2.8
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.80
MFGraph
0.00
反病毒引擎
未检测
暂无反病毒引擎检测结果
静态指标
查询计算机名称
(1 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545301.46925 GetComputerNameW |
computer_name:
TU-PC
|
success | 1 | 0 |
检查进程是否被调试器调试
(1 个事件)
使用Windows API生成加密密钥
(3 个事件)
检查系统中的内存量，这可以用于检测可用内存较少的虚拟机
(4 个事件)
文件包含未知的 PE 资源名称，可能指示打包器
(6 个事件)
| resource name | DESUHANUDIWUTOGOGIDIFE |
| resource name | TAFEPIJIWAGEKUWIZUMEDELO |
| resource name | TIXEBALEWUFEVUJOKA |
| resource name | XEPUVEMIRAZELERINEKA |
| resource name | XNNTTI |
| resource name | ZACACUDICUZODANECO |
动态指标
分配可读-可写-可执行内存（通常用于自解压）
(21 个事件)
查询磁盘大小，可用于检测具有小固定大小或动态分配的虚拟机
(1 个事件)
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Roaming\Microsoft\amzsuf.exe |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Roaming\Microsoft\amzsuf.exe |
检查适配器地址以检测虚拟网络接口
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545301.73425 GetAdaptersAddresses |
family:
0
flags: 0 |
failed | 111 | 0 |
|
1727545301.73425 GetAdaptersAddresses |
family:
0
flags: 0 |
success | 0 | 0 |
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(2 个事件)
| section | {'name': '.rsrc', 'virtual_address': '0x0001f000', 'virtual_size': '0x00022d94', 'size_of_data': '0x00022e00', 'entropy': 7.79873592162376} | entropy | 7.79873592162376 | description | 发现高熵的节 | |||||||||
| entropy | 0.5613682092555332 | description | 此PE文件的整体熵值较高 | |||||||||||
使用 Windows 工具进行基本 Windows 功能
(4 个事件)
| cmdline | nslookup ransomware.bit ns2.wowservers.ru |
| cmdline | nslookup carder.bit ns2.wowservers.ru |
| cmdline | nslookup carder.bit ns1.wowservers.ru |
| cmdline | nslookup ransomware.bit ns1.wowservers.ru |
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
检查 Windows 空闲时间以确定运行时间
(50 out of 152901 个事件)
在 Windows 启动时自我安装以实现自动运行
(1 个事件)
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\okbvctezeey | reg_value | "C:\Users\Administrator\AppData\Roaming\Microsoft\amzsuf.exe" | ||||||
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2018-06-22 18:16:18
PE Imphash
684ba7ed417885624fcdc51d03dac35b
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x000118d1 | 0x00011a00 | 6.699412647990477 |
| .rdata | 0x00013000 | 0x0000644e | 0x00006600 | 5.834718195033655 |
| .data | 0x0001a000 | 0x00004680 | 0x00001800 | 4.124956135229881 |
| .rsrc | 0x0001f000 | 0x00022d94 | 0x00022e00 | 7.79873592162376 |
| .reloc | 0x00042000 | 0x00001b56 | 0x00001c00 | 4.948013565568661 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| DESUHANUDIWUTOGOGIDIFE | 0x0001f394 | 0x0000019d | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| TAFEPIJIWAGEKUWIZUMEDELO | 0x0001f534 | 0x000002d4 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| TIXEBALEWUFEVUJOKA | 0x0001f808 | 0x00000070 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| XEPUVEMIRAZELERINEKA | 0x0001f878 | 0x00000163 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| XNNTTI | 0x0001f9dc | 0x0001a728 | LANG_DANISH | SUBLANG_DEFAULT | None |
| ZACACUDICUZODANECO | 0x0003a104 | 0x00000100 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_BITMAP | 0x0003c074 | 0x00005c08 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_BITMAP | 0x0003c074 | 0x00005c08 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_BITMAP | 0x0003c074 | 0x00005c08 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_VERSION | 0x00041c7c | 0x00000118 | LANG_ITALIAN | SUBLANG_ITALIAN | None |
Imports
Library KERNEL32.dll:
• 0x413000 GlobalAlloc
• 0x413004 LoadLibraryW
• 0x413008 TerminateThread
• 0x41300c GetACP
• 0x413010 FillConsoleOutputCharacterW
• 0x413014 GetLastError
• 0x413018 SetLastError
• 0x41301c GetProcAddress
• 0x413020 GetProcessVersion
• 0x413024 FindAtomA
• 0x413028 GetProcessShutdownParameters
• 0x41302c GetSystemTimes
• 0x413030 SetProcessShutdownParameters
• 0x413034 IsValidLocale
• 0x413038 EnumSystemLocalesA
• 0x41303c GetLocaleInfoA
• 0x413040 GetUserDefaultLCID
• 0x413044 IsValidCodePage
• 0x413048 GetOEMCP
• 0x41304c HeapSize
• 0x413050 GetSystemTimeAsFileTime
• 0x413054 GetCurrentProcessId
• 0x413058 GetTickCount
• 0x41305c VirtualProtect
• 0x413060 GlobalMemoryStatus
• 0x413064 QueryPerformanceCounter
• 0x413068 GetFileType
• 0x41306c SetHandleCount
• 0x413070 GetEnvironmentStringsW
• 0x413074 FreeEnvironmentStringsW
• 0x413078 InterlockedIncrement
• 0x41307c InterlockedDecrement
• 0x413080 EncodePointer
• 0x413084 DecodePointer
• 0x413088 Sleep
• 0x41308c InitializeCriticalSection
• 0x413090 DeleteCriticalSection
• 0x413094 EnterCriticalSection
• 0x413098 LeaveCriticalSection
• 0x41309c HeapFree
• 0x4130a0 HeapReAlloc
• 0x4130a4 GetModuleHandleW
• 0x4130a8 ExitProcess
• 0x4130ac GetCommandLineA
• 0x4130b0 HeapSetInformation
• 0x4130b4 GetStartupInfoW
• 0x4130b8 RaiseException
• 0x4130bc RtlUnwind
• 0x4130c0 HeapAlloc
• 0x4130c4 WideCharToMultiByte
• 0x4130c8 LCMapStringW
• 0x4130cc MultiByteToWideChar
• 0x4130d0 GetCPInfo
• 0x4130d4 TerminateProcess
• 0x4130d8 GetCurrentProcess
• 0x4130dc UnhandledExceptionFilter
• 0x4130e0 SetUnhandledExceptionFilter
• 0x4130e4 IsDebuggerPresent
• 0x4130e8 IsProcessorFeaturePresent
• 0x4130ec HeapCreate
• 0x4130f0 InitializeCriticalSectionAndSpinCount
• 0x4130f4 GetLocaleInfoW
• 0x4130f8 TlsAlloc
• 0x4130fc TlsGetValue
• 0x413100 TlsSetValue
• 0x413104 TlsFree
• 0x413108 GetCurrentThreadId
• 0x41310c WriteFile
• 0x413110 GetStdHandle
• 0x413114 GetModuleFileNameW
• 0x413118 GetModuleFileNameA
• 0x41311c GetStringTypeW
Library USER32.dll:
• 0x413134 EndPaint
• 0x413138 SendDlgItemMessageA
• 0x41313c GetRegisteredRawInputDevices
• 0x413140 GetAltTabInfoA
• 0x413144 GetAltTabInfoW
• 0x413148 GetRawInputDeviceInfoW
• 0x41314c RegisterRawInputDevices
• 0x413150 GetNextDlgGroupItem
L!This 3;2hm cannot be run in DOS mode.
?X?X?XP@X%XPuX
XPtX_X6MX6X?XcXEC
>XPDX>X{
y>XRich?X
`.rdata
@.data
@.reloc
^UQVWj
3};tp9>ulj
Y]};tAE
S3VWD$
S3VWD$
UQQVF@
Wt N$9t
M~<8F$8F4
8F uE8F0
F08 F$
u-q$6t$;w
q<0A<+
^[_UQQ$
wA+uA0
;w;+uA0
tuQ$2tlA
u$2I4+
t96u$t0|
;w+u$A4
UVWyw`V
N,N48F$8F48F
8F 8F084"
{ {${({,{
;uJu;uCEWPYYu
3;unVM
u;uKj R
|^_hLA
DDDDDDDDDDDDDD
Y3MW0u
3_^][)
YYuTVWhk@
3]j h0A
YY]jXhPA
tAt2t$
r)$0<@
DDDDDDDDDDDDDD
$UQQSVWd5
SVWE3PPPuu
E_^[E]
UQSVW}
3PuEEd
3PeuEEd
Y__^[]Q
YYF$;u
SSSSS#
UQSV50A
USW339]
|^_[]SSSSS!
SSSSS!
.t|PVj@u
@sh_tcPE
k_^[]3PPPPP=USVu
]SSSSSt
vP9YFTt
vT"YEfT
FP~HZ3PPPPP`
uFP=|0A
vPYFT;t
vTYFh^T^L^P^H_[
3PPPPP3
YP;s,Vh@
@PVWX=
VVVVV3M_^3[
S\PPPh
3M_3[2
YYltCHphD
d|-tt#
Yt1hlCHHYX
Y3PPPPP
pPW6Lv
uTlh=xxPtYt
VVVVV"
3xSSSh
;t\~Ht57xP
3M_^3[Hj
~lSWCM
woVW=A
S3VW;~ E
@;u+H;}
39](SSu
]9]tWuu
};~Bj3X
3;t?uWuuu
t"SS9] u
EWYuEYe_^[M3
u(Eu$u u
~.8]t)E
WPEW@Ph
~U8]tPMM
uYouu|utul3
3M_^3[ {
mYYu,9E
FGIuX^_]
3@]3]j
F$|3@_^
eE}hea@
Y+t"+t
+tY+uC
Uw\]Yp
u>OdMGd
u wdSUY
zuxVVu
ptXFVPYYtHptSu
3YY;u!9tt
SYM_^3[
NQSVPq"
SY3WWWWW
ffffffE
3PPPPP
_YYt:V5A
PPYF,t
PBYF4t
P4YF<t
P&YF@t
PYF\=FA
~lt#W1
Rtc=0A
YYt0V5A
B(;r3_^[]
1E3PEd
Y_^[]h
1E3PeuEEEEd
Y__^[]Q
:E_^[]E
9csmu)=GA
3PPPPPVZ
@Y<v*VZ
^SSSSSyj
;tFtA3
M_^3[Nj
8csmu*x
S^`N`H
j$Y~\d9
QY^`[_^]
VW39=xA
t.t$<"u
GWKYY=A
S3V:>=YX
3Y[_^5A
3PPPPP
FA>\t>"u&
uUEPSS}
=?sJMsB
;r6PPY;t)UEP
3wf93t
f90uW=0A
VVV+V@PSVVE
E;t8PYE;t*VVuPuSVV
j@j ^VYY3;u
H3H/5`A
;rSWf9M
E3E3;u
t3@_^]
=RCCt =MOCt
=csmu*
8csmu8x
t*9csmu"A
*Ed38E
EPYYE[
>csmuB~
YYtaSVL
YYt)SVPL
Ht Hu4j
=MOCt*=RCCt#u$u u
EPEPVu W
ESx;7|G;p
@u%u$u
E;Mr[_^
R9>u&~
Yu\39 ~
EPEPuu WiM
EGE~rF
.u$}u ]uE
u$u uSu
tR99u2y
u$Vu u
Q 3@_^[]U
VW_^]M
S3VW9]
3_^[];t
B:t"Ou
Pj1SEj
Pj2SEj
Pj3SEj
Pj4SEj
Pj5SEj
Pj6SEj
F Pj*SEj
F$Pj+Sj
F(Pj,SEj
F,Pj-SEj
F0Pj.SEj
F4Pj/SEj
Pj0SEj
F8PjDSEj
F<PjESEj
F@PjFSEj
FDPjGSEj
FHPjHSEj
FLPjISEj
FPPjJSEj
FTPjKSEj
FXPjLSEj
F\PjMSEj
F`PjNSEj
FdPjOSEj
FhPj8SEj
FlPj9SEj
FpPj:SEj
FtPj;SEj
FxPj<SEj
F|Pj=SEj
Pj>SEj
Pj?SEj
Pj@SEj
PjASEj
PjBSEj
PjCSEj
Pj(SEj
Pj)SEj
Pj uEj
Pj uEj
Pj1SEj
Pj2SEj
Pj3SEj
Pj4SEj
Pj5SEj
Pj6SEj
Pj7SEj
Pj*SEj
Pj+SEj
Pj,SEj
Pj-SEj
Pj.SEj
Pj/SEj
Pj0SEj
PjDSEj
PjESEj
PjFSEj
PjGSEj
PjHSEj
PjISEj
PjJSEj
PjKSEj
PjLSEj
PjMSEj
PjNSEj
Pj8SEj
Pj9SEj
Pj:SEj
Pj;SEj
Pj<SEj
Pj=SEj
Pj>SEj
Pj?SEj
Pj@SEj
PjASEj
PjBSEj
PjCSEj
Pj(SEj
Pj uESP
Pj uESP`
6v v$v(v,
vXwv\ov`gvd_vhWvlOvpGvt?vx7v|/@
PYv4;5tA
W3u}9~
3FSOuGYYD
PyYF$;
PgYF8;
PUYF<;
PCYF@;
P1YFD;
P YFH;
YvL;5A
W3}u}9~
C PjPVEj
C$PjQVEj
C*PjTVEj
C+PjUVEj
C,PjVVEj
C-PjWVEj
C.PjRVEj
C/PjSVEj
CHPjPVEj
CLPjQVEj
@4MC43@3
USV5x0A
SV5|0A
3W;to=@A
uYY~PE
PPY9_t
uV*Y_^[]
t4V0;t(W8jYt
Fpt"~l
lVYYYEE
WPWPWv
M_3[Lj
j %YFj
whu;5A
8]tEMap<u
TM_^3[Cj
%M}_hu
Y^hS=x0A
3_^]UV3PPPPPPPPU
U3S3@9]
|FVWt>E
tKh VA
VJYYt:h
r3@]3]
V3 AB<
3);ut!}
0WVyY;_t3@^
tEP6J&
t,PEP6^'
Y3Yu0N
t<6Y;F
t/EP6V%
M_^3[
@\EP6$
t*EP6$
VP?YYt
Wj@hHSA
th5<0A
u h$VA
3PPPPP]j@Sh
t,j@C@Ph
3uP;Qtu
tP;Qtu
eP;Qtu
MP;Qtu
?P;Qtu
0P;Qtu
(P;Qtu
{P;Qtu
mP;Qtu
^P;Qtu
uP;Qtu
ES3VW]9]
39] SSu
ESeEYe_^[M3j
M\u$Eu
rustnM
tR:QuMPt<:Qu7Pt&:Qu!Pt
@FA;r3^[
+UV3PPPPPPPPU
$sF ^QL$
EPQEPEj
URPQQh@
t;T$4t
;v.4v\
UVWS33333[_^]
33333USVWj
_^[]Ul$
SVW=0A
3;tuSu
t VV9u
e_^[M3&f
Eu}h]A
t?P50A
3M_^3[wd
ft'Ou"+
jPfDJXdf
3]USVWUj
P(RP$R
t:|$,t
;t$,v-4v
UQPXY]Y[
KuZUUU
;t_+^]
VSMYY1+W
E`p]Ex
tAMap8+
;t+3_^[
USV3;u
G;r3_^[]
MapVD$
RQMQVp
u+9uv&
E`p3_[^
]UWVSM
U33@V3VVV
UV3W9u
SV3W\$
PD$,PD$(P
|$ @<
u;;u1h`^A
FvD$0P
3D$ 9\$
8du$Vj@t$
R<$tmf<$
?s-=,A
Fu^8Mt
M(r3;u"W~j
E`p^[9M
~j"W8M
E`p33PPPPPN
[SMQMQp
M_^3[7M
E`p3[_^
MNclu#xj
T@PVSJ
xT@PVS
E`p3_^[
^VMQMQp
|w0lS]
dw0S;t
[M_3^G
_WMQMQp
tS]3K}-
[M_3^F
et_EtZfu
VVVVVn~^j
t*f u!f t
ZmZ,$Z
U(3EE9
tWItHIt9It
EYY" uES
M[EP3SSSSWEPEP
E`p3M_^3[m8
M'[EP3SSSSWEPEP/
E`p3M_^3[7
WB@PWV8
PEP"YYEPj
^3[53PPPPP!nWVU33D$
HWxtRHtCHt4Ht%HtFHHt
QP|xPEP%
YM_3^*3][
X 9} E
AP _^[]
;}"+]t
|3Et^E
EE EE$h
/$] \h
u+t's C
YYM3',][
Vf#^f;u
u'339\u
JBtj 3Y+@M
}99}r"9U
JBj Y+3B\M
3+BL1<
Jy3^j Y+
M_3[Q$
u'339\u
JBtj 3Y+@M
}99}r"9U
JBj Y+3B\M
3+BL1<
Jy3^j Y+
FWE}MuMMMMMMM9M$u
<+t"<-t
h<+t<-tk}
+t HHt
B:t,1<
+JMtHHt
B:}QMEO?
tEPuEP
}M]U3EE
3f;u AE
f;u!AC
u4}u+e
f;r#33f9EE
[M_3^W
EAV#f}
W]EEE?E
S3PPPPPO3f9Ut
u-h\zA
EfUu}M
3f;u GE
90t!uuE
EMuUm
HuMu9Et
u4}u+e
33f9EE
UUUUU3##
f;wK3EE9
}fEEEEEf}Z33f9u
Ea3f;u
f~7}x+EMe
EM}Um
H}Mu9Et
u4}u+e
f;r#33f9EE
ufEEEEEfu
~(E]Mm
0K;]sE;]s
EM_^3[i
K;sE;s3f
SVW}f]3
S3VWEN@
tfM_^fH
generic
iostream
system
iostream stream error
Unknown exception
CorExitProcess
bad allocation
Visual C++ CRT: Not enough memory to complete call to strerror.
LC_TIME
LC_NUMERIC
LC_MONETARY
LC_CTYPE
LC_COLLATE
LC_ALL
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
!"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
bad exception
Illegal byte sequence
Directory not empty
Function not implemented
No locks available
Filename too long
Resource deadlock avoided
Result too large
Domain error
Broken pipe
Too many links
Read-only file system
Invalid seek
No space left on device
File too large
Inappropriate I/O control operation
Too many open files
Too many open files in system
Invalid argument
Is a directory
Not a directory
No such device
Improper link
File exists
Resource device
Unknown error
Bad address
Permission denied
Not enough space
Resource temporarily unavailable
No child processes
Bad file descriptor
Exec format error
Arg list too long
No such device or address
Input/output error
Interrupted function call
No such process
No such file or directory
Operation not permitted
No error
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
united-states
united-kingdom
trinidad & tobago
south-korea
south-africa
south korea
south africa
slovak
puerto-rico
pr-china
pr china
new-zealand
hong-kong
holland
great britain
england
britain
america
swedish-finland
spanish-venezuela
spanish-uruguay
spanish-puerto rico
spanish-peru
spanish-paraguay
spanish-panama
spanish-nicaragua
spanish-modern
spanish-mexican
spanish-honduras
spanish-guatemala
spanish-el salvador
spanish-ecuador
spanish-dominican republic
spanish-costa rica
spanish-colombia
spanish-chile
spanish-bolivia
spanish-argentina
portuguese-brazilian
norwegian-nynorsk
norwegian-bokmal
norwegian
italian-swiss
irish-english
german-swiss
german-luxembourg
german-lichtenstein
german-austrian
french-swiss
french-luxembourg
french-canadian
french-belgian
english-usa
english-us
english-uk
english-trinidad y tobago
english-south africa
english-nz
english-jamaica
english-ire
english-caribbean
english-can
english-belize
english-aus
english-american
dutch-belgian
chinese-traditional
chinese-singapore
chinese-simplified
chinese-hongkong
chinese
canadian
belgian
australian
american-english
american english
american
Norwegian-Nynorsk
Complete Object Locator'
Class Hierarchy Descriptor'
Base Class Array'
Base Class Descriptor at (
Type Descriptor'
`local static thread guard'
`managed vector copy constructor iterator'
`vector vbase copy constructor iterator'
`vector copy constructor iterator'
`dynamic atexit destructor for '
`dynamic initializer for '
`eh vector vbase copy constructor iterator'
`eh vector copy constructor iterator'
`managed vector destructor iterator'
`managed vector constructor iterator'
`placement delete[] closure'
`placement delete closure'
`omni callsig'
delete[]
new[]
`local vftable constructor closure'
`local vftable'
`udt returning'
`copy constructor closure'
`eh vector vbase constructor iterator'
`eh vector destructor iterator'
`eh vector constructor iterator'
`virtual displacement map'
`vector vbase constructor iterator'
`vector destructor iterator'
`vector constructor iterator'
`scalar deleting destructor'
`default constructor closure'
`vector deleting destructor'
`vbase destructor'
`string'
`local static guard'
`typeof'
`vcall'
`vbtable'
`vftable'
operator
delete
__unaligned
__restrict
__ptr64
__eabi
__clrcall
__fastcall
__thiscall
__stdcall
__pascal
__cdecl
__based(
GetProcessWindowStation
GetUserObjectInformationW
GetLastActivePopup
GetActiveWindow
MessageBoxW
W0B!b5*
goribiwixelozopovuzevoku
bomunavepoxarozuhifurajo daciraricivuposamizeza homasowaku
VirtualProtect
bad locale name
ios_base::badbit set
ios_base::failbit set
ios_base::eofbit set
invalid string position
string too long
bad cast
nu?cv5
8Ud?|}}?<
?)0>B<
sl?ecb~q<
oX?F.K;<
4lkQg?;+U<
:@Xh?,n@4`<
G^*?m(<<
+?NibzP<
l? %X<
Y?]@_}<
En?T(+<
'?ju!4<
qw?_W<
w*I?n'$<
R*?)R<
H?Zxgf<
a?_"C<
]hNp?b
4{#s?Ug
*Ow5?.@<
W?W0e)<
J]?V:e:<
b;SO?4Td
U?\z#<
aX;[?Y']<
|a?B<$<
?+XUG<
._p?1S<
'4?/t><
&?5SmT4<
@ic?%[9
3?*+xi(<
?{!mB<
2?cMyoG
Vsw?8K
l?e/?B6!F
u0wu?M
G"zI?$}Tw5<
e?M]-e<
) ]?h<
'7?y]h
=e?:Q]D\<
?FnHAY<
)RQ?{<
dN{?c1
=.q?+`
iQi?v7
?ZEM-'^
!?:Zn=
eP5?+}ZI
Dwb?(,x
Q/?qq)=
o\l?)T&=
?|6??#DZ9?
?/.?>6)}?, ,
?x%q? ?/xbJ?
?(Z ?t?{}2F??_2
?>T^?u
?;E<?fSOs?JQ?zL?
?{yK+;?
h?F?-(?n?@F
J?CSi?
?89l!?f
:?1(>?
2:@?>?@@?"Ir?64?
?765@Z?&+-?w'?
Q?Gpt?2&?X9
?Mj$?3?s
?I@ |?P
?}>v?H|As?#
F)Z?2V
V?f\S?B?}
4P?VL?{
uB?1<>?(b;?
7?]o-4?
\%?f,!?
?a?9y?9
9R?%R?F
?@_o?7
?D<xZu?`\@j?)]Gq`?
LcU?JupJ?CY??
?#em? -F
R?VDD?oWsg6?UJ
?1_?$*2
)?V?l$G~
?+6?tF4
,~?"n?
L?l6;?6**?|59
?HK?s7
?I-?$z?9\?>|.~?
-W?^\sY0?:Rp7
?mbzA?G4's?Iy
C\2?Ou
M?nw?KK'F?l
?}6lw?
?$ f?e')lW?zD@
J?F<?Q'J`?xe_
?"Sr?xw
S/?yx|o?P6 d!?
T?!z? {
I^?A;?wC?JG7&?'
?,"Q?/
b?PV3 2?
p?Va"?
UUUUUU
333333m
.?333333?q
?UUUUUU?ON
?$rxxx??
Y ntan
_nextafter
_hypot
1#QNAN
1#SNAN
GlobalMemoryStatus
GetTickCount
GetSystemTimes
GlobalAlloc
LoadLibraryW
TerminateThread
GetACP
FillConsoleOutputCharacterW
GetLastError
SetLastError
GetProcAddress
GetProcessVersion
FindAtomA
GetProcessShutdownParameters
VirtualProtect
SetProcessShutdownParameters
KERNEL32.dll
RegisterRawInputDevices
GetRawInputDeviceInfoW
GetAltTabInfoW
GetAltTabInfoA
GetRegisteredRawInputDevices
SendDlgItemMessageA
GetNextDlgGroupItem
EndPaint
USER32.dll
DragQueryFileA
FindExecutableA
ShellAboutA
SHELL32.dll
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
HeapReAlloc
GetModuleHandleW
ExitProcess
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
RtlUnwind
HeapAlloc
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetCPInfo
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
.?AVerror_category@std@@
.?AV_Generic_error_category@std@@
.?AV_Iostream_error_category@std@@
.?AV_System_error_category@std@@
.?AV_Locimp@locale@std@@
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVout_of_range@std@@
Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.
.?AVtype_info@@
.?AVbad_exception@std@@
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AV?$ctype@D@std@@
.?AUctype_base@std@@
.?AVfacet@locale@std@@
.?AV?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AV?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AV?$basic_iostream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ostream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_istream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_streambuf@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ios@DU?$char_traits@D@std@@@std@@
.?AV?$_Iosb@H@std@@
.?AVios_base@std@@
.?AVruntime_error@std@@
.?AVexception@std@@
.?AVfailure@ios_base@std@@
.?AVsystem_error@std@@
.?AVbad_cast@std@@
.?AVbad_alloc@std@@
I x@oGAkU'9p|B
~QCv)/&D(
uuvHMXB
9;5SM]=];Z] T7aZ%]g']
?Zd;On
7?3=Bz
;1az?aUY~S|
D?$?9'
*?}d|FU>c{
zc%C1<!8G
u7.:3q
#2IZ9W
,%I-64OSk%Y
Batigiso jerojezotolu pasisuli muri. Mejozuzuyuwa kocapa vayi. Firebiguhe yihemesuju. Keyupocunucipo jafiyaya mapi. Nonebaza hinojagoho. Xogamekixitu. Nodolekoxosize vekececudixe. Tixakehe. Rese yetasohora benusere vatakenevagu. Megedagupe galeheru wagobu. Kirede xuvuwajeyowu jo. Vu. Tuzudiposuxe zoyirudipu fopici vehopowegigore. Rivekekari. Saruginile vusubo naxiwiyovizi. Cesehizu jizayonizinu kisi. Hinitufat
Lolarumalivuza. Wuju kigisu nudo xefese. Pexu jeri. Vugelavome juca. Lowoxuwuyelepe nada raju. Hojojinupu cayiruredo pofoxo banijodirivufe maxusunutave. Cehenube puhuguwuje. Ji xafupacelunuyi funogacebora coyenusaluwa hozepu. Mojuhogo runufi gunato duhoke jekayilakado. Lipowe lilebaxupewuri xazonanotale febuhafucayepe. Caxu bofo sero gati difeviceza. Kowu ke. Wofejave hebaji givihazifuya. Cizogizanugi payacu cipiwetewavasa. Logejuxo sidijo. Haruxayogora yocicenehozo golehejosa zobilonoziwo vazefa. Bo favi sefunotudo. Vozawesoji metasujine fegecipanolu. Yifozoberi fezidawazugeni. Yo. Kuluyesepu hezimosafodidu sepe jacu dage. Muvafalomise yicuwa titakoneyepi josudo. Taku. Povetemula vifiposoxohilu jusu. Cufusu saboheFazubihiculi coyamiyobewija ye rosoro. Rerojufebu su yiyo. Fakitawevilere tixa haweraluzu jicehowo. Dizo duremefCifucavoxilitu vabujupexo yixuhapi. Kosihemukuxabi kugiki jabesogutu yozuko nipi. Howusoceguto si xuxaco jofodagoluhi. Tokihonizezige sojevilohamocu. Gorozotahu jamijurukukiyi pucajetuto lorube womapeboka. Zumigesakukixo. Ye fepuwahu. Je cugetutuni. Vileraluwa fujo joxarukuluraza. Punekucedolape dubojirehe beta jedaraguluyo dawohu. Racuremaxo jo sewumaj
0nI\V-)Zj3\G
!,;b@V
`5um$pzb'/
@&LIQSuC
1vJM4HZqQg
&%%/wZS
R'8u0U6|
nW<`'?n
:Bz-_B
Qwa/u$OA
3yhpf<_hGX
+(lH?Yf
gGzNF(k
Z[4beAZWjIbpk3
Gp~7]eP=N<
e=D?N>*
,Cn?a9|6O,0g0/6K
GQ#LJV m
Uh%T!w5|7
<ZMn+)
P?=7hdg3
=~$p"!
IR4Or;
)S5EztT`R`QS]
z9]G6oY
T+(.8_b
HAagL5f}z'j
M&,M;Q
2R>8*NVsixQM
l'BKKtT
S7<{'U
l+KuiO
S$Xk1w
u[eM/3Nh
:|K_BT,{>B`*T
LzHcE2
T#rXMR
OWU4KU
P^u@zOT
~@:kk?
#Xq_PU
,Z4w(qI
:]K9XS
XS,|} B!
MJ69y6[z
~]<IV3bY
q"}{>shi
R)61y?
]bYv$Kz
x}zoPzB
%TW76y*Y<
<iw3oX1l
P#y?NzKI
6u@.A3LS;]Z5z;.
@Tu*-~Y
^N;ghsZ&
)=u$"o
luT_KhGK
~O+KKr?
:K-?4rF
IOfsYCM
\\s@C5Gh
8ow!Q'I}KBtx
NMAT ~fYWx7
!|O*\:9
6rdj!]XJR)
WL7FS<}Ky+,8qrt[]|
w\5rwU
1!yPm^'L
~k`)YFN
;Mv>wy[Jhf3
Zw^&PZO
8[dO-M(6e[
jrO!P^?
u*wby0L
mVgj<~/z>n9
Cpm/<HhqN
<a\&fuLM:
b!~!$d{
[/,<O<
2,sBH}&}OS
*1m!+D
Gsx:RKZDwBK
R?F9Mc(
nBj|5:fL
*n!5>7b\T
gjd#:T=ZF=w
)`w0Ql6B
xALvhM[
2J23$wS
{%l0'1
{p7%>*,b
G #|a}E"o}
Ow3$%w9{9J
lm,K8fJX/
QsM|p$5(
nrN\Ewb
T%0fw5f*
b.$%xbf|D
G(nx^;STE
`UbjXZR
O`E?'Qa*
WEWUE=E
;>uD1p|Mk6
4Ybxo!
ni}3YZ
vd?>:t0gO:
(JyBY13;-r[
>v!(:L
b:8&b/sX
*&F!7
%D2C@~3-
l&#*Kn
#m(g&e7U
7xp@#W m
d$4|ex
!|!Kly
Gk;-u"W
7rr,YSL(A37
A8G 2,
8>.*/2|T3
#qr.jV .g4:|qsjW&
+#5>{):R
?&+h56@pLSe
._Ac.?m
d#ZL\V|
E@B'%E]m@Q`
E(8CRbQc0O
|{,)Uq%
NrFMW'
x@^hG4=
RIoXn)}q
,_}N)OW
Qi+}4* n
73mnMkoyc(??
QNU&F;
i .AeT
-`|3$O
#%c73L
$uK}N*m
c[*0qS
4 ^01v
w8N"m4,
`F5#Y:O
1?W.V<N
Wca5okK
99k&f|P{
y@A.`,
`%/g[Q| .!rh
`nt-se
?CqDizbep[NNC>
~hr9J>
d/8OdR
B~.eI6
:(=,x?
g7bZzqZ
Oh2,{n
qaA8q]
d]*Wob+M
{9rol5U
;@\9LZem
mw(jeL|`@R
t)},-#PY
l|-}QN
zwD{59?}c ZS89*o~I
hd6] c
<Y^2yD|
Cy4gY4n
jE`oy&UU
DJ4]r'K
@5!`ww/
JIZ)@.)
>XBRnz/j@
KX$z# ,
|~p6F[
!'9`mF>l
V.~9tL
\(.TuI@zZu"'r
{A9-E)%&
|(|sr}PM&
sHTJ-Wgm[
2BVR^BhR e$$@KNY^[1@P
j,z. u
vJ8EV`Z}|`?1e@kuB2
$B% A(hd
3-M5@B
KJoS)u@g[e
'otQup
0LyhK)V>@-".
=YW,6s=
cfbcVI
f+1p-2
\t24)u+5$<//e
:eFJ1^
WG{.@a
GGx 3EBK[_hOr,G>\*y
~-8 ^M
l,Ag_>cGm_,
$'f$a2{\3
O%hX|vg
}2h,Oy
ofd\ K
K)Wj7;2[Z]cr>
2*krQ[hOl
=HsWWa
.Y^t|~EINN
-`Tdt@Z
4(9vp5V/+xr
|1>8cE.
S3|HaFtI3o
-w:3WMB
%UbXYv[{TSC
})02CR
U9CFC=
>9`8xJVE
t\p.7Zn
/prt<pI
=1n`|J8
9'oItMy
rFsLZA7}
UW#2hR$d
i}rrn8\#0
zL`Z,S
uMM1G#2@Qmq
y'=2oeJ5-
F.eDs
0F){nH
2@n\>3
F+egs#I
';,pVdf2E:F]faW
7|<:o6
"2l"27"<K
f7*8VoZ
LOqyor=
7=T)"r
q*(ofsY.f6
]l8,jP^
N=.$r7,h
,@YrhrlOUzZizf
.|<04#sV)"
LK)vl
DlW:+M
@1B}e*7uz|
W$M)&8)ePH
=a! x`
yUZMy'A#6,f
p,##x
[kr9k5'
>`IOxb/
Wd^~g~i'
oCz$\~?pOi
Rr9^hoNA
:;x^Yg30EXP)
(5$DFA
V`3bBh_`
kyOhhh
<&_% N
W}\&;c
KPn$m[Eo>b<:
3zb1?>zo*
"("DU,,mm
3Tw91gO H
Q68XQ50KqIjd@1)b
sEP51,?Gg(a4jzXwWfW+pz?
v*& P+y(
`8nyp6"hb
#{1'kg-
BA3&vO `2
h,9B$qV:#
XZ0$}d
7P],Ih
&S+yjt
Lm\0l*
lh_tTmw
160JS-im52*2#| m
!C?B`,Smuv+
9hGW.W!<?SVb
U.%`5uud7
A0:.c_
Yz#+Gg)
5SN_~"U,o
L{)o&r
uZOT /z
\2,Frk
$JU8I/zYz2$
'r3xJwSfg
T$Dj2B'
lCOQ>m
Ir";Hh
hpx_L2H
>YO,8jMD
_az6*5vf
y><H^``
T/r>Q-
(;jU<@D]((t
-Cl#eR
b-etg8j+m
Y~-!1_[
m|_\-,9u=
P1G# s?q{
n].=l}/'31Q
?_J$s{YsP[
`R8nPM</Y(Y8
ooRgh!n
e)A1bl]
uh:$&Q
n*,/cw3
gnJ8Nj:
5wi&~n}SXJ|fu
7LQrKq"
23iwAT9dMPc'=
.6^4l
SS<3w]2fpB
Y6h Q,
O)0zcc
[|"=s.
Y!R)`|
h F!G"i
M:f!_oJ
n{aPF6)hMJ2
{ yPthl
N\I0YCPl
M`dgct^
yRYQCt.}
=}~*;6rl}g}T7
@3$3Q[hi
Q35G=!9LWx3y
P5}Fn6
vQ 655f(R
.F>:bW Z/
7 uaD
pPKL5Z.Y
\Wr23#
36<x"z
1s45u~ s4KmL2l
@<"|'sy
JDWwpP
`txp/M
Un|6lHODjt0q
GDO>dQrQ
pPC9<!i1
4uVmY+ZR}
SO[_pw4K
m_y2_[
{O[[w5791
}S&3dG\pgj
knk$/w#U"kYs
Qzk rix
yQfXn_(
6(e!SvsXDA
_^,-!i
X;Y5tD
HLwL2Ccv
`tgD7V=N:-
NqOD`Kgdw
F?4K5L
P(b\?s
{f\O.Gs
Q3(3|`
JsEZFp
k I\Miu
]6Gni2TB_ML
IC8.W KMh
(r+bc$
%'}y8^g2
pfG<%K
t{,%^
nv,8v-
]y+\EY7Tb
:^M*A5l
/t^D)b
\xbp@0
O7* V1yPn
<DZ|^ S
A3/ZA~9a
7a @q@uR29
`Q|nZP!jH~5JGh4
VL)"kziMHGl
fd q.>bk}
(f~jQcLv
sN"m YfPc
uiaV]q#=
v8U`bSK?5f2U*fR
tq]6<j|+>75k
x\{d;5!
w0w8S[
'+GCyukAdS
A#-xZwk2
Z^Q*DX3nrT/oS
4N?JoNq{8+
1@6poTq0
YhoecKCc
NLXl}!
1vug0e
k k+HSn
/kNTk+
Ui/ydy
<'(_4uYb-@%l)e
UHgzx,R_
)1{U#vF:f\]C%*
KR&RSX7
|7C1');>u
AUbH+~A
}QXCsC
9iWMw_
RDJWfgy.Sd@
/($yYb
_EVgJ^
f(cv@6AFSj'
Ds0.=|q(
iptJCU/:kfj->WA
O4jB^7:#(
h:e{s/]
Fi mtcRWB " 3o{ {Z
P3KkZ
E\J6RW
q="m^9H
br.TZaw
>L#,5+vm
O!Ft8U5N@
%b[-+l]vFI{p
Oj.{m>EO
n&U]!
71&20X@
,o8C,MLg$BXr
d:8#5mp4ta
@$b08=b DE#k=>
]#E"z]
Q~@mY?(A&'BsMK,'LOd]8'
/V9Agh9ZDETmr
#<h<=*
g9,V=Cs
xu>W^Tj)K/uK$a{FZ}W
fi-B^6
{WUBV&PWBZ
{Js#R;
~&vwhG5
sv`Q~bM@u
%I/LEl
3n {=u<Xku
ynh'Z
g<*}A{:
Z)1=SJbm88:
55<(ES
=k8k?-
96^8i~>
Gh5;'v
hx ;l}
47-*#o!UI<%Y'yL
Pml=`B`[Y
v6h#2&
^q$$n^
NTfaE|
=9"'k_OF
$hA2VX=E
MIm<&uzuV
x&IB@D`Qp+"G{
w,Jer/*b"
NNV>%=,G2C[
qoscmA
s3(pdDzod:
EWDQ.fV
7L,XH~`
F7+yAl
08#\R~
1jguC0
6_6FE`J+
gYiU~"
W%]-,#
C+[/}V2 lZR;
>+z,?XE
G_*qIxpQ
t!$Z~!
>R\-L'
I vm$oJR()
_r:wzWj
m=eskvsG
E%EvYb" ecI
b`}h)1
{LA.2$
}N6T;3
KFXszQa
>?+8b:[lbKath&b
9:HY["zY
/r];*'.2$b
cdDbtln`\J|
O?9lc>F-D
_T[>P4
)OI>VE
vr9mz&
LM)&q[LMh
5Y3+/`
3vFkRC
z"$]0Z
.-<%`u\rT%Y
@u@3/2x$:cR
ooM Wlb
zhysga
{hH."%(
plx@1&*
Rj-KMV}m5@pF
l,X=/4H
iqpb3a5e)Iy)
XdThL$
iL+6iNe3
-{AA>Xp
TZ%m5cNJd
'n&^i?
KxGOK
Bg%{||J$x$
/RuDu*
,mTL:ce83
2\Y2pA(
S%_1N48bA
3'; i<
rG^ 2`
V-wP|#@d,
VkAPHpa
-nr`GZIdx|.
K5 :lS
G3vt{~~a#
'rf"o@
@t<aMoX
;s5FS/
+_]}vm
@$SnJu0g
/yfQw.f
B}!%4xJ
~txFSN
2M(-Tm?L
L)`US(
[wRgyR
^2hDO2
% #Dgx@
mO.cX6
+xNgPq.s
Noh`.F
)xJ,O$
%dnCQZjo}$5K
]sN%2)
;<2WRmB/
|Tq2k2($,h
F$QL]@2S
wBG)1_#|Q
63$.~2NOn
EH1&"v
-d,t[--
@"m8DNd#3v,
"edX[e
:)QGia
t@#;~[.L7tQ
jHA][ 4
\vXw%G)K-<Bfzl'C,8/e1Yhp.GP`Uxt)_
A\(gx.
yH1I\a,Q5X
Bsx\hfb
(KRQF4:
=+EZ O
3uLru}
#047G
N5j0loX+
P3j8_}F"
J+'WHV*
BHZk1^&f#
||`f# F
\z1-:n[#8U
a-+9(XOOF.8
10@R$*
"kd~0n
D.Jtz%^
z2H7C]#
z3'^0G3
&E?=z`5Hz%oau
Xv#[y6=>
H-H~CX
4gz"$ii
[Of#jV!~V
MY605%
B33c~)
r]^?<rE$+m1W7g'&S<{
.pb#7.
,dFV=c
*R#=mI
JP)wm,)?VZ
pHz._y3Y
2IdS^@JX
}/.Wm?dyq2
n=78_` tDQw{
'$x..ec?-o
@86<Yp@F,g
W_pE"C
[2l[~b
rH"s!R0
/BoGmqhr
JCtpnnpyC@%P1
`r4;W:
E{pD6m
l-*dx@
* qn,x%/ C
&=*9}gE4
51Q.M?A
!h4rFhD2Z
U$lXVi6Bj
`I|8?kU~
363!F[<`#Qt`}
]"A?BO"~2
<(u{Km"
<\6'aa
LpSW\#
=4v7x.W
Q=H\[?gA
YFYu7w
miaN$<
>di\0t
:oX-!$L=*dD
^_ .RWA~8t
Laa1%Xu
;rez3Xbb
F2AyFli
YiawFH `
GX\Pd?a_J
ov!8;sq`9l
7j=bM?I
I5Ns0/'
l*s1R&
`T8D!YTc
08p6%2b{
S~I&NqbB
qs~\`nxwKw
g&6HVIiLu
&=-0"Tc[iV\-
^zZ[e8}\C%
uf+z yrv
HuuZ+kr
%-:l9vg
.p"sru
~_3_h)T
|0dr]{7&d
9Uxtoz"
f%|"M9
bPzF-/
\F2~bmLH!
kcG8=dyj23e
x0S0+Esc
G~ShJwjb~
J)@)~"K1-
Uj Ys6D
x"YJP'3Z
tl%]^>ul[&
KNy_f*
wWLD4<r
,/SOh&h
Xr#i`D
#ij?#s90j
^5{Ok-f+
+DpH*'[
&u2/Bnj+R
7Dg.j'
x|*U9:
{LwE*W:Fiy
H;GR7"Y1
2gG/]1{.ZE
^Nv}Hz
[$1v/@
H*FCMM
7CQMGp*m
mg6/)WN4OZ
vqHm-~
ssUJRp>+gz#`To3$J{
aKd!(? j
Z&u"[5f
0dqao:
oM:z xrDR
N \Ql{J
T^EF(H5
}[^KGw
A9\ap9J
@j#njZ`"i
l!uU/L
3.fl/(e
VG>C* V
ix,<7mY.zII{
wut /!8t5l
i+|idhLNhv
Y"J6Tw=
2uR<:L m,
4\9 HT
Ua]H>\
Q@db+Zd:E
JNHa\$
C]t`05k! bXW
;w-/ 7\27
Z+BUMj
u?kjDY8wAK
?esj:|
ueR26I):
;!!eS/(x@
,-cSv!++
U53s*.+`HK
kkr $Qb~Tq;
*VVb8c!
S-*mj:
\WAC5,1y7
3X$0]]
7xv~mt*&e@p
3+on/1<p<
^mVS+]
B,R$*]
'l)dZf
@N%6Gshv]1V
<E1$O;cCc
z"6xD-"Z;
[:HE,e@-K
|}{{\u
e~$?N`2}
jg+xg9x1
g[fKj%o9
iHHHr18mn
ng_xVWlP
r}):f7
Y55>2 dmb
E-T|DDiDFk)b
^{ahsyMIN#Fg-+
"H8rAQ=
{R`eZi(('
xX.X,SU)^
{>5Jq@
[?D=S[`;5
|Ta jL
TECO[#T
tH"gis4R^
dyhXY8
:G{&?t
GaEda}kQ
A;ki/sN
NI$EO5
(IW|Ti86
g}M+>(
im|0piHnbszNz=G|
v7KE:LO
n0{1qHga
aLp2X{(J
kE[*mo\xt
y;,tEm
V8iDp4cPaf
vCg*}W#(
YV)VR}jT8><w
@`3`pi4
*7d.D)
'Ua+f?e
|l$W(c
DM=A Mp@26b v
t<!;q|`@7
3SLKHb
'3WKTVPv4qK
|D2-h.
LjdOPFR
Vn4q^l
'or-1G
Pn CM<W?$kl`l
[&GiW)%
W0q[X>2 k6
v+w_DC
lfih=K
/X1.P:
UG:{R#2U
J]}#?6'<
G#t5 6
YJp/|V
~2R&-@(
ZoM dO
S6}df#yE
2Z&"M]iK
-bS;+yg*Qw
:{S.;NhB
Y Ce :T. tH
Ts!.c
a%uXC/
<Tr}U(g
\5lUxJF;4e
G{./-(
A{GzccK&s?
V`ps2;
MXVj;?r
<m#%(~}=h
XP]j#~2,"=
6<tFs7
Y\-5wA
?wITo\
G6]{|eP
{*;!h"SCP\_n"
i^c&GXw
OOy7OzY,|0S
(I0}{l36
i&-)>df
];P6D$lMm
sf7.IX
Hh eFx^W"+
W^=kl>Ev1&
5mA oVw
[U"l)fa
O]%3Lv
rhMI6{zp;.+]
yx2]hL2m }3
"{{*[={@8
</:k3C_.<
gQ.m!_
<%n"B^
["EE<Xn_58V`J-Ops2
?(G|M2
kPRA$+'
vrX&e
'j.ol$EP
3eL /VKX79zJ
~2)bFm{4Y]54
Y|x{2e<
IUje a
/TKa|S/E[]8?
<2h`Zd
=\Z-]]8b
Qjm>m{S
'00K:f?
h{^r9k=43Knki3^Gxl4#I
%m^BbMpB^~~Hxoj
wF0VB_*ZAl
bl.+NL(
c`:k(7C+V;Q(=
lG"tIQ
?,B ![
3lF8q]
0*t!a|
gyz&:2.~
R,.n5Q
vT~,TL}
`//8"xx~f5
~cc,Hv[]RX
y$wdc+ 1
.S.2*7
n@+[>,n
*kDll:
2VG'z?
Ax>%+P
*a1=#*MDn
Fl|!Z)-_a
%tJK=G'Fjn
M yZ~8
_-xvV_ HEU&x
eNxu{}B~@
&ymS65
wg7[-+VC
A9'9"V
wV{cRNj6Uu#izpf 3_kts%c.
!- KF]08f
&^8!lYX]pyS$
\/m;}A1J@
:i^/j~
J)PU+nUK
(y7|r{xJ<
UZF6=Knw
*WR#dW>v IT
|WOL?H
p0V$=[Q
Spo>+m\8
JYPS|/Yi
G-)!Xz
94#rRK
U=X;<tw%
vz3,M]
2e}u2x|eAOU?dG}
c\|yQb1K>7
~rOe>V
W!!hC9p
ofTh{4dr}c
b^4`aTp|g'#Gf
?W@^(FT)Zj`bO
bofs{
kT{r@Wf
&<hm&{
)'0>'$#N j
'HlH:$
4-{NjH
^][cBNyu=}L+ga_#LE)
_H(]nV
=2dg/IN
ko9#1[I5V
?suEd".~V,
C$W8M}
h>!0`2
-y<q=(
G[7\2n
m0Jz,B
-t 4An;:|L<
`4x/U80`)
@C{he f5D)
{U5B&7
/&cC}h
$n'i6d;#H $~
6YaHq5$J
lP~cid
(1oc)<
H.TV6iO
f |\q xa
^:|j'N){
h!\yOD)[
:lzd\k/
|hjBLG
VJ!fib
,%OdS#_|
C1,8WQu}?B
*n`iBv
Psl3[lY0X)m-b
<+J6|[iEH|X,i}B&QI9T0LR
0"\Ok8"+d'
BPgtGXhxeo [
'yv4u3h
dx>n7_^CR
;,nDxluEk_
(9a8A@u7ea
\ei3ac|B'
~_~<LW+
(P!?$s
%7mq-/7gLu@
H"uDb@_
Ya)pYZc
VpFt).6
LBn2YCMd77BAg
yW0vA=rwrbC%bCrVD=
oyYv;?QV
m=JrCX'y>
FQQQ,vO37U'm|U
]>!x*1
G$)b(ynkV\
.tg<xa
upIL2^
cb-Q/=ib
A&|WQ;?
8O+ 7XP$[{
1$yhkp
mgOY~8
4eHPF*W2<P=
wwm`YT
8E0*R@Y
=ZTgRKR+
S`k@S]W
Nz+&yDkL
Sqz2Y`x
4`A;kFt
p\uz/H'hnK
qxhkLw@!
&HY\Sp
FzTQjJ;5 7D
"W>3Bk
P&TM4P"
uw\_{j
n:`h#\
u"FQ_q/oQwT5
!2^0Y*
2J{OG=8c&#:6
R!U)0-
yW*_S<4s4U
xKF'h{
)^AjY4oV
Ju/qv?^
n/F}9!?
8>$l.-
{{;Ssew
`Eq/st,
7JB=y=Q2
Bi'Lb23@
iR2i:"Un;
{_]4|:E>yC5
3G'<j-
aZA7=,nw
)HBzulF'vQ
XQ%HX-
&Ch+(Z
~{$-&R>n*qP
@+3kxk4Rj
Zg`yIr@
s-g2#)
-)0Z0?i.Y=
W2CJq`$
vb|W3*3M
$C\*P1
vY=&?$vOqt
Bt.IA|
8l<zHz
#tA~gg!X
2N1Bl
~kRZW$nO
;_HXHF
O+`d0v*.
/_!ugb)$
)<Q`BS
(uf87h`LW[2i2)=zkcF^ef%p<)BCKtb@}c
'?haO7
Wn8I)kht
sfn8&w \*
N^V8x>^Es
oK$. ^
E_`%dR ;]
%QP(6?
+n}PKIg>l
}]D'KYD_9
K7;s"%)
(z&nxf^}u|
<}JcZJ
!WrgcMo
B^/)DC
AAyESp
]?7fYiC
6A&r/E
P%hbJ6/$GR
\#Jelv
#aZ,HYWq
g=?v~ nJ3z
W_q};f8}g1d:c%@u
sBR 2E
o]TFO;F9#|b9PT$
nS ;:qz
fSuv:*(A
=x*iJ
<u#tg)M
DPP[MO%
D~!Ga<c
Z>`EWb
C5wi'?
'iM1fb
$y~('{4R ~
11=eya@F^.p
G`(s=^QIUN
1O;eg%
<jh2a,
o?_C1{96 T XZa
wK}/0[
\]1X@Hh
;c<G<r
\z!cUMFL
tGxcv:
R-B'*Cb
yK<ig}^bfS&0k`=:$&QYdt
+|\p@P2,{MaBzSf%r
] _n{Xm
cP3+"$#l
5'FF`Hum*
h5z`M2
qJxC d!,qeM~@L!8v
nMxi5k7[
%N`wG*T<kb(^
@Mf*nm
#[IOr~
3|mQ%5&
f$zDRaMx
U 21 %hE
R8x~m}
e,@wtd
5QYtP10dm
` iqW7E-
GQc]=?>IT\_L'
b@Dml0
]fol}M;9
Pic 7%
X|<F V
ThySGwN;*I
3B&-AZ
9QQ'*h
6WhYV]p_
uyzikI0
Chi.ODYcY{
o@y!<+^N|DhQ
?E1{q?-FOJ[E
5-dU)x
NJda4I
dWo`Bit5G
WQJvz>
uJ;[p@\
'8z+mDS
$`{B,CK
X*qSPuYd
9zz~-+
Iv1D(Y
_}4g}M/$X(~~;,
!F0=-(
"T!+&L.s}n
xVz)9D`Q
RKP@7@
c;fiY<c
b#roDG
L3e&mAp|:%07:1D
)+~=&.:
Y=yU)n
A&$+HR-
sYjzl5
w.Acd`9V2
y-Q'-;
cmdN2AN4W tur
8O"oRD
hu2s}g
U`[L-^(nby/8-@
cCOb0`l<
qOFVN}UW%B3^
%{qcUw9x
u_'k#0
w.L)2rp
R%|+<f9"bwu
b0)A6O18,=k~f
S=n-l1y^udOT4
keUi+A;6
:3RAo^i
PC|XEm~C
)o`6(<
y%|uxwt
yM!;IIr?;
-wkSeUGI
|7hkb0
Tv4yy%
gKHh*lN
XlV}j#
m'd{+H09gM
CW/)Eya*
0`X8#,hB6
WCck]RoQ
L_K-gR
/BzdRj~
Co.Z^5a
@$1!<$Uk/R<
}yYwyxqf
":ELw7G
W#FC;`>|G)tIj
B:1cf\"S=g5J
Vlvf4M
UKglKA{
ZQApJ`
7;tI-\1
^ K}Ux
PE{H2#
g$%~q[9z2+
}o9Pcw
!q.`+PPa^puhqY
wxHt["0
!@cD'?,I/
\OU+%:]
9z2ba=
kRd`m#o
Inj*v'BV^X
v]md=2+
H.BL}S
R*I-;ZS+/Nd
[)N;bRT
9H-yzU
0PHi.$f!
vu.2Z>s
kpl$ AY9
}0C6V?S
gb5etl
g~!qI4
]zJsD#,Y
TS&'} "
aVer >fAuF
Y"a%ED
+E51;^!EVIU'
{lUv\T
ru^E;62
^1]}]~l/ %
x}q.s\'R
@*?kmj
TS4~d62
19Ua4
_09NtO
vn(m=V
|wZ2lU9F
$N,,=,UiY
RP!"{A
k0o,mu
u][Jk|lH
=KT`7GHBtd
].-}-K
N fr|^2
o,vi iv8A"+c
S.c24J
7WXyR8>R
_CWB@4=$
TBUh` ]
f7U"<7)B6
#gJ?.%<v_
?xH4i?t
13Tn'Te
&J<\MO
U0)vC_B
r{((}U+I9J#n4jS
E9u$0>k8#
fAF:#9htji
A^[#vN
H&r:"W5X
QmBlM`:8]
dyjV"5]
qOFwRD[
}2[=:Y
)8:ae:
cP#8g%
8+sNOKIp
>m/;kxnf,gJFr
`#igQk_I
?7>>Ew
b;^=1h
4r*i!J@n
X50*] &Z]
kJxQt" 2D*
#*ZDL<h
I: w[AF7
0\[>CD!D
l8U:be
pQg$3\
,&v)qD
$5Ux,'
0X?D~K
nh<2{&zDi3w
E-7B0RwNK
, |oAeQ
/S%z^9
aO"N{.
pyRKAFb9MUmr=
u\T6> \\
Obl~zk
bYYKE"
D?.", tz
VJO($n
|?+vW0
C(q.R-/
UG2tuh
$tsr5$tO
lWFmtP
"C=W}g4
'OtlLNL
5-!$q1
MzU"cn-dlVj'9n-N
7{ohJRw
]Y)0DrH
5yoag3
4B%39?Meq
#sGl==/
lx_AR~guN
a6IG0e5
0}i1MlA
wS*G)*
u?v \ll?UtKa
^H-)juKBO[V
{y1 |&
WCZOxc
A[|KHg%
~?o)uT
fNjVD!0
Vw3l0}0Z56{
\L+D(e
8I33gV
#k[UUo=:O
^gjf+)NVSm
b9US:S
Hb*FYU
k7h?1+p|@I3BulS
aQ$8rZaT1$
Vum.7*;6
_Z/pUbe
+PrN=5jewBj+D
t;"D`9kN\
lvvv. N
f.r^_}4
!r7Xh!8
8WXR"iU
`W<tki
nRf~h9
`h$ 11
_E?<PN
<Tbq1v0?\DxH
Q9`4|(BM
+_hnKoY{EK
'k\XT9Z
;w6{Hd
6n##E?)Q
C*?7/A.
7+wt'C[
u:w}8Yq^8r wT[
xO KH=
0{yk6
rkUC$$y)'vbij
EFOJA`
j]7TZD)
Kha'g4G(
mA\ch]@;*
dQ<An$LM
{bp1gT3 o<4'"4
w@{Yc:%
tX%S&z
,OUL`Uc{jzq,A=}"
=^mA\>-38j
OW;@AR<'
Eamx~cx98
ZB/WIsVm*&Y^
-Hb'rMH
Gd _B:
AO_`:H-2\7
Bqi`}o
`~6{d9<
6-:2OH#
ql^bf\u\[#
0>A"b p=C 'fHv
=W_b."
\~KPmAO
&UU=O^
nv|d5lna
DWDIuY
kxib&;2
jt ~Fin
M7"3jL
n|hR8w4fV'
Di`?tf%Ts<P|l
R`TS4^=
+yI1@[{
kUu nGuNzn(-
gq#1r~^
+O7<^PkTy
}cBO$ F
#oU+5VT>xJX
$#J.5\
7*:=G13
CJcdZRh
G)t(*<iA
v8l!/J
,CdcWa
O3W+;D
37.=Lv
D(Y.ACUXJ
xH%W<'
qNAzU?
+LlJ:i"
^-N{ s?E"\aBRw
FmNV<FN
;HFCchA
b<~IR7
l*Xbur
5ivV;kJ|p%
Z-F&+]Y46
]SNl@#88.o$8X;
1~Wtwn2c9:i
2'fJs"qC}]J3z
B,EB[U
E7Oh4.c
l egh
(!(- j"p
ToU*UcQ
!tNp[+L*@]5
uf)id\t`
A#j?XP
F*{K9BH
|5%2IL
G` r(l
tk~y5Z#
h/(M2(6Q`T
,"ar25Z
pk~ ^Y;[TM
!sy+d=bX
()>XaV[D|
bh!MZjcP
>U&]35s
`O+iqsGIN3(&
BECD_u
GleR8@,G^V
^/ald7>1pf.7
,>7 CV
1f6x)vfh>wf}
# MT%<e7mk[XO
rZ'!az
ZLW9X/crLC<
m/h5+ f:JuG*
j=t4h7
aJz ,^
hAUo_M
@jzlpPYm
w3%x$hQaY{T
KEAbUq#Hg
@gO~{i:
F(jwb9c
:=ol\<L~~!X@
s5F:wKuUZY
dW;]11R/DDv65#D:"B9\
kIwk/!KRa
}J`~'K
nq'jhun`MJ
0fK)`SoQ
lm!Gm
kI DjC
GR}up8>
i>$O(y
<l$b'C
ork}ENcn]
=An@#|2RYuI
%;eyg0UG CO#u
"F.v} qN@a\
=f"e>@
+'3WscO
j?Uz(}}
XEP q[
PY,v9i0x
BuGt+/
v|F4*uMW [
=on]0iL9~
Uap]D2
1eF_|9yOU
k7x2lpy$=
M&h%j"
gw{n<Q
SV3Pe?A
1CrYDj
eWW>Zj8fj
d#@V~J
m\Gw`M\Z%I,
b+Oq>%g0Ynu
~^.)A<
JP.kc+
eh'x-d
/Ox)d$-Z|>KwOlIk.
sO`yD=1U(
1rH^b}|bmE.
C,eD":)
kImo<l
m9+UGR.
)m]:QhVr/6
|=Dq`u}
fc*3FC
ouAQLEX4
6^}9imqWFOZV3<95
jJu(bs
Cm0B;+ZL].^2z5
w.(Z}fm];]}
ip6!8m
fADgM%E
zJ5X>(
|9.6w
g|D7I/0
x=27YbE
WN6f(7B
p YKMxW2
p.A}/( ;
iI`;QLXp,wL
>Xj"x71#Un
%EfCzle
1]uk[pG+
z:Gcm/
4j rT,
m(u3)z^}=Rb
J7a%HZ?XKg!
1R+1--
#Lfa9~
jrS}cx?r,
Ri47lE#
X?CQc0
Jsu#z o
?AX%xhi0
""N[Z1
jHN{Q.
6c)-%L_yJa
.'>[8(* #B?[
"WSW2-v
34 Ba$
!K!6pv
;f\k^=+(_3jAFR$&$BDeW
>Dc,+>jzYKZh[
`PgV#KM
<#(8&"
L>^xu@B
,UWCre{
7PZ8hy
e&8Z">[
E/@VHW~@Dn
6lRoYIwb#<3/
H1Y;t#--
Nk?-{6w
Tp:FMl
98L=o)0n
k Z J{
TyK.#L
p,_PnK'#*Z#t
'NlG!F
{`~Z`'
<9G_d_F
1#<|rm'
C4(<|>
5x@XuD5^eMu5r#H
:vV)hRs*b
*yx35d
d kKQw
k63d[]V&
h?X^QQ#
jsu+&d
OYvUv5
vDo7:kLZXt8[
GNA*T!
\=EWh=C
8;4fby
798#@s
;jHST}
$N~}/`U
64Q3sVWo8
7u!5l-}eQ_A5#
Ng;Y q
,u:OSnoIy
m'\{+U
'Y!Jk'
;3N%b/
d%7zwgZ3}
A.,l+5Y{!=?Y1`-
vI\p|>]
6uN= BO
/YL]jp.
\-IJ>]1]gnQ
Pv]llH
GA"Ek,%s3W^
bzv/@o
GZ1"}=E
?w.n"aCyZ
/g|&dpf*i)/g
2?I~4N
!UgSD!{vL#
8MwMqkI2ui8
321- >
`r[)PBQ
hogW8
{vU}zy0m~|PQ -Fm
!{D]9;y
5U&hEt
%-q(YUg
*,(|HV_1ez7F\w
:fU|q;%`
JHF8;c!*
Cf{p}y) Z4
oQa:00UM
[|BRy0&#
%^U2gGOC
\x" l>14m]WN
w}j6(N
-?r_0Y$%$h;A+pcf
B3}}9b<)SO72ZdN2
'L,Wk$
)>'p#b9/qj
O`8Jj$iUs
mN.`[&
riG=j=`
@sH?VAd$1
#a4Iy(
es,^dz
W3E7&w
xcO7hd
RxB1{hex
,LoV^z|K
4zr]SL
3WI3$x
]d:nCIQd5H^gZ
l%(JDwakT4oob
D.8&MM
Z+q_+)
VVCMR0
lee](jC
I=,m ,d
=DXh&^ D
`<v}^Fj
U]b?b;8dd
hdzG<8
TK{S+ Y0=x
i[#zlz
uouP/`e?\
Z>*or}:
7Vp:U;8
NCW$>y"
&;|<=PNL.
]d;H{z
Sa*'JF
]G3D3`
]r! B!1O
B05ZyKc
ck7?7CihYF_v
[L vX_Wuus
DrN6x=F/8
N`BN9W
?o9!YA%z8&w:e3
x'Y[mo])
|G[:nGFX8
1fRS{g8
a@Q0apU
<x1[kvc
5#FANinx
E`&3W eI$VWn
e-?Ct:
5!.&@O
Uqj8%=s'
% {C1?xu
c0 pBGLrwzLY
*62ZMSOi^1w`+
fuNP"Lp3L
m<1^iKmxj-[Co>j$I#
"DFG*o
zaavF+$Esek+
89 Fb3U_j
f%217E^v 5
~Yu03R*-
A|Cs)gu
z%2a]8].
;GY8Ma!
"<9E{<
|N`U6y
=()t{6
Q\Q\h| N&x
y{:u8a9:
3_a'i~H{E>+T^z(y@WX
h;53:P[
_]my6"*1awJ?
KVO&bzU$
"eC/,I x
A+#!L6
rwY0Tn@HHDiNr
<I}?\[F'_g|
oTXU+4^2R<
Uk_409<t
]"`X4i
yuqvs5=
dgLk,To-
SII{/N
y%N&4~
txH^>n
v4H6q+Shp898Svq|
)9j\R"?
QCu,Cl23v-
35vF }mw9Z
{[J*tS!
,tXg ISD
L-fm".Ajc
z6*=hQ9L
\mz)!2r82
zds#WGe|
h,&t]Y)+1
sjke|a
tX3&|i!
Sljs6;RVn
GUZYC)[4'Ei
mBBjk;{"u
aT6T[*
w1twHpQ
o(TW36^
U+eN}&zH
' L`1[`L
EFs5!=
z;X9(xd
#z^}rqu
vU]K.b!\C
C+vS1 O
ziy3g}~
4cA.m$jt
>|m*R!Zkz
XCEf)drF;J(
.>2~)H
0!~dOpV-0-sVFe`
-BK"!Mi9
2% +|Lt+
&r(z!%
}:RTmh
=[8MPe|
gN!11tO
o\p([w
UY-wSGiF
^GH&yaR
ZG1{~tUQ
s2NceU7
EBmb=,
H8W-o_xI\]w]
TpK6*`
,bsh1BI]
]=N]5+uq{y
yc"Dq
u&_(}=
V;=\P^O
d{js9Rq
M.O=cl]>bm0A
._.1HIP
E/.~|l!2
*}+Xg'
!uM"7L
*<R;Id0
;Juh5LQB
qeS"^@$
g\%T./
BZM1=YB
YlgJm0
8g8`7I(
hT!k\@
Gzt7)x
B+r,s+h
=cz&;H&Y k
e`DGfy
6%6jE%*
hW^!W3
+3]&\.
MaPwfN
#3GuA)b"%
i7D\4Epny
T5}1~pOK)
`{kCs}R
&2Mk{Mh
hGlL<w
;#cO^Y)
/J YS{0
{`9~R1JI
HM8]3n
"9k<|z
nS/K~|F
%gC-)6
X$7-&9
U0x~)g
"E!P:1_
1WN}Om
RM$Z:5#L
~M9{r>
#hSuOg
Ni$Bjm"%
y$[dg"
fLd"L@zXf
:*B']D
X^}sHQY^b#,S
R;5O\m_d
WHU)M]FT|
?92WLm
Uc')[|0AS
Q}V;I:.v[
t{-OcH
G6FuCB4|=B
W[|)di
d6u58d
/1UyV>
R&tMm)dI%
_uYW%9FF'{+
@x]qyB
a}%6@x8
.ziT>-J|
z(\<El
%eQmF=
{[#/uO\&/ #2Q~x_
ZAQdoAcj
J?{L2 A
K*K&i)
B?X%&zHy
9@xYys6*
ksSiv@
%eU?+(K
_'qD4~"5a
(1<sv_Q=3m<5
>3"KRC}
q9P@5jnlj
}1P$"#
@-R*yKL>?
KAS1iK
wMX_5?N
} `Kip
ZJu1=GiD
uk9)}S
WCdU=| r!
|+iYX%;:|Q
`"WE :v
Cz H`"&PghkG_~L'6wtG}vfTs
^45u='
M>%`D@;u*
F.p'&VKg
T> z[II
p0{G>F:AZ
Kz>:dm
Ed+>SeuV3
Y^_+3hd
yv|hMq.
b'wDsR
sZl%!3eJf+
5+Xr/cm
/5dz|q
WSbfIdY-'O
:$PQd4$s
A-f/#Z\l
:ijV%V9au|Bj
qsn'CoI
nXDtM[YvV
Rw6W93={
CEM3zt
Vw@R-y&
EJM/T. |^
"yXLY|
W@ofcJ
b9hWM3
t!OK7*'6}z
K9 3t3VB
:R(HdzEzm
3R.uD /
T}vxjj
7685uAb
cw+vr.@:
BIoa&j
f|nd7Y
(M@'rY Bo
v }zgvyZ]|Mz(3YCk55`$QbiHruz$Y
1:1mksY
5H:f}>
x9DrQoK2?U+6{
*E(o*0
~f<SMW9
/+8+j@]&
;ur0%S_l
3KzS7x
8aGn.#
skAVLRQgZ
gbDWyA[Nv`P'd,
_:7!K-`
tq>_+O
`OQRX7<
>P541C
SBU,J_VL
Uo> Qtdy
B<ya)fr
k@A#83
ZBu'&DA'w5egKq5
^-o{aN
Is&8_1^
3V#foW
is!38_!YJ]h
vAGn>Vs(nx
B&_v2v7l
.;"cV`Tj
@P^%DsgN{OckOS
o@fxE;
$@6}PoyDn#f
z"Av! {N
{Tbdv>9
])"X7P
[jYm`='XmULrU
lXcAbn
@Jo3:LV
uBUjTQV
9T]{I;
gR^=VESK_
#y$6x<+9|
yV/Dey},I
!J%rZF
@ ydkC
&3RI(]
#r){mBa
rN/8=v,{Xkw
iB,Aa)-/&j?-
JLvKHs1S)i
uc6$B">Z
^oy;qOTZN
U's.E1OOk
S"J,aUMR#GkZ}[>
@^FLLGtY"CG
s-CkNbHytU."8
eqV={2
,J2PgN{q'vg@PU5{
D{7@A~
(hJC^=1~e
Ss.B<m})/ZAVo$^7R<k
"0*SuH5
a10QNlMVQee
=Xk|p&e
d^ hcq\
b[rO< *9&J
xe>zuN4!s
0<."?2
gK@W#M
|lBQ'|
S/oI W
9pz=CRY=#
T#$D273uo.(=r't
cN wP
T6MM N
Kau;/yM\2R
bRPf0ezA\O
]S7};W Pxy/T
E7} +^N,
T;+kwhV
7][brCS*
7,YVy&|%.r\+z;2
j1JO?<T
~OkXmr\&Epu,}m
DdB1y>
oW{8(>K$U
knS0&8d
*-%w9K
Zs/@zhi<
ECOyk%pI
{g`@TIOK!
e+p?iWP
d )NvRp%efhr:2
m:Vn O
l#I"@ ]
/;]x(=
yV1N4,U|`;
v;}2pM8Up
+UU&0+f
V{Q}'L
_3HJ-:
rNXo"0,@q45V
j#6->&.b
d`e-d#0ME
g>4/e2
K7CG-wx\`[
7!`1cT
m'kIfo($e
H$aklv>
5-Q7Cg;M8
/BG&?*
hoe\u5x<
7am2wh{`7^
Ri53mk| d-MMDM(y+rbH
lD8hE @
ePbK'~
x(&<Tm3tlD
@~^4#;^
5.'<~f
kp[D;1+n (
{w43\7v8W
GiYY!5eY>
Tohe)`
kg-u`6%//
gmgFn(EP
&r3!j6
_k{U5h0IoAm
1b30H"
=nP V<?d)g
|t#rgPR
7pm g_
bK'GW%7,0GdF
/au<3F^O'
09Jxo*r9;&
U%u~U6H
:Ii7P6o*Qmk
Mi]vZ)g
`#N?au4
Pm+shq
[]umlO
lYNu]6#}\C
V.36> Ej(
+6oC5#
C%xjEX
va}_j0}
#[3^kL
_8aYPD:}'
%+-qjV
pZ00m5"
.yZMDSIG
s*(F>hm&q&g
eV;[W]3a*.
;0O2@%
&7Qz-O
<,^9?asi
e:dF8i
ipV{fF89v
*'mTzb1
A@O8kK6+Ys_
;""Lw[
M?IZfH
I`au(XUm9?
Q[;aOUb
*5'd?_
#-vp]$Y
)%4p`OqSH"CV
MQoF=c
}@OnPres
Rnp,.L|Q<{=,
bj# !oMs{
Wl: ^v
t1A|t]
,cvM nuVC
|i|hg\S
Q-U9m%%.o
>.?Y$P
9GW.15eZ@
O<mX6n0V&
P;X\UUL4
mv_l{0IY,Wy
BX0Dc$
7[dy~S
-g6Dm>G}
]?"<2@
$l1K#\QW
G%Uw<'\a>t
ar3{bf@
b#UQ5
"au&<WX
XHG&,lLGK%GE
n"Vj<t
b7kLNwP=wlg`D
G6pIs.
5w*- 3{
"tt7gp]96SB'
o7Y3bJ,S
]@*nhy
Foy1]#!t=G
;F/1?"~N3"
2Mdh=u,0X:qr/iB
KvTTI"WO
%650I.
HZVJ;;Ktg
PKvu@d
q6FF"N_<+_Ka.V\z/r
n(HQ!d:]orQx
UMf@/`1
4wykYE
!i{6ZrX$
c!/:z`;t7/
c~Q&5;
G$~'` ;O}9?K
B Z!ZT03FT^U7$
H\kdC*k
m;H%MiC
#86J"(J5
k,@=[k
eE6z()Y4iAON+XM
A'av+t;v
ymB^xRpq
*0{lk~
B^L).y]
&LbZ:
#@@)YK
<O~Yb,
cjq@~v@C!R1Rlmu.g
,-#t9|7%Ziq
p49_bdFY|~0c}
HLn$Tf:Q(hz37:.|
n^MA{b
idIDt,(.c X)
3gT?6
hGomiha ciceyeye vaxudize. Ra fasumatevaku vokogumiwubota. Hutucoza mevijiharabe. Mebopoboze harupuyu citefuvukuyide. Diyejuyiwa dutoxa ze payuwe nesi. Huhosi cefu lecuzidato bojoseyatu. Talasuyi dofeda. Pobu wonayarutapera rupi xoyowahulepoki kuwucetumagik(
~~~~~~~~~~~~~~
H8RN u u u
Ej4nnn
~~~~~~~~~~~~
NRNH8 u u u u
E_____
~~~~~~~~~~~
NRNH8LA u u u
E_______
~~~~~~~~~
N__H8 u u u u
E________
l~~~~~~~
PPPPPh?
N__H8_ u
E__________
PPPPPh?h?h?__~H8________________
_PPPPPh?j4oUToUT~~~~~
______________
_PPPPPh?j4j4j4}GJ~~~~~ u u u___________
_PPPPP
Nj4j4~~~~~~ u u u u__________
____~~
__PPPPP
Nj4~~~~~~~ u u u~~~
_______
_______PPPPP
Nj4j4~~~~~~~ u u u u~~~~
_C=C=9K9K
h?______PPPPP
~~~~~~~~~ u u u~~~~~~0Y}0Y}9K
h?_____PPPPPP
~~~~~~~~~ u u u u~~~~~~~0Y}
v4v4___PPPPP
~~~~~~~~~~~ u u u u~~~~~~~
#AsAsAsv4v4v4PPPPP
~~~~~~~~~~~ u u~~~~~~~~
#AsAsAsAsAsAsPPPPPPzZ-
~~~~~~~~~~~~~~~~~~~
TTTT,cAsAsAsAsAsAsAsPPPPP
nn~~~~~~~~~~~~~~~~~
TTTTTTAsAsAs
wnnnnnWV~~~~~~~ u u~~~~~
PPPPPP
wnnnnnnWVWV~~~~ u u u~~~~~
wnnnnnnn
WVWV~~~ u u u~~~~
PPPPPAs
wnnnnnnnn
WVWVH8WV u u u u~~~
PPPPPP
wnnnnnnnn
WVWVH8WV u u u~~~
AsPPPPP
qqnnnnnWVWV
H8WV u u u u~~
v4PPPPPAsTTTTTTq!L
nnnnWVWVWV
mH8WV u u uL&L&
PPPPPP
NTTTTTT0Y}nnWVWVWVWVWV
m u u uL&L&
\l`PPPPPAs
NAsAsAsTTTTTTWVWVWV
uL&L&L&
PPPPPAs
NAsAsAsAs0Y}TTTTTTT
L&L&L&L&
PPPPPPAs
NAsAsAsAsAs0Y}0Y}0Y}TTTTTT
H8L&L&L& u
HHHH!L
wAsAsAsAsAsAsAsAsAs
mTTTTTT
L&H8L&L& u u
HHHHH!L
wv4AsAsAsAsAsAsAsAs
TTTTTTL&H8L& u u
HHHHH!L
PPPPPP
wnnAsAsAs
mAsAsAs
TTTTTTL& u
HHHHHH
*8|PPPPPc
NnnnAs
mAsAs0Y}0Y}
L&L&TTTTTT
HHHHHH
PPPPPc
mAs0Y}0Y}
L&L&L&L&L&L&TTT
HHHHHH
wPPPPPP
N&nH=H=H=H=0Y}
L&L&L&L&L&L&L&L&H8L&
HHHHHH
wPPPPP
N&&H=H=H=H=H=H=
L&L&L&L&L&L&L&L&L&H8
wPPPPP
N&&H=H=H=H=H=
L&L&L&L&L&L&L&L&L&L&H8
wPPPPP
&&&&&&H=H=H=H=
@O@OL&L&L&L&L&L&L&L&L&
AAAAAAAAAE7E7E7
AAAAAAAAE7E7E7E7
AAAAAAAAE7E7E7E7
AE7E7E7E7E7E7
E7E7E7E7E7E7
&E7E7E7E7E7E7E7
&E7E7E7E7E7E7E7
&E7E7E7E7E7E7
&E7E7E7E7E7E7
&E7E7E7E7E7
E7E7E7
&E7E7E7E7E7
E7E7E7E7
&E7E7E7E7
lE7E7E7E7E7
&E7E7E7
lE7E7E7E7E7E7
lE7E7E7E7E7E7E7
g,lE7E7E7E7E7E7E7E7
FE7E7E7E7E7E7E7E7
g,E7E7E7E7E7E7E7E7E7E7V
g,g,E7E7E7E7E7E7E7E7V
g,g,E7E7E7E7E7E7E7V
g,g,E7E7E7E7E7E7V
g,g,g,E7E7E7E7E7E7V
g,g,g,4/>E7E7E74/>4/>
g,g,g,4/>
g,g,g,g,
g,g,g,g,
g,g,g,g,g,
g,g,g,g,g,
g,g,g,g,g,
g,g,g,g,
oxoxoxox
oxoxoxoxoxoxox
oxoxoxoxoxoxoxoxoxox
oxoxoxoxoxoxoxoxoxoxoxox
oxoxoxoxoxoxoxoxoxoxoxoxox
oxoxoxoxoxoxoxoxoxoxoxoxox
oxoxoxoxoxoxoxoxoxoxoxoxox
oxoxoxoxoxoxoxoxoxoxoxoxox
oxoxoxoxoxoxoxoxoxoxoxoxox
oxoxoxoxoxoxoxoxoxoxox""
oxoxoxoxoxoxoxoxg,g,g,""
oxoxoxoxoxg,g,g,g,g,g,""
oxoxg,g,g,g,g,g,g,g,g,g,"
{g,g,g,g,g,g,g,g,g,g,"
{g,g,g,g,g,g,g,g,D* t"
%g,g,g,g,g,g,
` ]|]|]|
` ` ]|]|
` ` ` `
` ` ` ` `
]|` ` ` ` `
]|]|` ` ` ` `
` ` ` `
` ` ` ` g,g,g,g,
` ` ` ` g,g,g,
5` ` ` ` g,g,
` ` ` ` g,
}a}a5g,
` ` ` `
` ` `
5/////
/////////1111111111111////////
///////
//////////1111111111111///////
///////
///////////11111111111111///
whwhwh
///////
/////////////1111111111111
whwhwh
///////
//////////////1111111111111
whwhwh
///////
//////////
11111111111111
whwhwh
///////
1111111111111
////////
1111111111111
11111111111111
whwhwh
1111111111111
whwhwh
1111111111111
whwhwh
11111111111111
whwhwh
555555
1111111111111
whwhwh
@U@U@U@U@U@U/
1111111111111
@U@U@U@U@U@U/
@U@U@U@U@Uf)@U@U@U
11111111111111
@U@U@U@U@U@U@U@U/
@U@U@Uf)@U@U@U@U@U
@U@U@U@U@U
55@U@U55
1111111111111
whwhwh
@U@U@U@U@U@U@U/
@U@U@U@U@U@U@U@U@U
@U@U@U@U@U
@U@U55@U
1111111111111
whwhwh
@U@U@U@U@U@U@U/
f)@U@U@U@U@U@U@U@U
@U@U@U@U
@U@U@U@U@U5511111111111111S
@U@U@U@U@U@U@U@U
@U@U@U@U
@U@U@U@U@U
5551111111111111
@U@U@U@U@U
@U@U@U@U
@U@U@U@U@U
51111111111111
@U@U@U@U@U
JJ@U@U@U@U@U@U@U@U
@U11111111111111S
@U@U@U@U@U
@U@U@U@U@U@U@U@U@U@U@U@U@U@U@U@U
e1111111111111S
@U@U@U@U@U
@UJ@U@U@U@U@U@U@U@U@U@U@U@U@U@U@U
e1111111111111
@U@U@U@U@U
@UJJJ@U@U@U@U@U@U@U@U@U@U@U@U
e11111111111111
@U@UJ@U@U@U@U@U@U@U@U@U@U@U
1111111111111
J@U@U@U@U@U
_1111111111111
_11111111111111
_1111111111111
_11111111111115555
F`TF`TF`T
1111111111111155
F`TF`TF`TF`T
ttttt/
1111111111111
F`TF`TF`TF`T
1111111111111
F`TF`TF`T
1111111111111
F`TF`T#
11111111111111
1111111111111
1111111111111
11111111111111
1111111111111
1111111111111
tttttt
11111111111111
tttttttt
1111111111111
tttttttttt
1111111111111
tttttttttttt
11111111111111
F`TF`T
tttttttttttt
1111111111111
F`TF`T
tttttttttt
1111111111111
F`TF`T
tttttttt
11111111111111
F`TF`T
tttttt
1111111111111
1111111111111
_JHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJH
JHJHJH
11111111111111
_JHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJH
JHJHJHJHJHJHJHJHJHJHJHJHJHJHJH1111111111111JHJHJHJHJHJHJHJH
JHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJH
JHJHJHJHJHJHJHJHJHJHJHJHJHJHJH1111111111111JHJHJHJHJHJHJH
JHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJH
JHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJH#
11111111111111JHJHJHJHJH
JHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJH
JHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJH#
1111111111111JHJHJHJH
JHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJH
JHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJH
1111111111111JHJHJH
JHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJH
JHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJH
1111111111111JHJH
JHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJH
JHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJHJH
11111111111JHJH
JHJHJHJHJHJHJHJHJHJHJHJHJH
JH1111111111JHJH
111111111
1111111
0R00000Q111
2W222333
4E4b44444
7 7=7E7f7x7
777777
8)878::;; <(<w<<<B=t={===
?)?E?e?q??
00/1122r3333
4"4044444a5t55Z6666
7%7+7:7C7777v88888
9&9T9^9t999999
:#:?:e:p:::::::::
>,>2>8>?>H>O>U>\>h>z>>>>>>>X?????
*0j000000000 1=1D1H1L1P1T1X1\1`111111"2-2H2O2T2X2\2}22222222222F3L3P3T3X3333,424>4u44444
5-555555555
6*656O6Z6b6r6x666666
8%8/858I8a888888888884999C999
;4;;;C;H;L;P;y;;;;;;;;;;;*<0<4<8<<<<<<<<<<<'=Y=`=d=h=l=p=t=x=|======2>e>>v???
3.3j3q3y3333
4)4.434J4f55K6m66666%7@7Q7778
9 :$<T<<<
>9>A>m?
0K0U0a0m0y000 1%1411111"2k2
33R4Z444F5R555568J9`9j9t999999
:E:N:Z::::::
;$;*;0;6;<;C;J;Q;X;_;f;m;u;};;;;;;;;;;;;;;;
<~=======<>B>L>>>>>>>?????
00070P0d0j0s0000>1^1h1111111
2"2Q2W2_22222222
3q3z33
4h4355555666
7 7-737g7n7z7777777777777777
8%8:8`8888888
909999
:`:f:|:::::::::::::::::::::
;);/;7;<;D;I;Q;V;];l;q;w;;;;;;;
<+<1<7<<<<
=1=7===
?'?~????
0 0*0E0M0S0a00000
111?3L3U33333*454?4P4[4
6,646:6?6E66666G7S7m7777
8$8k8u88888*9<9j999999999
:-:5:@:S:!;B<;== ?
4*6m7s7T8Z8
3B4d4v44444
6#6+636Y66666
7.7@7R7d7v7777Q:::
;_;;;J<
=;====
i0z0000000 1+151N1X1k1111
2~222S3r333
434;4C4Z4s44444444
767J7^77
8888::;;;;2<v<<<<4=G=v==
22222222222222222
3 3$3(3,3034383D3g3
4V6u66777k888
9!929:9@9J9P9Z9`9j9s9~9999999
< <<1======?
0A466f7o7777777777777
8+818Z8888888"9(929<9F9L9c9j9v99999999999
:1:K:S:[:f:o:u::::::::::::::::::::";b;;;><I<[<r<<<W=q=z==
6688888D9Q9}9999t::::::I;U;];i;;;;
<6<X<====9>>H??
{0|1111111111^2222
3&3N3W3`3v3333333333
4d4h4l4p4t4x4|44444444
55N6\8l:`;=
?4?J?`?h??
0N1x1132W4i4{44444
5566I7*888i9o9}9
:0:j::;;<{=
>>>>j???
3^6b6f6j6n6r6v6z6~66666Y77777#8
6\6666
777Z7}7777
8'838=8I8S8_8l8p8w8{88888888888
\1`1d1h1l1p1t1x11111111111111111111
2 2$2(2,202<2@2D2H2L2P2T2x2|2222222222222222222222233333333333
555555555555555
6$6,6467777
H3P3X3`3h3p3x33333333333333333
4 4(40484@4H4P4X4`4h4p4x44444444444444444
5 5(50585@5H5P5X5`5h5p5x55555555555555555
6;;;;;;;;;;
< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\<`<d<h<l<p<t<x<|<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
= =$=(=,=0=4=8=<=@=D=H=L=P=T=X=
? ?$?(?,?0?4?8?<?@?D?H?L?P?T?X?\?`?d?h?l?p?t?x?|?????????????????????????????
:::::::::::
;$;(;8;<;@;H;`;p;t;;;;;;;;;;;;;;
< <$<(<0<H<X<\<l<p<t<|<<<<<<<<<<<<
=4=D=H=X=\=l=p=t=|==========
>(>8><>L>P>T>X>\>d>|>>>>>>>>>>>>>>>
?,?0?4?<?T?d?h?x?|????????????
0 0$0(0,00040<0T0d0h0x0|00000000000000000
1$14181H1L1P1T1X1`1x1111111111111
2 20242D2H2P2h2x2|2222222222222
3 383<3T3d3h3x3|33333333<4D4P4p4|444444444444
5(5H5d5h555555
6 6<6@6`6666666666
7(7L7X7`7777777777777
808P8p8x888888888888
9 9(9<9D9H9P9X9`9t9|99999999999999
:X:h:|::::::::
; ;@;L;l;x;;;;;;;,<0<
0$0P0|0000000000
1,111114444444444
5 5$5(5,5054585<5@5D5H5L5P5T5X5\5`5d5h5l5p5t5x5|5555555555555555555555555555555
6 6$6(6,6064686<6@6D6H6L6P6T6X6\6`6d6h6l6p6t6x6|666666666666666666666666666666
7 7$7(7,7074787777777
8 8@8D8H8L8P8T8X8\8`8d8p8t8x8|888888<==
?H????
000P0l00000,141<1D1L1T1\1d1l1t1|11111111111111111
MTU7MTU=
@ @ @ @ @ @
m s c o r e e . d l l
( ( ( ( ( H
h ( ( ( ( H
H
A K E R N E L 3 2 . D L L
r u n t i m e e r r o r
T L O S S e r r o r
S I N G e r r o r
D O M A I N e r r o r
- A t t e m p t t o u s e M S I L c o d e f r o m t h i s a s s e m b l y d u r i n g n a t i v e c o d e i n i t i a l i z a t i o n
T h i s i n d i c a t e s a b u g i n y o u r a p p l i c a t i o n . I t i s m o s t l i k e l y t h e r e s u l t o f c a l l i n g a n M S I L - c o m p i l e d ( / c l r ) f u n c t i o n f r o m a n a t i v e c o n s t r u c t o r o r f r o m D l l M a i n .
- n o t e n o u g h s p a c e f o r l o c a l e i n f o r m a t i o n
- A t t e m p t t o i n i t i a l i z e t h e C R T m o r e t h a n o n c e .
T h i s i n d i c a t e s a b u g i n y o u r a p p l i c a t i o n .
- C R T n o t i n i t i a l i z e d
- u n a b l e t o i n i t i a l i z e h e a p
- n o t e n o u g h s p a c e f o r l o w i o i n i t i a l i z a t i o n
- n o t e n o u g h s p a c e f o r s t d i o i n i t i a l i z a t i o n
- p u r e v i r t u a l f u n c t i o n c a l l
- n o t e n o u g h s p a c e f o r _ o n e x i t / a t e x i t t a b l e
- u n a b l e t o o p e n c o n s o l e d e v i c e
- u n e x p e c t e d h e a p e r r o r
- u n e x p e c t e d m u l t i t h r e a d l o c k e r r o r
- n o t e n o u g h s p a c e f o r t h r e a d d a t a
- a b o r t ( ) h a s b e e n c a l l e d
- n o t e n o u g h s p a c e f o r e n v i r o n m e n t
- n o t e n o u g h s p a c e f o r a r g u m e n t s
- f l o a t i n g p o i n t s u p p o r t n o t l o a d e d
A M i c r o s o f t V i s u a l C + + R u n t i m e L i b r a r y
< p r o g r a m n a m e u n k n o w n >
R u n t i m e E r r o r !
P r o g r a m :
H H : m m : s s
d d d d , M M M M d d , y y y y
M M / d d / y y
D e c e m b e r
N o v e m b e r
O c t o b e r
S e p t e m b e r
A u g u s t
F e b r u a r y
J a n u a r y
S a t u r d a y
F r i d a y
T h u r s d a y
W e d n e s d a y
T u e s d a y
M o n d a y
S u n d a y
W U S E R 3 2 . D L L
k e r n e l 3 2 . d l l
@ @ @ @ @ @ @ @ @ @
A A A A A A A A A A
A A A A A A A A
D E S U H A N U D I W U T O G O G I D I F E
T A F E P I J I W A G E K U W I Z U M E D E L O
T I X E B A L E W U F E V U J O K A
X E P U V E M I R A Z E L E R I N E K A
X N N T T I
Z A C A C U D I C U Z O D A N E C O
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
4 6 7 8 3 2 3 b 0
P r o d u c t V e r s i o n
2 . 1 3 . 5 . 6 6
V a r F i l e I n f o
T r a n s l a t i o n
Process Tree
-
029828d7788b0f6b1c50a16ae051dee0d289457423b90775e3c1c5c09943b7a0.exe (1932)
"C:\Users\Administrator\AppData\Local\Temp\029828d7788b0f6b1c50a16ae051dee0d289457423b90775e3c1c5c09943b7a0.exe"
- nslookup.exe (2708) nslookup carder.bit ns1.wowservers.ru
- nslookup.exe (1188) nslookup ransomware.bit ns1.wowservers.ru
- nslookup.exe (856) nslookup carder.bit ns2.wowservers.ru
- nslookup.exe (2328) nslookup ransomware.bit ns2.wowservers.ru
029828d7788b0f6b1c50a16ae051dee0d289457423b90775e3c1c5c09943b7a0.exe, PID: 1932, Parent PID: 2600
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 2708, Parent PID: 1932
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 2328, Parent PID: 1932
default registry file network process services synchronisation iexplore office pdf
Hosts
| IP |
|---|
| 114.114.114.114 |
| 107.178.223.183 |
| 8.8.8.8 |
DNS
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 57665 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 51758 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52215 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52216 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 52217 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 52218 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 52219 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 52220 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62361 | 114.114.114.114 | 53 |
| 192.168.56.101 | 62361 | 8.8.8.8 | 53 |
| 192.168.56.101 | 62362 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62363 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62364 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62365 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62366 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62367 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62368 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62369 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62370 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62371 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62372 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62373 | 107.178.223.183 ns2.wowservers.ru | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | a3d23406381a17b7_amzsuf.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Roaming\Microsoft\amzsuf.exe |
| Size | 249.5KB |
| Processes | 1932 (029828d7788b0f6b1c50a16ae051dee0d289457423b90775e3c1c5c09943b7a0.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | 8a3e9db505282b87c660c97c3e304a30 |
| SHA1 | d51d9f6bee96c60177299ecc82d79579f5f24027 |
| SHA256 | a3d23406381a17b7aeb843edc8229775a538df9e871607f5ff7c190e93cb9cf1 |
| CRC32 | 413C3F4A |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.