SmartHawk

1.2

低危

55 个模型检测该样本为恶意！

重新分析

下载样本

248e95c50a0f12992af39b2e314808d4e45ada42e6b2df63e676a6b122563872

248e95c50a0f12992af39b2e314808d4e45ada42e6b2df63e676a6b122563872.exe

分析耗时

195s

引擎	描述	特征	威胁分数	可能家族	检测耗时
DACN	基于动态分析和胶囊网络的可视化恶意软件检测	API调用、DLL以及注册表的修改情况	0.12	Unknown	0.06s
FACILE	利用改进的层次胶囊网络对二进制恶意软件图像进行识别分类	二进制图像映射为的灰度图像	1.00	Unknown	0.03s
IMCLNet	轻量化深度卷积网络模型实现恶意软件家族检测	原始二进制映射而成的可视化图像	0.76	Unknown	0.24s
MFGraph	利用静态特征构建图网络以检测恶意软件	原始二进制PE文件的静态特征节点	0.00	Unknown	0.00s

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	None	20190527	0.3.0.5
Avast	Win32:Evo-gen [Susp]	20191027	18.4.3895.0
Baidu	Win32.Trojan-Spy.Quart.a	20190318	1.0.0.2
CrowdStrike	win/malicious_confidence_100% (D)	20190702	1.0
Kingsoft	None	20191027	2013.8.14.323
McAfee	BackDoor-AXJ.gen	20191027	6.0.6.653
Tencent	None	20191027	1.0.0.1

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1981-02-18 18:45:42

PE Imphash

a64e048b98d051ae6e6b6334f77c95d3

Sections

Name	Virtual Address	Virtual Size	Size of Raw Data	Entropy
.text	0x00001000	0x00007e14	0x00007e14	7.151259854696746
.bss	0x00009000	0x000213b0	0x00000000	0.0
.data	0x0002b000	0x000033d0	0x000033d0	5.828440136120855
.idata	0x0002f000	0x00000ea4	0x00000ea4	5.0788658748287245
.qafnf	0x00030000	0x00001000	0x00000200	2.338076183816281

Imports

Library ole32.DLL:

• 0x42f308 CoCreateInstance

• 0x42f30c CLSIDFromString

• 0x42f310 CoInitialize

• 0x42f314 CoUninitialize

Library OLEAUT32.DLL:

• 0x42f320 SysAllocString

Library WININET.DLL:

• 0x42f32c DeleteUrlCacheEntry

• 0x42f330 FindFirstUrlCacheEntryA

• 0x42f334 FindNextUrlCacheEntryA

Library KERNEL32.DLL:

• 0x42f340 ExitProcess

• 0x42f344 ExpandEnvironmentStringsA

• 0x42f348 GetCommandLineA

• 0x42f34c GetComputerNameA

• 0x42f350 GetCurrentProcessId

• 0x42f354 GetCurrentThreadId

• 0x42f358 GetExitCodeThread

• 0x42f35c GetFileSize

• 0x42f360 GetModuleFileNameA

• 0x42f364 GetModuleHandleA

• 0x42f368 CloseHandle

• 0x42f36c GetProcAddress

• 0x42f370 GetSystemDirectoryA

• 0x42f374 GetTempPathA

• 0x42f378 GetTickCount

• 0x42f37c GetVersion

• 0x42f380 GetVersionExA

• 0x42f384 GetWindowsDirectoryA

• 0x42f388 GlobalMemoryStatus

• 0x42f38c CopyFileA

• 0x42f390 InterlockedIncrement

• 0x42f394 IsBadReadPtr

• 0x42f398 IsBadWritePtr

• 0x42f39c LoadLibraryA

• 0x42f3a0 LocalAlloc

• 0x42f3a4 LocalFree

• 0x42f3a8 OpenMutexA

• 0x42f3ac CreateFileA

• 0x42f3b0 ReadFile

• 0x42f3b4 RtlUnwind

• 0x42f3b8 SetFilePointer

• 0x42f3bc CreateMutexA

• 0x42f3c0 Sleep

• 0x42f3c4 TerminateProcess

• 0x42f3c8 VirtualQuery

• 0x42f3cc CreateProcessA

• 0x42f3d0 WaitForSingleObject

• 0x42f3d4 WideCharToMultiByte

• 0x42f3d8 WinExec

• 0x42f3dc WriteFile

• 0x42f3e0 lstrlenA

• 0x42f3e4 lstrlenW

• 0x42f3e8 CreateThread

• 0x42f3ec DeleteFileA

Library USER32.DLL:

• 0x42f3f8 GetWindowTextA

• 0x42f3fc GetWindowRect

• 0x42f400 FindWindowA

• 0x42f404 GetWindow

• 0x42f408 GetClassNameA

• 0x42f40c SetFocus

• 0x42f410 GetForegroundWindow

• 0x42f414 LoadCursorA

• 0x42f418 LoadIconA

• 0x42f41c SetTimer

• 0x42f420 RegisterClassA

• 0x42f424 MessageBoxA

• 0x42f428 GetMessageA

• 0x42f42c GetWindowLongA

• 0x42f430 SetWindowLongA

• 0x42f434 CreateDesktopA

• 0x42f438 SetThreadDesktop

• 0x42f43c GetThreadDesktop

• 0x42f440 TranslateMessage

• 0x42f444 DispatchMessageA

• 0x42f448 SendMessageA

• 0x42f44c PostQuitMessage

• 0x42f450 ShowWindow

• 0x42f454 CreateWindowExA

• 0x42f458 DestroyWindow

• 0x42f45c MoveWindow

• 0x42f460 DefWindowProcA

• 0x42f464 CallWindowProcA

Library GDI32.DLL:

• 0x42f470 GetStockObject

• 0x42f474 SetBkColor

• 0x42f478 SetTextColor

• 0x42f47c CreateBrushIndirect

• 0x42f480 CreateFontA

Library ADVAPI32.DLL:

• 0x42f48c GetUserNameA

• 0x42f490 RegCreateKeyExA

• 0x42f494 RegCloseKey

• 0x42f498 RegOpenKeyExA

• 0x42f49c RegQueryValueExA

• 0x42f4a0 RegSetValueExA

• 0x42f4a4 GetSecurityInfo

• 0x42f4a8 SetSecurityInfo

• 0x42f4ac SetEntriesInAclA

Library CRTDLL.DLL:

• 0x42f4b8 __GetMainArgs

• 0x42f4bc _sleep

• 0x42f4c0 _stricmp

• 0x42f4c4 atoi

• 0x42f4c8 exit

• 0x42f4cc memcpy

• 0x42f4d0 memset

• 0x42f4d4 printf

• 0x42f4d8 raise

• 0x42f4dc rand

• 0x42f4e0 signal

• 0x42f4e4 sprintf

• 0x42f4e8 srand

• 0x42f4ec sscanf

• 0x42f4f0 strcat

• 0x42f4f4 strchr

• 0x42f4f8 strncmp

• 0x42f4fc vsprintf

L!This program cannot be run in DOS mode.
.idata
.qafnf
S`^@)D&
9F$*DL
Mq)D:D)
c)jc}Lw{
)DHwD
~J.C,
bPDvA
%=D"x,k
M\]7<dL5c
tTzbX!H
!H+uKc
tcH)A]D)D"W)X!
D)uLtdDLjC$(D8dkn*T,kFRD
)Dwh,k.
$(D =)D|wX,k,
9_DMa)D
~!tyxOH)
C.A7)w`,k,]DteD*l,k
OFSDU{)D_)Jy
.C,)
3)L6_DuE
)kA_udZ8$h.w%k
~V2d([Z
D)uD)1jLttfD[ ID 0
#)Zjt
0FC%1<)k@wc\
=1C91`<)c\ZQDk@O_Ed
H)A]DLDLDwO!`)
+Dc,k).w
hZTl1Zw
#E\}m$DvAUJy
~1BT[b0:`uDc,k)`
`wD_|zI
Y}BU!@)1`
DvAUJyT
0(k!@)
lZwD_|zI
|u\vAUJyxO
tkcy9dnH
Jd([jLtlD.C,c6D
1C.7)@)k
`lvAUJyxL
!Bc\cz
toDvAUJyd
D)7)O,]DtpoDd
t,cps&D@
h(YD
y]DcD.a]Dg)&
&)%<(kw,D"?kD1?k
cy1w6)uE
tccHD\
ZTD)E)9`)
(DLD
c_CZZD
mD"[lFZ
\p9%-D
!;~{c~?
TD|w?k,\]D
P)DZjs
<A]DcD
~fWk}*D
EA))X!k
#}-#t-!`))){Z
LDTD&1A/))).C.C.ADiwD
h~GD
l.C.y)!
lxM!1h_+)uD
+w~ko)d
[jtrDvAUJyD))
~;f!ovBDP)
c)w~kED
XocFM\&)D
).4)s)
cy|c="D)
4.DcDF)a
).AA)a
cycD]F)
<hVFD
)kc(w~k!c~ljX%"c)0cE).A
c(DmD.A)w
)kc(w~k!c~
iX%"c)0cE).A)w
ycD#0
)D(w~k,
^Dt;cHD]
(w~k!c~hX%"c)1C
ycD#0
)Db1
cy|c~C
c_cDb
DED"[b
)o}DcDcbw
cyO)X%p
G)uDttDED
t0sDPcFc
_b&5)9c)8A)
_b&)9c))..)FwSDO
lM\&!)9c)
lM\&R)!c)
cy|c~?
TDD)y!Ic!
Q)DwbK
cwboX!
bOj@D
D(_cT_
(1ec)qc
cy+)X%u@
/!$tDcb
i =)Dy{
)rND
|(DZ_z[l58a0
w(k.C,
_D)uDtdzD
0pU;Dc,k)
Ap^D)D[,[)
)yc)DiF)`
0(ku\&d
]F)I^D
p^D,')Bc,'))zZ
E)A]Dj,
\{)I^D_)T
3})I^D
hE..u
(Ap^D)Duc
hF..u
^D)Duc
iE)p^D,')k
i)p^D
D)A]D,')
 )A^DD).u
<kM\UKd"`Cc
)Dh");;\]D
u\KE)NDc,k)A^D&)ThD>Y
lZ&A]DDZ
4=k|.
iFwi9j-jc
)mc,k)@
iu\iAUI
)IvD?u
ud,]D_
h,]D/
<kd([vA
hDc,k)w&k
0(k_V
DzZ)D[lE)D
0&kA]D[lF)
TA)9ZAD)
xyQh^D
O.C.C
,yuEt~D
0(k.j)uD-uBc\HD
l_jtBD
xyQh^D
l_vAUJy\[lMaM)
|u@)uE
c\.ZC!Q^D
0(kuc&@
D)jp[s
D)jl[s
D)jX[s
D)jT[s
yt)Dw
,)0Z(cA]D
#B\TdF
/#,;")0t,x
D)x+j!
1t+x+j
#B\Yd@
P(D#z\Mdax(j
#B\!dG
yb)D.")1
KW(v-@(Dn-Dc@
1nt*D
t*D;Y%2)}Z_
iuGEDyj
D)kdLDw'l
ln(mLEF(
Tc,k)c
@(DzIK*|
vAUJyCa))
c))y).
sD,k)
!c)jUs
c#A]D\
hK*ct
'kDRco
<O)Hc,k)
suc>,9D
z+!cn9Dci
cOqDc,k)p
D)wc))c
p&@s1n-Dc*D&)
D)g)D_\f
0(k)c/
-DA]D
c1AA))
cG,#D)
c1_AD
0(kK*c
Q_Ds~+P
s,9D+
yu)D&9(
D)c[FC
Cla|\7lF
1t*|\
1t,|]
wA]DB~+
yu)D?@(D
!c[1c(
F)x(D)jl
"F)D7x*D)jP
"@)D#x,D)kGK*c
cHt_cH
c@)mc,k)j`
'kD0c@
`E^JZlE
9D*!k)Do9M*!k)Do
`ZD)GJm
(")9&
f,jM_9Z&
a\)DD\
`&GD\
('1ZZIPD
d(9d.m$)Dz
lEZwD_|
a#_|^DAD)I.
w'xujCZm(E
Dt(ND
)cyK)X9
/d([C.jL))
Lt)uDDC
%0ZH
u\CsZDC
tOD\9O.
`).bH]
)INyD$'D
le)uDDC
.C,)c\
tLNDZH
).C.AD1
u\2.C.
).ZjTc\
|uG&@(
8hz1A^)#),]DttLDT
)vAUJyxL
)n&wb~k^{D
KhDZ)!p)!t)!x)9n*!k)Do9D
mZ[AmZl>Dk
1rrb\%
b6bGDk
@K*lK*m
E9b+j@DF
&Vv(DJE
xZw*vAU
x8_JyP
\J)ujO
l)F)D
f)nt|PDZ$`D
y~)D9_K*9
`m^J!w
)O.gDZ
%W}Z&]c
n+!$DtXQD
DN]EVI]
s"!kD..u
DZjLtcL
y0]D="!kKf9t~
)uH),)
ty)X1!kS
!kuED
T]D,)&
d-!kG
Z?)7)
NTy@]Diw!kl*
Zw>ND
!kuZ)
AP]Dl6E)
<).Tl@=
yX]DJM
9s(j@D\Z
y`X!uD)uF)uD)DjLt8VDZ
`Dc\aD
_vAUJy\)
~D2fl(Z
0(k)
)K*TOd}T
.c)#)^E'
tdTDml.C.C.ADig
^)w!k)c#
cyw}k
cywD))Dc,k)w}k,Q]D
cO,)t
Dzw(}k,]D+D
zaZvAUJyxO
~10xJ,
c,k)KDLD
)w{&.C.jHc\
lI.C91`W
)[Dc\
`DwD_|
nD(O=1jHc\
Jy~**d
.ZPjTc\
!B)X1@
_|yHNJ
`yuD/FC.C%1g
aDkHc\aDU
b^)1`W
1y1frd
Z/O,)
D)1jLt8WD 0
uD)1jt(WD 0jtXD
F))K+l
y`]D]<mD
dmd`]Dl1
wfuDDC.C,]DtTYD)k
~1BH[l
)mDJTZ-
nx)jkh
jTt]DEd
b)&9b&x)D
)D&fv*
@[HHH,]Dw
bO%lX!jC])!c)jI
\Dc)Dkb
@)H./
,]Dcbw)X!W))D
T<JmD%JD
~)X9))D
cNmD
,]Dcb)X!?))D
mD%#D
)')kM!c~wz}k
th[DTc\;,]D
bO,]D;
D)eA:w~k)c
)`t([DLt\D
D)eA:w~k)c
)`t\DLt\D
7))D
bH,]Do
bO,L]D3
T<fkD%JD
~)X98MDt]D
D)eA:w~k)c
,W]Dcb)X!))D
c:kD
cyw|k
tL]DP$:
kD%#D
)`t|]DLt8]D
D)eA:w~k)c/
T<FhD%JD
~)X99)
a(DZDcr\
DcDw_\
%3D~
bO,]D
,]Dcb)X!))D
cFiD
,l]Dcb)X!\
a:)5due
DDD E))zcZZX)D
c))cj\ca
D%#D
9AB)`t DLtl D
D)eA:w|k)c{{)?{)N)k
,l]Dcb{)X!
cA%)`t!DLt!D
D)eA:w
|k)cz)z)N)k
,W]Dcb)X!
D)eA:w~k)ccz)A-)`t@!DLt
W))D
z)y)N)k
,]DcbK)X!6)zcZy)N)k
,W]Dcb)X!
D%#D
y)')kM!c~wz}k
D;y)N)k
,l]Dcb
)X!wX|k)c/y)x)N)k
,l]DcbO)X!w^|k)cx)El
D%#D
9A)`t#DL
cywF|k
t#DTtD#D
D)eA:w~k)cx)A)`tP#DL
k))D
~)X9))D
ZA)`t$DLt$D
D)eA:w~k)c
D%JD
~#)X9wCk)cg
).C.C.ADi1s)tcb3).c
c)cO|)tt)DEl
s)pwD_|
D)wCk
cywE)R
AU)wE)6
)wBk,)tIcd
c!|&
s)ccC)!
t)D0a)cr)cc)!
cU),]Dt*Dak
t'D#q)O
A)wF)|;M\\
!#)Bbd([A
t'D{(a[a
Dtca.C
cy)X5
[c[D)x
bDaD5y
c(k9Db
D)4t,D
)w9Bk
cy;)X9
cyw1Bkn
6^ 0A<)_)d
[aD#wDl)
tKcHD\49c)fcs0D
})uDcc
))cov)
w/.3DwD^-
1w)Jc\
t/Daa)
Ft)LK+l/
K+|EL&
j[Ty)O.
wi.CZ
6Dtd/DzI
cyw"Bk
D)'){|[zXtt+DLj]c
c1k).yd
)d([|
0D 0zXt +DLj]c
c1k)ID_
[vAUJy
E)[)E
t,DL$JD
cCZAQ)w)w)N)k
D%#D
9Kw)')kM!)c~w
Bk!)c~
D)eA=w~k
)X!ws}k
)cyk)X!))D
t ,DLt-D
cH,]D
9wV}k
)cywe}k
D)eA=w~k
)cy;)X!wN}k
)cy/)X!c))D
tl-DL*
i')))D
f,bmt.D|D)e{AG)u)A6)u)u)N)k
D%#D
9A)cu)A
)wu)El
D%#D
9A)#u)jH
cO,]D
D%#D
9A)t)A)t))
D%#D
9A)t)kt))k
c)H!)c~wRBk!)c~')X9
G))D
/DLt0D
cH,]D
.C.C.ADiL
)u\iH
Dt=c#$)
O])uT)8gj)w@)
cywBk,(]D+D
cy)X5$)D
)Dc0Ot
cO.C.C.C
cyuDt5D K
i)?gDw
cO,]Dt5DM\\
,t*Dt
E)wDl)b
(w.Bk
/X%"c)K
DC)cg
cc_KZud
)cm)wOBkV
M\\6,]Dt6Daw
ccDDX%[
t7DaE)k,nDa
tX6DC)cl)c5Dcc)
9M.3l)
`yuDA`
)uD))ZC
t\7D;)O
D~qd
!)Z 1
md,c&D
[)uFwl)w@
WDZ)&ZA
)d([ZC,(Dc
))K+l\*O,c]D
.C.AE)uD)uB9)[C
]Dtt7Dul.~utc
).~utc
)s).~utc
3)c).~utc
)S)r}"DC
q^Dt(7DC
q^Dt8DC
]Dt8DC
q]Dt8D\).~utc
/)).~utc
)).~utc
).~utc
iH'Dqt^Dt88D?)w
]Dt9D#)w
i.`*=k~
Dq^Dt9D;)w
i.`*h
7)?)]D
7b)5DJy\~_Zd
jLtc,p]Dc
)uD_b)
+a)uDc
loO.C,)
A)wD)
=uP)A
)wAk.a)@
=wMO,@]D
C.C.C
.C.C, +D)uD!uPt:Dd
,+DMul)DAs)wAk.?a)8=k.*p
<h.A<F)u<
wD)O,]D
,M(DDC7,)
)uDt;D
)q^D)q
^D9w<),")D
C{.AD)uP*A
)w@k.#`)
h,]D)w
t(;Dmd,]D)w
)wh).AD)u>*A
)w@k.g)=k.*p
h.*$<k,(D
w),2)D*A
)w@k.g)h
h)q^D)q
DAwE)wD)O,]D
<h.AD)w),(D)DAL)wAk.
g)0=k.*p
<h.Cx,(DDADyw
@k,F]D))
^D)q^D)q
^D9w),(DMwD)O,]D
.AUE)w),)
)uDtD=D)uDc
DAD)uP)A
)wE@k,+Dt
=D)uDc
)u\DAD)uP)A)wE@k,+Dt>D
w).AD
yw}k,]D)
h.*$<k.C{,i)D=wDO,@]D(
AF)3)
^D)q^D)q
),5(D7wDO,
tcvA_|?
=PGD
c,p]D2c
lyI^6D)q^D)I4
ZC.AD
yw}k,}]D)
<h.*p
h.yux
yuP=wDO,U]D
xuP A
)wAk.
d)$<k.C
.C.AF)uD)uL=
yw}k,
]D))t^D
w>@k.A\E)qt^DtL
DAj)uDj
)+1C.AQE)qt^Dt
.C,(Dc
)_).*p
h.*$<k,(D
uPSwGO,@]D
C6D?
h.*$<k,(D
yw}k,
^Dt\cC
)DGwP),)
Dk)uDc
[)uTNw
),_)D)DA])wAk.GZ)t
hskoDC
,a)DDC{,)
w),<)D)DA
)wAk.Y)?k.*p
<h.AE)w).ADyw:Gk,F]D))]D)q^D)q
^D9w),c)D7wD)O,]D
C4D?
uP)A)wE@k,+Dt
)t){Z
=wDO,@]D(
AF))
^D)q^D)q]D1u vuP)A
)wE@k,+Dt
D?)uDc
[)uSDA_E)uZ)A)wGk.X)?k.
E)uDDC
DzZ)D
,]D(D
BnuDc\,]D}
dy1A")wE)
[vAUJyH)
)cyW)25D%&D
cOv>D
TF8w,k
TA8wt-k
)cy;)
1AT)wS)9c.jUM
1A)+S)9c jU
cO>D
9c"jU(
cON?D
TI8w}.k
1AJ)R)uD)w
Gk,]D
cO,^DtcA$)w-k,
^DtpcAc))X
cwD^-
cOv<D
}&);))D
cdE8w.k
cy)!c+jU
DdG8w.k
Dd@8wE/k
cy')!c,jU0
DdB8wp/k
cyk)!c.jUf
1As)qP)o
cON=D
1A)qP)o
1A)qP)
)q{P)o
cO=DY
cAo)w.k
cuGC,]Dt
F))!c)
cywqGk
cy)X%d
]61D&_xk
1A)wnGk
ZA)w[Gk
cy)X1
cywTGk
cO.>D
DT)`P)uE
k ,c01k
)`sR)d
)!ccC~u
cy')!c~h
E_U)dC)cA6)uD)
M\&da)c[V)]
Q)FGwD^-
,)>9D
w,k.A
c 0yw).P)F!p
DAD)w=k8Dt
DyK)D(_A
E)-jLt
ycD/E)A]D:0(k]
Lp^fq
D&+&R&xk
!iZc=D
cyw=k,P]D
cOn:D)?
cOv9D$SED
K)wFk,
A_);)D
>D)"9A)w=k,Z]DY
Y)Y)wFk,
A?)[)o~
<D)"9A)w=k,Z]D)
(U)uD)u@)uD)DA)+)
uF)uDK)
(1eCI
cH).ZC
,l]Dc\
&D[l)
#E\.jy)jtH
O.A)1(SK)-
Dc\~$D
f)A}]D
Z)`DC>&D
loAADA
DZ[lD).gT)
X)DZ)D
C.C.C.ADV)wAk,}]D))
C.7J)uDtc@tp
I)w:Fk
c-DT)
cy0As)w=Fk,
 1:((kD[,s)
D)9aDtcr
C.I)O%D
;)4C.A6)uD))
DC,h(D(q^Dt
).C.Z+J)
TE)`J
DL)"U)K
)y(DE)>)
@){a[A)tt
<h^%Dk+
cyuD)q
D*,(k[C)kD=)
ZL/C)uDt
h}!jLc\
,k)kx,/)kp,)kh,)k`,c)kX,)kP,
./D)1H)h
,c)kT,)kL,+)jI
DAc)1kH)
c9c)@sH)tul
cyqt^Dt
Fk./O)qt^Dt
"4(kED)w)
(1eA4uEw
cHD\?.C,]D))
cO%D
\?.C,]D){)5
#E\d9kd)uD
C#Dc
)))-DZc&`
xW?.C,{]D))5
gM)2)
cywiFk
cy3)X9w)
uD)wEk.SM)q
DG)){a[b
cO"D
\?.C,4]D))
)[hDb
cO,>]D
\?.C,]D)7)
?L)Z)
#E\d*kd)uD
C!Dc
7))u+DZc&g
xW?.C,]D))
?)_)!c)jd)uD8
?)w)+DZc&f
xW?.C,r]D)
cymA2)mL)C.C
.C,)
uF)uDcc
$/)cix)j
b^,D)pC
,l]Dcc)
cc?).a
+w~k)c
<h:/D)uD-uD)wD)_,_Dt
.C)c@)I
)pzw>k)c@)uD
cO.A)lt
b*D[,s)
(k,)tc\,q^Dt
y(DD)9 
s@)$q^D"q_Dtp
$q^D"q^Dt
h1"4(kD"qt^Dt8
h1"4(kE?q
$qt^D/Y_D
4;)$q_D/Y_D
4g)$q^D/Y_D
]D/Y^DkTc\
L-DwD^9D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)JyxH")D
OA)Zkm
 0dE&CkA?0oCZ)D(H.y
T)l@D)
m;@^!D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a<]D
D)a8]D
D)a4]D
D)a0]D
D)a,]D
D)a(]D
D)a$]D
D)a ]D
D)a\]D
D)aX]D
D)aT]D
D)aP]D
D)aL]D
D)aH]D
D)aD]D
D)a@]D
D)a|]D
D)ax]D
D)at]D
D)ap]D
D)ad]D
D)a`]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a]D
D)a<]D
D)a8]D
D)a4]D
D)a0]D
D)a$]D
D)a ]D
D)a\]D
D)aX]D
D)aT]D
D)aP]D
D)aL]D
D)aH]D
D)aD]D
D)a@]D
D)a|]D
D)ax]D
D)at]D
D)ap]D
D)al]D
D)ah]D
D)ad]D
D)a`]D
-D>AD*YAL6JeC
:-,J~]~
%N6K~B4
dXkWdI!F$],N
i_1Je]jL
zE4>bY0N0
kSkW%XkF%
xXkWdI!F$],N
&_dFjL
zE4>bY0N0
k_yH'VaLjL
zE4>bY0N0
kJxB._d
6K%D*ZoUjNb]DV~Y4
"KiFjL
zE4>bY0N0
kYeA [d^%Pn
6K%D*ZoUjNb]DV~Y4
"WfH7[k_'V$_1
4Vz-,J~]~
4Vz-,J~]~
%_+M'C!X~O%Pa
6K%D*ZoUjNb]DV~Y4
(Q|D*YeIjVe^0
yFkWdI!F$],N
xH RcC!
xXkWdI!F$],N
xXkWdI!F$],N
bL'Uo_7
f[kWdI!F$],N
lH0Vk_ 
4Vz-,J~]~
%A _xFjPg
6K%D*ZoUjV~@DV~Y4
4Le@jL
bY)>bY0N0
kNxB)Q$_1
,Jg-,J~]~
%]+JfH%X$N,_~
6K%D*ZoUjV~@DV~Y4
xXkWdI!F$E0S
xXkWdI!F$E0S
i_1Je]jP
bY)>bY0N0
k]xX0Qz
6K%D*ZoUjV~@DV~Y4
)_pL"_aLjL
bY)>bY0N0
kF}L6[$N.\$C!J%D*ZoUjV~@DV~Y4
/QdK-MaL0
,Jg-,J~]~
%]%LoUi\kC/
xXkWdI!F$E0S
&_dFjL
bY)>bY0N0
kUk[/_p
6K%D*ZoUjV~@DV~Y4
bY)>bY0N0
kXoY,_xIj\cWkWdI!F$E0S
~+X~Z%Loq
Wi_+MeK0>YB"J}L6[V`-]xB7QlYD>
-D>2-D>
C0ZfAjZfADl~A
PcN+Zo~0LcC#>DY
PgL4hcH3ql~!]~D+P
c0qzH*moN0WeCDp~`%N\D!IEK
[iY-Qd-
Jfc0m~L0Kyy+ze^
LxB6>Ix
-D>V- >o-2>c-'>o-
>z-,>s-7>c-'>k-(>g-!>g-+>x-=>
{DiDk.8
2i`2Q`6q`:XL>
YPO".0
c=Dm[>
G@k&O5
,097,E?
/F<_5B.%J.)".6pHw%b.)
,EK6pHw%b.)
LeN!My
vpoU0>
Ko_=ms^0[gd*Xe_)_~D+P
-D>aH6PoAw
-DP~I(R$I(R
C0ZfAjZfAD>
-D>}^+]a
-DUo_*[f
-/[xC!R9jZfAD>
^!L9jZfAD>
-DUo_*[f
-3]yN)N
-,JeC7>
WxY1_f}6Q~H'J
[~n1LxH*JZ_+]o^7wn-
WdI+IK-D>
[y^%YolD>
MHL loL n~_D>
-/[xC!R9jZfAD}Xt
>`Y1BD?
-D>Q-D>d-D>p-D>Q-D>-D>Gw>
-D>D>-D>
-D>J-D>
-D>-D>
Vc^dNxB#Lk@d]kC*Q~
&[*_1P*D*
gB [$ I4.-D>
-D>ZhD>F,B>9~
-D>-J
-D><D>
MD>J-D>
mD>f/D>
}D>-D>
D>^-D>
-D>$Y!F~-D>
-D>*-D^$_ _~LD>^-D>
D>^-D>
-D>*-D~$I%Jk-D>-D>
-D>J-D$D _~LD>f/D>
mD>f/D>
-D>j-D$_!ReND>-D>
}D>-D>
-D>*-D<$H _~LD>J-D>
MD>J-D>
-D>*-D~
-01i`6y`./=
- /-D>
|Ha`6eHv@>
2hLJ)B>
-K-D>hO={
-0C\xU
:-Th]|*
-D7mt>
y~:-T7
`y:Wsc
$J"Upq%
?6!2>\
]kFTT~
!.5z@>
G.D>hT
G.D>hT
.D>%t>
-::-TV
D.X~.D>t
=M~&.>]=
y2:-T7YTT
-DaD>_9
]lj"1x#
-C1&G>
=C-1:;Hp^
]ljCx#
-D>7Yt
-D/D>LO@_"
K@-D3>
D.`-,?
,D>M~r
b,D>m D>
'-DGD>
-D>C>D.
-D>/^D>}-6>
-D>kO'ZoK#VcG/RgC+>/^
y-/UiND>
-D>zmD>
oD>mD>mD>
-D>2oD>mD>
lD>.lD>JlD>ZlD>blD>rlD>lD>
-D>lD>lD>lD>lD>lD>lD>lD>lD>lD>
lD>.lD>JlD>ZlD>blD>rlD>lD>
-D>lD>lD>lD>lD>lD>lD>lD>lD>lD>
LeN!My-D>-
[~h*Hc_+PgH*JYY6WdJ7
Re^!vkC Ro-D>5,
[~~=M~H)zc_!]~B6GK-D>,
Jfx*IcC >/
Wdh<[i-D>-
XnB4[d-D>E,
QzH*ae^"VkC Ro-D>
/"]fB7[
-D>D/)_fA+]
-D>Q/4LcC0X
-D>j/6_c^!>m/7[~O1X
-D>g/7NxD*Jl-D>
/7JxN4G
zFajzFaD>
-D>*-D>
-D>*-D>
=D>R-D>!
mD>&-D>
-D>"MD>
-D>:MD>>MD>2MD>nA(
nA(>B>D>6MD>
-D>UF/>
-D>^E-M*f
dSeI!LkY+L*B"
i_1Je]jP
[fN+So
0Q*B1L*K+L
_yY!Ly
Y+N$C1>Kz
*Z!RiB)[*Y+
jE}jp_
wFidnE
{Kad}K~
jE}jp_-D>
PiB6LoN0
*]([k^!
*N+LxH'J
}([k^!
*H*Jo_dGeX6
>CC'Qx_!]~
iB [*B*
hL'U*B"
dNfH%Mo
d]e_6[iYDnfH%Mo
d[dY!L*T+Kx
iB [*B*
hL'U*B"
iL6Z#-aM'
7>ZA!_yHh
yH([iYd{r]-LkY-Qd
[k_DnfH%Mo
dMoA!]~
FzD6_~D+P*`+P~EDwdN+LxH'J*n%Ln
KgO!L&
4RoL7[&
'Qx_!]~-
RoL7[&
sB1L*n%Ln
/^DnfH%Mo
d[dY!L*N+LxH'J*k1Rf
_gHDnfH%Mo
dMoA!]~
\D7_%`%M~H6}k_ 
[mD7Jo_
[x[-]o}6QiH7M
F!LdH(
 Rf-7KxKjZkYDZdF/
nA(>aFw
 Rf-aMV
!Fo-aM%
aW$E0S
7bXY F;
nL0>}X4Z*-aM*
/^DbiB)SkC 
iB)>/^
]e@)_dIjNcKD
!Fo-aMVN)Z$]-X
8XDQl^
Ua-2HzX4UcCD]xX0Qz-5>aFDnfH%Mo
)_aHd]e_6[iY-Qd^d_dIdJxTd_mL-P$-
PkO([*Y+
kX0Ve_-Do
^`dnCci}eI!
c^dLo\1WxH 
~Bd]e@4RoY!
~_%PyL'JcB*
*l1JbB6WpL0WeCdxkD([n
D}fD'U*b*]o
Q*n+P~D*Ko-
'I-YcYdHkA-ZkY-Qd
'QnHdQd
&_iFdQl
_d]k_ 
dX)\o_D}k_ 
d[r]-LkY-Qd
 _~HDx
_yY!LIL6Z
RoL7[*K-Rf
-P*Y,[*N+LxH'J*D*Xe_)_~D+P*Y+
|H6WlTdGeX6
cI!P~D0G$-
[lB6[*^-YdD*Y*D*
*]([k^!
iB*Xc_)
~E%J*T+K*L6[*Y,[*B3Po_dQl
0Vc^d_iN+KdYj>eKdXxL1Z*B*
}H&McY!
C [xY%UcC#
4[xD+Z*_!HcH3
_dSo@&[x
%]iB1P~^j>K^dNk_0
_d]eC0WdX-Pm
'Qg@-JgH*J*Y+
z_+JoN0
sB1L*L']eX*J*L*Z*Y+
xH KiHdJbHdWd^0_dN!>
YH'KxD0G*`!_yX6[y-
f-Pmf%L~B*>OU4Re_!L
i+]EO.[iYD
'-aMyH0jc@!Q
1-aMyH(X$]%LoC0
fB'_~D+P7
C'JcB*
m>/^x'
GD'Le^+X~
P~H6PoYd{r](QxH6>Vd!FzA+Lo
DnkY,>YB"J}L6[V`-]xB7QlY
[~X4bYH0Kz-=[y-
LeZ7[DH3nxB'[y^D
{V`-]xB7QlY
icC Q}^
[x^-Qdq
FzA+Lo_
|xB3Moc!IZ_+]o^7>MA+\kA
XlA-Po-
QlY3_xH
scN6QyB"JVz-PnB3MVn1LxH*J\H6McB*bCC0[xC!J*~!J~D*Yy-u
bGD'Le^+X~q
WdI+Iyq
Kx_!P~{!LyD+PVd*Jo_*[~
[~Y-Pm^
deC!MV
bY)R4-x
yN6WzYz>/^7[~y-SoB1J"
>w-aMnB'KgH*J$
yX&ScYl
1-?>lX*]~D+P*Wl
7]xD4J4-x
lB6S4-xWd]1J*Y=No
dHkA1[7
>/^xWd]1J*Y=No
'DWn-aM6D*N
YdJs]!
dHkA1[7
h_z>/^xXe_)
kN0WeCy
gH0VeIy
hB G4-x
bH%Z4-
Wi_+meK0
bH%Z4-aM6
4-xV~@(
,Jg-aM/Na]
KyH6>]H&
~+X~Z%Loq
Wi_+MeK0b]D*ZeZ7bIX6LoC0ho_7WeC
mbH(RYH6HcN!qhG!]~i!RkT
zL6JgH*J
y,LoL WdJ
PZ_+]YH6Ho_w
7b/^jZfADE=
v([dJ0V7
-c*v7Kg@y
cpN>/^a]
>YD#P*D*>$T%VeBj]e@DIoO)_cAjT
iB)>gTjT
`X*Q$N+S
!_xY,RcC/
^-YdD*
oO%G$-
4_s]%R$N+S
-D>|-%>f-1>o-D>
'DscN6QyB"J*d*Jo_*[~
FzA+Lo_D>q-}>H-
>:-q>3-s>8-i>L-r>K-|>'-u>;-
>L-i>K-p>>-v>'-t>:-
>3-t>K-|>L-w>3-9>
-d>/ih
-D>-D>
-Dxk;H/
CoCreateInstance
CLSIDFromString
CoInitialize
CoUninitialize
SysAllocString
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
ExitProcess
ExpandEnvironmentStringsA
GetCommandLineA
GetComputerNameA
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeThread
GetFileSize
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
CopyFileA
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
LoadLibraryA
LocalAlloc
LocalFree
OpenMutexA
CreateFileA
ReadFile
RtlUnwind
SetFilePointer
CreateMutexA
TerminateProcess
VirtualQuery
CreateProcessA
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
lstrlenA
lstrlenW
CreateThread
DeleteFileA
GetWindowTextA
GetWindowRect
FindWindowA
GetWindow
GetClassNameA
SetFocus
GetForegroundWindow
LoadCursorA
LoadIconA
SetTimer
RegisterClassA
MessageBoxA
GetMessageA
GetWindowLongA
SetWindowLongA
CreateDesktopA
SetThreadDesktop
GetThreadDesktop
TranslateMessage
DispatchMessageA
SendMessageA
PostQuitMessage
ShowWindow
CreateWindowExA
DestroyWindow
MoveWindow
DefWindowProcA
CallWindowProcA
GetStockObject
SetBkColor
SetTextColor
CreateBrushIndirect
CreateFontA
GetUserNameA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetSecurityInfo
SetSecurityInfo
SetEntriesInAclA
__GetMainArgs
_sleep
_stricmp
memcpy
memset
printf
signal
sprintf
sscanf
strcat
strchr
strncmp
vsprintf
ole32.DLL
OLEAUT32.DLL
WININET.DLL
KERNEL32.DLL
USER32.DLL
GDI32.DLL
ADVAPI32.DLL
CRTDLL.DLL
L!This program cannot be run in DOS mode.
.idata
.qafnf
9_L>_\&]
^,f6HR+=6
_D>_@6Ebg
h1[ab\`(&
Fc]9[a:_MX6]
tQh+\52V1k
e<D+~>Y
cYc\+[R*E
9&dJ`s6W
6Wm]W5
9[a]mRf
"dJ~6W
y6_D6<76[ak]UM
\b\b\`6
vJP=B*
|'N*Q:]M]J*3V
^RX]]7s(X/
\:+}(p6]
?;EC"+}\&+}F<p6]EC(|N
]3We_1C
QPWmF6U>4
_MB7,>
5+MF%r
6<6[a_}
}(D|%UF*j
E36_F*3,D]N*M,D]J*3(D_M
]Q$]_]22
]F*hyc]e_1k;Y/OUMFe
E&{>@1
MF=33c(9L(A
6_MF3s ]MJhyc]e_1C
33c(B`J#
"1jB9zv?
tZ33c(9ziSs_g^
aVYt^Rt)Ef_uBq^R)E
`+}\bd{6
6]M]MF
JiSs_g^
iSs_8(`>kA
a9H3s8
7J\bx6]
3^R3+EoUU9
]3l$7F
`p3a33U5
?+Ef+}
6JQE+XR|/E
wJ6=U6
1s 1J`J@
J`J6ut
l|6YQE+y\|E
7s$X7C4V&]
q>_wa_7Ea]
6Yf*H6C6
1s1?+EBb7?+E
wJf_8E`_MN
D]hyc]9[akyMb
?6_M89Q6
6];Bz6?v3,
~>]M]MB
vJ6<M+
,]324?
1282WmF6le6]3>T46
9+}^6<6
#6b\b\b^
3s b\bf<6
>]9+H:
]6YEJg>+}N
7s$X4Xt<#6
6<6[aowyIi
6?+E6XtZ
3 DY~*
D6b,x6<?6
?+EfY~*!EW
33YZ*H6
zC~b7?+E
?+EfhYt
?+Ef_0E"
6l6YQE+yQE+X
wJf_0Ea
O3,D_v*
6TG*9P6b^6YG*
?+Ev?+EfX
*f{6#3pD]9
+6/7Xt
+Ea< L+~:E6|QE+
6JiE+_R!E
6JiE+_R!E
+6/7Xt
+Ea<TO+~:E6|QE+
6b^@6X
YQE+y\`
ftI5EW
+6L7Xt
+Ea<N+~:E6}\`
F`J7u\
?+Ef_0Ea
*QE+X1
YQE+yqE+
6Y2*QE+X1
6Yn*^D6_**
6YR*QE+X1
?+Ef_f*
QE+X1<D
+EQE+XS6JQE+XR/
QE+?+EQE+X7\DW
*^T6_&*
QE+X1pD
d3s(b
*6l6YQTE+yQE+?N+EQE+X7DW
baE+?+Ef_0Ea]
QUE+XED<I+~>]iPE+b
7}CQE+
n+EQUE+X1,DY+Ef<g6
6_:*>U
E8D_^*8D
P+9$D}QE+
33_R*>Wj*B
?+Ef_8E`
;m^6_Z*>=>M+Wm
1bE^P6vl
M^\33C0
b6<L+`J6Q
y'@6?}s(E+WmE
`_Uw|oUs$
z9X65E6
6+,?`J
@9H3s 
E36l6\3=
6]M]MV
.KI>tH#w
36]M]MR
.KIv=6
FuJ;6#3s$|9b
Z1\ML9bMM
:K#H0+
QvTuL2/:;
6TJ2]306
>DH2W-
6;-_6W-
6E36]w
*v9zvSs_
jtJ,9B
W6w'w`
W6w8%w`
B7,}i1VF^3}h`Uw
]6WmV6YM
6YM^f+
3#3sLy\
b\b\<s6
3#3s@y
6#3sDyiSs_8
WmN63c8
7s,X7s<XEC,b\+>+
9bME9b
6|,R3T4
6T44m3
0},R4T44Y3W
3s,&YL39
6CB~T47A3W
24B5D6
16}tR6_]
]3We_E36_}9E
$:61|@
9B`J9b]6
(+v9a,
bf<L+QE36
YL7_]N
E36WE,(
cX4+<nhJ
iSs_-6<6[a<
E6<656
QU+36|ie+
C9bI+3|E
+32AX#w
3pE+<fMI
+32(+v
I+9bI+{
#6]n+E36TY+9P6+3
E]{Y ]
6HQU+9E`&
pP6]9\4]
E36WV+X
;Eae++9
TW:+Id+
iU+}qU2
@+Q;8E
E_6=H6
3 EWN+AU+X4]{[4EF
3e+/;E6
E EUN+2
:7E}^6<6
EAd+x*
E]f+*Y
+u_~+3`E
f+:7E}y^
AU+X4_
EHAU+`&
6_N+5S6
E6W^+ae+J~T0CJ<
}$R5T0CJ<
}$R3T0BFQ+
Ad+X4]
30E?3?
1 E^2&3
E+n+R@-E
:7E|qU+
51e+'+N+; E
6E36=&F+?;E7
]3We_1kb!_MF
7K3BiJ
6'1s(x
}uTMA7UMFX
]]F9bK
Q<TMB7TuB1
hyc]`>oZ~yc
6b<Y6]9+H:
]Q8T4j
G9wW'!6Wm1
`-aY33Y};6^EC
?64Ef<6
?64Ef<
B7,}\b
6<6W_8
z&bxY6]MF;6b
3]1s(Wm
1Y`;4S;)6
\b\`6ECg
3]]9+}
\b\^RS
3WEvT463
7s(X4Xt^R
.]]66b\b^
X6];;6WEC9zb\b`<6b
33c(9a
OKtNe+}^6<o6`
;s(O69a
uUJ<9E
}6quJ$^
iSs_g^
6J<Z69E
33c(Wm
6WmV6WmR6Wm^6YuH
4\MDDX
M]Mf71s
*DD**DD**DD**D
6dJoYt
eQ*D*D*
**DD**D]
h*D*Q<
6P*D*356D%
*D1qD*J8*Dz:D*
*D}rD*WD*DoSE6H"ZH6dJ7Je*D
*DD*WDdD*o
3D**DD**D3D*#*D+D**D
8*DD*6*D
6dJWDdD*oYt
3D**DD**D3D*#*D+D**D
e8*DD*6*D
D*')y_8
`>_MP]MH
M@6?"Rc
9x024D4A
JfYMH9b]@7
b7$XRK
,;[(C6
my]uRa
6MRf<6
&WMB2u
E6_un9c3
iJQ!UQ
iJ233TuU7
iJf<F+~>
7s<XEC4^EC0<
yiSs_8
-J7$||
5J$\QG+|
C6nTY3#{C)3
I3\E+|s+
@5E+:s+
0s+4@?1+E6<o6
E+:7+E
5JQG+XR{
b\b\b^
vYA+0O6]N+EC
C6]]6YJ+^
)E@6+N+R
t[5JQD+XR
?)Ef[t
E36[t`w
6W$\QG+|iSs_g[a_}4l3]]E36UT
7s,X7s(X679b\b
3WEvT463s,
b\&+}F
9W_ak5B,}\b
~.Uyc]fhU
33YMBfYMFf
\b\:+}
1V&_1C..k*
]3W`v+*
N6]MB,!B
(6]M]MB
l6]3_MFiyc]6B2]M]MF
3fyc]9[a_}
T4;93$
]9qT46
3s,#mB3s(bv??3pL6]
B]MBMS,]MF
MS$]MJe<C6
1s$]M^3s4Q 
$y22NC,z_P
MD69cuD9b4,6
y86P5]]f
P+MD9cMD
]3l@4w
6WN*qE+
:<J+~>]
M,D]j)1
6bJ6]F*;
G]9+H:
E(D<;6
6JaE+s
$|<L6m
6JaE+hr
6JaE+ r
+Ea6[t_Rw
^6+F*R7
^6+F*R
#-Z1(D
#^)6Yd)
+E$J6W
EC?+EfZtXRS
#9u^6+F*Rc
Q@_z)hGB*D_z)hG
+_l5Ji
+E D+}Q
4JaE+`v
$|DH6m
~>Uz):6
E D_B*
+38G=v6
*]B*Sz
6l6\QE+|
QE+?+E
o4JQE+XR
7 GWEvT463
+XQE+>3 G
E$G_F*^60
#9u^6+F*R
E(D<76
~>]]E$G<6?+EQ
?*E^6+F*R
~>]]Rk
^6+F*R_
#-Z1(D
~>lz6\QE+|h56m
+Ea6[t_Rk
4JaE+
E(D<K6
+E,46W
#9u^$6+F*R
+EX46W
^6+F*RO
6JaE+D
5Ja<o6
:W6b\b\b^
v+}8?6]R)E(D<
6biE+_aE+
06+R)R
+EX?6]]T?6_V)hyc];
ME6?3;
(33yc];H
n]]9HE
>T09@9
?)E$q6#3E]
4J3tEUdk
?6]+EtE<
>6]+ELE<
1EY\7Y\7/)E
\bQG+XR
D+B7,}^
6YF+QG+XR
JQD+XR
,]QdG+}QG+X7(E
R;EQG+b\
?*Ef<6
~*]]}lE
QD+XR;EoY
+QD+X6
)E^6udt
?*Ef<w6
+B3?R)E
?*Ef}dtH
QD+XT<6
JQD+XRTiE
C)E6?*9HE
)E6]M]+3Y
:6_&+Q0U
hx2]3We_1kBVO33+}p;6]
bD:6]3#3s$}
$HX=6W
-6#3s<}
b`vb\|
7s,X(86
?4Efndt 
6lk6]QZ+}e+~+Rk
E+}('6
,}QZ+H6
B7,}QZ+X7
|e+~+R?
E+}|'6UV
B,}iSs_(6<W6[a_U
vA]M]N+3U
3#3$E_J+3][t[R
EQe+|^6Y+x;6W
64EaPdt
64Ea<C6
?64Ef<K6
?64Ef<'6
?64Ef)[t
?64Ef<6
~"]]RW
?64Ef<w6
?64Ef<c6
#-@3!R
6MCdY+^6Y+
#9u^$6Y+
#9u^$6Y+96W
#9u^$6Y+,86W
^6Y+086W
#9u^$6Y+l86W
64Ea<k6
9b\b\b^
3(E]]7E
6YB+fY+ae+
E(E<K69zv?
3#3<E]hyc];\
dZ>]M]>+3W&+
AG+B,}#6@
R" Eh6#3TE]6
?)Efdt`
6YF+QG+XR
^t6YF+
+QD+XR{
+QG+X7lE
b\b\b\
+$5J^6YF+
"6]]7bdt
?(Ef<P
QA+XFEW
)EQA+XR
QG+XE@E<
m+|,9B
y7'[E@E<
QG+XRG
)E8 6UE*
?)EiSs
1Ye_1k
3s,:<6
Y\&b 6]`<
.6YMFf
|\+^RC
,}\><6
 6]QVs_8
6?j^6YMNf<6
B7,}\`7
s*z5`E
7s XRo
7s X6K6
WJAWs_g_
6b\b\b\b\b^D
<6<O6ba8E
T6<?6ba8E
6</6ba8E
6<6ba8E
$6<6ba8E
@6<6ba8E
6<vbF'w
6<vbF$%w
RH\(*AH@.6E
RH\(uJ.6U*
7s$X-6
s X1s,#
b\`6TX5J^56
%wb<%wbL
1s,#WfY"
VtJ\b\b\b\b\`
KI\rtI\`4
^6gtb-6wt
tb<%wbL
KI\rtI\`k7
6]]6+=
KI\VtJ\b^~
6ftb,6w'w`
6K6XR7
6K6II0+6
6$6b^~
tb<%wbh
6ftbL+6w$%w+6+=
b<%wbL
^6gtb+6w|
tb<%wbL
fJft``
KI\rtI\b^
66`6X0
d)6w %wb<%wbh
tb\`O6
E]]R-Eiyc]9^NqvXU
6]M]MV
;R6YMJfx)
6MNf_MB
:f[t`[
wb<%wbf41s,#Wf
2KInw6#3s<}\
KI\rtI^
6gtb(6wh
tb\b\b\b\b^h
KI\VtJ\b\b^
:f[t`?
33rftb^
D6}\b^
6b<%wbh
b<%wbh
:f[t`?
KI\rtI\`;6
KI\rtI\`G6
^6gtb4
tb<%wbL
fvat``
KI\VtJ\`86
6l86]3
^76atbP
+3#3s4}
3WE9P6b`<_6
7s$X7s X7s(XEC`
2YMBf+}^6
B,}iSs_8
]M]F+3]M]B+3
?6+Ef<
#3\UEC`
?6+Ef<
M]N+3TuE5
?6+Ef<w6
6TuE1
}^W6Y+6TuE?
33TuE=
?6+Ef<6
}^6Y+p
S*Ehx2]3
[a_}X]]M]MF
;j6<w6
#-/,EiB+
?#Ef<6
fJQM+XR
?#Ef<6
?#Ef<k6
/gJQM+XR
?#Ef<'6
ygJQM+XR#
!6#30E]:'E}^6YW+8
6TI+C`1
:'E}^~6YW+l
6TI+C`s
:'E}^<6YW+P
6TI+C`
FtJQM+XR
?#EiB+:;WR+9P
$|2?#E
?,Ef=at
?(Ef<S6
~:WB+B.
6}^D6"at
?*Ef<6
J$|^D6
?*Ef<6`
9?*Ef<6
JQB+XRk
JQF+XRIE
f<6Q3,EU/
JQB+XR
fJQD+XR
3(E}QM+>3(EYM+
#E53#3
E]E,EYF+^
$|QB+XE E<k6
?,Ef<k6
*Ea_N+7J
,E^az6
6<O6XR
z9Q(G+
6a+hx2]3l`6
|f<;6b8
6>w<%w
6#3HE]R
E&{>@1
jo]9@AW+?9E7?>Ro
|W]2W+?9E7^
+>|{E"
+QT+XR
EQW+XR
J^6<w6
yijT+2
6'n^`6
6'n^v6
QU+XR
<6b\`J
?;Ef<G6
b^$6+}
7shXRO
KI\b\b\b^
p6gt`[
6v`tXR;
AW+?:E2
+^6q`t`
R|EQT+X6
+\b^"z6
33YM^f<6b\b
6^&WyBl6]3_M,
t+3<El
6]QG+}^86+R+R
30EYn+aG+X:
;9O6Y~+L
AG+1jC
QG+R2_j+
14Eb+QG+#?)Ef
R`J6]]9
6<Q+Q:
"]N+3D6L36436<3$6$3@6,36
6_N+36
^+E6+}
)E6Yf+
6]R+Ss
?*Ef+=R
6^G+2%E
?*Ef+=>
h7JID+[R
,}QD+X7%E
6TG+Cb\`
6<76*AH8
C-B&(6
|(E9bF+0D+4J4Hb\`]
?*E7^F+&3#3<E]7)E
?)Ef%`t
?*Ef+=:
6l6]QG+}QD+X7%E
6TG+Cb\`
QD+X7%E
6TG+Cb\`
C-B5(6
|/E9bA+0D+4J4Hb\`
?*E7^A+5;|6YG+QG+X
JQG+XR
|.E9b@+0D+4J4Hb\`T
?*E7YG+9+H:
?*EfYK+^6YK+<
\b\b\`6HvKIP
6]J+33
F`J6O7;6WEvT463
MHaD+x3
6YV+\`J
C-bAG+ZIG+[E$E<s6bQG+X4Xt
]6YV+e
b^86+J+R
Z`J^6X
EC:+}4
c]9[a_}k
T6<w63uJC
/v} %w2
EC&+}`2
3T7Cb,H
!3qT7B.q
9|I\|6
7bf<\U+WsV6
yy"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"yK
Vy"y"y"y"y"y"yFy"yF&=
yp)i L
Myw+l&q+"y"y"y"y"y"y"y"y"y"y"y"y"+r<f,0Z]]]:6R
u0fu0^q0~}2W
1{ ZVRe]]5${2Fby\=
xz=#xW
F&BZH,Q)r
*q8x#~#xW
 {<U:P
&Pe5q2
*P%&PE{ R
*P%&PE{ Re]]5${*
F&a v<"
7Zy"y"y"y"yV
"y"y"y"y"y"y"y"y"yG
y#|*sL
WNy"yQ
"y"y"y"
Ly"y"y"y"
C+C)Py"y"
N:{-ly
Z0X~&yV
tx#x#y"y
yy&y\ym*cOyi
"y"y"y"y"y
"yxIy"y"yFy
"y"y"y"y"y"y"y"y"y"y"y9"y=cw
/s"y"ygy#yd9"y"yY"X#N*y.y"y)3y2y
y"i2y y"y"y"y"yRy&y"y"y"y2y"y2y"y"yBy"yby y"y"y"y"y"y"yry)"y
y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"yV
"y$y2y$y&y"y"y"y"
y"y.y"y"y"y"9F
"y,y"y"y"y"
Cy yby y2y"y"y"y"
Ay!"yry!"y4y"y"y"y"{G
Cy"yBy"y:y"y"y"y"9"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y
&y"v2fq2vi0 az"
y""y]q2RG
YV]8TM
y"}.'\q.H
3}"&yP%,0Zq.
"y0g!2P<E0a%.R
'qy"Tu
y2 zA"&zE"/s`m"byA"
y{'FvV}|R$+
Z*&:2*Q'F
F&Hy,4I
Fq1G&}.rQuy
uy"2<U.
H/u!y0g!
H,y!y0g%
iFW!!!y
*yJI2&
E_z"z}"
iFW-!y:
)ywz"Zu"pFV
u1"}*1|"&py<U6/
y"D!&<M
HyK.4c'~eTed"yW
Q)y{P<AI2Z
HyK.4c'~eP
Ed"yV1" 2W!
Q y:Ted"yW{
}"y"yy"'
yzwP8x"/g
PNP]&0a
}PNPa&0X|y8_~"a0"
Z\G&zlG&#y00X|/y
R,ydG&yy"*
dy:<'F
Z\G&z\G&)4%F
"J^yH<'Fr1
H"1HyNPq&00X7y&y
"y]2&v
92I"yF
92I"yF
92I"yF
92I"yF
92I"yF
92I"yF
92I"yF
192I"yF
592I"yF
)92I"yF
-92I"yF
!92I"yF
%92I"yF
82I"yF
82I"yF
82I"yF
82I"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y1i"y"y"y"y"yQy"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y@
Ay"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"yby"y"y`y}by-by"y"y`yQby"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"ycycycycycycy=cy"y"y)cy%cy
cyqcymcyYcyQcyMcy`y"y"ycycycycycycy=cy"y"y)cy%cy
cyqcymcyYcyQcyMcy`y"y8"
"y9"M
"yg7nKf5"ybibibibibibibip=n=nybibibibibibibibibibi"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y2y:y
y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y2y"y
y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"yd9"yBy"y"y"yByByByNWNy1yBy"yIy"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"yJ
-dYCYM
VYp-r7
Yc=m<a7g-a0f)p6n5v*p)"<n:qUp8
Yp-r7"y"
AYvYkUR
WYvYkyL
IWNyIKT
8o)l:FYQ
",v7g0"-
QYMPYJ
VUUYPYL
K"WWEv5
T"W"TI
QWg8n%m-c<o
*d.p%K
G^QG@G(EPyQPYA
G[QGDWWEM
Gya*f\~
"y"y"y"y(4A
Py"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"yfJr
h/.~7"y"yy"y"?4
CoCreateInstance
CLSIDFromString
CoInitialize
CoUninitialize
SysAllocString
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
ExitProcess
ExpandEnvironmentStringsA
GetCommandLineA
GetComputerNameA
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeThread
GetFileSize
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
CopyFileA
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
LoadLibraryA
LocalAlloc
LocalFree
OpenMutexA
CreateFileA
ReadFile
RtlUnwind
SetFilePointer
CreateMutexA
TerminateProcess
VirtualQuery
CreateProcessA
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
lstrlenA
lstrlenW
CreateThread
DeleteFileA
GetWindowTextA
GetWindowRect
FindWindowA
GetWindow
GetClassNameA
SetFocus
GetForegroundWindow
LoadCursorA
LoadIconA
SetTimer
RegisterClassA
MessageBoxA
GetMessageA
GetWindowLongA
SetWindowLongA
CreateDesktopA
SetThreadDesktop
GetThreadDesktop
TranslateMessage
DispatchMessageA
SendMessageA
PostQuitMessage
ShowWindow
CreateWindowExA
DestroyWindow
MoveWindow
DefWindowProcA
CallWindowProcA
GetStockObject
SetBkColor
SetTextColor
CreateBrushIndirect
CreateFontA
GetUserNameA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetSecurityInfo
SetSecurityInfo
SetEntriesInAclA
__GetMainArgs
_sleep
_stricmp
memcpy
memset
printf
signal
sprintf
sscanf
strcat
strchr
strncmp
vsprintf
ole32.DLL
OLEAUT32.DLL
WININET.DLL
KERNEL32.DLL
USER32.DLL
GDI32.DLL
ADVAPI32.DLL
CRTDLL.DLL
XJ]!10
L!This program cannot be run in DOS mode.
.idata
.qafnf
*ay7nE_@
+^{o;\
*amQq2X
v*aPt:kw
*ng*aoiJ:RM*"
.ar|4od:ai
QRM*cA;#heA7#Y}0[
]RM*;#3#
URM*8Q5m
w?iR&h"{
m.iL&"
Qai_fZ
^KqRM*8t*aa"#
*aZB}RM*
xjakD
*aa:2X
PaIRM*+#ARM*
>z8u*a+N
*2X4lZ
yHy*a@`#
ku?4k{1Xs
j>4k{7
$w*a^ejj`
\|6iz&[%{cm
dhaajaaja
SoiJ"#
`zXXZaPt:+
4>[j/`&Vk
$/`ao+a
Qq!Z\|6iR&0wv$
&2VaK8lX<s
JaPt:+
px*air"1BHq
f#5H(8k
oQq!Z\|6iz:
;X2{/P"Op6
kZP"Pt:+
^z7_i]t
^y7_i]
^jC#_y
ZaPt:+
kJh"zv7#e.
##6a.1#,
*au?4kM
AM*1i?7H:
*:&!&!ooiiO.1i76oara
*aajac2V
dhaiJXs#y-s#
!e*$|*aH:
%JcokJ
haoJ1oz
araZBAM*
"haiJ1i7u
*ao_Vc
*aiJ&Xg
^jC#_Q
Qq!Za:2X@b
*h9z;+a
ql$nb3
OoioK)`g
>%W{whaAk#{%gaO>
ajaara
g*aOBa|N*
a!b3+a
GaPt:+
M*c*ak
AM*aD*ak+k
z})kJh"z:g
B1BN*W
_AM*1i76o%J
_B1BN*(`*aa&nU
*ng+ae+
7ha_ o
*a(@`#
B1BN*Y
*a(@`#
Aha_ S
+nl*a`:
H:*ng)a
z}EkJ:>!W
B1BN*g
}}MkJ:>!W
H:*ng (a
kJ:&!W
*akJh"
f*aa>:
zxf*aa:
*auY}$
h*aa.7
*ao!O%J
*aseY}Y7k
Y}N*jak
ka/!{N*h"
Eg#'y}N*!
A)a.!kJ`7 hc
dka{-P"c
/y}N*`
/y}N*c
VM*7 H
kaa(`7 a
N*`7 a
+a'y}N*Ac
ha/1BM*h"s~
+ZM*\b
lka'P"~`
dha*ao/
+djaa2n
/irO*c
% fjJ/
Dja2*Ntjah
e7 /mrO*ja
Dja2*Ntjah
e#/mrO*
erO*P"Ot:+|6]AH
|P*aAS#P
$Jo%J!
VM**!p#aOo
XM*dha%Jc
*Gog*a
kJ!oe*
z$R_@`
kJ!Pt:+
y%JhTh
@`oJ1oJ1
?q}N*>
_UnV2a
_InV2a
_}nV2a
_qnV2a
u6ng*a+>w%j
A.dhaz=
A>t0ha_2
qo[9d&boiJ:
cb3,eOa)
]+_wk)$~Yea-
e.g*a{-\
qo[9d&`:ekJ%
bb3,`<a.nT
*aa {#
4ci3?AsO*P9`:_
/`2ekJ
*a\|nTZ:
1{N*nT
A&l<hack
?AsO*g
b3/YM*ag
>8c#(bUXe
&pk?=w
ckcB`( c
*adhab
!g*a/@ai
*abr"a
+vjmZ_
b3/YM*a
\|6iR"
$J`or{#;a
z,.oW}
"i`"z&
z.)nTL+D"
oo7v*abJ`brnf
%_gbJ`
aOkJ%2a
_ebJ`oQq!ZY}
!Zkaga
a!b3+a
]S_f$K
*>Tw/*a
{aY}uX~0k
*&2*au?+
@a*ae)
z"]*ak
oma/*P"v
|0_*aZ
@a*ae.
z"^*ak
j{aomk
_k@aoZ3_m0
u?4k{7J[
ok+kZP9
RyaqcJ&
*P99nT
41:#j2
s7'#22
^y7wiiz&x<$
M* ]*aok
+y7q8mN*ao
*abr:`
L2aiJ"nUO(Hond
$>nTJnTK/a4`
_eabcbb`bra
*aiB*$og
oiJ&nUO,
Pt:+JrZ
ulO*[n
rrKrp
LS3jar2r
rzirPrerX)rsr"
]rulO*k
rsrrr\n
rsrrr\"
$i$oq7czo
ZeaoZUa-a
4]}>]x::
!:nTBH(:nT
*ajnT%
*zPA*ao`
dae,z:
rdaEcb*
~da'a{#`(l#5H(8k
7(ao_i
\Jhak)\&ha,
_M*vk)$
?_M*P`:.*ha
}6hakJ
bt>ha$
\>haOB_M*
h*ak)$
?_M*Po
)d.haJ
/_M*XXk)\&ha
3uw#'_M*52
#&[k+k
_eabyob
caocJo
,:>!Pt:+
*nTr1BHq
f#5H(8k
bJ`hJ]yg
z"jha2*
$Pt:+
m*aajaoJ1oJ1
z"F*ak
F*aQq!ZQkS(*a
u<!Z_}0l5fk
hG*a^m
G*apcW{
|6iz>
*nUJ2>4k
@@a*ae*
Pt!Z;_
thak_"!Za:2X
gz7aokJ
okJ:OVk+%
^Dk+_q
+y7wi%J
viaoiJ$
4>%n}}
*N*aY}Vwc}
&$oika!b3+a
z"J*aa"
4K*a[l*a
0K*aa"
xK*aa"K*a[
L*a[)a
M*a[l*a
*&Fk*a
DM*aa"
8N*a[l*a
8O*aa"
z4*ao
zh0*aa20*a[
T2*aa"2*a[
aiozg
aik+kN
3*aa"3*a[)a
4*a[l*a
*&B=M*W
Qq!Zc.`
d@a7#g`
Ak+ku!Zcc
|8*aiZ"
<R*a2V
o[ do[(`7
o[ diZ
h"z'7
*;*abA
|<*acX
\|6iR>{&k+k
z&t<*akL
z:`<*akLy<*akL%
kJ%_qooK,d
/nUZ`2
e*$=*ak
>%*a|=*aoJ1Q
|>*aiJ>T
a\|6iR"w)yfk
<M*x *ak#
o*ajP",
&%Pt:+
*2X<x
/*ag.`
`z%e"8
zH<*aa"<*a[
XB9<M*_
*&;*a
*a{3o*
}H=*aa:Bs
zT>*aa"
z@>*aa">*a[
?*aa:8?*a[
*x?*a[
XBw<M*_
aik+kb
*a{3o*
}  *aa:
z0 *aa"
g*aOy#*ak
*P"Omk
Qq!Zce
,awiJM
nf(ag.`
nfw(ag
nf*ae*W
Bj<M*(&*ag!
|D#*aa>h"z
Pt:+.a0\|6iR"a
hk+ky&*akJ
*%V6a\
x\)*a:G
_@agU?
*u?4ka
*)*aXW*
^eksc~
5"q*ao
^|6\ ~A
*%e+6?Tfha
ae+6?T
ae+6?T
ae+6?Trha
ae+6?Tha
N*(*aTbha
M}N*\)*acSs
qa*aoJ1
@aoJ1iJJz
*)*aAK e*; e*13$
*aiJJ_@0
>ha#e*p**aAo#e*
>%e+7?Tka
ae*; e*K e:
+*aA#e*; e*K e:
lha#e*+*aA
 e*; e*o#eN
Tka@Z*agB`
ha#e*,*aA#P
*a*ag*a_B#>M*
ha#e*D-*aA e*; e*K e:
@y#+aga
@y*aga
g*ab_B
ha#e*.*aA#F
.a9*a#_i
i}N*,/*ac>;
g*ab_B
_@]iJJ_@u
+ha#e*/*aA
kJ%e*; e*K g
$oaN1^@u
*$e+7?Tka
5ae*; e*o#eN
g)ab_B
@aL+a
*a=@uuBbz
>ha#e*
*a3@u*ag)ab_B
e*; e*K e:
MZae*; e*K e:
*a*aeN
g*a_B9M*
*aA#e*; e*o#e2
@v*agj`
qY}i(zc3`
@a*ae)
*aoJ1oJ1oJ1
ha[#_m
a2#,@e
&%Pt:+
kBRM*g
BQSM*g
BXPM*g
*&'*a
*4k{2X
2aPt:+.a
#"a\|6\E
B`QM*g
BUQM*g
_BT9M*g
BK9M*g
B~9M*g
_Bq9M*g
*aa nd5+a
os-`jp
#=*aO]z6t
*@*aY}
U}N*:&!/1
VM*{#Le
>a,{#
*aZupag
rha#gj
kakJW!o
%ao%Ja
*ak+k$&
v%ae*; e*
*ka#e*
V'a2*aXN#*l
B8M*1
@aZ!e*
6$a2zx
#u?qZcjc
Uoa(nfv+ai
*nf|(a29`
%BN* 
$X2z5g
*aCk#B
+ngZ-a
_l:q_q
_BL8M*g
@a##e*
a!b3+a%w
)a%BN*D
lrhaa!b3+a
\B@M*W
@ec#gS
u?qZa&2X
dn!S>*aiJ&\
#z!# Fe
V.a4}wO*
".a4A}N*
.a4A}N*
*aQq *a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
o^HkmH^{
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dbhar*a
Dfhar*a
Djhar*a
Dnhar*a
Drhar*a
Dvhar*a
Dzhar*a
D~har*a
DBhar*a
DFhar*a
DJhar*a
DNhar*a
DRhar*a
DVhar*a
DZhar*a
D^har*a
D"har*a
D&har*a
D*har*a
D.har*a
D2har*a
D6har*a
D:har*a
D>har*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dhar*a
Dbhar*a
Dnhar*a
Drhar*a
Dvhar*a
Dzhar*a
D~har*a
DBhar*a
DFhar*a
DJhar*a
DNhar*a
DZhar*a
D^har*a
D"har*a
D&har*a
D*har*a
D.har*a
D2har*a
D6har*a
D:har*a
D>har*a
Vjw1bk"mFg
q"s#y`k#lixv6?g|.sq&km"96yql"s7$,p8faxkiVwm&,6;yx0hxxv6?g|.sq&km"96ylu9.{7h7$,p8faxkiVwm&,67fz>b7$,p8faxkiVwm&,6"ls7-k#jw2{7&s
#h7$,p8faxkiVwm&,61o}3px8-k#jw2{7&s
?fj3qz>qlym}3-i>
q"s#yg| -w;qlym}3-i>
q"s#yqv%m|0ax8-k#jw2{7&s
>wil,u9jw1g7>pmxh6?g|.sq&km"96ytnxf}:m|xv6?g|.sq&km"96yuoxv6?g|.sq&km"96ybz=qjxu6?g|.sq&km"96yfm>q}xjcym}3-i>
q"s#yo}7h78-k#jw2{7>n
>wil,~7.i$n7$,p8faxwtVwm&,6&lt9qlym}3-q"
q"s#ysv"fx0`q7-k#jw2{7>n
>wil,r7fmxv6?g|.km;km"96yuoxv6?g|.km;km"96yql"s78,p8faxwtVwm&,65vm9-k#jw2{7>n
>wil,t7b
7b7$,p8faxwtVwm&,6.bk3`s4m|"jw2{7>n
>wil,r9ep%bmxq~ym}3-q"
q"s#ysx${44mrxv6?g|.km;km"96yj}9.{7h7$,p8faxwtVwm&,6=ur7-k#jw2{7>n
>wil,u2qrxn7$,p8faxwtVwm&,60wq7g74y6?g|.km;Pv0tx$_T?qv%emVl
"bk3Np5lj9w
x&YVs&YV%YV%YV%YV%YVH%YVH%YV
+YV%YV%YV%YV%YVH%YVH%YV
+YV+YV%YV%YV%YV%YVH%YVH%YV
+YV%YV%YV%YV%YVH%YVH%YV
+YV%YV%YV%YV%YVH%YVH%YV
+YV%YV%YV%YV%YVH%YVH%YV
+YV%YV%YV%YV%YVH%YVH%YV
+YV%YV%YV%YV%YVH%YVH%YV
+YV%YV%YV
%YV$YVg$YV+YV
%YV1$YV
%YV1$YV
$YV1$YV1$YV%YV%YV%YV%YV%YV%YV%YV%YV%YV%YV%YV%YV
+YV+YV
+YV+YV+YV+YV+YV
%YV+YV
%YV+YV+YV+YV+YV+YV+YV+YV+YV1$YV1$YV+YV
+YV%YV%YV1$YV
$YV+YV
+YV+YV
+YVu%YV
+YV%YV%YV%YV%YV
+YV%YV%YV%YV%YV%YV%YV%YV%YV
%YV+YV+YV+YV
+YV$YV+YV$YV$YV
+YVX%YVX%YV
+YV%YV%YVZ+YVZ+YVZ+YVZ+YV%+YV%+YV
+YV%+YV
+YVK+YVK+YVK+YVK+YVK+YVK+YVK+YVK+YVK+YVK+YVK+YVK+YVK+YVK+YVK+YVK+YVZ+YVZ+YVZ+YVZ+YVZ+YVZ+YVZ+YVZ+YVZ+YVZ+YVZ+YVZ+YVZ+YVZ+YVZ+YVZ+YV
+YVZ+YV8+YVZ+YV%+YV%+YV
+YVZ+YV8+YVZ+YV%+YVZ+YVZ+YVZ+YVZ+YVZ+YVZ+YVZ+YVZ+YVZ+YV%+YV%+YV8+YVZ+YVZ+YVZ+YVZ+YVZ+YVZ+YVZ+YV%+YV%+YV%+YV%+YV%+YV%+YV
mm2o72o
oP8wL8`v2Pm$m~VwL8bi
P|5jv8Mm
Nx&j|!eJ3wp9
p\$lkVVK
+DZuG=Zu
=^u_=Rwv
]"b]\^
I$`|%0+
VwH#q`
pm3Jw0qt7jv8
Vfk8o*dgu:
8gu:gu:
V[VG[V
\mm2o72o
Vpv50+xouV
=qw30+xouV
r3m|:172o
Vvj30+xouV
Vp|$172o
=qw30+xouV
O?wl7Sk9fz"
^3@l$fw"qv5pj
_?gN?gv!
J3gT3px1B
r3m|:172o
M]V.qUGC
0g:u;Vwl*1
V?YVY?YV>YV=YVnnD
1"M>p9&l~$n95mw9#{3ql8jwvLJvl}3
mYwG=^wW=Fu
wO=^wK
m+V=\w
V_7)VLw
VuF<i<
VuF<iH
V?V}!W
$*?*?#
VD&.Vy
VW$?#~VW$
=YF7=^
Vaz2e~>ir:mvVpEs
\.wI$`|%
^3Fw qv8fw"wk?dj
^3P`%ft
q|5lk/
V&mT#fa
K"Vw!m}Vd
d1=d1&dB1e7b6Wc6
c6gcv6c^6cF6c.6c
V19d11d1)d1]d1Ud1Md1Ed1}d1
VouxouV
Vkp%H\
E_vbjvl}3#{/U7v-9
SR/9;g|$wv$l
vql"s78
N3`v;#m9ll$ev$n5vgl:#N3#T7w|$"9>wil,z$wv&mlVTTzt|:lt3wvvQL
P8lk$`mvWTvJWzsu3p|z`v$fz"Su3p|zfw"q9/vkvWTvJWVmz9q|5#Z
19~.}?jmvl}3lwvbz=l
vbk2/9&fx%/95qk3w
fx%/93w|$zv##Z
19~.}?jmvl}3lwvbz=l
<%&jVo|7f5vfu3w9
sp$wp9#@3q
fx%/9%o|5#\.jk7jv8Nv8k
`v$fz"@x$#W#a|$#i:bj3#z9q|5
I:bj3#|8fkvll$@x$#W#a|$&jvp
fx%/93w|$`v$fz"El:#W7f
fx%/9%o|5#Z7g9~jj7Nx%fk
K3jj"qJ3up5Sk9fj%h|$fue-}:
j#e72w
2hrxouVh*dua2hre-}:
<%&jVpEs-|.
<%Qm22<?km;&j
w}.&pxbmVvi2
<%,Zvp
lt;m}xltVpE5nt7g7&e
s_z;-|.
<%`t2sp09<fv
o vi=m
fx%#t7f95qk3wp9p97g9"z97bp8
L8au3wvvvm>qp,-9
g|vp9$rl?f}vl95ni:w|vk|vqx8bz"lwx
9vBl"lk?bm?m9
jz=Lw5#M9@v8jw#
#I.Z9f
egp1w9 op2wp9#z9f99#{7h99#z7g9~uod
@9q95q}vvt4q
q}v%93sp$wp9#}7f
ouvbt3Up%
T7w|$bk2@V
I:bj3ep:#p8wq3`v$fz"jw0qt7jv8wvvfk?z9/vkvg|8jm/
[3lk3pp1jw1jwzsu3p|vlw0qtvkx"zv#bk3wq3ln8q99#m>p97`v#w7Ve90bl2lwvvkvf{%w|zt|vq|vm}3wx=m~v#i3jv2q| fnve99q9;n{3#x5ll8p7Vp9&qmve99q95mm?vp8#z9np"fw"wvvqv"`mvll$bz5vw"bw2wvvf}#f9"f9?pm7`|V#9vfz#jm/N|7vk3
Hp8Hx$lwV{i:q|$Gv5as3w
n|9w1t+0t&l
<%fu0sx$mmxlz7jv8!<%8
0mz"lwv+0Vp%w.9s#4{
A{hK3u(gJ\
bt3&js#4vjz$pv0#P8fk8w9
su9fkVJ|.ov$-|.#
"bk3Np5lj9wE#J3vi
[$tj3fn
Np5lj9wE
qk3wO3pp9_\.ov$qE
ln%M|!qv5pjVov4oL%qV0op8
J9wn7fE
"Tp8ln%@l$fw"fk%lw
mm3m|"P|"jw1
jz$pv0_N?gv!_Z#q|8U|$jv8Jw"qw3#J3wp8pE
m|%&lV,{9z'jwt:
%y`k?w'Vpj3Wp;ll"!c~!5s*"V
<%lz#fw"&jxv{;w1
bVvw5jv8y1
?j5ji"
%?sl"w`&>;%at?!9 ol3$>h&j*%w4s"Vp%?sl"w`&>;3jmtux:f$qp>vbt3$<%v>hakh
<%jw&w9"s|kf}?!9 ol3$<%#w7f$qp>hakh
jq'Vp%0qtv`m?m$tp;vfm>g$tLJ
#w7f$tp;he<xv
em{lk&&jjjm:=<%v%yjm:=
<%"4{&7d#4{
%>nuh-q"
<%`<5au?gF#fkVf{vu|8#U9d|$Pv0tx$_T?qv%em
fu:fk `|
i|5G|:zU9g
bk"fw"Wq$b}?dT9fuV@U
GEs_P8qv5fk q*d&j
3){2/d3[c4*n
[#vXu3dm>&p
Xj#n$s^
Vp<5&jv[<5&jvLK
&AVj~8jwVzx>l75n
!at7o7<mvxltVz7<mvxlty,
xvw9`v;-|7wq:mrxPp1#P8pp1jwxax/
U9#P8-i7sx:`v;
"Jw"qw3#\.ov$q
9VG5e7%GH
]G5e7%GH
OjiNGj
CoCreateInstance
CLSIDFromString
CoInitialize
CoUninitialize
SysAllocString
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
ExitProcess
ExpandEnvironmentStringsA
GetCommandLineA
GetComputerNameA
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeThread
GetFileSize
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
CopyFileA
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
LoadLibraryA
LocalAlloc
LocalFree
OpenMutexA
CreateFileA
ReadFile
RtlUnwind
SetFilePointer
CreateMutexA
TerminateProcess
VirtualQuery
CreateProcessA
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
lstrlenA
lstrlenW
CreateThread
DeleteFileA
GetWindowTextA
GetWindowRect
FindWindowA
GetWindow
GetClassNameA
SetFocus
GetForegroundWindow
LoadCursorA
LoadIconA
SetTimer
RegisterClassA
MessageBoxA
GetMessageA
GetWindowLongA
SetWindowLongA
CreateDesktopA
SetThreadDesktop
GetThreadDesktop
TranslateMessage
DispatchMessageA
SendMessageA
PostQuitMessage
ShowWindow
CreateWindowExA
DestroyWindow
MoveWindow
DefWindowProcA
CallWindowProcA
GetStockObject
SetBkColor
SetTextColor
CreateBrushIndirect
CreateFontA
GetUserNameA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetSecurityInfo
SetSecurityInfo
SetEntriesInAclA
__GetMainArgs
_sleep
_stricmp
memcpy
memset
printf
signal
sprintf
sscanf
strcat
strchr
strncmp
vsprintf
ole32.DLL
OLEAUT32.DLL
WININET.DLL
KERNEL32.DLL
USER32.DLL
GDI32.DLL
ADVAPI32.DLL
CRTDLL.DLL
L!This program cannot be run in DOS mode.
.idata
.qafnf
9_L>_\&]
^,f6HR+=6
_D>_@6Ebg
h1[ab\`(&
Fc]9[a:_MX6]
tQh+\52V1k
e<D+~>Y
cYc\+[R*E
9&dJ`s6W
6Wm]W5
9[a]mRf
"dJ~6W
y6_D6<76[ak]UM
\b\b\`6
vJP=B*
|'N*Q:]M]J*3V
^RX]]7s(X/
\:+}(p6]
?;EC"+}\&+}F<p6]EC(|N
]3We_1C
QPWmF6U>4
_MB7,>
5+MF%r
6<6[a_}
}(D|%UF*j
E36_F*3,D]N*M,D]J*3(D_M
]Q$]_]22
]F*hyc]e_1k;Y/OUMFe
E&{>@1
MF=33c(9L(A
6_MF3s ]MJhyc]e_1C
33c(B`J#
"1jB9zv?
tZ33c(9ziSs_g^
aVYt^Rt)Ef_uBq^R)E
`+}\bd{6
6]M]MF
JiSs_g^
iSs_8(`>kA
a9H3s8
7J\bx6]
3^R3+EoUU9
]3l$7F
`p3a33U5
?+Ef+}
6JQE+XR|/E
wJ6=U6
1s 1J`J@
J`J6ut
l|6YQE+y\|E
7s$X7C4V&]
q>_wa_7Ea]
6Yf*H6C6
1s1?+EBb7?+E
wJf_8E`_MN
D]hyc]9[akyMb
?6_M89Q6
6];Bz6?v3,
~>]M]MB
vJ6<M+
,]324?
1282WmF6le6]3>T46
9+}^6<6
#6b\b\b^
3s b\bf<6
>]9+H:
]6YEJg>+}N
7s$X4Xt<#6
6<6[aowyIi
6?+E6XtZ
3 DY~*
D6b,x6<?6
?+EfY~*!EW
33YZ*H6
zC~b7?+E
?+EfhYt
?+Ef_0E"
6l6YQE+yQE+X
wJf_0Ea
O3,D_v*
6TG*9P6b^6YG*
?+Ev?+EfX
*f{6#3pD]9
+6/7Xt
+Ea< L+~:E6|QE+
6JiE+_R!E
6JiE+_R!E
+6/7Xt
+Ea<TO+~:E6|QE+
6b^@6X
YQE+y\`
ftI5EW
+6L7Xt
+Ea<N+~:E6}\`
F`J7u\
?+Ef_0Ea
*QE+X1
YQE+yqE+
6Y2*QE+X1
6Yn*^D6_**
6YR*QE+X1
?+Ef_f*
QE+X1<D
+EQE+XS6JQE+XR/
QE+?+EQE+X7\DW
*^T6_&*
QE+X1pD
d3s(b
*6l6YQTE+yQE+?N+EQE+X7DW
baE+?+Ef_0Ea]
QUE+XED<I+~>]iPE+b
7}CQE+
n+EQUE+X1,DY+Ef<g6
6_:*>U
E8D_^*8D
P+9$D}QE+
33_R*>Wj*B
?+Ef_8E`
;m^6_Z*>=>M+Wm
1bE^P6vl
M^\33C0
b6<L+`J6Q
y'@6?}s(E+WmE
`_Uw|oUs$
z9X65E6
6+,?`J
@9H3s 
E36l6\3=
6]M]MV
.KI>tH#w
36]M]MR
.KIv=6
FuJ;6#3s$|9b
Z1\ML9bMM
:K#H0+
QvTuL2/:;
6TJ2]306
>DH2W-
6;-_6W-
6E36]w
*v9zvSs_
jtJ,9B
W6w'w`
W6w8%w`
B7,}i1VF^3}h`Uw
]6WmV6YM
6YM^f+
3#3sLy\
b\b\<s6
3#3s@y
6#3sDyiSs_8
WmN63c8
7s,X7s<XEC,b\+>+
9bME9b
6|,R3T4
6T44m3
0},R4T44Y3W
3s,&YL39
6CB~T47A3W
24B5D6
16}tR6_]
]3We_E36_}9E
$:61|@
9B`J9b]6
(+v9a,
bf<L+QE36
YL7_]N
E36WE,(
cX4+<nhJ
iSs_-6<6[a<
E6<656
QU+36|ie+
C9bI+3|E
+32AX#w
3pE+<fMI
+32(+v
I+9bI+{
#6]n+E36TY+9P6+3
E]{Y ]
6HQU+9E`&
pP6]9\4]
E36WV+X
;Eae++9
TW:+Id+
iU+}qU2
@+Q;8E
E_6=H6
3 EWN+AU+X4]{[4EF
3e+/;E6
E EUN+2
:7E}^6<6
EAd+x*
E]f+*Y
+u_~+3`E
f+:7E}y^
AU+X4_
EHAU+`&
6_N+5S6
E6W^+ae+J~T0CJ<
}$R5T0CJ<
}$R3T0BFQ+
Ad+X4]
30E?3?
1 E^2&3
E+n+R@-E
:7E|qU+
51e+'+N+; E
6E36=&F+?;E7
]3We_1kb!_MF
7K3BiJ
6'1s(x
}uTMA7UMFX
]]F9bK
Q<TMB7TuB1
hyc]`>oZ~yc
6b<Y6]9+H:
]Q8T4j
G9wW'!6Wm1
`-aY33Y};6^EC
?64Ef<6
?64Ef<
B7,}\b
6<6W_8
z&bxY6]MF;6b
3]1s(Wm
1Y`;4S;)6
\b\`6ECg
3]]9+}
\b\^RS
3WEvT463
7s(X4Xt^R
.]]66b\b^
X6];;6WEC9zb\b`<6b
33c(9a
OKtNe+}^6<o6`
;s(O69a
uUJ<9E
}6quJ$^
iSs_g^
6J<Z69E
33c(Wm
6WmV6WmR6Wm^6YuH
4\MDDX
M]Mf71s
*DD**DD**DD**D
6dJoYt
eQ*D*D*
**DD**D]
h*D*Q<
6P*D*356D%
*D1qD*J8*Dz:D*
*D}rD*WD*DoSE6H"ZH6dJ7Je*D
*DD*WDdD*o
3D**DD**D3D*#*D+D**D
8*DD*6*D
6dJWDdD*oYt
3D**DD**D3D*#*D+D**D
e8*DD*6*D
D*')y_8
`>_MP]MH
M@6?"Rc
9x024D4A
JfYMH9b]@7
b7$XRK
,;[(C6
my]uRa
6MRf<6
&WMB2u
E6_un9c3
iJQ!UQ
iJ233TuU7
iJf<F+~>
7s<XEC4^EC0<
yiSs_8
-J7$||
5J$\QG+|
C6nTY3#{C)3
I3\E+|s+
@5E+:s+
0s+4@?1+E6<o6
E+:7+E
5JQG+XR{
b\b\b^
vYA+0O6]N+EC
C6]]6YJ+^
)E@6+N+R
t[5JQD+XR
?)Ef[t
E36[t`w
6W$\QG+|iSs_g[a_}4l3]]E36UT
7s,X7s(X679b\b
3WEvT463s,
b\&+}F
9W_ak5B,}\b
~.Uyc]fhU
33YMBfYMFf
\b\:+}
1V&_1C..k*
]3W`v+*
N6]MB,!B
(6]M]MB
l6]3_MFiyc]6B2]M]MF
3fyc]9[a_}
T4;93$
]9qT46
3s,#mB3s(bv??3pL6]
B]MBMS,]MF
MS$]MJe<C6
1s$]M^3s4Q 
$y22NC,z_P
MD69cuD9b4,6
y86P5]]f
P+MD9cMD
]3l@4w
6WN*qE+
:<J+~>]
M,D]j)1
6bJ6]F*;
G]9+H:
E(D<;6
6JaE+s
$|<L6m
6JaE+hr
6JaE+ r
+Ea6[t_Rw
^6+F*R7
^6+F*R
#-Z1(D
#^)6Yd)
+E$J6W
EC?+EfZtXRS
#9u^6+F*Rc
Q@_z)hGB*D_z)hG
+_l5Ji
+E D+}Q
4JaE+`v
$|DH6m
~>Uz):6
E D_B*
+38G=v6
*]B*Sz
6l6\QE+|
QE+?+E
o4JQE+XR
7 GWEvT463
+XQE+>3 G
E$G_F*^60
#9u^6+F*R
E(D<76
~>]]E$G<6?+EQ
?*E^6+F*R
~>]]Rk
^6+F*R_
#-Z1(D
~>lz6\QE+|h56m
+Ea6[t_Rk
4JaE+
E(D<K6
+E,46W
#9u^$6+F*R
+EX46W
^6+F*RO
6JaE+D
5Ja<o6
:W6b\b\b^
v+}8?6]R)E(D<
6biE+_aE+
06+R)R
+EX?6]]T?6_V)hyc];
ME6?3;
(33yc];H
n]]9HE
>T09@9
?)E$q6#3E]
4J3tEUdk
?6]+EtE<
>6]+ELE<
1EY\7Y\7/)E
\bQG+XR
D+B7,}^
6YF+QG+XR
JQD+XR
,]QdG+}QG+X7(E
R;EQG+b\
?*Ef<6
~*]]}lE
QD+XR;EoY
+QD+X6
)E^6udt
?*Ef<w6
+B3?R)E
?*Ef}dtH
QD+XT<6
JQD+XRTiE
C)E6?*9HE
)E6]M]+3Y
:6_&+Q0U
hx2]3We_1kBVO33+}p;6]
bD:6]3#3s$}
$HX=6W
-6#3s<}
b`vb\|
7s,X(86
?4Efndt 
6lk6]QZ+}e+~+Rk
E+}('6
,}QZ+H6
B7,}QZ+X7
|e+~+R?
E+}|'6UV
B,}iSs_(6<W6[a_U
vA]M]N+3U
3#3$E_J+3][t[R
EQe+|^6Y+x;6W
64EaPdt
64Ea<C6
?64Ef<K6
?64Ef<'6
?64Ef)[t
?64Ef<6
~"]]RW
?64Ef<w6
?64Ef<c6
#-@3!R
6MCdY+^6Y+
#9u^$6Y+
#9u^$6Y+96W
#9u^$6Y+,86W
^6Y+086W
#9u^$6Y+l86W
64Ea<k6
9b\b\b^
3(E]]7E
6YB+fY+ae+
E(E<K69zv?
3#3<E]hyc];\
dZ>]M]>+3W&+
AG+B,}#6@
R" Eh6#3TE]6
?)Efdt`
6YF+QG+XR
^t6YF+
+QD+XR{
+QG+X7lE
b\b\b\
+$5J^6YF+
"6]]7bdt
?(Ef<P
QA+XFEW
)EQA+XR
QG+XE@E<
m+|,9B
y7'[E@E<
QG+XRG
)E8 6UE*
?)EiSs
1Ye_1k
3s,:<6
Y\&b 6]`<
.6YMFf
|\+^RC
,}\><6
 6]QVs_8
6?j^6YMNf<6
B7,}\`7
s*z5`E
7s XRo
7s X6K6
WJAWs_g_
6b\b\b\b\b^D
<6<O6ba8E
T6<?6ba8E
6</6ba8E
6<6ba8E
$6<6ba8E
@6<6ba8E
6<vbF'w
6<vbF$%w
RH\(*AH@.6E
RH\(uJ.6U*
7s$X-6
s X1s,#
b\`6TX5J^56
%wb<%wbL
1s,#WfY"
VtJ\b\b\b\b\`
KI\rtI\`4
^6gtb-6wt
tb<%wbL
KI\rtI\`k7
6]]6+=
KI\VtJ\b^~
6ftb,6w'w`
6K6XR7
6K6II0+6
6$6b^~
tb<%wbh
6ftbL+6w$%w+6+=
b<%wbL
^6gtb+6w|
tb<%wbL
fJft``
KI\rtI\b^
66`6X0
d)6w %wb<%wbh
tb\`O6
E]]R-Eiyc]9^NqvXU
6]M]MV
;R6YMJfx)
6MNf_MB
:f[t`[
wb<%wbf41s,#Wf
2KInw6#3s<}\
KI\rtI^
6gtb(6wh
tb\b\b\b\b^h
KI\VtJ\b\b^
:f[t`?
33rftb^
D6}\b^
6b<%wbh
b<%wbh
:f[t`?
KI\rtI\`;6
KI\rtI\`G6
^6gtb4
tb<%wbL
fvat``
KI\VtJ\`86
6l86]3
^76atbP
+3#3s4}
3WE9P6b`<_6
7s$X7s X7s(XEC`
2YMBf+}^6
B,}iSs_8
]M]F+3]M]B+3
?6+Ef<
#3\UEC`
?6+Ef<
M]N+3TuE5
?6+Ef<w6
6TuE1
}^W6Y+6TuE?
33TuE=
?6+Ef<6
}^6Y+p
S*Ehx2]3
[a_}X]]M]MF
;j6<w6
#-/,EiB+
?#Ef<6
fJQM+XR
?#Ef<6
?#Ef<k6
/gJQM+XR
?#Ef<'6
ygJQM+XR#
!6#30E]:'E}^6YW+8
6TI+C`1
:'E}^~6YW+l
6TI+C`s
:'E}^<6YW+P
6TI+C`
FtJQM+XR
?#EiB+:;WR+9P
$|2?#E
?,Ef=at
?(Ef<S6
~:WB+B.
6}^D6"at
?*Ef<6
J$|^D6
?*Ef<6`
9?*Ef<6
JQB+XRk
JQF+XRIE
f<6Q3,EU/
JQB+XR
fJQD+XR
3(E}QM+>3(EYM+
#E53#3
E]E,EYF+^
$|QB+XE E<k6
?,Ef<k6
*Ea_N+7J
,E^az6
6<O6XR
z9Q(G+
6a+hx2]3l`6
|f<;6b8
6>w<%w
6#3HE]R
E&{>@1
jo]9@AW+?9E7?>Ro
|W]2W+?9E7^
+>|{E"
+QT+XR
EQW+XR
J^6<w6
yijT+2
6'n^`6
6'n^v6
QU+XR
<6b\`J
?;Ef<G6
b^$6+}
7shXRO
KI\b\b\b^
p6gt`[
6v`tXR;
AW+?:E2
+^6q`t`
R|EQT+X6
+\b^"z6
33YM^f<6b\b
6^&WyBl6]3_M,
t+3<El
6]QG+}^86+R+R
30EYn+aG+X:
;9O6Y~+L
AG+1jC
QG+R2_j+
14Eb+QG+#?)Ef
R`J6]]9
6<Q+Q:
"]N+3D6L36436<3$6$3@6,36
6_N+36
^+E6+}
)E6Yf+
6]R+Ss
?*Ef+=R
6^G+2%E
?*Ef+=>
h7JID+[R
,}QD+X7%E
6TG+Cb\`
6<76*AH8
C-B&(6
|(E9bF+0D+4J4Hb\`]
?*E7^F+&3#3<E]7)E
?)Ef%`t
?*Ef+=:
6l6]QG+}QD+X7%E
6TG+Cb\`
QD+X7%E
6TG+Cb\`
C-B5(6
|/E9bA+0D+4J4Hb\`
?*E7^A+5;|6YG+QG+X
JQG+XR
|.E9b@+0D+4J4Hb\`T
?*E7YG+9+H:
?*EfYK+^6YK+<
\b\b\`6HvKIP
6]J+33
F`J6O7;6WEvT463
MHaD+x3
6YV+\`J
C-bAG+ZIG+[E$E<s6bQG+X4Xt
]6YV+e
b^86+J+R
Z`J^6X
EC:+}4
c]9[a_}k
T6<w63uJC
/v} %w2
EC&+}`2
3T7Cb,H
!3qT7B.q
9|I\|6
7bf<\U+WsV6
yy"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"yK
Vy"y"y"y"y"y"yFy"yF&=
yp)i L
Myw+l&q+"y"y"y"y"y"y"y"y"y"y"y"y"+r<f,0Z]]]:6R
u0fu0^q0~}2W
1{ ZVRe]]5${2Fby\=
xz=#xW
F&BZH,Q)r
*q8x#~#xW
 {<U:P
&Pe5q2
*P%&PE{ R
*P%&PE{ Re]]5${*
F&a v<"
7Zy"y"y"y"yV
"y"y"y"y"y"y"y"y"yG
y#|*sL
WNy"yQ
"y"y"y"
Ly"y"y"y"
C+C)Py"y"
N:{-ly
Z0X~&yV
tx#x#y"y
yy&y\ym*cOyi
"y"y"y"y"y
"yxIy"y"yFy
"y"y"y"y"y"y"y"y"y"y"y9"y=cw
/s"y"ygy#yd9"y"yY"X#N*y.y"y)3y2y
y"i2y y"y"y"y"yRy&y"y"y"y2y"y2y"y"yBy"yby y"y"y"y"y"y"yry)"y
y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"yV
"y$y2y$y&y"y"y"y"
y"y.y"y"y"y"9F
"y,y"y"y"y"
Cy yby y2y"y"y"y"
Ay!"yry!"y4y"y"y"y"{G
Cy"yBy"y:y"y"y"y"9"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y
&y"v2fq2vi0 az"
y""y]q2RG
YV]8TM
y"}.'\q.H
3}"&yP%,0Zq.
"y0g!2P<E0a%.R
'qy"Tu
y2 zA"&zE"/s`m"byA"
y{'FvV}|R$+
Z*&:2*Q'F
F&Hy,4I
Fq1G&}.rQuy
uy"2<U.
H/u!y0g!
H,y!y0g%
iFW!!!y
*yJI2&
E_z"z}"
iFW-!y:
)ywz"Zu"pFV
u1"}*1|"&py<U6/
y"D!&<M
HyK.4c'~eTed"yW
Q)y{P<AI2Z
HyK.4c'~eP
Ed"yV1" 2W!
Q y:Ted"yW{
}"y"yy"'
yzwP8x"/g
PNP]&0a
}PNPa&0X|y8_~"a0"
Z\G&zlG&#y00X|/y
R,ydG&yy"*
dy:<'F
Z\G&z\G&)4%F
"J^yH<'Fr1
H"1HyNPq&00X7y&y
"y]2&v
92I"yF
92I"yF
92I"yF
92I"yF
92I"yF
92I"yF
92I"yF
192I"yF
592I"yF
)92I"yF
-92I"yF
!92I"yF
%92I"yF
82I"yF
82I"yF
82I"yF
82I"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y1i"y"y"y"y"yQy"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y@
Ay"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"yby"y"y`y}by-by"y"y`yQby"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"ycycycycycycy=cy"y"y)cy%cy
cyqcymcyYcyQcyMcy`y"y"ycycycycycycy=cy"y"y)cy%cy
cyqcymcyYcyQcyMcy`y"y8"
"y9"M
"yg7nKf5"ybibibibibibibip=n=nybibibibibibibibibibi"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y2y:y
y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y2y"y
y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"yd9"yBy"y"y"yByByByNWNy1yBy"yIy"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"yJ
-dYCYM
VYp-r7
Yc=m<a7g-a0f)p6n5v*p)"<n:qUp8
Yp-r7"y"
AYvYkUR
WYvYkyL
IWNyIKT
8o)l:FYQ
",v7g0"-
QYMPYJ
VUUYPYL
K"WWEv5
T"W"TI
QWg8n%m-c<o
*d.p%K
G^QG@G(EPyQPYA
G[QGDWWEM
Gya*f\~
"y"y"y"y(4A
Py"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"y"yfJr
h/.~7"y"yy"y"?4
CoCreateInstance
CLSIDFromString
CoInitialize
CoUninitialize
SysAllocString
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
ExitProcess
ExpandEnvironmentStringsA
GetCommandLineA
GetComputerNameA
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeThread
GetFileSize
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
CopyFileA
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
LoadLibraryA
LocalAlloc
LocalFree
OpenMutexA
CreateFileA
ReadFile
RtlUnwind
SetFilePointer
CreateMutexA
TerminateProcess
VirtualQuery
CreateProcessA
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
lstrlenA
lstrlenW
CreateThread
DeleteFileA
GetWindowTextA
GetWindowRect
FindWindowA
GetWindow
GetClassNameA
SetFocus
GetForegroundWindow
LoadCursorA
LoadIconA
SetTimer
RegisterClassA
MessageBoxA
GetMessageA
GetWindowLongA
SetWindowLongA
CreateDesktopA
SetThreadDesktop
GetThreadDesktop
TranslateMessage
DispatchMessageA
SendMessageA
PostQuitMessage
ShowWindow
CreateWindowExA
DestroyWindow
MoveWindow
DefWindowProcA
CallWindowProcA
GetStockObject
SetBkColor
SetTextColor
CreateBrushIndirect
CreateFontA
GetUserNameA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetSecurityInfo
SetSecurityInfo
SetEntriesInAclA
__GetMainArgs
_sleep
_stricmp
memcpy
memset
printf
signal
sprintf
sscanf
strcat
strchr
strncmp
vsprintf
ole32.DLL
OLEAUT32.DLL
WININET.DLL
KERNEL32.DLL
USER32.DLL
GDI32.DLL
ADVAPI32.DLL
CRTDLL.DLL
XJ]!10
BBBBBBBBBBBBBBBBBB
BBBBBBBBBBBBBBBBBB
BBBBBBBBBBBBBBBBBB
BBBBBBBBBBBBBBBBBB

Hosts

IP
114.114.114.114
8.8.8.8

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255
dns.msftncsi.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	53179	224.0.0.252	5355
192.168.56.101	49642	224.0.0.252	5355
192.168.56.101	137	192.168.56.255	137
192.168.56.101	61714	114.114.114.114	53
192.168.56.101	61714	8.8.8.8	53
192.168.56.101	56933	8.8.8.8	53
192.168.56.101	138	192.168.56.255	138
192.168.56.101	58485	114.114.114.114	53
192.168.56.101	58485	8.8.8.8	53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.

ALYac	GenPack:Generic.Malware.SYd!g.4FA6DABC
APEX	Malicious
AVG	Win32:Evo-gen [Susp]
Acronis	suspicious
Ad-Aware	GenPack:Generic.Malware.SYd!g.4FA6DABC
AhnLab-V3	Win-Trojan/Berbew.51712
Antiy-AVL	Trojan[Proxy]/Win32.Qukart.gen
Arcabit	GenPack:Generic.Malware.SYd!g.4FA6DABC
Avast	Win32:Evo-gen [Susp]
Avira	TR/Crypt.XDR.Gen
Baidu	Win32.Trojan-Spy.Quart.a
BitDefender	GenPack:Generic.Malware.SYd!g.4FA6DABC
CAT-QuickHeal	Worm.Dorkbot.A
ClamAV	Win.Trojan.Crypted-29
Comodo	Worm.Win32.Qukart.K@565w5t
CrowdStrike	win/malicious_confidence_100% (D)
Cybereason	malicious.71f7bb
Cylance	Unsafe
Cyren	W32/Berbew.WRHR-5462
DrWeb	Trojan.Siggen8.42234
ESET-NOD32	a variant of Win32/Spy.Qukart
Emsisoft	GenPack:Generic.Malware.SYd!g.4FA6DABC (B)
Endgame	malicious (high confidence)
F-Prot	W32/Berbew.A
F-Secure	Trojan.TR/Crypt.XDR.Gen
FireEye	Generic.mg.a3020c871f7bb5f8
Fortinet	W32/GenKryptik.BJQV!tr
GData	GenPack:Generic.Malware.SYd!g.4FA6DABC
Ikarus	Trojan-Spy.Win32.Qukart
Invincea	heuristic
Jiangmin	TrojanProxy.Qukart.ekpe
K7AntiVirus	Proxy-Program ( 003b8b111 )
K7GW	Proxy-Program ( 003b8b111 )
Kaspersky	Trojan-Proxy.Win32.Qukart.gen
MAX	malware (ai score=80)
McAfee	BackDoor-AXJ.gen
McAfee-GW-Edition	BehavesLike.Win32.Backdoor.dc
MicroWorld-eScan	GenPack:Generic.Malware.SYd!g.4FA6DABC
Microsoft	Backdoor:Win32/Berbew
NANO-Antivirus	Trojan.Win32.Qukart.fokxzm
Panda	Trj/Genetic.gen
Qihoo-360	HEUR/QVM19.1.D467.Malware.Gen
Rising	Spyware.Qukart!1.AE0A (CLASSIC)
SentinelOne	DFI - Malicious PE
Sophos	Mal/Padodor-A
Symantec	Backdoor.Berbew.F
TotalDefense	Win32/Webber.W
TrendMicro	BKDR_BERBEW.SMA
TrendMicro-HouseCall	BKDR_BERBEW.SMA
VBA32	BScope.Backdoor.Berbew

host	114.114.114.114
host	8.8.8.8