Trojan-Dropper.Win32.Injector.pbuu (Kaspersky), Win32.Madangel.DIA (B) (Emsisoft), Win32.Madangel.DIA (AdAware), Trojan.Win32.IEDummy.FD, GenericInjector.YR (Lavasoft MAS)Behaviour: Trojan-Dropper, Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 3618e0e786d697dfb092edf82fd5e278
SHA1: 5b33fb886186a3e436d5174f14cfb19914973776
SHA256: 39df421489ec3bdb3eaadc407950d4680e72351916c5e240b5fe598a7a48498a
SSDeep: 196608:EwYvfXDBYhBpeLHe3 EPegZT3VCz0TByC Py7FU LCZAsdX3LBO:vibBYDey3PFCuByPyhRwxBB
Size: 9659089 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2012-12-31 02:38:38
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan-Dropper. Trojan program, intended for stealth installation of other malware into user's system.
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):
%original file name%.exe:928
%original file name%.exe:484
%original file name%.exe:1504
iexplore.exe:1252
Explorer.EXE:1140
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:928 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Program Files%\Internet Explorer\IEXPLORE.EXE (332 bytes)
%System%\Serverx.exe (1504347 bytes)
The process %original file name%.exe:1504 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\amd64\winusbcoinstaller2.dll (10100 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\adb\AdbWinApi.dll (1862 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\adb\adb.exe (9241 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\amd64\WdfCoInstaller01009.dll (12517 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\i386\winusbcoinstaller2.dll (8723 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\androidwinusb86.cat (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\DPInst_x86.exe (7803 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\amd64\NOTICE.txt (236 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\i386\WdfCoInstaller01009.dll (12376 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\DPInst_x64.exe (9828 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\amd64\WUDFUpdate_01009.dll (18515 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\android_winusb.inf (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\adb\AdbWinUsbApi.dll (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\androidwinusba64.cat (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\i386\NOTICE.txt (236 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\install.bat (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\xp\SETX.exe (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\adb\fastboot.exe (5044 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\i386\WUDFUpdate_01009.dll (15584 bytes)
Registry activity
The process %original file name%.exe:928 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "35 E9 06 11 44 AD 03 63 7D 65 49 E7 B5 3A 75 CE"
The process %original file name%.exe:1504 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "67 EE 5F AE E0 40 BE F4 D2 9A BD 28 DE A1 C4 32"
Dropped PE files
MD5 | File path |
---|---|
47a6ee3f186b2c2f5057028906bac0c6 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7ZipSfx.000\adb\AdbWinApi.dll |
5f23f2f936bdfac90bb0a4970ad365cf | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7ZipSfx.000\adb\AdbWinUsbApi.dll |
9e5dad83671d0d441be8347be4c246be | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7ZipSfx.000\adb\adb.exe |
c3b07cfe26d2b91a2bcb20a8d535a365 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7ZipSfx.000\adb\fastboot.exe |
0df1cb11aea7a66124fd18b4b15990a5 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7ZipSfx.000\driver\DPInst_x64.exe |
6cb18e67db5c9f7da56d126f4b9d45a4 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7ZipSfx.000\driver\DPInst_x86.exe |
ebf9ee8a7671f3b260ed9b08fcee0cc5 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7ZipSfx.000\driver\amd64\WUDFUpdate_01009.dll |
4da5da193e0e4f86f6f8fd43ef25329a | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7ZipSfx.000\driver\amd64\WdfCoInstaller01009.dll |
246900ce6474718730ecd4f873234cf5 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7ZipSfx.000\driver\amd64\winusbcoinstaller2.dll |
e1bbe9e3568cf54598e9a8d23697b67e | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7ZipSfx.000\driver\i386\WUDFUpdate_01009.dll |
a9970042be512c7981b36e689c5f3f9f | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7ZipSfx.000\driver\i386\WdfCoInstaller01009.dll |
8e7b9f81e8823fee2d82f7de3a44300b | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7ZipSfx.000\driver\i386\winusbcoinstaller2.dll |
aa1de4f07624771108a0a2b43e3bdc6d | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7ZipSfx.000\xp\SETX.exe |
HOSTS file anomalies
The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 734 bytes in size. The following strings are added to the hosts file listed below:
127.0.0.1 | ZieF.pl |
Rootkit activity
The Trojan installs the following user-mode hooks in ntdll.dll:
NtQueryInformationProcess
ZwOpenFile
NtCreateProcessEx
NtCreateProcess
NtCreateFile
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Scan a system with an anti-rootkit tool.
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Program Files%\Internet Explorer\IEXPLORE.EXE (332 bytes)
%System%\Serverx.exe (1504347 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\amd64\winusbcoinstaller2.dll (10100 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\adb\AdbWinApi.dll (1862 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\adb\adb.exe (9241 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\amd64\WdfCoInstaller01009.dll (12517 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\i386\winusbcoinstaller2.dll (8723 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\androidwinusb86.cat (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\DPInst_x86.exe (7803 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\amd64\NOTICE.txt (236 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\i386\WdfCoInstaller01009.dll (12376 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\DPInst_x64.exe (9828 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\amd64\WUDFUpdate_01009.dll (18515 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\android_winusb.inf (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\adb\AdbWinUsbApi.dll (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\androidwinusba64.cat (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\i386\NOTICE.txt (236 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\install.bat (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\xp\SETX.exe (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\adb\fastboot.exe (5044 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\i386\WUDFUpdate_01009.dll (15584 bytes) - Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
- Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name: Snoop0
Product Name: 15 seconds ADB Installer
Product Version: 1.4.
Legal Copyright:
Legal Trademarks:
Original Filename: adb-installer-1.4.3.ex
Internal Name: adb-installe
File Version: 1.4.
File Description: 15 seconds ADB Installer
Comments:
Language: English (United States)
Company Name: Snoop0Product Name: 15 seconds ADB InstallerProduct Version: 1.4.Legal Copyright: Legal Trademarks: Original Filename: adb-installer-1.4.3.exInternal Name: adb-installeFile Version: 1.4.File Description: 15 seconds ADB InstallerComments: Language: English (United States)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
UPX0 | 4096 | 389120 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
UPX1 | 393216 | 57344 | 55296 | 5.5262 | 18aa317adce1d31150ddba79a7e3d9c4 |
.rsrc | 450560 | 9603281 | 9603281 | 5.52583 | 8c9b2be20e3037633fb98baad338566c |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
irc.zief.pl | 148.81.111.121 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
NICK ccqzsjif.USER j020501 . . :#a8a67a25e Service Pack 3.JOIN #.364.
:irc 001 ccqzsjif :Hi virtu.:irc 376 ccqzsjif :End of /MOTD command.:irc 001 ccqzsjif :Hi virtu.:irc 376 ccqzsjif :End of /MOTD command..:ccqzsjif JOIN #.364..:ccqzsjif JOIN #.364.
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_928:
!Require Windows
!Require Windows
.rsrc
.rsrc
:=i|%dH
:=i|%dH
%X]-$pp
%X]-$pp
*{k%u
*{k%u
''yL
''yL
.NNNNNNNNNNNNNNNN
.NNNNNNNNNNNNNNNN
.NNNNNNNNNNNNNNN
.NNNNNNNNNNNNNNN
KERNEL32.DLL
KERNEL32.DLL
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
GDI32.dll
GDI32.dll
MSVCRT.dll
MSVCRT.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
SHELL32.dll
SHELL32.dll
USER32.dll
USER32.dll
RunProgram="waitall:install.bat"
RunProgram="waitall:install.bat"
'K.Jj
'K.Jj
M.oU)
M.oU)
.pefl
.pefl
.Bo%R
.Bo%R
.CwbR
.CwbR
p;g%C
p;g%C
h.fE$=]
h.fE$=]
rH.rW
rH.rW
.aw$T
.aw$T
-t.jq
-t.jq
b %CtK
b %CtK
oM.zS
oM.zS
c 9%D*J=
c 9%D*J=
.zw-9K)
.zw-9K)
{].zmN0
{].zmN0
87.Fb
87.Fb
K-tR}
K-tR}
%Ure.
%Ure.
(..HH
(..HH
S%8Si
S%8Si
%fJrw
%fJrw
mw8.KZ2
mw8.KZ2
/C0%U@
/C0%U@
.GnH0WoK*VXvrQ
.GnH0WoK*VXvrQ
.Hl>md
.Hl>md
.zhPi
.zhPi
\%uFF
\%uFF
Ftp0r?(
Ftp0r?(
HK.lY
HK.lY
!.HR
!.HR
.DTf(
.DTf(
Ihpw.NP
Ihpw.NP
'>7$%d
'>7$%d
,e.MFM3
,e.MFM3
d.Dw i
d.Dw i
y7.SE-
y7.SE-
|0.NGZ
|0.NGZ
ca%sW
ca%sW
9H.wl
9H.wl
UG4%f
UG4%f
z.Ssu'
z.Ssu'
s-n%u
s-n%u
8v.BC4E
8v.BC4E
2.SUO
2.SUO
-5TQs}
-5TQs}
zN.Zz
zN.Zz
E[%c_
E[%c_
W9-xK.YT
W9-xK.YT
TM4%D
TM4%D
(E%F#
(E%F#
P.ol\ko
P.ol\ko
=:g*(
=:g*(
HA;%cw
HA;%cw
^.wOW
^.wOW
Q8A~X .Dir
Q8A~X .Dir
_&.lb
_&.lb
.nFnA
.nFnA
O%3Un
O%3Un
.aQnX
.aQnX
pPSkJþ
pPSkJþ
2zycMd
2zycMd
!;-c}-M
!;-c}-M
v.oJ8
v.oJ8
y.Wr,
y.Wr,
P.NWf
P.NWf
A%svd^
A%svd^
[]v%x
[]v%x
c[.XN
c[.XN
>%uZO
>%uZO
.Fy%H
.Fy%H
{k%C(h.
{k%C(h.
`.wrM
`.wrM
'!.Ap
'!.Ap
/ .xy:1>u
/ .xy:1>u
nn`Ú?
nn`Ú?
=.cxFkm
=.cxFkm
NL%FI
NL%FI
G%U} R
G%U} R
.dSOq
.dSOq
hsN-F%U{
hsN-F%U{
X.HIU
X.HIU
$.Ut\
$.Ut\
Ok%d $*
Ok%d $*
.py/(=
.py/(=
|q%Se
|q%Se
l.jDn
l.jDn
nuDP!
nuDP!
~
~
H.iV*i0'?
H.iV*i0'?
%XSZu*W4
%XSZu*W4
RrI.fW
RrI.fW
0%ud0
0%ud0
Zy%UF
Zy%UF
y.rug
y.rug
.kK%l
.kK%l
ez8%3u=g
ez8%3u=g
jM5`.xl
jM5`.xl
.kKW8%b
.kKW8%b
\.tPI
\.tPI
$|%SU
$|%SU
d4%f>
d4%f>
SBEW.cY
SBEW.cY
b`FLF.Ec_
b`FLF.Ec_
.cNI3
.cNI3
.AI%cl
.AI%cl
.LK9^
.LK9^
l=.RK
l=.RK
T6 .IQ
T6 .IQ
:%c.T'
:%c.T'
f%up,
f%up,
tQOw.cg
tQOw.cg
%un?2
%un?2
b.kKv
b.kKv
F:\#F
F:\#F
z2.uvIE
z2.uvIE
SE.GK8
SE.GK8
CS.JW
CS.JW
& .PQk
& .PQk
:.vNu
:.vNu
#y.nKO
#y.nKO
<.mvi>
<.mvi>
#w
#w
\.eAd
\.eAd
]7.Uq2b
]7.Uq2b
D1%FG
D1%FG
.mT j
.mT j
%U^4p
%U^4p
..iR1
..iR1
nQX-O4}&
nQX-O4}&
I.dIJ
I.dIJ
BT`%Cg
BT`%Cg
9ÃŽz
9ÃŽz
.tH55
.tH55
_Dj.vY Q
_Dj.vY Q
(.XCw
(.XCw
e%ui} t
e%ui} t
*
*
<.zb>
<.zb>
.HDn{9
.HDn{9
%D;aF,
%D;aF,
jN.prVq
jN.prVq
3;J_Wx%ut
3;J_Wx%ut
(%x.
(%x.
n;X%dWp
n;X%dWp
D%F.B
D%F.B
%d%f(
%d%f(
W]EXey
W]EXey
z!%uf
z!%uf
.CVB%
.CVB%
l _%S@
l _%S@
dSshx
dSshx
H.GL0
H.GL0
)(pöH
)(pöH
E:\QQ
E:\QQ
@-.Pn
@-.Pn
%FN0$
%FN0$
ye.vN
ye.vN
.CBE)K
.CBE)K
ZV6%Dk
ZV6%Dk
pF.yu
pF.yu
%fR)$
%fR)$
%x6YI
%x6YI
kEyp
kEyp
&TM%s
&TM%s
Tg.GD
Tg.GD
R#kEY
R#kEY
cmdv
cmdv
Q.XDu
Q.XDu
hp.zk/
hp.zk/
/yGk.Wn
/yGk.Wn
-btB}
-btB}
>%VC%fsK
>%VC%fsK
.ah~e=`}O
.ah~e=`}O
C&.VU
C&.VU
a.Ja`
a.Ja`
vsY.un
vsY.un
r?As.Yx
r?As.Yx
9.UbU
9.UbU
pl%U?
pl%U?
J.lAW
J.lAW
.VK_V
.VK_V
.MpBkX
.MpBkX
9.Owdy
9.Owdy
5b=y%u
5b=y%u
cO.sggi
cO.sggi
#NUDpj
#NUDpj
.eg\~,
.eg\~,
$%c&F;E
$%c&F;E
%h%ug
%h%ug
:!-}[t.EU=
:!-}[t.EU=
.mbgy~
.mbgy~
.Dv/y6
.Dv/y6
.LoEFu
.LoEFu
%cZvb
%cZvb
=.aG"
=.aG"
%F$Gz
%F$Gz
}x%.Gd
}x%.Gd
R.VS> "
R.VS> "
ko^L%xW
ko^L%xW
Û;h
Û;h
a2.tk
a2.tk
tA.PE-
tA.PE-
n (.mzW$
n (.mzW$
5O.drp
5O.drp
s6b%Sc
s6b%Sc
f-O}2e>
f-O}2e>
\W\<.tq>
\W\<.tq>
\m%.DN;G
\m%.DN;G
eq(%F
eq(%F
%D!`K
%D!`K
%xX,,
%xX,,
?}d.gwu
?}d.gwu
PH.DY
PH.DY
Q%D&x
Q%D&x
%C UvT
%C UvT
IÚ>
IÚ>
.pCkxk
.pCkxk
%X!yL
%X!yL
"5>\%fi
"5>\%fi
1K/L%Sc
1K/L%Sc
@j.cT^o
@j.cT^o
3.MjOB
3.MjOB
}Mg%4%D
}Mg%4%D
.QJ31
.QJ31
y!ga.vJZ
y!ga.vJZ
.rX_E
.rX_E
O%u:>1D
O%u:>1D
W.qO;
W.qO;
*.*[$
*.*[$
%XyIR1
%XyIR1
'q.Ha@
'q.Ha@
]E.NE
]E.NE
%Uz=%
%Uz=%
>E!:.lL-
>E!:.lL-
YW.QM
YW.QM
.Bxx^G>
.Bxx^G>
]B.aZ
]B.aZ
x.Nq
x.Nq
[tj%Xa
[tj%Xa
Y(.WJ
Y(.WJ
(.rBE
(.rBE
U%x]|X|XZ
U%x]|X|XZ
%C#"KN
%C#"KN
.DzNhf6
.DzNhf6
&.BzZ
&.BzZ
m.lP/
m.lP/
Z/*.dD4p
Z/*.dD4p
i.Chp
i.Chp
vWjp%SA
vWjp%SA
7.RK5
7.RK5
r%s?z
r%s?z
Ssh6d
Ssh6d
^.mcV
^.mcV
P2.kGy
P2.kGy
JY.HnN
JY.HnN
ue.Se
ue.Se
.Is~W
.Is~W
yË|oh
yË|oh
y{.Ih
y{.Ih
e.Nde
e.Nde
.jq/r
.jq/r
.uVwv
.uVwv
1.oFb
1.oFb
I!\6w2.BW
I!\6w2.BW
hf.NA
hf.NA
*".gf$
*".gf$
.lZB=
.lZB=
..rP~
..rP~
'15%F>
'15%F>
W%.KP
W%.KP
;.Ryn/
;.Ryn/
h.bBCZ9
h.bBCZ9
k%%D)w
k%%D)w
.XhZzS(
.XhZzS(
8.ZQ'
8.ZQ'
.frQmq
.frQmq
=.Eka%
=.Eka%
.VsF
.VsF
9fs%F
9fs%F
.xGuY
.xGuY
.hfVZam
.hfVZam
1o% ]%X
1o% ]%X
G.lM5z
G.lM5z
Q$%FG
Q$%FG
|%f=p
|%f=p
e[*%D
e[*%D
U,4>%d
U,4>%d
$c..Lq
$c..Lq
-f$hO%S
-f$hO%S
E[>{Z%F
E[>{Z%F
%X9e\
%X9e\
:.jG.
:.jG.
1Ul%x
1Ul%x
/f.cHy
/f.cHy
g%u[Q&
g%u[Q&
9;.aU
9;.aU
;m'%F
;m'%F
L&
L&
NG5%x;
NG5%x;
Wa.Di
Wa.Di
.Bw8r
.Bw8r
.Ec f
.Ec f
^_.Df
^_.Df
i%CHJ
i%CHJ
9.fft
9.fft
2z.lU=
2z.lU=
~M%xe
~M%xe
D.aF8s
D.aF8s
.mZmW~
.mZmW~
b4OU%D
b4OU%D
$-xX}
$-xX}
{[;%F
{[;%F
kic%X
kic%X
zu.cb
zu.cb
@G.lh
@G.lh
gk%s
gk%s
7.GAk
7.GAk
K=.RD
K=.RD
n2^o
n2^o
xN[.vu
xN[.vu
{n5,%d
{n5,%d
S.azC4
S.azC4
bl.jVI
bl.jVI
fZ.FM
fZ.FM
.knt(
.knt(
.uzn|08
.uzn|08
.qC2
.qC2
C%dlh
C%dlh
gc%uz-
gc%uz-
Ix&Z%uHD
Ix&Z%uHD
.CWr^w
.CWr^w
3.bpd
3.bpd
L.ak^
L.ak^
.k%Fg
.k%Fg
K$.bw
K$.bw
.Sld&J
.Sld&J
n.vUg
n.vUg
a.mS_
a.mS_
)[2.TxP
)[2.TxP
.%S'p$F
.%S'p$F
V73.Sk
V73.Sk
-bNU}
-bNU}
u %c%M
u %c%M
..Rz%
..Rz%
gzl%xO
gzl%xO
i`.QC
i`.QC
F/.bb
F/.bb
%U>v%
%U>v%
k%uGV
k%uGV
%u!w>i
%u!w>i
|Uw^.fT
|Uw^.fT
!%S4s
!%S4s
MUj.AF
MUj.AF
{$Ã
{$Ã
pAr%d-
pAr%d-
.KmVX{
.KmVX{
#(.lV
#(.lV
{.Nc3
{.Nc3
KO.We
KO.We
:-QEX.BU
:-QEX.BU
l5:
l5:
Ôb~
Ôb~
.PEJl
.PEJl
olB
olB
8&n@.Xe
8&n@.Xe
|k-Q}
|k-Q}
d%d!m
d%d!m
F%uo
F%uo
#.ibEd
#.ibEd
3%Xv0s
3%Xv0s
[4 ?.YW
[4 ?.YW
FtPa
FtPa
s.sd~
s.sd~
.rPV6k$
.rPV6k$
.GLxQg
.GLxQg
.Sfb>
.Sfb>
%URC=
%URC=
d%.KS-
d%.KS-
,%U c
,%U c
0p.Aq
0p.Aq
l>.Rl
l>.Rl
1ki.Mg
1ki.Mg
.NB%*
.NB%*
;S%x%T
;S%x%T
F\.ue
F\.ue
.aO^.s>
.aO^.s>
.Xf s|;
.Xf s|;
.VdP=
.VdP=
S.zy;
S.zy;
e}%s#;
e}%s#;
m.RT
m.RT
ðIm
ðIm
..RTH
..RTH
.pKpaX
.pKpaX
U-.sr
U-.sr
T2%UN
T2%UN
&a.Os
&a.Os
.jgZok
.jgZok
{n%fPym
{n%fPym
/Cj~.YD
/Cj~.YD
!E.ky
!E.ky
.vQ[M
.vQ[M
Hua~%S r
Hua~%S r
~ .cw
~ .cw
.vIXff
.vIXff
!z6'.LD
!z6'.LD
_.xQ'
_.xQ'
V.rX{
V.rX{
)xPp%D
)xPp%D
1.hIe
1.hIe
N..JF"b^wN#
N..JF"b^wN#
.OL
.OL
ûp U
ûp U
cq.OT
cq.OT
.LjVZ
.LjVZ
.jN_Q
.jN_Q
LYs8.pr
LYs8.pr
.Tkwt7z
.Tkwt7z
PfTp0
PfTp0
8E.CI
8E.CI
.hL\39
.hL\39
5Y7%F
5Y7%F
C%8UF
C%8UF
gV%xMLc
gV%xMLc
i^.AAE
i^.AAE
Vc.en
Vc.en
_V2.oPC&
_V2.oPC&
^]-Y}
^]-Y}
r.fo7=}m
r.fo7=}m
.ldEJ
.ldEJ
S{Eu%D
S{Eu%D
n.yoM
n.yoM
%D!Dl
%D!Dl
k%X&a
k%X&a
$%X0B
$%X0B
g3}
g3}
%F\
%F\
%x1'"
%x1'"
zFTP
zFTP
US.pGc
US.pGc
.vJMI
.vJMI
T2.el
T2.el
$%.zf
$%.zf
5\5?5.5:50
5\5?5.5:50
uvÅ’B
uvÅ’B
%\V<.tf>
%\V<.tf>
.act_
.act_
%C;R@
%C;R@
P&4K%S
P&4K%S
0S.cy?)G
0S.cy?)G
#.$;';)@
#.$;';)@
.Xf]U
.Xf]U
tQ>%x
tQ>%x
0u.oAP
0u.oAP
.wz{h_Vc
.wz{h_Vc
.Mb[|
.Mb[|
2Yg/D%S
2Yg/D%S
-1pd}
-1pd}
#HF%xX.
#HF%xX.
"#.md
"#.md
%UZ5=
%UZ5=
O%d,w
O%d,w
@@@@.As
@@@@.As
k.aIh
k.aIh
~S3%c
~S3%c
w.apsQ_
w.apsQ_
,p%F/zE
,p%F/zE
%U/&!ru
%U/&!ru
P.MF
P.MF
_7%cg?
_7%cg?
\*%UG
\*%UG
$Y%x$
$Y%x$
w.II"!,
w.II"!,
.Qtd@
.Qtd@
=A1%sgu
=A1%sgu
.zNKZ
.zNKZ
(%XZG$
(%XZG$
%x
%x
\.OyX
\.OyX
.xGDB{
.xGDB{
[.fod
[.fod
u-o}k
u-o}k
!| Ev@l%x
!| Ev@l%x
.AVW,
.AVW,
\.RbC
\.RbC
-n.mb
-n.mb
op}{%c
op}{%c
7&.gr_
7&.gr_
e/x.uu?
e/x.uu?
G%u9/e
G%u9/e
\@W.cC
\@W.cC
"Q.Qq
"Q.Qq
/.Hk*
/.Hk*
Di.kLJ
Di.kLJ
N.LK*
N.LK*
.MN:un
.MN:un
.JS_J
.JS_J
-v.AB@
-v.AB@
LK.ay
LK.ay
2=.nU
2=.nU
}õ;#
}õ;#
.wwwwwwww`w
.wwwwwwww`w
;:f%c
;:f%c
C!.iT
C!.iT
MO..ZH
MO..ZH
.EA0p
.EA0p
vg%uFGd
vg%uFGd
&I.UR
&I.UR
;.ce-
;.ce-
AHm%D
AHm%D
Mg%u>
Mg%u>
M%0s
M%0s
.xFyZ
.xFyZ
D|%x$K
D|%x$K
Ec.yj
Ec.yj
S.Lk!u"~
S.Lk!u"~
[R.aC
[R.aC
AZ#5.ZN
AZ#5.ZN
-q}:"
-q}:"
Ln%Sw
Ln%Sw
iW%dM
iW%dM
:.qhlVfi
:.qhlVfi
| %SZQ0
| %SZQ0
ac%U T
ac%U T
7S.tJM
7S.tJM
6K.tm
6K.tm
.pLjxO
.pLjxO
8]R.vd
8]R.vd
"j.hu
"j.hu
}1kÃ
}1kÃ
X.ZP_G
X.ZP_G
6 \r
6 \r
%x~{d
%x~{d
&kj%sO)
&kj%sO)
.WS1s
.WS1s
.Dwi^
.Dwi^
^.jY.zr
^.jY.zr
s.CELM
s.CELM
nE.GD
nE.GD
jyy.Er7{
jyy.Er7{
#].nv
#].nv
z .eJ
z .eJ
.DBd1[
.DBd1[
9.Fl#}
9.Fl#}
V#.mp
V#.mp
%C@K'
%C@K'
.kJ*A
.kJ*A
{1.cu
{1.cu
.ByYk
.ByYk
UA.jZ
UA.jZ
.cr`5]
.cr`5]
1^Tzo
1^Tzo
xq.Iuj
xq.Iuj
299.Ai
299.Ai
T)%u=Q
T)%u=Q
E.jKk
E.jKk
>O~
>O~
.jvoB
.jvoB
8.zO&T
8.zO&T
.xbF!
.xbF!
i %s|
i %s|
O?Ce.Ih
O?Ce.Ih
s3%d(
s3%d(
0.hv4
0.hv4
þ(#
þ(#
@7%x8
@7%x8
1%f$uqr
1%f$uqr
WQm
WQm
bX%U=]
bX%U=]
mj.nm
mj.nm
]9.jDmI
]9.jDmI
z%Cga(
z%Cga(
r|5.VZ
r|5.VZ
lO.pT
lO.pT
J[m%CR
J[m%CR
.wgaR
.wgaR
%.bB^
%.bB^
\X.Vo
\X.Vo
&U(.fR
&U(.fR
a.xxPZ
a.xxPZ
.RejS
.RejS
.hMdzC
.hMdzC
%9UGl*
%9UGl*
-{.rK
-{.rK
-Op}o
-Op}o
.eOG8Yt
.eOG8Yt
wEbM
wEbM
`0818%8!*
`0818%8!*
QHX5g.qe
QHX5g.qe
q&A.RSU
q&A.RSU
I%.Ar\
I%.Ar\
ZB.ur
ZB.ur
\mc%x
\mc%x
j,Ã’
j,Ã’
b_%uF
b_%uF
A>%F ;
A>%F ;
.KuAC
.KuAC
R"~.QA
R"~.QA
%X-Wd
%X-Wd
-v4}I2
-v4}I2
.iYf$
.iYf$
gTexE
gTexE
/-1v}
/-1v}
ls.yM
ls.yM
]DD.SU
]DD.SU
U&%SG
U&%SG
,Y^%%UN
,Y^%%UN
X*%sf
X*%sf
%Å’|
%Å’|
5N.zb
5N.zb
(udpb
(udpb
d.TL^
d.TL^
lftp
lftp
o>M%%U7
o>M%%U7
.TOv`g
.TOv`g
1b.mL
1b.mL
525
525
:%SqN
:%SqN
%DOJw
%DOJw
!b*C.kR*
!b*C.kR*
.By9h_
.By9h_
.azzm
.azzm
b%ukY`
b%ukY`
xB-i}
xB-i}
eul-
eul-
?hD0%c
?hD0%c
".bggo
".bggo
%S/6gbM
%S/6gbM
p"$.vB
p"$.vB
1Ã…4
1Ã…4
f.DaifL*
f.DaifL*
t~=v%S."
t~=v%S."
1.zQXa
1.zQXa
$c%u7
$c%u7
G?J
G?J
ue
ue
%D-2yx
%D-2yx
6q)%F
6q)%F
>>@.Eal
>>@.Eal
".yUH
".yUH
6,$=%X
6,$=%X
::%d_
::%d_
j%dp\
j%dp\
1n.Vz
1n.Vz
Ye.lG
Ye.lG
O8O
O8O
M^v%X
M^v%X
!.NE&
!.NE&
/T)J%c
/T)J%c
Tu, .ua
Tu, .ua
i.lNG
i.lNG
{,.yC
{,.yC
/ .An
/ .An
w.OP0@
w.OP0@
{.FAz
{.FAz
Ko%uR
Ko%uR
%So&yk
%So&yk
S.OHNR
S.OHNR
C.HQ6Dk
C.HQ6Dk
.pJ2S:
.pJ2S:
dzœ
dzœ
`%7XE
`%7XE
"H%Xz:J/|C
"H%Xz:J/|C
%S$RK
%S$RK
7N$%c
7N$%c
W%C]ei
W%C]ei
d-wQ}
d-wQ}
O_9%Fq
O_9%Fq
IL.rK
IL.rK
%f"nf
%f"nf
H|D%c
H|D%c
K%7sW
K%7sW
Y.yi8
Y.yi8
Z.zZ6;X
Z.zZ6;X
gV.fp
gV.fp
~-M}
~-M}
urI.;%F
urI.;%F
=.KpJ@
=.KpJ@
|.PXm
|.PXm
=%XFJ{
=%XFJ{
9g6.yu5
9g6.yu5
8>%xV
8>%xV
.DH.2
.DH.2
s`tS-C}
s`tS-C}
R.rxtqE="n
R.rxtqE="n
F.Cky"
F.Cky"
.cXEd
.cXEd
Bh'.Ck1
Bh'.Ck1
R.ee:dNx
R.ee:dNx
I5[%S
I5[%S
U5g--Z}
U5g--Z}
~Y%SY
~Y%SY
6.oHoTn
6.oHoTn
(gSqL
(gSqL
@%C%E%
@%C%E%
CMd0Z
CMd0Z
K-.wS$r
K-.wS$r
m$].wp.
m$].wp.
(C.SG
(C.SG
A!N'%u
A!N'%u
%syePt
%syePt
%u_JA
%u_JA
%3XJ?
%3XJ?
gV&.tp(
gV&.tp(
f-.tua
f-.tua
}o.Fd
}o.Fd
%xm_a/
%xm_a/
E-Tl}
E-Tl}
EZG%X
EZG%X
}.ow.
}.ow.
m=.Up]
m=.Up]
.gB5Dn
.gB5Dn
l.Pe1
l.Pe1
%dh:IN)-
%dh:IN)-
V.pzvq
V.pzvq
:O.ra
:O.ra
u.Wz/
u.Wz/
.Nc[S
.Nc[S
Ze.vf
Ze.vf
..pon
..pon
=fP.KBr
=fP.KBr
P%xy-_
P%xy-_
R%FP(Q
R%FP(Q
.aGWYb
.aGWYb
8`%S.
8`%S.
.NBYb
.NBYb
U.qcD
U.qcD
X$%c)
X$%c)
^msgj7
^msgj7
.beVOd
.beVOd
.cwydm
.cwydm
%XB`.s
%XB`.s
%uf9r
%uf9r
.lfjR
.lfjR
.HKl4G;
.HKl4G;
m%dy5
m%dy5
7Þ1
7Þ1
%Dw"l
%Dw"l
$WL`D
$WL`D
B.OYXh1^
B.OYXh1^
T.Os;b
T.Os;b
.bGvW
.bGvW
z1#%sO
z1#%sO
|.LCe
|.LCe
..bWL
..bWL
'}Dp%X
'}Dp%X
j[ftpV~x
j[ftpV~x
-ùh
-ùh
T%C\l
T%C\l
quDP`5!
quDP`5!
tcP2sd
tcP2sd
D}.BM
D}.BM
S;.QvS`
S;.QvS`
%U{[7
%U{[7
%ct.Y
%ct.Y
E%s%V
E%s%V
-y%S;O
-y%S;O
.USp!s
.USp!s
.mxz*
.mxz*
USER32.DLL
USER32.DLL
ADVAPI32.DLL
ADVAPI32.DLL
MPR.DLL
MPR.DLL
WSOCK32.DLL
WSOCK32.DLL
SHELL32.DLL
SHELL32.DLL
hXXp://vguarder.91i.net/user.htm
hXXp://vguarder.91i.net/user.htm
hXXp://vguarder.bravehost.com/user.htm
hXXp://vguarder.bravehost.com/user.htm
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WinExec
WinExec
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
RegOpenKeyA
RegOpenKeyA
ShellExecuteA
ShellExecuteA
\setupx.exe
\setupx.exe
\updatex.exe
\updatex.exe
\Serverx.exe
\Serverx.exe
=.exet
=.exet
=.scrt
=.scrt
.idata
.idata
.reloc
.reloc
KERNEL32.dll
KERNEL32.dll
A.HK30
A.HK30
1.4.3
1.4.3
adb-installer-1.4.3.exe
adb-installer-1.4.3.exe
%original file name%.exe_928_rwx_004B8000_00001000:
KERNEL32.DLL
KERNEL32.DLL
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
GDI32.dll
GDI32.dll
MSVCRT.dll
MSVCRT.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
SHELL32.dll
SHELL32.dll
USER32.dll
USER32.dll
1.4.3
1.4.3
adb-installer-1.4.3.exe
adb-installer-1.4.3.exe
%original file name%.exe_928_rwx_00D95000_00002000:
\updatex.exe
\updatex.exe
\Serverx.exe
\Serverx.exe
=.exet
=.exet
=.scrt
=.scrt
.idata
.idata
.reloc
.reloc
KERNEL32.dll
KERNEL32.dll
USER32.DLL
USER32.DLL
ADVAPI32.DLL
ADVAPI32.DLL
MPR.DLL
MPR.DLL
WSOCK32.DLL
WSOCK32.DLL
SHELL32.DLL
SHELL32.DLL
hXXp://vguarder.91i.net/user.htm
hXXp://vguarder.91i.net/user.htm
hXXp://vguarder.bravehost.com/user.htm
hXXp://vguarder.bravehost.com/user.htm
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WinExec
WinExec
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
RegOpenKeyA
RegOpenKeyA
ShellExecuteA
ShellExecuteA
\setupx.exe
\setupx.exe
%original file name%.exe_1504:
!Require Windows
!Require Windows
`.rsrc
`.rsrc
PSSSSSSh
PSSSSSSh
ttNt_Nt.Nt
ttNt_Nt.Nt
:Language:%u
:Language:%u
Enter password:
Enter password:
0xx
0xx
"%s".
"%s".
Could not overwrite file "%s".
Could not overwrite file "%s".
Could not create file "%s".
Could not create file "%s".
0xX.
0xX.
7-Zip: Internal error, code 0xX.
7-Zip: Internal error, code 0xX.
7-Zip: Internal error, code %u.
7-Zip: Internal error, code %u.
The archive is corrupted, or invalid password was entered.
The archive is corrupted, or invalid password was entered.
7-Zip: Unsupported method.
7-Zip: Unsupported method.
Error during execution "%s".
Error during execution "%s".
"setup.exe"
"setup.exe"
Could not find "setup.exe".
Could not find "setup.exe".
Could not find command for "%s".
Could not find command for "%s".
Could not delete file or folder "%s".
Could not delete file or folder "%s".
Could not create folder "%s".
Could not create folder "%s".
Error in line %d of configuration data:
Error in line %d of configuration data:
Could not open archive file "%s".
Could not open archive file "%s".
1.6.0 develop [x86]
1.6.0 develop [x86]
2712 (30
2712 (30
1.6.0 develop [x86] build 2712 (December 30, 2012)
1.6.0 develop [x86] build 2712 (December 30, 2012)
Supported methods and filters, build options:
Supported methods and filters, build options:
Sorry, this program requires Microsoft Windows 2000 or later.
Sorry, this program requires Microsoft Windows 2000 or later.
CreateIoCompletionPort
CreateIoCompletionPort
_acmdln
_acmdln
ShellExecuteW
ShellExecuteW
ShellExecuteExW
ShellExecuteExW
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExW
SetWindowsHookExW
GetKeyState
GetKeyState
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
.NNNNNNNNNNNNNNNN
.NNNNNNNNNNNNNNNN
.NNNNNNNNNNNNNNN
.NNNNNNNNNNNNNNN
KERNEL32.DLL
KERNEL32.DLL
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
GDI32.dll
GDI32.dll
MSVCRT.dll
MSVCRT.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
SHELL32.dll
SHELL32.dll
USER32.dll
USER32.dll
RunProgram="waitall:install.bat"
RunProgram="waitall:install.bat"
'K.Jj
'K.Jj
M.oU)
M.oU)
.pefl
.pefl
.Bo%R
.Bo%R
.CwbR
.CwbR
p;g%C
p;g%C
h.fE$=]
h.fE$=]
rH.rW
rH.rW
.aw$T
.aw$T
-t.jq
-t.jq
b %CtK
b %CtK
oM.zS
oM.zS
c 9%D*J=
c 9%D*J=
.zw-9K)
.zw-9K)
{].zmN0
{].zmN0
87.Fb
87.Fb
K-tR}
K-tR}
%Ure.
%Ure.
(..HH
(..HH
S%8Si
S%8Si
%fJrw
%fJrw
mw8.KZ2
mw8.KZ2
/C0%U@
/C0%U@
.GnH0WoK*VXvrQ
.GnH0WoK*VXvrQ
.Hl>md
.Hl>md
.zhPi
.zhPi
\%uFF
\%uFF
Ftp0r?(
Ftp0r?(
HK.lY
HK.lY
!.HR
!.HR
.DTf(
.DTf(
Ihpw.NP
Ihpw.NP
'>7$%d
'>7$%d
,e.MFM3
,e.MFM3
d.Dw i
d.Dw i
y7.SE-
y7.SE-
|0.NGZ
|0.NGZ
ca%sW
ca%sW
9H.wl
9H.wl
UG4%f
UG4%f
z.Ssu'
z.Ssu'
s-n%u
s-n%u
8v.BC4E
8v.BC4E
2.SUO
2.SUO
-5TQs}
-5TQs}
zN.Zz
zN.Zz
E[%c_
E[%c_
W9-xK.YT
W9-xK.YT
TM4%D
TM4%D
(E%F#
(E%F#
P.ol\ko
P.ol\ko
=:g*(
=:g*(
HA;%cw
HA;%cw
^.wOW
^.wOW
Q8A~X .Dir
Q8A~X .Dir
_&.lb
_&.lb
.nFnA
.nFnA
O%3Un
O%3Un
.aQnX
.aQnX
pPSkJþ
pPSkJþ
2zycMd
2zycMd
!;-c}-M
!;-c}-M
v.oJ8
v.oJ8
y.Wr,
y.Wr,
P.NWf
P.NWf
A%svd^
A%svd^
[]v%x
[]v%x
c[.XN
c[.XN
>%uZO
>%uZO
.Fy%H
.Fy%H
{k%C(h.
{k%C(h.
`.wrM
`.wrM
'!.Ap
'!.Ap
/ .xy:1>u
/ .xy:1>u
nn`Ú?
nn`Ú?
=.cxFkm
=.cxFkm
NL%FI
NL%FI
G%U} R
G%U} R
.dSOq
.dSOq
hsN-F%U{
hsN-F%U{
X.HIU
X.HIU
$.Ut\
$.Ut\
Ok%d $*
Ok%d $*
.py/(=
.py/(=
|q%Se
|q%Se
l.jDn
l.jDn
nuDP!
nuDP!
~
~
H.iV*i0'?
H.iV*i0'?
%XSZu*W4
%XSZu*W4
RrI.fW
RrI.fW
0%ud0
0%ud0
Zy%UF
Zy%UF
y.rug
y.rug
.kK%l
.kK%l
ez8%3u=g
ez8%3u=g
jM5`.xl
jM5`.xl
.kKW8%b
.kKW8%b
\.tPI
\.tPI
$|%SU
$|%SU
d4%f>
d4%f>
SBEW.cY
SBEW.cY
b`FLF.Ec_
b`FLF.Ec_
.cNI3
.cNI3
.AI%cl
.AI%cl
.LK9^
.LK9^
l=.RK
l=.RK
T6 .IQ
T6 .IQ
:%c.T'
:%c.T'
f%up,
f%up,
tQOw.cg
tQOw.cg
%un?2
%un?2
b.kKv
b.kKv
F:\#F
F:\#F
z2.uvIE
z2.uvIE
SE.GK8
SE.GK8
CS.JW
CS.JW
& .PQk
& .PQk
:.vNu
:.vNu
#y.nKO
#y.nKO
<.mvi>
<.mvi>
#w
#w
\.eAd
\.eAd
]7.Uq2b
]7.Uq2b
D1%FG
D1%FG
.mT j
.mT j
%U^4p
%U^4p
..iR1
..iR1
nQX-O4}&
nQX-O4}&
I.dIJ
I.dIJ
BT`%Cg
BT`%Cg
9ÃŽz
9ÃŽz
.tH55
.tH55
_Dj.vY Q
_Dj.vY Q
(.XCw
(.XCw
e%ui} t
e%ui} t
*
*
<.zb>
<.zb>
.HDn{9
.HDn{9
%D;aF,
%D;aF,
jN.prVq
jN.prVq
3;J_Wx%ut
3;J_Wx%ut
(%x.
(%x.
n;X%dWp
n;X%dWp
D%F.B
D%F.B
%d%f(
%d%f(
W]EXey
W]EXey
z!%uf
z!%uf
.CVB%
.CVB%
l _%S@
l _%S@
dSshx
dSshx
H.GL0
H.GL0
)(pöH
)(pöH
E:\QQ
E:\QQ
@-.Pn
@-.Pn
%FN0$
%FN0$
ye.vN
ye.vN
.CBE)K
.CBE)K
ZV6%Dk
ZV6%Dk
pF.yu
pF.yu
%fR)$
%fR)$
%x6YI
%x6YI
kEyp
kEyp
&TM%s
&TM%s
Tg.GD
Tg.GD
R#kEY
R#kEY
cmdv
cmdv
Q.XDu
Q.XDu
hp.zk/
hp.zk/
/yGk.Wn
/yGk.Wn
-btB}
-btB}
>%VC%fsK
>%VC%fsK
.ah~e=`}O
.ah~e=`}O
C&.VU
C&.VU
a.Ja`
a.Ja`
vsY.un
vsY.un
r?As.Yx
r?As.Yx
9.UbU
9.UbU
pl%U?
pl%U?
J.lAW
J.lAW
.VK_V
.VK_V
.MpBkX
.MpBkX
9.Owdy
9.Owdy
5b=y%u
5b=y%u
cO.sggi
cO.sggi
#NUDpj
#NUDpj
.eg\~,
.eg\~,
$%c&F;E
$%c&F;E
%h%ug
%h%ug
:!-}[t.EU=
:!-}[t.EU=
.mbgy~
.mbgy~
.Dv/y6
.Dv/y6
.LoEFu
.LoEFu
%cZvb
%cZvb
=.aG"
=.aG"
%F$Gz
%F$Gz
}x%.Gd
}x%.Gd
R.VS> "
R.VS> "
ko^L%xW
ko^L%xW
Û;h
Û;h
a2.tk
a2.tk
tA.PE-
tA.PE-
n (.mzW$
n (.mzW$
5O.drp
5O.drp
s6b%Sc
s6b%Sc
f-O}2e>
f-O}2e>
\W\<.tq>
\W\<.tq>
\m%.DN;G
\m%.DN;G
eq(%F
eq(%F
%D!`K
%D!`K
%xX,,
%xX,,
?}d.gwu
?}d.gwu
PH.DY
PH.DY
Q%D&x
Q%D&x
%C UvT
%C UvT
IÚ>
IÚ>
.pCkxk
.pCkxk
%X!yL
%X!yL
"5>\%fi
"5>\%fi
1K/L%Sc
1K/L%Sc
@j.cT^o
@j.cT^o
3.MjOB
3.MjOB
}Mg%4%D
}Mg%4%D
.QJ31
.QJ31
y!ga.vJZ
y!ga.vJZ
.rX_E
.rX_E
O%u:>1D
O%u:>1D
W.qO;
W.qO;
*.*[$
*.*[$
%XyIR1
%XyIR1
'q.Ha@
'q.Ha@
]E.NE
]E.NE
%Uz=%
%Uz=%
>E!:.lL-
>E!:.lL-
YW.QM
YW.QM
.Bxx^G>
.Bxx^G>
]B.aZ
]B.aZ
x.Nq
x.Nq
[tj%Xa
[tj%Xa
Y(.WJ
Y(.WJ
(.rBE
(.rBE
U%x]|X|XZ
U%x]|X|XZ
%C#"KN
%C#"KN
.DzNhf6
.DzNhf6
&.BzZ
&.BzZ
m.lP/
m.lP/
Z/*.dD4p
Z/*.dD4p
i.Chp
i.Chp
vWjp%SA
vWjp%SA
7.RK5
7.RK5
r%s?z
r%s?z
Ssh6d
Ssh6d
^.mcV
^.mcV
P2.kGy
P2.kGy
JY.HnN
JY.HnN
ue.Se
ue.Se
.Is~W
.Is~W
yË|oh
yË|oh
y{.Ih
y{.Ih
e.Nde
e.Nde
.jq/r
.jq/r
.uVwv
.uVwv
1.oFb
1.oFb
I!\6w2.BW
I!\6w2.BW
hf.NA
hf.NA
*".gf$
*".gf$
.lZB=
.lZB=
..rP~
..rP~
'15%F>
'15%F>
W%.KP
W%.KP
;.Ryn/
;.Ryn/
h.bBCZ9
h.bBCZ9
k%%D)w
k%%D)w
.XhZzS(
.XhZzS(
8.ZQ'
8.ZQ'
.frQmq
.frQmq
=.Eka%
=.Eka%
.VsF
.VsF
9fs%F
9fs%F
.xGuY
.xGuY
.hfVZam
.hfVZam
1o% ]%X
1o% ]%X
G.lM5z
G.lM5z
Q$%FG
Q$%FG
|%f=p
|%f=p
e[*%D
e[*%D
U,4>%d
U,4>%d
$c..Lq
$c..Lq
-f$hO%S
-f$hO%S
E[>{Z%F
E[>{Z%F
%X9e\
%X9e\
:.jG.
:.jG.
1Ul%x
1Ul%x
/f.cHy
/f.cHy
g%u[Q&
g%u[Q&
9;.aU
9;.aU
;m'%F
;m'%F
L&
L&
NG5%x;
NG5%x;
Wa.Di
Wa.Di
.Bw8r
.Bw8r
.Ec f
.Ec f
^_.Df
^_.Df
i%CHJ
i%CHJ
9.fft
9.fft
2z.lU=
2z.lU=
~M%xe
~M%xe
D.aF8s
D.aF8s
.mZmW~
.mZmW~
b4OU%D
b4OU%D
$-xX}
$-xX}
{[;%F
{[;%F
kic%X
kic%X
zu.cb
zu.cb
@G.lh
@G.lh
gk%s
gk%s
7.GAk
7.GAk
K=.RD
K=.RD
n2^o
n2^o
xN[.vu
xN[.vu
{n5,%d
{n5,%d
S.azC4
S.azC4
bl.jVI
bl.jVI
fZ.FM
fZ.FM
.knt(
.knt(
.uzn|08
.uzn|08
.qC2
.qC2
C%dlh
C%dlh
gc%uz-
gc%uz-
Ix&Z%uHD
Ix&Z%uHD
.CWr^w
.CWr^w
3.bpd
3.bpd
L.ak^
L.ak^
.k%Fg
.k%Fg
K$.bw
K$.bw
.Sld&J
.Sld&J
n.vUg
n.vUg
a.mS_
a.mS_
)[2.TxP
)[2.TxP
.%S'p$F
.%S'p$F
V73.Sk
V73.Sk
-bNU}
-bNU}
u %c%M
u %c%M
..Rz%
..Rz%
gzl%xO
gzl%xO
i`.QC
i`.QC
F/.bb
F/.bb
%U>v%
%U>v%
k%uGV
k%uGV
%u!w>i
%u!w>i
|Uw^.fT
|Uw^.fT
!%S4s
!%S4s
MUj.AF
MUj.AF
{$Ã
{$Ã
pAr%d-
pAr%d-
.KmVX{
.KmVX{
#(.lV
#(.lV
{.Nc3
{.Nc3
KO.We
KO.We
:-QEX.BU
:-QEX.BU
l5:
l5:
Ôb~
Ôb~
.PEJl
.PEJl
olB
olB
8&n@.Xe
8&n@.Xe
|k-Q}
|k-Q}
d%d!m
d%d!m
F%uo
F%uo
#.ibEd
#.ibEd
3%Xv0s
3%Xv0s
[4 ?.YW
[4 ?.YW
FtPa
FtPa
s.sd~
s.sd~
.rPV6k$
.rPV6k$
.GLxQg
.GLxQg
.Sfb>
.Sfb>
%URC=
%URC=
d%.KS-
d%.KS-
,%U c
,%U c
0p.Aq
0p.Aq
l>.Rl
l>.Rl
1ki.Mg
1ki.Mg
.NB%*
.NB%*
;S%x%T
;S%x%T
F\.ue
F\.ue
.aO^.s>
.aO^.s>
.Xf s|;
.Xf s|;
.VdP=
.VdP=
S.zy;
S.zy;
e}%s#;
e}%s#;
m.RT
m.RT
ðIm
ðIm
..RTH
..RTH
.pKpaX
.pKpaX
U-.sr
U-.sr
T2%UN
T2%UN
&a.Os
&a.Os
.jgZok
.jgZok
{n%fPym
{n%fPym
/Cj~.YD
/Cj~.YD
!E.ky
!E.ky
.vQ[M
.vQ[M
Hua~%S r
Hua~%S r
~ .cw
~ .cw
.vIXff
.vIXff
!z6'.LD
!z6'.LD
_.xQ'
_.xQ'
V.rX{
V.rX{
)xPp%D
)xPp%D
1.hIe
1.hIe
N..JF"b^wN#
N..JF"b^wN#
.OL
.OL
ûp U
ûp U
cq.OT
cq.OT
.LjVZ
.LjVZ
.jN_Q
.jN_Q
LYs8.pr
LYs8.pr
.Tkwt7z
.Tkwt7z
PfTp0
PfTp0
8E.CI
8E.CI
.hL\39
.hL\39
5Y7%F
5Y7%F
C%8UF
C%8UF
gV%xMLc
gV%xMLc
i^.AAE
i^.AAE
Vc.en
Vc.en
_V2.oPC&
_V2.oPC&
^]-Y}
^]-Y}
r.fo7=}m
r.fo7=}m
.ldEJ
.ldEJ
S{Eu%D
S{Eu%D
n.yoM
n.yoM
%D!Dl
%D!Dl
k%X&a
k%X&a
$%X0B
$%X0B
g3}
g3}
%F\
%F\
%x1'"
%x1'"
zFTP
zFTP
US.pGc
US.pGc
.vJMI
.vJMI
T2.el
T2.el
$%.zf
$%.zf
5\5?5.5:50
5\5?5.5:50
uvÅ’B
uvÅ’B
%\V<.tf>
%\V<.tf>
.act_
.act_
%C;R@
%C;R@
P&4K%S
P&4K%S
0S.cy?)G
0S.cy?)G
#.$;';)@
#.$;';)@
.Xf]U
.Xf]U
tQ>%x
tQ>%x
0u.oAP
0u.oAP
.wz{h_Vc
.wz{h_Vc
.Mb[|
.Mb[|
2Yg/D%S
2Yg/D%S
-1pd}
-1pd}
#HF%xX.
#HF%xX.
"#.md
"#.md
%UZ5=
%UZ5=
O%d,w
O%d,w
@@@@.As
@@@@.As
k.aIh
k.aIh
~S3%c
~S3%c
w.apsQ_
w.apsQ_
,p%F/zE
,p%F/zE
%U/&!ru
%U/&!ru
P.MF
P.MF
_7%cg?
_7%cg?
\*%UG
\*%UG
$Y%x$
$Y%x$
w.II"!,
w.II"!,
.Qtd@
.Qtd@
=A1%sgu
=A1%sgu
.zNKZ
.zNKZ
(%XZG$
(%XZG$
%x
%x
\.OyX
\.OyX
.xGDB{
.xGDB{
[.fod
[.fod
u-o}k
u-o}k
!| Ev@l%x
!| Ev@l%x
.AVW,
.AVW,
\.RbC
\.RbC
-n.mb
-n.mb
op}{%c
op}{%c
7&.gr_
7&.gr_
e/x.uu?
e/x.uu?
G%u9/e
G%u9/e
\@W.cC
\@W.cC
"Q.Qq
"Q.Qq
/.Hk*
/.Hk*
Di.kLJ
Di.kLJ
N.LK*
N.LK*
.MN:un
.MN:un
.JS_J
.JS_J
-v.AB@
-v.AB@
LK.ay
LK.ay
2=.nU
2=.nU
}õ;#
}õ;#
.wwwwwwww`w
.wwwwwwww`w
;:f%c
;:f%c
C!.iT
C!.iT
MO..ZH
MO..ZH
.EA0p
.EA0p
vg%uFGd
vg%uFGd
&I.UR
&I.UR
;.ce-
;.ce-
AHm%D
AHm%D
Mg%u>
Mg%u>
M%0s
M%0s
.xFyZ
.xFyZ
D|%x$K
D|%x$K
Ec.yj
Ec.yj
S.Lk!u"~
S.Lk!u"~
[R.aC
[R.aC
AZ#5.ZN
AZ#5.ZN
-q}:"
-q}:"
Ln%Sw
Ln%Sw
iW%dM
iW%dM
:.qhlVfi
:.qhlVfi
| %SZQ0
| %SZQ0
ac%U T
ac%U T
7S.tJM
7S.tJM
6K.tm
6K.tm
.pLjxO
.pLjxO
8]R.vd
8]R.vd
"j.hu
"j.hu
}1kÃ
}1kÃ
X.ZP_G
X.ZP_G
6 \r
6 \r
%x~{d
%x~{d
&kj%sO)
&kj%sO)
.WS1s
.WS1s
.Dwi^
.Dwi^
^.jY.zr
^.jY.zr
s.CELM
s.CELM
nE.GD
nE.GD
jyy.Er7{
jyy.Er7{
#].nv
#].nv
z .eJ
z .eJ
.DBd1[
.DBd1[
9.Fl#}
9.Fl#}
V#.mp
V#.mp
%C@K'
%C@K'
.kJ*A
.kJ*A
{1.cu
{1.cu
.ByYk
.ByYk
UA.jZ
UA.jZ
.cr`5]
.cr`5]
1^Tzo
1^Tzo
xq.Iuj
xq.Iuj
299.Ai
299.Ai
T)%u=Q
T)%u=Q
E.jKk
E.jKk
>O~
>O~
.jvoB
.jvoB
8.zO&T
8.zO&T
.xbF!
.xbF!
i %s|
i %s|
O?Ce.Ih
O?Ce.Ih
s3%d(
s3%d(
0.hv4
0.hv4
þ(#
þ(#
@7%x8
@7%x8
1%f$uqr
1%f$uqr
WQm
WQm
bX%U=]
bX%U=]
mj.nm
mj.nm
]9.jDmI
]9.jDmI
z%Cga(
z%Cga(
r|5.VZ
r|5.VZ
lO.pT
lO.pT
J[m%CR
J[m%CR
.wgaR
.wgaR
%.bB^
%.bB^
\X.Vo
\X.Vo
&U(.fR
&U(.fR
a.xxPZ
a.xxPZ
.RejS
.RejS
.hMdzC
.hMdzC
%9UGl*
%9UGl*
-{.rK
-{.rK
-Op}o
-Op}o
.eOG8Yt
.eOG8Yt
wEbM
wEbM
`0818%8!*
`0818%8!*
QHX5g.qe
QHX5g.qe
q&A.RSU
q&A.RSU
I%.Ar\
I%.Ar\
ZB.ur
ZB.ur
\mc%x
\mc%x
j,Ã’
j,Ã’
b_%uF
b_%uF
A>%F ;
A>%F ;
.KuAC
.KuAC
R"~.QA
R"~.QA
%X-Wd
%X-Wd
-v4}I2
-v4}I2
.iYf$
.iYf$
gTexE
gTexE
/-1v}
/-1v}
ls.yM
ls.yM
]DD.SU
]DD.SU
U&%SG
U&%SG
,Y^%%UN
,Y^%%UN
X*%sf
X*%sf
%Å’|
%Å’|
5N.zb
5N.zb
(udpb
(udpb
d.TL^
d.TL^
lftp
lftp
o>M%%U7
o>M%%U7
.TOv`g
.TOv`g
1b.mL
1b.mL
525
525
:%SqN
:%SqN
%DOJw
%DOJw
!b*C.kR*
!b*C.kR*
.By9h_
.By9h_
.azzm
.azzm
b%ukY`
b%ukY`
xB-i}
xB-i}
eul-
eul-
?hD0%c
?hD0%c
".bggo
".bggo
%S/6gbM
%S/6gbM
p"$.vB
p"$.vB
1Ã…4
1Ã…4
f.DaifL*
f.DaifL*
t~=v%S."
t~=v%S."
1.zQXa
1.zQXa
$c%u7
$c%u7
G?J
G?J
ue
ue
%D-2yx
%D-2yx
6q)%F
6q)%F
>>@.Eal
>>@.Eal
".yUH
".yUH
6,$=%X
6,$=%X
::%d_
::%d_
j%dp\
j%dp\
1n.Vz
1n.Vz
Ye.lG
Ye.lG
O8O
O8O
M^v%X
M^v%X
!.NE&
!.NE&
/T)J%c
/T)J%c
Tu, .ua
Tu, .ua
i.lNG
i.lNG
{,.yC
{,.yC
/ .An
/ .An
w.OP0@
w.OP0@
{.FAz
{.FAz
Ko%uR
Ko%uR
%So&yk
%So&yk
S.OHNR
S.OHNR
C.HQ6Dk
C.HQ6Dk
.pJ2S:
.pJ2S:
dzœ
dzœ
`%7XE
`%7XE
"H%Xz:J/|C
"H%Xz:J/|C
%S$RK
%S$RK
7N$%c
7N$%c
W%C]ei
W%C]ei
d-wQ}
d-wQ}
O_9%Fq
O_9%Fq
IL.rK
IL.rK
%f"nf
%f"nf
H|D%c
H|D%c
K%7sW
K%7sW
Y.yi8
Y.yi8
Z.zZ6;X
Z.zZ6;X
gV.fp
gV.fp
~-M}
~-M}
urI.;%F
urI.;%F
=.KpJ@
=.KpJ@
|.PXm
|.PXm
=%XFJ{
=%XFJ{
9g6.yu5
9g6.yu5
8>%xV
8>%xV
.DH.2
.DH.2
s`tS-C}
s`tS-C}
R.rxtqE="n
R.rxtqE="n
F.Cky"
F.Cky"
.cXEd
.cXEd
Bh'.Ck1
Bh'.Ck1
R.ee:dNx
R.ee:dNx
I5[%S
I5[%S
U5g--Z}
U5g--Z}
~Y%SY
~Y%SY
6.oHoTn
6.oHoTn
(gSqL
(gSqL
@%C%E%
@%C%E%
CMd0Z
CMd0Z
K-.wS$r
K-.wS$r
m$].wp.
m$].wp.
(C.SG
(C.SG
A!N'%u
A!N'%u
%syePt
%syePt
%u_JA
%u_JA
%3XJ?
%3XJ?
gV&.tp(
gV&.tp(
f-.tua
f-.tua
}o.Fd
}o.Fd
%xm_a/
%xm_a/
E-Tl}
E-Tl}
EZG%X
EZG%X
}.ow.
}.ow.
m=.Up]
m=.Up]
.gB5Dn
.gB5Dn
l.Pe1
l.Pe1
%dh:IN)-
%dh:IN)-
V.pzvq
V.pzvq
:O.ra
:O.ra
u.Wz/
u.Wz/
.Nc[S
.Nc[S
Ze.vf
Ze.vf
..pon
..pon
=fP.KBr
=fP.KBr
P%xy-_
P%xy-_
R%FP(Q
R%FP(Q
.aGWYb
.aGWYb
8`%S.
8`%S.
.NBYb
.NBYb
U.qcD
U.qcD
X$%c)
X$%c)
^msgj7
^msgj7
.beVOd
.beVOd
.cwydm
.cwydm
%XB`.s
%XB`.s
%uf9r
%uf9r
.lfjR
.lfjR
.HKl4G;
.HKl4G;
m%dy5
m%dy5
7Þ1
7Þ1
%Dw"l
%Dw"l
$WL`D
$WL`D
B.OYXh1^
B.OYXh1^
T.Os;b
T.Os;b
.bGvW
.bGvW
z1#%sO
z1#%sO
|.LCe
|.LCe
..bWL
..bWL
'}Dp%X
'}Dp%X
j[ftpV~x
j[ftpV~x
-ùh
-ùh
T%C\l
T%C\l
quDP`5!
quDP`5!
tcP2sd
tcP2sd
D}.BM
D}.BM
S;.QvS`
S;.QvS`
%U{[7
%U{[7
%ct.Y
%ct.Y
E%s%V
E%s%V
-y%S;O
-y%S;O
.USp!s
.USp!s
.mxz*
.mxz*
USER32.DLL
USER32.DLL
ADVAPI32.DLL
ADVAPI32.DLL
MPR.DLL
MPR.DLL
WSOCK32.DLL
WSOCK32.DLL
SHELL32.DLL
SHELL32.DLL
hXXp://vguarder.91i.net/user.htm
hXXp://vguarder.91i.net/user.htm
hXXp://vguarder.bravehost.com/user.htm
hXXp://vguarder.bravehost.com/user.htm
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WinExec
WinExec
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
RegOpenKeyA
RegOpenKeyA
ShellExecuteA
ShellExecuteA
\setupx.exe
\setupx.exe
\updatex.exe
\updatex.exe
\Serverx.exe
\Serverx.exe
=.exet
=.exet
=.scrt
=.scrt
.idata
.idata
.reloc
.reloc
KERNEL32.dll
KERNEL32.dll
%s:*:enabled:@shell32.dll,-1
%s:*:enabled:@shell32.dll,-1
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Qoyirc.zief.pl
Qoyirc.zief.pl
proxim.ircgalaxy.pl
proxim.ircgalaxy.pl
NICK gvhmdwhu
NICK gvhmdwhu
SFC.DLL
SFC.DLL
SFC_OS.DLL
SFC_OS.DLL
SHLWAPI.DLL
SHLWAPI.DLL
WININET.DLL
WININET.DLL
%.6x . . :%c%.8x%x %s
%.6x . . :%c%.8x%x %s
JOIN
JOIN
127.0.0.1 ZieF.pl
127.0.0.1 ZieF.pl
#
#
X%cX%c
X%cX%c
SfxString%d
SfxString%d
SfxFolderd
SfxFolderd
PasswordTitle
PasswordTitle
PasswordText
PasswordText
%X - X - X - X - X
%X - X - X - X - X
7ZSfxx.cmd
7ZSfxx.cmd
setup.exe
setup.exe
7ZipSfx.x
7ZipSfx.x
SfxVarCmdLine1
SfxVarCmdLine1
SfxVarCmdLine2
SfxVarCmdLine2
SfxVarCmdLine0
SfxVarCmdLine0
@ (%d%s)
@ (%d%s)
1.4.3
1.4.3
adb-installer-1.4.3.exe
adb-installer-1.4.3.exe
%original file name%.exe_1504_rwx_00401000_0006B000:
PSSSSSSh
PSSSSSSh
ttNt_Nt.Nt
ttNt_Nt.Nt
:Language:%u
:Language:%u
Enter password:
Enter password:
0xx
0xx
"%s".
"%s".
Could not overwrite file "%s".
Could not overwrite file "%s".
Could not create file "%s".
Could not create file "%s".
0xX.
0xX.
7-Zip: Internal error, code 0xX.
7-Zip: Internal error, code 0xX.
7-Zip: Internal error, code %u.
7-Zip: Internal error, code %u.
The archive is corrupted, or invalid password was entered.
The archive is corrupted, or invalid password was entered.
7-Zip: Unsupported method.
7-Zip: Unsupported method.
Error during execution "%s".
Error during execution "%s".
"setup.exe"
"setup.exe"
Could not find "setup.exe".
Could not find "setup.exe".
Could not find command for "%s".
Could not find command for "%s".
Could not delete file or folder "%s".
Could not delete file or folder "%s".
Could not create folder "%s".
Could not create folder "%s".
Error in line %d of configuration data:
Error in line %d of configuration data:
Could not open archive file "%s".
Could not open archive file "%s".
1.6.0 develop [x86]
1.6.0 develop [x86]
2712 (30
2712 (30
1.6.0 develop [x86] build 2712 (December 30, 2012)
1.6.0 develop [x86] build 2712 (December 30, 2012)
Supported methods and filters, build options:
Supported methods and filters, build options:
Sorry, this program requires Microsoft Windows 2000 or later.
Sorry, this program requires Microsoft Windows 2000 or later.
CreateIoCompletionPort
CreateIoCompletionPort
_acmdln
_acmdln
ShellExecuteW
ShellExecuteW
ShellExecuteExW
ShellExecuteExW
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExW
SetWindowsHookExW
GetKeyState
GetKeyState
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
X%cX%c
X%cX%c
SfxString%d
SfxString%d
SfxFolderd
SfxFolderd
PasswordTitle
PasswordTitle
PasswordText
PasswordText
%X - X - X - X - X
%X - X - X - X - X
7ZSfxx.cmd
7ZSfxx.cmd
setup.exe
setup.exe
7ZipSfx.x
7ZipSfx.x
SfxVarCmdLine1
SfxVarCmdLine1
SfxVarCmdLine2
SfxVarCmdLine2
SfxVarCmdLine0
SfxVarCmdLine0
@ (%d%s)
@ (%d%s)
%original file name%.exe_484:
!Require Windows
!Require Windows
`.rsrc
`.rsrc
PSSSSSSh
PSSSSSSh
ttNt_Nt.Nt
ttNt_Nt.Nt
:Language:%u
:Language:%u
Enter password:
Enter password:
0xx
0xx
"%s".
"%s".
Could not overwrite file "%s".
Could not overwrite file "%s".
Could not create file "%s".
Could not create file "%s".
0xX.
0xX.
7-Zip: Internal error, code 0xX.
7-Zip: Internal error, code 0xX.
7-Zip: Internal error, code %u.
7-Zip: Internal error, code %u.
The archive is corrupted, or invalid password was entered.
The archive is corrupted, or invalid password was entered.
7-Zip: Unsupported method.
7-Zip: Unsupported method.
Error during execution "%s".
Error during execution "%s".
"setup.exe"
"setup.exe"
Could not find "setup.exe".
Could not find "setup.exe".
Could not find command for "%s".
Could not find command for "%s".
Could not delete file or folder "%s".
Could not delete file or folder "%s".
Could not create folder "%s".
Could not create folder "%s".
Error in line %d of configuration data:
Error in line %d of configuration data:
Could not open archive file "%s".
Could not open archive file "%s".
1.6.0 develop [x86]
1.6.0 develop [x86]
2712 (30
2712 (30
1.6.0 develop [x86] build 2712 (December 30, 2012)
1.6.0 develop [x86] build 2712 (December 30, 2012)
Supported methods and filters, build options:
Supported methods and filters, build options:
Sorry, this program requires Microsoft Windows 2000 or later.
Sorry, this program requires Microsoft Windows 2000 or later.
CreateIoCompletionPort
CreateIoCompletionPort
_acmdln
_acmdln
ShellExecuteW
ShellExecuteW
ShellExecuteExW
ShellExecuteExW
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExW
SetWindowsHookExW
GetKeyState
GetKeyState
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
.NNNNNNNNNNNNNNNN
.NNNNNNNNNNNNNNNN
.NNNNNNNNNNNNNNN
.NNNNNNNNNNNNNNN
KERNEL32.DLL
KERNEL32.DLL
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
GDI32.dll
GDI32.dll
MSVCRT.dll
MSVCRT.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
SHELL32.dll
SHELL32.dll
USER32.dll
USER32.dll
RunProgram="waitall:install.bat"
RunProgram="waitall:install.bat"
'K.Jj
'K.Jj
M.oU)
M.oU)
.pefl
.pefl
.Bo%R
.Bo%R
.CwbR
.CwbR
p;g%C
p;g%C
h.fE$=]
h.fE$=]
rH.rW
rH.rW
.aw$T
.aw$T
-t.jq
-t.jq
b %CtK
b %CtK
oM.zS
oM.zS
c 9%D*J=
c 9%D*J=
.zw-9K)
.zw-9K)
{].zmN0
{].zmN0
87.Fb
87.Fb
K-tR}
K-tR}
%Ure.
%Ure.
(..HH
(..HH
S%8Si
S%8Si
%fJrw
%fJrw
mw8.KZ2
mw8.KZ2
/C0%U@
/C0%U@
.GnH0WoK*VXvrQ
.GnH0WoK*VXvrQ
.Hl>md
.Hl>md
.zhPi
.zhPi
\%uFF
\%uFF
Ftp0r?(
Ftp0r?(
HK.lY
HK.lY
!.HR
!.HR
.DTf(
.DTf(
Ihpw.NP
Ihpw.NP
'>7$%d
'>7$%d
,e.MFM3
,e.MFM3
d.Dw i
d.Dw i
y7.SE-
y7.SE-
|0.NGZ
|0.NGZ
ca%sW
ca%sW
9H.wl
9H.wl
UG4%f
UG4%f
z.Ssu'
z.Ssu'
s-n%u
s-n%u
8v.BC4E
8v.BC4E
2.SUO
2.SUO
-5TQs}
-5TQs}
zN.Zz
zN.Zz
E[%c_
E[%c_
W9-xK.YT
W9-xK.YT
TM4%D
TM4%D
(E%F#
(E%F#
P.ol\ko
P.ol\ko
=:g*(
=:g*(
HA;%cw
HA;%cw
^.wOW
^.wOW
Q8A~X .Dir
Q8A~X .Dir
_&.lb
_&.lb
.nFnA
.nFnA
O%3Un
O%3Un
.aQnX
.aQnX
pPSkJþ
pPSkJþ
2zycMd
2zycMd
!;-c}-M
!;-c}-M
v.oJ8
v.oJ8
y.Wr,
y.Wr,
P.NWf
P.NWf
A%svd^
A%svd^
[]v%x
[]v%x
c[.XN
c[.XN
>%uZO
>%uZO
.Fy%H
.Fy%H
{k%C(h.
{k%C(h.
`.wrM
`.wrM
'!.Ap
'!.Ap
/ .xy:1>u
/ .xy:1>u
nn`Ú?
nn`Ú?
=.cxFkm
=.cxFkm
NL%FI
NL%FI
G%U} R
G%U} R
.dSOq
.dSOq
hsN-F%U{
hsN-F%U{
X.HIU
X.HIU
$.Ut\
$.Ut\
Ok%d $*
Ok%d $*
.py/(=
.py/(=
|q%Se
|q%Se
l.jDn
l.jDn
nuDP!
nuDP!
~
~
H.iV*i0'?
H.iV*i0'?
%XSZu*W4
%XSZu*W4
RrI.fW
RrI.fW
0%ud0
0%ud0
Zy%UF
Zy%UF
y.rug
y.rug
.kK%l
.kK%l
ez8%3u=g
ez8%3u=g
jM5`.xl
jM5`.xl
.kKW8%b
.kKW8%b
\.tPI
\.tPI
$|%SU
$|%SU
d4%f>
d4%f>
SBEW.cY
SBEW.cY
b`FLF.Ec_
b`FLF.Ec_
.cNI3
.cNI3
.AI%cl
.AI%cl
.LK9^
.LK9^
l=.RK
l=.RK
T6 .IQ
T6 .IQ
:%c.T'
:%c.T'
f%up,
f%up,
tQOw.cg
tQOw.cg
%un?2
%un?2
b.kKv
b.kKv
F:\#F
F:\#F
z2.uvIE
z2.uvIE
SE.GK8
SE.GK8
CS.JW
CS.JW
& .PQk
& .PQk
:.vNu
:.vNu
#y.nKO
#y.nKO
<.mvi>
<.mvi>
#w
#w
\.eAd
\.eAd
]7.Uq2b
]7.Uq2b
D1%FG
D1%FG
.mT j
.mT j
%U^4p
%U^4p
..iR1
..iR1
nQX-O4}&
nQX-O4}&
I.dIJ
I.dIJ
BT`%Cg
BT`%Cg
9ÃŽz
9ÃŽz
.tH55
.tH55
_Dj.vY Q
_Dj.vY Q
(.XCw
(.XCw
e%ui} t
e%ui} t
*
*
<.zb>
<.zb>
.HDn{9
.HDn{9
%D;aF,
%D;aF,
jN.prVq
jN.prVq
3;J_Wx%ut
3;J_Wx%ut
(%x.
(%x.
n;X%dWp
n;X%dWp
D%F.B
D%F.B
%d%f(
%d%f(
W]EXey
W]EXey
z!%uf
z!%uf
.CVB%
.CVB%
l _%S@
l _%S@
dSshx
dSshx
H.GL0
H.GL0
)(pöH
)(pöH
E:\QQ
E:\QQ
@-.Pn
@-.Pn
%FN0$
%FN0$
ye.vN
ye.vN
.CBE)K
.CBE)K
ZV6%Dk
ZV6%Dk
pF.yu
pF.yu
%fR)$
%fR)$
%x6YI
%x6YI
kEyp
kEyp
&TM%s
&TM%s
Tg.GD
Tg.GD
R#kEY
R#kEY
cmdv
cmdv
Q.XDu
Q.XDu
hp.zk/
hp.zk/
/yGk.Wn
/yGk.Wn
-btB}
-btB}
>%VC%fsK
>%VC%fsK
.ah~e=`}O
.ah~e=`}O
C&.VU
C&.VU
a.Ja`
a.Ja`
vsY.un
vsY.un
r?As.Yx
r?As.Yx
9.UbU
9.UbU
pl%U?
pl%U?
J.lAW
J.lAW
.VK_V
.VK_V
.MpBkX
.MpBkX
9.Owdy
9.Owdy
5b=y%u
5b=y%u
cO.sggi
cO.sggi
#NUDpj
#NUDpj
.eg\~,
.eg\~,
$%c&F;E
$%c&F;E
%h%ug
%h%ug
:!-}[t.EU=
:!-}[t.EU=
.mbgy~
.mbgy~
.Dv/y6
.Dv/y6
.LoEFu
.LoEFu
%cZvb
%cZvb
=.aG"
=.aG"
%F$Gz
%F$Gz
}x%.Gd
}x%.Gd
R.VS> "
R.VS> "
ko^L%xW
ko^L%xW
Û;h
Û;h
a2.tk
a2.tk
tA.PE-
tA.PE-
n (.mzW$
n (.mzW$
5O.drp
5O.drp
s6b%Sc
s6b%Sc
f-O}2e>
f-O}2e>
\W\<.tq>
\W\<.tq>
\m%.DN;G
\m%.DN;G
eq(%F
eq(%F
%D!`K
%D!`K
%xX,,
%xX,,
?}d.gwu
?}d.gwu
PH.DY
PH.DY
Q%D&x
Q%D&x
%C UvT
%C UvT
IÚ>
IÚ>
.pCkxk
.pCkxk
%X!yL
%X!yL
"5>\%fi
"5>\%fi
1K/L%Sc
1K/L%Sc
@j.cT^o
@j.cT^o
3.MjOB
3.MjOB
}Mg%4%D
}Mg%4%D
.QJ31
.QJ31
y!ga.vJZ
y!ga.vJZ
.rX_E
.rX_E
O%u:>1D
O%u:>1D
W.qO;
W.qO;
*.*[$
*.*[$
%XyIR1
%XyIR1
'q.Ha@
'q.Ha@
]E.NE
]E.NE
%Uz=%
%Uz=%
>E!:.lL-
>E!:.lL-
YW.QM
YW.QM
.Bxx^G>
.Bxx^G>
]B.aZ
]B.aZ
x.Nq
x.Nq
[tj%Xa
[tj%Xa
Y(.WJ
Y(.WJ
(.rBE
(.rBE
U%x]|X|XZ
U%x]|X|XZ
%C#"KN
%C#"KN
.DzNhf6
.DzNhf6
&.BzZ
&.BzZ
m.lP/
m.lP/
Z/*.dD4p
Z/*.dD4p
i.Chp
i.Chp
vWjp%SA
vWjp%SA
7.RK5
7.RK5
r%s?z
r%s?z
Ssh6d
Ssh6d
^.mcV
^.mcV
P2.kGy
P2.kGy
JY.HnN
JY.HnN
ue.Se
ue.Se
.Is~W
.Is~W
yË|oh
yË|oh
y{.Ih
y{.Ih
e.Nde
e.Nde
.jq/r
.jq/r
.uVwv
.uVwv
1.oFb
1.oFb
I!\6w2.BW
I!\6w2.BW
hf.NA
hf.NA
*".gf$
*".gf$
.lZB=
.lZB=
..rP~
..rP~
'15%F>
'15%F>
W%.KP
W%.KP
;.Ryn/
;.Ryn/
h.bBCZ9
h.bBCZ9
k%%D)w
k%%D)w
.XhZzS(
.XhZzS(
8.ZQ'
8.ZQ'
.frQmq
.frQmq
=.Eka%
=.Eka%
.VsF
.VsF
9fs%F
9fs%F
.xGuY
.xGuY
.hfVZam
.hfVZam
1o% ]%X
1o% ]%X
G.lM5z
G.lM5z
Q$%FG
Q$%FG
|%f=p
|%f=p
e[*%D
e[*%D
U,4>%d
U,4>%d
$c..Lq
$c..Lq
-f$hO%S
-f$hO%S
E[>{Z%F
E[>{Z%F
%X9e\
%X9e\
:.jG.
:.jG.
1Ul%x
1Ul%x
/f.cHy
/f.cHy
g%u[Q&
g%u[Q&
9;.aU
9;.aU
;m'%F
;m'%F
L&
L&
NG5%x;
NG5%x;
Wa.Di
Wa.Di
.Bw8r
.Bw8r
.Ec f
.Ec f
^_.Df
^_.Df
i%CHJ
i%CHJ
9.fft
9.fft
2z.lU=
2z.lU=
~M%xe
~M%xe
D.aF8s
D.aF8s
.mZmW~
.mZmW~
b4OU%D
b4OU%D
$-xX}
$-xX}
{[;%F
{[;%F
kic%X
kic%X
zu.cb
zu.cb
@G.lh
@G.lh
gk%s
gk%s
7.GAk
7.GAk
K=.RD
K=.RD
n2^o
n2^o
xN[.vu
xN[.vu
{n5,%d
{n5,%d
S.azC4
S.azC4
bl.jVI
bl.jVI
fZ.FM
fZ.FM
.knt(
.knt(
.uzn|08
.uzn|08
.qC2
.qC2
C%dlh
C%dlh
gc%uz-
gc%uz-
Ix&Z%uHD
Ix&Z%uHD
.CWr^w
.CWr^w
3.bpd
3.bpd
L.ak^
L.ak^
.k%Fg
.k%Fg
K$.bw
K$.bw
.Sld&J
.Sld&J
n.vUg
n.vUg
a.mS_
a.mS_
)[2.TxP
)[2.TxP
.%S'p$F
.%S'p$F
V73.Sk
V73.Sk
-bNU}
-bNU}
u %c%M
u %c%M
..Rz%
..Rz%
gzl%xO
gzl%xO
i`.QC
i`.QC
F/.bb
F/.bb
%U>v%
%U>v%
k%uGV
k%uGV
%u!w>i
%u!w>i
|Uw^.fT
|Uw^.fT
!%S4s
!%S4s
MUj.AF
MUj.AF
{$Ã
{$Ã
pAr%d-
pAr%d-
.KmVX{
.KmVX{
#(.lV
#(.lV
{.Nc3
{.Nc3
KO.We
KO.We
:-QEX.BU
:-QEX.BU
l5:
l5:
Ôb~
Ôb~
.PEJl
.PEJl
olB
olB
8&n@.Xe
8&n@.Xe
|k-Q}
|k-Q}
d%d!m
d%d!m
F%uo
F%uo
#.ibEd
#.ibEd
3%Xv0s
3%Xv0s
[4 ?.YW
[4 ?.YW
FtPa
FtPa
s.sd~
s.sd~
.rPV6k$
.rPV6k$
.GLxQg
.GLxQg
.Sfb>
.Sfb>
%URC=
%URC=
d%.KS-
d%.KS-
,%U c
,%U c
0p.Aq
0p.Aq
l>.Rl
l>.Rl
1ki.Mg
1ki.Mg
.NB%*
.NB%*
;S%x%T
;S%x%T
F\.ue
F\.ue
.aO^.s>
.aO^.s>
.Xf s|;
.Xf s|;
.VdP=
.VdP=
S.zy;
S.zy;
e}%s#;
e}%s#;
m.RT
m.RT
ðIm
ðIm
..RTH
..RTH
.pKpaX
.pKpaX
U-.sr
U-.sr
T2%UN
T2%UN
&a.Os
&a.Os
.jgZok
.jgZok
{n%fPym
{n%fPym
/Cj~.YD
/Cj~.YD
!E.ky
!E.ky
.vQ[M
.vQ[M
Hua~%S r
Hua~%S r
~ .cw
~ .cw
.vIXff
.vIXff
!z6'.LD
!z6'.LD
_.xQ'
_.xQ'
V.rX{
V.rX{
)xPp%D
)xPp%D
1.hIe
1.hIe
N..JF"b^wN#
N..JF"b^wN#
.OL
.OL
ûp U
ûp U
cq.OT
cq.OT
.LjVZ
.LjVZ
.jN_Q
.jN_Q
LYs8.pr
LYs8.pr
.Tkwt7z
.Tkwt7z
PfTp0
PfTp0
8E.CI
8E.CI
.hL\39
.hL\39
5Y7%F
5Y7%F
C%8UF
C%8UF
gV%xMLc
gV%xMLc
i^.AAE
i^.AAE
Vc.en
Vc.en
_V2.oPC&
_V2.oPC&
^]-Y}
^]-Y}
r.fo7=}m
r.fo7=}m
.ldEJ
.ldEJ
S{Eu%D
S{Eu%D
n.yoM
n.yoM
%D!Dl
%D!Dl
k%X&a
k%X&a
$%X0B
$%X0B
g3}
g3}
%F\
%F\
%x1'"
%x1'"
zFTP
zFTP
US.pGc
US.pGc
.vJMI
.vJMI
T2.el
T2.el
$%.zf
$%.zf
5\5?5.5:50
5\5?5.5:50
uvÅ’B
uvÅ’B
%\V<.tf>
%\V<.tf>
.act_
.act_
%C;R@
%C;R@
P&4K%S
P&4K%S
0S.cy?)G
0S.cy?)G
#.$;';)@
#.$;';)@
.Xf]U
.Xf]U
tQ>%x
tQ>%x
0u.oAP
0u.oAP
.wz{h_Vc
.wz{h_Vc
.Mb[|
.Mb[|
2Yg/D%S
2Yg/D%S
-1pd}
-1pd}
#HF%xX.
#HF%xX.
"#.md
"#.md
%UZ5=
%UZ5=
O%d,w
O%d,w
@@@@.As
@@@@.As
k.aIh
k.aIh
~S3%c
~S3%c
w.apsQ_
w.apsQ_
,p%F/zE
,p%F/zE
%U/&!ru
%U/&!ru
P.MF
P.MF
_7%cg?
_7%cg?
\*%UG
\*%UG
$Y%x$
$Y%x$
w.II"!,
w.II"!,
.Qtd@
.Qtd@
=A1%sgu
=A1%sgu
.zNKZ
.zNKZ
(%XZG$
(%XZG$
%x
%x
\.OyX
\.OyX
.xGDB{
.xGDB{
[.fod
[.fod
u-o}k
u-o}k
!| Ev@l%x
!| Ev@l%x
.AVW,
.AVW,
\.RbC
\.RbC
-n.mb
-n.mb
op}{%c
op}{%c
7&.gr_
7&.gr_
e/x.uu?
e/x.uu?
G%u9/e
G%u9/e
\@W.cC
\@W.cC
"Q.Qq
"Q.Qq
/.Hk*
/.Hk*
Di.kLJ
Di.kLJ
N.LK*
N.LK*
.MN:un
.MN:un
.JS_J
.JS_J
-v.AB@
-v.AB@
LK.ay
LK.ay
2=.nU
2=.nU
}õ;#
}õ;#
.wwwwwwww`w
.wwwwwwww`w
;:f%c
;:f%c
C!.iT
C!.iT
MO..ZH
MO..ZH
.EA0p
.EA0p
vg%uFGd
vg%uFGd
&I.UR
&I.UR
;.ce-
;.ce-
AHm%D
AHm%D
Mg%u>
Mg%u>
M%0s
M%0s
.xFyZ
.xFyZ
D|%x$K
D|%x$K
Ec.yj
Ec.yj
S.Lk!u"~
S.Lk!u"~
[R.aC
[R.aC
AZ#5.ZN
AZ#5.ZN
-q}:"
-q}:"
Ln%Sw
Ln%Sw
iW%dM
iW%dM
:.qhlVfi
:.qhlVfi
| %SZQ0
| %SZQ0
ac%U T
ac%U T
7S.tJM
7S.tJM
6K.tm
6K.tm
.pLjxO
.pLjxO
8]R.vd
8]R.vd
"j.hu
"j.hu
}1kÃ
}1kÃ
X.ZP_G
X.ZP_G
6 \r
6 \r
%x~{d
%x~{d
&kj%sO)
&kj%sO)
.WS1s
.WS1s
.Dwi^
.Dwi^
^.jY.zr
^.jY.zr
s.CELM
s.CELM
nE.GD
nE.GD
jyy.Er7{
jyy.Er7{
#].nv
#].nv
z .eJ
z .eJ
.DBd1[
.DBd1[
9.Fl#}
9.Fl#}
V#.mp
V#.mp
%C@K'
%C@K'
.kJ*A
.kJ*A
{1.cu
{1.cu
.ByYk
.ByYk
UA.jZ
UA.jZ
.cr`5]
.cr`5]
1^Tzo
1^Tzo
xq.Iuj
xq.Iuj
299.Ai
299.Ai
T)%u=Q
T)%u=Q
E.jKk
E.jKk
>O~
>O~
.jvoB
.jvoB
8.zO&T
8.zO&T
.xbF!
.xbF!
i %s|
i %s|
O?Ce.Ih
O?Ce.Ih
s3%d(
s3%d(
0.hv4
0.hv4
þ(#
þ(#
@7%x8
@7%x8
1%f$uqr
1%f$uqr
WQm
WQm
bX%U=]
bX%U=]
mj.nm
mj.nm
]9.jDmI
]9.jDmI
z%Cga(
z%Cga(
r|5.VZ
r|5.VZ
lO.pT
lO.pT
J[m%CR
J[m%CR
.wgaR
.wgaR
%.bB^
%.bB^
\X.Vo
\X.Vo
&U(.fR
&U(.fR
a.xxPZ
a.xxPZ
.RejS
.RejS
.hMdzC
.hMdzC
%9UGl*
%9UGl*
-{.rK
-{.rK
-Op}o
-Op}o
.eOG8Yt
.eOG8Yt
wEbM
wEbM
`0818%8!*
`0818%8!*
QHX5g.qe
QHX5g.qe
q&A.RSU
q&A.RSU
I%.Ar\
I%.Ar\
ZB.ur
ZB.ur
\mc%x
\mc%x
j,Ã’
j,Ã’
b_%uF
b_%uF
A>%F ;
A>%F ;
.KuAC
.KuAC
R"~.QA
R"~.QA
%X-Wd
%X-Wd
-v4}I2
-v4}I2
.iYf$
.iYf$
gTexE
gTexE
/-1v}
/-1v}
ls.yM
ls.yM
]DD.SU
]DD.SU
U&%SG
U&%SG
,Y^%%UN
,Y^%%UN
X*%sf
X*%sf
%Å’|
%Å’|
5N.zb
5N.zb
(udpb
(udpb
d.TL^
d.TL^
lftp
lftp
o>M%%U7
o>M%%U7
.TOv`g
.TOv`g
1b.mL
1b.mL
525
525
:%SqN
:%SqN
%DOJw
%DOJw
!b*C.kR*
!b*C.kR*
.By9h_
.By9h_
.azzm
.azzm
b%ukY`
b%ukY`
xB-i}
xB-i}
eul-
eul-
?hD0%c
?hD0%c
".bggo
".bggo
%S/6gbM
%S/6gbM
p"$.vB
p"$.vB
1Ã…4
1Ã…4
f.DaifL*
f.DaifL*
t~=v%S."
t~=v%S."
1.zQXa
1.zQXa
$c%u7
$c%u7
G?J
G?J
ue
ue
%D-2yx
%D-2yx
6q)%F
6q)%F
>>@.Eal
>>@.Eal
".yUH
".yUH
6,$=%X
6,$=%X
::%d_
::%d_
j%dp\
j%dp\
1n.Vz
1n.Vz
Ye.lG
Ye.lG
O8O
O8O
M^v%X
M^v%X
!.NE&
!.NE&
/T)J%c
/T)J%c
Tu, .ua
Tu, .ua
i.lNG
i.lNG
{,.yC
{,.yC
/ .An
/ .An
w.OP0@
w.OP0@
{.FAz
{.FAz
Ko%uR
Ko%uR
%So&yk
%So&yk
S.OHNR
S.OHNR
C.HQ6Dk
C.HQ6Dk
.pJ2S:
.pJ2S:
dzœ
dzœ
`%7XE
`%7XE
"H%Xz:J/|C
"H%Xz:J/|C
%S$RK
%S$RK
7N$%c
7N$%c
W%C]ei
W%C]ei
d-wQ}
d-wQ}
O_9%Fq
O_9%Fq
IL.rK
IL.rK
%f"nf
%f"nf
H|D%c
H|D%c
K%7sW
K%7sW
Y.yi8
Y.yi8
Z.zZ6;X
Z.zZ6;X
gV.fp
gV.fp
~-M}
~-M}
urI.;%F
urI.;%F
=.KpJ@
=.KpJ@
|.PXm
|.PXm
=%XFJ{
=%XFJ{
9g6.yu5
9g6.yu5
8>%xV
8>%xV
.DH.2
.DH.2
s`tS-C}
s`tS-C}
R.rxtqE="n
R.rxtqE="n
F.Cky"
F.Cky"
.cXEd
.cXEd
Bh'.Ck1
Bh'.Ck1
R.ee:dNx
R.ee:dNx
I5[%S
I5[%S
U5g--Z}
U5g--Z}
~Y%SY
~Y%SY
6.oHoTn
6.oHoTn
(gSqL
(gSqL
@%C%E%
@%C%E%
CMd0Z
CMd0Z
K-.wS$r
K-.wS$r
m$].wp.
m$].wp.
(C.SG
(C.SG
A!N'%u
A!N'%u
%syePt
%syePt
%u_JA
%u_JA
%3XJ?
%3XJ?
gV&.tp(
gV&.tp(
f-.tua
f-.tua
}o.Fd
}o.Fd
%xm_a/
%xm_a/
E-Tl}
E-Tl}
EZG%X
EZG%X
}.ow.
}.ow.
m=.Up]
m=.Up]
.gB5Dn
.gB5Dn
l.Pe1
l.Pe1
%dh:IN)-
%dh:IN)-
V.pzvq
V.pzvq
:O.ra
:O.ra
u.Wz/
u.Wz/
.Nc[S
.Nc[S
Ze.vf
Ze.vf
..pon
..pon
=fP.KBr
=fP.KBr
P%xy-_
P%xy-_
R%FP(Q
R%FP(Q
.aGWYb
.aGWYb
8`%S.
8`%S.
.NBYb
.NBYb
U.qcD
U.qcD
X$%c)
X$%c)
^msgj7
^msgj7
.beVOd
.beVOd
.cwydm
.cwydm
%XB`.s
%XB`.s
%uf9r
%uf9r
.lfjR
.lfjR
.HKl4G;
.HKl4G;
m%dy5
m%dy5
7Þ1
7Þ1
%Dw"l
%Dw"l
$WL`D
$WL`D
B.OYXh1^
B.OYXh1^
T.Os;b
T.Os;b
.bGvW
.bGvW
z1#%sO
z1#%sO
|.LCe
|.LCe
..bWL
..bWL
'}Dp%X
'}Dp%X
j[ftpV~x
j[ftpV~x
-ùh
-ùh
T%C\l
T%C\l
quDP`5!
quDP`5!
tcP2sd
tcP2sd
D}.BM
D}.BM
S;.QvS`
S;.QvS`
%U{[7
%U{[7
%ct.Y
%ct.Y
E%s%V
E%s%V
-y%S;O
-y%S;O
.USp!s
.USp!s
.mxz*
.mxz*
USER32.DLL
USER32.DLL
ADVAPI32.DLL
ADVAPI32.DLL
MPR.DLL
MPR.DLL
WSOCK32.DLL
WSOCK32.DLL
SHELL32.DLL
SHELL32.DLL
hXXp://vguarder.91i.net/user.htm
hXXp://vguarder.91i.net/user.htm
hXXp://vguarder.bravehost.com/user.htm
hXXp://vguarder.bravehost.com/user.htm
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WinExec
WinExec
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
RegOpenKeyA
RegOpenKeyA
ShellExecuteA
ShellExecuteA
\setupx.exe
\setupx.exe
\updatex.exe
\updatex.exe
\Serverx.exe
\Serverx.exe
=.exet
=.exet
=.scrt
=.scrt
.idata
.idata
.reloc
.reloc
KERNEL32.dll
KERNEL32.dll
A.HK30
A.HK30
X%cX%c
X%cX%c
SfxString%d
SfxString%d
SfxFolderd
SfxFolderd
PasswordTitle
PasswordTitle
PasswordText
PasswordText
%X - X - X - X - X
%X - X - X - X - X
7ZSfxx.cmd
7ZSfxx.cmd
setup.exe
setup.exe
7ZipSfx.x
7ZipSfx.x
SfxVarCmdLine1
SfxVarCmdLine1
SfxVarCmdLine2
SfxVarCmdLine2
SfxVarCmdLine0
SfxVarCmdLine0
@ (%d%s)
@ (%d%s)
1.4.3
1.4.3
adb-installer-1.4.3.exe
adb-installer-1.4.3.exe
%original file name%.exe_1504_rwx_004B8000_00001000:
KERNEL32.DLL
KERNEL32.DLL
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
GDI32.dll
GDI32.dll
MSVCRT.dll
MSVCRT.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
SHELL32.dll
SHELL32.dll
USER32.dll
USER32.dll
1.4.3
1.4.3
adb-installer-1.4.3.exe
adb-installer-1.4.3.exe
%original file name%.exe_1504_rwx_00D8C000_00006000:
WinExec
WinExec
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
RegOpenKeyA
RegOpenKeyA
ShellExecuteA
ShellExecuteA
\setupx.exe
\setupx.exe
\updatex.exe
\updatex.exe
\Serverx.exe
\Serverx.exe
=.exet
=.exet
=.scrt
=.scrt
.idata
.idata
.reloc
.reloc
KERNEL32.dll
KERNEL32.dll
ADVAPI32.DLL
ADVAPI32.DLL
%s:*:enabled:@shell32.dll,-1
%s:*:enabled:@shell32.dll,-1
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Qoyirc.zief.pl
Qoyirc.zief.pl
proxim.ircgalaxy.pl
proxim.ircgalaxy.pl
NICK gvhmdwhu
NICK gvhmdwhu
SFC.DLL
SFC.DLL
SFC_OS.DLL
SFC_OS.DLL
USER32.DLL
USER32.DLL
SHLWAPI.DLL
SHLWAPI.DLL
WSOCK32.DLL
WSOCK32.DLL
WININET.DLL
WININET.DLL
%.6x . . :%c%.8x%x %s
%.6x . . :%c%.8x%x %s
JOIN
JOIN
127.0.0.1 ZieF.pl
127.0.0.1 ZieF.pl
#
#
KERNEL32.DLL
KERNEL32.DLL
MPR.DLL
MPR.DLL
SHELL32.DLL
SHELL32.DLL
hXXp://vguarder.91i.net/user.htm
hXXp://vguarder.91i.net/user.htm
hXXp://vguarder.bravehost.com/user.htm
hXXp://vguarder.bravehost.com/user.htm
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
%original file name%.exe_1504_rwx_00D93000_00004000:
.idata
.idata
.reloc
.reloc
KERNEL32.dll
KERNEL32.dll
USER32.DLL
USER32.DLL
ADVAPI32.DLL
ADVAPI32.DLL
MPR.DLL
MPR.DLL
WSOCK32.DLL
WSOCK32.DLL
SHELL32.DLL
SHELL32.DLL
hXXp://vguarder.91i.net/user.htm
hXXp://vguarder.91i.net/user.htm
hXXp://vguarder.bravehost.com/user.htm
hXXp://vguarder.bravehost.com/user.htm
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WinExec
WinExec
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
RegOpenKeyA
RegOpenKeyA
ShellExecuteA
ShellExecuteA
\setupx.exe
\setupx.exe
\updatex.exe
\updatex.exe
\Serverx.exe
\Serverx.exe
=.exet
=.exet
=.scrt
=.scrt
iexplore.exe_1252:
%?9-*09,*19}*09
%?9-*09,*19}*09
.text
.text
.data
.data
.rsrc
.rsrc
msvcrt.dll
msvcrt.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
USER32.dll
USER32.dll
SHLWAPI.dll
SHLWAPI.dll
SHDOCVW.dll
SHDOCVW.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
IE-X-X
IE-X-X
rsabase.dll
rsabase.dll
System\CurrentControlSet\Control\Windows
System\CurrentControlSet\Control\Windows
dw15 -x -s %u
dw15 -x -s %u
watson.microsoft.com
watson.microsoft.com
IEWatsonURL
IEWatsonURL
%s -h %u
%s -h %u
iedw.exe
iedw.exe
Iexplore.XPExceptionFilter
Iexplore.XPExceptionFilter
jscript.DLL
jscript.DLL
mshtml.dll
mshtml.dll
mlang.dll
mlang.dll
urlmon.dll
urlmon.dll
wininet.dll
wininet.dll
shdocvw.DLL
shdocvw.DLL
browseui.DLL
browseui.DLL
comctl32.DLL
comctl32.DLL
IEXPLORE.EXE
IEXPLORE.EXE
iexplore.pdb
iexplore.pdb
ADVAPI32.dll
ADVAPI32.dll
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
IExplorer.EXE
IExplorer.EXE
IIIIIB(II<.fg>
IIIIIB(II<.fg>
7?_____ZZSSH%
7?_____ZZSSH%
)z.UUUUUUUU
)z.UUUUUUUU
,....Qym
,....Qym
````2```
````2```
{.QLQIIIKGKGKGKGKGKG
{.QLQIIIKGKGKGKGKGKG
;33;33;0
;33;33;0
8888880
8888880
8887080
8887080
.ucB^
.ucB^
%CQ@G
%CQ@G
W:\M!q
W:\M!q
browseui.dll
browseui.dll
shdocvw.dll
shdocvw.dll
6.00.2900.5512 (xpsp.080413-2105)
6.00.2900.5512 (xpsp.080413-2105)
Windows
Windows
Operating System
Operating System
6.00.2900.5512
6.00.2900.5512
%original file name%.exe_484_rwx_00401000_0006B000:
PSSSSSSh
PSSSSSSh
ttNt_Nt.Nt
ttNt_Nt.Nt
:Language:%u
:Language:%u
Enter password:
Enter password:
0xx
0xx
"%s".
"%s".
Could not overwrite file "%s".
Could not overwrite file "%s".
Could not create file "%s".
Could not create file "%s".
0xX.
0xX.
7-Zip: Internal error, code 0xX.
7-Zip: Internal error, code 0xX.
7-Zip: Internal error, code %u.
7-Zip: Internal error, code %u.
The archive is corrupted, or invalid password was entered.
The archive is corrupted, or invalid password was entered.
7-Zip: Unsupported method.
7-Zip: Unsupported method.
Error during execution "%s".
Error during execution "%s".
"setup.exe"
"setup.exe"
Could not find "setup.exe".
Could not find "setup.exe".
Could not find command for "%s".
Could not find command for "%s".
Could not delete file or folder "%s".
Could not delete file or folder "%s".
Could not create folder "%s".
Could not create folder "%s".
Error in line %d of configuration data:
Error in line %d of configuration data:
Could not open archive file "%s".
Could not open archive file "%s".
1.6.0 develop [x86]
1.6.0 develop [x86]
2712 (30
2712 (30
1.6.0 develop [x86] build 2712 (December 30, 2012)
1.6.0 develop [x86] build 2712 (December 30, 2012)
Supported methods and filters, build options:
Supported methods and filters, build options:
Sorry, this program requires Microsoft Windows 2000 or later.
Sorry, this program requires Microsoft Windows 2000 or later.
CreateIoCompletionPort
CreateIoCompletionPort
_acmdln
_acmdln
ShellExecuteW
ShellExecuteW
ShellExecuteExW
ShellExecuteExW
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExW
SetWindowsHookExW
GetKeyState
GetKeyState
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
X%cX%c
X%cX%c
SfxString%d
SfxString%d
SfxFolderd
SfxFolderd
PasswordTitle
PasswordTitle
PasswordText
PasswordText
%X - X - X - X - X
%X - X - X - X - X
7ZSfxx.cmd
7ZSfxx.cmd
setup.exe
setup.exe
7ZipSfx.x
7ZipSfx.x
SfxVarCmdLine1
SfxVarCmdLine1
SfxVarCmdLine2
SfxVarCmdLine2
SfxVarCmdLine0
SfxVarCmdLine0
@ (%d%s)
@ (%d%s)
%original file name%.exe_484_rwx_004B8000_00001000:
KERNEL32.DLL
KERNEL32.DLL
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
GDI32.dll
GDI32.dll
MSVCRT.dll
MSVCRT.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
SHELL32.dll
SHELL32.dll
USER32.dll
USER32.dll
1.4.3
1.4.3
adb-installer-1.4.3.exe
adb-installer-1.4.3.exe
iexplore.exe_1252_rwx_00401000_00002000:
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
IE-X-X
IE-X-X
rsabase.dll
rsabase.dll
System\CurrentControlSet\Control\Windows
System\CurrentControlSet\Control\Windows
dw15 -x -s %u
dw15 -x -s %u
watson.microsoft.com
watson.microsoft.com
IEWatsonURL
IEWatsonURL
%s -h %u
%s -h %u
iedw.exe
iedw.exe
Iexplore.XPExceptionFilter
Iexplore.XPExceptionFilter
jscript.DLL
jscript.DLL
mshtml.dll
mshtml.dll
mlang.dll
mlang.dll
urlmon.dll
urlmon.dll
wininet.dll
wininet.dll
shdocvw.DLL
shdocvw.DLL
browseui.DLL
browseui.DLL
comctl32.DLL
comctl32.DLL
IEXPLORE.EXE
IEXPLORE.EXE
iexplore.pdb
iexplore.pdb
msvcrt.dll
msvcrt.dll
ADVAPI32.dll
ADVAPI32.dll
KERNEL32.dll
KERNEL32.dll
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
USER32.dll
USER32.dll
SHLWAPI.dll
SHLWAPI.dll
SHDOCVW.dll
SHDOCVW.dll
IExplorer.EXE
IExplorer.EXE
browseui.dll
browseui.dll
shdocvw.dll
shdocvw.dll
%original file name%.exe_484_rwx_00D8C000_00001000:
WinExec
WinExec
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
RegOpenKeyA
RegOpenKeyA
ShellExecuteA
ShellExecuteA
\setupx.exe
\setupx.exe
\updatex.exe
\updatex.exe
\Serverx.exe
\Serverx.exe
=.exet
=.exet
=.scrt
=.scrt
.idata
.idata
.reloc
.reloc
KERNEL32.dll
KERNEL32.dll
%original file name%.exe_484_rwx_00D91000_00001000:
USER32.DLL
USER32.DLL
ADVAPI32.DLL
ADVAPI32.DLL
MPR.DLL
MPR.DLL
WSOCK32.DLL
WSOCK32.DLL
SHELL32.DLL
SHELL32.DLL
hXXp://vguarder.91i.net/user.htm
hXXp://vguarder.91i.net/user.htm
hXXp://vguarder.bravehost.com/user.htm
hXXp://vguarder.bravehost.com/user.htm
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WinExec
WinExec
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
RegOpenKeyA
RegOpenKeyA
ShellExecuteA
ShellExecuteA
\setupx.exe
\setupx.exe
\updatex.exe
\updatex.exe
\Serverx.exe
\Serverx.exe
=.exet
=.exet
=.scrt
=.scrt
%original file name%.exe_484_rwx_00D93000_00004000:
.idata
.idata
.reloc
.reloc
KERNEL32.dll
KERNEL32.dll
USER32.DLL
USER32.DLL
ADVAPI32.DLL
ADVAPI32.DLL
MPR.DLL
MPR.DLL
WSOCK32.DLL
WSOCK32.DLL
SHELL32.DLL
SHELL32.DLL
hXXp://vguarder.91i.net/user.htm
hXXp://vguarder.91i.net/user.htm
hXXp://vguarder.bravehost.com/user.htm
hXXp://vguarder.bravehost.com/user.htm
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WinExec
WinExec
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
RegOpenKeyA
RegOpenKeyA
ShellExecuteA
ShellExecuteA
\setupx.exe
\setupx.exe
\updatex.exe
\updatex.exe
\Serverx.exe
\Serverx.exe
=.exet
=.exet
=.scrt
=.scrt
iexplore.exe_1252_rwx_00418000_00006000:
.ucB^
.ucB^
%CQ@G
%CQ@G
W:\M!q
W:\M!q
6.00.2900.5512 (xpsp.080413-2105)
6.00.2900.5512 (xpsp.080413-2105)
IEXPLORE.EXE
IEXPLORE.EXE
Windows
Windows
Operating System
Operating System
6.00.2900.5512
6.00.2900.5512
Explorer.EXE_1140_rwx_00FF0000_00001000:
%System%\Serverx.exe
%System%\Serverx.exe