Analysis Date2014-11-25 21:11:59
MD5a915de54f7ca38582058e076a7f3fd90
SHA1f67bf90c65d84e72dd042e361e9b1b2c4e3c0c0e

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section md5: 71c86eac349d35ca1f598e1421624dc7 sha1: b2b06850bdf4ff36e6c9ba9c76c71bb4bcf5be8b size: 236032
Section.rsrc md5: 73c10423b6ea2bd9468b14941c816bcf sha1: 226b7584d313c17e08b615f35081808edddea4aa size: 27136
Section.idata md5: 61c5502d7d967e9ae5e127d7c69048b3 sha1: 15bd33091dcc383b55ddbade6d91c3e024d52f24 size: 512
SectionUnpack md5: 895b5fc21f70ff79b9b6ef40e68ae24c sha1: e9d93220cb59500b93b08bf97063ed1860425e3f size: 1135616
Timestamp2014-11-11 03:20:51
PackerThemida/WinLicense V1.8.0.2 + -> Oreans Technologies
PEhasha494392a56ba80cd41c4e7d88968c2d95d0e0e0b
IMPhashccae7705d3bafed6b8f5ee79b27d03ec
AV360 SafeTrojan.Packed.Libix.Gen.2
AVAd-AwareTrojan.Packed.Libix.Gen.2
AVAlwil (avast)Malware-gen:Win32:Malware-gen
AVArcabit (arcavir)no_virus
AVAuthentiumno_virus
AVAvira (antivir)TR/Crypt.TPM.Gen
AVBullGuardTrojan.Packed.Libix.Gen.2
AVCA (E-Trust Ino)no_virus
AVCAT (quickheal)no_virus
AVClamAVno_virus
AVDr. WebTrojan.Packed.650
AVEmsisoftTrojan.Packed.Libix.Gen.2
AVEset (nod32)Win32/Packed.Themida.A
AVFortinetW32/Packed.2D18!tr
AVFrisk (f-prot)no_virus
AVF-SecureTrojan.Packed.Libix.Gen.2
AVGrisoft (avg)Win32/Themida
AVIkarusPacked.Win32.Themida
AVK7Trojan ( 002e1e5b1 )
AVKasperskyPacked.Win32.Black.a
AVMalwareBytesno_virus
AVMcafeeno_virus
AVMicrosoft Security EssentialsVirTool:Win32/Obfuscator.XX
AVMicroWorld (escan)Trojan.Packed.Libix.Gen.2
AVRisingno_virus
AVSophosMal/Behav-285
AVSymantecTrojan.Gen
AVTrend MicroTROJ_AGENT.XXTXE
AVVirusBlokAda (vba32)no_virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012014112520141126\index.dat
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\BSDHA97U\logo[1].gif
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\uol.com[1].htm
Creates File\Device\Afd\AsyncConnectHlp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Deletes FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012013061320130614\index.dat
Deletes FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012013052720130603\index.dat
Creates Mutex_!SHMSFTHISTORY!_
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!mshist012014112520141126!
Creates MutexDBWinMutex
Winsock DNSwww.uol.com.br

Network Details:

DNShomeuol.ipv6uol.com.br
Type: A
200.147.67.142
DNSwww.uol.com.br
Type: A
HTTP GEThttp://www.uol.com.br/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://www.uol.com.br/logo.gif
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
Flows TCP192.168.1.1:1032 ➝ 200.147.67.142:80
Flows TCP192.168.1.1:1033 ➝ 200.147.67.142:80

Raw Pcap
0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   41636365 70743a20 2a2f2a0d 0a416363   Accept: */*..Acc
0x00000020 (00032)   6570742d 4c616e67 75616765 3a20656e   ept-Language: en
0x00000030 (00048)   2d75730d 0a416363 6570742d 456e636f   -us..Accept-Enco
0x00000040 (00064)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000050 (00080)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000060 (00096)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000070 (00112)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000080 (00128)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000090 (00144)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x000000a0 (00160)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000b0 (00176)   73743a20 7777772e 756f6c2e 636f6d2e   st: www.uol.com.
0x000000c0 (00192)   62720d0a 436f6e6e 65637469 6f6e3a20   br..Connection: 
0x000000d0 (00208)   4b656570 2d416c69 76650d0a 0d0a       Keep-Alive....

0x00000000 (00000)   47455420 2f6c6f67 6f2e6769 66204854   GET /logo.gif HT
0x00000010 (00016)   54502f31 2e310d0a 41636365 70743a20   TP/1.1..Accept: 
0x00000020 (00032)   2a2f2a0d 0a526566 65726572 3a206874   */*..Referer: ht
0x00000030 (00048)   74703a2f 2f777777 2e756f6c 2e636f6d   tp://www.uol.com
0x00000040 (00064)   2e62722f 0d0a4163 63657074 2d4c616e   .br/..Accept-Lan
0x00000050 (00080)   67756167 653a2065 6e2d7573 0d0a4163   guage: en-us..Ac
0x00000060 (00096)   63657074 2d456e63 6f64696e 673a2067   cept-Encoding: g
0x00000070 (00112)   7a69702c 20646566 6c617465 0d0a5573   zip, deflate..Us
0x00000080 (00128)   65722d41 67656e74 3a204d6f 7a696c6c   er-Agent: Mozill
0x00000090 (00144)   612f342e 30202863 6f6d7061 7469626c   a/4.0 (compatibl
0x000000a0 (00160)   653b204d 53494520 362e303b 2057696e   e; MSIE 6.0; Win
0x000000b0 (00176)   646f7773 204e5420 352e313b 20535631   dows NT 5.1; SV1
0x000000c0 (00192)   3b202e4e 45542043 4c522032 2e302e35   ; .NET CLR 2.0.5
0x000000d0 (00208)   30373237 290d0a48 6f73743a 20777777   0727)..Host: www
0x000000e0 (00224)   2e756f6c 2e636f6d 2e62720d 0a436f6e   .uol.com.br..Con
0x000000f0 (00240)   6e656374 696f6e3a 204b6565 702d416c   nection: Keep-Al
0x00000100 (00256)   6976650d 0a0d0a                       ive....


Strings
t.
2
.
.
Z./
0
t.
v-
.
\...
.
.
.
.o
.z
.
..,
.
.
..G.
u)..
S
...
DVCLAL
MAINICON
PACKAGEINFO
PLATFORMTARGETS
TFORM1
-"$|``<
.;}$!,
";}-:)-*
[\\?>>=
} :^>_
&'	!*^
%.;(# 
]&_`@0
00zkgNbO
02'Lp&
+0 9h 
0*A!g@
0!A~O5
0AoZh[
0bS%_d<
0c*kw^
0CPo	y
?[0[}D}#y
;;0F2u	.
0>f@e5]
0HL8=c
0 lQ>I
0[}O:C*
0P IVi@e
0R~%5	
0RG%u6
0RwYqWg
)0U;>2
0u_gwq
|`0u`j
0.uKFp
0$V98%
?0#^W]
}0XBo{
<0xN"wj
`	0XRS7
*0Y%R?`K
0	Z0<d
0zO<mk
"'1_# 
&|*1;.;(=
1?,`<*
1)!?)_
=12jKP(A
14'+\Y
/16Vk@
+}1,,b
1BQJ0+f
)1&|bU
1CcGbHK
1=`.{e
1{i\tX
1lIE`0q
1!&MW"
-&1%NkHF
;1o'[&|#
1PWp&\M
1qXuG0
%[1t1Z]\[,
%1}U #-$e#Z
`|1`w?
1xi7o2}
1-[Xqw
1(Ym}.`
1@\Z5M
^1`zQl
@`#|2|
2];.\(
2&&3!7
23d+NR
2^7 -{{
2	AS4`h%5
2CclJP
2@CH[!
2dA:3x+~
2E.aLF
2[ e(k
2HmzqT
{2+IfG
2Is?.p
2Jjx[Z
2KH!P 
2k,`PR_7
~2LY?J
2["NF[
2O\Qy&
2-qTI9
2{<QZ$
2U8u?d
2`V9NM
2XOPu[v
2{ySor
2YTuY"
2' ZN#?t
@_3 ")
322#8'
>~32"*_h
386?<-
_3b"}^
>`3B".
3FL:@1
"3f)l9CD!
3+fx!t
3;Fx}u
3jDmtZ	
@3ku<tv
:* 3Mf
?3N`O`Zh
$3nU)T0
3pWL	)L
3"QH,x
?3?Qq(
3sg"[nzt
/3$@<TJ\
3uyj`w
>3v5"%Q<!	
3wju"C
-.3W*x
?>3X%$	
3XbKY?
40,cAW
41^(B	
41:B5~
41G~/)=D
42KoT[
48:rb0
"&&4(A?=
4A)<7V
4,/|AT3
:`~\4bZ
4dhWf='
4DV!Y0
" 4f'Y-$
\	4g$`
4GO9^?nK
}4G<Vv
4@>gx-
4jz=Ps
4;NmXm
 ;4P!P
}4q		.
4r+8wOK
4r,ON%
@4:&sv
.4]tAB
%^4"U\
@4(u0K
4')V-';^T
%:4@W$
4WAk9Z
4\\w	w
4X~VEh 
	4y%%4o$
4?ySN0
4Z6w"M;
(![4!ZI
4)ZN;5l
52T-c0
5'7*k+V
{ <59+
5 cJf&
5Ds{d\
_5:G)>27(A
5\J`1+
5*jj%C
5kRu}^
5l]Efl
5Mt!O[
5	nH,@
5o8V/5
5%Ol>(
-!}^5p_1(
5PmM{7
5Q	_!~
[~5$r~OXP1
#5snV1
\5U="b
)5WOmu
#5	XVT88
5]*yM&:
5 !#z$G
5&z=h@
:5Z;H#x8
}5z%O3
.6)?[^
60E~u.
61LvI/
63p	w)
64n~w'
%64p$'
6'5hx 
6^5%n!Oc
6=;6Ks
6_)#d[)
6'd5Z'
6FE#w>p
%6/f*Pj.
[^6}fX
6	h	0F
};%6?k
;&6M9h
6!r8p _
6r&D_t|c
6wSY1f\(
6wZl_`-U
6XL-M"^
|&,"7*
$7.;=@
#70+`%
72+pvr
_72VQ_e
7+4a5X
}:75235:p~
7'` 5ZVG
76@v5s
7'*9t[@
7@=b47j
_[7c59
.-7Eph
7fR@(>
7g:^W,3
_^7i5<
|7;JrZ
7jW*Z$V
7KgP!@
~`%/7L
_{7m<k
7MuDb~
7oM&Q[)
7pcp~?
7Rwi<v
;7S<Jf
=7s@t@
7TP0>NP
7/U&8,
"7<(UB
 7U=B%8
7$	wq&IQ4GIOR
;7 X|[*
7Yc@o{H
| ]@,8
84[%Rh
85FW$c
)8.7<@
87-h7O
89A%=V
,89PSO 
@8$a~_
8:?A $I
8) *CrX
+=8E5x
8e8@f0,I1X  
\8(e*v
$8(In3v?
?8~j>{
|8*{J%:&
%8KJCo
8lsX#u
8ORMP4H
'8\RN-
8RN)Q/
8=,{s2
. {8Uv>
 	8{V%
8w>68~
}8'Xp $
8[Z?L5
8}ZRP_b
(,@}9"
@-9(0/so
91H8/'[v
)97ZE]
9atnm'
9;BIa8
9E|g*1
9EMcKI
9'f:9"
9^FtF/
9g'85K
9$g{V(
9HQ	@)
9I/$k@A
9j"i#`4AF
9*?:JMP
]9Jw_5%`P
}9M'!z
>@9!qQ
9SW )}
9sZt^D
,9-t:x1
,@&+9V
9vUJPM1m
9Y};8K
#%!9YAX
9yFeXD
9Z'ro`
?`a=+[
A$	1Zf
a4j	]B
a$[5eP
)a5Q	-
A/6-Tt
a</\=7
a77fl)
A9a_?g
a"9IN]
a,{*9q
aarzH.
ab`L4K*
!a&[)c
 a\C$(
%"*a`cdp"iqzfmVwv
a<CZ@D
aD2W`8
ADsV)PI
@|)AD&wx
a|E`t	%dmz
\?Af!(
{{aFIdqx
A@FT`<OE%
aGS>pD
A~hgic
aHi#>q
A-kn`\y:
}Ak )Y
@AL;$"9
_~ALQx
AMD\8ky
amD,?Z
aN``|doZ!
ANEMnKf
A%{@Nh
>ANjzD
`^*Ao>0S
a>OfM3:
aOOx[JJgSCC%
[\A*ovHw
a_+ozV
^__AQFJ
A;QJsw
ardQ)6
aRH=dUL
aRj|2?w0
Ar@k+9la
	AShI|
At_19c
AU0hha4V!JBp
au9vW+
_\AV2|"% 
/a>v&h2%
Avr Mz
AwXI`0
aX\j*O
ayai$n)'
 a=Z$C
azf)N|pa
,azu,A
$^	@]b
-(B -;
B"0L^vVH3
b0q?[Q
b\$24.L
B2WhiY&
B3"P)De
b<3s-!
#^B`48
B5pZH_&
b"`7[p
&b8/ZU
B+9m]=
\)((Bc 
b$C2G)
bCTRL+
BCwqDXh>
&b`DEB
[B	`(D]T,
BE]G;&
b,EM'=
beXiHV?
bf+A./
BF<W'1
bh8>fv;
bH}^Xo
B_-;I]
Bi$~6N
-Bi.~L
\BI\LWR0
bjcS`8@
bJ!g)|
bKP2 +`
B~L10*
b)lRxz
BM0>% 
BM@sl0
bM t%S^
BoEhP)&
b)O@"fn
	_b'~{P
#b p/Y
bQ|ah)T
!bQ u&S
\Bqw]Y
bq^@_y{
b-r@Tq
BRVWX\I
-@/bs`
!>b.S_
~=$bsk
	B.%T$
bT:0&d
btX&8Rw5
bu9s~O
$B]VeV
|`>BVH
bv@KT%
+B~$vs
b#V%SX
B'!vZa
bw+By+
Bw[pn^
B~y:G7
B^]YW[
bZc$V2
b^	z]E
,\c]/(
C1T`Mm
%c2l04
;C@ 3<@
$	{C`3<
^c3C\2
C,+]4v
C	;56s`,
+c7?Po
@&;C8:
C}8UB"I
c|92M^
C9/.(a
c$a?r{x
c%aZ,a
>c{B<0
]c,B+wh
cccCIHH
?c+D&Q_
cDV@)DI
(cG@D=
/C	h#?
c%h01t
ch	BQF
"+C]HZ
?/'cKc
c$LN ]^{
Cn5O^N[
C&n.B`
 /co]^
CoH#-\G
COMCTL32.dll
cOTy<Qq
(cpMN-
Cpx{,k
CP["?@Y(S
CQ=<b/
c^qJ)D
c?quaV
>c:r!&
CreateFileA
C_r>nO
C<SWJ]+N
cSy:Jm
-C}Tb9nsci
ctc2R9q
ctkhh>v
 CtXv-;'.
Cu4l`P
c"vfM^
_"$CVl
cW~-f"+
c&WQvg
C/$;Xl8
{'}cy_
Cyj_DX
C#YWHE
Cyx(Ag
Cz:e!{
;.d.:,
-#	$D+]
D]/* -
D^]01Sa
d0<ED,`L
d$0:Z2	
'D25-n
%]D ,5
D}-[_7Y
d8`|Qr;
dAn@$4vj
dBEW[bc
@dBg_k
D|BY]U
D%clAT]
d[d$=?
~dD>>CEwC9
D(dS?OR<
 DEz~J
'Dgp'S
:>dh0n
d/h7t8
dI_Etb
dL/SUr
dM@GS,
d]>!n-
$D=;n 
Dnke`c>
d	n  t
';(DO_5d	
dO8W$q
){dPR?
d<PT/h
*dQ?1O
D`@]QUot_
D?R\{Mo
'd$r*S
Ds	VpP
dt{rws
'DUm`%e
dvKt+L'
\Dw*`_
d[Wj 	
%DWq@RE
DymHSxo
}@dZ6@
DzX3f!
),'e6.
E7r:;{B
'E(_7WyK
*E9`*/
e9<`Dt
E9<(Q]
EAA>-m
eaD(pT
(EB#6-
E}+bJ`o
/Ed0r%
E)%e,B
eee8AB@
eeRC>:y
~(^{EF
e	?f9-
* EflY&
efU>6v
E%gN2*:u
E}=g`&Y
-(e.i{
eIM]u"^u
E	J"D 
?EkdK/
E,_L1[
E[l&m"L
ElP\fx<
E;mG .J
EM`!n[
eN2\u(
E!NtG6
E&^ob1x
=/eplDm
-e+=Q0
<eQamI
eqGcU*=`
e<]!$R
`E{R)Z
eST{|:
Et6o+([
E&	u_v
Eu~v/Sb`|
EVJv,3|
Evq\ VV
|E|	)W
E		(X$
EXCL$g
ExitProcess
exuE$h9
ExxwwEEx
E<{#yB
[eY@n]<3
`eY-_/Qu
eYwv.}
E"`^z$
ezo2XCXqd
.\@?|/F`!
+f02p^*
 F%0qW
=f19Bb3X
f2@$!6
f38~O,
f~,6<'
:F64y-
f.6~H(<
F<6)O'
`$F6&t=!(
 F6V$Oj
%F7 ir
%	fbDT
Fc[p"7%
fc\q^	
F;EW@?t
'feY'}
FFF?@>?
(Fh%^fF
fh$&MI
_.FIF]
f)i']L'<a
F#J	bw
*++Fk]
@fKn{0
"f{?L!
f:%lp~
Fm_d8l
FM?'E/
/,FN+K
F!<<O5
f'oAP@
%fOD[8
F*PgA1
FPN85Dv3
f:qE@6;
]fro<+
f<RQ(q
FS jSe
FSMLlU
F-S$yN
F{)[t4
fwTgl5
?+>>Fxc
%'FXCpX
 fym=E
fZaFjn,
fZfi^,V
f(zjZ/
fz=meP
<fZOGd
|)|~g\
+g`[08	
G'0Pz7V
G1 mZs
}^g	)3
"[G3^V
g/5Hv$%
G_5\]ju
g"7I=^
GaY<g$
"@{_GD
gD| Pz
G$e<(Xw
Gf]8n8d
)gFgw<
ggg=EED
GGGGGGGGGGG
:>G>G>h
$*g-GP
 Gh~RQY
	_gi[	
G\iL7#
g:>iO&
gi	rO)
	gJPk]f
gKQO4L
G%Kqsh"
:#>glen
G/n)xP'
{$[GO@
Go9DIAM
G`OVN3'
G{oW$'
GPhcTj3
|gQR3H
?G{QtH
g%r}_ 
gr&KwR.
GS c?jN
,gs&s*
:GT?mH0
g)!(uL]
']Gu"L
	%#gV0
`)gVc~+N
gW%l|T
G{yC #
G[@){Z
h$#{ <
()h1K)3
..h2?/
H::2UEE:UDD9TEE)SCC"SED
-h36d&
h3?9Gk%
H3g-9qG>
h40.+Il
H4,cdD
h4tq'8'
H4&u&]
H5=$0[
}h67)=
h>6a'I
,$h8_(K
h`}9;Q7
h9W	wQa
H<a9kl
h=`}aa
h:A^	HrU
;H/AL 
H	a:,pEh
:#H!BNv$a!
]Hbo6ld
HC>6F 
HCKHo9v_t
&(>"Hd
Hdc(&9J
h	DK'Fx%
h;Dl\"
H-{D'_V+
he0 %Z5
hF\0=G
,<_hfb
]h:G<%
\hG88N
HGaifs
[HH/RBB
hh}rH%
h [i7\R
HIY$x`
hJNE0_
Hk5qH0
h-K&a*vG
h	KGDF
H^l0Y?
:&hm%	
 H`'m:
%hM(D(
HMdOIZ
hMoe%1
/hM%Z!
H$[N'|e
h/np~Y>
*h*O]o
h	|PpR
"h!(QO
:>>>H>r
[H@|R?
>hR5._7
HS@c<f.
HTF^\G
'htT`$
hvb7p2;
hVnPmk
hVQox3
HV	ukR"y
h<W0B)@O
`h]w1nn
\#.h'X
hXNT*c
	[HxOx
.h;-z6
h+z97=qQx.
hz'F8m
~*hzG~
`$I?3i
I\3l"@W
;i{3}S
i9$>kQ
IaT	Q[YV
@IAu_jCna
ICGIGn
ic\i]C
.idata  
idI"vP	
ieD'[(B`r
iG@+2F&
IG>G>h
@I&h? 
IH,^9pP
IhhI>In
?IiC"^
iiiWuJ
[IIZYHHRVFF;RCC
>I_jM{
i!"J\'T
,i@K	1-
I:l e+q
i{M-!&
I#M8<Y
im>bd.Ph
[imp(p 
:&I`nio
InitCommonControls
iNM14-
:\iO|@
`>iocs
I.OO^`T
;I$~p@
I~%	p!-
i}P>kw
IP*LOQ
Ipxpmz
I(Q'fF
	Iqpz 
i'qUyM
=I;quZ
irnX g
i^=rs%
(`i!SA
IsH\$p
 i;t"B
Iua@[>
&IuSBB
Iu$tBJ
i?]@vM
Ix3U%-,H
ix#nK	pbP
ixZ3&<Y
IYWV1A2
IzP+ I
>=J&{&
{}J:%:
{j./01/\
}^	,J0C8xx
\j?0T1
J0x[iy
j@1,cst
J2#1"E
J|}.3_
&j7PDRF_
J802n)
J[9D.>
]^^@JAC
jb~1,~*%
j,[~BV"
J<<BYHHSYHHVXHHCXHH8SDD#RCC
J_^?(C
@JcAYL
J#C&j@
|JC@Lp
)}JD<$
Je+3)s
%JE7?j
>j;e[R
?' J)Fk
=<(Jfm{
jFZO, 
JG\[b5
jH]F?\
	JhjBY
/jHKS]
J?@\I6
jISv7uS)f
jixdY`V
	JjF(X
jjj;FFD
\JJX[IIdZJJQUEE&
jkBM *I
jk,JR?
?jL0GUw>>1
JmDSL#
jmN3#5
JM/Y R2
j]N'@`
Jo=".b
J}o%Cj
@\"JO'u
Jp'0Ta
jP\+D'
JPD=rO
J<<Q[IIaZIIfXGGKVFF1WII
^jQXne
-,jR#[
JRzX4v
jsA@0n^]
JSN~%[
J[t 2?
J*.tI{
JvsHyL\
(`-jwGP
jWt.0U
!Jx1L-
Jy|'9$
`JY%Lw
jYQ~a	
\j^Z9Jy
\k@\	-
k	"^~.={
}`?)K<
K\0df]
%#K0Zg
K2\HLl
K5nj(.fq
K6d*>Z
K6 ZMp
k7Fhh#}m
K@_[9;
`k[9~g
K;,_aH
<ka HA
kb+0	*t
k'{]bXRl
k<C}/`;Fe
k[<d^l
K_{DVI
kd.yHJ
KERNEL32.dll
****kf
k",F@g"
kf-Pgh
K-gOI`*qP
$K}h']
k}H	%T
kII=GCR
kJ2U`H
kK#DG#
klVHn+
(@KM<"
Ko)p0X
KP>&{3
K^plOF
kq)rJ"
,kQ+	$Z
<ksYcl
+[kT3g>
Ku^lmm
K`ur;-K4
)kV!DQ
~~kw9N
KwGBi0
|K=	x4
}kxf}Q
Kxh<XO{y
KXX`A!
kXZt&'pp
+,ky3](
K*yxw7
`(:{K'Z?eH
/KZ`pbu
K`\Zv'g
l0(*d!
l1"J2m
L2g``_
L@]2lI	J
L*4 E%
 l4h [
"(l;8U
l:A{-%
L=b`~!
LB 'IA
LC`Vw>
L&DIZ\
lDjpQF
ld'vxws
l,Eo.j
le.sf, 
Lfh0O<
l]fwrD
LFZ]Cf\
L}.[g)
>	lga9
#LG\Dg
L	G.t=
LgUvt*]
(%Lh)alZ
lHDB@m
lh ='J
,Li7}c
Liz' P4
LjrB)-C
L==^\KKpYHHeUDD2SDD
LkOXMx
-}'Ll&
]LLNQBB
lmNd*?
L\ns'T
'\%]_^lO
LOYQz9,a
?l'p0]
({)L((pVQHS
_l.[&q
lQqa#?
'/-lqt
>[l(rrlPSZ	L
L-!s"'
lS4q[P
@l+sjU
$<_>lt
&_l t:
l=T>|;
L.uME 
`!`lvH=
l:'Vu^
LwY_ahGW
LXfxP$j
'L@%>Y
LZo<+I
Lz@;p0
L_Z	XRVx_
	M ;+"
;M0d<1N
,M]0z-^
(	m1mU`V
M1vT!;
-M1$x!
 m"23)
	M>3}bLf
!_{M;5
+,?m7(
 .m>9O N	
m'$'_a
M*Au%v
mbT]]`
Mca--+
m,CZ:_G
~mD/7dsl
M|D-Fb"
MDl(^e
mD@*V3
}|m"E"
M$e(	"|0
~med`JX
/mf8)QV7'
mf$'[ e
^M%g8	
'/mgIL
m|/GlC
MHx{+y
 $M!,i
M~i}vf`pb
M?IYXA
.M%-J@5
M.kByk
 MKF4jGO"{fIDZ>
MKH	JCS
M:&LVK
<|M'?M)
M#_MU+g
=MN{7a
M`Oi=X
mo $j|
	!m+p=
mt2 Fp
\MT61C(
MTEN0W
"MT>H.
<M"txN
@mU)P]
MVBw6s
mVPx2v[;e
_MV-Q)b]S\l
Mww;k%
mx;hO^;
mxwHOm
n0^+!~
N0Eg/I
N1 [6BH
N256?X
n`3@re1j%
n58V(ABT
n5v_ O
)n5x.$
n%@~`.8
N@87.	
N9~U	<
]n9uOB?
N#&a\,
*nARKd
na,X+PJ
:~NB/~
+nB2KP
 }N`CXO
nd@arMX
N?'DnS.o$
N{e6,m<
-neb\ r
N*Fpwb
NF,*Zg
%N|^H(
N(h <0
NHa P~-
nhII:h
nHjoR+
NH/O%b7
@N^hu?
]@Nhug
nI_$4 
+nio+h
n=:i%V
NjfP4@
nJl<"q
N&:jP@
nJUW+E
<nJ' ]Z
nLd&Ef
&nLXtF
n=m7ct
nm7xT;
	nM9x4
n-Nu2u
np2}F[
N}_p4*
n_[p4a]
!N?P@d
nP]o2B
*Np,PI
Nq* bhTk
=Nq.Kz
N	)Tn@
<N'v ]
	( nWK
NX@1sq
$>N"/y,
NyI#cD
O#21Bjq
o3]NM?
]o4-._~
`O4&>RO,
=O613]
,O6oPQ
O7^=Nth
O8,b*a
Oay0oM
)OB8y4
]?oBP/
o(;Br.
OB?:YC@
o C;w~
%'o$D"
odA))!J
Odj`Bp
o;'~[dl
;OE=n`'
O{eryK
OE;yXP5
;|o}/f
O@fSb%
\oFu;WP
-O%,g`
o&H1/8
OH?ln>C
#}o)I'2
]=OiQW
!O	I=U
O=Jc%)
O(JNAn
*O!KEe
OkZ\ME
olhpK/
~OLq?%
oM%[0n
Om.e<2
=o*=nH
ONQee6
|O=Nt/7r6}oMc
oNxJ0w:
oO\<5U
O?oH#k
OP1!x"
O??qYIIYVEECRBB
)oRKOr6
OrL!	:
O~RM00
os?)o4>m
 OSR;p
ot{):`wQ
>oUL&5
o#upKc;3
OUT8Pr
=ov1S/
OwV&=(
oxkENXu
oX;#(p
oYOy-U{6
o@Yxr.
)^@-`p
"P!%\+
P	 ]=#
P04$-1
;P5@{f
P9GT_er
p9vx`z
pA3HHJr@*_
pa)6dk
p"AncH"
pA>W)]
p$/['B
|pb.aT
P-)BfN
(p^b\r
PC~)R<
pc%~t`
pD$8>5
pda&,u
pDy|>]w
PEDFu\!
PeyQ33%8W3
P'f	.3P
/pFPqO
pF)R7g
 ,-PG.
,P$	gL
PGrA'j
Ph`bP{a
PhfJIlX
phRJ:1/,=
p>h:V>
 (PH>x
>p@"=j
Pkv[>|
P/~%<*L
p,Lqi'
PM/1NJ\
p:M>7U
p"&/$n@Z
$pos&qP
PP~9wy1
,/P_pf
;^PPJX
PQHlh@
p	QOwbw
PQQr=8k[
PQRShqx
#pq\U@5
p,]	r1
P~RBYr
PShL:> J[
P@@sRCC
p T#-/
,{+P$T(
p#T^]<6
pUM3^ 
P+v"$`
pVPhdf
`pvwKB
pW	_| 
PX/f0/L
PXM$h1
{p?]y@
 	PY8h
Py/Hfth
p}"Y!V(0
Pyw2KM
PY )yf@
?q0MC4
q{|184n3
q1FamK
>q3<%	
$Q3Tbr|
q4MAp0
Q%]4tZ?
q6`4c?
(q6;cR
#~q`7$
Q#$7^zV
Q999999999Q
QB,-jF
"Q#!	'!c&)f
q$ChVP
q}Cm_<
Qd*E9H
q@do.q<
qeq#5K@
qEu${*
qHi!)h
\Qh n(
&Qh/?X
q #!.i@CQ
qJ>\+9
>q!}Kb
qL2{ql
qL ZVJ
q*m8Z/
Q=?+MK
q\\(n[
	-+-QN
q\*_nA
Qo0$y+
?)Q{Og
Qp7\|X!{g
 qQl6)K
@Qr7r[
qsOc@	H:h
|q{`:T
Qt8XGF
q>%udyX$#
*`qUls!
Q$up%.O
quTDo:
/`QVfxa
qV?FXT
	qV"L~
_q\vU5
Q!W1UZ
}q['w/E 
q^wHJDK
_QWhs}$
'Q,;wU
%q\_#:x
)qX>+.K
Qx#|S0
qx%V!+
:q^%yP
Qypb{,@
q;za*w0KtV
Q/Z%@M
	`QZw`
|*!;r;
R08i01
r1QS>Z
r2t"i}+
?``r36
R5JHl 
R6sAIf
R8?`6>
r8=g*'
rAh:Mjb
ra@t`C
r})Au-(
RCIeeee
rDmK!Ff
rEO 0!
Restar
r~ge69
#rg<.H
RhBE0kZ?
=Rhu$m
(}R''}k
r/[l1 
rL]2,S
 Rm@~h*(
rM$t$1
r nBgp
)rnC\'
?.*[R,o
R	Oq-Xu
R*='Q8
 R[sQ@
Rsu6%h
^r?sxu
=rtq>]M
ruA{ J
%r!$ux
RVN:0S-
'rw&n2
rWw|`M
r[_!X1
r|XN=^@
RX	tw$|\
Ry:1r)h
R{Y@BN
ryhWHR
|rzgO@
=s|*\ 
|')	\S^[
 |S$<-
S0{Rt$
S2x+jcT
)S5%^d
S8~c<1I
[s}$^9
Sa_q	Q
Sb5~fG
}^-~sbe
Sc?3<$
SCC%QBB
SCC%RBB"QBB
s"]DK0
Sdl$yLC:
SER32.dl
ShHP&Kr
sH#?RQ
'+Si	c
Si!j^/
sJ`?dD
sJQ{pI
-sju}|X?]
sk2k#_
 s{kuL
S+')ml
=S$O@h
soNgz(
sOX,N@
:Sp8}&
s(Pety
S#)/)pnV
sP!>Ob
s$p&rN
=sq?580
S?QN?g
SQnV2K
SsDWCm
StX6Ot
svDB-U
sV`gjEh
s/<W$7RW
swF*|A.'
 }Sxj{!h3
S}Z?8"i_
Sz;AA=E
SZY=v@
,T ;/)
T0j4tF
t-1E^WB
T2g'e1
t3]Fxcu
&,t5%!	
T=6@e.{A
t7j$]QOH
t7|Y*|[-
t.8@z`
t9oKLz
= TA/k`
t?aV.ck
+@{/TB"
TbDPz$
%T{||c&
^TCtg5+!
tDg\w|:
Td&KBQ
teAi #
?TeZyk
\tf0]|
tF	ipu>
tG/PK%
Themi8daB
This program must be run under Win32
ThI_TC
-~&THq
TIO6ad
tj8pw]
(Tk;Or
{tMFjJ
_)TM/ZS
T@NyY_*
={|TNZ
T&>o2\
&Tp#gP
Tph+}$
Tq8j`u	
TR1 X%
t'R%.Ns
.`t|sC
,t|S,E3
TTTI444
tVOLHA
T@W`ISU
TxA~zI
T=%X'&cC^&e 
tzCM72
.`t^ZS
tZXXXj!
^- u`(
`$U\`-
u0&5au
U1eX~E
U28`u`k/
|#U8^f*^
u8Q&D:
<u9){(
Ua@hCnY|l
#u#ANGk5Jl
]+ubl*r
%}_Udd
uDV5I@
,$+U>e
UfEa==
+ UfhC
U,fJ>xt^h
Uf[zPH
uhv!&ki
_Ui]$\*
uimf@8
UIp!K\
uJ1WBLw
u=_!kL
u{'kVo
' u#*L
U%_<l$rB
U\m5zR}
um$HLf
U?Mo`[
uN*:1r(
%UN&eM
Unpack  
?UOB|y
uoG_Ec
uPA2a_
UP'EG;
uQ]A+Y
^U}qJW
uqo!HcMO
UQU/@VRh
u`%rb;c'
U{SjWpp~
ut6gnj
Ut6-R=
UVh/"gH
U\VRHA
UW {3?
-uWDl/(
#uwT:]
(uWV}S
"UX]h3^
UXS+t&
Ux;Vj'
:U}Z();
$v+\)_
v |<-):
>\#v 0
\V}@/0
v+#098
v	0Trb
[#!v1_
V2jx@w~&
/v~ 3y
v4E(NP
%v6ix(z
v\Ah|xs
vbTO;h2
v_C7a5=
VD/fM3
_v@dwZ
v$ED3Id
VE,:K`l
'vf{-\
vgW}LC
!-v-H(
]"v+H;
<v?h`1/
VhJb&;
*V|\hp
[v[i*5
~ViGTkCi
{vj0Yf
,Vj-sS
	VK[)"
VkjP?_T{L
& Vkr-
vL804,
vmaJFskR
,%Vmo+
VNi(EG*
VNJwf~
V^@o{\
vp_-!?
vp08qK
v,P9{@
`((vpa4'
vP!_SYW
Vq?I_q
_VRh+S
vr$?~%O
vr^q=w
_VSh?t
~vSORd
V/t4^|
\=vt'D
>v$"(TlL
v *TS 
V:TzT5
V`=U"	
Vu&	j;';
V]uTK;Yp
vV*a	*
v:<VUh
vW@#o{^
!>V_Y 
v{"y\P
vZ8)_v2A
?W0`/V
W0V\s$
?W2|eX
$W2h=,
	%.W2k
w/3R*GuJ
w9r *h
	w/Aph
wB0_#{
wc\!]f
-w"d'#6.O
Wd#gSv
W[>dH$
wd`HE+T
|WdK:&
{ 'W'E
WFFYO??
*wfT:sr
W,g+`P}
WG$s>I
wgwwxx
Whb>:8pPs
wHhS%j
):w'HI
,+wI+J\
WJ#1`N!B
wK:BHgDe^
WkToru
W***lf
wlf7,0
wmfE>\
/(W^]	mL
wMOJ1C
wn,_h(
wnJM`S?
%W~(	NN
wo;(?:
WoD@P:+
W=OXLvM
&w`#p	
	wpimw
WPMMMPPUW
WQ9xhA
w q{ZJ
wReY)a
wRX|UN\<
Ws 2'/\
ws#8N}
WUQ*kc
wv%H?I
WWWILLL
WWWUWW
wwwwwwp
{WY=;f
;WyGH6>
|+!x#<
."^!#[X
`X4cRI
X6e[(=
X6+o(,
x#}&80!
$_	x88m
'X8BwP0
Xa>zNq
x.C)2=/
Xc-\5'L
=XCcNAc
xception9 I
Xc^$Ge
X-"cUpA
?XCUtv
X)$DJF
&^%XEU
	'X'Fi
XGmv],D
 %xH2P
xh<eX_`
=xhJks
*Xhl~+,`
XhrJ)$
>xh>U95A
xI9E,-
xI=;-<a
xi@ml^
 xjpYr2
X=kbPD
XK=k#S
X!L$P(a$N
*X+n-O
-|xON[
XOv#S`
@XqNzy
*(X$.R
<xRMXc
.XRtrc%8
xR	uOf
XSh|,v
xS n(J
\Xt'Qp
x| t_Y
XU /2~hHEj
x/uph1(
XV	w\R
&;)Xwd
`/xW_e
*	+X@x
x|XIDT5N
~$x~XK
~xxwwEwu~
{X({X&|Z,|Y*
X,Y")\0
[XY;JyT
XYme]`
XYyp&1
X	ZDFN-
XZRO/x
`*{X'|Z+|Y*
=+Y0_f
Y&	49*
y7sG{;
y9#d{e
YaW7#8
y^!BIG
 ybp4{
yc5&K$=
Y/C,Ed
_'YcU	
y%.CXlC
y{{D		
ydGnGta
y<*@d	W
$y*eP]
Y@F6fZ
)yG&YS|
yh3#^|
Yh@b8L
YHBOQ;F
'YhlNw
YHZh TF
yiu(OD
[/y )Ix
YJ`g@(
ykNdj@
Yo)|J\!?
YotZw.
!Yo>$z(
yPLdh,
y](pQN;
],Y#%Rj
YRMUk&
Y[S9i/
|yt<~=
?YT:jB`G~oyJ-
>y.u9Gb
YU=}F7
.YuXkK
y%v'bv
yvx}\p
Y"wKeea
>yww?W
@>yxo7{
[)|Y*|Y+
yY@FD7'
YYYEHGG
[;.*>Z
Z1vx|7M,>H
}z2C3L
Z3tpk7z&iN
Z68t7\#
/ZaoR1
)&z~C 
^`[Zc`
<{zCXJv
Zd,68zI
Z`eD-^
)'zE=F
ZE .	R.
]=`Z|f
Z; f8a
z{fm,w
zF%Of0w
Z	hR5&
ZII?XGGKXGG?TDD0SDD
Z'ISf(
ZiYGb_
Z <J3K
z@ jK?
ZkU(pl{
zl9ww8#
z{`L]S=
|	z\L<T
ZMf-E$
){z.n5:
`Z@nkY
Z* N@q|@
Zo7'w^f+
z&P?c%$
Z pp[;
Zp(\RrUn;
.ZPZtF
-:,/Zs
ZS+T|x
 ZTTEn
!ZUExb
-zu"Qb
!<(zuR*
ZVLl@UB
ZVs8wZ
ZVXkf7XT
%zv.Z&
Z!W}1#
z,w3`B
 Z{-WT
Z=@xL7
/+?zY\
Z`y#?0F
[#zZ@@
ZZ[:443
>)`Zz8
,Zz+ckC}