAm
3(C OQ
3ef)xR
3~EJa]WxS.)
3!e|Je
;3f,_*#
$3.F 7
3`fO:\s`
3+G-V:
$	3HQUT
\3i2&lm
[ $3iU
3iZ?M.X
3)JBEf
/3 jVcS=*
>3%K #]
3K^*6+
3L\lf8zT
"3M4a'
3M\LKe
+3/]n4
\<3ps?x
3pv_b}
 3)Q\4
3.&Q*4
3'~Rk&
,3S}yF
3!TM[c
,3TUv{
#3uV7f
3UwF6r'a
3v10IZ
3vuKzM
3XP4d}d`*
3yQw\_
3_?+zUO
4%@1y<Re<E{
4%25|4
4~a8)u5
4AxP\]_Ov#
 4.B*&-
)4.b6a
	:4BXf
4d1QV&
4E?lYq
4fo}NO
4FR/7|R
&&=4$h
4HEb	s
"4Hhmt\
4=i88[z
4i_	u&D
4,J)<hW
}4kCR)
	4/mh#
4O>	3~
4or<0c
|4q{([
4Q* E*
4qva'4_p
4sL`n1
4V!_*,
,4v_k!%x
4}vL,(
4v[X-AVF
4w#4XX>
4'WB+^\
4w~wK4{<
4;x_ba
?4:)YC
5~|{"]
50-RRZ[
5+1vwD
5<;)?2
$?52AK
54iy0:
>55A-!
%56kiGZyl
56nRm]
5B-V0D
@5Eq v#
5# [fl
5G QDR
5H adz
5{-H";g*
5hux''
5jF"^z
*5;JN"B
5^_JS"
5_j@SL y
5ki)jXJ
5M0g,eu!.J
%#5NjT
~>5oss
|5PG6R
5q48_T
5,]!qY
5 :R6]`
{~5S9mNU
5	/S_k.z
5=[[	T
5_	$$U
5U8\$Rl
5@[V1-
5|Wtj$
5xGI4;8
@5YG$o
5Z}nlB
5zQ[9f
5Z:]Yv
63o!gF
64"Ub8
6@4 ~VB
6a6E:S
6b#"d d,
6Dy@@7
6$(E%G
6FVL7FXA#
6:GsZ|{
6inF|Fh
6J>	(;8
++|#6l
6L]M<k}
6mB9OvG
!6MBXg
+6nHq_<
]6o2`2>
6OeDF6
6<oG=#
6owcg[
!6\*S&
6'to=j
6U:]^^
6UMs	B
&6uN@B
>"6`v4
,6`Vc0
6:vc2n
<6v^lx31
6WH>L	OR/
6y'^kV
72%]Fr"
754}{n"2
78\8Cl
"78P:Df
79a7a9O
79*V!u
\@7A3"-t
7a<5xz'2
/(7aPB
*7@arr
<7B$Bc
;7{b%M
7Br\g`_
7Cn	*;
7cNnLdd
7*dL7.
7D@_nY
7E`-7O
]7eP/	
7e*^t1=
>7"(@H
7I,tl|{
7*j&> w
7@Lo|t&
(7P\k'
7~?PpEp
7PXor@}
~)7Q-k
7.RXZ)f
7tK(KIV
-7'u)v:]28)Lr\^
)7W/Fo
7'WG8&
7WNc6Y/
7W)_ <t}
7~|Y5`
7zvqb^^b
81AgR\s
!83Vf6
[8413t
8\5Wo$
86e#V^|s
8a'O`^X
{8!ast
8<b7}3
8bpP>I+
)8EE^F
8f* =C
#8G,zt
,8?{J2
8jt}ZS
8.L2g]H\
8m^vkQ
|8m}}Y
@8nlq\
8O9l--
,8OpK+
8pBd.Bq
8|Qh{n
8_r KF{
8~(s<x5
8sY @p$
8tiQH`
8t^uey
8"=\V?
8VYD6m
+!"8ww
8X/&}z
*8y>cG
<9(-1C
9,<6_+
97groyd
9A!A-CpP
9b1-w'0
9 B)fw) 
9BU]}0 
9B#u*q,
9%c8sVVX+'
9_Cm2v?
:9C~)o0G
9%DX0"
9fH\_HT@
9[F&xs-
9\juA_}
`9kCn2/`:
9lTO F<
(9M|!{F
9Mqo'!
&9/Nxm
9Ow1J$
)9*q3q
9R-Q\-
9t6uqW+&
9@&@TM
9}vVix?
9V|`Ys
9wG_s\
9w'TO3
!9W[v3al
9)+XZ=*
9Zi^zT
9!Zm!4x
~!9z*p
9zti^)Cr
#=a,?#'%+
[a)&2i
A!2p'TDo
a3]Qa4
,A(&6f^>
A]6}FpO
A6'JcE
A7f@&#k
A`7hLv,
a7t~mw
a"8657
 a.}9#
aACDS@
AAdZwD
Aa"IQ4
aBKm40
^a:c7j
)Aca[K
a/&d'04|
A^/DHJ
a~DnkQ
advapi32.dll
}a,{:e+
A;=E/	=5
\afB	_
-a]G5a
A"GbFC
agNc6N
agw{MC
AH+Hd9
aHl^!^W"
aH'oTeN
{^aIa-
aiQ*Sat"
A;jf+d
(aJNb]
a={+j;_#T
aJzT[a
~a=`Kg
aKQ9^1
a]l{Id
A`lz^W
am86[;
aM>Hi`9$CD^
A`mI:r
A:n!3?l
aNar$k:
aO|w7I
AP_|kI
Aq25Mqt
.a+rZ@n
As$2[,
.aspack
*A-s[~TRd
aTcl0m
a[tEH`
At'Sj{
A]U#q+j
{a%urL}=
a>vlN)W
a>VUdh5
+ax4<9
a^XFNCVQ
aXJ0H.
ay]a4l
AYk=Fh
ayq\5#
b_0E7Z
b[0`i@
b0O7NVZ
(b0yw;
b2gjNF
B>5%BP
-b5$pF
B5UARE
b<@5w_
B#7-g+
b&"#8k:
BAEEWZG
b!#a~F
bDgF;.=
}^bDjpW
Be?GDz
.B.}]F
B\f%gI
BGxP0A7
Bh\7` 
b#ixxh
%_b_J`
~bjn1|*P(g
%b>Kb[d
BkL#J}H
}B!Lp9
B <Lze
	bma* 0
Bm:qt~
BnD(v#
B&nHo@o
B:N`iR
>bn #n
BN@!&y~A
;<b)OaF1
 B?p,iD<
.bQ:)a+
b=!qt;30m[
b};qZT
br[`Pq
=bRV|@
^b'^RY
Bs99KW
BSb?5rsq
Bsl4{O!q
)[Bt<'C
B=UOtUtcPQ
BVfJLt
\bWA)+
b'|w'B
b:_wLj
(BwM\z
B*,{WNtT
\{Bwqi
by}{d"
byy:0e
 b)&zubNj
.:),\C	
[^-~c0M
C2k,D_
}c#3Y2u
C4Gq)l*
`C52.W
[c7xlQ
c~8=fj
c'8t(q
C\@9d6
c@9HD{
C'/9t=
]C<|B'
CbC=p$ 
cc~Iha'h
cCX"Fq
cD{.4|
/C^\DB%
c}{DG\
cdhG=~
C(e#>.qP]
C-G{A>#
c=G`~n
ch8l?8
CH$BQ\
/cHtM-{
ci==cK
ciF]Lxe
Ci}K~&
cIz#oN
C&$.j,L"	
CkD]PG
cLcSsif
clfH,g
CLqm(R
CL_r8(
cM0'8fO
="Cmo8h
cNx~lN
comctl32.dll
CoUninitialize
#cqHG9
CqIUCf
;+C$q\o
cqqgiz
cQzg. 
CRAH5-
c)Ri94{
CsCSCcIy
CsJ<L{
CSX-(D
~@CThk$[
CTkyf(
-;	"cu
cu(a1+/
C)Up9dO
_Cur]w
$cu!Tb
&CuUL=
CUz\B2Ne
\~CV2OW
c:<|vN
`cvQJJ
cw%=oq
Cx0IN6
|C"&y#
Cy6*PB
CY\bJC
=CyqP}Pv-
	cYZB{5
CZ=ah53
>\^C(ZI
c|zI*}j(
-cZNO}mP
"\czSb
-CzzzmZ7
D0*7^U
(d:+2Z
D3wwww
d4dzC(
"d<6@=ES$]
D8x	JaKL{
D:9>GAs*
@~D[[A|
D}a-/h+
DamqME{
=dAWb?
#D-b7F
DC^,ka
D:C[Q>gI
'ddn>u9
dFZ6S3
<DI+H8
,'d!J<;!
dJI+['
DJ%)u4M(
d/LXb5
|@;d\N
#D;NhhC^
"]d$p,
d|~pkN
DP[nmv
DP`So)
dQ{2C@
DQ+j)F
>dqMi1N
).Dq Sb
dR7EcZF
=drfvr
D	rWNo$
DS2[l 
Ds#LyC
DuA?})
DuUw`e
dVVP.LaBl
Dv$X-f?C<
-DWA\Z
d]wEgaF
D.wI+>
dx[0'<<
d^Ybk|]C-
'DyZu`
d,)z[b
d&zGOT+
dZ|WEF
dzzsbut
E[0HlbG
E1=mou
E$;-{2%
E2r2k,
e2W]`a
&.e3.k
?'E?3m
e4<AQI~#
E5J5z1
E)>5jA
*!(e5x$
e7`iB!u;~
e7[xb'
e8Dj<w0o
?~e^8F
_e8Tj\]c
E8<zN'
Ee^9ux
e.F5q>
E.fj`{
egKC)w#
e;g+p6
EH3'>&
*}eHK}
EH,u]<
E>I"IL
eJ%&8"0x
ej`,/]U
E!.j;z
e}}KKm
eKv`Vl%
ELC:1k
eLiUXU
^e|mHT
E_m&iS
e:MJ~A
em)$RH<
EMUs,S
engjLb`27
EN%|>H
\-EoJp[A
{ePCjJ
ep<Oj/CX
(ePxGk
erJ7SlZ
?eR-q&W=s
-E@|s^
ES@5UD
e>s?M,b
`E	S@o-
EsO`vf
esP-Q')
~ ~esZ\
et|+YC
e'uAVbo^
EU~ :b
EUKEC	
Ev`6j[
%e}vM$
$>evP7
EWBfU(
EwIm	T>
ExitProcess
 e:XjIl
{E?y;0Y
EYk6|@
Ey&{ky
>EYP{Sg
eySgtS
E"zcI*
.ez;EL
"EzgpQ
EZJKyO
eZ%yAN
F0Ed+yys
]F0N_L
<f0tX.
:_<F;2.
F3h^M6e
%f3qV^
`}F3Sg
f5D{$?
F!5@_KS
f7l0!8
.f*9;'
{F[9R;
"|${f]A
f.A4|!N
-F!aqH2
.@FA}w
F;B1]A
%FBjC-}
F)bX:KA
F!'/Ct
f@D!Ag
FDa!-S
FdJBU[
Fetv7'0
FFW*6)
fGwzE4
fiJNS_
"FJ*9^
_fk\7lB?
;fl2|h(
!Fl6:p
Fl8qd6
(^FMWA
$"FnjC
?f`]+o
F$\oI;
!+Foiu
Fo(}J!x
fPBh 8
fPBIR8w
fPOldc
fp#}TEO$
F{r[\~
f>R5E}i
%FRB7~7aIx
f!\$![s
<FS3/t
|Fs%nt
fSXj{3r
^FtvpQ'z
'fuFx_
fu;Jn~
>;f#V)/
Fv|2!z9
f%w*;+
FW[#eq'\
FW"zal
F:>xLC
fX*%Tp
FY0e!i
fY]B_]
F&yc~6
Fy,{ji
fZh5UY{UB
fZTvet
FzU%^l
" g0_'F
'*:G2C
G3*It&
G3q6FJ
G}8N+i
G8s=;m
g9YW@|H$[
::GA(F^
G>a+hr&C
ga(k,%
gal)qQEy
G=,aP##dm
>gb-)E
gbfT5dFN
g.bp-u
Gc7	G_
GcIa"P
<G^[CV	
^g{d58
gdi32.dll
Gd-s4'
Ge#2Ok
GetErrorInfo
GetKeyboardType
GetModuleHandleA
GetProcAddress
(gE@u1
,g&fz	N
G~G6C5
#gG_Ftk
g/G.n!
GH|}]}
g *%HC
`GhH2T
&_}GHi
g.IUB!1Ip
<GJGo2
*GK{>/
	GK6qZ4n
Gk%8V:o{>
gk--a?#V
#;GKM/=;
!GKM~t
g&KRdQ
gKvcT$
g^L3rs
GM6iA7+w
gm>(k	
$gmxF6
?\gNEgqkv
{GnHtH
~gnjeq7
GNM?E;
!g!^ob
%goXH,
 G}pyw
#@]gQ	
gQV;Wk
@)]gr#
+GR+F*
^g]+rI
gS;p?$=
gthtzX
_G t.x
GTZ1*f
G\U9	Y
	G_UAK
g%uj]Dh
gWx	pW
g?$`Xk
GzbY|?hgX
GzhVW~
`gZO>h
gZq@_^;
H1JfLt
~H2GHgA
H34iWF
H3<$Iy
H3+NDJ
H3:,:y
H49Qvx
H6}$k>
-h%7|_
hAC+:9s
hB@"4-
*h}b5"|
hb-T@+[]
H::b=u3` 
h^"?c5
}HCKx/
hCL$Pq
HD.4~2
hdCd<3
hdcr"H
,HDm6$
~HE)G"H
<;h_F-}
hF,d!S>
hFh/-_
hfplcI[Z?0
h,]GN/
HgN	M]
:/>hh$
:hH+$(5
^h#,Hb*
h,+}!hm
hH'!ol
|;HIJ)kxJp
hiX=hh
=hi:]z
:HizF=
hK"1HOp
hl9qXY?
hlN,_v
hL[Ww1y
HLX{YW
h*-#M|m
hm[NxH
;]Hmo&
HMq=}?D
Hnd!9ia&
hnIy>1
(hNp_xN
ho6`LY~
"hO"Xj
H;-p`h
#hP+jo+
<hP!o}E
h|qiA0
/hq!P7
H>rE5j
Huu?Q~;
 h?*v@
H:>v,F
hv|n6z
H)Vr MO
H'w.lK
H:x{!2
H}XL}+
(H+Y[5
hY{9]W
h=zapn
HzeP	%2
hZO}*CO
Hz-q}$
%i#'"	
&i[1)	
 i2	{{
i3ma4.
i+/-48
i4B/8?.
[i{=5^
I5]>aY
'/I5bS
i5p'ub
I5,q@$
I7V\A_
i9_cDW
IA0?;]!K
IaooTL
IAqQG7
-i<$(b4
i$~B8?i~
ib_cAV8T
ibF|~ZNG
I_bM0t
IBppin
iC77Z<	
I'D7j!N
.idata
I|EA=cj
ieRYI%
)I,gnh
i <<J)
I~JLJl^YV
iJ-"&Q
*Ik<20dz
-I.l/[
i|,L5^
IL[iOr
ImageList_GetDragImage
Imr`pc
iM?W\&6
_imy:E
[io9~v
:I!oTi6
I,p5ee[
Ipp1a9U
\iP*Y t
Iq#{bzU
IR7}6z
}i`rpKi
:isz:K
It)%.a:<
IT];uw
&)Iu4B
I*UlN:JY3
iu\v]_
iUWU|v
i\}+v]
IvA\o3
'ivi:8
`@_iw|
I~w@b(
I&w_nG
iXA5lw
i][xakp
i"X^N4
ixOGgqG
ixza[P|
'[I}y~
iy\p:/
iYROv2
i*?"`yt
Iz"dq$
+J"~;!^
j!0#bi
<J0mrUr
j;2$@.
J3i8E[*+
j_3Zwmba!
J}4'y6]
;J5+B^
j7;W%+
.J`8}0
j9c"kb
#*J-A^
JA>@zF
~Jb|`=_F	_
:Jb@lEcZ
jbp-Up
J~`c.[
#jD	@(
jEI`w6G
`JeME]
je<x27
JFEj_Tl
JFe-	S
jFYr@i
jGiA8705'
jHBI?2
j\Hmu:=>X
`j	~~i
"ji7U<
J}IT=M
JKf6}S
%JKu=D
Jk`/=y
(jlC,H
-@?j`M
jm.m;2
&[jN"f(
;jnF*2
J-o\LC6
joT}W!+
JO"v	=
J,Qh6T
J*q:jnMq
JR	L)[e
JRSZO'&Z
jS*N=8RWI
`$&jtd
JTE=J/
J/+-V"
Jv[}xG
|=j:wgD
"~JWxo
JXB,I4
[JysO3r
,jznve
j\z"RD_v
~k%0c~
K+@1nY
K2}sJ)ED
)K3"%'
k)3QUC
<K5TQon
k6n$	F
K7;<Y$,
K8h__	
kA>e,~"
 k"?a^t
*Kb?Gd!
kb-k-$g;
#^[kbS
K|C1(55bX)
_KC+bW
Kdfg_	
k#d_'N
kernel32.dll
Kern:L
	kFE6'
Kg:C<B,
=KGD?1
kH2R4bnh
Kh2Yud
Kh3:T-
K[I3lu9
Kij|ysK*
]?k:J+
kjJpRRX/A
|kJN2r
kj./]o
kJQ=<o
:kj<=s
~k"k(1D/
k>KEsI
KKhN<1
kkxlpd
@Kl;6P@-y
,KL+7V
}=KLEw
K:l+`H
Kmx>4e
KOwtrg
		K<PJ
 k?&^qz
+KsgEE
k	T$zX
)kUJ}t
/ku:^|Y
}KX6.?D
)kx.8B
K(X{LF
kyBL!7
kynw^'
K!z9Dh
kzXu3C
'L.>1i
.L)@1m
L[1wR9X
L3/,`O
%l43Q6
/`l4KLT
+L5U	lM`
^L7D2z
l:}80w
L8JFi_3
L_^,*9~
{"l9R,
La0ci	*H
{LAQ 5
l B?G{
lbJoH6f
lB,O8i!D
lByva=S
])lccqDd
;LcYg=
ld[ENmE
%l&dFj
ldX-||
;lEKW?
Lf4`,A=
lFEiSw
l=(fFe
lf	\Ft9~
|lFhXJ
L<f/ P
`!l.+gD
l>gk<QP
$l@G:N
({lh1/
]$(L?H?(A
lHo-\	
Lh>t	,
L[HWzK
]!}Li3G
l=ipDK
Lj'3CG
lJggdZN%
/#=Lj+j
*LJ\Z3!FJ
lK:Bv5H*Y=
_&LKG	qM
l\lFyK
LOADER ERROR
LoadLibraryA
loMkIv
_&LONV
LqfeA5
#lq'oK
lr-,K*
Lr<qi+
l*s p'i)
-"{lt2
+LT"{l"
Lu3zHd
l)UdG7
l usFo
:-lV9%3
'--L;-!w
l=$waW
l\wFwvt
<~%LX/jo
L|Y@we `
l+)%zC
);M1I#{
M1Q?6@
M"\1T8
m2<Mb?Q.
m4G{@%P
\ M60e
m68src
m$6hL?5=+p
M6tR6p o
M@6ykt
M\8H" B>
m~9JL<
M#ac46
mAg<vn
M/AOc}
m@Ap0B
mb39}N 
M~b)xz
m^CG{QjYS
Mcj3].
M(cy*s!
M#?^#D
MessageBoxA
|&m`~f+
{+m/F`I
'`m}fLH
mg}RB^
m J\)Ov+$
.&[m'M
[M{mfD~g;
m mG,LJ
mMICrz
mMnCq=,
$m#]MS7,
M\!/N>K	
Mnm!I-|
.m}o9Db=
&moJ(y
`"MO^O
Mo`S{@Q
*m|PWT
mPx%eC7 
MR7s%\v
MRKD^P>C
~mR%$w,vU
MshEO/
M^Sn7s
mS_tOu
{<MtICs6
M`TkO>
>MTm'fRp6|q
m:TToh.
MuCL(r
)#M[ufY
?@mUp]
MV_[>L
Mvn^nk
?M]Vp%
;mVpE`=
MwcA	C
mWlVg'
$mwMrn*N
!%Mx2Rn`9
],M'Xk
mY+=28
my	MDe
.=<N&?|~ 
/=n0H6
+$N0P^
N0w-N(	?
n38>+k
n,.3%N
#n4|N[Dj
n4/}PpH`
n5K}b!
N6`ZEy
n7.0P%
N"7/r	
N"8?t#l
N 8z,_
N9@:'64
?{:N9BK
N>Abq}
N|>_~b
nB,Aj<5
nBf~pR
nC6:af6
N@coxv.
ND5Sh03
(N%dAjq
n`e)eE
 n%"E#Q
nE>>r_HNp<
NFBreA'&
'NgS>n
NHc`}w
N#ht.E
N,I+tT
;nj#F|
Nj':fZ
Nj.v(7
n:"":K0
nk6~*#
`NKO()Y
`N+k<Q
%n(l}$
;[n	Lg!^
N+l^H\
_N|-'LQ
N)lr\&
Nm4Gjb7l
nmN|ap
NnX|D\
,/n-[^O5
N;|o`d
.)*(nP
n:=pd)
n=@\Qv
n.=/.[	R
"%N@S`
NsYLFa
n+uP`'
nUPuu'
&N).Ur
+NurpDBB
nu=>wp
nV=#et2V
NVmwrj
N=:VsD
>}nvu1
Nvx@5G&-
NWXj|S
nXe.AT
nxhTAx
nX%(Zu
ny?7FW%,
nydE{b,Q
ny)WBq
o_'\^@
o!:)>}
o*1-vH
o2J'qI=
@O483mx
O4Jc8Ynu
?o;,58
O6,J1:Y
O]}!7q
`o8A'y
OA\b;wp
o$A{I<m;c
~oao9]{o
o,AsJX
-,ob|{
O<_c/^
#:OC&@
)o="CH
ocJp/I
o:c!Z6t}
.O@";D
"od7P0
oDbl B
o=$EA)W2t
[O'EbI
	OE?K.E$
OfPWpjW
oFr]@{
*+O<GC
]o#g,dY+
oH'_aW
o-^;hc<~
,oHhP6
O>?Hnv
 ;+o#h_tVB
o*Hw~H
OhXW-y
oh";zWn(
,o iYI
{.oJ<DU
;oJf/-
@ojo.K
okNFx- T
oKow%PwU
*oL	a'
OLdP(QO
ole32.dll
oleaut32.dll
!o+Mk5
;oN6eHO
ONedwRc
|O^nZ!
|oNZ&S
O=O,	Q
OO'?Ra
op0\i1
op|4>6
Opv`jTTv
OpXX~|
{@@oQL
O=Q&,P
oR!Iy0
o'rR*C
o&r(>TV
O;rXq	
OS	#&,
os:45I
~+ OsE
OS.xOof
'?/otf
,otR(i#
| OUvY
OU_{WUr
 *ov	4
OVB832
O>VlaF
<oY2O0
ozgn7F
OzO^4R7
p~'0OF
p[0,UH
P2q9 *
<|p+3)
p3>`f{
p3/#O4
_P	4:|
-/*P6)
P	/<6 
p{6gW:hb6D
p9aHK.5
P-aQHa
PasqQo`
@!p(b9
PbfD?cNg
p \BP1D3
^Pb-'T
pcKi?4(A
\p-=cT,N
'Pdj6x
PDMHeM
PdUT'}
PeE*y\
}\PegM~xNl
+&Pe[Gq
P	e%oG
$pFG3m
PF'j6Y
PfJ*Hh
p}/G	`
Pgjwfu
pg`U9_K
p<gX'Z;
=p|H0AXb+
PhrDfD
PhW=*~
P:I1iz
PipZqd
pIWisM]
>+ /pJ
"PjR1<'
Pj!Vgr+R
pKF:cM
PKLqXM
PlaCQS>:
p@mDrg+
_[\%pn
P{o$r\
Pox-ua
[Pq,Wl
PrIIX-?
pR]kQU
pr<vbT
PR#Zu?B
pS#m5b
p[SR""
p?SU[7
<-PtdC
"P_U:_
{pU0z9k9%
PU=_xTg
PuZA~%
PVd~U/
PV+VRmT[
Pvx){D
p-v)`z
['P`w+
($	)Pw8
\PW,sf
_]P)~wW
Px<Fg(
:pXK6-
<P;xw}Lf
@"pz]8
$,Q0?CG
q<1HT?q^
_q38v,Yg%0
q?3C}#:
Q5:~Z`
%(&q6Yq
q9%CV6
qA5g9`=
qAd.$cN
Qa=r9 
qb0`I)
qbe"m!
qb*kE[
-QbSc'
qC22^&
QcL*vo
qDnu/M
Q\d{Tki,>
QfCO/cq4{
qFid#A
qF.P?C
qg]^{cqm
q%hELI
qHj~OO'
Q}hu?14
Q^i|>m
qlO{i[
%Q\MB$
q@"mI+
qMqv$l
^%"q&N
qN;?<-
<$|Qn;
qNW0{PM8
qoTuW6
q"-qtf
qR4[KY
qr~:NL
Qr.NR5
QrVmG8
qt_&)N,
;qTNfw
q,t'p}
Q<(`>UN
QV1lW(w
Q(<#VD
q.VH(A
.QVUY6
Qwf$%u
qXGuWVl
qXtzer
q	Y+Q5
QYwB??
/qzWG(4
+:R`!@
R4tHTM
R5o%og8
=R#?#<6
r6nHiv
R7:8q-
R7o @2C
R7ZfP|
r8|I8):Z
r@8"r;
^R9}8!
R9KX)rxt
r9nkJQ:
Raq6tsz
r\bK#Y
RBoqqt
rB\YG 
]RC>UV
@RCZWP
.rdata
#-REBu
RegQueryValueExA
RegSetValueExA
.reloc
:reX;66
R{FG|Q>
rH.$or)
Rjb4=?
^R}~k,
RkR K%
Rl*"A16
]rL-}r
rL]:y9
Rm5v)A
)\#/rN
RN<{OQ
rNS4i_
RNTrlj3
Ro)2I1
#ROJeD
rPB^Su
_RT}gK
rtzPVp
RU4!rN
-rU<s9
~rXeFb:
/rxI#h%
>rXIyD
r}Y[d--8
r<ysk!M
RzEk,r
{?~ +S
S1!]N2
S3RoE*
^s$3s%
s_4Xn,
S~[>5H
S6{sgb
.s^8:|
!S9JZ]SNnz1T;
sal.ps
SA>o3YY
sbALp9
S:BK^%
SB/y2lw
sc.|8P4R
sd9C`e
\sDG_-B
]_S$DS-M\
S;d[:V#`
sev_D'
#=SgSF
SgTv#+y
shell32.dll
ShellExecuteA
s^hXcN
S*!%I*2
(SI*d[
.S&JVa\G
sl1!k$6
`SlD8+V
s!L&Lt
!_SL&T
"\SM1/
Smff(7
snQyUoe
snYxY)
S.P[BP
^S-pnP
#"SpW`7
Sq0"'H
>Sq\82_
S,&q%pZ
s"r7vT
sRxQ)L?
SR}z/9
..~S_S
s]S	D]G
?s\Sg3G
S(s?K%heGl
S{[U<>"
*Su>a~{
#Sud$_k
+sUg,l
[sU!Mj
+!suOt>
Sv3G~U
S V@bn
"SV}WUo
^%#S"$w
S&-;wx
S >\X/
SX!(#Gx
s'xTg=
SY>RPs
syVBDte!
Sy>yKmQY
S#'Zig
)	szUz
t0	'm-7
,T]^2]!
T3=i%y0
t>4Ic&
*%	T]?5
T:684e
t6-|\GUI
T7;d K
@T8DE[o
,\t9_R}
]t!a'6FO
T.a(X;
_tB%}*
)Tb)#D
!tbg(A
tBmQ)VK
Tc4$`&`
tCqFK&
tE=ACT)
[TEp,R
t~]Fcv
tFd&zs=c
'tfehSG
Tfh,D@
TF:?pX
TgL%y8
TgoJ4	]
TG&PGB
The ordinal %u could not be located in the dynamic link library %s
The procedure entry point %s could not be located in the dynamic link library %s
t///Hh
This program must be run under Win32
t#H(j:
timeKillEvent
TIoQhgD
t`IR-Xj {
\tj/,eR
TjI#\>
t,JTX2o`
tl3GO=
tLl\ZZ&x
);Tl/!m_&
t]MXn%6g
TNlZQ@
TnoZ<5s"
TNZC<F
topQ>kA!!
tP"2BO
Tp %*5
t@q5C%)	
t@^Q7u
Tqr~V'
")@t(R
Tr8XC=YPh
TR9O X
TRFY}$#
,~trQLSK
Ts3u{kuk
tSG|Z1
T%SH]`\
+t[sm 
TuQY%)
)%[tV.
TV]8rk
;twE$1
tw*SRKi
t/;wv^
t%Wy!F
;<[Tx,
@tx2L?
|TXD+	
*tY'm0
tY S/O
tz|aG 
tzO?&d
t[]zyu
\!U}0=
%/U18W([
u2>G55^3
U3fL}>
u3fT]c=;
u4jF8>
#U4Sq&g}
:U5kqJ#(
u!5>ux
).U7v]#
U$8rS%r
]:U:}90
_ub.B6
u*bbjR
UBiN7@EW
ubNno\
UbpI>On
u%C4rq
UC#.C/
uC	<Lp
U,DA5s-
UD|uxgf
Ue0-[tm
UE5Cqo
u!g{)9
}@UGv*
u-=_~H<[
$U]~HF
_uiD}&'A
%UIxKa&
^uJ'<).
U<)j4,8y
uj'f}$
UJh'bY
u*JU3}
-]*Ujz
\}uKy5
U%-\lGEF
U.LKd!g
um$m1}
*}UN5R
@U|ndU
-U,nee
u[nM#[
un oJ`D*&
UnrealizeObject
uN<tSS`
uo#~9~
uoE*$Pf
u"oK/U
u_om8{_t
:u+}oT
[[;up~
U|P_gt+`
u:p/)N
.#u>pR
UQ(2C1
*"(UQUm
@uq_zh(.
UrA8l\@
)u,,+S
user32.dll
USy_[M}z
U@T>(0
-ut6T8
Uu][{mH;
U!#u.pO
%Uv{0p$2&
u%VCch
u/vk[F,z
>uWa}_
Ux< L99
Ux#NheV
UYGO5=
U@<#Zb
Uzt)qz
)|]=#v:
{"`+}V
%v0	IK
v1O\sd
V%)/2W
V@41-H
;V4sV:
*=v&8+
V<8+rH!.
V,9)|B#2
";V<a|
VariantChangeTypeEx
vB-@ S
V:CNxcJ9JQ~
vdd};N
vDy];>
''VD=z
vE!2{6
VEc<$&P
VF2lhL
:V>fr5
v"/GS5
:<:v}i259
V!i	2v
VirtualAlloc
VirtualFree
vj5f8<
Vj_QC)
^vko)y
v L8iQWS
v: Ldi
V}{l:v!
v&/m'Uq
)VNCLb
{V|n:V
Vo;o;*
<v<O)R
Vp{aJu
vqe/^I
vRx~/mcq
Vs-`fs
	`V+Sp
vspl?J
VTK=`bb
v\TM]c7Y7
v`\TP!mo
VtZ!/F
v')u;G
VUXEd0
V/<uXQF8C
%"vv1)i#
vvB(<n%B
+VvP M
vvSfoY
Vw:(p0
VX_6P;
V&!x:<U"
v/.xYZK
VY\<KJ
&vzT-9
_:w#~;
W0c|30
+[W/0<IS
:W~0}z
]~w1F/jY
W2.NK5
w3jV=$/
W^_3Ow
W5{zO9ab
>;w6lp
w[.<9e
W9z/KY
?=~"WA
wa9	sv
W%Ad[/
WB>	2a
] ;WBu
w}C@s&f21
w(cYp>,0
WewS$	
wf)_bt
WFgvKG
wf__!m
wf?]W|RQ
W|G}7|
@wi+}|
|*wI3r)
WindowFromPoint
winmm.dll
WJs97C
]Wjt"D
Wk-Nc[
W(lJ[;
W#)}m+
\wmhe&
wm`j(k{;c
="Wmq(
Wm_q8M#
W%|MX]D
Wn9lc_
w^p1}0
wP_,,H
wpkN&#	>
_W}pKy
W]PsvJg
Wpx*tN
WqgI"h
Wqv tb
<&$W!R-
wR7GC\<
w(RcB=g
#wr"cS
@W,}rJ/
wR'q!m
wrY:	0
WSACleanup
W+]	Sg}V
wsock32.dll
wsprintfA
`Wt$3@
=W,t	BZ
?WT&hqnle
.wtJP~?
w-tO@EJ
wTuaD&@
WtzZ7S<
WUmCY8==
WVQy9=
WWk*t>s\
'{Wy>CH
Wynv+u
{WZJhiAt
W_ ZN9
WzYO2c0
#X':[`
x+#0;]
X1go6VKx
'x2)yj.
x&=)36
{X3.nS
'X4DtQ
x{_,5M;
X5;W/x
x6z)FEE<^G~
<@x" 8
x\]9c2h
#;~X_9P
Xax5~hc
xB9vbg
xCEKU9
(x,%CkQ
xcn#pz5P=~
xC'}y#
X.dhM-
xdQ;`^
Xds`7%
X?#DvJ
Xe3s-WY
XE+7hF
)xG}1ibe^;`k
xi1y	YL
`xI*Fm
_-xIK<
XJpu_[
XJQ0*vh
XjqRH}
xl{fEBm
xL<Q*;3
xlTFV_[i'
[`[xM/
\%_XMP;V
#XMT">z
xMzl%^`
,xoxtA
x!%PB\
^xPhLh$
xQ5a! 
Xr 4K9)T
xrqSXL
X	/Rq	ut
XrSvpi
(X!S<{
XsN`#|
XU|7k>
x_UHs3
!(XU?LV
Xut&ss
%XuUESa
xva	+j
`-X'w@-
x\W+gx
XW(n4|
xwS~h R\
X$W?z`
X{YbbK
x+Y .p
}/XZ#<
x]Z+?rY2p
Y/0JKK{
}Y0rnyl
.y,1W{a
Y2;UMpQliZ
Y2w< 0
Y2z;&Z
^&Y37I
Y3=H(?
\(`y3J
.Y@3Ja6
y51Njv
~Y:7=Y
~Y##a{&
Y_A;*-m
;^yAnhN
{=:@$Yb7
^Y]buFX
y_D`0,
^(YD?J}
-"%yFpr
yG'e/|n
Y<Gu2c
Y	H:9c
&YhGzw*b
$y	hlWA
]yhQ44m
Y )}*i
Yitt=q
.$Yk?^
YKh%Z0
yl162x
){`Ylr
y\mg?!8
ym+p8N
Y~nC}0X
[#	YnU%
-yNXTj
/!:yoY
Yp rUd
y'q)4R
YQOah7
YR8B&gk
yR|z2"
YS<DZkP
Y>@sEi
ysEK~JB
YS"Lag
'YtLeL*
YugzY|
y'VO=x
YW*9jR3
Yw~EQ?
YWgjjbkv
	$yXDA
"YX>uY
yx|Vrg
yX]w *
	YYDNf#
Y@YOT1
yzbUso
<yziI)
^yzn	Q
{z1[QS
:z&1W\)
Z3JkXx
"Z3NO}M
-Z3r6O
z5I-ar
z?^7c]/(o
z9FP_O
Z-9l+a
z9Z_PG
zAXpAKFz
<|>Z}cx
z@dR0F^
Z+\%dWH&
ze\"6}k
!#	z|eA
zE:?Iv
ze=TY[n
ZE-v<S
Z_f)a!!
Zf^%cJ
|)zfYM
(Zg}Hx
#ZH}iW
z>H:K)
ZH}mH*V
[z:Jom
/z)jOs
Z%jwE3
,$z	l>
z_[LLe
Z!l?z6O
ZM*iZ8
z!n]/s
zol?`B&
!*ZoMX
Z'Pyy'{
%ZQ>h	
Z`/'qJ
`ZqTis
ZsB(\T
,'#Zt|>
Zt=.r2l
]z\U,V
\zU[Xd
*z^v>{cl
z^\VMF[(
zvsN[ 
zwwb-kbAL
zw$wdj
:Zy0ZbD~
ZY3f6$
z{Y\tB[mpaj