2.2
中危
61 个模型检测该样本为恶意！
重新分析
更多

073edd98f5b792f405b9d00718685ce715e20753276a75523dddfb96a95eaaa2

073edd98f5b792f405b9d00718685ce715e20753276a75523dddfb96a95eaaa2.exe

分析耗时

134s

最近分析

381天前

文件大小

560.0KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN WORM MIRA
鹰眼引擎
DACN 0.14
FACILE 1.00
IMCLNet 0.77
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:MalOb-KU [Cryp] 20200713 18.4.3895.0
Baidu Win32.Worm.Mira.c 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Kingsoft None 20200713 2013.8.14.323
McAfee W32/Worm-GAT!D0AEDFB474E3 20200713 6.0.6.653
Tencent Worm.Win32.Mira.a 20200713 1.0.0.1
静态指标
检查系统中的内存量，这可以用于检测可用内存较少的虚拟机 (1 个事件)
Time & API Arguments Status Return Repeated
1727545309.547375
GlobalMemoryStatusEx
success 1 0
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报） (4 个事件)
section strings4
section INIT
section .NewSec
section __data
行为判定
动态指标
在文件系统上创建可执行文件 (24 个事件)
file c:\PerfLogs .exe
file c:\VC_RED.cab .exe
file c:\VC_RED.MSI .exe
file c:\Program Files (x86) .exe
file c:\globdata.ini .exe
file C:\ProgramData\oddpvk.exe
file c:\Recovery .exe
file c:\install.ini .exe
file c:\eula.2052.txt .exe
file c:\System Volume Information .exe
file c:\Windows .exe
file c:\ProgramData .exe
file c:\$Recycle.Bin .exe
file c:\gcoxh .exe
file c:\vcredist.bmp .exe
file c:\Users .exe
file c:\install.res.2052.dll .exe
file c:\Program Files .exe
file c:\360Downloads .exe
file c:\Python27 .exe
file c:\Documents and Settings .exe
file c:\install.exe .exe
file c:\pagefile.sys .exe
file c:\xkyysllas .exe
创建隐藏或系统文件 (25 个事件)
Time & API Arguments Status Return Repeated
1727545309.625375
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\ProgramData\oddpvk.exe
filepath_r: C:\ProgramData\oddpvk.exe
success 1 0
1727545312.172375
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: C:\ProgramData\Saaaalamm\Mira.h
filepath_r: C:\ProgramData\Saaaalamm\Mira.h
success 1 0
1727545313.109375
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\$Recycle.Bin
filepath_r: c:\$Recycle.Bin
success 1 0
1727545315.094375
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\360Downloads
filepath_r: c:\360Downloads
success 1 0
1727545317.219375
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\Documents and Settings
filepath_r: c:\Documents and Settings
success 1 0
1727545319.281375
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\eula.2052.txt
filepath_r: c:\eula.2052.txt
success 1 0
1727545321.422375
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\gcoxh
filepath_r: c:\gcoxh
success 1 0
1727545323.265375
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\globdata.ini
filepath_r: c:\globdata.ini
success 1 0
1727545325.359375
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\install.exe
filepath_r: c:\install.exe
success 1 0
1727545327.390375
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\install.ini
filepath_r: c:\install.ini
success 1 0
1727545329.578375
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\install.res.2052.dll
filepath_r: c:\install.res.2052.dll
success 1 0
1727545331.672375
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\pagefile.sys
filepath_r: c:\pagefile.sys
failed 0 0
1727545334.031375
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\PerfLogs
filepath_r: c:\PerfLogs
success 1 0
1727545336.125375
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\Program Files
filepath_r: c:\Program Files
success 1 0
1727545338.344375
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\Program Files (x86)
filepath_r: c:\Program Files (x86)
success 1 0
1727545340.437375
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\ProgramData
filepath_r: c:\ProgramData
success 1 0
1727545342.609375
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\Python27
filepath_r: c:\Python27
success 1 0
1727545344.937375
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\Recovery
filepath_r: c:\Recovery
success 1 0
1727545347.375375
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\System Volume Information
filepath_r: c:\System Volume Information
failed 0 0
1727545349.859375
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\Users
filepath_r: c:\Users
success 1 0
1727545352.281375
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\vcredist.bmp
filepath_r: c:\vcredist.bmp
success 1 0
1727545354.515375
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\VC_RED.cab
filepath_r: c:\VC_RED.cab
success 1 0
1727545356.828375
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\VC_RED.MSI
filepath_r: c:\VC_RED.MSI
success 1 0
1727545359.156375
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\Windows
filepath_r: c:\Windows
success 1 0
1727545361.390375
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath: c:\xkyysllas
filepath_r: c:\xkyysllas
success 1 0
投放一个二进制文件并执行它 (1 个事件)
file C:\ProgramData\oddpvk.exe
该二进制文件可能包含加密或压缩数据，表明使用了打包工具 (2 个事件)
section {'name': '.NewSec', 'virtual_address': '0x0004e000', 'virtual_size': '0x00001000', 'size_of_data': '0x00001000', 'entropy': 7.179229701561729} entropy 7.179229701561729 description 发现高熵的节
section {'name': '__data', 'virtual_address': '0x0004f000', 'virtual_size': '0x00010000', 'size_of_data': '0x00003600', 'entropy': 7.0363966999482805} entropy 7.0363966999482805 description 发现高熵的节
网络通信
与未执行 DNS 查询的主机进行通信 (2 个事件)
host 114.114.114.114
host 8.8.8.8
在 Windows 启动时自我安装以实现自动运行 (1 个事件)
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Microsoftﾮ Windowsﾮ Operating System reg_value C:\ProgramData\oddpvk.exe
文件已被 VirusTotal 上 61 个反病毒引擎识别为恶意 (50 out of 61 个事件)
ALYac Trojan.Agent.CCPK
APEX Malicious
AVG Win32:MalOb-KU [Cryp]
Acronis suspicious
Ad-Aware Trojan.Agent.CCPK
AhnLab-V3 Worm/Win32.Miram.C3452050
Antiy-AVL Trojan/Win32.Agent.icgh
Arcabit Trojan.Agent.CCPK
Avast Win32:MalOb-KU [Cryp]
Avira TR/Zusy.BQ
Baidu Win32.Worm.Mira.c
BitDefender Trojan.Agent.CCPK
BitDefenderTheta Gen:NN.ZexaF.34132.JGZ@a4ldQgki
Bkav W32.FamVT.MiraVM.Worm
CAT-QuickHeal Trojan.AgentPMF.S8083785
ClamAV Win.Trojan.Agent-1388655
Comodo Worm.Win32.Mira.AA@59ticr
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.474e3a
Cylance Unsafe
Cynet Malicious (score: 100)
Cyren W32/S-e40ac5b2!Eldorado
DrWeb Win32.HLLO.Siggen.5
ESET-NOD32 Win32/Mira.A
Emsisoft Trojan.Agent.CCPK (B)
Endgame malicious (high confidence)
F-Prot W32/S-e40ac5b2!Eldorado
F-Secure Trojan.TR/Zusy.BQ
FireEye Generic.mg.d0aedfb474e3a0ff
Fortinet W32/Mira.9C5!tr
GData Win32.Worm.Mira.D
Ikarus Trojan.Minggy
Invincea heuristic
Jiangmin Trojan/Agent.iezf
K7AntiVirus Trojan ( 0056560b1 )
K7GW Trojan ( 004993691 )
Kaspersky Trojan.Win32.Agent.icgh
MAX malware (ai score=82)
Malwarebytes Worm.Mira
McAfee W32/Worm-GAT!D0AEDFB474E3
MicroWorld-eScan Trojan.Agent.CCPK
Microsoft Worm:Win32/Mira!rfn
NANO-Antivirus Trojan.Win32.Zusy.ethqlz
Panda W32/Milam.A.worm
Qihoo-360 Worm.Win32.Mira.A
Rising Worm.Mira!1.A270 (RDMK:cmRtazqsvCg3YpD4iIBu7G6BJX9H)
Sangfor Malware
SentinelOne DFI - Malicious PE
Sophos W32/Mira-B
Symantec W32.SillyFDC
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2014-02-27 14:41:59

PE Imphash

dbf687d6aa2a6cafe4349f7b0821a792

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
strings4 0x00001000 0x0003c000 0x0003c000 6.080451775497244
INIT 0x0003d000 0x00001000 0x00000200 1.219839492304036
.rdata 0x0003e000 0x00003000 0x00002600 5.008530245268908
.bss 0x00041000 0x00005000 0x00000000 0.0
.idata 0x00046000 0x00001000 0x00000a00 4.294939157790109
.rsrc 0x00047000 0x00007000 0x00006800 6.000275775347418
.NewSec 0x0004e000 0x00001000 0x00001000 7.179229701561729
__data 0x0004f000 0x00010000 0x00003600 7.0363966999482805

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x0004cfec 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0004cfec 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0004cfec 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0004cfec 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0004cfec 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0004cfec 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0004cfec 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0004cfec 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0004cfec 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_GROUP_ICON 0x0004d454 0x00000084 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_VERSION 0x0004d4d8 0x000002e0 LANG_ENGLISH SUBLANG_ENGLISH_US None

Imports

Library KERNEL32.dll:
• 0x4461b8 AddAtomA
• 0x4461bc CreateDirectoryA
• 0x4461c0 CreateProcessA
• 0x4461c4 CreateSemaphoreA
• 0x4461c8 DeleteFileA
• 0x4461cc ExitProcess
• 0x4461d0 FindAtomA
• 0x4461d4 GetAtomNameA
• 0x4461d8 GetCommandLineA
• 0x4461dc GetLastError
• 0x4461e0 GetModuleFileNameA
• 0x4461e4 GetModuleHandleA
• 0x4461e8 GetStartupInfoA
• 0x4461f4 ReleaseSemaphore
• 0x4461f8 SetFileAttributesA
• 0x4461fc SetLastError
• 0x446204 Sleep
• 0x446208 TlsAlloc
• 0x44620c TlsFree
• 0x446210 TlsGetValue
• 0x446214 TlsSetValue
• 0x446218 WaitForSingleObject
Library msvcrt.dll:
• 0x446224 _fdopen
• 0x446228 _read
• 0x44622c _strdup
• 0x446230 _write
Library msvcrt.dll:
• 0x44623c __getmainargs
• 0x446240 __mb_cur_max
• 0x446244 __p__environ
• 0x446248 __p__fmode
• 0x44624c __set_app_type
• 0x446250 _assert
• 0x446254 _cexit
• 0x446258 _ctype
• 0x44625c _errno
• 0x446260 _fstati64
• 0x446264 _iob
• 0x446268 _isctype
• 0x44626c _lseeki64
• 0x446270 _onexit
• 0x446274 _pctype
• 0x446278 _setmode
• 0x44627c _strnicmp
• 0x446280 _vsnprintf
• 0x446284 abort
• 0x446288 atexit
• 0x44628c fclose
• 0x446290 fflush
• 0x446294 fopen
• 0x446298 fprintf
• 0x44629c free
• 0x4462a0 localeconv
• 0x4462a4 malloc
• 0x4462a8 memchr
• 0x4462ac memcpy
• 0x4462b0 memmove
• 0x4462b4 memset
• 0x4462b8 rand
• 0x4462bc setlocale
• 0x4462c0 setvbuf
• 0x4462c4 signal
• 0x4462c8 srand
• 0x4462cc strcat
• 0x4462d0 strcmp
• 0x4462d4 strcoll
• 0x4462d8 strcpy
• 0x4462dc strftime
• 0x4462e0 strlen
• 0x4462e4 strtod
• 0x4462e8 strxfrm
• 0x4462ec time
Library SHELL32.DLL:
• 0x4462f8 SHGetFolderPathA
• 0x4462fc ShellExecuteA
L!This program cannot be run in DOS mode.
strings4
.rdata
.idata
.NewSec
__data
E;Es9}
<t6p t<~@tO
x7EZ[^_]
UW1V1S
eEEE$@
++CCUNG
pP EtB(dB$
R \tp@$
hUhU`hu
llU6hU(Et
E!t#XtEXM~t
$]u}E$@
UpPl1|pl
;u ]]$}}
4$Yt8M
]1u}];] tIF
UWVS|U$E
E|[^_]
1|[^_]
UWVSL}
$DtbEN
UEXEE]u}E
++C B4CUNGB
t-S4C0
UEhEE]u}E
E]u}]E
UEhEE]u}E
tB1u2=C
UEXEE]u}E
80S4C0
t(S4C0
x9JtD|IS
]uEEEE
]uEEEE
]uEEEE
UUWVSLE
$UE@M@
$IMEQh$9t
$YMEQh$9t
$iMEQh$9t
]u}EEUE
Pht%$9t
UE]PhXdE
$]u}E$@
|u9EEP@
$]u}E$@
tuHxEE
$]u}E$@
tuHxEE
$]u}E$@
tuHxEE
$]u}E$@
tuHxEE
$]u}E$@
tuHxEE
$]u}E$@
tuHxEE
$]u}E$@
tuHxEE
$]u}E$@
tuHxEE
$]u}E$@
tuHxEE
UUWVS\E
EuSEUE9B
Et1@t@
UEXEE]
Et1@t@
UUWVS\E
EEUEn@
EuSEUE9B
UMWVSlE
UMWVSlE
UUWVS|E
@;Er]E[
@;ErEU]H
]xEEEt
$u}E$@
oUUWVSlUE
UUWVSlUE
9t1]u}]
[^_]UU
[^_]UXeE
$B4$Z]u]U
UEXEE]u}E
Eu!PRD
u9Et4+_
9}]t7q^
8"t-EE
$u}E$@
$u}E$@
$u}E$@
]uEEEE
]uEEEE
$u}E$@
$u}E$@
$u}E$@
]uEEEE
]uEEEE
$u}E$@
$u}E$@
$u}E$@
]uEEEE
]uEEEE
]uEEEE
]uEEEE
]uEEEE
]uEEEE
]uEEEE
]uEEEE
]uEEEE
]uEEEE
]uEEEE
e[^_]EAAAA
uEAAAAEAAAAE
EAAAAEAAAAE
EAAAAEAAAAE
EAAAAE
S C0C,
t(C,1D$
S0x]u]
t3[4u$&
t$B0x=B0uVB(
z(]u}]
H0x4P0uMX(]
[^_]o2
UWVS,PXD
]t"x0xFp0u X(EP J
UWVS,@
tLEtt$
tEp0x^X0uw@(UEEE
]tAH0xFP0u
X(EP J
X(EP J
H0us@(EUE
x0uaX(EP J
<$&]u}]
taH0xkP0uu@(
e[^_]PXD
H0yAPXD
EUM]Uu
M9MvuMEU]Eu}U]
EuaE9E
UEEEU]u}]
Mu,9vZ
1E]E}Uu]
W11V1S
tplhl$
D$'\ t&
ME1UfE
:|,1\$ \$0
t$$t$4|$(|$
\$ t$$|$(,
D$,L$(D$
T$$D$ L$
T$DfD$B
\$0fD$0
|T f|T`B
UWVS|$
t$@\$@L$B
;f9yD$
|[^_]fD$
\$ fD$
~t$`1L$@
tfxJ\$
[^_]uUt$
~ML$$t$$
~;D$$p
~PL$$q
[^_]Ov
1D[^_]
|$lOD$
~D[^_]
D[^_]fD$&
tH1|$(M
Ky\$\u=L$
|$\T$`
UWVSd\$xl$|
2L$:zQ
1d[^_]
1D$8L$
HyfD$8xfD$
UWVSLt$`l$d
:L$"ZQ
L[^_]1
HyT$ \$
LS[^_]
Iy%LbD
t,K9w4
0^t&K9w.
B9w[][]
;Ew,t&
Bt$H9v
9pr(t$
EZ;]]r
u39~rdF]
E9]EEr
9rrTB]
u)]u}]
9rrdB]
E@E9]EEr
9prw;M
DF;gUS
$]u}E$@
$]u}E$@
$]u}E$@
$]u}E$@
$]u}E$@
$]u}E$@
$]u}E$@
$]u}E$@
t>BtmEM
$rE]u}]
$UEP&A
]UUWVS
T$E|UD$
D$|UD$
eOEElD$
$SEJEEE
$@$EVE
rUMWVS
$EJEEE
$@$EFE
pUMWVS
$EJEEE
$@$EVE
rUMWVS
e|EElD$
$EJEEE
$@$ECE
nUMWVS,
enEElD$
11dE1X
'x $t&
cUMWVS,
e_EElD$
dE1X1\
$9\rpw
eUMWVS
$@$Eek
]EUu}]
UWVS<U
EMu`EED$
]UU EEE
$Uu}E$@
$:EUEEU
$8EU]u}]
UU EEE
$U]uE$@
$?7EU]u}]
]UU EEE
$Uu}E$@
$EU/EEU
$5EU]u}]
$;U(E$U
uM }u$}
UWVSLE
EUe[^_]
7UWVSLU
EUe[^_]
DUWVSLE
0P&M U
EUe[^_]
>UWVSLU
U N 1%D$
EUe[^_]
E$]U u]
E <$D$
@1vE D$
a0L$/4
@-6m D$
]U M$}>D$
W ]u}]
(]] uu
$WEEUs
AE]EUu}E
$YotuH
$]u}E$@
$;"UExE
$]u}E$@
$!UExE
$]u}E$@
UWVS<E
1t+u+t
$P$WUWVS<E
1t+u+t
<[^_]#
$P$WUW1VS
$P$US$M
E0EE,l
;E |qgfff
M(9Mt\EU
$P$UWVS|E
U ElUE
EET$$U
1t+u+t
|[^_]S<1u
Bu+E1E
UWVS,E,EE(l
C;]$s!U
CG;]$r
$X?E(UM
$<?E9Ur
U2Cu9rE
e[^_]E
<$MEMP
EET$$U
BdEBhEBlEBpE
1t6u6t
9u{tEC
,A<8w4
D$ E$T$$
D$ ,T$$U
|,U$HB
T$ 4E$
BHEBLEBPEBTE
E$T$(L$$D$
Bd8Bh<Bl@BpDBtHBxLB|P
B,EB0EB4EB8EB<EB@EBDE5
FJ8tJU
$%\$ ~
c%\$ (
$P$US$M
UWVS<E
$3;]$tb
tO%tv}
C;]$uE
%uC;]$tE
u!C;]$tM
R4UVS ]
^]kTU(
UMWVS|
MU E$@
e?E]l]
hxUxBl@
||8\A
\|@@B4E1<<
$E,|B
80tp@U
)UMWVS|
MU E$@
rxUxBl@
||8\A
\|@@B4E1<<
80tp@U
D$ E$T$
D$ E$T$
U M$$@
|htL$/p
x|e[^_]
$hp)dL$
UU EE$U
U8uE u
]U$M(}>D$
4$L$ D$
U t,t$
]u}]UWVS
$nXlD$
HlL$+@Ep1D$
@L$+<P0
T$+@Bl
kUWVS<
eE|lp<$yl
Od|dBl@
0L$'D,
0C,<$D$
EUEEUE
&{TPLB
ChtB4E
J$Z(@@<
X<$BuEX
$xUWVS<
eE|lp<$ll
Bd|dBl@
0L$'D,
0C,<$D$
EUEEUE
&nTPLB
ChtB4E
J$Z(@@<
X<$BuEX
$xUUWVS\E
$>\[^_]
UMWVSLE
$yL[^_]
U]Mu}EU
U]Mu}EU
$R]u}]
uEE}UM
UMWVSlE
t ]u$E
El[^_]
$bEl[^_]
]MEEUEIB
$E|[^_]
E|[^_]
EEUu}E
t&]u*E
EEU]}E
t&}u*E
$4E]u}]
$E]u}]
UU]EEu}E
E@t']u+E
$2E]u}]
EEU]}E
$nE]u}]E
EEUu}E$@
$D~E]u}]
UU]EEu}E$@
$B}E]u}]
$m|E]u}]
$]}E$@
EEUu}E
B@t2]u6t&
$yE]u}]
$yE]u}]
UMWVSlE
$wEl[^_]
$s.UWVS
UMWVS|E
$NrE|[^_]
rE|[^_]
}EEEEUE
@@t.}u2&
pE]u}]
$oE]u}]
$%nE\[^_]
$mE\[^_]
$rl]u}]
$$k]u}]
U}1EEU]uE
iE]u}]
$hE]u}]
UUWVS|E
$8gE|[^_]
$fE|[^_]
UUWVS|E
$heE|[^_]
$dE|[^_]
KUUWVS|E
$cE|[^_]
$"cE|[^_]
{UUWV1S|E
$aE|[^_]
$RaE|[^_]
UUWV1S|E
$_E|[^_]
$_E|[^_]
UUWV1S
UUWVS|E
$(\E|[^_]
$[E|[^_]
UUWV1S|E
$XZE|[^_]
$YE|[^_]
;UUWVS|E
$XE|[^_]
XE|[^_]
kUUWV1S
mUUWVS|E
$TE|[^_]
$BTE|[^_]
UUWV1S|E
$RE|[^_]
$rRE|[^_]
UUWVS|E
QE|[^_]
$PE|[^_]
UWVS|E
e1OEUE
$OE|[^_]
U]UEEu}E
$ME]u}]
ME]u}]E
EEUu}E$@
$NLE]u}]
$dKE]u}]
UU]EEu}E$@
$bJE]u}]
$IE]u}]
$]}E$@
$u}E$@
$8GE]u}]
$B]u}]
$kA]u}]
e5?EED$
}U|BtBu
#UUWVS|E
$<E|[^_]
6PxBtBu
]M|BtBu
eE4EED$
J|BtBu
e0E|D$
EpBtBu
eE-EED$
C|BtBu
]UUWVS
e"*E|E
3UUWVS
eu&EED$
<|BtBu
@))9rZt$
]]UXeE
]uEEEE}E
E]u}]E
$E+vUE
UU]EEu}E
UEWVSlE
El[^_]=
\dE|EiC
4$)1D$
9PrWp1|$
9BraR1_U\$
$K]u}]
9JrfzU
X?)9rY|$
9s3Bt$
)9snu~B
$u}E$@
UuL C
UjU(]E
u0F)9w
EJ?))9rRt$
8D]u}]
?J)9r[|$
?]9EUUrwU
X9s?))9rtt$
]u}]9st$
]]U(uU
<$E)(>U
UEEMEB
$I:EEE
$69E\E
A?));U
$u}E$@
$aUUWVS|E
$|[^_]
EE]u}E$@
$@]u}]
$u}E$@
9BUr~Uu
EHjU(}}
EE]u}E$@
$0]u}]
$u}E$@
9BUr~Uu
E8jU(}}
$]u}E$@
$]u}]E
$]u}E$@
$J]u}]E
}~UXeE
$cUXeE
U]uEEU
$@]u}]
$#UXeE
$cUXeE
$A]u}]
$~]u}]
$#UXeE
$cUXeE
U]uEEU
$>]u}]
$#UXeE
$bUheE
$sUXeE
$L]u}]
$c]u}]
$AUXeE
$(XUXeE
$(hUXeE
tD~@Q@
c_UWVS<E
7E|$/M
$UE19u
C@uaC@
C\u'C\
$#uOEE
$E]u}]
P0P@@J
@4A8A<u
$4UB@BI
;EE0AtM
$E.UMWVS
tlUEPXE
$e[^_]
$E,E3WqMEAX
$e[^_]
EpXX\
CdpueUpB\B
B4B8B<E
U]uEE}E
$E]u}]
${E]u}]
$EL*U(uu
EE]u}]
]9ttuF
U;:|CF
;9t19~!)tQC|$
P1SBF0
ChCdC@C
YLQ@9A
ALIPCT
$E>$BX
U9EXXPd
#t{]{T
$P$t:E
U]uEE}E
$:tfEU]@
$PE]CX
$E]u}]
E:IaUX}}
]u}]GT
_h1Wd)9]
G<~?O\U)
u6whO\U
F?E)\$
GhMW\)9EEr
GdeEGX
$\gGd\$
$AUUWVS\E
$\[^_]
UUWVS\E
$u\[^_]
]uEEEE
$R]u}]
]uEEEE
$1UXeE
]uEEEE
UUWVSlUE
e6EMxM
EUxBx8
UUWVS\UE
EUxBx8
hUMWVSlME
M6UMWVS\E
eR]UMC
EMUE]A
qUUWVS\E
EUxBx8
_UUWVS\E
EUxBx8
_UMWVS\E
EMUE]A
$4\[^_]
$RE]u}]
UUW1VS\E
$$UEMBt
$\[^_]
$OUUWV1S\UE
eDEMtM
$"UEMBt
$t\[^_]
UMWVS\E
$\[^_]
$yUMWVS\E
$YUXeE
EUtBt8
$1UXeE
EUtBt8
$RE]u}]
UUW1VS\E
$\[^_]
$WUUW1VS\E
eVEMpM
$UMWVS\E
$%\[^_]
UMWVS\E
EUpBp8
EUpBp8
$xUXeE
$"]u}]
$8p1D$
$"]u}]
$8o1D$
"EUE1}
*UqUheE
$.]u}]
$(UqUheE
]uEEEE
]uEEEE
$']u}]
]uEEEE
$g]u}]
]EEEEU
$]EUD$
$]YUheE
REUE1}
$:\EUD$
$m\YUS
[[]}OU
pl&$hd
$|e[^_]
$X)TL$
Nld)hL$
UUWVS\E
esEUE1}
t\[^_]
$K1UD$
$KZUUWVS\E
eXrEUE1}
$r\[^_]
$nJZUS
X[]}=U
UUWVS\E
epEUE1}
q\[^_]
HE1Ut$
$HZUUWVS\E
eHoEUE1}
$o\[^_]
1G1UD$
$^GZUS
X[]m:U
$'utJ$
p`1(@=
ie[^_]
$rld)hL$
$gktJ$
p`1(@=
$T_e[^_]
$hld)hL$
$69cU1
X[]}&U
Y[]-&U
$U]u}]
$`[UXeE
$ZUXeE
$ZT]u}]
$S]u}]
$SYUXeE
]uEEEE
$R]u}]
$XUXeE
]uEEEE
$:R]u}]
$WUXeE
]uEEEE
$Q]u}]
$O]u}]
$#UUXeE
$N]u}]
$sTUXeE
$ N]u}]
$SUXeE
$pM]u}]
]uEEEE
$L]u}]
$SRUXeE
]uEEEE
$K]u}]
$QUXeE
]uEEEE
$JK]u}]
$PUXeE
$J]u}]
$=PUXeE
$I]u}]
${OUXeE
$NUXeE
$WH]u}]
$MUXeE
$G]u}]
$;MUXeE
$F]u}]
UMWVS\E
$WC\[^_]
CtSt]u]
?XCtCu
CtSt]u]
$u}E$@
$&EUD$
E@xEtP
UWVSLE
$wllD$
$TCtCu
].UXeE
$~E1@t
$F=]u}]
u1EEEE}1
^H[^_]E
[H^_]E
-UWVS(E
C9u([^_]
4$ [^]
UUWVS|E
$2E|[^_]
$d2E|[^_]
UEXEE]u}E
$-1E]u}]
UEXEE]u}E
$m0E]u}]
UEXEE]u}E
$/E]u}]
$E]5t&
$EYUEXEE]u}E
$.E]u}]
UEXEE]u}E
$-.E]u}]
UEXEE]u}E
$m-E]u}]
UEXEE]u}E
$,E]u}]
$E]2t&
$EYUEXEE]u}E
$+E]u}]
UEXEE]u}E
$-+E]u}]
UEXEE]u}E
$m*E]u}]
UEXEE]u}E
$)E]u}]
$E]/t&
$EYUEXEE]u}E
$(E]u}]
UEXEE]u}E
$-(E]u}]
e}#EME
$MAX9EE~wE
k-MT$+Uyu
#Ee[^_]
8UBtBu
$e7 EME
.*MT$+Uyu
6UBtBu
$Ee[^_]=uE
$]uE$@
$E."EU
$]u}E$@
$E*!EU
$u}E$@
||EH;E
En}t uu$E
UM4$L$
UU]EEu}E
\Mira.h
Saaaalamm
basic_filebuf::xsgetn error reading the file
basic_filebuf::_M_convert_to_external conversion error
basic_filebuf::underflow codecvt::max_length() is not valid
basic_filebuf::underflow incomplete character in file
basic_filebuf::underflow error reading the file
basic_filebuf::underflow invalid byte sequence in file
basic_ios::clear
basic_string::at
basic_string::copy
basic_string::compare
basic_string::_S_create
basic_string::reserve
basic_string::erase
basic_string::assign
basic_string::append
basic_string::_M_replace_aux
basic_string::replace
basic_string::insert
basic_string::resize
basic_string::_S_construct NULL not valid
basic_string::basic_string
basic_string::substr
ios_base::_M_grow_words is not valid
ios_base::_M_grow_words allocation failed
locale::_S_normalize_category category not found
locale::_Impl::_M_replace_facet
basic_string::_M_replace_aux
%H:%M:%S
%m/%d/%y
basic_string::_M_replace_aux
basic_string::erase
pure virtual method called
LC_CTYPE
LC_NUMERIC
LC_TIME
LC_COLLATE
LC_MONETARY
LC_MESSAGES
locale::facet::_S_create_c_locale name not valid
-+xX0123456789abcdef0123456789ABCDEF
-+xX0123456789abcdefABCDEF
-0123456789
%m/%d/%y
August
September
October
November
December
%H:%M:%S
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
c:/mnt/samo/mingw/msys/mthr_stub.c
-LIBGCCW32-EH-2-SJLJ-GTHR-MINGW32
w32_sharedptr->size == sizeof(W32_EH_SHARED)
%s:%u: failed assertion `%s'
../../gcc/gcc/config/i386/w32-shared-ptr.c
GetAtomNameA (atom, s, sizeof(s)) != 0
R`%uM]=];Z
uuvHMe
Ix@ p+
N10__cxxabiv117__class_type_infoE
N10__cxxabiv120__si_class_type_infoE
N10__cxxabiv121__vmi_class_type_infoE
NSt6locale5facetE
NSt8ios_base7failureE
St10bad_typeid
St10ctype_base
St10money_base
St10moneypunctIcLb0EE
St10moneypunctIcLb1EE
St11__timepunctIcE
St11logic_error
St11range_error
St12codecvt_base
St12ctype_bynameIcE
St12domain_error
St12length_error
St12out_of_range
St13bad_exception
St13basic_filebufIcSt11char_traitsIcEE
St13basic_fstreamIcSt11char_traitsIcEE
St13messages_base
St13runtime_error
St14basic_ifstreamIcSt11char_traitsIcEE
St14basic_ofstreamIcSt11char_traitsIcEE
St14codecvt_bynameIcciE
St14collate_bynameIcE
St14overflow_error
St15basic_streambufIcSt11char_traitsIcEE
St15messages_bynameIcE
St15numpunct_bynameIcE
St15time_get_bynameIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE
St15time_put_bynameIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE
St15underflow_error
St16__numpunct_cacheIcE
St16invalid_argument
St17__timepunct_cacheIcE
St17moneypunct_bynameIcLb0EE
St17moneypunct_bynameIcLb1EE
St18__moneypunct_cacheIcLb0EE
St18__moneypunct_cacheIcLb1EE
St21__ctype_abstract_baseIcE
St23__codecvt_abstract_baseIcciE
St5ctypeIcE
St7codecvtIcciE
St7collateIcE
St7num_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE
St7num_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE
St8bad_cast
St8ios_base
St8messagesIcE
St8numpunctIcE
St8time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE
St8time_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE
St9bad_alloc
St9basic_iosIcSt11char_traitsIcEE
St9exception
St9money_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE
St9money_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE
St9time_base
St9type_info
AddAtomA
CreateDirectoryA
CreateProcessA
CreateSemaphoreA
DeleteFileA
ExitProcess
FindAtomA
GetAtomNameA
GetCommandLineA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetStartupInfoA
InterlockedDecrement
InterlockedIncrement
ReleaseSemaphore
SetFileAttributesA
SetLastError
SetUnhandledExceptionFilter
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WaitForSingleObject
_fdopen
_strdup
_write
__getmainargs
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_assert
_cexit
_ctype
_errno
_fstati64
_isctype
_lseeki64
_onexit
_pctype
_setmode
_strnicmp
_vsnprintf
atexit
fclose
fflush
fprintf
localeconv
malloc
memchr
memcpy
memmove
memset
setlocale
setvbuf
signal
strcat
strcmp
strcoll
strcpy
strftime
strlen
strtod
strxfrm
SHGetFolderPathA
ShellExecuteA
KERNEL32.dll
msvcrt.dll
msvcrt.dll
SHELL32.DLL
;33330
*7RTVVjrqmjr}
!/9?NGGaaq^^^m
+388<<a^^^^]^
#%88<Ca[]]]]]
#%''CCZ[^\\\]
#%'''<[[^^\\]
#%''<_a[^^^\^
#%''<<aa^^^^^
##''<_am^m^^m
"%%8D<aabm^^m
#-8<Iaammmmm
"#%89addammmr
$-8<Gdnmmmj
$-8GIdnnjrr
$-8GGhnsrr}
$-9Gdhnszz
$-9GGggs}s
+-9Ghgys
$1;GVvys
+/GSiiyy
+/?Tiv
jjuwxz.4DC\JJMU
'* KJJJ;t
99MJJBy
9KJJJ\
9#KMJJ\
=LMOO`
*1=R\QQc
*<=UUQ\h
*@@VU```g
2@CVVg`m
'2FCaccm
3F[Yam
%@74i%
(J@@=%
:TOJ7Q
Tccbk
Vcccl#
Vcccl),Fbb_:
Vccll7,bheb:
Vcj[S/dhhhbH
_VTTTPJJJBH
~s#MgR'Qj.(Vq
]vr Lhh(QjT/SiB3Sh'5Ti
Lit%Qla-TkM3Ti>5Sf85Qd(6Rf
Liz$Qli,UmU2VlD5Ti:5Rf55Qd1YD}h
Li|#Qmo+Un\Fsbcqy~xtvywvs^
~srrrr:oRdr}}xsqnlihglt
]{usrsrZagjlqqokhdb`__b
3zxvtsrHR]deddbcc_\ZZY]
~{ywvsGKQW\_``_`]ZYXX[
|zyv@FOVZ\^^__^\ZYXZ
~{y?EMTZ\^_`a^^\ZY[
|?FMTX\^`ab`^^\Z\
?FMTY\_accb`^^\_
?ELTY]_ccdbb`^^`
tELSX^acefdab``c
ELRX^acfhfcdccf
ELRY_cehiiffffp
FLTZ`dgiljiiij
FMTZ`ehkmljklo\
HNT[bfjlonmmpsf
HNU\chkoqqoprv
IPV]dinqstssuz
KQX_fkoruwuvx}
KRYaimqvxxxy|
MS[cioux{}|}
NT\elqw{~
OU]fmuy}
PW_gpv|
PX`iqx
NaHaJa
,~:F;!?c{
:3:3:3\-
)0^-i?
@Y:3fs]
3:3$.N-
( t.N-q
%d"}k7
:3:3-l
`3:O&-~0
33.NVg
`:O&3Q`
.fk.fm
`3p-c\-
.fs.fm0
,N^qAO<jNbI-7O
7+4?$QP
l%7Ik:-
.N}LJ>'L
.^:8mjp
5A+jpd
.N}LJ>'L
$.V*-5
.f~s?x
3q'jNFI
(} :W5
0Nb-dXM
:3:3:3
-cYf:W/
-cYf:W/
Ym,-cYf:W/
,5qYf7p
.~fsz0
!5A.~
5oW-})W-
3+k+Vp'
)3@!5A
5q',cfm%30
O&&-5A
)3@!5A
%5Ys'+Na5L
.Vj5Qk
+NippK
`0M*,K-cnxg
Yf5IkBx
.^j3.Nv3>.Nje
:3:3:35IO*&Z
`0M*,NV
.^j3v3>
5A -Nj
,`3C,PzlE
Nq jq&
-%5qkp
N.^zs,&
,N~dO3:3:3
qA{<'jNcI
3:3:3:3\-
{}LJ>'L
)Wm,,%
7Ac ,f
,jNnLZ:
-AY5A w(
5A_jL,Nb3
o(x.Vfl~+
+),Vfd7p
NB jNn
7Ac ,f
,jNnLR;
@|))dK\
VA jNn
3:3:3:3
i]< 4j
qA{<WjNI
qA{<gjNI
i,N^{3AS,
7Ac n9.f
5yYf7p
(..Fz
-:|c}u}
3:3:3:3&
qA{<wjNI
t?W14?
e,'7Ac
&v.Nrp jNn
{}LJ>'L
)5O|tS/
5qYf7p
5qYf7p
7Q{!5l
3Y,Nf3A,
jN I%.Nf
7Ac "5
5A[ ::W/
3Y,Nf3A,
jNIU.Nf
5Y.fmW/
5A[ 97
3Y,Nf3A,
5Y.fmW/
5A[ &97
7Q,f7Ac ,~
,Nb-qAg
7Q,f7Ac ,~
jN?I-y
,Nb-qAg
7Q,f7Ac ,~
jNI5-y
5Y.fm
5A[ 67
7Q,f7Ac ,~
jNIu-y
5Y.fm
5A[ &67
fm3:3:3
oL7Ac ,^JH
.Nf-5Q[
3A[jqq,
-'.^vp r
7I,f7Ac ,~
qA{<jNIu.Nf-u
5I_ R.Nfq-Blp|q
5yYf7p
7I,f7Ac ,~
qA{<jNI
5I_ b.Nfq-Blp|q
5yYf7p
7I,f-~0Nj-3q'jNI
5I_ r.Nfq-Blp|q
U0Nj-c$
5Ikjh,
Iv?(Y,n-#
-0Nj-#
5Y.fm
5Ak}-qAg
,YTfm0
7Y,7AcjNI
3Y-[,n-
5A[j &
{!V5Y[
5Y.fm
!5Y[d.fV
nJ5A[B`"5L
5QO.fZq3T
l7Ac (.f
5yYfjI
L3:3:3:3
3q'jNFI
|.^*3@
0Nb--
3q'jNFI
3q'jNFI
3q'jNFI*
7A[ R
3q'jNFI6
[IU< 2
3q'jNFIB
3q'jNFIN
7A[ r
3q'jNFIZ
3q'jNFIf
7A[ 2,0
3q'jNFIr
7A[ ,3:3&
7Ac ,f
,jNoL`
7Ac ,f
,jNoLa
.N jNn
I0Nj-'
.Nfm,\-:
e5AjNI7Ac
.^b/,N^
(o0Nj-
5QS(3AO~5Q_Ks.Kc
&Q.^V .I
.^^ .I
-.Vr-}
0N7Ac,
]5Q[30Nj-c
5Y.fmW/
-.Vr-}
5IWspH,
7Ac ,f
,jN,pLmf
5y_pc,
qA{<jN
5I_spc,
,jNTpL7AcjN
.^b/,N^
(o0Nj-
5QS(3AO~5Q_Ks.Kc
Q.^V .I
.^^ .I
-.Vr-}
u5A.^
3A_,^b-qA
5I_Zsx.K
5I_Zsx
5I[.J3
3AG.^R
.^f5>,
u5A.^
3A_,^b-qA
w?{,ng.^f
5I_Zsx.K
5I_Zsx
5I[.J3
3AG.^R
--.^f5>,
0Nj-S
-& >7
5AS _:W/
,jNpL7Ac ,^r
.3qC|
]5Q_.K/,N>p
5A_ysP7Ac >
3qS .Nf-u
@>!.^f
-3YK6"
5BBzsD
IAW{5QW
-.~r-
.~N-jNn
.^N-.fN-Wo
5Y,N5y
R0NN-C
KL v;
3I3,N>
5Q:s---g
F5.I :
5Q3.V,N25A'2z
.N2-3@
L.^,N* 5A'2
e.^5.^J
5AO}-qAK
,f(,NN3
,jNJpL
5Y.fm8i,
.Y3Q#3
0Nb--{
c38q,M
jNIsnjNpL7Ac jN@)I
5Q;jNn
.Vf5=,
:|--c
5Q_:3k[
.VVl,}
b L--#
l.NRl,e
\%? jNn
M-c:_jF
@:j-lr]
M-c :j
@:j-u^
M-c:kM0
39k,>^
M-c:s{iF
@:jjM(
@:|j39j
M-c:jF}
@:j-~"]
M-c:|#j39
39/j,>:]
k[!? ,M
.Vfk[Q@^
39k^=?
{k.^f
-.Vr-,^Zp
Mc}f7p
[0< BO
,~7AG ,
x?jNrL+I5Q.NJ
5yYf7p
-.VV-}
.VFq` jNR
,~7AG ,
qAc9x?jNr,IP.NJ
;i.^J\
5yYf7p
-.VV-}
.VFq` jNR
jNIsnjNLqL7Ac jN5I
5Q;jNn
.Vf5=,
:--c &
@:j-"^
.VVl,M
[5? "
@:j-z]
kj.^f-l~]
Mj3QG:|
31l,&_
M-c:skFA
@:jkM<
iMl.Nfl,F_
dlM{iF
@:sjM\
@:j3j[
M-u z\
7Ac ~nhg
.Nn5Qo,Vb
V,nF]E,"
5A{q/P
Nl:3:3:3
-/,LY[
,N%f}i
5Y.fm
5Y.fm-c
5Y.fm
5A ,}
3q:~'.qBp
Vp5~W/
5qYf:W/
5qYf5,
5yYf\-
*}-cnPfm-
:|---xjNb
v:|5},fn{5k|57Ac;f
7Ac ,f
,jNqL"
!3:3:3:3
.Nc}-W
f:3:3F,
.95BBl
0V:seBo
>AJ5||| q|p
m,-cO&
83?:jl}u~
7? :|--
83?:jl}u~
7? :|--
83?:jl}u~
7? :|--[
83?:jl}u~
7? :|--
,~7Ac ,
I|?jNEI7.Nf
:3:3:3qAg
.Nr3A[ m
,~7Ac ,
O|?jN|FI6.Nf
:3:3:3qAg
.Nr3A[ l
,~7Ac ,
U|?jNaGI
:3:3:3qAg
5Y.fm
fm3:3:3$,f
mh,=A,}
qA{<jN
7Ac ..f
5yYf7p
Ms]m@ jNn
3:3:3:3
3:3$,f
cHLi "_
5Y.fm
iHL-uk,
]B,N-
P.N5yk
iHL-5A
,-cYf:3:3ci,5Qf3
:3:3:3
,jNjduL
.I3Q?Lq
5Y.fm
/"5Q?,M
-.^Z5AC,
,jNjtuL
.I3Q?Lq
]0NN-{
ch7A{ zT
h!5AO,NB3Q7 ^8'}
,jNjuL
.I3Q?Lq
]0NN-{
ch7A{ zT
h!5AO,NB3Q7 ^7'}
3Y,Nf3A,
qA{<8jNPIu+.Nf
5yYf7p
3Y,Nf3A,
qA{<>jNlQI+.Nf
5yYf7p
,jNjuL&
.I3Q?Lq
5Y.fm
/"5Q?,M
-.^Z5AC,
,jNjuL
.I3Q?Lq
ch7A{ T
h!5AO,NB3Q7 2'}
,jNjuL
.I3Q?Lq
ch7A{ T
h!5AO,NB3Q7 1'}
3Y,Nf3A,
qA{<tjN<VI&.Nf
5yYf7p
3Y,Nf3A,
qA{<zjNVIE%.Nf
5yYf7p
fm3:3:3
,jNjuL
.I3Q?Lq
5Y.fm
/"5Q?,M
-.^Z5AC,
,jNjuL
.I3Q?Lq
ch7A{
h!5AO,NB3Q7 ,'}
,jNjvL
.I3Q?Lq
ch7A{
h!5AO,NB3Q7 +'}
3Y,Nf3A,
5yYf7p
-,Nb3AW,
3Y,Nf3A,
qA{<jN]I5.Nf
5yYf7p
-,Nb3AW,
:3:3:3
3Y,Nf3A,
qA{<jN,`I
.Nf-KL
5Y.fmW/
.Nr5A_
3Y,Nf3A,
qA{<jN`IU
5Y.fmW/
.Nr5A_ ^R
3Y,Nf3A,
qA{<jNaI
.Nr5A_ Q
3Y,Nf3A,
qA{<jN|bI
5Y.fmW/
.Nr5A_ P
3Y,Nf3A,
qA{<jN<cI
.Nf-;I
5Y.fmW/
.Nr5A_
3Y,Nf3A,
qA{<jN
.Nf-{H
.Nr5A_ JO
3:3:3:3\-
-iIiIjI
3Y,Nf3A,
qA{<jNeIe
5Y.fmW/
.Nr5A_ nM
3Y,Nf3A,
qA{<jNfI
5Y.fmW/
.Nr5A_ L
3Y,Nf3A,
.Nr5A_ K
3:3:3:3\-
pJpJpJ*y
)A:3:3:3
,NY^:3\-
:3:3:3-c
5yYf\-
-u:s3:|
+:s3:|+:s3:|+:s3:|+:s3:|+:s3:|+:s3:|+:s3:|+
uL,7AK
?(-7p
:3:3Yf:3:3
:3:3:3
:3:3:3
F?|qmW/
<nIMOd
(:3:3:3co,
jNB=J#
0~B=JqACJ=D?J=jNR=JKL=JqASJ=D?J=,Nn3
?D?4](0,3-"j
3:3:3\-
13?:j-53
.~fm=/
.~fmA3
jt,(R.K
$.ff7p
:3:3:3
:3:3:35<
5Af5@%
:3:3:3-cYf_0
5AQ3>fm
:3:3:3
-cYf_0
-cYf_0
-cYf_0
-cYf_0
.Q-u:7
:3:3:3`
co.fc}
$.N)5F
.I-u(3
,("Z.a
~~!17Q,N
:3:3:3g
:3:3:35T
{,7Q,N
co.c})
3Y.}#co(
:3:3:3`7y_
,(q.I
@,(#Jjb
{lls7p
{,5Y&fm
,%A9&c~
:3:3:3\-
,%9&-ujt:j-
75Yzf:3:34,~
5q'.N
t,5IoB
(3q.N5Y.~
5Q{,^?/
5qo2z3Aw
`Is.^v}
*.^v3Qo
YVz}3Qv3AK
5yYf:3:3:3
5I.Nu'.fi
c3,,qA
,5Y.fmW/
5Y.,5qkfmc
:3:3:3
5I.N~'.^
,VupqBr
2:3:3!
}z!#*|
24< >jf
-S5 2e(
ez!#*|
ez!#*|
:|&-:s-=$
ez!#*|
p Fp-
:j6--$
Zf:3:3:3-lS
c}(iL|
c~-l?X
L2jpJp?X
0^zbjNroqAm
)bjNvoqAq
bjNb'.fz5Qo'0b
3QOupt
|ur7Qk
t0U$,&
7q[.^z7
,^ZbjNb
|ur7IK
.fRK.VV,fr3Io,N~zo-yo
7ykUbj
-%s:s-
Z^t-c8]
7ykUbj
& U-7@
.} .$&
3:3:3:3-
a/&b,;-R#gmW/
5@%5H%
Bznz-u
--bjM,
pkso3d
!5H!7pme
:3:3:3
2z%o3L
S\-> 7
MI-O-:
oq@=&
Yfoq@'.
oq@)b
rso3dK
:3:3:3]b,eL
!7pi0U<^
ZxI o-5]--~
Ydb,"3&
(7.M 0y
(P.U &
db,"3&
(L.U 0z
& Ubj
%iLl-c"
0V-cXb
:3:3:3l
fmbjM"
#}-c&
*o3Bo+v
0Wb,Ob$"~t
:3:3:3S\-
Z;7H#7v${
:3:3:3
:jNn`g
(GJ-}}
7H!0M4,U
opAeo}
a@#7P%#
a@#7P%
Z@-o3.&
+0W-c
-TcbjPo-:}
*bjJoq=
:3:3:3
+qoq@)-
(gI--unH,
fm-l7p
(%J-b&0_
a/&b,;-R#:3:3:3!/{3
Ym3:3:3
Ym3:3:3
`f:3\-
3:3:3:3`
8/js}G!00
5A jqT-~
5A bjpsn
fm3:3:3
3:3:3:3`
Yf:3:3
3:3:3:3`
.95ZpT
5A jpT-~
5A bjqsn
fm3:3:3
:3:3\-
3:3:3:3`
c}?gsn
{.ffm
`f:3:3:3
5Y25{fq
{.ffm3:3
3:3:3:3`
5Y5<.N{D
5I.qB|Pp
.!5GBto
:3:3:3
3:3:3:3
Ym3:3:3\-
3:3:3:3`
3,^G,^
5y.N'
,f{T3AI&
Yf:3:3:3
3:3:3$,
\&t3:3:3
3A,N5A ,7AD
ejq5Y.fm3:3
3A,N5A5VD
5yYf:3:3:3$,f
3,f!3A
70BjdP
5,N3AB
ejq,.f
5yYf7p
57.V5~)
5,V!,^5I
95A{jB|I
7!K|+W/
57p:3:3:3\-
5A ~b3fm3:3:3:3
.[%mBlszYf:3
.N [f:3:3:3
.N [f:3:3:3\-
.f [{
3:3:3&"7AG ,f
5Y.fl
.NV-G]
j3:3:3
3:3:3\-
j3:3:3&"7AG ,f
0NN-#V
5Y.fl
f&"7AG ,f
.I-qAK
0NN-cU
5Y.fl
3:3:3&"7AG ,f
.I%qAK
5Y.fl
.NV-wZ
.f [{
.N [f:3:3:3
.N [f:3:3:3\-
.f [{
3:3:3&"7AG ,f
E0NN-sS
5Y.fl
.NV-'Y
j3:3:3
3:3:3\-
j3:3:3&"7AG ,f
,jNjsL
5Y.fl
f&"7AG ,f
,jNjsL
.I-qAK
0NN-CQ
5Y.fl
3:3:3&"7AG ,f
,jNjsLJ
.I%qAK
u0NN-P
5Y.fl
.NV-WV
.f [{
3:3:3fm3:3:3
3=fm3:3
3=fm3:3
U3=L,J]3=T,Je3=\,JYf:3:3
5>%3=fm3:3
3=fm3:3
93=0,JA3=8,JI3=@,JYf:3:3
-3=fm3:3
q3=h,Jy3=p,J3=x,J
:3:3:3t,n
7Q,f7Ac ,~
qA{<jNCJ
( iIjI
5A_.Vb,VJb
.^N5Q[.V^3
.Nn-.^vp
$.NZc}5,
5IO B:3:3&
7Ac ,f
,jN\hL
3:3:3\-
.^{2z-
hAfm3:3\-
.^{2z-!3P
hAfm3:3_}
0N.-3QG4,nV
5Q{.S8}/h
7A{ _?`
7A' jO|$V
0Nb-#X
f:3:3_}
5Q 3Q#Z
.^:--';
5Q+ ,]
h!5A;&
5A/ qA;
y0N>-E
3:3:3:3
3-cO.V
fm3:3:3:3\-
:3:3:3_}
,Vn)qA_<0NN3
5A?jh,M
5LF,^6
7QI3,"
5A3:|-:Xmj
j0q /T
j0q /T
0^---A
'.I(I?<
7Q{ :j-(I ,M
K<L8%2z
3{:3_}
,Vn)qA_<0NN3
5A?jh,M
5LF,^6
:3:3:35Q
.V>4-J
(&8]B?X
"z2(=5Q
0^---3
'}.I(E?8
7Q{ :j-(E ,M
.NV(Y,
3:3:3_}
,Vn)qA_<0NN3
5A?jh,M
5LF,^6
7QI3,"
5A3:|-:Xmj
j0q /T
j0q /T
0^--c /
'.I(I?<
7Q{ :j-(I ,M
K<L0%2r
7I{ jq&
3{:3_}
,Vn)qA_<0NN3
5A?jh,M
5LF,^6
7QI3,"
5A3:|-:Xmj
j0q /T
0N(E|p
j0q /T
7I{&
.NV(],
Ie:j|`$
3:3:3_}5
,Vn)qA_<0NN3
5A?jh,M
5LF,^6
:3:3:35Q
.V>4-J
-c:(m3
| Xe/P
2(QB/T
.N2`e3
Y0%(53,3
0^--c /
'}.I(9?,
7Q{ :j-(9 ,M
.NV(M,
Ie:j|`
3:3:3:3_}5
,Vn)qA_<0NN3
5A?jh,M
5LF,^6
7QI3,"
.N:-gT
*{(QB/T
(lr .I
0^--c /
'.I(9?,
7Q{ :j-(9 ,M
7I{ fjq&
5I;jNR
:3:3_}
,Vn-qA_<0NN3
6jNr4J
5Ajh,M
5QjF,N:u
'Ic:||
,iN9.^
5.I(E?8
.NB-&
iN9.^u
j',N.,N*
lK<L8Q2z
--c /D
5A;:---
5<j(A}
_DI?_4
5.I(=?0
5Q; /0
-& .
(80-|p
Ic:||`8
5.I(!_
_DI??
p|qjp&
3:3:3:3\-
3@!5A ,M
n fm3:3\-
3@!5A ,M
On fm3:3\-
3@!5A ,M
n fm3:3\-
3@!5A ,M
n fm3:3\-
3@!5A ,M
n fm3:3\-
3@!5A ,M
On fm3:3\-
3@!5A ,M
On fm3:3\-
3@!5A ,M
On fm3:3\-
3@!5A ,M
On fm3:3\-
3@!5A ,M
On fm3:3\-
3@!5A ,M
n fm3:3D,f
.N--#U
5yYf:3`
K,N\jN
3@%5A
3:3:3:3
0N7AG ,^>
,jNjtL
@.N>3P%5Q
.N>-3@
3:3:3:3
,^F)3A;,Nn3
qA_<<jNrBJ!:jNR
7A{ jNR
I?.N>3P%5Q
.N>-3@
3:3:3:3
0N7AG ,^>
,jNjtL
>.N>3P%5Q
.N>-3@
MI0NN-[
3:3:3:3$.N
!3@%5A
l:3:3:3$.N
!3@%5A
l:3:3:3$.N
!3@%5A
l:3:3:3$.N
!3@%5A
1l:3:3:3$.N
!3@%5A
l:3:3:3$.N
!3@%5A
l:3:3:3$
,f-~.V
+N!5<l
5Y.fm
.Nz---
)F.^3Q'
aN--3@
3p!5Q{
3:3:3`
!5A,Nsjh,M
5Y{",-
)B.^3Q'
Yf7>~ .^-
aN--3@
3p!7A,M
7p85Q{,7B
7> .^-
aN--3@
!5A,Nsjh,M
5Y{",-
3,0y|"
5A{#jI
0e+,}
3p!7A,M
3$, !5A
k-1,3/,
5A6:3:3`
8 2%/
-3@!7s
----L:j|
:3:3:3`
0+^? ,
3@!7A{& j/
----L:j|
&----7
:3:3:3\-
On fm3\-
:34,~%5q
!3P!5Q
--)5Y.fm3:3\-
:3$,f%5Y.^
:3$,f%5Y.^
,<5Y,
3:3:3:3_
J.f3Q.
.Nfmu3@
._!3ABlf
5A{,Nz3Qw
5yYf5D
hAr ,M
f:3:3$
3:3:3:3
3-cYf:3:3fm3:3:3&"7AG ,f
,jNjsL
5Y.fl
3:3:3&"7AG ,f
,jNjsL
%'0NN-S
5Y.fl
3:3:3&"7AG ,f
,jNjsL:
.I%qAK
5Y.fl
j3:3:3
j3:3:3
.f [{
3:3:3\-
.f [{
3:3:3\-
,Nu,5C
!3A ,]
3@!5A
''',.
!3A ,]
3@!5A
''',.
`:3`\-
!j.NdLs.^u}
3:3:3\-
3@!5A ,M
On fm3:3-cYf:3:3\-
3@!5A ,M
On fm3:3`
A&,Np'$
:3:3:3/[
a-}2&l
:3:3:3`
7IkD,NrU3AoL,Nz]3AwT,Ne3A
.K5>.K5x@5Y(
5Qg ,Y
''',.
5,%13l-LU
:3:3:35QIf
j5i}?fo
6.NCfn7p
0^L3qBnx
.V)5.=,-;
'N w0Vb
,Nb%.F
,Nr%.V
3H!3A,] .^
5YW[ Fq5L`,Nbq3A_h,Njy3Agp,Nr3Aox,Nz%..
,N%.eG[
5QW ,Y
2'2,.
%5QPC|
3H!3@1b
-3P--
.N--3@
5Q ,]
3P)5Q
3X%3H!3@
3@%5A
5LD,NbU3A_L,Nj]3AgT,Nre3Ao\,Nz-
.N--3@
:3:3:32AI
3P-3@!5A
.K"(Ux,
.Y53A;,,NF=3AC4,NNE3AK<,NVM3AS
3@!5A
5Q ,]
{:j|!%
,U$&
3@!5A ,M
On fm3:3\-
3@!5A ,M
On fm3:3\-
3@!5A ,M
On fm3:3`
+V|NeKjs~?fp*
5A Z5A,N
0:3:3:3_
%3P!5Q
& [5
?j3:3:3:3
?j3:3:3:3
?j3:3:3:3\-
}-dcfm
fm3:3:3:3
`f:3:3:3
tf:3_})
,=)2j7
3lYfba
s:3:3:3
Ym3:3:3_}
,V^)qAO<0N>3
5Y/mh,f.-cR
.^60h.I
0}:j(]?t
0Vr@U/B
(I0,N:-c/8
iIiIjI
%.f.(y?t
-.fF-Gh
Ic:||`$
7Ak .f0G
0ysp?l
7QI3,f
Ic:||`
YN=8}|`\
'm.I(?
a9& ,}
'7Ik}5<Q3S
5<2r5se 7
jNB
5Uc-qA;
,V^)qAO<0N>3
5Y/mh,f.-:
.^60h.I
0}:j(]?t
0Vr@U/B
(I0,N:-c/8
aiIiIjI
Er.f.(y?t
-.fF-Gh
7A{ z/h
Ic:||`$
0N--cm
7Ak .f0G
7A7 vm/
0ysp?l
7QI3,f
Ic:||`
YN=8}|`\
'm.I(?
a9& ,}
'7Ik}5<Q3S
5<2r5se 7
jNB
7Yk "A
5Uc-qA;
On fm3:3:3:3\-
On fm3:3:3:3`
-0 ,R
(e:jW/
0N-(e .J
`@&}0e
0i-8m7d
-8u ]
,^>!3A3
,^6)3A+ ,^*
(,Nn2Q* jNrlK
7Q{ Nd'
3P!5Q/ ,]
.^>-3P
5Q? N,^>
3P!5Q
.^>-3P
( v]:3:3:3\-
:3:3:34,~)5q
%3P%5Q
5Y.fm3:3:3:3$#,f
YN8i7`
d1uL0,B
:3:3:32
0Nr-(-
8 ,"
(Q:(u ?<
t:3:3:3`
0 jNb,K
0mh.I(i(
5?2qg,
`52z-3x
YPI?/'
.I(-g
0Vr-qA;
7Ik& Rg
5Ik#6,N2q
5A+,N*3Q'
L(e& ?l
@U jNB
`}0,N: .c
j-.F-gT
7A{ Z/T
K<L%sD/
7Yk ,]
& LT
-(II3@
K<L%Bzo
-@A',E
0 jNb,K
0mh.I(i(
5?2qg,
`52z-3x
YPI?/'
.I(-g
0Vr-qA;
0Vr-3P
5Ik#6,N2q
5A+,N*3Q'
L(e& R?l
@U jNB
`}0,N: .c
j-.F-gT
7A{ M/T
K<L%D/
7Yk ,]
& ?T
-(II3@
K<L%kBzo
0:-@A',U
e5AjNI7Ac jNmL:@
5A_.Vf
jJM-qAg
5Qk,^^
jJM-qAg
3:3:3_
3:3:3:3_
U5A.^
3A_,^b-qA
.fb5I_
7Ac 4nHg
fm3:3:3T,n
3y,^-qA{<3jNK
.Nf5I_
^0^j-,
3:3:3T,n
3y,^-qA{<+jNK.Nf5I_
5yYf:3T,n
3A_,3I jNI*
3.Vb5=,
5I[.J3@
5I[.J3
3:3:3:3
VM j-
3:3:3_
`Q,Nb2QZ
,jN<lLsG
Y^a3QO.J"e.I7
`,NJ.NF-_
:3:3:35Qi
.^R .I
5A? jNn
m3:3:3
2IV0NjqA>
`QV,^R
Q;}5=D
5A[nxg
.fV-3X
.^N .I
`.V^ .K
.fF .I
5Y7 jNn
0Nj3q'jNI
qAU> &+jI
E5Q[.["
".f^~~
5YWpy.
-',NZp
3:3:3d,n
0Nj3Y'jNI
qA%> V)
5ySpy.
-',NVp
5Q[&SK
3:3:3d,n
7Q,f7Ac,
7Ab jNn
47Ac '.f
5yYf7p
5YSpx.
-',NVp
7Q,f7Ac ,~
QW jNn
5yYf7p
-',NZp
3:3d,n
0Nj3Y'jNI
5Q[.["u}
-',NVp
.^Z-3P
7Ac f$.f
5A,f-~|0N.3q'jNFIz
.N7Q[.N.Nb
5Ao ,e
3A{jNf
.^5A{:-k
q3:3:3:3
3A3,~
qAO<cjNb_K-
3A{jNv
.^5A{:-k
5Q3,5N
.^6-3P
7A7 .f
U.^2-qA;
5A,~3A3,
,jNZkLjW
,N3Q{.N.^
-',N6p
5Q3&SK
M3:3:3d,n
0Nj3q'jNI
5Q[.S"l}
..f^~~
5yYf7p
5YWpx.
5QS jNn
3:3:3_
u5A.^
3A[,^^-qA
)s?h,n{.Nb
&VZ.fZ~}
IS jNn
.^V .I
5AG !,
R:3:3`
3.KA&/r
3:3:3:3`
3.KA&/r
3:3:3:3
F4 j-
3:3:3_
`Q,NZ2QR
,jN,lL>a
YNY5.Yvt,3AC
0f^%Q,N^x
aNY--3
5I;2r5Y?
5QC-5<
5YK ,e
90Nj-s
^:p.J7
J&VR.V
3y0N7AcjNI
s.^bq>
jNn
5yYf7p
5ySpx.
5QO jNn
Ix.NV-~
,,N^qA
r?sq,n-_
s(3"q\
-',VVp
.^Z-3P
5IW.R3
5AKnXg
q.^^-F
V}:3:3:3d,n
7Q,f-~0Nj
K!ojNn
5yYf7p
-.Nf5Q_j
jKM-qAg
-u:j}~
.~fm3:3:3T,n
7I'.^3A_,^b-3YjNI(
3.Vb5=,
5Y.fmW/
fm3:3:3:3\-
:3:3:3
fm3:3:3:3
,jNllLj
0Ni-qAg
5.a}t.^-3P
.^^-3P
.^Z-qAg
5AS ~.
5AjN~I7A_#jN
.VJjN^
3@!5AK,M
5Q? .J
.^Nu~3
5ACnxg
.NB-qAc
5ACnxg
v:3:3_
5AjN~I7A_jN_
.VJjN^
3@!5AK,M
5Q? .J
.^Nu~3
5ACnxg
.NB-qAc
3:3:3_
5AjN~I7A_CjN/
.VJjN^
3@!5AK,M
5Q? .J
.^Nu~3
5ACnxg
.NB-qAc
3:3:3_x.NqAw<0Nf:
.VJ5.a
3@!5AK,M
5Q? .J
.^Nu~3
5ACnxg
.NB-qAc
3:3:3_x.NqAw<0NfZ
.VJ5.a
3@!5AK,M
5Q? .J
.^Nu~3
5ACnxg
.NB-qAc
3:3:3_
-7A^ jNj
5Q?qAW
,NZ.NBm-7AC ,M
.NR-3@
5AS ,M
5U jNj
-',V>p
3:3:3:3_
5AjN~I7A_
.VJjN^
3@!5AK,M
5Q? .J
.^Nu~3
5ACnxg
.NB-qAc
3:3:3_x.NqAw<0Nf
.VJ5.a
3@!5AK,M
5Q? .J
.^Nu~3
5ACnxg
.NB-qAc
3:3:3_
5AjN~I7A_
.VJjN^
3@!5AK,M
5Q? .J
.^Nu~3
5ACnxg
.NB-qAc
3:3:3_
-7A^ jNj
5Q?qAW
,NZ.NBm-7AC ,M
.NR-3@
5AS ,M
5U jNj
7A_ $6
-',V>p
e:3:3:3_
5AjN~I7A_jN
.VJjN^
3@!5AK,M
5Q? .J
.^Nu~3
5ACnxg
.NB-qAc
3:3:3_x.NqAw<0Nfz
.VJ5.a
3@!5AK,M
5Q? .J
.^Nu~3
5ACnxg
.NB-qAc
3:3:3_
5AjN~I7A_cjN(K
.VJjN^
3@!5AK,M
5Q? .J
.^Nu~3
5ACnxg
.NB-qAc
3:3:3`
qA_<0N7AG,
aNI}t.Z7!
sI.N$
.Y"u}1 .I
3:3:3d,n
,^7Ac,
5.a}t(
,5y[q,
.^b-3P
7Ac .f
5A,f-~|0N.3q'jNFI
qAKy5>
.N7Q[.N.Nb
5Ao ,e
3A{jNf
.^5A{:-k
3:3:3:3
3A3,~
qAO<jNb?0K-
3A{jNv
.^5A{:-k
5Q3,5N
.^6-3P
u.^2-qA;
5A+ _.
5A,~3A3,
,jNZ0jLJ
,N3Q{.N.^
-',N6p
5Q3&SK
m3:3:3t,nv
7Q,f7AG ,~
qA_<?jNr<3KJjNR
A}N5.Qm
q.NF5A
)O.NF-U
5qYr *_:3:3:3
5qY _:3:3:3\-
Z:3:3:3\-
Z:3:3:3
.~fm3:3:3:3d,n
7Q,f-~0Nj
qA{<jN07KAEjNn
.N-qAg
-.Nf5Q_j
jKM-qAg
-u:j}~
7I'.^3A_,^b-3YjNI
qAk?>7
3.Vb5=,
5Ak :3:3
jIM-KZ
f:3:3:3
qAkYB>
5.y$q?x
5A; ,M
.N.--5=
)7AG N$F
a.N*(.
5Q# ~T.
sI.N$
5AjNfI7AG jNjjLz
5.a}tjNR
5yql(
5QC5A?
D.^B-J
zSjqX.
3:3:3`
,,N63Ag+^5-qAc1r?3,nv
7A{ ,]
5A; ,M
.N*--5=
&.^6".N.
sI.N$
5Q/&SK
|pA-5<
3:3:3_}
qAkyJ>
5.y$q?x
.NB-3@
..^6".N2
)7AG .$F
sI.N$
A.N*(.
5A# ^L.
sI.N5L &
-YuqAK
qAkYM>
5.y$q?x
}5..N-
.^F-3P
5Q' .O
:3:3:35A
)7AG N$F
sI.N$
a.N*(.
5A# ~I.
sI.N5L &
-yuqAK
s3:3\5Q
Y":3:3f
0NN-qAcYr?
5A; ,M
5n jNR
)7AG /x
sI.N$
5.yt.&
sI.N5L &
qAkIT>
5.y$q?x
5A; ,M
.N.--5=
..^6".N2
)7AG ^$F
sI.N$
q.N*(.
5Q# B.
sI.N5L &
0NN-qAc
,nv5-jNR
5.y%qGl
.Yyt.&
5Q? ,e
`A7jp7t
sI.N$
.N2----5=
(m >?x
.Y"u}E .I
5.y$q?x
.^--( ,M
.NB-3@
s#>,N:p
.{-qAK
)7AG $F
sI.N$
5A# ;.
sI.N5L &
.Nfm3\-
:j--c :j-
5yYf38
-E`,G3i
5yYf:3:3:3,-
5Y.fmW/
5Y.fm3:3,-
f:3:3:3
f:3:3:3
f:3:3:3
f:3:3:3
.^--3P
5Q& ,]
:3:3$,f
5A& ,M
5yYf-j
],5Y.fm
.f;5qYf:3:3\-
.SmzVfm-
3:3:3$.N9
/"3q,f
3Y,Nf3A,
&v.Nrp jNn
7Q,f7Ac,
5yYf5A
&v.Nrp jNn
.`{ ,]
.~{'.ffm-
.~{'.ffm3_
u3AgjNfI
,N.X|jN2h_K
5yYf:3:3\-
:|-}"l:3:3
302m-c
5Q.N ,,M
.I%Bzsl
--c ,]
5YYf7p
Yf:3$,f
5.y-c&
3:3$,f
,^----
,5Y.fm
5yYf
3:3$,
3A:j----
,5Y.fmW/
3:3$,~
E& :j---S
:3:3\-
,%aQ,M
Yf:3$,~
.Kc5z|
,5FzkBne%sBo
5YYf7p
.fm-3p
(,N250Y}
7A7 .f
5yYf :
,-.VF-}
7A{ "
5Y'.5A.95B25{fB(
)3Y:.f
5YYf:3:3
5Y'.5y&
.~{'.ffm
[:3:3:3$,
2}%kBn
:j---c
5Y.fm
3:3:3\-
3:3:3:3$,
:3:3:33.f
s3:3$,f
5Y'.5A,N
5,.O%Bsm5!
&,fG5Y
5Y.~
F=& :j-
:3:3-c
;,f5,^
5Y.fm5|
5Y.fm
5Y.fmW/
aNv ,M
5A2{'2--3@
5qYf:3:3:3$,
5q ,N%b9
:3:3:3$,~
5A2{'2--3@
5qYf:3:3:3\-
5,%%m2k-!3H
3:3$,~
5?4--3@
5qYf:3:3:3$,~
5A2{'2--3@
5qYf:3:3:3$,~
5A2{'2--3@
5qYf:3:3:3$,~!5q
.I%{2l7
b.^----
,5Y.fm
& '
:3:3\-
fm3:3_}
qASu?,N63IWc,nf-[
5<2%eD
5yq!|,N:3
,%A.N*
0Nr-!7A{ ,
0Vr-@m
5A m3:3:3:34,f
.95B25{fB(
53Y:.f
3:3:3$
5=25{f]
5yYf7p
3:3t,nv
7Q,f7AG ,~
qA_<jNryK
5Y.fm
5AjNfI7AG jNj7nL
5Y0Zf2
.^J5Y?
5< ,M
.VB!,M
5I; .
:s--3H
5Y.fm
f:3:3:3
fm3:3:3:3
s3:3:3$B
,jNJmLp
5Y.fm
30N.-s
5A3}<
,jNZgnL
5A5AB,^2n!.~
%Blsz-.^
5Y.fmW/
3Y. 5qB
5Qf:3:3
?m3:3:3:3
fm3:3:3:3
s3:3:3$B
5Y.fm
30N.-c
5A3}<
,jNZmnL
5A5AB,^2n!.~
%Blsz-.^
5Y.fmW/
3Y. 5qB
5Qf:3:3
?m3:3:3:3
5Qf:3&"7AG ,f
,jNj+nL
5A3QCLq,
().^J3@
5AO :3&"7AG ,f
,jNj1nL`
5A3QCLq,
().^J3@
5AO N:3
,%90,M
,=,5Y,
3:3:3\-
3fm3:3:3:3
:3:3:3\-
.fsbfm-cq
3:3:3\-
,%A/,M
.N--G}
3:3$,~
"k3:3:3T,n
7Q,f7Ac ,~
qA{<YjN
,K-c :j--qAg
.Nr3A[ >+
7Q,f7Ac ,~
qA{<ejN
.Nr3A[ ~*
,~7Ac,
qA{<MjNK-y
5Y.fm
.Nr3A[ )
7Q',^7Ac ,f
qA{<SjNLK-y
3>:j---qAg
.Nr3A[ (
7Q,f7Ac ,~
qA{<_jN
.Nr3A[ >(
7Q,f7Ac ,~
qA{<GjN
?,K-l:j
5Y.fm
.Nr3A[ ~'
7Q',^7Ac ,f
qA{<}jNK-y
3>:j---qAg
.Nr3A[ &
7Q,f7Ac ,~
jNLK-y
.Nr3A[ %
7Q,f7Ac ,~
qA{<qjN
?,K-l:j
5Y.fm
.Nr3A[ >%
,~7Ac,
qA{<wjN
---qAg
.Nr3A[ ~$
7Q,f7Ac ,~
.Nr3A[ #
7Q,f7Ac ,~
qA{<kjNLK-y
5Y.fm
.Nr3A[ "
7Q,f7Ac ,~
qA{<jN
3>:j--S{
5Y.fm
7Q,f7Ac ,~
jNKu-y
.^r3Q[ N!
7Q,f7Ac ,~
qA{<jNK-y
5Ak,Nb-
5A[ *T,n
7Q,f7Ac ,~
qA{<jN}K-y
3>:j--x
5Y.fm
7Q,f7Ac ,~
qA{<jNlK
.^r3Q[
7Q,f7Ac ,~
qA{<jN.K
5Ak,Nb-
5A[ T,n
,~7Ac ,
yy?jN,KU.Nf
.Z5e}u
5L|p-5<
.Vr3I[
,~7Ac ,
sy?jN,KE.Nf
.Z5e}u
5L|p-5<
.Vr3I[
,~7Ac ,
my?jN,KE.Nf
.Z5e}u
5L|p-5<
.Vr3I[
:3:3:3
@ `m3:3\-
YP:3:3:3
@ Um3:3
@ Um3:3\-
:3:3:3
Q@ Rem3:3\-
:3:3:3
dm3:3\-
:3:3:3
@ dm3:3
M/!I5M
3=fm3\5Y%P}]
`3?<,L
Yf:3:3
7/js}|`l
& Y</_
.Na5L3."3A{,M
.N---
7A7 n~.f
5yYf7p
5QEk95LF
.N:-[
3:3:3\-:
3fm3:3:3:3d,n
,~7Ac ,
o?jNKu
5Y.fm
MiNajNn
5Q_<iKiK,K
iNaT7p
qe jNn
3:3:3:3_}
qAS%p?0N>qA[?
,^6-+s
%.V:a/,"
h.^.3L,
.NJp jNB
5lke3.Y
,~7Ac'jNI
.^fI5A@,7Ac >w.f
5yYf7p
5Y.fm-qAg
:3:3:3$,~
LN5Y.fmW/
0M,_!pB
h:3:3:34,~
!5J2r|!Sq
A0^xC&?.On&
7>99Ic
.^-13P
5?%4jL
3:3:3:3_}
3ACjNjhL
3ao nq
%.JU5MB
,3=LiL,\
5Ay{3A+
j$E,N6p'
5I/ ,U
.VJ--m
5Y3?,L
e5<p8J
%kA+8^6
3:3:3:3
qA_<S,^n
#iL.LU?Lj
.N--3@
7AG Bo
R:3:3T,f
3OL0Ld
c:3:3d,n
,~7Ac'jNI
b.Nf5Y_
.[a(3A[
5QW-Ljt
,7Ac nk.f
5yYf7p
MLj:3T,
3St5s{mMd
Z2jf
'qB!\p
e3.^%k
q5S40h
5A{dT.
5S .^v
,=),N~~
5S2z53A{5
LI>:j~
:3:3:3_
e5AjNI7Ac jN(iL
5I_l-~
.^Z5I_T0
7Ac .enXg
.Nn-.^vp
5I[ :3:3_
e5AjNI7Ac jN<iL
5I_l-~
.^Z5I_T0
7Ac bnXg
.Nn-.^vp
5I[ R:3:3T,n
3Y,Nf3A,
jN|L.Nf
5A_ V-,
5yYf7p
5A[ jgT,n
3Y,Nf3A,
5A[ fT,n
3Y,Nf3A,
jNLE.Nf
7Ac F`
5A[ e\-
Yf5,5D
fm3:3:3:3&
7Ac ,f
&,nIjNn
7.^b-liK
jI"M-,N^
3=:j-"
7Ac J]nhg
3.VN5=,
5A_&"b
.^f3.Y
K,M3>.V^
jNI-~T,Nf3
q4.^b-liK
iKjK"
D-@K4M
5}0Nj-#T
p5QK.K.Y
5Q_jtjK"M-qAg
p?:7Ac,
5Q[.Nf
3QS,N^
.Vb5=,M
3.VZ5=,
3.Vb5=
.^f-"jNn
7Ac Xnhg
3.VJ5=,
5Q[,NN
5=.^N.Y
.^J!3=.^N
3>.J3@
e5A.^
3A_,^b-qA
p?-,ne.fb5I[
.K.J#5=,L5=
5I[,NV
3.Vb5YO
,jNMiL7Ac ,^!
0Nj-KN
5I[ Z7p
5QS.K.Y
.^f3.Y
3:3:3:3_
,jN]iL7Ac ,^j#
5I[ X7p
5QS.K.Y
.^f3.Y
3:3:3:3_
e5A.^
3A_,^b-qA
zp?72,n
.fb5I_.L
,- jNn
5.Nf5Q[.fV
5IK.J#5=
5YS.L.L
.Nb5Y_j
3.fZ5?
:3:3:3\-
Yf5,5D
fm3:3:3:3&
7Ac ,f
,jN|hL*'
z:RX.NqA{<0Nj-qA
(.^b5I_pp[
iKjK"
,V^-qAg
-q0Nj-SG
.^f3.Y
3:3:3:3_X,^
5Q[.Vf}}b
,V^-qAg
.^b--K
-',VZp
K`M5I_KdM
:3:3:3_
e5A.^
3A_,^b-qA
&q?s8,n
.^b5>5L
3.Vb5=,
3IW jNn
5AW vjq.
-',VZp
5Q[.K.Y
P:3:3_
e5A.^
3A_,^b-qA
.^b5>5L
3.Vb5=,
3IW jNn
I.N^3@
Yl0Nj-GC
-',VZp
5Q[.K.Y
O:3:3T,n
,~7Ac ,
Le.Vfkj
a@ jNn
Dm@.VfDq@
5yYf-',Nbp
5I[ NT,n
,~7Ac ,
p?jN LE.Vfkj
a@ jNn
Dm@.VfDq@
7Ac "H
-',Nbp
5I[ M:3:3:3T,n
.^3A_,^b-3q'jNIS
5Y[.Vf5?
,- jNn
U.^b5Y[
'5Y[.L.L
Yf5,5D
fm3:3:3:3&
7Ac ,f
,jNhL*1
z:RX.NqA{<0Nj-qA
.^b5I_pl[
iKjK"
5AW rojq.
-',VZp
KpM5I_KtM
3:3:RX.NqA{<0Nj-qA
p?A,nijNn
.^b5I_pl[
iKjK"
e0Nj-;
-',VZp
KpM5I_KtM
.NZ-cA
e5A.^
3A_,^b-qA
q?FB,n
.^b5>5L
%5Q_.K--
7Ac AnXg
3.Vb5=,
&G:3:3:3_
e5A.^
3A_,^b-qA
p?YC,n
.^b5>5L
.^f-jNn
y.^b5>5L
3:3:3T,n
,~7Ac ,
D}@.VfD@
7Ac ~?
-',Nbp
,~7Ac ,
D}@.VfD@
5Y.fm
-',Nbp
:3:3T,n
.^3A_,^b-3q'jNI;
5Y[.Vf5?
,- jNn
.^b5Y[
5Y.fm
5Y[.L.L
3:3:3:3d,n
?0N7Ac ,f
5yYf7p
5Ak.Nf-/
?0N7Ac ,f
5yYf7p
5Ak.Nf-/
:3:3:3
@ m3:3
m3:3d,n
7Q,f7Ac ,~
jN,L5.Nf3A[:j
5yYf-.^r
&.NR-qAg
5QW jNn
.^Z--w
,^R-qAg
3:3d,n
7Q,f7Ac ,~
.Nf3A[:j
5yYf-.^r
&.NR-qAg
5QW jNn
,^R-qAg
3:3d,n
3Y,Nf3A,
jNLU.Nf
5+.Nf-
5Y.fm
3Y,Nf3A,
u*0Nj-/
5Ak.Nb-
5AW F<:3:3:3d,n
3Y,Nf3A,
*0Nj-.
5Ak.Nb-
5AW ;:3:3:3\-
:3:3:3
m3:3$,f
3:3:3:3
,YYf:3:3-cYf:3:3
,KYf:3:3:3fm3:3:3
,KYf:3:3:3
0:3:3:3
.~fm3:3:3
1sdr3:3
5qYf-L
l{-L3:3:3`
5I--NI
3:3d,n
,Nf3A,^b-3q'jNI
5.^b-3
7Ac B0
}3:3:3
3-cYf:3:3\-
fm3:3:3
D3:3:3:3
!C3:3:3:3\-
X3:3:3
:3:3d,n
?0N7Ac ,f
5yYf7p
5A:--3
5Ak.Nf-
5AW 2d,n
?0N7Ac ,f
5yYf7p
5A:s--3
5Ak.Nf-
5AW 1\-
:3:3:3
@ 2m3:3
m3:3d,n
7Q,f7Ac ,~
qA{<jNL
.Nb3AW:j
5Y.fmW/
-',^Zp
5QS &0
.^-c ,]
`.Nf3@
:3:3d,n
7Q,f7Ac ,~
qA{<jN
Le.Nb3AW:j
5Y.fmW/
-',^Zp
.^-c ,]
M_.Nf3@
:3:3\-
Y:3:3:3
m3:3-u
YF:3:3:3
Q@ m3:3-u
Y:3:3:3
@ "m3:3
m3:3\-
:3:3:3
0^ Y0:j-
5> N/x
7I{--L0V8&)3
0m8q 7h
-8y .I
0N-(i
`@&}0i
7A{:-3K
%0] /P
:3:3:3-u
iIiIiI
:3:3:3-u
iIiIiI
:3:3:3\-
U5?jq V
5?jpX3
E5?jq
5?jph3
E5?jq fa
Yf Ra
5?jph3
:3:3:3
a@ Bm3:3-u
Yf:3-u
Yf:3\-
:3:3:3
y@ m3:3
y@ rm3:3_
e5AjNI7Ac jNqL^^
5A[,N^-c'
-',^Zp
5A_ ,M
Oc:3:3_
e5AjNI7Ac jNqL`
5A[,N^-c'
-',^Zp
7A_ ,]
5Q[ ,
Mc:3:3\-
Y:3:3:3
e5AjNI7Ac jN
5A[,N^-c'
-',^Zp
7A_ ,]
Lc:3:3_
e5AjNI7Ac jNqLc
5A[,N^-c'
-',^Zp
5A_ ,M
qJc:3:3\-
Y:3:3:3
@ m3:3
@ m3:3zi
0^ Y0:j-
+J8-L7
0^ Y0&-!c
7I{--L0V8&)3
%5A{.J
0N-(i .J
`@&}0i
0m-8q7h
-8y ]
7A{ 3K
%0q .
iIiIiIjI
LYf:3:3-u
iIiIiIjI
LYf:3:3\-
U5?jq (
,%,fTf7
5?jpX3
5?jpO3
U5?jq (
5?jpd`
5?jpO3
U5?jq (
5?jpd`
5?jpO3
0^ Y0:j-
+J8-L7
0^ Y0&-!c
7I{--L0V8&)3
%5A{.J
0N-(i .J
`@&}0i
0m-8q7h
-8y ]
7A{ 3K
%0q .
iIiIiIjI
LYf:3:3-u
iIiIiIjI
LYf:3:3\-
U5?jq (
,%,fVfw
5?jpX3
5?jpO3
U5?jq (
5?jpd`
5?jpO3
U5?jq (
5?jpd`
5?jpO3
Y:3:3:3
)@ m3:3\-
Y:3:3:3
i@ 2m3:3`
3:3:3:3T,n
7Q,f7Ac ,~
qA{<mjN
$L%X-y
7Q,f7Ac ,~
qA{<ajN$LuW-y
5Y.fm
.Nr3A[
7Q,f7Ac ,~
qA{<gjNo%LW-y
7Q,f7Ac ,~
qA{<[jN
5Y.fm
.Nr3A[ .
3Y,Nf3A,
jN&LeU.Nf
!0Nj-[
.Nr5A_ n
3Y,Nf3A,
qA{<yjN'LU.Nf
3Y,Nf3A,
qA{<sjN?(LT.Nf
5A_ >,
Y:3:3:3
I@ rm3:3
I@ Rm3:3-u
Y6:3:3:3
@ m3:3T,n
7Q,f7Ac ,~
qA{<+jNL*LR-y
5Y.fm
.Nr3A[
7Q,f7Ac ,~
qA{<jN+L5Q-y
5Y.fm
.Nr3A[ N
7Q,f7Ac ,~
qA{<%jN+LP-y
5Y.fm
.Nr3A[
7Q,f7Ac ,~
jN\,LP-y
5Y.fm
.Nr3A[
3Y,Nf3A,
qA{<=jN
-L%O.Nf
5A_ n,
.Nr5A_ .
3Y,Nf3A,
qA{<7jN-LeN.Nf
3Y,Nf3A,
qA{<1jN
.LN.Nf
7Q',^7Ac ,f
qA{<jN2/L
3>& jNn
5Ak,Nb-
5A[ :3:3:3T,n
7Q,f7Ac ,~
qA{<jN/LEL-y
.Nr3A[ V
3:3:3T,n
,^7Ac ,~
jN0LK-y
:3:3:3T,n
7Q,^7Ac ,f
jNr1LK-y
5Ak,Nb-z
5A[ v:3:3:3T,n
7Q,f7Ac ,~
qA{<jN42L
.Nr3A[
3:3:3T,n
7Q,f7Ac ,~
jN2LEI-y
:3:3:3-u
Y&:3:3:3
m3:3-u
Yv:3:3:3
@ ~m3:3
3A_,^bqA=?
5Q[5DB
,VZr(
~.^b.Q5
fm3:3:3:3
5qYf7p
}3iLp+\
5qYf:3
qAY?fb
,f7A0NN3
qAct?.^
.^J-3P
5ACt(3A;}
c%7Q{,M
.^B-5<
3Q3}3
3fm3:3`
_dNvpj
5Yg.]u
.fz3Pn
5qqAo}c
m5Yw#.Lq3C
,Nz-3Ao5
-]iP9 [) P
3:3:3:3T,n
3Y:7A0Nj-3q'jNI_
.Nf-lp
5A_ *,
:3:3:3\-
Tfm3:3T,n
3q:7A0Nj
qA{<^jN=L>jNn
:3:3:3\-
Ufm3:3\-
YF:3:3:3
@ [m3:3
@ [m3:3-u
Y:3:3:3
@ "tm3:3
sm3:3-u
Y:3:3:3
@ rsm3:3
@ Rsm3:3`
X.N!I&
Tk~| p@
!5yF<j-u
---I,3
{~| p3
J2Bqn$,
`A?-uR
[I? Jf
3:3:3:3_
5AjNfI7AG7jNrFL
5IC,7Y{ &
7A{ Vq
`,N2A3
5ACnxg
.^V3Q; rp,
.^> .I
5ACnxg
Yf:3:3
j-I,N
5A m3:3f
`Afm3:3&
7Ac .f
5yYf7p
qA{<;jNdIL
7Ac .f
5yYf7p
7Ac &.f
5yYf7p
7Ac f.f
5yYf7p
qA{<jNKL
7Ac .f
5yYf7p
qA{<jNdLL
7Ac .f
5yYf7p
qA{<jN$ML
7Ac &.f
5yYf7p
qA{<kjNML
7Ac f.f
5yYf7p
qA{<jNNL
7Ac .f
5yYf7p
qA{<[jNdOL
7Ac .f
5yYf7p
qA{<KjN$PL
7Ac &.f
5yYf7p
qA{<+jNPL
7Ac f.f
5yYf7p
7Ac .f
5yYf7p
qAkx^?
5I?:}5I;
.V:-3x!3H
.V:3I.^J5.a}t.
y7AG 0nW
.f~~}5.Qm
QA.^F}p>
u'.N$
|pG-5<
5D,N6m
&A-.VB-
3Q/#q~
}5I/ ,]
---jNR
m o,V:5I3
7AG 60nW
5IO,V2p
<)>jNR
5A+ z5.
3Mfm3:3:3
3Mfm3:3:3
,O-3.}
3.~fm-b
3.~fm3:3
5A,^n
,jNjEnL
5Y.fl
&R.NVp jNR
A%,3A;
Y().^>3@
5A;H3:3:3:3&"7AG ,f
,jNj=nL
5Y.fl
&R.NVp jNR
/"5Q?,M
.NJC:3:3:3
3Y0NN3
qAcZu?y>
5< jNR
.VF-3H
.V>-jNR
c7A{ &o3:3:3:3f3
3A?jNjkL~
0NM--qAK
7A{ 6U,
( 0NN-
.V>-3H
7AG $6
.V6-qAK
5I#-5<
5q'-5<
7Q,f7Ac,
5yYf7p
5Q[,5N
.^^-3P
5yYf-5<
.^Z-qAg
5AS V+.
3Mfm3:3:3
3Mfm3:3:3
,O-3.}
3.~fm-b
--2iL
3.~fm3:3-@
E3:3-@
5j3:3-@
l3:35@
J-3:3:3:35@
3:3:3:35@
3:3:3:35@
J-3:3:3:35@
3:3:3:35@
3:3:3:35@
J-Mi3:3:3:35@
k3:3:3:35@
J-]u3:3:3:35@
J-]v3:3:3:35@
3:3:3:35@
3:3:3:3
x!oLn
x!oQ)l
D.6\!CI.
LUNHhQNE
LHJAU[XAJUU[NOPO
a-<1@5
o-<1@5K@O)
,;0?4j
G]L]I]?]A]=]J]?]E]A]F]
D.6\VL
HK?`.N)6FSCQ)RC<
})~ V
iQFOf0
|lPdKJi8xy("vI@
yplpB
@JE;@U
CCCCCCCCCCCCCC
AAAAAAAAAAAAAAAAAAAAA
AAAAAAAAA
AAAAAAAAAAAA
AAAAAA
CCCCCC
CCCCCC
?@FHIMZEMLLPQRQUXasyMYSY\Y]^o`gST[[\]^dreiclimilelrq}blinaququ~x_dcinoilhourvyz|ty~rvq}_^YZ]abeadkcvrvynaefiniilq}szpt}suvruy}yy{~
>BCSEINZTZQNSPUS\acbf]Y_WX[]Y\]YY^Wcjnehnbdqszv{bks}{|TZ]XYfbgjnkaov{sr{KMW[QUX^[`eafjnmut{bbeimzrq{y}pvvtrvy|y~
]CKEINDTEGLJ[NNRVV]RV\dahn`tNZ]Q^_agceidkox
r~yV[`finmppvr}mpusz}y}

Process Tree

073edd98f5b792f405b9d00718685ce715e20753276a75523dddfb96a95eaaa2.exe, PID: 2336, Parent PID: 3028

default registry file network process services synchronisation iexplore office pdf

oddpvk.exe, PID: 3052, Parent PID: 2336

default registry file network process services synchronisation iexplore office pdf

DNS

Name Response Post-Analysis Lookup
dns.msftncsi.com A 131.107.255.255
dns.msftncsi.com

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 61714 8.8.8.8 53
192.168.56.101 56933 8.8.8.8 53
192.168.56.101 138 192.168.56.255 138
192.168.56.101 58485 114.114.114.114 53
192.168.56.101 58485 8.8.8.8 53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Name a1a720d15f076957_windows .exe
Filepath C:\Windows .exe
Size 560.0KB
Processes 3052 (oddpvk.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 0fd9a4f974d581d6a8af35a8d5c35eba
SHA1 1a529746beda54728326a3caed0aa809601ddc5f
SHA256 a1a720d15f0769574c203cdb1e5cd1e99f12605aa9bfecd05398284b27e6ea4e
CRC32 95D5251B
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 3c4d4875e000c229_install.ini .exe
Filepath C:\install.ini .exe
Size 560.0KB
Processes 3052 (oddpvk.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 e8aede8405b4d8bb1eb41f740af1576d
SHA1 43f96cd8d2cddd726b1403d6523947b91e4871bf
SHA256 3c4d4875e000c22911b92c2d78a942e8ef9a21628c3ce1e28c968a720fa3eea9
CRC32 50EAA19D
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 12065a3f5f5880fd_program files (x86) .exe
Filepath C:\Program Files (x86) .exe
Size 560.0KB
Processes 3052 (oddpvk.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 e01769979baf41fe24fd7404d756c70c
SHA1 6030e396f0f5ba0607d56d25a57d162d9b524ceb
SHA256 12065a3f5f5880fdbe04df985f60e58ee4eb55c2c3091b39ba6fa60b9358d144
CRC32 44953800
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 84bca4ec80607aaf_eula.2052.txt .exe
Filepath C:\eula.2052.txt .exe
Size 560.0KB
Processes 3052 (oddpvk.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 472153327f6abddb4a350945c1f20ef4
SHA1 4f27dd22ffa3f4beaee93353ef7945715b5236bc
SHA256 84bca4ec80607aaff63f2d4d507a49f99e05fed70ae98f936b227d499f6f10c4
CRC32 FA8C3755
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name e3b0c44298fc1c14_Mirar
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 1c196ea3d38a9bb7_programdata .exe
Filepath C:\ProgramData .exe
Size 560.0KB
Processes 3052 (oddpvk.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 93fd45c5d0718915b85e2784c24f3479
SHA1 7cfca4070141abdb99c618ea21a31499dd5d40f6
SHA256 1c196ea3d38a9bb71e7321f7bb02a937b2877829841e4c82fb8776e55b0c8e13
CRC32 95D3F151
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 226b9b65dcdf8c03_vc_red.msi .exe
Filepath C:\VC_RED.MSI .exe
Size 560.0KB
Processes 3052 (oddpvk.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 7825c1ac54d45a6b0ba642f1a28c5347
SHA1 356ed728d4d4a5c91e6fc24428ee7c0756ed4e86
SHA256 226b9b65dcdf8c0328e66e5cc613d6d1c1f35bc7e47e7a0f70d43376e01ea9c6
CRC32 640D1B13
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name dc2214022e8be1e5_mira.h
Filepath C:\ProgramData\Saaaalamm\Mira.h
Size 270.0KB
Processes 2336 (073edd98f5b792f405b9d00718685ce715e20753276a75523dddfb96a95eaaa2.exe) 3052 (oddpvk.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 ca9dfac0aff393d7ad3732c18bf722be
SHA1 0bbb7be6293e7fd953293d9e7d5ad0cbfbc81e75
SHA256 dc2214022e8be1e51c69f9554ad5e5da74e9a9f7ec8fd2f08b3e5c9f0bb01423
CRC32 AD6A36A4
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 4764d485e033c956_vc_red.cab .exe
Filepath C:\VC_RED.cab .exe
Size 560.0KB
Processes 3052 (oddpvk.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 e9d3026c01c2744b14591d0e630d2783
SHA1 d67975ca4af1f3615c2de375486216708aec5230
SHA256 4764d485e033c956c1e66288757dfdb11226e00abdaf5e50ec39bce6fe4616c1
CRC32 FECB02A0
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 93f67f17b5c83614_oddpvk.exe
Filepath C:\ProgramData\oddpvk.exe
Size 290.0KB
Processes 2336 (073edd98f5b792f405b9d00718685ce715e20753276a75523dddfb96a95eaaa2.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 fba623c65bf65867bd3d9199153f78c5
SHA1 bec198af1747a0bba2e9457bca3dc4cabdd58c09
SHA256 93f67f17b5c83614e8e17f6fcc7b067d093ce90b4631601a4c1d8340854f2df5
CRC32 703074E6
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 1f1e1d2c6fb230f9_system volume information .exe
Filepath C:\System Volume Information .exe
Size 560.0KB
Processes 3052 (oddpvk.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 d1c353eccb14b4f0e0c2ce6c61349d26
SHA1 70e0ed4e53e9f57a529e3ea40c3c78191f8d83d4
SHA256 1f1e1d2c6fb230f9695e107bd6a1d96092fc6eb402cc96da7fc509581ba7f7cb
CRC32 E2DE6CA8
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 376270814f29c9c5_program files .exe
Filepath C:\Program Files .exe
Size 560.0KB
Processes 3052 (oddpvk.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 e9c81cf26546adebd2abe4b2d3e6628b
SHA1 55f52fb4e6a9635e4156e9525c49c4ea4b85a0ba
SHA256 376270814f29c9c55b39d0163425a497680c608cf91b989011b857a0ce0462fa
CRC32 033937E7
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name c0805487eb94b7b1_documents and settings .exe
Filepath C:\Documents and Settings .exe
Size 560.0KB
Processes 3052 (oddpvk.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 c22437f99d82c74711238e203eb6c903
SHA1 b2c740a294e459653b4baf00127937ba41af4a05
SHA256 c0805487eb94b7b1d128452c02bbe280c44d929653cfb5dd5070749bae6c6dc6
CRC32 CCFE7358
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 635dd751340c1b5c_pagefile.sys .exe
Filepath C:\pagefile.sys .exe
Size 560.0KB
Processes 3052 (oddpvk.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 06c9d0cb0e8eacb621859a8be8a2d879
SHA1 15a4032a22a1fa8293ef0e28fbd01b894c84fddb
SHA256 635dd751340c1b5c118d92109c512a5fff234997d5bfb6335a96545b8af9a0be
CRC32 3B73231E
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 2a7bcf348a242895_perflogs .exe
Filepath C:\PerfLogs .exe
Size 560.0KB
Processes 3052 (oddpvk.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 90cf444addfc413f52040cefe0a02546
SHA1 0766c379bec7b74aecd12f4a23d40d99e9ade96d
SHA256 2a7bcf348a242895607dfd3f5135126db3605ba794d40328ce76b9d9f4eebfff
CRC32 B1985739
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 8887a203347ad122_install.res.2052.dll .exe
Filepath C:\install.res.2052.dll .exe
Size 560.0KB
Processes 3052 (oddpvk.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 6413cf6f92d84bbf589ee1a71c3433ee
SHA1 513d4a8462e8e61cf0758e2419a7054fabbfae99
SHA256 8887a203347ad122023aa00e301b8b9c0ea1dfaf29ed09fe4f822d1afcf3c8e8
CRC32 E8A01E7F
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name d8b21af9b1ca4e03_360downloads .exe
Filepath C:\360Downloads .exe
Size 560.0KB
Processes 3052 (oddpvk.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 d2361b02255b8817a04dfefe1e4e2749
SHA1 018f27872a772b82c5b558fc9b6691af4b350762
SHA256 d8b21af9b1ca4e03230f967c75cd2de18569fc62174587a737c0a2088ff00fba
CRC32 D692F9B0
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name f4c3182c8a6c02c1_recovery .exe
Filepath C:\Recovery .exe
Size 560.0KB
Processes 3052 (oddpvk.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 f088ee2687db5d1f61ae32c0b84ea0ca
SHA1 7f1d5e8d906b4d0da188a5a1cd05204ab4bd3d1e
SHA256 f4c3182c8a6c02c1654a8840af19d3936ca931d4276041d96fe1590176e1398c
CRC32 F0B23789
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name e8b21f381e4838b2_$recycle.bin .exe
Filepath C:\$Recycle.Bin .exe
Size 560.0KB
Processes 3052 (oddpvk.exe) 2336 (073edd98f5b792f405b9d00718685ce715e20753276a75523dddfb96a95eaaa2.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 d8d0f9dbaf0687077347c8fa375a315e
SHA1 ec455c6fb86c250815b9ca51900abd68f7a277a6
SHA256 e8b21f381e4838b24b0379f058f472ae9748fc8e515de1f456a99908a0b8e55f
CRC32 21EAA8CB
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 2a89f0e2f430a88f_gcoxh .exe
Filepath C:\gcoxh .exe
Size 560.0KB
Processes 3052 (oddpvk.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 3dc254cb2a638795c81970adc8b71fbf
SHA1 b49dd3d2b3dc580e88da4b0b545cc50f4e548cc4
SHA256 2a89f0e2f430a88fa8a7c5eea207e631cef4c7c5ddc12552abf4b4fc7e86b1ce
CRC32 BFD56F70
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name d566bf4414927073_python27 .exe
Filepath C:\Python27 .exe
Size 560.0KB
Processes 3052 (oddpvk.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 ae13b053b2863f7c1ae8116714d046f7
SHA1 cd242fcdc718cfc571108de7926d02f8512eb05f
SHA256 d566bf4414927073d287b11965138c96f77d5ed688399f27e6d88e962cc66480
CRC32 5FC59320
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 08492d0a4cb3454e_xkyysllas .exe
Filepath C:\xkyysllas .exe
Size 560.0KB
Processes 3052 (oddpvk.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 2db2662a4700db65a8a02769291b6766
SHA1 75a72a9be4b6953597617bab836525a10fb06296
SHA256 08492d0a4cb3454e13187cbf6849e4e901088371f7bf17d7f88c18ec28446510
CRC32 C68E3884
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 0f4cda0b51f9a3e3_vcredist.bmp .exe
Filepath C:\vcredist.bmp .exe
Size 560.0KB
Processes 3052 (oddpvk.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 c070e47be911c2ee4be6e23aec6229ae
SHA1 fb2b0b9eb6cc43e51e81a0608fbaf14bcd192aa4
SHA256 0f4cda0b51f9a3e3d3b6e6d5a1b130abee3ad6b580eaa9603ceaa02c0a7f168b
CRC32 5870CDE4
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 789393556e536bc8_users .exe
Filepath C:\Users .exe
Size 560.0KB
Processes 3052 (oddpvk.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 766a81b4bfeb87d388a8acbda8ba6709
SHA1 3dbb04fdeefe8e50e538966520948a55d16bab35
SHA256 789393556e536bc80c0ffb9d78c2ee3d6fdb9a4d8454ac4710ac4b5b2efeccb8
CRC32 C4022632
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 14044409b8924663_globdata.ini .exe
Filepath C:\globdata.ini .exe
Size 560.0KB
Processes 3052 (oddpvk.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 fb5965ca6345264cfa12f8c7aa047146
SHA1 a1c5d37e05080e05184d40115f95188e2e31cf8c
SHA256 14044409b8924663aa40606e9c3e2a2ea2f69f700ed1fefd194b01e7b6123db0
CRC32 F6311CB5
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 80695db91d05d709_install.exe .exe
Filepath C:\install.exe .exe
Size 560.0KB
Processes 3052 (oddpvk.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 6858459ab28594acf14fe068f85213eb
SHA1 15338545d357b2e96313728bcb4f777ea8f7ea82
SHA256 80695db91d05d709a60d28a57cff365e59a22ea6c7885988691ad3a14377109c
CRC32 6AFAE4DF
ssdeep None
Yara None matched
VirusTotal Search for analysis
Sorry! No dropped buffers.