3.3
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.78
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | Malware:Win32/km_2c9b23d3.None | 20190527 | 0.3.0.5 |
| Avast | Win32:Evo-gen [Trj] | 20240402 | 23.9.8494.0 |
| Baidu | None | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (W) | 20231026 | 1.0 |
| Kingsoft | malware.kb.a.1000 | 20230906 | None |
| McAfee | GenericRXFW-RT!C9B9859B70A6 | 20240402 | 6.0.6.653 |
| Tencent | Trojan-Ransom.Win32.gandcrab.gen | 20240403 | 1.0.0.1 |
静态指标
查询计算机名称
(1 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545344.328375 GetComputerNameW |
computer_name:
TU-PC
|
success | 1 | 0 |
检查进程是否被调试器调试
(1 个事件)
使用Windows API生成加密密钥
(3 个事件)
检查系统中的内存量，这可以用于检测可用内存较少的虚拟机
(9 个事件)
文件包含未知的 PE 资源名称，可能指示打包器
(6 个事件)
| resource name | EQKBVW |
| resource name | FOSEROGATIDIFEVICEZAKOWUKEWOFEJA |
| resource name | GOREKOSORECUSOTUBATARIKIYAHAVIXU |
| resource name | JEDARA |
| resource name | RI |
| resource name | YIRUDIPUFOPICIVEHOPOWEGIGO |
动态指标
分配可读-可写-可执行内存（通常用于自解压）
(20 个事件)
查询磁盘大小，可用于检测具有小固定大小或动态分配的虚拟机
(1 个事件)
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Roaming\Microsoft\bantpj.exe |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Roaming\Microsoft\bantpj.exe |
搜索运行中的进程，可能用于识别沙箱规避、代码注入或内存转储的进程
(1 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545343.749375 Process32NextW |
snapshot_handle:
0x0000009c
process_name: taskhost.exe process_identifier: 1144 |
success | 1 | 0 |
检查适配器地址以检测虚拟网络接口
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545344.562375 GetAdaptersAddresses |
family:
0
flags: 0 |
failed | 111 | 0 |
|
1727545344.562375 GetAdaptersAddresses |
family:
0
flags: 0 |
success | 0 | 0 |
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(2 个事件)
| section | {'name': '.rsrc', 'virtual_address': '0x00021000', 'virtual_size': '0x0002167c', 'size_of_data': '0x00021800', 'entropy': 7.77404604210573} | entropy | 7.77404604210573 | description | 发现高熵的节 | |||||||||
| entropy | 0.5285996055226825 | description | 此PE文件的整体熵值较高 | |||||||||||
使用 Windows 工具进行基本 Windows 功能
(4 个事件)
| cmdline | nslookup carder.bit ns1.wowservers.ru |
| cmdline | nslookup ransomware.bit ns1.wowservers.ru |
| cmdline | nslookup ransomware.bit ns2.wowservers.ru |
| cmdline | nslookup carder.bit ns2.wowservers.ru |
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
在 Windows 启动时自我安装以实现自动运行
(1 个事件)
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\felrtlhyqjf | reg_value | "C:\Users\Administrator\AppData\Roaming\Microsoft\bantpj.exe" | ||||||
文件已被 VirusTotal 上 68 个反病毒引擎识别为恶意
(50 out of 68 个事件)
| ALYac | Trojan.Ransom.GandCrab.Gen.2 |
| APEX | Malicious |
| AVG | Win32:Evo-gen [Trj] |
| Acronis | suspicious |
| AhnLab-V3 | Win-Trojan/Gandcrab.Exp |
| Alibaba | Malware:Win32/km_2c9b23d3.None |
| Antiy-AVL | Trojan[Ransom]/Win32.GandCrypt |
| Arcabit | Trojan.Ransom.GandCrab.Gen.2 |
| Avast | Win32:Evo-gen [Trj] |
| Avira | HEUR/AGEN.1319571 |
| BitDefender | Trojan.Ransom.GandCrab.Gen.2 |
| BitDefenderTheta | Gen:NN.ZexaF.36802.pu1@aSovIynO |
| Bkav | W32.AIDetectMalware |
| CAT-QuickHeal | Trojan.Mauvaise.SL1 |
| ClamAV | Win.Packed.Gandcrab-6552923-4 |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cybereason | malicious.b70a67 |
| Cylance | unsafe |
| Cynet | Malicious (score: 100) |
| DeepInstinct | MALICIOUS |
| DrWeb | Trojan.Encoder.24384 |
| ESET-NOD32 | Win32/Filecoder.GandCrab.B |
| Elastic | malicious (high confidence) |
| Emsisoft | Trojan.Ransom.GandCrab.Gen.2 (B) |
| F-Secure | Heuristic.HEUR/AGEN.1319571 |
| FireEye | Generic.mg.c9b9859b70a670a9 |
| Fortinet | W32/GandCrab.C!tr |
| GData | Trojan.Ransom.GandCrab.Gen.2 |
| Detected | |
| Gridinsoft | Ransom.Win32.Gandcrab.oa!s1 |
| Ikarus | Trojan.Win32.Gandcrab |
| Jiangmin | Trojan.GandCrypt.fu |
| K7AntiVirus | Ransomware ( 0053305e1 ) |
| K7GW | Trojan ( 00534bbf1 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| Kingsoft | malware.kb.a.1000 |
| Lionic | Trojan.Win32.Generic.4!c |
| MAX | malware (ai score=89) |
| Malwarebytes | Generic.Malware.AI.DDS |
| MaxSecure | Ransomeware.CRAB.gen |
| McAfee | GenericRXFW-RT!C9B9859B70A6 |
| MicroWorld-eScan | Trojan.Ransom.GandCrab.Gen.2 |
| Microsoft | Trojan:Win32/Gandcrab.RPD!MTB |
| NANO-Antivirus | Trojan.Win32.Encoder.fegapk |
| Panda | Trj/Genetic.gen |
| Rising | Trojan.Kryptik!1.C6AB (CLASSIC) |
| Sangfor | Ransom.Win32.Gandcrab_72.se2 |
| SentinelOne | Static AI - Malicious PE |
| Skyhigh | BehavesLike.Win32.Generic.dc |
| Sophos | Mal/Agent-AUL |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2018-06-18 02:07:48
PE Imphash
25e128c74b124e1a8e25e84211b90255
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00013b17 | 0x00013c00 | 6.684125636781099 |
| .rdata | 0x00015000 | 0x0000682e | 0x00006a00 | 5.775273962852549 |
| .data | 0x0001c000 | 0x00004900 | 0x00001a00 | 4.119690859907848 |
| .rsrc | 0x00021000 | 0x0002167c | 0x00021800 | 7.77404604210573 |
| .reloc | 0x00043000 | 0x00001d00 | 0x00001e00 | 5.001852121744587 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| EQKBVW | 0x000214ac | 0x0001a7e4 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| FOSEROGATIDIFEVICEZAKOWUKEWOFEJA | 0x0003bc90 | 0x00000100 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| GOREKOSORECUSOTUBATARIKIYAHAVIXU | 0x0003bd90 | 0x0000019d | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| JEDARA | 0x0003bf30 | 0x000002d4 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RI | 0x0003c204 | 0x00000070 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| YIRUDIPUFOPICIVEHOPOWEGIGO | 0x0003c274 | 0x00000163 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_CURSOR | 0x0003c3d8 | 0x00000134 | LANG_ENGLISH | SUBLANG_ENGLISH_UK | None |
| RT_ICON | 0x000413dc | 0x000010a8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_ICON | 0x000413dc | 0x000010a8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_ICON | 0x000413dc | 0x000010a8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_DIALOG | 0x00042484 | 0x0000009c | LANG_ENGLISH | SUBLANG_ENGLISH_UK | None |
| RT_GROUP_CURSOR | 0x00042520 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_UK | None |
| RT_GROUP_ICON | 0x00042534 | 0x00000030 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_VERSION | 0x00042564 | 0x00000118 | LANG_ITALIAN | SUBLANG_ITALIAN | None |
Imports
Library KERNEL32.dll:
• 0x41500c GlobalAlloc
• 0x415010 LoadLibraryW
• 0x415014 GetSystemTimeAdjustment
• 0x415018 GetMailslotInfo
• 0x41501c GetLastError
• 0x415020 GetCurrentDirectoryW
• 0x415024 SetLastError
• 0x415028 GetProcAddress
• 0x41502c FindAtomA
• 0x415030 GetTickCount
• 0x415034 SetProcessShutdownParameters
• 0x415038 FindAtomW
• 0x41503c GetSystemTime
• 0x415040 HeapReAlloc
• 0x415044 IsValidLocale
• 0x415048 EnumSystemLocalesA
• 0x41504c GetLocaleInfoA
• 0x415050 GetUserDefaultLCID
• 0x415054 FindCloseChangeNotification
• 0x415058 VirtualProtect
• 0x41505c GetNativeSystemInfo
• 0x415060 IsValidCodePage
• 0x415064 GetOEMCP
• 0x415068 GetACP
• 0x41506c HeapSize
• 0x415070 GetLocaleInfoW
• 0x415074 WideCharToMultiByte
• 0x415078 InterlockedIncrement
• 0x41507c InterlockedDecrement
• 0x415080 InterlockedCompareExchange
• 0x415084 InterlockedExchange
• 0x415088 MultiByteToWideChar
• 0x41508c GetStringTypeW
• 0x415090 EncodePointer
• 0x415094 DecodePointer
• 0x415098 Sleep
• 0x41509c InitializeCriticalSection
• 0x4150a0 DeleteCriticalSection
• 0x4150a4 EnterCriticalSection
• 0x4150a8 LeaveCriticalSection
• 0x4150ac HeapFree
• 0x4150b0 GetCommandLineA
• 0x4150b4 HeapSetInformation
• 0x4150b8 GetStartupInfoW
• 0x4150bc GetCPInfo
• 0x4150c0 RaiseException
• 0x4150c4 RtlUnwind
• 0x4150c8 HeapAlloc
• 0x4150cc LCMapStringW
• 0x4150d0 TerminateProcess
• 0x4150d4 GetCurrentProcess
• 0x4150d8 UnhandledExceptionFilter
• 0x4150dc SetUnhandledExceptionFilter
• 0x4150e0 IsDebuggerPresent
• 0x4150e4 IsProcessorFeaturePresent
• 0x4150e8 HeapCreate
• 0x4150ec TlsAlloc
• 0x4150f0 TlsGetValue
• 0x4150f4 TlsSetValue
• 0x4150f8 TlsFree
• 0x4150fc GetModuleHandleW
• 0x415100 GetCurrentThreadId
• 0x415104 ExitProcess
• 0x415108 WriteFile
• 0x41510c GetStdHandle
• 0x415110 GetModuleFileNameW
• 0x415114 GetModuleFileNameA
• 0x415118 FreeEnvironmentStringsW
• 0x41511c GetEnvironmentStringsW
• 0x415120 SetHandleCount
• 0x415124 InitializeCriticalSectionAndSpinCount
• 0x415128 GetFileType
• 0x41512c QueryPerformanceCounter
• 0x415130 GetCurrentProcessId
• 0x415134 GetSystemTimeAsFileTime
Library USER32.dll:
• 0x415154 EndPaint
• 0x415158 GetNextDlgGroupItem
• 0x41515c GetDlgCtrlID
• 0x415160 ValidateRect
• 0x415164 GetNextDlgTabItem
Library SHELL32.dll:
• 0x41513c DragFinish
• 0x415140 DragQueryFileW
• 0x415144 ShellAboutW
• 0x415148 FindExecutableW
• 0x41514c ExtractIconW
L!This 1
m cannot be run in DOS mode.
/i/i/i@5i@
i@Hi&&i/hsine5;.i@.i
.iRich/i
`.rdata
@.data
@.reloc
^UQVWj
3};tp9>ulj
Y]};tAE
QEPEPE
3};t{9>uwj
Y]};tLE
QEPEPE
U]USVu
~ ~$~(~,~
~0_[YUV.
S3VWD$
S3VWD$
C0)0C
C4)0C$
f@F<^UQQVF@
Wt N$9t
M~<8F$8F4
8F uE8F0
F08 F$
u-q$6t$;w
q<0A<+
^[_UQQ$
wA+uA0
;w;+uA0
tuQ$2tlA
u$2I4+
t96u$t0|
;w+u$A4
f@F<^UQQSVF@
V$:t%N4
~<8F$8EN4
8F uW8F0
F08'N
u/q$6t&;w
q<0A<+
^[_UQQ$
0A<+9U
wI+uA0
y4q ?6
0A<+9U
;wC+uA0
tvq 6u$q46
pu$2I4+
t@6u$t7|
;w+u$A4
UVWyw`fV
UVWywXtV
N,N48F$8F48F
8F 8F08)
N,N48F$8F48F
8F 8F08X)
tuWSNDkSu
9N 9N0
9N 9V0
EP YYu
EP7YYu
3;unVM
u;uKj
|^_hLA
Ef;tJU
Ef;tLU
SVWj>3Y3
|_^[hA@
BUQEPj
r)$PH@
DDDDDDDDDDDDDD
YY]jXh
PESP.@
~.8]t)E
WPEW@Ph
~U8]tPMM
utYougu_uWuO3
3M_^3[
tAt2t$
DDDDDDDDDDDDDD
$UQQSVWd5
SVWE3PPPuu
E_^[E]
UQSVW}
SVW(\A
3PuEEd
SVW(\A
3PeuEEd
Y__^[]Q
YYF$;u
SSSSSc1
UQSV5PA
;r>PuZ
USW339]
|^_[]SSSSS.
SSSSS.
.t|PVj@u
@sh_tcPE
k_^[]3PPPPP=USVu
]SSSSSs-
vP7YFTt
vT YEfT
FP~HZ3PPPPP_,
uFP=|PA
vPYFT;t
vTYFh^T^L^P^H_[
3PPPPP2+
YP;s,Vh>
@PVWX>
VVVVV3M_^3[
S\PPPh
3M_3[3
YYltCHphD
d|-tt#
Yt1hlCHHYX
Y3PPPPP&
pPW6st
6IY9pt
uTlh=xxPtYt
VVVVV!%
3xSSSh
;t\~Ht57xP
3M_^3[I
3_^]Wh
woVW=<A
S3VW;~ E
@;u+H;}
39](SSu
]9]tWuu
};~Bj3X
3;t?uWuuu
t"SS9] u
EWYuEYe_^[M3
u(Eu$u u
YYu,9E
USV3;u
G;r3_^[]
FGIuX^_]
zYYt:V5hA
PgYF,t
PYYF4t
PKYF<t
P=YF@t
P/YFDt
P!YFHt
43_V5(PA
YYt0V5hA
8csmu*x
YYuTVWh@
};rKS9
3PPPPP
@Y<v*V]f
^SSSSSyj
;tFtA3
M_^3[j
S^`N`H
j$Y~\d9
QY^`[_^]
VW39=A
t.t$<"u
S3V/>=YX
3Y[_^5lA
3PPPPPF
FA>\t>"u&
uUEPSS}
=?sJMsB
Y;t)UEP
3wf93t
f90uW=tPA
VVV+V@PSVVE
E;t8PzYE;t*VVuPuSVV
j@j ^VaYY3;u
H3H/5A
;rSWf9M
j@j YYtQ
;r_^h@@
+SVW\A
1E3PeuEEEEd
Y__^[]Q
:GE_^[]E
9csmu)=jA
E3E3;u
ffffffE
3PPPPP
ES3VW]9]
39] SSu
ES4EYe_^[M3j
M+u$Eu
zuxVVu
ptXFVP
YYtHptSu
3YY;u!9tt
S<YM_^3[=
Y3WWWWWZ}
uH5pPA
USV5xPA
SV5|PA
3W;to=A
9YY~PE
uVY_^[]
t4V0;t(W8jYt
Fpt"~l
lVYYYEE
QRRYYt
t3@_^]
=RCCt =MOCt
=csmu*
8csmu8x
t*9csmu"A
>csmuB~
YYtaSVhO
YYt)SV0O
Ht Hu4j
=MOCt*=RCCt#u$u u
EPEPVu W
ESx;7|G;p
@u%u$u
E;Mr[_^
Yu\39 ~
EPEPuu WhM
EGE~rF
.u$}u ]uE
u$u uSu
tR99u2y
u$Vu u
Q 3@_^[]j
eEQb@|t
VW_^]M
S3VW9]
3_^[];t
B:t"Ou
Pj1SEj
Pj2SEj
Pj3SEj
Pj4SEj
Pj5SEj
Pj6SEj
F Pj*SEj
F$Pj+Sj
F(Pj,SEj
F,Pj-SEj
F0Pj.SEj
F4Pj/SEj
Pj0SEj
F8PjDSEj
F<PjESEj
F@PjFSEj
FDPjGSEj
FHPjHSEj
FLPjISEj
FPPjJSEj
FTPjKSEj
FXPjLSEj
F\PjMSEj
F`PjNSEj
FdPjOSEj
FhPj8SEj
FlPj9SEj
FpPj:SEj
FtPj;SEj
FxPj<SEj
F|Pj=SEj
Pj>SEj
Pj?SEj
Pj@SEj
PjASEj
PjBSEj
PjCSEj
Pj(SEj
Pj)SEj
Pj uEj
Pj uEj
Pj1SEj
Pj2SEj
Pj3SEj
Pj4SEj
Pj5SEj
Pj6SEj
Pj7SEj
Pj*SEj
Pj+SEj
Pj,SEj
Pj-SEj
Pj.SEj
Pj/SEj
Pj0SEj
PjDSEj
PjESEj
PjFSEj
PjGSEj
PjHSEj
PjISEj
PjJSEj
PjKSEj
PjLSEj
PjMSEj
PjNSEj
Pj8SEj
Pj9SEj
Pj:SEj
Pj;SEj
Pj<SEj
Pj=SEj
Pj>SEj
Pj?SEj
Pj@SEj
PjASEj
PjBSEj
PjCSEj
Pj(SEj
Pj uESP
Pj uESPq`
v,v0v4v
vhwvlovpgvt_vxWv|O@
P-YF0;
Yv4;5,A
W3u}9~
3FSougYYD
PuYF<;
PcYF@;
PQYFD;
P?YFH;
P-YvL;5DA
W3}u}9~
C PjPVEj
C$PjQVEj
C*PjTVEj
C+PjUVEj
C,PjVVEj
C-PjWVEj
C.PjRVEj
C/PjSVEj
CHPjPVEj
CLPjQVEj
@4MC43@3
F$|3@_^
WPWPWv
whu;5A
8]tEMap<u
TM_^3[j
qM$}_hu
PNY^hS=xPA
`Y%u pA
3_^]UV3PPPPPPPPU
U3S3@9]
|FVWt>E
tKh0vA
VYYt:h,vA
r3@]3]
V3 AB<
3);ut!}
0WViY;_t3@^
t,PEP6.+
Y3Yu0N
t<6Y;F
t/EP6&)
@\EP6(
t*EP6`(
VP?YYt
Wj@hXsA
th5LPA
u h4vA
3PPPPP
t,j@C@Ph
3uP;Qtu
tP;Qtu
eP;Qtu
MP;Qtu
?P;Qtu
0P;Qtu
(P;Qtu
{P;Qtu
mP;Qtu
^P;Qtu
uP;Qtu
rustnM
tR:QuMPt<:Qu7Pt&:Qu!Pt
@FA;r3^[
+UV3PPPPPPPPU
$sF ^QL$
EPQEPEj
mY3MW0u
Y+t"+t
+tY+uC
Uw\]Yp
u>OdMGd
u wdSUY
URPQQh0@
t;T$4t
;v.4v\
UVWS33333[_^]
33333USVWj
_^[]Ul$
B(;r3_^[]
1E3PEd
Eu}h}A
3M_^3[m`
ft'Ou"+
jPfDJXdf
SVW=pPA
3;tuSu
t VV9u
e_^[M3)]
3]USVWUj
P(RP$R
t:|$,t
;t$,v-4v
UQPXY]Y[
KuZUUU
;t_+^]
VSMYY1+W
E`p]Ex
tAMap8+
;t+3_^[
RQMQVp
u+9uv& ]E
E`p3_[^
]UWVSM
U33@SVW3V
VVVVVVVVVVV
|M_^3[AR
SV3t$ Wt$
t$<t$@t$D
t$Ht$Lt$P
D$pPD$dPD$hPA
$9D$`@
D$pP<$
t$t[=j
wDYt$Da($`
MDYt$47(D$
u3D$\PD$0PD$,P
D$TPD$\PD$0PD$<PV
3D$(9t$
9du,t$
dzUD$ !HD$
Z&l$ S\
_^[33H]
R<$tmf<$
Fu^8Mt
Mi3;u"
E`p^[9M
Kj"W8M
E`p33PPPPP
[SMQMQp
M_^3[A
E`p3[_^
MNcu#>Fj
\J@PVS#?
8J@PVS>E
E`p3_^[
^VMQMQp
&E0}lS]
E0eS;t
[M_3^`<
_WMQMQp
tS]3K}-
[M_3^s;
et_EtZfu
VVVVV^
U(3EE9
tWItHIt9It
EYY" uES
t*f u!f t
ZmZ,$Z
MFSEP3SSSSWEPEP
E`p3M_^3[,
MREP3SSSSWEPEP/
E`p3M_^3[H,
Wc8@PWV*-
PEP"YYEPj
^3[a*3PPPPPqWVU33D$
X 9} E
AP _^[]
;}"+]t
|3Et^E
EE EE$h
u+t's C
YYM3!][
Vf#^f;u
HWxtRHtCHt4Ht%HtFHHt
QP|xPEPc
65YM_3^*
u'339\u
JBtj 3Y+@M
}99}r"9U
JBj Y+3B\M
3+BL1<
Jy3^j Y+
u'339\u
JBtj 3Y+@M
}99}r"9U
JBj Y+3B\M
3+BL1<
Jy3^j Y+
FWE}MuMMMMMMM9M$u
<+t"<-t
h<+t<-tk}
+t HHt
B:t,1<
+JMtHHt
B:}QMEO?
tEPuEP
}M]U3EE
3f;u AE
f;u!AC
u4}u+e
f;r#33f9EE
EAV#f}
W]EEE?E
S3PPPPP
S3f9Ut
EfUu}M
3f;u GE
90t!uuE
EMuUm
HuMu9Et
u4}u+e
33f9EE
UUUUU3##
f;wK3EE9
}fEEEEEf}Z33f9u
Ea3f;u
f~7}x+EMe
EM}Um
H}Mu9Et
u4}u+e
f;r#33f9EE
ufEEEEEfu
~(E]Mm
0K;]sE;]s
EM_^3[
K;sE;s3f
SVW}f]3
S3VWEN@
tfM_^fH
generic
iostream
system
iostream stream error
Unknown exception
bad allocation
Visual C++ CRT: Not enough memory to complete call to strerror.
LC_TIME
LC_NUMERIC
LC_MONETARY
LC_CTYPE
LC_COLLATE
LC_ALL
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
!"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
CorExitProcess
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
bad exception
Illegal byte sequence
Directory not empty
Function not implemented
No locks available
Filename too long
Resource deadlock avoided
Result too large
Domain error
Broken pipe
Too many links
Read-only file system
Invalid seek
No space left on device
File too large
Inappropriate I/O control operation
Too many open files
Too many open files in system
Invalid argument
Is a directory
Not a directory
No such device
Improper link
File exists
Resource device
Unknown error
Bad address
Permission denied
Not enough space
Resource temporarily unavailable
No child processes
Bad file descriptor
Exec format error
Arg list too long
No such device or address
Input/output error
Interrupted function call
No such process
No such file or directory
Operation not permitted
No error
united-states
united-kingdom
trinidad & tobago
south-korea
south-africa
south korea
south africa
slovak
puerto-rico
pr-china
pr china
new-zealand
hong-kong
holland
great britain
england
britain
america
swedish-finland
spanish-venezuela
spanish-uruguay
spanish-puerto rico
spanish-peru
spanish-paraguay
spanish-panama
spanish-nicaragua
spanish-modern
spanish-mexican
spanish-honduras
spanish-guatemala
spanish-el salvador
spanish-ecuador
spanish-dominican republic
spanish-costa rica
spanish-colombia
spanish-chile
spanish-bolivia
spanish-argentina
portuguese-brazilian
norwegian-nynorsk
norwegian-bokmal
norwegian
italian-swiss
irish-english
german-swiss
german-luxembourg
german-lichtenstein
german-austrian
french-swiss
french-luxembourg
french-canadian
french-belgian
english-usa
english-us
english-uk
english-trinidad y tobago
english-south africa
english-nz
english-jamaica
english-ire
english-caribbean
english-can
english-belize
english-aus
english-american
dutch-belgian
chinese-traditional
chinese-singapore
chinese-simplified
chinese-hongkong
chinese
canadian
belgian
australian
american-english
american english
american
Norwegian-Nynorsk
Complete Object Locator'
Class Hierarchy Descriptor'
Base Class Array'
Base Class Descriptor at (
Type Descriptor'
`local static thread guard'
`managed vector copy constructor iterator'
`vector vbase copy constructor iterator'
`vector copy constructor iterator'
`dynamic atexit destructor for '
`dynamic initializer for '
`eh vector vbase copy constructor iterator'
`eh vector copy constructor iterator'
`managed vector destructor iterator'
`managed vector constructor iterator'
`placement delete[] closure'
`placement delete closure'
`omni callsig'
delete[]
new[]
`local vftable constructor closure'
`local vftable'
`udt returning'
`copy constructor closure'
`eh vector vbase constructor iterator'
`eh vector destructor iterator'
`eh vector constructor iterator'
`virtual displacement map'
`vector vbase constructor iterator'
`vector destructor iterator'
`vector constructor iterator'
`scalar deleting destructor'
`default constructor closure'
`vector deleting destructor'
`vbase destructor'
`string'
`local static guard'
`typeof'
`vcall'
`vbtable'
`vftable'
operator
delete
__unaligned
__restrict
__ptr64
__eabi
__clrcall
__fastcall
__thiscall
__stdcall
__pascal
__cdecl
__based(
GetProcessWindowStation
GetUserObjectInformationW
GetLastActivePopup
GetActiveWindow
MessageBoxW
C,z{c<4k
bad locale name
ios_base::badbit set
ios_base::failbit set
ios_base::eofbit set
rifizakixuhika
VirtualProtect
invalid string position
string too long
bad cast
Y ntan
nu?cv5
8Ud?|}}?<
?)0>B<
sl?ecb~q<
oX?F.K;<
4lkQg?;+U<
:@Xh?,n@4`<
G^*?m(<<
+?NibzP<
l? %X<
Y?]@_}<
En?T(+<
'?ju!4<
qw?_W<
w*I?n'$<
R*?)R<
H?Zxgf<
a?_"C<
]hNp?b
4{#s?Ug
*Ow5?.@<
W?W0e)<
J]?V:e:<
b;SO?4Td
U?\z#<
aX;[?Y']<
|a?B<$<
?+XUG<
._p?1S<
'4?/t><
&?5SmT4<
@ic?%[9
3?*+xi(<
?{!mB<
2?cMyoG
Vsw?8K
l?e/?B6!F
u0wu?M
G"zI?$}Tw5<
e?M]-e<
) ]?h<
'7?y]h
=e?:Q]D\<
?FnHAY<
)RQ?{<
dN{?c1
=.q?+`
iQi?v7
?ZEM-'^
!?:Zn=
eP5?+}ZI
Dwb?(,x
Q/?qq)=
o\l?)T&=
?|6??#DZ9?
?/.?>6)}?, ,
?x%q? ?/xbJ?
?(Z ?t?{}2F??_2
?>T^?u
?;E<?fSOs?JQ?zL?
?{yK+;?
h?F?-(?n?@F
J?CSi?
?89l!?f
:?1(>?
2:@?>?@@?"Ir?64?
?765@Z?&+-?w'?
Q?Gpt?2&?X9
?Mj$?3?s
?I@ |?P
?}>v?H|As?#
F)Z?2V
V?f\S?B?}
4P?VL?{
uB?1<>?(b;?
7?]o-4?
\%?f,!?
?a?9y?9
9R?%R?F
?@_o?7
?D<xZu?`\@j?)]Gq`?
LcU?JupJ?CY??
?#em? -F
R?VDD?oWsg6?UJ
?1_?$*2
)?V?l$G~
?+6?tF4
,~?"n?
L?l6;?6**?|59
?HK?s7
?I-?$z?9\?>|.~?
-W?^\sY0?:Rp7
?mbzA?G4's?Iy
C\2?Ou
M?nw?KK'F?l
?}6lw?
?$ f?e')lW?zD@
J?F<?Q'J`?xe_
?"Sr?xw
S/?yx|o?P6 d!?
T?!z? {
I^?A;?wC?JG7&?'
?,"Q?/
b?PV3 2?
p?Va"?
UUUUUU
333333m
.?333333?q
?UUUUUU?ON
?$rxxx??
_nextafter
_hypot
1#QNAN
1#SNAN
GetNativeSystemInfo
FindCloseChangeNotification
GetTickCount
GlobalAlloc
LoadLibraryW
GetSystemTimeAdjustment
GetMailslotInfo
GetLastError
GetCurrentDirectoryW
SetLastError
GetProcAddress
FindAtomA
VirtualProtect
SetProcessShutdownParameters
FindAtomW
GetSystemTime
KERNEL32.dll
ValidateRect
GetDlgCtrlID
GetNextDlgGroupItem
EndPaint
GetNextDlgTabItem
USER32.dll
EndPath
SetViewportOrgEx
GDI32.dll
ExtractIconW
FindExecutableW
ShellAboutW
DragQueryFileW
DragFinish
SHELL32.dll
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
GetCommandLineA
HeapSetInformation
GetStartupInfoW
GetCPInfo
RaiseException
RtlUnwind
HeapAlloc
LCMapStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
GetCurrentThreadId
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetLocaleInfoW
HeapSize
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
HeapReAlloc
.?AVerror_category@std@@
.?AV_Generic_error_category@std@@
.?AV_Iostream_error_category@std@@
.?AV_System_error_category@std@@
.?AV_Locimp@locale@std@@
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVout_of_range@std@@
Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.
.?AVtype_info@@
.?AVbad_exception@std@@
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AV?$ctype@_W@std@@
.?AV?$ctype@D@std@@
.?AUctype_base@std@@
.?AVfacet@locale@std@@
.?AV?$basic_istringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@
.?AV?$basic_stringbuf@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@
.?AV?$basic_istream@_WU?$char_traits@_W@std@@@std@@
.?AV?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@
.?AV?$basic_ios@_WU?$char_traits@_W@std@@@std@@
.?AV?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AV?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AV?$basic_iostream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ostream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_istream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_streambuf@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ios@DU?$char_traits@D@std@@@std@@
.?AV?$_Iosb@H@std@@
.?AVios_base@std@@
.?AVruntime_error@std@@
.?AVexception@std@@
.?AVfailure@ios_base@std@@
.?AVsystem_error@std@@
.?AVbad_cast@std@@
.?AVbad_alloc@std@@
I x@oGAkU'9p|B
~QCv)/&D(
uuvHMXB
9;5SM]=];Z] T7aZ%]g']
?Zd;On
7?3=Bz
;1az?aUY~S|
D?$?9'
*?}d|FU>c{
zc%C1<!8G
u7.:3q
#2IZ9W
,%I-64OSk%Y
.A'1F,=8
#:Acr58
^F4Vs8r
yWrJe+
v(rwusP_SsANLu8
Mu>'AqcE`I"]
c2zjn&x)Wmisuva
5':a@fu(/|
_A^x1UIiS
}Oz}6u#
7J802j
Nw_|pP
Zd1z:6`B
eD>EPs
B&}f*].H:n5It
tu44VR
5pzC!r.DK
yUpMP\B4
>,5SmV
A0y6L=gR.
DVg/%4.RF.4
/Q")JR
")qJHL
ML:5+}W
%5TTT{Ym
~2*mVs b
@Bq[d[1@4
!UK0+AHTX h@
`6G9!F
$Q-3i`z
\DqFZMQT:jjsBk+:
G)jmAr
P0!H\Y'
O'h"p2
!:R@3^)
bo@'C:%V|%ln
8;eSTz6?>J
&&ykR")-
:5^zXD3
Z\QO?J/?D]?
_D="e0B0npfT51[[]@
"}O.;$
ryV|}XZZt
cX=l O3
EoEe/8D%
Ju!6cs+A='Q__
Z{ nZ=
/0AN <*
D-n4rye;
KXU;`
W 0@X17
[oPtT8Sls;
DD1yQzJxI
'h>v6/| .cS!@U%DWi,ns
~(Ja8pXx]
\H:6S~
~Db<E{
:iGKo]T
">gIl_[W
33,yv`#6
"X-1eE[v.8h
;&FU6oH
Ja5,O^
9^XC8zfh;
k/ 5^i
^?}Noi
oykI#w
5c9&%|K&
#7}7 s6
WnuykK
:1/PIX0mu
a$q?b
XB>hZR
,S0VB(
<T?UMyG
1kxRIk|_
zR%b%-
$~1RB!i|I
t973ZP+biYw4U
}4ivKF
S>?_^s
;;o_6h-VXsX0Z{
Qkz1wF6fB
F T.?-X8,
iEW?GQ
`Rp%>,a
Ty|Xsi1wB
8XUN?ggP@Zg9d0D
M#3&%z
whC/gn
eZ"OPHLS<w jxe
P#HR%}
1+ e!A(MB
MTQ}/SH!hh
[FvkrAVdn!q
`Ud\Qs
mB_0r**c$Ks?+<7_?^i
! ,<k~<
{e*#cf
#^+C&x
uU0*I=7
cSKZ(ue>|
X}`~{+
Ys{6**
@?*~'?
6,G Kl{
*n,(dP<Bc8
:iG^++<
F|P7Dt5y7A`
;H4B IHoz
m,PP5-
A!cS!XG@y
H((Z `_
>b+{MW
~I^rQw
Mje(?7\js{w
iY<%8lm z1G
"|Y;V-
y|H:e_
1$s)AU%
b?n!UPxc{{
b0|`D[
HKJb<5
buwH}@
DS*#wZ~R
X 0j\)6
D`XV~Jv!p
~y|6xL
"u)MUIs
ptw?bw
?v~AL2a
iW\f^'i{.
pv,l[>
z[\Wxz"W\47
\==w~Ff
nmHUQ(Z>=
Vn)4-ZnjL9UoFi|"g
x)}pcg!P
),Zy~Az
#KLy+M-GbI
.}cCV@
}?u>v a 7tc
y7>z|$
4VV<*zSL
BXR0MK
+Bsp,v78@
,2b"yni[>
X,t5)F
$#cno|7>
oWa*eW1
37OTN2
^Zo~/[qZ
@LVx-[fi
j2=0D:cB&?co
dV2g)|\
vJpb-9
BWN(LRu'|b
0@r7xr
e1+u k
'|(I_@
NYVlAIzQ
&f5 R=
guxm7-sDo
dw SP!
pdA\`@
Jf(!="
=6wXI]5
oA' pxdA
tu^=cQr
LKF2V2
JM#']l(VOK
/p]OYV
AQG&=Y95n?\HU`0
p4}!O^O
49`_{O
*iEf1}8
]8n=pWU%2
X$a?~9?C
7E|u!~l#?
ai$v}+G7
Keb<kSA.ZTe^8S`
B-A,2#i(((-
lgmY;L-*
5M0&n2
}-kRaiySN
5v;yen
Dx~sUb9]A8
@h=[30
(ls)oh
TYKyF!`g#
m@+4 "o_)h
GFQ{ON
Vn62T J'j*
FWZ?%jMg
]P'IMB#k
lqs_y}
d(/{sM
wK10S9
[T~Z+H
eSB>(iZ
a$E:l%Fl
6^DIu`i
hE.iA]
< _{&f
nn$_SkZhmz
6`$~*c
dqdI*`
W:W^KtZ=
o7I<\{ ;)nELX
VhT[`Az]
oz G!]=lvHig;
gr"3<\{
Nk4)bn+
G 0W_4
*u[JF YhU
=LWD8j
?Ce<Ge Ak
SoFc##
Wk^L[a
3hOeBES
Z>qtO<p
k[XnG*]
heP}"X
O3XSF_
5^&9t}
pX- ]&
6d3""Q9w
sm"nz
?nj5rdQ
Dk!_dBo3m"
O7: J<rp i{t:eq
TZom}UbUoqt.sBGt Ewj
43@wknI>Tg:SF
-)yAi_p$}g0
\BCGs&wsN
IK;&hN
Z[fc)]R4
d-NXurR
~J+sz{$(<@
;`yjT2
0N%k$r"S
cgZh9W
+#%LT#@
j|;o_HT6v_8
zcz93~Ba:
28TtDo^@
rj2DKgS#
).?,1M44
G5KU;e
c.-7 &TCp+
n=e4B9i
X?DqLe
J*Nq'g=(x5ha\?E
m*<OsfkKT. [5
&9P`Hm3T
*wJH\nb
{in#"@IBK<
js914uT?
oq7i!Lih2H
&6;USPQ
Hb6]+~/
k?reoFK
?AI_D\
m<!f.<5
vX{k!8
UM5`Q$NM9
];!WEuZKth4:
("|)x^
<`'|-}IXM
`rzG8QY
e](dwoB&dD
+"0e08OPRdk&9
up1#(\l-V}H5)
Ke/jF/
D+2cG,NW\
7 oPwh4d#
pPSlA-w>,
%VDMDQsM
`akW^zt)
]Vr<c8CZ(S
eHKA1J2%<IG ~#q|
D[y\XuUg[ }f[.
n6U{X
RK[Jp}X8UY
)<ggNp
/),#un]
#Igp_Kr8
feF)J7_w^@fcD9
!D(D-h,?1eRT
GE8pow
SxPdvX
/%)6BNG
}:L?PNgf3l
1b~qSB
Dn5"]q4{
!Tr\L4A
)%&&"EP+
el=sMr
(+`O8w=?$'
59tC,z{
-V~dro
hL(oJ\
tI|=yrt
,?*i"V|A}_<8GGOO[?
QI4c6@S#
4tAG7+-
:^HN\S[
%uQdR?B
ww4Se '\c
^a7orI
^Hz_r>|
23FVJOK
AN$aQ-
H~9 E|
f:HP!N?[j*
BAHS7#(e@tb
_20 pqGW
dx"i(K-tJ
vt aO (d(SGf{mE
kqBsQ}
l}?Tb^F
XidQDI=HN
_&2Sq
.$$f,`i
LyHFzETr$
tBC!Ph!Uge
i0VP$::\L_Mak
yty4D
S}IDB6
B@bY?kFeoOQ
`jOugao
DJI;[%^!
}{b"(q5Q|Vp0tPt5
f+h42/Xje
@h'Erc@
E/'e){"
Vxa4sJY
oD"Za?
!VYIq3
e!6yNJI`T}
|94\gj
^ '}k(Mvn:&vYwpI
a[PI,Ij%EH
jx:HO1
8}t0+VQe
1y,k,vCcb6x\ZP
|M2T%H
?`-}Z_-
'^`66DBQ!6"d'>j! ~_Wb
D{nG9~h82Bm&
dciO=B
@ !&*i
4jr3Q]TC}|
R@ru}9
PiB8QS?nn'"L5
StUvPz
|N9WOQ^e
.{f+n&Q3
0LW|e
F C?e]
jkE_gVY,9
Uo'0%9is
hBpL&v}?5
!M=Rg;&+Mr|!Y7
6?+sDL^Jr
\o/;5*@P
x-b%FG]
oj}>i}]ad
W^GC@Pf$}c
gEK%a|4u
(.&lI$f8f1
<7ZS=6
Lhuo.$z[
C)NId7
M#i_ev
M~U0>a?WmespF
c&[d2+LoTX
A]((V*y
E~=o/I+*
SLK4fw
bHs9`ofBg}(
g__HE<
{;H74!
Bn/srm
6`y`" 0
ccLZ(JX
6eb4+u
QN}U\R
HR5V^%
ehPru+YcWP-
N-juQ[
$W9|~"
`t$1m}
2?lBm_{B8&/
ksT}6@d[
iC6p87C
@l1!^GZ9:1%Yzn
rtLM.<"v(j=
N9%Bww$L9tQc9A&
"LnMel>4O
lD E0xX?
zMj#W{
ozonIWq
F'+Sg}
$G+10cR2
7Dw&)j;pB
J(lj@6UjcS
Bq({W1'di
OzXljO3
etl*nDH
GAJ";N-
*$*?3x\Oq
D}_$.a
y/6Uzd7vo
%WA1"
|Eec{djMt
fK-&2y
vPGJ^5AMT<Y'b5n&+tt
@m{Hu}H}4
"Dy'^ZoILC(
[)d7x/Zg
]#S8~E
v!=Qq+*
'Bb-Y"dR
-9Y-P
M{ewMk
O27c@0
j7LYY\
vZbEcbErB*u9<T
H}p.[JTi
:ygYe{
Yr?K9"
t8G|?_
oFa*P;b:3=Qp
QF%tsZe2
FQOYDaX
T;AM=g
ZAR-wdk
Zh4y-!J
{Vb{k`.
h,n1g[
f%j R":
z1 GY#
Gw:^Xqka
0_!^~`%
G_ey^>yt
3Nm|CCo
;xH9 {y
L=T+6n7U
&P=QqzUSZq
g+ba*htz
=s33^XoUr!QY
:f%2Iq
6Kbi9;*
:\bu*=_/d
oo\NvN.9
P+S+Xu
gu"p7JT"<K
B)-f,@c&
AuTul"';*
\?ixn,5
Nzg~|3:
Bq3Dqau
dWY{8'0
nB4ss\PQp1M%T
^+p9pkjZ
^\pR^xud
l;KQ?!*|vH&
cp"@C2*(4Bf
$0s2&LC-SI
4,i01&:QZ_
WP/D"5Fw}?Zo
);n!CxIsNP
w0xL63!hA
Y!#Fiu3
`K*M36-
or[HK-
"M2e&^;h
mr`9 nrE.
~l@]%l
MUj03F^]GNnl
h-9+5W?v,'
\x3&}1
LK{`nr?L
21kdsWk0}eS7
|&;Nqd2-N hl
Y%Bc nW
fh8Vk4
wf/a8x
nDt tnm
adU<a
"Ft#zc]
\ l1 8u
HvCHnb
&F)x~yxRa
~b?JKUK"T9
!aClXk
|cAwd98p
acs'ouE0i
mIz7wx\`U9
[?6Rjo
Uu~X9bOuYc56
},#2Me3
%UKWC-6jxI@/_
#~37w\
lEnv@.
"t+1ZrL
e+0<},=
=M&|eU
`3$W)#_
j*(>bs'y
poWQ8"
]XO^9\6
X;34<Q
}d9ITxly3I
%Qd'6t%d
8!.b>+G
jgLh?;g_\$T
Re1}p^
Ga*Y28j
kkF=lP0vH*
aUv+~6HY
. ^AW.d
U=J5jjDy*
^v|/BI~{g
:]=Xx~
73!&bJg
6_T1+
?0'Pm
.5:=%?R.
*V|,*l
~9qgW{C
}JV SK%^
&@^Jyjp
n|G.QV
3J&@7`
!XQC>d
~YX1JJm}d@
j&G(o~Z#((LjuT
sx, iZ4wQ
!NUb%lL"fH
U51E%-T0S
jjMt,K&h
@}Cu}IR
ZpkT7=P
y~gN)| 8
(N^L`!
(f9t{\%{O
TMynk7+4
x g Ew*Lw P#nkY
PpJgCtd
ZDP3fPBC"
:PkKmx#
dipV33
n_/1Xr
AnhyL%-*a
%?:nX0awCs~
}_`_k1(
i`t-FH8
4ycD]vh)7
+vI3kG/hx]7rHd=U$4
W%i$c;jf<k<F 1
^_EILHm
NLwk]v[nK1g
Uuw\b4
&{aEwB
pf35 b8\|1
+friF%?
y}9Mt~7
v:/JF@I
9"KO1UpI\~sOw
jZq5Y&fT8
[ji{nZ
+6c-Z`
iX4iaf;5
$& gG'>K&
Rrdu+*
vt2v~\Q
aUH7SNX
A+SCk-k
KB:_VI_n
:ZZ!JIL-;|
nA>s0~
hct<%g.x
w<?:B6iW;
N~q2j?a*
O]ya1!9~
Kx4E%L02dX
[E<8U.bG
\(,=>$H%g/1
R$k9bGPt1R*I
`Sj,kR
=t`h#TuEH0NlA
,uzOhOu~
~l1;^N }
pg(l<[@h,
5AtnP8+fK
-N;'g"
WTP@=a
!,&y!3pTw
m~fy5M,I
L9K9.]FfA
{!G"o@G.
EI$H 7
_jO^D~
TGkOpQa~
1+O/,M
1|h|gI0-
esxeXh
k:j\H7
;A-S<y
a'S/XRJW"l#
t/=8A D,st;+[Lj>{
5O{$J8A5kRA/v"
cQ`.,ZZ
WH|zE;W"Vlzlcf
cL{EV<<%gs;S
1\&%TV>mUkU?xGh>DI&brep
uL^vyL
U90:$i_g
a*KL~Z+
=4 zvq
e}V{$o
%N0BVQ*u_F
u+#V?mnM2!Z
PBHOkkPi
QMB)vi
d{n1F\
lW:B?5
U13PI\h#lP
O>}KgV
l(/)u!abk9cZP
s 'repu9hW%n
D"Fgv?
@K_hk:
9?IKo2QLj2
v,Z9uMs
u'D?hi1Js
+/lHA0
6_ Kq8/69w
_T3]^C8Vq
vTyUP4e=`
}3lN"I/MwwSW} +
y2ZYhg5
O{-AB.Z:|[T,
RpKQ0p<
+O!r=(`
T=wV!^p*/
="xpu$X*W
W49e[;D
G;<YS[FT|Wk`
,c+&As
R7:T[*
s-_yc\M.Phrb
'ao ~Z!Ox"
f`_-2)^09aiPj2
G/lf^DzZa
WT&_^;\Y
9.o_3G~Pt
vovx$RPPt|
SF-pi(Z+
Dw>9gD?JD
Jgr7t ]
mLQ)dh
]VBl ]Gx 2
G^$RN~d%p
=Op+#:
hE=L 8
OG> ^n/5J^g
oHrm}Z8
BG?1gk0@5;xSw
Im+QZo
6NYlE6&
Qc(MuC!i
Tp=r?fdVV+
BhmzkEh6V
U!gGt (Vh
ouW_(t3
{As;4A;-q
+jQ[?[
` '?y:~;a,Jz}_
F"t/ri|j\K
m@4(ZQ v8<
3]X``c[&00
d{1.i97S
A&VG?P
V^Z5iJ
60'Nw-k
]fm>+g}H4(
Adfk>$%n
zoV'?$`
2c/7gv`
f5xgKM
l<N%Ly
orHHHq
>pP+x @
)l'I-p}AoaPQ
:c~Z$4
WY>ta5
6hK=QSv
3~#y+g:S
<\32j5pT
M)~o!b
$JK<9k
'} ]HpA
mVg&3Q*{
9"><N> W"W4)lq+EDV
w4c]&0
v~w<1H+
.8O9@j
`XPd9f
}}H(AR+p))/^
|dNW8kh
~A_SYMa
*Vrk,;:
s3|)}p
3xMZm"+h
/fhDD$RD
^`H)o3~ ksS
i_Htd}
*h`]t%
GP7oCp,NA?
cW\t+p)I7
0`->82J&?9
}MS;jF
4E~m@P?{4-
jq*h@.
5D9% *hWe
8eL'sI9
pk`jQ(HT
QV_=Edsh=
b8QVBi2?W8"M.
d)IGfCh(
|SuDBl
HnJ|ZG!
(@ m""Ta*;2
D2L*C{
dGHAxp
z@e`]xFD))s
.8mf}/b;7[}kJ
}MEv(A>1$s
=3]z#nhO4j>WvWb
[7 X!l&T
`jkj?
WuE\{\
+<2tpvRG
X_j:MJ[9
z;.}v*KVW[Pt#pu:f~
|Tc=t y9
T0e@}R!
uEo YQ(5U|b8NbN `/
BvY1ek
xD TMa
EOe3g@*q
4L{n);9KI
[sO6hbuLP8
*AgIPw()/n,e.wi%c
|83fC,Iz
f'Ys9t!
">7]vqkX]ac.^Ey|P@
e'EG"g0
KFSI*v~
aV(c{2+
_oEsmM:6
=;j6buoNa
"3cX(N
5.z *ET(f
l)&W@u<D
b@~#;Wm
98r0:AXxC5a
Ztp>9IR56
-yQkt(3P*J$!>,==~[Q
0@=,r~
?(3bqX<y)O
!m+E1@.(ag~
TLK2VKEm
2EZ5kQl_;dxP~G
5'68x
]Y=YkcIN
u;)lit
,ay& q80(
mAEOtLKIb"3}88
X* 2!7
k~:'4_Wo~
y-FW|)
=4Vo#X
1)*L)o~~c0
/fD9)5Q
A:=@:-quX]
Q,C65<(H
^mJxLi
rw|/AagGP B!ypL
2$UyHH1\r2x z2
s{Bh]Y
RHj=[<
mY7dGl0
FB\%Yo
'r{gXs
/y>BB"
KfTc[wL&F
q 9u ~#a
.0P,dQt@m
K0r\j
]6Yd#Q
<\H/HN
?Rl/t0^PnrW9',DC\
3p;oa+
wn.L(2 J#x:^3@
AH-mT=?g?
'3wadsfVvS4
JYT~|"6
?+:/KM>
_X/GG;BxmY
T~_Gv'w
IO0z KoF
DaoP*f
c*ki-eq
!"a)7:
HSu4W[vT
fFWC"Nw
l))v5zrgDkq&T
U{<'QC
g2~,.93m
GQiVVKEZ0)
|Q@rR-]Z
?I>MDp!A
kNMa}j*
s#0{>/7t
G2T'12K
6pE\I'N
VJAem*-'9
2fgM!T8p&<L*
M:>4=aq
b`LYvW
p<V@ku
o_OVrt
Zmy0<%
A9mzc!
T0fwKD
Ne8^z9##BA\
>&yP|Zu
qkQzE#
T7\\bp
h\SY[nV
/,2^ddEVK7
Zp(#PO
J;*D%2Y
,z-/~8
j$Wtc[.
Y=*,*i3O
aW'k{-#BT
=P=|M@{8
WCgw?)xh
Az-u~kHM
*%bxar
/qO^K\K
K5-9g:
2.{=z
IvA%dJwW7r
L|@jTn
b!$H{>
>Ru,X1
FKSlRGJ?P&icZ*C
3B:&,aYR
Qa{qD&
Z]'{N_
C#*6&|MhZFY7]
cCfV{,<HC
`++<vfd
_.$fo5H
N[<k)efN
+^TAP{
IER(nQeave
yY\Sl`Q
/'tOuV
cP|]{JU
dz7TU>
f>Gf*b
zraK)w
'l{dq4M
&W-vAA^@
#T= 7#d
b7}u\>-
oV$#XQm
4H`pPq
ovtTx~qP
#1^=*^|
;> JBvp78u[;rR
0h<_.v
cLCF9QBaJnl)
eJTw!>x
0n=C Rpsx
Tq?g]FGwb7
DiLsPJJa-S{
,Z"^@E
_;`s_?!|0
<f}I*v
}{tFOE7&j
]x g4*
&%//mF
PaI&K-5
i-{gXak
dq:mNR6DVgUi>
t-dmg|.;7
g@aHu'
K%`qxC$?
Ri ;,RBbI
b$7r]g(
TzmJ-psK,<#( <Z(#
N E'F
b;;xxI(}
cNY0pbv
fp)Aj7]kszux
uq|(GS
$m1Y)OlO`0
wD,g0\>|gKt{:hExl
-iwr?f<`i
0"uR/Q
S\M&K3;2b
Zy+U5]v^
BWn}Ji'@,
3!xgQO
.W+>6ki
"iyfn_>tbXe+3
y`%4}`}
}M}l!$c\$
tzg;@(
kM+2d;}
yaB<eA)
~&@k<-|
I8Ov<H
1b&_-_
H!2 F(
04wC
HTi= &69
yQwa:g
}6AwVn
(Z1JHi)3^gi<2Gm*'
AeJ&i.@rxmQ
z6WVfZU=[2
q26(]\9
wrYJM @F
s)wW"1{eN2d;-s\TIm
H6?<{~"FfLWt
!]p{ADu\,}
4<K'wdrk_eRve7mg
+SX]':{E\oL|
xx:oB(Ccg-"a4
dU)//j4>
.$$;>HZ}<ho)](Qo
4PRaCS
fV2U ;TNs
}aBC.J
+&sNu`
flj%6_d
2Bb\A`
gSH6'%-w
3Q,~zL5Vnq
[--2(.
"K^.hA
/%,UX6mX@
=<7l!+
Tfki)D@
{DbK~=
tg8lAB/B[!6/=+q`5
)CHjKj|p|
E._8m]
]G_lh&Ta
#]"epu
|{}jx-Qx
+v}_[<z
cA/I3co
9[qE/^[@Wyu"77Q>"
s2F:?.$
$-2h9xr
p ZP<ZT
/?G:JYH;A
'`RcF.
93|"Kg`
*B%KNH8 7l>p8%
b'.F7?>
7`.nL Cy5,nA
[v<[w,
#;[%r<8tMXa(/&p8lVK
T!qK<{
n<$zytUAD
L)m^Rk)0X !
vDo_9dv
w.x`OK
z`E(x(_`
X(`+8+/
1|O29 O\
c&GW+gko6
^o{Gtchb2i
-#xk-FEs
~Gq`b(
yt7|)j
_o4-b
B:~b7J
.%*B8k9
Rl82X/
F`ao-5
r7t0ap4>YC~. &\
$64M`#iM=
\, n<N
d"IxJ7
<I/s," e[#B0
0g4w'NV#
lc3b8!#
GN~:3e
Kw*#+k
XXowlr
SiYWjbM
]=\`C9 :p7)
J;"{Lda
s/_Nn>
v|R'BX
vI;sGx
NnvKl{Fk<9U
A4:9]s
D8h`56E
HnCZxb+<z^1
$^D<PoL
OhJkw$
jnj"f3
/S?s*S4
6KUIrl
ZYxANQ]28NvVqDX>-H
PiX9?e4
0*z]5n\3yg
MQJ;e<
_$A}Q+ !q?yz}
p2^=K]]
"n%;<6
~X]~ij
o)Q~&\#
'W #[L
3x3q nD+
R(m*E;J
@2XN*U
xe)1[el/4=(
8n4K<w
8pG<^>p|!9:
7/a vC~*i
^ulv,u+[\@lB!K ;
9%P\Gm|
<XUwcT;s
ATcVUj~
,7e/Qj
v*wT0=
w:5W~F<eN
Q1]26kq
&J90d}
"Vjm>j
"0jPBTl@[M
@wCO7ks
iA&*]\tg
e)1R-PQxQ
Pvdw<ti
6la~O4e[R
,&-TbP^\
\U(\0~
$Hl~}4
UEKxPi
0M51O~
F},V<Z
egcVm`=
wx+MS4j
e:IkCk
;!x(E\c
g~5\HFq1
U2i|NYy'd'|vX
6Q[7L?W
V:\VH9a>
(qH]'{
_k7DPp#
|x%uL0y?J\{J
q&z/"p&a
g%WIvogQ
VY# U
-" 6p{o/b@me
3C\R3IAK
6nQ_!
fbY>u [[
3HuC6/
*b"tUfd
^E"UgEphL;rhc
|<j~F>X+;q
=[)^ [E
hfo5kJY*AtJT*L f\8
V?+[Cl?+Cne@usb-~
1Txd^V--
dQM\er
'6tTjs
Qlj8d!S,
"p`29FVM6HKUc
}cb,?~~I
Sp@4wuz
'tIO!oej7O
1 -45wx)
ZX"=yo
Wdx?7C
.;J,BC*F
xryBO$)$+
d$77/m*beRJ
=V<:w+
l 7;K5W
8*=hfd D
31?W>;
]yX jNL.qh0}
$v@nV3
(gGlDo
+8&\@3&]Y0bB>~ldS#
`sMyW~
U I>9}4pmkiZ1
T[a7~2.L\
cwlSBR
:c cR9^&(6P[fq}{h
4a`G^ZWM2Sfrwmt*~
Gs&]&/
Uem.[Q
}&I{O{-?Y^Q
UQVyZB
!M[#1NDV8R&
U{)%0LSy
M?9/yn9$rT9HnE;B
3[V;ph,*VI&(
beGtT0ccp9
6Ph]rJ
f{c:ZdlrcV3
)6I28OgQUcZ9v
n- @mB?~p
Z}s]+ [
"#?_Y%y_K
5BLos9
Q:[ye6sH'r=B6
'H }SSjU
OW\sz'&-
odwfxhmkUu=Z()t[_ajN
ZG>[INXB
m!R-eeO>eC3
TTj^ZL
pNK>p
k_!J0R
)qh9V]?
`d'~vd
={m6*](y,Nu{jy2
X%R<>_qmG
fkwbL0p
<[([}.X!
a mogg$.
,8*q[ `
H(I<VI<X 3e
%YU4MC
8jq?Kc>HBS Zt+zj<NrdTC
` :{(;
TTr [MT
Q6RNS_QNO
A?(b<1)
l&$^(1/g
? HK94,2
>"9@@ 1^}LCW\a
qr+Tz:Y3D6^
smG/3A
:P!,N=
|sEVO(?G
xs@?0z
!JtRJf
n/+^B;+s
p;DO*"
{#W=aWpf?bI
X?T!^de*J
5#z&^2
x|=UE JZ5TH
mTxG%uIZ
wm/o5tn{`
.JXpndwpZ
5_U~|lb0W
g/Ql0'ccz
9uN/Sc
l&z,k%
dzWF`^>Kg\F
#/ze|f
u4RMysE
%C|oO|6p
i`rU=A
nP/C~<b
G/y[K0:a3R%>R>C5_
dvf1>8O
~`F 6*2
J$"`C+b
Bj#0y;@G9ek#
XZ4N@B
]S<|efc:tv#g
fHx@ra
]aOe~`*?
dk3`=)&CU
Mp#r/peuw5
xqJ@z/
>\v%/ xJ
\(W8QJFDyJj
r!t@ `_
i|kel9
}\.zN|)>fnoPwtfr
n/O}{!181
K|+$]P
CM6z`
:,dOuuE
Ib-]>2
6Jf@F'
gC-0dd \ezT
@)KbJ6
DR>XA~
o/fwQT
z*-`<9"^
$_@A/BMM
1_K=76a3qlmJ,<C^
?R-uxH
D?mhJ;n
V _<7xi
,8%PDl
ybIn~
e9=]!$3bj5bGI
f5FT;J
q |Ov;ps
&[~7N=
2*nNwF
8j#<qX
DZ% &I
]-geRxQ[I8$2]0
pxFGf[B
E _g\t$X
FHYY>3S/]R
ew/0J`
'L<V&7p1
`l2D` NMnD
!Rh]sJnW=Pp{
TXC551<Ax3#n5<5k{l][g
'(9g.si
E 1ZbrXL
6Fh@+]mCSQ[
)ZX(*)K
i2%(^5w n!
n#N 38A2
c^\t>\Q,:.
6yQn0&-\l
[|uxb3Q
}'uL3s0Dt h'@q
-T:;]}:WJ-}iq
2N3m:RpL
4*}o;z
Zk2GX8
GR&5Oq=aR~fj
G(p]xJf
G8r?k9F
o5+$|G |ap0
pH~*4`bY1
nLy1##
wMmI!s
UQW++U
[S(SJ^$SC}W
AIS@OoO
|4(seN
8d`a;5
CM/(<LE+
Vy qu#
Gy07YU
s(C5 E
)I`\{F<
TSM9\~
f;J=?K
(]L:E=3
d(BYA\S
4cn,Zc<
Q<9 eZ][
G9(({?h.Y
E;G?kj
?P+L#S
(_1X)(|1
T=3l0Wtf9
=`u9*
rS7.kUp
tVZ%\Z
<.c5q1
mDLVyZ
[E$G1IE2P
(lUUo!
e8~H~
Wb,W?n5
RQuT_qQJ
k)y*6B
R,|})mjwm
7z@rsG,7O
xyhueTy
Uo8~N^=66W< /~
:#c`GV
/%Nxkc0-
*H0/M8
7aM<V7B.r'
c/BD&4
q})5O#.w;W
|_-l2o
dA/{nXLw
b+yxEHV
wXA-]A]Wz&
]}`/)?a!
SLX7i=Kqo
O%?\FD
+uO=d:KK
LbZ /Q
Ei#FjuWU8AM~6q&
+2MErJe^
;y-k_,
u!akYl
NyzrQL~
7g[,_Z>8uG
JQ*OyS
Dfehf
lPgwzCbk
z][1U7r\JA
#h:N_! _{Jq
|t$XJfAD7
&=k81e
?NC:G=I
'=|1)7rC=g
HS(9l
=mxTuS
x)y_M7|B
fYPM}&M
@U &ZU
F({lgAv
<~4SzUx
u+`14@(F'
Af`/&0HCK~
>8!2W:Q
Oe" &{
>dDh6v~4
`tx[ \\6=t
L)ANaR
${JHlTvh-Y-Y$\
&yB$>]|)|-Z\A
hK}ZT6
%4c~Y6
EY,*8s}qOT71P
8e`B[jFF
jK tfMdOPO;Rh(h$,r
/YOn~^V|
v, &:*CQ
5M4YKv
-`0f96}
7Z;&0K
khw1bd& ZC
KaJ33kK<
/5 hP@]
&&]oZ
V;j] 1#5P5@INEV^
0Z?y@T8
A;`eM~: v
rbQo8VQ)
AQ;-\:pccOWmq
LuA>Y?X
YY?NZbg/
mW192/WZ2
1~4t,Q
sWC"_m8PPqR
Vi_*kM&
VEa+z)}f8
~_TA(]F
HV[j#q
q{#.0tbA
n_Afp _
#s[KW#3
nnr( @^P1
V8H4];ws^lg
J7zD=
(C^A+xFM
lB@YU&
zUbOv`iOe/%w3~
|C-NT`m3
B2#&<\
?aC/-F4nS
=Z`1iCM}> Zpbu
8p7[u*lsya.DE
Ld{`^g%U
IDwPesdwk$nO0
/oQ-`'j_*
P s+1;<d=4
h9=u}?^bHTA
~e1NvQ
tdYdbqO.
CwmX{>
0OLfKK-
}86J-zB0;",u,L{
Vsn2a>?
BZ1C4=)
A>6~8Z[
Yx4faH
#vk%4s
?06+'8
3" /k^
5@"Emv
h)]hS7
}L,BsCRri(
vLh l{xmRC
4^O !,N2
}j8vuY
=z}cl|
$o :!Q
m*!Vb:?I=
K<*I9~
/gogBQv^XK$
*7=/ny
)d|8FgLU<@P
!qSo3xg6L
nP*Cr-
#B^"]Vbyq
%h?aPkg
H3f:5!
*\^l1Z
i\Dj__
FP4PK6XnY
;R<sJzNb
GVHcZWb#
kYD7mpTlPk+$LK&
SHC["R6"~
cTuy<a:IsZ44!H
+-(:1.5r0/LE
#,2M"]
@CBrq,H6:3N\j
sVTj$_&U*m)>
Wh44vhX09uSSa6T
SSkkct[/
U REk?
%iEL.u"%
@URv>%
eRVM&z^
aYaDW{
}cq&E..Tto
XeOux"F
7( P;D;
}y%)_0rI
}XH[HF
jw^ZRe!_ou
C9~}<cF
OXTgh5
^6*dODDY
k51=A+IO^vb
6,2d`@
C/rI)X
9Rt`9r
p~#6y_G~9by "
S^A)y1-
P0,4oZz_
)#dO3;
R1jSp/Cf
ZwS{W`9\^
?'1M" ZK
yZng7=U2p
a>Hb7P %
er.=j B(B_(J
1VDG~`
zokri>ef&
`,#!_l
cEVA<|~C
RN+.I4,
wAP kDLL%{AK.[3ry`
`Dt58`8C$
9i^!|,N
P}ni%&Euc7Fh
;'pq}'Nf/vRy:7I
ga`p[>mC
J\! Ld(w
e2':4fV(wb]q ~f
0vz[QRa
#./tPsY-e0Q:^
5 :+_NuNNO
>>D]Tt 3_
t]707Q
3~ hK{meYM|
&2kLROx6rn"<
_^*42ANm
RC^F;)j"EkJ]
Nz0tC,71zIYF.f
Ziw{+x'
S_x9bn
A[7W7]Hl
c7m3@i
]35P=~7
3Ij@N?
d+1g3]
T$I PB\SO
9]$.~(
n#&O|&@al\
8ySa`"I('qb>Pkj4|+
$m)Cf;}t
AT\i/i*)
f!W_,1':
B39tq3MF
I$rzb'
@JtISt6
VZR3,#x@8h+1Tix
S8?lF$O(4h
K=|npyN[
<V_4Mo
;]ur\,$E
7z*\Sx
vq[)23d
nkThI~{s
_oE~%/u
(7<)r[#B
:UO)]'
;Bb}K+
}nTpB43$h3T
s2s)T2O+X
K{ANR'=@/1
T=!Ff9cw
&?}@O2Q}1K5
rg0L<T
8fP/rm{
4\i!]RIj-x"1
U0<P"0gNob
MR*VQ%tD{
V2yuq:o)A;(>;VB
C;zUX(
/t5``Ts]2? {:
b7C-+S
'y-"'46Tt.
o#Z~Jp
G +"S-,:
Z#IB9t
XHGv&X/
RTu[Is+
[$vXaKE
FYRtv;
PW7 :W&
]hb`-[RE
nRX>O/B)/2X5
gtj[^L
;7j_4:I
QxGgG>
Re)!D{M^v
vPq<~8\
lc|\f6
@6i|V4hAS)eF
@ h'|5
C{*x\8
xGi+mg
Tam?9I5"S
RB;F{|]Ilf
Ea89a#SJ
@MvRFh
}|/*mJQI=r4&x =]m_D0n*0Q%U`
6R!RRp(*}~Sl+C
^}Qy5`w
>:zkOo
^5?0B,:
wF:.BX" +
|W_N_lHh
{<-,b|uP
Ycr?}g
=F/%1{+
b$wpRs
mWCCf2
9@.36BN
d}`g>PSk,%TDrDz5
$:]8*a)hN6
.=_*-R7?
rW]Vg2p0
gNmfjdH
d8/)1~za
V`)a&xw%
6_Qi7$
n}}@\{[
2=SFPQ
Hr2,<J[
/43Rub
+~YPO%}i3
k}i?sSU{Sn
r;Y*%K
GLDmWq.eY
@)6-a?`mXMy
wj#~sW%
h])R,m%TT
e[_=1l
Do~;SbE;)Ci a+?
q>;~)>S
Y=dG.0
KF#%Hm>7E
I.X;8i
=)*'Td"
5=:6zugvbuBs#}
?aVo}{b&
db8zXL
:O)%XA
Jufp,/
N=?*dx
!'jTiyn
390o8@
P$_{q0
$dpUNu>
{/eg'f{eOxfQ6DKF/
v\,7'5
z.,M$R#
KwtHO.
Is R7z!Q}"(=
v;7Nv<-
1g1ncB]z
h~]Mv_LR?8U
@M"O*r
|{9BLW<5vm=3
rq!"%v-g)
nlD+--
mh#RLQs
[1]x+#
0C</&X!Ez[i|vGY
xR}bfzl
o9h4rJ
$%UEQ>/
BbQ/>zwE
6[,t1S
98pY^8/
Zv)NQ!_
H|&!-n~=
q^~4Xq
ziax CtN4&Ct)<
a(yo}3z
tE;Sk37J
bLIn$]P
Fe#Q]r65/[#<jdrrXXk$O
bP4*2DX$DKl\F
VL^DJr?)rU
Z!f**]=
I_AB:_
*TwLVM{!` fM,+H0(
\fW2T<b
h}U;reOG
%}84wA
}>\F%&.P
@jLN_r=an
pUHV+PL
0d31x{p
#T2.2A6
(}eoz\GMA/S;"
B^''+mj
`L6:vu
"o=SO|
owD%.h:1wm/v
xR%/%mAn
d] ig26XMUt
zY=ka|
xXO$Y`:9b~o%
*eod<yk,
.xIUBTaF?:
.~d-z6oLjIG;c
]J4Zh`N
U@24,
avWe2Po
pYR*D3pUh
h{E=Wy
~R&'Eixd
8q''Do,
|-OR|mYeFo2kChUB
q3daTqVekpM;p
5|[} /
UgM&!?`Em*
e'fcLqa
P$}M% m
w5gjh>XlS
azf+-
0ug&sgm-!`
.z|/a3XTm>V
Pl7Nx5l7gPR9
~U|yrDO
!nG:n'
=i:%5T
y46p=6>C97w_S46
rBVCyx
lz}F2CT22f
2#=V2
k~}w^JqzEc-/s
{]g^)cuR&$u
t,C.Aj
V^W(CGDk1c&
trX=:Y
?tJKP{g<>Hdz%d
B`1iGQ5S
$W`6%$
"b]^]Vjh
j}h:w2U
cAJ>({& 5
EG-di1}uX:JQR1a
bv ah@~7V
-iym^{Uq8($%C
"ENkq(k=4
R28]n4(
]y-y_eh?Yk
R[7=x8
u3AavB&anH7
5EK5$Qw*1k\`A
%*&Fsr'
$LB+4g4Q
;%ESTzz9"A %/
Th=?VD
89SC2h$ *w4
,wp6]-?L->P<4&MzIqzgFa
REmG%g@l
l]^H*q_P
b(@F/p
<}[Jl Un#`&Ub#
;%|>F?2Q$K
KX#D&J(
hM|NFA?E
z4J^WEwl:v;
h}rvPs
x)r)8/~b
YTwH+UKdUNJ8C?
'navYxQyK
P"i@co
ycY!|%K+/
s^b. =ay
N\e;Y&u<op
DEY:Lgd6*o
:FZqDQ
}[k)T5
|6LW[y<+TPL
+Fb7Fe
ieO|B5k
5 8if I
.hEY4urS}sN*`WR
> PA}>;
&)je&kQ
\Vz"c(-&m]
Q\qNWwG
{KQ6.@$
m'v'>\D
067|W>
}n\VuiD
#Xf}]Y
V)Tj[@
`GAg/+/hXKdws`f
J21 #l
_[`^1*fIb@-bd*Cs',z
YmWVqoNN
}{ s<y
p/t[&b
j nu5"BInx
p;Pu?(y?d6'P!
7>_|x/c=.<=h
2z'$6;iI3S
ylIy5;u{T
l;Y,qY
sz&d2s:0
Jmx:$1
vtK[FJ
.x$}v'0
t(:UZ(
0V9g3*[
Ru'I,f
I:6!H{
SnB{0/f
oA>vb\
h/+)@ $Z>2N
\?umUz
Q-[jYe~xC
d?[2s[
coqV\5
|Pl~-C$
B.E`oZp
R&<Ay z &
)AC6#Dh#tTXO3;S
eN(]I&0
ugqU<m
bz]<7'Vw
E {P+yS
AU<fFjg_
C"TKUkYF$_
=q%9dVTe&guNpJU@o
S*EUXR
oRXZI"U;Uvm!
cVjh72
~ w&OBEc
HaRG"[T
z-[i*(P[v.
Fy&zN4ru;~GO[
mmkMFIROyt
ToQ&}.
:'cJo|
WT/=aSf
?Y;LF5OZ~
J~lo9%
1cp7-k7p:NB@^
TqxsE}FWI
-LkK3A2
yhw.1V
HC\7ycd
-U?!g9M#'
SIlBXYA[r
/n4@vy"eg 3
n3Lyjrs~;evX
,r0Navv{i=b
hym()K4
]a@k*`(
],dsc]n
o&yUJ16|
*'tF'>*2s(
p~Ek tP
lWwp^bAGr
7=uF;oF3bk
QNUW6uX
>@1!ZFy7
n|z"]t
gqldgp
v]czuSMyGJEZ /\
Y<RjbNwcGDE'
e|=$n~;*5t#
PxB:3Ll
`Y!81n*Me-yxI
IR-2,:Xw/
CC #&>;J
T_-Mm71t"'^g`
h 0V/n
\\E6nk!R
8@|_j+
^9T?M(D]{gF
I|Txsj[qw|7
x++RYq
C\ssn|
Qv'jw("3^#
M<(Gdia
qO{O;j<SPA
[h&>:p
^X-Fxnj
S^+yYfbLf2$H
q%!~V&0
>jzY-DdgP
&`Ede3 b
y29LI0
2&3}W_?
VTnRwl
aE_x\gf
1f;e&+V{rZ<
ZqlILqX&w7 r,C
NUjVY<"gg
~#To1*
!/F-Pf
;~ oC=x}X
FT#u}F6
7/];l
%a^X%!DCa
QYF:'L-q1
`Yn6f4;h'I}
.*\)Nj[
Jr,yK )Ro
ipA<?,C}Vx
_=ZJ9^0S#?-1 Uv<#~Ato)F={
GU}T>)v^c#
[Y>,E*
'?Z?Fe
b`8={
E?59 z7N0r5
)$?3bM#
1:6J7Z wDm
PvUuyVs
b8"i+y[
ip:O!Lj
;P}~ m
3}K;=c
US^yK@
8qg.<`C_n
6_}{{sY
KdrX`YN
/fKm~Q
xq=w|s9F0B
oFt -(
M53nXd<
Lc$~6pm6O4zV{T`S$)9Lm9
Wx?7\-]
w<k#yz
9>TGW#l
bCYuWBBz
AuJ<8Z
Wm4f|BV/P
Jj =E`
!=@)!3
;'$GYB
6Rr79uL_6K;p"OB
b43XQh+|6'}nyz7
vUh"X{?^LAJiy
-JYH*L
#HxS|j(Pb3d@dW
IRLS%RY
iQl|s\
U@;&q_1s
+b[&<:$O @7
_UKc7
[38:mr%}t
)BdV* x!
rpE)YT'
.QYv&;
b[3!>'
GYC}V8V?(v
6w21:`7=
"Q,yN5
&fACcF*n$
9:jYCjM
bvM"#K;
4Jy\kM;)
/@W;`<&wg>
L7(&o6M
ck"TM2mZH.
5fG@;%BgFi.u\
M7gw!E5:n*
^=JwRR
DJgTs}
FLU7lw;+Yf
ZC%f`Pnko
]:>3B+<
RyvNzLd=
{hc^1."
";=PH9
kK!>L?
rOb-r,yE
2@Ft#JzV ?lT
+E'L-
Mt8-P)Cm^AhX
C|K)-L f
L4"-:rSL
gMoH@Dp
<"wJj.
8g ])'
:RTPYR}]`lRP}
Z,,}g%
0v!fm$_lacze#
?'1;Q1l4
&f<[,N)GFd
Od\d/t6MPM}
nB`uO{
h a&KpL\
_FGOU8\
xL}+Fx<US
p]Y4cbNZ
~h$Ogss
$.*-kY
"k6TK7!u
],xeJ2R~jQ
\iHr_,9pxv6b8q
9{u'^i
[d>ugF
o.>'d>l
&R)\PtjGV
cz&N(.l0
^u2:iC(g8o
.b<5r0*yHo|
"H{yiHT2
[e(}Ib
3DGK4=
F`NDzs4?
hk,&%p8
guP"[Q)~@6~
}>a^b}
h\m- u9
2D}d&rd
k}wT08
&+(gb=
}B0 "7NJ'
Qi/Lp
D+ !RYf Q\wWH[1
*P|gP%
k) c`q
9Ig5(o(
=ttxj68OxK
fhPs#i3+eX
wHYxf0J
5O'Oe4\
hQKXUJ
I+}:;`p[>5 )
2T0V<\t
(6w.w~D
MKz5sf/_(k.
9t+BY VBabf&n9
K*{w;FB-U\V(-#0`
`J81*]l
tN>WW0
z4"/ P>?s
ah1CP(
uH(0=U
fajO _a`8W`@x&vQN
73Ytx3ZH
)bC~1*[Md!
Rs(8*?;z
IO#zcY
Gp@ScOd:q
`]#2H.
c7\6{S5
g{l-XVO}z
bomtNL~
rGH9<,"
A^HS3EbHt
Pqr6zFdk
PSy~uOM
v<b8c9g
J),qo^=)
nof%w`Y
eV.YlFM,
'Ns 18
o0!R F
qKc4u,!
oNE9PGDw
Q.(qwqvh.w
vUi1p6Nltx
G &z1"
O*)(szI
:F<?5"!n`j
j__fS"uB
MIP \JF
e'[J!pU{
w~82^U'!!
_i[b2>H;
C9zsn1
QdZQa>buiB
kX.7XZROL9FQ0gRK
Z*<?8Q~
ZsV%KO
8=?!Gm
Rh>,sXQ
U<<bI ce`/
u9s^(SiO2l1d
.f4x2l4tE
P{9|F,#&\O d{
,XCFFJjdOt6Fg{'n
bf\oAE
X\,OWL<spuu
d/t<=(
'S66R8f
k?<v!%+^
g])};q12
)p[yUm}
G!PGw_}
,6P .)!H NR6
LF)Iy"J
"7NK,,
9:!|crO
P<%lY1EY
LT3f8b5
T2l@/nZZ
-3"))%JruL
s/PaQu0
w@Z_fFS
N8[l#Y,[(Z
c1f:JfDF~#5
z0T7D8D~499
r{6$nz7
S(3AUN
Zvb|9y)+d}:
!J'G7U.Ig
y$R;3A4
W\{KjA
L.(X0vf
=Vugelavome jucalowoxu wuye. Lepenadaraju hojoji nupucayiruredo pofoxo. Banijodi rivufemaxusu nutavecehenu be puhuguwujejixa. Fupacelunuyifu nogacebo racoyenusaluwa ho. Zepumojuho gorunufigu natoduhokejeka yi lakadolipowe. Lilebaxupewu rixazo nanotalefebuhaReriveke ka risaru. Ginilevu. Subonaxiwi. Yovizicese hi zujizayo. Nizinuki sihinitu fatotovohe wimipuzigovujo. Zilu wibadu yo xitijigudesuha nu. Diwutogogi difegoribiwixe lozopo. Vuze. Vo. Kubomunavepoxa rozuhi fu rajodacira. Rici vuposamizezaho masowakuzuka. Kupi kiku. Mujagubola gijona vajigoyu. Poridukafera hodomafe miro cidarejaxulada. Wimiduvi tanamirogifu nohabuzono vi. Tekicoleseni. Mu pezumoti bopinece
Vehe. Bajigivihazifu yacizogizanu gipayacucipi. Wetewa vasalo. Gejuxosi dijoharuxayo gorayoci. Ceneho zogole. Hejosazobilono ziwovazefabo. Favisefuno tudovozaweso jimetasu jine. Fegecipanolu yifo. Zoberifezi dawazugeni yokuluyesepu hezimosafo. Didusepejacuda gemuvafa lomiseyicuwati tako neyepi. Jo sudotakupove. Temulavi fiposo xohilujusucufu susaboheni hide. Yadize rulevi. Yahude jitafe pijiwageku. Wizumedelo cifucavoxilitu. Va. Bujupexoyi xuhapi. Kosihemukuxabi kugi kijabesogu. Tuyozu konipihowuso cegutosi xuxacojofodago luhitokiho. Nizezi. Geso jevilohamocu goro zotahujami. Jurukukiyi pucaje tutolo rubewomapebo. Kazumigesa kukixoye fe puwa hu. Je cugetutuni vileralu. Wafujo joxarukulu razapuneku. Cedolapedu bojirSalasu. Yidofedapobu wonayaru tape. Rarupixo yowahulepo. Kikuwucetuma gikezacacudicu. Zodanecolola rumalivu. ZawGuluyodawohura curemaxojose. Wuma jamepo. Zoteramexizo simake luxepuvemira zeleri nekabati. Giso jerojezotolupa sisu limurimejozu zuyuwako. Capavayi firebi guheyiheme sujukeyu. Pocunucipo. Jafiyayama. Pinonebaza. Hinojago hoxo gamekixitunodo lekoxosizeve. Kececu dixetixa. Kehe rese yetaso. Horabenusere vatake nevagumegeda gupegale heru. Wago bukiredexu
yvfu~~
~~~~~~~
dn~~`~
l~~q~~~
~w~i~j
~~v~~w
~~x~|~~
~ud~i~
~nxdz~~
~~~~~~~
~qrnqry
r~~~v~
~kod~~
o~jq~~
{t{~~}
x~wv~~~
~~~~~~~~
~~~~~~
gzZ~~~
~_[~Qcz
r~q}m^
_p|^}W}
~~~~~~~
~~~m~~~
~R~~~~~
~~~~~~~~
~~~~r~
080|000071\1a11/2F22223Q444L6
7"737J7Z77
8f8{88::<<
=\=p=w=~=====
>B>P>^>l>
%1+111U2]222.3w333336677'8/8~88
9Z999999D:K:::$;;
=$=2=K=O>>K???
0/000q2
444i5555+686L6s666666
777p88G999999
:':0::::c;;;;;;
<A<K<a<<<<<<
=,=R=]=y=========
1e111112
3N3s33444444444
5-5=5M5U5n555Y6f6666
7<7T7[7c7h7l7p77777777777
8J8P8T8X8\88888888
9G9y99999999999999S:Y:k::\;b;g;o;
;;;;;;;;
<"<4<<<G<<<<<a=}===>
1'111\1d111111122
3#3(3,303Y3
3333333333
444444444
595@5D5H5L5P5T5X5\555555
6E66V7n7s799I:|::
;J;Q;Y;;;;;
<*<<<<
?g?m??????
P00$1!2244P5555l66668
999999
:::::S;[;p;{;;
<<k===^>j>>>\?h???????
70@0L00222222222
3!3(3/373?3G3S3\3a3g3q3z3333333333@5E5W5c555555
6$6*636?6E6M6S6_6e6r6|666666)7/7Y7_7e7{77738V8`88888
9 9%9,929:9A9F9N9W9c9h9m9s9w9}9999999999999999
:):/:G:c:::a;n;t;;;;;;;
<<<<<<<<<<
=%=?=J=R=b=h=y=====
>5>>>>C?[?e????????
#0@000*272@22222
3 3*3;3F3
5 5%5*505555526>6X6~66666
7V7`77777
8'8U8x8~8888888R9,:4:L:g::::
;$;0;Y;a;s;;e<o<|<<<<<
=/==7>>P????
;000&11
22222!343
89<<<<
K0V0\00000011f====
>,>c>??????
B0T0f0x00000000
1T13:4K44444444
5"565<5E5X5|55
606666]8n8888888
9 9)9B9L9_9999
:r:::G;f;;;;
<'</<7<N<g<<<<<<<<<
>>>>&?:?N???
{000223333"4f4444$575f5u5b:
:::::::::::::::::::::
; ;$;(;O=U=a===>>>>>>>>1?6?p?u?|??????
000011
333333333333
4 4+40494C4N4444666[7q7
8888u999s;<>
00111111
2'212H2T2Y2i2w22222222#3>3U33
5A5`5{555555555
6,616;6V6[6l6666666 7)7<<<<<<<<<<<<<<
=B==='>A>J>R>r>>5?G????
A222=88::::G;;;;;;
<7<@<I<_<<<<<<<<<<<<
=M=Q=U=Y=]=a=e=i=m=q=u=y=}====
?=?E?h??
40L0`0p0|00
1)1111111
2d3l3333`4
5|5;6<7L7]7e7u777n8|:>?
0+0A0I001/2Y22
385J5\55555
797788i9J:::;;;9<P<<
3090000111^2
525~8888888888888y9999 :C:
8-8|888
9'9M9s99993:=:I:U:a:m:y::::::::::::::::
p1t1x1|111111111111111111111
2(2,2024282<2@2L2P2T2X2\2`2d222222222222222222222222
333333333333333333<<
5555555555555
6$6,646<6D6::
X3`3h3p3x33333333333333333
4 4(40484@4H4P4X4`4h4p4x44444444444444444
5 5(50585@5H5P5X5`5h5p5x55555555555555555
6;;;;;;
< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\<`<d<h<l<p<t<x<|<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
= =$=(=,=0=4=8=<=@=D=H=L=P=T=X=\=`=d=h=>>
? ?$?(?,?0?4?8?<?@?D?H?L?P?T?X?\?`?d?h?l?p?t?x?|?????????????????????????????
0 0$0(0,0004080<0@0D0H0L0X0\0`0d0h0l0p0t0x0|0000000000000000000000
|;;;;;;;;;;;;;;
<0<@<D<T<X<\<d<|<<<<<<<<<<<<<<
=(=,=<=@=D=L=d=t=x==============
>(>,><>@>D>L>d>t>x>>>>>>>>>>>>
? ?$?(?,?4?L?\?`?p?t?x?|????????????
0$0<0L0P0T0\0t0000000000000
1,1014181<1@1H1`1p1t11111111111111
2,202@2D2L2d2t2x2222222222222222222
3 30343D3H3L3T3l3|3333333333333333
4 4$4,4D4T4X4h4l4p4t4x4444444444
545D5H5X5\5`5d5l555555555555
6 60646D6H6L6T6l6|6666
7 7@7H7T7t777777777777777
8 8@8`8l88888888
909P9p9x9|9999999
:4:8:T:X:`:h:p:t:|:::::::
;0;P;l;p;x;;;;;;;;;;;;
< <(<<<D<H<P<X<`<t<|<<<<<<<<<<<<<<
=X=h=|======
> >4>H>T>\>t>>>>>>>
?,?8?X?h?x?????
0$0P0|0000000000
1,11P3T3X3333333333333333333
4 4$4(4,4044484<4@4D4H4L4P4T4X4\4`4p4t4x4|444444444444444444444444444444444
5x555555555555
6064686<6@6D6H6L6P6T6X6\6`6d6h6l6p6t6x6|666666666666666666666666666
7(7,7074787<7@7D7H7<============
>,>P>>>4?t??
1@1x11111
202@2\222222222222
3$3,343<3D3L3T3\3d3l3t3|333
OTU7MzMx
( ( ( ( ( H
h ( ( ( ( H
H
A K E R N E L 3 2 . D L L
m s c o r e e . d l l
r u n t i m e e r r o r
T L O S S e r r o r
S I N G e r r o r
D O M A I N e r r o r
- A t t e m p t t o u s e M S I L c o d e f r o m t h i s a s s e m b l y d u r i n g n a t i v e c o d e i n i t i a l i z a t i o n
T h i s i n d i c a t e s a b u g i n y o u r a p p l i c a t i o n . I t i s m o s t l i k e l y t h e r e s u l t o f c a l l i n g a n M S I L - c o m p i l e d ( / c l r ) f u n c t i o n f r o m a n a t i v e c o n s t r u c t o r o r f r o m D l l M a i n .
- n o t e n o u g h s p a c e f o r l o c a l e i n f o r m a t i o n
- A t t e m p t t o i n i t i a l i z e t h e C R T m o r e t h a n o n c e .
T h i s i n d i c a t e s a b u g i n y o u r a p p l i c a t i o n .
- C R T n o t i n i t i a l i z e d
- u n a b l e t o i n i t i a l i z e h e a p
- n o t e n o u g h s p a c e f o r l o w i o i n i t i a l i z a t i o n
- n o t e n o u g h s p a c e f o r s t d i o i n i t i a l i z a t i o n
- p u r e v i r t u a l f u n c t i o n c a l l
- n o t e n o u g h s p a c e f o r _ o n e x i t / a t e x i t t a b l e
- u n a b l e t o o p e n c o n s o l e d e v i c e
- u n e x p e c t e d h e a p e r r o r
- u n e x p e c t e d m u l t i t h r e a d l o c k e r r o r
- n o t e n o u g h s p a c e f o r t h r e a d d a t a
- a b o r t ( ) h a s b e e n c a l l e d
- n o t e n o u g h s p a c e f o r e n v i r o n m e n t
- n o t e n o u g h s p a c e f o r a r g u m e n t s
- f l o a t i n g p o i n t s u p p o r t n o t l o a d e d
A M i c r o s o f t V i s u a l C + + R u n t i m e L i b r a r y
< p r o g r a m n a m e u n k n o w n >
R u n t i m e E r r o r !
P r o g r a m :
H H : m m : s s
d d d d , M M M M d d , y y y y
M M / d d / y y
D e c e m b e r
N o v e m b e r
O c t o b e r
S e p t e m b e r
A u g u s t
F e b r u a r y
J a n u a r y
S a t u r d a y
F r i d a y
T h u r s d a y
W e d n e s d a y
T u e s d a y
M o n d a y
S u n d a y
W U S E R 3 2 . D L L
t i p u c a x e g e c a v a p u b a
k e r n e l 3 2 . d l l
A A A A A A A A
A A A A A A A A
A A A A A A A A A A
A A A A A A A A A
E Q K B V W F O S E R O G A T I D I F E V I C E Z A K O W U K E W O F E J A G O R E K O S O R E C U S O T U B A T A R I K I Y A H A V I X U
J E D A R A
Y I R U D I P U F O P I C I V E H O P O W E G I G O
D i a l o g
M S S h e l l D l g
C a n c e l
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 8 0 9 0 4 b 0
P r o d u c t V e r s i o n
1 0 . 1 . 1 0 . 1 1
V a r F i l e I n f o
T r a n s l a t i o n
Process Tree
-
0a240c7641f83bf605b2c0572c8cc7e7e4871f876815b0f244cba9f2f857b408.exe (2060)
"C:\Users\Administrator\AppData\Local\Temp\0a240c7641f83bf605b2c0572c8cc7e7e4871f876815b0f244cba9f2f857b408.exe"
- nslookup.exe (1496) nslookup ransomware.bit ns2.wowservers.ru
- nslookup.exe (3036) nslookup ransomware.bit ns1.wowservers.ru
- nslookup.exe (1912) nslookup carder.bit ns1.wowservers.ru
- nslookup.exe (2916) nslookup ransomware.bit ns1.wowservers.ru
- nslookup.exe (2508) nslookup ransomware.bit ns2.wowservers.ru
- nslookup.exe (2020) nslookup carder.bit ns2.wowservers.ru
- nslookup.exe (2012) nslookup carder.bit ns1.wowservers.ru
- nslookup.exe (2484) nslookup carder.bit ns2.wowservers.ru
- nslookup.exe (2380) nslookup carder.bit ns1.wowservers.ru
0a240c7641f83bf605b2c0572c8cc7e7e4871f876815b0f244cba9f2f857b408.exe, PID: 2060, Parent PID: 2996
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 2012, Parent PID: 2060
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 1496, Parent PID: 2060
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 2484, Parent PID: 2060
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 3036, Parent PID: 2060
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 1912, Parent PID: 2060
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 2508, Parent PID: 2060
default registry file network process services synchronisation iexplore office pdf
nslookup.exe, PID: 2020, Parent PID: 2060
default registry file network process services synchronisation iexplore office pdf
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
| 107.178.223.183 |
DNS
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 57665 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 51758 | 114.114.114.114 | 53 |
| 192.168.56.101 | 51758 | 8.8.8.8 | 53 |
| 192.168.56.101 | 52215 | 8.8.8.8 | 53 |
| 192.168.56.101 | 52215 | 114.114.114.114 | 53 |
| 192.168.56.101 | 52216 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 52217 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 52218 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 52219 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 52220 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62361 | 114.114.114.114 | 53 |
| 192.168.56.101 | 62362 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62363 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62364 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62365 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62366 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62367 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62368 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62369 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62370 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62371 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62372 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62373 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62374 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62375 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62376 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62377 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62378 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62379 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62380 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62381 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62382 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62383 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62384 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62385 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62386 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62387 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62388 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62389 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62390 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62391 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62392 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62393 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62394 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62395 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62396 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62397 | 107.178.223.183 ns2.wowservers.ru | 53 |
| 192.168.56.101 | 62398 | 107.178.223.183 ns2.wowservers.ru | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | ef7fb89c7a90b21e_bantpj.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Roaming\Microsoft\bantpj.exe |
| Size | 254.5KB |
| Processes | 2060 (0a240c7641f83bf605b2c0572c8cc7e7e4871f876815b0f244cba9f2f857b408.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | 9fe80aa2b0244df6ad36a22097787f13 |
| SHA1 | e690ab2d8366653d2b26cb0e4ca977aa9ad628c9 |
| SHA256 | ef7fb89c7a90b21e1ddde1f20eb1658a41dfa00985e72bcf4e81b7cd600e4411 |
| CRC32 | FF018208 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.