1.9
低危
64 个模型检测该样本为恶意！
重新分析
更多

0ae010034d3b6a1de31da8d8b99b7d4d670b5faff770ee1ddaf54399ceeb358b

0ae010034d3b6a1de31da8d8b99b7d4d670b5faff770ee1ddaf54399ceeb358b.exe

分析耗时

133s

最近分析

379天前

文件大小

596.7KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN WORM MIRA
鹰眼引擎
DACN 0.14
FACILE 1.00
IMCLNet 0.77
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Malware-gen 20200415 18.4.3895.0
Baidu Win32.Worm.Mira.c 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Kingsoft None 20200417 2013.8.14.323
McAfee W32/Worm-GAT!CE075C5E9DFA 20200417 6.0.6.653
Tencent Worm.Win32.Mira.a 20200417 1.0.0.1
静态指标
检查系统中的内存量，这可以用于检测可用内存较少的虚拟机 (1 个事件)
Time & API Arguments Status Return Repeated
1727545328.546375
GlobalMemoryStatusEx
success 1 0
行为判定
动态指标
在文件系统上创建可执行文件 (24 个事件)
file c:\Python27 .exe
file c:\Program Files .exe
file c:\install.exe .exe
file c:\Windows .exe
file c:\globdata.ini .exe
file c:\Recovery .exe
file c:\install.ini .exe
file c:\eula.2052.txt .exe
file c:\System Volume Information .exe
file c:\Users .exe
file c:\PerfLogs .exe
file c:\$Recycle.Bin .exe
file c:\Documents and Settings .exe
file c:\VC_RED.MSI .exe
file c:\360Downloads .exe
file c:\xrmmmhqyvr .exe
file C:\ProgramData\gprpl.exe
file c:\gcoxh .exe
file c:\vcredist.bmp .exe
file c:\install.res.2052.dll .exe
file c:\Program Files (x86) .exe
file c:\VC_RED.cab .exe
file c:\ProgramData .exe
file c:\pagefile.sys .exe
创建隐藏或系统文件 (25 个事件)
Time & API Arguments Status Return Repeated
1727545328.640375
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\ProgramData\gprpl.exe
filepath_r: C:\ProgramData\gprpl.exe
success 1 0
1727545331.702375
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\ProgramData\Saaaalamm\Mira.h
filepath_r: C:\ProgramData\Saaaalamm\Mira.h
success 1 0
1727545332.84325
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\$Recycle.Bin
filepath_r: c:\$Recycle.Bin
success 1 0
1727545335.09325
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\360Downloads
filepath_r: c:\360Downloads
success 1 0
1727545337.29625
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\Documents and Settings
filepath_r: c:\Documents and Settings
success 1 0
1727545339.53125
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\eula.2052.txt
filepath_r: c:\eula.2052.txt
success 1 0
1727545341.82725
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\gcoxh
filepath_r: c:\gcoxh
success 1 0
1727545343.98425
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\globdata.ini
filepath_r: c:\globdata.ini
success 1 0
1727545346.17125
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\install.exe
filepath_r: c:\install.exe
success 1 0
1727545348.15625
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\install.ini
filepath_r: c:\install.ini
success 1 0
1727545350.39025
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\install.res.2052.dll
filepath_r: c:\install.res.2052.dll
success 1 0
1727545352.59325
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\pagefile.sys
filepath_r: c:\pagefile.sys
failed 0 0
1727545354.87425
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\PerfLogs
filepath_r: c:\PerfLogs
success 1 0
1727545357.14025
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\Program Files
filepath_r: c:\Program Files
success 1 0
1727545359.35925
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\Program Files (x86)
filepath_r: c:\Program Files (x86)
success 1 0
1727545361.56225
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\ProgramData
filepath_r: c:\ProgramData
success 1 0
1727545363.65625
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\Python27
filepath_r: c:\Python27
success 1 0
1727545365.74925
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\Recovery
filepath_r: c:\Recovery
success 1 0
1727545367.95225
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\System Volume Information
filepath_r: c:\System Volume Information
failed 0 0
1727545370.31225
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\Users
filepath_r: c:\Users
success 1 0
1727545372.42125
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\vcredist.bmp
filepath_r: c:\vcredist.bmp
success 1 0
1727545374.60925
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\VC_RED.cab
filepath_r: c:\VC_RED.cab
success 1 0
1727545376.68725
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\VC_RED.MSI
filepath_r: c:\VC_RED.MSI
success 1 0
1727545379.07725
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\Windows
filepath_r: c:\Windows
success 1 0
1727545381.23425
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\xrmmmhqyvr
filepath_r: c:\xrmmmhqyvr
success 1 0
投放一个二进制文件并执行它 (1 个事件)
file C:\ProgramData\gprpl.exe
网络通信
与未执行 DNS 查询的主机进行通信 (2 个事件)
host 195.29.173.139
host 114.114.114.114
在 Windows 启动时自我安装以实现自动运行 (1 个事件)
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Microsoftﾮ Windowsﾮ Operating System reg_value C:\ProgramData\gprpl.exe
文件已被 VirusTotal 上 64 个反病毒引擎识别为恶意 (50 out of 64 个事件)
ALYac Trojan.Agent.CCPK
APEX Malicious
AVG Win32:Malware-gen
Acronis suspicious
Ad-Aware Trojan.Agent.CCPK
AhnLab-V3 Trojan/Win32.Agent.R111396
Antiy-AVL Trojan/Win32.Agent.icgh
Arcabit Trojan.Agent.CCPK
Avast Win32:Malware-gen
Avira TR/Zusy.BQ
Baidu Win32.Worm.Mira.c
BitDefender Trojan.Agent.CCPK
BitDefenderTheta AI:Packer.B35C02071C
Bkav W32.FamVT.MiraVM.Worm
CAT-QuickHeal Trojan.Beaugrit.A6
CMC Trojan.Win32.Agent!O
ClamAV Win.Trojan.Agent-1388655
Comodo Worm.Win32.Mira.AA@59ticr
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.e9dfa9
Cylance Unsafe
Cyren W32/Trojan.YVBK-2015
DrWeb Win32.HLLO.Siggen.5
ESET-NOD32 Win32/Mira.A
Emsisoft Trojan.Agent.CCPK (B)
Endgame malicious (high confidence)
F-Prot W32/Trojan2.PUUV
F-Secure Trojan.TR/Zusy.BQ
FireEye Generic.mg.ce075c5e9dfa9990
Fortinet W32/Mira.9C5!tr
GData Win32.Worm.Mira.D
Ikarus Trojan.Minggy
Invincea heuristic
Jiangmin Trojan/Agent.iezf
K7AntiVirus Trojan ( 0040f8a71 )
K7GW Trojan ( 004993691 )
Kaspersky Trojan.Win32.Agent.icgh
MAX malware (ai score=87)
Malwarebytes Worm.Mira
MaxSecure Trojan.Agent.icgh
McAfee W32/Worm-GAT!CE075C5E9DFA
McAfee-GW-Edition BehavesLike.Win32.Worm.hh
MicroWorld-eScan Trojan.Agent.CCPK
Microsoft Worm:Win32/Mira!rfn
NANO-Antivirus Trojan.Win32.Zusy.ethqlz
Panda W32/Milam.A.worm
Qihoo-360 Worm.Win32.Mira.A
Rising Worm.Mira!1.A270 (RDMK:cmRtazr+14yemqzI91wrwNHRCQGd)
SUPERAntiSpyware Trojan.Agent/Gen-Mira
SentinelOne DFI - Malicious PE
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2014-02-27 14:41:59

PE Imphash

b81db2e58d7c6d491ab09e9b935feb54

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0003be78 0x0003c000 6.080451775497244
.data 0x0003d000 0x00000260 0x00000400 0.705049269986258
.rdata 0x0003e000 0x000024a8 0x00002600 5.008530245268908
.bss 0x00041000 0x00004890 0x00000000 0.0
.idata 0x00046000 0x000008a4 0x00000a00 3.8630905257398895
.rsrc 0x00047000 0x000067b8 0x00006800 4.732695681377311

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x0004cfec 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0004cfec 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0004cfec 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0004cfec 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0004cfec 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0004cfec 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0004cfec 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0004cfec 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0004cfec 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_GROUP_ICON 0x0004d454 0x00000084 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_VERSION 0x0004d4d8 0x000002e0 LANG_ENGLISH SUBLANG_ENGLISH_US None

Imports

Library KERNEL32.DLL:
• 0x4461b8 AddAtomA
• 0x4461bc CreateDirectoryA
• 0x4461c0 CreateProcessA
• 0x4461c4 CreateSemaphoreA
• 0x4461c8 DeleteFileA
• 0x4461cc ExitProcess
• 0x4461d0 FindAtomA
• 0x4461d4 GetAtomNameA
• 0x4461d8 GetCommandLineA
• 0x4461dc GetLastError
• 0x4461e0 GetModuleFileNameA
• 0x4461e4 GetModuleHandleA
• 0x4461e8 GetStartupInfoA
• 0x4461f4 ReleaseSemaphore
• 0x4461f8 SetFileAttributesA
• 0x4461fc SetLastError
• 0x446204 Sleep
• 0x446208 TlsAlloc
• 0x44620c TlsFree
• 0x446210 TlsGetValue
• 0x446214 TlsSetValue
• 0x446218 WaitForSingleObject
Library msvcrt.dll:
• 0x44623c __getmainargs
• 0x446240 __mb_cur_max
• 0x446244 __p__environ
• 0x446248 __p__fmode
• 0x44624c __set_app_type
• 0x446250 _assert
• 0x446254 _cexit
• 0x446258 _ctype
• 0x44625c _errno
• 0x446260 _fstati64
• 0x446264 _iob
• 0x446268 _isctype
• 0x44626c _lseeki64
• 0x446270 _onexit
• 0x446274 _pctype
• 0x446278 _setmode
• 0x44627c _strnicmp
• 0x446280 _vsnprintf
• 0x446284 abort
• 0x446288 atexit
• 0x44628c fclose
• 0x446290 fflush
• 0x446294 fopen
• 0x446298 fprintf
• 0x44629c free
• 0x4462a0 localeconv
• 0x4462a4 malloc
• 0x4462a8 memchr
• 0x4462ac memcpy
• 0x4462b0 memmove
• 0x4462b4 memset
• 0x4462b8 rand
• 0x4462bc setlocale
• 0x4462c0 setvbuf
• 0x4462c4 signal
• 0x4462c8 srand
• 0x4462cc strcat
• 0x4462d0 strcmp
• 0x4462d4 strcoll
• 0x4462d8 strcpy
• 0x4462dc strftime
• 0x4462e0 strlen
• 0x4462e4 strtod
• 0x4462e8 strxfrm
• 0x4462ec time
Library msvcrt.dll:
• 0x446224 _fdopen
• 0x446228 _read
• 0x44622c _strdup
• 0x446230 _write
Library SHELL32.DLL:
• 0x4462f8 SHGetFolderPathA
• 0x4462fc ShellExecuteA
L!This program cannot be run in DOS mode.
`.data
.rdata
.idata
E;Es9}
<t6p t<~@tO
x7EZ[^_]
UW1V1S
eEEE$@
++CCUNG
pP EtB(dB$
R \tp@$
hUhU`hu
llU6hU(Et
E!t#XtEXM~t
$]u}E$@
UpPl1|pl
;u ]]$}}
4$Yt8M
]1u}];] tIF
UWVS|U$E
E|[^_]
1|[^_]
UWVSL}
$DtbEN
UEXEE]u}E
++C B4CUNGB
t-S4C0
UEhEE]u}E
E]u}]E
UEhEE]u}E
tB1u2=C
UEXEE]u}E
80S4C0
t(S4C0
x9JtD|IS
]uEEEE
]uEEEE
]uEEEE
UUWVSLE
$UE@M@
$IMEQh$9t
$YMEQh$9t
$iMEQh$9t
]u}EEUE
Pht%$9t
UE]PhXdE
$]u}E$@
|u9EEP@
$]u}E$@
tuHxEE
$]u}E$@
tuHxEE
$]u}E$@
tuHxEE
$]u}E$@
tuHxEE
$]u}E$@
tuHxEE
$]u}E$@
tuHxEE
$]u}E$@
tuHxEE
$]u}E$@
tuHxEE
$]u}E$@
tuHxEE
UUWVS\E
EuSEUE9B
Et1@t@
UEXEE]
Et1@t@
UUWVS\E
EEUEn@
EuSEUE9B
UMWVSlE
UMWVSlE
UUWVS|E
@;Er]E[
@;ErEU]H
]xEEEt
$u}E$@
oUUWVSlUE
UUWVSlUE
9t1]u}]
[^_]UU
[^_]UXeE
$B4$Z]u]U
UEXEE]u}E
Eu!PRD
u9Et4+_
9}]t7q^
8"t-EE
$u}E$@
$u}E$@
$u}E$@
]uEEEE
]uEEEE
$u}E$@
$u}E$@
$u}E$@
]uEEEE
]uEEEE
$u}E$@
$u}E$@
$u}E$@
]uEEEE
]uEEEE
]uEEEE
]uEEEE
]uEEEE
]uEEEE
]uEEEE
]uEEEE
]uEEEE
]uEEEE
]uEEEE
e[^_]EAAAA
uEAAAAEAAAAE
EAAAAEAAAAE
EAAAAEAAAAE
EAAAAE
S C0C,
t(C,1D$
S0x]u]
t3[4u$&
t$B0x=B0uVB(
z(]u}]
H0x4P0uMX(]
[^_]o2
UWVS,PXD
]t"x0xFp0u X(EP J
UWVS,@
tLEtt$
tEp0x^X0uw@(UEEE
]tAH0xFP0u
X(EP J
X(EP J
H0us@(EUE
x0uaX(EP J
<$&]u}]
taH0xkP0uu@(
e[^_]PXD
H0yAPXD
EUM]Uu
M9MvuMEU]Eu}U]
EuaE9E
UEEEU]u}]
Mu,9vZ
1E]E}Uu]
W11V1S
tplhl$
D$'\ t&
ME1UfE
:|,1\$ \$0
t$$t$4|$(|$
\$ t$$|$(,
D$,L$(D$
T$$D$ L$
T$DfD$B
\$0fD$0
|T f|T`B
UWVS|$
t$@\$@L$B
;f9yD$
|[^_]fD$
\$ fD$
~t$`1L$@
tfxJ\$
[^_]uUt$
~ML$$t$$
~;D$$p
~PL$$q
[^_]Ov
1D[^_]
|$lOD$
~D[^_]
D[^_]fD$&
tH1|$(M
Ky\$\u=L$
|$\T$`
UWVSd\$xl$|
2L$:zQ
1d[^_]
1D$8L$
HyfD$8xfD$
UWVSLt$`l$d
:L$"ZQ
L[^_]1
HyT$ \$
LS[^_]
Iy%LbD
t,K9w4
0^t&K9w.
B9w[][]
;Ew,t&
Bt$H9v
9pr(t$
EZ;]]r
u39~rdF]
E9]EEr
9rrTB]
u)]u}]
9rrdB]
E@E9]EEr
9prw;M
DF;gUS
$]u}E$@
$]u}E$@
$]u}E$@
$]u}E$@
$]u}E$@
$]u}E$@
$]u}E$@
$]u}E$@
t>BtmEM
$rE]u}]
$UEP&A
]UUWVS
T$E|UD$
D$|UD$
eOEElD$
$SEJEEE
$@$EVE
rUMWVS
$EJEEE
$@$EFE
pUMWVS
$EJEEE
$@$EVE
rUMWVS
e|EElD$
$EJEEE
$@$ECE
nUMWVS,
enEElD$
11dE1X
'x $t&
cUMWVS,
e_EElD$
dE1X1\
$9\rpw
eUMWVS
$@$Eek
]EUu}]
UWVS<U
EMu`EED$
]UU EEE
$Uu}E$@
$:EUEEU
$8EU]u}]
UU EEE
$U]uE$@
$?7EU]u}]
]UU EEE
$Uu}E$@
$EU/EEU
$5EU]u}]
$;U(E$U
uM }u$}
UWVSLE
EUe[^_]
7UWVSLU
EUe[^_]
DUWVSLE
0P&M U
EUe[^_]
>UWVSLU
U N 1%D$
EUe[^_]
E$]U u]
E <$D$
@1vE D$
a0L$/4
@-6m D$
]U M$}>D$
W ]u}]
(]] uu
$WEEUs
AE]EUu}E
$YotuH
$]u}E$@
$;"UExE
$]u}E$@
$!UExE
$]u}E$@
UWVS<E
1t+u+t
$P$WUWVS<E
1t+u+t
<[^_]#
$P$WUW1VS
$P$US$M
E0EE,l
;E |qgfff
M(9Mt\EU
$P$UWVS|E
U ElUE
EET$$U
1t+u+t
|[^_]S<1u
Bu+E1E
UWVS,E,EE(l
C;]$s!U
CG;]$r
$X?E(UM
$<?E9Ur
U2Cu9rE
e[^_]E
<$MEMP
EET$$U
BdEBhEBlEBpE
1t6u6t
9u{tEC
,A<8w4
D$ E$T$$
D$ ,T$$U
|,U$HB
T$ 4E$
BHEBLEBPEBTE
E$T$(L$$D$
Bd8Bh<Bl@BpDBtHBxLB|P
B,EB0EB4EB8EB<EB@EBDE5
FJ8tJU
$%\$ ~
c%\$ (
$P$US$M
UWVS<E
$3;]$tb
tO%tv}
C;]$uE
%uC;]$tE
u!C;]$tM
R4UVS ]
^]kTU(
UMWVS|
MU E$@
e?E]l]
hxUxBl@
||8\A
\|@@B4E1<<
$E,|B
80tp@U
)UMWVS|
MU E$@
rxUxBl@
||8\A
\|@@B4E1<<
80tp@U
D$ E$T$
D$ E$T$
U M$$@
|htL$/p
x|e[^_]
$hp)dL$
UU EE$U
U8uE u
]U$M(}>D$
4$L$ D$
U t,t$
]u}]UWVS
$nXlD$
HlL$+@Ep1D$
@L$+<P0
T$+@Bl
kUWVS<
eE|lp<$yl
Od|dBl@
0L$'D,
0C,<$D$
EUEEUE
&{TPLB
ChtB4E
J$Z(@@<
X<$BuEX
$xUWVS<
eE|lp<$ll
Bd|dBl@
0L$'D,
0C,<$D$
EUEEUE
&nTPLB
ChtB4E
J$Z(@@<
X<$BuEX
$xUUWVS\E
$>\[^_]
UMWVSLE
$yL[^_]
U]Mu}EU
U]Mu}EU
$R]u}]
uEE}UM
UMWVSlE
t ]u$E
El[^_]
$bEl[^_]
]MEEUEIB
$E|[^_]
E|[^_]
EEUu}E
t&]u*E
EEU]}E
t&}u*E
$4E]u}]
$E]u}]
UU]EEu}E
E@t']u+E
$2E]u}]
EEU]}E
$nE]u}]E
EEUu}E$@
$D~E]u}]
UU]EEu}E$@
$B}E]u}]
$m|E]u}]
$]}E$@
EEUu}E
B@t2]u6t&
$yE]u}]
$yE]u}]
UMWVSlE
$wEl[^_]
$s.UWVS
UMWVS|E
$NrE|[^_]
rE|[^_]
}EEEEUE
@@t.}u2&
pE]u}]
$oE]u}]
$%nE\[^_]
$mE\[^_]
$rl]u}]
$$k]u}]
U}1EEU]uE
iE]u}]
$hE]u}]
UUWVS|E
$8gE|[^_]
$fE|[^_]
UUWVS|E
$heE|[^_]
$dE|[^_]
KUUWVS|E
$cE|[^_]
$"cE|[^_]
{UUWV1S|E
$aE|[^_]
$RaE|[^_]
UUWV1S|E
$_E|[^_]
$_E|[^_]
UUWV1S
UUWVS|E
$(\E|[^_]
$[E|[^_]
UUWV1S|E
$XZE|[^_]
$YE|[^_]
;UUWVS|E
$XE|[^_]
XE|[^_]
kUUWV1S
mUUWVS|E
$TE|[^_]
$BTE|[^_]
UUWV1S|E
$RE|[^_]
$rRE|[^_]
UUWVS|E
QE|[^_]
$PE|[^_]
UWVS|E
e1OEUE
$OE|[^_]
U]UEEu}E
$ME]u}]
ME]u}]E
EEUu}E$@
$NLE]u}]
$dKE]u}]
UU]EEu}E$@
$bJE]u}]
$IE]u}]
$]}E$@
$u}E$@
$8GE]u}]
$B]u}]
$kA]u}]
e5?EED$
}U|BtBu
#UUWVS|E
$<E|[^_]
6PxBtBu
]M|BtBu
eE4EED$
J|BtBu
e0E|D$
EpBtBu
eE-EED$
C|BtBu
]UUWVS
e"*E|E
3UUWVS
eu&EED$
<|BtBu
@))9rZt$
]]UXeE
]uEEEE}E
E]u}]E
$E+vUE
UU]EEu}E
UEWVSlE
El[^_]=
\dE|EiC
4$)1D$
9PrWp1|$
9BraR1_U\$
$K]u}]
9JrfzU
X?)9rY|$
9s3Bt$
)9snu~B
$u}E$@
UuL C
UjU(]E
u0F)9w
EJ?))9rRt$
8D]u}]
?J)9r[|$
?]9EUUrwU
X9s?))9rtt$
]u}]9st$
]]U(uU
<$E)(>U
UEEMEB
$I:EEE
$69E\E
A?));U
$u}E$@
$aUUWVS|E
$|[^_]
EE]u}E$@
$@]u}]
$u}E$@
9BUr~Uu
EHjU(}}
EE]u}E$@
$0]u}]
$u}E$@
9BUr~Uu
E8jU(}}
$]u}E$@
$]u}]E
$]u}E$@
$J]u}]E
}~UXeE
$cUXeE
U]uEEU
$@]u}]
$#UXeE
$cUXeE
$A]u}]
$~]u}]
$#UXeE
$cUXeE
U]uEEU
$>]u}]
$#UXeE
$bUheE
$sUXeE
$L]u}]
$c]u}]
$AUXeE
$(XUXeE
$(hUXeE
tD~@Q@
c_UWVS<E
7E|$/M
$UE19u
C@uaC@
C\u'C\
$#uOEE
$E]u}]
P0P@@J
@4A8A<u
$4UB@BI
;EE0AtM
$E.UMWVS
tlUEPXE
$e[^_]
$E,E3WqMEAX
$e[^_]
EpXX\
CdpueUpB\B
B4B8B<E
U]uEE}E
$E]u}]
${E]u}]
$EL*U(uu
EE]u}]
]9ttuF
U;:|CF
;9t19~!)tQC|$
P1SBF0
ChCdC@C
YLQ@9A
ALIPCT
$E>$BX
U9EXXPd
#t{]{T
$P$t:E
U]uEE}E
$:tfEU]@
$PE]CX
$E]u}]
E:IaUX}}
]u}]GT
_h1Wd)9]
G<~?O\U)
u6whO\U
F?E)\$
GhMW\)9EEr
GdeEGX
$\gGd\$
$AUUWVS\E
$\[^_]
UUWVS\E
$u\[^_]
]uEEEE
$R]u}]
]uEEEE
$1UXeE
]uEEEE
UUWVSlUE
e6EMxM
EUxBx8
UUWVS\UE
EUxBx8
hUMWVSlME
M6UMWVS\E
eR]UMC
EMUE]A
qUUWVS\E
EUxBx8
_UUWVS\E
EUxBx8
_UMWVS\E
EMUE]A
$4\[^_]
$RE]u}]
UUW1VS\E
$$UEMBt
$\[^_]
$OUUWV1S\UE
eDEMtM
$"UEMBt
$t\[^_]
UMWVS\E
$\[^_]
$yUMWVS\E
$YUXeE
EUtBt8
$1UXeE
EUtBt8
$RE]u}]
UUW1VS\E
$\[^_]
$WUUW1VS\E
eVEMpM
$UMWVS\E
$%\[^_]
UMWVS\E
EUpBp8
EUpBp8
$xUXeE
$"]u}]
$8p1D$
$"]u}]
$8o1D$
"EUE1}
*UqUheE
$.]u}]
$(UqUheE
]uEEEE
]uEEEE
$']u}]
]uEEEE
$g]u}]
]EEEEU
$]EUD$
$]YUheE
REUE1}
$:\EUD$
$m\YUS
[[]}OU
pl&$hd
$|e[^_]
$X)TL$
Nld)hL$
UUWVS\E
esEUE1}
t\[^_]
$K1UD$
$KZUUWVS\E
eXrEUE1}
$r\[^_]
$nJZUS
X[]}=U
UUWVS\E
epEUE1}
q\[^_]
HE1Ut$
$HZUUWVS\E
eHoEUE1}
$o\[^_]
1G1UD$
$^GZUS
X[]m:U
$'utJ$
p`1(@=
ie[^_]
$rld)hL$
$gktJ$
p`1(@=
$T_e[^_]
$hld)hL$
$69cU1
X[]}&U
Y[]-&U
$U]u}]
$`[UXeE
$ZUXeE
$ZT]u}]
$S]u}]
$SYUXeE
]uEEEE
$R]u}]
$XUXeE
]uEEEE
$:R]u}]
$WUXeE
]uEEEE
$Q]u}]
$O]u}]
$#UUXeE
$N]u}]
$sTUXeE
$ N]u}]
$SUXeE
$pM]u}]
]uEEEE
$L]u}]
$SRUXeE
]uEEEE
$K]u}]
$QUXeE
]uEEEE
$JK]u}]
$PUXeE
$J]u}]
$=PUXeE
$I]u}]
${OUXeE
$NUXeE
$WH]u}]
$MUXeE
$G]u}]
$;MUXeE
$F]u}]
UMWVS\E
$WC\[^_]
CtSt]u]
?XCtCu
CtSt]u]
$u}E$@
$&EUD$
E@xEtP
UWVSLE
$wllD$
$TCtCu
].UXeE
$~E1@t
$F=]u}]
u1EEEE}1
^H[^_]E
[H^_]E
-UWVS(E
C9u([^_]
4$ [^]
UUWVS|E
$2E|[^_]
$d2E|[^_]
UEXEE]u}E
$-1E]u}]
UEXEE]u}E
$m0E]u}]
UEXEE]u}E
$/E]u}]
$E]5t&
$EYUEXEE]u}E
$.E]u}]
UEXEE]u}E
$-.E]u}]
UEXEE]u}E
$m-E]u}]
UEXEE]u}E
$,E]u}]
$E]2t&
$EYUEXEE]u}E
$+E]u}]
UEXEE]u}E
$-+E]u}]
UEXEE]u}E
$m*E]u}]
UEXEE]u}E
$)E]u}]
$E]/t&
$EYUEXEE]u}E
$(E]u}]
UEXEE]u}E
$-(E]u}]
e}#EME
$MAX9EE~wE
k-MT$+Uyu
#Ee[^_]
8UBtBu
$e7 EME
.*MT$+Uyu
6UBtBu
$Ee[^_]=uE
$]uE$@
$E."EU
$]u}E$@
$E*!EU
$u}E$@
||EH;E
En}t uu$E
UM4$L$
UU]EEu}E
\Mira.h
Saaaalamm
basic_filebuf::xsgetn error reading the file
basic_filebuf::_M_convert_to_external conversion error
basic_filebuf::underflow codecvt::max_length() is not valid
basic_filebuf::underflow incomplete character in file
basic_filebuf::underflow error reading the file
basic_filebuf::underflow invalid byte sequence in file
basic_ios::clear
basic_string::at
basic_string::copy
basic_string::compare
basic_string::_S_create
basic_string::reserve
basic_string::erase
basic_string::assign
basic_string::append
basic_string::_M_replace_aux
basic_string::replace
basic_string::insert
basic_string::resize
basic_string::_S_construct NULL not valid
basic_string::basic_string
basic_string::substr
ios_base::_M_grow_words is not valid
ios_base::_M_grow_words allocation failed
locale::_S_normalize_category category not found
locale::_Impl::_M_replace_facet
basic_string::_M_replace_aux
%H:%M:%S
%m/%d/%y
basic_string::_M_replace_aux
basic_string::erase
pure virtual method called
LC_CTYPE
LC_NUMERIC
LC_TIME
LC_COLLATE
LC_MONETARY
LC_MESSAGES
locale::facet::_S_create_c_locale name not valid
-+xX0123456789abcdef0123456789ABCDEF
-+xX0123456789abcdefABCDEF
-0123456789
%m/%d/%y
August
September
October
November
December
%H:%M:%S
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
c:/mnt/samo/mingw/msys/mthr_stub.c
-LIBGCCW32-EH-2-SJLJ-GTHR-MINGW32
w32_sharedptr->size == sizeof(W32_EH_SHARED)
%s:%u: failed assertion `%s'
../../gcc/gcc/config/i386/w32-shared-ptr.c
GetAtomNameA (atom, s, sizeof(s)) != 0
R`%uM]=];Z
uuvHMe
Ix@ p+
N10__cxxabiv117__class_type_infoE
N10__cxxabiv120__si_class_type_infoE
N10__cxxabiv121__vmi_class_type_infoE
NSt6locale5facetE
NSt8ios_base7failureE
St10bad_typeid
St10ctype_base
St10money_base
St10moneypunctIcLb0EE
St10moneypunctIcLb1EE
St11__timepunctIcE
St11logic_error
St11range_error
St12codecvt_base
St12ctype_bynameIcE
St12domain_error
St12length_error
St12out_of_range
St13bad_exception
St13basic_filebufIcSt11char_traitsIcEE
St13basic_fstreamIcSt11char_traitsIcEE
St13messages_base
St13runtime_error
St14basic_ifstreamIcSt11char_traitsIcEE
St14basic_ofstreamIcSt11char_traitsIcEE
St14codecvt_bynameIcciE
St14collate_bynameIcE
St14overflow_error
St15basic_streambufIcSt11char_traitsIcEE
St15messages_bynameIcE
St15numpunct_bynameIcE
St15time_get_bynameIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE
St15time_put_bynameIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE
St15underflow_error
St16__numpunct_cacheIcE
St16invalid_argument
St17__timepunct_cacheIcE
St17moneypunct_bynameIcLb0EE
St17moneypunct_bynameIcLb1EE
St18__moneypunct_cacheIcLb0EE
St18__moneypunct_cacheIcLb1EE
St21__ctype_abstract_baseIcE
St23__codecvt_abstract_baseIcciE
St5ctypeIcE
St7codecvtIcciE
St7collateIcE
St7num_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE
St7num_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE
St8bad_cast
St8ios_base
St8messagesIcE
St8numpunctIcE
St8time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE
St8time_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE
St9bad_alloc
St9basic_iosIcSt11char_traitsIcEE
St9exception
St9money_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE
St9money_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE
St9time_base
St9type_info
AddAtomA
CreateDirectoryA
CreateProcessA
CreateSemaphoreA
DeleteFileA
ExitProcess
FindAtomA
GetAtomNameA
GetCommandLineA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetStartupInfoA
InterlockedDecrement
InterlockedIncrement
ReleaseSemaphore
SetFileAttributesA
SetLastError
SetUnhandledExceptionFilter
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WaitForSingleObject
_fdopen
_strdup
_write
__getmainargs
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_assert
_cexit
_ctype
_errno
_fstati64
_isctype
_lseeki64
_onexit
_pctype
_setmode
_strnicmp
_vsnprintf
atexit
fclose
fflush
fprintf
localeconv
malloc
memchr
memcpy
memmove
memset
setlocale
setvbuf
signal
strcat
strcmp
strcoll
strcpy
strftime
strlen
strtod
strxfrm
SHGetFolderPathA
ShellExecuteA
KERNEL32.DLL
msvcrt.dll
msvcrt.dll
SHELL32.DLL
;33330
*7RTVVjrqmjr}
!/9?NGGaaq^^^m
+388<<a^^^^]^
#%88<Ca[]]]]]
#%''CCZ[^\\\]
#%'''<[[^^\\]
#%''<_a[^^^\^
#%''<<aa^^^^^
##''<_am^m^^m
"%%8D<aabm^^m
#-8<Iaammmmm
"#%89addammmr
$-8<Gdnmmmj
$-8GIdnnjrr
$-8GGhnsrr}
$-9Gdhnszz
$-9GGggs}s
+-9Ghgys
$1;GVvys
+/GSiiyy
+/?Tiv
jjuwxz.4DC\JJMU
'* KJJJ;t
99MJJBy
9KJJJ\
9#KMJJ\
=LMOO`
*1=R\QQc
*<=UUQ\h
*@@VU```g
2@CVVg`m
'2FCaccm
3F[Yam
%@74i%
(J@@=%
:TOJ7Q
Tccbk
Vcccl#
Vcccl),Fbb_:
Vccll7,bheb:
Vcj[S/dhhhbH
_VTTTPJJJBH
~s#MgR'Qj.(Vq
]vr Lhh(QjT/SiB3Sh'5Ti
Lit%Qla-TkM3Ti>5Sf85Qd(6Rf
Liz$Qli,UmU2VlD5Ti:5Rf55Qd1YD}h
Li|#Qmo+Un\Fsbcqy~xtvywvs^
~srrrr:oRdr}}xsqnlihglt
]{usrsrZagjlqqokhdb`__b
3zxvtsrHR]deddbcc_\ZZY]
~{ywvsGKQW\_``_`]ZYXX[
|zyv@FOVZ\^^__^\ZYXZ
~{y?EMTZ\^_`a^^\ZY[
|?FMTX\^`ab`^^\Z\
?FMTY\_accb`^^\_
?ELTY]_ccdbb`^^`
tELSX^acefdab``c
ELRX^acfhfcdccf
ELRY_cehiiffffp
FLTZ`dgiljiiij
FMTZ`ehkmljklo\
HNT[bfjlonmmpsf
HNU\chkoqqoprv
IPV]dinqstssuz
KQX_fkoruwuvx}
KRYaimqvxxxy|
MS[cioux{}|}
NT\elqw{~
OU]fmuy}
PW_gpv|
PX`iqx
QYalsz
QZemu}
%Jc_(Nf/)Sl
]tHc}(Nfg1QfL4Qd%5Th
u@{sV~:
Gc%Mgr.RhY4RfE5Qd:fQ
{uh*>FE
Gc7fVkv}woaONOf*>EP
usrrOZcebYXUOLKYn
<~vssBDOX\^]XQLKa
zwu?GS[][WTOMLct
|yCEMWYZZWSPOeu
~=EOX\^^[XUUkx
?GPY_bb`^[[q|
nHQZbfgeabbv
JS]djkjghilq|
KT_inpnmop[
MWckqttrvxs
OYdouzxy|
R[hsy}}}
D:9hN!
_]^`DKV^]\[[r
lwogDCNNNNP\
pwoDENNNN
uwEIRRNN
yGNV[VR`
}JT\f`[b
N[csmfc
Raizsme
crt1.c
_atexit
__onexitp
crtstuff.c
main.cpp
.rdata
eh_personality.cc
.rdata
fstream-inst.cc
.rdata
ostream-inst.cc
istream-inst.cc
io-inst.cc
.rdata
string-inst.cc
.rdata
tinfo.cc
eh_exception.cc
eh_terminate.cc
eh_throw.cc
eh_alloc.cc
eh_globals.cc
eh_catch.cc
streambuf-inst.cc
codecvt.cc
.ctors
ios.cc
.rdata
functexcept.cc
locale.cc
.rdata
locale_init.cc
.ctors
.rdata
basic_file.cc
.rdata
del_opv.cc
__ZdaPv
new_opv.cc
__Znaj
del_op.cc
__ZdlPv
locale-inst.cc
NaHaJa
ppi"N"
qw!3!?B(8t
W&~i%
A&A&A&
N"WW&!
#vo"RaF?&!
JmF!LR:Q
:G\@]@
G?&!@
:WG!PX
/.v!@:
F]?&E]&]
gPGI#xO:
ryW!Xrv
f$:^c9
#z{zG&x
1R#zg&
1R#v"&
>Pd R[
~9uxQ
<3$:nG~
~8O!X:#
o84vko>/~
Y:mQ3~
YQ3~@:g
_Ktp:l
4W9#P:^
Y:mQw
H%6~}W
<x!PnD
wX:i
O&#P:
Y:mQw~!;
RGe#@x
F;Gi?#B&
2-|II`
B7&EXp8<
R!@<+o
#@:YA
~?&!@
o&O&!@
&lWA!@fq
%O1&<+S
A&A&A&
G];t&
G?&!@
o&O&
~NO]@
4ZX>L
_t&x#)
P4v0#W
or<so:fr
G?&!S
4^u:fV`
<3q!p<
w&!@":
G?&!@
.L_t!@
~-!P&<
<Gy?&!@":
G?&!H<
.jGh!@<
f6G!P*
U^Wq!H:G}H:
q#?@<
A&A&A&<#F~
gVF1G]
OO&G&!P
_?&!@
GO&!@
P:XP9X{
r!#@:
5Vod<P4
%W%b~
o:6_p <
q#?@:W~
:nw!X<
WO&!P
GV&A&A&
G6B`:*
kvGy&A
YA&A&A&
v!N6<+
B7&EWp"
n%G*E]@a;
?&!@:
qGi#@:
w!x:X>
2W;"Om>
n%G:E]@Y;
u;"@RaF
A&A&A&
qTfE_>
wxxrG;B`:y%
w#@:=&
w!x:Xx
fGe!@:
>#F~@9~
wxxrGv<B`:$
4RKboZ"
7;bGe7
mF!@4q@
g@R_!p<
.b^oV:Z
6VoDV&
6VooRjE
f~7%uw
:XA&A&A&
wxxrG>B`:"
~Gm!X<
~]Gm!X<
v!N6<+
B7&EWp"<
4L6hoF-
qLA&A&
f6G@>t#P
:&Gm#@:
xxrGAB~}Gm]q
w!x:X4[
^Gi!@x[
:&Gm#@:
xxrGAB~Gm]q
^Gi!@x[
:&Gm#@:
xxrGVBB~
#@:5
^Gi!@x[
wxxrG
vWm!@x[
wxxrGDB~M,4
vWm!@x[
GEB~,4
RD#@:
RGy]bN
RD#@:1
RGy]bN
_t&A&A&
Sj4VgV_6
Sj4VgV_
n%GE@>
L=v&x
>v_@>
wxxr(GHB~
FO&&
KRGm!Lj4V;s
~M_!p<
>v_@>
wxxr.GvIB~
FG&&!
[RGm!Lj4V;s
~]_!p<
RGq&:
FW&&1
kRGm!Lj4V;s
~NGq&|
xB}zRg&{
o&]&)?
4VRGq&Q{
RV_t&x#)
:zTg&z
RGq&1z
N_aKj:_
/R_!p<
D.Mv!Xx
S&A&A&A&
jV5BPW
Gy#P:
W1#@:
6Vz<+w
Gi?&
Gy#P:
W1!@:+s
~O&&uI
B]@%b>
Gy#P:
W1!@:+s
~w&&H
B]@1b>
Gy#P:
W1!@:+s
~o&&5F
~]M0/%
B]@=b>
Gy#P:
W1!@:+s
~O&&D
B]@Ib>
Gy#P:
W1!@:+s
~w&&C
B]@Ub>
Gy#P:
W1!@:+s
~o&&UA
~}H0/%
B]@ab>
Gy#P:
W1!@:+s
~O&&@
B]@mb>
Gy#P:
W1!@:+s
~w&&
~=E0/%
B]@yb>
Gy#P:
W1!@:+s
~o&&u<
n%GjE]@
~1CGq&g
!P<vo#:Z
n%G~E]@;
~qBGq&g
!P<vo#:Z
U43!@
6Vo"Yp
ivE?&]&E?
rG6cB`:)
Wi!6VGe[
y#o(#)
Gq&!d
J&%W]!
ZOy!P4v
n%GE]@;
Ge&E6
!P:Gq&b
ZOy!@4v
~Ge&!-
n%GE]@t
~uh_!p<
uWy!@%;v
~Gm&E,
wxxr?G9fB`y_
~g_!p<
uWy!@%;v
~Gm&e+
n%GE@>
vGiB`:
Wi!6VGe[
y#o(#)
J&%W]!
ZOy!P4v
VWi&xz~z\rg~mcWm!@
~=.Wm=
>C!:)0
9~H'<Gq&m[
^~P<v
VWi&x
~ztg~`Wm!@
~+Wm=
>C!:-
?&~Wm!H<
9~H'<Gq&Y
^~P<v
n%GFE@>
3_m!p<F
.D!6VGE
G4(Wm!=
@#_m!@<
:F%wa/&!
Zwy!P4&:oD4
=v+!@:Z
wU/&{Gu
:wU/&
&wX:t!A
<&G!@<
B]@~c>
OI!??&!:%(
~KGU&S
GE!p:^$4
3zG&?&
!Hw?<B!A
O!G9!P<
!HRE!:
~EW!G1!x<
~I^W!H<WQ\
!"B!:
_z~GU#@:+o
2%GQnE]@
?&~%G9
o'Eo&#@:m1
oK4vov:
_tbn
y#p>#w
R!@:{4:
>{<8<4
w!@<3w
Gy#K:+c
Gi?&
~G&&"
BQgGE@>
Cf`F]<
j&`F#q
OmNkeF
O]TKev
!PT^FN{
iE?&
:[e"^FH
9_eGYQWe^
wcf\F0
\FWU?&]&?
39+d,T]F!@:
wNd^F?&]&?
G&!Hov
i^F?&N7F
,Tj[FNk
3z9b,h
3q9b,T[F
3q9c,T\F
3q9#c,T\F
39Gc,:
\F9Oc,T\F
39{c,:[c,
:_c,:cc
Om9dJ?
i]F?&N+F
iE?&
3f[F#@:
ZOy!P4NWa
L.Fv]@
iaF9b2
ZGyB~JGQ]
~J_!p<
>O]!P4v
.&OM!P
ZGyvB~IGQ]
W&&i
7bWQaF!@6ho
~]I_!p<
>O]!P4v
.&OM!P
BQgGE@>
Cf`F]<
j&`F#q
OmTkev
]FNkdW]P
O]NKeF
:?e&^F?&
i^F?&N
V,:cWm
3q9c,:
jF\F9c,:3\
wcz\F\
iE?&
3z9/d,h:
3q97d,T]F
T^F8*
^FW&G&]&?
iEO&!P:
lEo&W&&
V,Tz[F
3q9c,T\F
3q93c,:b,:b,T\F
3z9Wc,T\F
3q9gc,T
:oc7)?
?&]&?
G&!Hl
T~]FNdF
n]F!Pi
]F]&x>
vGu!H<
OiP%~
B]@!d>
:.gM~>)
T.[F#@:z
Ljq]aF!@6ho
O&&:Ss
o&&:3s
Gi?&
6[F~iGA&A&A&
_V_iEYX
_t&j
&G#o(#)
U4_&
_@x#)
_0x#)
3G&W&O&~qGi
~u#@<>
n%G&E]@)2;
Gm#@:y
w!x:X4[
~yA&A&A&
C;s@#O\@!
LP/,4Z
3O&&Uf
3O&&f
3O&&e
3O&&Ed
:nV_t&x#)
.4$x#)
:nV_t&x#)
.4$x#)
A&A&A&x
Gq&9)
B~=/Gm]q
A&A&A&x
Gq&Y(
vGB~].Gm]q
A&A&A&x
^Wm@:W
_t&A&A&
._#Yn:
wxxrOGB`:I
A&A&A&
w!x:Xx
3O&~Uf
3$%G+-
w!x:X4&
@%_!p<
,pE?&~d
~;Gw&]&
^w}!x%
?&~YdG&]
pE/&<
<-K6!w&_M
G]At&
G]{At&
XA&A&A&
~WuX:
R%GqE]@
BWa@<
~WuX:
~G&&
FGI!@:
W?.*v]@
~WuX:
~W&&
FGI!@:
W>.*v]@
:&Gm#@:
xxrGVB~$Gm]*Gu
?&!@4V_
~}%_!p<
^Gi!@:="
~%+x#)
:&Gm#@:
$Gm]*Gu
?&!@4V
~$_!p<
^Gi!@:!
~u*x#)
]2uV_t&x#)
]2uV_t&x#)
]"uV_t&x#)
]"uV_t&x#)
]uV_t&x#)
]uV_t&x#)
~WuX:
R%Gq:E]@-F;
~5GQ&
BWa@<
~WuX:
R%GqJE]@"G;
~5GU&
~w&&
FGI!@:
9.*v]@
~WuX:
R%GqZE]@"H;
~5GU&
~O&&
FGI!@:
8.*v]@
:&Gm#@:
B~MGm]
?&!@4V
~ _!p<
^Gi!@:
:&Gm#@:
xxrGB~
?&!@4V/
~M_!p<
^Gi!@:
]zuV_t&x#)
]zuV_t&x#)
]buV_t&x#)
]buV_t&x#)
]ZuV_t&x#)
]ZuV_t&x#)
]JuV_t&x#)
]JuV_t&A&A&
~WuX:
R%GqvE]@
~EGQ&%
BWa@<
~WuX:
R%GqE]@
~EGU&
~G&&
FGI!@:
3.*v]@
~WuX:
R%GqE]@
~EGU&
~W&&
FGI!@:
2.*v]@
:&Gm#@:
Gm]ZGu
?&!@4V
^Gi!@:
:&Gm#@:
Gm]ZGu
?&!@4V
^Gi!@:
A&A&A&
RE=6A#(
RE=6A#(
:&Gm#@:
xxr+G
:&Gm#@:
xxr1GB~
:&Gm#@:
xxr7GJB~
w!x:X4[
:&Gm#@:
xxr=G
:&Gm#@:
xxrCG
:&Gm#@:
xxrIGB~
!@:uq
w!x:X4[
&A&A&A&
EGE]&b>
:&Gm#@:
xxrOGvB~
:&Gm#@:
xxrUG6B~
:&Gm#@:
xxr[GB~=
w!x:X4[
&A&A&A&
U4O!P
Cw)Cw%C1
V"A&A&A&
G?&!@
:nV_sA&A&A&
G?&!@
B+E];*B>
B<E];:_>
B^E];J>
sE];Z>
B%E];z>
3z3]r
3z33z33z33z33z33z33z3AV
h{6foN>L
FX&|&>
~=L~!XzY>
#XA&A&
A&A&A&
A&A&A&
6Vp8REQ
B~5HV]
&A&A&A&
:n__U>
G&O&]&>
iE?&~
<h%gYa
YGI<C7{wI]@<Cx
C<N:<CGY<C@R
E]@<Cx
C<VJ<C
Gu7Gy7G}7G7G
mF4qF
R*E~I>
VaF#>
TFaF#>
TfaF#`
J#o*:'3q?&!>.:%
q:+uV_t#q
wXRaF!
q#n6%&
w_t!>66Vo
w_t#>::
6ho&<+q
4t/&7t!RVaF!;.4-
v!C26_s6<+
A&A&A&
A&A&A&<'
A&A&A&
A&A&A&
Y:]Q~!
A&A&A&
<+G#X:#q
vW&w&!
4t/&7t4
v!s26sH<
Y:]Q~!;
!@_~o&
w(!;*>G!@
A&A&A&
A&A&A&<'
4t/&7t>G!@
RVaF!X6VoC<+z
wBW&&Ot~
_#o(#)
v0!k26
4t/&7t4
v*7h%Z
!C26_pu<#W@:
RVaF!X6V
&>~!_!p<
A&A&A&
RVaF!p
6Voc<+z
FX%dgN
G&Gt,4q
&7t<&~_t#q
G?&!@
?&G&]&
A&A&A&
3q?&N
E&/t,4
q<_A&A&
:W#H6_
W!p:fO!x:X{Y<;rq!:
zG!P<~w!x:
nO}#@6V
fw}&rW}i`
A&A&A&
._p.nq\:^
3z@<
_t!@j
z:p]GOi
i`:Wp(
A&A&A&
~%4h!X<
3z@<:Pn~
qEz"+rHLH:LH:m
G?&!@
A&A&ct
r4o+#5
o&#.+
hx+^#o(#)
3~&3zD
V`t~m)
~!o&~-)
~!W&!o&~&
V`t~A&
A&A&A&
,VQ3|}
o&W&~%
Gi.^_!@<
h6ht4^3qQ
bW!@>L
@VWaGi#q
h6ht4^~
F_y!@:
R:Xy+O
3z?&P;
_yO&G&o&
_;#p<+O
97&i|
B3zo&#X:
G;#H<3O
w;#P<3O
%%/-#-
~YA&A&A&4
h~44XK*V`t#(
PL{Yat#o(#)
PL{Yat#o(#)
h:BM=
1h:4WMM{p
t~w&o&W&#(
!o&#W&F
ML{!o&Q
A&A&A&M5s
M?V!&U
4PL{#o&
Mo&#W&#G&P
hx6~~
MGV!&E
yh:atk
A&A&A&MWV^
~!?&!O&
b0a.{puV`
1h:4WMM{~
h4d!G&
G&_!O&!G&
1h:4WMM{
1h:4WQM{
A&A&A&M
1h:4WQM{a
w!G&?Op$
PH||zw{E8
A&A&A&
A&A&A&M2a
M-saC4w
M5saC4}'
MsaqC4N
MsaqC4N
Msaq@C4
MsaqC4
.~u$>
-<*!v
1h:4WMM{Ih4v'H#Q
A&A&A&
QU4G%[
~Xjhx"
saNC4O
C4~Xhx"
h~44XK*A&A&A&t
qt&A&A&
qt&A&A&
GW&?&!@
YA&A&A&
Z_t&A&A&
G?&!@
GW&?&!@
YA&A&A&
w&?&!@
w#o(#)
G?&!@
GW&?&!@
YA&A&A&
!Mir0T :
Z_t&A&A&
G?&!@
GW&?&!@
YA&A&A&
G?&!@
]:fXA&
&__t]&!>
gVA&A&A&
&__t&A&
GW&?&!@
YA&A&A&
@<G=r.#o(#)
G?&!@
:\$:_!p:XA&A&A&
&A&A&A&
X!;t&
X!C6_
qt&A&A&
GW&?&!@
YA&A&A&
:iWW#o(#)
.4:W%_M:
G?&!@
A&A&A&
X!;t&
{&A&A&
_t&A&
w!@n_!p<
A&A&A&
.w!.;/mf<
~G#@#G
oX&<+!X<
>-;qW-*s6Vp
w!x:Xx
<G!;:;
zG#@#G
z^_!p<
G!;!my<
4(W!P<
W!R`4(
<iA&A&A&
U4_!;
w[:nV_t&A&A&A&
T_A&A&A&
T_A&A&A&
~~)@>
R%GqE]@a<
~GU&-
X!E"w
qYA&A&
qYA&A&
~~)@>
R%GqE]@
~MGU&
~~)@>
R%GqE]@
~~)@>
R%GqE]@1<
~GU&]
T_A&A&A&
T_A&A&A&
~~)@>
R%GqE]@
X!E"w
qYA&A&
qYA&A&
~~)@>
R%GqE]@<
~-GU&
~~)@>
R%GqE]@
~mGU&
~~)@>
R%GqE]@Q<
_t&A&A&
:_t&A&
:_t&A&
<C!=N:C!=V:
:_t&A&
:'_t&A&
<'!=2:
!=&:_t&A&
<_!=j:
C!}XA&A&A&
wxxr+G"C~
\;f@:
:OQ@i
2Z2_!p<
vGu!P4
o74voox
n%GE]@
W+?&!@
W+?&!@
G5&:>;-g]~=G9
G?&#@:UH
<{q~~GI
#O&!@4xF
WA?&
G&?&
2~P%~
A&A&A&
q<4#V_t&A&A&A&
!X4sA&A&A&
Ou!P"x
2GUP:V|Gy<4C`
@4VE&GM]@
EVC~@w
jv!H:#c
G&&q
Ww&?&
|nBBF
7;$4u]&
3q?&!B
BG8W#H
#@:]=
!H4*{{
6ho*<p"<
#@:]+
Ou!P"x
2GUP:VGy&BC`
@4VE&GM]@
EVC~@w
A&A&A&<
6ho6<p.<
%O9j>
6ho6<p.<
/~!V;F
Ww&?&
vnB>F
7;$4u]&
3q?&!>
Ou!P"x
2GUP:VvGyPC`
@4VE&GM]@
EVC~@w
jv!H:#c
G&&A
|nBBF
7;$4u]&
3q?&!B
BG8W#H
!H4*{{
O&#P:
6ho*<p"<
Ou!P"x
2GUP:VGy^C`
@4VE&GM]@
EVC~@w
jv!H:#c
g;<w!>
G&&a
Lf3!@<+
?&~qv
G!^h:WN
.Ou!P"x
2GUP:VpGy
@4VE&GM]@
EVC~@w
A&A&A&<
6ho6<p.<
%O9j>
3f&,:SS
!.:\:m
vnB2F
7;$4u]&
3q?&!2
^A&A&A&
.Ou!P"x
2GUP:VjGy,|C`
@4VE&GM]@
EVC~@w
jv!H:#c
DpK<##
J?&O&~Ad
ky!";6
|nB2F
7;$4u]&
3q?&!2
!H4*{{
~_GU&EH
Ou!P&x
2GUP:VGy&C`
;G9!H*@i
Dp:<+g
6ho6<p.<
!P<B>F
7;$4u]&
q!P4vqG5!G1!pRE
3z!@:
oeRE!J+
?&#@:
3W&G&&mD
!@<q:v
!H<B6F
7;$4u]&
6ho*<p"<
OET<&X
7;$4u]&
3z!@:
!@4*{{
6ho*<p"<
A&A&A&
U4G!P
GO&!P
G?&!@
+uV_t&A&
U4G!P
GO&!P
G?&!@
uV_t&A&
U4G!P
GO&!P
G?&!@
#uV_t&A&
U4G!P
GO&!P
G?&!@
'uV_t&A&
U4G!P
GO&!P
G?&!@
uV_t&A&
U4G!P
GO&!P
G?&!@
uV_t&A&
U4G!P
GO&!P
G?&!@
uV_t&A&
U4G!P
GO&!P
G?&!@
uV_t&A&
U4G!P
GO&!P
G?&!@
uV_t&A&
U4G!P
GO&!P
G?&!@
uV_t&A&
U4G!P
GO&!P
G?&!@
uV_t&A&
GO&&
@<Wn
<vW!p<
DGH&G
W?&O&!@
~9GOx6_
&A&A&A&
R%Gq5E]@4<
~9GE#P:
WM?&!@
~EEGU&-
w!x:X4[
W]#@:
GA&53
&A&A&A&
WM!P":
~Gu#@:
VGy*C~y3GY
~8GE#P:
WM?&!@
~CGU&E,
w!x:X4[
W]#@:
&A&A&A&
R%Gq;E]@
~Q7GE#P:
WM?&!@
~BGU&+
w!x:X4[
W]#@:
&A&A&A&
GO&?&!@
A&A&A&
GO&?&!@
~iA&A&A&
GO&?&!@
A&A&A&
GO&?&!@
~A&A&A&
GO&?&!@
A&A&A&
GO&?&!@
A&A&A&
G?&G?&#!:
?&#@:
>!x!@:
~#o&!C
GG&O&?&~G
40W!@:
G@&G!
~W?&!@>1:
?&GW&
I?&!@:
?&~aG
G@&G!
~W?&!@>1:
?&GW&
I?&!B
?&#@:
b,6_\!P
~W?&!@>1:
?&GW&
o&#@<
GW&O&?&
@:Ynr
:w!@<^
O&#@<
I?&!B
&_@LH
r?&~:X$6%O!
!P<$YO
w!x:X<
G7&:
G?&N(
!o&O&w&
!o&G&&+;26V
#N:nV
#N:nV
P~~%/V
~G&?&h
~sW&?&W&7&q
A&A&A&
!o&O&w&
!o&G&&+;26V
#N:nV
#N:nV
~G&?&h
~qw&?&W&7&
A&A&A&
GO&!P
W?&!@
GO&sW&?&!@
6G&?&O&R"<&
_t&A&
GO&!P
GO&!P
W?&!@
_!p:XA&
W?&!@
_!p:XA&
Wo&?&!@
YA&A&A&
Go&?&!@
C~_!@:&
G_t#An:
:;s&]A
:w!@<^
B@X/!D
G&#W&
GsW&?&!@
GsW&O&?&!@
W?&!@
W?&!@
G!P":
GG&O&?&!@
G!P":
GG&O&?&!@
&A&A&A&
_t&A&A&
~~)@>
R%GqE]@
~~)@>
R%Gq}E]@
~} GU&
~~)@>
R%GqwE]@AQ<
~GU&M
qYA&A&
qYA&A&
~!@"x
~BO&!P
W?&!@:
~!@"x
.G~m<g!4Z
~BO&!P
W?&!@:
U4G!P
GO&!P
G?&!@
uV_t&A&
U4G!P
GO&!P
G?&!@
uV_t&A&
NG@<'q
A&A&A&6h
)=ws:i
$6ho,<
Z_t!@<,
s4%v!H9*
A&A&A&
Gy!=N:
WmG&@<
GO&!P
D@<+bD@<3jD@<;rD@<
K*:Xe
~!@.:~
A&A&A&<
:;#P#W!-E:
6hppq4
62!@6h
vJ;!:tV
O!P"<63/&8
G~6Oi!K
Gi!}RM
Gy!}b]
Ge?&!@
GO&&
<3?x!@<
Gi!=j:
Gq!=r:
Gy!=z:
G!}z^NN
g;=w]@
G!H":+
r?&/&
,9g{.
q%9^'Cr6L
r?&/&
3q?&:
3q?&:
?&!@&:&4V
O?&!@
GO&!P
G=!}&q
?&!@&:*k
GO&!P
GO&!P
Gi!=N:
Gq!=V:
Gy!=^:
A&A&A&9
#A:F
GO&!P
5VpiVx#)
#A:F
#A:F
.R!=.:
GM!=6:
GU!=>:
G]!=F:
r?&/&
WW&G&O
#A:F
#A:F
U4G!P
GO&!P
G?&!@
uV_t&A&
U4G!P
GO&!P
G?&!@
uV_t&A&
U4G!P
GO&!P
G?&!@
uV_t&A&
zG@L@
X&:]od>L
X&&@G!P
pX&%VG
G?&!@
3q?&:
?&G7&:
A&A&A&
O?&!@
G&?&!@
>%4v6f
q<X/&>
O&G&K
qYA&A&A&
qYA&A&A&
qYA&A&A&
]T_t#q
uV_t&A&A&A&
gVA&A&A&
"w!S~6q
O&G&K
G_!k~6oaL
9q%_<
!X:Xw!x:
A&A&A&
qt&A&A&
~Oe!P"x
"GEP:FGiC`E
!v3qVF
~}y_5!rF
O&&x
._M!P4N
6ho*<p"<
!PRE!E^~
qGyo&W&&=
!@w(^~];
GW&&
!>.6Vy
6ho6<p.<
Gyo&O&&
7;$4u]&
>v!@<J:
<+yy>B
g;<w]@
Gy!;6V
~Oe!P"x
"GEP:FGi6
!v3qVF
~k_5!rF
O&&x
._M!P4N
6ho*<p"<
!PRE!E^~
qGyo&W&&
!@w(^~];
GW&&
!>.6Vy
#@:ii
6ho6<p.<
Gyo&O&&I
7;$4u]&
>v!@<J:
<+yy>B
g;<w]@
Gy!;6V
U4G!P
GO&!P
G?&!@
uV_t&A&A&A&
U4G!P
GO&!P
G?&!@
uV_t&A&A&A&
#H:AS
^3q#(
G?&!^
!bG&!f>
GG&&i
OO&!P
W=!P":
W1W~~Gu#@9
G?&!@:
WE?&!@:
G&WE]@
G?&!@:
WE?&!@:
W]#@:F
!zodA&A&A&
GO&!P
~XA&A&A&
GO&?&R
_t&A&A&A&
w!x:X:
>-4w>
!Fq~~e
>-<37
A&A&A&9
Gy?&!&
mA&A&A&
B%G]@g>
}Gi+D`
<+&}!>":S;
MC6\p+?
#@:mG
D?&!=
!.+?&#@:
!&3W&T
_o&G&
q?&~~
"G1!@:
G#@:H
YxF3q^.
\;E^-F
\!;:#;
7&x=w]@
?&#@:"
3q?&!
O&G&~A~
!:+y^BF
?&!BB:
7;$4u]&
?&W&!
3o&!:.^>G&W&~
B%G]@h>
}Gi8D`
<+&}!>":S;
MC6\p+?
#@:m:
D?&!=
!.+?&#@:
!&3W&T
_o&G&
q?&~~
"G1!@:
G#@:;
YxF3q^.
\;E^-KF
\!;:#;
7&x=w]@
?&#@:
O&G&~A~
!:+y^BF
?&!BB:
7;$4u]&
?&W&!
3w&!:.^N
G?E]@A=
F?&!@x
E%,hHN
\>w]>z
YA&A&A&
VWi&x
{zKHg~m_i!P<
NWm!H<
V_t&A&A&
&xrGAD~
&xrGVBD~MGm!P<
B]@1`>
:Oi!K<
YA&A&A&
q?&!@
vGi#@9n%GE]@z=
?&#@:
!KgC)>B=
gGQ!P$GM&!P<z
A&A&A&<
Oa!P:
Z_t!H<
q?&!@
rKWX9
NGqPx
<st@<
&%!P<J
B&B%uWi!
4N~-Ya
NGqP:
!C`T)!=
w#@:%
w!x:X>
We!P:
NGqP:.Gv
w#@:U
w!x:X>
Wa!P:
~MGe!X<
=nLJ;v!X6qp->
.J_!p<
Wa!P:
wxxrGPD~}GiP
?&#@:
-N_!p<
NGqP:.Gv
Gio&?&#@:Z
~|Ge!X<
FWa&:
_+J_!p<
~{G1!X<
YG!Uz>
?&!@:
w!x:X>
&!P<zw]@
A&A&A&
~WeX:
FGiUD&q
~yGA!X<
"W=&:
'&_!p<
IGM@%GI
NGqP:
?&#@:
w#o(#)
G%N_!p<
We!P:
~uGi!X<
~q{Ga&
!P<rw]@
VWe&x"zz
ag~-tGiP
?&#@:
:D%Oi<
&~Oa_a
!H:v]@
:YD!?:-@6V
=ntLtz
A&A&A&
:YD!?:-@6V
=ntLtz
A&A&A&
q?&!@
vGa#@9n%GE]@E=
G`@<R
Lr!P<B
$_eJfGe
GIG`W&?&!P:=
<+y@<
H!X6qo<
~=2Gq&
!@4Zw]
&~OYO!Xw$
B]@!`>
lWi#@x
!Ez6_oVLX<
Wa!P:
lGi!X<
~qG]&A!P<J
:n%Ge#@xyzjg&c
We!!<s&D
q{JGq!D
FWa&:
VKH:
OA&A&A&
xxrsGeD~yhGu
Wi!@wo
~h_!p<
^GmP<
3q\>v\>w]>z
w_t&A&A&
>.WH:
VWi&:&Gv
B]@/^>
:Oi!K<R
V_t&A&A&A&
A&A&A&
V_t&A&A&A&
~eGi!X<
H!@6Vo>L
JWe&:
uGy@%Gu
n{G)jD`:I
_GlG&!H:V
G?&#@:
Ga!P:
qOuH%Gq
{O&]@
n;GlD`:y
_GlG&!H:V
G?&#@:
Ga!P:
qOuH%Gq
Z_t!H:g
Q&A&A&
nGnD`:
_GlG&!H:V
G?&#@:
Ga!P:
qOuH%Gq
Z_t!H:
GPx6Gm]@A_>
OQ#@:V
OQ!P<Z]@
G?&#@:
Ga!P:
qOuH%Gq
Z_t!H:Mc
GPx6Gm]@a_>
OQ#@:V
OQ!P<Z]@
G?&#@:
Ga!P:
qOuH%Gq
Z_t!H:}a
:j%GM#@:n
GvsD`
o&!H>
O&!P>
GYO&!P:
:%OM!!<
&e!P<zw]@
A&A&A&
nG9uD`:9
_GlG&!H:V
G?&#@:
Ga!P:
qOuH%Gq
Z_t!H:]
GPx6Gm]@
OQ#@:V
OQ!P<Z]@
G?&#@:
Ga!P:
qOuH%Gq
Z_t!H:\
A&A&A&
nGyD`:
_GlG&!H:V
G?&#@:
Ga!P:
qOuH%Gq
Z_t!H:
q&A&A&
:j%GM#@:n+G{D`
o&!H>
O&!P>
GYO&!P:
:%OM!!<
GE&)Q
lA&A&A&
G}D`:
_GlG&!H:V
G?&#@:
Ga!P:
qOuH%Gq
Z_t!H:=V
GPx6Gm]@
OQ#@:V
OQ!P<Z]@
G?&#@:
Ga!P:
qOuH%Gq
Z_t!H:mT
nGID`:)
_GlG&!H:V
G?&#@:
Ga!P:
qOuH%Gq
~]GI&x
Z_t!H:R
WQ#@:
!P<ZGP
H!@6Vpz<
~YGE@<
!mBpax
~%A&A&
~IGm!X<
i!P:Z
NWi&:
~QWm!4
~HG1!X<
YG!Uz>
?&!@:
w!x:X>
!P<zw]@
A&A&A&
~WeX:
~FGA!X<
"W=&:
IGM@%GI
B%GaE]@Q$=
.nw!@<t
w!x:X<
vU!P<J
!uBpDx
~HGM&!!P<zw
!Kz6ho<
!UnR&4`
Q&A&A&
{!Er6_o
k#A&A&A&
{!Er6_o
A&A&A&
A&A&A&
A&A&A&
?&L2no%<<
w_t&A&A&A&
xxr#G
~AWi!@wo
w!x:X4[
^GmP<
3q\>v\>w]>z
>.WH:
VWi&:&Gv
:Oi!K<R
Gq&q6
~y_V_y
&_A&A&A&
G=?&#@:
.*@<r+
G5O&&<>
W=!!G9
!E^Bp">
~G1zr
wc!@<L
O&~nx
GqFE]@
?&#@:9
v#!P<Z
vC#o(#)
O&~%.>
~9GI@<
!E^BpDx
!Kz6ho<
!mR&4`
R%G=#@:
:W<&x
*y^g}~Y6GY
W=!)<s
!k{|&)
G1O&&<
%W=!)G5#
!UnBp">
O&~a>
oD4v]@
G=?&#@:
.*@<r+
D%!P<F
W=!)G9#
!UnBp">
~G1zr
wc!@<\
O&~nx
G=?&#@:
.*@<r+
GG&!P
WM?&!@:
x@%G9
!@6Vo6<
A&A&A&<
!UnBp">
~G1zr
wc!@<\
O&~nx
Ry^[g}~]-GY
fWE@L@5Vo
v!~!s<
!UnBp">
O&~1>
oD4v]@
w]!@<\
G=?&#@:
.*@<r+
G5O&&<
W=!)G9#
!UnBp">
wc!@<\
y^.g}~&GY
qGM@<z(
6Vo2<Kw
!UnBp">
:p*@<w@<Z(
G9W&O&?&/&<
vGY!X4N
!mBpMx
f;w8!@<L
G=?&#@:Mw
.*@<r+
WG&?&!~
GIO&!P:
v!P<z!@t
!UnBp">
~G1zr
wc!@<\
:3q?&
3q?&~q&
?&~Y@:n
A&A&A&
_t&A&
w!x:Xxv
w!x:XxvC
XGO&&Q
_A&A&A&
XGO&&Q
_A&A&A&
XGO&&uP
_A&A&A&
XGO&&EP
_A&A&A&
:.G!$X4#v
xG7&:
&_!x:X>
!X:XA&A&
>?&~]V<&
_!p:Xxr:
<DW!5VpA#(
&_!p:Xj
&_!X:XA
:&Gm#@:
1k&A&A&
Gm#@:m
w!x:X:f
.__tO&#B
.__t&
v!!X:w_s
!p:XA&A&
GW&&
\G/&:
&_!x:X:
WW&?&O&/&!
<GW&w&!H:
&wX<4R}
`4(<L;mh<
:3qW&?&w&/&%
w!x:X>
3q?&W&/&
!p:XA&A&
GW&&
3q?&~
w!x:Xx0
~WeX:
B%GaE]@qY=
GE"G9!P<R
.OM!P4v
%=v$#(
~W&&
&2<+y;/m":
3w&o&
4#&wX<
.__t]&
A&A&A&
_p<G!p
3q?&W&7&
%&_!p<
GW&?&!@
YA&A&A&
A&A&A&:_!p<
!X:w!x:X<v
[H!X:
G?&!@
ty#_#@<G!p<
<:$m]:
:nw!X<
3q?&o&
!X:XxK
!X:w_sA&A&
4$$u4#
_tuo&!P
w!x:XA&A&
W_t&
+W&/&:
A&A&A&
w&o&
w!x:XA&A&A&
+W&/&:
A&A&A&
+rO&!@
<$<-W&/&:
A&A&A&
+W&/&:
A&A&A&
+W&/&:
A&A&A&
#WW&w&O&/&
!p:XA&A&
GW&?&!@
uV_t&A&
G=#@:Ngm&
04G9~c
G=O&!H
"GA#@:
"_1?&!P
GA#@:u
Gy?&!P
OG&!X
<_?&!v
OyG&!f
G?&!@
t&A&A&A&
:2<+y;/m.:
<+y:+=
!X:w!x:Xx5
V$Gy.D~mWQ!
~O&&5
GqE]@n=
GE!P4V
~Y~-Ya
G]&m#(
3z?&/&:
A&A&A&
WuV_t&A&A&A&
zYA&A&
2%GQE]@wp=
<{#@:a
!P:G5&
~WeX:
GM&]&O>
O&?&~
w!x:X>
W?&!@
t&A&A&A&
G?&!@
G?&!@
G?&!@
WuV_t&A&A&A&
zYA&A&
2%GQE]@t=
<{#@:Q
!P:G5&!X<
~WeX:
GM&]&O>
O&?&~
w!x:X>
W?&!@
t&A&A&A&
G?&!@
G?&!@
G?&!@
~~)@>
R%GqE]@
0_WQ#@:
~~)@>
R%GqE]@gx=
0_WQ#@:
:nV_t&A&A&A&
3q?&~i
!X:XA&A&A&
%_[nV_t
GW&&
3q?&/&%
)r&A&A&
wxxrGD~,4
3q?&
w!x:X>
Gi&i&
wxxrGfD~
~i_!p<
xxrG&D~
FVD3]J
>.W@>
_pxrGD~M
3q?&w&
w!x:X>
Gi&)&
wxxrGD~
Gi&i&
wxxrGfD~
FVD3q]J
A#@:!~
>.W@>
_pxrG&D~
3q?&w&
w!x:X>
wxxrGD~M
Gi&)&
wxxrGD~
FVD3q]
!#@:|
Gi&i&
xxrGfD~
qDo&W&
w!x:X>
wxxrG&D~
wxxrGD~M
Gi&)&
wxxrMGD~
3q?&
&#@:y
^Wm@:
wxxrYGD~
Gq&!X<
wxxrAGXD~
~xWm=
wxxrGG
3q?&
&}#@:mv
^Wm@:u
wxxrSG
Gq&i!X<
wxxr;GD~m
~EvWm=
Gq&!X<
xrvGD~
~Gq&!X<
xlvGD~
xfvGD~
XA&A&A&
G]gt&A&
WA&A&A&
XA&A&A&
G]JKlt&A&
XA&A&A&
G]bkt&A&
XA&A&A&
G]zkt&A&
QU<+&
+5hoF6yB<;#4:
o6p<?q:
,v\>V!>
Jr6<S_
Hw&&
#fG&#H:
w!x:X<
WO&!@
~!SZ4V3
G?&!P
+o&!P:
Gw&O&?&#@:
Y4v]&>
FWe]@=
~@:2
g"_!p<
rK2<;
!;6:3p
&$GA&
:nV_t&A&A&A&
ZWy!H4
~5FGhGu
~5GGm];2
$&A&A&A&
w&GEHx
RW=&\@]@
5qoLxb
W=!X<JS
%OA!DZ6_)
:YBW&Q
W5!@:S*
ovGQ!P
OA#@xS
Sr!S^:]R
!Nj$:_F
B]@![>
Wm=B<
7~R_!p<
.b^o;:Z
Gq&!@<&
_t&x
A&A&A&
5ho>6y
5ho*wO
4H!IR+
!AF+@4x#K
6?&~uEG!@<&
Xov6qpx
~O2o~%
aA&A&A&
._!YZ+
WO&/&=
Cs#=fo3py#pv
>@A2!IB+
W?&#>*:
P:G\>K\>LA
>j:_E
:E/_!p<
&A&A&A&
:GqVE]@>
OQ!LZ6h
GL!@4V#?q
%C!TN<;;
OQO&G&~G
!@:vE#q
.FBo!:>
<_w!s^<
f_Q!n^<c
&A&A&A&
VWu]@>
>N<;U]@
GO&?&!@:
;v_!p<
:_!p:X>
{}prL>V4
EEG\>K
&:_!p:Xj
,:\s\A&A&
%Gm!P<T!VZf:
grN_!p<
0v#o(#)
w!x:X1
w!x:XwO
4I!JR+
:{tt!BFk
'RP<Syr
,<_+X%n
:7!J^:W
O&!@:
#H<W+@:t#H<IO&W&&!B^nI
E~%B73q
A&A&A&
vGu!P4
vGu!P4
:&Gm#@:
E~-Gm]
^Gi!@x3
~&IK]@
:&Gm#@:
E~]Gm]CZ
w!x:X4[
^Gi!@x3
~&J]@
:&Gm#@:
w!x:X4[
^Gi!@x3
~&J]@
_?&!@
uV_t#q
7*uV_t&A&A&A&
n%G6E]@>
~&yv:
~Gm!X<
BrGm#@:zg~Gu
!H4WsN
RD%B)N
FRGe7#
\=w]=z
3q?&!):Z
Gm!P4Vs
'O]?&!@
vGu!H4Fo64v
:OU!K<
R~)]=zi?
Wm!H:R73
BrGm#@:z
"g~!Gu
!H4WsN
RD%B)N
~vGq&
^~H%~
BD>R!<
xw3@>
:Oa!K<
:Oi!K<
>WmG&!)Gu
#OY?&!@
vGu!H4Bo64v
:OQ!K<
6WU6R!<
FDFR!<
VWi&x
wz;&g~_i!P<
NE!!K<
_m!!Gu
=>_]!<
!@:9H
NG]!X<sWY>R!<
:Oi!K<sA&
n%GE@>
~xGq&
Gm!P4Vs
JDFR!<
Wm!H:R73
&A&A&A&
n%GE@>
Gm!P4Vs
JDFR!<
Wm!H:R73
&A&A&A&
VWi&xswz+g~]_i!P<
ENR!X<
%WY!X<!X<_]#q
E!X`Gi!P<qGa!=
:_a!K<
A&A&A&
uV_t&A&A&A&
~&9g:
~Gm!X<
R3NGPxRGq&x
xz.g~aGu
!H4WoN
!Wi!@<
xoZrOe
JWi?&
&Wm!!<
Wm!H:R7c
Ga&U&A&A&A&
RXNW!@
R~%H:
ROm\=v];vi?
xoZrOe
JWi?&
:^~%]<
A&A&A&
VWi&xxz1g~=Wi!H<!H<Om
:Oi!K<
Ge!P:
RDNR!<
VWi&xwz2g~
Wi!H<!H<Om
:Oi!K<
Ge!P:
~eGq&
RDNR!<
vG-E~Om
~)_!p<
Gm!P4Vo
vG.E~Om
w!x:X4[
Gm!P4Vo
TA&A&A&
VWi&:
B]@Z\>
ROm!!K<
w!x:X4[
.Z^o <
uV_t&A&A&A&
n%G&E]@1>
~&9]:
~Gm!X<
R3NGPxRGq&x
xz8g~aGu
!H4WkN
F]<rI?
`~OG!H
:^~!]<ri?
Ga&]&A&
R3NGPxRGq&xwz;:g~Gu
!H4WkN
F]<rI?
~a^Gq&
:^~!]<ri?
Ga&&A&
VWi&x
xz;g~]Wi!H<!H<Om
/JWm?&!
O?&!@:
uOyH%Gu
:Oi!K<
NA&A&A&
VWi&xwz<g~
Wi!H<!H<Om
JWm?&!Gu
!H:v]@
Wi!H<!H<Om
vG^6E~Om
w!x:X4[
vGf7E~
#@:!*
VWi&:
B]@B\>
ROm!!K<
#@:!)
A&A&A&
G?&!@:
G?&!@:
G?&!@:
G?&!@:
A&A&A&
wxxrG<E~Gm!P:
%GY&x
Wa?&
qWY&x
wxxrG6=E~
%GY&x
qWY&x
:&Gm#@:
xxrG>E~Gm]"N~
~$Gm&mS#@:#
^Ge!@:
:&Gm#@:
xxrG<?E~
Gm]"N~
~#Gq&-!X<
JGi&5
?CA&A&A&
:&Gm#@:
xxrG@E~-Gm]"N~
#Gq&m!X<
JGi&u
BA&A&A&
XA&A&A&
~_sA&
&A&A&A&
^DA&A&A&
_t&A&A&
^DA&A&A&
A&A&A&
w_t&A&A&
K*zyYA&
XA&A&
&&A&A&
Gt#X<>G&
Gt#X<~
&/B%AI
VWi&:
!P<WiO&!P:Gu
;7_!p<
^W@:
&'uV_t&A&A&
=A&A&A&
y<A&A&A&
uQA&A&
XA&A&
G?&!@:
3W&?&!@:q
G?&!@:
3zG&?&!@:q
A&A&A&
G]z+t&A&
wxxr3GVKE~
~YGm!P:
wxxr+GME~Gi!P:
Gi&k]@
~XGm!P:
A&A&A&
G]k t&A&
G]K t&A&
?A&A&A&
A&A&A&
XA&A&A&
!;4G&E
R!3q#P4
?&~}GT
6qJaF.
nO!~=":
<~O&!N
~QygYa
'n,:f>
G?&!b
>3&:K
A&A&A&
XA&A&A&
XA&A&A&
XA&A&A&
A&A&A&
G]rkt&A&
GE]@e>
Gi&W]@
3q!P:
~)H\A&A&
Gi&aU]@
~F\A&A&
A&A&A&
GE]@u>
Gi&QQ]@
E\A&A&
3q!P:
~C\A&A&
A&A&A&
!;4G&s
R!3q#P4
n~W&!<
nO!~=":
D&}+z>.
~!G&i
R!3q#P4
G?&!b
!fG&!j>
6VpX<+
\;EA&A&
\;EA&A&
~_V_'&
!;4G&%i
R!3q#P4
?&~]GT
n~W&!<
nO!~=":I
D&"z>.
~aG&i
R!3q#P4
G?&!b
!fG&!j>
6VpX<+
\;EA&A&
\;EA&A&
A&A&A&
G]"{t&A&
A&A&A&
G]b+t&A&
W/&:
#N:~V
#N:~V
O&G&K
oW4%,1
#N:~V
#N:~V
A&A&A&
wxxrG|E~}Q,4
~%R_!p<
wxxrGV|E~P,4
FVD]"Z
RD#@:1
Gi&P&
wxxrG
~P_!p<
wxxrG~E~mO,4
FVD]"Z
RD#@:
Gi&YN&
:&Gm#@:
xxrGv~E~NGm]"q
Gq&H!X<
Gi&N&
:&Gm#@:
xxrG)
E~NGm]"q
~N_!p<
:&Gm#@:
E~MMGm]"q
~M_!p<
A&A&A&
G]Bkt&A&
G]BKt&A&
A&A&A&
wxxrGE~=K,4
RD#@:
Gi&)J&
wxxrwGE~J,4
RD#@:
Gi&yI&
wxxr}GFE~I,4
RD#@:A
Gi&I&
wxxrqGE~-I,4
RD#@:
:&Gm#@:
xxrGE~}HGm]q
Gq&B!X<
Gi&YG&
:&Gm#@:
xxrGiE~GGm]q
~eH_!p<
:&Gm#@:
~G_!p<
>.W@>
E~]F,4
7Gq&@!X<
A&A&A&
wxxr%GE~E,4
w!x:X4[
Gi&D&A&A&
GME~D,4
~E_!p<
A&A&A&
>&W@>
~4Gq&]=!X<
oA&A&A&
wxxrG
E~]C,4
w!x:X4[
Gi&AB&A&A&
GE~B,4
~AC_!p<
A&A&A&
A&A&A&
oA&A&A&
G]t&A&
n%W]@I`>
VWiHx
!H:X,<JK
!H:X,<JK
Oe!P<R1
Gq&]8
Z_t!6V
O!=r:k_t&A&A&A&
T>v:U%!X<
G!Ez6_o"6
4^&A&A&
_@>ZGUP:&
2WQ?&#@:
GM!P:
G&#@:
x!P:v#@:i
W!Sz:s3&:
:nV_t&A&
>~a!X_u
aV|_:
f{}&ERj:
G#X:(
&G#B&:<
?&~9VI&2
)A&A&A&
:3@>vGq&:
B]@f`>
~9_!p<
A&A&A&
\>v\>w]>z
V_t&A&
3@>vGqx
XxrG]E~7Gu
!@:]F
~q8_!p<
A&A&A&
\>v\>w]>z
V_t&A&
?A&A&A&
G]bt&A&
G]bt&A&
A&A&A&
G]zt&A&
A&A&A&
G]kzt&A&
G]Kzt&A&
]~bA#(
Z_t\@!p
o&O&?&~IB:f
4wEQ4;
T+;&zz
Z_tG&
L@:+sO&!P
GsW&?&!@
&y&:\^
O?&!@&:
G&qIo&
H@nm<6
4A&A&A&
VGyiE`:9
!>z:XGE!;
%<WQ!)<
vW]#@:
$G@G@<t&
wxxrcG>E`:
wxxrGE`:
GE`:1
G~E`:q
wxxr#G>E`:
wxxrSGE`:
wxxrCGE`:1
wxxrG~E`:q
wxxr3G>E`:
wxxrGE`:
wxxrGE`:1
wxxrG~E`:q
wxxrsG>E`:
4&U4_!p:X
4&wU4_!p:X
4&7U4_!p:X
4&T4_!p:X
4&T4_!p:X
4&wT4_!p:X
4&7T4_!p:X
4&S4_!p:X
4&S4_!p:X
4&wS4_!p:X
4&7S4_!p:X
4&R4_!p:X
4&R4_!p:X
OQ#@:Ut
!P<J!@
`LP:.
q"!H>-4x
<3!PT<v<
OAO&!P:
*WQ!H<Z
!uBpr>
w8!@<t
;vGY!H4"o;4v]@
q~~&OI#O&
!@TLv<
WMo&W&?&G&!GY
v*OA!P<
G&!=2x
@%WM!!<
!Kz6ho<
!UnR&4`
wf!@<|
:_t&A&A&
_t&A&A&
E%!X:w_t
?&~A5E&
E%!X:w_t&A&
~Wux:
R%GqE]@
2GO&!P
EP&GI>
0rWE#@:
O&A&A&A&
~~)@>
R%GqE]@
~GQA&A&A&
:6GUP:&
_GG&!Hl
W&G&&
OM&:
EH&OE
~O&&
v&A&A&A&
:Gq2E]@
GTG&&x
4Vgnw?&
&A/&x
~WM!!<sr@<
!~&C=.
:XG1!;
!p<6!;*x
&*&GU&Y
*&*%rwM!
*OE/&:
/&<>
Wi!)<s6D~
!X6qo<
JWe&:
uGy@%Gu
:_t&A&A&
_t&A&A&
E%!X:w_t
?&~+E&
E%!X:w_t&A&4
]eA&<
UA&A&A&<
A&A&A&<
%A&A&A&<
EA&A&A&<
A&A&A&<
A&A&A&<
bA&A&A&<
edA&A&A&<
nA&A&A&<
oA&A&A&<
5xA&A&A&<
%yA&A&A&
dqMw
5z$`v`t#
`t$jpmt
qvhc)ggoj
k$iq%qc
og#dpdn
nv#ii\v\u
nv#ii^q
]c$^a$
]c$^a$
mk5<#ng#
nv#ii`t
nv#ii\u$bp\u
]c$^a$
`t%]c$^a$
mk5<#nk+
nv#iiZU
]c$^a$
nv#ii\u
5u&nv#
mq(rq#n"
mq(rq#n"
jt*^c%bq#
nv#iiZO
5' UC<'
nv#iiZO
KG>aHG
sZ-519\d
`h-519<D@H&z
,4084c
NVNVNVNVNVNVNV@VNV@VNV
]g#Je%
]g#Iq'hd
5' U<OH
pt$\{mk
ow#\{ppjppg`fcwmk\v\p&m{`d#
\t*Hc#c
Hc*EwL&
ii(hu*
*o%ma$
DD>Y(G-/
(-a$\t
`t%jp u
^qdi.:r5nj
Z w=_[X=<4\
b<yHms3/@LE \
\u$o{!ZkjG
ig*]c$
]{hg@
ii%Zg#
o3cc#ot
o3nv#\o
jtNv^j
Zv#dv$^G
jtNv^j
Zv#dv$^G
_g#gq(`t#
hqtr&
hqtr&
^x%\d$
2e `e'
hd&Zk%mc%
o3cc#ot
hd&Zk%mc%
o3cc#ot
o3nv#\o
jtNv^j
Zv#dv$^G
jtNv^j
Zv#dv$^G
juNv^j
Zv#dv$^G
4g)`r%jp
`vNvdu%
og#oq#^U%,e
pvNvju%
og#oq#^U%,e
gq$Fg*
Kt `u$
`Ak<v
ov#]w%nC
Bg%\u%mt
Bg%jf&
Bg%jf&
1Bg%oc#
Dp%mn fg
`e#hg
Dp%mn fg
ie#hg
jNg%dn
ov#]w%nC
vNg%\u%mt
On$gn
"Zy#og
Za!Zg
Zk$o{!
Zqsk%
Hnv#\v
Jnv#hr
Knv#jn
Lnv#k{
Onv#ok
MP.4gn
Zc%sk%[
nqgk%
s R:MsN8xH3y@
CCCCCCCCCCCCCC
AAAAAAAAAAAAAAAAAAAAA
AAAAAAAAA
AAAAAAAAAAAA
AAAAAA
CCCCCC
CCCCCC
?@FHIMZEMLLPQRQUXasyMYSY\Y]^o`gST[[\]^dreiclimilelrq}blinaququ~x_dcinoilhourvyz|ty~rvq}_^YZ]abeadkcvrvynaefiniilq}szpt}suvruy}yy{~
>BCSEINZTZQNSPUS\acbf]Y_WX[]Y\]YY^Wcjnehnbdqszv{bks}{|TZ]XYfbgjnkaov{sr{KMW[QUX^[`eafjnmut{bbeimzrq{y}pvvtrvy|y~
]CKEINDTEGLJ[NNRVV]RV\dahn`tNZ]Q^_agceidkox
r~yV[`finmppvr}mpusz}y}
VS_VERSION_INFO
StringFileInfo
040904E4
CompanyName
Microsoft Corporation
FileVersion
1.0.0.155
FileDescription
Mira Malware
InternalName
LegalCopyright
Microsoft Corporation
LegalTrademarks
OriginalFilename
ProductName
Mira Malware
ProductVersion
1.0.0.155
VarFileInfo
Translation

Process Tree

0ae010034d3b6a1de31da8d8b99b7d4d670b5faff770ee1ddaf54399ceeb358b.exe, PID: 844, Parent PID: 1860

default registry file network process services synchronisation iexplore office pdf

gprpl.exe, PID: 2064, Parent PID: 844

default registry file network process services synchronisation iexplore office pdf

DNS

Name Response Post-Analysis Lookup
dns.msftncsi.com A 131.107.255.255 131.107.255.255
dns.msftncsi.com AAAA fd3e:4f5a:5b81::1 131.107.255.255

TCP

Source Source Port Destination Destination Port
195.29.173.139 25 192.168.56.101 49254

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 56933 114.114.114.114 53
192.168.56.101 138 192.168.56.255 138

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Name fa61da3336cf7ce9_install.exe .exe
Filepath C:\install.exe .exe
Size 596.7KB
Processes 2064 (gprpl.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 85fbeef9a518287966833f54c1a2fe18
SHA1 456631ea9fa7e2918bf6e972dc73119ee831baa0
SHA256 fa61da3336cf7ce9edb4102734ff2816d6c864593563a88aacfb785d9057520d
CRC32 54C5F9C3
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name da1b2c22578083cb_install.ini .exe
Filepath C:\install.ini .exe
Size 596.7KB
Processes 2064 (gprpl.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 7a2f5680693888a30b0036b6b513b4c1
SHA1 5e9b2e80ac13726cd5d19a3ad3ab380d4157cc0d
SHA256 da1b2c22578083cb64bcec5e13c80708f58debd1e4560de86af0692112e3f7c7
CRC32 F64A80CA
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 52cf0edf0af2486b_windows .exe
Filepath C:\Windows .exe
Size 596.7KB
Processes 2064 (gprpl.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 67ab04c232ab3b279995aaccee67bf2b
SHA1 fda0e00156d4f1a21b848b1972dce98b1a000910
SHA256 52cf0edf0af2486b7745b76e8e5a4130f536fbfefb96d35149cf47f122c6d625
CRC32 85978088
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name d8799f4f58eddd4e_gcoxh .exe
Filepath C:\gcoxh .exe
Size 596.7KB
Processes 2064 (gprpl.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 5bb974f17999e27cff5f03a8b1f6dc64
SHA1 b271ffd2d498e259e6ae945fd004fe7c8fca0551
SHA256 d8799f4f58eddd4e1e028d3f610de8a798de9e3299f327198ab5f8435629279e
CRC32 9FFA7D5D
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name e3b0c44298fc1c14_Mirat
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name ef2a27df7e4bea5c_program files (x86) .exe
Filepath C:\Program Files (x86) .exe
Size 596.7KB
Processes 2064 (gprpl.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 9dcb09e46b2dcd0c751d16044c87aaf6
SHA1 69e6dca6ed75e0bd0d5df810142120750ee990cc
SHA256 ef2a27df7e4bea5c10f68e540f83c2b5c7d2f60911bc3a5ae1855df51932d353
CRC32 A10926BB
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 56847f75716de3f8_globdata.ini .exe
Filepath C:\globdata.ini .exe
Size 596.7KB
Processes 2064 (gprpl.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 8bfaa8e53b383ea99ed32ad818230fca
SHA1 91adb43ea48019859c77251c972b724b291e8e0f
SHA256 56847f75716de3f8381e1c684d8478bbd08a834b5580f5ee537e8ac18d5fdf2f
CRC32 66C8F84B
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name e920e62f6b76bc2d_eula.2052.txt .exe
Filepath C:\eula.2052.txt .exe
Size 596.7KB
Processes 2064 (gprpl.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 80105cce3131eb379c27a44d6d9b9b27
SHA1 aa48330ea478e45bfc9007e629a08b6acd9d5194
SHA256 e920e62f6b76bc2d7b9d78a414bb72585222a3a4f3f3764f3cf18a1946755181
CRC32 DF54E573
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 8b839658cbf9a3bd_vc_red.msi .exe
Filepath C:\VC_RED.MSI .exe
Size 596.7KB
Processes 2064 (gprpl.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 c762f5553d960f523eb8f235c717a0eb
SHA1 99255ce5b41c2c441bca666ae2eaebe27bd74ef6
SHA256 8b839658cbf9a3bd9ee36e245a601d24295625c7c98df2d02b02c0a5d77935a3
CRC32 A8566926
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 712756b959dd0aac_vc_red.cab .exe
Filepath C:\VC_RED.cab .exe
Size 596.7KB
Processes 2064 (gprpl.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 44dcfe9ff3ea2a68f8dab42f6158ec1e
SHA1 2b9b6d501f344d8d1ceff550ce55ce485abc1410
SHA256 712756b959dd0aac4f972df2817d1586edbdf65dc6afc7685e7295bbf4a0fee1
CRC32 FA5D1B82
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 3ab5534dff8eb54a_system volume information .exe
Filepath C:\System Volume Information .exe
Size 596.7KB
Processes 2064 (gprpl.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 d29cd2faeea3ea1c8367543b933d1ebf
SHA1 43df452b685233d44811cba67fb0f97f0306af70
SHA256 3ab5534dff8eb54ace4c1572dcc20cdf5edbdc45e0d5ccea1dafca8a965aa72e
CRC32 65FA483B
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name f409d9e41fb697c9_gprpl.exe
Filepath C:\ProgramData\gprpl.exe
Size 263.0KB
Processes 844 (0ae010034d3b6a1de31da8d8b99b7d4d670b5faff770ee1ddaf54399ceeb358b.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 d9be4f37a2ce57f79ca16c21ab96ed29
SHA1 ae32a6c2a53c05615c4d1111e6a4f95eeb00d822
SHA256 f409d9e41fb697c9d9ec4e6f4ba4d0c75deef1f0699eedf0345e8d190a798cff
CRC32 CEF9EEF3
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name adc5b4a8e957cd9b_pagefile.sys .exe
Filepath C:\pagefile.sys .exe
Size 596.7KB
Processes 2064 (gprpl.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 ebd5fe2baf517680e8eef41338222932
SHA1 8f03c9745c92f3c262451bfd1e428ad837976489
SHA256 adc5b4a8e957cd9bd4cc78e50cfea1baa69e159b63923f3705e173b2c245f010
CRC32 685863FA
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 5427f6f52df3a882_$recycle.bin .exe
Filepath C:\$Recycle.Bin .exe
Size 596.7KB
Processes 2064 (gprpl.exe) 844 (0ae010034d3b6a1de31da8d8b99b7d4d670b5faff770ee1ddaf54399ceeb358b.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 74a51ab762b9cb18726b3b77caa5615e
SHA1 535634c4e88b7fc588082f48c4651a359898a91d
SHA256 5427f6f52df3a88251ff6b3831249f173efe5d2375ef7faf755e986596e0efb9
CRC32 C6B317F7
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name d453956ee2a5385e_programdata .exe
Filepath C:\ProgramData .exe
Size 596.7KB
Processes 2064 (gprpl.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 effc35ef22ecc2fbb21aaafcc29c7973
SHA1 313202c6ebf149007e7ee185b61aa004389af441
SHA256 d453956ee2a5385e2133b4eea10f8eba50b5b5a4cbe96bf3544144c56199f8d5
CRC32 07CBB99D
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 6aa7d55bc7df1b0f_360downloads .exe
Filepath C:\360Downloads .exe
Size 596.7KB
Processes 2064 (gprpl.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 e26bd9ec2edd23c83ecc715437c69104
SHA1 d6fd0721785c2b737d2ac2ede96d66554a8fbbaf
SHA256 6aa7d55bc7df1b0f54321411e53fa6abdb6768c0c8ca005e6322f8f8c5477a4b
CRC32 5CBD84A0
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name d35ed43e34f58c71_documents and settings .exe
Filepath C:\Documents and Settings .exe
Size 596.7KB
Processes 2064 (gprpl.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 bfb2e9d3424a9588ca6a0eee201bdb05
SHA1 4283c3e81b12c0bca24c06329325c075be06e072
SHA256 d35ed43e34f58c71279120e55191de839428140b1bb5e54479703a6ec3bb8e98
CRC32 B97CB138
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 6448fd4d87ce269f_mira.h
Filepath C:\ProgramData\Saaaalamm\Mira.h
Size 333.7KB
Processes 844 (0ae010034d3b6a1de31da8d8b99b7d4d670b5faff770ee1ddaf54399ceeb358b.exe) 2064 (gprpl.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 6487b60c4adb548ca2f03253ea0e9b9f
SHA1 a7d2d82b575392666e7a112f40b7f3668655b384
SHA256 6448fd4d87ce269f9d821c6ddbecaa2468268381bab8503a01add71f9aec5695
CRC32 DBD1C585
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name e2cdca1686745b6d_install.res.2052.dll .exe
Filepath C:\install.res.2052.dll .exe
Size 596.7KB
Processes 2064 (gprpl.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 d54d1ff177f60c83f65c2f37b2ee4a58
SHA1 0087af26e08b9c215c7bc1534d1314f6262885dc
SHA256 e2cdca1686745b6d38ca8c9117d3126f1db7d4dd63faae2b14ecb1ec8f0981fd
CRC32 43F11CF5
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name c720aadc76687070_xrmmmhqyvr .exe
Filepath C:\xrmmmhqyvr .exe
Size 596.7KB
Processes 2064 (gprpl.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 cdc5b6460ae8d9ff74bbefc1ede4b15b
SHA1 1e6d373758e437a6a85ff9b30b4068fc7d899204
SHA256 c720aadc766870707e15ac0cc547f97c8cc0938d371d14c2dfb8769d62acbef0
CRC32 02E6D329
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name a44970c57f2f6a77_program files .exe
Filepath C:\Program Files .exe
Size 596.7KB
Processes 2064 (gprpl.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 1b354b9dc01dbbd0b0e1550b5385cd46
SHA1 1162665d20980756c3fdd56311640bee1ef945bf
SHA256 a44970c57f2f6a770166e499cc3d2d26b078066e6145b8a72a3c411909917686
CRC32 CAE2D22F
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name fe0cbb1651c85005_recovery .exe
Filepath C:\Recovery .exe
Size 596.7KB
Processes 2064 (gprpl.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 ec4811899713463011d3f27da433c245
SHA1 0a50e62358aec51bee40e75150cb10bd79d32295
SHA256 fe0cbb1651c8500509a57453b1e0721f8c79d38bad449edbdde3f9a0b134afd1
CRC32 6BE7FC7E
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 0c4576f6b25a2520_users .exe
Filepath C:\Users .exe
Size 596.7KB
Processes 2064 (gprpl.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 11e85fe305fe1219aa0735cbf3bc9285
SHA1 29843bf5f9f69c47371cc3f1f215228ad1abcfac
SHA256 0c4576f6b25a2520b883fdf6000e147cabbc977c000da03c4e88cb4e2ba3262d
CRC32 3E281E95
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 60ffeebd92c29103_vcredist.bmp .exe
Filepath C:\vcredist.bmp .exe
Size 596.7KB
Processes 2064 (gprpl.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 08aa752aef785ba818c12bdd2d47cdf9
SHA1 d6db3c027866a1f286642e52ef4e681867d45327
SHA256 60ffeebd92c29103513c38cef6a51845d1c28497c6aa84ca6192ea60dba2e810
CRC32 4B7D9F37
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 66191b9bf8926a63_python27 .exe
Filepath C:\Python27 .exe
Size 596.7KB
Processes 2064 (gprpl.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 6e87a3016b8a7652fd9cb10079e23f20
SHA1 3c99bdf4cb451bc5ca03c3eb7795ba0557c1420c
SHA256 66191b9bf8926a63230d6f8161f88b27429c0180cee94aec38543764ffc274ec
CRC32 DCB637C1
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 2eae416101ed0f6a_perflogs .exe
Filepath C:\PerfLogs .exe
Size 596.7KB
Processes 2064 (gprpl.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 0e624a1682bcf7d4de489b415d294f15
SHA1 4fb051f1f02ed6f7de5b5925c07c2e61986c9f4a
SHA256 2eae416101ed0f6a0c0aaaa77b03caa8eb6da7001eefd2d8070e88a52979e97e
CRC32 98EEFF9E
ssdeep None
Yara None matched
VirusTotal Search for analysis
Sorry! No dropped buffers.