SmartHawk

2.1

中危

55 个模型检测该样本为恶意！

重新分析

下载样本

0d379ca43c05b63304611b55a1abd62448cef58210c260aad538aa4c796f73da

0d379ca43c05b63304611b55a1abd62448cef58210c260aad538aa4c796f73da.exe

分析耗时

133s

引擎	描述	特征	威胁分数	可能家族	检测耗时
DACN	基于动态分析和胶囊网络的可视化恶意软件检测	API调用、DLL以及注册表的修改情况	0.15	Unknown	0.05s
FACILE	利用改进的层次胶囊网络对二进制恶意软件图像进行识别分类	二进制图像映射为的灰度图像	1.00	Unknown	0.03s
IMCLNet	轻量化深度卷积网络模型实现恶意软件家族检测	原始二进制映射而成的可视化图像	0.84	Unknown	0.22s
MFGraph	利用静态特征构建图网络以检测恶意软件	原始二进制PE文件的静态特征节点	0.00	Unknown	0.00s

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	None	20190527	0.3.0.5
Avast	Win32:MalwareX-gen [Trj]	20200802	18.4.3895.0
Baidu	None	20190318	1.0.0.2
CrowdStrike	win/malicious_confidence_100% (D)	20190702	1.0
Kingsoft	None	20200802	2013.8.14.323
McAfee	Packed-FJB!D12BF1B4AB8C	20200802	6.0.6.653
Tencent	Trojan.Win32.Kryptik.gify	20200802	1.0.0.1

Time & API	Arguments	Status
1727545339.968375 NtAllocateVirtualMemory	process_handle: 0xffffffff base_address: 0x015d0000 region_size: 204800 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) protection: 64 (PAGE_EXECUTE_READWRITE) process_identifier: 2108	success
1727545339.968375 NtAllocateVirtualMemory	process_handle: 0xffffffff base_address: 0x00400000 region_size: 86016 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) protection: 64 (PAGE_EXECUTE_READWRITE) process_identifier: 2108	success
1727545339.968375 NtAllocateVirtualMemory	process_handle: 0xffffffff base_address: 0x00400000 region_size: 4096 allocation_type: 4096 (MEM_COMMIT) protection: 64 (PAGE_EXECUTE_READWRITE) process_identifier: 2108	success
1727545339.968375 NtAllocateVirtualMemory	process_handle: 0xffffffff base_address: 0x00401000 region_size: 36864 allocation_type: 4096 (MEM_COMMIT) protection: 64 (PAGE_EXECUTE_READWRITE) process_identifier: 2108	success
1727545339.968375 NtAllocateVirtualMemory	process_handle: 0xffffffff base_address: 0x0040a000 region_size: 4096 allocation_type: 4096 (MEM_COMMIT) protection: 64 (PAGE_EXECUTE_READWRITE) process_identifier: 2108	success
1727545339.968375 NtAllocateVirtualMemory	process_handle: 0xffffffff base_address: 0x0040c000 region_size: 16384 allocation_type: 4096 (MEM_COMMIT) protection: 64 (PAGE_EXECUTE_READWRITE) process_identifier: 2108	success
1727545339.968375 NtAllocateVirtualMemory	process_handle: 0xffffffff base_address: 0x00410000 region_size: 16384 allocation_type: 4096 (MEM_COMMIT) protection: 64 (PAGE_EXECUTE_READWRITE) process_identifier: 2108	success
1727545339.968375 NtAllocateVirtualMemory	process_handle: 0xffffffff base_address: 0x00414000 region_size: 4096 allocation_type: 4096 (MEM_COMMIT) protection: 64 (PAGE_EXECUTE_READWRITE) process_identifier: 2108	success

Time & API	Arguments	Status	Return	Repeated
1727545339.45275 MoveFileWithProgressW	flags: 2 oldfilepath: C:\Users\Administrator\AppData\Local\Temp\0d379ca43c05b63304611b55a1abd62448cef58210c260aad538aa4c796f73da.exe oldfilepath_r: C:\Users\Administrator\AppData\Local\Temp\0d379ca43c05b63304611b55a1abd62448cef58210c260aad538aa4c796f73da.exe newfilepath: C:\Users\Administrator\AppData\Local\Temp\old_0d379ca43c05b63304611b55a1abd62448cef58210c260aad538aa4c796f73da.exe newfilepath_r: C:\Users\Administrator\AppData\Local\Temp\old_0d379ca43c05b63304611b55a1abd62448cef58210c260aad538aa4c796f73da.exe	success	1	0

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1970-01-01 08:00:00

PE Imphash

ef3fd1c1a81435e51fcc42212e25d2ec

Sections

Name	Virtual Address	Virtual Size	Size of Raw Data	Entropy
.text	0x00001000	0x00013e00	0x00013e00	6.908542292460412
.data	0x00015000	0x00001084	0x00001200	4.048196718904612
.rdata	0x00017000	0x000138ec	0x00013a00	7.641451742397409
.bss	0x0002b000	0x000027e4	0x00000000	0.0
.CRT	0x0002e000	0x0000000c	0x00000200	0.11446338125913882
.idata	0x0002f000	0x000009a5	0x00000a00	4.865653897359711
.rsrc	0x00030000	0x00001138	0x00001200	3.8597127615059303

Resources

Name	Offset	Size	Language	Sub-language	File type
RT_ICON	0x00030ae0	0x00000128	LANG_NEUTRAL	SUBLANG_NEUTRAL	None
RT_ICON	0x00030ae0	0x00000128	LANG_NEUTRAL	SUBLANG_NEUTRAL	None
RT_ICON	0x00030ae0	0x00000128	LANG_NEUTRAL	SUBLANG_NEUTRAL	None
RT_GROUP_ICON	0x00030c08	0x00000030	LANG_NEUTRAL	SUBLANG_NEUTRAL	None
RT_VERSION	0x00030c38	0x000002e4	LANG_NEUTRAL	SUBLANG_NEUTRAL	None
RT_MANIFEST	0x00030f1c	0x00000219	LANG_NEUTRAL	SUBLANG_NEUTRAL	None

Imports

Library kernel32.dll:

• 0x42f1c8 GetLastError

• 0x42f1cc SetLastError

• 0x42f1d0 GetTickCount

• 0x42f1d4 ExitProcess

• 0x42f1d8 GetStartupInfoA

• 0x42f1dc GetStdHandle

• 0x42f1e0 GetCommandLineA

• 0x42f1e4 GetCurrentProcessId

• 0x42f1e8 GetCurrentThreadId

• 0x42f1ec GetCurrentProcess

• 0x42f1f0 ReadProcessMemory

• 0x42f1f4 GetModuleFileNameA

• 0x42f1f8 GetModuleHandleA

• 0x42f1fc WriteFile

• 0x42f200 ReadFile

• 0x42f204 CloseHandle

• 0x42f208 SetFilePointer

• 0x42f20c FreeLibrary

• 0x42f210 LoadLibraryA

• 0x42f214 GetProcAddress

• 0x42f218 DeleteFileW

• 0x42f21c MoveFileW

• 0x42f220 CreateFileW

• 0x42f224 GetFileAttributesW

• 0x42f228 GetConsoleMode

• 0x42f22c GetConsoleOutputCP

• 0x42f230 GetOEMCP

• 0x42f234 GetProcessHeap

• 0x42f238 HeapAlloc

• 0x42f23c HeapFree

• 0x42f240 TlsAlloc

• 0x42f244 TlsGetValue

• 0x42f248 TlsSetValue

• 0x42f24c CreateThread

• 0x42f250 ExitThread

• 0x42f254 LocalAlloc

• 0x42f258 LocalFree

• 0x42f25c Sleep

• 0x42f260 SuspendThread

• 0x42f264 ResumeThread

• 0x42f268 TerminateThread

• 0x42f26c WaitForSingleObject

• 0x42f270 SetThreadPriority

• 0x42f274 GetThreadPriority

• 0x42f278 CreateEventA

• 0x42f27c ResetEvent

• 0x42f280 SetEvent

• 0x42f284 InitializeCriticalSection

• 0x42f288 DeleteCriticalSection

• 0x42f28c EnterCriticalSection

• 0x42f290 LeaveCriticalSection

• 0x42f294 TryEnterCriticalSection

• 0x42f298 MultiByteToWideChar

• 0x42f29c WideCharToMultiByte

• 0x42f2a0 GetACP

• 0x42f2a4 GetConsoleCP

• 0x42f2a8 SetUnhandledExceptionFilter

• 0x42f2ac EnumResourceTypesA

• 0x42f2b0 EnumResourceNamesA

• 0x42f2b4 EnumResourceLanguagesA

• 0x42f2b8 FindResourceA

• 0x42f2bc FindResourceExA

• 0x42f2c0 LoadResource

• 0x42f2c4 SizeofResource

• 0x42f2c8 LockResource

• 0x42f2cc FreeResource

• 0x42f2d0 GetWindowsDirectoryA

• 0x42f2d4 CopyFileA

• 0x42f2d8 CreateProcessA

• 0x42f2dc GetVersionExA

• 0x42f2e0 CompareStringA

• 0x42f2e4 GetLocaleInfoA

• 0x42f2e8 EnumCalendarInfoA

• 0x42f2ec FormatMessageW

• 0x42f2f0 CompareStringW

• 0x42f2f4 TerminateProcess

• 0x42f2f8 GetThreadLocale

• 0x42f2fc SetThreadLocale

• 0x42f300 GetUserDefaultLCID

Library oleaut32.dll:

• 0x42f308 SysAllocStringLen

• 0x42f30c SysFreeString

• 0x42f310 SysReAllocStringLen

Library user32.dll:

• 0x42f318 MessageBoxA

• 0x42f31c CharUpperBuffW

• 0x42f320 CharLowerBuffW

• 0x42f324 CharUpperA

• 0x42f328 CharUpperBuffA

• 0x42f32c CharLowerA

• 0x42f330 CharLowerBuffA

• 0x42f334 GetSystemMetrics

• 0x42f338 MessageBeep

L!This program cannot be run in DOS mode.
.rdata
.idata
=L|9xGCG23
|{KF{B
Lu|h@uL
xw<8w@
>hBCwn
O9T8s\
L@9D8sH
DulhuD
ph6u@:sDhy
tkuthCD
sxhIsp:
@hI=wn
@c1h|I=_HwI
-`Ek;`Ek
|=wX_CQ}I
i|Y_p_p_x_x
?k!wY}J
bxZJ}bw'k
`@}j8GA
wXFF8MFF
8MGGG9LGG
@&iFFF
@&iVw8
B}ip/J
{QCJ@h
qCwL6?
Q>Ji}isU
u~~|wV
JwSrQA
=C6C8=
`JiBs'88G
NwZ@RH
aCs$wJ
Z}Mw,P
!w|P|I=wn
BB=HK6
B}KhYq
43ML2Gwb?a
zFFLL2|bA
-KF|f4
7Iwnw]
a=EXc&
XgI<wn
vCwnwM
kD6[G`HPC=.
Bv[Cwn
-1k.SS
HwzShs
$0k&ZS
SbwX:k%S-i
|wCwfwD
|wSwfw\
Rws99HJut
{88@Bud8@Bu\9HJuT8@Bw]
A:w{;?Z
TuP8FY<
A@LPk4CAZPwM8'6]w
AnrwPAP.??
/JyAJ}i
b?C}Kw&
S9s[`wS
T>Rw[Ax
Qwyh,i(0 
}K|u|(
2s%LXk
|wc9]th
ScwS;k%X-h;
8s$h1y
AwXs@8-k
S`wI8k%B-k
8s$Ghz
<8;k;Hs
?=|XwJ
B$BJ`wM
?,.Qjw0
=A@wYu8
?7?RZ??
PD`[[Sbw
p}r3;k
=3k.CS
8wJquP
Sfw{>k%p-m
^/F/BA
twZGNL,
K/o/kAu`w?Ju\?
>,^u4;Ku0
ZE`SQSku
^/R/NA
;wbJ?>
['?AwJ
?SOh!t
h`AhAl
B?JFtHwJ?=?ZS
[$?BwJ
sAH1wI
,zKt@H[
>6Pu0F
CG4H4R.
Bw{hP"t
@?F?JPwH
sAH1wI
?FZFN?=?J
?=?Pw@k
+??(Pw<A4A<.?^Pw8HDA]
Ir?G4Z&
,uLhQT
?F:hqS
k4lx4Y
?Y}`wU
t4lupu
Mux9Lt
|xqCwS
R9`CQEt
twA8M2GLw
AwShd*t
9TkLTs
a`Fk}J
F{}s~H[
`AzJkQ
i}\}\n
r=w{/9
xwEht-t
Xwzhd6t
szszwDA
1ZjQ&ZOQ%=I&{S[Sj/Lwsu
wswAkwDQj/SQO/P=7-{&PS
H0\H}U,
HSwa8Hh
PwAkwJ
PYwswCwsw[R
O/aQX/DQ[6ISp-.XjQ9|s
p7IwnwX
Lt9DGC8
h9sDhQsHhYstha
BupGhzP
@3pB:hYw
BupGhY
@3pB:hw
|{KF{B1h
<FZk@L
tsth!@4
u<w,Gs
w8k@^F
;{Ku|<@n
8w@K}@s
>h%I<wn
1uLuL{KhUt
xu|hmux
{t~0kwu0Dt
uxux{Kh
HwzhDt
tuxhI5
V{Yu|?q}d
Jwpk}M
wyzu|Ghp
|wPGuP
C{Kh8\t
x{tu|ws
.L{Kws
>utk!N
K9T8s\
=wnhXHt
tkwSQ`s
u|7Hwn
wQjwSh
@SwSku
*0k*0CwnhMt
ABCs|wHQ`s
i>wyQbu
N9|8sX
@tPw{h
hwh}wQ
@SwSku
Bw[Q`wJ
{Y_{=tRk3t=hdh
iFbcICht
=8]KA3#<
8~]OA3
Bwb8Lh]w{
wGI=wn
tsxhMux
BwShYt
BwShd[t
@hhuxI=
t{P{}wS
@P~P@k;C
`Dtc%#
xwtGw;?weks
{Y_CtRk3C
8YcYk<
hu7Hwn
{Y_CtRk3CGwr
.u:hI=uP
{Y_CtRk3C
{Y_CtRk3C
{P}8ha
Lu:hAH
YkFCLChu
tC11h$et
tkwSh 
*0wP]0(
t|hH2t
{Y_0tRk30hT
{Y_{=tRk3t=h
{Y_{=tRk3t=
wy8h9wi!
G;s^!<
Gw{:h
h5vhis
w8hIu|h
Bwb8Shu
{Y_{=tR
{Y_{=tR
wz8huP
Bk1t=9
{Y_{=tR
hIFhc{
7HwncE
2s%CwH
{Y_[NtRk3TN$
h)FkMc8`3
|Sx8Lh]
HwAAbB
{Y_[NtRk3TN
hCwH8 0
{Y_[NtRk3TN
MkF+Nc
E+_CwH
F+NcYC{YE`hQu
{Y_[NtRk3TN
XO:8h!
nFkM::F
@NGKN8^E
KN3 Nh
@NC8^E
CwHhxt
tAhp t
{Y_AtRk3A
BCwnhy
7Hwnhy
`87Hwnh9
@t|Xwsh
BCwnwX
k5k@`>
I=wnh)
7HwnhI
7Hwnhi
BC9PG[
F.(P8 P
F[.(P8`P
F{.(P8@P
F/(P8Q
F;/( P8@Q
,((P8S
F+,(0P8
F[/(8P8N
F0(@P8
0(HP8pN
F1(PP8O
F1(XP8O
F1(`P8.
H+;K0`0Hwn
u|7Hwn
kulG2W9k
3)9@wy
2)ii9pGs
{Y_AtRk3A
ICwH1D
V9T8s\
{Y_AtRk3A
G0W=wH
{Y_AtRk3A
X9D9Wc
{Y_AtRk3A
{Y_AtRk3AGk
{Y_AtRk3A
1)1W}c6S=
YkFAGkuP
O9|8sX
1)r^1W
FxwQruPhYv
EwshXNt
{Y_AtRk3AGhqL
{Y_AtRk3A
{Y_AtRk3A
YkFAGkuP
{Y_AtRk3AGk
YkFAGk
ICwnwH
{Y_AtRk3AGk
YkFAGk
6nwSht
{Y_AtRk3A
Q$KQMAw{wbA
YkFAGkuP
{Y_AtRk3A
Q$KQMAw{wbA
YkFAGkuP
{Y_AtRk3A
G0WkuP
LC8=8=wn
FBB8=wn
8I<8=8=8=8=8=
]0HwnwHi
GUHwH:
{Y_{=tRk3t=h
{Y_7tRk37:
+11WhD
wShhUt
{KF{Bh0t
{KF{Bht
@3pBh]
BC{K}c
_ 3M#0?
E]?A3O#8?
8nD]7A3M#|?
8>F]B3N#<
8nE]B3PO#<
(0G0;90i}*0#;
>!n}s3Q:heM
YkF_3ch
w|?wM9s[M@
xFokMd`Fc
8HiTMBF
i34M|b
8NixMDi3)M|b
tkMSkMRkMQF
>KMRkMt
BCwn8I
];B3h(
{Y_AtRk3A
{Y_AtRk3A
YkFAGhpt
F;(BI=!
tICwnu
BCwnhY
7HwnhY
7Hwnhi
V{Pwi8hy
tkw{:h
XwRZ^w=wn
@3pBhQ
wHhhRt
L\9`GoG
VICwHh
@zKg{}
LH9L8sT
ZhvHh]t
X7HwnwZ
C{Ku|k
BCs|wX
awI8hE
V9|8sX
|w`G{G
imwe0D
phIzKux
Aw{hvt
phzKux
Aw{h@xt
iywe0D
iuwe0D
uL9Fc)
218h}u
i%we0D
duPs\Dh
phzKux
i9we0D
duBs\Dh
tkwe0D
Sbw]:k%V-i^q}sL
X{Ku|[
CsxwG_
`hwkh<
ul{sLu|
%Y2RLst%
{Yu|k/~
Aw{hHt
AwShHt
t['LYG
twXwJ8tn
id}&0~
t[#H]C
%Y2RLst%
tk}60~
%]6VHst%
t['LYG
{l=8}c
Lw{9he
wShLXt
wSh Xt
kDO`:*
OwHG:3
]KU3P#@
GVH!N\
@kKICwn
{KF{Bh
tk}u4ci
C9H8sP
ws1Dcy
tCwnhyz~
G[ULT+
V9|8sX
|{KF{B
(PWICwn80
6L|9x8sT
wQi{YD{B
|{KF{Bc
{KF{Bh
{KF{Bh
Q{Yu|{YD{B
B{Ku|{KF{B
Q{Yu|{YD{B
B{Ku|{KF{B
}cI=wn
}cI=wn
|{YD{B
|{KF{Bc
BC8]KA3@#L?
8>]SA3#\?
]kA3#d?
8^]{A3@#<
V9T8s\
PsTDhI
EtJ`}Cw
sThQ~~
V9H8s\
tJ`}Cw
tJ`}Cw
tJ`}Cw
wR:hPt
tJ`}Cw
tJ`}Cw
tJ`}Cw
tG.LTF
p}cz>b^sPh}
@9|GCG2LPF
8L|9LG[8
9|GGG.3
Dt@hYu
 9|GsG>LD9L8sT
uL>^Gx%
@u<hme
s ChUt
LuHh-u
sLuHhIu
_wHG*3
@9|GGG.3
tG7Hh5t
=CC \Hwn
I<wnF.PBv
o\Gth;[Ev
uwtITBv
FXb.6S&3!v:&
gV\WQWVPPQVhB
0123456789ABCDEF
Q$^p8G
AP~uu\T
KV]~rhk
FPC 3.0.4 [2018/02/25] for i386 - Win32
K1E3AB.M8qf1
ehKNIt"K:3y
TwAvFe
")nCGj%
ah%m~=Q
nHVc--`X0<M
u{rTlS}
<R=~K&i5
jWsxnX
2Fw2BI@W
BV>H+b
eMtsyx=
)Zu\50ANR(
Tr)@U8p4
MHD3;P\
,w+)FUSH<K
?)O ,\
uUv1<[vcc
TmF(gzrB>:?
#ZeHu 
SKF=~0:KE
+2u5CC<6
b?4lSXo9
NX$w^b
`A9O+r
*tuASZId5!hpE=
-<~~{;'
3RMZ/l`X
"]#P7EKsXH=F
.<b^kf^
t</D<3dN
Fp/6-Ij;LK
T3o1AT>`j`z
*j<DX"F(NX
8RJmYfk
D%U9YI
hW*^nZ|I
/$+)FrVLBH2
+}Go1ucW<AA434A8m^.`v
db];F=y4
or{z/l`i;+
^8*BP:q3
0D f4]
2FyT'7
> beA#^
GjyaHn1ddlce
DCNn7_
E@`IbDsm
<e\lyP
`d$e=@Af"J=!
m`/PEA
W/^oZ[p@
t?I%$c
wca.D]
h@?Jyoi:N[US'
5*>B_<i)un
G4m0~_Z654
Q3/. 9=DE if
(54Jctm
j(7^Fao@MS
D,F|o\
&mw:4+Drq
9(+:5g
?$z)QW
iEF[Eg`
IG-6)eJe,D!I=f=Fu<*
:$+)Gr
;\/D4TS&
|!am*vZ`z
g`<z:"P(2-},/
Ju,BGF,
jAjS5GcEfTM-%`H)
Vf_ood
!6WVTx\
/ufla!
'[a{f"uL
)MGWR,
6r*o8E3
jeA@F'
^ZN9W!
X9t@N&
8Y8*I+D
$00yM>
P+aD^T
Sm&v/~~(
86a/}i
(>wQ*/S
}LIV-ob^
HG/tIi^{m
P]i]yKZ[~0
 \C{w\;di}6ha
-vbfB<
]4hBZhV
QTH2>2Vm
k:xSe3b
5EK@iE5
" oueC6
cpQ[=?1
gw'(.\D.5
w=efXYaj
]t+B\yP
&nL`nuh
#o/D4z3LD}
GJ8w~{2
M0hNm8
#59y\m
-(Q`*S*HJC.
9$`1Yb
HE^H-:G
~mF7ufZ
#5bD581F
&HdC^hpE
^aHZh&u
_FYNfvWq!+bYLF
"\[iH=>K{ gqqX
oY&t07RS
zjgzS~4=
TT7zA-eG4.{hS
tUE[SwmFUHA
Gph=tz9T
Ls .j0eWV
!cgy)EI,
dD#[A%I.c
db[D^'Y3
!@IXmSM^
Uk7A-I
_bRuBVFk=
q9o=S\V
#3.b&&S
*[^SQFG
V3/O9A
POY7;!C1?
FZra0n`
2VvN1]b
i wP>|2
k0']k"
_To7(5
2VvN1]b
"";ty4D3,
=FFz.U
K^G3m+
FJzaujlf
bFyyY9hDs'1U
KFU1=l@1kLLMH0QR1G
/DmU>0lw
S_26wTE/h
NNXV-a
.bg=I=5L
S5Kg1<b`=30BL_.
Lw:bra
MGf<RTh$
0=2E2[0S4\idmb2
hP4G>C,
5AfX15
jCzydV]
YhM7K(4fJY
Y+yjYf5} 
Gs!A0b~eZ
XmJ#N'K!ei5
SX@C!U8
G]7,]ztX6o{
>NU07jzuO
-^~(?'I)s
MUUE<7S
QO?4>D
S_26uTa'
leV~dX=r
u\S a%
;!np%cctqlMo
9<38+;9
zO~4P?o
@O22lr>
Yg-nf2>J
&uA}w$
nZl1re{~
KTHdPd&IzaZ
j/x\|o@I
*tu]49+
BNY;MKYa
jkN:{jTE
=J+.=aZ
^c`2&\b
"F`%7P<Z
-<dxy!em^.`M|}
k:k;}8I!
woyu,@lJ
o/T^\sB8{A3
so~=Qtu
f[[n7K(_6
8Anp%2Sdt
;y$sL_ZKDFE%9bbWq!i}-
NMiUwORqUb%(E
b;5j;J9uF
s/XZ8VpLKJSK
P&VJ<u
d>Ij1AL
z'2B-9
j#OQ
"Fz7#(!!"
ff@Iifsv
7pLZOz@PxW
fPOv^>
O1Y$Ah&m}l1=@#<^j
cCqT[^S
&Gl@aT]v:l
']k"=pmB
lE`@|!1
H(7\z0e{^o>?p:
jD~vE 
|k^s<^@@
/^'<N>
VS_{UT
g:@s>cnp%cy4
oreuK^<V
F1P,OA+dZ
/p7,rw{0^Lf#>
po?R<e"
lFo@NJbIm}b
>u8jNs"+U2
RqL`aRpp:8Ur
fq{I%Jk<HHo754>2jg=QV
0 mXC9H.:5Lyd
>QcGg1?
#h<mS>7F
1if,z7I8G
}oD-jrM#&16
|pug\o7SG}}Fq
By!aO]m
I)HgW4$
sT?yC]
l;D ,+l{Jtd
"oNNT;(
k:~a!+
>e`RYzf
%<[fD@_JM")
*6Sd:Xn
gce6}M
Q@2Bva1O_
'"(&r1
lx/9?2'FK3 =]jg^
 DT53Y
nVi% 243
vImLn1F
ML=V=6<e
0>!>mk
,C-?M9QeFZn{
[}qPd`Lw(c!
:"rs{^
?ly@^:
:f2}bvk%B6hj;H={
xCf3DGl
y<iK+a
FujX<~vlt
2/L9+r
GE?3NS}cf
,5:z5R3b2ec_x
1h2[jn
?5FSc
Vi=;~85/{Q
Lz./4z2w
sD06uK'[.>
q`1$t9B
1rk0mK|`Wa4{AH0Xl>@g
PmIR] )9lf2
OR'A:e
.2xSC.4&i{Z-
oNat>|S
j7 :31L
$:kqNI
tAaeOzm
975d>u
:09`x=
l/y@Av
T#,=Loudx>7
XNLNHZm2D
WQJo1a];
tcSK4Sq(
y0cG5FDFsx,
FjChn5ey
qK89gw
7(@zh<gz
gSL$e!u
2a"!gy
%T4z.=
vv} e1pl K[YL
5OX$S,V
$_W#0X
KD0thbY"!iK!w
{O@<wg=
Oce<(Cb=)O\%D
dfpB[5 =bXT6d
EGk4)a
g1z`.g7.Q
2A3E~[j
]LG|!^o$
X<uhYgz
a}bWec
a<IcKE
Cp8YbG
i9NT_B
}MpmAhA6c~1n
c/l2x7#<
mG"Nat/K>Q
vF;<k<A
,bAScg^M
-NZ45]
mg-&13
oNn!\~^*3rt##N
)(&KN=SS>
>N%_VM*mSA
:Y>01" 
(}~lKZ
f[`4~6Qx
G,*2FxN
=:fOL\"
|ab#-,.
vn`eWVR
q0TP>jzlp>
(9P|XH3dU59h0
9zuDSFZ
v`N#'6d$
\a-8<&t
UFJ4X@AA
27x]8bl ou
<#BZH-Xk
xt8verCQf
h]a% a ]x<q;
J ZU*
 ouf3`Xcp[
FG24/g
3//_z}jt/
_!Y 1fL
8w>)YJIW
&ve1<)Zu\b~gW-#
=HdC(\vL
hb%HKcpYjSL#l8.p;
Ab=V30
e5c#15
=D}]|A
XE4z48{
_mQ|<ZOa}U 
{B5N>S{
qjYd\z2K<
w2bvC2%
]Hmow?6?
sC0bpE]`-gZ
Vb8qjf
o9U4ys9
h8l7v[p
+hu]Ug[u?"m9
"s=T=j
tBUC_V
/^E]tU
ui{;za
#X>D%2SO
q~)0P5fh
:l~(cNc?-
4$7B0Jq[
f8aX;{0^/3uD]@
$B2/;R
ky<0u{1oa
qu686;
zNQ]q`N
e;?@+ly
K8.`a|cDYu
xah]IlZ*Ea%
D"GtfUl?U,9r<c
Iplay
9X?7Pp
Sc$`}4j
*PzAs57
Z}LydO,
9*G]23
'S^I-/c
}A8#1XD
 /\^(Z
O%3L{J
{OR:u9^sm2mc{ 
Zvg{7=FjW
O89cua
W|\Zj-/mI2sE;~
d^0FwC
XGT8Uf
pE\m"}'
8x_#>BC
/wYJsE
 -9`ULV#
s;Xs!\D
2OF+M28en[}
7JZN25E
y7zG>|
kq7&Ej;I3d#
EOtcNXX
Bh8,!=
dPdfreaNMS*?
Rn5^'Y
Qf,~fR<pb
F0vJcZ8<u
lQNcH]%
JikA:W
1&ix-;D`l(@g?
l=5d|D"
s1/yMo:fLUsF
j<ui3J~cLA
Eo1@je*W&l
fIoiQ&
-Zcd5qj ~tq
eyde;cJ
39#_G%
UmB{f~>2F;K
b%S$t6Ttv
f2eEWz32{9'M
Zth |va"-C0XI6LC
*Un9@Us/
%!6.bxc
ZU"}E|F
Ew\$L7
tR&z20s
_jWV3$1zg<J
/Ts!`AS
GHuP#86q]L 
?dvYBV
uV]dbBZ
nY62h1`&
jxl~*EEAa
p!dGP:
{]@Ydt
M2$F'73J+F,s'6
fEw(iw#|&
i\WU bE
i_Wsg6
f4y`/1
%IpAlu?!
x*X?7hr0
ZXd5qjk
B3/{OlC=uf
dhq.r7ii{{=
Z7Si@%Frj
435}_N
L,DJ\Vfoc;
$A{X3nS/
@JZNwE5uCrEz#>aqhOgI
5{;s0^T*)9YF
C'pu]yz01*LVi5;-Txm%ly
JT0>`-T!4
A0,'BC{j
4M.H[Kw"D
{U!.n%7
Z=:x/L
lL$Xf;[#
c-kcW2.
@$x1:k
Dh#$qTFefvEN`
4fCYc?
8<]LlBw*EGua
v!#zHa
<g[#*YL
Li;[I5n
y1~V0x*
.t6x~v
kVAuS@^'.1baDc[Q
8NujI;l
ypy]e2I
D<WMl]
MQ0yv:
:u|*OSX
/xa4YQ
`]72}U "`N
hAkw#pN
=!x<j}
%yiC Z
O=_,)1V[f
x#|6h=nG]eR~R
hYUN0R|'
\9Eozp
RoU:/0
'40w%p. Dpy
c1OOK]"
-U};'f
,{hd=F{CW/
ndo#BY_;
m`H/v28j
|==J"0z
WxF2Y'
2[bbcI
0QQus2S
&&i{;z
,;mb2^
7_0u{s{&o
~_Q:-r
h&OWu$
>1h0<nq4@
BIIyds*
OVyL3ME`
r__0~lp
5K0adE
~oN,)=[
lF}=oN(:w
&(gt83
b7>c)?`
G\[Z b
q6#7Fx<O>
oM#sJ*7Pd`NK#s
6<; x_2i
h3#1hp~
`-$;zn
"|LvP#kDrb]Z
>GRnq(|kM}!B7W
`.?bSM}~
P;OWM9
CF0^wH
l@iQ<Y
%~&5E2J
'uoyf$+q}F
U@c3g9oPAb
LSCQ^\1V
`D#F1z3hc
c|O:$;^v=<1
CX-QmM)R
FBl=yd
k"!iK!NcY(h
wz)dtIa
SaiRbt
}|Lr#%a
L1@fE[
^6x>er i
a u>*z%ks5CmL7
=@Wb`o;
w5jef^DZjzuDT%g3l
"t:vtIq
{d=g=i,g
`sPxhJ1O
9{f8fb;
rnAQTqW
IVUf2ihDtg'z
4>YUk-
*7YG/w
v/xJzl9
L]sBK7
n]UCo:^\
w"EVHT)v
@dGhAB
(f;odE
lyIcMSL\F
Gh)f{@y@ZNo
Gw,0eb
JPNqvHKWr
aP:vud
5:IKDxm!~,1v@uNAD[
;EgDL]v
x[G>'WO^
!A*^YE
s.J%{zU
JI/`EM+"FK5L/}$P
K]=Ow'
1'[w]2')R8R
GA37.5:M
FmHS@i7{
E5bA3Hd5T)0t
JN7.H2i*Y
hMUh1OMSgA
,f}T*S0Nw7.5
Dw,H:pf
YH9u4+KeFX7/vl*k1kk
#3MYH/
C;)jOee1'
w]2GI2
J@4x.W4H+*<#7
I=5:lz
5I)SG\+g0
M:1Z/R2 
5)G+S014@-F
rczhm&
fsLy.m*Y
GetLastError
SetLastError
GetTickCount
ExitProcess
GetStartupInfoA
GetStdHandle
GetCommandLineA
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
ReadProcessMemory
GetModuleFileNameA
GetModuleHandleA
WriteFile
ReadFile
CloseHandle
SetFilePointer
FreeLibrary
LoadLibraryA
GetProcAddress
DeleteFileW
MoveFileW
CreateFileW
GetFileAttributesW
GetConsoleMode
GetConsoleOutputCP
GetOEMCP
GetProcessHeap
HeapAlloc
HeapFree
TlsAlloc
TlsGetValue
TlsSetValue
CreateThread
ExitThread
LocalAlloc
LocalFree
SuspendThread
ResumeThread
TerminateThread
WaitForSingleObject
SetThreadPriority
GetThreadPriority
CreateEventA
ResetEvent
SetEvent
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetConsoleCP
SetUnhandledExceptionFilter
EnumResourceTypesA
EnumResourceNamesA
EnumResourceLanguagesA
FindResourceA
FindResourceExA
LoadResource
SizeofResource
LockResource
FreeResource
GetWindowsDirectoryA
CopyFileA
CreateProcessA
GetVersionExA
CompareStringA
GetLocaleInfoA
EnumCalendarInfoA
FormatMessageW
CompareStringW
TerminateProcess
GetThreadLocale
SetThreadLocale
GetUserDefaultLCID
SysAllocStringLen
SysFreeString
SysReAllocStringLen
MessageBoxA
CharUpperBuffW
CharLowerBuffW
CharUpperA
CharUpperBuffA
CharLowerA
CharLowerBuffA
GetSystemMetrics
MessageBeep
kernel32.dll
oleaut32.dll
user32.dll
#EUUUT1
25UUUS#
%CEB"$T4Q%U1
25UUUS#
3EUUUT1
333330

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity type="win32" name="WJR.PEview.PEview" version="0.9.8.0" processorArchitecture="X86"/>
<description>PE/COFF File Viewer.</description>
<dependency>
<dependentAssembly>
<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"/>
</dependentAssembly>
</dependency>
</assembly>PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXMZ
L!This program cannot be run in DOS mode.
.rdata
.idata
kwwwuwhwwwushwwwu
hwwwu{hwwwughwwwuchwwwuohwwwukhwwwuWhwwwuShwwwu_hwwwu[hwwwuGhwwwuChwwwuOhwwwuKhwwwu7hwwwu3hwwwu?hwwwu;hwwwu'hwwwu#hwwwu/hwwwu+hwwwu
hwwwuhwwwu
hwwwuhwwwuhwwwuhwwwuhwwwuhwwwuhwwwuhwwwuhwwwuhwwwuhwwwuhwwwuhwwwuhwwwuhwwwuhwwwuhwwwu
hwwwuwiwwwu
iwwwu{iwwwugiwwwuoiwwwukiwwwuWiwwwuSiwwwu_iwwwu[iwwwuGiwwwuCiwwwuOiwwwe
rZw2wa"
Jr"z.5g2f
YYwwwe
/vw+2bwMw] w
3w wb%wviTX'
Fg2fbg2V
qWFa2fbW0w
r&wre2&2
(6a43w
E+2Nw2wa"F
a:NVwbK8g:N
}/Jrr
,SIwwwe
wZwTvRa:jb{
<wrZw
wZwTvRa:jb
!)C/we
wrwMw]
wJw+2^w2wa"R
Zizg2vb
Jr"z.5
Ng2vbeg"^
WwrrCw
*va2^b
a2^bk2g:^
rwTvFa:~b
a2bb[ya2j0
/JrrwC/wwwwe
TvVa:nb
Z+wrvwC/wwwMs
IgbZwX~;-5u>2
J/wwu:w
>wl77h7(777V7777\7
77w7N777}74777{72777a78777
u/Te=D
>wl2797777'777t7-777r7+777x7
777f7777l7
/wwweE[o
-ga3LmSo
^K$vP'
$zJo*v]K
xsmb[v
s\;\_Lx*G
#X^Hx*7
\_Lx.7
X^HZsws\;\gLx*G
#X^Hx*7
\gLx.7
X^HZs\w}*x
\w\ws\;\_Lx*G
#X\Hx*7
\_Lx.7
\w\ws\;\gLx*G
#X\Hx*7
\gLx.7
{dDmSg^o)Ywww
?vR=Xoj=vP
eemHw`
3o{#ff
cxxg}}
Ye<-K,vsoyGKyF(Yw
=roeaZo
wd}*we
\(Iwwwe
'K,SPehC
a%>{uY$,Y2w/!
jsi-~"w*^]
-~ZyJx,
DeJ@NRR oc}5{
v%wwwe
Po}>VJ
SYwwweQ`r.e4
wIwwweQare4
gtqTw,Ywww
wYwwwe
e2fB"fC/we
beuhTvx8
g2bwU\
/5_mLgYw:/5(&
w"Z7)#
6c"7)#
<cwYwwQ3r
Q3r"uwHwwbeu/wwwbgeu/wwwe
6NJrg:n
we<.a0beuf"n
Cbeug2n
XwZ}Ag<XobKeue
wXgqa
o3X}6Ka[
&WF mh-
Me#e;g#a5
pTVF xK
(/wwwwe
Yo2N2w
+v}eT>
QT}|&>
Bg:"=P
@\.g2:
(%wwwee
Se[`{Wvy4,SHwwwwe
m)C.swwwe
vqVwx,
)C.swwZ
HdYwwe
&*s[bi
,SHwwe
$bceuXwww
Bo2)Iwww
6UbOeu
,SHwwwwe
 uwb_euau
,SHwwwwe
 uwbeuau
,SHwwe
 uwbceuau
euer6e
w!wacy
SMswsvwm
BeIbas
S3U7^[
w!wacy
S;g3gg
WIhe wax?Y?
S}Seuw
g3g?@[
Xwg3gg$wSs
wg3+wwq
g3ggI`g3egq
{x%Cg3goIaVw
sqg3+ww
Pvemle2^
$vemle2F
DVwvi<~RwvI
@0we w
/wlHe#w3w@g2n
"w2wHg:~2wHg2F3w@g:N2wHe
jVw[0we!w-f@
RWwv[6^g*J2wTwvC.FWwv[6NWwv[6L
IVwt2"&
#j5wRwvY
BUwv]""eO
g22m(%wwwe
Ie"VSbZ
ZwqYSZe"-$
r[dvhe"JS2J<R5-Y.
]<xS"J
$FJ$x%<KK
HmeuwXFa*
*:63w
|Gb]vrr
x%Io}4
#wyIeu
 *z63wswg2J
X/]8wH^x$Xe[rK
N5i_eu
euJ~MiGeu
,xAwZ2Zau
euY_eu
[er&wc:q
wcFqvw
rCb_euY
Ho2fg2fe
wi/Rwqve3Orw
WIie!wax?R?!w
2a2>b#eug2>0we
wbe2a"2
eu+2.u
eSumRa?Z2w?
<5C2wVwc
WIje"wax?H?
]Lwjg"~
p2a2>Uubeug22
p2g:&+fK
P.g2:<.Nw
euoS"^<
x%(NXc
.Tw|22&H
Px>Hze
&<vK`e2*
/vSmSg2"
\T>e2"
Jx%(NJ6x
euoS"^<
K'euYx%A
x%(NX
eua'S2^.
eux-('
'55iKeu
S5%x%X
z6WSSSSSm;xG
CcEoCg
g#Sx%He373132Ejr
/!bseuVH^Xe"
VwX2we"N
w!wacy
2we{g2J
WIle$wax?z?
{Uw[2we:^
{Tw.e22
eT6e"B
Lx5Tx5Pv[
&~e]\w&w
x5@x5\v[
2e2~ue
Ve"rue0
%%Kg2z}
@g:F-R
,L&g2.Ag**
D>g2ZC
x5@x5\v[
D>g2ZC
^Y=x%d@
Lx5@x5\v[
g:vax%
Z[S"uw
Qt5x%Ke
MA~g2f
x%Y]Wr3e*ri
\\qf2r
wg"nLum2r
S"rS2v
bx,Rf2v
X6f2&
SmRXS^g2fUwb
Xx%@T^Re5/x%P
Qt6x%He
\hbeuJw
waCS+e
,&hf2ZZ
<<:*sJw
,x,Zg2*Lgm2Z
,vmLNqMBH<
IA:g2f
HerZ0e*Z
\Zqf2Z
wg"*Lum2Zx%Tx%X^Je
waCS+e
,x%Xr[Ww
,SHwwwe
\Hw\\w5/x%X\i
c5/x%^Je2Za
5c5:^Je2&S2.S"&<x%L^Je2"Z2^S
S2:S:&
ZvXS"uw$
KS`hx%M@4
-&g"VbCeuBw
$Nhf2R
wg"6Lum2R
,w&g2f
.jbceuBtJB>
waCS2:;X
<&&dsm2R
<$&dcm2R
6wM2wg26
bceu*2>f2>
X9=55qf
~iLfu*r
fg"jg3uRw(
fa/SIs
g2b+w~w
ve"ze:j
a&~w+2vw
sw@vL
wre2va
ve"je:n
QWYKw[a
e"G V}
peYR<x%
,SHwwwe
Kern8e
+2Nwa^wa2
Me|u
w4wg:F
LzpRvdP
Lia6dZ
$x,Rg2J
$x,Rg2J
<so2Fo
$x,rf3ag
Sax,s`
wSvv}_W*v
{]ow$w
SMww<S"u
IlKf<S
ees^w3
U+NmN@
x%Je3g3a
)Iwwwe
rer~?e
Rern$e
,SHwwwwe
RwrBwcEwg"
pe[uFa
<FHaves
#p[4U[7x'CaAI`=mygk
Ig;Jg#
SHwwwwe
RwrRwa
<FH}myeqeK`=KE=7%x7qJY
z%wwwe
Be"BwbA
myemyeX
E=KR=KQSA'<p[+i
*Bg2>VJcR
z%wwee
S]v+7w
gs+7*w
rr&eIwwww
~w+2^wMw"w
wrwia"R
v-5b+Pa2^bCba2RbKba2nbsbZOw
Xwwwwe
b{euYa
ecvg2f
Hg2jUwb
ZjHw wbKeu
Hg2jUwbKp
zguJr"z.5
 wbeuw
ZjHw wbeu
ea1g:j
Jr"z.50w
zr]wrw
,SHwwwe
wBwTvZa:rbU
u'JwmXeu
 wb3eu
@.:g:"
L6q\Hwq
$~a2nb3e*Z&"Vw7p
Zv"&g2ne
bfKwswm
g2&e26Mw
T"oO:g2"
DL2>g2"
eue*"aLJT
 wbeug22
,1ig7f.LJ
.Bbsg"2
X2e2Zo
Z&"6]wrw
b7U)C.swe
;wg*Vg2Vi
ZfrGeeq\5e*V
g"Ve'narg2fb
/Jrr:w
,SIwww
mfrFeeq\5e<e3wrjw
obeugse+
x]wr:w
wqe*Veu
2hUwbvi
Te3wrw
g*bg2bi
Deeq\5e*b
vr]wrw
Sbeues
~~gpJt
bb;eua 
g5ne4n
1weut
Njeut
v~g2bb[eug2f
)C.sww
\ig%f5w
[e uwbkeue
eg2eVt
<eu+ww]
8euwTv
bl)C.cwe
Q)u-
euepg2fUwbeu)C/wwe
 vwTvRa:jb[a
Zve2Jg2J
DabbvYi
Zfr2Neeq\5e
rig7feur"z.5
<\Fieut
tFZ2Vg"R
/JrrVw
"jUwbeugaXt
;\5Iwwwwe
A+2Nw2wa"F
r"wbPZA
aa2Nb{euZ
(/wwwerRZe
qeKja'
g2f+7v
bkeug2f%e
wgqJr
Zv=ub?euZ
C/wwww
LeQ/w
Zv=JD
eqgaXr
jbeueI
beu/www
2w/wwww
:wq:wYwwwer_e
veKja'
wgsgb:w
/AjbcU,Ywww
rr_eIwwwwe
Zve|O
Zve|H
Jr"z.5uwX(%
BbeueD/wwww
Kg+gtrAec,weKhg;gv
rAecpwg#gu
Kg+gtrN@e
Sr:@ea
)Iwwwe
D+2fw2wa"B
<]wrFGebya2fbceuZ
RwoHjbeueps
resboie
yNXbwKb
ZvigpJt
eqg`Xt
gcbWeuer
eKjpMw
(/wwww
GJHj7weXeqV'
5gbZwX~;zQ5u>2
r ~Q53
iM'Han7wrnwb
cTwSIwwwwb
eu/wwwb
eu/www2
O[w9.52l
w9B-52\
He"FwbO`e
bgerFw
]w)C/wwwwe
rr@e%w
`beuei
fjoOVoOh/~a2bb_mg*b
JYaVgo
JVug"n
HernIe
[g"jbeu
(%wwwwe
'Mw,SIwe
vorg"buC
w2wa"N
rwb`Zr
/J9"w
(wrRwio
/Jrrwb
g2bC/www
-SR0wg~e
zbaoKR
beuei"/5_e
s/wwwerw
4wIwwww2
JsZZZa
e3g3gw
hSwsNw
+MhSww
gue$w
euig3mew
ew}hSweu
>v)Iwww
Wuy#g7
jbcrg,
J/wwwIwwwwa
HSwIww
EgbZwX~;/5u>2
;fgbZwX~;/5u>2
e2jM{w
re"nMw!w5weqa
NEYe[hv
iM7YHaIw
w"SwbG{oJ
6bg{%wwe
GJHIweX
iM'YHaIw]we
GJHIweX
r"/5Mw<5
beugbZwX~;/5u>2
gt wbg)C/wwwgbZwX|;/5u>Ya
etIwww
iM7YHaIw
mBbg+r
iM7YHaIw
{"wbs}
,YwgbZwX~;/5u>2
goQrr
GJHIweX
wgt wbSywww
GJHIweX
r"/5Mw<5
wIwbeu
wr.weIw
K[[[[[[[[
)Iwwww
aBbseu
eabWeu
)Iwwww
+eue!w2
wwYwwwMg*L6
:wmZOg*
qS^Reu
qW^ahwZyw
qS^Reu
qW^awZFGww
agFJ)0
|Ze[hx
H-<,Ywww
Re[sIC%
-J3w,Ywwe
v!rB e
,SHwwww
GJHKweX
r"-5mOm=I+w
u(/wgj
GJHJ9weX
s(]wgbZwX~;Z_5u>28
*Ha:wr^w
s(]wgbZwX~;
V5u>2x
iM'Han7wrwIww
GJHKweX
r"-5+wgj
weeZoJ
iM'Han7w
e"wb+\e;6b7eue
6buUg@2w
wy;.5bf+rHwwrvw
HSw/wbeu
{e%www
gbZwX~;/5u>2
Sbkeug;gc
Me wbeue
,SIwwe
SIwwwwe
b'id2rcwa
~a2bbeuo
,eug2nu
"wb[_g2fb_o
Lf}r&je
/JrrReC/wwIwwwwe
He"Ywbeu%wwe
GJHj7weX
PgbZwX~;zQ5u>2
GJHj7weXeqV'C2w
GJHj7weXeqV'c2w
r ~Q53
e"wb^gbZwX|;zQ5u>Xan7w#
GJHj7weX
r"~Q5b[RTq
eu%wwwe_
eu%wwwe
GJHJDweX
r"^"5Hwe
wi/)Ywwe
iMTHaNDw.w
w+4wMcw]w
w+4wMSwIwwww
yzak'e[b
N@>(/w
&wbeu,Yww
dw)Iwwwwe
$rIwww
6jb[euo
)Iww_w
Yb+eug4
vgO$wcwa
Y*bzeo|}
veuqg0
r)C.swwwe
e4wg"v
Dw"55w"*"5b;zTW
w"j!5bOpoJDwj
5limvo
m;6beue|N;6
*l.5{]
r}"FwbOeuUkrac
4Re[h~X
|wg2vMlw
re3gbZwX~;Z"5u>28
Cvqerw
iMTHaNDw
vQsC
(/wwww
4wmwa1
::Dwrw
w"*"5b
,Ywwwe"*"5b
iMTHaNDw
(/wwww
w_wqTT
:Dwrw9B
wU,Ywe
Bb_euTTCwIwwiWw
4,Ywww
iMTHaNDw
`bceuhgqe.
NBYuS]
w"*"5btgbZwX|;Z"5u>YaNDw
R]w 2wb3
,YmJZDw6MTv2L
qTTXbeuoJ
JQsw w
3wgbZwX|;Z"5u>YaNDw
Tw:Dwrw
eueuS;"5
TvmJZDwY2L
A:Dwrw
,YerrebeuoJ
bnKwrz2ebVgbZwX~;-5u>2
GJHKweX
GJHKweX
GJH:weX
r"\5Mwn#5qe
/wwwuU
eue|_e
eu,SIwwww
)C/wwe
GJH:weX
wg2fb#euer
,SHwwwwe
e2jb'euT{kc
wvrIT7'
eue|p
,SHwwe
C/wwwe
eu%webk
2w%wwweb+
eu%weXt
eu%wwwe
eu/wwweb
eu%web
eu%web
eu%web
eu%web
wqeQr"z.5
,RewmRr
e%wwee
c$wb(eue4a
z,SIwwewwrJeC/wwwweb;(eu%web[
eu%web{
eu%weu
Yw+rZww]
wTW4Zw"*B7)
T4Zw"jB7)
T4Zw"JB7)l
TW5Zw"C7)h
Zw"C7)`
Zw"*C7)p
T5:Zw"JC7)H
T62Zw"A7)@
T6*Zw"
T5"Zw"\7)P
T*RZw"z\7) 
Tg+JZw"]7)8
TG+BZw"]7)0
T'+zZw"<5bGeu
GJH:weX
}WwNE`
Je#uwOr
wf3hoK[
.zbGeua1[
Jcb*eui
C/wwwe
J{rveb
:wZ+wX
v,SIwe
eug2f%e
vofgur
GJHKweX
r"-5+w
qg"vMs(]w#waf+59;w3wJe
hgp!wa
f+58;wc{w+2jwMeu
ewfggXk|$
bseug2vMs(]w
f+7:;w
,SHwwwe
c]w,Ywe
gbZwX~;-5u>2
wwwwee
wqgbZwX~;-5u>2
4kb{euT7-
iM'[HaKw
wbeuhT-
,SIwwe+V#
:Bbeue
|3lwMo=w
\+2Nw2wa"F
b/eu,SIwwwwe
iM'[HaKw
s(]wee
+4:;wMgw]w
GJHKweX
r"-5+w
GJHKweX
r"-5+w
+4wMcw
bK!eu\a
gbZwX~;-5u>2
Ms*]w/wwe
iM'[HaKw
wB3wVM
iM'[HaKw
GJHKweX
r"-5+w
iM'[HaKwM
aBuWIww
Cbeug3/
iM'[HaKw
SBuSqgbZwX~;-5u>2
GJHKweX
r"-5+ww
EgbZwX~;-5u>2
s;;wZ+]wox,
]wqgbZwX~;-5u>2
(/wwwe
E+2fw2wa"B
euZiQ<5
s;;w`Z+]w
exg2JbKeui
WwerR\ee
qeur z.5
GJHKweX
r"-5+w
iM'[HaKwM
bceua2fb
iM'[HaKw
iM'[HaKw
AgbZwX~;-5u>2
]wqgbZwX~;-5u>2
o1)Iww
e$].;;wriqT
(/wwwwe+V;k
:Bb'eue
|3lwMo=w
\gbZwX~;-5u>2
s:;wZ*]worg
iM'[HaKwM
,SIwwwwee
\gbZwX~;-5u>2
s:;wZ*]worg
iM'[HaKwM
]wg2bMsw
iM'[HaKw
vg5]w;;wr
[QCKemh
re?a<5
]wqgbZwX~;-5u>2
(%wwwe
]wg2bMsw
iM'[HaKw
vg5]w;;wr0
[QCKemh
bKeuuv
re?a<5
]wqgbZwX~;-5u>2
(%wwwe
iM'[HaKw
eMs*]wqgbZwX~;-5u>2
,Yw2w/www2w/wwwe
TwXwwww2w/wwwe
"wC.s2w/www2w/www2w/www2w/www2w/www
w+2fwvabt
eumMidu
eu\lI^f
rb_w*nt
I\lI^ovt
u".5b'euM'X
w)C/www
u".5beugs
b,eua$+
as"beua
)Iwwww+
oIwweJh
4ewrea
wb72euOg*
uw952s
95wj6bT
eMGOw^o
b=eu+r_ww]
e'MGOw
wwwe 5beuTGQ
r"e)\$
3euOZ6?w
iM'Han7wr
V5beugbZwX~;Z_5u>28
iMG-Ha
eugbZwX~;\5u>2
GJHJ9weX
GJH:weX
GJHj7weX
w=b32eug*b
4PbeuerbGe
ZvigtJt
iTX'r:e%wwwe
4Pbeuer
ZvigtJt
iTX're%wwwe
swp#wa
4PbseugtJr
ZjHwbO2euYe
4PbeugtJr
ZjHwb2euYiorn
b4euYa
6euYeIwww
WvNEqa
NE2Gw9:-52
O[Ew92-52|
O[Gw9v-52,
OwXDw9.52|
XJEw9.5b[5eu
+r:wsw
)Iwwwwe
[w wbweu
GJH:weX
r"\5beugbZwX~;[5u>2
e#wyIJ6
w]w"JJ)
!w3w*2r
g2v{sx2rax,
,SIwwe
<":95rr
sBSeC/wwe
w)*2fgq
RcFw_\
Tcjw_sw9;vw
2wgq]wSeu
q_q_q_\
w,J_q_
*95Zb:
Twgq]wSeu
,SHwwwwe"
[b1eue
r7ebGeu
HwC/wwww+
e%wwweg
%bWKeu,SHwwe
SIweg*
%bCKeuXwwwe
YwebKKeu%webKKeu%web{Keu%w2\.
\ie"wbeue
s wbweuo
wbGeu/wwwe
]wreC.
rje2wa"^
r@eb?euZi
vgwJt
v62n~l
`g2fb&eug
v62nB$
beu)C/wwwwe
/vg2fbeuTvRa:jbeu
'JU 5
Jr"z.5
/Jrr2Be
he2wa"B
r:FebeuZ
ZjHwbAeueQc
ZjHwbCAeuerb@e
e)Iwwe
Vbbeue40L
Vbbeue40
(%wwwe
[e4we
 vwg"N
/vYtFe"J
a2fbeu7wu
4Reeg8
Yb+eue
/vIt~e2J
gg2juO
gg2Jug
*bk)eu
(%wwwe
I\oLBffo
Vw+2zwMw]
sfw+2j
Rewwe\"g
p]pwBw
wq+2>w
eu)C/wwe
uGe\,SIwer
Iwwwwe
Bb+euer
[Zg#a{
@u=,Ywe
wrdeab0w
eu)C/we
/JrrIe
4,SIwe
/JrrIe
4,SIwe
Bw+2Vw2wa"N
rMebSeuZFg2bbeug*V
$@b@drOe
Iig,fal
vQ}<oe
.vP}<ge
ke"wbWeuHB
S/wwwe
\+2fw2wa"B
rLeb+euZih
VvGw a
w wbK]VV
)C/wwwe
eMw]4w
ewMidu
wTv.a:&b#eu
|euVw;
Zve2zMw]
-fg2fbeug:
}e*Vw[
teua2Bb
]Zrg"~
peuUeu
-jbgeu
-jb[}hg2b
4Hvg2V<^g2B
p^\Grke
teu\Grbje
ebg?eua
-jb~hg2b
KerJjeat:
teua2Bbs
<Rig%f
pRa2Bb
Ge?`eua2
g"V3wTv
r.eckqe*V{[
w"wbUg"
r"ecgre*Vt[
Ge?`eua2
g"V3wTw3w
-jbqhg"b
Zhrg2~
AZharg2~
w"wboWg"
rrec7te*Vs[
ng3Ja:FVwb
-jbshg2b
9Zrg2~
xeua:FVwb
0wroec+we*Vx[
ng3Xa:FVwbeu
qe*Vz[
ng3Xa"
b#eug"
^g2F0w
Y+2Nwat:
K-0wRwc
WIhe wax?\?Tq
o^^2V^e2V
4Hvg2J<
pRa2Bb
|eug:Bb
euo2jg2j
/JrrZye
,SHwww
,Ywwwa
resMeu
eugsMeu
azbver6w
agw\$w
^gsMseu
ze'val
o7jg2f
z'zvg7j
g'jg2f
g/ravgw
"wbeua$
J'J{
rg3Bg"f
g'va2Vg2f
zg7v-vgw
eav+7u
ebeua2Vb
C/wwwe
,SHwwwe
(euwTv^a:vbeu
@eu7_C Fa
e?Deuw
Peua5
(euaRt
eu\w0w
e['g6t
eb{Geu
I2wVeu
Xeud;ug2t
HeuWw
ig%fydu
o,euQw
w?Heu<
f3ug.t
XeuL/.
ebXeuf"b
DeuguJt
cQwaJt
w wb#DeuaJt
e6p*3u"
 z|5bs
',eu"
DeuUv7
',eu"
KerBecvg6t
I2wVeu
(euaJt
Bb(eu\w0w
e[5g6t
I2wVeu
eb]euf"b
Deugg*
mRe"~|50w
(eug2t
wrecv|o*t
Teuonur
@eu7_C Fa
e?Deuw
[erecKwg2t
<eug*t
"wb%eua^t
e?Deuw
b_eue.t
e0wTwK
=@beu
(euere:
e2wVv[
Deugg*
.Bbeuo.t
\euwg"t
vworqw
@eu7_G$Ba
e?Deuw
Deug6t
\euTw
(euaJt
Bb+ eu\w0w
e[5g6t
eb#Ueu
ebsUeuf"b
wrec>tg2
v^wuwuwTo
wrFectw"}5
wrfecvuw"}5
Deugu
Deugu
wrecVvw"}5
wrec.ww
Deugu
DeuguJt
Deugu
eb;keuZ
<DeO2B~26
w wb(euf26
,SIwwwweg
Xwwwweg
Xwwww2<
]w wbaeu/wwwwWwqa
v/wwww2wo
,v]igLwbYw2t
w2w/wwwe
~g"nuC
.w2wa"J
ebeuZ~VwW
Zg"fb8euo
SIwwwe
wTv"a:Zbc
eua2:bneuZk
rebGeuZr
~%wwwe
~g"nuC
,w2wa"J
ebeuZ~Vw'
reb+euZr
wTv"a:Zb
SHwwwe
/LMw"w
$eugtr*e
Be2V2|
8Fe#wbw9eu
/Jrr^e
wwgbZwX~;zQ5u>2
eqgbZwX~;
V5u>2x
euebt
eue(TwK
eue"wb
ecpwe"
euhgnt
wrDeb;
euerKeb'
eugbt
euerFJeb
euer*Jeb
eu)C.swWwqa
egPaa w
<,Ywwe
wqV0h(
qe*fMw
w wb7eue2n
]$wNerw
8Zwa2R
w wbeue
eua2^b
X+2fwMw"w
/ve2&M
\N+2Zw
 Bwa2"
,SHww2X
OOJw9J6
w wbKeuOM
9J;5L{2n
OJw96MwLw
;J;5L{+,
wweJr"z.5
u*%wwweJr"z.5
~ZySIwweXr z.5iTX'r
J%wwwe
)C.swwwe
4,SIwwwe
+2Nw2wa"F
Xwwwwe
+2Nw2wa"F
,SHwwwe
+2Rw2wa"J
Fbduea2n
wbgdutT
eua2Rb
<eu+Nt
8euaNt
b7euaNw
eVwb/0eugNt
wbHeuaNw
.bb7euaNw
r]X wb
8eugJw
8euaNt
8euaNt
eVwb1eugNt
<eua6b?JeuaNw
e wbeuaNw
euqU'
eVwbG2eugNt
<eua63
eVwb2eugNt
<eua63
eUwb0w
8eugJw
8euaNt
eVwbC3eugNt
 wb3eugJw
<eud5
eVwb3eugNt
 wbeugJw
YwwwbduVKp
Yebkdu{
eb{euY
JW95MO~
^95wMOv
Hmeuw}.eJ_w
\+2fw2wa"B
viTX'w
duova?em
{g2fVwb&eu
/Jrrje
du/wwwe
Z;5wMi
J]wSIwwwwe":6Uw0v
SIwwwwe
$vw+2bw2wa"N
W*vee\
ZjHwuwb;duo
re2nbdui
Kbbg:f
KciVXviTX
BbueugtJt
,SIwwwwe
BbueugtJt
,SIwwwwe
[ig>fiVX%
Hig%fiTX'w3a
[ig>fiVX%
Hig%fiTX'wa
wwbduoC/wweu
duoC/wwe
4,SIwwwwe
4,SIwwwwe
SviVXviTX
O[Zw9F-52_
w9^-52,_
w9V-52^
w9n-52^
w9f-52L^
O[Zw9.5Iwwe
Lb#euig?
s wbeueqgq
Ie"5b/#euha
R)C/wwwwbeuig7a>
wYwwwb7eu
*w9*62\
wYwwbeuV
reb-eua
(%wwwe
ebgeua:w
 wb'eu
e7eusP
(%wwwe
:eu,SIwe
)C/wwwe
rze2wa"F
Zvobw)eue
z,Ywwbeu/wwwe
wNwTvZa:rb#eu
Zve2&Mw
sg2nbSNeug"^
b eu)C/we
reMw"w
IaC3wo
Nwg2R0w
e2^Fgu
\+2Nw2wa"F
we2JZa:NVwb[Ceug:N
Rwure2JZa:NVwbCeug:N
jb{[eueweK
,SIwwe
/LMw"w
Jd</Ze0wr
8eua:NVwb7Eeug"N
eb$eua2NbCduZ
Yg2fb]euTvRa:jb'eu
'JE"wb
Rg:f00
/Jrr"e%we
\+2Rw2wa"F
JkVwbEeu
)C/wwe
eMw]<w
zg:fbS^eu
<Fg2fbeug"V
Cb{^eu
/Jrre
ewMigu
Zx,Ia'ZVw
4euV3y
4eue0wr
BbeugNw
<eufVw
/Jrre
Zmew[h
eue0wr
e%wwwe
Zmew[h
eue0wrZ
e%wwwe
Rew[jRZ
)C/wwwe
Rew[jRZ
)C/www
JkVwbgZeu
Bbeu,Yww
JkVwbZeu
Bbeu,Ywwe
Zmew[h
eue0wre%wwwe
C/wwwe
Zmew[h
eue0wr
e%wwwe
Zmew[h
eue0wr
e%wwwe
]<w^wTvVa:nbg?eu
uiohr1w
Dwa2Jbeug*Ju
g2VbUeu
beua:J
beua"Jb[eug:J
g2VbVeu
eude{z
<@bKeug:J
g2VbVeu
bWeude+z
bo>eu)C.swwwe
J+2fwMw] wZwTvRa:jbk2eu
 u5bKeug2f
JZhJguJt
g"^.qe
2b0eua2Rbdua2Vb
dua2Jb
,SIwwe
*vw+2VwMw"w
<'"uw4Rew[jRF
Meu+2fwMw]<w
Za2fbeua"V2w
 6f2^beug"V
a2fb/euV
LWwNDqa
PNf2ZbKeug"V
reb{3eua2Vb
dua2Jb
2eu)C.
*+2fwMw],wNw+2Vw2wa"N
reb#euZik
#wbNeug
Oeua2bbeud2>
pJg2&b
Na"Zbeug"Z
=@beug"Z
=@beug"Z
Ja2fbeuV/
 wb+neug2fbCAeue!w2
a2fb2euV
/Jrr2e
eug7Iwwb7eu
Z/wbWeu
r:wYbGeug7Iww
"g2fboeu+2bwMw"w
%wg2Rb
Ig2Rbeug7
Fg2Rb?eug7
$Cbeua2Vg2Rb[eug7
7eu)C.se
wrbe4wo
a:NVwbheug:N
BbG`euo*
b7eu,SIwwwe
J+2fwMw]<w
eb1euo
g2ZbeueHe
Ig2Zbeug7
as'e(Zk
Za2Vbeug"V
(%wwwe
w%wwwb'eu/wwwIwwwwIwwww*'
Fr*eb'
Jrr~eC.{e\<&
'r.*e3
ebeuTgK
SIwwwwu
ewwwv+sfD5
<RP/[w
&wwwwwwwwwwww0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:
'oMSv"w
f^V\QTTYZhB
p>[B)
0123456789ABCDEF
Q$^p8G
AP~uu\T
KV]~rhk
FPC 3.0.4 [2018/02/25] for i386 - Win32
 A9/3!O4
)rMg+w
6Z;l#Ex
eC}y !RH
[7@=DiA>
)PU$-W*
Cw,b%QD[V~
0CA(u9k
CFK2o
!|9!r`^"Nl
'r{B:A6_
%8tP&e
w2E1CBzD
b&@Z/A4!{
pW^N&t
)E29wO
Fx*M/irB
v~7;p}
'c&%Z^
$Z{9Zxl 
?Ey,Zi
k![6Wy]
/(j9xb4.}
B:,8}d"f
q%ZCkXpWNwq*vhy
>s#HF'
`N;VJIO2
E`BT>!t
9&e3L2O
ESiNQ)
zM_2)|
"bAzprB)kr
|2|).Y
ZZ2o_#Y6ly
mQ`H3$
24f`:d
"^&rAZ<Bu(qU
IA/ *(zYR_"
'AIEY$Z
8_g]7Gz
s;7iIFTx5&nv;YJAu+q
}LeFntR
`H`N@z!
N2"Xu7
o9W5zJ2
NtX~.^6
3\uj%$SxI!QK
N48jxDjh
 x^0aL#2
2@PgKwlyQ
gX_]$
7+2&6BFk,P!-
NtX6cC
2cB5FZ_
WZ|-VF7'
G^O3CC
,]R8"Z
M.AKq[9&ZK
AR:6npiW\c
qf#mH#
9ux.ap=Uf;
%{1D*8Jk!eZ
JVj481
:V|>O8T(c^7=
R14xw1
#_~n vqyo/
O8ZFj[q
>/yJSpl
("P73lB} 33
"PZw8K0
("YBj=PZWlKVo+Bl6S
ED^A1{Y
9y. )VQ
cl*SjeA
 _BzDt;6
GDD/&GH
n~-7im{$VFG
PF \G7I2=~
9?8v4En{od
Uw.g *lzMlH
[N)=u<
ct56OU
seeRAcL
c0@]o2K
1& I(N0
m0p.!h
[cA}*o
2KF3: ?u
G%63[E$k>%N
}T#/S#
q]?J${3o
k!V^>F
;s0dzp
8@C0(7
omrJ6h8B
EpUnDl
?^mx6[
6=5X&P_]L>
&opKxMY]#yWF
DEe}g
CGKYEO6
O7rt$~
;@GE&Sid'
g@V[T
YH'R"g
?QN}*"
"NQ>nu
~',Lc2h }
cjNmJ2
Do!Dl6R
+LfqZDA<
}Az<xB)u|
t& DED
ZB*a9H
dJ9@kD
a 5,gEJ
mnK90=
C19vc."Ix
U.kzkGnA
Z5~[kcLC
G8sYAQd:
iV)Fngbs]
%:4.K.G'O
JC_2'~y
mR8.4 
TxW8b@?Q{
icjCNQ/#8?B
mRL".B
=:FN<$'9e^F
zE6U3]=i%O}
fWB_Dz? *S
V\#q,N
w.PWD],s
(9}^>h6)^o
"}l w%&tTTt
+COD#EG3@
}2[88
0B2PQZ$N
#-ChB5
&#NNAG:3
D}8{6CFX5r
qM[V#bY>
?py?*b;
6<BvDz_Un|
8xsA^B&
 )wMME\K||
E;9K0VL
}4Uf-@
``u0pd/N
bB^%l`'wFU4q;b
f_Qe\B>[
E]7jb87
3_iC}_C
v9I4SS$q4`w
*gP\[Q
~V Wa6
YeOa%?6CGu
7mUM]"
9v@EX/oHDbLy
$99<<I
A II[T
2Dd9=CE+
0VWsH5
W'#"ea
p\`"ud
I,>3d]d
l(r~a
#%GhB-^
e$n%(
y?*-O8
!p_l:pMA
?S"J3s
8Do|#%GhB-^
-@FT,;2t
/\4i_8L
=Yr3e"\y(c@<
K9_MxL
rN8i5_
9\* es
BV'Y2G
OGHO'm
X3V8tV
v/Uw\z0i46
;'LDO;
'~+y;VF
WZP"`K
%r^Vw$"e#
]TDJ7s
$p'[/F
j/6):PE$]
m(Zh4hk
nKFy(m
*lWM&@r.ZW
-8+Gn#{
7 bOAIF~gp
I/CrBM,ZI
1/KB/5
lDeBJbF7
OCJAV!
K z%2>t
g/AEJ+
a-J64Oh*%kxoe
'L2-S#
GGO.r=A;
\y[].4V
yKdDri[~
\S[W@iaSQ4B
oV8I27$
gB*;|?i
h,MRK8C${R
cF>x_%e
ow/i 7
pdZ-NeS
E<|(J{
`dH#w6at
NAFv~4<[{
p=VnZ9S
22?5N"J<_1
UDirm Fhq
LzGn #
c&{T".
adK~g9
Ad%2U$
2SY|?Inf
Sp]!F6'"
bD&').aE4@Y\Od/+xE;c
GE@l{c_p2O
oLDi=@2jQ@'IA
@p?=X'lE`1
0Lh9"38/"
}ltqRsl
pWNS}/#
jFH`Jb
C{keD=
${rStF|
pUp+S6
r4Kgozf
+7+Z).>D6
R!!c9u:<K
d_!C<nV
-O87bgg4X
~jR|n+
B:7-Vh
q?D$-4(j03
v$K6Gb~{':
g l6G$
!AT<6`dO2
Vr9hmFR
R$i|?i&
yLA+BUK9H
%b6xe"EDl1
xmX,GAXqB'(cA
Sg2oZhq
GMmN42op
\8!G (3
AXc*Vs~X
j0D"_`0
q6FRZ%.4 }78L
^<,~3A5mo
Y3Z ?^~
cPqUD0
F[B$sb3#
?4gN?P``1j<,3
}IMooo{
H|c{EO`g!P
OfX',r
sGv1V69]
x8e\@DF""
7rXqB?61Q^U
B`{Y-0<x#MD#${:a
1p,XCm
-=LY:7O}T
-2YN)SJ
o>S'-dD
petLAz
/V*rk4:
;2_aF^1
Q=Jc%x`f
yygA[Z
&Q%G+o \H
70txaL7
X<LbxE!B/
j|9%N7]
o)`JNd|~
N]ODABwNy
/0hfX!r
CCU;]=5
DA0sD{u/3"/%`
-#/LDI
*jFh$4%`8e'y
N"m<-oA5<
fX35p+`"Lw2frY]&
f]t=(`|Jg[
HW2@#+|82E@m5
nrtn@mAh?Ky
$ I4>4aP
}s,Av(I
p=>:07)
er:#0=t
3nKsUh
o/?emO
@J@B 9
{%NG&qXGF 5
]@3NX$U
F67^onDj-
R\DZ@P:w
WM[X/u
;niA.A2
]L ^i6b&P
|xja8)
{Y#mceH
3oZ%nwfrb^1
?kzo;z[BaM
oj:A3AK
wZ4xX7
8Lo_/EJILN%xP
41vQwJy
[8k"nB~
B>UE*R
IaERm6Gmm/Z
!-siBUiw
"Q'#]?ND
0t3*/v.
bnz|XQ
28?'hJ
M9q>;Mk
/J>#k?Pt
U;T6Kg
JobK0mE`
oko1x]y
vCMBV
cQ(j2K]
c;#DFH
K$Rilt
i=(j96
"hg\SJ@
]B'l%2
n%0Q4/[
BhQ<=8N
L)Y6pq.ZK\
T_62)Cu
lw'\C@> /W3
0!hh9)
?scF[N\
T/MW IK
#bO=i.
2%C_EPT+KqZ
JO;6F4E
z=TQOQql
Q%r{>l
&xYBnN
E9D) ;6
z]edJF
6e@ t^(
LD#anvkp
*FSB9$`v4
VA{'O"<~
oGP>JZK
 X-r*G
Cj"|whh[tF
"MA|bQG/2@kG0b
X@G02ol
zRq[b|
L2].%uB
5%Mg`=
E+K.:;V/'Y'U
<|w&#HFh}9
<g\Sk@'
6'BvF^
#<3ACB
@O2fpY>
,]z'm4>U=
"fs8HJ)
SUG8rL17H2u
Vpirpe
YN*(l(7
aGsB_m-
ZiI"vp_W
z'umB@
Ka`{lHeiGQ.+e
Fn5eN4`=
webv%I
~JAp~^
nrjZ2k
&%O1)@
L2oO2B
l:B|zN' z
"KG4({
0~2iy'
RlB@fU,
9&2.%"PPc]Q<
/Km*Bk4B)"ED
aRClcNW
O#kjxT
r3G~n@ W?
v5G#2h6Oy[ZP
OH1CeFA:4
Vp~6a|
#?nQt!O
A6@rfg
Zh`Kui?
VWLOq@
5KYLFS'=%q
o9;JH^
!FFi$P
`E[O4Vh
CXaE@m0Do+ZL)i 
lmi<-7OL
BvSJiQLbB\/<9
n FP7%
wC qy)
mI\g"4
RUF^9*l
O>ac*jNk
0-"j94_X
JB;NY^#!Fo/v)P
>38]wL9(2%
y-44_`)&C89)
_EfCyDJed9
T9"6xZ
kRNxnn
|&Edt'H#
l@;iH&gfuT=\
cS!oa9~CKD
bA_=U6X
cD@{,qK
&p+4ju'^j~
/r/n"fN0
#]oLDB^d<
siH,gsu
.i;ce(
G'iL25Cm
1=cQwx_eZ
e{t[4]?
ivk`dk
wHiYt&d4\A
\h7>,^fFd<
aV!bU"y
H7nbfk0
?MQo"7J
OdZi=2
,$p#bi.
Cct0H4 *y
-\.=6JGK}|%?
E`E6G;[`&@F\
F3aM1A
:#_S]Bg92$GF
UDBT<W/  N6K7
n(xPC,CaJy
<D}=BP
dEk6`9
pT~vd W[kBc
P`;DYMl/#
6%`gKN^
yQo.lZ%iu
C^`LOGp
(6[Q\-
-9GP!6
m" c?m)<)
fsV|M:_+,sU_M
fOMm= 1
!bcepHo
Z6Z?zS}Vv
;zCb J-b")
{j6sn4p
#>@R^L
y)X9avQF/l"
V7<L/yh
>Q07Z!mYB
k#ig~b
@IcRoTp4&?E
{SZa=%x
(&N^Nl}
.C?J2PH
_'Q4hOG`1
'$kcUu
?.ay"vTF0#+
CLD//OS6U
/c{6MhkG
_178~
h.*;Vc'Y1?]Nw7
"zN+&z
*/65;XI2a`
kBU)6
9ef^Bt
lOGDr%&
~m WokB
\W0v\:
s|3`Bs(.ju9 K
JVc1!ISC'Ct
Rv-oh74,rlFd8
PV+uIk
aDgJ=$xkV,yQ<C/
cW @,#Wi
&wMGbfOC
jO(o:(r
[a<m)\S@'
D7{:P3
3LIVtE
rfb/NdUGHlx@C
bKE_\b:@qv
HeGF %#*
.:?m/$2VNcR
E]7A0$
v?tOw/!|O
*tHM~X;
rbZN%(2xY
z'RemKv
Ci8A76))
G,4a1h
R?BFU$_8%
HUcF!_
dD!83#m`Gx[5
xMSU8"v
5zDsB]#fP
u?</9V
>|Sz^O
e\@&;Q3K
=N$i%j]Z
Me_N)au
.Z12!bU 
z9#vbdD:}
7..`d(
qN2hhO
[$H|Vc
2vIqw3vH%
-I_3gt
Q4LG*LZ
 KOJi}?#e4Jv
X.b`'
\P/Jcn"
e3nw~[kkCY=k
sc@~C)
#wZl _Q
,`7Uaa
"HC'JEze
epotFT+^xoN
j<`PC&
?#i*z|h4!
bO^m5xp6
SGAa?x
"KfRX[q
=VK5e0x+x
 WJ_5x
]|}E$V
OGKb;G
%|MVO(
kUobNU
V;;36!g0.d
GT.r<f
aBw+I\g
P,ud{b=S
0f+5J\
oP\a~0
'q7.ueP#qQ[obX
W`WDb^Cx
jA|/ogwgW
p.@|0P])F.=
}#,Brj7.
o&y,?cbk
o+E6pdY<e
o+iagu_
oocv~t#,S
^.y!kc.tuJ
7^6b!^
L\P.9}
.Wx$AN5Rk
ic`bv8(mQ
R&QGtBvU
hi2Mj|V9$S\
nk6ol!
M~W(vGV;6Er
`hpZ&N
E^4LT3
,@FzZ)s
E,P6N!L
(/EoZB
R"y"ica'3]#k
KZ*6^6#!J
=`Qa`[v6SU(G
BD6[3<D@
CAxv7F
xO%rteq
H'NswW\
2!779!
{"( zv
tW"d!xC
pXFS8wIppR#XaQ
XT@Wp.^]
J0l#Nc
?7o'_YF
zs?|Xb\~C
tR\W|LK
CB~QsM_C
\ng80%
F#BBdm
2[a`^u6S\gFg|
0j#<Eh#
(z*.ag
vW=bSsuD\_t@bl|
CBjLXH
WKwT"y
-[ccna
uYStMJb#&'
]H]Nf;SS
}]OyFE_IEK
7W|=Pp~
ug"modt}Qma\x'AP
dd Exp"
]#XCXI
QcPEEZtU`!i
o|Rma_Jbh\
xFwrih
f5V(d%j1.faW5V"7
:qUPMqKQ
oESuLAUNRP
r_@XqwI`jB|IhA
SF@Q}HOS{VO2
gDU mA
H3vflPa-
PQNY6Hr{tjKC}/
OORJ}n[_
 {9rIG
Vzgn7s
'vU5wGFO
qsHo|B|V~I
YQVY`RXMjMQsF
lZQuQIR_NW
seZ\XyxDlpZlTcO
YACBfRX_
lt}_mw6<
2\V;@cg
I)y!p.Xc
dF< ^wBdlSGZFd
AKUo/<
,Oo)MoO<kyraq
/Jr uKA^
A8"%M2=.Ueu!ts&p/`
ipL\sKWSNOK
]wwrKSrKbd
QAtZ)r
7y4zc`
qhPUo\b/9fB
+CMo^Ce
ttmz-|
du6!Byod$C
v".ffT'kX@#/
sonKWjoJWM9L.=N
^o2UR.V9.aq
s,|'`]"F$F:
EZbWWyCfdGj
zogkyr2lp`VM'TM
`xSp{eoo
CgL5fVU"+EU#`
ZgZnW
oo"oqh
kGTnWXSE@\
Z'WGvV&
4|6oE@
`@]*-IbMrBTB\Vl@wNk+j
Sm1S\3VCoNkyeoq
eDNGg6J?jR`]*'
UKgCYnY
ELf ,V
<MPrXO=Q
XT=b]{#mVer
RAwEmS
Y\Kz@\`W
dXDD~bSykWn\a[
IBWrBMvF
cVSpJR_CO|*B
!y/ztqW/pPW
.iRj@
[oHVZc
|YWGgI}N(
DCC96
ODFd314
B2058*S
_~Is[GAVT
U;DtJkPKD}48 `
XDcBYxN
+pj~kBd4
51WN^dp
3U3#L}
(KMUIS\gZ
OFB{1^}*BbXb
I45ELxVsq
)D"L(#-fc
Yd\<+{_
!CUJ-8
#d2N7&_\mS]&k
f+J}2S
605_P@
Fw8Px(o{
9DGoN.
7t&PC=_G9}\A'5w6
q@E\@G
;5}O-;2@
DA~3O4
U)= $'W
?p!NBv
2@\O=4$Z.8 K;
~F[rGG"zUGAOu
V/D<:V#q)DJ'pv2$N@
UB;!*$'9
D\8w";Y
\Oe$.? K;g
D#Lx%?
B{"=i W?p
Q,Vx]p
Ne+6Z! b
K#g1Y\J5d0yL+ay
)!8WSZl5
)/;E#o;5'}OM[
Z3@RO>j<$E.>Z
fM7.z"S
KB{]=itb'
6OP!-kTO4
p(8[V.P
wd/xao[
ojcud808
Qhytml;-i
]oQdPL146qm wvJ.fG
\fM%B`Cy
J$k[;/mV
qeeo7)
~WHtZe
(kz-}k
S^OZ
lW8#@?%[=
W8T@?y[=x
>LT %W
E@P.@2
E`@P.v2
ZczNin
TW#a"au ,_ws|U
dOXKzN1H
}gu9@I|_
YIqeayt&M
!N}0%C
L3hME!1T
wtFBrZLPIJ|(gzAtA}
G[egjHrB
DtJ6=@m/
uaWXRy
U+)BPOjD
%iMa#Bsxm
E@s'[J:v
} dj'/S
@FPK(Fv
O,^xwrSXj
r>xBgN
wwZ5wZ5wwv
ew5wwwj5ww/5wzl7
m7jm7n7y7y7y7y7n7o7
h7*h7:h7www8
wwwwww
wwwWwww
wwww_wwwW
wwYwww}www
wwww;>wleuwwww5
wvwwww6$
ewa'Yp
ewa hpwvu
ewa6{wvu
ewa<px:vu
:w66%6o666
6O6q666?6y66686w~
5w/5wzl7
m7jm7n7y7y7y7y7n7o7
h7*h76w
5ww/5wzl7
m7jm7n7y7y7y7y7n7o7
h7*h76w2
e55wwwF
5ww/5wzl7
m7jm7n7y7y7y7y7n7o7
h7*h76w>
55wwwf
5ww/5wzl7
m7jm7n7y7y7y7y7n7o7
h7*h76w3
5f5wwwx5ww/5wzl7
m7jm7n7y7y7y7y7n7o7
h7*h76w%
5l5wwwx5ww/5wzl7
m7jm7n7y7y7y7y7n7o7
h7*h76w>
e5Rl5wwwx5ww/5wzl7
m7jm7n7y7y7y7y7n7o7
h7*h76w:2
el5m5wwwx5ww/5wzl7
m7jm7n7y7y7y7y7n7o7
h7*h76w>
el5Jm5www*x5ww/5wzl7
m7jm7n7y7y7y7y7n7o7
h7*h76w-3
el5n5wwwNx5ww/5wzl7
m7jm7n7y7y7y7y7n7o7
h7*h76w8
el5"n5wwwnx5ww/5wzl7
m7jm7n7y7y7y7y7n7o7
h7*h76w"
e>5o5wwwy5ww/5wzl7
m7jm7n7y7y7y7y7n7o7
h7*h76w>
o5wwwy5ww/5wzl7
m7J6n7y7y7y7y7n7o7
h7*h76w?:
e5h5wwwy5ww/5wzl7
m7jm7n7y7y7y7y7n7o7
h7*h76w2
y5ww/5wzl7
m7J6n7y7y7y7y7n7o7
h7*h76w>
eo5i5www"y5ww/5wzl7
m7J6n7y7y7y7y7n7o7
h7*h76w8
e>5i5wwwFy5ww/5wzl7
m7jm7n7y7y7y7y7n7o7
h7*h76w>
e>5zi5wwwzy5ww/5wzl7
m7jm7n7y7y7y7y7n7o7
h7*h76w!
e5j5wwwz5ww/5wzl7
m7jm7n7y7y7y7y7n7o7
h7*h76w6
ej5nj5wwwz5ww/5wzl7
m7jm7n7y7y7y7y7n7o7
h7*h76w5
e5k5wwwz5ww/5wzl7
m7jm7n7y7y7y7y7n7o7
h7*h76w'
e5Fk5www
z5ww/5wzl7
m7jm7n7y7y7y7y7n7o7
h7*h76w$
e5d5www"z5ww/5wzl7
m7jm7n7y7y7y7y7n7o7
h7*h76w4
e>52d5wwwBz5ww/5wzl7
m7jm7n7y7y7y7y7n7o7
h7*h76w4
e>5e5wwwfz5ww/5wzl7
m7jm7n7y7y7y7y7n7o7
h7*h76w6
e>5"e5www{5ww/5wzl7
m7jm7n7y7y7y7y7n7o7
h7*h76w6
e>5f5www{5ww/5wzl7
m7jm7n7y7y7y7y7n7o7
h7*h76w8
f5www{5ww/5wzl7
m7jm7n7y7y7y7y7n7o7
h7*h76w>42
e>5g5www
{5ww/5wzl7
m7jm7n7y7y7y7y7n7o7
h7*h76w8
g5www"{5ww/5wzl7
m7jm7n7y7y7y7y7n7o7
h7*h76w$
e>5`5www^{5ww/5wzl7
m7jm7n7y7y7y7y7n7o7
h7*h76w9
`5wwwv{5ww/5wzl7
m7jm7n7y7y7y7y7n7o7
h7*h76w9
5a5wwwt5ww/5wzl7
m7jm7n7y7y7y7y7n7o7
h7*h7:h7y7y7y7y7y7y76y7y7y7w2
ewMwvu
ewwGwvu
ewwGwvu
ewwwwvwwwwwwwvu
wwJww2
8nl5x5
ewowvu
ewwewwwmwvu
ewwwwwwwvu
ewbwwvu
ewbwvu
ewIwvu
ewCwvu
GetLastError
SetLastError
GetTickCount
ExitProcess
GetStartupInfoA
GetStdHandle
GetCommandLineA
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
ReadProcessMemory
GetModuleFileNameA
GetModuleHandleA
WriteFile
ReadFile
CloseHandle
SetFilePointer
FreeLibrary
LoadLibraryA
GetProcAddress
DeleteFileW
MoveFileW
CreateFileW
GetFileAttributesW
GetConsoleMode
GetConsoleOutputCP
GetOEMCP
GetProcessHeap
HeapAlloc
HeapFree
TlsAlloc
TlsGetValue
TlsSetValue
CreateThread
ExitThread
LocalAlloc
LocalFree
SuspendThread
ResumeThread
TerminateThread
WaitForSingleObject
SetThreadPriority
GetThreadPriority
CreateEventA
ResetEvent
SetEvent
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetConsoleCP
SetUnhandledExceptionFilter
EnumResourceTypesA
EnumResourceNamesA
EnumResourceLanguagesA
FindResourceA
FindResourceExA
LoadResource
SizeofResource
LockResource
FreeResource
GetWindowsDirectoryA
CopyFileA
CreateProcessA
GetVersionExA
CompareStringA
GetLocaleInfoA
EnumCalendarInfoA
FormatMessageW
CompareStringW
TerminateProcess
GetThreadLocale
SetThreadLocale
GetUserDefaultLCID
SysAllocStringLen
SysFreeString
SysReAllocStringLen
MessageBoxA
CharUpperBuffW
CharLowerBuffW
CharUpperA
CharUpperBuffA
CharLowerA
CharLowerBuffA
GetSystemMetrics
MessageBeep
kernel32.dll
oleaut32.dll
user32.dll
#EUUUT1
25UUUS#
%CEB"$T4Q%U1
25UUUS#
3EUUUT1
333330

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity type="win32" name="WJR.PEview.PEview" version="0.9.8.0" processorArchitecture="X86"/>
<description>PE/COFF File Viewer.</description>
<dependency>
<dependentAssembly>
<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"/>
</dependentAssembly>
</dependency>
</assembly>PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX
VS_VERSION_INFO
StringFileInfo
040904E4
CompanyName
Wayne J. Radburn
FileDescription
PE/COFF File Viewer
FileVersion
0.9.9.0
InternalName
PEview
LegalCopyright
Copyright
 1997-2011 Wayne J. Radburn
OriginalFilename
PEview.exe
ProductName
PEview
ProductVersion
0.9.9.0
VarFileInfo
Translation
VS_VERSION_INFO
StringFileInfo
040904E4
CompanyName
Wayne J. Radburn
FileDescription
PE/COFF File Viewer
FileVersion
0.9.9.0
InternalName
PEview
LegalCopyright
Copyright
 1997-2011 Wayne J. Radburn
OriginalFilename
PEview.exe
ProductName
PEview
ProductVersion
0.9.9.0
VarFileInfo
Translation

Process Tree

0d379ca43c05b63304611b55a1abd62448cef58210c260aad538aa4c796f73da.exe (1612) "C:\Users\Administrator\AppData\Local\Temp\0d379ca43c05b63304611b55a1abd62448cef58210c260aad538aa4c796f73da.exe"
- 0d379ca43c05b63304611b55a1abd62448cef58210c260aad538aa4c796f73da.exe (2108) C:\Users\Administrator\AppData\Local\Temp\0d379ca43c05b63304611b55a1abd62448cef58210c260aad538aa4c796f73da.exe

0d379ca43c05b63304611b55a1abd62448cef58210c260aad538aa4c796f73da.exe, PID: 1612, Parent PID: 2244

default registry file network process services synchronisation iexplore office pdf

0d379ca43c05b63304611b55a1abd62448cef58210c260aad538aa4c796f73da.exe, PID: 2108, Parent PID: 1612

default registry file network process services synchronisation iexplore office pdf

Hosts

IP
114.114.114.114
8.8.8.8

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255 A 131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	53179	224.0.0.252	5355
192.168.56.101	49642	224.0.0.252	5355
192.168.56.101	137	192.168.56.255	137
192.168.56.101	61714	114.114.114.114	53
192.168.56.101	61714	8.8.8.8	53
192.168.56.101	56933	8.8.8.8	53
192.168.56.101	138	192.168.56.255	138
192.168.56.101	58485	114.114.114.114	53
192.168.56.101	57665	114.114.114.114	53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Name	0d379ca43c05b633_old_0d379ca43c05b63304611b55a1abd62448cef58210c260aad538aa4c796f73da.exe
Filepath	C:\Users\Administrator\AppData\Local\Temp\old_0d379ca43c05b63304611b55a1abd62448cef58210c260aad538aa4c796f73da.exe
Size	342.0KB
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5	`d12bf1b4ab8c2828b349289f64b4cf00`
SHA1	`782713535bc9a68d9862ad90249fd7af678a8edb`
SHA256	`0d379ca43c05b63304611b55a1abd62448cef58210c260aad538aa4c796f73da`
CRC32	`FFF7C629`
ssdeep	`None`
Yara	None matched
VirusTotal	Search for analysis

Name	0c092e096b9b76b3_0d379ca43c05b63304611b55a1abd62448cef58210c260aad538aa4c796f73da.exe
Filepath	C:\Users\Administrator\AppData\Local\Temp\0d379ca43c05b63304611b55a1abd62448cef58210c260aad538aa4c796f73da.exe
Size	342.0KB
Processes	1612 (0d379ca43c05b63304611b55a1abd62448cef58210c260aad538aa4c796f73da.exe)
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5	`7312846b0016a30f4877120d671d1cd6`
SHA1	`26ee12c85e20940dca271cdf9a63ea568921e53e`
SHA256	`0c092e096b9b76b339e7a27a8b1d93c89572393831312c57e4116fb8b1833bc0`
CRC32	`6BB83419`
ssdeep	`None`
Yara	None matched
VirusTotal	Search for analysis

Sorry! No dropped buffers.

ALYac	Gen:Variant.Symmi.93801
APEX	Malicious
AVG	Win32:MalwareX-gen [Trj]
Acronis	suspicious
Ad-Aware	Gen:Variant.Symmi.93801
AhnLab-V3	Malware/Win32.Generic.C2583382
Antiy-AVL	GrayWare/Win32.Kryptik.GIFQ
Arcabit	Trojan.Symmi.D16E69
Avast	Win32:MalwareX-gen [Trj]
Avira	TR/Crypt.XPACK.Gen
BitDefender	Gen:Variant.Symmi.93801
BitDefenderTheta	Gen:NN.ZexaF.34144.vC3@aqLBNoc
Bkav	W32.AIDetectVM.malware1
ClamAV	Win.Malware.Razy-6724262-0
Comodo	TrojWare.Win32.Kryptik.TLS@812zm8
CrowdStrike	win/malicious_confidence_100% (D)
Cybereason	malicious.4ab8c2
Cylance	Unsafe
Cynet	Malicious (score: 100)
Cyren	W32/Razy.CD.gen!Eldorado
DrWeb	Trojan.Packed2.41883
ESET-NOD32	a variant of Win32/Kryptik.GIRH
Emsisoft	Gen:Variant.Symmi.93801 (B)
Endgame	malicious (high confidence)
F-Prot	W32/Razy.CD.gen!Eldorado
F-Secure	Trojan.TR/Crypt.XPACK.Gen
FireEye	Generic.mg.d12bf1b4ab8c2828
Fortinet	W32/Kryptik.GIFQ!tr
GData	Gen:Variant.Symmi.93801
Ikarus	Trojan-Downloader.Win32.FakeAlert
Invincea	heuristic
K7AntiVirus	Trojan ( 005393141 )
K7GW	Trojan ( 005393141 )
Kaspersky	HEUR:Trojan.Win32.Generic
MAX	malware (ai score=82)
Malwarebytes	Trojan.MalPack
McAfee	Packed-FJB!D12BF1B4AB8C
MicroWorld-eScan	Gen:Variant.Symmi.93801
Microsoft	VirTool:Win32/CeeInject.AKZ!bit
NANO-Antivirus	Trojan.Win32.PackedENT.fisfht
Panda	Trj/Genetic.gen
Qihoo-360	HEUR/QVM19.1.F824.Malware.Gen
Rising	Trojan.Kryptik!1.B34D (RDMK:cmRtazr/aEakSJo7nVvuD1pCkixK)
Sangfor	Malware
SentinelOne	DFI - Malicious PE
Sophos	Mal/Inject-GJ
Symantec	ML.Attribute.HighConfidence
Tencent	Trojan.Win32.Kryptik.gify
Trapmine	suspicious.low.ml.score
VBA32	Trojan.Tiggre

file	C:\Users\Administrator\AppData\Local\Temp\old_0d379ca43c05b63304611b55a1abd62448cef58210c260aad538aa4c796f73da.exe
file	C:\Users\Administrator\AppData\Local\Temp\0d379ca43c05b63304611b55a1abd62448cef58210c260aad538aa4c796f73da.exe

host	114.114.114.114
host	8.8.8.8