Win32.Madangel.DIA_3618e0e786

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:928
%original file name%.exe:484
%original file name%.exe:1504
iexplore.exe:1252
Explorer.EXE:1140

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:928 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\Internet Explorer\IEXPLORE.EXE (332 bytes)
%System%\Serverx.exe (1504347 bytes)

The process %original file name%.exe:1504 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\amd64\winusbcoinstaller2.dll (10100 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\adb\AdbWinApi.dll (1862 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\adb\adb.exe (9241 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\amd64\WdfCoInstaller01009.dll (12517 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\i386\winusbcoinstaller2.dll (8723 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\androidwinusb86.cat (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\DPInst_x86.exe (7803 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\amd64\NOTICE.txt (236 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\i386\WdfCoInstaller01009.dll (12376 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\DPInst_x64.exe (9828 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\amd64\WUDFUpdate_01009.dll (18515 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\android_winusb.inf (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\adb\AdbWinUsbApi.dll (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\androidwinusba64.cat (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\i386\NOTICE.txt (236 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\install.bat (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\xp\SETX.exe (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\adb\fastboot.exe (5044 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\i386\WUDFUpdate_01009.dll (15584 bytes)

Registry activity

The process %original file name%.exe:928 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "35 E9 06 11 44 AD 03 63 7D 65 49 E7 B5 3A 75 CE"

The process %original file name%.exe:1504 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "67 EE 5F AE E0 40 BE F4 D2 9A BD 28 DE A1 C4 32"

Dropped PE files

MD5	File path
47a6ee3f186b2c2f5057028906bac0c6	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7ZipSfx.000\adb\AdbWinApi.dll
5f23f2f936bdfac90bb0a4970ad365cf	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7ZipSfx.000\adb\AdbWinUsbApi.dll
9e5dad83671d0d441be8347be4c246be	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7ZipSfx.000\adb\adb.exe
c3b07cfe26d2b91a2bcb20a8d535a365	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7ZipSfx.000\adb\fastboot.exe
0df1cb11aea7a66124fd18b4b15990a5	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7ZipSfx.000\driver\DPInst_x64.exe
6cb18e67db5c9f7da56d126f4b9d45a4	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7ZipSfx.000\driver\DPInst_x86.exe
ebf9ee8a7671f3b260ed9b08fcee0cc5	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7ZipSfx.000\driver\amd64\WUDFUpdate_01009.dll
4da5da193e0e4f86f6f8fd43ef25329a	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7ZipSfx.000\driver\amd64\WdfCoInstaller01009.dll
246900ce6474718730ecd4f873234cf5	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7ZipSfx.000\driver\amd64\winusbcoinstaller2.dll
e1bbe9e3568cf54598e9a8d23697b67e	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7ZipSfx.000\driver\i386\WUDFUpdate_01009.dll
a9970042be512c7981b36e689c5f3f9f	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7ZipSfx.000\driver\i386\WdfCoInstaller01009.dll
8e7b9f81e8823fee2d82f7de3a44300b	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7ZipSfx.000\driver\i386\winusbcoinstaller2.dll
aa1de4f07624771108a0a2b43e3bdc6d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7ZipSfx.000\xp\SETX.exe

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 734 bytes in size. The following strings are added to the hosts file listed below:

127.0.0.1	ZieF.pl

Rootkit activity

The Trojan installs the following user-mode hooks in ntdll.dll:

NtQueryInformationProcess
ZwOpenFile
NtCreateProcessEx
NtCreateProcess
NtCreateFile

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Scan a system with an anti-rootkit tool.
   
2. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
3. Delete the original Trojan file.
   
4. Delete or disinfect the following files created/modified by the Trojan:

   %Program Files%\Internet Explorer\IEXPLORE.EXE (332 bytes)
   %System%\Serverx.exe (1504347 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\amd64\winusbcoinstaller2.dll (10100 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\adb\AdbWinApi.dll (1862 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\adb\adb.exe (9241 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\amd64\WdfCoInstaller01009.dll (12517 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\i386\winusbcoinstaller2.dll (8723 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\androidwinusb86.cat (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\DPInst_x86.exe (7803 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\amd64\NOTICE.txt (236 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\i386\WdfCoInstaller01009.dll (12376 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\DPInst_x64.exe (9828 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\amd64\WUDFUpdate_01009.dll (18515 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\android_winusb.inf (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\adb\AdbWinUsbApi.dll (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\androidwinusba64.cat (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\i386\NOTICE.txt (236 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\install.bat (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\xp\SETX.exe (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\adb\fastboot.exe (5044 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\driver\i386\WUDFUpdate_01009.dll (15584 bytes)

5. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
   
6. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
7. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Snoop0
Product Name: 15 seconds ADB Installer
Product Version: 1.4.
Legal Copyright:
Legal Trademarks:
Original Filename: adb-installer-1.4.3.ex
Internal Name: adb-installe
File Version: 1.4.
File Description: 15 seconds ADB Installer
Comments:
Language: English (United States)

Company Name: Snoop0Product Name: 15 seconds ADB InstallerProduct Version: 1.4.Legal Copyright: Legal Trademarks: Original Filename: adb-installer-1.4.3.exInternal Name: adb-installeFile Version: 1.4.File Description: 15 seconds ADB InstallerComments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	389120	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	393216	57344	55296	5.5262	18aa317adce1d31150ddba79a7e3d9c4
.rsrc	450560	9603281	9603281	5.52583	8c9b2be20e3037633fb98baad338566c

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
irc.zief.pl	148.81.111.121

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

NICK ccqzsjif.USER j020501 . . :#a8a67a25e Service Pack 3.JOIN #.364.

:irc 001 ccqzsjif :Hi virtu.:irc 376 ccqzsjif :End of /MOTD command.:irc 001 ccqzsjif :Hi virtu.:irc 376 ccqzsjif :End of /MOTD command..:ccqzsjif JOIN #.364..:ccqzsjif JOIN #.364.

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_928:

!Require Windows

!Require Windows

.rsrc

.rsrc

:=i|%dH

:=i|%dH

%X]-$pp

%X]-$pp

*{k%u

*{k%u

''yL

''yL

.NNNNNNNNNNNNNNNN

.NNNNNNNNNNNNNNNN

.NNNNNNNNNNNNNNN

.NNNNNNNNNNNNNNN

KERNEL32.DLL

KERNEL32.DLL

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

GDI32.dll

GDI32.dll

MSVCRT.dll

MSVCRT.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

SHELL32.dll

SHELL32.dll

USER32.dll

USER32.dll

RunProgram="waitall:install.bat"

RunProgram="waitall:install.bat"

'K.Jj

'K.Jj

M.oU)

M.oU)

.pefl

.pefl

.Bo%R

.Bo%R

.CwbR

.CwbR

p;g%C

p;g%C

h.fE$=]

h.fE$=]

rH.rW

rH.rW

.aw$T

.aw$T

-t.jq

-t.jq

b %CtK

b %CtK

oM.zS

oM.zS

c 9%D*J=

c 9%D*J=

.zw-9K)

.zw-9K)

{].zmN0

{].zmN0

87.Fb

87.Fb

K-tR}

K-tR}

%Ure.

%Ure.

(..HH

(..HH

S%8Si

S%8Si

%fJrw

%fJrw

mw8.KZ2

mw8.KZ2

/C0%U@

/C0%U@

.GnH0WoK*VXvrQ

.GnH0WoK*VXvrQ

.Hl>md

.Hl>md

.zhPi

.zhPi

\%uFF

\%uFF

Ftp0r?(

Ftp0r?(

HK.lY

HK.lY

!.HR

!.HR

.DTf(

.DTf(

Ihpw.NP

Ihpw.NP

'>7$%d

'>7$%d

,e.MFM3

,e.MFM3

d.Dw i

d.Dw i

y7.SE-

y7.SE-

|0.NGZ

|0.NGZ

ca%sW

ca%sW

9H.wl

9H.wl

UG4%f

UG4%f

z.Ssu'

z.Ssu'

s-n%u

s-n%u

8v.BC4E

8v.BC4E

2.SUO

2.SUO

-5TQs}

-5TQs}

zN.Zz

zN.Zz

E[%c_

E[%c_

W9-xK.YT

W9-xK.YT

TM4%D

TM4%D

(E%F#

(E%F#

P.ol\ko

P.ol\ko

=:g*(

=:g*(

HA;%cw

HA;%cw

^.wOW

^.wOW

Q8A~X .Dir

Q8A~X .Dir

_&.lb

_&.lb

.nFnA

.nFnA

O%3Un

O%3Un

.aQnX

.aQnX

pPSkJþ

pPSkJþ

2zycMd

2zycMd

!;-c}-M

!;-c}-M

v.oJ8

v.oJ8

y.Wr,

y.Wr,

P.NWf

P.NWf

A%svd^

A%svd^

[]v%x

[]v%x

c[.XN

c[.XN

>%uZO

>%uZO

.Fy%H

.Fy%H

{k%C(h.

{k%C(h.

`.wrM

`.wrM

'!.Ap

'!.Ap

/ .xy:1>u

/ .xy:1>u

nn`Ú?

nn`Ú?

=.cxFkm

=.cxFkm

NL%FI

NL%FI

G%U} R

G%U} R

.dSOq

.dSOq

hsN-F%U{

hsN-F%U{

X.HIU

X.HIU

$.Ut\

$.Ut\

Ok%d $*

Ok%d $*

.py/(=

.py/(=

|q%Se

|q%Se

l.jDn

l.jDn

nuDP!

nuDP!

~

~

H.iV*i0'?

H.iV*i0'?

%XSZu*W4

%XSZu*W4

RrI.fW

RrI.fW

0%ud0

0%ud0

Zy%UF

Zy%UF

y.rug

y.rug

.kK%l

.kK%l

ez8%3u=g

ez8%3u=g

jM5`.xl

jM5`.xl

.kKW8%b

.kKW8%b

\.tPI

\.tPI

$|%SU

$|%SU

d4%f>

d4%f>

SBEW.cY

SBEW.cY

b`FLF.Ec_

b`FLF.Ec_

.cNI3

.cNI3

.AI%cl

.AI%cl

.LK9^

.LK9^

l=.RK

l=.RK

T6 .IQ

T6 .IQ

:%c.T'

:%c.T'

f%up,

f%up,

tQOw.cg

tQOw.cg

%un?2

%un?2

b.kKv

b.kKv

F:\#F

F:\#F

z2.uvIE

z2.uvIE

SE.GK8

SE.GK8

CS.JW

CS.JW

& .PQk

& .PQk

:.vNu

:.vNu

#y.nKO

#y.nKO

<.mvi>

<.mvi>

#w

#w

\.eAd

\.eAd

]7.Uq2b

]7.Uq2b

D1%FG

D1%FG

.mT j

.mT j

%U^4p

%U^4p

..iR1

..iR1

nQX-O4}&

nQX-O4}&

I.dIJ

I.dIJ

BT`%Cg

BT`%Cg

9ÃŽz

9ÃŽz

.tH55

.tH55

_Dj.vY Q

_Dj.vY Q

(.XCw

(.XCw

e%ui} t

e%ui} t

*

*

<.zb>

<.zb>

.HDn{9

.HDn{9

%D;aF,

%D;aF,

jN.prVq

jN.prVq

3;J_Wx%ut

3;J_Wx%ut

(%x.

(%x.

n;X%dWp

n;X%dWp

D%F.B

D%F.B

%d%f(

%d%f(

W]EXey

W]EXey

z!%uf

z!%uf

.CVB%

.CVB%

l _%S@

l _%S@

dSshx

dSshx

H.GL0

H.GL0

)(pöH

)(pöH

E:\QQ

E:\QQ

@-.Pn

@-.Pn

%FN0$

%FN0$

ye.vN

ye.vN

.CBE)K

.CBE)K

ZV6%Dk

ZV6%Dk

pF.yu

pF.yu

%fR)$

%fR)$

%x6YI

%x6YI

kEyp

kEyp

&TM%s

&TM%s

Tg.GD

Tg.GD

R#kEY

R#kEY

cmdv

cmdv

Q.XDu

Q.XDu

hp.zk/

hp.zk/

/yGk.Wn

/yGk.Wn

-btB}

-btB}

>%VC%fsK

>%VC%fsK

.ah~e=`}O

.ah~e=`}O

C&.VU

C&.VU

a.Ja`

a.Ja`

vsY.un

vsY.un

r?As.Yx

r?As.Yx

9.UbU

9.UbU

pl%U?

pl%U?

J.lAW

J.lAW

.VK_V

.VK_V

.MpBkX

.MpBkX

9.Owdy

9.Owdy

5b=y%u

5b=y%u

cO.sggi

cO.sggi

#NUDpj

#NUDpj

.eg\~,

.eg\~,

$%c&F;E

$%c&F;E

%h%ug

%h%ug

:!-}[t.EU=

:!-}[t.EU=

.mbgy~

.mbgy~

.Dv/y6

.Dv/y6

.LoEFu

.LoEFu

%cZvb

%cZvb

=.aG"

=.aG"

%F$Gz

%F$Gz

}x%.Gd

}x%.Gd

R.VS> "

R.VS> "

ko^L%xW

ko^L%xW

Û;h

Û;h

a2.tk

a2.tk

tA.PE-

tA.PE-

n (.mzW$

n (.mzW$

5O.drp

5O.drp

s6b%Sc

s6b%Sc

f-O}2e>

f-O}2e>

\W\<.tq>

\W\<.tq>

\m%.DN;G

\m%.DN;G

eq(%F

eq(%F

%D!`K

%D!`K

%xX,,

%xX,,

?}d.gwu

?}d.gwu

PH.DY

PH.DY

Q%D&x

Q%D&x

%C UvT

%C UvT

IÚ>

IÚ>

.pCkxk

.pCkxk

%X!yL

%X!yL

"5>\%fi

"5>\%fi

1K/L%Sc

1K/L%Sc

@j.cT^o

@j.cT^o

3.MjOB

3.MjOB

}Mg%4%D

}Mg%4%D

.QJ31

.QJ31

y!ga.vJZ

y!ga.vJZ

.rX_E

.rX_E

O%u:>1D

O%u:>1D

W.qO;

W.qO;

*.*[$

*.*[$

%XyIR1

%XyIR1

'q.Ha@

'q.Ha@

]E.NE

]E.NE

%Uz=%

%Uz=%

>E!:.lL-

>E!:.lL-

YW.QM

YW.QM

.Bxx^G>

.Bxx^G>

]B.aZ

]B.aZ

x.Nq

x.Nq

[tj%Xa

[tj%Xa

Y(.WJ

Y(.WJ

(.rBE

(.rBE

U%x]|X|XZ

U%x]|X|XZ

%C#"KN

%C#"KN

.DzNhf6

.DzNhf6

&.BzZ

&.BzZ

m.lP/

m.lP/

Z/*.dD4p

Z/*.dD4p

i.Chp

i.Chp

vWjp%SA

vWjp%SA

7.RK5

7.RK5

r%s?z

r%s?z

Ssh6d

Ssh6d

^.mcV

^.mcV

P2.kGy

P2.kGy

JY.HnN

JY.HnN

ue.Se

ue.Se

.Is~W

.Is~W

yË|oh

yË|oh

y{.Ih

y{.Ih

e.Nde

e.Nde

.jq/r

.jq/r

.uVwv

.uVwv

1.oFb

1.oFb

I!\6w2.BW

I!\6w2.BW

hf.NA

hf.NA

*".gf$

*".gf$

.lZB=

.lZB=

..rP~

..rP~

'15%F>

'15%F>

W%.KP

W%.KP

;.Ryn/

;.Ryn/

h.bBCZ9

h.bBCZ9

k%%D)w

k%%D)w

.XhZzS(

.XhZzS(

8.ZQ'

8.ZQ'

.frQmq

.frQmq

=.Eka%

=.Eka%

.VsF

.VsF

9fs%F

9fs%F

.xGuY

.xGuY

.hfVZam

.hfVZam

1o% ]%X

1o% ]%X

G.lM5z

G.lM5z

Q$%FG

Q$%FG

|%f=p

|%f=p

e[*%D

e[*%D

U,4>%d

U,4>%d

$c..Lq

$c..Lq

-f$hO%S

-f$hO%S

E[>{Z%F

E[>{Z%F

%X9e\

%X9e\

:.jG.

:.jG.

1Ul%x

1Ul%x

/f.cHy

/f.cHy

g%u[Q&

g%u[Q&

9;.aU

9;.aU

;m'%F

;m'%F

L&

L&

NG5%x;

NG5%x;

Wa.Di

Wa.Di

.Bw8r

.Bw8r

.Ec f

.Ec f

^_.Df

^_.Df

i%CHJ

i%CHJ

9.fft

9.fft

2z.lU=

2z.lU=

~M%xe

~M%xe

D.aF8s

D.aF8s

.mZmW~

.mZmW~

b4OU%D

b4OU%D

$-xX}

$-xX}

{[;%F

{[;%F

kic%X

kic%X

zu.cb

zu.cb

@G.lh

@G.lh

gk%s

gk%s

7.GAk

7.GAk

K=.RD

K=.RD

n2^o

n2^o

xN[.vu

xN[.vu

{n5,%d

{n5,%d

S.azC4

S.azC4

bl.jVI

bl.jVI

fZ.FM

fZ.FM

.knt(

.knt(

.uzn|08

.uzn|08

.qC2

.qC2

C%dlh

C%dlh

gc%uz-

gc%uz-

Ix&Z%uHD

Ix&Z%uHD

.CWr^w

.CWr^w

3.bpd

3.bpd

L.ak^

L.ak^

.k%Fg

.k%Fg

K$.bw

K$.bw

.Sld&J

.Sld&J

n.vUg

n.vUg

a.mS_

a.mS_

)[2.TxP

)[2.TxP

.%S'p$F

.%S'p$F

V73.Sk

V73.Sk

-bNU}

-bNU}

u %c%M

u %c%M

..Rz%

..Rz%

gzl%xO

gzl%xO

i`.QC

i`.QC

F/.bb

F/.bb

%U>v%

%U>v%

k%uGV

k%uGV

%u!w>i

%u!w>i

|Uw^.fT

|Uw^.fT

!%S4s

!%S4s

MUj.AF

MUj.AF

{$Ý

{$Ý

pAr%d-

pAr%d-

.KmVX{

.KmVX{

#(.lV

#(.lV

{.Nc3

{.Nc3

KO.We

KO.We

:-QEX.BU

:-QEX.BU

l5:

l5:

Ôb~

Ôb~

.PEJl

.PEJl

olB

olB

8&n@.Xe

8&n@.Xe

|k-Q}

|k-Q}

d%d!m

d%d!m

F%uo

F%uo

#.ibEd

#.ibEd

3%Xv0s

3%Xv0s

[4 ?.YW

[4 ?.YW

FtPa

FtPa

s.sd~

s.sd~

.rPV6k$

.rPV6k$

.GLxQg

.GLxQg

.Sfb>

.Sfb>

%URC=

%URC=

d%.KS-

d%.KS-

,%U c

,%U c

0p.Aq

0p.Aq

l>.Rl

l>.Rl

1ki.Mg

1ki.Mg

.NB%*

.NB%*

;S%x%T

;S%x%T

F\.ue

F\.ue

.aO^.s>

.aO^.s>

.Xf s|;

.Xf s|;

.VdP=

.VdP=

S.zy;

S.zy;

e}%s#;

e}%s#;

m.RT

m.RT

ðIm

ðIm

..RTH

..RTH

.pKpaX

.pKpaX

U-.sr

U-.sr

T2%UN

T2%UN

&a.Os

&a.Os

.jgZok

.jgZok

{n%fPym

{n%fPym

/Cj~.YD

/Cj~.YD

!E.ky

!E.ky

.vQ[M

.vQ[M

Hua~%S r

Hua~%S r

~ .cw

~ .cw

.vIXff

.vIXff

!z6'.LD

!z6'.LD

_.xQ'

_.xQ'

V.rX{

V.rX{

)xPp%D

)xPp%D

1.hIe

1.hIe

N..JF"b^wN#

N..JF"b^wN#

.OL

.OL

ûp U

ûp U

cq.OT

cq.OT

.LjVZ

.LjVZ

.jN_Q

.jN_Q

LYs8.pr

LYs8.pr

.Tkwt7z

.Tkwt7z

PfTp0

PfTp0

8E.CI

8E.CI

.hL\39

.hL\39

5Y7%F

5Y7%F

C%8UF

C%8UF

gV%xMLc

gV%xMLc

i^.AAE

i^.AAE

Vc.en

Vc.en

_V2.oPC&

_V2.oPC&

^]-Y}

^]-Y}

r.fo7=}m

r.fo7=}m

.ldEJ

.ldEJ

S{Eu%D

S{Eu%D

n.yoM

n.yoM

%D!Dl

%D!Dl

k%X&a

k%X&a

$%X0B

$%X0B

g3}

g3}

%F\

%F\

%x1'"

%x1'"

zFTP

zFTP

US.pGc

US.pGc

.vJMI

.vJMI

T2.el

T2.el

$%.zf

$%.zf

5\5?5.5:50

5\5?5.5:50

uvÅ’B

uvÅ’B

%\V<.tf>

%\V<.tf>

.act_

.act_

%C;R@

%C;R@

P&4K%S

P&4K%S

0S.cy?)G

0S.cy?)G

#.$;';)@

#.$;';)@

.Xf]U

.Xf]U

tQ>%x

tQ>%x

0u.oAP

0u.oAP

.wz{h_Vc

.wz{h_Vc

.Mb[|

.Mb[|

2Yg/D%S

2Yg/D%S

-1pd}

-1pd}

#HF%xX.

#HF%xX.

"#.md

"#.md

%UZ5=

%UZ5=

O%d,w

O%d,w

@@@@.As

@@@@.As

k.aIh

k.aIh

~S3%c

~S3%c

w.apsQ_

w.apsQ_

,p%F/zE

,p%F/zE

%U/&!ru

%U/&!ru

P.MF

P.MF

_7%cg?

_7%cg?

\*%UG

\*%UG

$Y%x$

$Y%x$

w.II"!,

w.II"!,

.Qtd@

.Qtd@

=A1%sgu

=A1%sgu

.zNKZ

.zNKZ

(%XZG$

(%XZG$

%x

%x

\.OyX

\.OyX

.xGDB{

.xGDB{

[.fod

[.fod

u-o}k

u-o}k

!| Ev@l%x

!| Ev@l%x

.AVW,

.AVW,

\.RbC

\.RbC

-n.mb

-n.mb

op}{%c

op}{%c

7&.gr_

7&.gr_

e/x.uu?

e/x.uu?

G%u9/e

G%u9/e

\@W.cC

\@W.cC

"Q.Qq

"Q.Qq

/.Hk*

/.Hk*

Di.kLJ

Di.kLJ

N.LK*

N.LK*

.MN:un

.MN:un

.JS_J

.JS_J

-v.AB@

-v.AB@

LK.ay

LK.ay

2=.nU

2=.nU

}õ;#

}õ;#

.wwwwwwww`w

.wwwwwwww`w

;:f%c

;:f%c

C!.iT

C!.iT

MO..ZH

MO..ZH

.EA0p

.EA0p

vg%uFGd

vg%uFGd

&I.UR

&I.UR

;.ce-

;.ce-

AHm%D

AHm%D

Mg%u>

Mg%u>

M%0s

M%0s

.xFyZ

.xFyZ

D|%x$K

D|%x$K

Ec.yj

Ec.yj

S.Lk!u"~

S.Lk!u"~

[R.aC

[R.aC

AZ#5.ZN

AZ#5.ZN

-q}:"

-q}:"

Ln%Sw

Ln%Sw

iW%dM

iW%dM

:.qhlVfi

:.qhlVfi

| %SZQ0

| %SZQ0

ac%U T

ac%U T

7S.tJM

7S.tJM

6K.tm

6K.tm

.pLjxO

.pLjxO

8]R.vd

8]R.vd

"j.hu

"j.hu

}1kÝ

}1kÝ

X.ZP_G

X.ZP_G

6 \r

6 \r

%x~{d

%x~{d

&kj%sO)

&kj%sO)

.WS1s

.WS1s

.Dwi^

.Dwi^

^.jY.zr

^.jY.zr

s.CELM

s.CELM

nE.GD

nE.GD

jyy.Er7{

jyy.Er7{

#].nv

#].nv

z .eJ

z .eJ

.DBd1[

.DBd1[

9.Fl#}

9.Fl#}

V#.mp

V#.mp

%C@K'

%C@K'

.kJ*A

.kJ*A

{1.cu

{1.cu

.ByYk

.ByYk

UA.jZ

UA.jZ

.cr`5]

.cr`5]

1^Tzo

1^Tzo

xq.Iuj

xq.Iuj

299.Ai

299.Ai

T)%u=Q

T)%u=Q

E.jKk

E.jKk

>O~

>O~

.jvoB

.jvoB

8.zO&T

8.zO&T

.xbF!

.xbF!

i %s|

i %s|

O?Ce.Ih

O?Ce.Ih

s3%d(

s3%d(

0.hv4

0.hv4

þ(#

þ(#

@7%x8

@7%x8

1%f$uqr

1%f$uqr

WQm

WQm

bX%U=]

bX%U=]

mj.nm

mj.nm

]9.jDmI

]9.jDmI

z%Cga(

z%Cga(

r|5.VZ

r|5.VZ

lO.pT

lO.pT

J[m%CR

J[m%CR

.wgaR

.wgaR

%.bB^

%.bB^

\X.Vo

\X.Vo

&U(.fR

&U(.fR

a.xxPZ

a.xxPZ

.RejS

.RejS

.hMdzC

.hMdzC

%9UGl*

%9UGl*

-{.rK

-{.rK

-Op}o

-Op}o

.eOG8Yt

.eOG8Yt

wEbM

wEbM

`0818%8!*

`0818%8!*

QHX5g.qe

QHX5g.qe

q&A.RSU

q&A.RSU

I%.Ar\

I%.Ar\

ZB.ur

ZB.ur

\mc%x

\mc%x

j,Ã’

j,Ã’

b_%uF

b_%uF

A>%F ;

A>%F ;

.KuAC

.KuAC

R"~.QA

R"~.QA

%X-Wd

%X-Wd

-v4}I2

-v4}I2

.iYf$

.iYf$

gTexE

gTexE

/-1v}

/-1v}

ls.yM

ls.yM

]DD.SU

]DD.SU

U&%SG

U&%SG

,Y^%%UN

,Y^%%UN

X*%sf

X*%sf

%Å’|

%Å’|

5N.zb

5N.zb

(udpb

(udpb

d.TL^

d.TL^

lftp

lftp

o>M%%U7

o>M%%U7

.TOv`g

.TOv`g

1b.mL

1b.mL

525

525

:%SqN

:%SqN

%DOJw

%DOJw

!b*C.kR*

!b*C.kR*

.By9h_

.By9h_

.azzm

.azzm

b%ukY`

b%ukY`

xB-i}

xB-i}

eul-

eul-

?hD0%c

?hD0%c

".bggo

".bggo

%S/6gbM

%S/6gbM

p"$.vB

p"$.vB

1Ã…4

1Ã…4

f.DaifL*

f.DaifL*

t~=v%S."

t~=v%S."

1.zQXa

1.zQXa

$c%u7

$c%u7

G?J

G?J

ue

ue

%D-2yx

%D-2yx

6q)%F

6q)%F

>>@.Eal

>>@.Eal

".yUH

".yUH

6,$=%X

6,$=%X

::%d_

::%d_

j%dp\

j%dp\

1n.Vz

1n.Vz

Ye.lG

Ye.lG

O8O

O8O

M^v%X

M^v%X

!.NE&

!.NE&

/T)J%c

/T)J%c

Tu, .ua

Tu, .ua

i.lNG

i.lNG

{,.yC

{,.yC

/ .An

/ .An

w.OP0@

w.OP0@

{.FAz

{.FAz

Ko%uR

Ko%uR

%So&yk

%So&yk

S.OHNR

S.OHNR

C.HQ6Dk

C.HQ6Dk

.pJ2S:

.pJ2S:

dzœ

dzœ

`%7XE

`%7XE

"H%Xz:J/|C

"H%Xz:J/|C

%S$RK

%S$RK

7N$%c

7N$%c

W%C]ei

W%C]ei

d-wQ}

d-wQ}

O_9%Fq

O_9%Fq

IL.rK

IL.rK

%f"nf

%f"nf

H|D%c

H|D%c

K%7sW

K%7sW

Y.yi8

Y.yi8

Z.zZ6;X

Z.zZ6;X

gV.fp

gV.fp

~-M}

~-M}

urI.;%F

urI.;%F

=.KpJ@

=.KpJ@

|.PXm

|.PXm

=%XFJ{

=%XFJ{

9g6.yu5

9g6.yu5

8>%xV

8>%xV

.DH.2

.DH.2

s`tS-C}

s`tS-C}

R.rxtqE="n

R.rxtqE="n

F.Cky"

F.Cky"

.cXEd

.cXEd

Bh'.Ck1

Bh'.Ck1

R.ee:dNx

R.ee:dNx

I5[%S

I5[%S

U5g--Z}

U5g--Z}

~Y%SY

~Y%SY

6.oHoTn

6.oHoTn

(gSqL

(gSqL

@%C%E%

@%C%E%

CMd0Z

CMd0Z

K-.wS$r

K-.wS$r

m$].wp.

m$].wp.

(C.SG

(C.SG

A!N'%u

A!N'%u

%syePt

%syePt

%u_JA

%u_JA

%3XJ?

%3XJ?

gV&.tp(

gV&.tp(

f-.tua

f-.tua

}o.Fd

}o.Fd

%xm_a/

%xm_a/

E-Tl}

E-Tl}

EZG%X

EZG%X

}.ow.

}.ow.

m=.Up]

m=.Up]

.gB5Dn

.gB5Dn

l.Pe1

l.Pe1

%dh:IN)-

%dh:IN)-

V.pzvq

V.pzvq

:O.ra

:O.ra

u.Wz/

u.Wz/

.Nc[S

.Nc[S

Ze.vf

Ze.vf

..pon

..pon

=fP.KBr

=fP.KBr

P%xy-_

P%xy-_

R%FP(Q

R%FP(Q

.aGWYb

.aGWYb

8`%S.

8`%S.

.NBYb

.NBYb

U.qcD

U.qcD

X$%c)

X$%c)

^msgj7

^msgj7

.beVOd

.beVOd

.cwydm

.cwydm

%XB`.s

%XB`.s

%uf9r

%uf9r

.lfjR

.lfjR

.HKl4G;

.HKl4G;

m%dy5

m%dy5

7Þ1

7Þ1

%Dw"l

%Dw"l

$WL`D

$WL`D

B.OYXh1^

B.OYXh1^

T.Os;b

T.Os;b

.bGvW

.bGvW

z1#%sO

z1#%sO

|.LCe

|.LCe

..bWL

..bWL

'}Dp%X

'}Dp%X

j[ftpV~x

j[ftpV~x

-ùh

-ùh

T%C\l

T%C\l

quDP`5!

quDP`5!

tcP2sd

tcP2sd

D}.BM

D}.BM

S;.QvS`

S;.QvS`

%U{[7

%U{[7

%ct.Y

%ct.Y

E%s%V

E%s%V

-y%S;O

-y%S;O

.USp!s

.USp!s

.mxz*

.mxz*

USER32.DLL

USER32.DLL

ADVAPI32.DLL

ADVAPI32.DLL

MPR.DLL

MPR.DLL

WSOCK32.DLL

WSOCK32.DLL

SHELL32.DLL

SHELL32.DLL

hXXp://vguarder.91i.net/user.htm

hXXp://vguarder.91i.net/user.htm

hXXp://vguarder.bravehost.com/user.htm

hXXp://vguarder.bravehost.com/user.htm

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

WinExec

WinExec

RegNotifyChangeKeyValue

RegNotifyChangeKeyValue

RegOpenKeyA

RegOpenKeyA

ShellExecuteA

ShellExecuteA

\setupx.exe

\setupx.exe

\updatex.exe

\updatex.exe

\Serverx.exe

\Serverx.exe

=.exet

=.exet

=.scrt

=.scrt

.idata

.idata

.reloc

.reloc

KERNEL32.dll

KERNEL32.dll

A.HK30

A.HK30

1.4.3

1.4.3

adb-installer-1.4.3.exe

adb-installer-1.4.3.exe

%original file name%.exe_928_rwx_004B8000_00001000:

KERNEL32.DLL

KERNEL32.DLL

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

GDI32.dll

GDI32.dll

MSVCRT.dll

MSVCRT.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

SHELL32.dll

SHELL32.dll

USER32.dll

USER32.dll

1.4.3

1.4.3

adb-installer-1.4.3.exe

adb-installer-1.4.3.exe

%original file name%.exe_928_rwx_00D95000_00002000:

\updatex.exe

\updatex.exe

\Serverx.exe

\Serverx.exe

=.exet

=.exet

=.scrt

=.scrt

.idata

.idata

.reloc

.reloc

KERNEL32.dll

KERNEL32.dll

USER32.DLL

USER32.DLL

ADVAPI32.DLL

ADVAPI32.DLL

MPR.DLL

MPR.DLL

WSOCK32.DLL

WSOCK32.DLL

SHELL32.DLL

SHELL32.DLL

hXXp://vguarder.91i.net/user.htm

hXXp://vguarder.91i.net/user.htm

hXXp://vguarder.bravehost.com/user.htm

hXXp://vguarder.bravehost.com/user.htm

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

WinExec

WinExec

RegNotifyChangeKeyValue

RegNotifyChangeKeyValue

RegOpenKeyA

RegOpenKeyA

ShellExecuteA

ShellExecuteA

\setupx.exe

\setupx.exe

%original file name%.exe_1504:

!Require Windows

!Require Windows

`.rsrc

`.rsrc

PSSSSSSh

PSSSSSSh

ttNt_Nt.Nt

ttNt_Nt.Nt

:Language:%u

:Language:%u

Enter password:

Enter password:

0xx

0xx

"%s".

"%s".

Could not overwrite file "%s".

Could not overwrite file "%s".

Could not create file "%s".

Could not create file "%s".

0xX.

0xX.

7-Zip: Internal error, code 0xX.

7-Zip: Internal error, code 0xX.

7-Zip: Internal error, code %u.

7-Zip: Internal error, code %u.

The archive is corrupted, or invalid password was entered.

The archive is corrupted, or invalid password was entered.

7-Zip: Unsupported method.

7-Zip: Unsupported method.

Error during execution "%s".

Error during execution "%s".

"setup.exe"

"setup.exe"

Could not find "setup.exe".

Could not find "setup.exe".

Could not find command for "%s".

Could not find command for "%s".

Could not delete file or folder "%s".

Could not delete file or folder "%s".

Could not create folder "%s".

Could not create folder "%s".

Error in line %d of configuration data:

Error in line %d of configuration data:

Could not open archive file "%s".

Could not open archive file "%s".

1.6.0 develop [x86]

1.6.0 develop [x86]

2712 (30

2712 (30

1.6.0 develop [x86] build 2712 (December 30, 2012)

1.6.0 develop [x86] build 2712 (December 30, 2012)

Supported methods and filters, build options:

Supported methods and filters, build options:

Sorry, this program requires Microsoft Windows 2000 or later.

Sorry, this program requires Microsoft Windows 2000 or later.

CreateIoCompletionPort

CreateIoCompletionPort

_acmdln

_acmdln

ShellExecuteW

ShellExecuteW

ShellExecuteExW

ShellExecuteExW

UnhookWindowsHookEx

UnhookWindowsHookEx

SetWindowsHookExW

SetWindowsHookExW

GetKeyState

GetKeyState

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

.NNNNNNNNNNNNNNNN

.NNNNNNNNNNNNNNNN

.NNNNNNNNNNNNNNN

.NNNNNNNNNNNNNNN

KERNEL32.DLL

KERNEL32.DLL

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

GDI32.dll

GDI32.dll

MSVCRT.dll

MSVCRT.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

SHELL32.dll

SHELL32.dll

USER32.dll

USER32.dll

RunProgram="waitall:install.bat"

RunProgram="waitall:install.bat"

'K.Jj

'K.Jj

M.oU)

M.oU)

.pefl

.pefl

.Bo%R

.Bo%R

.CwbR

.CwbR

p;g%C

p;g%C

h.fE$=]

h.fE$=]

rH.rW

rH.rW

.aw$T

.aw$T

-t.jq

-t.jq

b %CtK

b %CtK

oM.zS

oM.zS

c 9%D*J=

c 9%D*J=

.zw-9K)

.zw-9K)

{].zmN0

{].zmN0

87.Fb

87.Fb

K-tR}

K-tR}

%Ure.

%Ure.

(..HH

(..HH

S%8Si

S%8Si

%fJrw

%fJrw

mw8.KZ2

mw8.KZ2

/C0%U@

/C0%U@

.GnH0WoK*VXvrQ

.GnH0WoK*VXvrQ

.Hl>md

.Hl>md

.zhPi

.zhPi

\%uFF

\%uFF

Ftp0r?(

Ftp0r?(

HK.lY

HK.lY

!.HR

!.HR

.DTf(

.DTf(

Ihpw.NP

Ihpw.NP

'>7$%d

'>7$%d

,e.MFM3

,e.MFM3

d.Dw i

d.Dw i

y7.SE-

y7.SE-

|0.NGZ

|0.NGZ

ca%sW

ca%sW

9H.wl

9H.wl

UG4%f

UG4%f

z.Ssu'

z.Ssu'

s-n%u

s-n%u

8v.BC4E

8v.BC4E

2.SUO

2.SUO

-5TQs}

-5TQs}

zN.Zz

zN.Zz

E[%c_

E[%c_

W9-xK.YT

W9-xK.YT

TM4%D

TM4%D

(E%F#

(E%F#

P.ol\ko

P.ol\ko

=:g*(

=:g*(

HA;%cw

HA;%cw

^.wOW

^.wOW

Q8A~X .Dir

Q8A~X .Dir

_&.lb

_&.lb

.nFnA

.nFnA

O%3Un

O%3Un

.aQnX

.aQnX

pPSkJþ

pPSkJþ

2zycMd

2zycMd

!;-c}-M

!;-c}-M

v.oJ8

v.oJ8

y.Wr,

y.Wr,

P.NWf

P.NWf

A%svd^

A%svd^

[]v%x

[]v%x

c[.XN

c[.XN

>%uZO

>%uZO

.Fy%H

.Fy%H

{k%C(h.

{k%C(h.

`.wrM

`.wrM

'!.Ap

'!.Ap

/ .xy:1>u

/ .xy:1>u

nn`Ú?

nn`Ú?

=.cxFkm

=.cxFkm

NL%FI

NL%FI

G%U} R

G%U} R

.dSOq

.dSOq

hsN-F%U{

hsN-F%U{

X.HIU

X.HIU

$.Ut\

$.Ut\

Ok%d $*

Ok%d $*

.py/(=

.py/(=

|q%Se

|q%Se

l.jDn

l.jDn

nuDP!

nuDP!

~

~

H.iV*i0'?

H.iV*i0'?

%XSZu*W4

%XSZu*W4

RrI.fW

RrI.fW

0%ud0

0%ud0

Zy%UF

Zy%UF

y.rug

y.rug

.kK%l

.kK%l

ez8%3u=g

ez8%3u=g

jM5`.xl

jM5`.xl

.kKW8%b

.kKW8%b

\.tPI

\.tPI

$|%SU

$|%SU

d4%f>

d4%f>

SBEW.cY

SBEW.cY

b`FLF.Ec_

b`FLF.Ec_

.cNI3

.cNI3

.AI%cl

.AI%cl

.LK9^

.LK9^

l=.RK

l=.RK

T6 .IQ

T6 .IQ

:%c.T'

:%c.T'

f%up,

f%up,

tQOw.cg

tQOw.cg

%un?2

%un?2

b.kKv

b.kKv

F:\#F

F:\#F

z2.uvIE

z2.uvIE

SE.GK8

SE.GK8

CS.JW

CS.JW

& .PQk

& .PQk

:.vNu

:.vNu

#y.nKO

#y.nKO

<.mvi>

<.mvi>

#w

#w

\.eAd

\.eAd

]7.Uq2b

]7.Uq2b

D1%FG

D1%FG

.mT j

.mT j

%U^4p

%U^4p

..iR1

..iR1

nQX-O4}&

nQX-O4}&

I.dIJ

I.dIJ

BT`%Cg

BT`%Cg

9ÃŽz

9ÃŽz

.tH55

.tH55

_Dj.vY Q

_Dj.vY Q

(.XCw

(.XCw

e%ui} t

e%ui} t

*

*

<.zb>

<.zb>

.HDn{9

.HDn{9

%D;aF,

%D;aF,

jN.prVq

jN.prVq

3;J_Wx%ut

3;J_Wx%ut

(%x.

(%x.

n;X%dWp

n;X%dWp

D%F.B

D%F.B

%d%f(

%d%f(

W]EXey

W]EXey

z!%uf

z!%uf

.CVB%

.CVB%

l _%S@

l _%S@

dSshx

dSshx

H.GL0

H.GL0

)(pöH

)(pöH

E:\QQ

E:\QQ

@-.Pn

@-.Pn

%FN0$

%FN0$

ye.vN

ye.vN

.CBE)K

.CBE)K

ZV6%Dk

ZV6%Dk

pF.yu

pF.yu

%fR)$

%fR)$

%x6YI

%x6YI

kEyp

kEyp

&TM%s

&TM%s

Tg.GD

Tg.GD

R#kEY

R#kEY

cmdv

cmdv

Q.XDu

Q.XDu

hp.zk/

hp.zk/

/yGk.Wn

/yGk.Wn

-btB}

-btB}

>%VC%fsK

>%VC%fsK

.ah~e=`}O

.ah~e=`}O

C&.VU

C&.VU

a.Ja`

a.Ja`

vsY.un

vsY.un

r?As.Yx

r?As.Yx

9.UbU

9.UbU

pl%U?

pl%U?

J.lAW

J.lAW

.VK_V

.VK_V

.MpBkX

.MpBkX

9.Owdy

9.Owdy

5b=y%u

5b=y%u

cO.sggi

cO.sggi

#NUDpj

#NUDpj

.eg\~,

.eg\~,

$%c&F;E

$%c&F;E

%h%ug

%h%ug

:!-}[t.EU=

:!-}[t.EU=

.mbgy~

.mbgy~

.Dv/y6

.Dv/y6

.LoEFu

.LoEFu

%cZvb

%cZvb

=.aG"

=.aG"

%F$Gz

%F$Gz

}x%.Gd

}x%.Gd

R.VS> "

R.VS> "

ko^L%xW

ko^L%xW

Û;h

Û;h

a2.tk

a2.tk

tA.PE-

tA.PE-

n (.mzW$

n (.mzW$

5O.drp

5O.drp

s6b%Sc

s6b%Sc

f-O}2e>

f-O}2e>

\W\<.tq>

\W\<.tq>

\m%.DN;G

\m%.DN;G

eq(%F

eq(%F

%D!`K

%D!`K

%xX,,

%xX,,

?}d.gwu

?}d.gwu

PH.DY

PH.DY

Q%D&x

Q%D&x

%C UvT

%C UvT

IÚ>

IÚ>

.pCkxk

.pCkxk

%X!yL

%X!yL

"5>\%fi

"5>\%fi

1K/L%Sc

1K/L%Sc

@j.cT^o

@j.cT^o

3.MjOB

3.MjOB

}Mg%4%D

}Mg%4%D

.QJ31

.QJ31

y!ga.vJZ

y!ga.vJZ

.rX_E

.rX_E

O%u:>1D

O%u:>1D

W.qO;

W.qO;

*.*[$

*.*[$

%XyIR1

%XyIR1

'q.Ha@

'q.Ha@

]E.NE

]E.NE

%Uz=%

%Uz=%

>E!:.lL-

>E!:.lL-

YW.QM

YW.QM

.Bxx^G>

.Bxx^G>

]B.aZ

]B.aZ

x.Nq

x.Nq

[tj%Xa

[tj%Xa

Y(.WJ

Y(.WJ

(.rBE

(.rBE

U%x]|X|XZ

U%x]|X|XZ

%C#"KN

%C#"KN

.DzNhf6

.DzNhf6

&.BzZ

&.BzZ

m.lP/

m.lP/

Z/*.dD4p

Z/*.dD4p

i.Chp

i.Chp

vWjp%SA

vWjp%SA

7.RK5

7.RK5

r%s?z

r%s?z

Ssh6d

Ssh6d

^.mcV

^.mcV

P2.kGy

P2.kGy

JY.HnN

JY.HnN

ue.Se

ue.Se

.Is~W

.Is~W

yË|oh

yË|oh

y{.Ih

y{.Ih

e.Nde

e.Nde

.jq/r

.jq/r

.uVwv

.uVwv

1.oFb

1.oFb

I!\6w2.BW

I!\6w2.BW

hf.NA

hf.NA

*".gf$

*".gf$

.lZB=

.lZB=

..rP~

..rP~

'15%F>

'15%F>

W%.KP

W%.KP

;.Ryn/

;.Ryn/

h.bBCZ9

h.bBCZ9

k%%D)w

k%%D)w

.XhZzS(

.XhZzS(

8.ZQ'

8.ZQ'

.frQmq

.frQmq

=.Eka%

=.Eka%

.VsF

.VsF

9fs%F

9fs%F

.xGuY

.xGuY

.hfVZam

.hfVZam

1o% ]%X

1o% ]%X

G.lM5z

G.lM5z

Q$%FG

Q$%FG

|%f=p

|%f=p

e[*%D

e[*%D

U,4>%d

U,4>%d

$c..Lq

$c..Lq

-f$hO%S

-f$hO%S

E[>{Z%F

E[>{Z%F

%X9e\

%X9e\

:.jG.

:.jG.

1Ul%x

1Ul%x

/f.cHy

/f.cHy

g%u[Q&

g%u[Q&

9;.aU

9;.aU

;m'%F

;m'%F

L&

L&

NG5%x;

NG5%x;

Wa.Di

Wa.Di

.Bw8r

.Bw8r

.Ec f

.Ec f

^_.Df

^_.Df

i%CHJ

i%CHJ

9.fft

9.fft

2z.lU=

2z.lU=

~M%xe

~M%xe

D.aF8s

D.aF8s

.mZmW~

.mZmW~

b4OU%D

b4OU%D

$-xX}

$-xX}

{[;%F

{[;%F

kic%X

kic%X

zu.cb

zu.cb

@G.lh

@G.lh

gk%s

gk%s

7.GAk

7.GAk

K=.RD

K=.RD

n2^o

n2^o

xN[.vu

xN[.vu

{n5,%d

{n5,%d

S.azC4

S.azC4

bl.jVI

bl.jVI

fZ.FM

fZ.FM

.knt(

.knt(

.uzn|08

.uzn|08

.qC2

.qC2

C%dlh

C%dlh

gc%uz-

gc%uz-

Ix&Z%uHD

Ix&Z%uHD

.CWr^w

.CWr^w

3.bpd

3.bpd

L.ak^

L.ak^

.k%Fg

.k%Fg

K$.bw

K$.bw

.Sld&J

.Sld&J

n.vUg

n.vUg

a.mS_

a.mS_

)[2.TxP

)[2.TxP

.%S'p$F

.%S'p$F

V73.Sk

V73.Sk

-bNU}

-bNU}

u %c%M

u %c%M

..Rz%

..Rz%

gzl%xO

gzl%xO

i`.QC

i`.QC

F/.bb

F/.bb

%U>v%

%U>v%

k%uGV

k%uGV

%u!w>i

%u!w>i

|Uw^.fT

|Uw^.fT

!%S4s

!%S4s

MUj.AF

MUj.AF

{$Ý

{$Ý

pAr%d-

pAr%d-

.KmVX{

.KmVX{

#(.lV

#(.lV

{.Nc3

{.Nc3

KO.We

KO.We

:-QEX.BU

:-QEX.BU

l5:

l5:

Ôb~

Ôb~

.PEJl

.PEJl

olB

olB

8&n@.Xe

8&n@.Xe

|k-Q}

|k-Q}

d%d!m

d%d!m

F%uo

F%uo

#.ibEd

#.ibEd

3%Xv0s

3%Xv0s

[4 ?.YW

[4 ?.YW

FtPa

FtPa

s.sd~

s.sd~

.rPV6k$

.rPV6k$

.GLxQg

.GLxQg

.Sfb>

.Sfb>

%URC=

%URC=

d%.KS-

d%.KS-

,%U c

,%U c

0p.Aq

0p.Aq

l>.Rl

l>.Rl

1ki.Mg

1ki.Mg

.NB%*

.NB%*

;S%x%T

;S%x%T

F\.ue

F\.ue

.aO^.s>

.aO^.s>

.Xf s|;

.Xf s|;

.VdP=

.VdP=

S.zy;

S.zy;

e}%s#;

e}%s#;

m.RT

m.RT

ðIm

ðIm

..RTH

..RTH

.pKpaX

.pKpaX

U-.sr

U-.sr

T2%UN

T2%UN

&a.Os

&a.Os

.jgZok

.jgZok

{n%fPym

{n%fPym

/Cj~.YD

/Cj~.YD

!E.ky

!E.ky

.vQ[M

.vQ[M

Hua~%S r

Hua~%S r

~ .cw

~ .cw

.vIXff

.vIXff

!z6'.LD

!z6'.LD

_.xQ'

_.xQ'

V.rX{

V.rX{

)xPp%D

)xPp%D

1.hIe

1.hIe

N..JF"b^wN#

N..JF"b^wN#

.OL

.OL

ûp U

ûp U

cq.OT

cq.OT

.LjVZ

.LjVZ

.jN_Q

.jN_Q

LYs8.pr

LYs8.pr

.Tkwt7z

.Tkwt7z

PfTp0

PfTp0

8E.CI

8E.CI

.hL\39

.hL\39

5Y7%F

5Y7%F

C%8UF

C%8UF

gV%xMLc

gV%xMLc

i^.AAE

i^.AAE

Vc.en

Vc.en

_V2.oPC&

_V2.oPC&

^]-Y}

^]-Y}

r.fo7=}m

r.fo7=}m

.ldEJ

.ldEJ

S{Eu%D

S{Eu%D

n.yoM

n.yoM

%D!Dl

%D!Dl

k%X&a

k%X&a

$%X0B

$%X0B

g3}

g3}

%F\

%F\

%x1'"

%x1'"

zFTP

zFTP

US.pGc

US.pGc

.vJMI

.vJMI

T2.el

T2.el

$%.zf

$%.zf

5\5?5.5:50

5\5?5.5:50

uvÅ’B

uvÅ’B

%\V<.tf>

%\V<.tf>

.act_

.act_

%C;R@

%C;R@

P&4K%S

P&4K%S

0S.cy?)G

0S.cy?)G

#.$;';)@

#.$;';)@

.Xf]U

.Xf]U

tQ>%x

tQ>%x

0u.oAP

0u.oAP

.wz{h_Vc

.wz{h_Vc

.Mb[|

.Mb[|

2Yg/D%S

2Yg/D%S

-1pd}

-1pd}

#HF%xX.

#HF%xX.

"#.md

"#.md

%UZ5=

%UZ5=

O%d,w

O%d,w

@@@@.As

@@@@.As

k.aIh

k.aIh

~S3%c

~S3%c

w.apsQ_

w.apsQ_

,p%F/zE

,p%F/zE

%U/&!ru

%U/&!ru

P.MF

P.MF

_7%cg?

_7%cg?

\*%UG

\*%UG

$Y%x$

$Y%x$

w.II"!,

w.II"!,

.Qtd@

.Qtd@

=A1%sgu

=A1%sgu

.zNKZ

.zNKZ

(%XZG$

(%XZG$

%x

%x

\.OyX

\.OyX

.xGDB{

.xGDB{

[.fod

[.fod

u-o}k

u-o}k

!| Ev@l%x

!| Ev@l%x

.AVW,

.AVW,

\.RbC

\.RbC

-n.mb

-n.mb

op}{%c

op}{%c

7&.gr_

7&.gr_

e/x.uu?

e/x.uu?

G%u9/e

G%u9/e

\@W.cC

\@W.cC

"Q.Qq

"Q.Qq

/.Hk*

/.Hk*

Di.kLJ

Di.kLJ

N.LK*

N.LK*

.MN:un

.MN:un

.JS_J

.JS_J

-v.AB@

-v.AB@

LK.ay

LK.ay

2=.nU

2=.nU

}õ;#

}õ;#

.wwwwwwww`w

.wwwwwwww`w

;:f%c

;:f%c

C!.iT

C!.iT

MO..ZH

MO..ZH

.EA0p

.EA0p

vg%uFGd

vg%uFGd

&I.UR

&I.UR

;.ce-

;.ce-

AHm%D

AHm%D

Mg%u>

Mg%u>

M%0s

M%0s

.xFyZ

.xFyZ

D|%x$K

D|%x$K

Ec.yj

Ec.yj

S.Lk!u"~

S.Lk!u"~

[R.aC

[R.aC

AZ#5.ZN

AZ#5.ZN

-q}:"

-q}:"

Ln%Sw

Ln%Sw

iW%dM

iW%dM

:.qhlVfi

:.qhlVfi

| %SZQ0

| %SZQ0

ac%U T

ac%U T

7S.tJM

7S.tJM

6K.tm

6K.tm

.pLjxO

.pLjxO

8]R.vd

8]R.vd

"j.hu

"j.hu

}1kÝ

}1kÝ

X.ZP_G

X.ZP_G

6 \r

6 \r

%x~{d

%x~{d

&kj%sO)

&kj%sO)

.WS1s

.WS1s

.Dwi^

.Dwi^

^.jY.zr

^.jY.zr

s.CELM

s.CELM

nE.GD

nE.GD

jyy.Er7{

jyy.Er7{

#].nv

#].nv

z .eJ

z .eJ

.DBd1[

.DBd1[

9.Fl#}

9.Fl#}

V#.mp

V#.mp

%C@K'

%C@K'

.kJ*A

.kJ*A

{1.cu

{1.cu

.ByYk

.ByYk

UA.jZ

UA.jZ

.cr`5]

.cr`5]

1^Tzo

1^Tzo

xq.Iuj

xq.Iuj

299.Ai

299.Ai

T)%u=Q

T)%u=Q

E.jKk

E.jKk

>O~

>O~

.jvoB

.jvoB

8.zO&T

8.zO&T

.xbF!

.xbF!

i %s|

i %s|

O?Ce.Ih

O?Ce.Ih

s3%d(

s3%d(

0.hv4

0.hv4

þ(#

þ(#

@7%x8

@7%x8

1%f$uqr

1%f$uqr

WQm

WQm

bX%U=]

bX%U=]

mj.nm

mj.nm

]9.jDmI

]9.jDmI

z%Cga(

z%Cga(

r|5.VZ

r|5.VZ

lO.pT

lO.pT

J[m%CR

J[m%CR

.wgaR

.wgaR

%.bB^

%.bB^

\X.Vo

\X.Vo

&U(.fR

&U(.fR

a.xxPZ

a.xxPZ

.RejS

.RejS

.hMdzC

.hMdzC

%9UGl*

%9UGl*

-{.rK

-{.rK

-Op}o

-Op}o

.eOG8Yt

.eOG8Yt

wEbM

wEbM

`0818%8!*

`0818%8!*

QHX5g.qe

QHX5g.qe

q&A.RSU

q&A.RSU

I%.Ar\

I%.Ar\

ZB.ur

ZB.ur

\mc%x

\mc%x

j,Ã’

j,Ã’

b_%uF

b_%uF

A>%F ;

A>%F ;

.KuAC

.KuAC

R"~.QA

R"~.QA

%X-Wd

%X-Wd

-v4}I2

-v4}I2

.iYf$

.iYf$

gTexE

gTexE

/-1v}

/-1v}

ls.yM

ls.yM

]DD.SU

]DD.SU

U&%SG

U&%SG

,Y^%%UN

,Y^%%UN

X*%sf

X*%sf

%Å’|

%Å’|

5N.zb

5N.zb

(udpb

(udpb

d.TL^

d.TL^

lftp

lftp

o>M%%U7

o>M%%U7

.TOv`g

.TOv`g

1b.mL

1b.mL

525

525

:%SqN

:%SqN

%DOJw

%DOJw

!b*C.kR*

!b*C.kR*

.By9h_

.By9h_

.azzm

.azzm

b%ukY`

b%ukY`

xB-i}

xB-i}

eul-

eul-

?hD0%c

?hD0%c

".bggo

".bggo

%S/6gbM

%S/6gbM

p"$.vB

p"$.vB

1Ã…4

1Ã…4

f.DaifL*

f.DaifL*

t~=v%S."

t~=v%S."

1.zQXa

1.zQXa

$c%u7

$c%u7

G?J

G?J

ue

ue

%D-2yx

%D-2yx

6q)%F

6q)%F

>>@.Eal

>>@.Eal

".yUH

".yUH

6,$=%X

6,$=%X

::%d_

::%d_

j%dp\

j%dp\

1n.Vz

1n.Vz

Ye.lG

Ye.lG

O8O

O8O

M^v%X

M^v%X

!.NE&

!.NE&

/T)J%c

/T)J%c

Tu, .ua

Tu, .ua

i.lNG

i.lNG

{,.yC

{,.yC

/ .An

/ .An

w.OP0@

w.OP0@

{.FAz

{.FAz

Ko%uR

Ko%uR

%So&yk

%So&yk

S.OHNR

S.OHNR

C.HQ6Dk

C.HQ6Dk

.pJ2S:

.pJ2S:

dzœ

dzœ

`%7XE

`%7XE

"H%Xz:J/|C

"H%Xz:J/|C

%S$RK

%S$RK

7N$%c

7N$%c

W%C]ei

W%C]ei

d-wQ}

d-wQ}

O_9%Fq

O_9%Fq

IL.rK

IL.rK

%f"nf

%f"nf

H|D%c

H|D%c

K%7sW

K%7sW

Y.yi8

Y.yi8

Z.zZ6;X

Z.zZ6;X

gV.fp

gV.fp

~-M}

~-M}

urI.;%F

urI.;%F

=.KpJ@

=.KpJ@

|.PXm

|.PXm

=%XFJ{

=%XFJ{

9g6.yu5

9g6.yu5

8>%xV

8>%xV

.DH.2

.DH.2

s`tS-C}

s`tS-C}

R.rxtqE="n

R.rxtqE="n

F.Cky"

F.Cky"

.cXEd

.cXEd

Bh'.Ck1

Bh'.Ck1

R.ee:dNx

R.ee:dNx

I5[%S

I5[%S

U5g--Z}

U5g--Z}

~Y%SY

~Y%SY

6.oHoTn

6.oHoTn

(gSqL

(gSqL

@%C%E%

@%C%E%

CMd0Z

CMd0Z

K-.wS$r

K-.wS$r

m$].wp.

m$].wp.

(C.SG

(C.SG

A!N'%u

A!N'%u

%syePt

%syePt

%u_JA

%u_JA

%3XJ?

%3XJ?

gV&.tp(

gV&.tp(

f-.tua

f-.tua

}o.Fd

}o.Fd

%xm_a/

%xm_a/

E-Tl}

E-Tl}

EZG%X

EZG%X

}.ow.

}.ow.

m=.Up]

m=.Up]

.gB5Dn

.gB5Dn

l.Pe1

l.Pe1

%dh:IN)-

%dh:IN)-

V.pzvq

V.pzvq

:O.ra

:O.ra

u.Wz/

u.Wz/

.Nc[S

.Nc[S

Ze.vf

Ze.vf

..pon

..pon

=fP.KBr

=fP.KBr

P%xy-_

P%xy-_

R%FP(Q

R%FP(Q

.aGWYb

.aGWYb

8`%S.

8`%S.

.NBYb

.NBYb

U.qcD

U.qcD

X$%c)

X$%c)

^msgj7

^msgj7

.beVOd

.beVOd

.cwydm

.cwydm

%XB`.s

%XB`.s

%uf9r

%uf9r

.lfjR

.lfjR

.HKl4G;

.HKl4G;

m%dy5

m%dy5

7Þ1

7Þ1

%Dw"l

%Dw"l

$WL`D

$WL`D

B.OYXh1^

B.OYXh1^

T.Os;b

T.Os;b

.bGvW

.bGvW

z1#%sO

z1#%sO

|.LCe

|.LCe

..bWL

..bWL

'}Dp%X

'}Dp%X

j[ftpV~x

j[ftpV~x

-ùh

-ùh

T%C\l

T%C\l

quDP`5!

quDP`5!

tcP2sd

tcP2sd

D}.BM

D}.BM

S;.QvS`

S;.QvS`

%U{[7

%U{[7

%ct.Y

%ct.Y

E%s%V

E%s%V

-y%S;O

-y%S;O

.USp!s

.USp!s

.mxz*

.mxz*

USER32.DLL

USER32.DLL

ADVAPI32.DLL

ADVAPI32.DLL

MPR.DLL

MPR.DLL

WSOCK32.DLL

WSOCK32.DLL

SHELL32.DLL

SHELL32.DLL

hXXp://vguarder.91i.net/user.htm

hXXp://vguarder.91i.net/user.htm

hXXp://vguarder.bravehost.com/user.htm

hXXp://vguarder.bravehost.com/user.htm

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

WinExec

WinExec

RegNotifyChangeKeyValue

RegNotifyChangeKeyValue

RegOpenKeyA

RegOpenKeyA

ShellExecuteA

ShellExecuteA

\setupx.exe

\setupx.exe

\updatex.exe

\updatex.exe

\Serverx.exe

\Serverx.exe

=.exet

=.exet

=.scrt

=.scrt

.idata

.idata

.reloc

.reloc

KERNEL32.dll

KERNEL32.dll

%s:*:enabled:@shell32.dll,-1

%s:*:enabled:@shell32.dll,-1

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer

Qoyirc.zief.pl

Qoyirc.zief.pl

proxim.ircgalaxy.pl

proxim.ircgalaxy.pl

NICK gvhmdwhu

NICK gvhmdwhu

SFC.DLL

SFC.DLL

SFC_OS.DLL

SFC_OS.DLL

SHLWAPI.DLL

SHLWAPI.DLL

WININET.DLL

WININET.DLL

%.6x . . :%c%.8x%x %s

%.6x . . :%c%.8x%x %s

JOIN

JOIN

127.0.0.1 ZieF.pl

127.0.0.1 ZieF.pl

#

#