SmartHawk

1.2

低危

60 个模型检测该样本为恶意！

重新分析

下载样本

225a11cc12d48e09177ff68a37544116741bdfb25a7ed5eb79f070d664e45c37

225a11cc12d48e09177ff68a37544116741bdfb25a7ed5eb79f070d664e45c37.exe

分析耗时

195s

引擎	描述	特征	威胁分数	可能家族	检测耗时
DACN	基于动态分析和胶囊网络的可视化恶意软件检测	API调用、DLL以及注册表的修改情况	0.12	Unknown	0.06s
FACILE	利用改进的层次胶囊网络对二进制恶意软件图像进行识别分类	二进制图像映射为的灰度图像	1.00	Unknown	0.77s
IMCLNet	轻量化深度卷积网络模型实现恶意软件家族检测	原始二进制映射而成的可视化图像	0.81	Unknown	0.22s
MFGraph	利用静态特征构建图网络以检测恶意软件	原始二进制PE文件的静态特征节点	0.00	Unknown	0.00s

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	None	20190527	0.3.0.5
Avast	Win32:Evo-gen [Susp]	20200123	18.4.3895.0
Baidu	None	20190318	1.0.0.2
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0
Kingsoft	None	20200123	2013.8.14.323
McAfee	BackDoor-AXJ.gen	20200123	6.0.6.653
Tencent	None	20200123	1.0.0.1

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-07-11 11:39:59

PE Imphash

26babd76bbb7f9c516a338b0601b4c9f

Sections

Name	Virtual Address	Virtual Size	Size of Raw Data	Entropy
.text	0x00001000	0x0000b7d0	0x0000b7d0	7.201938076106342
.bss	0x0000d000	0x0001e81c	0x00000000	0.0
.data	0x0002c000	0x00003314	0x00003314	6.069632883466061
.idata	0x00030000	0x00001210	0x00001210	4.968075144922723
.ajelhf	0x00032000	0x00001000	0x00000200	2.270973069309488

Imports

Library wsock32.dll:

• 0x43039c WSAGetLastError

• 0x4303a0 WSAStartup

• 0x4303a4 __WSAFDIsSet

• 0x4303a8 accept

• 0x4303ac bind

• 0x4303b0 closesocket

• 0x4303b4 connect

• 0x4303b8 gethostbyname

• 0x4303bc htonl

• 0x4303c0 htons

• 0x4303c4 inet_addr

• 0x4303c8 ioctlsocket

• 0x4303cc listen

• 0x4303d0 recv

• 0x4303d4 select

• 0x4303d8 send

• 0x4303dc socket

Library ole32.DLL:

• 0x4303e8 CoCreateInstance

• 0x4303ec CLSIDFromString

• 0x4303f0 CoTaskMemFree

• 0x4303f4 CoInitialize

• 0x4303f8 CoUninitialize

Library OLEAUT32.DLL:

• 0x430404 SysAllocString

Library WININET.DLL:

• 0x430410 DeleteUrlCacheEntry

• 0x430414 FindFirstUrlCacheEntryA

• 0x430418 FindNextUrlCacheEntryA

Library KERNEL32.DLL:

• 0x430424 ExitProcess

• 0x430428 ExitThread

• 0x43042c ExpandEnvironmentStringsA

• 0x430430 FileTimeToLocalFileTime

• 0x430434 FileTimeToSystemTime

• 0x430438 FindClose

• 0x43043c FindFirstFileA

• 0x430440 FindNextFileA

• 0x430444 FreeLibrary

• 0x430448 GetCommandLineA

• 0x43044c GetCurrentProcessId

• 0x430450 GetCurrentThreadId

• 0x430454 GetExitCodeProcess

• 0x430458 GetExitCodeThread

• 0x43045c GetFileAttributesA

• 0x430460 GetFileSize

• 0x430464 GetFileTime

• 0x430468 GetLocalTime

• 0x43046c GetModuleFileNameA

• 0x430470 GetModuleHandleA

• 0x430474 CloseHandle

• 0x430478 GetProcAddress

• 0x43047c GetSystemDirectoryA

• 0x430480 GetTempPathA

• 0x430484 GetTickCount

• 0x430488 GetTimeZoneInformation

• 0x43048c GetVersion

• 0x430490 GetVersionExA

• 0x430494 GetWindowsDirectoryA

• 0x430498 GlobalMemoryStatus

• 0x43049c CopyFileA

• 0x4304a0 InterlockedIncrement

• 0x4304a4 IsBadReadPtr

• 0x4304a8 IsBadWritePtr

• 0x4304ac LoadLibraryA

• 0x4304b0 CreateDirectoryA

• 0x4304b4 LocalAlloc

• 0x4304b8 LocalFree

• 0x4304bc OpenFile

• 0x4304c0 OpenMutexA

• 0x4304c4 OpenProcess

• 0x4304c8 PeekNamedPipe

• 0x4304cc CreateFileA

• 0x4304d0 ReadFile

• 0x4304d4 RemoveDirectoryA

• 0x4304d8 RtlUnwind

• 0x4304dc SetFileAttributesA

• 0x4304e0 SetFilePointer

• 0x4304e4 CreateMutexA

• 0x4304e8 Sleep

• 0x4304ec TerminateProcess

• 0x4304f0 TerminateThread

• 0x4304f4 CreatePipe

• 0x4304f8 VirtualQuery

• 0x4304fc CreateProcessA

• 0x430500 WaitForSingleObject

• 0x430504 WideCharToMultiByte

• 0x430508 WinExec

• 0x43050c WriteFile

• 0x430510 lstrlenA

• 0x430514 lstrlenW

• 0x430518 CreateThread

• 0x43051c DeleteFileA

Library USER32.DLL:

• 0x430528 GetWindowTextA

• 0x43052c GetWindowRect

• 0x430530 FindWindowA

• 0x430534 GetWindow

• 0x430538 IsWindowVisible

• 0x43053c GetClassNameA

• 0x430540 GetForegroundWindow

• 0x430544 LoadCursorA

• 0x430548 SetTimer

• 0x43054c KillTimer

• 0x430550 RegisterClassA

• 0x430554 GetMessageA

• 0x430558 CreateDesktopA

• 0x43055c SetThreadDesktop

• 0x430560 GetThreadDesktop

• 0x430564 TranslateMessage

• 0x430568 DispatchMessageA

• 0x43056c SendMessageA

• 0x430570 CharUpperBuffA

• 0x430574 OemToCharA

• 0x430578 PostQuitMessage

• 0x43057c ShowWindow

• 0x430580 CreateWindowExA

• 0x430584 DestroyWindow

• 0x430588 DefWindowProcA

Library GDI32.DLL:

• 0x430594 GetStockObject

• 0x430598 DeleteObject

Library ADVAPI32.DLL:

• 0x4305a4 RegCreateKeyExA

• 0x4305a8 RegCloseKey

• 0x4305ac RegOpenKeyExA

• 0x4305b0 RegQueryValueExA

• 0x4305b4 RegSetValueExA

• 0x4305b8 GetSecurityInfo

• 0x4305bc SetSecurityInfo

• 0x4305c0 SetEntriesInAclA

Library CRTDLL.DLL:

• 0x4305cc _itoa

• 0x4305d0 __GetMainArgs

• 0x4305d4 _sleep

• 0x4305d8 _strcmpi

• 0x4305dc _stricmp

• 0x4305e0 atoi

• 0x4305e4 exit

• 0x4305e8 memcpy

• 0x4305ec memset

• 0x4305f0 raise

• 0x4305f4 rand

• 0x4305f8 signal

• 0x4305fc sprintf

• 0x430600 srand

• 0x430604 sscanf

• 0x430608 strcat

• 0x43060c strchr

• 0x430610 strncmp

L!This program cannot be run in DOS mode.
.idata
.ajelhf
CV9A24V)
lb_M^IUV\
|k<)isFi
j-!&IV)
UnRt_j
]TV)%^ wC
b!FCUV(
)kYYW)
V*r<)k>
~ZO9g",!
)))LV)Cgl
^bAaj(
)^bAaj(
eV|LFx 
bHao8?*
\ltd7Y
49Ph .
hp#`iB
^:Z'WV)C\
jP7jNR}Vv_
nh(h'0
R)k1VD
VRNV)Xh
j)-VjiVlhhb+
l\2hhly!k
)QjfWlj
V^4"yPV)
Vi^JV)'<+k<)W
V:IV)d
bkV)u(\Vh
ly!k
!Y\V)gb)
>VvMV)%Z&d
L9g"YKh
=CV&lyi1k
QjnVl&
QjnVl&%R)
9g&I+
VjiVl&W)
b])9W"
QjfWfV)\
VAYV)7)
TbkV)t/
D=F8Thh
CVt>VDV)%FA!
yVv_(|
))iW)t
\S\f~tV)
VZC|rV)CxV)
V)CV)D
hu%LUVh}
\CUV9&iQ)
V1hIC
V)9g"ljVD
)<)k\
jV)"6
Qlyk
eR i}jVD
lh(h)d
R iYjVD
lh(h)d
p/Vha
~V)iW)
VIVb-l`HVC
b-lVAV)d
SgV)k>Vy
yob%<
"7k>VIY
=V\ji}W|09T
^bAaj(
hhmh5
Vj#!pyTh(h
}V)CYG
&TE^yd
'U)i[k
'<)i}i
)k<)k<)k>)
P$tl'R/
`-V&yklyZ
P$l'R/
DDYT?}
YC<)yD
~\06`lV
A>Y)k\
#9~vV)RvV)%)
V^=u&Vh
kV&LT)
ftV)iV(
h|9V]AT
"uV)'l'k
uV)'llR[`vV '
TY'V)\
rrV)yW
*{*yiV)Ql
!"8k<(i
VsV)&KW
Vxbi^"
)k>!V4
RC<-Fyy)
)k<#y^qV
v_Th!W)W)
QT~jV)d
eS)RC<)QlyV
S-V~7)
Vj#!l%C`IyV
8k<!i.k
`$VDl'
&:YWYOY !
w}bC0!
TfV)g)
V).iV)
Vj#!RAT`9V
yR"gV)
!BWd=VzIThU
yRRdV)0!
Vzb9#zBa-h
^zb!0!
0#|RB +k
XhRRB#!
1E\|F)
v_ThxW\
"!^NbV)Z)u_
V&bV)RCO
S-V&f)
ZzWwW'
b!#|a(i
<)k>Vw
V)k<(k)V
N&@EV)
bAYD?V)S
VbV)"0
^zsnVh
VfdV)%Z
)CV_@V")
bsV)@V$
a[ViT)
@/@NV)T)
V))g $n
V))W $n
SV4@.@W,~
YV)it,
P\MbS|V+T#
ho]V&"@
,tT#.T@R
bs|V)GjC|V
hoT@)C9V
i0)_ThxW',H
V)Dl>)
tEl<({()
#k<)k</rV)"%h
>?VDlj
@4V)^|
V\5m6k
V\)m6k
ixV&B=
V!l=SK
V=T\dhaP+t
T=T\Ph
FES(b-
WR/="'<V)
V)tIvVT}
l@V_@ol&kR6HEW
u$V:V)R
VV)<V)Q
=lZ$o)
T=T@V&{R)
V)s<V)s
TUdjZ8mC
V)sV,!
!YaV)^)
Y=V)W)
~b+V\h
V)t-4V)
BYB +]C
=S9wVV)&^B
!j!B=B_@W\
=S=wV)
!j!B5B_@YlVD
!j!B=F_@V]
=S=wV(
=S=wV)
Z~^O^R
b%yk<)i
qB`f"V
##S=wV)u,!
5F_@5mV
%F_@Vn
`ROV4k
c1VV)NC
rzWge<
<9yRC!jVAV)RCqjVD
##S=wV)ueV)g
lj3BOC5wV
)CdbAaj(
0DYD^U
0DYD^
hO&=y\
V)uYDym1
}hQlc 
fvV)C<);)
#2^&Zy'<)s>)
XVNV)Cl
=V\h6V)
Qly3:)
iV|*^uh(h1Q)
XVV)9W".
uSO&&t
o}:0DV)YDY
WyiFk
ly_b%<
Fa(=y)
lyb1&0|
0DYD
V)u<(i
"YDkV]blWA5
eSyb%&
lljk81*l
V)u<(iCk
lyb%eS
#>iuW)
ly^V)%ZDYA
XVNV)9
ah=bAaj(
=l\9\<
=V\l*
T2V)^F(9g&
y^qY\V
h<bAaj(
Vj+!RFV)d
N~V)<q)
)k<)7)
ly^q]]VI
'vp"Yg
)C<)K7)
tDV)uMV)uGV)
)t<(ik
S6V)k>VA
k>ZVm
~V)9g"\l
@:V)<q)
lyb%&
=*-=(/F+}
yKhKa)
=V\VyWj
ll^_'.
t4h`d)
QVA>Y)k<)k\
h(hbAaj(
^LVjrVh
kYWVbAaj(
<-k<)iV)
&<+k<)W
&<)Z)ul
hD)iW)t
V)kl<+i
+(h(h&&S
T#-+9g"DT#Z&TD
V&&#WlY
V)ETlcwV
V)ED7)
V)D)lj
bitlYB
bi|lDs)
V)<aV)
;Ctl#(.s
V)tlYD
qSsV,$i
V9AAQ8hVCBCX
~ZOZ5"9
kR/=$<=!8^(Y
"<!iqV)
bkV)tgT)
:C}=<k
V)k<)9U,
V)9UljCV
)8[@Cl
s8PVD9PV|9Yh&3
Vi^&V)|
~:\aX`bV<k
BC>i9VCA
IV&@W)
jC!V}R)uYD?!V)^C]
qIVO&*^C
bs!V)^(|
#,)<lV!l
l'R.]lJV&
2V)%ZGlV
laj.]^&
Vv_Th~7]
&>i9VC
c!V&V)k<(kGVS
cV.V)&
cVV)'bV)&mV)
&l<)h"v(
C?!V)^Cm
l',/a
IVSV)k
`j>Vv_(|
<)QLC\
<)QLC\
<)QFC\
<+k<*iV)Al
\1FCmEVC
WC=EVC
#+<)yV\
lbt>9VV)k
%AVv_ThW)_h)
~cLCY0
K>VBV7Z>lVBV
V)Z)t>V
u?VMb+%
%1?Vv)
YhYB,>VQCV09d
VQI>VC
Vj+!RRV)
Vzx&lV)
?V).0!0
vV)#0Tj
`4VO& 
.yzV]ohiQC
k<(ku8VGV)k<)yi)
<9yRV)
`V)R"V)
,Ce=VC
V)k>QV
kV]WAy
V)u<(ik
y?b%eS)
bEY%V)R)
pQY.V)~kmD
V)<zU
pRYrV)
V)u</ik
!Zygj)
>9VV)k
YPV)\S
#&k<)R
Cb,QVz=b%
Cb,QTzqb%
_u!Jyik
>9V:V)k
5VV)\R
h(hv_ThT)
_tg%V)
'<)yk<)k^
kl<)k<)FBV)
'TYV)0:
r#R)Th
Vj#!Fv
VV)89%,0!
Vj#!){h
)k<)+d)
)^VV)a)
V)%^ aA
&</ihk
!YV)tV
!Pye)
V\+"CE0VC
nzWB1qV)
hAV)k>9VV)%ZyV)
)Q@A<)k
.Vys{)
~To``.VD
NV)]e)
V))kll
ZV)kll
lhDMl&
ll<)k<
-VtE1-V
hw*Vw*Vw*V@
#%^0V)%Nv\"
Z~V8Gh
T)k<)k\
#1Bt<)Ft
A/V Zt
Vj#=NON
lh&Nv_(|
yW$yV))
(Vy#z)
<)k<)i
w"a"OP)
h|mm$t(
4nm)tWT
m)tIaj*
&&mXL)
 *bHVj+VzC
JV)%BO&
$v_Th=T)Sp)
~(q@h(h
V~k9)V
&7~\V)
Qjyik
1?]{a.(q"yV]o
'<)k<+k<)iV)A
h(hzKr)
`tiVv_ThW)
h&yiok
llS[VA:
^9Yb(d
USUWkt
`WVYV)
V/`u?V
>UVFV)"_t>
VvV)d=
WS[]`VQ
)u>)V>V)iW)
QVV)'g
b%^b,Q
Z&ESiQ
)k<)v)
ZbV)0!
g`&cV]I)
V)%^t\
k<)k<)k>)
VAh(hC
&EV)d
>UV*V)'_t>
WbS[&W)
V_t>VV)|
Z>V)UF{k5
lhv_ThxQ
~2E@`W
WUsb9t\
lhxVV)<)
Vs>VrV)iOk
#%^^V)sVh
V)P(zS
bVD|VV)l
VV)k<)kl
bSV!C,!
Jk<)iMk
YV)k>V
))iW)t
&T~k>V
"V)"2c
 6(+Xhn:\
V)%BBV-
*V)f,)
!SyC@)
bSV!C,!
V)%F+u)
`3.Vv_
)k<)7D)
Vv#F)ThW)
&<(yyib%'}
)|s.Vh
w#F)ThW)
Hkh(hh
V)C^$uk
V)C^$uk
Q\C>$VA
k\C>VAj
%N]%>#VA
bSV!C,!
bSV!C,!
VkV~i%k
)k<)7[)
Vv#F)ThxV^
`YVAAV
VzWwdL(
V)9W"<)d
-6b@aoos?,!
b(S>VV)%Z
=V\l*.
b(S>VV)%Z
=V\l*.
=V\l*.
=V\l*.
 6(+"7y
'>)~VC
)k<)k<(iV)V)
+C>VV)ik
jV)&0<Mk
`ZVVV)&0<Ik
QC>VA
NV)k<)k<)
'A>9&VA
'A>&VA,V)
)`oV4Qk
r"V$}Uj
Vl](hn
OE^r-Ej
LLL,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,Lz
s~,L,L(L,$LBvLQL,L,L,L,LJ*_(_*,LO}J
<L.L,L,L,L,L,L,Lt/L,L}O,L}O}O,LdnLdnLdnLdnLoLoLiLiLdnLdnLdnLdnLoLoLiLPhLdnLdnLdnLdnLoLoLiLiLdnLdnLdnLdnLoLoLiLiLdnLdnLdnLdnLoLoLoLiLdnLdnLdnLdnLoLoLoLiLdnLdnLdnLdnLoLoLoLiLdnLdnLdnLdnLoLoLoLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLdnLdnLoLoLWoLhL
hLhLoLhLiLiLiLiLoLoLoLoLoLoLoLoLoLoLoLoLoLoLoLoLhLhLhLhLdnLdnLdnLdnLdnLdnLdnLdnLdnLdnLdnLdnLiLiLiLiLiLiLiLiLiLiLhLiLiLiLiLiL
hLiLiLiLiLoL
hLiLiLiLiLiLiLoLoLoLoLoLoLoLoL
hLhLhL/hLiLdnLdnLhLhL=hLiL/hLiLiLznLiLiLdnLdnLdnLdnLoLoLiLiLdnLdnLdnLdnLdnLdnLdnLdnLoLoLoLoLoLoLoLoL
hLhLoLiLiLiLiL
oLIhL+oL+oLiLiLoLoLiLiLiLiLiLiLdnLdnLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiLiL~
@"X"O(
>BLX"M
a<E;J)X#,8bM9x
,L,L,L,L,L,L,L,L,L,L,L,L,
XN.3X;Phh\
@<}lLRTnMA
p8<j}OL3F
j'Gp8M[GD-MX$D
M-K-MY.N
Un490$98(9P\D
N.;?NM-9\D
N.;Phh\
TL,L,L,L,LX9^_)e*^-E",L,L,L,L,L,L,L,L,LI"@~H ,"H H ,L,LSLL-I$FB(@(@L,L_/b@L,'^)b@L,)B 
(@LY)b@L,L_>
(@L,'^)b@L,/O<,L,L,L,8BL,L,L,L,%X-|#I8,L,)o>I8^/_
,%H%H;,L,L,)H)_+mL,L,?M
^L,L,)B 
#B/E"I8N%D(&Fa
/L(LOLL,LlL,L,L,L,L,L,L,L,LL",
El^+MlM"X.
L,L|L`J
B'N,L,L,LL,L,L,L,L,L-L,L(L,L,L,L,L.L,\,L,\,L,L<L,LdL,LL,L,L,L,L,L,L,LL,LxL,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L
L,L,L,L,L
(XLxL,LxL,L,L,L,L
-MLL,LL,L,L,L,LlLB
(XLL,LL,L,L,L,LLLB
)CLL,LL,L,L,L,L
(XLdL,LdL,L,L,L,L
L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L
`HumJ,8hh,LA
h\FN$<\
hXZ;@1h@
SH?I,L
DulJ,C
_$3}#4,Z30
Ay9z 9
,<O9D#,L`
jL|<P,X
jLt|! LH,E}X&{X,F$;q
\\,+*L
,LsLy9
v,LoI,9
q@Q,LX9IUK
pix9IUK
|}YL_)L
(L,EBY
q,Lj(LtD
yL?0p,L,
yH9L,L,
+aG99u9jO
B,a5|OA
)LLI,3C,ZS
N}sa5|OA3,G
5y,99:LS
,a5|OA-hAsV:
N}sMZs(L:ILS
N}seZs}ZsMZs$ 
\,M3(L
J,99u9BO
}9jL[U,q@LheZsO/L
,OnOjLha5|OAsZ,6"Lu92O
}999u9*O
,a5|OAC,qLha5|OAs
,BWLu9
0U,1tL:LS
N}si[Lq,G
}9u9:O
,A~LheZsXLu92O
,a5|OADOL,=
,a5|OA
hAs,ALha5|OA
}99:5LS
N}seZsAL[,$(Lu9
,a5|OA
N,99:sLS
N}sMZs
OWM,3hMZs}ZseZsAjLheZsAL"A,G
k],999
0,a5|OA-hA
Z`,999
,9u9O
KL|iphhJ1@,
bPOA|ipt[h
,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L-L-L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,LdL,L,L,L,L,L
L[>,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,LM/I+E'A#p
K ,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L\L,L,LxLLL,L,LLL,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L
LxL\LLLLLL,L,LLLLL$L8L
LdL,L,L
LxL\LLLLLL,L,LLLLL$L8L
X9^"x>M
X"E#A"
>B?,L7
C)M(IL
X5X!E)X>mLy
X%G#BL
\"C*M(IL!*@?,L
I%,Lb!@#,Lw<E8,LL>E)K?X9,LC?M(]?^-,LY?^<,Lg
,L,L,L,L,L,L,L,L,L,Lo
`b`L8L8L8L8L8L8L8L8L8L8L8L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L
L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,LpL
J>R,L L,L,L
LH$@<X4P
,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L
L-L-L-L
LH H dL
L,Ls%a%l~,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L-M-a
w},8P},L*]L^L:^L
L*L(LRL-Q
,L,L,L,L,L9,LMLILML\LMLYLYLYLILOLCLIL,L,L_i,
O#C8exD8
c[bE>_*
)MqI)^$M#X.M'I+
%Y _bCcO(X8D8
<@+\<D8
(Xip?I)EL@:,#
*[>,"@~H8
H}E$Aip8Ti
-,9HL_c
#,?O!M(\*p!
4,?O(\*
L,)E8^)Z/|#I?G>I
/E8J"X#
7I*\>BbC-E"
Li>AL_9
O#C8e8^)
I<C)I),-DJ;^
8\X<n#_
E>_*p%H;p9^"z>E"i<C)p>[)I
C-y)c*E)
*[>p%^?J
X>IlI8B?
O#C8{"C?o>I8I?C
8E+p#I
5InY!XlM9
~r_>\rY/E"];
(O!Bb^}_.Ed
~lO%Bn_lI$Hnc
bXL_/O.E(Y),#A"
4,-LlE ,%@(,>O?
<OL\/!LT8&i
iF|#I?
C)_~E?,>M)C I<
||<!L,L,~
)@lM#Cm&i
|Ei!LC-
L_LIlZ"
*[>p%^?J
^%BI I:O
F/h U#H
M8I8x>M%K#ILohip"^/I:^~
@#A(~=I8&>K-
#O/IFC8BaU)
)X$AA!px
vn#_>_"
-J>IlI9_Lx
#BA|-AvBaM$!
B)X8\vX4
lC8M)h@#YlM H
xFiLM$
A!LilX<
L,M-M-LvL,Lj>
+I8|l_LC!Y+_lM?C(,?
#A9K?,
O#C8e8^)
ELILY#Y+_Lc
^)X)_#p4@>^
X"A-D(M?C(,
X>IlT ^>|8^
I8e?M/,?C)
L,L,L,L&
O#C8e8^)
4@>^L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,L,Lh
`]6U}|7
`]6UE{
,L,LB,L,
WSAGetLastError
WSAStartup
__WSAFDIsSet
accept
closesocket
connect
gethostbyname
inet_addr
ioctlsocket
listen
select
socket
CoCreateInstance
CLSIDFromString
CoTaskMemFree
CoInitialize
CoUninitialize
SysAllocString
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
ExitProcess
ExitThread
ExpandEnvironmentStringsA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetCommandLineA
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeProcess
GetExitCodeThread
GetFileAttributesA
GetFileSize
GetFileTime
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetTimeZoneInformation
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
CopyFileA
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
LoadLibraryA
CreateDirectoryA
LocalAlloc
LocalFree
OpenFile
OpenMutexA
OpenProcess
PeekNamedPipe
CreateFileA
ReadFile
RemoveDirectoryA
RtlUnwind
SetFileAttributesA
SetFilePointer
CreateMutexA
TerminateProcess
TerminateThread
CreatePipe
VirtualQuery
CreateProcessA
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
lstrlenA
lstrlenW
CreateThread
DeleteFileA
GetWindowTextA
GetWindowRect
FindWindowA
GetWindow
IsWindowVisible
GetClassNameA
GetForegroundWindow
LoadCursorA
SetTimer
KillTimer
RegisterClassA
GetMessageA
CreateDesktopA
SetThreadDesktop
GetThreadDesktop
TranslateMessage
DispatchMessageA
SendMessageA
CharUpperBuffA
OemToCharA
PostQuitMessage
ShowWindow
CreateWindowExA
DestroyWindow
DefWindowProcA
GetStockObject
DeleteObject
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetSecurityInfo
SetSecurityInfo
SetEntriesInAclA
__GetMainArgs
_sleep
_strcmpi
_stricmp
memcpy
memset
signal
sprintf
sscanf
strcat
strchr
strncmp
wsock32.dll
ole32.DLL
OLEAUT32.DLL
WININET.DLL
KERNEL32.DLL
USER32.DLL
GDI32.DLL
ADVAPI32.DLL
CRTDLL.DLL
X!5PU10
L!This program cannot be run in DOS mode.
.idata
.ajelhf
LZ;b/;
j7O&gn"(
CL~D\~Y
:X;a.D\CdXN
MXEPoT@
Mhd7JSq+lI
;{(0ki
6D\p0B
"?l\p;nty
"X;i:D\
i:7YD\^\^\]9;
CL#~)C
\Ee]nKkU
M[P~{z>w
SPImQG7
;9C~m 
;9C~mdX
j/<<Lc
SX;P!~G7E
fImU~dX
;p;l\r
hPo3l\p;d;
D`[OU
MsTFu]<;+
_V4ND\
U4~UNZ
b7Ee]n
X;V*PT
4-D\V)
\o7yD\
Z?V"Q@~g
NW4D\r?
D\J6L3
Ee]nKkU
MdWb@Ka
\l^p;l\L
\ImQtW
JSX;J>
\n'JS[;6397
kJ6L'/
V4D\V"
V"Qd~U4
nJSX;jJ>
\n7J6L3}-
mEe]npny
\ok~4C
4D\p;l\r&
ImQG7&G.o=
\>X;cD
kl\p;)
;YD\7;
;fp;~J
\V6sqQ
4D\V&a
;suBmZ
;rBp:ny
k,7;^
MsT)O]
\V4D\V
>X;YD\+F
Cl\r,-
D\Ee]n6
CYD\p;l\p?l\p;n\
CJsLs\
>X;l\~
m_V4%;
C1~ae:
Nu6mD;
{INMgr)_C
;YD\~w_;
;!;sH~_
~Jp;iFG\p;)
~O/HS1n
Cp:V6*s\
rMp;l]r
4^D\rs
SRX;n]
SBX;ny
SX;nFy
ESjQ}5D
F\p_n:;
_7@C~\8
D\p;lV~
;7Z;d\
<PX<b;
;Mp;lTr
mdXnM_RI.3
_7Vo3V377Y
D\EE_orC
D\/l]L}
m{>~Z7\;
b2SeBSmCS
WT/7Z?
m*37Ee]n
p;l\V6
\ImQG3
\@FXoIY
h3hqYx
N$B_!?z~
9rNp<U[
4'Y^G;Fw
ZCFqd<
\(UoC{
C#~ BD^;)
D\@>\n6a&F\
;777!;
]GVmCl
m6qT\
fk+bQZ
fk+bQ\
N63B\
Cll\p9ny
j\xbu?
\p;l]p9\;
;`_3`D\>
{F\p;l\
>[;Z>[;UI
\>X;YG\
YD\>[;j
;YD\>[;
UG\0y[|y
#Z"JD\6[;F'
;YD\>[;FS
o=YFG\
^x!?sx6[;:
CFYo6!;s[>![;
IG\>![;gz
.![;\?
[;?YFG\hYD\/;p
4D\Uz\
SX;PyG
_>X;nHy
9;9;YD\^\/9;
sp;l\p?lZNiE
>CKc}VK$;
CJCJsp;
o3l.[;/q
G7YD\+
NXS~74X
RO:?/
RO:?/
\o#<m;
:IFG\+
..X;(7Y
QtD\K^h
.[;>X;
\!pVIN
)ASX;i;
\o-X/:
\o%`'8
\o1`'>
;t>X;r
MCT|CT
7/x+p
*[;,w;
MG\Uu\
\n^YD\~
*[;@v;
MG\=j\
;l\r+p
4YG\Jc7
;|[^\;d
CJCJ3Xy
#S~7/`+p
:F8o*PyQ
S~7/h+p
S~7/X+p
S(ImQo+6T[
_~\>X;
kd7?o>
:nS~&=))
CJsHh\
\/YD\L
EP;\Ee]nW
YD\7`;
\>X;l\Ek\
;r['}!\
b+(@F&:
\>X;`r;
Z7V=CQ
:~S~gG
:~S~S?f`_
:~S~gGS
4JSX;J
Nm:`_}
{V4D\V
]|S=n4
;rm|C|
\n^l]r
;sYD\p5J
\n%l]r
rY){o,n
4_F\p;l\-g\
\ImQ<\&
\>X;l\g\
UO,eI$g)
FPJX__3
FPJ(__3
\o&l]rM
_+`_+{~Z
Ll`_cR\
*[\AZ\
SPImQo/AsK0
\p;l\p;)
N_)ml]p;)
C~s-\\
;ZU]eY
;lXp;l\r;
l^p;l\LS
Ee]nKkU
iUo7Pm
\Ee]n6
!9sXV^71:!;s~
=;o,E_
:V~]F[h
Z&KtI&DqM~
K3L/lTr
SlImQ\vX7H;
jX;-H'S
YD\#~.
8C.X;7LX2
D\6X;P y
X;QD\7<g
_VoUoW;
S~&<))
MSVX;Q)u
\p=l]p9\;
D\^\'\
CJCJ3y
kl\s&]
D\JSZ;l\p;hP;
SJX;o::
Llm%EB\
4PD\V`
;;ep:JCT
sPV4_D\VMq
N,4!D\A\
nxJS#X;J
S=X;l\;
;l^p;l_r;
O3n1F\
s^)l\~
snp:JCPZk7a-
F\n-l\N
;l\JSX;o98\
\p;V4D\F
\VSVSVSVS
4vmj-qMSX;M
SX;|%;
g3k-=\
k!7g44
CG6@5N2:4
:vS~UDm
;g5N)a:
8hJSX;J
97Ee]n
p=l]p9
\p+l\~
\p:n$y
;k`#;;
\n%l]rM
D]aYlB|
;y}'kQ
UiR(FD+aH~R
;yL'hR
\nWlZrO
;l\JSoX;o50\
+)@Z0oj
?;sSp;l\I
;l\JS=X;o2\
4!D\1\
u4TD\1\
4YD\1\
45D\)1\
;l\JS'X;o4\
m Ee]nKkU
_Vm?`(;
p;l\p;+
;!;s{p;
kl\p;l\L
\#uY+F!
MsT"y`u;W\
p;P4}F\p;l\4\
\7JSX;
)0SrX;0+;
\p;nLz
!1sMLOw
Z;l\p;5;
CJ3V_VA
kl\p;l|p:l\p;aG\
MsT_4ul31;
P~dXnM$b&
\p:Vo/)
GSlaz:Q
CHJsLN
\p;l\p;)
e_si+FWw];
;l\p;l\r
M[Tavitug7
HsLm+\
=\o R:_
_7F.__7V
GSxImQG3
!3Q6ZCu
@gotN&;
=M{MS*X;QQ
:~S~g_t~
sLN"4D\r
8gHtw]\
\Q46D\
o(`~]jOrb9
(tsHrb
T/l\p;l^p;l\r;
4!D\rv
\V4D\r
\n1n\;
)^~:sT&\
:no7:;
p;P43F\p;l\!&\
\ImQG31U::
kJSkX;
\+F|Sx;
p;l\p9l\p;n\
Llmq_<\
\V4D\r
kl\p;l|p;l\p;JQ
 hLoV)
\Kl\)b
rZgof`
\p;l\p;
X;YD\O{
;?p;l\r
S[;JSX;
\7l\VF
~7|61\
S;QG\
V4hD\V,
X;YD\ny
4]D\V-
SX;JOM
;SjQche'
F\p;l\
mQ;gx;
P-iD\g*
4;D\r!
)3mtb_
p;)SX;n
2(>mnVy
X;YD\~;
\Llj_>\
X;YD\%C
\7lcr;r
xSQSQSQ
\n*YD\
4D\V}+
\V4D\D
4F\p;l\
MEBio3
4=F\rIN
4ZF\r{qG
SZ;l\p;
3yD\>X;nX
4X-5?1
~>?hYD\
]o5/)jn
5JSX;ny
;YD\~FG\~V
C/n\e;
\>X;&_
;YD\p;iFG\p;l\p:l]r;
SX;l\p;
;JSX;ny
S>X;Vu2
;i4D\r
\p;l\p;l\
SwZ;nL=;
SwZ;n=2
iD\1t;
2(|nl\
Y{{Ey{Y;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{4{
IYx;{Sx;{
|;{p;{";{ 
;{Yx;{Yx;{Yx;{Xx;{8
;Yh;{Yz;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{{;{Zx;{
Ix;{:{{:{{:{{:{{z;{{z;{{
={{:{{:{{:{{:{{z;{{z;{{
={{<{{:{{:{{:{{:{{z;{{z;{{
={{:{{:{{:{{:{{z;{{z;{{
={{:{{:{{:{{:{{z;{{z;{{
={{:{{:{{:{{:{{z;{{z;{{
={{:{{:{{:{{:{{z;{{z;{{
={{:{{:{{:{{:{{z;{{z;{{
={{:{{:{{
;{{;{{X<{{<{{
;{{`<{{
;{{`<{{
<{{`<{{`<{{:{{:{{:{{:{{:{{:{{:{{:{{:{{:{{:{{:{{
={{-<{{
={{<{{<{{<{{<{{
;{{<{{
;{{<{{<{{<{{<{{<{{<{{<{{<{{`<{{`<{{<{{
={{:{{:{{`<{{
<{{<{{
={{<{{
={{:{{
={{:{{:{{:{{:{{
={{:{{:{{:{{:{{:{{:{{:{{:{{
;{{<{{<{{-<{{
={{;{{<{{;{{;{{
={{J;{{J;{{
={{:{{:{{L={{L={{L={{L={{
={{L={{L={{L={{L={{L={{L={{L={{L={{L={{L={{L={{L={{L={{L={{L={{L={{
={{L={{j={{L={{
={{L={{j={{L={{
={{L={{L={{L={{L={{L={{L={{L={{L={{L={{
={{j={{L={{L={{L={{L={{L={{L={{L={{
+~)Yx;{
x_{<xM{0xX{<xg{)xS{ xH{0xX{8xW{4x^{4xT{+xB{Yxx)
}G_QO_]'_
Ifw<w
3m\y[z9
g}O_]G_Q&h;8${Y
]zx?dy:zX
Q={Yx;[y=Z
?.s0pR
p8~sdy:zX
:zXyO|dy:zX
}|g}s%7$p'}|G}9y[z
Ls%7$p'}|G}9y[zg}O_]G_Q&p;
O{Yx;{Yx;{Yx;{Yx;{
Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{2
Yx;{Yx;{y{
y{Yy8~^p2qR
;{Yx;{.
W{Yx;{,
Yx;{Yx;{Yx;{YxS
H{Yx;{Yx;{Yx;{Yxm
Yx;{Yx|
x;{Yx;{Yxh
<9;{Yx;{Yxr
;{Yx;{YxP
{Yx;{Y0o/
^Tr6qY5aY{;{Y|;{Y{Y;{Yx;{Y8;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Y;{Yv$WxrYz
T<V6vS\;{Yx;{Y(~{Y4:}YV
x;{Yx;{Y;uxs:ynx1{Yx7{Yx;{Y*{Yx+{Yx
{Yx;{Ix+{Yx9{Yy;{Yx;{Y|;{Yx;{YxK{Yx?{Yx;{Yz;{Yx;kYx+{Yx;kYx+{Yx;{Yh;{Yx[{Y0;{Yx{{Y9{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yxk{Y;{Yx
{Y,;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{YVO
;{YP2{Yx+{YP2{Yx?{Yx;{Yx;{Yx;{YX;{9VI8
Z{Y,;{Yx
{Y,;{Yx5{Yx;{Yx;{Yx;{YX;{
;{Y;{Yx
{Y;{Yx+{Yx;{Yx;{Yx;{Y8;{VR8
Z{Y9{Yx{{Y9{Yx){Yx;{Yx;{Yx;{Y
X{Y;{Yxk{Y;{Yx#{Yx;{Yx;{Yx;{YX;{[V^8
Z{Y0;{Yx[{Y0;{Yx!{Yx;{Yx;{Yx;{YX;{
x;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{YI;4
9?}Yx;
_Qo_I9Zx;{+m,<k
{Yx;];{Yx?}X#QKw
ww_Qsw
-Q{3xSIx+,p
-&U~s8?}Yx;t;{Y~=+
7"pwYx;U
$.n2h>;Y
KYh.9aH;k:?eH;k
/jMx;{E{KYhNaH;k
t2-PCO
R\|Yx]%d%
{Yx_x;,h
#UxzYx;-
7,3xQ={Y~3xQ={Y~3xQ={Y~1f
{IN={Y3KYhSgix+,_x;]H;k1d
{IN={YKt
Y/_x;pFUH;kPOk3xl~;{
/>x;{Y~Yx%
fYx;{d
|ECGDx;{YxN
<D{Yx;$
kix+$;
]I/f,hbz
|$GDx;{YEOK
FYx;{|={Ys=
-EkGDx;{YxN-
]m;{Yx;{YxzYx;$
_,};{1<{YP~YxQ
NYxpB{Y
H;k3xSzYg;p|;{
2V{Yxh
8{YbZx;
L{YR{;{
mQx;v;{
yYxB;{
bYxm ;{p{Y
9{Y|FYx
vWYx9g;{
Yx;,_x;*
$yYxhp
wYxA;{
Q&x;F{Y
{Y x;|;{
(yYxX'N{Y
zYxIzJR>]{YR7{YvYx
r*YxA;{
];{3yX
Ix;yII
'e 7{Y(G}?_V
w}x9u\bx(G} 
t{Z{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yy;{Yy;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Y0({Ix;{Yx;{Yx;{Yx;{Yx;{Y]H{Y
Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Y
Y$;>7^
Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Y
{{Yx;{Yx;{Y,y{Y{{Y{{Yx;{Yx;{Yy{Y{{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{YTz{YDz{Y,z{Y
z{Yz{Yz{Yz{Yz{Yz{Yx;{Yx;{Yz{Yz{Yz{Yz{Ypy{Yly{YXy{YPy{YLy{YDy{Y0y{Yx;{Yx;{YTz{YDz{Y,z{Y
z{Yz{Yz{Yz{Yz{Yz{Yx;{Yx;{Yz{Yz{Yz{Yz{Ypy{Yly{YXy{YPy{YLy{YDy{Y0y{Yx;{Y;>!
;{Y;<<
_2=x;{Y;<<
x;{Yc;85
;{YG:<<
 9;{Y-:<<
O{Y:4)
x;{Yv9)-
UY9,0
;{Y;$?
;{Y7:$6
<x;{YA;$:
-x;{Y69
:x;{Y#9
 x;{Y3~)
x;{Yx{{Ix{{Ix{{Ix{{Ix{{Ix{{Ix{{Ix{{Ix{{I;i/
4w{Yl{{Il{{Il{{Il{{Il{{Il{{Il{{Il{{Il{{Il{{Il{{Ix;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{YX;{Yx;{YX;{Yx+{Yx!{Yx
{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx+{Y$;{YS
{Yt;{Yx
{Yx{{YH;{Y
kx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{YV
x;{YP[{Yy;{Yy;{Yy;{YH[{YL[{Y@[{Y
Y0({YD[{Yx;{Y'w
IYx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx:{Xx:{Xy;zYy>V1
{{ILHL!;{Y~:{Y|;{;{
}Y;{MK;{
x;{7x;{#x;{
x;{x;{
X{Yx;{Yx;{|
^iJ_{;
?~7Y]H':
+8^{|
7WHkVM
]H{(xi
=z?gDo2
4~EeWs>
-$r>y+^
Khxh4,l:
5wEY]H
^F~]H\y
^*]N\gDY
^F~]H\gDY
gu1{!1~+6\O
5wEe0~:
,w>g]H^,D
7h/{XU
VJ{F;U1
Tr;^*]
#y]HvSxu[y(r?yX
=6qY(I
Tr;IhM
cXwCTr;IjH
+t7PvSx
LDTr;IlH
6u1{ux1{Tx
PZTr;^*]H'Y]X
[y]R[|
^*u1{-
IoXkV6
*b[)u1{lH
{XXvSx
Tr;NlH
+t=6qY]H^*x
W{Y;w(
<g^*$r
IY]H'|
WvSu1G
,v7gDs>
=z?gDy4
5wEe0~:
,w>g=I
3;qSxs/
JY]H[|
 U;vSu1{
{\x;zXy:zXy:{Y";{Yx;{Y>T
-xh4,l:
Lixl5<
I*xv+
f[~]H\Y#
YB;AvW;27
y]cAY]H[7i6
]c{/xZ{5xN{<x;{Tr;60
{hxx{x
{ixz{ixx{`x
{`xF{Yx
:bkKj;YpkKj;Yp~<
5jt;Yx;{Yx;{x;{Yx;=8n7jF;
WSAGetLastError
WSAStartup
__WSAFDIsSet
accept
closesocket
connect
gethostbyname
inet_addr
ioctlsocket
listen
select
socket
CoCreateInstance
CLSIDFromString
CoTaskMemFree
CoInitialize
CoUninitialize
SysAllocString
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
ExitProcess
ExitThread
ExpandEnvironmentStringsA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetCommandLineA
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeProcess
GetExitCodeThread
GetFileAttributesA
GetFileSize
GetFileTime
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetTimeZoneInformation
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
CopyFileA
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
LoadLibraryA
CreateDirectoryA
LocalAlloc
LocalFree
OpenFile
OpenMutexA
OpenProcess
PeekNamedPipe
CreateFileA
ReadFile
RemoveDirectoryA
RtlUnwind
SetFileAttributesA
SetFilePointer
CreateMutexA
TerminateProcess
TerminateThread
CreatePipe
VirtualQuery
CreateProcessA
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
lstrlenA
lstrlenW
CreateThread
DeleteFileA
GetWindowTextA
GetWindowRect
FindWindowA
GetWindow
IsWindowVisible
GetClassNameA
GetForegroundWindow
LoadCursorA
SetTimer
KillTimer
RegisterClassA
GetMessageA
CreateDesktopA
SetThreadDesktop
GetThreadDesktop
TranslateMessage
DispatchMessageA
SendMessageA
CharUpperBuffA
OemToCharA
PostQuitMessage
ShowWindow
CreateWindowExA
DestroyWindow
DefWindowProcA
GetStockObject
DeleteObject
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetSecurityInfo
SetSecurityInfo
SetEntriesInAclA
__GetMainArgs
_sleep
_strcmpi
_stricmp
memcpy
memset
signal
sprintf
sscanf
strcat
strchr
strncmp
wsock32.dll
ole32.DLL
OLEAUT32.DLL
WININET.DLL
KERNEL32.DLL
USER32.DLL
GDI32.DLL
ADVAPI32.DLL
CRTDLL.DLL
L!This program cannot be run in DOS mode.
.idata
.ajelhf
6.2u>0
OVWHFW,5cqNI
0nBofw
_HFGm>-
{SHF'>-
{[HF6MT;
1WJf~n
cdBIJFNi
cdrh;c_
HFFoN'
FoV<D]
ZS6lc6
sGHF'.-
@ ;CHFwFwFt#
OVVW3jO)n
9E3cWV
F0LQG>BY
Vv(GFooW*
FmKFooW*U
wRS(+:(o
#OWwMT
9E3gf5I
9E3g9w}j
*Z.;HFFo
K;0LQG"
o+OJ`tGo
F6o WDoOW*Z
F;guB8582
wog[.HF
oO?2{/
OVWI*/P
0LQG>BY
3,o_=A3cDf
*Z,mz>-
oB~EB*
oB~Er*
FoF5-Fo
ZW]~WO
ZB~E2*
ZB~E.*
Z.rHFZ
oF`GDo
ZB~Ef*
`FFoKn
&Dow.bB
Fo2F`Fo
DFoJ!o
C+TFoOo
FBoG>B\
[53voR
*CHFf~^
vFoCHFWoOZ
oNa/aj
+o.VCog
VNxZBbP
/6Gog*
FZ.HFZd
CHF^Jcw
2k)M}R
HF0LQG:
oow,oO?
lFFooo
FoJ`OnW*
ow*Z.P
NlFozFo
FHyFo*
{E?eZu
OUGBGo
4FoODW{
Fogy,jD^
Fow<gA
CHFWm*7n
3bODW{
W:#=_DG
hFow,ox
4VoEJ'm
Jw.=JF
CkHFWC
FoO6ro
FJ5|oJ5|o
FowwtGo
F#;/^J
N.0J-&
o|B,Fov o
OoOnBo
cL0W)e
,eO?|B
wMTG8SH<
CkHF;U
CoLl\o
CkHFlIE
0CkHF#`G9q
>ILNIDOI
7CkHFW
`FZ,nko
`CkHF<
=,Dn7o
Y6<V=,
OVW:N^+
g<eCkHFi2F
{SJFng
9E;gRn9n
F`M:?o
FoB1go
Fow,j}N
0k|J9d
OCgHFnw WFo
Fo6CkJFof
 WIW{o
oBskHF`uFo
CkHF`O
OCkHF2no
q~Fo/S
FcbFo*
CoKFnf
o>CKFkf
 .FoCHF
9/.?HF.
KF5\Fo*.
CoKF2o
CoKF/.
3zwogX
.HF|vFo.HF9s:o
ooOW*JFo
CHFwF#
CkHFWj
B`GtFo
w_W,kx
,nO?O?
{,3`Fo
FogTIW-
o6xkg^
m6@kgJ
l6@ng9
@S/~HR
Z^A.4F
m6SoKF^
6CHFmg
KHF>0o
BT3fUo
BFo+IO
CHF`ON
OCHF`ON
*CHF`ON
dKF|yFoJW
>C{dKF
nIazAo
ckHFoX
ow WDo
CKF?o-o
WwF7~o
CHFm1o
oO?O??BP
f WFo/IW-
eFoo,nz-
Fow^ogx,nz
c GIWS
RdFoJ`O
F#CHF9
F0LQG~
fcCHF;l
`FlgFoK`F
K`FbFoo
2a/Fao
~ART-Fog*
 WIW}n
 WIW}nI
JRFoga l*g`O`
RZ.HFZ
]Io/]I
C(G%Fo
t;wIW{
.[HF`O
S"03Wx
BpnFoJ
B3gn@o
oON`JJ?
/6Gog,oB8wNe
FR!-Fog
kFoBb0
FR!-Fo
QFo/9ao
F<D]Iu*
FoO?zt k
gzBQFo
`FkFoK`F
3sON`JJ?TS*
3DON`JJ?$S*
`FlVFo
/RU1;n
RFogGI
OVv`E*l
FR!-Fog
ON`JJ?S,o
Fo{S"vBS+t@()w
Z.::k.38m
sow/Z4L
SFo_NP
.aHF9k
AFhVFo
ooO?O?x
NTPFoG
/6Gog*3D`G
9E3g#8>
S,V3hNqn
PFFow,ozFo
3swJof
0LQG>BY
8\Fow*
F0LQG:
7FowVng
 W^oON`JDWFGIWIV
gnwog*
OJ`J@G
FWGoZ,
F+CkFo1!
eOnw~`
3eIGWg
E`_UV
fXJFo#
fX{HFo#
# WFoFo
llYFoOuFo
@SbxSSm}WW
?O`_nZ@
O`OJ'+I
v<D]uzB;=
CHFVW4-
`HFWuE*SHF^
cFo/NP
sTLNwR
gwVofD WFo
LFo G,
O?O??P
CgHF?z/
PBFozF-
lNFoON
.%HFZlx
CowB3c_
F<D]:H
OJ*%3Tx
JZ.*HFZ8X
g .THFMFox
@OFoBbtP
ZE;g=@Q
OJ*%3]x
,oBb}P
F9E,!~
4BFoZZQ
IFoO3_z
,oBbVP
t(JFoFo
,oBbGP
`FHFo,oz
q5FoA>-
.nHFhHFox
F4FoA\
>?#-C_o
.HFKFox
}EFowJog
6-b%BEb
zaXk8z-
,oB8wNe
gzB0Foz-
9E3gWJ6[f8_o
`On:Z@g>
 _IWOmwFo
`LN?~o
F2QwJog
HF6Fox
,oBb<P
FomQ{,ENf`[Do
Fo/^?W
 @^23m'{=W^
Fo/Y<F
JRFogEBo?z
`F?zc-
<FouEo
FoqJof
`F?z1-
u>FoGo
.THF=Fox
Foo.!HF=Fox
.,HF=Fox
HF=Fox
`F?z+-
.}HF<Fox
U0LQG>BY
.HF>Fo.HF?uo
9E;g6nJ
F^I,oO?z
2dMV9OU
 O;\8!
FVyC^JT
G*Bqxo
`F8FoB_
Og=.oR
,oBb2P
Ff~P<mo
d$Foo,oO?
T$FoxN,oO?vo
oA`F'Fo
MTG8(x
$FoO?O?x
wB\,ox
 uFo7P
s^J"m(
FoNbkuP
8WNHzs
VD'FoJeo
l FoOW*
],/Ooo
B\7f~L`
u{k!L}
 WFoBIoI.1
'8w8z&-
 WIW}*xW
F,FoA\
Vg..HF
 FoRo*F`
F].CHF
\(FoOZj
FoO^*c2
t#FoJ|
"FoN#`F
N(/Foco
.HFZ.n
.Fo_NF
Fz$.Fo*
~^Ln^DnPZo
F<(FoBzI
,ox*,ox
eJRFog!
N*Fo G
V*Fo G
_`O`_n
FoO?Dr
gFoxN,o
F#`Ffu
3c^@n@bx
*Z,oDbqR
4VoG>A\
skujzo
F0VoGz
CHFCao
F;`FZ3
:RFoEo
Bo?3Uo
Fo|`DGo
{KFmgD.o
FoD]NNt!-8FoG.k
Fo*Z*Z
2KDbLP
CHFr!o
CHF)Yo
.ofKFZ
.KF`7P
FZ.HF^
ETozmo
R}]ozko
FoG.k9
FoG,o"
qf~Ic2e
3vAncKo
3vAnwL
wZFo3Ao
CHFgFo
k/%Pnyzgd
CHFWoKFWj
ooooOj
FooooozP
.RBbDm
`F(z{/
n.BNbk
2$yc21~a21~c5B
S$9ES39ESR
]\S,la?.6a?.
W'.Qk:6Mk:!wa6
6Mk>#hS:'oJ5
}f'+wkS
lJ#'vV6!ll<,
$K`06qj=BJq?
lV'#lp 
wA<1]w!-j
wd![l!W
wl!Wd![XR
PqS"[(
ZywJqwF
.JYwF9w
.JYwF9w
wl!Wd![XJ
BHw<!}v q*K6:l
6Ip60aV*1l`>
vc<0ud'+wkSB
8'jk6.+7}&tiSB
k'&ti}&tiSB
X,la?.6a?.
$1wf8q*+7.t
n60v`?q*+7.t
SBs`!,}i`p6a?.
S7k`!q*+7.t
&1}w`p6a?.
n60v`?q*+7.t
SBof !uuSB
SBpq<,k
SBNl!6md?
jj''{qSB
mw!'vq
0wf61kL7B^l=&Ol=&wr
SBK`=&U` 1yb6
#|W6#|U'0
SBs`!,}i`p6a?.
m)+cb*5cb[j=,}f'+wks'kq2 tl *}a^H
9Q;+k%#0wb!#u%0#vk<68g6bjp=bqks
WVs/wa6l
Sll`+6
3lja26y
lqa26y
lj`?-{
Ql}a26y
q\\![L!C
SBAwb][h
qsyl!w6
S,5SRP
X5SR0kr
 5SRAZ
SBWG[
_Oy9NB
SBm?B~
U)SB3]
SBw5SR
4xSBiB
sCk*5SRR
Css"|SB
!\,![$
$!F<cN<
S#zf7'~b;+rn?/vjS
@=%}iSB
@++lU!-{` 1
B66[p!0}k'
pw6#|L7B
B66]k%+jj=/}k'
B66K| 6}h
+j`06ww*
B66Ll0)[j&,l
J#'vH&6}}
W'.Mk$+vaS
R:,]}6!
Z5&wu6,
-kc;#va?'
c0.wv6B
Z0'`l'B
h2.tj0B
u!+vq5B
w2+k`S%
v66zp5B
v!#vaS3
v'0{d'B
v'0{u*B
T6al\IB
Si(c(c(
bc)b)b@*
aV*!ah*:a*Bg-ex Ck
 [k( sk k k k k k 
S&*ma.*ua6*}a>*a*a*a*a*a*a*aB
S&ti}&tiS
Brq&>SB
v15  BUB
BKj56od!'DH:!jj -~q
]1S*lq#x7*$5o+>+{w<1wc'l{j>mqv22q*!'|l!l|i?}hw7
q`u#j8:'k`20{mS#zj&6"g?#vnS'vbbp
m'6h?|mnl!7ki:1l+0-u*$!ua}6`qS*lq#x7*%+jp .qv'l{j>mhu .wb}2puS*lq#x7*%+jp .qv'l{j>mhl#.wb}2pulgk?v+" :x=vig(<&x=lig(77x=5a&" cp|
]ISgkY0!{q`p6a26
=v}'``S+h
2.qs6B~jS
wc'5yw6B}k4.+7}&yqS
}d!!p%
ld!68U2%}
v17W'&`4v+6m'/
Jq7:) :l|d'Bop#&8
{j>/yk7l{j>B=v
!wh>#va}2qcS
{h7l}}6B=v
!ua}2qcSx=5a7
`=%t6aln}7B=v
"BJ`4+kq60K`!4qf6
jj0'kvS)}w='t6al|i?B$M
T;oc5(S~PQ
YAm~LL
];v1=pomLL
];omP@
\\m~kf!+hqm$mk06qj=bit$j1~ 'tc}2yw6,l+?-{d'+wkn`=vqyev66Ll>'wp'j:t"50,qn)5cr(,h~7v00qu'|$*
\\m~7M
T;Sh6/S
v1=pso8H:!jj -~qs
vq60v`'b]}#.ww60
'`u?-j`}'``sBHd'*
V<$lr20}Y
+{w<1wc'
}q&2DV66muS
jj$1}K65Hw<!}v B6A
+{w<1wc'
Ol=&wr 
[p!0}k'
}w +wk
`u?-j`!
Zw<5k`
'oU!-{` 1
B?-zd?
~c?+v`S
wc'5yw6
Ul00wv<$lY
+va<5kY
7jw6,lS60kl<,DL=6}w='l%
vSs.5bBKJ
DH:!jj -~q
qk7-ov
mw!'vq
'jv:-vY
,l`!,}qs
}q'+vb 
Bj='kYv7
9:,hp'bl|#'%' 7zh:6:%%#tp6
?"m~7C
U;o1{w:2l;57vf'+wks3ir{kca<!mh6,l+50u4}1mg>+l-zyev66Ll>'wp'j:t"50,qn)5cr(,h~7v00qu'|$*
\\m~7M
T;SgkySgk9:,hp'bl|#'%'6&qqqbnd?7}8tgk"s,yh6
?  gm"m~zwmO
  ~qk#7l%';h`n`}a:6:%%#tp6
?  e8k2/}8tgk"m~zwmO
]U<fl`!B$M
T@mgk &~7Q
T@m~7M
U%2!ll<,%'v1:%>'lm<&%'
KQqbvd>'%'50u4q|
v1=fv!
7k`!B{j>/yk7l{j>B{h7l}}6B{d="l%8+ti}Bsl?.}a}BHw<!}v b=]sgk
x8G2&8U
YB=]Scsu!!8
r2jf?O
6:qq^H
  g(7:b=]sgk
QAsb8%sbVD
jj0'kv`pV`+6
U!-{` 1+7
+jv'B[w6#l`
-wi;'tu`pKk22km<6
V@q*+
o]w!-j
YB*5cbZL
;h`ibT=^H
7`r8U~
YB+6bbH(
7fr8'v1:%0&
^B*7cbP`?.w%##|j=-s$^H
  gkYSg{w$:jr+0o}sb)%=-wk6b8%s,wb!-musb8%sgq%v18%vr*lsg(7:x=5a+8  O
'-ld?b.0fq-
YB=vyl2
YB*7ebH(<)
YB*0cb\@
Sp-2s`=vqb{
YB*4`b=l^H
0fr8U~
Sgk  B6
4}k'bTj4%}wS
wc'5yw6
Ul00wv<$lY
+va<5kY
7jw6,lS60kl<,DV;'ti
'js:!}J1(}f'
}i2;Tj2&
D##jq>'vqS
pw6#|l=%Uj7't
'js60+7SgkYv16a?.
r/=~s/C
5@ks)(as+7kr]0
z+4.BPQ
74}r81cr8H2.~j!/}as
}t&'kq^HHw2%udibvj~!yf;'
-vq6,l(';h`ibl`+67m'/t
UIm~P@
|]w!-j1cr$*
YAm~ZJ
&9;s&@!0ww`r(?s
jj$1}ws1}k'bud?$ww>'|%!'ip61l
LU|s65sv(1s
wv'bVj'b^j&,|
jd4/y?s,w(0#{m6O
F<,l`=65q*2}?s6}}'mpq>.
jw<0,5g~7Q
T@m~7M
|$mb|]w!-j1cv"%
-kq=#u`s
VVs.wj87h%5#qi6&
74Sgk%v1
#{m6o[j=6jj?x
L%;6luim7
mb4'kqs
#kv$-ja BMv6b^j!/Kp4%}v'BKJ
DH:!jj -~q
vq60v`'b]}#.ww60DH2+v
qf!-kj56DR:,|j$1DF&0j`=6N`!1qj=
]}#.ww60DD&6wF</hi66}
&`p/2cBOK66]k&/[d0*}a
#kv$-ja BUU
l\IB=vigk
^v1E%tgk"S
L=6}w='l%
:hi<0}wS
Kq<0}F!'yq6
vv'#vf6Bhv'-j`0l|i?B=vsg@?Sgk%
H:!jj -~qs
vq60v`'b]}#.ww60
WSAGetLastError
WSAStartup
__WSAFDIsSet
accept
closesocket
connect
gethostbyname
inet_addr
ioctlsocket
listen
select
socket
CoCreateInstance
CLSIDFromString
CoTaskMemFree
CoInitialize
CoUninitialize
SysAllocString
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
ExitProcess
ExitThread
ExpandEnvironmentStringsA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetCommandLineA
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeProcess
GetExitCodeThread
GetFileAttributesA
GetFileSize
GetFileTime
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetTimeZoneInformation
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
CopyFileA
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
LoadLibraryA
CreateDirectoryA
LocalAlloc
LocalFree
OpenFile
OpenMutexA
OpenProcess
PeekNamedPipe
CreateFileA
ReadFile
RemoveDirectoryA
RtlUnwind
SetFileAttributesA
SetFilePointer
CreateMutexA
TerminateProcess
TerminateThread
CreatePipe
VirtualQuery
CreateProcessA
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
lstrlenA
lstrlenW
CreateThread
DeleteFileA
GetWindowTextA
GetWindowRect
FindWindowA
GetWindow
IsWindowVisible
GetClassNameA
GetForegroundWindow
LoadCursorA
SetTimer
KillTimer
RegisterClassA
GetMessageA
CreateDesktopA
SetThreadDesktop
GetThreadDesktop
TranslateMessage
DispatchMessageA
SendMessageA
CharUpperBuffA
OemToCharA
PostQuitMessage
ShowWindow
CreateWindowExA
DestroyWindow
DefWindowProcA
GetStockObject
DeleteObject
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetSecurityInfo
SetSecurityInfo
SetEntriesInAclA
__GetMainArgs
_sleep
_strcmpi
_stricmp
memcpy
memset
signal
sprintf
sscanf
strcat
strchr
strncmp
wsock32.dll
ole32.DLL
OLEAUT32.DLL
WININET.DLL
KERNEL32.DLL
USER32.DLL
GDI32.DLL
ADVAPI32.DLL
CRTDLL.DLL
X!5PU10
L!This program cannot be run in DOS mode.
.idata
.ajelhf
LZ;b/;
j7O&gn"(
CL~D\~Y
:X;a.D\CdXN
MXEPoT@
Mhd7JSq+lI
;{(0ki
6D\p0B
"?l\p;nty
"X;i:D\
i:7YD\^\^\]9;
CL#~)C
\Ee]nKkU
M[P~{z>w
SPImQG7
;9C~m 
;9C~mdX
j/<<Lc
SX;P!~G7E
fImU~dX
;p;l\r
hPo3l\p;d;
D`[OU
MsTFu]<;+
_V4ND\
U4~UNZ
b7Ee]n
X;V*PT
4-D\V)
\o7yD\
Z?V"Q@~g
NW4D\r?
D\J6L3
Ee]nKkU
MdWb@Ka
\l^p;l\L
\ImQtW
JSX;J>
\n'JS[;6397
kJ6L'/
V4D\V"
V"Qd~U4
nJSX;jJ>
\n7J6L3}-
mEe]npny
\ok~4C
4D\p;l\r&
ImQG7&G.o=
\>X;cD
kl\p;)
;YD\7;
;fp;~J
\V6sqQ
4D\V&a
;suBmZ
;rBp:ny
k,7;^
MsT)O]
\V4D\V
>X;YD\+F
Cl\r,-
D\Ee]n6
CYD\p;l\p?l\p;n\
CJsLs\
>X;l\~
m_V4%;
C1~ae:
Nu6mD;
{INMgr)_C
;YD\~w_;
;!;sH~_
~Jp;iFG\p;)
~O/HS1n
Cp:V6*s\
rMp;l]r
4^D\rs
SRX;n]
SBX;ny
SX;nFy
ESjQ}5D
F\p_n:;
_7@C~\8
D\p;lV~
;7Z;d\
<PX<b;
;Mp;lTr
mdXnM_RI.3
_7Vo3V377Y
D\EE_orC
D\/l]L}
m{>~Z7\;
b2SeBSmCS
WT/7Z?
m*37Ee]n
p;l\V6
\ImQG3
\@FXoIY
h3hqYx
N$B_!?z~
9rNp<U[
4'Y^G;Fw
ZCFqd<
\(UoC{
C#~ BD^;)
D\@>\n6a&F\
;777!;
]GVmCl
m6qT\
fk+bQZ
fk+bQ\
N63B\
Cll\p9ny
j\xbu?
\p;l]p9\;
;`_3`D\>
{F\p;l\
>[;Z>[;UI
\>X;YG\
YD\>[;j
;YD\>[;
UG\0y[|y
#Z"JD\6[;F'
;YD\>[;FS
o=YFG\
^x!?sx6[;:
CFYo6!;s[>![;
IG\>![;gz
.![;\?
[;?YFG\hYD\/;p
4D\Uz\
SX;PyG
_>X;nHy
9;9;YD\^\/9;
sp;l\p?lZNiE
>CKc}VK$;
CJCJsp;
o3l.[;/q
G7YD\+
NXS~74X
RO:?/
RO:?/
\o#<m;
:IFG\+
..X;(7Y
QtD\K^h
.[;>X;
\!pVIN
)ASX;i;
\o-X/:
\o%`'8
\o1`'>
;t>X;r
MCT|CT
7/x+p
*[;,w;
MG\Uu\
\n^YD\~
*[;@v;
MG\=j\
;l\r+p
4YG\Jc7
;|[^\;d
CJCJ3Xy
#S~7/`+p
:F8o*PyQ
S~7/h+p
S~7/X+p
S(ImQo+6T[
_~\>X;
kd7?o>
:nS~&=))
CJsHh\
\/YD\L
EP;\Ee]nW
YD\7`;
\>X;l\Ek\
;r['}!\
b+(@F&:
\>X;`r;
Z7V=CQ
:~S~gG
:~S~S?f`_
:~S~gGS
4JSX;J
Nm:`_}
{V4D\V
]|S=n4
;rm|C|
\n^l]r
;sYD\p5J
\n%l]r
rY){o,n
4_F\p;l\-g\
\ImQ<\&
\>X;l\g\
UO,eI$g)
FPJX__3
FPJ(__3
\o&l]rM
_+`_+{~Z
Ll`_cR\
*[\AZ\
SPImQo/AsK0
\p;l\p;)
N_)ml]p;)
C~s-\\
;ZU]eY
;lXp;l\r;
l^p;l\LS
Ee]nKkU
iUo7Pm
\Ee]n6
!9sXV^71:!;s~
=;o,E_
:V~]F[h
Z&KtI&DqM~
K3L/lTr
SlImQ\vX7H;
jX;-H'S
YD\#~.
8C.X;7LX2
D\6X;P y
X;QD\7<g
_VoUoW;
S~&<))
MSVX;Q)u
\p=l]p9\;
D\^\'\
CJCJ3y
kl\s&]
D\JSZ;l\p;hP;
SJX;o::
Llm%EB\
4PD\V`
;;ep:JCT
sPV4_D\VMq
N,4!D\A\
nxJS#X;J
S=X;l\;
;l^p;l_r;
O3n1F\
s^)l\~
snp:JCPZk7a-
F\n-l\N
;l\JSX;o98\
\p;V4D\F
\VSVSVSVS
4vmj-qMSX;M
SX;|%;
g3k-=\
k!7g44
CG6@5N2:4
:vS~UDm
;g5N)a:
8hJSX;J
97Ee]n
p=l]p9
\p+l\~
\p:n$y
;k`#;;
\n%l]rM
D]aYlB|
;y}'kQ
UiR(FD+aH~R
;yL'hR
\nWlZrO
;l\JSoX;o50\
+)@Z0oj
?;sSp;l\I
;l\JS=X;o2\
4!D\1\
u4TD\1\
4YD\1\
45D\)1\
;l\JS'X;o4\
m Ee]nKkU
_Vm?`(;
p;l\p;+
;!;s{p;
kl\p;l\L
\#uY+F!
MsT"y`u;W\
p;P4}F\p;l\4\
\7JSX;
)0SrX;0+;
\p;nLz
!1sMLOw
Z;l\p;5;
CJ3V_VA
kl\p;l|p:l\p;aG\
MsT_4ul31;
P~dXnM$b&
\p:Vo/)
GSlaz:Q
CHJsLN
\p;l\p;)
e_si+FWw];
;l\p;l\r
M[Tavitug7
HsLm+\
=\o R:_
_7F.__7V
GSxImQG3
!3Q6ZCu
@gotN&;
=M{MS*X;QQ
:~S~g_t~
sLN"4D\r
8gHtw]\
\Q46D\
o(`~]jOrb9
(tsHrb
T/l\p;l^p;l\r;
4!D\rv
\V4D\r
\n1n\;
)^~:sT&\
:no7:;
p;P43F\p;l\!&\
\ImQG31U::
kJSkX;
\+F|Sx;
p;l\p9l\p;n\
Llmq_<\
\V4D\r
kl\p;l|p;l\p;JQ
 hLoV)
\Kl\)b
rZgof`
\p;l\p;
X;YD\O{
;?p;l\r
S[;JSX;
\7l\VF
~7|61\
S;QG\
V4hD\V,
X;YD\ny
4]D\V-
SX;JOM
;SjQche'
F\p;l\
mQ;gx;
P-iD\g*
4;D\r!
)3mtb_
p;)SX;n
2(>mnVy
X;YD\~;
\Llj_>\
X;YD\%C
\7lcr;r
xSQSQSQ
\n*YD\
4D\V}+
\V4D\D
4F\p;l\
MEBio3
4=F\rIN
4ZF\r{qG
SZ;l\p;
3yD\>X;nX
4X-5?1
~>?hYD\
]o5/)jn
5JSX;ny
;YD\~FG\~V
C/n\e;
\>X;&_
;YD\p;iFG\p;l\p:l]r;
SX;l\p;
;JSX;ny
S>X;Vu2
;i4D\r
\p;l\p;l\
SwZ;nL=;
SwZ;n=2
iD\1t;
2(|nl\
Y{{Ey{Y;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{4{
IYx;{Sx;{
|;{p;{";{ 
;{Yx;{Yx;{Yx;{Xx;{8
;Yh;{Yz;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{{;{Zx;{
Ix;{:{{:{{:{{:{{z;{{z;{{
={{:{{:{{:{{:{{z;{{z;{{
={{<{{:{{:{{:{{:{{z;{{z;{{
={{:{{:{{:{{:{{z;{{z;{{
={{:{{:{{:{{:{{z;{{z;{{
={{:{{:{{:{{:{{z;{{z;{{
={{:{{:{{:{{:{{z;{{z;{{
={{:{{:{{:{{:{{z;{{z;{{
={{:{{:{{
;{{;{{X<{{<{{
;{{`<{{
;{{`<{{
<{{`<{{`<{{:{{:{{:{{:{{:{{:{{:{{:{{:{{:{{:{{:{{
={{-<{{
={{<{{<{{<{{<{{
;{{<{{
;{{<{{<{{<{{<{{<{{<{{<{{<{{`<{{`<{{<{{
={{:{{:{{`<{{
<{{<{{
={{<{{
={{:{{
={{:{{:{{:{{:{{
={{:{{:{{:{{:{{:{{:{{:{{:{{
;{{<{{<{{-<{{
={{;{{<{{;{{;{{
={{J;{{J;{{
={{:{{:{{L={{L={{L={{L={{
={{L={{L={{L={{L={{L={{L={{L={{L={{L={{L={{L={{L={{L={{L={{L={{L={{
={{L={{j={{L={{
={{L={{j={{L={{
={{L={{L={{L={{L={{L={{L={{L={{L={{L={{
={{j={{L={{L={{L={{L={{L={{L={{L={{
+~)Yx;{
x_{<xM{0xX{<xg{)xS{ xH{0xX{8xW{4x^{4xT{+xB{Yxx)
}G_QO_]'_
Ifw<w
3m\y[z9
g}O_]G_Q&h;8${Y
]zx?dy:zX
Q={Yx;[y=Z
?.s0pR
p8~sdy:zX
:zXyO|dy:zX
}|g}s%7$p'}|G}9y[z
Ls%7$p'}|G}9y[zg}O_]G_Q&p;
O{Yx;{Yx;{Yx;{Yx;{
Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{2
Yx;{Yx;{y{
y{Yy8~^p2qR
;{Yx;{.
W{Yx;{,
Yx;{Yx;{Yx;{YxS
H{Yx;{Yx;{Yx;{Yxm
Yx;{Yx|
x;{Yx;{Yxh
<9;{Yx;{Yxr
;{Yx;{YxP
{Yx;{Y0o/
^Tr6qY5aY{;{Y|;{Y{Y;{Yx;{Y8;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Y;{Yv$WxrYz
T<V6vS\;{Yx;{Y(~{Y4:}YV
x;{Yx;{Y;uxs:ynx1{Yx7{Yx;{Y*{Yx+{Yx
{Yx;{Ix+{Yx9{Yy;{Yx;{Y|;{Yx;{YxK{Yx?{Yx;{Yz;{Yx;kYx+{Yx;kYx+{Yx;{Yh;{Yx[{Y0;{Yx{{Y9{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yxk{Y;{Yx
{Y,;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{YVO
;{YP2{Yx+{YP2{Yx?{Yx;{Yx;{Yx;{YX;{9VI8
Z{Y,;{Yx
{Y,;{Yx5{Yx;{Yx;{Yx;{YX;{
;{Y;{Yx
{Y;{Yx+{Yx;{Yx;{Yx;{Y8;{VR8
Z{Y9{Yx{{Y9{Yx){Yx;{Yx;{Yx;{Y
X{Y;{Yxk{Y;{Yx#{Yx;{Yx;{Yx;{YX;{[V^8
Z{Y0;{Yx[{Y0;{Yx!{Yx;{Yx;{Yx;{YX;{
x;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{YI;4
9?}Yx;
_Qo_I9Zx;{+m,<k
{Yx;];{Yx?}X#QKw
ww_Qsw
-Q{3xSIx+,p
-&U~s8?}Yx;t;{Y~=+
7"pwYx;U
$.n2h>;Y
KYh.9aH;k:?eH;k
/jMx;{E{KYhNaH;k
t2-PCO
R\|Yx]%d%
{Yx_x;,h
#UxzYx;-
7,3xQ={Y~3xQ={Y~3xQ={Y~1f
{IN={Y3KYhSgix+,_x;]H;k1d
{IN={YKt
Y/_x;pFUH;kPOk3xl~;{
/>x;{Y~Yx%
fYx;{d
|ECGDx;{YxN
<D{Yx;$
kix+$;
]I/f,hbz
|$GDx;{YEOK
FYx;{|={Ys=
-EkGDx;{YxN-
]m;{Yx;{YxzYx;$
_,};{1<{YP~YxQ
NYxpB{Y
H;k3xSzYg;p|;{
2V{Yxh
8{YbZx;
L{YR{;{
mQx;v;{
yYxB;{
bYxm ;{p{Y
9{Y|FYx
vWYx9g;{
Yx;,_x;*
$yYxhp
wYxA;{
Q&x;F{Y
{Y x;|;{
(yYxX'N{Y
zYxIzJR>]{YR7{YvYx
r*YxA;{
];{3yX
Ix;yII
'e 7{Y(G}?_V
w}x9u\bx(G} 
t{Z{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Y
x+x;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yy;{Yy;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Y0({Ix;{Yx;{Yx;{Yx;{Yx;{Y]H{Y
Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Y
Y$;>7^
Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Y
{{Yx;{Yx;{Y,y{Y{{Y{{Yx;{Yx;{Yy{Y{{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{YTz{YDz{Y,z{Y
z{Yz{Yz{Yz{Yz{Yz{Yx;{Yx;{Yz{Yz{Yz{Yz{Ypy{Yly{YXy{YPy{YLy{YDy{Y0y{Yx;{Yx;{YTz{YDz{Y,z{Y
z{Yz{Yz{Yz{Yz{Yz{Yx;{Yx;{Yz{Yz{Yz{Yz{Ypy{Yly{YXy{YPy{YLy{YDy{Y0y{Yx;{Y;>!
;{Y;<<
_2=x;{Y;<<
x;{Yc;85
;{YG:<<
 9;{Y-:<<
O{Y:4)
x;{Yv9)-
UY9,0
;{Y;$?
;{Y7:$6
<x;{YA;$:
-x;{Y69
:x;{Y#9
 x;{Y3~)
x;{Yx{{Ix{{Ix{{Ix{{Ix{{Ix{{Ix{{Ix{{Ix{{I;i/
4w{Yl{{Il{{Il{{Il{{Il{{Il{{Il{{Il{{Il{{Il{{Il{{Ix;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{YX;{Yx;{YX;{Yx+{Yx!{Yx
{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx+{Y$;{YS
{Yt;{Yx
{Yx{{YH;{Y
kx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{YV
x;{YP[{Yy;{Yy;{Yy;{YH[{YL[{Y@[{Y
Y0({YD[{Yx;{Y'w
IYx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx;{Yx:{Xx:{Xy;zYy>V1
{{ILHL!;{Y~:{Y|;{;{
}Y;{MK;{
x;{7x;{#x;{
x;{x;{
X{Yx;{Yx;{|
^iJ_{;
?~7Y]H':
+8^{|
7WHkVM
]H{(xi
=z?gDo2
4~EeWs>
-$r>y+^
Khxh4,l:
5wEY]H
^F~]H\y
^*]N\gDY
^F~]H\gDY
gu1{!1~+6\O
5wEe0~:
,w>g]H^,D
7h/{XU
VJ{F;U1
Tr;^*]
#y]HvSxu[y(r?yX
=6qY(I
Tr;IhM
cXwCTr;IjH
+t7PvSx
LDTr;IlH
6u1{ux1{Tx
PZTr;^*]H'Y]X
[y]R[|
^*u1{-
IoXkV6
*b[)u1{lH
{XXvSx
Tr;NlH
+t=6qY]H^*x
W{Y;w(
<g^*$r
IY]H'|
WvSu1G
,v7gDs>
=z?gDy4
5wEe0~:
,w>g=I
3;qSxs/
JY]H[|
 U;vSu1{
{\x;zXy:zXy:{Y";{Yx;{Y>T
-xh4,l:
Lixl5<
I*xv+
f[~]H\Y#
YB;AvW;27
y]cAY]H[7i6
]c{/xZ{5xN{<x;{Tr;60
{hxx{x
{ixz{ixx{`x
{`xF{Yx
:bkKj;YpkKj;Yp~<
5jt;Yx;{Yx;{x;{Yx;=8n7jF;
WSAGetLastError
WSAStartup
__WSAFDIsSet
accept
closesocket
connect
gethostbyname
inet_addr
ioctlsocket
listen
select
socket
CoCreateInstance
CLSIDFromString
CoTaskMemFree
CoInitialize
CoUninitialize
SysAllocString
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
ExitProcess
ExitThread
ExpandEnvironmentStringsA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetCommandLineA
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeProcess
GetExitCodeThread
GetFileAttributesA
GetFileSize
GetFileTime
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetTimeZoneInformation
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
CopyFileA
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
LoadLibraryA
CreateDirectoryA
LocalAlloc
LocalFree
OpenFile
OpenMutexA
OpenProcess
PeekNamedPipe
CreateFileA
ReadFile
RemoveDirectoryA
RtlUnwind
SetFileAttributesA
SetFilePointer
CreateMutexA
TerminateProcess
TerminateThread
CreatePipe
VirtualQuery
CreateProcessA
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
lstrlenA
lstrlenW
CreateThread
DeleteFileA
GetWindowTextA
GetWindowRect
FindWindowA
GetWindow
IsWindowVisible
GetClassNameA
GetForegroundWindow
LoadCursorA
SetTimer
KillTimer
RegisterClassA
GetMessageA
CreateDesktopA
SetThreadDesktop
GetThreadDesktop
TranslateMessage
DispatchMessageA
SendMessageA
CharUpperBuffA
OemToCharA
PostQuitMessage
ShowWindow
CreateWindowExA
DestroyWindow
DefWindowProcA
GetStockObject
DeleteObject
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetSecurityInfo
SetSecurityInfo
SetEntriesInAclA
__GetMainArgs
_sleep
_strcmpi
_stricmp
memcpy
memset
signal
sprintf
sscanf
strcat
strchr
strncmp
wsock32.dll
ole32.DLL
OLEAUT32.DLL
WININET.DLL
KERNEL32.DLL
USER32.DLL
GDI32.DLL
ADVAPI32.DLL
CRTDLL.DLL
L<C<C<C
PCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPC
dCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdC
L<C<C<C
PCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPC
dCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdC
L<C<C<C
PCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPC
dCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdC
L<C<C<C
PCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPCPC
dCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdCdC

Hosts

IP
114.114.114.114

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	53179	224.0.0.252	5355
192.168.56.101	49642	224.0.0.252	5355
192.168.56.101	137	192.168.56.255	137
192.168.56.101	61714	114.114.114.114	53
192.168.56.101	56933	114.114.114.114	53
192.168.56.101	138	192.168.56.255	138

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.

ALYac	Trojan.Agent.DQQO
APEX	Malicious
AVG	Win32:Evo-gen [Susp]
Acronis	suspicious
Ad-Aware	Trojan.Agent.DQQO
AhnLab-V3	Win-Trojan/Berbew.51712
Antiy-AVL	Trojan[Proxy]/Win32.Qukart.gen
Arcabit	Trojan.Agent.DQQO
Avast	Win32:Evo-gen [Susp]
Avira	TR/Crypt.XDR.Gen
BitDefender	Trojan.Agent.DQQO
BitDefenderTheta	AI:Packer.983A49741E
Bkav	W32.HfsAutoB.
CAT-QuickHeal	Worm.Dorkbot.A
ClamAV	Win.Trojan.Crypted-29
Comodo	Worm.Win32.Qukart.K@565w5t
CrowdStrike	win/malicious_confidence_100% (W)
Cybereason	malicious.51a5e2
Cylance	Unsafe
Cyren	W32/S-c46e6d2d!Eldorado
DrWeb	BackDoor.HangUp.5
ESET-NOD32	Win32/Padodor.NAM
Emsisoft	Trojan.Agent.DQQO (B)
Endgame	malicious (high confidence)
F-Prot	W32/S-c46e6d2d!Eldorado
F-Secure	Trojan.TR/Crypt.XDR.Gen
FireEye	Generic.mg.cb26a3c51a5e2b9d
Fortinet	W32/HangUp.FCEF!tr
GData	Trojan.Agent.DQQO
Ikarus	Backdoor.Win32.Padodor
Invincea	heuristic
Jiangmin	Backdoor.Padodor.c
K7AntiVirus	Proxy-Program ( 00557ea51 )
K7GW	Proxy-Program ( 00557ea51 )
Kaspersky	Backdoor.Win32.Padodor.gen
MAX	malware (ai score=89)
Malwarebytes	Backdoor.Padodor
MaxSecure	Backdoor.Win32.Padodor.gen
McAfee	BackDoor-AXJ.gen
McAfee-GW-Edition	BehavesLike.Win32.Backdoor.dc
MicroWorld-eScan	Trojan.Agent.DQQO
Microsoft	Backdoor:Win32/Berbew.AA!MTB
NANO-Antivirus	Trojan.Win32.Padodor.foufls
Panda	Trj/Genetic.gen
Qihoo-360	HEUR/QVM19.1.C0BD.Malware.Gen
Rising	Backdoor.Berbew!8.115 (TFE:dGZlOgLj35Yb1koQJQ)
Sangfor	Malware
SentinelOne	DFI - Malicious PE
Sophos	Troj/Padodor-M
Symantec	Backdoor.Berbew