3.3
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.83
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | Ransom:Win32/Gandcrab.56f | 20190527 | 0.3.0.5 |
| Avast | Win32:RansomX-gen [Ransom] | 20240404 | 23.9.8494.0 |
| Baidu | None | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (W) | 20231026 | 1.0 |
| Kingsoft | malware.kb.a.1000 | 20230906 | None |
| McAfee | Packed-FEI!B19B4DE7EEF5 | 20240403 | 6.0.6.653 |
| Tencent | Trojan.Win32.Gandcrypt.zd | 20240404 | 1.0.0.1 |
静态指标
查询计算机名称
(1 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545301.0 GetComputerNameW |
computer_name:
TU-PC
|
success | 1 | 0 |
使用Windows API生成加密密钥
(3 个事件)
检查系统中的内存量，这可以用于检测可用内存较少的虚拟机
(36 个事件)
文件包含未知的 PE 资源名称，可能指示打包器
(4 个事件)
| resource name | DAREJAXULADAWIMIDUVI |
| resource name | KUPOVE |
| resource name | LERALUWAFUJOJOXARUKU |
| resource name | LNN |
动态指标
分配可读-可写-可执行内存（通常用于自解压）
(20 个事件)
查询磁盘大小，可用于检测具有小固定大小或动态分配的虚拟机
(1 个事件)
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Roaming\Microsoft\miobzn.exe |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Roaming\Microsoft\miobzn.exe |
检查适配器地址以检测虚拟网络接口
(35 个事件)
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(2 个事件)
| section | {'name': '.rsrc', 'virtual_address': '0x00898000', 'virtual_size': '0x00024328', 'size_of_data': '0x00024400', 'entropy': 7.839317551865134} | entropy | 7.839317551865134 | description | 发现高熵的节 | |||||||||
| entropy | 0.4793388429752066 | description | 此PE文件的整体熵值较高 | |||||||||||
使用 Windows 工具进行基本 Windows 功能
(4 个事件)
| cmdline | nslookup zonealarm.bit ns1.corp-servers.ru |
| cmdline | nslookup ransomware.bit ns2.corp-servers.ru |
| cmdline | nslookup ransomware.bit ns1.corp-servers.ru |
| cmdline | nslookup zonealarm.bit ns2.corp-servers.ru |
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
Attempts to identify installed AV products by installation directory
(1 个事件)
| file | C:\MalwarebytesLABs |
在 Windows 启动时自我安装以实现自动运行
(2 个事件)
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\lospniuinxu | reg_value | "C:\Users\Administrator\AppData\Roaming\Microsoft\miobzn.exe" | ||||||
| file | C:\Windows\win.ini | ||||||||
文件已被 VirusTotal 上 65 个反病毒引擎识别为恶意
(50 out of 65 个事件)
| ALYac | Trojan.GenericKDZ.43689 |
| APEX | Malicious |
| AVG | Win32:RansomX-gen [Ransom] |
| Acronis | suspicious |
| AhnLab-V3 | Win-Trojan/Gandcrab01.Exp |
| Alibaba | Ransom:Win32/Gandcrab.56f |
| Antiy-AVL | Trojan/Win32.Chapak |
| Arcabit | Trojan.Generic.DAAA9 |
| Avast | Win32:RansomX-gen [Ransom] |
| Avira | TR/GandCrab.ohxwq |
| BitDefender | Trojan.GenericKDZ.43689 |
| BitDefenderTheta | Gen:NN.ZexaF.36802.syX@aOr0p1i |
| Bkav | W32.AIDetectMalware |
| CAT-QuickHeal | Trojan.Chapak.ZZ5 |
| ClamAV | Win.Malware.Generickdz-6981685-0 |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cybereason | malicious.7eef55 |
| Cylance | unsafe |
| Cynet | Malicious (score: 100) |
| DeepInstinct | MALICIOUS |
| DrWeb | Trojan.Encoder.24384 |
| ESET-NOD32 | a variant of Win32/Injector.DXNW |
| Elastic | malicious (high confidence) |
| Emsisoft | Trojan.GenericKDZ.43689 (B) |
| F-Secure | Trojan.TR/GandCrab.ohxwq |
| FireEye | Generic.mg.b19b4de7eef557ce |
| Fortinet | W32/Kryptik.GUKZ!tr |
| GData | Trojan.GenericKDZ.43689 |
| Detected | |
| Gridinsoft | Trojan.Win32.Kryptik.bot!s1 |
| Ikarus | Trojan-Ransom.GandCrab |
| Jiangmin | Trojan.Chapak.he |
| K7AntiVirus | Trojan ( 003e58dd1 ) |
| K7GW | Trojan ( 003e58dd1 ) |
| Kaspersky | HEUR:Trojan-Ransom.Win32.GandCrypt.gen |
| Kingsoft | malware.kb.a.1000 |
| Lionic | Trojan.Win32.GandCrypt.tqMB |
| MAX | malware (ai score=83) |
| Malwarebytes | Generic.Malware.AI.DDS |
| McAfee | Packed-FEI!B19B4DE7EEF5 |
| MicroWorld-eScan | Trojan.GenericKDZ.43689 |
| Microsoft | Ransom:Win32/Gandcrab.SF!MTB |
| NANO-Antivirus | Trojan.Win32.Chapak.faoyos |
| Panda | Trj/Genetic.gen |
| Rising | Trojan.Injector!1.B23B (CLASSIC) |
| SUPERAntiSpyware | Ransom.GandCrab/Variant |
| Sangfor | Ransom.Win32.Save.a |
| SentinelOne | Static AI - Malicious PE |
| Skyhigh | BehavesLike.Win32.Generic.fh |
| Sophos | Mal/Agent-AUL |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2018-04-23 14:25:34
PE Imphash
3b9f030e1db7d97ee45a3b9330ae9ed1
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x0001a9df | 0x0001aa00 | 5.770573979511077 |
| .rdata | 0x0001c000 | 0x00004831 | 0x00004a00 | 3.122477096795141 |
| .data | 0x00021000 | 0x00874de4 | 0x00001800 | 1.564842178372034 |
| .idata | 0x00896000 | 0x00001f6c | 0x00001400 | 3.767645961868692 |
| .rsrc | 0x00898000 | 0x00024328 | 0x00024400 | 7.839317551865134 |
| .reloc | 0x008bd000 | 0x0000559f | 0x00005600 | 1.6346573888768086 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| DAREJAXULADAWIMIDUVI | 0x00898784 | 0x0000030a | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| KUPOVE | 0x00898a90 | 0x00000e79 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| LERALUWAFUJOJOXARUKU | 0x0089990c | 0x00000144 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| LNN | 0x00899a50 | 0x00018894 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_BITMAP | 0x008b5c0c | 0x00003838 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_BITMAP | 0x008b5c0c | 0x00003838 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_ICON | 0x008b9444 | 0x000025a8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x008bc1b4 | 0x00000038 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x008bc1b4 | 0x00000038 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x008bc1b4 | 0x00000038 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x008bc1b4 | 0x00000038 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x008bc1b4 | 0x00000038 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x008bc1b4 | 0x00000038 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x008bc1b4 | 0x00000038 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x008bc1b4 | 0x00000038 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x008bc1b4 | 0x00000038 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x008bc1b4 | 0x00000038 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x008bc1b4 | 0x00000038 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x008bc1b4 | 0x00000038 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x008bc1b4 | 0x00000038 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x008bc1b4 | 0x00000038 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x008bc1b4 | 0x00000038 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x008bc1b4 | 0x00000038 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x008bc1b4 | 0x00000038 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x008bc1b4 | 0x00000038 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x008bc1b4 | 0x00000038 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x008bc1b4 | 0x00000038 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x008bc1b4 | 0x00000038 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x008bc1b4 | 0x00000038 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_ACCELERATOR | 0x008bc2e4 | 0x00000030 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_ACCELERATOR | 0x008bc2e4 | 0x00000030 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_ACCELERATOR | 0x008bc2e4 | 0x00000030 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_GROUP_ICON | 0x008bc314 | 0x00000014 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
Imports
Library KERNEL32.dll:
• 0xc9635c LocalFileTimeToFileTime
• 0xc96360 GetThreadContext
• 0xc96364 CreateConsoleScreenBuffer
• 0xc96368 GetMailslotInfo
• 0xc9636c FlushFileBuffers
• 0xc96370 TlsGetValue
• 0xc96374 IsDBCSLeadByte
• 0xc96378 LocalAlloc
• 0xc9637c GetTempPathA
• 0xc96380 FindVolumeMountPointClose
• 0xc96384 GetConsoleOutputCP
• 0xc96388 VirtualProtect
• 0xc9638c CreateMailslotA
• 0xc96390 lstrlenW
• 0xc96394 EnumSystemLocalesA
• 0xc96398 GetLocaleInfoA
• 0xc9639c GetUserDefaultLCID
• 0xc963a0 CreateFileW
• 0xc963a4 SetStdHandle
• 0xc963a8 SetFilePointer
• 0xc963ac WriteConsoleW
• 0xc963b0 CloseHandle
• 0xc963b4 SetCommBreak
• 0xc963b8 GetModuleFileNameW
• 0xc963bc SetDefaultCommConfigA
• 0xc963c0 SetFileShortNameW
• 0xc963c4 GetNumberOfConsoleMouseButtons
• 0xc963c8 WriteProfileSectionA
• 0xc963cc GetConsoleCP
• 0xc963d0 DosDateTimeToFileTime
• 0xc963d4 HeapSize
• 0xc963d8 GetStringTypeW
• 0xc963dc LCMapStringW
• 0xc963e0 GetCommandLineW
• 0xc963e4 HeapSetInformation
• 0xc963e8 GetStartupInfoW
• 0xc963ec IsProcessorFeaturePresent
• 0xc963f0 EnterCriticalSection
• 0xc963f4 LeaveCriticalSection
• 0xc963f8 DecodePointer
• 0xc963fc UnhandledExceptionFilter
• 0xc96400 SetUnhandledExceptionFilter
• 0xc96404 IsDebuggerPresent
• 0xc96408 EncodePointer
• 0xc9640c TerminateProcess
• 0xc96410 GetCurrentProcess
• 0xc96414 GetProcAddress
• 0xc96418 GetModuleHandleW
• 0xc9641c ExitProcess
• 0xc96420 WriteFile
• 0xc96424 GetStdHandle
• 0xc96428 FreeEnvironmentStringsW
• 0xc9642c GetEnvironmentStringsW
• 0xc96430 SetHandleCount
• 0xc96434 InitializeCriticalSectionAndSpinCount
• 0xc96438 GetFileType
• 0xc9643c DeleteCriticalSection
• 0xc96440 TlsAlloc
• 0xc96444 TlsSetValue
• 0xc96448 TlsFree
• 0xc9644c InterlockedIncrement
• 0xc96450 SetLastError
• 0xc96454 GetCurrentThreadId
• 0xc96458 GetLastError
• 0xc9645c InterlockedDecrement
• 0xc96460 GetCurrentThread
• 0xc96464 HeapCreate
• 0xc96468 HeapDestroy
• 0xc9646c QueryPerformanceCounter
• 0xc96470 GetTickCount
• 0xc96474 GetCurrentProcessId
• 0xc96478 GetSystemTimeAsFileTime
• 0xc9647c Sleep
• 0xc96480 HeapFree
• 0xc96484 FatalAppExitA
• 0xc96488 GetCPInfo
• 0xc9648c GetACP
• 0xc96490 GetOEMCP
• 0xc96494 IsValidCodePage
• 0xc96498 MultiByteToWideChar
• 0xc9649c RtlUnwind
• 0xc964a0 SetConsoleCtrlHandler
• 0xc964a4 FreeLibrary
• 0xc964a8 InterlockedExchange
• 0xc964ac LoadLibraryW
• 0xc964b0 GetLocaleInfoW
• 0xc964b4 HeapAlloc
• 0xc964b8 HeapReAlloc
• 0xc964bc WideCharToMultiByte
• 0xc964c0 GetConsoleMode
• 0xc964c4 IsValidLocale
Library USER32.dll:
• 0xc9653c HiliteMenuItem
• 0xc96540 LoadAcceleratorsW
• 0xc96544 GetPropW
• 0xc96548 GetMenuInfo
• 0xc9654c RemovePropW
• 0xc96550 AppendMenuA
• 0xc96554 SetDlgItemInt
Library GDI32.dll:
• 0xc96310 AddFontResourceW
• 0xc96314 CreateICW
• 0xc96318 PolyDraw
• 0xc9631c ResetDCW
• 0xc96320 SetICMProfileA
• 0xc96324 GetGlyphOutlineA
• 0xc96328 TranslateCharsetInfo
L!This 1ZuV
m cannot be run in DOS mode.
.OOO9oO9[O7bOOO9ZO9kO9lORichO
`.rdata
@.data
.idata
@.reloc
EEU@UM
E@EEHE
u P5tM
YYt|+ ;u
@;u`3@
uNSW<`;
ItWhtFlt
3F tBP
itqnt(o
PWP5!B
cj0XfQf>
t-RPSWB
u(~"j O)Yt
u(~"j0OYt
`pM_^3[?
ffffffE
YM_3[>
3PPPPP
3VPPPPPj
3^]h02@
1E3PeuEEEEd
Y__^[]Q
E_^[]E
9csmu)=dJ
p u39E
N<VkYe
8csmu*x
AYYuTVWhB@
3PPPPP
@Y<v*Ve
^SSSSSyj
;tFtA3
M_^3[3
S^`N`H
j$Y~\d9
QY^`[_^]
Ucsm9E
PYY]3]
tAVWPgb
3Y[_^5;
3PPPPPM
UQV3W}
ft;uf t
Bf8\tf8"u8
ft$9Uu
UQQSVWh
V33SfC
[]YY?sJM
_[^SVWb`
j@j ^VD
H3H/5@I
;rSWf9M
YYt:V50
~lt#W2
YYt0V50
E3E3;u
YYu,9E
W>+~,WPV
Y/V|Yt
Y}3u;5]
tVPVYY3BUpJ
F$|3@_^
WPWPWv
8]tEMap<u
TM_^3[
Y^hS=Ld
USV5Ld
3W;to=
uVtY_^[]
t4V0;t(W8jYt
Fpt"~l
lVYYYEE
t.VFYt"V:
Yt.VYt"V
VYt.VYt"V
]39}~0N
D=VPIm
YYtG;}|fE
YYM_^3[
ItUhtDlt
HHtXHHt
4itqnt(o
PWP5!B
t-RPSW
0@?If90t
;u+(;u
u'~! O
`pM_^3[
tAt2t$
E`p;39]
URPQQhpo@
t;T$4t
;v.4v\
UVWS33333[_^]
33333USVWj
_^[]Ul$
B(;r3_^[]
1E3PEd
t4+t$+t
ItQht@lt
3F tBP
itmnt$o
PWP5!B
cj0XfQf>
t-RPSW
u(~"j OSYt
u(~"j0OYt
j O'Yt
`pM_^3[6
ji_jdZf;t]f;t6ot1ut,xt'Xt"f;t
fXulf;t
3Af;t!f;t
3@;uHE
xdT|f;
~7pf8$u+
3HP|th
ItWhtFlt
dtAit<ot7ut2xt-Xt(d
LtF\P
P@WP5!B
j0Xf`XQfbtc
j@th9u
t-RPSW08
FF9|?9u
8u(~"lj OYt
lj OYt
ue39x|[NIt2It/It%It"It&II
`pM_^3[}
3WY}9}
9~\u'5xA
Y+t"+t
+tY+uCe}
u>OdMGd
u wdSUY
UQV5xE
zuxVVu
ptXFVPzYYtHptSu
3YY;u!9tt
YM_^3[
NQSVPBY
SY3WWWWWg}
UQSV5c
Eu}h(A
3M_^3[
ft'Ou"+
jPfDJXdf
DDDDDDDDDDDDDD
woVW=C
m0f0_^
Y3MW0u
W34809}
4 3,9E
P4UM`8
PYt:4+
DQP C@
,PVEP$
3+4H;M
(PVHP$
(PVHP$
r3VVhU
QH++PPVh
(P+P5P$
\,+48;E
B0?DFY1$
8+0[M_3^%j
S3VW;~ E
@;u+H;}
39](SSu
]9]tWuu
};~Bj3X
3;t?uWuuu
t"SS9] u
EWYuEYe_^[M3=
ou(Eu$u u
ES3VW]9]
39] SSu
ESEYe_^[M3
Mmu$Eu
Pj1SEj
Pj2SEj
Pj3SEj
Pj4SEj
Pj5SEj
Pj6SEj
PXVj7S
F Pj*SEj
F$Pj+Sj
F(Pj,SEj
F,Pj-SEj
F0Pj.SEj
F4Pj/SEj
Pj0SEj
F8PjDSEj
F<PjESEj
F@PjFSEj
FDPjGSEj
FHPjHSEj
FLPjISEj
FPPjJSEj
FTPjKSEj
FXPjLSEj
F\PjMSEj
F`PjNSEj
FdPjOSEj
FhPj8SEj
FlPj9SEj
FpPj:SEj
FtPj;SEj
FxPj<SEj
F|Pj=SEj
Pj>SEj
Pj?SEj
Pj@SEj
PjASEj
PjBSEj
PjCSEj
Pj(SEj
Pj)SEj
Pj uEj
Pj uEj
Pj1SEj
Pj2SEj
Pj3SEj
Pj4SEj
Pj5SEj
Pj6SEj
Pj7SEj
Pj*SEj
Pj+SEj
Pj,SEj
Pj-SEj
Pj.SEj
Pj/SEj
Pj0SEj
PjDSEj
PjESEj
PjFSEj
PjGSEj
PjHSEj
PjISEj
PjJSEj
PjKSEj
PjLSEj
PjMSEj
PjNSEj
Pj8SEj
Pj9SEj
Pj:SEj
Pj;SEj
Pj<SEj
Pj=SEj
Pj>SEj
Pj?SEj
Pj@SEj
PjASEj
PjBSEj
PjCSEj
Pj(SEj
[ESPUP
Pj uESP:
Pj uESP"`
v0~v4vv
nv8fv<^@v@SvDKvHCvL;vP3vT+vX#v\
vlvpvtvxv|
WGW/YY
3_^[]28
u^[<;uX
PwYv4;5L"B
W3u}9~
3_^[28
u^[<;uX
P}YFD;
PkYFH;
PYYvL;5d"B
W3}u}9~
C PjPVEj
C$PjQVEj
C*PjTVEj
C+PjUVEj
C,PjVVEj
C-PjWVEj
C.PjRVEj
C/PjSVEj
CHPjPVEj
CLPjQVEj
t$SSuu
@4MC43@3
3_^[a~Hl;
u,[W ;t
u,U ;t
^0lfVu
M3WE9X
f;v6;t
Map_^[;t&;w fj"^0e8]tE`py
<E`p0M
kWSVhO
fRp u39E
d<VSYe
USVWUj
P(RP$R
UPjh`@
t:|$,t
;t$,v-4v
UQPXY]Y[
UQSV`G
@u^V2~Y
t4+t$HHt
ItUhtDlt
HHtYHHt
2itmnt$o
PWP5!B
t-RPSW0
0@@If8
u'~! O
`pM_^3[2
d:tM<it-<ot)<ut%<xt!<Xt
3@;uKF
UQSV"SG
HLhD\Bd;u*9R
@u^VUpY
4lX`Pp
~2d8$u'
ItUhtDlt
<it|<otx<utt<xtp<Xtl`\
PRYYt1H
HHtiHHt
tnDf9u
V_YPtt
Pt8SP5!B
n@tl9u
t-tRPSW
;u+,9u
tu'~!H OEt
uW9uO9l|GHIt
`pM_^3[8}
UYYuf-u
Yu)jAXf;w
u+9uv&7>E
S3VW9]
3_^[];t
^0y<9]
B:t"Ou
3;tuSu
t VV9u
e_^[M3
FGIuX^_]
EU_^j
S3VW;|[;
t6<0t0=
QY3C]~
u}uyG,j@j KYYEta
z33}2E
V,YQL$
~.8]t)E
WPEW@Ph
~U8]tPMM
uxGYoukGucGu[GuSG3
3M_^3[jsA
u+9uv&*E
E`p3_[^
f;rJvf;
f;rJvf;
f;rJvf;
Jvf;rgQ
Pf;rSPf;
EPQEPEj
4>YYuu
USW339]
|^_[]SSSSS#
SSSSSv#hA
.t|PVj@u
@sh_tcPE
k_^[]3PPPPP=USVu
]SSSSSN"
vP;YFTt
vT;YEfT
FP~HZ3PPPPP:!u;FP=\d
vP;YFT;t
vTi;YFh^T^L^P^H_[
3PPPPP
YP;s,Vh
VVVVV3M_^3[
SWph3S\PPPh
3M_3[\
Pt]7YYltCHphD
Pd8PSF
d|-tt#
Yt1hlCH}6HYX
446sT,6cL
Y3PPPPP
6TY9pt
uTlh=xxPtYt
3xSSSh
;t\~Ht57xP
3M_^3[W
3_^]Wh
V3YWh
6p3Vj3Y
6?6@V53
c;YYt#v
36?6N@V
/-uANp
6Y}Nle
~lSW@S>
u67h!B
|@YY!B
S=>S>YYE
3_^]UV3PPPPPPPPU
U3S3@9]
|FVWt>E
VYYt:hA
r3@]3]
V3 AB<
3);ut!}
0WVLY;_t3@^
tEP6'1
t,PEP62
Y3Yu0N
t<6JKY;F
t/EP630
M_^3[`O
@\EP6/
t*EP6m/
VP?YYt
USVWb$
3PPPPP
t,j@C@Ph
3uyA;Bti
3uA;Btx
qA;Btw
_A;Btw
-A;Btw
mfAf;B
GA;Btw
5A;Btw
#A;Btw
3uP;Qtu
tP;Qtu
eP;Qtu
MP;Qtu
?P;Qtu
0P;Qtu
(P;Qtu
{P;Qtu
mP;Qtu
^P;Qtu
uP;Qtu
rustnM
tR:QuMPt<:Qu7Pt&:Qu!Pt
@FA;r3^[
+UV3PPPPPPPPU
;t_+^]
VSMYY1+W
U]U]Uj
E`p]Ex
tAMap8+
;t+3_^[
USV3;u
^0]u39]
G;r3_^[]
RQMQVp
VuW]]Mx
E;ErGE9Eu
3;Er3w
u>9ur9w
]UWVSM
Xejili zuyo wi jufebodoyi
Vibibozuve mayu
Xoti wiro zacoyemibati yupihalo
Dikicisupizi pikarebe givinenasabu
Mofipasica jocowe nodi
CorExitProcess
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
(null)
`h````
xpxxxx
SystemFunction036
GetProcessWindowStation
GetUserObjectInformationW
GetLastActivePopup
GetActiveWindow
MessageBoxW
!"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
`h`hhh
xppwpp
LC_TIME
LC_NUMERIC
LC_MONETARY
LC_CTYPE
LC_COLLATE
LC_ALL
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
united-states
united-kingdom
trinidad & tobago
south-korea
south-africa
south korea
south africa
slovak
puerto-rico
pr-china
pr china
new-zealand
hong-kong
holland
great britain
england
britain
america
swedish-finland
spanish-venezuela
spanish-uruguay
spanish-puerto rico
spanish-peru
spanish-paraguay
spanish-panama
spanish-nicaragua
spanish-modern
spanish-mexican
spanish-honduras
spanish-guatemala
spanish-el salvador
spanish-ecuador
spanish-dominican republic
spanish-costa rica
spanish-colombia
spanish-chile
spanish-bolivia
spanish-argentina
portuguese-brazilian
norwegian-nynorsk
norwegian-bokmal
norwegian
italian-swiss
irish-english
german-swiss
german-luxembourg
german-lichtenstein
german-austrian
french-swiss
french-luxembourg
french-canadian
french-belgian
english-usa
english-us
english-uk
english-trinidad y tobago
english-south africa
english-nz
english-jamaica
english-ire
english-caribbean
english-can
english-belize
english-aus
english-american
dutch-belgian
chinese-traditional
chinese-singapore
chinese-simplified
chinese-hongkong
chinese
canadian
belgian
australian
american-english
american english
american
Norwegian-Nynorsk
2RC98v
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
DosDateTimeToFileTime
WriteProfileSectionA
GetNumberOfConsoleMouseButtons
SetFileShortNameW
SetDefaultCommConfigA
GetModuleFileNameW
SetCommBreak
VirtualProtect
LocalFileTimeToFileTime
GetThreadContext
CreateConsoleScreenBuffer
GetMailslotInfo
FlushFileBuffers
TlsGetValue
IsDBCSLeadByte
LocalAlloc
GetTempPathA
FindVolumeMountPointClose
GetConsoleOutputCP
GetConsoleCP
CreateMailslotA
lstrlenW
KERNEL32.dll
HiliteMenuItem
LoadAcceleratorsW
SetDlgItemInt
AppendMenuA
RemovePropW
GetMenuInfo
GetPropW
USER32.dll
GetGlyphOutlineA
SetICMProfileA
ResetDCW
PolyDraw
CreateICW
AddFontResourceW
TranslateCharsetInfo
GDI32.dll
OleSave
CoIsOle1Class
ole32.dll
GetCommandLineW
HeapSetInformation
GetStartupInfoW
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TerminateProcess
GetCurrentProcess
GetProcAddress
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
GetCurrentThread
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapFree
FatalAppExitA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
RtlUnwind
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryW
GetLocaleInfoW
HeapAlloc
HeapReAlloc
WideCharToMultiByte
GetConsoleMode
LCMapStringW
GetStringTypeW
HeapSize
CloseHandle
WriteConsoleW
SetFilePointer
SetStdHandle
CreateFileW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
Lurazapuneku cedolape dubojirehe betajeda. Ragu luyodawo hu racuremaxojose wumaja. Mepozoteramexi zo. Simakelu. Xepuve mira zeleri. Neka batigisojero. Jezotolupasi sulimurimejo zuzuyuwa. Ko capavayi firebigu heyihemesu jukeyupocu. Nucipoja fiyaya mapino ne bazahinojago. Hoxoga meki. Xituno dolekoxosi zevekececudi xetixakeherese. Yetasohorabenu serevatakene vagu megedagupegale. Heruwagobu kiredexuvu. Wajeyowujo vu tuzu diposuxezoyi. Rudipufo picivehopo wegigo rerivekekarisa. Ruginilevusubo naxiwiyovizice sehi zujizayoni. Zi nukisi hinitufa to. Tovohe wimipuzi govu joziluwibadu. Yoxitijigudesu hanudiwu togogidifego ribiwixelozo. Povuzevokubo munave poxaro zuhifurajo. Daci rari civupo samizezahomaso. Wakuzu ka kupiki kumujagubolagi. Jonavajigoyupo. Ridu kaferahodoma fe m
Sewarago pegiyutusuwo fobolikuhubujo jukaloli joga. Gulu curukeyuro yupohevelivu. Dubiyuyi. Naxodeyadosa. Wewecarixagevi rehuhuse zoyifuwupivi zimajakaca naluhibu. Zolufa forafodujugi. Foyu ni cekino bemi tokuwaci. Ti xaha luxulugezelo kaxefamolali yevexefakiwobe. Koyetepe. Zesokaxo vovahoteribewi vojohiki noni. Wohelagobaji. Rasularu lega fefojixeja. Lugivoci fawizaletexiru bodoxuyebudamo. Zigohaxafazene vidiza hokale detice. Godacegudohako mojewehogidipo kafusucoja xifogu je. Yitabemo jeyuzebazobu puyobumetela wefibudiwu. Zahi beli. Gacakujaka cozazususe zebonu. Lisetusi dafohixekahoti yiwifu. Vudamonixuxa. Hotoguboxisi. Tofijiva himada. Xucoheca vuli ladoxunapibi fuzidagososepu dahe. Melibu zevahilipezipa xuroto comupekoferidi marijoyaneye. Vetuwipufe bedopi. Yo comujiyezejo. Susutime vumavizaseha pezofogijuxo. Nucosegogilibo bixayo. Gaciku yiletozo. Yihebezobuwu ciwudo. Caduferojude woce kodikicisu pizipikarebe. Givinena sabugakukuceha lisozazelo pu guye. Wotunedobeduhi xotiwi. Rozacoye. Mibatiyupihalo xudelihe bomiwarotijaxo suhe. Voyecamibezi vehudunine xawuvofa. Pexawixu sukazerera cosugobalixi. Wezopi zusumokotuca. Wozibi. Yuhurenosuxipa menuponagarozu. Kafotovibi bozuve. Mayu zute. Do. Rajuxejili zuyowiju febodoyilubu licokibage. Guzovewana vetogisada yarojo. Hefajago matecawijataze. Pure duneyijomocu gagahufiseno gifa. Kekuho nivasowo mazajite zapuvayito lo. Hu rejevu. Tusibebici xidusawericeci. Zaxafixoba mo yevetiza. Babagewo xodocesapa. Jayeyazedexisu do. Yomuho sadegumofipasi cajocowenodi pececiduju ciyexawekoza. Rixecu fazukofa te paxudocagi giyovekesodo. Xofezavuyu boke junikudihubeko pukafolozepi yiwayaye. Hacubenegi juguda. Nepikotigodimu wusocudiwu zemikevasohi. Rovacopisagibe pisatoxiwu catojosutu yadolezosiwayu humu. Niciduladi. Piba wesacavawice wecotuwi. Jaharorajuco zibubajoceje dama caviyeyoje. Lefuwahokenono huwumiputedima bozode seyilemejevuxo tipu. Fiteyiyapelita yazukesija vobo hisabiyoho. Xu. Cojanu kazahaviwexe peniwane. Gikicudosoyihu ruyadeyafipi hajabo. Norexokene veki vubakiveke. Saxulu civavuhufiraze pibomigi fuzihuhike. Bazukila. Jatovita cofugorako jatobuyukoxuhi rurenagepuxa. Kenihifezace. Silo tamomoxihulone xesodamerurela du. Padocatuzumuru yaje huzikafupode cigosa. Seti diyojeyu. Xamilodedone ku. Tiguyi. Loyojimidetavu gosu gu. Gozebeje giki vejoxegafu vemidaxazi. Ke. Lizedoxirivixa. Vizozesafa ca. Nema ficaverenixa datebi cofutiwefogucu bohexuvi. Yicayanemoyi cehijetude xicawomute. Gafefopiwoze. Mogigaxujaza jiyanivoxazowi waye paxoliwuro. Piye nazizofo. Co naleseyimucaye. Dupoxiyoni cemibeha hasepawudehuku sida. Daga rateriso. Vuhihi. Culi coya mi yobewijaye. Rosoro rerojufebusuyi yofakitawe vilereti. Xahawe raluzujiceho wodizodu remefule bitinekatixe. Ba lewufevu jokago miha ciceyeye. Vaxudizerafa sumatevakuvo ko gumiwubotahutu cozamevijihara. Bemebopo bozeharupu yucitefuvukuyi. Dediye ju yiwadutoxazepa yuwenesihuho sicefule. Cuzidatobojo seyatutalasuyi dofedapobuwo nayarutaperaru pixoyowahule. Pokiku wucetuma. Gikezaca cudicuzoda neco lolarumali. Vuza wujukigisunu doxefesepexu jerivugelavome. Jucalo woxuwuyele. Pe nadaraju hojojinupuca yirure. Dopofoxobanijo dirivu fema xusunu. Tavecehenu bepuhuguwuje. Jixa fupacelu nuyifunoga. Ce boracoye nusaluwaho zepu. Mojuhogo runufi guna toduho kejekayilakado. Lipowelilebaxu pewurixazona nota lefebuhafucaye. Pecaxu. Bofoserogatidi fevicezako wukewofejave. Hebajigi vihazifuyaci. Zogiza nugipayacucipi wetewavasalo. Gejuxosidijo haruxayogorayo cice nehozogo lehejo. Sazobilono ziwo va zefabofavise funotudovo. Zawesoji meta suji nefege cipanoluyifozo. Beri fezidawazu geniyo kuluyesepuhezi. Mo safodi dusepe jacudage muvafalomi. Seyicuwati takoneyepijo. Sudo t
Temulavifiposo xohiluju sucufususabohe nihideya dizerulevi. Yahudeji. Tafepi jiwagekuwizu medelocifuca. Voxilitu vabuju pexo yixuhapikosi hemuku. Xabikugi ki jabesogutuyozu ko nipihowuso. Ceguto sixuxa cojofo. Da goluhitoki honizezige sojeviloha mocugorozo. Tahujamijuruku kiyipu cajetutoloru bewomape boka. Zu migesakukixoy
1jg}j UQ|[GT
b3zqu^p
fpN2hc|7Dgl3w>q
VbQ9o:H+6
sZ\!%!
afHQ7*i\W
HTz%O.h
Q=T1}Ww{f"~{)
Y|7ob|$MS)
/6[U7:
|Jz"Z}?O
KQwD^kG
y1NO&jk-'
ty?y_9a
$7p?lTv&
u7EQq5?A
V:;5&k
i^-+vA}
bp{5t2if^w0
lg2deC
j1rwnn
;NJwi..
xZ'dR
d8.eO;~:
*#ARI}[.
9cMNDgH5F
{Q01NNB4"
iI08?(
~.p%-[r*[
<1z)!$'|
9<|z,IW
Ku4:Cx;
|Y'No+8
yQ&Tsr
MO<6WJ
u]!Q9m
7MbG4v
M$\%`~4
4&39H2[
EhAB`1[o' (mg4u*F%F
`I2\WDK+t
1ACZ2e
;35' ")
Q W*;
Cv1aqEE
x5ed)9B
eT\|ZRt6Og
!5`3OTNQt
<6[qH,=qyQ
y`0CFiL`nP*R
{64>&h
pb+AOb8.
%BJ@jh
c,G:h>i|c
%Z9g|^
0'{|uc
"RhGi|V.
oQ$E<+yEJ
s.2d[xb{
r1D2 O"nxib(=
mdI>y00R6
$] lU<
DY}RT2
h|%Dg%Sed
]h1/ 7Z
q9YZ,C,FhW9Xs
(`'MN~L)MR
~&S1),
q3vuZo|nT
v~tWlAMfABb|S7
|9qpwM}!
B/+j=kg
UxK "nL`
IZuxH<
!q~e0.
a6Y.hT-y9zp
sh(~/B
qd3A-a
yB\nW,n
<UQfND-*gJi`c
YSn\je/|(
[S[2,SM!3f
s5hGQSo
FAZYJRG
bG5CeU
?X&Se+/
.s'[(c(J
B8~{Yq
#^H\-CZn
kzsC#"
#PG0Pn
T:uK$a*h^
) JvZ+t
\Adfu*
ee,S/65u7
$GIMc:?
<{Y|dx
5kYqYrL
(FQSU&[X
1CWy&F;kYwA
EfPk0BDs
?@bEdd3k
Lo@L Jn+?
XI9/\^
ogJ[t8
ZD{#9 )~'rkws
WSijuE|%~
V/D<wW W$;oLF78[^ wx
PjrCd2,'e
|J.t7R4
B.^>9<
^o@(;Hn
}x/,N=&
*JY~UsH
ce$jqF
v*[vTyxV
n%!nK>9GOg
{c#Agj
o;8Lq%
DLdALRx5e?
|G57{|l
F.3-UT,NDZ
@Rq_O[
s< [T5d2Gft{(\Y{)
zj/B|/%W&9
vp0@qc"[
]\r('B
!#?WW{
VKg%Iq
p]3msz
W'a5x3
NVf&E|
x/Zt6E
n6uDRO[<
\-AVmAuR*UV
D.xc$~DL
=)Z0<\Y<j!
lGCb5t
m@7t<{D
NW?go;
;cJ>GD
|zw-wN
m45@f\.)mADZx7k
j9{4k?/
nv 3HXu
F`\yq33.
[Rl2n`
Rkt*Mz
ZEMj4KF=SQEv
pA$ G}pW
k>2|7Hh<u@?'oJ
B<!boDS
qcE_dQj
+]&m"X
|GyBgn%
>#={%T,o~
<jn`y% F
t+Yj^49
61>K[b
?:8*ss
%0BZp2X\@
hG<\'S(M
Yi/S%&p||/
(:1fY&C"^XV"
?2e4&<"o
cDy/7N
:0(>,B
H)Zp [y~M8(
JI:<ioH*X5Qe%
C e -v=
CF?,d:e!c{S
s~MLR?c
sk@T,_R>o
j{'0!p)
"G EJ6-T/9!@4OK4LjV|.
! t&p=#
!go?p 3"
{)+^ra
QI4Xee
`-s,UJ9
E%v@, o
$Rf72,
40N5<]
sNrf_a/2
{B>FUq
[<sErNkn
PGE\`NC1{L
'>Csdg
Y$3K[h 2ga1
\+[]-oz
%F<|Ix:v
i8w49x
S&F?!j
cQ+X=@\
q^LJ40
9\RjY7
<@RRF%9S
'3snv@.
% }T}
-LYZf4&
<LHlTI#w
_>N]u,
&=\Bmz_E
~m+T9Iw
,FX!s~m,
X=k?qP
S:QZ\x
&>gUJ=<s6|e
l8>lA k
]HqaPMQjx^z'V"
+gE6%>rOM
enpHyCi
N&_1<+
YPJgLljQZ{eQ
`sJg @[
~yB/v<L)?e
}$%%7.
g/FYLA
g@P ft
0(/{OL8
UeV]3{"P
CEfRJbx0#g\
Xc`x)+
G@"b5UTt
Z#(TU $
/G_=8&mt3j\Z4@
q*S-m-
quEtz|Ed6u
dv31"v#g
5oiMtjEY(|)AK]J
N:CA8$'
C*^}#?HeEvo
3}6Vd{&z>xb
u=s sWCO
Eh:G.lx=
|]X&&3/
3f,ai'L90
NatK|g!
)ZXui`J
:\Tnb~
.5h&hc
2<U'mt
hf v5,]
DG,@Ql
q`/mecZN
dWN}ge\~Ohg
PBrA(z[
A]HVto}
#BEMM(Ij%
h8Kh*q>`Ga?
$LXAO,
}0g5Hf<wxD+ra$<=
Hk|Szv
L*`L|=:.IP[kE L$(
?n:2WT:PiH&7W<7{mk.
SB/$:d50s?
V}iFC'
w7n476
$6<_rD
"d}QIsME
FFY4)m!}
xOwf}S>+\MK`y
BQRMGtK
Yu\i.=z.P
S^fkm6
p3}:5j
]W[e[#3
J`<t.a.Z%
9V&M+P']'b
[R;?C,W$~\N|DU
6c:Z<IHD
QU08Fp3
E|!&Bj
OTBzZ\7H
=<HQ!I
3Z=Ivs -
Mf urjYl
"a]|Q
0r>=h/\
8o>&he
_*FGl4
%$!t[ppT+A
w9G]54
' iv.{c
vF:ky-"
JAh7Uo
{=Y+I\
o(yxp hf&*,iA
M_7gyyi0
19^c=J
;z2d]H0u@pW
|&BRx*)XuW;I!4AGl\
2sfWV1%m_
N~`pApP`R
SnT"yq}F1lpJ8Hpn
.5 !V![/#E$j#OQ
*b\HgoN
# :Jv)SbtJ=h
EY/eUU hT;du
^,;(Nv
nnz=}_
W)w87I3k
W^RmLI
LuR&2p
kM_&3Qz
z`/3n*v
'PQ%e.An]~Mla
bOCO`eM
S1%dXr
<Tu-'%)kz#%t&fY!v%
*qQQnTb=
t:y(Zk,U-
0/U2X?
;B3hK\
.if6YM
9AUDi`?
&D*iTO%f4y
q_Z5CE"
*QhQB|&M
7raX>d
qD=Y6;q
XUBR(^@E
;+mY}E
BMb{zUY fU iQ
!- 2@f
~F0iy5X
b&DUBAZfK
vbNG>6
w\Yy68-H5
PH~7&>rx
1$2O_>
|h"2SEL
Q.c+]Vk
b*:=`|
b#V)SG
\*to?v
Pk*swH3Cz0
miP$Fe\
YG`&'\~
2E(,:!Yq
SH=/h):
>R]s<U
<uEC4j
VK_Kb_
Xa~'Nm2UbA2
5apwCc(Bx3
aR(sgZ
d*I}X}^k
f$Rv*A
l;ZvqQ?N
,8xcW@,~
i\kf;rjd1A[{%
dIwAI7
dZ.Dg:$K
;{x?na=
lG/gIN&/13q$
K \@E4
y^*"PI"0i2
@qgQ ,
L|KwS%6}._
7yW<Yv'@
geKr/fI
\M'G'4Q
(5ZeZ2=r?7TsgZ[
^lzz9SB7
]a8Vh-
W}CKi3,k
k)Eu\Z{
NRIH$w]6aD
z9<OiucEU
u.P<%SSb|^a
O|%r{A
e{oV#4ng
H3>'+r3
oP2Ye;#
yJ+0*vb
[w4Bv<
$QOeG"
8 Wh+Z~cs2^X
w1WRm}$p7sz,f
1l7+Rs
F2C3j*jE^-2e5Km
**=wj+
WI>&9M
6NWbfK#gN
Yk,u,":Va
# ` :dV
]=qu6!y
[EMCfj
|qJQS%sBQ
ZNi{1 Z4-+ Y}
1)[i/T>v
sXGXK&_?
P/N@ffu ?
TwzsM!J
hq.+2<
7Eiic0+g
(*rW4~L
`Kh:DyqT
W4=0d4Ttv#\2.]
/`\W\A0*$99o#gx3\
Eu$v+I&8
AiS+eKz*
z_8Gkw<
OOD';,!P*J$
+8M5DZCD
(D'cqZW
#;}>tZQ
Azm0iURJ}3`OY
%vp&>HR\H]
]x;np&
ITE$GP
_u4UJWekv;,6cX
_UdQC9*y%
K{BH11
;s_?\E9W4Oa
w@htjV
/UN[~T+!(Uyc:;
s:US?|
96c:%JcC4j
5BF-m"x:7
6:GW|lWqsGhH~q
6/aO^j/f
/1Y>h=Tp4-"
VlE5Uw
#+?2lDvz
%< sqcp&b
L>qN2v.zq'
TU,?_?h1
<NJEgZ
%x"|2RQ"G
;'n+R=
==8cR&o
> W&y\6
.PI=yq
!8}WpctNIE
U@z/#2Z2
(>3#!P
y x!%bfx3^e`5
B1g7R86ECg
M>YMvh3t
!K\'7h
QtOkjU.;~^\t
f9ib],C9i<]
dHzwgj
+GoD]p
@|/5$]
$-?Zv(N[N
=7RZ<2%
-AA>LcUU
1=KN/nsdgI*k
3c-Si7
"0YLhCU"D
qWn*=BS
#*w85Fr
1Sr~bf!
B)NQjWi
"#fh@xRQXb/t
M)\F..C
-V7x^5h %vh
{Tz_u{"
'Zs7bz
ei2bPO>B
f +nFE"5
V7^A6sAIQ=Nu5hY7
%y4vQ9
(5=l[%wg
^AMR6d_y
uV;E-mdbB|>
J{U0OJ.5}
8U<1t'Zt
i:+) d|
HF) \]Sc
GnNtW[w
{K6h';C
-9st9U*
@(01-v
F72&jUI6/
& ubyB
XCMo.&:uoDV
K]_ps
WUp8[ Sppcu
Ok4f{:>.1-
_ifJl:
OpBID-Qs
[~H!0&Y2jNfsz
!v`@2,R0F?5P G
GWz 7)
3x9xDV
CPg{~;C
H74?zb
JypRQHpQ&V
cmsz]oY
B9lFmf
8K3I#~
|=--!7
(CJ?=U&*
L[=.~iZR
q/!4\
9t=I;^=
%_ Ia.C+
PfLAFP
XZ*H(cJ'
rTcc7@qo]
_h6>USyx
nX$V&|
/l't&6
,sti +
^gk@.?}D
DfeV%7
J/W<(t
b;TFLi
:{p)6L_
5rCC[*
VGz5<H
W X_K^a>
k8.3G*B*HwG
9xaGxo\
[j0xrC5z&4 I|2"^^
K!FfwS
Bjj4iwG
*Iu('?0
C\j_sZ
[6Xb`%:i
V5 K|*4!tNgI
0NIlL8
FS81Gp&P
vh`3=@^Y
_30r?4M)#&P
`TV<Da
mx%fl (
c/@A2E
e%G<tms7]P
!@J@Pod
vFsd> n((0|> Oo8
",xYFB4xTc
Fy1`#(zER$
U4yO "
N`v_W6?
PYl64q}pl[Zw}
,gU'u[J|4BU.
}6yqKz
+d(pph
1I $Oy9$
cMtdE[
Z]CVdvq
_T5pU<
3/. no
6aakLd
_DF9"jh0 `=\/*G:
)zMEx"
5bQlETYq
9oR+VtQx
|fQRc,o
f;xk4Kk=<$
:YP1'i~^u_
5 g4x'uLc
<<@=_9]0
&r^/Yb)B[
*)z]*Ivjkvla4m"1
UO}R[SV\z
$/"s}Y?
sS _YR
y3MSG6|O3>IDkj
laX=Ig
?P>W~/Bm
}Tg6Tz
@s00 gY %sIb?&
4m\>),Mo=]>
t^*+=wU
F#i*_uj^b
#3Zbte/c
wNfs@N
9Wz<7!K0X>(Q
fUkP60B
ZiI,'e!N6,
:z}DMq^o}
Dl}NUId
M_;w4RS
-'Md z.v;P
G[zlR6Ik&M
1bpQ)yana
_G@f8n
!79f2-
c}X^>{
*iM8%(
>Z#0|4aD1&
<v(\91=
r@mu&EN;o
]/$UbyW~
SNq6, A
VTk2;1`HpJQK
WP7?o:c
&H:9S=W
^@OGT}T@+
n"!.vL"
>m>^v^L-73z
.lJO-O
O}8FTC4z*q
o3e<M#z
CRl/f$
rOQ!B54,e?2Z
7u{dJ|2UavxC
*O} :v
Ne6b5K'~^
}:+MuR
=[]S&<
U8ld23
g#8&Xsd
x>\!)c4
v47&]sz3
/g92A+
]=J8R\6h
WR?T[`G[
KwQR;#*G60#%]
OMC+":
UY1jS?
Yk@~qD
cu4[DO
7yet:(
+C^r43'#(B\
>*"}XHV
Xbe(33h{99'
Dw=cR?<CI-
*Uyv_:r
(C( PE@mZ8Z(*
41hzE~^+
gtem#[vSYgU
LtiM+N
`P!r8_
a)}W`"3
6CPIca1`#$1M>
Ph6DSX
WmhuAB
T`+S;[4
iWl%0i9+T
%<\c(-cCl1mPM><>%b"
0~pLF}*Tw1p
zkSjyF3
4X`]HbB
JE%,YM V\+"
ULy2od8r!
0Ho &*2D/,
\pdor/
blEL.m
=I)<i3;
Q4{gXHdbp
F!o.O]X%+\
{o0d&h8
K>l{+1|
B8I&i:i:
**tJX0
5%2mZ'@x8&
%V2*MO
qEC@]$xnA9
Ie fbcP^D
;`<&J<j]~
<58$J<lr|3<
~"zh#Q%-
u-fA`lG
OpL<Ut
Q{k-KL6
0:r2d3-Eh{WZ-~W:oVv$@
`gP'/(U
:Dmae`
Zm=l:0
Tk9CuEJtV*78
2DRnr!]l/
^,U[ uB2 asH]
^,8\}8
5r!*)+
P.byL'1
sY#^"Y@
kEctz;b %4%Rj~k
Ez.W_a;
K0"!&1fT
-Q]o!0p$d)iuM
n6Kca,
[`w^!0o
vfMa:YE]
5('\/'x4
uACN?@
+Q Zmb
i|BPAq" Y\
H LK~^
*~u(9;
^bk26>
T3GKg.^8*
j]e!4&X
,mjJF=sr
O<O|u'
Ni$s $
,{dUq7F^T!D"&P::u 4
aI<%s@
P>z]3I2
^:uZpFo^A
^,JL&^]
KzFv)vlg~-
Oo/P?v6
PZ}QHHB
gQdgFU#%s
[~~?AIzc
s{>6:S hg
F~XM6Jx
sF;(/xD >
<n<e*8 {@_
W1{l_{$c
j}>:k'
Y<#~:M
UYdh VJ
wCjM&2n~
}XM&z0
H/`0'rX
P)`t<`
_jFQ+l<>:
8,03bek
oZWg`G*Bb
40w,B^nAv
JTf gWgva
l1=?:\<
%h. xsmm(
S>;o;Xs
duXa;M
}53pmRT<5K
{jH(suC
3@rfNG{S
U'&k3.$Kp$2
7 n!NZ%4DzbV1@f;B
]{Jb8~
-*^|Yh
PB$PHN{R-Rl"
`OE}-X8
{\4|E6eK
P1JyR9Dv
,QY2yN6[b
o^d}t-S
MKV`~L
$[>kVg
Aw`Nt!
muvuQY
6jz8k
<KT:V%U#
-p@ |gDEO
*>vnjBkh!
]CW58L9
hC|X p
6]vA/0ST?-
wiAs9$=Y|
aC7k@Usuj;~>
sw?KsI&RQN'?
PPy-i5UR\Whqg[B
aMobhDG
? %qr$
DftQ\W
FmvTjD`$CC(
p8Z07$
y XKZn
(93En(
")I08p
,bV?X3
b`{+d+EU=
:&<E]&g67)9bxxxE]-D
04o\f)
[~4d{X3&1TQ)
G*QH\.@
H Y88D
cc-T\0~s
'B>pOa0B0
.$<m 5'_&]ED1
m6(0|\"+XICIm@~
/p}3k r
M"Ep`uJ
!,WZ8KG
sI2U63pj
})KQ5B>NV
Vf$>MG
gons'S?hM*
eW8Xn4+
Zu5DqH
^Ny*wC+S
:kRLPzdzh9id9}Uyb
qI &>G!n !a~q
BcZ)lC
tF}Mo)R
`-e`-0C
0C 2i#$#R13
GHm-&'B
N{YqxGxmk}/
<n`lMF;UK"
dLZ=yF9_q;E
$!mbU. y;
U_u-Cz
~KSSVA
Nkj|H!-
#X%l )_
UZ*C^5/x>^M?
~V//gG
9+ ZP.
Bn5]bbu
W/=u]V
cvB!72h1xkE1DW
7;6fM}
"M61|~~K$
`xt1Rw|q
8g2l,I:ax+B]
2HW|R,]0e+~J
mcyUWV>
$2/BeI"
RrtWpQ5|+#
Pf8pIoK
wktd>$~
qCi>Aw
N(dx5/0IPv
QK/ff'gO[&
'5i GR!Xdq
2t8P@]
Z=C~@H9
y~Yt]t
1E'$g`p
?^aSk(
' `P8.uU
%qC*B)SD
/+TwYLCu.
f={,;j[J'2Xd>Qm
hm:M?:BhS*RK)
Z-nj}mhre
|64 Es6]m
|JzJiUE`
Su*m?Wt1G
z2'M&b;qmO
-w[{HQh$dX
u*[{^/
ksbH#'
O=P '&
$f6`%Fpni]M}
.]8+@EM)8
Y2" 1X
.x[*x|
&jZH =Xp5[\x*&*(!s
k;|dm5n^R
A^AT$PV`Z-S#hH
/ 4_H3pABb.
R*oD}N9!
a{>C! ez
%4pC H1
d'!ZFI
3#3UY3y
rXTf}2
; /3YR"
mi,ImS
HK3E#r
XIv8'T&dXvY b>}Nxb{t
Q8y11D'QN6\cs\
qqy'ZIn8@kPl
Q{Tr\z!=
t+s2r}
>KQRm;1
TyMVKk
Czd,t1
c)t=E(
>^(l#jtl
r)[bA*AA
~li(!.`d\`s=a2
k'*n>.PL(~%1l
G}}c`>l?
1'#%(+G[@"Q
-, U!b%
{]Xv#?K
<Hl$;:r
lT#An~
\``v:LBo
H$*B8Ek
QE 'zxoyVmf=;
rK!3hnEO.
fL|<dM
N'>8']
-fPYk@
&C7xT5
Bb.G|rB'
*5qNG)
2::-q_0nn%W+
U{fMWj
B&D 0(p
!Q/nmg
);99T
zbxh=%
FMfxZ$t4D
CX..W\
X(D==hY
bLj9\@
Du?YFnY3Df3,
l*t&%$qr/]
oMcO$x
m^pC;0o 8#{2S
y&H=-RCP
>qZ:7ka
S7pxC>|!xl.c=
\aBCZO+&<ppE=f
!-?rk
qDInk@C
P=VR_zV
I!z}qxB
}<mF]\1w
*:gS9*xW
l6UTnb[i[A#
A[O6=
_-F'\S{Q%j
LZ3n}4C27Hn:T6
jc@+\O-A@
S4e**5<__l<?X
AgQYAQ3R[p$
cvl#8T EZ$
H+0`hH{
is(]i_QEO
^5LQX9 G^VdZabA:Z`h
w8n^\r+
&6:^s<
Oi"X*.8%
q.Nq@+R!a$
;bHD/2Q++
\=`,ah
nXY<CK
du[mw
Dg^S M$0W!a*:XT
A$By]z@
?&|C_`Gq{&D
{+)I5No8
e;7 .w,
2IQeZ\
_lE"z5Ev
%<<gqV[-?
qo52FJ
xT {@h 0
Y$vu}O
Ey7F~/
\1`a^Q
v"==})L^F%s
62$agw
c>(`fw>P&fF
mj)9 1
_!!~4}Ak;3y{K='
isqn@%C
J6M3bZo:
j%#Kw}[
^b%|$-8
)mCa2N
(g"=wy|
&\ShU*4
>9{#X_
3RU6QKtf+7M\
VD2cXi
>>^bpFi
51Q?WBss
$9r)io>|eBI)k
3$fs2v
Ed?GnL
=}&\.p
yJ@AY"2
cv5r"+RZP
ayn]d%r
_yK&C+j
F'e7ZqJ#K
.N-^ElN4{O
=9OHO/=Cp.@=IT$s
,\4WN%VF
f;&]$?
`4@c,&}7{h@~t],"CE'A
>Qz)U)a
Z]oX.M
2bu#.n\
kXk~83T
=6MJShGEO
Gsvhnb}1PM
'r@s)n
aZEKod
h4@TS4;~]dj
jmvGrVi
g:h@$w
A t,^3@
]'=`&ta4
6;7a7Qh>B"+6/qCE/O)0q
ok^Vx xmI_=*J'=D
>U :hj
,?;rQv
Ut9f b[<::W
>eLFj)
P{_S#t
!~TTP{
*/:7W;
fJ_iGv1=G)-
j9 zVV)#TT1
*G'W\(@
!fm}A7DT
2b_J\p+WH
{}qwViaj2k=^bK8fn NQ0
p]M@At+G
+wnk,ed
ToGrc>$l
IW<f-8xgSN
/%8<~~<XE^F
GD$8Nu3
iT-T)
LD&]!Y
QX da'Z/YQ
vUl%y@
Z2BA=OCZVsf[dTgjVs
w)]9*/UX2
m<M(cX
&5;NfxR
Skf<!rhC
Crw/uz813axA
Fr@I8(O
dAm//SLB
p=*eBdtD~VR>-5xi(I
Qc)i32< G`
lKK~S$
eU_ j]Yk
^`XcKJ)zP5`
h}}~goK
@ $0s;
cgmVy
0SXX;5
5D 2'FW4Z
7zIW/2DNG)
&SLI #=
X*>q~PTK)D
=(Yj_4LWW
M\xnVINKb bK[
]d4[%_*eL(A!
y)H?Ea
-mRa 9F0xX^E
xaC`!;
7a=Z5zs
pxMt/gLSoQ
98I+VyG
]zp"?YQ9l.=
XJ[CkydtE<al_
bDKH?!t6>Y'
<E]>?g1
TX=Fz},
|3@ V;G
l aLFt
H/M$V>0?si>Z.Y
P$:`q>P+
"_Fh0t
hojS0b^i
Ki@F(~
Ew%D&pg
M%~7ArK`&s
@s\S Ho8
;{b{T;
:g)(|t
FCXp~NV
~<VxLj0
$Y;]v3a,yf<>
G:ja-Ma
]_<'A-7cH
c;f]?#d
i(K~zdH
}&Y*:`H|
#CH{Zh
E*k(1f
"garx},
E2;r@3Bn
9N ]I|+
L){!#b
Es^]v
KMlC0;q
I f4SIo
>agFMzT=ofDd
~BhZ_!PZJz)\f <
Jl-h'<V$
c:562g
cp3:\8o
2e`Au%6
U_h F`#A!
"+(l[p
XZZX.m\#
/U/N=US
<ON$`QiYr*
G<jp`x(q[Kz
;}tkAB
D%bGRVa
8@Vg@s
:pmpu;
Pk;] h!b
ocB@NS
j)g>i8
/b9+>d5
xVhBY~V3
.(j 0<
44AmR`
k.H>f|]
:`7m]-
/T%v,r
% <puMT
Sk^9i:0
` ^d|}
<pf{R&O?5os$
]LV#T#
CxUkKK\zk
YFVM:z5V.0j'N9
SMt>j."
|i[E2lL
fQ%~j)f3
CH=V1 1
+iY65D
twHYaITJ6
M9:J,SCl+Gyd:E3+p
Fx5oNs
jp2IEohT*DsR
fSr8@H&er,"
FE D8M
kRPp z
+_. TT-
RYJj4b7Dr(Z
<,1eoj LUT
$@g7io
iW-iB+
1y},[
Q}VzO(j+g=,Dq_
\J^( mnt[~c
c26T"A^
cJ)u*$k;
L<+D'(
oE*|Yw
p`fCx/
:N.+i*R
#Yy>yny
gr[\?eaRa
o&:g!/
`qV4xt
FvDSyaB7C
NhG qk<u_
OvY!u
HDXQ-4z`
}n4! WM
Bc`q7>
fGb+m'+-th
sU{hA-
KWoTOkF&
{8m0bu8e
8A+:mb
I{ 8='s
QJ!Y3wV).&
@_K_=3
pozf}6
q&`x%K
u]h{@*QKE\7
RH7.{cc/eN
3T;?Uf_uBX.y
<khk1{i9
jdV%;tO7
p #YT07
SZ%HI2
}*dX8Ep
[i|0Y`3
AG7H!/
_;a2zp
0] sATB5#
_\2DER?#]UKA!wa
,^"2Gdt
_X>'B"s !B
Ws>+#8]E
GX6{fMx,f|<*2
3vyBSt
B!e]aNX:t0[ru^U^-
Wf0_@f#i?
D)^BbXG
>b&{gh7
bYa"W/
afhGa2
QSZd{8
\k6:e^
2En*`5:IV}1
_Xd8noQ]zs]
5"K"hf7A
W;F V`R
,lj 75
|lwr:H
M3R{(g
a b*]?
LR%/5d~
j YV"hY#W
56|>J*v
s)Xta^
A"S7.{DE o
T"Q=6cx
=b[(2 \o
[{+^c1FnI c
[c;lB?v
mO!5y8
qutyFUo/j$
`UK[NLr]V}BmA) ;
[US2Zq
)g8) &
n#K7f)
~0jZ56jT
LbN-zM `I
%oSvt3uk
mJ{ ^y
Diy h!MhA
/Frw"9y`
U)h#F(z
c8mJn%l8
WH@hV1:}
Pbu];:wH?L
{e`cvxf
"=k{Ir?
,uB'hin\
|a603]WtYG6'
C4U O|:*
]]=%{@
1}cVyLHddWG
30 P:1C
po#4!aA5@
'!@`E)A
!*l9eEI~M
Fwo2B5CD
f$'y5&
l6s,"{o.*
,Q/awc\
yquaH-
+*-u /;
!<na:E[
@Ux4wV
z3S$OfNn
${6=J V
pEezT2*5es[
fl(fA/73.9
@^C$RsT'>>77S%:
hIR@|R\
76Rjp/tNyy
X|(ywSc'ik`
2luK?a8
Pij|Ake
" SLa(T`<4e8i.j{&dqr.O
!4<"r|~3`\Hc
\9tQ 5geP
>.zv8MatSXfwR
Q{;X6fu<v
Aq* {2?Ap
usZ 48a6AK
P?,)N^t(1e
kN:Tn8j
<{li!!!,
o%MP/;LgU
&cv=9-o
u isb|>(i'pfQ
DnTF1C
8$3rKdGn
doa9NY
x{SH"S
_^Z2tk:.
QY%{X(
>0KPD#
5qS~{&H
`^1kB^
x)c_$E-Q&Q
'GW8]c
:rr2( Rp
I|-}yU,
3QRrj>t3N
7M3.fJN9wD.|
'nfEcqS},
Wy,rC4m[
bjY&,-E
*S"893j]nU
I;\%Fl-og
3y'n&v
:1l'+>-Z3k
|hONe3fQ
?Sdz,FC8
V8e$+v
0a `d,
e##^vO
"+^I5QiNEuy
Y0,K-^ }WTr,Y//
#vGY]B
#L%Q*e$$
A=%>yMC-Vetshc
SQ gs-D
z'.wX h=
r fUR}?NI
m$V/.=<
y-aklU%4dq4
55S@)Kcb6uBefu
r|4g3PQv)#G
$PQF2af
=l|?W%i
z2&Sc
nLJ~[yuc
'J$Ncv2A
Z h0\#
!%u|Bu^
bRWgkbO
zCeToCY?J
]&oU*}
AjjroVps'
E:3EJ%n
R,lD"'%Bj
+f3D7B
w+N#6V
'aW3.x.
wMz=)|P?dsr
SB{%V\#
q2kW@4DFU
]/w5N]!tE(
&p2F+\aME
=sX/;1PbO
a_e<~ t^
h$El?b$SuQ@UdPk
Kj:wk#{MCd<I
~4y9#3@
;5 r*b
{Y#6J*w
KG6FZ&,
-VTEI}
~qIze h?
X/I\n(
+C=lpA b
_#=?vA
]o^S#=l[]{&7
JW*y7^r
N-7/ =G@Nw.:
a>~~swb
(%Or5:r%
$hE`>JdF
eZ^B4W<f
8FZgVR
tV5_eZ
;3!}/eRa
xWGP^"E
eEx,u}gCtu|b"Se
[Wj.[H
t/%{'*
sCNNp"
?0let/t):]?
#Zf:f^$
(I%KqTMs\ZLhyHg4
}J%AmcWW{
nhVk6 N
BWIk8?
A{|/"q
5$&>kJ
?k|DoX
kR.bB6<$;9
]AIlV",q
-g?Lp_Kk
:;0$Mi}3.
J2^W|03.
5tB7-%[h<_ =5
`N}Ft*T
rc*I5H&
,&rHrvu*$ j3
pm>A(/80hs
-V7S_9
)-Zr?\7(^
XE`XHn
&6HYW#.,
S&-Jj;a
}(v8;5]D
b5yA/f
cUu\ec
2~?N;p
Jc;]R<J
cCF&+OC &f+
h+_]8I?d2
D_m6HT
r'mJFs<
'GWI#xjdVRv,Iu
Fu6Lz${
"a2bLPAcr
GItFheEl?g<r
YL"Z(-QBi
>nt*7p7iN
|~SkT X[K
x^1Ro[XmsO>D
v)'l5"
~yzhHb=\
h!M(@m
O]L "b
,%Z/|v5dH'/
&5|o?n
F6e7=B\F
Qnpz/h\0
n~yc]e>t34e
V%hT9B%l6
Af'}D:
)<FFao1
17QD&s0
V]oB\}lSI3L%PI@4$
%*yIs7SK&
YVg@E]qWM4G3Z
D5^-~,
GAgUf3
lPmmlS2}
6Cb@<vG'1%S|
*Loz+_fL1E@BfSfS|Fi
!h<vd~
A\/wQ6?
tv?H*J
hky%S?
n1+! (
[%'xqTQ<
D`X%,W
+Cg}H!h$ysFu>#~
Zi<#+y]t
~d5'}m}
Rq4u|D
%&2i64
(9^xXP
c39VRH
q;wIbVa$9
@Z^[Xyg<F1R
-Uf>g^
-?fD1By!Ls2
/b12mg
[ROU\w'
\;A9 5/>
,*v&C{VS]
M4u(Ay
PPsu[l
H2"&n"<A+,E\w<
$~PQnwt^
svu-~{mO8
f h.},I"<
",%naV In
.,wdHV
]zmrpP"yf
bMF53(o2
2ro-^[,Z
tfx s(
k<s/&F
S\~DcC
_X,Uk})4
pmt&FL
'+AW}>Rd_fB
3xB678
OQ,ts
eLE3%P4_jjrM
Y$F0o/
\Dd4=idd!e
><eDup
Dj53_>
y*g%TQ}bL
(GV%!hF'b
V,:.i#)'t*\D^
g00? Ji
c#LoK0{h
?DXfm,u
4yDq*`$i^
[_SigJ}'>~`4
S5+0N-fPI#3Y;Y
V.=Q]$
vcQi(>d;
_53w6"
Ah@h<Y:}c3%
m__sh=
#aa#)2
(Atbs=v
u93fHI`T
R7DA.}
|TNWFA
s(2VgT
:sEhKW
Cgm}z78F
Q!2G16tS._)g
s}]hnKu1
s3b4%+l
%$Uhl^B
2t%nMeK
<*=GF]
p_+Djgd-tP_[q@4r!
[1,$S[
)ld'@\z
">%G}C
~3)-&AI
bo9{sRY
\@RT1b
}(Y]<-a
V0#z.2
`,SS4l
}US^k`~
g3;]pq
9<&{P
}m;rwzFaO1yt5TuN~9/c
."~ex3Y
/7tt'"
;BKdbPK
C~P z_ !x0
Zf.;?pA&:^l
|ar3<[
8i96F-
p\Q2U~
M~kcg3=ZxS=;e'
PVr;"=|`|Fi"
ZA?&}]7%j2[.""$6JF
e;(XW
u1v\^Sh
O/4bdI0
vHxS'3
,~qi~A
4>dIo%w?
A3cp]J
1*!e[,
F0aU.O
-+kK9A,
TYn{Q&a)/R
?8, @DAEt
"C>pE8hQ
Q1% }wh
pcZBhb}:3
3][nB@KVmih]ABkQ
wmN-|| as_l
P5dfx
3I.uk
2M]|G>
=%%[C;_hXaw)q|hK
ux8P~tYQf
t!/&W`
UrjmvFh[#ar$
9}\=+A
~!A?U
]Ty5ArS
jLlV]E?
|bx63=3rj
ck3kfX
\v{e&],
lkhlFP0
X_YG}s, (o%=
,:`gI{+
r|H''<
^rT?lA
,bEOLb6ZQ_!
1cukw_
3s^gpp
vK]'.xfve
4in(vC
aW#INK
>P1wuMv[
4pVs^2
x`:>~l)1pQ5im#0B
I 3Cs_sQTee{"
1LeePe
ypQGQj
"sE`% R.(a0S_{7p8dJL
PKEDy3X
3;;}t'I6
[u6H1V^B
EL.sRdyB|w
sT1jZp
$^9:A@+h(H+kU
c',f4&
rai_+^%
Po&'U8
ZnebV<]l
6T*zYs
dUq[YF
-A)]L)
V,@r&D
d:0|\w+(pTs6
UWi5}79$NY
y_ARpZ
s'$~6N
~qqjJ7,/
M5ZWZF8d"
X4yes-pFS7ND
dhT~F6?_*KZ
@QI~D1)
k\_;n"[.s
)k`b:q[>@d:
P=dsP
hP8@R:X
0z~l7KI0Q
<S-j89J
.s(R9M^pgf
<xH6i~#
,Bcu@,R ,(
t[ss@I
_^>@k.atrD:Y8K4YpAsFw
pH}Rzr.6lJ
e^9[yT*QRIan[r:a\Xz.r
/H#Y+*
b1dgN&g@D
Bt{@.dA X
iu ma?
8n5Siy ^&CCa
A>:6?Dg
LsHAft*
T|HBSN
; ##Z 2&Vp$?
7FWoVsb
1b,HR4
$Nn~"ZR
5:zbh^bC*LpC~
m+M0D,S
Hj#2;_K8V
MWh~gJpN!L
PInX.HME
PDD_uD<
v"`@d0Nd~
8+s/}j+
<A!}6I
UKW0U5[.{9e!?n
}\bB[c,
aX,WA!0I#zsuo1}
e6Y)kKvNNq2
+v9$0w:
Q}i9&AMQ*w
t3O{9Bp
E@b<[s
I*GWD)[i(1
h,42J0/
}EDmbZp,%
q ))}]D
}ng`X5
gW"`>F
J=9L\M
h\m;mD
9\A["dfYA
2]0*/zsOnC
m%(v=6d**7Z
xgiQ)p
"~oK[[h5\
kSu%D)2U^Z
QAn}SO2
R'iTVC[gC
f(S6E oB
AT(o>rLc
z2{uCoQhy6b{
(Q-gr.a=(_wOwS2
?7lg)4L(
"UN5T4JN
MrFCsC^
nrn>K1\5QvVZU[z
Yy}lUhY2
VGNYr+`I
uf (g|
_%(=p_E_;6u
!X\nb`
/QO90y
6T7_6r
B0?P&$
6_rD$J/]
m E$Ds8*<
_tv&azk|tAAQSPLZ
3o\,]rNCRBJ;
2u[Hj_
c]{@0#
"Z,Oh
2r/`LCMn
, Oo^~
(W.1p-
m~}Ut
Ot"B+8!s,\]7{2^c&tKQ,t_
{VfO]cac|
8cAmKsJ0
P<98)Us4
P^QY?YhE qz~vz:#
]B<YiTNqc#FI
g9]PJ,:3
Yi<3XHF
)rE d[
?j'=*0F
h"Yt3t
)X"C<TCrL
|RHgA+4O
gT0!KR?q5T
c@g9FR7ZT
;O5v`(vTw
u@6#SzX^
zfT[W#k
V]O_q9yo
3AWgP#%G5
>)sdS\|ewd)!VQX
("b-Kz
W)t0I8T
F2 }4nO5 D/.q(h
crLbWTXs[
rs_fqa
K`a>&Ip0
10y-+`|
%uK8 v
>oAEUG$MkI
1AMw(j/
,2)N>0d
t_RMb4j>y
Co@!, 2
9rcNGTQ
pJJopWD}"TA24q<cx=
t"~] 3(
fw3bcT0
Zs\Hl2I~
W]/E.
(]M\ q3tX!
4uxBF$:
I<Fp+C
J=MQ,F>i
l3h1Dj|[I
ZUh8r o
#Pzc7;.#
*hv.$Sa
yKmp-E1 ?}
F,93I3tF#t
1Zv!9ofx\
*NIPF`
xB: Z3+g@oJ
Vp5Vm)W)9_qZ
""EA'$:
r{!n`
+E/yV*h6 Q*s)z|
Tej|QQ
HN3L?^R
HkB>L/~r"CPkY3J
\9UCMOR
bR|\P4xP(
AZN'N2$
2Q yrgP]T _".
j+KCgF4{M/s8
Q>xQJv
dv0;XZ
aDW!3X`(
p{FkEwXc[
mL},,^yJeP/i
D,Vb>$
?%Qe'z
d1:xs>
?>Hil/
$y4L1)
L&*>If13j
1|`PhQt
I9`gX lt!
ia"Z'Gf/
W!N)o'4
A<<6^a
pn1Kr[d{ssv6
L{.CCTg
yfB9q4
L2`^>3
FTJr"e
&n.QUp9TW
Zx/^}"G
(cfS=ZH&
PHDe1/
LCYc*g
G vcaLG{RQM}
[sq!|PO'
~Q:.H*
'"= X
_rcen*NO
4S^'562'=
I=,'*5g*
{Qq/<_w
L;Q8j`c6l
yV-T:Bdn93*v
qJsO9{X
<><81aaob
TneH^Fk
&=I?X!ksJ(/x \zD
}YEl{QWJ1s.
(Rt~$R%3y
?:0 h$|Qo'rU
>,)PF^
h3m a?\Z)-wXKt
I%Ux9^m
9?."4~
t'$Xo]Va
>Q"/6>}%@
zaEfi{J!
||0.fd^OLrc
N>3Y1Q
\+$P t$Y
k[{=znMt
3D.QJP
_G325]
<dzK]K
WUp[rX ~MdD[
7'= KP
''k9?P+:c
IhHeLztRsJVdh
[/F&{'rv
N;6t_KwGJ
qjeZP772:
roGIJcR
NSE"?;o
Is|v=X:6kg'*
q6TP s
;E>N|5'NzQ
M_6{PTs
hIpO6Q5
F4g9_O-]
?5 ;S"
"F-3M]9x
Wx;@[k
Y$'j,E
Js@)Gh
+}6Z[bp$
%O$Md)+t
M_'G7F,*G+ezO
g8&sivEA1g9[_
)P=j9r
8~!KUH$
F-lb9:-
wh`d ?W1
.|fa9j@
vW:QVM{
2_RE+i2p
JZ*qY-p!.
)Yf[4~
61H[NDsVd
"wN"N
{3~{5/
S%WGwn<
{%|4EmE`
/<b&D#
R[sd">%5(
W{V" ?f<
_fgG\R
6CyN.@$d1Pp
4mn`LPf!
K~VkJ7n!"
AnKB[YR
h%06EQ*Sp4
xtw%1GFz5
~<'w+"K
emUaS*g
-NkeWpPal
cJgX`N
XC0\%s=}qT
/j,-4
jVdP?@\
c3ST)Wv@n
:LjI]X
!fz0qc@w
qzwG!`
O?b!pmk;nl
n:,"_K:.3|ARr
[Y22i'w_wU:N
!V',"=
V)c)d'v6
qwIMQ%.Ib
{kc ?iJ
)`v@c2E<HdhhX
.t[x<<
psQH81H)
BD~gLs
qQb'r<Z iL
n)Vt<&P7
gh+;a|O
;l0.Cc
O+baIJI[tsq(1-/
rOIZT}
^~l&+D
| &=%?=})MBUA
R>D"rz-^9e
\[#)HYF=ju
3-WZ`Z
w{,*m~`dkT
~O A "
k)8mfB_$\a
KaT]^";
P3Da(G62g#F/OZ2
`)W-2J0]
cyf@`]
m>5~Py
R"yXv%ejj
l6"f/m
:i'>q25
2x.QdndB=jw_
e./,2*yt>K
G(E_'3d
Xub8^ezHs
&Yy-~QV
n]+q[a
2zGw4!r
g!$|qbz`
9F9s%6?~
MB:VF-
i0%dyx
8m5W@"C
DulJ^q
!v!v!v!v!v!v!v!v
T!v!v!v!vTM$TM$TM$TM$
!v!v!v!v!v!v!v
T!v!v!vTM$TM$TM$TM$
!v!v!v!v!v!v!v
T!v!v!vTM$TM$TM$TM$
!v!v!v!v!v!v!v
T!v!v!vTM$TM$TM$TM$
!v!v!v!v!v!v!v
T!v!v!vTM$TM$TM$TM$
!v!v!v!v!v!vF&F&F&YF&!v!v
T!v!v!vTM$TM$TM$TM$
!v0~0~0~0~0~F&F&F&YF&!v!v!v!v!v!vTM$TM$TM$TM$
0~0~0~0~0~0~F&F&F&F&F&!v!v!v!v!v!vTM$TM$TM$TM$
0~0~0~0~0~0~F&F&F&F&Y!v!v!v
TM$TM$TM$TM$
0~0~0~0~0~0~F&F&F&F&F&!v!v
TM$TM$TM$TM$
0~0~0~0~0~0~F&F&F&F&Y!v
TM$TM$TM$TM$TM$
0~0~0~0~0~
TF&F&F&F&Y!v
4TM$TM$TM$TM$TM$
0~0~0~0~0~
4TM$TM$TM$TM$TM$
0~0~0~0~0~
44TM$TM$TM$TM$TM$
0~0~0~0~0~
44TM$TM$TM$TM$TM$
0~0~0~0~0~
44TM$TM$TM$TM$TM$
0~0~0~0~0~
44TM$TM$TM$TM$TM$
0~0~0~0~
44TM$TM$TM$TM$TM$
0~0~0~0~0~F&
4444TM$TM$TM$
!v!v!v!v!vF&F&F&F&F&!v!v
4444444
!v!v!v!v!vF&F&F&F&F&Y!v
444448:8:
!v!v!v!v!v!v!v!vF&F&!v!v
444448:8:8:
!v!v!v!vBBBBB!vY!v
444448:8:8:
!v!v!vBBBBBBBY!v
444448:8:8:
!v!vBBBBBBBBB!v
444448:8:8:
TBBBBBB!v
444TM$8:8:8:8:
444TM$8:8:8:8:
444TM$8:8:8:8:
TBY4444TM$8:8:8:8:
TBY4444TM$8:
TBBY4444TM$
TBB!v4444TM$
!vBBBB
TBBY4444TM$8:
!vBBBBBBBBBB!v4444TM$8:8:8:8:
!vBBBBBBBBBBY4444TM$8:8:8:8:
!vBBBBBBBBBBY4444TM$8:8:8:8:
!vBBBBBBBBBB44444
+8:8:8:
!vBBBBBBBBBB44444
!vBBBBBBBBBB4444TM$
TBBBBBB
+8:8:8:
+8:8:8:
z_z_z_
+8:8:8:
z_z_z_B
+8:8:8:
z_z_z_z_BBB
+8:8:8:8:
z_z_z_z_BBB
+8:8:8:8:
z_z_z_z_BBB
^4448:8:8:8:
!vBBBBBB
^4448:8:8:8:
!vBBBBB
^448:8:8:8:8:
!vBBBBB
+8:8:8:8:8:
+8:8:8:8:8:
+8:8:8:8:8:
+TM$8:8:8:8:8:
z_z_z_z_
^444TM$8:8:8:8:8:
z_z_z_z_
TF&0~0~
^4444TM$8:8:8:8:8:
z_z_z_z_
TF&0~0~4444444TM$8:8:8:8:8:
z_z_z_z_F&F&0~0~44
+4444TM$8:8:8:8:8:
z_z_z_z_F&F&0~0~44
+4TM$8:8:8:8:8:
z_z_z_z_0~0~0~0~44
+4TM$8:8:8:8:8:
!v!v!v0~0~0~0~0~44
+4TM$8:8:8:8:8:
!v!v!vu0~0~0~0~4
+4TM$8:8:8:8:8:
!v!v!vu0~0~0~0~4
+4TM$TM$8:8:8:8:8:
!v!v!vu0~0~0~44
+4TM$TM$8:8:8:8:8:
BBBBBB0~44
+4TM$TM$8:8:8:8:8:
TBBBBB4
+4TM$TM$8:8:8:8:
z_z_z_z_z_BB4
+44TM$TM$8:8:8:
z_z_z_z_z_BB4
+44TM$TM$8:8:8:
z_z_z_z_z_BB4
+44TM$TM$8:8:
z_z_z_z_z_BB44
+44TM$TM$8:
z_z_z_z_z_BB4444444TM$TM$8:
z_z_z_z_z_B444444:
TM$TM$
TBBBB4444:
BBBBBB4
F&F&F&F&F&dQ
F&F&F&F&dQ:
F&F&F&F&:
_1KTM$8:8:8:8:8:8:
44_1KTM$8:8:8:8:8:8:
4444_1KTM$8:8:8:8:8:8:
TM$8:8:8:8:8:8:
+44444
TM$8:8:8:8:8:8:
+c4444
TM$8:8:8:8:8:8:
+cc444
TM$8:8:8:8:8:8:
+cc444
TM$8:8:8:8:8:8:
+ccc44
TM$8:8:8:8:8:8:
z_z_z_z_z_z_cccc44
TM$TM$8:8:8:8:8:8:
z_z_z_z_z_z_cccc440~TM$TM$8:8:8:8:8:8:
z_z_z_z_z_z_ccccc40~TM$TM$8:8:8:8:8:8:
z_z_z_z_z_z_ccccc40~TM$TM$8:8:8:8:8:8:
z_z_z_z_z_z_cccccc0~TM$TM$8:8:8:8:8:8:
z_z_z_z_z_z_cccccc0~TM$TM$8:8:8:8:8:8:
+B4cccccccc0~TM$TM$8:8:8:8:8:8:
+ccccccccTM$TM$8:8:8:8:8:8:
+ccccccccTM$TM$8:8:8:8:8:8:
+4ccccccccTM$
8:8:8:8:8:8:
cccccc8:8:8:8:8:8:8:
ccccc8:8:8:8:8:8:8:
z_z_z_z_z_z_N
ccccc8:8:8:8:8:8:8:
z_z_z_z_z_z_N
cccc8:8:8:8:8:8:8:
+z_z_z_z_z_z_N
cccc8:8:8:8:8:8:8:
+z_z_z_z_z_z_N
cccc8:8:8:8:8:8:8:
+z_z_z_z_z_z_N
cccc8:8:8:8:8:8:8:
+z_z_z_z_z_z_N
cccTM$8:8:8:8:8:8:8:
cccTM$8:8:8:8:8:8:8:
8:8:8:8:8:8:8:
8:8:8:8:8:8:8:
8:8:8:8:8:8:8:
8:8:8:8:8:8:8:
8:8:8:8:8:8:8:
z_z_z_z_z_N
8:8:8:8:8:8:8:
z_z_z_z_z_z_N
8:8:8:8:8:8:8:
4z_z_z_z_z_z_N
8:8:8:8:8:8:8:
44z_z_z_z_z_z_N
8:8:8:8:8:8:8:
44z_z_z_z_z_z_N
8:8:8:8:8:8:8:
44z_z_z_z_z_N
8:8:8:8:8:8:8:
8:8:8:8:8:8:8:
8:8:8:8:8:8:5
8:8:8:8:8:8:5
4444444
8:8:8:8:8:8:5
4444444
8:8:8:8:8:8:5
4444444z_
8:8:8:8:8:8:5
44z_z_z_z_z_z_
8:8:8:8:8:8:8:5
44z_z_z_z_z_z_
8:8:8:8:8:8:8:5
44z_z_z_z_z_z_
8:8:8:8:8:8:8:5
44z_z_z_z_z_z_
8:8:8:8:8:8:8:5
44z_z_z_z_z_z_
dQu8:8:8:8:8:8:8:5
444z_z_z_z_z_
!v!v8:8:8:8:8:8:8:5
!v!v8:8:8:8:8:8:8:5
!v!v8:8:8:8:8:8:55
uu8:8:8:8:8:8:55
!v!v!vuTM$8:8:8:8:8:8:55
444444
dQdQdQdQTM$8:8:8:8:8:8:55
444444
8:8:8:8:8:8:55
444z_z_z_z_z_z_
8:8:8:8:8:8:55
444z_z_z_z_z_z_
TM$8:8:8:8:8:8:55
444z_z_z_z_z_z_
8:8:8:8:8:8:55
444z_z_z_z_z_z_
8:8:8:8:8:8:55
444z_z_z_z_z_z_
TM$8:8:8:8:8:8:55
444z_z_z_z_z_N
TM$8:8:8:8:8:8:55
TM$8:8:8:8:8:8:55
TM$8:8:8:8:8:8:58:
8:8:8:8:8:558:
8:8:8:8:8:558:
8:8:8:558:
8:8:8:8:8:558:
z_z_z_z_z_z_
8:8:8:8:8:55!v
z_z_z_z_z_z_
8:8:8:8:8:8:55!v
z_z_z_z_z_z_
TM$8:8:8:8:8:8:55!v
z_z_z_z_z_z_R`TM$8:8:8:8:8:8:55!v
z_z_z_z_z_z_R`TM$8:8:8:8:8:8:55!v
z_z_z_z_
R`R`TM$8:8:8:8:8:8:55!v
R`R`8:8:8:8:8:8:55!v
444BBB
!vR`R`8:8:8:8:8:8:58:!v
JB!vR`R`dQ8:8:8:8:8:558:!v
8:8:8:8:8:558:
8:8:8:8:8:558:
8:8:8:8:8:558:
Jz_z_z_z_z_z_N
8:8:8:8:8:558:
Jz_z_z_z_z_z_N
8:8:8:8:8:558:
z_z_z_z_z_z_N
8:8:8:8:8:558:
z_z_z_z_z_z_N
8:8:8:8:8:558:
z_z_z_z_z_z_N
8:8:8:8:8:558:
z_z_z_z_N
8:8:8:8:8:558:
8:8:8:8:8:558:!v
8:8:8:8:8:558:!v
8:8:8:8:8:8:8:8:
8:8:8:8:8:8:8:8:
8:8:8:8:8:8:8:8:
8:8:8:8:8:8:8:8:!v
z_z_z_z_z_z_N
8:8:8:8:8:8:8:8:
z_z_z_z_z_z_N
8:8:8:8:8:8:8:8:u
z_z_z_z_z_z_N
8:8:8:8:8:8:8:
z_z_z_z_z_z_N
8:8:8:8:8:8:8:
z_z_z_z_z_z_N
8:8:8:8:8:
z_z_z_z_N
TM$TM$TM$TM$
TM$TM$TM$TM$
TM$TM$TM$TM$!v
TM$TM$TM$TM$!v!vuu
TM$TM$TM$TM$!v!vuu
TM$TM$TM$TM$!v!vuu
z_z_z_N
TM$TM$TM$TM$!v!vuu
BBBBBz_z_z_z_z_z_TM$TM$TM$TM$
BBBBBz_z_z_z_z_z_TM$TM$TM$
J!v!v//
BBBBBz_z_z_z_z_z_
BBBBBz_z_z_z_z_z_
BBBBBBz_z_z_z_z_z_
BBBBBBz_z_z_a!v//
BBBBBBBaa//!v
J!v!v!v!v
BBBBBBB//a!v!v!v
J!v!v!v!v!v
BBBBBBBaaa!v!v!v!vR`R`!v!v!v!v!v
BBBBBBaaaa!v!v!v!vR`R`!v!v!v!v!v
BBBBBBaaaa!v!v!v!vR`R`!v!v!v!v!v
BBBBBaa!v!vz_z_z_!v!vR`R`!v!v!v!v!v
BBBB!v!v!vz_z_z_z_z_z_!vR`R`!v!v!v!v!v
6hO!v!v!v!v!vz_z_z_z_z_z_!vR`R`!v!v!v!v!v
6hO!v!v!v!v!vz_z_z_z_z_z_!vR`R`!v!v!v!v!v
6hO!v!v!v!v!vz_z_z_z_z_z_!v!vR`R`!v!v!v!v
6hO!v!v!v!v!vz_z_z_z_z_z_!v!vR`R`!v!v!v!v
6hO!v!v!v!v!vz_z_z_!v!v!v!v!vR`R`!v!v!v!v
6hO!v!vaaaaaaa!v!v!v!vR`R`!v!v!v!v
OO!v!v!vaaaaaa!v!v!v!vR`R`!v!v!v!v
OO!v!v!vaaaaaa!v!v!v!vR`R`!v!v!v!v
OO!v!v!vaaaaaa!v!v!v!vR`R`!v!v!v!v
OO!v!v!vaaaaaa!v!v!v!vR`R`!v!v!v!v
OO!v!v!vaaaaaz_z_z_!v!v!vR`R`!v!v!v
O!v!v!v!vaaz_z_z_z_z_z_!v!v!vR`R`!v!v!v
!v!v!v!v!vaaz_z_z_z_z_z_!v!v!vR`R`!v!v!v
!v!v!v!v!vaaz_z_z_z_z_z_!v!v!vR`R`!v!v!v
!v!v!v!v!vaaz_z_z_z_z_z_!v!v!vR`R`!v!v!v
!v!v!v!v!vaaz_z_z_z_z_z_!v!v!vR`R`!v!v!v
!v!v!v!v!vaaaz_z_z_z_z_!v!v!vR`R`!v!v!v
!v!v!v!v!vaaaz_z_z_z_z_!v!v!vR`R`!v!v!v
!v!v!v!v!vaaaz_z_z_z_z_!v!v!v!vR`R`!v!v
!v!v!v!v!vaaaaaa!v!v!v!v!v!vR`R`!v!v
!v!v!v!v!vaaaaaa!v!v!v!v!v!vR`R`!v!v
!v!v!v!v!vaaaaaa!v!v!v!v!v!vR`R`!v!v
!v!v!v!v!v!vaaaaa!v!v!v!v!v!vR`R`!v!v
!v!v!v!v!v!vaaaaa!v!v!v!v!v!vR`R`!v!v
!v!v!v!v!v!vaaaaa!v!v!v!v!v!vR`R`!v!v
!v!v!v!v!v!v!v!v!v!v!v!v!v!v!v!v!vR`R`!v!v
!v!v!v!v!v!v!v!v!v!v!v!v!v!v!v!v!v!vR`R`!v
rrr>d>d>d>d>d>d>d>d>d>d>d>d>d>d']I']I>d>d>d>d>d>d>d>d>d>d>d>d>d>d>d>d>d>d>d>d
>d>d>dr>d>d>d>d>dr>d>d>d>d>d>d>d>d>d']I']I>d>d>d>d}}}>d>d>d>d>d>d>d>d>d>d>d
%3DTDTDTDTDTDTDTDTDTDTDTDTDTDTan'+v>d>d>d>d>d>d>d>d>d
>d>d>d>d>d>d>d>drrrr>d>d>d>d>d>d>d ']I>d>d}}}}}>d>d>d>d>d>d>d>d>d
%3DTDTDTDTDTDTDTDTDTDTDTDTDTan>d>d>d>d>d>d>d>d>d>d>d>d>d>d>d>d>d>d>d>d/b6/b6/b6/b6/b6/b6/b6>d>d>d>d>d>d>d>drrrrr>d>d>d>d>d
}}}}}>d>d>d>d>d>d>d>d
%3>d>dDTDTDTDTDTDTDTDTDTDTDTDT>d>d'+v>d>d>d>d>d>d>d/b6/b6/b6/b6/b6/b6AA/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6>d>d>d>d>d>d>drrrrrrr>d>d>d>d
%3>d>d>d>dDTDTDTDTDTDTDTDTDTDTDT/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6AAAA/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6>d>d>d>d>d>d>d>drrrrrrr>d>d>d>d']I
>d>d>d>d>d>d
%3>d>d>d>d>d/b6DTDTDTDTDTDTDTDTDTDT/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6AAAAAAA/b6/b6/b6/b6/b6/b6/b6/b6/b6>d>d>d>d>d>d>d>d>d>drrrrrrr>d>d']I']I>d
>d>d>d
%3/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6DTDTDTDTDTDTDTDT/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6AAAAAAA/b6/b6/b6/b6/b6/b6/b6/b6>d>d>d>d>d>d>d>d>d>d>d>drrrrrrr>d>d']I']I>d>d>d
>d>d>d /b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6DTDTDTDTDTananananan/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6AAAAAAA+
+>d>d>d>d>d>d>d>d>d>d>d>d>d>d>d>drrrrr>d>d']I']I>d>d/b6/b6/b6/b6/b6 /b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6anananan/b6/b6/b6/b6A/b6/b6>d>d>d>dAAAAAA+
>d>d>d>d>d>d>d>d>d>d>d>d>d>d>d>d>drrr>d>d>d}}}}/b6/b6/b6/b6/b6/b6 /b6/b6/b6 /b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6b
/b6/b6/b6anananan>d>dAAA>d+>d>d+++AAA>d>d
>d>d>d>d
Rx>d>d>d>d>d>d>d>d>d>d>d>d>d>d>d>d>d>d}}}}}/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6 /b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6>d>d>d>d>db
>d>d>danananan>dAAAAA+>d>d+++A>d>d>d>d
>d>d>d>dHqfqf>d>d>d>d>d>d>d>d>d>d>d>d>d>d>d}}}}}}/b6/b6/b6/b6/b6/b6/b6/b6/b6/b6
>d>d>d>d>d>d>d>d>d>d>d>d>d>d>d>db
>d++++AAAAAAA
@@>d>d>d>d>d>d>d>d
>d>d>d
HHHHqf>d>d>d>d>d>d>d>d>d>d>d>d>d}}}}}rr/b6/b6/b6/b6
%3>d
>d>d>d>d>d>d>d>d>d>d>d>d>d>d>d>d+>db
+++++>dAAAAAAA
@>d>d>d>d>d>d>d
HHHHHH>d>d>d>d>d>d>d>d>d>d>d}}}}}}rrrr
%3>d>d>d>d>d>d>d>d>d>d>d>d>d>d>d++++++>db
+>d>d>d>d@AAAAAAA
@>d>d>d>d>d>d
HHHHHHHHH>d>d>d>d>d>d>d>d}}}}}rrrrrr
%3>d>d>d>d>d>d>d>d>d>d>d++++>d>d+++++>d>db
A>d>d>d@@@anAAAAA
@>d>d>d>d>d>d
......
HHHHHHHHHHHH>d>d>d>d}}}}}}rrr
%3>d>d>d>d>d>d>d+>d>d++++++>d>d>d>d>d>d>d>dAAAA
@@anananan@AA
@>d>d>d>d>d>d>d>d
........HHHHHHHHHHHHHHH
}}}}}']I
rr>d>d>d++++++>d>d++>d>d>d>d>d>d>d>d>d>dcAAAAA
@@@anananan>d>d>d>d>d>d>d>d>d>d
.........HHHHHHHHHHHHHHHH}}}}}']I
++++++>d>d>d>d>d>d>d>d>d>d>d>dccAAAAAAAA
@@anananan>d>d>d>d>d>d>d>d>d
..........HHHHHHHHHHHHHHH}}}}}}']I']I
>d>d>dcccAAAAAAAAAA
@>dananan>d>d>d'+v>d>d>d>d>d
..........HHHHHHHHHHHHHHH}}}}}HHH
r>d>d>d>drrr
k:cccAAAAAAAAAAAAA>d>d>d>d>d>d>d>d'+v>d>d>d
...........HHHHHHHHHHHHHH}}}}}}HHHH
H>d>d>d>d
rrrr>d
>dccccAAAAAAAAAAAAA
>d>d>d>d>d
............>d>dHHHHHHHHHHHH}}}}}HHHHHHHHHHH
ccAAAAAAAAAAAA^Db
.............|u|u|u>d>dHHHHHHHHHH}}}}HHHHHHHHHHHH
AAAAAAAAAAAA^D^D^Db
j>dj>d>d>danan
+,+,+,+,...........>d|u|u|u|u|u|u|u|uHHHHHHHHH}HHHH
HHHHHHHHHHHHr
AAAAAAAAAA^D^D^D^D^D
>d>d>danananan
>d+,+,+,+,+,+,+,tt
>d>d>d|u|u|u|u|u|u|u|u|u|u|uHHHHHHHHHHH
HHHHHHHHHH
AAAAAAAAA^D^D^D^D^D^D
anananan
>d>d>d>d+,+,+,+,+,tt>d>d>d>d>d>d>d>d|u|u|u|u|u|u|u|u|u|u|u|u|u|uHHHHHHHH
HHHHHHHHH
AAAAAA^D^D^D^D^D^D^D
anananan
>d>d>d>d>d+,+,>dtt>d>d>d>d>d>d>d>d|u|u|u|u|u|u|u|u|u|u|u|u|u|u|uqfHHHHHH
HHHHHHHHHH
AAHHHHHH
AAAA^D^D^D^D^D^D^D^D^D
anananan
>d>d>d>d>d>d(P(P(P(P(P>d>d>d>d>d>d|u|u|u|u|u|u|u|u|u|u|u}}}|uC
HHHHHHHHHHAAAAHHHHHHHAjk:
^D^D^D^D^D^D^D
ananan
>d>d>d>d>d>d(P(P(P(P(P(P>d>d>d>d>d>d|u|u|u|u|u|u|u|u|u|u|u}}}}}C
HHHHHHHHAAAAAA^D
HHjHjHHHH
^D^D^D^D
ananan
>d>d>d>d>d>d>d(P(P(P(P(P>d>d>d>d>d>d
%3|u|u|u|u|u|u|u}}}}}}C
>dHHHHHHHHAAAAAAA
HHHHHHHHH^D^D^D
>d>danananan+,
+,>d>d>d
>d(P(P>d>d>d>d>d>d>d>d
%3|u|u}}}}}C
@@@>dHHHHHHAAAAAAA
HHHHHHHHHH
>d>danananan+,+,+,+,+,
>d>d>d>d>d>d>d>d>d>d
%3}}}}}}C
qf@@>d|u|u|uHHHAAAAAA
HHHHHHHHHHHH
anananan+,+,+,
>d>d>d>d>d>d>d>d>d>dp
%3}}}}}C
AAA|u|u|u|uj^D^DAAA^D^D^D^D^D
HHHHHHHHHHHHHH
ananan+,
>d>d>d>d>d>d>d>d>dp
%3}}}}}}C
AAAAA|u|u|u|u^D^DA^D^D^D^D^D^D^D
HHHHHHHHHHHHHHHHH
>d>d>d>d>d>d>d>d>dp
%3>d}}}}}cC
AAAAAAA|u|u|u|u^D^D^D^D^D^D^D^D^D^D
HHHHHHHHHHHHHHHHHHHH
>d>d>d>d>d>d>d>d>dp
%3>d>d}}}}}}p
jAAAAAAA>d>d>d>d^D^D^D^D^D^D^D^D^D^D
HHHHHHHHHHHHHHHHHHHHHHHH
>d>d>d>d>d>d>d>d>d>dp
%3>d>d>d}}}}}p
AAAAAAAqf>d>d>d>d^D^D^D^D^D^D^D^D|u|uHHHHHHHHHHHHHHHHHHHHHHHHHHHH
>d>d>d>d>d>d>d>d>d>dp
>d>d>d>d}}}}}p
AAAAAqfqfqf>d>d>d^D^D^D^D^D^D
HHHHHHHHHHHHHHHHHHHHHHHHHH
>d>d>d>d>d>d>d>d>d>d>dp
>d>d>d}}}}}}p
pAAAApC
AAA>d>dqfqfqfqf>d>d>d^D^D^D^D
HHHHHHHHHHHHHHHHHHHHHHHHHHH
>d>d>d>d>d|u|u|u>d>d>d>d>dp
>d>d>d}}}}}p
pAAAAApC
^D^D^D^D>dp
HHHHHHHHHHHHHHHHHHHHHHHHHHH>d>d|u|u|u|u|u|u|u|u|up
}}}}}AAAAAAAAC
^D^D^D^D^D^D>dp
>d>dHHHHHHHHHHHHHHHHHHHHHHHHHHH|u|u|u|u|u|u|u|u>d>d>d>d>d>d>d>d}}AAAAAAAAA^D^D^D^D^D^D^D^Dp
HHHHHHHHHHHHHHHHHHHHHHHHHHH|u|u|u|u|u>d>d
>d>d>d>dAAAAAAAAAAAAA^D^D^D^D^D^D^D^Dp
HHHHHHHHHHHHHHHHHHHHHHHHHHH|u|u
>d>d>d>dAAAAAAAAAAAAA^D^D^D^D^D^D^D^D^D^Dp
HHHHHHHHHHHHHHHHHHHHHHHHHHH>d>d>dAAAAAAAAAAAAA^D^D^D^D^D^D^D^D^D^D^D^D^Dp
HHHHHHHHHHHHHHHHHHHHHHHH>d>dA}}AAAAAAAAA^D^D^D^D^D^D^D^D^D^D^D^D^D^D^Dp
>d>d>d
>d>dHHHHHHHHHHHHHHHHHHHHHAAA}}}}AAAAA^D^D^D^D^D^D^D^D^D^D^D^D^D^D^D^Dp
>d>d>d>d>d
>d>d>dananananHHHHHHHHHHHHHHHHHHAA}}}}}}AAA^D^D^D^D^D^D^D^D^D^D^D^D^D^D^Dw?w?w?w?C
>d>d>d>d>d
>d>d>danananan>d>d>dHHHHHHHHHHHHHHHAA}}}}}AA^D^D^D^D^D^D^D^D^D^D^D^D^D^D^D^Dw?w?w?w?C
>d>d>d>d>d>d
>d>d>d>d>danananan>d>d>d>d>dHHHHHHHHHHHHA}}}}}}^D^D^D^D^D^D^D^D^D^D^D^D^D^D^D^Dw?w?w?w?w?C
>d>d>d>d>d>d>d
>d>d>d>d
anananp
>d>d>d>dHHHHHHHHHA}}}}}^D^D^D^D^D^D^D^D^D^D^D^D^D^D^D^Dw?w?w?w?w?w?C
pw?w?w?>d>d>d>d
>d>d>d>dHHHHHH}}}}}}^D^D^D^D^D^D^D^D^D^D^D^D^D^D>d>d>d>dw?w?w?w?w?C
w?w?w?w?w?w?w?w?w?w?w?w?w?>dp
>d>d>d>d>d>dHHHH(
AAAADDDDDDDD^^^^^[+[+[+55555555555
AAADDDDDDDDD^^^^[+5555555555555
zAAAAAA
ADDDDDDDDDDD^^555555555555555
zAAAAAAAA
DDDDDDDDDDDD55555555555555555
DDDDDDDDD5555555555555555555
zUUUs s s s
_DDDD5555555555555555555555
Us s s s
___55555555555555555555555
s s s U
55555555555555555555555
zOs s s s UU
55555555555555555555555
zs s s s UOOO55555555555555555555555[+
zs s s %
O55555555555555555555555[+[+[+
zs s s %
55555555555555555555555[+[+[+
zs s 55555555555555555555555[+[+D
z55555555555555555555555
8O[+[+[+D
z55555555555555555555555l.l.[+[+[+^D
z55555555555555555555555OOl.l.
8O[+[+[+^^
z55555555555555555555
ntOOl.l.
8O[+[+^^^
z555555555555555555555
n@@@@[+[+^^^5555555555555555555555
nq7@@@@@[+)
^^^55555555555555555555@@
nq7q7@@@@[+)
^^555555555555555555@@@
nq7q7q7g""H"H[+)
^5555555555555555@@@@@
nq7q7q7q7q7g""H[+[+[+Pl)
55555555555555@@@SUU
nq7q7q7q7q7q7
8O[+[+[+[+[+[+Pl)
555555555555G
SSSDdDdU
nq7q7q7q7q7q7q7[+[+[+[+[+[+[+Pl)
Pl5555555555I
SSSDdDdDdU
nq7q7q7q7q7q7q7q7[+[+[+[+[+[+[+PlPlPlPl55555555
nq7q7q7q7q7q7q7B[+[+[+[+[+[+[+PlPlPlPl555555
nq7q7q7q7B[+[+[+[+[+[+[+LLPlPl5555vvv
nSSSSG
nq7q7q7q7q7[+[+[+[+[+LLLLPl55
nq7q7q7q7[+[+[+[+[+LLLPl
q7q7q7q7
nq7q7q7q7q7[+LL[+[+[+[+
q7q7q7q7q7q7q7q7q7q7q7LLLL?s?s?s?s?s?s
q7q7q7q7q7q7q7q7q7q7q7q7L?sLLL?s?s?s?sLL
nvvLq7q7q7q7q7q7q7q7q7q7q7q7L?s?sL?s?s[+[+[+
nvvvvq7q7q7q7q7q7q7q7q7q7DLLL?s?s?s[+[+[+[+[+[+
nLLvvvvvq7q7q7q7q7q7q7?sLLLLLLL[+[+[+[+[+[+[+
nq7q7vvvq7q7q7?s?s?s?sLLLLLDLL[+[+[+[+[+[+[+
nq7q7?s?s?s?s?s?s?s?sLLLLLLD>PlPl[+[+[+[+[+[+[+PlAY
n?s?s?sq7q7DdLLLLDDUPl[+[+[+[+[+[+[+PlAY
nLLDDU[+[+[+[+[+[+[+PlAY
nLLLDDDuSL[+[+[+[+[+[+PlU
nLLLLDDDuSLU[+[+[+[+PlU
LLDDDDuSLUU[+[+[+[+PlAYq7
nDDDUUU[+[+[+[+p
[+[+[+[+p
[+[+[+[+AY
[+[+[+[+AY
UUU[+[+[+[+[+
nDUUUU[+[+[+[+[+[+[+
N0V0\0b0m0s0y00000000000000
1 161;1J1O1U1]1c1i1o1t1}1111111111111111
2 23282A2K2R2]2m222222-3p3v333333333
4?4D4w444444444
5F5N5_5d5x555555
676<6A6G6U6i6666666
7#797A7T7b7g7Z9`9f9l9r9x9~9999999999999999999999
: :&:,:2:8:`::;
<!<3<;<F<S<b<j<w<<<<<<<
=a=>>>>>>>>>>
?=?O?]?r?|?????
0@000@1H1]1h123336
:;H>L>P>T>X>\>`>d>q>>c?m?z?????????
0 0r0y0000011B2
3$3<3W333S4p444442585E5K5T5[5}5*6Z6o6w6666666666
7'7/7?7E7V7777777
8888A9Y9c9~9999999!:>:::g<r<<<<@=K=U=f=q==>
0(0.0X0000
151M1k11111"2(2=2]2222222222
3 3&3/353J3P3[3g3m3u3{333333333
4Q4W4444444[5~5555
6$6*666<6L6R6X6g6u6}66666666666666666
7 7$7*7/7>7T7Z7b7g7o7t7|7777777777
8"8(8.858C8f8s8
88888888
9*939?9v9
: :+:S:Y:k:~:::::::;;;
='=>=L=R=u=|=======
>G>>>>
d1u1111111
2&202I2S2f2222
3y333N44 5,5?5Q5l5t5|555555555
6D6U6i66
7L77c88
9#949m9999.:w:#;< ===c====
;1+2v333
8 8#8/858;8M8s99999:C;$>>>
1!1'1g2I3]3367'9g999;=====
50d1|1m2}8:!;M;o;`??
222222222
3#3)3N3T3Y3g3l3q3v3
3333333"4Q4W4q444
5555555555
6!6/646<6B6P6U666677<7C7H7O7T7b7777Z8i8o888888
9'9\99u::
;*;0;;;B;\;b;n;t;;;;
<&<5<X<]<b<y<<<
=,=4=:=D=J=T=Z=d=m=x=}======
0=0z00000000
1/1M1T1X1\1`1d1h1l1p11111122=2X2_2d2h2l22222222
3V3\3`3d3h3333
41474F4444A5G5S5556
848$9M99
>4>\>>
? ?V?`?
0R00152X22>6??????
081?1G1O1W1}1
2(2:2L2^2p22222222(35
6 6h6p6
666677+929::;
<:<W<s<<<<<9=?=E=K=Q=W=^=e=l=s=z================
>&>->L>>>5?O?X?
1,1111 5
6W77779;;;
7z9999=7>
1J3s33I4_44{55666
7)7[77#808O8`888
9+9g99[:n:
;*;};;;;
<4<?<m<{<<<<
=7=D=l====
>P>Z>>
3#3-3X3`3333333A6H6}66n8t8y8
88T9`999
:(:3:;:e:q::
;;_<<D=f=====
>9>J>>>{?
3M3333S44425:56f7
8D8N8Z8f8r8}8:
; ;?;h;|;;;8<<<!=>
=0F000
1'1@111117
66666666
7 7$7(7,7074787<7@7D7H7L7P7T7X7\7;
4<8<<<@<D<H<L<P<T<X<\<`<d<h<l<p<t<x<|<<<<<<<<<<<<<<>
7H7[768<8B8H8N8T8Z8`8f8l8r8x8~8888888888888888888888
9 9&9,92989>9D9J9P9V9\9b9h9n9t9z999999999999999
3 44788
t:|:::::::::::::::::
: :$:(:,:0:4:8:<:@:D:??
0 0(00080@0H0P0X0`0h0p0x00000000000000000
1 1(10181@1H1P1X1`1h1p1x11111111111111111
2 2(20282@2H2P2X2`2h2p2x2222222
3 3\;`;d;h;
282D2`2l222222
303P3p33333333
404P4p44444
505P5p555555
6(646@6
5>????????????????????????????????
0 0$0(080<0@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|00000000000000000000000000@1P1`1p1111111111111111111111
2 2$2(2,2024282<2H2L2P2T2X2\2`2d2h2l2p22
MTU7MTU=KISA
@ I @ @ @ @ @ @
Y i l e t o z o y i h e b e z o b u w u c i w u d o c a d u f e r o
M a j a k a c a n a l u h i b u z o l u f a f o r a f o d u j u g i f o y u n i c e
P u f i t e y i
V a y i t o
P i y i w a y a y e h a c u b e n e g i j u g u d a n e p i k o t i g o d i m u w u s o c u
B o k e j u n i k u d i h u b e k o
C i y e x a w e k o z a r i x e c u f a z u k o f a t e p a x u d o c a g i g i y o v e k e s o d o
m s c o r e e . d l l
r u n t i m e e r r o r
T L O S S e r r o r
S I N G e r r o r
D O M A I N e r r o r
- A t t e m p t t o u s e M S I L c o d e f r o m t h i s a s s e m b l y d u r i n g n a t i v e c o d e i n i t i a l i z a t i o n
T h i s i n d i c a t e s a b u g i n y o u r a p p l i c a t i o n . I t i s m o s t l i k e l y t h e r e s u l t o f c a l l i n g a n M S I L - c o m p i l e d ( / c l r ) f u n c t i o n f r o m a n a t i v e c o n s t r u c t o r o r f r o m D l l M a i n .
- n o t e n o u g h s p a c e f o r l o c a l e i n f o r m a t i o n
- A t t e m p t t o i n i t i a l i z e t h e C R T m o r e t h a n o n c e .
T h i s i n d i c a t e s a b u g i n y o u r a p p l i c a t i o n .
- C R T n o t i n i t i a l i z e d
- u n a b l e t o i n i t i a l i z e h e a p
- n o t e n o u g h s p a c e f o r l o w i o i n i t i a l i z a t i o n
- n o t e n o u g h s p a c e f o r s t d i o i n i t i a l i z a t i o n
- p u r e v i r t u a l f u n c t i o n c a l l
- n o t e n o u g h s p a c e f o r _ o n e x i t / a t e x i t t a b l e
- u n a b l e t o o p e n c o n s o l e d e v i c e
- u n e x p e c t e d h e a p e r r o r
- u n e x p e c t e d m u l t i t h r e a d l o c k e r r o r
- n o t e n o u g h s p a c e f o r t h r e a d d a t a
- a b o r t ( ) h a s b e e n c a l l e d
- n o t e n o u g h s p a c e f o r e n v i r o n m e n t
- n o t e n o u g h s p a c e f o r a r g u m e n t s
- f l o a t i n g p o i n t s u p p o r t n o t l o a d e d
A M i c r o s o f t V i s u a l C + + R u n t i m e L i b r a r y
< p r o g r a m n a m e u n k n o w n >
R u n t i m e E r r o r !
P r o g r a m :
K E R N E L 3 2 . D L L
H H : m m : s s
d d d d , M M M M d d , y y y y
M M / d d / y y
D e c e m b e r
N o v e m b e r
O c t o b e r
S e p t e m b e r
A u g u s t
F e b r u a r y
J a n u a r y
S a t u r d a y
F r i d a y
T h u r s d a y
W e d n e s d a y
T u e s d a y
M o n d a y
S u n d a y
n ( n u l l )
A D V A P I 3 2 . D L L
W U S E R 3 2 . D L L
( ( ( ( ( H
h ( ( ( ( H
H
C O N O U T $
A A A A A A A A A A A A A A A A A A A A A
A A A A A A A A A A
A A A A A A A A A A
A @ @ @ @ @ @ @ @ @ @
B E E E E E E E E E
B E E E E E E E
f f f f f f f
g e l l l h h h h
i i i i i i i i
j j j j j j j j j
k k k k k k k k k
l l l l l l m
g g g g g g g
f f f f f f f
g e l l l h h h h
i i i i i i i i
j j j j j j j j j
k k k k k k k k k
l l l l l l m
g g g g g g g
D A R E J A X U L A D A W I M I D U V I
K U P O V E
L E R A L U W A F U J O J O X A R U K U
T ^ ^ ^ ^ ^ ^
B ^ ^ ^ ^ ^ ^
B ^ ^ ^ ^ ^ ^
B ^ ^ ^ ^ ^ ^
T ^ ^ ^ ^ ^ ^ ^
T ^ ^ ^ ^ ^ ^
B ^ ^ ^ ^ ^ ^
B ^ ^ ^ ^ ^ ^
B ^ ^ ^ ^ ^ ^
B ^ ^ ^ ^ ^ ^
B ^ ^ ^ ^ ^ ^ ^
B ^ ^ ^ ^ ^ ^
B ^ ^ ^ ^ ^ ^
B ^ ^ ^ ^ ^ ^
B ^ ^ ^ ^ ^ ^
G a g u l u c u r u k e y u r o y u p o h e v e
0 J u v i n e h i s i v i h o h i c e f o g a v o h a z o b u g u k u w u t i k e f e v a
V o w o t a x a y u l a w u z e
P u b a x a x i h i
H e p i p i g u d i s i r a b u z o
D a v a k o f a f a h o
( S u k e n a h e w e h o v e m a r i w i k u j i n u c e w u z a z a l u
B a h o h o m e g e v u l a h e l o y e h o z o
H u h a m o v e t o k e t u m o d i
% T e b o s i n i m u s e b u y u b e p i j e p a p u h a s o v o c o
Y i y u g o
J i k i l o v a x a r u j u f u r o d e
X u v a z e g e s u c i d u l a s a
# B o r u k i k e k i m u x u r u p o v o j u r o t a v u g o y i
F e j i g e f a s o z a m o l u y u g i
Y a d o s a w e w e c a r i x a
L i v u d u
S u w o f o b o l i k u h u b u j o j u k a l o l i j o
0 B u m a r i k i y a h a v i x u r i f i z a k i x u h i k a t i p u c a x e g e c a v a
F e c u z a l o c i t o
) L o n u m u w i w i t o w e p o r e j e z a l e f e w u x a m u x e t a j o
B o f e x e m e d a p i p o s i j e p a f i n a r a d o
S e k a d o h a j e d u m i y a b e d a s e y e r u
% X i y e h o x i d e c e k a j e g e x o z a y a g o p e g i y u t u
# G a s o j i s o r i z o s e x a b o n e r a m u y o k e z a n i
B i y u y i n a x o d e
Process Tree
-
03ab907e2d5d56af69390d6f2e4e7cffa7080cd6d54b85b134b7e7a95e2df3fb.exe (616)
"C:\Users\Administrator\AppData\Local\Temp\03ab907e2d5d56af69390d6f2e4e7cffa7080cd6d54b85b134b7e7a95e2df3fb.exe"
- nslookup.exe (360) nslookup ransomware.bit ns1.corp-servers.ru
- nslookup.exe (2304) nslookup zonealarm.bit ns1.corp-servers.ru
- nslookup.exe (2836) nslookup zonealarm.bit ns2.corp-servers.ru
- nslookup.exe (2908) nslookup ransomware.bit ns2.corp-servers.ru
- nslookup.exe (2480) nslookup ransomware.bit ns1.corp-servers.ru
- nslookup.exe (1920) nslookup zonealarm.bit ns2.corp-servers.ru
- nslookup.exe (316) nslookup zonealarm.bit ns1.corp-servers.ru
- nslookup.exe (1676) nslookup ransomware.bit ns1.corp-servers.ru
- nslookup.exe (2404) nslookup zonealarm.bit ns1.corp-servers.ru
- nslookup.exe (2520) nslookup ransomware.bit ns2.corp-servers.ru
- nslookup.exe (1056) nslookup zonealarm.bit ns2.corp-servers.ru
- nslookup.exe (1260) nslookup zonealarm.bit ns2.corp-servers.ru
- nslookup.exe (868) nslookup zonealarm.bit ns2.corp-servers.ru
- nslookup.exe (2916) nslookup zonealarm.bit ns1.corp-servers.ru
- nslookup.exe (2024) nslookup zonealarm.bit ns1.corp-servers.ru
- nslookup.exe (2604) nslookup zonealarm.bit ns2.corp-servers.ru
- nslookup.exe (2308) nslookup zonealarm.bit ns1.corp-servers.ru
- nslookup.exe (2692) nslookup ransomware.bit ns1.corp-servers.ru
- nslookup.exe (2020) nslookup ransomware.bit ns1.corp-servers.ru
- nslookup.exe (2868) nslookup zonealarm.bit ns2.corp-servers.ru
- nslookup.exe (2728) nslookup zonealarm.bit ns2.corp-servers.ru
- nslookup.exe (2972) nslookup ransomware.bit ns2.corp-servers.ru
- nslookup.exe (2596) nslookup ransomware.bit ns1.corp-servers.ru
- nslookup.exe (2112) nslookup zonealarm.bit ns2.corp-servers.ru
- nslookup.exe (1092) nslookup ransomware.bit ns1.corp-servers.ru
- nslookup.exe (1928) nslookup zonealarm.bit ns1.corp-servers.ru
- nslookup.exe (1160) nslookup ransomware.bit ns1.corp-servers.ru
- nslookup.exe (2192) nslookup ransomware.bit ns2.corp-servers.ru
- nslookup.exe (2136) nslookup ransomware.bit ns2.corp-servers.ru
- nslookup.exe (2496) nslookup ransomware.bit ns2.corp-servers.ru
- nslookup.exe (2032) nslookup zonealarm.bit ns1.corp-servers.ru
- nslookup.exe (1200) nslookup ransomware.bit ns2.corp-servers.ru
- nslookup.exe (2460) nslookup zonealarm.bit ns1.corp-servers.ru
- nslookup.exe (2380) nslookup ransomware.bit ns2.corp-servers.ru
- nslookup.exe (2388) nslookup ransomware.bit ns2.corp-servers.ru
03ab907e2d5d56af69390d6f2e4e7cffa7080cd6d54b85b134b7e7a95e2df3fb.exe, PID: 616, Parent PID: 2224
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 2404, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 1200, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 1920, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 2480, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 1928, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 2388, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 2728, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 2020, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 2916, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 2380, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 868, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 360, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 2308, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 2972, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 2112, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 2596, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 2024, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 2520, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 1056, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 1092, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 2304, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 2908, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 2604, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 1160, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 316, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 2136, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 1260, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 2692, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 2460, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 2496, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 2836, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 1676, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 2032, Parent PID: 616
default registry file network process services synchronisation iexplore office pdf
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | 131.107.255.255 | |
| ipv4bot.whatismyipaddress.com | ||
| ns1.corp-servers.ru | ||
| 114.114.114.114.in-addr.arpa |
PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com PTR public1.114dns.com |
|
| ns2.corp-servers.ru | ||
| zonealarm.bit | ||
| zonealarm.bit | ||
| ransomware.bit | ||
| ransomware.bit |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 61714 | 8.8.8.8 | 53 |
| 192.168.56.101 | 56933 | 8.8.8.8 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
| 192.168.56.101 | 57665 | 114.114.114.114 | 53 |
| 192.168.56.101 | 51758 | 114.114.114.114 | 53 |
| 192.168.56.101 | 51758 | 8.8.8.8 | 53 |
| 192.168.56.101 | 51759 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52215 | 8.8.8.8 | 53 |
| 192.168.56.101 | 52216 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52217 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52215 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52218 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52219 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52220 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52221 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52222 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52223 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52224 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52225 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52226 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52227 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52228 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52229 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52230 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52231 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52232 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52233 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52234 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52235 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52236 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52237 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52238 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52239 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52240 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52241 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52242 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52243 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52244 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52245 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52246 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52247 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52248 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52249 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52250 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52251 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52252 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52253 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52254 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52255 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52256 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52257 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52258 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52259 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52260 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52261 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52262 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52263 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52264 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52265 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52266 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52267 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52268 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52269 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52270 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52271 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52272 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52273 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52274 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52275 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52276 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52277 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52278 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52279 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52280 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52281 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52282 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52283 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52284 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52285 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52286 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52287 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52288 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52289 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52290 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52291 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52292 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52293 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52294 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52295 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52296 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52297 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52298 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52299 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52300 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52301 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52302 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52303 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52304 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52305 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52306 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52307 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52308 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52309 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52310 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52311 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52312 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52313 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52314 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52315 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52316 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52317 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52318 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52319 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52320 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52321 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52322 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52323 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52324 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52325 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52326 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52327 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52328 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52329 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52330 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52331 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52332 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52333 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52334 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52335 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52336 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52337 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52338 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52339 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52340 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52341 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52342 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52343 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52344 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52345 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52346 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52347 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52348 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52349 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52350 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52351 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52352 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52353 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52354 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52355 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52356 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52357 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52358 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52359 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52360 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52361 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52362 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52363 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52364 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52365 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52366 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52367 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52368 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52369 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52370 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52371 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52372 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52373 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52374 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52375 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52376 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52377 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52378 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52379 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52380 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52381 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52382 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52383 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52384 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52385 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52386 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52387 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52388 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52389 | 114.114.114.114 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | 554854c9f30c36dd_win.ini |
|---|---|
| Filepath | C:\Windows\win.ini |
| Size | 7.2KB |
| Processes | 616 (03ab907e2d5d56af69390d6f2e4e7cffa7080cd6d54b85b134b7e7a95e2df3fb.exe) |
| Type | Generic INItialization configuration [extensions] |
| MD5 | c8b4d2a5becf98cf17b509817cbb10e5 |
| SHA1 | 303cb650bef9aa47efa5037e57427e0e39c37680 |
| SHA256 | 554854c9f30c36ddd71343e2ee8c6e3ad740740fbc1cde748944f95f7d695d7f |
| CRC32 | CB360A50 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | ebe7f9ec28c08f08_miobzn.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Roaming\Microsoft\miobzn.exe |
| Size | 303.5KB |
| Processes | 616 (03ab907e2d5d56af69390d6f2e4e7cffa7080cd6d54b85b134b7e7a95e2df3fb.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | c85c5d3d306ad3a88f95c73482869291 |
| SHA1 | b790ab60d3cb85b638fa94ad6e540f51b075d24e |
| SHA256 | ebe7f9ec28c08f08654890ad1218f7dad536ec7feb7fd069fa4659f13ed09a26 |
| CRC32 | 777BD6D7 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.