3.6
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.82
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | Ransom:Win32/Gandcrab.309ade5a | 20190527 | 0.3.0.5 |
| Avast | Win32:RansomX-gen [Ransom] | 20200325 | 18.4.3895.0 |
| Baidu | None | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (W) | 20190702 | 1.0 |
| Kingsoft | None | 20200325 | 2013.8.14.323 |
| McAfee | GenericRXFJ-RT!B5330D0FFCAC | 20200325 | 6.0.6.653 |
| Tencent | Trojan.Win32.Gandcrab.r | 20200325 | 1.0.0.1 |
静态指标
查询计算机名称
(1 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545301.6255 GetComputerNameW |
computer_name:
TU-PC
|
success | 1 | 0 |
检查进程是否被调试器调试
(1 个事件)
使用Windows API生成加密密钥
(3 个事件)
检查系统中的内存量，这可以用于检测可用内存较少的虚拟机
(5 个事件)
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(1 个事件)
| section | .gfids |
文件包含未知的 PE 资源名称，可能指示打包器
(2 个事件)
| resource name | AFX_DIALOG_LAYOUT |
| resource name | GLJQUHNPHJ |
动态指标
解析可疑的顶级域名（TLD）
(2 个事件)
| domain | ns2.wowservers.ru | description | 俄罗斯联邦域名 TLD | ||||||
| domain | ns1.wowservers.ru | description | 俄罗斯联邦域名 TLD | ||||||
分配可读-可写-可执行内存（通常用于自解压）
(20 个事件)
查询磁盘大小，可用于检测具有小固定大小或动态分配的虚拟机
(1 个事件)
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Roaming\Microsoft\amgbqu.exe |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Roaming\Microsoft\amgbqu.exe |
搜索运行中的进程，可能用于识别沙箱规避、代码注入或内存转储的进程
(33 个事件)
检查适配器地址以检测虚拟网络接口
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545301.8755 GetAdaptersAddresses |
family:
0
flags: 0 |
failed | 111 | 0 |
|
1727545301.8755 GetAdaptersAddresses |
family:
0
flags: 0 |
success | 0 | 0 |
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(2 个事件)
| section | {'name': '.rsrc', 'virtual_address': '0x00075000', 'virtual_size': '0x00021544', 'size_of_data': '0x00021600', 'entropy': 7.914147819843593} | entropy | 7.914147819843593 | description | 发现高熵的节 | |||||||||
| entropy | 0.5493827160493827 | description | 此PE文件的整体熵值较高 | |||||||||||
使用 Windows 工具进行基本 Windows 功能
(4 个事件)
| cmdline | nslookup carder.bit ns2.wowservers.ru |
| cmdline | nslookup ransomware.bit ns2.wowservers.ru |
| cmdline | nslookup carder.bit ns1.wowservers.ru |
| cmdline | nslookup ransomware.bit ns1.wowservers.ru |
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
在 Windows 启动时自我安装以实现自动运行
(2 个事件)
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pxcjgqaocyy | reg_value | "C:\Users\Administrator\AppData\Roaming\Microsoft\amgbqu.exe" | ||||||
| file | C:\Windows\win.ini | ||||||||
文件已被 VirusTotal 上 65 个反病毒引擎识别为恶意
(50 out of 65 个事件)
| ALYac | Trojan.Ransom.GandCrab.Gen.2 |
| APEX | Malicious |
| AVG | Win32:RansomX-gen [Ransom] |
| Acronis | suspicious |
| Ad-Aware | Trojan.Ransom.GandCrab.Gen.2 |
| AhnLab-V3 | Win-Trojan/Gandcrab.Exp |
| Alibaba | Ransom:Win32/Gandcrab.309ade5a |
| Antiy-AVL | Trojan[Ransom]/Win32.GandCrypt |
| Arcabit | Trojan.Ransom.GandCrab.Gen.2 |
| Avast | Win32:RansomX-gen [Ransom] |
| Avira | HEUR/AGEN.1004070 |
| BitDefender | Trojan.Ransom.GandCrab.Gen.2 |
| BitDefenderTheta | Gen:NN.ZexaF.34104.pyX@a8yh7Ymi |
| Bkav | W32.AIDetectVM.malware |
| CAT-QuickHeal | Trojan.Mauvaise.SL1 |
| ClamAV | Win.Packed.Gandcrab-6552923-4 |
| Comodo | TrojWare.Win32.Chapak.GG@7ne4ou |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cybereason | malicious.ffcacc |
| Cylance | Unsafe |
| Cyren | W32/Trojan.LVKC-8883 |
| DrWeb | Trojan.Encoder.24384 |
| ESET-NOD32 | a variant of Win32/Kryptik.GGTU |
| Emsisoft | Trojan.Ransom.GandCrab.Gen.2 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Trojan2.PYPF |
| F-Secure | Heuristic.HEUR/AGEN.1004070 |
| FireEye | Generic.mg.b5330d0ffcacc979 |
| Fortinet | W32/Agent.BFJ!tr |
| GData | Trojan.Ransom.GandCrab.Gen.2 |
| Ikarus | Trojan-Ransom.GandCrab |
| Invincea | heuristic |
| Jiangmin | Trojan.GandCrypt.cv |
| K7AntiVirus | Trojan ( 0053305e1 ) |
| K7GW | Trojan ( 0053305e1 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| MAX | malware (ai score=84) |
| Malwarebytes | Trojan.MalPack.GS |
| MaxSecure | Ransomeware.GandCrypt.Gen |
| McAfee | GenericRXFJ-RT!B5330D0FFCAC |
| McAfee-GW-Edition | BehavesLike.Win32.Generic.dc |
| MicroWorld-eScan | Trojan.Ransom.GandCrab.Gen.2 |
| Microsoft | Ransom:Win32/Gandcrab.E!MTB |
| NANO-Antivirus | Trojan.Win32.Chapak.fcdqyc |
| Paloalto | generic.ml |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | Win32/Trojan.Ransom.f48 |
| Rising | Trojan.Kryptik!1.B1E3 (CLOUD) |
| SUPERAntiSpyware | Ransom.GandCrab/Variant |
| Sangfor | Malware |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2018-05-16 02:44:37
PE Imphash
2d9e7c15c5b4c9d97d16e58e5147e6f4
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x000126c7 | 0x00012800 | 6.616935164379052 |
| .rdata | 0x00014000 | 0x00006808 | 0x00006a00 | 5.171633076906104 |
| .data | 0x0001b000 | 0x00058f24 | 0x00001000 | 1.3810411345249083 |
| .gfids | 0x00074000 | 0x000000ac | 0x00000200 | 1.453511747253263 |
| .rsrc | 0x00075000 | 0x00021544 | 0x00021600 | 7.914147819843593 |
| .reloc | 0x00097000 | 0x00001084 | 0x00001200 | 6.354987427357414 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| AFX_DIALOG_LAYOUT | 0x00075544 | 0x00000002 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| GLJQUHNPHJ | 0x00075548 | 0x0001a838 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_CURSOR | 0x0008fd80 | 0x00000134 | LANG_ENGLISH | SUBLANG_ENGLISH_UK | None |
| RT_BITMAP | 0x0008feb4 | 0x00003928 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_ICON | 0x000937dc | 0x000025a8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00096444 | 0x00000098 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00096444 | 0x00000098 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00096444 | 0x00000098 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00096444 | 0x00000098 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00096444 | 0x00000098 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00096444 | 0x00000098 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00096444 | 0x00000098 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00096444 | 0x00000098 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00096444 | 0x00000098 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00096444 | 0x00000098 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00096444 | 0x00000098 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00096444 | 0x00000098 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00096444 | 0x00000098 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_STRING | 0x00096444 | 0x00000098 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_ACCELERATOR | 0x000964dc | 0x00000040 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_GROUP_CURSOR | 0x0009651c | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_UK | None |
| RT_GROUP_ICON | 0x00096530 | 0x00000014 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
Imports
Library KERNEL32.dll:
• 0x414000 VirtualAlloc
• 0x414004 GetLastError
• 0x414008 GetThreadContext
• 0x41400c FlushFileBuffers
• 0x414010 SetFileShortNameW
• 0x414014 SetCommBreak
• 0x414018 SetCommMask
• 0x41401c FileTimeToSystemTime
• 0x414020 GetSystemTimeAdjustment
• 0x414024 CreateMailslotA
• 0x414028 SetMailslotInfo
• 0x41402c FlushViewOfFile
• 0x414030 UnmapViewOfFile
• 0x414034 LoadLibraryW
• 0x414038 GetModuleFileNameA
• 0x41403c WriteProfileSectionW
• 0x414040 GetTempPathA
• 0x414044 FindNextVolumeMountPointW
• 0x414048 SetVolumeMountPointW
• 0x41404c GetNumberOfConsoleMouseButtons
• 0x414050 GetConsoleCP
• 0x414054 SetConsoleCP
• 0x414058 GetConsoleOutputCP
• 0x41405c DecodePointer
• 0x414060 SetEndOfFile
• 0x414064 QueryPerformanceCounter
• 0x414068 GetCurrentProcessId
• 0x41406c GetCurrentThreadId
• 0x414070 GetSystemTimeAsFileTime
• 0x414074 InitializeSListHead
• 0x414078 IsDebuggerPresent
• 0x41407c UnhandledExceptionFilter
• 0x414080 SetUnhandledExceptionFilter
• 0x414084 GetStartupInfoW
• 0x414088 IsProcessorFeaturePresent
• 0x41408c GetModuleHandleW
• 0x414090 GetCurrentProcess
• 0x414094 TerminateProcess
• 0x414098 RtlUnwind
• 0x41409c SetLastError
• 0x4140a0 EnterCriticalSection
• 0x4140a4 LeaveCriticalSection
• 0x4140a8 DeleteCriticalSection
• 0x4140ac InitializeCriticalSectionAndSpinCount
• 0x4140b0 TlsAlloc
• 0x4140b4 TlsGetValue
• 0x4140b8 TlsSetValue
• 0x4140bc TlsFree
• 0x4140c0 FreeLibrary
• 0x4140c4 GetProcAddress
• 0x4140c8 LoadLibraryExW
• 0x4140cc GetStdHandle
• 0x4140d0 WriteFile
• 0x4140d4 MultiByteToWideChar
• 0x4140d8 WideCharToMultiByte
• 0x4140dc ExitProcess
• 0x4140e0 GetModuleHandleExW
• 0x4140e4 GetACP
• 0x4140e8 HeapFree
• 0x4140ec HeapAlloc
• 0x4140f0 GetConsoleMode
• 0x4140f4 GetFileType
• 0x4140f8 GetStringTypeW
• 0x4140fc CloseHandle
• 0x414100 FindClose
• 0x414104 FindFirstFileExA
• 0x414108 FindNextFileA
• 0x41410c IsValidCodePage
• 0x414110 GetOEMCP
• 0x414114 GetCPInfo
• 0x414118 GetCommandLineA
• 0x41411c GetCommandLineW
• 0x414120 GetEnvironmentStringsW
• 0x414124 FreeEnvironmentStringsW
• 0x414128 LCMapStringW
• 0x41412c SetStdHandle
• 0x414130 GetProcessHeap
• 0x414134 SetFilePointerEx
• 0x414138 WriteConsoleW
• 0x41413c ReadFile
• 0x414140 ReadConsoleW
• 0x414144 CreateFileW
• 0x414148 HeapSize
• 0x41414c HeapReAlloc
• 0x414150 RaiseException
L!This *0fm cannot be run in DOS mode.
`.rdata
@.data
.gfids
@.rsrc
@.reloc
E@E}[TZ
E@EE@EEHE
(;u3^]
+PQiYYt'x$
ME3M3M3;u
_^]3@3
VP50%G
|xffftfpflfhE
@jPEVP
^[]UDjDEj
8csmu%x
;r_^[SV@A
;r_^[%dAA
+SVW(A
1E3PeuEEEEd
Y__^[]QU%4%G
MEineIE5ntel
EEEEE|2j
u3u/ A
Mxf~UE
8csmu7=
E_^[]h(A
URPQQh
t;T$4t
;v.4v\
UVWS33333[_^]
33333USVWj
_^[]Ul$
2_^V5(G
3;tit
j Y+3;3_^[]US]
3W3<(G
^_[]UVhCA
^]^]%@A
V 3j Y+
j Y+33
USVWUj
P(RP$R
UPjh)@
t:|$,t
;t$,v-4v
UQPXY]Y[
~0WPQr
Y.V~Yt
YYu3^]j
u;tt>}
WIYt!E
jMQh(A
jMQh(A
MEEEPu
UQQSVW
EEEEPu
>x|Ml}Pu
;u$0u ]E
M0t,0<
O;u;tQP
X%uEuVP
<(t)Mi
USV3W}
USV3W}
t!},t%
MM]]EU,0<
Ut^;sZM
;ur%Ew
3E@}VWS
E]Pv4F
E]Pv4F
SV3W8^.u:Fl
F0EF4E]}t
AHMEUM
SV3W8^.u:Fl
F0EF4E]}t
t&uEPEPWS6
Z Z$Z([]
_Cl^[]
^ ^$^(8
^ ^$^(F
$YY]38M
+]+]KG
YPVWSu
kPVWSu
uEUSuu
U]eMj@Y+
aYY]38M
3SVW8A
B,;utZss
G;utO,ss
0,C,43
PP0SPq
@F;ut4s
A;utZss
uC3P,Ph
PP0SPl
P,PS=,@;
@A\;ut4s
YtE<4UA
3P,P0h
3P,P0h
0,C,S3,PP0h
C03PPh
A;utLss
F;utOss
@A\;ut4s
ssYCs3PPh
A;utRss
uC3P\Ph
PP`WP`
P\PW#\@;
*3P\P`h
u|P\P`h
3P\P`h
`\A\R3\PP`h
t+;v!j
+;w9r0K;t0;`u
2*3PPh
3 ;vI+t%33@3
M_^3[x]
SV3W3r
Ft2E;uu
_33[]VpAu
}tDEF@E4d$
^_33[]
t)EMMe
]]EEwPr
;Ev"E]
M33tUE
Eu]M3;wGr
9}s@t5u
u]UEHEu3U
Q V3+;
2^ItFt^^D^H
Et3g~%i
^ ^$^( F(
E3PR]9
^ ^$^(F
ItPLt>Tt,h
zu;@A
F F$F(2
V3uV,Uu'F
F(F$F F
?]tfSF
tX-u=;t9x
]t1X:v
]:t&uuT
8]uM[F
X]3@]j
Ej?XfEFhP
YM3^&]
E}PE}PWWS
_81EPEPE
JE}PV;
F@>\t>"u1
UQQSVW}
YYtm]R
YYt0WuV
Y_^[]3PPPPPJ
;uM_3^
P^Y]hv@
'YYSV_<
t*t <"u
G;uM_^3[^]
u3M_3^
j Y+33
j Y+33
_^[]3H*G
MEEEPu
MEEEPu
}]j Y+33
j Y;EtMME
_3^M3[k]
} j Y+3
j Y+33
YY]h@A
Vj 3Y+35(A
YY3^]j
<xt"<Xt
EQPjjM
M;ur%w
3A}VWP
MEEEPu
Kx7;5-G
EEPVYY
MQPEPu
E9Erf}
M_^3[]
Yf;u(F
D0(t p
M_^3[4]
M_^3[F]
M;rSShU
QP+PPSh
VYt9t"
uEWVPuEWVPuEWVP
3QMMMMQuWP
+E[M_3^"]
0ffffffE
|YM3_D
3PPPPPy
t'@-rA
U]tUHEP
CE;u_^[]
]A7tSF
3<at <rt
m2tEPSo
t>=umF8
EP}YY}
U]}UWu
}PQ3@|
EPQSRYPT
SPYYt1M
SY;ui-G
HLMMQP^
EAEfEEj
EPQEPEj
3^[]Wu
MEEEPu
MEEEPu
MEEEPu
MEEEPu
PY8W58A
S;Y+W58A
tVEfE*?P6M,H
Au+MCE
_[^]3PPPPP
#Y^[_]3PPPPPK
WWWPWS
u-PWWS
u7gY_^
MEEEPu
A;rM_^3[`]
wYMEIH;A
3SSVWh
WFY_^[]
E3HHEP
uEEEPj
wHuhOj
YuwHu;5 A
C9]vQ}
uVY3_M^3[\]
W3f9:t!V
f9:u^B
3tVVYWWWW+SVWW
Et4PYt
3PPuWSVPP
3;tit
j Y+3;3_^[]
3@M3^Y]
M3^vY]
M3^ Y]
M3^qX]
EVh0jA
EVh8jA
t'u(u$u u
M3^W]$
EVhPjA
YM3^+W]
Wj X.G
2^M3|V]
UQQSWj0j@v3
;t>Vw Sh
}^SY_[]
0;uVY_[^]j
^0S3uj
| 94+G
xi;5-G
Mj0Xu;t`F(
Wxg;5-G
PqYFD;
P_YFH;
PMYFL;
Y;u_^[]
339E WWu
#PDYtE
t4SWVQ
e_^[M3tN]
teF|t^8
VVVYY^]
-V0YtW
tWY3_^]
;u2[^M3_I]
MEEEPu
j Y+33
uk;u6p
YfEm}fE3
sKEPS!
3fEEEx
3]AEfEUEEj
uW$YY
d1(_^]
^u;5+G
F+_^[]
D8(HXt:fUf;u
ZT8,;f9Eu
SED8(Ht5FL8*
[+_^]j
totkE]j
E:Eu>E
t)t%E]j
SeYtqEM
(t]EPu
EPEPuu
P~YVY^
EPEPuu
^[]SVL$
MQP@M
t3EEEu
?SW}(3
u%E]PY
t=3^_[]j
Y+t>+t5+t,+t$@t
EPkYuz9}t
_^[]3PPPPP
33ySWj
uN3_[^]3fEEj
3PPPVG#
,VuWu u
UDSVWu
W3EUYY
3Yu(EE
-EHu E
UQQ3!EfE}=4%G
EVPbuY
;w_^M3[?%]
_^M3$]
;r^;t3
++;|9;s
T[M_3^[!]
^0\^]S+Wu
U]DUV3PPPPPPPPU
}$39E(j
}3PPPPPWSu
3QQQPu
#PcYtI
3PP9E u:PPVWPu$
u.WBY3S9Y
e_^[M3
MCu(Eu$u u
3^_]#tVYtVWj
E]3PPj
t9V$VtVP
YVY_^]j
YUWVSM
Yt0uVju
VdY_[^]
3VuuW#
V8&YQ;
3[_^]j
MEEEPu
Sx7;5-G
EEPV}YY
YY;tWYP
R<$tLD$
t*f u!f t
PQW|PEPB
YM_3^d
bt)t%C
YYM_3^L
3GY3Au
fEE;}++
j yY3^
u(EE$uEEPH\
ff#f;u3E
3SVWH<
B(;r3_^[]Ujh
1E3PEd
Y_^[]UE
33hp!@
+SVW(A
EPeuEEEEd
YWVU33D$
on0v00f
on0v00f
on0v00f
u r#
Ju t0
B:t6t:t't
B^_[WVt$
on0v00f
on0v00f
on0v00f
u r#
Ju t0
HuYUW=4%G
#3+#I#[
kuwizumedelocifucavo xilituvabujupexoyixuha pikosihemukuxabikugikija
besogu
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
operator ""
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
%{pk >_
EZ%qVJ
d8L2WBJa"=
[aOni*{
+4/'Pcq
)[f.;}eSw S
gV :6
ipev &g
f) }m?
:@O?owM&
juvD,GA
~ $s%r
@b;zO]3AOmm
- G 8NhU]i<
@;*xh2k
zKG-wn@
-Ciu+-,W
Ly;-"m^8{
yrvxyN
\lo};obwQ4Y+X<XF"
|WYu&Sgw
E]B.4o?nz(wKgg;
H[=J6RMq!
;<(wXC=sF|bt
P,=87Msgm
Ob{!@f
wdq=v/
3v2!L.2
@@w,=q/
ycg6fvPb
ut^6n16B(
.=k=yICyJ"p
BncW[5
^<V7w8=O
oi^,dH9
H'W&|.
IND)ind)
CorExitProcess
UTF-16LEUNICODE
!"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
AreFileApisANSI
GetCurrentPackageId
LCMapStringEx
LocaleNameToLCID
A.lzZ?
@-32? Dz
Jwk?zn
@$"3?5Wg4p6=
T?Nv$^
St)?4K
$?QhBC .=
(lX ?T@b ==
f??# =
G ? $l
?sdLi==
p|?rx"#2=
p ?h}s"=
%S#[k =
!V1?}a2=
q?20J5=
/@?"B <1=
z?\-!y!=
X0z?~b>==
Cq?y7i9+=
_hypot
_nextafter
.text$mn
.idata$5
.00cfg
.CRT$XCA
.CRT$XCAA
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIAC
.CRT$XIC
.CRT$XIZ
.CRT$XLA
.CRT$XLZ
.CRT$XPA
.CRT$XPX
.CRT$XPXA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$T
.rdata$sxdata
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.xdata$x
.idata$2
.idata$3
.idata$4
.idata$6
.tls$ZZZ
.gfids$x
.gfids$y
.rsrc$01
.rsrc$02
VirtualAlloc
GetLastError
GetThreadContext
FlushFileBuffers
SetFileShortNameW
SetCommBreak
SetCommMask
FileTimeToSystemTime
GetSystemTimeAdjustment
CreateMailslotA
SetMailslotInfo
FlushViewOfFile
UnmapViewOfFile
LoadLibraryW
GetModuleFileNameA
WriteProfileSectionW
GetTempPathA
FindNextVolumeMountPointW
SetVolumeMountPointW
GetNumberOfConsoleMouseButtons
GetConsoleCP
SetConsoleCP
GetConsoleOutputCP
KERNEL32.dll
CoGetContextToken
CoCancelCall
ole32.dll
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetConsoleMode
GetFileType
GetStringTypeW
CloseHandle
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetStdHandle
GetProcessHeap
SetFilePointerEx
WriteConsoleW
ReadFile
ReadConsoleW
CreateFileW
HeapSize
HeapReAlloc
SetEndOfFile
DecodePointer
RaiseException
1l>-gF
Z!2@Do`
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
m.BF|^2HQ/
V567[C/ qw
zgA,7>
B_%#hS
fj|.Jb,|V
zz;Lq
PW3i,~kE='|W}3U^
7A2V. H
Sqg6iHs
&wp*|l
cH"*xXp
JXSI>I
MCyBvd6#
2bnglh
#|QzNc
f{DPvQlMy
'~WbW!h<)XL-;
\Xb8Pe?
4*Z6x!#N@
C)YYsevR[
s{+GTqm
^v9)O?F
%Tf("kQ
1Ukmp{
SHReDbSmRsL5|2QhKaY&
RLQ04;)
.nJlFW
)o!gN^^
NH_I+@r
f66B"'
&ZEw]#FIN
1\+)jj8}
Q,6/|pSG
OMnu1,r
{a{"MG3NzH0*XqQvgNq#
t;Ue/y
1~|`nd
Zh;J(Sne
c4](=:<O
xtfQMVeiA
$A{;8t
8)+lmz
+nOGGU
[js5Rp1
($fS>AE
[w5H{R
j};$6]
qxz12O6o*!J
~BWqP%v
iN"$:3
BN8HPH;
:$HZ;h"
k8!$9`9Pa[
^#72qeV
W&x)VI}"p
y{ mvpW
#SQ#xHI
RO/y!e]N
Ll&]&kOQ*8as
l, d$2}f
uKw>V/OmFD2o
'K60@l4i
1ju<}$
Y*d&w&[
;w3q~s:dkb(-
#~]ph{u%d
V`de6`(Z
/|wt_Ao(
2gk}u;_X]p;
g"B5(N{O%?
-dYH\@%TW
j9;kzDP't7t(mX\eV@J
wcQ$ J
4vE(6btNS
MZey )q
Sc^#t$:H .c9$,-
U6/PjMFs
lH8?IhuKy?W
M`Q4{N2
,*19a>
?(5M*F
`P;vCr
>YAv^/
ftd'\1arFGX
LuRmh'+
Z'Q?qhhPM93%
,Ompe%
}$B,Is `
CR6o5m
IPEiWrkni
km6:_ti9%*t]
l>&,4gF 10
/{|CGi
R"|MtR]0
}$$a0W'
1J51vRo
NZU"faF@ "
:t[3^W
}nEzhCy
?o"\OxoOJ^
]yD{Xn
+Xf5kTv
~rY(9b}@>e
%iBE~`
]@(K^Uh
CP~!JH;h>
;IP9Kiv\t-qpe
[j9>W%eH
Kc]H{qBo
,:]O8N?o&
grU0D4Y
T+6{+}
E~pPjHc
1 y/cO/
;E^{sJ3h
9o,?T^|
Z5:4mzRP}
s0RZud}
sp;vRmxAk
^c=i:%*WU!
xP{ni
zX@4wpA
SJD7Hw{&eAC
fJv< x7aUC
NT_+{p
!6"@2LSo40yU
k;>B]fe
s~E`FZ
*,UW+s
Fl'_%c-@pO
+\?mC[
$}MMZd
FE?#8b)w9V_>o`lE^u'3X^X
_OCEpc
#&C4>O
O=0~25
4E7KgPFC
S!_Z;2wMpji`\
AS@az"X
3Te&}g,4
r#@'3,dy!6Fg
@X/) Q
/Mw ww
8fS&RD2
d[O4&T6`=
zFXqsjk>_Y
hN,SIv>
U52cvkH
x:Gk7G
U4a `$
whuxOku8
dsBP:jxJq\/
2v~vt1
D423U7\b
Nn]2$M7
E>gB;>;
2v03^c
S<\pe_<>WU
\j$MaCHp %
c|`cuiw#!?
"Z/aK{
Du[R`.
UI!)AN!
wi>B:x<
j2mSrcip
_%*':<
/8eVl6
>!=+2C
)TguOO6o
d9S1;3
7>6rO)
PU({05:Dcn"
(vq,S*
E/Hn6->
hS.O'C,I
#MDp*kt]!
T_%'?3
EYn.OV5Xk
%`R05,1wv
+eP(|h%}$Yc
Cb*ltA
S%Tp dR[s'Lv{&
k,@ V& \OZ#
EP/K7xL
@aps6j>
<?@ug7*6
mi(TNR
^*s~>v
j*;VEC
g1-x7_g
g~I@/01OtrOp
J_rK"{%Zu09
,WPe|._8
0PFA^-}hp`
_[VVVK
I2"k<3MoF~fzG,1sD
mBJ@_`
gbV'HnlDQ
>TWG"v
_<kp;q
b0*1Q^
'~maOq
vyO>#u.
LuG s3yY{m
>6K\"f
exFhuQTHW2
qT{[E,?@*
OC2QQ`zM
[TvS8B'4?L
EF9-sSxs
<5A,%r1|
_$&wh&
p6gs"*=#C
;nM]H }*kq
YX>[U9*'
c95lO)-, _h/
UQmkwh(
3U"7`#u2IF(D
)W0\MwzKRX
))4FRI
)!WLBq
dC\@Tp#:S122
yR*vg<}MVM
-HhC`M
"zl%l)Qj
(,yS hqY!A
"JSxzh)vD_B\|
Im-nw>(
f:-ycF
>r#wb.ia
B2g;"4/
u,^m*Z
)"I kbX=nlEZ#
Gjq*V>N;
&JJG:)
|3|jzx&a6
tVoKP<GO
cRI.^LKd6'u
THGLidSn
$]+zHb]k,1v
{KfB6+
$nNR`c_1
(Q8EK+^Si *B_KZH
},m11E
Li@IXvVW
f+(pz&7KtT",t^
GCBn?No&Cg
{da??Ycb'
BHUr8hJnR%M\C
JUU)]PM
2V9akO":E
l:V?Vq,yS
Z)Nd0b+qAcEL
Z41ai
*L3Ia|O%
"wQ9ie
+/.tOpj
b;iPr]K
z"`T,LE?DWq
Jd~b^[uT"{
p*D5[^/
DI.!v3G6sU
O.{Ime:j6
%bTI?;o
@IRZE\r`lN
qu8\g1Qh
:R>q4K@
3NrOwnN
Mh^& d
U)erY]*l
@#22OTLO;|vl%s;
d TFr~<
$*!^{]&
.?n4c:Qf-{
UcP4%FV
l5:c?\A@]
u-OQG/[oX_ZL
4pubH)/Mz
)PQ?z5QKJ`ip<oo
Dl^.ZhCG>/]
8(E(Jc
})\yNd.}y
5<-AX=fp2s_
&CbC95|=M
M3~S8y%
jLB@+X*'SeH<n
CD:+V"z[/
4A(O0Ib
@{Z}zH
& Ta"PWU.
']k0Xxji,}"gdw*wO+
owAq+GH
M79]'Sdv7
yn4dl;,
b!qEE@da]x8q
(ZK_DhR
uMEK}Y,AQ2
0eL(tl4%
6c.;U(
LWtL1 iP"C4>
E8w2p'nq/Wu-OziI
t'KpI]vD^Pl
N:y*al
zE??_$
0;hAr%
M`oM#Fmr@g^
s+8_GJ!
[Acp9^
/t/w#4
_Q6632:
.f.!nWN1!x
FSz/V1,
7%X/7!U
0H4Qa<'
M WCctxP0
PP(?_oy"K
;l5nY{
]%Dip&Orh
>"0*%1e#
A4*A :h
W7i"C;B_OT."
Xa}=?`
Hd\_fN1Cfk&3
XmJ_nK
'r/;5<.
aMcWt0{y
R5/]R6\
kmNfKND
b()B!?
3Isj.Y2
vhpG#
r=;5"M
<#/WTL
Z`5D5[,
k?'^)y<
$;x.fBH
a-[IcHn%
6{c:h1 IN:
+fJ$oUbxOI;
3t9/L&
OkJAQZB/6Fxn
fA`b-nMhtu
>=.y;x#/X-
>|a3J9
v8Xl%,1
dZ%[;TCI
D$n`ZE,K
VGO{Cckdp
xI2^W9o
^xk)x&
T''}'W
:}>q~%
G|2dKR3:c=;
z4DTOy
SUI)e\c/DI8j
n0G8:H=
2 '#C<D?-0q
%|1bz_CeDeB,
gV$<53_]|`?X^gw
s8s+A^Z7n19Y
~-{j0-
f x=EIV
k@Mf;
),v')cn_
_2SnJ_)n=1
LSni/+_l|
evzz;!%aq.W
k5,#t.
#Pj$'H`~1#egy!4=|>3h
8M^>_U
dU>sS/
[K+FMrZ
-.%I$n
0tZo8SY,M
{:Zh`@Yb&R@f25
xxK0\o3'SlKiC@
e*|mk,Z%eV
o83s<Ee%=P^?PmNeR[CbU&$)
,"V{'q
YLQZD!orx!
o\^[oT:iO0}
IH0GU$ioD:
N^}R! )v<
IGUk.xkh
}cu.S?
-k&|6_
uQukQVU^
3nMd^gzEf8
JW0Mg:
Z 'f r
"a3susRc5"
Y1,OX[^XD%I
nx1I>u}0DWtY
MwP, 4=o8
f`t{\Di
`M$.#*
t~Xs)|cPw
;4-m>s
[j>"Y0
>nHKz,L7]
_:!xU-Q
'y8Pea??S
"@K`kd|\
}2})fO>b
9wHzPI0uRh
Fd}I9 BTI
KO?_TeMv
UjC5x`(m-#l
k$ X|XU
_E`NBz
h<(Uj6p
$vgKO0
;jDo'*3$F}4xZ
SEpw1N
[5(b2GYU tB
^hCmJ
8r9@|Mt
1}:)~S
ZVm/\L
c-YWd26
]; `(PUm8~
Hyd~1<.
i_2t: dH
dTnMn9SN_`
Y`%n\b
0z9~WM,'$
=pu{-J0
^{Um50
]4~:]cF|"
zx7a9N
Ux"S:^
Sx5x}G o
b\e6O~a z[Vy
^rhRKd\\n*.|
mM#Q{O|kF
SYJil$
0gqN*l
B aT}a
!~*U]P9myeK2?s_E
=d]>Jq
6'HML}
A`}e "16!7
fPj^wfL
R_!SSY3
r/+Acg)6
\2W3 -
VOkl)BQC
GE5I]rtl]}Y
NE&EV8/b&4
lC'}]:
xYyVm#B&
-fV@O@
/:H"lg\\
vB2GSu
||g{i@>{i
\A}Z/@<
0w&kj$mNu
*-34v4MQ&9\s
SWnlC1x
=,ogvW@q
+-Jp#7
[rpaDbd
cE_?A$.!x~
U,H6uj:,k[Ji[
zQ]?Q?&L@
t/v>gil-/eT
hm,V!sC=
eQ5@zpR3M_
sT#Ey8&Dr
H`8/#OB.e`1
k}t[G7
!3/+KO:,&^Nui*t
!^PvrGS
\e?WwL
[3y%ls
#nheXhI
Dw}>F24k\S
#`$CzoS"Ai
DlwkdI
|/hh C5>wPILP
a3W5I7
,Cz+Qi
5o (7YQ/D
-/Yv9t
\:m*LAc'32
LgB-<N
6bzC{XA^@N)q\?
7C'7e`jH_
<m{|<Q72
eg<YZR2
)d=hYA+KR
<KeoAV:L
9{[g3,HM[||q
Y1`MuJh4
wOZ]3vS
+8Q@+g
.I,[Ww:2"'}~
(r"3J[
4}A9&cbT
\vdT[_fd)=Ws
kF~yGv
}ykV@[H
9eyU|5z
dH5P/e
Nw/*~ZFL!
9d]I.6:q(qVb6'`6s/90T
}W@qwO>W
TF4E)J,i2g
d8n" &
W]H?`#
i[kpA=rV
JToD6D
A3tY5p
{t/EY(pgs\
?cE6=Oy5Q\
"U[JX=z
{/u7WDp4,
k55%H-
#Q?{b
>sO6xo.eu
`%fkr/{Mcm|(HzT!:H|v0
8ZaeGDI
]]; ?y-Y
kmY=Dp:
95fzcF
`)Ev6hLZS(LsZ#~
|?Nj$I
u]MiH1^1j s
fIzus
zQ;{ lzw00
c$9QN= F5A
dop0(C-RK
o*[QqY
[EY.q8
!F.:_2o
nI,{T%s8
$dJEW
[\iYi/Wi
eTy<I\Ux$N2z
HGmPc<
,%K*w2
!""J>??d5_
{914<B7
AKMPg1'(Z6#;B:3
G~iX(V#r%_G
N$ 7LLIJ0w
df#18lgUI
-3M2"[
9S],CNa>)
$I5PgP@.:
lY(m;8[
y x3]r0f]qAZX
ZAs{*:e~48
(pdbpQ
a<4O4^-"z
dM[DY8U%xV
cZBm!CdB4h12-lWeJo<Y
ERnjK<jG
'_K.6A
%@rk;Tt$Q
3"4l)i
A\ilfU` vZ)l;B)
kdq5fJWvz{
c'\ b[
f{%vW2S5)W
X-6jKSd`-XBL=kEIz
&$B$,z5
*st&1x
uX,Y|8wF
^h\,=(N8a5
e,Nq&V b
"ET[[Lo
h.ca$Q~@#~BLaz
e7O7cR:
v|*_zC9{
PR}l\DzN
IE hq+
i>Su~5.
bSyJ[y*P
my.<b/&0
?Fl7jlL/5&)!&
Ld!O'}O
b5AqCJ
W?2|+AuRn~
J.diTnA9d(j
oJ:V]L\
@ZlH!x``ICigh!e-
<9IWC*ko
O7g$fV!hQ
2gBI<'zA
YI{p4Y
0#ej[.i
[v^8TP
`0s{sNf
xB,VjlV
^wMSk}
$|lN)k
[ZW GieK
8+m)"!
9Fk+m`L
t\A9`6L
!LyW0`
=,N~kN
sn}sj`)N6c:
\%9;
@!wcRJ#
+usdy",
,sSYWEd
_"OMQKhB
CyaPw%
@pQh.x@.'J/Gl@
@K:kb4
$9oj^gAi7
amtI&WS.
87:%.]b
v9_#*0JM}
\_M=Q=)I
Q[x!/Q"Hx@yRaY
s0*xz&
#iZ#B1#^qm<
du-SAK;
)euQ1\g
} %>`JUTBT
oZ F$O~7uLBD2
ixkP)x
ygrHC~Y
;u?%:'f(
xWClC-p
?jm*by
E0ZAy\Uki
w}6YNe-@5B
I7xOvr1
&u;3oMr''
Ymbhm{"K
X6Fw{1
_(n@($}$eIW
al."`2
F(:[\p1
];ue-o
,CE}lNs
:qyGM%}fISv|
AR{G-j\ q
1JvoCAHZ
2^ e>+|ld
@V2eUcy
9oY)xT
93%W1= tA
vs)&XE
7'k:0E
eqYHE84^Y
p3.sn2](8Q:
bP:t6fH
{LWqNo {
IudR9z4
f8.fxU
W0>%M<
Sqe)LPX
A4]h<u*WPzt
_6}=7C
Bzfy7UF/t
!F5sgn
Il$|ig
lhGGMa
T,pP%<[,
J$KDn:';CYB
,Jp1OJ
KnIK~'
'9Cq]]J@X
[%2G]L
kwlU6>
Ud"|_.lq<<lO-:X^
=V+"\QH
+_XjPAO
hH4[3G N
H@F"xI
n<wXOE
&9 3-
juJnRf6
as3l3SZ(k]CNT`
m[Qm=EY
%"~WzbOYs^5u
n_\q)9/*Fx
hi@lOU
rG:1nu
5&~dZ_{u
pxT4fh+p
=Q7*O^+?
,]j0Q2:]Gz8
G2r ;V
G77yR1q~
\Y djs
m>XUPM'?qbY~]F
VrI|`JT
pbTr|<X0
c4HFg=
Cj,N2zZ]/#H)
Sg|l5A#B
+oAph=RL^Ne)
Q;wXfp
V~cO0V
p/ #JE"jT
z90\!vqA1
yA>Y%\2#HV
>=|wKEN
"$q"]G=W0`,
M{1=PSY
g>qHQ/Sf al
Wk6L/HxL?},6)*H
J!^82,
+J:P{"g
YmXx1kK
YK[`h8l8
?w|L?f[8%
lWksuX
24A';_?f+Yo_
9]CM)K
9>PE?>R R<
,sp2MMLMw
NjcN#=
85a%/Sj
YEga2}LLQ
&|0Z~~B
yY.O0&X
'Dl[45{
Rsqm`z0TU(
eBAiLO
zTLQ2Ge
?T}tM`W
h-z,M"
rSi0G*PjB
9MJ> 7$B?
<|/dnu9DS2
l3m(/c!wa{9dOv
^;_+r'V|nz@
EGO81<
iDP=7*=4Z98 z}
^"@ATFeE$5
CPo}u *1
Cmd4P-bY^4}s.
{C6!;cbV=UM
rF"r%{XDv^B'q:&
}K!I;ne=
/0H,wW
3RaZ@(
|+)sr;
H EanR
_3crEqg%
p[dZ>x@"d[a
zWU_nla
wE5pPE
;q'Az`~
7ZDd:n/4
"u}"&9e \^3
4\<~>.LLx[
/9~Y97J+
_ul,g`
F.`q3!Y
HdALw9
')1KXF
>n,|yVq]
GAO*TF"1"d
try9 X_I
#4/]nO1
SsYNlAEz
?.ww2.[En
II.+HX)'
%Jo0mn
8ph^pvZ
/^-)^Q
OcgZoZ!`
(~'v"5
*Q66FcS*t#
e9mlSdw^*=
lqE(ZO
hmW$H}O0:
~PZxd;-
;ZNY"<
xW_>T:
.6U|#.;1Ad
^PDsS%
&gfV:N
::^?U*Tsi
p_G?Nf5
w>&@`t
tH*UFn
WcrQ92 HsR
Bt<@*"O %`
5'Qt!,O)4{Y)1UX~$Ac!
oU8f3;d%=N
dUEw|cW'i{
3q6sxSU3h
S,I(kV'8
P\wB8_H
{n8wOHzg
ESFjhv
5bd/cr
}>s7?,U@ooP"2
|!v)}@Q
|Sz=9NW#
/V]S*d
/Tu?D&IA
_w4u{8YgDW[V4+
Dj jN%
l=1YW6Qh%
X/y?UE
g3-F+2
GCT.r3X
iw&-D=
q0F=3!g?Fhl
[Ybwxhh
d2qL}X
Tg=lA
V#n1E$
&_#Z3 ^O
1@R\P#
Z~v3_i9pQ14/=
F;=J:G)
c=[l<MD7CPP4J
J!GXd%u
g;=F]\3qQ
fNLZ6R
2'x\2{
kg;{Uzb-w
wP,de#b
r94\kLDczJ
:,vu)e
|Kn^pb(~6
w1_q<=$[\
~lb62\f
C<Z`Or
lSI/_AM{<K5k/_>Q}
Cm"_sSV
M+z0HU4?
bOOY8!!
H=$_Kt6
b!bvEG
2X8h$xm$?
g;F?!U8 irl
;yz!>!kQ
(ON=Nb
#8@"V:na
>e,9'9L
nfa*[/
"};(S_]S
K`}Q\|/\7:
!,\7`\
&h.Vg`).J
5CHH_-ock
P'wOhe
d(??bP/
f,VyO"aF
p_F`Y}FHS
" %5"7
?F?[J0H8.`
d@jcQ[\
OD3+3m
nzdrEp5
jiIx:*
[_EL>,jp
9<4p)C
70YK`4;
-9_7}Y
!S3Js'>w
]BBX^VFXVGB&
%TKI@]
gnjN+J
!?`=.+%k
%~Q([ZHE_(:v
k&`yPU
uU {]PD-M"}g
?OwV0F'k
&2A5o!=o*)"^0aL
VL+f"/#
Ul~(d}
<]G#!<AKDQ
db6mi#cy
h/A^_atc}2
Sxsn`qk5
&Qg3V[XuBc
,MaGO\$Q_
PQ<V'=k
7+I*kem
9\0MK#y
z!;P~}
2}P/B\C
S)}Z,^/
+)uB+Ps
|&>+@nAX
c-ty}@#
SH> Y/2VF4A>CN
<Er1=`2
WWc/iuv'
k0[>'X
KxZZi~
iX4ZX|
l~'vP?2L6"
cj} uRv
6>=TA@V
Z<9HN_
s%!".Mh
uX+kbLGJ
y6*op,
?=!2Y.
YQ =+3<
@5\|i&f>
< vy6T
<b\e!L
lGJ1[<sk8n[
.;b dkBT
[o4 \
M&r|:E
KZ#K-=/!p
cV'`rf
ll]NbYs7\G
.i<&@J$
'0AJPzQo1O
j6|xXC
P{IeR#--eJ
MgF]7}T9
lsk`Hkw
V:x~#v
dEcHT!
_<X^j~g7
~C>0tQM
bM$$U6P6L
K$1.##
zXODQGT9
fp~"t~?B7\
27)N4]
MvHU[F:^(G(3
9gn@ 7xP
$5`DEi\oKR7
X$Ia\F
YEY* $n88
FPzH~M)VO
e(/ !j( `Q
S0NKx|`!
Gh-u2K
m1/*gwk
8]fkfr!r+x
`OaTsC!
#Co3.5
jx$g=X6
uTGuO-
[Msy'E/E1
IB0r:Ha
p) F"jj
VnzIx$W~=3v
j:Hni|
}^zhqta
31jj"6
*AEM7(r5
IZ_JdL
eSI#16?
h7[b<e.
m|pv &
c-+0)I}?m:~
=<Up`m6GI'E;
a=Ek.xx{i_2
M2=PS]
[x~+y4
7jw:by
Vzd8j^
_H:?DXX
Kgs!nh
'u`I34Vl?
*&"P3Gu
=qo;!nRRj
l]K D`{`
3[M}s\$|qq
I'/XBlw
V[,q;G30gz4vy,Z^
9{V7S.p
[O|6`(j(i
]E7;v/@!vwN
^Vwy6=
rR}}yk.ei|xX
'hE43f
}cNz$ *
Hs}kh&,uv
FJi\S12tf}w
4Go"S:
u@Mk./~?
HTpiD\}H
yf#&T#S"u
nb$JR(.767?xs
oEN@]Bg
@/_)JB
(/0\W`!(6,v
x ;pSAG
^x1Yw>
\O41]N
,e8|a$Y
R:*qJIJurS1F"H(
-Y&K#HMIeo{
R#p4B2
I7d+t
lC> ^u{< qL</!`;!;]}
8<M Zk*~HgZ
i^2wK'}
)= *Ngx
KI75,g
|AihCW,
Gt}ErB
m#g !r
w39,Q1
dI,/G!/
I"}{c%6td_
MvTe,4>
0=dd@NS>r;"
mVK+EnoXiLgnV`j#
>zT1N&;
l~I)Y#10@(
+7:PCwk*
oaJM\h{h@;~CDY
*VCdij[ON
ZdUBx@Z60tP.
c~*G-%
?7?+5K7G]T
2; SHNlx
R QV</
|ONN!:aGKfz
%]9Yy}b>Zw;
)d @)a5EY
Vd'#kO*
!)F0:i
_45[uA
{%bY'&6
Q2rLm}
b:Yq/I9p
:HI3"3
DJe(~bl
lnTQ4$[
< tLo(#rGl_*
`er0}g'Lg
QXm9~A
f8ASK!F
UD#(=s
Nn%p[Uf5&
[hZaSU_m
6#'s_>*w-
9bJ6u6
MU!m2w
KifEQn)
C^ e2!()
'h}eFv<
Wj~/{kfsd"x?or
~=.8k*<^w
jE`k<Xf
paFp8b*j^c
9y~+}6
F;6|2Md;NJ$zuh~
\M Cp_
oqjhJD
mSmspME[
TaU|Wu_E
J5Z+sW5
7:t$C]rf9,-}
/Z~S-HNbO
B[Z_}I
3 %4TTe
=m"-nyc.@
6c#*[K| o
BG_DTP[|
GzYz D2*~G)
0b8XbAg!HA"R/
2PwO:2A
qUL!o7
IL$ZhJ0c
G8<=&s(oe
u?[Es>s4/Cdr
KeN&y~
Oi9,U@#/
jLjp"@9
`9=&Qdi
W,e<Y&[&
@Y{< j5^*?b-_
,nF3=l
Cs\X]~T1NZ<T
fQ'X_JE
cyzx"
2 y=S;
Zq</3g{
cZ#G01_!
2fh&;O&o0
SDJVnvh!
[#`rs3)
Qo5`3~\#
LAo$h&
K~ky1g
Vhghq=;0Uy-ybtK
((1K/s
>dH ,A9?@Yc v7
ww+t.Q*+
Dio%+\u
WGc)r8(
u]_NAD
b[1a(`d7Tc-bMYs{7^;H$KjO4q^Y
LV0v )rX5R
3Sm$j66
$.\AY~`d
(eM8#mg7O
&w15t4k
.*b{I8
$ @Gr`
F.)G%,?,& #R"Z
BtULqVF`WI}
6VNHS }yWA
dBDnO;R&
QS"UZrB
(tJLr<(
M*Dqn@S
t0.O'8}>
dMR $k"
XcYpA6
yfb"`3e
b:zQIDI
C%EiB64^Q
+d,R!7|"nXJ
UtLlO:[+n2
<gT-.I
zx!gB-a
7w,25<
pM26)CD^
M$k?[4
F3ne\W
s#v+f)1Ztd
#83MWN[6~
h;L6[j
|p,(:c
e5#Q`gh
Ab`9s_>
!|L68U}~5
&ga(Ht?[a3
>+_bb
a'tIm]M/-_:Y%
)`r5|.]
6?6wBW
$_c2'QlT
YMY4Sf
C.Ln(i
<U);K`h.X
Q>TiU*=9aJ5N;eI
N p{)Dq
`\+OQY
Wy|~y-*
|UrV`{
K`_:a'0
/$U7UISQcJU`
"Mx8CexQ;r
r`pw%>
|/%Rv!n
mc3sZ1e
Jisl\)Xsz
~gn^x}X1
dx;oOi/
'%W{rcS
%6"nLAli[x?
d1%l2f#@
u;SWhy;
#;*MUhm!
1HX@,}
meHs&Rn
u^\o@$Sa
$(UhfRf.,
A{Y q<
{Z<Qg-WA@m
F@kupiL
{@Sf:E:C
zT:tnwH
mdN@Cs$R
/BM8i5GO
plT< Uhjr
(]yp\?J|
5w[6k]
]2eYAd
p!062j>
~|Wj@J$_o0
|P[EV/
83>zIOc
7.ZnSOO
-6&3X:!
_'!` mYfF\G
yI$/{?8N
.{<GdK
Q#t #u
e_7FJf)B0b+
r/;BK[
|B"\_|
m<M"+1
QRTs,j$
UKlca9
E<1^OD*eh <LS2
oGQ6z$
eFRR&Cs+
7rR;m@@=2+4?Egr5;
.y vw#u
R5KNgnXI!g9n
qh!#w?
2&)0&F
mKbavPHU
&NJ^u]X
G['_V3
D2*b?[_%
8x 40h8
SB>o')
~!U[,P
% y? KB'Z>q
bK`1^$A`q
[:$)QlR
pJ;`Hc2
g3$9}"'
X#v>n#ja
?U`1RX
[/X7QV3'a3D
[:W~xWG
\hE_(7
hSWj "MBBh(
PS z*&V
4e+:*}
=hdudw 1n7
nzy|eCcHc)
1glMK&ZP
6/i'"<T`yBXBe(#r]5
'An)d!*_F"&=DV~*
dOb}Hu.
h_HTCZ)
%n<wL~UDcg
'tS=(K]aW
SNUQ(zKf
IM3 !A
bnSUl"
Pzm=W*
fP08yMzA
hRI>on
r"!cC&C.NL}+
~fF/ttTk]_$MW
nYx&Oz
~G%!{$
8Ewp~W<
z!QM$S
X[JveM!
#70qV^X
X?tSfxf 6
?@CpjtXu
3^'c%4\(w[%
[63Alz=\}b
Ycmcx
Ppm)[
=Q%h)\rI
,{fm6sY
(4f.-W
=MJK2
yki{9w
O}Gf"N^eE
g({g(!aV
:^Z5m*
r,fJqdTd=VC
/ ;4~jGR6
ec|N8s+*uk
bDbl?0M7 qzKJ
WI4#$uI- 4-v?z
,R=UWX
U3RyV:I~#*[U
NoCBpcp
?'l-tguX8
-8_m;u{^jc{
JRY^oD.$n\
}@TP:2%r
F[TJ$xZv]v#nr6eL
6qq;~%CnRj
heZ-F/
&YkvMj
t/SQ=s
6.f;]!EmA\O
_t5A Ov
g6nue=
D|LUo(
DJ,eOeff"r
ByB$#|?
2}Q%YsA
<p$i[acn
}53}ygE,F,g74l
y'2f_8><>Xb3}x
@IRV\%i0
mTUM0e
!S"sVB
ZU|=#.#/u\
7&UptIs<
&.0d0.PI.
N5KH<2
t1&nx1
+`1S2}
(j-c8.-@
i!n#Su
5NpKPy
aNq}(H
Ou@$wJ
)0cPMM
2\)xA`vv
zKHPy>
RQYi_w6<?
=Zy&?]
Yf*{9_4kW~"D9e
QQXtz,FlW]^o6UitoQlJh%78
dBH[ :wLZI
Si5tsXJ`
<.fpI#&
Ce7D,BBf
xx&88xZ
Ww$,sBMm
6`8M%]I9
8VhZH0erRwS
d+W$0!
QlTa7F
7&TpAb2
!)_@mG
-O0,mA-
ht-5`/avU@
JK\lGl
xI6\A%>
^b{x+I
TRm\AP
vtBpI1DlD
S% @bh;M g`
^#VmvD
5@9GT\;
a.:yq8k$
V[ g6;tODM
ztjdqn$yyHB
^TqeW*N"
F-2 o^+]
U*(WE|f
agO7H=
/ruQ"wc8Xz-%G964
>NT1%y
% 4M<1&
q, #BB
GIwb8FDn
h 1= PRJeu
7!|vM3Dpp`"<\z$)
68$7=J}$?_B@v%&E}
|HZeAG"*
<(GlBX"_9aM
Ij;OjD
\mi<s=kT/ 's
0j&\Vep
2&xqf.?>
(*e&)[f
LK|Hod
h-"'&w
\^,KfS
/h(t`sB
1tJ7@YbqO=L3
||_,/y@E!&
%@W+sT~>
nFio.R
ZEmg#CU!
TPA[tPS
]Y +;C
0?J|>dje
WqiYQ[/
QcM7UQ%
3Gi,X3
Dz}L+0
li/N2l#n/
{`c)Fj.
) \1F|
UrZSe!ZRwb
F`k?n)eK{
\Omb5j+0
r (O'D
k^5j~i
yF"Cnn
m9A>@ 2f/V_Wlvizkqj)E
tieEyIF([
d`DovCM s
L_bo^p
p)evu*
.6b\tt)v;bioYEn<;d=
:U\^8+
K)|'Ko5if
&q!W0m~,
^If8T__af1;
G4G*{T
|b|u>}T *:6~(8\i|v
]Y(DI!@"5R`p
6WQ5vB
JV+k<=%Q@B?[
Q^.YD^AtT
JhlOgvf.
l-N~~&\WOav-?
O>'$H^gn
=g]HfHTjO
`C]dy7
b"\M Foj!
a3(I3|fKt2
{]1wMt
i"/ rX
y9/04D#&[U:M1
AkYrf!
].U&C,<
|HuhgYi
A`T6pyW
GJDhBAUGj
BII48D
,LVFf6lc)mciY.Y0'
^pW:Sl)u2|+d_D"
|<Ji~
?(6>?V.
u3(r2{
abE+ Ivh
vafxOi=hi%-v
jy=]U@Z
mC3+g9]U
De~1/='G
6E!dt`
KMP#J/P4NGe[
i<*G["k
ozEl3]E
h)gDg&
,Fv\{-
F>BY"B`<
.Z4nf]
7xIy&L
"<`O.)
?Cdjso^7L\U'Iv,5n Q
aF{fRJ$
rYp0BNw
:m:<Z.2#QF11q
K-q<nyq{0
lr}FTr
qL1_Rs
CpC^C.|3Kd
7r9zZs
GV+7Je?
Y]uPx{;
*|8]2lm=V
}G42%bp}
X%+fR&
}rCi1Ocawb
6rrg|4
-#h@8Udby
QVGa)r^],P%y *
u%*YAb
BKZ5`Pd&6o,
3Tt_b&cm0
i\eT87
35(@#o
#0<ym/4}
WRH~a[c&
7iT=v0G8B
\fQQ&bW
Fio ,Y9m_>
Geml[I
G8y'dT
pOwW2gY
sw)}YFi
3MNi6'P" 4
-553qte3X
WOahg1p
Pw(Tlf*{
?B5K0AL
o)$LY;8
mNVPa`Xu#
7mIo/4}/
Dmnq;~!L#{'
B|:uqAAJ}e
WS[hm+
r`V?8jlYz
#c^% \ZF
[8zbt+F"
czm<y8 Y?^Cdb
#g'pZ,@9
pHtI8G
H[=[Rj,
80ZraqQ)9U#g+$_5^
qVz4YW_
$7jE,?n
XIcj,I4
RbBwX8
rD3!Q *trGTlo=y.@
XlG`Xe5
qFJFe\sRBWa@.P,
Uq1[b"Gm
Jm<tTh
ALO#`ir#dY
+ ^*rWX
i/`tz5D1d
!'Om6>
+iZI{IV}5Xe$
,T=XF{>\
5 1 i)R
'~]!~chU
cpY-wZ
r%[^},,
Td`*t/7g<5
3(h-f'}p
RSBtGc
|}}h{%ov(
)-5\'=
&a49K2}myQC,r
6J [F??rX[KM
D@V_Sfaw>
RP/!1va
K%*p&&
4qmo$KhiL&$`6k%
)A-c#j
dD55$ c''lwvyG8
$b":y~
A7ljh[!t
nf7]S/5
;sTI9]o)
Q,`,7t
8"?|&4Q
SrH< b
|<7/<'
>:5keHki4xF_zh.p
m@0<:
1gAD5?Vv;,Nu
D>hG`~
<YHEe_
Z1v>#*eu RB
d8;3^j
pE#@rTVuv
JTq2.}x
#g#+f}~xF8
=7-7az^f/zo
74z@t%Zh
F"Py}\
\JZc'jK
%w{YXUe
v>x@n4RjCFE
R"LXn`|U
6eOxCCw3
K1^6<TrOh^K
HW(/25
4-0P'M
d0kzCu8H
][I'!,So
;(>!J-hn1
O~;3-
1q_u)C S~B
#WBY3F
jTk?#N
.zu7<ii@d`\{
_}g%J{p5
DD3Y,Sb
d<Y]#~~OJ.-W
pQiLzjx
&d:5M0`D
V$c:7.[
0j$Y62
?/:PHUS}N
dV8{P>
$NY_q sk6My+$^,0*j%
2a-Ec.
FUpR.,,`=<
:o}-k'
78F>k@]hc)?nmk
r@x1E}.
BJR`AGa-
$Cfi /}[su
E5,Y{g{0g
e/!!!Atb
1$k+#$bQ~|1UY
/](hMY
$%!YE/
n a'/6X<,
I!e-=uZ
DuVyZw
h-mX R
69=;:dS?
WbtbyE-X9
-b|a@g
L/Xd-'DVD
*$cBKT
=67<Pxr4<L
~1Z148
6V1D~WV2gi
5DWc@wCD
5nXd!Zm
mV!u(D
%:@\5\
o:p3b7
+9K2L.P
;Gg\@*6
+ssS[0~\`
RO3`yYA~
N8m*G"dlVuEgJu
Q$7X%|
4 B3QLHNx)
A4.1#TO8_p
+h'(I.
dm!sE&1
znF~I@t
K/n_[=
l%Wh7sw}
m@@$FIQ
>)K9,s
Ijo}9!|
gj5z,+P
-\}yzf;-x
~gB*8)
D}<t"#&
t7zZ@ 1T
m4 ""9Hh
0b`mPv)
PbthVh
n/9jW3'
&5{"wF
*Sbj+S.=z
WLry.Plq
! !Xe3
Uk+~o"
dh_L@kl
chS:mD|U(|
,Y^f^v{nYtOM
wy#52G
$tH16R
I[c]CgA7)9|XuL
?7q\.nK
iNM)3i
Sa6uZf7P$LF6(eI#(yb\
02sIqx5i~
qG_0[W&SC
Ae;2<YA>T#'pi-
GWH~}c
?M#M,\]
!C<*Wk
.b 1d.0
Dq+U"/
O|p);I
Ns(rTX
?IH1(}w
!JE+xA
4==ECk2
~Y"9o%>WJct
b-o+qg
mxjj6z
hpJ]:-=L
oR.I4's~_+|WcEh.37d
p>Z Q8>xK
98z$o~l
Vl[d\G
CSnYcOTb
HC4qs,
R\Z,o(w(*M
,(eXmj
HsR[4g(~J]
2:|o}f|G<S
kcsj+,
'XvUGw-W
s%^Y uj"
w{"YWmQ
>W UHd
$_w.~&6E|CB
W_*YcM
iW$vu1E
hD`jFcs
f4tW Rxp0
j8]ic2%3Vm
O+SC}@
;~E7nE
i+1!^X
LvaJb*t
#e!u<;7,
jn]c2'X
A6 *6 u
w4FUPa(
_#JC9=:q/m
D>s{rh 3
6vJ~[_j
6:FVli
0J_aeNm^=e
]d507P
Yo*E}YQ(;?uS~F.
?W\Z&qD
@3O1lRe"
$}d'*<
ZTIDMv
V4u+%:
F(:c5o,H
j8++gv$/
pe k{1~
]V}K8ba
Dx%a]#k1
:ngP{L8
$A[*b@
JTf-^U
wV/o{G
S))[")
.!MRzNi)kZ2Ar
oKF7n`d6z|BO
i^S^ j-
zz?9El
nfS_eF
2Kl\,./F
nnC@O#1T^
bP2LpAB,tYZ
U:=#r'
vbS9"p-i
N{DAx3h6
*QiW[9d
Ks:>,vgL"$^XVC%z#!Isb
J2`Bep]e{'
VWZL%<@c
=^T<~H
-"0IIg~
3@/D8B
p*?/e[C[+ (
AP&TJ]
LLay2&
o"ko+\Tnnn
?2i?w0
~zaL8A(
4QZ%Q(
L}&n9A
t;n7g@
QL%Wh-i
[q|tEo
#x["*,
=HLhwrI&Xn^]_>3
%_{*W6
PMq#hv
rH(L(L =AMvE*G[8o
/gYIrqee<]
u;GU)]NFFm
uCu#\02pZ>{
E\'M'KJ#Cycu
pSMvD&:[m
X^?8-r"g_xM
E#XN]@%Cp80R3
^6UNy3Qm2
R4=/{(
mW4&?ew
H`$jW(
Kb%;Qm5o~
UpM}#V 83
COl\U&qNT#<q
aCvwh-
gZ+X b}h}n
y@dH$y
(lvFAz
a`\N&Tx|S@kUhw
O s ~6
=Hnx]gd
znrZo:;(#
/*_lrZ
`}CjyC
Kq,&fNu
)BXU!>l
uw~kSX@
L|<N3wbq
=$a<wOn9
id3f8n*r92Q \
zKuu:knp!8H|]\1w
3p1\$*'1&5L
|=p,JT?
a/ 77]NF[
L? 03Xi
[nu$j)&'f
zVnNcT3
.|RNs-[`*{
U;[9CO4
,iO}1N&
PDu()(I7
C>Y?aO7
qb_y)NZ
1{zAiO]P`:-AKln(
YgC|wF v
s?/6B?vG
Y!P:q_
f3j.h(.=
Dk7Pd?Lu
$=h(Je$AS=m<
/1sAhn7m"
@>C/[@MB6GM3
2Dn8U/l
2nesGsT
S'~&Y4&
6iBFu@G
<>-2p\J7-zeh9<Cc
m$ -e~^q5-
}Oc.=Od`M
8D#V Z
wO}}]E
M_;J-.
-:Y-;m^FI#NbyB
@htt>F
$l?8$%R&f
:"G2=A; ~JX
y5.2w3}h
'w&I0ldu{
<[:;`DK
2d_XI\lZ
Y{lV^2bI
%f:XFiA.
!)pGY \
joS;lU
T>4>G`/
]LF>C
O^? CnCVU
!mzc c
Q-[$LZN
8/1Fk%
Yvg<\Pf%
[2Uu$JJHf
R%i7o.BQ[\
KJjr=5f1fw
=35& x
+@+6lnRXx"JACi
E#GvM7F
"Cax 4
BgYTYDbd
O-"PCzW
QT}?F(@Ik
'7V_h,!wf
HiS|D.
u3!Y_
nAFxF1
),u2uy97
/Cy#%a)l
@^ J!;aj0
>5.@nOp
r[4rYwlo
P24K"e8
E0$SL<%-
)Iy\bV
\=9m9+o
d-Y%C&aS'&kR
6eE3V^5
ZD^W6_CFxb
x`%_zI
H8G ]8
Nv`|-E+}
PHL9Q4 5 dv)
3|'}Zw0Rr0;?|
r#q"O<Xz
:>lnEu?E
2ZlM@e
,~<0Nbd
q@xoJ3
H`%$w#YT/
$D:%uZ%j
uK`^1zsuz"pg
rgr.M0F
$beS?W)Vb.X0,
Uk([ZWN
N&Qh3_"'
2:5-wA
)9<#/r
U8bYU(I
l!%kK|
9; blb
L?^_0@I"!p8v%ee
+yVp_vD3:
sL& e);NLf|u%ehNs8\[A2
x+^m4)s]n[EwC#JC
Xkqn!2J
iFepgn
Pt%rPH~\D#
g2p5ly7a"
t7 7;Oz|E}J
'cUy+VOt
!Hf(!F
^q}#Q.
AV&n;]#sOA`&EtIzL
}f7rHFY
Q+x".QxV8F5
'^PICIS&
^;*,e+
j&3;HC
0@O9hR`
/,^o,14
a8;|m/;yQ
j(iq^}lk
|9^R|U{'
^X[qG=C/|6Ve7tW
P:?`y(
3UGz#-.47
kGW z]
#O}xp~B3RH^@In 7q{1|L
9/s$P3
V4WuIG!N'_+
K@IAMw
\ {p9a#N
,ohdtDeOv
X%3L*c NLv
/w4oD8e
PEF%/!Epz
z)v2ndV
$HL5U,
\=2mp_4PpI@
Dd%lJk
|#u n2q
g"#IZ~k^
GLRRDA@B
Vb8? =
t`kJK.P>
Zk+f@!
-V*Bx9JNQi!
1I5`2
J#>ENd80
z'X]rmwo&O5
P-rM5^GXvZ6ogg
LDJ Vb!5n!]
svr4fv
_/<e1!9<
)vk0OJ
-R{J/-V@6<Ld
|iU* /
xMu _k
Tl)e+YC%D
9N)K-OzbHFR`T.
4.&ZZ9
$K<'3xh
+3E?,.8/I
';hE9b
%U;+q%
?-QjKE
:{GNc%
R+<ykd(;4
C RZg-_GdM1#\G)
}SK#'[rT
P9i{REs
uSnu;&
8)GuqP~b
8}{B+URyLuQ%RY[O
x+ "E:c[}T<
hNOUob}
m4^'8v
8%ywBE
99fu1xI
RV~t::
xK'5Ra
s25@9
.F}nBh
1zX.hn
R.n\!x=
<ry\;p(
/Ls/,&m
6Fr#~<
IB3`!>E68
egi<+O
f_~} a$
sKq(8nJ8
4qtTZ=
Bg{7.jvc
<[pFMZl E
ew3'<$J
3bZb S
9fuyej
Y]6%% WDu
>b"rN"
3(0bB/'*/l50^
5 ]2Nz
>6,E;y
W:BTF"
!2`Y$Ac
XKtzK>2
V>FTUn
!,>FZt!pd.M_%
.#DZB QY"Z}
Uzd}Js8G
?:RxfQ=3|k~c
b8kahUQ
C4~p&0(
2rr0];SH
T7Xp?~K06
!(5,IEo3N#
5exn~A<%
OeVfJ~
)|Bgea/%
Y^=3Nn
i.?f1x}qi\*q
K4ks==
1&3Pb^>s-H
`H<;D$
Noq B*vcix
HAfE2)M
@~q)Oy~3
Q?_=ux
Q+iliRc%6
L9|U`w
7Hc\R(
hx$d?b}
J,WzO-m
{IL1Zo$'
i-\D[1S
d,4S+rF4B
H=GB;-
'*9~~?,
)nt]zI
"5}47X4
ow> )z4v
wt4T|ZRpuk
NYFo'7$RG+ FGH#
F|zDq=zw)./
UX02f0
ZM]^ec
]Gc <N
k4lx(9m
2#3<vRk
yu0\K/@
X<'Y:B;
>"&<blrH
jsOm&^*6
!Xe+T<]$X:
%24l3!Y6h
P<D~RY
8oS,*(Rp
}`k`]JdWs
W[z7[bB>
AZTw>o,
F-'-'-'-'-'
F-'-'-'-'-'
F-'-'-'-'-'
F-'-'-'-'-'
F-'-'-'-'-'
F-'-'-'-'-'
F-'-'-'-'-'
F-'-'-'*?
F-'-'-'*?
F-'-'-'-'
F*?-'-'-'
}r}r}r}r
F\\\\}r}r}r}r}r
Fi7i7|i7i7i7\\\\\}r}r}r}r}r}r
Fi7i7|i7i7\\\\\\}r}r}r}r}r}r
Fi7i7|i7i7\\\\\\}r}r}r}r}r}r
Fi7i7i7i7i7\\\\\\}r}r}r}r}r}r
Fi7i7|i7i7\\\\\\}r}r}r}r}r}r
Fi7i7|i7i7\\\\\\}r}r}r}r}r}r
Fi7i7|i7i7i7i7
F-'\\}r}r}r}r}r}r
Fi7i7i7i7i7i7i7
Fe*e*B,}r}r}r}r}r}r
Fi7|i7i7i7i7i7
Fe*B,}r}r}r}r}r}r
Fi7|i7i7i7i7i7
Fe*B,}r}r}r}r}r}r
Fi7|i7i7i7i7i7
Fe*B,}r}r}r}r}r}r
Fi7i7i7i7i7i7i7
Fe*B,}r}r}r}r}r}r
Fi7|i7i7i7i7i7
Fe*r}r}r}r}r}r}r
Fi7|i7i7i7i7i7
}r}r}r}r}r}r
Fi7|i7i7i7i7i7
}r}r}r}r}r}r
Fi7i7i7i7\\\rr
}r}r}r}r}r}r
Fi7|i7i7\\\\\\}r}r}r}r}r}r
F|i7i7\\\\\\}r}r}r}r}r}r
F|i7i7\\\\\\}r}r}r}r}r}r
Fi7i7\\\\\\\}r}r}r}r}r}r
Fi7|\\\\\\\}r}r}r}r}r}r
|\\\\\\\}r}r}r}r}r}r
|\\\\\\\}r}r}r}r}r}r
rrr\\\\\\\}r}r}r}r}r}r
|\\\\\\\}r}r}r}r}r}r
|\\\\\\\}r}r}r}r}r}r
|\\\\\\\
}r}r}r}r[o
-'rrrrrrr\\\\\\
}r}r}r}r}r
-'rrrrrr
|\\\\\\}r}r}r}r}r}r
rrrrrrr
|\\\\\\}r}r}r}r}r
|\\\\\\
}r}r}r}r}r
i7\\\\\\II}r}r}r}r}r
|\\\\\\II}r}r}r}r}r
|\\\\\\II}r}r}r}r}r
\\\\\\II}r}r}r}r}r
\\\\\\II}r}r}r[o}r
\\\\\\II}r}r}r[o[o
\\\\II}r}r}r[o[o
\\\II}r}r}r[o[o
\\II}r}r[o[o[o
\\II}r}r[o[o[o
\\\II}r}r[o[o[o
F|i7i7
II}r}r[o[o[o
II}r}r[o[o[o
F|i7i7i7i7
II}r}r[o[o[o
II}r[o[o[o[o
II}r[o[o[o[o
II}r[o[o[o[o
II}r[o[o[o[o
II}r[o[o[o[o
II}r[o[o[o[o
II[o[o[o[o[o
II[o[o[o[o[o
II[o[o[o[o[o
II[o[o[o[o[o
II[o[o[o[o[o
II[o[o[o[o[o
II[o[o[o[o[o
II[o[o[o[o[o
y\\\\\
II[o[o[o[o[o
ww|\\\\\\II[o[o[o[o[o
\II[o[o[o[o[o
}r[o[o[o
9}r}r}r}r
9}r}r}r}r
9}r}r}r}r
9}r}r}r}r
9}r}r}r}r
9}r}r}r}r
IIi7}r}r}r}r
IIi7}r}r}r}r
II[o}r}r}r}r
II[o[o[o[o[o
Z[oII[o[o[o[o[o
[oII[o[o[o[o[o
[oII[o[o[o[o[o
Z\[oII[o[o[o[o[o
II[o[o[o[o[o
II[o[o[o[o[o
II[o[o[o[o[o
[o[o[o[o
}r}r}r}r
}r}r}r}r
}r}r}r}r
}r}r}r
}r}r}r
}r}r}r
i[o[o[oII
i[o[o[o[oII[o[o[o}r
i[o[o[o[oII[o[o[o}r
i[o[o[o[oII[o[o
i[o[o[o[oII
i[o[o[o[oII
i[o[o[o[oII
i|[o[o[o[o[oII
i|[o[o[o[o[oII
i|[o[o[o[o[oII
i[o[o[o[o[oII
i|[o[o[o[o[oII
i|[o[o[o[o[oII[o
i[o[o[o[o[o[oII[o
ww[o[o[o[o[o[oII[o
www[o[o[o[o[o[oII[o
9www[o[o[o[o[o[oII[o
9www[o[o[o[o[o[oII[o
9www[o[o[o[o[o[oII[o
9\\[o[o[o[o[o[oII[o
9\\[o[o[o[o[o[o[oII
9\\[o[o[o[o[o[o[oII
9\\[o[o[o[o[o[oII[o
i[o[o[o[o[o[oII[o
i[o[o[o[o[o[oII[o
i[o[o[o[o[o[oII[o
i[o[o[o[o[o[oII[o
[o[o[o[o[o[o[o[oII
[o[o[o[o[o[o[o[oII
[o[o[o[o[o[o[o[oII
[o[o[o[o[o[o[o[o[oII
[o[o[o[o[o[o[o[o[oII
[o[o[o[o[o[o[o[o[oII
[o[o[o[o[o[o[o[o[oII
[o[o[o[o[o[o[o[o[oII
[o[o[o[o[o[o[oII
*^*^&e
*^&e&e
*^b:xb:xb:xb:xb:xb:xb:xb:xb:x
*^b:xb:xb:xb:xb:xb:xb:xb:xb:x
*^&eb:xb:xb:xb:xb:xb:xb:xb:x
:&eb:xb:xb:xb:xb:xb:xb:xb:x
&e&eb:xb:xb:xb:xb:xb:xb:xb:x
&e&eb:xb:xb:xb:xb:x
&e&e[o[o[o
&e&e[o[o[o[o[o[o[o[o[o
[o[o[o[o[o[o[o[o[o
[o[o[o[o[o[o[o[o[o
[o[o[o[o[o[o[o[o[o
&e[o[o[o[o[o[o[o[o[o[o
&e[o[o[o[o[o[o[o[o[o
[o[o[o[o[o[o[o[o[o
[o[o[o[o[o[o[o[o[o
[o[o[o[o[o[o[o[o[o
[o[o[o[o[o[o[o[o[o
[o[o[o[o[o[o[o[o[o
[o[o[o[o[o[o[o[o[o
[o[o[o[o[o[o[o[o[o
[o[o[o[o[o[o[o[o[o
[o[o[o[o[o[o[o[o[o
[o[o[o[o[o[o[o[o[o
EW'EW'
[o[o[o[o[o[o[o[o[oEW'EW'EW'
[o[o[o[o[o[o[o[oEW'EW'EW'EW'
[o[o[o[o[o[o[o[oEW'EW'EW'EW'
[o[o[o[o[o[o[o[oEW'EW'EW'EW'
[o[o[o[o[o[o[o[oEW'EW'EW'EW'
[o[o[o[o[o[o[o[oEW'EW'EW'EW'
[o[o[o[o[o[o[o[oEW'EW'EW'EW'
[o[o[o[o[o[o[o[oEW'EW'EW'EW'
[o[o[o[o[o[o[o
`S-'-'-'
[o[o[o[o[o[o[o`S`S-'-'X'
[o[o[o[o[o[o[o
[o[o[o[o[o[o[o
[o[o[o[o[o[o[o
[o[o[o[o[o[o
ya[o[o[o
*^*^`S`S-'-'
`S`S-'-'
`S`S-'-'
`S`S-'-'
2M2M2M2M2M
-'-'-'
2MII2M2M2M2M2M2M
2M2M2M2M2MII2M2M2M2M2M
2M2M2M2M2M2M2MII2M
2M2M2M2M2M2M2M
2M2M2M
II-'-'
*^*^II
*^*^*^II
*^*^*^*^II
*^*^*^*^*^I
*^*^*^*^*^*^
*^*^*^*^*^*^*^-'
+*^*^*^*^-'-'u-'
-'-'-'-'-'-'u-'-'
-'-'-'-'-'-'-'u-'-'-'
-'-'-'-'-'-'-'-'-'-'-'-'
-'-'-'-'-'-'u-'-'-'-'-'-'
-'-'-'-'-'-'-'-'-'-'-'-'-'-'-'
-'-'-'-'-'-'u-'-'-'-'-'-'-'-'>
-'-'-'-'-'*^*^*^-'-'-'-'-'-'-'>
-'*^*^*^*^*^*^*^-'-'-'-'-'-'-'>
-'-'*^*^*^*^*^*^*^-'-'-'-'-'-'-'
-'-'-'*^*^*^*^*^*^*^-'-'-'-'-'-'>
++-'*^*^*^*^*^*^*^-'-'-'-'-'-'-'
++-'*^*^*^*^*^*^*^-'-'-'-'-'3
++-'*^*^*^*^*^*^*^-'-'-'3
++-'*^*^*^*^*^*^*^-'3
++-'-'*^*^*^*^*^3
?+-'-'-'*^*^*^3
?+-'-'-'3
-'-'-'
-'-'-'-'-'
'k7(`>3Z74i>.dA'a6
_;6B>9><<
d_ig~h~l
e_~g~j
{Q~JSZ]X
/c94a?2ZC4a5-W=*Z9
Xc?5<>7?<_
XW~X2cD'c?4l0%Z;,e:2a
g?>B7:9E
ebfiaek_
WS~W]~]~U~V~Z
(^<)g6-eB,m;(]91~
nc~c~gdf
1g<+h<(g@5\A;~4~
)~/xs}+z
A=:AA*\
ai~^kl_
YZ^SQT\^~RZ
,d73b=4\9+^2~0
UVQ~W~P~XVQ~TZJ
UY~*b;*YA&g?)e5~3~
)b67c<,e=~,~%~
O~[~XX
~+c9%c@)a6
Evt')!QMQ
1c;/c<~1h8
>vr~m~q
UY\YVW[W
~-h5+^>~+n?
EE)G(v
Y`YV~XT
W~RTP~_
LYWbYUV
+NU`~U~Y
]Q]X^P
LTOWYQQX`
QUYX~PY
/~4'~.
-PX~YU^~T
TZVW~XRRY~UWUY
O4Yn8[p
~-~U^KR~R
V~T~WR
WS~~O~<7=4
ZRXWU~U[
TY]caY
V~XV~Z
35:~4~;3~6
~LK5N=EC
Mcbbg[3
8.~:0<~9=
Z^Z~ABd~~S~O
M9H<F<[W
N~Vgbaspu0~0
~Tt~MDI<SHYYN
[X[Uh;s|sg~f
6~9B@~44
W~tGzH~F
}I|=?MFj~[
Tg4`mh3pt
g7emuqc;
q|k8Pb
rMttpn~Y
Y]R~UU
+s5Uotvb7ne:^n9Pg=V`
F;?~=<;9;
/~{q~se=g:To7YlBX
Ohqnwt[R
03unpk>_n=jIYo<]
1:/:~\
}Olker~
-)pl<[k?h1^l:Zg/`pI&~Y
l:`9Y^:_L&
ff~.~*?
-349$/-#
\~xJ{J~{O(H:pN7~/
{G,>=sG5)~
kjrsrio
}T~wF~vO(BBvr
~dexus
inlvX|Q
OtK~X C:pl~+~'
0514*~
e>^f7TE
`jmnonr
|L|Q{L
{Kvex0~,~
&6)<*/
{Nlbp%
-8/11558
$k:[q<\_
V2~<~:
=62>26jqsk
f~qmrw}L
|Ix~cu
<8467;ioh>>#J!
5;|RvO
44Cnhr:H~'F
*:3702
6jjg99
nuep2;4>
xG|F~yE~|O~
0$0*060V0000000
1*12171`1o111111111
282i2o2y2
22222222
3#3)3/3:3@3F3N3T3Y3`3f3l3|333333333333333333
4)4/444C4S4X4_4e4t4z44444444444444445,6U666666 7$7177|888
9)999J9p999999
:@:H:a:::::::
;6;<;d;;;;;u<<<<<<1=7=
=======
>P>^>y>>
?d?s?z????????
0$0D0J0P0V0\0b0i0p0w0~000000000000000
2!2z22U3h3344555
6.6?6K6g666666666&767M7U7
77777777
8'80858:8^8j8o8t888888888
9-9?9K9U9g9l9999u:::p;;;H<<M=R=Y=}===>M?R?Y?}???
1-1N34u5s:{:::/;7;1<9<k<s<<z=~==========~>>>>>>>>>>
y666798>8C8^8c8h8=?
0:0A0y3
5?5F58;;;;
22222222
3B:^:b:f:j:n:r:v:z:~:::<=
>&>4>@>S>Z>b>{>>>>>>
?&?,?2?????
2=3U33333333333C4w4444"515G5]5t5{5555555+626D6Q6c6k6u6~66666
7(7f777
8'8C888888859>9j9s9{99s::::G;_;;?<V<<
=*=`=e=r=~=======
>#>)>4>:>H>T>Y>f>k>>>$?*?<?z??
0t0z033333333
4 4S4h4y44
5U5q555L6k66666]777777
8888m9999d::::
;/;Q;;,<<;=E===
>#>1>=>I>W>g>|>>>>>>>
?+????
p0z00000
1$1v1}1111
4-4h4444
5d5t55,646
7o8888g9*<1<0>B>H>
0:0$1Z111&2V2233-444
5!5V5g5555555
6(6J6[6p6z666
999I:p:y;;
<&<B<`<j<{<<<<<<<<
='=7====?
!0B0G0R0f0q000000
1P111+2_22233
4N4q44444
5(5?5G5n5555555555
626=6B6G6b6l66666666666
747?7D7I7g7q7777777777
878[8w888888888
9#9E9S9b9999G:a::::::
;*;@;z;;;;;;
<;<y<<<<<
=D=K====
>)>;>M>_>q>>>>>>>>
m00<1N1152
3v33354n444
555555$6O6q66666
7B7`7k77777
8K8X8e8r88P9999
:-:[:<
1+111 2k2z222222
3 3384L4i44
7&7d7w7777Z8r888
;W;l;;;;;
<4<><|<<<>=
4666666=7Y777
8,8^8x889':W:
<j<<<==
[0051/22l3333/454B4M4]44
5*5p5v5{555
6N7[777
:3:::::2;r;;;
<4<X<c<p<<<<g=|=======
>'>/>>>>>>>0?Z?b?
00!1X1u1111i2233
4&4{4|555555,676B6H6Q666666
7-7X7p777777
88-999W:v::;6=Q=g=}==
011x4~4444
7889999;;;;;;;&<k<p<t<x<|<>
D0W0u0012h2o2t2x2|222
3 3$3(3,35
d1l1x1|1111111
3 3$3(3,384<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|444444444444444444444444444444444
5 5$5(5,5054585<5@5D5H5L5P5T5X5\5`5d5h5l5p5t5x5|5555555555555555555
0888@8D8H8L8P8T8X8\8d8h8l8p8t8x8|88888888
3333333333333333333333333333
4 4$4(4,4044484D4H4L4P4T4X4\4`4d4h4l4p4t4x4|444444444444444444444444444444444
585<5@5D5H5L5P5T5X5\5`5d5h5l5p5t5x5|555t:|:::::::::::::::::
;$;,;4;<;D;L;T;\;d;l;t;|;;;;;;;;;;;;;;;;;
<$<,<4<<<D<L<T<\<d<l<t<|<<<<<<<<<<<<<<<<<
=$=,=4=<=D=L=T=\=d=l=t=|=================
>$>,>4><>D>L>T>\>d>l>t>|>>>>>>>>>>>>>>>>>
?$?,?4?<?D?L?T?\?d?l?t?|?????????????????
0$0,040<0D0L0T0\0d0l0t0|00000000000000000
1$1,141<1D1L1T1\1d1l1t1|111;;;;;;;;;;;;;;
< <(<0<8<@<H<P<X<`<h<p<x<<<<<<<<<<<<<<<<<
= =(=0=8=@=H=P=X=`=h=p=x=================
> >(>0>8>@>H>P>X>`>h>p>x>>>>>>>>>>>>>>>>>
? ?(?0?8?@?H?P?X?`?h?p?x?????????????????
0 0(00080@0H0P0X0`0h0p0x00000000000000000
1 1(10181@1H1P1X1`1h1p1x11111111111111111
2 2(20282@2H2P2X2`2h2p2x2222222<<<<
L6T6\6d6l6t6|66666666666666666
7$7,77777777\;`;|;;;;;;
<(<H<h<p<t<<<<<<
=0=P=p=====
>0>P>p>>>>>
?0?P?p???????
@5p55555555555 ;0;4;8;<;@;D;H;L;P;T;`;d;h;l;p;t;x;|;
MTU7MTU=
l a v i f i p o s o x o h i l u j u s u c u f u s u s a b o h e w i n i h i d e y a d i z e r u l e v i y a
k e r n e l 3 2 . d l l
s e y i c u w a t i t a k o n e y e p i j o s u d o t a k u p o v e t e m u
h u d e j i t a f e p i j i w a g e
A a d v a p i 3 2
a p i - m s - w i n - c o r e - f i b e r s - l 1 - 1 - 1
a p i - m s - w i n - c o r e - s y n c h - l 1 - 2 - 0
k e r n e l 3 2
m i n k e r n e l \ c r t s \ u c r t \ i n c \ c o r e c r t _ i n t e r n a l _ s t r t o x . h
_ _ c r t _ s t r t o x : : f l o a t i n g _ p o i n t _ v a l u e : : a s _ d o u b l e
_ i s _ d o u b l e
_ _ c r t _ s t r t o x : : f l o a t i n g _ p o i n t _ v a l u e : : a s _ f l o a t
! _ i s _ d o u b l e
m s c o r e e . d l l
( ( ( ( ( H
S u n d a y
M o n d a y
T u e s d a y
W e d n e s d a y
T h u r s d a y
F r i d a y
S a t u r d a y
J a n u a r y
F e b r u a r y
A u g u s t
S e p t e m b e r
O c t o b e r
N o v e m b e r
D e c e m b e r
M M / d d / y y
d d d d , M M M M d d , y y y y
H H : m m : s s
A j a - J P
A a p i - m s - w i n - a p p m o d e l - r u n t i m e - l 1 - 1 - 1
a p i - m s - w i n - c o r e - d a t e t i m e - l 1 - 1 - 1
a p i - m s - w i n - c o r e - f i l e - l 2 - 1 - 1
a p i - m s - w i n - c o r e - l o c a l i z a t i o n - l 1 - 2 - 1
a p i - m s - w i n - c o r e - l o c a l i z a t i o n - o b s o l e t e - l 1 - 2 - 0
a p i - m s - w i n - c o r e - p r o c e s s t h r e a d s - l 1 - 1 - 2
a p i - m s - w i n - c o r e - s t r i n g - l 1 - 1 - 0
a p i - m s - w i n - c o r e - s y s i n f o - l 1 - 2 - 1
a p i - m s - w i n - c o r e - w i n r t - l 1 - 1 - 0
a p i - m s - w i n - c o r e - x s t a t e - l 2 - 1 - 0
a p i - m s - w i n - r t c o r e - n t u s e r - w i n d o w - l 1 - 1 - 0
a p i - m s - w i n - s e c u r i t y - s y s t e m f u n c t i o n s - l 1 - 1 - 0
e x t - m s - w i n - k e r n e l 3 2 - p a c k a g e - c u r r e n t - l 1 - 1 - 0
e x t - m s - w i n - n t u s e r - d i a l o g b o x - l 1 - 1 - 0
e x t - m s - w i n - n t u s e r - w i n d o w s t a t i o n - l 1 - 1 - 0
u s e r 3 2
z h - C H S
a z - A Z - L a t n
u z - U Z - L a t n
k o k - I N
s y r - S Y
d i v - M V
q u z - B O
s r - S P - L a t n
a z - A Z - C y r l
u z - U Z - C y r l
q u z - E C
s r - S P - C y r l
q u z - P E
s m j - N O
b s - B A - L a t n
s m j - S E
s r - B A - L a t n
s m a - N O
s r - B A - C y r l
s m a - S E
s m s - F I
s m n - F I
z h - C H T
a z - a z - c y r l
a z - a z - l a t n
b s - b a - l a t n
d i v - m v
k o k - i n
q u z - b o
q u z - e c
q u z - p e
s m a - n o
s m a - s e
s m j - n o
s m j - s e
s m n - f i
s m s - f i
s r - b a - c y r l
s r - b a - l a t n
s r - s p - c y r l
s r - s p - l a t n
s y r - s y
u z - u z - c y r l
u z - u z - l a t n
z h - c h s
z h - c h t
C O N O U T $
A F X _ D I A L O G _ L A Y O U T
G L J Q U H N P H J
V V e m i r a z e l e r i n e k a b a t i g i s o j e r o j e z o t o l u p a s i s u l i m u r i m e j o z u z u y u w a k o c a p a v a y i f i r e b i g u
H e n u b e p u h u g u w u j e j i x a
H o w u s o c e g u t o s i x u x a c o j o f o
' P u w a h u j e c u g e t u t u n i v i l e r a l u w a f u j o j o x a
P e b o k a z u m i g e s a k u k i x o y e f e
L e k o x o s i z e v e
H e y i h e m e s u j u k e y u p o c u
M e x i z o s i m a k e l u x e p u
Q D o x u w u y e l e p e n a d a r a j u h o j o j i n u p u c a y i r u r e d o p o f o x o b a n i j o d i r i v u f e m a x u s u n u t a v e c e
[ F u p a c e l u n u y i f u n o g a c e b o r a c o y e n u s a l u w a h o z e p u m o j u h o g o r u n u f i g u n a t o d u h o k e j e k a y i l a k a d o l i p o
- W e l i l e b a x u p e w u r i x a z o n a n o t a l e f e b u h a f u c a y e p e
Z R u k u l u r a z a p u n e k u c e d o l a p e d u b o j i r e h e b e t a j e d a r a g u l u y o d a w o h u r a c u r e m a x o j o s e w u m a j a m e p o z o
Y D a g o l u h i t o k i h o n i z e z i g e s o j e v i l o h a m o c u g o r o z o t a h u j a m i j u r u k u k i y i p u c a j e t u t o l o r u b e w o m a
< N u c i p o j a f i y a y a m a p i n o n e b a z a h i n o j a g o h o x o g a m e k i x i t u n o d o
Process Tree
-
045cdd8541aece98ba0bf1707ceffae41eef492bda222a2f4dc4484582f21f41.exe (3012)
"C:\Users\Administrator\AppData\Local\Temp\045cdd8541aece98ba0bf1707ceffae41eef492bda222a2f4dc4484582f21f41.exe"
- nslookup.exe (2416) nslookup carder.bit ns1.wowservers.ru
- nslookup.exe (1240) nslookup ransomware.bit ns2.wowservers.ru
- nslookup.exe (1840) nslookup carder.bit ns1.wowservers.ru
- nslookup.exe (1140) nslookup carder.bit ns2.wowservers.ru
- nslookup.exe (2100) nslookup ransomware.bit ns1.wowservers.ru
045cdd8541aece98ba0bf1707ceffae41eef492bda222a2f4dc4484582f21f41.exe, PID: 3012, Parent PID: 2236
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 2416, Parent PID: 3012
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 1240, Parent PID: 3012
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 1140, Parent PID: 3012
default registry file network process services synchronisation iexplore office pdf
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
| 107.178.223.183 |
DNS
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 61714 | 8.8.8.8 | 53 |
| 192.168.56.101 | 56933 | 8.8.8.8 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 57665 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52215 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 62361 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58985 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58986 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 58987 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 58988 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 58989 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 58990 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 50075 | 114.114.114.114 | 53 |
| 192.168.56.101 | 50076 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 50077 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 50078 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 50079 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 50080 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 50081 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 50082 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 50083 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 50084 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 50085 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 50086 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 50087 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 50088 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 50089 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 50090 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 50091 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 50092 | 107.178.223.183 ns2.wowservers.ru | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | ddb0d5260333ac72_win.ini |
|---|---|
| Filepath | C:\Windows\win.ini |
| Size | 18.7KB |
| Processes | 3012 (045cdd8541aece98ba0bf1707ceffae41eef492bda222a2f4dc4484582f21f41.exe) |
| Type | Generic INItialization configuration [extensions] |
| MD5 | 5b972ee771bd26f76645663c1cf47b60 |
| SHA1 | 6b4beefa0b71c9933b28b4483e7430bba49dfb26 |
| SHA256 | ddb0d5260333ac7284b2ca7856a7110781c45fc3dc19301a40c33d60d84cf6ff |
| CRC32 | A1C5BF5B |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | f3f2d8151b719bdf_amgbqu.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Roaming\Microsoft\amgbqu.exe |
| Size | 244.0KB |
| Processes | 3012 (045cdd8541aece98ba0bf1707ceffae41eef492bda222a2f4dc4484582f21f41.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | 07314887d7dd8f843113d60fc2609708 |
| SHA1 | 28a4940c5268f7042ff90c2c26f08a2615087c25 |
| SHA256 | f3f2d8151b719bdfd1f35991b2ba915f23b2da46c87cfc058f206b7fd4ae3f35 |
| CRC32 | C7AAC41B |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.