Analysis Date2018-03-28 19:33:32
MD5a227e5ceaf93c0b9cdd2c7dfb9e63fd4
SHA1f29c710edbe52675b066bb3196bfa07ce2b69db5

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section md5: aed4a14b2d9cbc1857b4da1c0545b115 sha1: 8e017b7c4ede75c832f243fb0ad47f8788495688 size: 222208
Section md5: 13bd4d46a4aad40f495e792e92919d91 sha1: a8bbfe26da6d200145870b7e718a807f2c5789f2 size: 53760
Section md5: c42bd68d0b94594c14bee3b0657f53ba sha1: 0373d6f22350def59d70c2c39add0e512dcdb850 size: 5632
Section.rsrc md5: 7cf45b5731de8e641cb5310a8e83a1fc sha1: 260169c8523f17d48dc637837476dc4b77a3a330 size: 351232
Section md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Section55fga md5: f51d3a9204708741b1fbf41bdccf703e sha1: e5544d5e1c056292d548ed30e4d2429b3bf06fc7 size: 316928
Section.adata md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Timestamp2014-01-11 11:43:37
VersionLegalCopyright: Copyright (C) 2014
ProductVersion11: 1, qwerwqer, 0, 1
FileVersion: 1, 1223143, 0, 1
FileVersion11: 1, 12wer321, 0, 1
LegalCopyright11: Copyright (C) 2014
ProductVersion: 1, 123wer21, 0, 1
FileDescription: weqrewqrewr
PackerASProtect v1.2
PEhashcd54295d9e8f06b2aee64634855bc8a9535757c2
AVArcabit (arcavir)Gen:Variant.Adware.Symmi.37537
AVAuthentiumNo Virus
AVGrisoft (avg)FakeAV_r.XQ
AVAvira (antivir)TR/Crypt.XPACK.Gen7
AVAlwil (avast)Evo-gen [Susp]
AVAd-AwareGen:Variant.Adware.Symmi.37537
AVBitDefenderGen:Variant.Adware.Symmi.37537
AVBullGuardError Scanning File
AVClamAVError Scanning File
AVDr. WebTrojan.FakeAV.16383
AVEmsisoftGen:Variant.Adware.Symmi.37537
AVMicroWorld (escan)Gen:Variant.Adware.Symmi.37537
AVCA (E-Trust Ino)Error Scanning File
AVFortinetW32/FakeAV.AC!tr
AVFrisk (f-prot)No Virus
AVF-SecureNo Virus
AVIkarusError Scanning File
AVK7No Virus
AVKasperskyError Scanning File
AVMalwareBytesTrojan.FakeAV
AVMcafeeFakeAlert-FSY!A227E5CEAF93
AVMicrosoft Security EssentialsRogue:Win32/FakePAV
AVNANOTrojan.Win32.Dapato.cutwmu
AVEset (nod32)Win32/AdWare.WindowsExpertConsole.AG
AVPadvishNo Virus
AVCAT (quickheal)No Virus
AVRisingNo Virus
AV360 SafeNo Virus
AVSUPERAntiSpywareTrojan.Agent/Gen-Faldesc
AVSymantecNo Virus
AVTrend MicroNo Virus
AVTwisterTrojan.BBD249B4EC5E6522
AVVirusBlokAda (vba32)No Virus
AVWindows DefenderRogue:Win32/FakePAV
AVZillya!Error Scanning File

Runtime Details:

Screenshot

Process
↳ C:\Windows\System32\lsass.exe

Process
↳ C:\Users\Phil\AppData\Local\Temp\f29c710edbe52675b066bb3196bfa07ce2b69db5.exe

Creates FileC:\Users\Phil\AppData\Local\Temp\f29c710edbe52675b066bb3196bfa07ce2b69db5.exe

Process
↳ C:\Users\Phil\AppData\Roaming\proto-jjka.exe

Creates FileC:\Users\Phil\AppData\Roaming\proto-jjka.exe

Process
↳ C:\Windows\SysWOW64\cmd.exe

Creates File\??\NUL

Process
↳ C:\Windows\SysWOW64\mshta.exe

Creates MutexLocal\!PrivacIE!SharedMemory!Mutex
Creates Mutex
Creates MutexRasPbFile
Creates FileC:\Windows\Globalization\Sorting\sortdefault.nls
Creates FileC:\Users\Phil\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
Creates FileC:\Users\Phil\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
Creates FileC:\Users\Phil\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\mshta_RASAPI32\EnableFileTracing ➝
0
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\mshta_RASAPI32\EnableConsoleTracing ➝
0
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\mshta_RASAPI32\FileTracingMask ➝
4294901760
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\mshta_RASAPI32\ConsoleTracingMask ➝
4294901760
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\mshta_RASAPI32\MaxFileSize ➝
1048576
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\mshta_RASAPI32\FileDirectory ➝
%windir%\tracing

Process
↳ C:\Windows\SysWOW64\sc.exe

Creates FileC:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui
Creates FileC:\Windows\SysWOW64\en-US\sc.exe.mui

Process
↳ C:\Windows\SysWOW64\sc.exe

Creates FileC:\Windows\SysWOW64\en-US\sc.exe.mui

Network Details:

DNScheckip.dyndns.com
Type: A
216.146.38.70
DNScheckip.dyndns.com
Type: A
216.146.39.70
DNScheckip.dyndns.com
Type: A
216.146.43.70
DNScheckip.dyndns.com
Type: A
91.198.22.70
DNScheckip.dyndns.org
Type: A
HTTP GEThttp://checkip.dyndns.org/
User-Agent: Mozilla/4.0
Flows TCP192.168.1.1:1031 ➝ 216.146.38.70:80

Raw Pcap
0x00000000 (00000)   47455420 2f6e6373 692e7478 74204854   GET /ncsi.txt HT
0x00000010 (00016)   54502f31 2e310d0a 436f6e6e 65637469   TP/1.1..Connecti
0x00000020 (00032)   6f6e3a20 436c6f73 650d0a55 7365722d   on: Close..User-
0x00000030 (00048)   4167656e 743a204d 6963726f 736f6674   Agent: Microsoft
0x00000040 (00064)   204e4353 490d0a48 6f73743a 20777777    NCSI..Host: www
0x00000050 (00080)   2e6d7366 746e6373 692e636f 6d0d0a0d   .msftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f6e6373 692e7478 74204854   GET /ncsi.txt HT
0x00000010 (00016)   54502f31 2e310d0a 436f6e6e 65637469   TP/1.1..Connecti
0x00000020 (00032)   6f6e3a20 436c6f73 650d0a55 7365722d   on: Close..User-
0x00000030 (00048)   4167656e 743a204d 6963726f 736f6674   Agent: Microsoft
0x00000040 (00064)   204e4353 490d0a48 6f73743a 20777777    NCSI..Host: www
0x00000050 (00080)   2e6d7366 746e6373 692e636f 6d0d0a0d   .msftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f6e6373 692e7478 74204854   GET /ncsi.txt HT
0x00000010 (00016)   54502f31 2e310d0a 436f6e6e 65637469   TP/1.1..Connecti
0x00000020 (00032)   6f6e3a20 436c6f73 650d0a55 7365722d   on: Close..User-
0x00000030 (00048)   4167656e 743a204d 6963726f 736f6674   Agent: Microsoft
0x00000040 (00064)   204e4353 490d0a48 6f73743a 20777777    NCSI..Host: www
0x00000050 (00080)   2e6d7366 746e6373 692e636f 6d0d0a0d   .msftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x00000020 (00032)   6c6c612f 342e300d 0a486f73 743a2063   lla/4.0..Host: c
0x00000030 (00048)   6865636b 69702e64 796e646e 732e6f72   heckip.dyndns.or
0x00000040 (00064)   670d0a0d 0a0d0a48 6f73743a 20777777   g......Host: www
0x00000050 (00080)   2e6d7366 746e6373 692e636f 6d0d0a0d   .msftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   47455420 2f6e6373 692e7478 74204854   GET /ncsi.txt HT
0x00000010 (00016)   54502f31 2e310d0a 436f6e6e 65637469   TP/1.1..Connecti
0x00000020 (00032)   6f6e3a20 436c6f73 650d0a55 7365722d   on: Close..User-
0x00000030 (00048)   4167656e 743a204d 6963726f 736f6674   Agent: Microsoft
0x00000040 (00064)   204e4353 490d0a48 6f73743a 20777777    NCSI..Host: www
0x00000050 (00080)   2e6d7366 746e6373 692e636f 6d0d0a0d   .msftncsi.com...
0x00000060 (00096)   0a                                    .

0x00000000 (00000)   504f5354 202f3365 31363236 34372d63   POST /3e162647-c
0x00000010 (00016)   3364382d 34346333 2d393937 622d3061   3d8-44c3-997b-0a
0x00000020 (00032)   63396135 66363838 33322f20 48545450   c9a5f68832/ HTTP
0x00000030 (00048)   2f312e31 0d0a4361 6368652d 436f6e74   /1.1..Cache-Cont
0x00000040 (00064)   726f6c3a 206e6f2d 63616368 650d0a43   rol: no-cache..C
0x00000050 (00080)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000060 (00096)   0d0a5072 61676d61 3a206e6f 2d636163   ..Pragma: no-cac
0x00000070 (00112)   68650d0a 436f6e74 656e742d 54797065   he..Content-Type
0x00000080 (00128)   3a206170 706c6963 6174696f 6e2f736f   : application/so
0x00000090 (00144)   61702b78 6d6c0d0a 55736572 2d416765   ap+xml..User-Age
0x000000a0 (00160)   6e743a20 57534441 50490d0a 436f6e74   nt: WSDAPI..Cont
0x000000b0 (00176)   656e742d 4c656e67 74683a20 3733330d   ent-Length: 733.
0x000000c0 (00192)   0a486f73 743a2031 39322e31 36382e31   .Host: 192.168.1
0x000000d0 (00208)   30302e31 39303a35 3335370d 0a0d0a3c   00.190:5357....<
0x000000e0 (00224)   3f786d6c 20766572 73696f6e 3d22312e   ?xml version="1.
0x000000f0 (00240)   30222065 6e636f64 696e673d 22757466   0" encoding="utf
0x00000100 (00256)   2d38223f 3e3c736f 61703a45 6e76656c   -8"?><soap:Envel
0x00000110 (00272)   6f706520 786d6c6e 733a736f 61703d22   ope xmlns:soap="
0x00000120 (00288)   68747470 3a2f2f77 77772e77 332e6f72   http://www.w3.or
0x00000130 (00304)   672f3230 30332f30 352f736f 61702d65   g/2003/05/soap-e
0x00000140 (00320)   6e76656c 6f706522 20786d6c 6e733a77   nvelope" xmlns:w
0x00000150 (00336)   73613d22 68747470 3a2f2f73 6368656d   sa="http://schem
0x00000160 (00352)   61732e78 6d6c736f 61702e6f 72672f77   as.xmlsoap.org/w
0x00000170 (00368)   732f3230 30342f30 382f6164 64726573   s/2004/08/addres
0x00000180 (00384)   73696e67 2220786d 6c6e733a 6c6d733d   sing" xmlns:lms=
0x00000190 (00400)   22687474 703a2f2f 73636865 6d61732e   "http://schemas.
0x000001a0 (00416)   6d696372 6f736f66 742e636f 6d2f7769   microsoft.com/wi
0x000001b0 (00432)   6e646f77 732f6c6d 732f3230 30372f30   ndows/lms/2007/0
0x000001c0 (00448)   38223e3c 736f6170 3a486561 6465723e   8"><soap:Header>
0x000001d0 (00464)   3c777361 3a546f3e 75726e3a 75756964   <wsa:To>urn:uuid
0x000001e0 (00480)   3a336531 36323634 372d6333 64382d34   :3e162647-c3d8-4
0x000001f0 (00496)   3463332d 39393762 2d306163 39613566   4c3-997b-0ac9a5f
0x00000200 (00512)   36383833 323c2f77 73613a54 6f3e3c77   68832</wsa:To><w
0x00000210 (00528)   73613a41 6374696f 6e3e6874 74703a2f   sa:Action>http:/
0x00000220 (00544)   2f736368 656d6173 2e786d6c 736f6170   /schemas.xmlsoap
0x00000230 (00560)   2e6f7267 2f77732f 32303034 2f30392f   .org/ws/2004/09/
0x00000240 (00576)   7472616e 73666572 2f476574 3c2f7773   transfer/Get</ws
0x00000250 (00592)   613a4163 74696f6e 3e3c7773 613a4d65   a:Action><wsa:Me
0x00000260 (00608)   73736167 6549443e 75726e3a 75756964   ssageID>urn:uuid
0x00000270 (00624)   3a666131 38666535 332d3930 33662d34   :fa18fe53-903f-4
0x00000280 (00640)   3736312d 62663436 2d306532 32323264   761-bf46-0e2222d
0x00000290 (00656)   33626665 333c2f77 73613a4d 65737361   3bfe3</wsa:Messa
0x000002a0 (00672)   67654944 3e3c7773 613a5265 706c7954   geID><wsa:ReplyT
0x000002b0 (00688)   6f3e3c77 73613a41 64647265 73733e68   o><wsa:Address>h
0x000002c0 (00704)   7474703a 2f2f7363 68656d61 732e786d   ttp://schemas.xm
0x000002d0 (00720)   6c736f61 702e6f72 672f7773 2f323030   lsoap.org/ws/200
0x000002e0 (00736)   342f3038 2f616464 72657373 696e672f   4/08/addressing/
0x000002f0 (00752)   726f6c65 2f616e6f 6e796d6f 75733c2f   role/anonymous</
0x00000300 (00768)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000310 (00784)   613a5265 706c7954 6f3e3c77 73613a46   a:ReplyTo><wsa:F
0x00000320 (00800)   726f6d3e 3c777361 3a416464 72657373   rom><wsa:Address
0x00000330 (00816)   3e75726e 3a757569 643a6130 38313139   >urn:uuid:a08119
0x00000340 (00832)   65632d30 3665362d 34643834 2d613636   ec-06e6-4d84-a66
0x00000350 (00848)   342d6131 64643862 36343639 61363c2f   4-a1dd8b6469a6</
0x00000360 (00864)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000370 (00880)   613a4672 6f6d3e3c 6c6d733a 4c617267   a:From><lms:Larg
0x00000380 (00896)   654d6574 61646174 61537570 706f7274   eMetadataSupport
0x00000390 (00912)   2f3e3c2f 736f6170 3a486561 6465723e   /></soap:Header>
0x000003a0 (00928)   3c736f61 703a426f 64792f3e 3c2f736f   <soap:Body/></so
0x000003b0 (00944)   61703a45 6e76656c 6f70653e            ap:Envelope>

0x00000000 (00000)   504f5354 202f3365 31363236 34372d63   POST /3e162647-c
0x00000010 (00016)   3364382d 34346333 2d393937 622d3061   3d8-44c3-997b-0a
0x00000020 (00032)   63396135 66363838 33322f20 48545450   c9a5f68832/ HTTP
0x00000030 (00048)   2f312e31 0d0a4361 6368652d 436f6e74   /1.1..Cache-Cont
0x00000040 (00064)   726f6c3a 206e6f2d 63616368 650d0a43   rol: no-cache..C
0x00000050 (00080)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000060 (00096)   0d0a5072 61676d61 3a206e6f 2d636163   ..Pragma: no-cac
0x00000070 (00112)   68650d0a 436f6e74 656e742d 54797065   he..Content-Type
0x00000080 (00128)   3a206170 706c6963 6174696f 6e2f736f   : application/so
0x00000090 (00144)   61702b78 6d6c0d0a 55736572 2d416765   ap+xml..User-Age
0x000000a0 (00160)   6e743a20 57534441 50490d0a 436f6e74   nt: WSDAPI..Cont
0x000000b0 (00176)   656e742d 4c656e67 74683a20 3733330d   ent-Length: 733.
0x000000c0 (00192)   0a486f73 743a2031 39322e31 36382e31   .Host: 192.168.1
0x000000d0 (00208)   30302e31 39383a35 3335370d 0a0d0a3c   00.198:5357....<
0x000000e0 (00224)   3f786d6c 20766572 73696f6e 3d22312e   ?xml version="1.
0x000000f0 (00240)   30222065 6e636f64 696e673d 22757466   0" encoding="utf
0x00000100 (00256)   2d38223f 3e3c736f 61703a45 6e76656c   -8"?><soap:Envel
0x00000110 (00272)   6f706520 786d6c6e 733a736f 61703d22   ope xmlns:soap="
0x00000120 (00288)   68747470 3a2f2f77 77772e77 332e6f72   http://www.w3.or
0x00000130 (00304)   672f3230 30332f30 352f736f 61702d65   g/2003/05/soap-e
0x00000140 (00320)   6e76656c 6f706522 20786d6c 6e733a77   nvelope" xmlns:w
0x00000150 (00336)   73613d22 68747470 3a2f2f73 6368656d   sa="http://schem
0x00000160 (00352)   61732e78 6d6c736f 61702e6f 72672f77   as.xmlsoap.org/w
0x00000170 (00368)   732f3230 30342f30 382f6164 64726573   s/2004/08/addres
0x00000180 (00384)   73696e67 2220786d 6c6e733a 6c6d733d   sing" xmlns:lms=
0x00000190 (00400)   22687474 703a2f2f 73636865 6d61732e   "http://schemas.
0x000001a0 (00416)   6d696372 6f736f66 742e636f 6d2f7769   microsoft.com/wi
0x000001b0 (00432)   6e646f77 732f6c6d 732f3230 30372f30   ndows/lms/2007/0
0x000001c0 (00448)   38223e3c 736f6170 3a486561 6465723e   8"><soap:Header>
0x000001d0 (00464)   3c777361 3a546f3e 75726e3a 75756964   <wsa:To>urn:uuid
0x000001e0 (00480)   3a336531 36323634 372d6333 64382d34   :3e162647-c3d8-4
0x000001f0 (00496)   3463332d 39393762 2d306163 39613566   4c3-997b-0ac9a5f
0x00000200 (00512)   36383833 323c2f77 73613a54 6f3e3c77   68832</wsa:To><w
0x00000210 (00528)   73613a41 6374696f 6e3e6874 74703a2f   sa:Action>http:/
0x00000220 (00544)   2f736368 656d6173 2e786d6c 736f6170   /schemas.xmlsoap
0x00000230 (00560)   2e6f7267 2f77732f 32303034 2f30392f   .org/ws/2004/09/
0x00000240 (00576)   7472616e 73666572 2f476574 3c2f7773   transfer/Get</ws
0x00000250 (00592)   613a4163 74696f6e 3e3c7773 613a4d65   a:Action><wsa:Me
0x00000260 (00608)   73736167 6549443e 75726e3a 75756964   ssageID>urn:uuid
0x00000270 (00624)   3a343436 34623663 302d3630 64342d34   :4464b6c0-60d4-4
0x00000280 (00640)   6139322d 61363464 2d306338 37303962   a92-a64d-0c8709b
0x00000290 (00656)   66616364 313c2f77 73613a4d 65737361   facd1</wsa:Messa
0x000002a0 (00672)   67654944 3e3c7773 613a5265 706c7954   geID><wsa:ReplyT
0x000002b0 (00688)   6f3e3c77 73613a41 64647265 73733e68   o><wsa:Address>h
0x000002c0 (00704)   7474703a 2f2f7363 68656d61 732e786d   ttp://schemas.xm
0x000002d0 (00720)   6c736f61 702e6f72 672f7773 2f323030   lsoap.org/ws/200
0x000002e0 (00736)   342f3038 2f616464 72657373 696e672f   4/08/addressing/
0x000002f0 (00752)   726f6c65 2f616e6f 6e796d6f 75733c2f   role/anonymous</
0x00000300 (00768)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000310 (00784)   613a5265 706c7954 6f3e3c77 73613a46   a:ReplyTo><wsa:F
0x00000320 (00800)   726f6d3e 3c777361 3a416464 72657373   rom><wsa:Address
0x00000330 (00816)   3e75726e 3a757569 643a6130 38313139   >urn:uuid:a08119
0x00000340 (00832)   65632d30 3665362d 34643834 2d613636   ec-06e6-4d84-a66
0x00000350 (00848)   342d6131 64643862 36343639 61363c2f   4-a1dd8b6469a6</
0x00000360 (00864)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000370 (00880)   613a4672 6f6d3e3c 6c6d733a 4c617267   a:From><lms:Larg
0x00000380 (00896)   654d6574 61646174 61537570 706f7274   eMetadataSupport
0x00000390 (00912)   2f3e3c2f 736f6170 3a486561 6465723e   /></soap:Header>
0x000003a0 (00928)   3c736f61 703a426f 64792f3e 3c2f736f   <soap:Body/></so
0x000003b0 (00944)   61703a45 6e76656c 6f70653e            ap:Envelope>

0x00000000 (00000)   504f5354 202f3365 31363236 34372d63   POST /3e162647-c
0x00000010 (00016)   3364382d 34346333 2d393937 622d3061   3d8-44c3-997b-0a
0x00000020 (00032)   63396135 66363838 33322f20 48545450   c9a5f68832/ HTTP
0x00000030 (00048)   2f312e31 0d0a4361 6368652d 436f6e74   /1.1..Cache-Cont
0x00000040 (00064)   726f6c3a 206e6f2d 63616368 650d0a43   rol: no-cache..C
0x00000050 (00080)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000060 (00096)   0d0a5072 61676d61 3a206e6f 2d636163   ..Pragma: no-cac
0x00000070 (00112)   68650d0a 436f6e74 656e742d 54797065   he..Content-Type
0x00000080 (00128)   3a206170 706c6963 6174696f 6e2f736f   : application/so
0x00000090 (00144)   61702b78 6d6c0d0a 55736572 2d416765   ap+xml..User-Age
0x000000a0 (00160)   6e743a20 57534441 50490d0a 436f6e74   nt: WSDAPI..Cont
0x000000b0 (00176)   656e742d 4c656e67 74683a20 3733330d   ent-Length: 733.
0x000000c0 (00192)   0a486f73 743a2031 39322e31 36382e31   .Host: 192.168.1
0x000000d0 (00208)   30302e31 39363a35 3335370d 0a0d0a3c   00.196:5357....<
0x000000e0 (00224)   3f786d6c 20766572 73696f6e 3d22312e   ?xml version="1.
0x000000f0 (00240)   30222065 6e636f64 696e673d 22757466   0" encoding="utf
0x00000100 (00256)   2d38223f 3e3c736f 61703a45 6e76656c   -8"?><soap:Envel
0x00000110 (00272)   6f706520 786d6c6e 733a736f 61703d22   ope xmlns:soap="
0x00000120 (00288)   68747470 3a2f2f77 77772e77 332e6f72   http://www.w3.or
0x00000130 (00304)   672f3230 30332f30 352f736f 61702d65   g/2003/05/soap-e
0x00000140 (00320)   6e76656c 6f706522 20786d6c 6e733a77   nvelope" xmlns:w
0x00000150 (00336)   73613d22 68747470 3a2f2f73 6368656d   sa="http://schem
0x00000160 (00352)   61732e78 6d6c736f 61702e6f 72672f77   as.xmlsoap.org/w
0x00000170 (00368)   732f3230 30342f30 382f6164 64726573   s/2004/08/addres
0x00000180 (00384)   73696e67 2220786d 6c6e733a 6c6d733d   sing" xmlns:lms=
0x00000190 (00400)   22687474 703a2f2f 73636865 6d61732e   "http://schemas.
0x000001a0 (00416)   6d696372 6f736f66 742e636f 6d2f7769   microsoft.com/wi
0x000001b0 (00432)   6e646f77 732f6c6d 732f3230 30372f30   ndows/lms/2007/0
0x000001c0 (00448)   38223e3c 736f6170 3a486561 6465723e   8"><soap:Header>
0x000001d0 (00464)   3c777361 3a546f3e 75726e3a 75756964   <wsa:To>urn:uuid
0x000001e0 (00480)   3a336531 36323634 372d6333 64382d34   :3e162647-c3d8-4
0x000001f0 (00496)   3463332d 39393762 2d306163 39613566   4c3-997b-0ac9a5f
0x00000200 (00512)   36383833 323c2f77 73613a54 6f3e3c77   68832</wsa:To><w
0x00000210 (00528)   73613a41 6374696f 6e3e6874 74703a2f   sa:Action>http:/
0x00000220 (00544)   2f736368 656d6173 2e786d6c 736f6170   /schemas.xmlsoap
0x00000230 (00560)   2e6f7267 2f77732f 32303034 2f30392f   .org/ws/2004/09/
0x00000240 (00576)   7472616e 73666572 2f476574 3c2f7773   transfer/Get</ws
0x00000250 (00592)   613a4163 74696f6e 3e3c7773 613a4d65   a:Action><wsa:Me
0x00000260 (00608)   73736167 6549443e 75726e3a 75756964   ssageID>urn:uuid
0x00000270 (00624)   3a626237 32303765 662d3135 64322d34   :bb7207ef-15d2-4
0x00000280 (00640)   3233312d 62316334 2d666637 32666239   231-b1c4-ff72fb9
0x00000290 (00656)   66656439 303c2f77 73613a4d 65737361   fed90</wsa:Messa
0x000002a0 (00672)   67654944 3e3c7773 613a5265 706c7954   geID><wsa:ReplyT
0x000002b0 (00688)   6f3e3c77 73613a41 64647265 73733e68   o><wsa:Address>h
0x000002c0 (00704)   7474703a 2f2f7363 68656d61 732e786d   ttp://schemas.xm
0x000002d0 (00720)   6c736f61 702e6f72 672f7773 2f323030   lsoap.org/ws/200
0x000002e0 (00736)   342f3038 2f616464 72657373 696e672f   4/08/addressing/
0x000002f0 (00752)   726f6c65 2f616e6f 6e796d6f 75733c2f   role/anonymous</
0x00000300 (00768)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000310 (00784)   613a5265 706c7954 6f3e3c77 73613a46   a:ReplyTo><wsa:F
0x00000320 (00800)   726f6d3e 3c777361 3a416464 72657373   rom><wsa:Address
0x00000330 (00816)   3e75726e 3a757569 643a3336 66333264   >urn:uuid:36f32d
0x00000340 (00832)   63312d66 3936352d 34333635 2d613530   c1-f965-4365-a50
0x00000350 (00848)   312d3231 61363237 32313264 66323c2f   1-21a627212df2</
0x00000360 (00864)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000370 (00880)   613a4672 6f6d3e3c 6c6d733a 4c617267   a:From><lms:Larg
0x00000380 (00896)   654d6574 61646174 61537570 706f7274   eMetadataSupport
0x00000390 (00912)   2f3e3c2f 736f6170 3a486561 6465723e   /></soap:Header>
0x000003a0 (00928)   3c736f61 703a426f 64792f3e 3c2f736f   <soap:Body/></so
0x000003b0 (00944)   61703a45 6e76656c 6f70653e            ap:Envelope>

0x00000000 (00000)   504f5354 202f3365 31363236 34372d63   POST /3e162647-c
0x00000010 (00016)   3364382d 34346333 2d393937 622d3061   3d8-44c3-997b-0a
0x00000020 (00032)   63396135 66363838 33322f20 48545450   c9a5f68832/ HTTP
0x00000030 (00048)   2f312e31 0d0a4361 6368652d 436f6e74   /1.1..Cache-Cont
0x00000040 (00064)   726f6c3a 206e6f2d 63616368 650d0a43   rol: no-cache..C
0x00000050 (00080)   6f6e6e65 6374696f 6e3a2043 6c6f7365   onnection: Close
0x00000060 (00096)   0d0a5072 61676d61 3a206e6f 2d636163   ..Pragma: no-cac
0x00000070 (00112)   68650d0a 436f6e74 656e742d 54797065   he..Content-Type
0x00000080 (00128)   3a206170 706c6963 6174696f 6e2f736f   : application/so
0x00000090 (00144)   61702b78 6d6c0d0a 55736572 2d416765   ap+xml..User-Age
0x000000a0 (00160)   6e743a20 57534441 50490d0a 436f6e74   nt: WSDAPI..Cont
0x000000b0 (00176)   656e742d 4c656e67 74683a20 3733330d   ent-Length: 733.
0x000000c0 (00192)   0a486f73 743a2031 39322e31 36382e31   .Host: 192.168.1
0x000000d0 (00208)   30302e32 30313a35 3335370d 0a0d0a3c   00.201:5357....<
0x000000e0 (00224)   3f786d6c 20766572 73696f6e 3d22312e   ?xml version="1.
0x000000f0 (00240)   30222065 6e636f64 696e673d 22757466   0" encoding="utf
0x00000100 (00256)   2d38223f 3e3c736f 61703a45 6e76656c   -8"?><soap:Envel
0x00000110 (00272)   6f706520 786d6c6e 733a736f 61703d22   ope xmlns:soap="
0x00000120 (00288)   68747470 3a2f2f77 77772e77 332e6f72   http://www.w3.or
0x00000130 (00304)   672f3230 30332f30 352f736f 61702d65   g/2003/05/soap-e
0x00000140 (00320)   6e76656c 6f706522 20786d6c 6e733a77   nvelope" xmlns:w
0x00000150 (00336)   73613d22 68747470 3a2f2f73 6368656d   sa="http://schem
0x00000160 (00352)   61732e78 6d6c736f 61702e6f 72672f77   as.xmlsoap.org/w
0x00000170 (00368)   732f3230 30342f30 382f6164 64726573   s/2004/08/addres
0x00000180 (00384)   73696e67 2220786d 6c6e733a 6c6d733d   sing" xmlns:lms=
0x00000190 (00400)   22687474 703a2f2f 73636865 6d61732e   "http://schemas.
0x000001a0 (00416)   6d696372 6f736f66 742e636f 6d2f7769   microsoft.com/wi
0x000001b0 (00432)   6e646f77 732f6c6d 732f3230 30372f30   ndows/lms/2007/0
0x000001c0 (00448)   38223e3c 736f6170 3a486561 6465723e   8"><soap:Header>
0x000001d0 (00464)   3c777361 3a546f3e 75726e3a 75756964   <wsa:To>urn:uuid
0x000001e0 (00480)   3a336531 36323634 372d6333 64382d34   :3e162647-c3d8-4
0x000001f0 (00496)   3463332d 39393762 2d306163 39613566   4c3-997b-0ac9a5f
0x00000200 (00512)   36383833 323c2f77 73613a54 6f3e3c77   68832</wsa:To><w
0x00000210 (00528)   73613a41 6374696f 6e3e6874 74703a2f   sa:Action>http:/
0x00000220 (00544)   2f736368 656d6173 2e786d6c 736f6170   /schemas.xmlsoap
0x00000230 (00560)   2e6f7267 2f77732f 32303034 2f30392f   .org/ws/2004/09/
0x00000240 (00576)   7472616e 73666572 2f476574 3c2f7773   transfer/Get</ws
0x00000250 (00592)   613a4163 74696f6e 3e3c7773 613a4d65   a:Action><wsa:Me
0x00000260 (00608)   73736167 6549443e 75726e3a 75756964   ssageID>urn:uuid
0x00000270 (00624)   3a353933 38643939 342d3063 30382d34   :5938d994-0c08-4
0x00000280 (00640)   3135302d 39366664 2d343333 63376339   150-96fd-433c7c9
0x00000290 (00656)   36336163 343c2f77 73613a4d 65737361   63ac4</wsa:Messa
0x000002a0 (00672)   67654944 3e3c7773 613a5265 706c7954   geID><wsa:ReplyT
0x000002b0 (00688)   6f3e3c77 73613a41 64647265 73733e68   o><wsa:Address>h
0x000002c0 (00704)   7474703a 2f2f7363 68656d61 732e786d   ttp://schemas.xm
0x000002d0 (00720)   6c736f61 702e6f72 672f7773 2f323030   lsoap.org/ws/200
0x000002e0 (00736)   342f3038 2f616464 72657373 696e672f   4/08/addressing/
0x000002f0 (00752)   726f6c65 2f616e6f 6e796d6f 75733c2f   role/anonymous</
0x00000300 (00768)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000310 (00784)   613a5265 706c7954 6f3e3c77 73613a46   a:ReplyTo><wsa:F
0x00000320 (00800)   726f6d3e 3c777361 3a416464 72657373   rom><wsa:Address
0x00000330 (00816)   3e75726e 3a757569 643a6130 38313139   >urn:uuid:a08119
0x00000340 (00832)   65632d30 3665362d 34643834 2d613636   ec-06e6-4d84-a66
0x00000350 (00848)   342d6131 64643862 36343639 61363c2f   4-a1dd8b6469a6</
0x00000360 (00864)   7773613a 41646472 6573733e 3c2f7773   wsa:Address></ws
0x00000370 (00880)   613a4672 6f6d3e3c 6c6d733a 4c617267   a:From><lms:Larg
0x00000380 (00896)   654d6574 61646174 61537570 706f7274   eMetadataSupport
0x00000390 (00912)   2f3e3c2f 736f6170 3a486561 6465723e   /></soap:Header>
0x000003a0 (00928)   3c736f61 703a426f 64792f3e 3c2f736f   <soap:Body/></so
0x000003b0 (00944)   61703a45 6e76656c 6f70653e            ap:Envelope>


Strings
02ffb4zz0
1, 1223143, 0, 1
1, 123wer21, 0, 1
1, 12wer321, 0, 1
1, qwerwqer, 0, 1
APPROVE
Copyright (C) 2014
DECLINE
DFGHJKL100
DFGHJKL1001
DFGHJKL10399
DFGHJKL111
DFGHJKL1122	DFGHJKL13
DFGHJKL134	DFGHJKL14
DFGHJKL160
DFGHJKL177
DFGHJKL18211
DFGHJKL190
DFGHJKL201
DFGHJKL202
DFGHJKL203
DFGHJKL204
DFGHJKL205
DFGHJKL206
DFGHJKL207
DFGHJKL20797
DFGHJKL208
DFGHJKL20804	DFGHJKL21	DFGHJKL23	DFGHJKL24
DFGHJKL240
DFGHJKL250
DFGHJKL274
DFGHJKL300
DFGHJKL301
DFGHJKL302
DFGHJKL303
DFGHJKL31048
DFGHJKL337
DFGHJKL349
DFGHJKL350
DFGHJKL351
DFGHJKL36867
DFGHJKL36869
DFGHJKL36871
DFGHJKL368711
DFGHJKL36872
DFGHJKL36884
DFGHJKL38738	DFGHJKL47
FileDescription
FileVersion
FileVersion11
FLASH
FORM
LegalCopyright
LegalCopyright11
PANEL1
PANEL2
ProductVersion
ProductVersion11
SETTINGS
StringFileInfo
VS_VERSION_INFO
weqrewqrewr
`}+^;{
 <.=['
:-_\*"
]|(^!{
$%&'()
	`\:]<
;0=(:$
*0:*\]
(",@04
?0@4/8
0'8"!{
08@P`p
08X9;)
0]aF%zo
\0_B^3
.0]BT^;y
#=0'cGig
0'D=tbbj
=,=0&F
#0gfnG
0i	,F2
0"?ijf
)!0j):
0:j	od|
0Keja)ic
0lH'!h
0~\M6x
\0"oo3
0?p3B[|
0pGTr|
0,qH7N
=0r7/P
!\0rS_
;,0S;$
0@	TM'
0T~v/H
0\ZB5]
@0zM\`
0Z[ODL
12345867
12e\]G
)$+14z
1;6znv'
17,ZZ`
\1A4Cxk
[1CDkz
	&^1(d
1E:szx
1fSGlwIaZL'
^1Ic[=0+
1?IHtYA
1 $/j`
1j`K9	
;1<^=~L>
&\1N~}
1Ni541(
 /1!(P
.1/PV3^
1=rBfX
1R"@Cn
"1*r	m
1u6"v0
1U8'	f#
1UK`@+3
1Un\~5
1Z@'_|
@@:}2/<
2>1,$	
22cEN@HD
?2~$3~0
2 3L3D3
29vEw~3%
'2Ad|"
2cGofH
2CK'~r
2c^pxP
?2c!UxT
2D]]3m
2#ecaqY
2*gkBO
2H3nE|9
2	kv!-
2N<V=\
<2nZ7+
2QP!:QP
2]Rvd.
2Ty<I9
2$Umxp
2U/RLs0Lp
$.31rF
38q`<]>
+3/9hc
3$9~`ukz
)3D;>M
-3d<v"
+3_^e[
3fZozZE
#3IQ\gW
3 j.#/:
_3{m8.g
3P0i A%
	@3p%?f
3Q$CGFS
3	T!$@
3teYM/:
3TU.P#
3.!%uJ
3W7**"
3w|BlM
4	>2?j
$:44Tv
4[7o*b
 486DX
?4 8pH@
48WxHZ[f/
4?[9=,u
4 (black
4[CnQ[5
4:cO6j
	4Cp[*
>4#gA'
4^#\K7
4K{qY=
'4lEVmd
&4~lH_
4M\7D!B^f
#4m`v<
4Pb{oq
4.Tq$^
@4u1F 
/4U"a(?
4uM@pa
_4#v9o
4vLIhP
!4V@M3f
4YLD#w
4Y<t^a
4y&/zg^
4,Z'1q
4^Zm?i
5,,32'qm
54VY_{
56789+/=
5$8yLc
5*>a/+~
}5\B(+
5bt(KO
5+c)sq"S
5D6gqw
5df)+8
5D]i^i
5[(e=8
5:Ewc]
5GWK$zbE
5jOvR(-
	5kNU@kof
5NC=1-
5>n(I,
>5 (O+/zv
@5qD?j$
5+QM"!
5~qN==}'
5r-eA@
/5SN<-
'*'5/T
5./#u`
~5;z&'<Gs
/+(6-+
@&.>6	
_6`;\26
69B!{$
6]b,8G
6d2Sj4
6$d85BLT
6`>d9n
6ewD}/
^6G>')
6hDJ%w
#6hfu#C
-6LNaG
'6Ne|y
6nVC;I
6@og	R
6#O{*'J]
6pj&L(z
;6P<	p
:6}*|-q
;#6SzF
)6tR>*$
6UJgj}
:=#6v<
"[#6z 
72	Wf6
73\{;-
755%1<
7(/5U+
7(:*6j
7aT5oI
@|^7BO
=7b[OU
7 &cK8
7dfB\M~E
;7\DV%
<.7)Eq
7>(fs|b
~"*7"g'
_7+g{}
7+g%be&
7#' G+g/
7-gU2]
7|HW@Q
@7|"JG
7J-J,	
;<7K7$
7kl_rqt`{VTM#`
7;)K)x\
.! 7L)"
@7{lsWS
$7M(Cx
!.,=7Mo
7`pTN/,
+7"rgf
-7T02u!-{
7	u%FZZ8TJ
7v7dkP
`7w&[|`J
7,_W_LN
)%7Wob 
7x,S.2
"7YEs;
7ygH_1
'8\~%|
$8	{;")
!8(=8b
8}# a*
8a^aMGp
8c="R1
^8dR2W
8ey8wN
8$F v"
8g"h a0
8;huxX
8Im.o!cXu
8(		:'l
/:8+.q
8QU>9W
8r.0f9~R
<8REM^
8'	#sX
?8TJ'(]E
^8uNE{(
8<VV(K;
+-_9!<
~94_BW
95}VtUC
97\b6r
97=fpw!
9>b,~)
.9C/~|]
,~9%CgLq2m
9cwmw)
9;# />eB
*)=`9f
9 GDUc
|9hr8c
[9IM4u
/9'~)j
9.j DxmB
9;nsNc
{(9$qF
9Rnd]Q=
:9uF3@O
9uw$WB
@9V,f	&
9VS8oJ=
>9:]z~
|a15~6
_a1a^(
A4~>`hVd
A}6->C
a7Id.`W2
}	<!aA
AA{I3;
aavu6I
AB.Mh]i
A+:cbp
A[Ch3h
a^C{:U
.adata
ADl%zpe4
advapi32.dll
A+,F?~
afuWRh}
Ag0LY*
%ah5^/:
  AH)8
AI(3v+
AL$*}*
A$!@lb;PZ
 ALY*ra
AM/sPx
#aNG}P
-AN>klDr
A%P.xL
ARttp%
ARW%wp*
</assembly>
      <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
a-T;9pu
at^Vso
aTy$pe
`} au(
AukS$T
A+V8:v
a&:Vte
^=A -W
AW9.yl
AX=4^Z
A]Y&RU
$,A=ywO
aZAS;c
AZHivP?
B0qKt*
B1bM"k
B1FK*u
b3mxF:
b=4PTN
b4U*WN
B]>5	~
b$@5AN
^b5?Ly
`B_66^
b$8Urw
\BA~Lu(
B[B@3	
{bB]i@
BbU7b:L}-
;bB&Y7
BD 1%0!R~]
bDzW.%B
BeginDeferWindowPos
b;fQP:
b>GeQdS
.-BH|D
}}#bi?
bIIN?'<
~/B_KVx|
	b	L]	
!):blY
'bLy3k
'BM38j
b!mf}O
*%bn8B
|<=BNg
bnV*y8
bos8At
/B-P1k
bpfQIg
b.qElt
BQy_0`
B.sH_`
b}Sl7KY
bT,),B
>bT+=yq
buocq`[S
|=<BUx
@Bv9v?2uw\=m!
BvU@n;
BWQy,,
BW{s.?
%bw<w!
BY!0M}C
[^B<zE
%C2Y	lx
C-6&9?=
c7"\r	[/$
;c8Pbkc\
Cancexl
	}c+!B
c|B	'>3a
C~d^8%
~~cdbB
CDuAsrR
CEX({oxAn
"cF8]/B
@  Cla\sr
=c%L	vm
C{_m)Z
CNH0}.
c}nL;0
coLLZo
comctl32.dll
comdlg32.dll
cOsjaa
CoTaskMemAlloc
-cR4QK_
Cra}`\c
CreateStdAccessibleObject
`Cr__Q
CrU~Xpe<
c`?Rz"
CSb`36
]]>\Ct
C:t4/y
C}T|nk
ct]V" 
C!uhg,
cUWcY|
Cv2}ZZ
'c$X (
cX+`=[
}c#xC`
Cx`KuY
C/xV!Q
CY&]%H
C/y"jN=
 @[c)YtA
c	Z4Ui|
Cz~fX}
D>]='/
d2;n@U
D3atNU
d{		[4
d4{(zy
d"85l9~
)D8;Dhl
d8r4>G
Db24{=
{DBC>J#N
d	B;HJ
D{B}jT
d+chDZ
DD	wq4
de+|8aS
  </dependency>
  <dependency>
    </dependentAssembly>
    <dependentAssembly>
\DE~zY
$df^*C
d]&F"S
-dG1	(
d%^GS/
d(	,H*
d?h]nQ'*
d]HYVG
#dI%l$'t
~{Div$
|?DI~Z
dj%[SC*
Dj/W7}
dK%@,MAR
d(:K,p
dkSx}!c
D'#,+m
<d@mv)ks
d,`N3Y?
/Do\d3
(DoV<Q
dP`Jl	
dQ^!7B
(}DQ8|
DQ~Q	"
|d_~rn
dR!]p@
D`Spec
DsW5	r
)dtR`|
DtX,Ir
DuKO6"
dvwO[E
D\xxf4I
dzX[B,
}E/.[@
^E1Y:e
]E@\<4!s
E('9l	l
`E?^> a
?_ECl2v
eCsV~}h
[*Ed<=j
'^EdTB
e:Ev `fQ
ef97?&	`c
_E:F?A
Efc>xrf
e Fp$T.
#e{GKP
#E	HsP
'eI@#B
,eIq @
Ei-raMI
$ eJJ4
e%"jxIq1
	EkxX>> c
EKytvzfG
eliEmA";
e'oGv`{
e_P'Bwl7
eP^}+Y
eqhrv6
eqU _W
+-]e	Rg
ern`l32.
ES9D=a
Escape
@EsS$8
eST9}C
EtM\lQX
evN1FmAIt
EV%RhY
*!<:eW.
e-WdJf[
eWni5V
_&EX0O
ex68oi
ExA:$L
e'@:XE
exT["JT(
'{[e+XV3
$}	e(y
"eyX	C
E%zP:2
^\.f_/
f	14E	
&F;2f[
"F3}l='H
f4|i8(
F5^$*)
f_[5nx_
F<B>q8
*_Fc4N
f=EYMw
FF9 ;m
Fgavqc
Fge|+z
FGHIJK8LM
f>h7rw~ 
FH9-Hm
*;?#FI$pM
~{fI$'_Y
])FJ!=^
fjV1nk
Fk%`L1b
fkWT,h
flow4t(G
fMemory
fngx*6k
f&n]Pa0
fOj0vdw
fP0HAH`
f&/P3T
 F<P!Q
+!#Fq1
f- rL%
F"|s=[
F _sNZm
FS;%P<
F}T?4y
FtEVXC
|F/T`x
FV~{|;ge
fVx[	,
$fW/er
fWGZ@=
fwMct,C
f$XHXM
f:. ?y
"\[F)#Y
=*>F'zG
G'0cY:
g~0*Ia
*g2b17
'+g|2ZRl
G3'0X9P
g{3=Wb
G5'W083
',G8g<
G:9,QE:B
/gbXqP
^$g_c 
%Gc4oymI)
gCJ]5NP
GC ~%n2
*gc+.V
!GD5b(
gdi32.dll
GdipGetImagePaletteSize
gdiplus.dll
gdj|Eb
GDuin2z
G@E"'[d@
"^g)eg0
$Ge(~r
GetFileTitleW
GetFileVersionInfoSizeW
GetModuleHandleA
GetProcAddress
GetProcessImageFileNameW
g-E^y8
gf6~<$L
gFWiIj9
~Gg+#_
ggdo V :
^G^g_s>
GhlfrQ
gJ9-9x
^@gJ*J=
G-%k8V
g(ku#~
G%LX_'
\GnCXX
'_Gngy
gN?{h9(
g.@}Oq*
,gPFOk
GPjHRK_)
Gr=;[%
GradientFill
@$;gRX
GTU6s\
g/V2g2V
.gV]I2
)GWde~
g|X_1E<
gXMf< P
gYthaj
g{ZKc>a2/-
&~.>_h
{:h+=0
h1<LtG
H2k%Mr
h3kdYz
_H4@UU
h5/6r	
H5o4}qd
h(6Ky]
h9~J}(,
{H)a]=hx
hb|B}S4t@
H}B		F>H
HbT#"iS
_hC! H_
;	!hDp;
h~D^WC
{He[bE'D
	HeP}>
Her{t'V
H";*<F
.Hf+<6h
hG3=af
HGPFCf
,hhKj8:}l
=hhU=D
HI`pDR
H"iw_H~
H\JDEDT
$*[#hK
h$kVx+n
hL2j."
H; /+LB
hL!M2Hp
HlXgc1
[h,ly@
].H_m"
\|&_Hm
hM5/Ky
HN|hgA
HO}T*]
H 	_.'P
hQ6a/	
`hQyA/;rr
\^hR`?3"
 $HR|PP,
hRU00=
HU@eBM
HU#F!T
H}uTxyN
("Huva)
hvjzZ[6
HVnZ|X
&h[XL3
I1[BCd
$_i1G	
i57#ds
i6d*BS
I6}gOk
i[6jw^=
I9Gm$z#
I9-xhn
`iA*)3
IaG^]J
}I\	#c
Ic8Wha
/|~=[i"Cn
i	d63Xb
,I|d D
IDVRCS
@>.'IG^
=,:Ihj
i" I l
II=N%Kdr
iJqr+mW/
"Ij Z|
i+Ke[W
i{!kN4K{
iKv)AD
i=ln7!^
?Im4DK"
I|m4oN
IM{j?U
I:ml-r
I_]}mPo-
INrFtA
InternetOpenA
iP;i I
IProdu
ip@)%x
iQmzj!=
=~$iR;$8/I
irs&($
IrZ~ai
^IS{d4\y
?I[U4]
_	I{U<R
i*V8qn
i$vbZuG
IV}jhbZ]
)=IvSX
iw'-Qv9b
iW<SbS
IxaIKP
]IxL6_
	IYE%R
IYO2jZa
IYowE"
"|](	J
j%1j"1
`J*!2{
j][2<_S
=j36?^
(^J3V.
|j5e#x>
j+5zg(h
"+&_J6
	^j{6d
j9\n^_
j^ADe 
+|jAr>vYq
JB @dHP
j.,B=s
$jc.P%|
jcuha"g
|JD3f8
jectdi
j"-eTQ
}J:F)=
]j#fp`
)J$fv%.
j~H'5_
jHj}.?
&j@H{J
.<JiE>
jI`F)fU&
<jK)	z
JLb{(O
\JLh,5
J[M2 9%
jMXpOG~.C
j~NU"+[
J!~o~$_
J@! Ps
j$QUA'
JS?~B9
j`S{KW
>\|?jt
+jTb\A17
\JTP=ZS
JTVj,3
J>)Uqf
Jvls8S
J(=wNqb
JX!;A$Q
	JYF[/U
j@z*,'	
=?] @k
]'k-<%
K`1ohg
k#3|(MJr{`29A
^k440M
|KbL\\jR?48
[kD	#3
kdx6TJO.
kD"	ZG
kEb')"+If
kernel32.dll
K**ey304|
kE$[YHl
=kfbWy
Kgek6a
:k!h{-}
k,^}H&D
:@]khF
_KHfk)c)&
KHH4_+o
&kj*Md`
|K~?'K
,kl-#E
-$	#KM
_&!KMoD(
,"+Knrdo
kn-z8u
,KOG?)
KP>T&#
 kq1+B|
K)%]qS
Kr]J'j
kR^Oz!
|KS<`"#
kSu*Vs
k>s.wlN
/`KTYL
]K*u6`3
k%'UHP
 kUY?J%u. w'U
kV4?e%
kV+LYE`
;<KZ"]
k>/)$:z'/av
-K(zW]C
~-?{l|
}!l&^?*
L'!~;#
l0DUMpw-
L0[F*`
L1tZ(@
%l2Gsn
(l&2YF
l5+LJ!g
L*!&	6
l6TM^k-
l8KFSE
lae"CrBUL8
la~HKId"z
la`h;M
LBL#^k
Lc	F}{7
lD43q1
lDrp=2
~L#F04mQL
@|l%HB
LhF$Lz
LHg.MT
lI{%;:
LibP1 
LIJ%,y
lISs@w
,L(KPl
|".`l l
^lMH$ng
LoadLibraryA
l@ofn.
loSZ<!G
%lpbj[
lP:r{MR
lpv4I+
lq#m5"+
L&Qvr2
Lr73OZ
lRo-db
.LsM=^
@l}t#0T
LT\KmB
L	Var	
::#LWw.rJ
lW*]-":Z3
l@xc_E
l,	y4n
/Ly-6!
&lZMQ	un
|l,{zZ
M2bp!7
M#5k[]
m6c. ck
M7fu~Xg
	M7WXd^|
&m990j
M9c]&]
m9ssHe~
mbBZC\
M>e`P*
+|m;`F
.m{GN]
Mg{zU`
M?~j" 
M:j@uIt
mJX7{i
}MmINL
M^NgV0:
,m},^P
M.-~q9
|MqZ@Ap
Mrd[uM
msimg32.dll
^mUtuQ
M:V;\<l=
mXp}*_
my0KK%
[my9?;.
m+YdO>Hr
%M"Y/S
*mYuZ,^
N1QPDr
N`,[2L
N2sj0<g
<n#6-x5N
n6y.Ts
N7Bvdv
;n:AvT?!
nC53xe
n@C\V5
Nd.~uP
nD`x)o
nF2^r'
nF4}HH
`[N&.g6}
#NGd{ 
NgIJ/_
N@%GV|D
Ni%m& &:
n+!NK}
N,;O>Ld[}:
NOng{g
NOPQRST
nrTqwK.
/NslS[M
NslY?'
+n}T/I
n+t;K\y
N"txgu
n	 u9D
@n.(uc
N_v00/
NvLSB!
nv<vm;6
nx+%+aQ]
/>&\o`
^&O%	%
O.3;8;P:
(O7q"}
O~8r1/4
o#9;2P
\OaMn;
oBW}mo
OcDzKG
odeInvf
odP?QZ
OEDA9b9?
	oEL.gL
%'O FP
>oG'Cl:
O&?GkB.
]ogr$c
 #	|O:gv
Ohq).=Gh
O	h'WVAT
oI{k($
OI[NE)
[OK{tBq<
ole32.dll
oleacc.dll
oleaut32.dll
oledlg.dll
OleUIBusyW
/&oMi/K
On2U*e
~o"N|"q
oN~y|,
OpenPrinterW
OQ7gCt
O=qlk"M
>OqTs]
ORPU\Y
O.rV!2A
oTC>},
~OU8E7
OVE!`j
-OwW=M)
O"XDaj
Oxn 02
~OXR3KoM
oz+/Dh
.P{_@[
P:1sJa
p$2FHqH
P4A'~!Q
P5NS0-
P72	l`C
P7c3R:
p+7+]N
P86mj4rL
p9)cZp
p9)[g#
Pa= 1wc^
paf(QIZ9
@PAkXL
PathIsUNCW
 Pa+Ubu
	pb:""
[p*B9p/~
"p% bA
pB}}gY
pByn\}
pC`~qSGLVZXY
&p}!-d
<,P&DF
PfP<S>
P--F]sZ
Pf,ue	UD
pFZZjb
PI6(X#
PIS	ny.|Jm
Pi@V,,&
P-j'}`p
pjqEq_r
pl,FQ)xQ"i
pLG<DnI=
p?mT.a4
PMxKi6
pN@kbq%e
(PnU!Y
"^p<Pf-E
pp*]=sN
!<pQ|hj
pqrstu8vw
printf
P%"S:_
@PS@3)
psapi.dll
{PsprU~
*pSU"r
pth(VS
]P|t&R
PuZ\u:
PV5~x(
+P~;vB`QF
	!PVMx
'	PW'8
PWnIp&
|PWX!Z:
:{{P{X{`
P*XG|HP
pXu$<0Y
q1/}	/
"q1B%;zER
q3sWu.cwm
Q$4>;>
q4I)Zw
q68Zuec3
Q6*~h:z
@q74<V
Q*b/[)
QbLmULV~
Q{CNlB
 qd8A7
/qd\/c
qdV)EN
QeRj%Hy
!QFa$od}
QfsKwC
QI.1>3
q,Jaf2
q%^K2v
qk/cvln
QKn&tX
qk.PJ6
qll})`
qm?KB|_=
|,Q]N{"
%#Q@nL
Qn%XO%
q$[O\F
q,@Pa.
]qP;VS
q"pZEH
 Q%qbe(
'QqT[-
QRtwwE
Q)Rx<	
qspiZX
q	S,`V
QT4tpu
,!QtFC
( Q'$u&
QuSrZ#
qW1	!3C
QWph?K
QWR,kX
q_x98~
Q<XIc4
QY^{=I
Q@Yy2uZ
}q`Z#\
,qze]Lm
QZ%o}Z
<% .>,r
?R$%:$
R0f{uu
R0S8f(U
r-12AC;
r2-t` 
:r3c[~
r7ICp<b.
R!#9']
R99wRg*A=<
RaiseException
RA#Qi\
:.;>rB<
,RB[.`	
R(;(+C
r'clwf
RCn:)u
RdCM;K
<"RDht
R"\Djx
r-DUl,
Re{c!N
RegQueryValueW
REp@$"
        <requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
      </requestedPrivileges>
      <requestedPrivileges>
R@et	>
Rf;6b 
rFK&aC-
rFk\P#\
rG#EhcX
rgpC8bw
rh5OyFq
|r!hqUt
 Rich|
RJ8J:B
RjCj1z
%[@Rjwm
/rK"k:
R,K/Od
rKOjoF
R!K/T 
_'>rkXY
.[r^!o&
ROg,LmU
rP!BTy<
{rPd~+O
rpJ{v\
rQ1'kL
RQ	.p@
+r,]RU
Rs/F(p
rSgj/|"
;Rs,N[3
Rs p-2
.@rT^+g
|> ?r$t(P,
;r&t.vnx
rU8: J
R"UG2D
Runtim
RUo7sP
RUu$?O
RvC45i
Rw},_n
RWU6z;
RX1u<9Ix
R$xaZe8{l
rxegU=',
rXtYvZx[z\|]~^
 rZgH&
RzokZiO
r=zwaQ
@)*S/{
[s-*0	
S0Q^N@
&s11$X!
S?##1l
:S1m= "
#S3WmZ
Sa.+2%
}sa4v$}
S?!A6km
s}AB,{K
SB,{,B6
SB!`UYMK
sb	Z_33
ScH<u$
|s]#CM
ScsiWqt
_Scu%OlV
sdba?Y`N
sdvaWjsZ
    </security>
    <security>
sEJm5:
s=F,5A
shell32.dll
ShellExecuteExW
Sh	|i|
shlwapi.dll
{sI5Wx
S<I*QT
"Si[wNuy
sk2p_f
sK2ZXv
sKJ=ws
s?^K~s
	s`l|E
SLx/$t[
Smd3Wn
_?"!sn
so6md]D/
"SoJA|
(S*PE'
sp Rai
>SQ>CB
(Sq Co
$s] =QHd
SQWRVvD
SR;|Ar
sR.#|Iuh
stomIni.;
sv0Q`l
=Sv!:Pc
=->S?w
$[|`Sw
sw	Puc5X=
{:[:SX
);syB^
sZ/d2j;
T!1U=G
)T2ON:
Tb'R,Q{}
:&~tc7
^tCh~P
(tCK:H
TDd\wS
tE-jB+
te?|Q4R$Ag
/t)FkJ
t<G>D:
=TGoKp
TH\3{5
THanLd	
T=he(p>7du
!This program cannot be run in DOS mode.
't$Hp)LP
t%!itEU
TIX\	0
t*jdda
T?m6Kf
TM\oOd
@$TMul
tnvvx~
ToM1ul
[|tOPe
TO?<Z{
T$p4	t
tP8syE
tQKS^'(
.T.{qT6
Tq$y2M
t@r\3%
_TrackMouseEvent
T|R<hY>
T]RoMM
  </trustInfo>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
ts\c_tW1{_
)&tSw(4
ttD2]Y
t'tK/t
tTmw#"G[(
(Tu#;V.
T UWik
T$v!7p
t-vO^[	
twarKe
t"WeZ$
tWHu_w
T<wwPLN
T]:X\b
T}X~r:
tZ@R8c
t"$"z{<Y;
*+	,-./u
U1o_N8}[
|u<2m{
!U#2`P
U]2>|W)
U4bv2w
^U6<O9r
!u?8>\
\)U91~K
&u\alG
uAM,l6Z
-U<[B{
}Ubcp&|
uBgEJt
Ubxg{N})
uD4e~\
~\u@E.	
u]Ecya
UeNv' /
U\FaO~
&uF:E*
u(fJFc
U^("&g
uge?GX
uG_	qf
Ug=v@x
^&UGXy
u\H';4
[uHE':
uiWu$l	
!UIx `,
:uJoUD
?ul,?`
U=LwiC
&'u`.M
U|m)<%
-.@U]M
um=M)w
u#mW]F
,u/Mwy
un<$*)
*u(o2z
"UO8>E
uok6x<%
=UOP0!
u[p(x~Je
uQ[d6rg4
ur)<i`
U-.rlwF
uR<\Yj
user32.dll
uS~X0[
?U;u/3
u+w4`)&
u%wW'))j
ux'fVK1
U-YaUx
`@=u$YJR
uZ<i&7
@#,|V<
V_}1I`t
v2u1n[
v_	39q
~*v62Q
V7_{1Xo
V)8prP
~v'8?t
>V{9*v
VariantChangeTypeEx
vaZxXZ!
&V@&.#C
_v{c12
vCiTZN)\t/
/?vDc'bK^
v:d.'x9
version.dll
v=Fp8Y 
v"]fPa<+
Vg#I'}
vg->|U
Vh-Dk0R
vHL{A!
%Vi+D`
ViGtua
[v.J=H
?vjhuQ
V	lG1_q
V#^L]N
Vmc+\_
?vMf]L2p*U
V\Mh^.0
Vm'paz
V.N)k)
V*OpGK?
vp4U*qF
Vpt."h
VpXI}nul1
v-q?%>
{)"VQ^
v#,Q,3=
V#Q;\91D
vR`D$f
v!+r!=F
 V:SGe
&,\vSVZ
vT0NeWp
v<:ts7v
v"tv8_n7<|
V~U^4c,
-VUfA%
V~ us'
-V)uzQ,
"[%Vv~.
v%V'o)z
VV`U'3
	vw{ao
V	~!W{G
V*X+\k
vY^{`<
V[%y'k
v/ZC6s
^VzO;jHf
VZZ:\T
\W1.2\
W3t2x{
W4pUIHm,_
W4{	xN
%W6KC/N
&w[7Em
W*a6rN')/f
w.Aa1H	
:wak3[
WAq$_8%
Wa{`uW"
w bhVi
wBo/27
w&`Bu2
w|CWHf
w>D9nL
|Wd|kLw
wdML[Yy
wD	w8]
wfqy`K
	 Wfr&8
)Wf;S*
wGLYN&(Np
W,Gsn~
*WH4~V
Wh OZ[
{whuS>W
wiiBam
wininet.dll
winspool.drv
w^Iu#B
))W*J~
wJSXzn
WkL[^C
WQ|,eB
WQk1>'0l?n
Wr<^Mpr
wrRFo!
=Ws<{?
@wtCuss
WTdHHR
)wu;fa
w<|U{j
Wv"P^@
wxM?CK
W<)Xy~
@)Wy[,
#w{y?N[
WY\u';
w	$!Z-.{
Wz7}!h
/~Wz8V
w{za6'
X2{IDJx
x)2+QV
x4=:9E
X!6pr~
|)X<|8
x9jw?S
XCP2rb_\
XDsP91
^~X'emx
.xEO()
XesL*(
x=EwGp
XgP=nR*
^`XHS>
XI08[pr
*XidV%b
x ix>L@
[;#(Xj
x|;JMD
$.xjPR
xJzR|Z~b
&Xl|^L@
X$>(lT
Xms^BN
XMyn=!7
~XnmGl
x}_OL[
X= ]P2l
X`pf),
X@P%^@t
XrB5PI
X)S}0}X+S
X#Sx3Q
xSX&zp
xTxJWS
XVbHR6
X<Xv$_
x{}\yz
xyz0123p4
x@zH|T
XZ	lh"
$Y%,#	
(#"+Y1m
 Y~4;DU
Y4ie	 d
y5	|#,
[^&Y.5
y]5~8>
y">=5X
]Y/8Y.-Y
 Y;A)#'
Ya@\O"
YcFI>I:x
?YC;`k
@]yc'ymi
y,Cy;W
=$`YDm
;Ye5Ka
YfB[rK
	YHVZ/
yj~}1N
YjGcr(
YJ{Z/r;p
=YK<,_6
Yk-(>h
'y}l"9>
y!/LbL
y_LXl%4
{yM']*
Ymn5Wn
ym-}>U
YMz}e0
y&N~b5
yNT(zM
yQI|($
Yr*`*&\
YRrXaJX
,YR)xN
yT8$X)Vs
Y?	XG/
Y`zW=Ye!
>Z>=#^
z1]E62
Z1nO}f?
z;]1/X
z2o nR
#Z3'Ww
Z`6	8!
z839bM	q/p
;Z8ZH,
Z_9F!?
Za*bmx
ZabTK<,
Zax[W!
Z<>B=</
'&zC8H
@:Zdol
z$EE-OFY
$zEOu7
zf u=T
#zGe2X
ZHnMA>
zHvv1[w
]ZI0D	BHe
Z/I5tf
^[$zJ4
_zk(>0
ZK6s0)
	zKVGD
Z'!l}K
zL?r61
%zmIC`
Z<Ng9R"
@z=|O<[
z	o,>b
_z Omu3
$\z;Ps
ZR9$\hE
,zs-}c;
_zs(hAbu
{ZSoWi
ZTU}W	Sb
z|Tx!^
!@?zU"
]>=ZV =
;Z!=Wh
Z>WWR}
^Z_,Y[
-ZYi\\`v
ZY}_r8
..Zy@s
=]|	zz
Z:]	z3