Sample details: 4084145491c52a4ab0afcf0f44d7e949 --

Hashes
MD5: 4084145491c52a4ab0afcf0f44d7e949
SHA1: 73322e5818ff73da4f7383484a4c6f57029c6e19
SHA256: 4adefbce4f5fd6b6b4649013acc98d5071eb8524dee0db38f10cfc960a87a053
SSDEEP: 24576:t2klg+S/qITj7lTARkxu0AJiizvsStC3r2M:IYS/nTjmkx6JiivsStC3r2M
Details
File Type: Composite
Yara Hits
CuckooSandbox/shellcode | CuckooSandbox/embedded_pe | CuckooSandbox/embedded_win_api | YRP/domain | YRP/IP | YRP/url | YRP/contentis_base64 | YRP/maldoc_OLE_file_magic_number | YRP/escalate_priv | YRP/screenshot | YRP/win_registry | YRP/win_token | YRP/win_private_profile | YRP/win_files_operation | YRP/CRC32_poly_Constant | YRP/suspicious_packer_section |
Strings
		Package
Package
C:\Users\777\Downloads\Telegram Desktop\
C:\Users\777\AppData\Local\Temp\
!This program cannot be run in DOS mode.
`.rdata
@.data
.ndata
 s495L
v#Vh|,@
Instu`
softuW
NulluN	E
D$$Ph,
D$(SPS
Vj%SSS
D$$+D$
D$,+D$$P
_^[t	P
HtVHtHH
UXTHEME
USERENV
SETUPAPI
APPHELP
PROPSYS
DWMAPI
CRYPTBASE
OLEACC
CLBCATQ
NTMARTA
RichEdit
RichEdit20A
RichEd32
RichEd20
.DEFAULT\Control Panel\International
Control Panel\Desktop\ResourceLocale
Software\Microsoft\Windows\CurrentVersion
\Microsoft\Internet Explorer\Quick Launch
MulDiv
DeleteFileA
FindFirstFileA
FindNextFileA
FindClose
SetFilePointer
GetPrivateProfileStringA
WritePrivateProfileStringA
MultiByteToWideChar
FreeLibrary
LoadLibraryExA
GetModuleHandleA
GlobalAlloc
GlobalFree
ExpandEnvironmentStringsA
lstrcmpA
lstrcmpiA
CloseHandle
SetFileTime
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
SetFileAttributesA
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetEnvironmentVariableA
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
lstrlenA
GetVersion
SetErrorMode
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
ReadFile
WriteFile
lstrcpyA
MoveFileExA
lstrcatA
GetSystemDirectoryA
GetProcAddress
GetExitCodeProcess
WaitForSingleObject
KERNEL32.dll
EndPaint
DrawTextA
FillRect
GetClientRect
BeginPaint
DefWindowProcA
SendMessageA
InvalidateRect
EnableWindow
ReleaseDC
LoadImageA
SetWindowLongA
GetDlgItem
IsWindow
FindWindowExA
SendMessageTimeoutA
wsprintfA
ShowWindow
SetForegroundWindow
PostQuitMessage
SetWindowTextA
SetTimer
CreateDialogParamA
DestroyWindow
ExitWindowsEx
CharNextA
DialogBoxParamA
GetClassInfoA
CreateWindowExA
SystemParametersInfoA
RegisterClassA
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
USER32.dll
SelectObject
SetTextColor
SetBkMode
CreateFontIndirectA
CreateBrushIndirect
DeleteObject
GetDeviceCaps
SetBkColor
GDI32.dll
SHFileOperationA
SHGetFileInfoA
SHBrowseForFolderA
SHGetPathFromIDListA
ShellExecuteExA
SHGetSpecialFolderLocation
SHELL32.dll
RegEnumValueA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
SetFileSecurityA
RegOpenKeyExA
RegCreateKeyExA
ADVAPI32.dll
ImageList_Destroy
ImageList_AddMasked
ImageList_Create
COMCTL32.dll
CoCreateInstance
OleUninitialize
OleInitialize
CoTaskMemFree
ole32.dll
verifying installer: %d%%
Installer integrity check has failed. Common causes include
incomplete download and damaged media. Contact the
installer's author to obtain a new copy.
More information at:
http://nsis.sf.net/NSIS_Error
Error launching installer
... %d%%
SeShutdownPrivilege
NSIS Error
Error writing temporary file. Make sure your temp folder is valid.
%u.%u%s%s
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
VERSION
SHGetFolderPathA
SHFOLDER
SHAutoComplete
SHLWAPI
SHELL32
InitiateShutdownA
RegDeleteKeyExA
ADVAPI32
GetUserDefaultUILanguage
GetDiskFreeSpaceExA
SetDefaultDllDirectories
KERNEL32
[Rename]
*?|<>/":
%s%s.dll
wwwwwwwxp
wwwwwwww
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="*" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v3.04</description><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/><supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/></application></compatibility></assembly>
NullsoftInst
ep30^`
UUy#VC
=`}e6Fo)>Pl
;]ILIS
+1,_Kz(Y^uH
DGPzOHt
CG$S|DC>b%X
~#CxFD
'UA<Ju	
-v*@|I
gX.bq)
|	DRj|^e
usQfl6
]9N&~e
e(e-J	
XQ@_B !
4:(iaM
VFZ3sd
$ v]CX
YEDHh!
N1llJd
|^yX+{W
&ylx*TY
b})tNJ
F=oRms(
d_'AHKev
j	OyI;*
XZv&[m
C3'R4__
I<=BI)
?0;I>k
>X Cu)	
08m*MH,
br=\*\
Y\?nkY
@rOG4m
pPi"y>K
(_bmnuR
P#Y?"E A
F43(~'C
\>jP+>
"_PKr#
YX@,lE
C+y;-(
Y1-?]V
XrC|Fz@
"oj/$# 
z6m?6?
#Dz68	
`$$uz}
S:d!~H
9hOC<l
L.0W9yDR
<BGTa|
EYSEQ1
iH>wpC
i5 j2>
'q)/nw
/~;/2dn$7
P$? Z@vz	
y`3Zc?
/{#rY@(
[O@{8^
t~i}){9n
A0cCu<[
2D<7Mi
 4&+	-
D>2X;0Va
N+U;/y
kZ`W$H
{cD	k;$M
j!STVJ
 dd`OB
{zNsO,
p8*P]-
-j_uux
"[]mLZ
	<tB"|%
]e[&+)
("&xx0
'q{(rGH
Iv*5$N: 
X,%z!!
N*BnL6
W5h2FT
82`fn]1g&N
mW3W#=
Xz~(SEU
i;uvZP^#
dR+h0?o
y8LK04
:6>N!U
[}=UUF
^^<7/:N
aO&	p]
7D6DLb[M
ne{'Ru
PeELGlC
A(=Yfu
6dpR";
vOb;IxC
1SGKg_.
aW|KVzE
5[xN, 
zfR&f$
A@O -@
IU*.)W
<$i%Wj
=s9qg,g
aEk,.z
>a8!X1
SbP2o=\)W
f)In1+
*qs	{}
V*e!ozE]P
@TJ`|`W
8Ck`P{
u#.qpvd:
u6CO	aO
5&9-~+
w<^\l(:
e"Jb"i	
'0*i)Q?aLy	M
JiZ}l>
F+M%(`XZi	
)6+_5[
lP+ru/
 TQQ	t
Gs~*62k7
lB&jD6X
o[K_U1
Eb'9<a
g<:shP{
bzq$zWz
4CjRK9
=b`JI{I
:xtxK^
7YR5q!
LbxN#A
a'&@w5
A742d\
	d1.bl
bX#/7#7
|h,/4f3
Z`P!b:n
z.<Zt$
^Gk]`#V
mvhdE_
X	\bPJ&>L
jPTt"-
4	?Cy'
,Sv2[Z
MbB%^e^
mVTShp
Os++Bt
mpv2[Y3
iaeKT6'br
Anu>-{
z0/(wP
:HpUyE+
=Lq.:C
bdpbm&
a5{5.=/
]MC#=^
sd?9J:0
iGi#Zgl<P
#w`w`_F
{1PzWo
$OQQ11qq	
|@!`1`
'phOxxl$
Nzrd4+
[QDJdjd
;"&752
 kvt|n
h7YO)1
 ckTal
MJ1vJ)F&
<m=Qjd*aM?
MR);J&e
OHLJNIMK
_v)_-iP4
-8XsV0
_l<ucb
,^y-=r
cq4egs
4#q{1}C
R(}<(=
(}\)}R(
cs 6	.
nbk#wr(
>wWZz%G
$j\&3w
fk!VNz
\Uclz2~
}NZWgk
0mS.?L
5b(#F5
Dkzr s
	b'pY$
]!bF&+5:
)w?>Q)z
n+#rNv
8Cn	 E
NVp!L:2
3HJt}q
%'MCr+
\9A?:t
:%L]2VR;
>8VT;.?g
-w{m$n
R@J5T0t
km^`8}Nb
rZMo[=C^&
w\3=~k
?q=3Zo
*#{E$n|
QNx[1}
o;RB[.-\
+DbEdWTV
peIvPsT|J
CWe>Zx|
M9#j/K
ThT<ur
i4bAOd0
OJJJKMKM
QNBbB"
m\ \AYuR
d6;YB^
?4*2"@
K]pe`B
y;&eu+_
8jT-N	
M@%T@P9
8ak;N"
+mY3N_A
g_bl!7
35//oM
ZPn :J
RRQ%o^
jEW.Tke
y4VD%?
,%-<'BDM
P!paSYl
TTT[tj
\pT",^
=+?gOz_
Yo_,q(
,(AnfB
e\!j\!n\aV
z<q+{q
Kb",lz
cP*=@d_
9*=JEUUM4,
c`I|I=	
^^f[1,`o
UgqnKc
_j_IT'e^D
)}As^o
*ubo._
2$?c4Y
085kye
2[9|Jm
G	.~KE>
n{'IJ^
7kJ<g\sI
	*oyQJ
}tFBR+
j	kwadp
5URwJk
322XC}
o|'B,w
y$xt`G
j''$q[
7WyU7W/
|v7#DPhw
46XyP(
yC+qG1A
aq8e\0N
I{HR$<I
<E^"SS
PoPc`n
E>Ev$_"'
'=#='u
@zD*!U
tR&);fA	
b20Y`O
(I0)rh(
pH^@If
)3;}1D
YQIPK/P
+bG_xE
?2y}_>
y1`a0}
DgV<L#
pG,M^UQ?e
Iu	HxV
e9KQEZ
kT]);L
OrRi/D
8[k7Lxc7n
=wP{Ir
l.+K<!
oWI.Cy
#_pCwp
.&lqDx
Lx%&Y?
u/5]G[
yJ'4>C
@mNtUP
|2N<;`
!MO:B0&
91j!|n
q!>O3[
CU^wv 
zPB\Kx
p-a,bD
1<dxO5
{"g2O+
L^AHL^
z>3p=X
\{	.kg
y;P:wP
QX1G*EnA
k/8 [SqR
K?5wJft
kS"'I+
JM3)yFum
;\c$*<
!%Fu!D
6Ns{,S
sP=Goi
	B	@$y^
Sz5rTH
}arK&Z
P?C1vx
CP,wHrV*
9@:H#m
L	Cj)r
>y*dQT
SO!]K5w
c !G.0q
LWE	Wb
t}yac!
S_"tRbx
&r1/Si
{gVof6
cpJf5:
>5''a6X
5+*x:bJ#6
JE00+VS
XH)nJ|
`|XoHL
+T<ZkX
Ip1XSK
X<6n>:
x_hGeJ
!{GxSS
w/XNmd
Vegu&T
KdTeD4
r0e&7d@
\T*y[]	
F7"gYN7
+,psrl
{ ~f1{
iqjwg6
IOjH2@
}U|'a(g
/%\\+7~ew
y@=biH~*
LB~u;F
%N:R7Eq
qCe" V 
"m9IK~
jx?`4y
hvU8l=
sxNO#B|.
nR(\ 3_]U)
JrMB.%
Yw0&sK!0
M7=dbR
2CS`\R
^p?8UA
h+1esr
_.pfk/
7QF.R789d@
0/.BI~s
~LAX3Q
b2Vjd}
#S@Ao(<"v
v(J39\c
wU6<:@
ggtD[V
uh@7%hs
,mb[L,
 {eaUj
XKi7 -8
]P2Hg*
0*-S3hn
1QHIjE
~W[Zq:V)
s,}WHv
6AQ`Pr
hz]#o~
kr2[>O
4J2#c*:6.R
RL0@N?
d>BG&m
EBsfvu
j]+P*	
 agwKLV
;Y)hPsZ
LWocJJ
`V)HZDQrZ'l9
1NUv f[G3
6KgNv%%3
z0r+*{
8;Eh@~
!jugVTz
?p>8AP
lwq'E9
n-#{dSQ
.eH-+gb
S~r5I=
84=m4TQ
;kj%2e
$-B:Y:{f
5Xo#'?V
.kvhQz7M
K(fv@=
F+//{X-
Bb4rc0y#5R 
?il4918
x4Y/>t
^:Aa-"
4Uo;>!
WtyAOw.
RKavTT
mMgyjc
D&n?^.
*ML?w~PR
KApUaW1
]R/4Jc
d7*Yjp
Ze@k{U
q1KHYQ
G:ymMt
_?H	*[
sD0q& 
 pmWT(@
{T{^~#')M
NHf B`
QgHJ:V
\e?{]5
	klikn
u[bT2y
4Y~xRZ,
E8`OvsO
<09NzPTLj
-m=z{+
Iz:55TR
v?4x|)
nR159xi{
L*amI9
'4%=I]
~_!w/ea
J\?{ d
..Y~ j
~+ddD`F
` FEA,
oX',N;h
4cFB)f
]$ b,x
VvTw4s
f'&=_]
&P~)RF
wQ2iPF
Yw~4.>
O#/ro'
HT	OZ6m]
B\,XUer
n-jCx#
 w^.^/
VIRkl	
t@R<$7*
>:S~X(v
<5f	nu
mMm@@8
~?iB&cI
nr`m[qJ
Yg	VJr
A-ZF@.
?*t_g=\
Qd]$tQ
'W,,	~M*
Xz)P?V
"u0Suw
SY:Ga_w
A$jY|%
FLI'0M
zOn%D9
tr{J.\JF
 z s[m
d/0\	<\
<+_KCn
t~60WSX
ID9k~z
masJ/~s
{(*_/%,
==tQ&{
Oj5jtr
tyrMJ<
R;vYzJ
DCCY-;'
N|<S#9I
tqgs<;
0^}^.(
2$%eSXlc
<yntS$
<Y w+a
J2W)v?^#
]o8zBd
IJ	%Om
RyQ*Hx
kfCr:;1
+[K5!\I
*D.6R@
0;esl^Gd
=I{y?h
op_m8f
G$,RBcA
r.I3Hj
9xly|:/
! RJeL
12GhV?
yO'Abj
K043:,
;F<P	L
"mJI7I
jwiRa#
U=Ck;h
X}/dK)
>SxB9Y
Xbm/g	
lm!@I|
q`ZqJw
u9No5_
ii?'h*}
@e&eI9/
8pY"yd
g	Ur}@!
C3oWYY):6^
nGw@0l.
?hZy8\
fU:-z{
~i9lFr[
_lq%% 2
5"%d]k
wl74A]
P\6c:rs.j:
tI61YM9k
.Eqd10
8tk95]
O}AD'.
s8Mdm(
 UhRlY
CjNA|>
eB6l1x
>-izWB
@JFq.'zP
c!]3N%H
cN|1.D0
q~.Y[Qe2S
N &O$:
i3<%l2
Hl]p_f-
pne,9U
r 0q68/
Vj*2up
/|m^It7
aO&`7L7%
/{C"/f
#_Cerr
NU2eul#
?M**k\0
u>Ff&A
'.5{:=@
!Q&XW|.
bZZg?>
69 o{$"
{3PV*KT`A	
KZo%;q
C4q#w6
iu@"sqg"
M0#a^<l
?p9BpW
O;=`f)
BiF"cH
Tx	61|
oRwhIi
`n'9Dy
a-RM2W=
PN ?W%
aM?p;H
'[-Fp"i
oo ZkTZ`^
n)0FY3
G@WDfA=
`,.uwL?e
M/U(z 
NJLpul
&	N~*\
#ffJO)9-\
TKA;HP>,
Isk`xT
0U6XU%t
G~Y;-K
;d,fwx
xj2a[;
"	Hwa@
0u(#;&
QozZKK
xnD$TF
O86M?t
I17((l
B=-c51
4RAg[h
M14QK,
eB/;>q
t"Ki(Z
#SA$g@
ART]Ip
.NE"?U
$^|=ic
NY<u`H
=Bq<]j
'|B$DZ
zEL8n#
yTA<.g
>n`t~PdN
<n,dF4
CiBGp7|
Vv3) mU
smo3_"@nD
9$)lK-
[:y'Gi
!jH(+?n%y
-]9bp0
}1J0-&
`~d[XU
B~fiBy
PShIq[
lFL<ZA
s]UsGd
ZvtzDu
Y{djdf
]anns^
TT,vW$2
cm/	P-
C=%X3:
XuLL")
 ;AxS4
!Kaw&b
c?MKd70
:/0lXq
mWR:aV
r	cg0Z7
SjL~4\n3
ZGQWyu
q;UDq0
	G$<K?
==]h6&i
k:'"#P
;KzDC<
)#upi1
.gm`}_
BP5	O4:
H}m`HD
,+,-_e
;H4~UQ
btP-} y
(jIQm8.c
1VU-6v
dOPEq0
d:@+wmb`&
v@B~RDr
;Qc?@YsC
wq8txv
:f_\fOh
:	"Gg%
V`2"[,
y!,8m]
O#r@FU
+7JUeu
 $qO#'w
4i+N0F
XtAxza
;Mtb7|O#p
(Ia\Ju
Z!q.Ml
KKL+xL
o`@v"O
+K8D%k
nWURU!
)-#OlzO
AwI[wj
u{h4Gd
tFs82@
l,({Kqt
 2e	~[
WBlBg}
ut oE|
26@!hY
wbFD%n
8]rcJY
.RvF4g
u	AV7l
!qN;6.
n(AB.#
[=R!nSq
6''J%i
oA`/^S
zt/EwJ;z
;m >d6
q8Xa$t
wVy!xn*
*lH;hV
m}%h>B
uFV-`Z
)Z[ZX&
*CR:qI
0P0!b9`
[a(UO{
<Yi<"s	
h	KW/'V
*-	[$#b
Bqn5As
	lZdU(
X1zad 1byr
k)%@[Y
)BAlu{
z[COQN
bIc@ZCE
'~Ug`Pj
/ai;%S
sw.ZV"
@VLfSi
=-:wsQ
2Rd5rJ
tb;P%a
G2"gwLo
=X[|wq>
S{XE\`'[
f,+9,L(ZS
ERSo&c
)G(JDRU
GVXvS<
XXMiG:
i[NU=b
4+V[R|
G>~O@E
<]A7)J
]7'H"=
C*k\lR
@lP&t?`
nT ~SU`
_D~O{9!g
2`pY?2^Q
Xq+~L^
,H~143
 w@|7\
H+hb;o
NkM3(h
_$n6x@
9+G0k>
I""aTZ
?<z11L
2tIPA{
-$9&S7
LG$3jU
}Sd\D+
!w5M_7
a^'~.?
EZsB-A8?
\H`ULK
f{	h{Ez
.BtPoh
%m`sgS
; 0T7!
xn9dGK
@\zT'd
M%z>2N
o>nBLcV;t[
;q/D:0
[BS6zj
~JG5wD
PO%0%m
_k3E-7
,E5f:RS
b?#Xo=
zczU7W
,,}B_1
K~YCynw
ea8]M'+
\G]M+j
YZ2JSz^
]Cjz$	
sZY)i=
s4%OLZ
*m|e~&
nE=*8h
$2WHtc&
>m`"&{
s/aQ>86 &
a3xxSIg
&6!B-X,
kYEBTf
^mHzYya
aBRyH#
[\&N%(
L].<mc~	
Q^5vdP3
u!d;?+
$2yD.d
3k|!q2V
?/E"}f
MVug 6
KxB\,rV
c&P|N'
,[4<J#
p@dg*"
(TL\U_
tVJ/Fp?
Gfj9NV
:c5B)5
o/"dh[I
0-?!IVH
H^(x-l
hMm1!p
P&9oT#$
X#ALTsGhkC
"h]@,:R
G%R\U0
CZc$[1
UX4MHK
cTulV"9
hre<F8
Y1|,O?
).Qks^z
J?jW$0u
[V0H0M
E5OI43
#~r}VE$7
wmp*hM4
#iTR2(
|5aC*m
v:ZT4sj
	\* JJ
TGj,])
Te^*cv
PuoN{xN)
j3N/n$
=^:#|-
Q!DCoI>BN
:i?ia]
;8~$=9~T
Eul?v_	
p~-bBKJ
U4WM;N
_Z>j}N
!Oo&28
fhce20i|f
l=.81e'7:
0emcw@
:irXL?
.T,h{9K
{sCoqcV3D
zVLbTh
Rg_xel
5DDcZ~
	dgLX!
b""XNw
f$Ok2>e
e4I.Qa
TQdnu+4
<'bw]a!
<0CY4P
d{nlzC*&
zB+pr*
]3I?\12
`}x5Mw
QVsUR}
:-$r6Q
%rYHnv:
'LhSb90bZ= n
AwKaA/
55,CLo#
(*Y'kS
evzE	$
D|4hFN
4SX!<K
K:4NqER
^(3t;CY
EY^,gr
WQf >qF
daZY$Z
3SB8P4
e{Lk}~
b6c/**'
`'Vf%+
p3kVsvL
5*X_GTp
EsCyir
Q06oM6
oO|gc]
9^sRXGY!
*#;b-sL%9I5
xLmX!}aR>jR
`1QXVl
eHx%S(
*h07lT
/g8@+O
M>c^)l
['D^?vy
xAgVNG
`r#:jN
b,[Dh'+
smr=yl
;CDN4SZ
n;na.)w
z[r~ <
fV$nV 
l!mK	7
0 wz{e
@\~(k$
%$Py](4
H(e,76
{o#|Ea
x[P$A!og
Q}"r<j
m(N`5u9
JO+/ZQ
NCVb2T
-Zj"]]
$-H))]`<
Q+vIxX
,9,M_qM
x;`gO`
l0Jvpt
I%={b>'r
R3Na[M
7\sKyFp.L
IU$Wx5
uj >*^(
drX=,S
.;P4r8
AtuV6u
`{5XXn
8>#6Lm
RmY2H o
 X/%cLV
WQlj`?
Bz {d.
(.^kRl
Zn8i<B1
E^MfsON1c
r,_"m7G
yZ	]JB
^on&L!
{g/zw?
"-Sx0]Tk
1S $55
_?4~<s
IA4(;@
o$SJ{$
spEN]qSl
A('`XJ
%!y}YS
>.qcHTg
2DynUG
?_)EF9
$&}~hb
@A*rkol
A=E{7.
.qi4xev
zwJ`tr
	gaqV~`t
^P[8p-c}
PGb8|JG
t<}&Mw>
lr5"-b
(;)?lk5!
jS5v%o
I:mpAw
BTYDKYPK
>L+qbu
Z:AW22/$
4lfrm]
LkT a>
na9	]-S
VFuJ'*9
O)Iykp
E81hg}
zYuI_z=+
,aI68"
d<RYW4!
xF,sEedY
a]H<8~
q3\&LS
(TE"s;dBD
+Q=-)/
Hpx@lRN,
 6dth2f
nc%nkkn
2-Zjw!
uVE@{a
;{^s|b
BE7IP7X
MSJ<0?
06	8Z|
^/ 0~'
$\I:Nk
%Z=O7L
uC"R&Z
V^5}}R
e8np5Lg
H"Pczm
@{Cv\.
VnDv@VM
|u;E/i{
,|DLB$
WVLJ_3
yxza_`+
.N87uL
	Q	wmU
|\Vc8s
,%+8++
/=m_^n%
.mY#rK
/iGR|S
h$&?`8n
Z=a5#-
1Va<S. 
a)yl3.#[Su
Tq)nV2
:])fK)c
2t"P_)
d nn]Fj
lv	5L[Ub?
f	+/sR
:Uo&)wt	r
!_0'>c
C}M]l'
*se=kO
ajF/%![I
)4TM$c
'jn&])
oT"W_w
`RnZ^j
x" `*6cS
J>da?t2
C0;UnS
qS4h+d
n=,J#b{
}HD,oE
"Feq1Kew
dz6	AN
A <,gL
^ k:o[J
*aHS;y
b8twEQ,
n"0l,g
u2j'`s4
/&.Yb%jisZ
JjhDMu
T8:qRu=
 L|@o?A
'kzht#
y0*0Ox
K@d`U}
j5!bf(
p$,rx=qz
8H :V-j
~YB$sEl
O=:'o-
<jnZf$g
Ep!r\#
Aa4z"_#W
S+8lm*[nX
x!GTB O]
L	NF)u
]zY*n9
@T`^H}
re&{+Y
1R![J[
mn"P\1\
3@?%`S
yyTu2N
oJC)w1y
	xX	&"T
"-TSBF
iw7k{I
G0`_MPax
P<d'C-i
fq&.Gb
}L,<q`6A
!U^siB
Xf((fd
U~`fd-
6u*s1n
KCf@.O
Z!<@P;
Uv%XS]
P=y&B/
{`]*@]
:wi@YD
$>$"|H
J9l7	i
iQ })f
yk9;M`@
u[Xge_)
f=PkyHT
v=@>}#
2	N9-=
3/*b!.
t9nM`*
Ol)JkX
lV9PFf
rC?uFnd5>
!f3E	j	
LG_6:d
EeS ,#
c/N@b2
"(d){nw
cO)yeU
!owUFR
q=Fuyx
 K|Ub_
3.r2ft
a&IUVy
i%HZj&
hM;Ye*p
rF'Bq%
I41k,nT
'=1ndn
/dqX3tu
O<V#VR
J2097P1
{+^Pwu
\6$dyL
o-54w&
$7t4]3;
\%LpA 
.R[DC$
|Ububw
]r	<_ux
zvMk.)U
Vi"&4iX 
7X{\qn"
ep&aD9^
QSNav&V
"%>=zu
,9w@&zQoEY:
O/#~r%
DLdw2k
VRisb7Y
[#)_r;
c``y	'
sZNN00
n^:XjqV
2,g9ckZm
BcVJ$8kj
E#	L%.
c	vfT4`
P[zS$.`
kGV,P<
*$V@*(
wWm'yf
Ljyc>*~h<
X8:7c4h
X&2:B>
!>}ijmd
>];U1]X
dBTRhl
84}UHl
|d9[`SL
z[A|$)
K@	]GpNvLj
MQ1DRg8
]^H_o@
qDY*pC1
}\4qj(
Gyq!OQ]
Xa	wc|B?
FA-.oh
6mbR&t
xbYpTN
c__,]f
"r0`[%b
E-yD\4W
+Bf'X|@
(>Ypv;j
*+CS;8
2h&UeAC
pFH7 !
1;<O6* u
/Do!)(A
=pc(G+`<Dg
OJEL!{~3
Q3E9\ 
p:?;Jy;
D7`@my
fhveM?
<v}5>"J";Q
a@B=43
&)K4U~
%"-z &@
zZsiYL
dMIR)#2
8g_?eoB
^iA3>_%2
eHCk<<X
4\4fy!<T
JWqvFeN
09Zm1O
^=darJ
={>Wzs;
=RUKrs
e`2y'q
N0Y6[:%
\buJ,#\&h
|,iZof
KT:l]:{
55HyGDJN{
6ED3$~MA
%guv[~E
E(Z0np
aeSd>gM%
 $NS3s
d3F~EXCw4f
s>^DPG
UU{_!"
Ua@cgv
	[;3@M
|dN{W;\
	W{W,B
@{*$7B
8_x`nSK
,B+mPj
O$ZT!P
U%7//n
!j0^t~
Sh"<~v
Q5[sKi
#C,gRB
R]FeJ"
P[("f/
cIT`L_
	r;l9M
2Y;L,!E
"]dreB>
Rs[5|Udc8e
;b1#?9
4D~1f \v
]gI[b0{
Lk	 nxI
?05{6P:
c9mh`i
erPJ[>2;P
EdW!fmS
Z8wtz"0ly@a
J%i*l7
	+yxrF|
6VI>X^.{Rq
!cP](zi
~G|D3*
^6SQcTkZ
-LzG\X*v
'3_{b5
sROvpU
?K9mzD
:n?z-7LAV=
XH0X"d
liUqNl
U#ASV~
o9wtx}9
Nh56ML
f{_1.?
]gKL P
7?F++!
cP5~b?
dd$ h 
&O6C&{
gsin$w
nReH\XH,
E'2`R3
qW!zhM
".GXsi
)kr4_W
SpY)v 
{}ww$?
>K<B6t
p+5YVx
'aruY_d@U
0(N/5N
$j6D<d
#)_7e2
-c^snF.
@/N]`Hq
0kJ$c%
bEa*^>
9CzO6#
kNF5qW
KIl0\a
$Y}p%Q
&Uq~52
%=F$T7
FyDagD
0 o%&UB
}%-wVg]
F0b@t{
[f#0~"
@Ee+: a%
BsXCDr
?WJc=6
W+f5s#
*KvU4j
l7&JBZ
Qg6-ld
iEpidY
kQj'(L
r#Ljcd*
(t\}lh
/6H~7v9
W&iWiNaOG
H7ks^n
 "FFr~
b]L<Sc
Q76%>B
ARx2 `
T,K%z=
mett,^M
4n Gyc6
Hssu5*2
D!ZI2A
<UM36"
NyOXs,
&9c{bl:
	gO|	B)%
C3F_j*Tl
|PZ%HtJ
SKH	EoD>M
8U9[CP
{q/$l>
_I~*CK8
Y_#86]
C}43I*
NyLFO5
55/\Ow
N>4;sm9
2#u}#4
yR=[,,
|(sLxl
LfZH?r
)?p&3,
mE=/C"
mBY5,q,
nLNX	Y
Iq]zNW
f`=c>xV^G
rkNejf"
6s[v+X
\=%]}46
y2Xa_N
tqz>=YZ^
]Pfx;H(
a73[UB
[z*>tO/,p
:g}[v$
qytEF8
",br+`
jo%A&.
v^o"4U
Nq3~dfj
75nI-J
nOIow&
9niJdY
!hmY79
|Nx{tw
ti3+J	0vY_
jknoB[l
u;n?WJ6
Ogsg(_T
~-`vH"c
Pfy/7p
ZD|	|U
lvvFfqcY
V`)7s^
)s9VMV
fM.BWD\:}=p
EaDz\>\)Q
270YYE0
V+WU$/
PcNNhIw/C>
OKk CL
@{}GkQ
8XFwed
2QaSwx
@R"I9u
.<qc9dC
*Kx]q~
Jy@S]i
SsVIJOc
yU\BWwm
Qpuu?xbw
8r4W		t\
-C #&c
OL@@aa
qRRt;f
dP="!t
	50$dS
a^f_Ao
s3(va 
I|"u|Gh
WcI!,g
\Sk0B?V
esj]ww
wY_}tp
q#Bd)q
asy"WV
J7E)|fq
qL]g0q`-Z
@OaAxS.
9&Cwv5
oynA:-y
~$$Qk*>VyM
o^+5	y
Lj@rtQ1
iea5Yp
+J|cP^
9/[WZr
sl{;jU
`U!I)|(
]YBesb7
}8$=}u
~,*^5JB^I?
II4KS 
MI^9e!
)R/|,Pc
XR?R)+
U|v"2A4
$,ty>l
6eP<m|
u8QL*[
Jujsb^!
, ="XN(
E/Bmr|
,o>=W.xG|
gy%B)o
($"i0?$
#u0XFDt!
tC*PX0
Ak\G(soA
~y1[wo
RK3H'i
9)FwM$
Hrk8"<?
Oy#'KS
>.+nL$
Sg*=eM
W|B<47
CXk{nk
]fBZ\l
&F>VZ-y
{hv?C_)DU
|=SU5$W
+K=0q:
:Y"$bZy.
d0F1.C
(_Zk	4n`
+c<M 6
uA6o4ix
{)	RQR7^
JZ	-nLEr
SzNq4M
;^X\OfAB`|
	/=?4"
}.n*Xsp
VOt`*r-F
osr2.5
_!r=(K
CNBjxv-
Tp:&ia
'lZ^-;
!!YT$X
Vr;_:_
\0#bot:j
o>-fhp
Yza~J0;_
vg]opM
L5Y2I3
mWw5"T
{Kx@yt
R$G1g>
JrJT)R{
F!?b}p1+
OrcchH3
Z9&] [)
d`U/nZK
6/j\G$]
LK,*cXB
Z.uVbv
,{Vt}po[^5
Lz#FsV
q-q&Na
7 HC h`
)OzutE5
pbQPKq
>{sYsUU
k'/b'0
r:Bq+Xi@e
X}KP;.
7fE/!W^
GVjNP>
DK@Sf%c
;	"sy6
2~OGm5
"rUO,}O
==V,(m
+eH	:j
gZ*JnE|
fiIg((
]TL5/g
l|9;8$
veV_Cv1
s6H5PY;
+	:$al
L\jFr@%CW
<R/B>%J
_7FRah
h3_ek`P0
25}.3$
:%=RP[
z%B8DKE
pJ+LYhV
O,_$I&
MOJ"-d
xa)V5){
;\Y`Lk
X	9:gw
,:hnat
_+ H~9J
01AiHN
!Eb&-8S
Dv#Ms2
&gkO)s
i'g<5C
 /CfFQxX4
GpLxJL
elnvE6+,
<`np>_v
&(=td=
vYA4x<Z
1WOfI09
wd$j-V
E78Z|V
f,Pwd|+
VD>~>t
$:_Rgc
}W3xzFQb
<>m'8lVm
*fI}t /
[)N??V
-XI@!^q
Pn)e	Q
*ORr;;2
qwe.exe
Path=%APPDATA%
Setup=qwe.exe
Silent=1
Overwrite=1
Update=U
J-O_Pl
h=5%BN,&QV
PCjES0q
[5YjyC
lV>Qz!+K
[_D\ I
jb<C.U
)B6~'	S
hM&qZHY
!A1XiS
%$F1Ma}F
4Jpj;=Z|i
q|`|9~
FhpBjJk
}O_PtG
/+/|!]
$<uQo|+!
]w !ps
-d+La^
{0jiJq
@N+6"U
*I?L+_
=]N3~d$`
t_JW"G 
,6!x1K
e]WuYW
.,D:Y[
mRB0j6?:k
iG.OXm
<Cwt{Zj
P]W[QC
KcEl<#g
zF}Kf&
02:k7U7
+bkcm\
x4{<f}
|Mzb,]
<wNAEc
DigiCert Inc1
www.digicert.com1$0"
DigiCert Assured ID Root CA0
061110000000Z
311110000000Z0e1
DigiCert Inc1
www.digicert.com1$0"
DigiCert Assured ID Root CA0
DigiCert Inc1
www.digicert.com1$0"
DigiCert Assured ID Root CA0
131022120000Z
281022120000Z0r1
DigiCert Inc1
www.digicert.com110/
(DigiCert SHA2 Assured ID Code Signing CA0
p1f3q>
http://ocsp.digicert.com0C
7http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
4http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
4http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
https://www.digicert.com/CPS0
DigiCert Inc1
www.digicert.com110/
(DigiCert SHA2 Assured ID Code Signing CA0
190531000000Z
200604120000Z0
California1
Mountain View1
Mozilla Corporation1
Release Engineering1
Mozilla Corporation1/0-
 release+certificates@mozilla.com0
f:>]uZ=
/http://crl3.digicert.com/sha2-assured-cs-g1.crl05
/http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
https://www.digicert.com/CPS0
http://ocsp.digicert.com0N
Bhttp://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Symantec Corporation100.
'Symantec Time Stamping Services CA - G20
121018000000Z
201229235959Z0b1
Symantec Corporation1402
+Symantec Time Stamping Services Signer - G40
http://ts-ocsp.ws.symantec.com07
+http://ts-aia.ws.symantec.com/tss-ca-g2.cer0<
+http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
TimeStamp-2048-20
Western Cape1
Durbanville1
Thawte1
Thawte Certification1
Thawte Timestamping CA0
121221000000Z
201230235959Z0^1
Symantec Corporation100.
'Symantec Time Stamping Services CA - G20
http://ocsp.thawte.com0
.http://crl.thawte.com/ThawteTimestampingCA.crl0
TimeStamp-2048-10
DigiCert Inc1
www.digicert.com110/
(DigiCert SHA2 Assured ID Code Signing CA
190813170322Z0
https://www.mozilla.com0
9[}vHt
Symantec Corporation100.
'Symantec Time Stamping Services CA - G2
190813170332Z0#