3.1
中危
该样本未表现出任何异常！
重新分析
更多

0deb3441dd125dfcccae7bc58f52f56ceb63abf6c1173c8390c7826301473de5

0deb3441dd125dfcccae7bc58f52f56ceb63abf6c1173c8390c7826301473de5.exe

分析耗时

136s

最近分析

376天前

文件大小

276.0KB
静态报毒 动态报毒 UNKNOWN
鹰眼引擎
DACN 0.14
FACILE 1.00
IMCLNet 0.81
MFGraph 0.00
静态判定
反病毒引擎
未检测 暂无反病毒引擎检测结果
静态指标
查询计算机名称 (1 个事件)
Time & API Arguments Status Return Repeated
1727545354.297
GetComputerNameW
computer_name: TU-PC
success 1 0
检查进程是否被调试器调试 (1 个事件)
Time & API Arguments Status Return Repeated
1727545352.062
IsDebuggerPresent
failed 0 0
使用Windows API生成加密密钥 (3 个事件)
Time & API Arguments Status Return Repeated
1727545354.297
CryptGenKey
provider_handle: 0x00c68738
algorithm_identifier: 0x0000a400 (CALG_RSA_KEYX)
flags: 134217729
crypto_handle: 0x00bab480
success 1 0
1727545354.297
CryptExportKey
crypto_handle: 0x00bab480
crypto_export_handle: 0x00000000
blob_type: 6
flags: 0
buffer: ¤RSA1aoLvã;>6ܦ#j°ÓäFÌôž° lº©cŸ‰IÿfŒôË@sû™^‰7Y-·ºüçò﹧R\`®Hãl8òJKÁI÷:¤Eu2…p—Òly7\Ékî9ûÂb¤S¾†¨˜ÜÊøȪ­d8G¥¾‚VGƒ>Â0É$}t>0¦DÔ(‡ô·ÑM(š/E.pÍ ñü=}t/`!I=¹rË"#¥;«D*ŠUßW&7øGïúŸ¤øô±†w¸7óY]‚¼öåI@ñ‚¨ÍÄV–ÇΝŸ…"F²È6³yÔ.HR¾oÃ$Ä)åžoH¬¾I¬‹Ø߃õŸ÷Y3öbÚgÆÈ
success 1 0
1727545354.297
CryptExportKey
crypto_handle: 0x00bab480
crypto_export_handle: 0x00000000
blob_type: 7
flags: 0
buffer: ¤RSA2aoLvã;>6ܦ#j°ÓäFÌôž° lº©cŸ‰IÿfŒôË@sû™^‰7Y-·ºüçò﹧R\`®Hãl8òJKÁI÷:¤Eu2…p—Òly7\Ékî9ûÂb¤S¾†¨˜ÜÊøȪ­d8G¥¾‚VGƒ>Â0É$}t>0¦DÔ(‡ô·ÑM(š/E.pÍ ñü=}t/`!I=¹rË"#¥;«D*ŠUßW&7øGïúŸ¤øô±†w¸7óY]‚¼öåI@ñ‚¨ÍÄV–ÇΝŸ…"F²È6³yÔ.HR¾oÃ$Ä)åžoH¬¾I¬‹Ø߃õŸ÷Y3öbÚgÆȝmŒ†FÉ[ßNOóLëD‘”߶4÷cRIN£÷™Øcû*™åº­±¹–@~¼ãp.ÁâƂ—}\•äbÛPܾ.Ïÿ þ$AæX¯ÑÑ]³˜ÛçœóØÁ>màÖØÿ²Àl2N<àÃ؆å([CŠÂG0ö­e(&-*AÌ î•?ípÿ‰Ö©Pœ’9§Ø[–«ª«Ð"ÈÊòLÀ|æW¯(Œ¡%$g_¯/”|F¿úØÖ^íˆÄ<h©Oã3lŸEÚËL¥4$ÛޏBAW÷ô30ÿ¨rƒ?‰#êA"A´í×ßál±è‰*¢õql¤•€u…Q’tF‰bR)Ïéשƒÿ^Pà0ž­w[:õp‹è|ŒËÊ—{œxU"Þ矀#n!K”¾°5h©5Ÿ@ŠùO™@ËLB c°’ a•fšÕ#Tî‰"¬´‚±±q@ktÀ×ؘq¿õGèœ,]OŠZkX·ß_Rà==²Œ ªÏw^Ú_Zl _s åÇéޖ0֏Ý38`fCCµ.o¼Ϣ‡ð°Îg;EÿVo ìeK¡¶6qX€]\Ýš.æ›ñ¥Å/U«,ey,ó,mY‚ðH}Ä ƒ ^‹kT25Z”µòHé–ý<í‹a¸j³øˆB¸\rOЙŽ]ì›y˜Y$]µø5 œ%®íĒp 1³$±ñ™(` Ð%¢0:‹+¾ååÝÏ ‘„ålÈò¦P;'ÀM˓—•â­ÍTƒ£f,A9ºÏ°Õ§›³º¾§¬—ŒWKHáµÔHO ze>²÷Œ¶[º úB¢0¨º,ûh£Uw®.?ç€%!”ËàøDñ³ü|uH谅Ët­7|~˜|ÙT©¤ÚÄM3˺vÔ̒|Z l`m]XI@ÞՎur³]ôi~6TŒ ¸[rJÐ~¡`…1ùíÙ犕ü™o’Ž÷p•¨~‚Ò'Ó4>Œ¦Ç)¤ŸÂ ֈD°É£ú;•Ù¡RÖa\a$ÛFrnB*ÏN3çÏW··Š¹‚©õŸ¨zf@ Üuq³Ïñ5J´>Àh¤G£í˜Êm§²èjáϜ¸×ßñ i)جp¡…n2bWO¿?€—Ïi@ÈÁ[ËUž‰ßCÓshÌÃ}5±‰ %ÉÝQOg{¼½¢P^@0¯
success 1 0
检查系统中的内存量，这可以用于检测可用内存较少的虚拟机 (50 out of 82 个事件)
Time & API Arguments Status Return Repeated
1727545354.9065
GlobalMemoryStatusEx
success 1 0
1727545356.969625
GlobalMemoryStatusEx
success 1 0
1727545359.50025
GlobalMemoryStatusEx
success 1 0
1727545360.797125
GlobalMemoryStatusEx
success 1 0
1727545362.094
GlobalMemoryStatusEx
success 1 0
1727545363.389875
GlobalMemoryStatusEx
success 1 0
1727545364.68675
GlobalMemoryStatusEx
success 1 0
1727545365.984625
GlobalMemoryStatusEx
success 1 0
1727545367.2815
GlobalMemoryStatusEx
success 1 0
1727545368.594
GlobalMemoryStatusEx
success 1 0
1727545369.889875
GlobalMemoryStatusEx
success 1 0
1727545371.18675
GlobalMemoryStatusEx
success 1 0
1727545372.484625
GlobalMemoryStatusEx
success 1 0
1727545373.7815
GlobalMemoryStatusEx
success 1 0
1727545375.078375
GlobalMemoryStatusEx
success 1 0
1727545376.37525
GlobalMemoryStatusEx
success 1 0
1727545377.672125
GlobalMemoryStatusEx
success 1 0
1727545379.000625
GlobalMemoryStatusEx
success 1 0
1727545380.2975
GlobalMemoryStatusEx
success 1 0
1727545381.578375
GlobalMemoryStatusEx
success 1 0
1727545382.905875
GlobalMemoryStatusEx
success 1 0
1727545384.18675
GlobalMemoryStatusEx
success 1 0
1727545385.500625
GlobalMemoryStatusEx
success 1 0
1727545386.7975
GlobalMemoryStatusEx
success 1 0
1727545388.078375
GlobalMemoryStatusEx
success 1 0
1727545389.39025
GlobalMemoryStatusEx
success 1 0
1727545390.672125
GlobalMemoryStatusEx
success 1 0
1727545391.984625
GlobalMemoryStatusEx
success 1 0
1727545393.2975
GlobalMemoryStatusEx
success 1 0
1727545394.578375
GlobalMemoryStatusEx
success 1 0
1727545395.89025
GlobalMemoryStatusEx
success 1 0
1727545397.172125
GlobalMemoryStatusEx
success 1 0
1727545398.469
GlobalMemoryStatusEx
success 1 0
1727545399.796875
GlobalMemoryStatusEx
success 1 0
1727545401.109625
GlobalMemoryStatusEx
success 1 0
1727545402.4065
GlobalMemoryStatusEx
success 1 0
1727545403.703375
GlobalMemoryStatusEx
success 1 0
1727545405.046875
GlobalMemoryStatusEx
success 1 0
1727545406.359625
GlobalMemoryStatusEx
success 1 0
1727545407.6565
GlobalMemoryStatusEx
success 1 0
1727545408.969375
GlobalMemoryStatusEx
success 1 0
1727545410.26525
GlobalMemoryStatusEx
success 1 0
1727545411.547125
GlobalMemoryStatusEx
success 1 0
1727545412.844
GlobalMemoryStatusEx
success 1 0
1727545414.139875
GlobalMemoryStatusEx
success 1 0
1727545415.45275
GlobalMemoryStatusEx
success 1 0
1727545416.764875
GlobalMemoryStatusEx
success 1 0
1727545418.06175
GlobalMemoryStatusEx
success 1 0
1727545419.359625
GlobalMemoryStatusEx
success 1 0
1727545420.6565
GlobalMemoryStatusEx
success 1 0
文件包含未知的 PE 资源名称，可能指示打包器 (1 个事件)
resource name PQDPDSFKC
行为判定
动态指标
分配可读-可写-可执行内存（通常用于自解压） (20 个事件)
Time & API Arguments Status Return Repeated
1727545352.422
NtProtectVirtualMemory
process_handle: 0xffffffff
base_address: 0x00bae000
length: 102400
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1784
success 0 0
1727545352.437
NtProtectVirtualMemory
process_handle: 0xffffffff
base_address: 0x00400000
length: 163840
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1784
success 0 0
1727545352.453
NtProtectVirtualMemory
process_handle: 0xffffffff
base_address: 0x00412000
length: 77824
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1784
success 0 0
1727545352.453
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x003e0000
region_size: 94208
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1784
success 0 0
1727545352.5
NtProtectVirtualMemory
process_handle: 0xffffffff
base_address: 0x00412000
length: 77824
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1784
success 0 0
1727545353.5
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x000d0000
region_size: 4096
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1784
success 0 0
1727545353.5
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x00110000
region_size: 4096
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1784
success 0 0
1727545353.703
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x00160000
region_size: 4096
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1784
success 0 0
1727545353.719
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x002b0000
region_size: 4096
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1784
success 0 0
1727545353.859
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x002b0000
region_size: 4096
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1784
success 0 0
1727545353.859
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x002b0000
region_size: 4096
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1784
success 0 0
1727545353.875
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x00130000
region_size: 4096
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1784
success 0 0
1727545353.875
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x00140000
region_size: 4096
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1784
success 0 0
1727545354.375
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x02690000
region_size: 12288
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1784
success 0 0
1727545354.39
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x026e0000
region_size: 12288
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1784
success 0 0
1727545354.562
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x03950000
region_size: 98304
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1784
success 0 0
1727545354.562
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x025d0000
region_size: 4096
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1784
success 0 0
1727545354.562
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x02690000
region_size: 4096
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1784
success 0 0
1727545354.578
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x02690000
region_size: 36864
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1784
success 0 0
1727545354.578
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x03900000
region_size: 8192
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1784
success 0 0
查询磁盘大小，可用于检测具有小固定大小或动态分配的虚拟机 (1 个事件)
Time & API Arguments Status Return Repeated
1727545354.312
GetDiskFreeSpaceW
root_path: C:\
sectors_per_cluster: 8
bytes_per_sector: 512
number_of_free_clusters: 1782438
total_number_of_clusters: 8362495
success 1 0
在文件系统上创建可执行文件 (1 个事件)
file C:\Users\Administrator\AppData\Roaming\Microsoft\klqlwt.exe
将可执行文件投放到用户的 AppData 文件夹 (1 个事件)
file C:\Users\Administrator\AppData\Roaming\Microsoft\klqlwt.exe
检查适配器地址以检测虚拟网络接口 (50 out of 82 个事件)
Time & API Arguments Status Return Repeated
1727545355.7655
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545358.281625
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545359.56225
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545360.859125
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545362.156
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545363.468875
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545364.76475
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545366.047625
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545367.3595
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545368.656
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545369.952875
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545371.26475
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545372.547625
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545373.8445
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545375.156375
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545376.45325
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545377.750125
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545379.062625
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545380.3595
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545381.640375
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545382.968875
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545384.24975
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545385.547625
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545386.8595
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545388.156375
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545389.45325
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545390.750125
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545392.047625
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545393.3595
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545394.656375
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545395.95325
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545397.234125
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545398.531
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545399.858875
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545401.172625
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545402.4695
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545403.781375
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545405.124875
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545406.422625
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545407.7195
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545409.031375
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545410.31225
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545411.625125
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545412.922
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545414.218875
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545415.51475
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545416.827875
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545418.12475
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545419.422625
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
1727545420.7195
GetAdaptersAddresses
family: 0
flags: 1158
success 0 0
该二进制文件可能包含加密或压缩数据，表明使用了打包工具 (2 个事件)
section {'name': '.rsrc', 'virtual_address': '0x005cc000', 'virtual_size': '0x00024df6', 'size_of_data': '0x00024e00', 'entropy': 7.568927203734149} entropy 7.568927203734149 description 发现高熵的节
entropy 0.5363636363636364 description 此PE文件的整体熵值较高
使用 Windows 工具进行基本 Windows 功能 (4 个事件)
cmdline nslookup ransomware.bit ns2.corp-servers.ru
cmdline nslookup zonealarm.bit ns2.corp-servers.ru
cmdline nslookup ransomware.bit ns1.corp-servers.ru
cmdline nslookup zonealarm.bit ns1.corp-servers.ru
网络通信
与未执行 DNS 查询的主机进行通信 (2 个事件)
host 114.114.114.114
host 8.8.8.8
Attempts to identify installed AV products by installation directory (1 个事件)
file C:\MalwarebytesLABs
检查 Windows 空闲时间以确定运行时间 (50 out of 156986 个事件)
Time & API Arguments Status Return Repeated
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
1727545343.469
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
在 Windows 启动时自我安装以实现自动运行 (1 个事件)
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\htuqkglqswo reg_value "C:\Users\Administrator\AppData\Roaming\Microsoft\klqlwt.exe"
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2018-04-23 02:26:27

PE Imphash

022e75c8089eb1300c6b4ca118f5ca63

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0001446c 0x00014600 6.609223616681068
.rdata 0x00016000 0x000045e8 0x00004600 5.343275147271966
.data 0x0001b000 0x005b0a68 0x00001c00 2.498293467623795
.rsrc 0x005cc000 0x00024df6 0x00024e00 7.568927203734149
.reloc 0x005f1000 0x0000550e 0x00005600 2.014999663034088

Resources

Name Offset Size Language Sub-language File type
PQDPDSFKC 0x005cca74 0x00018b0e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_BITMAP 0x005e5584 0x00006160 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_ICON 0x005ebb4c 0x000025a8 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_ICON 0x005ebb4c 0x000025a8 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x005f0d3c 0x0000007e LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_ACCELERATOR 0x005f0dbc 0x00000018 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_GROUP_ICON 0x005f0dd4 0x00000022 LANG_NEUTRAL SUBLANG_NEUTRAL None

Imports

Library KERNEL32.dll:
• 0x416008 GetProcAddress
• 0x416010 LoadLibraryW
• 0x41601c WriteFileEx
• 0x416020 FindAtomA
• 0x416024 SetConsoleMode
• 0x416028 LocalAlloc
• 0x41602c WriteConsoleInputA
• 0x416034 GetSystemTimes
• 0x416038 GetThreadPriority
• 0x41603c SetFileAttributesW
• 0x416040 GetNamedPipeInfo
• 0x416044 lstrlenA
• 0x416048 lstrlenW
• 0x41604c WriteConsoleW
• 0x416050 GetConsoleOutputCP
• 0x416054 WriteConsoleA
• 0x416058 GetProcessHeap
• 0x41605c SetEndOfFile
• 0x416060 FlushFileBuffers
• 0x416064 GetLocaleInfoW
• 0x416068 LoadLibraryA
• 0x41606c SetTapePosition
• 0x416070 AddConsoleAliasW
• 0x416074 GetConsoleMode
• 0x416078 GetConsoleCP
• 0x41607c CreateFileA
• 0x416080 CloseHandle
• 0x416084 SetStdHandle
• 0x416090 Sleep
• 0x4160a4 RaiseException
• 0x4160a8 GetLastError
• 0x4160ac HeapFree
• 0x4160b0 TerminateProcess
• 0x4160b4 GetCurrentProcess
• 0x4160c0 IsDebuggerPresent
• 0x4160c4 RtlUnwind
• 0x4160c8 GetCommandLineA
• 0x4160cc GetStartupInfoA
• 0x4160d0 LCMapStringA
• 0x4160d4 WideCharToMultiByte
• 0x4160d8 MultiByteToWideChar
• 0x4160dc LCMapStringW
• 0x4160e0 GetCPInfo
• 0x4160e4 HeapAlloc
• 0x4160e8 HeapCreate
• 0x4160ec VirtualFree
• 0x4160f0 VirtualAlloc
• 0x4160f4 HeapReAlloc
• 0x4160f8 GetModuleHandleW
• 0x4160fc TlsGetValue
• 0x416100 TlsAlloc
• 0x416104 TlsSetValue
• 0x416108 TlsFree
• 0x41610c SetLastError
• 0x416110 GetCurrentThreadId
• 0x416114 SetHandleCount
• 0x416118 GetStdHandle
• 0x41611c GetFileType
• 0x416120 ReadFile
• 0x416124 ExitProcess
• 0x416128 WriteFile
• 0x41612c GetModuleFileNameA
• 0x416144 GetTickCount
• 0x416148 GetCurrentProcessId
• 0x416150 GetACP
• 0x416154 GetOEMCP
• 0x416158 IsValidCodePage
• 0x41615c GetLocaleInfoA
• 0x416160 GetStringTypeA
• 0x416164 GetStringTypeW
• 0x416168 HeapSize
• 0x41616c GetUserDefaultLCID
• 0x416170 EnumSystemLocalesA
• 0x416174 IsValidLocale
• 0x41617c SetFilePointer
Library USER32.dll:
• 0x416184 PostMessageA
• 0x416188 GetWindow
• 0x41618c GetLastInputInfo
• 0x416190 IsChild
• 0x416198 LoadCursorFromFileW
• 0x41619c RemoveMenu
• 0x4161a0 GetMenuInfo
• 0x4161a4 DrawEdge
• 0x4161a8 DrawCaption
Library ADVAPI32.dll:
• 0x416000 ReportEventA
Library ole32.dll:
• 0x4161b8 CoLoadLibrary
• 0x4161bc OleLoadFromStream
L!This BrTm cannot be run in DOS mode.
s 7s7s7s)ks%s)}sCs
<s>s7sMs)zs
s)js6s)os6sRich7s
`.rdata
@.data
@.reloc
^]UQVWj
UQW9t=j
;u_^[]
;u_^[]
V1W+W}
V1W+W}
WPF(R_^]
VSPQa)
^SWy0
_[^_[^USVq$
t-?t'|#A
s8^[]3
s8^[]UQV39u
Wu~nS]
VQRSm"
UQV39u
Wu~mS]
_D2,eA
~<9V$:N4U
:N 9V0
V0: N$
SVWe}E
@PM/EE
^UVWywT.V
F8^4^$FT^P^@FpE
P^lV^\
~p^l^\~T
~T^P^@~8
~8^4^$~
SVWtF~
Q+RV_^[]
@u+PV_^]
]tm9uiVj
@u+PRM_^]
_^[]UE
t'hDfA
MEPMhA
Mt$h,fA
YURMhA
5MQMhA
UQS3VWSS^$^
~$_^[]_^$^[]U
A$SVW8j
PU_^UVu
QSVWeE
_^[]E+@
UQS3VW]9]
F09^(u
SVWe3}E
2H0M@(URzuAM
PR ;t$E
1P0U@(MQ
SVW3h@
@u+=hu
VVVVVV
VVVVVVVVV
UREPMQ
3PMQPPPE
EP Qh@dA
UREPMQURj
!uuXj49
POX=_^]
EPM9hpA
Wt1t'P
^0WWWWWI
VW3;tG9}
^0WWWWW
YVM[hA
,ffffffE
Y]3PPPPP
$UQQSVWd5
SVWE3PPPuu
E_^[E]
UQSVW}
VW3M]9}
W6uuh)~
E+)E(VQe
3PPPPPEN
VVVVVf
]8u 5
U S39]
YY]jXhA
ESV3W9
u8SS3GWh@gA
39]$SSu
;~Ej3X
3;tAuVWuu
t"SS9]
EV1Yu(EYY
3;tuSW.
PWu uo
e_^[M3g
Mu(Mu$u u
E~-8]t(E
G;~@@8Xu
WPEW@Ph
~S8]tNMM
9M~MAAM8Yuh
uYmuuuu3
3M_^3[
DDDDDDDDDDDDDD
YYu,9E
UQSVW5
;r@PuYYt1
tAt2t$
ffffffu
3PuEEd
3PeuEEd
Y__^[]Q
3W;to=A
7YY~PE
uVY_^[]
USV5`A
t7t3V0;t(W8Yt
V3Y^3j
Fpt"~l
3;~,Vu
Ou^_[]
SSSSS3
@sw_trPE
3PPPPP
SSSSS:
CH0EhhpA
3PPPPPo
0CH0EEhhpA
vP[YFTt
vTDYEfT
FP~HNu&FP=`A
vTYFh^T^L^P^H_[
H(TH,X
YP;s,Vh
3VVVVV
VVVVVd
3M_^3[T
PtYYptCHM
3PPPPP0
Yt1\pCH(XYl
1CHM_3[R
~ChdpA
hu3vSSSh
;tZ~Ht37xP
DM_^3[7j
SSSSS'
^l|WYFp
WNWpYYE
t3@_^]
=csmu+$
8csmu8x
t*9csmu"A
Uj,h A
EPZYYE!
>csmuB~
YYtaSVT
LYYPV3
YYt)SV
HtHu4j
t+>MOCt#u$u u
EPEPVu WoE
;Es[S;7|G;w
@u"u$u
;Er[_^
YuO39~
QYYhpA
EPEPuu WG
(u$]u E
)u$u uSu
tR99u2y
u$Vu u
Q 3@_^[]
S3VW;t
^0SSSSS
3_^[]j
Y0^]UWVu
DDDDDDDDDDDDDD
F$|3@_^
MOI;|9M
SI VW}
HD9#U#
MLD3#u
]#\D\D
1E3PeuEEEEd
Y__^[]Q
:E_^[]E
9csmu)=ppA
t hppA
eYV5$A
FlvlYE
YYt:V5 A
PtYF4t
PfYF<t
PXYF@t
PJYFDt
P<YFHt
P.YF\=xwA
~lt#WY;=A
ntehU@
YYt4V5 A
eEG|@|t
VW_^]M
Ej@j ^VYY;
[j@j ^YYtVM
x;u VVVVV
@SuzPyYA
Yt0tVVtYPkYYG
(48m3u
\dtWitRotMxtHXu
Aj9ht(lt
\ntJct
g~Eit!n
ldt^xL
xklltfxTX
0P|PCST$
0P|PCST$
xklltfTxX
0P|PCST${
e0P|PCST$
dtDx-u,T
-0P|PCS
x+u/llu
xklltfTxX
0P|PCST$
YudtxUX
dtWx@YYL
\ctN\su
]FE f/^F<-uBt>
]t7F:s
HDx+u'lu
dtCxj0^9x
x<xtX<XtT\x
dtPYYx
FD@tWPjYY9@
x+u'lu
\xte\pt\
\ou"x8
xPYtr48x
lt5dtx
dtxYY`
\xt;\pt2
lt5dtxXdtxYY`
f>HcGH`<%u
GxH;ul
GH;uGtxu
?%uDHx
VSVPVSy
Yxu*<u
`p<[M_3^
uOVYt.VYt"V
jXEU;u
Y]\3_[^j
<at9<rt,<wt
L9]u<eE
F> t>=upF> tj
Y]3u;5@
4V0YY
YSVWT$
URPQQh<@
t;T$4t
;v.4v\
UVWS33333[_^]
33333USVWj
_^[]Ul$
QPvYYu
3PPPPP5
@u^VPYA
ItUhtDlt
HHtXHHt
4itqnt(o
iYYYgu
DYYY;-u
t-RPSWv
0@>If90t
@@;u+(;u
u(9t M
`pM_^3[$
8csmu*x
YYuBh]@
VW33};
VVVVVs
u&h@wA
3PPPPPs
V@Y<v8V;
3VVVVV\s
VVVVV8s
;t$tj
6<YP6S
Yu=@A
EYF`[_^
t.t$<"u
C>=Yt1j
tNVSP[
3PPPPP7p
3Y[_^5
FA>\t>"u&
uUEPSS}
=?sJMsB
Y;t)UEP
SV5<aA
W33;u.
SSS+S@PWSSE
E;t/PYE;t!SSuPuWSS
u7lY]]W
u+@PE|Y;u
E3E3;u
WPWPWv
M_3[ej
whu;5A
8]tEMap<u
Zf1Af0A@@JuL
@;vFF~
XM_^3[`j
0M}_hu
P'eY^hS=`A
u4YF;~[
-WWuuj
WWWWVuWu
#~YYE;t+WWVPVuWu
oYEe_^[M3
EPQEPEj
SV3W;u:EP3FVh@gA
39] SSu
ESlEYu39]
e_^[M3
M`lu$Mu u
p;t_3FVPPzYY;tMSpxWu
;u!9xt
W-^YM_^3[}
NQWVPi
SSSSS^
W]Y39]
Iuu}]U
+EPRQL
3SEEESX5
PZ+tQ3
3;v.jX3;E
WWWWW\
]5VWYE;t'CH;r
PSuqSVESP|
9}uH;u
E;t CH;r
PSumqSu/
t4V0YtvV YR
S3;v(j3X;E
WWWWWDY
Y+t"+t
+td+uD:}
3PPPPPW
u@OdMGd
uwdSUY
Pj1Q3CESPF
Pj2uESP
Pj3uESPt
Pj4uESP_P
Pj5uESPG
Pj6uESP2Vj7u
F Pj*uESP
F$Pj+uESP
F(Pj,uESP
F,Pj-uESP
F0Pj.uESPP
F4Pj/uESP
Pj0uESP
F8PjDuESPr
F<PjEuESP]P
F@PjFuESPE
FDPjGuESP0
FHPjHuESP
FLPjIuESP
FPPjJuESP
FTPjKuESP
FXPjLuESP
F\PjMuESPP
F`PjNuESP
FdPjOuESP
FhPj8uESPm
FlPj9uESPXP
FpPj:uESP@
FtPj;uESP+
FxPj<uESP
F|Pj=uESP
Pj>uESP
Pj?uESP
Pj@uSEP
PjAuESPP
PjBuESP
PjCuESPk
Pj(uESPS
Pj)uESP;P
PjuESP
Pj uESP
O6Ov Ov$Ov(zOv,rOv0jOv4bOv
ZOv8ROv<JO@v@?OvD7OvH/OvL'OvPOvT
Ov`NvdNvhNvlNvpNvtNvxNv|N@
V+VMYY
73_^[]
V3W]u9s
h3YE;u
PWKYF ;
PEKYv$;5A
V3KY^]
W3}u}9~
ffYE;u
SJY89~
CfYE;u
C PjPVEj
C$PjQVEj
C*PjTVEj
C+PjUVEj
C,PjVVEj
C-PjWVEj
C.PjRVEj
C/PjSVEj
t$SSTIuLIuDI
S3VW;t
^0SSSSSI
3_^[]UV3PPPPPPPPU
3_^[];t
^0SSSSS)I
U3S3@9]
|FVWt>E
t/uV2H
YM3^ej
r3@]3]
V3#,aB<
EVjxEPE
6WVbY;_t3@M3^
t,PEP6I
Y3Yu/N
t;6`Y;F
t/EP6G
M_^3[Db
@[EP6FG
t*EP6 G
PW$YYt
USVWh]
Vj@h0~A
tm=\aA
t"3PPPPP*@
t,j@C@Ph
vP;Qt}
XP;Qt}
9P;Qt}
xP;Qt}
ZP;Qt~
lP;Qt}
NP;Qt~
/fPf;Q
iP;Qt}
KP;Qt}
,P;Qt}
_3_^]X
ru{vnM
tR:QuMPt<:Qu7Pt&:Qu!Pt
@AE9]r3_[
+UV3PPPPPPPPU
B(;r3_^[]
1E3PEd
Y_^[]USVWUj
H3bDUh
P(RP$R
t:|$,t
;t$,v-4v
UQPXY]Y[
W>+~,WPV
Y/V|Yt
gY}3u;5@
tVPVC|YY3BU
4VL|YYE
@WuyV~YA
a3WWWWW
M~-E9X
eMapY_
E`p:39]
EU_^j
WWWWW[
u&p]8V]
S3;VW|[;
t58t0=@A
]V3;|";
u$[0p[VVVVV
_Y3C]~
u}uyG+j@j X5YYEta
SSSSSN
tGHt.Ht&wX
^SSSSS0
Y+t7+t*+t
;t0;t,;t=
uEPuuu
SuEuPuuu
$ MeHM
;tSS6!
tSSS6#
E+PD=P6
[b3u3}
_8VVVVVt
9ut(9ut
u.PSSSSS
;u.KPSSSSS
MfMf;u!f;t
E`p3^_[
H8]tMapUj
u+GNSSSSS
NSSSSS
E`p3^_[
H8]tMap
V34809u
;u'L0LVVVVV
u&L30fLVVVVV
ca@l39H
P4UM`8
P9Yt:4+
<PVEP(
r3VVhU
QH++PPVh
,P+P5P(
\D+48;E
aF0?@eFY1(
8+0_[M3^%j
WWWWWf
3]V3;|
DVVVVV
^SSSSS0
f;v6;t
Map_^[;t2;w,Cj"^SSSSS0
_WSVuB
0;u,KBWWWWW
u+9uv&@E
E`p3[_^
tGPIR5(
<RYYt,t(
;t0PQYt%
s>VVVVV
VW33G;u,VVWV
3;tuWu
t VV9u
e_^[M3
;t_+^]
u.;SSSSS
;u+b;SSSSS
:YY4VE
;t+^8]t
UV395`
u:VVVVV
S3VW9]
u.f:SSSSS
v(':SSSSS
E`p`E9X
8]tDMap;E
;t+3_^[
UV395`
u9VVVVV
UQSV3;u
^SSSSS0
^SSSSS0
G;r3_^[
!8WWWWW
WWWWWb
ENHVUQY}V*YEE
WVYtP
L1$!_^[u
1VVVVV
EV395A
tVURPEPQ
RQMQVp
Map^[UWVSM
^]3PPj
B:t6t:t't
B^_[%`A
bad allocation
susabohenihideyadi
berifezidawazu geniyokuluye sepuhe zimosafodidusepejacudagemuvafa lomiseyicuwatitakoneyepi josudotakupovete mulavifiposo xohilujusucufu %f
zeruleviyahudejitafe.txt
pijiwagekuwizumedelocifucavoxi lituva bujupexo go yixu hapikosihemukuxabikugikijabeso gutuyo %s %d %f
zukonipihowusoceguto
xarukulurazapunekucedolapedubo jirehebe tajedara
guluyo dawohuracuremaxojo sewumajame pozoteramexi zosimakeluxepu
De vemira zelerinekabatigisojerojezoto lupasisulimurimejozuzuyuwako capavayifirebiguheyihemesujuke
bad cast
ios_base::eofbit set
ios_base::failbit set
ios_base::badbit set
bad allocation
string too long
invalid string position
Unknown exception
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
LC_TIME
LC_NUMERIC
LC_MONETARY
LC_CTYPE
LC_COLLATE
LC_ALL
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
bad exception
EncodePointer
DecodePointer
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
UTF-16LE
UNICODE
(null)
`h````
xpxxxx
CorExitProcess
runtime error
TLOSS error
SING error
DOMAIN error
An application has made an attempt to load the C runtime library incorrectly.
Please contact the application's support team for more information.
- Attempt to use MSIL code from this assembly during native code initialization
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
- not enough space for locale information
- Attempt to initialize the CRT more than once.
This indicates a bug in your application.
- CRT not initialized
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
This application has requested the Runtime to terminate it in an unusual way.
Please contact the application's support team for more information.
- not enough space for environment
- not enough space for arguments
- floating point support not loaded
Microsoft Visual C++ Runtime Library
<program name unknown>
Runtime Error!
Program:
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
united-states
united-kingdom
trinidad & tobago
south-korea
south-africa
south korea
south africa
slovak
puerto-rico
pr-china
pr china
new-zealand
hong-kong
holland
great britain
england
britain
america
swedish-finland
spanish-venezuela
spanish-uruguay
spanish-puerto rico
spanish-peru
spanish-paraguay
spanish-panama
spanish-nicaragua
spanish-modern
spanish-mexican
spanish-honduras
spanish-guatemala
spanish-el salvador
spanish-ecuador
spanish-dominican republic
spanish-costa rica
spanish-colombia
spanish-chile
spanish-bolivia
spanish-argentina
portuguese-brazilian
norwegian-nynorsk
norwegian-bokmal
norwegian
italian-swiss
irish-english
german-swiss
german-luxembourg
german-lichtenstein
german-austrian
french-swiss
french-luxembourg
french-canadian
french-belgian
english-usa
english-us
english-uk
english-trinidad y tobago
english-south africa
english-nz
english-jamaica
english-ire
english-caribbean
english-can
english-belize
english-aus
english-american
dutch-belgian
chinese-traditional
chinese-singapore
chinese-simplified
chinese-hongkong
chinese
canadian
belgian
australian
american-english
american english
american
Norwegian-Nynorsk
Complete Object Locator'
Class Hierarchy Descriptor'
Base Class Array'
Base Class Descriptor at (
Type Descriptor'
`local static thread guard'
`managed vector copy constructor iterator'
`vector vbase copy constructor iterator'
`vector copy constructor iterator'
`dynamic atexit destructor for '
`dynamic initializer for '
`eh vector vbase copy constructor iterator'
`eh vector copy constructor iterator'
`managed vector destructor iterator'
`managed vector constructor iterator'
`placement delete[] closure'
`placement delete closure'
`omni callsig'
delete[]
new[]
`local vftable constructor closure'
`local vftable'
`udt returning'
`copy constructor closure'
`eh vector vbase constructor iterator'
`eh vector destructor iterator'
`eh vector constructor iterator'
`virtual displacement map'
`vector vbase constructor iterator'
`vector destructor iterator'
`vector constructor iterator'
`scalar deleting destructor'
`default constructor closure'
`vector deleting destructor'
`vbase destructor'
`string'
`local static guard'
`typeof'
`vcall'
`vbtable'
`vftable'
operator
delete
__unaligned
__restrict
__ptr64
__clrcall
__fastcall
__thiscall
__stdcall
__pascal
__cdecl
__based(
`h`hhh
xppwpp
GetProcessWindowStation
GetUserObjectInformationA
GetLastActivePopup
GetActiveWindow
MessageBoxA
USER32.DLL
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
CONOUT$
AddConsoleAliasW
GetNamedPipeInfo
GetProcAddress
FindFirstVolumeMountPointA
LoadLibraryW
DnsHostnameToComputerNameA
SetCriticalSectionSpinCount
WriteFileEx
FindAtomA
SetConsoleMode
LocalAlloc
WriteConsoleInputA
WaitForSingleObjectEx
GetSystemTimes
GetThreadPriority
SetFileAttributesW
SetTapePosition
lstrlenA
lstrlenW
KERNEL32.dll
PostMessageA
GetWindow
GetLastInputInfo
IsChild
GetWindowTextLengthW
DrawCaption
DrawEdge
GetMenuInfo
RemoveMenu
LoadCursorFromFileW
USER32.dll
ReportEventA
ADVAPI32.dll
GetHGlobalFromStream
CreateStreamOnHGlobal
CoReleaseMarshalData
CoLoadLibrary
OleLoadFromStream
ole32.dll
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
RaiseException
GetLastError
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
GetCommandLineA
GetStartupInfoA
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetCPInfo
HeapAlloc
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
SetHandleCount
GetStdHandle
GetFileType
ReadFile
ExitProcess
WriteFile
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
HeapSize
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
InitializeCriticalSectionAndSpinCount
SetFilePointer
SetStdHandle
CloseHandle
CreateFileA
GetConsoleCP
GetConsoleMode
LoadLibraryA
GetLocaleInfoW
FlushFileBuffers
SetEndOfFile
GetProcessHeap
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
0KBjOv
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVfacet@locale@std@@
.?AUctype_base@std@@
.?AVios_base@std@@
.?AV?$_Iosb@H@std@@
.?AV?$basic_ostream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ios@DU?$char_traits@D@std@@@std@@
.?AV?$basic_istream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_iostream@DU?$char_traits@D@std@@@std@@
.?AV?$ctype@D@std@@
.?AV?$basic_streambuf@DU?$char_traits@D@std@@@std@@
.?AV?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AV?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AVruntime_error@std@@
.?AVfailure@ios_base@std@@
.?AVbad_cast@std@@
.?AV_Locimp@locale@std@@
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVout_of_range@std@@
Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.
.?AVtype_info@@
.?AVbad_exception@std@@
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
i#pE*^
nwq082z
4R}qz\!}
8yQ!r$'n6{
tELj,Tv3!Qa8
Hufa\qW
abKLHC
w`n8Hh~
3zap0&8
prbHJn
i^Ls`,
_B,O_<5h
xO(X-kF0\1U
=+8bzn;
V)_-$
NI)0!;
#f&k$Y
2{Cv#S
UA$kCn !#
F3CPuzw
;?{k/}zz8
odK"Ia
}Id*W P&
6VI!VwK
m*i_Yy!
{ZT%}@T?
XMq+Me
,{Ya~=
s\Dd}U
J^mx0m_k
*nD`$G@M
%8C>$qc
zWf_/4s
w"F0lj@49(6:y
<})a5[t:
]}:K&CFiSl9
}R[I^3L0
nD6)gJzA*(L
Vv`O0n''<
WjzFFi|[;
Bp</d$?$
/ouC:0
9[m2xK
E6l^^X
EgtdPz\mwt8
_6'2,YmWKLB+
pe?<|}5
8Xgz08RRPr4rcdl
Dwp#7J
|%"qV>||
/N=CG?7;
"T.(yHT
ST_3.-
:F819Ls7+2O
M/EGW"
sXW~x8v
BWRHX5s3
brQ'=D2w
BRI"#;
DFu8YkJ}
v?;F4FuAy
9Q5V;9Em.j/uz
;l.@[w!
z!Hx*-P$,@l+
'G%B{f@m1/naG{
E=^wPR
A /\0~t6k
jrq'1<FbT
0`.IG!1TO!jU
f;+qiP
s"Vuo"
,#OJD<
|gdHN[5,
**$ bEH2{Rd{016*
W\o&J7T^
&*s}z\\N.R
gCgulNfg_6!
@Jr?.
7rsycB
*v^mOU
My-qy^
8wfMlf~
Z2,,j/3oI
I3z'k-mQ
'a_=cD6
2)*9^-?cHp,_^(
Y}$M$\%pX
Kv.yX:mE[T~
G%HyQ7
3T<>^
(SAI<k2&r
.]S!mA!<N+o
|%>CxY
.n9paX
x4ium!
roMD^],/
9}}"hEg
.Xk<7f
OSaz%"
+)|2LWiv
!Lz(#h
R:d4T|n?vS8
EMcOjlnpiF
8elJh;d<u{/mu|Y8qp
o^dQq=0:
"XhH$z(&t-i
`vrz@tg
1W-s#xt
n[H~o!~W2(W
0$j!o{Qz T
C]=o>
y_...
2K`i/H4*5
KUL5{O@?LM9iMvCV
gbU8@Nd
BxMQ4,
tgm.#!
Q:\k?%
~B/BQp@+DX:
%')n.d{IO(/
juj#}g
sl;'L~Y
6MH$b`
"JI`2
O(48@A[
u[^G[J
S:ZG+ahzL3kN
XAU2C5
#vTfQ#SV!]z
Zbc)kmQS5
NK(9}8
D5\eJ+\lA
mI.vXDc}/.e
i@GI2'.
hx"@+brMd
Uflmbd
@/}mw
d0EWj%
m/,@XoU
PaVufy
%8+4,J
.j:_[r
#9)T(j$)VTEO
askzgTG
/0l<Z6-
%tL[K+er
]6y8D^Vj4X
zlmJb
f}!&lDm]w>f
)}<zE=cQjvA
=7dfM}(^
VT+]M*cz
f*:J>$
bt+n6Dz
dlgn4Ye
zJb(X(=Q(3~&
#'_'"wV8sOA5*2V>
u?HCeTJ
JDoE|[
-;wN.s`7
?p4F=(
caRTO\
EV)xip
pkv9x~
*_ZclJFy3
w&B8o8
Vm.4dm
m_pA@E
SqNjLdVC-
W"5dc%8
Z_zWdQ
\HH%];HQX
-_/$030
/Q^`VE.(}:;
|y{oqX~G\
Q'er!(D1X
'|9*HD)
@jNlL*0n2d
t)f0n3
G={3e9/
SVs$?!R
kf@,Qm
n:o;omJy
jAe)`(W37
3s\[<'n
WT:|pcA4LWH
UP^"6`<
FYL;qjU
Li";Kq|
:"B0hSLP1cV
CmH{:sNS
r<Py[&mD571-p3p>s
1y#S#z:
_d&u5UA
MPo|W\`
U4d~~D
BW5G)#kddaOt
CIPF/l/d@!
Rb3`CqA
xFQAPi
L${p">Et\pau,w
B"OMIA
I!(,/Ag
s|]Iqf
0hH1]9U`,gP
~-n>B8z
3Gj)ev5&OZ
5fh]?(b
qpL(Un
=L2uq`
/."1nO2n(Q(Q}T
`yM:Vf5
1[lx1$b?{
7XNr3l
@&aGXy
*L{5X\\jj2^yc+Y
#vV:dp
pR]EQP#
pD`ndfT
$KZ!#14q
3z9y4NmU
:>f6z`
a53qwF
2u5JF05
m3fRL;
&Xj#%{re0`Yr
R2]'L5Z
3J4.JXz
@hKqTd
IQd{p^l
{fUtY@I
s5ymbV/W
C@aH;<NWX
K/^MNfEfHizA=
Pcl3't
[3`0D-
PVa7*~5
h!D:V4|[kA
n}D.-:plr
S>M7I*kp|
DD9l?!
;\`l%qk
;Q$O(8
,?B~i56
:DXm"[
p(Hx1B
e={mzI0}$
)A`sjI
gH;=l@Eu8#
Bx49\:Nl`G
PZ/)hr`$80
93X\.'@h
Q]0Qof"
:mwoB~*
"V"XoE73
o$nOE*
8Had#D{\Z
WcAhph
.2U(/liv
H4MLZ,ld
Le}NV<[
,K["#I~7
F&7T6K
u$(8]"*
a`5BBP!t4,""h5
!/R?rTi
`aw)Z;
=8^T\baYyt@c
_-De-7}
b@-<vK'pL55@ a
;$0>0i
m[w\,<Q-tUum{m#
pc0.XA
yyE>MhI
k@5r]27m=]
Kl?uypa^NQ;CKfda
JeZN9v1}
(7&tr5fy}[G
5}NEET6_4.x1!
A|[Xah\JU
7Cd98}
-S^@J,
B*`hGwSs
>-:~1z
!qn;Krx
jlpVU`t }
O|1Kvmi 6vl
*gv<ZxJw
9yR~ 9Rh?r
P#j|Fm4]rzQ:dv@NB]:MV
H{m3%t
YnEPc+
c5Dn;@3aS
Hs1!"9!
|nXhZ{,3K<
D[8k9,.'8S
H|wxV\a&n_I
&KA6_z
5`5Nie
@}+G~f
SomL^4
2M6adyu4&
LJ.>K0
r'}=G#D%
gJWl77z
=?i7fd
v$4/uMt&^P
/2)\C%
&|/pQ&j
iI+!0>31
0Y4MbaFJM
(7ldWr?
oj_pJg
707r32
h@,_2`3C6Y~Q>C
(mr.*vj
RbOrVSK-C
{/)z7=C
wP8e\B=S,$t8
2G[pm#UGd
rP(9%Zy
<2j@LR
Cx1Dn1v="
`,pvD6
zje)!{Unt26
^Njv@(<&=Q4<84
JMLH2[W
tM,k0mx
]\l/K7qIq
5HZ>6U
ev_(40
9(-HFAD`b
D~KUq9
HyPW;
c}XSQk
j=Dh^@
YWnsKc
$Z>0LsN
L7!*~g
Ka@zwF
{'VD@57?e7F
B}lTI#OmSC<yI
T4H\v+
*8W^A6d1
+]BB6'
75QECl_
B" d~ct
&|N)@*Y
ngzo~E\E3VG
C\vIbL
m9Sf5<<rR!$O
WRM+e(SMR
DA-gVb
xlSxYY
dF*,5z?-DD=
]&(Ummf=`
CT^{xbv\yBb|\
AFXjF!"
7.1!(H
~V}?u.Z.Bq_f?3
hoENPv
tCKv[pL4y
j*D!;,4{Z
*>q'['F*9(qNX
Aa>5;'
v~_kS0
2lkXP_4>p")
c$%_."
M\DDSk
^T3a&pXL{
<h B]Nh
N4t%&BP
Fm_CA/&3
I>Y8I^8h=
jd/A7&W=7
hDac})
i04>PNFsc9lv
?PYs#X
=Fgqu9
[1D4.Sthki
TIl Rm
zn<^+lAiF
x6snSh-7s4Azg}
mh0Zuz
L58vo:uWKguATq
aBcy0Z
'}!.hi-:<
s3d@(/}]A2n
p#~ex@
xbv5#H*dq
Wo{J)r
Pd*)xhs%Ym
{4*w i
%p[K'8h
UbKfcvcP*]t\YE We?{_77
j%WgMd3]O
0"}UF!
?4GkZ2iA
PkwI.`
vNXqZ{B
dq4YD`
y>k2:0:
\BJ`=y
gUh`km
`!LpJ.b1(
LX}}O^G|XjMHm6Z&]mDxz
CGH`T
.FF}KU1_-`.m
=u2e;=
(#jQ;
s1cn9vJ
Umtx84@mc9
d"}G D
|V>,#oTuV
IBG$:TX#
l~TJ,p)z'BE
1x|Y>4dtz
,r}Hg\N
|ZRW[C9
nB\=WN
e)[*-_k+6#
@o0:>n&
nh@# [M]L0
TXQ]d^VU
38bd_np8li8Fe!Q*
=[UIye(
}\WCoJ?@>0
7hn!>:VTGMkEdS
i{~d \
8<Z6NaM!MOm
-RC`'}}A<
x|5?H@b[
N$?Y4L5c%I
C;sr /ELCV-
6l[']CSB5
C$>Q,WM
(Ql}/OU){n
dEf`n|-
%V="n_-MH
ne1kJws
z3BDc&=V6n
L.z3=^D
&%tP2tJ
tu!bQ'C
#{>f"hq&d
;9]G}Bg@
v!]K??N6"wT
#{9d'G^y`ww
whAU~W
dcv}rE
$T-Zn#A
!(\t#
[4SX"E6
|U*^o3fbD
PeQ-F8WX~aH
T2/RC4[
h kkuTppr`OLfG
o9^`)$
ylb-0O/9 L
E}zS~Zxt"@Bf
yV\D1C)
?]0;^DEq;5]v}P
+mQ2Wx6
D]V>`gM3|
dzR lty>
>De,0cw(QERQS>oDiyC;[t/+3
$+c1J:
9fo%_t7?HqL2
wQM 9
G1L4Z
`2Ydm9H
95!u.J:q:LM#"BI
GA+ JlC
[H.m'c73gG,\>:
i7u4v6
U,!>O#
Xc[~yyZ
b&zGIi
]6'?t.!Jx)Z
=xRh']
I(["ar
|A6nI1h
xju6<P}Q:R
@><LS"W
MztcH',{W/?AiZ
QavfT^Dix!qzO
[[&mh(bek
KX(\vqtD~n7O
LO[V3H7.EVQ
=0<N(s:1<gc
:Ha\j&c%.D1Q
oZf&[>8
utt\<7w
/1Fe'9
|T-D#z
:r!@:)@
U:Oyvuy?3~)
W]Bsg
g~6^PU
F4LN%V"wN
1N*h|E=|
rl3])M
4H3.y(
l3#v6>
([[@&3sd"uDZb/,l
mL1+)rZ>~g
s?#PnD
w2869T52UZ\w$#FEV;~
|d_\ta
vq(-x'l
T;Bm./
EW`>73
O"kq G,:
60Q#Ju;,]c$
|~i $\|LfDZ/3eBlrF9lIJt
}`[d$
Mw x=-
gOUEsi3M
& 'MG'o<
F~gB}o'
$yFx0I
H2LK[p
['$R+Zq{M
yTgtnP
AX;1Lp
]6)t^n|}
z_/Wg'[%$Cv
Cio/R{
X7hBW_
BLI|A
S7FP|O`
[R,5%vG7
RNnO5c<k5FmMA8F[
avLZ5`I)
f;.4GU=w
5kSB%KlQ
'N!k$6AOG
&P,y]t\q
nHY./Czn
h`\ESErOwq
I@N eq
il8Tx4
U6R00-.
AoJq+}$L+4D)
j)wG)X+J
fRUs2M
W3tK#B=gg#
W+1M*EEY
fJusxNHe#o0
f'@N/{q
7+Qq*1
j> M!d
x0!/ees
e5pE{&u`
=M>jC.
`bq4B~<
M7f>b
%V[)}i
n+XzF]6
c2+axn
7>~_2D
)W+2+1a5DL
+v9+oR
R"u?IA\I9y
UD@wZY1,o
_I`.GC8?
NeI%no&
0f2-e9rnN:=6+;
JX0gfV;
D_1<bMplh
d{u,U$1^Y
{.GyO$
$Z:+M_
`\^3h1x1mBD,j
@14gk*
t`Rk;dV":
32@aZB}Z9Dw
}H>J=uiH\j
BO"L)&|b,B
CBOO]wf
le_6JdiS
0AJmq8;B1"PS)
P;/To"
`BUZ )Xh
to#9doB2
pp}>WiQ%Bz}
,p{[A^B
!zic&{K(
8CV(Q*#oG^
2y?4g4Fx
MyJ|79[
{?"06In~QCwlTO<[GR&{r
eKZo;kp
&5B;[6
$p iR|Z;
X-(bem4dKp
?fC0X1-f8\
kVpcL@<0
"vy9X`
090g<f
God$Q&ng>Ur
=4Js@Tk`
zka9/XER0KIV9-V
3Z\XKR"@Q
)m:kWKQ$
l%!3sk
e^KO*[y[
IH(C}H
#Q1gF3.5,f
7G"G%f
JJ!FS)6@
"EMr&!nMc;
#w!I$n
iw\ If
&9/u+1h,Y`m34&;
'xS]Ln
r,x_u,
STdy!Q
B$%-&3&'
dwOeC'TM
KH#4#Op{}
Y mn0]
~HK73XeCM
&dfW;hH/ls
>^+><rR4
BT\8?5~W
ZM3ViJ
]rsuca5u/I{
&gU/BWi
_%-np*SkU9
Pajo15
-xkTWg
@~><h%B6
aiYoS_
SB~=r@
7SIOA\~jHkk
<Y*Q4%
$"/`G=
sHt97u
Lhdz_:,X\BU
P 5>L(b
kFxM<sy
$D<)9fa
KC-`r,@"+<"
k0?"!'
<2)%20t
Uac>VJuW2X
qbb}(xnOg:?v%76Xj
h1(dj-0
%@Mdin
M8lX27B
6gI@4:%
LhH_=BRZ
Pk=p,q)Ab6
EH1!3Vj
@:yKG8O4F~
M8f1jlE<I
%+P9F*8+
cq.`|4
_*@ qP@
I}iq/|
ZEw7,h
pB#|ODh
}(VrNwq%
>(WP~e}?J;T
&cYE,_~W
O-[$]fR^!
?z75~b
h&Bh[l5:
g Iu@N6N7A
v`;}=~h
y.,Gn`nD
_q"Xf.qwI*
F8~F3g7
<?!/sg]
X:%H,h
#)Pcf?
dE1b{I?[2
F<~Ya-D9</
Kr?~u
\-GBnuy1F}J
"$1*aG<B U
govqJ?m#
JmMZZk
]f{7P>3
UA5J4]
T`>X`'Jgc
-g5yi%;w
5=`mC(:=
rzpK'm
gzTI:XH,2
dQc[G(p*
r)BX5]
X$"fwVOJ$!
(|sW8y'yTl*
b&2$|}"Ap#!oU
}>e2I*g
@(S1J?
"tJ_0Gm
):'x=WR=lo
S-]?LsVLZ8FArs5;gm
H`d5UH}}O
x9^&f&b"
pSRUk?*>
7j7i1)`i
q {&g>
zO',LioMhZS)\@\L
ylya`2
;vb A}A
]AB.I[
yq=)V(&
wB#(!4\
VH*OR[mY`
9=KGC}m@
`{$gNM
?NwIW-E82M:BK]
]L6`XEDn
++iv-a
zb'p|98,q6
m<_\lov!
so+![ll`Au
s"'e^L
uhY&X-l<
8^;^L
d"$=1;L{q?v0
c5Zc^hg
Q:b!cv5G0
?rsmu};w
[-[h=C
yMl:wOA$ZJIs(l`y
~$9<nz
0I$p$*
t=uKE[s41v
V0S\Hm1gv:A
k&j|-Bv
r5?{gT
,Eg5)o:
5c"1yMN
L%UMuQF
8KS5;h6
E:@B(E
b<s&,0Aa?O)NF
3De_h>
'0_kn<j\
$UR=:.f
I:H<jZ
&..@-!<sj
Ww\wl@Jl9
^w,i]\Zl#
7;Q\<7H
KTH;s Q?=i<
[?{.+eC')|cg{xD
"Ip/;H0s
wQQa=#Gcf0{$EbUs
rOh%Z`m3R9kW([~t
a[e]6B{Cv
8ao l4g`
rdXklF~
JIR%h{
Hs<|t/
J9f,ln!-
aL,FmgY
+,#i!]
wH]?Gg9
,P>"Og
x_}]0*
6,ot[=!
QC|/ooR
*f+Or-8oaH3+@V1+j
Xrj[On96
F3*)/jS
4z=4]dpo
`xd@}Ro'|Zt,!Q4ju~dbp
KFYXEKDv|'slx9
zN:xw<3eERr
a$ItvlQE
I&Fy2<
ebsi F vr%C
wu/~-J[
F|hYU)-ZK518O
F^1p=%
0\wC5"tz[}Skin$
@cJG5n5
xoWZ[>6[6I
FP?uhu
x(T4Bh}|
{$C1b.[(3
J+(i!zxk
>?^%%8Yku&
-}9\NR
nLcIX8~
FPmo)P
_9K%z17a
FX{5hv
;~y)Ej1HSPW
K74{`~%O=3&
v#pKm"
Rebg3,D[
C$;GhzeVC#xn
CFlqI0s
b5x5Du
C>{p=,z.
U>w(1R>u$y
ZE$[VsX^
n(vZOQaS>f0v
BhT6e1
&t(U=,b`
=&Gn`@
BnuEEk@Q;9
a*1#uJm
Gll^U{
H3bnDT8K&<
4mHOz/m~Mk\o<B
IXOS!n
~IxM`N
aiM?:9J /
y+@S'4/r>
{t+G/5P1
U}rzQuq:[9
ch2Y`3rnZ[{,6D
<o~/|02ciQb+W
MyX3y'-C
E%LzrE
A] ,>/,
;ElT'J3!
7SXti*Y:3x\'Tsdy1
JRBVTA
azYa\c0@sM
8]e//z
5DY$"z]KMP
W0Gx4wtu_
Fd>u+P<@GO8 Wf|
`7BR3] B
]d<%b:Ib
O/SIx5aH
jwzjY/6a
D61ZJ$LLkJe
"w!v7785?qOR)
lWpdsw
gU GY@sv"!
)5_6xR
IT.|V&
[3(0"t`
o4sGfK
jCaa}*5mYj46p"A
Rsm3Tx?0>~*
0}5k \6
LR7]JO
%zOE$f
/onDWfYU
>e+#H4
Z#rHs;8
wlXc@$
%j}0y!U
s/CJX"
aLM;LDU`m
a8B23rL
C=!}7J
=x3Hn~x)W4L
Nhjvj0\$
|I3Y1XbKOB{M
dtJjKs_
6Qe(Pm
krv?,_}nIh&"K
Sa"4]G
,j&cnn
D)}LtV\
C$t\C*-^.Lol'=:t6T
Yn K}6FKR#=e-i13
##f(-BEm
KcJ,iT6
Pfy+"
13:WKN4
j:m{:-
JRxFB(
T'BqJjy8
JzmJC.q-v
*b1x(`
_FUlYv!502
^SC=c6
q-'Ay4G
w%g<{;:4
{z_=s%
`t?Q/HC5
HZtv[C
_Aa+d
'CTy(L1
9Si;?7mio+
\+8/&N|
=QFFt9u9}u
V(zzUy}TX^q;c
O|4Ppv>UeWeg@
j:[8^O
[M[i]IW#
ka9-#%0e[
0QrD:U
E?iG]{`[$Y
/,ZIjro/H
a18 P(Hw[O
.D@l80<S~"R
Ing3yrm
,J-d]FQaf&@
FGY"xa
[=D4Bs
8Stz_5B:vf
*:'\PD$L&q}>fc&
+OVQ9 o;;
pky)>G`$^
=pTV/>
5@Ssnoi
s8u((GSrzw
YJ{J)`@
(9jPh;C
8y:0nV]C|].
EJ!'~n
+i\r6i4;':&*
\@iW&:Ro%@_
aG".M*
0>@PHQ5g8A*
UoA+#7
~QNcr'
OMN_at
9[8SdC{MFsJ
v9&[`&?
*-u\),:NFo&;
q"V9corolfBlgdM
[gxfZ
hsMVtP
!jB2~9Q
Zn:\3:<$
|3v[JKga%q%
fp{WB]
4z/2Dg^_hg
Mb E,ZA
6xNk!$^!ChG LV
0y,U"B'I[
n.gVB c`"
GR&HJ1
brz82(
Asn(am1GtQ|
pucd!|r=Q
MG}H6 Q
v"Ok\@mT_i$sX
\xhg;<<
0Acy+d
Z)O}w6
JD#Gt>`#;=
.B5)Sn{N8f
tM/A'e
t!KD+D
4'P>}pl|
sqc}6&rgrH*s6^
o,KnCQ$
"07zu#U
t;nw6B=C
wR\Ny7"r
#9Zm|f
mRaO!'
cQZX| 9ZX$
^@l}]Yz<2
Zb{,yN
Ca4JrH
p\a0%D
[!Q%>,`u
^53M`#nT
4]<f]#B
5dY,pmzw%
SHULbw9S
H-:uz-
\#L;S;
h<SD's
urT:^T/%tZ
?0']T_
DRG#+#
63:1f>
wR#NU2X8
e:[WS%@
p||gY<
qKU3`=P\
%Bh9&C'
XV9#/%i
^dVc/o])(
b)B@Sv)
4!N^-J9-Px
}a-EN59Jx
~l9v|~@Q</
9!cBV9:I(2OC
@K\5j!N
" /:^1
".()3F~;
)^6WCLzY
~%=Q.^f
$"{J]|)[q~{*&f
[S8Y';n`
X4;Jl{J]6
:f,%8dv{O
GL|Ng5y(s
[_Z5pw3bg%Cmf
H<8T+BjEu
[t)w:A.
5l_q:9]B
!f ;(>Z
.,>bm$6
:e55wo
*Ax9`3#
Q=3];x
ay]i@6A`UuT
>,::4oF
l/+X|C|J25*
CLnDD/{
F~FBW%4~
E'\+GP
}7x|T6
hDZ!O-
fr`DdD`
.C#IC1{
1#bwoWo9
v=trqv&~W
9L`5G|6%*
]$=FK)Y
O4+,qC'
2,MH{^
PtQ.]S\dmq
U-n_{]Rt
Jne@D+
>d"U&t+3_/
jGf?yro
dv"H>svP
*X<[O\d
cLejQ4a8(DI;
J1+wKk
J+bK&0UH8G_l
yKrbVby
GJi%1V}wx
v*-YMeAjVr
yCi:?K(
VC\q!U
voJM ]h
g9BpEn)
(>4KE`
$YPx!iJ$wbG^w
Uuz~gjP.
<8ib%S
>($h\h&H
|aM,q)
fjmw7$Z"<\]$
F/K6\Xr@
)dq4YLw
?q7LZZ|
H?<8Jj
Ovkk52d>}
ldH`(2
Bh_z-}b~1
5^*Ky,rN)FKe
Ww7Doka
coMf%GDh
vJc GK
x~=S5x
f0R&[(
!=SH~y+ce
Z\t?7+oBM
X1Fa]Z>2
{H'f-RQ~)G=
c_x@>Q}6
G4s,ICO6
N9BZE=
|}c<LEg4~
:w7fa|
{)BOK@\8jB+
1RI@+TkyO3
cjAY^9
/j!!xS
1E>|&e
o2i^_4c
+@Z?pHmSW\
!_uK_r
?iiD+Dk
36`&&:&,YNKY2-Z]E<*:!S;k zt
x5_@TZ
@J0t :V:
2.5R=Es#
xj,V4(M
[[TNH#x=
y%tKA|#>
arA#BkiS(
AtoXbI1
jr\-@H/)
\})"CU
o#z"HT
qV$[}`L
AI;.eKwX
V%pSSg
~{?$D&
oV*wZ}f
m8]}VG
ldPMd:
O4nC;|
K(@#%B
\{6>Hh1
3pg}m}#D)z{/6ud0l8
?Z)Ov32a
I97X"3~N]ARd*nY
0A"CXZCioO;gIg
FW,IJ+
j.#w6|Hf
A8g1[_S
n}TDsE
)7Hg)E
$phIz
qG5CZ}
e|$lw`+Q:,V
(dXGxhFm3x
p `ISAqv
v,Zj51B-
$B5aHE~6
jHw1Za
!w%,$9lB+
5?SW7<I
.?:U/z.9
@?Pmg^6_
4p8,PM#
VsV5s~s
cf`pV
$`6hgfGv
7R0yGTV
^{ksr<S
>?_-unI
:0}vVLmM-(LEsc]
AJAv&A
_G\+T.L
kv-cq{>P5B
?%3oy)<!!l
ZcZa(W}/z~RiRs:2
p'n8h-sW7N2
OhRP`oC
Rl^RW]
h~nF\6
H-P@+j
o)rK&Nq^w
z3mHL2FE
8h]skw
E}dSQD
:$nNIC
%W;;SVG^
>gD6Ly$`1M^FI}l
=F0{tH?
AOe:w9
b7u:P}
6zCy>C-fb
IBw>O.,
xLV?)'5
tIh2$lDn
ys; /AhZ(u
.Zqsw
C(2B4 }>!!
x5{,[]S
eB(9@i0@
+\=!OM5s`Oh
<urrdm
bB.GKx
>'?<^M)
.c0?V$0
PDZ7BJ=
qB3E?WjeKV
*pLGjCy
f%uE_"LAv
+ZK?yE+
;f!_ofH\
8|H(97
N_"}Mb${xLp)x=%
TuylG~\g
N%D\sn
fj3)sD
I7MK]wrA
x\L/qZa
MP2.S7
Ao4!8$:
B.mHlhfI
g>?^zTz
U>0p^W
#=Rb`Zx)
$N4`g`97"}RWx
%v3=8`
zVciKQ_
?7IC?N
h`VX k
AK;Cjh>LK
,BkBIwUAAwS
D2L,uiQ:YNmTiX
^[X=gG
jk:aNqbN
)bxbmLr"
Y_]9<'
ih6cAP( ?'
b@o:Kfc_
ANyS192yh=
6/G7!<AFRz
N~>Up9H
b#s~#"^P
BkwtOdp0 e
2Wad,f
=LPP!!
snT`A]sTl
9:-KRWLmSNZ1~@B
QBs*`}?l-z
xKRFBJN#M[9l
DVlw'-.Mtf
PtG2Uc#
{.Y(<?r
~{+1g/mI
e9wnbw8
]s"AyN
h8]XdB{<7
9oQXM(
Ni=-%P
=yx.v^Y6\E=
,fX^hu5"k
~W^GL;`h:`
|yt&:;1;J&Btst7SY
l`rm8xK
1h\!n~
8fT}.R
.R$w+=
!Qiu^?bfiNb-{
O5"7UdRIIS1:*?0g
KN$$t?
wA)f|[$
qDt>a
a+vP~
wW$^eG,
4cQy`g
#>9+5Zu
#H?74-O=
rD|D*+m
c|$*@Y
/=f=# Wl
y0q]N
ZW1Z'x2!;(wEW3
{3LTrm3
'I%{2T
Y~Hydo
WihW>%cR>Y
&/-rZ:Lv)m<
o:,C2Fvx7+
hY5\<-yHUw
t|Zr2)\T-
5cSP87'
,4]z2t
;yjo-Tqvh
*7>4@a
~e`R%(
OVs+/i
OJ?^Z$
6G:'vGiBn
X"k*Ww~)
i4?{%Lpfl*FI
naJ6]G
62JUBu
KpdC`8.
/ -&{V3
6MeY]\U
'65gnR8Q
?F9>[}
3PT)>s
]Kg"E.Y
&LunH{
~zP{^G;mry
&C*\m+
:rMKbA,Fs7 /
E$3y&$^e5
pzu)*]=[K
"=[J:m%
]t<TlQP#cD6f
8Yyf2q$
eE/<+s
DPIW4c
Ln'=vK#|7
Y}qUZ"Y
i`/A0Q8Ds
#{+o-#
{ AIzNF
YqK1M+
gCkRaSG
Ue<Wu`
s&C\mDlF
z1m\WS%
Rlsc^&Yag+cni=
b#5ouWLGUSshF4}4n
sy8BX_1!]qn#
^F)1}N?
1[!uqdN<8vp
G@f<c<gw,
6np2_N
P<"Ln`:_[R
uGzxI>=z7lNM
#Hz&-D
6N*M:~
(wP7N'P
K!,%--K}:n
cmd/V'
Apb~m<r 8Ow
,^*Gv(I>F
eNlt(@s8mWez'F
Y6*`rw,W
,=#S%c
!;T9m6}+CY
+aKPH7
#*R7rW3vRLAz2/+
t/YZz/e3%
x$88c;
.[(2j$Y|&
\c/*&[
Ij<Cu2[
=;Bk)2B
)nOcM\e+J
.>it4j~D\[
pqwoK, y
s;j1z_
K VW5G
N};4Xj
2bo8YDXM
)DI{g-#J>ccGJ
(7tr[.WE6
U\tmRvdN
?_!-lB
HWQ<cJU
SY-vj4K[MQ
a48:A
2AED0K}
f<[}$G(p(
]7y9H]
?1TnN!
*7^)i4
Q sL"{L
vrr=sH
HGR<eUmX:DJa,|U
V% QTK(Gr
jJkez
s:M!DT
q>f^p'
.&$(:ndh8b,ww7
6TRZx_
'91[Qj
1xXCgo*
|hW{'\
t_gb\/
Xk>|{*f>4Hn|
pf).{oGUW
x7*{W?hs
aXrtH`
FMGiC'
!p'(vFJ
=,YS 1
CqsWh#
mZY6,!i
)hx7* -{`?8u
hZy4Mb{C,D
0Hv:%OTXxGn[
O!U!/x
Xq7D4Lh/Y,X1+t
Q4-AT1
u|G0~=p edVp*:
_?lj9h)
?\!MyS
?uZTOzOiP1=
`unnzTh.[:h
XBP5|]$-
oXEIB1
'Bb?j=
W^YyoAg
LIe>-UH6@
pkF%V8
s/ZNA<J0
p/1?5)z|H
8m,CCS'
b`xPAcmrB
`A^ H.G.Whv&e
$x+a;G
I3!N\wj,
6T#m0+Y>vfD\
I{9Y5#
~-,h@b
ZCP<FhosPSj~v
0]1UpP
7W6K'Sq
78W@|J
!5PYF/
3+TWy_
dPO .l5c
|z&n=w
$d<9-^4k
{TD/S=T@?
,F&buKZZ+BM
2[1s62o
HSKzl7
_SY6EniP[I
]deZ n?
[TF,y'<c"z-
B? NgK
P/u0cg
a;"r ibTg
}<yv$Q;Iy"o
c/w^Zc
;/|m9_r
V:~Rv
oz]+!^
PImX14D
kD(^50x
skr%:0M#}@]
:0"zqv
B{8`}c^i
;vXzTx<*6
AX?_U,-
iAf"b=g;
P%3oyOIh7
8_?zY_U{JR'h)`X
S#4VXLv
Fq:Mn8[
JC,Y<
Z74 ]5%N)(
\w"s!-J
UFWgTx-
&%UE_eH3
q^P`iKvhX
M^Dj:6v'x
WmT5&(!
gGa1v@
pq1:uV&!
2~Lw9-t2Z
-t^,ry
PlR!N2t9t[c
_7^ 8>
=o]WVNE.5!w
*1ImP<,`S
<0'5k}RK
4!V}EF
*hL)1+q*[
guhX<>pa
Oq{LSQ
@!cZiAd
3YZ?R#?"
C`C>ywd^U]%<
pP'mHX
v=`Y:d_.h="
6g:,xv
tKg^]@
A(Sz{Zz|;w
Bji]?vqE
"~{)sYt
5]/]WyAm[pa?
x4$w@~"yA
)V'D6=LM1"})
Xc\!Q~Dw
5av,Pw~?S
1 6Q'Gx>
Bke;Z`SeO
]3GzjO,O;K
wLD.=iN,
h]9O0wG5XZ`E#D
4.g|l&=]
b<' '|UqT
WFG:C'#
;Y3$_.vpe31Np|kTYA
jI2\7:-mWI
7be("8i
M,d,?:
#yt>y!d
>xhK"&1X
&,T2Dhw
{,WW.lGG
'E{,_,&
|iW'|5
[:X:kR"
>!LHu@
;Zv{&F
O'YXUer'
lD%8sDqb"
3K(Ks2^
&I|V.35
H[z]s*W
4yb!KQVQ_b.(_
.wbDC;U&
k>.g\7z&h0pHGtqc+K'
VT>*&5BI3WHf?__Zy
.a7Rww%v}
Qg,oj_&9y
5_jSYS
TQBGQ`
z6[R>n
iIS$vZg9L
y_o4VP%
"(OP\Xw}
@ki0L.f
z\&*<_|\EO
pRNs+v|
Gl@xxg(lJUZO<r0D'
\;^m9" Eep
R8-ihbx
-xiVFFi
dN5TfD
Wt\&Q-
l3l3@5
ZT\7F!6dwb
zTAXxidT4
\NSBm[^Kc
$DkpQzGte`NQ,?6
ZmiJ&Y)L
'?U91uB+o
'I[2w$N5(
laaI_$8+
M*!7`3G[mo
i1}|nS pvTQ
@I9KCtE
lW|~5z
b|t?`
ZlTf:1)^S\
5$z*\*3
p}{(rwQ
"xAe3PY^
,n"(W'
$^c5Ut`Q+|B]
E`lf"(j{
|MM}tyPGclXb`b]"
OF! @
91r@*[
M!sk;XR
BRX5'=.M}
f5~C_p;c
NPnGr6x;0L5:
?awf+?HxZnQ
9Au>6\q;M
B[{cLL
XhHTdd0O
7@nq[vo8
HI.ktyL)
l(pL\=
+W'q;byHv
?WW:[Y
`}T?[(
;w|Q?Q>:<
[ltcQDy+
LN6 -G
<<3`~^K3
~y?H)uqp
Mr?WF[ 8
c+f"kGU
8U~!\(
O|]>@i
fhQ}^;
0%lB.@
j.[$2!
>9G1e|O
{c||Qsy:pCG9<7tM-
Tmnd=EMz
)sB(!6G
+DxV1mI
ok$CDxZ$
g<3#*;O
"Fvqv
I/{=;EL
>iRTn:
0&JcKDi@.
Edt];d
P2rSgG9{6
K+_x,a|_
Ay%dSK
Ej~*&(dOM@
mp70]F]
Ey+gL+
Ltpi?:@k&8#4
)L`,~At
t-) qx+
JQk0d*z
jl(d'G
dVzHJ7:
_yFU7[
N3yH,m
<_: tO
:km,?b
sWr+bEq[*
ln*`S1O3j
S)/+|7
adzO`x]LZ
Q?nsi:"
F}@pCz_(
4)p`r+oY'X
PK'"k|G
UnqHhNt
o#=0Ru)qry
dX|C/@(
o#Wj(ol
/F|VO1O,zBA%
G7(CSh
2v+DA Ske
\DQ!(
tI;W\_B
v9]ptR}j1[
6HC]_cYo0>vPhD^
j1$Cg(/m
a5ny\6
xokv"E{/"{VPl/&d
op7eG0X
U<kO)?
[nf(Kt
.y2drZE
%kW6'f\=
@I=nZG
AZ+1n&_J
6NYnBD
j]z,sz
R1h#sw
SBQjDj
|r+c:w
{"D$'vD{@jP89z\V
8#F M??
S;&rt@:
6s[MU6
Zz0;6j$&}H4
&!h#4"9
B_cX#6#
@:J$Go
s8b[EU
i1k:C/6io]-
J.=Qx7}NoqCx
K>%<AOdXa
D."!c]i9o! mHez
~jn,)mE
#=*,_hjhN
nU/X~r
:[:vC@
URvz{#1Hbj$
|40SQF
Qk 8Ew7UO
sDJYn%
1+8Elr
j@*!bryAP
%QbmeF-61
:x`'+[w
7 (1Oqe^A
JSz,u{0I
?\hz~)"
jEibe{@s
9uH/Gsk
.T;KjU{
:92jk0-zX
xRRCN ;%
}@u1Rk
%TNmDQi}h%
YS,{e`
~&REn{tk
S4/"Lf
S9"w3T
&5_aii
zokp<5Wgt
t}k:!#Xk
,n$7Pc
ss*5s?s v7zUxD0
qkAR>>2
R6fBL9
:TxY4?
\)oYF7>V0d
*]fR_xi
R21-Od,6OUQ
pmII8K_
P!lS_nZS2%m8
*e0H#Rj
8JiL) d
O/?}4HvY
lamE>9
%l)A*{F
eeM#WN}y
66}Ol|"HcX>~0z*6q
'1[jp(
Vs9,X^2pG=HZ
hy[;9+I/T
O2?n]?(
`zbMF
!b#8ST
\_DO1(
q>m.ws
@{5'K%
`lF_m^
gU0xE}
,Rn'}f{2I;
}10/Ng@mx
flj._>S
Ec)B3r>INs
d)lgA@*
HN}ADVMW(
jVJr=8.2a+p`St
TsNs"BC
>j=#8xE(
G~N%ZA
+UN*,J
I'2?B#M4
eVV~>T46JfnLA|}n)/S.'c_[cw
xe?k!s
47U?zJ
H<B6{9|iDw]v=
P5Suk<K)=v
k~g2;"1wa)
S?ZoC#
CX e(#J<5
RmTVq1k+?#hQa7PB
AfdCI3WQ
4Q@-RnIIU
t*@.\N99n)
$Q+3Spl`9@toifw/ie
p]@nH0*VIX
XpsX[UW[
.]|$J,
!KuztoW
_5u#a*2
@EAzV5:%5e+-
~3bv^8 7h(1<4_
}@"4kz]
2)QH[>
ud2o]_K
|%g:&"O
.a2lovTJ94K
VJf0l}(d`
a~&vQg1r<A
c1KL[?
u|Gnf5`nZ
M3H(&Frk6
8"XqT30LX"6
,qJUT_J
?}tCPhOx9
k45aNT&
g]6;{M
:{ueSfo5
KY/&I!
,53++Ume
na"h5RDq
+eof;_gZp7u
O90$\-3T:X]
gGb2=w#>!
"0l$Y,|/nK
,|f(TD]Qe
DE97FGG
s*Agc,
A8}`,B
0L?=]h
=FK0um
fs%LH2
a/E De8Z
Ix{D|G#-\V
_FG&KZ1
Kk6XZ-
tjyd!<
@hg^<@3o*Wtq#O+v
cXen^G
3Eu.!bB
/aoC| 7`(lDb+
2eNcoc`=l
\|Qe2H
s,V|),
a^+dWi
bp]2%!
5w2'QdY8/%X]
`QdHu)
F=?(ov@n
q64hn}
9($L0(`
G&3L/?
2$HL!|Z
V8fN @
I({/CCuTo
NP{SVh/5
D}LTI61ut0
&})n1T|v~!E
07p&:f+
NR#D5M,U^^_Sf
k$Oq5H
_b"&M5
=5;=`#en<Hw
*Y."8sr
RFVw>sS.zKUVC
Nh3YZW
1=VAsM
9^Dd$x&a2
;&ZDE8+<
Taeb+S5
(A$_SO87[{xZ
e{0knJ!Q~KcL{ikAE
a8J03P
e*CgO(c`Wc
==>5|"
^`4e3z0d*zRF-h3*??|
8gLtA:MZ`G"3o
6}%e0y
]>E/`/ooe
.edzvAD+f
?Vr@7!Y4-r
&1R"x=z
}{CMQY)n7qY
uDc''P~+28
xE65x_qSPd
:>O[mA#L
XPo9&,h-"
s@{ZiCS
(i?zxv+k~v8
o*{Dv^0
aGrfCk
yO\x]M]zQ(4
=*61;QohoO<MYMb;%T@X]Q
b3TE=s#ex
#v6@*muz,
<J"g$xP6G>f
xWx6YP
':05zC,B<#
c&=c2Ea9rk
&2q[N|?u(\
44;?Y7x
j|(>3&~nn1Xw
CcpmU@c
B|*ktQO
2O~+1B)
\TCZ>
a^l6Oyn
[0F~2.yEt
_byWl'
<+wbu|DA
UT kDp^r"v-{
z+no6D1i
'\}$a}/2z
\)5|<\
vNme]0
|D3f<3
?RLlNd8.-
<;->gA^"?h-
7,:,&
U>*5>h
nX}^VAPc0X!Vi4Q;\Yc8JEn
OsgL jz
XrU0S&H,
UttXp6uM5G[
Se^NI~
31t0Dz
0c\/*yV) wpm
G)sb)[tg
mA'yP~xr,V o>
O0wV`H6():2
OS)QE
81DP4U_
I9{6s8I4
"*nNyPLi
g%E:$B
sQ*QC9M7#
>Bz^wo
m3R%da=y[
cNdfZt
z:"K*c)EjjIh[%'RvXYCT
rC*CB=
%S;J_G8e
@"s>ah3z:
J,uC,})NW</zV_
EF!=O[(
o(L@EU
R~::`hs
OaY"F$
</<V:F
%nG|&B
3##;(KHRH
<'zB"&s
fV\bp/Vx
/zy$d|4
5ZC&IC"
O"`Yi=t0
8rMYJBE
gYk}Cjyml$k
p\J?FK4bQQ'+<'SgQ\/
DTo|fD{b
qM]Z 4S
>@msD,GI\S
m4w!a-;
^n<m?
ezZOGG
z,Jy&L
{8jXb<
G,'UH
%lOd+}6
HSn4x<V=77&}j
_nbc:`
]-U'7<A
0b/LcJjV
BB-<*WkR
{\'3B/
fGuOiM0
UG[s0sV]e,
x/aaE9c
;4Qo[W
_WTF!Tx
_9J_5%y,#u+
:`VY((
P2:6%De
c[%1{*eq*$x
8o%TPr9}7Q
H%nOx"OP2XTz:CK
Mn\-:{Exp
X^XEB7JE;
ik~'k,'Akqi_
C` V=sTKDM-fcR0:
xPm8 HGN
Z} ozb
f#m`nudW
#.qPpP
1@&6$u
0|)MGv
;csosd
iApwp)P]
)la@9EpH
;}oA%`
m}E-rn
q"Xe,(<Vw
Y7U)y\5WtW
<A\E0G
|F zCR
9meZ1B
z?Okw8e5
SeO^y|
s*O_ Iz
?=U<eu"
7777777777;\;\;\;\;\7777777777/
XPXPXPXPXPXPXPXP/
zgzgzg/
777777777777777
777777777;\;\;\;\;\;\;\7777777777777777777777777/
XPXPXPXPXPXPXPXPXP/
zgzgzg/
77777777;\;\;\;\;\;\;\;\;\777777777777777777777777777777777777777/
XPXPXPXPXPXPXPXP/
zgzgzg/
7777777;\;\;\;\;\;\;\;\;\;\;\777777777777777777777777777777777777777777777XPXPXPXPXPXPXPXP/
zgzgzg/
7777777;\;\;\;\;\;\;\;\;\;\;\;\77777777777777777777777777777777777777777777XPXPXPXPXPXPXPXP777777777777777/
zgzgzg/
77777777;\;\;\;\;\;\;\;\;\;\;\;\7777777777777777777777777777777777777777777XPXPXPXPXPXPXPXP77777777777777777777777777pppp/
zgzgzgzg/
777777777;\;\;\;\;\;\;\;\;\;\;\;\777777777777777777777777777777777777777777XPXPXPXPXPXPXP777777777777777777777777pppppppp77777777ppppp7
zgzgzg/
7777777777;\;\;\;\;\;\;\;\;\;\;\;\77777777777777777777777777777777777777777XPXPXPXPXPXPXP7777777777777777777777pppppppppp7777
77p7777
7777zgzgzgzg7/
77777777777;\;\;\;\;\;\;\;\;\;\;\;\7777777777777777777777777777777777aaaaaa7ZVZVZVXPXPXPXPXP777777777777777777777pppppppppppp7
7777777
7777zgzgzg7777777777777777/
777777777777;\;\;\;\;\;\;\;\;\;\;\;\777777777777777777777777777777777aaaaaaZVZVZVZVZVZVZVZVZVZV77777777777777777ppppppppppppp
77777777
777777zgzgzg7777777777777777777777777777777
77777777777777;\;\;\;\;\;\;\;\;\;\;\77777777777777777777777777777777777ZVZVZVZVZVZVZVZVZVZVZVZVZV777777777777pppppppppppp
7777777
7777777777zgzgzg777777777777777777777777777777
777777777777777;\;\;\;\;\;\;\;\;\;\;\7777777777777777777777777777777777ZVZVZVZVZVZVZVZVZVZVZVZVZVZVZV77777777pppppppppp
7777777777777777777zgzgzg777777777777777777777777777777
7777777777777777;\;\;\;\;\;\;\;\;\;\;\77777777777777777777777777777777|ZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZV77pppppppppp
77777777777777777777zgzgzg77777777777777777777777777777
77777777777777777;\;\;\;\;\;\;\;\;\;\;\77777777777777777777777777777|
|ZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVppppppp
77777777777777777777zgzgzg77777777777777777777777777777
777777777777777777;\;\;\;\;\;\;\;\;\;\;\7777777777777777777777777|
|ZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVpppp
777777777777777777777777zgzgzg7777777777777777777777777777
7777777777777777777;\;\;\;\;\;\;\;\;\;\;\7777777777777777777777|
|ZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZV
777777777777777777777777777zgzgzg7777777777777777773g3g3g3g3g77777
77777777777777777777;\;\;\;\;\;\;\;\;\;\7777777777777777777|
|777ZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZV
777777777777777777777777777777zgzgzgzg777777777777773g3g3g3g3g3g3g3g3g7777
777777777777777777777;\;\;\;\;\;\;\;\;\7777777777777777777|
|aaaa777777ZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZV
7777777777777777777777777777777777zgzgzg777777777773g3g3g3g3g3g3g3g3g3g3g3g7777
7777777777777777777777;\;\;\;\;\;\;\;\7777777777777777777|
|77777777pppppZVZVZVZVZVZVZVZVZVZVZVZV
7777777777777777777777777777777777777zgzgzgzg7777773g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g777
77777777777777777777777;\;\;\;\;\;\;\777777777777|
|777777|
|777777777pppppppp77ZVZVZVZVZVZVZVZVZV77
777ZVZV777777777777777777777777777777777777zgzgzg7773g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g777
777777777777777777777777;\;\;\;\;\7777777777|
|77777|
|77777777pppppppppppp777ZVZVZVZVZVZV77777777ZVZVZVZVZVZV777777777777777777777777777777777zgzgzg3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g777
7777777777777777777777777777777777777|
|77777777777777ppppaappppppppp777ZVZVZVZVZVZV777777777ZVZVZVZVZVZVZVZV7777777777777777777777777777773g3gzgzgzg3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g777
7777777777777777777777777777777777|
|77777777777pppaaaaaaaapppppp77777777ZVZVZV777777777ZVZVZVZVZVZVZVZV7777777777777777777777777773g3g3g3g3gzgzgzg3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g7777
77777777777777777777777777777777|
|777777777ppppppaaaaaaaappppppp7777777777777777777ZVZVZVZVZVZVZVZVZV777777777777777777777773g3g3g3g3g3g3g3g3g3gzgzgzg3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g777777
Fy77777777777777777777777777777|
|777777777ppppppppaaaapppppp777777777777777777777ZVZVZVZVZVZVZVZV777777777ZV777777777773g3g3g3g3g3g3g3g3g3g3g3g3gzgzgzg3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g77777777
FyFy77777777777777777777777777777|
|7777777777pppppppppaaaaaappppp7777777777777777777777ZVZVZVZVZVZVZVZVZV777777777ZVZVZV7777773g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3gzgzgzgzg3g3g3g3g3g3g3g3g3g3g3g777777777777
FyFyFy7777777777777777777777|77777|
|7777777777pppppppppaaaaaaaappp7777777777777777777777777ZVZVZVZVZVZVZVZV77777777ZVZVZVZVZVZVZV3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3gzgzgzg3g3g3g3g3g3g3g3g777777777777777
FyFyFyFy777777777777777777|
|77777|
|777777777777pppppppppppaaaaaaaa7777777777777777777777777777777ZVZVZVZV777777777ZVZVZVZVZVZVZVZVZVZV3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3gzgzgzgzg3g3g3g7777777777777777777
FyFyFyFy7777777777777777|
|777777|77777777777777ppppppppppaaaaaaaa777777777777777777777777777777777ZVZV77777777ZVZVZVZVZVZVZVZVZVZVZVZVZVZV3g3g3g3g3g3g3g3g3g3g3g3g3g3g3gzgzgzg7777777777777777777777
FyFyFy77777777777777|
|77777777777777777pppppppppppppaaaaaaaaaa7777777777777777777777777777777777777773g3g3gZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZV3g3g3g3g3g3g3g3g3g3g3g3g3gzgzgzg7777777777777777777777
FyFyFy777777777777|
|77777777777777777ppppppppppp7777aaaaaaaa7777777777777777777777777777777777773g3g3g3g3g3gZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZV3g3g3g3g3g3g77777zgzgzg777777777777777777777
FyFy777777777777|
|77777777777777777ppppppppp777777aaaaaaaa7777777777777777777777777777777773g3g3g3g3g3g3g3gZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZV77777777zgzgzg777777777777777777777
Fy7777777777777|
|7777777777777777777777pppppp77777777aaaaaaaa777777777777777777777777777773g3g3g3g3g3g3g3g3g3g3g3g3g3gZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZV7777777zgzgzg77777777777777777777
77777777777777|
|7777777777777777777777777777777777777aaaaaaaa777777777777777777777777773g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3gZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZV7777777zgzgzg77777777777777777777
77777777777Fy777|
|777777777777777777777777777777777777777777aaaaaa777777777777777777777773g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3gZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZVZV77777777zgzgzg7777777777777777777
7777777777FyFyFy777777777777777777777777777777777777777777777777777777777777777777773g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3gZVZVZVZVZVZVZVZVZVZVZVZVZVZV777777777zgzgzg7777777777777777777
777777777FyFyFyFyFy777777777777777777777777777777777777777777777777777777777777777773g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g7777777ZVZVZVZVZVZVZVZVZVZVZV777777777zgzgzgzg777777777777777777
77777777FyFyFyFyFyFyFy7777777777777777777777777777777777777777777777777777777777773g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g7777777777777ZVZVZVZVZVZVZVZV77777777ZVZVzgzgzgZVZV7777777777777777
77777777FyFyFyFyFy777777777777777777777777777777777777777777777777777777777773g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g7777777777777777777ZVZVZVZV777777777ZVZVzgzgzgzgZVZV777777777777777
7777777FyFyFyFyFyFy77777777777777777777777777777777777777777777777777777773g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g7777777777777777777777777ZVZV77777777ZVZVZVZVzgzgzgZVZV777777777777777
777777FyFyFyFyFyFyFyFyFyFyFy777777777777777777777777777777777777777777777777773g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g7777777777777777777777777777777777ZVZVZVZVzgzgzgZVZV777777777777777
777777FyFyFyFyFyFyFyFyFyFyFyFyFyFy7777777777777777777777777777777777777777777773g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g777777777777777777777777777777777ZVZVZVZVZVzgzgzg777777777ZVZV77777
7777777FyFyFyFyFyFyFyFyFyFyFyFyFyFy777777777777777777777777777777777777777773g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g77777777777777777777777777777777777ZVZVZVZVZVZVzgzgzg77777777ZVZVZVZVZVZV77
77777777FyFyFyFyFyFyFyFyFyFyFyFyFyFy77777777777777777777777777777777777773g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g777777777777777777777777777777777777777ZVZVZVZVZVzgzgzg7777777ZVZVZVZVZVZVZVZV
7777777777FyFyFyFyFyFyFyFyFyFyFyFyFy777777777777777777777777777777773g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g77777777777777777777777777777777777777777777ZVZVzgzgzg7777777ZVZVZVZVZVZVZVZV
77777777777FyFyFyFyFyFyFyFyFyFyFyFyFy77777777777777777777777777xxxxxx3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g777777777777777777777777777777777777777777777777777zgzgzgzg77777ZVZVZVZVZVZVZVZVZV
777777777777FyFyFyFyFyFyFyFyFyFyFyFyFy777777777777777777777777xxxxxxxxxx3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g3g777777777777777777777777777777777777777777777777777777zgzgzg77777ZVZVZVZVZVZVZVZVZV
7777777777777FyFyFyFyFyFyFyFyFyFyFyFyFy77777777777777777773g3g3gxxxxxxxxxxx3g3g3g3g3g3g3gxxxxx3g3g3g3g3g3g77777777777777777777777777777777777777777777777777777777777zg777777ZVZVZVZVZVZVZVZVZV
77777777777FyFyFyFyFyFyFyFyFyFyFyFyFy7777777777777773g3g3g3g3g3gxxxxxxxxxxx3g3g3g3g3g3g3gxxxxxxx7777777777777777777777777777777777777777777777777777777777777777777777ZVZVZVZVZVZVZVZVZV
777FyFyFyFyFyFyFyFyFyFyFyFyFyFy77777777773g3g3g3g3g3g3g3g3gxxxxxxxxxx3g3g3g3g3g3g3g3gxxxxxxx7777777xxxxxx777777777777777777777777777777777777777777777777777777777777ZVZVZVZVZVZV
FyFyFyFyFyFyFyFyFyFyFyFyFyFy777773g3g3g3g3g3g3g3g3g3g3g3g3g3gxxxxxxxxx3g3g3g3g3g3g3gxxxxxxx77777777xxxxxxx7777777777777777777777777777777777777777777777777777777777777ZVZVZVZV
hQzIje(SV
~DR2QP
jITRD
~nEQ[n.RR
Xn]lUy@
~[ls~Bj4
F!_+X+Y8!7K.HxIwF\
[R;Kvey
_gi:RV
F bf"iiv-
luviRYy
^`ghfkm-
zHwKuLzIVU
~CBCB\kZn]i
C~~zIzM{FzHzHyKyKQV
~?A?DA@YnYmZh
zHzKyI{HxIzHRW
BDCB@^mWlYm
yGzHwIwGyHzF|GyKVU
VC~?B~CBCA@ZmYmYk[i
yI|G{JyHwH{IwHxI{JyGxKSX
CBASDAB@D\jZjZj[k\k[m
zJ|IzGxIvGyJyHxI*
~CCBBREAAZmZmZiZlZk[p^o\m
xG{LxJxHyJxI{H*
A@DCB?U
]n\jZl\i\m\h[n~
yIxEzF{LwH{I-
FAC@C@AA~S
~]n^nYk^oXlZl\l
xJxG{HyH)
[m[n[jYj]mZk[p
DDCFB~AB?D
V\l[m[lZkYk\i[m[k
EABCAC
QXk^j[j[j\nZm~
V\mXiYoZl]m[i
YkYlV]kYlZm
GzIyK{I
Yk]lS[k
D{JyFzKyHxI
EzFzEyFzHvJ|HyI
[kZo\j
EyFxJyKyIyKzJyGzJyJ
[mZlYj
HxHxIyL{J{J{JyHyI{JzGxI
Zm[nZm]m
D _]\RV
g{HzIyJyJ}KyHwI{HxJ|KwJvG
\n]l]m[o
kkzIxKyIwK{IwH{H-
~]m[lZm[j
D\^_VX
ilhzLyHzI+
]m[j]n
C ]__]SY
D_]\SX
jgiii-
iihgfh,
gkjhghh-
~kghghgiilm-
iijgjkimkgjhg'
kjhiijiiiijijikii
kijjiilehhkjigjhgh
E!]]]~
hlijffjififkjhiil
hgjkihiglgikigilk&'*)**-
hkjhjjijhjljkhheki~
hjkjjjghhkhjhljhj~,
gihikigjihiileif,
khijihighiigjk+
jjihgijkihighi+
hjlghiijkhjkhk)
jkjkjjgihhlgijh-
ijmjgkihjjglh
~miiihhekghk
lllikgkilg
ijklkkijk
jkikijgi
hjh3403//.0
1M1U1e1y1
111111Y233
787u88C99
:S:Z::::#;1;?;F;y;;-<===
7!757777777
8f8s8888
9$929H9y999;
<5<<<C<O<<<<
>>>>>>>>>
?!?+?0?B?L?m?w?~????????
0u000000000000
1)181=1s1{1111111111
2&2,222222
3$3)3G3X344444
595V555
6)626666666-7T7]7v77777778D8N8S888M9V9::
;;;;;;
<&<0<M<^<<<<<<<
=-=4=?=E=P=U=k=
===C>[>s>>>>>
*070g0m0u000000
1_1e1v111v222222F33
4666X7_7777
::I;G<l<<<<<<<<
=$=s=;>C>X>c>>>>>>>>
67888888
99999999
:!:(:,:0:4:8:<:@:D::::::
;,;3;8;<;@;a;;;;;;;;;;;*<0<4<8<<<<<<<<
=9=B=N======F>_>>>>???
00000F1
4S4z44444444q5
6j6666
7_7x777+889\:?<o<<<
>>>F>p?
0(0X0b0n0w000
4S45n7:::<
>&>v>|>>>>-?M?R?
1j111111111#2A2H2L2P2T2X2\2`2d222222&313L3S3X3\3`33333333333
4J4P4T4X4\44444
5$5N5\5b5555555556666
989=9L9U9b9m9
9999999999999
:$:*:8:?:D:M:Z:`:z::::
Z1e1m1111222
3[3n3|3333333333
4)404D4K4c4o4u4444444444444
5*5M5b555555
626X666677?7777777777777777
8#8(8.838B8X8c8h8s8x8888888888
9`9k9999
:,:9:E:U:\:k:w:::::::
;@;O;X;|;;;;;;!<x<<<<<
=L=|====
)0_0122^3m33344q555
66|8888Q9t99999
:;:K:]:b:::;
>>>>[?n??
23N5}55799999999999
:5:P:V:_:f::::
;";,;3;>;G;];h;;;;;;;
<2<7<B<G<e<
=#=@=w=======
>D>i>>>>>>)?????
v00000
1 1p1{1111T3e3m3s3x3~333
4(444A4H4
5,5;5@5a5f55555555
6{666B8S88888888
9'919D9h9999W:t::(;G;;;;;
</<H<d<m<s<|<<<<<<
="=N===s>>??
00'040;0k0
1y11B2
3U3h34555
6Q6W6c666#77777
828f8l8x88N999999
:E:S::::::::
<$<*<1<8<?<F<M<T<[<c<k<s<
<<<<<<<<<<<<<<
2"3@3R3d334444P5b5t5555557B8S8v::::::
;;;;%<I<<<k>>c?l???
0E00000
1@1O16
7777777777777777777
88#8'8+8/838A:J:_::H;M;_;};;;
<q<}<<
=:=[=g=====>>>>)????
0c11;2222
3C3r3+4>4O4t44444P5a555
6L6Z6c666
7$7L7~7779
:v::::::
>@>x>>>>>
</<B<M<x==
151;1J1P1_1e1s1|111111
2"2a2h2n2l3333333344
6W7,99993:=::
<\<<<<<
?!?/?7?D?b?l?u???????
1111112222
3'3U3333333
4%414;4E4O4Z4^4c4
111111111
5 5$5(5,5054585<5@5D5H5L5P5T5X5\5`5d5h5l5p5t5x5|555555555555555555555555555555555
666666666666666
7?????????????????
p0t0x0|0770>8>@>H>P>X>`>h>p>x>>>>>>>>>>>>>>>>>
? ?(?0?8?@?H?P?X?`?h?p?x?????????????????
0 0(00080@0H0P0X0`0h0p0x000000000000000666666666666666666
7 7$7(7,7074787<7@7D7H7L7P7T7X7\7`7d7h7l7p7t7x7|777777777777777777777777777777777
8 8$8(8,8084899999999999999
:$:(:<:@:P:T:\:t::::::::::::::
;$;(;0;H;X;\;l;p;t;x;|;;;;;;;;;;;;
<,<<<@<P<T<X<\<`<h<<<<<<<<<<<<<<<<<
=(=,=<=@=D=H=P=h=x=|============
> >$>(>,>0>4>8><>@>D>H>P>h>x>|>>>>>>>>>>>>>
?(?,?0?8?P?`?d?t?x?|????????????
0$0<0L0P0`0d0t0x0|00000000000
101111111111
2,242X2l2t2|22222222222222
303<3D3d33333333
4 4@4H4T4t4|444444444444
5,545@5x555555
6 6@6`6l6x66666666
787@7D7\7`7|7777777777
888D8`8l88888888
9(9H9h999999
:$:(:D:H:h:::::::
;8;X;x;;
484T4t4444
5@5|555
6`6666
7<7D7H7h7777
848D8H8T8X8\8|80;8;>>>
?$?,?4?<?D?L?T?\?d?l?t?|????????
3P5`5p5555555555555555555
6 6$6(6,6064686<6@6D6H6L6P6T6X6\6`6d6h6l6p6t6x6|66666666666666666666
MTU7MTU=
jjjjjj
@I@@@@@
bilonoziwovaze
fabofavisefunotudovozawesojimeta sujinefegecipanoluyifozo
kernel32.dll
((((( H
h(((( H
H
KERNEL32.DLL
E(null)
mscoree.dll
AAAAAAAAA
AAAAAAAAAAAAA
AAAAAA
PQDPDSFKC
3Ho hicefogavoha zobuguku wuti kefeva sukena hewe ho
Rebegivi nena sabugakuku ceha
Wuyelepenada
Vibibozuve
)Pigudi sirabuzogasoji sorizose xaboneramu
Tubatarikiya havixu
/Xacojofodagolu hitokiho nizezigesojevi lohamocu6Lisozaze lo puguyewotune dobeduhixotiwi rozacoyemibati
BVemariwi kujinuce wuzazaludavako fafahofecuzalo cito tebo sinimuse
'Navajigo yuporidukafera hodoma femiroci
FZojikilova xarujufurode huha movetoke tumo difejigefasoza moluyugihepi
WCivehopowegigo reri vekekarisarugi nilevusubo naxiwiyovizice sehizu jizayoni zinukisihi
Yocicenehozogo lehejosazo
EFefopiwo zemogi gaxujazajiyani voxazowiwayepa xo liwuropiye nazi zofo
SBazu kilajatovi tacofugora koja tobu yu koxuhirurena gepuxa kenihifezace silotamomo
*Yonice mibehaha se pawudehuku sidadagarate
sKelizedoxi rivixavizoze safacanemafi cavere nixadatebicofu tiwefogucu bohexu viyicayane moyicehijetu dexicawomutega
!Negijugudane pikoti godimuwu socu
SXafixobamoye vetizababa gewoxodocesa pajayeyazede xisudoyomuhosa degu mo fipasicajo
GDu remefulebiti nekatixeba lewufe vujoka gomihacice yeye vaxudizerafasu[Koxosize vekececu dixetixake hereseye taso horabenu sereva takeneva gumegedagupe galeheruwa
ZDupadocatuzu muruyajehu zikafupodecigo sasetidiyojeyu xami lodedo nekuti guyiloyojimi deta
DBofexeme dapiposije pafina radolonumuwi witoweporeje zalefewuxa muxe
ZYupiha loxudeli hebomiwa rotijaxosuhevo yecamibezi vehu duninexawuvofa pexawixusuka zerera
APucaje tutolorube womape boka zu migesa kukixoyefepuwa hujecugetu
Jelefuwa hokenonohu
Go rozotahujami jurukukiyi
1Rajuhojo ji nupucayiruredo pofoxo bani jodirivufeCRogatidifevice zakowukewofeja vehe bajigivihazi fuya cizo gizanu gi
UZaletexirubo doxuyebudamo zigohaxa fazenevidiza ho kaledeticego dacegu dohakomojeweho
Wucetumagike
QWumi putedimabozo deseyilemeje vuxoti pufi teyiya peli tayazuke sijavobo hisabiyo
:Yokezaniboruki kekimuxurupo vo jurotavugo yiyiyugo se kado
'Bupuyobumete lawefibu diwuzahibeliga ca
0Nitufa totovohewi mipuzigovu joziluwiba duyoxiti
)Rifizaki xuhikati pucaxegeca vapubaxaxihi
^Sawewecarixa gevire huhusezoyifuwu pivizimaja kacana luhibuzo lufaforafodu jugi foyunicekinobe
DBujojuka lolijo gagu lucu rukeyu royupohevelivu dubiyuyina xode yado
Yijomo
oRidimarijoyane yevetuwipufebe dopiyocomu jiyezejosusu timevuma vizasehapezo fogijuxonucose gogi libo bixayogaci
-Wimiduvitanami rogi funohabuzono vitekicolese
Conale seyimuca yedupoxi
Darejaxulada
#Tajovowotaxayu lawuzejuvine hisi vi
Neku cedo lape
uDubojirehe betajedara guluyodawo huracuremaxojo sewumajamepozo terame xizosimakeluxe puvemira zelerinekabati gisojero
?Bifuzi da gososepu dahemeli buze vahilipezipaxu rotoco mupekofe
Rozuhi furajodacirari civupo1Jezoto lupasisuli murime jozuzuyuwa kocapava yifi
4Wicewecotuwi jaharo rajucozibuba jocejedamacavi yeyo
FKuyile tozoyi hebezobuwuciwu doca duferojude woceko dikici supi zipika
3Payacucipi wetewa va salogejuxo sidijoharuxayo gora
Talasuyidofe
JHajedumiyabeda seyeru xiyeho xidecekaje gexozayagopegi yutusu wofobolikuhu
Cu gagahufise
Xihulo nexeso damerurela
!Vileraluwafu jojoxaru kulura zapu
WRebiguhe yihemesuju keyupocunucipo jafiyayama pinoneba zahinojago hoxoga mekixitunodole
3No gifakekuhoniva sowo mazaji tezapu vayitolohureje
Pezesokaxovova hote
0Riso vuhihiculi coya miyobewijaye rosororerojufe
/Gidipo kafusucojaxi fo gu jeyitabe mojeyuzebazo
9Gobukire de xuvu wajeyowujovu tuzudiposuxe zoyirudipufopi
JTiyiwifuvuda mo nixuxaho toguboxisitofi jivahimadaxuco hecavulila doxunapi
&Mayuzutedoraju xejilizuyowi jufebodoyi
QCo wenodipe cecidu juciye xawekozarixe cufa zuko fatepaxudoca gigi yovekesodoxofe
:Hanudiwutogo gidifego ribiwixelozo povuzevokubo munavepoxa
.Dapobu wonayaru tape rarupi xoyo wahu lepokiku
XZacacu dicu zodanecololaru malivuzawuju kigisunudoxefe sepe xuje rivugelavome jucalowoxu
Tonipi ho wusocegutosixu
MDiwuzemikevaso hirova copisagi bepisatoxiwuca tojo sutuyado le zosiwayuhumuniEBuyubepi jepapu hasovocoxuva zegesucidulasa bahoho megevu laheloye ho
KNa toduhokejeka yilakadoli powelilebaxupe wu rixazonanotale febuha fucayepe
-Vugo sugugozebe jegi kivejo xegafu vemidaxazi
Ci du la dipibawe sacava
'Kula tebuto hutejijobodugo rekosorecuso
CMitoku waciti xahalu xulugezeloka xefamolaliye vexefaki wobeko yete
)Matevakuvokogu miwubotahutu co zamevijiha
Vu tusi bebici xidu sawericeciza
$Sula rulega fe fojixejalugivo cifawi
eMaxusunutave cehenube puhu guwuje jixafupacelu nuyifuno gaceboracoyenu saluwahozepu mojuho gorunufiguNCosugo balixiwezo pizusumo kotucawozibi yuhureno suxipamenupona garozu ka foto
7Zavu yubokejuniku dihubekopuka folozepiyi waya yehacube
5Bu suyiyofakita wevi leretixahawera luzujice howodizo
"Ribewivojohiki noniwohela gobajira
Nimu pezu moti bopinecesaxi
2Hoxucojanuka zahaviwexepeni wanegiki cu dosoyihuru
0Samizeza homasowaku zukakupi kikumujagubo lagijo
Jigudesu
OLubulico ki bageguzo vewanaveto gisada yarojohefa jagomate ca wijatazepu redunegRabemebo pobozeharupu yucitefuvuku yidedi yejuyi wadu toxazepayuwe nesihuhosicefu lecuzidatobojo seyatu
Caxubo fose
WYa deyafipiha ja bo norexokeneveki vubakivekesa xulu civavuhufiraze pibomigifuzihu hike
/Kujakaco zazususezebo nulise tu sidafohixeka ho

Process Tree

0deb3441dd125dfcccae7bc58f52f56ceb63abf6c1173c8390c7826301473de5.exe, PID: 1784, Parent PID: 2264

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2656, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2444, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2452, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2024, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 1884, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 1828, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 848, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2592, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2540, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2576, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 1280, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2720, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2352, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2188, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2256, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2948, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2708, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 1600, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 1496, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 1012, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2512, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2508, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2304, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2008, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2772, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2900, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 888, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 1064, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 1972, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 1836, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2480, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 332, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2712, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2412, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2280, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 3068, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 844, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 1384, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 1324, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 1844, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 1196, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2808, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2404, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2764, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2448, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2124, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 316, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2920, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 1200, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2600, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 900, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 1756, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 1528, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2932, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 936, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2084, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 312, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 1056, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2980, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 1404, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 1956, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 972, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2128, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2812, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 1136, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2624, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2952, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2116, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2460, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2160, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2956, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2972, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 1144, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2296, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 3088, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 3152, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 3216, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 3280, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 3344, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 3408, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 3472, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 3536, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

DNS

Name Response Post-Analysis Lookup
dns.msftncsi.com A 131.107.255.255
A 131.107.255.255 		131.107.255.255
dns.msftncsi.com AAAA fd3e:4f5a:5b81::1 131.107.255.255
ipv4bot.whatismyipaddress.com
ns1.corp-servers.ru
114.114.114.114.in-addr.arpa PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
PTR public1.114dns.com
zonealarm.bit
zonealarm.bit
ns2.corp-servers.ru
ransomware.bit
ransomware.bit

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 61714 8.8.8.8 53
192.168.56.101 56933 8.8.8.8 53
192.168.56.101 138 192.168.56.255 138
192.168.56.101 58485 114.114.114.114 53
192.168.56.101 58485 8.8.8.8 53
192.168.56.101 57665 114.114.114.114 53
192.168.56.101 51758 114.114.114.114 53
192.168.56.101 52215 114.114.114.114 53
192.168.56.101 52216 114.114.114.114 53
192.168.56.101 52217 114.114.114.114 53
192.168.56.101 52218 114.114.114.114 53
192.168.56.101 52219 114.114.114.114 53
192.168.56.101 52220 114.114.114.114 53
192.168.56.101 62361 114.114.114.114 53
192.168.56.101 62361 8.8.8.8 53
192.168.56.101 62362 114.114.114.114 53
192.168.56.101 62363 114.114.114.114 53
192.168.56.101 62364 114.114.114.114 53
192.168.56.101 62365 114.114.114.114 53
192.168.56.101 62366 114.114.114.114 53
192.168.56.101 62367 114.114.114.114 53
192.168.56.101 62368 114.114.114.114 53
192.168.56.101 62369 114.114.114.114 53
192.168.56.101 62370 114.114.114.114 53
192.168.56.101 62371 114.114.114.114 53
192.168.56.101 62372 114.114.114.114 53
192.168.56.101 62373 114.114.114.114 53
192.168.56.101 62374 114.114.114.114 53
192.168.56.101 62375 114.114.114.114 53
192.168.56.101 62376 114.114.114.114 53
192.168.56.101 62377 114.114.114.114 53
192.168.56.101 62378 114.114.114.114 53
192.168.56.101 62379 114.114.114.114 53
192.168.56.101 62380 114.114.114.114 53
192.168.56.101 62381 114.114.114.114 53
192.168.56.101 62382 114.114.114.114 53
192.168.56.101 62383 114.114.114.114 53
192.168.56.101 62384 114.114.114.114 53
192.168.56.101 62385 114.114.114.114 53
192.168.56.101 62386 114.114.114.114 53
192.168.56.101 62387 114.114.114.114 53
192.168.56.101 62388 114.114.114.114 53
192.168.56.101 62389 114.114.114.114 53
192.168.56.101 62390 114.114.114.114 53
192.168.56.101 62391 114.114.114.114 53
192.168.56.101 62392 114.114.114.114 53
192.168.56.101 62393 114.114.114.114 53
192.168.56.101 62394 114.114.114.114 53
192.168.56.101 62395 114.114.114.114 53
192.168.56.101 62396 114.114.114.114 53
192.168.56.101 62397 114.114.114.114 53
192.168.56.101 62398 114.114.114.114 53
192.168.56.101 62399 114.114.114.114 53
192.168.56.101 62400 114.114.114.114 53
192.168.56.101 62401 114.114.114.114 53
192.168.56.101 62402 114.114.114.114 53
192.168.56.101 62403 114.114.114.114 53
192.168.56.101 62404 114.114.114.114 53
192.168.56.101 62405 114.114.114.114 53
192.168.56.101 62406 114.114.114.114 53
192.168.56.101 62407 114.114.114.114 53
192.168.56.101 62408 114.114.114.114 53
192.168.56.101 62409 114.114.114.114 53
192.168.56.101 62410 114.114.114.114 53
192.168.56.101 62411 114.114.114.114 53
192.168.56.101 62412 114.114.114.114 53
192.168.56.101 62413 114.114.114.114 53
192.168.56.101 62414 114.114.114.114 53
192.168.56.101 62415 114.114.114.114 53
192.168.56.101 62416 114.114.114.114 53
192.168.56.101 62417 114.114.114.114 53
192.168.56.101 62418 114.114.114.114 53
192.168.56.101 62419 114.114.114.114 53
192.168.56.101 62420 114.114.114.114 53
192.168.56.101 62421 114.114.114.114 53
192.168.56.101 62422 114.114.114.114 53
192.168.56.101 62423 114.114.114.114 53
192.168.56.101 62424 114.114.114.114 53
192.168.56.101 62425 114.114.114.114 53
192.168.56.101 62426 114.114.114.114 53
192.168.56.101 62427 114.114.114.114 53
192.168.56.101 62428 114.114.114.114 53
192.168.56.101 62429 114.114.114.114 53
192.168.56.101 62430 114.114.114.114 53
192.168.56.101 62431 114.114.114.114 53
192.168.56.101 62432 114.114.114.114 53
192.168.56.101 62433 114.114.114.114 53
192.168.56.101 62434 114.114.114.114 53
192.168.56.101 62435 114.114.114.114 53
192.168.56.101 62436 114.114.114.114 53
192.168.56.101 62437 114.114.114.114 53
192.168.56.101 62438 114.114.114.114 53
192.168.56.101 62439 114.114.114.114 53
192.168.56.101 62440 114.114.114.114 53
192.168.56.101 62441 114.114.114.114 53
192.168.56.101 62442 114.114.114.114 53
192.168.56.101 62443 114.114.114.114 53
192.168.56.101 62444 114.114.114.114 53
192.168.56.101 62445 114.114.114.114 53
192.168.56.101 62446 114.114.114.114 53
192.168.56.101 62447 114.114.114.114 53
192.168.56.101 62448 114.114.114.114 53
192.168.56.101 62449 114.114.114.114 53
192.168.56.101 62450 114.114.114.114 53
192.168.56.101 62451 114.114.114.114 53
192.168.56.101 62452 114.114.114.114 53
192.168.56.101 62453 114.114.114.114 53
192.168.56.101 62454 114.114.114.114 53
192.168.56.101 62455 114.114.114.114 53
192.168.56.101 62456 114.114.114.114 53
192.168.56.101 62457 114.114.114.114 53
192.168.56.101 62458 114.114.114.114 53
192.168.56.101 62459 114.114.114.114 53
192.168.56.101 62460 114.114.114.114 53
192.168.56.101 62461 114.114.114.114 53
192.168.56.101 62462 114.114.114.114 53
192.168.56.101 62463 114.114.114.114 53
192.168.56.101 62464 114.114.114.114 53
192.168.56.101 62465 114.114.114.114 53
192.168.56.101 62466 114.114.114.114 53
192.168.56.101 62467 114.114.114.114 53
192.168.56.101 62468 114.114.114.114 53
192.168.56.101 62469 114.114.114.114 53
192.168.56.101 62470 114.114.114.114 53
192.168.56.101 62471 114.114.114.114 53
192.168.56.101 62472 114.114.114.114 53
192.168.56.101 62473 114.114.114.114 53
192.168.56.101 62474 114.114.114.114 53
192.168.56.101 62475 114.114.114.114 53
192.168.56.101 62476 114.114.114.114 53
192.168.56.101 62477 114.114.114.114 53
192.168.56.101 62478 114.114.114.114 53
192.168.56.101 62479 114.114.114.114 53
192.168.56.101 62480 114.114.114.114 53
192.168.56.101 62481 114.114.114.114 53
192.168.56.101 62482 114.114.114.114 53
192.168.56.101 62483 114.114.114.114 53
192.168.56.101 62484 114.114.114.114 53
192.168.56.101 62485 114.114.114.114 53
192.168.56.101 62486 114.114.114.114 53
192.168.56.101 62487 114.114.114.114 53
192.168.56.101 62488 114.114.114.114 53
192.168.56.101 62489 114.114.114.114 53
192.168.56.101 62490 114.114.114.114 53
192.168.56.101 62491 114.114.114.114 53
192.168.56.101 62492 114.114.114.114 53
192.168.56.101 62493 114.114.114.114 53
192.168.56.101 62494 114.114.114.114 53
192.168.56.101 62495 114.114.114.114 53
192.168.56.101 62496 114.114.114.114 53
192.168.56.101 62497 114.114.114.114 53
192.168.56.101 62498 114.114.114.114 53
192.168.56.101 62499 114.114.114.114 53
192.168.56.101 62500 114.114.114.114 53
192.168.56.101 62501 114.114.114.114 53
192.168.56.101 62502 114.114.114.114 53
192.168.56.101 62503 114.114.114.114 53
192.168.56.101 62504 114.114.114.114 53
192.168.56.101 62505 114.114.114.114 53
192.168.56.101 62506 114.114.114.114 53
192.168.56.101 62507 114.114.114.114 53
192.168.56.101 62508 114.114.114.114 53
192.168.56.101 62509 114.114.114.114 53
192.168.56.101 62510 114.114.114.114 53
192.168.56.101 62511 114.114.114.114 53
192.168.56.101 62512 114.114.114.114 53
192.168.56.101 62513 114.114.114.114 53
192.168.56.101 62514 114.114.114.114 53
192.168.56.101 62515 114.114.114.114 53
192.168.56.101 62516 114.114.114.114 53
192.168.56.101 62517 114.114.114.114 53
192.168.56.101 62518 114.114.114.114 53
192.168.56.101 62519 114.114.114.114 53
192.168.56.101 62520 114.114.114.114 53
192.168.56.101 62521 114.114.114.114 53
192.168.56.101 62522 114.114.114.114 53
192.168.56.101 62523 114.114.114.114 53
192.168.56.101 62524 114.114.114.114 53
192.168.56.101 62525 114.114.114.114 53
192.168.56.101 62526 114.114.114.114 53
192.168.56.101 62527 114.114.114.114 53
192.168.56.101 62528 114.114.114.114 53
192.168.56.101 62529 114.114.114.114 53
192.168.56.101 62530 114.114.114.114 53
192.168.56.101 62531 114.114.114.114 53
192.168.56.101 62532 114.114.114.114 53
192.168.56.101 62533 114.114.114.114 53
192.168.56.101 62534 114.114.114.114 53
192.168.56.101 62535 114.114.114.114 53
192.168.56.101 62536 114.114.114.114 53
192.168.56.101 62537 114.114.114.114 53
192.168.56.101 62538 114.114.114.114 53
192.168.56.101 62539 114.114.114.114 53
192.168.56.101 62540 114.114.114.114 53
192.168.56.101 62541 114.114.114.114 53
192.168.56.101 62542 114.114.114.114 53
192.168.56.101 62543 114.114.114.114 53
192.168.56.101 62544 114.114.114.114 53
192.168.56.101 62545 114.114.114.114 53
192.168.56.101 62546 114.114.114.114 53
192.168.56.101 62547 114.114.114.114 53
192.168.56.101 62548 114.114.114.114 53
192.168.56.101 62549 114.114.114.114 53
192.168.56.101 62550 114.114.114.114 53
192.168.56.101 62551 114.114.114.114 53
192.168.56.101 62552 114.114.114.114 53
192.168.56.101 62553 114.114.114.114 53
192.168.56.101 62554 114.114.114.114 53
192.168.56.101 62555 114.114.114.114 53
192.168.56.101 62556 114.114.114.114 53
192.168.56.101 62557 114.114.114.114 53
192.168.56.101 62558 114.114.114.114 53
192.168.56.101 62559 114.114.114.114 53
192.168.56.101 62560 114.114.114.114 53
192.168.56.101 62561 114.114.114.114 53
192.168.56.101 62562 114.114.114.114 53
192.168.56.101 62563 114.114.114.114 53
192.168.56.101 62564 114.114.114.114 53
192.168.56.101 62565 114.114.114.114 53
192.168.56.101 62566 114.114.114.114 53
192.168.56.101 62567 114.114.114.114 53
192.168.56.101 62568 114.114.114.114 53
192.168.56.101 62569 114.114.114.114 53
192.168.56.101 62570 114.114.114.114 53
192.168.56.101 62571 114.114.114.114 53
192.168.56.101 62572 114.114.114.114 53
192.168.56.101 62573 114.114.114.114 53
192.168.56.101 62574 114.114.114.114 53
192.168.56.101 62575 114.114.114.114 53
192.168.56.101 62576 114.114.114.114 53
192.168.56.101 62577 114.114.114.114 53
192.168.56.101 62578 114.114.114.114 53
192.168.56.101 62579 114.114.114.114 53
192.168.56.101 62580 114.114.114.114 53
192.168.56.101 62581 114.114.114.114 53
192.168.56.101 62582 114.114.114.114 53
192.168.56.101 62583 114.114.114.114 53
192.168.56.101 62584 114.114.114.114 53
192.168.56.101 62585 114.114.114.114 53
192.168.56.101 62586 114.114.114.114 53
192.168.56.101 62587 114.114.114.114 53
192.168.56.101 62588 114.114.114.114 53
192.168.56.101 62589 114.114.114.114 53
192.168.56.101 62590 114.114.114.114 53
192.168.56.101 62591 114.114.114.114 53
192.168.56.101 62592 114.114.114.114 53
192.168.56.101 62593 114.114.114.114 53
192.168.56.101 62594 114.114.114.114 53
192.168.56.101 62595 114.114.114.114 53
192.168.56.101 62596 114.114.114.114 53
192.168.56.101 62597 114.114.114.114 53
192.168.56.101 62598 114.114.114.114 53
192.168.56.101 62599 114.114.114.114 53
192.168.56.101 62600 114.114.114.114 53
192.168.56.101 62601 114.114.114.114 53
192.168.56.101 62602 114.114.114.114 53
192.168.56.101 62603 114.114.114.114 53
192.168.56.101 62604 114.114.114.114 53
192.168.56.101 62605 114.114.114.114 53
192.168.56.101 62606 114.114.114.114 53
192.168.56.101 62607 114.114.114.114 53
192.168.56.101 62608 114.114.114.114 53
192.168.56.101 62609 114.114.114.114 53
192.168.56.101 62610 114.114.114.114 53
192.168.56.101 62611 114.114.114.114 53
192.168.56.101 62612 114.114.114.114 53
192.168.56.101 62613 114.114.114.114 53
192.168.56.101 62614 114.114.114.114 53
192.168.56.101 62615 114.114.114.114 53
192.168.56.101 62616 114.114.114.114 53
192.168.56.101 62617 114.114.114.114 53
192.168.56.101 62618 114.114.114.114 53
192.168.56.101 62619 114.114.114.114 53
192.168.56.101 62620 114.114.114.114 53
192.168.56.101 62621 114.114.114.114 53
192.168.56.101 62622 114.114.114.114 53
192.168.56.101 62623 114.114.114.114 53
192.168.56.101 62624 114.114.114.114 53
192.168.56.101 62625 114.114.114.114 53
192.168.56.101 62626 114.114.114.114 53
192.168.56.101 62627 114.114.114.114 53
192.168.56.101 62628 114.114.114.114 53
192.168.56.101 62629 114.114.114.114 53
192.168.56.101 62630 114.114.114.114 53
192.168.56.101 62631 114.114.114.114 53
192.168.56.101 62632 114.114.114.114 53
192.168.56.101 62633 114.114.114.114 53
192.168.56.101 62634 114.114.114.114 53
192.168.56.101 62635 114.114.114.114 53
192.168.56.101 62636 114.114.114.114 53
192.168.56.101 62637 114.114.114.114 53
192.168.56.101 62638 114.114.114.114 53
192.168.56.101 62639 114.114.114.114 53
192.168.56.101 62640 114.114.114.114 53
192.168.56.101 62641 114.114.114.114 53
192.168.56.101 62642 114.114.114.114 53
192.168.56.101 62643 114.114.114.114 53
192.168.56.101 62644 114.114.114.114 53
192.168.56.101 62645 114.114.114.114 53
192.168.56.101 62646 114.114.114.114 53
192.168.56.101 62647 114.114.114.114 53
192.168.56.101 62648 114.114.114.114 53
192.168.56.101 62649 114.114.114.114 53
192.168.56.101 62650 114.114.114.114 53
192.168.56.101 62651 114.114.114.114 53
192.168.56.101 62652 114.114.114.114 53
192.168.56.101 62653 114.114.114.114 53
192.168.56.101 62654 114.114.114.114 53
192.168.56.101 62655 114.114.114.114 53
192.168.56.101 62656 114.114.114.114 53
192.168.56.101 62657 114.114.114.114 53
192.168.56.101 62658 114.114.114.114 53
192.168.56.101 62659 114.114.114.114 53
192.168.56.101 62660 114.114.114.114 53
192.168.56.101 62661 114.114.114.114 53
192.168.56.101 62662 114.114.114.114 53
192.168.56.101 62663 114.114.114.114 53
192.168.56.101 62664 114.114.114.114 53
192.168.56.101 62665 114.114.114.114 53
192.168.56.101 62666 114.114.114.114 53
192.168.56.101 62667 114.114.114.114 53
192.168.56.101 62668 114.114.114.114 53
192.168.56.101 62669 114.114.114.114 53
192.168.56.101 62670 114.114.114.114 53
192.168.56.101 62671 114.114.114.114 53
192.168.56.101 62672 114.114.114.114 53
192.168.56.101 62673 114.114.114.114 53
192.168.56.101 62674 114.114.114.114 53
192.168.56.101 62675 114.114.114.114 53
192.168.56.101 62676 114.114.114.114 53
192.168.56.101 62677 114.114.114.114 53
192.168.56.101 62678 114.114.114.114 53
192.168.56.101 62679 114.114.114.114 53
192.168.56.101 62680 114.114.114.114 53
192.168.56.101 62681 114.114.114.114 53
192.168.56.101 62682 114.114.114.114 53
192.168.56.101 62683 114.114.114.114 53
192.168.56.101 62684 114.114.114.114 53
192.168.56.101 62685 114.114.114.114 53
192.168.56.101 62686 114.114.114.114 53
192.168.56.101 62687 114.114.114.114 53
192.168.56.101 62688 114.114.114.114 53
192.168.56.101 62689 114.114.114.114 53
192.168.56.101 62690 114.114.114.114 53
192.168.56.101 62691 114.114.114.114 53
192.168.56.101 62692 114.114.114.114 53
192.168.56.101 62693 114.114.114.114 53
192.168.56.101 62694 114.114.114.114 53
192.168.56.101 62695 114.114.114.114 53
192.168.56.101 62696 114.114.114.114 53
192.168.56.101 62697 114.114.114.114 53
192.168.56.101 62698 114.114.114.114 53
192.168.56.101 62699 114.114.114.114 53
192.168.56.101 62700 114.114.114.114 53
192.168.56.101 62701 114.114.114.114 53
192.168.56.101 62702 114.114.114.114 53
192.168.56.101 62703 114.114.114.114 53
192.168.56.101 62704 114.114.114.114 53
192.168.56.101 62705 114.114.114.114 53
192.168.56.101 62706 114.114.114.114 53
192.168.56.101 62707 114.114.114.114 53
192.168.56.101 62708 114.114.114.114 53
192.168.56.101 62709 114.114.114.114 53
192.168.56.101 62710 114.114.114.114 53
192.168.56.101 62711 114.114.114.114 53
192.168.56.101 62712 114.114.114.114 53
192.168.56.101 62713 114.114.114.114 53
192.168.56.101 62714 114.114.114.114 53
192.168.56.101 62715 114.114.114.114 53
192.168.56.101 62716 114.114.114.114 53
192.168.56.101 62717 114.114.114.114 53
192.168.56.101 62718 114.114.114.114 53
192.168.56.101 62719 114.114.114.114 53
192.168.56.101 62720 114.114.114.114 53
192.168.56.101 62721 114.114.114.114 53
192.168.56.101 62722 114.114.114.114 53
192.168.56.101 62723 114.114.114.114 53
192.168.56.101 62724 114.114.114.114 53
192.168.56.101 62725 114.114.114.114 53
192.168.56.101 62726 114.114.114.114 53
192.168.56.101 62727 114.114.114.114 53
192.168.56.101 62728 114.114.114.114 53
192.168.56.101 62729 114.114.114.114 53
192.168.56.101 62730 114.114.114.114 53
192.168.56.101 62731 114.114.114.114 53
192.168.56.101 62732 114.114.114.114 53
192.168.56.101 62733 114.114.114.114 53
192.168.56.101 62734 114.114.114.114 53
192.168.56.101 62735 114.114.114.114 53
192.168.56.101 62736 114.114.114.114 53
192.168.56.101 62737 114.114.114.114 53
192.168.56.101 62738 114.114.114.114 53
192.168.56.101 62739 114.114.114.114 53
192.168.56.101 62740 114.114.114.114 53
192.168.56.101 62741 114.114.114.114 53
192.168.56.101 62742 114.114.114.114 53
192.168.56.101 62743 114.114.114.114 53
192.168.56.101 62744 114.114.114.114 53
192.168.56.101 62745 114.114.114.114 53
192.168.56.101 62746 114.114.114.114 53
192.168.56.101 62747 114.114.114.114 53
192.168.56.101 62748 114.114.114.114 53
192.168.56.101 62749 114.114.114.114 53
192.168.56.101 62750 114.114.114.114 53
192.168.56.101 62751 114.114.114.114 53
192.168.56.101 62752 114.114.114.114 53
192.168.56.101 62753 114.114.114.114 53
192.168.56.101 62754 114.114.114.114 53
192.168.56.101 62755 114.114.114.114 53
192.168.56.101 62756 114.114.114.114 53
192.168.56.101 62757 114.114.114.114 53
192.168.56.101 62758 114.114.114.114 53
192.168.56.101 62759 114.114.114.114 53
192.168.56.101 62760 114.114.114.114 53
192.168.56.101 62761 114.114.114.114 53
192.168.56.101 62762 114.114.114.114 53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Name 6d33a55bfbcab9c6_klqlwt.exe
Filepath C:\Users\Administrator\AppData\Roaming\Microsoft\klqlwt.exe
Size 276.0KB
Processes 1784 (0deb3441dd125dfcccae7bc58f52f56ceb63abf6c1173c8390c7826301473de5.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 20b9556bc396611db6132037982aa42c
SHA1 233bd7e072af1f8566d6390032c07347486b77a8
SHA256 6d33a55bfbcab9c6f6c56be02958ebf54e955973cb0623a0d04cda1fa2072084
CRC32 44552840
ssdeep None
Yara None matched
VirusTotal Search for analysis
Sorry! No dropped buffers.