Analysis Date2015-03-04 16:24:24
MD5325c62715baa8fd066d0068af7ce65c2
SHA1ddab11910c1093d3e22efd99b5dd5515be97b825

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 49eca36854976bacb03e52a2edb00b18 sha1: 8238c0c259d4c402d437a5595d3e995954a9b151 size: 24064
Section.rdata md5: bed60c9116dbff6d06b51530a732c0c9 sha1: 6dba0bb21c48c914a32e00be24ec402203667819 size: 5120
Section.data md5: ddd201fff50b7e7d81a3d7828b1cc9d4 sha1: 277367c219dd5a966e0036a1b11ac2797da9a6a0 size: 1024
Section.ndata md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Section.rsrc md5: 6455d63d21fc79f9650a5fde80e8748b sha1: 2fdf3534d86bfc1c3c54f69b91d68bb4a3d4d0fc size: 3584
Timestamp2014-10-07 04:40:23
VersionProductName: Razer Cortex
ProductVersion: 5.1.38.0
FileDescription: Razer Cortex
FileVersion: 5.1.38.0
CompanyName: Razer Inc.
PackerNullsoft PiMP Stub -> SFX
PEhashf4eba6716b772fd2f24bc0badb78cb42922e351e
IMPhashe160ef8e55bb9d162da4e266afd9eef3
AV360 Safeno_virus
AVAd-AwareTrojan.GenericKD.2173076
AVAlwil (avast)Malware-gen:Win32:Malware-gen
AVArcabit (arcavir)Trojan.GenericKD.2173076
AVAuthentiumW32/Trojan.LOQD-1082
AVAvira (antivir)TR/Injector.113486
AVBullGuardTrojan.GenericKD.2173076
AVCA (E-Trust Ino)no_virus
AVCAT (quickheal)no_virus
AVClamAVno_virus
AVDr. Webno_virus
AVEmsisoftTrojan.GenericKD.2173076
AVEset (nod32)Win32/Injector.BUUK
AVFortinetno_virus
AVFrisk (f-prot)no_virus
AVF-SecureTrojan.GenericKD.2173076
AVGrisoft (avg)Inject2.BPLA
AVIkarusno_virus
AVK7Trojan ( 004b68481 )
AVKasperskyBackdoor.Win32.Androm.ghyf
AVKaspersky 2015Backdoor.Win32.Androm.ghyf
AVMalwareBytesTrojan.Dropper.NS
AVMcafeeRDN/Generic.dx!djl
AVMicrosoft Security EssentialsWorm:Win32/Gamarue
AVMicroWorld (escan)Trojan.GenericKD.2173076
AVRisingno_virus
AVSophosno_virus
AVSymantecTrojan.Gen.2
AVTrend Microno_virus
AVVirusBlokAda (vba32)no_virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\nsx2.tmp\pecker.dll
Creates FileC:\Documents and Settings\Administrator\Application Data\R.E.M. - Reveal - 06 - Saturn Return.mp3
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temp\nsw1.tmp
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temp\nsx2.tmp\pecker.dll
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temp\nsx2.tmp
Creates ProcessC:\malware.exe

Process
↳ C:\malware.exe

Creates ProcessC:\WINDOWS\system32\msiexec.exe
Creates ProcessC:\WINDOWS\system32\msiexec.exe

Process
↳ C:\WINDOWS\system32\msiexec.exe

RegistryHKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\Explorer\TaskbarNoNotification ➝
NULL
RegistryHKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\Policies\Explorer\Run\4033585203 ➝
C:\Documents and Settings\All Users\msrhmucm.exe\\x00
RegistryHKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\advanced\ShowSuperHidden ➝
NULL
RegistryHKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system\EnableLUA ➝
NULL
RegistryHKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\Explorer\TaskbarNoNotification ➝
NULL
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates File\Device\Afd\AsyncConnectHlp
Winsock DNSpoppin32.info
Winsock DNSpopping45.com
Winsock DNSpoppingj.com
Winsock DNSpoppingd.info
Winsock DNSpoppingk.com
Winsock DNSpoppingh.com
Winsock DNSpoppinge.info
Winsock DNSpopping33.org
Winsock DNSpoppingb.com
Winsock DNSpoppin22.com
Winsock DNSpoppinga.com
Winsock DNSpoppingx.com
Winsock DNSpoppingc.info
Winsock DNSpoppingg.com
Winsock DNSpoppingi.com
Winsock DNSpopping678.org
Winsock DNSpoppin33.com
Winsock DNSpoping45.info
Winsock DNSpoppingf.com
Winsock DNSpoppingma.com

Process
↳ C:\WINDOWS\system32\msiexec.exe

RegistryHKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\Explorer\TaskbarNoNotification ➝
NULL
RegistryHKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\Policies\Explorer\Run\4033585203 ➝
C:\Documents and Settings\All Users\msrhmucm.exe\\x00
RegistryHKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\advanced\ShowSuperHidden ➝
NULL
RegistryHKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system\EnableLUA ➝
NULL
RegistryHKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\Explorer\TaskbarNoNotification ➝
NULL
Creates Filepipe\2600651871
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates File\Device\Afd\AsyncConnectHlp
Winsock DNSpoppin32.info
Winsock DNSpopping45.com
Winsock DNSpoppingj.com
Winsock DNSpoppingd.info
Winsock DNSpoppingk.com
Winsock DNSpoppingh.com
Winsock DNSpoppinge.info
Winsock DNSpopping33.org
Winsock DNSpoppingb.com
Winsock DNSpoppin22.com
Winsock DNSpoppinga.com
Winsock DNSpoppingx.com
Winsock DNSpoppingc.info
Winsock DNSpoppingg.com
Winsock DNSpoppingi.com
Winsock DNSpopping678.org
Winsock DNSpoppin33.com
Winsock DNSpoping45.info
Winsock DNSpoppingf.com
Winsock DNSpoppingma.com

Process
↳ C:\WINDOWS\Explorer.EXE

Creates FilePIPE\wkssvc

Network Details:

DNSupdate.microsoft.com.nsatc.net
Type: A
65.54.51.250
DNSupdate.microsoft.com.nsatc.net
Type: A
65.55.138.126
DNSpoppinga.com
Type: A
69.89.25.171
DNSpoppingb.com
Type: A
94.102.53.180
DNSpoppingd.info
Type: A
166.78.144.80
DNS888950.parkingcrew.net
Type: A
185.53.177.20
DNSpoppingj.com
Type: A
192.0.78.25
DNSpoppingj.com
Type: A
192.0.78.24
DNS888950.parkingcrew.net
Type: A
185.53.177.20
DNSupdate.microsoft.com
Type: A
DNSpoppingx.com
Type: A
DNSpoppingc.info
Type: A
DNSpoppinge.info
Type: A
DNSpoppingf.com
Type: A
DNSpoppingg.com
Type: A
DNSpoppingh.com
Type: A
DNSpoping45.info
Type: A
DNSpoppingi.com
Type: A
DNSpoppingk.com
Type: A
DNSpopping678.org
Type: A
DNSpoppin33.com
Type: A
DNSpopping33.org
Type: A
DNSpopping45.com
Type: A
DNSpoppingma.com
Type: A
DNSpoppin32.info
Type: A
DNSpoppin22.com
Type: A
HTTP POSThttp://poppinga.com/and/gate.php
User-Agent: Mozilla/4.0
HTTP POSThttp://poppingb.com/and/gate.php
User-Agent: Mozilla/4.0
HTTP POSThttp://poppingd.info/and/gate.php
User-Agent: Mozilla/4.0
HTTP POSThttp://poppingg.com/and/gate.php
User-Agent: Mozilla/4.0
HTTP POSThttp://poppingj.com/and/gate.php
User-Agent: Mozilla/4.0
HTTP POSThttp://poppingk.com/and/gate.php
User-Agent: Mozilla/4.0
Flows UDP192.168.1.1:1033 ➝ 8.8.4.4:53
Flows TCP192.168.1.1:1034 ➝ 65.54.51.250:80
Flows UDP192.168.1.1:1035 ➝ 8.8.4.4:53
Flows UDP192.168.1.1:1036 ➝ 8.8.4.4:53
Flows UDP192.168.1.1:1037 ➝ 8.8.4.4:53
Flows TCP192.168.1.1:1039 ➝ 69.89.25.171:80
Flows UDP192.168.1.1:1041 ➝ 8.8.4.4:53
Flows UDP192.168.1.1:1043 ➝ 8.8.4.4:53
Flows UDP192.168.1.1:1044 ➝ 8.8.4.4:53
Flows TCP192.168.1.1:1045 ➝ 94.102.53.180:80
Flows UDP192.168.1.1:1046 ➝ 8.8.4.4:53
Flows TCP192.168.1.1:1047 ➝ 166.78.144.80:80
Flows UDP192.168.1.1:1048 ➝ 8.8.4.4:53
Flows UDP192.168.1.1:1049 ➝ 8.8.4.4:53
Flows UDP192.168.1.1:1050 ➝ 8.8.4.4:53
Flows UDP192.168.1.1:1051 ➝ 8.8.4.4:53
Flows UDP192.168.1.1:1052 ➝ 8.8.4.4:53
Flows TCP192.168.1.1:1053 ➝ 185.53.177.20:80
Flows UDP192.168.1.1:1054 ➝ 8.8.4.4:53
Flows UDP192.168.1.1:1055 ➝ 8.8.4.4:53
Flows UDP192.168.1.1:1056 ➝ 8.8.4.4:53
Flows UDP192.168.1.1:1057 ➝ 8.8.4.4:53
Flows UDP192.168.1.1:1058 ➝ 8.8.4.4:53
Flows UDP192.168.1.1:1059 ➝ 8.8.4.4:53
Flows UDP192.168.1.1:1060 ➝ 8.8.4.4:53
Flows TCP192.168.1.1:1061 ➝ 192.0.78.25:80
Flows UDP192.168.1.1:1062 ➝ 8.8.4.4:53
Flows TCP192.168.1.1:1063 ➝ 185.53.177.20:80
Flows UDP192.168.1.1:1064 ➝ 8.8.4.4:53
Flows UDP192.168.1.1:1065 ➝ 8.8.4.4:53
Flows UDP192.168.1.1:1066 ➝ 8.8.4.4:53
Flows UDP192.168.1.1:1067 ➝ 8.8.4.4:53
Flows UDP192.168.1.1:1068 ➝ 8.8.4.4:53
Flows UDP192.168.1.1:1069 ➝ 8.8.4.4:53
Flows UDP192.168.1.1:1070 ➝ 8.8.4.4:53
Flows UDP192.168.1.1:1071 ➝ 8.8.4.4:53
Flows UDP192.168.1.1:1072 ➝ 8.8.4.4:53
Flows UDP192.168.1.1:1073 ➝ 8.8.4.4:53
Flows UDP192.168.1.1:1074 ➝ 8.8.4.4:53
Flows UDP192.168.1.1:1075 ➝ 8.8.4.4:53
Flows UDP192.168.1.1:1076 ➝ 8.8.4.4:53
Flows UDP192.168.1.1:1077 ➝ 8.8.4.4:53

Raw Pcap
0x00000000 (00000)   504f5354 202f616e 642f6761 74652e70   POST /and/gate.p
0x00000010 (00016)   68702048 5454502f 312e310d 0a436f6e   hp HTTP/1.1..Con
0x00000020 (00032)   74656e74 2d547970 653a2061 70706c69   tent-Type: appli
0x00000030 (00048)   63617469 6f6e2f78 2d777777 2d666f72   cation/x-www-for
0x00000040 (00064)   6d2d7572 6c656e63 6f646564 0d0a436f   m-urlencoded..Co
0x00000050 (00080)   6e6e6563 74696f6e 3a20636c 6f73650d   nnection: close.
0x00000060 (00096)   0a557365 722d4167 656e743a 204d6f7a   .User-Agent: Moz
0x00000070 (00112)   696c6c61 2f342e30 0d0a486f 73743a20   illa/4.0..Host: 
0x00000080 (00128)   706f7070 696e6761 2e636f6d 0d0a436f   poppinga.com..Co
0x00000090 (00144)   6e74656e 742d4c65 6e677468 3a203734   ntent-Length: 74
0x000000a0 (00160)   0d0a4361 6368652d 436f6e74 726f6c3a   ..Cache-Control:
0x000000b0 (00176)   206e6f2d 63616368 650d0a50 7261676d    no-cache..Pragm
0x000000c0 (00192)   613a206e 6f2d6361 6368650d 0a0d0a6b   a: no-cache....k
0x000000d0 (00208)   515a6642 574e612b 4a646135 58313448   QZfBWNa+Jda5X14H
0x000000e0 (00224)   6e6e4f36 72646267 555a484e 6e372f50   nnO6rdbgUZHNn7/P
0x000000f0 (00240)   35326462 67766e50 6449724d 4f497347   52dbgvnPdIrMOIsG
0x00000100 (00256)   6a562b39 6d33536a 68574950 6675340a   jV+9m3SjhWIPfu4.
0x00000110 (00272)   4c563631 446b343d 0a                  LV61Dk4=.

0x00000000 (00000)   504f5354 202f616e 642f6761 74652e70   POST /and/gate.p
0x00000010 (00016)   68702048 5454502f 312e310d 0a436f6e   hp HTTP/1.1..Con
0x00000020 (00032)   74656e74 2d547970 653a2061 70706c69   tent-Type: appli
0x00000030 (00048)   63617469 6f6e2f78 2d777777 2d666f72   cation/x-www-for
0x00000040 (00064)   6d2d7572 6c656e63 6f646564 0d0a436f   m-urlencoded..Co
0x00000050 (00080)   6e6e6563 74696f6e 3a20636c 6f73650d   nnection: close.
0x00000060 (00096)   0a557365 722d4167 656e743a 204d6f7a   .User-Agent: Moz
0x00000070 (00112)   696c6c61 2f342e30 0d0a486f 73743a20   illa/4.0..Host: 
0x00000080 (00128)   706f7070 696e6762 2e636f6d 0d0a436f   poppingb.com..Co
0x00000090 (00144)   6e74656e 742d4c65 6e677468 3a203734   ntent-Length: 74
0x000000a0 (00160)   0d0a4361 6368652d 436f6e74 726f6c3a   ..Cache-Control:
0x000000b0 (00176)   206e6f2d 63616368 650d0a50 7261676d    no-cache..Pragm
0x000000c0 (00192)   613a206e 6f2d6361 6368650d 0a0d0a6b   a: no-cache....k
0x000000d0 (00208)   515a6642 574e612b 4a646135 58313448   QZfBWNa+Jda5X14H
0x000000e0 (00224)   6e6e4f36 72646267 555a484e 6e372f50   nnO6rdbgUZHNn7/P
0x000000f0 (00240)   35326462 67766e50 6449724d 4f497347   52dbgvnPdIrMOIsG
0x00000100 (00256)   6a562b39 6d33536a 68574950 6675340a   jV+9m3SjhWIPfu4.
0x00000110 (00272)   4c563631 446b343d 0a                  LV61Dk4=.

0x00000000 (00000)   504f5354 202f616e 642f6761 74652e70   POST /and/gate.p
0x00000010 (00016)   68702048 5454502f 312e310d 0a436f6e   hp HTTP/1.1..Con
0x00000020 (00032)   74656e74 2d547970 653a2061 70706c69   tent-Type: appli
0x00000030 (00048)   63617469 6f6e2f78 2d777777 2d666f72   cation/x-www-for
0x00000040 (00064)   6d2d7572 6c656e63 6f646564 0d0a436f   m-urlencoded..Co
0x00000050 (00080)   6e6e6563 74696f6e 3a20636c 6f73650d   nnection: close.
0x00000060 (00096)   0a557365 722d4167 656e743a 204d6f7a   .User-Agent: Moz
0x00000070 (00112)   696c6c61 2f342e30 0d0a486f 73743a20   illa/4.0..Host: 
0x00000080 (00128)   706f7070 696e6764 2e696e66 6f0d0a43   poppingd.info..C
0x00000090 (00144)   6f6e7465 6e742d4c 656e6774 683a2037   ontent-Length: 7
0x000000a0 (00160)   340d0a43 61636865 2d436f6e 74726f6c   4..Cache-Control
0x000000b0 (00176)   3a206e6f 2d636163 68650d0a 50726167   : no-cache..Prag
0x000000c0 (00192)   6d613a20 6e6f2d63 61636865 0d0a0d0a   ma: no-cache....
0x000000d0 (00208)   6b515a66 42574e61 2b4a6461 35583134   kQZfBWNa+Jda5X14
0x000000e0 (00224)   486e6e4f 36726462 67555a48 4e6e372f   HnnO6rdbgUZHNn7/
0x000000f0 (00240)   50353264 6267766e 50644972 4d4f4973   P52dbgvnPdIrMOIs
0x00000100 (00256)   476a562b 396d3353 6a685749 50667534   GjV+9m3SjhWIPfu4
0x00000110 (00272)   0a4c5636 31446b34 3d0a                .LV61Dk4=.

0x00000000 (00000)   504f5354 202f616e 642f6761 74652e70   POST /and/gate.p
0x00000010 (00016)   68702048 5454502f 312e310d 0a436f6e   hp HTTP/1.1..Con
0x00000020 (00032)   74656e74 2d547970 653a2061 70706c69   tent-Type: appli
0x00000030 (00048)   63617469 6f6e2f78 2d777777 2d666f72   cation/x-www-for
0x00000040 (00064)   6d2d7572 6c656e63 6f646564 0d0a436f   m-urlencoded..Co
0x00000050 (00080)   6e6e6563 74696f6e 3a20636c 6f73650d   nnection: close.
0x00000060 (00096)   0a557365 722d4167 656e743a 204d6f7a   .User-Agent: Moz
0x00000070 (00112)   696c6c61 2f342e30 0d0a486f 73743a20   illa/4.0..Host: 
0x00000080 (00128)   706f7070 696e6767 2e636f6d 0d0a436f   poppingg.com..Co
0x00000090 (00144)   6e74656e 742d4c65 6e677468 3a203734   ntent-Length: 74
0x000000a0 (00160)   0d0a4361 6368652d 436f6e74 726f6c3a   ..Cache-Control:
0x000000b0 (00176)   206e6f2d 63616368 650d0a50 7261676d    no-cache..Pragm
0x000000c0 (00192)   613a206e 6f2d6361 6368650d 0a0d0a6b   a: no-cache....k
0x000000d0 (00208)   515a6642 574e612b 4a646135 58313448   QZfBWNa+Jda5X14H
0x000000e0 (00224)   6e6e4f36 72646267 555a484e 6e372f50   nnO6rdbgUZHNn7/P
0x000000f0 (00240)   35326462 67766e50 6449724d 4f497347   52dbgvnPdIrMOIsG
0x00000100 (00256)   6a562b39 6d33536a 68574950 6675340a   jV+9m3SjhWIPfu4.
0x00000110 (00272)   4c563631 446b343d 0a0a                LV61Dk4=..

0x00000000 (00000)   504f5354 202f616e 642f6761 74652e70   POST /and/gate.p
0x00000010 (00016)   68702048 5454502f 312e310d 0a436f6e   hp HTTP/1.1..Con
0x00000020 (00032)   74656e74 2d547970 653a2061 70706c69   tent-Type: appli
0x00000030 (00048)   63617469 6f6e2f78 2d777777 2d666f72   cation/x-www-for
0x00000040 (00064)   6d2d7572 6c656e63 6f646564 0d0a436f   m-urlencoded..Co
0x00000050 (00080)   6e6e6563 74696f6e 3a20636c 6f73650d   nnection: close.
0x00000060 (00096)   0a557365 722d4167 656e743a 204d6f7a   .User-Agent: Moz
0x00000070 (00112)   696c6c61 2f342e30 0d0a486f 73743a20   illa/4.0..Host: 
0x00000080 (00128)   706f7070 696e676a 2e636f6d 0d0a436f   poppingj.com..Co
0x00000090 (00144)   6e74656e 742d4c65 6e677468 3a203734   ntent-Length: 74
0x000000a0 (00160)   0d0a4361 6368652d 436f6e74 726f6c3a   ..Cache-Control:
0x000000b0 (00176)   206e6f2d 63616368 650d0a50 7261676d    no-cache..Pragm
0x000000c0 (00192)   613a206e 6f2d6361 6368650d 0a0d0a6b   a: no-cache....k
0x000000d0 (00208)   515a6642 574e612b 4a646135 58313448   QZfBWNa+Jda5X14H
0x000000e0 (00224)   6e6e4f36 72646267 555a484e 6e372f50   nnO6rdbgUZHNn7/P
0x000000f0 (00240)   35326462 67766e50 6449724d 4f497347   52dbgvnPdIrMOIsG
0x00000100 (00256)   6a562b39 6d33536a 68574950 6675340a   jV+9m3SjhWIPfu4.
0x00000110 (00272)   4c563631 446b343d 0a0a                LV61Dk4=..

0x00000000 (00000)   504f5354 202f616e 642f6761 74652e70   POST /and/gate.p
0x00000010 (00016)   68702048 5454502f 312e310d 0a436f6e   hp HTTP/1.1..Con
0x00000020 (00032)   74656e74 2d547970 653a2061 70706c69   tent-Type: appli
0x00000030 (00048)   63617469 6f6e2f78 2d777777 2d666f72   cation/x-www-for
0x00000040 (00064)   6d2d7572 6c656e63 6f646564 0d0a436f   m-urlencoded..Co
0x00000050 (00080)   6e6e6563 74696f6e 3a20636c 6f73650d   nnection: close.
0x00000060 (00096)   0a557365 722d4167 656e743a 204d6f7a   .User-Agent: Moz
0x00000070 (00112)   696c6c61 2f342e30 0d0a486f 73743a20   illa/4.0..Host: 
0x00000080 (00128)   706f7070 696e676b 2e636f6d 0d0a436f   poppingk.com..Co
0x00000090 (00144)   6e74656e 742d4c65 6e677468 3a203734   ntent-Length: 74
0x000000a0 (00160)   0d0a4361 6368652d 436f6e74 726f6c3a   ..Cache-Control:
0x000000b0 (00176)   206e6f2d 63616368 650d0a50 7261676d    no-cache..Pragm
0x000000c0 (00192)   613a206e 6f2d6361 6368650d 0a0d0a6b   a: no-cache....k
0x000000d0 (00208)   515a6642 574e612b 4a646135 58313448   QZfBWNa+Jda5X14H
0x000000e0 (00224)   6e6e4f36 72646267 555a484e 6e372f50   nnO6rdbgUZHNn7/P
0x000000f0 (00240)   35326462 67766e50 6449724d 4f497347   52dbgvnPdIrMOIsG
0x00000100 (00256)   6a562b39 6d33536a 68574950 6675340a   jV+9m3SjhWIPfu4.
0x00000110 (00272)   4c563631 446b343d 0a0a                LV61Dk4=..


Strings
 " "0x\
.E
000004e4
!1Aa
#+3;CScs
5.1.38.0
CompanyName
FileDescription
FileVersion
msctls_progress32
MS Shell Dlg
ProductName
ProductVersion
Razer Cortex
Razer Inc.
StringFileInfo
SysListView32
Translation
VarFileInfo
VS_VERSION_INFO
~|$&$=
*?|<>/":
0UEq}R
1wg^	F
1Z(|&J3{
23Y_XO
261w[a
2(@S;LC
;=~=3a
@5Be}N
6b*&aRK
6CG``h
6?E[/M;-
6htN(17
6kohK9
6VTU>k
;%"7BV
7cLf03
8K|B<-
8) u}g
983L.d
$9fz,JZJ
9y]_	]
'$9y$p(Gm
AdjustTokenPrivileges
ADVAPI32
ADVAPI32.dll
aGUj^<M
al{f9^
AppendMenuA
a=%,Wu
b:}_ -)
B\4Fi'!J|
B8v>dF
BeginPaint
bF:Y\K
}`,>Bg5
;bn6X*
*-*B-u'
CallWindowProcA
C+	C+	C
"!CDzJ
#c'[e!
c']!Gw
CharNextA
CharPrevA
CheckDlgButton
CloseClipboard
CloseHandle
CoCreateInstance
COMCTL32.dll
CompareFileTime
Control Panel\Desktop\ResourceLocale
CopyFileA
CoTaskMemFree
CreateBrushIndirect
CreateDialogParamA
CreateDirectoryA
CreateFileA
CreateFontIndirectA
CreatePopupMenu
CreateProcessA
CreateThread
CreateWindowExA
/[Cy^z
... %d%%
=*D:8~
@.data
dbp\Fy
D$$+D$
D$,+D$$P
.DEFAULT\Control Panel\International
DefWindowProcA
DeleteFileA
DeleteObject
DestroyWindow
DGlmK*KT
DialogBoxParamA
DispatchMessageA
dmE'U.p
D$(Ph,
DrawTextA
D$,SPS
DY~Vh#?
E08a~D
E4)V}(RYTlq
e5nWY=[
ed/'{%
((EE%2
EgYn1[
EiAoBYy
)]E{J]
EmptyClipboard
EnableMenuItem
EnableWindow
EndDialog
EndPaint
!E;,qgyo
Error launching installer
Error writing temporary file. Make sure your temp folder is valid.
ExitProcess
ExitWindowsEx
ExpandEnvironmentStringsA
E_ZHEJ
FdLg8l4n
ff&l+l
]fg#[V
FillRect
FindClose
FindFirstFileA
FindNextFileA
FindWindowExA
FreeLibrary
G&3O[m*
+[`>g4
~(^GB<
GDI32.dll
GE9u2b
GetClassInfoA
GetClientRect
GetCommandLineA
GetCurrentProcess
GetDeviceCaps
GetDiskFreeSpaceA
GetDiskFreeSpaceExA
GetDlgItem
GetDlgItemTextA
GetExitCodeProcess
GetFileAttributesA
GetFileSize
GetFileVersionInfoA
GetFileVersionInfoSizeA
GetFullPathNameA
GetLastError
GetMessagePos
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileStringA
GetProcAddress
GetShortPathNameA
GetSysColor
GetSystemDirectoryA
GetSystemMenu
GetSystemMetrics
GetTempFileNameA
GetTempPathA
GetTickCount
GetUserDefaultUILanguage
GetVersion
GetWindowLongA
GetWindowRect
GetWindowsDirectoryA
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
%Gn0V"
g;S0T|8
H$quhbd
http://nsis.sf.net/NSIS_Error
HtVHtHH
*I%8I%h
?I8==N
#=i<{F
+i^#M#
ImageList_AddMasked
ImageList_Create
ImageList_Destroy
incomplete download and damaged media. Contact the
InitiateShutdownA
Installer integrity check has failed. Common causes include
installer's author to obtain a new copy.
Instu`
InvalidateRect
iRichu
IsWindow
IsWindowEnabled
IsWindowVisible
I ^`U!
ji?h/C
jMzKp/
JS%NIP
j*z`2v
KERNEL32
KERNEL32.dll
k^gjf/s
KIGD4C="
KL&hEr
kU(A`81
KVZ-!L
k(XK)"/
^kyCY`V2
lAQB7:
LoadBitmapA
LoadCursorA
LoadImageA
LoadLibraryA
LoadLibraryExA
LookupPrivilegeValueA
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpyA
lstrcpynA
lstrlenA
=LS&Yd%
M2&3I^
MessageBoxIndirectA
\Microsoft\Internet Explorer\Quick Launch
M{LGLq
More information at:
;mo$"U
MoveFileA
MoveFileExA
m)u\d'23\
MulDiv
MultiByteToWideChar
[nb:!,
.ndata
nFbfKT
NSIS Error
~nsu.tmp
NullsoftInstu
NulluN	E
{"og^,
ole32.dll
OleInitialize
OleUninitialize
	~OoXK
OpenClipboard
OpenProcessToken
Oqq\<5
p1Fl%v
p5Z}Im
,Pay=X"MxO
PeekMessageA
Pk>4^bp
p$mg|g
PoDwz&
PostQuitMessage
PPPPPP
pt1q;y
QufRufR
qw{!QP
`.rdata
ReadFile
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegDeleteKeyExA
RegDeleteValueA
RegEnumKeyA
RegEnumValueA
RegisterClassA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
ReleaseDC
RemoveDirectoryA
[Rename]
.rFAM&?
RichEd20
RichEd32
RichEdit
RichEdit20A
\$R(L]
rPl<@'
+rsATD
"RZ<3bJ
ScreenToClient
SearchPathA
SelectObject
SendMessageA
SendMessageTimeoutA
SeShutdownPrivilege
SetBkColor
SetBkMode
SetClassLongA
SetClipboardData
SetCurrentDirectoryA
SetCursor
SetDlgItemTextA
SetEnvironmentVariableA
SetErrorMode
SetFileAttributesA
SetFilePointer
SetFileTime
SetForegroundWindow
SetTextColor
SetTimer
SetWindowLongA
SetWindowPos
SetWindowTextA
SHAutoComplete
SHBrowseForFolderA
SHELL32.dll
ShellExecuteA
SHFileOperationA
SHFOLDER
SHGetFileInfoA
SHGetFolderPathA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHLWAPI
ShowWindow
{^SM/4
softuW
Software\Microsoft\Windows\CurrentVersion
SQSSSPW
SystemParametersInfoA
t3q vp
tBr$JH
!This program cannot be run in DOS mode.
tn<q]b
_^[t	P
TQn/[U
TrackPopupMenu
u6s	:l>4A
u6 @tKP
<@UAb$
u_dA$'Y
]:.Un3
USER32.dll
%u.%u%s%s
UUTnX%
UZXn(_
verifying installer: %d%%
VerQueryValueA
VERSION.dll
v$hP>Cq
VjGt[^
Vj%SSS
vuF4bDU
v#VhB+@
Vzer] 
W9?HM@
WaitForSingleObject
#'WE~[r
WriteFile
WritePrivateProfileStringA
wsprintfA
w~U.s<
,WV+o(
w%+]WB
wwwwwwww
wwwwwwwxp
*wYy5k
>	|+x-
x 2Ftg
XaG5U4/t*
xE-RlJ
?xLeS='s
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="*" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v3.0b1</description><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/></application></compatibility></assembly>
xmSj\1v
xT~OcG
~Xx&JY
y5OG{*
Y&}c:Q
y(D9%j Zf
y!/dUA
($|?YtHM
Za.4W"[
z.avUp[