Analysis Date2018-03-28 22:02:10
MD5093a531f13285cb30a41fcd1f284de74
SHA1cda02022059c4d4c8c9bb217469698e0f286c2a1

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section md5: f1c182d64590b0c7f34bbb13084dcc41 sha1: 6cabb96de5a8bd111a730c272040d5520e166776 size: 222208
Section md5: e89d19e4fcc68b08934994efbcfe61dd sha1: d1018f125dfd7d50e83da6e7857611318235c158 size: 52224
Section md5: edf2c2e0cc42bde22a002dd68a0bb9c7 sha1: 2700eb59b3a833f86bfb97107c94d97f0a8c05d5 size: 5632
Section.rsrc md5: 332a73c3fb1c7e458eb02c16fc37e168 sha1: 784fb4238714bbc98e90ac5a6754aa34e8baae36 size: 352256
Section2234 md5: a6a25810828651d9afd05dc8791de0d2 sha1: 49cc635b85b9eb6cb595aab2131ecb83f832f96e size: 355840
Section.adata md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Timestamp2014-01-13 07:46:43
VersionLegalCopyright: Copyright (C) 2014-2015
ProductVersion11: 1, 3sdfg, 0, 1
FileVersion: 1, 1wer3, 0, 1
FileVersion11: 1, 1sdfsdf1, 0, 1
LegalCopyright11: Copyright (C) 2014-2015
ProductVersion: 1, 3qrweqwfg, 0, 1
FileDescription: 345sldflsdkflsdkf
PackerASProtect v1.2
PEhash74e376ac1fef6c02e105f65f89841f8f80ccf2dc
AVArcabit (arcavir)Gen:Variant.Adware.Symmi.37537
AVAuthentiumNo Virus
AVGrisoft (avg)FakeAV_r.XP
AVAvira (antivir)TR/Crypt.XPACK.Gen7
AVAlwil (avast)Evo-gen [Susp]
AVAd-AwareGen:Variant.Adware.Symmi.37537
AVBitDefenderGen:Variant.Adware.Symmi.37537
AVBullGuardGen:Variant.Adware.Symmi.37537
AVClamAVNo Virus
AVDr. WebTrojan.FakeAV.16414
AVEmsisoftGen:Variant.Adware.Symmi.37537
AVMicroWorld (escan)Gen:Variant.Adware.Symmi.37537
AVCA (E-Trust Ino)Gen:Variant.Adware.Symmi.37537
AVFortinetW32/FakeAV.AC!tr
AVFrisk (f-prot)No Virus
AVF-SecureNo Virus
AVIkarusTrojan.Win32.FakeAV
AVK7No Virus
AVKasperskyTrojan-Ransom.Win32.Blocker.kxer
AVMalwareBytesTrojan.FakeAV
AVMcafeeFakeAlert-FTE!093A531F1328
AVMicrosoft Security EssentialsRogue:Win32/FakePAV
AVNANOTrojan.Win32.Dapato.cuudrt
AVEset (nod32)Win32/AdWare.WindowsExpertConsole.AG
AVPadvishNo Virus
AVCAT (quickheal)No Virus
AVRisingNo Virus
AV360 SafeNo Virus
AVSUPERAntiSpywareError Scanning File
AVSymantecTrojan.FakeAV!gen123
AVTrend MicroNo Virus
AVTwisterTrojan.69E4E902FB47780D
AVVirusBlokAda (vba32)TrojanDropper.Dapato
AVWindows DefenderRogue:Win32/FakePAV
AVZillya!No Virus

Runtime Details:

Screenshot

Process
↳ C:\Windows\System32\lsass.exe

Process
↳ C:\Users\Phil\AppData\Local\Temp\cda02022059c4d4c8c9bb217469698e0f286c2a1.exe

Process
↳ C:\Users\Phil\AppData\Roaming\safe-tppt.exe

Process
↳ C:\Windows\SysWOW64\cmd.exe

Creates File\??\NUL

Process
↳ C:\Windows\SysWOW64\mshta.exe

Creates MutexLocal\!PrivacIE!SharedMemory!Mutex
Creates Mutex
Creates MutexRasPbFile
Creates FileC:\Windows\Globalization\Sorting\sortdefault.nls
Creates FileC:\Users\Phil\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
Creates FileC:\Users\Phil\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
Creates FileC:\Users\Phil\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\mshta_RASAPI32\EnableFileTracing ➝
0
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\mshta_RASAPI32\EnableConsoleTracing ➝
0
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\mshta_RASAPI32\FileTracingMask ➝
4294901760
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\mshta_RASAPI32\ConsoleTracingMask ➝
4294901760
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\mshta_RASAPI32\MaxFileSize ➝
1048576
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\mshta_RASAPI32\FileDirectory ➝
%windir%\tracing

Process
↳ C:\Windows\SysWOW64\sc.exe

Creates FileC:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui
Creates FileC:\Windows\SysWOW64\en-US\sc.exe.mui

Process
↳ C:\Windows\SysWOW64\sc.exe

Creates FileC:\Windows\SysWOW64\en-US\sc.exe.mui

Network Details:

DNScheckip.dyndns.com
Type: A
216.146.39.70
DNScheckip.dyndns.com
Type: A
216.146.43.70
DNScheckip.dyndns.com
Type: A
91.198.22.70
DNScheckip.dyndns.com
Type: A
216.146.38.70
DNScheckip.dyndns.org
Type: A
HTTP GEThttp://checkip.dyndns.org/
User-Agent: Mozilla/4.0
HTTP GEThttp://93.115.86.197/?0=13&1=0&2=11&3=i&4=2600&5=1&6=1111&7=xvbkliocrj
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
Flows TCP192.168.1.1:1031 ➝ 216.146.39.70:80
Flows TCP192.168.1.1:1033 ➝ 93.115.86.197:80

Raw Pcap
0x00000000 (00000)   47455420 2f6e6373 692e7478 74204854   GET /ncsi.txt HT
0x00000010 (00016)   54502f31 2e310d0a 436f6e6e 65637469   TP/1.1..Connecti
0x00000020 (00032)   6f6e3a20 436c6f73 650d0a55 7365722d   on: Close..User-
0x00000030 (00048)   4167656e 743a204d 6963726f 736f6674   Agent: Microsoft
0x00000040 (00064)   204e4353 490d0a48 6f73743a 20777777    NCSI..Host: www
0x00000050 (00080)   2e6d7366 746e6373 692e636f 6d0d0a0d   .msftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f6e6373 692e7478 74204854   GET /ncsi.txt HT
0x00000010 (00016)   54502f31 2e310d0a 436f6e6e 65637469   TP/1.1..Connecti
0x00000020 (00032)   6f6e3a20 436c6f73 650d0a55 7365722d   on: Close..User-
0x00000030 (00048)   4167656e 743a204d 6963726f 736f6674   Agent: Microsoft
0x00000040 (00064)   204e4353 490d0a48 6f73743a 20777777    NCSI..Host: www
0x00000050 (00080)   2e6d7366 746e6373 692e636f 6d0d0a0d   .msftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f6e6373 692e7478 74204854   GET /ncsi.txt HT
0x00000010 (00016)   54502f31 2e310d0a 436f6e6e 65637469   TP/1.1..Connecti
0x00000020 (00032)   6f6e3a20 436c6f73 650d0a55 7365722d   on: Close..User-
0x00000030 (00048)   4167656e 743a204d 6963726f 736f6674   Agent: Microsoft
0x00000040 (00064)   204e4353 490d0a48 6f73743a 20777777    NCSI..Host: www
0x00000050 (00080)   2e6d7366 746e6373 692e636f 6d0d0a0d   .msftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x00000020 (00032)   6c6c612f 342e300d 0a486f73 743a2063   lla/4.0..Host: c
0x00000030 (00048)   6865636b 69702e64 796e646e 732e6f72   heckip.dyndns.or
0x00000040 (00064)   670d0a0d 0a0d0a48 6f73743a 20777777   g......Host: www
0x00000050 (00080)   2e6d7366 746e6373 692e636f 6d0d0a0d   .msftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f6e6373 692e7478 74204854   GET /ncsi.txt HT
0x00000010 (00016)   54502f31 2e310d0a 436f6e6e 65637469   TP/1.1..Connecti
0x00000020 (00032)   6f6e3a20 436c6f73 650d0a55 7365722d   on: Close..User-
0x00000030 (00048)   4167656e 743a204d 6963726f 736f6674   Agent: Microsoft
0x00000040 (00064)   204e4353 490d0a48 6f73743a 20777777    NCSI..Host: www
0x00000050 (00080)   2e6d7366 746e6373 692e636f 6d0d0a0d   .msftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   504f5354 202f3365 31363236 34372d63   POST /3e162647-c
0x00000010 (00016)   3364382d 34346333 2d393937 622d3061   3d8-44c3-997b-0a
0x00000020 (00032)   63396135 66363838 33322f20 48545450   c9a5f68832/ HTTP
0x00000030 (00048)   2f312e31 0d0a4361 6368652d 436f6e74   /1.1..Cache-Cont
0x00000040 (00064)   726f6c3a 206e6f2d 63616368 650d0a43   rol: no-cache..C
0x00000050 (00080)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000060 (00096)   0d0a5072 61676d61 3a206e6f 2d636163   ..Pragma: no-cac
0x00000070 (00112)   68650d0a 436f6e74 656e742d 54797065   he..Content-Type
0x00000080 (00128)   3a206170 706c6963 6174696f 6e2f736f   : application/so
0x00000090 (00144)   61702b78 6d6c0d0a 55736572 2d416765   ap+xml..User-Age
0x000000a0 (00160)   6e743a20 57534441 50490d0a 436f6e74   nt: WSDAPI..Cont
0x000000b0 (00176)   656e742d 4c656e67 74683a20 3733330d   ent-Length: 733.
0x000000c0 (00192)   0a486f73 743a2031 39322e31 36382e31   .Host: 192.168.1
0x000000d0 (00208)   30302e31 36333a35 3335370d 0a0d0a3c   00.163:5357....<
0x000000e0 (00224)   3f786d6c 20766572 73696f6e 3d22312e   ?xml version="1.
0x000000f0 (00240)   30222065 6e636f64 696e673d 22757466   0" encoding="utf
0x00000100 (00256)   2d38223f 3e3c736f 61703a45 6e76656c   -8"?><soap:Envel
0x00000110 (00272)   6f706520 786d6c6e 733a736f 61703d22   ope xmlns:soap="
0x00000120 (00288)   68747470 3a2f2f77 77772e77 332e6f72   http://www.w3.or
0x00000130 (00304)   672f3230 30332f30 352f736f 61702d65   g/2003/05/soap-e
0x00000140 (00320)   6e76656c 6f706522 20786d6c 6e733a77   nvelope" xmlns:w
0x00000150 (00336)   73613d22 68747470 3a2f2f73 6368656d   sa="http://schem
0x00000160 (00352)   61732e78 6d6c736f 61702e6f 72672f77   as.xmlsoap.org/w
0x00000170 (00368)   732f3230 30342f30 382f6164 64726573   s/2004/08/addres
0x00000180 (00384)   73696e67 2220786d 6c6e733a 6c6d733d   sing" xmlns:lms=
0x00000190 (00400)   22687474 703a2f2f 73636865 6d61732e   "http://schemas.
0x000001a0 (00416)   6d696372 6f736f66 742e636f 6d2f7769   microsoft.com/wi
0x000001b0 (00432)   6e646f77 732f6c6d 732f3230 30372f30   ndows/lms/2007/0
0x000001c0 (00448)   38223e3c 736f6170 3a486561 6465723e   8"><soap:Header>
0x000001d0 (00464)   3c777361 3a546f3e 75726e3a 75756964   <wsa:To>urn:uuid
0x000001e0 (00480)   3a336531 36323634 372d6333 64382d34   :3e162647-c3d8-4
0x000001f0 (00496)   3463332d 39393762 2d306163 39613566   4c3-997b-0ac9a5f
0x00000200 (00512)   36383833 323c2f77 73613a54 6f3e3c77   68832</wsa:To><w
0x00000210 (00528)   73613a41 6374696f 6e3e6874 74703a2f   sa:Action>http:/
0x00000220 (00544)   2f736368 656d6173 2e786d6c 736f6170   /schemas.xmlsoap
0x00000230 (00560)   2e6f7267 2f77732f 32303034 2f30392f   .org/ws/2004/09/
0x00000240 (00576)   7472616e 73666572 2f476574 3c2f7773   transfer/Get</ws
0x00000250 (00592)   613a4163 74696f6e 3e3c7773 613a4d65   a:Action><wsa:Me
0x00000260 (00608)   73736167 6549443e 75726e3a 75756964   ssageID>urn:uuid
0x00000270 (00624)   3a333635 37323430 642d3261 34362d34   :3657240d-2a46-4
0x00000280 (00640)   6632382d 61646439 2d396136 39323039   f28-add9-9a69209
0x00000290 (00656)   39363965 303c2f77 73613a4d 65737361   969e0</wsa:Messa
0x000002a0 (00672)   67654944 3e3c7773 613a5265 706c7954   geID><wsa:ReplyT
0x000002b0 (00688)   6f3e3c77 73613a41 64647265 73733e68   o><wsa:Address>h
0x000002c0 (00704)   7474703a 2f2f7363 68656d61 732e786d   ttp://schemas.xm
0x000002d0 (00720)   6c736f61 702e6f72 672f7773 2f323030   lsoap.org/ws/200
0x000002e0 (00736)   342f3038 2f616464 72657373 696e672f   4/08/addressing/
0x000002f0 (00752)   726f6c65 2f616e6f 6e796d6f 75733c2f   role/anonymous</
0x00000300 (00768)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000310 (00784)   613a5265 706c7954 6f3e3c77 73613a46   a:ReplyTo><wsa:F
0x00000320 (00800)   726f6d3e 3c777361 3a416464 72657373   rom><wsa:Address
0x00000330 (00816)   3e75726e 3a757569 643a3934 65316462   >urn:uuid:94e1db
0x00000340 (00832)   30632d33 3366342d 34626439 2d386635   0c-33f4-4bd9-8f5
0x00000350 (00848)   342d3965 30326135 34303632 62633c2f   4-9e02a54062bc</
0x00000360 (00864)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000370 (00880)   613a4672 6f6d3e3c 6c6d733a 4c617267   a:From><lms:Larg
0x00000380 (00896)   654d6574 61646174 61537570 706f7274   eMetadataSupport
0x00000390 (00912)   2f3e3c2f 736f6170 3a486561 6465723e   /></soap:Header>
0x000003a0 (00928)   3c736f61 703a426f 64792f3e 3c2f736f   <soap:Body/></so
0x000003b0 (00944)   61703a45 6e76656c 6f70653e            ap:Envelope>

0x00000000 (00000)   504f5354 202f3365 31363236 34372d63   POST /3e162647-c
0x00000010 (00016)   3364382d 34346333 2d393937 622d3061   3d8-44c3-997b-0a
0x00000020 (00032)   63396135 66363838 33322f20 48545450   c9a5f68832/ HTTP
0x00000030 (00048)   2f312e31 0d0a4361 6368652d 436f6e74   /1.1..Cache-Cont
0x00000040 (00064)   726f6c3a 206e6f2d 63616368 650d0a43   rol: no-cache..C
0x00000050 (00080)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000060 (00096)   0d0a5072 61676d61 3a206e6f 2d636163   ..Pragma: no-cac
0x00000070 (00112)   68650d0a 436f6e74 656e742d 54797065   he..Content-Type
0x00000080 (00128)   3a206170 706c6963 6174696f 6e2f736f   : application/so
0x00000090 (00144)   61702b78 6d6c0d0a 55736572 2d416765   ap+xml..User-Age
0x000000a0 (00160)   6e743a20 57534441 50490d0a 436f6e74   nt: WSDAPI..Cont
0x000000b0 (00176)   656e742d 4c656e67 74683a20 3733330d   ent-Length: 733.
0x000000c0 (00192)   0a486f73 743a2031 39322e31 36382e31   .Host: 192.168.1
0x000000d0 (00208)   30302e31 36333a35 3335370d 0a0d0a3c   00.163:5357....<
0x000000e0 (00224)   3f786d6c 20766572 73696f6e 3d22312e   ?xml version="1.
0x000000f0 (00240)   30222065 6e636f64 696e673d 22757466   0" encoding="utf
0x00000100 (00256)   2d38223f 3e3c736f 61703a45 6e76656c   -8"?><soap:Envel
0x00000110 (00272)   6f706520 786d6c6e 733a736f 61703d22   ope xmlns:soap="
0x00000120 (00288)   68747470 3a2f2f77 77772e77 332e6f72   http://www.w3.or
0x00000130 (00304)   672f3230 30332f30 352f736f 61702d65   g/2003/05/soap-e
0x00000140 (00320)   6e76656c 6f706522 20786d6c 6e733a77   nvelope" xmlns:w
0x00000150 (00336)   73613d22 68747470 3a2f2f73 6368656d   sa="http://schem
0x00000160 (00352)   61732e78 6d6c736f 61702e6f 72672f77   as.xmlsoap.org/w
0x00000170 (00368)   732f3230 30342f30 382f6164 64726573   s/2004/08/addres
0x00000180 (00384)   73696e67 2220786d 6c6e733a 6c6d733d   sing" xmlns:lms=
0x00000190 (00400)   22687474 703a2f2f 73636865 6d61732e   "http://schemas.
0x000001a0 (00416)   6d696372 6f736f66 742e636f 6d2f7769   microsoft.com/wi
0x000001b0 (00432)   6e646f77 732f6c6d 732f3230 30372f30   ndows/lms/2007/0
0x000001c0 (00448)   38223e3c 736f6170 3a486561 6465723e   8"><soap:Header>
0x000001d0 (00464)   3c777361 3a546f3e 75726e3a 75756964   <wsa:To>urn:uuid
0x000001e0 (00480)   3a336531 36323634 372d6333 64382d34   :3e162647-c3d8-4
0x000001f0 (00496)   3463332d 39393762 2d306163 39613566   4c3-997b-0ac9a5f
0x00000200 (00512)   36383833 323c2f77 73613a54 6f3e3c77   68832</wsa:To><w
0x00000210 (00528)   73613a41 6374696f 6e3e6874 74703a2f   sa:Action>http:/
0x00000220 (00544)   2f736368 656d6173 2e786d6c 736f6170   /schemas.xmlsoap
0x00000230 (00560)   2e6f7267 2f77732f 32303034 2f30392f   .org/ws/2004/09/
0x00000240 (00576)   7472616e 73666572 2f476574 3c2f7773   transfer/Get</ws
0x00000250 (00592)   613a4163 74696f6e 3e3c7773 613a4d65   a:Action><wsa:Me
0x00000260 (00608)   73736167 6549443e 75726e3a 75756964   ssageID>urn:uuid
0x00000270 (00624)   3a656235 66613065 312d3661 37612d34   :eb5fa0e1-6a7a-4
0x00000280 (00640)   3462372d 39643830 2d363235 30623762   4b7-9d80-6250b7b
0x00000290 (00656)   35316132 353c2f77 73613a4d 65737361   51a25</wsa:Messa
0x000002a0 (00672)   67654944 3e3c7773 613a5265 706c7954   geID><wsa:ReplyT
0x000002b0 (00688)   6f3e3c77 73613a41 64647265 73733e68   o><wsa:Address>h
0x000002c0 (00704)   7474703a 2f2f7363 68656d61 732e786d   ttp://schemas.xm
0x000002d0 (00720)   6c736f61 702e6f72 672f7773 2f323030   lsoap.org/ws/200
0x000002e0 (00736)   342f3038 2f616464 72657373 696e672f   4/08/addressing/
0x000002f0 (00752)   726f6c65 2f616e6f 6e796d6f 75733c2f   role/anonymous</
0x00000300 (00768)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000310 (00784)   613a5265 706c7954 6f3e3c77 73613a46   a:ReplyTo><wsa:F
0x00000320 (00800)   726f6d3e 3c777361 3a416464 72657373   rom><wsa:Address
0x00000330 (00816)   3e75726e 3a757569 643a6533 34383666   >urn:uuid:e3486f
0x00000340 (00832)   31302d66 3433362d 34636365 2d383539   10-f436-4cce-859
0x00000350 (00848)   352d3665 34326230 62373462 35663c2f   5-6e42b0b74b5f</
0x00000360 (00864)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000370 (00880)   613a4672 6f6d3e3c 6c6d733a 4c617267   a:From><lms:Larg
0x00000380 (00896)   654d6574 61646174 61537570 706f7274   eMetadataSupport
0x00000390 (00912)   2f3e3c2f 736f6170 3a486561 6465723e   /></soap:Header>
0x000003a0 (00928)   3c736f61 703a426f 64792f3e 3c2f736f   <soap:Body/></so
0x000003b0 (00944)   61703a45 6e76656c 6f70653e            ap:Envelope>

0x00000000 (00000)   504f5354 202f3365 31363236 34372d63   POST /3e162647-c
0x00000010 (00016)   3364382d 34346333 2d393937 622d3061   3d8-44c3-997b-0a
0x00000020 (00032)   63396135 66363838 33322f20 48545450   c9a5f68832/ HTTP
0x00000030 (00048)   2f312e31 0d0a4361 6368652d 436f6e74   /1.1..Cache-Cont
0x00000040 (00064)   726f6c3a 206e6f2d 63616368 650d0a43   rol: no-cache..C
0x00000050 (00080)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000060 (00096)   0d0a5072 61676d61 3a206e6f 2d636163   ..Pragma: no-cac
0x00000070 (00112)   68650d0a 436f6e74 656e742d 54797065   he..Content-Type
0x00000080 (00128)   3a206170 706c6963 6174696f 6e2f736f   : application/so
0x00000090 (00144)   61702b78 6d6c0d0a 55736572 2d416765   ap+xml..User-Age
0x000000a0 (00160)   6e743a20 57534441 50490d0a 436f6e74   nt: WSDAPI..Cont
0x000000b0 (00176)   656e742d 4c656e67 74683a20 3733330d   ent-Length: 733.
0x000000c0 (00192)   0a486f73 743a2031 39322e31 36382e31   .Host: 192.168.1
0x000000d0 (00208)   30302e31 36333a35 3335370d 0a0d0a3c   00.163:5357....<
0x000000e0 (00224)   3f786d6c 20766572 73696f6e 3d22312e   ?xml version="1.
0x000000f0 (00240)   30222065 6e636f64 696e673d 22757466   0" encoding="utf
0x00000100 (00256)   2d38223f 3e3c736f 61703a45 6e76656c   -8"?><soap:Envel
0x00000110 (00272)   6f706520 786d6c6e 733a736f 61703d22   ope xmlns:soap="
0x00000120 (00288)   68747470 3a2f2f77 77772e77 332e6f72   http://www.w3.or
0x00000130 (00304)   672f3230 30332f30 352f736f 61702d65   g/2003/05/soap-e
0x00000140 (00320)   6e76656c 6f706522 20786d6c 6e733a77   nvelope" xmlns:w
0x00000150 (00336)   73613d22 68747470 3a2f2f73 6368656d   sa="http://schem
0x00000160 (00352)   61732e78 6d6c736f 61702e6f 72672f77   as.xmlsoap.org/w
0x00000170 (00368)   732f3230 30342f30 382f6164 64726573   s/2004/08/addres
0x00000180 (00384)   73696e67 2220786d 6c6e733a 6c6d733d   sing" xmlns:lms=
0x00000190 (00400)   22687474 703a2f2f 73636865 6d61732e   "http://schemas.
0x000001a0 (00416)   6d696372 6f736f66 742e636f 6d2f7769   microsoft.com/wi
0x000001b0 (00432)   6e646f77 732f6c6d 732f3230 30372f30   ndows/lms/2007/0
0x000001c0 (00448)   38223e3c 736f6170 3a486561 6465723e   8"><soap:Header>
0x000001d0 (00464)   3c777361 3a546f3e 75726e3a 75756964   <wsa:To>urn:uuid
0x000001e0 (00480)   3a336531 36323634 372d6333 64382d34   :3e162647-c3d8-4
0x000001f0 (00496)   3463332d 39393762 2d306163 39613566   4c3-997b-0ac9a5f
0x00000200 (00512)   36383833 323c2f77 73613a54 6f3e3c77   68832</wsa:To><w
0x00000210 (00528)   73613a41 6374696f 6e3e6874 74703a2f   sa:Action>http:/
0x00000220 (00544)   2f736368 656d6173 2e786d6c 736f6170   /schemas.xmlsoap
0x00000230 (00560)   2e6f7267 2f77732f 32303034 2f30392f   .org/ws/2004/09/
0x00000240 (00576)   7472616e 73666572 2f476574 3c2f7773   transfer/Get</ws
0x00000250 (00592)   613a4163 74696f6e 3e3c7773 613a4d65   a:Action><wsa:Me
0x00000260 (00608)   73736167 6549443e 75726e3a 75756964   ssageID>urn:uuid
0x00000270 (00624)   3a363631 31306163 302d3638 65352d34   :66110ac0-68e5-4
0x00000280 (00640)   3963362d 38306561 2d383931 31303237   9c6-80ea-8911027
0x00000290 (00656)   64626535 323c2f77 73613a4d 65737361   dbe52</wsa:Messa
0x000002a0 (00672)   67654944 3e3c7773 613a5265 706c7954   geID><wsa:ReplyT
0x000002b0 (00688)   6f3e3c77 73613a41 64647265 73733e68   o><wsa:Address>h
0x000002c0 (00704)   7474703a 2f2f7363 68656d61 732e786d   ttp://schemas.xm
0x000002d0 (00720)   6c736f61 702e6f72 672f7773 2f323030   lsoap.org/ws/200
0x000002e0 (00736)   342f3038 2f616464 72657373 696e672f   4/08/addressing/
0x000002f0 (00752)   726f6c65 2f616e6f 6e796d6f 75733c2f   role/anonymous</
0x00000300 (00768)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000310 (00784)   613a5265 706c7954 6f3e3c77 73613a46   a:ReplyTo><wsa:F
0x00000320 (00800)   726f6d3e 3c777361 3a416464 72657373   rom><wsa:Address
0x00000330 (00816)   3e75726e 3a757569 643a3639 38383932   >urn:uuid:698892
0x00000340 (00832)   38322d33 6337622d 34646561 2d383163   82-3c7b-4dea-81c
0x00000350 (00848)   642d3864 65653961 65653938 36373c2f   d-8dee9aee9867</
0x00000360 (00864)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000370 (00880)   613a4672 6f6d3e3c 6c6d733a 4c617267   a:From><lms:Larg
0x00000380 (00896)   654d6574 61646174 61537570 706f7274   eMetadataSupport
0x00000390 (00912)   2f3e3c2f 736f6170 3a486561 6465723e   /></soap:Header>
0x000003a0 (00928)   3c736f61 703a426f 64792f3e 3c2f736f   <soap:Body/></so
0x000003b0 (00944)   61703a45 6e76656c 6f70653e            ap:Envelope>

0x00000000 (00000)   504f5354 202f3365 31363236 34372d63   POST /3e162647-c
0x00000010 (00016)   3364382d 34346333 2d393937 622d3061   3d8-44c3-997b-0a
0x00000020 (00032)   63396135 66363838 33322f20 48545450   c9a5f68832/ HTTP
0x00000030 (00048)   2f312e31 0d0a4361 6368652d 436f6e74   /1.1..Cache-Cont
0x00000040 (00064)   726f6c3a 206e6f2d 63616368 650d0a43   rol: no-cache..C
0x00000050 (00080)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000060 (00096)   0d0a5072 61676d61 3a206e6f 2d636163   ..Pragma: no-cac
0x00000070 (00112)   68650d0a 436f6e74 656e742d 54797065   he..Content-Type
0x00000080 (00128)   3a206170 706c6963 6174696f 6e2f736f   : application/so
0x00000090 (00144)   61702b78 6d6c0d0a 55736572 2d416765   ap+xml..User-Age
0x000000a0 (00160)   6e743a20 57534441 50490d0a 436f6e74   nt: WSDAPI..Cont
0x000000b0 (00176)   656e742d 4c656e67 74683a20 3733330d   ent-Length: 733.
0x000000c0 (00192)   0a486f73 743a2031 39322e31 36382e31   .Host: 192.168.1
0x000000d0 (00208)   30302e31 39333a35 3335370d 0a0d0a3c   00.193:5357....<
0x000000e0 (00224)   3f786d6c 20766572 73696f6e 3d22312e   ?xml version="1.
0x000000f0 (00240)   30222065 6e636f64 696e673d 22757466   0" encoding="utf
0x00000100 (00256)   2d38223f 3e3c736f 61703a45 6e76656c   -8"?><soap:Envel
0x00000110 (00272)   6f706520 786d6c6e 733a736f 61703d22   ope xmlns:soap="
0x00000120 (00288)   68747470 3a2f2f77 77772e77 332e6f72   http://www.w3.or
0x00000130 (00304)   672f3230 30332f30 352f736f 61702d65   g/2003/05/soap-e
0x00000140 (00320)   6e76656c 6f706522 20786d6c 6e733a77   nvelope" xmlns:w
0x00000150 (00336)   73613d22 68747470 3a2f2f73 6368656d   sa="http://schem
0x00000160 (00352)   61732e78 6d6c736f 61702e6f 72672f77   as.xmlsoap.org/w
0x00000170 (00368)   732f3230 30342f30 382f6164 64726573   s/2004/08/addres
0x00000180 (00384)   73696e67 2220786d 6c6e733a 6c6d733d   sing" xmlns:lms=
0x00000190 (00400)   22687474 703a2f2f 73636865 6d61732e   "http://schemas.
0x000001a0 (00416)   6d696372 6f736f66 742e636f 6d2f7769   microsoft.com/wi
0x000001b0 (00432)   6e646f77 732f6c6d 732f3230 30372f30   ndows/lms/2007/0
0x000001c0 (00448)   38223e3c 736f6170 3a486561 6465723e   8"><soap:Header>
0x000001d0 (00464)   3c777361 3a546f3e 75726e3a 75756964   <wsa:To>urn:uuid
0x000001e0 (00480)   3a336531 36323634 372d6333 64382d34   :3e162647-c3d8-4
0x000001f0 (00496)   3463332d 39393762 2d306163 39613566   4c3-997b-0ac9a5f
0x00000200 (00512)   36383833 323c2f77 73613a54 6f3e3c77   68832</wsa:To><w
0x00000210 (00528)   73613a41 6374696f 6e3e6874 74703a2f   sa:Action>http:/
0x00000220 (00544)   2f736368 656d6173 2e786d6c 736f6170   /schemas.xmlsoap
0x00000230 (00560)   2e6f7267 2f77732f 32303034 2f30392f   .org/ws/2004/09/
0x00000240 (00576)   7472616e 73666572 2f476574 3c2f7773   transfer/Get</ws
0x00000250 (00592)   613a4163 74696f6e 3e3c7773 613a4d65   a:Action><wsa:Me
0x00000260 (00608)   73736167 6549443e 75726e3a 75756964   ssageID>urn:uuid
0x00000270 (00624)   3a376339 65353037 662d3332 36322d34   :7c9e507f-3262-4
0x00000280 (00640)   6431392d 61356535 2d366362 65613334   d19-a5e5-6cbea34
0x00000290 (00656)   66386362 613c2f77 73613a4d 65737361   f8cba</wsa:Messa
0x000002a0 (00672)   67654944 3e3c7773 613a5265 706c7954   geID><wsa:ReplyT
0x000002b0 (00688)   6f3e3c77 73613a41 64647265 73733e68   o><wsa:Address>h
0x000002c0 (00704)   7474703a 2f2f7363 68656d61 732e786d   ttp://schemas.xm
0x000002d0 (00720)   6c736f61 702e6f72 672f7773 2f323030   lsoap.org/ws/200
0x000002e0 (00736)   342f3038 2f616464 72657373 696e672f   4/08/addressing/
0x000002f0 (00752)   726f6c65 2f616e6f 6e796d6f 75733c2f   role/anonymous</
0x00000300 (00768)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000310 (00784)   613a5265 706c7954 6f3e3c77 73613a46   a:ReplyTo><wsa:F
0x00000320 (00800)   726f6d3e 3c777361 3a416464 72657373   rom><wsa:Address
0x00000330 (00816)   3e75726e 3a757569 643a3539 34653163   >urn:uuid:594e1c
0x00000340 (00832)   30392d31 3365632d 34333837 2d623234   09-13ec-4387-b24
0x00000350 (00848)   632d3634 34303666 39363766 39623c2f   c-64406f967f9b</
0x00000360 (00864)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000370 (00880)   613a4672 6f6d3e3c 6c6d733a 4c617267   a:From><lms:Larg
0x00000380 (00896)   654d6574 61646174 61537570 706f7274   eMetadataSupport
0x00000390 (00912)   2f3e3c2f 736f6170 3a486561 6465723e   /></soap:Header>
0x000003a0 (00928)   3c736f61 703a426f 64792f3e 3c2f736f   <soap:Body/></so
0x000003b0 (00944)   61703a45 6e76656c 6f70653e            ap:Envelope>


Strings
02ab4vz0
1, 1sdfsdf1, 0, 1
1, 1wer3, 0, 1
1, 3qrweqwfg, 0, 1
1, 3sdfg, 0, 1
345sldflsdkflsdkf
APPROVE
Copyright (C) 2014-2015
DECLINE
DFGHJKL100
DFGHJKL1001
DFGHJKL10399
DFGHJKL111
DFGHJKL1122	DFGHJKL13
DFGHJKL134	DFGHJKL14
DFGHJKL160
DFGHJKL177
DFGHJKL18211
DFGHJKL190
DFGHJKL201
DFGHJKL202
DFGHJKL203
DFGHJKL204
DFGHJKL205
DFGHJKL206
DFGHJKL207
DFGHJKL20797
DFGHJKL208
DFGHJKL20804	DFGHJKL21	DFGHJKL23	DFGHJKL24
DFGHJKL240
DFGHJKL250
DFGHJKL274
DFGHJKL300
DFGHJKL301
DFGHJKL302
DFGHJKL303
DFGHJKL31048
DFGHJKL337
DFGHJKL349
DFGHJKL350
DFGHJKL351
DFGHJKL36867
DFGHJKL36869
DFGHJKL36871
DFGHJKL368711
DFGHJKL36872
DFGHJKL36884
DFGHJKL38738	DFGHJKL47
FileDescription
FileVersion
FileVersion11
FLASH
FORM
LegalCopyright
LegalCopyright11
PANEL1
PANEL2
ProductVersion
ProductVersion11
SETTINGS
StringFileInfo
VS_VERSION_INFO
:-_\*"'	
]_]!?&-]
00wp9qq
#0'3ZM9
,"0@48
0$5]! 
0<B 6@
0(CPk;
0%D43mGo
0HfwL?
0hh<W8O`
0i`>D0
0J!f'(
*_0k=+
?0k~s	
0,\m"%
`0-Ms$[?
0\qCh_T88
0	rAFx
`0RB`.C
0T$)YF4
,0U6QB
]0vg`W^
0WL*?M
^0y{?	
!0Y-]Y4
;1<^=&~>
10:Bhm
12H'mt
$12WK(
154zZy
15*qd1
16cwkE
 18MYB
#1+dH4
^1,dz,
1F/\LU
(1{g5ty$O
1Hn5%%j
=1kS&n
1}N`G7
1Oj$??
1oMZpc
,1<=Q{
%/1~#Q
1r3)VuOc
1rTsx%+
1Ti93GW`
1VW,[1
1ya5phk
>1|yn2	
1Z}A!aN
2.@4\Q
263`Ig
2A<Jg$
{ 2C	'
>2_@fKcc
%2GNs(
,2kq4,
2LWZQxh
2m&6yh
2%m.x>
2	NOHkO&
2<Q?D4-
&2So+h%>>
2|\SOn
^2TIg 
2TtWZhr
2$uqH`
{<+{*2w
:2WA+T@l~ 
;2xK0>g
]2yJuGV
3]3<8G<
36Gf~	}
36m'@u
37Sx#.6
3CNP~r4oz
3&g7lK
3GN9$M
,3]HRd
3is[uH
3IY'X^
3JH?F$A
3K?TArj
`3&*K(Ums
3n*l%AAdJ
3P24x"
%+3q\c{
"3r*fE
3RxE6%
3_) [s(
"3U`)AK
3^<x~eB:
3xR12&&}[
*3^xTw]5
3,YK1N
'3z0qmcw=
{]4~{	
4"3/B'
[44b|\a
457baI
45%N"[a	
466Fn62
49+Z-N_
4a6\`|U
$4c2|#
,4Coc:@,/<N
4cQQA.
4D<zu;D-
?4 Ibbs
}4JeJ5
`4j<!o	T
+4{'l@
4_M+(r
4N/yXL
.+%4pJ
,4q]"d
#4&Uxs+Q
}4<=VF)
4+)'vNB
#4w	-2
4^wtR#R
4/#x$%
|4Y F9
4Z<7_P
5:0<goJ
51-p>|
54UC]R2
5ABEn3
5A'IEk
<]5BNK
^5,(dK^
5d],/r[
5Ea!AE
5%FX6;
5g1M7K
5G6]mP
5]i|59
5Jk<8!
(5K-gp
5kiUBz
#:5L&|
:,5N*6`<(4
5n\Dwa
?"5O~>
5/Oogz
	)5sY]@
]5TH#J
*5vSKd
5XaQ[5
<&=.>6?
61@C{{
64ORPU
?$66\q
=6cG 6l!
6^CLHt
6[Eh8RN
6Fc}i?
~^6G|"
/#6,g(1
{6GO{ ^
6H<2u$qv
>6I`1.[
[6iP)/
$6!(Jd
6J/' Zg\*
6*@kaW
6K}q3n
6L=\X	
6m'^.XY
'[6NN(
6Om	<b
6!onAX
6$qRDY}
{6U)hv
6V*l4 
6&{X*r
6.z8ZnsgQ)O
='.! 7)
{73D&d
76GQ<`
789+/=
7aZtwC
+7 FlZ
7!GD5b(
7,(i\b
7KXt>5pr
{7~lii
7@;Lk!
7MOMRZ!
7&}VB-
7wM0.!
7Xe(lf
7yZ+qN
7zS|~|
7Zuo<y
%7"z#W@
!8|>-&
[80`:K
<8^3,@
84;te 
85<mN2
86p;C|1
8#~6zx
8	7cdp
8++A$I
%{8+\aT
--8aV}E,W
?<(8#B^
8BSf=az
8>?DX0
8Ejw79~j
8^eqP/y
%8h1R2
~8h9zz
$\8i%k
8Kf|50
8koM4(
-8MSCg
$8O%JV(
8&OKTW
>+8%"S
8U~X=H:
8<'V7?
~~8wP"
]8]\X^
8X0	N~Rj20,7
.8Y6 V
\8yk)w
8_ze;t
%"%9`(
92L_.@y
9@2XKs
(93M:V
9<>/^a&
{9Dh[\
9f"W"%{
9(I'p,
9!/&j2
9kDz*X
9Ldd\)
9MxAkV
9NegdU
%9nkMy
9Op!u&,<
9,Ph>:
9~P:T;X$\
9Py|uC
\9<qV`
9RR+W@
\9sBSF'	
9"~@vH
?\9Wd	o?
9W/L_OI
<9=X->
9xI[>i
9ytA[2
=9zLNNA*+
)?a$*]~
A+0dpK
A0l+^(
a0u-M)7
A3^|98A
A5+8ie
`-~,A6
a6(4#U
a7$qy.o@
a8(eeJ
A=`99c
A9~.;q7
{a/9WE
@Ab*9c
ABCDpE
a#\bYx
.adata
&A(DE?Jm	W
|AD=k|
AdUN:?l
advapi32.dll
.af">!	
#AF@=6K\
!aFD<2
~AFF;l
AgC&X6
AGEY\\J	
aG.'M\&
aGXe	|
A"h 4p
ah?g~h
AHmf.>I=5
AjHS%K8
AKemz&
+aL`Cn 
ALv@;P
A$MD\[
An*2V\ 
and`	$j
`ANh7s
An&y)x
=a[,OV
#a#<PL
a>QT,%
ARE\Borl
AR@LGS
aR	$xG
asra%M
AsS=/:
</assembly>*
      <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
aT,(v&
a`ufv:Q~
aV#!oi}|
A%.VOR
 AV*UO;{^
a,x@h:
=Azh\v
=[b?:#>0
b0av=@
b")16<
.b1mN"
 \B*:3
b8U@>ul
b,aRB4
bArPK4/
BbeJqE
bB`IKr
bbtV8!
Bb&zB@4
B}c-hhb
bc	Pyo
B~dlom
]bE4^=
BeginDeferWindowPos
':!>BF]
BFK*uZ
BFU]vmlW
BG8CD6
"bg.PdlR
BGT|%*
`bKp=rk
bmf:Q_
bmZ`Nh
bn/Rb0g0
'bP8i`
B{PmOcw
}B'pV3Pz
&~b@py\
bRGmi^
b'scRdbL>N
B#toxdeKo
^BVGfnExe\`
+b%VKB
B@VNztLG
>b%vOGmk
.bVT"$Q
"bwI7hJj
b~.yKZ_h
>by)o95
&-C.@@
!c0J4[
c3G*R2>Y
c53WA0{
c80*qF
c8c[>#
<&C9v'3
CA4IJy|
cA[5qi"
ca\;EQl
C;"a=H>.W&
/C	AXL&6
C/bs0/
CBxv%|
C]`}c0W
C>%.~c6
C~c]Ba
(?cCV3d$~:
_C@D3nc
CDEFW 
CDy:9EK7J
Ce$(DP
cefA5w
|-cf;S
C#(]Ft_
=CFY,It
$cgb2ir
CgLkW,
*cH=8o
	/C{iyn
CJaXLM
{CK	aT
}cLSkT
c	=l<Y
cN %15|
Cn$eCK
cn@]P+
comctl32.dll
comdlg32.dll
CO_r=P_@0
cOs5L	
CoTaskMemAlloc
cPDAvr;
c}p-te
)CpXS%
`~@c?q
Cqi$tH
CreateStdAccessibleObject
CR(McH
C~	(rP9
csPjFx
$;Csu<
"CTN$-r
c{_u=X
C,/v`0
cV6f68i
CV\bZ.
_^C[VpqQ
Cw7{?#
%	cxH(U
>C?ZS	
)=d<|~
>*D	<!,
D)=&!:
; d0>	2
D_1E`AE
D239.<a
D_-\2f
d2igI{o,B
`&d3kX|
d6ci"R
d; 6l7
d7G78wC9
d8 u4dY
DB5y[g
 D-B^b
dBkQ"N
d]b:@ s
d{~B-t
DBY/`@
\D= DL
@dD	lH
ddVi)Im
  </dependency>
  <dependency>
    </dependentAssembly>
    <dependentAssembly>
'df%0c@
dF4ADpl
Dfb3b:
d ^g,#
~"Dg~]
D'(G\0
d]H68{
dH`xLxj
D/K?Kn
	*"<DL\
D'l6jLQv
dmh^BD
D%mO4B;p6k
D+?nn:
@#+D%o
dO'4N#EvT
&}d(O8
dOBh^=
!;D/OS
`doVWo
DPP_%/Wr
DP!zN=
DQEcmd
d%Qm}	
DQZyLo
dR~QyV
DS{DjT;3
]D)T"hO{(
%DU(qB-
dV^L{6
D}WzkS
dx.>Kl
{d!Xph*
^dY:$6
}D z^|
!d=z2`*
dZ??A][`I
DZ@OFi
_&:*e-
|> ?$'(E,
e`0Rj!2
E)0RKq
E/3(*[
e*5NO`
E5*Pgb
~e#5\Wj
E7/4QeY7+
\E7xa/
e8F9	J$N
{=]E8wZ
<E9{i,"
e$)A.HL
EAY*9^
?e&b]B(
(eB_.b
eBd30m
&e=}c#B
	EdituQ
.|eeLp
 EePZi5
	E.g.;X>
Ehec%H
'E#JT#
#-#}<eL
?E@`$l
e=LxAj
E[MHK%
emvj;p
END/qo2
 En^h5
Enu`!R
E)qCK!
EQdMXD.
@E ,rd
ErJ`j,
er}t^D
Escape
@EStre
?e*TB?
E,T j@
etXy}f
EU]2G4
>e'u.B?
EU>F*u>
\evS`I
e^WF:%
$EXN'(!
}E`Xx9
^\f,{[
!(|?F|
f08VnB
/@F2):=
f4?3`fz9V
f4gU|	+
f5I|cc@
f6?Y%7
	;F8 Gn
[F9^0!JK
:F9P	v
f'9"r#
FBoM8u'
+ fB$?x
&Fb xU
fcb(tM	
F-)C=Z
F(	D,*
Fd[YHs
f"EaU`,
FE\)Of
fEy;tdy[j$
ffbMSCX
^fF h]
f^GcN[
FGHIJKLM
Fg_sKL
`]fH%Dt
@f@Ie.
}fKpSj
F+l]Ek
FlJDiWp
F\l!JO%
flwMb^
%`fLXi
fm9WW7
F(mAm9;
FM:U f
^fo_@:5
f`p"e.[
Fp}oc8
f_PPa~ak
fPxi5A,
%FRF:J
FroKK+q1
}Fr`~Pl
FRtdu.
/|+Fs	
"fs,.zE
FSz*Fq
ftfn`*
@|;ftw
ftZ)OwQ
[fu1=c%
FU8p)y
?+FuPm
>fuqbY
F%V&5 
f-WO//
<f>>XPX
fY9N,(
fY/(p+6j
?fZ{9f
F*zpBX
+_FZr{
%G,%*!
G0(;TC
g0X+va
G1Bx7p
 g1\YD~
g&2)v=
G3V` 0
G5z4~F
,G7l&/
(g-8` ?
G>8ioAB5
^g8r,r
[g\(bA
#g(B$a
 GBM)[O
G-cL?\b(
	G+C\t
G ;cx8
gdi32.dll
GdipGetImagePaletteSize
gdiplus.dll
#(]G;e
gEQxxDF
GetFileTitleW
GetFileVersionInfoSizeW
GetModuleHandleA
GetProcAddress
GetProcessImageFileNameW
 .g%F%
'!G)g3
GglFC:
GhlfQ|
GI,RU_
giZ`iT
g|~J<R'
GKq42!
gLs(!!
GMC	Og
gMx=}n
`GNnvW
GP>wb@1S
}GQC3I
Gqm^iM70
g"q_"T"A
GradientFill
/g*#Rq
G]s%1'|
~GSLfr
gT1<#f
(gt/[7
GtkWZ	l
g}+tUN
gu&b}y
G[Vx)bk~
*?G<_X
G#)x0#
GZxv)uU
	.h~+!
; @H=-
)H;`*[:
H0|et#
H%0Ux5
H0v(|k
_H2[x"
^ h@_4
h6.bOa
\]h.6Q
	/h8%I
/+|&H9
(hA`9&8
ha'	9I
HAPoV-
H[bY"&s
H"\D<@
:"hda|
|HD,c 
H{D$FAD
=;H'Dwa
H	F?"C
:?-H	Ff
H.	fL]
h<!g4\
hGP=CW6
hH`lK{
hH=Q5a
hijklmnpo
Hi}+&Yy+
hLi`1B1
HlJE[+
HMC4>b
H:nlYGT
HoHzO#1
H}:o?wdy
h"P2<,Ncn
H|Pw3 (7_
@:H;P,X
h>p.xp
#H:Qc+
h]Q]}Q
HRf(Ym
(h~*>s
.Hs!	L8D
ht/@D3,
h&*u:0E*
h<uFI^
HuWBjvj
HVam$>
h*Y?*^"
hy;TOq&e7
h@Z>DO
:**I% 
$@I}%-
I*/::$
i0d .]R
I0TXvs*
I2jPj_K*
	i2q2A
_"I5"r
i@67&|
I6n.xn
]:+i/7NA
|i7</Y
i+=9UA
IaM4_u
iA{<)r
Ibi45/Pg?
i%B|:K
ibm.Ff
i+)c>\H
icO]ql
*'iCTHa
:iCV1Xg
idcooY
I=DFlwc;l
ie6JcMu
i$]Ep+
iFOO7h
iGbo(W
$(igHx`
" iH-A
=,:Ihj
iH N}v
II[ gt
iiyR_J
i;kkV~
}I<lO^
ILPH24
Il[t0vN
I{'m\#
_{$&in
=i<NFE
INfu;M
InternetOpenA
iNw>O[
i<+Ny'4#
Ipt kl
I	Q>0D
	I"Q'3
IQicpP
=I$q@o+QH
(I{Q{y+
I[TjjR
i.^TsT=
\IV4!!
|iv8\p
i\v@t/
{i?W`D
iWlmCqUF
)iWo&r~
i/WRy{eSh
?iwZo9
i	=X&r
I+x"W(
 I,*YN
iyWxQJ
?:(iz-
iz#1\)
iZ3ED{D
 )-Ize
!iZeR}/
Iz_uWuK!
i@@?/Zwq[
J0Uq67
j<}2bP
=J34w zb6
j3{[cao?
j5ak%8Vm
`j,6BW
j?7MT];G
Jac@P`
|j%]B4o
jc3?;%
jC|;7D@e
{&JcOs
>$jE5^d
(_J"g|e
Jil_;>\
[=([JK
]jk5ne
JKKt5N
J}K:o|
JkP1+ 
jl1|g=
jL$%;f
)!JlG,
*'Jm.1S!
j?m.L^
><Jml2L>
jM/V2k4
jO2vgN8C_
>JOop$
JO%Pn-
jp0ihHBr
j{PPLR,R
.J^(qc;F
J(q:E(Z
jrU X"E-
$jS[8mE
jS B_Q
},j}SM
jT?4AX
	-j_`U
JwO(US[
jX'B?	
)JZ2B4
k0GZt 
K]0Qwd=
K1rWOd
k,%2l|
K8!(b3L
K9%G-R
k9m;@%RW
K9XQN=y
k9y#$W
K$A\>g~
}K ALx
KARgqJ
KAu.La~
k;bby<
kdj$P\f0
K%DO1.
	K'Dq\
kdWb~Ao
]kD~(,	x!
K,E|;@
kernel32.dll
KEVE7@m
kF,v8s
>?KgAN
;kgrsD:F
K.Hjfd
:KhJ#X
kihMV(
kISzg6
k}j`TMelU
k{K88H+
kl<:o%!C
km@NTc
Kmp@u 
k	MS8X
KN/;VSjOi
kP9'2+?
_	kPd~
kP(D^LG]
K	P,~M
)k$ PZ
KRv<4Z
K@\Rx{
ks?c_	
KTt8dYe
KTwKSA
%`KUk.
Kum*ru
"K$u~P
_KuP9^U
`kv-:]
Kxa7&$
K?-y`"j
'KyJIE
]l1j\B
L{1=qciJ
L	*=2M
l32:.d
"L3Zmf
_%L4^"
)]l?a*~
	lBH!|:L
[ =lc%:JA
l}ct%b`p
%Le'@C
'!LE&NxRIb
lfbxX0
=Lfy(&
LG#x<	
L^h-&e
	LibcP
lI't')|
Ljq'gi
l'M8o>
}LMfq(
lm?:z7
(lN:"=H
L~	N`K
!L?Nn=]
LoadLibraryA
Loy39:
_L(oZU
#l"p+9b
L'PGTg`
.lpR\EF
lqrdy#4
'LR2aB
!,l(rq
Lru7EM\
*<lTai
L@TD	^
ltI8'!
lTzfoUqg
;\<l=u>
l`UOU2
lv<,Jwo=
l>\VO7
l)v?\!R
}'+Ly~
lZw$Qh
-M2*PY
m<534"
#,M5aM
m'5^KB
M7/rqV
=m8j9=
M98Cr~W
@M98%G^
m{BiPu
m(@+cqd
MD#C!4d
^"mDH|
ME+'Lz
mf4`8Np
mfKlIA
M&g=y,
=mh[a{
MHE't'
 ?MHn~X%P
/MHyBq4uQ"uD
Mi<CNT
miVgRv
%m`}=k
m|^K^&
MkT}rM
ML'[:4B
mMtx~7
M#n^\%
=mN1t&d
MNj&~N
M,nOIp
mnpqrst
Mo	[d&
[_mOUhih
MOZ9^+
 mp3H#k
Mp"K,Q.v
mP*[*r
mq}}0"A
[M#;qE
m@QGF<
M.\r9T
m~}rCId
(MRE&f
[mrj4g
msbG"Tb
msimg32.dll
msJ;g7C
MthUc&<
M<tpnD
mTV]k	
mtzi7 Ov
mV4nWW
	?mV:kK
m!<Wm-&
+]mWNQ;
MwNVA#
m@wtCus
^&MY?%
M	YHCH5
M/ y&s
M/zDF~;
N{.>(!
n1<%+9
n 1w6y
n6{:3"
n$6KVB
n8:.vH
(;|!na
?n/a9`
n,ax{k
n b56.
Nb5&lR
Nb|h3`y
NEKrd`
netapi
,n:/fE|
*nfFq/GU
ngLs)C
Ngv/&:B
nG	wlu
nH<")?
n+H6q&
nHumJA
>nI)hO
+N`$%Jt
-NKC H)
NLCO5E
nlEc(5
nm8_Ln}e= 
nNE$D*c
nN~Xy 
N>"`O]
[NO>)7
-NOx*z	
?N*pMx
;N>q.|_
N*qsTs
?N&reU(c
|n~rR	
*nu[{#
 nudpqk
NU`^eT;~E
nuWqX-
nv<mc6
.@NVT-
NXfiqi
NXzz|e
>nyE^#
,o0@I8
[O1D&~
o)3E7G!
=*O-5l
o5u>kL
O6dLTI8
O@9/r:
O9?wC6
Oad8p.U
o\B)Mb
oBzTs\
od{e!r
<>Oe[I,"
oEm,{v
oe%z',
o>%g@V
	oHfiC
OH@WP(
OHxzo'
OINH~w
OjBiTY~
okQQD%5
ole32.dll
oleacc.dll
oleaut32.dll
oledlg.dll
OleUIBusyW
oL}qd4
o(ml9{[
OMYNRY
oNR1O"]Vy
oN[wzf
%o.@p8
OpenPrinterW
Op[Mh;
OpnmcSV
OPQRSTU
/OPS!V
o+*qA2
o(Qb'1
o>Q-E,
)[OQRn
orPe' 
OSRj(2
OuAqmsw
OUjXFT<
O&V]o1
Ov.tlOlv
o?v;)V
^OW%XtfW
OyvG<-r
_`o=z#
oz)Bq3
oZd%;0{
'p0Y0#8O
P@/!2fn
P-5xtY
Pa/,6y)
PaacaN.
 PABcqV
	P$aHr
PathIsUNCW
P`az`]
pBHJm7-V_
p<B`_s
pBz["V
`P%E>7
;pFTM'
/PH }k
Ph&Ub	
_pHX)l
*;PiyM
P'J/Dn
p'Lp$s
[Pmi0s
'pMlSw
PNDON|
P<ojhv
po^?Ye
Pp8}W~\
Pp o<#
p)qN i
pqrstuvw
^	pr1[&M
printf
PR|j	m
P:rpV1
psapi.dll
\pS]E#
P!t3S`
p+Uf\v
PUMaskV
#PVI$%7
P>$W_\;
(Pw`P`3
px8,-x
pXvhXN
P!$)'y
py-^6{
py`Duu
}P? #Z
p'Z}4N
q;^"%*&
{q:	+03
q0e-;O
q1eow|
>$q(2b
Q45n5Q
q(6hP%
q7UbK<N
q(9}2a
q9V)sq
Q9WTZg
^Q_A]4
Qc478'n
Q	Ca^t8
q}C:Qz
~&-\qd
Q;D'TT9
qdX,`T
qeh=f<v
q%eiuw
QE]M6(S'
%qF:4;
QFIao$d
Q=F}M'I
"Qfqrm
#Q?'fwTg
QGkPb'
[qI}3F
Q|IfTRRy
Q	JiVu
^ qkcr	
Q"/KMD(
ql.R8a:C;
qLwjpn
.QN8@f=
Qo|BU9UN^
q=_Q>p
|	qrBj4
!_Qr~ia
:(qsx]
Qup;5a
QUt0z{
*q%x?!
qXC34?
QXcfz#55Qh=
qxw\~?
Q"y387
qYAZJ(
QZ7&AR
qZ+R.l
qzuJ!)Fk
=}&`R~
R02c{;
r-0$&w
@r1Nk{
R4N?:K
R5,QD]
}?R70lX
R,?)83
;/R8xZb
r9+Baq
,RaG.Yy
RaiseException
>RB4&r
	>RbdM
# RBHw
=[rb@s
?R	C6a
RC	n.TE
RC;`ok~=
]Rc]@_^X
RDR;CY
R/E0QF"
RegQueryValueW
-Rf;bl 
RFjW].
RgF.s0
:~R*gL
=RH-IW
: Rich
`rj$Dq
 rj:Er
rkSoS:E
rktxR,
?&RLm~$<W
r Lu"F
R~M	$1
rM745zz
rmqVF~q_S
%{r{/N
rO:?<Gg
r*Otf*C0C
rpXG&)aU
Rq1I:Zy
R/=ssJ`
!}r~%T
rT.Ijc
R|%-+t*l>
R(TrF|
r{Un"<
r~Vw)Ew
>rX1)p
r/x<	F
rXNU~R
r?YC;b
RZb2h[
R|Z~b'jGrg{
/R~zz1A
/&+	`&s
$"!s\=
S$+\/	?
\s@0q:}
-@s"#1
^s2ilNG%g>sF
s2|~$r
S2Z tj
S3nV%0
s3!o5;
s5<"kb
?s5}Qdi'
#s5^V$:
/$S5Zy
s7Is"F
S<?9S6
Sa0DEG
|,Sa#8
#sA8EI
SAOvpr
`_?=Sb
,S&D(,
SelE m
SeMf`F
sFIaj]
?,SG?#
S|`'Gk
shell32.dll
ShellExecuteExW
shH8XGa\3
shlwapi.dll
shuD^S
SHy Kl
_SJ$|(
}%	S)J
sJBV&?
S:@	Jg
}=sK&l
&s|[OA
SOFTpW
s	otGYu
sOvz;S#
s.PDNPll
spv&ub
s|Q <(
>>sq;T
sqz"E@
SRvu8UA
%`ssqKJ
sT5';tQ
STb;-Q
stomInKi
Strin5g:X
sU7CFA
Su'f[Lv+R
sUo:Fy4'{
su/(|rr
sW;~x$
SwZBK[}
sXuYwZH[_{}]
S!zrM,
 T[12I4
t_2!V-
T#@3VW
t4(^X 1k
?<t :@7
&~&t7/
t>8 5O=
)t8]Ay
T}9Fe5
%T9[^Q?	^
t	A)#2
t]^')a~4
tAS &Po
tA'UdS_\
=Tb2$ 
?{t:Bc
t!BOzy
tdh)v@
td{`"PE
TdWW+Q
te7$ Q
t !egaP
TE{I?*a
@TE]kgF
>t] f3
@tFgavc
	TFile
T/f-x1f
Tfyl1Z
T%gt3*
t`Gxq^$
\thH<K"
!This program cannot be run in DOS mode.
$t*$=I
tid=6a
TIv#$d%
t	kCaj
{T*\$L
tL*Fts&
-t@lVA!
&]]t\M
$TM3ul
~TMs3w
tn3pjI
tO^;9U_4B%6
tp),:8
	<TqwX
_TrackMouseEvent
t"r@_LWs
tR\<wi*
&T'Sh).
T.sKcCp
TSmT1;
t_t!xOx
? t@u@B,&
.tUqE-
tuu$g~
?\(t^V
tv4x8Y
t:vBxJz
tvNd.	
T"VZf	
Tw;hfz?
TW:PcP
t	X+Q~
t`yC^R
t=YT9[C
#+"TZ~
t+z+^L
TZ~.XIiV
u0lRV,
>u2@ZD
u4XHH/
u|=8A.J
:u8TDI
*u8zfM
u?-( 9
U'.@9vr
u**9>W
*UaChx
u?B4z?
#UB_pH
:Ub|QX=bta
uCR&z5W
u)d{p9R
Uepr2v Q
uf.U.K
U{hn9IG
uHrwVe
-UI3-w
UJ!q^)
UjUL!e
uKR^	"
&U?lFf
UlN*Q4
 u? Ls
*<um ;
um	j*gy
UMU1	wf
uNHAx %@
unihq2W
[uNJ:}
UnkGowZ
U=nr=e
UOO%Tcl
upex	~
U!pRSX
&$?uQ>
uQlVs%
user32.dll
ute	Jz
ut`fMemo
UUnp*3
]UuZ4T
UvG89}
UZo-o:
[`<^~V!
v03Ft)
	v-1A9 
V1Fa -
V1M!YC
v2aC?\O
v4kq9g
@"v6'$K
v!6&>PE
V7I`:rR	C
V7xpg(j82
^v8\:[
v83HKJ
v8N4b{
/vAbij
vA"bw#
VAc5yx
VariantChangeTypeEx
VAS|?5
"vb,-a
+VBBI@/
VBUS/;
*vCWQpk
!vCxd}
vd10d~
vd~+~b
\V)Ds/
version.dll
':]Vew
V(ew}D
VeZn	5x
vFr8gNmw
vGS>$j
V=\Gv?
VhnGEh	
vinN^`
VJG{'N
VJ*KQ&
.vjOt3
#vKFlA
[+vk.\x
~<vmM<
,V{Nu]
v!oT-5
VpFf5Y}s|
*~vPZ,
@VruE+-Gc
@Vs0z lTz
^~[vv\1
[Vv<z7H
v%,Vz_Q
V(Wk;~G_1
vxaN1Kt
v;{Xva7e
v(x@zH
v,z s-}
W0$&t&
W1F8+U
+^)=w4Xx
w525n?
}w5hD+
w6i:p<
W^!AK%):S
wApetqeg
wARje#7
W&bC>9
wC\3H4K
W;@C_jd
 w#'{D
#Wdpqjrl
WDv+:R
WdyAAQ
]wEEd<$fXv;
W@eXP8
*W@gGi
%WgJiUH7jd*
<|wguM.
wininet.dll
winspool.drv
"{'WlZ/
:Wmft.
wN"8GBz
_wO[r}W
wPG4,;
`W%pJm-
\~|;wQ
W(R0n8
Wripb--B~U
wRKP@"
W|SaJ^
WSRc6	
|`w<sy
wua	mW
+WuM!"@
]wu)/o
 W%VGZ
ww#UPN,
;]wXjKt
W)x,;y
w%Yr8"
&Wy{rr
w&;@ Z
 WZXC5
X0@?X&0?
]x2c 7
x3FZP1
`x?3PO
X9l(&c<
x/a12$v
XA.3|+
x?Cs&J
#X[CWch
Xd:M72
/;>X]e
X#)f[A
xFp0B<o
XfPh{)
XHXn}`
xiE6.|
xjT&Bv
X_Kj0kVs
xK[JJg
X^KpFj
xkz,w|`
|X:L9R
@%x#m3Ij
X}	M p`Db
`X[N'K
?,>X#Pm
xq"6<RM
xQY01E
xQz1?L
<xR[9c
XrGgYl
/X#@r	I+
)xsmeGp1
XSQWRV
x|.[T:pf
xT)X^|
/%XWb0
XWK^b8+
X_x14?-GX
;.xXG|5g
xyDJ[@~&
]xY#i'
Xy}Ip%v*No
x_zc|g~k
"Y0d8'.
y1@,N^">
y~2T/g
y*2w=ac
Y3XLMPi
y6|w}D
\Y}7<@
y7Uv~v
y8YtG*
YA b^}VZL
 yBkKT
yCD;s*
yc%iK	{
ydLV_]
+ydM\U
,Y-do[
YdU8"$
^ye7nz
!ye{A8
'yEr/d#
Y\&G0N
#y|H%>
YhG);b	c
Yi>"xT
yj}h[eF&
yJtL>}(
yKK&wS
ylS9 O
	\yL.X'
!+&yMJ
YMz}e0
yRc.sD
Y+S8^F
ysg6f`?
yt_uG3Kn]M
@yU%~1F
}yu&Dx
yx},5~o
y`XIC4
{}\:yz
yz01234
"=yZ]L
$yzr%t%C
|[z\)[
Z0Wb^}_g
Z1@UbU
Z4s'wG
$.z4uVf'z#
_z\5oQ
,z}5:X
_@Z87xWX
z8nsZv
Zabcde8fg
z:Al>D
ZB7>K_w
zba+[\9
Z$bF8Qm3\W
+Zb?.O
Z)^C;s
#zCZ?W
zDkihOFC
Zd"Mmt
ZdVvxt
}z)#e4mp
Z=EP]m,
ze\rq)+
zezdc'
zFF~(Ir
]Z;fRU
z+F*Wb
+:Z	#G
|`|Z<H
zHpM_n
	?ZH>Q
z\i@GvD
Z>[iv&7I
z,!|k/
ZK6QwW
z'kGt]
Z>kqf;
<_ZL{+
?Z{l6DW
z.;Lo'
[zo;b9
?!zO)J^
./]~zP:;
}=Z *R
(zRZN%
ZS~MA%7
zUUM3C
zu#VsH&
][Zv4bq
ZwgYC;
;Z!=Wh
Zw/I*x
z@~wqT
Zyd2%5
zyKL G
^Z_Y:z[
Zyz[)y	
?z[)%z
zZ]W1md~