Analysis Date2014-01-30 14:21:30
MD5f0afad08250fa3b24fd369144cc4984a
SHA1f1b68888b80a0d2aa79548c53f7e488bf761c77b

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
SectionUPX0 md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
SectionUPX1 md5: 35f936de79e72720bd60aa32b63c2940 sha1: c4fe9fedf0b22a83191240bf3f4d36d1a13d1048 size: 594944
Section.rsrc md5: b00bc4ef31879263fc0cba1a83b88b56 sha1: eb8085cd1391d678bf4160b9ca77daf3abb79a4d size: 35840
Timestamp2014-01-08 18:48:23
VersionLegalCopyright: DarkTeam© | 2012-2014
ProductVersion: 3.9
ProductName: Speedius 3.9
FileVersion: 3.9
FileDescription: Need For Speed World Trainer
PackerUPX -> www.upx.sourceforge.net
PEhashe607eeac8e2b36240a4f195d44d25b2669fb90df
AVavgGeneric35.BJEN

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates File\Device\Afd\Endpoint
Creates File\Device\Afd\AsyncConnectHlp
Winsock DNSdarkteam.net

Network Details:

DNSdarkteam.net
Type: A
141.101.117.69
DNSdarkteam.net
Type: A
141.101.116.69
HTTP POSThttp://darkteam.net/development/Speedius.php
User-Agent: darkteam.net
Flows TCP192.168.1.1:1031 ➝ 141.101.117.69:80

Raw Pcap
0x00000000 (00000)   504f5354 202f6465 76656c6f 706d656e   POST /developmen
0x00000010 (00016)   742f5370 65656469 75732e70 68702048   t/Speedius.php H
0x00000020 (00032)   5454502f 312e310d 0a436f6e 74656e74   TTP/1.1..Content
0x00000030 (00048)   2d547970 653a2061 70706c69 63617469   -Type: applicati
0x00000040 (00064)   6f6e2f78 2d777777 2d666f72 6d2d7572   on/x-www-form-ur
0x00000050 (00080)   6c656e63 6f646564 0d0a5573 65722d41   lencoded..User-A
0x00000060 (00096)   67656e74 3a206461 726b7465 616d2e6e   gent: darkteam.n
0x00000070 (00112)   65740d0a 486f7374 3a206461 726b7465   et..Host: darkte
0x00000080 (00128)   616d2e6e 65740d0a 436f6e74 656e742d   am.net..Content-
0x00000090 (00144)   4c656e67 74683a20 3135390d 0a436f6e   Length: 159..Con
0x000000a0 (00160)   6e656374 696f6e3a 204b6565 702d416c   nection: Keep-Al
0x000000b0 (00176)   6976650d 0a0d0a65 6e637279 70746564   ive....encrypted
0x000000c0 (00192)   546f6b65 6e3d3230 33303835 32397833   Token=20308529x3
0x000000d0 (00208)   30393930 37397834 37313633 34327832   099079x4716342x2
0x000000e0 (00224)   32333439 34343378 31373438 36333537   2349443x17486357
0x000000f0 (00240)   78323735 33393735 36783235 31373930   x27539756x251790
0x00000100 (00256)   31347832 36353132 37307832 37353130   14x2651270x27510
0x00000110 (00272)   34313878 31353733 33393630 78383936   418x15733960x896
0x00000120 (00288)   37337838 37353137 32357836 37373836   73x8751725x67786
0x00000130 (00304)   35367838 30313634 30317833 39363638   56x8016401x39668
0x00000140 (00320)   36317831 31343436 35392676 65727369   61x1144659&versi
0x00000150 (00336)   6f6e3d33 2e39                         on=3.9


Strings

04FF04b0
 | 2012-2014
DarkTeam
FileDescription
FileVersion
LegalCopyright
Need For Speed World Trainer
ProductName
ProductVersion
SCRIPT
Speedius 3.9
StringFileInfo
Translation
VarFileInfo
VS_VERSION_INFO
,//,))
,(;@>^
$--%"!' 	&,[\
&&'()*+
##@,&%
)?,"(:0
/012R3345566789:;<
@0#1WI@
(,0^4<H
06*`yN
 08vlD!
0[BP:#
0_c_hy
0f}]\uC
& '()0*#G
0Hdi1mo
0j\j=>
?&0;;J s%
0K+A_N$
#^=0KJ
0,LLA=
0LT#|5
:0#/@N
0o0_0n'
)0ofs^
> >0><>P
0|	#RJJ
(,0ry.
0S'7WL
0sw$R'S
0t<NdX
0u?,>(
`0Vh;	I
/0@v?kA
0`':W[
0>@+X.
0x/0#9
>= 0xd8
 0z9H+
0ZEwko
10&sinh?
12ppdq
|:#1*9u
[1d`[vld9
~$1Ea&
]1ehPk
 |	1GO
1IX	;k
1MIVXZD,
1nPb'n1
}1P??H
1-QDal
1Q	Wa3
.)1&tM
1v,u!oM
1W2*w9
1wjTT8
{1ZdYw
-:?)*^2
,2</|$
2[:<:]\
222TXP\
2345''''6789
> 255n
_26).7
2=9DcPV/
2([9_X
2??=D2%
]2`DdD
2NSivN
;}2#Ox
;~',2q9>r
2t4`c.
2tGAt}x,
?2vj>2
3(-,'')-*/%'+
3-@-#32
3'345(t
\)3<B0	
3c#6aK
3+.dNW9k
%3Id&Multi
|3K to
3MQ|h@
/!3Nj8
3%oX$-jC
?3S"	!	#%A
^3sS;U
3yh>a[oq
-43wh	
43_ %^Z]	
=4,5&F
4_7Bhp'n
[47<gL
47u&MS
48Q_"{
4aG_ 3v
&$4C-_@
(`4|cp
4e?EWW
.^4+F"0
4@h(It`b
+4{jra
*!4LB^n
%4om4V
4Qd<YP
4|wXtG
4W@ZPe<r
<	;51>5
5`4[Xl
5~(9A l
'.5<CJ=
5<@D;|
5[FFQK
5l32_<
5L$!9B
}``5lG
;%'5Qe9	
5sA1>E
5SmT4^
5T*!3(
5TJ$d`
`5v2JV
)5v'QB
5[y<#DEq
]5yy{ 
5ZBa Y
 $$((,6 
6$1#SNAN
66[$"m|
66r[w.*'&
	6	/9@
6c9Wfg
6_ee?>
6Hl5C|&a
6\[I_J
\6?Jh\
6KN.pyQ`u
6Logw7!
6m_g/fn&
&6ocdt
6PIDATx
6rk&ZI
6r NPf
6s@v:VZ
\6t6HLy
6U@wkz
6Ww<T|
"6_y?a
74Yi^r
7c4nA j2:+)
7daB?7{
7etchBltI
7F@j|J9Z
7I/SAV
7'|LtC.
7m <[n
"}/'7nZ
7=O%t!DlE
7P4H22
7uw;ZB
^7 vF+
@[7wO] 
&.7Xm]w^
@~7Z8>	
84B*5E
@85^^<@
<88jp[
8$<8\r
=892hk%
8,98:D;G
8{b%A{
8BgSx*z`D	
(8DP\h<
}8,H+M
8+@,H-Pr
8HYa~e
=?#"8I
8i}?1)
/8j!='u
8|)=-k`
8@,KhM
^8_L^$L
8,\l>W
8<r;i3
8@tHtb
8[>zxh9
>?>?(9
95:<8|
),>9?7j
$9999(,04
9<@D\6
}9D^ARq
;*9"E-z
$9F[3P
#9f;F?Qj 
9GphSZq(
9`ioAS
9`^L5N
9`Lj^&
9lpt\6
9;O|s,
9P>\?h@tA
* 9$QB*
9QN,8p
9rLCXkp
#9SBc=Yro
[9%St-B
#9tQHLz
^$9^,u
9u(v?VSs
9Vxv7|
9wnHJkB
>!9ZLb
A0Dz>{
A27~3/
\a2ah$#
a2bi80
A3`spY&
a.4????
A4h$7~
A6XZj7
A7=Y$&
A8OvM*
A-B)@}-)
>?>@ABC	GDEFGHIJKLMf
$[aBHj
;A^B P
ACPgR/
.;AC}u
AddAce
AdjunTok
advapi
ADVAPI32.dll
{~Ae8j
a\Fe`k
A[FgJP
A\@h^=
a<hwk],
@Aj~B`
AKKssx
A^$lM8b
alphJowe+
a&MNx>
`~A%My
'an@!G
 		<application>
		</application>
aPV_7`
~@a|Q9C
:Arc7n
AS]|>F
</assembly>
 			<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" language="*" processorArchitecture="*" publicKeyToken="6595b64144ccf1df"/>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
At-~~~~
aTD^t@
~a;_%^U]
AutoIt 
aWUGqsWD,h
AX}Q:i
AxuN}*
AxWi{vL
(A:Y]Ak
B!`:	(
[b0+d6
b3oleaut
[:b]4t
B~&4zU
{~|b}6
B6@ttRRLDL
ba?`_'
__base
BBg9Bld
]bbq\n
Bfe9?0
Bfz[4`
bGh;;0
b$GlEM
BhacV5
bHL| B
bHPE\<
Bi,3/3=
bKr:gWr+
'~[B=L
B+l@4FH;w0	
BlhQ^g
B(LuEY
B(_m8(
[b $Md
BN]3y1
B_Ogn,
bqg&dh
B;rB,Ep
!bSq9!
BU1U7	
BU45As
bu?P/Y
BUu{zB
b]uXV`{
/$*}bv
ByteToWideChar)DivaV
bZiXH#S
bz$Zr?
%"#{c`
C0'xKo
@C2[ZV?
C=[4zc
c7J2." 
! c9*h
 ] CAP.[
#CAxlete/c
cB:@,]
=C?<C,
CCe)CXv
`cG".J
c gvdX
CH0a^2
.charac
c~HDJb
*-?CHU1
Ch"VHD
chZ7X8
cIdHFQ
CKifae7
$ *C~l;06n
c"M.0h7k
).}cMY$~
cNQ\v}]
C>{O!"
cOc?9r
CoGetObject
%Co#,<i
COMCTL32.dll
COMDLG32.dll
CoMJDn
 	</compatibility>
	<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
CPk+|0
CPNO_A&
:Cq*4:
Cq(\6F
CqTR;i=
Cs.ak[bSp
cS+?Bl
cS=cHpu
C,t?Ln0
C,@?t=M
cUu\ !
c"wk0m
CwR+-z
CWv!H9
CX9w v
CxjS>'
C&zB>&"4y
c.ZPq4
~d_1i?
d1ZYf0
D2{< 8
<d4	5ok
D?48YY
D7piw,j
D7R@3A
\D8%Q>
+D:$8vGE
daf8t+!<)
.-db"	
 db9r6
dBNr`@Q@
DBt G)u
-DBw_hq
|DB\Yt
d? cf>	
%DC<XC
dd!@`3
Dec_uTygr
D'eFB.
 	</dependency>
 	<dependency>
 		</dependentAssembly>
 		<dependentAssembly>
?-Df+]
df8H$?
D,FFf#P
Dg)nMm
Dh8!<X
<dhlpt
%dh\Pu
Di_(yJ
?Dj0Q:
DJZM+Id
D|K$&le"
>d>l>|>
dm"-2Cl
-Dmu=t'	
d\mzo9
?'@-DN
dNaZ*(91&]
dOXH:UDR,
DP;GLu
DragFinish
_dRBXg
\DSCc(G
\ds^qe]c
dST&x!
DT!4dAa
dtOG-^	0
DtSsss;
{DUA[1
Du&B4lc
duvwt7exWbruoi
D>V:e:
DXPwh3
D<xZu`\@
D [YS&
\>e,048\.
,e+29dJW
E3m$6w%
E6H-^u
E6VGHPQ
eC(Pjv
ED9M`Uv
E(d|J#X
>eE4fCr
E?E/EOE
EFIN`UTF
Eh;cp	]SF^
ei1f!P
e/[<i;G
`~EjaX
\:Ejv 
elp32S:phot2E$
e],L S
~e')lW
#]\en%
	*>E\nc
<@En[vP
e}O9(^
Eol'"x
)eQ[3O
+e@q-5
eQTxC/
ErrRH(88
ErW??> '
e]s	C{x7
%E}Sd!
e//sY].
E!T4dA
e	t5fF[(
E:W<u	
Ew_Wg7,mm
e@.X(\
ExitProcess
EXO\+T'1"IR
EXy(? o-
e|+$z^
@e ZX5F,
f})19d
F1jfY#
F-;.2 
F3JK.9
F?4LQ,
F5+Dtk
F6ukA!
@f@@7-
%F94d%
FaTVkB/
fbSeu*
F+FVGB 
.f>h%a9
[fi~	q
flh(\+v
F (n00t
++++f'o9+
fO&w|"
	Fp:1+
FpS+WIs
fPZB	y
f]r)E74^
$fs(,3
FtpOpenFileW
f|Uw :
f~vh87
$Fv@>j
Fvu'SVC
f) $Xpg
!f$Y*[9(
fYwoek
 |+G<+
G0QCdo
G0Ugx{4_
G$4CN'5u,
G4tS-R1
G9$Vvh2%\
@GAap3
+Gbkk+
g	By|(
gCA=d1I
gD{6!$l
GDI32.dll
Genuu_
GetProcAddress
GetProcessMemoryInfo
GetSaveFileNameW
GetValu
GG|.3L
GgSvzV.
gh7 ] 
#GH"T#`$
+'G[?\I{;]
Gi`hzB
gjcJnL
g&J /J
GkA"Ou
GKT[EG
gLPFBIw
$gNRE\
GP]_r~
GSGGij
Gt-Ot$
g/TU\_e
G`u0_Y
#GU22O
G,?U9C:
G~U`K 
gU{q%ZWN(
?@;!GV
g)([|X>H1
G<;y0}j
h:57#g
'H&5o@
&H68h~
H6i9_/T|W
?H\A4k
haSVPw
HAU#5+
?HB``)
$H#`/B
HB>3Rx
hBJjGP;WL
@H}Bzo
.hC^j2
H%d=j@
 HE>8#
h`f{{$
HfCL(W
hF<:O`+
\`hHo5
H;Ibje
^h_*L?-
*Hl0&Th
HLJh},I
Hljq9?a
\.hlpt
H`_:m 
~>~hMP
hnfw)W(
=[H.O5	
HprrrLPTX
H%pwtV>wP
hrGeabi
h Rp0xo0;6
hsYlE)
Ht#1S]3 
htHjlY
Ht!HjU
"H:U;'
huguh8
h|uH%6
[HuiS`
_)=_Hv
-"Hv\|
HV>)]doL_
|HvE @
h'Wc"Vm?sw,
!H*W|l(
H<y]Ag
%h]y-{R
)Hy	Sa\
%}	$!i
i(,,00S
?|I7Z#
IcmpSendEcho
id)LCM
,i[@h/
(iJ>G<>
iK.s8<b
i:lank
;ILi.,Whenp
i~l~#mu
?>i\LS
ImageList_Remove
i+Mj$A+
"IMvX(
i)Mw$;
+!imXi
ineIuV
<in {} quantifi3
i:oo$p
IPHLPAPI.DLL
iq1p~J78;
IQPRs3!
iS&\}\
isCV5]
IsThemeActive
it^~+1
 &)iV'
iv2oc_,%7
IwUGjO^
I'_yM%
i-Y|Y0
[I$ZasX
_IzK.`
i}Z#)n
J1L&F[I
j,;2;#
>J3lM}[
J	4axR
]'j4Zx
j7u:\1
j87d,+PJ7s
j<8n,M
>j	a^%`8
jA[jZ^+
Jd8DB3)
jD/GPO
JD`s&s
J&"#F1
'J@H%>
JH6&2B
-jHX84fZ
JIjAq.
]J'JnW
Jk{203
=`j`KwA
j&lVrG
JmR.}n
`jNBh-
>JNM`5
Jn-PST~D
-jO jH
?JoJJ?
jPdHH+
j+Pyt=
Jq^;d1
*`($J?qN
",[j.!r
jrP;e:
"/jT"X
juwp63
j;V[-e#\
jV>lyt/
jv=WdY
JwJQJ)
%:@jWzv
j=XiW;
j+Yj^;m
Jy.{Lw
}J|ZmF
k1djG;u
|K!5 B
^k5ZW	
<k6pO'Sp
K6qD8Z
@_k:9;
KA46%.
>k	CBe
KeE?-rR
.\kEgM
KERNEL32.DLL
kernel32U
k_eWtE
k&~F14
k	fc)e
KIBHEN
KiE[6!Q
k>? #J
k?jj@fc
~kj@JV
'!/kjWm
kJ!wYJ
KlcA.-
k!/L'i@
(k,`m0
!KMDzH
K)[m-;W)
:known ex
k.+PyP`Tzp
K|<q2J-)P
K,Qv(4
kR<.a*
kSizeof
K^,uDYQ
l"7j,_
}-}Lc7B
'-$LcFS|
lDe4q6#~
leS%WH
LgXUw5
L#hQ=Q
LI*G#U
LineTo
<liYH~3
[L'^K[
L ?=L$
llpptt
<Lm][;
LoadLibraryA
LoadUserProfileW
LOB]BoQ
L!p\1G G
?`Lp.9;r
lptxF6
%Lq~~?@Nt3
!LqQ7'
lQt3=QO<
Lr0DHL
LSIDFr
L.Sj&S
~LtCF	
-LtPq$c5,
'lts]LL
^ltXXb
L~u !\
`L{;U<
lu'Iy/
L[vd+I
lVe/Sq
Lx8'<%
 LXf<(
LX'ht$dI
L |y2V7Al
<@lY Tz	
"]`#\M~
M`[_}'
M1o&GN
m1WY$?]
m 32As
m<4o72
m7Ot%]
Ma8;JVH
mc`m-jp
mDrp(W
-$?M,*f
mfn/c[
??m`)H
,MHI (rN@
M$$&I-'
m<^J~&
}}MjNL
[>Mk	4
m?llkrrr;jojih
#MlPS/
]m_McgG
MMORRrrr;Q
M"nto]
ModuleHandlx&6]
mP7y/m
MPR.dll
mP_'Yv
m(Rl[9o
<MsLssssw
Mta?o8
M =u*V:cMi
M;vDu$
[mvhPB
MWhJSi
MX*K<YQfJ|G
&mxZcMxf,
?M*=;#=YuP
,#m[Zg
<n6qd9
n9NM>6Zx
naHdP8w
nAZp<&tl<!th<otd<]t
@n&c||
=Ndi2I
NeHof p
. >\NfAJg
N	&G6Y
nl-b0-
N}l<i\
@nl#M+
NL&uJ;'
nMUH}j
n'MV<%
NNB{Bn<
Nn'do__/_
n(N{j`
 [NNn_   
";&NNNN
NNNXWWoV
NNspac
_No<f\
N/o//_.Mn7l
n(ot	`
Npooon99
np|Up=
nPv`~p0g
NQPu,0Qj
NrerictunJign
N*R})R[
_n[rrrrH5#
ntU)u54
"nujsc
(null)B
-}n#`v
Nvq~d)h
NW|f#C
nw/kqH
NXBT	:
}-N$xY
{:O($[
o022=[
O1&.66
"?*O(2
)O2^7`
+#O2C*]
O3,yl=
@, O6R+
>O'@}7
~OBD\jO
o,Bi`iX
oCTwsd
o/]%>D	
o+DV>_
o|<E`6
Of|CV 
~}ofH&
OFu=+ 
OH'_8 
OIbET'
ole32.dll
OLEAUT32.dll
O-Lhyt
O-M]0th)p
/ONNN7
_^]o]\Nn''[Z?ZY
OoE%,3
ooiOs?k
o$O$$na
o/rx`b@
oscoRh
@O T'|
oT[y58
@oV#F[N
O;#"W5
O#w_j+
>OYc?W1N
oY (I?H`
ozpE9O
 p,}0C
P0xE06
P1%-I>
)P\$|1J
P1N$`d
p2DZ6RZ
P"3 aq@C~
p\|5?C
?"p5"u,hj?2
]_p`A2
	PA&4p
Pa5Z&o
"p]!Am
]P&B.$
P/B0V#
PB=G2"A
Pb)Kp0
P B"XS
&pcalstd
\pCWt;PA
+pd5Xa
p,.dSta
(,&pEL
peratorJ
P/fGCo
p:fV{(
~pf {>y
p*hp[(
PjdE@J[
Pjn`A[
Pj_O"\
	P[j'pee
=PKBc7M
pLc; ;
 Pl*ok
PLTfQT@
-%}?Pm
PMB%Y4
PMM/dd/y
pND>^,ZN
?]pngP
\PNgRwiK
pno eT8
poolTim
po(	t%H
p<Ot{x
({poYyf
Pq4FB4M
=pQD7|
pR4WeB
p_R:'ko 
PRoRoWF
PSAPI.DLL
PSQ"D'
psr;@H'
PTX\`d
|)P!?Ua0
Pv2<hV]w
!PvH\1
*-pVL x
+PW+2@p
pX6T',
px:F_m
}px;HF
PX`hpx
^p=zC5
Q0T;UE
Q1K`h$
'Q&`1@w
q2[|;6
=q5SGq
<\Q8_lg
"QBO[H@
$Q@Cla
<q@DLP.
_Q\E;q
Q^f99x
(QgdfU
qG	Sw3k
Q_he$c
qi'V5S
qJ=<Kj
q'*J_s{
Qju@9~`
Qkkbal
q;LE|*
?Q"m19
Q:$MHY
+qo,@/
Qp%\sp
QQRB2g
Qr*A.d
qr<\f 3
qsu}_c
q|T9{t%
QTX,XFy
QU?!ATx
QVQ#N>
q	,,Ws
<QX_fm
Q(XGfY
q!$Xj(
QXUV o
=QY=OI=
Qyt4x=
r?>?\ '
r,04ry.
r,2:c`}
/'r2d'
r7Yr7]D
r86Fx;
r$,<89
-=r8o7
r9M9	m8vV
rBA<0Hs	7
rcpyWK
}`R_de
RECURSION'CRRL
rep8t)
 				<requestedExecutionLevel level="requireAdministrator" uiAccess="false"/>
 			</requestedPrivileges>
 			<requestedPrivileges>
Re%wwp
RGh-xba
'rgzGn
Rh$004
rHbad allocationmo
RiVVV{
rJ>}/A(p
Rj?]jHKjv
"=;r;jrMJ
rj!Yf+
R[*M|*G
rm/q(m
r+o@+OR
R`POl=
RPoXK?
r#qh[X
RQ*~(Txx{
=_=rr2
rRF'sMz
rror text 
	rrrr			
.rsrc5
r|$T8H
rtbAtYatTStK
Rt'St!Tt
rXb&<(
$R> +XY8
-"R{Ze?
 s:&*/ 
(=	>s	+
$s0878nvZ
<s0SF-{
s12&fo
"S1d-<
S1H-X=
S3G7TnC
s6x$>a
 s80}:Q
]s9,k&
&'SaMtoxy
sBHSPA@	
sBmNT5J
S.,Br8
SCtZud
#	{sd>
sdkVgR
SdPXr9Q
 		</security>
 		<security>
;(S!e<_F*m
Se+RoAi
SHELL32.dll
sh%|;Y
 sL#rp
Smiss(0
SMu#XH
SohD"TX
S*)Pc`
 @sqtk
SQU"Gf
''SR\k
ssgY6'$
sspucw Y,
sS/R@;@
'START_OPTA
stFHt<ht7Nt+
			<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
			<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
			<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
 			<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
SVo:-	
?SW<Iu
s*wwK&
sX(048
/s+ZtR
?T^&"=
t_"0%@
,t0x4M
|T$2H;-NP
>%t2x{|'
&,T@@3
t]3]L<
-t*4(t
t[;6uE
/!~t8\
`*t8uk
TB%0	o
tbsfp9
tC&~B8
>tCij2Y
tdP|8.&0G\
tE5$ncb
Telv@+
.textW
t@H39#
!This program cannot be run in DOS mode.
#ThTc]n
$$'t#I
t""i\8
tI D7$
timeGetTime
T%iOlC
@.tIt<
$t+`kH \z
TN?+4"r
]TnL>&
t`oMR*
To+mXq
`T	_P,
tP<_tL<
tr(U|$
 	</trustInfo>
 	<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
*`t(s)M,H
TtvKmuR
ttv|O"
@t(`t"+w
`<[t\<\tX<
"t|<%tx<'tt
,|*tu7
Tu'@h4
tuh^q|
tu`@Qx
TUVWXYZ[\]^_`abcdefghijklm
{$T!Vf
!T\vHh!
~^t vI
TvVEpEy
(t,vx+
T"XXF?
`tyRof$&lo( s
tZ<dpj5
Tz}G&U
Tz>Zy3
U1dSoY
U  3rD
u,3z\s
u4 j Wo
U%,4T_
u5{y2	u
U7/B_P/
{U&7TLQ
U8Bt6jv
u],9x@\2
<u^a@ 
u+)B*n
u'bPjP-
uC5NOa
u cz"5
u!Eaev
uen0qB#e
u]/eU|
U"gjRA@
;uH*Qc
],'#U|I
u*I;3F
uIJzR8
UJb*@C
&u&''K
uK$#SX
<uLj>'
,)Uluq
"\UN8H]
Uo%/.CC"
updi7S
 upj(]
upLP,4
Upp_'2]G
uPS0y[
{u,-	pt^^$B
U-qh	vR
>}uQng
UQPXY]Y[
uqWk0d{
u.;~r)
uS9q4uNBa
USER32.dll
USERENV.dll
usOrKe
|u?!u$
U\uI2b
UUT?Sr;99RRQoP
 >UV5]G
.uV_H/>r
 %)	UX
u"-xK{
UxTheme.dll
U ^%X)(W=
UxwMajm
u?ZC|$
^>~%v[<
~v-*?`
",V<[<
v26t*8t\
?	V2/}lv
v3oCB4
v44h<D
@*<v5!
v@5~)H
v8Q[8-
$VaL_%
vC+e_//
vCi>9V
V	C/`w
V+d`](
vd(yc,
VERB)q
VerQueryValueW
VERSION.dll
vEwd(V
_&veWindow
|VfF(F,F0F4ZU
vFl-2/
vg?gfe
 V<Gok
V~H@@8
vi2JaS
Vietkl
VirtualAlloc
VirtualFree
VirtualProtect
vi+r}x
^Vj$@8
Vk?JFK"m
V#K.'U
+vKuG=
vl]|~:
vlPMZx
vmsAttbu
Vn6$!e
vovuttNNNn?srqq
Vo">#Y
V/P0sTP;-
v(`'p2# 
]vQ<)8h
.\V,*r
\,@@VR
vr[[/OV?
vRpI8,
vrrPON?M
vr@U9/
(VSC1V
v SeDH
vsobQA
VS\VI|,z
Vu'v6U 
vuZEeu
[VUzV6
V#vd_@
;Vv	N+0
vWHC`K
v@W#V1
vwxyz{|}~
vx<Y >
 w`*)#
W`(" '
+/w34$O
w3Zv&j
~w4(</
w'4a=!<
W6UJ#te
w7HKm2
w]9(2d
W9#3,{)O_
w<.+!C
w<C:`<r
WE;n<}+
W#f147
.?WH	ccO
 whdB~oHa8
wHTx%I]
wHYP(4
"\wI@fb
[]WiH?^k2
WININET.dll
WINMM.dll
WK7kk:
  WKp`^VP
%/wMN$)
WNetUseConnectionW
wN'SX(
{w+O	H
W~oHuv
wo^t/)
w@ppC.
_WQ7(B
_WQJ&hX?
-,_\wq^sv$
WR33a-
wr;I/II
WSOCK32.dll
WSPO'@`
WSTTd`G
(#|Wtc
WuBO*>q
_WUj'*
#WuLQ'
w/;]vHp6
WvjIp`F
|WVSxavI
&w#/vvbm
_WW/W9
WZlw	I
WZ+/X{o
# $$%x
>??\X$#=
]:&'X\
x0QxGIp
,&X18*
X19<G!
X1/,B1
x3sW C
+|x|5EP
/X6`7h8G
*%?x6PN
x7[ V)
$x8P_?Z
%X9PQk%
X@A+E-
xaM8ayS
xA@-u*>
::x:/CA0U
xD&mx^
$<*XgA	
>.XI@f
XiPV {`
xitPrResD
X@[j-^aR
?#-Xj]Zf
<xl,;l:
xmWOHB
Xn\v=)uT
xnY-^)
xp/:+n
XPTPSW
,*x.SZTq
X*TN&"
X^~';_t|%#P
_ XTwa
xu!!h{)
XV@[K	K
X#VXC0
xW)Ks=
XwL!qGC8
`X&X[8
	XXm,"UMN3
?#%X.y
y1~?|"
Y;~2;Q
`{Y3.;3
y37N]@#
y40$T<&<]K
y4Th{{
]Y64 V
-Y/8!3o9
!*Ya3z
Y:/(A6_
YaxYo 
YD{&F+
|y.FHl7
%y'I6]
y!J1`*
`Yj>Qx
&?~YK|
Yk`{PcGj
YLq;5~
yqy'#m
yR4ZX%
YSP`Y>s
Y)s<s$
Y#]?t	
yTYF9n
YW;3{eI
y.		WF&
y{wYQw
y[^_"x
YX6yQp
YYCf.o%*
yyxw'''
.z.&|&
~ +\,Z'
/Z0:3:
,\z5y2/6
z^6H)8
Z9RvII
ZaL2q&
zC`O)W
\-zD.|
ZEM-'^
'Zfu6}Q
zH7*9S
Z'jK$	u
~z@KS3F/y
\){^|zL2
Zm\`N 
ZO`6%H
Zo[;IU\
ZoJIw4
	Z%Q1	Kf
/zQAC(
zQtcCi
z":.r'
z;So>p
ZTL/$hm
zTp?Up
Zu|,!;
(zXd6H
^Z	$*Y2k
zYMjZjfV
zzc!G1
Z?Z/ZO